@query-farm/vgi-rpc 0.7.5 → 0.9.0

package/dist/index.js

@@ -734,130 +734,42 @@ var init_zstd = __esm(() => {
   isBun = typeof globalThis.Bun !== "undefined";
 });
 
-// src/access-log.ts
-var _NODE_FS_MOD = "node:fs";
-function _loadWriteSync() {
-  const req = import.meta.require ?? globalThis.require ?? null;
-  if (!req) {
-    throw new Error("FdSink requires Node.js or Bun (node:fs.writeSync). For other runtimes, " + "supply a custom AccessLogSink that wraps console.log or your logger.");
-  }
-  return req(_NODE_FS_MOD).writeSync;
-}
+// src/client/tcp.ts
+import { connect } from "node:net";
 
-class FdSink {
-  fd;
-  _writeSync = _loadWriteSync();
-  constructor(fd) {
-    this.fd = fd;
-  }
-  write(line) {
-    const buf = new TextEncoder().encode(line);
-    let offset = 0;
-    while (offset < buf.length) {
-      const n = this._writeSync(this.fd, buf, offset, buf.length - offset);
-      if (n <= 0)
-        throw new Error(`access-log writeSync returned ${n}`);
-      offset += n;
-    }
-  }
-}
-function rfc3339Utc() {
-  const d = new Date;
-  const yyyy = d.getUTCFullYear().toString().padStart(4, "0");
-  const mm = (d.getUTCMonth() + 1).toString().padStart(2, "0");
-  const dd = d.getUTCDate().toString().padStart(2, "0");
-  const hh = d.getUTCHours().toString().padStart(2, "0");
-  const mi = d.getUTCMinutes().toString().padStart(2, "0");
-  const ss = d.getUTCSeconds().toString().padStart(2, "0");
-  const ms = d.getUTCMilliseconds().toString().padStart(3, "0");
-  return `${yyyy}-${mm}-${dd}T${hh}:${mi}:${ss}.${ms}Z`;
-}
-function base64(bytes) {
-  return Buffer.from(bytes).toString("base64");
-}
-function roundTo2(f) {
-  return Math.round(f * 100) / 100;
-}
+// src/client/pipe.ts
+import {
+  Field,
+  makeData,
+  RecordBatch,
+  RecordBatchStreamWriter as RecordBatchStreamWriter2,
+  Schema,
+  Struct,
+  vectorFromArray
+} from "@query-farm/apache-arrow";
+
+// src/constants.ts
+var RPC_METHOD_KEY = "vgi_rpc.method";
+var LOG_LEVEL_KEY = "vgi_rpc.log_level";
+var LOG_MESSAGE_KEY = "vgi_rpc.log_message";
+var LOG_EXTRA_KEY = "vgi_rpc.log_extra";
+var REQUEST_VERSION_KEY = "vgi_rpc.request_version";
+var REQUEST_VERSION = "1";
+var SERVER_ID_KEY = "vgi_rpc.server_id";
+var REQUEST_ID_KEY = "vgi_rpc.request_id";
+var PROTOCOL_NAME_KEY = "vgi_rpc.protocol_name";
+var DESCRIBE_VERSION_KEY = "vgi_rpc.describe_version";
+var PROTOCOL_HASH_KEY = "vgi_rpc.protocol_hash";
+var DESCRIBE_VERSION = "4";
+var PROTOCOL_VERSION_KEY = "vgi_rpc.protocol_version";
+var DESCRIBE_METHOD_NAME = "__describe__";
+var STATE_KEY = "vgi_rpc.stream_state#b64";
+var CANCEL_KEY = "vgi_rpc.cancel";
+var LOCATION_KEY = "vgi_rpc.location";
+var LOCATION_SHA256_KEY = "vgi_rpc.location.sha256";
+var RPC_ERROR_HEADER = "X-VGI-RPC-Error";
+var ERROR_KIND_KEY = "vgi_rpc.error_kind";
 
-class AccessLogHook {
-  sink;
-  serverVersion;
-  level;
-  constructor(sink, options = {}) {
-    this.sink = sink;
-    if (typeof options === "string") {
-      this.serverVersion = options;
-      this.level = "INFO";
-    } else {
-      this.serverVersion = options.serverVersion ?? "";
-      this.level = options.level ?? "INFO";
-    }
-  }
-  onDispatchStart(_info) {
-    const token = { startNs: process.hrtime.bigint() };
-    return token;
-  }
-  onDispatchEnd(token, info, stats, error) {
-    const t = token;
-    const durationMs = t ? roundTo2(Number(process.hrtime.bigint() - t.startNs) / 1e6) : 0;
-    const status = error ? "error" : "ok";
-    const errType = error ? error.type ?? error.constructor.name : "";
-    const errMsg = error?.message ?? "";
-    const protocol = info.protocol ?? "";
-    const rec = {
-      timestamp: rfc3339Utc(),
-      level: "INFO",
-      logger: "vgi_rpc.access",
-      message: `${protocol}.${info.method} ${status}`,
-      server_id: info.serverId,
-      protocol,
-      protocol_hash: info.protocolHash ?? "",
-      method: info.method,
-      method_type: info.methodType,
-      principal: info.principal ?? "",
-      auth_domain: info.authDomain ?? "",
-      authenticated: info.authenticated ?? false,
-      remote_addr: info.remoteAddr ?? "",
-      duration_ms: durationMs,
-      status,
-      error_type: errType
-    };
-    if (errMsg)
-      rec.error_message = errMsg;
-    if (this.serverVersion)
-      rec.server_version = this.serverVersion;
-    if (info.protocolVersion)
-      rec.protocol_version = info.protocolVersion;
-    if (info.requestId)
-      rec.request_id = info.requestId;
-    if (info.requestData && info.requestData.length > 0) {
-      const encoded = base64(info.requestData);
-      if (this.level === "DEBUG") {
-        rec.request_data = encoded;
-      } else {
-        rec.original_request_bytes = encoded.length;
-        rec.truncated = true;
-      }
-    }
-    if (info.methodType === "stream") {
-      rec.stream_id = info.streamId ?? "00000000000000000000000000000000";
-    }
-    if (info.cancelled)
-      rec.cancelled = true;
-    if (stats.inputBatches + stats.outputBatches + stats.inputRows + stats.outputRows + stats.inputBytes + stats.outputBytes !== 0) {
-      rec.input_batches = stats.inputBatches;
-      rec.output_batches = stats.outputBatches;
-      rec.input_rows = stats.inputRows;
-      rec.output_rows = stats.outputRows;
-      rec.input_bytes = stats.inputBytes;
-      rec.output_bytes = stats.outputBytes;
-    }
-    try {
-      this.sink.write(`${JSON.stringify(rec)}
-`);
-    } catch {}
-  }
-}
 // src/errors.ts
 class RpcError extends Error {
   errorType;
@@ -927,49 +839,6 @@ class ServerDrainingError extends Error {
   }
 }
 
-// src/auth.ts
-class AuthContext {
-  domain;
-  authenticated;
-  principal;
-  claims;
-  constructor(domain, authenticated, principal, claims = {}) {
-    this.domain = domain;
-    this.authenticated = authenticated;
-    this.principal = principal;
-    this.claims = claims;
-  }
-  static anonymous() {
-    return new AuthContext("", false, null);
-  }
-  requireAuthenticated() {
-    if (!this.authenticated) {
-      throw new RpcError("AuthenticationError", "Authentication required", "");
-    }
-  }
-}
-// src/constants.ts
-var RPC_METHOD_KEY = "vgi_rpc.method";
-var LOG_LEVEL_KEY = "vgi_rpc.log_level";
-var LOG_MESSAGE_KEY = "vgi_rpc.log_message";
-var LOG_EXTRA_KEY = "vgi_rpc.log_extra";
-var REQUEST_VERSION_KEY = "vgi_rpc.request_version";
-var REQUEST_VERSION = "1";
-var SERVER_ID_KEY = "vgi_rpc.server_id";
-var REQUEST_ID_KEY = "vgi_rpc.request_id";
-var PROTOCOL_NAME_KEY = "vgi_rpc.protocol_name";
-var DESCRIBE_VERSION_KEY = "vgi_rpc.describe_version";
-var PROTOCOL_HASH_KEY = "vgi_rpc.protocol_hash";
-var DESCRIBE_VERSION = "4";
-var PROTOCOL_VERSION_KEY = "vgi_rpc.protocol_version";
-var DESCRIBE_METHOD_NAME = "__describe__";
-var STATE_KEY = "vgi_rpc.stream_state#b64";
-var CANCEL_KEY = "vgi_rpc.cancel";
-var LOCATION_KEY = "vgi_rpc.location";
-var LOCATION_SHA256_KEY = "vgi_rpc.location.sha256";
-var RPC_ERROR_HEADER = "X-VGI-RPC-Error";
-var ERROR_KIND_KEY = "vgi_rpc.error_kind";
-
 // src/arrow/impl-arrowjs/index.ts
 import {
   Binary as A_Binary,
@@ -1509,63 +1378,6 @@ async function readRequestFromBody(body) {
   return { schema: batch.schema, batch };
 }
 
-// src/client/capabilities.ts
-var MAX_REQUEST_BYTES_HEADER = "VGI-Max-Request-Bytes";
-var UPLOAD_URL_HEADER = "VGI-Upload-URL-Support";
-var MAX_UPLOAD_BYTES_HEADER = "VGI-Max-Upload-Bytes";
-function parseHeaderInt(headers, name) {
-  const raw = headers.get(name) ?? headers.get(name.toLowerCase());
-  if (raw == null)
-    return null;
-  const parsed = Number.parseInt(raw, 10);
-  return Number.isFinite(parsed) ? parsed : null;
-}
-function parseCapabilitiesFromHeaders(headers) {
-  const uploadRaw = headers.get(UPLOAD_URL_HEADER) ?? headers.get(UPLOAD_URL_HEADER.toLowerCase());
-  const uploadUrlSupport = uploadRaw === "true";
-  let cacheExpiresAt = null;
-  const cc = headers.get("Cache-Control") ?? headers.get("cache-control");
-  if (cc) {
-    for (const token of cc.split(",")) {
-      const t = token.trim().toLowerCase();
-      if (t.startsWith("max-age=")) {
-        const seconds = Number.parseFloat(t.slice("max-age=".length));
-        if (Number.isFinite(seconds)) {
-          cacheExpiresAt = Date.now() + seconds * 1000;
-        }
-        break;
-      }
-    }
-  }
-  return {
-    maxRequestBytes: parseHeaderInt(headers, MAX_REQUEST_BYTES_HEADER),
-    uploadUrlSupport,
-    maxUploadBytes: parseHeaderInt(headers, MAX_UPLOAD_BYTES_HEADER),
-    cacheExpiresAt
-  };
-}
-function isCapabilitySnapshotFresh(snapshot) {
-  if (!snapshot)
-    return false;
-  if (snapshot.cacheExpiresAt == null)
-    return true;
-  return Date.now() < snapshot.cacheExpiresAt;
-}
-
-// src/client/introspect.ts
-import { Schema as ArrowSchema } from "@query-farm/apache-arrow";
-
-// src/client/ipc.ts
-import {
-  Binary,
-  Bool,
-  DataType,
-  Float64,
-  Int64,
-  RecordBatchReader as RecordBatchReader3,
-  Utf8
-} from "@query-farm/apache-arrow";
-
 // src/wire/reader.ts
 import { RecordBatchReader as RecordBatchReader2 } from "@query-farm/apache-arrow";
 
@@ -1637,12 +1449,24 @@ class IpcStreamReader {
   }
 }
 
+// src/client/introspect.ts
+import { Schema as ArrowSchema } from "@query-farm/apache-arrow";
+
 // src/client/ipc.ts
-function inferArrowType(value) {
-  if (typeof value === "string")
-    return new Utf8;
-  if (typeof value === "boolean")
-    return new Bool;
+import {
+  Binary,
+  Bool,
+  DataType,
+  Float64,
+  Int64,
+  RecordBatchReader as RecordBatchReader3,
+  Utf8
+} from "@query-farm/apache-arrow";
+function inferArrowType(value) {
+  if (typeof value === "string")
+    return new Utf8;
+  if (typeof value === "boolean")
+    return new Bool;
   if (typeof value === "bigint")
     return new Int64;
   if (typeof value === "number")
@@ -1853,1173 +1677,1380 @@ async function httpIntrospect(baseUrl, options) {
   return parseDescribeResponse(batches);
 }
 
-// src/client/stream.ts
-import { Field, makeData, RecordBatch, Schema, Struct, vectorFromArray } from "@query-farm/apache-arrow";
-class HttpStreamSession {
-  _baseUrl;
-  _prefix;
-  _method;
-  _stateToken;
-  _outputSchema;
-  _inputSchema;
+// src/client/pipe.ts
+class PipeIncrementalWriter {
+  writer;
+  writeFn;
+  closed = false;
+  constructor(writeFn, schema2) {
+    this.writeFn = writeFn;
+    this.writer = new RecordBatchStreamWriter2;
+    this.writer.reset(undefined, schema2);
+    this.drain();
+  }
+  write(batch) {
+    if (this.closed)
+      throw new Error("PipeIncrementalWriter already closed");
+    this.writer._writeRecordBatch(batch);
+    this.drain();
+  }
+  close() {
+    if (this.closed)
+      return;
+    this.closed = true;
+    const eos = new Uint8Array(new Int32Array([-1, 0]).buffer);
+    this.writeFn(eos);
+  }
+  drain() {
+    const values = this.writer._sink._values;
+    for (const chunk of values) {
+      this.writeFn(chunk);
+    }
+    values.length = 0;
+  }
+}
+
+class PipeStreamSession {
+  _reader;
+  _writeFn;
   _onLog;
-  _pendingBatches;
-  _finished;
   _header;
-  _compressionLevel;
-  _compressFn;
-  _decompressFn;
-  _authorization;
+  _inputWriter = null;
+  _inputSchema = null;
+  _outputStreamOpened = false;
+  _closed = false;
+  _outputSchema;
+  _releaseBusy;
+  _setDrainPromise;
   _externalConfig;
-  _postFn;
   constructor(opts) {
-    this._baseUrl = opts.baseUrl;
-    this._prefix = opts.prefix;
-    this._method = opts.method;
-    this._stateToken = opts.stateToken;
-    this._outputSchema = opts.outputSchema;
-    this._inputSchema = opts.inputSchema;
+    this._reader = opts.reader;
+    this._writeFn = opts.writeFn;
     this._onLog = opts.onLog;
-    this._pendingBatches = opts.pendingBatches;
-    this._finished = opts.finished;
     this._header = opts.header;
-    this._compressionLevel = opts.compressionLevel;
-    this._compressFn = opts.compressFn;
-    this._decompressFn = opts.decompressFn;
-    this._authorization = opts.authorization;
+    this._outputSchema = opts.outputSchema;
+    this._releaseBusy = opts.releaseBusy;
+    this._setDrainPromise = opts.setDrainPromise;
     this._externalConfig = opts.externalConfig;
-    this._postFn = opts.postFn;
-  }
-  async _post(url, body) {
-    if (this._postFn)
-      return this._postFn(url, body);
-    return fetch(url, {
-      method: "POST",
-      headers: this._buildHeaders(),
-      body: await this._prepareBody(body)
-    });
   }
   get header() {
     return this._header;
   }
-  _buildHeaders() {
-    const headers = {
-      "Content-Type": ARROW_CONTENT_TYPE
-    };
-    if (this._compressionLevel != null && this._compressFn) {
-      headers["Content-Encoding"] = "zstd";
-    }
-    if (this._compressionLevel != null && this._decompressFn) {
-      headers["Accept-Encoding"] = "zstd";
-    }
-    if (this._authorization) {
-      headers.Authorization = this._authorization;
-    }
-    return headers;
-  }
-  async _prepareBody(content) {
-    if (this._compressionLevel != null && this._compressFn) {
-      return await this._compressFn(content, this._compressionLevel);
+  async _readOutputBatch() {
+    while (true) {
+      const batch = await this._reader.readNextBatch();
+      if (batch === null)
+        return null;
+      if (batch.numRows === 0) {
+        if (isExternalLocationBatch(batch)) {
+          return await resolveExternalLocation(batch, this._externalConfig);
+        }
+        if (dispatchLogOrError(batch, this._onLog)) {
+          continue;
+        }
+      }
+      return batch;
     }
-    return content;
   }
-  async _readResponse(resp) {
-    let body = new Uint8Array(await resp.arrayBuffer());
-    if (resp.headers.get("Content-Encoding") === "zstd" && this._decompressFn) {
-      body = new Uint8Array(await this._decompressFn(body));
+  async _ensureOutputStream() {
+    if (this._outputStreamOpened)
+      return;
+    this._outputStreamOpened = true;
+    const schema2 = await this._reader.openNextStream();
+    if (!schema2) {
+      throw new RpcError("ProtocolError", "Expected output stream but got EOF", "");
     }
-    return body;
   }
   async exchange(input) {
-    if (this._stateToken === null) {
-      throw new RpcError("ProtocolError", "Stream has finished — no state token available", "");
+    if (this._closed) {
+      throw new RpcError("ProtocolError", "Stream session is closed", "");
     }
+    let inputSchema;
+    let batch;
     if (input.length === 0) {
-      const zeroSchema = this._inputSchema ?? this._outputSchema;
-      const emptyBatch = this._buildEmptyBatch(zeroSchema);
-      const metadata2 = new Map;
-      metadata2.set(STATE_KEY, this._stateToken);
-      const batchWithMeta = new RecordBatch(zeroSchema, emptyBatch.data, metadata2);
-      return this._doExchange(zeroSchema, [batchWithMeta]);
-    }
-    const keys = Object.keys(input[0]);
-    const fields = keys.map((key) => {
-      let sample;
-      for (const row of input) {
-        if (row[key] != null) {
-          sample = row[key];
-          break;
+      inputSchema = this._inputSchema ?? this._outputSchema;
+      const children = inputSchema.fields.map((f) => {
+        return makeData({ type: f.type, length: 0, nullCount: 0 });
+      });
+      const structType = new Struct(inputSchema.fields);
+      const data = makeData({
+        type: structType,
+        length: 0,
+        children,
+        nullCount: 0
+      });
+      batch = new RecordBatch(inputSchema, data);
+    } else {
+      const keys = Object.keys(input[0]);
+      const fields = keys.map((key) => {
+        let sample;
+        for (const row of input) {
+          if (row[key] != null) {
+            sample = row[key];
+            break;
+          }
         }
-      }
-      const arrowType = inferArrowType(sample);
-      const nullable = input.some((row) => row[key] == null);
-      return new Field(key, arrowType, nullable);
-    });
-    const inputSchema = new Schema(fields);
-    const children = inputSchema.fields.map((f) => {
-      const values = input.map((row) => row[f.name]);
-      return vectorFromArray(values, f.type).data[0];
-    });
-    const structType = new Struct(inputSchema.fields);
-    const data = makeData({
-      type: structType,
-      length: input.length,
-      children,
-      nullCount: 0
-    });
-    const metadata = new Map;
-    metadata.set(STATE_KEY, this._stateToken);
-    const batch = new RecordBatch(inputSchema, data, metadata);
-    return this._doExchange(inputSchema, [batch]);
-  }
-  async _doExchange(schema2, batches) {
-    const body = serializeIpcStream(schema2, batches);
-    const resp = await this._post(`${this._baseUrl}${this._prefix}/${this._method}/exchange`, body);
-    if (resp.status === 401) {
-      throw new RpcError("AuthenticationError", "Authentication required", "");
-    }
-    const responseBody = await this._readResponse(resp);
-    const { batches: responseBatches } = await readResponseBatches(responseBody);
-    let resultRows = [];
-    for (const batch of responseBatches) {
-      if (batch.numRows === 0) {
-        dispatchLogOrError(batch, this._onLog);
-        const token2 = batch.metadata?.get(STATE_KEY);
-        if (token2) {
-          this._stateToken = token2;
+        const arrowType = inferArrowType(sample);
+        return new Field(key, arrowType, true);
+      });
+      inputSchema = new Schema(fields);
+      if (this._inputSchema) {
+        const cached = this._inputSchema;
+        if (cached.fields.length !== inputSchema.fields.length || cached.fields.some((f, i) => f.name !== inputSchema.fields[i].name)) {
+          throw new RpcError("ProtocolError", `Exchange input schema changed: expected [${cached.fields.map((f) => f.name).join(", ")}] ` + `but got [${inputSchema.fields.map((f) => f.name).join(", ")}]`, "");
         }
-        continue;
+      } else {
+        this._inputSchema = inputSchema;
       }
-      const token = batch.metadata?.get(STATE_KEY);
-      if (token) {
-        this._stateToken = token;
+      const children = inputSchema.fields.map((f) => {
+        const values = input.map((row) => row[f.name]);
+        return vectorFromArray(values, f.type).data[0];
+      });
+      const structType = new Struct(inputSchema.fields);
+      const data = makeData({
+        type: structType,
+        length: input.length,
+        children,
+        nullCount: 0
+      });
+      batch = new RecordBatch(inputSchema, data);
+    }
+    if (!this._inputWriter) {
+      this._inputWriter = new PipeIncrementalWriter(this._writeFn, inputSchema);
+    }
+    this._inputWriter.write(batch);
+    await this._ensureOutputStream();
+    try {
+      const outputBatch = await this._readOutputBatch();
+      if (outputBatch === null) {
+        return [];
       }
-      resultRows = extractBatchRows(batch);
+      return extractBatchRows(outputBatch);
+    } catch (e) {
+      await this._cleanup();
+      throw e;
     }
-    return resultRows;
-  }
-  _buildEmptyBatch(schema2) {
-    const children = schema2.fields.map((f) => {
-      return makeData({ type: f.type, length: 0, nullCount: 0 });
-    });
-    const structType = new Struct(schema2.fields);
-    const data = makeData({
-      type: structType,
-      length: 0,
-      children,
-      nullCount: 0
-    });
-    return new RecordBatch(schema2, data);
+  }
+  async _cleanup() {
+    if (this._closed)
+      return;
+    this._closed = true;
+    if (this._inputWriter) {
+      this._inputWriter.close();
+      this._inputWriter = null;
+    }
+    try {
+      if (this._outputStreamOpened) {
+        while (await this._reader.readNextBatch() !== null) {}
+      }
+    } catch {}
+    this._releaseBusy();
   }
   async* [Symbol.asyncIterator]() {
-    for (let batch of this._pendingBatches) {
-      if (batch.numRows === 0) {
-        if (isExternalLocationBatch(batch)) {
-          batch = await resolveExternalLocation(batch, this._externalConfig);
-        } else {
-          dispatchLogOrError(batch, this._onLog);
-          continue;
+    if (this._closed)
+      return;
+    try {
+      const tickSchema = new Schema([]);
+      this._inputWriter = new PipeIncrementalWriter(this._writeFn, tickSchema);
+      const structType = new Struct(tickSchema.fields);
+      const tickData = makeData({
+        type: structType,
+        length: 0,
+        children: [],
+        nullCount: 0
+      });
+      const tickBatch = new RecordBatch(tickSchema, tickData);
+      while (true) {
+        this._inputWriter.write(tickBatch);
+        await this._ensureOutputStream();
+        const outputBatch = await this._readOutputBatch();
+        if (outputBatch === null) {
+          break;
         }
+        yield extractBatchRows(outputBatch);
       }
-      yield extractBatchRows(batch);
+    } finally {
+      if (this._inputWriter) {
+        this._inputWriter.close();
+        this._inputWriter = null;
+      }
+      try {
+        if (this._outputStreamOpened) {
+          while (await this._reader.readNextBatch() !== null) {}
+        }
+      } catch {}
+      this._closed = true;
+      this._releaseBusy();
     }
-    this._pendingBatches = [];
-    if (this._finished)
-      return;
-    if (this._stateToken === null)
+  }
+  close() {
+    if (this._closed)
       return;
-    while (true) {
-      const stateToken = this._stateToken;
-      if (stateToken === null)
-        return;
-      const responseBody = await this._sendContinuation(stateToken);
-      const { batches } = await readResponseBatches(responseBody);
-      let gotContinuation = false;
-      for (let batch of batches) {
-        if (batch.numRows === 0) {
-          const token = batch.metadata?.get(STATE_KEY);
-          if (token) {
-            this._stateToken = token;
-            gotContinuation = true;
-            continue;
-          }
-          if (isExternalLocationBatch(batch)) {
-            batch = await resolveExternalLocation(batch, this._externalConfig);
-          } else {
-            dispatchLogOrError(batch, this._onLog);
-            continue;
+    this._closed = true;
+    if (this._inputWriter) {
+      this._inputWriter.close();
+      this._inputWriter = null;
+    } else {
+      const emptySchema = new Schema([]);
+      const ipc = serializeIpcStream(emptySchema, []);
+      this._writeFn(ipc);
+    }
+    const drainPromise = (async () => {
+      try {
+        if (!this._outputStreamOpened) {
+          const schema2 = await this._reader.openNextStream();
+          if (schema2) {
+            while (await this._reader.readNextBatch() !== null) {}
           }
+        } else {
+          while (await this._reader.readNextBatch() !== null) {}
         }
-        yield extractBatchRows(batch);
+      } catch {} finally {
+        this._releaseBusy();
       }
-      if (!gotContinuation)
-        break;
-    }
+    })();
+    this._setDrainPromise(drainPromise);
   }
-  async _sendContinuation(token) {
-    const emptySchema = new Schema([]);
-    const metadata = new Map;
-    metadata.set(STATE_KEY, token);
-    const structType = new Struct(emptySchema.fields);
-    const data = makeData({
-      type: structType,
-      length: 1,
-      children: [],
-      nullCount: 0
-    });
-    const batch = new RecordBatch(emptySchema, data, metadata);
-    const body = serializeIpcStream(emptySchema, [batch]);
-    const resp = await this._post(`${this._baseUrl}${this._prefix}/${this._method}/exchange`, body);
-    if (resp.status === 401) {
-      throw new RpcError("AuthenticationError", "Authentication required", "");
+}
+function pipeConnect(readable, writable, options) {
+  const onLog = options?.onLog;
+  const externalConfig = options?.externalLocation;
+  let reader = null;
+  let readerPromise = null;
+  let methodCache = null;
+  let protocolName = "";
+  let serverProtocolVersion = "";
+  let _busy = false;
+  let _drainPromise = null;
+  let closed = false;
+  const writeFn = (bytes) => {
+    writable.write(bytes);
+    writable.flush?.();
+  };
+  async function ensureReader() {
+    if (reader)
+      return reader;
+    if (!readerPromise) {
+      readerPromise = IpcStreamReader.create(readable);
     }
-    return this._readResponse(resp);
+    reader = await readerPromise;
+    return reader;
   }
-  close() {}
-}
-
-// src/client/uploadUrl.ts
-import { Field as Field2, Int64 as Int642, RecordBatchReader as RecordBatchReader4, Schema as Schema2 } from "@query-farm/apache-arrow";
-var UPLOAD_URL_METHOD = "__upload_url__";
-var UPLOAD_URL_PARAMS_SCHEMA = new Schema2([new Field2("count", new Int642, false)]);
-async function requestUploadUrls(baseUrl, prefix, count, authorization) {
-  const body = buildRequestIpc(UPLOAD_URL_PARAMS_SCHEMA, { count: BigInt(count) }, UPLOAD_URL_METHOD);
-  const headers = { "Content-Type": ARROW_CONTENT_TYPE };
-  if (authorization)
-    headers.Authorization = authorization;
-  const resp = await fetch(`${baseUrl}${prefix}/${UPLOAD_URL_METHOD}/init`, {
-    method: "POST",
-    headers,
-    body
-  });
-  if (resp.status === 404) {
-    throw new RpcError("NotSupported", "Server does not support upload URLs", "");
+  async function acquireBusy() {
+    if (_drainPromise) {
+      await _drainPromise;
+      _drainPromise = null;
+    }
+    if (_busy) {
+      throw new Error("Pipe transport is busy — another call or stream is in progress. " + "Pipe connections are single-threaded; wait for the current operation to complete.");
+    }
+    _busy = true;
   }
-  if (resp.status === 401) {
-    throw new RpcError("AuthenticationError", "Authentication required", "");
+  function releaseBusy() {
+    _busy = false;
   }
-  if (!resp.ok) {
-    throw new RpcError("HttpError", `__upload_url__/init failed: HTTP ${resp.status}`, "");
+  function setDrainPromise(p) {
+    _drainPromise = p;
   }
-  const respBody = new Uint8Array(await resp.arrayBuffer());
-  const reader = await RecordBatchReader4.from(respBody);
-  await reader.open();
-  const pairs = [];
-  for (const batch of reader.readAll()) {
-    if (batch.numRows === 0)
-      continue;
-    for (let r = 0;r < batch.numRows; r++) {
-      const uploadUrl = batch.getChildAt(0)?.get(r);
-      const downloadUrl = batch.getChildAt(1)?.get(r);
-      const expiresRaw = batch.getChildAt(2)?.get(r);
-      let expiresAt;
-      if (expiresRaw instanceof Date) {
-        expiresAt = expiresRaw;
-      } else if (typeof expiresRaw === "bigint") {
-        expiresAt = new Date(Number(expiresRaw / 1000n));
-      } else if (typeof expiresRaw === "number") {
-        expiresAt = new Date(expiresRaw);
-      } else {
-        expiresAt = new Date;
+  async function ensureMethodCache() {
+    if (methodCache)
+      return methodCache;
+    await acquireBusy();
+    try {
+      const emptySchema = new Schema([]);
+      const body = buildRequestIpc(emptySchema, {}, DESCRIBE_METHOD_NAME);
+      writeFn(body);
+      const r = await ensureReader();
+      const response = await r.readStream();
+      if (!response) {
+        throw new Error("EOF reading __describe__ response");
       }
-      pairs.push({ uploadUrl, downloadUrl, expiresAt });
+      const desc = await parseDescribeResponse(response.batches, onLog);
+      protocolName = desc.protocolName;
+      serverProtocolVersion = desc.protocolVersion;
+      methodCache = new Map(desc.methods.map((m) => [m.name, m]));
+      return methodCache;
+    } finally {
+      releaseBusy();
     }
   }
-  if (pairs.length === 0) {
-    throw new RpcError("ProtocolError", "Server returned no upload URLs", "");
-  }
-  return pairs;
-}
-async function buildPointerRequestBody(originalBody, downloadUrl) {
-  const reader = await RecordBatchReader4.from(originalBody);
-  await reader.open();
-  const schema2 = reader.schema;
-  if (!schema2) {
-    throw new RpcError("ProtocolError", "Original request body has no schema", "");
-  }
-  const batches = reader.readAll();
-  if (batches.length === 0) {
-    throw new RpcError("ProtocolError", "Original request body has no batches", "");
-  }
-  const original = batches[0];
-  const originalMeta = original.metadata ?? new Map;
-  const pointer = makeExternalLocationBatch(schema2, downloadUrl);
-  const merged = new Map(pointer.metadata ?? new Map);
-  const method = originalMeta.get(RPC_METHOD_KEY);
-  const version = originalMeta.get(REQUEST_VERSION_KEY) ?? REQUEST_VERSION;
-  if (method)
-    merged.set(RPC_METHOD_KEY, method);
-  merged.set(REQUEST_VERSION_KEY, version);
-  for (const [k, v] of originalMeta) {
-    if (!merged.has(k))
-      merged.set(k, v);
-  }
-  const { RecordBatch: RecordBatch2 } = await import("@query-farm/apache-arrow");
-  const pointerWithMeta = new RecordBatch2(schema2, pointer.data, merged);
-  return serializeIpcStream(schema2, [pointerWithMeta]);
-}
-async function externalizeRequestBody(body, opts) {
-  const pairs = await requestUploadUrls(opts.baseUrl, opts.prefix, 1, opts.authorization);
-  const pair = pairs[0];
-  if (opts.urlValidator) {
-    opts.urlValidator(pair.uploadUrl);
-    opts.urlValidator(pair.downloadUrl);
-  }
-  const putResp = await fetch(pair.uploadUrl, {
-    method: "PUT",
-    headers: { "Content-Type": ARROW_CONTENT_TYPE },
-    body
-  });
-  if (!putResp.ok) {
-    throw new RpcError("ExternalUploadFailed", `PUT to upload URL failed: HTTP ${putResp.status}`, "");
-  }
-  return buildPointerRequestBody(body, pair.downloadUrl);
-}
-
-// src/client/connect.ts
-function httpConnect(baseUrl, options) {
-  const prefix = (options?.prefix ?? "").replace(/\/+$/, "");
-  const onLog = options?.onLog;
-  const compressionLevel = options?.compressionLevel;
-  const authorization = options?.authorization;
-  const externalConfig = options?.externalLocation;
-  let methodCache = null;
-  let serverProtocolVersion = "";
-  let compressFn;
-  let decompressFn;
-  let compressionLoaded = false;
-  let capabilities = null;
-  function updateCapabilitiesFromResponse(resp) {
-    const next = parseCapabilitiesFromHeaders(resp.headers);
-    if (next.maxRequestBytes != null || next.uploadUrlSupport) {
-      capabilities = next;
-    }
-  }
-  async function maybeExternalize(body) {
-    const caps = isCapabilitySnapshotFresh(capabilities) ? capabilities : null;
-    if (!caps)
-      return body;
-    if (!caps.uploadUrlSupport)
-      return body;
-    if (caps.maxRequestBytes == null || body.byteLength <= caps.maxRequestBytes)
-      return body;
-    return externalizeRequestBody(body, {
-      baseUrl,
-      prefix,
-      authorization,
-      urlValidator: externalConfig?.urlValidator ?? null
-    });
-  }
-  async function postWithExternalization(url, body) {
-    const sendBody = await maybeExternalize(body);
-    let resp = await fetch(url, {
-      method: "POST",
-      headers: buildHeaders(),
-      body: await prepareBody(sendBody)
-    });
-    updateCapabilitiesFromResponse(resp);
-    if (resp.status === 413 && capabilities?.uploadUrlSupport && body.byteLength > 0) {
-      const externalized = await externalizeRequestBody(body, {
-        baseUrl,
-        prefix,
-        authorization,
-        urlValidator: externalConfig?.urlValidator ?? null
-      });
-      resp = await fetch(url, {
-        method: "POST",
-        headers: buildHeaders(),
-        body: await prepareBody(externalized)
-      });
-      updateCapabilitiesFromResponse(resp);
-    }
-    return resp;
-  }
-  async function ensureCompression() {
-    if (compressionLoaded || compressionLevel == null)
-      return;
-    try {
-      const mod = await Promise.resolve().then(() => (init_zstd(), exports_zstd));
-      compressFn = mod.zstdCompress;
-      decompressFn = mod.zstdDecompress;
-    } catch {}
-    compressionLoaded = true;
-  }
-  function buildHeaders() {
-    const headers = {
-      "Content-Type": ARROW_CONTENT_TYPE
-    };
-    if (compressionLevel != null && compressFn) {
-      headers["Content-Encoding"] = "zstd";
-    }
-    if (compressionLevel != null && decompressFn) {
-      headers["Accept-Encoding"] = "zstd";
-    }
-    if (authorization) {
-      headers.Authorization = authorization;
-    }
-    return headers;
-  }
-  async function prepareBody(content) {
-    if (compressionLevel != null && compressFn) {
-      return await compressFn(content, compressionLevel);
-    }
-    return content;
-  }
-  function checkAuth(resp) {
-    if (resp.status === 401) {
-      throw new RpcError("AuthenticationError", "Authentication required", "");
-    }
-  }
-  async function readResponse(resp) {
-    let body = new Uint8Array(await resp.arrayBuffer());
-    if (resp.headers.get("Content-Encoding") === "zstd" && decompressFn) {
-      body = new Uint8Array(await decompressFn(body));
-    }
-    return body;
-  }
-  async function ensureMethodCache() {
-    if (methodCache)
-      return methodCache;
-    await ensureCompression();
-    const desc = await httpIntrospect(baseUrl, {
-      prefix,
-      authorization,
-      compressionLevel,
-      compressFn,
-      decompressFn
-    });
-    methodCache = new Map(desc.methods.map((m) => [m.name, m]));
-    serverProtocolVersion = desc.protocolVersion;
-    return methodCache;
-  }
   return {
     async call(method, params) {
-      await ensureCompression();
       const methods = await ensureMethodCache();
-      const info = methods.get(method);
-      if (!info) {
-        throw new Error(`Unknown method: '${method}'`);
-      }
-      const fullParams = { ...info.defaults ?? {}, ...params ?? {} };
-      const body = buildRequestIpc(info.paramsSchema, fullParams, method, { protocolVersion: serverProtocolVersion });
-      const resp = await postWithExternalization(`${baseUrl}${prefix}/${method}`, body);
-      checkAuth(resp);
-      const responseBody = await readResponse(resp);
-      const { batches } = await readResponseBatches(responseBody);
-      let resultBatch = null;
-      for (let batch of batches) {
-        if (batch.numRows === 0) {
-          if (isExternalLocationBatch(batch)) {
-            batch = await resolveExternalLocation(batch, externalConfig);
-          } else {
-            dispatchLogOrError(batch, onLog);
-            continue;
-          }
+      await acquireBusy();
+      try {
+        const info = methods.get(method);
+        if (!info) {
+          throw new Error(`Unknown method: '${method}'`);
         }
-        resultBatch = batch;
-      }
-      if (!resultBatch) {
-        return null;
-      }
-      const rows = extractBatchRows(resultBatch);
-      if (rows.length === 0)
-        return null;
-      const result = rows[0];
-      if (info.resultSchema.fields.length === 0)
-        return null;
-      return result;
-    },
-    async stream(method, params) {
-      await ensureCompression();
-      const methods = await ensureMethodCache();
-      const info = methods.get(method);
-      if (!info) {
-        throw new Error(`Unknown method: '${method}'`);
-      }
-      const fullParams = { ...info.defaults ?? {}, ...params ?? {} };
-      const body = buildRequestIpc(info.paramsSchema, fullParams, method, { protocolVersion: serverProtocolVersion });
-      const resp = await postWithExternalization(`${baseUrl}${prefix}/${method}/init`, body);
-      checkAuth(resp);
-      const responseBody = await readResponse(resp);
-      let header = null;
-      let stateToken = null;
-      const pendingBatches = [];
-      let finished = false;
-      let streamSchema = null;
-      if (info.headerSchema) {
-        const reader = await readSequentialStreams(responseBody);
-        const headerStream = await reader.readStream();
-        if (headerStream) {
-          for (const batch of headerStream.batches) {
-            if (batch.numRows === 0) {
+        const r = await ensureReader();
+        const fullParams = { ...info.defaults ?? {}, ...params ?? {} };
+        const body = buildRequestIpc(info.paramsSchema, fullParams, method, { protocolVersion: serverProtocolVersion });
+        writeFn(body);
+        const response = await r.readStream();
+        if (!response) {
+          throw new Error("EOF reading response");
+        }
+        let resultBatch = null;
+        for (let batch of response.batches) {
+          if (batch.numRows === 0) {
+            if (isExternalLocationBatch(batch)) {
+              batch = await resolveExternalLocation(batch, externalConfig);
+            } else {
               dispatchLogOrError(batch, onLog);
               continue;
             }
-            const rows = extractBatchRows(batch);
-            if (rows.length > 0) {
-              header = rows[0];
-            }
           }
+          resultBatch = batch;
         }
-        const dataStream = await reader.readStream();
-        if (dataStream) {
-          streamSchema = dataStream.schema;
+        if (!resultBatch) {
+          return null;
         }
-        const headerErrorBatches = [];
-        if (dataStream) {
-          for (const batch of dataStream.batches) {
-            if (batch.numRows === 0) {
-              const token = batch.metadata?.get(STATE_KEY);
-              if (token) {
-                stateToken = token;
+        const rows = extractBatchRows(resultBatch);
+        if (rows.length === 0)
+          return null;
+        if (info.resultSchema.fields.length === 0)
+          return null;
+        return rows[0];
+      } finally {
+        releaseBusy();
+      }
+    },
+    async stream(method, params) {
+      const methods = await ensureMethodCache();
+      await acquireBusy();
+      try {
+        const info = methods.get(method);
+        if (!info) {
+          throw new Error(`Unknown method: '${method}'`);
+        }
+        const r = await ensureReader();
+        const fullParams = { ...info.defaults ?? {}, ...params ?? {} };
+        const body = buildRequestIpc(info.paramsSchema, fullParams, method, { protocolVersion: serverProtocolVersion });
+        writeFn(body);
+        let header = null;
+        if (info.headerSchema) {
+          const headerStream = await r.readStream();
+          if (headerStream) {
+            for (const batch of headerStream.batches) {
+              if (batch.numRows === 0) {
+                dispatchLogOrError(batch, onLog);
                 continue;
               }
-              const level = batch.metadata?.get(LOG_LEVEL_KEY);
-              if (level === "EXCEPTION") {
-                headerErrorBatches.push(batch);
-                continue;
+              const rows = extractBatchRows(batch);
+              if (rows.length > 0) {
+                header = rows[0];
               }
-              dispatchLogOrError(batch, onLog);
-              continue;
             }
-            pendingBatches.push(batch);
           }
         }
-        if (headerErrorBatches.length > 0) {
-          if (pendingBatches.length > 0 || stateToken !== null) {
-            pendingBatches.push(...headerErrorBatches);
-          } else {
-            for (const batch of headerErrorBatches) {
-              dispatchLogOrError(batch, onLog);
-            }
-          }
-        }
-        if (!dataStream && !stateToken) {
-          finished = true;
-        }
-      } else {
-        const { schema: responseSchema, batches } = await readResponseBatches(responseBody);
-        streamSchema = responseSchema;
-        const errorBatches = [];
-        for (const batch of batches) {
-          if (batch.numRows === 0) {
-            const token = batch.metadata?.get(STATE_KEY);
-            if (token) {
-              stateToken = token;
-              continue;
-            }
-            const level = batch.metadata?.get(LOG_LEVEL_KEY);
-            if (level === "EXCEPTION") {
-              errorBatches.push(batch);
-              continue;
-            }
-            dispatchLogOrError(batch, onLog);
-            continue;
-          }
-          pendingBatches.push(batch);
-        }
-        if (errorBatches.length > 0) {
-          if (pendingBatches.length > 0 || stateToken !== null) {
-            pendingBatches.push(...errorBatches);
-          } else {
-            for (const batch of errorBatches) {
-              dispatchLogOrError(batch, onLog);
-            }
-          }
-        }
-      }
-      if (pendingBatches.length === 0 && stateToken === null) {
-        finished = true;
+        const outputSchema = info.outputSchema ?? info.resultSchema;
+        return new PipeStreamSession({
+          reader: r,
+          writeFn,
+          onLog,
+          header,
+          outputSchema,
+          releaseBusy,
+          setDrainPromise,
+          externalConfig
+        });
+      } catch (e) {
+        try {
+          const r = await ensureReader();
+          const emptySchema = new Schema([]);
+          const ipc = serializeIpcStream(emptySchema, []);
+          writeFn(ipc);
+          const outStream = await r.readStream();
+        } catch {}
+        releaseBusy();
+        throw e;
       }
-      const outputSchema = (streamSchema && streamSchema.fields.length > 0 ? streamSchema : null) ?? (pendingBatches.length > 0 ? pendingBatches[0].schema : null) ?? info.outputSchema ?? info.resultSchema;
-      return new HttpStreamSession({
-        baseUrl,
-        prefix,
-        method,
-        stateToken,
-        outputSchema,
-        inputSchema: info.inputSchema,
-        onLog,
-        pendingBatches,
-        finished,
-        header,
-        compressionLevel,
-        compressFn,
-        decompressFn,
-        authorization,
-        externalConfig,
-        postFn: postWithExternalization
-      });
     },
     async describe() {
-      await ensureCompression();
-      return httpIntrospect(baseUrl, {
-        prefix,
-        authorization,
-        compressionLevel,
-        compressFn,
-        decompressFn
-      });
+      const methods = await ensureMethodCache();
+      return {
+        protocolName,
+        protocolVersion: serverProtocolVersion,
+        methods: [...methods.values()]
+      };
     },
-    close() {}
+    close() {
+      if (closed)
+        return;
+      closed = true;
+      writable.end();
+    }
   };
 }
-// src/client/oauth.ts
-function parseMetadataJson(json) {
-  const result = {
-    resource: json.resource,
-    authorizationServers: json.authorization_servers
+function subprocessConnect(cmd, options) {
+  const proc = Bun.spawn(cmd, {
+    stdin: "pipe",
+    stdout: "pipe",
+    stderr: options?.stderr ?? "ignore",
+    cwd: options?.cwd,
+    env: options?.env ? { ...process.env, ...options.env } : undefined
+  });
+  const stdout = proc.stdout;
+  const writable = {
+    write(data) {
+      proc.stdin.write(data);
+    },
+    flush() {
+      proc.stdin.flush();
+    },
+    end() {
+      proc.stdin.end();
+    }
   };
-  if (json.scopes_supported)
-    result.scopesSupported = json.scopes_supported;
-  if (json.bearer_methods_supported)
-    result.bearerMethodsSupported = json.bearer_methods_supported;
-  if (json.resource_signing_alg_values_supported)
-    result.resourceSigningAlgValuesSupported = json.resource_signing_alg_values_supported;
-  if (json.resource_name)
-    result.resourceName = json.resource_name;
-  if (json.resource_documentation)
-    result.resourceDocumentation = json.resource_documentation;
-  if (json.resource_policy_uri)
-    result.resourcePolicyUri = json.resource_policy_uri;
-  if (json.resource_tos_uri)
-    result.resourceTosUri = json.resource_tos_uri;
-  if (json.client_id)
-    result.clientId = json.client_id;
-  if (json.client_secret)
-    result.clientSecret = json.client_secret;
-  if (json.use_id_token_as_bearer)
-    result.useIdTokenAsBearer = json.use_id_token_as_bearer;
-  if (json.device_code_client_id)
-    result.deviceCodeClientId = json.device_code_client_id;
-  if (json.device_code_client_secret)
-    result.deviceCodeClientSecret = json.device_code_client_secret;
-  return result;
+  const client = pipeConnect(stdout, writable, {
+    onLog: options?.onLog,
+    externalLocation: options?.externalLocation
+  });
+  const originalClose = client.close;
+  client.close = () => {
+    originalClose.call(client);
+    try {
+      proc.kill();
+    } catch {}
+  };
+  return client;
 }
-async function httpOAuthMetadata(baseUrl, prefix) {
-  const effectivePrefix = (prefix ?? "").replace(/\/+$/, "");
-  const metadataUrl = `${baseUrl.replace(/\/+$/, "")}/.well-known/oauth-protected-resource${effectivePrefix}`;
-  try {
-    return await fetchOAuthMetadata(metadataUrl);
-  } catch {
-    return null;
-  }
+
+// src/client/tcp.ts
+function tcpConnect(host, port, options) {
+  const socket = connect({ host, port });
+  socket.setNoDelay(true);
+  socket.on("error", () => {});
+  const readable = socket;
+  const writable = {
+    write(data) {
+      socket.write(data);
+    },
+    end() {
+      socket.end();
+    }
+  };
+  const client = pipeConnect(readable, writable, {
+    onLog: options?.onLog,
+    externalLocation: options?.externalLocation
+  });
+  const originalClose = client.close;
+  client.close = () => {
+    originalClose.call(client);
+    try {
+      socket.destroy();
+    } catch {}
+  };
+  return client;
 }
-async function fetchOAuthMetadata(metadataUrl) {
-  const response = await fetch(metadataUrl);
-  if (!response.ok) {
-    throw new Error(`Failed to fetch OAuth metadata from ${metadataUrl}: ${response.status}`);
+// src/access-log.ts
+var _NODE_FS_MOD = "node:fs";
+function _loadWriteSync() {
+  const req = import.meta.require ?? globalThis.require ?? null;
+  if (!req) {
+    throw new Error("FdSink requires Node.js or Bun (node:fs.writeSync). For other runtimes, " + "supply a custom AccessLogSink that wraps console.log or your logger.");
   }
-  const json = await response.json();
-  return parseMetadataJson(json);
-}
-function parseResourceMetadataUrl(wwwAuthenticate) {
-  const bearerMatch = wwwAuthenticate.match(/^Bearer\s+(.*)/i);
-  if (!bearerMatch)
-    return null;
-  const params = bearerMatch[1];
-  const metadataMatch = params.match(/resource_metadata="([^"]+)"/);
-  if (!metadataMatch)
-    return null;
-  return metadataMatch[1];
+  return req(_NODE_FS_MOD).writeSync;
 }
-function parseClientId(wwwAuthenticate) {
-  const bearerMatch = wwwAuthenticate.match(/^Bearer\s+(.*)/i);
-  if (!bearerMatch)
-    return null;
-  const params = bearerMatch[1];
-  const clientIdMatch = params.match(/client_id="([^"]+)"/);
-  if (!clientIdMatch)
-    return null;
-  return clientIdMatch[1];
+
+class FdSink {
+  fd;
+  _writeSync = _loadWriteSync();
+  constructor(fd) {
+    this.fd = fd;
+  }
+  write(line) {
+    const buf = new TextEncoder().encode(line);
+    let offset = 0;
+    while (offset < buf.length) {
+      const n = this._writeSync(this.fd, buf, offset, buf.length - offset);
+      if (n <= 0)
+        throw new Error(`access-log writeSync returned ${n}`);
+      offset += n;
+    }
+  }
 }
-function parseClientSecret(wwwAuthenticate) {
-  const bearerMatch = wwwAuthenticate.match(/^Bearer\s+(.*)/i);
-  if (!bearerMatch)
-    return null;
-  const params = bearerMatch[1];
-  const match = params.match(/client_secret="([^"]+)"/);
-  if (!match)
-    return null;
-  return match[1];
+function rfc3339Utc() {
+  const d = new Date;
+  const yyyy = d.getUTCFullYear().toString().padStart(4, "0");
+  const mm = (d.getUTCMonth() + 1).toString().padStart(2, "0");
+  const dd = d.getUTCDate().toString().padStart(2, "0");
+  const hh = d.getUTCHours().toString().padStart(2, "0");
+  const mi = d.getUTCMinutes().toString().padStart(2, "0");
+  const ss = d.getUTCSeconds().toString().padStart(2, "0");
+  const ms = d.getUTCMilliseconds().toString().padStart(3, "0");
+  return `${yyyy}-${mm}-${dd}T${hh}:${mi}:${ss}.${ms}Z`;
 }
-function parseUseIdTokenAsBearer(wwwAuthenticate) {
-  const bearerMatch = wwwAuthenticate.match(/^Bearer\s+(.*)/i);
-  if (!bearerMatch)
-    return false;
-  const params = bearerMatch[1];
-  const match = params.match(/use_id_token_as_bearer="([^"]+)"/);
-  if (!match)
-    return false;
-  return match[1] === "true";
+function base64(bytes) {
+  return Buffer.from(bytes).toString("base64");
 }
-function parseDeviceCodeClientId(wwwAuthenticate) {
-  const bearerMatch = wwwAuthenticate.match(/^Bearer\s+(.*)/i);
-  if (!bearerMatch)
-    return null;
-  const params = bearerMatch[1];
-  const match = params.match(/device_code_client_id="([^"]+)"/);
-  if (!match)
-    return null;
-  return match[1];
+function roundTo2(f) {
+  return Math.round(f * 100) / 100;
 }
-function parseDeviceCodeClientSecret(wwwAuthenticate) {
-  const bearerMatch = wwwAuthenticate.match(/^Bearer\s+(.*)/i);
-  if (!bearerMatch)
-    return null;
-  const params = bearerMatch[1];
-  const match = params.match(/device_code_client_secret="([^"]+)"/);
-  if (!match)
-    return null;
-  return match[1];
+
+class AccessLogHook {
+  sink;
+  serverVersion;
+  level;
+  constructor(sink, options = {}) {
+    this.sink = sink;
+    if (typeof options === "string") {
+      this.serverVersion = options;
+      this.level = "INFO";
+    } else {
+      this.serverVersion = options.serverVersion ?? "";
+      this.level = options.level ?? "INFO";
+    }
+  }
+  onDispatchStart(_info) {
+    const token = { startNs: process.hrtime.bigint() };
+    return token;
+  }
+  onDispatchEnd(token, info, stats, error) {
+    const t = token;
+    const durationMs = t ? roundTo2(Number(process.hrtime.bigint() - t.startNs) / 1e6) : 0;
+    const status = error ? "error" : "ok";
+    const errType = error ? error.type ?? error.constructor.name : "";
+    const errMsg = error?.message ?? "";
+    const protocol = info.protocol ?? "";
+    const rec = {
+      timestamp: rfc3339Utc(),
+      level: "INFO",
+      logger: "vgi_rpc.access",
+      message: `${protocol}.${info.method} ${status}`,
+      server_id: info.serverId,
+      protocol,
+      protocol_hash: info.protocolHash ?? "",
+      method: info.method,
+      method_type: info.methodType,
+      principal: info.principal ?? "",
+      auth_domain: info.authDomain ?? "",
+      authenticated: info.authenticated ?? false,
+      remote_addr: info.remoteAddr ?? "",
+      duration_ms: durationMs,
+      status,
+      error_type: errType
+    };
+    if (errMsg)
+      rec.error_message = errMsg;
+    if (this.serverVersion)
+      rec.server_version = this.serverVersion;
+    if (info.protocolVersion)
+      rec.protocol_version = info.protocolVersion;
+    if (info.requestId)
+      rec.request_id = info.requestId;
+    if (info.requestData && info.requestData.length > 0) {
+      const encoded = base64(info.requestData);
+      if (this.level === "DEBUG") {
+        rec.request_data = encoded;
+      } else {
+        rec.original_request_bytes = encoded.length;
+        rec.truncated = true;
+      }
+    }
+    if (info.methodType === "stream") {
+      rec.stream_id = info.streamId ?? "00000000000000000000000000000000";
+    }
+    if (info.cancelled)
+      rec.cancelled = true;
+    if (stats.inputBatches + stats.outputBatches + stats.inputRows + stats.outputRows + stats.inputBytes + stats.outputBytes !== 0) {
+      rec.input_batches = stats.inputBatches;
+      rec.output_batches = stats.outputBatches;
+      rec.input_rows = stats.inputRows;
+      rec.output_rows = stats.outputRows;
+      rec.input_bytes = stats.inputBytes;
+      rec.output_bytes = stats.outputBytes;
+    }
+    try {
+      this.sink.write(`${JSON.stringify(rec)}
+`);
+    } catch {}
+  }
 }
-// src/client/pipe.ts
-import {
-  Field as Field3,
-  makeData as makeData2,
-  RecordBatch as RecordBatch2,
-  RecordBatchStreamWriter as RecordBatchStreamWriter2,
-  Schema as Schema3,
-  Struct as Struct2,
-  vectorFromArray as vectorFromArray2
-} from "@query-farm/apache-arrow";
-class PipeIncrementalWriter {
-  writer;
-  writeFn;
-  closed = false;
-  constructor(writeFn, schema2) {
-    this.writeFn = writeFn;
-    this.writer = new RecordBatchStreamWriter2;
-    this.writer.reset(undefined, schema2);
-    this.drain();
+// src/auth.ts
+class AuthContext {
+  domain;
+  authenticated;
+  principal;
+  claims;
+  constructor(domain, authenticated, principal, claims = {}) {
+    this.domain = domain;
+    this.authenticated = authenticated;
+    this.principal = principal;
+    this.claims = claims;
   }
-  write(batch) {
-    if (this.closed)
-      throw new Error("PipeIncrementalWriter already closed");
-    this.writer._writeRecordBatch(batch);
-    this.drain();
+  static anonymous() {
+    return new AuthContext("", false, null);
   }
-  close() {
-    if (this.closed)
-      return;
-    this.closed = true;
-    const eos = new Uint8Array(new Int32Array([-1, 0]).buffer);
-    this.writeFn(eos);
+  requireAuthenticated() {
+    if (!this.authenticated) {
+      throw new RpcError("AuthenticationError", "Authentication required", "");
+    }
   }
-  drain() {
-    const values = this.writer._sink._values;
-    for (const chunk of values) {
-      this.writeFn(chunk);
+}
+// src/client/capabilities.ts
+var MAX_REQUEST_BYTES_HEADER = "VGI-Max-Request-Bytes";
+var UPLOAD_URL_HEADER = "VGI-Upload-URL-Support";
+var MAX_UPLOAD_BYTES_HEADER = "VGI-Max-Upload-Bytes";
+function parseHeaderInt(headers, name) {
+  const raw = headers.get(name) ?? headers.get(name.toLowerCase());
+  if (raw == null)
+    return null;
+  const parsed = Number.parseInt(raw, 10);
+  return Number.isFinite(parsed) ? parsed : null;
+}
+function parseCapabilitiesFromHeaders(headers) {
+  const uploadRaw = headers.get(UPLOAD_URL_HEADER) ?? headers.get(UPLOAD_URL_HEADER.toLowerCase());
+  const uploadUrlSupport = uploadRaw === "true";
+  let cacheExpiresAt = null;
+  const cc = headers.get("Cache-Control") ?? headers.get("cache-control");
+  if (cc) {
+    for (const token of cc.split(",")) {
+      const t = token.trim().toLowerCase();
+      if (t.startsWith("max-age=")) {
+        const seconds = Number.parseFloat(t.slice("max-age=".length));
+        if (Number.isFinite(seconds)) {
+          cacheExpiresAt = Date.now() + seconds * 1000;
+        }
+        break;
+      }
     }
-    values.length = 0;
   }
+  return {
+    maxRequestBytes: parseHeaderInt(headers, MAX_REQUEST_BYTES_HEADER),
+    uploadUrlSupport,
+    maxUploadBytes: parseHeaderInt(headers, MAX_UPLOAD_BYTES_HEADER),
+    cacheExpiresAt
+  };
+}
+function isCapabilitySnapshotFresh(snapshot) {
+  if (!snapshot)
+    return false;
+  if (snapshot.cacheExpiresAt == null)
+    return true;
+  return Date.now() < snapshot.cacheExpiresAt;
 }
 
-class PipeStreamSession {
-  _reader;
-  _writeFn;
+// src/client/stream.ts
+import { Field as Field2, makeData as makeData2, RecordBatch as RecordBatch2, Schema as Schema2, Struct as Struct2, vectorFromArray as vectorFromArray2 } from "@query-farm/apache-arrow";
+class HttpStreamSession {
+  _baseUrl;
+  _prefix;
+  _method;
+  _stateToken;
+  _outputSchema;
+  _inputSchema;
   _onLog;
+  _pendingBatches;
+  _finished;
   _header;
-  _inputWriter = null;
-  _inputSchema = null;
-  _outputStreamOpened = false;
-  _closed = false;
-  _outputSchema;
-  _releaseBusy;
-  _setDrainPromise;
+  _compressionLevel;
+  _compressFn;
+  _decompressFn;
+  _authorization;
   _externalConfig;
+  _postFn;
   constructor(opts) {
-    this._reader = opts.reader;
-    this._writeFn = opts.writeFn;
+    this._baseUrl = opts.baseUrl;
+    this._prefix = opts.prefix;
+    this._method = opts.method;
+    this._stateToken = opts.stateToken;
+    this._outputSchema = opts.outputSchema;
+    this._inputSchema = opts.inputSchema;
     this._onLog = opts.onLog;
+    this._pendingBatches = opts.pendingBatches;
+    this._finished = opts.finished;
     this._header = opts.header;
-    this._outputSchema = opts.outputSchema;
-    this._releaseBusy = opts.releaseBusy;
-    this._setDrainPromise = opts.setDrainPromise;
+    this._compressionLevel = opts.compressionLevel;
+    this._compressFn = opts.compressFn;
+    this._decompressFn = opts.decompressFn;
+    this._authorization = opts.authorization;
     this._externalConfig = opts.externalConfig;
+    this._postFn = opts.postFn;
+  }
+  async _post(url, body) {
+    if (this._postFn)
+      return this._postFn(url, body);
+    return fetch(url, {
+      method: "POST",
+      headers: this._buildHeaders(),
+      body: await this._prepareBody(body)
+    });
   }
   get header() {
     return this._header;
   }
-  async _readOutputBatch() {
-    while (true) {
-      const batch = await this._reader.readNextBatch();
-      if (batch === null)
-        return null;
+  _buildHeaders() {
+    const headers = {
+      "Content-Type": ARROW_CONTENT_TYPE
+    };
+    if (this._compressionLevel != null && this._compressFn) {
+      headers["Content-Encoding"] = "zstd";
+    }
+    if (this._compressionLevel != null && this._decompressFn) {
+      headers["Accept-Encoding"] = "zstd";
+    }
+    if (this._authorization) {
+      headers.Authorization = this._authorization;
+    }
+    return headers;
+  }
+  async _prepareBody(content) {
+    if (this._compressionLevel != null && this._compressFn) {
+      return await this._compressFn(content, this._compressionLevel);
+    }
+    return content;
+  }
+  async _readResponse(resp) {
+    let body = new Uint8Array(await resp.arrayBuffer());
+    if (resp.headers.get("Content-Encoding") === "zstd" && this._decompressFn) {
+      body = new Uint8Array(await this._decompressFn(body));
+    }
+    return body;
+  }
+  async exchange(input) {
+    if (this._stateToken === null) {
+      throw new RpcError("ProtocolError", "Stream has finished — no state token available", "");
+    }
+    if (input.length === 0) {
+      const zeroSchema = this._inputSchema ?? this._outputSchema;
+      const emptyBatch = this._buildEmptyBatch(zeroSchema);
+      const metadata2 = new Map;
+      metadata2.set(STATE_KEY, this._stateToken);
+      const batchWithMeta = new RecordBatch2(zeroSchema, emptyBatch.data, metadata2);
+      return this._doExchange(zeroSchema, [batchWithMeta]);
+    }
+    const keys = Object.keys(input[0]);
+    const fields = keys.map((key) => {
+      let sample;
+      for (const row of input) {
+        if (row[key] != null) {
+          sample = row[key];
+          break;
+        }
+      }
+      const arrowType = inferArrowType(sample);
+      const nullable = input.some((row) => row[key] == null);
+      return new Field2(key, arrowType, nullable);
+    });
+    const inputSchema = new Schema2(fields);
+    const children = inputSchema.fields.map((f) => {
+      const values = input.map((row) => row[f.name]);
+      return vectorFromArray2(values, f.type).data[0];
+    });
+    const structType = new Struct2(inputSchema.fields);
+    const data = makeData2({
+      type: structType,
+      length: input.length,
+      children,
+      nullCount: 0
+    });
+    const metadata = new Map;
+    metadata.set(STATE_KEY, this._stateToken);
+    const batch = new RecordBatch2(inputSchema, data, metadata);
+    return this._doExchange(inputSchema, [batch]);
+  }
+  async _doExchange(schema2, batches) {
+    const body = serializeIpcStream(schema2, batches);
+    const resp = await this._post(`${this._baseUrl}${this._prefix}/${this._method}/exchange`, body);
+    if (resp.status === 401) {
+      throw new RpcError("AuthenticationError", "Authentication required", "");
+    }
+    const responseBody = await this._readResponse(resp);
+    const { batches: responseBatches } = await readResponseBatches(responseBody);
+    let resultRows = [];
+    for (const batch of responseBatches) {
+      if (batch.numRows === 0) {
+        dispatchLogOrError(batch, this._onLog);
+        const token2 = batch.metadata?.get(STATE_KEY);
+        if (token2) {
+          this._stateToken = token2;
+        }
+        continue;
+      }
+      const token = batch.metadata?.get(STATE_KEY);
+      if (token) {
+        this._stateToken = token;
+      }
+      resultRows = extractBatchRows(batch);
+    }
+    return resultRows;
+  }
+  _buildEmptyBatch(schema2) {
+    const children = schema2.fields.map((f) => {
+      return makeData2({ type: f.type, length: 0, nullCount: 0 });
+    });
+    const structType = new Struct2(schema2.fields);
+    const data = makeData2({
+      type: structType,
+      length: 0,
+      children,
+      nullCount: 0
+    });
+    return new RecordBatch2(schema2, data);
+  }
+  async* [Symbol.asyncIterator]() {
+    for (let batch of this._pendingBatches) {
       if (batch.numRows === 0) {
         if (isExternalLocationBatch(batch)) {
-          return await resolveExternalLocation(batch, this._externalConfig);
-        }
-        if (dispatchLogOrError(batch, this._onLog)) {
+          batch = await resolveExternalLocation(batch, this._externalConfig);
+        } else {
+          dispatchLogOrError(batch, this._onLog);
           continue;
         }
       }
-      return batch;
+      yield extractBatchRows(batch);
     }
-  }
-  async _ensureOutputStream() {
-    if (this._outputStreamOpened)
+    this._pendingBatches = [];
+    if (this._finished)
       return;
-    this._outputStreamOpened = true;
-    const schema2 = await this._reader.openNextStream();
-    if (!schema2) {
-      throw new RpcError("ProtocolError", "Expected output stream but got EOF", "");
+    if (this._stateToken === null)
+      return;
+    while (true) {
+      const stateToken = this._stateToken;
+      if (stateToken === null)
+        return;
+      const responseBody = await this._sendContinuation(stateToken);
+      const { batches } = await readResponseBatches(responseBody);
+      let gotContinuation = false;
+      for (let batch of batches) {
+        if (batch.numRows === 0) {
+          const token = batch.metadata?.get(STATE_KEY);
+          if (token) {
+            this._stateToken = token;
+            gotContinuation = true;
+            continue;
+          }
+          if (isExternalLocationBatch(batch)) {
+            batch = await resolveExternalLocation(batch, this._externalConfig);
+          } else {
+            dispatchLogOrError(batch, this._onLog);
+            continue;
+          }
+        }
+        yield extractBatchRows(batch);
+      }
+      if (!gotContinuation)
+        break;
     }
   }
-  async exchange(input) {
-    if (this._closed) {
-      throw new RpcError("ProtocolError", "Stream session is closed", "");
+  async _sendContinuation(token) {
+    const emptySchema = new Schema2([]);
+    const metadata = new Map;
+    metadata.set(STATE_KEY, token);
+    const structType = new Struct2(emptySchema.fields);
+    const data = makeData2({
+      type: structType,
+      length: 1,
+      children: [],
+      nullCount: 0
+    });
+    const batch = new RecordBatch2(emptySchema, data, metadata);
+    const body = serializeIpcStream(emptySchema, [batch]);
+    const resp = await this._post(`${this._baseUrl}${this._prefix}/${this._method}/exchange`, body);
+    if (resp.status === 401) {
+      throw new RpcError("AuthenticationError", "Authentication required", "");
     }
-    let inputSchema;
-    let batch;
-    if (input.length === 0) {
-      inputSchema = this._inputSchema ?? this._outputSchema;
-      const children = inputSchema.fields.map((f) => {
-        return makeData2({ type: f.type, length: 0, nullCount: 0 });
-      });
-      const structType = new Struct2(inputSchema.fields);
-      const data = makeData2({
-        type: structType,
-        length: 0,
-        children,
-        nullCount: 0
-      });
-      batch = new RecordBatch2(inputSchema, data);
-    } else {
-      const keys = Object.keys(input[0]);
-      const fields = keys.map((key) => {
-        let sample;
-        for (const row of input) {
-          if (row[key] != null) {
-            sample = row[key];
-            break;
-          }
-        }
-        const arrowType = inferArrowType(sample);
-        return new Field3(key, arrowType, true);
-      });
-      inputSchema = new Schema3(fields);
-      if (this._inputSchema) {
-        const cached = this._inputSchema;
-        if (cached.fields.length !== inputSchema.fields.length || cached.fields.some((f, i) => f.name !== inputSchema.fields[i].name)) {
-          throw new RpcError("ProtocolError", `Exchange input schema changed: expected [${cached.fields.map((f) => f.name).join(", ")}] ` + `but got [${inputSchema.fields.map((f) => f.name).join(", ")}]`, "");
-        }
+    return this._readResponse(resp);
+  }
+  close() {}
+}
+
+// src/client/uploadUrl.ts
+import { Field as Field3, Int64 as Int642, RecordBatchReader as RecordBatchReader4, Schema as Schema3 } from "@query-farm/apache-arrow";
+var UPLOAD_URL_METHOD = "__upload_url__";
+var UPLOAD_URL_PARAMS_SCHEMA = new Schema3([new Field3("count", new Int642, false)]);
+async function requestUploadUrls(baseUrl, prefix, count, authorization) {
+  const body = buildRequestIpc(UPLOAD_URL_PARAMS_SCHEMA, { count: BigInt(count) }, UPLOAD_URL_METHOD);
+  const headers = { "Content-Type": ARROW_CONTENT_TYPE };
+  if (authorization)
+    headers.Authorization = authorization;
+  const resp = await fetch(`${baseUrl}${prefix}/${UPLOAD_URL_METHOD}/init`, {
+    method: "POST",
+    headers,
+    body
+  });
+  if (resp.status === 404) {
+    throw new RpcError("NotSupported", "Server does not support upload URLs", "");
+  }
+  if (resp.status === 401) {
+    throw new RpcError("AuthenticationError", "Authentication required", "");
+  }
+  if (!resp.ok) {
+    throw new RpcError("HttpError", `__upload_url__/init failed: HTTP ${resp.status}`, "");
+  }
+  const respBody = new Uint8Array(await resp.arrayBuffer());
+  const reader = await RecordBatchReader4.from(respBody);
+  await reader.open();
+  const pairs = [];
+  for (const batch of reader.readAll()) {
+    if (batch.numRows === 0)
+      continue;
+    for (let r = 0;r < batch.numRows; r++) {
+      const uploadUrl = batch.getChildAt(0)?.get(r);
+      const downloadUrl = batch.getChildAt(1)?.get(r);
+      const expiresRaw = batch.getChildAt(2)?.get(r);
+      let expiresAt;
+      if (expiresRaw instanceof Date) {
+        expiresAt = expiresRaw;
+      } else if (typeof expiresRaw === "bigint") {
+        expiresAt = new Date(Number(expiresRaw / 1000n));
+      } else if (typeof expiresRaw === "number") {
+        expiresAt = new Date(expiresRaw);
       } else {
-        this._inputSchema = inputSchema;
+        expiresAt = new Date;
       }
-      const children = inputSchema.fields.map((f) => {
-        const values = input.map((row) => row[f.name]);
-        return vectorFromArray2(values, f.type).data[0];
-      });
-      const structType = new Struct2(inputSchema.fields);
-      const data = makeData2({
-        type: structType,
-        length: input.length,
-        children,
-        nullCount: 0
-      });
-      batch = new RecordBatch2(inputSchema, data);
+      pairs.push({ uploadUrl, downloadUrl, expiresAt });
     }
-    if (!this._inputWriter) {
-      this._inputWriter = new PipeIncrementalWriter(this._writeFn, inputSchema);
+  }
+  if (pairs.length === 0) {
+    throw new RpcError("ProtocolError", "Server returned no upload URLs", "");
+  }
+  return pairs;
+}
+async function buildPointerRequestBody(originalBody, downloadUrl) {
+  const reader = await RecordBatchReader4.from(originalBody);
+  await reader.open();
+  const schema2 = reader.schema;
+  if (!schema2) {
+    throw new RpcError("ProtocolError", "Original request body has no schema", "");
+  }
+  const batches = reader.readAll();
+  if (batches.length === 0) {
+    throw new RpcError("ProtocolError", "Original request body has no batches", "");
+  }
+  const original = batches[0];
+  const originalMeta = original.metadata ?? new Map;
+  const pointer = makeExternalLocationBatch(schema2, downloadUrl);
+  const merged = new Map(pointer.metadata ?? new Map);
+  const method = originalMeta.get(RPC_METHOD_KEY);
+  const version = originalMeta.get(REQUEST_VERSION_KEY) ?? REQUEST_VERSION;
+  if (method)
+    merged.set(RPC_METHOD_KEY, method);
+  merged.set(REQUEST_VERSION_KEY, version);
+  for (const [k, v] of originalMeta) {
+    if (!merged.has(k))
+      merged.set(k, v);
+  }
+  const { RecordBatch: RecordBatch3 } = await import("@query-farm/apache-arrow");
+  const pointerWithMeta = new RecordBatch3(schema2, pointer.data, merged);
+  return serializeIpcStream(schema2, [pointerWithMeta]);
+}
+async function externalizeRequestBody(body, opts) {
+  const pairs = await requestUploadUrls(opts.baseUrl, opts.prefix, 1, opts.authorization);
+  const pair = pairs[0];
+  if (opts.urlValidator) {
+    opts.urlValidator(pair.uploadUrl);
+    opts.urlValidator(pair.downloadUrl);
+  }
+  const putResp = await fetch(pair.uploadUrl, {
+    method: "PUT",
+    headers: { "Content-Type": ARROW_CONTENT_TYPE },
+    body
+  });
+  if (!putResp.ok) {
+    throw new RpcError("ExternalUploadFailed", `PUT to upload URL failed: HTTP ${putResp.status}`, "");
+  }
+  return buildPointerRequestBody(body, pair.downloadUrl);
+}
+
+// src/client/connect.ts
+function httpConnect(baseUrl, options) {
+  const prefix = (options?.prefix ?? "").replace(/\/+$/, "");
+  const onLog = options?.onLog;
+  const compressionLevel = options?.compressionLevel;
+  const authorization = options?.authorization;
+  const externalConfig = options?.externalLocation;
+  let methodCache = null;
+  let serverProtocolVersion = "";
+  let compressFn;
+  let decompressFn;
+  let compressionLoaded = false;
+  let capabilities = null;
+  function updateCapabilitiesFromResponse(resp) {
+    const next = parseCapabilitiesFromHeaders(resp.headers);
+    if (next.maxRequestBytes != null || next.uploadUrlSupport) {
+      capabilities = next;
     }
-    this._inputWriter.write(batch);
-    await this._ensureOutputStream();
-    try {
-      const outputBatch = await this._readOutputBatch();
-      if (outputBatch === null) {
-        return [];
-      }
-      return extractBatchRows(outputBatch);
-    } catch (e) {
-      await this._cleanup();
-      throw e;
+  }
+  async function maybeExternalize(body) {
+    const caps = isCapabilitySnapshotFresh(capabilities) ? capabilities : null;
+    if (!caps)
+      return body;
+    if (!caps.uploadUrlSupport)
+      return body;
+    if (caps.maxRequestBytes == null || body.byteLength <= caps.maxRequestBytes)
+      return body;
+    return externalizeRequestBody(body, {
+      baseUrl,
+      prefix,
+      authorization,
+      urlValidator: externalConfig?.urlValidator ?? null
+    });
+  }
+  async function postWithExternalization(url, body) {
+    const sendBody = await maybeExternalize(body);
+    let resp = await fetch(url, {
+      method: "POST",
+      headers: buildHeaders(),
+      body: await prepareBody(sendBody)
+    });
+    updateCapabilitiesFromResponse(resp);
+    if (resp.status === 413 && capabilities?.uploadUrlSupport && body.byteLength > 0) {
+      const externalized = await externalizeRequestBody(body, {
+        baseUrl,
+        prefix,
+        authorization,
+        urlValidator: externalConfig?.urlValidator ?? null
+      });
+      resp = await fetch(url, {
+        method: "POST",
+        headers: buildHeaders(),
+        body: await prepareBody(externalized)
+      });
+      updateCapabilitiesFromResponse(resp);
     }
+    return resp;
   }
-  async _cleanup() {
-    if (this._closed)
+  async function ensureCompression() {
+    if (compressionLoaded || compressionLevel == null)
       return;
-    this._closed = true;
-    if (this._inputWriter) {
-      this._inputWriter.close();
-      this._inputWriter = null;
-    }
     try {
-      if (this._outputStreamOpened) {
-        while (await this._reader.readNextBatch() !== null) {}
-      }
+      const mod = await Promise.resolve().then(() => (init_zstd(), exports_zstd));
+      compressFn = mod.zstdCompress;
+      decompressFn = mod.zstdDecompress;
     } catch {}
-    this._releaseBusy();
+    compressionLoaded = true;
   }
-  async* [Symbol.asyncIterator]() {
-    if (this._closed)
-      return;
-    try {
-      const tickSchema = new Schema3([]);
-      this._inputWriter = new PipeIncrementalWriter(this._writeFn, tickSchema);
-      const structType = new Struct2(tickSchema.fields);
-      const tickData = makeData2({
-        type: structType,
-        length: 0,
-        children: [],
-        nullCount: 0
-      });
-      const tickBatch = new RecordBatch2(tickSchema, tickData);
-      while (true) {
-        this._inputWriter.write(tickBatch);
-        await this._ensureOutputStream();
-        const outputBatch = await this._readOutputBatch();
-        if (outputBatch === null) {
-          break;
-        }
-        yield extractBatchRows(outputBatch);
-      }
-    } finally {
-      if (this._inputWriter) {
-        this._inputWriter.close();
-        this._inputWriter = null;
-      }
-      try {
-        if (this._outputStreamOpened) {
-          while (await this._reader.readNextBatch() !== null) {}
-        }
-      } catch {}
-      this._closed = true;
-      this._releaseBusy();
+  function buildHeaders() {
+    const headers = {
+      "Content-Type": ARROW_CONTENT_TYPE
+    };
+    if (compressionLevel != null && compressFn) {
+      headers["Content-Encoding"] = "zstd";
     }
-  }
-  close() {
-    if (this._closed)
-      return;
-    this._closed = true;
-    if (this._inputWriter) {
-      this._inputWriter.close();
-      this._inputWriter = null;
-    } else {
-      const emptySchema = new Schema3([]);
-      const ipc = serializeIpcStream(emptySchema, []);
-      this._writeFn(ipc);
+    if (compressionLevel != null && decompressFn) {
+      headers["Accept-Encoding"] = "zstd";
     }
-    const drainPromise = (async () => {
-      try {
-        if (!this._outputStreamOpened) {
-          const schema2 = await this._reader.openNextStream();
-          if (schema2) {
-            while (await this._reader.readNextBatch() !== null) {}
-          }
-        } else {
-          while (await this._reader.readNextBatch() !== null) {}
-        }
-      } catch {} finally {
-        this._releaseBusy();
-      }
-    })();
-    this._setDrainPromise(drainPromise);
-  }
-}
-function pipeConnect(readable, writable, options) {
-  const onLog = options?.onLog;
-  const externalConfig = options?.externalLocation;
-  let reader = null;
-  let readerPromise = null;
-  let methodCache = null;
-  let protocolName = "";
-  let serverProtocolVersion = "";
-  let _busy = false;
-  let _drainPromise = null;
-  let closed = false;
-  const writeFn = (bytes) => {
-    writable.write(bytes);
-    writable.flush?.();
-  };
-  async function ensureReader() {
-    if (reader)
-      return reader;
-    if (!readerPromise) {
-      readerPromise = IpcStreamReader.create(readable);
+    if (authorization) {
+      headers.Authorization = authorization;
     }
-    reader = await readerPromise;
-    return reader;
+    return headers;
   }
-  async function acquireBusy() {
-    if (_drainPromise) {
-      await _drainPromise;
-      _drainPromise = null;
-    }
-    if (_busy) {
-      throw new Error("Pipe transport is busy — another call or stream is in progress. " + "Pipe connections are single-threaded; wait for the current operation to complete.");
+  async function prepareBody(content) {
+    if (compressionLevel != null && compressFn) {
+      return await compressFn(content, compressionLevel);
     }
-    _busy = true;
+    return content;
   }
-  function releaseBusy() {
-    _busy = false;
+  function checkAuth(resp) {
+    if (resp.status === 401) {
+      throw new RpcError("AuthenticationError", "Authentication required", "");
+    }
   }
-  function setDrainPromise(p) {
-    _drainPromise = p;
+  async function readResponse(resp) {
+    let body = new Uint8Array(await resp.arrayBuffer());
+    if (resp.headers.get("Content-Encoding") === "zstd" && decompressFn) {
+      body = new Uint8Array(await decompressFn(body));
+    }
+    return body;
   }
   async function ensureMethodCache() {
     if (methodCache)
       return methodCache;
-    await acquireBusy();
-    try {
-      const emptySchema = new Schema3([]);
-      const body = buildRequestIpc(emptySchema, {}, DESCRIBE_METHOD_NAME);
-      writeFn(body);
-      const r = await ensureReader();
-      const response = await r.readStream();
-      if (!response) {
-        throw new Error("EOF reading __describe__ response");
-      }
-      const desc = await parseDescribeResponse(response.batches, onLog);
-      protocolName = desc.protocolName;
-      serverProtocolVersion = desc.protocolVersion;
-      methodCache = new Map(desc.methods.map((m) => [m.name, m]));
-      return methodCache;
-    } finally {
-      releaseBusy();
-    }
+    await ensureCompression();
+    const desc = await httpIntrospect(baseUrl, {
+      prefix,
+      authorization,
+      compressionLevel,
+      compressFn,
+      decompressFn
+    });
+    methodCache = new Map(desc.methods.map((m) => [m.name, m]));
+    serverProtocolVersion = desc.protocolVersion;
+    return methodCache;
   }
   return {
     async call(method, params) {
+      await ensureCompression();
       const methods = await ensureMethodCache();
-      await acquireBusy();
-      try {
-        const info = methods.get(method);
-        if (!info) {
-          throw new Error(`Unknown method: '${method}'`);
+      const info = methods.get(method);
+      if (!info) {
+        throw new Error(`Unknown method: '${method}'`);
+      }
+      const fullParams = { ...info.defaults ?? {}, ...params ?? {} };
+      const body = buildRequestIpc(info.paramsSchema, fullParams, method, { protocolVersion: serverProtocolVersion });
+      const resp = await postWithExternalization(`${baseUrl}${prefix}/${method}`, body);
+      checkAuth(resp);
+      const responseBody = await readResponse(resp);
+      const { batches } = await readResponseBatches(responseBody);
+      let resultBatch = null;
+      for (let batch of batches) {
+        if (batch.numRows === 0) {
+          if (isExternalLocationBatch(batch)) {
+            batch = await resolveExternalLocation(batch, externalConfig);
+          } else {
+            dispatchLogOrError(batch, onLog);
+            continue;
+          }
         }
-        const r = await ensureReader();
-        const fullParams = { ...info.defaults ?? {}, ...params ?? {} };
-        const body = buildRequestIpc(info.paramsSchema, fullParams, method, { protocolVersion: serverProtocolVersion });
-        writeFn(body);
-        const response = await r.readStream();
-        if (!response) {
-          throw new Error("EOF reading response");
+        resultBatch = batch;
+      }
+      if (!resultBatch) {
+        return null;
+      }
+      const rows = extractBatchRows(resultBatch);
+      if (rows.length === 0)
+        return null;
+      const result = rows[0];
+      if (info.resultSchema.fields.length === 0)
+        return null;
+      return result;
+    },
+    async stream(method, params) {
+      await ensureCompression();
+      const methods = await ensureMethodCache();
+      const info = methods.get(method);
+      if (!info) {
+        throw new Error(`Unknown method: '${method}'`);
+      }
+      const fullParams = { ...info.defaults ?? {}, ...params ?? {} };
+      const body = buildRequestIpc(info.paramsSchema, fullParams, method, { protocolVersion: serverProtocolVersion });
+      const resp = await postWithExternalization(`${baseUrl}${prefix}/${method}/init`, body);
+      checkAuth(resp);
+      const responseBody = await readResponse(resp);
+      let header = null;
+      let stateToken = null;
+      const pendingBatches = [];
+      let finished = false;
+      let streamSchema = null;
+      if (info.headerSchema) {
+        const reader = await readSequentialStreams(responseBody);
+        const headerStream = await reader.readStream();
+        if (headerStream) {
+          for (const batch of headerStream.batches) {
+            if (batch.numRows === 0) {
+              dispatchLogOrError(batch, onLog);
+              continue;
+            }
+            const rows = extractBatchRows(batch);
+            if (rows.length > 0) {
+              header = rows[0];
+            }
+          }
+        }
+        const dataStream = await reader.readStream();
+        if (dataStream) {
+          streamSchema = dataStream.schema;
         }
-        let resultBatch = null;
-        for (let batch of response.batches) {
-          if (batch.numRows === 0) {
-            if (isExternalLocationBatch(batch)) {
-              batch = await resolveExternalLocation(batch, externalConfig);
-            } else {
+        const headerErrorBatches = [];
+        if (dataStream) {
+          for (const batch of dataStream.batches) {
+            if (batch.numRows === 0) {
+              const token = batch.metadata?.get(STATE_KEY);
+              if (token) {
+                stateToken = token;
+                continue;
+              }
+              const level = batch.metadata?.get(LOG_LEVEL_KEY);
+              if (level === "EXCEPTION") {
+                headerErrorBatches.push(batch);
+                continue;
+              }
               dispatchLogOrError(batch, onLog);
               continue;
             }
+            pendingBatches.push(batch);
           }
-          resultBatch = batch;
         }
-        if (!resultBatch) {
-          return null;
+        if (headerErrorBatches.length > 0) {
+          if (pendingBatches.length > 0 || stateToken !== null) {
+            pendingBatches.push(...headerErrorBatches);
+          } else {
+            for (const batch of headerErrorBatches) {
+              dispatchLogOrError(batch, onLog);
+            }
+          }
         }
-        const rows = extractBatchRows(resultBatch);
-        if (rows.length === 0)
-          return null;
-        if (info.resultSchema.fields.length === 0)
-          return null;
-        return rows[0];
-      } finally {
-        releaseBusy();
-      }
-    },
-    async stream(method, params) {
-      const methods = await ensureMethodCache();
-      await acquireBusy();
-      try {
-        const info = methods.get(method);
-        if (!info) {
-          throw new Error(`Unknown method: '${method}'`);
+        if (!dataStream && !stateToken) {
+          finished = true;
         }
-        const r = await ensureReader();
-        const fullParams = { ...info.defaults ?? {}, ...params ?? {} };
-        const body = buildRequestIpc(info.paramsSchema, fullParams, method, { protocolVersion: serverProtocolVersion });
-        writeFn(body);
-        let header = null;
-        if (info.headerSchema) {
-          const headerStream = await r.readStream();
-          if (headerStream) {
-            for (const batch of headerStream.batches) {
-              if (batch.numRows === 0) {
-                dispatchLogOrError(batch, onLog);
-                continue;
-              }
-              const rows = extractBatchRows(batch);
-              if (rows.length > 0) {
-                header = rows[0];
-              }
+      } else {
+        const { schema: responseSchema, batches } = await readResponseBatches(responseBody);
+        streamSchema = responseSchema;
+        const errorBatches = [];
+        for (const batch of batches) {
+          if (batch.numRows === 0) {
+            const token = batch.metadata?.get(STATE_KEY);
+            if (token) {
+              stateToken = token;
+              continue;
+            }
+            const level = batch.metadata?.get(LOG_LEVEL_KEY);
+            if (level === "EXCEPTION") {
+              errorBatches.push(batch);
+              continue;
             }
+            dispatchLogOrError(batch, onLog);
+            continue;
           }
+          pendingBatches.push(batch);
         }
-        const outputSchema = info.outputSchema ?? info.resultSchema;
-        return new PipeStreamSession({
-          reader: r,
-          writeFn,
-          onLog,
-          header,
-          outputSchema,
-          releaseBusy,
-          setDrainPromise,
-          externalConfig
-        });
-      } catch (e) {
-        try {
-          const r = await ensureReader();
-          const emptySchema = new Schema3([]);
-          const ipc = serializeIpcStream(emptySchema, []);
-          writeFn(ipc);
-          const outStream = await r.readStream();
-        } catch {}
-        releaseBusy();
-        throw e;
+        if (errorBatches.length > 0) {
+          if (pendingBatches.length > 0 || stateToken !== null) {
+            pendingBatches.push(...errorBatches);
+          } else {
+            for (const batch of errorBatches) {
+              dispatchLogOrError(batch, onLog);
+            }
+          }
+        }
+      }
+      if (pendingBatches.length === 0 && stateToken === null) {
+        finished = true;
       }
+      const outputSchema = (streamSchema && streamSchema.fields.length > 0 ? streamSchema : null) ?? (pendingBatches.length > 0 ? pendingBatches[0].schema : null) ?? info.outputSchema ?? info.resultSchema;
+      return new HttpStreamSession({
+        baseUrl,
+        prefix,
+        method,
+        stateToken,
+        outputSchema,
+        inputSchema: info.inputSchema,
+        onLog,
+        pendingBatches,
+        finished,
+        header,
+        compressionLevel,
+        compressFn,
+        decompressFn,
+        authorization,
+        externalConfig,
+        postFn: postWithExternalization
+      });
     },
     async describe() {
-      const methods = await ensureMethodCache();
-      return {
-        protocolName,
-        protocolVersion: serverProtocolVersion,
-        methods: [...methods.values()]
-      };
+      await ensureCompression();
+      return httpIntrospect(baseUrl, {
+        prefix,
+        authorization,
+        compressionLevel,
+        compressFn,
+        decompressFn
+      });
     },
-    close() {
-      if (closed)
-        return;
-      closed = true;
-      writable.end();
-    }
+    close() {}
   };
 }
-function subprocessConnect(cmd, options) {
-  const proc = Bun.spawn(cmd, {
-    stdin: "pipe",
-    stdout: "pipe",
-    stderr: options?.stderr ?? "ignore",
-    cwd: options?.cwd,
-    env: options?.env ? { ...process.env, ...options.env } : undefined
-  });
-  const stdout = proc.stdout;
-  const writable = {
-    write(data) {
-      proc.stdin.write(data);
-    },
-    flush() {
-      proc.stdin.flush();
-    },
-    end() {
-      proc.stdin.end();
-    }
-  };
-  const client = pipeConnect(stdout, writable, {
-    onLog: options?.onLog,
-    externalLocation: options?.externalLocation
-  });
-  const originalClose = client.close;
-  client.close = () => {
-    originalClose.call(client);
-    try {
-      proc.kill();
-    } catch {}
+// src/client/oauth.ts
+function parseMetadataJson(json) {
+  const result = {
+    resource: json.resource,
+    authorizationServers: json.authorization_servers
   };
-  return client;
+  if (json.scopes_supported)
+    result.scopesSupported = json.scopes_supported;
+  if (json.bearer_methods_supported)
+    result.bearerMethodsSupported = json.bearer_methods_supported;
+  if (json.resource_signing_alg_values_supported)
+    result.resourceSigningAlgValuesSupported = json.resource_signing_alg_values_supported;
+  if (json.resource_name)
+    result.resourceName = json.resource_name;
+  if (json.resource_documentation)
+    result.resourceDocumentation = json.resource_documentation;
+  if (json.resource_policy_uri)
+    result.resourcePolicyUri = json.resource_policy_uri;
+  if (json.resource_tos_uri)
+    result.resourceTosUri = json.resource_tos_uri;
+  if (json.client_id)
+    result.clientId = json.client_id;
+  if (json.client_secret)
+    result.clientSecret = json.client_secret;
+  if (json.use_id_token_as_bearer)
+    result.useIdTokenAsBearer = json.use_id_token_as_bearer;
+  if (json.device_code_client_id)
+    result.deviceCodeClientId = json.device_code_client_id;
+  if (json.device_code_client_secret)
+    result.deviceCodeClientSecret = json.device_code_client_secret;
+  return result;
+}
+async function httpOAuthMetadata(baseUrl, prefix) {
+  const effectivePrefix = (prefix ?? "").replace(/\/+$/, "");
+  const metadataUrl = `${baseUrl.replace(/\/+$/, "")}/.well-known/oauth-protected-resource${effectivePrefix}`;
+  try {
+    return await fetchOAuthMetadata(metadataUrl);
+  } catch {
+    return null;
+  }
+}
+async function fetchOAuthMetadata(metadataUrl) {
+  const response = await fetch(metadataUrl);
+  if (!response.ok) {
+    throw new Error(`Failed to fetch OAuth metadata from ${metadataUrl}: ${response.status}`);
+  }
+  const json = await response.json();
+  return parseMetadataJson(json);
+}
+function parseResourceMetadataUrl(wwwAuthenticate) {
+  const bearerMatch = wwwAuthenticate.match(/^Bearer\s+(.*)/i);
+  if (!bearerMatch)
+    return null;
+  const params = bearerMatch[1];
+  const metadataMatch = params.match(/resource_metadata="([^"]+)"/);
+  if (!metadataMatch)
+    return null;
+  return metadataMatch[1];
+}
+function parseClientId(wwwAuthenticate) {
+  const bearerMatch = wwwAuthenticate.match(/^Bearer\s+(.*)/i);
+  if (!bearerMatch)
+    return null;
+  const params = bearerMatch[1];
+  const clientIdMatch = params.match(/client_id="([^"]+)"/);
+  if (!clientIdMatch)
+    return null;
+  return clientIdMatch[1];
+}
+function parseClientSecret(wwwAuthenticate) {
+  const bearerMatch = wwwAuthenticate.match(/^Bearer\s+(.*)/i);
+  if (!bearerMatch)
+    return null;
+  const params = bearerMatch[1];
+  const match = params.match(/client_secret="([^"]+)"/);
+  if (!match)
+    return null;
+  return match[1];
+}
+function parseUseIdTokenAsBearer(wwwAuthenticate) {
+  const bearerMatch = wwwAuthenticate.match(/^Bearer\s+(.*)/i);
+  if (!bearerMatch)
+    return false;
+  const params = bearerMatch[1];
+  const match = params.match(/use_id_token_as_bearer="([^"]+)"/);
+  if (!match)
+    return false;
+  return match[1] === "true";
+}
+function parseDeviceCodeClientId(wwwAuthenticate) {
+  const bearerMatch = wwwAuthenticate.match(/^Bearer\s+(.*)/i);
+  if (!bearerMatch)
+    return null;
+  const params = bearerMatch[1];
+  const match = params.match(/device_code_client_id="([^"]+)"/);
+  if (!match)
+    return null;
+  return match[1];
+}
+function parseDeviceCodeClientSecret(wwwAuthenticate) {
+  const bearerMatch = wwwAuthenticate.match(/^Bearer\s+(.*)/i);
+  if (!bearerMatch)
+    return null;
+  const params = bearerMatch[1];
+  const match = params.match(/device_code_client_secret="([^"]+)"/);
+  if (!match)
+    return null;
+  return match[1];
 }
 // src/http/auth.ts
 function oauthResourceMetadataToJson(metadata) {
@@ -3304,6 +3335,7 @@ var TransportKind;
   TransportKind2["PIPE"] = "pipe";
   TransportKind2["HTTP"] = "http";
   TransportKind2["UNIX"] = "unix";
+  TransportKind2["TCP"] = "tcp";
 })(TransportKind ||= {});
 var EMPTY_COOKIES = new Map;
 function cookieNotUnaryHttpError() {
@@ -8632,17 +8664,20 @@ class VgiRpcServer {
 ` + `  Direction: ${direction}`);
   }
   async run() {
-    const stdin = process.stdin;
     if (process.stdin.isTTY || process.stdout.isTTY) {
       process.stderr.write("WARNING: This process communicates via Arrow IPC on stdin/stdout " + `and is not intended to be run interactively.
 ` + "It should be launched as a subprocess by an RPC client " + `(e.g. vgi_rpc.connect()).
 `);
     }
-    const reader = await IpcStreamReader.create(stdin);
-    const writer = new IpcStreamWriter;
+    const stdin = process.stdin;
+    await this.serveConnection(stdin);
+  }
+  async serveConnection(readable, writable, transportKind = "pipe" /* PIPE */) {
+    const reader = await IpcStreamReader.create(readable);
+    const writer = new IpcStreamWriter(writable);
     try {
       while (true) {
-        await this.notifyTransport("pipe" /* PIPE */);
+        await this.notifyTransport(transportKind);
         await this.serveOne(reader, writer);
       }
     } catch (e) {
@@ -8759,6 +8794,17 @@ class VgiRpcServer {
     }
   }
 }
+// src/serve-stream.ts
+//! Serve a protocol over a caller-provided byte-stream pair — the stream
+//! sibling of `serveTcp` / `serveUnix`, with no socket/listener of its own.
+//!
+//! Useful for transports the launcher helpers don't cover: a Web Worker /
+//! `MessagePort` bridge (postMessage), an in-memory pipe, or a pre-connected
+//! socket. The host side already has this symmetry via `pipeConnect`.
+async function serveStream(protocol, options) {
+  const server = new VgiRpcServer(protocol, options.serverOptions);
+  await server.serveConnection(options.readable, options.writable, options.transportKind);
+}
 // src/launcher/hash.ts
 var HASH_LEN = 16;
 function canonicalJson(value) {
@@ -9236,11 +9282,236 @@ function onceExit(proc) {
 function delay(ms) {
   return new Promise((r) => setTimeout(r, Math.max(0, ms)));
 }
+// src/launcher/serve-tcp.ts
+import { createServer } from "node:net";
+var EMPTY_SCHEMA6 = schema([]);
+async function serveTcp(protocol, options = {}) {
+  const host = options.host ?? "127.0.0.1";
+  const requestedPort = options.port ?? 0;
+  const idleTimeoutS = options.idleTimeout ?? 300;
+  const startupGraceS = options.startupGraceSeconds ?? 5;
+  const protocolVersion = options.protocolVersion ?? "";
+  const serverId = options.serverId ?? crypto.randomUUID().replace(/-/g, "").slice(0, 12);
+  const enableDescribe = options.enableDescribe ?? true;
+  const dispatchHook = options.dispatchHook ?? null;
+  const externalConfig = options.externalLocation;
+  const onServeStart = options.onServeStart ?? null;
+  const backlog = options.backlog ?? 128;
+  const announcementSink = options.announcementSink ?? process.stdout;
+  let describePromise = null;
+  function describeInfo() {
+    if (!describePromise) {
+      describePromise = buildDescribeBatch(protocol.name, protocol.getMethods(), serverId).then(({ batch, metadata }) => ({
+        batch,
+        protocolHash: metadata.get("vgi_rpc.protocol_hash") ?? ""
+      }));
+    }
+    return describePromise;
+  }
+  let serveStartFired = false;
+  async function notifyTransport() {
+    if (serveStartFired)
+      return;
+    if (onServeStart) {
+      await onServeStart("tcp" /* TCP */);
+    }
+    serveStartFired = true;
+  }
+  const server = createServer({ allowHalfOpen: false });
+  let activeConnections = 0;
+  let idleTimer = null;
+  let resolveDone = () => {};
+  let rejectDone = () => {};
+  const done = new Promise((resolve, reject) => {
+    resolveDone = resolve;
+    rejectDone = reject;
+  });
+  let stopped = false;
+  function armIdleTimer() {
+    if (idleTimeoutS <= 0)
+      return;
+    if (idleTimer)
+      clearTimeout(idleTimer);
+    idleTimer = setTimeout(() => {
+      if (activeConnections === 0 && !stopped) {
+        shutdown();
+      }
+    }, idleTimeoutS * 1000);
+  }
+  function disarmIdleTimer() {
+    if (idleTimer) {
+      clearTimeout(idleTimer);
+      idleTimer = null;
+    }
+  }
+  async function shutdown() {
+    if (stopped)
+      return;
+    stopped = true;
+    disarmIdleTimer();
+    await new Promise((resolve) => {
+      server.close(() => resolve());
+    });
+    resolveDone();
+  }
+  server.on("connection", (socket) => {
+    try {
+      socket.setNoDelay(true);
+    } catch {}
+    activeConnections += 1;
+    disarmIdleTimer();
+    handleConnection(socket).catch((err2) => {
+      process.stderr.write(`vgi-rpc/tcp: connection failed: ${err2?.message ?? err2}
+`);
+    }).finally(() => {
+      activeConnections -= 1;
+      socket.destroy();
+      if (activeConnections === 0 && !stopped) {
+        armIdleTimer();
+      }
+    });
+  });
+  server.on("error", (err2) => {
+    if (stopped)
+      return;
+    rejectDone(err2);
+  });
+  async function handleConnection(socket) {
+    const reader = await IpcStreamReader.create(socket);
+    const writer = new IpcStreamWriter(socket);
+    try {
+      await notifyTransport();
+      while (true) {
+        try {
+          await serveOnce(reader, writer);
+        } catch (e) {
+          const err2 = e;
+          if (err2?.message?.includes("closed") || err2?.message?.includes("Expected Schema Message") || err2?.message?.includes("null or length 0") || err2?.message?.includes("EOF") || err2?.code === "EPIPE" || err2?.code === "ERR_STREAM_PREMATURE_CLOSE" || err2?.code === "ERR_STREAM_DESTROYED") {
+            return;
+          }
+          throw e;
+        }
+      }
+    } finally {
+      try {
+        await reader.cancel();
+      } catch {}
+    }
+  }
+  async function serveOnce(reader, writer) {
+    const stream = await reader.readStream();
+    if (!stream) {
+      throw new Error("EOF");
+    }
+    const { schema: schema2, batches } = stream;
+    if (batches.length === 0) {
+      const err2 = new RpcError("ProtocolError", "Request stream contains no batches", "");
+      const errBatch = buildErrorBatch(EMPTY_SCHEMA6, err2, serverId, null);
+      await writer.writeStream(EMPTY_SCHEMA6, [errBatch]);
+      return;
+    }
+    const batch = batches[0];
+    let methodName;
+    let params;
+    let requestId;
+    try {
+      const parsed = parseRequest(schema2, batch);
+      methodName = parsed.methodName;
+      params = parsed.params;
+      requestId = parsed.requestId;
+    } catch (e) {
+      const errBatch = buildErrorBatch(EMPTY_SCHEMA6, e, serverId, null);
+      await writer.writeStream(EMPTY_SCHEMA6, [errBatch]);
+      if (e instanceof VersionError || e instanceof RpcError)
+        return;
+      throw e;
+    }
+    if (methodName === DESCRIBE_METHOD_NAME && enableDescribe) {
+      const { batch: descBatch } = await describeInfo();
+      await writer.writeStream(descBatch.schema, [descBatch]);
+      return;
+    }
+    const methods = protocol.getMethods();
+    const method = methods.get(methodName);
+    if (!method) {
+      const available = [...methods.keys()].sort();
+      const err2 = new Error(`Unknown method: '${methodName}'. Available methods: [${available.join(", ")}]`);
+      const errBatch = buildErrorBatch(EMPTY_SCHEMA6, err2, serverId, requestId);
+      await writer.writeStream(EMPTY_SCHEMA6, [errBatch]);
+      return;
+    }
+    const methodType = method.type === "unary" /* UNARY */ ? "unary" : "stream";
+    let requestData;
+    try {
+      requestData = serializeBatch(batch);
+    } catch {}
+    const { protocolHash } = await describeInfo();
+    const info = {
+      method: methodName,
+      methodType,
+      serverId,
+      requestId,
+      protocol: protocol.name,
+      protocolHash,
+      protocolVersion,
+      kind: "tcp" /* TCP */,
+      principal: "",
+      authDomain: "",
+      authenticated: false,
+      remoteAddr: "",
+      requestData
+    };
+    const stats = {
+      inputBatches: 0,
+      outputBatches: 0,
+      inputRows: 0,
+      outputRows: 0,
+      inputBytes: 0,
+      outputBytes: 0
+    };
+    const token = dispatchHook?.onDispatchStart(info);
+    let dispatchError;
+    applyDefaults(params, method.defaults);
+    try {
+      if (method.type === "unary" /* UNARY */) {
+        await dispatchUnary(method, params, writer, serverId, requestId, externalConfig, "tcp" /* TCP */);
+      } else {
+        await dispatchStream(method, params, writer, reader, serverId, requestId, externalConfig, "tcp" /* TCP */);
+      }
+    } catch (e) {
+      dispatchError = e instanceof Error ? e : new Error(String(e));
+      throw e;
+    } finally {
+      dispatchHook?.onDispatchEnd(token, info, stats, dispatchError);
+    }
+  }
+  await new Promise((resolve, reject) => {
+    server.listen({ host, port: requestedPort, backlog }, () => resolve());
+    server.once("error", (err2) => reject(err2));
+  });
+  const address = server.address();
+  const boundPort = typeof address === "object" && address ? address.port : requestedPort;
+  options.onBound?.(host, boundPort);
+  announcementSink.write(`TCP:${host}:${boundPort}
+`);
+  if (idleTimeoutS > 0) {
+    setTimeout(() => {
+      if (activeConnections === 0 && !stopped)
+        armIdleTimer();
+    }, startupGraceS * 1000).unref?.();
+  }
+  return {
+    host,
+    port: boundPort,
+    stop: shutdown,
+    done
+  };
+}
 // src/launcher/serve-unix.ts
 import { existsSync as existsSync2, unlinkSync as unlinkSync3 } from "node:fs";
-import { createServer } from "node:net";
+import { createServer as createServer2 } from "node:net";
 import * as path2 from "node:path";
-var EMPTY_SCHEMA6 = schema([]);
+var EMPTY_SCHEMA7 = schema([]);
 async function serveUnix(protocol, options) {
   const sockPath = path2.resolve(options.unixPath);
   const idleTimeoutS = options.idleTimeout ?? 300;
@@ -9277,7 +9548,7 @@ async function serveUnix(protocol, options) {
     }
     serveStartFired = true;
   }
-  const server = createServer({ allowHalfOpen: false });
+  const server = createServer2({ allowHalfOpen: false });
   let activeConnections = 0;
   let idleTimer = null;
   let resolveDone = () => {};
@@ -9366,8 +9637,8 @@ async function serveUnix(protocol, options) {
     const { schema: schema2, batches } = stream;
     if (batches.length === 0) {
       const err2 = new RpcError("ProtocolError", "Request stream contains no batches", "");
-      const errBatch = buildErrorBatch(EMPTY_SCHEMA6, err2, serverId, null);
-      await writer.writeStream(EMPTY_SCHEMA6, [errBatch]);
+      const errBatch = buildErrorBatch(EMPTY_SCHEMA7, err2, serverId, null);
+      await writer.writeStream(EMPTY_SCHEMA7, [errBatch]);
       return;
     }
     const batch = batches[0];
@@ -9380,8 +9651,8 @@ async function serveUnix(protocol, options) {
       params = parsed.params;
       requestId = parsed.requestId;
     } catch (e) {
-      const errBatch = buildErrorBatch(EMPTY_SCHEMA6, e, serverId, null);
-      await writer.writeStream(EMPTY_SCHEMA6, [errBatch]);
+      const errBatch = buildErrorBatch(EMPTY_SCHEMA7, e, serverId, null);
+      await writer.writeStream(EMPTY_SCHEMA7, [errBatch]);
       if (e instanceof VersionError || e instanceof RpcError)
         return;
       throw e;
@@ -9396,8 +9667,8 @@ async function serveUnix(protocol, options) {
     if (!method) {
       const available = [...methods.keys()].sort();
       const err2 = new Error(`Unknown method: '${methodName}'. Available methods: [${available.join(", ")}]`);
-      const errBatch = buildErrorBatch(EMPTY_SCHEMA6, err2, serverId, requestId);
-      await writer.writeStream(EMPTY_SCHEMA6, [errBatch]);
+      const errBatch = buildErrorBatch(EMPTY_SCHEMA7, err2, serverId, requestId);
+      await writer.writeStream(EMPTY_SCHEMA7, [errBatch]);
       return;
     }
     const methodType = method.type === "unary" /* UNARY */ ? "unary" : "stream";
@@ -9476,11 +9747,14 @@ export {
   uint162 as uint16,
   tryAcquireLock,
   toSchema,
+  tcpConnect,
   subprocessConnect,
   str,
   statusRows,
   socketPaths,
   serveUnix,
+  serveTcp,
+  serveStream,
   resolveExternalLocation,
   probeSocket,
   pipeConnect,
@@ -9561,4 +9835,4 @@ export {
   ARROW_CONTENT_TYPE
 };
 
-//# debugId=4D9D32B49233679B64756E2164756E21
+//# debugId=FD35C475AB9ACBBD64756E2164756E21