@omg-dev/server 0.4.24

package/dist/index.mjs

@@ -0,0 +1,3278 @@
+import { TriggerScanError, extractTriggers, scanTriggers, writeTriggersManifest } from "./trigger-scan.mjs";
+import path from "node:path";
+import fs from "node:fs";
+import { createAuthMiddleware, createAuthMiddleware as createAuthMiddleware$1 } from "@omg-dev/auth";
+import { AsyncLocalStorage } from "node:async_hooks";
+import { Database } from "bun:sqlite";
+import { Topic } from "@omg-dev/stream/core";
+import { collection, defineSchema, fields, schemaDiff, schemaToSQL } from "@omg-dev/schema";
+import crypto$1 from "node:crypto";
+//#region src/ctx.ts
+const ctxStore = new AsyncLocalStorage();
+const ctx = {
+	get userId() {
+		return ctxStore.getStore()?.userId ?? null;
+	},
+	get userEmail() {
+		return ctxStore.getStore()?.userEmail;
+	},
+	get userName() {
+		return ctxStore.getStore()?.userName;
+	},
+	get appId() {
+		return ctxStore.getStore()?.appId;
+	}
+};
+//#endregion
+//#region src/broker.ts
+const topic = new Topic();
+const adapters = /* @__PURE__ */ new Map();
+const decoder = new TextDecoder();
+/** Extract the JSON payload from an SSE frame `id: N\ndata: <json>\n\n`. */
+function extractData(chunk) {
+	const text = decoder.decode(chunk);
+	const dataLines = [];
+	for (const line of text.split("\n")) if (line.startsWith("data: ")) dataLines.push(line.slice(6));
+	return dataLines.join("\n");
+}
+function makeAdapter(client) {
+	const adapter = { async write(chunk) {
+		if (client.readyState !== 1) {
+			adapters.delete(client);
+			topic.detach(adapter);
+			throw new Error("client not open");
+		}
+		try {
+			client.send(extractData(chunk));
+		} catch (err) {
+			adapters.delete(client);
+			topic.detach(adapter);
+			throw err;
+		}
+	} };
+	return adapter;
+}
+function addClient(client) {
+	const adapter = makeAdapter(client);
+	adapters.set(client, adapter);
+	topic.attach(adapter);
+}
+function removeClient(client) {
+	const adapter = adapters.get(client);
+	if (!adapter) return;
+	adapters.delete(client);
+	topic.detach(adapter);
+}
+function invalidate(collection) {
+	topic.publish({
+		type: "invalidate",
+		collection
+	});
+}
+function clientCount() {
+	return topic.size();
+}
+//#endregion
+//#region src/codec.ts
+function encodeValue(type, v) {
+	if (v === null || v === void 0) return v;
+	if (type === "boolean") return v ? 1 : 0;
+	if (typeof type === "object" && "array" in type) return JSON.stringify(v);
+	return v;
+}
+function decodeRow(row, fields) {
+	const out = { ...row };
+	for (const [name, def] of Object.entries(fields)) {
+		if (out[name] === null || out[name] === void 0) continue;
+		if (def.type === "boolean") out[name] = !!out[name];
+		else if (typeof def.type === "object" && "array" in def.type) try {
+			out[name] = JSON.parse(out[name]);
+		} catch {}
+	}
+	return out;
+}
+function decodeRows(rows, fields) {
+	return rows.map((r) => decodeRow(r, fields));
+}
+//#endregion
+//#region src/predicate.ts
+var PredicateValidationError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "PredicateValidationError";
+	}
+};
+const IDENTIFIER_RE$1 = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
+const MAX_DEPTH = 32;
+const MAX_CLAUSES = 256;
+function validatePredicate(node) {
+	validateAtDepth(node, 0);
+}
+function validateAtDepth(node, depth) {
+	if (depth > MAX_DEPTH) throw new PredicateValidationError(`predicate nested too deep (>${MAX_DEPTH})`);
+	if (!node || typeof node !== "object" || Array.isArray(node)) throw new PredicateValidationError("predicate must be an object");
+	const n = node;
+	if (typeof n.op !== "string") throw new PredicateValidationError("predicate missing 'op'");
+	switch (n.op) {
+		case "and":
+		case "or": {
+			const m = n;
+			if (!Array.isArray(m.clauses)) throw new PredicateValidationError(`'${n.op}' requires 'clauses' array`);
+			if (m.clauses.length === 0) throw new PredicateValidationError(`'${n.op}' requires at least one clause`);
+			if (m.clauses.length > MAX_CLAUSES) throw new PredicateValidationError(`'${n.op}' has too many clauses (>${MAX_CLAUSES})`);
+			for (const c of m.clauses) validateAtDepth(c, depth + 1);
+			return;
+		}
+		case "not":
+			validateAtDepth(n.clause, depth + 1);
+			return;
+		case "eq":
+		case "ne": {
+			const m = n;
+			requireColumn(m.column);
+			requireLiteral(m.value);
+			return;
+		}
+		case "gt":
+		case "gte":
+		case "lt":
+		case "lte": {
+			const m = n;
+			requireColumn(m.column);
+			const v = m.value;
+			if (v === null || typeof v === "boolean") throw new PredicateValidationError(`'${n.op}' value must be number or string, got ${v === null ? "null" : "boolean"}`);
+			if (typeof v !== "number" && typeof v !== "string") throw new PredicateValidationError(`'${n.op}' value must be number or string`);
+			if (typeof v === "number" && !Number.isFinite(v)) throw new PredicateValidationError(`'${n.op}' value must be a finite number`);
+			return;
+		}
+		case "in": {
+			const m = n;
+			requireColumn(m.column);
+			if (!Array.isArray(m.values)) throw new PredicateValidationError("'in' requires 'values' array");
+			if (m.values.length === 0) throw new PredicateValidationError("'in' values must be non-empty");
+			if (m.values.length > MAX_CLAUSES) throw new PredicateValidationError(`'in' has too many values (>${MAX_CLAUSES})`);
+			for (const v of m.values) requireLiteral(v);
+			return;
+		}
+		case "like": {
+			const m = n;
+			requireColumn(m.column);
+			if (typeof m.pattern !== "string") throw new PredicateValidationError("'like' requires string 'pattern'");
+			return;
+		}
+		case "isNull":
+		case "isNotNull":
+			requireColumn(n.column);
+			return;
+		default: throw new PredicateValidationError(`unknown op: ${String(n.op)}`);
+	}
+}
+function requireColumn(c) {
+	if (typeof c !== "string" || !IDENTIFIER_RE$1.test(c)) throw new PredicateValidationError(`invalid column: ${String(c)}`);
+}
+function requireLiteral(v) {
+	if (v === null) return;
+	const t = typeof v;
+	if (t !== "string" && t !== "number" && t !== "boolean") throw new PredicateValidationError(`unsupported literal: ${t}`);
+	if (t === "number" && !Number.isFinite(v)) throw new PredicateValidationError("non-finite numbers (NaN/Infinity) not allowed");
+}
+function compileToSql(pred) {
+	const params = [];
+	return {
+		sql: emitSql(pred, params),
+		params
+	};
+}
+function emitSql(p, params) {
+	switch (p.op) {
+		case "and": return `(${p.clauses.map((c) => emitSql(c, params)).join(" AND ")})`;
+		case "or": return `(${p.clauses.map((c) => emitSql(c, params)).join(" OR ")})`;
+		case "not": return `(NOT ${emitSql(p.clause, params)})`;
+		case "eq":
+			params.push(encodeLiteral(p.value));
+			return `${p.column} = ?`;
+		case "ne":
+			params.push(encodeLiteral(p.value));
+			return `${p.column} != ?`;
+		case "gt":
+			params.push(encodeLiteral(p.value));
+			return `${p.column} > ?`;
+		case "gte":
+			params.push(encodeLiteral(p.value));
+			return `${p.column} >= ?`;
+		case "lt":
+			params.push(encodeLiteral(p.value));
+			return `${p.column} < ?`;
+		case "lte":
+			params.push(encodeLiteral(p.value));
+			return `${p.column} <= ?`;
+		case "in":
+			for (const v of p.values) params.push(encodeLiteral(v));
+			return `${p.column} IN (${p.values.map(() => "?").join(", ")})`;
+		case "like":
+			params.push(p.pattern);
+			return `${p.column} LIKE ?`;
+		case "isNull": return `${p.column} IS NULL`;
+		case "isNotNull": return `${p.column} IS NOT NULL`;
+	}
+}
+function encodeLiteral(v) {
+	if (typeof v === "boolean") return v ? 1 : 0;
+	return v;
+}
+/**
+* Compile to a row matcher. The row is the *decoded* shape — same flavour
+* as what auto-crud returns to REST clients (booleans as `true`/`false`,
+* arrays as JS arrays, etc). Subscribers feed decoded rows in.
+*/
+function compileToJs(pred) {
+	const tri = compileToTri(pred);
+	return (row) => tri(row) === true;
+}
+function compileToTri(pred) {
+	switch (pred.op) {
+		case "and": {
+			const cs = pred.clauses.map(compileToTri);
+			return (r) => {
+				let seenNull = false;
+				for (const c of cs) {
+					const v = c(r);
+					if (v === false) return false;
+					if (v === null) seenNull = true;
+				}
+				return seenNull ? null : true;
+			};
+		}
+		case "or": {
+			const cs = pred.clauses.map(compileToTri);
+			return (r) => {
+				let seenNull = false;
+				for (const c of cs) {
+					const v = c(r);
+					if (v === true) return true;
+					if (v === null) seenNull = true;
+				}
+				return seenNull ? null : false;
+			};
+		}
+		case "not": {
+			const c = compileToTri(pred.clause);
+			return (r) => {
+				const v = c(r);
+				if (v === null) return null;
+				return !v;
+			};
+		}
+		case "eq": {
+			const { column, value } = pred;
+			return (r) => {
+				const cv = r[column];
+				if (cv === null || cv === void 0) return null;
+				if (value === null) return null;
+				return valuesEqual(cv, value);
+			};
+		}
+		case "ne": {
+			const { column, value } = pred;
+			return (r) => {
+				const cv = r[column];
+				if (cv === null || cv === void 0) return null;
+				if (value === null) return null;
+				return !valuesEqual(cv, value);
+			};
+		}
+		case "gt": {
+			const { column, value } = pred;
+			return (r) => triCompare(r[column], value, (n) => n > 0);
+		}
+		case "gte": {
+			const { column, value } = pred;
+			return (r) => triCompare(r[column], value, (n) => n >= 0);
+		}
+		case "lt": {
+			const { column, value } = pred;
+			return (r) => triCompare(r[column], value, (n) => n < 0);
+		}
+		case "lte": {
+			const { column, value } = pred;
+			return (r) => triCompare(r[column], value, (n) => n <= 0);
+		}
+		case "in": {
+			const { column, values } = pred;
+			return (r) => {
+				const cv = r[column];
+				if (cv === null || cv === void 0) return null;
+				let seenNull = false;
+				for (const x of values) {
+					if (x === null) {
+						seenNull = true;
+						continue;
+					}
+					if (valuesEqual(cv, x)) return true;
+				}
+				return seenNull ? null : false;
+			};
+		}
+		case "like": {
+			const { column, pattern } = pred;
+			const re = likeToRegExp(pattern);
+			return (r) => {
+				const cv = r[column];
+				if (cv === null || cv === void 0) return null;
+				const s = typeof cv === "string" ? cv : String(cv);
+				return re.test(s);
+			};
+		}
+		case "isNull": {
+			const { column } = pred;
+			return (r) => r[column] === null || r[column] === void 0;
+		}
+		case "isNotNull": {
+			const { column } = pred;
+			return (r) => r[column] !== null && r[column] !== void 0;
+		}
+	}
+}
+function triCompare(a, b, pick) {
+	if (a === null || a === void 0) return null;
+	const n = orderedCompare(a, b);
+	if (Number.isNaN(n)) return null;
+	return pick(n);
+}
+/**
+* Equality with SQLite-ish semantics:
+*  - NULL is never equal to anything (including NULL) → false. Use isNull
+*    if you want NULL matching.
+*  - boolean ↔ 0/1 matches (so a decoded `true` matches a stored `1` row
+*    if anyone hands us a raw row by accident).
+*  - Number/string types compare loosely so an unquoted JSON literal
+*    matches the matching DB column.
+*/
+function valuesEqual(a, b) {
+	if (a === null || a === void 0) return false;
+	if (typeof b === "boolean") {
+		if (typeof a === "boolean") return a === b;
+		if (typeof a === "number") return (b ? 1 : 0) === a;
+		return false;
+	}
+	if (b === null) return false;
+	if (typeof a === typeof b) return a === b;
+	return String(a) === String(b);
+}
+/**
+* Returns -1 / 0 / +1, or NaN if either side is null/undefined or types
+* don't permit ordering. Callers treat NaN as "predicate false" — same as
+* SQL where any comparison involving NULL yields UNKNOWN.
+*/
+function orderedCompare(a, b) {
+	if (a === null || a === void 0) return NaN;
+	if (typeof b === "number") {
+		const av = typeof a === "number" ? a : Number(a);
+		if (!Number.isFinite(av)) return NaN;
+		return av < b ? -1 : av > b ? 1 : 0;
+	}
+	const as = typeof a === "string" ? a : String(a);
+	return as < b ? -1 : as > b ? 1 : 0;
+}
+/**
+* Translate a SQL LIKE pattern to a JS RegExp. SQLite LIKE is
+* case-insensitive for ASCII by default — we mirror that with the `i` flag.
+* `%` matches any run of characters; `_` matches exactly one. No escape
+* handling yet — adding `ESCAPE '\\'` is a Phase 6 concern.
+*/
+function likeToRegExp(pattern) {
+	let re = "^";
+	for (const ch of pattern) if (ch === "%") re += ".*";
+	else if (ch === "_") re += ".";
+	else re += ch.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+	re += "$";
+	return new RegExp(re, "i");
+}
+//#endregion
+//#region src/subscriptions.ts
+const clients = /* @__PURE__ */ new Map();
+const subsByCollection = /* @__PURE__ */ new Map();
+let currentSchema = null;
+function setSubscriptionSchema(schema) {
+	currentSchema = schema;
+}
+let seqCounter = 0;
+const ringByCollection = /* @__PURE__ */ new Map();
+let RING_CAP = 256;
+let MAX_SUBS_PER_CLIENT = 64;
+function setMaxSubsPerClient(n) {
+	if (!Number.isInteger(n) || n < 1) throw new Error("max subs per client must be a positive integer");
+	MAX_SUBS_PER_CLIENT = n;
+}
+/** Test/operator hook: override the per-collection ring cap. */
+function setSubscriptionRingCap(cap) {
+	if (!Number.isInteger(cap) || cap < 1) throw new Error("ring cap must be positive integer");
+	RING_CAP = cap;
+}
+function nextSeq() {
+	seqCounter += 1;
+	return seqCounter;
+}
+function pushRing(collection, entry) {
+	let ring = ringByCollection.get(collection);
+	if (!ring) {
+		ring = [];
+		ringByCollection.set(collection, ring);
+	}
+	ring.push(entry);
+	if (ring.length > RING_CAP) ring.splice(0, ring.length - RING_CAP);
+}
+function addSubClient(client) {
+	if (clients.has(client)) return;
+	clients.set(client, /* @__PURE__ */ new Map());
+}
+function removeSubClient(client) {
+	const subs = clients.get(client);
+	if (!subs) return;
+	for (const sub of subs.values()) {
+		const set = subsByCollection.get(sub.collection);
+		if (set) {
+			set.delete(client);
+			if (set.size === 0) subsByCollection.delete(sub.collection);
+		}
+	}
+	clients.delete(client);
+}
+function subClientCount() {
+	return clients.size;
+}
+function subscriptionCount(collection) {
+	if (collection) return subsByCollection.get(collection)?.size ?? 0;
+	let n = 0;
+	for (const subs of clients.values()) n += subs.size;
+	return n;
+}
+async function handleSubMessage(client, raw) {
+	let msg;
+	try {
+		msg = JSON.parse(raw);
+	} catch {
+		sendError(client, void 0, "bad_json", "message is not valid JSON");
+		return;
+	}
+	if (!msg || typeof msg !== "object" || !("op" in msg)) {
+		sendError(client, void 0, "bad_shape", "missing op field");
+		return;
+	}
+	if (msg.op === "sub") {
+		if (!msg.subId || typeof msg.subId !== "string") {
+			sendError(client, void 0, "bad_subId", "subId required");
+			return;
+		}
+		if (!msg.collection || typeof msg.collection !== "string") {
+			sendError(client, msg.subId, "bad_collection", "collection required");
+			return;
+		}
+		const subs = clients.get(client);
+		if (!subs) {
+			sendError(client, msg.subId, "client_not_registered", "client not registered — call addSubClient first");
+			return;
+		}
+		if (subs.has(msg.subId)) {
+			sendError(client, msg.subId, "duplicate_subId", "subId already in use on this client");
+			return;
+		}
+		if (subs.size >= MAX_SUBS_PER_CLIENT) {
+			sendError(client, msg.subId, "sub_limit_exceeded", `client has reached the subscription cap (${MAX_SUBS_PER_CLIENT})`);
+			return;
+		}
+		if (!currentSchema || !currentSchema.collections[msg.collection]) {
+			sendError(client, msg.subId, "unknown_collection", `no such collection: ${msg.collection}`);
+			return;
+		}
+		if (currentSchema.collections[msg.collection].scope === "user" && !client.ctx.userId) {
+			sendError(client, msg.subId, "auth_required", `scoped collection "${msg.collection}" requires an authenticated user`);
+			return;
+		}
+		let predicate = null;
+		let predicateJs = null;
+		if (msg.where !== void 0) try {
+			validatePredicate(msg.where);
+			predicate = msg.where;
+			predicateJs = compileToJs(msg.where);
+		} catch (err) {
+			if (err instanceof PredicateValidationError) sendError(client, msg.subId, "bad_predicate", err.message);
+			else sendError(client, msg.subId, "bad_predicate", err.message);
+			return;
+		}
+		const sub = {
+			subId: msg.subId,
+			collection: msg.collection,
+			predicate,
+			predicateJs
+		};
+		subs.set(msg.subId, sub);
+		let set = subsByCollection.get(msg.collection);
+		if (!set) {
+			set = /* @__PURE__ */ new Set();
+			subsByCollection.set(msg.collection, set);
+		}
+		set.add(client);
+		if (typeof msg.resumeFromSeq === "number" && msg.resumeFromSeq >= 0 && canResumeFrom(msg.collection, msg.resumeFromSeq)) {
+			await sendResumeReplay(client, sub, msg.resumeFromSeq);
+			return;
+		}
+		await sendSnapshot(client, sub);
+		return;
+	}
+	if (msg.op === "unsub") {
+		const subs = clients.get(client);
+		if (!subs) return;
+		const sub = subs.get(msg.subId);
+		if (!sub) return;
+		subs.delete(msg.subId);
+		let stillOnCollection = false;
+		for (const remaining of subs.values()) if (remaining.collection === sub.collection) {
+			stillOnCollection = true;
+			break;
+		}
+		if (!stillOnCollection) {
+			const set = subsByCollection.get(sub.collection);
+			if (set) {
+				set.delete(client);
+				if (set.size === 0) subsByCollection.delete(sub.collection);
+			}
+		}
+		return;
+	}
+	sendError(client, void 0, "unknown_op", `unknown op: ${msg.op}`);
+}
+/**
+* Push a per-row delta to every subscriber of `collection`. Auto-crud
+* invokes this with raw (storage-shape) old/new rows; we decode through
+* the schema once and then run each sub's predicate against the decoded
+* row to compute the membership transition.
+*
+* Pass `oldRow=null` for inserts, `newRow=null` for deletes. For an update
+* pass both; if a sub's predicate flips one direction we emit insert /
+* delete deltas (the row entered or left the read set), if it stays on
+* both sides we emit update.
+*
+* Returns a Promise (same pattern as notifyCollectionChange) so callers
+* can fire-and-forget while tests await for determinism.
+*/
+function notifyRowChange(collection, kind, oldRowRaw, newRowRaw) {
+	if (!currentSchema) return Promise.resolve();
+	const col = currentSchema.collections[collection];
+	if (!col) return Promise.resolve();
+	const seq = nextSeq();
+	pushRing(collection, {
+		seq,
+		kind,
+		oldRowRaw,
+		newRowRaw
+	});
+	const set = subsByCollection.get(collection);
+	if (!set || set.size === 0) return Promise.resolve();
+	const oldRow = oldRowRaw ? decodeRow(oldRowRaw, col.fields) : null;
+	const newRow = newRowRaw ? decodeRow(newRowRaw, col.fields) : null;
+	const scoped = col.scope === "user";
+	const rowOwner = scoped ? newRowRaw?._owner ?? oldRowRaw?._owner ?? null : null;
+	const pending = [];
+	const targets = Array.from(set);
+	for (const client of targets) {
+		if (client.readyState !== 1) {
+			removeSubClient(client);
+			continue;
+		}
+		if (scoped) {
+			if (!client.ctx.userId || client.ctx.userId !== rowOwner) continue;
+		}
+		const subs = clients.get(client);
+		if (!subs) continue;
+		for (const sub of subs.values()) {
+			if (sub.collection !== collection) continue;
+			pending.push(dispatchDeltaWithSeq(client, sub, kind, oldRow, newRow, seq));
+		}
+	}
+	return Promise.allSettled(pending).then(() => void 0);
+}
+async function dispatchDeltaWithSeq(client, sub, kind, oldRow, newRow, seq) {
+	const match = sub.predicateJs;
+	const was = oldRow ? match ? match(oldRow) : true : false;
+	const now = newRow ? match ? match(newRow) : true : false;
+	if (kind === "insert") {
+		if (now) {
+			emitDelta(client, sub, "insert", newRow, seq);
+			return true;
+		}
+		return false;
+	}
+	if (kind === "delete") {
+		if (was) {
+			const id = oldRow.id;
+			sendMessage(client, {
+				type: "delta",
+				subId: sub.subId,
+				collection: sub.collection,
+				seq,
+				op: "delete",
+				id
+			});
+			return true;
+		}
+		return false;
+	}
+	if (!was && now) {
+		emitDelta(client, sub, "insert", newRow, seq);
+		return true;
+	}
+	if (was && now) {
+		emitDelta(client, sub, "update", newRow, seq);
+		return true;
+	}
+	if (was && !now) {
+		const id = oldRow.id;
+		sendMessage(client, {
+			type: "delta",
+			subId: sub.subId,
+			collection: sub.collection,
+			seq,
+			op: "delete",
+			id
+		});
+		return true;
+	}
+	return false;
+}
+function emitDelta(client, sub, op, row, seq) {
+	sendMessage(client, {
+		type: "delta",
+		subId: sub.subId,
+		collection: sub.collection,
+		seq,
+		op,
+		row
+	});
+}
+/**
+* Coarse fan-out fallback: re-push the entire snapshot to every subscriber
+* of `collection`. Used by user-authored raw-SQL handlers that mutate
+* outside auto-crud — auto-crud itself prefers notifyRowChange. Kept for
+* back-compat; calling this is strictly less efficient than the delta
+* path but always correct.
+*/
+function notifyCollectionChange(collection) {
+	const set = subsByCollection.get(collection);
+	if (!set || set.size === 0) return Promise.resolve();
+	const targets = Array.from(set);
+	const pending = [];
+	for (const client of targets) {
+		if (client.readyState !== 1) {
+			removeSubClient(client);
+			continue;
+		}
+		const subs = clients.get(client);
+		if (!subs) continue;
+		for (const sub of subs.values()) {
+			if (sub.collection !== collection) continue;
+			pending.push(sendSnapshot(client, sub));
+		}
+	}
+	return Promise.allSettled(pending).then(() => void 0);
+}
+async function sendSnapshot(client, sub) {
+	const db = getDbInstance();
+	if (!db) {
+		sendError(client, sub.subId, "db_not_ready", "db not initialized");
+		return;
+	}
+	if (!currentSchema) {
+		sendError(client, sub.subId, "no_schema", "schema not registered");
+		return;
+	}
+	const col = currentSchema.collections[sub.collection];
+	if (!col) {
+		sendError(client, sub.subId, "unknown_collection", `no such collection: ${sub.collection}`);
+		return;
+	}
+	const scoped = col.scope === "user";
+	const conditions = [];
+	const params = [];
+	if (scoped) {
+		if (!client.ctx.userId) {
+			sendError(client, sub.subId, "auth_required", `scoped collection "${sub.collection}" requires an authenticated user`);
+			return;
+		}
+		conditions.push("_owner = ?");
+		params.push(client.ctx.userId);
+	}
+	if (sub.predicate) {
+		if (!predicateColumnsExist(sub.predicate, col.fields)) {
+			sendError(client, sub.subId, "bad_predicate", "predicate references unknown column");
+			return;
+		}
+		const compiled = compileToSql(sub.predicate);
+		conditions.push(compiled.sql);
+		params.push(...compiled.params);
+	}
+	const where = conditions.length ? `WHERE ${conditions.join(" AND ")}` : "";
+	try {
+		const rows = db.raw().prepare(`SELECT * FROM ${sub.collection} ${where} ORDER BY created_at DESC`).all(...params).map((r) => decodeRow(r, col.fields));
+		sendMessage(client, {
+			type: "snapshot",
+			subId: sub.subId,
+			collection: sub.collection,
+			seq: seqCounter,
+			rows
+		});
+	} catch (err) {
+		sendError(client, sub.subId, "snapshot_failed", err.message ?? String(err));
+	}
+}
+function canResumeFrom(collection, fromSeq) {
+	const ring = ringByCollection.get(collection);
+	if (!ring || ring.length === 0) return fromSeq <= seqCounter;
+	const oldest = ring[0];
+	if (!oldest) return fromSeq <= seqCounter;
+	return fromSeq >= oldest.seq - 1;
+}
+async function sendResumeReplay(client, sub, fromSeq) {
+	if (!currentSchema) {
+		sendError(client, sub.subId, "no_schema", "schema not registered");
+		return;
+	}
+	const col = currentSchema.collections[sub.collection];
+	if (!col) {
+		sendError(client, sub.subId, "unknown_collection", `no such collection: ${sub.collection}`);
+		return;
+	}
+	const ring = ringByCollection.get(sub.collection) ?? [];
+	let replayed = 0;
+	for (const entry of ring) {
+		if (entry.seq <= fromSeq) continue;
+		if (col.scope === "user") {
+			const owner = entry.newRowRaw?._owner ?? entry.oldRowRaw?._owner ?? null;
+			if (!client.ctx.userId || client.ctx.userId !== owner) continue;
+		}
+		const oldRow = entry.oldRowRaw ? decodeRow(entry.oldRowRaw, col.fields) : null;
+		const newRow = entry.newRowRaw ? decodeRow(entry.newRowRaw, col.fields) : null;
+		if (await dispatchDeltaWithSeq(client, sub, entry.kind, oldRow, newRow, entry.seq)) replayed += 1;
+	}
+	sendMessage(client, {
+		type: "resumed",
+		subId: sub.subId,
+		collection: sub.collection,
+		fromSeq,
+		toSeq: seqCounter,
+		replayed
+	});
+}
+const RESERVED = new Set([
+	"id",
+	"created_at",
+	"updated_at",
+	"_owner"
+]);
+function predicateColumnsExist(p, fields) {
+	switch (p.op) {
+		case "and":
+		case "or": return p.clauses.every((c) => predicateColumnsExist(c, fields));
+		case "not": return predicateColumnsExist(p.clause, fields);
+		default: return RESERVED.has(p.column) || p.column in fields;
+	}
+}
+function sendMessage(client, msg) {
+	if (client.readyState !== 1) {
+		removeSubClient(client);
+		return;
+	}
+	try {
+		client.send(JSON.stringify(msg));
+	} catch {
+		removeSubClient(client);
+	}
+}
+function sendError(client, subId, code, message) {
+	sendMessage(client, {
+		type: "error",
+		subId,
+		code,
+		message
+	});
+}
+//#endregion
+//#region src/db.ts
+const scopedTables = /* @__PURE__ */ new Set();
+function markScoped(table) {
+	scopedTables.add(table);
+}
+const RESERVED_COLUMNS = new Set([
+	"id",
+	"_owner",
+	"created_at",
+	"updated_at"
+]);
+const IDENTIFIER_RE = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
+function stripReserved(data) {
+	const out = {};
+	for (const [k, v] of Object.entries(data)) if (!RESERVED_COLUMNS.has(k)) out[k] = v;
+	return out;
+}
+/**
+* Thrown when a row-level operation on a user-scoped table is attempted with
+* no authenticated user in context. Caught by the apiHandler dispatcher and
+* turned into a 401 — letting the call through (the prior behaviour) silently
+* dropped the `_owner = ?` predicate and exposed every user's rows.
+*/
+var VibesAuthRequiredError = class extends Error {
+	table;
+	constructor(table) {
+		super(`[vibes:auth] scoped table "${table}" requires an authenticated user`);
+		this.name = "VibesAuthRequiredError";
+		this.table = table;
+	}
+};
+function openDb(path) {
+	const bun = new Database(path, { create: true });
+	bun.exec("PRAGMA journal_mode=WAL;");
+	function now() {
+		return (/* @__PURE__ */ new Date()).toISOString();
+	}
+	function getOwner() {
+		return ctxStore.getStore()?.userId ?? null;
+	}
+	function isScoped(table) {
+		return scopedTables.has(table);
+	}
+	const db = {
+		async getAll(table, opts = {}) {
+			const conditions = [];
+			const params = [];
+			if (isScoped(table)) {
+				const owner = getOwner();
+				if (!owner) throw new VibesAuthRequiredError(table);
+				conditions.push("_owner = ?");
+				params.push(owner);
+			}
+			const where = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
+			let orderClause = "ORDER BY created_at DESC";
+			if (opts.orderBy) {
+				if (!IDENTIFIER_RE.test(opts.orderBy)) throw new Error(`[vibes] getAll: invalid orderBy column: ${opts.orderBy}`);
+				const dir = opts.orderDir === "DESC" ? "DESC" : "ASC";
+				orderClause = `ORDER BY ${opts.orderBy} ${dir}`;
+			}
+			const limit = Number.isInteger(opts.limit) && opts.limit >= 0 ? `LIMIT ${opts.limit}` : "";
+			const offset = Number.isInteger(opts.offset) && opts.offset >= 0 ? `OFFSET ${opts.offset}` : "";
+			const sql = `SELECT * FROM ${table} ${where} ${orderClause} ${limit} ${offset}`.trim();
+			return bun.prepare(sql).all(...params);
+		},
+		async get(table, id) {
+			const conditions = ["id = ?"];
+			const params = [id];
+			if (isScoped(table)) {
+				const owner = getOwner();
+				if (!owner) throw new VibesAuthRequiredError(table);
+				conditions.push("_owner = ?");
+				params.push(owner);
+			}
+			const sql = `SELECT * FROM ${table} WHERE ${conditions.join(" AND ")} LIMIT 1`;
+			return bun.prepare(sql).get(...params) ?? null;
+		},
+		async insert(table, data) {
+			const id = crypto.randomUUID();
+			const ts = now();
+			const record = {
+				...stripReserved(data),
+				id,
+				created_at: ts,
+				updated_at: ts
+			};
+			if (isScoped(table)) {
+				const owner = getOwner();
+				if (!owner) throw new VibesAuthRequiredError(table);
+				record._owner = owner;
+			}
+			const columns = Object.keys(record);
+			const placeholders = columns.map(() => "?").join(", ");
+			const values = Object.values(record);
+			const sql = `INSERT INTO ${table} (${columns.join(", ")}) VALUES (${placeholders})`;
+			bun.prepare(sql).run(...values);
+			invalidate(table);
+			notifyRowChange(table, "insert", null, record);
+			return record;
+		},
+		async update(table, id, data) {
+			const existing = await db.get(table, id);
+			if (!existing) return null;
+			const updates = {
+				...stripReserved(data),
+				updated_at: now()
+			};
+			const setClauses = Object.keys(updates).map((k) => `${k} = ?`).join(", ");
+			const values = [...Object.values(updates), id];
+			let sql = `UPDATE ${table} SET ${setClauses} WHERE id = ?`;
+			if (isScoped(table)) {
+				const owner = getOwner();
+				if (!owner) throw new VibesAuthRequiredError(table);
+				sql += " AND _owner = ?";
+				values.push(owner);
+			}
+			bun.prepare(sql).run(...values);
+			const updated = {
+				...existing,
+				...updates
+			};
+			invalidate(table);
+			notifyRowChange(table, "update", existing, updated);
+			return updated;
+		},
+		async delete(table, id) {
+			const existing = await db.get(table, id);
+			if (!existing) return false;
+			const conditions = ["id = ?"];
+			const params = [id];
+			if (isScoped(table)) {
+				const owner = getOwner();
+				if (!owner) throw new VibesAuthRequiredError(table);
+				conditions.push("_owner = ?");
+				params.push(owner);
+			}
+			const sql = `DELETE FROM ${table} WHERE ${conditions.join(" AND ")}`;
+			const deleted = (bun.prepare(sql).run(...params).changes ?? 0) > 0;
+			if (deleted) {
+				invalidate(table);
+				notifyRowChange(table, "delete", existing, null);
+			}
+			return deleted;
+		},
+		raw() {
+			return bun;
+		},
+		close() {
+			bun.close();
+		}
+	};
+	return db;
+}
+let _dbInstance = null;
+const dbProxy = new Proxy({}, { get(_target, prop) {
+	if (!_dbInstance) throw new Error(`[vibes] db not initialized. Call createVibesServer() before using db.`);
+	return _dbInstance[prop];
+} });
+function setDbInstance(instance) {
+	_dbInstance = instance;
+}
+function getDbInstance() {
+	return _dbInstance;
+}
+//#endregion
+//#region src/migrator.ts
+/**
+* Register which tables are user-scoped so db.ts filters by _owner.
+* MUST be called at runtime even when migrations are skipped — otherwise
+* scoped collections silently leak data across users.
+*/
+function registerScopes(schema) {
+	for (const [tableName, col] of Object.entries(schema.collections)) if (col.scope === "user") markScoped(tableName);
+}
+function migrate(bunDb, schema) {
+	console.log("[vibes:migrator] Running migrations...");
+	registerScopes(schema);
+	const existingTablesResult = bunDb.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%'").all();
+	const existingTableNames = new Set(existingTablesResult.map((r) => r.name));
+	const oldCollections = {};
+	for (const tableName of existingTableNames) {
+		const columns = bunDb.prepare(`PRAGMA table_info(${tableName})`).all();
+		const userFields = {};
+		for (const col of columns) {
+			if ([
+				"id",
+				"created_at",
+				"updated_at",
+				"_owner"
+			].includes(col.name)) continue;
+			userFields[col.name] = { type: "string" };
+		}
+		oldCollections[tableName] = {
+			fields: userFields,
+			scope: "global",
+			indexes: [],
+			uniqueIndexes: []
+		};
+	}
+	const oldSchema = { collections: oldCollections };
+	if (existingTableNames.size === 0) {
+		const sqls = schemaToSQL(schema);
+		for (const sql of sqls) {
+			console.log(`[vibes:migrator] Executing: ${sql.split("\n")[0]}...`);
+			bunDb.exec(sql);
+		}
+		console.log("[vibes:migrator] Initial migration complete.");
+		return;
+	}
+	for (const [tableName, col] of Object.entries(schema.collections)) {
+		if (col.scope !== "user") continue;
+		if (!existingTableNames.has(tableName)) continue;
+		if (bunDb.prepare(`PRAGMA table_info(${tableName})`).all().some((c) => c.name === "_owner")) continue;
+		console.log(`[vibes:migrator] ADD COLUMN ${tableName}._owner (scope→user)`);
+		bunDb.exec(`ALTER TABLE ${tableName} ADD COLUMN _owner TEXT`);
+	}
+	const migrations = schemaDiff(oldSchema, schema);
+	if (migrations.length === 0) {
+		console.log("[vibes:migrator] Schema is up to date.");
+		return;
+	}
+	for (const migration of migrations) switch (migration.type) {
+		case "create_table": {
+			const sqls = schemaToSQL({ collections: { [migration.table]: schema.collections[migration.table] } });
+			for (const sql of sqls) {
+				console.log(`[vibes:migrator] CREATE TABLE ${migration.table}`);
+				bunDb.exec(sql);
+			}
+			break;
+		}
+		case "add_column": {
+			const colType = fieldTypeToSQL(migration.field.type);
+			const sql = `ALTER TABLE ${migration.table} ADD COLUMN ${migration.column} ${colType}`;
+			console.log(`[vibes:migrator] ADD COLUMN ${migration.table}.${migration.column}`);
+			bunDb.exec(sql);
+			break;
+		}
+		case "drop_table":
+			console.warn(`[vibes:migrator] SKIP drop_table ${migration.table} — run manually if intended`);
+			break;
+		case "drop_column":
+			console.warn(`[vibes:migrator] SKIP drop_column ${migration.table}.${migration.column} — run manually if intended`);
+			break;
+		case "add_index": {
+			const indexName = `idx_${migration.table}_${migration.columns.join("_")}`;
+			const sql = `CREATE INDEX IF NOT EXISTS ${indexName} ON ${migration.table} (${migration.columns.join(", ")})`;
+			console.log(`[vibes:migrator] ADD INDEX ${indexName}`);
+			bunDb.exec(sql);
+			break;
+		}
+		case "add_unique_index": {
+			const indexName = `uidx_${migration.table}_${migration.columns.join("_")}`;
+			const sql = `CREATE UNIQUE INDEX IF NOT EXISTS ${indexName} ON ${migration.table} (${migration.columns.join(", ")})`;
+			console.log(`[vibes:migrator] ADD UNIQUE INDEX ${indexName}`);
+			bunDb.exec(sql);
+			break;
+		}
+	}
+	console.log(`[vibes:migrator] Applied ${migrations.length} migration(s).`);
+}
+function fieldTypeToSQL(type) {
+	if (type === "string") return "TEXT";
+	if (type === "number") return "REAL";
+	if (type === "boolean") return "INTEGER";
+	if (type === "date") return "TEXT";
+	if (typeof type === "object" && type !== null) return "TEXT";
+	return "TEXT";
+}
+//#endregion
+//#region src/http-error.ts
+/**
+* VibesHttpError — an expected, client-facing rejection with an explicit
+* HTTP status. Handlers (and the infra-API proxy helpers in the
+* control-plane) throw this instead of a bare Error when the failure is a
+* known refusal — ownership checks, validation against an upstream API,
+* upstream unavailability — rather than a bug.
+*
+* The dispatcher maps it to its status and, for 4xx, logs a one-liner
+* instead of a stack-bearing "Handler error in <name>" crash entry. A bare
+* Error keeps the existing 500-with-crash-log behavior.
+*/
+var VibesHttpError = class extends Error {
+	status;
+	constructor(status, message) {
+		super(message);
+		this.name = "VibesHttpError";
+		this.status = status;
+	}
+};
+//#endregion
+//#region src/dispatcher.ts
+function errorResponse(err, where) {
+	if (err instanceof VibesAuthRequiredError) return Response.json({ error: err.message }, { status: 401 });
+	if (err instanceof VibesHttpError && err.status < 500) {
+		console.warn(`[vibes:dispatcher] refused ${where}: ${err.message} (${err.status})`);
+		return Response.json({ error: err.message }, { status: err.status });
+	}
+	console.error(`[vibes:dispatcher] Handler error in ${where}:`, err);
+	const message = err instanceof Error ? err.message : "Internal server error";
+	const status = err instanceof VibesHttpError ? err.status : 500;
+	return Response.json({ error: message }, { status });
+}
+function loadRoutes(routesJson) {
+	return routesJson;
+}
+function matchPath(pattern, path) {
+	const patternParts = pattern.split("/");
+	const pathParts = path.split("/");
+	if (patternParts.length !== pathParts.length) return null;
+	const params = {};
+	for (let i = 0; i < patternParts.length; i++) {
+		const pp = patternParts[i];
+		const vp = pathParts[i];
+		if (pp.startsWith(":")) params[pp.slice(1)] = decodeURIComponent(vp);
+		else if (pp !== vp) return null;
+	}
+	return params;
+}
+const moduleCache = /* @__PURE__ */ new Map();
+async function loadModule(modulePath) {
+	if (moduleCache.has(modulePath)) return moduleCache.get(modulePath);
+	const mod = await import(modulePath);
+	moduleCache.set(modulePath, mod);
+	return mod;
+}
+function clearModuleCache() {
+	moduleCache.clear();
+}
+async function handleRequest(req, routes) {
+	const pathname = new URL(req.url).pathname;
+	let matchedRoute = null;
+	let pathParams = {};
+	for (const route of routes) {
+		if (route.method !== req.method) continue;
+		const params = matchPath(route.path, pathname);
+		if (params !== null) {
+			matchedRoute = route;
+			pathParams = params;
+			break;
+		}
+	}
+	if (!matchedRoute) return Response.json({ error: "Not found" }, { status: 404 });
+	if (matchedRoute.inlineHandler) try {
+		return await matchedRoute.inlineHandler(req, pathParams);
+	} catch (err) {
+		return errorResponse(err, `inline route ${matchedRoute.path}`);
+	}
+	const handlerName = matchedRoute.handler;
+	let mod;
+	if (matchedRoute.mod) mod = matchedRoute.mod;
+	else try {
+		mod = await loadModule(matchedRoute.module);
+	} catch (err) {
+		console.error(`[vibes:dispatcher] Failed to load module ${matchedRoute.module}:`, err);
+		return Response.json({ error: "Internal server error" }, { status: 500 });
+	}
+	const handler = mod[handlerName];
+	if (typeof handler !== "function") return Response.json({ error: `Handler "${handlerName}" not found in module` }, { status: 500 });
+	if (matchedRoute.style === "method") try {
+		const result = await handler(req, pathParams);
+		return result instanceof Response ? result : Response.json(result);
+	} catch (err) {
+		return errorResponse(err, handlerName);
+	}
+	let body = void 0;
+	if ([
+		"POST",
+		"PUT",
+		"PATCH"
+	].includes(req.method)) {
+		if ((req.headers.get("content-type") ?? "").includes("application/json")) try {
+			body = await req.json();
+		} catch {
+			return Response.json({ error: "Invalid JSON body" }, { status: 400 });
+		}
+	}
+	const args = [];
+	if (pathParams.id) args.push(pathParams.id);
+	if (body !== void 0) args.push(body);
+	try {
+		const result = await handler(...args);
+		return result instanceof Response ? result : Response.json(result);
+	} catch (err) {
+		return errorResponse(err, handlerName);
+	}
+}
+//#endregion
+//#region src/auto-crud.ts
+async function readJsonBody(req) {
+	if (!(req.headers.get("content-type") ?? "").includes("application/json")) return {};
+	const text = await req.text();
+	if (!text.trim()) return {};
+	try {
+		const parsed = JSON.parse(text);
+		return parsed && typeof parsed === "object" ? parsed : {};
+	} catch {
+		throw new Error("Invalid JSON body");
+	}
+}
+function jsonError(status, message) {
+	return Response.json({ error: message }, { status });
+}
+function getUserId() {
+	return ctxStore.getStore()?.userId ?? null;
+}
+function makeListHandler(name, fields, scoped) {
+	return async () => {
+		const db = getDbInstance();
+		if (!db) return jsonError(500, "db not initialized");
+		if (scoped) {
+			const userId = getUserId();
+			if (!userId) return jsonError(401, "Authentication required");
+			const rows = db.raw().prepare(`SELECT * FROM ${name} WHERE _owner = ? ORDER BY created_at DESC`).all(userId);
+			return Response.json(decodeRows(rows, fields));
+		}
+		const rows = db.raw().prepare(`SELECT * FROM ${name} ORDER BY created_at DESC`).all();
+		return Response.json(decodeRows(rows, fields));
+	};
+}
+function makeGetHandler(name, fields, scoped) {
+	return async (_req, params) => {
+		const db = getDbInstance();
+		if (!db) return jsonError(500, "db not initialized");
+		if (scoped) {
+			const userId = getUserId();
+			if (!userId) return jsonError(401, "Authentication required");
+			const row = db.raw().prepare(`SELECT * FROM ${name} WHERE id = ? AND _owner = ? LIMIT 1`).get(params.id, userId);
+			if (!row) return jsonError(404, "Not found");
+			return Response.json(decodeRow(row, fields));
+		}
+		const row = db.raw().prepare(`SELECT * FROM ${name} WHERE id = ? LIMIT 1`).get(params.id);
+		if (!row) return jsonError(404, "Not found");
+		return Response.json(decodeRow(row, fields));
+	};
+}
+function makeCreateHandler(name, fields, scoped) {
+	return async (req) => {
+		const db = getDbInstance();
+		if (!db) return jsonError(500, "db not initialized");
+		let userId = null;
+		if (scoped) {
+			userId = getUserId();
+			if (!userId) return jsonError(401, "Authentication required");
+		}
+		let body;
+		try {
+			body = await readJsonBody(req);
+		} catch (e) {
+			return jsonError(400, e.message);
+		}
+		const id = crypto.randomUUID();
+		const ts = (/* @__PURE__ */ new Date()).toISOString();
+		const record = {
+			id,
+			created_at: ts,
+			updated_at: ts
+		};
+		if (scoped) record._owner = userId;
+		for (const [k, def] of Object.entries(fields)) if (k in body) record[k] = encodeValue(def.type, body[k]);
+		const cols = Object.keys(record);
+		const placeholders = cols.map(() => "?").join(", ");
+		const values = Object.values(record);
+		db.raw().prepare(`INSERT INTO ${name} (${cols.join(", ")}) VALUES (${placeholders})`).run(...values);
+		invalidate(name);
+		notifyRowChange(name, "insert", null, record);
+		return Response.json(decodeRow(record, fields));
+	};
+}
+function makeUpdateHandler(name, fields, scoped) {
+	return async (req, params) => {
+		const db = getDbInstance();
+		if (!db) return jsonError(500, "db not initialized");
+		let userId = null;
+		if (scoped) {
+			userId = getUserId();
+			if (!userId) return jsonError(401, "Authentication required");
+		}
+		let body;
+		try {
+			body = await readJsonBody(req);
+		} catch (e) {
+			return jsonError(400, e.message);
+		}
+		const existing = db.raw().prepare(`SELECT * FROM ${name} WHERE id = ? LIMIT 1`).get(params.id);
+		if (!existing) return jsonError(404, "Not found");
+		if (scoped && existing._owner !== userId) return jsonError(404, "Not found");
+		const updates = {};
+		for (const [k, v] of Object.entries(body)) {
+			if (k === "id" || k === "created_at" || k === "updated_at" || k === "_owner") continue;
+			if (!(k in fields)) return jsonError(400, `Unknown column: ${k}`);
+			updates[k] = encodeValue(fields[k].type, v);
+		}
+		updates.updated_at = (/* @__PURE__ */ new Date()).toISOString();
+		const setClauses = Object.keys(updates).map((k) => `${k} = ?`).join(", ");
+		const values = [...Object.values(updates), params.id];
+		db.raw().prepare(`UPDATE ${name} SET ${setClauses} WHERE id = ?`).run(...values);
+		const merged = {
+			...existing,
+			...updates
+		};
+		invalidate(name);
+		notifyRowChange(name, "update", existing, merged);
+		return Response.json(decodeRow(merged, fields));
+	};
+}
+function makeRemoveHandler(name, scoped) {
+	return async (_req, params) => {
+		const db = getDbInstance();
+		if (!db) return jsonError(500, "db not initialized");
+		const existing = db.raw().prepare(`SELECT * FROM ${name} WHERE id = ? LIMIT 1`).get(params.id);
+		if (!existing) return jsonError(404, "Not found");
+		if (scoped) {
+			const userId = getUserId();
+			if (!userId) return jsonError(401, "Authentication required");
+			if (existing._owner !== userId) return jsonError(404, "Not found");
+		}
+		db.raw().prepare(`DELETE FROM ${name} WHERE id = ?`).run(params.id);
+		invalidate(name);
+		notifyRowChange(name, "delete", existing, null);
+		return new Response(null, { status: 204 });
+	};
+}
+function buildAutoCrudRoutes(schema) {
+	const routes = [];
+	for (const [name, col] of Object.entries(schema.collections)) {
+		const fields = col.fields;
+		const scoped = col.scope === "user";
+		routes.push({
+			method: "GET",
+			path: `/api/${name}`,
+			module: "<auto-crud>",
+			handler: "list",
+			inlineHandler: makeListHandler(name, fields, scoped)
+		});
+		routes.push({
+			method: "GET",
+			path: `/api/${name}/:id`,
+			module: "<auto-crud>",
+			handler: "get",
+			inlineHandler: makeGetHandler(name, fields, scoped)
+		});
+		routes.push({
+			method: "POST",
+			path: `/api/${name}`,
+			module: "<auto-crud>",
+			handler: "create",
+			inlineHandler: makeCreateHandler(name, fields, scoped)
+		});
+		routes.push({
+			method: "PATCH",
+			path: `/api/${name}/:id`,
+			module: "<auto-crud>",
+			handler: "update",
+			inlineHandler: makeUpdateHandler(name, fields, scoped)
+		});
+		routes.push({
+			method: "DELETE",
+			path: `/api/${name}/:id`,
+			module: "<auto-crud>",
+			handler: "remove",
+			inlineHandler: makeRemoveHandler(name, scoped)
+		});
+	}
+	return routes;
+}
+//#endregion
+//#region src/triggers.ts
+/**
+* Schedule a function to run on a cron expression (UTC, 5-field syntax).
+* The schedule must be a literal string — dynamic values will be rejected by
+* the build-time scanner so the orchestrator can register the trigger.
+*
+* Returns the handler unchanged so it can also be invoked directly in tests.
+*/
+function cron(schedule, handler) {
+	return handler;
+}
+/**
+* Subscribe a function to an event topic. The topic must be a literal string.
+*/
+function on(topic, handler) {
+	return handler;
+}
+/**
+* Emit an event. Mode-aware: posts to the orchestrator in prod; runs
+* subscribers in-process in dev.
+*
+* Payload is JSON-serialized; total size capped at 64 KB (matched against
+* the orchestrator-side limit).
+*/
+async function emit(topic, payload = null) {
+	if (vibesMode$1() === "dev") return emitInProcess(topic, payload);
+	return emitToOrchestrator(topic, payload);
+}
+/**
+* Schedule a one-shot delayed fire of `topic`. Same fan-out semantics as
+* `emit()` (every `on(topic, …)` subscriber receives one delivery), but
+* each delivery runs at `atMs` instead of immediately.
+*
+* `atMs` is unix milliseconds. Past timestamps fire ASAP. The orchestrator
+* caps the future horizon at 365 days.
+*
+* Returns `{ eventId, subscriberCount, scheduledFor }`. Hold onto `eventId`
+* if you might need to `cancel(eventId)` before it fires.
+*
+* Example:
+*   const { eventId } = await schedule(reminder.dueAt, "reminder.due", { id })
+*   // …later, if user deletes the reminder:
+*   await cancel(eventId)
+*/
+async function schedule(atMs, topic, payload = null) {
+	if (!Number.isFinite(atMs) || atMs < 0) throw new Error(`schedule("${topic}"): at must be a unix-ms number`);
+	if (!topic || typeof topic !== "string") throw new Error("schedule: topic required");
+	if (vibesMode$1() === "dev") return scheduleInProcess(atMs, topic, payload);
+	return scheduleToOrchestrator(atMs, topic, payload);
+}
+/**
+* Cancel the pending deliveries created by a previous `schedule()`. At-most-
+* once semantics: anything already claimed or fired is past the cancel
+* window and is left untouched.
+*
+* Returns `{ cancelled }`, the number of pending deliveries dropped. Zero
+* is a valid response meaning "nothing left to cancel" (already fired, or
+* never scheduled with this eventId).
+*/
+async function cancel(eventId) {
+	if (!eventId || typeof eventId !== "string") throw new Error("cancel: eventId required");
+	if (vibesMode$1() === "dev") return cancelInProcess(eventId);
+	return cancelOnOrchestrator(eventId);
+}
+const triggerRegistry = /* @__PURE__ */ new Map();
+const topicSubscribers = /* @__PURE__ */ new Map();
+const storageHookHandlers = /* @__PURE__ */ new Map();
+const cronIntervals = /* @__PURE__ */ new Map();
+let _cronDriver = null;
+function setCronDriver(driver) {
+	if (driver !== "orchestrator" && driver !== "in-process") throw new Error(`[vibes:triggers] unknown cron driver ${JSON.stringify(driver)} — expected "orchestrator" or "in-process"`);
+	_cronDriver = driver;
+}
+function cronDriver() {
+	if (_cronDriver) return _cronDriver;
+	const env = (typeof process !== "undefined" ? process.env?.VIBES_CRON_DRIVER : void 0) ?? "";
+	if (env === "") return "orchestrator";
+	if (env !== "orchestrator" && env !== "in-process") throw new Error(`[vibes:triggers] unknown VIBES_CRON_DRIVER ${JSON.stringify(env)} — expected "orchestrator" or "in-process"`);
+	return env;
+}
+/** Clear everything — called on HMR reload. */
+function clearTriggers() {
+	for (const interval of cronIntervals.values()) clearInterval(interval);
+	cronIntervals.clear();
+	triggerRegistry.clear();
+	topicSubscribers.clear();
+	storageHookHandlers.clear();
+}
+/** Load triggers from .vibes/triggers.json (called at createVibesServer boot). */
+async function loadTriggersFromFile(root) {
+	const triggersPath = path.join(root, ".vibes", "triggers.json");
+	if (!fs.existsSync(triggersPath)) return [];
+	try {
+		const raw = fs.readFileSync(triggersPath, "utf-8");
+		const parsed = JSON.parse(raw);
+		return Array.isArray(parsed) ? parsed : [];
+	} catch (err) {
+		console.error("[vibes:triggers] failed to read triggers.json:", err);
+		return [];
+	}
+}
+/**
+* Populate the registry from a parsed trigger list. Either resolves each
+* handler via dynamic import (dev) or reads it from the preloaded `mod`
+* field (prod bundle). Idempotent.
+*/
+async function registerTriggers(entries) {
+	clearTriggers();
+	for (const e of entries) {
+		let fn;
+		if (e.mod) fn = e.mod[e.exportName];
+		else try {
+			fn = (await import(e.module))[e.exportName];
+		} catch (err) {
+			console.error(`[vibes:triggers] import ${e.module}#${e.exportName} failed:`, err);
+			continue;
+		}
+		if (typeof fn !== "function") {
+			console.error(`[vibes:triggers] ${e.module}#${e.exportName} is not a function (got ${typeof fn}) — skipping`);
+			continue;
+		}
+		triggerRegistry.set(e.handler, {
+			entry: e,
+			fn
+		});
+		if (e.kind === "on") {
+			if (!topicSubscribers.has(e.key)) topicSubscribers.set(e.key, /* @__PURE__ */ new Set());
+			topicSubscribers.get(e.key).add(e.handler);
+		} else if (e.kind === "storage:upload" || e.kind === "storage:delete") {
+			if (!storageHookHandlers.has(e.kind)) storageHookHandlers.set(e.kind, /* @__PURE__ */ new Set());
+			storageHookHandlers.get(e.kind).add(e.handler);
+		}
+	}
+	const inProcessCron = vibesMode$1() === "dev" || cronDriver() === "in-process";
+	if (inProcessCron) scheduleAllCronInProcess();
+	console.log(`[vibes:triggers] registered ${entries.length} trigger(s) — mode=${vibesMode$1()}, cron=${inProcessCron ? "in-process" : "orchestrator"}`);
+}
+/** Snapshot of the registry — used by the in-dev Inspect endpoints. */
+function listTriggers() {
+	return Array.from(triggerRegistry.values()).map(({ entry }) => ({
+		handler: entry.handler,
+		kind: entry.kind,
+		key: entry.key
+	}));
+}
+/**
+* Fan out a storage event to every registered `storage.onUpload` /
+* `onDelete` handler. Called by the auto-injected /api/_storage/notify
+* route after a successful PUT/DELETE round-trips back from the browser.
+*
+* Handlers run in-process (no orchestrator dispatcher round-trip) — the
+* notify is best-effort fire-and-forget from the SDK's perspective. A
+* dropped notify means the hook doesn't fire; the storage object itself
+* is unaffected.
+*
+* Returns the number of handlers invoked. Each handler's failure is
+* logged but doesn't bubble — one bad handler shouldn't block siblings.
+*/
+async function dispatchStorageEvent(kind, evt) {
+	const names = storageHookHandlers.get(kind);
+	if (!names || names.size === 0) return 0;
+	let fired = 0;
+	await Promise.all(Array.from(names).map(async (name) => {
+		const resolved = triggerRegistry.get(name);
+		if (!resolved) return;
+		try {
+			const handler = resolved.fn;
+			const payload = kind === "storage:upload" ? {
+				kind: "upload",
+				key: evt.key,
+				size: evt.size ?? 0,
+				contentType: evt.contentType ?? "",
+				userId: evt.userId ?? null
+			} : {
+				kind: "delete",
+				key: evt.key,
+				userId: evt.userId ?? null
+			};
+			await handler({
+				userId: evt.userId ?? null,
+				system: true
+			}, payload);
+			fired++;
+		} catch (err) {
+			console.error(`[vibes:storage] handler ${name} threw:`, err);
+		}
+	}));
+	return fired;
+}
+/**
+* Invoke a registered handler. Returns a Response so the agent can pass
+* it back to the orchestrator dispatcher loop, which keys retry/done on
+* the status code.
+*/
+async function dispatchHandler(body) {
+	const resolved = triggerRegistry.get(body.handler);
+	if (!resolved) return new Response(JSON.stringify({ error: `unknown handler: ${body.handler}` }), {
+		status: 404,
+		headers: { "Content-Type": "application/json" }
+	});
+	let payload = null;
+	if (body.payload && body.payload !== "null") try {
+		payload = JSON.parse(body.payload);
+	} catch (err) {
+		return new Response(JSON.stringify({ error: `payload parse: ${err.message}` }), {
+			status: 400,
+			headers: { "Content-Type": "application/json" }
+		});
+	}
+	try {
+		await ctxStore.run({
+			userId: null,
+			system: true
+		}, async () => {
+			if (resolved.entry.kind === "cron") await resolved.fn({
+				userId: null,
+				system: true
+			});
+			else await resolved.fn({
+				userId: null,
+				system: true
+			}, payload);
+		});
+		return new Response(JSON.stringify({ ok: true }), {
+			status: 200,
+			headers: { "Content-Type": "application/json" }
+		});
+	} catch (err) {
+		const msg = err instanceof Error ? err.message : String(err);
+		console.error(`[vibes:triggers] handler ${body.handler} threw:`, err);
+		return new Response(JSON.stringify({ error: msg }), {
+			status: 500,
+			headers: { "Content-Type": "application/json" }
+		});
+	}
+}
+const MAX_EMIT_BYTES = 64 * 1024;
+const DEV_EMIT_RING = 200;
+const recentDevEmits = [];
+const recentDevDeliveries = [];
+function pushBounded(arr, v, max) {
+	arr.unshift(v);
+	if (arr.length > max) arr.length = max;
+}
+function emitInProcess(topic, payload) {
+	if (JSON.stringify(payload ?? null).length > MAX_EMIT_BYTES) throw new Error(`emit("${topic}"): payload exceeds ${MAX_EMIT_BYTES} bytes`);
+	const subs = topicSubscribers.get(topic);
+	const subList = subs ? Array.from(subs) : [];
+	const ev = {
+		id: `evt_dev_${Date.now()}_${Math.floor(Math.random() * 4096).toString(16)}`,
+		topic,
+		payload,
+		subscriberCount: subList.length,
+		createdAt: Date.now()
+	};
+	pushBounded(recentDevEmits, ev, DEV_EMIT_RING);
+	for (const handler of subList) {
+		const resolved = triggerRegistry.get(handler);
+		if (!resolved) continue;
+		const start = Date.now();
+		(async () => {
+			try {
+				await resolved.fn({
+					userId: null,
+					system: true
+				}, payload);
+				pushBounded(recentDevDeliveries, {
+					id: `dlv_dev_${start}_${Math.floor(Math.random() * 4096).toString(16)}`,
+					eventId: ev.id,
+					handler,
+					status: "done",
+					attempts: 1,
+					createdAt: start,
+					runAt: start,
+					doneAt: Date.now()
+				}, DEV_EMIT_RING);
+			} catch (err) {
+				pushBounded(recentDevDeliveries, {
+					id: `dlv_dev_${start}_${Math.floor(Math.random() * 4096).toString(16)}`,
+					eventId: ev.id,
+					handler,
+					status: "failed",
+					attempts: 1,
+					lastError: err instanceof Error ? err.message : String(err),
+					createdAt: start,
+					runAt: start,
+					doneAt: Date.now()
+				}, DEV_EMIT_RING);
+				console.error(`[vibes:triggers] dev emit ${topic} → ${handler} threw:`, err);
+			}
+		})();
+	}
+	return { subscriberCount: subList.length };
+}
+async function emitToOrchestrator(topic, payload) {
+	const payloadStr = JSON.stringify(payload ?? null);
+	if (payloadStr.length > MAX_EMIT_BYTES) throw new Error(`emit("${topic}"): payload exceeds ${MAX_EMIT_BYTES} bytes`);
+	const res = await fetch("http://localhost:8080/_emit", {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify({
+			topic,
+			payload: JSON.parse(payloadStr)
+		})
+	});
+	if (!res.ok) {
+		const text = await res.text().catch(() => "");
+		throw new Error(`emit("${topic}") agent ${res.status}: ${text.slice(0, 200)}`);
+	}
+	return { subscriberCount: (await res.json()).subscriberCount ?? 0 };
+}
+const pendingScheduledFires = /* @__PURE__ */ new Map();
+function devId$1(prefix) {
+	return `${prefix}_dev_${Date.now()}_${Math.floor(Math.random() * 4096).toString(16)}`;
+}
+function scheduleInProcess(atMs, topic, payload) {
+	if (JSON.stringify(payload ?? null).length > MAX_EMIT_BYTES) throw new Error(`schedule("${topic}"): payload exceeds ${MAX_EMIT_BYTES} bytes`);
+	const subs = topicSubscribers.get(topic);
+	const subList = subs ? Array.from(subs) : [];
+	const eventId = devId$1("evt");
+	const now = Date.now();
+	pushBounded(recentDevEmits, {
+		id: eventId,
+		topic,
+		payload,
+		subscriberCount: subList.length,
+		createdAt: now
+	}, DEV_EMIT_RING);
+	const deliveryIds = [];
+	for (const handler of subList) {
+		const id = devId$1("dlv");
+		deliveryIds.push(id);
+		pushBounded(recentDevDeliveries, {
+			id,
+			eventId,
+			handler,
+			status: "pending",
+			attempts: 0,
+			createdAt: now,
+			runAt: atMs
+		}, DEV_EMIT_RING);
+	}
+	const delay = Math.max(0, atMs - now);
+	const timer = setTimeout(() => {
+		pendingScheduledFires.delete(eventId);
+		for (let i = 0; i < subList.length; i++) {
+			const handler = subList[i];
+			const id = deliveryIds[i];
+			const resolved = triggerRegistry.get(handler);
+			if (!resolved) continue;
+			const startedAt = Date.now();
+			(async () => {
+				try {
+					await resolved.fn({
+						userId: null,
+						system: true
+					}, payload);
+					updateDevDelivery(id, {
+						status: "done",
+						attempts: 1,
+						doneAt: Date.now(),
+						runAt: startedAt
+					});
+				} catch (err) {
+					updateDevDelivery(id, {
+						status: "failed",
+						attempts: 1,
+						doneAt: Date.now(),
+						runAt: startedAt,
+						lastError: err instanceof Error ? err.message : String(err)
+					});
+					console.error(`[vibes:triggers] dev schedule ${topic} → ${handler} threw:`, err);
+				}
+			})();
+		}
+	}, delay);
+	pendingScheduledFires.set(eventId, {
+		timer,
+		topic,
+		payload,
+		fireAt: atMs,
+		deliveryIds
+	});
+	return {
+		eventId,
+		subscriberCount: subList.length,
+		scheduledFor: atMs
+	};
+}
+function cancelInProcess(eventId) {
+	const pending = pendingScheduledFires.get(eventId);
+	if (!pending) return { cancelled: 0 };
+	clearTimeout(pending.timer);
+	pendingScheduledFires.delete(eventId);
+	const ids = new Set(pending.deliveryIds);
+	for (let i = recentDevDeliveries.length - 1; i >= 0; i--) if (ids.has(recentDevDeliveries[i].id)) recentDevDeliveries.splice(i, 1);
+	return { cancelled: pending.deliveryIds.length };
+}
+function updateDevDelivery(id, patch) {
+	const i = recentDevDeliveries.findIndex((d) => d.id === id);
+	if (i < 0) return;
+	recentDevDeliveries[i] = {
+		...recentDevDeliveries[i],
+		...patch
+	};
+}
+async function scheduleToOrchestrator(atMs, topic, payload) {
+	const payloadStr = JSON.stringify(payload ?? null);
+	if (payloadStr.length > MAX_EMIT_BYTES) throw new Error(`schedule("${topic}"): payload exceeds ${MAX_EMIT_BYTES} bytes`);
+	const res = await fetch("http://localhost:8080/_schedule", {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify({
+			topic,
+			payload: JSON.parse(payloadStr),
+			runAt: atMs
+		})
+	});
+	if (!res.ok) {
+		const text = await res.text().catch(() => "");
+		throw new Error(`schedule("${topic}") agent ${res.status}: ${text.slice(0, 200)}`);
+	}
+	const body = await res.json();
+	return {
+		eventId: body.eventId ?? "",
+		subscriberCount: body.subscriberCount ?? 0,
+		scheduledFor: body.runAt ?? atMs
+	};
+}
+async function cancelOnOrchestrator(eventId) {
+	const url = `http://localhost:8080/_schedule/${encodeURIComponent(eventId)}`;
+	const res = await fetch(url, { method: "DELETE" });
+	if (!res.ok) {
+		const text = await res.text().catch(() => "");
+		throw new Error(`cancel(${eventId}) agent ${res.status}: ${text.slice(0, 200)}`);
+	}
+	return { cancelled: (await res.json()).cancelled ?? 0 };
+}
+function scheduleAllCronInProcess() {
+	for (const interval of cronIntervals.values()) clearInterval(interval);
+	cronIntervals.clear();
+	for (const { entry } of triggerRegistry.values()) {
+		if (entry.kind !== "cron") continue;
+		scheduleOneCron(entry.handler, entry.key);
+	}
+}
+function scheduleOneCron(handlerName, expr) {
+	const tickFn = async () => {
+		const resolved = triggerRegistry.get(handlerName);
+		if (!resolved) return;
+		const start = Date.now();
+		try {
+			await resolved.fn({
+				userId: null,
+				system: true
+			});
+			pushBounded(recentDevDeliveries, {
+				id: `dlv_dev_${start}_${Math.floor(Math.random() * 4096).toString(16)}`,
+				handler: handlerName,
+				status: "done",
+				attempts: 1,
+				createdAt: start,
+				runAt: start,
+				doneAt: Date.now()
+			}, DEV_EMIT_RING);
+		} catch (err) {
+			pushBounded(recentDevDeliveries, {
+				id: `dlv_dev_${start}_${Math.floor(Math.random() * 4096).toString(16)}`,
+				handler: handlerName,
+				status: "failed",
+				attempts: 1,
+				lastError: err instanceof Error ? err.message : String(err),
+				createdAt: start,
+				runAt: start,
+				doneAt: Date.now()
+			}, DEV_EMIT_RING);
+			console.error(`[vibes:triggers] dev cron ${handlerName} threw:`, err);
+		}
+	};
+	const reschedule = () => {
+		const next = nextCronTime(expr, /* @__PURE__ */ new Date());
+		if (!next) {
+			console.error(`[vibes:triggers] dev cron ${handlerName}: invalid expr ${expr}`);
+			return;
+		}
+		const wait = Math.max(0, next.getTime() - Date.now());
+		const timer = setTimeout(() => {
+			tickFn().finally(reschedule);
+		}, wait);
+		cronIntervals.set(handlerName, timer);
+	};
+	reschedule();
+}
+function nextCronTime(expr, after) {
+	try {
+		const fields = expr.trim().split(/\s+/);
+		if (fields.length !== 5) return null;
+		const matchers = fields.map((f, i) => parseField(f, FIELD_BOUNDS[i]));
+		let t = /* @__PURE__ */ new Date(after.getTime() + 6e4 - after.getTime() % 6e4);
+		const limit = t.getTime() + 4 * 365 * 24 * 60 * 60 * 1e3;
+		while (t.getTime() < limit) {
+			if (matchers[0](t.getUTCMinutes()) && matchers[1](t.getUTCHours()) && matchers[2](t.getUTCDate()) && matchers[3](t.getUTCMonth() + 1) && matchers[4](t.getUTCDay())) return t;
+			t = new Date(t.getTime() + 6e4);
+		}
+		return null;
+	} catch {
+		return null;
+	}
+}
+const FIELD_BOUNDS = [
+	[0, 59],
+	[0, 23],
+	[1, 31],
+	[1, 12],
+	[0, 6]
+];
+function parseField(field, [lo, hi]) {
+	const allowed = /* @__PURE__ */ new Set();
+	for (const part of field.split(",")) if (part === "*") for (let i = lo; i <= hi; i++) allowed.add(i);
+	else if (part.includes("*/")) {
+		const [, stepStr] = part.split("*/");
+		const step = parseInt(stepStr, 10);
+		if (!Number.isFinite(step) || step <= 0) continue;
+		for (let i = lo; i <= hi; i += step) allowed.add(i);
+	} else if (part.includes("-")) {
+		const [a, b] = part.split("-").map((s) => parseInt(s, 10));
+		if (Number.isFinite(a) && Number.isFinite(b)) for (let i = a; i <= b; i++) allowed.add(i);
+	} else if (part.includes("/")) {
+		const [aStr, bStr] = part.split("/");
+		const a = parseInt(aStr, 10);
+		const b = parseInt(bStr, 10);
+		if (Number.isFinite(a) && Number.isFinite(b) && b > 0) for (let i = a; i <= hi; i += b) allowed.add(i);
+	} else {
+		const n = parseInt(part, 10);
+		if (Number.isFinite(n)) allowed.add(n);
+	}
+	return (v) => allowed.has(v);
+}
+let _vibesMode$1 = null;
+function vibesMode$1() {
+	if (_vibesMode$1) return _vibesMode$1;
+	_vibesMode$1 = ((typeof process !== "undefined" ? process.env?.VIBES_MODE : void 0) ?? "") === "dev" ? "dev" : "prod";
+	return _vibesMode$1;
+}
+function devInspectTriggers() {
+	return Array.from(triggerRegistry.values()).map(({ entry }, i) => ({
+		id: `trg_dev_${i}_${entry.handler}`,
+		kind: entry.kind,
+		key: entry.key,
+		handler: entry.handler,
+		version: 0,
+		nextFireAt: 0,
+		createdAt: 0
+	}));
+}
+function devInspectDeliveries() {
+	return recentDevDeliveries;
+}
+function devInspectEvents() {
+	return recentDevEmits;
+}
+//#endregion
+//#region src/workflows.ts
+/**
+* Declare a durable workflow. `name` must be a string literal — the
+* build-time scanner persists it so the orchestrator can register the
+* workflow endpoint with the engine. Returns the function unchanged so it
+* can be invoked directly in tests.
+*/
+function workflow(name, fn) {
+	return fn;
+}
+/**
+* Start a workflow run by name. Fire-and-forget: resolves with the run id
+* as soon as the engine has durably accepted the start, not when the run
+* completes. Payload is JSON-serialized, capped at 64 KB (same as emit()).
+*/
+async function startWorkflow(name, payload = null, opts = {}) {
+	if (!name || typeof name !== "string") throw new Error("startWorkflow: name required");
+	const payloadStr = JSON.stringify(payload ?? null);
+	if (payloadStr.length > MAX_WORKFLOW_PAYLOAD_BYTES) throw new Error(`startWorkflow("${name}"): payload exceeds ${MAX_WORKFLOW_PAYLOAD_BYTES} bytes`);
+	if (workflowMode() === "dev") return startInProcess(name, payload, opts);
+	return startViaAgent(name, payloadStr, opts);
+}
+const workflowRegistry = /* @__PURE__ */ new Map();
+function clearWorkflows() {
+	workflowRegistry.clear();
+}
+/** Load workflow entries from .vibes/workflows.json (dev boot path). */
+async function loadWorkflowsFromFile(root) {
+	const p = path.join(root, ".vibes", "workflows.json");
+	if (!fs.existsSync(p)) return [];
+	try {
+		const parsed = JSON.parse(fs.readFileSync(p, "utf-8"));
+		return Array.isArray(parsed) ? parsed : [];
+	} catch (err) {
+		console.error("[vibes:workflows] failed to read workflows.json:", err);
+		return [];
+	}
+}
+/**
+* Populate the registry. Resolves each workflow fn from the preloaded `mod`
+* (prod bundle) or via dynamic import (dev). Idempotent — called at boot
+* and on HMR reload.
+*/
+async function registerWorkflows(entries) {
+	clearWorkflows();
+	for (const e of entries) {
+		let fn;
+		if (e.mod) fn = e.mod[e.exportName];
+		else try {
+			fn = (await import(e.module))[e.exportName];
+		} catch (err) {
+			console.error(`[vibes:workflows] import ${e.module}#${e.exportName} failed:`, err);
+			continue;
+		}
+		if (typeof fn !== "function") {
+			console.error(`[vibes:workflows] ${e.module}#${e.exportName} is not a function — skipping`);
+			continue;
+		}
+		if (workflowRegistry.has(e.name)) throw new Error(`[vibes:workflows] duplicate workflow name "${e.name}" (${e.handler} vs ${workflowRegistry.get(e.name).entry.handler})`);
+		workflowRegistry.set(e.name, {
+			entry: e,
+			fn
+		});
+	}
+	if (entries.length > 0) console.log(`[vibes:workflows] registered ${workflowRegistry.size} workflow(s) — mode=${workflowMode()}`);
+}
+function listWorkflows() {
+	return Array.from(workflowRegistry.values()).map(({ entry }) => ({
+		name: entry.name,
+		handler: entry.handler
+	}));
+}
+const MAX_WORKFLOW_PAYLOAD_BYTES = 64 * 1024;
+let _mode = null;
+function workflowMode() {
+	if (_mode) return _mode;
+	_mode = ((typeof process !== "undefined" ? process.env?.VIBES_MODE : void 0) ?? "") === "dev" ? "dev" : "prod";
+	return _mode;
+}
+const DEV_RUN_RING = 200;
+const recentDevRuns = [];
+const devIdempotency = /* @__PURE__ */ new Map();
+function pushBoundedRun(run) {
+	recentDevRuns.unshift(run);
+	if (recentDevRuns.length > DEV_RUN_RING) recentDevRuns.length = DEV_RUN_RING;
+}
+function devId() {
+	return `run_dev_${Date.now()}_${Math.floor(Math.random() * 4096).toString(16)}`;
+}
+function startInProcess(name, payload, opts) {
+	const resolved = workflowRegistry.get(name);
+	if (!resolved) throw new Error(`startWorkflow("${name}"): unknown workflow — declare it as \`export const x = workflow("${name}", async (step, payload) => …)\` in functions/`);
+	if (opts.id) {
+		const existing = devIdempotency.get(opts.id);
+		if (existing) return { runId: existing };
+	}
+	const run = {
+		id: devId(),
+		name,
+		status: "running",
+		payload,
+		steps: [],
+		createdAt: Date.now()
+	};
+	if (opts.id) devIdempotency.set(opts.id, run.id);
+	pushBoundedRun(run);
+	const step = {
+		async run(stepName, fn) {
+			const s = {
+				name: stepName,
+				kind: "run",
+				status: "running",
+				startedAt: Date.now()
+			};
+			run.steps.push(s);
+			try {
+				const out = await fn();
+				Object.assign(s, {
+					status: "done",
+					doneAt: Date.now()
+				});
+				return out;
+			} catch (err) {
+				Object.assign(s, {
+					status: "failed",
+					doneAt: Date.now()
+				});
+				throw err;
+			}
+		},
+		async sleep(stepName, ms) {
+			const s = {
+				name: stepName,
+				kind: "sleep",
+				status: "running",
+				startedAt: Date.now()
+			};
+			run.steps.push(s);
+			await new Promise((resolve) => setTimeout(resolve, Math.max(0, ms)));
+			Object.assign(s, {
+				status: "done",
+				doneAt: Date.now()
+			});
+		}
+	};
+	ctxStore.run({
+		userId: null,
+		system: true
+	}, async () => {
+		try {
+			const result = await resolved.fn(step, payload);
+			run.status = "done";
+			run.result = result;
+			run.doneAt = Date.now();
+		} catch (err) {
+			run.status = "failed";
+			run.error = err instanceof Error ? err.message : String(err);
+			run.doneAt = Date.now();
+			console.error(`[vibes:workflows] dev run ${name} (${run.id}) failed:`, err);
+		}
+	});
+	return { runId: run.id };
+}
+/** Dev Inspect accessor — mirrors devInspectDeliveries() in triggers.ts. */
+function devInspectWorkflowRuns() {
+	return recentDevRuns;
+}
+const DEFAULT_IDENTITY_KEYS = ["publickeyv1_9w1Za94FAEiJ2LzArToAt7mCw6B8UnZYS4EQJkqJ1uZM"];
+function workflowServiceName(slug) {
+	return `wf_${slug.replace(/-/g, "_")}`;
+}
+let restateFetchHandler = null;
+/**
+* Build the Restate endpoint fetch handler for the registered workflows.
+* Called once at createVibesServer boot in prod when the app declares
+* workflows. Resolves the slug from VIBES_APP_SLUG (injected by the
+* orchestrator's startDeployServer) — fails loud when missing, because a
+* silently mis-named service would strand every run.
+*/
+async function buildWorkflowEndpoint() {
+	if (workflowMode() === "dev") return;
+	if (workflowRegistry.size === 0) return;
+	const slug = process.env.VIBES_APP_SLUG ?? "";
+	if (!slug) throw new Error("[vibes:workflows] VIBES_APP_SLUG not set but this deploy declares workflows — orchestrator must inject it (startDeployServer). Refusing to boot with a mis-named service.");
+	const [{ service }, { createEndpointHandler }] = await Promise.all([import("@restatedev/restate-sdk"), import("@restatedev/restate-sdk/fetch")]);
+	const handlers = {};
+	for (const { entry, fn } of workflowRegistry.values()) handlers[entry.name] = (ctx, payload) => ctxStore.run({
+		userId: null,
+		system: true
+	}, () => fn(makeRestateStepContext(ctx), payload));
+	const keysEnv = process.env.VIBES_WORKFLOW_IDENTITY_KEYS;
+	const identityKeys = keysEnv === "insecure" ? void 0 : keysEnv ? keysEnv.split(",").map((s) => s.trim()).filter(Boolean) : DEFAULT_IDENTITY_KEYS;
+	restateFetchHandler = createEndpointHandler({
+		services: [service({
+			name: workflowServiceName(slug),
+			handlers
+		})],
+		...identityKeys ? { identityKeys } : {}
+	});
+	console.log(`[vibes:workflows] Restate endpoint ready — service=${workflowServiceName(slug)} workflows=${workflowRegistry.size} identity=${identityKeys ? "verified" : "INSECURE"}`);
+}
+function makeRestateStepContext(ctx) {
+	return {
+		run(name, fn) {
+			return ctx.run(name, fn);
+		},
+		sleep(name, ms) {
+			return ctx.sleep(ms, name);
+		}
+	};
+}
+/**
+* Serve a request under /_vibes/workflow/*. Returns null when no endpoint
+* is mounted (no workflows, or dev mode — dev runs never go through
+* Restate). index.ts turns null into a 404.
+*/
+function handleWorkflowRequest(req) {
+	if (!restateFetchHandler) return null;
+	return restateFetchHandler(req);
+}
+async function startViaAgent(name, payloadStr, opts) {
+	const res = await fetch("http://localhost:8080/_workflow/start", {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify({
+			workflow: name,
+			payload: JSON.parse(payloadStr),
+			...opts.id ? { idempotencyKey: opts.id } : {}
+		})
+	});
+	if (!res.ok) {
+		const text = await res.text().catch(() => "");
+		throw new Error(`startWorkflow("${name}") agent ${res.status}: ${text.slice(0, 200)}`);
+	}
+	const body = await res.json();
+	if (!body.runId) throw new Error(`startWorkflow("${name}"): agent returned no runId`);
+	return { runId: body.runId };
+}
+//#endregion
+//#region src/storage.ts
+function onUpload(handler) {
+	return handler;
+}
+function onDelete(handler) {
+	return handler;
+}
+let _vibesMode = null;
+function vibesMode() {
+	if (_vibesMode) return _vibesMode;
+	_vibesMode = ((typeof process !== "undefined" ? process.env?.VIBES_MODE : void 0) ?? "") === "dev" ? "dev" : "prod";
+	return _vibesMode;
+}
+const KEY_RE = /^[a-zA-Z0-9._\-/]{1,256}$/;
+function validateKey(key) {
+	if (!KEY_RE.test(key)) throw new Error(`storage: invalid key ${JSON.stringify(key)}`);
+	if (key.includes("..") || key.startsWith("/") || key.includes("//")) throw new Error(`storage: key cannot contain traversal segments or empty parts`);
+}
+function resolveScope(scope, userId) {
+	if ((scope ?? "user") === "user") {
+		const resolved = userId ?? ctx.userId ?? "";
+		if (!resolved) throw new Error(`storage: scope="user" requires an authed user — pass storage.upload(...) from a route that's behind VibesAuthGuard or set scope:"app" explicitly.`);
+		return {
+			scope: "user",
+			userId: resolved
+		};
+	}
+	return {
+		scope: "app",
+		userId: ""
+	};
+}
+async function uploadUrl(opts) {
+	validateKey(opts.key);
+	const { scope, userId } = resolveScope(opts.scope, opts.userId);
+	if (vibesMode() === "dev") return devUploadUrl(opts.key, scope, userId, opts.contentType);
+	return prodPresign("put", opts.key, scope, userId, opts.contentType);
+}
+async function downloadUrl(key, opts = {}) {
+	validateKey(key);
+	const { scope, userId } = resolveScope(opts.scope, opts.userId);
+	if (vibesMode() === "dev") return devDownloadUrl(key, scope, userId);
+	const res = await prodPresign("get", key, scope, userId);
+	return {
+		url: res.url,
+		method: "GET",
+		key: res.key,
+		expiresAt: res.expiresAt
+	};
+}
+async function list(opts = {}) {
+	const { scope, userId } = resolveScope(opts.scope, opts.userId);
+	if (vibesMode() === "dev") return devList(scope, userId, opts.prefix ?? "");
+	return prodList(scope, userId, opts.prefix ?? "", opts.limit ?? 200);
+}
+async function del(key, opts = {}) {
+	validateKey(key);
+	const { scope, userId } = resolveScope(opts.scope, opts.userId);
+	if (vibesMode() === "dev") return devDelete(key, scope, userId);
+	return prodDelete(key, scope, userId);
+}
+const storage = {
+	uploadUrl,
+	downloadUrl,
+	list,
+	delete: del,
+	onUpload,
+	onDelete
+};
+const AGENT_BASE$1 = "http://localhost:8080";
+async function prodPresign(action, key, scope, userId, contentType) {
+	const res = await fetch(`${AGENT_BASE$1}/_storage/presign`, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify({
+			action,
+			key,
+			scope,
+			userId,
+			contentType
+		})
+	});
+	if (!res.ok) {
+		const text = await res.text().catch(() => "");
+		throw new Error(`storage.${action === "put" ? "uploadUrl" : "downloadUrl"}(${JSON.stringify(key)}) agent ${res.status}: ${text.slice(0, 200)}`);
+	}
+	const body = await res.json();
+	return {
+		url: body.url,
+		method: action === "put" ? "PUT" : "GET",
+		key: body.key,
+		expiresAt: body.expiresAt,
+		maxBytes: body.maxBytes ?? 25 * 1024 * 1024
+	};
+}
+async function prodList(scope, userId, prefix, limit) {
+	const res = await fetch(`${AGENT_BASE$1}/_storage/list`, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify({
+			scope,
+			userId,
+			prefix,
+			limit
+		})
+	});
+	if (!res.ok) {
+		const text = await res.text().catch(() => "");
+		throw new Error(`storage.list agent ${res.status}: ${text.slice(0, 200)}`);
+	}
+	return (await res.json()).map((o) => ({
+		key: o.key,
+		relPath: o.relPath,
+		size: o.size,
+		lastModified: o.lastModified,
+		contentType: o.contentType
+	}));
+}
+async function prodDelete(key, scope, userId) {
+	const res = await fetch(`${AGENT_BASE$1}/_storage/delete`, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify({
+			key,
+			scope,
+			userId
+		})
+	});
+	if (!res.ok && res.status !== 204) {
+		const text = await res.text().catch(() => "");
+		throw new Error(`storage.delete agent ${res.status}: ${text.slice(0, 200)}`);
+	}
+}
+function devRoot() {
+	return path.resolve(process.cwd(), ".vibes", "storage");
+}
+function devPath(scope, userId, key) {
+	const base = scope === "user" ? path.join("users", userId) : "app";
+	return path.join(devRoot(), base, key);
+}
+function devRelative(scope, userId, key) {
+	return scope === "user" ? `users/${userId}/${key}` : `app/${key}`;
+}
+const DEV_TOKEN_SECRET = process.env.VIBES_DEV_STORAGE_SECRET ?? "vibes-dev-storage";
+function devSignToken(rel, action, expiresAt) {
+	const h = crypto$1.createHmac("sha256", DEV_TOKEN_SECRET);
+	h.update(`${rel}|${action}|${expiresAt}`);
+	return `${expiresAt}.${h.digest("hex").slice(0, 16)}`;
+}
+/**
+* Verify a dev-storage signed token. Exported so the vite-plugin middleware
+* can call into it without duplicating crypto. (Internal use; not part of the
+* @omg-dev/server public API.)
+*/
+function _verifyDevStorageToken(rel, action, token) {
+	const [expStr, sig] = token.split(".");
+	if (!expStr || !sig) return false;
+	const exp = Number(expStr);
+	if (!Number.isFinite(exp) || exp < Date.now()) return false;
+	return devSignToken(rel, action, exp).split(".")[1] === sig;
+}
+/**
+* Write a file into the dev storage tree under the given namespace. Exported
+* so the vite-plugin middleware can perform the PUT after verifying the
+* token. Creates parent directories as needed.
+*/
+function _devStorageWrite(scope, userId, key, data) {
+	const dst = devPath(scope, userId, key);
+	fs.mkdirSync(path.dirname(dst), { recursive: true });
+	fs.writeFileSync(dst, data);
+}
+/**
+* Resolve a dev storage file to its absolute filesystem path so the plugin
+* middleware can stream the GET. Returns null if the file does not exist.
+*/
+function _devStorageRead(scope, userId, key) {
+	const src = devPath(scope, userId, key);
+	if (!fs.existsSync(src)) return null;
+	return src;
+}
+function devUploadUrl(key, scope, userId, contentType) {
+	const rel = devRelative(scope, userId, key);
+	const expiresAt = Date.now() + 300 * 1e3;
+	return {
+		url: `/_vibes_storage/${rel}?t=${devSignToken(rel, "put", expiresAt)}${contentType ? `&ct=${encodeURIComponent(contentType)}` : ""}`,
+		method: "PUT",
+		key: rel,
+		expiresAt: new Date(expiresAt).toISOString(),
+		maxBytes: 25 * 1024 * 1024
+	};
+}
+function devDownloadUrl(key, scope, userId) {
+	const rel = devRelative(scope, userId, key);
+	const expiresAt = Date.now() + 3600 * 1e3;
+	return {
+		url: `/_vibes_storage/${rel}?t=${devSignToken(rel, "get", expiresAt)}`,
+		method: "GET",
+		key: rel,
+		expiresAt: new Date(expiresAt).toISOString()
+	};
+}
+function devList(scope, userId, prefix) {
+	const root = devPath(scope, userId, prefix || ".");
+	if (!fs.existsSync(root)) return [];
+	const out = [];
+	function walk(dir) {
+		for (const ent of fs.readdirSync(dir, { withFileTypes: true })) {
+			const full = path.join(dir, ent.name);
+			if (ent.isDirectory()) {
+				walk(full);
+				continue;
+			}
+			if (!ent.isFile()) continue;
+			const st = fs.statSync(full);
+			const base = devPath(scope, userId, "");
+			const rel = path.relative(base, full).replaceAll(path.sep, "/");
+			out.push({
+				key: rel,
+				relPath: rel,
+				size: st.size,
+				lastModified: st.mtime.toISOString()
+			});
+		}
+	}
+	walk(root);
+	return out;
+}
+function devDelete(key, scope, userId) {
+	const src = devPath(scope, userId, key);
+	if (fs.existsSync(src)) fs.rmSync(src);
+}
+//#endregion
+//#region src/notifications.ts
+const NOTIFICATIONS_TABLE = "vibesNotifications";
+const PREFERENCES_TABLE = "vibesNotificationPreferences";
+const SUBSCRIPTIONS_TABLE = "vibesPushSubscriptions";
+const DELIVERIES_TABLE = "vibesNotificationDeliveries";
+const notificationSystemCollectionNames = new Set([
+	NOTIFICATIONS_TABLE,
+	PREFERENCES_TABLE,
+	SUBSCRIPTIONS_TABLE,
+	DELIVERIES_TABLE
+]);
+const notificationSystemSchema = defineSchema({ collections: {
+	[NOTIFICATIONS_TABLE]: collection({ fields: {
+		appId: fields.string(),
+		userId: fields.string(),
+		kind: fields.string(),
+		title: fields.string(),
+		body: fields.string(),
+		url: fields.string(),
+		status: fields.enum([
+			"unread",
+			"read",
+			"archived"
+		]),
+		priority: fields.enum([
+			"low",
+			"normal",
+			"high"
+		]),
+		sourceType: fields.string(),
+		sourceId: fields.string(),
+		dedupeKey: fields.string(),
+		dataJson: fields.string(),
+		readAt: fields.number(),
+		createdAt: fields.number()
+	} }).scoped("user").index("_owner", "status", "createdAt").index("_owner", "createdAt").index("appId", "userId", "createdAt"),
+	[PREFERENCES_TABLE]: collection({ fields: {
+		appId: fields.string(),
+		userId: fields.string(),
+		kind: fields.string(),
+		inApp: fields.boolean(),
+		push: fields.boolean(),
+		createdAt: fields.number(),
+		updatedAt: fields.number()
+	} }).scoped("user").index("_owner", "appId", "kind"),
+	[SUBSCRIPTIONS_TABLE]: collection({ fields: {
+		appId: fields.string(),
+		userId: fields.string(),
+		endpoint: fields.string(),
+		p256dh: fields.string(),
+		auth: fields.string(),
+		userAgent: fields.string(),
+		disabledAt: fields.number(),
+		lastSeenAt: fields.number(),
+		createdAt: fields.number(),
+		updatedAt: fields.number()
+	} }).scoped("user").index("_owner", "appId").index("endpoint"),
+	[DELIVERIES_TABLE]: collection({ fields: {
+		notificationId: fields.ref(NOTIFICATIONS_TABLE),
+		appId: fields.string(),
+		userId: fields.string(),
+		channel: fields.enum(["in_app", "push"]),
+		status: fields.enum([
+			"pending",
+			"sent",
+			"failed",
+			"skipped"
+		]),
+		attempts: fields.number(),
+		error: fields.string(),
+		createdAt: fields.number(),
+		updatedAt: fields.number()
+	} }).scoped("user").index("_owner", "createdAt").index("notificationId", "channel")
+} });
+function withNotificationSystemSchema(schema) {
+	if (!schema) return notificationSystemSchema;
+	return { collections: {
+		...schema.collections,
+		...notificationSystemSchema.collections
+	} };
+}
+function ensureNotificationIndexes(db) {
+	db.raw().exec(`CREATE UNIQUE INDEX IF NOT EXISTS uniq_vibes_notifications_owner_dedupe
+       ON ${NOTIFICATIONS_TABLE} (_owner, appId, dedupeKey)
+       WHERE dedupeKey != ''`);
+	db.raw().exec(`CREATE UNIQUE INDEX IF NOT EXISTS uniq_vibes_push_subscriptions_owner_endpoint
+       ON ${SUBSCRIPTIONS_TABLE} (_owner, appId, endpoint)`);
+	db.raw().exec(`CREATE UNIQUE INDEX IF NOT EXISTS uniq_vibes_notification_prefs_owner_kind
+       ON ${PREFERENCES_TABLE} (_owner, appId, kind)`);
+}
+function dbOrThrow() {
+	const db = getDbInstance();
+	if (!db) throw new Error("[vibes:notifications] db not initialized");
+	return db;
+}
+function nowIso() {
+	return (/* @__PURE__ */ new Date()).toISOString();
+}
+function insertRaw(db, table, data) {
+	const id = typeof data.id === "string" ? data.id : crypto.randomUUID();
+	const iso = nowIso();
+	const record = {
+		...data,
+		id,
+		created_at: iso,
+		updated_at: iso
+	};
+	const cols = Object.keys(record);
+	const placeholders = cols.map(() => "?").join(", ");
+	db.raw().prepare(`INSERT INTO ${table} (${cols.join(", ")}) VALUES (${placeholders})`).run(...Object.values(record));
+	invalidate(table);
+	notifyRowChange(table, "insert", null, record);
+	return record;
+}
+function patchRaw(db, table, id, patch) {
+	const before = db.raw().prepare(`SELECT * FROM ${table} WHERE id = ? LIMIT 1`).get(id);
+	if (!before) return null;
+	const write = {
+		...patch,
+		updated_at: nowIso()
+	};
+	const cols = Object.keys(write);
+	db.raw().prepare(`UPDATE ${table} SET ${cols.map((c) => `${c} = ?`).join(", ")} WHERE id = ?`).run(...cols.map((c) => write[c]), id);
+	const after = {
+		...before,
+		...write
+	};
+	invalidate(table);
+	notifyRowChange(table, "update", before, after);
+	return after;
+}
+function getPreference(db, userId, appId, kind) {
+	return db.raw().prepare(`SELECT inApp, push FROM ${PREFERENCES_TABLE}
+        WHERE _owner = ? AND appId = ? AND kind = ?
+        LIMIT 1`).get(userId, appId, kind);
+}
+function desiredChannels(db, input, userId, appId) {
+	const pref = getPreference(db, userId, appId, input.kind);
+	return {
+		inApp: input.channels?.inApp ?? (pref ? Boolean(pref.inApp) : true),
+		push: input.channels?.push ?? (pref ? Boolean(pref.push) : true)
+	};
+}
+async function configureWebPush() {
+	const publicKey = process.env.VIBES_VAPID_PUBLIC_KEY;
+	const privateKey = process.env.VIBES_VAPID_PRIVATE_KEY;
+	if (!publicKey || !privateKey) return {
+		sender: null,
+		error: "VAPID keys not configured",
+		skipped: true
+	};
+	try {
+		const mod = await new Function("specifier", "return import(specifier)")("web-push");
+		const sender = mod.default ?? mod;
+		sender.setVapidDetails(process.env.VIBES_VAPID_SUBJECT || "mailto:support@omg.dev", publicKey, privateKey);
+		return {
+			sender,
+			error: "",
+			skipped: false
+		};
+	} catch (err) {
+		return {
+			sender: null,
+			error: err instanceof Error ? err.message : String(err),
+			skipped: false
+		};
+	}
+}
+async function fanoutPush(db, row) {
+	const subscriptions = db.raw().prepare(`SELECT * FROM ${SUBSCRIPTIONS_TABLE}
+        WHERE _owner = ? AND appId = ? AND disabledAt = 0`).all(row.userId, row.appId);
+	if (subscriptions.length === 0) {
+		insertRaw(db, DELIVERIES_TABLE, {
+			_owner: row.userId,
+			notificationId: row.id,
+			appId: row.appId,
+			userId: row.userId,
+			channel: "push",
+			status: "skipped",
+			attempts: 0,
+			error: "no push subscriptions",
+			createdAt: Date.now(),
+			updatedAt: Date.now()
+		});
+		return;
+	}
+	const webPush = await configureWebPush();
+	for (const sub of subscriptions) {
+		const delivery = insertRaw(db, DELIVERIES_TABLE, {
+			_owner: row.userId,
+			notificationId: row.id,
+			appId: row.appId,
+			userId: row.userId,
+			channel: "push",
+			status: webPush.sender ? "pending" : webPush.skipped ? "skipped" : "failed",
+			attempts: 0,
+			error: webPush.sender ? "" : webPush.error,
+			createdAt: Date.now(),
+			updatedAt: Date.now()
+		});
+		if (!webPush.sender) continue;
+		const pushSub = {
+			endpoint: String(sub.endpoint),
+			keys: {
+				p256dh: String(sub.p256dh),
+				auth: String(sub.auth)
+			}
+		};
+		try {
+			await webPush.sender.sendNotification(pushSub, JSON.stringify({
+				id: row.id,
+				title: row.title,
+				body: row.body,
+				url: row.url,
+				tag: row.dedupeKey || row.id,
+				data: safeJson(row.dataJson)
+			}));
+			patchRaw(db, DELIVERIES_TABLE, String(delivery.id), {
+				status: "sent",
+				attempts: 1,
+				error: "",
+				updatedAt: Date.now()
+			});
+		} catch (err) {
+			const statusCode = typeof err === "object" && err && "statusCode" in err ? Number(err.statusCode) : 0;
+			if (statusCode === 404 || statusCode === 410) patchRaw(db, SUBSCRIPTIONS_TABLE, String(sub.id), {
+				disabledAt: Date.now(),
+				updatedAt: Date.now()
+			});
+			patchRaw(db, DELIVERIES_TABLE, String(delivery.id), {
+				status: "failed",
+				attempts: 1,
+				error: err instanceof Error ? err.message : String(err),
+				updatedAt: Date.now()
+			});
+		}
+	}
+}
+function safeJson(raw) {
+	if (!raw) return {};
+	try {
+		return JSON.parse(raw);
+	} catch {
+		return {};
+	}
+}
+async function notify(input) {
+	const db = dbOrThrow();
+	const userId = input.userId ?? ctx.userId;
+	if (!userId) return null;
+	const appId = input.appId ?? ctx.appId ?? "app";
+	const channels = desiredChannels(db, input, userId, appId);
+	if (!channels.inApp && !channels.push) return null;
+	const dedupeKey = input.dedupeKey ?? "";
+	if (dedupeKey) {
+		const existing = db.raw().prepare(`SELECT * FROM ${NOTIFICATIONS_TABLE}
+          WHERE _owner = ? AND appId = ? AND dedupeKey = ?
+          LIMIT 1`).get(userId, appId, dedupeKey);
+		if (existing) return existing;
+	}
+	const now = Date.now();
+	let inserted;
+	try {
+		inserted = insertRaw(db, NOTIFICATIONS_TABLE, {
+			_owner: userId,
+			appId,
+			userId,
+			kind: input.kind,
+			title: input.title,
+			body: input.body ?? "",
+			url: input.url ?? "",
+			status: "unread",
+			priority: input.priority ?? "normal",
+			sourceType: input.source?.type ?? "",
+			sourceId: input.source?.id ?? "",
+			dedupeKey,
+			dataJson: input.data ? JSON.stringify(input.data) : "{}",
+			readAt: 0,
+			createdAt: now
+		});
+	} catch (err) {
+		if (dedupeKey && err instanceof Error && /UNIQUE/i.test(err.message)) return db.raw().prepare(`SELECT * FROM ${NOTIFICATIONS_TABLE}
+            WHERE _owner = ? AND appId = ? AND dedupeKey = ?
+            LIMIT 1`).get(userId, appId, dedupeKey);
+		throw err;
+	}
+	if (channels.inApp) insertRaw(db, DELIVERIES_TABLE, {
+		_owner: userId,
+		notificationId: inserted.id,
+		appId,
+		userId,
+		channel: "in_app",
+		status: "sent",
+		attempts: 0,
+		error: "",
+		createdAt: now,
+		updatedAt: now
+	});
+	if (channels.push) fanoutPush(db, inserted);
+	return inserted;
+}
+async function readBody(req) {
+	try {
+		const body = await req.json();
+		return body && typeof body === "object" ? body : {};
+	} catch {
+		return {};
+	}
+}
+function requireUser() {
+	if (!ctx.userId) return Response.json({ error: "Authentication required" }, { status: 401 });
+	return ctx.userId;
+}
+async function notificationsConfigHandler() {
+	return Response.json({ vapidPublicKey: process.env.VIBES_VAPID_PUBLIC_KEY ?? "" });
+}
+async function notificationsListHandler(req) {
+	const userId = requireUser();
+	if (userId instanceof Response) return userId;
+	const db = dbOrThrow();
+	const unreadOnly = new URL(req.url).searchParams.get("unread") === "1";
+	const rows = db.raw().prepare(`SELECT * FROM ${NOTIFICATIONS_TABLE}
+        WHERE _owner = ? ${unreadOnly ? "AND status = 'unread'" : ""}
+        ORDER BY createdAt DESC
+        LIMIT 100`).all(userId);
+	return Response.json(rows);
+}
+async function notificationsUnreadCountHandler() {
+	const userId = requireUser();
+	if (userId instanceof Response) return userId;
+	const row = dbOrThrow().raw().prepare(`SELECT COUNT(*) AS count FROM ${NOTIFICATIONS_TABLE} WHERE _owner = ? AND status = 'unread'`).get(userId);
+	return Response.json({ count: row?.count ?? 0 });
+}
+async function notificationsSubscribeHandler(req) {
+	const userId = requireUser();
+	if (userId instanceof Response) return userId;
+	const body = await readBody(req);
+	const subscription = body.subscription && typeof body.subscription === "object" ? body.subscription : body;
+	const endpoint = typeof subscription.endpoint === "string" ? subscription.endpoint : "";
+	const keys = subscription.keys && typeof subscription.keys === "object" ? subscription.keys : {};
+	const p256dh = typeof keys.p256dh === "string" ? keys.p256dh : "";
+	const auth = typeof keys.auth === "string" ? keys.auth : "";
+	if (!endpoint || !p256dh || !auth) return Response.json({ error: "invalid push subscription" }, { status: 400 });
+	const db = dbOrThrow();
+	const appId = typeof body.appId === "string" && body.appId ? body.appId : ctx.appId ?? "app";
+	const existing = db.raw().prepare(`SELECT id FROM ${SUBSCRIPTIONS_TABLE}
+        WHERE _owner = ? AND appId = ? AND endpoint = ?
+        LIMIT 1`).get(userId, appId, endpoint);
+	const patch = {
+		p256dh,
+		auth,
+		userAgent: req.headers.get("user-agent") ?? "",
+		disabledAt: 0,
+		lastSeenAt: Date.now(),
+		updatedAt: Date.now()
+	};
+	if (existing) {
+		patchRaw(db, SUBSCRIPTIONS_TABLE, existing.id, patch);
+		return Response.json({
+			ok: true,
+			id: existing.id
+		});
+	}
+	const row = insertRaw(db, SUBSCRIPTIONS_TABLE, {
+		_owner: userId,
+		appId,
+		userId,
+		endpoint,
+		...patch,
+		createdAt: Date.now()
+	});
+	return Response.json({
+		ok: true,
+		id: row.id
+	});
+}
+async function notificationsUnsubscribeHandler(req) {
+	const userId = requireUser();
+	if (userId instanceof Response) return userId;
+	const body = await readBody(req);
+	const endpoint = typeof body.endpoint === "string" ? body.endpoint : "";
+	if (!endpoint) return Response.json({ error: "endpoint required" }, { status: 400 });
+	const db = dbOrThrow();
+	const appId = typeof body.appId === "string" && body.appId ? body.appId : ctx.appId ?? "app";
+	const rows = db.raw().prepare(`SELECT id FROM ${SUBSCRIPTIONS_TABLE}
+        WHERE _owner = ? AND appId = ? AND endpoint = ?`).all(userId, appId, endpoint);
+	for (const row of rows) patchRaw(db, SUBSCRIPTIONS_TABLE, row.id, {
+		disabledAt: Date.now(),
+		updatedAt: Date.now()
+	});
+	return Response.json({ ok: true });
+}
+async function notificationsReadHandler(req) {
+	const userId = requireUser();
+	if (userId instanceof Response) return userId;
+	const body = await readBody(req);
+	const db = dbOrThrow();
+	const now = Date.now();
+	if (Array.isArray(body.ids)) {
+		for (const id of body.ids) {
+			if (typeof id !== "string") continue;
+			if (db.raw().prepare(`SELECT * FROM ${NOTIFICATIONS_TABLE} WHERE id = ? AND _owner = ? LIMIT 1`).get(id, userId)) patchRaw(db, NOTIFICATIONS_TABLE, id, {
+				status: "read",
+				readAt: now
+			});
+		}
+		return Response.json({ ok: true });
+	}
+	if (body.all === true) {
+		const rows = db.raw().prepare(`SELECT id FROM ${NOTIFICATIONS_TABLE} WHERE _owner = ? AND status = 'unread'`).all(userId);
+		for (const row of rows) patchRaw(db, NOTIFICATIONS_TABLE, row.id, {
+			status: "read",
+			readAt: now
+		});
+		return Response.json({
+			ok: true,
+			count: rows.length
+		});
+	}
+	return Response.json({ error: "ids or all required" }, { status: 400 });
+}
+async function notificationsCreateHandler(req) {
+	const userId = requireUser();
+	if (userId instanceof Response) return userId;
+	const body = await readBody(req);
+	const row = await notify({
+		userId,
+		appId: typeof body.appId === "string" ? body.appId : void 0,
+		kind: typeof body.kind === "string" ? body.kind : "app_custom",
+		title: typeof body.title === "string" ? body.title : "Notification",
+		body: typeof body.body === "string" ? body.body : "",
+		url: typeof body.url === "string" ? body.url : "",
+		priority: body.priority === "low" || body.priority === "high" ? body.priority : "normal",
+		source: {
+			type: typeof body.sourceType === "string" ? body.sourceType : "",
+			id: typeof body.sourceId === "string" ? body.sourceId : ""
+		},
+		dedupeKey: typeof body.dedupeKey === "string" ? body.dedupeKey : void 0,
+		data: body.data && typeof body.data === "object" ? body.data : void 0
+	});
+	return Response.json(row);
+}
+function notificationServiceWorkerHandler() {
+	return new Response(`self.addEventListener("push", (event) => {
+  let payload = {};
+  try { payload = event.data ? event.data.json() : {}; } catch {}
+  const title = payload.title || "Notification";
+  const options = {
+    body: payload.body || "",
+    tag: payload.tag || payload.id || undefined,
+    data: { url: payload.url || "/", id: payload.id || "" },
+    icon: "/icons/pwa-192x192.png",
+    badge: "/icons/pwa-192x192.png",
+  };
+  event.waitUntil(self.registration.showNotification(title, options));
+});
+
+self.addEventListener("notificationclick", (event) => {
+  event.notification.close();
+  const url = (event.notification.data && event.notification.data.url) || "/";
+  event.waitUntil((async () => {
+    const allClients = await clients.matchAll({ type: "window", includeUncontrolled: true });
+    for (const client of allClients) {
+      if ("focus" in client) {
+        client.focus();
+        if ("navigate" in client) return client.navigate(url);
+        return;
+      }
+    }
+    if (clients.openWindow) return clients.openWindow(url);
+  })());
+});`, { headers: {
+		"content-type": "text/javascript; charset=utf-8",
+		"cache-control": "no-cache",
+		"service-worker-allowed": "/__vibes_push/"
+	} });
+}
+//#endregion
+//#region src/billing.ts
+const AGENT_BASE = "http://localhost:8080";
+const MICROS_PER_UNIT = 1e6;
+/**
+* Dollars (or whole credit units) → integer micro-units, for the amount
+* arguments of `track`/`grant`. `usd(5)` → 5_000_000. Re-exported from the
+* same definition @omg-dev/billing uses so app authors can write `usd(5)`.
+*/
+function usd(amount) {
+	return Math.round(amount * MICROS_PER_UNIT);
+}
+async function agentPost(path, body, label) {
+	const res = await fetch(`${AGENT_BASE}${path}`, {
+		method: "POST",
+		headers: { "Content-Type": "application/json" },
+		body: JSON.stringify(body)
+	});
+	if (!res.ok) {
+		const text = await res.text().catch(() => "");
+		throw new Error(`billing.${label} agent ${res.status}: ${text.slice(0, 200)}`);
+	}
+	return await res.json();
+}
+async function agentGet(path, label) {
+	const res = await fetch(`${AGENT_BASE}${path}`, {
+		method: "GET",
+		headers: { Accept: "application/json" }
+	});
+	if (!res.ok) {
+		const text = await res.text().catch(() => "");
+		throw new Error(`billing.${label} agent ${res.status}: ${text.slice(0, 200)}`);
+	}
+	return await res.json();
+}
+const billing = {
+	/**
+	* Create (or fetch) the billing customer for one of this app's end-users.
+	* Idempotent on `externalRef` within the app — call it on signup. `plan`
+	* optionally pins the customer onto a declared plan at creation.
+	*/
+	async ensureCustomer(externalRef, plan) {
+		return agentPost("/_billing/customers", {
+			externalRef,
+			plan
+		}, "ensureCustomer");
+	},
+	/**
+	* Check whether `externalRef` is entitled to use `feature` right now. Read
+	* the `allow` flag before serving the feature; `reason` explains a denial.
+	*/
+	async check(feature, externalRef) {
+		return agentPost("/_billing/check", {
+			feature,
+			externalRef
+		}, "check");
+	},
+	/**
+	* Record `amountMicros` of `feature` usage against `externalRef` after the
+	* feature was served. `idempotencyKey` dedupes retries — reuse the same key
+	* for the same logical unit of work. Returns the new balance.
+	*/
+	async track(feature, externalRef, amountMicros, idempotencyKey, reason) {
+		return agentPost("/_billing/track", {
+			feature,
+			externalRef,
+			amountMicros,
+			idempotencyKey,
+			reason
+		}, "track");
+	},
+	/**
+	* Add `amountMicros` of `feature` credit to `externalRef` (a top-up, refund,
+	* or promo grant). `opts.idempotencyKey` dedupes retries; `opts.grantKey`
+	* dedupes a one-time grant (e.g. a signup bonus) across the customer's
+	* lifetime. Returns the new balance.
+	*/
+	async grant(externalRef, feature, amountMicros, opts) {
+		return agentPost("/_billing/grant", {
+			externalRef,
+			feature,
+			amountMicros,
+			idempotencyKey: opts.idempotencyKey,
+			grantKey: opts.grantKey,
+			source: opts.source,
+			reason: opts.reason
+		}, "grant");
+	},
+	/**
+	* Read the current `feature` balance for `externalRef` without mutating it.
+	* `exists` is false if the customer was never created.
+	*/
+	async balance(externalRef, feature) {
+		return agentGet(`/_billing/balance?${new URLSearchParams({
+			externalRef,
+			feature
+		}).toString()}`, "balance");
+	},
+	/**
+	* Read `externalRef`'s current plan + newest subscription record without
+	* mutating anything. Use it to render entitlement UI — pass `plan` to
+	* <PricingTable currentPlan> or gate paid features. An end-user who never
+	* subscribed reads back the catalog default plan with `subscription: null`.
+	*/
+	async subscription(externalRef) {
+		return agentGet(`/_billing/subscription?${new URLSearchParams({ externalRef }).toString()}`, "subscription");
+	},
+	/**
+	* Mint a hosted checkout for one of this app's end-users to buy `plan`, in
+	* the APP OWNER's connected Polar org. Returns the checkout URL to redirect
+	* to. The amount + product are resolved server-side from the active
+	* plan-version (the client cannot set the price). On successful payment the
+	* Polar webhook credits/upgrades `externalRef` automatically.
+	*
+	*   export const buyPro: Route = async (ctx) => {
+	*     const { checkoutUrl } = await billing.checkout({
+	*       plan: "pro",
+	*       externalRef: ctx.user.id,
+	*     })
+	*     return Response.redirect(checkoutUrl, 303)
+	*   }
+	*/
+	async checkout(opts) {
+		return agentPost("/_billing/checkout", {
+			plan: opts.plan,
+			externalRef: opts.externalRef,
+			successUrl: opts.successUrl,
+			feature: opts.feature,
+			amountMicros: opts.amountMicros
+		}, "checkout");
+	}
+};
+//#endregion
+//#region src/index.ts
+async function storagePresignHandler(req) {
+	let body;
+	try {
+		body = await req.json();
+	} catch {
+		return Response.json({ error: "invalid JSON body" }, { status: 400 });
+	}
+	const action = body.action ?? "put";
+	if (action !== "put" && action !== "get") return Response.json({ error: `unknown action: ${action}` }, { status: 400 });
+	if (!body.key || typeof body.key !== "string") return Response.json({ error: "key required" }, { status: 400 });
+	const scope = body.scope ?? "user";
+	if (scope !== "user" && scope !== "app") return Response.json({ error: `unknown scope: ${scope}` }, { status: 400 });
+	if (scope === "user" && !ctx.userId) return Response.json({ error: "auth required for scope:user — sign in or pass scope:'app'." }, { status: 401 });
+	try {
+		if (action === "put") {
+			const out = await storage.uploadUrl({
+				key: body.key,
+				contentType: body.contentType,
+				scope
+			});
+			return Response.json(out);
+		}
+		const out = await storage.downloadUrl(body.key, { scope });
+		return Response.json(out);
+	} catch (err) {
+		const msg = err instanceof Error ? err.message : String(err);
+		return Response.json({ error: msg }, { status: 500 });
+	}
+}
+async function storageNotifyHandler(req) {
+	let body;
+	try {
+		body = await req.json();
+	} catch {
+		return Response.json({ error: "invalid JSON body" }, { status: 400 });
+	}
+	const action = body.action ?? "upload";
+	if (action !== "upload" && action !== "delete") return Response.json({ error: `unknown action: ${action}` }, { status: 400 });
+	if (!body.key || typeof body.key !== "string") return Response.json({ error: "key required" }, { status: 400 });
+	const scope = body.scope ?? "user";
+	const kind = action === "upload" ? "storage:upload" : "storage:delete";
+	try {
+		const fired = await dispatchStorageEvent(kind, {
+			key: body.key,
+			size: body.size,
+			contentType: body.contentType,
+			userId: ctx.userId ?? null,
+			scope
+		});
+		return Response.json({
+			ok: true,
+			handlersFired: fired
+		});
+	} catch (err) {
+		const msg = err instanceof Error ? err.message : String(err);
+		return Response.json({ error: msg }, { status: 500 });
+	}
+}
+async function createVibesServer(opts) {
+	const { root, db: dbPath } = opts;
+	let currentSchema = withNotificationSystemSchema(opts.schema);
+	function loadExplicitRoutes() {
+		if (opts.routes) return loadRoutes(opts.routes);
+		const routesJsonPath = path.join(root, ".vibes", "routes.json");
+		if (!fs.existsSync(routesJsonPath)) return [];
+		return loadRoutes(JSON.parse(fs.readFileSync(routesJsonPath, "utf-8")));
+	}
+	let explicitRoutes = loadExplicitRoutes();
+	let routes = [];
+	let dbInstance = null;
+	function ensureDb() {
+		if (dbInstance) return dbInstance;
+		dbInstance = openDb(path.isAbsolute(dbPath) ? dbPath : path.join(root, dbPath));
+		setDbInstance(dbInstance);
+		return dbInstance;
+	}
+	function hasCollections(s) {
+		return !!s?.collections && Object.keys(s.collections).length > 0;
+	}
+	const storageBuiltinRoutes = [{
+		method: "POST",
+		path: "/api/_storage/presign",
+		module: "@omg-dev/server/storage-presign",
+		handler: "inline",
+		inlineHandler: storagePresignHandler
+	}, {
+		method: "POST",
+		path: "/api/_storage/notify",
+		module: "@omg-dev/server/storage-notify",
+		handler: "inline",
+		inlineHandler: storageNotifyHandler
+	}];
+	const notificationBuiltinRoutes = [
+		{
+			method: "GET",
+			path: "/api/_notifications/config",
+			module: "@omg-dev/server/notifications-config",
+			handler: "inline",
+			inlineHandler: notificationsConfigHandler
+		},
+		{
+			method: "GET",
+			path: "/api/_notifications/list",
+			module: "@omg-dev/server/notifications-list",
+			handler: "inline",
+			inlineHandler: notificationsListHandler
+		},
+		{
+			method: "GET",
+			path: "/api/_notifications/unread-count",
+			module: "@omg-dev/server/notifications-unread-count",
+			handler: "inline",
+			inlineHandler: notificationsUnreadCountHandler
+		},
+		{
+			method: "POST",
+			path: "/api/_notifications/subscribe",
+			module: "@omg-dev/server/notifications-subscribe",
+			handler: "inline",
+			inlineHandler: notificationsSubscribeHandler
+		},
+		{
+			method: "POST",
+			path: "/api/_notifications/unsubscribe",
+			module: "@omg-dev/server/notifications-unsubscribe",
+			handler: "inline",
+			inlineHandler: notificationsUnsubscribeHandler
+		},
+		{
+			method: "POST",
+			path: "/api/_notifications/read",
+			module: "@omg-dev/server/notifications-read",
+			handler: "inline",
+			inlineHandler: notificationsReadHandler
+		},
+		{
+			method: "POST",
+			path: "/api/_notifications/create",
+			module: "@omg-dev/server/notifications-create",
+			handler: "inline",
+			inlineHandler: notificationsCreateHandler
+		}
+	];
+	function rebuildRoutes() {
+		const explicit = new Set(explicitRoutes.map((r) => `${r.method} ${r.path}`));
+		const builtinKeys = new Set([...storageBuiltinRoutes.map((r) => `${r.method} ${r.path}`), ...notificationBuiltinRoutes.map((r) => `${r.method} ${r.path}`)]);
+		const builtinStorage = storageBuiltinRoutes.filter((r) => !explicit.has(`${r.method} ${r.path}`));
+		const builtinNotifications = notificationBuiltinRoutes.filter((r) => !explicit.has(`${r.method} ${r.path}`));
+		if (hasCollections(currentSchema) && opts.autoCrud !== false) routes = [
+			...buildAutoCrudRoutes(currentSchema).filter((r) => {
+				if (explicit.has(`${r.method} ${r.path}`) || builtinKeys.has(`${r.method} ${r.path}`)) return false;
+				const collection = r.path.split("/")[2];
+				return !notificationSystemCollectionNames.has(collection);
+			}),
+			...builtinStorage,
+			...builtinNotifications,
+			...explicitRoutes
+		];
+		else routes = [
+			...builtinStorage,
+			...builtinNotifications,
+			...explicitRoutes
+		];
+	}
+	if (hasCollections(currentSchema)) {
+		const db = ensureDb();
+		registerScopes(currentSchema);
+		if (opts.migrate !== false) {
+			migrate(db.raw(), currentSchema);
+			ensureNotificationIndexes(db);
+		}
+	}
+	setSubscriptionSchema(currentSchema ?? null);
+	rebuildRoutes();
+	if (opts.cron) setCronDriver(opts.cron);
+	const triggerEntries = opts.triggers && opts.triggers.length > 0 ? opts.triggers : await loadTriggersFromFile(root);
+	if (triggerEntries.length > 0) await registerTriggers(triggerEntries);
+	const workflowEntries = opts.workflows && opts.workflows.length > 0 ? opts.workflows : await loadWorkflowsFromFile(root);
+	if (workflowEntries.length > 0) {
+		await registerWorkflows(workflowEntries);
+		await buildWorkflowEndpoint();
+	}
+	const authMW = typeof opts.auth === "function" ? opts.auth : opts.auth ? createAuthMiddleware$1(opts.auth) : null;
+	const staticDir = opts.staticDir ? path.resolve(root, opts.staticDir) : null;
+	async function serveStatic(req) {
+		if (!staticDir) return null;
+		const url = new URL(req.url);
+		let filePath = path.join(staticDir, url.pathname);
+		if (fs.existsSync(filePath) && fs.statSync(filePath).isFile()) return new Response(Bun.file(filePath));
+		const indexPath = path.join(staticDir, "index.html");
+		if (fs.existsSync(indexPath)) return new Response(Bun.file(indexPath));
+		return null;
+	}
+	const instance = {
+		async apiHandler(req) {
+			let authResult = null;
+			if (authMW) try {
+				authResult = await authMW(req);
+			} catch {
+				authResult = null;
+			}
+			return ctxStore.run({
+				userId: authResult?.userId ?? null,
+				userEmail: authResult?.userEmail,
+				userName: authResult?.userName,
+				appId: authResult?.appId
+			}, () => handleRequest(req, routes));
+		},
+		async fetch(req) {
+			const url = new URL(req.url);
+			if (url.pathname === "/_vibes/dispatch" && req.method === "POST") try {
+				return await dispatchHandler(await req.json());
+			} catch (err) {
+				return Response.json({ error: `dispatch: ${err.message}` }, { status: 400 });
+			}
+			if (url.pathname === "/_vibes/inspect/triggers" && req.method === "GET") return Response.json(devInspectTriggers());
+			if (url.pathname === "/_vibes/inspect/deliveries" && req.method === "GET") return Response.json(devInspectDeliveries());
+			if (url.pathname === "/_vibes/inspect/events" && req.method === "GET") return Response.json(devInspectEvents());
+			if (url.pathname === "/_vibes/inspect/workflows" && req.method === "GET") return Response.json(devInspectWorkflowRuns());
+			if (url.pathname.startsWith("/_vibes/workflow")) {
+				const r = handleWorkflowRequest(req);
+				if (r) return r;
+				return Response.json({ error: "no workflow endpoint mounted" }, { status: 404 });
+			}
+			if (url.pathname === "/__vibes_push/sw.js" && req.method === "GET") return notificationServiceWorkerHandler();
+			if (url.pathname.startsWith("/api/")) return instance.apiHandler(req);
+			const staticResponse = await serveStatic(req);
+			if (staticResponse) return staticResponse;
+			return Response.json({ error: "Not found" }, { status: 404 });
+		},
+		migrate(newSchema) {
+			currentSchema = withNotificationSystemSchema(newSchema ?? currentSchema);
+			setSubscriptionSchema(currentSchema ?? null);
+			if (!hasCollections(currentSchema)) {
+				rebuildRoutes();
+				return;
+			}
+			const db = ensureDb();
+			registerScopes(currentSchema);
+			migrate(db.raw(), currentSchema);
+			ensureNotificationIndexes(db);
+			rebuildRoutes();
+		},
+		reloadFunctions() {
+			if (!opts.routes) {
+				explicitRoutes = loadExplicitRoutes();
+				rebuildRoutes();
+			}
+			clearModuleCache();
+			console.log(`[vibes] Function modules reloaded (${explicitRoutes.length} explicit routes).`);
+		},
+		async reloadTriggers() {
+			const entries = await loadTriggersFromFile(root);
+			await registerTriggers(entries);
+			console.log(`[vibes] Triggers reloaded (${entries.length} registered).`);
+		},
+		async reloadWorkflows() {
+			const entries = await loadWorkflowsFromFile(root);
+			await registerWorkflows(entries);
+			console.log(`[vibes] Workflows reloaded (${entries.length} registered).`);
+		},
+		close() {
+			dbInstance?.close();
+		}
+	};
+	return instance;
+}
+//#endregion
+export { PredicateValidationError, TriggerScanError, VibesAuthRequiredError, VibesHttpError, _devStorageRead, _devStorageWrite, _verifyDevStorageToken, addClient, addSubClient, billing, buildAutoCrudRoutes, cancel, clearTriggers, clearWorkflows, clientCount, compileToJs, compileToSql, createAuthMiddleware, createVibesServer, cron, ctx, dbProxy as db, decodeRow, decodeRows, devInspectDeliveries, devInspectEvents, devInspectTriggers, devInspectWorkflowRuns, dispatchHandler, emit, extractTriggers, handleSubMessage, invalidate, listTriggers, listWorkflows, loadTriggersFromFile, loadWorkflowsFromFile, migrate, notificationSystemSchema, notify, notifyCollectionChange, notifyRowChange, on, registerScopes, registerTriggers, registerWorkflows, removeClient, removeSubClient, scanTriggers, schedule, setCronDriver, setMaxSubsPerClient, setSubscriptionRingCap, setSubscriptionSchema, startWorkflow, storage, subClientCount, subscriptionCount, usd, validatePredicate, workflow, workflowServiceName, writeTriggersManifest };