@voltro/runtime 0.85.0 → 0.87.0

package/dist/rpcServer.js

@@ -0,0 +1,1065 @@
+import { crdtFoldCell as e, crdtIncrementalCell as t } from "./crdtMerge.js";
+import { resolveDependentTables as n } from "./dependencyGraph.js";
+import { buildSubjectKey as r } from "./rywPositionStore.js";
+import { runWithRoutingContext as i, runWithRoutingContextEffect as a } from "./replicatedDataStore.js";
+import { makeDefaultRefilter as o, rowFilterMayNarrow as s } from "./rowFilter.js";
+import { captureRpcWorkloadAdmission as c, selectRpcWorkloadGroup as l } from "./rpcWorkloadAdmission.js";
+import { applyKeepAlive as u, resolveKeepAlive as d } from "./httpKeepAlive.js";
+import { rpcFrameDefects as f } from "./rpcDefectDiagnostics.js";
+import { makeHttpRouteGroupFinder as p, makeUnmatchedGroupFinder as m, planHttpRouteMounts as h } from "./httpRouteMounts.js";
+import { isComputedQuery as g } from "./computedQuery.js";
+import { registerConnectionStream as _ } from "./connectionCredentials.js";
+import { getRpcConnection as v, withRpcClientAddress as y, withRpcConnectionIdentity as b } from "./rpcConnections.js";
+import { makeSubscriptionOutbox as x, pumpOutbox as S, reactiveSocketTunables as C } from "./subscriptionOutbox.js";
+import { adoptDetached as ee, canonicalInputKey as te, detachForResume as ne, recordForResume as re } from "./subscriptionResume.js";
+import { externalSpanFromTraceparent as ie, newTraceId as w, parseTraceparent as T } from "./traceparent.js";
+import { runWithTraceContext as E } from "./traceContext.js";
+import { runWithObservedProcedure as D } from "./observedGraph.js";
+import { actingUserId as O } from "./storeMiddleware.js";
+import { readCappedBody as ae, withBufferedBody as oe } from "./rpcBodyCap.js";
+import { dispatchHttpInputStream as se } from "./httpInputStream.js";
+import { maybeCompress as ce, mergeCompressionHeaders as le } from "./httpCompression.js";
+import { runWebSocketGateway as ue } from "./webSocketGatewayRuntime.js";
+import { noteResumeVerdict as de } from "./resumeCensus.js";
+import { publishServerTracerLayer as fe } from "./serverTracer.js";
+import { boundByCredential as pe } from "./credentialBound.js";
+import { classifyRequestOrigin as me, isStateChangingMethod as he, makeOriginGuardExemption as ge, resolveOriginGuardConfig as _e } from "./originGuard.js";
+import { resolveRequestClientAddress as ve, resolveRequestIsHttps as ye, resolveTrustedProxies as be } from "./trustedProxy.js";
+import { resolveSecurityHeaders as xe, securityHeadersFor as Se } from "./securityHeaders.js";
+import { assertWebhookRoutesDeclareVerification as Ce } from "./webhookVerification.js";
+import { Cause as k, Context as we, Deferred as A, Effect as j, Fiber as Te, Layer as M, Queue as N, Schema as P, Stream as F } from "effect";
+import { extractDbCause as Ee, hasEagerLoads as I, runWithWriteAttribution as L } from "@voltro/database";
+import { randomUUID as De } from "node:crypto";
+import { ConnectionInfo as R, MUTATION_IN_FLIGHT_RETRY_AFTER_MS as Oe, MutationConnectionRequired as z, MutationIdempotencyRefused as ke, MutationInFlight as Ae, SubjectService as je, Unauthenticated as Me, beginIdempotent as Ne, currentSubjectAuthority as Pe, defineWebSocket as Fe, failIdempotent as Ie, finishIdempotent as Le, groupShapeDigests as Re, holdIdempotentClaim as ze, prepareIdempotentInput as Be, recheckGuardsEffect as Ve, validateHttpStreamMaxDuration as He, wsMutationIdempotencyScope as Ue } from "@voltro/protocol";
+import { LoggerLayer as We, createLogger as B } from "@voltro/logger";
+import { RpcSerialization as Ge, RpcServer as V } from "effect/rpc";
+import { Server as Ke, createServer as qe } from "node:http";
+import { HttpRouter as H, HttpServer as Je, HttpServerError as Ye, HttpServerRequest as U, HttpServerResponse as W } from "effect/http";
+import { NodeHttpServer as Xe, NodeHttpServerRequest as Ze, NodeServices as Qe } from "@effect/platform-node";
+import { dispatchSharedPath as $e, restCorsHeaders as et, restCorsPreflight as tt, routeAcceptsPath as nt } from "@voltro/protocol/rest";
+import { instanceId as rt, replicaId as it } from "@voltro/protocol/identity";
+//#region src/rpcServer.ts
+var at = (e) => {
+	let t = e.indexOf(".");
+	if (t <= 0) return;
+	let n = e.slice(0, t), r = e.slice(t + 1);
+	if (r !== "" && r.includes(".")) {
+		if (n === "subscription") return {
+			tag: r,
+			kind: "query"
+		};
+		if (n === "query" || n === "mutation" || n === "action" || n === "stream") return {
+			tag: r,
+			kind: n
+		};
+	}
+}, G = (e, t) => {
+	let n = at(e);
+	return n === void 0 ? t() : D(n, t);
+}, ot = (e, t, n, r) => e === "subject" ? `${t}:s:${n}` : e === "global" ? `${t}:global` : r.tenantId == null ? void 0 : `${t}:t:${r.tenantId}`, st = We({}), K = (e, t) => j.callback((n) => {
+	let r = L(t, () => j.runFork(e.pipe(j.provide(st))));
+	return r.addObserver((e) => {
+		n(e);
+	}), j.asVoid(Te.interrupt(r));
+}), ct = (e, t, n, r) => {
+	let i = n === void 0 ? void 0 : v(n);
+	return {
+		subject: e,
+		traceId: t?.traceId ?? w(),
+		...r === void 0 ? {} : { cookieHeader: r },
+		...t?.spanId === void 0 ? {} : { spanId: t.spanId },
+		...n === void 0 ? {} : { clientId: n },
+		...i === void 0 ? {} : { connection: i },
+		...i?.remoteAddr === void 0 ? {} : { remoteAddr: i.remoteAddr }
+	};
+}, lt = j.currentSpan.pipe(j.catch(() => j.succeed(void 0))), ut = (e) => ({
+	traceId: e.traceId,
+	...e.spanId === void 0 ? {} : { spanId: e.spanId }
+}), dt = (e, t, n) => {
+	e !== void 0 && (e.attribute("rpc.tag", t), e.attribute("subject.type", n.type), n.tenantId !== void 0 && n.tenantId !== null && e.attribute("tenant.id", n.tenantId));
+}, ft = (e) => o(e, (e) => {
+	J.error("row filter failed to load — subscription", {}, e instanceof Error ? e : Error(String(e)));
+}), q = (e) => ({
+	single: (t) => j.runPromise(N.offer(e, t)),
+	end: () => N.endUnsafe(e)
+}), pt = (r, i, a, o, c, l, u, d, f, p) => F.callback((m) => j.gen(function* () {
+	let h = f ?? C(), g = i.crdtColumnsFor(r.table), v = x({
+		maxBufferedBytes: h.maxBufferedBytes,
+		overrunAfterMs: h.overrunAfterMs,
+		oversizedEventBytes: h.oversizedEventBytes,
+		label: c,
+		...g.size > 0 ? { crdt: {
+			columns: g,
+			merge: e,
+			incremental: t
+		} } : {}
+	});
+	yield* j.addFinalizer(() => j.sync(() => v.close()));
+	let y = s([...n(r)]), b = d !== void 0 && (I(r) || y), ie = p !== void 0 && !b, w = ie ? te(p.input) : "unused", T = ie && w !== "uncanonical" ? {
+		label: c,
+		inputKey: w,
+		subjectId: a.subject.id ?? "anonymous",
+		tenantId: a.subject.tenantId ?? ""
+	} : void 0;
+	de(c, p === void 0 ? "not-offered" : b ? y ? "row-filter" : "eager-load" : w !== "uncanonical" || "uncanonical-input");
+	let E = { current: (e) => {
+		T !== void 0 && re(T, e), v.push(e);
+	} };
+	if (T !== void 0 && p?.fromRevision !== void 0 && p.reconcile === void 0) {
+		let e = u !== void 0 && (yield* j.tryPromise(() => u()).pipe(j.match({
+			onFailure: () => !0,
+			onSuccess: (e) => !!e
+		}))) ? void 0 : ee(T, p.fromRevision);
+		if (e !== void 0) {
+			for (let t of e.deltas) v.push({
+				_tag: "delta",
+				revision: t.revision,
+				emittedAt: t.emittedAt,
+				patch: t.patch
+			});
+			e.sink.current = E.current;
+			let t = e.unsubscribe;
+			if (yield* j.addFinalizer(() => j.sync(() => {
+				e.sink.current = () => {}, ne(T, {
+					sink: e.sink,
+					unsubscribe: t
+				});
+			})), yield* j.forkScoped(j.promise(() => S(v, q(m), c))), a.clientId !== void 0) {
+				let e = _(a.clientId, () => {
+					N.endUnsafe(m);
+				});
+				yield* j.addFinalizer(() => j.sync(() => e()));
+			}
+			return;
+		}
+	}
+	let D = yield* j.tryPromise(() => i.subscribe(r, (e) => {
+		E.current(e);
+	}, a, o, c, p?.reconcile === void 0 ? l : void 0, u, d, p?.reconcile !== void 0)).pipe(j.matchCause({
+		onFailure: (e) => (X(`subscription.${c}`, a.traceId, e), {
+			ok: !1,
+			error: Tt(e)
+		}),
+		onSuccess: (e) => ({
+			ok: !0,
+			unsubscribe: e
+		})
+	}));
+	if (!D.ok) {
+		N.offerUnsafe(m, {
+			_tag: "error",
+			error: D.error
+		}), N.endUnsafe(m);
+		return;
+	}
+	let O = D.unsubscribe;
+	if (yield* j.addFinalizer(() => j.sync(() => {
+		T === void 0 ? O() : (E.current = () => {}, ne(T, {
+			sink: E,
+			unsubscribe: O
+		}));
+	})), yield* j.forkScoped(j.promise(() => S(v, q(m), c))), a.clientId !== void 0) {
+		let e = _(a.clientId, () => {
+			N.endUnsafe(m);
+		});
+		yield* j.addFinalizer(() => j.sync(() => e()));
+	}
+}), { bufferSize: 1 }), mt = (e, t, n, r, i) => F.callback((a) => j.gen(function* () {
+	let o = i ?? C(), s = x({
+		maxBufferedBytes: o.maxBufferedBytes,
+		overrunAfterMs: o.overrunAfterMs,
+		oversizedEventBytes: o.oversizedEventBytes,
+		label: r
+	});
+	yield* j.addFinalizer(() => j.sync(() => s.close()));
+	let c = yield* j.tryPromise(() => t.subscribeComputed(e, (e) => {
+		s.push(e._tag === "snapshot" ? {
+			...e,
+			computed: !0
+		} : e);
+	}, n, r)).pipe(j.matchCause({
+		onFailure: (e) => (X(`subscription.${r}`, n.traceId, e), {
+			ok: !1,
+			error: Tt(e)
+		}),
+		onSuccess: (e) => ({
+			ok: !0,
+			unsubscribe: e
+		})
+	}));
+	if (!c.ok) {
+		N.offerUnsafe(a, {
+			_tag: "error",
+			error: c.error
+		}), N.endUnsafe(a);
+		return;
+	}
+	let l = c.unsubscribe;
+	if (de(r, "computed"), yield* j.addFinalizer(() => j.sync(() => l())), yield* j.forkScoped(j.promise(() => S(s, q(a), r))), n.clientId !== void 0) {
+		let e = _(n.clientId, () => {
+			N.endUnsafe(a);
+		});
+		yield* j.addFinalizer(() => j.sync(() => e()));
+	}
+}), { bufferSize: 1 }), ht = (e, t, n = "rpc.subscription", o, s, c, l) => F.unwrap(j.gen(function* () {
+	let u = yield* je, d = yield* R, f = (e) => {
+		let t = F.make({
+			_tag: "error",
+			error: new Me({ reason: "The session has expired. Sign in again." })
+		});
+		return pe(e, d.credentialExpiresAt, t, t);
+	}, p = yield* lt;
+	dt(p, n, u);
+	let m = ct(u, p, d.clientId, d.cookieHeader), h = r(u.id, d.clientId), _ = {
+		subjectKey: h,
+		...d.reconcile === void 0 ? {} : { forcePrimary: !0 }
+	}, v = i(_, () => E({
+		traceId: m.traceId,
+		...m.spanId === void 0 ? {} : { spanId: m.spanId }
+	}, () => G(n, () => e(m)))), y = j.isEffect(v) ? yield* a(_, v).pipe(j.matchCause({
+		onFailure: (e) => (X(`subscription.${n}`, m.traceId, e), {
+			ok: !1,
+			error: Tt(e)
+		}),
+		onSuccess: (e) => ({
+			ok: !0,
+			value: e
+		})
+	})) : {
+		ok: !0,
+		value: v
+	};
+	if (!y.ok) return F.make({
+		_tag: "error",
+		error: y.error
+	});
+	let b = y.value;
+	if (g(b)) return f(gt(mt(d.reconcile === void 0 ? b : {
+		...b,
+		recompute: () => i(_, b.recompute)
+	}, t, m, n), d.reconcile));
+	let x = b, S = o?.(x), C = s === void 0 ? void 0 : ot(s.scope, s.baseKey, h, u);
+	return f(gt(pt(x, t, m, S, n, s === void 0 || C === void 0 ? void 0 : {
+		key: C,
+		ttlMs: s.ttlMs,
+		swrMs: s.swrMs,
+		label: n.replace(/^subscription\./, "")
+	}, c?.(u), l?.(u) ?? ft(u), void 0, {
+		input: x,
+		...d.resumeFrom === void 0 ? {} : { fromRevision: d.resumeFrom },
+		...d.reconcile === void 0 ? {} : { reconcile: d.reconcile }
+	}), d.reconcile));
+}).pipe(j.withSpan(n, { attributes: { "framework.kind": "subscription" } }))), gt = (e, t) => t === void 0 ? e : e.pipe(F.mapAccum(() => !1, (e, n) => !e && n._tag === "snapshot" ? [!0, [{
+	...n,
+	reconciles: t
+}]] : [e, [n]])), _t = (e, t = "rpc.stream", n, r, i) => F.unwrap(j.gen(function* () {
+	let a = yield* je, o = yield* R, s = yield* lt;
+	dt(s, t, a);
+	let c = ct(a, s, o.clientId, o.cookieHeader), l = n ?? [], u = () => Ve(a, l, r), d = j.gen(function* () {
+		let n = yield* u();
+		if (n) return yield* j.fail(n);
+		let r = G(t, () => e(c));
+		return j.isEffect(r) ? yield* r : r;
+	}), f = yield* (i?.interceptor ? i.interceptor(d, {
+		tag: i.tag,
+		kind: "stream",
+		input: r,
+		subject: a,
+		traceId: c.traceId,
+		...c.spanId === void 0 ? {} : { spanId: c.spanId },
+		...c.remoteAddr === void 0 ? {} : { remoteAddr: c.remoteAddr }
+	}) : d).pipe(j.catchCause((e) => j.succeed(F.failCause(e)))), p = F.flatMap(f, (e) => F.unwrap(u().pipe(j.map((t) => t ? F.fail(t) : F.make(e))))), m = pe(p, o.credentialExpiresAt, F.empty);
+	if (c.clientId === void 0) return m;
+	let h = c.clientId;
+	return F.unwrap(j.gen(function* () {
+		let e = yield* A.make(), t = _(h, () => {
+			A.doneUnsafe(e, j.void);
+		});
+		return yield* j.addFinalizer(() => j.sync(() => t())), m.pipe(F.interruptWhen(A.await(e)));
+	}));
+}).pipe(j.withSpan(t, { attributes: { "framework.kind": "stream" } }))), J = B({ scope: "voltro:rpc" }), vt = B({ scope: "voltro:http" }), Y = B({ scope: "voltro:shutdown" }), yt = (e) => {
+	if (e instanceof Error) {
+		let t = e._tag;
+		return {
+			name: e.name,
+			message: e.message,
+			...typeof t == "string" ? { tag: t } : {},
+			...e.stack === void 0 ? {} : { stack: e.stack.split("\n").slice(1, 4).map((e) => e.trim()) }
+		};
+	}
+	if (typeof e == "object" && e) {
+		let t = e._tag;
+		return {
+			...typeof t == "string" ? { tag: t } : {},
+			value: String(e).slice(0, 300)
+		};
+	}
+	return { value: String(e).slice(0, 300) };
+}, X = (e, t, n) => {
+	if (k.hasInterruptsOnly(n)) return;
+	let r = k.squash(n), i = r?._tag, a = r instanceof Error ? r.message : r?.message ?? String(r), o = k.hasDies(n), s = Ee(r), c = {
+		traceId: t,
+		...i === void 0 ? {} : { errorTag: i },
+		...s
+	}, l = a === "Failed to execute statement" && typeof s.dbMessage == "string" ? s.dbMessage : a;
+	o ? J.error(`${e} failed: ${l}`, c) : J.warn(`${e} failed: ${l}`, c);
+}, bt = /* @__PURE__ */ new Set([
+	"SqlError",
+	"ResultLengthMismatch",
+	"FieldDecryptionError"
+]), Z = (e) => typeof e == "object" && !!e && typeof e._tag == "string" && bt.has(e._tag), xt = (e, t) => {
+	try {
+		return P.is(e)(t);
+	} catch {
+		return !0;
+	}
+}, St = /* @__PURE__ */ new Set(), Ct = (e, t) => {
+	let n = `${e}\u0000${t}`;
+	St.has(n) || (St.size >= 1e3 && St.clear(), St.add(n), J.warn(`${e} failed with '${t}', which is undeclared on its wire union — the client received InternalError instead. Add ${t} to the descriptor's \`error:\`, register it app-wide through a plugin's \`errorSchemas\`, or map it to a declared error (\`Effect.orDie\` if it is a defect). \`defineExecutor\` reports this at compile time.`, {
+		procedure: e,
+		errorTag: t
+	}));
+}, wt = (e, t = "internal server error") => ({
+	_tag: "InternalError",
+	message: t,
+	traceId: e
+}), Q = (e) => {
+	let t = e instanceof Error ? e.message : e?.message, n = typeof t == "string" && t.length > 0 ? t : String(e), r = e?._tag, i = typeof r == "string" && r.length > 0 && !n.startsWith(r) ? `${r}: ${n}` : n;
+	return i.length <= 500 ? i : `${i.slice(0, 500)}…`;
+}, Tt = (e) => {
+	let t = k.squash(e);
+	if (t && typeof t == "object" && t._tag === "UnknownError" && (t = t.error ?? t.cause ?? t), Z(t)) return {
+		_tag: "InternalError",
+		message: "internal server error"
+	};
+	let n = t && typeof t == "object" ? t : {}, r = {};
+	for (let [e, t] of Object.entries(n)) e !== "cause" && e !== "stack" && e !== "message" && (t === null || typeof t == "string" || typeof t == "number" || typeof t == "boolean") && (r[e] = t);
+	let i = t?._tag, a = t instanceof Error ? t.message : t?.message;
+	return {
+		...r,
+		...typeof i == "string" ? { _tag: i } : {},
+		message: typeof a == "string" ? a : String(t)
+	};
+}, Et = (e, t, n) => {
+	let r = P.encodeUnknownSync(t), i = P.decodeUnknownSync(t);
+	return {
+		input: e,
+		admit: n,
+		encode: (e) => {
+			try {
+				return r(e);
+			} catch {
+				throw Error("Mutation output cannot be recorded for replay");
+			}
+		},
+		decode: (e) => {
+			try {
+				return i(e);
+			} catch {
+				throw Error("Stored mutation response is incompatible with the current output contract");
+			}
+		}
+	};
+}, Dt = (e) => {
+	let t = {}, n;
+	for (let [r, i] of Object.entries(e ?? {})) Array.isArray(i) ? r.toLowerCase() === "set-cookie" ? n = i : t[r] = i.join(", ") : t[r] = i;
+	return {
+		headers: t,
+		setCookie: n
+	};
+}, Ot = (e, t, n = "rpc.mutation", a, o, s, c = "subject") => j.gen(function* () {
+	let l = t, u = yield* je, d = yield* R, f = yield* lt;
+	dt(f, n, u);
+	let p = ct(u, f, d.clientId, d.cookieHeader), m = async () => {
+		if (typeof a?.admit != "function") throw Error("Missing current mutation admission");
+		await a.admit(l, p);
+	}, h = () => j.tryPromise({
+		try: m,
+		catch: (e) => e
+	}), g = c === "connection";
+	if (g && (p.connection?.transport !== "websocket" || p.connection.signal.aborted)) return yield* j.fail(new z({ traceId: p.traceId }));
+	let _ = o && d.idempotencyKey ? {
+		store: o.store,
+		ttlMs: o.ttlMs,
+		key: d.idempotencyKey,
+		scope: Ue(u.tenantId, O(u), n, g ? p.connection?.id : void 0)
+	} : null, v = r(u.id, d.clientId), y = {
+		traceId: p.traceId,
+		subjectId: O(u),
+		procedure: n
+	}, b = (t = (e) => e) => j.suspend(() => {
+		let r = i({ subjectKey: v }, () => E({
+			traceId: p.traceId,
+			...p.spanId === void 0 ? {} : { spanId: p.spanId }
+		}, () => L(y, () => G(n, () => e(l, {
+			...p,
+			subject: Pe(u)
+		})))));
+		return j.isEffect(r) ? t(K(r, y)) : j.tryPromise({
+			try: () => Promise.resolve(r),
+			catch: (e) => e
+		});
+	}), x = !1, S;
+	return yield* (_ ? j.acquireUseRelease(j.tryPromise({
+		try: async () => {
+			let e;
+			try {
+				if (!a) throw Error("Missing declared mutation codec");
+				let n = await Be(a.input, t, u);
+				l = n.input, e = n.fingerprint;
+			} catch {
+				throw new ke({
+					traceId: p.traceId,
+					reason: "input-unavailable"
+				});
+			}
+			await m();
+			let n = await Ne(_.store, _.scope, _.key, e, _.ttlMs, Date.now());
+			return n.kind === "fresh" && (S = ze(_.store, n.claim)), n;
+		},
+		catch: (e) => e
+	}), (e) => j.gen(function* () {
+		if (yield* j.yieldNow, yield* h(), g && p.connection?.signal.aborted) return yield* j.fail(new z({ traceId: p.traceId }));
+		if (e.kind === "replay") {
+			if (e.response.status !== 200) throw Error("Stored mutation response is unavailable");
+			try {
+				return a ? a.decode(e.response.body) : e.response.body;
+			} catch {
+				throw Error("Stored mutation response is incompatible with the current output contract");
+			}
+		}
+		return e.kind === "input-conflict" || e.kind === "input-unbound" ? yield* j.fail(new ke({
+			traceId: p.traceId,
+			reason: e.kind
+		})) : e.kind === "conflict" ? yield* j.fail(new Ae({
+			traceId: p.traceId,
+			retryAfterMs: Oe
+		})) : yield* j.uninterruptibleMask((t) => t(j.void).pipe(j.flatMap(() => b(t)), j.tap((t) => {
+			x = !0;
+			let n;
+			try {
+				n = {
+					status: 200,
+					body: a ? a.encode(t) : t
+				};
+			} catch {
+				n = {
+					status: 500,
+					body: null
+				};
+			}
+			return j.promise(async () => {
+				try {
+					if (!await Le(_.store, e.claim, n, Date.now())) throw Error("Original mutation claim is no longer owned");
+				} catch {
+					throw Error("Mutation replay receipt could not be retained");
+				}
+				if (n.status !== 200) throw Error("Mutation output cannot be recorded for replay");
+			});
+		})));
+	}), (e) => j.sync(() => S?.()).pipe(j.andThen(e.kind === "fresh" && !x ? j.promise(() => Ie(_.store, e.claim)).pipe(j.ignore) : j.void))) : a ? h().pipe(j.flatMap(() => b())) : b()).pipe(j.tapCause((e) => j.sync(() => X(n, p.traceId, e))), j.catchIf(Z, () => j.die(wt(p.traceId))), j.catchIf((e) => e instanceof Error && typeof e._tag != "string", (e) => j.die(wt(p.traceId, Q(e)))), j.catchIf((e) => s !== void 0 && typeof e?._tag == "string" && !xt(s, e), (e) => j.sync(() => Ct(n, e._tag)).pipe(j.andThen(j.die(wt(p.traceId, Q(e)))))), j.catchDefect((e) => e?._tag === "InternalError" ? j.die(e) : j.die(wt(p.traceId, Q(e)))), j.annotateLogs(ut(p)));
+}).pipe(j.withSpan(n, { attributes: { "framework.kind": "mutation" } })), kt = 8388608, At = (e) => {
+	let t = c(e.workloadAdmission), n = l(e.group, t, "http"), r = l(e.group, t, "websocket"), i = e.port ?? 4e3, a = e.host, o = e.path ?? "/ws", s = o, g = e.replicaId ?? it();
+	Ce(e.webhookRoutes);
+	let _ = e.listener, x = _?.server ?? qe(), S = /* @__PURE__ */ new Set();
+	x.on("connection", (e) => {
+		S.add(e), e.once("close", () => {
+			S.delete(e);
+		});
+	}), u(x, d(e));
+	let C = (t) => U.HttpServerRequest.pipe(j.flatMap((t) => j.gen(function* () {
+		if (!e.inspectRoute) return W.text("inspect route not configured", { status: 404 });
+		let n = {};
+		for (let [e, r] of Object.entries(t.headers)) r !== void 0 && (n[e.toLowerCase()] = Array.isArray(r) ? r.join(", ") : r);
+		let r = e.inspectRoute, i = r.binary?.[new URL(t.url, "http://inspect.invalid").pathname], a;
+		!i && t.method !== "GET" && t.method !== "HEAD" && t.method !== "OPTIONS" && (a = yield* t.text.pipe(j.orElseSucceed(() => "")));
+		let o = yield* j.promise(async (e) => {
+			if (!i) return r.handle(t.url, n, t.method, a, e);
+			let o = F.toReadableStream(t.stream);
+			return i(t.url, n, t.method, o, e);
+		});
+		if (o === null) return W.text("inspect route not found", { status: 404 });
+		if (o.byteStream !== void 0) {
+			let e = {
+				...o.headers,
+				...o.byteStream.contentLength === void 0 ? {} : { "content-length": String(o.byteStream.contentLength) },
+				...o.byteStream.contentDisposition === void 0 ? {} : { "content-disposition": o.byteStream.contentDisposition }
+			};
+			if (t.method === "HEAD") return W.empty({
+				status: o.status,
+				headers: {
+					...e,
+					"content-type": o.contentType
+				}
+			});
+			let n = o.byteStream.stream;
+			return W.stream(F.fromReadableStream({
+				evaluate: () => typeof n == "function" ? n() : n,
+				onError: (e) => e
+			}), {
+				status: o.status,
+				contentType: o.contentType,
+				headers: e
+			});
+		}
+		return W.text(o.body, {
+			status: o.status,
+			contentType: o.contentType,
+			headers: o.headers ?? {}
+		});
+	}))), ee = () => U.HttpServerRequest.pipe(j.flatMap((t) => {
+		let n = e.inspectStream;
+		if (!n) return j.succeed(W.text("inspect stream not configured", { status: 404 }));
+		let r = {};
+		for (let [e, n] of Object.entries(t.headers)) n !== void 0 && (r[e.toLowerCase()] = Array.isArray(n) ? n.join(", ") : n);
+		let i = n.corsHeaders(r.origin);
+		if (n.isDisabled()) return j.succeed(W.text(JSON.stringify({ error: "inspect disabled (VOLTRO_INSPECT=off)" }), {
+			status: 503,
+			contentType: "application/json; charset=utf-8",
+			headers: i
+		}));
+		let a = n.authorize(r);
+		return a.ok ? (n.select?.(t.url, r) ?? j.succeed(void 0)).pipe(j.flatMap((e) => {
+			if (e?.kind === "stream") return j.succeed(W.stream(e.stream, {
+				status: 200,
+				headers: {
+					...i,
+					"content-type": "text/event-stream; charset=utf-8",
+					"cache-control": "no-cache, no-transform",
+					"x-accel-buffering": "no"
+				}
+			}));
+			if (e?.kind === "refused") return j.succeed(W.text(JSON.stringify(e.body), {
+				status: e.status,
+				contentType: "application/json; charset=utf-8",
+				headers: i
+			}));
+			let r = new TextEncoder(), a = n.keepAliveMs ?? 15e3, o = t.url.indexOf("?"), s = o === -1 ? new URLSearchParams() : new URLSearchParams(t.url.slice(o + 1)), c = s.get("live") === "1", l = s.get("channels"), u = l ? new Set(l.split(",").map((e) => e.trim()).filter((e) => e.length > 0)) : void 0, d = (e) => {
+				if (!u || e.indexOf("event: ") !== 0) return !0;
+				let t = e.indexOf("\n", 7);
+				return t < 0 || u.has(e.slice(7, t).trim());
+			}, f = F.callback((e) => j.gen(function* () {
+				if (N.offerUnsafe(e, r.encode("retry: 5000\n\n")), !c) for (let t of n.replay()) d(t) && N.offerUnsafe(e, r.encode(t));
+				let t = n.subscribe((t) => {
+					d(t) && N.offerUnsafe(e, r.encode(t));
+				}), i = setInterval(() => {
+					N.offerUnsafe(e, r.encode(n.keepAlive()));
+				}, a);
+				yield* j.addFinalizer(() => j.sync(() => {
+					clearInterval(i), t();
+				}));
+			}));
+			return j.succeed(W.stream(f, {
+				status: 200,
+				headers: {
+					"content-type": "text/event-stream; charset=utf-8",
+					...n.replicaId ? { "x-voltro-replica-id": n.replicaId } : {},
+					"cache-control": "no-cache, no-transform",
+					connection: "keep-alive",
+					"x-accel-buffering": "no",
+					...i
+				}
+			}));
+		})) : j.succeed(W.text(JSON.stringify({
+			error: "unauthorized",
+			reason: a.reason
+		}), {
+			status: 401,
+			contentType: "application/json; charset=utf-8",
+			headers: i
+		}));
+	})), te = C(!0), ne = C(!1), re = H.add("*", "/_voltro/inspect/*", U.HttpServerRequest.pipe(j.flatMap((e) => e.url.split("?")[0] === "/_voltro/inspect" ? te : ne))), E = M.empty;
+	e.inspectRoute !== void 0 && (E = e.inspectStream === void 0 ? re : M.mergeAll(H.add("GET", "/_voltro/inspect/stream", ee()), re));
+	let D = e.publishSurfaceDigest === !0 ? Re(e.group) : void 0, O = e.serviceSurfaceTags ?? /* @__PURE__ */ new Set(), de = (e) => {
+		let t = Object.entries(D), n = 0;
+		for (let r of t) (e ? O.has(r[0]) : !O.has(r[0])) && (t[n++] = r);
+		return t.length = n, Object.fromEntries(t);
+	}, pe = D === void 0 ? void 0 : de(!1), A = D === void 0 || O.size === 0 ? void 0 : de(!0), P = j.succeed(W.text(JSON.stringify({
+		protocol: 1,
+		mutationReplay: e.mutationReplay === !0,
+		...pe === void 0 ? {} : { surface: pe },
+		...A === void 0 ? {} : { serviceSurface: A }
+	}), {
+		status: 200,
+		contentType: "application/json; charset=utf-8",
+		headers: {
+			"cache-control": "no-store",
+			"access-control-allow-origin": "*"
+		}
+	})), I = "/_voltro/runtime-capabilities", L = `${s.slice(0, s.lastIndexOf("/"))}/_voltro/runtime-capabilities`, R = L === I ? H.add("GET", I, P) : M.mergeAll(H.add("GET", I, P), H.add("GET", L, P)), Oe = M.empty;
+	if (e.webhookRoutes !== void 0 && e.webhookRoutes.size > 0) {
+		let t = (t) => U.HttpServerRequest.pipe(j.flatMap((n) => j.gen(function* () {
+			let r = {};
+			for (let [e, t] of Object.entries(n.headers)) t !== void 0 && (r[e.toLowerCase()] = Array.isArray(t) ? t.join(", ") : t);
+			let i = n.url.split("?")[0], a = t.maxBodyBytes ?? ot, o = /* @__PURE__ */ new Uint8Array();
+			if (n.method !== "GET" && n.method !== "HEAD") {
+				let e = Number(r["content-length"]);
+				if (Number.isFinite(e) && e > a) return W.text("payload too large", { status: 413 });
+				let t = yield* ae(n.source, a);
+				if (t._tag === "aborted") return W.text("request aborted", { status: 400 });
+				if (t._tag === "too-large") return W.text("payload too large", { status: 413 });
+				o = new Uint8Array(t.bytes);
+			}
+			let s = ie(r.traceparent), c = yield* j.promise(() => t.handle({
+				method: n.method,
+				path: i,
+				headers: r,
+				rawBody: o
+			})).pipe(j.withSpan(`webhook${i}`, {
+				attributes: {
+					"framework.kind": "webhook",
+					"http.route": i
+				},
+				...s ? { parent: s } : {}
+			})), l = new TextEncoder().encode(c.body), u = ce({
+				body: l,
+				contentType: c.contentType,
+				acceptEncoding: r["accept-encoding"],
+				options: e.compression
+			});
+			return u.compressed ? W.uint8Array(u.bytes, {
+				status: c.status,
+				contentType: c.contentType,
+				headers: u.headers
+			}) : W.text(c.body, {
+				status: c.status,
+				contentType: c.contentType
+			});
+		}))), n = Array.from(e.webhookRoutes.entries()).map(([e, n]) => H.add("*", e, t(n)));
+		Oe = M.mergeAll(...n);
+	}
+	let z = be(e.security?.trustedProxies, process.env, e.security?.clientAddressHeader), ke = M.empty, Ae = () => void 0;
+	if (e.httpRoutes !== void 0 && e.httpRoutes.length > 0) {
+		let t = (t) => U.HttpServerRequest.pipe(j.flatMap((n) => j.gen(function* () {
+			let r = {};
+			for (let [e, t] of Object.entries(n.headers)) t !== void 0 && (r[e.toLowerCase()] = Array.isArray(t) ? t.join(", ") : t);
+			let i = n.url.indexOf("?"), a = i >= 0 ? n.url.slice(0, i) : n.url, o = i >= 0 ? n.url.slice(i + 1) : "";
+			if (!t.some((e) => nt(e, a))) return W.text("not found", { status: 404 });
+			let s = t.reduce((e, t) => Math.max(e, t.maxBodyBytes ?? ot), 0), c = t[0]?.handleStream, l = /* @__PURE__ */ new Uint8Array();
+			if (c !== void 0 || n.method !== "GET" && n.method !== "HEAD") {
+				let e = Number(r["content-length"]);
+				if (Number.isFinite(e) && e > s) return W.text("payload too large", { status: 413 });
+				if (c === void 0) {
+					let e = yield* ae(n.source, s);
+					if (e._tag === "aborted") return W.text("request aborted", { status: 400 });
+					if (e._tag === "too-large") return W.text("payload too large", { status: 413 });
+					l = new Uint8Array(e.bytes);
+				}
+			}
+			let u = e.getStore?.(), d;
+			try {
+				d = n.source?.socket?.remoteAddress;
+			} catch {
+				d = void 0;
+			}
+			let f = ve({
+				socketAddress: d,
+				headers: r,
+				config: z
+			}), p = {
+				method: n.method,
+				path: a,
+				query: o,
+				headers: r,
+				...u === void 0 ? {} : { store: u },
+				...f === void 0 ? {} : { remoteAddr: f }
+			}, m = Date.now(), h = yield* j.promise((e) => c === void 0 ? $e(t, {
+				...p,
+				rawBody: l
+			}) : se(n.source, s, p, c, e));
+			if (e.onHttpRoute !== void 0) try {
+				e.onHttpRoute({
+					method: n.method,
+					path: a,
+					status: h.status,
+					durationMs: Date.now() - m,
+					traceId: T(r.traceparent)?.traceId ?? w()
+				});
+			} catch {}
+			h.status >= 500 && vt.warn(`${n.method} ${a} → ${h.status}`, {
+				method: n.method,
+				path: a,
+				status: h.status,
+				...typeof h.body == "string" && h.body.length > 0 ? { body: h.body.slice(0, 1e3) } : {},
+				...h.cause === void 0 ? {} : { cause: yt(h.cause) }
+			});
+			let g = Dt(h.headers), _ = g.headers, v = (e) => (g.setCookie !== void 0 && Ze.toServerResponse(n).setHeader("set-cookie", [...g.setCookie]), e), y = {
+				status: h.status,
+				...h.contentType ? { contentType: h.contentType } : {},
+				headers: _
+			};
+			if (h.byteStream !== void 0) {
+				let e = h.byteStream.stream, t = typeof e == "function" ? e() : e;
+				return v(W.stream(F.fromReadableStream({
+					evaluate: () => t,
+					onError: (e) => e
+				}), {
+					status: h.status,
+					contentType: h.contentType ?? "application/octet-stream",
+					headers: {
+						..._,
+						...h.byteStream.contentLength === void 0 ? {} : { "content-length": String(h.byteStream.contentLength) },
+						...h.byteStream.contentDisposition === void 0 ? {} : { "content-disposition": h.byteStream.contentDisposition }
+					}
+				}));
+			}
+			if (h.stream !== void 0) {
+				let { subscribe: e, keepAliveMs: t } = h.stream, n = He(h.stream.maxDurationMs), r = new TextEncoder(), i = t ?? 15e3, a = F.callback((t) => j.gen(function* () {
+					let n, a, o = !1;
+					yield* j.addFinalizer(() => j.sync(() => {
+						o = !0, a !== void 0 && clearInterval(a), n?.();
+					})), N.offerUnsafe(t, r.encode("retry: 5000\n\n"));
+					let s = e((e) => {
+						o || N.offerUnsafe(t, r.encode(e));
+					});
+					o ? s() : n = s, a = !o && i > 0 ? setInterval(() => {
+						N.offerUnsafe(t, r.encode(": keep-alive\n\n"));
+					}, i) : void 0;
+				})), o = n === void 0 ? a : a.pipe(F.interruptWhen(j.sleep(n)));
+				return v(W.stream(o, {
+					status: h.status,
+					headers: {
+						..._,
+						"content-type": "text/event-stream; charset=utf-8",
+						"cache-control": "no-cache, no-transform",
+						connection: "keep-alive",
+						"x-accel-buffering": "no"
+					}
+				}));
+			}
+			if (n.method === "HEAD") return v(W.empty({
+				status: y.status,
+				headers: _
+			}));
+			let b = h.body instanceof Uint8Array ? h.body : new TextEncoder().encode(h.body ?? ""), x = ce({
+				body: b,
+				contentType: h.contentType,
+				acceptEncoding: r["accept-encoding"],
+				options: e.compression
+			});
+			return v(W.uint8Array(x.bytes, {
+				...y,
+				headers: le(_, x.headers)
+			}));
+		})), j.tapCause((e) => k.hasInterruptsOnly(e) ? j.void : j.sync(() => vt.error(`${t.map((e) => e.method).join("|")} ${t[0].path} threw`, { path: t[0].path }, k.squash(e))))), n = h(e.httpRoutes), r = new Map(n.map((e) => [e, t(e.routes)])), i = m(n);
+		Ae = (e) => {
+			let t = i(e);
+			return t === void 0 ? void 0 : { effect: r.get(t) };
+		};
+		let a = n.flatMap((e) => {
+			let t = r.get(e);
+			return e.methods.map((n) => H.add(n, `${e.mountPath}/*`, t));
+		});
+		ke = M.mergeAll(...a);
+	}
+	let je = V.layerProtocolWebsocket({ path: o }), Me = (e) => {
+		let t = B({ scope: e }), n = /* @__PURE__ */ new Map();
+		return (e) => M.flatMap(e, (e) => {
+			let r = we.get(e, V.Protocol);
+			return M.succeedContext(we.make(V.Protocol, {
+				...r,
+				run: (e) => r.run((t, r) => j.suspend(() => {
+					if (r._tag === "Request") {
+						let e = n.get(t);
+						e === void 0 && (n.set(t, e = /* @__PURE__ */ new Map()), v(t)?.signal.addEventListener("abort", () => {
+							n.delete(t);
+						}, { once: !0 })), e.set(String(r.id), r.tag);
+					}
+					return e(t, r);
+				})),
+				end: (e) => (n.delete(e), r.end(e)),
+				send: (e, i, a) => j.suspend(() => {
+					let o = n.get(e), s = "requestId" in i ? String(i.requestId) : void 0, c = s === void 0 ? o?.size === 1 ? o.values().next().value : void 0 : o?.get(s);
+					i._tag === "Exit" && s !== void 0 && o?.delete(s);
+					for (let n of f(i)) {
+						let r = Ee(n), i = typeof r.dbMessage == "string" ? r.dbMessage : void 0;
+						t.error(i === void 0 ? "rpc defect sent to client" : `rpc defect sent to client: ${i}`, {
+							clientId: e,
+							defect: n,
+							...s === void 0 ? {} : { requestId: s },
+							...c === void 0 ? {} : { rpcTag: c },
+							...c === void 0 && o !== void 0 ? { rpcTags: [...new Set(o.values())] } : {},
+							...String(n).includes("Expected JSON value") ? { outputHint: "Schema.Unknown outputs must contain JSON values; declare date conversion in the output schema." } : {},
+							...r,
+							...i === void 0 ? {} : { hint: "the failing statement is in `_voltro_traces` (attributes.db.query.text) for this trace" }
+						});
+					}
+					return r.send(e, i, a);
+				})
+			}));
+		});
+	}, Ne = { disableFatalDefects: !0 }, Pe = V.layer(r, Ne), Ie = V.layer(n, Ne).pipe(M.provide(Me("voltro:rpc:http")(b(V.layerProtocolHttp({ path: "/rpc" }), "http"))), M.provide(Ge.layerJson), M.provide(e.httpHandlersLayer ?? e.handlersLayer)), Le = Pe.pipe(M.provide(Me("voltro:rpc")(b(je, "websocket"))), M.provide(Ge.layerJson), M.provide(e.handlersLayer)), ze = new Set((e.webSocketGateways ?? []).map((e) => e.path)), Be;
+	if (e.webSocketGateways !== void 0 && e.webSocketGateways.length > 0) {
+		let t = B({ scope: "voltro:gateway" }), n = e.webSocketGateways.map(Fe).map((n) => H.add("GET", n.path, U.HttpServerRequest.pipe(j.flatMap((r) => j.gen(function* () {
+			let i = {};
+			for (let [e, t] of Object.entries(r.headers)) t !== void 0 && (i[e.toLowerCase()] = Array.isArray(t) ? t.join(", ") : t);
+			if (!gt(r.method, i)) return W.text("upgrade required", {
+				status: 426,
+				headers: { upgrade: "websocket" }
+			});
+			let a = null, o;
+			if (n.auth === "subject") {
+				let r = e.resolveGatewaySubject;
+				if (r === void 0) return t.error("gateway declares auth: subject but the boot passed no resolveGatewaySubject", { path: n.path }), W.text("gateway auth unavailable", { status: 500 });
+				let s = yield* j.promise(() => r(i).catch(() => null));
+				if (s === null) return W.text("unauthorized", { status: 401 });
+				a = s.subject, o = s.credentialExpiresAt;
+			}
+			let s = yield* r.upgrade;
+			return yield* ue(s, r.source.socket, n, a, i, o, (e) => t.error("gateway handler failed", { path: n.path }, e)), W.empty({ status: 200 });
+		})))));
+		Be = M.mergeAll(...n);
+	}
+	let Ve = H.make.pipe(j.provideService(H.RouterConfig, {
+		caseSensitive: !0,
+		ignoreTrailingSlash: !1,
+		ignoreDuplicateSlashes: !1
+	})), Ue = M.mergeAll(R, ...t === void 0 || r.requests.size > 0 ? [Le] : [], ...t === void 0 || n.requests.size > 0 ? [Ie] : [], E, Oe, ke, ...Be === void 0 ? [] : [Be]), We = e.pluginHttpInterceptor, Ke = Number(process.env.VOLTRO_MAX_RPC_BODY_BYTES), at = e.maxRpcBodyBytes ?? (Number.isFinite(Ke) && Ke > 0 ? Ke : 8388608), G = Number(process.env.VOLTRO_MAX_BODY_BYTES), ot = e.maxBodyBytes ?? (Number.isFinite(G) && G > 0 ? G : 8388608), K = { "cache-control": "no-store" }, ct = e.httpRoutes?.some((e) => e.cors !== void 0 || e.credentials !== void 0) ? p(h(e.httpRoutes)) : () => void 0, lt = _e({
+		...e.security?.originGuard === void 0 ? {} : { mode: e.security.originGuard },
+		...e.security?.allowedOrigins === void 0 ? {} : { allowedOrigins: e.security.allowedOrigins }
+	}), ut = ge({
+		...e.webhookRoutes === void 0 ? {} : { webhookPaths: e.webhookRoutes.keys() },
+		...e.httpRoutes === void 0 ? {} : { httpRoutes: e.httpRoutes }
+	}), dt = xe(e.security?.headers), ft = B({ scope: "voltro:security" }), q = B({ scope: "voltro:rpc" }), pt = (e) => {
+		try {
+			let t = new URL(e, "http://voltro.invalid").searchParams.get("voltro-socket-id");
+			return t !== null && /^[A-Za-z0-9-]{1,80}$/.test(t) ? t : void 0;
+		} catch {
+			return;
+		}
+	}, mt = (e) => {
+		let t = Object.create(e);
+		return Object.defineProperty(t, "upgrade", {
+			configurable: !0,
+			get: () => j.gen(function* () {
+				let t = yield* e.upgrade, n = De(), r = pt(e.url), i = Date.now();
+				return q.info("rpc websocket opened", {
+					replicaId: g,
+					instanceId: rt(),
+					connectionId: n,
+					...r === void 0 ? {} : { clientSocketId: r }
+				}), yield* j.addFinalizer(() => j.sync(() => {
+					q.info("rpc websocket closed", {
+						replicaId: g,
+						instanceId: rt(),
+						connectionId: n,
+						...r === void 0 ? {} : { clientSocketId: r },
+						durationMs: Date.now() - i
+					});
+				})), t;
+			})
+		}), t;
+	}, ht = (e, t) => {
+		let n = e.headers, r = Se(dt, {
+			contentType: n["content-type"],
+			https: t
+		}), i = {};
+		for (let [e, t] of Object.entries(r)) n[e] === void 0 && (i[e] = t);
+		return Object.keys(i).length === 0 ? e : W.setHeaders(e, i);
+	}, gt = (e, t) => e.toUpperCase() === "GET" && (t.upgrade ?? "").toLowerCase().includes("websocket"), _t = (e) => j.gen(function* () {
+		let t = yield* U.HttpServerRequest, n = {};
+		for (let [e, r] of Object.entries(t.headers)) r !== void 0 && (n[e.toLowerCase()] = Array.isArray(r) ? r.join(", ") : r);
+		let r = t.url.indexOf("?"), i = r === -1 ? t.url : t.url.slice(0, r), a, o = !1;
+		try {
+			let e = t.source?.socket;
+			a = e?.remoteAddress, o = e?.encrypted === !0;
+		} catch {
+			a = void 0;
+		}
+		let c = ye({
+			socketEncrypted: o,
+			socketAddress: a,
+			xForwardedProto: n["x-forwarded-proto"],
+			config: z
+		}), l = ve({
+			socketAddress: a,
+			headers: n,
+			config: z
+		}), u = t.method === "OPTIONS" ? n["access-control-request-method"] ?? t.method : t.method, d = (ct(i)?.routes ?? []).filter((e) => nt(e, i)), f = d.find((e) => e.method === u || e.method === "*" || u === "HEAD" && e.method === "GET"), p = f ?? d[0], m = et(p?.cors, n.origin), h = (e) => {
+			let t = e.headers.vary, n = p?.cors !== void 0 && t !== void 0 ? {
+				...m,
+				vary: [...new Set(`${t}, Origin`.split(",").map((e) => e.trim()))].join(", ")
+			} : m;
+			return ht(W.setHeaders(e, n), c);
+		};
+		if (t.method === "OPTIONS" && f?.cors !== void 0 && n["access-control-request-method"] !== void 0) {
+			let e = tt(f.cors, f.method, n);
+			return h(W.empty({
+				status: e.status,
+				headers: e.headers
+			}));
+		}
+		if (t.method === "POST" && i === "/rpc") {
+			let e = n["content-length"];
+			if (e !== void 0 && Number(e) > at) return h(W.text("rpc payload too large", {
+				status: 413,
+				headers: K
+			}));
+		}
+		let g = i === "/rpc" && he(t.method), _ = (i === s || ze.has(i)) && gt(t.method, n);
+		if (he(t.method) && !ut(i) && f?.credentials !== "bearer" || _) {
+			let e = me({
+				headers: n,
+				config: lt
+			});
+			if (!e.allowed) return ft.warn("refused cross-site request", {
+				path: i,
+				method: t.method,
+				reason: e.reason,
+				origin: e.origin,
+				surface: _ ? "websocket-upgrade" : g ? "rpc" : "http-route"
+			}), h(W.text("origin not allowed", {
+				status: 403,
+				headers: K
+			}));
+		}
+		let v = g ? j.gen(function* () {
+			let r = yield* ae(t.source, at);
+			return r._tag === "aborted" ? h(W.text("rpc request body incomplete", {
+				status: 400,
+				headers: K
+			})) : r._tag === "too-large" ? (ft.warn("refused an over-cap rpc body", {
+				path: i,
+				cap: at,
+				receivedAtLeast: r.received,
+				declaredLength: n["content-length"] ?? null
+			}), h(W.text("rpc payload too large", {
+				status: 413,
+				headers: K
+			}))) : yield* j.provideService(e, U.HttpServerRequest, oe(y(t, l), r.bytes));
+		}) : e, b = _ && i === s ? mt(y(t, l)) : t, x = b === t ? v : j.provideService(v, U.HttpServerRequest, b);
+		if (!We) {
+			let e = yield* x;
+			return W.isHttpServerResponse(e) ? h(e) : e;
+		}
+		let S = yield* j.tryPromise(() => We(async () => null, {
+			method: t.method,
+			path: i,
+			headers: n,
+			remoteAddr: l
+		})).pipe(j.catch((e) => j.sync(() => (vt.error("http interceptor threw — request REFUSED (fail-closed)", {
+			method: t.method,
+			path: i
+		}, e), {
+			status: 500,
+			body: "internal error",
+			headers: void 0
+		}))));
+		if (S !== null) return h(W.text(S.body ?? "", {
+			status: S.status,
+			...S.headers ? { headers: S.headers } : {}
+		}));
+		let C = yield* x;
+		return W.isHttpServerResponse(C) ? h(C) : C;
+	}), J = _ === void 0 ? void 0 : new jt(x);
+	if (_ !== void 0 && J !== void 0) {
+		let e = new Promise((e) => {
+			let t = (n) => {
+				n === "request" && (J.removeListener("newListener", t), e());
+			};
+			J.on("newListener", t);
+		});
+		Mt.set(x, e), e.then(() => {
+			_.delegate({
+				request: (e, t) => {
+					J.emit("request", e, t);
+				},
+				upgrade: (e, t, n) => {
+					J.emit("upgrade", e, t, n);
+				}
+			});
+		});
+	}
+	let Y = M.unwrap(j.gen(function* () {
+		let e = yield* Ve;
+		return yield* M.build(M.provide(Ue, M.succeed(H.HttpRouter, e))), e.asHttpEffect();
+	}).pipe(j.map((e) => Je.serve(_t(e.pipe(j.catchIf((e) => Ye.isHttpServerError(e) && e.reason._tag === "RouteNotFound", (e) => {
+		let t = Ae(e.request.url.split("?")[0]);
+		return t === void 0 ? j.fail(e) : t.effect;
+	}))))))).pipe(M.provide(Xe.layer(() => J ?? x, a === void 0 ? { port: i } : {
+		port: i,
+		host: a
+	})), M.provide(Qe.layer), M.provide(st));
+	e.tracerLayer && (Y = Y.pipe(M.provide(fe), M.provide(e.tracerLayer)));
+	let X = B({ scope: "voltro:rpc" }), bt = M.launch(Y).pipe(j.catchCause((e) => j.sync(() => {
+		X.error("rpc server crashed", {}, k.squash(e)), process.exit(1);
+	}))), Z = j.runFork(bt);
+	return $.add(Z), Vt(), {
+		server: x,
+		shutdown: async () => {
+			$.delete(Z);
+			let e = j.runPromise(Te.interrupt(Z)).then(() => void 0, () => void 0);
+			for (let e of S) e.destroy();
+			x.closeIdleConnections(), await e, _ !== void 0 && await _.close();
+		}
+	};
+}, jt = class extends Ke {
+	bound;
+	constructor(e) {
+		super(), this.bound = e;
+	}
+	listen(...e) {
+		let t = e.find((e) => typeof e == "function");
+		return t !== void 0 && process.nextTick(t), this;
+	}
+	address() {
+		return this.bound.address();
+	}
+}, Mt = /* @__PURE__ */ new WeakMap(), $ = /* @__PURE__ */ new Set(), Nt = /* @__PURE__ */ new Set(), Pt = !1, Ft = (e) => (Nt.add(e), () => {
+	Nt.delete(e);
+}), It = 1e4, Lt = 1e3, Rt = 3e5, zt = () => {
+	let e = process.env.VOLTRO_SHUTDOWN_GRACE_MS;
+	if (e === void 0 || e === "") return It;
+	let t = Number(e);
+	return !Number.isFinite(t) || t <= 0 ? It : Math.min(Rt, Math.max(Lt, Math.trunc(t)));
+}, Bt = (e) => {
+	let t = Date.now(), n = !1, r = (r) => () => {
+		n || (n = !0, clearTimeout(i), e.onOutcome?.({
+			reason: r,
+			ms: Date.now() - t
+		}), e.exit());
+	}, i = setTimeout(r("deadline"), e.deadlineMs);
+	i.unref?.(), Promise.all(e.hooks.map((e) => Promise.resolve().then(e).then(() => void 0, () => void 0))).then(() => Promise.all(e.fibers.map((e) => j.runPromise(Te.interrupt(e)).then(() => void 0, () => void 0)))).then(r("drained"), r("drained"));
+}, Vt = () => {
+	if (Pt) return;
+	Pt = !0;
+	let e = () => {
+		let e = [...$], t = [...Nt];
+		$.clear(), Nt.clear(), Bt({
+			fibers: e,
+			hooks: t,
+			deadlineMs: zt(),
+			exit: () => process.exit(0),
+			onOutcome: ({ reason: e, ms: t }) => {
+				e === "drained" ? Y.info(`drained in ${t}ms`) : Y.error(`drain deadline exceeded — cut at ${t}ms`, { hint: "a shutdown hook or a pool drain did not complete; whatever had not finished did not happen" });
+			}
+		});
+	};
+	process.once("SIGINT", e), process.once("SIGTERM", e);
+}, Ht = (e, t = 1e4) => new Promise((n, r) => {
+	if (e.listening) {
+		let i = Mt.get(e);
+		if (i === void 0) {
+			n();
+			return;
+		}
+		let a = setTimeout(() => r(/* @__PURE__ */ Error(`rpc server did not bind within ${t}ms`)), t);
+		i.then(() => {
+			clearTimeout(a), n();
+		});
+		return;
+	}
+	let i = !1, a;
+	function o(t) {
+		i || (i = !0, clearTimeout(a), e.removeListener("listening", s), e.removeListener("error", c), t ? r(t) : n());
+	}
+	function s() {
+		o();
+	}
+	function c(e) {
+		o(e);
+	}
+	a = setTimeout(() => o(/* @__PURE__ */ Error(`rpc server did not bind within ${t}ms`)), t), e.on("listening", s), e.on("error", c);
+});
+//#endregion
+export { kt as DEFAULT_MAX_RPC_BODY_BYTES, Ht as awaitServerListening, mt as bindComputedUntyped, Ot as bindMutation, _t as bindStream, ht as bindSubscription, pt as bindSubscriptionUntyped, Q as defectMessage, Bt as drainForShutdown, Z as isInfraError, Et as makeMutationCodec, Ft as onProcessShutdown, zt as shutdownGraceMsFromEnv, At as startRpcServer };