@smthrs/gateway 0.35.0 → 1.0.0-rc.4

package/dist/cjs/RuntimeBridge.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/RuntimeBridge.ts"],
+  "sourcesContent": ["/**\n * Versioned JSON boundary between the Go product backend and the canonical\n * TypeScript Flow/Control host.\n *\n * This module adapts HTTP-shaped commands to `Control`. It owns no graph,\n * scheduler, journal, or lifecycle state of its own.\n *\n * @since 1.0.0\n */\n\nimport { Control } from \"@smthrs/control/Control\"\nimport * as ControlError from \"@smthrs/control/ControlError\"\nimport { ControlExecutor, type Service as ControlExecutorService } from \"@smthrs/control/ControlExecutor\"\nimport type { Principal, WatchCursor } from \"@smthrs/control/ControlSchema\"\nimport {\n  ApprovalPayload,\n  ControlEvent,\n  MessageSteer,\n  Receipt,\n  RunSummary,\n  SignalPayload\n} from \"@smthrs/control/ControlSchema\"\nimport * as Fault from \"@smthrs/flow/Fault\"\nimport { Effect, Layer, Schema, Stream } from \"effect\"\nimport { HttpRouter, HttpServerRequest, HttpServerResponse } from \"effect/unstable/http\"\nimport { RunSummaryRow } from \"./GatewayProjection.ts\"\nimport * as Projections from \"./Projections.ts\"\nimport { monitorFromJournal } from \"./RunTrace.ts\"\n\n/**\n * The only protocol version accepted by this host.\n * @since 1.0.0\n * @category constants\n */\nexport const protocol = \"smithers.flow-runtime/v1\" as const\n\nconst Sha256 = Schema.String.check(Schema.isPattern(/^[0-9a-f]{64}$/))\nconst SourceRevision = Schema.String.check(Schema.isPattern(/^[0-9a-f]{40}$/))\nconst PositiveSafeInteger = Schema.Int.check(\n  Schema.isGreaterThan(0),\n  Schema.isLessThanOrEqualTo(Number.MAX_SAFE_INTEGER)\n)\nconst RequestId = Schema.NonEmptyString.check(Schema.isMaxLength(1024))\n// A decimal consumes a whole journal entry. v1 preserves an expansion offset;\n// the empty seed consumes nothing, including sequence zero.\nconst observationCursorPattern = /^(?:(0|[1-9][0-9]*)|v1:(0|[1-9][0-9]*):(0|[1-9][0-9]*))?(?![\\s\\S])/\n\n/**\n * Non-secret identity published by readiness for startup compatibility.\n * @since 1.0.0\n * @category models\n */\nexport const Identity = Schema.Struct({\n  protocol: Schema.Literal(protocol),\n  runtimeArtifactDigest: Sha256,\n  sourceRevision: SourceRevision,\n  ownerGeneration: PositiveSafeInteger\n})\n\n/**\n * Non-secret identity published by readiness for startup compatibility.\n * @since 1.0.0\n * @category models\n */\nexport type Identity = typeof Identity.Type\nconst common = {\n  protocol: Schema.Literal(protocol),\n  applicationRequestId: RequestId,\n  ownerGeneration: PositiveSafeInteger\n}\n\n// The version a launch must run: a flow, the source commit it was chosen\n// from and that flow's execution digest. A pinned launch runs only a plan\n// with that exact identity.\nconst LaunchPin = Schema.Struct({\n  flow: Schema.NonEmptyString,\n  sourceCommit: SourceRevision,\n  executionDigest: Sha256\n})\n\n/**\n * Launches one immutable named flow. Planning and running stay in Control.\n * @since 1.0.0\n * @category models\n */\nexport const LaunchCommand = Schema.Struct({\n  ...common,\n  operation: Schema.Literal(\"launch\"),\n  attempt: PositiveSafeInteger,\n  runId: Schema.optional(Schema.NonEmptyString),\n  runtimeArtifactDigest: Sha256,\n  sourceRevision: SourceRevision,\n  flowId: Schema.NonEmptyString,\n  payload: Schema.Json,\n  pin: Schema.optional(LaunchPin)\n})\n\n/**\n * Submits an approval or denial payload produced by the same Control host.\n * @since 1.0.0\n * @category models\n */\nexport const DecisionCommand = Schema.Struct({\n  ...common,\n  operation: Schema.Literals([\"approve\", \"deny\"]),\n  approval: ApprovalPayload\n})\n\n/**\n * Delivers one durable named signal.\n * @since 1.0.0\n * @category models\n */\nexport const SignalCommand = Schema.Struct({\n  ...common,\n  operation: Schema.Literal(\"signal\"),\n  runId: Schema.NonEmptyString,\n  signal: SignalPayload\n})\n\nconst Steer = Schema.Union([\n  Schema.Struct({ kind: Schema.Literal(\"Message\"), body: Schema.String }),\n  Schema.Struct({ kind: Schema.Literal(\"Seat\"), seat: Schema.NonEmptyString }),\n  Schema.Struct({\n    kind: Schema.Literal(\"Thinking\"),\n    thinking: Schema.Literals([\"none\", \"minimal\", \"low\", \"medium\", \"high\", \"xhigh\"])\n  }),\n  Schema.Struct({ kind: Schema.Literal(\"Tools\"), toolNames: Schema.NonEmptyArray(Schema.NonEmptyString) })\n])\n\n/**\n * Enqueues one steer for the runtime's next turn boundary.\n * @since 1.0.0\n * @category models\n */\nexport const SteerCommand = Schema.Struct({\n  version: Schema.optional(Schema.Number),\n  ...common,\n  operation: Schema.Literal(\"steer\"),\n  runId: Schema.NonEmptyString,\n  messageId: Schema.NonEmptyString,\n  createdAt: Schema.Number,\n  attribution: MessageSteer.fields.attribution,\n  steer: Steer\n})\n\n/**\n * Requests cancellation, explicit resume, or completion of a retained run.\n * @since 1.0.0\n * @category models\n */\nexport const LifecycleCommand = Schema.Struct({\n  ...common,\n  /** Completion is a host-only lifecycle operation. @since 1.0.0 */\n  operation: Schema.Literals([\"cancel\", \"resume\", \"complete\"]),\n  runId: Schema.NonEmptyString,\n  reason: Schema.optional(Schema.String)\n})\n\n/**\n * Every mutating operation accepted by the bridge.\n * @since 1.0.0\n * @category models\n */\nexport const Command = Schema.Union([\n  LaunchCommand,\n  DecisionCommand,\n  SignalCommand,\n  SteerCommand,\n  LifecycleCommand\n])\n\n/**\n * Every mutating operation accepted by the bridge.\n * @since 1.0.0\n * @category models\n */\nexport type Command = typeof Command.Type\n\n/**\n * A bounded, reconnectable read of one canonical runtime execution.\n * @since 1.0.0\n * @category models\n */\nexport const ObserveRequest = Schema.Struct({\n  protocol: Schema.Literal(protocol),\n  runId: Schema.NonEmptyString,\n  afterCursor: Schema.optional(Schema.String.check(Schema.isPattern(observationCursorPattern))),\n  limit: Schema.optional(PositiveSafeInteger)\n})\n\n/**\n * A bounded, reconnectable read of one canonical runtime execution.\n * @since 1.0.0\n * @category models\n */\nexport type ObserveRequest = typeof ObserveRequest.Type\n\n/**\n * A process result recorded by installed host equipment, never by a flow result.\n * @since 1.0.0\n * @category models\n */\nexport const CommandReceipt = Schema.Struct({\n  runId: Schema.NonEmptyString,\n  operationId: Schema.NonEmptyString,\n  status: Schema.Literals([\"running\", \"completed\"]),\n  argv: Schema.NonEmptyArray(Schema.String),\n  exitCode: Schema.optionalKey(Schema.Int),\n  stderr: Schema.optionalKey(Schema.String),\n  fault: Schema.optionalKey(Schema.Literals([\"factory\", \"infra\"]))\n})\n/**\n * A process result recorded by installed host equipment.\n * @since 1.0.0\n * @category models\n */\nexport type CommandReceipt = typeof CommandReceipt.Type\n\n/**\n * Host identity fixed for the lifetime of one owning process.\n * @since 1.0.0\n * @category models\n */\nexport interface Config {\n  readonly runtimeArtifactDigest: string\n  readonly sourceRevision: string\n  /** Captured and verified by native catalog registration, never decoded from a request or environment. */\n  readonly verifiedCatalogSourceRevision?: string | undefined\n  readonly ownerGeneration: number\n  /**\n   * Private installed-host receipt reader; never accepted on the command wire.\n   * @since 1.0.0\n   */\n  readonly commandReceipt?: ((runId: string) => Effect.Effect<CommandReceipt | undefined, unknown>) | undefined\n  /**\n   * Native host completion port, captured from the executor rather than from a request.\n   * @since 1.0.0\n   */\n  readonly requestComplete?: ControlExecutorService[\"requestComplete\"]\n  readonly authenticate: (\n    headers: Readonly<Record<string, string>>\n  ) => Effect.Effect<Principal, ControlError.Unauthorized>\n}\n\n/**\n * Stable bridge-only failures. Control failures retain their own code.\n * @since 1.0.0\n * @category errors\n */\nexport class BridgeError extends Schema.TaggedError<BridgeError>()(\"@smthrs/gateway/RuntimeBridgeError\", {\n  code: Schema.Literals([\n    \"invalid_request\",\n    \"artifact_mismatch\",\n    \"source_mismatch\",\n    \"stale_owner\",\n    \"run_not_found\",\n    \"resource_limit\",\n    \"unavailable\",\n    \"internal\"\n  ]),\n  message: Schema.String,\n  retryable: Schema.Boolean\n}) {}\n\nconst decodeCommand = Schema.decodeUnknownEffect(Command)\nconst decodeObserve = Schema.decodeUnknownEffect(ObserveRequest)\nconst terminal = new Set([\"completed\", \"failed\", \"cancelled\"])\nconst retryableCodes = new Set([\"transport_error\", \"unavailable\", \"persistence_failed\", \"launch_failed\"])\nconst notFoundCodes = new Set([\"run_not_found\", \"flow_not_found\", \"plan_not_found\"])\nconst conflictCodes = new Set([\"stale_owner\", \"artifact_mismatch\", \"source_mismatch\", \"conflict\"])\nconst defaultEventLimit = 250\nconst maximumEventLimit = 1_000\n\n// Host generation fences who may execute a delivery, but it is not part of\n// the durable product request identity. A replacement owner must reconcile a\n// lost acknowledgement against the same Control command keys.\nconst idempotencyKey = (input: Pick<Command, \"applicationRequestId\">, suffix: string) =>\n  `bridge:v1:${input.applicationRequestId}:${suffix}`\n\nconst validateOwner = (config: Config, input: Pick<Command, \"ownerGeneration\">) =>\n  input.ownerGeneration === config.ownerGeneration\n    ? Effect.void\n    : Effect.fail(\n      new BridgeError({ code: \"stale_owner\", message: \"Runtime owner generation is stale\", retryable: true })\n    )\n\n/**\n * Executes one decoded command exclusively through the canonical Control API.\n * @since 1.0.0\n * @category constructors\n */\nexport const execute = (\n  config: Config,\n  control: Control[\"Service\"],\n  principal: Principal,\n  input: Command\n) =>\n  Effect.gen(function*() {\n    yield* validateOwner(config, input)\n    switch (input.operation) {\n      case \"launch\": {\n        if (input.runtimeArtifactDigest !== config.runtimeArtifactDigest) {\n          return yield* Effect.fail(\n            new BridgeError({\n              code: \"artifact_mismatch\",\n              message: \"Runtime artifact digest does not match the owning host\",\n              retryable: false\n            })\n          )\n        }\n        if (input.sourceRevision !== config.sourceRevision) {\n          return yield* Effect.fail(\n            new BridgeError({\n              code: \"source_mismatch\",\n              message: \"Flow source revision does not match the owning host\",\n              retryable: false\n            })\n          )\n        }\n        // Every launch of a pinned attempt (its composition and the engine's\n        // launches) runs from the pinned source commit: a host serving any\n        // other source refuses before planning imports anything.\n        if (input.pin !== undefined && input.pin.sourceCommit !== config.sourceRevision) {\n          return yield* Effect.fail(\n            new BridgeError({\n              code: \"source_mismatch\",\n              message: \"Flow source revision does not match the pinned launch\",\n              retryable: false\n            })\n          )\n        }\n        const plan = yield* control.plan({\n          flowId: input.flowId,\n          input: input.payload,\n          idempotencyKey: idempotencyKey(input, \"plan\")\n        })\n        // Graphs are optional for valid Flow declarations. Only a verified\n        // native catalog snapshot can supply the missing provenance; the\n        // configured/wire identity by itself cannot stand in for that proof.\n        const plannedSource = plan.graph?.sourceRevision ?? config.verifiedCatalogSourceRevision\n        if (plannedSource !== input.sourceRevision) {\n          return yield* Effect.fail(\n            new BridgeError({\n              code: \"source_mismatch\",\n              message: \"Flow source revision does not match the immutable request\",\n              retryable: false\n            })\n          )\n        }\n        // A pinned launch runs nothing but its pin: a plan with no execution\n        // identity, or the pinned flow planned as other code, never starts.\n        if (\n          input.pin !== undefined &&\n          (plan.executionDigest === undefined ||\n            (input.pin.flow === input.flowId && plan.executionDigest !== input.pin.executionDigest))\n        ) {\n          return yield* Effect.fail(\n            new BridgeError({\n              code: \"source_mismatch\",\n              message: \"Flow execution digest does not match the pinned launch\",\n              retryable: false\n            })\n          )\n        }\n        const receipt = yield* control.run({\n          _tag: \"Plan\",\n          planId: plan.planId,\n          digest: plan.digest,\n          envelope: plan.envelope,\n          idempotencyKey: idempotencyKey(input, `run:${input.runId ?? input.attempt}`),\n          principal,\n          ...(input.runId === undefined ? {} : { reservedRunId: input.runId })\n        })\n        return {\n          operation: input.operation,\n          applicationRequestId: input.applicationRequestId,\n          ownerGeneration: input.ownerGeneration,\n          runtimeArtifactDigest: config.runtimeArtifactDigest,\n          sourceRevision: input.sourceRevision,\n          planId: plan.planId,\n          planDigest: plan.digest,\n          ...(plan.executionDigest === undefined ? {} : { executionDigest: plan.executionDigest }),\n          envelope: plan.envelope,\n          approval: plan.approval,\n          receipt\n        } as const\n      }\n      case \"approve\":\n      case \"deny\": {\n        const request = {\n          ...input.approval,\n          idempotencyKey: idempotencyKey(input, input.operation),\n          principal\n        }\n        const receipt = yield* input.operation === \"approve\" ? control.approve(request) : control.deny(request)\n        return { operation: input.operation, applicationRequestId: input.applicationRequestId, receipt } as const\n      }\n      case \"signal\": {\n        const receipt = yield* control.signal({\n          runId: input.runId,\n          signal: input.signal,\n          idempotencyKey: idempotencyKey(input, \"signal\"),\n          principal\n        })\n        return { operation: input.operation, applicationRequestId: input.applicationRequestId, receipt } as const\n      }\n      case \"steer\": {\n        const receipt = yield* control.steer({\n          runId: input.runId,\n          idempotencyKey: idempotencyKey(input, \"steer\"),\n          ...(input.version === undefined ? {} : { version: input.version }),\n          message: {\n            ...input.steer,\n            runId: input.runId,\n            messageId: input.messageId,\n            createdAt: input.createdAt,\n            ...(input.attribution === undefined ? {} : { attribution: input.attribution }),\n            principal\n          }\n        })\n        return { operation: input.operation, applicationRequestId: input.applicationRequestId, receipt } as const\n      }\n      // This authenticated host bridge is not a catalog or public Control\n      // verb. The executor validates the completed native child and resumes\n      // its retained parent to settle from that child's committed result.\n      case \"complete\": {\n        const executor = yield* Effect.serviceOption(ControlExecutor)\n        const complete = config.requestComplete ??\n          (executor._tag === \"Some\" ? executor.value.requestComplete : undefined)\n        if (complete === undefined) {\n          return yield* Effect.fail(\n            new BridgeError({\n              code: \"unavailable\",\n              message: \"Completed-module settlement is unavailable\",\n              retryable: true\n            })\n          )\n        }\n        const receipt = yield* complete({ runId: input.runId, receiptId: idempotencyKey(input, \"complete\") })\n        return { operation: input.operation, applicationRequestId: input.applicationRequestId, receipt } as const\n      }\n      case \"cancel\":\n      case \"resume\": {\n        const request = {\n          runId: input.runId,\n          idempotencyKey: idempotencyKey(input, input.operation),\n          ...(input.reason === undefined ? {} : { reason: input.reason }),\n          principal\n        }\n        const receipt = yield* input.operation === \"cancel\" ? control.cancel(request) : control.resume(request)\n        return { operation: input.operation, applicationRequestId: input.applicationRequestId, receipt } as const\n      }\n    }\n  })\n\nconst cursorPosition = (cursor: string | undefined): Effect.Effect<WatchCursor | undefined, BridgeError> => {\n  if (cursor === undefined || cursor === \"\") return Effect.succeed(undefined)\n  const match = observationCursorPattern.exec(cursor)\n  const sequence = Number(match?.[1] ?? match?.[2])\n  const offset = match?.[3] === undefined ? undefined : Number(match[3])\n  const valid = (value: number) => Number.isSafeInteger(value) && value >= 0 && value < Number.MAX_SAFE_INTEGER\n  return match !== null && valid(sequence) && (offset === undefined || valid(offset))\n    ? Effect.succeed({ sequence, ...(offset === undefined ? {} : { offset }) })\n    : Effect.fail(\n      new BridgeError({\n        code: \"invalid_request\",\n        message: \"Observation cursor is invalid or out of range\",\n        retryable: false\n      })\n    )\n}\n\nconst encodedCursor = (cursor: WatchCursor): string =>\n  cursor.offset === undefined ? String(cursor.sequence) : `v1:${cursor.sequence}:${cursor.offset}`\n\n/**\n * Reads a bounded event replay and current canonical run projection.\n * @since 1.0.0\n * @category constructors\n */\nexport const observe = (control: Control[\"Service\"], input: ObserveRequest, receipts?: Config[\"commandReceipt\"]) =>\n  Effect.gen(function*() {\n    const after = yield* cursorPosition(input.afterCursor)\n    const limit = Math.min(input.limit ?? defaultEventLimit, maximumEventLimit)\n    const listed = yield* control.list({ _tag: \"runs\", filters: { runId: input.runId }, limit: 1 })\n    const summary = listed._tag === \"runs\" ? listed.items[0] : undefined\n    if (summary === undefined) {\n      return yield* Effect.fail(\n        new BridgeError({ code: \"run_not_found\", message: \"Runtime execution was not found\", retryable: true })\n      )\n    }\n    const events = Array.from(\n      yield* Stream.runCollect(Stream.take(\n        control.watch({\n          runId: input.runId,\n          ...(after === undefined\n            ? {}\n            : after.offset === undefined\n            ? { afterSequence: after.sequence }\n            : { afterCursor: after }),\n          follow: false\n        }),\n        limit + 1\n      ))\n    )\n    const page = events.slice(0, limit)\n    const last = page.at(-1)\n    // Typed Flow results use the same committed root projection as the app.\n    // A terminal status alone never supplies a result, and a bounded event\n    // page cannot reconstruct a root result that precedes its cursor.\n    let finalOutput: string | undefined\n    let failure: { readonly failureFault?: Fault.Class; readonly failureTag?: string } = {}\n    if (terminal.has(summary.status)) {\n      const projections = yield* Projections.make(control)\n      const snapshot = yield* projections.snapshot({ _tag: \"run-summary\", runId: input.runId })\n      const row = snapshot.rows.find(Schema.is(RunSummaryRow))\n      if (\n        row === undefined || row.runId !== summary.runId || row.flowId !== summary.flowId ||\n        row.status !== summary.status || row.planId !== summary.planId || row.planDigest !== summary.planDigest\n      ) {\n        return yield* Effect.fail(\n          new BridgeError({ code: \"internal\", message: \"Terminal result observation changed\", retryable: true })\n        )\n      }\n      finalOutput = row.finalOutput\n      failure = {\n        ...(row.failureFault === undefined ? {} : { failureFault: row.failureFault }),\n        ...(row.failureTag === undefined ? {} : { failureTag: row.failureTag })\n      }\n    }\n    // Keep the private receipt out of every repository-controlled projection.\n    const hostSummary = yield* Schema.decodeUnknownEffect(RunSummary)(summary)\n    const commandReceipt = receipts === undefined ? undefined : yield* receipts(input.runId)\n    if (commandReceipt !== undefined && commandReceipt.runId !== input.runId) {\n      return yield* Effect.fail(\n        new BridgeError({ code: \"internal\", message: \"Host command receipt names another run\", retryable: false })\n      )\n    }\n    return {\n      run: {\n        ...hostSummary,\n        ...(commandReceipt === undefined ? {} : { commandReceipt }),\n        ...(finalOutput === undefined ? {} : { finalOutput }),\n        ...failure\n      },\n      events: page,\n      nextCursor: last === undefined\n        ? input.afterCursor ?? \"\"\n        : encodedCursor(last.cursor ?? { sequence: last.sequence }),\n      hasMore: events.length > limit,\n      terminal: terminal.has(summary.status)\n    }\n  })\n\n// Disposable raw journal prefixes for Inspect. This stores no run state: the\n// existing monitor fold still derives every answer from journal records. Bound\n// retention across all runs of one control service, and rebuild after eviction.\nconst monitorJournals = new WeakMap<\n  Control[\"Service\"],\n  Map<string, {\n    readonly records: ReadonlyArray<ControlEvent>\n    readonly bytes: number\n  }>\n>()\nconst monitorJournalBytes = 64 * 1024 * 1024\n\n/** Read an existing run and its committed journal without invoking any execution door.\n * @since 1.0.0\n * @category constructors\n */\nexport const monitor = (control: Control[\"Service\"], runId: string, at?: number) =>\n  Effect.gen(function*() {\n    const listed = yield* control.list({ _tag: \"runs\", filters: { runId }, limit: 1 })\n    const run = listed._tag === \"runs\" ? listed.items[0] : undefined\n    if (run === undefined || run.runId !== runId) {\n      return yield* new BridgeError({\n        code: \"run_not_found\",\n        message: \"Runtime execution was not found\",\n        retryable: false\n      })\n    }\n    const cache = monitorJournals.get(control) ??\n      new Map<string, { readonly records: ReadonlyArray<ControlEvent>; readonly bytes: number }>()\n    monitorJournals.set(control, cache)\n    const cached = cache.get(runId)\n    const last = cached?.records.at(-1)?.sequence\n    // Replay the final entry because one entry may expand into several events.\n    const consumed = last === undefined ? 0 : cached!.records.filter((row) => row.sequence === last).length\n    let skipped = 0\n    const suffix = Array.from(\n      yield* Stream.runCollect(\n        control.watch({\n          runId,\n          follow: false,\n          ...(last === undefined || last === 0 ? {} : { afterSequence: last - 1 })\n        }).pipe(\n          Stream.filter((row) =>\n            last === undefined || row.sequence > last || row.sequence === last && skipped++ >= consumed\n          ),\n          Stream.take(Projections.maxEventsScanned + 1)\n        )\n      )\n    )\n    const records = [...(cached?.records ?? []), ...suffix]\n    if (records.length > Projections.maxEventsScanned) {\n      return yield* new BridgeError({\n        code: \"resource_limit\",\n        message: \"Run journal exceeds the inspection limit\",\n        retryable: false\n      })\n    }\n    const bytes = (cached?.bytes ?? 0) +\n      suffix.reduce((sum, row) => sum + new TextEncoder().encode(JSON.stringify(row)).byteLength, 0)\n    const current = cache.get(runId)\n    // A slower reader cannot overwrite a longer committed prefix.\n    if (bytes <= monitorJournalBytes && (current === undefined || current.records.length <= records.length)) {\n      cache.delete(runId)\n      cache.set(runId, { records, bytes })\n      let total = [...cache.values()].reduce((sum, entry) => sum + entry.bytes, 0)\n      while (cache.size > 32 || total > monitorJournalBytes) {\n        const oldest = cache.keys().next().value!\n        total -= cache.get(oldest)!.bytes\n        cache.delete(oldest)\n      }\n    }\n    const folded = monitorFromJournal({ runId, flowId: run.flowId, status: run.status }, records, at)\n    // The journal is read page by page when its tab opens (run-events). Only a\n    // replay frame carries its own journal prefix. The extent bounds the run.\n    let start = Infinity\n    let end = 0\n    for (const row of records) {\n      if (row.occurredAt > 0) {\n        start = Math.min(start, row.occurredAt)\n        end = Math.max(end, row.occurredAt)\n      }\n    }\n    const value: Partial<typeof folded> & Omit<typeof folded, \"journal\"> & { extent?: { start: string; end: string } } =\n      {\n        ...folded,\n        ...(end === 0 ? {} : { extent: { start: new Date(start).toISOString(), end: new Date(end).toISOString() } })\n      }\n    if (at === undefined) delete value.journal\n    if (new TextEncoder().encode(JSON.stringify(value)).byteLength > Projections.maxProjectionBytes) {\n      return yield* new BridgeError({\n        code: \"resource_limit\",\n        message: \"Run monitor exceeds the inspection limit\",\n        retryable: false\n      })\n    }\n    return value\n  })\n\n/**\n * Successful command response on the JSON wire.\n * @since 1.0.0\n * @category models\n */\nexport const CommandResponse = Schema.Struct({\n  protocol: Schema.Literal(protocol),\n  ok: Schema.Literal(true),\n  value: Schema.Struct({\n    operation: Schema.String,\n    applicationRequestId: Schema.String,\n    ownerGeneration: Schema.optional(PositiveSafeInteger),\n    runtimeArtifactDigest: Schema.optional(Sha256),\n    sourceRevision: Schema.optional(SourceRevision),\n    planId: Schema.optional(Schema.String),\n    planDigest: Schema.optional(Sha256),\n    executionDigest: Schema.optional(Sha256),\n    envelope: Schema.optional(Schema.Json),\n    approval: Schema.optional(ApprovalPayload),\n    receipt: Receipt\n  })\n})\n\n/**\n * Successful observation response on the JSON wire.\n * @since 1.0.0\n * @category models\n */\nexport const ObserveResponse = Schema.Struct({\n  protocol: Schema.Literal(protocol),\n  ok: Schema.Literal(true),\n  value: Schema.Struct({\n    run: Schema.Struct({\n      ...RunSummary.fields,\n      finalOutput: Schema.optional(Schema.String),\n      failureFault: Schema.optional(Fault.Class),\n      failureTag: Schema.optional(Schema.String),\n      commandReceipt: Schema.optionalKey(CommandReceipt)\n    }),\n    events: Schema.Array(ControlEvent),\n    nextCursor: Schema.String,\n    hasMore: Schema.Boolean,\n    terminal: Schema.Boolean\n  })\n})\n\n/**\n * Stable sanitized failure response on the JSON wire.\n * @since 1.0.0\n * @category models\n */\nexport const ErrorResponse = Schema.Struct({\n  protocol: Schema.Literal(protocol),\n  ok: Schema.Literal(false),\n  error: Schema.Struct({ code: Schema.String, message: Schema.String, retryable: Schema.Boolean })\n})\n\nconst errorResponse = (cause: unknown) => {\n  const known = Schema.is(ControlError.ControlErrorSchema)(cause)\n  const code = cause instanceof BridgeError || known ? cause.code : \"internal\"\n  const retryable = cause instanceof BridgeError\n    ? cause.retryable\n    : cause instanceof ControlError.TransportError\n    ? cause.retryable\n    : retryableCodes.has(code)\n  // Control errors can contain storage paths, SQL diagnostics, or executor\n  // output. The bridge publishes their stable code, never that backend text.\n  const message = cause instanceof BridgeError ? cause.message : \"Runtime bridge failed\"\n  const status = code === \"unauthorized\" ?\n    401\n    : notFoundCodes.has(code) ?\n    404\n    : conflictCodes.has(code) ?\n    409\n    : retryable ?\n    503\n    : code === \"internal\" ?\n    500\n    : 400\n  return HttpServerResponse.jsonUnsafe({ protocol, ok: false, error: { code, message, retryable } }, { status })\n}\n\n/**\n * Answers a failed bridge request with its sanitized response, logging it first.\n *\n * The wire carries only the stable code. The operator log carries the full\n * cause of every failure the caller did not cause, so a launch that failed in\n * storage or in the executor can be diagnosed from the host.\n */\nconst respondToFailure = (operation: \"runtime-bridge.command\" | \"runtime-bridge.observe\") => (cause: unknown) => {\n  const response = errorResponse(cause)\n  if (cause instanceof BridgeError) return Effect.succeed(response)\n  const code = Schema.is(ControlError.ControlErrorSchema)(cause) ? cause.code : \"internal\"\n  return Effect.logError({ message: \"Runtime bridge request failed\", operation, code, cause }).pipe(\n    Effect.as(response)\n  )\n}\n\nconst readJson = Effect.gen(function*() {\n  const request = yield* HttpServerRequest.HttpServerRequest\n  const text = yield* request.text\n  return yield* Effect.try({\n    try: () => JSON.parse(text) as unknown,\n    catch: () => new BridgeError({ code: \"invalid_request\", message: \"Request body must be JSON\", retryable: false })\n  })\n})\n\nconst authenticated = <A, E, R>(\n  config: Config,\n  effect: (principal: Principal) => Effect.Effect<A, E, R>\n) =>\n  Effect.gen(function*() {\n    const request = yield* HttpServerRequest.HttpServerRequest\n    const principal = yield* config.authenticate(request.headers)\n    return yield* effect(principal)\n  })\n\n/**\n * Mounts the authenticated JSON bridge beside the existing gateway RPCs.\n * @since 1.0.0\n * @category layers\n */\nexport const layer = (config: Config) => {\n  const command = authenticated(config, (principal) =>\n    Effect.gen(function*() {\n      const body = yield* readJson\n      const input = yield* decodeCommand(body).pipe(Effect.mapError(() =>\n        new BridgeError({\n          code: \"invalid_request\",\n          message: \"Request does not match the runtime bridge contract\",\n          retryable: false\n        })\n      ))\n      const control = yield* Control\n      const value = yield* execute(config, control, principal, input)\n      return HttpServerResponse.jsonUnsafe({ protocol, ok: true, value })\n    })).pipe(\n      Effect.catch(respondToFailure(\"runtime-bridge.command\")),\n      Effect.withSpan(\"runtime-bridge.command\")\n    )\n\n  const observation = authenticated(config, () =>\n    Effect.gen(function*() {\n      const body = yield* readJson\n      const input = yield* decodeObserve(body).pipe(Effect.mapError(() =>\n        new BridgeError({\n          code: \"invalid_request\",\n          message: \"Request does not match the observation contract\",\n          retryable: false\n        })\n      ))\n      const control = yield* Control\n      const value = yield* observe(control, input, config.commandReceipt)\n      return HttpServerResponse.jsonUnsafe({ protocol, ok: true, value })\n    })).pipe(\n      Effect.catch(respondToFailure(\"runtime-bridge.observe\")),\n      Effect.withSpan(\"runtime-bridge.observe\")\n    )\n\n  const inspection = authenticated(config, () =>\n    Effect.gen(function*() {\n      const body = yield* readJson\n      const input = yield* Schema.decodeUnknownEffect(Schema.Struct({\n        protocol: Schema.Literal(protocol),\n        runId: Schema.NonEmptyString,\n        at: Schema.optional(Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)))\n      }))(body).pipe(Effect.mapError(() =>\n        new BridgeError({ code: \"invalid_request\", message: \"Invalid monitor request\", retryable: false })\n      ))\n      const control = yield* Control\n      return HttpServerResponse.jsonUnsafe({\n        protocol,\n        ok: true,\n        value: yield* monitor(control, input.runId, input.at)\n      })\n    })).pipe(Effect.catch(respondToFailure(\"runtime-bridge.observe\")))\n\n  return HttpRouter.add(\"POST\", \"/runtime/v1/command\", command).pipe(\n    Layer.merge(HttpRouter.add(\"POST\", \"/runtime/v1/monitor\", inspection)),\n    Layer.merge(HttpRouter.add(\"POST\", \"/runtime/v1/observe\", observation))\n  )\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUA,qBAAwB;AACxB,mBAA8B;AAC9B,6BAAwE;AAExE,2BAOO;AACP,YAAuB;AACvB,oBAA8C;AAC9C,kBAAkE;AAClE,+BAA8B;AAC9B,kBAA6B;AAC7B,sBAAmC;AAO5B,MAAM,WAAW;AAExB,MAAM,SAAS,qBAAO,OAAO,MAAM,qBAAO,UAAU,gBAAgB,CAAC;AACrE,MAAM,iBAAiB,qBAAO,OAAO,MAAM,qBAAO,UAAU,gBAAgB,CAAC;AAC7E,MAAM,sBAAsB,qBAAO,IAAI;AAAA,EACrC,qBAAO,cAAc,CAAC;AAAA,EACtB,qBAAO,oBAAoB,OAAO,gBAAgB;AACpD;AACA,MAAM,YAAY,qBAAO,eAAe,MAAM,qBAAO,YAAY,IAAI,CAAC;AAGtE,MAAM,2BAA2B;AAO1B,MAAM,WAAW,qBAAO,OAAO;AAAA,EACpC,UAAU,qBAAO,QAAQ,QAAQ;AAAA,EACjC,uBAAuB;AAAA,EACvB,gBAAgB;AAAA,EAChB,iBAAiB;AACnB,CAAC;AAQD,MAAM,SAAS;AAAA,EACb,UAAU,qBAAO,QAAQ,QAAQ;AAAA,EACjC,sBAAsB;AAAA,EACtB,iBAAiB;AACnB;AAKA,MAAM,YAAY,qBAAO,OAAO;AAAA,EAC9B,MAAM,qBAAO;AAAA,EACb,cAAc;AAAA,EACd,iBAAiB;AACnB,CAAC;AAOM,MAAM,gBAAgB,qBAAO,OAAO;AAAA,EACzC,GAAG;AAAA,EACH,WAAW,qBAAO,QAAQ,QAAQ;AAAA,EAClC,SAAS;AAAA,EACT,OAAO,qBAAO,SAAS,qBAAO,cAAc;AAAA,EAC5C,uBAAuB;AAAA,EACvB,gBAAgB;AAAA,EAChB,QAAQ,qBAAO;AAAA,EACf,SAAS,qBAAO;AAAA,EAChB,KAAK,qBAAO,SAAS,SAAS;AAChC,CAAC;AAOM,MAAM,kBAAkB,qBAAO,OAAO;AAAA,EAC3C,GAAG;AAAA,EACH,WAAW,qBAAO,SAAS,CAAC,WAAW,MAAM,CAAC;AAAA,EAC9C,UAAU;AACZ,CAAC;AAOM,MAAM,gBAAgB,qBAAO,OAAO;AAAA,EACzC,GAAG;AAAA,EACH,WAAW,qBAAO,QAAQ,QAAQ;AAAA,EAClC,OAAO,qBAAO;AAAA,EACd,QAAQ;AACV,CAAC;AAED,MAAM,QAAQ,qBAAO,MAAM;AAAA,EACzB,qBAAO,OAAO,EAAE,MAAM,qBAAO,QAAQ,SAAS,GAAG,MAAM,qBAAO,OAAO,CAAC;AAAA,EACtE,qBAAO,OAAO,EAAE,MAAM,qBAAO,QAAQ,MAAM,GAAG,MAAM,qBAAO,eAAe,CAAC;AAAA,EAC3E,qBAAO,OAAO;AAAA,IACZ,MAAM,qBAAO,QAAQ,UAAU;AAAA,IAC/B,UAAU,qBAAO,SAAS,CAAC,QAAQ,WAAW,OAAO,UAAU,QAAQ,OAAO,CAAC;AAAA,EACjF,CAAC;AAAA,EACD,qBAAO,OAAO,EAAE,MAAM,qBAAO,QAAQ,OAAO,GAAG,WAAW,qBAAO,cAAc,qBAAO,cAAc,EAAE,CAAC;AACzG,CAAC;AAOM,MAAM,eAAe,qBAAO,OAAO;AAAA,EACxC,SAAS,qBAAO,SAAS,qBAAO,MAAM;AAAA,EACtC,GAAG;AAAA,EACH,WAAW,qBAAO,QAAQ,OAAO;AAAA,EACjC,OAAO,qBAAO;AAAA,EACd,WAAW,qBAAO;AAAA,EAClB,WAAW,qBAAO;AAAA,EAClB,aAAa,kCAAa,OAAO;AAAA,EACjC,OAAO;AACT,CAAC;AAOM,MAAM,mBAAmB,qBAAO,OAAO;AAAA,EAC5C,GAAG;AAAA;AAAA,EAEH,WAAW,qBAAO,SAAS,CAAC,UAAU,UAAU,UAAU,CAAC;AAAA,EAC3D,OAAO,qBAAO;AAAA,EACd,QAAQ,qBAAO,SAAS,qBAAO,MAAM;AACvC,CAAC;AAOM,MAAM,UAAU,qBAAO,MAAM;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAcM,MAAM,iBAAiB,qBAAO,OAAO;AAAA,EAC1C,UAAU,qBAAO,QAAQ,QAAQ;AAAA,EACjC,OAAO,qBAAO;AAAA,EACd,aAAa,qBAAO,SAAS,qBAAO,OAAO,MAAM,qBAAO,UAAU,wBAAwB,CAAC,CAAC;AAAA,EAC5F,OAAO,qBAAO,SAAS,mBAAmB;AAC5C,CAAC;AAcM,MAAM,iBAAiB,qBAAO,OAAO;AAAA,EAC1C,OAAO,qBAAO;AAAA,EACd,aAAa,qBAAO;AAAA,EACpB,QAAQ,qBAAO,SAAS,CAAC,WAAW,WAAW,CAAC;AAAA,EAChD,MAAM,qBAAO,cAAc,qBAAO,MAAM;AAAA,EACxC,UAAU,qBAAO,YAAY,qBAAO,GAAG;AAAA,EACvC,QAAQ,qBAAO,YAAY,qBAAO,MAAM;AAAA,EACxC,OAAO,qBAAO,YAAY,qBAAO,SAAS,CAAC,WAAW,OAAO,CAAC,CAAC;AACjE,CAAC;AAuCM,MAAM,oBAAoB,qBAAO,YAAyB,EAAE,sCAAsC;AAAA,EACvG,MAAM,qBAAO,SAAS;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAAA,EACD,SAAS,qBAAO;AAAA,EAChB,WAAW,qBAAO;AACpB,CAAC,EAAE;AAAC;AAEJ,MAAM,gBAAgB,qBAAO,oBAAoB,OAAO;AACxD,MAAM,gBAAgB,qBAAO,oBAAoB,cAAc;AAC/D,MAAM,WAAW,oBAAI,IAAI,CAAC,aAAa,UAAU,WAAW,CAAC;AAC7D,MAAM,iBAAiB,oBAAI,IAAI,CAAC,mBAAmB,eAAe,sBAAsB,eAAe,CAAC;AACxG,MAAM,gBAAgB,oBAAI,IAAI,CAAC,iBAAiB,kBAAkB,gBAAgB,CAAC;AACnF,MAAM,gBAAgB,oBAAI,IAAI,CAAC,eAAe,qBAAqB,mBAAmB,UAAU,CAAC;AACjG,MAAM,oBAAoB;AAC1B,MAAM,oBAAoB;AAK1B,MAAM,iBAAiB,CAAC,OAA8C,WACpE,aAAa,MAAM,oBAAoB,IAAI,MAAM;AAEnD,MAAM,gBAAgB,CAAC,QAAgB,UACrC,MAAM,oBAAoB,OAAO,kBAC7B,qBAAO,OACP,qBAAO;AAAA,EACP,IAAI,YAAY,EAAE,MAAM,eAAe,SAAS,qCAAqC,WAAW,KAAK,CAAC;AACxG;AAOG,MAAM,UAAU,CACrB,QACA,SACA,WACA,UAEA,qBAAO,IAAI,aAAY;AACrB,SAAO,cAAc,QAAQ,KAAK;AAClC,UAAQ,MAAM,WAAW;AAAA,IACvB,KAAK,UAAU;AACb,UAAI,MAAM,0BAA0B,OAAO,uBAAuB;AAChE,eAAO,OAAO,qBAAO;AAAA,UACnB,IAAI,YAAY;AAAA,YACd,MAAM;AAAA,YACN,SAAS;AAAA,YACT,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AAAA,MACF;AACA,UAAI,MAAM,mBAAmB,OAAO,gBAAgB;AAClD,eAAO,OAAO,qBAAO;AAAA,UACnB,IAAI,YAAY;AAAA,YACd,MAAM;AAAA,YACN,SAAS;AAAA,YACT,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AAAA,MACF;AAIA,UAAI,MAAM,QAAQ,UAAa,MAAM,IAAI,iBAAiB,OAAO,gBAAgB;AAC/E,eAAO,OAAO,qBAAO;AAAA,UACnB,IAAI,YAAY;AAAA,YACd,MAAM;AAAA,YACN,SAAS;AAAA,YACT,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AAAA,MACF;AACA,YAAM,OAAO,OAAO,QAAQ,KAAK;AAAA,QAC/B,QAAQ,MAAM;AAAA,QACd,OAAO,MAAM;AAAA,QACb,gBAAgB,eAAe,OAAO,MAAM;AAAA,MAC9C,CAAC;AAID,YAAM,gBAAgB,KAAK,OAAO,kBAAkB,OAAO;AAC3D,UAAI,kBAAkB,MAAM,gBAAgB;AAC1C,eAAO,OAAO,qBAAO;AAAA,UACnB,IAAI,YAAY;AAAA,YACd,MAAM;AAAA,YACN,SAAS;AAAA,YACT,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AAAA,MACF;AAGA,UACE,MAAM,QAAQ,WACb,KAAK,oBAAoB,UACvB,MAAM,IAAI,SAAS,MAAM,UAAU,KAAK,oBAAoB,MAAM,IAAI,kBACzE;AACA,eAAO,OAAO,qBAAO;AAAA,UACnB,IAAI,YAAY;AAAA,YACd,MAAM;AAAA,YACN,SAAS;AAAA,YACT,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AAAA,MACF;AACA,YAAM,UAAU,OAAO,QAAQ,IAAI;AAAA,QACjC,MAAM;AAAA,QACN,QAAQ,KAAK;AAAA,QACb,QAAQ,KAAK;AAAA,QACb,UAAU,KAAK;AAAA,QACf,gBAAgB,eAAe,OAAO,OAAO,MAAM,SAAS,MAAM,OAAO,EAAE;AAAA,QAC3E;AAAA,QACA,GAAI,MAAM,UAAU,SAAY,CAAC,IAAI,EAAE,eAAe,MAAM,MAAM;AAAA,MACpE,CAAC;AACD,aAAO;AAAA,QACL,WAAW,MAAM;AAAA,QACjB,sBAAsB,MAAM;AAAA,QAC5B,iBAAiB,MAAM;AAAA,QACvB,uBAAuB,OAAO;AAAA,QAC9B,gBAAgB,MAAM;AAAA,QACtB,QAAQ,KAAK;AAAA,QACb,YAAY,KAAK;AAAA,QACjB,GAAI,KAAK,oBAAoB,SAAY,CAAC,IAAI,EAAE,iBAAiB,KAAK,gBAAgB;AAAA,QACtF,UAAU,KAAK;AAAA,QACf,UAAU,KAAK;AAAA,QACf;AAAA,MACF;AAAA,IACF;AAAA,IACA,KAAK;AAAA,IACL,KAAK,QAAQ;AACX,YAAM,UAAU;AAAA,QACd,GAAG,MAAM;AAAA,QACT,gBAAgB,eAAe,OAAO,MAAM,SAAS;AAAA,QACrD;AAAA,MACF;AACA,YAAM,UAAU,OAAO,MAAM,cAAc,YAAY,QAAQ,QAAQ,OAAO,IAAI,QAAQ,KAAK,OAAO;AACtG,aAAO,EAAE,WAAW,MAAM,WAAW,sBAAsB,MAAM,sBAAsB,QAAQ;AAAA,IACjG;AAAA,IACA,KAAK,UAAU;AACb,YAAM,UAAU,OAAO,QAAQ,OAAO;AAAA,QACpC,OAAO,MAAM;AAAA,QACb,QAAQ,MAAM;AAAA,QACd,gBAAgB,eAAe,OAAO,QAAQ;AAAA,QAC9C;AAAA,MACF,CAAC;AACD,aAAO,EAAE,WAAW,MAAM,WAAW,sBAAsB,MAAM,sBAAsB,QAAQ;AAAA,IACjG;AAAA,IACA,KAAK,SAAS;AACZ,YAAM,UAAU,OAAO,QAAQ,MAAM;AAAA,QACnC,OAAO,MAAM;AAAA,QACb,gBAAgB,eAAe,OAAO,OAAO;AAAA,QAC7C,GAAI,MAAM,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,QAChE,SAAS;AAAA,UACP,GAAG,MAAM;AAAA,UACT,OAAO,MAAM;AAAA,UACb,WAAW,MAAM;AAAA,UACjB,WAAW,MAAM;AAAA,UACjB,GAAI,MAAM,gBAAgB,SAAY,CAAC,IAAI,EAAE,aAAa,MAAM,YAAY;AAAA,UAC5E;AAAA,QACF;AAAA,MACF,CAAC;AACD,aAAO,EAAE,WAAW,MAAM,WAAW,sBAAsB,MAAM,sBAAsB,QAAQ;AAAA,IACjG;AAAA;AAAA;AAAA;AAAA,IAIA,KAAK,YAAY;AACf,YAAM,WAAW,OAAO,qBAAO,cAAc,sCAAe;AAC5D,YAAM,WAAW,OAAO,oBACrB,SAAS,SAAS,SAAS,SAAS,MAAM,kBAAkB;AAC/D,UAAI,aAAa,QAAW;AAC1B,eAAO,OAAO,qBAAO;AAAA,UACnB,IAAI,YAAY;AAAA,YACd,MAAM;AAAA,YACN,SAAS;AAAA,YACT,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AAAA,MACF;AACA,YAAM,UAAU,OAAO,SAAS,EAAE,OAAO,MAAM,OAAO,WAAW,eAAe,OAAO,UAAU,EAAE,CAAC;AACpG,aAAO,EAAE,WAAW,MAAM,WAAW,sBAAsB,MAAM,sBAAsB,QAAQ;AAAA,IACjG;AAAA,IACA,KAAK;AAAA,IACL,KAAK,UAAU;AACb,YAAM,UAAU;AAAA,QACd,OAAO,MAAM;AAAA,QACb,gBAAgB,eAAe,OAAO,MAAM,SAAS;AAAA,QACrD,GAAI,MAAM,WAAW,SAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;AAAA,QAC7D;AAAA,MACF;AACA,YAAM,UAAU,OAAO,MAAM,cAAc,WAAW,QAAQ,OAAO,OAAO,IAAI,QAAQ,OAAO,OAAO;AACtG,aAAO,EAAE,WAAW,MAAM,WAAW,sBAAsB,MAAM,sBAAsB,QAAQ;AAAA,IACjG;AAAA,EACF;AACF,CAAC;AAEH,MAAM,iBAAiB,CAAC,WAAoF;AAC1G,MAAI,WAAW,UAAa,WAAW,GAAI,QAAO,qBAAO,QAAQ,MAAS;AAC1E,QAAM,QAAQ,yBAAyB,KAAK,MAAM;AAClD,QAAM,WAAW,OAAO,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC;AAChD,QAAM,SAAS,QAAQ,CAAC,MAAM,SAAY,SAAY,OAAO,MAAM,CAAC,CAAC;AACrE,QAAM,QAAQ,CAAC,UAAkB,OAAO,cAAc,KAAK,KAAK,SAAS,KAAK,QAAQ,OAAO;AAC7F,SAAO,UAAU,QAAQ,MAAM,QAAQ,MAAM,WAAW,UAAa,MAAM,MAAM,KAC7E,qBAAO,QAAQ,EAAE,UAAU,GAAI,WAAW,SAAY,CAAC,IAAI,EAAE,OAAO,EAAG,CAAC,IACxE,qBAAO;AAAA,IACP,IAAI,YAAY;AAAA,MACd,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACJ;AAEA,MAAM,gBAAgB,CAAC,WACrB,OAAO,WAAW,SAAY,OAAO,OAAO,QAAQ,IAAI,MAAM,OAAO,QAAQ,IAAI,OAAO,MAAM;AAOzF,MAAM,UAAU,CAAC,SAA6B,OAAuB,aAC1E,qBAAO,IAAI,aAAY;AACrB,QAAM,QAAQ,OAAO,eAAe,MAAM,WAAW;AACrD,QAAM,QAAQ,KAAK,IAAI,MAAM,SAAS,mBAAmB,iBAAiB;AAC1E,QAAM,SAAS,OAAO,QAAQ,KAAK,EAAE,MAAM,QAAQ,SAAS,EAAE,OAAO,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;AAC9F,QAAM,UAAU,OAAO,SAAS,SAAS,OAAO,MAAM,CAAC,IAAI;AAC3D,MAAI,YAAY,QAAW;AACzB,WAAO,OAAO,qBAAO;AAAA,MACnB,IAAI,YAAY,EAAE,MAAM,iBAAiB,SAAS,mCAAmC,WAAW,KAAK,CAAC;AAAA,IACxG;AAAA,EACF;AACA,QAAM,SAAS,MAAM;AAAA,IACnB,OAAO,qBAAO,WAAW,qBAAO;AAAA,MAC9B,QAAQ,MAAM;AAAA,QACZ,OAAO,MAAM;AAAA,QACb,GAAI,UAAU,SACV,CAAC,IACD,MAAM,WAAW,SACjB,EAAE,eAAe,MAAM,SAAS,IAChC,EAAE,aAAa,MAAM;AAAA,QACzB,QAAQ;AAAA,MACV,CAAC;AAAA,MACD,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AACA,QAAM,OAAO,OAAO,MAAM,GAAG,KAAK;AAClC,QAAM,OAAO,KAAK,GAAG,EAAE;AAIvB,MAAI;AACJ,MAAI,UAAiF,CAAC;AACtF,MAAI,SAAS,IAAI,QAAQ,MAAM,GAAG;AAChC,UAAM,cAAc,OAAO,YAAY,KAAK,OAAO;AACnD,UAAM,WAAW,OAAO,YAAY,SAAS,EAAE,MAAM,eAAe,OAAO,MAAM,MAAM,CAAC;AACxF,UAAM,MAAM,SAAS,KAAK,KAAK,qBAAO,GAAG,sCAAa,CAAC;AACvD,QACE,QAAQ,UAAa,IAAI,UAAU,QAAQ,SAAS,IAAI,WAAW,QAAQ,UAC3E,IAAI,WAAW,QAAQ,UAAU,IAAI,WAAW,QAAQ,UAAU,IAAI,eAAe,QAAQ,YAC7F;AACA,aAAO,OAAO,qBAAO;AAAA,QACnB,IAAI,YAAY,EAAE,MAAM,YAAY,SAAS,uCAAuC,WAAW,KAAK,CAAC;AAAA,MACvG;AAAA,IACF;AACA,kBAAc,IAAI;AAClB,cAAU;AAAA,MACR,GAAI,IAAI,iBAAiB,SAAY,CAAC,IAAI,EAAE,cAAc,IAAI,aAAa;AAAA,MAC3E,GAAI,IAAI,eAAe,SAAY,CAAC,IAAI,EAAE,YAAY,IAAI,WAAW;AAAA,IACvE;AAAA,EACF;AAEA,QAAM,cAAc,OAAO,qBAAO,oBAAoB,+BAAU,EAAE,OAAO;AACzE,QAAM,iBAAiB,aAAa,SAAY,SAAY,OAAO,SAAS,MAAM,KAAK;AACvF,MAAI,mBAAmB,UAAa,eAAe,UAAU,MAAM,OAAO;AACxE,WAAO,OAAO,qBAAO;AAAA,MACnB,IAAI,YAAY,EAAE,MAAM,YAAY,SAAS,0CAA0C,WAAW,MAAM,CAAC;AAAA,IAC3G;AAAA,EACF;AACA,SAAO;AAAA,IACL,KAAK;AAAA,MACH,GAAG;AAAA,MACH,GAAI,mBAAmB,SAAY,CAAC,IAAI,EAAE,eAAe;AAAA,MACzD,GAAI,gBAAgB,SAAY,CAAC,IAAI,EAAE,YAAY;AAAA,MACnD,GAAG;AAAA,IACL;AAAA,IACA,QAAQ;AAAA,IACR,YAAY,SAAS,SACjB,MAAM,eAAe,KACrB,cAAc,KAAK,UAAU,EAAE,UAAU,KAAK,SAAS,CAAC;AAAA,IAC5D,SAAS,OAAO,SAAS;AAAA,IACzB,UAAU,SAAS,IAAI,QAAQ,MAAM;AAAA,EACvC;AACF,CAAC;AAKH,MAAM,kBAAkB,oBAAI,QAM1B;AACF,MAAM,sBAAsB,KAAK,OAAO;AAMjC,MAAM,UAAU,CAAC,SAA6B,OAAe,OAClE,qBAAO,IAAI,aAAY;AACrB,QAAM,SAAS,OAAO,QAAQ,KAAK,EAAE,MAAM,QAAQ,SAAS,EAAE,MAAM,GAAG,OAAO,EAAE,CAAC;AACjF,QAAM,MAAM,OAAO,SAAS,SAAS,OAAO,MAAM,CAAC,IAAI;AACvD,MAAI,QAAQ,UAAa,IAAI,UAAU,OAAO;AAC5C,WAAO,OAAO,IAAI,YAAY;AAAA,MAC5B,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACA,QAAM,QAAQ,gBAAgB,IAAI,OAAO,KACvC,oBAAI,IAAuF;AAC7F,kBAAgB,IAAI,SAAS,KAAK;AAClC,QAAM,SAAS,MAAM,IAAI,KAAK;AAC9B,QAAM,OAAO,QAAQ,QAAQ,GAAG,EAAE,GAAG;AAErC,QAAM,WAAW,SAAS,SAAY,IAAI,OAAQ,QAAQ,OAAO,CAAC,QAAQ,IAAI,aAAa,IAAI,EAAE;AACjG,MAAI,UAAU;AACd,QAAM,SAAS,MAAM;AAAA,IACnB,OAAO,qBAAO;AAAA,MACZ,QAAQ,MAAM;AAAA,QACZ;AAAA,QACA,QAAQ;AAAA,QACR,GAAI,SAAS,UAAa,SAAS,IAAI,CAAC,IAAI,EAAE,eAAe,OAAO,EAAE;AAAA,MACxE,CAAC,EAAE;AAAA,QACD,qBAAO;AAAA,UAAO,CAAC,QACb,SAAS,UAAa,IAAI,WAAW,QAAQ,IAAI,aAAa,QAAQ,aAAa;AAAA,QACrF;AAAA,QACA,qBAAO,KAAK,YAAY,mBAAmB,CAAC;AAAA,MAC9C;AAAA,IACF;AAAA,EACF;AACA,QAAM,UAAU,CAAC,GAAI,QAAQ,WAAW,CAAC,GAAI,GAAG,MAAM;AACtD,MAAI,QAAQ,SAAS,YAAY,kBAAkB;AACjD,WAAO,OAAO,IAAI,YAAY;AAAA,MAC5B,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACA,QAAM,SAAS,QAAQ,SAAS,KAC9B,OAAO,OAAO,CAAC,KAAK,QAAQ,MAAM,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,GAAG,CAAC,EAAE,YAAY,CAAC;AAC/F,QAAM,UAAU,MAAM,IAAI,KAAK;AAE/B,MAAI,SAAS,wBAAwB,YAAY,UAAa,QAAQ,QAAQ,UAAU,QAAQ,SAAS;AACvG,UAAM,OAAO,KAAK;AAClB,UAAM,IAAI,OAAO,EAAE,SAAS,MAAM,CAAC;AACnC,QAAI,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,EAAE,OAAO,CAAC,KAAK,UAAU,MAAM,MAAM,OAAO,CAAC;AAC3E,WAAO,MAAM,OAAO,MAAM,QAAQ,qBAAqB;AACrD,YAAM,SAAS,MAAM,KAAK,EAAE,KAAK,EAAE;AACnC,eAAS,MAAM,IAAI,MAAM,EAAG;AAC5B,YAAM,OAAO,MAAM;AAAA,IACrB;AAAA,EACF;AACA,QAAM,aAAS,oCAAmB,EAAE,OAAO,QAAQ,IAAI,QAAQ,QAAQ,IAAI,OAAO,GAAG,SAAS,EAAE;AAGhG,MAAI,QAAQ;AACZ,MAAI,MAAM;AACV,aAAW,OAAO,SAAS;AACzB,QAAI,IAAI,aAAa,GAAG;AACtB,cAAQ,KAAK,IAAI,OAAO,IAAI,UAAU;AACtC,YAAM,KAAK,IAAI,KAAK,IAAI,UAAU;AAAA,IACpC;AAAA,EACF;AACA,QAAM,QACJ;AAAA,IACE,GAAG;AAAA,IACH,GAAI,QAAQ,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,IAAI,KAAK,KAAK,EAAE,YAAY,GAAG,KAAK,IAAI,KAAK,GAAG,EAAE,YAAY,EAAE,EAAE;AAAA,EAC5G;AACF,MAAI,OAAO,OAAW,QAAO,MAAM;AACnC,MAAI,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,KAAK,CAAC,EAAE,aAAa,YAAY,oBAAoB;AAC/F,WAAO,OAAO,IAAI,YAAY;AAAA,MAC5B,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACA,SAAO;AACT,CAAC;AAOI,MAAM,kBAAkB,qBAAO,OAAO;AAAA,EAC3C,UAAU,qBAAO,QAAQ,QAAQ;AAAA,EACjC,IAAI,qBAAO,QAAQ,IAAI;AAAA,EACvB,OAAO,qBAAO,OAAO;AAAA,IACnB,WAAW,qBAAO;AAAA,IAClB,sBAAsB,qBAAO;AAAA,IAC7B,iBAAiB,qBAAO,SAAS,mBAAmB;AAAA,IACpD,uBAAuB,qBAAO,SAAS,MAAM;AAAA,IAC7C,gBAAgB,qBAAO,SAAS,cAAc;AAAA,IAC9C,QAAQ,qBAAO,SAAS,qBAAO,MAAM;AAAA,IACrC,YAAY,qBAAO,SAAS,MAAM;AAAA,IAClC,iBAAiB,qBAAO,SAAS,MAAM;AAAA,IACvC,UAAU,qBAAO,SAAS,qBAAO,IAAI;AAAA,IACrC,UAAU,qBAAO,SAAS,oCAAe;AAAA,IACzC,SAAS;AAAA,EACX,CAAC;AACH,CAAC;AAOM,MAAM,kBAAkB,qBAAO,OAAO;AAAA,EAC3C,UAAU,qBAAO,QAAQ,QAAQ;AAAA,EACjC,IAAI,qBAAO,QAAQ,IAAI;AAAA,EACvB,OAAO,qBAAO,OAAO;AAAA,IACnB,KAAK,qBAAO,OAAO;AAAA,MACjB,GAAG,gCAAW;AAAA,MACd,aAAa,qBAAO,SAAS,qBAAO,MAAM;AAAA,MAC1C,cAAc,qBAAO,SAAS,MAAM,KAAK;AAAA,MACzC,YAAY,qBAAO,SAAS,qBAAO,MAAM;AAAA,MACzC,gBAAgB,qBAAO,YAAY,cAAc;AAAA,IACnD,CAAC;AAAA,IACD,QAAQ,qBAAO,MAAM,iCAAY;AAAA,IACjC,YAAY,qBAAO;AAAA,IACnB,SAAS,qBAAO;AAAA,IAChB,UAAU,qBAAO;AAAA,EACnB,CAAC;AACH,CAAC;AAOM,MAAM,gBAAgB,qBAAO,OAAO;AAAA,EACzC,UAAU,qBAAO,QAAQ,QAAQ;AAAA,EACjC,IAAI,qBAAO,QAAQ,KAAK;AAAA,EACxB,OAAO,qBAAO,OAAO,EAAE,MAAM,qBAAO,QAAQ,SAAS,qBAAO,QAAQ,WAAW,qBAAO,QAAQ,CAAC;AACjG,CAAC;AAED,MAAM,gBAAgB,CAAC,UAAmB;AACxC,QAAM,QAAQ,qBAAO,GAAG,aAAa,kBAAkB,EAAE,KAAK;AAC9D,QAAM,OAAO,iBAAiB,eAAe,QAAQ,MAAM,OAAO;AAClE,QAAM,YAAY,iBAAiB,cAC/B,MAAM,YACN,iBAAiB,aAAa,iBAC9B,MAAM,YACN,eAAe,IAAI,IAAI;AAG3B,QAAM,UAAU,iBAAiB,cAAc,MAAM,UAAU;AAC/D,QAAM,SAAS,SAAS,iBACtB,MACE,cAAc,IAAI,IAAI,IACxB,MACE,cAAc,IAAI,IAAI,IACxB,MACE,YACF,MACE,SAAS,aACX,MACE;AACJ,SAAO,+BAAmB,WAAW,EAAE,UAAU,IAAI,OAAO,OAAO,EAAE,MAAM,SAAS,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC;AAC/G;AASA,MAAM,mBAAmB,CAAC,cAAmE,CAAC,UAAmB;AAC/G,QAAM,WAAW,cAAc,KAAK;AACpC,MAAI,iBAAiB,YAAa,QAAO,qBAAO,QAAQ,QAAQ;AAChE,QAAM,OAAO,qBAAO,GAAG,aAAa,kBAAkB,EAAE,KAAK,IAAI,MAAM,OAAO;AAC9E,SAAO,qBAAO,SAAS,EAAE,SAAS,iCAAiC,WAAW,MAAM,MAAM,CAAC,EAAE;AAAA,IAC3F,qBAAO,GAAG,QAAQ;AAAA,EACpB;AACF;AAEA,MAAM,WAAW,qBAAO,IAAI,aAAY;AACtC,QAAM,UAAU,OAAO,8BAAkB;AACzC,QAAM,OAAO,OAAO,QAAQ;AAC5B,SAAO,OAAO,qBAAO,IAAI;AAAA,IACvB,KAAK,MAAM,KAAK,MAAM,IAAI;AAAA,IAC1B,OAAO,MAAM,IAAI,YAAY,EAAE,MAAM,mBAAmB,SAAS,6BAA6B,WAAW,MAAM,CAAC;AAAA,EAClH,CAAC;AACH,CAAC;AAED,MAAM,gBAAgB,CACpB,QACA,WAEA,qBAAO,IAAI,aAAY;AACrB,QAAM,UAAU,OAAO,8BAAkB;AACzC,QAAM,YAAY,OAAO,OAAO,aAAa,QAAQ,OAAO;AAC5D,SAAO,OAAO,OAAO,SAAS;AAChC,CAAC;AAOI,MAAM,QAAQ,CAAC,WAAmB;AACvC,QAAM,UAAU,cAAc,QAAQ,CAAC,cACrC,qBAAO,IAAI,aAAY;AACrB,UAAM,OAAO,OAAO;AACpB,UAAM,QAAQ,OAAO,cAAc,IAAI,EAAE,KAAK,qBAAO;AAAA,MAAS,MAC5D,IAAI,YAAY;AAAA,QACd,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH,CAAC;AACD,UAAM,UAAU,OAAO;AACvB,UAAM,QAAQ,OAAO,QAAQ,QAAQ,SAAS,WAAW,KAAK;AAC9D,WAAO,+BAAmB,WAAW,EAAE,UAAU,IAAI,MAAM,MAAM,CAAC;AAAA,EACpE,CAAC,CAAC,EAAE;AAAA,IACF,qBAAO,MAAM,iBAAiB,wBAAwB,CAAC;AAAA,IACvD,qBAAO,SAAS,wBAAwB;AAAA,EAC1C;AAEF,QAAM,cAAc,cAAc,QAAQ,MACxC,qBAAO,IAAI,aAAY;AACrB,UAAM,OAAO,OAAO;AACpB,UAAM,QAAQ,OAAO,cAAc,IAAI,EAAE,KAAK,qBAAO;AAAA,MAAS,MAC5D,IAAI,YAAY;AAAA,QACd,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH,CAAC;AACD,UAAM,UAAU,OAAO;AACvB,UAAM,QAAQ,OAAO,QAAQ,SAAS,OAAO,OAAO,cAAc;AAClE,WAAO,+BAAmB,WAAW,EAAE,UAAU,IAAI,MAAM,MAAM,CAAC;AAAA,EACpE,CAAC,CAAC,EAAE;AAAA,IACF,qBAAO,MAAM,iBAAiB,wBAAwB,CAAC;AAAA,IACvD,qBAAO,SAAS,wBAAwB;AAAA,EAC1C;AAEF,QAAM,aAAa,cAAc,QAAQ,MACvC,qBAAO,IAAI,aAAY;AACrB,UAAM,OAAO,OAAO;AACpB,UAAM,QAAQ,OAAO,qBAAO,oBAAoB,qBAAO,OAAO;AAAA,MAC5D,UAAU,qBAAO,QAAQ,QAAQ;AAAA,MACjC,OAAO,qBAAO;AAAA,MACd,IAAI,qBAAO,SAAS,qBAAO,IAAI,MAAM,qBAAO,uBAAuB,CAAC,CAAC,CAAC;AAAA,IACxE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,qBAAO;AAAA,MAAS,MAC7B,IAAI,YAAY,EAAE,MAAM,mBAAmB,SAAS,2BAA2B,WAAW,MAAM,CAAC;AAAA,IACnG,CAAC;AACD,UAAM,UAAU,OAAO;AACvB,WAAO,+BAAmB,WAAW;AAAA,MACnC;AAAA,MACA,IAAI;AAAA,MACJ,OAAO,OAAO,QAAQ,SAAS,MAAM,OAAO,MAAM,EAAE;AAAA,IACtD,CAAC;AAAA,EACH,CAAC,CAAC,EAAE,KAAK,qBAAO,MAAM,iBAAiB,wBAAwB,CAAC,CAAC;AAEnE,SAAO,uBAAW,IAAI,QAAQ,uBAAuB,OAAO,EAAE;AAAA,IAC5D,oBAAM,MAAM,uBAAW,IAAI,QAAQ,uBAAuB,UAAU,CAAC;AAAA,IACrE,oBAAM,MAAM,uBAAW,IAAI,QAAQ,uBAAuB,WAAW,CAAC;AAAA,EACxE;AACF;",
+  "names": []
+}

package/dist/cjs/bun/BunGateway.d.ts

@@ -0,0 +1,20 @@
+/** Bun HTTP adapter for the same authenticated workspace gateway protocol.
+ * @since 1.0.0
+ */
+import { Layer } from "effect";
+import type { HttpServer } from "effect/unstable/http/HttpServer";
+import { GatewayError } from "../GatewayError.ts";
+import type * as GatewayServer from "../GatewayServer.ts";
+import * as NativeGateway from "../internal/NativeGateway.ts";
+export { bearerPrincipal, scopedPrincipal } from "../internal/NativeGateway.ts";
+/** TCP bind and existing gateway policy options supported by the Bun host.
+ * @since 1.0.0
+ * @category models
+ */
+export type ServerOptions = Pick<NativeGateway.ServerOptions, "host" | "port" | "allowedHosts" | "listen" | "credential" | "heartbeatMillis" | "maxRequestBodyBytes">;
+/** Serves the existing HTTP/WebSocket gateway using Bun.serve in the caller's scope.
+ * @since 1.0.0
+ * @category layers
+ */
+export declare const layer: (health: GatewayServer.Health, options?: ServerOptions) => Layer.Layer<HttpServer, GatewayError | import("@smthrs/sync/SyncError").SyncError, import("@smthrs/control/Control").Control | import("@smthrs/sync/SyncRpcs").SyncAuth | import("@smthrs/sync/SyncServer").SyncServer | import("../Projections.ts").Projections>;
+//# sourceMappingURL=BunGateway.d.ts.map

package/dist/cjs/bun/BunGateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BunGateway.d.ts","sourceRoot":"","sources":["../../../src/bun/BunGateway.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAiB,KAAK,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAA;AAEjE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,KAAK,KAAK,aAAa,MAAM,qBAAqB,CAAA;AACzD,OAAO,KAAK,aAAa,MAAM,8BAA8B,CAAA;AAE7D,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAE/E;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,IAAI,CAC9B,aAAa,CAAC,aAAa,EAC3B,MAAM,GAAG,MAAM,GAAG,cAAc,GAAG,QAAQ,GAAG,YAAY,GAAG,iBAAiB,GAAG,qBAAqB,CACvG,CAAA;AAyBD;;;GAGG;AACH,eAAO,MAAM,KAAK,GAAI,QAAQ,aAAa,CAAC,MAAM,EAAE,UAAS,aAAkD,sQACtF,CAAA"}

package/dist/cjs/bun/BunGateway.js

@@ -0,0 +1,62 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var BunGateway_exports = {};
+__export(BunGateway_exports, {
+  bearerPrincipal: () => import_NativeGateway.bearerPrincipal,
+  layer: () => layer,
+  scopedPrincipal: () => import_NativeGateway.scopedPrincipal
+});
+module.exports = __toCommonJS(BunGateway_exports);
+var BunHttpServer = __toESM(require("../../vendor/cjs/bun/BunHttpServer.js"), 1);
+var import_effect = require("effect");
+var import_GatewayError = require("../GatewayError.js");
+var NativeGateway = __toESM(require("../internal/NativeGateway.js"), 1);
+var import_NativeGateway = require("../internal/NativeGateway.js");
+const native = NativeGateway.makeLayer(
+  (options) => BunHttpServer.layerServer({
+    // Shared listenOptions has already supplied and admitted the bind host.
+    hostname: options.host,
+    port: options.port ?? 7331
+  }).pipe(import_effect.Layer.catchCause((cause) => {
+    const failure = import_effect.Cause.squash(cause);
+    const code = typeof failure === "object" && failure !== null && "code" in failure ? failure.code : void 0;
+    if (import_effect.Cause.hasInterruptsOnly(cause) || !["EADDRINUSE", "EACCES", "EADDRNOTAVAIL"].includes(String(code))) {
+      return import_effect.Layer.effectContext(import_effect.Effect.failCause(cause));
+    }
+    return import_effect.Layer.effectContext(import_effect.Effect.fail(
+      new import_GatewayError.GatewayError({
+        code: "bind_failed",
+        message: "The gateway socket could not be bound",
+        cause: { _tag: "BunServeError", code: String(code) }
+      })
+    ));
+  }))
+);
+const layer = (health, options = NativeGateway.defaultServerOptions) => native(health, options);
+//# sourceMappingURL=BunGateway.js.map

package/dist/cjs/bun/BunGateway.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/bun/BunGateway.ts"],
+  "sourcesContent": ["/** Bun HTTP adapter for the same authenticated workspace gateway protocol.\n * @since 1.0.0\n */\n\nimport * as BunHttpServer from \"@effect/platform-bun/BunHttpServer\"\nimport { Cause, Effect, Layer } from \"effect\"\nimport type { HttpServer } from \"effect/unstable/http/HttpServer\"\nimport type { ServeError } from \"effect/unstable/http/HttpServerError\"\nimport { GatewayError } from \"../GatewayError.ts\"\nimport type * as GatewayServer from \"../GatewayServer.ts\"\nimport * as NativeGateway from \"../internal/NativeGateway.ts\"\n\nexport { bearerPrincipal, scopedPrincipal } from \"../internal/NativeGateway.ts\"\n\n/** TCP bind and existing gateway policy options supported by the Bun host.\n * @since 1.0.0\n * @category models\n */\nexport type ServerOptions = Pick<\n  NativeGateway.ServerOptions,\n  \"host\" | \"port\" | \"allowedHosts\" | \"listen\" | \"credential\" | \"heartbeatMillis\" | \"maxRequestBodyBytes\"\n>\n\nconst native = NativeGateway.makeLayer((options) =>\n  BunHttpServer.layerServer({\n    // Shared listenOptions has already supplied and admitted the bind host.\n    hostname: options.host!,\n    port: options.port ?? 7331\n  }).pipe(Layer.catchCause((cause): Layer.Layer<HttpServer, ServeError | GatewayError> => {\n    const failure = Cause.squash(cause)\n    const code = typeof failure === \"object\" && failure !== null && \"code\" in failure ? failure.code : undefined\n    if (Cause.hasInterruptsOnly(cause) || ![\"EADDRINUSE\", \"EACCES\", \"EADDRNOTAVAIL\"].includes(String(code))) {\n      return Layer.effectContext<HttpServer, ServeError | GatewayError, never>(Effect.failCause(cause))\n    }\n    // The errno is safe to keep: NativeGateway logs it for the operator and\n    // strips it from the refusal every bearer holder sees.\n    return Layer.effectContext<HttpServer, ServeError | GatewayError, never>(Effect.fail(\n      new GatewayError({\n        code: \"bind_failed\",\n        message: \"The gateway socket could not be bound\",\n        cause: { _tag: \"BunServeError\", code: String(code) }\n      })\n    ))\n  }))\n)\n\n/** Serves the existing HTTP/WebSocket gateway using Bun.serve in the caller's scope.\n * @since 1.0.0\n * @category layers\n */\nexport const layer = (health: GatewayServer.Health, options: ServerOptions = NativeGateway.defaultServerOptions) =>\n  native(health, options)\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,oBAA+B;AAC/B,oBAAqC;AAGrC,0BAA6B;AAE7B,oBAA+B;AAE/B,2BAAiD;AAWjD,MAAM,SAAS,cAAc;AAAA,EAAU,CAAC,YACtC,cAAc,YAAY;AAAA;AAAA,IAExB,UAAU,QAAQ;AAAA,IAClB,MAAM,QAAQ,QAAQ;AAAA,EACxB,CAAC,EAAE,KAAK,oBAAM,WAAW,CAAC,UAA8D;AACtF,UAAM,UAAU,oBAAM,OAAO,KAAK;AAClC,UAAM,OAAO,OAAO,YAAY,YAAY,YAAY,QAAQ,UAAU,UAAU,QAAQ,OAAO;AACnG,QAAI,oBAAM,kBAAkB,KAAK,KAAK,CAAC,CAAC,cAAc,UAAU,eAAe,EAAE,SAAS,OAAO,IAAI,CAAC,GAAG;AACvG,aAAO,oBAAM,cAA4D,qBAAO,UAAU,KAAK,CAAC;AAAA,IAClG;AAGA,WAAO,oBAAM,cAA4D,qBAAO;AAAA,MAC9E,IAAI,iCAAa;AAAA,QACf,MAAM;AAAA,QACN,SAAS;AAAA,QACT,OAAO,EAAE,MAAM,iBAAiB,MAAM,OAAO,IAAI,EAAE;AAAA,MACrD,CAAC;AAAA,IACH,CAAC;AAAA,EACH,CAAC,CAAC;AACJ;AAMO,MAAM,QAAQ,CAAC,QAA8B,UAAyB,cAAc,yBACzF,OAAO,QAAQ,OAAO;",
+  "names": []
+}

package/dist/cjs/index.d.ts

@@ -0,0 +1,65 @@
+/**
+ * The assembled workspace gateway: one HTTP surface carrying the control
+ * plane, the sync read path, the served projections, and a health probe.
+ *
+ * The package also declares the wire schemas those mounts speak and the pure
+ * folds that compute every served row from control-plane facts.
+ *
+ * @since 0.1.0
+ */
+/**
+ * @since 0.1.0 @category errors
+ */
+export * as GatewayError from "./GatewayError.ts";
+/**
+ * @since 0.1.0 @category models
+ */
+export * as GatewaySchema from "./GatewaySchema.ts";
+/**
+ * @since 1.0.0 @category projections
+ */
+export * as Diagnosis from "./Diagnosis.ts";
+/**
+ * @since 1.0.0 @category projections
+ */
+export * as RunTrace from "./RunTrace.ts";
+/**
+ * @since 1.0.0 @category projections
+ */
+export * as EngineTrace from "./EngineTrace.ts";
+/**
+ * @since 1.0.0 @category projections
+ */
+export * as RunDevTools from "./RunDevTools.ts";
+/**
+ * @since 1.0.0 @category projections
+ */
+export * as GatewayProjection from "./GatewayProjection.ts";
+/**
+ * @since 1.0.0 @category rpc
+ */
+export * as GatewayRpcs from "./GatewayRpcs.ts";
+/**
+ * @since 1.0.0 @category layers
+ */
+export * as GatewayServer from "./GatewayServer.ts";
+/**
+ * @since 1.0.0 @category services
+ */
+export * as Projections from "./Projections.ts";
+/**
+ * @since 1.0.0 @category rpc
+ */
+export * as RunHistory from "./RunHistory.ts";
+/**
+ * @since 1.0.0 @category runtime bridge
+ */
+export * as RuntimeBridge from "./RuntimeBridge.ts";
+/**
+ * The canonical durable journal synchronization package.
+ *
+ * @since 0.1.0
+ * @category services
+ */
+export * as Sync from "@smthrs/sync";
+//# sourceMappingURL=index.d.ts.map

package/dist/cjs/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;GAEG;AACH,OAAO,KAAK,YAAY,MAAM,mBAAmB,CAAA;AAEjD;;GAEG;AACH,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AAEnD;;GAEG;AACH,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAA;AAE3C;;GAEG;AACH,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAA;AAEzC;;GAEG;AACH,OAAO,KAAK,WAAW,MAAM,kBAAkB,CAAA;AAE/C;;GAEG;AACH,OAAO,KAAK,WAAW,MAAM,kBAAkB,CAAA;AAE/C;;GAEG;AACH,OAAO,KAAK,iBAAiB,MAAM,wBAAwB,CAAA;AAE3D;;GAEG;AACH,OAAO,KAAK,WAAW,MAAM,kBAAkB,CAAA;AAE/C;;GAEG;AACH,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AAEnD;;GAEG;AACH,OAAO,KAAK,WAAW,MAAM,kBAAkB,CAAA;AAE/C;;GAEG;AACH,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAA;AAE7C;;GAEG;AACH,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AAEnD;;;;;GAKG;AACH,OAAO,KAAK,IAAI,MAAM,cAAc,CAAA"}

package/dist/cjs/index.js

@@ -0,0 +1,59 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var index_exports = {};
+__export(index_exports, {
+  Diagnosis: () => Diagnosis,
+  EngineTrace: () => EngineTrace,
+  GatewayError: () => GatewayError,
+  GatewayProjection: () => GatewayProjection,
+  GatewayRpcs: () => GatewayRpcs,
+  GatewaySchema: () => GatewaySchema,
+  GatewayServer: () => GatewayServer,
+  Projections: () => Projections,
+  RunDevTools: () => RunDevTools,
+  RunHistory: () => RunHistory,
+  RunTrace: () => RunTrace,
+  RuntimeBridge: () => RuntimeBridge,
+  Sync: () => Sync
+});
+module.exports = __toCommonJS(index_exports);
+var GatewayError = __toESM(require("./GatewayError.js"), 1);
+var GatewaySchema = __toESM(require("./GatewaySchema.js"), 1);
+var Diagnosis = __toESM(require("./Diagnosis.js"), 1);
+var RunTrace = __toESM(require("./RunTrace.js"), 1);
+var EngineTrace = __toESM(require("./EngineTrace.js"), 1);
+var RunDevTools = __toESM(require("./RunDevTools.js"), 1);
+var GatewayProjection = __toESM(require("./GatewayProjection.js"), 1);
+var GatewayRpcs = __toESM(require("./GatewayRpcs.js"), 1);
+var GatewayServer = __toESM(require("./GatewayServer.js"), 1);
+var Projections = __toESM(require("./Projections.js"), 1);
+var RunHistory = __toESM(require("./RunHistory.js"), 1);
+var RuntimeBridge = __toESM(require("./RuntimeBridge.js"), 1);
+var Sync = __toESM(require("@smthrs/sync"), 1);
+//# sourceMappingURL=index.js.map

package/dist/cjs/index.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/index.ts"],
+  "sourcesContent": ["/**\n * The assembled workspace gateway: one HTTP surface carrying the control\n * plane, the sync read path, the served projections, and a health probe.\n *\n * The package also declares the wire schemas those mounts speak and the pure\n * folds that compute every served row from control-plane facts.\n *\n * @since 0.1.0\n */\n\n/**\n * @since 0.1.0 @category errors\n */\nexport * as GatewayError from \"./GatewayError.ts\"\n\n/**\n * @since 0.1.0 @category models\n */\nexport * as GatewaySchema from \"./GatewaySchema.ts\"\n\n/**\n * @since 1.0.0 @category projections\n */\nexport * as Diagnosis from \"./Diagnosis.ts\"\n\n/**\n * @since 1.0.0 @category projections\n */\nexport * as RunTrace from \"./RunTrace.ts\"\n\n/**\n * @since 1.0.0 @category projections\n */\nexport * as EngineTrace from \"./EngineTrace.ts\"\n\n/**\n * @since 1.0.0 @category projections\n */\nexport * as RunDevTools from \"./RunDevTools.ts\"\n\n/**\n * @since 1.0.0 @category projections\n */\nexport * as GatewayProjection from \"./GatewayProjection.ts\"\n\n/**\n * @since 1.0.0 @category rpc\n */\nexport * as GatewayRpcs from \"./GatewayRpcs.ts\"\n\n/**\n * @since 1.0.0 @category layers\n */\nexport * as GatewayServer from \"./GatewayServer.ts\"\n\n/**\n * @since 1.0.0 @category services\n */\nexport * as Projections from \"./Projections.ts\"\n\n/**\n * @since 1.0.0 @category rpc\n */\nexport * as RunHistory from \"./RunHistory.ts\"\n\n/**\n * @since 1.0.0 @category runtime bridge\n */\nexport * as RuntimeBridge from \"./RuntimeBridge.ts\"\n\n/**\n * The canonical durable journal synchronization package.\n *\n * @since 0.1.0\n * @category services\n */\nexport * as Sync from \"@smthrs/sync\"\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAaA,mBAA8B;AAK9B,oBAA+B;AAK/B,gBAA2B;AAK3B,eAA0B;AAK1B,kBAA6B;AAK7B,kBAA6B;AAK7B,wBAAmC;AAKnC,kBAA6B;AAK7B,oBAA+B;AAK/B,kBAA6B;AAK7B,iBAA4B;AAK5B,oBAA+B;AAQ/B,WAAsB;",
+  "names": []
+}

package/dist/cjs/internal/NativeGateway.d.ts

@@ -0,0 +1,176 @@
+/**
+ * Shared native gateway bind policy, credential policy,
+ * and the one composition a `smithers serve` verb hosts.
+ *
+ * Two rules decide whether a bind is allowed, and both fail closed:
+ *
+ * 1. A non-loopback host requires an explicit `listen` opt-in. Binding
+ *    `0.0.0.0` because a port was free is how a workspace gateway ends up on
+ *    a shared network by accident.
+ * 2. A non-loopback bind requires a bearer credential. The control plane can
+ *    launch runs, cancel them, and approve capability grants; reachable from
+ *    another machine, an unauthenticated one is a remote execution service.
+ *
+ * A loopback bind with no network credential allows anonymous reads; approval
+ * decisions require the session operator token. Ingress still checks Host and
+ * Origin so a web page cannot exercise the loopback endpoint.
+ *
+ * @since 1.0.0
+ */
+import { ControlRpcs } from "@smthrs/control";
+import { Effect, Layer } from "effect";
+import type { HttpServer } from "effect/unstable/http/HttpServer";
+import type { ServeError } from "effect/unstable/http/HttpServerError";
+import type { ListenOptions } from "node:net";
+import { GatewayError } from "../GatewayError.ts";
+import * as GatewayServer from "../GatewayServer.ts";
+import type * as RuntimeBridge from "../RuntimeBridge.ts";
+/**
+ * Where the gateway binds, and whether a non-loopback bind was asked for.
+ *
+ * @since 1.0.0
+ * @category models
+ */
+export interface ServerOptions extends ListenOptions {
+    /** Additional accepted Host header names (without ports), for network or proxy access. */
+    readonly allowedHosts?: ReadonlyArray<string> | undefined;
+    /** The `--listen` opt-in required for a non-loopback host. */
+    readonly listen?: boolean | undefined;
+    /** The shared bearer credential, required for a non-loopback bind. */
+    readonly credential?: string | undefined;
+    /** Per-session approval token on credential-free loopback. Read calls remain anonymous. */
+    readonly operatorToken?: string | undefined;
+    /**
+     * How often an idle followed `Watch` on `/rpc/ws` and an idle followed
+     * `Projection.Subscribe` on `/projections/ws` emit a keepalive frame. Unset,
+     * both run at `Projections.heartbeatIntervalMillis` unless the supplied
+     * `Projections` service was built with its own cadence. A relay with an idle
+     * cut shorter than that one needs a shorter cadence here.
+     */
+    readonly heartbeatMillis?: number | undefined;
+    /** Maximum bytes accepted on one HTTP RPC request. Default one MiB. */
+    readonly maxRequestBodyBytes?: number | undefined;
+    /** Immutable identity of an opt-in packaged Flow runtime bridge. */
+    readonly runtimeBridge?: Omit<RuntimeBridge.Config, "authenticate"> | undefined;
+}
+/**
+ * The default bind: loopback, port 7331, no credential.
+ *
+ * @since 1.0.0
+ * @category models
+ */
+export declare const defaultServerOptions: ServerOptions;
+/**
+ * Whether a host names this machine only.
+ *
+ * @param host the host to classify
+ * @since 1.0.0
+ * @category predicates
+ */
+export declare const isLoopbackHost: (host: string) => boolean;
+/**
+ * The typed refusal a requested bind earns, or `undefined` when it is allowed.
+ *
+ * Every start-time rule this module enforces answers here as a `bind_failed`
+ * `GatewayError`, so a host that wants to report a refusal rather than crash on
+ * one asks this before it composes a layer. {@link listenOptions} and
+ * {@link layer} fail with exactly what this returns.
+ *
+ * @param options the requested bind
+ * @since 1.0.0
+ * @category constructors
+ */
+export declare const bindRefusal: (options: ServerOptions) => GatewayError | undefined;
+/**
+ * Applies the bind policy, returning the admitted Node options or a typed
+ * `bind_failed` refusal.
+ *
+ * @param options the requested bind
+ * @since 1.0.0
+ * @category constructors
+ */
+export declare const listenOptions: (options: ServerOptions) => Effect.Effect<ListenOptions, GatewayError>;
+/**
+ * The authentication both RPC mounts run under.
+ *
+ * A configured credential authenticates every request that presents it and
+ * stamps the same server-owned principal. A scoped token minted under that
+ * credential (`@smthrs/control` `ScopedToken`) authenticates only the
+ * procedures, run, or flow it names, until it expires, and stamps
+ * {@link scopedPrincipal}. With no credential the composition is
+ * loopback-only (see {@link listenOptions}) and every request runs as the
+ * anonymous read principal. A session operator token alone stamps the local
+ * operator for approval decisions; without it approvals are unauthorized.
+ *
+ * @param options the requested bind
+ * @since 1.0.0
+ * @category layers
+ */
+export declare const layerAuth: (options: ServerOptions) => Layer.Layer<ControlRpcs.ControlAuth>;
+/**
+ * The identity stamped only after this gateway verifies its configured token.
+ * Hosts may explicitly delegate operator decisions to this exact identity.
+ * @category constants
+ * @since 1.0.0
+ */
+export declare const bearerPrincipal: Readonly<{
+    id: "gateway";
+    kind: "bearer";
+}>;
+/**
+ * The protected mounts a scoped token may reach: those guarded in band by
+ * `ControlAuth`, which checks each frame's procedure against the token, and
+ * the ticket exchange that opens their sockets.
+ * @category constants
+ * @since 1.0.0
+ */
+export declare const scopedTokenPaths: ReadonlyArray<string>;
+/**
+ * The identity stamped after this gateway verifies a scoped token minted
+ * under its configured credential. It is its own kind so that delegating
+ * approval to {@link bearerPrincipal} does not delegate it to every token
+ * minted from the bearer; a host that wants a scoped `approve:runs` token to
+ * decide delegates to this identity explicitly.
+ * @category constants
+ * @since 1.0.0
+ */
+export declare const scopedPrincipal: Readonly<{
+    id: "gateway";
+    kind: "scoped";
+}>;
+/**
+ * The ingress policy a requested bind runs behind.
+ *
+ * The accepted Host names are the loopback names, the operator's
+ * `allowedHosts`, and the concrete bind host itself, so `--host 192.168.1.10`
+ * is reachable at that address without naming it twice. A wildcard bind
+ * (`0.0.0.0` or `::`) adds nothing: every interface is not a Host name, and
+ * the operator names the reachable ones. Protected paths are authenticated
+ * before any request body is read.
+ *
+ * @param options the requested bind
+ * @since 1.0.0
+ * @category constructors
+ */
+export declare const ingressOptions: (options: ServerOptions) => GatewayServer.IngressOptions;
+/**
+ * Hosts the assembled gateway on an injected native HTTP server.
+ *
+ * Supplies the bind policy, the shared-credential authentication both RPC
+ * mounts run under, and newline-delimited JSON as the wire serialization. The
+ * caller supplies what the mounts read through: `Control`, `Projections`,
+ * `SyncServer`, and the `SyncAuth` middleware.
+ *
+ * The returned layer retains the concrete `HttpServer` service, so a caller
+ * that bound port 0 can read the ephemeral address it got.
+ *
+ * Policy refusals and operating-system listen failures both fail the layer as
+ * sanitized `bind_failed` `GatewayError` values.
+ *
+ * @param health the identity `GET /health` answers with
+ * @param options the requested bind
+ * @since 1.0.0
+ * @category layers
+ */
+export declare const makeLayer: (server: (options: ListenOptions) => Layer.Layer<HttpServer, ServeError | GatewayError>) => (health: GatewayServer.Health, options?: ServerOptions) => Layer.Layer<HttpServer, GatewayError | import("@smthrs/sync/SyncError").SyncError, import("@smthrs/control/Control").Control | import("@smthrs/sync/SyncRpcs").SyncAuth | import("@smthrs/sync/SyncServer").SyncServer | import("../Projections.ts").Projections>;
+//# sourceMappingURL=NativeGateway.d.ts.map

package/dist/cjs/internal/NativeGateway.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"NativeGateway.d.ts","sourceRoot":"","sources":["../../../src/internal/NativeGateway.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,WAAW,EAAe,MAAM,iBAAiB,CAAA;AAC1D,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAA;AAEtC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAA;AACjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAA;AAEtE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAkB,MAAM,oBAAoB,CAAA;AACjE,OAAO,KAAK,aAAa,MAAM,qBAAqB,CAAA;AACpD,OAAO,KAAK,KAAK,aAAa,MAAM,qBAAqB,CAAA;AAEzD;;;;;GAKG;AACH,MAAM,WAAW,aAAc,SAAQ,aAAa;IAClD,0FAA0F;IAC1F,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;IACzD,8DAA8D;IAC9D,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;IACrC,sEAAsE;IACtE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACxC,2FAA2F;IAC3F,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7C,uEAAuE;IACvE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACjD,oEAAoE;IACpE,QAAQ,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,cAAc,CAAC,GAAG,SAAS,CAAA;CAChF;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,aAAiD,CAAA;AAEpF;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,GAAI,MAAM,MAAM,KAAG,OAAyD,CAAA;AAEvG;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,WAAW,GAAI,SAAS,aAAa,KAAG,YAAY,GAAG,SA2BnE,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,GAAI,SAAS,aAAa,KAAG,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,CAgB5F,CAAA;AAEJ;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,SAAS,GAAI,SAAS,aAAa,KAAG,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,CAmBQ,CAAA;AAuB9F;;;;;GAKG;AACH,eAAO,MAAM,eAAe;;;EAAmD,CAAA;AAE/E;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAE,aAAa,CAAC,MAAM,CAMlD,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe;;;EAAmD,CAAA;AAE/E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,cAAc,GAAI,SAAS,aAAa,KAAG,aAAa,CAAC,cA4BrE,CAAA;AA+BD;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,SAAS,GACpB,QAAQ,CAAC,OAAO,EAAE,aAAa,KAAK,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,GAAG,YAAY,CAAC,MAGtF,QAAQ,aAAa,CAAC,MAAM,EAC5B,UAAS,aAAoC,sQA0B5C,CAAA"}