@shivaedev/server 0.0.0-stage → 0.1.0

package/src/AppHostFactory.ts

@@ -0,0 +1,121 @@
+import type { Effect, Layer } from "effect";
+import type { Rpc } from "effect/rpc";
+import type { SessionShape } from "@shivaedev/identity/server/session.ts";
+import type { HostPreflight } from "#AppHostInput.ts";
+import type { AppDatabaseOptions, AppHostOptions, AppHttpHostOptions, AppLocalHostOptions } from "#appHost.ts";
+import type { appHostHttp, deferredHost } from "#appHostHttp.ts";
+
+type PreflightHost<THost extends Layer.Any, TServices, TError, TRequirements> = Layer.Layer<
+	Layer.Success<THost> | TServices,
+	Layer.Error<THost> | TError,
+	Exclude<Layer.Services<THost>, TServices> | TRequirements
+>;
+
+export interface AppHostFactory {
+	<
+		TRpcs extends Rpc.Any,
+		THandlers,
+		THandlerError,
+		THandlerRequirements,
+		TServices = never,
+		TServiceError = never,
+		TServiceRequirements = never,
+		TMigrations = never,
+		TSession extends SessionShape = SessionShape,
+		TApplicationError = never,
+		TApplicationRequirements = never,
+		TPreflight = never,
+		TPreflightError = never,
+		TPreflightRequirements = never,
+	>(
+		options: HostPreflight<TPreflight, TPreflightError, TPreflightRequirements> &
+			(
+				| (AppDatabaseOptions<TMigrations> & {
+						readonly application: Effect.Effect<
+							AppHttpHostOptions<TRpcs, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements, TSession>,
+							TApplicationError,
+							TApplicationRequirements
+						>;
+				  })
+				| AppHostOptions<
+						TRpcs,
+						THandlers,
+						THandlerError,
+						THandlerRequirements,
+						TServices,
+						TServiceError,
+						TServiceRequirements,
+						TMigrations,
+						TSession,
+						TPreflight,
+						TPreflightError,
+						TPreflightRequirements
+				  >
+				| AppLocalHostOptions<
+						TRpcs,
+						THandlers,
+						THandlerError,
+						THandlerRequirements,
+						TServices,
+						TServiceError,
+						TServiceRequirements,
+						TMigrations,
+						TPreflight,
+						TPreflightError,
+						TPreflightRequirements
+				  >
+			),
+	): PreflightHost<
+		ReturnType<
+			typeof deferredHost<
+				TRpcs,
+				THandlers,
+				THandlerError,
+				THandlerRequirements,
+				TServices,
+				TServiceError,
+				TServiceRequirements,
+				TMigrations,
+				TSession,
+				TApplicationError,
+				TApplicationRequirements
+			>
+		>,
+		NoInfer<TPreflight>,
+		NoInfer<TPreflightError>,
+		NoInfer<TPreflightRequirements>
+	>;
+
+	<
+		TRpcs extends Rpc.Any,
+		THandlers,
+		THandlerError,
+		THandlerRequirements,
+		TServices = never,
+		TServiceError = never,
+		TServiceRequirements = never,
+		TSession extends SessionShape = SessionShape,
+		TPreflight = never,
+		TPreflightError = never,
+		TPreflightRequirements = never,
+	>(
+		options: AppHttpHostOptions<
+			TRpcs,
+			THandlers,
+			THandlerError,
+			THandlerRequirements,
+			TServices,
+			TServiceError,
+			TServiceRequirements,
+			TSession,
+			TPreflight,
+			TPreflightError,
+			TPreflightRequirements
+		>,
+	): PreflightHost<
+		ReturnType<typeof appHostHttp<TRpcs, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements, TSession>>,
+		NoInfer<TPreflight>,
+		NoInfer<TPreflightError>,
+		NoInfer<TPreflightRequirements>
+	>;
+}

package/src/AppHostInput.ts

@@ -0,0 +1,74 @@
+import type { Effect, Layer } from "effect";
+import type { Rpc } from "effect/rpc";
+import type { SessionShape } from "@shivaedev/identity/server/session.ts";
+import type { AppDatabaseOptions, AppHostOptions, AppHttpHostOptions, AppLocalHostOptions } from "#appHost.ts";
+
+export type HostPreflight<TServices = never, TError = never, TRequirements = never> =
+	| { readonly preflight: Layer.Layer<TServices, TError, TRequirements> }
+	| ([TServices | TError | TRequirements] extends [never] ? { readonly preflight?: never } : never);
+
+export type AppHostInput<
+	TRpcs extends Rpc.Any,
+	THandlers,
+	THandlerError,
+	THandlerRequirements,
+	TServices = never,
+	TServiceError = never,
+	TServiceRequirements = never,
+	TMigrations = never,
+	TSession extends SessionShape = SessionShape,
+	TApplicationError = never,
+	TApplicationRequirements = never,
+	TPreflight = never,
+	TPreflightError = never,
+	TPreflightRequirements = never,
+> = HostPreflight<TPreflight, TPreflightError, TPreflightRequirements> &
+	(
+		| (AppDatabaseOptions<TMigrations> & {
+				readonly application: Effect.Effect<
+					AppHttpHostOptions<TRpcs, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements, TSession>,
+					TApplicationError,
+					TApplicationRequirements
+				>;
+		  })
+		| AppHostOptions<
+				TRpcs,
+				THandlers,
+				THandlerError,
+				THandlerRequirements,
+				TServices,
+				TServiceError,
+				TServiceRequirements,
+				TMigrations,
+				TSession,
+				TPreflight,
+				TPreflightError,
+				TPreflightRequirements
+		  >
+		| AppLocalHostOptions<
+				TRpcs,
+				THandlers,
+				THandlerError,
+				THandlerRequirements,
+				TServices,
+				TServiceError,
+				TServiceRequirements,
+				TMigrations,
+				TPreflight,
+				TPreflightError,
+				TPreflightRequirements
+		  >
+		| AppHttpHostOptions<
+				TRpcs,
+				THandlers,
+				THandlerError,
+				THandlerRequirements,
+				TServices,
+				TServiceError,
+				TServiceRequirements,
+				TSession,
+				TPreflight,
+				TPreflightError,
+				TPreflightRequirements
+		  >
+	);

package/src/MigrationOptions.ts

@@ -0,0 +1,15 @@
+import type { Duration } from "effect";
+import type { Migrator } from "effect/sql";
+import type { SchemaComponent } from "@shivaedev/sql/SchemaComponent.ts";
+
+export interface MigrationOptions<R = never> {
+	readonly components?: readonly SchemaComponent<R>[];
+	readonly loader: Migrator.Loader<R>;
+	readonly lockTimeout?: Duration.Input;
+	readonly mode?: "migrate" | "check" | "wait";
+	readonly pollInterval?: Duration.Input;
+	readonly progressInterval?: Duration.Input;
+	readonly release?: string;
+	readonly table?: string;
+	readonly waitTimeout?: Duration.Input;
+}

package/src/RedactionPolicy.ts

@@ -0,0 +1,4 @@
+import { Context } from "effect";
+import { isSensitiveKey, type SensitiveKey } from "@shivaedev/errors/sensitive.ts";
+
+export const RedactionPolicy = Context.Reference<SensitiveKey>("@shivaedev/server/RedactionPolicy", { defaultValue: () => isSensitiveKey });

package/src/appHost.ts

@@ -0,0 +1,117 @@
+import { Context, type Effect, Layer } from "effect";
+import type { Rpc } from "effect/rpc";
+import type { makeLiveServer } from "@shivaedev/contract/makeLiveServer.ts";
+import type { SessionPolicy, SessionShape } from "@shivaedev/identity/server/session.ts";
+import type { AppHostFactory } from "#AppHostFactory.ts";
+import type { AppHostInput, HostPreflight } from "#AppHostInput.ts";
+import { appHostHttp, deferredHost, migratedHost } from "#appHostHttp.ts";
+import { type DatabaseConfig, databaseLayer } from "#databaseLayer.ts";
+import type { HostOptions, HostPolicy } from "#hostOptions.ts";
+import type { MigrationOptions } from "#MigrationOptions.ts";
+
+export class AppChanges extends Context.Service<AppChanges, Effect.Success<typeof makeLiveServer>>()("@shivaedev/server/AppChanges") {}
+export interface AppDatabaseOptions<R = never> {
+	readonly config?: DatabaseConfig;
+	readonly migrations: MigrationOptions<R>;
+}
+
+export function appDatabase<R>(options: AppDatabaseOptions<R>) {
+	return databaseLayer(options, AppChanges);
+}
+
+export type AppHostOptions<
+	TRpcs extends Rpc.Any,
+	THandlers,
+	THandlerError,
+	THandlerRequirements,
+	TServices = never,
+	TServiceError = never,
+	TServiceRequirements = never,
+	TMigrations = never,
+	TSession extends SessionShape = SessionShape,
+	TPreflight = never,
+	TPreflightError = never,
+	TPreflightRequirements = never,
+> = HostPreflight<TPreflight, TPreflightError, TPreflightRequirements> &
+	HostOptions<TRpcs, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements> & {
+		readonly migrations: AppDatabaseOptions<TMigrations>["migrations"];
+		readonly policy?: undefined;
+		readonly sessions: SessionPolicy<TSession>;
+	};
+
+export type AppLocalHostOptions<
+	TRpcs extends Rpc.Any,
+	THandlers,
+	THandlerError,
+	THandlerRequirements,
+	TServices = never,
+	TServiceError = never,
+	TServiceRequirements = never,
+	TMigrations = never,
+	TPreflight = never,
+	TPreflightError = never,
+	TPreflightRequirements = never,
+> = HostPreflight<TPreflight, TPreflightError, TPreflightRequirements> &
+	HostOptions<TRpcs, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements> & {
+		readonly migrations: AppDatabaseOptions<TMigrations>["migrations"];
+		readonly policy: "loopback";
+		readonly sessions?: never;
+	};
+
+export type AppHttpHostOptions<
+	TRpcs extends Rpc.Any,
+	THandlers,
+	THandlerError,
+	THandlerRequirements,
+	TServices = never,
+	TServiceError = never,
+	TServiceRequirements = never,
+	TSession extends SessionShape = SessionShape,
+	TPreflight = never,
+	TPreflightError = never,
+	TPreflightRequirements = never,
+> = HostPreflight<TPreflight, TPreflightError, TPreflightRequirements> &
+	HostOptions<TRpcs, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements> &
+	HostPolicy<TSession> & { readonly migrations?: undefined };
+export const appHost: AppHostFactory = <
+	TRpcs extends Rpc.Any,
+	THandlers,
+	THandlerError,
+	THandlerRequirements,
+	TServices = never,
+	TServiceError = never,
+	TServiceRequirements = never,
+	TMigrations = never,
+	TSession extends SessionShape = SessionShape,
+	TApplicationError = never,
+	TApplicationRequirements = never,
+	TPreflight = never,
+	TPreflightError = never,
+	TPreflightRequirements = never,
+>(
+	options: AppHostInput<
+		TRpcs,
+		THandlers,
+		THandlerError,
+		THandlerRequirements,
+		TServices,
+		TServiceError,
+		TServiceRequirements,
+		TMigrations,
+		TSession,
+		TApplicationError,
+		TApplicationRequirements,
+		TPreflight,
+		TPreflightError,
+		TPreflightRequirements
+	>,
+) => {
+	if ("application" in options) {
+		return deferredHost(options.application, appDatabase(options), AppChanges).pipe(Layer.provideMerge(options.preflight ?? Layer.empty));
+	}
+	return options.migrations === undefined
+		? appHostHttp(options, AppChanges).pipe(Layer.provideMerge(options.preflight ?? Layer.empty))
+		: migratedHost({ ...options, migrations: options.migrations }, appDatabase({ ...options, migrations: options.migrations }), AppChanges).pipe(
+				Layer.provideMerge(options.preflight ?? Layer.empty),
+			);
+};

package/src/appHostHttp.ts

@@ -0,0 +1,147 @@
+import { createServer } from "node:http";
+import { NodeHttpServer, NodeServices } from "@effect/platform-node";
+import { ByteSize, Config, Effect, Layer } from "effect";
+import { HttpEffect, HttpIncomingMessage, HttpRouter, HttpServerRequest, HttpServerResponse, HttpStaticServer } from "effect/http";
+import { type Rpc, RpcSerialization, RpcServer } from "effect/rpc";
+import type { Authenticated, MaybeAuthenticated, RequestTracing } from "@shivaedev/identity/middleware.ts";
+import { localRpcGuard } from "@shivaedev/identity/server/local.ts";
+import { authenticatedLayer, maybeAuthenticatedLayer, type SessionShape } from "@shivaedev/identity/server/session.ts";
+import { requestTracingLayer } from "@shivaedev/identity/server/tracing.ts";
+import type { AppChanges, AppHttpHostOptions } from "#appHost.ts";
+import { boundedRpcRequest } from "#boundedRpcRequest.ts";
+import type { databaseLayer } from "#databaseLayer.ts";
+import { healthRoute } from "#healthRoute.ts";
+import { hostChanges } from "#hostChanges.ts";
+import type { HostOptions, HostPolicy } from "#hostOptions.ts";
+import { hostTransport } from "#hostTransport.ts";
+import type { MigrationOptions } from "#MigrationOptions.ts";
+import { nativeClientOrigins } from "#nativeClientOrigins.ts";
+import { otlpTracing } from "#otlpTracing.ts";
+import { RedactionPolicy } from "#RedactionPolicy.ts";
+import { redactingDiagnostics } from "#redactingDiagnostics.ts";
+import { redactingRpcSerialization } from "#redactingRpcSerialization.ts";
+import { schemaSensitiveKeys } from "#schemaSensitiveKeys.ts";
+import { tracedGroup } from "#tracedGroup.ts";
+
+const rpcCacheControl: HttpEffect.PreResponseHandler = (_, response) =>
+	Effect.succeed(HttpServerResponse.setHeader(response, "cache-control", "private, no-store"));
+
+export function appHostHttp<
+	TRpcs extends Rpc.Any,
+	THandlers,
+	THandlerError,
+	THandlerRequirements,
+	TServices,
+	TServiceError,
+	TServiceRequirements,
+	TSession extends SessionShape,
+>(
+	options: HostOptions<TRpcs, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements> & HostPolicy<TSession>,
+	changesService: typeof AppChanges,
+) {
+	const sensitive = schemaSensitiveKeys(options.group, options.config?.sensitiveKeys);
+	return Layer.unwrap(
+		Effect.gen(function* () {
+			const { bodySize, trustedProxy, nativeOrigins } = yield* hostTransport(options);
+			const middleware: Layer.Layer<RequestTracing> | Layer.Layer<Authenticated | MaybeAuthenticated | RequestTracing> =
+				options.policy === "loopback"
+					? requestTracingLayer({ sensitive })
+					: Layer.mergeAll(authenticatedLayer(options.sessions), maybeAuthenticatedLayer(options.sessions), requestTracingLayer({ sensitive }));
+			const routes = HttpRouter.use((router) =>
+				Effect.gen(function* () {
+					const wire = redactingRpcSerialization(yield* RpcSerialization.RpcSerialization, sensitive, sensitive.maskFailure);
+					const handler = yield* RpcServer.toHttpEffect(tracedGroup(options.group)).pipe(
+						Effect.provideService(RpcSerialization.RpcSerialization, wire),
+					);
+					const guarded = localRpcGuard(handler, trustedProxy, nativeOrigins);
+					if (nativeOrigins.length > 0) {
+						yield* router.add("OPTIONS", options.rpcPath ?? "/rpc", HttpServerResponse.text("Local same-origin requests only", { status: 403 }));
+					}
+					yield* router.add("POST", options.rpcPath ?? "/rpc", (request) => {
+						HttpEffect.appendPreResponseHandlerUnsafe(request, rpcCacheControl);
+						return guarded.pipe(
+							Effect.provideService(HttpIncomingMessage.MaxBodySize, ByteSize.bytes(bodySize)),
+							Effect.provideService(HttpServerRequest.HttpServerRequest, boundedRpcRequest(request)),
+							Effect.provideService(RpcSerialization.RpcSerialization, wire),
+						);
+					});
+				}),
+			).pipe(
+				Layer.provide(Layer.merge(middleware, hostChanges(options.group, changesService).pipe(Layer.provideMerge(options.handlers)))),
+				Layer.provide(RpcSerialization.layerNdjson),
+				Layer.provide(nativeClientOrigins(nativeOrigins, trustedProxy)),
+			);
+			const assets =
+				options.assets === undefined
+					? Layer.empty
+					: HttpStaticServer.layer(typeof options.assets === "string" ? { root: options.assets } : options.assets);
+			const application = Layer.mergeAll(options.services ?? Layer.empty);
+			const server = Layer.unwrap(
+				Effect.gen(function* () {
+					const port = options.config?.port ?? (yield* Config.Int("PORT").pipe(Config.withDefault(3000)));
+					const host = options.config?.host ?? (yield* Config.String("HOST").pipe(Config.withDefault("127.0.0.1")));
+					return NodeHttpServer.layer(createServer, {
+						gracefulShutdownTimeout: options.config?.gracefulShutdownTimeout,
+						host,
+						port,
+						...(options.config?.disablePreemptiveShutdown === undefined
+							? {}
+							: { disablePreemptiveShutdown: options.config.disablePreemptiveShutdown }),
+					});
+				}),
+			);
+			const applicationRoutes = (options.routes ?? Layer.empty).pipe(
+				Layer.provide(options.nativeOrigins === undefined ? Layer.empty : nativeClientOrigins(nativeOrigins, trustedProxy, true)),
+			);
+			return HttpRouter.serve(Layer.mergeAll(routes, healthRoute, assets, applicationRoutes), { disableLogger: true }).pipe(
+				Layer.provideMerge(application),
+				Layer.provideMerge(server),
+				Layer.provide(NodeServices.layer),
+			);
+		}),
+	).pipe(Layer.provide(redactingDiagnostics(sensitive)), Layer.provide(otlpTracing), Layer.provide(Layer.succeed(RedactionPolicy, sensitive)));
+}
+
+export function migratedHost<
+	TRpcs extends Rpc.Any,
+	THandlers,
+	THandlerError,
+	THandlerRequirements,
+	TServices,
+	TServiceError,
+	TServiceRequirements,
+	TMigrations,
+	TSession extends SessionShape,
+>(
+	options: HostOptions<TRpcs, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements> &
+		HostPolicy<TSession> & { readonly migrations: MigrationOptions<TMigrations> },
+	database: ReturnType<typeof databaseLayer<TMigrations>>,
+	changesService: typeof AppChanges,
+) {
+	const services = Layer.mergeAll(options.services ?? Layer.empty);
+	return appHostHttp({ ...options, services: services.pipe(Layer.provideMerge(database)) }, changesService);
+}
+
+export function deferredHost<
+	TRpcs extends Rpc.Any,
+	THandlers,
+	THandlerError,
+	THandlerRequirements,
+	TServices,
+	TServiceError,
+	TServiceRequirements,
+	TMigrations,
+	TSession extends SessionShape,
+	TApplicationError,
+	TApplicationRequirements,
+>(
+	application: Effect.Effect<
+		AppHttpHostOptions<TRpcs, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements, TSession>,
+		TApplicationError,
+		TApplicationRequirements
+	>,
+	database: ReturnType<typeof databaseLayer<TMigrations>>,
+	changesService: typeof AppChanges,
+) {
+	return Layer.unwrap(Effect.map(application, (options) => appHostHttp(options, changesService))).pipe(Layer.provideMerge(database));
+}

package/src/boundedRpcRequest.ts

@@ -0,0 +1,28 @@
+import { Effect } from "effect";
+import { HttpServerError, type HttpServerRequest } from "effect/http";
+import { readBoundedBody } from "@shivaedev/http/server/boundedBody.ts";
+
+export function boundedRpcRequest(request: HttpServerRequest.HttpServerRequest): HttpServerRequest.HttpServerRequest {
+	const arrayBuffer = readBoundedBody(request).pipe(
+		Effect.mapError((cause) =>
+			cause._tag === "RequestBodyTooLarge"
+				? new HttpServerError.HttpServerError({ reason: new HttpServerError.RequestParseError({ cause, request }) })
+				: cause,
+		),
+		Effect.cached,
+		Effect.runSync,
+	);
+	const text = Effect.map(arrayBuffer, (body) => new TextDecoder().decode(body));
+	// The native text reader destroys the HTTP socket on overflow, preventing a 4xx response.
+	return new Proxy(request, {
+		get: (target, key, receiver) => {
+			if (key === "text") {
+				return text;
+			}
+			if (key === "arrayBuffer") {
+				return arrayBuffer;
+			}
+			return Reflect.get(target, key, receiver);
+		},
+	});
+}

package/src/databaseAddress.ts

@@ -0,0 +1,25 @@
+import type { PgPoolConfig } from "@effect/sql-pg/PgClient";
+import { Redacted } from "effect";
+
+export function databaseAddress(value: Redacted.Redacted<string>): Pick<PgPoolConfig, "host" | "port"> {
+	try {
+		const url = new URL(Redacted.value(value));
+		if (url.protocol !== "postgres:" && url.protocol !== "postgresql:") {
+			return {};
+		}
+		const hostname = url.hostname.startsWith("[") ? url.hostname.slice(1, -1) : decodeURIComponent(url.hostname);
+		// PgConnection applies query parameters in order, after the authority.
+		const host = url.searchParams.getAll("host").at(-1) ?? hostname;
+		const rawPort = url.searchParams.getAll("port").at(-1) ?? url.port;
+		const port = rawPort === "" ? undefined : Number(rawPort);
+		if (host.includes(",") || (port !== undefined && (!Number.isInteger(port) || port < 1 || port > 65_535))) {
+			return {};
+		}
+		return {
+			...(host === "" && !url.searchParams.has("host") ? {} : { host }),
+			...(port === undefined ? {} : { port }),
+		};
+	} catch {
+		return {};
+	}
+}

package/src/databaseLayer.ts

@@ -0,0 +1,127 @@
+import { createHash } from "node:crypto";
+import { createConnection } from "node:net";
+import * as PgClient from "@effect/sql-pg/PgClient";
+import { Config, Duration, Effect, Fiber, Layer, Redacted, Schedule } from "effect";
+import * as Reactivity from "effect/reactivity/Reactivity";
+import { makeLiveServer } from "@shivaedev/contract/makeLiveServer.ts";
+import { assertPostgresMigrations, postgresMigrationError } from "@shivaedev/sql/assertPostgresMigrations.ts";
+import type { SqlNameTransforms } from "@shivaedev/sql/clientOptions.ts";
+import { coordinateWorkerRelease } from "@shivaedev/sql/coordinateWorkerRelease.ts";
+import { migratePostgres } from "@shivaedev/sql/migrations.ts";
+import { type PendingPostgresMigrations, pendingPostgresMigrations } from "@shivaedev/sql/pendingPostgresMigrations.ts";
+import { type PostgresChangesOptions, postgresChanges } from "@shivaedev/sql/postgresChanges.ts";
+import { WorkerRelease } from "@shivaedev/sql/WorkerRelease.ts";
+import type { AppChanges, AppDatabaseOptions } from "#appHost.ts";
+import { databaseAddress } from "./databaseAddress.ts";
+
+export interface DatabaseConfig extends SqlNameTransforms {
+	readonly applicationName?: string;
+	readonly changes?: Partial<Omit<PostgresChangesOptions, "client" | "resync">>;
+	readonly databaseUrl?: Redacted.Redacted<string>;
+	readonly maxConnections?: number;
+}
+
+export function databaseLayer<R>(options: AppDatabaseOptions<R>, changesService: typeof AppChanges) {
+	const pool = Layer.unwrap(
+		Effect.gen(function* () {
+			const url = options.config?.databaseUrl ?? (yield* Config.Redacted("DATABASE_URL"));
+			const address = databaseAddress(url);
+			const disconnected = new Set<Promise<void>>();
+			// Native pool shutdown sends Terminate without waiting for its sockets to close.
+			yield* Effect.addFinalizer(() => Effect.promise(() => Promise.all([...disconnected])));
+			return PgClient.layer({
+				stream: () => {
+					const target = new URL(Redacted.value(url));
+					const host = address.host ?? target.searchParams.getAll("host").at(-1) ?? (decodeURIComponent(target.hostname) || "localhost");
+					const port = address.port ?? 5432;
+					const socket = createConnection(host.startsWith("/") ? { path: `${host}/.s.PGSQL.${port}` } : { host, noDelay: true, port });
+					const closed = new Promise<void>((resolve) =>
+						socket.once("close", () => {
+							disconnected.delete(closed);
+							resolve();
+						}),
+					);
+					disconnected.add(closed);
+					return socket;
+				},
+				transformQueryNames: options.config?.transformQueryNames,
+				transformResultNames: options.config?.transformResultNames,
+				url,
+				...address,
+				...(options.config?.maxConnections === undefined ? {} : { maxConnections: options.config.maxConnections }),
+				...(options.config?.applicationName === undefined ? {} : { applicationName: options.config.applicationName }),
+			});
+		}),
+	);
+	const prepared = Layer.effectDiscard(prepareMigrations(options.migrations)).pipe(Layer.provideMerge(pool));
+	const live = Layer.effect(changesService, makeLiveServer).pipe(Layer.provideMerge(Reactivity.layer));
+	const migrations = options.migrations;
+	const worker =
+		migrations.mode === "wait" && migrations.release !== undefined
+			? Layer.effect(WorkerRelease, coordinateWorkerRelease(migrations.release, migrations.pollInterval, migrations.table))
+			: Layer.empty;
+	const base = Layer.merge(worker.pipe(Layer.provideMerge(prepared)), live);
+	const changes = options.config?.changes;
+	return Layer.unwrap(
+		Effect.gen(function* () {
+			const client = yield* PgClient.PgClient;
+			const hints = yield* changesService;
+			const url = options.config?.databaseUrl ?? (yield* Config.Redacted("DATABASE_URL"));
+			const name = yield* Config.String("APP_NAME").pipe(Config.withDefault(new URL(Redacted.value(url)).pathname));
+			const channel = changes?.channel ?? `changes_${createHash("sha256").update(name).digest("hex").slice(0, 32)}`;
+			return postgresChanges({ ...changes, channel, client, resync: hints.resync });
+		}),
+	).pipe(Layer.provideMerge(base));
+}
+
+function prepareMigrations<R>(migrations: AppDatabaseOptions<R>["migrations"]) {
+	switch (migrations.mode) {
+		case "check": {
+			const schema = { ...migrations };
+			delete schema.release;
+			return assertPostgresMigrations(schema);
+		}
+		case "wait":
+			return waitForMigrations(migrations);
+		default:
+			return migratePostgres({ ...migrations, lockTimeout: migrations.lockTimeout ?? "5 seconds" }).pipe(Effect.asVoid);
+	}
+}
+
+function waitForMigrations<R>(migrations: AppDatabaseOptions<R>["migrations"]) {
+	return Effect.gen(function* () {
+		const progressInterval = Duration.fromInputUnsafe(migrations.progressInterval ?? "30 seconds");
+		let pending: PendingPostgresMigrations = { components: [], migrations: [] };
+		let progress: Fiber.Fiber<never> | undefined;
+		function log(message: string) {
+			return Effect.suspend(() =>
+				Effect.logInfo(message).pipe(Effect.annotateLogs({ pendingComponents: pending.components, pendingMigrations: pending.migrations })),
+			);
+		}
+		yield* Effect.gen(function* () {
+			pending = yield* pendingPostgresMigrations(migrations);
+			if (pending.migrations.length === 0 && pending.components.length === 0) {
+				return;
+			}
+			if (progress === undefined) {
+				yield* log("Waiting for database migrations");
+				progress = yield* Effect.forever(Effect.sleep(progressInterval).pipe(Effect.andThen(log("Still waiting for database migrations")))).pipe(
+					Effect.forkScoped,
+				);
+			}
+			return yield* Effect.fail(postgresMigrationError(pending));
+		}).pipe(
+			Effect.retry({
+				schedule: Schedule.max([Schedule.spaced(migrations.pollInterval ?? "1 second"), Schedule.during(migrations.waitTimeout ?? "5 minutes")]),
+				while: (error) => error._tag === "MigrationError" && error.kind === "BadState",
+			}),
+			Effect.tapError((error) =>
+				error._tag === "MigrationError" && error.kind === "BadState" ? log("Timed out waiting for database migrations") : Effect.void,
+			),
+		);
+		if (progress !== undefined) {
+			yield* Fiber.interrupt(progress);
+			yield* Effect.logInfo("Database migrations current");
+		}
+	}).pipe(Effect.scoped);
+}