@voltro/runtime 0.86.0 → 0.88.0

package/dist/rpcServer.js

@@ -1,42 +1,45 @@
 import { crdtFoldCell as e, crdtIncrementalCell as t } from "./crdtMerge.js";
-import { makeDefaultRefilter as n, rowFilterMayNarrow as r } from "./rowFilter.js";
-import { buildSubjectKey as i } from "./rywPositionStore.js";
-import { runWithRoutingContext as a, runWithRoutingContextEffect as o } from "./replicatedDataStore.js";
-import { applyKeepAlive as s, resolveKeepAlive as c } from "./httpKeepAlive.js";
-import { rpcFrameDefects as l } from "./rpcDefectDiagnostics.js";
-import { makeHttpRouteGroupFinder as u, makeUnmatchedGroupFinder as d, planHttpRouteMounts as f } from "./httpRouteMounts.js";
-import { isComputedQuery as p } from "./computedQuery.js";
-import { registerConnectionStream as m } from "./connectionCredentials.js";
-import { getRpcConnection as h, withRpcClientAddress as g, withRpcConnectionIdentity as _ } from "./rpcConnections.js";
-import { makeSubscriptionOutbox as v, pumpOutbox as y, reactiveSocketTunables as b } from "./subscriptionOutbox.js";
-import { adoptDetached as x, canonicalInputKey as S, detachForResume as C, recordForResume as w } from "./subscriptionResume.js";
-import { externalSpanFromTraceparent as ee, newTraceId as T, parseTraceparent as E } from "./traceparent.js";
-import { runWithTraceContext as D } from "./traceContext.js";
-import { runWithObservedProcedure as O } from "./observedGraph.js";
-import { actingUserId as k } from "./storeMiddleware.js";
-import { readCappedBody as A, withBufferedBody as te } from "./rpcBodyCap.js";
-import { maybeCompress as ne, mergeCompressionHeaders as re } from "./httpCompression.js";
-import { runWebSocketGateway as ie } from "./webSocketGatewayRuntime.js";
-import { noteResumeVerdict as ae } from "./resumeCensus.js";
-import { publishServerTracerLayer as oe } from "./serverTracer.js";
-import { boundByCredential as j } from "./credentialBound.js";
-import { classifyRequestOrigin as se, isStateChangingMethod as ce, makeOriginGuardExemption as le, resolveOriginGuardConfig as ue } from "./originGuard.js";
-import { resolveRequestClientAddress as de, resolveRequestIsHttps as fe, resolveTrustedProxies as pe } from "./trustedProxy.js";
-import { resolveSecurityHeaders as me, securityHeadersFor as he } from "./securityHeaders.js";
-import { assertWebhookRoutesDeclareVerification as ge } from "./webhookVerification.js";
-import { Cause as M, Context as _e, Deferred as N, Effect as P, Fiber as ve, Layer as F, Queue as I, Schema as L, Stream as R } from "effect";
-import { extractDbCause as ye, hasEagerLoads as be, runWithWriteAttribution as z } from "@voltro/database";
-import { randomUUID as xe } from "node:crypto";
-import { ConnectionInfo as B, MUTATION_IN_FLIGHT_RETRY_AFTER_MS as Se, MutationConnectionRequired as Ce, MutationInFlight as we, SubjectService as V, Unauthenticated as Te, beginIdempotent as Ee, defineWebSocket as De, failIdempotent as Oe, finishIdempotent as ke, groupShapeDigests as Ae, holdIdempotentClaim as je, recheckGuardsEffect as Me, wsMutationIdempotencyScope as Ne } from "@voltro/protocol";
-import { LoggerLayer as Pe, createLogger as H } from "@voltro/logger";
-import { Server as Fe, createServer as Ie } from "node:http";
-import { HttpRouter as U, HttpServer as Le, HttpServerError as Re, HttpServerRequest as W, HttpServerResponse as G } from "effect/http";
-import { NodeHttpServer as ze, NodeHttpServerRequest as Be, NodeServices as Ve } from "@effect/platform-node";
-import { RpcSerialization as He, RpcServer as K } from "effect/rpc";
-import { dispatchSharedPath as Ue, restCorsHeaders as We, restCorsPreflight as Ge, routeAcceptsPath as Ke } from "@voltro/protocol/rest";
-import { instanceId as qe, replicaId as Je } from "@voltro/protocol/identity";
-//#region src/rpcServer.ts
-var q = (e) => {
+import { resolveDependentTables as n } from "./dependencyGraph.js";
+import { buildSubjectKey as r } from "./rywPositionStore.js";
+import { runWithRoutingContext as i, runWithRoutingContextEffect as a } from "./replicatedDataStore.js";
+import { makeDefaultRefilter as o, rowFilterMayNarrow as s } from "./rowFilter.js";
+import { captureRpcWorkloadAdmission as c, selectRpcWorkloadGroup as l } from "./rpcWorkloadAdmission.js";
+import { applyKeepAlive as u, resolveKeepAlive as d } from "./httpKeepAlive.js";
+import { rpcFrameDefects as f } from "./rpcDefectDiagnostics.js";
+import { makeHttpRouteGroupFinder as p, makeUnmatchedGroupFinder as m, planHttpRouteMounts as h } from "./httpRouteMounts.js";
+import { isComputedQuery as g } from "./computedQuery.js";
+import { registerConnectionStream as _ } from "./connectionCredentials.js";
+import { getRpcConnection as v, withRpcClientAddress as y, withRpcConnectionIdentity as b } from "./rpcConnections.js";
+import { makeSubscriptionOutbox as x, pumpOutbox as S, reactiveSocketTunables as C } from "./subscriptionOutbox.js";
+import { adoptDetached as ee, canonicalInputKey as te, detachForResume as ne, recordForResume as re } from "./subscriptionResume.js";
+import { externalSpanFromTraceparent as ie, newTraceId as w, parseTraceparent as T } from "./traceparent.js";
+import { runWithTraceContext as E } from "./traceContext.js";
+import { runWithObservedProcedure as D } from "./observedGraph.js";
+import { actingUserId as O } from "./storeMiddleware.js";
+import { readCappedBody as ae, withBufferedBody as oe } from "./rpcBodyCap.js";
+import { dispatchHttpInputStream as se } from "./httpInputStream.js";
+import { maybeCompress as ce, mergeCompressionHeaders as le } from "./httpCompression.js";
+import { runWebSocketGateway as ue } from "./webSocketGatewayRuntime.js";
+import { noteResumeVerdict as de } from "./resumeCensus.js";
+import { publishServerTracerLayer as fe } from "./serverTracer.js";
+import { boundByCredential as pe } from "./credentialBound.js";
+import { classifyRequestOrigin as me, isStateChangingMethod as he, makeOriginGuardExemption as ge, resolveOriginGuardConfig as _e } from "./originGuard.js";
+import { resolveRequestClientAddress as ve, resolveRequestIsHttps as ye, resolveTrustedProxies as be } from "./trustedProxy.js";
+import { resolveSecurityHeaders as xe, securityHeadersFor as Se } from "./securityHeaders.js";
+import { assertWebhookRoutesDeclareVerification as Ce } from "./webhookVerification.js";
+import { Cause as k, Context as we, Deferred as A, Effect as j, Fiber as Te, Layer as M, Queue as N, Schema as P, Stream as F } from "effect";
+import { extractDbCause as Ee, hasEagerLoads as I, runWithWriteAttribution as L } from "@voltro/database";
+import { randomUUID as De } from "node:crypto";
+import { ConnectionInfo as R, MUTATION_IN_FLIGHT_RETRY_AFTER_MS as Oe, MutationConnectionRequired as z, MutationIdempotencyRefused as ke, MutationInFlight as Ae, SubjectService as je, Unauthenticated as Me, beginIdempotent as Ne, currentSubjectAuthority as Pe, defineWebSocket as Fe, failIdempotent as Ie, finishIdempotent as Le, groupShapeDigests as Re, holdIdempotentClaim as ze, prepareIdempotentInput as Be, recheckGuardsEffect as Ve, validateHttpStreamMaxDuration as He, wsMutationIdempotencyScope as Ue } from "@voltro/protocol";
+import { LoggerLayer as We, createLogger as B } from "@voltro/logger";
+import { RpcSerialization as Ge, RpcServer as V } from "effect/rpc";
+import { Server as Ke, createServer as qe } from "node:http";
+import { HttpRouter as H, HttpServer as Je, HttpServerError as Ye, HttpServerRequest as U, HttpServerResponse as W } from "effect/http";
+import { NodeHttpServer as Xe, NodeHttpServerRequest as Ze, NodeServices as Qe } from "@effect/platform-node";
+import { dispatchSharedPath as $e, restCorsHeaders as et, restCorsPreflight as tt, routeAcceptsPath as nt } from "@voltro/protocol/rest";
+import { instanceId as rt, replicaId as it } from "@voltro/protocol/identity";
+// src/rpcServer.ts
+var at = (e) => {
 	let t = e.indexOf(".");
 	if (t <= 0) return;
 	let n = e.slice(0, t), r = e.slice(t + 1);
@@ -50,137 +53,134 @@ var q = (e) => {
 			kind: n
 		};
 	}
-}, J = (e, t) => {
-	let n = q(e);
-	return n === void 0 ? t() : O(n, t);
-}, Ye = (e, t, n, r) => e === "subject" ? `${t}:s:${n}` : e === "global" ? `${t}:global` : r.tenantId == null ? void 0 : `${t}:t:${r.tenantId}`, Xe = Pe({}), Ze = (e, t) => P.callback((n) => {
-	let r = z(t, () => P.runFork(e.pipe(P.provide(Xe))));
+}, G = (e, t) => {
+	let n = at(e);
+	return n === void 0 ? t() : D(n, t);
+}, ot = (e, t, n, r) => e === "subject" ? `${t}:s:${n}` : e === "global" ? `${t}:global` : r.tenantId == null ? void 0 : `${t}:t:${r.tenantId}`, st = We({}), K = (e, t) => j.callback((n) => {
+	let r = L(t, () => j.runFork(e.pipe(j.provide(st))));
 	return r.addObserver((e) => {
 		n(e);
-	}), P.asVoid(ve.interrupt(r));
-}), Y = (e, t, n) => {
-	let r = n === void 0 ? void 0 : h(n);
+	}), j.asVoid(Te.interrupt(r));
+}), ct = (e, t, n, r) => {
+	let i = n === void 0 ? void 0 : v(n);
 	return {
 		subject: e,
-		traceId: t?.traceId ?? T(),
+		traceId: t?.traceId ?? w(),
+		...r === void 0 ? {} : { cookieHeader: r },
 		...t?.spanId === void 0 ? {} : { spanId: t.spanId },
 		...n === void 0 ? {} : { clientId: n },
-		...r === void 0 ? {} : { connection: r },
-		...r?.remoteAddr === void 0 ? {} : { remoteAddr: r.remoteAddr }
+		...i === void 0 ? {} : { connection: i },
+		...i?.remoteAddr === void 0 ? {} : { remoteAddr: i.remoteAddr }
 	};
-}, Qe = P.currentSpan.pipe(P.catch(() => P.succeed(void 0))), $e = (e) => ({
+}, lt = j.currentSpan.pipe(j.catch(() => j.succeed(void 0))), ut = (e) => ({
 	traceId: e.traceId,
 	...e.spanId === void 0 ? {} : { spanId: e.spanId }
-}), et = (e, t, n) => {
+}), dt = (e, t, n) => {
 	e !== void 0 && (e.attribute("rpc.tag", t), e.attribute("subject.type", n.type), n.tenantId !== void 0 && n.tenantId !== null && e.attribute("tenant.id", n.tenantId));
-}, tt = (e) => n(e, (e) => {
-	Q.error("row filter failed to load — subscription", {}, e instanceof Error ? e : Error(String(e)));
-}), X = (e) => ({
-	single: (t) => P.runPromise(I.offer(e, t)),
-	end: () => I.endUnsafe(e)
-}), nt = (n, i, a, o, s, c, l, u, d, f) => R.callback((p) => P.gen(function* () {
-	let h = d ?? b(), g = i.crdtColumnsFor(n.table), _ = v({
+}, ft = (e) => o(e, (e) => {
+	J.error("row filter failed to load — subscription", {}, e instanceof Error ? e : Error(String(e)));
+}), q = (e) => ({
+	single: (t) => j.runPromise(N.offer(e, t)),
+	end: () => N.endUnsafe(e)
+}), pt = (r, i, a, o, c, l, u, d, f, p) => F.callback((m) => j.gen(function* () {
+	let h = f ?? C(), g = i.crdtColumnsFor(r.table), v = x({
 		maxBufferedBytes: h.maxBufferedBytes,
 		overrunAfterMs: h.overrunAfterMs,
 		oversizedEventBytes: h.oversizedEventBytes,
-		label: s,
+		label: c,
 		...g.size > 0 ? { crdt: {
 			columns: g,
 			merge: e,
 			incremental: t
 		} } : {}
 	});
-	yield* P.addFinalizer(() => P.sync(() => _.close()));
-	let ee = u !== void 0 && (be(n) || r([n.table])), T = f !== void 0 && !ee, E = T ? S(f.input) : "unused", D = T && E !== "uncanonical" ? {
-		label: s,
-		inputKey: E,
+	yield* j.addFinalizer(() => j.sync(() => v.close()));
+	let y = s([...n(r)]), b = d !== void 0 && (I(r) || y), ie = p !== void 0 && !b, w = ie ? te(p.input) : "unused", T = ie && w !== "uncanonical" ? {
+		label: c,
+		inputKey: w,
 		subjectId: a.subject.id ?? "anonymous",
 		tenantId: a.subject.tenantId ?? ""
 	} : void 0;
-	ae(s, f === void 0 ? "not-offered" : ee ? r([n.table]) ? "row-filter" : "eager-load" : E !== "uncanonical" || "uncanonical-input");
-	let O = { current: (e) => {
-		D !== void 0 && w(D, e), _.push(e);
+	de(c, p === void 0 ? "not-offered" : b ? y ? "row-filter" : "eager-load" : w !== "uncanonical" || "uncanonical-input");
+	let E = { current: (e) => {
+		T !== void 0 && re(T, e), v.push(e);
 	} };
-	if (D !== void 0 && f?.fromRevision !== void 0 && f.reconcile === void 0) {
-		let e = l !== void 0 && (yield* P.tryPromise(() => l()).pipe(P.match({
+	if (T !== void 0 && p?.fromRevision !== void 0 && p.reconcile === void 0) {
+		let e = u !== void 0 && (yield* j.tryPromise(() => u()).pipe(j.match({
 			onFailure: () => !0,
 			onSuccess: (e) => !!e
-		}))) ? void 0 : x(D, f.fromRevision);
+		}))) ? void 0 : ee(T, p.fromRevision);
 		if (e !== void 0) {
-			for (let t of e.deltas) _.push({
+			for (let t of e.deltas) v.push({
 				_tag: "delta",
 				revision: t.revision,
 				emittedAt: t.emittedAt,
 				patch: t.patch
 			});
-			e.sink.current = O.current;
+			e.sink.current = E.current;
 			let t = e.unsubscribe;
-			if (yield* P.addFinalizer(() => P.sync(() => {
-				e.sink.current = () => {}, C(D, {
+			if (yield* j.addFinalizer(() => j.sync(() => {
+				e.sink.current = () => {}, ne(T, {
 					sink: e.sink,
 					unsubscribe: t
 				});
-			})), yield* P.forkScoped(P.promise(() => y(_, X(p), s))), a.clientId !== void 0) {
-				let e = m(a.clientId, () => {
-					I.endUnsafe(p);
+			})), yield* j.forkScoped(j.promise(() => S(v, q(m), c))), a.clientId !== void 0) {
+				let e = _(a.clientId, () => {
+					N.endUnsafe(m);
 				});
-				yield* P.addFinalizer(() => P.sync(() => e()));
+				yield* j.addFinalizer(() => j.sync(() => e()));
 			}
 			return;
 		}
 	}
-	let k = yield* P.tryPromise(() => i.subscribe(n, (e) => {
-		O.current(e);
-	}, a, o, s, f?.reconcile === void 0 ? c : void 0, l, u, f?.reconcile !== void 0)).pipe(P.matchCause({
-		onFailure: (e) => (pt(`subscription.${s}`, a.traceId, e), {
+	let D = yield* j.tryPromise(() => i.subscribe(r, (e) => {
+		E.current(e);
+	}, a, o, c, p?.reconcile === void 0 ? l : void 0, u, d, p?.reconcile !== void 0)).pipe(j.matchCause({
+		onFailure: (e) => (X(`subscription.${c}`, a.traceId, e), {
 			ok: !1,
-			error: bt(e)
+			error: Tt(e)
 		}),
 		onSuccess: (e) => ({
 			ok: !0,
 			unsubscribe: e
 		})
 	}));
-	if (!k.ok) {
-		I.offerUnsafe(p, {
+	if (!D.ok) {
+		N.offerUnsafe(m, {
 			_tag: "error",
-			error: k.error
-		}), I.endUnsafe(p);
+			error: D.error
+		}), N.endUnsafe(m);
 		return;
 	}
-	let A = k.unsubscribe;
-	if (yield* P.addFinalizer(() => P.sync(() => {
-		D === void 0 ? A() : (O.current = () => {}, C(D, {
-			sink: O,
-			unsubscribe: A
+	let O = D.unsubscribe;
+	if (yield* j.addFinalizer(() => j.sync(() => {
+		T === void 0 ? O() : (E.current = () => {}, ne(T, {
+			sink: E,
+			unsubscribe: O
 		}));
-	})), yield* P.forkScoped(P.promise(() => y(_, X(p), s))), a.clientId !== void 0) {
-		let e = m(a.clientId, () => {
-			I.endUnsafe(p);
+	})), yield* j.forkScoped(j.promise(() => S(v, q(m), c))), a.clientId !== void 0) {
+		let e = _(a.clientId, () => {
+			N.endUnsafe(m);
 		});
-		yield* P.addFinalizer(() => P.sync(() => e()));
+		yield* j.addFinalizer(() => j.sync(() => e()));
 	}
-}), { bufferSize: 1 }), rt = /* @__PURE__ */ new Set(), it = () => {
-	rt.clear();
-}, at = (e) => {
-	rt.has(e) || (rt.add(e), ft.warn(`${e}: \`cache:\` is declared but NOT applied — this query's handler returns a computed value, and the snapshot cache only wraps a store read. Every subscriber re-runs the handler. Either return a query descriptor (so the read can be cached), or drop \`cache:\` so the declaration matches what happens.`, { label: e }));
-}, ot = (e, t, n, r, i) => R.callback((a) => P.gen(function* () {
-	let o = i ?? b(), s = v({
+}), { bufferSize: 1 }), mt = (e, t, n, r, i) => F.callback((a) => j.gen(function* () {
+	let o = i ?? C(), s = x({
 		maxBufferedBytes: o.maxBufferedBytes,
 		overrunAfterMs: o.overrunAfterMs,
 		oversizedEventBytes: o.oversizedEventBytes,
 		label: r
 	});
-	yield* P.addFinalizer(() => P.sync(() => s.close()));
-	let c = yield* P.tryPromise(() => t.subscribeComputed(e, (e) => {
+	yield* j.addFinalizer(() => j.sync(() => s.close()));
+	let c = yield* j.tryPromise(() => t.subscribeComputed(e, (e) => {
 		s.push(e._tag === "snapshot" ? {
 			...e,
 			computed: !0
 		} : e);
-	}, n, r)).pipe(P.matchCause({
-		onFailure: (e) => (pt(`subscription.${r}`, n.traceId, e), {
+	}, n, r)).pipe(j.matchCause({
+		onFailure: (e) => (X(`subscription.${r}`, n.traceId, e), {
 			ok: !1,
-			error: bt(e)
+			error: Tt(e)
 		}),
 		onSuccess: (e) => ({
 			ok: !0,
@@ -188,38 +188,38 @@ var q = (e) => {
 		})
 	}));
 	if (!c.ok) {
-		I.offerUnsafe(a, {
+		N.offerUnsafe(a, {
 			_tag: "error",
 			error: c.error
-		}), I.endUnsafe(a);
+		}), N.endUnsafe(a);
 		return;
 	}
 	let l = c.unsubscribe;
-	if (ae(r, "computed"), yield* P.addFinalizer(() => P.sync(() => l())), yield* P.forkScoped(P.promise(() => y(s, X(a), r))), n.clientId !== void 0) {
-		let e = m(n.clientId, () => {
-			I.endUnsafe(a);
+	if (de(r, "computed"), yield* j.addFinalizer(() => j.sync(() => l())), yield* j.forkScoped(j.promise(() => S(s, q(a), r))), n.clientId !== void 0) {
+		let e = _(n.clientId, () => {
+			N.endUnsafe(a);
 		});
-		yield* P.addFinalizer(() => P.sync(() => e()));
+		yield* j.addFinalizer(() => j.sync(() => e()));
 	}
-}), { bufferSize: 1 }), st = (e, t, n = "rpc.subscription", r, s, c, l) => R.unwrap(P.gen(function* () {
-	let u = yield* V, d = yield* B, f = (e) => {
-		let t = R.make({
+}), { bufferSize: 1 }), ht = (e, t, n = "rpc.subscription", o, s, c, l) => F.unwrap(j.gen(function* () {
+	let u = yield* je, d = yield* R, f = (e) => {
+		let t = F.make({
 			_tag: "error",
-			error: new Te({ reason: "The session has expired. Sign in again." })
+			error: new Me({ reason: "The session has expired. Sign in again." })
 		});
-		return j(e, d.credentialExpiresAt, t, t);
-	}, m = yield* Qe;
-	et(m, n, u);
-	let h = Y(u, m, d.clientId), g = i(u.id, d.clientId), _ = {
-		subjectKey: g,
+		return pe(e, d.credentialExpiresAt, t, t);
+	}, p = yield* lt;
+	dt(p, n, u);
+	let m = ct(u, p, d.clientId, d.cookieHeader), h = r(u.id, d.clientId), _ = {
+		subjectKey: h,
 		...d.reconcile === void 0 ? {} : { forcePrimary: !0 }
-	}, v = a(_, () => D({
-		traceId: h.traceId,
-		...h.spanId === void 0 ? {} : { spanId: h.spanId }
-	}, () => J(n, () => e(h)))), y = P.isEffect(v) ? yield* o(_, v).pipe(P.matchCause({
-		onFailure: (e) => (pt(`subscription.${n}`, h.traceId, e), {
+	}, v = i(_, () => E({
+		traceId: m.traceId,
+		...m.spanId === void 0 ? {} : { spanId: m.spanId }
+	}, () => G(n, () => e(m)))), y = j.isEffect(v) ? yield* a(_, v).pipe(j.matchCause({
+		onFailure: (e) => (X(`subscription.${n}`, m.traceId, e), {
 			ok: !1,
-			error: bt(e)
+			error: Tt(e)
 		}),
 		onSuccess: (e) => ({
 			ok: !0,
@@ -229,43 +229,55 @@ var q = (e) => {
 		ok: !0,
 		value: v
 	};
-	if (!y.ok) return R.make({
+	if (!y.ok) return F.make({
 		_tag: "error",
 		error: y.error
 	});
 	let b = y.value;
-	if (p(b)) return s !== void 0 && at(n), f(Z(ot(d.reconcile === void 0 ? b : {
+	if (g(b)) return f(gt(mt(d.reconcile === void 0 ? b : {
 		...b,
-		recompute: () => a(_, b.recompute)
-	}, t, h, n), d.reconcile));
-	let x = b, S = r?.(x), C = s === void 0 ? void 0 : Ye(s.scope, s.baseKey, g, u);
-	return f(Z(nt(x, t, h, S, n, s === void 0 || C === void 0 ? void 0 : {
+		recompute: () => i(_, b.recompute)
+	}, t, m, n), d.reconcile));
+	let x = b, S = o?.(x), C = s === void 0 ? void 0 : ot(s.scope, s.baseKey, h, u);
+	return f(gt(pt(x, t, m, S, n, s === void 0 || C === void 0 ? void 0 : {
 		key: C,
 		ttlMs: s.ttlMs,
-		swrMs: s.swrMs
-	}, c?.(u), l?.(u) ?? tt(u), void 0, {
+		swrMs: s.swrMs,
+		label: n.replace(/^subscription\./, "")
+	}, c?.(u), l?.(u) ?? ft(u), void 0, {
 		input: x,
 		...d.resumeFrom === void 0 ? {} : { fromRevision: d.resumeFrom },
 		...d.reconcile === void 0 ? {} : { reconcile: d.reconcile }
 	}), d.reconcile));
-}).pipe(P.withSpan(n, { attributes: { "framework.kind": "subscription" } }))), Z = (e, t) => t === void 0 ? e : e.pipe(R.mapAccum(() => !1, (e, n) => !e && n._tag === "snapshot" ? [!0, [{
+}).pipe(j.withSpan(n, { attributes: { "framework.kind": "subscription" } }))), gt = (e, t) => t === void 0 ? e : e.pipe(F.mapAccum(() => !1, (e, n) => !e && n._tag === "snapshot" ? [!0, [{
 	...n,
 	reconciles: t
-}]] : [e, [n]])), ct = (e, t = "rpc.stream", n, r) => R.unwrap(P.gen(function* () {
-	let i = yield* V, a = yield* B, o = yield* Qe;
-	et(o, t, i);
-	let s = Y(i, o, a.clientId), c = n ?? [], l = () => Me(i, c, r), u = yield* l();
-	if (u) return R.fail(u);
-	let d = J(t, () => e(s)), f = P.isEffect(d) ? yield* d.pipe(P.orDie) : d, p = R.flatMap(f, (e) => R.unwrap(l().pipe(P.map((t) => t ? R.fail(t) : R.make(e))))), h = j(p, a.credentialExpiresAt, R.empty);
-	if (s.clientId === void 0) return h;
-	let g = s.clientId;
-	return R.unwrap(P.gen(function* () {
-		let e = yield* N.make(), t = m(g, () => {
-			N.doneUnsafe(e, P.void);
+}]] : [e, [n]])), _t = (e, t = "rpc.stream", n, r, i) => F.unwrap(j.gen(function* () {
+	let a = yield* je, o = yield* R, s = yield* lt;
+	dt(s, t, a);
+	let c = ct(a, s, o.clientId, o.cookieHeader), l = n ?? [], u = () => Ve(a, l, r), d = j.gen(function* () {
+		let n = yield* u();
+		if (n) return yield* j.fail(n);
+		let r = G(t, () => e(c));
+		return j.isEffect(r) ? yield* r : r;
+	}), f = yield* (i?.interceptor ? i.interceptor(d, {
+		tag: i.tag,
+		kind: "stream",
+		input: r,
+		subject: a,
+		traceId: c.traceId,
+		...c.spanId === void 0 ? {} : { spanId: c.spanId },
+		...c.remoteAddr === void 0 ? {} : { remoteAddr: c.remoteAddr }
+	}) : d).pipe(j.catchCause((e) => j.succeed(F.failCause(e)))), p = F.flatMap(f, (e) => F.unwrap(u().pipe(j.map((t) => t ? F.fail(t) : F.make(e))))), m = pe(p, o.credentialExpiresAt, F.empty);
+	if (c.clientId === void 0) return m;
+	let h = c.clientId;
+	return F.unwrap(j.gen(function* () {
+		let e = yield* A.make(), t = _(h, () => {
+			A.doneUnsafe(e, j.void);
 		});
-		return yield* P.addFinalizer(() => P.sync(() => t())), h.pipe(R.interruptWhen(N.await(e)));
+		return yield* j.addFinalizer(() => j.sync(() => t())), m.pipe(F.interruptWhen(A.await(e)));
 	}));
-}).pipe(P.withSpan(t, { attributes: { "framework.kind": "stream" } }))), Q = H({ scope: "voltro:rpc" }), lt = H({ scope: "voltro:http" }), ut = H({ scope: "voltro:shutdown" }), dt = (e) => {
+}).pipe(j.withSpan(t, { attributes: { "framework.kind": "stream" } }))), J = B({ scope: "voltro:rpc" }), vt = B({ scope: "voltro:http" }), Y = B({ scope: "voltro:shutdown" }), yt = (e) => {
 	if (e instanceof Error) {
 		let t = e._tag;
 		return {
@@ -283,40 +295,40 @@ var q = (e) => {
 		};
 	}
 	return { value: String(e).slice(0, 300) };
-}, ft = H({ scope: "voltro:rpc" }), pt = (e, t, n) => {
-	if (M.hasInterruptsOnly(n)) return;
-	let r = M.squash(n), i = r?._tag, a = r instanceof Error ? r.message : r?.message ?? String(r), o = M.hasDies(n), s = ye(r), c = {
+}, X = (e, t, n) => {
+	if (k.hasInterruptsOnly(n)) return;
+	let r = k.squash(n), i = r?._tag, a = r instanceof Error ? r.message : r?.message ?? String(r), o = k.hasDies(n), s = Ee(r), c = {
 		traceId: t,
 		...i === void 0 ? {} : { errorTag: i },
 		...s
 	}, l = a === "Failed to execute statement" && typeof s.dbMessage == "string" ? s.dbMessage : a;
-	o ? Q.error(`${e} failed: ${l}`, c) : Q.warn(`${e} failed: ${l}`, c);
-}, mt = /* @__PURE__ */ new Set([
+	o ? J.error(`${e} failed: ${l}`, c) : J.warn(`${e} failed: ${l}`, c);
+}, bt = /* @__PURE__ */ new Set([
 	"SqlError",
 	"ResultLengthMismatch",
 	"FieldDecryptionError"
-]), ht = (e) => typeof e == "object" && !!e && typeof e._tag == "string" && mt.has(e._tag), gt = (e, t) => {
+]), Z = (e) => typeof e == "object" && !!e && typeof e._tag == "string" && bt.has(e._tag), xt = (e, t) => {
 	try {
-		return L.is(e)(t);
+		return P.is(e)(t);
 	} catch {
 		return !0;
 	}
-}, _t = /* @__PURE__ */ new Set(), vt = (e, t) => {
+}, St = /* @__PURE__ */ new Set(), Ct = (e, t) => {
 	let n = `${e}\u0000${t}`;
-	_t.has(n) || (_t.size >= 1e3 && _t.clear(), _t.add(n), Q.warn(`${e} failed with '${t}', which is undeclared on its wire union — the client received InternalError instead. Add ${t} to the descriptor's \`error:\`, register it app-wide through a plugin's \`errorSchemas\`, or map it to a declared error (\`Effect.orDie\` if it is a defect). \`defineExecutor\` reports this at compile time.`, {
+	St.has(n) || (St.size >= 1e3 && St.clear(), St.add(n), J.warn(`${e} failed with '${t}', which is undeclared on its wire union — the client received InternalError instead. Add ${t} to the descriptor's \`error:\`, register it app-wide through a plugin's \`errorSchemas\`, or map it to a declared error (\`Effect.orDie\` if it is a defect). \`defineExecutor\` reports this at compile time.`, {
 		procedure: e,
 		errorTag: t
 	}));
-}, $ = (e, t = "internal server error") => ({
+}, wt = (e, t = "internal server error") => ({
 	_tag: "InternalError",
 	message: t,
 	traceId: e
-}), yt = (e) => {
+}), Q = (e) => {
 	let t = e instanceof Error ? e.message : e?.message, n = typeof t == "string" && t.length > 0 ? t : String(e), r = e?._tag, i = typeof r == "string" && r.length > 0 && !n.startsWith(r) ? `${r}: ${n}` : n;
 	return i.length <= 500 ? i : `${i.slice(0, 500)}…`;
-}, bt = (e) => {
-	let t = M.squash(e);
-	if (t && typeof t == "object" && t._tag === "UnknownError" && (t = t.error ?? t.cause ?? t), ht(t)) return {
+}, Tt = (e) => {
+	let t = k.squash(e);
+	if (t && typeof t == "object" && t._tag === "UnknownError" && (t = t.error ?? t.cause ?? t), Z(t)) return {
 		_tag: "InternalError",
 		message: "internal server error"
 	};
@@ -328,96 +340,152 @@ var q = (e) => {
 		...typeof i == "string" ? { _tag: i } : {},
 		message: typeof a == "string" ? a : String(t)
 	};
-}, xt = (e) => {
-	if (e === void 0) return;
-	let t = L.encodeUnknownSync(e), n = L.decodeUnknownSync(e);
+}, Et = (e, t, n) => {
+	let r = P.encodeUnknownSync(t), i = P.decodeUnknownSync(t);
 	return {
+		input: e,
+		admit: n,
 		encode: (e) => {
 			try {
-				return t(e);
+				return r(e);
 			} catch {
-				return e;
+				throw Error("Mutation output cannot be recorded for replay");
 			}
 		},
 		decode: (e) => {
 			try {
-				return n(e);
+				return i(e);
 			} catch {
-				return e;
+				throw Error("Stored mutation response is incompatible with the current output contract");
 			}
 		}
 	};
-}, St = (e) => {
+}, Dt = (e) => {
 	let t = {}, n;
 	for (let [r, i] of Object.entries(e ?? {})) Array.isArray(i) ? r.toLowerCase() === "set-cookie" ? n = i : t[r] = i.join(", ") : t[r] = i;
 	return {
 		headers: t,
 		setCookie: n
 	};
-}, Ct = (e, t, n = "rpc.mutation", r, o, s, c = "subject") => P.gen(function* () {
-	let l = yield* V, u = yield* B, d = yield* Qe;
-	et(d, n, l);
-	let f = Y(l, d, u.clientId), p = c === "connection";
-	if (p && (f.connection?.transport !== "websocket" || f.connection.signal.aborted)) return yield* P.fail(new Ce({ traceId: f.traceId }));
-	let m = o && u.idempotencyKey ? {
+}, Ot = (e, t, n = "rpc.mutation", a, o, s, c = "subject") => j.gen(function* () {
+	let l = t, u = yield* je, d = yield* R, f = yield* lt;
+	dt(f, n, u);
+	let p = ct(u, f, d.clientId, d.cookieHeader), m = async () => {
+		if (typeof a?.admit != "function") throw Error("Missing current mutation admission");
+		await a.admit(l, p);
+	}, h = () => j.tryPromise({
+		try: m,
+		catch: (e) => e
+	}), g = c === "connection";
+	if (g && (p.connection?.transport !== "websocket" || p.connection.signal.aborted)) return yield* j.fail(new z({ traceId: p.traceId }));
+	let _ = o && d.idempotencyKey ? {
 		store: o.store,
 		ttlMs: o.ttlMs,
-		key: u.idempotencyKey,
-		scope: Ne(l.tenantId, k(l), n, p ? f.connection?.id : void 0)
-	} : null, h = i(l.id, u.clientId), g = {
-		traceId: f.traceId,
-		subjectId: k(l),
+		key: d.idempotencyKey,
+		scope: Ue(u.tenantId, O(u), n, g ? p.connection?.id : void 0)
+	} : null, v = r(u.id, d.clientId), y = {
+		traceId: p.traceId,
+		subjectId: O(u),
 		procedure: n
-	}, _ = (r = (e) => e) => P.suspend(() => {
-		let i = a({ subjectKey: h }, () => D({
-			traceId: f.traceId,
-			...f.spanId === void 0 ? {} : { spanId: f.spanId }
-		}, () => z(g, () => J(n, () => e(t, f)))));
-		return P.isEffect(i) ? r(Ze(i, g)) : P.tryPromise({
-			try: () => Promise.resolve(i),
+	}, b = (t = (e) => e) => j.suspend(() => {
+		let r = i({ subjectKey: v }, () => E({
+			traceId: p.traceId,
+			...p.spanId === void 0 ? {} : { spanId: p.spanId }
+		}, () => L(y, () => G(n, () => e(l, {
+			...p,
+			subject: Pe(u)
+		})))));
+		return j.isEffect(r) ? t(K(r, y)) : j.tryPromise({
+			try: () => Promise.resolve(r),
 			catch: (e) => e
 		});
-	}), v = !1, y;
-	return yield* (m ? P.acquireUseRelease(P.promise(async () => {
-		let e = await Ee(m.store, m.scope, m.key, m.ttlMs, Date.now());
-		return e.kind === "fresh" && (y = je(m.store, m.scope, m.key)), e;
-	}), (e) => P.gen(function* () {
-		return yield* P.yieldNow, p && f.connection?.signal.aborted ? yield* P.fail(new Ce({ traceId: f.traceId })) : e.kind === "replay" ? r ? r.decode(e.response.body) : e.response.body : e.kind === "conflict" ? yield* P.fail(new we({
-			traceId: f.traceId,
-			retryAfterMs: Se
-		})) : yield* P.uninterruptibleMask((e) => e(P.void).pipe(P.flatMap(() => _(e)), P.tap((e) => (v = !0, P.promise(() => ke(m.store, m.scope, m.key, {
-			status: 200,
-			body: r ? r.encode(e) : e
-		}, Date.now())).pipe(P.ignore)))));
-	}), (e) => P.sync(() => y?.()).pipe(P.andThen(e.kind === "fresh" && !v ? P.promise(() => Oe(m.store, m.scope, m.key)).pipe(P.ignore) : P.void))) : _()).pipe(P.tapCause((e) => P.sync(() => pt(n, f.traceId, e))), P.catchIf(ht, () => P.die($(f.traceId))), P.catchIf((e) => e instanceof Error && typeof e._tag != "string", (e) => P.die($(f.traceId, yt(e)))), P.catchIf((e) => s !== void 0 && typeof e?._tag == "string" && !gt(s, e), (e) => P.sync(() => vt(n, e._tag)).pipe(P.andThen(P.die($(f.traceId, yt(e)))))), P.catchDefect((e) => e?._tag === "InternalError" ? P.die(e) : P.die($(f.traceId, yt(e)))), P.annotateLogs($e(f)));
-}).pipe(P.withSpan(n, { attributes: { "framework.kind": "mutation" } })), wt = 8388608, Tt = (e) => {
-	let t = e.port ?? 4e3, n = e.host, r = e.path ?? "/ws", i = r, a = e.replicaId ?? Je();
-	ge(e.webhookRoutes);
-	let o = e.listener, p = o?.server ?? Ie(), m = /* @__PURE__ */ new Set();
-	p.on("connection", (e) => {
-		m.add(e), e.once("close", () => {
-			m.delete(e);
+	}), x = !1, S;
+	return yield* (_ ? j.acquireUseRelease(j.tryPromise({
+		try: async () => {
+			let e;
+			try {
+				if (!a) throw Error("Missing declared mutation codec");
+				let n = await Be(a.input, t, u);
+				l = n.input, e = n.fingerprint;
+			} catch {
+				throw new ke({
+					traceId: p.traceId,
+					reason: "input-unavailable"
+				});
+			}
+			await m();
+			let n = await Ne(_.store, _.scope, _.key, e, _.ttlMs, Date.now());
+			return n.kind === "fresh" && (S = ze(_.store, n.claim)), n;
+		},
+		catch: (e) => e
+	}), (e) => j.gen(function* () {
+		if (yield* j.yieldNow, yield* h(), g && p.connection?.signal.aborted) return yield* j.fail(new z({ traceId: p.traceId }));
+		if (e.kind === "replay") {
+			if (e.response.status !== 200) throw Error("Stored mutation response is unavailable");
+			try {
+				return a ? a.decode(e.response.body) : e.response.body;
+			} catch {
+				throw Error("Stored mutation response is incompatible with the current output contract");
+			}
+		}
+		return e.kind === "input-conflict" || e.kind === "input-unbound" ? yield* j.fail(new ke({
+			traceId: p.traceId,
+			reason: e.kind
+		})) : e.kind === "conflict" ? yield* j.fail(new Ae({
+			traceId: p.traceId,
+			retryAfterMs: Oe
+		})) : yield* j.uninterruptibleMask((t) => t(j.void).pipe(j.flatMap(() => b(t)), j.tap((t) => {
+			x = !0;
+			let n;
+			try {
+				n = {
+					status: 200,
+					body: a ? a.encode(t) : t
+				};
+			} catch {
+				n = {
+					status: 500,
+					body: null
+				};
+			}
+			return j.promise(async () => {
+				try {
+					if (!await Le(_.store, e.claim, n, Date.now())) throw Error("Original mutation claim is no longer owned");
+				} catch {
+					throw Error("Mutation replay receipt could not be retained");
+				}
+				if (n.status !== 200) throw Error("Mutation output cannot be recorded for replay");
+			});
+		})));
+	}), (e) => j.sync(() => S?.()).pipe(j.andThen(e.kind === "fresh" && !x ? j.promise(() => Ie(_.store, e.claim)).pipe(j.ignore) : j.void))) : a ? h().pipe(j.flatMap(() => b())) : b()).pipe(j.tapCause((e) => j.sync(() => X(n, p.traceId, e))), j.catchIf(Z, () => j.die(wt(p.traceId))), j.catchIf((e) => e instanceof Error && typeof e._tag != "string", (e) => j.die(wt(p.traceId, Q(e)))), j.catchIf((e) => s !== void 0 && typeof e?._tag == "string" && !xt(s, e), (e) => j.sync(() => Ct(n, e._tag)).pipe(j.andThen(j.die(wt(p.traceId, Q(e)))))), j.catchDefect((e) => e?._tag === "InternalError" ? j.die(e) : j.die(wt(p.traceId, Q(e)))), j.annotateLogs(ut(p)));
+}).pipe(j.withSpan(n, { attributes: { "framework.kind": "mutation" } })), kt = 8388608, At = (e) => {
+	let t = c(e.workloadAdmission), n = l(e.group, t, "http"), r = l(e.group, t, "websocket"), i = e.port ?? 4e3, a = e.host, o = e.path ?? "/ws", s = o, g = e.replicaId ?? it();
+	Ce(e.webhookRoutes);
+	let _ = e.listener, x = _?.server ?? qe(), S = /* @__PURE__ */ new Set();
+	x.on("connection", (e) => {
+		S.add(e), e.once("close", () => {
+			S.delete(e);
 		});
-	}), s(p, c(e));
-	let v = (t) => W.HttpServerRequest.pipe(P.flatMap((t) => P.gen(function* () {
-		if (!e.inspectRoute) return G.text("inspect route not configured", { status: 404 });
+	}), u(x, d(e));
+	let C = (t) => U.HttpServerRequest.pipe(j.flatMap((t) => j.gen(function* () {
+		if (!e.inspectRoute) return W.text("inspect route not configured", { status: 404 });
 		let n = {};
 		for (let [e, r] of Object.entries(t.headers)) r !== void 0 && (n[e.toLowerCase()] = Array.isArray(r) ? r.join(", ") : r);
 		let r = e.inspectRoute, i = r.binary?.[new URL(t.url, "http://inspect.invalid").pathname], a;
-		!i && t.method !== "GET" && t.method !== "HEAD" && t.method !== "OPTIONS" && (a = yield* t.text.pipe(P.orElseSucceed(() => "")));
-		let o = yield* P.promise(async (e) => {
+		!i && t.method !== "GET" && t.method !== "HEAD" && t.method !== "OPTIONS" && (a = yield* t.text.pipe(j.orElseSucceed(() => "")));
+		let o = yield* j.promise(async (e) => {
 			if (!i) return r.handle(t.url, n, t.method, a, e);
-			let o = R.toReadableStream(t.stream);
+			let o = F.toReadableStream(t.stream);
 			return i(t.url, n, t.method, o, e);
 		});
-		if (o === null) return G.text("inspect route not found", { status: 404 });
+		if (o === null) return W.text("inspect route not found", { status: 404 });
 		if (o.byteStream !== void 0) {
 			let e = {
 				...o.headers,
 				...o.byteStream.contentLength === void 0 ? {} : { "content-length": String(o.byteStream.contentLength) },
 				...o.byteStream.contentDisposition === void 0 ? {} : { "content-disposition": o.byteStream.contentDisposition }
 			};
-			if (t.method === "HEAD") return G.empty({
+			if (t.method === "HEAD") return W.empty({
 				status: o.status,
 				headers: {
 					...e,
@@ -425,7 +493,7 @@ var q = (e) => {
 				}
 			});
 			let n = o.byteStream.stream;
-			return G.stream(R.fromReadableStream({
+			return W.stream(F.fromReadableStream({
 				evaluate: () => typeof n == "function" ? n() : n,
 				onError: (e) => e
 			}), {
@@ -434,25 +502,25 @@ var q = (e) => {
 				headers: e
 			});
 		}
-		return G.text(o.body, {
+		return W.text(o.body, {
 			status: o.status,
 			contentType: o.contentType,
 			headers: o.headers ?? {}
 		});
-	}))), y = () => W.HttpServerRequest.pipe(P.flatMap((t) => {
+	}))), ee = () => U.HttpServerRequest.pipe(j.flatMap((t) => {
 		let n = e.inspectStream;
-		if (!n) return P.succeed(G.text("inspect stream not configured", { status: 404 }));
+		if (!n) return j.succeed(W.text("inspect stream not configured", { status: 404 }));
 		let r = {};
 		for (let [e, n] of Object.entries(t.headers)) n !== void 0 && (r[e.toLowerCase()] = Array.isArray(n) ? n.join(", ") : n);
 		let i = n.corsHeaders(r.origin);
-		if (n.isDisabled()) return P.succeed(G.text(JSON.stringify({ error: "inspect disabled (VOLTRO_INSPECT=off)" }), {
+		if (n.isDisabled()) return j.succeed(W.text(JSON.stringify({ error: "inspect disabled (VOLTRO_INSPECT=off)" }), {
 			status: 503,
 			contentType: "application/json; charset=utf-8",
 			headers: i
 		}));
 		let a = n.authorize(r);
-		return a.ok ? (n.select?.(t.url, r) ?? P.succeed(void 0)).pipe(P.flatMap((e) => {
-			if (e?.kind === "stream") return P.succeed(G.stream(e.stream, {
+		return a.ok ? (n.select?.(t.url, r) ?? j.succeed(void 0)).pipe(j.flatMap((e) => {
+			if (e?.kind === "stream") return j.succeed(W.stream(e.stream, {
 				status: 200,
 				headers: {
 					...i,
@@ -461,7 +529,7 @@ var q = (e) => {
 					"x-accel-buffering": "no"
 				}
 			}));
-			if (e?.kind === "refused") return P.succeed(G.text(JSON.stringify(e.body), {
+			if (e?.kind === "refused") return j.succeed(W.text(JSON.stringify(e.body), {
 				status: e.status,
 				contentType: "application/json; charset=utf-8",
 				headers: i
@@ -470,18 +538,18 @@ var q = (e) => {
 				if (!u || e.indexOf("event: ") !== 0) return !0;
 				let t = e.indexOf("\n", 7);
 				return t < 0 || u.has(e.slice(7, t).trim());
-			}, f = R.callback((e) => P.gen(function* () {
-				if (I.offerUnsafe(e, r.encode("retry: 5000\n\n")), !c) for (let t of n.replay()) d(t) && I.offerUnsafe(e, r.encode(t));
+			}, f = F.callback((e) => j.gen(function* () {
+				if (N.offerUnsafe(e, r.encode("retry: 5000\n\n")), !c) for (let t of n.replay()) d(t) && N.offerUnsafe(e, r.encode(t));
 				let t = n.subscribe((t) => {
-					d(t) && I.offerUnsafe(e, r.encode(t));
+					d(t) && N.offerUnsafe(e, r.encode(t));
 				}), i = setInterval(() => {
-					I.offerUnsafe(e, r.encode(n.keepAlive()));
+					N.offerUnsafe(e, r.encode(n.keepAlive()));
 				}, a);
-				yield* P.addFinalizer(() => P.sync(() => {
+				yield* j.addFinalizer(() => j.sync(() => {
 					clearInterval(i), t();
 				}));
 			}));
-			return P.succeed(G.stream(f, {
+			return j.succeed(W.stream(f, {
 				status: 200,
 				headers: {
 					"content-type": "text/event-stream; charset=utf-8",
@@ -492,7 +560,7 @@ var q = (e) => {
 					...i
 				}
 			}));
-		})) : P.succeed(G.text(JSON.stringify({
+		})) : j.succeed(W.text(JSON.stringify({
 			error: "unauthorized",
 			reason: a.reason
 		}), {
@@ -500,17 +568,17 @@ var q = (e) => {
 			contentType: "application/json; charset=utf-8",
 			headers: i
 		}));
-	})), b = v(!0), x = v(!1), S = U.add("*", "/_voltro/inspect/*", W.HttpServerRequest.pipe(P.flatMap((e) => e.url.split("?")[0] === "/_voltro/inspect" ? b : x))), C = F.empty;
-	e.inspectRoute !== void 0 && (C = e.inspectStream === void 0 ? S : F.mergeAll(U.add("GET", "/_voltro/inspect/stream", y()), S));
-	let w = e.publishSurfaceDigest === !0 ? Ae(e.group) : void 0, D = e.serviceSurfaceTags ?? /* @__PURE__ */ new Set(), O = (e) => {
-		let t = Object.entries(w), n = 0;
-		for (let r of t) (e ? D.has(r[0]) : !D.has(r[0])) && (t[n++] = r);
+	})), te = C(!0), ne = C(!1), re = H.add("*", "/_voltro/inspect/*", U.HttpServerRequest.pipe(j.flatMap((e) => e.url.split("?")[0] === "/_voltro/inspect" ? te : ne))), E = M.empty;
+	e.inspectRoute !== void 0 && (E = e.inspectStream === void 0 ? re : M.mergeAll(H.add("GET", "/_voltro/inspect/stream", ee()), re));
+	let D = e.publishSurfaceDigest === !0 ? Re(e.group) : void 0, O = e.serviceSurfaceTags ?? /* @__PURE__ */ new Set(), de = (e) => {
+		let t = Object.entries(D), n = 0;
+		for (let r of t) (e ? O.has(r[0]) : !O.has(r[0])) && (t[n++] = r);
 		return t.length = n, Object.fromEntries(t);
-	}, k = w === void 0 ? void 0 : O(!1), ae = w === void 0 || D.size === 0 ? void 0 : O(!0), j = P.succeed(G.text(JSON.stringify({
+	}, pe = D === void 0 ? void 0 : de(!1), A = D === void 0 || O.size === 0 ? void 0 : de(!0), P = j.succeed(W.text(JSON.stringify({
 		protocol: 1,
 		mutationReplay: e.mutationReplay === !0,
-		...k === void 0 ? {} : { surface: k },
-		...ae === void 0 ? {} : { serviceSurface: ae }
+		...pe === void 0 ? {} : { surface: pe },
+		...A === void 0 ? {} : { serviceSurface: A }
 	}), {
 		status: 200,
 		contentType: "application/json; charset=utf-8",
@@ -518,135 +586,140 @@ var q = (e) => {
 			"cache-control": "no-store",
 			"access-control-allow-origin": "*"
 		}
-	})), N = "/_voltro/runtime-capabilities", L = `${i.slice(0, i.lastIndexOf("/"))}/_voltro/runtime-capabilities`, be = L === N ? U.add("GET", N, j) : F.mergeAll(U.add("GET", N, j), U.add("GET", L, j)), z = F.empty;
+	})), I = "/_voltro/runtime-capabilities", L = `${s.slice(0, s.lastIndexOf("/"))}/_voltro/runtime-capabilities`, R = L === I ? H.add("GET", I, P) : M.mergeAll(H.add("GET", I, P), H.add("GET", L, P)), Oe = M.empty;
 	if (e.webhookRoutes !== void 0 && e.webhookRoutes.size > 0) {
-		let t = (t) => W.HttpServerRequest.pipe(P.flatMap((n) => P.gen(function* () {
+		let t = (t) => U.HttpServerRequest.pipe(j.flatMap((n) => j.gen(function* () {
 			let r = {};
 			for (let [e, t] of Object.entries(n.headers)) t !== void 0 && (r[e.toLowerCase()] = Array.isArray(t) ? t.join(", ") : t);
-			let i = n.url.split("?")[0], a = t.maxBodyBytes ?? Ze, o = /* @__PURE__ */ new Uint8Array();
+			let i = n.url.split("?")[0], a = t.maxBodyBytes ?? ot, o = /* @__PURE__ */ new Uint8Array();
 			if (n.method !== "GET" && n.method !== "HEAD") {
 				let e = Number(r["content-length"]);
-				if (Number.isFinite(e) && e > a) return G.text("payload too large", { status: 413 });
-				let t = yield* A(n.source, a);
-				if (t._tag === "aborted") return G.text("request aborted", { status: 400 });
-				if (t._tag === "too-large") return G.text("payload too large", { status: 413 });
+				if (Number.isFinite(e) && e > a) return W.text("payload too large", { status: 413 });
+				let t = yield* ae(n.source, a);
+				if (t._tag === "aborted") return W.text("request aborted", { status: 400 });
+				if (t._tag === "too-large") return W.text("payload too large", { status: 413 });
 				o = new Uint8Array(t.bytes);
 			}
-			let s = ee(r.traceparent), c = yield* P.promise(() => t.handle({
+			let s = ie(r.traceparent), c = yield* j.promise(() => t.handle({
 				method: n.method,
 				path: i,
 				headers: r,
 				rawBody: o
-			})).pipe(P.withSpan(`webhook${i}`, {
+			})).pipe(j.withSpan(`webhook${i}`, {
 				attributes: {
 					"framework.kind": "webhook",
 					"http.route": i
 				},
 				...s ? { parent: s } : {}
-			})), l = new TextEncoder().encode(c.body), u = ne({
+			})), l = new TextEncoder().encode(c.body), u = ce({
 				body: l,
 				contentType: c.contentType,
 				acceptEncoding: r["accept-encoding"],
 				options: e.compression
 			});
-			return u.compressed ? G.uint8Array(u.bytes, {
+			return u.compressed ? W.uint8Array(u.bytes, {
 				status: c.status,
 				contentType: c.contentType,
 				headers: u.headers
-			}) : G.text(c.body, {
+			}) : W.text(c.body, {
 				status: c.status,
 				contentType: c.contentType
 			});
-		}))), n = Array.from(e.webhookRoutes.entries()).map(([e, n]) => U.add("*", e, t(n)));
-		z = F.mergeAll(...n);
+		}))), n = Array.from(e.webhookRoutes.entries()).map(([e, n]) => H.add("*", e, t(n)));
+		Oe = M.mergeAll(...n);
 	}
-	let B = pe(e.security?.trustedProxies, process.env, e.security?.clientAddressHeader), Se = F.empty, Ce = () => void 0;
+	let z = be(e.security?.trustedProxies, process.env, e.security?.clientAddressHeader), ke = M.empty, Ae = () => void 0;
 	if (e.httpRoutes !== void 0 && e.httpRoutes.length > 0) {
-		let t = (t) => W.HttpServerRequest.pipe(P.flatMap((n) => P.gen(function* () {
+		let t = (t) => U.HttpServerRequest.pipe(j.flatMap((n) => j.gen(function* () {
 			let r = {};
 			for (let [e, t] of Object.entries(n.headers)) t !== void 0 && (r[e.toLowerCase()] = Array.isArray(t) ? t.join(", ") : t);
 			let i = n.url.indexOf("?"), a = i >= 0 ? n.url.slice(0, i) : n.url, o = i >= 0 ? n.url.slice(i + 1) : "";
-			if (!t.some((e) => Ke(e, a))) return G.text("not found", { status: 404 });
-			let s = t.reduce((e, t) => Math.max(e, t.maxBodyBytes ?? Ze), 0), c = /* @__PURE__ */ new Uint8Array();
-			if (n.method !== "GET" && n.method !== "HEAD") {
+			if (!t.some((e) => nt(e, a))) return W.text("not found", { status: 404 });
+			let s = t.reduce((e, t) => Math.max(e, t.maxBodyBytes ?? ot), 0), c = t[0]?.handleStream, l = /* @__PURE__ */ new Uint8Array();
+			if (c !== void 0 || n.method !== "GET" && n.method !== "HEAD") {
 				let e = Number(r["content-length"]);
-				if (Number.isFinite(e) && e > s) return G.text("payload too large", { status: 413 });
-				let t = yield* A(n.source, s);
-				if (t._tag === "aborted") return G.text("request aborted", { status: 400 });
-				if (t._tag === "too-large") return G.text("payload too large", { status: 413 });
-				c = new Uint8Array(t.bytes);
+				if (Number.isFinite(e) && e > s) return W.text("payload too large", { status: 413 });
+				if (c === void 0) {
+					let e = yield* ae(n.source, s);
+					if (e._tag === "aborted") return W.text("request aborted", { status: 400 });
+					if (e._tag === "too-large") return W.text("payload too large", { status: 413 });
+					l = new Uint8Array(e.bytes);
+				}
 			}
-			let l = e.getStore?.(), u;
+			let u = e.getStore?.(), d;
 			try {
-				u = n.source?.socket?.remoteAddress;
+				d = n.source?.socket?.remoteAddress;
 			} catch {
-				u = void 0;
+				d = void 0;
 			}
-			let d = de({
-				socketAddress: u,
+			let f = ve({
+				socketAddress: d,
 				headers: r,
-				config: B
-			}), f = {
+				config: z
+			}), p = {
 				method: n.method,
 				path: a,
 				query: o,
 				headers: r,
-				rawBody: c,
-				...l === void 0 ? {} : { store: l },
-				...d === void 0 ? {} : { remoteAddr: d }
-			}, p = Date.now(), m = yield* P.promise(() => Ue(t, f));
+				...u === void 0 ? {} : { store: u },
+				...f === void 0 ? {} : { remoteAddr: f }
+			}, m = Date.now(), h = yield* j.promise((e) => c === void 0 ? $e(t, {
+				...p,
+				rawBody: l
+			}) : se(n.source, s, p, c, e));
 			if (e.onHttpRoute !== void 0) try {
 				e.onHttpRoute({
 					method: n.method,
 					path: a,
-					status: m.status,
-					durationMs: Date.now() - p,
-					traceId: E(r.traceparent)?.traceId ?? T()
+					status: h.status,
+					durationMs: Date.now() - m,
+					traceId: T(r.traceparent)?.traceId ?? w()
 				});
 			} catch {}
-			m.status >= 500 && lt.warn(`${n.method} ${a} → ${m.status}`, {
+			h.status >= 500 && vt.warn(`${n.method} ${a} → ${h.status}`, {
 				method: n.method,
 				path: a,
-				status: m.status,
-				...typeof m.body == "string" && m.body.length > 0 ? { body: m.body.slice(0, 1e3) } : {},
-				...m.cause === void 0 ? {} : { cause: dt(m.cause) }
+				status: h.status,
+				...typeof h.body == "string" && h.body.length > 0 ? { body: h.body.slice(0, 1e3) } : {},
+				...h.cause === void 0 ? {} : { cause: yt(h.cause) }
 			});
-			let h = St(m.headers), g = h.headers, _ = (e) => (h.setCookie !== void 0 && Be.toServerResponse(n).setHeader("set-cookie", [...h.setCookie]), e), v = {
-				status: m.status,
-				...m.contentType ? { contentType: m.contentType } : {},
-				headers: g
+			let g = Dt(h.headers), _ = g.headers, v = (e) => (g.setCookie !== void 0 && Ze.toServerResponse(n).setHeader("set-cookie", [...g.setCookie]), e), y = {
+				status: h.status,
+				...h.contentType ? { contentType: h.contentType } : {},
+				headers: _
 			};
-			if (m.byteStream !== void 0) {
-				let e = m.byteStream.stream, t = typeof e == "function" ? e() : e;
-				return _(G.stream(R.fromReadableStream({
+			if (h.byteStream !== void 0) {
+				let e = h.byteStream.stream, t = typeof e == "function" ? e() : e;
+				return v(W.stream(F.fromReadableStream({
 					evaluate: () => t,
 					onError: (e) => e
 				}), {
-					status: m.status,
-					contentType: m.contentType ?? "application/octet-stream",
+					status: h.status,
+					contentType: h.contentType ?? "application/octet-stream",
 					headers: {
-						...g,
-						...m.byteStream.contentLength === void 0 ? {} : { "content-length": String(m.byteStream.contentLength) },
-						...m.byteStream.contentDisposition === void 0 ? {} : { "content-disposition": m.byteStream.contentDisposition }
+						..._,
+						...h.byteStream.contentLength === void 0 ? {} : { "content-length": String(h.byteStream.contentLength) },
+						...h.byteStream.contentDisposition === void 0 ? {} : { "content-disposition": h.byteStream.contentDisposition }
 					}
 				}));
 			}
-			if (m.stream !== void 0) {
-				let { subscribe: e, keepAliveMs: t } = m.stream, n = new TextEncoder(), r = t ?? 15e3, i = R.callback((t) => P.gen(function* () {
-					I.offerUnsafe(t, n.encode("retry: 5000\n\n"));
-					let i = e((e) => {
-						I.offerUnsafe(t, n.encode(e));
-					}), a = r > 0 ? setInterval(() => {
-						I.offerUnsafe(t, n.encode(": keep-alive\n\n"));
-					}, r) : void 0;
-					yield* P.addFinalizer(() => P.sync(() => {
-						a !== void 0 && clearInterval(a), i();
-					}));
-				}));
-				return _(G.stream(i, {
-					status: m.status,
+			if (h.stream !== void 0) {
+				let { subscribe: e, keepAliveMs: t } = h.stream, n = He(h.stream.maxDurationMs), r = new TextEncoder(), i = t ?? 15e3, a = F.callback((t) => j.gen(function* () {
+					let n, a, o = !1;
+					yield* j.addFinalizer(() => j.sync(() => {
+						o = !0, a !== void 0 && clearInterval(a), n?.();
+					})), N.offerUnsafe(t, r.encode("retry: 5000\n\n"));
+					let s = e((e) => {
+						o || N.offerUnsafe(t, r.encode(e));
+					});
+					o ? s() : n = s, a = !o && i > 0 ? setInterval(() => {
+						N.offerUnsafe(t, r.encode(": keep-alive\n\n"));
+					}, i) : void 0;
+				})), o = n === void 0 ? a : a.pipe(F.interruptWhen(j.sleep(n)));
+				return v(W.stream(o, {
+					status: h.status,
 					headers: {
-						...g,
+						..._,
 						"content-type": "text/event-stream; charset=utf-8",
 						"cache-control": "no-cache, no-transform",
 						connection: "keep-alive",
@@ -654,52 +727,52 @@ var q = (e) => {
 					}
 				}));
 			}
-			if (n.method === "HEAD") return _(G.empty({
-				status: v.status,
-				headers: g
+			if (n.method === "HEAD") return v(W.empty({
+				status: y.status,
+				headers: _
 			}));
-			let y = m.body instanceof Uint8Array ? m.body : new TextEncoder().encode(m.body ?? ""), b = ne({
-				body: y,
-				contentType: m.contentType,
+			let b = h.body instanceof Uint8Array ? h.body : new TextEncoder().encode(h.body ?? ""), x = ce({
+				body: b,
+				contentType: h.contentType,
 				acceptEncoding: r["accept-encoding"],
 				options: e.compression
 			});
-			return _(G.uint8Array(b.bytes, {
-				...v,
-				headers: re(g, b.headers)
+			return v(W.uint8Array(x.bytes, {
+				...y,
+				headers: le(_, x.headers)
 			}));
-		})), P.tapCause((e) => M.hasInterruptsOnly(e) ? P.void : P.sync(() => lt.error(`${t.map((e) => e.method).join("|")} ${t[0].path} threw`, { path: t[0].path }, M.squash(e))))), n = f(e.httpRoutes), r = new Map(n.map((e) => [e, t(e.routes)])), i = d(n);
-		Ce = (e) => {
+		})), j.tapCause((e) => k.hasInterruptsOnly(e) ? j.void : j.sync(() => vt.error(`${t.map((e) => e.method).join("|")} ${t[0].path} threw`, { path: t[0].path }, k.squash(e))))), n = h(e.httpRoutes), r = new Map(n.map((e) => [e, t(e.routes)])), i = m(n);
+		Ae = (e) => {
 			let t = i(e);
 			return t === void 0 ? void 0 : { effect: r.get(t) };
 		};
 		let a = n.flatMap((e) => {
 			let t = r.get(e);
-			return e.methods.map((n) => U.add(n, `${e.mountPath}/*`, t));
+			return e.methods.map((n) => H.add(n, `${e.mountPath}/*`, t));
 		});
-		Se = F.mergeAll(...a);
+		ke = M.mergeAll(...a);
 	}
-	let we = K.layerProtocolWebsocket({ path: r }), V = (e) => {
-		let t = H({ scope: e }), n = /* @__PURE__ */ new Map();
-		return (e) => F.flatMap(e, (e) => {
-			let r = _e.get(e, K.Protocol);
-			return F.succeedContext(_e.make(K.Protocol, {
+	let je = V.layerProtocolWebsocket({ path: o }), Me = (e) => {
+		let t = B({ scope: e }), n = /* @__PURE__ */ new Map();
+		return (e) => M.flatMap(e, (e) => {
+			let r = we.get(e, V.Protocol);
+			return M.succeedContext(we.make(V.Protocol, {
 				...r,
-				run: (e) => r.run((t, r) => P.suspend(() => {
+				run: (e) => r.run((t, r) => j.suspend(() => {
 					if (r._tag === "Request") {
 						let e = n.get(t);
-						e === void 0 && (n.set(t, e = /* @__PURE__ */ new Map()), h(t)?.signal.addEventListener("abort", () => {
+						e === void 0 && (n.set(t, e = /* @__PURE__ */ new Map()), v(t)?.signal.addEventListener("abort", () => {
 							n.delete(t);
 						}, { once: !0 })), e.set(String(r.id), r.tag);
 					}
 					return e(t, r);
 				})),
 				end: (e) => (n.delete(e), r.end(e)),
-				send: (e, i, a) => P.suspend(() => {
+				send: (e, i, a) => j.suspend(() => {
 					let o = n.get(e), s = "requestId" in i ? String(i.requestId) : void 0, c = s === void 0 ? o?.size === 1 ? o.values().next().value : void 0 : o?.get(s);
 					i._tag === "Exit" && s !== void 0 && o?.delete(s);
-					for (let n of l(i)) {
-						let r = ye(n), i = typeof r.dbMessage == "string" ? r.dbMessage : void 0;
+					for (let n of f(i)) {
+						let r = Ee(n), i = typeof r.dbMessage == "string" ? r.dbMessage : void 0;
 						t.error(i === void 0 ? "rpc defect sent to client" : `rpc defect sent to client: ${i}`, {
 							clientId: e,
 							defect: n,
@@ -715,60 +788,60 @@ var q = (e) => {
 				})
 			}));
 		});
-	}, Te = { disableFatalDefects: !0 }, Ee = K.layer(e.group, Te), Oe = K.layer(e.group, Te).pipe(F.provide(V("voltro:rpc:http")(_(K.layerProtocolHttp({ path: "/rpc" }), "http"))), F.provide(He.layerJson), F.provide(e.httpHandlersLayer ?? e.handlersLayer)), ke = Ee.pipe(F.provide(V("voltro:rpc")(_(we, "websocket"))), F.provide(He.layerJson), F.provide(e.handlersLayer)), je = new Set((e.webSocketGateways ?? []).map((e) => e.path)), Me;
+	}, Ne = { disableFatalDefects: !0 }, Pe = V.layer(r, Ne), Ie = V.layer(n, Ne).pipe(M.provide(Me("voltro:rpc:http")(b(V.layerProtocolHttp({ path: "/rpc" }), "http"))), M.provide(Ge.layerJson), M.provide(e.httpHandlersLayer ?? e.handlersLayer)), Le = Pe.pipe(M.provide(Me("voltro:rpc")(b(je, "websocket"))), M.provide(Ge.layerJson), M.provide(e.handlersLayer)), ze = new Set((e.webSocketGateways ?? []).map((e) => e.path)), Be;
 	if (e.webSocketGateways !== void 0 && e.webSocketGateways.length > 0) {
-		let t = H({ scope: "voltro:gateway" }), n = e.webSocketGateways.map(De).map((n) => U.add("GET", n.path, W.HttpServerRequest.pipe(P.flatMap((r) => P.gen(function* () {
+		let t = B({ scope: "voltro:gateway" }), n = e.webSocketGateways.map(Fe).map((n) => H.add("GET", n.path, U.HttpServerRequest.pipe(j.flatMap((r) => j.gen(function* () {
 			let i = {};
 			for (let [e, t] of Object.entries(r.headers)) t !== void 0 && (i[e.toLowerCase()] = Array.isArray(t) ? t.join(", ") : t);
-			if (!ot(r.method, i)) return G.text("upgrade required", {
+			if (!gt(r.method, i)) return W.text("upgrade required", {
 				status: 426,
 				headers: { upgrade: "websocket" }
 			});
 			let a = null, o;
 			if (n.auth === "subject") {
 				let r = e.resolveGatewaySubject;
-				if (r === void 0) return t.error("gateway declares auth: subject but the boot passed no resolveGatewaySubject", { path: n.path }), G.text("gateway auth unavailable", { status: 500 });
-				let s = yield* P.promise(() => r(i).catch(() => null));
-				if (s === null) return G.text("unauthorized", { status: 401 });
+				if (r === void 0) return t.error("gateway declares auth: subject but the boot passed no resolveGatewaySubject", { path: n.path }), W.text("gateway auth unavailable", { status: 500 });
+				let s = yield* j.promise(() => r(i).catch(() => null));
+				if (s === null) return W.text("unauthorized", { status: 401 });
 				a = s.subject, o = s.credentialExpiresAt;
 			}
 			let s = yield* r.upgrade;
-			return yield* ie(s, r.source.socket, n, a, i, o, (e) => t.error("gateway handler failed", { path: n.path }, e)), G.empty({ status: 200 });
+			return yield* ue(s, r.source.socket, n, a, i, o, (e) => t.error("gateway handler failed", { path: n.path }, e)), W.empty({ status: 200 });
 		})))));
-		Me = F.mergeAll(...n);
+		Be = M.mergeAll(...n);
 	}
-	let Ne = U.make.pipe(P.provideService(U.RouterConfig, {
+	let Ve = H.make.pipe(j.provideService(H.RouterConfig, {
 		caseSensitive: !0,
 		ignoreTrailingSlash: !1,
 		ignoreDuplicateSlashes: !1
-	})), Pe = F.mergeAll(ke, Oe, be, C, z, Se, ...Me === void 0 ? [] : [Me]), Fe = e.pluginHttpInterceptor, q = Number(process.env.VOLTRO_MAX_RPC_BODY_BYTES), J = e.maxRpcBodyBytes ?? (Number.isFinite(q) && q > 0 ? q : 8388608), Ye = Number(process.env.VOLTRO_MAX_BODY_BYTES), Ze = e.maxBodyBytes ?? (Number.isFinite(Ye) && Ye > 0 ? Ye : 8388608), Y = { "cache-control": "no-store" }, Qe = e.httpRoutes?.some((e) => e.cors !== void 0 || e.credentials !== void 0) ? u(f(e.httpRoutes)) : () => void 0, $e = ue({
+	})), Ue = M.mergeAll(R, ...t === void 0 || r.requests.size > 0 ? [Le] : [], ...t === void 0 || n.requests.size > 0 ? [Ie] : [], E, Oe, ke, ...Be === void 0 ? [] : [Be]), We = e.pluginHttpInterceptor, Ke = Number(process.env.VOLTRO_MAX_RPC_BODY_BYTES), at = e.maxRpcBodyBytes ?? (Number.isFinite(Ke) && Ke > 0 ? Ke : 8388608), G = Number(process.env.VOLTRO_MAX_BODY_BYTES), ot = e.maxBodyBytes ?? (Number.isFinite(G) && G > 0 ? G : 8388608), K = { "cache-control": "no-store" }, ct = e.httpRoutes?.some((e) => e.cors !== void 0 || e.credentials !== void 0) ? p(h(e.httpRoutes)) : () => void 0, lt = _e({
 		...e.security?.originGuard === void 0 ? {} : { mode: e.security.originGuard },
 		...e.security?.allowedOrigins === void 0 ? {} : { allowedOrigins: e.security.allowedOrigins }
-	}), et = le({
+	}), ut = ge({
 		...e.webhookRoutes === void 0 ? {} : { webhookPaths: e.webhookRoutes.keys() },
 		...e.httpRoutes === void 0 ? {} : { httpRoutes: e.httpRoutes }
-	}), tt = me(e.security?.headers), X = H({ scope: "voltro:security" }), nt = H({ scope: "voltro:rpc" }), rt = (e) => {
+	}), dt = xe(e.security?.headers), ft = B({ scope: "voltro:security" }), q = B({ scope: "voltro:rpc" }), pt = (e) => {
 		try {
 			let t = new URL(e, "http://voltro.invalid").searchParams.get("voltro-socket-id");
 			return t !== null && /^[A-Za-z0-9-]{1,80}$/.test(t) ? t : void 0;
 		} catch {
 			return;
 		}
-	}, it = (e) => {
+	}, mt = (e) => {
 		let t = Object.create(e);
 		return Object.defineProperty(t, "upgrade", {
 			configurable: !0,
-			get: () => P.gen(function* () {
-				let t = yield* e.upgrade, n = xe(), r = rt(e.url), i = Date.now();
-				return nt.info("rpc websocket opened", {
-					replicaId: a,
-					instanceId: qe(),
+			get: () => j.gen(function* () {
+				let t = yield* e.upgrade, n = De(), r = pt(e.url), i = Date.now();
+				return q.info("rpc websocket opened", {
+					replicaId: g,
+					instanceId: rt(),
 					connectionId: n,
 					...r === void 0 ? {} : { clientSocketId: r }
-				}), yield* P.addFinalizer(() => P.sync(() => {
-					nt.info("rpc websocket closed", {
-						replicaId: a,
-						instanceId: qe(),
+				}), yield* j.addFinalizer(() => j.sync(() => {
+					q.info("rpc websocket closed", {
+						replicaId: g,
+						instanceId: rt(),
 						connectionId: n,
 						...r === void 0 ? {} : { clientSocketId: r },
 						durationMs: Date.now() - i
@@ -776,151 +849,151 @@ var q = (e) => {
 				})), t;
 			})
 		}), t;
-	}, at = (e, t) => {
-		let n = e.headers, r = he(tt, {
+	}, ht = (e, t) => {
+		let n = e.headers, r = Se(dt, {
 			contentType: n["content-type"],
 			https: t
 		}), i = {};
 		for (let [e, t] of Object.entries(r)) n[e] === void 0 && (i[e] = t);
-		return Object.keys(i).length === 0 ? e : G.setHeaders(e, i);
-	}, ot = (e, t) => e.toUpperCase() === "GET" && (t.upgrade ?? "").toLowerCase().includes("websocket"), st = (e) => P.gen(function* () {
-		let t = yield* W.HttpServerRequest, n = {};
+		return Object.keys(i).length === 0 ? e : W.setHeaders(e, i);
+	}, gt = (e, t) => e.toUpperCase() === "GET" && (t.upgrade ?? "").toLowerCase().includes("websocket"), _t = (e) => j.gen(function* () {
+		let t = yield* U.HttpServerRequest, n = {};
 		for (let [e, r] of Object.entries(t.headers)) r !== void 0 && (n[e.toLowerCase()] = Array.isArray(r) ? r.join(", ") : r);
-		let r = t.url.indexOf("?"), a = r === -1 ? t.url : t.url.slice(0, r), o, s = !1;
+		let r = t.url.indexOf("?"), i = r === -1 ? t.url : t.url.slice(0, r), a, o = !1;
 		try {
 			let e = t.source?.socket;
-			o = e?.remoteAddress, s = e?.encrypted === !0;
+			a = e?.remoteAddress, o = e?.encrypted === !0;
 		} catch {
-			o = void 0;
+			a = void 0;
 		}
-		let c = fe({
-			socketEncrypted: s,
-			socketAddress: o,
+		let c = ye({
+			socketEncrypted: o,
+			socketAddress: a,
 			xForwardedProto: n["x-forwarded-proto"],
-			config: B
-		}), l = de({
-			socketAddress: o,
+			config: z
+		}), l = ve({
+			socketAddress: a,
 			headers: n,
-			config: B
-		}), u = t.method === "OPTIONS" ? n["access-control-request-method"] ?? t.method : t.method, d = (Qe(a)?.routes ?? []).filter((e) => Ke(e, a)), f = d.find((e) => e.method === u || e.method === "*" || u === "HEAD" && e.method === "GET"), p = f ?? d[0], m = We(p?.cors, n.origin), h = (e) => {
+			config: z
+		}), u = t.method === "OPTIONS" ? n["access-control-request-method"] ?? t.method : t.method, d = (ct(i)?.routes ?? []).filter((e) => nt(e, i)), f = d.find((e) => e.method === u || e.method === "*" || u === "HEAD" && e.method === "GET"), p = f ?? d[0], m = et(p?.cors, n.origin), h = (e) => {
 			let t = e.headers.vary, n = p?.cors !== void 0 && t !== void 0 ? {
 				...m,
 				vary: [...new Set(`${t}, Origin`.split(",").map((e) => e.trim()))].join(", ")
 			} : m;
-			return at(G.setHeaders(e, n), c);
+			return ht(W.setHeaders(e, n), c);
 		};
 		if (t.method === "OPTIONS" && f?.cors !== void 0 && n["access-control-request-method"] !== void 0) {
-			let e = Ge(f.cors, f.method, n);
-			return h(G.empty({
+			let e = tt(f.cors, f.method, n);
+			return h(W.empty({
 				status: e.status,
 				headers: e.headers
 			}));
 		}
-		if (t.method === "POST" && a === "/rpc") {
+		if (t.method === "POST" && i === "/rpc") {
 			let e = n["content-length"];
-			if (e !== void 0 && Number(e) > J) return h(G.text("rpc payload too large", {
+			if (e !== void 0 && Number(e) > at) return h(W.text("rpc payload too large", {
 				status: 413,
-				headers: Y
+				headers: K
 			}));
 		}
-		let _ = a === "/rpc" && ce(t.method), v = (a === i || je.has(a)) && ot(t.method, n);
-		if (ce(t.method) && !et(a) && f?.credentials !== "bearer" || v) {
-			let e = se({
+		let g = i === "/rpc" && he(t.method), _ = (i === s || ze.has(i)) && gt(t.method, n);
+		if (he(t.method) && !ut(i) && f?.credentials !== "bearer" || _) {
+			let e = me({
 				headers: n,
-				config: $e
+				config: lt
 			});
-			if (!e.allowed) return X.warn("refused cross-site request", {
-				path: a,
+			if (!e.allowed) return ft.warn("refused cross-site request", {
+				path: i,
 				method: t.method,
 				reason: e.reason,
 				origin: e.origin,
-				surface: v ? "websocket-upgrade" : _ ? "rpc" : "http-route"
-			}), h(G.text("origin not allowed", {
+				surface: _ ? "websocket-upgrade" : g ? "rpc" : "http-route"
+			}), h(W.text("origin not allowed", {
 				status: 403,
-				headers: Y
+				headers: K
 			}));
 		}
-		let y = _ ? P.gen(function* () {
-			let r = yield* A(t.source, J);
-			return r._tag === "aborted" ? h(G.text("rpc request body incomplete", {
+		let v = g ? j.gen(function* () {
+			let r = yield* ae(t.source, at);
+			return r._tag === "aborted" ? h(W.text("rpc request body incomplete", {
 				status: 400,
-				headers: Y
-			})) : r._tag === "too-large" ? (X.warn("refused an over-cap rpc body", {
-				path: a,
-				cap: J,
+				headers: K
+			})) : r._tag === "too-large" ? (ft.warn("refused an over-cap rpc body", {
+				path: i,
+				cap: at,
 				receivedAtLeast: r.received,
 				declaredLength: n["content-length"] ?? null
-			}), h(G.text("rpc payload too large", {
+			}), h(W.text("rpc payload too large", {
 				status: 413,
-				headers: Y
-			}))) : yield* P.provideService(e, W.HttpServerRequest, te(g(t, l), r.bytes));
-		}) : e, b = v && a === i ? it(g(t, l)) : t, x = b === t ? y : P.provideService(y, W.HttpServerRequest, b);
-		if (!Fe) {
+				headers: K
+			}))) : yield* j.provideService(e, U.HttpServerRequest, oe(y(t, l), r.bytes));
+		}) : e, b = _ && i === s ? mt(y(t, l)) : t, x = b === t ? v : j.provideService(v, U.HttpServerRequest, b);
+		if (!We) {
 			let e = yield* x;
-			return G.isHttpServerResponse(e) ? h(e) : e;
+			return W.isHttpServerResponse(e) ? h(e) : e;
 		}
-		let S = yield* P.tryPromise(() => Fe(async () => null, {
+		let S = yield* j.tryPromise(() => We(async () => null, {
 			method: t.method,
-			path: a,
+			path: i,
 			headers: n,
 			remoteAddr: l
-		})).pipe(P.catch((e) => P.sync(() => (lt.error("http interceptor threw — request REFUSED (fail-closed)", {
+		})).pipe(j.catch((e) => j.sync(() => (vt.error("http interceptor threw — request REFUSED (fail-closed)", {
 			method: t.method,
-			path: a
+			path: i
 		}, e), {
 			status: 500,
 			body: "internal error",
 			headers: void 0
 		}))));
-		if (S !== null) return h(G.text(S.body ?? "", {
+		if (S !== null) return h(W.text(S.body ?? "", {
 			status: S.status,
 			...S.headers ? { headers: S.headers } : {}
 		}));
 		let C = yield* x;
-		return G.isHttpServerResponse(C) ? h(C) : C;
-	}), Z = o === void 0 ? void 0 : new Et(p);
-	if (o !== void 0 && Z !== void 0) {
+		return W.isHttpServerResponse(C) ? h(C) : C;
+	}), J = _ === void 0 ? void 0 : new jt(x);
+	if (_ !== void 0 && J !== void 0) {
 		let e = new Promise((e) => {
 			let t = (n) => {
-				n === "request" && (Z.removeListener("newListener", t), e());
+				n === "request" && (J.removeListener("newListener", t), e());
 			};
-			Z.on("newListener", t);
+			J.on("newListener", t);
 		});
-		Dt.set(p, e), e.then(() => {
-			o.delegate({
+		Mt.set(x, e), e.then(() => {
+			_.delegate({
 				request: (e, t) => {
-					Z.emit("request", e, t);
+					J.emit("request", e, t);
 				},
 				upgrade: (e, t, n) => {
-					Z.emit("upgrade", e, t, n);
+					J.emit("upgrade", e, t, n);
 				}
 			});
 		});
 	}
-	let ct = F.unwrap(P.gen(function* () {
-		let e = yield* Ne;
-		return yield* F.build(F.provide(Pe, F.succeed(U.HttpRouter, e))), e.asHttpEffect();
-	}).pipe(P.map((e) => Le.serve(st(e.pipe(P.catchIf((e) => Re.isHttpServerError(e) && e.reason._tag === "RouteNotFound", (e) => {
-		let t = Ce(e.request.url.split("?")[0]);
-		return t === void 0 ? P.fail(e) : t.effect;
-	}))))))).pipe(F.provide(ze.layer(() => Z ?? p, n === void 0 ? { port: t } : {
-		port: t,
-		host: n
-	})), F.provide(Ve.layer), F.provide(Xe));
-	e.tracerLayer && (ct = ct.pipe(F.provide(oe), F.provide(e.tracerLayer)));
-	let Q = H({ scope: "voltro:rpc" }), ut = F.launch(ct).pipe(P.catchCause((e) => P.sync(() => {
-		Q.error("rpc server crashed", {}, M.squash(e)), process.exit(1);
-	}))), ft = P.runFork(ut);
-	return Ot.add(ft), Lt(), {
-		server: p,
+	let Y = M.unwrap(j.gen(function* () {
+		let e = yield* Ve;
+		return yield* M.build(M.provide(Ue, M.succeed(H.HttpRouter, e))), e.asHttpEffect();
+	}).pipe(j.map((e) => Je.serve(_t(e.pipe(j.catchIf((e) => Ye.isHttpServerError(e) && e.reason._tag === "RouteNotFound", (e) => {
+		let t = Ae(e.request.url.split("?")[0]);
+		return t === void 0 ? j.fail(e) : t.effect;
+	}))))))).pipe(M.provide(Xe.layer(() => J ?? x, a === void 0 ? { port: i } : {
+		port: i,
+		host: a
+	})), M.provide(Qe.layer), M.provide(st));
+	e.tracerLayer && (Y = Y.pipe(M.provide(fe), M.provide(e.tracerLayer)));
+	let X = B({ scope: "voltro:rpc" }), bt = M.launch(Y).pipe(j.catchCause((e) => j.sync(() => {
+		X.error("rpc server crashed", {}, k.squash(e)), process.exit(1);
+	}))), Z = j.runFork(bt);
+	return $.add(Z), Vt(), {
+		server: x,
 		shutdown: async () => {
-			Ot.delete(ft);
-			let e = P.runPromise(ve.interrupt(ft)).then(() => void 0, () => void 0);
-			for (let e of m) e.destroy();
-			p.closeIdleConnections(), await e, o !== void 0 && await o.close();
+			$.delete(Z);
+			let e = j.runPromise(Te.interrupt(Z)).then(() => void 0, () => void 0);
+			for (let e of S) e.destroy();
+			x.closeIdleConnections(), await e, _ !== void 0 && await _.close();
 		}
 	};
-}, Et = class extends Fe {
+}, jt = class extends Ke {
 	bound;
 	constructor(e) {
 		super(), this.bound = e;
@@ -932,40 +1005,40 @@ var q = (e) => {
 	address() {
 		return this.bound.address();
 	}
-}, Dt = /* @__PURE__ */ new WeakMap(), Ot = /* @__PURE__ */ new Set(), kt = /* @__PURE__ */ new Set(), At = !1, jt = (e) => (kt.add(e), () => {
-	kt.delete(e);
-}), Mt = 1e4, Nt = 1e3, Pt = 3e5, Ft = () => {
+}, Mt = /* @__PURE__ */ new WeakMap(), $ = /* @__PURE__ */ new Set(), Nt = /* @__PURE__ */ new Set(), Pt = !1, Ft = (e) => (Nt.add(e), () => {
+	Nt.delete(e);
+}), It = 1e4, Lt = 1e3, Rt = 3e5, zt = () => {
 	let e = process.env.VOLTRO_SHUTDOWN_GRACE_MS;
-	if (e === void 0 || e === "") return Mt;
+	if (e === void 0 || e === "") return It;
 	let t = Number(e);
-	return !Number.isFinite(t) || t <= 0 ? Mt : Math.min(Pt, Math.max(Nt, Math.trunc(t)));
-}, It = (e) => {
+	return !Number.isFinite(t) || t <= 0 ? It : Math.min(Rt, Math.max(Lt, Math.trunc(t)));
+}, Bt = (e) => {
 	let t = Date.now(), n = !1, r = (r) => () => {
 		n || (n = !0, clearTimeout(i), e.onOutcome?.({
 			reason: r,
 			ms: Date.now() - t
 		}), e.exit());
 	}, i = setTimeout(r("deadline"), e.deadlineMs);
-	i.unref?.(), Promise.all(e.hooks.map((e) => Promise.resolve().then(e).then(() => void 0, () => void 0))).then(() => Promise.all(e.fibers.map((e) => P.runPromise(ve.interrupt(e)).then(() => void 0, () => void 0)))).then(r("drained"), r("drained"));
-}, Lt = () => {
-	if (At) return;
-	At = !0;
+	i.unref?.(), Promise.all(e.hooks.map((e) => Promise.resolve().then(e).then(() => void 0, () => void 0))).then(() => Promise.all(e.fibers.map((e) => j.runPromise(Te.interrupt(e)).then(() => void 0, () => void 0)))).then(r("drained"), r("drained"));
+}, Vt = () => {
+	if (Pt) return;
+	Pt = !0;
 	let e = () => {
-		let e = [...Ot], t = [...kt];
-		Ot.clear(), kt.clear(), It({
+		let e = [...$], t = [...Nt];
+		$.clear(), Nt.clear(), Bt({
 			fibers: e,
 			hooks: t,
-			deadlineMs: Ft(),
+			deadlineMs: zt(),
 			exit: () => process.exit(0),
 			onOutcome: ({ reason: e, ms: t }) => {
-				e === "drained" ? ut.info(`drained in ${t}ms`) : ut.error(`drain deadline exceeded — cut at ${t}ms`, { hint: "a shutdown hook or a pool drain did not complete; whatever had not finished did not happen" });
+				e === "drained" ? Y.info(`drained in ${t}ms`) : Y.error(`drain deadline exceeded — cut at ${t}ms`, { hint: "a shutdown hook or a pool drain did not complete; whatever had not finished did not happen" });
 			}
 		});
 	};
 	process.once("SIGINT", e), process.once("SIGTERM", e);
-}, Rt = (e, t = 1e4) => new Promise((n, r) => {
+}, Ht = (e, t = 1e4) => new Promise((n, r) => {
 	if (e.listening) {
-		let i = Dt.get(e);
+		let i = Mt.get(e);
 		if (i === void 0) {
 			n();
 			return;
@@ -988,5 +1061,4 @@ var q = (e) => {
 	}
 	a = setTimeout(() => o(/* @__PURE__ */ Error(`rpc server did not bind within ${t}ms`)), t), e.on("listening", s), e.on("error", c);
 });
-//#endregion
-export { wt as DEFAULT_MAX_RPC_BODY_BYTES, Rt as awaitServerListening, ot as bindComputedUntyped, Ct as bindMutation, ct as bindStream, st as bindSubscription, nt as bindSubscriptionUntyped, yt as defectMessage, It as drainForShutdown, ht as isInfraError, xt as makeMutationOutputCodec, jt as onProcessShutdown, it as resetComputedQueryCacheWarnings, Ft as shutdownGraceMsFromEnv, Tt as startRpcServer };
+export { kt as DEFAULT_MAX_RPC_BODY_BYTES, Ht as awaitServerListening, mt as bindComputedUntyped, Ot as bindMutation, _t as bindStream, ht as bindSubscription, pt as bindSubscriptionUntyped, Q as defectMessage, Bt as drainForShutdown, Z as isInfraError, Et as makeMutationCodec, Ft as onProcessShutdown, zt as shutdownGraceMsFromEnv, At as startRpcServer };