@deslop/scope 0.1.1267 → 0.1.1270

package/dist/server.js

@@ -4839,7 +4839,7 @@ const ServiceProto = {
 	.../*#__PURE__*/ Prototype({
 		label: "Service",
 		evaluate(fiber) {
-			return exitSucceed(get$11(fiber.context, this));
+			return exitSucceed(get$10(fiber.context, this));
 		}
 	}),
 	toJSON() {
@@ -4855,10 +4855,10 @@ const ServiceProto = {
 		return make$81(this, self);
 	},
 	use(f) {
-		return withFiber$1((fiber) => f(get$11(fiber.context, this)));
+		return withFiber$1((fiber) => f(get$10(fiber.context, this)));
 	},
 	useSync(f) {
-		return withFiber$1((fiber) => exitSucceed(f(get$11(fiber.context, this))));
+		return withFiber$1((fiber) => exitSucceed(f(get$10(fiber.context, this))));
 	}
 };
 const cacheKeys = /*#__PURE__*/ new Set();
@@ -5237,7 +5237,7 @@ const getUnsafe$2 = /*#__PURE__*/ dual(2, (self, service) => {
 * @category getters
 * @since 2.0.0
 */
-const get$11 = getUnsafe$2;
+const get$10 = getUnsafe$2;
 const defaultValueCacheKey = "~effect/Context/defaultValue";
 const getDefaultValue = (ref) => {
 	if (defaultValueCacheKey in ref) return ref[defaultValueCacheKey];
@@ -6144,7 +6144,7 @@ const has$4 = /*#__PURE__*/ dual(2, (self, key) => Object.hasOwn(self, key));
 * @category getters
 * @since 2.0.0
 */
-const get$10 = /*#__PURE__*/ dual(2, (self, key) => Object.hasOwn(self, key) ? some$1(self[key]) : none());
+const get$9 = /*#__PURE__*/ dual(2, (self, key) => Object.hasOwn(self, key) ? some$1(self[key]) : none());
 /**
 * Maps a record into another record by applying a transformation function to each of its values.
 *
@@ -6670,7 +6670,7 @@ function isOutOfBounds(i, as) {
 * @category getters
 * @since 2.0.0
 */
-const get$9 = /*#__PURE__*/ dual(2, (self, index) => {
+const get$8 = /*#__PURE__*/ dual(2, (self, index) => {
 	const i = Math.floor(index);
 	return isOutOfBounds(i, self) ? none() : some$1(self[i]);
 });
@@ -6731,7 +6731,7 @@ const getUnsafe$1 = /*#__PURE__*/ dual(2, (self, index) => {
 * @category getters
 * @since 2.0.0
 */
-const head = /*#__PURE__*/ get$9(0);
+const head = /*#__PURE__*/ get$8(0);
 /**
 * Returns the first element of a `NonEmptyReadonlyArray` directly (no `Option`
 * wrapper).
@@ -9856,7 +9856,7 @@ var FiberImpl = class {
 		return this._dispatcher ??= this.cache.scheduler.makeDispatcher();
 	}
 	getRef(ref) {
-		return get$11(this.context, ref);
+		return get$10(this.context, ref);
 	}
 	addObserver(cb) {
 		if (this._exit) {
@@ -10024,17 +10024,17 @@ var FiberImpl = class {
 const makeFiberContextCache = (context) => {
 	const currentTracer = getOrUndefinedUnsafe(context, TracerKey);
 	return {
-		scheduler: get$11(context, Scheduler),
+		scheduler: get$10(context, Scheduler),
 		tracer: currentTracer,
 		tracerContext: currentTracer ? currentTracer["context"] : void 0,
-		tracerEnabled: get$11(context, TracerEnabled),
+		tracerEnabled: get$10(context, TracerEnabled),
 		span: getOrUndefinedUnsafe(context, ParentSpanKey),
-		logLevel: get$11(context, CurrentLogLevel$1),
-		minimumLogLevel: get$11(context, MinimumLogLevel$1),
-		stackFrame: get$11(context, CurrentStackFrame),
+		logLevel: get$10(context, CurrentLogLevel$1),
+		minimumLogLevel: get$10(context, MinimumLogLevel$1),
+		stackFrame: get$10(context, CurrentStackFrame),
 		runtimeMetrics: getOrUndefinedUnsafe(context, FiberRuntimeMetricsKey),
-		maxOpsBeforeYield: get$11(context, MaxOpsBeforeYield),
-		preventYield: get$11(context, PreventSchedulerYield)
+		maxOpsBeforeYield: get$10(context, MaxOpsBeforeYield),
+		preventYield: get$10(context, PreventSchedulerYield)
 	};
 };
 const deferredInterruptCont = {
@@ -11551,11 +11551,11 @@ const NoopSpanProto = {
 const noopSpan = (options) => Object.assign(Object.create(NoopSpanProto), options);
 const filterDisablePropagation = (span) => {
 	if (!span) return none();
-	return get$11(span.annotations, DisablePropagation) ? span._tag === "Span" ? filterDisablePropagation(getOrUndefined$1(span.parent)) : none() : some$1(span);
+	return get$10(span.annotations, DisablePropagation) ? span._tag === "Span" ? filterDisablePropagation(getOrUndefined$1(span.parent)) : none() : some$1(span);
 };
 /** @internal */
 const makeSpanUnsafe = (fiber, name, options) => {
-	const disablePropagation = !fiber.cache.tracerEnabled || options?.annotations && get$11(options.annotations, DisablePropagation);
+	const disablePropagation = !fiber.cache.tracerEnabled || options?.annotations && get$10(options.annotations, DisablePropagation);
 	const parent = options?.parent !== void 0 ? some$1(options.parent) : options?.root ? none() : filterDisablePropagation(fiber.cache.span);
 	let span;
 	if (disablePropagation) span = noopSpan({
@@ -14724,7 +14724,7 @@ const unwrapKey = /*#__PURE__*/ Service$2("effect/Layer/unwrap");
 * @category converting
 * @since 4.0.0
 */
-const unwrap$7 = (self) => flatMap$4(effect(unwrapKey)(self), get$11(unwrapKey));
+const unwrap$7 = (self) => flatMap$4(effect(unwrapKey)(self), get$10(unwrapKey));
 const mergeAllEffect = (layers, memoMap, scope) => {
 	const parentScope = forkUnsafe(scope, "parallel");
 	return forEach$2(layers, (layer) => layer.build(memoMap, forkUnsafe(parentScope, "sequential")), { concurrency: layers.length }).pipe(map$7((context) => mergeAll$2(...context)));
@@ -16772,7 +16772,7 @@ const empty$9 = () => {
 * @category getters
 * @since 2.0.0
 */
-const get$8 = /*#__PURE__*/ dual(2, (self, key) => {
+const get$7 = /*#__PURE__*/ dual(2, (self, key) => {
 	if (self.backing.has(key)) return some$1(self.backing.get(key));
 	else if (isSimpleKey(key)) return none();
 	const hash$3 = hash(key);
@@ -29236,7 +29236,7 @@ var HashMapImpl = class {
 			const thatImpl = that;
 			if (this.size !== thatImpl.size) return false;
 			for (const [key, value] of this) {
-				const otherValue = pipe(that, get$7(key));
+				const otherValue = pipe(that, get$6(key));
 				if (isNone(otherValue) || !equals$2(value, otherValue.value)) return false;
 			}
 			return true;
@@ -29282,7 +29282,7 @@ const fromIterable$5 = (entries) => {
 	return new HashMapImpl(false, 0, root, size);
 };
 /** @internal */
-const get$7 = /*#__PURE__*/ dual(2, (self, key) => {
+const get$6 = /*#__PURE__*/ dual(2, (self, key) => {
 	return self._root.get(0, hash(key), key);
 });
 /** @internal */
@@ -30225,7 +30225,7 @@ const TypeId$50 = /*#__PURE__*/ Symbol.for("~effect/http/Headers");
 const Proto$18 = /*#__PURE__*/ Object.defineProperties(/*#__PURE__*/ Object.create(null), {
 	[TypeId$50]: { value: TypeId$50 },
 	[symbolRedactable]: { value(context) {
-		return redact$1(this, get$11(context, CurrentRedactedNames$1));
+		return redact$1(this, get$10(context, CurrentRedactedNames$1));
 	} },
 	toJSON: { value() {
 		return redact$2(this);
@@ -30648,7 +30648,7 @@ const Proto$17 = {
 	[symbolRedactable](context) {
 		return {
 			_id: "UrlParams",
-			params: Object.fromEntries(redact(this, get$11(context, CurrentRedactedNames)))
+			params: Object.fromEntries(redact(this, get$10(context, CurrentRedactedNames)))
 		};
 	},
 	toJSON() {
@@ -30861,7 +30861,7 @@ const decodeQueryKey = (key) => {
 		return key;
 	}
 };
-const currentRedactedNames = () => get$11(globalThis["~effect/Fiber/currentFiber"]?.context ?? empty$14(), CurrentRedactedNames);
+const currentRedactedNames = () => get$10(globalThis["~effect/Fiber/currentFiber"]?.context ?? empty$14(), CurrentRedactedNames);
 /**
 * Query parameter names or patterns to redact in inspection, spans and errors.
 *
@@ -36924,32 +36924,6 @@ function toRepresentations(asts, options) {
 }
 // ../../node_modules/.pnpm/effect@4.1.2/node_modules/effect/dist/Struct.js
 /**
-* Retrieves the value at `key` from a struct.
-*
-* **When to use**
-*
-* Use to extract a single property from a struct in a pipeline.
-*
-* **Details**
-*
-* The return type is narrowed to `S[K]`.
-*
-* **Example** (Extracting a property in a pipeline)
-*
-* ```ts import.meta.vitest
-* import { pipe, Struct } from "effect"
-*
-* pipe({ name: "Alice", age: 30 }, Struct.get("name")) // => "Alice"
-* ```
-*
-* @see {@link keys} – list all string keys of a struct
-* @see {@link pick} – extract multiple properties into a new struct
-* @stability stable
-* @category getters
-* @since 2.0.0
-*/
-const get$6 = /*#__PURE__*/ dual(2, (self, key) => self[key]);
-/**
 * Creates a new struct containing only the specified keys.
 *
 * **When to use**
@@ -41572,7 +41546,7 @@ const publishUnsafe = /*#__PURE__*/ dual(2, (self, value) => {
 * @since 2.0.0
 */
 const subscribe = (self) => uninterruptible(contextWith((services) => {
-	const localScope = get$11(services, Scope);
+	const localScope = get$10(services, Scope);
 	const scope = forkUnsafe(self.scope);
 	const subscription = makeSubscriptionUnsafe(self.pubsub, self.subscribers, self.strategy, self.ended);
 	return addFinalizer$1(scope, unsubscribe(subscription)).pipe(andThen(addFinalizerExit(localScope, (exit) => close(scope, exit))), as(subscription));
@@ -45598,7 +45572,7 @@ const makeUnsafe$3 = (options) => ({
 */
 const make$55 = (options) => withFiber((fiber) => {
 	const context = fiber.context;
-	const scope = get$11(context, Scope);
+	const scope = get$10(context, Scope);
 	const self = makeUnsafe$3({
 		lookup: options.lookup,
 		context,
@@ -45665,7 +45639,7 @@ const get$4 = /*#__PURE__*/ dual(2, (self, key) => uninterruptibleMask((restore)
 	if (self.state._tag === "Closed") return interrupt$1;
 	const state = self.state;
 	const parent = getCurrent();
-	const o = get$8(state.map, key);
+	const o = get$7(state.map, key);
 	let entry;
 	if (o._tag === "Some") {
 		entry = o.value;
@@ -45699,7 +45673,7 @@ const get$4 = /*#__PURE__*/ dual(2, (self, key) => uninterruptibleMask((restore)
 }));
 const removeInterrupted = (self, key, entry, context) => {
 	if (self.state._tag === "Closed") return;
-	const o = get$8(self.state.map, key);
+	const o = get$7(self.state.map, key);
 	if (o._tag === "None" || o.value !== entry) return;
 	remove$5(self.state.map, key);
 	if (entry.refCount > 0) return;
@@ -45713,7 +45687,7 @@ const release$1 = (self, key, entry) => withFiber((fiber) => {
 	entry.refCount--;
 	if (entry.refCount > 0) return void_$1;
 	else if (self.state._tag === "Closed") return closeEntry(entry);
-	const o = get$8(self.state.map, key);
+	const o = get$7(self.state.map, key);
 	if (o._tag === "None" || o.value !== entry) return closeEntry(entry);
 	else if (isZero$1(entry.idleTimeToLive)) {
 		remove$5(self.state.map, key);
@@ -45727,7 +45701,7 @@ const release$1 = (self, key, entry) => withFiber((fiber) => {
 		const remaining = entry.expiresAt - now;
 		if (remaining <= 0) {
 			if (self.state._tag === "Closed" || entry.refCount > 0) return void_$1;
-			const o = get$8(self.state.map, key);
+			const o = get$7(self.state.map, key);
 			if (o._tag === "None" || o.value !== entry) return void_$1;
 			remove$5(self.state.map, key);
 			return ignoreCause(close(entry.scope, void_$2), {
@@ -45769,7 +45743,7 @@ var RcRefImpl = class {
 /** @internal */
 const make$54 = (options) => withFiber((fiber) => {
 	const context = fiber.context;
-	const scope = get$11(context, Scope);
+	const scope = get$10(context, Scope);
 	const ref = new RcRefImpl(options.acquire, context, scope, options.idleTimeToLive !== void 0 ? fromInputUnsafe$1(options.idleTimeToLive) : void 0);
 	return as(addFinalizerExit(scope, () => {
 		const state = ref.state;
@@ -53267,7 +53241,7 @@ const Strict = /*#__PURE__*/ Reference("effect/ai/Tool/Strict", { defaultValue:
 * @category getters
 * @since 4.0.0
 */
-const getStrictMode = (tool) => get$11(tool.annotations, Strict);
+const getStrictMode = (tool) => get$10(tool.annotations, Strict);
 /**
 * Schema for denied or interrupted tool calls.
 *
@@ -60680,7 +60654,7 @@ const makeNoSerialization$1 = /*#__PURE__*/ fnUntraced(function* (group, options
 	const disableTracing = options?.disableTracing ?? false;
 	const generateRequestId = options?.generateRequestId ?? (() => requestIdCounter++);
 	const services = yield* context();
-	const scope = get$11(services, Scope);
+	const scope = get$10(services, Scope);
 	const entries = /* @__PURE__ */ new Map();
 	let isShutdown = false;
 	yield* addFinalizer$1(scope, withFiber((parent) => {
@@ -61027,7 +61001,7 @@ const makeRpcSchemas = (codecFor) => {
 		let entry = cache.get(rpc);
 		if (entry !== void 0) return entry;
 		const streamSchemas = getStreamSchemas(rpc.successSchema);
-		const parseOptions = get$11(rpc.annotations, ParseOptions);
+		const parseOptions = get$10(rpc.annotations, ParseOptions);
 		const exitSchema$2 = exitSchema(rpc);
 		let decodeDiscardExit;
 		entry = {
@@ -68122,7 +68096,7 @@ const isMultipartError = (u) => hasProperty(u, MultipartErrorTypeId);
 * @since 4.0.0
 */
 const makeConfig = (headers) => withFiber((fiber) => {
-	const mimeTypes = get$11(fiber.context, FieldMimeTypes);
+	const mimeTypes = get$10(fiber.context, FieldMimeTypes);
 	return succeed$5({
 		headers,
 		maxParts: fiber.getRef(MaxParts),
@@ -71464,7 +71438,7 @@ var MiddlewareImpl = class MiddlewareImpl {
 			const stack = [getOrUndefinedUnsafe(context$3, fnContextKey)];
 			if (this.dependencies) {
 				const memoMap = yield* CurrentMemoMap;
-				const scope = get$11(context$3, Scope);
+				const scope = get$10(context$3, Scope);
 				const depsContext = yield* buildWithMemoMap(this.dependencies, memoMap, scope);
 				stack.push(...getMiddleware$1(depsContext));
 			}
@@ -71519,9 +71493,9 @@ const serve = (appLayer, options) => {
 	const layerWithRouter = provideMerge(appLayer, options?.routerConfig ? provide$2(layer$18, succeed$6(RouterConfig)(options.routerConfig)) : layer$18);
 	return contextWith((context) => {
 		const memoMap = CurrentMemoMap.forkOrCreate(context);
-		return buildWithMemoMap(layerWithRouter, memoMap, get$11(context, Scope));
+		return buildWithMemoMap(layerWithRouter, memoMap, get$10(context, Scope));
 	}).pipe(map$5((context) => {
-		const handler = get$11(context, HttpRouter).asHttpEffect();
+		const handler = get$10(context, HttpRouter).asHttpEffect();
 		return merge$3(middleware ? serve$1(handler, middleware) : serve$1(handler), succeedContext(context));
 	}), unwrap$7, options?.disableListenLog ? identity : withLogAddress);
 };
@@ -71558,7 +71532,7 @@ const makeNoSerialization = /*#__PURE__*/ fnUntraced(function* (group, options)
 	const concurrency = options.concurrency ?? "unbounded";
 	const disableFatalDefects = options.disableFatalDefects ?? false;
 	const services = yield* context();
-	const scope = get$11(services, Scope);
+	const scope = get$10(services, Scope);
 	const trackFiber = runIn(forkUnsafe(scope, "parallel"));
 	const concurrencySemaphore = concurrency === "unbounded" ? void 0 : yield* make$72(concurrency);
 	const clients = /* @__PURE__ */ new Map();
@@ -71799,7 +71773,7 @@ const rpcCodecs = (codecFor, rpc) => {
 	let codecs = shared ? sharedRpcCodecs.get(rpc) : void 0;
 	if (codecs === void 0) {
 		const streamSchemas = getStreamSchemas(rpc.successSchema);
-		const parseOptions = get$11(rpc.annotations, ParseOptions);
+		const parseOptions = get$10(rpc.annotations, ParseOptions);
 		codecs = {
 			decode: decodeUnknownEffect(codecFor(rpc.payloadSchema), parseOptions),
 			encodeChunk: encodeUnknownEffect(codecFor(NonEmptyArray(isSome(streamSchemas) ? streamSchemas.value.success : Any)), parseOptions),
@@ -71924,7 +71898,7 @@ const make$13 = /*#__PURE__*/ fnUntraced(function* (group, options) {
 			const exitSchema$1 = exitSchema(rpc);
 			discardSchemas = {
 				...schemas,
-				encodeExit: encodeUnknownEffect(codecFor(Exit(Void, exitSchema$1.error, exitSchema$1.defect)), get$11(rpc.annotations, ParseOptions))
+				encodeExit: encodeUnknownEffect(codecFor(Exit(Void, exitSchema$1.error, exitSchema$1.defect)), get$10(rpc.annotations, ParseOptions))
 			};
 			discardSchemasCache.set(rpc, discardSchemas);
 		}
@@ -72491,7 +72465,7 @@ const runMiddleware = (handler, middleware, invocation, request) => {
 		if (isSuccess$1(failure) && !hasDies(cause)) {
 			const error = failure.success.error;
 			if (isHidden(error)) return fail$7(error);
-			if (middleware.length === 0 || get$11(reasonAnnotations(failure.success), HandlerFailure)) return failCause$3(cause);
+			if (middleware.length === 0 || get$10(reasonAnnotations(failure.success), HandlerFailure)) return failCause$3(cause);
 			if (isMcpError(error)) return rejectWith(error);
 		}
 		return logError(cause).pipe(andThen(report(cause)), andThen(rejectWith(internalError)));
@@ -72580,7 +72554,7 @@ var McpServer = class McpServer extends (/*#__PURE__*/ Service$2()("effect/ai/Mc
 					_tag: "Exit",
 					exit: void_$2
 				}));
-				const requestQueue = get$11(fiber.context, RequestNotificationQueue);
+				const requestQueue = get$10(fiber.context, RequestNotificationQueue);
 				if (requestQueue !== void 0 && queued.requestContext !== void 0 && isRequestNotification(notification)) {
 					offerUnsafe(requestQueue, queued);
 					return andThen(_await(delivered), acknowledge);
@@ -73538,7 +73512,7 @@ const registerToolkit = /*#__PURE__*/ fnUntraced(function* (toolkit) {
 			const failure = findFail(cause);
 			if (isSuccess$1(failure)) {
 				const error = failure.success.error;
-				const origin = get$11(reasonAnnotations(failure.success), FailureOrigin);
+				const origin = get$10(reasonAnnotations(failure.success), FailureOrigin);
 				if (origin === "parameters" && isParameterValidationError(error)) return fail$7(new InvalidParams({ message: error.reason.message }));
 				if (origin === "handler" && isDeclaredFailure(error)) return catchCause$2(declaredFailureResult(error), internalToolError);
 			}
@@ -73553,10 +73527,10 @@ const registerToolkit = /*#__PURE__*/ fnUntraced(function* (toolkit) {
 			outputSchema,
 			annotations: {
 				...getOption(tool.annotations, Title).pipe(map$11((title) => ({ title })), getOrUndefined$1),
-				readOnlyHint: get$11(tool.annotations, Readonly),
-				destructiveHint: get$11(tool.annotations, Destructive),
-				idempotentHint: get$11(tool.annotations, Idempotent),
-				openWorldHint: get$11(tool.annotations, OpenWorld)
+				readOnlyHint: get$10(tool.annotations, Readonly),
+				destructiveHint: get$10(tool.annotations, Destructive),
+				idempotentHint: get$10(tool.annotations, Idempotent),
+				openWorldHint: get$10(tool.annotations, OpenWorld)
 			},
 			_meta: toolMeta
 		});
@@ -73620,1021 +73594,412 @@ const makeUriMatcher = () => {
 	};
 };
 const isProtocolVersion = (version) => version === "2024-11-05" || version === "2025-03-26" || version === "2025-06-18" || version === "2025-11-25" || version === "2026-07-28";
+// ../../node_modules/.pnpm/effect@4.1.2/node_modules/effect/dist/process/CommandLine.js
 /**
-* Service that derives bytes from a secret.
+* Builds command lines, the single strings that a shell or a Windows program
+* turns back into arguments, and argument lists from templates. It is
+* unrelated to `effect/cli`, which parses the arguments of your own program.
 *
-* **Example** (Deriving a key with HKDF)
+* The rules depend on what parses the string, not on the platform that builds
+* it, so `quote`, `join` and `display` take an explicit `format`:
 *
-* ```ts import.meta.vitest
-* import { Effect } from "effect"
-* import { Kdf } from "effect/crypto"
+* - `"posix"` (the default) for `sh`, `dash`, `bash` and `zsh`. Quoted output
+*   is also read the same way by `fish`.
+* - `"powershell"` for PowerShell 7.3 or later.
+* - `"windows"` for the Microsoft C runtime rules that most Windows programs
+*   use to split their command line.
 *
-* const program = Effect.gen(function*() {
-*   const kdf = yield* Kdf.Kdf
-*   return yield* kdf.derive(Kdf.hkdfSha256, new Uint8Array(32), {
-*     salt: new Uint8Array(16),
-*     info: new TextEncoder().encode("encryption"),
-*     length: 32
-*   })
-* })
+* SSH sends one command line to the login shell of the remote account, so the
+* format must match that shell. The remote shell must be a POSIX shell or
+* PowerShell: Windows OpenSSH uses `cmd.exe` by default, which no format
+* supports, so set its `DefaultShell` to PowerShell. Docker and Kubernetes exec
+* take argument lists and need no command line at all.
 *
-* const bytes = await Effect.runPromise(program.pipe(Effect.provide(Kdf.layerWebCrypto)))
-* bytes.length // => 32
-* ```
+* Arguments can be `Redacted` strings. `quote` and `join` include their values,
+* because their output is meant to run, while `display` replaces them with
+* `<redacted>`.
 *
 * @stability unstable
-* @category services
-* @since 4.0.0
+* @since 4.0.7
 */
-var Kdf = class extends (/*#__PURE__*/ Service$2()("effect/crypto/Kdf")) {};
-const invalidArgument$1 = (description) => fail$6("Kdf", "derive", new InvalidArgument$1({ description }));
-const isIntegerIn$1 = (n, min, max) => Number.isSafeInteger(n) && n >= min && n <= max;
-const checkArguments = (algorithm, options) => {
-	if (algorithm._tag !== "Hkdf" && options.info !== void 0) return invalidArgument$1("info only applies to HKDF");
-	if (algorithm._tag === "Argon2id") return void 0;
-	if (algorithm.hash.name === "MD5") return invalidArgument$1(`${algorithm._tag} needs a SHA hash, not MD5`);
-	if (algorithm._tag === "Hkdf") {
-		const maxLength = 255 * algorithm.hash.outputLength;
-		return isIntegerIn$1(options.length, 1, maxLength) ? void 0 : invalidArgument$1(`length must be between 1 and ${maxLength} bytes for ${algorithm.name}`);
-	}
-	if (!isIntegerIn$1(algorithm.iterations, 1, 2147483647)) return invalidArgument$1("iterations must be between 1 and 2^31 - 1");
-	return isIntegerIn$1(options.length, 1, 536870911) ? void 0 : invalidArgument$1("length must be between 1 and 2^29 - 1 bytes");
-};
-const webCryptoParams = (algorithm, options) => algorithm._tag === "Hkdf" ? {
-	name: "HKDF",
-	hash: algorithm.hash.name,
-	salt: options.salt,
-	info: options.info ?? /* @__PURE__ */ new Uint8Array()
-} : {
-	name: "PBKDF2",
-	hash: algorithm.hash.name,
-	salt: options.salt,
-	iterations: algorithm.iterations
-};
 /**
-* Layer that provides `Kdf` on the `WebCrypto` reference.
+* Error returned when a command line or a template cannot be built.
 *
 * **Details**
 *
-* HKDF and PBKDF2 run on `crypto.subtle`, off the event loop where the runtime
-* supports it. Argon2id fails with an `Unsupported` reason.
+* - `NulCharacter`: an argument passed to {@link quote} or {@link join}
+*   contains a NUL character, which no command line can carry.
+* - `InvalidArgument`: the format cannot carry an argument: a Windows program
+*   name with a double quote, or the argument `--%`, which PowerShell drops
+*   when it calls a native program.
+* - `InvalidEscape`: template text ends with a backslash that escapes nothing,
+*   or contains an invalid JavaScript escape sequence.
+* - `UnterminatedQuote`: a quoted section of a template is not closed.
+* - `UnsupportedSyntax`: template text contains shell syntax that cannot work
+*   without a shell, such as operators, expansions, globs, comments or
+*   variable assignments, or an interpolated array is not a separate argument.
+*
+* Messages never include the input, which may contain secrets.
 *
 * @stability unstable
-* @category layers
-* @since 4.0.0
+* @category errors
+* @since 4.0.7
 */
-const layerWebCrypto = /*#__PURE__*/ effect(Kdf, /*#__PURE__*/ WebCrypto.use((crypto) => succeed$5(Kdf.of({ derive: (algorithm, secret, options) => suspend$2(() => {
-	const failure = checkArguments(algorithm, options);
-	if (failure !== void 0) return failure;
-	if (algorithm._tag === "Argon2id") return fail$6("Kdf", "derive", new Unsupported({ description: "Kdf.layerWebCrypto does not provide argon2id" }));
-	const name = algorithm._tag === "Hkdf" ? "HKDF" : "PBKDF2";
-	return run$6("Kdf", "derive", algorithm.name, crypto, async (subtle) => {
-		const handle = await subtle.importKey("raw", secret, name, false, ["deriveBits"]);
-		return new Uint8Array(await subtle.deriveBits(webCryptoParams(algorithm, options), handle, options.length * 8));
-	});
-}) }))));
-// ../../node_modules/.pnpm/effect@4.1.2/node_modules/effect/dist/http/FetchHttpClient.js
+var CommandLineError = class extends (/*#__PURE__*/ TaggedError$1("CommandLineError")) {};
 /**
-* Fetch-based implementation of the Effect HTTP client service.
-*
-* This module provides an `HttpClient` layer that executes requests through a
-* Web Fetch API implementation. It is the transport to use in browsers, edge
-* runtimes, and Node.js environments where `globalThis.fetch` is available, or
-* anywhere a compatible fetch function can be supplied.
+* Renders a command for logs and error messages.
 *
-* Requests with an `Upgrade` header fail with `TransportError` before anything
-* is sent because fetch cannot hand over the connection.
+* **When to use**
 *
-* @stability unstable
-* @since 4.0.0
-*/
-/**
-* Context reference for the `fetch` implementation used by the fetch-based HTTP client.
+* Use when you show a command to a person, for example in an error message,
+* and secrets and control characters must not reach the output.
 *
 * **Details**
 *
-* Defaults to `globalThis.fetch`.
+* - Quotes like {@link join}, so commands without control characters or
+*   secrets can be copied into a terminal of the given format.
+* - Replaces `Redacted` arguments with `<redacted>`.
+* - Writes control characters and Unicode line separators as escapes such as
+*   `\n` or `\u001b`, so output cannot move the cursor or inject terminal
+*   sequences.
+* - Never fails: input that {@link join} rejects is rendered anyway.
 *
-* @stability unstable
-* @category services
-* @since 4.0.0
-*/
-const Fetch = /*#__PURE__*/ Reference("effect/http/FetchHttpClient/Fetch", { defaultValue: () => globalThis.fetch });
-/**
-* Context reference controlling stream bodies when the runtime does not support streaming requests.
+* **Gotchas**
 *
-* **Details**
+* The output is for reading only. It is not a reliable command line: escapes
+* and `<redacted>` change what a shell would run.
 *
-* Defaults to `"error"`, which fails with an `EncodeError` without sending the
-* request. Set to `"buffer"` to collect the entire stream in memory and send it
-* as a single body instead. Runtimes with streaming support always send the stream.
+* **Example** (Showing a command with a secret)
 *
-* **Gotchas**
+* ```ts import.meta.vitest
+* import { Redacted } from "effect"
+* import { CommandLine } from "effect/process"
 *
-* Buffering keeps the entire upload in memory and can exhaust memory for large
-* or unbounded uploads. Support is detected once, on the first stream body sent,
-* using the global `Request` implementation even when a custom `Fetch` is provided.
+* const token = Redacted.make("hunter2")
+*
+* CommandLine.display(["curl", "-H", token, "https://x.dev/a b"]) // => "curl -H <redacted> 'https://x.dev/a b'"
+* ```
+*
+* @see {@link join} for building a command line to run
 *
 * @stability unstable
-* @category services
-* @since 4.0.0
+* @category encoding
+* @since 4.0.7
 */
-const StreamBodyFallback = /*#__PURE__*/ Reference("effect/http/FetchHttpClient/StreamBodyFallback", { defaultValue: () => "error" });
+const display = (words, options) => {
+	if (words.length === 0) return "";
+	const format = options?.format ?? "posix";
+	return joinWords(format, words.map((word, i) => isRedacted(word) ? "<redacted>" : escapeControlCharacters$1(quoteWord(format, word, i === 0))));
+};
 /**
-* Service that contains default fetch options for the fetch-based HTTP client.
+* Builds an argument list from a template literal.
 *
 * **When to use**
 *
-* Use to provide default credentials, cache, redirect, integrity, or other
-* fetch options for outgoing HTTP requests.
+* Use to write a command as it would look in a shell while keeping every
+* interpolated value a literal argument.
 *
 * **Details**
 *
-* Request-specific method, headers, body, and abort signal are supplied by the client when a request is executed.
+* - The template text is split into words as a POSIX shell does: spaces,
+*   tabs and line breaks separate words, and quotes and backslash escapes are
+*   removed. A long command can span several lines.
+* - Text that would need a shell fails with `UnsupportedSyntax`: operators
+*   (`| & ; < > ( )`), expansions (`$NAME`, `${...}`, `$(...)`, backticks, a
+*   leading `~`, braces such as `{a,b}`, and a leading `=` that `zsh`
+*   expands), globs (`* ? [`), comments (`#` at the start of a word), and a
+*   variable assignment in the program position. Quote such characters to
+*   pass them literally.
+* - No shell runs, so a program such as `if` or `time` names an executable.
+* - Each `${}` value is inserted literally, without splitting or quote
+*   processing. Next to other text or inside quotes, it becomes part of the
+*   surrounding argument.
+* - An array adds one argument per element and must stand alone as a whole
+*   argument.
+* - Numbers and booleans are converted with `String`.
+* - An argument that contains a `Redacted` value becomes `Redacted` as a
+*   whole.
 *
-* @see {@link HttpClient.followRedirects} for following redirects in the client, which needs `{ redirect: "manual" }` here
+* **Gotchas**
+*
+* - An invalid JavaScript escape sequence in the text, such as `\u` without
+*   hex digits, fails with `InvalidEscape`. Use `String.raw` or a `${}` value
+*   for backslashes.
+* - Neither the text nor the values are checked for NUL characters.
+*   {@link join} and the child process spawners reject them where they would
+*   truncate an argument.
+*
+* **Example** (Building arguments with interpolated values)
+*
+* ```ts import.meta.vitest
+* import { Redacted, Result } from "effect"
+* import { CommandLine } from "effect/process"
+*
+* const msg = "fix: handle $HOME"
+* const files = ["a.ts", "b.ts"]
+*
+* CommandLine.template`git commit -m ${msg} ${files}` // => Result.succeed(["git", "commit", "-m", msg, ...files])
+*
+* const password = Redacted.make("hunter2")
+* const words = Result.getOrThrow(CommandLine.template`psql "--password=${password}"`)
+*
+* CommandLine.display(words) // => "psql <redacted>"
+* ```
 *
 * @stability unstable
-* @category services
-* @since 4.0.0
+* @category constructors
+* @since 4.0.7
 */
-var RequestInit = class extends (/*#__PURE__*/ Service$2()("effect/http/FetchHttpClient/RequestInit")) {};
-let supportsStreamBody;
-const detectStreamBodySupport = () => {
-	try {
-		let duplexAccessed = false;
-		const body = new ReadableStream();
-		const request = new Request("https://example.com", {
-			method: "POST",
-			body,
-			get duplex() {
-				duplexAccessed = true;
-				return "half";
+const template = (strings, ...expressions) => {
+	const index = strings.findIndex((text) => text === void 0);
+	if (index !== -1) return fail$12(new CommandLineError({
+		reason: "InvalidEscape",
+		message: `Template part ${index} contains an invalid escape sequence`
+	}));
+	return parseTemplate$1(strings, expressions);
+};
+const unwrap$1 = (item) => isRedacted(item) ? value$2(item) : String(item);
+const toWord = (item) => isRedacted(item) ? item : String(item);
+const reservedWords = /*#__PURE__*/ new Set([
+	"!",
+	"{",
+	"}",
+	"and",
+	"begin",
+	"case",
+	"coproc",
+	"do",
+	"done",
+	"elif",
+	"else",
+	"end",
+	"esac",
+	"fi",
+	"for",
+	"foreach",
+	"function",
+	"if",
+	"in",
+	"nocorrect",
+	"not",
+	"or",
+	"repeat",
+	"select",
+	"switch",
+	"then",
+	"time",
+	"until",
+	"while"
+]);
+const quoteWord = (format, value, program) => {
+	switch (format) {
+		case "posix": return program && reservedWords.has(value) ? `'${value}'` : quotePosix(value);
+		case "powershell": return quotePowerShell(value);
+		case "windows": return program && !value.includes("\"") ? quoteWindowsProgram(value) : quoteWindowsArgument(value);
+	}
+};
+const joinWords = (format, quoted) => format === "powershell" ? `& ${quoted.join(" ")}` : quoted.join(" ");
+const posixSafe = /^[A-Za-z0-9_@+:,./-]+$/;
+const quotePosix = (value) => posixSafe.test(value) ? value : `'${value.replace(/['\\]/g, (char) => `'\\${char}'`)}'`;
+const quotePowerShell = (value) => `'${value.replace(/['\u2018\u2019\u201A\u201B]/g, "$&$&")}'`;
+const windowsNeedsQuotes = /[ \t\n\v"]/;
+const quoteWindowsArgument = (value) => {
+	if (value.length > 0 && !windowsNeedsQuotes.test(value)) return value;
+	let out = "\"";
+	let backslashes = 0;
+	for (const char of value) if (char === "\\") backslashes++;
+	else if (char === "\"") {
+		out += "\\".repeat(backslashes * 2 + 1) + "\"";
+		backslashes = 0;
+	} else {
+		out += "\\".repeat(backslashes) + char;
+		backslashes = 0;
+	}
+	return out + "\\".repeat(backslashes * 2) + "\"";
+};
+const quoteWindowsProgram = (value) => value.length > 0 && !/[ \t]/.test(value) ? value : `"${value}"`;
+const controlCharacters = /[\u0000-\u001f\u007f-\u009f\u2028\u2029]/g;
+const controlEscapes = {
+	"\n": "\\n",
+	"\r": "\\r",
+	"	": "\\t"
+};
+const escapeControlCharacters$1 = (value) => value.replace(controlCharacters, (char) => controlEscapes[char] ?? `\\u${char.charCodeAt(0).toString(16).padStart(4, "0")}`);
+const operators = "|&;<>()";
+const globs = "*?[";
+const expansionStart = /[A-Za-z_0-9{(@*#?$!'"-]/;
+const quotedExpansionStart = /[A-Za-z_0-9{(@*#?$!-]/;
+const assignmentName = /^[A-Za-z_][A-Za-z0-9_]*\+?$/;
+const isBlank = (char) => char === " " || char === "	" || char === "\n";
+const unsupportedSyntax = (char, next, wordStart) => {
+	if (operators.includes(char)) return `The operator "${char}" needs a shell`;
+	if (char === "`") return "Command substitution needs a shell";
+	if (char === "$" && next !== void 0 && expansionStart.test(next)) return `The expansion "$${next}" needs a shell`;
+	if (globs.includes(char)) return `The glob character "${char}" needs a shell`;
+	if (!wordStart) return void 0;
+	if (char === "#") return "A comment needs a shell";
+	if (char === "~") return "Tilde expansion needs a shell";
+	if (char === "=" && next !== void 0 && !isBlank(next)) return "A leading \"=\" is expanded by zsh";
+};
+const parseTemplate$1 = (texts, values) => {
+	const words = [];
+	let word = [];
+	let plain = true;
+	let braceDepth = 0;
+	let quote = void 0;
+	let quotePart = 0;
+	let part = 0;
+	const error = (reason, message, at = part) => fail$12(new CommandLineError({
+		reason,
+		message: `${message} in template part ${at}`
+	}));
+	const endWord = () => {
+		if (word.length === 0) return;
+		const value = word.map(unwrap$1).join("");
+		words.push(word.length === 1 && isRedacted(word[0]) ? word[0] : word.some(isRedacted) ? make$65(value) : value);
+		word = [];
+		plain = true;
+		braceDepth = 0;
+	};
+	const scan = (text) => {
+		for (let i = 0; i < text.length; i++) {
+			const char = text[i];
+			const next = text[i + 1];
+			if (quote === "'") {
+				if (char === "'") quote = void 0;
+				else word.push(char);
+			} else if (quote === "\"") {
+				if (char === "\"") quote = void 0;
+				else if (char === "\\" && next !== void 0 && "$`\"\\\n".includes(next)) {
+					if (next !== "\n") word.push(next);
+					i++;
+				} else if (char === "`") return error("UnsupportedSyntax", "Command substitution needs a shell");
+				else if (char === "$" && next !== void 0 && quotedExpansionStart.test(next)) return error("UnsupportedSyntax", `The expansion "$${next}" needs a shell`);
+				else word.push(char);
+			} else if (isBlank(char)) endWord();
+			else if (char === "\\") {
+				if (next === void 0) return error("InvalidEscape", "A trailing backslash escapes nothing");
+				if (next !== "\n") {
+					word.push(next);
+					plain = false;
+				}
+				i++;
+			} else if (char === "'" || char === "\"") {
+				quote = char;
+				quotePart = part;
+				word.push("");
+				plain = false;
+			} else {
+				const unsupported = unsupportedSyntax(char, next, word.length === 0);
+				if (unsupported !== void 0) return error("UnsupportedSyntax", unsupported);
+				if (char === "{") braceDepth++;
+				else if (char === "}") {
+					if (braceDepth > 0) braceDepth--;
+				} else if (braceDepth > 0 && (char === "," || char === "." && next === ".")) return error("UnsupportedSyntax", "Brace expansion needs a shell");
+				else if (char === "=" && words.length === 0 && plain && assignmentName.test(word.join(""))) return error("UnsupportedSyntax", "A variable assignment needs a shell");
+				word.push(char);
 			}
-		});
-		return (duplexAccessed || request.body === body) && !request.headers.has("Content-Type");
-	} catch {
-		return false;
+		}
+	};
+	for (; part < texts.length; part++) {
+		const failure = scan(texts[part]);
+		if (failure !== void 0) return failure;
+		if (part === values.length) break;
+		const expression = values[part];
+		if (Array.isArray(expression)) {
+			const after = texts[part + 1][0];
+			if (word.length > 0 || (after === void 0 ? part + 1 < values.length : !isBlank(after))) return error("UnsupportedSyntax", "An interpolated array must be a separate argument");
+			for (const item of expression) words.push(toWord(item));
+		} else {
+			word.push(toWord(expression));
+			plain = false;
+		}
 	}
+	if (quote !== void 0) return error("UnterminatedQuote", "The quote is not closed", quotePart);
+	endWord();
+	return succeed$10(words);
 };
+// ../../node_modules/.pnpm/effect@4.1.2/node_modules/effect/dist/process/ChildProcess.js
 /**
-* Layer that provides an `HttpClient` implementation backed by the configured
-* `Fetch` function.
+* Describes child processes before they are started.
 *
-* **When to use**
+* A `Command` stores the executable, arguments, environment, standard streams,
+* working directory, and other process options. Commands can also be piped
+* together. A command is an `Effect`; running it asks the
+* `ChildProcessSpawner` service to start the process and returns a
+* `ChildProcessHandle`.
 *
-* Use when an Effect program should execute `HttpClient` requests through the
-* platform `fetch` implementation, especially in browser, edge, or Node.js
-* runtimes with `globalThis.fetch`.
+* @stability unstable
+* @since 4.0.0
+*/
+const TypeId$5 = "~effect/process/ChildProcess";
+const Proto$3 = {
+	.../*#__PURE__*/ Prototype({
+		label: "Command",
+		evaluate(fiber) {
+			return getUnsafe$2(fiber.context, ChildProcessSpawner).spawn(this);
+		}
+	}),
+	[TypeId$5]: TypeId$5
+};
+const makeStandardCommand = (command, args, options) => Object.assign(Object.create(Proto$3), {
+	_tag: "StandardCommand",
+	command,
+	args,
+	options
+});
+/**
+* Create a command from a template literal, options + template, or array form.
 *
 * **Details**
 *
-* The layer uses the current `Fetch` reference and optional `RequestInit`
-* service for each request. Request-specific method, headers, body, and abort
-* signal are supplied by the client and override matching `RequestInit` fields.
+* This function supports three calling conventions:
+* 1. Template literal: `make\`npm run build\``
+* 2. Options + template literal: `make({ cwd: "/app" })\`npm run build\``
+* 3. Array form: `make("npm", ["run", "build"], options?)`
+*
+* Templates are split with `CommandLine.template`: quotes group words, each
+* `${}` value is one literal argument, and an argument that contains a
+* `Redacted` value stays `Redacted`. Arguments in the array form can be
+* `Redacted` too.
+*
+* With the `shell` option, the template text is the shell script and is kept
+* as written.
 *
 * **Gotchas**
 *
-* Fetch behavior comes from the runtime's implementation, so CORS, cookies,
-* redirects, abort handling, and streaming support can vary by platform.
-* `fetch` follows redirects itself by default, so `HttpClient.followRedirects`
-* has no effect unless `RequestInit` sets `redirect: "manual"`. Trace
-* propagation is on by default, and a browser preflight fails unless the
-* target allows `b3` and `traceparent`. Stream request bodies are sent as Web
-* streams with `duplex: "half"` when the runtime supports it; see
-* `StreamBodyFallback` for the unsupported case. Any `content-length` header is
-* removed before calling `fetch`. Chrome passes the support check but rejects
-* streaming uploads over HTTP/1.1, which surfaces as a `TransportError`, and
-* browsers only deliver the response after the entire request body has been sent.
+* - A template is parsed when `make` is called. Shell syntax such as `|`,
+*   `$HOME`, `*` or `~` throws a `CommandLine.CommandLineError`: quote it, or
+*   pass the value with `${}`.
+* - A template with the `shell` option cannot contain `${}` values, because
+*   their quoting depends on the shell. Build the script with
+*   `CommandLine.quote` and pass it as a string.
+* - The program name, the first word, cannot be `Redacted`.
+* - A NUL character in the command, an argument or an `env` value fails with
+*   a `BadArgument` error when the command is spawned.
 *
-* @see {@link Fetch} for supplying the fetch implementation used by this layer
-* @see {@link RequestInit} for default `RequestInit` options applied before request-specific fields
-* @see {@link StreamBodyFallback} for opting into buffering on unsupported runtimes
-* @see {@link HttpClient.TracerPropagationEnabled} for leaving `b3` and `traceparent` off a browser request
+* **Example** (Creating commands)
+*
+* ```ts import.meta.vitest
+* import { ChildProcess } from "effect/process"
+*
+* // Template literal form; quotes group words
+* const cmd1 = ChildProcess.make`echo "hello world"`
+*
+* // With options
+* const cmd2 = ChildProcess.make({ cwd: "/tmp" })`ls -la`
+*
+* // Array form
+* const cmd3 = ChildProcess.make("git", ["status"])
+*
+* const result = [cmd1.args[0], cmd2.options.cwd, cmd3.args[0]] // => ["hello world", "/tmp", "status"]
+* ```
 *
 * @stability unstable
-* @category layers
+* @category constructors
 * @since 4.0.0
 */
-const layer$16 = /*#__PURE__*/ layerMergedContext(/*#__PURE__*/ succeed$5(/* @__PURE__ */ make$34((request, url, signal, fiber) => {
-	if (request.headers.upgrade !== void 0) return fail$7(new HttpClientError({ reason: new TransportError({
-		request,
-		description: "fetch cannot send an HTTP upgrade request"
-	}) }));
-	const fetch = fiber.getRef(Fetch);
-	const options = getOrUndefined(fiber.context, RequestInit) ?? {};
-	let headers = options.headers ? merge$2(fromInput$1(options.headers), request.headers) : request.headers;
-	if (headers["content-length"]) headers = remove$1(headers, "content-length");
-	let uploadController;
-	const stopUpload = sync(() => uploadController?.abort());
-	const send = (body) => map$5(tryPromise({
-		try: () => fetch(url, {
-			...options,
-			method: request.method,
-			headers,
-			body,
-			duplex: typeof ReadableStream !== "undefined" && body instanceof ReadableStream ? "half" : void 0,
-			signal: uploadController ? AbortSignal.any([signal, uploadController.signal]) : signal
-		}),
-		catch: (cause) => new HttpClientError({ reason: new TransportError({
-			request,
-			cause
-		}) })
-	}), (response) => {
-		const original = fromWeb(request, response);
-		if (!uploadController) return original;
-		if (response.body === null) uploadController.abort();
-		return Object.create(original, {
-			...Object.fromEntries([
-				"arrayBuffer",
-				"text",
-				"json",
-				"formData",
-				"urlParamsBody"
-			].map((key) => [key, { get: () => ensuring$2(original[key], stopUpload) }])),
-			stream: { get: () => ensuring(original.stream, stopUpload) }
-		});
-	}).pipe(onError(() => stopUpload));
-	switch (request.body._tag) {
-		case "Raw":
-		case "Uint8Array": return send(request.body.body);
-		case "FormData": return send(request.body.formData);
-		case "Stream":
-			supportsStreamBody ??= detectStreamBodySupport();
-			if (supportsStreamBody) {
-				uploadController = new AbortController();
-				const uploadSignal = AbortSignal.any([signal, uploadController.signal]);
-				const stopped = callback$1((resume) => {
-					const onAbort = () => resume(interrupt$1);
-					if (uploadSignal.aborted) {
-						onAbort();
-						return;
-					}
-					uploadSignal.addEventListener("abort", onAbort, { once: true });
-					return sync(() => uploadSignal.removeEventListener("abort", onAbort));
-				});
-				return flatMap$3(toReadableStreamEffect(interruptWhen(request.body.stream, stopped)), send);
-			}
-			if (fiber.getRef(StreamBodyFallback) === "error") return fail$7(new HttpClientError({ reason: new EncodeError({
-				request,
-				description: "Streaming request bodies are not supported in this runtime"
-			}) }));
-			return mkArrayBuffer(request.body.stream).pipe(mapError$2((cause) => new HttpClientError({ reason: new EncodeError({
-				request,
-				cause
-			}) })), flatMap$3(send));
-	}
-	return send(void 0);
-})));
-// ../../node_modules/.pnpm/effect@4.1.2/node_modules/effect/dist/http/HttpStaticServer.js
-/**
-* Serves static files for Effect HTTP applications.
-*
-* `HttpStaticServer` turns request paths into file responses under a configured
-* root directory. It can be used as an application value or mounted onto an
-* `HttpRouter`, and it handles index files, optional single-page application
-* fallback, MIME type headers, cache-control headers, byte ranges, and
-* conditional `304 Not Modified` responses.
-*
-* @stability unstable
-* @since 4.0.0
-*/
-/**
-* Creates an `HttpApp` that serves files from a directory.
-*
-* **Example** (Serving files from a directory)
-*
-* ```ts import.meta.vitest
-* import { ByteSize, Effect, FileSystem, Layer, Path } from "effect"
-* import {
-*   HttpEffect,
-*   HttpPlatform,
-*   HttpServerResponse,
-*   HttpStaticServer
-* } from "effect/http"
-*
-* const TestFileSystem = FileSystem.layerNoop({
-*   stat: () =>
-*     Effect.succeed({
-*       type: "File",
-*       size: ByteSize.bytes(20)
-*     } as FileSystem.File.Info)
-* })
-* const TestHttpPlatform = Layer.succeed(
-*   HttpPlatform.HttpPlatform,
-*   HttpPlatform.HttpPlatform.of({
-*     platform: "web",
-*     fileResponse: (path) => Effect.succeed(HttpServerResponse.text(`Serving ${path}`)),
-*     fileWebResponse: () => Effect.die("unused")
-*   })
-* )
-* const TestServices = Layer.mergeAll(Path.layer, TestFileSystem, TestHttpPlatform)
-*
-* const program = Effect.gen(function*() {
-*   const app = yield* HttpStaticServer.make({ root: "/public" })
-*   const handler = HttpEffect.toWebHandler(app)
-*   const response = yield* Effect.promise(() => handler(new Request("http://localhost/guide.txt")))
-*   const body = yield* Effect.promise(() => response.text())
-*   return body
-* }).pipe(Effect.provide(TestServices))
-*
-* await Effect.runPromise(program) // => "Serving /public/guide.txt"
-* ```
-*
-* @stability unstable
-* @category constructors
-* @since 4.0.0
-*/
-const make$12 = /*#__PURE__*/ fnUntraced(function* (options) {
-	const fileSystem = yield* FileSystem;
-	const path = yield* Path$1;
-	const platform = yield* HttpPlatform;
-	const resolvedRoot = path.resolve(options.root);
-	const index = "index" in options ? options.index : "index.html";
-	const spa = options.spa === true;
-	const cacheControl = options.cacheControl;
-	const mimeTypes = {
-		...defaultMimeTypes,
-		...options.mimeTypes
-	};
-	const setFileHeaders = (response, filePath) => {
-		let currentResponse = setHeaders(response, {
-			"Content-Type": resolveMimeType(path, filePath, mimeTypes),
-			"Accept-Ranges": "bytes"
-		});
-		if (cacheControl !== void 0) currentResponse = setHeader(currentResponse, "Cache-Control", cacheControl);
-		return currentResponse;
-	};
-	const serveFile = fnUntraced(function* (request, filePath, fileSize) {
-		const rangeHeader = request.method === "GET" ? request.headers["range"] : void 0;
-		const shouldEvaluateConditionals = request.headers["if-match"] !== void 0 || request.headers["if-unmodified-since"] !== void 0 || request.headers["if-none-match"] !== void 0 || request.headers["if-modified-since"] !== void 0;
-		let fullResponse;
-		const getFullResponse = () => fullResponse === void 0 ? map$5(handlePlatformError(request, platform.fileResponse(filePath)), (response) => setFileHeaders(response, filePath)) : succeed$5(fullResponse);
-		if (shouldEvaluateConditionals) {
-			fullResponse = yield* getFullResponse();
-			const conditionalResponse = evaluateConditionalRequest(request, fullResponse);
-			if (conditionalResponse !== void 0) return conditionalResponse;
-		}
-		if (rangeHeader === void 0) return yield* getFullResponse();
-		const ifRange = request.headers["if-range"];
-		if (ifRange !== void 0) {
-			fullResponse = yield* getFullResponse();
-			if (!matchesIfRange(ifRange, fullResponse.headers["etag"])) return fullResponse;
-		}
-		const resolvedFileSize = fileSize ?? (yield* handlePlatformError(request, fileSystem.stat(filePath))).size;
-		const parsedRange = parseRange(rangeHeader, resolvedFileSize);
-		if (parsedRange === void 0) return yield* getFullResponse();
-		if (parsedRange === "unsatisfiable") return empty({
-			status: 416,
-			headers: { "Content-Range": `bytes */${resolvedFileSize}` }
-		});
-		let response = setFileHeaders(yield* handlePlatformError(request, platform.fileResponse(filePath, {
-			status: 206,
-			offset: parsedRange.start,
-			bytesToRead: parsedRange.end - parsedRange.start + BigInt(1)
-		})), filePath);
-		response = setHeader(response, "Content-Range", `bytes ${parsedRange.start}-${parsedRange.end}/${resolvedFileSize}`);
-		return response;
-	});
-	return HttpServerRequest.use((request) => {
-		const resolvedPath = resolveFilePath(path, resolvedRoot, request.url);
-		if (resolvedPath === void 0) return fail$7(toRouteNotFoundError(request));
-		return matchEffect(fileSystem.stat(resolvedPath), {
-			onFailure: (error) => error.reason._tag === "NotFound" && spa && index !== void 0 && path.extname(resolvedPath) === "" && acceptsHtml(request.headers["accept"]) ? serveFile(request, path.join(resolvedRoot, index)) : error.reason._tag === "NotFound" ? fail$7(toRouteNotFoundError(request)) : fail$7(toInternalServerError(request, error)),
-			onSuccess(info) {
-				if (info.type === "File") return serveFile(request, resolvedPath, info.size);
-				if (info.type === "Directory" && index !== void 0) {
-					let originalUrl = request.originalUrl;
-					if (!originalUrl.startsWith("/")) {
-						const url = new URL(originalUrl);
-						originalUrl = url.pathname + url.search;
-					}
-					const pathname = stripQueryString(originalUrl);
-					if (!pathname.endsWith("/")) {
-						const location = pathname.replace(/^\/+/, "/").replace(/\\/g, "%5C");
-						return succeed$5(redirect(`${location}/${originalUrl.slice(pathname.length)}`, { status: 301 }));
-					}
-					return serveFile(request, path.join(resolvedPath, index));
-				}
-				return fail$7(toRouteNotFoundError(request));
-			}
-		});
-	});
-});
-/**
-* Creates a layer that mounts static files on an `HttpRouter`.
-*
-* **Example** (Mounting static files on a router)
-*
-* ```ts import.meta.vitest
-* import { Layer } from "effect"
-* import { HttpRouter, HttpServerResponse, HttpStaticServer } from "effect/http"
-*
-* const ApiLayer = HttpRouter.add("GET", "/health", HttpServerResponse.text("ok"))
-*
-* const StaticFilesLayer = HttpStaticServer.layer({
-*   root: "./public",
-*   prefix: "/static"
-* })
-*
-* const AppLayer = Layer.mergeAll(ApiLayer, StaticFilesLayer)
-* Layer.isLayer(AppLayer) // => true
-* ```
-*
-* @stability unstable
-* @category layers
-* @since 4.0.0
-*/
-const layer$15 = (options) => effectDiscard(gen(function* () {
-	const router = yield* HttpRouter;
-	const handler = (yield* make$12(options)).pipe(catch_$2(toResponse));
-	if (options.prefix !== void 0) {
-		yield* router.prefixed(options.prefix).add("GET", "/*", handler);
-		return;
-	}
-	yield* router.add("GET", "/*", handler);
-}));
-const defaultMimeTypes = {
-	html: "text/html; charset=utf-8",
-	htm: "text/html; charset=utf-8",
-	css: "text/css; charset=utf-8",
-	js: "text/javascript; charset=utf-8",
-	mjs: "text/javascript; charset=utf-8",
-	json: "application/json; charset=utf-8",
-	xml: "application/xml; charset=utf-8",
-	txt: "text/plain; charset=utf-8",
-	csv: "text/csv; charset=utf-8",
-	md: "text/markdown; charset=utf-8",
-	yaml: "text/yaml; charset=utf-8",
-	yml: "text/yaml; charset=utf-8",
-	png: "image/png",
-	jpg: "image/jpeg",
-	jpeg: "image/jpeg",
-	gif: "image/gif",
-	svg: "image/svg+xml; charset=utf-8",
-	ico: "image/x-icon",
-	webp: "image/webp",
-	avif: "image/avif",
-	woff: "font/woff",
-	woff2: "font/woff2",
-	ttf: "font/ttf",
-	otf: "font/otf",
-	eot: "application/vnd.ms-fontobject",
-	mp3: "audio/mpeg",
-	mp4: "video/mp4",
-	webm: "video/webm",
-	ogg: "audio/ogg",
-	wav: "audio/wav",
-	flac: "audio/flac",
-	aac: "audio/aac",
-	pdf: "application/pdf",
-	zip: "application/zip",
-	gz: "application/gzip",
-	wasm: "application/wasm",
-	map: "application/json",
-	webmanifest: "application/manifest+json"
-};
-const stripQueryString = (url) => {
-	const queryIndex = url.indexOf("?");
-	return queryIndex === -1 ? url : url.slice(0, queryIndex);
-};
-const resolveMimeType = (path, filePath, mimeTypes) => {
-	const extension = path.extname(filePath).toLowerCase();
-	if (extension.length <= 1) return "application/octet-stream";
-	return mimeTypes[extension.slice(1)] ?? "application/octet-stream";
-};
-const parseInteger = (value) => {
-	if (!/^\d+$/.test(value)) return;
-	return BigInt(value);
-};
-const parseRange = (header, fileSize) => {
-	const value = header.trim();
-	if (!value.toLowerCase().startsWith("bytes=")) return;
-	const rangeValue = value.slice(6).trim();
-	if (rangeValue.length === 0 || rangeValue.includes(",")) return;
-	const separatorIndex = rangeValue.indexOf("-");
-	if (separatorIndex === -1) return;
-	const startPart = rangeValue.slice(0, separatorIndex).trim();
-	const endPart = rangeValue.slice(separatorIndex + 1).trim();
-	if (startPart === "" && endPart === "") return;
-	if (startPart === "") {
-		const suffixLength = parseInteger(endPart);
-		if (suffixLength === void 0) return;
-		if (suffixLength === BigInt(0) || fileSize === BigInt(0)) return "unsatisfiable";
-		return {
-			start: fileSize > suffixLength ? fileSize - suffixLength : BigInt(0),
-			end: fileSize - BigInt(1)
-		};
-	}
-	const start = parseInteger(startPart);
-	if (start === void 0) return;
-	if (endPart === "") {
-		if (start >= fileSize) return "unsatisfiable";
-		return {
-			start,
-			end: fileSize - BigInt(1)
-		};
-	}
-	const end = parseInteger(endPart);
-	if (end === void 0) return;
-	if (start > end || start >= fileSize) return "unsatisfiable";
-	return {
-		start,
-		end: end < fileSize ? end : fileSize - BigInt(1)
-	};
-};
-const resolveFilePath = (path, root, url) => {
-	const urlPath = stripQueryString(url);
-	let decodedPath;
-	try {
-		decodedPath = decodeURIComponent(urlPath);
-	} catch {
-		return;
-	}
-	if (decodedPath.includes("\0")) return;
-	const relativePath = decodedPath.replace(path.sep === "\\" ? /^[/\\]+/ : /^\/+/, "");
-	return getOrUndefined$1(path.resolveWithin(root, relativePath));
-};
-const toRouteNotFoundError = (request) => new HttpServerError({ reason: new RouteNotFound({ request }) });
-const toInternalServerError = (request, cause) => new HttpServerError({ reason: new InternalError({
-	request,
-	cause
-}) });
-const handlePlatformError = (request, self) => catchIf(self, (error) => error.reason._tag === "NotFound", () => fail$7(toRouteNotFoundError(request)), (error) => fail$7(toInternalServerError(request, error)));
-const acceptsHtml = (accept) => accept !== void 0 && accept.toLowerCase().includes("text/html");
-const stripWeakEtagPrefix = (value) => {
-	const trimmed = value.trim();
-	return /^w\//i.test(trimmed) ? trimmed.slice(2) : trimmed;
-};
-const entityTagList = /^[\s,]*(?:(?:W\/)?"[^"]*"\s*(?:,[\s,]*|$))*$/;
-const entityTag = /(?:W\/)?"[^"]*"/g;
-const matchesIfMatch = (ifMatch, etag) => {
-	if (ifMatch.trim() === "*") return true;
-	if (etag === void 0 || !etag.startsWith("\"") || !entityTagList.test(ifMatch)) return false;
-	return ifMatch.match(entityTag)?.includes(etag) ?? false;
-};
-const matchesIfNoneMatch = (ifNoneMatch, etag) => {
-	const normalizedEtag = etag === void 0 ? void 0 : stripWeakEtagPrefix(etag);
-	for (const candidate of ifNoneMatch.split(",")) {
-		const value = candidate.trim();
-		if (value === "") continue;
-		if (value === "*") return true;
-		if (normalizedEtag !== void 0 && stripWeakEtagPrefix(value) === normalizedEtag) return true;
-	}
-	return false;
-};
-const isModifiedSince = (since, lastModified) => {
-	if (lastModified === void 0) return;
-	const sinceDate = parseHttpDate(since);
-	if (isFailure$1(sinceDate)) return;
-	const lastModifiedDate = parseHttpDate(lastModified);
-	return isSuccess$1(lastModifiedDate) ? toEpochMillis(lastModifiedDate.success) > toEpochMillis(sinceDate.success) : void 0;
-};
-const matchesIfRange = (ifRange, etag) => {
-	const value = ifRange.trim();
-	return value.startsWith("\"") && value === etag;
-};
-const notModifiedHeaders = [
-	"cache-control",
-	"content-location",
-	"date",
-	"etag",
-	"expires",
-	"last-modified",
-	"vary"
-];
-const notModifiedResponse = (response) => {
-	const headers = {};
-	for (const name of notModifiedHeaders) {
-		const value = response.headers[name];
-		if (value !== void 0) headers[name] = value;
-	}
-	return empty({
-		status: 304,
-		headers
-	});
-};
-const evaluateConditionalRequest = (request, response) => {
-	const etag = response.headers["etag"];
-	const lastModified = response.headers["last-modified"];
-	const ifMatch = request.headers["if-match"];
-	if (ifMatch !== void 0) {
-		if (!matchesIfMatch(ifMatch, etag)) return empty({ status: 412 });
-	} else {
-		const ifUnmodifiedSince = request.headers["if-unmodified-since"];
-		if (ifUnmodifiedSince !== void 0 && isModifiedSince(ifUnmodifiedSince, lastModified) === true) return empty({ status: 412 });
-	}
-	const ifNoneMatch = request.headers["if-none-match"];
-	if (ifNoneMatch !== void 0) return matchesIfNoneMatch(ifNoneMatch, etag) ? notModifiedResponse(response) : void 0;
-	const ifModifiedSince = request.headers["if-modified-since"];
-	if (ifModifiedSince !== void 0 && isModifiedSince(ifModifiedSince, lastModified) === false) return notModifiedResponse(response);
-};
-// ../../node_modules/.pnpm/effect@4.1.2/node_modules/effect/dist/process/CommandLine.js
-/**
-* Builds command lines, the single strings that a shell or a Windows program
-* turns back into arguments, and argument lists from templates. It is
-* unrelated to `effect/cli`, which parses the arguments of your own program.
-*
-* The rules depend on what parses the string, not on the platform that builds
-* it, so `quote`, `join` and `display` take an explicit `format`:
-*
-* - `"posix"` (the default) for `sh`, `dash`, `bash` and `zsh`. Quoted output
-*   is also read the same way by `fish`.
-* - `"powershell"` for PowerShell 7.3 or later.
-* - `"windows"` for the Microsoft C runtime rules that most Windows programs
-*   use to split their command line.
-*
-* SSH sends one command line to the login shell of the remote account, so the
-* format must match that shell. The remote shell must be a POSIX shell or
-* PowerShell: Windows OpenSSH uses `cmd.exe` by default, which no format
-* supports, so set its `DefaultShell` to PowerShell. Docker and Kubernetes exec
-* take argument lists and need no command line at all.
-*
-* Arguments can be `Redacted` strings. `quote` and `join` include their values,
-* because their output is meant to run, while `display` replaces them with
-* `<redacted>`.
-*
-* @stability unstable
-* @since 4.0.7
-*/
-/**
-* Error returned when a command line or a template cannot be built.
-*
-* **Details**
-*
-* - `NulCharacter`: an argument passed to {@link quote} or {@link join}
-*   contains a NUL character, which no command line can carry.
-* - `InvalidArgument`: the format cannot carry an argument: a Windows program
-*   name with a double quote, or the argument `--%`, which PowerShell drops
-*   when it calls a native program.
-* - `InvalidEscape`: template text ends with a backslash that escapes nothing,
-*   or contains an invalid JavaScript escape sequence.
-* - `UnterminatedQuote`: a quoted section of a template is not closed.
-* - `UnsupportedSyntax`: template text contains shell syntax that cannot work
-*   without a shell, such as operators, expansions, globs, comments or
-*   variable assignments, or an interpolated array is not a separate argument.
-*
-* Messages never include the input, which may contain secrets.
-*
-* @stability unstable
-* @category errors
-* @since 4.0.7
-*/
-var CommandLineError = class extends (/*#__PURE__*/ TaggedError$1("CommandLineError")) {};
-/**
-* Renders a command for logs and error messages.
-*
-* **When to use**
-*
-* Use when you show a command to a person, for example in an error message,
-* and secrets and control characters must not reach the output.
-*
-* **Details**
-*
-* - Quotes like {@link join}, so commands without control characters or
-*   secrets can be copied into a terminal of the given format.
-* - Replaces `Redacted` arguments with `<redacted>`.
-* - Writes control characters and Unicode line separators as escapes such as
-*   `\n` or `\u001b`, so output cannot move the cursor or inject terminal
-*   sequences.
-* - Never fails: input that {@link join} rejects is rendered anyway.
-*
-* **Gotchas**
-*
-* The output is for reading only. It is not a reliable command line: escapes
-* and `<redacted>` change what a shell would run.
-*
-* **Example** (Showing a command with a secret)
-*
-* ```ts import.meta.vitest
-* import { Redacted } from "effect"
-* import { CommandLine } from "effect/process"
-*
-* const token = Redacted.make("hunter2")
-*
-* CommandLine.display(["curl", "-H", token, "https://x.dev/a b"]) // => "curl -H <redacted> 'https://x.dev/a b'"
-* ```
-*
-* @see {@link join} for building a command line to run
-*
-* @stability unstable
-* @category encoding
-* @since 4.0.7
-*/
-const display = (words, options) => {
-	if (words.length === 0) return "";
-	const format = options?.format ?? "posix";
-	return joinWords(format, words.map((word, i) => isRedacted(word) ? "<redacted>" : escapeControlCharacters$1(quoteWord(format, word, i === 0))));
-};
-/**
-* Builds an argument list from a template literal.
-*
-* **When to use**
-*
-* Use to write a command as it would look in a shell while keeping every
-* interpolated value a literal argument.
-*
-* **Details**
-*
-* - The template text is split into words as a POSIX shell does: spaces,
-*   tabs and line breaks separate words, and quotes and backslash escapes are
-*   removed. A long command can span several lines.
-* - Text that would need a shell fails with `UnsupportedSyntax`: operators
-*   (`| & ; < > ( )`), expansions (`$NAME`, `${...}`, `$(...)`, backticks, a
-*   leading `~`, braces such as `{a,b}`, and a leading `=` that `zsh`
-*   expands), globs (`* ? [`), comments (`#` at the start of a word), and a
-*   variable assignment in the program position. Quote such characters to
-*   pass them literally.
-* - No shell runs, so a program such as `if` or `time` names an executable.
-* - Each `${}` value is inserted literally, without splitting or quote
-*   processing. Next to other text or inside quotes, it becomes part of the
-*   surrounding argument.
-* - An array adds one argument per element and must stand alone as a whole
-*   argument.
-* - Numbers and booleans are converted with `String`.
-* - An argument that contains a `Redacted` value becomes `Redacted` as a
-*   whole.
-*
-* **Gotchas**
-*
-* - An invalid JavaScript escape sequence in the text, such as `\u` without
-*   hex digits, fails with `InvalidEscape`. Use `String.raw` or a `${}` value
-*   for backslashes.
-* - Neither the text nor the values are checked for NUL characters.
-*   {@link join} and the child process spawners reject them where they would
-*   truncate an argument.
-*
-* **Example** (Building arguments with interpolated values)
-*
-* ```ts import.meta.vitest
-* import { Redacted, Result } from "effect"
-* import { CommandLine } from "effect/process"
-*
-* const msg = "fix: handle $HOME"
-* const files = ["a.ts", "b.ts"]
-*
-* CommandLine.template`git commit -m ${msg} ${files}` // => Result.succeed(["git", "commit", "-m", msg, ...files])
-*
-* const password = Redacted.make("hunter2")
-* const words = Result.getOrThrow(CommandLine.template`psql "--password=${password}"`)
-*
-* CommandLine.display(words) // => "psql <redacted>"
-* ```
-*
-* @stability unstable
-* @category constructors
-* @since 4.0.7
-*/
-const template = (strings, ...expressions) => {
-	const index = strings.findIndex((text) => text === void 0);
-	if (index !== -1) return fail$12(new CommandLineError({
-		reason: "InvalidEscape",
-		message: `Template part ${index} contains an invalid escape sequence`
-	}));
-	return parseTemplate$1(strings, expressions);
-};
-const unwrap$1 = (item) => isRedacted(item) ? value$2(item) : String(item);
-const toWord = (item) => isRedacted(item) ? item : String(item);
-const reservedWords = /*#__PURE__*/ new Set([
-	"!",
-	"{",
-	"}",
-	"and",
-	"begin",
-	"case",
-	"coproc",
-	"do",
-	"done",
-	"elif",
-	"else",
-	"end",
-	"esac",
-	"fi",
-	"for",
-	"foreach",
-	"function",
-	"if",
-	"in",
-	"nocorrect",
-	"not",
-	"or",
-	"repeat",
-	"select",
-	"switch",
-	"then",
-	"time",
-	"until",
-	"while"
-]);
-const quoteWord = (format, value, program) => {
-	switch (format) {
-		case "posix": return program && reservedWords.has(value) ? `'${value}'` : quotePosix(value);
-		case "powershell": return quotePowerShell(value);
-		case "windows": return program && !value.includes("\"") ? quoteWindowsProgram(value) : quoteWindowsArgument(value);
-	}
-};
-const joinWords = (format, quoted) => format === "powershell" ? `& ${quoted.join(" ")}` : quoted.join(" ");
-const posixSafe = /^[A-Za-z0-9_@+:,./-]+$/;
-const quotePosix = (value) => posixSafe.test(value) ? value : `'${value.replace(/['\\]/g, (char) => `'\\${char}'`)}'`;
-const quotePowerShell = (value) => `'${value.replace(/['\u2018\u2019\u201A\u201B]/g, "$&$&")}'`;
-const windowsNeedsQuotes = /[ \t\n\v"]/;
-const quoteWindowsArgument = (value) => {
-	if (value.length > 0 && !windowsNeedsQuotes.test(value)) return value;
-	let out = "\"";
-	let backslashes = 0;
-	for (const char of value) if (char === "\\") backslashes++;
-	else if (char === "\"") {
-		out += "\\".repeat(backslashes * 2 + 1) + "\"";
-		backslashes = 0;
-	} else {
-		out += "\\".repeat(backslashes) + char;
-		backslashes = 0;
-	}
-	return out + "\\".repeat(backslashes * 2) + "\"";
-};
-const quoteWindowsProgram = (value) => value.length > 0 && !/[ \t]/.test(value) ? value : `"${value}"`;
-const controlCharacters = /[\u0000-\u001f\u007f-\u009f\u2028\u2029]/g;
-const controlEscapes = {
-	"\n": "\\n",
-	"\r": "\\r",
-	"	": "\\t"
-};
-const escapeControlCharacters$1 = (value) => value.replace(controlCharacters, (char) => controlEscapes[char] ?? `\\u${char.charCodeAt(0).toString(16).padStart(4, "0")}`);
-const operators = "|&;<>()";
-const globs = "*?[";
-const expansionStart = /[A-Za-z_0-9{(@*#?$!'"-]/;
-const quotedExpansionStart = /[A-Za-z_0-9{(@*#?$!-]/;
-const assignmentName = /^[A-Za-z_][A-Za-z0-9_]*\+?$/;
-const isBlank = (char) => char === " " || char === "	" || char === "\n";
-const unsupportedSyntax = (char, next, wordStart) => {
-	if (operators.includes(char)) return `The operator "${char}" needs a shell`;
-	if (char === "`") return "Command substitution needs a shell";
-	if (char === "$" && next !== void 0 && expansionStart.test(next)) return `The expansion "$${next}" needs a shell`;
-	if (globs.includes(char)) return `The glob character "${char}" needs a shell`;
-	if (!wordStart) return void 0;
-	if (char === "#") return "A comment needs a shell";
-	if (char === "~") return "Tilde expansion needs a shell";
-	if (char === "=" && next !== void 0 && !isBlank(next)) return "A leading \"=\" is expanded by zsh";
-};
-const parseTemplate$1 = (texts, values) => {
-	const words = [];
-	let word = [];
-	let plain = true;
-	let braceDepth = 0;
-	let quote = void 0;
-	let quotePart = 0;
-	let part = 0;
-	const error = (reason, message, at = part) => fail$12(new CommandLineError({
-		reason,
-		message: `${message} in template part ${at}`
-	}));
-	const endWord = () => {
-		if (word.length === 0) return;
-		const value = word.map(unwrap$1).join("");
-		words.push(word.length === 1 && isRedacted(word[0]) ? word[0] : word.some(isRedacted) ? make$65(value) : value);
-		word = [];
-		plain = true;
-		braceDepth = 0;
-	};
-	const scan = (text) => {
-		for (let i = 0; i < text.length; i++) {
-			const char = text[i];
-			const next = text[i + 1];
-			if (quote === "'") {
-				if (char === "'") quote = void 0;
-				else word.push(char);
-			} else if (quote === "\"") {
-				if (char === "\"") quote = void 0;
-				else if (char === "\\" && next !== void 0 && "$`\"\\\n".includes(next)) {
-					if (next !== "\n") word.push(next);
-					i++;
-				} else if (char === "`") return error("UnsupportedSyntax", "Command substitution needs a shell");
-				else if (char === "$" && next !== void 0 && quotedExpansionStart.test(next)) return error("UnsupportedSyntax", `The expansion "$${next}" needs a shell`);
-				else word.push(char);
-			} else if (isBlank(char)) endWord();
-			else if (char === "\\") {
-				if (next === void 0) return error("InvalidEscape", "A trailing backslash escapes nothing");
-				if (next !== "\n") {
-					word.push(next);
-					plain = false;
-				}
-				i++;
-			} else if (char === "'" || char === "\"") {
-				quote = char;
-				quotePart = part;
-				word.push("");
-				plain = false;
-			} else {
-				const unsupported = unsupportedSyntax(char, next, word.length === 0);
-				if (unsupported !== void 0) return error("UnsupportedSyntax", unsupported);
-				if (char === "{") braceDepth++;
-				else if (char === "}") {
-					if (braceDepth > 0) braceDepth--;
-				} else if (braceDepth > 0 && (char === "," || char === "." && next === ".")) return error("UnsupportedSyntax", "Brace expansion needs a shell");
-				else if (char === "=" && words.length === 0 && plain && assignmentName.test(word.join(""))) return error("UnsupportedSyntax", "A variable assignment needs a shell");
-				word.push(char);
-			}
-		}
-	};
-	for (; part < texts.length; part++) {
-		const failure = scan(texts[part]);
-		if (failure !== void 0) return failure;
-		if (part === values.length) break;
-		const expression = values[part];
-		if (Array.isArray(expression)) {
-			const after = texts[part + 1][0];
-			if (word.length > 0 || (after === void 0 ? part + 1 < values.length : !isBlank(after))) return error("UnsupportedSyntax", "An interpolated array must be a separate argument");
-			for (const item of expression) words.push(toWord(item));
-		} else {
-			word.push(toWord(expression));
-			plain = false;
-		}
-	}
-	if (quote !== void 0) return error("UnterminatedQuote", "The quote is not closed", quotePart);
-	endWord();
-	return succeed$10(words);
-};
-// ../../node_modules/.pnpm/effect@4.1.2/node_modules/effect/dist/process/ChildProcess.js
-/**
-* Describes child processes before they are started.
-*
-* A `Command` stores the executable, arguments, environment, standard streams,
-* working directory, and other process options. Commands can also be piped
-* together. A command is an `Effect`; running it asks the
-* `ChildProcessSpawner` service to start the process and returns a
-* `ChildProcessHandle`.
-*
-* @stability unstable
-* @since 4.0.0
-*/
-const TypeId$5 = "~effect/process/ChildProcess";
-const Proto$3 = {
-	.../*#__PURE__*/ Prototype({
-		label: "Command",
-		evaluate(fiber) {
-			return getUnsafe$2(fiber.context, ChildProcessSpawner).spawn(this);
-		}
-	}),
-	[TypeId$5]: TypeId$5
-};
-const makeStandardCommand = (command, args, options) => Object.assign(Object.create(Proto$3), {
-	_tag: "StandardCommand",
-	command,
-	args,
-	options
-});
-/**
-* Create a command from a template literal, options + template, or array form.
-*
-* **Details**
-*
-* This function supports three calling conventions:
-* 1. Template literal: `make\`npm run build\``
-* 2. Options + template literal: `make({ cwd: "/app" })\`npm run build\``
-* 3. Array form: `make("npm", ["run", "build"], options?)`
-*
-* Templates are split with `CommandLine.template`: quotes group words, each
-* `${}` value is one literal argument, and an argument that contains a
-* `Redacted` value stays `Redacted`. Arguments in the array form can be
-* `Redacted` too.
-*
-* With the `shell` option, the template text is the shell script and is kept
-* as written.
-*
-* **Gotchas**
-*
-* - A template is parsed when `make` is called. Shell syntax such as `|`,
-*   `$HOME`, `*` or `~` throws a `CommandLine.CommandLineError`: quote it, or
-*   pass the value with `${}`.
-* - A template with the `shell` option cannot contain `${}` values, because
-*   their quoting depends on the shell. Build the script with
-*   `CommandLine.quote` and pass it as a string.
-* - The program name, the first word, cannot be `Redacted`.
-* - A NUL character in the command, an argument or an `env` value fails with
-*   a `BadArgument` error when the command is spawned.
-*
-* **Example** (Creating commands)
-*
-* ```ts import.meta.vitest
-* import { ChildProcess } from "effect/process"
-*
-* // Template literal form; quotes group words
-* const cmd1 = ChildProcess.make`echo "hello world"`
-*
-* // With options
-* const cmd2 = ChildProcess.make({ cwd: "/tmp" })`ls -la`
-*
-* // Array form
-* const cmd3 = ChildProcess.make("git", ["status"])
-*
-* const result = [cmd1.args[0], cmd2.options.cwd, cmd3.args[0]] // => ["hello world", "/tmp", "status"]
-* ```
-*
-* @stability unstable
-* @category constructors
-* @since 4.0.0
-*/
-const make$11 = function make(...args) {
+const make$12 = function make(...args) {
 	if (isTemplateString(args[0])) {
 		const [templates, ...expressions] = args;
 		const [command, cmdArgs] = parseTemplate(templates, expressions);
@@ -75167,7 +74532,7 @@ const taskkill = (childProcess, onExit = () => {}) => {
 * @category layers
 * @since 4.0.0
 */
-const layer$14 = /*#__PURE__*/ effect(ChildProcessSpawner, /* @__PURE__ */ gen(function* () {
+const layer$16 = /*#__PURE__*/ effect(ChildProcessSpawner, /* @__PURE__ */ gen(function* () {
 	const fs = yield* FileSystem;
 	const path = yield* Path$1;
 	const resolveWorkingDirectory = fnUntraced(function* (options) {
@@ -75529,7 +74894,7 @@ const layer$14 = /*#__PURE__*/ effect(ChildProcessSpawner, /* @__PURE__ */ gen(f
 					const stdinConfig = resolveStdinOption(command.options);
 					const sourceStream = unwrap$3(succeed$5(getSourceStream(handles[handles.length - 1], options.from)));
 					const toOption = options.to ?? "stdin";
-					if (toOption === "stdin") handles.push(yield* spawnCommand(make$11(command.command, command.args, {
+					if (toOption === "stdin") handles.push(yield* spawnCommand(make$12(command.command, command.args, {
 						...command.options,
 						stdin: {
 							...stdinConfig,
@@ -75549,14 +74914,14 @@ const layer$14 = /*#__PURE__*/ effect(ChildProcessSpawner, /* @__PURE__ */ gen(f
 								type: "input",
 								stream: sourceStream
 							};
-							handles.push(yield* spawnCommand(make$11(command.command, command.args, {
+							handles.push(yield* spawnCommand(make$12(command.command, command.args, {
 								...command.options,
 								additionalFds: {
 									...existingFds,
 									[fdName$1]: fdConfig
 								}
 							})));
-						} else handles.push(yield* spawnCommand(make$11(command.command, command.args, {
+						} else handles.push(yield* spawnCommand(make$12(command.command, command.args, {
 							...command.options,
 							stdin: {
 								...stdinConfig,
@@ -79504,6 +78869,79 @@ require_sender();
 require_subprotocol();
 require_websocket();
 var import_websocket_server = /* @__PURE__ */ __toESM(require_websocket_server(), 1);
+/**
+* Service that derives bytes from a secret.
+*
+* **Example** (Deriving a key with HKDF)
+*
+* ```ts import.meta.vitest
+* import { Effect } from "effect"
+* import { Kdf } from "effect/crypto"
+*
+* const program = Effect.gen(function*() {
+*   const kdf = yield* Kdf.Kdf
+*   return yield* kdf.derive(Kdf.hkdfSha256, new Uint8Array(32), {
+*     salt: new Uint8Array(16),
+*     info: new TextEncoder().encode("encryption"),
+*     length: 32
+*   })
+* })
+*
+* const bytes = await Effect.runPromise(program.pipe(Effect.provide(Kdf.layerWebCrypto)))
+* bytes.length // => 32
+* ```
+*
+* @stability unstable
+* @category services
+* @since 4.0.0
+*/
+var Kdf = class extends (/*#__PURE__*/ Service$2()("effect/crypto/Kdf")) {};
+const invalidArgument$1 = (description) => fail$6("Kdf", "derive", new InvalidArgument$1({ description }));
+const isIntegerIn$1 = (n, min, max) => Number.isSafeInteger(n) && n >= min && n <= max;
+const checkArguments = (algorithm, options) => {
+	if (algorithm._tag !== "Hkdf" && options.info !== void 0) return invalidArgument$1("info only applies to HKDF");
+	if (algorithm._tag === "Argon2id") return void 0;
+	if (algorithm.hash.name === "MD5") return invalidArgument$1(`${algorithm._tag} needs a SHA hash, not MD5`);
+	if (algorithm._tag === "Hkdf") {
+		const maxLength = 255 * algorithm.hash.outputLength;
+		return isIntegerIn$1(options.length, 1, maxLength) ? void 0 : invalidArgument$1(`length must be between 1 and ${maxLength} bytes for ${algorithm.name}`);
+	}
+	if (!isIntegerIn$1(algorithm.iterations, 1, 2147483647)) return invalidArgument$1("iterations must be between 1 and 2^31 - 1");
+	return isIntegerIn$1(options.length, 1, 536870911) ? void 0 : invalidArgument$1("length must be between 1 and 2^29 - 1 bytes");
+};
+const webCryptoParams = (algorithm, options) => algorithm._tag === "Hkdf" ? {
+	name: "HKDF",
+	hash: algorithm.hash.name,
+	salt: options.salt,
+	info: options.info ?? /* @__PURE__ */ new Uint8Array()
+} : {
+	name: "PBKDF2",
+	hash: algorithm.hash.name,
+	salt: options.salt,
+	iterations: algorithm.iterations
+};
+/**
+* Layer that provides `Kdf` on the `WebCrypto` reference.
+*
+* **Details**
+*
+* HKDF and PBKDF2 run on `crypto.subtle`, off the event loop where the runtime
+* supports it. Argon2id fails with an `Unsupported` reason.
+*
+* @stability unstable
+* @category layers
+* @since 4.0.0
+*/
+const layerWebCrypto = /*#__PURE__*/ effect(Kdf, /*#__PURE__*/ WebCrypto.use((crypto) => succeed$5(Kdf.of({ derive: (algorithm, secret, options) => suspend$2(() => {
+	const failure = checkArguments(algorithm, options);
+	if (failure !== void 0) return failure;
+	if (algorithm._tag === "Argon2id") return fail$6("Kdf", "derive", new Unsupported({ description: "Kdf.layerWebCrypto does not provide argon2id" }));
+	const name = algorithm._tag === "Hkdf" ? "HKDF" : "PBKDF2";
+	return run$6("Kdf", "derive", algorithm.name, crypto, async (subtle) => {
+		const handle = await subtle.importKey("raw", secret, name, false, ["deriveBits"]);
+		return new Uint8Array(await subtle.deriveBits(webCryptoParams(algorithm, options), handle, options.length * 8));
+	});
+}) }))));
 // ../../node_modules/.pnpm/@effect+platform-node-shared@4.1.2_effect@4.1.2/node_modules/@effect/platform-node-shared/dist/NodeCrypto.js
 /**
 * Node.js layers for the `effect/crypto` modules, also used by Bun.
@@ -79667,7 +79105,7 @@ const concat = (parts) => {
 * @category layers
 * @since 4.0.0
 */
-const layer$13 = /*#__PURE__*/ mergeAll$1(layerSecureRandom, layerDigest, layerMac, layerKdf, /* @__PURE__ */ layerWebCryptoWith$1(NodeCrypto.getCiphers().includes("chacha20-poly1305") ? { implementations: { chacha20Poly1305: {
+const layer$15 = /*#__PURE__*/ mergeAll$1(layerSecureRandom, layerDigest, layerMac, layerKdf, /* @__PURE__ */ layerWebCryptoWith$1(NodeCrypto.getCiphers().includes("chacha20-poly1305") ? { implementations: { chacha20Poly1305: {
 	encrypt: (key, nonce, plaintext, aad) => {
 		const cipher = NodeCrypto.createCipheriv("chacha20-poly1305", key, nonce, { authTagLength: 16 });
 		cipher.setAAD(aad);
@@ -80131,7 +79569,7 @@ const makeFileSystem = /*#__PURE__*/ map$5(/*#__PURE__*/ serviceOption(WatchBack
 * @category layers
 * @since 4.0.0
 */
-const layer$11 = /* @__PURE__ */ effect(FileSystem)(makeFileSystem);
+const layer$13 = /* @__PURE__ */ effect(FileSystem)(makeFileSystem);
 // ../../node_modules/.pnpm/@effect+platform-node@4.1.2_effect@4.1.2_redis@6.3.1/node_modules/@effect/platform-node/dist/NodeHttpIncomingMessage.js
 /**
 * Adapter base for exposing Node `http.IncomingMessage` values as Effect HTTP
@@ -80241,6 +79679,199 @@ var NodeHttpIncomingMessage = class extends Class$2 {
 		return this.arrayBufferEffect;
 	}
 };
+// ../../node_modules/.pnpm/effect@4.1.2/node_modules/effect/dist/http/FetchHttpClient.js
+/**
+* Fetch-based implementation of the Effect HTTP client service.
+*
+* This module provides an `HttpClient` layer that executes requests through a
+* Web Fetch API implementation. It is the transport to use in browsers, edge
+* runtimes, and Node.js environments where `globalThis.fetch` is available, or
+* anywhere a compatible fetch function can be supplied.
+*
+* Requests with an `Upgrade` header fail with `TransportError` before anything
+* is sent because fetch cannot hand over the connection.
+*
+* @stability unstable
+* @since 4.0.0
+*/
+/**
+* Context reference for the `fetch` implementation used by the fetch-based HTTP client.
+*
+* **Details**
+*
+* Defaults to `globalThis.fetch`.
+*
+* @stability unstable
+* @category services
+* @since 4.0.0
+*/
+const Fetch = /*#__PURE__*/ Reference("effect/http/FetchHttpClient/Fetch", { defaultValue: () => globalThis.fetch });
+/**
+* Context reference controlling stream bodies when the runtime does not support streaming requests.
+*
+* **Details**
+*
+* Defaults to `"error"`, which fails with an `EncodeError` without sending the
+* request. Set to `"buffer"` to collect the entire stream in memory and send it
+* as a single body instead. Runtimes with streaming support always send the stream.
+*
+* **Gotchas**
+*
+* Buffering keeps the entire upload in memory and can exhaust memory for large
+* or unbounded uploads. Support is detected once, on the first stream body sent,
+* using the global `Request` implementation even when a custom `Fetch` is provided.
+*
+* @stability unstable
+* @category services
+* @since 4.0.0
+*/
+const StreamBodyFallback = /*#__PURE__*/ Reference("effect/http/FetchHttpClient/StreamBodyFallback", { defaultValue: () => "error" });
+/**
+* Service that contains default fetch options for the fetch-based HTTP client.
+*
+* **When to use**
+*
+* Use to provide default credentials, cache, redirect, integrity, or other
+* fetch options for outgoing HTTP requests.
+*
+* **Details**
+*
+* Request-specific method, headers, body, and abort signal are supplied by the client when a request is executed.
+*
+* @see {@link HttpClient.followRedirects} for following redirects in the client, which needs `{ redirect: "manual" }` here
+*
+* @stability unstable
+* @category services
+* @since 4.0.0
+*/
+var RequestInit = class extends (/*#__PURE__*/ Service$2()("effect/http/FetchHttpClient/RequestInit")) {};
+let supportsStreamBody;
+const detectStreamBodySupport = () => {
+	try {
+		let duplexAccessed = false;
+		const body = new ReadableStream();
+		const request = new Request("https://example.com", {
+			method: "POST",
+			body,
+			get duplex() {
+				duplexAccessed = true;
+				return "half";
+			}
+		});
+		return (duplexAccessed || request.body === body) && !request.headers.has("Content-Type");
+	} catch {
+		return false;
+	}
+};
+/**
+* Layer that provides an `HttpClient` implementation backed by the configured
+* `Fetch` function.
+*
+* **When to use**
+*
+* Use when an Effect program should execute `HttpClient` requests through the
+* platform `fetch` implementation, especially in browser, edge, or Node.js
+* runtimes with `globalThis.fetch`.
+*
+* **Details**
+*
+* The layer uses the current `Fetch` reference and optional `RequestInit`
+* service for each request. Request-specific method, headers, body, and abort
+* signal are supplied by the client and override matching `RequestInit` fields.
+*
+* **Gotchas**
+*
+* Fetch behavior comes from the runtime's implementation, so CORS, cookies,
+* redirects, abort handling, and streaming support can vary by platform.
+* `fetch` follows redirects itself by default, so `HttpClient.followRedirects`
+* has no effect unless `RequestInit` sets `redirect: "manual"`. Trace
+* propagation is on by default, and a browser preflight fails unless the
+* target allows `b3` and `traceparent`. Stream request bodies are sent as Web
+* streams with `duplex: "half"` when the runtime supports it; see
+* `StreamBodyFallback` for the unsupported case. Any `content-length` header is
+* removed before calling `fetch`. Chrome passes the support check but rejects
+* streaming uploads over HTTP/1.1, which surfaces as a `TransportError`, and
+* browsers only deliver the response after the entire request body has been sent.
+*
+* @see {@link Fetch} for supplying the fetch implementation used by this layer
+* @see {@link RequestInit} for default `RequestInit` options applied before request-specific fields
+* @see {@link StreamBodyFallback} for opting into buffering on unsupported runtimes
+* @see {@link HttpClient.TracerPropagationEnabled} for leaving `b3` and `traceparent` off a browser request
+*
+* @stability unstable
+* @category layers
+* @since 4.0.0
+*/
+const layer$12 = /*#__PURE__*/ layerMergedContext(/*#__PURE__*/ succeed$5(/* @__PURE__ */ make$34((request, url, signal, fiber) => {
+	if (request.headers.upgrade !== void 0) return fail$7(new HttpClientError({ reason: new TransportError({
+		request,
+		description: "fetch cannot send an HTTP upgrade request"
+	}) }));
+	const fetch = fiber.getRef(Fetch);
+	const options = getOrUndefined(fiber.context, RequestInit) ?? {};
+	let headers = options.headers ? merge$2(fromInput$1(options.headers), request.headers) : request.headers;
+	if (headers["content-length"]) headers = remove$1(headers, "content-length");
+	let uploadController;
+	const stopUpload = sync(() => uploadController?.abort());
+	const send = (body) => map$5(tryPromise({
+		try: () => fetch(url, {
+			...options,
+			method: request.method,
+			headers,
+			body,
+			duplex: typeof ReadableStream !== "undefined" && body instanceof ReadableStream ? "half" : void 0,
+			signal: uploadController ? AbortSignal.any([signal, uploadController.signal]) : signal
+		}),
+		catch: (cause) => new HttpClientError({ reason: new TransportError({
+			request,
+			cause
+		}) })
+	}), (response) => {
+		const original = fromWeb(request, response);
+		if (!uploadController) return original;
+		if (response.body === null) uploadController.abort();
+		return Object.create(original, {
+			...Object.fromEntries([
+				"arrayBuffer",
+				"text",
+				"json",
+				"formData",
+				"urlParamsBody"
+			].map((key) => [key, { get: () => ensuring$2(original[key], stopUpload) }])),
+			stream: { get: () => ensuring(original.stream, stopUpload) }
+		});
+	}).pipe(onError(() => stopUpload));
+	switch (request.body._tag) {
+		case "Raw":
+		case "Uint8Array": return send(request.body.body);
+		case "FormData": return send(request.body.formData);
+		case "Stream":
+			supportsStreamBody ??= detectStreamBodySupport();
+			if (supportsStreamBody) {
+				uploadController = new AbortController();
+				const uploadSignal = AbortSignal.any([signal, uploadController.signal]);
+				const stopped = callback$1((resume) => {
+					const onAbort = () => resume(interrupt$1);
+					if (uploadSignal.aborted) {
+						onAbort();
+						return;
+					}
+					uploadSignal.addEventListener("abort", onAbort, { once: true });
+					return sync(() => uploadSignal.removeEventListener("abort", onAbort));
+				});
+				return flatMap$3(toReadableStreamEffect(interruptWhen(request.body.stream, stopped)), send);
+			}
+			if (fiber.getRef(StreamBodyFallback) === "error") return fail$7(new HttpClientError({ reason: new EncodeError({
+				request,
+				description: "Streaming request bodies are not supported in this runtime"
+			}) }));
+			return mkArrayBuffer(request.body.stream).pipe(mapError$2((cause) => new HttpClientError({ reason: new EncodeError({
+				request,
+				cause
+			}) })), flatMap$3(send));
+	}
+	return send(void 0);
+})));
 // ../../node_modules/.pnpm/@effect+platform-node@4.1.2_effect@4.1.2_redis@6.3.1/node_modules/@effect/platform-node/dist/internal/upgrade.js
 /**
 * Wraps an upgraded connection. Acquiring the reader runs `open`; releasing
@@ -80412,7 +80043,7 @@ const compress = (data, algorithm, options) => callback$1((resume) => {
 * @category constructors
 * @since 4.0.0
 */
-const make$9 = (fallback) => ({
+const make$10 = (fallback) => ({
 	algorithms: fallback.algorithms,
 	compressResponse(response, algorithm, options) {
 		const body = response.body;
@@ -80498,9 +80129,9 @@ const compressedBody = (response, body) => removeHeader(setBody(response, body),
 * @category constructors
 * @since 4.0.0
 */
-const make$8 = /*#__PURE__*/ make$26({
+const make$9 = /*#__PURE__*/ make$26({
 	platform: "node",
-	compression: /* @__PURE__ */ make$9({
+	compression: /* @__PURE__ */ make$10({
 		algorithms,
 		compressResponse(response, algorithm, options) {
 			const body = response.body;
@@ -80555,7 +80186,7 @@ const make$8 = /*#__PURE__*/ make$26({
 * @category layers
 * @since 4.0.0
 */
-const layer$10 = /*#__PURE__*/ pipe(/*#__PURE__*/ effect(HttpPlatform)(make$8), /*#__PURE__*/ provide$2(layer$11), /*#__PURE__*/ provide$2(layer$20));
+const layer$11 = /*#__PURE__*/ pipe(/*#__PURE__*/ effect(HttpPlatform)(make$9), /*#__PURE__*/ provide$2(layer$13), /*#__PURE__*/ provide$2(layer$20));
 // ../../node_modules/.pnpm/@effect+platform-node@4.1.2_effect@4.1.2_redis@6.3.1/node_modules/@effect/platform-node/dist/NodeMultipartParser.js
 /**
 * Node.js streams adapter for the low-level multipart parser.
@@ -80656,7 +80287,7 @@ var MultipartStream = class extends Duplex {
 * @category constructors
 * @since 4.0.0
 */
-const make$7 = (config) => new MultipartStream(config);
+const make$8 = (config) => new MultipartStream(config);
 /**
 * A readable stream containing a parsed multipart file.
 *
@@ -80704,7 +80335,7 @@ var FileStream = class extends Readable {
 */
 const stream = (source, headers) => makeConfig(headers).pipe(map$5((config) => fromReadable({
 	evaluate() {
-		const parser = make$7(config);
+		const parser = make$8(config);
 		const cleanup = finished(source, {
 			readable: true,
 			writable: false
@@ -80857,7 +80488,7 @@ const fileUrlOps = (windows) => ({
 * @category layers
 * @since 4.0.0
 */
-const layer$8 = /* @__PURE__ */ succeed$6(Path$1)(/*#__PURE__*/ make$50({
+const layer$9 = /* @__PURE__ */ succeed$6(Path$1)(/*#__PURE__*/ make$50({
 	...Path,
 	.../*#__PURE__*/ fileUrlOps(void 0)
 }));
@@ -80881,7 +80512,7 @@ const layer$8 = /* @__PURE__ */ succeed$6(Path$1)(/*#__PURE__*/ make$50({
 * @category layers
 * @since 4.0.0
 */
-const layer$6 = /* @__PURE__ */ succeed$6(Stdio, /*#__PURE__*/ make$42({
+const layer$7 = /* @__PURE__ */ succeed$6(Stdio, /*#__PURE__*/ make$42({
 	args: /*#__PURE__*/ sync(() => process.argv.slice(2)),
 	stdinIsTerminal: /*#__PURE__*/ sync(() => process.stdin.isTTY === true),
 	stdoutIsTerminal: /*#__PURE__*/ sync(() => process.stdout.isTTY === true),
@@ -80925,7 +80556,7 @@ const layer$6 = /* @__PURE__ */ succeed$6(Stdio, /*#__PURE__*/ make$42({
 * @category layers
 * @since 4.0.0
 */
-const layer$5 = /*#__PURE__*/ effect(Terminal, /*#__PURE__*/ (/* @__PURE__ */ fnUntraced(function* (shouldQuit = defaultShouldQuit) {
+const layer$6 = /*#__PURE__*/ effect(Terminal, /*#__PURE__*/ (/* @__PURE__ */ fnUntraced(function* (shouldQuit = defaultShouldQuit) {
 	const stdin = process.stdin;
 	const stdout = process.stdout;
 	const lines = yield* make$74();
@@ -81057,7 +80688,7 @@ function defaultShouldQuit(input) {
 * @category layers
 * @since 4.0.0
 */
-const layer$3 = /*#__PURE__*/ provideMerge(layer$14, /*#__PURE__*/ mergeAll$1(layer$11, layer$8, layer$6, layer$5));
+const layer$4 = /*#__PURE__*/ provideMerge(layer$16, /*#__PURE__*/ mergeAll$1(layer$13, layer$9, layer$7, layer$6));
 // ../../node_modules/.pnpm/@effect+platform-node@4.1.2_effect@4.1.2_redis@6.3.1/node_modules/@effect/platform-node/dist/NodeHttpServer.js
 /**
 * Node.js implementation of the Effect `HttpServer`.
@@ -81135,7 +80766,7 @@ const layer$3 = /*#__PURE__*/ provideMerge(layer$14, /*#__PURE__*/ mergeAll$1(la
 * @category constructors
 * @since 4.0.0
 */
-const make$5 = /*#__PURE__*/ fnUntraced(function* (evaluate, options) {
+const make$6 = /*#__PURE__*/ fnUntraced(function* (evaluate, options) {
 	const scope$4 = yield* scope;
 	const server = evaluate();
 	let closing = false;
@@ -81520,7 +81151,7 @@ var ServerRequestImpl = class ServerRequestImpl extends NodeHttpIncomingMessage
 * @category layers
 * @since 4.0.0
 */
-const layerHttpServices = /*#__PURE__*/ mergeAll$1(layer$10, layerWeak, layer$3);
+const layerHttpServices = /*#__PURE__*/ mergeAll$1(layer$11, layerWeak, layer$4);
 /**
 * Provides a Node `HttpServer` together with the Node HTTP platform, ETag,
 * and core Node platform services, reading the listen and shutdown options from
@@ -81530,7 +81161,7 @@ const layerHttpServices = /*#__PURE__*/ mergeAll$1(layer$10, layerWeak, layer$3)
 * @category layers
 * @since 4.0.0
 */
-const layerConfig = (evaluate, options) => mergeAll$1(effect(HttpServer)(flatMap$3(unwrap$2(options), (options) => make$5(evaluate, options))), layerHttpServices);
+const layerConfig = (evaluate, options) => mergeAll$1(effect(HttpServer)(flatMap$3(unwrap$2(options), (options) => make$6(evaluate, options))), layerHttpServices);
 http.createServer;
 const closeCode = (exit) => isSuccess(exit) ? 1e3 : hasInterruptsOnly(exit.cause) ? 1001 : 1011;
 const upgradedResponse = /*#__PURE__*/ empty({ status: 101 });
@@ -85141,7 +84772,7 @@ const Formatter = /*#__PURE__*/ Reference("effect/cli/CliOutput", { defaultValue
 */
 const defaultPresenter = { present: /*#__PURE__*/ fnUntraced(function* (event) {
 	const context$2 = yield* context();
-	const formatter = getOrUndefined(context$2, Formatter) ?? defaultFormatter({ colors: get$11(context$2, TerminalCapabilities).canColor });
+	const formatter = getOrUndefined(context$2, Formatter) ?? defaultFormatter({ colors: get$10(context$2, TerminalCapabilities).canColor });
 	switch (event._tag) {
 		case "Help": return yield* log(formatter.formatHelpDoc(event.helpDoc));
 		case "InvalidInvocation":
@@ -87536,7 +87167,7 @@ const defaults = { builtIns: BuiltIns };
 *
 * @internal
 */
-const resolveFormatter = /*#__PURE__*/ contextWith((context) => succeed$5(getOrUndefined(context, Formatter) ?? defaultFormatter({ colors: get$11(context, TerminalCapabilities).canColor })));
+const resolveFormatter = /*#__PURE__*/ contextWith((context) => succeed$5(getOrUndefined(context, Formatter) ?? defaultFormatter({ colors: get$10(context, TerminalCapabilities).canColor })));
 // ../../node_modules/.pnpm/effect@4.1.2/node_modules/effect/dist/cli/internal/lexer.js
 /**
 * @internal
@@ -88457,7 +88088,7 @@ const isCommand = (u) => hasProperty(u, TypeId$1);
 * @category constructors
 * @since 4.0.0
 */
-const make$4 = (name, config, handler) => {
+const make$5 = (name, config, handler) => {
 	const parsedConfig = parseConfig(config ?? {});
 	return makeCommand({
 		name,
@@ -88907,115 +88538,458 @@ const run = /*#__PURE__*/ dual(2, (command, config) => Stdio.use(({ args }) => f
 *   yield* runCommand(["--name", "Alice", "--count", "2"])
 * })
 *
-* await Effect.runPromise(testProgram.pipe(Effect.provide(CliTestLayer)))
-* output // => ["Hello, Alice!", "Hello, Alice!"]
+* await Effect.runPromise(testProgram.pipe(Effect.provide(CliTestLayer)))
+* output // => ["Hello, Alice!", "Hello, Alice!"]
+* ```
+*
+* @stability unstable
+* @category running
+* @since 4.0.0
+*/
+const runWith = (command, config) => {
+	const commandImpl = toImpl(command);
+	return fnUntraced(function* (args) {
+		const { builtIns } = yield* CliConfig;
+		const { tokens, trailingOperands } = lex(args);
+		const allFlags = getGlobalFlagsForCommandTree(command, builtIns);
+		const allFlagParams = allFlags.flatMap((f) => extractSingleParams(f.flag));
+		const globalRegistry = createFlagRegistry(allFlagParams.filter(isFlagParam));
+		const { flagMap, remainder, errors: globalFlagErrors } = consumeGlobalFlags(tokens, command, globalRegistry);
+		const emptyArgs = {
+			flags: flagMap,
+			arguments: []
+		};
+		const parsedArgs = yield* parseArgs({
+			tokens: remainder,
+			trailingOperands
+		}, command);
+		const commandPath = [command.name, ...getCommandPath(parsedArgs)];
+		const toShowHelp = mapError$2((error) => error._tag === "ShowHelp" ? error : new ShowHelp({
+			commandPath,
+			errors: [error]
+		}));
+		const handlerCtx = {
+			builtIns,
+			command,
+			commandPath,
+			version: config.version
+		};
+		const activeFlags = getGlobalFlagsForCommandPath(command, commandPath, builtIns);
+		const outOfScopeErrors = getOutOfScopeGlobalFlagErrors(allFlags, activeFlags, flagMap, commandPath);
+		if (outOfScopeErrors.length > 0 || globalFlagErrors.length > 0) {
+			const parseErrors = parsedArgs.errors ?? [];
+			return yield* new ShowHelp({
+				commandPath,
+				errors: [
+					...globalFlagErrors,
+					...outOfScopeErrors,
+					...parseErrors
+				]
+			});
+		}
+		for (const flag of activeFlags) {
+			if (flag._tag !== "Action") continue;
+			if (!extractSingleParams(flag.flag).some((s) => {
+				const entries = flagMap[s.name];
+				return entries !== void 0 && entries.length > 0;
+			})) continue;
+			const [, value] = yield* flag.flag.parse(emptyArgs).pipe(toShowHelp);
+			if (flag === Wizard) {
+				const { colors } = yield* Theme;
+				return yield* gen(function* () {
+					yield* log(renderIntroduction(command.name, config.version, command.description, colors));
+					const prefix = [command.name, ...args.filter((arg) => arg !== "--wizard" && !arg.startsWith("--wizard="))];
+					const wizardResult = yield* run$1(command, {
+						commandPath,
+						prefix
+					});
+					yield* log(renderCompletion(wizardResult.displayArgs, colors));
+					if (yield* run$2(Toggle({
+						message: "Run this command?",
+						initial: true,
+						active: "yes",
+						inactive: "no"
+					}))) {
+						yield* log();
+						yield* runWith(command, {
+							...config,
+							renderErrors: false
+						})(wizardResult.args.slice(1));
+					}
+				}).pipe(catchTag("QuitError", () => log(renderQuit(colors))));
+			}
+			yield* flag.run(value, handlerCtx);
+			return;
+		}
+		if (parsedArgs.errors && parsedArgs.errors.length > 0) return yield* new ShowHelp({
+			commandPath,
+			errors: parsedArgs.errors
+		});
+		const input = yield* commandImpl.parse(parsedArgs).pipe(toShowHelp);
+		let program = commandImpl.handle(input, [command.name]);
+		const logLevel = activeFlags.includes(LogLevel) ? (yield* LogLevel.flag.parse(emptyArgs).pipe(toShowHelp))[1] : none();
+		program = provideService(program, LogLevel, logLevel);
+		for (const flag of activeFlags) {
+			if (flag._tag !== "Setting" || flag === LogLevel) continue;
+			const [, value] = yield* flag.flag.parse(emptyArgs).pipe(toShowHelp);
+			program = provideService(program, flag, value);
+		}
+		const services = match$8(logLevel, {
+			onNone: () => empty$14(),
+			onSome: (level) => make$81(MinimumLogLevel, level)
+		});
+		yield* provideContext$2(program, services);
+	}, catchFilter((error) => isCliError(error) && error._tag === "ShowHelp" ? succeed$10(error) : fail$12(error), (error) => andThen(showHelp(command, error, config.renderErrors !== false), fail$7(error))), catchFilter((error) => {
+		if (config.renderErrors === false || !isObjectKeyword(error)) return fail$12(error);
+		const userMessage = getUserMessage(error);
+		return userMessage === void 0 ? fail$12(error) : succeed$10({
+			error,
+			userMessage
+		});
+	}, ({ error, userMessage }) => andThen(showUserError(error, userMessage), fail$7(error))), catchFilter((e) => isQuitError(e) ? succeed$10(e) : fail$12(e), (_) => interrupt$1));
+};
+// ../../node_modules/.pnpm/effect@4.1.2/node_modules/effect/dist/http/HttpStaticServer.js
+/**
+* Serves static files for Effect HTTP applications.
+*
+* `HttpStaticServer` turns request paths into file responses under a configured
+* root directory. It can be used as an application value or mounted onto an
+* `HttpRouter`, and it handles index files, optional single-page application
+* fallback, MIME type headers, cache-control headers, byte ranges, and
+* conditional `304 Not Modified` responses.
+*
+* @stability unstable
+* @since 4.0.0
+*/
+/**
+* Creates an `HttpApp` that serves files from a directory.
+*
+* **Example** (Serving files from a directory)
+*
+* ```ts import.meta.vitest
+* import { ByteSize, Effect, FileSystem, Layer, Path } from "effect"
+* import {
+*   HttpEffect,
+*   HttpPlatform,
+*   HttpServerResponse,
+*   HttpStaticServer
+* } from "effect/http"
+*
+* const TestFileSystem = FileSystem.layerNoop({
+*   stat: () =>
+*     Effect.succeed({
+*       type: "File",
+*       size: ByteSize.bytes(20)
+*     } as FileSystem.File.Info)
+* })
+* const TestHttpPlatform = Layer.succeed(
+*   HttpPlatform.HttpPlatform,
+*   HttpPlatform.HttpPlatform.of({
+*     platform: "web",
+*     fileResponse: (path) => Effect.succeed(HttpServerResponse.text(`Serving ${path}`)),
+*     fileWebResponse: () => Effect.die("unused")
+*   })
+* )
+* const TestServices = Layer.mergeAll(Path.layer, TestFileSystem, TestHttpPlatform)
+*
+* const program = Effect.gen(function*() {
+*   const app = yield* HttpStaticServer.make({ root: "/public" })
+*   const handler = HttpEffect.toWebHandler(app)
+*   const response = yield* Effect.promise(() => handler(new Request("http://localhost/guide.txt")))
+*   const body = yield* Effect.promise(() => response.text())
+*   return body
+* }).pipe(Effect.provide(TestServices))
+*
+* await Effect.runPromise(program) // => "Serving /public/guide.txt"
+* ```
+*
+* @stability unstable
+* @category constructors
+* @since 4.0.0
+*/
+const make$4 = /*#__PURE__*/ fnUntraced(function* (options) {
+	const fileSystem = yield* FileSystem;
+	const path = yield* Path$1;
+	const platform = yield* HttpPlatform;
+	const resolvedRoot = path.resolve(options.root);
+	const index = "index" in options ? options.index : "index.html";
+	const spa = options.spa === true;
+	const cacheControl = options.cacheControl;
+	const mimeTypes = {
+		...defaultMimeTypes,
+		...options.mimeTypes
+	};
+	const setFileHeaders = (response, filePath) => {
+		let currentResponse = setHeaders(response, {
+			"Content-Type": resolveMimeType(path, filePath, mimeTypes),
+			"Accept-Ranges": "bytes"
+		});
+		if (cacheControl !== void 0) currentResponse = setHeader(currentResponse, "Cache-Control", cacheControl);
+		return currentResponse;
+	};
+	const serveFile = fnUntraced(function* (request, filePath, fileSize) {
+		const rangeHeader = request.method === "GET" ? request.headers["range"] : void 0;
+		const shouldEvaluateConditionals = request.headers["if-match"] !== void 0 || request.headers["if-unmodified-since"] !== void 0 || request.headers["if-none-match"] !== void 0 || request.headers["if-modified-since"] !== void 0;
+		let fullResponse;
+		const getFullResponse = () => fullResponse === void 0 ? map$5(handlePlatformError(request, platform.fileResponse(filePath)), (response) => setFileHeaders(response, filePath)) : succeed$5(fullResponse);
+		if (shouldEvaluateConditionals) {
+			fullResponse = yield* getFullResponse();
+			const conditionalResponse = evaluateConditionalRequest(request, fullResponse);
+			if (conditionalResponse !== void 0) return conditionalResponse;
+		}
+		if (rangeHeader === void 0) return yield* getFullResponse();
+		const ifRange = request.headers["if-range"];
+		if (ifRange !== void 0) {
+			fullResponse = yield* getFullResponse();
+			if (!matchesIfRange(ifRange, fullResponse.headers["etag"])) return fullResponse;
+		}
+		const resolvedFileSize = fileSize ?? (yield* handlePlatformError(request, fileSystem.stat(filePath))).size;
+		const parsedRange = parseRange(rangeHeader, resolvedFileSize);
+		if (parsedRange === void 0) return yield* getFullResponse();
+		if (parsedRange === "unsatisfiable") return empty({
+			status: 416,
+			headers: { "Content-Range": `bytes */${resolvedFileSize}` }
+		});
+		let response = setFileHeaders(yield* handlePlatformError(request, platform.fileResponse(filePath, {
+			status: 206,
+			offset: parsedRange.start,
+			bytesToRead: parsedRange.end - parsedRange.start + BigInt(1)
+		})), filePath);
+		response = setHeader(response, "Content-Range", `bytes ${parsedRange.start}-${parsedRange.end}/${resolvedFileSize}`);
+		return response;
+	});
+	return HttpServerRequest.use((request) => {
+		const resolvedPath = resolveFilePath(path, resolvedRoot, request.url);
+		if (resolvedPath === void 0) return fail$7(toRouteNotFoundError(request));
+		return matchEffect(fileSystem.stat(resolvedPath), {
+			onFailure: (error) => error.reason._tag === "NotFound" && spa && index !== void 0 && path.extname(resolvedPath) === "" && acceptsHtml(request.headers["accept"]) ? serveFile(request, path.join(resolvedRoot, index)) : error.reason._tag === "NotFound" ? fail$7(toRouteNotFoundError(request)) : fail$7(toInternalServerError(request, error)),
+			onSuccess(info) {
+				if (info.type === "File") return serveFile(request, resolvedPath, info.size);
+				if (info.type === "Directory" && index !== void 0) {
+					let originalUrl = request.originalUrl;
+					if (!originalUrl.startsWith("/")) {
+						const url = new URL(originalUrl);
+						originalUrl = url.pathname + url.search;
+					}
+					const pathname = stripQueryString(originalUrl);
+					if (!pathname.endsWith("/")) {
+						const location = pathname.replace(/^\/+/, "/").replace(/\\/g, "%5C");
+						return succeed$5(redirect(`${location}/${originalUrl.slice(pathname.length)}`, { status: 301 }));
+					}
+					return serveFile(request, path.join(resolvedPath, index));
+				}
+				return fail$7(toRouteNotFoundError(request));
+			}
+		});
+	});
+});
+/**
+* Creates a layer that mounts static files on an `HttpRouter`.
+*
+* **Example** (Mounting static files on a router)
+*
+* ```ts import.meta.vitest
+* import { Layer } from "effect"
+* import { HttpRouter, HttpServerResponse, HttpStaticServer } from "effect/http"
+*
+* const ApiLayer = HttpRouter.add("GET", "/health", HttpServerResponse.text("ok"))
+*
+* const StaticFilesLayer = HttpStaticServer.layer({
+*   root: "./public",
+*   prefix: "/static"
+* })
+*
+* const AppLayer = Layer.mergeAll(ApiLayer, StaticFilesLayer)
+* Layer.isLayer(AppLayer) // => true
 * ```
 *
 * @stability unstable
-* @category running
+* @category layers
 * @since 4.0.0
 */
-const runWith = (command, config) => {
-	const commandImpl = toImpl(command);
-	return fnUntraced(function* (args) {
-		const { builtIns } = yield* CliConfig;
-		const { tokens, trailingOperands } = lex(args);
-		const allFlags = getGlobalFlagsForCommandTree(command, builtIns);
-		const allFlagParams = allFlags.flatMap((f) => extractSingleParams(f.flag));
-		const globalRegistry = createFlagRegistry(allFlagParams.filter(isFlagParam));
-		const { flagMap, remainder, errors: globalFlagErrors } = consumeGlobalFlags(tokens, command, globalRegistry);
-		const emptyArgs = {
-			flags: flagMap,
-			arguments: []
+const layer$2 = (options) => effectDiscard(gen(function* () {
+	const router = yield* HttpRouter;
+	const handler = (yield* make$4(options)).pipe(catch_$2(toResponse));
+	if (options.prefix !== void 0) {
+		yield* router.prefixed(options.prefix).add("GET", "/*", handler);
+		return;
+	}
+	yield* router.add("GET", "/*", handler);
+}));
+const defaultMimeTypes = {
+	html: "text/html; charset=utf-8",
+	htm: "text/html; charset=utf-8",
+	css: "text/css; charset=utf-8",
+	js: "text/javascript; charset=utf-8",
+	mjs: "text/javascript; charset=utf-8",
+	json: "application/json; charset=utf-8",
+	xml: "application/xml; charset=utf-8",
+	txt: "text/plain; charset=utf-8",
+	csv: "text/csv; charset=utf-8",
+	md: "text/markdown; charset=utf-8",
+	yaml: "text/yaml; charset=utf-8",
+	yml: "text/yaml; charset=utf-8",
+	png: "image/png",
+	jpg: "image/jpeg",
+	jpeg: "image/jpeg",
+	gif: "image/gif",
+	svg: "image/svg+xml; charset=utf-8",
+	ico: "image/x-icon",
+	webp: "image/webp",
+	avif: "image/avif",
+	woff: "font/woff",
+	woff2: "font/woff2",
+	ttf: "font/ttf",
+	otf: "font/otf",
+	eot: "application/vnd.ms-fontobject",
+	mp3: "audio/mpeg",
+	mp4: "video/mp4",
+	webm: "video/webm",
+	ogg: "audio/ogg",
+	wav: "audio/wav",
+	flac: "audio/flac",
+	aac: "audio/aac",
+	pdf: "application/pdf",
+	zip: "application/zip",
+	gz: "application/gzip",
+	wasm: "application/wasm",
+	map: "application/json",
+	webmanifest: "application/manifest+json"
+};
+const stripQueryString = (url) => {
+	const queryIndex = url.indexOf("?");
+	return queryIndex === -1 ? url : url.slice(0, queryIndex);
+};
+const resolveMimeType = (path, filePath, mimeTypes) => {
+	const extension = path.extname(filePath).toLowerCase();
+	if (extension.length <= 1) return "application/octet-stream";
+	return mimeTypes[extension.slice(1)] ?? "application/octet-stream";
+};
+const parseInteger = (value) => {
+	if (!/^\d+$/.test(value)) return;
+	return BigInt(value);
+};
+const parseRange = (header, fileSize) => {
+	const value = header.trim();
+	if (!value.toLowerCase().startsWith("bytes=")) return;
+	const rangeValue = value.slice(6).trim();
+	if (rangeValue.length === 0 || rangeValue.includes(",")) return;
+	const separatorIndex = rangeValue.indexOf("-");
+	if (separatorIndex === -1) return;
+	const startPart = rangeValue.slice(0, separatorIndex).trim();
+	const endPart = rangeValue.slice(separatorIndex + 1).trim();
+	if (startPart === "" && endPart === "") return;
+	if (startPart === "") {
+		const suffixLength = parseInteger(endPart);
+		if (suffixLength === void 0) return;
+		if (suffixLength === BigInt(0) || fileSize === BigInt(0)) return "unsatisfiable";
+		return {
+			start: fileSize > suffixLength ? fileSize - suffixLength : BigInt(0),
+			end: fileSize - BigInt(1)
 		};
-		const parsedArgs = yield* parseArgs({
-			tokens: remainder,
-			trailingOperands
-		}, command);
-		const commandPath = [command.name, ...getCommandPath(parsedArgs)];
-		const toShowHelp = mapError$2((error) => error._tag === "ShowHelp" ? error : new ShowHelp({
-			commandPath,
-			errors: [error]
-		}));
-		const handlerCtx = {
-			builtIns,
-			command,
-			commandPath,
-			version: config.version
+	}
+	const start = parseInteger(startPart);
+	if (start === void 0) return;
+	if (endPart === "") {
+		if (start >= fileSize) return "unsatisfiable";
+		return {
+			start,
+			end: fileSize - BigInt(1)
 		};
-		const activeFlags = getGlobalFlagsForCommandPath(command, commandPath, builtIns);
-		const outOfScopeErrors = getOutOfScopeGlobalFlagErrors(allFlags, activeFlags, flagMap, commandPath);
-		if (outOfScopeErrors.length > 0 || globalFlagErrors.length > 0) {
-			const parseErrors = parsedArgs.errors ?? [];
-			return yield* new ShowHelp({
-				commandPath,
-				errors: [
-					...globalFlagErrors,
-					...outOfScopeErrors,
-					...parseErrors
-				]
-			});
-		}
-		for (const flag of activeFlags) {
-			if (flag._tag !== "Action") continue;
-			if (!extractSingleParams(flag.flag).some((s) => {
-				const entries = flagMap[s.name];
-				return entries !== void 0 && entries.length > 0;
-			})) continue;
-			const [, value] = yield* flag.flag.parse(emptyArgs).pipe(toShowHelp);
-			if (flag === Wizard) {
-				const { colors } = yield* Theme;
-				return yield* gen(function* () {
-					yield* log(renderIntroduction(command.name, config.version, command.description, colors));
-					const prefix = [command.name, ...args.filter((arg) => arg !== "--wizard" && !arg.startsWith("--wizard="))];
-					const wizardResult = yield* run$1(command, {
-						commandPath,
-						prefix
-					});
-					yield* log(renderCompletion(wizardResult.displayArgs, colors));
-					if (yield* run$2(Toggle({
-						message: "Run this command?",
-						initial: true,
-						active: "yes",
-						inactive: "no"
-					}))) {
-						yield* log();
-						yield* runWith(command, {
-							...config,
-							renderErrors: false
-						})(wizardResult.args.slice(1));
-					}
-				}).pipe(catchTag("QuitError", () => log(renderQuit(colors))));
-			}
-			yield* flag.run(value, handlerCtx);
-			return;
-		}
-		if (parsedArgs.errors && parsedArgs.errors.length > 0) return yield* new ShowHelp({
-			commandPath,
-			errors: parsedArgs.errors
-		});
-		const input = yield* commandImpl.parse(parsedArgs).pipe(toShowHelp);
-		let program = commandImpl.handle(input, [command.name]);
-		const logLevel = activeFlags.includes(LogLevel) ? (yield* LogLevel.flag.parse(emptyArgs).pipe(toShowHelp))[1] : none();
-		program = provideService(program, LogLevel, logLevel);
-		for (const flag of activeFlags) {
-			if (flag._tag !== "Setting" || flag === LogLevel) continue;
-			const [, value] = yield* flag.flag.parse(emptyArgs).pipe(toShowHelp);
-			program = provideService(program, flag, value);
-		}
-		const services = match$8(logLevel, {
-			onNone: () => empty$14(),
-			onSome: (level) => make$81(MinimumLogLevel, level)
-		});
-		yield* provideContext$2(program, services);
-	}, catchFilter((error) => isCliError(error) && error._tag === "ShowHelp" ? succeed$10(error) : fail$12(error), (error) => andThen(showHelp(command, error, config.renderErrors !== false), fail$7(error))), catchFilter((error) => {
-		if (config.renderErrors === false || !isObjectKeyword(error)) return fail$12(error);
-		const userMessage = getUserMessage(error);
-		return userMessage === void 0 ? fail$12(error) : succeed$10({
-			error,
-			userMessage
-		});
-	}, ({ error, userMessage }) => andThen(showUserError(error, userMessage), fail$7(error))), catchFilter((e) => isQuitError(e) ? succeed$10(e) : fail$12(e), (_) => interrupt$1));
+	}
+	const end = parseInteger(endPart);
+	if (end === void 0) return;
+	if (start > end || start >= fileSize) return "unsatisfiable";
+	return {
+		start,
+		end: end < fileSize ? end : fileSize - BigInt(1)
+	};
+};
+const resolveFilePath = (path, root, url) => {
+	const urlPath = stripQueryString(url);
+	let decodedPath;
+	try {
+		decodedPath = decodeURIComponent(urlPath);
+	} catch {
+		return;
+	}
+	if (decodedPath.includes("\0")) return;
+	const relativePath = decodedPath.replace(path.sep === "\\" ? /^[/\\]+/ : /^\/+/, "");
+	return getOrUndefined$1(path.resolveWithin(root, relativePath));
+};
+const toRouteNotFoundError = (request) => new HttpServerError({ reason: new RouteNotFound({ request }) });
+const toInternalServerError = (request, cause) => new HttpServerError({ reason: new InternalError({
+	request,
+	cause
+}) });
+const handlePlatformError = (request, self) => catchIf(self, (error) => error.reason._tag === "NotFound", () => fail$7(toRouteNotFoundError(request)), (error) => fail$7(toInternalServerError(request, error)));
+const acceptsHtml = (accept) => accept !== void 0 && accept.toLowerCase().includes("text/html");
+const stripWeakEtagPrefix = (value) => {
+	const trimmed = value.trim();
+	return /^w\//i.test(trimmed) ? trimmed.slice(2) : trimmed;
+};
+const entityTagList = /^[\s,]*(?:(?:W\/)?"[^"]*"\s*(?:,[\s,]*|$))*$/;
+const entityTag = /(?:W\/)?"[^"]*"/g;
+const matchesIfMatch = (ifMatch, etag) => {
+	if (ifMatch.trim() === "*") return true;
+	if (etag === void 0 || !etag.startsWith("\"") || !entityTagList.test(ifMatch)) return false;
+	return ifMatch.match(entityTag)?.includes(etag) ?? false;
+};
+const matchesIfNoneMatch = (ifNoneMatch, etag) => {
+	const normalizedEtag = etag === void 0 ? void 0 : stripWeakEtagPrefix(etag);
+	for (const candidate of ifNoneMatch.split(",")) {
+		const value = candidate.trim();
+		if (value === "") continue;
+		if (value === "*") return true;
+		if (normalizedEtag !== void 0 && stripWeakEtagPrefix(value) === normalizedEtag) return true;
+	}
+	return false;
+};
+const isModifiedSince = (since, lastModified) => {
+	if (lastModified === void 0) return;
+	const sinceDate = parseHttpDate(since);
+	if (isFailure$1(sinceDate)) return;
+	const lastModifiedDate = parseHttpDate(lastModified);
+	return isSuccess$1(lastModifiedDate) ? toEpochMillis(lastModifiedDate.success) > toEpochMillis(sinceDate.success) : void 0;
+};
+const matchesIfRange = (ifRange, etag) => {
+	const value = ifRange.trim();
+	return value.startsWith("\"") && value === etag;
+};
+const notModifiedHeaders = [
+	"cache-control",
+	"content-location",
+	"date",
+	"etag",
+	"expires",
+	"last-modified",
+	"vary"
+];
+const notModifiedResponse = (response) => {
+	const headers = {};
+	for (const name of notModifiedHeaders) {
+		const value = response.headers[name];
+		if (value !== void 0) headers[name] = value;
+	}
+	return empty({
+		status: 304,
+		headers
+	});
+};
+const evaluateConditionalRequest = (request, response) => {
+	const etag = response.headers["etag"];
+	const lastModified = response.headers["last-modified"];
+	const ifMatch = request.headers["if-match"];
+	if (ifMatch !== void 0) {
+		if (!matchesIfMatch(ifMatch, etag)) return empty({ status: 412 });
+	} else {
+		const ifUnmodifiedSince = request.headers["if-unmodified-since"];
+		if (ifUnmodifiedSince !== void 0 && isModifiedSince(ifUnmodifiedSince, lastModified) === true) return empty({ status: 412 });
+	}
+	const ifNoneMatch = request.headers["if-none-match"];
+	if (ifNoneMatch !== void 0) return matchesIfNoneMatch(ifNoneMatch, etag) ? notModifiedResponse(response) : void 0;
+	const ifModifiedSince = request.headers["if-modified-since"];
+	if (ifModifiedSince !== void 0 && isModifiedSince(ifModifiedSince, lastModified) === false) return notModifiedResponse(response);
 };
 // ../../packages/runtime/src/auth/schema.ts
 var AuthError = class extends TaggedError()("AuthError", {
@@ -89026,7 +89000,6 @@ var AuthError = class extends TaggedError()("AuthError", {
 		"invalid_client_metadata",
 		"invalid_redirect_uri",
 		"invalid_grant",
-		"invalid_target",
 		"invalid_scope",
 		"unsupported_grant_type",
 		"unsupported_response_type",
@@ -89197,10 +89170,10 @@ const layerFlusher = /*#__PURE__*/ sync$1(Flusher, () => {
 */
 const make$3 = /*#__PURE__*/ fnUntraced(function* (options) {
 	const services = yield* context();
-	const clock = get$11(services, Clock);
-	const scope = get$11(services, Scope);
+	const clock = get$10(services, Clock);
+	const scope = get$10(services, Scope);
 	const exportInterval = max$1(fromInputUnsafe$1(options.exportInterval), zero$2);
-	const client = get$11(services, HttpClient).pipe(tap((response) => ignore$1(response.arrayBuffer)), tapError((error) => error.response ? ignore$1(error.response.arrayBuffer) : void_$1), filterStatusOk, transformResponse(provideService(TracerPropagationEnabled, false)), retryTransient({
+	const client = get$10(services, HttpClient).pipe(tap((response) => ignore$1(response.arrayBuffer)), tapError((error) => error.response ? ignore$1(error.response.arrayBuffer) : void_$1), filterStatusOk, transformResponse(provideService(TracerPropagationEnabled, false)), retryTransient({
 		schedule: policy,
 		times: 3
 	}));
@@ -89810,7 +89783,7 @@ function layerOtlp(serviceName, url, runtime, version) {
 			"code_verifier",
 			"session",
 			"token"
-		])), provide$2([layerJson, layer$16]));
+		])), provide$2([layerJson, layer$12]));
 	})), catchCause$3((cause) => {
 		if (hasInterrupts$1(cause)) return effectDiscard(interrupt$1);
 		return effectDiscard(logWarning("Telemetry is unavailable"));
@@ -89819,6 +89792,12 @@ function layerOtlp(serviceName, url, runtime, version) {
 // ../../packages/runtime/src/auth/lib/utils.ts
 const ISSUER_PATH = "/api/auth";
 const APPS_PATH = "/api/apps";
+const COOKIE = {
+	httpOnly: true,
+	path: "/",
+	sameSite: "lax",
+	secure: true
+};
 const SESSION_COOKIE = "__Host-session";
 function matchingSessions(saved, userId) {
 	return sort(filter$3(getSomes(saved), (session) => session.value.user.id === userId), mapInput(flip$2(Number$6), (session) => session.value.expiresAt));
@@ -90824,7 +90803,7 @@ var Sessions = class Sessions extends Service$2()("@deslop/runtime/auth/sessions
 			return digest.digestHex(sha256, new TextEncoder().encode(id));
 		}
 		function lockOf(key) {
-			return getOrElse(get$8(locks, key), () => {
+			return getOrElse(get$7(locks, key), () => {
 				const lock = makeUnsafe$6(1);
 				set$5(locks, key, lock);
 				return lock;
@@ -90883,7 +90862,7 @@ var Sessions = class Sessions extends Service$2()("@deslop/runtime/auth/sessions
 				if (is$2(AuthError)(renewed.failure) && renewed.failure.error === "temporarily_unavailable") return yield* renewed.failure;
 			}
 			const now = yield* currentTimeMillis;
-			const bearer = getOrUndefined$1(filter$5(get$8(bearers, userId), (access) => access.expiresAt >= now + 6e4));
+			const bearer = getOrUndefined$1(filter$5(get$7(bearers, userId), (access) => access.expiresAt >= now + 6e4));
 			if (bearer !== void 0) return bearer.token;
 			remove$5(bearers, userId);
 			return yield* AuthError.make({ message: `Open ${capitalize(split$2(new URL(app).hostname, ".")[0])} once so it can use AI for you` });
@@ -91039,13 +91018,6 @@ function layerMcpAuth(resource) {
 // ../../packages/runtime/src/server.ts
 const LOOPBACK = /^(?:localhost|\d{1,3}(?:\.\d{1,3}){3}|\[[\da-f:.]+\])$/iu;
 const OTLP = ["/v1/traces", "/v1/logs"];
-const COOKIE = {
-	httpOnly: true,
-	path: "/",
-	sameSite: "lax",
-	secure: true
-};
-const SIGN_IN_COOKIE = "__Host-sign-in";
 const packageRoot = match$1(endsWith(".ts")(import.meta.url), {
 	onFalse: () => fileURLToPath(new URL("..", import.meta.url)),
 	onTrue: cwd
@@ -91180,112 +91152,6 @@ const layerRoutes = use((router) => gen(function* () {
 		}, { headers: { "cache-control": "no-store" } });
 	}));
 }));
-const SignInState = fromJsonString(Struct({
-	next: String$6,
-	state: String$6,
-	verifier: String$6
-}));
-const CallbackParams = Struct({
-	code: optionalKey(String$6),
-	error: optionalKey(String$6),
-	iss: optionalKey(String$6),
-	state: optionalKey(String$6)
-});
-function signedOut(next, cause) {
-	return as(logWarning("The sign-in did not complete", cause), expireCookieUnsafe(redirect(next), SIGN_IN_COOKIE, COOKIE));
-}
-function layerSignIn(issuer) {
-	return use((router) => gen(function* () {
-		const sessions = yield* Sessions;
-		const random = yield* SecureRandom;
-		const digest = yield* Digest;
-		const canonical = new URL(yield* String$5("APP_URL")).origin;
-		const callback = new URL(CALLBACK_PATH, canonical).href;
-		const clientId = yield* cached(map$5(appName$1, (name) => clientIdOf({
-			name: capitalize(name),
-			redirects: [callback]
-		})));
-		function ended(headers) {
-			return match$8(sessionIdOf(headers), {
-				onNone: () => void_$1,
-				onSome: (id) => ignore$1(sessions.end(id), {
-					log: "Warn",
-					message: "The session could not be ended"
-				})
-			});
-		}
-		function toNext(handle) {
-			return flatMap$3(HttpServerRequest, (request) => match$8(filter$5(liftThrowable(() => new URL(new URL(request.url, canonical).searchParams.get("next") ?? canonical, canonical))(), (next) => next.origin === canonical), {
-				onNone: () => succeed$5(empty({ status: 400 })),
-				onSome: (next) => handle(request, next)
-			}));
-		}
-		yield* router.add("GET", "/auth/sign-in", toNext(fnUntraced(function* (_, next) {
-			const verifier = encode$1(yield* random.randomBytes(32));
-			const state = encode$1(yield* random.randomBytes(16));
-			const authorize = new URL(AUTHORIZE_PATH, issuer);
-			authorize.search = `${new URLSearchParams({
-				client_id: yield* clientId,
-				code_challenge: encode$1(yield* digest.digest(sha256, new TextEncoder().encode(verifier))),
-				code_challenge_method: "S256",
-				redirect_uri: callback,
-				response_type: "code",
-				scope: "deslop offline_access",
-				state
-			})}`;
-			return setCookieUnsafe(redirect(authorize.href), SIGN_IN_COOKIE, yield* encodeEffect(SignInState)({
-				next: next.href,
-				state,
-				verifier
-			}), {
-				...COOKIE,
-				maxAge: "10 minutes"
-			});
-		})));
-		yield* router.add("GET", CALLBACK_PATH, gen(function* () {
-			const request = yield* HttpServerRequest;
-			return yield* match$8(yield* option$1(decodeUnknownEffect(SignInState)(request.cookies[SIGN_IN_COOKIE])), {
-				onNone: () => signedOut(canonical, "The sign-in expired or began in another browser"),
-				onSome: fnUntraced(function* (saved) {
-					const started = yield* result$1(gen(function* () {
-						const params = yield* schemaSearchParams(CallbackParams);
-						if (params.state !== saved.state) return yield* AuthError.make({ message: "The sign-in began in another browser" });
-						if (params.error !== void 0 || params.code === void 0) return yield* AuthError.make({ message: `Auth answered ${params.error ?? "without a code"}` });
-						if (params.iss !== new URL("/api/auth", issuer).href) return yield* AuthError.make({ message: "The answer came from another issuer" });
-						return yield* sessions.start({
-							client_id: yield* clientId,
-							code: params.code,
-							code_verifier: saved.verifier,
-							redirect_uri: callback
-						});
-					}));
-					if (isFailure$1(started)) return yield* signedOut(saved.next, started.failure);
-					return pipe(redirect(saved.next), expireCookieUnsafe(SIGN_IN_COOKIE, COOKIE), setCookieUnsafe(SESSION_COOKIE, started.success, {
-						...COOKIE,
-						maxAge: "365 days"
-					}));
-				})
-			});
-		}));
-		yield* router.add("POST", "/auth/session", gen(function* () {
-			const started = yield* result$1(pipe(schemaBodyJson(CodeGrant), rejected("The sign-in request is invalid"), flatMap$3(sessions.start)));
-			if (isFailure$1(started)) return text$1(started.failure.message, failureOptions(started.failure, 400));
-			return yield* schemaJson(SessionHandle)({ session: started.success }, { headers: { "cache-control": "no-store" } });
-		}));
-		yield* router.add("GET", "/auth/sign-out", toNext((request, next) => as(ended(request.headers), expireCookieUnsafe(redirect(`${new URL("/", issuer).href}?${new URLSearchParams({
-			next: next.href,
-			"sign-out": ""
-		})}`), SESSION_COOKIE, COOKIE))));
-		yield* router.add("POST", "/auth/sign-out", as(flatMap$3(HttpServerRequest, (request) => ended(request.headers)), empty({ status: 204 })));
-	}));
-}
-const notConfigured = text$1("Sign-in is not configured for this app", { status: 503 });
-const layerSessionRoutes = unwrap$7(gen(function* () {
-	return match$8(yield* option(String$5("AUTH_URL")), {
-		onNone: () => mergeAll$1(add("GET", "/auth/sign-in", notConfigured), add("GET", "/auth/sign-out", notConfigured)),
-		onSome: layerSignIn
-	});
-}));
 const layerAnnounce = effectDiscard(gen(function* () {
 	const origin = new URL(yield* String$5("APP_URL")).origin;
 	const client = pipe(yield* HttpClient, filterStatusOk, timeout("10 seconds"), retryTransient({
@@ -91330,11 +91196,11 @@ const layerWeb = unwrap$7(gen(function* () {
 	}, {
 		contentType: "application/manifest+json",
 		headers: { "cache-control": "no-cache" }
-	}))), layer$15({
+	}))), layer$2({
 		cacheControl: "public, max-age=31536000, immutable",
 		prefix: "/assets",
 		root: `${client}/assets`
-	}), layer$15({
+	}), layer$2({
 		cacheControl: "no-cache",
 		index: "index.html",
 		root: client,
@@ -91415,6 +91281,113 @@ var AiGateway = class AiGateway extends Service$2()("@deslop/runtime/ai/service/
 		});
 	}));
 };
+// ../../packages/runtime/src/auth/routes.ts
+const SIGN_IN_COOKIE = "__Host-sign-in";
+const SignInState = fromJsonString(Struct({
+	next: String$6,
+	state: String$6,
+	verifier: String$6
+}));
+const CallbackParams = Struct({
+	code: optionalKey(String$6),
+	error: optionalKey(String$6),
+	iss: optionalKey(String$6),
+	state: optionalKey(String$6)
+});
+function signedOut(next, cause) {
+	return as(logWarning("The sign-in did not complete", cause), expireCookieUnsafe(redirect(next), SIGN_IN_COOKIE, COOKIE));
+}
+function layerSignIn(issuer) {
+	return use((router) => gen(function* () {
+		const sessions = yield* Sessions;
+		const random = yield* SecureRandom;
+		const digest = yield* Digest;
+		const canonical = new URL(yield* String$5("APP_URL")).origin;
+		const callback = new URL(CALLBACK_PATH, canonical).href;
+		const clientId = yield* cached(map$5(appName$1, (name) => clientIdOf({
+			name: capitalize(name),
+			redirects: [callback]
+		})));
+		function ended(headers) {
+			return match$8(sessionIdOf(headers), {
+				onNone: () => void_$1,
+				onSome: (id) => ignore$1(sessions.end(id), {
+					log: "Warn",
+					message: "The session could not be ended"
+				})
+			});
+		}
+		function toNext(handle) {
+			return flatMap$3(HttpServerRequest, (request) => match$8(filter$5(liftThrowable(() => new URL(new URL(request.url, canonical).searchParams.get("next") ?? canonical, canonical))(), (next) => next.origin === canonical), {
+				onNone: () => succeed$5(empty({ status: 400 })),
+				onSome: (next) => handle(request, next)
+			}));
+		}
+		yield* router.add("GET", "/auth/sign-in", toNext(fnUntraced(function* (_, next) {
+			const verifier = encode$1(yield* random.randomBytes(32));
+			const state = encode$1(yield* random.randomBytes(16));
+			const authorize = new URL(AUTHORIZE_PATH, issuer);
+			authorize.search = `${new URLSearchParams({
+				client_id: yield* clientId,
+				code_challenge: encode$1(yield* digest.digest(sha256, new TextEncoder().encode(verifier))),
+				code_challenge_method: "S256",
+				redirect_uri: callback,
+				response_type: "code",
+				scope: "deslop offline_access",
+				state
+			})}`;
+			return setCookieUnsafe(redirect(authorize.href), SIGN_IN_COOKIE, yield* encodeEffect(SignInState)({
+				next: next.href,
+				state,
+				verifier
+			}), {
+				...COOKIE,
+				maxAge: "10 minutes"
+			});
+		})));
+		yield* router.add("GET", CALLBACK_PATH, gen(function* () {
+			const request = yield* HttpServerRequest;
+			return yield* match$8(yield* option$1(decodeUnknownEffect(SignInState)(request.cookies[SIGN_IN_COOKIE])), {
+				onNone: () => signedOut(canonical, "The sign-in expired or began in another browser"),
+				onSome: fnUntraced(function* (saved) {
+					const started = yield* result$1(gen(function* () {
+						const params = yield* schemaSearchParams(CallbackParams);
+						if (params.state !== saved.state) return yield* AuthError.make({ message: "The sign-in began in another browser" });
+						if (params.error !== void 0 || params.code === void 0) return yield* AuthError.make({ message: `Auth answered ${params.error ?? "without a code"}` });
+						if (params.iss !== new URL("/api/auth", issuer).href) return yield* AuthError.make({ message: "The answer came from another issuer" });
+						return yield* sessions.start({
+							client_id: yield* clientId,
+							code: params.code,
+							code_verifier: saved.verifier,
+							redirect_uri: callback
+						});
+					}));
+					if (isFailure$1(started)) return yield* signedOut(saved.next, started.failure);
+					return pipe(redirect(saved.next), expireCookieUnsafe(SIGN_IN_COOKIE, COOKIE), setCookieUnsafe(SESSION_COOKIE, started.success, {
+						...COOKIE,
+						maxAge: "365 days"
+					}));
+				})
+			});
+		}));
+		yield* router.add("POST", "/auth/session", gen(function* () {
+			const started = yield* result$1(pipe(schemaBodyJson(CodeGrant), rejected("The sign-in request is invalid"), flatMap$3(sessions.start)));
+			if (isFailure$1(started)) return text$1(started.failure.message, failureOptions(started.failure, 400));
+			return yield* schemaJson(SessionHandle)({ session: started.success }, { headers: { "cache-control": "no-store" } });
+		}));
+		yield* router.add("GET", "/auth/sign-out", toNext((request, next) => as(ended(request.headers), expireCookieUnsafe(redirect(`${new URL("/", issuer).href}?${new URLSearchParams({
+			next: next.href,
+			"sign-out": ""
+		})}`), SESSION_COOKIE, COOKIE))));
+		yield* router.add("POST", "/auth/sign-out", as(flatMap$3(HttpServerRequest, (request) => ended(request.headers)), empty({ status: 204 })));
+	}));
+}
+const layerSessionRoutes = unwrap$7(gen(function* () {
+	return match$8(yield* option(String$5("AUTH_URL")), {
+		onNone: () => empty$10,
+		onSome: layerSignIn
+	});
+}));
 // ../../packages/runtime/src/cli/schema.ts
 var AppError = class extends TaggedError()("AppError", {
 	cause: optional$8(Defect()),
@@ -91425,7 +91398,7 @@ function systemdArgument(value) {
 	return `"${pipe(value, replaceAll("\\", "\\\\"), replaceAll("\"", "\\\""), replaceAll("%", "%%"), replaceAll("$", "$$$$"), replaceAll("\n", "\\n"), replaceAll("\r", "\\r"))}"`;
 }
 const execute = fnUntraced(function* (command, args) {
-	const process = yield* make$11(command, args, {
+	const process = yield* make$12(command, args, {
 		stderr: "pipe",
 		stdout: "pipe"
 	});
@@ -91579,7 +91552,7 @@ const configProvider = fnUntraced(function* (given, defaultPort) {
 		PORT: port
 	}), fromEnv());
 });
-const layerPlatform = mergeAll$1(layer$3, layer$16, layer$13);
+const layerPlatform = mergeAll$1(layer$4, layer$12, layer$15);
 function server(app) {
 	const routes = pipe(mergeAll$1(app.routes, layerRoutes, layerIcon(app.icon), layerWeb, layerAnnounce), provide$2(match$8(fromUndefinedOr(app.middleware), {
 		onNone: () => empty$10,
@@ -91612,10 +91585,10 @@ function runApp(app) {
 			},
 			...app.settings
 		};
-		const root = pipe(make$4(name), withSharedFlags(flagsOf(settings)));
+		const root = pipe(make$5(name), withSharedFlags(flagsOf(settings)));
 		const given = map$5(root, (input) => getSomes$1(input));
-		return yield* pipe(root, withHandler((input) => flatMap$3(configProvider(getSomes$1(input), metadata.config.port), (values) => provideService(server(app), ConfigProvider, values))), withSubcommands([pipe(make$4("service"), withSubcommands([
-			make$4("install", {}, fnUntraced(function* () {
+		return yield* pipe(root, withHandler((input) => flatMap$3(configProvider(getSomes$1(input), metadata.config.port), (values) => provideService(server(app), ConfigProvider, values))), withSubcommands([pipe(make$5("service"), withSubcommands([
+			make$5("install", {}, fnUntraced(function* () {
 				const fs = yield* FileSystem;
 				const path = yield* Path$1;
 				const flags = yield* given;
@@ -91634,15 +91607,13 @@ function runApp(app) {
 					"update"
 				]);
 			})),
-			make$4("status", {}, () => flatMap$3(status(name), output)),
-			make$4("uninstall", {}, () => flatMap$3(uninstall(name), output)),
-			make$4("update", {}, () => flatMap$3(update(name), output))
+			make$5("status", {}, () => flatMap$3(status(name), output)),
+			make$5("uninstall", {}, () => flatMap$3(uninstall(name), output)),
+			make$5("update", {}, () => flatMap$3(update(name), output))
 		]))]), run({ version: metadata.version }));
 	});
 	runMain(pipe(program, scoped, provide(layerPlatform), provideService(LogToStderr, true)));
 }
-// src/routes/icon.svg
-var icon_default = "<svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 64 64\" shape-rendering=\"crispEdges\"><path fill=\"#000\" fill-opacity=\".18\" d=\"M17 45h1v1h-1zM15 46h3v1h-3zM13 47h4v1h-4zM15 48h4v1h-4zM46 48h1v1h-1zM17 49h4v1h-4zM46 49h3v1h-3zM19 50h4v1h-4zM47 50h4v1h-4zM21 51h4v1h-4zM45 51h4v1h-4zM23 52h4v1h-4zM43 52h4v1h-4zM25 53h4v1h-4zM41 53h4v1h-4zM27 54h4v1h-4zM39 54h4v1h-4zM29 55h4v1h-4zM37 55h4v1h-4zM31 56h8v1h-8zM33 57h4v1h-4z\"/><path fill=\"#000\" fill-opacity=\".38\" d=\"M17 47h2v1h-2zM19 48h1v1h-1zM21 49h1v1h-1zM23 50h1v1h-1zM45 50h2v1h-2zM25 51h1v1h-1zM44 51h1v1h-1zM27 52h1v1h-1zM42 52h1v1h-1zM29 53h1v1h-1zM40 53h1v1h-1zM31 54h1v1h-1zM38 54h1v1h-1zM33 55h1v1h-1zM36 55h1v1h-1z\"/><path fill=\"#4e6f72\" d=\"M18 8h4v1h-4zM16 9h2v1h-2zM22 9h2v1h-2zM15 10h1v1h-1zM24 10h2v1h-2zM15 11h1v1h-1zM26 11h2v1h-2zM15 12h1v1h-1zM28 12h2v1h-2zM15 13h1v1h-1zM30 13h2v1h-2zM15 14h1v1h-1zM32 14h2v1h-2zM15 15h1v1h-1zM34 15h2v1h-2zM15 16h1v1h-1zM36 16h2v1h-2zM15 17h1v1h-1zM38 17h2v1h-2zM15 18h1v1h-1zM40 18h2v1h-2zM15 19h1v1h-1zM42 19h2v1h-2zM15 20h1v1h-1zM44 20h2v1h-2zM15 21h1v1h-1zM46 21h2v1h-2zM15 22h1v1h-1zM48 22h1v1h-1zM15 23h1v1h-1zM48 23h1v1h-1zM15 24h1v1h-1zM48 24h1v1h-1zM15 25h1v1h-1zM48 25h1v1h-1zM15 26h1v1h-1zM48 26h1v1h-1zM15 27h1v1h-1zM48 27h1v1h-1zM15 28h1v1h-1zM48 28h1v1h-1zM15 29h1v1h-1zM48 29h1v1h-1zM15 30h1v1h-1zM48 30h1v1h-1zM15 31h1v1h-1zM48 31h1v1h-1zM15 32h1v1h-1zM48 32h1v1h-1zM16 33h2v1h-2zM48 33h1v1h-1zM18 34h2v1h-2zM48 34h1v1h-1zM20 35h2v1h-2zM48 35h1v1h-1zM22 36h2v1h-2zM48 36h1v1h-1zM24 37h2v1h-2zM48 37h1v1h-1zM26 38h2v1h-2zM48 38h1v1h-1zM48 39h1v1h-1zM48 40h1v1h-1zM48 41h1v1h-1zM48 42h1v1h-1zM48 43h1v1h-1zM48 44h1v1h-1zM46 45h2v1h-2zM44 46h2v1h-2z\"/><path fill=\"#bce6e6\" d=\"M18 9h4v1h-4zM18 10h6v1h-6zM20 11h6v1h-6zM22 12h6v1h-6zM24 13h6v1h-6zM26 14h6v1h-6zM28 15h6v1h-6zM20 16h2v1h-2zM30 16h6v1h-6zM20 17h4v1h-4zM32 17h6v1h-6zM22 18h4v1h-4zM34 18h6v1h-6zM24 19h4v1h-4zM36 19h6v1h-6zM26 20h4v1h-4zM38 20h6v1h-6zM28 21h4v1h-4zM40 21h6v1h-6zM30 22h4v1h-4zM42 22h4v1h-4zM26 23h2v1h-2zM32 23h4v1h-4zM26 24h4v1h-4zM34 24h2v1h-2zM43 24h1v1h-1zM28 25h4v1h-4zM43 25h1v1h-1zM30 26h4v1h-4zM43 26h1v1h-1zM32 27h4v1h-4zM43 27h1v1h-1zM34 28h2v1h-2zM43 28h1v1h-1zM30 29h2v1h-2zM43 29h1v1h-1zM30 30h4v1h-4zM43 30h1v1h-1zM32 31h2v1h-2zM43 31h1v1h-1zM43 32h1v1h-1zM43 33h1v1h-1zM43 34h1v1h-1zM43 35h1v1h-1zM43 36h1v1h-1zM43 37h1v1h-1zM43 38h1v1h-1zM43 39h1v1h-1zM43 40h1v1h-1zM43 41h1v1h-1zM43 42h1v1h-1zM43 43h1v1h-1zM43 44h1v1h-1zM43 45h1v1h-1z\"/><path fill=\"#daf7f7\" d=\"M16 10h2v1h-2zM18 11h2v1h-2zM20 12h2v1h-2zM22 13h2v1h-2zM24 14h2v1h-2zM26 15h2v1h-2zM28 16h2v1h-2zM30 17h2v1h-2zM32 18h2v1h-2zM34 19h2v1h-2zM36 20h2v1h-2zM38 21h2v1h-2zM40 22h2v1h-2zM46 22h2v1h-2zM42 23h4v1h-4z\"/><path fill=\"#A3D4D5\" d=\"M16 11h2v1h-2zM16 12h4v1h-4zM16 13h6v1h-6zM16 14h2v1h-2zM20 14h4v1h-4zM16 15h2v1h-2zM22 15h4v1h-4zM16 16h2v1h-2zM24 16h4v1h-4zM16 17h2v1h-2zM26 17h4v1h-4zM16 18h2v1h-2zM28 18h4v1h-4zM16 19h2v1h-2zM30 19h4v1h-4zM16 20h2v1h-2zM32 20h4v1h-4zM16 21h2v1h-2zM34 21h4v1h-4zM16 22h2v1h-2zM36 22h4v1h-4zM16 23h2v1h-2zM38 23h4v1h-4zM16 24h2v1h-2zM40 24h3v1h-3zM16 25h2v1h-2zM42 25h1v1h-1zM16 26h2v1h-2zM42 26h1v1h-1zM16 27h2v1h-2zM42 27h1v1h-1zM16 28h2v1h-2zM42 28h1v1h-1zM16 29h2v1h-2zM42 29h1v1h-1zM16 30h4v1h-4zM42 30h1v1h-1zM16 31h6v1h-6zM42 31h1v1h-1zM16 32h8v1h-8zM42 32h1v1h-1zM18 33h8v1h-8zM42 33h1v1h-1zM20 34h8v1h-8zM42 34h1v1h-1zM22 35h8v1h-8zM42 35h1v1h-1zM24 36h8v1h-8zM42 36h1v1h-1zM26 37h8v1h-8zM42 37h1v1h-1zM28 38h8v1h-8zM42 38h1v1h-1zM30 39h8v1h-8zM42 39h1v1h-1zM32 40h8v1h-8zM42 40h1v1h-1zM34 41h9v1h-9zM36 42h7v1h-7zM38 43h5v1h-5zM40 44h3v1h-3zM42 45h1v1h-1z\"/><path fill=\"#16161D\" d=\"M18 14h2v1h-2zM18 15h4v1h-4zM18 16h2v1h-2zM22 16h2v1h-2zM18 17h2v1h-2zM24 17h2v1h-2zM18 18h4v1h-4zM26 18h2v1h-2zM18 19h6v1h-6zM28 19h2v1h-2zM18 20h8v1h-8zM30 20h2v1h-2zM18 21h10v1h-10zM32 21h2v1h-2zM18 22h12v1h-12zM34 22h2v1h-2zM18 23h8v1h-8zM28 23h4v1h-4zM36 23h2v1h-2zM18 24h8v1h-8zM30 24h4v1h-4zM36 24h4v1h-4zM18 25h10v1h-10zM32 25h10v1h-10zM18 26h12v1h-12zM34 26h8v1h-8zM18 27h14v1h-14zM36 27h6v1h-6zM18 28h16v1h-16zM36 28h6v1h-6zM18 29h12v1h-12zM32 29h10v1h-10zM20 30h10v1h-10zM34 30h8v1h-8zM22 31h10v1h-10zM34 31h8v1h-8zM24 32h18v1h-18zM26 33h16v1h-16zM28 34h14v1h-14zM30 35h12v1h-12zM32 36h10v1h-10zM34 37h8v1h-8zM36 38h2v1h-2zM40 38h2v1h-2zM38 39h4v1h-4zM40 40h2v1h-2z\"/><path fill=\"#77a4a7\" d=\"M46 23h2v1h-2zM44 24h4v1h-4zM44 25h4v1h-4zM44 26h4v1h-4zM44 27h4v1h-4zM44 28h4v1h-4zM44 29h4v1h-4zM44 30h4v1h-4zM44 31h4v1h-4zM44 32h4v1h-4zM44 33h4v1h-4zM44 34h4v1h-4zM44 35h4v1h-4zM44 36h4v1h-4zM44 37h4v1h-4zM44 38h4v1h-4zM44 39h4v1h-4zM44 40h4v1h-4zM44 41h4v1h-4zM44 42h4v1h-4zM44 43h4v1h-4zM44 44h4v1h-4zM44 45h2v1h-2z\"/><path fill=\"#F2D98C\" d=\"M38 38h2v1h-2z\"/><path fill=\"#565961\" d=\"M27 39h1v1h-1zM26 40h2v1h-2zM24 41h2v1h-2zM22 42h2v1h-2zM20 43h2v1h-2zM36 43h2v1h-2zM19 44h1v1h-1zM38 44h2v1h-2zM18 45h1v1h-1zM40 45h2v1h-2zM18 46h1v1h-1zM42 46h2v1h-2zM19 47h1v1h-1zM44 47h1v1h-1zM20 48h2v1h-2zM45 48h1v1h-1zM22 49h2v1h-2zM44 49h2v1h-2zM24 50h2v1h-2zM42 50h3v1h-3zM26 51h2v1h-2zM40 51h4v1h-4zM28 52h2v1h-2zM38 52h4v1h-4zM30 53h2v1h-2zM36 53h4v1h-4zM32 54h2v1h-2zM35 54h3v1h-3zM34 55h2v1h-2z\"/><path fill=\"#B4B8C4\" d=\"M28 39h2v1h-2zM28 40h4v1h-4zM28 41h4v1h-4zM28 42h4v1h-4zM28 43h4v1h-4zM28 44h4v1h-4zM19 45h1v1h-1zM28 45h4v1h-4zM20 46h2v1h-2zM28 46h4v1h-4zM22 47h2v1h-2zM30 47h2v1h-2zM24 48h2v1h-2zM26 49h2v1h-2zM28 50h2v1h-2zM30 51h2v1h-2zM32 52h2v1h-2zM34 53h1v1h-1z\"/><path fill=\"#c8cbd6\" d=\"M26 41h2v1h-2zM24 42h4v1h-4zM22 43h6v1h-6zM20 44h8v1h-8zM36 44h2v1h-2zM20 45h8v1h-8zM36 45h4v1h-4zM22 46h6v1h-6zM36 46h6v1h-6zM24 47h6v1h-6zM34 47h10v1h-10zM26 48h18v1h-18zM28 49h14v1h-14zM30 50h10v1h-10zM32 51h6v1h-6zM34 52h2v1h-2z\"/><path fill=\"#868a95\" d=\"M32 41h2v1h-2zM32 42h4v1h-4zM32 43h4v1h-4zM32 44h4v1h-4zM32 45h4v1h-4zM32 46h4v1h-4zM32 47h2v1h-2zM44 48h1v1h-1zM42 49h2v1h-2zM40 50h2v1h-2zM38 51h2v1h-2zM36 52h2v1h-2zM35 53h1v1h-1z\"/><path fill=\"#9ea2ad\" d=\"M19 46h1v1h-1zM20 47h2v1h-2zM22 48h2v1h-2zM24 49h2v1h-2zM26 50h2v1h-2zM28 51h2v1h-2zM30 52h2v1h-2zM32 53h2v1h-2zM34 54h1v1h-1z\"/></svg>";
 // src/services/telemetry/schema.ts
 var TelemetryError = class extends TaggedError()("TelemetryError", {
 	cause: optional$8(Defect()),
@@ -91685,7 +91656,7 @@ const Log = StructWithRest(Struct({
 	severityNumber: optionalKey(Int$1),
 	severityText: optionalKey(String$6),
 	spanId: optionalKey(Union([SpanId, Literal("")])),
-	timeUnixNano: optionalKey(Nano),
+	timeUnixNano: Nano,
 	traceId: optionalKey(Union([TraceId, Literal("")]))
 }), [JsonObject]);
 const TracesRequest = Struct({ resourceSpans: optionalKey(ArraySchema(StructWithRest(Struct({
@@ -91713,9 +91684,6 @@ const Entry = Struct({
 	payload: JsonObject,
 	receivedAt: optionalKey(Natural),
 	resource: Resource,
-	resourceSchemaUrl: String$6,
-	scope: Resource,
-	scopeSchemaUrl: String$6,
 	service: String$6,
 	signal: Literals(["trace", "log"]),
 	spanId: String$6,
@@ -91723,12 +91691,7 @@ const Entry = Struct({
 	time: Nano,
 	traceId: String$6
 });
-const EntryItem = Entry.mapFields(omit([
-	"resource",
-	"resourceSchemaUrl",
-	"scope",
-	"scopeSchemaUrl"
-]));
+const EntryItem = Entry.mapFields(omit(["resource"]));
 const Query = Struct({
 	errors: Boolean$5,
 	from: Finite,
@@ -91809,10 +91772,7 @@ const Overview = Struct({ apps: ArraySchema(Struct({
 		runtime: Runtime,
 		traces: ArraySchema(Struct({
 			durationMs: Finite,
-			failure: optionalKey(Struct({
-				message: String$6,
-				span: String$6
-			})),
+			failure: optionalKey(Struct({ span: String$6 })),
 			id: TraceId,
 			time: Nano
 		}))
@@ -91837,6 +91797,7 @@ const TraceSpan = Struct({
 });
 const Trace = Struct({
 	durationMs: Finite,
+	failureSpanId: optionalKey(String$6),
 	id: TraceId,
 	logs: ArraySchema(EntryItem),
 	services: ArraySchema(Service),
@@ -91852,24 +91813,174 @@ const Filters = Struct({
 	traceId: pipe(Query.fields.traceId, withDecodingDefaultTypeKey(succeed$5("")), annotateEncoded({ description: "Only entries of this trace." }))
 });
 const SortFilters = Struct({
-	...Struct({
-		...Filters.fields,
-		limit: pipe(Query.fields.limit, withDecodingDefaultTypeKey(succeed$5(20)), annotateEncoded({ description: "Page size, 1 to 1000." })),
-		offset: pipe(Query.fields.offset, withDecodingDefaultTypeKey(succeed$5(0)), annotateEncoded({ description: "Entries to skip, for the next page." }))
-	}).fields,
+	...Filters.fields,
+	limit: pipe(Query.fields.limit, withDecodingDefaultTypeKey(succeed$5(20)), annotateEncoded({ description: "Page size, 1 to 1000." })),
+	offset: pipe(Query.fields.offset, withDecodingDefaultTypeKey(succeed$5(0)), annotateEncoded({ description: "Entries to skip, for the next page." })),
 	sort: pipe(Query.fields.sort, withDecodingDefaultTypeKey(succeed$5("recent")), annotateEncoded({ description: "\"recent\" puts the newest first, \"slowest\" the longest first." }))
 });
-// src/rpcs/contracts.ts
-var RpcContracts = class extends make$29(make$31("scope.overview", {
-	error: Union([AuthError, TelemetryError]),
-	stream: true,
-	success: Overview
-}), make$31("scope.trace", {
-	error: Union([AuthError, TelemetryError]),
-	payload: Struct({ id: TraceId }),
-	success: Trace
-})).middleware(RpcAuth) {};
+// src/services/github/lib/utils.ts
+function nanos(time) {
+	return `${BigInt(toEpochMillis(makeUnsafe$5(time))) * 1000000n}`;
+}
+function hex(value, width) {
+	return padStart(width, "0")(value.toString(16));
+}
+function traceIdOf(run, attempt) {
+	return `${hex(run, 24)}${hex(attempt, 8)}`;
+}
+function runSpanId(run) {
+	return `1${hex(run, 15)}`;
+}
+function jobSpanId(job) {
+	return `2${hex(job, 15)}`;
+}
+function statusOf(conclusion, message) {
+	if (conclusion === "failure" || conclusion === "timed_out" || conclusion === "startup_failure") return {
+		code: 2,
+		message
+	};
+	if (conclusion === "success") return {
+		code: 1,
+		message: ""
+	};
+	return {
+		code: 0,
+		message: ""
+	};
+}
+function text(key, value) {
+	return {
+		key,
+		value: { stringValue: value }
+	};
+}
+function repositoryTraces(repository, spans) {
+	return TracesRequest.make({ resourceSpans: [{
+		resource: { attributes: [text("service.name", repository), text("scope.runtime", "ci")] },
+		scopeSpans: [{
+			scope: { name: "github-actions" },
+			spans
+		}]
+	}] });
+}
+function runIds(event) {
+	return {
+		spanId: runSpanId(event.workflow_run.id),
+		traceId: traceIdOf(event.workflow_run.id, event.workflow_run.run_attempt)
+	};
+}
+function runTrace(event) {
+	const run = event.workflow_run;
+	return repositoryTraces(event.repository.full_name, [{
+		attributes: [
+			text("github.title", run.display_title),
+			text("github.event", run.event),
+			text("git.branch", run.head_branch ?? ""),
+			text("git.commit", run.head_sha),
+			text("github.conclusion", run.conclusion ?? ""),
+			text("url.full", run.html_url)
+		],
+		kind: 1,
+		name: run.name ?? run.display_title,
+		parentSpanId: "",
+		startTimeUnixNano: nanos(run.run_started_at),
+		status: statusOf(run.conclusion, `${run.display_title} failed`),
+		...runIds(event),
+		...match$8(liftPredicate(event.action, (action) => action === "completed"), {
+			onNone: () => ({}),
+			onSome: () => ({ endTimeUnixNano: nanos(run.updated_at) })
+		})
+	}]);
+}
+function jobTrace(event) {
+	const job = event.workflow_job;
+	const traceId = traceIdOf(job.run_id, job.run_attempt);
+	const steps = getSomes(map$8(job.steps, (step) => pipe(all$4({
+		completed: fromNullishOr(step.completed_at),
+		started: fromNullishOr(step.started_at)
+	}), map$11((times) => ({
+		...step,
+		...times
+	})))));
+	const failed = findFirst(steps, (step) => statusOf(step.conclusion, "").code === 2);
+	return repositoryTraces(event.repository.full_name, [{
+		attributes: [
+			text("github.runner", job.runner_name ?? ""),
+			text("github.conclusion", job.conclusion ?? ""),
+			{
+				key: "github.queued_ms",
+				value: { intValue: `${toEpochMillis(makeUnsafe$5(job.started_at)) - toEpochMillis(makeUnsafe$5(job.created_at))}` }
+			},
+			text("url.full", job.html_url)
+		],
+		endTimeUnixNano: nanos(job.completed_at ?? job.started_at),
+		kind: 1,
+		name: job.name,
+		parentSpanId: runSpanId(job.run_id),
+		spanId: jobSpanId(job.id),
+		startTimeUnixNano: nanos(job.started_at),
+		status: statusOf(job.conclusion, match$8(failed, {
+			onNone: () => `${job.name} failed`,
+			onSome: (step) => `${step.name} failed`
+		})),
+		traceId
+	}, ...map$8(steps, (step) => ({
+		attributes: [text("github.conclusion", step.conclusion ?? ""), text("url.full", `${job.html_url}#step:${step.number}:1`)],
+		endTimeUnixNano: nanos(step.completed),
+		kind: 1,
+		name: step.name,
+		parentSpanId: jobSpanId(job.id),
+		spanId: `3${hex(job.id, 12)}${hex(step.number, 3)}`,
+		startTimeUnixNano: nanos(step.started),
+		status: statusOf(step.conclusion, `${step.name} failed`),
+		traceId
+	}))]);
+}
+// src/services/github/schema.ts
+const Repository = Struct({ full_name: String$6 });
+const Step = Struct({
+	completed_at: NullOr(String$6),
+	conclusion: NullOr(String$6),
+	name: String$6,
+	number: Int$1,
+	started_at: NullOr(String$6)
+});
+const WorkflowJob = Struct({
+	action: String$6,
+	repository: Repository,
+	workflow_job: Struct({
+		completed_at: NullOr(String$6),
+		conclusion: NullOr(String$6),
+		created_at: String$6,
+		html_url: String$6,
+		id: Int$1,
+		name: String$6,
+		run_attempt: Int$1,
+		run_id: Int$1,
+		runner_name: NullOr(String$6),
+		started_at: String$6,
+		steps: ArraySchema(Step)
+	})
+});
+const WorkflowRun = Struct({
+	action: String$6,
+	repository: Repository,
+	workflow_run: Struct({
+		conclusion: NullOr(String$6),
+		display_title: String$6,
+		event: String$6,
+		head_branch: NullOr(String$6),
+		head_sha: String$6,
+		html_url: String$6,
+		id: Int$1,
+		name: NullOr(String$6),
+		run_attempt: Int$1,
+		run_started_at: String$6,
+		updated_at: String$6
+	})
+});
 // src/services/telemetry/lib/utils.ts
+const KEEP = 20;
 const byRelease = mapInput(Array_(Number$6), (version) => map$8(split$2(version, "."), (part) => getOrElse(parse$3(part), () => 0)));
 function queryOf(filters, now) {
 	return {
@@ -91881,9 +91992,6 @@ function queryOf(filters, now) {
 		to: now
 	};
 }
-function logTime(log, now) {
-	return pipe(findFirst([log.timeUnixNano, log.observedTimeUnixNano], (time) => time !== void 0 && time !== "0"), flatMap$8(fromUndefinedOr), getOrElse(() => now));
-}
 function resourceString(resource, key) {
 	return pipe(resource.attributes ?? [], findFirst((attribute) => attribute.key === key), flatMap$8((attribute) => liftPredicate(attribute.value["stringValue"], isString$1)), getOrElse(() => ""));
 }
@@ -91914,7 +92022,7 @@ function newestVersions(entries, known) {
 }
 function isSuperseded(entry, newest) {
 	const version = releaseOf(entry);
-	return version !== "" && exists(get$10(newest, entry.service), (latest) => isLessThan$1(byRelease)(version, latest));
+	return version !== "" && exists(get$9(newest, entry.service), (latest) => isLessThan$1(byRelease)(version, latest));
 }
 function retentionOf(current, newest, receivedAt, retentionMs) {
 	const now = BigInt(receivedAt) * 1000000n;
@@ -91956,9 +92064,6 @@ function appName(service) {
 function runtime(resource) {
 	const value = resourceString(resource, "scope.runtime");
 	if (is$2(Runtime)(value)) return value;
-	const language = resourceString(resource, "telemetry.sdk.language");
-	if (language === "webjs") return "web";
-	if (language === "nodejs") return "server";
 	return "unknown";
 }
 function started(resource) {
@@ -91997,18 +92102,18 @@ function durationMs(start, end) {
 	if (BigInt(end) < BigInt(start)) return 0;
 	return pipe(parse$3(`${BigInt(end) - BigInt(start)}`), getOrThrow$1) / 1e6;
 }
+function percentile(times, ratio) {
+	return getOrElse(get$8(times, max(0, Math.ceil(times.length * ratio) - 1)), () => 0);
+}
 function summary(entries, query) {
 	const times = sort(map$8(entries, (entry) => entry.durationMs), Number$6);
-	function percentile(ratio) {
-		return pipe(get$9(times, max(0, Math.ceil(times.length * ratio) - 1)), getOrElse(() => 0));
-	}
 	return {
 		count: entries.length,
 		errors: countBy(entries, (entry) => entry.status === 2),
 		from: query.from,
-		maxMs: percentile(1),
-		p50Ms: percentile(.5),
-		p95Ms: percentile(.95),
+		maxMs: percentile(times, 1),
+		p50Ms: percentile(times, .5),
+		p95Ms: percentile(times, .95),
 		to: query.to
 	};
 }
@@ -92067,6 +92172,14 @@ function parentId(entry) {
 	if (isString$1(entry.payload["parentSpanId"])) return toLowerCase(entry.payload["parentSpanId"]);
 	return "";
 }
+function brokeAt(spans) {
+	const failed = filter$3(spans, (span) => span.status === 2);
+	const parents = fromIterable$2(map$8(failed, parentId));
+	return match$6(filter$3(failed, (span) => !has(parents, span.spanId)), {
+		onEmpty: () => none(),
+		onNonEmpty: (candidates) => some$1(min(candidates, byStart))
+	});
+}
 function traceView(entries, id) {
 	const ordered = reverse(orderEntries(entries, "recent"));
 	const spans = map$8(filter$3(ordered, (entry) => entry.signal === "trace"), (entry, index) => ({
@@ -92077,11 +92190,12 @@ function traceView(entries, id) {
 	const timing = traceTiming(entries);
 	const logs = filter$3(ordered, (entry) => entry.signal === "log");
 	const bySpan = groupBy(logs, (log) => log.spanId);
+	const broken = brokeAt(map$8(spans, (span) => span.entry));
 	const tree = pipe(map$8(spans, (span) => {
 		const ancestors = reverse(unfold({
 			entry: span.entry,
 			seen: make$66(span.entry.spanId)
-		}, (current) => pipe(get$10(byId, parentId(current.entry)), filter$5((parent) => !has(current.seen, parent.entry.spanId)), map$11((parent) => [parent, {
+		}, (current) => pipe(get$9(byId, parentId(current.entry)), filter$5((parent) => !has(current.seen, parent.entry.spanId)), map$11((parent) => [parent, {
 			entry: parent.entry,
 			seen: add$1(current.seen, parent.entry.spanId)
 		}]))));
@@ -92090,7 +92204,7 @@ function traceView(entries, id) {
 			value: {
 				...span.entry,
 				depth: ancestors.length,
-				logs: getOrElse(get$10(bySpan, span.entry.spanId), () => []),
+				logs: getOrElse(get$9(bySpan, span.entry.spanId), () => []),
 				offsetMs: durationMs(timing.time, span.entry.time),
 				parentSpanId: parentId(span.entry),
 				runtime: runtime(span.entry.resource)
@@ -92099,6 +92213,10 @@ function traceView(entries, id) {
 	}), sort(Struct$1({ path: Array_(Number$6) })), map$8((node) => node.value));
 	return {
 		durationMs: timing.durationMs,
+		...match$8(broken, {
+			onNone: () => ({}),
+			onSome: (span) => ({ failureSpanId: span.spanId })
+		}),
 		id,
 		logs: filter$3(logs, (log) => !has$4(byId, log.spanId)),
 		services: dedupeWith(map$8([...tree, ...logs], (entry) => ({
@@ -92129,14 +92247,6 @@ function subscription(root, spans) {
 function failureCount(group) {
 	return countBy(group, (item) => item.trace.failure !== void 0);
 }
-function brokeAt(spans) {
-	const failed = filter$3(spans, (span) => span.status === 2);
-	const parents = fromIterable$2(map$8(failed, parentId));
-	return match$6(filter$3(failed, (span) => !has(parents, span.spanId)), {
-		onEmpty: () => none(),
-		onNonEmpty: (candidates) => some$1(min(candidates, byStart))
-	});
-}
 function traced(records, now) {
 	return flatMap$8(match$6(filter$3(records, (entry) => entry.signal === "trace"), {
 		onEmpty: () => none(),
@@ -92154,10 +92264,7 @@ function traced(records, now) {
 				durationMs: timing.durationMs,
 				...match$8(brokeAt(spans), {
 					onNone: () => ({}),
-					onSome: (span) => ({ failure: {
-						message: pipe(fromNullishOr(span.payload["status"]), filter$5(isObject$2), flatMap$8((status) => fromNullishOr(get$6(status, "message"))), filter$5(isString$1), getOrElse(() => "")),
-						span: span.name
-					} })
+					onSome: (span) => ({ failure: { span: span.name } })
 				}),
 				id: root.traceId,
 				time: timing.time
@@ -92165,23 +92272,23 @@ function traced(records, now) {
 		});
 	});
 }
-function operationsOf(group, keep) {
-	return sort(map$8(toEntries(groupBy(group, (item) => `${item.runtime} ${item.name}`)), (entry) => {
+function operationsOf(group) {
+	return map$8(toEntries(groupBy(group, (item) => `${item.runtime} ${item.name}`)), (entry) => {
 		const times = sort(map$8(entry[1], (item) => item.trace.durationMs), Number$6);
 		return {
 			count: entry[1].length,
 			failures: failureCount(entry[1]),
 			name: headNonEmpty(entry[1]).name,
-			p50Ms: getOrElse(get$9(times, max(0, Math.ceil(times.length / 2) - 1)), () => 0),
+			p50Ms: percentile(times, .5),
 			runtime: headNonEmpty(entry[1]).runtime,
-			traces: map$8(sort(take$3(dedupeWith([...take$3(sort(filter$3(entry[1], (item) => item.trace.failure !== void 0), flip$2(mapInput(byTime, (item) => item.trace.time))), keep / 2), ...sort(entry[1], mapInput(flip$2(Number$6), (item) => item.trace.durationMs))], (first, second) => first.trace.id === second.trace.id), keep), mapInput(flip$2(Number$6), (item) => item.trace.durationMs)), (item) => item.trace)
+			traces: map$8(sort(take$3(dedupeWith([...take$3(sort(filter$3(entry[1], (item) => item.trace.failure !== void 0), flip$2(mapInput(byTime, (item) => item.trace.time))), KEEP / 2), ...sort(entry[1], mapInput(flip$2(Number$6), (item) => item.trace.durationMs))], (first, second) => first.trace.id === second.trace.id), KEEP), mapInput(flip$2(Number$6), (item) => item.trace.durationMs)), (item) => item.trace)
 		};
-	}), combine$2(mapInput(flip$2(Number$6), (operation) => operation.failures), mapInput(flip$2(Number$6), (operation) => operation.count)));
+	});
 }
-function overview(entries, keep, now) {
+function overview(entries, now) {
 	return { apps: map$8(sort(values$2(groupBy(getSomes(map$8(values$2(groupBy(filter$3(entries, (entry) => entry.traceId !== ""), (entry) => entry.traceId)), (records) => traced(records, now))), (item) => item.app)), combine$2(mapInput(flip$2(Number$6), (group) => failureCount(group)), mapInput(flip$2(Number$6), (group) => group.length))), (group) => ({
 		name: headNonEmpty(group).app,
-		operations: operationsOf(group, keep)
+		operations: operationsOf(group)
 	})) };
 }
 // src/services/telemetry/service.ts
@@ -92263,7 +92370,7 @@ var Telemetry = class extends Service$2()("@deslop/scope/services/telemetry/serv
 	}), flatMap$1(() => concat$1(fromEffect(pipe(all$1({
 		entries: read,
 		now: currentTimeMillis
-	}, { concurrency: "unbounded" }), map$5((current) => overview(current.entries, 20, current.now)))), drain(fromEffect(sleep("1 second"))))), share({
+	}, { concurrency: "unbounded" }), map$5((current) => overview(current.entries, current.now)))), drain(fromEffect(sleep("1 second"))))), share({
 		capacity: 1,
 		replay: 1,
 		strategy: "sliding"
@@ -92278,7 +92385,6 @@ var Telemetry = class extends Service$2()("@deslop/scope/services/telemetry/serv
 	return {
 		ingestLogs: fn("Telemetry.ingestLogs")(function* (payload) {
 			const receivedAt = yield* currentTimeMillis;
-			const now = `${BigInt(receivedAt) * 1000000n}`;
 			yield* save(yield* forEach$1(flatMap$6(payload.resourceLogs ?? [], (group) => flatMap$6(group.scopeLogs ?? [], (scope) => map$8(scope.logRecords ?? [], (log) => ({
 				group,
 				log,
@@ -92290,9 +92396,6 @@ var Telemetry = class extends Service$2()("@deslop/scope/services/telemetry/serv
 				payload: item.log,
 				receivedAt,
 				resource: item.group.resource ?? {},
-				resourceSchemaUrl: item.group.schemaUrl ?? "",
-				scope: item.scope.scope ?? {},
-				scopeSchemaUrl: item.scope.schemaUrl ?? "",
 				service: serviceName(item.group.resource ?? {}),
 				signal: "log",
 				spanId: toLowerCase(item.log.spanId ?? ""),
@@ -92300,7 +92403,7 @@ var Telemetry = class extends Service$2()("@deslop/scope/services/telemetry/serv
 					onFalse: () => 0,
 					onTrue: () => 2
 				}),
-				time: logTime(item.log, now),
+				time: item.log.timeUnixNano,
 				traceId: toLowerCase(item.log.traceId ?? "")
 			})), { concurrency: 1 }));
 		}),
@@ -92313,9 +92416,6 @@ var Telemetry = class extends Service$2()("@deslop/scope/services/telemetry/serv
 				payload: span,
 				receivedAt,
 				resource: group.resource ?? {},
-				resourceSchemaUrl: group.schemaUrl ?? "",
-				scope: scope.scope ?? {},
-				scopeSchemaUrl: scope.schemaUrl ?? "",
 				service: serviceName(group.resource ?? {}),
 				signal: "trace",
 				spanId: toLowerCase(span.spanId),
@@ -92368,7 +92468,7 @@ var Telemetry = class extends Service$2()("@deslop/scope/services/telemetry/serv
 				entries: map$8(take$3(drop$1(ordered, query.offset), query.limit), (found) => {
 					const records = byTrace[found.id] ?? [];
 					const view = traceView(records, found.id);
-					const root = getOrElse(head(view.spans), () => getOrThrow$1(head(records)));
+					const root = getOrThrow$1(head(view.spans));
 					return {
 						durationMs: found.durationMs,
 						errors: countBy(records, (entry) => entry.status === 2),
@@ -92388,215 +92488,7 @@ var Telemetry = class extends Service$2()("@deslop/scope/services/telemetry/serv
 }, failed) }) {
 	static layer = (directory) => pipe(effect(this, this.make(directory)), provide$2(layerKeyValueStore(directory)));
 };
-// src/rpcs/handlers.ts
-const RpcHandlers = RpcContracts.toLayer(gen(function* () {
-	const telemetry = yield* Telemetry;
-	return RpcContracts.of({
-		"scope.overview": () => telemetry.overview,
-		"scope.trace": (input) => telemetry.trace(input.id)
-	});
-}));
-// src/services/github/lib/utils.ts
-function nanos(time) {
-	return `${BigInt(toEpochMillis(makeUnsafe$5(time))) * 1000000n}`;
-}
-function hex(value, width) {
-	return padStart(width, "0")(value.toString(16));
-}
-function traceIdOf(run, attempt) {
-	return `${hex(run, 24)}${hex(attempt, 8)}`;
-}
-function runSpanId(run) {
-	return `1${hex(run, 15)}`;
-}
-function jobSpanId(job) {
-	return `2${hex(job, 15)}`;
-}
-function statusOf(conclusion, message) {
-	if (conclusion === "failure" || conclusion === "timed_out" || conclusion === "startup_failure") return {
-		code: 2,
-		message
-	};
-	if (conclusion === "success") return {
-		code: 1,
-		message: ""
-	};
-	return {
-		code: 0,
-		message: ""
-	};
-}
-function text(key, value) {
-	return {
-		key,
-		value: { stringValue: value }
-	};
-}
-function repositoryTraces(repository, spans) {
-	return TracesRequest.make({ resourceSpans: [{
-		resource: { attributes: [text("service.name", repository), text("scope.runtime", "ci")] },
-		scopeSpans: [{
-			scope: { name: "github-actions" },
-			spans
-		}]
-	}] });
-}
-function runIds(event) {
-	return {
-		spanId: runSpanId(event.workflow_run.id),
-		traceId: traceIdOf(event.workflow_run.id, event.workflow_run.run_attempt)
-	};
-}
-function runTrace(event) {
-	const run = event.workflow_run;
-	return repositoryTraces(event.repository.full_name, [{
-		attributes: [
-			text("github.title", run.display_title),
-			text("github.event", run.event),
-			text("git.branch", run.head_branch ?? ""),
-			text("git.commit", run.head_sha),
-			text("github.conclusion", run.conclusion ?? ""),
-			text("url.full", run.html_url)
-		],
-		kind: 1,
-		name: run.name ?? run.display_title,
-		parentSpanId: "",
-		startTimeUnixNano: nanos(run.run_started_at),
-		status: statusOf(run.conclusion, `${run.display_title} failed`),
-		...runIds(event),
-		...match$8(liftPredicate(event.action, (action) => action === "completed"), {
-			onNone: () => ({}),
-			onSome: () => ({ endTimeUnixNano: nanos(run.updated_at) })
-		})
-	}]);
-}
-function jobTrace(event) {
-	const job = event.workflow_job;
-	const traceId = traceIdOf(job.run_id, job.run_attempt);
-	const steps = getSomes(map$8(job.steps, (step) => pipe(all$4({
-		completed: fromNullishOr(step.completed_at),
-		started: fromNullishOr(step.started_at)
-	}), filter$5(() => step.conclusion !== "skipped"), map$11((times) => ({
-		...step,
-		...times
-	})))));
-	const failed = findFirst(steps, (step) => statusOf(step.conclusion, "").code === 2);
-	return repositoryTraces(event.repository.full_name, [{
-		attributes: [
-			text("github.runner", job.runner_name ?? ""),
-			text("github.conclusion", job.conclusion ?? ""),
-			{
-				key: "github.queued_ms",
-				value: { intValue: `${toEpochMillis(makeUnsafe$5(job.started_at)) - toEpochMillis(makeUnsafe$5(job.created_at))}` }
-			},
-			text("url.full", job.html_url)
-		],
-		endTimeUnixNano: nanos(job.completed_at ?? job.started_at),
-		kind: 1,
-		name: job.name,
-		parentSpanId: runSpanId(job.run_id),
-		spanId: jobSpanId(job.id),
-		startTimeUnixNano: nanos(job.started_at),
-		status: statusOf(job.conclusion, match$8(failed, {
-			onNone: () => `${job.name} failed`,
-			onSome: (step) => `${step.name} failed`
-		})),
-		traceId
-	}, ...map$8(steps, (step) => ({
-		attributes: [text("github.conclusion", step.conclusion ?? ""), text("url.full", `${job.html_url}#step:${step.number}:1`)],
-		endTimeUnixNano: nanos(step.completed),
-		kind: 1,
-		name: step.name,
-		parentSpanId: jobSpanId(job.id),
-		spanId: `3${hex(job.id, 12)}${hex(step.number, 3)}`,
-		startTimeUnixNano: nanos(step.started),
-		status: statusOf(step.conclusion, `${step.name} failed`),
-		traceId
-	}))]);
-}
-// src/services/github/schema.ts
-const Repository = Struct({ full_name: String$6 });
-const Step = Struct({
-	completed_at: NullOr(String$6),
-	conclusion: NullOr(String$6),
-	name: String$6,
-	number: Int$1,
-	started_at: NullOr(String$6)
-});
-const WorkflowJob = Struct({
-	action: String$6,
-	repository: Repository,
-	workflow_job: Struct({
-		completed_at: NullOr(String$6),
-		conclusion: NullOr(String$6),
-		created_at: String$6,
-		html_url: String$6,
-		id: Int$1,
-		name: String$6,
-		run_attempt: Int$1,
-		run_id: Int$1,
-		runner_name: NullOr(String$6),
-		started_at: String$6,
-		steps: ArraySchema(Step)
-	})
-});
-const WorkflowRun = Struct({
-	action: String$6,
-	repository: Repository,
-	workflow_run: Struct({
-		conclusion: NullOr(String$6),
-		display_title: String$6,
-		event: String$6,
-		head_branch: NullOr(String$6),
-		head_sha: String$6,
-		html_url: String$6,
-		id: Int$1,
-		name: NullOr(String$6),
-		run_attempt: Int$1,
-		run_number: Int$1,
-		run_started_at: String$6,
-		updated_at: String$6
-	})
-});
-// src/tools/contracts.ts
-const Tools = make$37(make$38("list_services", {
-	description: "Start here: each service with its latest run, release, last event and entry count, plus rejected exports. Only each service's newest release is kept, so nothing here predates it. A service missing here sent nothing in the last three days.",
-	failure: TelemetryError,
-	success: IngestionStatus
-}).annotate(Readonly, true), make$38("find", {
-	description: "Find traces (one request or action each), single spans with their attributes, or logs, newest or slowest first; searches the latest run of each service unless runs is \"all\". Open a trace with read_trace.",
-	failure: TelemetryError,
-	parameters: Struct({
-		...SortFilters.fields,
-		kind: Literals([
-			"traces",
-			"spans",
-			"logs"
-		]).annotate({ description: "What to find." })
-	}),
-	success: Union([TracesPage, Page])
-}).annotate(Readonly, true), make$38("read_trace", {
-	description: "One trace whole: every span in order with its depth, offset, duration and logs.",
-	failure: TelemetryError,
-	parameters: Struct({ id: pipe(TraceId, annotateEncoded({ description: "The 32-character id from find." })) }),
-	success: Trace
-}).annotate(Readonly, true), make$38("measure_latency", {
-	description: "Count, errors and p50, p95 and max milliseconds of the matching spans; run it before and after a change to compare.",
-	failure: TelemetryError,
-	parameters: Filters,
-	success: Stats
-}).annotate(Readonly, true));
-// src/tools/handlers.ts
-const ToolHandlers = Tools.toLayer(gen(function* () {
-	const telemetry = yield* Telemetry;
-	return Tools.of({
-		find: (input) => flatMap$3(currentTimeMillis, (now) => pipe(value(input.kind), when("traces", () => telemetry.traces(queryOf(input, now))), when("spans", () => telemetry.spans(queryOf(input, now))), when("logs", () => telemetry.logs(queryOf(input, now))), exhaustive)),
-		list_services: () => telemetry.services(),
-		measure_latency: (filters) => flatMap$3(currentTimeMillis, (now) => telemetry.stats(queryOf(filters, now))),
-		read_trace: (input) => telemetry.trace(input.id)
-	});
-}));
-// src/main.server.ts
+// src/http/handlers.ts
 const cors = cors$1({
 	allowedHeaders: ["content-type"],
 	allowedMethods: ["POST"]
@@ -92620,7 +92512,11 @@ function answer(schema, save) {
 		}));
 	});
 }
-const receiver = use((router) => gen(function* () {
+const Signature = pipe(String$6, check(isPattern(/^sha256=[0-9a-f]{64}$/u)), decodeTo(Uint8ArrayFromHex, {
+	decode: transform$3(slice$1(7)),
+	encode: transform$3((tag) => `sha256=${tag}`)
+}));
+const HttpHandlers = use((router) => gen(function* () {
 	const telemetry = yield* Telemetry;
 	const ingest = fnUntraced(function* (route, schema, save) {
 		const request = yield* HttpServerRequest;
@@ -92643,48 +92539,101 @@ const receiver = use((router) => gen(function* () {
 	yield* router.add("POST", "/v1/logs", cors(ingest("/v1/logs", LogsRequest, telemetry.ingestLogs)));
 	yield* router.add("OPTIONS", "/v1/*", cors(succeed$5(empty())));
 	yield* router.add("GET", "/health", text$1("ready"));
+	const mac = yield* Mac;
+	yield* match$8(yield* option(Redacted("GITHUB_WEBHOOK_SECRET")), {
+		onNone: () => void_$1,
+		onSome: fnUntraced(function* (secret) {
+			const key = yield* key$1(hmacSha256, new TextEncoder().encode(value$2(secret)));
+			yield* router.add("POST", "/v1/github", catchTags(gen(function* () {
+				const request = yield* HttpServerRequest;
+				const body = new Uint8Array(yield* request.arrayBuffer);
+				if (!(yield* match$8(decodeOption(Signature)(request.headers["x-hub-signature-256"] ?? ""), {
+					onNone: () => succeed$5(false),
+					onSome: (tag) => mac.verify(key, tag, body)
+				}))) return empty({ status: 401 });
+				const text = new TextDecoder().decode(body);
+				if (request.headers["x-github-event"] === "workflow_run") {
+					const event = yield* decodeEffect(fromJsonString(WorkflowRun))(text);
+					const ids = runIds(event);
+					const finished = yield* map$5(option$1(telemetry.trace(ids.traceId)), exists((trace) => some(trace.spans, (span) => span.spanId === ids.spanId && isString$2(span.payload["endTimeUnixNano"]))));
+					if (event.action === "completed" || event.action === "in_progress" && !finished) yield* telemetry.ingestTraces(runTrace(event));
+				}
+				if (request.headers["x-github-event"] === "workflow_job") {
+					const event = yield* decodeEffect(fromJsonString(WorkflowJob))(text);
+					if (event.action === "completed" && event.workflow_job.conclusion !== "skipped") yield* telemetry.ingestTraces(jobTrace(event));
+				}
+				return empty({ status: 204 });
+			}), {
+				CryptoError: () => succeed$5(empty({ status: 401 })),
+				HttpServerError: () => succeed$5(empty({ status: 400 })),
+				SchemaError: (error) => succeed$5(text$1(error.message, { status: 400 })),
+				TelemetryError: () => succeed$5(empty({ status: 503 }))
+			}));
+		})
+	});
 }));
-const Signature = pipe(String$6, check(isPattern(/^sha256=[0-9a-f]{64}$/u)), decodeTo(Uint8ArrayFromHex, {
-	decode: transform$3(slice$1(7)),
-	encode: transform$3((tag) => `sha256=${tag}`)
+// src/routes/icon.svg
+var icon_default = "<svg xmlns=\"http://www.w3.org/2000/svg\" viewBox=\"0 0 64 64\" shape-rendering=\"crispEdges\"><path fill=\"#000\" fill-opacity=\".18\" d=\"M17 45h1v1h-1zM15 46h3v1h-3zM13 47h4v1h-4zM15 48h4v1h-4zM46 48h1v1h-1zM17 49h4v1h-4zM46 49h3v1h-3zM19 50h4v1h-4zM47 50h4v1h-4zM21 51h4v1h-4zM45 51h4v1h-4zM23 52h4v1h-4zM43 52h4v1h-4zM25 53h4v1h-4zM41 53h4v1h-4zM27 54h4v1h-4zM39 54h4v1h-4zM29 55h4v1h-4zM37 55h4v1h-4zM31 56h8v1h-8zM33 57h4v1h-4z\"/><path fill=\"#000\" fill-opacity=\".38\" d=\"M17 47h2v1h-2zM19 48h1v1h-1zM21 49h1v1h-1zM23 50h1v1h-1zM45 50h2v1h-2zM25 51h1v1h-1zM44 51h1v1h-1zM27 52h1v1h-1zM42 52h1v1h-1zM29 53h1v1h-1zM40 53h1v1h-1zM31 54h1v1h-1zM38 54h1v1h-1zM33 55h1v1h-1zM36 55h1v1h-1z\"/><path fill=\"#4e6f72\" d=\"M18 8h4v1h-4zM16 9h2v1h-2zM22 9h2v1h-2zM15 10h1v1h-1zM24 10h2v1h-2zM15 11h1v1h-1zM26 11h2v1h-2zM15 12h1v1h-1zM28 12h2v1h-2zM15 13h1v1h-1zM30 13h2v1h-2zM15 14h1v1h-1zM32 14h2v1h-2zM15 15h1v1h-1zM34 15h2v1h-2zM15 16h1v1h-1zM36 16h2v1h-2zM15 17h1v1h-1zM38 17h2v1h-2zM15 18h1v1h-1zM40 18h2v1h-2zM15 19h1v1h-1zM42 19h2v1h-2zM15 20h1v1h-1zM44 20h2v1h-2zM15 21h1v1h-1zM46 21h2v1h-2zM15 22h1v1h-1zM48 22h1v1h-1zM15 23h1v1h-1zM48 23h1v1h-1zM15 24h1v1h-1zM48 24h1v1h-1zM15 25h1v1h-1zM48 25h1v1h-1zM15 26h1v1h-1zM48 26h1v1h-1zM15 27h1v1h-1zM48 27h1v1h-1zM15 28h1v1h-1zM48 28h1v1h-1zM15 29h1v1h-1zM48 29h1v1h-1zM15 30h1v1h-1zM48 30h1v1h-1zM15 31h1v1h-1zM48 31h1v1h-1zM15 32h1v1h-1zM48 32h1v1h-1zM16 33h2v1h-2zM48 33h1v1h-1zM18 34h2v1h-2zM48 34h1v1h-1zM20 35h2v1h-2zM48 35h1v1h-1zM22 36h2v1h-2zM48 36h1v1h-1zM24 37h2v1h-2zM48 37h1v1h-1zM26 38h2v1h-2zM48 38h1v1h-1zM48 39h1v1h-1zM48 40h1v1h-1zM48 41h1v1h-1zM48 42h1v1h-1zM48 43h1v1h-1zM48 44h1v1h-1zM46 45h2v1h-2zM44 46h2v1h-2z\"/><path fill=\"#bce6e6\" d=\"M18 9h4v1h-4zM18 10h6v1h-6zM20 11h6v1h-6zM22 12h6v1h-6zM24 13h6v1h-6zM26 14h6v1h-6zM28 15h6v1h-6zM20 16h2v1h-2zM30 16h6v1h-6zM20 17h4v1h-4zM32 17h6v1h-6zM22 18h4v1h-4zM34 18h6v1h-6zM24 19h4v1h-4zM36 19h6v1h-6zM26 20h4v1h-4zM38 20h6v1h-6zM28 21h4v1h-4zM40 21h6v1h-6zM30 22h4v1h-4zM42 22h4v1h-4zM26 23h2v1h-2zM32 23h4v1h-4zM26 24h4v1h-4zM34 24h2v1h-2zM43 24h1v1h-1zM28 25h4v1h-4zM43 25h1v1h-1zM30 26h4v1h-4zM43 26h1v1h-1zM32 27h4v1h-4zM43 27h1v1h-1zM34 28h2v1h-2zM43 28h1v1h-1zM30 29h2v1h-2zM43 29h1v1h-1zM30 30h4v1h-4zM43 30h1v1h-1zM32 31h2v1h-2zM43 31h1v1h-1zM43 32h1v1h-1zM43 33h1v1h-1zM43 34h1v1h-1zM43 35h1v1h-1zM43 36h1v1h-1zM43 37h1v1h-1zM43 38h1v1h-1zM43 39h1v1h-1zM43 40h1v1h-1zM43 41h1v1h-1zM43 42h1v1h-1zM43 43h1v1h-1zM43 44h1v1h-1zM43 45h1v1h-1z\"/><path fill=\"#daf7f7\" d=\"M16 10h2v1h-2zM18 11h2v1h-2zM20 12h2v1h-2zM22 13h2v1h-2zM24 14h2v1h-2zM26 15h2v1h-2zM28 16h2v1h-2zM30 17h2v1h-2zM32 18h2v1h-2zM34 19h2v1h-2zM36 20h2v1h-2zM38 21h2v1h-2zM40 22h2v1h-2zM46 22h2v1h-2zM42 23h4v1h-4z\"/><path fill=\"#A3D4D5\" d=\"M16 11h2v1h-2zM16 12h4v1h-4zM16 13h6v1h-6zM16 14h2v1h-2zM20 14h4v1h-4zM16 15h2v1h-2zM22 15h4v1h-4zM16 16h2v1h-2zM24 16h4v1h-4zM16 17h2v1h-2zM26 17h4v1h-4zM16 18h2v1h-2zM28 18h4v1h-4zM16 19h2v1h-2zM30 19h4v1h-4zM16 20h2v1h-2zM32 20h4v1h-4zM16 21h2v1h-2zM34 21h4v1h-4zM16 22h2v1h-2zM36 22h4v1h-4zM16 23h2v1h-2zM38 23h4v1h-4zM16 24h2v1h-2zM40 24h3v1h-3zM16 25h2v1h-2zM42 25h1v1h-1zM16 26h2v1h-2zM42 26h1v1h-1zM16 27h2v1h-2zM42 27h1v1h-1zM16 28h2v1h-2zM42 28h1v1h-1zM16 29h2v1h-2zM42 29h1v1h-1zM16 30h4v1h-4zM42 30h1v1h-1zM16 31h6v1h-6zM42 31h1v1h-1zM16 32h8v1h-8zM42 32h1v1h-1zM18 33h8v1h-8zM42 33h1v1h-1zM20 34h8v1h-8zM42 34h1v1h-1zM22 35h8v1h-8zM42 35h1v1h-1zM24 36h8v1h-8zM42 36h1v1h-1zM26 37h8v1h-8zM42 37h1v1h-1zM28 38h8v1h-8zM42 38h1v1h-1zM30 39h8v1h-8zM42 39h1v1h-1zM32 40h8v1h-8zM42 40h1v1h-1zM34 41h9v1h-9zM36 42h7v1h-7zM38 43h5v1h-5zM40 44h3v1h-3zM42 45h1v1h-1z\"/><path fill=\"#16161D\" d=\"M18 14h2v1h-2zM18 15h4v1h-4zM18 16h2v1h-2zM22 16h2v1h-2zM18 17h2v1h-2zM24 17h2v1h-2zM18 18h4v1h-4zM26 18h2v1h-2zM18 19h6v1h-6zM28 19h2v1h-2zM18 20h8v1h-8zM30 20h2v1h-2zM18 21h10v1h-10zM32 21h2v1h-2zM18 22h12v1h-12zM34 22h2v1h-2zM18 23h8v1h-8zM28 23h4v1h-4zM36 23h2v1h-2zM18 24h8v1h-8zM30 24h4v1h-4zM36 24h4v1h-4zM18 25h10v1h-10zM32 25h10v1h-10zM18 26h12v1h-12zM34 26h8v1h-8zM18 27h14v1h-14zM36 27h6v1h-6zM18 28h16v1h-16zM36 28h6v1h-6zM18 29h12v1h-12zM32 29h10v1h-10zM20 30h10v1h-10zM34 30h8v1h-8zM22 31h10v1h-10zM34 31h8v1h-8zM24 32h18v1h-18zM26 33h16v1h-16zM28 34h14v1h-14zM30 35h12v1h-12zM32 36h10v1h-10zM34 37h8v1h-8zM36 38h2v1h-2zM40 38h2v1h-2zM38 39h4v1h-4zM40 40h2v1h-2z\"/><path fill=\"#77a4a7\" d=\"M46 23h2v1h-2zM44 24h4v1h-4zM44 25h4v1h-4zM44 26h4v1h-4zM44 27h4v1h-4zM44 28h4v1h-4zM44 29h4v1h-4zM44 30h4v1h-4zM44 31h4v1h-4zM44 32h4v1h-4zM44 33h4v1h-4zM44 34h4v1h-4zM44 35h4v1h-4zM44 36h4v1h-4zM44 37h4v1h-4zM44 38h4v1h-4zM44 39h4v1h-4zM44 40h4v1h-4zM44 41h4v1h-4zM44 42h4v1h-4zM44 43h4v1h-4zM44 44h4v1h-4zM44 45h2v1h-2z\"/><path fill=\"#F2D98C\" d=\"M38 38h2v1h-2z\"/><path fill=\"#565961\" d=\"M27 39h1v1h-1zM26 40h2v1h-2zM24 41h2v1h-2zM22 42h2v1h-2zM20 43h2v1h-2zM36 43h2v1h-2zM19 44h1v1h-1zM38 44h2v1h-2zM18 45h1v1h-1zM40 45h2v1h-2zM18 46h1v1h-1zM42 46h2v1h-2zM19 47h1v1h-1zM44 47h1v1h-1zM20 48h2v1h-2zM45 48h1v1h-1zM22 49h2v1h-2zM44 49h2v1h-2zM24 50h2v1h-2zM42 50h3v1h-3zM26 51h2v1h-2zM40 51h4v1h-4zM28 52h2v1h-2zM38 52h4v1h-4zM30 53h2v1h-2zM36 53h4v1h-4zM32 54h2v1h-2zM35 54h3v1h-3zM34 55h2v1h-2z\"/><path fill=\"#B4B8C4\" d=\"M28 39h2v1h-2zM28 40h4v1h-4zM28 41h4v1h-4zM28 42h4v1h-4zM28 43h4v1h-4zM28 44h4v1h-4zM19 45h1v1h-1zM28 45h4v1h-4zM20 46h2v1h-2zM28 46h4v1h-4zM22 47h2v1h-2zM30 47h2v1h-2zM24 48h2v1h-2zM26 49h2v1h-2zM28 50h2v1h-2zM30 51h2v1h-2zM32 52h2v1h-2zM34 53h1v1h-1z\"/><path fill=\"#c8cbd6\" d=\"M26 41h2v1h-2zM24 42h4v1h-4zM22 43h6v1h-6zM20 44h8v1h-8zM36 44h2v1h-2zM20 45h8v1h-8zM36 45h4v1h-4zM22 46h6v1h-6zM36 46h6v1h-6zM24 47h6v1h-6zM34 47h10v1h-10zM26 48h18v1h-18zM28 49h14v1h-14zM30 50h10v1h-10zM32 51h6v1h-6zM34 52h2v1h-2z\"/><path fill=\"#868a95\" d=\"M32 41h2v1h-2zM32 42h4v1h-4zM32 43h4v1h-4zM32 44h4v1h-4zM32 45h4v1h-4zM32 46h4v1h-4zM32 47h2v1h-2zM44 48h1v1h-1zM42 49h2v1h-2zM40 50h2v1h-2zM38 51h2v1h-2zM36 52h2v1h-2zM35 53h1v1h-1z\"/><path fill=\"#9ea2ad\" d=\"M19 46h1v1h-1zM20 47h2v1h-2zM22 48h2v1h-2zM24 49h2v1h-2zM26 50h2v1h-2zM28 51h2v1h-2zM30 52h2v1h-2zM32 53h2v1h-2zM34 54h1v1h-1z\"/></svg>";
+// src/rpcs/contracts.ts
+var RpcContracts = class extends make$29(make$31("scope.overview", {
+	error: Union([AuthError, TelemetryError]),
+	stream: true,
+	success: Overview
+}), make$31("scope.trace", {
+	error: Union([AuthError, TelemetryError]),
+	payload: Struct({ id: TraceId }),
+	success: Trace
+})).middleware(RpcAuth) {};
+// src/rpcs/handlers.ts
+const RpcHandlers = RpcContracts.toLayer(gen(function* () {
+	const telemetry = yield* Telemetry;
+	return RpcContracts.of({
+		"scope.overview": () => telemetry.overview,
+		"scope.trace": (input) => telemetry.trace(input.id)
+	});
 }));
+// src/tools/contracts.ts
+const Tools = make$37(make$38("list_services", {
+	description: "Start here: each service with its latest run, release, last event and entry count, plus rejected exports. Only each service's newest release is kept, so nothing here predates it. A service missing here sent nothing in the last three days.",
+	failure: TelemetryError,
+	success: IngestionStatus
+}).annotate(Readonly, true), make$38("find", {
+	description: "Find traces (one request or action each), single spans with their attributes, or logs, newest or slowest first; searches the latest run of each service unless runs is \"all\". Open a trace with read_trace.",
+	failure: TelemetryError,
+	parameters: Struct({
+		...SortFilters.fields,
+		kind: Literals([
+			"traces",
+			"spans",
+			"logs"
+		]).annotate({ description: "What to find." })
+	}),
+	success: Union([TracesPage, Page])
+}).annotate(Readonly, true), make$38("read_trace", {
+	description: "One trace whole: every span in order with its depth, offset, duration and logs.",
+	failure: TelemetryError,
+	parameters: Struct({ id: pipe(TraceId, annotateEncoded({ description: "The 32-character id from find." })) }),
+	success: Trace
+}).annotate(Readonly, true), make$38("measure_latency", {
+	description: "Count, errors and p50, p95 and max milliseconds of the matching spans; run it before and after a change to compare.",
+	failure: TelemetryError,
+	parameters: Filters,
+	success: Stats
+}).annotate(Readonly, true));
+// src/tools/handlers.ts
+const ToolHandlers = Tools.toLayer(gen(function* () {
+	const telemetry = yield* Telemetry;
+	return Tools.of({
+		find: (input) => flatMap$3(currentTimeMillis, (now) => pipe(value(input.kind), when("traces", () => telemetry.traces(queryOf(input, now))), when("spans", () => telemetry.spans(queryOf(input, now))), when("logs", () => telemetry.logs(queryOf(input, now))), exhaustive)),
+		list_services: () => telemetry.services(),
+		measure_latency: (filters) => flatMap$3(currentTimeMillis, (now) => telemetry.stats(queryOf(filters, now))),
+		read_trace: (input) => telemetry.trace(input.id)
+	});
+}));
+// src/main.server.ts
 runApp({
 	icon: icon_default,
-	routes: pipe(mergeAll$1(receiver, use((router) => gen(function* () {
-		const telemetry = yield* Telemetry;
-		const mac = yield* Mac;
-		yield* match$8(yield* option(Redacted("GITHUB_WEBHOOK_SECRET")), {
-			onNone: () => void_$1,
-			onSome: fnUntraced(function* (secret) {
-				const key = yield* key$1(hmacSha256, new TextEncoder().encode(value$2(secret)));
-				yield* router.add("POST", "/v1/github", catchTags(gen(function* () {
-					const request = yield* HttpServerRequest;
-					const body = new Uint8Array(yield* request.arrayBuffer);
-					if (!(yield* match$8(decodeOption(Signature)(request.headers["x-hub-signature-256"] ?? ""), {
-						onNone: () => succeed$5(false),
-						onSome: (tag) => mac.verify(key, tag, body)
-					}))) return empty({ status: 401 });
-					const text = new TextDecoder().decode(body);
-					if (request.headers["x-github-event"] === "workflow_run") {
-						const event = yield* decodeEffect(fromJsonString(WorkflowRun))(text);
-						const ids = runIds(event);
-						const finished = yield* map$5(option$1(telemetry.trace(ids.traceId)), exists((trace) => some(trace.spans, (span) => span.spanId === ids.spanId && isString$2(span.payload["endTimeUnixNano"]))));
-						if (event.action === "completed" || event.action === "in_progress" && !finished) yield* telemetry.ingestTraces(runTrace(event));
-					}
-					if (request.headers["x-github-event"] === "workflow_job") {
-						const event = yield* decodeEffect(fromJsonString(WorkflowJob))(text);
-						if (event.action === "completed" && event.workflow_job.conclusion !== "skipped") yield* telemetry.ingestTraces(jobTrace(event));
-					}
-					return empty({ status: 204 });
-				}), {
-					CryptoError: () => succeed$5(empty({ status: 401 })),
-					HttpServerError: () => succeed$5(empty({ status: 400 })),
-					SchemaError: (error) => succeed$5(text$1(error.message, { status: 400 })),
-					TelemetryError: () => succeed$5(empty({ status: 503 }))
-				}));
-			})
-		});
-	})), layerRpc({
+	routes: pipe(mergeAll$1(HttpHandlers, layerRpc({
 		group: RpcContracts,
 		handlers: RpcHandlers
 	}), layerMcp({