@voltro/cli 0.11.4 → 0.12.0

package/dist/serveCommand-B2-YV9TU.js

@@ -0,0 +1,1112 @@
+import { at as e, t } from "./inspectMetrics-uEfIS1vp.js";
+import { F as n, G as r, N as i, P as a, j as o, l as s, o as c } from "./seedRunner-DZmhoqNt.js";
+import { r as l, t as u } from "./appModuleLoader-C9r9mxZt.js";
+import { A as d, B as f, C as p, D as ee, E as te, F as m, G as ne, I as re, J as h, K as g, M as _, N as v, O as y, P as ie, R as ae, S as oe, T as b, U as se, V as x, W as ce, X as le, Y as ue, _ as de, b as fe, d as pe, f as S, g as me, h as he, i as C, j as w, k as T, m as ge, n as E, o as _e, q as ve, s as ye, t as be, v as xe, w as Se, x as Ce, y as D, z as we } from "./dev-d0LjACxE.js";
+import { c as O, r as Te } from "./apiBuild-GefjNI5d.js";
+import { t as Ee } from "./bootTiming-BdyP9nYw.js";
+import { n as De } from "./cliArgs-qdZSElM3.js";
+import { join as Oe } from "node:path";
+import { pathToFileURL as ke } from "node:url";
+import { Cause as Ae, Effect as k, Layer as A, ManagedRuntime as je } from "effect";
+import { createLogger as j } from "@voltro/logger";
+import { existsSync as M } from "node:fs";
+import { AggregateRegistry as N, Dispatcher as Me, apiKeyManagementRoutes as P, applySoftDeleteScope as Ne, applyTenantScope as Pe, attachAnalyticsMirror as Fe, awaitServerListening as Ie, bindMutation as F, bindStream as Le, bindSubscription as I, buildTracingLayer as Re, cancelWakeup as ze, compileCron as Be, dataStoreApiKeyStore as Ve, dataStoreIdempotencyStore as He, frameworkApiKeyStrategy as Ue, installPolicyGuardResolver as We, loadResourceTuples as L, makeActionRunner as Ge, makeAdvisoryLockCoordinator as Ke, makeApiKeyService as qe, makeApiKeyUsageBuffer as Je, makeApiKeyUsageFlusher as R, makeAsyncKv as Ye, makeCoordinatedScheduler as Xe, makeEffectStoreLayer as z, makeLazyWorkflowFacade as Ze, makeMutationRunner as Qe, makeOneShotQueryRunner as $e, makeQueryDescriptorProducer as et, makeQueryReauthorizer as tt, makeQuerySubscriber as nt, makeSchemaRegistry as rt, makeWorkflowFacade as it, makeWorkflowFacadeWithCallerContext as at, makeWorkflowLayers as B, noopKv as ot, recordSubscriptionDelivery as st, registerWakeup as ct, resolveSecretsBackend as lt, runProvidedEffect as ut, setSecretsBackend as dt, setSystemStoreHandle as ft, setTupleSource as pt, singleCoordinator as mt, startRpcServer as ht, startScheduler as V, workflowToRpc as gt } from "@voltro/runtime";
+import { RpcGroup as _t } from "@effect/rpc";
+import { SqlClient as vt } from "@effect/sql";
+import { and as yt, ensureTableRegistered as bt, eq as H, or as xt } from "@voltro/database";
+import { appStorageProvider as U, fromNodeReadable as St, getObjectStream as W, putObjectStream as G, toNodeReadable as K } from "@voltro/plugin-storage";
+import { AuthMiddleware as Ct, ConnectionInfoMiddleware as wt, actionToRpc as q, anonymousSubject as Tt, mutationToRpc as Et, queryToRpc as J, streamToRpc as Dt, workflowCancelDescriptor as Ot, workflowDomainEventsQueryDescriptor as Y, workflowEventDeliveriesQueryDescriptor as kt, workflowResumeDescriptor as At, workflowRunEventsQueryDescriptor as X, workflowRunQueryDescriptor as jt, workflowRunStepsQueryDescriptor as Mt, workflowRunsQueryDescriptor as Z, workflowSignalDescriptor as Nt, workflowUpdateDescriptor as Pt } from "@voltro/protocol";
+import { assertProductionSessionSecret as Ft } from "@voltro/protocol/session";
+import { createHash as It, timingSafeEqual as Lt } from "node:crypto";
+import { declaredSnapshot as Rt, describeOutcome as zt, runPlannedMigrations as Bt } from "@voltro/database/sql";
+import { getAuthSessionStrategy as Vt } from "@voltro/plugin-auth";
+import { collectPublicApiRoutes as Ht, restRoutesToHttpRoutes as Ut } from "@voltro/protocol/rest";
+import { buildDeliverWebhookExecute as Wt, buildWebhooksService as Gt, defaultIncomingPath as Kt, deliverWebhookWorkflow as qt, mountIncomingWebhook as Jt } from "@voltro/plugin-webhooks";
+import { packBundle as Yt, runExport as Xt, runImport as Zt, storageBlobSink as Qt, storageRefsBlobSource as $t, unpackBundle as en, unpackBundleToDir as tn } from "@voltro/data-transfer";
+//#region src/adminAuth.ts
+var nn = "/_voltro/admin/import", rn = "/_voltro/admin/export", Q = (e, t) => ({
+	status: e,
+	contentType: "application/json; charset=utf-8",
+	body: JSON.stringify(t)
+}), an = (e) => {
+	let t = e.authorization ?? e.Authorization, n = t ? /^Bearer\s+(.+)$/i.exec(t) : null;
+	return n ? n[1] : null;
+}, on = (e, t) => Lt(It("sha256").update(e).digest(), It("sha256").update(t).digest()), sn = (e, t) => {
+	if (e.method.toUpperCase() !== "POST") return Q(405, { error: "method not allowed" });
+	if (!t || t.length < 16) return Q(503, { error: "data transfer misconfigured (no/weak secret)" });
+	let n = an(e.headers);
+	return !n || !on(n, t) ? Q(401, { error: "unauthorized" }) : null;
+}, cn = j({ scope: "voltro:admin-import" }), ln = "VBUNDLE2", un = async function* (e) {
+	yield e;
+}, dn = (e) => async (t) => {
+	let n = sn(t, e.secret);
+	if (n) return n;
+	let r = t.headers["x-import-mode"], i = t.headers["x-import-on-conflict"], a = t.headers["x-import-atomic"] === "1" || t.headers["x-import-atomic"] === "true", o = t.headers["x-import-force"] === "1" || t.headers["x-import-force"] === "true", s = t.rawBody.byteLength >= 8 && Buffer.from(t.rawBody.subarray(0, 8)).toString("latin1") === ln, c, l;
+	if (s) c = un(t.rawBody), l = "upload";
+	else {
+		let n;
+		try {
+			n = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
+		} catch {
+			return Q(400, { error: "body must be a packed bundle archive or { bundleKey } JSON" });
+		}
+		if (typeof n.bundleKey != "string" || !n.bundleKey) return Q(400, { error: "body.bundleKey (string) is required for the storage transport" });
+		if (!e.openArchive) return Q(501, { error: "storage transport not configured on this instance" });
+		c = e.openArchive(n.bundleKey), l = "storage";
+	}
+	let u = await import("node:os"), d = await import("node:fs/promises"), f = await import("node:path"), p = await d.mkdtemp(f.join(u.tmpdir(), "voltro-admin-import-"));
+	try {
+		e.assetSink ? await en(c, {
+			dir: p,
+			blobs: e.assetSink
+		}) : await tn(c, p);
+		let t = await k.runPromiseExit(Zt({
+			store: e.store,
+			bundleDir: p,
+			...r ? { mode: r } : {},
+			...i ? { onConflict: i } : {},
+			...a ? { atomic: a } : {},
+			...e.snapshot ? { targetSnapshot: e.snapshot } : {},
+			force: o,
+			onWarn: (e) => cn.warn("admin.import", { message: e }),
+			...e.assetSink ? { assetsAlreadyRestored: !0 } : {}
+		}));
+		if (t._tag === "Failure") {
+			let e = t.cause._tag === "Fail" ? t.cause.error : void 0;
+			if (e && e._tag === "SchemaDriftError") {
+				let t = e;
+				return cn.warn("admin.import refused (schema drift)", {
+					transport: l,
+					bundle: t.bundleFingerprint.slice(0, 16),
+					target: t.targetFingerprint.slice(0, 16)
+				}), Q(409, {
+					error: "schema drift",
+					bundleFingerprint: t.bundleFingerprint,
+					targetFingerprint: t.targetFingerprint,
+					diff: t.diff,
+					hint: "re-export against the current schema, or resend with x-import-force: 1"
+				});
+			}
+			throw Error(String(e?.message ?? e ?? "import failed"));
+		}
+		let n = t.value, s = n.tables.reduce((e, t) => e + t.rowCount, 0);
+		return cn.info("admin.import", {
+			transport: l,
+			tables: n.tables.length,
+			rows: s,
+			mode: r ?? "upsert",
+			atomic: a
+		}), Q(200, {
+			tables: n.tables.length,
+			rows: s,
+			transport: l
+		});
+	} catch (e) {
+		return cn.warn("admin.import failed", {
+			transport: l,
+			error: e?.message ?? String(e)
+		}), Q(500, {
+			error: "import failed",
+			message: e?.message ?? String(e)
+		});
+	} finally {
+		await d.rm(p, {
+			recursive: !0,
+			force: !0
+		});
+	}
+}, fn = j({ scope: "voltro:admin-export" }), pn = async (e) => {
+	let t = [];
+	for await (let n of e) t.push(Buffer.from(n));
+	return new Uint8Array(Buffer.concat(t));
+}, mn = (e) => typeof e.tenant == "string" && e.tenant ? {
+	kind: "tenant",
+	tenantId: e.tenant
+} : Array.isArray(e.tables) && e.tables.length ? {
+	kind: "tables",
+	tables: e.tables.filter((e) => typeof e == "string")
+} : { kind: "all" }, hn = (e) => async (t) => {
+	let n = sn(t, e.secret);
+	if (n) return n;
+	let r;
+	try {
+		r = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
+	} catch {
+		return Q(400, { error: "body must be JSON: { profile?, tenant?, tables?, consistency?, compression?, bundleKey? }" });
+	}
+	let i = {};
+	if (typeof r.profile == "string" && r.profile) {
+		if (!e.loadProfile) return Q(501, { error: "server-side profiles not configured on this instance" });
+		try {
+			i = await e.loadProfile(r.profile);
+		} catch (e) {
+			return Q(400, {
+				error: `profile '${r.profile}' could not be loaded`,
+				message: e?.message ?? String(e)
+			});
+		}
+	}
+	let a = r.consistency === "snapshot" ? "snapshot" : i.consistency ?? "live", o = (typeof r.compression == "string" ? r.compression : void 0) ?? i.compression, s = i.scope ?? mn(r), c = typeof r.bundleKey == "string" && r.bundleKey.length > 0, l = r.assets === !0 && e.assetSource ? { blobs: e.assetSource } : {}, u = await import("node:os"), d = await import("node:fs/promises"), f = await import("node:path"), p = await d.mkdtemp(f.join(u.tmpdir(), "voltro-admin-export-"));
+	try {
+		let t = await k.runPromise(Xt({
+			store: e.store,
+			snapshot: e.snapshot,
+			dialect: e.dialect,
+			outDir: p,
+			...i.subset ? { subset: i.subset } : {
+				scope: s,
+				...e.tenantTables && e.tenantTables.length > 0 ? { tenantTables: e.tenantTables } : {}
+			},
+			consistency: a,
+			...o ? { compression: o } : {},
+			...i.masking ? { masking: i.masking } : {}
+		})), n = t.tables.reduce((e, t) => e + t.rowCount, 0), u = t.masking?.transformed.length ?? 0;
+		if (c) {
+			if (!e.putArchive) return Q(501, { error: "storage transport not configured on this instance" });
+			let i = r.bundleKey;
+			return await e.putArchive(i, () => Yt({
+				dir: p,
+				...l
+			})), fn.info("admin.export", {
+				transport: "storage",
+				tables: t.tables.length,
+				rows: n,
+				masked: u,
+				bundleKey: i
+			}), Q(200, {
+				bundleKey: i,
+				tables: t.tables.length,
+				rows: n,
+				masked: u,
+				transport: "storage"
+			});
+		}
+		let d = await pn(Yt({
+			dir: p,
+			...l
+		}));
+		return fn.info("admin.export", {
+			transport: "download",
+			tables: t.tables.length,
+			rows: n,
+			masked: u,
+			bytes: d.byteLength
+		}), {
+			status: 200,
+			contentType: "application/octet-stream",
+			body: d,
+			headers: {
+				"x-export-tables": String(t.tables.length),
+				"x-export-rows": String(n),
+				"x-export-masked": String(u)
+			}
+		};
+	} catch (e) {
+		return fn.warn("admin.export failed", { error: e?.message ?? String(e) }), Q(500, {
+			error: "export failed",
+			message: e?.message ?? String(e)
+		});
+	} finally {
+		await d.rm(p, {
+			recursive: !0,
+			force: !0
+		});
+	}
+}, gn = async (e) => {
+	let { resolve: t } = await import("node:path"), { existsSync: n } = await import("node:fs"), r = [
+		e,
+		`${e}.profile.ts`,
+		`data-profiles/${e}.ts`,
+		`data-profiles/${e}.profile.ts`
+	].map((e) => t(process.cwd(), e)), i = r.find((e) => n(e));
+	if (!i) throw Error(`data profile '${e}' not found (looked for: ${r.join(", ")})`);
+	let a = await import(i), o = a.default ?? a.profile;
+	if (!o) throw Error(`data profile '${i}' has no default export`);
+	return o;
+}, _n = (e, t, n = {}) => (async function* () {
+	let r = await K((await k.runPromise(W(e, t).pipe(k.timeout(n.openTimeout ?? "30 seconds")))).stream), i = n.stallMs ?? 12e4, a, o = () => {
+		a && clearTimeout(a), a = setTimeout(() => r.destroy(/* @__PURE__ */ Error(`storage read stalled for ${i}ms reading '${t}'`)), i);
+	};
+	try {
+		o();
+		for await (let e of r) o(), yield e instanceof Uint8Array ? e : new Uint8Array(e);
+	} finally {
+		a && clearTimeout(a), r.destroy();
+	}
+})(), vn = {
+	get: async () => void 0,
+	set: async () => {},
+	setWithTags: async () => {},
+	remove: async () => !1,
+	has: async () => !1,
+	clear: async () => {},
+	invalidateTag: async () => 0,
+	wrap: async (e, t, n) => n()
+}, yn = async (e) => {
+	ft({
+		dataStore: e.store,
+		schemaRegistry: e.schemaRegistry
+	});
+	let t = new Me({
+		store: e.store,
+		...e.snapshotCache ? { cache: e.snapshotCache } : {},
+		recordDelivery: (e) => st({
+			label: e.label,
+			kind: e.kind,
+			durationMs: e.durationMs,
+			rowCount: e.rowCount
+		})
+	}), n = e.cache ?? vn, r = e.kv ?? ot, i, a, o, s = /* @__PURE__ */ new Map(), c = () => `wfctx_${globalThis.crypto?.randomUUID?.() ?? `${Date.now().toString(36)}${Math.random().toString(36).slice(2)}`}`, l = async (t, n, r) => {
+		let i = {
+			...r,
+			source: r.source ?? `workflow:${t}`
+		};
+		s.set(n, i);
+		try {
+			let r = await e.store.query({
+				table: "_voltro_workflow_start_contexts",
+				order: [],
+				predicate: H("executionId", n),
+				projection: ["id"],
+				skip: void 0,
+				take: 1
+			}), a = {
+				workflowName: t,
+				executionId: n,
+				subject: i.subject ?? null,
+				traceId: i.traceId ?? null,
+				source: i.source ?? null,
+				parentExecutionId: i.parentExecutionId ?? null,
+				parentClosePolicy: i.parentClosePolicy ?? null,
+				createdAt: /* @__PURE__ */ new Date()
+			};
+			r[0] === void 0 ? await e.store.insert("_voltro_workflow_start_contexts", {
+				id: c(),
+				...a
+			}) : await e.store.update("_voltro_workflow_start_contexts", r[0].id, a);
+		} catch (e) {
+			process.stderr.write(`[workflow] failed to persist start context for ${t}/${n}: ${e?.message ?? String(e)}\n`);
+		}
+	}, u = async (t, n) => {
+		let r = s.get(n);
+		if (r !== void 0) return r;
+		try {
+			let t = (await e.store.query({
+				table: "_voltro_workflow_start_contexts",
+				order: [],
+				predicate: H("executionId", n),
+				projection: void 0,
+				skip: void 0,
+				take: 1
+			}))[0];
+			if (t === void 0) return;
+			let r = {
+				...t.subject === null ? {} : { subject: t.subject },
+				...t.traceId === null ? {} : { traceId: t.traceId },
+				...t.source === null ? {} : { source: t.source },
+				...t.parentExecutionId === null ? {} : { parentExecutionId: t.parentExecutionId },
+				...t.parentClosePolicy === null ? {} : { parentClosePolicy: t.parentClosePolicy }
+			};
+			return s.set(n, r), r;
+		} catch (e) {
+			process.stderr.write(`[workflow] failed to load start context for ${n}: ${e?.message ?? String(e)}\n`);
+			return;
+		}
+	}, d = (e.discovered.workflows?.length ?? 0) > 0 ? Ze(() => i) : void 0, f = (e.discovered.workflows?.length ?? 0) > 0 || (e.discovered.eventTriggers?.length ?? 0) > 0, ee = f || (e.discovered.workflowWorkers?.length ?? 0) > 0 || e.scheduleCoordination === "cluster", te = e.tenantIsolation === "namespace", ne = (e.log ?? j({ scope: "voltro:serve" })).child("webhooks"), re, v = e.discovered.webhooks;
+	if (v && v.outgoing.length > 0 && e.workflowEngineLayer !== void 0) {
+		let t = e.workflowEngineLayer, i = h({
+			store: e.store,
+			schemaRegistry: e.schemaRegistry,
+			cache: n,
+			kv: r
+		}), a = v.outgoing.map((e) => e.descriptor);
+		re = Gt(i, async (e) => {
+			let n = qt.execute(e).pipe(k.provide(qt.toLayer(Wt(i, { events: a })).pipe(A.provideMerge(t))));
+			k.runPromise(n).catch((t) => {
+				ne.error("deliverWebhook workflow crashed", {
+					deliveryId: e.deliveryId,
+					targetId: e.targetId
+				}, t);
+			});
+		}, { events: a });
+	}
+	let ae = /* @__PURE__ */ new Map();
+	if (v) for (let e of v.incoming) {
+		let t = e.descriptor.path ?? Kt(e.descriptor.id), n = `VOLTRO_WEBHOOK_SECRET_${e.descriptor.id.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`, r = Jt(e.descriptor, {
+			resolveSecret: async () => process.env[n] ?? null,
+			resolveWorkflows: () => d === void 0 ? void 0 : at(d, {
+				traceId: `incoming:${e.descriptor.id}`,
+				source: `incoming:${e.descriptor.id}`
+			}),
+			log: (e) => {
+				let t = {
+					webhookId: e.webhookId,
+					status: e.status,
+					signatureOk: String(e.signatureOk),
+					idempotency: e.idempotency,
+					durationMs: e.durationMs
+				};
+				e.status >= 500 ? ne.error("incoming delivery failed", t) : e.status >= 400 ? ne.warn("incoming delivery rejected", t) : ne.info("incoming delivery handled", t);
+			}
+		});
+		ae.set(t, { handle: r });
+	}
+	We(), pt((t) => L(e.store, t.subjectId, t.resourceType, t.resourceId));
+	let oe = (e.discovered.outboxHandlers?.length ?? 0) > 0 ? ie({
+		handlers: e.discovered.outboxHandlers ?? [],
+		store: e.store,
+		log: (e.log ?? j({ scope: "voltro:serve" })).child("outbox")
+	}) : void 0, b = _({
+		definitions: (e.discovered.connections ?? []).map((e) => e.definition),
+		store: e.store,
+		publicUrl: w(e.port ?? 4e3),
+		log: (e.log ?? j({ scope: "voltro:serve" })).child("connections")
+	}), x = ve({
+		store: e.store,
+		schemaRegistry: e.schemaRegistry,
+		cache: n,
+		kv: r,
+		...re === void 0 ? {} : { webhooksService: re },
+		...d === void 0 ? {} : { workflowsProxy: d },
+		eventTriggers: e.discovered.eventTriggers ?? [],
+		namespaceIsolationOn: te,
+		...oe === void 0 ? {} : { outbox: { nudge: oe.nudge } },
+		...b.active ? { connections: { registry: b.registry } } : {}
+	}), ce = A.succeed(N, Se), le = (t, n) => {
+		let r = t.pipe(k.provide(z(n)));
+		return ut((e.baseLayer ? r.pipe(k.provide(e.baseLayer)) : r).pipe(k.provide(ce)));
+	}, ue = Qe({
+		store: e.store,
+		buildContext: (e, t, n) => x(e, t, n),
+		runEffect: le,
+		undoCapture: D()
+	}), de = xe(), fe = Ge({
+		buildContext: (e) => x(e),
+		runEffect: le
+	}), pe = {
+		buildContext: (e) => x(e),
+		finalize: (t, n) => Ne(Pe(t, e.tenantScopedTables, n.subject.tenantId), e.softDeleteScopedTables),
+		provideEffect: (e, t) => e.pipe(k.provide(z(t)))
+	}, S = et(pe), me = $e({
+		...pe,
+		queryRows: (t) => e.store.query(t)
+	}), C = nt({
+		...pe,
+		subscribeDescriptor: (e, n, r) => t.subscribe(e, n, r),
+		subscribeComputed: (e, n, r) => t.subscribeComputed(e, n, r)
+	}), E = {};
+	for (let n of [
+		...e.discovered.queries,
+		...de.queries,
+		...b.queries
+	]) E[n.descriptor.name] = (e) => I(S(n, e), t, `subscription.${n.descriptor.name}`, void 0, void 0, tt(n, e));
+	for (let t of [
+		...e.discovered.mutations,
+		...de.mutations,
+		...b.mutations
+	]) E[t.descriptor.name] = (e) => F(async (e, n) => ue(t, e, n), e, `mutation.${t.descriptor.name}`);
+	for (let t of [...e.discovered.actions, ...b.actions]) E[t.descriptor.name] = (e) => F(async (e, n) => fe(t, e, n), e, `action.${t.descriptor.name}`);
+	let _e = () => `public-${Math.random().toString(36).slice(2, 10)}`, ye = [
+		...e.discovered.queries.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => me(e, t, {
+				subject: n.subject,
+				traceId: _e()
+			}),
+			subscribe: (t, n, r) => C(e, t, {
+				subject: n.subject,
+				traceId: _e()
+			}, r)
+		})),
+		...e.discovered.mutations.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => ue(e, t, {
+				subject: n.subject,
+				traceId: _e()
+			})
+		})),
+		...e.discovered.actions.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => fe(e, t, {
+				subject: n.subject,
+				traceId: _e()
+			})
+		}))
+	], be = ye.length > 0 ? Ut(Ht(ye), {
+		store: e.store,
+		resolveSubject: (t) => e.resolveSubject(t, -1)
+	}) : [], Ce = e.dataTransferSecret ?? process.env.VOLTRO_DATA_TRANSFER_SECRET, we = Ce && Ce.length >= 16 ? [{
+		method: "POST",
+		path: nn,
+		handle: dn({
+			secret: Ce,
+			store: e.store,
+			...e.dataTransferSnapshot ? { snapshot: e.dataTransferSnapshot } : {},
+			assetSink: Qt(U()),
+			openArchive: (e) => _n(U(), e)
+		})
+	}, {
+		method: "POST",
+		path: rn,
+		handle: hn({
+			secret: Ce,
+			store: e.store,
+			snapshot: e.dataTransferSnapshot ?? { tables: [] },
+			dialect: e.dataTransferDialect ?? "memory",
+			tenantTables: [...e.tenantScopedTables],
+			loadProfile: gn,
+			assetSource: $t(U(), e.store),
+			putArchive: async (e, t) => {
+				let { Readable: n } = await import("node:stream"), r = U(), i = St("storage", () => n.from(t()));
+				await k.runPromise(G(r, e, i, { contentType: "application/octet-stream" }));
+			}
+		})
+	}] : [], O = [
+		...e.httpRoutes ?? [],
+		...be,
+		...we,
+		...b.httpRoutes
+	];
+	for (let t of e.discovered.streams ?? []) E[t.descriptor.name] = (n) => Le((r) => {
+		let i = x(r), a = t.executor(n, i);
+		if (k.isEffect(a)) {
+			let t = a.pipe(k.provide(z(i.store)));
+			return (e.baseLayer ? t.pipe(k.provide(e.baseLayer)) : t).pipe(k.provide(ce));
+		}
+		return typeof a == "object" && a && typeof a.then == "function" ? k.promise(() => a) : a;
+	}, `stream.${t.descriptor.name}`);
+	for (let t of e.discovered.workflows ?? []) E[t.definition.name] = (e) => F(async (e, n) => {
+		let r = n;
+		return at(d, {
+			subject: r.subject,
+			traceId: r.traceId,
+			source: "workflow-rpc"
+		}).start(t.definition.name, e);
+	}, e, `workflow.${t.definition.name}`);
+	f && (E[jt.name] = (e) => I(S({
+		descriptor: jt,
+		executor: (e) => {
+			let t = e.id;
+			return {
+				table: "_voltro_workflow_runs",
+				order: [{
+					column: "startedAt",
+					direction: "desc"
+				}],
+				predicate: xt(H("id", t), H("executionId", t)),
+				take: 1,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${jt.name}`), E[Z.name] = (e) => I(S({
+		descriptor: Z,
+		executor: (e) => {
+			let t = e, n = [...t.tag === void 0 ? [] : [H("tag", t.tag)], ...t.status === void 0 ? [] : [H("status", t.status)]], r = Number.isFinite(t.limit) && t.limit !== void 0 ? Math.min(Math.max(Math.floor(t.limit), 1), 500) : 100;
+			return {
+				table: "_voltro_workflow_runs",
+				order: [{
+					column: "startedAt",
+					direction: "desc"
+				}],
+				predicate: n.length === 0 ? void 0 : n.length === 1 ? n[0] : yt(...n),
+				take: r,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${Z.name}`), E[Mt.name] = (e) => I(S({
+		descriptor: Mt,
+		executor: (e) => {
+			let t = e.runId;
+			return {
+				table: "_voltro_workflow_run_steps",
+				order: [{
+					column: "startedAt",
+					direction: "asc"
+				}],
+				predicate: H("runId", t),
+				take: 1e3,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${Mt.name}`), E[X.name] = (e) => I(S({
+		descriptor: X,
+		executor: (e) => {
+			let t = e.runId;
+			return {
+				table: "_voltro_workflow_run_events",
+				order: [{
+					column: "occurredAt",
+					direction: "asc"
+				}],
+				predicate: H("runId", t),
+				take: 1e3,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${X.name}`), E[Y.name] = (e) => I(S({
+		descriptor: Y,
+		executor: (e) => {
+			let t = e;
+			return {
+				table: "_voltro_workflow_events",
+				order: [{
+					column: "occurredAt",
+					direction: "desc"
+				}],
+				predicate: t.name === void 0 ? void 0 : H("name", t.name),
+				take: Math.max(1, Math.min(500, t.limit ?? 100)),
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${Y.name}`), E[kt.name] = (e) => I(S({
+		descriptor: kt,
+		executor: (e) => {
+			let t = e.eventId;
+			return {
+				table: "_voltro_workflow_event_deliveries",
+				order: [{
+					column: "createdAt",
+					direction: "asc"
+				}],
+				predicate: H("eventId", t),
+				take: 500,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${kt.name}`), E[Ot.name] = (t) => F(async (t, n) => {
+		let r = t;
+		return await g(e.store, n.subject, { executionId: r.executionId }), await d.cancel(r.workflowName, r.executionId), await Be(r.workflowName, r.executionId, "workflow.cancel"), { ok: !0 };
+	}, t, `action.${Ot.name}`), E[At.name] = (t) => F(async (t, n) => {
+		let r = t;
+		return await g(e.store, n.subject, { executionId: r.executionId }), await d.resume(r.workflowName, r.executionId), { ok: !0 };
+	}, t, `action.${At.name}`), E[Nt.name] = (t) => F(async (t, n) => {
+		let r = t;
+		return await g(e.store, n.subject, { id: r.id }), d.signal({ id: r.id }, r.signalName, r.payload);
+	}, t, `action.${Nt.name}`), E[Pt.name] = (t) => F(async (t, n) => {
+		let r = t;
+		return await g(e.store, n.subject, { id: r.id }), d.update({ id: r.id }, r.updateName, r.payload, r.timeoutMs === void 0 ? void 0 : { timeoutMs: r.timeoutMs });
+	}, t, `action.${Pt.name}`));
+	let Te = [
+		...e.discovered.queries.map((e) => J(e.descriptor)),
+		...e.discovered.mutations.map((e) => Et(e.descriptor)),
+		...e.discovered.actions.map((e) => q(e.descriptor)),
+		...de.queries.map((e) => J(e.descriptor)),
+		...de.mutations.map((e) => Et(e.descriptor)),
+		...b.queries.map((e) => J(e.descriptor)),
+		...b.mutations.map((e) => Et(e.descriptor)),
+		...b.actions.map((e) => q(e.descriptor)),
+		...(e.discovered.streams ?? []).map((e) => Dt(e.descriptor)),
+		...(e.discovered.workflows ?? []).map((e) => gt(e.definition)),
+		...f ? [
+			J(jt),
+			J(Z),
+			J(Mt),
+			J(X),
+			J(Y),
+			J(kt),
+			q(Ot),
+			q(At),
+			q(Nt),
+			q(Pt)
+		] : []
+	], Ee = _t.make(...Te).middleware(Ct).middleware(wt), De = A.succeed(Ct, Ct.of(({ headers: t, clientId: n }) => k.promise(() => e.resolveSubject(t, n)))), Oe = A.succeed(wt, wt.of(({ clientId: e }) => k.succeed({ clientId: e }))), ke = e.dormancyTenantId ?? "default", Ae = e.dormancy === "sleep" ? {
+		register: (t, n, r) => ct(e.store, {
+			tenantId: r ?? ke,
+			kind: "workflow",
+			refId: t,
+			wakeAt: n
+		}),
+		cancel: (t, n) => ze(e.store, {
+			tenantId: n ?? ke,
+			kind: "workflow",
+			refId: t
+		}).then(() => {})
+	} : void 0, M = ee ? await import("@voltro/workflow") : void 0, P = M?.makeWorkflowRunRecorder({
+		store: e.store,
+		...Ae === void 0 ? {} : { wakeups: Ae }
+	}), Fe = async (t, n) => {
+		await M.closeWorkflowChildrenForParent({
+			store: e.store,
+			parentExecutionId: t,
+			parentStatus: n,
+			recorder: P,
+			log: { warn: (e, t) => {
+				process.stderr.write(`[workflow] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+			} },
+			interruptChild: async (t, n) => {
+				let r = (e.discovered.workflows ?? []).find((e) => e.definition.name === t);
+				if (!r) throw Error(`Unknown child workflow: ${t}`);
+				if (!a) throw Error("Workflow runtime is not ready");
+				await a.runPromise(r.definition.interrupt(n));
+			}
+		});
+	}, Be = async (t, n, r) => {
+		let i = (await e.store.query({
+			table: "_voltro_workflow_runs",
+			order: [],
+			predicate: H("executionId", n),
+			projection: void 0,
+			skip: void 0,
+			take: 1
+		}))[0];
+		if (i === void 0) return;
+		let a = await e.store.update("_voltro_workflow_runs", i.id, {
+			status: "cancelled",
+			cancelled: !0,
+			completedAt: /* @__PURE__ */ new Date()
+		}), o = i.subject?.tenantId ?? void 0;
+		a && await P.recordEvent({
+			runId: i.id,
+			eventType: "run-cancelled",
+			payload: {
+				reason: r,
+				workflowName: t,
+				executionId: n,
+				...o == null ? {} : { tenantId: o }
+			}
+		}), a && await Fe(n, "cancelled");
+	}, Ve = [...B(e.discovered.workflows ?? [], {
+		buildContext: (t, n) => e.buildContextForWorkflow?.(t, n) ?? x({
+			subject: t.subject,
+			traceId: t.traceId
+		}, e.store, void 0, `workflow:${n.workflowName}`, { parentExecutionId: n.executionId }),
+		resolveStartContext: u
+	}, (t, n, r) => {
+		let i = M.getWorkflowVersionMetadata(t.definition);
+		return M.wrapWorkflowExecuteWithRunRecording({
+			name: t.definition.name,
+			store: e.store,
+			subject: r.subject,
+			source: r.source ?? null,
+			traceId: r.traceId,
+			workflowVersion: i.version,
+			workflowCompatibleVersions: i.compatibleWith,
+			workflowPatches: i.patches,
+			parentExecutionId: r?.parentExecutionId ?? null,
+			parentClosePolicy: r?.parentClosePolicy ?? null,
+			onParentClose: ({ executionId: e, status: t }) => Fe(e, t),
+			recorder: P
+		}, n);
+	}), ...e.discovered.workflowWorkers ?? []], He = Ve.length > 0 ? A.mergeAll(...Ve) : A.empty;
+	if (((e.discovered.workflows?.length ?? 0) > 0 || (e.discovered.workflowWorkers?.length ?? 0) > 0 || e.scheduleCoordination === "cluster") && e.workflowEngineLayer !== void 0) {
+		let t = He.pipe(A.provideMerge(e.workflowEngineLayer));
+		a = je.make(e.baseLayer === void 0 ? t : t.pipe(A.provideMerge(e.baseLayer))), await a.runPromise(k.void), i = (e.discovered.workflows?.length ?? 0) > 0 ? it({
+			workflows: e.discovered.workflows ?? [],
+			runEffect: (e) => a.runPromise(e),
+			rememberStartContext: l,
+			signal: async (t, n, r) => {
+				let i = await M.sendWorkflowSignal({
+					store: e.store,
+					recorder: P,
+					target: t,
+					signalName: n,
+					payload: r
+				});
+				return await a.runPromise(M.completeSuspendingSignal({
+					store: e.store,
+					target: t,
+					signalName: n,
+					payload: r
+				})).catch(() => {}), i;
+			},
+			update: (t, n, r, i) => M.sendWorkflowUpdate({
+				store: e.store,
+				recorder: P,
+				target: t,
+				updateName: n,
+				payload: r,
+				...i === void 0 ? {} : { options: i }
+			}),
+			listRuns: (t) => ge(e.store, t),
+			retry: (t, n) => he({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runPromise: (e) => a.runPromise(e)
+			}, t, n)
+		}) : void 0;
+	}
+	let Ue = A.mergeAll(Ee.toLayer(E), De, Oe), qe = se(E, e.discovered.queries.map((e) => e.descriptor.name), f), Je = A.mergeAll(Ee.toLayer(qe), De, Oe), R = e.observability, Ye = await Re({
+		...R && R.spanProcessors.length > 0 ? { extraSpanProcessors: R.spanProcessors } : {},
+		...R && R.metricReaders.length > 0 ? { extraMetricReaders: R.metricReaders } : {},
+		...R && Object.keys(R.resourceAttributes).length > 0 ? { resourceAttributes: R.resourceAttributes } : {},
+		...R && R.sampler !== void 0 ? { sampler: R.sampler } : {}
+	}), Xe = !1, rt = e.store.ping ? () => e.store.ping().then(() => !0).catch(() => !1) : void 0, { server: lt, shutdown: dt } = ht({
+		group: Ee,
+		handlersLayer: Ue,
+		httpHandlersLayer: Je,
+		port: e.port ?? 4e3,
+		path: e.path ?? "/ws",
+		tracerLayer: Ye.layer,
+		healthCheck: {
+			isReady: () => Xe,
+			...rt ? { ping: rt } : {}
+		},
+		...O.length > 0 ? { httpRoutes: O } : {},
+		...ae.size > 0 ? { webhookRoutes: ae } : {}
+	});
+	if (await Ie(lt), (e.discovered.schedules?.length ?? 0) > 0) {
+		let t = (e.scheduleCoordination ?? "single") === "advisoryLock" ? Ke(e.store, e.scheduleReplicaId ?? `pid-${process.pid}`) : mt;
+		o = await V(e.discovered.schedules ?? [], {
+			store: e.store,
+			coordinator: t,
+			defaultTrigger: e.scheduleDefaultTrigger ?? "self",
+			replicaId: e.scheduleReplicaId ?? `pid-${process.pid}`,
+			armSelf: e.scheduleArmSelf ?? !0,
+			dormancy: e.dormancy ?? "always-on",
+			...e.dormancyTenantId === void 0 ? {} : { dormancyTenantId: e.dormancyTenantId },
+			buildContext: ({ traceId: t, scheduleName: n, subject: r }) => x({
+				subject: r,
+				traceId: t
+			}, e.store, void 0, `schedule:${n}`),
+			log: {
+				info: (e, t) => {
+					process.stdout.write(`[schedule] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+				},
+				warn: (e, t) => {
+					process.stderr.write(`[schedule] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+				},
+				error: (e, t) => {
+					process.stderr.write(`[schedule] ERROR ${e} ${t ? JSON.stringify(t) : ""}\n`);
+				},
+				debug: () => {}
+			},
+			...e.scheduleFireInterceptor === void 0 ? {} : { interceptFire: e.scheduleFireInterceptor },
+			...e.onScheduleRunEvent === void 0 ? {} : { onRunEvent: e.onScheduleRunEvent }
+		}), e.onSchedulerReady?.(o);
+	}
+	let vt = e.log ?? j({ scope: "voltro:serve" }), bt, W;
+	if ((e.discovered.subscribers?.length ?? 0) > 0 && (bt = m(e.discovered.subscribers ?? [], e.store, vt.child("subscribe"), e.schemaRegistry)), (e.discovered.reactions?.length ?? 0) > 0) {
+		let t = vt.child("reaction");
+		W = y(e.discovered.reactions ?? [], e.store, {
+			runAct: async (n, r) => {
+				if (n.kind === "workflow") {
+					if (d === void 0) {
+						t.warn("reaction workflow act skipped — no workflow engine in this app", { workflow: n.workflow });
+						return;
+					}
+					let e = r.new ?? r.old ?? {};
+					await at(d, {
+						traceId: `reaction:${n.workflow}`,
+						source: `reaction:${n.workflow}`
+					}).start(n.workflow, e);
+					return;
+				}
+				await T(n.agent, r, {
+					findAgentSend: (t) => e.discovered.actions.find((e) => e.descriptor.name === `${t}.send`),
+					runAction: (e, t, n) => Promise.resolve(fe(e, t, n)),
+					makeSubject: (e) => Tt(e),
+					now: () => Date.now(),
+					log: t
+				});
+			},
+			checkBudget: async (n, r) => {
+				try {
+					let { requireAiBudget: t } = await import("@voltro/ai");
+					return (await k.runPromise(k.either(t(e.store, {
+						tenantId: n,
+						limitUsd: r
+					}))))._tag === "Right";
+				} catch (e) {
+					return t.warn("reaction budget check failed — refusing the act", { tenantId: n }, e), !1;
+				}
+			}
+		}, t);
+	}
+	let K;
+	return (e.discovered.aggregates?.length ?? 0) > 0 && (K = await p({
+		discovered: e.discovered.aggregates ?? [],
+		store: e.store,
+		log: vt.child("aggregate"),
+		...e.analytics === void 0 ? {} : { analytics: e.analytics },
+		...e.aggregateStorage === void 0 ? {} : { storage: e.aggregateStorage },
+		...e.aggregateCoordinator === void 0 ? {} : { coordinator: e.aggregateCoordinator }
+	}), ce = A.succeed(N, K.registry)), Xe = !0, e.bootTiming?.mark("ready"), {
+		dispatcher: t,
+		server: lt,
+		scheduler: o,
+		close: async () => {
+			Xe = !1, K?.detach(), W?.(), bt?.(), await o?.shutdown(), t.close(), await a?.dispose(), await new Promise((e) => lt.close(() => e())), await dt();
+		}
+	};
+}, $ = j({ scope: "voltro:serve" }), bn = (e, t, n) => (e === "production" || e === "staging") && t !== "memory" && n !== "0", xn = De, Sn = async (e) => {
+	let t = O(process.cwd());
+	if (M(t)) {
+		let n;
+		try {
+			let e = await import(ke(t).href);
+			typeof e.runServe == "function" ? n = e.runServe : $.warn("serve bundle has no runServe export — using the standard serve path");
+		} catch (e) {
+			$.warn("serve bundle failed to load — using the standard serve path", {}, e);
+		}
+		if (n) return $.info("serve: booting from the precompiled serve bundle"), n(e);
+	}
+	return Cn(e);
+}, Cn = async (p) => {
+	let m = Ee();
+	process.env.NODE_ENV || (process.env.NODE_ENV = "production"), Ft();
+	let h = process.cwd(), g = Number(process.env.PORT ?? xn(p, "--port") ?? 4e3), _ = await _e(h);
+	dt(lt(_?.secrets)), await e({
+		rawEnv: _?.env,
+		appType: "api",
+		root: h,
+		log: $,
+		generateTypes: !1
+	}), m.mark("config");
+	let y = (process.env.DB_DIALECT ?? _?.store ?? "memory").toLowerCase(), ie = (y === "mariadb" || y === "postgres" || y === "mssql") && (process.env.CDC ?? "1") !== "0", se = y === "mariadb" ? "mariadb" : y === "mssql" ? "mssql" : void 0, he = Te(h);
+	if (!u() && M(he)) try {
+		let e = await import(ke(he).href);
+		if (e.modules) {
+			let t = {};
+			for (let [n, r] of Object.entries(e.modules)) t[Oe(h, n)] = r;
+			l(t), $.info("precompiled api bundle loaded", { modules: Object.keys(t).length });
+		}
+	} catch (e) {
+		$.warn("precompiled api bundle failed to load — falling back to source", {}, e);
+	}
+	let w = await pe(h), T = await ye(w, { cdc: ie && se !== void 0 }), ge = w.filter((e) => Ce.test(e)), ve = ge.length > 0 ? await oe(ge, $.child("webhooks")) : void 0, xe = c({
+		mix: T.featureMix,
+		plugins: _?.plugins ?? [],
+		cdc: ie && se !== void 0,
+		...se ? { cdcDialect: se } : {}
+	}), Se = _?.analytics !== void 0 && _.analytics.kind !== "noop" && y !== "memory" ? (await r(y)).makeSqlLayer(C()) : void 0, D = await we({
+		spec: _?.analytics,
+		sqlLayer: Se,
+		log: $
+	}), O = (() => {
+		let e = new Set(T.tables.map((e) => e.tableName)), t = [...T.tables];
+		for (let n of [...xe, ...D.tables]) e.has(n.tableName) || (e.add(n.tableName), t.push(n));
+		return t;
+	})();
+	for (let e of O) bt(e);
+	let De = (process.env.NODE_ENV ?? "").toLowerCase();
+	if (bn(De, y, process.env.VOLTRO_AUTO_MIGRATE)) {
+		let e = (await r(y)).makeSqlLayer(C()), t = await k.runPromise(vt.SqlClient.pipe(k.flatMap((e) => Bt(e, O, {
+			appliedBy: `serve:${De}`,
+			environment: "prod",
+			dialectId: y
+		})), k.provide(e)));
+		t.kind === "prod-mismatch" && ($.error(zt(t, y)), $.error("serve: refusing to boot — apply the schema first (voltro db apply in a pre-deploy step), or set VOLTRO_AUTO_MIGRATE=0 to bypass this check."), process.exit(1)), $.info(zt(t, y));
+	}
+	let j = rt(O);
+	m.mark("discover");
+	let N = await E(_, void 0);
+	_?.cache && !process.env.CACHE_BACKEND && (process.env.CACHE_BACKEND = _.cache), _?.cacheRedisUrl && !process.env.CACHE_REDIS_URL && (process.env.CACHE_REDIS_URL = _.cacheRedisUrl), _?.cacheRedisDriver && !process.env.CACHE_REDIS_DRIVER && (process.env.CACHE_REDIS_DRIVER = _.cacheRedisDriver), _?.cacheKeyPrefix && !process.env.CACHE_KEY_PREFIX && (process.env.CACHE_KEY_PREFIX = _.cacheKeyPrefix);
+	let { service: Me, invalidationBus: Ne, snapshotCache: Pe, cache: Ie, backend: F, dispose: Le } = await le({ env: process.env });
+	$.info(`cache backend resolved: ${F}` + (F === "redis" ? ` (driver ${process.env.CACHE_REDIS_DRIVER ?? "resp"})` : " — in-process, not cross-instance")), N.onChange((e) => {
+		k.runFork(Ne.publish(e.table));
+	}), _?.kv && !process.env.KV_BACKEND && (process.env.KV_BACKEND = _.kv), _?.kvRedisUrl && !process.env.KV_REDIS_URL && (process.env.KV_REDIS_URL = _.kvRedisUrl), _?.kvKeyPrefix && !process.env.KV_KEY_PREFIX && (process.env.KV_KEY_PREFIX = _.kvKeyPrefix);
+	let { kv: I, service: Re } = await Ye({ store: N });
+	m.mark("store");
+	let ze = Fe({
+		store: N,
+		sink: D.sink,
+		log: $
+	}), We = ue({
+		store: N,
+		dialect: y
+	}), L = _?.plugins ?? [], Ge = process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, z, Ze;
+	y !== "memory" && (z = je.make((await r(y)).makeSqlLayer(C())), Ze = await z.runPromise(vt.SqlClient));
+	let Qe = Xe({
+		coordinator: [
+			"postgres",
+			"mariadb",
+			"mysql",
+			"mssql"
+		].includes(y) ? Ke(N, Ge, $) : mt,
+		replicaId: Ge,
+		log: $
+	}), $e = [], et = {
+		...Ze ? { sql: Ze } : {},
+		scheduleCoordinated: (e, t, n) => {
+			let r = Qe(e, t, n);
+			return $e.push(r), r;
+		}
+	};
+	for (let e of L) e.bindDataStore?.(N, et);
+	let tt = L.filter((e) => typeof e.onChangeEvent == "function");
+	if (tt.length > 0) {
+		let e = N.changeScope ?? "local";
+		N.onChange((t) => {
+			let n = {
+				table: t.table,
+				op: t.op,
+				new: t.new ?? null,
+				old: t.old ?? null,
+				...t.origin === void 0 ? {} : { origin: t.origin },
+				changeScope: e
+			};
+			for (let e of tt) k.runFork(e.onChangeEvent(n).pipe(k.catchAllCause((t) => k.sync(() => $.warn(`plugin ${e.name} onChangeEvent failed`, { error: Ae.pretty(t) })))));
+		});
+	}
+	let nt = de({
+		plugins: L,
+		appName: _?.name ?? "voltro-api",
+		appType: "api",
+		voltroVersion: process.env.npm_package_version ?? "0.0.0",
+		log: $
+	});
+	L.length && await nt.activate(), m.mark("plugins");
+	let it = await nt.gatherObservability(), at = await S(N, _, y, {
+		info: (e, t) => process.stdout.write(`[broadcast] ${e} ${t ? JSON.stringify(t) : ""}\n`),
+		warn: (e, t) => process.stderr.write(`[broadcast] ${e} ${t ? JSON.stringify(t) : ""}\n`),
+		debug: () => {}
+	}), B = _?.apiKeys, ot = (typeof B == "object" ? B.prefix : void 0) ?? "voltro_", st = B ? Ve(N) : void 0, ct = st ? Je({ flush: R(st) }) : void 0;
+	ct && process.once("exit", () => {
+		ct.shutdown();
+	});
+	let ut = st ? qe(st, {
+		prefix: ot,
+		...ct ? { usage: ct } : {}
+	}) : void 0, ft = ut ? [Ue(ut, { prefix: ot })] : [], pt = be([..._?.auth?.strategies ?? [], ...ft], Vt(_?.plugins ?? []), _?.auth?.anonymousTenantRequired ?? !1), ht = [..._?.restRoutes ?? [], ...ut ? P(ut, (typeof B == "object" ? B.managementPath : void 0) ?? "/v1/api-keys") : []], V = _?.idempotency, gt = V ? {
+		store: He(N),
+		header: (typeof V == "object" ? V.header : void 0) ?? "Idempotency-Key",
+		ttlMs: (typeof V == "object" ? V.ttlMs : void 0) ?? 864e5
+	} : void 0, _t = ht.length > 0 ? Ut(ht, {
+		store: N,
+		resolveSubject: (e) => pt({
+			headers: e,
+			clientId: -1
+		}),
+		...gt ? { idempotency: gt } : {}
+	}) : [], yt = L.map((e) => e.services).filter((e) => e !== void 0), H = A.mergeAll(ne({
+		analyticsLayer: D.layer,
+		cacheService: Me,
+		kvService: Re,
+		pluginServices: yt,
+		userLayers: _?.layers ?? []
+	}), ce(_?.http ?? {})), xt = _?.scheduling ?? {}, U = xt.trigger ?? "self", St = /* @__PURE__ */ new Set([
+		"postgres",
+		"mysql",
+		"mariadb",
+		"mssql"
+	]), W = xt.coordination ?? (St.has(y) ? "advisoryLock" : "single"), G = W === "cluster" && St.has(y), K = G ? "cluster" : W === "advisoryLock" && St.has(y) ? "advisoryLock" : "single";
+	W === "cluster" && !G && $.warn("scheduling.coordination=cluster needs a sql-backed store except sqlite — falling back to single"), W === "advisoryLock" && !St.has(y) && $.warn("scheduling.coordination=advisoryLock needs a SQL store (the claim-row gate) — falling back to single");
+	let Ct, wt = T.workflows.length > 0 || T.workflowWorkers.length > 0 || T.eventTriggers.length > 0 || (ve?.outgoing.length ?? 0) > 0 || G, q;
+	if (wt) {
+		if (y === "mssql") {
+			let e = await ae(process.cwd());
+			e && $.warn(e);
+		}
+		let [{ WorkflowEngine: e }, { makeClusterCronLayer: t, workflowEngineLayer: n, resolveRunnerStorage: i }] = await Promise.all([import("@effect/workflow"), import("@voltro/workflow/cluster")]), a = G ? T.schedules.filter((e) => (e.trigger ?? U) === "self").map((e) => t({
+			name: e.name,
+			cron: Be(e),
+			execute: async () => {
+				await Ct?.fireFromCluster(e.name);
+			}
+		})) : [];
+		q = y === "memory" ? e.layerMemory : await (async () => {
+			let e = await r(y), t = i({ sqliteFamily: e.id === "sqlite" || e.id === "turso" });
+			return $.info(`workflow engine: cluster-${t}, dialect=${e.id}` + (t === "memory" ? " — single-process durable replay, no cross-pod shard handoff" + (e.id !== "sqlite" && e.id !== "turso" ? " (VOLTRO_WORKFLOW_RUNNER_STORAGE=memory: SqlRunnerStorage/cluster_runners + GET_LOCK skipped)" : "") : "")), n({
+				sqlClientLayer: e.makeSqlLayer(C()),
+				runnerStorage: t,
+				dialectId: e.id,
+				...process.env.VOLTRO_WORKFLOW_RUNNER_PORT ? { runnerListenPort: Number(process.env.VOLTRO_WORKFLOW_RUNNER_PORT) } : {},
+				...a.length > 0 ? { extraShardingLayers: a } : {}
+			});
+		})();
+	}
+	let Tt = me(L, t()), Et = w.filter((e) => /\.subscribe\.tsx?$/.test(e)), J = Et.length > 0 ? await re(Et, $) : [], Dt = w.filter((e) => /\.reaction\.tsx?$/.test(e)), Ot = Dt.length > 0 ? await d(Dt, $) : [], Y = w.filter((e) => s.test(e)), kt = Y.length > 0 ? await v(Y, $) : [], At = w.filter((e) => /\.aggregate\.tsx?$/.test(e)), X = At.length > 0 ? await b(At, $) : [], jt = te();
+	if (X.length > 0 && y !== "memory") try {
+		jt = ee((await r(y)).makeSqlLayer(C()));
+	} catch (e) {
+		$.warn("aggregate: SQL storage init failed — falling back to in-process", { err: String(e) });
+	}
+	let Mt = y === "memory" ? mt : Ke(N, `aggregate@${process.pid}`, $), Z = [], Nt = [], Pt = w.filter((e) => o.test(e));
+	if (Pt.length > 0) {
+		let e = $.child("agent"), t = w.filter((e) => i.test(e));
+		t.length > 0 && await n(t, e);
+		let r = await a(Pt, e);
+		for (let e of r.agents) for (let t of fe(e)) (t.kind === "action" ? Z : Nt).push({
+			file: t.file,
+			descriptor: t.descriptor,
+			executor: t.executor
+		});
+		r.agents.length > 0 && e.info("synthesized agent routes", { agents: r.agents.map((e) => e.descriptor.name) });
+	}
+	m.mark("workflow");
+	let It = await yn({
+		bootTiming: m,
+		discovered: {
+			queries: [...T.queries, ...Nt],
+			mutations: T.mutations,
+			actions: [...T.actions, ...Z],
+			streams: T.streams,
+			workflows: T.workflows,
+			workflowWorkers: T.workflowWorkers,
+			eventTriggers: T.eventTriggers,
+			schedules: T.schedules,
+			subscribers: J,
+			outboxHandlers: kt,
+			connections: T.connections,
+			reactions: Ot,
+			aggregates: X,
+			...ve === void 0 ? {} : { webhooks: ve }
+		},
+		log: $,
+		analytics: D.sink,
+		aggregateStorage: jt,
+		aggregateCoordinator: Mt,
+		store: N,
+		kv: I,
+		cache: Ie,
+		snapshotCache: Pe,
+		schemaRegistry: j,
+		tenantScopedTables: T.tenantScopedTables,
+		softDeleteScopedTables: T.softDeleteScopedTables,
+		dataTransferSnapshot: Rt(O),
+		dataTransferDialect: y,
+		tenantIsolation: (process.env.VOLTRO_TENANT_ISOLATION ?? _?.tenancy?.isolation) === "namespace" ? "namespace" : "shared-schema",
+		resolveSubject: (e, t) => pt({
+			headers: e,
+			clientId: t
+		}),
+		httpRoutes: [...L.flatMap((e) => e.httpRoutes ?? []), ..._t],
+		...H ? { baseLayer: H } : {},
+		...q === void 0 ? {} : { workflowEngineLayer: q },
+		scheduleDefaultTrigger: U,
+		scheduleCoordination: K,
+		scheduleArmSelf: !G,
+		dormancy: process.env.VOLTRO_DORMANCY === "sleep" || process.env.VOLTRO_DORMANCY === "always-on" ? process.env.VOLTRO_DORMANCY : _?.dormancy ?? "always-on",
+		scheduleReplicaId: process.env.HOSTNAME ?? `pid-${process.pid}`,
+		...Tt === void 0 ? {} : { scheduleFireInterceptor: Tt },
+		onSchedulerReady: (e) => {
+			Ct = e;
+		},
+		observability: it,
+		port: g,
+		..._?.transport?.wsPath ? { path: _.transport.wsPath } : {}
+	});
+	x(f([
+		T.queries,
+		T.mutations,
+		T.actions,
+		T.streams
+	]), (e) => {
+		$.warn(e);
+	}), $.info(`API listening on :${g}`, {
+		dialect: y,
+		queries: T.queries.length,
+		mutations: T.mutations.length,
+		actions: T.actions.length,
+		streams: T.streams.length,
+		workflows: T.workflows.length,
+		workflowWorkers: T.workflowWorkers.length,
+		schedules: T.schedules.length,
+		scheduleCoordination: K
+	}), m.finish($);
+	let Lt = () => {
+		for (let e of $e) e.stop();
+		ze.detach(), We.stop(), Le(), z?.dispose(), setTimeout(() => process.exit(0), 1e4).unref?.(), Promise.resolve(nt.deactivate()).then(() => at?.close()).then(() => D.dispose()).then(() => It.close()).then(() => N.close?.()).then(() => process.exit(0)).catch((e) => {
+			console.error("serve: shutdown step failed, exiting anyway:", e), process.exit(0);
+		});
+	};
+	return process.on("SIGINT", Lt), process.on("SIGTERM", Lt), await new Promise(() => {}), 0;
+};
+//#endregion
+export { Sn as n, gn as r, Cn as t };