overmux 0.0.10 → 0.0.12

package/dist/internal/server/coordinator/server-child.js

@@ -1,16 +1,16 @@
+import { A as overmuxLogoutPath, C as serverProtocolMessageSchema, D as instanceIdSchema, E as backgroundNotificationSubscriptionSchema, F as serverConfigRuntimeSchema, M as authDurationSchema, N as getOvermuxPaths, O as logLevelSchema, S as notificationEventSchema, T as backgroundNotificationDisableRequestSchema, b as decodeProtocolFrame, c as defaultInstanceId, g as getServerLogFile, h as errorMessage, i as postWorkerMessage, j as overmuxSettingsPath, k as notificationSchema, l as ProtocolError, m as errorDetails$1, n as deserializeWorkerError, o as workerLimits, p as createServerLogger, r as encodeWorkerMessage, s as createRuntimeInstance, t as decodeWorkerMessage, u as OperationValidationError, w as webSocketCloseCode, x as encodeProtocolFrame, y as clientProtocolMessageSchema } from "../../../worker-protocol-hXs4FXCH.js";
 import { serve } from "@hono/node-server";
-import { chmod, link, mkdir, open, readFile, realpath, rename, rm, stat } from "node:fs/promises";
-import { createServer, isIP } from "node:net";
-import { dirname, isAbsolute, join, resolve } from "node:path";
-import { createJiti } from "jiti";
-import { ZodError, z } from "zod";
-import { homedir, hostname } from "node:os";
 import { once } from "node:events";
+import { basename, dirname, join, resolve } from "node:path";
 import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { chmod, link, mkdir, open, readFile, rename, rm, stat } from "node:fs/promises";
+import { homedir } from "node:os";
+import { createServer } from "node:net";
+import { ZodError, z } from "zod";
 import { generateCookie } from "hono/cookie";
 import { bodyLimit } from "hono/body-limit";
 import { parse } from "hono/utils/cookie";
-import { appendFileSync, constants, mkdirSync, readFileSync } from "node:fs";
+import { constants, readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { Hono } from "hono";
 import { serveStatic } from "@hono/node-server/serve-static";
@@ -18,146 +18,7 @@ import { proxyFetch, proxyUpgrade } from "httpxy";
 import { WebSocket, WebSocketServer } from "ws";
 import webPush from "web-push";
 import { isDeepStrictEqual } from "node:util";
-//#region ../shared/dist/node/index.js
-const durationPattern$1 = /^([1-9]\d*)(ms|s|m|h|d)$/;
-const millisecondsByUnit$1 = {
-	d: 1440 * 60 * 1e3,
-	h: 3600 * 1e3,
-	m: 60 * 1e3,
-	ms: 1,
-	s: 1e3
-};
-const durationToMilliseconds$1 = (duration) => {
-	const match = durationPattern$1.exec(duration);
-	if (!match) return;
-	const unit = match[2];
-	const milliseconds = Number(match[1]) * millisecondsByUnit$1[unit];
-	return Number.isSafeInteger(milliseconds) ? milliseconds : void 0;
-};
-const aiContextSnippets = ["package-source", "tech-stack-recommendations"];
-const instanceIdSchema$1 = z.string().max(253).regex(/^[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?(?![\s\S])/, "Expected a lowercase instance ID with only ASCII letters, digits, internal dots and hyphens");
-const zodTypeSchema = z.custom((value) => value instanceof z.ZodType, "Expected a Zod schema");
-const functionSchema = z.custom((value) => typeof value === "function", "Expected a function");
-const contractRuntimeSchema = z.object({
-	input: zodTypeSchema,
-	output: zodTypeSchema
-});
-const operationRuntimeSchema = z.object({
-	handle: functionSchema,
-	input: zodTypeSchema,
-	output: zodTypeSchema
-});
-const streamHandlerRuntimeSchema = z.object({
-	contract: z.object({
-		clientMessage: zodTypeSchema,
-		input: zodTypeSchema,
-		serverMessage: zodTypeSchema
-	}),
-	open: functionSchema
-});
-const resourceDefinitionRuntimeSchema = z.discriminatedUnion("kind", [
-	z.object({
-		contract: contractRuntimeSchema,
-		kind: z.literal("query"),
-		read: functionSchema
-	}),
-	z.object({
-		contract: contractRuntimeSchema,
-		kind: z.literal("subscription"),
-		read: functionSchema,
-		subscribe: functionSchema
-	}),
-	z.object({
-		combine: functionSchema,
-		contract: contractRuntimeSchema,
-		dependencies: z.record(z.string(), z.string()),
-		kind: z.literal("derived")
-	})
-]);
-const authDurationSchema = z.string().regex(/^[1-9]\d*[mhd]$/, "Expected a positive duration such as 30d").refine((value) => durationToMilliseconds$1(value) !== void 0, "Duration is too large");
-const isLoopbackHostname$1 = (hostname) => hostname === "localhost" || hostname === "[::1]" || /^127(?:\.\d{1,3}){3}$/.test(hostname);
-const exactOriginSchema = z.url().refine((value) => new URL(value).origin === value, "Expected an origin").refine((value) => {
-	const url = new URL(value);
-	return url.protocol === "https:" || url.protocol === "http:" && isLoopbackHostname$1(url.hostname);
-}, "Non-loopback Overmux origins must use HTTPS");
-const loopbackPeerSchema = z.string().refine((value) => isIP(value) !== 0 && (value === "::1" || value.startsWith("127.")), "Expected a loopback IP address");
-const authConfigRuntimeSchema = z.object({
-	mode: z.literal("cli-login"),
-	origins: z.array(exactOriginSchema).min(1).refine((origins) => new Set(origins).size === origins.length, "Expected unique origins").optional(),
-	sessionLifetime: z.union([z.literal("forever"), authDurationSchema]).default("forever"),
-	trustedProxyPeer: loopbackPeerSchema.optional()
-}).strict();
-const serverConfigRuntimeSchema = z.object({
-	host: z.string().min(1).optional(),
-	port: z.number().int().min(1).max(65535).optional(),
-	productionWebAssetsDir: z.string().min(1).optional(),
-	watch: z.boolean().optional()
-});
-const serverDefinitionRuntimeSchema = z.object({
-	operations: z.record(z.string(), operationRuntimeSchema).optional(),
-	resources: z.record(z.string(), resourceDefinitionRuntimeSchema),
-	streams: z.record(z.string(), streamHandlerRuntimeSchema).optional()
-});
-const configDefinitionRuntimeSchema = serverConfigRuntimeSchema.extend({
-	aiContextSnippets: z.array(z.enum(aiContextSnippets)).optional(),
-	auth: authConfigRuntimeSchema,
-	debug: z.boolean().optional(),
-	instanceId: z.union([instanceIdSchema$1, z.custom((value) => typeof value === "function", "Expected an instance ID or a function of the bound port")]).optional(),
-	server: serverDefinitionRuntimeSchema,
-	vite: z.string().min(1).optional()
-});
-const resolveLogicalPath = async (path) => {
-	const logicalPath = resolve(path);
-	return {
-		logicalPath,
-		realPath: await realpath(logicalPath)
-	};
-};
-const resolveOvermuxConfigPaths = async (configPath) => {
-	const { logicalPath, realPath } = await resolveLogicalPath(configPath);
-	return {
-		logicalApplicationRoot: dirname(logicalPath),
-		logicalConfigPath: logicalPath,
-		realApplicationRoot: dirname(realPath),
-		realConfigPath: realPath
-	};
-};
-const unwrapDefaultExport = (module) => {
-	if (typeof module === "object" && module !== null && "default" in module) return module.default;
-	return module;
-};
-const loadOvermuxConfig = async ({ aliases = {}, configPath }) => {
-	const paths = await resolveOvermuxConfigPaths(configPath);
-	const module = await createJiti(paths.logicalConfigPath, {
-		alias: aliases,
-		fsCache: true,
-		jsx: {
-			importSource: "react",
-			runtime: "automatic"
-		},
-		moduleCache: false,
-		sourceMaps: true,
-		tsconfigPaths: true
-	}).import(paths.logicalConfigPath);
-	return {
-		config: configDefinitionRuntimeSchema.parse(unwrapDefaultExport(module)),
-		paths
-	};
-};
-const xdgDirectory = (configured, fallback) => configured && isAbsolute(configured) ? configured : fallback;
-const overmuxDirectory = (root) => join(root, "overmux");
-const getOvermuxPaths = ({ environment = process.env, homeDir = homedir(), xdgCacheHome = environment.XDG_CACHE_HOME, xdgConfigHome = environment.XDG_CONFIG_HOME, xdgDataHome = environment.XDG_DATA_HOME, xdgRuntimeDir = environment.XDG_RUNTIME_DIR, xdgStateHome = environment.XDG_STATE_HOME } = {}) => {
-	if (!isAbsolute(homeDir)) throw new TypeError("The home directory must be absolute.");
-	const runtimeDir = xdgRuntimeDir && isAbsolute(xdgRuntimeDir) ? overmuxDirectory(xdgRuntimeDir) : void 0;
-	return {
-		cacheDir: overmuxDirectory(xdgDirectory(xdgCacheHome, join(homeDir, ".cache"))),
-		configDir: overmuxDirectory(xdgDirectory(xdgConfigHome, join(homeDir, ".config"))),
-		dataDir: overmuxDirectory(xdgDirectory(xdgDataHome, join(homeDir, ".local", "share"))),
-		...runtimeDir ? { runtimeDir } : {},
-		stateDir: overmuxDirectory(xdgDirectory(xdgStateHome, join(homeDir, ".local", "state")))
-	};
-};
-//#endregion
+import { Worker } from "node:worker_threads";
 //#region ../lib/dist/index.js
 const durationPattern = /^([1-9]\d*)(ms|s|m|h|d)$/;
 const millisecondsByUnit = {
@@ -845,37 +706,6 @@ const createHttpAuthenticationHandlers = ({ auth, authAssetsDirectory }) => {
 	};
 };
 //#endregion
-//#region ../shared/dist/index.js
-const overmuxSettingsPath = "/_overmux/settings";
-const overmuxLogoutPath = "/_overmux/logout";
-const safeRelativeNotificationLink = (link) => {
-	let decoded;
-	try {
-		decoded = decodeURIComponent(link);
-	} catch {
-		return false;
-	}
-	return !decoded.startsWith("//") && !decoded.includes("\\") && ![...decoded].some((character) => {
-		const codePoint = character.codePointAt(0) ?? 0;
-		return codePoint < 32 || codePoint === 127;
-	});
-};
-const notificationLinkSchema = z.union([z.string().max(4096).startsWith("/").refine(safeRelativeNotificationLink), z.string().max(4096).url().refine((link) => {
-	if (!URL.canParse(link)) return false;
-	const url = new URL(link);
-	return ["http:", "https:"].includes(url.protocol) && !url.username && !url.password;
-})]);
-const notificationSchema = z.object({
-	body: z.string().max(4096).optional(),
-	open: z.object({ link: notificationLinkSchema }).strict().optional(),
-	title: z.string().min(1).max(4096)
-}).strict();
-const instanceIdSchema = z.string().max(253).regex(/^[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?(?![\s\S])/, "Expected a lowercase instance ID with only ASCII letters, digits, internal dots and hyphens");
-const createInstanceIdentity = (instanceId) => ({
-	instanceId: instanceIdSchema.parse(instanceId),
-	deepLinkPrefix: `overmux://${instanceId}`
-});
-//#endregion
 //#region src/internal/server/auth/instance-control.ts
 const maxControlMessageBytes = 16384;
 const controlRequestSchema = z.discriminatedUnion("type", [
@@ -1098,214 +928,6 @@ const startInstanceControl = async ({ auth, apiUrl, instanceId, port, url }) =>
 	return { close };
 };
 //#endregion
-//#region src/internal/shared/background-notifications.ts
-const deliveryKeySchema = z.string().min(1).max(1024).regex(/^[\w-]+$/u);
-const backgroundNotificationSubscriptionSchema = z.object({
-	endpoint: z.url().max(4096).refine((endpoint) => {
-		const url = new URL(endpoint);
-		return url.protocol === "https:" && !url.username && !url.password;
-	}),
-	expirationTime: z.number().int().nonnegative().nullable(),
-	keys: z.object({
-		auth: deliveryKeySchema,
-		p256dh: deliveryKeySchema
-	}).strict()
-}).strict();
-z.object({ publicKey: deliveryKeySchema }).strict();
-const backgroundNotificationDisableRequestSchema = z.object({ endpoint: backgroundNotificationSubscriptionSchema.shape.endpoint }).strict();
-const webSocketCloseCode = {
-	authenticationRevoked: 4001,
-	authenticationUnavailable: 4002
-};
-z.object({
-	debug: z.boolean(),
-	operations: z.array(z.string().min(1)),
-	protocolVersion: z.literal(10),
-	resources: z.array(z.string().min(1)),
-	streams: z.array(z.string().min(1))
-});
-const updateAvailableEventSchema = z.object({ type: z.literal("update-available") });
-const restartingEventSchema = z.object({ type: z.literal("restarting") });
-z.discriminatedUnion("type", [updateAvailableEventSchema, restartingEventSchema]);
-const notificationEventSchema = z.object({
-	notification: notificationSchema,
-	type: z.literal("notification")
-}).strict();
-const operationIdSchema = z.string().min(1).max(256);
-const registrationNameSchema = z.string().min(1).max(256);
-const resourceReadMessageSchema = z.object({
-	input: z.unknown().optional(),
-	operationId: operationIdSchema,
-	resourceName: registrationNameSchema,
-	type: z.literal("resource-read")
-});
-const resourceSubscribeMessageSchema = z.object({
-	input: z.unknown().optional(),
-	operationId: operationIdSchema,
-	resourceName: registrationNameSchema,
-	subscriptionId: operationIdSchema,
-	type: z.literal("resource-subscribe")
-});
-const resourceUnsubscribeMessageSchema = z.object({
-	subscriptionId: operationIdSchema,
-	type: z.literal("resource-unsubscribe")
-});
-const streamOpenMessageSchema = z.object({
-	input: z.unknown().optional(),
-	operationId: operationIdSchema,
-	streamId: operationIdSchema,
-	streamName: registrationNameSchema,
-	type: z.literal("stream-open")
-});
-const streamMessageSchema = z.object({
-	message: z.unknown(),
-	streamId: operationIdSchema,
-	type: z.literal("stream-message")
-});
-const streamCloseMessageSchema = z.object({
-	streamId: operationIdSchema,
-	type: z.literal("stream-close")
-});
-const clientDiagnosticEventSchema = z.object({
-	arguments: z.string().max(16100),
-	level: z.enum([
-		"log",
-		"info",
-		"warn",
-		"error",
-		"debug"
-	]),
-	message: z.string().max(4100),
-	stack: z.string().max(8100).optional(),
-	timestamp: z.iso.datetime(),
-	type: z.literal("client-diagnostic"),
-	url: z.string().max(2100).optional()
-});
-const clientProtocolMessageSchema = z.discriminatedUnion("type", [
-	resourceReadMessageSchema,
-	resourceSubscribeMessageSchema,
-	resourceUnsubscribeMessageSchema,
-	streamOpenMessageSchema,
-	streamMessageSchema,
-	streamCloseMessageSchema,
-	clientDiagnosticEventSchema
-]);
-const resourceResultMessageSchema = z.object({
-	operationId: operationIdSchema,
-	output: z.unknown(),
-	type: z.literal("resource-result")
-});
-const resourceInvalidatedMessageSchema = z.object({
-	subscriptionId: operationIdSchema,
-	type: z.literal("resource-invalidated")
-});
-const streamOpenedMessageSchema = z.object({
-	operationId: operationIdSchema,
-	streamId: operationIdSchema,
-	type: z.literal("stream-opened")
-});
-const streamOutputMessageSchema = z.object({
-	message: z.unknown(),
-	streamId: operationIdSchema,
-	type: z.literal("stream-output")
-});
-const streamClosedMessageSchema = z.object({
-	streamId: operationIdSchema,
-	type: z.literal("stream-closed")
-});
-const protocolErrorMessageSchema = z.object({
-	code: z.enum([
-		"bad-request",
-		"conflict",
-		"internal",
-		"not-found"
-	]),
-	message: z.string(),
-	operationId: operationIdSchema.optional(),
-	streamId: operationIdSchema.optional(),
-	subscriptionId: operationIdSchema.optional(),
-	type: z.literal("error")
-});
-const serverInfoMessageSchema = z.object({
-	type: z.literal("server-info"),
-	instanceId: instanceIdSchema
-}).strict();
-const serverProtocolMessageSchema = z.discriminatedUnion("type", [
-	serverInfoMessageSchema,
-	resourceResultMessageSchema,
-	resourceInvalidatedMessageSchema,
-	streamOpenedMessageSchema,
-	streamOutputMessageSchema,
-	streamClosedMessageSchema,
-	protocolErrorMessageSchema,
-	updateAvailableEventSchema,
-	restartingEventSchema,
-	notificationEventSchema
-]);
-const byteMarker = "$overmuxBytes";
-const decodeValue = (value) => {
-	if (Array.isArray(value)) return value.map(decodeValue);
-	if (typeof value !== "object" || value === null) return value;
-	const record = value;
-	if (Object.keys(record).length === 1 && Array.isArray(record[byteMarker]) && record[byteMarker].every((item) => Number.isInteger(item) && item >= 0 && item <= 255)) return Uint8Array.from(record[byteMarker]);
-	return Object.fromEntries(Object.entries(record).map(([key, item]) => [key, decodeValue(item)]));
-};
-const binaryMarker = "$overmuxBinary";
-const binaryMagic = 1330468865;
-const encodeBinaryValue = (value, payloads, offset) => {
-	if (value instanceof Uint8Array) {
-		const marker = { [binaryMarker]: [offset.value, value.byteLength] };
-		payloads.push(value);
-		offset.value += value.byteLength;
-		return marker;
-	}
-	if (Array.isArray(value)) return value.map((item) => encodeBinaryValue(item, payloads, offset));
-	if (typeof value === "object" && value !== null) return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, encodeBinaryValue(item, payloads, offset)]));
-	return value;
-};
-const decodeBinaryValue = (value, payload) => {
-	if (Array.isArray(value)) return value.map((item) => decodeBinaryValue(item, payload));
-	if (typeof value !== "object" || value === null) return value;
-	const record = value;
-	const marker = record[binaryMarker];
-	if (Object.keys(record).length === 1 && Array.isArray(marker) && marker.length === 2 && marker.every((item) => Number.isInteger(item) && item >= 0)) {
-		const [offset, length] = marker;
-		if (offset + length > payload.byteLength) throw new Error("Invalid Overmux binary payload range");
-		return payload.slice(offset, offset + length);
-	}
-	return Object.fromEntries(Object.entries(record).map(([key, item]) => [key, decodeBinaryValue(item, payload)]));
-};
-const decodeProtocolMessage = (message) => decodeValue(JSON.parse(message));
-const encodeProtocolFrame = (message) => {
-	const payloads = [];
-	const encoded = encodeBinaryValue(message, payloads, { value: 0 });
-	if (!payloads.length) return JSON.stringify(encoded);
-	const header = new TextEncoder().encode(JSON.stringify(encoded));
-	const payloadLength = payloads.reduce((total, payload) => total + payload.byteLength, 0);
-	const frame = new Uint8Array(8 + header.byteLength + payloadLength);
-	const view = new DataView(frame.buffer);
-	view.setUint32(0, binaryMagic);
-	view.setUint32(4, header.byteLength);
-	frame.set(header, 8);
-	let offset = 8 + header.byteLength;
-	payloads.forEach((payload) => {
-		frame.set(payload, offset);
-		offset += payload.byteLength;
-	});
-	return frame;
-};
-const decodeProtocolFrame = (frame) => {
-	if (typeof frame === "string") return decodeProtocolMessage(frame);
-	const bytes = frame instanceof Uint8Array ? frame : new Uint8Array(frame, 0, frame.byteLength);
-	if (bytes.byteLength < 8) throw new Error("Invalid Overmux binary frame");
-	const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
-	if (view.getUint32(0) !== binaryMagic) throw new Error("Invalid Overmux binary frame magic");
-	const headerLength = view.getUint32(4);
-	if (8 + headerLength > bytes.byteLength) throw new Error("Invalid Overmux binary frame header");
-	const header = JSON.parse(new TextDecoder().decode(bytes.subarray(8, 8 + headerLength)));
-	return decodeBinaryValue(header, bytes.subarray(8 + headerLength));
-};
-//#endregion
 //#region src/internal/server/http/background-notification-handlers.ts
 const requestLimit = 16384;
 const parseJson = async (request, schema) => {
@@ -1339,61 +961,6 @@ const createBackgroundNotificationHandlers = ({ backgroundNotifications }) => ({
 	}
 });
 //#endregion
-//#region src/internal/server/server-logger.ts
-const lifecycleEvents = /* @__PURE__ */ new Set([
-	"server-start",
-	"server-stop",
-	"websocket-close",
-	"websocket-close-event",
-	"websocket-connect",
-	"websocket-open"
-]);
-const getServerLogFile = ({ homeDir, xdgStateHome } = {}) => join(getOvermuxPaths({
-	homeDir,
-	xdgStateHome
-}).stateDir, "overmux.log");
-const safeJson = (value) => {
-	try {
-		return JSON.stringify(value);
-	} catch {
-		return JSON.stringify({
-			event: "log-serialization-error",
-			level: "error",
-			source: "server",
-			timestamp: (/* @__PURE__ */ new Date()).toISOString()
-		});
-	}
-};
-const createServerLogger = ({ enabled, logFile }) => {
-	let debugEnabled = enabled;
-	return {
-		get enabled() {
-			return debugEnabled;
-		},
-		id: randomUUID,
-		log: (entry) => {
-			if (!debugEnabled && entry.level !== "error" && !lifecycleEvents.has(entry.event)) return;
-			const record = safeJson({
-				timestamp: entry.timestamp ?? (/* @__PURE__ */ new Date()).toISOString(),
-				level: entry.level ?? "info",
-				source: entry.source ?? "server",
-				...entry
-			});
-			mkdirSync(dirname(logFile), { recursive: true });
-			appendFileSync(logFile, `${record}\n`, "utf8");
-			process.stderr.write(`[overmux:debug] ${record}\n`);
-		},
-		setEnabled: (nextEnabled) => {
-			debugEnabled = nextEnabled;
-		}
-	};
-};
-const errorMessage = (cause) => cause instanceof Error ? cause.message : String(cause);
-const errorDetails$1 = (cause) => ({
-	message: errorMessage(cause),
-	...cause instanceof Error && cause.stack ? { stack: cause.stack } : {}
-});
-//#endregion
 //#region src/internal/server/http/development-web-backend.ts
 const createForwardingHeaders = ({ origin, remoteAddress, request }) => {
 	const headers = new Headers(request.headers);
@@ -1449,42 +1016,6 @@ const createRestartHandler = ({ onRestartRequested, shutdown }) => (context) =>
 	return response;
 };
 //#endregion
-//#region src/internal/server/runtime/runtime-operations.ts
-var OperationValidationError = class extends Error {
-	phase;
-	constructor(phase, cause) {
-		super(cause.message, { cause });
-		this.phase = phase;
-	}
-};
-const createRuntimeOperations = ({ context, definitions, notifications }) => {
-	const operations = /* @__PURE__ */ new Map();
-	Object.entries(definitions).forEach(([name, definition]) => {
-		if (!name) throw new Error("Operation names must not be empty");
-		operations.set(name, {
-			execute: async (rawInput, signal) => {
-				const operationContext = context(signal);
-				operationContext.signal.throwIfAborted();
-				const input = definition.input.safeParse(rawInput);
-				if (!input.success) throw new OperationValidationError("input", input.error);
-				const rawOutput = await definition.handle(input.data, {
-					...operationContext,
-					notifications
-				});
-				operationContext.signal.throwIfAborted();
-				const output = definition.output.safeParse(rawOutput);
-				if (!output.success) throw new OperationValidationError("output", output.error);
-				return output.data;
-			},
-			returnsVoid: definition.output instanceof z.ZodVoid
-		});
-	});
-	return {
-		get: (name) => operations.get(name),
-		names: [...operations.keys()]
-	};
-};
-//#endregion
 //#region src/internal/server/http/operation-handler.ts
 const maxOperationRequestBytes = 1048576;
 const parseOperationRequest = async (request) => {
@@ -1521,15 +1052,17 @@ const createOperationHandler = ({ runtime, serverLogger }) => async (context) =>
 	serverLogger?.log({
 		correlationId,
 		details: { registeredName: context.req.param("name") },
-		event: "operation-start"
+		event: "operation-start",
+		level: "debug"
 	});
 	try {
-		const output = await operation.execute(parsed.input, context.req.raw.signal);
+		const output = await operation.execute(parsed.input, context.req.raw.signal, { correlationId });
 		serverLogger?.log({
 			correlationId,
 			details: { registeredName: context.req.param("name") },
 			durationMs: Date.now() - startedAt,
-			event: "operation-complete"
+			event: "operation-complete",
+			level: "debug"
 		});
 		return operation.returnsVoid ? new Response(void 0, { status: 204 }) : context.json(output);
 	} catch (cause) {
@@ -1562,7 +1095,7 @@ const createRequestLoggingMiddleware = ({ serverLogger }) => async (context, nex
 		},
 		durationMs: Date.now() - startedAt,
 		event: failed ? "http-request-failure" : "http-request",
-		level: failed ? "error" : void 0,
+		level: failed ? "error" : "debug",
 		message: context.error?.message
 	});
 };
@@ -1574,6 +1107,8 @@ const createRuntimeManifestHandler = ({ runtime }) => (context) => {
 };
 //#endregion
 //#region src/internal/shared/routes.ts
+const pushNotificationIconPath = "/_overmux/push/icon.png";
+const pushNotificationBadgePath = "/_overmux/push/badge.png";
 const runtimeWebSocketPath = "/api/socket";
 const viteInfrastructurePath = "/_overmux/vite/*";
 //#endregion
@@ -1608,6 +1143,17 @@ const registerHttpRoutes = ({ app, auth, authAssetsDirectory, backgroundNotifica
 			path: "*",
 			handler: createRequestLoggingMiddleware({ serverLogger })
 		},
+		...[pushNotificationIconPath, pushNotificationBadgePath].map((path) => ({
+			method: "GET",
+			path,
+			handler: async (context) => {
+				const asset = await readFile(fileURLToPath(new URL(`../push/${basename(path)}`, import.meta.resolve("overmux"))));
+				context.header("Cache-Control", "public, max-age=86400");
+				context.header("Content-Type", "image/png");
+				context.header("X-Content-Type-Options", "nosniff");
+				return context.body(new Uint8Array(asset));
+			}
+		})),
 		{
 			method: "GET",
 			path: "/_overmux/auth-shell/*",
@@ -1639,6 +1185,17 @@ const registerHttpRoutes = ({ app, auth, authAssetsDirectory, backgroundNotifica
 			path: "*",
 			handler: authentication.authenticate
 		},
+		{
+			method: "GET",
+			path: "/sw.js",
+			handler: async (context) => {
+				const script = await readFile(fileURLToPath(new URL("../push/sw.js", import.meta.resolve("overmux"))), "utf8");
+				context.header("Cache-Control", "no-cache");
+				context.header("Content-Type", "text/javascript; charset=UTF-8");
+				context.header("X-Content-Type-Options", "nosniff");
+				return context.body(script);
+			}
+		},
 		{
 			method: "POST",
 			path: "/api/auth/logout",
@@ -1746,13 +1303,6 @@ const createHttpApp = ({ auth, authAssetsDirectory, backgroundNotifications, dev
 //#endregion
 //#region src/internal/server/websocket-connection.ts
 const maxPendingStreamOutputBytes = 1048576;
-var OperationError = class extends Error {
-	code;
-	constructor(code, message) {
-		super(message);
-		this.code = code;
-	}
-};
 const bytesOf = (data) => {
 	if (Array.isArray(data)) return Buffer.concat(data);
 	if (data instanceof ArrayBuffer) return new Uint8Array(data);
@@ -1769,7 +1319,7 @@ const operationIdOf = (value) => {
 	return typeof operationId === "string" && operationId.length <= 256 ? operationId : void 0;
 };
 const errorDetails = (cause) => {
-	if (cause instanceof OperationError) return {
+	if (cause instanceof ProtocolError) return {
 		code: cause.code,
 		message: cause.message
 	};
@@ -1809,6 +1359,14 @@ const sendError = (state, cause, operationId, identity) => {
 		type: "error"
 	});
 };
+const reportCleanupFailure = (state, cause) => {
+	state.serverLogger?.log({
+		correlationId: state.connectionId,
+		details: errorDetails$1(cause),
+		event: "protocol-cleanup-error",
+		level: "error"
+	});
+};
 const disposeSubscription = async (state, subscriptionId) => {
 	const entry = state.subscriptions.get(subscriptionId);
 	if (!entry) return;
@@ -1827,11 +1385,11 @@ const disposeStream = async (state, streamId, notify = true) => {
 	}
 	state.streams.delete(streamId);
 	entry.controller.abort(/* @__PURE__ */ new Error("Stream closed"));
-	await entry.session?.dispose();
 	if (notify) send$1(state, {
 		streamId,
 		type: "stream-closed"
 	});
+	await entry.session?.dispose();
 };
 const disposeConnectionOperations = async (state, notify) => {
 	const operationControllers = [...state.operations.values()];
@@ -1843,7 +1401,7 @@ const disposeConnectionOperations = async (state, notify) => {
 };
 const runOperation = (state, identity, operation) => {
 	if (state.operations.has(identity.operationId)) {
-		sendError(state, new OperationError("conflict", "Operation ID is already active"), identity.operationId, identity);
+		sendError(state, new ProtocolError("conflict", "Operation ID is already active"), identity.operationId, identity);
 		return;
 	}
 	const controller = new AbortController();
@@ -1852,14 +1410,16 @@ const runOperation = (state, identity, operation) => {
 	state.serverLogger?.log({
 		correlationId: identity.operationId,
 		details: identity,
-		event: "operation-start"
+		event: "operation-start",
+		level: "debug"
 	});
 	operation(controller.signal).then(() => {
 		state.serverLogger?.log({
 			correlationId: identity.operationId,
 			details: identity,
 			durationMs: Date.now() - startedAt,
-			event: "operation-complete"
+			event: "operation-complete",
+			level: "debug"
 		});
 	}).catch((cause) => {
 		if (!controller.signal.aborted && !state.closed) {
@@ -1887,8 +1447,11 @@ const readResource = (state, message) => {
 		requestedName: message.resourceName
 	};
 	runOperation(state, identity, async (signal) => {
-		if (!resource) throw new OperationError("not-found", "Resource not found");
-		const output = await resource.read(message.input, signal);
+		if (!resource) throw new ProtocolError("not-found", "Resource not found");
+		const output = await resource.read(message.input, signal, {
+			correlationId: message.operationId,
+			connectionId: state.connectionId
+		});
 		send$1(state, {
 			operationId: message.operationId,
 			output,
@@ -1904,20 +1467,31 @@ const subscribeResource = (state, message) => {
 		requestedName: message.resourceName
 	};
 	if (state.subscriptions.has(message.subscriptionId)) {
-		sendError(state, new OperationError("conflict", "Subscription ID is already active"), message.operationId, identity);
+		sendError(state, new ProtocolError("conflict", "Subscription ID is already active"), message.operationId, identity);
 		return;
 	}
 	runOperation(state, identity, async (operationSignal) => {
-		if (!resource) throw new OperationError("not-found", "Resource not found");
+		if (!resource) throw new ProtocolError("not-found", "Resource not found");
 		const controller = new AbortController();
 		const entry = { controller };
 		state.subscriptions.set(message.subscriptionId, entry);
 		const signal = AbortSignal.any([operationSignal, controller.signal]);
 		try {
-			const dispose = await resource.subscribe(message.input, () => void send$1(state, {
-				subscriptionId: message.subscriptionId,
-				type: "resource-invalidated"
-			}), signal);
+			const dispose = await resource.subscribe(message.input, () => {
+				if (signal.aborted || state.subscriptions.get(message.subscriptionId) !== entry) return;
+				send$1(state, {
+					subscriptionId: message.subscriptionId,
+					type: "resource-invalidated"
+				});
+			}, signal, (cause) => {
+				if (signal.aborted || state.subscriptions.get(message.subscriptionId) !== entry) return;
+				sendError(state, cause, message.subscriptionId, identity);
+				disposeSubscription(state, message.subscriptionId).catch((disposeCause) => sendError(state, disposeCause, message.subscriptionId, identity));
+			}, {
+				correlationId: message.operationId,
+				connectionId: state.connectionId,
+				subscriptionId: message.subscriptionId
+			});
 			if (state.subscriptions.get(message.subscriptionId) === entry) entry.dispose = dispose;
 			else await dispose();
 		} catch (cause) {
@@ -1946,11 +1520,11 @@ const openStream = (state, message) => {
 		requestedName: message.streamName
 	};
 	if (state.streams.has(message.streamId)) {
-		sendError(state, new OperationError("conflict", "Stream ID is already active"), message.operationId, identity);
+		sendError(state, new ProtocolError("conflict", "Stream ID is already active"), message.operationId, identity);
 		return;
 	}
 	runOperation(state, identity, async (operationSignal) => {
-		if (!stream) throw new OperationError("not-found", "Stream not found");
+		if (!stream) throw new ProtocolError("not-found", "Stream not found");
 		const controller = new AbortController();
 		const entry = {
 			controller,
@@ -1960,8 +1534,10 @@ const openStream = (state, message) => {
 		const pending = [];
 		let pendingBytes = 0;
 		let opened = false;
+		const signal = AbortSignal.any([operationSignal, controller.signal]);
 		try {
-			entry.session = await stream.open(message.input, (output) => {
+			const session = await stream.open(message.input, (output) => {
+				if (signal.aborted || state.streams.get(message.streamId) !== entry) return;
 				if (opened) {
 					if (!send$1(state, {
 						message: output,
@@ -1973,12 +1549,22 @@ const openStream = (state, message) => {
 				pendingBytes += frameLength(output);
 				if (pendingBytes > maxPendingStreamOutputBytes) throw new Error("Stream produced too much output while opening");
 				pending.push(output);
-			}, AbortSignal.any([operationSignal, controller.signal]), (cause) => {
+			}, signal, (cause) => {
+				if (signal.aborted || state.streams.get(message.streamId) !== entry) return;
 				sendError(state, cause, message.streamId, identity);
 				disposeStream(state, message.streamId).catch((disposeCause) => {
-					sendError(state, disposeCause, message.streamId, identity);
+					reportCleanupFailure(state, disposeCause);
 				});
+			}, {
+				correlationId: message.operationId,
+				connectionId: state.connectionId,
+				streamId: message.streamId
 			});
+			if (signal.aborted || state.streams.get(message.streamId) !== entry) {
+				await session.dispose();
+				return;
+			}
+			entry.session = session;
 			send$1(state, {
 				operationId: message.operationId,
 				streamId: message.streamId,
@@ -1991,6 +1577,7 @@ const openStream = (state, message) => {
 				type: "stream-output"
 			})) throw new Error("Stream output could not be delivered");
 		} catch (cause) {
+			if (signal.aborted || state.streams.get(message.streamId) !== entry) return;
 			await disposeStream(state, message.streamId, false);
 			throw cause;
 		}
@@ -2004,18 +1591,19 @@ const sendStreamMessage = (state, message) => {
 		operationType: message.type
 	};
 	if (!entry?.session) {
-		sendError(state, new OperationError("not-found", "Stream not found"), message.streamId, identity);
+		sendError(state, new ProtocolError("not-found", "Stream not found"), message.streamId, identity);
 		return;
 	}
 	entry.session.send(message.message).catch((cause) => {
+		if (entry.controller.signal.aborted || state.streams.get(message.streamId) !== entry) return;
 		sendError(state, cause, message.streamId, identity);
 		disposeStream(state, message.streamId).catch((disposeCause) => {
-			sendError(state, disposeCause, message.streamId, identity);
+			reportCleanupFailure(state, disposeCause);
 		});
 	});
 };
 const logClientDiagnostic = (state, message) => {
-	if (!state.serverLogger?.enabled) return;
+	if (state.serverLogger?.logLevel !== "debug") return;
 	state.serverLogger.log({
 		details: {
 			arguments: message.arguments,
@@ -2044,7 +1632,7 @@ const handleMessage = (state, message) => {
 	}
 	if (message.type === "resource-unsubscribe") {
 		disposeSubscription(state, message.subscriptionId).catch((cause) => {
-			sendError(state, cause, message.subscriptionId);
+			reportCleanupFailure(state, cause);
 		});
 		return;
 	}
@@ -2054,7 +1642,7 @@ const handleMessage = (state, message) => {
 	}
 	if (message.type === "stream-close") {
 		disposeStream(state, message.streamId).catch((cause) => {
-			sendError(state, cause, message.streamId);
+			reportCleanupFailure(state, cause);
 		});
 		return;
 	}
@@ -2091,7 +1679,8 @@ const disposeConnection = async (state) => {
 	state.closed = true;
 	state.serverLogger?.log({
 		correlationId: state.connectionId,
-		event: "websocket-close"
+		event: "websocket-close",
+		level: "debug"
 	});
 	await disposeConnectionOperations(state, false);
 };
@@ -2113,7 +1702,8 @@ const attachWebSocketConnection = ({ runtime, serverLogger, socket }) => {
 	});
 	serverLogger?.log({
 		correlationId: state.connectionId,
-		event: "websocket-open"
+		event: "websocket-open",
+		level: "debug"
 	});
 	socket.on("message", (data, isBinary) => handleFrame(state, data, isBinary));
 	socket.once("close", (code, reason) => {
@@ -2123,7 +1713,8 @@ const attachWebSocketConnection = ({ runtime, serverLogger, socket }) => {
 				code,
 				reason: reason?.toString() ?? ""
 			},
-			event: "websocket-close-event"
+			event: "websocket-close-event",
+			level: "debug"
 		});
 		disposeConnection(state);
 	});
@@ -2312,7 +1903,8 @@ const createWebSocketServer = ({ auth, developmentWebTarget, runtime, server, se
 		const correlationId = serverLogger?.id();
 		serverLogger?.log({
 			correlationId,
-			event: "websocket-connect"
+			event: "websocket-connect",
+			level: "debug"
 		});
 		const path = requestPath(request);
 		const isRuntimeSocket = path === runtimeWebSocketPath;
@@ -2615,15 +2207,6 @@ const createFileBackgroundNotificationStore = ({ environment = process.env, home
 		}
 	};
 };
-z.void();
-const jsonValueSchema = z.lazy(() => z.union([
-	z.string(),
-	z.number().finite(),
-	z.boolean(),
-	z.null(),
-	z.array(jsonValueSchema),
-	z.record(z.string(), jsonValueSchema)
-]));
 //#endregion
 //#region src/internal/server/notifications/notification-service.ts
 const deliverSafely = async ({ deliver, event, logger }) => {
@@ -2661,389 +2244,537 @@ const createNotificationService = ({ backgroundNotifications, logger }) => {
 	};
 };
 //#endregion
-//#region src/internal/server/runtime/runtime-instance.ts
-const defaultInstanceId = ({ port }) => `${hostname()}-${port}`;
-const createRuntimeInstance = (configured) => {
-	let identity;
-	const get = () => {
-		if (!identity) throw new Error("Overmux instance identity is not ready");
-		return identity;
+//#region src/internal/server/runtime/worker-connection.ts
+const deliverNotification = async (message, notifications, postControl) => {
+	await Promise.resolve();
+	try {
+		await notifications.send(message.notification);
+		postControl({
+			type: "notification-result",
+			id: message.id,
+			ok: true
+		});
+	} catch (cause) {
+		postControl({
+			type: "notification-result",
+			id: message.id,
+			ok: false,
+			error: String(cause).slice(0, 8192)
+		});
+	}
+};
+let sequence = 0;
+const nextId = () => ++sequence;
+const asError = (cause) => cause instanceof Error ? cause : new Error(String(cause));
+const contain = (callback) => {
+	try {
+		callback();
+	} catch {}
+};
+const settleCaller = (pending, result) => {
+	if (pending.caller.status === "settled") return;
+	const { settle } = pending.caller;
+	pending.caller = { status: "settled" };
+	settle(result);
+};
+const ownSession = ({ id, options, postClose, release }) => {
+	let state = {
+		status: "opening",
+		admission: "local"
+	};
+	const detach = () => options.signal?.removeEventListener("abort", abort);
+	const close = (failure) => {
+		if (state.status === "closed" || state.status === "closing") return state.completion;
+		detach();
+		if (state.status === "opening" && state.admission === "local") {
+			state = {
+				status: "closed",
+				completion: Promise.resolve(),
+				failure
+			};
+			release();
+			return state.completion;
+		}
+		const { promise, resolve, reject } = Promise.withResolvers();
+		state = {
+			status: "closing",
+			completion: promise,
+			resolve,
+			reject,
+			failure
+		};
+		promise.catch(() => void 0);
+		postClose();
+		return promise;
+	};
+	const abort = () => {
+		close();
 	};
+	const fail = (cause) => {
+		if (state.status === "closing" || state.status === "closed") return;
+		close(cause);
+		contain(() => options.onError?.(cause));
+	};
+	const finishClose = (cause) => {
+		if (state.status !== "closing") return;
+		const closing = state;
+		state = {
+			status: "closed",
+			completion: closing.completion,
+			failure: closing.failure ?? cause
+		};
+		release();
+		cause ? closing.reject(cause) : closing.resolve();
+	};
+	const assertOpen = () => {
+		if (state.status === "opening") throw new Error("Session is still opening");
+		if (state.status === "closing" || state.status === "closed") throw state.failure ?? /* @__PURE__ */ new Error(options.action === "stream-open" ? "Stream is closed" : "Subscription is closed");
+	};
+	options.signal?.addEventListener("abort", abort, { once: true });
 	return {
-		context: {
-			getInstanceId: () => get().instanceId,
-			getDeepLinkPrefix: () => get().deepLinkPrefix
+		id,
+		close: () => close(),
+		assertOpen,
+		fail,
+		finishClose,
+		getFailure: () => state.status === "closing" || state.status === "closed" ? state.failure : void 0,
+		markSent: () => {
+			if (state.status === "opening") state = {
+				status: "opening",
+				admission: "remote"
+			};
+		},
+		opened: () => {
+			if (state.status === "opening") state = { status: "open" };
+			assertOpen();
 		},
-		establish: (port) => {
-			if (identity) throw new Error("Overmux instance identity is already established");
+		deliver: (value) => {
+			if (state.status !== "opening" && state.status !== "open") return;
 			try {
-				identity = createInstanceIdentity(typeof configured === "function" ? configured({ port }) : configured);
+				options.onEvent(value);
 			} catch (cause) {
-				throw new Error("Invalid Overmux instance ID; configure instanceId with a canonical lowercase ID", { cause });
+				fail(asError(cause));
 			}
-			return identity;
+		},
+		terminate: (cause) => {
+			if (state.status === "closed") return;
+			if (state.status === "closing") {
+				finishClose(cause);
+				return;
+			}
+			detach();
+			state = {
+				status: "closed",
+				completion: Promise.resolve(),
+				failure: cause
+			};
+			release();
+			contain(() => options.onError?.(cause));
 		}
 	};
 };
-//#endregion
-//#region src/internal/server/runtime/runtime-lifecycle.ts
-const asError = (cause) => cause instanceof Error ? cause : new Error(String(cause));
-const disposeAll = async (disposers) => {
-	const errors = (await Promise.allSettled([...disposers].map(async (dispose) => dispose()))).flatMap((result) => result.status === "rejected" ? [asError(result.reason)] : []);
-	if (errors.length) throw new AggregateError(errors, "Runtime disposal failed");
-};
-const createRuntimeLifecycle = (preparationSignal) => {
-	const controller = new AbortController();
-	const activeDisposers = /* @__PURE__ */ new Set();
-	let disposal;
-	const abortPreparation = () => controller.abort(preparationSignal?.reason);
-	preparationSignal?.addEventListener("abort", abortPreparation, { once: true });
-	if (preparationSignal?.aborted) abortPreparation();
-	const completePreparation = () => {
-		preparationSignal?.removeEventListener("abort", abortPreparation);
-	};
-	const requestSignal = (signal) => signal ? AbortSignal.any([controller.signal, signal]) : controller.signal;
-	const track = (dispose, signal) => {
-		let pending;
-		const disposeOnce = () => {
-			if (pending) return pending;
-			controller.signal.removeEventListener("abort", onAbort);
-			signal?.removeEventListener("abort", onAbort);
-			activeDisposers.delete(disposeOnce);
-			pending = Promise.resolve().then(dispose);
-			return pending;
-		};
-		const onAbort = () => {
-			disposeOnce().catch(() => void 0);
+const createWorkerConnection = (options) => {
+	const worker = new Worker(new URL(import.meta.resolve("#worker-entry")));
+	const startup = Promise.withResolvers();
+	const pending = /* @__PURE__ */ new Map();
+	const sessions = /* @__PURE__ */ new Map();
+	let pendingBytes = 0;
+	let state = {
+		status: "starting",
+		timer: setTimeout(() => {
+			terminate(/* @__PURE__ */ new Error(`Worker ${options.name} startup deadline exceeded`));
+		}, options.startupMs)
+	};
+	const terminate = (cause) => {
+		if (state.status === "stopped") return state.completion;
+		const previous = state;
+		if (previous.status === "starting" || previous.status === "stopping") clearTimeout(previous.timer);
+		const completion = worker.terminate().then(() => void 0);
+		state = {
+			status: "stopped",
+			cause,
+			completion
 		};
-		activeDisposers.add(disposeOnce);
-		controller.signal.addEventListener("abort", onAbort, { once: true });
-		signal?.addEventListener("abort", onAbort, { once: true });
-		if (controller.signal.aborted || signal?.aborted) onAbort();
-		return disposeOnce;
-	};
-	const dispose = (reason = /* @__PURE__ */ new Error("Runtime disposed")) => {
-		if (disposal) return disposal;
-		completePreparation();
-		const pending = [...activeDisposers];
-		activeDisposers.clear();
-		controller.abort(reason);
-		disposal = disposeAll(pending);
-		return disposal;
+		if (previous.status === "starting") startup.reject(cause);
+		if (previous.status === "stopping") completion.then(previous.finish, previous.finish);
+		pending.forEach((request) => settleCaller(request, {
+			ok: false,
+			error: cause
+		}));
+		pending.clear();
+		pendingBytes = 0;
+		sessions.forEach((session) => session.terminate(cause));
+		return completion;
 	};
-	return {
-		completePreparation,
-		dispose,
-		disposeAll,
-		requestSignal,
-		signal: controller.signal,
-		track
+	const postControl = (message) => {
+		if (state.status === "stopped") return;
+		try {
+			postWorkerMessage(worker, encodeWorkerMessage(message));
+		} catch (cause) {
+			terminate(asError(cause));
+		}
 	};
-};
-//#endregion
-//#region src/internal/server/runtime/resource-dependency-graph.ts
-const emptyGraphFor = (resourceIds) => new Map(resourceIds.map((resourceId) => [resourceId, /* @__PURE__ */ new Set()]));
-const visitDependencies = ({ dependencies, path, resourceId, visited, visiting }) => {
-	if (visiting.has(resourceId)) throw new Error(`Resource dependency cycle: ${[...path, resourceId].join(" -> ")}`);
-	if (visited.has(resourceId)) return;
-	visiting.add(resourceId);
-	dependencies.get(resourceId)?.forEach((dependencyId) => {
-		visitDependencies({
-			dependencies,
-			path: [...path, resourceId],
-			resourceId: dependencyId,
-			visited,
-			visiting
+	const requireReady = () => {
+		if (state.status === "stopping" || state.status === "stopped") throw state.cause;
+		if (state.status !== "ready") throw new Error(`Worker ${options.name} is not ready`);
+	};
+	const request = async (message, signal, onSent) => {
+		signal?.throwIfAborted();
+		requireReady();
+		const id = nextId();
+		const packet = encodeWorkerMessage({
+			...message,
+			id
 		});
-	});
-	visiting.delete(resourceId);
-	visited.add(resourceId);
-};
-const assertAcyclic = (dependencies) => {
-	const visited = /* @__PURE__ */ new Set();
-	const visiting = /* @__PURE__ */ new Set();
-	dependencies.forEach((_, resourceId) => {
-		visitDependencies({
-			dependencies,
-			path: [],
-			resourceId,
-			visited,
-			visiting
+		signal?.throwIfAborted();
+		const bytes = packet.byteLength;
+		if (pending.size >= workerLimits.pendingRequests || pendingBytes + bytes > workerLimits.pendingBytes) throw new Error(`Worker ${options.name} request queue is full or payload exceeds 1 MiB`);
+		return new Promise((resolve, reject) => {
+			const abort = () => {
+				settleCaller(owned, {
+					ok: false,
+					error: signal?.reason
+				});
+				postControl({
+					type: "cancel",
+					requestId: id
+				});
+			};
+			const owned = {
+				bytes,
+				caller: {
+					status: "waiting",
+					settle: (result) => {
+						signal?.removeEventListener("abort", abort);
+						result.ok ? resolve(result.value) : reject(result.error);
+					}
+				}
+			};
+			pending.set(id, owned);
+			pendingBytes += bytes;
+			signal?.addEventListener("abort", abort, { once: true });
+			try {
+				postWorkerMessage(worker, packet);
+				onSent?.();
+			} catch (cause) {
+				pending.delete(id);
+				pendingBytes -= bytes;
+				settleCaller(owned, {
+					ok: false,
+					error: cause
+				});
+			}
 		});
-	});
-};
-const createResourceDependencyGraph = (resources) => {
-	const resourceIds = Object.keys(resources);
-	if (resourceIds.some((resourceId) => !resourceId)) throw new Error("Resource IDs must not be empty");
-	const dependencies = emptyGraphFor(resourceIds);
-	const dependants = emptyGraphFor(resourceIds);
-	Object.entries(resources).forEach(([resourceId, resource]) => {
-		if (resource.kind !== "derived") return;
-		Object.entries(resource.dependencies).forEach(([dependencyName, dependencyId]) => {
-			if (!dependencyName) throw new Error(`Resource ${resourceId} has an empty dependency name`);
-			if (!dependencyId) throw new Error(`Resource ${resourceId} has an empty dependency ID`);
-			if (!dependencies.has(dependencyId)) throw new Error(`Unknown resource dependency: ${dependencyId}`);
-			dependencies.get(resourceId)?.add(dependencyId);
-			dependants.get(dependencyId)?.add(resourceId);
+	};
+	const openSession = async (sessionOptions) => {
+		sessionOptions.signal?.throwIfAborted();
+		requireReady();
+		if (sessions.size >= workerLimits.lifetimes) throw new Error("Worker lifetime limit reached");
+		const id = nextId();
+		const session = ownSession({
+			id,
+			options: sessionOptions,
+			postClose: () => postControl({
+				type: "close",
+				sessionId: id
+			}),
+			release: () => sessions.delete(id)
 		});
-	});
-	assertAcyclic(dependencies);
-	return Object.freeze({
-		dependencies,
-		dependants
-	});
-};
-const collectInvalidatedResourceIds = (graph, resourceId, invalidated) => {
-	if (invalidated.has(resourceId)) return;
-	invalidated.add(resourceId);
-	graph.dependants.get(resourceId)?.forEach((dependantId) => {
-		collectInvalidatedResourceIds(graph, dependantId, invalidated);
-	});
-};
-const getInvalidatedResourceIds = (graph, resourceId) => {
-	const invalidated = /* @__PURE__ */ new Set();
-	collectInvalidatedResourceIds(graph, resourceId, invalidated);
-	return invalidated;
-};
-//#endregion
-//#region src/internal/server/runtime/runtime-resources.ts
-const createSubscriptionLifetime = ({ entry, invalidationListeners, lifecycle, signal }) => {
-	const controller = new AbortController();
-	const subscriptionSignal = AbortSignal.any([lifecycle.requestSignal(signal), controller.signal]);
-	subscriptionSignal.throwIfAborted();
-	const registeredEntry = {
-		...entry,
-		listener: () => {
-			if (!subscriptionSignal.aborted) entry.listener();
+		sessions.set(id, session);
+		const { action, name, input, signal, correlation } = sessionOptions;
+		try {
+			await request({
+				action,
+				name,
+				input,
+				correlation,
+				sessionId: id
+			}, signal, session.markSent);
+			signal?.throwIfAborted();
+			session.opened();
+			return session;
+		} catch (cause) {
+			const failure = session.getFailure();
+			session.close();
+			throw failure ?? cause;
 		}
 	};
-	const disposers = [];
-	const release = lifecycle.track(async () => {
-		invalidationListeners.delete(registeredEntry);
-		await lifecycle.disposeAll(disposers);
-	}, subscriptionSignal);
-	const dispose = () => {
-		controller.abort(/* @__PURE__ */ new Error("Resource subscription closed"));
-		return release();
+	const handleReady = (message) => {
+		if (state.status !== "starting") throw new Error("Unexpected worker ready message");
+		clearTimeout(state.timer);
+		state = { status: "ready" };
+		startup.resolve(message);
+	};
+	const handleRequestReply = (message) => {
+		const result = message.ok ? {
+			ok: true,
+			value: message.value
+		} : {
+			ok: false,
+			error: deserializeWorkerError(message.error)
+		};
+		const owned = pending.get(message.id);
+		if (!owned) return;
+		pending.delete(message.id);
+		pendingBytes -= owned.bytes;
+		settleCaller(owned, result);
 	};
-	invalidationListeners.add(registeredEntry);
-	return {
-		dispose,
-		disposers,
-		refresh: registeredEntry.listener,
-		signal: subscriptionSignal
-	};
-};
-const createRuntimeResources = ({ definitions, instance, lifecycle }) => {
-	const graph = createResourceDependencyGraph(definitions);
-	const invalidationListeners = /* @__PURE__ */ new Set();
-	const resources = /* @__PURE__ */ new Map();
-	const invalidateResource = (id, input, allInputs = false) => {
-		if (lifecycle.signal.aborted) return;
-		const ids = getInvalidatedResourceIds(graph, id);
-		invalidationListeners.forEach((entry) => {
-			if (ids.has(entry.resourceId) && (allInputs || isDeepStrictEqual(entry.input, input))) entry.listener();
-		});
+	const handleDelivery = (message) => {
+		try {
+			if (message.type === "reply") handleRequestReply(message);
+			if (message.type === "closed") {
+				const error = message.error === void 0 ? void 0 : deserializeWorkerError(message.error);
+				sessions.get(message.sessionId)?.finishClose(error);
+			}
+			if (message.type === "invalidate") sessions.get(message.sessionId)?.deliver(void 0);
+			if (message.type === "stream-output") sessions.get(message.sessionId)?.deliver(message.message);
+			if (message.type === "stream-error") {
+				const error = deserializeWorkerError(message.error);
+				sessions.get(message.sessionId)?.fail(error);
+			}
+			if (message.type === "log") contain(() => {
+				const entry = JSON.parse(message.entry);
+				options.serverLogger?.log({
+					...entry,
+					details: {
+						...entry.details,
+						worker: options.name
+					}
+				});
+			});
+			if (message.type === "notification") deliverNotification(message, options.notifications, postControl);
+		} finally {
+			postControl({
+				type: "ack",
+				deliveryId: message.deliveryId
+			});
+		}
 	};
-	const invalidate = (resourceId, input) => {
-		if (!resources.has(resourceId)) throw new Error(`Unknown resource ID: ${resourceId}`);
-		const definition = definitions[resourceId];
-		const parsedInput = input === void 0 ? void 0 : definition.contract.input.parse(input);
-		invalidateResource(resourceId, parsedInput, input === void 0);
+	const receive = (packet) => {
+		if (state.status === "stopped") return;
+		try {
+			const message = decodeWorkerMessage(packet);
+			if (message.type === "ready") handleReady(message);
+			else if (message.type === "fatal") terminate(deserializeWorkerError(message.error));
+			else if (message.type === "disposed") {
+				if (state.status !== "stopping") throw new Error("Unexpected worker disposed message");
+				terminate(state.cause);
+			} else handleDelivery(message);
+		} catch (cause) {
+			terminate(asError(cause));
+		}
 	};
-	const context = (signal) => ({
-		instance,
-		invalidate,
-		signal: lifecycle.requestSignal(signal)
+	const stop = () => {
+		if (state.status === "stopped" || state.status === "stopping") return state.completion;
+		const cause = /* @__PURE__ */ new Error("Worker runtime disposed");
+		if (state.status === "starting") return terminate(cause);
+		const { promise, resolve } = Promise.withResolvers();
+		state = {
+			status: "stopping",
+			cause,
+			completion: promise,
+			finish: resolve,
+			timer: setTimeout(() => {
+				terminate(cause);
+			}, options.shutdownMs)
+		};
+		pending.forEach((owned) => settleCaller(owned, {
+			ok: false,
+			error: cause
+		}));
+		sessions.forEach((session) => session.fail(cause));
+		postControl({ type: "shutdown" });
+		return promise;
+	};
+	worker.on("message", receive);
+	worker.on("error", (cause) => {
+		terminate(cause);
 	});
-	const read = async (id, rawInput, signal) => {
-		const definition = definitions[id];
-		const operationSignal = lifecycle.requestSignal(signal);
-		operationSignal.throwIfAborted();
-		const input = definition.contract.input.parse(rawInput);
-		const rawOutput = definition.kind === "derived" ? definition.combine(Object.fromEntries(await Promise.all(Object.entries(definition.dependencies).map(async ([name, dependencyId]) => [name, await read(dependencyId, rawInput, signal)])))) : await definition.read(input, context(signal));
-		operationSignal.throwIfAborted();
-		return definition.contract.output.parse(rawOutput);
-	};
-	const activateSubscriptions = async (id, rawInput, signal, activated, disposers) => {
-		signal.throwIfAborted();
-		if (activated.has(id)) return;
-		activated.add(id);
-		const definition = definitions[id];
-		const input = definition.contract.input.parse(rawInput);
-		if (definition.kind === "subscription") {
-			const dispose = await definition.subscribe(input, () => {
-				if (!signal.aborted) invalidateResource(id, input);
-			}, context(signal));
-			if (typeof dispose !== "function") throw new Error(`Resource ${id} subscribe must return a disposer`);
-			if (signal.aborted) {
-				await dispose();
-				signal.throwIfAborted();
-			}
-			disposers.push(dispose);
-			return;
-		}
-		if (definition.kind === "derived") for (const dependencyId of graph.dependencies.get(id) ?? []) await activateSubscriptions(dependencyId, rawInput, signal, activated, disposers);
-	};
-	Object.keys(definitions).forEach((name) => {
-		resources.set(name, {
-			read: (input, signal) => read(name, input, signal),
-			subscribe: async (rawInput, listener, signal) => {
-				lifecycle.requestSignal(signal).throwIfAborted();
-				const input = definitions[name].contract.input.parse(rawInput);
-				const subscription = createSubscriptionLifetime({
-					entry: {
-						input,
-						listener,
-						resourceId: name
-					},
-					invalidationListeners,
-					lifecycle,
-					signal
-				});
-				try {
-					await activateSubscriptions(name, rawInput, subscription.signal, /* @__PURE__ */ new Set(), subscription.disposers);
-					subscription.signal.throwIfAborted();
-					subscription.refresh();
-					subscription.signal.throwIfAborted();
-					return subscription.dispose;
-				} catch (cause) {
-					try {
-						await subscription.dispose();
-					} catch (cleanupError) {
-						throw new AggregateError([cause, cleanupError], "Resource subscription setup and cleanup failed");
-					}
-					throw cause;
-				}
-			}
-		});
+	worker.on("exit", (code) => {
+		const phase = state.status === "starting" ? " during startup" : "";
+		terminate(/* @__PURE__ */ new Error(`Worker ${options.name} exited${phase} (${code})`));
 	});
+	postControl(options.init);
 	return {
-		context,
-		get: (name) => resources.get(name),
-		invalidate,
-		names: [...resources.keys()]
+		ready: startup.promise,
+		request,
+		openSession,
+		stop,
+		terminate
 	};
 };
 //#endregion
-//#region src/internal/server/runtime/runtime-streams.ts
-const createRuntimeStreams = ({ context, definitions, lifecycle }) => {
-	const streams = /* @__PURE__ */ new Map();
-	Object.entries(definitions).forEach(([name, definition]) => {
-		if (!name) throw new Error("Stream names must not be empty");
-		streams.set(name, { open: async (rawInput, emit, requestSignal, onError) => {
-			const sessionController = new AbortController();
-			const sessionSignal = requestSignal ? AbortSignal.any([requestSignal, sessionController.signal]) : sessionController.signal;
-			const operationSignal = lifecycle.requestSignal(sessionSignal);
-			operationSignal.throwIfAborted();
-			const input = definition.contract.input.parse(rawInput);
-			let acceptingMessages = true;
-			let failed = false;
-			let failure;
-			let opened = false;
-			const fail = (cause) => {
-				if (failed || operationSignal.aborted) return;
-				failed = true;
-				failure = cause;
-				acceptingMessages = false;
-				sessionController.abort(cause);
-				if (opened) onError?.(cause);
-			};
-			const session = await definition.open(input, {
-				...context(sessionSignal),
-				emit: (message) => {
-					if (operationSignal.aborted) return;
-					try {
-						emit(definition.contract.serverMessage.parse(message));
-					} catch (cause) {
-						fail(cause);
-					}
-				},
-				fail,
-				signal: operationSignal
-			});
-			opened = true;
-			if (failed || operationSignal.aborted) {
-				await session.dispose?.();
-				operationSignal.throwIfAborted();
-				throw failure;
-			}
-			let messages = Promise.resolve();
-			const dispose = lifecycle.track(async () => {
-				acceptingMessages = false;
-				sessionController.abort(/* @__PURE__ */ new Error("Stream session disposed"));
-				await messages.catch(() => void 0);
-				await session.dispose?.();
-			}, requestSignal);
-			return {
-				dispose: async () => dispose(),
-				send: async (rawMessage) => {
-					if (!acceptingMessages) throw new Error("Stream session is closed");
-					const message = definition.contract.clientMessage.parse(rawMessage);
-					messages = messages.then(async () => {
-						operationSignal.throwIfAborted();
-						await session.onMessage?.(message);
-						operationSignal.throwIfAborted();
-					});
-					return messages;
-				}
-			};
-		} });
+//#region src/internal/server/runtime/worker-capabilities.ts
+const createWorkerResource = (connection, name) => ({
+	read: (input, signal, correlation) => connection.request({
+		action: "resource-read",
+		input,
+		name,
+		correlation
+	}, signal),
+	subscribe: async (input, listener, signal, onError, correlation) => {
+		return (await connection.openSession({
+			action: "resource-subscribe",
+			name,
+			input,
+			signal,
+			onEvent: listener,
+			onError,
+			correlation
+		})).close;
+	}
+});
+const createWorkerOperation = (connection, name, returnsVoid) => ({
+	execute: (input, signal, correlation) => connection.request({
+		action: "operation",
+		input,
+		name,
+		correlation
+	}, signal),
+	returnsVoid
+});
+const createWorkerStream = (connection, name) => ({ open: async (input, emit, signal, onError, correlation) => {
+	const session = await connection.openSession({
+		action: "stream-open",
+		name,
+		input,
+		signal,
+		onEvent: emit,
+		onError,
+		correlation
 	});
 	return {
-		get: (name) => streams.get(name),
-		names: [...streams.keys()]
+		dispose: session.close,
+		send: async (message) => {
+			session.assertOpen();
+			await connection.request({
+				action: "stream-message",
+				message,
+				sessionId: session.id
+			}, signal);
+		}
 	};
-};
+} });
 //#endregion
-//#region src/internal/server/runtime/create-runtime.ts
-const createRuntime = async ({ config, debug = true, notifications = { send: async () => void 0 }, signal }) => {
-	const lifecycle = createRuntimeLifecycle(signal);
-	const instance = createRuntimeInstance(config.instanceId ?? defaultInstanceId);
+//#region src/internal/server/runtime/worker-runtime.ts
+const silentNotifications = { send: async () => void 0 };
+const resolveOptions = (options) => ({
+	...options,
+	notifications: options.notifications ?? silentNotifications,
+	aliases: options.aliases ?? {},
+	startupMs: options.startupMs ?? workerLimits.startupMs,
+	shutdownMs: options.shutdownMs ?? workerLimits.shutdownMs
+});
+const launchWorker = (selection, options, workers) => {
+	const connection = createWorkerConnection({
+		name: selection.name,
+		init: {
+			type: "init",
+			configPath: options.configPath,
+			aliases: options.aliases,
+			logLevel: options.serverLogger?.logLevel,
+			role: selection.role,
+			stream: selection.stream
+		},
+		notifications: options.notifications,
+		serverLogger: options.serverLogger,
+		startupMs: options.startupMs,
+		shutdownMs: options.shutdownMs
+	});
+	workers.push(connection);
+	return connection;
+};
+const loadWorkerConfig = async (options) => {
+	const workers = [];
 	try {
-		const resources = createRuntimeResources({
-			definitions: config.server.resources ?? {},
-			instance: instance.context,
-			lifecycle
-		});
-		const context = resources.context;
-		const operations = createRuntimeOperations({
-			context,
-			definitions: config.server.operations ?? {},
-			notifications
-		});
-		const streams = createRuntimeStreams({
-			context,
-			definitions: config.server.streams ?? {},
-			lifecycle
-		});
-		lifecycle.signal.throwIfAborted();
-		lifecycle.completePreparation();
-		const manifest = {
-			debug,
-			operations: [...operations.names],
-			protocolVersion: 10,
-			resources: [...resources.names],
-			streams: [...streams.names]
-		};
+		return { config: (await launchWorker({
+			role: "metadata",
+			name: "config"
+		}, resolveOptions(options), workers).ready).settings };
+	} finally {
+		await Promise.all(workers.map((worker) => worker.terminate(/* @__PURE__ */ new Error("Config inspection finished"))));
+	}
+};
+const startStreams = async (ready, options, workers) => {
+	const streams = /* @__PURE__ */ new Map();
+	const names = ready.manifest.streams;
+	for (let offset = 0; offset < names.length; offset += 4) await Promise.all(names.slice(offset, offset + 4).map(async (name) => {
+		const owner = launchWorker({
+			role: "stream",
+			stream: name,
+			name: `stream:${name}`
+		}, options, workers);
+		const streamReady = await owner.ready;
+		if (JSON.stringify(streamReady.manifest) !== JSON.stringify(ready.manifest)) throw new Error("Server definitions changed between worker imports");
+		streams.set(name, owner);
+	}));
+	return streams;
+};
+const createWorkerIdentity = ({ application, streams, startupMs }) => {
+	let instance = createRuntimeInstance(defaultInstanceId);
+	return {
+		instance: {
+			getInstanceId: () => instance.context.getInstanceId(),
+			getDeepLinkPrefix: () => instance.context.getDeepLinkPrefix()
+		},
+		establishInstance: async (port) => {
+			const signal = AbortSignal.timeout(startupMs);
+			const identity = await application.request({
+				action: "initialize-instance-identity",
+				port
+			}, signal);
+			await Promise.all([...streams.values()].map((stream) => stream.request({
+				action: "initialize-instance-identity",
+				port,
+				instanceId: identity.instanceId
+			}, signal)));
+			instance = createRuntimeInstance(identity.instanceId);
+			return instance.establish(port);
+		}
+	};
+};
+const createWorkerRuntime = async (input) => {
+	const options = resolveOptions(input);
+	const workers = [];
+	let disposal;
+	try {
+		const application = launchWorker({
+			role: "application",
+			name: "resources/operations"
+		}, options, workers);
+		const ready = await application.ready;
+		const streams = await startStreams(ready, options, workers);
+		const resources = new Map(ready.manifest.resources.map((name) => [name, createWorkerResource(application, name)]));
+		const operations = new Map(ready.manifest.operations.map((name) => [name, createWorkerOperation(application, name, ready.voidOperations.includes(name))]));
 		return {
-			instance: instance.context,
-			establishInstance: instance.establish,
-			manifest,
-			dispose: lifecycle.dispose,
-			getOperation: operations.get,
-			getResource: resources.get,
-			getStream: streams.get
+			settings: ready.settings,
+			...createWorkerIdentity({
+				application,
+				streams,
+				startupMs: options.startupMs
+			}),
+			manifest: ready.manifest,
+			dispose: () => {
+				disposal = disposal ?? Promise.all(workers.map((worker) => worker.stop())).then(() => void 0);
+				return disposal;
+			},
+			getOperation: (name) => operations.get(name),
+			getResource: (name) => resources.get(name),
+			getStream: (name) => {
+				const owner = streams.get(name);
+				return owner ? createWorkerStream(owner, name) : void 0;
+			}
 		};
 	} catch (cause) {
-		await lifecycle.dispose(cause).catch(() => void 0);
+		const error = cause instanceof Error ? cause : new Error(String(cause));
+		await Promise.all(workers.map((worker) => worker.terminate(error)));
 		throw cause;
 	}
 };
 //#endregion
 //#region src/internal/server/server-startup-options.ts
 const serverStartupOverridesRuntimeSchema = serverConfigRuntimeSchema.omit({ port: true }).extend({
-	debug: z.boolean().optional(),
+	logLevel: logLevelSchema.optional(),
 	port: z.number().int().min(0).max(65535).optional()
 });
 const resolveServerStartupOptions = ({ config, configPath, overrides = {} }) => {
@@ -3051,7 +2782,7 @@ const resolveServerStartupOptions = ({ config, configPath, overrides = {} }) =>
 	const configuredWebAssetsDir = config.productionWebAssetsDir ? resolve(dirname(configPath), config.productionWebAssetsDir) : void 0;
 	const productionWebAssetsDir = validatedOverrides.productionWebAssetsDir ? resolve(validatedOverrides.productionWebAssetsDir) : configuredWebAssetsDir;
 	return {
-		debug: validatedOverrides.debug ?? config.debug ?? true,
+		logLevel: validatedOverrides.logLevel ?? config.logLevel ?? "info",
 		host: validatedOverrides.host ?? config.host ?? "localhost",
 		port: validatedOverrides.port ?? config.port ?? 4242,
 		...productionWebAssetsDir === void 0 ? {} : { productionWebAssetsDir },
@@ -3113,7 +2844,7 @@ const registerProcessErrorLogging = (logger) => {
 	};
 };
 const loadServerSettings = async ({ configPath, options }) => {
-	const { config } = await loadOvermuxConfig({
+	const { config } = await loadWorkerConfig({
 		aliases: options.configAliases,
 		configPath
 	});
@@ -3137,7 +2868,7 @@ const createAuthOrigins = ({ configuredOrigins, startup }) => {
 		get: () => values
 	};
 };
-const createApplicationServices = async ({ config, logger, resources, startup }) => {
+const createApplicationServices = async ({ aliases, config, configPath, logger, resources, startup }) => {
 	const authOrigins = createAuthOrigins({
 		configuredOrigins: config.auth.origins,
 		startup
@@ -3166,10 +2897,11 @@ const createApplicationServices = async ({ config, logger, resources, startup })
 		backgroundNotifications,
 		logger
 	});
-	const runtime = await createRuntime({
-		config,
-		debug: logger.enabled,
-		notifications
+	const runtime = await createWorkerRuntime({
+		configPath,
+		serverLogger: logger,
+		notifications,
+		aliases
 	});
 	resources.add(runtime.dispose);
 	return {
@@ -3203,7 +2935,7 @@ const startApplicationTransport = async ({ auth, authOrigins, authService, backg
 	});
 	resources.add(() => closeNodeServer(server, runtime.dispose));
 	const address = await getServerAddress(server);
-	runtime.establishInstance(address.port);
+	await runtime.establishInstance(address.port);
 	const urlHost = startup.host.includes(":") ? `[${startup.host}]` : startup.host;
 	const localUrl = `http://${urlHost}:${address.port}`;
 	const controlApiHost = startup.host === "0.0.0.0" ? "127.0.0.1" : startup.host === "::" ? "[::1]" : urlHost;
@@ -3249,25 +2981,26 @@ const failApplicationServerStartup = async (cause, resources) => {
 	throw cause;
 };
 const startApplicationServer = async ({ onRestartRequested, options }) => {
+	const configPath = resolve(options.configPath);
+	const { config, startup } = await loadServerSettings({
+		configPath,
+		options
+	});
 	const logger = createServerLogger({
-		enabled: options.debug ?? true,
+		logLevel: startup.logLevel,
 		logFile: getServerLogFile()
 	});
 	const resources = createResources();
 	resources.add(registerProcessErrorLogging(logger));
 	try {
-		const configPath = resolve(options.configPath);
 		logger.log({
 			details: { configPath },
 			event: "server-start"
 		});
-		const { config, startup } = await loadServerSettings({
-			configPath,
-			options
-		});
-		logger.setEnabled(startup.debug);
 		const { auth, authOrigins, authService, backgroundNotifications, notifications, runtime } = await createApplicationServices({
+			aliases: options.configAliases,
 			config,
+			configPath,
 			logger,
 			resources,
 			startup
@@ -3306,7 +3039,7 @@ const startApplicationServer = async ({ onRestartRequested, options }) => {
 const childOptionsSchema = z.object({
 	configAliases: z.record(z.string(), z.string()).optional(),
 	configPath: z.string(),
-	debug: z.boolean().optional(),
+	logLevel: logLevelSchema.optional(),
 	developmentWebTarget: z.url().optional(),
 	host: z.string().optional(),
 	port: z.number().int().min(0).max(65535).optional(),