@voltro/runtime 0.84.0 → 0.86.0

package/dist/rpcServer.js

@@ -0,0 +1,992 @@
+import { crdtFoldCell as e, crdtIncrementalCell as t } from "./crdtMerge.js";
+import { makeDefaultRefilter as n, rowFilterMayNarrow as r } from "./rowFilter.js";
+import { buildSubjectKey as i } from "./rywPositionStore.js";
+import { runWithRoutingContext as a, runWithRoutingContextEffect as o } from "./replicatedDataStore.js";
+import { applyKeepAlive as s, resolveKeepAlive as c } from "./httpKeepAlive.js";
+import { rpcFrameDefects as l } from "./rpcDefectDiagnostics.js";
+import { makeHttpRouteGroupFinder as u, makeUnmatchedGroupFinder as d, planHttpRouteMounts as f } from "./httpRouteMounts.js";
+import { isComputedQuery as p } from "./computedQuery.js";
+import { registerConnectionStream as m } from "./connectionCredentials.js";
+import { getRpcConnection as h, withRpcClientAddress as g, withRpcConnectionIdentity as _ } from "./rpcConnections.js";
+import { makeSubscriptionOutbox as v, pumpOutbox as y, reactiveSocketTunables as b } from "./subscriptionOutbox.js";
+import { adoptDetached as x, canonicalInputKey as S, detachForResume as C, recordForResume as w } from "./subscriptionResume.js";
+import { externalSpanFromTraceparent as ee, newTraceId as T, parseTraceparent as E } from "./traceparent.js";
+import { runWithTraceContext as D } from "./traceContext.js";
+import { runWithObservedProcedure as O } from "./observedGraph.js";
+import { actingUserId as k } from "./storeMiddleware.js";
+import { readCappedBody as A, withBufferedBody as te } from "./rpcBodyCap.js";
+import { maybeCompress as ne, mergeCompressionHeaders as re } from "./httpCompression.js";
+import { runWebSocketGateway as ie } from "./webSocketGatewayRuntime.js";
+import { noteResumeVerdict as ae } from "./resumeCensus.js";
+import { publishServerTracerLayer as oe } from "./serverTracer.js";
+import { boundByCredential as j } from "./credentialBound.js";
+import { classifyRequestOrigin as se, isStateChangingMethod as ce, makeOriginGuardExemption as le, resolveOriginGuardConfig as ue } from "./originGuard.js";
+import { resolveRequestClientAddress as de, resolveRequestIsHttps as fe, resolveTrustedProxies as pe } from "./trustedProxy.js";
+import { resolveSecurityHeaders as me, securityHeadersFor as he } from "./securityHeaders.js";
+import { assertWebhookRoutesDeclareVerification as ge } from "./webhookVerification.js";
+import { Cause as M, Context as _e, Deferred as N, Effect as P, Fiber as ve, Layer as F, Queue as I, Schema as L, Stream as R } from "effect";
+import { extractDbCause as ye, hasEagerLoads as be, runWithWriteAttribution as z } from "@voltro/database";
+import { randomUUID as xe } from "node:crypto";
+import { ConnectionInfo as B, MUTATION_IN_FLIGHT_RETRY_AFTER_MS as Se, MutationConnectionRequired as Ce, MutationInFlight as we, SubjectService as V, Unauthenticated as Te, beginIdempotent as Ee, defineWebSocket as De, failIdempotent as Oe, finishIdempotent as ke, groupShapeDigests as Ae, holdIdempotentClaim as je, recheckGuardsEffect as Me, wsMutationIdempotencyScope as Ne } from "@voltro/protocol";
+import { LoggerLayer as Pe, createLogger as H } from "@voltro/logger";
+import { Server as Fe, createServer as Ie } from "node:http";
+import { HttpRouter as U, HttpServer as Le, HttpServerError as Re, HttpServerRequest as W, HttpServerResponse as G } from "effect/http";
+import { NodeHttpServer as ze, NodeHttpServerRequest as Be, NodeServices as Ve } from "@effect/platform-node";
+import { RpcSerialization as He, RpcServer as K } from "effect/rpc";
+import { dispatchSharedPath as Ue, restCorsHeaders as We, restCorsPreflight as Ge, routeAcceptsPath as Ke } from "@voltro/protocol/rest";
+import { instanceId as qe, replicaId as Je } from "@voltro/protocol/identity";
+//#region src/rpcServer.ts
+var q = (e) => {
+	let t = e.indexOf(".");
+	if (t <= 0) return;
+	let n = e.slice(0, t), r = e.slice(t + 1);
+	if (r !== "" && r.includes(".")) {
+		if (n === "subscription") return {
+			tag: r,
+			kind: "query"
+		};
+		if (n === "query" || n === "mutation" || n === "action" || n === "stream") return {
+			tag: r,
+			kind: n
+		};
+	}
+}, J = (e, t) => {
+	let n = q(e);
+	return n === void 0 ? t() : O(n, t);
+}, Ye = (e, t, n, r) => e === "subject" ? `${t}:s:${n}` : e === "global" ? `${t}:global` : r.tenantId == null ? void 0 : `${t}:t:${r.tenantId}`, Xe = Pe({}), Ze = (e, t) => P.callback((n) => {
+	let r = z(t, () => P.runFork(e.pipe(P.provide(Xe))));
+	return r.addObserver((e) => {
+		n(e);
+	}), P.asVoid(ve.interrupt(r));
+}), Y = (e, t, n) => {
+	let r = n === void 0 ? void 0 : h(n);
+	return {
+		subject: e,
+		traceId: t?.traceId ?? T(),
+		...t?.spanId === void 0 ? {} : { spanId: t.spanId },
+		...n === void 0 ? {} : { clientId: n },
+		...r === void 0 ? {} : { connection: r },
+		...r?.remoteAddr === void 0 ? {} : { remoteAddr: r.remoteAddr }
+	};
+}, Qe = P.currentSpan.pipe(P.catch(() => P.succeed(void 0))), $e = (e) => ({
+	traceId: e.traceId,
+	...e.spanId === void 0 ? {} : { spanId: e.spanId }
+}), et = (e, t, n) => {
+	e !== void 0 && (e.attribute("rpc.tag", t), e.attribute("subject.type", n.type), n.tenantId !== void 0 && n.tenantId !== null && e.attribute("tenant.id", n.tenantId));
+}, tt = (e) => n(e, (e) => {
+	Q.error("row filter failed to load — subscription", {}, e instanceof Error ? e : Error(String(e)));
+}), X = (e) => ({
+	single: (t) => P.runPromise(I.offer(e, t)),
+	end: () => I.endUnsafe(e)
+}), nt = (n, i, a, o, s, c, l, u, d, f) => R.callback((p) => P.gen(function* () {
+	let h = d ?? b(), g = i.crdtColumnsFor(n.table), _ = v({
+		maxBufferedBytes: h.maxBufferedBytes,
+		overrunAfterMs: h.overrunAfterMs,
+		oversizedEventBytes: h.oversizedEventBytes,
+		label: s,
+		...g.size > 0 ? { crdt: {
+			columns: g,
+			merge: e,
+			incremental: t
+		} } : {}
+	});
+	yield* P.addFinalizer(() => P.sync(() => _.close()));
+	let ee = u !== void 0 && (be(n) || r([n.table])), T = f !== void 0 && !ee, E = T ? S(f.input) : "unused", D = T && E !== "uncanonical" ? {
+		label: s,
+		inputKey: E,
+		subjectId: a.subject.id ?? "anonymous",
+		tenantId: a.subject.tenantId ?? ""
+	} : void 0;
+	ae(s, f === void 0 ? "not-offered" : ee ? r([n.table]) ? "row-filter" : "eager-load" : E !== "uncanonical" || "uncanonical-input");
+	let O = { current: (e) => {
+		D !== void 0 && w(D, e), _.push(e);
+	} };
+	if (D !== void 0 && f?.fromRevision !== void 0 && f.reconcile === void 0) {
+		let e = l !== void 0 && (yield* P.tryPromise(() => l()).pipe(P.match({
+			onFailure: () => !0,
+			onSuccess: (e) => !!e
+		}))) ? void 0 : x(D, f.fromRevision);
+		if (e !== void 0) {
+			for (let t of e.deltas) _.push({
+				_tag: "delta",
+				revision: t.revision,
+				emittedAt: t.emittedAt,
+				patch: t.patch
+			});
+			e.sink.current = O.current;
+			let t = e.unsubscribe;
+			if (yield* P.addFinalizer(() => P.sync(() => {
+				e.sink.current = () => {}, C(D, {
+					sink: e.sink,
+					unsubscribe: t
+				});
+			})), yield* P.forkScoped(P.promise(() => y(_, X(p), s))), a.clientId !== void 0) {
+				let e = m(a.clientId, () => {
+					I.endUnsafe(p);
+				});
+				yield* P.addFinalizer(() => P.sync(() => e()));
+			}
+			return;
+		}
+	}
+	let k = yield* P.tryPromise(() => i.subscribe(n, (e) => {
+		O.current(e);
+	}, a, o, s, f?.reconcile === void 0 ? c : void 0, l, u, f?.reconcile !== void 0)).pipe(P.matchCause({
+		onFailure: (e) => (pt(`subscription.${s}`, a.traceId, e), {
+			ok: !1,
+			error: bt(e)
+		}),
+		onSuccess: (e) => ({
+			ok: !0,
+			unsubscribe: e
+		})
+	}));
+	if (!k.ok) {
+		I.offerUnsafe(p, {
+			_tag: "error",
+			error: k.error
+		}), I.endUnsafe(p);
+		return;
+	}
+	let A = k.unsubscribe;
+	if (yield* P.addFinalizer(() => P.sync(() => {
+		D === void 0 ? A() : (O.current = () => {}, C(D, {
+			sink: O,
+			unsubscribe: A
+		}));
+	})), yield* P.forkScoped(P.promise(() => y(_, X(p), s))), a.clientId !== void 0) {
+		let e = m(a.clientId, () => {
+			I.endUnsafe(p);
+		});
+		yield* P.addFinalizer(() => P.sync(() => e()));
+	}
+}), { bufferSize: 1 }), rt = /* @__PURE__ */ new Set(), it = () => {
+	rt.clear();
+}, at = (e) => {
+	rt.has(e) || (rt.add(e), ft.warn(`${e}: \`cache:\` is declared but NOT applied — this query's handler returns a computed value, and the snapshot cache only wraps a store read. Every subscriber re-runs the handler. Either return a query descriptor (so the read can be cached), or drop \`cache:\` so the declaration matches what happens.`, { label: e }));
+}, ot = (e, t, n, r, i) => R.callback((a) => P.gen(function* () {
+	let o = i ?? b(), s = v({
+		maxBufferedBytes: o.maxBufferedBytes,
+		overrunAfterMs: o.overrunAfterMs,
+		oversizedEventBytes: o.oversizedEventBytes,
+		label: r
+	});
+	yield* P.addFinalizer(() => P.sync(() => s.close()));
+	let c = yield* P.tryPromise(() => t.subscribeComputed(e, (e) => {
+		s.push(e._tag === "snapshot" ? {
+			...e,
+			computed: !0
+		} : e);
+	}, n, r)).pipe(P.matchCause({
+		onFailure: (e) => (pt(`subscription.${r}`, n.traceId, e), {
+			ok: !1,
+			error: bt(e)
+		}),
+		onSuccess: (e) => ({
+			ok: !0,
+			unsubscribe: e
+		})
+	}));
+	if (!c.ok) {
+		I.offerUnsafe(a, {
+			_tag: "error",
+			error: c.error
+		}), I.endUnsafe(a);
+		return;
+	}
+	let l = c.unsubscribe;
+	if (ae(r, "computed"), yield* P.addFinalizer(() => P.sync(() => l())), yield* P.forkScoped(P.promise(() => y(s, X(a), r))), n.clientId !== void 0) {
+		let e = m(n.clientId, () => {
+			I.endUnsafe(a);
+		});
+		yield* P.addFinalizer(() => P.sync(() => e()));
+	}
+}), { bufferSize: 1 }), st = (e, t, n = "rpc.subscription", r, s, c, l) => R.unwrap(P.gen(function* () {
+	let u = yield* V, d = yield* B, f = (e) => {
+		let t = R.make({
+			_tag: "error",
+			error: new Te({ reason: "The session has expired. Sign in again." })
+		});
+		return j(e, d.credentialExpiresAt, t, t);
+	}, m = yield* Qe;
+	et(m, n, u);
+	let h = Y(u, m, d.clientId), g = i(u.id, d.clientId), _ = {
+		subjectKey: g,
+		...d.reconcile === void 0 ? {} : { forcePrimary: !0 }
+	}, v = a(_, () => D({
+		traceId: h.traceId,
+		...h.spanId === void 0 ? {} : { spanId: h.spanId }
+	}, () => J(n, () => e(h)))), y = P.isEffect(v) ? yield* o(_, v).pipe(P.matchCause({
+		onFailure: (e) => (pt(`subscription.${n}`, h.traceId, e), {
+			ok: !1,
+			error: bt(e)
+		}),
+		onSuccess: (e) => ({
+			ok: !0,
+			value: e
+		})
+	})) : {
+		ok: !0,
+		value: v
+	};
+	if (!y.ok) return R.make({
+		_tag: "error",
+		error: y.error
+	});
+	let b = y.value;
+	if (p(b)) return s !== void 0 && at(n), f(Z(ot(d.reconcile === void 0 ? b : {
+		...b,
+		recompute: () => a(_, b.recompute)
+	}, t, h, n), d.reconcile));
+	let x = b, S = r?.(x), C = s === void 0 ? void 0 : Ye(s.scope, s.baseKey, g, u);
+	return f(Z(nt(x, t, h, S, n, s === void 0 || C === void 0 ? void 0 : {
+		key: C,
+		ttlMs: s.ttlMs,
+		swrMs: s.swrMs
+	}, c?.(u), l?.(u) ?? tt(u), void 0, {
+		input: x,
+		...d.resumeFrom === void 0 ? {} : { fromRevision: d.resumeFrom },
+		...d.reconcile === void 0 ? {} : { reconcile: d.reconcile }
+	}), d.reconcile));
+}).pipe(P.withSpan(n, { attributes: { "framework.kind": "subscription" } }))), Z = (e, t) => t === void 0 ? e : e.pipe(R.mapAccum(() => !1, (e, n) => !e && n._tag === "snapshot" ? [!0, [{
+	...n,
+	reconciles: t
+}]] : [e, [n]])), ct = (e, t = "rpc.stream", n, r) => R.unwrap(P.gen(function* () {
+	let i = yield* V, a = yield* B, o = yield* Qe;
+	et(o, t, i);
+	let s = Y(i, o, a.clientId), c = n ?? [], l = () => Me(i, c, r), u = yield* l();
+	if (u) return R.fail(u);
+	let d = J(t, () => e(s)), f = P.isEffect(d) ? yield* d.pipe(P.orDie) : d, p = R.flatMap(f, (e) => R.unwrap(l().pipe(P.map((t) => t ? R.fail(t) : R.make(e))))), h = j(p, a.credentialExpiresAt, R.empty);
+	if (s.clientId === void 0) return h;
+	let g = s.clientId;
+	return R.unwrap(P.gen(function* () {
+		let e = yield* N.make(), t = m(g, () => {
+			N.doneUnsafe(e, P.void);
+		});
+		return yield* P.addFinalizer(() => P.sync(() => t())), h.pipe(R.interruptWhen(N.await(e)));
+	}));
+}).pipe(P.withSpan(t, { attributes: { "framework.kind": "stream" } }))), Q = H({ scope: "voltro:rpc" }), lt = H({ scope: "voltro:http" }), ut = H({ scope: "voltro:shutdown" }), dt = (e) => {
+	if (e instanceof Error) {
+		let t = e._tag;
+		return {
+			name: e.name,
+			message: e.message,
+			...typeof t == "string" ? { tag: t } : {},
+			...e.stack === void 0 ? {} : { stack: e.stack.split("\n").slice(1, 4).map((e) => e.trim()) }
+		};
+	}
+	if (typeof e == "object" && e) {
+		let t = e._tag;
+		return {
+			...typeof t == "string" ? { tag: t } : {},
+			value: String(e).slice(0, 300)
+		};
+	}
+	return { value: String(e).slice(0, 300) };
+}, ft = H({ scope: "voltro:rpc" }), pt = (e, t, n) => {
+	if (M.hasInterruptsOnly(n)) return;
+	let r = M.squash(n), i = r?._tag, a = r instanceof Error ? r.message : r?.message ?? String(r), o = M.hasDies(n), s = ye(r), c = {
+		traceId: t,
+		...i === void 0 ? {} : { errorTag: i },
+		...s
+	}, l = a === "Failed to execute statement" && typeof s.dbMessage == "string" ? s.dbMessage : a;
+	o ? Q.error(`${e} failed: ${l}`, c) : Q.warn(`${e} failed: ${l}`, c);
+}, mt = /* @__PURE__ */ new Set([
+	"SqlError",
+	"ResultLengthMismatch",
+	"FieldDecryptionError"
+]), ht = (e) => typeof e == "object" && !!e && typeof e._tag == "string" && mt.has(e._tag), gt = (e, t) => {
+	try {
+		return L.is(e)(t);
+	} catch {
+		return !0;
+	}
+}, _t = /* @__PURE__ */ new Set(), vt = (e, t) => {
+	let n = `${e}\u0000${t}`;
+	_t.has(n) || (_t.size >= 1e3 && _t.clear(), _t.add(n), Q.warn(`${e} failed with '${t}', which is undeclared on its wire union — the client received InternalError instead. Add ${t} to the descriptor's \`error:\`, register it app-wide through a plugin's \`errorSchemas\`, or map it to a declared error (\`Effect.orDie\` if it is a defect). \`defineExecutor\` reports this at compile time.`, {
+		procedure: e,
+		errorTag: t
+	}));
+}, $ = (e, t = "internal server error") => ({
+	_tag: "InternalError",
+	message: t,
+	traceId: e
+}), yt = (e) => {
+	let t = e instanceof Error ? e.message : e?.message, n = typeof t == "string" && t.length > 0 ? t : String(e), r = e?._tag, i = typeof r == "string" && r.length > 0 && !n.startsWith(r) ? `${r}: ${n}` : n;
+	return i.length <= 500 ? i : `${i.slice(0, 500)}…`;
+}, bt = (e) => {
+	let t = M.squash(e);
+	if (t && typeof t == "object" && t._tag === "UnknownError" && (t = t.error ?? t.cause ?? t), ht(t)) return {
+		_tag: "InternalError",
+		message: "internal server error"
+	};
+	let n = t && typeof t == "object" ? t : {}, r = {};
+	for (let [e, t] of Object.entries(n)) e !== "cause" && e !== "stack" && e !== "message" && (t === null || typeof t == "string" || typeof t == "number" || typeof t == "boolean") && (r[e] = t);
+	let i = t?._tag, a = t instanceof Error ? t.message : t?.message;
+	return {
+		...r,
+		...typeof i == "string" ? { _tag: i } : {},
+		message: typeof a == "string" ? a : String(t)
+	};
+}, xt = (e) => {
+	if (e === void 0) return;
+	let t = L.encodeUnknownSync(e), n = L.decodeUnknownSync(e);
+	return {
+		encode: (e) => {
+			try {
+				return t(e);
+			} catch {
+				return e;
+			}
+		},
+		decode: (e) => {
+			try {
+				return n(e);
+			} catch {
+				return e;
+			}
+		}
+	};
+}, St = (e) => {
+	let t = {}, n;
+	for (let [r, i] of Object.entries(e ?? {})) Array.isArray(i) ? r.toLowerCase() === "set-cookie" ? n = i : t[r] = i.join(", ") : t[r] = i;
+	return {
+		headers: t,
+		setCookie: n
+	};
+}, Ct = (e, t, n = "rpc.mutation", r, o, s, c = "subject") => P.gen(function* () {
+	let l = yield* V, u = yield* B, d = yield* Qe;
+	et(d, n, l);
+	let f = Y(l, d, u.clientId), p = c === "connection";
+	if (p && (f.connection?.transport !== "websocket" || f.connection.signal.aborted)) return yield* P.fail(new Ce({ traceId: f.traceId }));
+	let m = o && u.idempotencyKey ? {
+		store: o.store,
+		ttlMs: o.ttlMs,
+		key: u.idempotencyKey,
+		scope: Ne(l.tenantId, k(l), n, p ? f.connection?.id : void 0)
+	} : null, h = i(l.id, u.clientId), g = {
+		traceId: f.traceId,
+		subjectId: k(l),
+		procedure: n
+	}, _ = (r = (e) => e) => P.suspend(() => {
+		let i = a({ subjectKey: h }, () => D({
+			traceId: f.traceId,
+			...f.spanId === void 0 ? {} : { spanId: f.spanId }
+		}, () => z(g, () => J(n, () => e(t, f)))));
+		return P.isEffect(i) ? r(Ze(i, g)) : P.tryPromise({
+			try: () => Promise.resolve(i),
+			catch: (e) => e
+		});
+	}), v = !1, y;
+	return yield* (m ? P.acquireUseRelease(P.promise(async () => {
+		let e = await Ee(m.store, m.scope, m.key, m.ttlMs, Date.now());
+		return e.kind === "fresh" && (y = je(m.store, m.scope, m.key)), e;
+	}), (e) => P.gen(function* () {
+		return yield* P.yieldNow, p && f.connection?.signal.aborted ? yield* P.fail(new Ce({ traceId: f.traceId })) : e.kind === "replay" ? r ? r.decode(e.response.body) : e.response.body : e.kind === "conflict" ? yield* P.fail(new we({
+			traceId: f.traceId,
+			retryAfterMs: Se
+		})) : yield* P.uninterruptibleMask((e) => e(P.void).pipe(P.flatMap(() => _(e)), P.tap((e) => (v = !0, P.promise(() => ke(m.store, m.scope, m.key, {
+			status: 200,
+			body: r ? r.encode(e) : e
+		}, Date.now())).pipe(P.ignore)))));
+	}), (e) => P.sync(() => y?.()).pipe(P.andThen(e.kind === "fresh" && !v ? P.promise(() => Oe(m.store, m.scope, m.key)).pipe(P.ignore) : P.void))) : _()).pipe(P.tapCause((e) => P.sync(() => pt(n, f.traceId, e))), P.catchIf(ht, () => P.die($(f.traceId))), P.catchIf((e) => e instanceof Error && typeof e._tag != "string", (e) => P.die($(f.traceId, yt(e)))), P.catchIf((e) => s !== void 0 && typeof e?._tag == "string" && !gt(s, e), (e) => P.sync(() => vt(n, e._tag)).pipe(P.andThen(P.die($(f.traceId, yt(e)))))), P.catchDefect((e) => e?._tag === "InternalError" ? P.die(e) : P.die($(f.traceId, yt(e)))), P.annotateLogs($e(f)));
+}).pipe(P.withSpan(n, { attributes: { "framework.kind": "mutation" } })), wt = 8388608, Tt = (e) => {
+	let t = e.port ?? 4e3, n = e.host, r = e.path ?? "/ws", i = r, a = e.replicaId ?? Je();
+	ge(e.webhookRoutes);
+	let o = e.listener, p = o?.server ?? Ie(), m = /* @__PURE__ */ new Set();
+	p.on("connection", (e) => {
+		m.add(e), e.once("close", () => {
+			m.delete(e);
+		});
+	}), s(p, c(e));
+	let v = (t) => W.HttpServerRequest.pipe(P.flatMap((t) => P.gen(function* () {
+		if (!e.inspectRoute) return G.text("inspect route not configured", { status: 404 });
+		let n = {};
+		for (let [e, r] of Object.entries(t.headers)) r !== void 0 && (n[e.toLowerCase()] = Array.isArray(r) ? r.join(", ") : r);
+		let r = e.inspectRoute, i = r.binary?.[new URL(t.url, "http://inspect.invalid").pathname], a;
+		!i && t.method !== "GET" && t.method !== "HEAD" && t.method !== "OPTIONS" && (a = yield* t.text.pipe(P.orElseSucceed(() => "")));
+		let o = yield* P.promise(async (e) => {
+			if (!i) return r.handle(t.url, n, t.method, a, e);
+			let o = R.toReadableStream(t.stream);
+			return i(t.url, n, t.method, o, e);
+		});
+		if (o === null) return G.text("inspect route not found", { status: 404 });
+		if (o.byteStream !== void 0) {
+			let e = {
+				...o.headers,
+				...o.byteStream.contentLength === void 0 ? {} : { "content-length": String(o.byteStream.contentLength) },
+				...o.byteStream.contentDisposition === void 0 ? {} : { "content-disposition": o.byteStream.contentDisposition }
+			};
+			if (t.method === "HEAD") return G.empty({
+				status: o.status,
+				headers: {
+					...e,
+					"content-type": o.contentType
+				}
+			});
+			let n = o.byteStream.stream;
+			return G.stream(R.fromReadableStream({
+				evaluate: () => typeof n == "function" ? n() : n,
+				onError: (e) => e
+			}), {
+				status: o.status,
+				contentType: o.contentType,
+				headers: e
+			});
+		}
+		return G.text(o.body, {
+			status: o.status,
+			contentType: o.contentType,
+			headers: o.headers ?? {}
+		});
+	}))), y = () => W.HttpServerRequest.pipe(P.flatMap((t) => {
+		let n = e.inspectStream;
+		if (!n) return P.succeed(G.text("inspect stream not configured", { status: 404 }));
+		let r = {};
+		for (let [e, n] of Object.entries(t.headers)) n !== void 0 && (r[e.toLowerCase()] = Array.isArray(n) ? n.join(", ") : n);
+		let i = n.corsHeaders(r.origin);
+		if (n.isDisabled()) return P.succeed(G.text(JSON.stringify({ error: "inspect disabled (VOLTRO_INSPECT=off)" }), {
+			status: 503,
+			contentType: "application/json; charset=utf-8",
+			headers: i
+		}));
+		let a = n.authorize(r);
+		return a.ok ? (n.select?.(t.url, r) ?? P.succeed(void 0)).pipe(P.flatMap((e) => {
+			if (e?.kind === "stream") return P.succeed(G.stream(e.stream, {
+				status: 200,
+				headers: {
+					...i,
+					"content-type": "text/event-stream; charset=utf-8",
+					"cache-control": "no-cache, no-transform",
+					"x-accel-buffering": "no"
+				}
+			}));
+			if (e?.kind === "refused") return P.succeed(G.text(JSON.stringify(e.body), {
+				status: e.status,
+				contentType: "application/json; charset=utf-8",
+				headers: i
+			}));
+			let r = new TextEncoder(), a = n.keepAliveMs ?? 15e3, o = t.url.indexOf("?"), s = o === -1 ? new URLSearchParams() : new URLSearchParams(t.url.slice(o + 1)), c = s.get("live") === "1", l = s.get("channels"), u = l ? new Set(l.split(",").map((e) => e.trim()).filter((e) => e.length > 0)) : void 0, d = (e) => {
+				if (!u || e.indexOf("event: ") !== 0) return !0;
+				let t = e.indexOf("\n", 7);
+				return t < 0 || u.has(e.slice(7, t).trim());
+			}, f = R.callback((e) => P.gen(function* () {
+				if (I.offerUnsafe(e, r.encode("retry: 5000\n\n")), !c) for (let t of n.replay()) d(t) && I.offerUnsafe(e, r.encode(t));
+				let t = n.subscribe((t) => {
+					d(t) && I.offerUnsafe(e, r.encode(t));
+				}), i = setInterval(() => {
+					I.offerUnsafe(e, r.encode(n.keepAlive()));
+				}, a);
+				yield* P.addFinalizer(() => P.sync(() => {
+					clearInterval(i), t();
+				}));
+			}));
+			return P.succeed(G.stream(f, {
+				status: 200,
+				headers: {
+					"content-type": "text/event-stream; charset=utf-8",
+					...n.replicaId ? { "x-voltro-replica-id": n.replicaId } : {},
+					"cache-control": "no-cache, no-transform",
+					connection: "keep-alive",
+					"x-accel-buffering": "no",
+					...i
+				}
+			}));
+		})) : P.succeed(G.text(JSON.stringify({
+			error: "unauthorized",
+			reason: a.reason
+		}), {
+			status: 401,
+			contentType: "application/json; charset=utf-8",
+			headers: i
+		}));
+	})), b = v(!0), x = v(!1), S = U.add("*", "/_voltro/inspect/*", W.HttpServerRequest.pipe(P.flatMap((e) => e.url.split("?")[0] === "/_voltro/inspect" ? b : x))), C = F.empty;
+	e.inspectRoute !== void 0 && (C = e.inspectStream === void 0 ? S : F.mergeAll(U.add("GET", "/_voltro/inspect/stream", y()), S));
+	let w = e.publishSurfaceDigest === !0 ? Ae(e.group) : void 0, D = e.serviceSurfaceTags ?? /* @__PURE__ */ new Set(), O = (e) => {
+		let t = Object.entries(w), n = 0;
+		for (let r of t) (e ? D.has(r[0]) : !D.has(r[0])) && (t[n++] = r);
+		return t.length = n, Object.fromEntries(t);
+	}, k = w === void 0 ? void 0 : O(!1), ae = w === void 0 || D.size === 0 ? void 0 : O(!0), j = P.succeed(G.text(JSON.stringify({
+		protocol: 1,
+		mutationReplay: e.mutationReplay === !0,
+		...k === void 0 ? {} : { surface: k },
+		...ae === void 0 ? {} : { serviceSurface: ae }
+	}), {
+		status: 200,
+		contentType: "application/json; charset=utf-8",
+		headers: {
+			"cache-control": "no-store",
+			"access-control-allow-origin": "*"
+		}
+	})), N = "/_voltro/runtime-capabilities", L = `${i.slice(0, i.lastIndexOf("/"))}/_voltro/runtime-capabilities`, be = L === N ? U.add("GET", N, j) : F.mergeAll(U.add("GET", N, j), U.add("GET", L, j)), z = F.empty;
+	if (e.webhookRoutes !== void 0 && e.webhookRoutes.size > 0) {
+		let t = (t) => W.HttpServerRequest.pipe(P.flatMap((n) => P.gen(function* () {
+			let r = {};
+			for (let [e, t] of Object.entries(n.headers)) t !== void 0 && (r[e.toLowerCase()] = Array.isArray(t) ? t.join(", ") : t);
+			let i = n.url.split("?")[0], a = t.maxBodyBytes ?? Ze, o = /* @__PURE__ */ new Uint8Array();
+			if (n.method !== "GET" && n.method !== "HEAD") {
+				let e = Number(r["content-length"]);
+				if (Number.isFinite(e) && e > a) return G.text("payload too large", { status: 413 });
+				let t = yield* A(n.source, a);
+				if (t._tag === "aborted") return G.text("request aborted", { status: 400 });
+				if (t._tag === "too-large") return G.text("payload too large", { status: 413 });
+				o = new Uint8Array(t.bytes);
+			}
+			let s = ee(r.traceparent), c = yield* P.promise(() => t.handle({
+				method: n.method,
+				path: i,
+				headers: r,
+				rawBody: o
+			})).pipe(P.withSpan(`webhook${i}`, {
+				attributes: {
+					"framework.kind": "webhook",
+					"http.route": i
+				},
+				...s ? { parent: s } : {}
+			})), l = new TextEncoder().encode(c.body), u = ne({
+				body: l,
+				contentType: c.contentType,
+				acceptEncoding: r["accept-encoding"],
+				options: e.compression
+			});
+			return u.compressed ? G.uint8Array(u.bytes, {
+				status: c.status,
+				contentType: c.contentType,
+				headers: u.headers
+			}) : G.text(c.body, {
+				status: c.status,
+				contentType: c.contentType
+			});
+		}))), n = Array.from(e.webhookRoutes.entries()).map(([e, n]) => U.add("*", e, t(n)));
+		z = F.mergeAll(...n);
+	}
+	let B = pe(e.security?.trustedProxies, process.env, e.security?.clientAddressHeader), Se = F.empty, Ce = () => void 0;
+	if (e.httpRoutes !== void 0 && e.httpRoutes.length > 0) {
+		let t = (t) => W.HttpServerRequest.pipe(P.flatMap((n) => P.gen(function* () {
+			let r = {};
+			for (let [e, t] of Object.entries(n.headers)) t !== void 0 && (r[e.toLowerCase()] = Array.isArray(t) ? t.join(", ") : t);
+			let i = n.url.indexOf("?"), a = i >= 0 ? n.url.slice(0, i) : n.url, o = i >= 0 ? n.url.slice(i + 1) : "";
+			if (!t.some((e) => Ke(e, a))) return G.text("not found", { status: 404 });
+			let s = t.reduce((e, t) => Math.max(e, t.maxBodyBytes ?? Ze), 0), c = /* @__PURE__ */ new Uint8Array();
+			if (n.method !== "GET" && n.method !== "HEAD") {
+				let e = Number(r["content-length"]);
+				if (Number.isFinite(e) && e > s) return G.text("payload too large", { status: 413 });
+				let t = yield* A(n.source, s);
+				if (t._tag === "aborted") return G.text("request aborted", { status: 400 });
+				if (t._tag === "too-large") return G.text("payload too large", { status: 413 });
+				c = new Uint8Array(t.bytes);
+			}
+			let l = e.getStore?.(), u;
+			try {
+				u = n.source?.socket?.remoteAddress;
+			} catch {
+				u = void 0;
+			}
+			let d = de({
+				socketAddress: u,
+				headers: r,
+				config: B
+			}), f = {
+				method: n.method,
+				path: a,
+				query: o,
+				headers: r,
+				rawBody: c,
+				...l === void 0 ? {} : { store: l },
+				...d === void 0 ? {} : { remoteAddr: d }
+			}, p = Date.now(), m = yield* P.promise(() => Ue(t, f));
+			if (e.onHttpRoute !== void 0) try {
+				e.onHttpRoute({
+					method: n.method,
+					path: a,
+					status: m.status,
+					durationMs: Date.now() - p,
+					traceId: E(r.traceparent)?.traceId ?? T()
+				});
+			} catch {}
+			m.status >= 500 && lt.warn(`${n.method} ${a} → ${m.status}`, {
+				method: n.method,
+				path: a,
+				status: m.status,
+				...typeof m.body == "string" && m.body.length > 0 ? { body: m.body.slice(0, 1e3) } : {},
+				...m.cause === void 0 ? {} : { cause: dt(m.cause) }
+			});
+			let h = St(m.headers), g = h.headers, _ = (e) => (h.setCookie !== void 0 && Be.toServerResponse(n).setHeader("set-cookie", [...h.setCookie]), e), v = {
+				status: m.status,
+				...m.contentType ? { contentType: m.contentType } : {},
+				headers: g
+			};
+			if (m.byteStream !== void 0) {
+				let e = m.byteStream.stream, t = typeof e == "function" ? e() : e;
+				return _(G.stream(R.fromReadableStream({
+					evaluate: () => t,
+					onError: (e) => e
+				}), {
+					status: m.status,
+					contentType: m.contentType ?? "application/octet-stream",
+					headers: {
+						...g,
+						...m.byteStream.contentLength === void 0 ? {} : { "content-length": String(m.byteStream.contentLength) },
+						...m.byteStream.contentDisposition === void 0 ? {} : { "content-disposition": m.byteStream.contentDisposition }
+					}
+				}));
+			}
+			if (m.stream !== void 0) {
+				let { subscribe: e, keepAliveMs: t } = m.stream, n = new TextEncoder(), r = t ?? 15e3, i = R.callback((t) => P.gen(function* () {
+					I.offerUnsafe(t, n.encode("retry: 5000\n\n"));
+					let i = e((e) => {
+						I.offerUnsafe(t, n.encode(e));
+					}), a = r > 0 ? setInterval(() => {
+						I.offerUnsafe(t, n.encode(": keep-alive\n\n"));
+					}, r) : void 0;
+					yield* P.addFinalizer(() => P.sync(() => {
+						a !== void 0 && clearInterval(a), i();
+					}));
+				}));
+				return _(G.stream(i, {
+					status: m.status,
+					headers: {
+						...g,
+						"content-type": "text/event-stream; charset=utf-8",
+						"cache-control": "no-cache, no-transform",
+						connection: "keep-alive",
+						"x-accel-buffering": "no"
+					}
+				}));
+			}
+			if (n.method === "HEAD") return _(G.empty({
+				status: v.status,
+				headers: g
+			}));
+			let y = m.body instanceof Uint8Array ? m.body : new TextEncoder().encode(m.body ?? ""), b = ne({
+				body: y,
+				contentType: m.contentType,
+				acceptEncoding: r["accept-encoding"],
+				options: e.compression
+			});
+			return _(G.uint8Array(b.bytes, {
+				...v,
+				headers: re(g, b.headers)
+			}));
+		})), P.tapCause((e) => M.hasInterruptsOnly(e) ? P.void : P.sync(() => lt.error(`${t.map((e) => e.method).join("|")} ${t[0].path} threw`, { path: t[0].path }, M.squash(e))))), n = f(e.httpRoutes), r = new Map(n.map((e) => [e, t(e.routes)])), i = d(n);
+		Ce = (e) => {
+			let t = i(e);
+			return t === void 0 ? void 0 : { effect: r.get(t) };
+		};
+		let a = n.flatMap((e) => {
+			let t = r.get(e);
+			return e.methods.map((n) => U.add(n, `${e.mountPath}/*`, t));
+		});
+		Se = F.mergeAll(...a);
+	}
+	let we = K.layerProtocolWebsocket({ path: r }), V = (e) => {
+		let t = H({ scope: e }), n = /* @__PURE__ */ new Map();
+		return (e) => F.flatMap(e, (e) => {
+			let r = _e.get(e, K.Protocol);
+			return F.succeedContext(_e.make(K.Protocol, {
+				...r,
+				run: (e) => r.run((t, r) => P.suspend(() => {
+					if (r._tag === "Request") {
+						let e = n.get(t);
+						e === void 0 && (n.set(t, e = /* @__PURE__ */ new Map()), h(t)?.signal.addEventListener("abort", () => {
+							n.delete(t);
+						}, { once: !0 })), e.set(String(r.id), r.tag);
+					}
+					return e(t, r);
+				})),
+				end: (e) => (n.delete(e), r.end(e)),
+				send: (e, i, a) => P.suspend(() => {
+					let o = n.get(e), s = "requestId" in i ? String(i.requestId) : void 0, c = s === void 0 ? o?.size === 1 ? o.values().next().value : void 0 : o?.get(s);
+					i._tag === "Exit" && s !== void 0 && o?.delete(s);
+					for (let n of l(i)) {
+						let r = ye(n), i = typeof r.dbMessage == "string" ? r.dbMessage : void 0;
+						t.error(i === void 0 ? "rpc defect sent to client" : `rpc defect sent to client: ${i}`, {
+							clientId: e,
+							defect: n,
+							...s === void 0 ? {} : { requestId: s },
+							...c === void 0 ? {} : { rpcTag: c },
+							...c === void 0 && o !== void 0 ? { rpcTags: [...new Set(o.values())] } : {},
+							...String(n).includes("Expected JSON value") ? { outputHint: "Schema.Unknown outputs must contain JSON values; declare date conversion in the output schema." } : {},
+							...r,
+							...i === void 0 ? {} : { hint: "the failing statement is in `_voltro_traces` (attributes.db.query.text) for this trace" }
+						});
+					}
+					return r.send(e, i, a);
+				})
+			}));
+		});
+	}, Te = { disableFatalDefects: !0 }, Ee = K.layer(e.group, Te), Oe = K.layer(e.group, Te).pipe(F.provide(V("voltro:rpc:http")(_(K.layerProtocolHttp({ path: "/rpc" }), "http"))), F.provide(He.layerJson), F.provide(e.httpHandlersLayer ?? e.handlersLayer)), ke = Ee.pipe(F.provide(V("voltro:rpc")(_(we, "websocket"))), F.provide(He.layerJson), F.provide(e.handlersLayer)), je = new Set((e.webSocketGateways ?? []).map((e) => e.path)), Me;
+	if (e.webSocketGateways !== void 0 && e.webSocketGateways.length > 0) {
+		let t = H({ scope: "voltro:gateway" }), n = e.webSocketGateways.map(De).map((n) => U.add("GET", n.path, W.HttpServerRequest.pipe(P.flatMap((r) => P.gen(function* () {
+			let i = {};
+			for (let [e, t] of Object.entries(r.headers)) t !== void 0 && (i[e.toLowerCase()] = Array.isArray(t) ? t.join(", ") : t);
+			if (!ot(r.method, i)) return G.text("upgrade required", {
+				status: 426,
+				headers: { upgrade: "websocket" }
+			});
+			let a = null, o;
+			if (n.auth === "subject") {
+				let r = e.resolveGatewaySubject;
+				if (r === void 0) return t.error("gateway declares auth: subject but the boot passed no resolveGatewaySubject", { path: n.path }), G.text("gateway auth unavailable", { status: 500 });
+				let s = yield* P.promise(() => r(i).catch(() => null));
+				if (s === null) return G.text("unauthorized", { status: 401 });
+				a = s.subject, o = s.credentialExpiresAt;
+			}
+			let s = yield* r.upgrade;
+			return yield* ie(s, r.source.socket, n, a, i, o, (e) => t.error("gateway handler failed", { path: n.path }, e)), G.empty({ status: 200 });
+		})))));
+		Me = F.mergeAll(...n);
+	}
+	let Ne = U.make.pipe(P.provideService(U.RouterConfig, {
+		caseSensitive: !0,
+		ignoreTrailingSlash: !1,
+		ignoreDuplicateSlashes: !1
+	})), Pe = F.mergeAll(ke, Oe, be, C, z, Se, ...Me === void 0 ? [] : [Me]), Fe = e.pluginHttpInterceptor, q = Number(process.env.VOLTRO_MAX_RPC_BODY_BYTES), J = e.maxRpcBodyBytes ?? (Number.isFinite(q) && q > 0 ? q : 8388608), Ye = Number(process.env.VOLTRO_MAX_BODY_BYTES), Ze = e.maxBodyBytes ?? (Number.isFinite(Ye) && Ye > 0 ? Ye : 8388608), Y = { "cache-control": "no-store" }, Qe = e.httpRoutes?.some((e) => e.cors !== void 0 || e.credentials !== void 0) ? u(f(e.httpRoutes)) : () => void 0, $e = ue({
+		...e.security?.originGuard === void 0 ? {} : { mode: e.security.originGuard },
+		...e.security?.allowedOrigins === void 0 ? {} : { allowedOrigins: e.security.allowedOrigins }
+	}), et = le({
+		...e.webhookRoutes === void 0 ? {} : { webhookPaths: e.webhookRoutes.keys() },
+		...e.httpRoutes === void 0 ? {} : { httpRoutes: e.httpRoutes }
+	}), tt = me(e.security?.headers), X = H({ scope: "voltro:security" }), nt = H({ scope: "voltro:rpc" }), rt = (e) => {
+		try {
+			let t = new URL(e, "http://voltro.invalid").searchParams.get("voltro-socket-id");
+			return t !== null && /^[A-Za-z0-9-]{1,80}$/.test(t) ? t : void 0;
+		} catch {
+			return;
+		}
+	}, it = (e) => {
+		let t = Object.create(e);
+		return Object.defineProperty(t, "upgrade", {
+			configurable: !0,
+			get: () => P.gen(function* () {
+				let t = yield* e.upgrade, n = xe(), r = rt(e.url), i = Date.now();
+				return nt.info("rpc websocket opened", {
+					replicaId: a,
+					instanceId: qe(),
+					connectionId: n,
+					...r === void 0 ? {} : { clientSocketId: r }
+				}), yield* P.addFinalizer(() => P.sync(() => {
+					nt.info("rpc websocket closed", {
+						replicaId: a,
+						instanceId: qe(),
+						connectionId: n,
+						...r === void 0 ? {} : { clientSocketId: r },
+						durationMs: Date.now() - i
+					});
+				})), t;
+			})
+		}), t;
+	}, at = (e, t) => {
+		let n = e.headers, r = he(tt, {
+			contentType: n["content-type"],
+			https: t
+		}), i = {};
+		for (let [e, t] of Object.entries(r)) n[e] === void 0 && (i[e] = t);
+		return Object.keys(i).length === 0 ? e : G.setHeaders(e, i);
+	}, ot = (e, t) => e.toUpperCase() === "GET" && (t.upgrade ?? "").toLowerCase().includes("websocket"), st = (e) => P.gen(function* () {
+		let t = yield* W.HttpServerRequest, n = {};
+		for (let [e, r] of Object.entries(t.headers)) r !== void 0 && (n[e.toLowerCase()] = Array.isArray(r) ? r.join(", ") : r);
+		let r = t.url.indexOf("?"), a = r === -1 ? t.url : t.url.slice(0, r), o, s = !1;
+		try {
+			let e = t.source?.socket;
+			o = e?.remoteAddress, s = e?.encrypted === !0;
+		} catch {
+			o = void 0;
+		}
+		let c = fe({
+			socketEncrypted: s,
+			socketAddress: o,
+			xForwardedProto: n["x-forwarded-proto"],
+			config: B
+		}), l = de({
+			socketAddress: o,
+			headers: n,
+			config: B
+		}), u = t.method === "OPTIONS" ? n["access-control-request-method"] ?? t.method : t.method, d = (Qe(a)?.routes ?? []).filter((e) => Ke(e, a)), f = d.find((e) => e.method === u || e.method === "*" || u === "HEAD" && e.method === "GET"), p = f ?? d[0], m = We(p?.cors, n.origin), h = (e) => {
+			let t = e.headers.vary, n = p?.cors !== void 0 && t !== void 0 ? {
+				...m,
+				vary: [...new Set(`${t}, Origin`.split(",").map((e) => e.trim()))].join(", ")
+			} : m;
+			return at(G.setHeaders(e, n), c);
+		};
+		if (t.method === "OPTIONS" && f?.cors !== void 0 && n["access-control-request-method"] !== void 0) {
+			let e = Ge(f.cors, f.method, n);
+			return h(G.empty({
+				status: e.status,
+				headers: e.headers
+			}));
+		}
+		if (t.method === "POST" && a === "/rpc") {
+			let e = n["content-length"];
+			if (e !== void 0 && Number(e) > J) return h(G.text("rpc payload too large", {
+				status: 413,
+				headers: Y
+			}));
+		}
+		let _ = a === "/rpc" && ce(t.method), v = (a === i || je.has(a)) && ot(t.method, n);
+		if (ce(t.method) && !et(a) && f?.credentials !== "bearer" || v) {
+			let e = se({
+				headers: n,
+				config: $e
+			});
+			if (!e.allowed) return X.warn("refused cross-site request", {
+				path: a,
+				method: t.method,
+				reason: e.reason,
+				origin: e.origin,
+				surface: v ? "websocket-upgrade" : _ ? "rpc" : "http-route"
+			}), h(G.text("origin not allowed", {
+				status: 403,
+				headers: Y
+			}));
+		}
+		let y = _ ? P.gen(function* () {
+			let r = yield* A(t.source, J);
+			return r._tag === "aborted" ? h(G.text("rpc request body incomplete", {
+				status: 400,
+				headers: Y
+			})) : r._tag === "too-large" ? (X.warn("refused an over-cap rpc body", {
+				path: a,
+				cap: J,
+				receivedAtLeast: r.received,
+				declaredLength: n["content-length"] ?? null
+			}), h(G.text("rpc payload too large", {
+				status: 413,
+				headers: Y
+			}))) : yield* P.provideService(e, W.HttpServerRequest, te(g(t, l), r.bytes));
+		}) : e, b = v && a === i ? it(g(t, l)) : t, x = b === t ? y : P.provideService(y, W.HttpServerRequest, b);
+		if (!Fe) {
+			let e = yield* x;
+			return G.isHttpServerResponse(e) ? h(e) : e;
+		}
+		let S = yield* P.tryPromise(() => Fe(async () => null, {
+			method: t.method,
+			path: a,
+			headers: n,
+			remoteAddr: l
+		})).pipe(P.catch((e) => P.sync(() => (lt.error("http interceptor threw — request REFUSED (fail-closed)", {
+			method: t.method,
+			path: a
+		}, e), {
+			status: 500,
+			body: "internal error",
+			headers: void 0
+		}))));
+		if (S !== null) return h(G.text(S.body ?? "", {
+			status: S.status,
+			...S.headers ? { headers: S.headers } : {}
+		}));
+		let C = yield* x;
+		return G.isHttpServerResponse(C) ? h(C) : C;
+	}), Z = o === void 0 ? void 0 : new Et(p);
+	if (o !== void 0 && Z !== void 0) {
+		let e = new Promise((e) => {
+			let t = (n) => {
+				n === "request" && (Z.removeListener("newListener", t), e());
+			};
+			Z.on("newListener", t);
+		});
+		Dt.set(p, e), e.then(() => {
+			o.delegate({
+				request: (e, t) => {
+					Z.emit("request", e, t);
+				},
+				upgrade: (e, t, n) => {
+					Z.emit("upgrade", e, t, n);
+				}
+			});
+		});
+	}
+	let ct = F.unwrap(P.gen(function* () {
+		let e = yield* Ne;
+		return yield* F.build(F.provide(Pe, F.succeed(U.HttpRouter, e))), e.asHttpEffect();
+	}).pipe(P.map((e) => Le.serve(st(e.pipe(P.catchIf((e) => Re.isHttpServerError(e) && e.reason._tag === "RouteNotFound", (e) => {
+		let t = Ce(e.request.url.split("?")[0]);
+		return t === void 0 ? P.fail(e) : t.effect;
+	}))))))).pipe(F.provide(ze.layer(() => Z ?? p, n === void 0 ? { port: t } : {
+		port: t,
+		host: n
+	})), F.provide(Ve.layer), F.provide(Xe));
+	e.tracerLayer && (ct = ct.pipe(F.provide(oe), F.provide(e.tracerLayer)));
+	let Q = H({ scope: "voltro:rpc" }), ut = F.launch(ct).pipe(P.catchCause((e) => P.sync(() => {
+		Q.error("rpc server crashed", {}, M.squash(e)), process.exit(1);
+	}))), ft = P.runFork(ut);
+	return Ot.add(ft), Lt(), {
+		server: p,
+		shutdown: async () => {
+			Ot.delete(ft);
+			let e = P.runPromise(ve.interrupt(ft)).then(() => void 0, () => void 0);
+			for (let e of m) e.destroy();
+			p.closeIdleConnections(), await e, o !== void 0 && await o.close();
+		}
+	};
+}, Et = class extends Fe {
+	bound;
+	constructor(e) {
+		super(), this.bound = e;
+	}
+	listen(...e) {
+		let t = e.find((e) => typeof e == "function");
+		return t !== void 0 && process.nextTick(t), this;
+	}
+	address() {
+		return this.bound.address();
+	}
+}, Dt = /* @__PURE__ */ new WeakMap(), Ot = /* @__PURE__ */ new Set(), kt = /* @__PURE__ */ new Set(), At = !1, jt = (e) => (kt.add(e), () => {
+	kt.delete(e);
+}), Mt = 1e4, Nt = 1e3, Pt = 3e5, Ft = () => {
+	let e = process.env.VOLTRO_SHUTDOWN_GRACE_MS;
+	if (e === void 0 || e === "") return Mt;
+	let t = Number(e);
+	return !Number.isFinite(t) || t <= 0 ? Mt : Math.min(Pt, Math.max(Nt, Math.trunc(t)));
+}, It = (e) => {
+	let t = Date.now(), n = !1, r = (r) => () => {
+		n || (n = !0, clearTimeout(i), e.onOutcome?.({
+			reason: r,
+			ms: Date.now() - t
+		}), e.exit());
+	}, i = setTimeout(r("deadline"), e.deadlineMs);
+	i.unref?.(), Promise.all(e.hooks.map((e) => Promise.resolve().then(e).then(() => void 0, () => void 0))).then(() => Promise.all(e.fibers.map((e) => P.runPromise(ve.interrupt(e)).then(() => void 0, () => void 0)))).then(r("drained"), r("drained"));
+}, Lt = () => {
+	if (At) return;
+	At = !0;
+	let e = () => {
+		let e = [...Ot], t = [...kt];
+		Ot.clear(), kt.clear(), It({
+			fibers: e,
+			hooks: t,
+			deadlineMs: Ft(),
+			exit: () => process.exit(0),
+			onOutcome: ({ reason: e, ms: t }) => {
+				e === "drained" ? ut.info(`drained in ${t}ms`) : ut.error(`drain deadline exceeded — cut at ${t}ms`, { hint: "a shutdown hook or a pool drain did not complete; whatever had not finished did not happen" });
+			}
+		});
+	};
+	process.once("SIGINT", e), process.once("SIGTERM", e);
+}, Rt = (e, t = 1e4) => new Promise((n, r) => {
+	if (e.listening) {
+		let i = Dt.get(e);
+		if (i === void 0) {
+			n();
+			return;
+		}
+		let a = setTimeout(() => r(/* @__PURE__ */ Error(`rpc server did not bind within ${t}ms`)), t);
+		i.then(() => {
+			clearTimeout(a), n();
+		});
+		return;
+	}
+	let i = !1, a;
+	function o(t) {
+		i || (i = !0, clearTimeout(a), e.removeListener("listening", s), e.removeListener("error", c), t ? r(t) : n());
+	}
+	function s() {
+		o();
+	}
+	function c(e) {
+		o(e);
+	}
+	a = setTimeout(() => o(/* @__PURE__ */ Error(`rpc server did not bind within ${t}ms`)), t), e.on("listening", s), e.on("error", c);
+});
+//#endregion
+export { wt as DEFAULT_MAX_RPC_BODY_BYTES, Rt as awaitServerListening, ot as bindComputedUntyped, Ct as bindMutation, ct as bindStream, st as bindSubscription, nt as bindSubscriptionUntyped, yt as defectMessage, It as drainForShutdown, ht as isInfraError, xt as makeMutationOutputCodec, jt as onProcessShutdown, it as resetComputedQueryCacheWarnings, Ft as shutdownGraceMsFromEnv, Tt as startRpcServer };