overmux 0.0.1 → 0.0.2

package/dist/internal/server/coordinator/server-child.js

@@ -0,0 +1,3299 @@
+import { serve } from "@hono/node-server";
+import { chmod, link, mkdir, open, readFile, realpath, rename, rm, stat } from "node:fs/promises";
+import { createServer, isIP } from "node:net";
+import { dirname, isAbsolute, join, resolve } from "node:path";
+import { createJiti } from "jiti";
+import { ZodError, z } from "zod";
+import { homedir, tmpdir } from "node:os";
+import { once } from "node:events";
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { generateCookie } from "hono/cookie";
+import { bodyLimit } from "hono/body-limit";
+import { parse } from "hono/utils/cookie";
+import { appendFileSync, mkdirSync, readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { Hono } from "hono";
+import { serveStatic } from "@hono/node-server/serve-static";
+import { proxyFetch, proxyUpgrade } from "httpxy";
+import { WebSocket, WebSocketServer } from "ws";
+import webPush from "web-push";
+import { isDeepStrictEqual } from "node:util";
+//#region ../shared/dist/node/index.js
+const durationPattern$1 = /^([1-9]\d*)(ms|s|m|h|d)$/;
+const millisecondsByUnit$1 = {
+	d: 1440 * 60 * 1e3,
+	h: 3600 * 1e3,
+	m: 60 * 1e3,
+	ms: 1,
+	s: 1e3
+};
+const durationToMilliseconds$1 = (duration) => {
+	const match = durationPattern$1.exec(duration);
+	if (!match) return;
+	const unit = match[2];
+	const milliseconds = Number(match[1]) * millisecondsByUnit$1[unit];
+	return Number.isSafeInteger(milliseconds) ? milliseconds : void 0;
+};
+const aiContextSnippets = ["package-source", "tech-stack-recommendations"];
+const zodTypeSchema = z.custom((value) => value instanceof z.ZodType, "Expected a Zod schema");
+const functionSchema = z.custom((value) => typeof value === "function", "Expected a function");
+const contractRuntimeSchema = z.object({
+	input: zodTypeSchema,
+	output: zodTypeSchema
+});
+const operationRuntimeSchema = z.object({
+	handle: functionSchema,
+	input: zodTypeSchema,
+	output: zodTypeSchema
+});
+const streamHandlerRuntimeSchema = z.object({
+	contract: z.object({
+		clientMessage: zodTypeSchema,
+		input: zodTypeSchema,
+		serverMessage: zodTypeSchema
+	}),
+	open: functionSchema
+});
+const resourceDefinitionRuntimeSchema = z.discriminatedUnion("kind", [
+	z.object({
+		contract: contractRuntimeSchema,
+		kind: z.literal("query"),
+		read: functionSchema
+	}),
+	z.object({
+		contract: contractRuntimeSchema,
+		kind: z.literal("subscription"),
+		read: functionSchema,
+		subscribe: functionSchema
+	}),
+	z.object({
+		combine: functionSchema,
+		contract: contractRuntimeSchema,
+		dependencies: z.record(z.string(), z.string()),
+		kind: z.literal("derived")
+	})
+]);
+const authDurationSchema = z.string().regex(/^[1-9]\d*[mhd]$/, "Expected a positive duration such as 30d").refine((value) => durationToMilliseconds$1(value) !== void 0, "Duration is too large");
+const isLoopbackHostname$1 = (hostname) => hostname === "localhost" || hostname === "[::1]" || /^127(?:\.\d{1,3}){3}$/.test(hostname);
+const exactOriginSchema = z.url().refine((value) => new URL(value).origin === value, "Expected an origin").refine((value) => {
+	const url = new URL(value);
+	return url.protocol === "https:" || url.protocol === "http:" && isLoopbackHostname$1(url.hostname);
+}, "Non-loopback Overmux origins must use HTTPS");
+const loopbackPeerSchema = z.string().refine((value) => isIP(value) !== 0 && (value === "::1" || value.startsWith("127.")), "Expected a loopback IP address");
+const authConfigRuntimeSchema = z.object({
+	mode: z.literal("cli-login"),
+	origins: z.array(exactOriginSchema).min(1).refine((origins) => new Set(origins).size === origins.length, "Expected unique origins").optional(),
+	sessionLifetime: z.union([z.literal("never"), authDurationSchema]).default("never"),
+	trustedProxyPeer: loopbackPeerSchema.optional()
+}).strict();
+const serverConfigRuntimeSchema = z.object({
+	host: z.string().min(1).optional(),
+	logFile: z.string().min(1).optional(),
+	port: z.number().int().min(1).max(65535).optional(),
+	productionWebAssetsDir: z.string().min(1).optional(),
+	watch: z.boolean().optional()
+});
+const serverDefinitionRuntimeSchema = z.object({
+	operations: z.record(z.string(), operationRuntimeSchema).optional(),
+	resources: z.record(z.string(), resourceDefinitionRuntimeSchema),
+	streams: z.record(z.string(), streamHandlerRuntimeSchema).optional()
+});
+const configDefinitionRuntimeSchema = serverConfigRuntimeSchema.extend({
+	aiContextSnippets: z.array(z.enum(aiContextSnippets)).optional(),
+	auth: authConfigRuntimeSchema,
+	debug: z.boolean().optional(),
+	server: serverDefinitionRuntimeSchema,
+	vite: z.string().min(1).optional()
+});
+const resolveLogicalPath = async (path) => {
+	const logicalPath = resolve(path);
+	return {
+		logicalPath,
+		realPath: await realpath(logicalPath)
+	};
+};
+const resolveOvermuxConfigPaths = async (configPath) => {
+	const { logicalPath, realPath } = await resolveLogicalPath(configPath);
+	return {
+		logicalApplicationRoot: dirname(logicalPath),
+		logicalConfigPath: logicalPath,
+		realApplicationRoot: dirname(realPath),
+		realConfigPath: realPath
+	};
+};
+const unwrapDefaultExport = (module) => {
+	if (typeof module === "object" && module !== null && "default" in module) return module.default;
+	return module;
+};
+const loadOvermuxConfig = async ({ aliases = {}, configPath }) => {
+	const paths = await resolveOvermuxConfigPaths(configPath);
+	const module = await createJiti(paths.logicalConfigPath, {
+		alias: aliases,
+		fsCache: true,
+		jsx: {
+			importSource: "react",
+			runtime: "automatic"
+		},
+		moduleCache: false,
+		sourceMaps: true,
+		tsconfigPaths: true
+	}).import(paths.logicalConfigPath);
+	return {
+		config: configDefinitionRuntimeSchema.parse(unwrapDefaultExport(module)),
+		paths
+	};
+};
+const xdgDirectory = (configured, fallback) => configured && isAbsolute(configured) ? configured : fallback;
+const overmuxDirectory = (root) => join(root, "overmux");
+const getOvermuxPaths = ({ environment = process.env, homeDir = homedir(), xdgCacheHome = environment.XDG_CACHE_HOME, xdgConfigHome = environment.XDG_CONFIG_HOME, xdgDataHome = environment.XDG_DATA_HOME, xdgRuntimeDir = environment.XDG_RUNTIME_DIR, xdgStateHome = environment.XDG_STATE_HOME } = {}) => {
+	if (!isAbsolute(homeDir)) throw new TypeError("The home directory must be absolute.");
+	const runtimeDir = xdgRuntimeDir && isAbsolute(xdgRuntimeDir) ? overmuxDirectory(xdgRuntimeDir) : void 0;
+	return {
+		cacheDir: overmuxDirectory(xdgDirectory(xdgCacheHome, join(homeDir, ".cache"))),
+		configDir: overmuxDirectory(xdgDirectory(xdgConfigHome, join(homeDir, ".config"))),
+		dataDir: overmuxDirectory(xdgDirectory(xdgDataHome, join(homeDir, ".local", "share"))),
+		...runtimeDir ? { runtimeDir } : {},
+		stateDir: overmuxDirectory(xdgDirectory(xdgStateHome, join(homeDir, ".local", "state")))
+	};
+};
+//#endregion
+//#region ../lib/dist/index.js
+const durationPattern = /^([1-9]\d*)(ms|s|m|h|d)$/;
+const millisecondsByUnit = {
+	d: 1440 * 60 * 1e3,
+	h: 3600 * 1e3,
+	m: 60 * 1e3,
+	ms: 1,
+	s: 1e3
+};
+const durationToMilliseconds = (duration) => {
+	const match = durationPattern.exec(duration);
+	if (!match) return;
+	const unit = match[2];
+	const milliseconds = Number(match[1]) * millisecondsByUnit[unit];
+	return Number.isSafeInteger(milliseconds) ? milliseconds : void 0;
+};
+//#endregion
+//#region src/internal/server/notifications/private-json-file.ts
+const missingFile = (cause) => cause.code === "ENOENT";
+const preparePrivateDirectory = async (path) => {
+	await mkdir(path, {
+		mode: 448,
+		recursive: true
+	});
+	await chmod(path, 448);
+};
+const writeTemporaryPrivateJson = async (path, value) => {
+	await preparePrivateDirectory(dirname(path));
+	const temporaryPath = `${path}.${process.pid}.${randomUUID()}`;
+	try {
+		const handle = await open(temporaryPath, "wx", 384);
+		try {
+			await handle.writeFile(`${JSON.stringify(value)}\n`);
+			await handle.sync();
+		} finally {
+			await handle.close();
+		}
+		return temporaryPath;
+	} catch (cause) {
+		await rm(temporaryPath, { force: true });
+		throw cause;
+	}
+};
+const readPrivateJson = async (path, schema) => {
+	try {
+		const contents = await readFile(path, "utf8");
+		await chmod(path, 384);
+		return schema.parse(JSON.parse(contents));
+	} catch (cause) {
+		if (missingFile(cause)) return;
+		throw cause;
+	}
+};
+const replacePrivateJsonAtomically = async (path, value) => {
+	const temporaryPath = await writeTemporaryPrivateJson(path, value);
+	try {
+		await rename(temporaryPath, path);
+	} catch (cause) {
+		await rm(temporaryPath, { force: true });
+		throw cause;
+	}
+};
+const createPrivateJsonExclusively = async (path, value) => {
+	const temporaryPath = await writeTemporaryPrivateJson(path, value);
+	try {
+		await link(temporaryPath, path);
+	} finally {
+		await rm(temporaryPath, { force: true });
+	}
+};
+//#endregion
+//#region src/internal/server/auth/auth-service.ts
+const loginGrantLifetimeMs = 10 * 6e4;
+const localBearerLifetimeMs = 6e4;
+const maxCodeAttempts = 8;
+const lastSeenWriteIntervalMs = 6e4;
+const codeAlphabet = "23456789ABCDEFGHJKLMNPQRSTUVWXYZ";
+const loginGrantSchema$1 = z.object({
+	codeHash: z.string(),
+	codeLookupHash: z.string(),
+	consumedAt: z.string().optional(),
+	createdAt: z.string(),
+	expiresAt: z.string(),
+	failedCodeAttempts: z.number().int().nonnegative(),
+	id: z.string(),
+	linkTokenHash: z.string()
+});
+const authSessionSchema = z.object({
+	createdAt: z.string(),
+	expiresAt: z.string().optional(),
+	id: z.string(),
+	kind: z.enum(["browser", "local"]),
+	lastSeenAt: z.string(),
+	origin: z.string().optional(),
+	revokedAt: z.string().optional(),
+	tokenHash: z.string()
+});
+const authStoreSchema = z.object({
+	grants: z.array(loginGrantSchema$1),
+	installationId: z.string(),
+	sessions: z.array(authSessionSchema),
+	version: z.literal(1)
+});
+const tokenHash = (token) => createHash("sha256").update(token, "utf8").digest("hex");
+const hashesEqual = (left, right) => {
+	const leftBytes = Buffer.from(left, "hex");
+	const rightBytes = Buffer.from(right, "hex");
+	return leftBytes.length === rightBytes.length && timingSafeEqual(leftBytes, rightBytes);
+};
+const randomToken = () => randomBytes(32).toString("base64url");
+const randomCode = () => {
+	const bytes = randomBytes(8);
+	const characters = Array.from(bytes, (byte) => codeAlphabet[byte % 32]);
+	return `${characters.slice(0, 4).join("")}-${characters.slice(4).join("")}`;
+};
+const durationMilliseconds = (duration) => {
+	const milliseconds = durationToMilliseconds(authDurationSchema.parse(duration));
+	if (milliseconds === void 0) throw new Error("Expected a validated authentication duration");
+	return milliseconds;
+};
+const acquireStoreLock = async (path, deadline = Date.now() + 5e3) => {
+	await mkdir(dirname(path), {
+		mode: 448,
+		recursive: true
+	});
+	await chmod(dirname(path), 448);
+	try {
+		await (await open(path, "wx", 384)).close();
+		return () => rm(path, { force: true });
+	} catch (cause) {
+		if (cause.code !== "EEXIST") throw cause;
+		let lockAge;
+		try {
+			lockAge = Date.now() - (await stat(path)).mtimeMs;
+		} catch (statCause) {
+			if (statCause.code === "ENOENT") return acquireStoreLock(path, deadline);
+			throw statCause;
+		}
+		if (lockAge > 3e4) {
+			await rm(path, { force: true });
+			return acquireStoreLock(path, deadline);
+		}
+		if (Date.now() >= deadline) throw new Error("Timed out waiting for the authentication store lock");
+		await new Promise((resolve) => setTimeout(resolve, 10));
+		return acquireStoreLock(path, deadline);
+	}
+};
+const dataDirectory = ({ environment, homeDirectory }) => join(getOvermuxPaths({
+	environment,
+	homeDir: homeDirectory
+}).dataDir, "auth");
+const publicSession = ({ kind: _kind, tokenHash: _tokenHash, ...session }) => session;
+const activeSession = (session, now) => !session.revokedAt && (session.kind === "local" || Boolean(session.origin)) && (!session.expiresAt || Date.parse(session.expiresAt) > now);
+const revokeExpired = (store, currentTime) => {
+	const expiredIds = [];
+	return {
+		expiredIds,
+		sessions: store.sessions.map((session) => {
+			if (!session.revokedAt && session.expiresAt && Date.parse(session.expiresAt) <= currentTime) {
+				expiredIds.push(session.id);
+				return {
+					...session,
+					revokedAt: new Date(currentTime).toISOString()
+				};
+			}
+			return session;
+		})
+	};
+};
+const authenticateStoredToken = ({ currentTime, store, origin, token }) => {
+	const { expiredIds, sessions } = revokeExpired(store, currentTime);
+	const expectedHash = tokenHash(token);
+	const session = sessions.find((candidate) => hashesEqual(candidate.tokenHash, expectedHash));
+	const authenticated = session && activeSession(session, currentTime) && (session.kind === "local" || session.origin === origin) ? {
+		...session.expiresAt ? { expiresAt: session.expiresAt } : {},
+		id: session.id,
+		kind: session.kind,
+		...session.origin ? { origin: session.origin } : {},
+		token
+	} : void 0;
+	const updateLastSeen = Boolean(session && authenticated && currentTime - Date.parse(session.lastSeenAt) >= lastSeenWriteIntervalMs);
+	return {
+		authenticated,
+		expiredIds,
+		nextSessions: updateLastSeen ? sessions.map((candidate) => candidate.id === session?.id ? {
+			...candidate,
+			lastSeenAt: new Date(currentTime).toISOString()
+		} : candidate) : sessions,
+		updateLastSeen
+	};
+};
+const createAuthService = ({ config, environment = process.env, homeDirectory = homedir(), now = Date.now }) => {
+	const directory = dataDirectory({
+		environment,
+		homeDirectory
+	});
+	const storePath = join(directory, "auth.json");
+	const lockPath = join(directory, "auth.lock");
+	const listeners = /* @__PURE__ */ new Set();
+	let origins = config.origins;
+	let pendingWrite = Promise.resolve();
+	const readStore = async () => {
+		const existing = await readPrivateJson(storePath, authStoreSchema);
+		if (existing) return existing;
+		const initial = {
+			grants: [],
+			installationId: randomUUID(),
+			sessions: [],
+			version: 1
+		};
+		try {
+			await createPrivateJsonExclusively(storePath, initial);
+			return initial;
+		} catch (cause) {
+			if (cause.code !== "EEXIST") throw cause;
+			const concurrentlyCreated = await readPrivateJson(storePath, authStoreSchema);
+			if (!concurrentlyCreated) throw cause;
+			return concurrentlyCreated;
+		}
+	};
+	const updateStore = (update) => {
+		const operation = pendingWrite.then(async () => {
+			const release = await acquireStoreLock(lockPath);
+			try {
+				const updated = update(await readStore());
+				if (updated.store) await replacePrivateJsonAtomically(storePath, updated.store);
+				emitRevoked(updated.revokedIds ?? []);
+				return updated.result;
+			} finally {
+				await release();
+			}
+		});
+		pendingWrite = operation.then(() => void 0, () => void 0);
+		return operation;
+	};
+	const emitRevoked = (ids) => {
+		if (ids.length === 0) return;
+		const revoked = new Set(ids);
+		listeners.forEach((listener) => listener(revoked));
+	};
+	const createSession = ({ kind, lifetimeMs, origin }) => {
+		const token = randomToken();
+		const createdAt = new Date(now()).toISOString();
+		const configuredLifetime = config.sessionLifetime && config.sessionLifetime !== "never" ? durationMilliseconds(config.sessionLifetime) : void 0;
+		const expiresIn = lifetimeMs ?? configuredLifetime;
+		return {
+			stored: {
+				createdAt,
+				...expiresIn ? { expiresAt: new Date(now() + expiresIn).toISOString() } : {},
+				id: randomUUID(),
+				kind,
+				lastSeenAt: createdAt,
+				...origin ? { origin } : {},
+				tokenHash: tokenHash(token)
+			},
+			token
+		};
+	};
+	const authenticateToken = async (token, origin) => {
+		await pendingWrite;
+		const currentTime = now();
+		const inspected = authenticateStoredToken({
+			currentTime,
+			origin,
+			store: await readStore(),
+			token
+		});
+		if (inspected.expiredIds.length === 0 && !inspected.updateLastSeen) return inspected.authenticated;
+		return updateStore((store) => {
+			const current = authenticateStoredToken({
+				currentTime: now(),
+				origin,
+				store,
+				token
+			});
+			return {
+				result: current.authenticated,
+				revokedIds: current.expiredIds,
+				store: {
+					...store,
+					sessions: current.nextSessions
+				}
+			};
+		});
+	};
+	return {
+		authenticateToken,
+		consumeLoginGrant: (input) => updateStore((store) => {
+			const currentTime = now();
+			const presented = input.code?.trim().toUpperCase() ?? input.ticket;
+			if (!presented || Boolean(input.code) === Boolean(input.ticket)) return { result: { status: "invalid" } };
+			const expectedHash = tokenHash(presented);
+			const codeLookupHash = input.code ? tokenHash(presented.split("-", 1)[0] ?? "") : void 0;
+			const exactCodeIndex = store.grants.findIndex((grant) => hashesEqual(grant.codeHash, expectedHash));
+			const codeIndex = exactCodeIndex >= 0 ? exactCodeIndex : store.grants.findIndex((grant) => hashesEqual(grant.codeLookupHash, codeLookupHash ?? ""));
+			const index = input.code ? codeIndex : store.grants.findIndex((grant) => hashesEqual(grant.linkTokenHash, expectedHash));
+			if (index < 0) return { result: { status: "invalid" } };
+			const grant = store.grants[index];
+			if (grant.consumedAt) return { result: { status: "invalid" } };
+			if (Date.parse(grant.expiresAt) <= currentTime) return { result: { status: "expired" } };
+			if (input.code && grant.failedCodeAttempts >= maxCodeAttempts) return { result: { status: "rate-limited" } };
+			if (input.code && !hashesEqual(grant.codeHash, expectedHash)) {
+				const grants = store.grants.map((candidate, grantIndex) => grantIndex === index ? {
+					...candidate,
+					failedCodeAttempts: candidate.failedCodeAttempts + 1
+				} : candidate);
+				return {
+					result: { status: "invalid" },
+					store: {
+						...store,
+						grants
+					}
+				};
+			}
+			const { stored, token } = createSession({
+				kind: "browser",
+				origin: input.origin
+			});
+			const grants = store.grants.map((candidate, grantIndex) => grantIndex === index ? {
+				...candidate,
+				consumedAt: new Date(currentTime).toISOString()
+			} : candidate);
+			return {
+				result: {
+					session: publicSession(stored),
+					status: "authenticated",
+					token
+				},
+				store: {
+					...store,
+					grants,
+					sessions: [...store.sessions.filter((session) => activeSession(session, currentTime)), stored]
+				}
+			};
+		}),
+		createLoginGrant: () => updateStore((store) => {
+			if (!origins) throw new Error("The server has not established its browser origins");
+			const code = randomCode();
+			const ticket = randomToken();
+			const createdAt = new Date(now()).toISOString();
+			const expiresAt = new Date(now() + loginGrantLifetimeMs).toISOString();
+			const id = randomUUID();
+			const grant = {
+				codeHash: tokenHash(code),
+				codeLookupHash: tokenHash(code.split("-", 1)[0]),
+				createdAt,
+				expiresAt,
+				failedCodeAttempts: 0,
+				id,
+				linkTokenHash: tokenHash(ticket)
+			};
+			return {
+				result: {
+					code,
+					expiresAt,
+					id,
+					urls: origins.map((origin) => `${origin}/login#ticket=${encodeURIComponent(ticket)}`)
+				},
+				store: {
+					...store,
+					grants: [...store.grants.filter((candidate) => Date.parse(candidate.expiresAt) > now() && !candidate.consumedAt), grant]
+				}
+			};
+		}),
+		issueLocalBearer: () => updateStore((store) => {
+			const currentTime = now();
+			const { stored, token } = createSession({
+				kind: "local",
+				lifetimeMs: localBearerLifetimeMs
+			});
+			return {
+				result: {
+					expiresAt: stored.expiresAt,
+					token
+				},
+				store: {
+					...store,
+					sessions: [...store.sessions.filter((session) => activeSession(session, currentTime)), stored]
+				}
+			};
+		}),
+		isSessionActive: (id) => updateStore((store) => {
+			const currentTime = now();
+			const { expiredIds, sessions } = revokeExpired(store, currentTime);
+			return {
+				result: Boolean(sessions.find((session) => session.id === id && activeSession(session, currentTime))),
+				revokedIds: expiredIds,
+				...expiredIds.length > 0 ? { store: {
+					...store,
+					sessions
+				} } : {}
+			};
+		}),
+		listSessions: () => updateStore((store) => {
+			const currentTime = now();
+			const { expiredIds, sessions } = revokeExpired(store, currentTime);
+			return {
+				result: sessions.filter((session) => session.kind === "browser" && activeSession(session, currentTime)).map(publicSession),
+				revokedIds: expiredIds,
+				...expiredIds.length > 0 ? { store: {
+					...store,
+					sessions
+				} } : {}
+			};
+		}),
+		onSessionsRevoked: (listener) => {
+			listeners.add(listener);
+			return () => listeners.delete(listener);
+		},
+		revokeAllSessions: () => updateStore((store) => {
+			const currentTime = now();
+			const expired = revokeExpired(store, currentTime);
+			const ids = expired.sessions.filter((session) => session.kind === "browser" && activeSession(session, currentTime)).map((session) => session.id);
+			const revoked = new Set(ids);
+			const revokedAt = new Date(currentTime).toISOString();
+			const sessions = expired.sessions.map((session) => revoked.has(session.id) ? {
+				...session,
+				revokedAt
+			} : session);
+			const revokedIds = [...expired.expiredIds, ...ids];
+			return {
+				result: ids.length,
+				revokedIds,
+				...revokedIds.length > 0 ? { store: {
+					...store,
+					sessions
+				} } : {}
+			};
+		}),
+		revokeSession: (id) => updateStore((store) => {
+			if (!store.sessions.find((candidate) => candidate.id === id && !candidate.revokedAt)) return { result: false };
+			const revokedAt = new Date(now()).toISOString();
+			const sessions = store.sessions.map((candidate) => candidate.id === id ? {
+				...candidate,
+				revokedAt
+			} : candidate);
+			return {
+				result: true,
+				revokedIds: [id],
+				store: {
+					...store,
+					sessions
+				}
+			};
+		}),
+		setOrigins: (nextOrigins) => {
+			origins = nextOrigins.map((origin) => new URL(origin).origin);
+		}
+	};
+};
+//#endregion
+//#region src/internal/server/rate-limiter.ts
+const createRateLimiter = ({ maxAttemptsPerKey, maxGlobalAttempts, maxTrackedKeys, windowMs }) => ({
+	attemptsByKey: /* @__PURE__ */ new Map(),
+	globalAttempts: [],
+	maxAttemptsPerKey,
+	maxGlobalAttempts,
+	maxTrackedKeys,
+	windowMs
+});
+const hasRateLimitCapacity = ({ currentTime = Date.now(), key, limiter }) => {
+	const threshold = currentTime - limiter.windowMs;
+	const recent = (limiter.attemptsByKey.get(key) ?? []).filter((attempt) => attempt > threshold);
+	limiter.globalAttempts = limiter.globalAttempts.filter((attempt) => attempt > threshold);
+	if (recent.length >= limiter.maxAttemptsPerKey || limiter.globalAttempts.length >= limiter.maxGlobalAttempts) {
+		limiter.attemptsByKey.set(key, recent);
+		return false;
+	}
+	limiter.attemptsByKey.set(key, [...recent, currentTime]);
+	limiter.globalAttempts.push(currentTime);
+	if (limiter.attemptsByKey.size > limiter.maxTrackedKeys) limiter.attemptsByKey.clear();
+	return true;
+};
+//#endregion
+//#region src/internal/server/auth/auth-shell-http.ts
+const authEntry = "index.html";
+const fingerprintedAssetPattern = /^assets\/[A-Za-z0-9_.-]+-[A-Za-z0-9_-]{8}\.(?:css|js)$/;
+const defaultAuthAssetsDirectory = () => fileURLToPath(new URL("../auth/", import.meta.resolve("overmux")));
+const loadAuthShell = (directory = defaultAuthAssetsDirectory()) => {
+	const manifest = JSON.parse(readFileSync(`${directory}/.vite/manifest.json`, "utf8"));
+	const entry = manifest[authEntry];
+	if (!entry?.file || !entry.css?.length) throw new Error("The packaged Overmux authentication assets are incomplete");
+	const paths = new Set(Object.values(manifest).flatMap(({ css = [], file }) => file ? [file, ...css] : css));
+	const invalidPath = [...paths].find((path) => !fingerprintedAssetPattern.test(path));
+	if (invalidPath) throw new Error(`Invalid Overmux authentication asset path: ${invalidPath}`);
+	return {
+		files: new Map([...paths].map((path) => [path, {
+			body: Uint8Array.from(readFileSync(`${directory}/${path}`)).buffer,
+			contentType: path.endsWith(".css") ? "text/css; charset=UTF-8" : "text/javascript; charset=UTF-8"
+		}])),
+		html: readFileSync(`${directory}/index.html`, "utf8")
+	};
+};
+const serveAuthShellAsset = (context, shell) => {
+	const asset = shell.files.get(context.req.path.slice(21));
+	if (!asset) return context.body(null, 404);
+	context.header("Cache-Control", "public, max-age=31536000, immutable");
+	context.header("Content-Type", asset.contentType);
+	context.header("Cross-Origin-Resource-Policy", "same-origin");
+	context.header("X-Content-Type-Options", "nosniff");
+	return context.body(asset.body);
+};
+const renderAuthShell = (context, shell, status = 200) => {
+	context.header("Cache-Control", "no-store");
+	context.header("Content-Security-Policy", "default-src 'none'; script-src 'self'; style-src 'self'; connect-src 'self'; base-uri 'none'; form-action 'self'; frame-ancestors 'none'");
+	context.header("Cross-Origin-Resource-Policy", "same-origin");
+	context.header("Referrer-Policy", "no-referrer");
+	context.header("X-Content-Type-Options", "nosniff");
+	return context.html(shell.html, status);
+};
+const isBrowserNavigation = (request) => request.headers.get("Sec-Fetch-Dest") === "document" || request.headers.get("Accept")?.includes("text/html");
+//#endregion
+//#region src/internal/server/auth/auth-http.ts
+const maxLoginBodyBytes = 4096;
+const loginWindowMs = 6e4;
+const maxLoginRequestsPerWindow = 12;
+const maxGlobalLoginRequestsPerWindow = 120;
+const maxTrackedLoginAddresses = 1e4;
+const neverCookieLifetimeSeconds = 400 * 24 * 60 * 60;
+const sessionCookieName = "overmux_session";
+const bearerToken = (header) => /^Bearer ([A-Za-z0-9_-]+)$/.exec(header ?? "")?.[1];
+const isLoopbackHostname = (hostname) => hostname === "localhost" || hostname === "::1" || hostname === "[::1]" || /^127(?:\.\d{1,3}){3}$/.test(hostname);
+const validateAuthOrigin = (origin) => {
+	const url = new URL(origin);
+	if (url.origin !== origin) throw new Error("auth.origins must contain exact origins without paths");
+	if (url.protocol !== "https:" && !(url.protocol === "http:" && isLoopbackHostname(url.hostname))) throw new Error("Non-loopback Overmux origins must use HTTPS");
+	return origin;
+};
+const exactForwardedValue = (value) => value !== null && value === value.trim() && !value.includes(",") ? value : void 0;
+const resolveRequestOrigin = ({ origins, remoteAddress, request, trustedProxyPeer }) => {
+	const requestUrl = new URL(request.url);
+	const forwardedHost = request.headers.get("X-Forwarded-Host");
+	const forwardedProto = request.headers.get("X-Forwarded-Proto");
+	if (trustedProxyPeer !== void 0 && remoteAddress === trustedProxyPeer && (forwardedHost !== null || forwardedProto !== null)) {
+		const host = exactForwardedValue(forwardedHost);
+		if (exactForwardedValue(forwardedProto) !== "https" || !host || requestUrl.protocol !== "http:" || requestUrl.host !== host) return;
+		const forwardedOrigin = new URL(`https://${host}`).origin;
+		return origins.includes(forwardedOrigin) ? forwardedOrigin : void 0;
+	}
+	return origins.includes(requestUrl.origin) ? requestUrl.origin : void 0;
+};
+const cookieMaxAge = (expiresAt) => Math.min(neverCookieLifetimeSeconds, expiresAt ? Math.max(0, Math.floor((Date.parse(expiresAt) - Date.now()) / 1e3)) : neverCookieLifetimeSeconds);
+const generateSessionCookie = ({ origin, token, maxAge }) => generateCookie(sessionCookieName, token, {
+	httpOnly: true,
+	maxAge,
+	path: "/",
+	sameSite: "Strict",
+	...new URL(origin).protocol === "https:" ? { prefix: "host" } : {}
+});
+const createRequestAuthentication = ({ service }) => {
+	const cookieName = (origin) => new URL(origin).protocol === "https:" ? `__Host-${sessionCookieName}` : sessionCookieName;
+	const cookieHeader = (origin, token, expiresAt) => generateSessionCookie({
+		maxAge: cookieMaxAge(expiresAt),
+		origin,
+		token
+	});
+	return {
+		authenticate: async (request, origin) => {
+			const authorizationHeader = request.headers.get("Authorization");
+			if (authorizationHeader !== null) {
+				const token = bearerToken(authorizationHeader);
+				const authenticatedSession = token ? await service.authenticateToken(token) : void 0;
+				return authenticatedSession?.kind === "local" ? {
+					...authenticatedSession,
+					credential: "bearer"
+				} : void 0;
+			}
+			if (!origin) return;
+			const name = cookieName(origin);
+			const token = parse(request.headers.get("Cookie") ?? "", name)[name];
+			const authenticatedSession = token ? await service.authenticateToken(token, origin) : void 0;
+			return authenticatedSession?.kind === "browser" ? {
+				...authenticatedSession,
+				credential: "cookie"
+			} : void 0;
+		},
+		clearCookieHeader: (origin) => generateSessionCookie({
+			maxAge: 0,
+			origin,
+			token: ""
+		}),
+		cookieHeader
+	};
+};
+const createAuthBoundary = ({ origins, service, trustedProxyPeer }) => ({
+	requests: createRequestAuthentication({ service }),
+	resolveOrigin: (input) => resolveRequestOrigin({
+		...input,
+		origins: origins(),
+		trustedProxyPeer
+	}),
+	service
+});
+const loginInputSchema = z.union([z.object({ code: z.string() }).strict(), z.object({ ticket: z.string() }).strict()]);
+const parseLoginBody = async (request) => {
+	if (request.headers.get("Content-Type")?.split(";", 1)[0]?.toLowerCase() !== "application/json") return;
+	try {
+		return loginInputSchema.safeParse(await request.json()).data;
+	} catch {
+		return;
+	}
+};
+const hasTrustedBrowserHeaders = (request, origin) => request.headers.get("Origin") === origin && request.headers.get("Sec-Fetch-Site") === "same-origin";
+const changesState = (request) => ![
+	"GET",
+	"HEAD",
+	"OPTIONS"
+].includes(request.method);
+const requestOrigin = (auth, context) => auth.resolveOrigin({
+	remoteAddress: context.env?.incoming?.socket.remoteAddress,
+	request: context.req.raw
+});
+const createHttpAuthenticationHandlers = ({ auth, authAssetsDirectory }) => {
+	const authShell = loadAuthShell(authAssetsDirectory);
+	const loginRateLimiter = createRateLimiter({
+		maxAttemptsPerKey: maxLoginRequestsPerWindow,
+		maxGlobalAttempts: maxGlobalLoginRequestsPerWindow,
+		maxTrackedKeys: maxTrackedLoginAddresses,
+		windowMs: loginWindowMs
+	});
+	return {
+		asset: (context) => serveAuthShellAsset(context, authShell),
+		state: async (context) => {
+			context.header("Cache-Control", "no-store");
+			const origin = requestOrigin(auth, context);
+			const session = await auth.requests.authenticate(context.req.raw, origin);
+			if (session?.credential === "cookie" && origin) context.header("Set-Cookie", auth.requests.cookieHeader(origin, session.token, session.expiresAt));
+			return context.json({ authenticated: Boolean(session) });
+		},
+		loginBodyLimitMiddleware: bodyLimit({
+			maxSize: maxLoginBodyBytes,
+			onError: (context) => context.json({ error: "Login request is too large" }, 413)
+		}),
+		login: async (context) => {
+			context.header("Cache-Control", "no-store");
+			const origin = requestOrigin(auth, context);
+			if (!origin || !hasTrustedBrowserHeaders(context.req.raw, origin)) return context.json({ error: "Login request origin was rejected" }, 403);
+			if (!hasRateLimitCapacity({
+				key: context.env?.incoming?.socket.remoteAddress ?? "unknown",
+				limiter: loginRateLimiter
+			})) return context.json({ status: "rate-limited" }, 429);
+			const input = await parseLoginBody(context.req.raw);
+			if (!input) return context.json({ error: "Invalid login request" }, 400);
+			const result = await auth.service.consumeLoginGrant({
+				...input,
+				origin
+			});
+			if (result.status !== "authenticated") return context.json({ status: result.status }, result.status === "rate-limited" ? 429 : 401);
+			context.header("Set-Cookie", auth.requests.cookieHeader(origin, result.token, result.session.expiresAt));
+			return context.json({ authenticated: true });
+		},
+		loginPage: async (context) => {
+			const origin = requestOrigin(auth, context);
+			if (await auth.requests.authenticate(context.req.raw, origin)) return context.redirect("/");
+			return renderAuthShell(context, authShell);
+		},
+		authenticate: async (context, next) => {
+			const origin = requestOrigin(auth, context);
+			let session;
+			try {
+				session = await auth.requests.authenticate(context.req.raw, origin);
+			} catch {
+				context.header("Cache-Control", "no-store");
+				return context.json({ error: "Authentication service unavailable" }, 503);
+			}
+			if (!session) {
+				if (!context.req.path.startsWith("/api/") && isBrowserNavigation(context.req.raw)) return renderAuthShell(context, authShell, 401);
+				context.header("Cache-Control", "no-store");
+				return context.json({ error: "Authentication required" }, 401);
+			}
+			context.set("session", session);
+			context.header("Cache-Control", "private, no-store");
+			if (session.credential === "cookie") {
+				if (!origin || changesState(context.req.raw) && !hasTrustedBrowserHeaders(context.req.raw, origin)) return context.json({ error: "Request origin was rejected" }, 403);
+				context.header("Set-Cookie", auth.requests.cookieHeader(origin, session.token, session.expiresAt));
+			}
+			await next();
+		},
+		logout: async (context) => {
+			const session = context.get("session");
+			await auth.service.revokeSession(session.id);
+			if (session.origin) context.header("Set-Cookie", auth.requests.clearCookieHeader(session.origin));
+			return context.json({ authenticated: false });
+		}
+	};
+};
+//#endregion
+//#region src/internal/server/auth/instance-control.ts
+const maxControlMessageBytes = 16384;
+const controlRequestSchema = z.discriminatedUnion("type", [
+	z.object({ type: z.literal("ping") }).strict(),
+	z.object({ type: z.literal("create-login") }).strict(),
+	z.object({ type: z.literal("issue-bearer") }).strict(),
+	z.object({ type: z.literal("list-sessions") }).strict(),
+	z.object({
+		id: z.string(),
+		type: z.literal("revoke-session")
+	}).strict(),
+	z.object({ type: z.literal("revoke-all") }).strict()
+]);
+const loginGrantSchema = z.object({
+	code: z.string(),
+	expiresAt: z.string(),
+	id: z.string(),
+	urls: z.array(z.string())
+}).strict();
+const sessionSchema = z.object({
+	createdAt: z.string(),
+	expiresAt: z.string().optional(),
+	id: z.string(),
+	lastSeenAt: z.string(),
+	origin: z.string().optional(),
+	revokedAt: z.string().optional()
+}).strict();
+z.object({
+	login: loginGrantSchema,
+	ok: z.literal(true)
+}).strict(), z.object({
+	bearer: z.object({
+		expiresAt: z.string(),
+		token: z.string()
+	}).strict(),
+	ok: z.literal(true)
+}).strict(), z.object({
+	ok: z.literal(true),
+	sessions: z.array(sessionSchema)
+}).strict(), z.object({ ok: z.literal(true) }).strict(), z.object({
+	count: z.number().int().nonnegative(),
+	ok: z.literal(true)
+}).strict(), z.object({
+	ok: z.literal(true),
+	revoked: z.boolean()
+}).strict();
+z.object({
+	error: z.unknown().optional(),
+	ok: z.unknown()
+}).passthrough();
+z.object({
+	apiUrl: z.string().url(),
+	controlSocket: z.string(),
+	id: z.string(),
+	pid: z.number().int().positive(),
+	port: z.number().int().min(1).max(65535),
+	url: z.string().url()
+});
+const runtimeDirectory = () => {
+	const paths = getOvermuxPaths();
+	const preferred = paths.runtimeDir ?? join(paths.stateDir, "runtime");
+	if (Buffer.byteLength(preferred) <= 80) return preferred;
+	const suffix = createHash("sha256").update(preferred).digest("hex").slice(0, 12);
+	return join(tmpdir(), `overmux-${process.getuid?.() ?? "user"}-${suffix}`);
+};
+const readNewlineFrame = ({ maximumBytes, socket, timeout }) => new Promise((resolve, reject) => {
+	let buffer = Buffer.alloc(0);
+	let timer;
+	const cleanup = () => {
+		socket.off("data", onData);
+		socket.off("end", onEnd);
+		socket.off("error", onError);
+		if (timer) clearTimeout(timer);
+	};
+	const fail = (cause) => {
+		cleanup();
+		reject(cause);
+	};
+	const onData = (chunk) => {
+		buffer = Buffer.concat([buffer, chunk]);
+		if (buffer.length > maximumBytes) {
+			fail(/* @__PURE__ */ new Error("Control message is too large"));
+			return;
+		}
+		const newline = buffer.indexOf(10);
+		if (newline < 0) return;
+		cleanup();
+		resolve(buffer.subarray(0, newline));
+	};
+	const onEnd = () => fail(/* @__PURE__ */ new Error("Control socket ended before a complete frame"));
+	const onError = (cause) => fail(cause);
+	if (socket.errored) fail(socket.errored);
+	else if (socket.readableEnded || socket.destroyed) fail(/* @__PURE__ */ new Error("Control socket is already closed"));
+	else {
+		socket.on("data", onData);
+		socket.once("end", onEnd);
+		socket.once("error", onError);
+		if (timeout !== void 0) timer = setTimeout(() => {
+			socket.destroy();
+			fail(/* @__PURE__ */ new Error("Control request timed out"));
+		}, timeout);
+	}
+});
+const writeResponse = (socket, response) => {
+	socket.end(`${JSON.stringify(response)}\n`);
+};
+const handleRequest = async (auth, request) => {
+	if (request.type === "ping") return { ok: true };
+	if (request.type === "create-login") return {
+		login: await auth.createLoginGrant(),
+		ok: true
+	};
+	if (request.type === "issue-bearer") return {
+		bearer: await auth.issueLocalBearer(),
+		ok: true
+	};
+	if (request.type === "list-sessions") return {
+		ok: true,
+		sessions: await auth.listSessions()
+	};
+	if (request.type === "revoke-session") return {
+		ok: true,
+		revoked: await auth.revokeSession(request.id)
+	};
+	return {
+		count: await auth.revokeAllSessions(),
+		ok: true
+	};
+};
+const handleConnection = async ({ auth, socket }) => {
+	try {
+		const frame = await readNewlineFrame({
+			maximumBytes: maxControlMessageBytes,
+			socket
+		});
+		const request = controlRequestSchema.parse(JSON.parse(frame.toString()));
+		writeResponse(socket, await handleRequest(auth, request));
+	} catch (cause) {
+		writeResponse(socket, {
+			error: cause instanceof Error ? cause.message : "Invalid control request",
+			ok: false
+		});
+	}
+};
+const startInstanceControl = async ({ auth, apiUrl, port, url }) => {
+	const directory = runtimeDirectory();
+	await mkdir(directory, {
+		mode: 448,
+		recursive: true
+	});
+	await chmod(directory, 448);
+	const id = randomBytes(8).toString("hex");
+	const socketPath = join(directory, `${id}.sock`);
+	const registrationPath = join(directory, `${id}.json`);
+	const sockets = /* @__PURE__ */ new Set();
+	const server = createServer((socket) => {
+		sockets.add(socket);
+		socket.once("close", () => sockets.delete(socket));
+		handleConnection({
+			auth,
+			socket
+		});
+	});
+	const close = async () => {
+		sockets.forEach((socket) => socket.destroy());
+		try {
+			await new Promise((resolve, reject) => server.close((cause) => cause ? reject(cause) : resolve()));
+		} finally {
+			await Promise.all([rm(socketPath, { force: true }), rm(registrationPath, { force: true })]);
+		}
+	};
+	await new Promise((resolve, reject) => {
+		server.once("error", reject);
+		server.listen(socketPath, () => {
+			server.off("error", reject);
+			resolve();
+		});
+	});
+	try {
+		await chmod(socketPath, 384);
+		await replacePrivateJsonAtomically(registrationPath, {
+			apiUrl,
+			controlSocket: socketPath,
+			id,
+			pid: process.pid,
+			port,
+			url
+		});
+	} catch (cause) {
+		await close().catch(() => void 0);
+		throw cause;
+	}
+	return { close };
+};
+//#endregion
+//#region src/internal/shared/background-notifications.ts
+const deliveryKeySchema = z.string().min(1).max(1024).regex(/^[\w-]+$/u);
+const backgroundNotificationSubscriptionSchema = z.object({
+	endpoint: z.url().max(4096).refine((endpoint) => {
+		const url = new URL(endpoint);
+		return url.protocol === "https:" && !url.username && !url.password;
+	}),
+	expirationTime: z.number().int().nonnegative().nullable(),
+	keys: z.object({
+		auth: deliveryKeySchema,
+		p256dh: deliveryKeySchema
+	}).strict()
+}).strict();
+z.object({ publicKey: deliveryKeySchema }).strict();
+const backgroundNotificationDisableRequestSchema = z.object({ endpoint: backgroundNotificationSubscriptionSchema.shape.endpoint }).strict();
+const overmuxSettingsPath = "/_overmux/settings";
+const overmuxLogoutPath = "/_overmux/logout";
+const safeRelativeNotificationLink = (link) => {
+	let decoded;
+	try {
+		decoded = decodeURIComponent(link);
+	} catch {
+		return false;
+	}
+	return !decoded.startsWith("//") && !decoded.includes("\\") && ![...decoded].some((character) => {
+		const codePoint = character.codePointAt(0) ?? 0;
+		return codePoint < 32 || codePoint === 127;
+	});
+};
+const notificationLinkSchema = z.union([z.string().max(4096).startsWith("/").refine(safeRelativeNotificationLink), z.string().max(4096).url().refine((link) => {
+	if (!URL.canParse(link)) return false;
+	const url = new URL(link);
+	return ["http:", "https:"].includes(url.protocol) && !url.username && !url.password;
+})]);
+const notificationSchema = z.object({
+	body: z.string().max(4096).optional(),
+	open: z.object({ link: notificationLinkSchema }).strict().optional(),
+	title: z.string().min(1).max(4096)
+}).strict();
+const webSocketCloseCode = {
+	authenticationRevoked: 4001,
+	authenticationUnavailable: 4002
+};
+z.object({
+	debug: z.boolean(),
+	operations: z.array(z.string().min(1)),
+	protocolVersion: z.literal(9),
+	resources: z.array(z.string().min(1)),
+	streams: z.array(z.string().min(1))
+});
+const updateAvailableEventSchema = z.object({ type: z.literal("update-available") });
+const restartingEventSchema = z.object({ type: z.literal("restarting") });
+z.discriminatedUnion("type", [updateAvailableEventSchema, restartingEventSchema]);
+const notificationEventSchema = z.object({
+	notification: notificationSchema,
+	type: z.literal("notification")
+}).strict();
+const operationIdSchema = z.string().min(1).max(256);
+const registrationNameSchema = z.string().min(1).max(256);
+const resourceReadMessageSchema = z.object({
+	input: z.unknown().optional(),
+	operationId: operationIdSchema,
+	resourceName: registrationNameSchema,
+	type: z.literal("resource-read")
+});
+const resourceSubscribeMessageSchema = z.object({
+	input: z.unknown().optional(),
+	operationId: operationIdSchema,
+	resourceName: registrationNameSchema,
+	subscriptionId: operationIdSchema,
+	type: z.literal("resource-subscribe")
+});
+const resourceUnsubscribeMessageSchema = z.object({
+	subscriptionId: operationIdSchema,
+	type: z.literal("resource-unsubscribe")
+});
+const streamOpenMessageSchema = z.object({
+	input: z.unknown().optional(),
+	operationId: operationIdSchema,
+	streamId: operationIdSchema,
+	streamName: registrationNameSchema,
+	type: z.literal("stream-open")
+});
+const streamMessageSchema = z.object({
+	message: z.unknown(),
+	streamId: operationIdSchema,
+	type: z.literal("stream-message")
+});
+const streamCloseMessageSchema = z.object({
+	streamId: operationIdSchema,
+	type: z.literal("stream-close")
+});
+const clientDiagnosticEventSchema = z.object({
+	arguments: z.string().max(16100),
+	level: z.enum([
+		"log",
+		"info",
+		"warn",
+		"error",
+		"debug"
+	]),
+	message: z.string().max(4100),
+	stack: z.string().max(8100).optional(),
+	timestamp: z.iso.datetime(),
+	type: z.literal("client-diagnostic"),
+	url: z.string().max(2100).optional()
+});
+const clientProtocolMessageSchema = z.discriminatedUnion("type", [
+	resourceReadMessageSchema,
+	resourceSubscribeMessageSchema,
+	resourceUnsubscribeMessageSchema,
+	streamOpenMessageSchema,
+	streamMessageSchema,
+	streamCloseMessageSchema,
+	clientDiagnosticEventSchema
+]);
+const resourceResultMessageSchema = z.object({
+	operationId: operationIdSchema,
+	output: z.unknown(),
+	type: z.literal("resource-result")
+});
+const resourceInvalidatedMessageSchema = z.object({
+	subscriptionId: operationIdSchema,
+	type: z.literal("resource-invalidated")
+});
+const streamOpenedMessageSchema = z.object({
+	operationId: operationIdSchema,
+	streamId: operationIdSchema,
+	type: z.literal("stream-opened")
+});
+const streamOutputMessageSchema = z.object({
+	message: z.unknown(),
+	streamId: operationIdSchema,
+	type: z.literal("stream-output")
+});
+const streamClosedMessageSchema = z.object({
+	streamId: operationIdSchema,
+	type: z.literal("stream-closed")
+});
+const protocolErrorMessageSchema = z.object({
+	code: z.enum([
+		"bad-request",
+		"conflict",
+		"internal",
+		"not-found"
+	]),
+	message: z.string(),
+	operationId: operationIdSchema.optional(),
+	streamId: operationIdSchema.optional(),
+	subscriptionId: operationIdSchema.optional(),
+	type: z.literal("error")
+});
+const serverProtocolMessageSchema = z.discriminatedUnion("type", [
+	resourceResultMessageSchema,
+	resourceInvalidatedMessageSchema,
+	streamOpenedMessageSchema,
+	streamOutputMessageSchema,
+	streamClosedMessageSchema,
+	protocolErrorMessageSchema,
+	updateAvailableEventSchema,
+	restartingEventSchema,
+	notificationEventSchema
+]);
+const byteMarker = "$overmuxBytes";
+const decodeValue = (value) => {
+	if (Array.isArray(value)) return value.map(decodeValue);
+	if (typeof value !== "object" || value === null) return value;
+	const record = value;
+	if (Object.keys(record).length === 1 && Array.isArray(record[byteMarker]) && record[byteMarker].every((item) => Number.isInteger(item) && item >= 0 && item <= 255)) return Uint8Array.from(record[byteMarker]);
+	return Object.fromEntries(Object.entries(record).map(([key, item]) => [key, decodeValue(item)]));
+};
+const binaryMarker = "$overmuxBinary";
+const binaryMagic = 1330468865;
+const encodeBinaryValue = (value, payloads, offset) => {
+	if (value instanceof Uint8Array) {
+		const marker = { [binaryMarker]: [offset.value, value.byteLength] };
+		payloads.push(value);
+		offset.value += value.byteLength;
+		return marker;
+	}
+	if (Array.isArray(value)) return value.map((item) => encodeBinaryValue(item, payloads, offset));
+	if (typeof value === "object" && value !== null) return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, encodeBinaryValue(item, payloads, offset)]));
+	return value;
+};
+const decodeBinaryValue = (value, payload) => {
+	if (Array.isArray(value)) return value.map((item) => decodeBinaryValue(item, payload));
+	if (typeof value !== "object" || value === null) return value;
+	const record = value;
+	const marker = record[binaryMarker];
+	if (Object.keys(record).length === 1 && Array.isArray(marker) && marker.length === 2 && marker.every((item) => Number.isInteger(item) && item >= 0)) {
+		const [offset, length] = marker;
+		if (offset + length > payload.byteLength) throw new Error("Invalid Overmux binary payload range");
+		return payload.slice(offset, offset + length);
+	}
+	return Object.fromEntries(Object.entries(record).map(([key, item]) => [key, decodeBinaryValue(item, payload)]));
+};
+const decodeProtocolMessage = (message) => decodeValue(JSON.parse(message));
+const encodeProtocolFrame = (message) => {
+	const payloads = [];
+	const encoded = encodeBinaryValue(message, payloads, { value: 0 });
+	if (!payloads.length) return JSON.stringify(encoded);
+	const header = new TextEncoder().encode(JSON.stringify(encoded));
+	const payloadLength = payloads.reduce((total, payload) => total + payload.byteLength, 0);
+	const frame = new Uint8Array(8 + header.byteLength + payloadLength);
+	const view = new DataView(frame.buffer);
+	view.setUint32(0, binaryMagic);
+	view.setUint32(4, header.byteLength);
+	frame.set(header, 8);
+	let offset = 8 + header.byteLength;
+	payloads.forEach((payload) => {
+		frame.set(payload, offset);
+		offset += payload.byteLength;
+	});
+	return frame;
+};
+const decodeProtocolFrame = (frame) => {
+	if (typeof frame === "string") return decodeProtocolMessage(frame);
+	const bytes = frame instanceof Uint8Array ? frame : new Uint8Array(frame, 0, frame.byteLength);
+	if (bytes.byteLength < 8) throw new Error("Invalid Overmux binary frame");
+	const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+	if (view.getUint32(0) !== binaryMagic) throw new Error("Invalid Overmux binary frame magic");
+	const headerLength = view.getUint32(4);
+	if (8 + headerLength > bytes.byteLength) throw new Error("Invalid Overmux binary frame header");
+	const header = JSON.parse(new TextDecoder().decode(bytes.subarray(8, 8 + headerLength)));
+	return decodeBinaryValue(header, bytes.subarray(8 + headerLength));
+};
+//#endregion
+//#region src/internal/server/http/background-notification-handlers.ts
+const requestLimit = 16384;
+const parseJson = async (request, schema) => {
+	if (request.headers.get("Content-Type")?.split(";", 1)[0]?.toLowerCase() !== "application/json") return;
+	if (Number(request.headers.get("Content-Length") ?? 0) > requestLimit) return;
+	try {
+		const bytes = await request.arrayBuffer();
+		if (bytes.byteLength > requestLimit) return;
+		const parsed = schema.safeParse(JSON.parse(new TextDecoder().decode(bytes)));
+		return parsed.success ? parsed.data : void 0;
+	} catch {
+		return;
+	}
+};
+const createBackgroundNotificationHandlers = ({ backgroundNotifications }) => ({
+	publicKey: async (context) => {
+		context.header("Cache-Control", "no-store");
+		return context.json({ publicKey: await backgroundNotifications.publicKey() });
+	},
+	enable: async (context) => {
+		const subscription = await parseJson(context.req.raw, backgroundNotificationSubscriptionSchema);
+		if (!subscription) return context.json({ error: "Invalid background subscription" }, 400);
+		await backgroundNotifications.enable(context.get("session").id, subscription);
+		return context.json({ ok: true });
+	},
+	disable: async (context) => {
+		const input = await parseJson(context.req.raw, backgroundNotificationDisableRequestSchema);
+		if (!input) return context.json({ error: "Invalid background subscription" }, 400);
+		await backgroundNotifications.disable(input.endpoint);
+		return context.json({ ok: true });
+	}
+});
+//#endregion
+//#region src/internal/server/server-logger.ts
+const lifecycleEvents = /* @__PURE__ */ new Set([
+	"server-start",
+	"server-stop",
+	"websocket-close",
+	"websocket-close-event",
+	"websocket-connect",
+	"websocket-open"
+]);
+const getDefaultServerLogFile = ({ homeDir, xdgStateHome } = {}) => join(getOvermuxPaths({
+	homeDir,
+	xdgStateHome
+}).stateDir, "overmux.log");
+const safeJson = (value) => {
+	try {
+		return JSON.stringify(value);
+	} catch {
+		return JSON.stringify({
+			event: "log-serialization-error",
+			level: "error",
+			source: "server",
+			timestamp: (/* @__PURE__ */ new Date()).toISOString()
+		});
+	}
+};
+const createServerLogger = ({ enabled, logFile = getDefaultServerLogFile() }) => {
+	let activeLogFile = logFile;
+	let debugEnabled = enabled;
+	return {
+		get enabled() {
+			return debugEnabled;
+		},
+		id: randomUUID,
+		log: (entry) => {
+			if (!debugEnabled && entry.level !== "error" && !lifecycleEvents.has(entry.event)) return;
+			const record = safeJson({
+				timestamp: entry.timestamp ?? (/* @__PURE__ */ new Date()).toISOString(),
+				level: entry.level ?? "info",
+				source: entry.source ?? "server",
+				...entry
+			});
+			mkdirSync(dirname(activeLogFile), { recursive: true });
+			appendFileSync(activeLogFile, `${record}\n`, "utf8");
+			process.stderr.write(`[overmux:debug] ${record}\n`);
+		},
+		setEnabled: (nextEnabled) => {
+			debugEnabled = nextEnabled;
+		},
+		setLogFile: (nextLogFile) => {
+			activeLogFile = nextLogFile;
+		}
+	};
+};
+const errorMessage = (cause) => cause instanceof Error ? cause.message : String(cause);
+const errorDetails$1 = (cause) => ({
+	message: errorMessage(cause),
+	...cause instanceof Error && cause.stack ? { stack: cause.stack } : {}
+});
+//#endregion
+//#region src/internal/server/http/development-web-backend.ts
+const createForwardingHeaders = ({ origin, remoteAddress, request }) => {
+	const headers = new Headers(request.headers);
+	[...headers.keys()].forEach((name) => {
+		if (name === "authorization" || name === "cookie" || name === "forwarded" || name.startsWith("x-forwarded-")) headers.delete(name);
+	});
+	const publicUrl = new URL(origin);
+	if (remoteAddress) headers.set("x-forwarded-for", remoteAddress);
+	headers.set("x-forwarded-host", publicUrl.host);
+	headers.set("x-forwarded-port", publicUrl.port || (publicUrl.protocol === "https:" ? "443" : "80"));
+	headers.set("x-forwarded-proto", publicUrl.protocol.slice(0, -1));
+	return headers;
+};
+const createDevelopmentWebHandler = ({ auth, serverLogger, target }) => async (context) => {
+	const incoming = context.env?.incoming;
+	const origin = auth.resolveOrigin({
+		remoteAddress: incoming?.socket.remoteAddress,
+		request: context.req.raw
+	});
+	if (!origin) return context.text("Request origin was rejected", 403);
+	const headers = createForwardingHeaders({
+		origin,
+		remoteAddress: incoming?.socket.remoteAddress,
+		request: context.req.raw
+	});
+	try {
+		return await proxyFetch(target, new Request(context.req.raw, { headers }), void 0, {
+			changeOrigin: true,
+			xfwd: false
+		});
+	} catch (cause) {
+		serverLogger?.log({
+			details: errorDetails$1(cause),
+			event: "vite-http-proxy-failure",
+			level: "error"
+		});
+		return context.text("Overmux development server is unavailable", 503, { "Cache-Control": "no-store" });
+	}
+};
+//#endregion
+//#region src/internal/server/http/control-handlers.ts
+const createHealthHandler = ({ shutdown }) => (context) => shutdown.requested ? context.json({ status: "stopping" }, 503) : context.json({ status: "ok" });
+const createRestartHandler = ({ onRestartRequested, shutdown }) => (context) => {
+	const response = context.json({ status: "restarting" }, 202);
+	if (!onRestartRequested) return response;
+	const beginRestart = () => {
+		shutdown.requested = true;
+		onRestartRequested();
+	};
+	const nodeResponse = context.env?.outgoing;
+	if (nodeResponse) nodeResponse.once("finish", beginRestart);
+	else setImmediate(beginRestart);
+	return response;
+};
+//#endregion
+//#region src/internal/server/runtime/runtime-operations.ts
+var OperationValidationError = class extends Error {
+	phase;
+	constructor(phase, cause) {
+		super(cause.message, { cause });
+		this.phase = phase;
+	}
+};
+const createRuntimeOperations = ({ context, definitions, notifications }) => {
+	const operations = /* @__PURE__ */ new Map();
+	Object.entries(definitions).forEach(([name, definition]) => {
+		if (!name) throw new Error("Operation names must not be empty");
+		operations.set(name, {
+			execute: async (rawInput, signal) => {
+				const operationContext = context(signal);
+				operationContext.signal.throwIfAborted();
+				const input = definition.input.safeParse(rawInput);
+				if (!input.success) throw new OperationValidationError("input", input.error);
+				const rawOutput = await definition.handle(input.data, {
+					...operationContext,
+					notifications
+				});
+				operationContext.signal.throwIfAborted();
+				const output = definition.output.safeParse(rawOutput);
+				if (!output.success) throw new OperationValidationError("output", output.error);
+				return output.data;
+			},
+			returnsVoid: definition.output instanceof z.ZodVoid
+		});
+	});
+	return {
+		get: (name) => operations.get(name),
+		names: [...operations.keys()]
+	};
+};
+//#endregion
+//#region src/internal/server/http/operation-handler.ts
+const maxOperationRequestBytes = 1048576;
+const parseOperationRequest = async (request) => {
+	if ((request.headers.get("Content-Type")?.split(";", 1)[0])?.toLowerCase() !== "application/json") return {
+		error: "Content-Type must be application/json",
+		status: 415
+	};
+	if (Number(request.headers.get("Content-Length") ?? 0) > maxOperationRequestBytes) return {
+		error: "Request body is too large",
+		status: 413
+	};
+	try {
+		const body = await request.arrayBuffer();
+		if (body.byteLength > maxOperationRequestBytes) return {
+			error: "Request body is too large",
+			status: 413
+		};
+		const text = new TextDecoder().decode(body);
+		return { input: text ? JSON.parse(text) : void 0 };
+	} catch {
+		return {
+			error: "Invalid JSON request body",
+			status: 400
+		};
+	}
+};
+const createOperationHandler = ({ runtime, serverLogger }) => async (context) => {
+	const operation = runtime.getOperation(context.req.param("name"));
+	if (!operation) return context.json({ error: "Operation not found" }, 404);
+	const parsed = await parseOperationRequest(context.req.raw);
+	if ("error" in parsed) return context.json({ error: parsed.error }, parsed.status);
+	const correlationId = context.res.headers.get("X-Overmux-Correlation-Id") ?? serverLogger?.id();
+	const startedAt = Date.now();
+	serverLogger?.log({
+		correlationId,
+		details: { registeredName: context.req.param("name") },
+		event: "operation-start"
+	});
+	try {
+		const output = await operation.execute(parsed.input, context.req.raw.signal);
+		serverLogger?.log({
+			correlationId,
+			details: { registeredName: context.req.param("name") },
+			durationMs: Date.now() - startedAt,
+			event: "operation-complete"
+		});
+		return operation.returnsVoid ? new Response(void 0, { status: 204 }) : context.json(output);
+	} catch (cause) {
+		const message = cause instanceof Error ? cause.message : "Operation failed";
+		serverLogger?.log({
+			correlationId,
+			details: { registeredName: context.req.param("name") },
+			durationMs: Date.now() - startedAt,
+			event: "operation-error",
+			level: "error",
+			message
+		});
+		return context.json({ error: message }, cause instanceof OperationValidationError && cause.phase === "input" ? 400 : 500);
+	}
+};
+//#endregion
+//#region src/internal/server/http/request-logging.ts
+const createRequestLoggingMiddleware = ({ serverLogger }) => async (context, next) => {
+	const correlationId = serverLogger?.id();
+	const startedAt = Date.now();
+	if (correlationId) context.header("X-Overmux-Correlation-Id", correlationId);
+	await next();
+	const failed = context.res.status >= 400 || Boolean(context.error);
+	serverLogger?.log({
+		correlationId,
+		details: {
+			method: context.req.method,
+			path: context.req.path,
+			status: context.res.status
+		},
+		durationMs: Date.now() - startedAt,
+		event: failed ? "http-request-failure" : "http-request",
+		level: failed ? "error" : void 0,
+		message: context.error?.message
+	});
+};
+//#endregion
+//#region src/internal/server/http/runtime-manifest-handler.ts
+const createRuntimeManifestHandler = ({ runtime }) => (context) => {
+	context.header("Cache-Control", "no-store");
+	return context.json(runtime.manifest);
+};
+//#endregion
+//#region src/internal/shared/routes.ts
+const runtimeWebSocketPath = "/api/socket";
+const viteInfrastructurePath = "/_overmux/vite/*";
+//#endregion
+//#region src/internal/server/http/routes.ts
+const applyDescriptor = (app, route) => {
+	if (route.method === "USE") {
+		app.use(route.path, route.handler);
+		return;
+	}
+	if (route.middleware) {
+		app.on(route.method, route.path, route.middleware, route.handler);
+		return;
+	}
+	app.on(route.method, route.path, route.handler);
+};
+const registerHttpRoutes = ({ app, auth, authAssetsDirectory, backgroundNotifications, developmentWebTarget, onRestartRequested, runtime, serverLogger, shutdown, webAssetsDir }) => {
+	const authentication = createHttpAuthenticationHandlers({
+		auth,
+		authAssetsDirectory
+	});
+	const notificationHandlers = backgroundNotifications ? createBackgroundNotificationHandlers({ backgroundNotifications }) : void 0;
+	const developmentWebHandler = developmentWebTarget ? createDevelopmentWebHandler({
+		auth,
+		serverLogger,
+		target: developmentWebTarget
+	}) : void 0;
+	const productionWebHandler = webAssetsDir ? serveStatic({ path: join(webAssetsDir, "index.html") }) : void 0;
+	const hostedWebHandler = developmentWebHandler ?? productionWebHandler;
+	[
+		{
+			method: "USE",
+			path: "*",
+			handler: createRequestLoggingMiddleware({ serverLogger })
+		},
+		{
+			method: "GET",
+			path: "/_overmux/auth-shell/*",
+			handler: authentication.asset
+		},
+		{
+			method: "GET",
+			path: "/api/auth/state",
+			handler: authentication.state
+		},
+		{
+			method: "POST",
+			path: "/api/auth/login",
+			middleware: authentication.loginBodyLimitMiddleware,
+			handler: authentication.login
+		},
+		{
+			method: "GET",
+			path: "/login",
+			handler: authentication.loginPage
+		},
+		{
+			method: "GET",
+			path: "/api/health",
+			handler: createHealthHandler({ shutdown })
+		},
+		{
+			method: "USE",
+			path: "*",
+			handler: authentication.authenticate
+		},
+		{
+			method: "POST",
+			path: "/api/auth/logout",
+			handler: authentication.logout
+		},
+		{
+			method: "POST",
+			path: "/api/operations/:name",
+			handler: createOperationHandler({
+				runtime,
+				serverLogger
+			})
+		},
+		{
+			method: "POST",
+			path: "/api/restart",
+			handler: createRestartHandler({
+				onRestartRequested,
+				shutdown
+			})
+		},
+		{
+			method: "GET",
+			path: "/api/runtime-manifest",
+			handler: createRuntimeManifestHandler({ runtime })
+		},
+		...notificationHandlers ? [
+			{
+				method: "GET",
+				path: "/api/background-notifications/public-key",
+				handler: notificationHandlers.publicKey
+			},
+			{
+				method: "PUT",
+				path: "/api/background-notifications/subscription",
+				handler: notificationHandlers.enable
+			},
+			{
+				method: "DELETE",
+				path: "/api/background-notifications/subscription",
+				handler: notificationHandlers.disable
+			}
+		] : [],
+		{
+			method: "ALL",
+			path: "/api/*",
+			handler: (context) => context.notFound()
+		},
+		...developmentWebHandler ? [{
+			method: "ALL",
+			path: viteInfrastructurePath,
+			handler: developmentWebHandler
+		}] : [],
+		...hostedWebHandler ? [{
+			method: "GET",
+			path: overmuxSettingsPath,
+			handler: hostedWebHandler
+		}, {
+			method: "GET",
+			path: overmuxLogoutPath,
+			handler: hostedWebHandler
+		}] : [],
+		{
+			method: "ALL",
+			path: "/_overmux/*",
+			handler: (context) => context.notFound()
+		},
+		...developmentWebHandler ? [{
+			method: "ALL",
+			path: "*",
+			handler: developmentWebHandler
+		}] : [],
+		...webAssetsDir ? [{
+			method: "USE",
+			path: "*",
+			handler: serveStatic({ root: webAssetsDir })
+		}, {
+			method: "GET",
+			path: "*",
+			handler: serveStatic({ path: join(webAssetsDir, "index.html") })
+		}] : []
+	].forEach((route) => applyDescriptor(app, route));
+};
+//#endregion
+//#region src/internal/server/http/create-http-app.ts
+const createHttpApp = ({ auth, authAssetsDirectory, backgroundNotifications, developmentWebTarget, onRestartRequested, serverLogger, runtime, webAssetsDir }) => {
+	const app = new Hono();
+	const shutdown = { requested: false };
+	registerHttpRoutes({
+		app,
+		auth,
+		authAssetsDirectory,
+		backgroundNotifications,
+		developmentWebTarget,
+		onRestartRequested,
+		runtime,
+		serverLogger,
+		shutdown,
+		webAssetsDir
+	});
+	return Object.assign(app, { beginShutdown: () => {
+		shutdown.requested = true;
+	} });
+};
+//#endregion
+//#region src/internal/server/websocket-connection.ts
+const maxPendingStreamOutputBytes = 1048576;
+var OperationError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.code = code;
+	}
+};
+const bytesOf = (data) => {
+	if (Array.isArray(data)) return Buffer.concat(data);
+	if (data instanceof ArrayBuffer) return new Uint8Array(data);
+	return new Uint8Array(data.buffer, data.byteOffset, data.byteLength);
+};
+const textOf = (data) => Buffer.from(bytesOf(data)).toString("utf8");
+const frameLength = (message) => {
+	const frame = encodeProtocolFrame(message);
+	return typeof frame === "string" ? Buffer.byteLength(frame, "utf8") : frame.byteLength;
+};
+const operationIdOf = (value) => {
+	if (typeof value !== "object" || value === null) return;
+	const operationId = value.operationId;
+	return typeof operationId === "string" && operationId.length <= 256 ? operationId : void 0;
+};
+const errorDetails = (cause) => {
+	if (cause instanceof OperationError) return {
+		code: cause.code,
+		message: cause.message
+	};
+	if (cause instanceof ZodError || cause instanceof SyntaxError) return {
+		code: "bad-request",
+		message: cause instanceof ZodError ? cause.issues.map((issue) => `${issue.path.join(".") || "value"}: ${issue.message}`).join("; ") : cause.message
+	};
+	return {
+		code: "internal",
+		message: cause instanceof Error ? cause.message : String(cause)
+	};
+};
+const send$1 = (state, message) => {
+	if (state.closed || state.socket.readyState !== WebSocket.OPEN) return false;
+	if (state.socket.bufferedAmount > 1048576) {
+		state.socket.close(1013, "client could not keep up");
+		return false;
+	}
+	state.socket.send(encodeProtocolFrame(serverProtocolMessageSchema.parse(message)));
+	return true;
+};
+const sendError = (state, cause, operationId, identity) => {
+	const error = errorDetails(cause);
+	state.serverLogger?.log({
+		correlationId: identity?.operationId ?? operationId ?? state.connectionId,
+		details: {
+			code: error.code,
+			...identity,
+			...errorDetails$1(cause)
+		},
+		event: "protocol-handler-error",
+		level: "error"
+	});
+	send$1(state, {
+		...error,
+		operationId,
+		type: "error"
+	});
+};
+const disposeSubscription = async (state, subscriptionId) => {
+	const entry = state.subscriptions.get(subscriptionId);
+	if (!entry) return;
+	state.subscriptions.delete(subscriptionId);
+	entry.controller.abort(/* @__PURE__ */ new Error("Resource subscription closed"));
+	await entry.dispose?.();
+};
+const disposeStream = async (state, streamId, notify = true) => {
+	const entry = state.streams.get(streamId);
+	if (!entry) {
+		if (notify) send$1(state, {
+			streamId,
+			type: "stream-closed"
+		});
+		return;
+	}
+	state.streams.delete(streamId);
+	entry.controller.abort(/* @__PURE__ */ new Error("Stream closed"));
+	await entry.session?.dispose();
+	if (notify) send$1(state, {
+		streamId,
+		type: "stream-closed"
+	});
+};
+const disposeConnectionOperations = async (state, notify) => {
+	const operationControllers = [...state.operations.values()];
+	state.operations.clear();
+	operationControllers.forEach((controller) => controller.abort(/* @__PURE__ */ new Error("WebSocket connection closed")));
+	const subscriptionIds = [...state.subscriptions.keys()];
+	const streamIds = [...state.streams.keys()];
+	await Promise.allSettled([...subscriptionIds.map((subscriptionId) => disposeSubscription(state, subscriptionId)), ...streamIds.map((streamId) => disposeStream(state, streamId, notify))]);
+};
+const runOperation = (state, identity, operation) => {
+	if (state.operations.has(identity.operationId)) {
+		sendError(state, new OperationError("conflict", "Operation ID is already active"), identity.operationId, identity);
+		return;
+	}
+	const controller = new AbortController();
+	const startedAt = Date.now();
+	state.operations.set(identity.operationId, controller);
+	state.serverLogger?.log({
+		correlationId: identity.operationId,
+		details: identity,
+		event: "operation-start"
+	});
+	operation(controller.signal).then(() => {
+		state.serverLogger?.log({
+			correlationId: identity.operationId,
+			details: identity,
+			durationMs: Date.now() - startedAt,
+			event: "operation-complete"
+		});
+	}).catch((cause) => {
+		if (!controller.signal.aborted && !state.closed) {
+			state.serverLogger?.log({
+				correlationId: identity.operationId,
+				details: {
+					...identity,
+					...errorDetails$1(cause)
+				},
+				durationMs: Date.now() - startedAt,
+				event: "operation-error",
+				level: "error"
+			});
+			sendError(state, cause, identity.operationId, identity);
+		}
+	}).finally(() => {
+		if (state.operations.get(identity.operationId) === controller) state.operations.delete(identity.operationId);
+	});
+};
+const readResource = (state, message) => {
+	const resource = state.runtime.getResource(message.resourceName);
+	const identity = {
+		operationId: message.operationId,
+		operationType: message.type,
+		requestedName: message.resourceName
+	};
+	runOperation(state, identity, async (signal) => {
+		if (!resource) throw new OperationError("not-found", "Resource not found");
+		const output = await resource.read(message.input, signal);
+		send$1(state, {
+			operationId: message.operationId,
+			output,
+			type: "resource-result"
+		});
+	});
+};
+const subscribeResource = (state, message) => {
+	const resource = state.runtime.getResource(message.resourceName);
+	const identity = {
+		operationId: message.operationId,
+		operationType: message.type,
+		requestedName: message.resourceName
+	};
+	if (state.subscriptions.has(message.subscriptionId)) {
+		sendError(state, new OperationError("conflict", "Subscription ID is already active"), message.operationId, identity);
+		return;
+	}
+	runOperation(state, identity, async (operationSignal) => {
+		if (!resource) throw new OperationError("not-found", "Resource not found");
+		const controller = new AbortController();
+		const entry = { controller };
+		state.subscriptions.set(message.subscriptionId, entry);
+		const signal = AbortSignal.any([operationSignal, controller.signal]);
+		try {
+			entry.dispose = resource.subscribe(message.input, () => void send$1(state, {
+				subscriptionId: message.subscriptionId,
+				type: "resource-invalidated"
+			}), signal);
+		} catch (cause) {
+			await disposeSubscription(state, message.subscriptionId);
+			throw cause;
+		}
+	});
+};
+const openStream = (state, message) => {
+	const stream = state.runtime.getStream(message.streamName);
+	const identity = {
+		operationId: message.operationId,
+		operationType: message.type,
+		requestedName: message.streamName
+	};
+	if (state.streams.has(message.streamId)) {
+		sendError(state, new OperationError("conflict", "Stream ID is already active"), message.operationId, identity);
+		return;
+	}
+	runOperation(state, identity, async (operationSignal) => {
+		if (!stream) throw new OperationError("not-found", "Stream not found");
+		const controller = new AbortController();
+		const entry = {
+			controller,
+			identity
+		};
+		state.streams.set(message.streamId, entry);
+		const pending = [];
+		let pendingBytes = 0;
+		let opened = false;
+		try {
+			entry.session = await stream.open(message.input, (output) => {
+				if (opened) {
+					if (!send$1(state, {
+						message: output,
+						streamId: message.streamId,
+						type: "stream-output"
+					})) throw new Error("Stream output could not be delivered");
+					return;
+				}
+				pendingBytes += frameLength(output);
+				if (pendingBytes > maxPendingStreamOutputBytes) throw new Error("Stream produced too much output while opening");
+				pending.push(output);
+			}, AbortSignal.any([operationSignal, controller.signal]), (cause) => {
+				sendError(state, cause, message.streamId, identity);
+				disposeStream(state, message.streamId).catch((disposeCause) => {
+					sendError(state, disposeCause, message.streamId, identity);
+				});
+			});
+			send$1(state, {
+				operationId: message.operationId,
+				streamId: message.streamId,
+				type: "stream-opened"
+			});
+			opened = true;
+			for (const output of pending) if (!send$1(state, {
+				message: output,
+				streamId: message.streamId,
+				type: "stream-output"
+			})) throw new Error("Stream output could not be delivered");
+		} catch (cause) {
+			await disposeStream(state, message.streamId, false);
+			throw cause;
+		}
+	});
+};
+const sendStreamMessage = (state, message) => {
+	const entry = state.streams.get(message.streamId);
+	const identity = {
+		...entry?.identity,
+		operationId: message.streamId,
+		operationType: message.type
+	};
+	if (!entry?.session) {
+		sendError(state, new OperationError("not-found", "Stream not found"), message.streamId, identity);
+		return;
+	}
+	entry.session.send(message.message).catch((cause) => {
+		sendError(state, cause, message.streamId, identity);
+		disposeStream(state, message.streamId).catch((disposeCause) => {
+			sendError(state, disposeCause, message.streamId, identity);
+		});
+	});
+};
+const logClientDiagnostic = (state, message) => {
+	if (!state.serverLogger?.enabled) return;
+	state.serverLogger.log({
+		details: {
+			arguments: message.arguments,
+			...message.stack ? { stack: message.stack } : {},
+			...message.url ? { url: message.url } : {}
+		},
+		event: "browser-console",
+		level: message.level === "log" ? "info" : message.level,
+		message: message.message,
+		source: "browser",
+		timestamp: message.timestamp
+	});
+};
+const handleMessage = (state, message) => {
+	if (message.type === "client-diagnostic") {
+		logClientDiagnostic(state, message);
+		return;
+	}
+	if (message.type === "resource-read") {
+		readResource(state, message);
+		return;
+	}
+	if (message.type === "resource-subscribe") {
+		subscribeResource(state, message);
+		return;
+	}
+	if (message.type === "resource-unsubscribe") {
+		disposeSubscription(state, message.subscriptionId).catch((cause) => {
+			sendError(state, cause, message.subscriptionId);
+		});
+		return;
+	}
+	if (message.type === "stream-open") {
+		openStream(state, message);
+		return;
+	}
+	if (message.type === "stream-close") {
+		disposeStream(state, message.streamId).catch((cause) => {
+			sendError(state, cause, message.streamId);
+		});
+		return;
+	}
+	sendStreamMessage(state, message);
+};
+const handleFrame = (state, data, isBinary) => {
+	let raw;
+	try {
+		raw = decodeProtocolFrame(isBinary ? bytesOf(data) : textOf(data));
+		const result = clientProtocolMessageSchema.safeParse(raw);
+		if (!result.success) {
+			state.serverLogger?.log({
+				correlationId: state.connectionId,
+				details: errorDetails$1(result.error),
+				event: "protocol-parse-error",
+				level: "error"
+			});
+			sendError(state, result.error, operationIdOf(raw));
+			return;
+		}
+		handleMessage(state, result.data);
+	} catch (cause) {
+		state.serverLogger?.log({
+			correlationId: state.connectionId,
+			details: errorDetails$1(cause),
+			event: "protocol-parse-error",
+			level: "error"
+		});
+		sendError(state, cause, operationIdOf(raw));
+	}
+};
+const disposeConnection = async (state) => {
+	if (state.closed) return;
+	state.closed = true;
+	state.serverLogger?.log({
+		correlationId: state.connectionId,
+		event: "websocket-close"
+	});
+	await disposeConnectionOperations(state, false);
+};
+const createConnectionState = ({ runtime, serverLogger, socket }) => ({
+	closed: false,
+	connectionId: serverLogger?.id(),
+	operations: /* @__PURE__ */ new Map(),
+	runtime,
+	serverLogger,
+	socket,
+	streams: /* @__PURE__ */ new Map(),
+	subscriptions: /* @__PURE__ */ new Map()
+});
+const attachWebSocketConnection = ({ runtime, serverLogger, socket }) => {
+	const state = createConnectionState({
+		runtime,
+		serverLogger,
+		socket
+	});
+	serverLogger?.log({
+		correlationId: state.connectionId,
+		event: "websocket-open"
+	});
+	socket.on("message", (data, isBinary) => handleFrame(state, data, isBinary));
+	socket.once("close", (code, reason) => {
+		serverLogger?.log({
+			correlationId: state.connectionId,
+			details: {
+				code,
+				reason: reason?.toString() ?? ""
+			},
+			event: "websocket-close-event"
+		});
+		disposeConnection(state);
+	});
+	socket.once("error", (cause) => {
+		serverLogger?.log({
+			correlationId: state.connectionId,
+			details: errorDetails$1(cause),
+			event: "websocket-error",
+			level: "error"
+		});
+		disposeConnection(state);
+	});
+	return () => disposeConnection(state);
+};
+//#endregion
+//#region src/internal/server/vite-websocket-proxy.ts
+const setTrustedForwardingHeaders = (request, origin) => {
+	Object.keys(request.headers).forEach((name) => {
+		if (name === "authorization" || name === "cookie" || name === "forwarded" || name.startsWith("x-forwarded-")) Reflect.deleteProperty(request.headers, name);
+	});
+	const publicUrl = new URL(origin);
+	request.headers["x-forwarded-for"] = request.socket.remoteAddress;
+	request.headers["x-forwarded-host"] = publicUrl.host;
+	request.headers["x-forwarded-port"] = publicUrl.port || (publicUrl.protocol === "https:" ? "443" : "80");
+	request.headers["x-forwarded-proto"] = publicUrl.protocol.slice(0, -1);
+};
+const closeFrame = (code, reason) => {
+	const payload = Buffer.allocUnsafe(2 + Buffer.byteLength(reason));
+	payload.writeUInt16BE(code);
+	payload.write(reason, 2);
+	return Buffer.concat([Buffer.from([136, payload.length]), payload]);
+};
+const closeSocket = (socket, code, reason) => {
+	if (socket.closed) return;
+	socket.closed = true;
+	clearInterval(socket.timer);
+	if (!socket.client.destroyed) socket.client.end(closeFrame(code, reason));
+	socket.upstream?.destroy();
+};
+const revalidateSocket = async ({ auth, serverLogger, origin, socket, token }) => {
+	try {
+		if (!await auth.service.authenticateToken(token, origin)) closeSocket(socket, webSocketCloseCode.authenticationRevoked, "authentication revoked");
+	} catch (cause) {
+		serverLogger?.log({
+			details: errorDetails$1(cause),
+			event: "vite-websocket-session-revalidation-failure",
+			level: "error"
+		});
+		closeSocket(socket, webSocketCloseCode.authenticationUnavailable, "authentication unavailable");
+	}
+};
+const createViteWebSocketProxy = ({ auth, serverLogger, target }) => {
+	const sockets = /* @__PURE__ */ new Map();
+	const connect = ({ correlationId, head, origin, request, session, socket }) => {
+		let revalidationPending = false;
+		const proxied = {
+			client: socket,
+			closed: false,
+			sessionId: session.id,
+			timer: setInterval(() => {
+				if (revalidationPending) return;
+				revalidationPending = true;
+				revalidateSocket({
+					auth,
+					origin,
+					serverLogger,
+					socket: proxied,
+					token: session.token
+				}).finally(() => {
+					revalidationPending = false;
+				});
+			}, 1e3)
+		};
+		sockets.set(socket, proxied);
+		socket.once("close", () => {
+			clearInterval(proxied.timer);
+			sockets.delete(socket);
+		});
+		setTrustedForwardingHeaders(request, origin);
+		proxyUpgrade(target, request, socket, head, {
+			changeOrigin: true,
+			xfwd: false
+		}).then((upstream) => {
+			if (proxied.closed) {
+				upstream.destroy();
+				return;
+			}
+			proxied.upstream = upstream;
+		}, (cause) => {
+			clearInterval(proxied.timer);
+			sockets.delete(socket);
+			if (proxied.closed) return;
+			proxied.closed = true;
+			serverLogger?.log({
+				correlationId,
+				details: errorDetails$1(cause),
+				event: "vite-websocket-proxy-failure",
+				level: "error"
+			});
+		});
+	};
+	return {
+		close: () => {
+			sockets.forEach((socket) => closeSocket(socket, 1001, "server shutting down"));
+			sockets.clear();
+		},
+		connect,
+		revoke: (ids) => {
+			sockets.forEach((socket) => {
+				if (ids.has(socket.sessionId)) closeSocket(socket, webSocketCloseCode.authenticationRevoked, "authentication revoked");
+			});
+		}
+	};
+};
+//#endregion
+//#region src/internal/server/websocket-server.ts
+const maxWebSocketPayloadBytes = 1048576;
+const rejectUpgrade = (socket, status, message) => {
+	socket.end(`HTTP/1.1 ${status} ${message}\r\nConnection: close\r\nContent-Length: 0\r\n\r\n`);
+};
+const requestPath = (request) => {
+	try {
+		return new URL(request.url ?? "", "http://localhost").pathname;
+	} catch {
+		return;
+	}
+};
+const requestAuthenticationInput = (request) => {
+	const host = request.headers.host;
+	if (!host) return;
+	const headers = new Headers();
+	Object.entries(request.headers).forEach(([name, value]) => {
+		if (Array.isArray(value)) value.forEach((entry) => headers.append(name, entry));
+		else if (value !== void 0) headers.set(name, value);
+	});
+	const encrypted = Boolean(request.socket.encrypted);
+	try {
+		return new Request(`${encrypted ? "https" : "http"}://${host}${request.url ?? "/"}`, { headers });
+	} catch {
+		return;
+	}
+};
+const attachSessionLifecycle = ({ auth, serverLogger, session, sessionSockets, socket }) => {
+	sessionSockets.set(socket, session.id);
+	let revalidationPending = false;
+	const revalidationTimer = setInterval(() => {
+		if (revalidationPending) return;
+		revalidationPending = true;
+		auth.service.authenticateToken(session.token, session.origin).then((authenticated) => {
+			if (!authenticated) socket.close(webSocketCloseCode.authenticationRevoked, "authentication revoked");
+		}, (cause) => {
+			serverLogger?.log({
+				details: errorDetails$1(cause),
+				event: "websocket-session-revalidation-failure",
+				level: "error"
+			});
+			socket.close(webSocketCloseCode.authenticationUnavailable, "authentication unavailable");
+		}).finally(() => {
+			revalidationPending = false;
+		});
+	}, 1e3);
+	socket.once("close", () => {
+		clearInterval(revalidationTimer);
+		sessionSockets.delete(socket);
+	});
+};
+const createWebSocketServer = ({ auth, developmentWebTarget, runtime, server, serverLogger }) => {
+	const webSocketServer = new WebSocketServer({
+		maxPayload: maxWebSocketPayloadBytes,
+		noServer: true
+	});
+	let updateAvailable = false;
+	const sessionSockets = /* @__PURE__ */ new Map();
+	const viteProxy = developmentWebTarget ? createViteWebSocketProxy({
+		auth,
+		serverLogger,
+		target: developmentWebTarget
+	}) : void 0;
+	const removeRevocationListener = auth.service.onSessionsRevoked((ids) => {
+		sessionSockets.forEach((sessionId, socket) => {
+			if (ids.has(sessionId)) socket.close(webSocketCloseCode.authenticationRevoked, "authentication revoked");
+		});
+		viteProxy?.revoke(ids);
+	});
+	const onUpgrade = async (request, socket, head) => {
+		const correlationId = serverLogger?.id();
+		serverLogger?.log({
+			correlationId,
+			event: "websocket-connect"
+		});
+		const path = requestPath(request);
+		const isRuntimeSocket = path === runtimeWebSocketPath;
+		const isViteSocket = path === "/_overmux/vite/hmr" && developmentWebTarget !== void 0;
+		if (!isRuntimeSocket && !isViteSocket) {
+			serverLogger?.log({
+				correlationId,
+				details: { status: 404 },
+				event: "websocket-connect-rejected",
+				level: "warn"
+			});
+			rejectUpgrade(socket, 404, "Not Found");
+			return;
+		}
+		const authenticationInput = requestAuthenticationInput(request);
+		if (!authenticationInput) {
+			rejectUpgrade(socket, 400, "Bad Request");
+			return;
+		}
+		const origin = auth.resolveOrigin({
+			remoteAddress: request.socket.remoteAddress,
+			request: authenticationInput
+		});
+		let session;
+		try {
+			session = await auth.requests.authenticate(authenticationInput, origin);
+		} catch (cause) {
+			serverLogger?.log({
+				correlationId,
+				details: errorDetails$1(cause),
+				event: "websocket-authentication-failure",
+				level: "error"
+			});
+			rejectUpgrade(socket, 503, "Service Unavailable");
+			return;
+		}
+		if (!session) {
+			rejectUpgrade(socket, 401, "Unauthorized");
+			return;
+		}
+		if (session.kind === "browser" && (!origin || request.headers.origin !== origin)) {
+			rejectUpgrade(socket, 403, "Forbidden");
+			return;
+		}
+		if (isViteSocket) {
+			if (session.kind !== "browser" || session.credential !== "cookie" || !origin) {
+				rejectUpgrade(socket, 401, "Unauthorized");
+				return;
+			}
+			if (!viteProxy) {
+				rejectUpgrade(socket, 503, "Service Unavailable");
+				return;
+			}
+			viteProxy.connect({
+				correlationId,
+				head,
+				origin,
+				request,
+				session,
+				socket
+			});
+			return;
+		}
+		webSocketServer.handleUpgrade(request, socket, head, (webSocket) => {
+			attachSessionLifecycle({
+				auth,
+				serverLogger,
+				session,
+				sessionSockets,
+				socket: webSocket
+			});
+			webSocketServer.emit("connection", webSocket, request);
+			attachWebSocketConnection({
+				runtime,
+				serverLogger,
+				socket: webSocket
+			});
+			if (updateAvailable) webSocket.send(encodeProtocolFrame({ type: "update-available" }));
+		});
+	};
+	server.on("upgrade", onUpgrade);
+	const broadcast = (message) => {
+		const frame = encodeProtocolFrame(serverProtocolMessageSchema.parse(message));
+		let delivered = 0;
+		webSocketServer.clients.forEach((socket) => {
+			if (socket.readyState !== WebSocket.OPEN) return;
+			if (socket.bufferedAmount > 1048576) {
+				socket.close(1013, "client could not keep up");
+				return;
+			}
+			try {
+				socket.send(frame);
+				delivered += 1;
+			} catch (cause) {
+				socket.terminate();
+				serverLogger?.log({
+					details: errorDetails$1(cause),
+					event: "websocket-broadcast-failure",
+					level: "error"
+				});
+			}
+		});
+		return delivered;
+	};
+	return {
+		announceRestarting: () => broadcast({ type: "restarting" }),
+		announceUpdateAvailable: () => {
+			updateAvailable = true;
+			return broadcast({ type: "update-available" });
+		},
+		broadcastNotification: (notification) => broadcast(notificationEventSchema.parse({
+			notification,
+			type: "notification"
+		})),
+		close: async () => {
+			server.off("upgrade", onUpgrade);
+			removeRevocationListener();
+			viteProxy?.close();
+			webSocketServer.clients.forEach((socket) => socket.terminate());
+			await new Promise((resolve) => webSocketServer.close(() => resolve()));
+		}
+	};
+};
+//#endregion
+//#region src/internal/server/notifications/background-notification-payload.ts
+const maxPayloadBytes = 3800;
+const payloadBytes = (payload) => new TextEncoder().encode(JSON.stringify(payload)).byteLength;
+const largestFittingPrefix = (characters, accepts, low = 0, high = characters.length) => {
+	if (low >= high) return characters.slice(0, low).join("");
+	const middle = Math.ceil((low + high) / 2);
+	return accepts(characters.slice(0, middle).join("")) ? largestFittingPrefix(characters, accepts, middle, high) : largestFittingPrefix(characters, accepts, low, middle - 1);
+};
+const notificationPayload = (notification) => ({
+	notification,
+	type: "notification"
+});
+const createBackgroundNotificationPayload = (notification) => {
+	const original = notificationPayload(notification);
+	if (payloadBytes(original) <= maxPayloadBytes) return JSON.stringify(original);
+	const withoutBody = {
+		...notification,
+		body: void 0
+	};
+	const body = largestFittingPrefix([...notification.body ?? ""], (prefix) => payloadBytes(notificationPayload({
+		...withoutBody,
+		...prefix ? { body: prefix } : {}
+	})) <= maxPayloadBytes);
+	const bodyTruncated = notificationPayload({
+		...withoutBody,
+		...body ? { body } : {}
+	});
+	if (payloadBytes(bodyTruncated) <= maxPayloadBytes) return JSON.stringify(bodyTruncated);
+	const title = largestFittingPrefix([...notification.title], (prefix) => Boolean(prefix) && payloadBytes(notificationPayload({
+		...withoutBody,
+		title: prefix
+	})) <= maxPayloadBytes);
+	if (title) return JSON.stringify(notificationPayload({
+		...withoutBody,
+		title
+	}));
+	const safeTitle = largestFittingPrefix([...notification.title], (prefix) => Boolean(prefix) && payloadBytes(notificationPayload({ title: prefix })) <= maxPayloadBytes);
+	return JSON.stringify(notificationPayload({ title: safeTitle || "Overmux" }));
+};
+//#endregion
+//#region src/internal/server/notifications/background-notification-service.ts
+const vapidSubject = "https://github.com/richardgill/overmux";
+const webPushStatus = (cause) => {
+	if (typeof cause === "object" && cause !== null && "statusCode" in cause && typeof cause.statusCode === "number") return cause.statusCode;
+};
+const deliverToSubscription = async ({ keys, logger, payload, sendWebPush, store, subscription }) => {
+	try {
+		await sendWebPush(subscription, payload, {
+			TTL: 60,
+			vapidDetails: {
+				privateKey: keys.privateKey,
+				publicKey: keys.publicKey,
+				subject: vapidSubject
+			}
+		});
+	} catch (cause) {
+		const status = webPushStatus(cause);
+		if (status === 404 || status === 410) await store.removeSubscription(subscription.endpoint);
+		logger?.log({
+			details: {
+				...errorDetails$1(cause),
+				...status ? { status } : {}
+			},
+			event: "background-notification-delivery-failure",
+			level: "warn"
+		});
+	}
+};
+const createBackgroundNotificationService = ({ isSessionActive = async () => true, logger, sendWebPush = webPush.sendNotification, store }) => {
+	let keysPromise;
+	const getKeys = () => {
+		if (!keysPromise) keysPromise = store.getOrCreateKeys(webPush.generateVAPIDKeys).catch((cause) => {
+			keysPromise = void 0;
+			throw cause;
+		});
+		return keysPromise;
+	};
+	return {
+		disable: (endpoint) => store.removeSubscription(endpoint),
+		disableSessions: (sessionIds) => store.removeSessionSubscriptions(sessionIds),
+		enable: (sessionId, subscription) => store.upsertSubscription(sessionId, subscription),
+		publicKey: async () => (await getKeys()).publicKey,
+		send: async (notification) => {
+			const storedSubscriptions = await store.listSubscriptions();
+			const subscriptions = (await Promise.all(storedSubscriptions.map(async (entry) => ({
+				active: await isSessionActive(entry.sessionId),
+				entry
+			})))).flatMap(({ active: sessionActive, entry }) => sessionActive ? [entry] : []);
+			if (!subscriptions.length) return;
+			const keys = await getKeys();
+			const payload = createBackgroundNotificationPayload(notification);
+			await Promise.all(subscriptions.map((entry) => deliverToSubscription({
+				keys,
+				logger,
+				payload,
+				sendWebPush,
+				store,
+				subscription: entry.subscription
+			})));
+		}
+	};
+};
+//#endregion
+//#region src/internal/server/notifications/background-notification-store.ts
+const vapidKeysSchema = z.object({
+	privateKey: z.string().min(1),
+	publicKey: z.string().min(1)
+}).strict();
+const storedSubscriptionSchema = z.object({
+	sessionId: z.string(),
+	subscription: backgroundNotificationSubscriptionSchema
+});
+const subscriptionsSchema = z.array(storedSubscriptionSchema);
+const backgroundNotificationDataDirectory = ({ environment, homeDirectory }) => join(getOvermuxPaths({
+	environment,
+	homeDir: homeDirectory
+}).dataDir, "background-notifications");
+const createFileBackgroundNotificationStore = ({ environment = process.env, homeDirectory = homedir() } = {}) => {
+	const directory = backgroundNotificationDataDirectory({
+		environment,
+		homeDirectory
+	});
+	const keysPath = join(directory, "vapid.json");
+	const subscriptionsPath = join(directory, "subscriptions.json");
+	let pendingSubscriptionWrite = Promise.resolve();
+	const readSubscriptions = async () => await readPrivateJson(subscriptionsPath, subscriptionsSchema) ?? [];
+	const updateSubscriptions = (update) => {
+		const operation = pendingSubscriptionWrite.then(async () => {
+			const updated = update(await readSubscriptions());
+			if (updated) await replacePrivateJsonAtomically(subscriptionsPath, updated);
+		});
+		pendingSubscriptionWrite = operation.catch(() => void 0);
+		return operation;
+	};
+	return {
+		getOrCreateKeys: async (generate) => {
+			const existing = await readPrivateJson(keysPath, vapidKeysSchema);
+			if (existing) return existing;
+			const generated = vapidKeysSchema.parse(generate());
+			try {
+				await createPrivateJsonExclusively(keysPath, generated);
+				return generated;
+			} catch (cause) {
+				if (cause.code !== "EEXIST") throw cause;
+				const concurrentlyCreated = await readPrivateJson(keysPath, vapidKeysSchema);
+				if (!concurrentlyCreated) throw cause;
+				return concurrentlyCreated;
+			}
+		},
+		listSubscriptions: async () => {
+			await pendingSubscriptionWrite;
+			return readSubscriptions();
+		},
+		removeSubscription: (endpoint) => updateSubscriptions((subscriptions) => {
+			if (!subscriptions.some((entry) => entry.subscription.endpoint === endpoint)) return;
+			return subscriptions.filter((entry) => entry.subscription.endpoint !== endpoint);
+		}),
+		removeSessionSubscriptions: (sessionIds) => updateSubscriptions((subscriptions) => {
+			const updated = subscriptions.filter((entry) => !sessionIds.has(entry.sessionId));
+			return updated.length === subscriptions.length ? void 0 : updated;
+		}),
+		upsertSubscription: (sessionId, subscription) => {
+			const parsed = backgroundNotificationSubscriptionSchema.parse(subscription);
+			return updateSubscriptions((subscriptions) => {
+				const entry = {
+					sessionId,
+					subscription: parsed
+				};
+				if (isDeepStrictEqual(subscriptions.find((candidate) => candidate.subscription.endpoint === parsed.endpoint), entry)) return;
+				return [...subscriptions.filter((candidate) => candidate.subscription.endpoint !== parsed.endpoint), entry];
+			});
+		}
+	};
+};
+z.void();
+const jsonValueSchema = z.lazy(() => z.union([
+	z.string(),
+	z.number().finite(),
+	z.boolean(),
+	z.null(),
+	z.array(jsonValueSchema),
+	z.record(z.string(), jsonValueSchema)
+]));
+//#endregion
+//#region src/internal/server/notifications/notification-service.ts
+const deliverSafely = async ({ deliver, event, logger }) => {
+	try {
+		await deliver();
+	} catch (cause) {
+		logger?.log({
+			details: errorDetails$1(cause),
+			event,
+			level: "error"
+		});
+	}
+};
+const createNotificationService = ({ backgroundNotifications, logger }) => {
+	let liveDeliveryAttached = false;
+	let deliverLive = () => void 0;
+	return {
+		send: async (input) => {
+			const notification = notificationSchema.parse(input);
+			await Promise.all([deliverSafely({
+				deliver: () => deliverLive(notification),
+				event: "live-notification-dispatch-failure",
+				logger
+			}), deliverSafely({
+				deliver: () => backgroundNotifications.send(notification),
+				event: "background-notification-dispatch-failure",
+				logger
+			})]);
+		},
+		attachLiveDelivery: (deliver) => {
+			if (liveDeliveryAttached) throw new Error("Live delivery is already attached");
+			liveDeliveryAttached = true;
+			deliverLive = deliver;
+		}
+	};
+};
+//#endregion
+//#region src/internal/server/runtime/runtime-lifecycle.ts
+const asError = (cause) => cause instanceof Error ? cause : new Error(String(cause));
+const disposeAll = async (disposers) => {
+	const errors = (await Promise.allSettled([...disposers].map(async (dispose) => dispose()))).flatMap((result) => result.status === "rejected" ? [asError(result.reason)] : []);
+	if (errors.length) throw new AggregateError(errors, "Runtime disposal failed");
+};
+const createRuntimeLifecycle = (preparationSignal) => {
+	const controller = new AbortController();
+	const activeDisposers = /* @__PURE__ */ new Set();
+	let disposal;
+	const abortPreparation = () => controller.abort(preparationSignal?.reason);
+	preparationSignal?.addEventListener("abort", abortPreparation, { once: true });
+	if (preparationSignal?.aborted) abortPreparation();
+	const completePreparation = () => {
+		preparationSignal?.removeEventListener("abort", abortPreparation);
+	};
+	const requestSignal = (signal) => signal ? AbortSignal.any([controller.signal, signal]) : controller.signal;
+	const track = (dispose, signal) => {
+		let pending;
+		const disposeOnce = () => {
+			if (pending) return pending;
+			controller.signal.removeEventListener("abort", onAbort);
+			signal?.removeEventListener("abort", onAbort);
+			activeDisposers.delete(disposeOnce);
+			pending = Promise.resolve().then(dispose);
+			return pending;
+		};
+		const onAbort = () => {
+			disposeOnce().catch(() => void 0);
+		};
+		activeDisposers.add(disposeOnce);
+		controller.signal.addEventListener("abort", onAbort, { once: true });
+		signal?.addEventListener("abort", onAbort, { once: true });
+		if (controller.signal.aborted || signal?.aborted) onAbort();
+		return disposeOnce;
+	};
+	const dispose = (reason = /* @__PURE__ */ new Error("Runtime disposed")) => {
+		if (disposal) return disposal;
+		completePreparation();
+		const pending = [...activeDisposers];
+		activeDisposers.clear();
+		controller.abort(reason);
+		disposal = disposeAll(pending);
+		return disposal;
+	};
+	return {
+		completePreparation,
+		dispose,
+		disposeAll,
+		requestSignal,
+		signal: controller.signal,
+		track
+	};
+};
+//#endregion
+//#region src/internal/server/runtime/resource-dependency-graph.ts
+const emptyGraphFor = (resourceIds) => new Map(resourceIds.map((resourceId) => [resourceId, /* @__PURE__ */ new Set()]));
+const visitDependencies = ({ dependencies, path, resourceId, visited, visiting }) => {
+	if (visiting.has(resourceId)) throw new Error(`Resource dependency cycle: ${[...path, resourceId].join(" -> ")}`);
+	if (visited.has(resourceId)) return;
+	visiting.add(resourceId);
+	dependencies.get(resourceId)?.forEach((dependencyId) => {
+		visitDependencies({
+			dependencies,
+			path: [...path, resourceId],
+			resourceId: dependencyId,
+			visited,
+			visiting
+		});
+	});
+	visiting.delete(resourceId);
+	visited.add(resourceId);
+};
+const assertAcyclic = (dependencies) => {
+	const visited = /* @__PURE__ */ new Set();
+	const visiting = /* @__PURE__ */ new Set();
+	dependencies.forEach((_, resourceId) => {
+		visitDependencies({
+			dependencies,
+			path: [],
+			resourceId,
+			visited,
+			visiting
+		});
+	});
+};
+const createResourceDependencyGraph = (resources) => {
+	const resourceIds = Object.keys(resources);
+	if (resourceIds.some((resourceId) => !resourceId)) throw new Error("Resource IDs must not be empty");
+	const dependencies = emptyGraphFor(resourceIds);
+	const dependants = emptyGraphFor(resourceIds);
+	Object.entries(resources).forEach(([resourceId, resource]) => {
+		if (resource.kind !== "derived") return;
+		Object.entries(resource.dependencies).forEach(([dependencyName, dependencyId]) => {
+			if (!dependencyName) throw new Error(`Resource ${resourceId} has an empty dependency name`);
+			if (!dependencyId) throw new Error(`Resource ${resourceId} has an empty dependency ID`);
+			if (!dependencies.has(dependencyId)) throw new Error(`Unknown resource dependency: ${dependencyId}`);
+			dependencies.get(resourceId)?.add(dependencyId);
+			dependants.get(dependencyId)?.add(resourceId);
+		});
+	});
+	assertAcyclic(dependencies);
+	return Object.freeze({
+		dependencies,
+		dependants
+	});
+};
+const collectInvalidatedResourceIds = (graph, resourceId, invalidated) => {
+	if (invalidated.has(resourceId)) return;
+	invalidated.add(resourceId);
+	graph.dependants.get(resourceId)?.forEach((dependantId) => {
+		collectInvalidatedResourceIds(graph, dependantId, invalidated);
+	});
+};
+const getInvalidatedResourceIds = (graph, resourceId) => {
+	const invalidated = /* @__PURE__ */ new Set();
+	collectInvalidatedResourceIds(graph, resourceId, invalidated);
+	return invalidated;
+};
+//#endregion
+//#region src/internal/server/runtime/runtime-resources.ts
+const createRuntimeResources = ({ definitions, lifecycle }) => {
+	const graph = createResourceDependencyGraph(definitions);
+	const invalidationListeners = /* @__PURE__ */ new Set();
+	const contracts = /* @__PURE__ */ new Map();
+	const resources = /* @__PURE__ */ new Map();
+	Object.entries(definitions).forEach(([id, definition]) => {
+		contracts.set(definition.contract, [...contracts.get(definition.contract) ?? [], id]);
+	});
+	const invalidateResource = (id, input, allInputs = false) => {
+		if (lifecycle.signal.aborted) return;
+		const ids = getInvalidatedResourceIds(graph, id);
+		invalidationListeners.forEach((entry) => {
+			if (ids.has(entry.resourceId) && (allInputs || isDeepStrictEqual(entry.input, input))) entry.listener();
+		});
+	};
+	const invalidate = (contract, input) => {
+		const ids = contracts.get(contract) ?? Object.entries(definitions).filter(([, definition]) => definition.contract.input === contract.input && definition.contract.output === contract.output).map(([id]) => id);
+		if (!ids.length) throw new Error("Cannot invalidate a resource outside this runtime");
+		ids.forEach((id) => {
+			const definition = definitions[id];
+			const parsedInput = input === void 0 ? void 0 : definition.contract.input.parse(input);
+			invalidateResource(id, parsedInput, input === void 0);
+		});
+	};
+	const context = (signal) => ({
+		invalidate,
+		signal: lifecycle.requestSignal(signal)
+	});
+	const read = async (id, rawInput, signal) => {
+		const definition = definitions[id];
+		const operationSignal = lifecycle.requestSignal(signal);
+		operationSignal.throwIfAborted();
+		const input = definition.contract.input.parse(rawInput);
+		const rawOutput = definition.kind === "derived" ? definition.combine(Object.fromEntries(await Promise.all(Object.entries(definition.dependencies).map(async ([name, dependencyId]) => [name, await read(dependencyId, rawInput, signal)])))) : await definition.read(input, context(signal));
+		operationSignal.throwIfAborted();
+		return definition.contract.output.parse(rawOutput);
+	};
+	const activateWatchers = (id, rawInput, signal, activated, disposers) => {
+		if (activated.has(id)) return;
+		activated.add(id);
+		const definition = definitions[id];
+		const input = definition.contract.input.parse(rawInput);
+		if (definition.kind === "subscription") {
+			const dispose = definition.subscribe(input, () => invalidateResource(id, input), context(signal));
+			if (typeof dispose !== "function") throw new Error(`Resource ${id} subscribe must return a disposer`);
+			disposers.push(dispose);
+			return;
+		}
+		if (definition.kind === "derived") graph.dependencies.get(id)?.forEach((dependencyId) => {
+			activateWatchers(dependencyId, rawInput, signal, activated, disposers);
+		});
+	};
+	Object.keys(definitions).forEach((name) => {
+		resources.set(name, {
+			read: (input, signal) => read(name, input, signal),
+			subscribe: (rawInput, listener, signal) => {
+				lifecycle.requestSignal(signal).throwIfAborted();
+				const entry = {
+					input: definitions[name].contract.input.parse(rawInput),
+					listener,
+					resourceId: name
+				};
+				const watcherDisposers = [];
+				invalidationListeners.add(entry);
+				try {
+					activateWatchers(name, rawInput, signal, /* @__PURE__ */ new Set(), watcherDisposers);
+				} catch (cause) {
+					invalidationListeners.delete(entry);
+					lifecycle.disposeAll(watcherDisposers).catch(() => void 0);
+					throw cause;
+				}
+				return lifecycle.track(async () => {
+					invalidationListeners.delete(entry);
+					await lifecycle.disposeAll(watcherDisposers);
+				}, signal);
+			}
+		});
+	});
+	return {
+		context,
+		get: (name) => resources.get(name),
+		invalidate,
+		names: [...resources.keys()]
+	};
+};
+//#endregion
+//#region src/internal/server/runtime/runtime-streams.ts
+const createRuntimeStreams = ({ context, definitions, lifecycle }) => {
+	const streams = /* @__PURE__ */ new Map();
+	Object.entries(definitions).forEach(([name, definition]) => {
+		if (!name) throw new Error("Stream names must not be empty");
+		streams.set(name, { open: async (rawInput, emit, requestSignal, onError) => {
+			const sessionController = new AbortController();
+			const sessionSignal = requestSignal ? AbortSignal.any([requestSignal, sessionController.signal]) : sessionController.signal;
+			const operationSignal = lifecycle.requestSignal(sessionSignal);
+			operationSignal.throwIfAborted();
+			const input = definition.contract.input.parse(rawInput);
+			let acceptingMessages = true;
+			let failed = false;
+			let failure;
+			let opened = false;
+			const fail = (cause) => {
+				if (failed || operationSignal.aborted) return;
+				failed = true;
+				failure = cause;
+				acceptingMessages = false;
+				sessionController.abort(cause);
+				if (opened) onError?.(cause);
+			};
+			const session = await definition.open(input, {
+				...context(sessionSignal),
+				emit: (message) => {
+					if (operationSignal.aborted) return;
+					try {
+						emit(definition.contract.serverMessage.parse(message));
+					} catch (cause) {
+						fail(cause);
+					}
+				},
+				fail,
+				signal: operationSignal
+			});
+			opened = true;
+			if (failed || operationSignal.aborted) {
+				await session.dispose?.();
+				operationSignal.throwIfAborted();
+				throw failure;
+			}
+			let messages = Promise.resolve();
+			const dispose = lifecycle.track(async () => {
+				acceptingMessages = false;
+				sessionController.abort(/* @__PURE__ */ new Error("Stream session disposed"));
+				await messages.catch(() => void 0);
+				await session.dispose?.();
+			}, requestSignal);
+			return {
+				dispose: async () => dispose(),
+				send: async (rawMessage) => {
+					if (!acceptingMessages) throw new Error("Stream session is closed");
+					const message = definition.contract.clientMessage.parse(rawMessage);
+					messages = messages.then(async () => {
+						operationSignal.throwIfAborted();
+						await session.onMessage?.(message);
+						operationSignal.throwIfAborted();
+					});
+					return messages;
+				}
+			};
+		} });
+	});
+	return {
+		get: (name) => streams.get(name),
+		names: [...streams.keys()]
+	};
+};
+//#endregion
+//#region src/internal/server/runtime/create-runtime.ts
+const createRuntime = async ({ config, debug = false, notifications = { send: async () => void 0 }, signal }) => {
+	const lifecycle = createRuntimeLifecycle(signal);
+	try {
+		const resources = createRuntimeResources({
+			definitions: config.server.resources ?? {},
+			lifecycle
+		});
+		const context = resources.context;
+		const operations = createRuntimeOperations({
+			context,
+			definitions: config.server.operations ?? {},
+			notifications
+		});
+		const streams = createRuntimeStreams({
+			context,
+			definitions: config.server.streams ?? {},
+			lifecycle
+		});
+		lifecycle.signal.throwIfAborted();
+		lifecycle.completePreparation();
+		return {
+			manifest: {
+				debug,
+				operations: [...operations.names],
+				protocolVersion: 9,
+				resources: [...resources.names],
+				streams: [...streams.names]
+			},
+			dispose: lifecycle.dispose,
+			getOperation: operations.get,
+			getResource: resources.get,
+			getStream: streams.get
+		};
+	} catch (cause) {
+		await lifecycle.dispose(cause).catch(() => void 0);
+		throw cause;
+	}
+};
+//#endregion
+//#region src/internal/server/server-startup-options.ts
+const resolveServerStartupOptions = ({ config, configPath, overrides = {} }) => {
+	const validatedOverrides = serverConfigRuntimeSchema.omit({ port: true }).extend({ port: z.number().int().min(0).max(65535).optional() }).parse(overrides);
+	const configuredLogFile = config.logFile ? resolve(dirname(configPath), config.logFile) : void 0;
+	const logFile = validatedOverrides.logFile ? resolve(validatedOverrides.logFile) : configuredLogFile;
+	const configuredWebAssetsDir = config.productionWebAssetsDir ? resolve(dirname(configPath), config.productionWebAssetsDir) : void 0;
+	const productionWebAssetsDir = validatedOverrides.productionWebAssetsDir ? resolve(validatedOverrides.productionWebAssetsDir) : configuredWebAssetsDir;
+	return {
+		host: validatedOverrides.host ?? config.host ?? "localhost",
+		...logFile === void 0 ? {} : { logFile },
+		port: validatedOverrides.port ?? config.port ?? 4200,
+		...productionWebAssetsDir === void 0 ? {} : { productionWebAssetsDir },
+		watch: validatedOverrides.watch ?? config.watch ?? true
+	};
+};
+//#endregion
+//#region src/internal/server/start-application-server.ts
+const cleanupResources = async (cleanups) => {
+	const errors = [];
+	for (const cleanup of [...cleanups].reverse()) try {
+		await cleanup();
+	} catch (cause) {
+		errors.push(cause);
+	}
+	if (errors.length > 0) throw new AggregateError(errors, "Failed to clean up server resources");
+};
+const createResources = () => {
+	const cleanups = [];
+	let closePromise;
+	return {
+		add: (cleanup) => cleanups.push(cleanup),
+		close: () => {
+			const next = closePromise ?? cleanupResources(cleanups);
+			closePromise = next;
+			return next;
+		}
+	};
+};
+const closeNodeServer = (server, cancelActiveWork) => {
+	const closed = new Promise((resolveClose, reject) => {
+		server.close((error) => {
+			if (error && error.code !== "ERR_SERVER_NOT_RUNNING") {
+				reject(error);
+				return;
+			}
+			resolveClose();
+		});
+	});
+	const cancellation = cancelActiveWork();
+	if ("closeAllConnections" in server) server.closeAllConnections();
+	return Promise.all([closed, cancellation]).then(() => void 0);
+};
+const getServerAddress = async (server) => {
+	if (!server.address()) await once(server, "listening");
+	const address = server.address();
+	if (!address || typeof address === "string") throw new Error("Overmux server did not bind a TCP address");
+	return address;
+};
+const registerProcessErrorLogging = (logger) => {
+	const onUncaughtException = (cause, origin) => logger.log({
+		details: errorDetails$1(cause),
+		event: origin === "unhandledRejection" ? "unhandled-rejection" : "uncaught-exception",
+		level: "error"
+	});
+	process.on("uncaughtExceptionMonitor", onUncaughtException);
+	return () => {
+		process.off("uncaughtExceptionMonitor", onUncaughtException);
+	};
+};
+const loadServerSettings = async ({ configPath, options }) => {
+	const { config } = await loadOvermuxConfig({
+		aliases: options.configAliases,
+		configPath
+	});
+	return {
+		config,
+		startup: resolveServerStartupOptions({
+			config,
+			configPath,
+			overrides: options
+		})
+	};
+};
+const createAuthOrigins = ({ configuredOrigins, startup }) => {
+	const urlHost = startup.host.includes(":") ? `[${startup.host}]` : startup.host;
+	let values = (configuredOrigins ?? [`http://${urlHost}:${startup.port}`]).map(validateAuthOrigin);
+	return {
+		establish: (localUrl) => {
+			values = (configuredOrigins ?? [localUrl]).map(validateAuthOrigin);
+			return values;
+		},
+		get: () => values
+	};
+};
+const createApplicationServices = async ({ config, logger, resources, startup }) => {
+	const authOrigins = createAuthOrigins({
+		configuredOrigins: config.auth.origins,
+		startup
+	});
+	const authService = createAuthService({ config: config.auth });
+	const auth = createAuthBoundary({
+		origins: authOrigins.get,
+		service: authService,
+		trustedProxyPeer: config.auth.trustedProxyPeer
+	});
+	const backgroundNotifications = createBackgroundNotificationService({
+		isSessionActive: authService.isSessionActive,
+		logger,
+		store: createFileBackgroundNotificationStore()
+	});
+	resources.add(authService.onSessionsRevoked((sessionIds) => {
+		backgroundNotifications.disableSessions(sessionIds).catch((cause) => {
+			logger.log({
+				details: errorDetails$1(cause),
+				event: "background-notification-session-cleanup-failed",
+				level: "error"
+			});
+		});
+	}));
+	const notifications = createNotificationService({
+		backgroundNotifications,
+		logger
+	});
+	const runtime = await createRuntime({
+		config,
+		debug: logger.enabled,
+		notifications
+	});
+	resources.add(runtime.dispose);
+	return {
+		auth,
+		authOrigins,
+		authService,
+		backgroundNotifications,
+		notifications,
+		runtime
+	};
+};
+const startApplicationTransport = async ({ auth, authOrigins, authService, backgroundNotifications, developmentWebTarget, logger, notifications, onRestartRequested, resources, runtime, startup }) => {
+	let announceRestarting = () => void 0;
+	const app = createHttpApp({
+		auth,
+		backgroundNotifications,
+		developmentWebTarget,
+		onRestartRequested: () => {
+			announceRestarting();
+			onRestartRequested();
+		},
+		runtime,
+		serverLogger: logger,
+		webAssetsDir: developmentWebTarget ? void 0 : startup.productionWebAssetsDir
+	});
+	const server = serve({
+		fetch: app.fetch,
+		hostname: startup.host,
+		port: startup.port
+	});
+	resources.add(() => closeNodeServer(server, runtime.dispose));
+	const webSockets = createWebSocketServer({
+		auth,
+		developmentWebTarget,
+		runtime,
+		server,
+		serverLogger: logger
+	});
+	resources.add(webSockets.close);
+	announceRestarting = webSockets.announceRestarting;
+	notifications.attachLiveDelivery(webSockets.broadcastNotification);
+	const address = await getServerAddress(server);
+	const urlHost = startup.host.includes(":") ? `[${startup.host}]` : startup.host;
+	const localUrl = `http://${urlHost}:${address.port}`;
+	const controlApiHost = startup.host === "0.0.0.0" ? "127.0.0.1" : startup.host === "::" ? "[::1]" : urlHost;
+	const origins = authOrigins.establish(localUrl);
+	authService.setOrigins(origins);
+	const instanceControl = await startInstanceControl({
+		auth: authService,
+		apiUrl: `http://${controlApiHost}:${address.port}`,
+		port: address.port,
+		url: origins[0]
+	});
+	resources.add(instanceControl.close);
+	return {
+		address,
+		app,
+		localUrl,
+		webSockets
+	};
+};
+const closeApplicationServer = async ({ app, logger, resources }) => {
+	logger.log({ event: "server-stop" });
+	app.beginShutdown();
+	await resources.close();
+};
+const failApplicationServerStartup = async (cause, resources) => {
+	try {
+		await resources.close();
+	} catch (cleanupCause) {
+		throw new AggregateError([cause, cleanupCause], "Server startup and cleanup failed");
+	}
+	throw cause;
+};
+const startApplicationServer = async ({ onRestartRequested, options }) => {
+	const logger = createServerLogger({
+		enabled: options.debug ?? false,
+		logFile: options.logFile ? resolve(options.logFile) : void 0
+	});
+	const resources = createResources();
+	resources.add(registerProcessErrorLogging(logger));
+	try {
+		const configPath = resolve(options.configPath);
+		logger.log({
+			details: { configPath },
+			event: "server-start"
+		});
+		const { config, startup } = await loadServerSettings({
+			configPath,
+			options
+		});
+		logger.setEnabled(Boolean(options.debug || config.debug));
+		if (startup.logFile) logger.setLogFile(startup.logFile);
+		const { auth, authOrigins, authService, backgroundNotifications, notifications, runtime } = await createApplicationServices({
+			config,
+			logger,
+			resources,
+			startup
+		});
+		const { address, app, localUrl, webSockets } = await startApplicationTransport({
+			auth,
+			authOrigins,
+			authService,
+			backgroundNotifications,
+			developmentWebTarget: options.developmentWebTarget,
+			logger,
+			notifications,
+			onRestartRequested,
+			resources,
+			runtime,
+			startup
+		});
+		return {
+			announceUpdateAvailable: webSockets.announceUpdateAvailable,
+			close: () => closeApplicationServer({
+				app,
+				logger,
+				resources
+			}),
+			host: startup.host,
+			port: address.port,
+			url: localUrl,
+			watch: startup.watch
+		};
+	} catch (cause) {
+		return failApplicationServerStartup(cause, resources);
+	}
+};
+//#endregion
+//#region src/internal/server/coordinator/ipc-protocol.ts
+const childOptionsSchema = z.object({
+	configAliases: z.record(z.string(), z.string()).optional(),
+	configPath: z.string(),
+	debug: z.boolean().optional(),
+	developmentWebTarget: z.url().optional(),
+	host: z.string().optional(),
+	logFile: z.string().optional(),
+	port: z.number().int().min(0).max(65535).optional(),
+	productionWebAssetsDir: z.string().optional(),
+	watch: z.boolean().optional()
+});
+const parentMessageSchema = z.discriminatedUnion("type", [
+	z.object({
+		options: childOptionsSchema,
+		type: z.literal("start")
+	}),
+	z.object({ type: z.literal("update-available") }),
+	z.object({ type: z.literal("stop") })
+]);
+z.discriminatedUnion("type", [
+	z.object({
+		host: z.string(),
+		port: z.number().int().min(1).max(65535),
+		type: z.literal("ready"),
+		url: z.string(),
+		watch: z.boolean()
+	}),
+	z.object({ type: z.literal("restart-requested") }),
+	z.object({
+		message: z.string(),
+		type: z.literal("startup-failed")
+	})
+]);
+const parseParentMessage = (value) => parentMessageSchema.parse(value);
+//#endregion
+//#region src/internal/server/coordinator/server-child.ts
+const send = (message) => {
+	if (!process.connected) return;
+	try {
+		process.send?.(message, () => void 0);
+	} catch {}
+};
+const disconnect = () => {
+	if (!process.connected) return;
+	try {
+		process.disconnect();
+	} catch {}
+};
+const runServerChild = () => {
+	let serverPromise;
+	let closing;
+	const close = () => {
+		if (closing) return closing;
+		closing = serverPromise?.then((server) => server.close(), () => void 0) ?? Promise.resolve();
+		return closing;
+	};
+	process.on("message", (raw) => {
+		let message;
+		try {
+			message = parseParentMessage(raw);
+		} catch (cause) {
+			send({
+				message: errorMessage(cause),
+				type: "startup-failed"
+			});
+			return;
+		}
+		if (message.type === "update-available") {
+			if (!closing) serverPromise?.then((server) => server.announceUpdateAvailable(), () => void 0);
+			return;
+		}
+		if (message.type === "stop") {
+			close().catch((cause) => {
+				process.stderr.write(`[overmux] child shutdown failed: ${errorMessage(cause)}\n`);
+			}).finally(disconnect);
+			return;
+		}
+		if (serverPromise || closing) {
+			send({
+				message: "Server child received more than one start request",
+				type: "startup-failed"
+			});
+			return;
+		}
+		serverPromise = startApplicationServer({
+			onRestartRequested: () => send({ type: "restart-requested" }),
+			options: message.options
+		});
+		serverPromise.then((server) => {
+			if (closing) return;
+			send({
+				host: server.host,
+				port: server.port,
+				type: "ready",
+				url: server.url,
+				watch: server.watch
+			});
+		}).catch((cause) => {
+			send({
+				message: errorMessage(cause),
+				type: "startup-failed"
+			});
+			disconnect();
+		});
+	});
+	process.once("disconnect", () => {
+		close().catch((cause) => {
+			process.stderr.write(`[overmux] disconnected child shutdown failed: ${errorMessage(cause)}\n`);
+		});
+	});
+};
+runServerChild();
+//#endregion
+export {};
+
+//# sourceMappingURL=server-child.js.map