@p4code/cli 0.6.13 → 0.6.14

package/dist/bin.mjs

@@ -8,7 +8,7 @@ import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
 import { Argument, Command, Flag, GlobalFlag, Prompt } from "effect/unstable/cli";
 import * as CliError from "effect/unstable/cli/CliError";
-import { FetchHttpClient, Headers as Headers$1, HttpBody, HttpClient, HttpClientError, HttpClientRequest, HttpClientResponse, HttpEffect, HttpRouter, HttpServer, HttpServerRequest, HttpServerRespondable, HttpServerResponse } from "effect/unstable/http";
+import { FetchHttpClient, HttpBody, HttpClient, HttpClientError, HttpClientRequest, HttpClientResponse, HttpEffect, HttpRouter, HttpServer, HttpServerRequest, HttpServerRespondable, HttpServerResponse } from "effect/unstable/http";
 import * as Context from "effect/Context";
 import * as NodeOS from "node:os";
 import * as NodeNet from "node:net";
@@ -63,6 +63,8 @@ import * as NodeReadline from "node:readline";
 import * as NodeFSP from "node:fs/promises";
 import { access } from "node:fs/promises";
 import * as Clock from "effect/Clock";
+import * as Headers$1 from "effect/unstable/http/Headers";
+import * as HttpRouter$1 from "effect/unstable/http/HttpRouter";
 import * as NodeStream from "@effect/platform-node/NodeStream";
 import * as NodeHttp from "node:http";
 import * as Deferred from "effect/Deferred";
@@ -266,7 +268,7 @@ const make$124 = () => {
 const layer$124 = Layer.sync(NetService, make$124);
 //#endregion
 //#region package.json
-var version$1 = "0.6.13";
+var version$1 = "0.6.14";
 //#endregion
 //#region src/config.ts
 /**
@@ -24244,6 +24246,49 @@ function isLoopbackHost(host) {
 	return normalized === "localhost" || normalized === "127.0.0.1" || normalized === "::1" || normalized === "[::1]" || normalized.startsWith("127.");
 }
 //#endregion
+//#region src/httpCompression/HttpResponseCompression.ts
+const GZIP_MIN_BYTES = 1024;
+var HttpResponseCompression = class extends Context.Service()("@p4code/cli/httpCompression/HttpResponseCompression") {};
+const layerNode = Layer.effect(HttpResponseCompression, Effect.gen(function* () {
+	const NodeZlib = yield* Effect.promise(() => import("node:zlib"));
+	return { gzip: (body, options) => {
+		const stream = NodeZlib.createGzip();
+		stream.end(body);
+		return HttpServerResponse$1.raw(stream, options);
+	} };
+}));
+const layerBun = Layer.succeed(HttpResponseCompression, { gzip: (body, options) => HttpServerResponse$1.raw(new Response(body).body.pipeThrough(new CompressionStream("gzip")), options) });
+function acceptsGzip(value) {
+	if (!value) return false;
+	const accepted = new Map(value.split(",").map((entry) => {
+		const [coding = "", ...parameters] = entry.trim().toLowerCase().split(";");
+		const quality = parameters.map((parameter) => parameter.trim().match(/^q=(.+)$/)?.[1]).find((parameter) => parameter !== void 0);
+		return [coding, quality === void 0 ? 1 : Number(quality)];
+	}));
+	return (accepted.get("gzip") ?? accepted.get("*") ?? 0) > 0;
+}
+function varyByAcceptEncoding(value) {
+	if (!value) return "Accept-Encoding";
+	const values = new Set(value.split(",").map((entry) => entry.trim().toLowerCase()));
+	return values.has("*") || values.has("accept-encoding") ? value : `${value}, Accept-Encoding`;
+}
+const compressHttpResponse = Effect.fnUntraced(function* (response, acceptEncoding) {
+	const body = response.body;
+	if (body._tag !== "Uint8Array" || body.contentLength < GZIP_MIN_BYTES || !body.contentType.startsWith("application/json") || response.headers["content-encoding"]) return response;
+	const variedResponse = HttpServerResponse$1.setHeader(response, "vary", varyByAcceptEncoding(response.headers.vary));
+	if (!acceptsGzip(acceptEncoding)) return variedResponse;
+	const compression = yield* HttpResponseCompression;
+	const headers = Headers$1.set(Headers$1.remove(variedResponse.headers, "content-length"), "content-encoding", "gzip");
+	return compression.gzip(body.body, {
+		status: response.status,
+		statusText: response.statusText,
+		headers,
+		cookies: response.cookies,
+		contentType: body.contentType
+	});
+});
+const httpCompressionLayer = HttpRouter$1.middleware((httpEffect) => Effect.flatMap(Effect.all([httpEffect, HttpServerRequest$1.HttpServerRequest]), ([response, request]) => compressHttpResponse(response, request.headers["accept-encoding"])), { global: true });
+//#endregion
 //#region src/persistence/Services/AgentAssets.ts
 var AgentAssetRepository = class extends Context.Service()("@p4code/cli/persistence/Services/AgentAssets/AgentAssetRepository") {};
 //#endregion
@@ -28795,6 +28840,321 @@ const hubTunnelClientSocketRoute = Effect.gen(function* () {
 })));
 const layer$96 = HttpRouter.add("GET", `${HUB_TUNNEL_CLIENT_SOCKET_PATH}/*`, hubTunnelClientSocketRoute);
 //#endregion
+//#region src/sync/HubLink.ts
+/**
+* Where this server's hub is, what it authenticates with, and whether it syncs
+* on its own.
+*
+* Absent by default. A server with no hub configured runs exactly as it does
+* today — the sync is skipped rather than failing, because "no hub" is a
+* complete and normal configuration, not a broken one.
+*
+* The record lives in `ServerSecretStore`, which already writes with
+* restrictive permissions, rather than in the settings file or the database.
+* The sync mode rides along in that record even though it is not a secret:
+* connect, disconnect and pause are then one write and one read, and the
+* settings panel reads one thing instead of joining two. Environment variables
+* override the link so a container or a service unit can be configured without
+* a first-run interactive step — the same trade the hub process itself makes
+* with `P4CODE_HUB_TOKEN_HASHES` — while the mode always comes from the stored
+* record, so a server configured by environment can still be paused.
+*
+* Mutable, deliberately. Resolving this once at layer construction would mean
+* connecting to a hub did nothing until the server restarted, which is a
+* miserable thing to discover after typing a token into a form.
+*
+* @module sync/HubLink
+*/
+/** Secret name holding the hub record as JSON. */
+const HUB_LINK_SECRET_NAME = "hub-link";
+var HubLink = class extends Context.Service()("@p4code/cli/sync/HubLink") {};
+/** The submitted URL or token could not make a usable link. */
+var InvalidHubLink = class extends Schema$1.TaggedErrorClass()("InvalidHubLink", { detail: Schema$1.String }) {
+	get message() {
+		return this.detail;
+	}
+};
+const trimTrailingSlash = (value) => value.replace(/\/+$/u, "");
+/**
+* Both halves must be present and the URL parseable. A half-configured link is
+* treated as no link at all, because a server that thinks it has a hub and
+* cannot form a request would report every sync as a failure rather than as the
+* "not configured" it actually is.
+*/
+const validateHubLink = (rawBaseUrl, rawToken) => {
+	const trimmed = trimTrailingSlash(rawBaseUrl.trim());
+	const token = rawToken.trim();
+	if (trimmed.length === 0 || token.length === 0) return Option.none();
+	const baseUrl = /^[a-z][a-z0-9+.-]*:\/\//iu.test(trimmed) ? trimmed : `https://${trimmed}`;
+	if (!URL.canParse(baseUrl)) return Option.none();
+	const parsed = new URL(baseUrl);
+	if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return Option.none();
+	return Option.some({
+		baseUrl,
+		token
+	});
+};
+const StoredHubLink = Schema$1.fromJsonString(Schema$1.Struct({
+	baseUrl: Schema$1.String,
+	token: Schema$1.String,
+	syncMode: Schema$1.optional(Schema$1.Literals(["auto", "paused"])),
+	shareMode: Schema$1.optional(Schema$1.Literals(["all", "selected"]))
+}));
+const decodeStoredHubLink = Schema$1.decodeUnknownExit(StoredHubLink);
+const encodeStoredHubLink = Schema$1.encodeSync(StoredHubLink);
+/**
+* Parse a stored record, tolerating anything that is not the shape we wrote.
+*
+* A corrupt secret disables the sync rather than failing the server's start.
+* Losing sync is recoverable by reconnecting; refusing to boot over it is not
+* proportionate to what has gone wrong.
+*/
+const parseHubLink = (raw) => {
+	const decoded = decodeStoredHubLink(raw);
+	if (decoded._tag !== "Success") return {
+		settings: Option.none(),
+		syncMode: "auto",
+		shareMode: "all"
+	};
+	return {
+		settings: validateHubLink(decoded.value.baseUrl, decoded.value.token),
+		syncMode: decoded.value.syncMode ?? "auto",
+		shareMode: decoded.value.shareMode ?? "all"
+	};
+};
+const formatHubLink = (input) => encodeStoredHubLink({
+	baseUrl: Option.match(input.settings, {
+		onNone: () => "",
+		onSome: (settings) => trimTrailingSlash(settings.baseUrl)
+	}),
+	token: Option.match(input.settings, {
+		onNone: () => "",
+		onSome: (s) => s.token
+	}),
+	syncMode: input.syncMode,
+	shareMode: input.shareMode
+});
+const fromEnvironment = (environment) => validateHubLink(environment.P4CODE_HUB_URL ?? "", environment.P4CODE_HUB_TOKEN ?? "");
+const make$113 = Effect.fn("HubLink.make")(function* (environment) {
+	const secrets = yield* ServerSecretStore;
+	const env = environment ?? process.env;
+	const fromEnv = fromEnvironment(env);
+	const readStored = Effect.fn("HubLink.readStored")(function* () {
+		const stored = yield* secrets.get(HUB_LINK_SECRET_NAME).pipe(Effect.orElseSucceed(() => Option.none()));
+		return Option.match(stored, {
+			onNone: () => ({
+				settings: Option.none(),
+				syncMode: "auto",
+				shareMode: "all"
+			}),
+			onSome: (bytes) => parseHubLink(new TextDecoder().decode(bytes))
+		});
+	});
+	const toState = (record) => Option.isSome(fromEnv) ? {
+		settings: fromEnv,
+		syncMode: record.syncMode,
+		shareMode: record.shareMode,
+		source: "environment"
+	} : {
+		settings: record.settings,
+		syncMode: record.syncMode,
+		shareMode: record.shareMode,
+		source: Option.isSome(record.settings) ? "stored" : "none"
+	};
+	const cache = yield* Ref.make(yield* readStored());
+	const updates = yield* PubSub.sliding({
+		capacity: 1,
+		replay: 1
+	});
+	yield* PubSub.publish(updates, toState(yield* Ref.get(cache)));
+	const persist = Effect.fn("HubLink.persist")(function* (record) {
+		yield* secrets.set(HUB_LINK_SECRET_NAME, new TextEncoder().encode(formatHubLink(record)));
+		yield* Ref.set(cache, record);
+		yield* PubSub.publish(updates, toState(record));
+		return toState(record);
+	});
+	return {
+		current: Ref.get(cache).pipe(Effect.map(toState)),
+		changes: Stream.fromPubSub(updates),
+		connect: (settings) => Effect.gen(function* () {
+			const validated = validateHubLink(settings.baseUrl, settings.token);
+			if (Option.isNone(validated)) return yield* new InvalidHubLink({ detail: "A hub needs an http or https URL and a non-empty token." });
+			const record = yield* Ref.get(cache);
+			return yield* persist({
+				...record,
+				settings: validated
+			});
+		}),
+		disconnect: Effect.gen(function* () {
+			const record = yield* Ref.get(cache);
+			return yield* persist({
+				...record,
+				settings: Option.none()
+			});
+		}),
+		setSyncMode: (mode) => Effect.gen(function* () {
+			const record = yield* Ref.get(cache);
+			return yield* persist({
+				...record,
+				syncMode: mode
+			});
+		}),
+		setShareMode: (mode) => Effect.gen(function* () {
+			const record = yield* Ref.get(cache);
+			return yield* persist({
+				...record,
+				shareMode: mode
+			});
+		})
+	};
+});
+const layer$95 = Layer.effect(HubLink, make$113());
+//#endregion
+//#region src/persistence/Layers/RemoteTasks.ts
+/**
+* The hub's task API, as a client.
+*
+* This used to be a `TaskRepository` in its own right, and the board was
+* either this or the local database. It is now the transport underneath
+* `SyncedTaskRepository`: local SQLite is a replica of the hub, so nothing
+* reads from here directly and the board no longer goes dark when the hub is
+* unreachable. What changed with it is the failure story — an unreachable hub
+* used to mean no board, and now means a board that is behind.
+*
+* The four calls here are what a mirror needs and no more: pull what changed
+* on the hub, push a whole row, arbitrate a claim, and delete. There is no partial
+* patch, because a mirror always holds the full row it wants the hub to have
+* and sending a diff of it would only add a way for the two to disagree.
+*
+* @module persistence/Layers/RemoteTasks
+*/
+const HUB_REQUEST_TIMEOUT_MS$1 = 15e3;
+/**
+* How often the hub writes to an idle `/v1/task-changes` stream. The client
+* treats two missed beats as a dead connection. Under ten seconds because Bun
+* closes a connection idle for ten, and proxies in front of a hosted hub are
+* rarely more patient.
+*/
+const HUB_TASK_CHANGES_HEARTBEAT_MS = 8e3;
+/**
+* `cursor`, `deletedTaskIds` and `full` are absent from a hub that predates
+* cursors, which answers every pull with the whole board.
+*/
+const TaskListPage = Schema$1.Struct({
+	tasks: Schema$1.Array(Task),
+	deletedTaskIds: Schema$1.optional(Schema$1.Array(TaskId)),
+	cursor: Schema$1.optional(Schema$1.String),
+	full: Schema$1.optional(Schema$1.Boolean)
+});
+const ConflictBody$1 = Schema$1.Struct({ current: Task });
+const decodeTaskListPage = Schema$1.decodeUnknownEffect(TaskListPage);
+const decodeTask = Schema$1.decodeUnknownEffect(Task);
+const decodeConflictBody$1 = Schema$1.decodeUnknownEffect(ConflictBody$1);
+/**
+* Every failure here is reported as the persistence error type.
+*
+* The mirror catches these and carries on — a failed push leaves the row
+* `pending` and the next pass retries it — so what matters is that the detail
+* says the hub was the store that would not answer, which is what shows up in
+* the log when someone asks why their two machines disagree.
+*/
+const hubUnavailable = (operation, detail) => new PersistenceSqlError({
+	operation: `HubTaskClient.${operation}`,
+	detail: `The hub board is unavailable: ${detail}`,
+	cause: null
+});
+var HubTaskClient = class extends Context.Service()("@p4code/cli/persistence/Layers/RemoteTasks/HubTaskClient") {};
+const makeHubTaskClient = Effect.gen(function* () {
+	const http = yield* HttpClient.HttpClient;
+	const link = yield* HubLink;
+	const isLinked = link.current.pipe(Effect.map((state) => Option.isSome(state.settings)));
+	const requireSettings = (operation) => Effect.gen(function* () {
+		const state = yield* link.current;
+		if (Option.isNone(state.settings)) return yield* hubUnavailable(operation, "no hub is configured on this server");
+		return state.settings.value;
+	});
+	const send = (operation, settings, request) => http.execute(request.pipe(HttpClientRequest.setHeader("authorization", `Bearer ${settings.token}`), HttpClientRequest.setHeader("accept", "application/json"))).pipe(Effect.timeout(HUB_REQUEST_TIMEOUT_MS$1), Effect.mapError((cause) => hubUnavailable(operation, `${cause._tag ?? "request failed"}`)));
+	const pull = (from) => Effect.gen(function* () {
+		const settings = yield* requireSettings("pull");
+		const resume = from?.baseUrl === settings.baseUrl ? from : void 0;
+		const request = HttpClientRequest.get(`${settings.baseUrl}/tasks${resume === void 0 ? "" : `?since=${encodeURIComponent(resume.cursor)}`}`);
+		const response = yield* send("pull", settings, resume?.etag === void 0 ? request : HttpClientRequest.setHeader(request, "if-none-match", resume.etag));
+		if (response.status === 304) return Option.none();
+		if (response.status !== 200) return yield* hubUnavailable("pull", `status ${response.status}`);
+		const body = yield* response.json.pipe(Effect.flatMap(decodeTaskListPage), Effect.mapError(() => hubUnavailable("pull", "the response did not match the contract")));
+		return Option.some({
+			full: body.full ?? true,
+			tasks: body.tasks,
+			deletedTaskIds: body.deletedTaskIds ?? [],
+			next: body.cursor === void 0 ? void 0 : {
+				baseUrl: settings.baseUrl,
+				cursor: body.cursor,
+				etag: response.headers.etag
+			}
+		});
+	});
+	const watch = Stream.unwrap(Effect.gen(function* () {
+		const settings = yield* requireSettings("watch");
+		const response = yield* http.execute(HttpClientRequest.get(`${settings.baseUrl}/v1/task-changes`).pipe(HttpClientRequest.setHeader("authorization", `Bearer ${settings.token}`))).pipe(Effect.mapError((cause) => hubUnavailable("watch", `${cause._tag ?? "request failed"}`)));
+		if (response.status !== 200) return yield* hubUnavailable("watch", `status ${response.status}`);
+		const relinked = link.changes.pipe(Stream.filter((state) => Option.isNone(state.settings) || state.settings.value.baseUrl !== settings.baseUrl || state.settings.value.token !== settings.token), Stream.runHead);
+		return response.stream.pipe(Stream.mapError(() => hubUnavailable("watch", "the change stream failed")), Stream.decodeText, Stream.splitLines, Stream.timeout(HUB_TASK_CHANGES_HEARTBEAT_MS * 2), Stream.filter((line) => line.includes("\"ready\"") || line.includes("\"changed\"")), Stream.map(() => void 0), Stream.interruptWhen(relinked));
+	}));
+	const put = (row, readableIdPrefix) => Effect.gen(function* () {
+		const settings = yield* requireSettings("put");
+		const response = yield* send("put", settings, HttpClientRequest.bodyJsonUnsafe(HttpClientRequest.put(`${settings.baseUrl}/tasks/${encodeURIComponent(row.taskId)}`), {
+			projectId: row.projectId,
+			repositoryKey: row.repositoryKey,
+			threadId: row.threadId,
+			parentTaskId: row.parentTaskId,
+			title: row.title,
+			body: row.body,
+			status: row.status,
+			priority: row.priority,
+			assignee: row.assignee,
+			labels: row.labels,
+			orderKey: row.orderKey,
+			createdAt: row.createdAt,
+			statusChangedAt: row.statusChangedAt ?? row.updatedAt,
+			readableIdPrefix
+		}));
+		if (response.status !== 200 && response.status !== 201) return yield* hubUnavailable("put", `status ${response.status}`);
+		return yield* response.json.pipe(Effect.flatMap(decodeTask), Effect.mapError(() => hubUnavailable("put", "the response did not match the contract")));
+	});
+	const patchIfStatus = (input) => Effect.gen(function* () {
+		const settings = yield* requireSettings("patchIfStatus");
+		const { taskId, ...fields } = input.patch;
+		const response = yield* send("patchIfStatus", settings, HttpClientRequest.bodyJsonUnsafe(HttpClientRequest.patch(`${settings.baseUrl}/tasks/${encodeURIComponent(taskId)}`), {
+			...fields,
+			expectedStatus: input.expectedStatus
+		}));
+		if (response.status === 404) return { outcome: "missing" };
+		if (response.status === 409) return {
+			outcome: "conflict",
+			current: (yield* response.json.pipe(Effect.flatMap(decodeConflictBody$1), Effect.mapError(() => hubUnavailable("patchIfStatus", "the conflict response did not match the contract")))).current
+		};
+		if (response.status !== 200) return yield* hubUnavailable("patchIfStatus", `status ${response.status}`);
+		return {
+			outcome: "updated",
+			task: yield* response.json.pipe(Effect.flatMap(decodeTask), Effect.mapError(() => hubUnavailable("patchIfStatus", "the response did not match the contract")))
+		};
+	});
+	const remove = (taskId) => Effect.gen(function* () {
+		const settings = yield* requireSettings("remove");
+		const response = yield* send("remove", settings, HttpClientRequest.delete(`${settings.baseUrl}/tasks/${encodeURIComponent(taskId)}`));
+		if (response.status !== 200 && response.status !== 204 && response.status !== 404) return yield* hubUnavailable("remove", `status ${response.status}`);
+	});
+	return {
+		isLinked,
+		pull,
+		watch,
+		put,
+		patchIfStatus,
+		remove
+	};
+});
+Layer.effect(HubTaskClient, makeHubTaskClient);
+//#endregion
 //#region src/hub/HubHttpServer.ts
 /**
 * The hub's HTTP surface.
@@ -28857,10 +29217,66 @@ const identityRoute = HttpRouter.add("GET", "/v1/identity", respondToHubFailures
 		environmentId: principal.environmentId
 	}, { headers: { "cache-control": "no-store" } });
 })));
+/**
+* Minted per process, not per database: a database restored from a backup
+* carries its old sequence numbers, and a cursor past the restore point would
+* otherwise skip every write it lost. The cost is one full pull per server
+* after each hub restart.
+*/
+const TASK_CURSOR_EPOCH = NodeCrypto.randomBytes(8).toString("hex");
+/**
+* The board, or what changed on it since a cursor.
+*
+* `?since=<cursor>` returns rows changed after that cursor plus the ids
+* deleted since, so a server polling an idle board downloads almost nothing.
+* An unfiltered list also carries the cursor to start from. A cursor this
+* process never issued gets the whole board back with `full: true`. Cursors
+* are `<epoch>-<seq>`; callers treat them as opaque.
+*/
+const readTaskPage = Effect.fn("HubHttpServer.readTaskPage")(function* (filter, since) {
+	const tasks = yield* TaskRepository;
+	if (since === void 0 && Object.keys(filter).length > 0) return { tasks: yield* tasks.list(filter) };
+	const sql = yield* SqlClient.SqlClient;
+	const [head] = yield* sql`SELECT COALESCE(MAX(seq), 0) AS seq FROM task_change_log`;
+	const seq = head?.seq ?? 0;
+	const epoch = TASK_CURSOR_EPOCH;
+	const cursor = `${epoch}-${seq}`;
+	const [sinceEpoch, sinceSeqText] = since?.split("-") ?? [];
+	const sinceSeq = Number(sinceSeqText);
+	if (since === void 0 || sinceEpoch !== epoch || sinceSeq > seq) return {
+		tasks: yield* tasks.list({}),
+		deletedTaskIds: [],
+		cursor,
+		full: true
+	};
+	const changes = yield* sql`
+    SELECT task_id AS "taskId", deleted FROM task_change_log
+    WHERE seq > ${sinceSeq} AND seq <= ${seq}
+    ORDER BY seq
+  `;
+	const changed = [];
+	const deletedTaskIds = [];
+	for (const change of changes) {
+		if (change.deleted === 1) {
+			deletedTaskIds.push(change.taskId);
+			continue;
+		}
+		const task = yield* tasks.getById({ taskId: change.taskId });
+		if (Option.isSome(task)) changed.push(task.value);
+	}
+	return {
+		tasks: changed,
+		deletedTaskIds,
+		cursor,
+		full: false
+	};
+});
+/** Weak, because gzip may re-encode the same representation on the way out. */
+const taskPageEtag = (body) => `W/"${NodeCrypto.createHash("sha256").update(body).digest("base64url")}"`;
+const matchesEtag = (ifNoneMatch, etag) => ifNoneMatch !== void 0 && ifNoneMatch.split(",").map((candidate) => candidate.trim().replace(/^W\//, "")).some((candidate) => candidate === "*" || candidate === etag.replace(/^W\//, ""));
 const listTasksRoute = HttpRouter.add("GET", "/tasks", respondToHubFailures(Effect.gen(function* () {
 	yield* authenticateHubRequest();
 	const request = yield* HttpServerRequest.HttpServerRequest;
-	const tasks = yield* TaskRepository;
 	const url = new URL(request.url, "http://hub.invalid");
 	const filter = yield* decodeOrInvalid(TaskListFilter, "Query string does not match TaskListFilter.")(Object.fromEntries([
 		"projectId",
@@ -28869,8 +29285,39 @@ const listTasksRoute = HttpRouter.add("GET", "/tasks", respondToHubFailures(Effe
 		"assignee",
 		"query"
 	].map((key) => [key, url.searchParams.get(key)]).filter(([, value]) => value !== null)));
-	const listed = yield* tasks.list(filter);
-	return HttpServerResponse.jsonUnsafe({ tasks: listed });
+	const sinceParam = url.searchParams.get("since");
+	if (sinceParam !== null && (!/^[0-9a-f]{1,32}-\d{1,15}$/.test(sinceParam) || Object.keys(filter).length > 0)) return yield* new InvalidHubRequest({ detail: "`since` must be a cursor from an earlier page and cannot be combined with filters." });
+	const page = yield* readTaskPage(filter, sinceParam ?? void 0);
+	const body = JSON.stringify(page);
+	const etag = taskPageEtag(body);
+	if (matchesEtag(request.headers["if-none-match"], etag)) return HttpServerResponse.empty({
+		status: 304,
+		headers: { etag }
+	});
+	return HttpServerResponse.text(body, {
+		contentType: "application/json",
+		headers: { etag }
+	});
+})));
+const taskChangeLine = (type) => new TextEncoder().encode(`{"type":"${type}"}\n`);
+/**
+* A nudge per board write, so linked servers pull when something changed
+* instead of on a timer.
+*
+* Carries no rows: the server answers a nudge with the same cursor pull it
+* always makes, so a nudge that is lost or duplicated costs nothing but
+* latency. `ready` doubles as a nudge, covering whatever changed while the
+* server was not listening.
+*/
+const taskChangesRoute = HttpRouter.add("GET", "/v1/task-changes", respondToHubFailures(Effect.gen(function* () {
+	yield* authenticateHubRequest();
+	const tasks = yield* TaskRepository;
+	const events = Stream.merge(tasks.streamWithSnapshot.pipe(Stream.map((event) => taskChangeLine(event.type === "snapshot" ? "ready" : "changed"))), Stream.tick(HUB_TASK_CHANGES_HEARTBEAT_MS).pipe(Stream.drop(1), Stream.map(() => taskChangeLine("heartbeat"))));
+	return HttpServerResponse.stream(events, { headers: {
+		"content-type": "application/x-ndjson",
+		"cache-control": "no-store",
+		"x-accel-buffering": "no"
+	} });
 })));
 const getTaskRoute = HttpRouter.add("GET", "/tasks/:taskId", respondToHubFailures(Effect.gen(function* () {
 	yield* authenticateHubRequest();
@@ -29292,7 +29739,7 @@ const releaseFeedLeaseRoute = HttpRouter.add("DELETE", "/feed/lease", respondToH
 })));
 /** Provide around HttpRouter.serve so request fibers share these process-owned services. */
 const routingServices = Layer.mergeAll(layer$113, layer$111, layer$102, layer$101).pipe(Layer.provideMerge(layer$112));
-const layer$95 = Layer.mergeAll(layer$100, layer$99, layer$103, layer$97, layer$96, layer$110, layer$98, healthRoute, identityRoute, listTasksRoute, getTaskRoute, createTaskRoute, putTaskRoute, updateTaskRoute, deleteTaskRoute, listAssetsRoute, getAssetRoute, putAssetRoute, deleteAssetRoute, listFeedSourcesRoute, upsertFeedSourceRoute, deleteFeedSourceRoute, listFeedRoute, putFeedArticleRoute, putFeedEngagementRoute, markFeedReadRoute, cleanupFeedRoute, setFeedRefreshedAtRoute, acquireFeedLeaseRoute, renewFeedLeaseRoute, releaseFeedLeaseRoute).pipe(Layer.provideMerge(layer$113), Layer.provideMerge(layer$111), Layer.provideMerge(layer$102));
+const layer$94 = Layer.mergeAll(layer$100, layer$99, layer$103, layer$97, layer$96, layer$110, layer$98, healthRoute, identityRoute, listTasksRoute, taskChangesRoute, getTaskRoute, createTaskRoute, putTaskRoute, updateTaskRoute, deleteTaskRoute, listAssetsRoute, getAssetRoute, putAssetRoute, deleteAssetRoute, listFeedSourcesRoute, upsertFeedSourceRoute, deleteFeedSourceRoute, listFeedRoute, putFeedArticleRoute, putFeedEngagementRoute, markFeedReadRoute, cleanupFeedRoute, setFeedRefreshedAtRoute, acquireFeedLeaseRoute, renewFeedLeaseRoute, releaseFeedLeaseRoute).pipe(Layer.provideMerge(layer$113), Layer.provideMerge(layer$111), Layer.provideMerge(layer$102));
 //#endregion
 //#region src/hub/Migrations/001_Tasks.ts
 /**
@@ -29789,6 +30236,57 @@ var _022_AnalyticsFacts_default = Effect.gen(function* () {
     ON hub_analytics_facts(account_id, kind, occurred_at DESC, event_id DESC)`;
 });
 //#endregion
+//#region src/hub/Migrations/023_TaskChangeLog.ts
+/**
+* One row per task that has ever existed, stamped with the order of its last
+* change, so a server can ask for "everything since cursor N" instead of the
+* whole board every poll.
+*
+* The sequence is the hub's, not `updated_at`: that timestamp is written by
+* whichever machine made the edit, and a machine with a slow clock would land
+* behind a cursor that already moved past it. `AUTOINCREMENT` never reuses a
+* value, and SQLite serializes writers, so a reader never sees N+1 before N.
+*
+* Triggers rather than repository code, because the hub shares
+* `TaskRepository` with every environment server and only the hub needs this.
+* A delete keeps its row with `deleted = 1`, which is how another machine
+* learns the task is gone. The triggers delete then insert rather than
+* `INSERT OR REPLACE`, because the repository writes with an upsert and its
+* conflict policy overrides the trigger's, failing the whole write.
+*/
+var _023_TaskChangeLog_default = Effect.gen(function* () {
+	const sql = yield* SqlClient.SqlClient;
+	yield* sql`
+    CREATE TABLE task_change_log (
+      seq INTEGER PRIMARY KEY AUTOINCREMENT,
+      task_id TEXT NOT NULL UNIQUE,
+      deleted INTEGER NOT NULL DEFAULT 0
+    )
+  `;
+	yield* sql`
+    INSERT INTO task_change_log (task_id)
+    SELECT task_id FROM tasks ORDER BY updated_at, task_id
+  `;
+	yield* sql`
+    CREATE TRIGGER task_change_log_insert AFTER INSERT ON tasks BEGIN
+      DELETE FROM task_change_log WHERE task_id = NEW.task_id;
+      INSERT INTO task_change_log (task_id, deleted) VALUES (NEW.task_id, 0);
+    END
+  `;
+	yield* sql`
+    CREATE TRIGGER task_change_log_update AFTER UPDATE ON tasks BEGIN
+      DELETE FROM task_change_log WHERE task_id = NEW.task_id;
+      INSERT INTO task_change_log (task_id, deleted) VALUES (NEW.task_id, 0);
+    END
+  `;
+	yield* sql`
+    CREATE TRIGGER task_change_log_delete AFTER DELETE ON tasks BEGIN
+      DELETE FROM task_change_log WHERE task_id = OLD.task_id;
+      INSERT INTO task_change_log (task_id, deleted) VALUES (OLD.task_id, 1);
+    END
+  `;
+});
+//#endregion
 //#region src/hub/Migrations.ts
 /**
 * Hub migrations.
@@ -29909,6 +30407,11 @@ const hubMigrationEntries = [
 		22,
 		"AnalyticsFacts",
 		_022_AnalyticsFacts_default
+	],
+	[
+		23,
+		"TaskChangeLog",
+		_023_TaskChangeLog_default
 	]
 ];
 const hubMigrationLoader = Migrator.fromRecord(Object.fromEntries(hubMigrationEntries.map(([id, name, migration]) => [`${id}_${name}`, migration])));
@@ -30000,7 +30503,7 @@ const announce = Layer.effectDiscard(Effect.gen(function* () {
 	});
 	if (isRemoteReachableHost(config.host)) yield* Effect.logWarning("Hub is reachable beyond loopback. The bearer token is the only control — repeated auth failures are not rate limited.", { host: config.host });
 }));
-const makeHubLayer = HttpRouter.serve(Layer.mergeAll(layer$95, layer$107, layer$109)).pipe(Layer.provideMerge(routingServices), Layer.provideMerge(layer$105), Layer.provideMerge(layer$106), Layer.provideMerge(layer$104), Layer.provideMerge(announce), Layer.provideMerge(HubHttpServerLive), Layer.provideMerge(layer$115), Layer.provideMerge(TaskRepositoryLive), Layer.provideMerge(AgentAssetRepositoryLive), Layer.provideMerge(HubPersistenceLive));
+const makeHubLayer = HttpRouter.serve(Layer.mergeAll(layer$94, layer$107, layer$109).pipe(Layer.provide(httpCompressionLayer))).pipe(Layer.provideMerge(typeof Bun !== "undefined" ? layerBun : layerNode), Layer.provideMerge(routingServices), Layer.provideMerge(layer$105), Layer.provideMerge(layer$106), Layer.provideMerge(layer$104), Layer.provideMerge(announce), Layer.provideMerge(HubHttpServerLive), Layer.provideMerge(layer$115), Layer.provideMerge(TaskRepositoryLive), Layer.provideMerge(AgentAssetRepositoryLive), Layer.provideMerge(HubPersistenceLive));
 const runHub = Layer.launch(makeHubLayer);
 //#endregion
 //#region src/atomicWrite.ts
@@ -30157,7 +30660,7 @@ function stripDefaultServerSettings(current, defaults) {
 	}
 	return Object.is(current, defaults) ? void 0 : current;
 }
-const make$113 = Effect.gen(function* () {
+const make$112 = Effect.gen(function* () {
 	const { settingsPath } = yield* ServerConfig$1;
 	const fs = yield* FileSystem.FileSystem;
 	const pathService = yield* Path$1.Path;
@@ -30380,7 +30883,7 @@ const make$113 = Effect.gen(function* () {
 		}
 	};
 });
-const layer$94 = Layer.effect(ServerSettingsService, make$113);
+const layer$93 = Layer.effect(ServerSettingsService, make$112);
 //#endregion
 //#region src/provider/skillWorkspace.ts
 /** Ancestors inside the nearest Git checkout, ordered from root to cwd. */
@@ -31124,7 +31627,7 @@ function entriesOf(config) {
 	return found;
 }
 var ClaudeMcpFiles = class extends Context.Service()("@p4code/cli/mcp/ClaudeMcpFiles") {};
-const make$112 = Effect.gen(function* () {
+const make$111 = Effect.gen(function* () {
 	const fileSystem = yield* FileSystem.FileSystem;
 	const path = yield* Path$1.Path;
 	const services = yield* Effect.context();
@@ -31195,7 +31698,7 @@ const make$112 = Effect.gen(function* () {
 		removeProject: (projectDir, name) => removeAt(Effect.succeed(projectFile(projectDir)))(name)
 	};
 });
-const layer$93 = Layer.effect(ClaudeMcpFiles, make$112);
+const layer$92 = Layer.effect(ClaudeMcpFiles, make$111);
 Layer.succeed(ClaudeMcpFiles, {
 	readUser: Effect.succeed([]),
 	readUserStrict: Effect.succeed([]),
@@ -31369,7 +31872,7 @@ const decodeClientRegistration = Schema$1.decodeUnknownExit(ClientRegistrationRe
 const decodeTokenResponse = Schema$1.decodeUnknownExit(TokenResponse);
 var McpOAuth = class extends Context.Service()("@p4code/cli/mcp/McpOAuth") {};
 const registryError = (detail) => new McpRegistryError({ detail });
-const make$111 = Effect.gen(function* () {
+const make$110 = Effect.gen(function* () {
 	const config = yield* ServerConfig$1;
 	const secrets = yield* ServerSecretStore;
 	const http = yield* HttpClient.HttpClient;
@@ -31774,7 +32277,7 @@ const make$111 = Effect.gen(function* () {
 		grantIdentityFor
 	};
 });
-const layer$92 = Layer.effect(McpOAuth, make$111);
+const layer$91 = Layer.effect(McpOAuth, make$110);
 Layer.succeed(McpOAuth, {
 	statusFor: () => Effect.succeed(Option.none()),
 	begin: () => Effect.fail(new McpRegistryError({ detail: "OAuth sign-in is not available." })),
@@ -31829,7 +32332,7 @@ const slotsOf = (registration) => registration.secrets ?? [];
 */
 const OMITTED_FOR_SIGN_IN = "mcp server omitted: sign-in required";
 const SIGN_IN_ACTION = "Connect it in Settings > MCP servers.";
-const make$110 = Effect.gen(function* () {
+const make$109 = Effect.gen(function* () {
 	const config = yield* ServerConfig$1;
 	const secrets = yield* ServerSecretStore;
 	const oauth = yield* McpOAuth;
@@ -32109,7 +32612,7 @@ const make$110 = Effect.gen(function* () {
 		resolveForSessionAtClaudeUserConfigPath
 	};
 });
-const layer$91 = Layer.effect(McpRegistry, make$110);
+const layer$90 = Layer.effect(McpRegistry, make$109);
 //#endregion
 //#region src/sync/skillDirectory.ts
 /**
@@ -32393,176 +32896,6 @@ const removeAgentDefinition = Effect.fn("agentDefinitionFiles.remove")(function*
 	yield* fileSystem.remove(path.join(input.agentsRoot, input.name), { force: true });
 });
 //#endregion
-//#region src/sync/HubLink.ts
-/**
-* Where this server's hub is, what it authenticates with, and whether it syncs
-* on its own.
-*
-* Absent by default. A server with no hub configured runs exactly as it does
-* today — the sync is skipped rather than failing, because "no hub" is a
-* complete and normal configuration, not a broken one.
-*
-* The record lives in `ServerSecretStore`, which already writes with
-* restrictive permissions, rather than in the settings file or the database.
-* The sync mode rides along in that record even though it is not a secret:
-* connect, disconnect and pause are then one write and one read, and the
-* settings panel reads one thing instead of joining two. Environment variables
-* override the link so a container or a service unit can be configured without
-* a first-run interactive step — the same trade the hub process itself makes
-* with `P4CODE_HUB_TOKEN_HASHES` — while the mode always comes from the stored
-* record, so a server configured by environment can still be paused.
-*
-* Mutable, deliberately. Resolving this once at layer construction would mean
-* connecting to a hub did nothing until the server restarted, which is a
-* miserable thing to discover after typing a token into a form.
-*
-* @module sync/HubLink
-*/
-/** Secret name holding the hub record as JSON. */
-const HUB_LINK_SECRET_NAME = "hub-link";
-var HubLink = class extends Context.Service()("@p4code/cli/sync/HubLink") {};
-/** The submitted URL or token could not make a usable link. */
-var InvalidHubLink = class extends Schema$1.TaggedErrorClass()("InvalidHubLink", { detail: Schema$1.String }) {
-	get message() {
-		return this.detail;
-	}
-};
-const trimTrailingSlash = (value) => value.replace(/\/+$/u, "");
-/**
-* Both halves must be present and the URL parseable. A half-configured link is
-* treated as no link at all, because a server that thinks it has a hub and
-* cannot form a request would report every sync as a failure rather than as the
-* "not configured" it actually is.
-*/
-const validateHubLink = (rawBaseUrl, rawToken) => {
-	const trimmed = trimTrailingSlash(rawBaseUrl.trim());
-	const token = rawToken.trim();
-	if (trimmed.length === 0 || token.length === 0) return Option.none();
-	const baseUrl = /^[a-z][a-z0-9+.-]*:\/\//iu.test(trimmed) ? trimmed : `https://${trimmed}`;
-	if (!URL.canParse(baseUrl)) return Option.none();
-	const parsed = new URL(baseUrl);
-	if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return Option.none();
-	return Option.some({
-		baseUrl,
-		token
-	});
-};
-const StoredHubLink = Schema$1.fromJsonString(Schema$1.Struct({
-	baseUrl: Schema$1.String,
-	token: Schema$1.String,
-	syncMode: Schema$1.optional(Schema$1.Literals(["auto", "paused"])),
-	shareMode: Schema$1.optional(Schema$1.Literals(["all", "selected"]))
-}));
-const decodeStoredHubLink = Schema$1.decodeUnknownExit(StoredHubLink);
-const encodeStoredHubLink = Schema$1.encodeSync(StoredHubLink);
-/**
-* Parse a stored record, tolerating anything that is not the shape we wrote.
-*
-* A corrupt secret disables the sync rather than failing the server's start.
-* Losing sync is recoverable by reconnecting; refusing to boot over it is not
-* proportionate to what has gone wrong.
-*/
-const parseHubLink = (raw) => {
-	const decoded = decodeStoredHubLink(raw);
-	if (decoded._tag !== "Success") return {
-		settings: Option.none(),
-		syncMode: "auto",
-		shareMode: "all"
-	};
-	return {
-		settings: validateHubLink(decoded.value.baseUrl, decoded.value.token),
-		syncMode: decoded.value.syncMode ?? "auto",
-		shareMode: decoded.value.shareMode ?? "all"
-	};
-};
-const formatHubLink = (input) => encodeStoredHubLink({
-	baseUrl: Option.match(input.settings, {
-		onNone: () => "",
-		onSome: (settings) => trimTrailingSlash(settings.baseUrl)
-	}),
-	token: Option.match(input.settings, {
-		onNone: () => "",
-		onSome: (s) => s.token
-	}),
-	syncMode: input.syncMode,
-	shareMode: input.shareMode
-});
-const fromEnvironment = (environment) => validateHubLink(environment.P4CODE_HUB_URL ?? "", environment.P4CODE_HUB_TOKEN ?? "");
-const make$109 = Effect.fn("HubLink.make")(function* (environment) {
-	const secrets = yield* ServerSecretStore;
-	const env = environment ?? process.env;
-	const fromEnv = fromEnvironment(env);
-	const readStored = Effect.fn("HubLink.readStored")(function* () {
-		const stored = yield* secrets.get(HUB_LINK_SECRET_NAME).pipe(Effect.orElseSucceed(() => Option.none()));
-		return Option.match(stored, {
-			onNone: () => ({
-				settings: Option.none(),
-				syncMode: "auto",
-				shareMode: "all"
-			}),
-			onSome: (bytes) => parseHubLink(new TextDecoder().decode(bytes))
-		});
-	});
-	const toState = (record) => Option.isSome(fromEnv) ? {
-		settings: fromEnv,
-		syncMode: record.syncMode,
-		shareMode: record.shareMode,
-		source: "environment"
-	} : {
-		settings: record.settings,
-		syncMode: record.syncMode,
-		shareMode: record.shareMode,
-		source: Option.isSome(record.settings) ? "stored" : "none"
-	};
-	const cache = yield* Ref.make(yield* readStored());
-	const updates = yield* PubSub.sliding({
-		capacity: 1,
-		replay: 1
-	});
-	yield* PubSub.publish(updates, toState(yield* Ref.get(cache)));
-	const persist = Effect.fn("HubLink.persist")(function* (record) {
-		yield* secrets.set(HUB_LINK_SECRET_NAME, new TextEncoder().encode(formatHubLink(record)));
-		yield* Ref.set(cache, record);
-		yield* PubSub.publish(updates, toState(record));
-		return toState(record);
-	});
-	return {
-		current: Ref.get(cache).pipe(Effect.map(toState)),
-		changes: Stream.fromPubSub(updates),
-		connect: (settings) => Effect.gen(function* () {
-			const validated = validateHubLink(settings.baseUrl, settings.token);
-			if (Option.isNone(validated)) return yield* new InvalidHubLink({ detail: "A hub needs an http or https URL and a non-empty token." });
-			const record = yield* Ref.get(cache);
-			return yield* persist({
-				...record,
-				settings: validated
-			});
-		}),
-		disconnect: Effect.gen(function* () {
-			const record = yield* Ref.get(cache);
-			return yield* persist({
-				...record,
-				settings: Option.none()
-			});
-		}),
-		setSyncMode: (mode) => Effect.gen(function* () {
-			const record = yield* Ref.get(cache);
-			return yield* persist({
-				...record,
-				syncMode: mode
-			});
-		}),
-		setShareMode: (mode) => Effect.gen(function* () {
-			const record = yield* Ref.get(cache);
-			return yield* persist({
-				...record,
-				shareMode: mode
-			});
-		})
-	};
-});
-const layer$90 = Layer.effect(HubLink, make$109());
-//#endregion
 //#region src/sync/HubAssetClient.ts
 /**
 * The server's half of the hub's asset API.
@@ -32576,7 +32909,7 @@ const layer$90 = Layer.effect(HubLink, make$109());
 *
 * @module sync/HubAssetClient
 */
-const HUB_REQUEST_TIMEOUT_MS$1 = 15e3;
+const HUB_REQUEST_TIMEOUT_MS = 15e3;
 /**
 * The hub could not be reached, or answered something unusable.
 *
@@ -32589,9 +32922,9 @@ var HubAssetConflict = class extends Data.TaggedError("HubAssetConflict") {};
 /** No hub is configured on this server, so there is nothing to talk to. */
 var HubNotConfigured = class extends Data.TaggedError("HubNotConfigured") {};
 const AssetListPage = Schema$1.Struct({ assets: Schema$1.Array(AgentAsset) });
-const ConflictBody$1 = Schema$1.Struct({ current: Schema$1.NullOr(AgentAsset) });
+const ConflictBody = Schema$1.Struct({ current: Schema$1.NullOr(AgentAsset) });
 const decodeAssetListPage = Schema$1.decodeUnknownEffect(AssetListPage);
-const decodeConflictBody$1 = Schema$1.decodeUnknownEffect(ConflictBody$1);
+const decodeConflictBody = Schema$1.decodeUnknownEffect(ConflictBody);
 const decodeAsset = Schema$1.decodeUnknownEffect(AgentAsset);
 var HubAssetClient = class extends Context.Service()("@p4code/cli/sync/HubAssetClient") {};
 const make$108 = Effect.gen(function* () {
@@ -32603,7 +32936,7 @@ const make$108 = Effect.gen(function* () {
 		return state.settings.value;
 	});
 	const send = Effect.fn("HubAssetClient.send")(function* (operation, settings, request) {
-		return yield* http.execute(request.pipe(HttpClientRequest.setHeader("authorization", `Bearer ${settings.token}`), HttpClientRequest.setHeader("accept", "application/json"))).pipe(Effect.timeout(HUB_REQUEST_TIMEOUT_MS$1), Effect.mapError((cause) => new HubUnavailable({
+		return yield* http.execute(request.pipe(HttpClientRequest.setHeader("authorization", `Bearer ${settings.token}`), HttpClientRequest.setHeader("accept", "application/json"))).pipe(Effect.timeout(HUB_REQUEST_TIMEOUT_MS), Effect.mapError((cause) => new HubUnavailable({
 			operation,
 			detail: `${cause._tag ?? "error"}`
 		})));
@@ -32623,7 +32956,7 @@ const make$108 = Effect.gen(function* () {
 	* which is what lets a caller show both sides instead of only saying no.
 	*/
 	const conflictFrom = Effect.fn("HubAssetClient.conflictFrom")(function* (name, response) {
-		const body = yield* decodeBody("conflict", decodeConflictBody$1, response).pipe(Effect.orElseSucceed(() => ({ current: null })));
+		const body = yield* decodeBody("conflict", decodeConflictBody, response).pipe(Effect.orElseSucceed(() => ({ current: null })));
 		return new HubAssetConflict({
 			name,
 			current: body.current === null ? Option.none() : Option.some(body.current)
@@ -34849,7 +35182,7 @@ const findAgentPreset = (requested) => {
 };
 //#endregion
 //#region src/cli/assets.ts
-const SyncServicesLive = layer$88.pipe(Layer.provideMerge(layer$89), Layer.provideMerge(layer$90), Layer.provideMerge(layer$94.pipe(Layer.provide(layer$120))), Layer.provideMerge(layer$120), Layer.provideMerge(FetchHttpClient.layer));
+const SyncServicesLive = layer$88.pipe(Layer.provideMerge(layer$89), Layer.provideMerge(layer$95), Layer.provideMerge(layer$93.pipe(Layer.provide(layer$120))), Layer.provideMerge(layer$120), Layer.provideMerge(FetchHttpClient.layer));
 const runWithSync = (flags, run) => Effect.gen(function* () {
 	const config = yield* resolveCliAuthConfig(flags, yield* GlobalFlag.LogLevel);
 	return yield* Effect.gen(function* () {
@@ -58879,18 +59212,6 @@ const acceptBunDeviceSocket = Effect.fn("DeviceHubBunSocket.accept")(function* (
 	}))), MAX_DEVICE_INPUT_BYTES, MAX_DEVICE_OUTPUT_BYTES);
 });
 //#endregion
-//#region src/httpCompression/HttpResponseCompression.ts
-var HttpResponseCompression = class extends Context.Service()("@p4code/cli/httpCompression/HttpResponseCompression") {};
-const layerNode = Layer.effect(HttpResponseCompression, Effect.gen(function* () {
-	const NodeZlib = yield* Effect.promise(() => import("node:zlib"));
-	return { gzip: (body, options) => {
-		const stream = NodeZlib.createGzip();
-		stream.end(body);
-		return HttpServerResponse$1.raw(stream, options);
-	} };
-}));
-const layerBun = Layer.succeed(HttpResponseCompression, { gzip: (body, options) => HttpServerResponse$1.raw(new Response(body).body.pipeThrough(new CompressionStream("gzip")), options) });
-//#endregion
 //#region ../../packages/shared/src/devProxy.ts
 /**
 * Backend paths the web dev server proxies in single-origin browser dev.
@@ -60562,7 +60883,6 @@ const LOOPBACK_HOSTNAMES = /* @__PURE__ */ new Set([
 	"localhost"
 ]);
 const DESKTOP_RENDERER_ORIGINS = ["p4code://app", "p4code-dev://app"];
-const GZIP_MIN_BYTES = 1024;
 const SVG_CONTENT_SECURITY_POLICY = "default-src 'none'; style-src 'unsafe-inline'; sandbox";
 function assetResponseHeaders(filePath) {
 	return {
@@ -60571,36 +60891,6 @@ function assetResponseHeaders(filePath) {
 		...filePath.toLowerCase().endsWith(".svg") ? { "Content-Security-Policy": SVG_CONTENT_SECURITY_POLICY } : {}
 	};
 }
-function acceptsGzip(value) {
-	if (!value) return false;
-	const accepted = new Map(value.split(",").map((entry) => {
-		const [coding = "", ...parameters] = entry.trim().toLowerCase().split(";");
-		const quality = parameters.map((parameter) => parameter.trim().match(/^q=(.+)$/)?.[1]).find((parameter) => parameter !== void 0);
-		return [coding, quality === void 0 ? 1 : Number(quality)];
-	}));
-	return (accepted.get("gzip") ?? accepted.get("*") ?? 0) > 0;
-}
-function varyByAcceptEncoding(value) {
-	if (!value) return "Accept-Encoding";
-	const values = new Set(value.split(",").map((entry) => entry.trim().toLowerCase()));
-	return values.has("*") || values.has("accept-encoding") ? value : `${value}, Accept-Encoding`;
-}
-const compressHttpResponse = Effect.fnUntraced(function* (response, acceptEncoding) {
-	const body = response.body;
-	if (body._tag !== "Uint8Array" || body.contentLength < GZIP_MIN_BYTES || !body.contentType.startsWith("application/json") || response.headers["content-encoding"]) return response;
-	const variedResponse = HttpServerResponse.setHeader(response, "vary", varyByAcceptEncoding(response.headers.vary));
-	if (!acceptsGzip(acceptEncoding)) return variedResponse;
-	const compression = yield* HttpResponseCompression;
-	const headers = Headers$1.set(Headers$1.remove(variedResponse.headers, "content-length"), "content-encoding", "gzip");
-	return compression.gzip(body.body, {
-		status: response.status,
-		statusText: response.statusText,
-		headers,
-		cookies: response.cookies,
-		contentType: body.contentType
-	});
-});
-const httpCompressionLayer = HttpRouter.middleware((httpEffect) => Effect.flatMap(Effect.all([httpEffect, HttpServerRequest.HttpServerRequest]), ([response, request]) => compressHttpResponse(response, request.headers["accept-encoding"])), { global: true });
 const browserApiCorsLayer = Layer.unwrap(Effect.gen(function* () {
 	const config = yield* ServerConfig$1;
 	const devOrigin = config.devUrl?.origin;
@@ -109238,7 +109528,7 @@ const COMMON_DEV_PORTS = Object.freeze([
 	8888,
 	9e3
 ]);
-const POLL_INTERVAL$2 = Duration.seconds(3);
+const POLL_INTERVAL$3 = Duration.seconds(3);
 const LSOF_TIMEOUT_MS = 5e3;
 const WINDOWS_LISTENER_TIMEOUT_MS = 5e3;
 const terminalOwnerKey = (owner) => `${owner.threadId}\u0000${owner.terminalId}`;
@@ -109413,7 +109703,7 @@ const make$61 = Effect.gen(function* PortDiscoveryMake() {
 			lastSnapshot: next
 		}])) yield* broadcast(next);
 	}, Effect.catchCause((cause) => Effect.logWarning("preview port scan failed", Cause.pretty(cause))));
-	yield* Effect.forkScoped(pollTick().pipe(Effect.repeat(Schedule.spaced(POLL_INTERVAL$2))));
+	yield* Effect.forkScoped(pollTick().pipe(Effect.repeat(Schedule.spaced(POLL_INTERVAL$3))));
 	const acquireRetention = Effect.fn("PortDiscovery.retain")(function* () {
 		if (yield* Ref.modify(stateRef, (state) => [state.retainCount === 0, {
 			...state,
@@ -124922,7 +125212,7 @@ const LINEAR_ISSUE_FIELDS = [
 * a Linear workspace is edited by people at human speed rather than by agents
 * at machine speed.
 */
-const POLL_INTERVAL$1 = Duration.seconds(30);
+const POLL_INTERVAL$2 = Duration.seconds(30);
 /** Linear's cap on one page. Asking for more is an error, not a bigger page. */
 const LINEAR_PAGE_LIMIT = 250;
 const LINEAR_LIST_TOOL = "list_issues";
@@ -125175,7 +125465,7 @@ const makeLinearTaskRepository = Effect.gen(function* () {
 			taskId
 		});
 	}).pipe(Effect.ignoreCause({ log: true }));
-	yield* Effect.forever(pollOnce.pipe(Effect.andThen(Effect.sleep(POLL_INTERVAL$1)))).pipe(Effect.forkScoped);
+	yield* Effect.forever(pollOnce.pipe(Effect.andThen(Effect.sleep(POLL_INTERVAL$2)))).pipe(Effect.forkScoped);
 	return {
 		create,
 		upsert,
@@ -125199,127 +125489,6 @@ const makeLinearTaskRepository = Effect.gen(function* () {
 	};
 });
 //#endregion
-//#region src/persistence/Layers/RemoteTasks.ts
-/**
-* The hub's task API, as a client.
-*
-* This used to be a `TaskRepository` in its own right, and the board was
-* either this or the local database. It is now the transport underneath
-* `SyncedTaskRepository`: local SQLite is a replica of the hub, so nothing
-* reads from here directly and the board no longer goes dark when the hub is
-* unreachable. What changed with it is the failure story — an unreachable hub
-* used to mean no board, and now means a board that is behind.
-*
-* The four calls here are what a mirror needs and no more: read the hub's
-* rows, push a whole row, arbitrate a claim, and delete. There is no partial
-* patch, because a mirror always holds the full row it wants the hub to have
-* and sending a diff of it would only add a way for the two to disagree.
-*
-* @module persistence/Layers/RemoteTasks
-*/
-const HUB_REQUEST_TIMEOUT_MS = 15e3;
-const TaskListPage = Schema$1.Struct({ tasks: Schema$1.Array(Task) });
-const ConflictBody = Schema$1.Struct({ current: Task });
-const decodeTaskListPage = Schema$1.decodeUnknownEffect(TaskListPage);
-const decodeTask = Schema$1.decodeUnknownEffect(Task);
-const decodeConflictBody = Schema$1.decodeUnknownEffect(ConflictBody);
-/**
-* Every failure here is reported as the persistence error type.
-*
-* The mirror catches these and carries on — a failed push leaves the row
-* `pending` and the next pass retries it — so what matters is that the detail
-* says the hub was the store that would not answer, which is what shows up in
-* the log when someone asks why their two machines disagree.
-*/
-const hubUnavailable = (operation, detail) => new PersistenceSqlError({
-	operation: `HubTaskClient.${operation}`,
-	detail: `The hub board is unavailable: ${detail}`,
-	cause: null
-});
-var HubTaskClient = class extends Context.Service()("@p4code/cli/persistence/Layers/RemoteTasks/HubTaskClient") {};
-const makeHubTaskClient = Effect.gen(function* () {
-	const http = yield* HttpClient.HttpClient;
-	const link = yield* HubLink;
-	const isLinked = link.current.pipe(Effect.map((state) => Option.isSome(state.settings)));
-	const requireSettings = (operation) => Effect.gen(function* () {
-		const state = yield* link.current;
-		if (Option.isNone(state.settings)) return yield* hubUnavailable(operation, "no hub is configured on this server");
-		return state.settings.value;
-	});
-	const send = (operation, settings, request) => http.execute(request.pipe(HttpClientRequest.setHeader("authorization", `Bearer ${settings.token}`), HttpClientRequest.setHeader("accept", "application/json"))).pipe(Effect.timeout(HUB_REQUEST_TIMEOUT_MS), Effect.mapError((cause) => hubUnavailable(operation, `${cause._tag ?? "request failed"}`)));
-	const list = (filter) => Effect.gen(function* () {
-		const settings = yield* requireSettings("list");
-		const query = new URLSearchParams();
-		for (const key of [
-			"projectId",
-			"repositoryKey",
-			"threadId",
-			"status",
-			"assignee",
-			"query"
-		]) {
-			const value = filter[key];
-			if (value !== void 0) query.set(key, value);
-		}
-		const suffix = query.size === 0 ? "" : `?${query.toString()}`;
-		const response = yield* send("list", settings, HttpClientRequest.get(`${settings.baseUrl}/tasks${suffix}`));
-		if (response.status !== 200) return yield* hubUnavailable("list", `status ${response.status}`);
-		return (yield* response.json.pipe(Effect.flatMap(decodeTaskListPage), Effect.mapError(() => hubUnavailable("list", "the response did not match the contract")))).tasks;
-	});
-	const put = (row, readableIdPrefix) => Effect.gen(function* () {
-		const settings = yield* requireSettings("put");
-		const response = yield* send("put", settings, HttpClientRequest.bodyJsonUnsafe(HttpClientRequest.put(`${settings.baseUrl}/tasks/${encodeURIComponent(row.taskId)}`), {
-			projectId: row.projectId,
-			repositoryKey: row.repositoryKey,
-			threadId: row.threadId,
-			parentTaskId: row.parentTaskId,
-			title: row.title,
-			body: row.body,
-			status: row.status,
-			priority: row.priority,
-			assignee: row.assignee,
-			labels: row.labels,
-			orderKey: row.orderKey,
-			createdAt: row.createdAt,
-			statusChangedAt: row.statusChangedAt ?? row.updatedAt,
-			readableIdPrefix
-		}));
-		if (response.status !== 200 && response.status !== 201) return yield* hubUnavailable("put", `status ${response.status}`);
-		return yield* response.json.pipe(Effect.flatMap(decodeTask), Effect.mapError(() => hubUnavailable("put", "the response did not match the contract")));
-	});
-	const patchIfStatus = (input) => Effect.gen(function* () {
-		const settings = yield* requireSettings("patchIfStatus");
-		const { taskId, ...fields } = input.patch;
-		const response = yield* send("patchIfStatus", settings, HttpClientRequest.bodyJsonUnsafe(HttpClientRequest.patch(`${settings.baseUrl}/tasks/${encodeURIComponent(taskId)}`), {
-			...fields,
-			expectedStatus: input.expectedStatus
-		}));
-		if (response.status === 404) return { outcome: "missing" };
-		if (response.status === 409) return {
-			outcome: "conflict",
-			current: (yield* response.json.pipe(Effect.flatMap(decodeConflictBody), Effect.mapError(() => hubUnavailable("patchIfStatus", "the conflict response did not match the contract")))).current
-		};
-		if (response.status !== 200) return yield* hubUnavailable("patchIfStatus", `status ${response.status}`);
-		return {
-			outcome: "updated",
-			task: yield* response.json.pipe(Effect.flatMap(decodeTask), Effect.mapError(() => hubUnavailable("patchIfStatus", "the response did not match the contract")))
-		};
-	});
-	const remove = (taskId) => Effect.gen(function* () {
-		const settings = yield* requireSettings("remove");
-		const response = yield* send("remove", settings, HttpClientRequest.delete(`${settings.baseUrl}/tasks/${encodeURIComponent(taskId)}`));
-		if (response.status !== 200 && response.status !== 204 && response.status !== 404) return yield* hubUnavailable("remove", `status ${response.status}`);
-	});
-	return {
-		isLinked,
-		list,
-		put,
-		patchIfStatus,
-		remove
-	};
-});
-Layer.effect(HubTaskClient, makeHubTaskClient);
-//#endregion
 //#region src/persistence/Layers/TaskSyncStore.ts
 /**
 * The bookkeeping a mirror needs and a board does not.
@@ -125516,14 +125685,17 @@ const makeTaskSyncStore = Effect.gen(function* () {
 * @module persistence/Layers/SyncedTasks
 */
 /**
-* How stale another machine's write may look here.
+* How stale another machine's write may look here when the hub cannot push.
 *
-* Short enough that a board left open follows along, long enough that two
-* servers idling all day are not a steady stream of requests at a hosted
-* service. Only changes made elsewhere wait for it; a write made here is
-* already on screen.
+* With the hub's change stream connected, a write elsewhere triggers a pull
+* right away and the timer is only a safety net, so it can be slow. Without
+* it (an older hub, or the stream is reconnecting) the timer is the only
+* signal, and a board left open should still follow along.
 */
-const SYNC_INTERVAL = Duration.seconds(10);
+const POLL_INTERVAL$1 = Duration.seconds(10);
+const PUSHED_POLL_INTERVAL = Duration.minutes(5);
+/** Between change-stream attempts, so an older hub's 404 is not hammered. */
+const WATCH_RETRY_DELAY = Duration.seconds(30);
 const makeSyncedTaskRepository = Effect.gen(function* () {
 	const local = yield* makeTaskRepository;
 	const sync = yield* makeTaskSyncStore;
@@ -125610,6 +125782,11 @@ const makeSyncedTaskRepository = Effect.gen(function* () {
 	* that was just removed; a pull run before either would see this machine's
 	* own stale absence as the hub's opinion and undo local work.
 	*/
+	/**
+	* Where the last applied pull left off. Held in memory only: a restart pulls
+	* the whole board once, then follows changes again.
+	*/
+	let position;
 	const syncOnce = Effect.gen(function* () {
 		if (!(yield* hub.isLinked)) return;
 		for (const taskId of yield* sync.listTombstones) yield* hub.remove(taskId).pipe(Effect.andThen(sync.clearTombstone(taskId)), Effect.ignoreCause({ log: true }));
@@ -125617,21 +125794,36 @@ const makeSyncedTaskRepository = Effect.gen(function* () {
 			const { readableIdPrefix, ...task } = row;
 			yield* pushInBackground(task, readableIdPrefix ?? "T");
 		}
-		const remote = yield* hub.list({});
+		const pulled = yield* hub.pull(position);
+		if (Option.isNone(pulled)) return;
+		const page = pulled.value;
 		const stillPending = new Set((yield* sync.listPending).map((row) => row.taskId));
 		const tombstoned = new Set(yield* sync.listTombstones);
 		const syncedIds = yield* sync.listSyncedIds;
 		const held = new Map((yield* local.list({})).map((task) => [task.taskId, task]));
 		const seen = /* @__PURE__ */ new Set();
-		for (const task of remote) {
+		for (const task of page.tasks) {
 			seen.add(task.taskId);
 			if (stillPending.has(task.taskId) || tombstoned.has(task.taskId)) continue;
 			const current = held.get(task.taskId);
 			if (current === void 0 || current.updatedAt !== task.updatedAt) yield* adopt(task);
 		}
-		for (const taskId of syncedIds) if (!seen.has(taskId)) yield* local.deleteById({ taskId });
+		const gone = page.full ? syncedIds.filter((taskId) => !seen.has(taskId)) : page.deletedTaskIds.filter((taskId) => syncedIds.includes(taskId));
+		for (const taskId of gone) yield* local.deleteById({ taskId });
+		position = page.next;
 	}).pipe(Effect.ignoreCause({ log: true }));
-	yield* Effect.forever(syncOnce.pipe(Effect.andThen(Effect.sleep(SYNC_INTERVAL)))).pipe(Effect.forkScoped);
+	const nudges = yield* Queue.sliding(1);
+	let watching = false;
+	yield* hub.watch.pipe(Stream.runForEach(() => Effect.sync(() => {
+		watching = true;
+	}).pipe(Effect.andThen(Queue.offer(nudges, void 0)))), Effect.ignoreCause({ log: "Debug" }), Effect.andThen(Effect.sync(() => {
+		watching = false;
+	}).pipe(Effect.andThen(Queue.offer(nudges, void 0)))), Effect.andThen(Effect.sleep(WATCH_RETRY_DELAY)), Effect.forever, Effect.forkScoped);
+	const nextPass = Effect.gen(function* () {
+		const owed = (yield* sync.listPending).length > 0 || (yield* sync.listTombstones).length > 0;
+		return yield* Queue.take(nudges).pipe(Effect.timeoutOption(watching && !owed ? PUSHED_POLL_INTERVAL : POLL_INTERVAL$1));
+	}).pipe(Effect.catch(() => Effect.sleep(POLL_INTERVAL$1)));
+	yield* Effect.forever(syncOnce.pipe(Effect.andThen(nextPass))).pipe(Effect.forkScoped);
 	return {
 		create,
 		upsert,
@@ -148286,8 +148478,8 @@ const WorkspaceLayerLive = Layer.mergeAll(layer$71, WorkspaceEntriesLayerLive, W
 const ProjectFaviconResolverLayerLive = layer$66.pipe(Layer.provide(layer$71), Layer.provide(layer$67));
 const AuthLayerLive = layer$116.pipe(Layer.provideMerge(PersistenceLayerLive), Layer.provide(layer$120));
 const ProviderRuntimeLayerLive = Layer.mergeAll(ProviderSessionReaperLive, ProviderHealthRefresherLive).pipe(Layer.provideMerge(ProviderLayerLive), Layer.provideMerge(OrchestrationLayerLive));
-const RuntimeCoreDependenciesLive = ReactorLayerLive.pipe(Layer.provideMerge(layer$28), Layer.provideMerge(Layer.mergeAll(PullRequestServiceLive, CheckpointingLayerLive, SourceControlProviderRegistryLayerLive)), Layer.provideMerge(GitLayerLive), Layer.provideMerge(VcsLayerLive), Layer.provideMerge(ProviderAuthServiceLive), Layer.provideMerge(ProviderRuntimeLayerLive), Layer.provideMerge(Layer.mergeAll(TerminalLayerLive, PreviewLayerLive, RoutedTaskRepositoryLive)), Layer.provideMerge(Layer.mergeAll(PersistenceLayerLive, layer$90)), Layer.provideMerge(layer$84), Layer.provideMerge(ProviderRegistryLive), Layer.provideMerge(layer$61), Layer.provideMerge(Layer.mergeAll(layer$60, layer$73.pipe(Layer.provide(layer$86)), layer$75, layer$70)), Layer.provideMerge(layer$55), Layer.provideMerge(layer$56), Layer.provideMerge(layer$57), Layer.provideMerge(layer$58), Layer.provideMerge(layer$59)).pipe(Layer.provideMerge(ProviderInstanceRegistryHydrationLive), Layer.provideMerge(AntigravityInstallation.layer), Layer.provideMerge(ProviderEventLoggersLive), Layer.provideMerge(OpenCodeRuntimeLive), Layer.provideMerge(layer$63), Layer.provideMerge(JevWorkspaceAdvisorLive.pipe(Layer.provide(TypeSafeClientLive))), Layer.provideMerge(layer$94.pipe(Layer.provide(layer$120))), Layer.provideMerge(SupervisorSecretsLive.pipe(Layer.provide(layer$120))), Layer.provideMerge(WorkspaceLayerLive), Layer.provideMerge(ProjectFaviconResolverLayerLive), Layer.provideMerge(layer$85), Layer.provideMerge(layer$69), Layer.provideMerge(remoteComputerUseBindingsLayer.pipe(Layer.provide(layer$90))), Layer.provideMerge(layer$78), Layer.provideMerge(AuthLayerLive), Layer.provideMerge(layer$5.pipe(Layer.provideMerge(LinearClientLive), Layer.provideMerge(Layer.mergeAll(LinearMcpClientLive, TrackerSecretsLive)), Layer.provideMerge(Layer.mergeAll(layer$91, layer$21).pipe(Layer.provideMerge(layer$92), Layer.provideMerge(layer$93))))), Layer.provideMerge(layer$120));
-const UsageLayerLive = layer$25.pipe(Layer.provide(layer$94.pipe(Layer.provide(layer$120))));
+const RuntimeCoreDependenciesLive = ReactorLayerLive.pipe(Layer.provideMerge(layer$28), Layer.provideMerge(Layer.mergeAll(PullRequestServiceLive, CheckpointingLayerLive, SourceControlProviderRegistryLayerLive)), Layer.provideMerge(GitLayerLive), Layer.provideMerge(VcsLayerLive), Layer.provideMerge(ProviderAuthServiceLive), Layer.provideMerge(ProviderRuntimeLayerLive), Layer.provideMerge(Layer.mergeAll(TerminalLayerLive, PreviewLayerLive, RoutedTaskRepositoryLive)), Layer.provideMerge(Layer.mergeAll(PersistenceLayerLive, layer$95)), Layer.provideMerge(layer$84), Layer.provideMerge(ProviderRegistryLive), Layer.provideMerge(layer$61), Layer.provideMerge(Layer.mergeAll(layer$60, layer$73.pipe(Layer.provide(layer$86)), layer$75, layer$70)), Layer.provideMerge(layer$55), Layer.provideMerge(layer$56), Layer.provideMerge(layer$57), Layer.provideMerge(layer$58), Layer.provideMerge(layer$59)).pipe(Layer.provideMerge(ProviderInstanceRegistryHydrationLive), Layer.provideMerge(AntigravityInstallation.layer), Layer.provideMerge(ProviderEventLoggersLive), Layer.provideMerge(OpenCodeRuntimeLive), Layer.provideMerge(layer$63), Layer.provideMerge(JevWorkspaceAdvisorLive.pipe(Layer.provide(TypeSafeClientLive))), Layer.provideMerge(layer$93.pipe(Layer.provide(layer$120))), Layer.provideMerge(SupervisorSecretsLive.pipe(Layer.provide(layer$120))), Layer.provideMerge(WorkspaceLayerLive), Layer.provideMerge(ProjectFaviconResolverLayerLive), Layer.provideMerge(layer$85), Layer.provideMerge(layer$69), Layer.provideMerge(remoteComputerUseBindingsLayer.pipe(Layer.provide(layer$95))), Layer.provideMerge(layer$78), Layer.provideMerge(AuthLayerLive), Layer.provideMerge(layer$5.pipe(Layer.provideMerge(LinearClientLive), Layer.provideMerge(Layer.mergeAll(LinearMcpClientLive, TrackerSecretsLive)), Layer.provideMerge(Layer.mergeAll(layer$90, layer$21).pipe(Layer.provideMerge(layer$91), Layer.provideMerge(layer$92))))), Layer.provideMerge(layer$120));
+const UsageLayerLive = layer$25.pipe(Layer.provide(layer$93.pipe(Layer.provide(layer$120))));
 const RuntimeDependenciesLive = layer$24.pipe(Layer.provideMerge(RuntimeCoreDependenciesLive)).pipe(Layer.provideMerge(UsageLayerLive), Layer.provideMerge(layer$12), Layer.provideMerge(layer$11), Layer.provideMerge(layer$10), Layer.provideMerge(layer$81), Layer.provideMerge(layer$83), Layer.provideMerge(layer$82), Layer.provide(layer$124));
 /**
 * Hub asset sync.
@@ -148296,7 +148488,7 @@ const RuntimeDependenciesLive = layer$24.pipe(Layer.provideMerge(RuntimeCoreDepe
 * not-configured shape, and every call reports that rather than failing — so
 * this costs a server with no hub nothing but a layer.
 */
-const AssetSyncLive = layer$88.pipe(Layer.provideMerge(layer$77), Layer.provideMerge(layer$89), Layer.provideMerge(layer$90));
+const AssetSyncLive = layer$88.pipe(Layer.provideMerge(layer$77), Layer.provideMerge(layer$89), Layer.provideMerge(layer$95));
 const RuntimeServicesLive = layer$72.pipe(Layer.provideMerge(layer$1), Layer.provideMerge(AssetSyncLive), Layer.provideMerge(layer$23), Layer.provideMerge(layer$22.pipe(Layer.provide(layer$53), Layer.provide(ProviderSessionDirectoryLayerLive), Layer.provide(ProjectionProjectRepositoryLive))), Layer.provideMerge(RuntimeDependenciesLive));
 const makeRoutesLayer = Layer.mergeAll(Layer.mergeAll(HttpApiBuilder.layer(EnvironmentHttpApi).pipe(Layer.provide(authHttpApiLayer), Layer.provide(orchestrationHttpApiLayer), Layer.provide(pullRequestHttpApiLayer), Layer.provide(serverEnvironmentHttpApiLayer), Layer.provide(environmentAuthenticatedAuthLayer)), otlpTracesProxyRouteLayer, assetRouteLayer, mcpOAuthCallbackRouteLayer, staticAndDevRouteLayer, websocketRpcRouteLayer), layer$4.pipe(Layer.provide(layer$6)), layer$68, layer).pipe(Layer.provide(ProjectionProjectRepositoryLive.pipe(Layer.provide(PersistenceLayerLive))), Layer.provide(ProjectionThreadRepositoryLive.pipe(Layer.provide(PersistenceLayerLive))), Layer.provide(layer$67), Layer.provide(layer$28), Layer.provide(PullRequestServiceLive), Layer.provide(layer$20), Layer.provide(layer$79), Layer.provide(layer$26), Layer.provide(browserApiCorsLayer), Layer.provide(httpCompressionLayer));
 const makeServerLayer = Layer.unwrap(Effect.gen(function* () {