@smthrs/gateway 1.0.0-rc.5 → 1.0.0-rc.7

package/dist/cjs/RuntimeBridge.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/RuntimeBridge.ts"],
-  "sourcesContent": ["/**\n * Versioned JSON boundary between the Go product backend and the canonical\n * TypeScript Flow/Control host.\n *\n * This module adapts HTTP-shaped commands to `Control`. It owns no graph,\n * scheduler, journal, or lifecycle state of its own.\n *\n * @since 1.0.0\n */\n\nimport { Control } from \"@smthrs/control/Control\"\nimport * as ControlError from \"@smthrs/control/ControlError\"\nimport { ControlExecutor, type Service as ControlExecutorService } from \"@smthrs/control/ControlExecutor\"\nimport type { Principal, WatchCursor } from \"@smthrs/control/ControlSchema\"\nimport {\n  ApprovalPayload,\n  ControlEvent,\n  MessageSteer,\n  Receipt,\n  RunSummary,\n  SignalPayload\n} from \"@smthrs/control/ControlSchema\"\nimport * as Fault from \"@smthrs/flow/Fault\"\nimport { Effect, Layer, Schema, Stream } from \"effect\"\nimport { HttpRouter, HttpServerRequest, HttpServerResponse } from \"effect/unstable/http\"\nimport { RunSummaryRow } from \"./GatewayProjection.ts\"\nimport * as Projections from \"./Projections.ts\"\nimport { monitorFromJournal } from \"./RunTrace.ts\"\n\n/**\n * The only protocol version accepted by this host.\n * @since 1.0.0\n * @category constants\n */\nexport const protocol = \"smithers.flow-runtime/v1\" as const\n\nconst Sha256 = Schema.String.check(Schema.isPattern(/^[0-9a-f]{64}$/))\nconst SourceRevision = Schema.String.check(Schema.isPattern(/^[0-9a-f]{40}$/))\nconst PositiveSafeInteger = Schema.Int.check(\n  Schema.isGreaterThan(0),\n  Schema.isLessThanOrEqualTo(Number.MAX_SAFE_INTEGER)\n)\nconst RequestId = Schema.NonEmptyString.check(Schema.isMaxLength(1024))\n// A decimal consumes a whole journal entry. v1 preserves an expansion offset;\n// the empty seed consumes nothing, including sequence zero.\nconst observationCursorPattern = /^(?:(0|[1-9][0-9]*)|v1:(0|[1-9][0-9]*):(0|[1-9][0-9]*))?(?![\\s\\S])/\n\n/**\n * Non-secret identity published by readiness for startup compatibility.\n * @since 1.0.0\n * @category models\n */\nexport const Identity = Schema.Struct({\n  protocol: Schema.Literal(protocol),\n  runtimeArtifactDigest: Sha256,\n  sourceRevision: SourceRevision,\n  ownerGeneration: PositiveSafeInteger\n})\n\n/**\n * Non-secret identity published by readiness for startup compatibility.\n * @since 1.0.0\n * @category models\n */\nexport type Identity = typeof Identity.Type\nconst common = {\n  protocol: Schema.Literal(protocol),\n  applicationRequestId: RequestId,\n  ownerGeneration: PositiveSafeInteger\n}\n\n// The version a launch must run: a flow, the source commit it was chosen\n// from and that flow's execution digest. A pinned launch runs only a plan\n// with that exact identity.\nconst LaunchPin = Schema.Struct({\n  flow: Schema.NonEmptyString,\n  sourceCommit: SourceRevision,\n  executionDigest: Sha256\n})\n\n/**\n * Launches one immutable named flow. Planning and running stay in Control.\n * @since 1.0.0\n * @category models\n */\nexport const LaunchCommand = Schema.Struct({\n  ...common,\n  operation: Schema.Literal(\"launch\"),\n  attempt: PositiveSafeInteger,\n  runId: Schema.optional(Schema.NonEmptyString),\n  runtimeArtifactDigest: Sha256,\n  sourceRevision: SourceRevision,\n  flowId: Schema.NonEmptyString,\n  payload: Schema.Json,\n  pin: Schema.optional(LaunchPin)\n})\n\n/**\n * Submits an approval or denial payload produced by the same Control host.\n * @since 1.0.0\n * @category models\n */\nexport const DecisionCommand = Schema.Struct({\n  ...common,\n  operation: Schema.Literals([\"approve\", \"deny\"]),\n  approval: ApprovalPayload\n})\n\n/**\n * Delivers one durable named signal.\n * @since 1.0.0\n * @category models\n */\nexport const SignalCommand = Schema.Struct({\n  ...common,\n  operation: Schema.Literal(\"signal\"),\n  runId: Schema.NonEmptyString,\n  signal: SignalPayload\n})\n\nconst Steer = Schema.Union([\n  Schema.Struct({ kind: Schema.Literal(\"Message\"), body: Schema.String }),\n  Schema.Struct({ kind: Schema.Literal(\"Seat\"), seat: Schema.NonEmptyString }),\n  Schema.Struct({\n    kind: Schema.Literal(\"Thinking\"),\n    thinking: Schema.Literals([\"none\", \"minimal\", \"low\", \"medium\", \"high\", \"xhigh\"])\n  }),\n  Schema.Struct({ kind: Schema.Literal(\"Tools\"), toolNames: Schema.NonEmptyArray(Schema.NonEmptyString) })\n])\n\n/**\n * Enqueues one steer for the runtime's next turn boundary.\n * @since 1.0.0\n * @category models\n */\nexport const SteerCommand = Schema.Struct({\n  version: Schema.optional(Schema.Number),\n  ...common,\n  operation: Schema.Literal(\"steer\"),\n  runId: Schema.NonEmptyString,\n  messageId: Schema.NonEmptyString,\n  createdAt: Schema.Number,\n  attribution: MessageSteer.fields.attribution,\n  steer: Steer\n})\n\n/**\n * Requests cancellation, explicit resume, or completion of a retained run.\n * @since 1.0.0\n * @category models\n */\nexport const LifecycleCommand = Schema.Struct({\n  ...common,\n  /** Completion is a host-only lifecycle operation. @since 1.0.0 */\n  operation: Schema.Literals([\"cancel\", \"resume\", \"complete\"]),\n  runId: Schema.NonEmptyString,\n  reason: Schema.optional(Schema.String)\n})\n\n/**\n * Every mutating operation accepted by the bridge.\n * @since 1.0.0\n * @category models\n */\nexport const Command = Schema.Union([\n  LaunchCommand,\n  DecisionCommand,\n  SignalCommand,\n  SteerCommand,\n  LifecycleCommand\n])\n\n/**\n * Every mutating operation accepted by the bridge.\n * @since 1.0.0\n * @category models\n */\nexport type Command = typeof Command.Type\n\n/**\n * A bounded, reconnectable read of one canonical runtime execution.\n * @since 1.0.0\n * @category models\n */\nexport const ObserveRequest = Schema.Struct({\n  protocol: Schema.Literal(protocol),\n  runId: Schema.NonEmptyString,\n  afterCursor: Schema.optional(Schema.String.check(Schema.isPattern(observationCursorPattern))),\n  limit: Schema.optional(PositiveSafeInteger)\n})\n\n/**\n * A bounded, reconnectable read of one canonical runtime execution.\n * @since 1.0.0\n * @category models\n */\nexport type ObserveRequest = typeof ObserveRequest.Type\n\n/**\n * A process result recorded by installed host equipment, never by a flow result.\n * @since 1.0.0\n * @category models\n */\nexport const CommandReceipt = Schema.Struct({\n  runId: Schema.NonEmptyString,\n  operationId: Schema.NonEmptyString,\n  status: Schema.Literals([\"running\", \"completed\"]),\n  argv: Schema.NonEmptyArray(Schema.String),\n  exitCode: Schema.optionalKey(Schema.Int),\n  stderr: Schema.optionalKey(Schema.String),\n  fault: Schema.optionalKey(Schema.Literals([\"factory\", \"infra\"]))\n})\n/**\n * A process result recorded by installed host equipment.\n * @since 1.0.0\n * @category models\n */\nexport type CommandReceipt = typeof CommandReceipt.Type\n\n/**\n * Host identity fixed for the lifetime of one owning process.\n * @since 1.0.0\n * @category models\n */\nexport interface Config {\n  readonly runtimeArtifactDigest: string\n  readonly sourceRevision: string\n  /** Captured and verified by native catalog registration, never decoded from a request or environment. */\n  readonly verifiedCatalogSourceRevision?: string | undefined\n  readonly ownerGeneration: number\n  /**\n   * Private installed-host receipt reader; never accepted on the command wire.\n   * @since 1.0.0\n   */\n  readonly commandReceipt?: ((runId: string) => Effect.Effect<CommandReceipt | undefined, unknown>) | undefined\n  /**\n   * Native host completion port, captured from the executor rather than from a request.\n   * @since 1.0.0\n   */\n  readonly requestComplete?: ControlExecutorService[\"requestComplete\"]\n  readonly authenticate: (\n    headers: Readonly<Record<string, string>>\n  ) => Effect.Effect<Principal, ControlError.Unauthorized>\n}\n\n/**\n * Stable bridge-only failures. Control failures retain their own code.\n * @since 1.0.0\n * @category errors\n */\nexport class BridgeError extends Schema.TaggedError<BridgeError>()(\"@smthrs/gateway/RuntimeBridgeError\", {\n  code: Schema.Literals([\n    \"invalid_request\",\n    \"artifact_mismatch\",\n    \"source_mismatch\",\n    \"stale_owner\",\n    \"run_not_found\",\n    \"resource_limit\",\n    \"unavailable\",\n    \"internal\"\n  ]),\n  message: Schema.String,\n  retryable: Schema.Boolean\n}) {}\n\nconst decodeCommand = Schema.decodeUnknownEffect(Command)\nconst decodeObserve = Schema.decodeUnknownEffect(ObserveRequest)\nconst terminal = new Set([\"completed\", \"failed\", \"cancelled\"])\nconst retryableCodes = new Set([\"transport_error\", \"unavailable\", \"persistence_failed\", \"launch_failed\"])\nconst notFoundCodes = new Set([\"run_not_found\", \"flow_not_found\", \"plan_not_found\"])\nconst conflictCodes = new Set([\"stale_owner\", \"artifact_mismatch\", \"source_mismatch\", \"conflict\"])\nconst defaultEventLimit = 250\nconst maximumEventLimit = 1_000\n\n// Host generation fences who may execute a delivery, but it is not part of\n// the durable product request identity. A replacement owner must reconcile a\n// lost acknowledgement against the same Control command keys.\nconst idempotencyKey = (input: Pick<Command, \"applicationRequestId\">, suffix: string) =>\n  `bridge:v1:${input.applicationRequestId}:${suffix}`\n\nconst validateOwner = (config: Config, input: Pick<Command, \"ownerGeneration\">) =>\n  input.ownerGeneration === config.ownerGeneration\n    ? Effect.void\n    : Effect.fail(\n      new BridgeError({ code: \"stale_owner\", message: \"Runtime owner generation is stale\", retryable: true })\n    )\n\n/**\n * Executes one decoded command exclusively through the canonical Control API.\n * @since 1.0.0\n * @category constructors\n */\nexport const execute = (\n  config: Config,\n  control: Control[\"Service\"],\n  principal: Principal,\n  input: Command\n) =>\n  Effect.gen(function*() {\n    yield* validateOwner(config, input)\n    switch (input.operation) {\n      case \"launch\": {\n        if (input.runtimeArtifactDigest !== config.runtimeArtifactDigest) {\n          return yield* Effect.fail(\n            new BridgeError({\n              code: \"artifact_mismatch\",\n              message: \"Runtime artifact digest does not match the owning host\",\n              retryable: false\n            })\n          )\n        }\n        if (input.sourceRevision !== config.sourceRevision) {\n          return yield* Effect.fail(\n            new BridgeError({\n              code: \"source_mismatch\",\n              message: \"Flow source revision does not match the owning host\",\n              retryable: false\n            })\n          )\n        }\n        // Every launch of a pinned attempt (its composition and the engine's\n        // launches) runs from the pinned source commit: a host serving any\n        // other source refuses before planning imports anything.\n        if (input.pin !== undefined && input.pin.sourceCommit !== config.sourceRevision) {\n          return yield* Effect.fail(\n            new BridgeError({\n              code: \"source_mismatch\",\n              message: \"Flow source revision does not match the pinned launch\",\n              retryable: false\n            })\n          )\n        }\n        const plan = yield* control.plan({\n          flowId: input.flowId,\n          input: input.payload,\n          idempotencyKey: idempotencyKey(input, \"plan\")\n        })\n        // Graphs are optional for valid Flow declarations. Only a verified\n        // native catalog snapshot can supply the missing provenance; the\n        // configured/wire identity by itself cannot stand in for that proof.\n        const plannedSource = plan.graph?.sourceRevision ?? config.verifiedCatalogSourceRevision\n        if (plannedSource !== input.sourceRevision) {\n          return yield* Effect.fail(\n            new BridgeError({\n              code: \"source_mismatch\",\n              message: \"Flow source revision does not match the immutable request\",\n              retryable: false\n            })\n          )\n        }\n        // A pinned launch runs nothing but its pin: a plan with no execution\n        // identity, or the pinned flow planned as other code, never starts.\n        if (\n          input.pin !== undefined &&\n          (plan.executionDigest === undefined ||\n            (input.pin.flow === input.flowId && plan.executionDigest !== input.pin.executionDigest))\n        ) {\n          return yield* Effect.fail(\n            new BridgeError({\n              code: \"source_mismatch\",\n              message: \"Flow execution digest does not match the pinned launch\",\n              retryable: false\n            })\n          )\n        }\n        const receipt = yield* control.run({\n          _tag: \"Plan\",\n          planId: plan.planId,\n          digest: plan.digest,\n          envelope: plan.envelope,\n          idempotencyKey: idempotencyKey(input, `run:${input.runId ?? input.attempt}`),\n          principal,\n          ...(input.runId === undefined ? {} : { reservedRunId: input.runId })\n        })\n        return {\n          operation: input.operation,\n          applicationRequestId: input.applicationRequestId,\n          ownerGeneration: input.ownerGeneration,\n          runtimeArtifactDigest: config.runtimeArtifactDigest,\n          sourceRevision: input.sourceRevision,\n          planId: plan.planId,\n          planDigest: plan.digest,\n          ...(plan.executionDigest === undefined ? {} : { executionDigest: plan.executionDigest }),\n          envelope: plan.envelope,\n          approval: plan.approval,\n          receipt\n        } as const\n      }\n      case \"approve\":\n      case \"deny\": {\n        const request = {\n          ...input.approval,\n          idempotencyKey: idempotencyKey(input, input.operation),\n          principal\n        }\n        const receipt = yield* input.operation === \"approve\" ? control.approve(request) : control.deny(request)\n        return { operation: input.operation, applicationRequestId: input.applicationRequestId, receipt } as const\n      }\n      case \"signal\": {\n        const receipt = yield* control.signal({\n          runId: input.runId,\n          signal: input.signal,\n          idempotencyKey: idempotencyKey(input, \"signal\"),\n          principal\n        })\n        return { operation: input.operation, applicationRequestId: input.applicationRequestId, receipt } as const\n      }\n      case \"steer\": {\n        const receipt = yield* control.steer({\n          runId: input.runId,\n          idempotencyKey: idempotencyKey(input, \"steer\"),\n          ...(input.version === undefined ? {} : { version: input.version }),\n          message: {\n            ...input.steer,\n            runId: input.runId,\n            messageId: input.messageId,\n            createdAt: input.createdAt,\n            ...(input.attribution === undefined ? {} : { attribution: input.attribution }),\n            principal\n          }\n        })\n        return { operation: input.operation, applicationRequestId: input.applicationRequestId, receipt } as const\n      }\n      // This authenticated host bridge is not a catalog or public Control\n      // verb. The executor validates the completed native child and resumes\n      // its retained parent to settle from that child's committed result.\n      case \"complete\": {\n        const executor = yield* Effect.serviceOption(ControlExecutor)\n        const complete = config.requestComplete ??\n          (executor._tag === \"Some\" ? executor.value.requestComplete : undefined)\n        if (complete === undefined) {\n          return yield* Effect.fail(\n            new BridgeError({\n              code: \"unavailable\",\n              message: \"Completed-module settlement is unavailable\",\n              retryable: true\n            })\n          )\n        }\n        const receipt = yield* complete({ runId: input.runId, receiptId: idempotencyKey(input, \"complete\") })\n        return { operation: input.operation, applicationRequestId: input.applicationRequestId, receipt } as const\n      }\n      case \"cancel\":\n      case \"resume\": {\n        const request = {\n          runId: input.runId,\n          idempotencyKey: idempotencyKey(input, input.operation),\n          ...(input.reason === undefined ? {} : { reason: input.reason }),\n          principal\n        }\n        const receipt = yield* input.operation === \"cancel\" ? control.cancel(request) : control.resume(request)\n        return { operation: input.operation, applicationRequestId: input.applicationRequestId, receipt } as const\n      }\n    }\n  })\n\nconst cursorPosition = (cursor: string | undefined): Effect.Effect<WatchCursor | undefined, BridgeError> => {\n  if (cursor === undefined || cursor === \"\") return Effect.succeed(undefined)\n  const match = observationCursorPattern.exec(cursor)\n  const sequence = Number(match?.[1] ?? match?.[2])\n  const offset = match?.[3] === undefined ? undefined : Number(match[3])\n  const valid = (value: number) => Number.isSafeInteger(value) && value >= 0 && value < Number.MAX_SAFE_INTEGER\n  return match !== null && valid(sequence) && (offset === undefined || valid(offset))\n    ? Effect.succeed({ sequence, ...(offset === undefined ? {} : { offset }) })\n    : Effect.fail(\n      new BridgeError({\n        code: \"invalid_request\",\n        message: \"Observation cursor is invalid or out of range\",\n        retryable: false\n      })\n    )\n}\n\nconst encodedCursor = (cursor: WatchCursor): string =>\n  cursor.offset === undefined ? String(cursor.sequence) : `v1:${cursor.sequence}:${cursor.offset}`\n\n/**\n * Reads a bounded event replay and current canonical run projection.\n * @since 1.0.0\n * @category constructors\n */\nexport const observe = (control: Control[\"Service\"], input: ObserveRequest, receipts?: Config[\"commandReceipt\"]) =>\n  Effect.gen(function*() {\n    const after = yield* cursorPosition(input.afterCursor)\n    const limit = Math.min(input.limit ?? defaultEventLimit, maximumEventLimit)\n    const listed = yield* control.list({ _tag: \"runs\", filters: { runId: input.runId }, limit: 1 })\n    const summary = listed._tag === \"runs\" ? listed.items[0] : undefined\n    if (summary === undefined) {\n      return yield* Effect.fail(\n        new BridgeError({ code: \"run_not_found\", message: \"Runtime execution was not found\", retryable: true })\n      )\n    }\n    const events = Array.from(\n      yield* Stream.runCollect(Stream.take(\n        control.watch({\n          runId: input.runId,\n          ...(after === undefined\n            ? {}\n            : after.offset === undefined\n            ? { afterSequence: after.sequence }\n            : { afterCursor: after }),\n          follow: false\n        }),\n        limit + 1\n      ))\n    )\n    const page = events.slice(0, limit)\n    const last = page.at(-1)\n    // Typed Flow results use the same committed root projection as the app.\n    // A terminal status alone never supplies a result, and a bounded event\n    // page cannot reconstruct a root result that precedes its cursor.\n    let finalOutput: string | undefined\n    let failure: {\n      readonly failureFault?: Fault.Class\n      readonly failureTag?: string\n      readonly failureMessage?: string\n    } = {}\n    if (terminal.has(summary.status)) {\n      const projections = yield* Projections.make(control)\n      const snapshot = yield* projections.snapshot({ _tag: \"run-summary\", runId: input.runId })\n      const row = snapshot.rows.find(Schema.is(RunSummaryRow))\n      if (\n        row === undefined || row.runId !== summary.runId || row.flowId !== summary.flowId ||\n        row.status !== summary.status || row.planId !== summary.planId || row.planDigest !== summary.planDigest\n      ) {\n        return yield* Effect.fail(\n          new BridgeError({ code: \"internal\", message: \"Terminal result observation changed\", retryable: true })\n        )\n      }\n      finalOutput = row.finalOutput\n      failure = {\n        ...(row.failureFault === undefined ? {} : { failureFault: row.failureFault }),\n        ...(row.failureTag === undefined ? {} : { failureTag: row.failureTag }),\n        ...(row.failureMessage === undefined ? {} : { failureMessage: row.failureMessage })\n      }\n    }\n    // Keep the private receipt out of every repository-controlled projection.\n    const hostSummary = yield* Schema.decodeUnknownEffect(RunSummary)(summary)\n    const commandReceipt = receipts === undefined ? undefined : yield* receipts(input.runId)\n    if (commandReceipt !== undefined && commandReceipt.runId !== input.runId) {\n      return yield* Effect.fail(\n        new BridgeError({ code: \"internal\", message: \"Host command receipt names another run\", retryable: false })\n      )\n    }\n    return {\n      run: {\n        ...hostSummary,\n        ...(commandReceipt === undefined ? {} : { commandReceipt }),\n        ...(finalOutput === undefined ? {} : { finalOutput }),\n        ...failure\n      },\n      events: page,\n      nextCursor: last === undefined\n        ? input.afterCursor ?? \"\"\n        : encodedCursor(last.cursor ?? { sequence: last.sequence }),\n      hasMore: events.length > limit,\n      terminal: terminal.has(summary.status)\n    }\n  })\n\n// Disposable raw journal prefixes for Inspect. This stores no run state: the\n// existing monitor fold still derives every answer from journal records. Bound\n// retention across all runs of one control service, and rebuild after eviction.\nconst monitorJournals = new WeakMap<\n  Control[\"Service\"],\n  Map<string, {\n    readonly records: ReadonlyArray<ControlEvent>\n    readonly bytes: number\n  }>\n>()\nconst monitorJournalBytes = 64 * 1024 * 1024\n\n/** Read an existing run and its committed journal without invoking any execution door.\n * @since 1.0.0\n * @category constructors\n */\nexport const monitor = (control: Control[\"Service\"], runId: string, at?: number) =>\n  Effect.gen(function*() {\n    const listed = yield* control.list({ _tag: \"runs\", filters: { runId }, limit: 1 })\n    const run = listed._tag === \"runs\" ? listed.items[0] : undefined\n    if (run === undefined || run.runId !== runId) {\n      return yield* new BridgeError({\n        code: \"run_not_found\",\n        message: \"Runtime execution was not found\",\n        retryable: false\n      })\n    }\n    const cache = monitorJournals.get(control) ??\n      new Map<string, { readonly records: ReadonlyArray<ControlEvent>; readonly bytes: number }>()\n    monitorJournals.set(control, cache)\n    const cached = cache.get(runId)\n    const last = cached?.records.at(-1)?.sequence\n    // Replay the final entry because one entry may expand into several events.\n    const consumed = last === undefined ? 0 : cached!.records.filter((row) => row.sequence === last).length\n    let skipped = 0\n    const suffix = Array.from(\n      yield* Stream.runCollect(\n        control.watch({\n          runId,\n          follow: false,\n          ...(last === undefined || last === 0 ? {} : { afterSequence: last - 1 })\n        }).pipe(\n          Stream.filter((row) =>\n            last === undefined || row.sequence > last || row.sequence === last && skipped++ >= consumed\n          ),\n          Stream.take(Projections.maxEventsScanned + 1)\n        )\n      )\n    )\n    const records = [...(cached?.records ?? []), ...suffix]\n    if (records.length > Projections.maxEventsScanned) {\n      return yield* new BridgeError({\n        code: \"resource_limit\",\n        message: \"Run journal exceeds the inspection limit\",\n        retryable: false\n      })\n    }\n    const bytes = (cached?.bytes ?? 0) +\n      suffix.reduce((sum, row) => sum + new TextEncoder().encode(JSON.stringify(row)).byteLength, 0)\n    const current = cache.get(runId)\n    // A slower reader cannot overwrite a longer committed prefix.\n    if (bytes <= monitorJournalBytes && (current === undefined || current.records.length <= records.length)) {\n      cache.delete(runId)\n      cache.set(runId, { records, bytes })\n      let total = [...cache.values()].reduce((sum, entry) => sum + entry.bytes, 0)\n      while (cache.size > 32 || total > monitorJournalBytes) {\n        const oldest = cache.keys().next().value!\n        total -= cache.get(oldest)!.bytes\n        cache.delete(oldest)\n      }\n    }\n    const folded = monitorFromJournal({ runId, flowId: run.flowId, status: run.status }, records, at)\n    // The journal is read page by page when its tab opens (run-events). Only a\n    // replay frame carries its own journal prefix. The extent bounds the run.\n    let start = Infinity\n    let end = 0\n    for (const row of records) {\n      if (row.occurredAt > 0) {\n        start = Math.min(start, row.occurredAt)\n        end = Math.max(end, row.occurredAt)\n      }\n    }\n    const value: Partial<typeof folded> & Omit<typeof folded, \"journal\"> & { extent?: { start: string; end: string } } =\n      {\n        ...folded,\n        ...(end === 0 ? {} : { extent: { start: new Date(start).toISOString(), end: new Date(end).toISOString() } })\n      }\n    if (at === undefined) delete value.journal\n    if (new TextEncoder().encode(JSON.stringify(value)).byteLength > Projections.maxProjectionBytes) {\n      return yield* new BridgeError({\n        code: \"resource_limit\",\n        message: \"Run monitor exceeds the inspection limit\",\n        retryable: false\n      })\n    }\n    return value\n  })\n\n/**\n * Successful command response on the JSON wire.\n * @since 1.0.0\n * @category models\n */\nexport const CommandResponse = Schema.Struct({\n  protocol: Schema.Literal(protocol),\n  ok: Schema.Literal(true),\n  value: Schema.Struct({\n    operation: Schema.String,\n    applicationRequestId: Schema.String,\n    ownerGeneration: Schema.optional(PositiveSafeInteger),\n    runtimeArtifactDigest: Schema.optional(Sha256),\n    sourceRevision: Schema.optional(SourceRevision),\n    planId: Schema.optional(Schema.String),\n    planDigest: Schema.optional(Sha256),\n    executionDigest: Schema.optional(Sha256),\n    envelope: Schema.optional(Schema.Json),\n    approval: Schema.optional(ApprovalPayload),\n    receipt: Receipt\n  })\n})\n\n/**\n * Successful observation response on the JSON wire.\n * @since 1.0.0\n * @category models\n */\nexport const ObserveResponse = Schema.Struct({\n  protocol: Schema.Literal(protocol),\n  ok: Schema.Literal(true),\n  value: Schema.Struct({\n    run: Schema.Struct({\n      ...RunSummary.fields,\n      finalOutput: Schema.optional(Schema.String),\n      failureFault: Schema.optional(Fault.Class),\n      failureTag: Schema.optional(Schema.String),\n      failureMessage: Schema.optional(Schema.String),\n      commandReceipt: Schema.optionalKey(CommandReceipt)\n    }),\n    events: Schema.Array(ControlEvent),\n    nextCursor: Schema.String,\n    hasMore: Schema.Boolean,\n    terminal: Schema.Boolean\n  })\n})\n\n/**\n * Stable sanitized failure response on the JSON wire.\n * @since 1.0.0\n * @category models\n */\nexport const ErrorResponse = Schema.Struct({\n  protocol: Schema.Literal(protocol),\n  ok: Schema.Literal(false),\n  error: Schema.Struct({ code: Schema.String, message: Schema.String, retryable: Schema.Boolean })\n})\n\nconst errorResponse = (cause: unknown) => {\n  const known = Schema.is(ControlError.ControlErrorSchema)(cause)\n  const code = cause instanceof BridgeError || known ? cause.code : \"internal\"\n  const retryable = cause instanceof BridgeError\n    ? cause.retryable\n    : cause instanceof ControlError.TransportError\n    ? cause.retryable\n    : retryableCodes.has(code)\n  // Control errors can contain storage paths, SQL diagnostics, or executor\n  // output. The bridge publishes their stable code, never that backend text.\n  const message = cause instanceof BridgeError ? cause.message : \"Runtime bridge failed\"\n  const status = code === \"unauthorized\" ?\n    401\n    : notFoundCodes.has(code) ?\n    404\n    : conflictCodes.has(code) ?\n    409\n    : retryable ?\n    503\n    : code === \"internal\" ?\n    500\n    : 400\n  return HttpServerResponse.jsonUnsafe({ protocol, ok: false, error: { code, message, retryable } }, { status })\n}\n\n/**\n * Answers a failed bridge request with its sanitized response, logging it first.\n *\n * The wire carries only the stable code. The operator log carries the full\n * cause of every failure the caller did not cause, so a launch that failed in\n * storage or in the executor can be diagnosed from the host.\n */\nconst respondToFailure = (operation: \"runtime-bridge.command\" | \"runtime-bridge.observe\") => (cause: unknown) => {\n  const response = errorResponse(cause)\n  if (cause instanceof BridgeError) return Effect.succeed(response)\n  const code = Schema.is(ControlError.ControlErrorSchema)(cause) ? cause.code : \"internal\"\n  return Effect.logError({ message: \"Runtime bridge request failed\", operation, code, cause }).pipe(\n    Effect.as(response)\n  )\n}\n\nconst readJson = Effect.gen(function*() {\n  const request = yield* HttpServerRequest.HttpServerRequest\n  const text = yield* request.text\n  return yield* Effect.try({\n    try: () => JSON.parse(text) as unknown,\n    catch: () => new BridgeError({ code: \"invalid_request\", message: \"Request body must be JSON\", retryable: false })\n  })\n})\n\nconst authenticated = <A, E, R>(\n  config: Config,\n  effect: (principal: Principal) => Effect.Effect<A, E, R>\n) =>\n  Effect.gen(function*() {\n    const request = yield* HttpServerRequest.HttpServerRequest\n    const principal = yield* config.authenticate(request.headers)\n    return yield* effect(principal)\n  })\n\n/**\n * Mounts the authenticated JSON bridge beside the existing gateway RPCs.\n * @since 1.0.0\n * @category layers\n */\nexport const layer = (config: Config) => {\n  const command = authenticated(config, (principal) =>\n    Effect.gen(function*() {\n      const body = yield* readJson\n      const input = yield* decodeCommand(body).pipe(Effect.mapError(() =>\n        new BridgeError({\n          code: \"invalid_request\",\n          message: \"Request does not match the runtime bridge contract\",\n          retryable: false\n        })\n      ))\n      const control = yield* Control\n      const value = yield* execute(config, control, principal, input)\n      return HttpServerResponse.jsonUnsafe({ protocol, ok: true, value })\n    })).pipe(\n      Effect.catch(respondToFailure(\"runtime-bridge.command\")),\n      Effect.withSpan(\"runtime-bridge.command\")\n    )\n\n  const observation = authenticated(config, () =>\n    Effect.gen(function*() {\n      const body = yield* readJson\n      const input = yield* decodeObserve(body).pipe(Effect.mapError(() =>\n        new BridgeError({\n          code: \"invalid_request\",\n          message: \"Request does not match the observation contract\",\n          retryable: false\n        })\n      ))\n      const control = yield* Control\n      const value = yield* observe(control, input, config.commandReceipt)\n      return HttpServerResponse.jsonUnsafe({ protocol, ok: true, value })\n    })).pipe(\n      Effect.catch(respondToFailure(\"runtime-bridge.observe\")),\n      Effect.withSpan(\"runtime-bridge.observe\")\n    )\n\n  const inspection = authenticated(config, () =>\n    Effect.gen(function*() {\n      const body = yield* readJson\n      const input = yield* Schema.decodeUnknownEffect(Schema.Struct({\n        protocol: Schema.Literal(protocol),\n        runId: Schema.NonEmptyString,\n        at: Schema.optional(Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)))\n      }))(body).pipe(Effect.mapError(() =>\n        new BridgeError({ code: \"invalid_request\", message: \"Invalid monitor request\", retryable: false })\n      ))\n      const control = yield* Control\n      return HttpServerResponse.jsonUnsafe({\n        protocol,\n        ok: true,\n        value: yield* monitor(control, input.runId, input.at)\n      })\n    })).pipe(Effect.catch(respondToFailure(\"runtime-bridge.observe\")))\n\n  return HttpRouter.add(\"POST\", \"/runtime/v1/command\", command).pipe(\n    Layer.merge(HttpRouter.add(\"POST\", \"/runtime/v1/monitor\", inspection)),\n    Layer.merge(HttpRouter.add(\"POST\", \"/runtime/v1/observe\", observation))\n  )\n}\n"],
+  "sourcesContent": ["/**\n * Versioned JSON boundary between the Go product backend and the canonical\n * TypeScript Flow/Control host.\n *\n * This module adapts HTTP-shaped commands to `Control`. It owns no graph,\n * scheduler, journal, or lifecycle state of its own.\n *\n * @since 1.0.0\n */\n\nimport { Control } from \"@smthrs/control/Control\"\nimport * as ControlError from \"@smthrs/control/ControlError\"\nimport { ControlExecutor, type Service as ControlExecutorService } from \"@smthrs/control/ControlExecutor\"\nimport type { Principal, WatchCursor } from \"@smthrs/control/ControlSchema\"\nimport {\n  ApprovalPayload,\n  ControlEvent,\n  MessageSteer,\n  Receipt,\n  RunSummary,\n  SignalPayload\n} from \"@smthrs/control/ControlSchema\"\nimport * as Fault from \"@smthrs/flow/Fault\"\nimport { Effect, Layer, Schema, Stream } from \"effect\"\nimport { HttpRouter, HttpServerRequest, HttpServerResponse } from \"effect/http\"\nimport { RunSummaryRow } from \"./GatewayProjection.ts\"\nimport * as Projections from \"./Projections.ts\"\nimport { monitorFromJournal } from \"./RunTrace.ts\"\n\n/**\n * The only protocol version accepted by this host.\n * @since 1.0.0\n * @category constants\n */\nexport const protocol = \"smithers.flow-runtime/v1\" as const\n\nconst Sha256 = Schema.String.check(Schema.isPattern(/^[0-9a-f]{64}$/))\nconst SourceRevision = Schema.String.check(Schema.isPattern(/^[0-9a-f]{40}$/))\nconst PositiveSafeInteger = Schema.Int.check(\n  Schema.isGreaterThan(0),\n  Schema.isLessThanOrEqualTo(Number.MAX_SAFE_INTEGER)\n)\nconst RequestId = Schema.NonEmptyString.check(Schema.isMaxLength(1024))\n// A decimal consumes a whole journal entry. v1 preserves an expansion offset;\n// the empty seed consumes nothing, including sequence zero.\nconst observationCursorPattern = /^(?:(0|[1-9][0-9]*)|v1:(0|[1-9][0-9]*):(0|[1-9][0-9]*))?(?![\\s\\S])/\n\n/**\n * Non-secret identity published by readiness for startup compatibility.\n * @since 1.0.0\n * @category models\n */\nexport const Identity = Schema.Struct({\n  protocol: Schema.Literal(protocol),\n  runtimeArtifactDigest: Sha256,\n  sourceRevision: SourceRevision,\n  ownerGeneration: PositiveSafeInteger\n})\n\n/**\n * Non-secret identity published by readiness for startup compatibility.\n * @since 1.0.0\n * @category models\n */\nexport type Identity = typeof Identity.Type\nconst common = {\n  protocol: Schema.Literal(protocol),\n  applicationRequestId: RequestId,\n  ownerGeneration: PositiveSafeInteger\n}\n\n// The version a launch must run: a flow, the source commit it was chosen\n// from and that flow's execution digest. A pinned launch runs only a plan\n// with that exact identity.\nconst LaunchPin = Schema.Struct({\n  flow: Schema.NonEmptyString,\n  sourceCommit: SourceRevision,\n  executionDigest: Sha256\n})\n\n/**\n * Launches one immutable named flow. Planning and running stay in Control.\n * @since 1.0.0\n * @category models\n */\nexport const LaunchCommand = Schema.Struct({\n  ...common,\n  operation: Schema.Literal(\"launch\"),\n  attempt: PositiveSafeInteger,\n  runId: Schema.optional(Schema.NonEmptyString),\n  runtimeArtifactDigest: Sha256,\n  sourceRevision: SourceRevision,\n  flowId: Schema.NonEmptyString,\n  payload: Schema.Json,\n  pin: Schema.optional(LaunchPin)\n})\n\n/**\n * Submits an approval or denial payload produced by the same Control host.\n * @since 1.0.0\n * @category models\n */\nexport const DecisionCommand = Schema.Struct({\n  ...common,\n  operation: Schema.Literals([\"approve\", \"deny\"]),\n  approval: ApprovalPayload\n})\n\n/**\n * Delivers one durable named signal.\n * @since 1.0.0\n * @category models\n */\nexport const SignalCommand = Schema.Struct({\n  ...common,\n  operation: Schema.Literal(\"signal\"),\n  runId: Schema.NonEmptyString,\n  signal: SignalPayload\n})\n\nconst Steer = Schema.Union([\n  Schema.Struct({ kind: Schema.Literal(\"Message\"), body: Schema.String }),\n  Schema.Struct({ kind: Schema.Literal(\"Seat\"), seat: Schema.NonEmptyString }),\n  Schema.Struct({\n    kind: Schema.Literal(\"Thinking\"),\n    thinking: Schema.Literals([\"none\", \"minimal\", \"low\", \"medium\", \"high\", \"xhigh\"])\n  }),\n  Schema.Struct({ kind: Schema.Literal(\"Tools\"), toolNames: Schema.NonEmptyArray(Schema.NonEmptyString) })\n])\n\n/**\n * Enqueues one steer for the runtime's next turn boundary.\n * @since 1.0.0\n * @category models\n */\nexport const SteerCommand = Schema.Struct({\n  version: Schema.optional(Schema.Number),\n  ...common,\n  operation: Schema.Literal(\"steer\"),\n  runId: Schema.NonEmptyString,\n  messageId: Schema.NonEmptyString,\n  createdAt: Schema.Number,\n  attribution: MessageSteer.fields.attribution,\n  steer: Steer\n})\n\n/**\n * Requests cancellation, explicit resume, or completion of a retained run.\n * @since 1.0.0\n * @category models\n */\nexport const LifecycleCommand = Schema.Struct({\n  ...common,\n  /** Completion is a host-only lifecycle operation. @since 1.0.0 */\n  operation: Schema.Literals([\"cancel\", \"resume\", \"complete\"]),\n  runId: Schema.NonEmptyString,\n  reason: Schema.optional(Schema.String)\n})\n\n/**\n * Every mutating operation accepted by the bridge.\n * @since 1.0.0\n * @category models\n */\nexport const Command = Schema.Union([\n  LaunchCommand,\n  DecisionCommand,\n  SignalCommand,\n  SteerCommand,\n  LifecycleCommand\n])\n\n/**\n * Every mutating operation accepted by the bridge.\n * @since 1.0.0\n * @category models\n */\nexport type Command = typeof Command.Type\n\n/**\n * A bounded, reconnectable read of one canonical runtime execution.\n * @since 1.0.0\n * @category models\n */\nexport const ObserveRequest = Schema.Struct({\n  protocol: Schema.Literal(protocol),\n  runId: Schema.NonEmptyString,\n  afterCursor: Schema.optional(Schema.String.check(Schema.isPattern(observationCursorPattern))),\n  limit: Schema.optional(PositiveSafeInteger)\n})\n\n/**\n * A bounded, reconnectable read of one canonical runtime execution.\n * @since 1.0.0\n * @category models\n */\nexport type ObserveRequest = typeof ObserveRequest.Type\n\n/**\n * A process result recorded by installed host equipment, never by a flow result.\n * @since 1.0.0\n * @category models\n */\nexport const CommandReceipt = Schema.Struct({\n  runId: Schema.NonEmptyString,\n  operationId: Schema.NonEmptyString,\n  status: Schema.Literals([\"running\", \"completed\"]),\n  argv: Schema.NonEmptyArray(Schema.String),\n  exitCode: Schema.optionalKey(Schema.Int),\n  stderr: Schema.optionalKey(Schema.String),\n  fault: Schema.optionalKey(Schema.Literals([\"factory\", \"infra\"]))\n})\n/**\n * A process result recorded by installed host equipment.\n * @since 1.0.0\n * @category models\n */\nexport type CommandReceipt = typeof CommandReceipt.Type\n\n/**\n * Host identity fixed for the lifetime of one owning process.\n * @since 1.0.0\n * @category models\n */\nexport interface Config {\n  readonly runtimeArtifactDigest: string\n  readonly sourceRevision: string\n  /** Captured and verified by native catalog registration, never decoded from a request or environment. */\n  readonly verifiedCatalogSourceRevision?: string | undefined\n  readonly ownerGeneration: number\n  /**\n   * Private installed-host receipt reader; never accepted on the command wire.\n   * @since 1.0.0\n   */\n  readonly commandReceipt?: ((runId: string) => Effect.Effect<CommandReceipt | undefined, unknown>) | undefined\n  /**\n   * Native host completion port, captured from the executor rather than from a request.\n   * @since 1.0.0\n   */\n  readonly requestComplete?: ControlExecutorService[\"requestComplete\"]\n  readonly authenticate: (\n    headers: Readonly<Record<string, string>>\n  ) => Effect.Effect<Principal, ControlError.Unauthorized>\n}\n\n/**\n * Stable bridge-only failures. Control failures retain their own code.\n * @since 1.0.0\n * @category errors\n */\nexport class BridgeError extends Schema.TaggedError<BridgeError>()(\"@smthrs/gateway/RuntimeBridgeError\", {\n  code: Schema.Literals([\n    \"invalid_request\",\n    \"artifact_mismatch\",\n    \"source_mismatch\",\n    \"stale_owner\",\n    \"run_not_found\",\n    \"resource_limit\",\n    \"unavailable\",\n    \"internal\"\n  ]),\n  message: Schema.String,\n  retryable: Schema.Boolean\n}) {}\n\nconst decodeCommand = Schema.decodeUnknownEffect(Command)\nconst decodeObserve = Schema.decodeUnknownEffect(ObserveRequest)\nconst terminal = new Set([\"completed\", \"failed\", \"cancelled\"])\nconst retryableCodes = new Set([\"transport_error\", \"unavailable\", \"persistence_failed\", \"launch_failed\"])\nconst notFoundCodes = new Set([\"run_not_found\", \"flow_not_found\", \"plan_not_found\"])\nconst conflictCodes = new Set([\"stale_owner\", \"artifact_mismatch\", \"source_mismatch\", \"conflict\"])\nconst defaultEventLimit = 250\nconst maximumEventLimit = 1_000\n\n// Host generation fences who may execute a delivery, but it is not part of\n// the durable product request identity. A replacement owner must reconcile a\n// lost acknowledgement against the same Control command keys.\nconst idempotencyKey = (input: Pick<Command, \"applicationRequestId\">, suffix: string) =>\n  `bridge:v1:${input.applicationRequestId}:${suffix}`\n\nconst validateOwner = (config: Config, input: Pick<Command, \"ownerGeneration\">) =>\n  input.ownerGeneration === config.ownerGeneration\n    ? Effect.void\n    : Effect.fail(\n      new BridgeError({ code: \"stale_owner\", message: \"Runtime owner generation is stale\", retryable: true })\n    )\n\n/**\n * Executes one decoded command exclusively through the canonical Control API.\n * @since 1.0.0\n * @category constructors\n */\nexport const execute = (\n  config: Config,\n  control: Control[\"Service\"],\n  principal: Principal,\n  input: Command\n) =>\n  Effect.gen(function*() {\n    yield* validateOwner(config, input)\n    switch (input.operation) {\n      case \"launch\": {\n        if (input.runtimeArtifactDigest !== config.runtimeArtifactDigest) {\n          return yield* Effect.fail(\n            new BridgeError({\n              code: \"artifact_mismatch\",\n              message: \"Runtime artifact digest does not match the owning host\",\n              retryable: false\n            })\n          )\n        }\n        if (input.sourceRevision !== config.sourceRevision) {\n          return yield* Effect.fail(\n            new BridgeError({\n              code: \"source_mismatch\",\n              message: \"Flow source revision does not match the owning host\",\n              retryable: false\n            })\n          )\n        }\n        // Every launch of a pinned attempt (its composition and the engine's\n        // launches) runs from the pinned source commit: a host serving any\n        // other source refuses before planning imports anything.\n        if (input.pin !== undefined && input.pin.sourceCommit !== config.sourceRevision) {\n          return yield* Effect.fail(\n            new BridgeError({\n              code: \"source_mismatch\",\n              message: \"Flow source revision does not match the pinned launch\",\n              retryable: false\n            })\n          )\n        }\n        const plan = yield* control.plan({\n          flowId: input.flowId,\n          input: input.payload,\n          idempotencyKey: idempotencyKey(input, \"plan\")\n        })\n        // Graphs are optional for valid Flow declarations. Only a verified\n        // native catalog snapshot can supply the missing provenance; the\n        // configured/wire identity by itself cannot stand in for that proof.\n        const plannedSource = plan.graph?.sourceRevision ?? config.verifiedCatalogSourceRevision\n        if (plannedSource !== input.sourceRevision) {\n          return yield* Effect.fail(\n            new BridgeError({\n              code: \"source_mismatch\",\n              message: \"Flow source revision does not match the immutable request\",\n              retryable: false\n            })\n          )\n        }\n        // A pinned launch runs nothing but its pin: a plan with no execution\n        // identity, or the pinned flow planned as other code, never starts.\n        if (\n          input.pin !== undefined &&\n          (plan.executionDigest === undefined ||\n            (input.pin.flow === input.flowId && plan.executionDigest !== input.pin.executionDigest))\n        ) {\n          return yield* Effect.fail(\n            new BridgeError({\n              code: \"source_mismatch\",\n              message: \"Flow execution digest does not match the pinned launch\",\n              retryable: false\n            })\n          )\n        }\n        const receipt = yield* control.run({\n          _tag: \"Plan\",\n          planId: plan.planId,\n          digest: plan.digest,\n          envelope: plan.envelope,\n          idempotencyKey: idempotencyKey(input, `run:${input.runId ?? input.attempt}`),\n          principal,\n          ...(input.runId === undefined ? {} : { reservedRunId: input.runId })\n        })\n        return {\n          operation: input.operation,\n          applicationRequestId: input.applicationRequestId,\n          ownerGeneration: input.ownerGeneration,\n          runtimeArtifactDigest: config.runtimeArtifactDigest,\n          sourceRevision: input.sourceRevision,\n          planId: plan.planId,\n          planDigest: plan.digest,\n          ...(plan.executionDigest === undefined ? {} : { executionDigest: plan.executionDigest }),\n          envelope: plan.envelope,\n          approval: plan.approval,\n          receipt\n        } as const\n      }\n      case \"approve\":\n      case \"deny\": {\n        const request = {\n          ...input.approval,\n          idempotencyKey: idempotencyKey(input, input.operation),\n          principal\n        }\n        const receipt = yield* input.operation === \"approve\" ? control.approve(request) : control.deny(request)\n        return { operation: input.operation, applicationRequestId: input.applicationRequestId, receipt } as const\n      }\n      case \"signal\": {\n        const receipt = yield* control.signal({\n          runId: input.runId,\n          signal: input.signal,\n          idempotencyKey: idempotencyKey(input, \"signal\"),\n          principal\n        })\n        return { operation: input.operation, applicationRequestId: input.applicationRequestId, receipt } as const\n      }\n      case \"steer\": {\n        const receipt = yield* control.steer({\n          runId: input.runId,\n          idempotencyKey: idempotencyKey(input, \"steer\"),\n          ...(input.version === undefined ? {} : { version: input.version }),\n          message: {\n            ...input.steer,\n            runId: input.runId,\n            messageId: input.messageId,\n            createdAt: input.createdAt,\n            ...(input.attribution === undefined ? {} : { attribution: input.attribution }),\n            principal\n          }\n        })\n        return { operation: input.operation, applicationRequestId: input.applicationRequestId, receipt } as const\n      }\n      // This authenticated host bridge is not a catalog or public Control\n      // verb. The executor validates the completed native child and resumes\n      // its retained parent to settle from that child's committed result.\n      case \"complete\": {\n        const executor = yield* Effect.serviceOption(ControlExecutor)\n        const complete = config.requestComplete ??\n          (executor._tag === \"Some\" ? executor.value.requestComplete : undefined)\n        if (complete === undefined) {\n          return yield* Effect.fail(\n            new BridgeError({\n              code: \"unavailable\",\n              message: \"Completed-module settlement is unavailable\",\n              retryable: true\n            })\n          )\n        }\n        const receipt = yield* complete({ runId: input.runId, receiptId: idempotencyKey(input, \"complete\") })\n        return { operation: input.operation, applicationRequestId: input.applicationRequestId, receipt } as const\n      }\n      case \"cancel\":\n      case \"resume\": {\n        const request = {\n          runId: input.runId,\n          idempotencyKey: idempotencyKey(input, input.operation),\n          ...(input.reason === undefined ? {} : { reason: input.reason }),\n          principal\n        }\n        const receipt = yield* input.operation === \"cancel\" ? control.cancel(request) : control.resume(request)\n        return { operation: input.operation, applicationRequestId: input.applicationRequestId, receipt } as const\n      }\n    }\n  })\n\nconst cursorPosition = (cursor: string | undefined): Effect.Effect<WatchCursor | undefined, BridgeError> => {\n  if (cursor === undefined || cursor === \"\") return Effect.succeed(undefined)\n  const match = observationCursorPattern.exec(cursor)\n  const sequence = Number(match?.[1] ?? match?.[2])\n  const offset = match?.[3] === undefined ? undefined : Number(match[3])\n  const valid = (value: number) => Number.isSafeInteger(value) && value >= 0 && value < Number.MAX_SAFE_INTEGER\n  return match !== null && valid(sequence) && (offset === undefined || valid(offset))\n    ? Effect.succeed({ sequence, ...(offset === undefined ? {} : { offset }) })\n    : Effect.fail(\n      new BridgeError({\n        code: \"invalid_request\",\n        message: \"Observation cursor is invalid or out of range\",\n        retryable: false\n      })\n    )\n}\n\nconst encodedCursor = (cursor: WatchCursor): string =>\n  cursor.offset === undefined ? String(cursor.sequence) : `v1:${cursor.sequence}:${cursor.offset}`\n\n/**\n * Reads a bounded event replay and current canonical run projection.\n * @since 1.0.0\n * @category constructors\n */\nexport const observe = (control: Control[\"Service\"], input: ObserveRequest, receipts?: Config[\"commandReceipt\"]) =>\n  Effect.gen(function*() {\n    const after = yield* cursorPosition(input.afterCursor)\n    const limit = Math.min(input.limit ?? defaultEventLimit, maximumEventLimit)\n    const listed = yield* control.list({ _tag: \"runs\", filters: { runId: input.runId }, limit: 1 })\n    const summary = listed._tag === \"runs\" ? listed.items[0] : undefined\n    if (summary === undefined) {\n      return yield* Effect.fail(\n        new BridgeError({ code: \"run_not_found\", message: \"Runtime execution was not found\", retryable: true })\n      )\n    }\n    const events = Array.from(\n      yield* Stream.runCollect(Stream.take(\n        control.watch({\n          runId: input.runId,\n          ...(after === undefined\n            ? {}\n            : after.offset === undefined\n            ? { afterSequence: after.sequence }\n            : { afterCursor: after }),\n          follow: false\n        }),\n        limit + 1\n      ))\n    )\n    const page = events.slice(0, limit)\n    const last = page.at(-1)\n    // Typed Flow results use the same committed root projection as the app.\n    // A terminal status alone never supplies a result, and a bounded event\n    // page cannot reconstruct a root result that precedes its cursor.\n    let finalOutput: string | undefined\n    let failure: {\n      readonly failureFault?: Fault.Class\n      readonly failureTag?: string\n      readonly failureMessage?: string\n    } = {}\n    if (terminal.has(summary.status)) {\n      const projections = yield* Projections.make(control)\n      const snapshot = yield* projections.snapshot({ _tag: \"run-summary\", runId: input.runId })\n      const row = snapshot.rows.find(Schema.is(RunSummaryRow))\n      if (\n        row === undefined || row.runId !== summary.runId || row.flowId !== summary.flowId ||\n        row.status !== summary.status || row.planId !== summary.planId || row.planDigest !== summary.planDigest\n      ) {\n        return yield* Effect.fail(\n          new BridgeError({ code: \"internal\", message: \"Terminal result observation changed\", retryable: true })\n        )\n      }\n      finalOutput = row.finalOutput\n      failure = {\n        ...(row.failureFault === undefined ? {} : { failureFault: row.failureFault }),\n        ...(row.failureTag === undefined ? {} : { failureTag: row.failureTag }),\n        ...(row.failureMessage === undefined ? {} : { failureMessage: row.failureMessage })\n      }\n    }\n    // Keep the private receipt out of every repository-controlled projection.\n    const hostSummary = yield* Schema.decodeUnknownEffect(RunSummary)(summary)\n    const commandReceipt = receipts === undefined ? undefined : yield* receipts(input.runId)\n    if (commandReceipt !== undefined && commandReceipt.runId !== input.runId) {\n      return yield* Effect.fail(\n        new BridgeError({ code: \"internal\", message: \"Host command receipt names another run\", retryable: false })\n      )\n    }\n    return {\n      run: {\n        ...hostSummary,\n        ...(commandReceipt === undefined ? {} : { commandReceipt }),\n        ...(finalOutput === undefined ? {} : { finalOutput }),\n        ...failure\n      },\n      events: page,\n      nextCursor: last === undefined\n        ? input.afterCursor ?? \"\"\n        : encodedCursor(last.cursor ?? { sequence: last.sequence }),\n      hasMore: events.length > limit,\n      terminal: terminal.has(summary.status)\n    }\n  })\n\n// Disposable raw journal prefixes for Inspect. This stores no run state: the\n// existing monitor fold still derives every answer from journal records. Bound\n// retention across all runs of one control service, and rebuild after eviction.\nconst monitorJournals = new WeakMap<\n  Control[\"Service\"],\n  Map<string, {\n    readonly records: ReadonlyArray<ControlEvent>\n    readonly bytes: number\n  }>\n>()\nconst monitorJournalBytes = 64 * 1024 * 1024\n\n/** Read an existing run and its committed journal without invoking any execution door.\n * @since 1.0.0\n * @category constructors\n */\nexport const monitor = (control: Control[\"Service\"], runId: string, at?: number) =>\n  Effect.gen(function*() {\n    const listed = yield* control.list({ _tag: \"runs\", filters: { runId }, limit: 1 })\n    const run = listed._tag === \"runs\" ? listed.items[0] : undefined\n    if (run === undefined || run.runId !== runId) {\n      return yield* new BridgeError({\n        code: \"run_not_found\",\n        message: \"Runtime execution was not found\",\n        retryable: false\n      })\n    }\n    const cache = monitorJournals.get(control) ??\n      new Map<string, { readonly records: ReadonlyArray<ControlEvent>; readonly bytes: number }>()\n    monitorJournals.set(control, cache)\n    const cached = cache.get(runId)\n    const last = cached?.records.at(-1)?.sequence\n    // Replay the final entry because one entry may expand into several events.\n    const consumed = last === undefined ? 0 : cached!.records.filter((row) => row.sequence === last).length\n    let skipped = 0\n    const suffix = Array.from(\n      yield* Stream.runCollect(\n        control.watch({\n          runId,\n          follow: false,\n          ...(last === undefined || last === 0 ? {} : { afterSequence: last - 1 })\n        }).pipe(\n          Stream.filter((row) =>\n            last === undefined || row.sequence > last || row.sequence === last && skipped++ >= consumed\n          ),\n          Stream.take(Projections.maxEventsScanned + 1)\n        )\n      )\n    )\n    const records = [...(cached?.records ?? []), ...suffix]\n    if (records.length > Projections.maxEventsScanned) {\n      return yield* new BridgeError({\n        code: \"resource_limit\",\n        message: \"Run journal exceeds the inspection limit\",\n        retryable: false\n      })\n    }\n    const bytes = (cached?.bytes ?? 0) +\n      suffix.reduce((sum, row) => sum + new TextEncoder().encode(JSON.stringify(row)).byteLength, 0)\n    const current = cache.get(runId)\n    // A slower reader cannot overwrite a longer committed prefix.\n    if (bytes <= monitorJournalBytes && (current === undefined || current.records.length <= records.length)) {\n      cache.delete(runId)\n      cache.set(runId, { records, bytes })\n      let total = [...cache.values()].reduce((sum, entry) => sum + entry.bytes, 0)\n      while (cache.size > 32 || total > monitorJournalBytes) {\n        const oldest = cache.keys().next().value!\n        total -= cache.get(oldest)!.bytes\n        cache.delete(oldest)\n      }\n    }\n    const folded = monitorFromJournal({ runId, flowId: run.flowId, status: run.status }, records, at)\n    // The journal is read page by page when its tab opens (run-events). Only a\n    // replay frame carries its own journal prefix. The extent bounds the run.\n    let start = Infinity\n    let end = 0\n    for (const row of records) {\n      if (row.occurredAt > 0) {\n        start = Math.min(start, row.occurredAt)\n        end = Math.max(end, row.occurredAt)\n      }\n    }\n    const value: Partial<typeof folded> & Omit<typeof folded, \"journal\"> & { extent?: { start: string; end: string } } =\n      {\n        ...folded,\n        ...(end === 0 ? {} : { extent: { start: new Date(start).toISOString(), end: new Date(end).toISOString() } })\n      }\n    if (at === undefined) delete value.journal\n    if (new TextEncoder().encode(JSON.stringify(value)).byteLength > Projections.maxProjectionBytes) {\n      return yield* new BridgeError({\n        code: \"resource_limit\",\n        message: \"Run monitor exceeds the inspection limit\",\n        retryable: false\n      })\n    }\n    return value\n  })\n\n/**\n * Successful command response on the JSON wire.\n * @since 1.0.0\n * @category models\n */\nexport const CommandResponse = Schema.Struct({\n  protocol: Schema.Literal(protocol),\n  ok: Schema.Literal(true),\n  value: Schema.Struct({\n    operation: Schema.String,\n    applicationRequestId: Schema.String,\n    ownerGeneration: Schema.optional(PositiveSafeInteger),\n    runtimeArtifactDigest: Schema.optional(Sha256),\n    sourceRevision: Schema.optional(SourceRevision),\n    planId: Schema.optional(Schema.String),\n    planDigest: Schema.optional(Sha256),\n    executionDigest: Schema.optional(Sha256),\n    envelope: Schema.optional(Schema.Json),\n    approval: Schema.optional(ApprovalPayload),\n    receipt: Receipt\n  })\n})\n\n/**\n * Successful observation response on the JSON wire.\n * @since 1.0.0\n * @category models\n */\nexport const ObserveResponse = Schema.Struct({\n  protocol: Schema.Literal(protocol),\n  ok: Schema.Literal(true),\n  value: Schema.Struct({\n    run: Schema.Struct({\n      ...RunSummary.fields,\n      finalOutput: Schema.optional(Schema.String),\n      failureFault: Schema.optional(Fault.Class),\n      failureTag: Schema.optional(Schema.String),\n      failureMessage: Schema.optional(Schema.String),\n      commandReceipt: Schema.optionalKey(CommandReceipt)\n    }),\n    events: Schema.Array(ControlEvent),\n    nextCursor: Schema.String,\n    hasMore: Schema.Boolean,\n    terminal: Schema.Boolean\n  })\n})\n\n/**\n * Stable sanitized failure response on the JSON wire.\n * @since 1.0.0\n * @category models\n */\nexport const ErrorResponse = Schema.Struct({\n  protocol: Schema.Literal(protocol),\n  ok: Schema.Literal(false),\n  error: Schema.Struct({ code: Schema.String, message: Schema.String, retryable: Schema.Boolean })\n})\n\nconst errorResponse = (cause: unknown) => {\n  const known = Schema.is(ControlError.ControlErrorSchema)(cause)\n  const code = cause instanceof BridgeError || known ? cause.code : \"internal\"\n  const retryable = cause instanceof BridgeError\n    ? cause.retryable\n    : cause instanceof ControlError.TransportError\n    ? cause.retryable\n    : retryableCodes.has(code)\n  // Control errors can contain storage paths, SQL diagnostics, or executor\n  // output. The bridge publishes their stable code, never that backend text.\n  const message = cause instanceof BridgeError ? cause.message : \"Runtime bridge failed\"\n  const status = code === \"unauthorized\" ?\n    401\n    : notFoundCodes.has(code) ?\n    404\n    : conflictCodes.has(code) ?\n    409\n    : retryable ?\n    503\n    : code === \"internal\" ?\n    500\n    : 400\n  return HttpServerResponse.jsonUnsafe({ protocol, ok: false, error: { code, message, retryable } }, { status })\n}\n\n/**\n * Answers a failed bridge request with its sanitized response, logging it first.\n *\n * The wire carries only the stable code. The operator log carries the full\n * cause of every failure the caller did not cause, so a launch that failed in\n * storage or in the executor can be diagnosed from the host.\n */\nconst respondToFailure = (operation: \"runtime-bridge.command\" | \"runtime-bridge.observe\") => (cause: unknown) => {\n  const response = errorResponse(cause)\n  if (cause instanceof BridgeError) return Effect.succeed(response)\n  const code = Schema.is(ControlError.ControlErrorSchema)(cause) ? cause.code : \"internal\"\n  return Effect.logError({ message: \"Runtime bridge request failed\", operation, code, cause }).pipe(\n    Effect.as(response)\n  )\n}\n\nconst readJson = Effect.gen(function*() {\n  const request = yield* HttpServerRequest.HttpServerRequest\n  const text = yield* request.text\n  return yield* Effect.try({\n    try: () => JSON.parse(text) as unknown,\n    catch: () => new BridgeError({ code: \"invalid_request\", message: \"Request body must be JSON\", retryable: false })\n  })\n})\n\nconst authenticated = <A, E, R>(\n  config: Config,\n  effect: (principal: Principal) => Effect.Effect<A, E, R>\n) =>\n  Effect.gen(function*() {\n    const request = yield* HttpServerRequest.HttpServerRequest\n    const principal = yield* config.authenticate(request.headers)\n    return yield* effect(principal)\n  })\n\n/**\n * Mounts the authenticated JSON bridge beside the existing gateway RPCs.\n * @since 1.0.0\n * @category layers\n */\nexport const layer = (config: Config) => {\n  const command = authenticated(config, (principal) =>\n    Effect.gen(function*() {\n      const body = yield* readJson\n      const input = yield* decodeCommand(body).pipe(Effect.mapError(() =>\n        new BridgeError({\n          code: \"invalid_request\",\n          message: \"Request does not match the runtime bridge contract\",\n          retryable: false\n        })\n      ))\n      const control = yield* Control\n      const value = yield* execute(config, control, principal, input)\n      return HttpServerResponse.jsonUnsafe({ protocol, ok: true, value })\n    })).pipe(\n      Effect.catch(respondToFailure(\"runtime-bridge.command\")),\n      Effect.withSpan(\"runtime-bridge.command\")\n    )\n\n  const observation = authenticated(config, () =>\n    Effect.gen(function*() {\n      const body = yield* readJson\n      const input = yield* decodeObserve(body).pipe(Effect.mapError(() =>\n        new BridgeError({\n          code: \"invalid_request\",\n          message: \"Request does not match the observation contract\",\n          retryable: false\n        })\n      ))\n      const control = yield* Control\n      const value = yield* observe(control, input, config.commandReceipt)\n      return HttpServerResponse.jsonUnsafe({ protocol, ok: true, value })\n    })).pipe(\n      Effect.catch(respondToFailure(\"runtime-bridge.observe\")),\n      Effect.withSpan(\"runtime-bridge.observe\")\n    )\n\n  const inspection = authenticated(config, () =>\n    Effect.gen(function*() {\n      const body = yield* readJson\n      const input = yield* Schema.decodeUnknownEffect(Schema.Struct({\n        protocol: Schema.Literal(protocol),\n        runId: Schema.NonEmptyString,\n        at: Schema.optional(Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)))\n      }))(body).pipe(Effect.mapError(() =>\n        new BridgeError({ code: \"invalid_request\", message: \"Invalid monitor request\", retryable: false })\n      ))\n      const control = yield* Control\n      return HttpServerResponse.jsonUnsafe({\n        protocol,\n        ok: true,\n        value: yield* monitor(control, input.runId, input.at)\n      })\n    })).pipe(Effect.catch(respondToFailure(\"runtime-bridge.observe\")))\n\n  return HttpRouter.add(\"POST\", \"/runtime/v1/command\", command).pipe(\n    Layer.merge(HttpRouter.add(\"POST\", \"/runtime/v1/monitor\", inspection)),\n    Layer.merge(HttpRouter.add(\"POST\", \"/runtime/v1/observe\", observation))\n  )\n}\n"],
   "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUA,qBAAwB;AACxB,mBAA8B;AAC9B,6BAAwE;AAExE,2BAOO;AACP,YAAuB;AACvB,oBAA8C;AAC9C,kBAAkE;AAClE,+BAA8B;AAC9B,kBAA6B;AAC7B,sBAAmC;AAO5B,MAAM,WAAW;AAExB,MAAM,SAAS,qBAAO,OAAO,MAAM,qBAAO,UAAU,gBAAgB,CAAC;AACrE,MAAM,iBAAiB,qBAAO,OAAO,MAAM,qBAAO,UAAU,gBAAgB,CAAC;AAC7E,MAAM,sBAAsB,qBAAO,IAAI;AAAA,EACrC,qBAAO,cAAc,CAAC;AAAA,EACtB,qBAAO,oBAAoB,OAAO,gBAAgB;AACpD;AACA,MAAM,YAAY,qBAAO,eAAe,MAAM,qBAAO,YAAY,IAAI,CAAC;AAGtE,MAAM,2BAA2B;AAO1B,MAAM,WAAW,qBAAO,OAAO;AAAA,EACpC,UAAU,qBAAO,QAAQ,QAAQ;AAAA,EACjC,uBAAuB;AAAA,EACvB,gBAAgB;AAAA,EAChB,iBAAiB;AACnB,CAAC;AAQD,MAAM,SAAS;AAAA,EACb,UAAU,qBAAO,QAAQ,QAAQ;AAAA,EACjC,sBAAsB;AAAA,EACtB,iBAAiB;AACnB;AAKA,MAAM,YAAY,qBAAO,OAAO;AAAA,EAC9B,MAAM,qBAAO;AAAA,EACb,cAAc;AAAA,EACd,iBAAiB;AACnB,CAAC;AAOM,MAAM,gBAAgB,qBAAO,OAAO;AAAA,EACzC,GAAG;AAAA,EACH,WAAW,qBAAO,QAAQ,QAAQ;AAAA,EAClC,SAAS;AAAA,EACT,OAAO,qBAAO,SAAS,qBAAO,cAAc;AAAA,EAC5C,uBAAuB;AAAA,EACvB,gBAAgB;AAAA,EAChB,QAAQ,qBAAO;AAAA,EACf,SAAS,qBAAO;AAAA,EAChB,KAAK,qBAAO,SAAS,SAAS;AAChC,CAAC;AAOM,MAAM,kBAAkB,qBAAO,OAAO;AAAA,EAC3C,GAAG;AAAA,EACH,WAAW,qBAAO,SAAS,CAAC,WAAW,MAAM,CAAC;AAAA,EAC9C,UAAU;AACZ,CAAC;AAOM,MAAM,gBAAgB,qBAAO,OAAO;AAAA,EACzC,GAAG;AAAA,EACH,WAAW,qBAAO,QAAQ,QAAQ;AAAA,EAClC,OAAO,qBAAO;AAAA,EACd,QAAQ;AACV,CAAC;AAED,MAAM,QAAQ,qBAAO,MAAM;AAAA,EACzB,qBAAO,OAAO,EAAE,MAAM,qBAAO,QAAQ,SAAS,GAAG,MAAM,qBAAO,OAAO,CAAC;AAAA,EACtE,qBAAO,OAAO,EAAE,MAAM,qBAAO,QAAQ,MAAM,GAAG,MAAM,qBAAO,eAAe,CAAC;AAAA,EAC3E,qBAAO,OAAO;AAAA,IACZ,MAAM,qBAAO,QAAQ,UAAU;AAAA,IAC/B,UAAU,qBAAO,SAAS,CAAC,QAAQ,WAAW,OAAO,UAAU,QAAQ,OAAO,CAAC;AAAA,EACjF,CAAC;AAAA,EACD,qBAAO,OAAO,EAAE,MAAM,qBAAO,QAAQ,OAAO,GAAG,WAAW,qBAAO,cAAc,qBAAO,cAAc,EAAE,CAAC;AACzG,CAAC;AAOM,MAAM,eAAe,qBAAO,OAAO;AAAA,EACxC,SAAS,qBAAO,SAAS,qBAAO,MAAM;AAAA,EACtC,GAAG;AAAA,EACH,WAAW,qBAAO,QAAQ,OAAO;AAAA,EACjC,OAAO,qBAAO;AAAA,EACd,WAAW,qBAAO;AAAA,EAClB,WAAW,qBAAO;AAAA,EAClB,aAAa,kCAAa,OAAO;AAAA,EACjC,OAAO;AACT,CAAC;AAOM,MAAM,mBAAmB,qBAAO,OAAO;AAAA,EAC5C,GAAG;AAAA;AAAA,EAEH,WAAW,qBAAO,SAAS,CAAC,UAAU,UAAU,UAAU,CAAC;AAAA,EAC3D,OAAO,qBAAO;AAAA,EACd,QAAQ,qBAAO,SAAS,qBAAO,MAAM;AACvC,CAAC;AAOM,MAAM,UAAU,qBAAO,MAAM;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAcM,MAAM,iBAAiB,qBAAO,OAAO;AAAA,EAC1C,UAAU,qBAAO,QAAQ,QAAQ;AAAA,EACjC,OAAO,qBAAO;AAAA,EACd,aAAa,qBAAO,SAAS,qBAAO,OAAO,MAAM,qBAAO,UAAU,wBAAwB,CAAC,CAAC;AAAA,EAC5F,OAAO,qBAAO,SAAS,mBAAmB;AAC5C,CAAC;AAcM,MAAM,iBAAiB,qBAAO,OAAO;AAAA,EAC1C,OAAO,qBAAO;AAAA,EACd,aAAa,qBAAO;AAAA,EACpB,QAAQ,qBAAO,SAAS,CAAC,WAAW,WAAW,CAAC;AAAA,EAChD,MAAM,qBAAO,cAAc,qBAAO,MAAM;AAAA,EACxC,UAAU,qBAAO,YAAY,qBAAO,GAAG;AAAA,EACvC,QAAQ,qBAAO,YAAY,qBAAO,MAAM;AAAA,EACxC,OAAO,qBAAO,YAAY,qBAAO,SAAS,CAAC,WAAW,OAAO,CAAC,CAAC;AACjE,CAAC;AAuCM,MAAM,oBAAoB,qBAAO,YAAyB,EAAE,sCAAsC;AAAA,EACvG,MAAM,qBAAO,SAAS;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAAA,EACD,SAAS,qBAAO;AAAA,EAChB,WAAW,qBAAO;AACpB,CAAC,EAAE;AAAC;AAEJ,MAAM,gBAAgB,qBAAO,oBAAoB,OAAO;AACxD,MAAM,gBAAgB,qBAAO,oBAAoB,cAAc;AAC/D,MAAM,WAAW,oBAAI,IAAI,CAAC,aAAa,UAAU,WAAW,CAAC;AAC7D,MAAM,iBAAiB,oBAAI,IAAI,CAAC,mBAAmB,eAAe,sBAAsB,eAAe,CAAC;AACxG,MAAM,gBAAgB,oBAAI,IAAI,CAAC,iBAAiB,kBAAkB,gBAAgB,CAAC;AACnF,MAAM,gBAAgB,oBAAI,IAAI,CAAC,eAAe,qBAAqB,mBAAmB,UAAU,CAAC;AACjG,MAAM,oBAAoB;AAC1B,MAAM,oBAAoB;AAK1B,MAAM,iBAAiB,CAAC,OAA8C,WACpE,aAAa,MAAM,oBAAoB,IAAI,MAAM;AAEnD,MAAM,gBAAgB,CAAC,QAAgB,UACrC,MAAM,oBAAoB,OAAO,kBAC7B,qBAAO,OACP,qBAAO;AAAA,EACP,IAAI,YAAY,EAAE,MAAM,eAAe,SAAS,qCAAqC,WAAW,KAAK,CAAC;AACxG;AAOG,MAAM,UAAU,CACrB,QACA,SACA,WACA,UAEA,qBAAO,IAAI,aAAY;AACrB,SAAO,cAAc,QAAQ,KAAK;AAClC,UAAQ,MAAM,WAAW;AAAA,IACvB,KAAK,UAAU;AACb,UAAI,MAAM,0BAA0B,OAAO,uBAAuB;AAChE,eAAO,OAAO,qBAAO;AAAA,UACnB,IAAI,YAAY;AAAA,YACd,MAAM;AAAA,YACN,SAAS;AAAA,YACT,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AAAA,MACF;AACA,UAAI,MAAM,mBAAmB,OAAO,gBAAgB;AAClD,eAAO,OAAO,qBAAO;AAAA,UACnB,IAAI,YAAY;AAAA,YACd,MAAM;AAAA,YACN,SAAS;AAAA,YACT,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AAAA,MACF;AAIA,UAAI,MAAM,QAAQ,UAAa,MAAM,IAAI,iBAAiB,OAAO,gBAAgB;AAC/E,eAAO,OAAO,qBAAO;AAAA,UACnB,IAAI,YAAY;AAAA,YACd,MAAM;AAAA,YACN,SAAS;AAAA,YACT,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AAAA,MACF;AACA,YAAM,OAAO,OAAO,QAAQ,KAAK;AAAA,QAC/B,QAAQ,MAAM;AAAA,QACd,OAAO,MAAM;AAAA,QACb,gBAAgB,eAAe,OAAO,MAAM;AAAA,MAC9C,CAAC;AAID,YAAM,gBAAgB,KAAK,OAAO,kBAAkB,OAAO;AAC3D,UAAI,kBAAkB,MAAM,gBAAgB;AAC1C,eAAO,OAAO,qBAAO;AAAA,UACnB,IAAI,YAAY;AAAA,YACd,MAAM;AAAA,YACN,SAAS;AAAA,YACT,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AAAA,MACF;AAGA,UACE,MAAM,QAAQ,WACb,KAAK,oBAAoB,UACvB,MAAM,IAAI,SAAS,MAAM,UAAU,KAAK,oBAAoB,MAAM,IAAI,kBACzE;AACA,eAAO,OAAO,qBAAO;AAAA,UACnB,IAAI,YAAY;AAAA,YACd,MAAM;AAAA,YACN,SAAS;AAAA,YACT,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AAAA,MACF;AACA,YAAM,UAAU,OAAO,QAAQ,IAAI;AAAA,QACjC,MAAM;AAAA,QACN,QAAQ,KAAK;AAAA,QACb,QAAQ,KAAK;AAAA,QACb,UAAU,KAAK;AAAA,QACf,gBAAgB,eAAe,OAAO,OAAO,MAAM,SAAS,MAAM,OAAO,EAAE;AAAA,QAC3E;AAAA,QACA,GAAI,MAAM,UAAU,SAAY,CAAC,IAAI,EAAE,eAAe,MAAM,MAAM;AAAA,MACpE,CAAC;AACD,aAAO;AAAA,QACL,WAAW,MAAM;AAAA,QACjB,sBAAsB,MAAM;AAAA,QAC5B,iBAAiB,MAAM;AAAA,QACvB,uBAAuB,OAAO;AAAA,QAC9B,gBAAgB,MAAM;AAAA,QACtB,QAAQ,KAAK;AAAA,QACb,YAAY,KAAK;AAAA,QACjB,GAAI,KAAK,oBAAoB,SAAY,CAAC,IAAI,EAAE,iBAAiB,KAAK,gBAAgB;AAAA,QACtF,UAAU,KAAK;AAAA,QACf,UAAU,KAAK;AAAA,QACf;AAAA,MACF;AAAA,IACF;AAAA,IACA,KAAK;AAAA,IACL,KAAK,QAAQ;AACX,YAAM,UAAU;AAAA,QACd,GAAG,MAAM;AAAA,QACT,gBAAgB,eAAe,OAAO,MAAM,SAAS;AAAA,QACrD;AAAA,MACF;AACA,YAAM,UAAU,OAAO,MAAM,cAAc,YAAY,QAAQ,QAAQ,OAAO,IAAI,QAAQ,KAAK,OAAO;AACtG,aAAO,EAAE,WAAW,MAAM,WAAW,sBAAsB,MAAM,sBAAsB,QAAQ;AAAA,IACjG;AAAA,IACA,KAAK,UAAU;AACb,YAAM,UAAU,OAAO,QAAQ,OAAO;AAAA,QACpC,OAAO,MAAM;AAAA,QACb,QAAQ,MAAM;AAAA,QACd,gBAAgB,eAAe,OAAO,QAAQ;AAAA,QAC9C;AAAA,MACF,CAAC;AACD,aAAO,EAAE,WAAW,MAAM,WAAW,sBAAsB,MAAM,sBAAsB,QAAQ;AAAA,IACjG;AAAA,IACA,KAAK,SAAS;AACZ,YAAM,UAAU,OAAO,QAAQ,MAAM;AAAA,QACnC,OAAO,MAAM;AAAA,QACb,gBAAgB,eAAe,OAAO,OAAO;AAAA,QAC7C,GAAI,MAAM,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,MAAM,QAAQ;AAAA,QAChE,SAAS;AAAA,UACP,GAAG,MAAM;AAAA,UACT,OAAO,MAAM;AAAA,UACb,WAAW,MAAM;AAAA,UACjB,WAAW,MAAM;AAAA,UACjB,GAAI,MAAM,gBAAgB,SAAY,CAAC,IAAI,EAAE,aAAa,MAAM,YAAY;AAAA,UAC5E;AAAA,QACF;AAAA,MACF,CAAC;AACD,aAAO,EAAE,WAAW,MAAM,WAAW,sBAAsB,MAAM,sBAAsB,QAAQ;AAAA,IACjG;AAAA;AAAA;AAAA;AAAA,IAIA,KAAK,YAAY;AACf,YAAM,WAAW,OAAO,qBAAO,cAAc,sCAAe;AAC5D,YAAM,WAAW,OAAO,oBACrB,SAAS,SAAS,SAAS,SAAS,MAAM,kBAAkB;AAC/D,UAAI,aAAa,QAAW;AAC1B,eAAO,OAAO,qBAAO;AAAA,UACnB,IAAI,YAAY;AAAA,YACd,MAAM;AAAA,YACN,SAAS;AAAA,YACT,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AAAA,MACF;AACA,YAAM,UAAU,OAAO,SAAS,EAAE,OAAO,MAAM,OAAO,WAAW,eAAe,OAAO,UAAU,EAAE,CAAC;AACpG,aAAO,EAAE,WAAW,MAAM,WAAW,sBAAsB,MAAM,sBAAsB,QAAQ;AAAA,IACjG;AAAA,IACA,KAAK;AAAA,IACL,KAAK,UAAU;AACb,YAAM,UAAU;AAAA,QACd,OAAO,MAAM;AAAA,QACb,gBAAgB,eAAe,OAAO,MAAM,SAAS;AAAA,QACrD,GAAI,MAAM,WAAW,SAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;AAAA,QAC7D;AAAA,MACF;AACA,YAAM,UAAU,OAAO,MAAM,cAAc,WAAW,QAAQ,OAAO,OAAO,IAAI,QAAQ,OAAO,OAAO;AACtG,aAAO,EAAE,WAAW,MAAM,WAAW,sBAAsB,MAAM,sBAAsB,QAAQ;AAAA,IACjG;AAAA,EACF;AACF,CAAC;AAEH,MAAM,iBAAiB,CAAC,WAAoF;AAC1G,MAAI,WAAW,UAAa,WAAW,GAAI,QAAO,qBAAO,QAAQ,MAAS;AAC1E,QAAM,QAAQ,yBAAyB,KAAK,MAAM;AAClD,QAAM,WAAW,OAAO,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC;AAChD,QAAM,SAAS,QAAQ,CAAC,MAAM,SAAY,SAAY,OAAO,MAAM,CAAC,CAAC;AACrE,QAAM,QAAQ,CAAC,UAAkB,OAAO,cAAc,KAAK,KAAK,SAAS,KAAK,QAAQ,OAAO;AAC7F,SAAO,UAAU,QAAQ,MAAM,QAAQ,MAAM,WAAW,UAAa,MAAM,MAAM,KAC7E,qBAAO,QAAQ,EAAE,UAAU,GAAI,WAAW,SAAY,CAAC,IAAI,EAAE,OAAO,EAAG,CAAC,IACxE,qBAAO;AAAA,IACP,IAAI,YAAY;AAAA,MACd,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACJ;AAEA,MAAM,gBAAgB,CAAC,WACrB,OAAO,WAAW,SAAY,OAAO,OAAO,QAAQ,IAAI,MAAM,OAAO,QAAQ,IAAI,OAAO,MAAM;AAOzF,MAAM,UAAU,CAAC,SAA6B,OAAuB,aAC1E,qBAAO,IAAI,aAAY;AACrB,QAAM,QAAQ,OAAO,eAAe,MAAM,WAAW;AACrD,QAAM,QAAQ,KAAK,IAAI,MAAM,SAAS,mBAAmB,iBAAiB;AAC1E,QAAM,SAAS,OAAO,QAAQ,KAAK,EAAE,MAAM,QAAQ,SAAS,EAAE,OAAO,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;AAC9F,QAAM,UAAU,OAAO,SAAS,SAAS,OAAO,MAAM,CAAC,IAAI;AAC3D,MAAI,YAAY,QAAW;AACzB,WAAO,OAAO,qBAAO;AAAA,MACnB,IAAI,YAAY,EAAE,MAAM,iBAAiB,SAAS,mCAAmC,WAAW,KAAK,CAAC;AAAA,IACxG;AAAA,EACF;AACA,QAAM,SAAS,MAAM;AAAA,IACnB,OAAO,qBAAO,WAAW,qBAAO;AAAA,MAC9B,QAAQ,MAAM;AAAA,QACZ,OAAO,MAAM;AAAA,QACb,GAAI,UAAU,SACV,CAAC,IACD,MAAM,WAAW,SACjB,EAAE,eAAe,MAAM,SAAS,IAChC,EAAE,aAAa,MAAM;AAAA,QACzB,QAAQ;AAAA,MACV,CAAC;AAAA,MACD,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AACA,QAAM,OAAO,OAAO,MAAM,GAAG,KAAK;AAClC,QAAM,OAAO,KAAK,GAAG,EAAE;AAIvB,MAAI;AACJ,MAAI,UAIA,CAAC;AACL,MAAI,SAAS,IAAI,QAAQ,MAAM,GAAG;AAChC,UAAM,cAAc,OAAO,YAAY,KAAK,OAAO;AACnD,UAAM,WAAW,OAAO,YAAY,SAAS,EAAE,MAAM,eAAe,OAAO,MAAM,MAAM,CAAC;AACxF,UAAM,MAAM,SAAS,KAAK,KAAK,qBAAO,GAAG,sCAAa,CAAC;AACvD,QACE,QAAQ,UAAa,IAAI,UAAU,QAAQ,SAAS,IAAI,WAAW,QAAQ,UAC3E,IAAI,WAAW,QAAQ,UAAU,IAAI,WAAW,QAAQ,UAAU,IAAI,eAAe,QAAQ,YAC7F;AACA,aAAO,OAAO,qBAAO;AAAA,QACnB,IAAI,YAAY,EAAE,MAAM,YAAY,SAAS,uCAAuC,WAAW,KAAK,CAAC;AAAA,MACvG;AAAA,IACF;AACA,kBAAc,IAAI;AAClB,cAAU;AAAA,MACR,GAAI,IAAI,iBAAiB,SAAY,CAAC,IAAI,EAAE,cAAc,IAAI,aAAa;AAAA,MAC3E,GAAI,IAAI,eAAe,SAAY,CAAC,IAAI,EAAE,YAAY,IAAI,WAAW;AAAA,MACrE,GAAI,IAAI,mBAAmB,SAAY,CAAC,IAAI,EAAE,gBAAgB,IAAI,eAAe;AAAA,IACnF;AAAA,EACF;AAEA,QAAM,cAAc,OAAO,qBAAO,oBAAoB,+BAAU,EAAE,OAAO;AACzE,QAAM,iBAAiB,aAAa,SAAY,SAAY,OAAO,SAAS,MAAM,KAAK;AACvF,MAAI,mBAAmB,UAAa,eAAe,UAAU,MAAM,OAAO;AACxE,WAAO,OAAO,qBAAO;AAAA,MACnB,IAAI,YAAY,EAAE,MAAM,YAAY,SAAS,0CAA0C,WAAW,MAAM,CAAC;AAAA,IAC3G;AAAA,EACF;AACA,SAAO;AAAA,IACL,KAAK;AAAA,MACH,GAAG;AAAA,MACH,GAAI,mBAAmB,SAAY,CAAC,IAAI,EAAE,eAAe;AAAA,MACzD,GAAI,gBAAgB,SAAY,CAAC,IAAI,EAAE,YAAY;AAAA,MACnD,GAAG;AAAA,IACL;AAAA,IACA,QAAQ;AAAA,IACR,YAAY,SAAS,SACjB,MAAM,eAAe,KACrB,cAAc,KAAK,UAAU,EAAE,UAAU,KAAK,SAAS,CAAC;AAAA,IAC5D,SAAS,OAAO,SAAS;AAAA,IACzB,UAAU,SAAS,IAAI,QAAQ,MAAM;AAAA,EACvC;AACF,CAAC;AAKH,MAAM,kBAAkB,oBAAI,QAM1B;AACF,MAAM,sBAAsB,KAAK,OAAO;AAMjC,MAAM,UAAU,CAAC,SAA6B,OAAe,OAClE,qBAAO,IAAI,aAAY;AACrB,QAAM,SAAS,OAAO,QAAQ,KAAK,EAAE,MAAM,QAAQ,SAAS,EAAE,MAAM,GAAG,OAAO,EAAE,CAAC;AACjF,QAAM,MAAM,OAAO,SAAS,SAAS,OAAO,MAAM,CAAC,IAAI;AACvD,MAAI,QAAQ,UAAa,IAAI,UAAU,OAAO;AAC5C,WAAO,OAAO,IAAI,YAAY;AAAA,MAC5B,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACA,QAAM,QAAQ,gBAAgB,IAAI,OAAO,KACvC,oBAAI,IAAuF;AAC7F,kBAAgB,IAAI,SAAS,KAAK;AAClC,QAAM,SAAS,MAAM,IAAI,KAAK;AAC9B,QAAM,OAAO,QAAQ,QAAQ,GAAG,EAAE,GAAG;AAErC,QAAM,WAAW,SAAS,SAAY,IAAI,OAAQ,QAAQ,OAAO,CAAC,QAAQ,IAAI,aAAa,IAAI,EAAE;AACjG,MAAI,UAAU;AACd,QAAM,SAAS,MAAM;AAAA,IACnB,OAAO,qBAAO;AAAA,MACZ,QAAQ,MAAM;AAAA,QACZ;AAAA,QACA,QAAQ;AAAA,QACR,GAAI,SAAS,UAAa,SAAS,IAAI,CAAC,IAAI,EAAE,eAAe,OAAO,EAAE;AAAA,MACxE,CAAC,EAAE;AAAA,QACD,qBAAO;AAAA,UAAO,CAAC,QACb,SAAS,UAAa,IAAI,WAAW,QAAQ,IAAI,aAAa,QAAQ,aAAa;AAAA,QACrF;AAAA,QACA,qBAAO,KAAK,YAAY,mBAAmB,CAAC;AAAA,MAC9C;AAAA,IACF;AAAA,EACF;AACA,QAAM,UAAU,CAAC,GAAI,QAAQ,WAAW,CAAC,GAAI,GAAG,MAAM;AACtD,MAAI,QAAQ,SAAS,YAAY,kBAAkB;AACjD,WAAO,OAAO,IAAI,YAAY;AAAA,MAC5B,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACA,QAAM,SAAS,QAAQ,SAAS,KAC9B,OAAO,OAAO,CAAC,KAAK,QAAQ,MAAM,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,GAAG,CAAC,EAAE,YAAY,CAAC;AAC/F,QAAM,UAAU,MAAM,IAAI,KAAK;AAE/B,MAAI,SAAS,wBAAwB,YAAY,UAAa,QAAQ,QAAQ,UAAU,QAAQ,SAAS;AACvG,UAAM,OAAO,KAAK;AAClB,UAAM,IAAI,OAAO,EAAE,SAAS,MAAM,CAAC;AACnC,QAAI,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,EAAE,OAAO,CAAC,KAAK,UAAU,MAAM,MAAM,OAAO,CAAC;AAC3E,WAAO,MAAM,OAAO,MAAM,QAAQ,qBAAqB;AACrD,YAAM,SAAS,MAAM,KAAK,EAAE,KAAK,EAAE;AACnC,eAAS,MAAM,IAAI,MAAM,EAAG;AAC5B,YAAM,OAAO,MAAM;AAAA,IACrB;AAAA,EACF;AACA,QAAM,aAAS,oCAAmB,EAAE,OAAO,QAAQ,IAAI,QAAQ,QAAQ,IAAI,OAAO,GAAG,SAAS,EAAE;AAGhG,MAAI,QAAQ;AACZ,MAAI,MAAM;AACV,aAAW,OAAO,SAAS;AACzB,QAAI,IAAI,aAAa,GAAG;AACtB,cAAQ,KAAK,IAAI,OAAO,IAAI,UAAU;AACtC,YAAM,KAAK,IAAI,KAAK,IAAI,UAAU;AAAA,IACpC;AAAA,EACF;AACA,QAAM,QACJ;AAAA,IACE,GAAG;AAAA,IACH,GAAI,QAAQ,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,IAAI,KAAK,KAAK,EAAE,YAAY,GAAG,KAAK,IAAI,KAAK,GAAG,EAAE,YAAY,EAAE,EAAE;AAAA,EAC5G;AACF,MAAI,OAAO,OAAW,QAAO,MAAM;AACnC,MAAI,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,KAAK,CAAC,EAAE,aAAa,YAAY,oBAAoB;AAC/F,WAAO,OAAO,IAAI,YAAY;AAAA,MAC5B,MAAM;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACA,SAAO;AACT,CAAC;AAOI,MAAM,kBAAkB,qBAAO,OAAO;AAAA,EAC3C,UAAU,qBAAO,QAAQ,QAAQ;AAAA,EACjC,IAAI,qBAAO,QAAQ,IAAI;AAAA,EACvB,OAAO,qBAAO,OAAO;AAAA,IACnB,WAAW,qBAAO;AAAA,IAClB,sBAAsB,qBAAO;AAAA,IAC7B,iBAAiB,qBAAO,SAAS,mBAAmB;AAAA,IACpD,uBAAuB,qBAAO,SAAS,MAAM;AAAA,IAC7C,gBAAgB,qBAAO,SAAS,cAAc;AAAA,IAC9C,QAAQ,qBAAO,SAAS,qBAAO,MAAM;AAAA,IACrC,YAAY,qBAAO,SAAS,MAAM;AAAA,IAClC,iBAAiB,qBAAO,SAAS,MAAM;AAAA,IACvC,UAAU,qBAAO,SAAS,qBAAO,IAAI;AAAA,IACrC,UAAU,qBAAO,SAAS,oCAAe;AAAA,IACzC,SAAS;AAAA,EACX,CAAC;AACH,CAAC;AAOM,MAAM,kBAAkB,qBAAO,OAAO;AAAA,EAC3C,UAAU,qBAAO,QAAQ,QAAQ;AAAA,EACjC,IAAI,qBAAO,QAAQ,IAAI;AAAA,EACvB,OAAO,qBAAO,OAAO;AAAA,IACnB,KAAK,qBAAO,OAAO;AAAA,MACjB,GAAG,gCAAW;AAAA,MACd,aAAa,qBAAO,SAAS,qBAAO,MAAM;AAAA,MAC1C,cAAc,qBAAO,SAAS,MAAM,KAAK;AAAA,MACzC,YAAY,qBAAO,SAAS,qBAAO,MAAM;AAAA,MACzC,gBAAgB,qBAAO,SAAS,qBAAO,MAAM;AAAA,MAC7C,gBAAgB,qBAAO,YAAY,cAAc;AAAA,IACnD,CAAC;AAAA,IACD,QAAQ,qBAAO,MAAM,iCAAY;AAAA,IACjC,YAAY,qBAAO;AAAA,IACnB,SAAS,qBAAO;AAAA,IAChB,UAAU,qBAAO;AAAA,EACnB,CAAC;AACH,CAAC;AAOM,MAAM,gBAAgB,qBAAO,OAAO;AAAA,EACzC,UAAU,qBAAO,QAAQ,QAAQ;AAAA,EACjC,IAAI,qBAAO,QAAQ,KAAK;AAAA,EACxB,OAAO,qBAAO,OAAO,EAAE,MAAM,qBAAO,QAAQ,SAAS,qBAAO,QAAQ,WAAW,qBAAO,QAAQ,CAAC;AACjG,CAAC;AAED,MAAM,gBAAgB,CAAC,UAAmB;AACxC,QAAM,QAAQ,qBAAO,GAAG,aAAa,kBAAkB,EAAE,KAAK;AAC9D,QAAM,OAAO,iBAAiB,eAAe,QAAQ,MAAM,OAAO;AAClE,QAAM,YAAY,iBAAiB,cAC/B,MAAM,YACN,iBAAiB,aAAa,iBAC9B,MAAM,YACN,eAAe,IAAI,IAAI;AAG3B,QAAM,UAAU,iBAAiB,cAAc,MAAM,UAAU;AAC/D,QAAM,SAAS,SAAS,iBACtB,MACE,cAAc,IAAI,IAAI,IACxB,MACE,cAAc,IAAI,IAAI,IACxB,MACE,YACF,MACE,SAAS,aACX,MACE;AACJ,SAAO,+BAAmB,WAAW,EAAE,UAAU,IAAI,OAAO,OAAO,EAAE,MAAM,SAAS,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC;AAC/G;AASA,MAAM,mBAAmB,CAAC,cAAmE,CAAC,UAAmB;AAC/G,QAAM,WAAW,cAAc,KAAK;AACpC,MAAI,iBAAiB,YAAa,QAAO,qBAAO,QAAQ,QAAQ;AAChE,QAAM,OAAO,qBAAO,GAAG,aAAa,kBAAkB,EAAE,KAAK,IAAI,MAAM,OAAO;AAC9E,SAAO,qBAAO,SAAS,EAAE,SAAS,iCAAiC,WAAW,MAAM,MAAM,CAAC,EAAE;AAAA,IAC3F,qBAAO,GAAG,QAAQ;AAAA,EACpB;AACF;AAEA,MAAM,WAAW,qBAAO,IAAI,aAAY;AACtC,QAAM,UAAU,OAAO,8BAAkB;AACzC,QAAM,OAAO,OAAO,QAAQ;AAC5B,SAAO,OAAO,qBAAO,IAAI;AAAA,IACvB,KAAK,MAAM,KAAK,MAAM,IAAI;AAAA,IAC1B,OAAO,MAAM,IAAI,YAAY,EAAE,MAAM,mBAAmB,SAAS,6BAA6B,WAAW,MAAM,CAAC;AAAA,EAClH,CAAC;AACH,CAAC;AAED,MAAM,gBAAgB,CACpB,QACA,WAEA,qBAAO,IAAI,aAAY;AACrB,QAAM,UAAU,OAAO,8BAAkB;AACzC,QAAM,YAAY,OAAO,OAAO,aAAa,QAAQ,OAAO;AAC5D,SAAO,OAAO,OAAO,SAAS;AAChC,CAAC;AAOI,MAAM,QAAQ,CAAC,WAAmB;AACvC,QAAM,UAAU,cAAc,QAAQ,CAAC,cACrC,qBAAO,IAAI,aAAY;AACrB,UAAM,OAAO,OAAO;AACpB,UAAM,QAAQ,OAAO,cAAc,IAAI,EAAE,KAAK,qBAAO;AAAA,MAAS,MAC5D,IAAI,YAAY;AAAA,QACd,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH,CAAC;AACD,UAAM,UAAU,OAAO;AACvB,UAAM,QAAQ,OAAO,QAAQ,QAAQ,SAAS,WAAW,KAAK;AAC9D,WAAO,+BAAmB,WAAW,EAAE,UAAU,IAAI,MAAM,MAAM,CAAC;AAAA,EACpE,CAAC,CAAC,EAAE;AAAA,IACF,qBAAO,MAAM,iBAAiB,wBAAwB,CAAC;AAAA,IACvD,qBAAO,SAAS,wBAAwB;AAAA,EAC1C;AAEF,QAAM,cAAc,cAAc,QAAQ,MACxC,qBAAO,IAAI,aAAY;AACrB,UAAM,OAAO,OAAO;AACpB,UAAM,QAAQ,OAAO,cAAc,IAAI,EAAE,KAAK,qBAAO;AAAA,MAAS,MAC5D,IAAI,YAAY;AAAA,QACd,MAAM;AAAA,QACN,SAAS;AAAA,QACT,WAAW;AAAA,MACb,CAAC;AAAA,IACH,CAAC;AACD,UAAM,UAAU,OAAO;AACvB,UAAM,QAAQ,OAAO,QAAQ,SAAS,OAAO,OAAO,cAAc;AAClE,WAAO,+BAAmB,WAAW,EAAE,UAAU,IAAI,MAAM,MAAM,CAAC;AAAA,EACpE,CAAC,CAAC,EAAE;AAAA,IACF,qBAAO,MAAM,iBAAiB,wBAAwB,CAAC;AAAA,IACvD,qBAAO,SAAS,wBAAwB;AAAA,EAC1C;AAEF,QAAM,aAAa,cAAc,QAAQ,MACvC,qBAAO,IAAI,aAAY;AACrB,UAAM,OAAO,OAAO;AACpB,UAAM,QAAQ,OAAO,qBAAO,oBAAoB,qBAAO,OAAO;AAAA,MAC5D,UAAU,qBAAO,QAAQ,QAAQ;AAAA,MACjC,OAAO,qBAAO;AAAA,MACd,IAAI,qBAAO,SAAS,qBAAO,IAAI,MAAM,qBAAO,uBAAuB,CAAC,CAAC,CAAC;AAAA,IACxE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,qBAAO;AAAA,MAAS,MAC7B,IAAI,YAAY,EAAE,MAAM,mBAAmB,SAAS,2BAA2B,WAAW,MAAM,CAAC;AAAA,IACnG,CAAC;AACD,UAAM,UAAU,OAAO;AACvB,WAAO,+BAAmB,WAAW;AAAA,MACnC;AAAA,MACA,IAAI;AAAA,MACJ,OAAO,OAAO,QAAQ,SAAS,MAAM,OAAO,MAAM,EAAE;AAAA,IACtD,CAAC;AAAA,EACH,CAAC,CAAC,EAAE,KAAK,qBAAO,MAAM,iBAAiB,wBAAwB,CAAC,CAAC;AAEnE,SAAO,uBAAW,IAAI,QAAQ,uBAAuB,OAAO,EAAE;AAAA,IAC5D,oBAAM,MAAM,uBAAW,IAAI,QAAQ,uBAAuB,UAAU,CAAC;AAAA,IACrE,oBAAM,MAAM,uBAAW,IAAI,QAAQ,uBAAuB,WAAW,CAAC;AAAA,EACxE;AACF;",
   "names": []
 }

package/dist/cjs/bun/BunGateway.d.ts

@@ -2,7 +2,7 @@
  * @since 1.0.0
  */
 import { Layer } from "effect";
-import type { HttpServer } from "effect/unstable/http/HttpServer";
+import type { HttpServer } from "effect/http/HttpServer";
 import { GatewayError } from "../GatewayError.ts";
 import type * as GatewayServer from "../GatewayServer.ts";
 import * as NativeGateway from "../internal/NativeGateway.ts";

package/dist/cjs/bun/BunGateway.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"BunGateway.d.ts","sourceRoot":"","sources":["../../../src/bun/BunGateway.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAiB,KAAK,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAA;AAEjE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,KAAK,KAAK,aAAa,MAAM,qBAAqB,CAAA;AACzD,OAAO,KAAK,aAAa,MAAM,8BAA8B,CAAA;AAE7D,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAE/E;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,IAAI,CAC9B,aAAa,CAAC,aAAa,EAC3B,MAAM,GAAG,MAAM,GAAG,cAAc,GAAG,QAAQ,GAAG,YAAY,GAAG,iBAAiB,GAAG,qBAAqB,CACvG,CAAA;AAyBD;;;GAGG;AACH,eAAO,MAAM,KAAK,GAAI,QAAQ,aAAa,CAAC,MAAM,EAAE,UAAS,aAAkD,sQACtF,CAAA"}
+{"version":3,"file":"BunGateway.d.ts","sourceRoot":"","sources":["../../../src/bun/BunGateway.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAiB,KAAK,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAExD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,KAAK,KAAK,aAAa,MAAM,qBAAqB,CAAA;AACzD,OAAO,KAAK,aAAa,MAAM,8BAA8B,CAAA;AAE7D,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AAE/E;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,IAAI,CAC9B,aAAa,CAAC,aAAa,EAC3B,MAAM,GAAG,MAAM,GAAG,cAAc,GAAG,QAAQ,GAAG,YAAY,GAAG,iBAAiB,GAAG,qBAAqB,CACvG,CAAA;AAyBD;;;GAGG;AACH,eAAO,MAAM,KAAK,GAAI,QAAQ,aAAa,CAAC,MAAM,EAAE,UAAS,aAAkD,sQACtF,CAAA"}

package/dist/cjs/bun/BunGateway.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/bun/BunGateway.ts"],
-  "sourcesContent": ["/** Bun HTTP adapter for the same authenticated workspace gateway protocol.\n * @since 1.0.0\n */\n\nimport * as BunHttpServer from \"@effect/platform-bun/BunHttpServer\"\nimport { Cause, Effect, Layer } from \"effect\"\nimport type { HttpServer } from \"effect/unstable/http/HttpServer\"\nimport type { ServeError } from \"effect/unstable/http/HttpServerError\"\nimport { GatewayError } from \"../GatewayError.ts\"\nimport type * as GatewayServer from \"../GatewayServer.ts\"\nimport * as NativeGateway from \"../internal/NativeGateway.ts\"\n\nexport { bearerPrincipal, scopedPrincipal } from \"../internal/NativeGateway.ts\"\n\n/** TCP bind and existing gateway policy options supported by the Bun host.\n * @since 1.0.0\n * @category models\n */\nexport type ServerOptions = Pick<\n  NativeGateway.ServerOptions,\n  \"host\" | \"port\" | \"allowedHosts\" | \"listen\" | \"credential\" | \"heartbeatMillis\" | \"maxRequestBodyBytes\"\n>\n\nconst native = NativeGateway.makeLayer((options) =>\n  BunHttpServer.layerServer({\n    // Shared listenOptions has already supplied and admitted the bind host.\n    hostname: options.host!,\n    port: options.port ?? 7331\n  }).pipe(Layer.catchCause((cause): Layer.Layer<HttpServer, ServeError | GatewayError> => {\n    const failure = Cause.squash(cause)\n    const code = typeof failure === \"object\" && failure !== null && \"code\" in failure ? failure.code : undefined\n    if (Cause.hasInterruptsOnly(cause) || ![\"EADDRINUSE\", \"EACCES\", \"EADDRNOTAVAIL\"].includes(String(code))) {\n      return Layer.effectContext<HttpServer, ServeError | GatewayError, never>(Effect.failCause(cause))\n    }\n    // The errno is safe to keep: NativeGateway logs it for the operator and\n    // strips it from the refusal every bearer holder sees.\n    return Layer.effectContext<HttpServer, ServeError | GatewayError, never>(Effect.fail(\n      new GatewayError({\n        code: \"bind_failed\",\n        message: \"The gateway socket could not be bound\",\n        cause: { _tag: \"BunServeError\", code: String(code) }\n      })\n    ))\n  }))\n)\n\n/** Serves the existing HTTP/WebSocket gateway using Bun.serve in the caller's scope.\n * @since 1.0.0\n * @category layers\n */\nexport const layer = (health: GatewayServer.Health, options: ServerOptions = NativeGateway.defaultServerOptions) =>\n  native(health, options)\n"],
+  "sourcesContent": ["/** Bun HTTP adapter for the same authenticated workspace gateway protocol.\n * @since 1.0.0\n */\n\nimport * as BunHttpServer from \"@effect/platform-bun/BunHttpServer\"\nimport { Cause, Effect, Layer } from \"effect\"\nimport type { HttpServer } from \"effect/http/HttpServer\"\nimport type { ServeError } from \"effect/http/HttpServerError\"\nimport { GatewayError } from \"../GatewayError.ts\"\nimport type * as GatewayServer from \"../GatewayServer.ts\"\nimport * as NativeGateway from \"../internal/NativeGateway.ts\"\n\nexport { bearerPrincipal, scopedPrincipal } from \"../internal/NativeGateway.ts\"\n\n/** TCP bind and existing gateway policy options supported by the Bun host.\n * @since 1.0.0\n * @category models\n */\nexport type ServerOptions = Pick<\n  NativeGateway.ServerOptions,\n  \"host\" | \"port\" | \"allowedHosts\" | \"listen\" | \"credential\" | \"heartbeatMillis\" | \"maxRequestBodyBytes\"\n>\n\nconst native = NativeGateway.makeLayer((options) =>\n  BunHttpServer.layerServer({\n    // Shared listenOptions has already supplied and admitted the bind host.\n    hostname: options.host!,\n    port: options.port ?? 7331\n  }).pipe(Layer.catchCause((cause): Layer.Layer<HttpServer, ServeError | GatewayError> => {\n    const failure = Cause.squash(cause)\n    const code = typeof failure === \"object\" && failure !== null && \"code\" in failure ? failure.code : undefined\n    if (Cause.hasInterruptsOnly(cause) || ![\"EADDRINUSE\", \"EACCES\", \"EADDRNOTAVAIL\"].includes(String(code))) {\n      return Layer.effectContext<HttpServer, ServeError | GatewayError, never>(Effect.failCause(cause))\n    }\n    // The errno is safe to keep: NativeGateway logs it for the operator and\n    // strips it from the refusal every bearer holder sees.\n    return Layer.effectContext<HttpServer, ServeError | GatewayError, never>(Effect.fail(\n      new GatewayError({\n        code: \"bind_failed\",\n        message: \"The gateway socket could not be bound\",\n        cause: { _tag: \"BunServeError\", code: String(code) }\n      })\n    ))\n  }))\n)\n\n/** Serves the existing HTTP/WebSocket gateway using Bun.serve in the caller's scope.\n * @since 1.0.0\n * @category layers\n */\nexport const layer = (health: GatewayServer.Health, options: ServerOptions = NativeGateway.defaultServerOptions) =>\n  native(health, options)\n"],
   "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAIA,oBAA+B;AAC/B,oBAAqC;AAGrC,0BAA6B;AAE7B,oBAA+B;AAE/B,2BAAiD;AAWjD,MAAM,SAAS,cAAc;AAAA,EAAU,CAAC,YACtC,cAAc,YAAY;AAAA;AAAA,IAExB,UAAU,QAAQ;AAAA,IAClB,MAAM,QAAQ,QAAQ;AAAA,EACxB,CAAC,EAAE,KAAK,oBAAM,WAAW,CAAC,UAA8D;AACtF,UAAM,UAAU,oBAAM,OAAO,KAAK;AAClC,UAAM,OAAO,OAAO,YAAY,YAAY,YAAY,QAAQ,UAAU,UAAU,QAAQ,OAAO;AACnG,QAAI,oBAAM,kBAAkB,KAAK,KAAK,CAAC,CAAC,cAAc,UAAU,eAAe,EAAE,SAAS,OAAO,IAAI,CAAC,GAAG;AACvG,aAAO,oBAAM,cAA4D,qBAAO,UAAU,KAAK,CAAC;AAAA,IAClG;AAGA,WAAO,oBAAM,cAA4D,qBAAO;AAAA,MAC9E,IAAI,iCAAa;AAAA,QACf,MAAM;AAAA,QACN,SAAS;AAAA,QACT,OAAO,EAAE,MAAM,iBAAiB,MAAM,OAAO,IAAI,EAAE;AAAA,MACrD,CAAC;AAAA,IACH,CAAC;AAAA,EACH,CAAC,CAAC;AACJ;AAMO,MAAM,QAAQ,CAAC,QAA8B,UAAyB,cAAc,yBACzF,OAAO,QAAQ,OAAO;",
   "names": []
 }

package/dist/cjs/internal/NativeGateway.d.ts

@@ -19,8 +19,8 @@
  */
 import { ControlRpcs } from "@smthrs/control";
 import { Effect, Layer } from "effect";
-import type { HttpServer } from "effect/unstable/http/HttpServer";
-import type { ServeError } from "effect/unstable/http/HttpServerError";
+import type { HttpServer } from "effect/http/HttpServer";
+import type { ServeError } from "effect/http/HttpServerError";
 import type { ListenOptions } from "node:net";
 import { GatewayError } from "../GatewayError.ts";
 import * as GatewayServer from "../GatewayServer.ts";

package/dist/cjs/internal/NativeGateway.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"NativeGateway.d.ts","sourceRoot":"","sources":["../../../src/internal/NativeGateway.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,WAAW,EAAe,MAAM,iBAAiB,CAAA;AAC1D,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAA;AAEtC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAA;AACjE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sCAAsC,CAAA;AAEtE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAkB,MAAM,oBAAoB,CAAA;AACjE,OAAO,KAAK,aAAa,MAAM,qBAAqB,CAAA;AACpD,OAAO,KAAK,KAAK,aAAa,MAAM,qBAAqB,CAAA;AAEzD;;;;;GAKG;AACH,MAAM,WAAW,aAAc,SAAQ,aAAa;IAClD,0FAA0F;IAC1F,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;IACzD,8DAA8D;IAC9D,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;IACrC,sEAAsE;IACtE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACxC,2FAA2F;IAC3F,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7C,uEAAuE;IACvE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACjD,oEAAoE;IACpE,QAAQ,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,cAAc,CAAC,GAAG,SAAS,CAAA;CAChF;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,aAAiD,CAAA;AAEpF;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,GAAI,MAAM,MAAM,KAAG,OAAyD,CAAA;AAEvG;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,WAAW,GAAI,SAAS,aAAa,KAAG,YAAY,GAAG,SA2BnE,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,GAAI,SAAS,aAAa,KAAG,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,CAgB5F,CAAA;AAEJ;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,SAAS,GAAI,SAAS,aAAa,KAAG,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,CAmBQ,CAAA;AAuB9F;;;;;GAKG;AACH,eAAO,MAAM,eAAe;;;EAAmD,CAAA;AAE/E;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAE,aAAa,CAAC,MAAM,CAMlD,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe;;;EAAmD,CAAA;AAE/E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,cAAc,GAAI,SAAS,aAAa,KAAG,aAAa,CAAC,cA4BrE,CAAA;AA+BD;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,SAAS,GACpB,QAAQ,CAAC,OAAO,EAAE,aAAa,KAAK,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,GAAG,YAAY,CAAC,MAGtF,QAAQ,aAAa,CAAC,MAAM,EAC5B,UAAS,aAAoC,sQA0B5C,CAAA"}
+{"version":3,"file":"NativeGateway.d.ts","sourceRoot":"","sources":["../../../src/internal/NativeGateway.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,WAAW,EAAe,MAAM,iBAAiB,CAAA;AAC1D,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAA;AAEtC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAA;AAE7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAkB,MAAM,oBAAoB,CAAA;AACjE,OAAO,KAAK,aAAa,MAAM,qBAAqB,CAAA;AACpD,OAAO,KAAK,KAAK,aAAa,MAAM,qBAAqB,CAAA;AAEzD;;;;;GAKG;AACH,MAAM,WAAW,aAAc,SAAQ,aAAa;IAClD,0FAA0F;IAC1F,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;IACzD,8DAA8D;IAC9D,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;IACrC,sEAAsE;IACtE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACxC,2FAA2F;IAC3F,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC3C;;;;;;OAMG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7C,uEAAuE;IACvE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACjD,oEAAoE;IACpE,QAAQ,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,cAAc,CAAC,GAAG,SAAS,CAAA;CAChF;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,aAAiD,CAAA;AAEpF;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,GAAI,MAAM,MAAM,KAAG,OAAyD,CAAA;AAEvG;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,WAAW,GAAI,SAAS,aAAa,KAAG,YAAY,GAAG,SA2BnE,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,GAAI,SAAS,aAAa,KAAG,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,CAgB5F,CAAA;AAEJ;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,SAAS,GAAI,SAAS,aAAa,KAAG,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW,CAmBQ,CAAA;AAuB9F;;;;;GAKG;AACH,eAAO,MAAM,eAAe;;;EAAmD,CAAA;AAE/E;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAE,aAAa,CAAC,MAAM,CAMlD,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe;;;EAAmD,CAAA;AAE/E;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,cAAc,GAAI,SAAS,aAAa,KAAG,aAAa,CAAC,cA4BrE,CAAA;AA+BD;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,SAAS,GACpB,QAAQ,CAAC,OAAO,EAAE,aAAa,KAAK,KAAK,CAAC,KAAK,CAAC,UAAU,EAAE,UAAU,GAAG,YAAY,CAAC,MAGtF,QAAQ,aAAa,CAAC,MAAM,EAC5B,UAAS,aAAoC,sQA0B5C,CAAA"}

package/dist/cjs/internal/NativeGateway.js

@@ -42,8 +42,8 @@ __export(NativeGateway_exports, {
 module.exports = __toCommonJS(NativeGateway_exports);
 var import_control = require("@smthrs/control");
 var import_effect = require("effect");
-var import_http = require("effect/unstable/http");
-var import_rpc = require("effect/unstable/rpc");
+var import_http = require("effect/http");
+var import_rpc = require("effect/rpc");
 var import_GatewayError = require("../GatewayError.js");
 var GatewayServer = __toESM(require("../GatewayServer.js"), 1);
 const defaultServerOptions = { host: "127.0.0.1", port: 7331 };

package/dist/cjs/internal/NativeGateway.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/internal/NativeGateway.ts"],
-  "sourcesContent": ["/**\n * Shared native gateway bind policy, credential policy,\n * and the one composition a `smithers serve` verb hosts.\n *\n * Two rules decide whether a bind is allowed, and both fail closed:\n *\n * 1. A non-loopback host requires an explicit `listen` opt-in. Binding\n *    `0.0.0.0` because a port was free is how a workspace gateway ends up on\n *    a shared network by accident.\n * 2. A non-loopback bind requires a bearer credential. The control plane can\n *    launch runs, cancel them, and approve capability grants; reachable from\n *    another machine, an unauthenticated one is a remote execution service.\n *\n * A loopback bind with no network credential allows anonymous reads; approval\n * decisions require the session operator token. Ingress still checks Host and\n * Origin so a web page cannot exercise the loopback endpoint.\n *\n * @since 1.0.0\n */\n\nimport { ControlRpcs, ScopedToken } from \"@smthrs/control\"\nimport { Effect, Layer } from \"effect\"\nimport { HttpRouter } from \"effect/unstable/http\"\nimport type { HttpServer } from \"effect/unstable/http/HttpServer\"\nimport type { ServeError } from \"effect/unstable/http/HttpServerError\"\nimport { RpcSerialization } from \"effect/unstable/rpc\"\nimport type { ListenOptions } from \"node:net\"\nimport { GatewayError, settingRefusal } from \"../GatewayError.ts\"\nimport * as GatewayServer from \"../GatewayServer.ts\"\nimport type * as RuntimeBridge from \"../RuntimeBridge.ts\"\n\n/**\n * Where the gateway binds, and whether a non-loopback bind was asked for.\n *\n * @since 1.0.0\n * @category models\n */\nexport interface ServerOptions extends ListenOptions {\n  /** Additional accepted Host header names (without ports), for network or proxy access. */\n  readonly allowedHosts?: ReadonlyArray<string> | undefined\n  /** The `--listen` opt-in required for a non-loopback host. */\n  readonly listen?: boolean | undefined\n  /** The shared bearer credential, required for a non-loopback bind. */\n  readonly credential?: string | undefined\n  /** Per-session approval token on credential-free loopback. Read calls remain anonymous. */\n  readonly operatorToken?: string | undefined\n  /**\n   * How often an idle followed `Watch` on `/rpc/ws` and an idle followed\n   * `Projection.Subscribe` on `/projections/ws` emit a keepalive frame. Unset,\n   * both run at `Projections.heartbeatIntervalMillis` unless the supplied\n   * `Projections` service was built with its own cadence. A relay with an idle\n   * cut shorter than that one needs a shorter cadence here.\n   */\n  readonly heartbeatMillis?: number | undefined\n  /** Maximum bytes accepted on one HTTP RPC request. Default one MiB. */\n  readonly maxRequestBodyBytes?: number | undefined\n  /** Immutable identity of an opt-in packaged Flow runtime bridge. */\n  readonly runtimeBridge?: Omit<RuntimeBridge.Config, \"authenticate\"> | undefined\n}\n\n/**\n * The default bind: loopback, port 7331, no credential.\n *\n * @since 1.0.0\n * @category models\n */\nexport const defaultServerOptions: ServerOptions = { host: \"127.0.0.1\", port: 7331 }\n\n/**\n * Whether a host names this machine only.\n *\n * @param host the host to classify\n * @since 1.0.0\n * @category predicates\n */\nexport const isLoopbackHost = (host: string): boolean => GatewayServer.loopbackHostNames.includes(host)\n\n/**\n * The typed refusal a requested bind earns, or `undefined` when it is allowed.\n *\n * Every start-time rule this module enforces answers here as a `bind_failed`\n * `GatewayError`, so a host that wants to report a refusal rather than crash on\n * one asks this before it composes a layer. {@link listenOptions} and\n * {@link layer} fail with exactly what this returns.\n *\n * @param options the requested bind\n * @since 1.0.0\n * @category constructors\n */\nexport const bindRefusal = (options: ServerOptions): GatewayError | undefined => {\n  const setting = settingRefusal(\"The gateway keepalive cadence\", options.heartbeatMillis) ??\n    settingRefusal(\"The gateway request body limit\", options.maxRequestBodyBytes)\n  if (setting !== undefined) return setting\n  // The bridge authenticates only with the bearer credential, even on\n  // loopback, so a bridge without one would answer 401 to every request.\n  if (options.runtimeBridge !== undefined && (options.credential === undefined || options.credential === \"\")) {\n    return new GatewayError({\n      code: \"bind_failed\",\n      message: \"Refusing to enable the runtime bridge without a bearer credential\"\n    })\n  }\n  const host = options.host ?? \"127.0.0.1\"\n  if (isLoopbackHost(host)) return undefined\n  if (options.listen !== true) {\n    return new GatewayError({\n      code: \"bind_failed\",\n      message: `Refusing non-loopback gateway bind ${host} without an explicit --listen opt-in`\n    })\n  }\n  if (options.credential === undefined || options.credential === \"\") {\n    return new GatewayError({\n      code: \"bind_failed\",\n      message: `Refusing non-loopback gateway bind ${host} without a bearer credential`\n    })\n  }\n  return undefined\n}\n\n/**\n * Applies the bind policy, returning the admitted Node options or a typed\n * `bind_failed` refusal.\n *\n * @param options the requested bind\n * @since 1.0.0\n * @category constructors\n */\nexport const listenOptions = (options: ServerOptions): Effect.Effect<ListenOptions, GatewayError> =>\n  Effect.suspend(() => {\n    const refusal = bindRefusal(options)\n    if (refusal !== undefined) return Effect.fail(refusal)\n    // `credential`, `listen`, and the keepalive cadence are this module's, not\n    // `node:net`'s: they are named here so the rest is exactly a bind.\n    const {\n      allowedHosts: _allowedHosts,\n      credential: _credential,\n      heartbeatMillis: _cadence,\n      listen: _listen,\n      maxRequestBodyBytes: _maxBody,\n      runtimeBridge: _runtimeBridge,\n      ...node\n    } = options\n    return Effect.succeed({ ...node, host: node.host ?? \"127.0.0.1\" })\n  })\n\n/**\n * The authentication both RPC mounts run under.\n *\n * A configured credential authenticates every request that presents it and\n * stamps the same server-owned principal. A scoped token minted under that\n * credential (`@smthrs/control` `ScopedToken`) authenticates only the\n * procedures, run, or flow it names, until it expires, and stamps\n * {@link scopedPrincipal}. With no credential the composition is\n * loopback-only (see {@link listenOptions}) and every request runs as the\n * anonymous read principal. A session operator token alone stamps the local\n * operator for approval decisions; without it approvals are unauthorized.\n *\n * @param options the requested bind\n * @since 1.0.0\n * @category layers\n */\nexport const layerAuth = (options: ServerOptions): Layer.Layer<ControlRpcs.ControlAuth> =>\n  options.credential === undefined || options.credential === \"\"\n    ? ControlRpcs.layerAuth({\n      authenticate: (headers) => {\n        const token = options.operatorToken\n        if (token === undefined || token === \"\") {\n          return Effect.succeed({ id: \"loopback\", kind: \"anonymous\", stampedAt: 0 })\n        }\n        return ControlRpcs.bearerAuthenticator({\n          token,\n          principal: { id: \"local\", kind: \"operator\" }\n        }).authenticate(headers).pipe(\n          Effect.catchTag(\n            \"/control/Unauthorized\",\n            () => Effect.succeed({ id: \"loopback\", kind: \"anonymous\", stampedAt: 0 })\n          )\n        )\n      }\n    }, gatewayRunVisibility)\n    : ControlRpcs.layerAuth(credentialAuthenticator(options.credential), gatewayRunVisibility)\n\n/**\n * Every identity this gateway stamps reads every run. They all stand for the\n * one operator who holds the gateway's credential, or the machine's loopback\n * user when there is none; a scoped token is that operator's grant, confined\n * by the procedures, run, or flow it names rather than by who launched a run.\n */\nconst gatewayRunVisibility: ControlRpcs.AuthOptions = { seesAllRuns: () => true }\n\n/**\n * The bearer credential itself, or a scoped token minted under it.\n *\n * The runtime bridge deliberately does not use this: it accepts the bearer\n * alone, because a scoped token names control procedures and the bridge's\n * versioned commands are not those.\n */\nconst credentialAuthenticator = (credential: string): ControlRpcs.Authenticator =>\n  ControlRpcs.anyAuthenticator([\n    ControlRpcs.bearerAuthenticator({ token: credential, principal: bearerPrincipal }),\n    ScopedToken.authenticator({ key: credential, principal: scopedPrincipal })\n  ])\n\n/**\n * The identity stamped only after this gateway verifies its configured token.\n * Hosts may explicitly delegate operator decisions to this exact identity.\n * @category constants\n * @since 1.0.0\n */\nexport const bearerPrincipal = Object.freeze({ id: \"gateway\", kind: \"bearer\" })\n\n/**\n * The protected mounts a scoped token may reach: those guarded in band by\n * `ControlAuth`, which checks each frame's procedure against the token, and\n * the ticket exchange that opens their sockets.\n * @category constants\n * @since 1.0.0\n */\nexport const scopedTokenPaths: ReadonlyArray<string> = [\n  \"/rpc\",\n  \"/rpc/ws\",\n  \"/projections\",\n  \"/projections/ws\",\n  \"/auth/ticket\"\n]\n\n/**\n * The identity stamped after this gateway verifies a scoped token minted\n * under its configured credential. It is its own kind so that delegating\n * approval to {@link bearerPrincipal} does not delegate it to every token\n * minted from the bearer; a host that wants a scoped `approve:runs` token to\n * decide delegates to this identity explicitly.\n * @category constants\n * @since 1.0.0\n */\nexport const scopedPrincipal = Object.freeze({ id: \"gateway\", kind: \"scoped\" })\n\n/**\n * The ingress policy a requested bind runs behind.\n *\n * The accepted Host names are the loopback names, the operator's\n * `allowedHosts`, and the concrete bind host itself, so `--host 192.168.1.10`\n * is reachable at that address without naming it twice. A wildcard bind\n * (`0.0.0.0` or `::`) adds nothing: every interface is not a Host name, and\n * the operator names the reachable ones. Protected paths are authenticated\n * before any request body is read.\n *\n * @param options the requested bind\n * @since 1.0.0\n * @category constructors\n */\nexport const ingressOptions = (options: ServerOptions): GatewayServer.IngressOptions => {\n  const maxRequestBodyBytes = options.maxRequestBodyBytes\n  const host = options.host ?? \"127.0.0.1\"\n  const allowedHosts = [...GatewayServer.loopbackHostHeaderNames, ...options.allowedHosts ?? []]\n  const bindAuthority = URL.parse(`http://${host.includes(\":\") ? `[${host}]` : host}`)\n  if (host !== \"0.0.0.0\" && host !== \"::\" && bindAuthority !== null && !allowedHosts.includes(bindAuthority.hostname)) {\n    allowedHosts.push(bindAuthority.hostname)\n  }\n  if (options.credential === undefined || options.credential === \"\") {\n    return {\n      loopbackOnly: true,\n      ...(maxRequestBodyBytes === undefined ? {} : { maxRequestBodyBytes }),\n      allowedHosts\n    }\n  }\n  // The edge knows no call, so a scoped token passes here on its signature\n  // and expiry, and only toward the mounts whose every frame `ControlAuth`\n  // judges in band; journal sync and the runtime bridge take the bearer alone.\n  const bearer = ControlRpcs.bearerAuthenticator({ token: options.credential, principal: bearerPrincipal })\n  const scoped = credentialAuthenticator(options.credential)\n  return {\n    allowedHosts,\n    ...(maxRequestBodyBytes === undefined ? {} : { maxRequestBodyBytes }),\n    authorize: (headers, path) =>\n      (scopedTokenPaths.includes(path) ? scoped : bearer).authenticate(headers).pipe(\n        Effect.match({ onFailure: () => false, onSuccess: () => true })\n      )\n  }\n}\n\nconst bindFailure = (failure: ServeError | GatewayError): GatewayError =>\n  new GatewayError({\n    code: \"bind_failed\",\n    message: \"The gateway socket could not be bound\",\n    cause: { _tag: failure._tag }\n  })\n\n/**\n * Fails the layer with the sanitized refusal every bearer holder may see, after\n * logging the operator's copy: the requested authority and the operating-system\n * cause (`EADDRINUSE`, `EACCES`, `EADDRNOTAVAIL`), which the wire error omits.\n */\nconst mapServeError = <A, R>(\n  bind: ListenOptions,\n  server: Layer.Layer<A, ServeError | GatewayError, R>\n): Layer.Layer<A, GatewayError, R> =>\n  server.pipe(\n    Layer.catch((failure) =>\n      Layer.effectContext<A, GatewayError, never>(\n        Effect.logError({\n          message: \"The gateway socket could not be bound\",\n          host: bind.host,\n          port: bind.port,\n          cause: failure\n        }).pipe(Effect.andThen(Effect.fail(bindFailure(failure))))\n      )\n    )\n  )\n\n/**\n * Hosts the assembled gateway on an injected native HTTP server.\n *\n * Supplies the bind policy, the shared-credential authentication both RPC\n * mounts run under, and newline-delimited JSON as the wire serialization. The\n * caller supplies what the mounts read through: `Control`, `Projections`,\n * `SyncServer`, and the `SyncAuth` middleware.\n *\n * The returned layer retains the concrete `HttpServer` service, so a caller\n * that bound port 0 can read the ephemeral address it got.\n *\n * Policy refusals and operating-system listen failures both fail the layer as\n * sanitized `bind_failed` `GatewayError` values.\n *\n * @param health the identity `GET /health` answers with\n * @param options the requested bind\n * @since 1.0.0\n * @category layers\n */\nexport const makeLayer = (\n  server: (options: ListenOptions) => Layer.Layer<HttpServer, ServeError | GatewayError>\n) =>\n(\n  health: GatewayServer.Health,\n  options: ServerOptions = defaultServerOptions\n) =>\n  Layer.unwrap(\n    Effect.map(listenOptions(options), (nodeOptions) =>\n      HttpRouter.serve(\n        GatewayServer.layer(health, {\n          ...(options.heartbeatMillis === undefined ? {} : { heartbeatMillis: options.heartbeatMillis }),\n          ingress: ingressOptions(options),\n          ...(options.runtimeBridge === undefined ? {} : {\n            runtimeBridge: {\n              ...options.runtimeBridge,\n              authenticate: ControlRpcs.bearerAuthenticator({\n                // listenOptions rejects a runtime bridge without a credential.\n                token: options.credential!,\n                principal: bearerPrincipal\n              }).authenticate\n            }\n          })\n        }).pipe(\n          Layer.provide(layerAuth(options)),\n          Layer.provide(RpcSerialization.layerNdjson)\n        ),\n        { disableListenLog: true, disableLogger: true }\n      ).pipe(\n        Layer.provideMerge(mapServeError(nodeOptions, server(nodeOptions)))\n      ))\n  )\n"],
+  "sourcesContent": ["/**\n * Shared native gateway bind policy, credential policy,\n * and the one composition a `smithers serve` verb hosts.\n *\n * Two rules decide whether a bind is allowed, and both fail closed:\n *\n * 1. A non-loopback host requires an explicit `listen` opt-in. Binding\n *    `0.0.0.0` because a port was free is how a workspace gateway ends up on\n *    a shared network by accident.\n * 2. A non-loopback bind requires a bearer credential. The control plane can\n *    launch runs, cancel them, and approve capability grants; reachable from\n *    another machine, an unauthenticated one is a remote execution service.\n *\n * A loopback bind with no network credential allows anonymous reads; approval\n * decisions require the session operator token. Ingress still checks Host and\n * Origin so a web page cannot exercise the loopback endpoint.\n *\n * @since 1.0.0\n */\n\nimport { ControlRpcs, ScopedToken } from \"@smthrs/control\"\nimport { Effect, Layer } from \"effect\"\nimport { HttpRouter } from \"effect/http\"\nimport type { HttpServer } from \"effect/http/HttpServer\"\nimport type { ServeError } from \"effect/http/HttpServerError\"\nimport { RpcSerialization } from \"effect/rpc\"\nimport type { ListenOptions } from \"node:net\"\nimport { GatewayError, settingRefusal } from \"../GatewayError.ts\"\nimport * as GatewayServer from \"../GatewayServer.ts\"\nimport type * as RuntimeBridge from \"../RuntimeBridge.ts\"\n\n/**\n * Where the gateway binds, and whether a non-loopback bind was asked for.\n *\n * @since 1.0.0\n * @category models\n */\nexport interface ServerOptions extends ListenOptions {\n  /** Additional accepted Host header names (without ports), for network or proxy access. */\n  readonly allowedHosts?: ReadonlyArray<string> | undefined\n  /** The `--listen` opt-in required for a non-loopback host. */\n  readonly listen?: boolean | undefined\n  /** The shared bearer credential, required for a non-loopback bind. */\n  readonly credential?: string | undefined\n  /** Per-session approval token on credential-free loopback. Read calls remain anonymous. */\n  readonly operatorToken?: string | undefined\n  /**\n   * How often an idle followed `Watch` on `/rpc/ws` and an idle followed\n   * `Projection.Subscribe` on `/projections/ws` emit a keepalive frame. Unset,\n   * both run at `Projections.heartbeatIntervalMillis` unless the supplied\n   * `Projections` service was built with its own cadence. A relay with an idle\n   * cut shorter than that one needs a shorter cadence here.\n   */\n  readonly heartbeatMillis?: number | undefined\n  /** Maximum bytes accepted on one HTTP RPC request. Default one MiB. */\n  readonly maxRequestBodyBytes?: number | undefined\n  /** Immutable identity of an opt-in packaged Flow runtime bridge. */\n  readonly runtimeBridge?: Omit<RuntimeBridge.Config, \"authenticate\"> | undefined\n}\n\n/**\n * The default bind: loopback, port 7331, no credential.\n *\n * @since 1.0.0\n * @category models\n */\nexport const defaultServerOptions: ServerOptions = { host: \"127.0.0.1\", port: 7331 }\n\n/**\n * Whether a host names this machine only.\n *\n * @param host the host to classify\n * @since 1.0.0\n * @category predicates\n */\nexport const isLoopbackHost = (host: string): boolean => GatewayServer.loopbackHostNames.includes(host)\n\n/**\n * The typed refusal a requested bind earns, or `undefined` when it is allowed.\n *\n * Every start-time rule this module enforces answers here as a `bind_failed`\n * `GatewayError`, so a host that wants to report a refusal rather than crash on\n * one asks this before it composes a layer. {@link listenOptions} and\n * {@link layer} fail with exactly what this returns.\n *\n * @param options the requested bind\n * @since 1.0.0\n * @category constructors\n */\nexport const bindRefusal = (options: ServerOptions): GatewayError | undefined => {\n  const setting = settingRefusal(\"The gateway keepalive cadence\", options.heartbeatMillis) ??\n    settingRefusal(\"The gateway request body limit\", options.maxRequestBodyBytes)\n  if (setting !== undefined) return setting\n  // The bridge authenticates only with the bearer credential, even on\n  // loopback, so a bridge without one would answer 401 to every request.\n  if (options.runtimeBridge !== undefined && (options.credential === undefined || options.credential === \"\")) {\n    return new GatewayError({\n      code: \"bind_failed\",\n      message: \"Refusing to enable the runtime bridge without a bearer credential\"\n    })\n  }\n  const host = options.host ?? \"127.0.0.1\"\n  if (isLoopbackHost(host)) return undefined\n  if (options.listen !== true) {\n    return new GatewayError({\n      code: \"bind_failed\",\n      message: `Refusing non-loopback gateway bind ${host} without an explicit --listen opt-in`\n    })\n  }\n  if (options.credential === undefined || options.credential === \"\") {\n    return new GatewayError({\n      code: \"bind_failed\",\n      message: `Refusing non-loopback gateway bind ${host} without a bearer credential`\n    })\n  }\n  return undefined\n}\n\n/**\n * Applies the bind policy, returning the admitted Node options or a typed\n * `bind_failed` refusal.\n *\n * @param options the requested bind\n * @since 1.0.0\n * @category constructors\n */\nexport const listenOptions = (options: ServerOptions): Effect.Effect<ListenOptions, GatewayError> =>\n  Effect.suspend(() => {\n    const refusal = bindRefusal(options)\n    if (refusal !== undefined) return Effect.fail(refusal)\n    // `credential`, `listen`, and the keepalive cadence are this module's, not\n    // `node:net`'s: they are named here so the rest is exactly a bind.\n    const {\n      allowedHosts: _allowedHosts,\n      credential: _credential,\n      heartbeatMillis: _cadence,\n      listen: _listen,\n      maxRequestBodyBytes: _maxBody,\n      runtimeBridge: _runtimeBridge,\n      ...node\n    } = options\n    return Effect.succeed({ ...node, host: node.host ?? \"127.0.0.1\" })\n  })\n\n/**\n * The authentication both RPC mounts run under.\n *\n * A configured credential authenticates every request that presents it and\n * stamps the same server-owned principal. A scoped token minted under that\n * credential (`@smthrs/control` `ScopedToken`) authenticates only the\n * procedures, run, or flow it names, until it expires, and stamps\n * {@link scopedPrincipal}. With no credential the composition is\n * loopback-only (see {@link listenOptions}) and every request runs as the\n * anonymous read principal. A session operator token alone stamps the local\n * operator for approval decisions; without it approvals are unauthorized.\n *\n * @param options the requested bind\n * @since 1.0.0\n * @category layers\n */\nexport const layerAuth = (options: ServerOptions): Layer.Layer<ControlRpcs.ControlAuth> =>\n  options.credential === undefined || options.credential === \"\"\n    ? ControlRpcs.layerAuth({\n      authenticate: (headers) => {\n        const token = options.operatorToken\n        if (token === undefined || token === \"\") {\n          return Effect.succeed({ id: \"loopback\", kind: \"anonymous\", stampedAt: 0 })\n        }\n        return ControlRpcs.bearerAuthenticator({\n          token,\n          principal: { id: \"local\", kind: \"operator\" }\n        }).authenticate(headers).pipe(\n          Effect.catchTag(\n            \"/control/Unauthorized\",\n            () => Effect.succeed({ id: \"loopback\", kind: \"anonymous\", stampedAt: 0 })\n          )\n        )\n      }\n    }, gatewayRunVisibility)\n    : ControlRpcs.layerAuth(credentialAuthenticator(options.credential), gatewayRunVisibility)\n\n/**\n * Every identity this gateway stamps reads every run. They all stand for the\n * one operator who holds the gateway's credential, or the machine's loopback\n * user when there is none; a scoped token is that operator's grant, confined\n * by the procedures, run, or flow it names rather than by who launched a run.\n */\nconst gatewayRunVisibility: ControlRpcs.AuthOptions = { seesAllRuns: () => true }\n\n/**\n * The bearer credential itself, or a scoped token minted under it.\n *\n * The runtime bridge deliberately does not use this: it accepts the bearer\n * alone, because a scoped token names control procedures and the bridge's\n * versioned commands are not those.\n */\nconst credentialAuthenticator = (credential: string): ControlRpcs.Authenticator =>\n  ControlRpcs.anyAuthenticator([\n    ControlRpcs.bearerAuthenticator({ token: credential, principal: bearerPrincipal }),\n    ScopedToken.authenticator({ key: credential, principal: scopedPrincipal })\n  ])\n\n/**\n * The identity stamped only after this gateway verifies its configured token.\n * Hosts may explicitly delegate operator decisions to this exact identity.\n * @category constants\n * @since 1.0.0\n */\nexport const bearerPrincipal = Object.freeze({ id: \"gateway\", kind: \"bearer\" })\n\n/**\n * The protected mounts a scoped token may reach: those guarded in band by\n * `ControlAuth`, which checks each frame's procedure against the token, and\n * the ticket exchange that opens their sockets.\n * @category constants\n * @since 1.0.0\n */\nexport const scopedTokenPaths: ReadonlyArray<string> = [\n  \"/rpc\",\n  \"/rpc/ws\",\n  \"/projections\",\n  \"/projections/ws\",\n  \"/auth/ticket\"\n]\n\n/**\n * The identity stamped after this gateway verifies a scoped token minted\n * under its configured credential. It is its own kind so that delegating\n * approval to {@link bearerPrincipal} does not delegate it to every token\n * minted from the bearer; a host that wants a scoped `approve:runs` token to\n * decide delegates to this identity explicitly.\n * @category constants\n * @since 1.0.0\n */\nexport const scopedPrincipal = Object.freeze({ id: \"gateway\", kind: \"scoped\" })\n\n/**\n * The ingress policy a requested bind runs behind.\n *\n * The accepted Host names are the loopback names, the operator's\n * `allowedHosts`, and the concrete bind host itself, so `--host 192.168.1.10`\n * is reachable at that address without naming it twice. A wildcard bind\n * (`0.0.0.0` or `::`) adds nothing: every interface is not a Host name, and\n * the operator names the reachable ones. Protected paths are authenticated\n * before any request body is read.\n *\n * @param options the requested bind\n * @since 1.0.0\n * @category constructors\n */\nexport const ingressOptions = (options: ServerOptions): GatewayServer.IngressOptions => {\n  const maxRequestBodyBytes = options.maxRequestBodyBytes\n  const host = options.host ?? \"127.0.0.1\"\n  const allowedHosts = [...GatewayServer.loopbackHostHeaderNames, ...options.allowedHosts ?? []]\n  const bindAuthority = URL.parse(`http://${host.includes(\":\") ? `[${host}]` : host}`)\n  if (host !== \"0.0.0.0\" && host !== \"::\" && bindAuthority !== null && !allowedHosts.includes(bindAuthority.hostname)) {\n    allowedHosts.push(bindAuthority.hostname)\n  }\n  if (options.credential === undefined || options.credential === \"\") {\n    return {\n      loopbackOnly: true,\n      ...(maxRequestBodyBytes === undefined ? {} : { maxRequestBodyBytes }),\n      allowedHosts\n    }\n  }\n  // The edge knows no call, so a scoped token passes here on its signature\n  // and expiry, and only toward the mounts whose every frame `ControlAuth`\n  // judges in band; journal sync and the runtime bridge take the bearer alone.\n  const bearer = ControlRpcs.bearerAuthenticator({ token: options.credential, principal: bearerPrincipal })\n  const scoped = credentialAuthenticator(options.credential)\n  return {\n    allowedHosts,\n    ...(maxRequestBodyBytes === undefined ? {} : { maxRequestBodyBytes }),\n    authorize: (headers, path) =>\n      (scopedTokenPaths.includes(path) ? scoped : bearer).authenticate(headers).pipe(\n        Effect.match({ onFailure: () => false, onSuccess: () => true })\n      )\n  }\n}\n\nconst bindFailure = (failure: ServeError | GatewayError): GatewayError =>\n  new GatewayError({\n    code: \"bind_failed\",\n    message: \"The gateway socket could not be bound\",\n    cause: { _tag: failure._tag }\n  })\n\n/**\n * Fails the layer with the sanitized refusal every bearer holder may see, after\n * logging the operator's copy: the requested authority and the operating-system\n * cause (`EADDRINUSE`, `EACCES`, `EADDRNOTAVAIL`), which the wire error omits.\n */\nconst mapServeError = <A, R>(\n  bind: ListenOptions,\n  server: Layer.Layer<A, ServeError | GatewayError, R>\n): Layer.Layer<A, GatewayError, R> =>\n  server.pipe(\n    Layer.catch((failure) =>\n      Layer.effectContext<A, GatewayError, never>(\n        Effect.logError({\n          message: \"The gateway socket could not be bound\",\n          host: bind.host,\n          port: bind.port,\n          cause: failure\n        }).pipe(Effect.andThen(Effect.fail(bindFailure(failure))))\n      )\n    )\n  )\n\n/**\n * Hosts the assembled gateway on an injected native HTTP server.\n *\n * Supplies the bind policy, the shared-credential authentication both RPC\n * mounts run under, and newline-delimited JSON as the wire serialization. The\n * caller supplies what the mounts read through: `Control`, `Projections`,\n * `SyncServer`, and the `SyncAuth` middleware.\n *\n * The returned layer retains the concrete `HttpServer` service, so a caller\n * that bound port 0 can read the ephemeral address it got.\n *\n * Policy refusals and operating-system listen failures both fail the layer as\n * sanitized `bind_failed` `GatewayError` values.\n *\n * @param health the identity `GET /health` answers with\n * @param options the requested bind\n * @since 1.0.0\n * @category layers\n */\nexport const makeLayer = (\n  server: (options: ListenOptions) => Layer.Layer<HttpServer, ServeError | GatewayError>\n) =>\n(\n  health: GatewayServer.Health,\n  options: ServerOptions = defaultServerOptions\n) =>\n  Layer.unwrap(\n    Effect.map(listenOptions(options), (nodeOptions) =>\n      HttpRouter.serve(\n        GatewayServer.layer(health, {\n          ...(options.heartbeatMillis === undefined ? {} : { heartbeatMillis: options.heartbeatMillis }),\n          ingress: ingressOptions(options),\n          ...(options.runtimeBridge === undefined ? {} : {\n            runtimeBridge: {\n              ...options.runtimeBridge,\n              authenticate: ControlRpcs.bearerAuthenticator({\n                // listenOptions rejects a runtime bridge without a credential.\n                token: options.credential!,\n                principal: bearerPrincipal\n              }).authenticate\n            }\n          })\n        }).pipe(\n          Layer.provide(layerAuth(options)),\n          Layer.provide(RpcSerialization.layerNdjson)\n        ),\n        { disableListenLog: true, disableLogger: true }\n      ).pipe(\n        Layer.provideMerge(mapServeError(nodeOptions, server(nodeOptions)))\n      ))\n  )\n"],
   "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAoBA,qBAAyC;AACzC,oBAA8B;AAC9B,kBAA2B;AAG3B,iBAAiC;AAEjC,0BAA6C;AAC7C,oBAA+B;AAsCxB,MAAM,uBAAsC,EAAE,MAAM,aAAa,MAAM,KAAK;AAS5E,MAAM,iBAAiB,CAAC,SAA0B,cAAc,kBAAkB,SAAS,IAAI;AAc/F,MAAM,cAAc,CAAC,YAAqD;AAC/E,QAAM,cAAU,oCAAe,iCAAiC,QAAQ,eAAe,SACrF,oCAAe,kCAAkC,QAAQ,mBAAmB;AAC9E,MAAI,YAAY,OAAW,QAAO;AAGlC,MAAI,QAAQ,kBAAkB,WAAc,QAAQ,eAAe,UAAa,QAAQ,eAAe,KAAK;AAC1G,WAAO,IAAI,iCAAa;AAAA,MACtB,MAAM;AAAA,MACN,SAAS;AAAA,IACX,CAAC;AAAA,EACH;AACA,QAAM,OAAO,QAAQ,QAAQ;AAC7B,MAAI,eAAe,IAAI,EAAG,QAAO;AACjC,MAAI,QAAQ,WAAW,MAAM;AAC3B,WAAO,IAAI,iCAAa;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,sCAAsC,IAAI;AAAA,IACrD,CAAC;AAAA,EACH;AACA,MAAI,QAAQ,eAAe,UAAa,QAAQ,eAAe,IAAI;AACjE,WAAO,IAAI,iCAAa;AAAA,MACtB,MAAM;AAAA,MACN,SAAS,sCAAsC,IAAI;AAAA,IACrD,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAUO,MAAM,gBAAgB,CAAC,YAC5B,qBAAO,QAAQ,MAAM;AACnB,QAAM,UAAU,YAAY,OAAO;AACnC,MAAI,YAAY,OAAW,QAAO,qBAAO,KAAK,OAAO;AAGrD,QAAM;AAAA,IACJ,cAAc;AAAA,IACd,YAAY;AAAA,IACZ,iBAAiB;AAAA,IACjB,QAAQ;AAAA,IACR,qBAAqB;AAAA,IACrB,eAAe;AAAA,IACf,GAAG;AAAA,EACL,IAAI;AACJ,SAAO,qBAAO,QAAQ,EAAE,GAAG,MAAM,MAAM,KAAK,QAAQ,YAAY,CAAC;AACnE,CAAC;AAkBI,MAAM,YAAY,CAAC,YACxB,QAAQ,eAAe,UAAa,QAAQ,eAAe,KACvD,2BAAY,UAAU;AAAA,EACtB,cAAc,CAAC,YAAY;AACzB,UAAM,QAAQ,QAAQ;AACtB,QAAI,UAAU,UAAa,UAAU,IAAI;AACvC,aAAO,qBAAO,QAAQ,EAAE,IAAI,YAAY,MAAM,aAAa,WAAW,EAAE,CAAC;AAAA,IAC3E;AACA,WAAO,2BAAY,oBAAoB;AAAA,MACrC;AAAA,MACA,WAAW,EAAE,IAAI,SAAS,MAAM,WAAW;AAAA,IAC7C,CAAC,EAAE,aAAa,OAAO,EAAE;AAAA,MACvB,qBAAO;AAAA,QACL;AAAA,QACA,MAAM,qBAAO,QAAQ,EAAE,IAAI,YAAY,MAAM,aAAa,WAAW,EAAE,CAAC;AAAA,MAC1E;AAAA,IACF;AAAA,EACF;AACF,GAAG,oBAAoB,IACrB,2BAAY,UAAU,wBAAwB,QAAQ,UAAU,GAAG,oBAAoB;AAQ7F,MAAM,uBAAgD,EAAE,aAAa,MAAM,KAAK;AAShF,MAAM,0BAA0B,CAAC,eAC/B,2BAAY,iBAAiB;AAAA,EAC3B,2BAAY,oBAAoB,EAAE,OAAO,YAAY,WAAW,gBAAgB,CAAC;AAAA,EACjF,2BAAY,cAAc,EAAE,KAAK,YAAY,WAAW,gBAAgB,CAAC;AAC3E,CAAC;AAQI,MAAM,kBAAkB,OAAO,OAAO,EAAE,IAAI,WAAW,MAAM,SAAS,CAAC;AASvE,MAAM,mBAA0C;AAAA,EACrD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAWO,MAAM,kBAAkB,OAAO,OAAO,EAAE,IAAI,WAAW,MAAM,SAAS,CAAC;AAgBvE,MAAM,iBAAiB,CAAC,YAAyD;AACtF,QAAM,sBAAsB,QAAQ;AACpC,QAAM,OAAO,QAAQ,QAAQ;AAC7B,QAAM,eAAe,CAAC,GAAG,cAAc,yBAAyB,GAAG,QAAQ,gBAAgB,CAAC,CAAC;AAC7F,QAAM,gBAAgB,IAAI,MAAM,UAAU,KAAK,SAAS,GAAG,IAAI,IAAI,IAAI,MAAM,IAAI,EAAE;AACnF,MAAI,SAAS,aAAa,SAAS,QAAQ,kBAAkB,QAAQ,CAAC,aAAa,SAAS,cAAc,QAAQ,GAAG;AACnH,iBAAa,KAAK,cAAc,QAAQ;AAAA,EAC1C;AACA,MAAI,QAAQ,eAAe,UAAa,QAAQ,eAAe,IAAI;AACjE,WAAO;AAAA,MACL,cAAc;AAAA,MACd,GAAI,wBAAwB,SAAY,CAAC,IAAI,EAAE,oBAAoB;AAAA,MACnE;AAAA,IACF;AAAA,EACF;AAIA,QAAM,SAAS,2BAAY,oBAAoB,EAAE,OAAO,QAAQ,YAAY,WAAW,gBAAgB,CAAC;AACxG,QAAM,SAAS,wBAAwB,QAAQ,UAAU;AACzD,SAAO;AAAA,IACL;AAAA,IACA,GAAI,wBAAwB,SAAY,CAAC,IAAI,EAAE,oBAAoB;AAAA,IACnE,WAAW,CAAC,SAAS,UAClB,iBAAiB,SAAS,IAAI,IAAI,SAAS,QAAQ,aAAa,OAAO,EAAE;AAAA,MACxE,qBAAO,MAAM,EAAE,WAAW,MAAM,OAAO,WAAW,MAAM,KAAK,CAAC;AAAA,IAChE;AAAA,EACJ;AACF;AAEA,MAAM,cAAc,CAAC,YACnB,IAAI,iCAAa;AAAA,EACf,MAAM;AAAA,EACN,SAAS;AAAA,EACT,OAAO,EAAE,MAAM,QAAQ,KAAK;AAC9B,CAAC;AAOH,MAAM,gBAAgB,CACpB,MACA,WAEA,OAAO;AAAA,EACL,oBAAM;AAAA,IAAM,CAAC,YACX,oBAAM;AAAA,MACJ,qBAAO,SAAS;AAAA,QACd,SAAS;AAAA,QACT,MAAM,KAAK;AAAA,QACX,MAAM,KAAK;AAAA,QACX,OAAO;AAAA,MACT,CAAC,EAAE,KAAK,qBAAO,QAAQ,qBAAO,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC;AAAA,IAC3D;AAAA,EACF;AACF;AAqBK,MAAM,YAAY,CACvB,WAEF,CACE,QACA,UAAyB,yBAEzB,oBAAM;AAAA,EACJ,qBAAO,IAAI,cAAc,OAAO,GAAG,CAAC,gBAClC,uBAAW;AAAA,IACT,cAAc,MAAM,QAAQ;AAAA,MAC1B,GAAI,QAAQ,oBAAoB,SAAY,CAAC,IAAI,EAAE,iBAAiB,QAAQ,gBAAgB;AAAA,MAC5F,SAAS,eAAe,OAAO;AAAA,MAC/B,GAAI,QAAQ,kBAAkB,SAAY,CAAC,IAAI;AAAA,QAC7C,eAAe;AAAA,UACb,GAAG,QAAQ;AAAA,UACX,cAAc,2BAAY,oBAAoB;AAAA;AAAA,YAE5C,OAAO,QAAQ;AAAA,YACf,WAAW;AAAA,UACb,CAAC,EAAE;AAAA,QACL;AAAA,MACF;AAAA,IACF,CAAC,EAAE;AAAA,MACD,oBAAM,QAAQ,UAAU,OAAO,CAAC;AAAA,MAChC,oBAAM,QAAQ,4BAAiB,WAAW;AAAA,IAC5C;AAAA,IACA,EAAE,kBAAkB,MAAM,eAAe,KAAK;AAAA,EAChD,EAAE;AAAA,IACA,oBAAM,aAAa,cAAc,aAAa,OAAO,WAAW,CAAC,CAAC;AAAA,EACpE,CAAC;AACL;",
   "names": []
 }

package/dist/cjs/node/NodeGateway.d.ts

@@ -12,5 +12,5 @@ export type ServerOptions = NativeGateway.ServerOptions;
  * @since 1.0.0
  * @category layers
  */
-export declare const layer: (health: import("../GatewayServer.ts").Health, options?: NativeGateway.ServerOptions) => import("effect/Layer").Layer<import("effect/unstable/http/HttpServer").HttpServer, import("../GatewayError.ts").GatewayError | import("@smthrs/sync/SyncError").SyncError, import("@smthrs/control/Control").Control | import("@smthrs/sync/SyncRpcs").SyncAuth | import("@smthrs/sync/SyncServer").SyncServer | import("../Projections.ts").Projections>;
+export declare const layer: (health: import("../GatewayServer.ts").Health, options?: NativeGateway.ServerOptions) => import("effect/Layer").Layer<import("effect/http/HttpServer").HttpServer, import("../GatewayError.ts").GatewayError | import("@smthrs/sync/SyncError").SyncError, import("@smthrs/control/Control").Control | import("@smthrs/sync/SyncRpcs").SyncAuth | import("@smthrs/sync/SyncServer").SyncServer | import("../Projections.ts").Projections>;
 //# sourceMappingURL=NodeGateway.d.ts.map

package/dist/cjs/node/NodeGateway.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"NodeGateway.d.ts","sourceRoot":"","sources":["../../../src/node/NodeGateway.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,KAAK,aAAa,MAAM,8BAA8B,CAAA;AAE7D,OAAO,EACL,eAAe,EACf,WAAW,EACX,oBAAoB,EACpB,cAAc,EACd,cAAc,EACd,SAAS,EACT,aAAa,EACb,eAAe,EACf,gBAAgB,EACjB,MAAM,8BAA8B,CAAA;AACrC;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,aAAa,CAAC,aAAa,CAAA;AAEvD;;;GAGG;AACH,eAAO,MAAM,KAAK,obAAoF,CAAA"}
+{"version":3,"file":"NodeGateway.d.ts","sourceRoot":"","sources":["../../../src/node/NodeGateway.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,KAAK,aAAa,MAAM,8BAA8B,CAAA;AAE7D,OAAO,EACL,eAAe,EACf,WAAW,EACX,oBAAoB,EACpB,cAAc,EACd,cAAc,EACd,SAAS,EACT,aAAa,EACb,eAAe,EACf,gBAAgB,EACjB,MAAM,8BAA8B,CAAA;AACrC;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,aAAa,CAAC,aAAa,CAAA;AAEvD;;;GAGG;AACH,eAAO,MAAM,KAAK,2aAAoF,CAAA"}

package/dist/esm/GatewayRpcs.d.ts

@@ -15,7 +15,7 @@
  */
 import { ControlError, ControlRpcs } from "@smthrs/control";
 import { Schema } from "effect";
-import { Rpc, RpcGroup } from "effect/unstable/rpc";
+import { Rpc, RpcGroup } from "effect/rpc";
 import { GatewayError } from "./GatewayError.ts";
 import * as RunHistory from "./RunHistory.ts";
 /**
@@ -720,7 +720,7 @@ export declare const GatewayRpcs: RpcGroup.RpcGroup<Rpc.Rpc<"Projection.Snapshot
         readonly value: Schema.Int;
         readonly offset: Schema.Int;
     }>>;
-}>, import("effect/unstable/rpc/RpcSchema").Stream<Schema.Union<readonly [Schema.TaggedStruct<"snapshot-start", {
+}>, import("effect/rpc/RpcSchema").Stream<Schema.Union<readonly [Schema.TaggedStruct<"snapshot-start", {
     readonly selector: Schema.Union<readonly [Schema.TaggedStruct<"workspace-runs", {
         readonly flowId: Schema.optionalKey<Schema.NonEmptyString>;
     }>, Schema.TaggedStruct<"run-summary", {

package/dist/esm/GatewayRpcs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"GatewayRpcs.d.ts","sourceRoot":"","sources":["../../src/GatewayRpcs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,YAAY,EAAE,WAAW,EAAiB,MAAM,iBAAiB,CAAA;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/B,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAEhD,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAA;AAE7C;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,+CAAuC,CAAA;AAE5D;;;;;GAKG;AACH,MAAM,MAAM,QAAQ,GAAG,OAAO,QAAQ,CAAC,IAAI,CAAA;AAE3C;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB;;IAG9B;;;;;;;;;;;;OAYG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEH,CAAA;AAEF;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,OAAO,mBAAmB,CAAC,IAAI,CAAA;AAEjE;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;EAE/B,CAAA;AAEF;;;;;GAKG;AACH,MAAM,MAAM,oBAAoB,GAAG,OAAO,oBAAoB,CAAC,IAAI,CAAA;AAoCnE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA1FtB;;;;;;;;;;;;OAYG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yKAsHgC,CAAA"}
+{"version":3,"file":"GatewayRpcs.d.ts","sourceRoot":"","sources":["../../src/GatewayRpcs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,YAAY,EAAE,WAAW,EAAiB,MAAM,iBAAiB,CAAA;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/B,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAEhD,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAA;AAE7C;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,+CAAuC,CAAA;AAE5D;;;;;GAKG;AACH,MAAM,MAAM,QAAQ,GAAG,OAAO,QAAQ,CAAC,IAAI,CAAA;AAE3C;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB;;IAG9B;;;;;;;;;;;;OAYG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAEH,CAAA;AAEF;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,OAAO,mBAAmB,CAAC,IAAI,CAAA;AAEjE;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;EAE/B,CAAA;AAEF;;;;;GAKG;AACH,MAAM,MAAM,oBAAoB,GAAG,OAAO,oBAAoB,CAAC,IAAI,CAAA;AAoCnE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA1FtB;;;;;;;;;;;;OAYG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yKAsHgC,CAAA"}

package/dist/esm/GatewayRpcs.js

@@ -15,7 +15,7 @@
  */
 import { ControlError, ControlRpcs, ControlSchema } from "@smthrs/control";
 import { Schema } from "effect";
-import { Rpc, RpcGroup } from "effect/unstable/rpc";
+import { Rpc, RpcGroup } from "effect/rpc";
 import { GatewayError } from "./GatewayError.js";
 import * as GatewaySchema from "./GatewaySchema.js";
 import * as RunHistory from "./RunHistory.js";

package/dist/esm/GatewayRpcs.js.map

@@ -1 +1 @@
-{"version":3,"file":"GatewayRpcs.js","sourceRoot":"","sources":["../../src/GatewayRpcs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/B,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AACnD,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAA;AAE7C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAA;AAU5D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/C,GAAG,aAAa,CAAC,eAAe,CAAC,MAAM;IACvC,QAAQ,EAAE,QAAQ;IAClB;;;;;;;;;;;;OAYG;IACH,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;CACrC,CAAC,CAAA;AAUF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC;IAChD,QAAQ,EAAE,aAAa,CAAC,OAAO;CAChC,CAAC,CAAA;AAUF;;;;;;;;;;;GAWG;AACH,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC;IAChC,YAAY,CAAC,cAAc;IAC3B,YAAY,CAAC,SAAS;IACtB,YAAY,CAAC,kBAAkB;IAC/B,YAAY,CAAC,gBAAgB;IAC7B,YAAY,CAAC,eAAe;IAC5B,YAAY,CAAC,YAAY;IACzB,YAAY,CAAC,WAAW;IACxB,YAAY,CAAC,YAAY;IACzB,YAAY,CAAC,YAAY;IACzB,YAAY,CAAC,gBAAgB;IAC7B,YAAY,CAAC,WAAW;IACxB,YAAY,CAAC,cAAc;CAC5B,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,cAAc,EAAE,YAAY,CAAC,YAAY,EAAE,YAAY,CAAC,WAAW,CAAC,CAAC,CAAA;AAEpH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CACtC,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE;IAC9B,MAAM,EAAE,WAAW,CAAC,aAAa;IACjC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;QACrB,QAAQ,EAAE,aAAa,CAAC,kBAAkB;QAC1C,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,gBAAgB,CAAC;KACvD,CAAC;IACF,OAAO,EAAE,aAAa,CAAC,kBAAkB;IACzC,KAAK,EAAE,YAAY;CACpB,CAAC,EACF,GAAG,CAAC,IAAI,CAAC,sBAAsB,EAAE;IAC/B,MAAM,EAAE,WAAW,CAAC,aAAa;IACjC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;QACrB,QAAQ,EAAE,aAAa,CAAC,kBAAkB;QAC1C,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,gBAAgB,CAAC;KACvD,CAAC;IACF,OAAO,EAAE,aAAa,CAAC,YAAY;IACnC,KAAK,EAAE,YAAY;IACnB,MAAM,EAAE,IAAI;CACb,CAAC,EACF,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE;IAC1B,MAAM,EAAE,WAAW,CAAC,aAAa;IACjC,OAAO,EAAE,mBAAmB;IAC5B,OAAO,EAAE,oBAAoB;IAC7B,KAAK,EAAE,YAAY;CACpB,CAAC;AACF,oFAAoF;AACpF,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE;IACnB,MAAM,EAAE,WAAW,CAAC,aAAa;IACjC,OAAO,EAAE,UAAU,CAAC,SAAS;IAC7B,OAAO,EAAE,UAAU,CAAC,UAAU;IAC9B,KAAK,EAAE,aAAa;CACrB,CAAC;AACF,8FAA8F;AAC9F,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE;IACrB,MAAM,EAAE,WAAW,CAAC,aAAa;IACjC,OAAO,EAAE,UAAU,CAAC,WAAW;IAC/B,OAAO,EAAE,UAAU,CAAC,YAAY;IAChC,KAAK,EAAE,aAAa;CACrB,CAAC,CACH,CAAC,UAAU,CAAC,WAAW,CAAC,WAAW,CAAC,CAAA","sourcesContent":["/**\n * The gateway's own remote procedures: the served read path, and the one\n * composite mutation a product client cannot assemble safely on its own.\n *\n * Control mutations are not re-declared here. `@smthrs/control` `ControlRpcs`\n * is the mutation contract and the gateway mounts it unchanged at `/rpc`, so\n * there is exactly one wire definition of `Plan`, `Run`, `Approve`, `Deny`,\n * `Cancel`, `Signal`, `Steer`, `Resume`, `List`, and `Watch`.\n *\n * The group shares `ControlRpcs.ControlAuth`, so one bearer credential\n * authenticates both mounts and one server-stamped principal is recorded for\n * whatever it authorizes.\n *\n * @since 1.0.0\n */\n\nimport { ControlError, ControlRpcs, ControlSchema } from \"@smthrs/control\"\nimport { Schema } from \"effect\"\nimport { Rpc, RpcGroup } from \"effect/unstable/rpc\"\nimport { GatewayError } from \"./GatewayError.ts\"\nimport * as GatewaySchema from \"./GatewaySchema.ts\"\nimport * as RunHistory from \"./RunHistory.ts\"\n\n/**\n * The decision a client submits for one approval.\n *\n * @since 1.0.0\n * @category models\n */\nexport const Decision = Schema.Literals([\"approve\", \"deny\"])\n\n/**\n * The decision a client submits for one approval.\n *\n * @since 1.0.0\n * @category models\n */\nexport type Decision = typeof Decision.Type\n\n/**\n * One approval decision, submitted with the exact payload the run published.\n *\n * @since 1.0.0\n * @category models\n */\nexport const SubmitApprovalInput = Schema.Struct({\n  ...ControlSchema.ApprovalPayload.fields,\n  decision: Decision,\n  /**\n   * The answer to a question, for a gate that asks one.\n   *\n   * Most gates are a grant: approve or deny, and the decision IS the payload.\n   * A `HumanTask` gate asks for a value — prose, a choice, a JSON object — and\n   * the decision alone answers nothing. Present exactly when the row being\n   * submitted is one of those, in which case `target.requestId` names the wait\n   * point and this is what is delivered to it. A denial carries no answer: the\n   * question is refused, not answered.\n   *\n   * Additive on purpose: a client that never asks a person anything submits\n   * exactly what it submitted before.\n   */\n  answer: Schema.optional(Schema.Json)\n})\n\n/**\n * One approval decision, submitted with the exact payload the run published.\n *\n * @since 1.0.0\n * @category models\n */\nexport type SubmitApprovalInput = typeof SubmitApprovalInput.Type\n\n/**\n * What submitting an approval did.\n *\n * `decision` is the receipt for the grant or refusal. Control owns the\n * decision and its durable resume delegation as one domain command.\n *\n * @since 1.0.0\n * @category models\n */\nexport const SubmitApprovalOutput = Schema.Struct({\n  decision: ControlSchema.Receipt\n})\n\n/**\n * What submitting an approval did.\n *\n * @since 1.0.0\n * @category models\n */\nexport type SubmitApprovalOutput = typeof SubmitApprovalOutput.Type\n\n/**\n * The failures `Approval.Submit` can answer with: exactly the union\n * `@smthrs/control` `Control.approve`, `Control.deny`, and — for a gate that\n * asks a question — `Control.signal` declare, because the handler is a\n * transport adapter over those commands and adds no failure of its own. A\n * member none of them raises would be a recovery branch no client's code could\n * ever reach.\n *\n * `NoMatchingWait` is the one an answer adds: the question was answered after\n * the run moved on, or somebody else answered it first. `CodeDrift` is a node\n * decision on a run whose flow changed since it started (#1807).\n */\nconst submitErrors = Schema.Union([\n  ControlError.NoMatchingWait,\n  ControlError.CodeDrift,\n  ControlError.PlanDigestMismatch,\n  ControlError.EnvelopeMismatch,\n  ControlError.AlreadyResolved,\n  ControlError.PlanNotFound,\n  ControlError.RunNotFound,\n  ControlError.InvalidInput,\n  ControlError.Unauthorized,\n  ControlError.PersistenceError,\n  ControlError.Unavailable,\n  ControlError.TransportError\n])\n\n/**\n * The failures `Run.Fork` and `Run.Verify` answer with: the history host's own\n * refusal, `Unauthorized` for an anonymous loopback caller, or `Unavailable`\n * from a gateway composed without a history host.\n */\nconst historyErrors = Schema.Union([RunHistory.HistoryRefused, ControlError.Unauthorized, ControlError.Unavailable])\n\n/**\n * The gateway read path, the composite approval mutation, and the run\n * history procedures.\n *\n * `Approval.Submit` is the transport form of Control's single decision\n * command. Control records the decision and durable resume delegation; the\n * gateway never composes a second mutation.\n *\n * @since 1.0.0\n * @category groups\n */\nexport const GatewayRpcs = RpcGroup.make(\n  Rpc.make(\"Projection.Snapshot\", {\n    defect: ControlRpcs.ControlDefect,\n    payload: Schema.Struct({\n      selector: GatewaySchema.ProjectionSelector,\n      after: Schema.optional(GatewaySchema.ProjectionCursor)\n    }),\n    success: GatewaySchema.ProjectionSnapshot,\n    error: GatewayError\n  }),\n  Rpc.make(\"Projection.Subscribe\", {\n    defect: ControlRpcs.ControlDefect,\n    payload: Schema.Struct({\n      selector: GatewaySchema.ProjectionSelector,\n      after: Schema.optional(GatewaySchema.ProjectionCursor)\n    }),\n    success: GatewaySchema.GatewayFrame,\n    error: GatewayError,\n    stream: true\n  }),\n  Rpc.make(\"Approval.Submit\", {\n    defect: ControlRpcs.ControlDefect,\n    payload: SubmitApprovalInput,\n    success: SubmitApprovalOutput,\n    error: submitErrors\n  }),\n  /* Branches a run at a recorded frame into a parked child, as `smthrs runs fork`. */\n  Rpc.make(\"Run.Fork\", {\n    defect: ControlRpcs.ControlDefect,\n    payload: RunHistory.ForkInput,\n    success: RunHistory.ForkOutput,\n    error: historyErrors\n  }),\n  /* Reports what a resume under the current flow code would replay, as `smthrs runs verify`. */\n  Rpc.make(\"Run.Verify\", {\n    defect: ControlRpcs.ControlDefect,\n    payload: RunHistory.VerifyInput,\n    success: RunHistory.VerifyReport,\n    error: historyErrors\n  })\n).middleware(ControlRpcs.ControlAuth)\n"]}
+{"version":3,"file":"GatewayRpcs.js","sourceRoot":"","sources":["../../src/GatewayRpcs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC/B,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AACnD,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAA;AAE7C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAA;AAU5D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/C,GAAG,aAAa,CAAC,eAAe,CAAC,MAAM;IACvC,QAAQ,EAAE,QAAQ;IAClB;;;;;;;;;;;;OAYG;IACH,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC;CACrC,CAAC,CAAA;AAUF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC,MAAM,CAAC;IAChD,QAAQ,EAAE,aAAa,CAAC,OAAO;CAChC,CAAC,CAAA;AAUF;;;;;;;;;;;GAWG;AACH,MAAM,YAAY,GAAG,MAAM,CAAC,KAAK,CAAC;IAChC,YAAY,CAAC,cAAc;IAC3B,YAAY,CAAC,SAAS;IACtB,YAAY,CAAC,kBAAkB;IAC/B,YAAY,CAAC,gBAAgB;IAC7B,YAAY,CAAC,eAAe;IAC5B,YAAY,CAAC,YAAY;IACzB,YAAY,CAAC,WAAW;IACxB,YAAY,CAAC,YAAY;IACzB,YAAY,CAAC,YAAY;IACzB,YAAY,CAAC,gBAAgB;IAC7B,YAAY,CAAC,WAAW;IACxB,YAAY,CAAC,cAAc;CAC5B,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,cAAc,EAAE,YAAY,CAAC,YAAY,EAAE,YAAY,CAAC,WAAW,CAAC,CAAC,CAAA;AAEpH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CACtC,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE;IAC9B,MAAM,EAAE,WAAW,CAAC,aAAa;IACjC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;QACrB,QAAQ,EAAE,aAAa,CAAC,kBAAkB;QAC1C,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,gBAAgB,CAAC;KACvD,CAAC;IACF,OAAO,EAAE,aAAa,CAAC,kBAAkB;IACzC,KAAK,EAAE,YAAY;CACpB,CAAC,EACF,GAAG,CAAC,IAAI,CAAC,sBAAsB,EAAE;IAC/B,MAAM,EAAE,WAAW,CAAC,aAAa;IACjC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;QACrB,QAAQ,EAAE,aAAa,CAAC,kBAAkB;QAC1C,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,gBAAgB,CAAC;KACvD,CAAC;IACF,OAAO,EAAE,aAAa,CAAC,YAAY;IACnC,KAAK,EAAE,YAAY;IACnB,MAAM,EAAE,IAAI;CACb,CAAC,EACF,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE;IAC1B,MAAM,EAAE,WAAW,CAAC,aAAa;IACjC,OAAO,EAAE,mBAAmB;IAC5B,OAAO,EAAE,oBAAoB;IAC7B,KAAK,EAAE,YAAY;CACpB,CAAC;AACF,oFAAoF;AACpF,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE;IACnB,MAAM,EAAE,WAAW,CAAC,aAAa;IACjC,OAAO,EAAE,UAAU,CAAC,SAAS;IAC7B,OAAO,EAAE,UAAU,CAAC,UAAU;IAC9B,KAAK,EAAE,aAAa;CACrB,CAAC;AACF,8FAA8F;AAC9F,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE;IACrB,MAAM,EAAE,WAAW,CAAC,aAAa;IACjC,OAAO,EAAE,UAAU,CAAC,WAAW;IAC/B,OAAO,EAAE,UAAU,CAAC,YAAY;IAChC,KAAK,EAAE,aAAa;CACrB,CAAC,CACH,CAAC,UAAU,CAAC,WAAW,CAAC,WAAW,CAAC,CAAA","sourcesContent":["/**\n * The gateway's own remote procedures: the served read path, and the one\n * composite mutation a product client cannot assemble safely on its own.\n *\n * Control mutations are not re-declared here. `@smthrs/control` `ControlRpcs`\n * is the mutation contract and the gateway mounts it unchanged at `/rpc`, so\n * there is exactly one wire definition of `Plan`, `Run`, `Approve`, `Deny`,\n * `Cancel`, `Signal`, `Steer`, `Resume`, `List`, and `Watch`.\n *\n * The group shares `ControlRpcs.ControlAuth`, so one bearer credential\n * authenticates both mounts and one server-stamped principal is recorded for\n * whatever it authorizes.\n *\n * @since 1.0.0\n */\n\nimport { ControlError, ControlRpcs, ControlSchema } from \"@smthrs/control\"\nimport { Schema } from \"effect\"\nimport { Rpc, RpcGroup } from \"effect/rpc\"\nimport { GatewayError } from \"./GatewayError.ts\"\nimport * as GatewaySchema from \"./GatewaySchema.ts\"\nimport * as RunHistory from \"./RunHistory.ts\"\n\n/**\n * The decision a client submits for one approval.\n *\n * @since 1.0.0\n * @category models\n */\nexport const Decision = Schema.Literals([\"approve\", \"deny\"])\n\n/**\n * The decision a client submits for one approval.\n *\n * @since 1.0.0\n * @category models\n */\nexport type Decision = typeof Decision.Type\n\n/**\n * One approval decision, submitted with the exact payload the run published.\n *\n * @since 1.0.0\n * @category models\n */\nexport const SubmitApprovalInput = Schema.Struct({\n  ...ControlSchema.ApprovalPayload.fields,\n  decision: Decision,\n  /**\n   * The answer to a question, for a gate that asks one.\n   *\n   * Most gates are a grant: approve or deny, and the decision IS the payload.\n   * A `HumanTask` gate asks for a value — prose, a choice, a JSON object — and\n   * the decision alone answers nothing. Present exactly when the row being\n   * submitted is one of those, in which case `target.requestId` names the wait\n   * point and this is what is delivered to it. A denial carries no answer: the\n   * question is refused, not answered.\n   *\n   * Additive on purpose: a client that never asks a person anything submits\n   * exactly what it submitted before.\n   */\n  answer: Schema.optional(Schema.Json)\n})\n\n/**\n * One approval decision, submitted with the exact payload the run published.\n *\n * @since 1.0.0\n * @category models\n */\nexport type SubmitApprovalInput = typeof SubmitApprovalInput.Type\n\n/**\n * What submitting an approval did.\n *\n * `decision` is the receipt for the grant or refusal. Control owns the\n * decision and its durable resume delegation as one domain command.\n *\n * @since 1.0.0\n * @category models\n */\nexport const SubmitApprovalOutput = Schema.Struct({\n  decision: ControlSchema.Receipt\n})\n\n/**\n * What submitting an approval did.\n *\n * @since 1.0.0\n * @category models\n */\nexport type SubmitApprovalOutput = typeof SubmitApprovalOutput.Type\n\n/**\n * The failures `Approval.Submit` can answer with: exactly the union\n * `@smthrs/control` `Control.approve`, `Control.deny`, and — for a gate that\n * asks a question — `Control.signal` declare, because the handler is a\n * transport adapter over those commands and adds no failure of its own. A\n * member none of them raises would be a recovery branch no client's code could\n * ever reach.\n *\n * `NoMatchingWait` is the one an answer adds: the question was answered after\n * the run moved on, or somebody else answered it first. `CodeDrift` is a node\n * decision on a run whose flow changed since it started (#1807).\n */\nconst submitErrors = Schema.Union([\n  ControlError.NoMatchingWait,\n  ControlError.CodeDrift,\n  ControlError.PlanDigestMismatch,\n  ControlError.EnvelopeMismatch,\n  ControlError.AlreadyResolved,\n  ControlError.PlanNotFound,\n  ControlError.RunNotFound,\n  ControlError.InvalidInput,\n  ControlError.Unauthorized,\n  ControlError.PersistenceError,\n  ControlError.Unavailable,\n  ControlError.TransportError\n])\n\n/**\n * The failures `Run.Fork` and `Run.Verify` answer with: the history host's own\n * refusal, `Unauthorized` for an anonymous loopback caller, or `Unavailable`\n * from a gateway composed without a history host.\n */\nconst historyErrors = Schema.Union([RunHistory.HistoryRefused, ControlError.Unauthorized, ControlError.Unavailable])\n\n/**\n * The gateway read path, the composite approval mutation, and the run\n * history procedures.\n *\n * `Approval.Submit` is the transport form of Control's single decision\n * command. Control records the decision and durable resume delegation; the\n * gateway never composes a second mutation.\n *\n * @since 1.0.0\n * @category groups\n */\nexport const GatewayRpcs = RpcGroup.make(\n  Rpc.make(\"Projection.Snapshot\", {\n    defect: ControlRpcs.ControlDefect,\n    payload: Schema.Struct({\n      selector: GatewaySchema.ProjectionSelector,\n      after: Schema.optional(GatewaySchema.ProjectionCursor)\n    }),\n    success: GatewaySchema.ProjectionSnapshot,\n    error: GatewayError\n  }),\n  Rpc.make(\"Projection.Subscribe\", {\n    defect: ControlRpcs.ControlDefect,\n    payload: Schema.Struct({\n      selector: GatewaySchema.ProjectionSelector,\n      after: Schema.optional(GatewaySchema.ProjectionCursor)\n    }),\n    success: GatewaySchema.GatewayFrame,\n    error: GatewayError,\n    stream: true\n  }),\n  Rpc.make(\"Approval.Submit\", {\n    defect: ControlRpcs.ControlDefect,\n    payload: SubmitApprovalInput,\n    success: SubmitApprovalOutput,\n    error: submitErrors\n  }),\n  /* Branches a run at a recorded frame into a parked child, as `smthrs runs fork`. */\n  Rpc.make(\"Run.Fork\", {\n    defect: ControlRpcs.ControlDefect,\n    payload: RunHistory.ForkInput,\n    success: RunHistory.ForkOutput,\n    error: historyErrors\n  }),\n  /* Reports what a resume under the current flow code would replay, as `smthrs runs verify`. */\n  Rpc.make(\"Run.Verify\", {\n    defect: ControlRpcs.ControlDefect,\n    payload: RunHistory.VerifyInput,\n    success: RunHistory.VerifyReport,\n    error: historyErrors\n  })\n).middleware(ControlRpcs.ControlAuth)\n"]}

package/dist/esm/GatewayServer.d.ts

@@ -27,8 +27,8 @@
 import { Control } from "@smthrs/control/Control";
 import * as SyncServer from "@smthrs/sync/SyncServer";
 import { Effect, Layer, Schema } from "effect";
-import { HttpRouter } from "effect/unstable/http";
-import { RpcSerialization, RpcServer } from "effect/unstable/rpc";
+import { HttpRouter } from "effect/http";
+import { RpcSerialization, RpcServer } from "effect/rpc";
 import { GatewayError } from "./GatewayError.ts";
 import { Projections } from "./Projections.ts";
 import * as RuntimeBridge from "./RuntimeBridge.ts";
@@ -73,7 +73,7 @@ export declare const layerHealth: (health: Health) => Layer.Layer<never, never,
  * @since 1.0.0
  * @category layers
  */
-export declare const layerHandlers: Layer.Layer<import("effect/unstable/rpc/Rpc").Handler<"Projection.Snapshot"> | import("effect/unstable/rpc/Rpc").Handler<"Projection.Subscribe"> | import("effect/unstable/rpc/Rpc").Handler<"Approval.Submit"> | import("effect/unstable/rpc/Rpc").Handler<"Run.Fork"> | import("effect/unstable/rpc/Rpc").Handler<"Run.Verify">, never, Control | Projections>;
+export declare const layerHandlers: Layer.Layer<import("effect/rpc/Rpc").Handler<"Projection.Snapshot"> | import("effect/rpc/Rpc").Handler<"Projection.Subscribe"> | import("effect/rpc/Rpc").Handler<"Approval.Submit"> | import("effect/rpc/Rpc").Handler<"Run.Fork"> | import("effect/rpc/Rpc").Handler<"Run.Verify">, never, Control | Projections>;
 /**
  * The kind a `Watch` keepalive carries.
  *
@@ -371,7 +371,7 @@ export declare const carriesRpcRequest: (serialization: RpcSerialization.RpcSeri
  * Enforces local Host/Origin policy and edge authentication before reading a
  * body or upgrading a socket, then validates RPC body size and framing.
  *
- * `effect/unstable/rpc` hands every decoded message to the server loop, and a
+ * `effect/rpc` hands every decoded message to the server loop, and a
  * body that decodes to something else — `{}`, `[]`, prose, nothing at all —
  * reached it as a message with no tag and died there, so the gateway answered
  * `500 Internal Server Error` with an empty body (release validation). That is the

package/dist/esm/GatewayServer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"GatewayServer.d.ts","sourceRoot":"","sources":["../../src/GatewayServer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAA;AAOjD,OAAO,KAAK,UAAU,MAAM,yBAAyB,CAAA;AACrD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAU,MAAM,EAAsB,MAAM,QAAQ,CAAA;AAE1E,OAAO,EAAW,UAAU,EAAyC,MAAM,sBAAsB,CAAA;AACjG,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AACjE,OAAO,EAAE,YAAY,EAAkB,MAAM,mBAAmB,CAAA;AAIhE,OAAO,EAA2B,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAEvE,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,MAAM;;;;;;;;;;;;EAIjB,CAAA;AAEF;;;;;GAKG;AACH,MAAM,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,IAAI,CAAA;AAIvC;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,GAAI,QAAQ,MAAM,KAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC,UAAU,CACL,CAAA;AAEvF;;;;;GAKG;AACH,eAAO,MAAM,aAAa,kWAkGzB,CAAA;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB,8BAA8B,CAAA;AAgD7D;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc,GACzB,SAAQ,MAAgC,KACvC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAInC,CAAA;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,yBAAyB,GAAI,QAAQ,MAAM,KAAG,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,EAAE,WAAW,CAOnG,CAAA;AAyBH;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,GAAI,SAAS,MAAM,GAAG,SAAS,oKACS,CAAA;AAMrE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,+KAWhC,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,aAAa,sKAWzB,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAgD,CAAA;AAE3F;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,EAAE,aAAa,CAAC,MAAM,CAIlD,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,cAAc,EAAE,aAAa,CAAC,MAAM,CAShD,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,UAAU,GAAI,KAAK,MAAM,KAAG,MAqBxC,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,UAAU,iBAAiB,CAAA;AAExC;;;;;GAKG;AACH,eAAO,MAAM,WAAW,EAAE,aAAa,CAAC,MAAM,CAA8C,CAAA;AAE5F;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,QAAS,CAAA;AAKzC;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,MAAM;;;EAGjB,CAAA;AAEF;;;;;GAKG;AACH,MAAM,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,IAAI,CAAA;AAevC;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,QAAc,CAAA;AAErD;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;IACzD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACjD,oEAAoE;IACpE,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,CACnB,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACzC,IAAI,EAAE,MAAM,KACT,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAC3B,sFAAsF;IACtF,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAC3C;AAyDD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,EAAE,aAAa,CAAC,MAAM,CAAqC,CAAA;AAEzF;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,EAAE,aAAa,CAAC,MAAM,CAEzD,CAAA;AAMD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,iBAAiB,GAAI,OAAO,OAAO,KAAG,OAQlD,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,WAAW,GACtB,MAAM,MAAM,EACZ,UAAU,MAAM,EAChB,OAAO,OAAO,KACb;IAAE,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CASrD,CAAA;AAEL;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,iBAAiB,GAC5B,eAAe,gBAAgB,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAC3D,MAAM,MAAM,KACX,OAWF,CAAA;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,YAAY,GAAI,UAAS,cAAmB,mIAsGxD,CAAA;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7C,oDAAoD;IACpD,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,GAAG,SAAS,CAAA;IAC7C,8DAA8D;IAC9D,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,MAAM,GAAG,SAAS,CAAA;CAC1D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,KAAK,GAAI,QAAQ,MAAM,EAAE,UAAS,YAAiB,6XAe/D,CAAA"}
+{"version":3,"file":"GatewayServer.d.ts","sourceRoot":"","sources":["../../src/GatewayServer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAA;AAOjD,OAAO,KAAK,UAAU,MAAM,yBAAyB,CAAA;AACrD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAU,MAAM,EAAsB,MAAM,QAAQ,CAAA;AAE1E,OAAO,EAAW,UAAU,EAAyC,MAAM,aAAa,CAAA;AACxF,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACxD,OAAO,EAAE,YAAY,EAAkB,MAAM,mBAAmB,CAAA;AAIhE,OAAO,EAA2B,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAEvE,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,MAAM;;;;;;;;;;;;EAIjB,CAAA;AAEF;;;;;GAKG;AACH,MAAM,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,IAAI,CAAA;AAIvC;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,GAAI,QAAQ,MAAM,KAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC,UAAU,CACL,CAAA;AAEvF;;;;;GAKG;AACH,eAAO,MAAM,aAAa,qTAkGzB,CAAA;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,kBAAkB,8BAA8B,CAAA;AAgD7D;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,cAAc,GACzB,SAAQ,MAAgC,KACvC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAInC,CAAA;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,yBAAyB,GAAI,QAAQ,MAAM,KAAG,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,EAAE,WAAW,CAOnG,CAAA;AAyBH;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,GAAI,SAAS,MAAM,GAAG,SAAS,oKACS,CAAA;AAMrE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,oBAAoB,+KAWhC,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,aAAa,sKAWzB,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAgD,CAAA;AAE3F;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,EAAE,aAAa,CAAC,MAAM,CAIlD,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,cAAc,EAAE,aAAa,CAAC,MAAM,CAShD,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,UAAU,GAAI,KAAK,MAAM,KAAG,MAqBxC,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,UAAU,iBAAiB,CAAA;AAExC;;;;;GAKG;AACH,eAAO,MAAM,WAAW,EAAE,aAAa,CAAC,MAAM,CAA8C,CAAA;AAE5F;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,QAAS,CAAA;AAKzC;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,MAAM;;;EAGjB,CAAA;AAEF;;;;;GAKG;AACH,MAAM,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,IAAI,CAAA;AAevC;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,QAAc,CAAA;AAErD;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;IACzD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACjD,oEAAoE;IACpE,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;IAC3C;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,CACnB,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EACzC,IAAI,EAAE,MAAM,KACT,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAC3B,sFAAsF;IACtF,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAC3C;AAyDD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,iBAAiB,EAAE,aAAa,CAAC,MAAM,CAAqC,CAAA;AAEzF;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,EAAE,aAAa,CAAC,MAAM,CAEzD,CAAA;AAMD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,iBAAiB,GAAI,OAAO,OAAO,KAAG,OAQlD,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,WAAW,GACtB,MAAM,MAAM,EACZ,UAAU,MAAM,EAChB,OAAO,OAAO,KACb;IAAE,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CASrD,CAAA;AAEL;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,iBAAiB,GAC5B,eAAe,gBAAgB,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAC3D,MAAM,MAAM,KACX,OAWF,CAAA;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,YAAY,GAAI,UAAS,cAAmB,mIAsGxD,CAAA;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7C,oDAAoD;IACpD,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,GAAG,SAAS,CAAA;IAC7C,8DAA8D;IAC9D,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,MAAM,GAAG,SAAS,CAAA;CAC1D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,KAAK,GAAI,QAAQ,MAAM,EAAE,UAAS,YAAiB,6XAe/D,CAAA"}

package/dist/esm/GatewayServer.js

@@ -33,8 +33,8 @@ import { SyncRpcs } from "@smthrs/sync/SyncRpcs";
 import * as SyncServer from "@smthrs/sync/SyncServer";
 import { Effect, Layer, Option, Schema, Stream } from "effect";
 import * as ByteSize from "effect/ByteSize";
-import { Headers, HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/unstable/http";
-import { RpcSerialization, RpcServer } from "effect/unstable/rpc";
+import { Headers, HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/http";
+import { RpcSerialization, RpcServer } from "effect/rpc";
 import { GatewayError, settingRefusal } from "./GatewayError.js";
 import { GatewayRpcs } from "./GatewayRpcs.js";
 import * as GatewaySchema from "./GatewaySchema.js";
@@ -579,7 +579,7 @@ export const carriesRpcRequest = (serialization, body) => {
  * Enforces local Host/Origin policy and edge authentication before reading a
  * body or upgrading a socket, then validates RPC body size and framing.
  *
- * `effect/unstable/rpc` hands every decoded message to the server loop, and a
+ * `effect/rpc` hands every decoded message to the server loop, and a
  * body that decodes to something else — `{}`, `[]`, prose, nothing at all —
  * reached it as a message with no tag and died there, so the gateway answered
  * `500 Internal Server Error` with an empty body (release validation). That is the