rebase-git 0.0.2-nightly.20260822.35

package/dist/runtime.js

@@ -0,0 +1,2555 @@
+#!/usr/bin/env node
+
+// src/apps/server/cli.ts
+import { existsSync as existsSync2, realpathSync } from "node:fs";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+
+// src/contracts/environment-connection/environment-transport-limits.contract.ts
+import { Schema } from "effect";
+var ByteLimit = Schema.Int.check(
+  Schema.isBetween({ minimum: 1024, maximum: 67108864 })
+), QueueLength = Schema.Int.check(
+  Schema.isBetween({ minimum: 1, maximum: 4096 })
+), TimeoutMilliseconds = Schema.Int.check(
+  Schema.isBetween({ minimum: 100, maximum: 6e4 })
+), TransportLimits = Schema.Struct({
+  maxHttpRequestBytes: ByteLimit,
+  maxHttpResponseBytes: ByteLimit,
+  maxWebSocketRequestBytes: ByteLimit,
+  maxWebSocketResponseBytes: ByteLimit,
+  maxQueuedEvents: QueueLength,
+  maxQueuedEventBytes: ByteLimit,
+  maxCapturedOutputBytes: ByteLimit,
+  helloTimeoutMilliseconds: TimeoutMilliseconds
+}), ClientReceiveLimits = Schema.Struct({
+  maxCapturedOutputBytes: ByteLimit,
+  maxHttpResponseBytes: ByteLimit,
+  maxWebSocketResponseBytes: ByteLimit
+}), currentTransportLimits = {
+  helloTimeoutMilliseconds: 5e3,
+  maxCapturedOutputBytes: 1048576,
+  maxHttpRequestBytes: 65536,
+  maxHttpResponseBytes: 65536,
+  maxQueuedEventBytes: 262144,
+  maxQueuedEvents: 128,
+  maxWebSocketRequestBytes: 16384,
+  maxWebSocketResponseBytes: 16384
+}, currentClientReceiveLimits = {
+  maxCapturedOutputBytes: currentTransportLimits.maxCapturedOutputBytes,
+  maxHttpResponseBytes: currentTransportLimits.maxHttpResponseBytes,
+  maxWebSocketResponseBytes: currentTransportLimits.maxWebSocketResponseBytes
+};
+
+// src/contracts/environment-connection/negotiation/environment-protocol.contract.ts
+import { Schema as Schema2 } from "effect";
+var ProtocolNumber = Schema2.Natural.check(Schema2.isLessThanOrEqualTo(65535)), CapabilityName = Schema2.String.check(
+  Schema2.isMinLength(1),
+  Schema2.isMaxLength(64)
+), ProductVersion = Schema2.String.check(
+  Schema2.isMinLength(1),
+  Schema2.isMaxLength(64)
+), ProtocolRange = Schema2.Struct({
+  major: ProtocolNumber,
+  minor: ProtocolNumber,
+  minimumSupportedMinor: ProtocolNumber
+}).check(
+  Schema2.makeFilter(
+    (range) => range.minimumSupportedMinor <= range.minor || "minimumSupportedMinor must not exceed minor"
+  )
+), EnvironmentCapability = Schema2.Struct({
+  name: CapabilityName,
+  version: Schema2.Int.check(
+    Schema2.isGreaterThan(0),
+    Schema2.isLessThanOrEqualTo(65535)
+  ),
+  introducedInMinor: ProtocolNumber
+}), EnvironmentCapabilities = Schema2.Array(
+  EnvironmentCapability
+).check(
+  Schema2.isMaxLength(32),
+  Schema2.makeFilter((capabilities) => new Set(capabilities.map((capability) => capability.name)).size === capabilities.length || "capability names must be unique")
+), ProductVersionSchema = ProductVersion, currentEnvironmentProtocol = {
+  major: 1,
+  minor: 2,
+  minimumSupportedMinor: 0
+}, currentEnvironmentCapabilities = [
+  {
+    introducedInMinor: 0,
+    name: "environment-events",
+    version: 1
+  },
+  {
+    introducedInMinor: 1,
+    name: "sequence-resnapshot",
+    version: 1
+  }
+];
+
+// src/contracts/environment-connection/websocket/environment-live-connection.contract.ts
+import { Schema as Schema3 } from "effect";
+var EnvironmentHello = Schema3.TaggedStruct("Hello", {
+  productVersion: ProductVersionSchema,
+  protocol: ProtocolRange,
+  capabilities: EnvironmentCapabilities,
+  receiveLimits: ClientReceiveLimits,
+  lastObservedSequence: Schema3.optionalKey(Schema3.Natural)
+}), SnapshotApplied = Schema3.TaggedStruct("SnapshotApplied", {
+  sequence: Schema3.Natural
+}), EnvironmentClientMessage = Schema3.Union([
+  EnvironmentHello,
+  SnapshotApplied
+]), ProtocolMajorMismatch = Schema3.TaggedStruct("ProtocolMajorMismatch", {
+  clientMajor: Schema3.Natural,
+  serverMajor: Schema3.Natural,
+  requiredUpdate: Schema3.Literals(["client", "server"])
+}), ProtocolMinorMismatch = Schema3.TaggedStruct("ProtocolMinorMismatch", {
+  clientMinor: Schema3.Natural,
+  clientMinimumSupportedMinor: Schema3.Natural,
+  serverMinor: Schema3.Natural,
+  serverMinimumSupportedMinor: Schema3.Natural
+}), InvalidMessage = Schema3.TaggedStruct("InvalidMessage", {}), PayloadTooLarge = Schema3.TaggedStruct("PayloadTooLarge", {
+  limitBytes: Schema3.Natural
+}), HandshakeRequired = Schema3.TaggedStruct("HandshakeRequired", {}), HandshakeAlreadyCompleted = Schema3.TaggedStruct(
+  "HandshakeAlreadyCompleted",
+  {}
+), EnvironmentTransportFailure = Schema3.Union([
+  ProtocolMajorMismatch,
+  ProtocolMinorMismatch,
+  InvalidMessage,
+  PayloadTooLarge,
+  HandshakeRequired,
+  HandshakeAlreadyCompleted
+]), HelloAccepted = Schema3.TaggedStruct("HelloAccepted", {
+  environmentId: Schema3.String.check(Schema3.isUUID(4)),
+  protocol: Schema3.Struct({
+    major: Schema3.Natural,
+    minor: Schema3.Natural
+  }),
+  capabilities: EnvironmentCapabilities,
+  limits: TransportLimits,
+  currentSequence: Schema3.Natural
+}), HelloRejected = Schema3.TaggedStruct("HelloRejected", {
+  failure: EnvironmentTransportFailure
+}), EnvironmentChanged = Schema3.TaggedStruct("EnvironmentChanged", {
+  sequence: Schema3.Natural
+}), ResnapshotRequired = Schema3.TaggedStruct("ResnapshotRequired", {
+  currentSequence: Schema3.Natural,
+  reason: Schema3.Literals(["SequenceGap", "OutgoingQueueOverflow"])
+}), EnvironmentHelloResult = Schema3.Union([
+  HelloAccepted,
+  HelloRejected
+]), EnvironmentServerMessage = Schema3.Union([
+  HelloAccepted,
+  HelloRejected,
+  EnvironmentChanged,
+  ResnapshotRequired
+]);
+
+// src/contracts/environment-authorization/environment-authorization.contract.ts
+import { Schema as Schema4 } from "effect";
+var environmentAuthorizationRoles = [
+  "viewer",
+  "contributor",
+  "maintainer",
+  "owner",
+  "custom"
+], environmentAccessCapabilities = [
+  "environment.read",
+  "repository.read",
+  "repository.write",
+  "history.rewrite",
+  "worktree.manage",
+  "authorization.manage",
+  "environment.manage"
+], EnvironmentAuthorizationRole = Schema4.Literals(
+  environmentAuthorizationRoles
+), EnvironmentAccessCapability = Schema4.Literals(
+  environmentAccessCapabilities
+), AuthorizationId = Schema4.String.check(Schema4.isUUID(4)), SecretMaterial = Schema4.String.check(
+  Schema4.isMinLength(32),
+  Schema4.isMaxLength(512)
+), PairingCode = Schema4.String.check(Schema4.isPattern(/^\d{3}-\d{3}$/)), DeviceLabel = Schema4.String.check(
+  Schema4.isMinLength(1),
+  Schema4.isMaxLength(128)
+), IsoDate = Schema4.String, CreateEnvironmentPairing = Schema4.Struct({
+  role: EnvironmentAuthorizationRole,
+  capabilities: Schema4.Array(EnvironmentAccessCapability).check(
+    Schema4.isMaxLength(environmentAccessCapabilities.length)
+  )
+}), EnvironmentPairingCreated = Schema4.Struct({
+  pairingUrl: Schema4.String,
+  expiresAt: IsoDate
+}), ExchangeEnvironmentPairing = Schema4.Struct({
+  pairingMaterial: PairingCode,
+  label: DeviceLabel
+}), EnvironmentDeviceAuthorization = Schema4.Struct({
+  id: AuthorizationId,
+  label: DeviceLabel,
+  role: EnvironmentAuthorizationRole,
+  capabilities: Schema4.Array(EnvironmentAccessCapability)
+}), EnvironmentPairingExchanged = Schema4.Struct({
+  authorization: EnvironmentDeviceAuthorization,
+  credential: SecretMaterial
+}), EnvironmentWebSocketTicket = Schema4.Struct({
+  expiresAt: IsoDate,
+  ticket: SecretMaterial
+}), RevokeEnvironmentAuthorization = Schema4.Struct({
+  authorizationId: AuthorizationId
+}), EnvironmentAuthorizationRevoked = Schema4.Struct({
+  authorizationId: AuthorizationId,
+  revokedAt: IsoDate
+}), InvalidHost = Schema4.TaggedStruct("InvalidHost", {}), InvalidOrigin = Schema4.TaggedStruct("InvalidOrigin", {}), InvalidGrant = Schema4.TaggedStruct("InvalidGrant", {}), ExpiredGrant = Schema4.TaggedStruct("ExpiredGrant", {}), RevokedGrant = Schema4.TaggedStruct("RevokedGrant", {}), CapabilityDenied = Schema4.TaggedStruct("CapabilityDenied", {
+  capability: EnvironmentAccessCapability
+}), InvalidPairing = Schema4.TaggedStruct("InvalidPairing", {}), ExpiredPairing = Schema4.TaggedStruct("ExpiredPairing", {}), PairingAlreadyUsed = Schema4.TaggedStruct("PairingAlreadyUsed", {}), InvalidTicket = Schema4.TaggedStruct("InvalidTicket", {}), ExpiredTicket = Schema4.TaggedStruct("ExpiredTicket", {}), TicketAlreadyUsed = Schema4.TaggedStruct("TicketAlreadyUsed", {}), EnvironmentAuthorizationFailure = Schema4.Union([
+  InvalidHost,
+  InvalidOrigin,
+  InvalidGrant,
+  ExpiredGrant,
+  RevokedGrant,
+  CapabilityDenied,
+  InvalidPairing,
+  ExpiredPairing,
+  PairingAlreadyUsed,
+  InvalidTicket,
+  ExpiredTicket,
+  TicketAlreadyUsed
+]), EnvironmentGrantHttpFailure = Schema4.Union([
+  InvalidHost,
+  InvalidOrigin,
+  InvalidGrant,
+  ExpiredGrant,
+  RevokedGrant,
+  CapabilityDenied,
+  InvalidMessage,
+  PayloadTooLarge
+]), EnvironmentPairingExchangeHttpFailure = Schema4.Union([
+  InvalidHost,
+  InvalidOrigin,
+  InvalidPairing,
+  ExpiredPairing,
+  PairingAlreadyUsed,
+  InvalidMessage,
+  PayloadTooLarge
+]), EnvironmentAuthorizationHttpFailure = Schema4.Union([
+  EnvironmentGrantHttpFailure,
+  EnvironmentPairingExchangeHttpFailure
+]), environmentPairingExchangePath = "/api/authorization/pairings/exchange", environmentPairingsPath = "/api/authorization/pairings", environmentWebSocketTicketsPath = "/api/authorization/websocket-tickets", environmentAuthorizationRevocationPath = "/api/authorization/revocations", EnvironmentAuthorizationHttpApi = {
+  createPairing: {
+    failure: EnvironmentGrantHttpFailure,
+    failureStatuses: [400, 401, 403, 410, 413],
+    method: "POST",
+    path: environmentPairingsPath,
+    request: CreateEnvironmentPairing,
+    success: EnvironmentPairingCreated,
+    successStatus: 201
+  },
+  exchangePairing: {
+    failure: EnvironmentPairingExchangeHttpFailure,
+    failureStatuses: [400, 401, 403, 409, 410, 413],
+    method: "POST",
+    path: environmentPairingExchangePath,
+    request: ExchangeEnvironmentPairing,
+    success: EnvironmentPairingExchanged,
+    successStatus: 201
+  },
+  mintWebSocketTicket: {
+    failure: EnvironmentGrantHttpFailure,
+    failureStatuses: [400, 401, 403, 410, 413],
+    method: "POST",
+    path: environmentWebSocketTicketsPath,
+    success: EnvironmentWebSocketTicket,
+    successStatus: 201
+  },
+  revokeAuthorization: {
+    failure: EnvironmentGrantHttpFailure,
+    failureStatuses: [400, 401, 403, 410, 413],
+    method: "POST",
+    path: environmentAuthorizationRevocationPath,
+    request: RevokeEnvironmentAuthorization,
+    success: EnvironmentAuthorizationRevoked,
+    successStatus: 200
+  }
+};
+
+// src/contracts/environment-connection/http/environment-discovery.contract.ts
+import { Schema as Schema5 } from "effect";
+var environmentDiscoveryPath = "/api/discovery", environmentSnapshotPath = "/api/environment/snapshot", environmentLivePath = "/api/environment/live", EnvironmentDiscovery = Schema5.Struct({
+  environmentId: Schema5.String.check(Schema5.isUUID(4)),
+  productVersion: ProductVersionSchema,
+  protocol: ProtocolRange,
+  capabilities: EnvironmentCapabilities,
+  limits: TransportLimits,
+  routes: Schema5.Struct({
+    snapshot: Schema5.Literal(environmentSnapshotPath),
+    live: Schema5.Literal(environmentLivePath)
+  })
+}), EnvironmentSnapshot = Schema5.Struct({
+  environmentId: Schema5.String.check(Schema5.isUUID(4)),
+  sequence: Schema5.Natural
+}), EnvironmentHttpFailure = Schema5.Union([
+  InvalidMessage,
+  PayloadTooLarge
+]), EnvironmentDiscoveryHttpFailure = Schema5.Union([
+  EnvironmentHttpFailure,
+  InvalidHost
+]), EnvironmentHttpApi = {
+  discovery: {
+    failure: EnvironmentDiscoveryHttpFailure,
+    failureStatuses: [400, 403, 413],
+    method: "GET",
+    path: environmentDiscoveryPath,
+    success: EnvironmentDiscovery,
+    successStatus: 200
+  },
+  snapshot: {
+    failure: EnvironmentGrantHttpFailure,
+    failureStatuses: [400, 401, 403, 410, 413],
+    method: "GET",
+    path: environmentSnapshotPath,
+    success: EnvironmentSnapshot,
+    successStatus: 200
+  }
+};
+function createCurrentEnvironmentDiscovery(environmentId, productVersion2) {
+  return {
+    capabilities: currentEnvironmentCapabilities,
+    environmentId,
+    limits: currentTransportLimits,
+    productVersion: productVersion2,
+    protocol: currentEnvironmentProtocol,
+    routes: {
+      live: environmentLivePath,
+      snapshot: environmentSnapshotPath
+    }
+  };
+}
+
+// src/contracts/environment-connection/negotiation/negotiate-environment-protocol.ts
+function negotiateEnvironmentHello(discovery, hello, currentSequence) {
+  if (hello.protocol.major !== discovery.protocol.major)
+    return {
+      _tag: "HelloRejected",
+      failure: {
+        _tag: "ProtocolMajorMismatch",
+        clientMajor: hello.protocol.major,
+        requiredUpdate: hello.protocol.major < discovery.protocol.major ? "client" : "server",
+        serverMajor: discovery.protocol.major
+      }
+    };
+  let negotiatedMinor = Math.min(
+    hello.protocol.minor,
+    discovery.protocol.minor
+  ), minimumCompatibleMinor = Math.max(
+    hello.protocol.minimumSupportedMinor,
+    discovery.protocol.minimumSupportedMinor
+  );
+  return negotiatedMinor < minimumCompatibleMinor ? {
+    _tag: "HelloRejected",
+    failure: {
+      _tag: "ProtocolMinorMismatch",
+      clientMinor: hello.protocol.minor,
+      clientMinimumSupportedMinor: hello.protocol.minimumSupportedMinor,
+      serverMinor: discovery.protocol.minor,
+      serverMinimumSupportedMinor: discovery.protocol.minimumSupportedMinor
+    }
+  } : {
+    _tag: "HelloAccepted",
+    capabilities: negotiateCapabilities(
+      discovery.capabilities,
+      hello.capabilities,
+      negotiatedMinor
+    ),
+    currentSequence,
+    environmentId: discovery.environmentId,
+    limits: negotiatedLimits(discovery.limits, hello.receiveLimits),
+    protocol: {
+      major: discovery.protocol.major,
+      minor: negotiatedMinor
+    }
+  };
+}
+function negotiateCapabilities(serverCapabilities, clientCapabilities, negotiatedMinor) {
+  let clientByName = new Map(
+    clientCapabilities.map((capability) => [capability.name, capability])
+  );
+  return serverCapabilities.flatMap((serverCapability) => {
+    let clientCapability = clientByName.get(serverCapability.name);
+    return clientCapability === void 0 || serverCapability.introducedInMinor > negotiatedMinor || clientCapability.introducedInMinor > negotiatedMinor ? [] : [
+      {
+        introducedInMinor: Math.max(
+          serverCapability.introducedInMinor,
+          clientCapability.introducedInMinor
+        ),
+        name: serverCapability.name,
+        version: Math.min(serverCapability.version, clientCapability.version)
+      }
+    ];
+  });
+}
+function negotiatedLimits(serverLimits, clientLimits) {
+  return {
+    helloTimeoutMilliseconds: serverLimits.helloTimeoutMilliseconds,
+    maxCapturedOutputBytes: Math.min(
+      serverLimits.maxCapturedOutputBytes,
+      clientLimits.maxCapturedOutputBytes
+    ),
+    maxHttpRequestBytes: serverLimits.maxHttpRequestBytes,
+    maxHttpResponseBytes: Math.min(
+      serverLimits.maxHttpResponseBytes,
+      clientLimits.maxHttpResponseBytes
+    ),
+    maxQueuedEventBytes: serverLimits.maxQueuedEventBytes,
+    maxQueuedEvents: serverLimits.maxQueuedEvents,
+    maxWebSocketRequestBytes: serverLimits.maxWebSocketRequestBytes,
+    maxWebSocketResponseBytes: Math.min(
+      serverLimits.maxWebSocketResponseBytes,
+      clientLimits.maxWebSocketResponseBytes
+    )
+  };
+}
+
+// src/apps/server/cli.ts
+import { Deferred, Effect as Effect20 } from "effect";
+
+// src/apps/server/features/browser-client/default-browser.ts
+import { spawn } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { release } from "node:os";
+function openDefaultBrowser(url) {
+  if (process.env.BROWSER !== "none")
+    try {
+      let invocation = browserInvocation(url), child = spawn(invocation.command, invocation.arguments, {
+        detached: !0,
+        stdio: "ignore",
+        windowsHide: !0
+      });
+      child.once("error", () => {
+      }), child.unref();
+    } catch {
+    }
+}
+function browserInvocation(url) {
+  return process.platform === "darwin" ? { arguments: [url], command: "open" } : process.platform === "win32" || isWindowsSubsystemForLinux() ? {
+    arguments: ["/d", "/s", "/c", "start", "", url],
+    command: "cmd.exe"
+  } : { arguments: [url], command: "xdg-open" };
+}
+function isWindowsSubsystemForLinux() {
+  if (process.env.WSL_DISTRO_NAME !== void 0) return !0;
+  try {
+    return readFileSync("/proc/sys/kernel/osrelease", "utf8").toLowerCase().includes("microsoft");
+  } catch {
+    return release().toLowerCase().includes("microsoft");
+  }
+}
+
+// src/apps/server/features/environment-server/server/start-environment-server.ts
+import { and } from "drizzle-orm";
+import { Effect as Effect19 } from "effect";
+
+// src/apps/server/features/environment-authorization/environment-authorization.ts
+import { randomUUID } from "node:crypto";
+import { eq } from "drizzle-orm";
+import { Effect } from "effect";
+
+// src/apps/server/features/environment-authorization/environment-authorization.contract.ts
+import { Data } from "effect";
+var EnvironmentAuthorizationError = class extends Data.TaggedError(
+  "EnvironmentAuthorizationError"
+) {
+};
+function isEnvironmentAuthorizationError(value) {
+  return value instanceof EnvironmentAuthorizationError;
+}
+
+// src/apps/server/features/environment-authorization/environment-authorization-secret.ts
+import {
+  createHash,
+  createHmac,
+  randomBytes,
+  randomInt,
+  timingSafeEqual
+} from "node:crypto";
+var credentialPrefix = "rebase.v1";
+function createDeviceCredential(serverSecret, authorizationId) {
+  let secret = createSecretMaterial(), unsigned = `${credentialPrefix}.${authorizationId}.${secret}`, signature = signCredential(serverSecret, unsigned);
+  return `${unsigned}.${signature}`;
+}
+function verifyDeviceCredential(serverSecret, credential) {
+  if (credential === void 0)
+    return;
+  let [product, version, authorizationId, secret, signature, excess] = credential.split(".");
+  if (product !== "rebase" || version !== "v1" || authorizationId === void 0 || !/^[0-9a-f-]{36}$/.test(authorizationId) || secret === void 0 || !/^[A-Za-z0-9_-]{43}$/.test(secret) || signature === void 0 || !/^[A-Za-z0-9_-]{43}$/.test(signature) || excess !== void 0)
+    return;
+  let unsigned = `${credentialPrefix}.${authorizationId}.${secret}`, expected = Buffer.from(signCredential(serverSecret, unsigned)), received = Buffer.from(signature);
+  return expected.byteLength === received.byteLength && timingSafeEqual(expected, received) ? authorizationId : void 0;
+}
+function createSecretMaterial() {
+  return randomBytes(32).toString("base64url");
+}
+function createPairingCode() {
+  let digits = randomInt(1e6).toString().padStart(6, "0");
+  return `${digits.slice(0, 3)}-${digits.slice(3)}`;
+}
+function digestSecretMaterial(material) {
+  return createHash("sha256").update(material).digest("base64url");
+}
+function signCredential(serverSecret, unsigned) {
+  return createHmac("sha256", serverSecret).update(unsigned).digest("base64url");
+}
+
+// src/apps/server/features/environment-authorization/environment-capabilities.ts
+var viewerCapabilities = [
+  "environment.read",
+  "repository.read"
+], contributorCapabilities = [
+  ...viewerCapabilities,
+  "repository.write"
+], maintainerCapabilities = [
+  ...contributorCapabilities,
+  "history.rewrite",
+  "worktree.manage"
+], ownerCapabilities = [
+  ...maintainerCapabilities,
+  "authorization.manage",
+  "environment.manage"
+];
+function capabilitiesForRole(role, customCapabilities) {
+  switch (role) {
+    case "viewer":
+      return viewerCapabilities;
+    case "contributor":
+      return contributorCapabilities;
+    case "maintainer":
+      return maintainerCapabilities;
+    case "owner":
+      return ownerCapabilities;
+    case "custom":
+      return [...new Set(customCapabilities)];
+  }
+}
+
+// src/apps/server/persistence/environment-state.schema.ts
+import { sql } from "drizzle-orm";
+import {
+  check,
+  foreignKey,
+  index,
+  integer,
+  primaryKey,
+  sqliteTable,
+  text
+} from "drizzle-orm/sqlite-core";
+
+// src/apps/server/domain/environment-state.contract.ts
+var operationStatuses = [
+  "queued",
+  "running",
+  "succeeded",
+  "failed",
+  "cancelled",
+  "outcome_unknown"
+];
+
+// src/apps/server/persistence/environment-state.schema.ts
+var environmentTable = sqliteTable(
+  "environment",
+  {
+    automaticPort: integer("automatic_port"),
+    id: text("id").notNull().unique(),
+    singleton: integer("singleton").primaryKey()
+  },
+  (environment) => [
+    check(
+      "environment_automatic_port_check",
+      sql`${environment.automaticPort} BETWEEN 1 AND 65535`
+    ),
+    check("environment_singleton_check", sql`${environment.singleton} = 1`)
+  ]
+), authorizationMetadataTable = sqliteTable(
+  "authorization_metadata",
+  {
+    createdAt: text("created_at").notNull(),
+    id: text("id").primaryKey(),
+    label: text("label").notNull(),
+    lastSeenAt: text("last_seen_at"),
+    revokedAt: text("revoked_at"),
+    role: text("role", { enum: environmentAuthorizationRoles }).notNull()
+  },
+  (authorization) => [
+    check(
+      "authorization_metadata_role_check",
+      sql`${authorization.role} IN (${sql.raw(sqlValues(environmentAuthorizationRoles))})`
+    )
+  ]
+), authorizationCapabilityTable = sqliteTable(
+  "authorization_capability",
+  {
+    authorizationId: text("authorization_id").notNull(),
+    capability: text("capability", {
+      enum: environmentAccessCapabilities
+    }).notNull()
+  },
+  (authorizationCapability) => [
+    primaryKey({
+      columns: [
+        authorizationCapability.authorizationId,
+        authorizationCapability.capability
+      ]
+    }),
+    foreignKey({
+      columns: [authorizationCapability.authorizationId],
+      foreignColumns: [authorizationMetadataTable.id]
+    }).onDelete("cascade"),
+    check(
+      "authorization_capability_value_check",
+      sql`${authorizationCapability.capability} IN (${sql.raw(sqlValues(environmentAccessCapabilities))})`
+    )
+  ]
+), operationActivityTable = sqliteTable(
+  "operation_activity",
+  {
+    finishedAt: text("finished_at"),
+    id: text("id").primaryKey(),
+    kind: text("kind").notNull(),
+    startedAt: text("started_at").notNull(),
+    status: text("status", { enum: operationStatuses }).notNull()
+  },
+  (operation) => [
+    check(
+      "operation_activity_status_check",
+      sql`${operation.status} IN (${sql.raw(sqlValues(operationStatuses))})`
+    ),
+    index("operation_activity_started_at").on(
+      sql`${operation.startedAt} DESC`,
+      sql`${operation.id} DESC`
+    )
+  ]
+);
+function sqlValues(values) {
+  return values.map((value) => `'${value.replaceAll("'", "''")}'`).join(", ");
+}
+
+// src/apps/server/features/environment-authorization/environment-authorization.ts
+var pairingLifetimeMilliseconds = 600 * 1e3, ticketLifetimeMilliseconds = 30 * 1e3, authorizationInactivityMilliseconds = 2160 * 60 * 60 * 1e3, retainedMaterialMilliseconds = 1440 * 60 * 1e3;
+function createEnvironmentAuthorization(context, serverSecret, options = {}) {
+  let clock = options.clock ?? systemClock, pairings = /* @__PURE__ */ new Map(), tickets = /* @__PURE__ */ new Map();
+  return {
+    authorize: (credential, capability) => authorizeCredential(context, serverSecret, clock, credential, capability),
+    consumeTicket: (ticket) => consumeTicket(context, clock, tickets, ticket),
+    createPairing: (pairing) => Effect.sync(() => createPairing(clock, pairings, pairing)),
+    exchangePairing: (exchange) => exchangePairing(context, serverSecret, clock, pairings, exchange),
+    mintTicket: (credential) => mintTicket(context, serverSecret, clock, tickets, credential),
+    revoke: (credential, authorizationId) => revokeAuthorization(
+      context,
+      serverSecret,
+      clock,
+      credential,
+      authorizationId
+    )
+  };
+}
+function createPairing(clock, pairings, pairing) {
+  let now = clock.now().getTime();
+  removeOldMaterial(pairings, now);
+  let material = createAvailablePairingCode(pairings), expiresAt = now + pairingLifetimeMilliseconds;
+  return pairings.set(digestSecretMaterial(material), {
+    capabilities: capabilitiesForRole(pairing.role, pairing.capabilities),
+    expiresAt,
+    role: pairing.role,
+    used: !1
+  }), { expiresAt: new Date(expiresAt).toISOString(), material };
+}
+function createAvailablePairingCode(pairings) {
+  let code = createPairingCode();
+  for (; pairings.has(digestSecretMaterial(code)); )
+    code = createPairingCode();
+  return code;
+}
+function exchangePairing(context, serverSecret, clock, pairings, exchange) {
+  return Effect.gen(function* () {
+    let now = clock.now(), pairing = yield* consumePairing(
+      pairings,
+      exchange.pairingMaterial,
+      now
+    ), authorization = {
+      capabilities: pairing.capabilities,
+      id: randomUUID(),
+      label: exchange.label,
+      role: pairing.role
+    };
+    return yield* context.write(
+      "Could not save device authorization",
+      (database) => database.transaction(
+        (transaction) => {
+          transaction.insert(authorizationMetadataTable).values({
+            createdAt: now.toISOString(),
+            id: authorization.id,
+            label: authorization.label,
+            role: authorization.role
+          }).run(), authorization.role === "custom" && authorization.capabilities.length > 0 && transaction.insert(authorizationCapabilityTable).values(
+            authorization.capabilities.map((capability) => ({
+              authorizationId: authorization.id,
+              capability
+            }))
+          ).run();
+        },
+        { behavior: "immediate" }
+      )
+    ).pipe(
+      Effect.tapError(
+        () => Effect.sync(() => {
+          pairing.used = !1;
+        })
+      )
+    ), {
+      authorization,
+      credential: createDeviceCredential(serverSecret, authorization.id)
+    };
+  });
+}
+function consumePairing(pairings, material, now) {
+  let pairing = pairings.get(digestSecretMaterial(material));
+  return pairing === void 0 ? failAuthorization({ _tag: "InvalidPairing" }) : pairing.used ? failAuthorization({ _tag: "PairingAlreadyUsed" }) : now.getTime() >= pairing.expiresAt ? failAuthorization({ _tag: "ExpiredPairing" }) : (pairing.used = !0, Effect.succeed(pairing));
+}
+function authorizeCredential(context, serverSecret, clock, credential, capability) {
+  let authorizationId = verifyDeviceCredential(serverSecret, credential);
+  return authorizationId === void 0 ? failAuthorization({ _tag: "InvalidGrant" }) : authorizeStoredGrant(context, clock, authorizationId, capability);
+}
+function authorizeStoredGrant(context, clock, authorizationId, capability) {
+  let now = clock.now();
+  return context.write("Could not authenticate device authorization", (database) => {
+    let metadata = database.select().from(authorizationMetadataTable).where(eq(authorizationMetadataTable.id, authorizationId)).get();
+    if (metadata === void 0)
+      return authorizationFailure({ _tag: "InvalidGrant" });
+    if (metadata.revokedAt !== null)
+      return authorizationFailure({ _tag: "RevokedGrant" });
+    let activeSince = new Date(
+      metadata.lastSeenAt ?? metadata.createdAt
+    ).getTime();
+    if (now.getTime() - activeSince >= authorizationInactivityMilliseconds)
+      return authorizationFailure({ _tag: "ExpiredGrant" });
+    let capabilities = capabilitiesForRole(
+      metadata.role,
+      metadata.role === "custom" ? database.select({ capability: authorizationCapabilityTable.capability }).from(authorizationCapabilityTable).where(
+        eq(
+          authorizationCapabilityTable.authorizationId,
+          authorizationId
+        )
+      ).all().map(({ capability: storedCapability }) => storedCapability) : []
+    );
+    return database.update(authorizationMetadataTable).set({ lastSeenAt: now.toISOString() }).where(eq(authorizationMetadataTable.id, authorizationId)).run(), capabilities.includes(capability) ? authorizationSuccess({
+      capabilities,
+      id: metadata.id,
+      label: metadata.label,
+      role: metadata.role
+    }) : authorizationFailure({ _tag: "CapabilityDenied", capability });
+  }).pipe(
+    Effect.flatMap(
+      (result) => result.success ? Effect.succeed(result.authorization) : failAuthorization(result.failure)
+    )
+  );
+}
+function mintTicket(context, serverSecret, clock, tickets, credential) {
+  return Effect.gen(function* () {
+    let authorization = yield* authorizeCredential(
+      context,
+      serverSecret,
+      clock,
+      credential,
+      "environment.read"
+    ), now = clock.now().getTime();
+    removeOldMaterial(tickets, now);
+    let ticket = createSecretMaterial(), expiresAt = now + ticketLifetimeMilliseconds;
+    return tickets.set(digestSecretMaterial(ticket), {
+      authorizationId: authorization.id,
+      expiresAt,
+      used: !1
+    }), { expiresAt: new Date(expiresAt).toISOString(), ticket };
+  });
+}
+function consumeTicket(context, clock, tickets, ticket) {
+  if (ticket === void 0)
+    return failAuthorization({ _tag: "InvalidTicket" });
+  let stored = tickets.get(digestSecretMaterial(ticket));
+  return stored === void 0 ? failAuthorization({ _tag: "InvalidTicket" }) : stored.used ? failAuthorization({ _tag: "TicketAlreadyUsed" }) : clock.now().getTime() >= stored.expiresAt ? failAuthorization({ _tag: "ExpiredTicket" }) : (stored.used = !0, authorizeStoredGrant(
+    context,
+    clock,
+    stored.authorizationId,
+    "environment.read"
+  ).pipe(
+    Effect.tapError(
+      (error) => error._tag === "EnvironmentStorageError" ? Effect.sync(() => {
+        stored.used = !1;
+      }) : Effect.void
+    )
+  ));
+}
+function revokeAuthorization(context, serverSecret, clock, credential, authorizationId) {
+  return Effect.gen(function* () {
+    yield* authorizeCredential(
+      context,
+      serverSecret,
+      clock,
+      credential,
+      "authorization.manage"
+    );
+    let revokedAt = clock.now().toISOString();
+    return (yield* context.write(
+      "Could not revoke device authorization",
+      (database) => database.update(authorizationMetadataTable).set({ revokedAt }).where(eq(authorizationMetadataTable.id, authorizationId)).run().changes > 0
+    )) ? { authorizationId, revokedAt } : yield* failAuthorization({ _tag: "InvalidGrant" });
+  });
+}
+function removeOldMaterial(entries, now) {
+  for (let [digest, entry] of entries)
+    entry.expiresAt + retainedMaterialMilliseconds <= now && entries.delete(digest);
+}
+function authorizationFailure(failure) {
+  return { failure, success: !1 };
+}
+function authorizationSuccess(authorization) {
+  return { authorization, success: !0 };
+}
+function failAuthorization(failure) {
+  return Effect.fail(new EnvironmentAuthorizationError({ failure }));
+}
+var systemClock = {
+  now: () => /* @__PURE__ */ new Date()
+};
+
+// src/apps/server/features/environment-connection/events/environment-event-publisher.ts
+function createEnvironmentEventPublisher() {
+  let sequence = 0, subscribers = /* @__PURE__ */ new Set();
+  return {
+    currentSequence: () => sequence,
+    publishChanged: () => {
+      sequence += 1;
+      for (let subscriber of subscribers)
+        subscriber(sequence);
+      return sequence;
+    },
+    subscribe: (subscriber) => (subscribers.add(subscriber), () => {
+      subscribers.delete(subscriber);
+    })
+  };
+}
+
+// src/apps/server/features/environment-server/environment-state.specifications.ts
+import { eq as eq2, isNull } from "drizzle-orm";
+function isCurrentEnvironment() {
+  return eq2(environmentTable.singleton, 1);
+}
+function hasNoAutomaticPort() {
+  return isNull(environmentTable.automaticPort);
+}
+
+// src/apps/server/features/environment-server/runtime/runtime-marker.ts
+import { randomUUID as randomUUID2 } from "node:crypto";
+import { mkdir as mkdir2, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+import { Effect as Effect3 } from "effect";
+
+// src/apps/server/error-inspection.ts
+function isFileSystemError(error) {
+  return error instanceof Error && "code" in error;
+}
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+// src/apps/server/features/environment-server/runtime/runtime-errors.contract.ts
+import { Data as Data2 } from "effect";
+var RuntimeMarkerError = class extends Data2.TaggedError("RuntimeMarkerError") {
+}, RuntimeRequirementsError = class extends Data2.TaggedError(
+  "RuntimeRequirementsError"
+) {
+};
+
+// src/apps/server/persistence/storage/environment-paths.ts
+import { chmod, mkdir } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { Effect as Effect2 } from "effect";
+
+// src/apps/server/persistence/storage/storage-error.contract.ts
+import { Data as Data3 } from "effect";
+var EnvironmentStorageError = class extends Data3.TaggedError(
+  "EnvironmentStorageError"
+) {
+};
+
+// src/apps/server/persistence/storage/environment-paths.ts
+function defaultEnvironmentPaths() {
+  return environmentPaths(join(homedir(), ".rebase"));
+}
+function environmentPaths(root) {
+  let cacheDirectory = join(root, "cache"), runtimeDirectory = join(root, "runtime"), secretsDirectory = join(root, "secrets"), settingsDirectory = join(root, "settings"), stateDirectory = join(root, "state");
+  return {
+    cacheDirectory,
+    root,
+    runtimeDirectory,
+    runtimeMarker: join(runtimeDirectory, "runtime.json"),
+    secretsDirectory,
+    serverSecret: join(secretsDirectory, "server.key"),
+    settingsDirectory,
+    stateDatabase: join(stateDirectory, "state.sqlite"),
+    stateDirectory
+  };
+}
+function prepareEnvironmentDirectories(paths) {
+  let directories = [
+    paths.root,
+    paths.stateDirectory,
+    paths.runtimeDirectory,
+    paths.settingsDirectory,
+    paths.secretsDirectory,
+    paths.cacheDirectory
+  ];
+  return Effect2.tryPromise({
+    try: async () => {
+      for (let directory of directories)
+        await mkdir(directory, { mode: 448, recursive: !0 }), process.platform !== "win32" && await chmod(directory, 448);
+    },
+    catch: (cause) => new EnvironmentStorageError({
+      cause,
+      message: `Could not prepare Environment storage: ${errorMessage(cause)}`
+    })
+  });
+}
+
+// src/apps/server/features/environment-server/runtime/runtime-marker.ts
+function defaultRuntimePath() {
+  return defaultEnvironmentPaths().runtimeMarker;
+}
+function acquireRuntimeMarker(marker, runtimePath = defaultRuntimePath()) {
+  return Effect3.acquireRelease(
+    writeRuntimeMarker(runtimePath, marker),
+    () => removeRuntimeMarker(runtimePath, marker.pid).pipe(
+      Effect3.catchTag("RuntimeMarkerError", reportCleanupFailure)
+    )
+  ).pipe(Effect3.asVoid);
+}
+function writeRuntimeMarker(runtimePath, marker) {
+  let temporaryPath = `${runtimePath}.${process.pid}.${randomUUID2()}.tmp`;
+  return Effect3.gen(function* () {
+    yield* fileSystemOperation(
+      () => mkdir2(dirname(runtimePath), { recursive: !0 })
+    ), yield* fileSystemOperation(
+      () => writeFile(temporaryPath, `${JSON.stringify(marker)}
+`, { mode: 384 })
+    ), yield* replaceFile(temporaryPath, runtimePath);
+  }).pipe(
+    Effect3.ensuring(
+      fileSystemOperation(() => rm(temporaryPath, { force: !0 })).pipe(
+        Effect3.orDie
+      )
+    )
+  );
+}
+function removeRuntimeMarker(runtimePath, pid) {
+  return Effect3.gen(function* () {
+    let contents = yield* fileSystemOperation(
+      () => readFile(runtimePath, "utf8")
+    );
+    (yield* Effect3.try({
+      try: () => JSON.parse(contents),
+      catch: runtimeMarkerError
+    })).pid === pid && (yield* fileSystemOperation(() => rm(runtimePath)));
+  }).pipe(
+    Effect3.catchTag(
+      "RuntimeMarkerError",
+      (error) => isMissingFile(error.cause) ? Effect3.void : Effect3.fail(error)
+    )
+  );
+}
+function replaceFile(source, destination) {
+  return fileSystemOperation(() => rename(source, destination)).pipe(
+    Effect3.catchTag("RuntimeMarkerError", (error) => isReplaceConflict(error.cause) ? Effect3.gen(function* () {
+      yield* fileSystemOperation(() => rm(destination, { force: !0 })), yield* fileSystemOperation(() => rename(source, destination));
+    }) : Effect3.fail(error))
+  );
+}
+function fileSystemOperation(operation) {
+  return Effect3.tryPromise({
+    try: operation,
+    catch: runtimeMarkerError
+  });
+}
+function runtimeMarkerError(cause) {
+  return new RuntimeMarkerError({
+    cause,
+    message: `Could not update the runtime marker: ${errorMessage(cause)}`
+  });
+}
+function reportCleanupFailure(error) {
+  return Effect3.sync(() => {
+    process.stderr.write(`${error.message}
+`);
+  });
+}
+function isMissingFile(error) {
+  return isFileSystemError(error) && error.code === "ENOENT";
+}
+function isReplaceConflict(error) {
+  return isFileSystemError(error) && (error.code === "EEXIST" || error.code === "EPERM");
+}
+
+// src/apps/server/features/environment-server/runtime/runtime-requirements.ts
+import { execFile } from "node:child_process";
+import { Effect as Effect4 } from "effect";
+var requiredNodeMajor = 24, minimumGitVersion = [2, 34, 0], verifyRuntimeRequirements = Effect4.gen(function* () {
+  yield* captureRequirement(
+    () => assertSupportedNodeVersion(process.versions.node)
+  );
+  let gitVersion = yield* readGitVersion();
+  yield* captureRequirement(() => assertSupportedGitVersion(gitVersion));
+});
+function assertSupportedNodeVersion(version) {
+  let [major] = parseVersion(version, "Node");
+  if (major !== requiredNodeMajor)
+    throw new Error(`Node 24 is required. Found Node ${version}.`);
+}
+function assertSupportedGitVersion(version) {
+  let parsed = parseVersion(version, "Git");
+  if (compareVersions(parsed, minimumGitVersion) < 0)
+    throw new Error(`Git 2.34 or newer is required. Found Git ${version}.`);
+}
+function parseGitVersion(output) {
+  let match = output.match(/^git version (\d+\.\d+\.\d+)/i);
+  if (!match?.[1])
+    throw new Error(
+      `Could not determine the Git version from "${output.trim()}".`
+    );
+  return match[1];
+}
+function readGitVersion() {
+  return Effect4.callback((resume, signal) => {
+    execFile(
+      "git",
+      ["--version"],
+      { encoding: "utf8", signal, timeout: 5e3 },
+      (error, stdout) => {
+        if (!error) {
+          resume(captureRequirement(() => parseGitVersion(stdout)));
+          return;
+        }
+        let message = error.code === "ENOENT" ? "Git 2.34 or newer is required, but Git was not found." : `Could not run Git: ${error.message}`;
+        resume(
+          Effect4.fail(new RuntimeRequirementsError({ cause: error, message }))
+        );
+      }
+    );
+  });
+}
+function captureRequirement(check2) {
+  return Effect4.try({
+    try: check2,
+    catch: (cause) => new RuntimeRequirementsError({
+      cause,
+      message: cause instanceof Error ? cause.message : String(cause)
+    })
+  });
+}
+function parseVersion(version, product) {
+  let match = version.match(/^(\d+)\.(\d+)\.(\d+)/);
+  if (!match?.[1] || !match[2] || !match[3])
+    throw new Error(`Could not parse ${product} version "${version}".`);
+  return [Number(match[1]), Number(match[2]), Number(match[3])];
+}
+function compareVersions(left, right) {
+  for (let index2 of [0, 1, 2]) {
+    let difference = left[index2] - right[index2];
+    if (difference !== 0) return difference;
+  }
+  return 0;
+}
+
+// src/apps/server/features/environment-server/server/environment-listener.ts
+import { createServer } from "node:http";
+import { Effect as Effect14, FiberSet as FiberSet2 } from "effect";
+
+// src/apps/server/features/environment-connection/http/environment-http-handler.ts
+import { Effect as Effect9 } from "effect";
+
+// src/apps/server/features/browser-client/browser-assets.ts
+import { readFile as readFile2 } from "node:fs/promises";
+import { isAbsolute, relative, resolve } from "node:path";
+import { Effect as Effect5 } from "effect";
+var contentTypes = {
+  ".css": "text/css; charset=utf-8",
+  ".html": "text/html; charset=utf-8",
+  ".js": "text/javascript; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".svg": "image/svg+xml"
+};
+function respondWithBrowserAsset(request, response, assetsRoot) {
+  let asset = resolveBrowserAsset(request.url, assetsRoot);
+  return asset === void 0 ? Effect5.succeed(!1) : request.method !== "GET" && request.method !== "HEAD" ? (response.writeHead(405, { allow: "GET, HEAD" }).end(), Effect5.succeed(!0)) : Effect5.promise(async () => {
+    try {
+      let content = await readFile2(asset.path);
+      response.writeHead(
+        200,
+        browserAssetHeaders(asset.extension, asset.cache)
+      ), response.end(request.method === "HEAD" ? void 0 : content);
+    } catch (error) {
+      let status = isMissingAsset(error) ? 404 : 500;
+      response.writeHead(status).end();
+    }
+    return !0;
+  });
+}
+function resolveBrowserAsset(url, assetsRoot) {
+  let pathname;
+  try {
+    pathname = decodeURIComponent(
+      new URL(url ?? "/", "http://127.0.0.1").pathname
+    );
+  } catch {
+    return;
+  }
+  let relativePath = browserAssetPath(pathname);
+  if (relativePath === void 0)
+    return;
+  let path = resolve(assetsRoot, relativePath), pathFromRoot = relative(resolve(assetsRoot), path);
+  if (pathFromRoot.startsWith("..") || isAbsolute(pathFromRoot))
+    return;
+  let extensionIndex = relativePath.lastIndexOf(".");
+  return {
+    cache: relativePath.startsWith("assets/"),
+    extension: extensionIndex === -1 ? "" : relativePath.slice(extensionIndex),
+    path
+  };
+}
+function browserAssetPath(pathname) {
+  if (pathname === "/" || pathname === "/pair" || pathname === "/pair/")
+    return "index.html";
+  if (pathname === "/favicon.svg" || pathname.startsWith("/assets/") && pathname !== "/assets/")
+    return pathname.slice(1);
+}
+function browserAssetHeaders(extension, cache) {
+  return {
+    "cache-control": cache ? "public, max-age=31536000, immutable" : "no-store",
+    "content-security-policy": "default-src 'self'; base-uri 'none'; connect-src 'self' ws://127.0.0.1:*; form-action 'none'; frame-ancestors 'none'; img-src 'self' data:; object-src 'none'; script-src 'self'; style-src 'self'",
+    "content-type": contentTypes[extension] ?? "application/octet-stream",
+    "x-content-type-options": "nosniff"
+  };
+}
+function isMissingAsset(error) {
+  return error !== null && typeof error == "object" && "code" in error && (error.code === "ENOENT" || error.code === "EISDIR");
+}
+
+// src/apps/server/features/environment-authorization/http/environment-authorization-http-handler.ts
+import { Effect as Effect7, Schema as Schema7 } from "effect";
+
+// src/apps/server/features/environment-connection/environment-request-authorization.ts
+import { Effect as Effect6 } from "effect";
+function validateRequestHost(request) {
+  let port = request.socket.localPort, expectedHost = port === void 0 ? void 0 : `127.0.0.1:${port}`;
+  return request.headers.host === expectedHost ? Effect6.void : failAuthorization2({ _tag: "InvalidHost" });
+}
+function validateRequestOrigin(request, required) {
+  let origin = request.headers.origin;
+  return origin === void 0 && !required ? Effect6.void : origin === expectedRequestOrigin(request) ? Effect6.void : failAuthorization2({ _tag: "InvalidOrigin" });
+}
+function expectedRequestOrigin(request) {
+  return `http://127.0.0.1:${request.socket.localPort ?? 0}`;
+}
+function readBearerCredential(request) {
+  let authorization = request.headers.authorization;
+  return authorization?.startsWith("Bearer ") ? authorization.slice(7) : void 0;
+}
+function authorizationFailureStatus(failure) {
+  switch (failure._tag) {
+    case "InvalidHost":
+    case "InvalidOrigin":
+    case "CapabilityDenied":
+      return 403;
+    case "InvalidGrant":
+    case "RevokedGrant":
+    case "InvalidPairing":
+    case "InvalidTicket":
+      return 401;
+    case "ExpiredGrant":
+    case "ExpiredPairing":
+    case "ExpiredTicket":
+      return 410;
+    case "PairingAlreadyUsed":
+    case "TicketAlreadyUsed":
+      return 409;
+  }
+}
+function failAuthorization2(failure) {
+  return Effect6.fail(new EnvironmentAuthorizationError({ failure }));
+}
+
+// src/apps/server/features/environment-connection/http/environment-http-request-body.contract.ts
+import { Data as Data4 } from "effect";
+var EnvironmentHttpBodyError = class extends Data4.TaggedError(
+  "EnvironmentHttpBodyError"
+) {
+};
+
+// src/apps/server/features/environment-connection/http/environment-http-response.ts
+import { Schema as Schema6 } from "effect";
+function writeJson(response, status, schema, value) {
+  writeJsonValue(response, status, Schema6.encodeSync(schema)(value));
+}
+function writeJsonValue(response, status, value) {
+  response.writeHead(status, {
+    "cache-control": "no-store",
+    "content-type": "application/json; charset=utf-8"
+  }), response.end(JSON.stringify(value));
+}
+
+// src/apps/server/features/environment-authorization/http/environment-authorization-http-handler.ts
+function respondToEnvironmentAuthorizationRequest(request, response, body, authorization) {
+  return Effect7.gen(function* () {
+    if (request.url === EnvironmentAuthorizationHttpApi.exchangePairing.path) {
+      yield* requireMethod(
+        request,
+        response,
+        EnvironmentAuthorizationHttpApi.exchangePairing.method
+      ), yield* validateRequestOrigin(request, !1);
+      let result = yield* authorization.exchangePairing(
+        yield* decodeRequestBody(ExchangeEnvironmentPairing, body)
+      );
+      return writeJson(
+        response,
+        EnvironmentAuthorizationHttpApi.exchangePairing.successStatus,
+        EnvironmentPairingExchanged,
+        result
+      ), !0;
+    }
+    if (request.url === EnvironmentAuthorizationHttpApi.createPairing.path) {
+      yield* requireMethod(
+        request,
+        response,
+        EnvironmentAuthorizationHttpApi.createPairing.method
+      ), yield* validateRequestOrigin(request, !1), yield* authorization.authorize(
+        readBearerCredential(request),
+        "authorization.manage"
+      );
+      let pairing = yield* authorization.createPairing(
+        yield* decodeRequestBody(CreateEnvironmentPairing, body)
+      );
+      return writeJson(
+        response,
+        EnvironmentAuthorizationHttpApi.createPairing.successStatus,
+        EnvironmentPairingCreated,
+        {
+          expiresAt: pairing.expiresAt,
+          pairingUrl: `${expectedRequestOrigin(request)}/pair#${pairing.material}`
+        }
+      ), !0;
+    }
+    if (request.url === EnvironmentAuthorizationHttpApi.mintWebSocketTicket.path) {
+      yield* requireMethod(
+        request,
+        response,
+        EnvironmentAuthorizationHttpApi.mintWebSocketTicket.method
+      ), yield* validateRequestOrigin(request, !1), yield* requireEmptyBody(body);
+      let ticket = yield* authorization.mintTicket(
+        readBearerCredential(request)
+      );
+      return writeJson(
+        response,
+        EnvironmentAuthorizationHttpApi.mintWebSocketTicket.successStatus,
+        EnvironmentWebSocketTicket,
+        ticket
+      ), !0;
+    }
+    if (request.url === EnvironmentAuthorizationHttpApi.revokeAuthorization.path) {
+      yield* requireMethod(
+        request,
+        response,
+        EnvironmentAuthorizationHttpApi.revokeAuthorization.method
+      ), yield* validateRequestOrigin(request, !1);
+      let revocation = yield* decodeRequestBody(
+        RevokeEnvironmentAuthorization,
+        body
+      ), revoked = yield* authorization.revoke(
+        readBearerCredential(request),
+        revocation.authorizationId
+      );
+      return writeJson(
+        response,
+        EnvironmentAuthorizationHttpApi.revokeAuthorization.successStatus,
+        EnvironmentAuthorizationRevoked,
+        revoked
+      ), !0;
+    }
+    return !1;
+  });
+}
+function requireMethod(request, response, method) {
+  return request.method === method ? Effect7.void : Effect7.sync(
+    () => response.writeHead(405, { allow: method }).end()
+  ).pipe(Effect7.andThen(Effect7.interrupt));
+}
+function requireEmptyBody(body) {
+  return body.byteLength === 0 ? Effect7.void : Effect7.fail(
+    new EnvironmentHttpBodyError({
+      failure: { _tag: "InvalidMessage" }
+    })
+  );
+}
+function decodeRequestBody(schema, body) {
+  return Effect7.try({
+    try: () => Schema7.decodeUnknownSync(schema)(JSON.parse(body.toString("utf8")), {
+      onExcessProperty: "error"
+    }),
+    catch: () => new EnvironmentHttpBodyError({ failure: { _tag: "InvalidMessage" } })
+  });
+}
+
+// src/apps/server/features/environment-connection/http/environment-http-request-body.ts
+import { Effect as Effect8 } from "effect";
+var maximumRequestBytes = currentTransportLimits.maxHttpRequestBytes;
+function readEnvironmentHttpRequestBody(request) {
+  return Effect8.callback((resume) => {
+    let state = {
+      chunks: [],
+      receivedBytes: 0
+    }, finish = finishBodyRead(resume), handlers = createBodyHandlers(request, state, finish);
+    if (declaredBodyLength(request) > maximumRequestBytes) {
+      rejectPayloadTooLarge(request, finish);
+      return;
+    }
+    return attachBodyHandlers(request, handlers), Effect8.sync(() => detachBodyHandlers(request, handlers));
+  });
+}
+function createBodyHandlers(request, state, finish) {
+  return {
+    end: () => completeBodyRead(state, finish),
+    receive: (chunk) => receiveBodyChunk(
+      state,
+      chunk,
+      () => rejectPayloadTooLarge(request, finish)
+    ),
+    rejectInvalidMessage: () => {
+      finish(Effect8.fail(invalidMessageFailure()));
+    }
+  };
+}
+function finishBodyRead(resume) {
+  let settled = !1;
+  return (effect) => {
+    settled || (settled = !0, resume(effect));
+  };
+}
+function rejectPayloadTooLarge(request, finish) {
+  finish(Effect8.fail(payloadTooLargeFailure())), request.resume();
+}
+function receiveBodyChunk(state, chunk, rejectPayload) {
+  if (state.receivedBytes += chunk.byteLength, state.receivedBytes > maximumRequestBytes) {
+    rejectPayload();
+    return;
+  }
+  state.chunks.push(chunk);
+}
+function completeBodyRead(state, finish) {
+  finish(Effect8.succeed(Buffer.concat(state.chunks, state.receivedBytes)));
+}
+function attachBodyHandlers(request, handlers) {
+  request.on("data", handlers.receive), request.on("end", handlers.end), request.on("aborted", handlers.rejectInvalidMessage), request.on("error", handlers.rejectInvalidMessage);
+}
+function detachBodyHandlers(request, handlers) {
+  request.off("data", handlers.receive), request.off("end", handlers.end), request.off("aborted", handlers.rejectInvalidMessage), request.off("error", handlers.rejectInvalidMessage);
+}
+function declaredBodyLength(request) {
+  return Number(request.headers["content-length"] ?? 0);
+}
+function invalidMessageFailure() {
+  return new EnvironmentHttpBodyError({
+    failure: { _tag: "InvalidMessage" }
+  });
+}
+function payloadTooLargeFailure() {
+  return new EnvironmentHttpBodyError({
+    failure: {
+      _tag: "PayloadTooLarge",
+      limitBytes: maximumRequestBytes
+    }
+  });
+}
+
+// src/apps/server/features/environment-connection/http/environment-http-handler.ts
+function createEnvironmentHttpHandler(state, authorization, ready, runEnvironmentEffect, browserAssetsRoot) {
+  return (request, response) => {
+    let lifetime = startHttpRequestLifetime(request, response);
+    runEnvironmentEffect(
+      createEnvironmentHttpResponse(
+        request,
+        response,
+        state,
+        authorization,
+        ready(),
+        browserAssetsRoot
+      ).pipe(Effect9.ensuring(Effect9.sync(lifetime.release))),
+      lifetime.signal
+    );
+  };
+}
+function startHttpRequestLifetime(request, response) {
+  let abortController = new AbortController(), abort = () => abortController.abort();
+  return request.once("aborted", abort), response.once("close", abort), {
+    release: () => {
+      request.off("aborted", abort), response.off("close", abort);
+    },
+    signal: abortController.signal
+  };
+}
+function createEnvironmentHttpResponse(request, response, state, authorization, ready, browserAssetsRoot) {
+  return respondToEnvironmentRequest(
+    request,
+    response,
+    state,
+    authorization,
+    ready,
+    browserAssetsRoot
+  ).pipe(
+    Effect9.catch(
+      (error) => Effect9.sync(() => writeEnvironmentHttpError(response, error))
+    )
+  );
+}
+function respondToEnvironmentRequest(request, response, state, authorization, ready, browserAssetsRoot) {
+  return Effect9.gen(function* () {
+    if (request.url === "/health") {
+      yield* requireMethod2(request, response, "GET"), yield* requireEmptyBody2(yield* readEnvironmentHttpRequestBody(request)), writeJsonValue(response, ready ? 200 : 503, {
+        status: ready ? "ready" : "starting"
+      });
+      return;
+    }
+    if (yield* validateRequestHost(request), browserAssetsRoot !== void 0 && (yield* respondWithBrowserAsset(request, response, browserAssetsRoot)))
+      return;
+    let body = yield* readEnvironmentHttpRequestBody(request);
+    if (request.url === EnvironmentHttpApi.discovery.path) {
+      yield* requireMethod2(
+        request,
+        response,
+        EnvironmentHttpApi.discovery.method
+      ), yield* requireEmptyBody2(body), writeJson(
+        response,
+        EnvironmentHttpApi.discovery.successStatus,
+        EnvironmentDiscovery,
+        state.discovery
+      );
+      return;
+    }
+    if (request.url === EnvironmentHttpApi.snapshot.path) {
+      yield* requireMethod2(
+        request,
+        response,
+        EnvironmentHttpApi.snapshot.method
+      ), yield* requireEmptyBody2(body), yield* validateRequestOrigin(request, !1), yield* authorization.authorize(
+        readBearerCredential(request),
+        "environment.read"
+      ), writeJson(
+        response,
+        EnvironmentHttpApi.snapshot.successStatus,
+        EnvironmentSnapshot,
+        {
+          environmentId: state.discovery.environmentId,
+          sequence: state.events.currentSequence()
+        }
+      );
+      return;
+    }
+    (yield* respondToEnvironmentAuthorizationRequest(
+      request,
+      response,
+      body,
+      authorization
+    )) || response.writeHead(404).end();
+  });
+}
+function requireMethod2(request, response, method) {
+  return request.method === method ? Effect9.void : Effect9.sync(
+    () => response.writeHead(405, { allow: method }).end()
+  ).pipe(Effect9.andThen(Effect9.interrupt));
+}
+function requireEmptyBody2(body) {
+  return body.byteLength === 0 ? Effect9.void : Effect9.fail(
+    new EnvironmentHttpBodyError({
+      failure: { _tag: "InvalidMessage" }
+    })
+  );
+}
+function writeEnvironmentHttpError(response, error) {
+  if (!response.writableEnded) {
+    if (error._tag === "EnvironmentAuthorizationError") {
+      writeJson(
+        response,
+        authorizationFailureStatus(error.failure),
+        EnvironmentAuthorizationFailure,
+        error.failure
+      );
+      return;
+    }
+    if (error._tag === "EnvironmentHttpBodyError") {
+      writeJson(
+        response,
+        error.failure._tag === "PayloadTooLarge" ? 413 : 400,
+        EnvironmentHttpFailure,
+        error.failure
+      );
+      return;
+    }
+    response.writeHead(500).end();
+  }
+}
+
+// src/apps/server/features/environment-connection/websocket/environment-websocket-server.ts
+import { Cause as Cause2, Effect as Effect13 } from "effect";
+import { WebSocketServer } from "ws";
+
+// src/apps/server/features/environment-connection/websocket/environment-websocket-session.ts
+import { Effect as Effect12, FiberSet, Option, Queue as Queue2, Schema as Schema9 } from "effect";
+import { WebSocket as WebSocketState } from "ws";
+
+// src/apps/server/features/environment-connection/websocket/environment-websocket-error.contract.ts
+import { Data as Data5 } from "effect";
+var EnvironmentWebSocketSessionClosed = class extends Data5.TaggedError(
+  "EnvironmentWebSocketSessionClosed"
+) {
+}, EnvironmentWebSocketSessionRejected = class extends Data5.TaggedError(
+  "EnvironmentWebSocketSessionRejected"
+) {
+}, EnvironmentWebSocketWriteError = class extends Data5.TaggedError(
+  "EnvironmentWebSocketWriteError"
+) {
+};
+
+// src/apps/server/features/environment-connection/websocket/environment-websocket-inbox.ts
+import { Cause, Effect as Effect10, Queue } from "effect";
+function acquireEnvironmentWebSocketInbox(socket, state) {
+  return Effect10.gen(function* () {
+    let messages = yield* Queue.bounded(state.discovery.limits.maxQueuedEvents), handlers = createInboxHandlers(socket, messages);
+    return yield* Effect10.acquireRelease(
+      Effect10.sync(() => attachInboxHandlers(socket, handlers)),
+      () => Effect10.sync(() => detachInboxHandlers(socket, handlers)).pipe(
+        Effect10.andThen(Queue.shutdown(messages))
+      )
+    ), messages;
+  });
+}
+function createInboxHandlers(socket, messages) {
+  let close = () => {
+    Queue.failCauseUnsafe(
+      messages,
+      Cause.fail(new EnvironmentWebSocketSessionClosed())
+    );
+  };
+  return {
+    close,
+    receive: (data, isBinary) => {
+      Queue.offerUnsafe(messages, { data, isBinary }) || (socket.close(1013, "IncomingQueueOverflow"), close());
+    }
+  };
+}
+function attachInboxHandlers(socket, handlers) {
+  socket.on("message", handlers.receive), socket.on("close", handlers.close), socket.on("error", handlers.close);
+}
+function detachInboxHandlers(socket, handlers) {
+  socket.off("message", handlers.receive), socket.off("close", handlers.close), socket.off("error", handlers.close);
+}
+
+// src/apps/server/features/environment-connection/websocket/environment-websocket-writer.ts
+import { Effect as Effect11, Ref, Schema as Schema8, Semaphore } from "effect";
+import { WebSocket } from "ws";
+
+// src/apps/server/features/environment-connection/websocket/outgoing-message-queue.ts
+function createOutgoingMessageQueue() {
+  return { messages: [], overflowed: !1, queuedBytes: 0 };
+}
+function enqueueOutgoingMessage(queue, value, overflowMessage, limits) {
+  if (queue.overflowed)
+    return queue;
+  let message = queuedMessage(value), overCount = queue.messages.length + 1 > limits.maxQueuedEvents, overBytes = queue.queuedBytes + message.byteLength > limits.maxQueuedEventBytes;
+  if (overCount || overBytes) {
+    let overflow = queuedMessage(overflowMessage);
+    return {
+      messages: [overflow],
+      overflowed: !0,
+      queuedBytes: overflow.byteLength
+    };
+  }
+  return {
+    messages: [...queue.messages, message],
+    overflowed: !1,
+    queuedBytes: queue.queuedBytes + message.byteLength
+  };
+}
+function dequeueOutgoingMessage(queue) {
+  let [message, ...remaining] = queue.messages;
+  return message === void 0 ? { message: void 0, queue } : {
+    message: message.value,
+    queue: {
+      messages: remaining,
+      overflowed: queue.overflowed,
+      queuedBytes: queue.queuedBytes - message.byteLength
+    }
+  };
+}
+function resetOutgoingMessageQueue() {
+  return createOutgoingMessageQueue();
+}
+function replaceWithResnapshotMessage(queue, value) {
+  let message = queuedMessage(value);
+  return {
+    messages: [message],
+    overflowed: queue.overflowed,
+    queuedBytes: message.byteLength
+  };
+}
+function queuedMessage(value) {
+  return { byteLength: Buffer.byteLength(value), value };
+}
+
+// src/apps/server/features/environment-connection/websocket/environment-websocket-writer.ts
+function createEnvironmentWebSocketWriter(socket, state) {
+  return Effect11.gen(function* () {
+    let writerState = yield* Ref.make({
+      limits: state.discovery.limits,
+      queue: createOutgoingMessageQueue(),
+      requiredSnapshotSequence: void 0,
+      supportsResnapshot: !1
+    }), sendPermit = yield* Semaphore.make(1), flush = flushOutgoingMessages(socket, writerState, sendPermit), enqueue = (message) => enqueueServerMessage(writerState, state, message);
+    return {
+      acknowledgeSnapshot: (sequence) => acknowledgeSnapshot(writerState, state, sendPermit, sequence),
+      enqueue,
+      flush,
+      send: (message) => sendServerMessage(enqueue, flush, message),
+      setNegotiatedContract: (limits, supportsResnapshot) => setNegotiatedContract(writerState, limits, supportsResnapshot)
+    };
+  });
+}
+function flushOutgoingMessages(socket, writerState, sendPermit) {
+  return sendPermit.withPermit(
+    Effect11.gen(function* () {
+      for (; ; ) {
+        if (socket.readyState !== WebSocket.OPEN)
+          return yield* Effect11.fail(
+            new EnvironmentWebSocketWriteError({
+              closeCode: 1011,
+              reason: "WebSocketNotOpen"
+            })
+          );
+        let next = yield* dequeueServerMessage(writerState);
+        if (next === void 0)
+          return;
+        yield* sendWebSocketMessage(socket, next);
+      }
+    })
+  );
+}
+function dequeueServerMessage(writerState) {
+  return Ref.modify(writerState, (current) => {
+    let dequeued = dequeueOutgoingMessage(current.queue);
+    return [dequeued.message, { ...current, queue: dequeued.queue }];
+  });
+}
+function enqueueServerMessage(writerState, transportState, message) {
+  return Effect11.gen(function* () {
+    let result = yield* Ref.modify(
+      writerState,
+      (current) => enqueueMessage(current, message, transportState.events.currentSequence())
+    );
+    return result._tag === "Rejected" ? yield* result.error : result._tag === "Enqueued";
+  });
+}
+function sendServerMessage(enqueue, flush, message) {
+  return Effect11.gen(function* () {
+    (yield* enqueue(message)) && (yield* flush);
+  });
+}
+function acknowledgeSnapshot(writerState, transportState, sendPermit, sequence) {
+  return sendPermit.withPermit(
+    Ref.modify(writerState, (current) => current.requiredSnapshotSequence !== sequence || sequence !== transportState.events.currentSequence() || current.queue.messages.length > 0 ? [!1, current] : [
+      !0,
+      {
+        ...current,
+        queue: resetOutgoingMessageQueue(),
+        requiredSnapshotSequence: void 0
+      }
+    ])
+  );
+}
+function setNegotiatedContract(writerState, limits, supportsResnapshot) {
+  return Ref.update(writerState, (current) => ({
+    ...current,
+    limits,
+    supportsResnapshot
+  }));
+}
+function enqueueMessage(state, message, currentSequence) {
+  if (message._tag === "EnvironmentChanged" && state.requiredSnapshotSequence !== void 0)
+    return [
+      { _tag: "Ignored" },
+      {
+        ...state,
+        requiredSnapshotSequence: Math.max(
+          state.requiredSnapshotSequence,
+          message.sequence
+        )
+      }
+    ];
+  let encoded = encodeMessage(message);
+  if (Buffer.byteLength(encoded) > state.limits.maxWebSocketResponseBytes)
+    return [
+      {
+        _tag: "Rejected",
+        error: new EnvironmentWebSocketWriteError({
+          closeCode: 1009,
+          reason: "PayloadTooLarge"
+        })
+      },
+      state
+    ];
+  if (message._tag === "ResnapshotRequired" && state.queue.overflowed)
+    return [
+      { _tag: "Enqueued" },
+      {
+        ...state,
+        queue: replaceWithResnapshotMessage(state.queue, encoded),
+        requiredSnapshotSequence: message.currentSequence
+      }
+    ];
+  let overflow = encodeMessage({
+    _tag: "ResnapshotRequired",
+    currentSequence,
+    reason: "OutgoingQueueOverflow"
+  }), queue = enqueueOutgoingMessage(
+    state.queue,
+    encoded,
+    overflow,
+    state.limits
+  ), overflowed = !state.queue.overflowed && queue.overflowed;
+  return overflowed && !state.supportsResnapshot ? [
+    {
+      _tag: "Rejected",
+      error: new EnvironmentWebSocketWriteError({
+        closeCode: 1013,
+        reason: "OutgoingQueueOverflow"
+      })
+    },
+    { ...state, queue }
+  ] : [
+    { _tag: "Enqueued" },
+    {
+      ...state,
+      queue,
+      requiredSnapshotSequence: message._tag === "ResnapshotRequired" ? message.currentSequence : overflowed ? currentSequence : state.requiredSnapshotSequence
+    }
+  ];
+}
+function sendWebSocketMessage(socket, message) {
+  return Effect11.callback((resume) => {
+    socket.send(message, (error) => {
+      resume(
+        error == null ? Effect11.void : Effect11.fail(
+          new EnvironmentWebSocketWriteError({
+            closeCode: 1011,
+            reason: "WebSocketWriteFailed"
+          })
+        )
+      );
+    });
+  });
+}
+function encodeMessage(message) {
+  return JSON.stringify(
+    Schema8.encodeSync(EnvironmentServerMessage)(message)
+  );
+}
+
+// src/apps/server/features/environment-connection/websocket/environment-websocket-session.ts
+function runEnvironmentWebSocketSession(socket, state) {
+  return runSession(socket, state).pipe(
+    Effect12.catchTag("EnvironmentWebSocketSessionClosed", () => Effect12.void),
+    Effect12.catchTag(
+      "EnvironmentWebSocketSessionRejected",
+      ({ result }) => rejectAndClose(socket, result)
+    ),
+    Effect12.catchTag(
+      "EnvironmentWebSocketWriteError",
+      (error) => closeForWriteError(socket, error)
+    ),
+    Effect12.scoped
+  );
+}
+function runSession(socket, state) {
+  return Effect12.gen(function* () {
+    let messages = yield* acquireEnvironmentWebSocketInbox(socket, state), writer = yield* createEnvironmentWebSocketWriter(socket, state), runSessionEffect = yield* FiberSet.makeRuntime(), hello = yield* readHello(messages, state), result = yield* negotiateSession(state, hello), supportsResnapshot = yield* initializeNegotiatedSession(
+      socket,
+      state,
+      runSessionEffect,
+      writer,
+      hello,
+      result
+    );
+    yield* processClientMessages(messages, writer, state, supportsResnapshot);
+  });
+}
+function negotiateSession(state, hello) {
+  let result = negotiateEnvironmentHello(
+    state.discovery,
+    hello,
+    state.events.currentSequence()
+  );
+  return result._tag === "HelloRejected" ? Effect12.fail(new EnvironmentWebSocketSessionRejected({ result })) : Effect12.succeed(result);
+}
+function initializeNegotiatedSession(socket, state, runSessionEffect, writer, hello, result) {
+  return Effect12.gen(function* () {
+    let capabilities = new Set(
+      result.capabilities.map((capability) => capability.name)
+    ), supportsEnvironmentEvents = capabilities.has("environment-events"), supportsResnapshot = capabilities.has("sequence-resnapshot");
+    return yield* writer.setNegotiatedContract(result.limits, supportsResnapshot), yield* writer.enqueue(result), supportsEnvironmentEvents && (yield* acquireEventSubscription(
+      socket,
+      state,
+      runSessionEffect,
+      writer.send
+    )), yield* enqueueInitialResnapshot(writer.enqueue, hello, result, state), yield* writer.flush, supportsResnapshot;
+  });
+}
+function processClientMessages(messages, writer, state, supportsResnapshot) {
+  return Effect12.gen(function* () {
+    for (; ; ) {
+      let message = decodeSocketMessage(yield* Queue2.take(messages));
+      yield* handleClientMessage(message, writer, state, supportsResnapshot);
+    }
+  });
+}
+function handleClientMessage(message, writer, state, supportsResnapshot) {
+  return message === void 0 ? rejectSession("InvalidMessage") : message._tag === "Hello" ? rejectSession("HandshakeAlreadyCompleted") : supportsResnapshot ? Effect12.gen(function* () {
+    (yield* writer.acknowledgeSnapshot(message.sequence)) || (yield* writer.send({
+      _tag: "ResnapshotRequired",
+      currentSequence: state.events.currentSequence(),
+      reason: "SequenceGap"
+    }));
+  }) : rejectSession("InvalidMessage");
+}
+function readHello(messages, state) {
+  return Effect12.gen(function* () {
+    let first = yield* Queue2.take(messages).pipe(
+      Effect12.timeoutOption(state.discovery.limits.helloTimeoutMilliseconds)
+    );
+    if (Option.isNone(first))
+      return yield* rejectSession("HandshakeRequired");
+    let message = decodeSocketMessage(first.value);
+    return message === void 0 ? yield* rejectSession("InvalidMessage") : message._tag !== "Hello" ? yield* rejectSession("HandshakeRequired") : message;
+  });
+}
+function acquireEventSubscription(socket, state, runSessionEffect, send) {
+  return Effect12.acquireRelease(
+    Effect12.sync(
+      () => state.events.subscribe((sequence) => {
+        runSessionEffect(
+          send({ _tag: "EnvironmentChanged", sequence }).pipe(
+            Effect12.catchTag(
+              "EnvironmentWebSocketWriteError",
+              (error) => closeForWriteError(socket, error)
+            )
+          )
+        );
+      })
+    ),
+    (unsubscribe) => Effect12.sync(unsubscribe)
+  );
+}
+function enqueueInitialResnapshot(enqueue, hello, result, state) {
+  return !result.capabilities.some(
+    (capability) => capability.name === "sequence-resnapshot"
+  ) || (hello.lastObservedSequence === void 0 || hello.lastObservedSequence === result.currentSequence) && result.currentSequence === state.events.currentSequence() ? Effect12.void : enqueue({
+    _tag: "ResnapshotRequired",
+    currentSequence: state.events.currentSequence(),
+    reason: "SequenceGap"
+  });
+}
+function decodeSocketMessage(message) {
+  if (!message.isBinary)
+    try {
+      return Schema9.decodeUnknownSync(EnvironmentClientMessage)(
+        JSON.parse(message.data.toString()),
+        { onExcessProperty: "error" }
+      );
+    } catch {
+      return;
+    }
+}
+function rejectSession(failure) {
+  return Effect12.fail(
+    new EnvironmentWebSocketSessionRejected({
+      result: { _tag: "HelloRejected", failure: sessionFailure(failure) }
+    })
+  );
+}
+function sessionFailure(failure) {
+  switch (failure) {
+    case "HandshakeAlreadyCompleted":
+      return { _tag: "HandshakeAlreadyCompleted" };
+    case "HandshakeRequired":
+      return { _tag: "HandshakeRequired" };
+    case "InvalidMessage":
+      return { _tag: "InvalidMessage" };
+  }
+}
+function rejectAndClose(socket, result) {
+  if (result._tag !== "HelloRejected")
+    return Effect12.void;
+  let encoded = JSON.stringify(
+    Schema9.encodeSync(EnvironmentHelloResult)(result)
+  );
+  return Effect12.callback((resume) => {
+    if (socket.readyState !== WebSocketState.OPEN) {
+      socket.terminate(), resume(Effect12.void);
+      return;
+    }
+    socket.send(encoded, (error) => {
+      error != null ? socket.terminate() : socket.close(1008, result.failure._tag), resume(Effect12.void);
+    });
+  });
+}
+function closeForWriteError(socket, error) {
+  return Effect12.sync(() => {
+    socket.readyState === WebSocketState.OPEN ? socket.close(error.closeCode, error.reason) : socket.terminate();
+  });
+}
+
+// src/apps/server/features/environment-connection/websocket/environment-websocket-server.ts
+function attachEnvironmentWebSocketServer(server, state, authorization, runEnvironmentEffect) {
+  let webSocketServer = new WebSocketServer({
+    clientTracking: !0,
+    maxPayload: currentTransportLimits.maxWebSocketRequestBytes,
+    noServer: !0,
+    perMessageDeflate: !1
+  }), upgrade = (request, socket, head) => {
+    let url = readUpgradeUrl(request);
+    if (url?.pathname !== environmentLivePath) {
+      socket.end(`HTTP/1.1 404 Not Found\r
+Connection: close\r
+\r
+`);
+      return;
+    }
+    runEnvironmentEffect(
+      Effect13.gen(function* () {
+        yield* validateRequestHost(request), yield* validateRequestOrigin(request, !1);
+        let tickets = url.searchParams.getAll("ticket");
+        yield* authorization.consumeTicket(
+          tickets.length === 1 ? tickets[0] : void 0
+        ), yield* Effect13.sync(() => {
+          webSocketServer.handleUpgrade(request, socket, head, (webSocket) => {
+            webSocketServer.emit("connection", webSocket, request);
+          });
+        });
+      }).pipe(
+        Effect13.catchCause(
+          (cause) => Effect13.sync(() => rejectUpgrade(socket, Cause2.squash(cause)))
+        )
+      )
+    );
+  };
+  return server.on("upgrade", upgrade), webSocketServer.on("connection", (socket) => {
+    runEnvironmentEffect(runEnvironmentWebSocketSession(socket, state));
+  }), {
+    close: () => closeWebSocketServer(server, webSocketServer, upgrade)
+  };
+}
+function readUpgradeUrl(request) {
+  try {
+    return new URL(request.url ?? "", expectedRequestOrigin(request));
+  } catch {
+    return;
+  }
+}
+function rejectUpgrade(socket, error) {
+  let authorizationError = isEnvironmentAuthorizationError(error) ? error : void 0, status = authorizationError === void 0 ? 503 : authorizationFailureStatus(authorizationError.failure), body = JSON.stringify(
+    authorizationError === void 0 ? { _tag: "EnvironmentUnavailable" } : authorizationError.failure
+  );
+  socket.end(
+    `HTTP/1.1 ${status} ${statusText(status)}\r
+Content-Type: application/json; charset=utf-8\r
+Cache-Control: no-store\r
+Content-Length: ${Buffer.byteLength(body)}\r
+Connection: close\r
+\r
+${body}`
+  );
+}
+function statusText(status) {
+  switch (status) {
+    case 401:
+      return "Unauthorized";
+    case 403:
+      return "Forbidden";
+    case 409:
+      return "Conflict";
+    case 410:
+      return "Gone";
+    default:
+      return "Service Unavailable";
+  }
+}
+function closeWebSocketServer(server, webSocketServer, upgrade) {
+  server.off("upgrade", upgrade);
+  for (let client of webSocketServer.clients)
+    client.terminate();
+  return new Promise((resolveClosed, rejectClosed) => {
+    webSocketServer.close((error) => {
+      error !== void 0 ? rejectClosed(error) : resolveClosed();
+    });
+  });
+}
+
+// src/apps/server/features/environment-server/server/environment-server-error.contract.ts
+import { Data as Data6 } from "effect";
+var EnvironmentServerStartError = class extends Data6.TaggedError(
+  "EnvironmentServerStartError"
+) {
+};
+
+// src/apps/server/features/environment-server/server/environment-listener.ts
+var loopbackHost = "127.0.0.1";
+function acquireEnvironmentListener(options) {
+  return Effect14.gen(function* () {
+    let port = options.port ?? 0, readiness = { value: !1 }, state = {
+      discovery: createCurrentEnvironmentDiscovery(
+        options.environmentId,
+        options.productVersion
+      ),
+      events: options.events
+    }, runFork = yield* FiberSet2.makeRuntime(), runEnvironmentEffect = (effect, signal) => {
+      runFork(effect, signal === void 0 ? void 0 : { signal });
+    }, server = yield* Effect14.acquireRelease(
+      createHttpServer(
+        readiness,
+        state,
+        options.authorization,
+        port,
+        runEnvironmentEffect,
+        options.browserAssetsRoot
+      ),
+      (acquiredServer) => Effect14.promise(() => closeServer(acquiredServer)).pipe(Effect14.orDie)
+    );
+    yield* Effect14.acquireRelease(
+      Effect14.try({
+        try: () => attachEnvironmentWebSocketServer(
+          server,
+          state,
+          options.authorization,
+          runEnvironmentEffect
+        ),
+        catch: (cause) => environmentServerError(cause, port)
+      }),
+      (webSockets) => Effect14.promise(webSockets.close).pipe(Effect14.orDie)
+    ), yield* listen(server, port);
+    let listeningPort = yield* readListeningPort(server, port);
+    return {
+      host: loopbackHost,
+      origin: `http://${loopbackHost}:${listeningPort}`,
+      port: listeningPort,
+      readiness,
+      server
+    };
+  });
+}
+function createHttpServer(readiness, state, authorization, port, runEnvironmentEffect, browserAssetsRoot) {
+  return Effect14.try({
+    try: () => createServer(
+      { maxHeaderSize: 16384 },
+      createEnvironmentHttpHandler(
+        state,
+        authorization,
+        () => readiness.value,
+        runEnvironmentEffect,
+        browserAssetsRoot
+      )
+    ),
+    catch: (cause) => environmentServerError(cause, port)
+  });
+}
+function readListeningPort(server, requestedPort) {
+  return Effect14.try({
+    try: () => {
+      let address = server.address();
+      if (address === null || typeof address == "string")
+        throw new Error("The HTTP listener has no TCP address.");
+      return address.port;
+    },
+    catch: (cause) => environmentServerError(cause, requestedPort)
+  });
+}
+function listen(server, port) {
+  return Effect14.callback(
+    (resume, signal) => {
+      let failed = (cause) => {
+        detach(), resume(Effect14.fail(environmentServerError(cause, port)));
+      }, listening = () => {
+        detach(), resume(Effect14.void);
+      }, detach = () => {
+        server.off("error", failed), server.off("listening", listening);
+      };
+      server.once("error", failed), server.once("listening", listening);
+      try {
+        server.listen({ exclusive: !0, host: loopbackHost, port, signal });
+      } catch (cause) {
+        failed(cause);
+      }
+      return Effect14.sync(detach);
+    }
+  );
+}
+function closeServer(server) {
+  return new Promise((resolveClosed, rejectClosed) => {
+    server.close((error) => {
+      error && !isServerNotRunning(error) ? rejectClosed(error) : resolveClosed();
+    }), server.closeAllConnections();
+  });
+}
+function isServerNotRunning(error) {
+  return isFileSystemError(error) && error.code === "ERR_SERVER_NOT_RUNNING";
+}
+function environmentServerError(cause, port) {
+  return new EnvironmentServerStartError({
+    cause,
+    message: listenerErrorMessage(cause, port)
+  });
+}
+function listenerErrorMessage(cause, port) {
+  return isFileSystemError(cause) && cause.code === "EADDRINUSE" && port !== 0 ? `Port ${port} is already in use on ${loopbackHost}.` : `Could not start the Environment server: ${errorMessage(cause)}`;
+}
+
+// src/apps/server/persistence/environment-context.ts
+import { randomUUID as randomUUID3 } from "node:crypto";
+import { eq as eq3 } from "drizzle-orm";
+import { drizzle as drizzle2 } from "drizzle-orm/node-sqlite";
+import { Effect as Effect18, Semaphore as Semaphore2 } from "effect";
+
+// src/apps/server/persistence/sqlite/database.ts
+import { chmodSync } from "node:fs";
+import { DatabaseSync } from "node:sqlite";
+import { drizzle } from "drizzle-orm/node-sqlite";
+import { Effect as Effect16, Schedule } from "effect";
+
+// src/apps/server/persistence/sqlite/migrations.ts
+import { existsSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { readMigrationFiles } from "drizzle-orm/migrator";
+import { migrate } from "drizzle-orm/node-sqlite/migrator";
+var migrationsFolder = resolveMigrationsFolder(), migrationsTable = "__drizzle_migrations";
+function migrateEnvironmentState(database) {
+  let localMigrations = readMigrationFiles({ migrationsFolder }), appliedMigrations = readAppliedMigrations(database.$client);
+  if (validateMigrationHistory(localMigrations, appliedMigrations), appliedMigrations.length !== localMigrations.length)
+    try {
+      migrate(database, { migrationsFolder, migrationsTable });
+    } catch (error) {
+      let migrationsAfterFailure = readAppliedMigrations(database.$client);
+      if (validateMigrationHistory(localMigrations, migrationsAfterFailure), migrationsAfterFailure.length !== localMigrations.length) throw error;
+    }
+}
+function readAppliedMigrations(database) {
+  return database.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?").get(migrationsTable) === void 0 ? [] : database.prepare(`SELECT id, name, hash FROM ${migrationsTable} ORDER BY id`).all().map(parseAppliedMigration);
+}
+function validateMigrationHistory(localMigrations, appliedMigrations) {
+  for (let [index2, applied] of appliedMigrations.entries()) {
+    let expected = localMigrations[index2];
+    if (expected === void 0)
+      throw new Error(
+        `The state database is at version ${applied.id}, but this Rebase build supports version ${localMigrations.length}.`
+      );
+    if (applied.id !== index2 + 1 || applied.name !== expected.name)
+      throw new Error(
+        `Migration ${applied.id} "${applied.name}" does not match the expected migration "${expected.name}".`
+      );
+    if (applied.hash !== expected.hash)
+      throw new Error(
+        `Migration ${applied.id} "${applied.name}" no longer matches its applied checksum.`
+      );
+  }
+}
+function parseAppliedMigration(row) {
+  if (typeof row.id != "number" || typeof row.name != "string" || typeof row.hash != "string")
+    throw new Error("The migration history contains an invalid record.");
+  return {
+    hash: row.hash,
+    id: row.id,
+    name: row.name
+  };
+}
+function resolveMigrationsFolder() {
+  let folder = [
+    new URL("./migrations", import.meta.url),
+    new URL("../migrations", import.meta.url)
+  ].find((candidate) => existsSync(candidate));
+  if (folder === void 0)
+    throw new Error("Rebase database migrations are missing.");
+  return fileURLToPath(folder);
+}
+
+// src/apps/server/persistence/sqlite/storage-operation.ts
+import { Effect as Effect15 } from "effect";
+function serializedPromise(writer, message, operation) {
+  return writer.withPermit(storagePromise(message, operation));
+}
+function storagePromise(message, operation) {
+  return Effect15.tryPromise({
+    try: async () => operation(),
+    catch: (cause) => storageError(message, cause)
+  });
+}
+function storageSync(message, operation) {
+  return Effect15.try({
+    try: operation,
+    catch: (cause) => storageError(message, cause)
+  });
+}
+function storageError(message, cause) {
+  return new EnvironmentStorageError({
+    cause,
+    message: `${message}: ${errorMessage(cause)}`
+  });
+}
+
+// src/apps/server/persistence/sqlite/database.ts
+var busyTimeoutMilliseconds = 1e3, databaseLockRetryDelay = "10 millis", databaseLockRetryCount = 10;
+function openEnvironmentDatabase(paths) {
+  return Effect16.gen(function* () {
+    let database = yield* storageSync(
+      "Could not open Environment state",
+      () => new DatabaseSync(paths.stateDatabase, {
+        allowUnknownNamedParameters: !1,
+        enableForeignKeyConstraints: !0,
+        timeout: busyTimeoutMilliseconds
+      })
+    );
+    return yield* Effect16.gen(function* () {
+      return yield* storageSync(
+        "Could not open Environment state",
+        () => configureDatabase(database)
+      ).pipe(retryDatabaseLock), yield* migrateDatabase(database), yield* storageSync(
+        "Could not open Environment state",
+        () => restrictDatabasePermissions(paths.stateDatabase)
+      ), database;
+    }).pipe(Effect16.onError(() => closeEnvironmentDatabase(database)));
+  });
+}
+function closeEnvironmentDatabase(database) {
+  return Effect16.sync(() => database.close()).pipe(Effect16.orDie);
+}
+function readDatabaseSettings(database) {
+  let foreignKeys = database.prepare("PRAGMA foreign_keys").get();
+  return {
+    busyTimeout: database.prepare("PRAGMA busy_timeout").get().timeout,
+    foreignKeys: foreignKeys.foreign_keys === 1,
+    journalMode: readJournalMode(database)
+  };
+}
+function configureDatabase(database) {
+  database.exec(`
+    PRAGMA busy_timeout = ${busyTimeoutMilliseconds};
+    PRAGMA synchronous = NORMAL;
+  `), enableWriteAheadLogging(database);
+}
+function migrateDatabase(database) {
+  return storageSync(
+    "Could not open Environment state",
+    () => migrateEnvironmentState(drizzle({ client: database }))
+  ).pipe(retryDatabaseLock);
+}
+function retryDatabaseLock(effect) {
+  return effect.pipe(
+    Effect16.retry({
+      schedule: Schedule.spaced(databaseLockRetryDelay),
+      times: databaseLockRetryCount,
+      while: isDatabaseLocked
+    })
+  );
+}
+function isDatabaseLocked(error) {
+  return error.message.includes("database is locked");
+}
+function enableWriteAheadLogging(database) {
+  try {
+    database.exec("PRAGMA journal_mode = WAL;");
+  } catch (error) {
+    if (readJournalMode(database) !== "wal") throw error;
+  }
+}
+function readJournalMode(database) {
+  return database.prepare("PRAGMA journal_mode").get().journal_mode;
+}
+function restrictDatabasePermissions(path) {
+  process.platform !== "win32" && chmodSync(path, 384);
+}
+
+// src/apps/server/persistence/storage/server-secret.ts
+import { randomBytes as randomBytes2 } from "node:crypto";
+import { chmod as chmod2, readFile as readFile3, writeFile as writeFile2 } from "node:fs/promises";
+import { setTimeout } from "node:timers/promises";
+import { Effect as Effect17 } from "effect";
+var secretCreationRetryCount = 10, secretCreationRetryDelayMilliseconds = 10;
+function ensureServerSecret(paths) {
+  return Effect17.tryPromise({
+    try: () => readOrCreateServerSecret(paths.serverSecret),
+    catch: (cause) => new EnvironmentStorageError({
+      cause,
+      message: `Could not prepare the server secret: ${errorMessage(cause)}`
+    })
+  });
+}
+async function readOrCreateServerSecret(path) {
+  let secret;
+  try {
+    secret = await readFile3(path, "utf8");
+  } catch (error) {
+    if (!isMissingFile2(error))
+      throw error;
+    let generated = `${randomBytes2(32).toString("base64url")}
+`;
+    try {
+      await writeFile2(path, generated, { flag: "wx", mode: 384 }), secret = generated;
+    } catch (writeError) {
+      if (!isExistingFile(writeError))
+        throw writeError;
+      secret = await readSecretCreatedByAnotherProcess(path);
+    }
+  }
+  if (!/^[A-Za-z0-9_-]{43}$/.test(secret.trim()))
+    throw new Error("The server secret is invalid.");
+  return process.platform !== "win32" && await chmod2(path, 384), secret.trim();
+}
+async function readSecretCreatedByAnotherProcess(path) {
+  for (let attempt = 0; attempt <= secretCreationRetryCount; attempt += 1) {
+    let secret = await readFile3(path, "utf8");
+    if (/^[A-Za-z0-9_-]{43}$/.test(secret.trim()))
+      return secret;
+    if (attempt === secretCreationRetryCount)
+      break;
+    await setTimeout(secretCreationRetryDelayMilliseconds);
+  }
+  throw new Error("The server secret is invalid.");
+}
+function isMissingFile2(error) {
+  return isFileSystemError(error) && error.code === "ENOENT";
+}
+function isExistingFile(error) {
+  return isFileSystemError(error) && error.code === "EEXIST";
+}
+
+// src/apps/server/persistence/environment-context.ts
+function acquireEnvironmentContext(paths = defaultEnvironmentPaths()) {
+  return Effect18.gen(function* () {
+    yield* prepareEnvironmentDirectories(paths);
+    let serverSecret = yield* ensureServerSecret(paths), database = yield* Effect18.acquireRelease(
+      openEnvironmentDatabase(paths),
+      closeEnvironmentDatabase
+    ), context = yield* storageSync(
+      "Could not read Environment state settings",
+      () => createEnvironmentContext(database, serverSecret)
+    );
+    return yield* initializeEnvironment(context), context;
+  });
+}
+function createEnvironmentContext(database, serverSecret) {
+  let drizzleDatabase = drizzle2({ client: database }), writer = Semaphore2.makeUnsafe(1);
+  return {
+    database: drizzleDatabase,
+    databaseSettings: readDatabaseSettings(database),
+    serverSecret,
+    read: (message, operation) => storagePromise(message, () => operation(drizzleDatabase)),
+    write: (message, operation) => serializedPromise(writer, message, () => operation(drizzleDatabase))
+  };
+}
+function initializeEnvironment(context) {
+  return context.write(
+    "Could not initialize Environment state",
+    async (database) => {
+      if (await database.insert(environmentTable).values({ id: randomUUID3(), singleton: 1 }).onConflictDoNothing({ target: environmentTable.singleton }), await database.select({ id: environmentTable.id }).from(environmentTable).where(eq3(environmentTable.singleton, 1)).get() === void 0)
+        throw new Error("The Environment identity is missing.");
+    }
+  );
+}
+
+// src/apps/server/product-version.ts
+var productVersion = "0.0.2-nightly.20260822.35";
+
+// src/apps/server/features/environment-server/server/start-environment-server.ts
+function startEnvironmentServer(options = {}) {
+  return Effect19.gen(function* () {
+    yield* verifyRuntimeRequirements;
+    let paths = defaultEnvironmentPaths(), context = yield* acquireEnvironmentContext(paths), environment = yield* readCurrentEnvironment(context), authorization = createEnvironmentAuthorization(
+      context,
+      context.serverSecret
+    ), useAutomaticPort = options.port === void 0 || options.port === 0, requestedPort = useAutomaticPort ? environment.automaticPort ?? 0 : options.port, events = createEnvironmentEventPublisher(), listener = yield* acquireEnvironmentListener({
+      authorization,
+      ...options.browserAssetsRoot === void 0 ? {} : { browserAssetsRoot: options.browserAssetsRoot },
+      environmentId: environment.id,
+      events,
+      port: requestedPort,
+      productVersion
+    });
+    useAutomaticPort && environment.automaticPort === null && (yield* claimAutomaticPort(context, listener.port)), yield* acquireRuntimeMarker(runtimeMarker(listener), paths.runtimeMarker);
+    let pairing = yield* authorization.createPairing({
+      capabilities: [],
+      role: "owner"
+    });
+    return yield* markListenerReady(listener), {
+      environmentId: environment.id,
+      origin: listener.origin,
+      pairingUrl: `${listener.origin}/pair#${pairing.material}`,
+      port: listener.port
+    };
+  });
+}
+function readCurrentEnvironment(context) {
+  return context.read("Could not read Environment state", async (database) => {
+    let environment = await database.select().from(environmentTable).where(isCurrentEnvironment()).get();
+    if (environment === void 0)
+      throw new Error("The Environment identity is missing.");
+    return environment;
+  });
+}
+function claimAutomaticPort(context, port) {
+  return context.write(
+    "Could not save the automatic port",
+    async (database) => {
+      await database.update(environmentTable).set({ automaticPort: port }).where(and(isCurrentEnvironment(), hasNoAutomaticPort()));
+      let selected = await database.select({ automaticPort: environmentTable.automaticPort }).from(environmentTable).where(isCurrentEnvironment()).get();
+      if (selected?.automaticPort === null || selected === void 0)
+        throw new Error("The automatic port was not saved.");
+      if (selected.automaticPort !== port)
+        throw new Error(
+          `Another server selected automatic port ${selected.automaticPort}.`
+        );
+    }
+  );
+}
+function runtimeMarker(listener) {
+  return {
+    host: listener.host,
+    origin: listener.origin,
+    pid: process.pid,
+    port: listener.port,
+    startedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+function markListenerReady(listener) {
+  return Effect19.gen(function* () {
+    yield* Effect19.addFinalizer(
+      () => Effect19.sync(() => {
+        listener.readiness.value = !1;
+      })
+    ), yield* Effect19.sync(() => {
+      listener.readiness.value = !0;
+    });
+  });
+}
+
+// src/apps/server/cli.ts
+var usage = "Usage: rebase [serve] [--port <1-65535>]";
+function runCli(arguments_ = process.argv.slice(2)) {
+  if (arguments_.includes("--help") || arguments_.includes("-h"))
+    return writeOutput(usage).pipe(Effect20.as(0));
+  if (arguments_.includes("--version") || arguments_.includes("-v"))
+    return writeOutput(versionOutput()).pipe(Effect20.as(0));
+  let program = Effect20.try({
+    try: () => parseServeArguments(arguments_),
+    catch: normalizeError
+  }).pipe(Effect20.flatMap(serve));
+  return Effect20.matchEffect(program, {
+    onFailure: (error) => writeFailure(`rebase serve failed: ${error.message}`).pipe(Effect20.as(1)),
+    onSuccess: () => Effect20.succeed(0)
+  });
+}
+async function main() {
+  process.exitCode = await Effect20.runPromise(runCli());
+}
+function parseServeArguments(arguments_) {
+  let normalizedArguments = arguments_.length === 0 || arguments_[0] === "--port" ? ["serve", ...arguments_] : arguments_, [command, ...options] = normalizedArguments;
+  if (command !== "serve") throw new Error(usage);
+  let browserAssetsRoot = resolveBrowserAssetsRoot();
+  if (options.length === 0) return { browserAssetsRoot };
+  if (options.length !== 2 || options[0] !== "--port" || !options[1])
+    throw new Error(usage);
+  let port = Number(options[1]);
+  if (!Number.isInteger(port) || port < 1 || port > 65535)
+    throw new Error(
+      `Port must be an integer between 1 and 65535. Found "${options[1]}".`
+    );
+  return { browserAssetsRoot, port };
+}
+function serve(options) {
+  return Effect20.scoped(
+    Effect20.gen(function* () {
+      let shutdown = yield* acquireShutdownSignal(), server = yield* Effect20.raceFirst(
+        startEnvironmentServer(options),
+        Deferred.await(shutdown)
+      );
+      server !== void 0 && (yield* Effect20.sync(() => {
+        process.stdout.write(`Listening URL: ${server.origin}
+`), process.stdout.write(`Pairing URL: ${server.pairingUrl}
+`), openDefaultBrowser(server.pairingUrl);
+      }), yield* Deferred.await(shutdown));
+    })
+  );
+}
+function acquireShutdownSignal() {
+  return Effect20.gen(function* () {
+    let shutdown = yield* Deferred.make();
+    return yield* Effect20.acquireRelease(
+      Effect20.sync(() => {
+        let stop = () => {
+          Deferred.doneUnsafe(shutdown, Effect20.void);
+        };
+        return process.once("SIGINT", stop), process.once("SIGTERM", stop), stop;
+      }),
+      (stop) => Effect20.sync(() => {
+        process.off("SIGINT", stop), process.off("SIGTERM", stop);
+      })
+    ), shutdown;
+  });
+}
+function writeOutput(line) {
+  return Effect20.sync(() => {
+    process.stdout.write(`${line}
+`);
+  });
+}
+function writeFailure(line) {
+  return Effect20.sync(() => {
+    process.stderr.write(`${line}
+`);
+  });
+}
+function normalizeError(error) {
+  return error instanceof Error ? error : new Error(String(error));
+}
+function resolveBrowserAssetsRoot() {
+  let root = [
+    new URL("./web", import.meta.url),
+    new URL("../web/dist/web", import.meta.url),
+    new URL("../../web/dist/web", import.meta.url)
+  ].find((candidate) => existsSync2(candidate));
+  if (root === void 0)
+    throw new Error(
+      "Browser assets are missing. Reinstall Rebase or rebuild the web client."
+    );
+  return fileURLToPath2(root);
+}
+function versionOutput() {
+  let protocol = currentEnvironmentProtocol;
+  return [
+    `Rebase ${productVersion}`,
+    `Environment protocol ${protocol.major}.${protocol.minor} (minimum ${protocol.major}.${protocol.minimumSupportedMinor})`
+  ].join(`
+`);
+}
+var entryPoint = process.argv[1];
+entryPoint && realpathSync(fileURLToPath2(import.meta.url)) === realpathSync(entryPoint) && await main();
+export {
+  main,
+  runCli
+};