@voltro/cli 0.11.4 → 0.13.0

package/dist/serveCommand-CqYxzBZR.js

@@ -0,0 +1,1113 @@
+import { at as e, t } from "./inspectMetrics-DOiiII34.js";
+import { s as n } from "./seedRunner-D6eu-u5U.js";
+import { r, t as i } from "./appModuleLoader-C9r9mxZt.js";
+import { A as a, D as o, a as s, j as c, k as l, n as u } from "./frameworkTableAssembly-CYlrafoK.js";
+import { A as d, B as f, C as p, D as ee, E as te, F as m, G as ne, H as re, I as h, J as ie, K as g, L as ae, M as _, N as v, O as oe, P as y, S as b, T as se, V as ce, W as le, X as ue, Y as de, Z as fe, _ as pe, a as x, b as S, c as me, f as C, g as w, h as he, j as ge, k as _e, n as ve, p as T, q as ye, r as be, s as xe, v as Se, w as Ce, x as we, y as E, z as Te } from "./dev-Fb9BmavX.js";
+import { c as D, r as Ee } from "./apiBuild-B6_ehbem.js";
+import { t as De } from "./bootTiming-BdyP9nYw.js";
+import { n as Oe } from "./cliArgs-qdZSElM3.js";
+import { join as ke } from "node:path";
+import { pathToFileURL as Ae } from "node:url";
+import { Cause as je, Effect as O, Layer as k, ManagedRuntime as Me } from "effect";
+import { createLogger as A } from "@voltro/logger";
+import { existsSync as j } from "node:fs";
+import { AggregateRegistry as M, Dispatcher as Ne, apiKeyManagementRoutes as N, applySoftDeleteScope as Pe, applyTenantScope as Fe, attachAnalyticsMirror as Ie, awaitServerListening as Le, bindMutation as P, bindStream as Re, bindSubscription as F, buildTracingLayer as ze, cancelWakeup as Be, compileCron as Ve, dataStoreApiKeyStore as He, dataStoreIdempotencyStore as Ue, frameworkApiKeyStrategy as We, installPolicyGuardResolver as Ge, loadResourceTuples as I, makeActionRunner as Ke, makeAdvisoryLockCoordinator as qe, makeApiKeyService as Je, makeApiKeyUsageBuffer as Ye, makeApiKeyUsageFlusher as L, makeAsyncKv as Xe, makeCoordinatedScheduler as Ze, makeEffectStoreLayer as R, makeLazyWorkflowFacade as Qe, makeMutationRunner as $e, makeOneShotQueryRunner as et, makeQueryDescriptorProducer as tt, makeQueryReauthorizer as nt, makeQuerySubscriber as rt, makeSchemaRegistry as it, makeWorkflowFacade as at, makeWorkflowFacadeWithCallerContext as ot, makeWorkflowLayers as z, noopKv as st, recordSubscriptionDelivery as ct, registerWakeup as lt, resolveSecretsBackend as ut, runProvidedEffect as dt, setSecretsBackend as ft, setSystemStoreHandle as pt, setTupleSource as mt, singleCoordinator as ht, startRpcServer as gt, startScheduler as B, workflowToRpc as _t } from "@voltro/runtime";
+import { RpcGroup as vt } from "@effect/rpc";
+import { SqlClient as yt } from "@effect/sql";
+import { and as bt, ensureTableRegistered as xt, eq as V, or as St } from "@voltro/database";
+import { appStorageProvider as H, fromNodeReadable as Ct, getObjectStream as U, putObjectStream as W, toNodeReadable as G } from "@voltro/plugin-storage";
+import { AuthMiddleware as wt, ConnectionInfoMiddleware as Tt, actionToRpc as K, anonymousSubject as Et, mutationToRpc as Dt, queryToRpc as q, streamToRpc as Ot, workflowCancelDescriptor as kt, workflowDomainEventsQueryDescriptor as J, workflowEventDeliveriesQueryDescriptor as At, workflowResumeDescriptor as jt, workflowRunEventsQueryDescriptor as Y, workflowRunQueryDescriptor as X, workflowRunStepsQueryDescriptor as Mt, workflowRunsQueryDescriptor as Z, workflowSignalDescriptor as Nt, workflowUpdateDescriptor as Pt } from "@voltro/protocol";
+import { assertProductionSessionSecret as Ft } from "@voltro/protocol/session";
+import { createHash as It, timingSafeEqual as Lt } from "node:crypto";
+import { declaredSnapshot as Rt, describeOutcome as zt, runPlannedMigrations as Bt } from "@voltro/database/sql";
+import { getAuthSessionStrategy as Vt } from "@voltro/plugin-auth";
+import { collectPublicApiRoutes as Ht, restRoutesToHttpRoutes as Ut } from "@voltro/protocol/rest";
+import { buildDeliverWebhookExecute as Wt, buildWebhooksService as Gt, defaultIncomingPath as Kt, deliverWebhookWorkflow as qt, mountIncomingWebhook as Jt } from "@voltro/plugin-webhooks";
+import { packBundle as Yt, runExport as Xt, runImport as Zt, storageBlobSink as Qt, storageRefsBlobSource as $t, unpackBundle as en, unpackBundleToDir as tn } from "@voltro/data-transfer";
+//#region src/adminAuth.ts
+var nn = "/_voltro/admin/import", rn = "/_voltro/admin/export", Q = (e, t) => ({
+	status: e,
+	contentType: "application/json; charset=utf-8",
+	body: JSON.stringify(t)
+}), an = (e) => {
+	let t = e.authorization ?? e.Authorization, n = t ? /^Bearer\s+(.+)$/i.exec(t) : null;
+	return n ? n[1] : null;
+}, on = (e, t) => Lt(It("sha256").update(e).digest(), It("sha256").update(t).digest()), sn = (e, t) => {
+	if (e.method.toUpperCase() !== "POST") return Q(405, { error: "method not allowed" });
+	if (!t || t.length < 16) return Q(503, { error: "data transfer misconfigured (no/weak secret)" });
+	let n = an(e.headers);
+	return !n || !on(n, t) ? Q(401, { error: "unauthorized" }) : null;
+}, cn = A({ scope: "voltro:admin-import" }), ln = "VBUNDLE2", un = async function* (e) {
+	yield e;
+}, dn = (e) => async (t) => {
+	let n = sn(t, e.secret);
+	if (n) return n;
+	let r = t.headers["x-import-mode"], i = t.headers["x-import-on-conflict"], a = t.headers["x-import-atomic"] === "1" || t.headers["x-import-atomic"] === "true", o = t.headers["x-import-force"] === "1" || t.headers["x-import-force"] === "true", s = t.rawBody.byteLength >= 8 && Buffer.from(t.rawBody.subarray(0, 8)).toString("latin1") === ln, c, l;
+	if (s) c = un(t.rawBody), l = "upload";
+	else {
+		let n;
+		try {
+			n = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
+		} catch {
+			return Q(400, { error: "body must be a packed bundle archive or { bundleKey } JSON" });
+		}
+		if (typeof n.bundleKey != "string" || !n.bundleKey) return Q(400, { error: "body.bundleKey (string) is required for the storage transport" });
+		if (!e.openArchive) return Q(501, { error: "storage transport not configured on this instance" });
+		c = e.openArchive(n.bundleKey), l = "storage";
+	}
+	let u = await import("node:os"), d = await import("node:fs/promises"), f = await import("node:path"), p = await d.mkdtemp(f.join(u.tmpdir(), "voltro-admin-import-"));
+	try {
+		e.assetSink ? await en(c, {
+			dir: p,
+			blobs: e.assetSink
+		}) : await tn(c, p);
+		let t = await O.runPromiseExit(Zt({
+			store: e.store,
+			bundleDir: p,
+			...r ? { mode: r } : {},
+			...i ? { onConflict: i } : {},
+			...a ? { atomic: a } : {},
+			...e.snapshot ? { targetSnapshot: e.snapshot } : {},
+			force: o,
+			onWarn: (e) => cn.warn("admin.import", { message: e }),
+			...e.assetSink ? { assetsAlreadyRestored: !0 } : {}
+		}));
+		if (t._tag === "Failure") {
+			let e = t.cause._tag === "Fail" ? t.cause.error : void 0;
+			if (e && e._tag === "SchemaDriftError") {
+				let t = e;
+				return cn.warn("admin.import refused (schema drift)", {
+					transport: l,
+					bundle: t.bundleFingerprint.slice(0, 16),
+					target: t.targetFingerprint.slice(0, 16)
+				}), Q(409, {
+					error: "schema drift",
+					bundleFingerprint: t.bundleFingerprint,
+					targetFingerprint: t.targetFingerprint,
+					diff: t.diff,
+					hint: "re-export against the current schema, or resend with x-import-force: 1"
+				});
+			}
+			throw Error(String(e?.message ?? e ?? "import failed"));
+		}
+		let n = t.value, s = n.tables.reduce((e, t) => e + t.rowCount, 0);
+		return cn.info("admin.import", {
+			transport: l,
+			tables: n.tables.length,
+			rows: s,
+			mode: r ?? "upsert",
+			atomic: a
+		}), Q(200, {
+			tables: n.tables.length,
+			rows: s,
+			transport: l
+		});
+	} catch (e) {
+		return cn.warn("admin.import failed", {
+			transport: l,
+			error: e?.message ?? String(e)
+		}), Q(500, {
+			error: "import failed",
+			message: e?.message ?? String(e)
+		});
+	} finally {
+		await d.rm(p, {
+			recursive: !0,
+			force: !0
+		});
+	}
+}, fn = A({ scope: "voltro:admin-export" }), pn = async (e) => {
+	let t = [];
+	for await (let n of e) t.push(Buffer.from(n));
+	return new Uint8Array(Buffer.concat(t));
+}, mn = (e) => typeof e.tenant == "string" && e.tenant ? {
+	kind: "tenant",
+	tenantId: e.tenant
+} : Array.isArray(e.tables) && e.tables.length ? {
+	kind: "tables",
+	tables: e.tables.filter((e) => typeof e == "string")
+} : { kind: "all" }, hn = (e) => async (t) => {
+	let n = sn(t, e.secret);
+	if (n) return n;
+	let r;
+	try {
+		r = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
+	} catch {
+		return Q(400, { error: "body must be JSON: { profile?, tenant?, tables?, consistency?, compression?, bundleKey? }" });
+	}
+	let i = {};
+	if (typeof r.profile == "string" && r.profile) {
+		if (!e.loadProfile) return Q(501, { error: "server-side profiles not configured on this instance" });
+		try {
+			i = await e.loadProfile(r.profile);
+		} catch (e) {
+			return Q(400, {
+				error: `profile '${r.profile}' could not be loaded`,
+				message: e?.message ?? String(e)
+			});
+		}
+	}
+	let a = r.consistency === "snapshot" ? "snapshot" : i.consistency ?? "live", o = (typeof r.compression == "string" ? r.compression : void 0) ?? i.compression, s = i.scope ?? mn(r), c = typeof r.bundleKey == "string" && r.bundleKey.length > 0, l = r.assets === !0 && e.assetSource ? { blobs: e.assetSource } : {}, u = await import("node:os"), d = await import("node:fs/promises"), f = await import("node:path"), p = await d.mkdtemp(f.join(u.tmpdir(), "voltro-admin-export-"));
+	try {
+		let t = await O.runPromise(Xt({
+			store: e.store,
+			snapshot: e.snapshot,
+			dialect: e.dialect,
+			outDir: p,
+			...i.subset ? { subset: i.subset } : {
+				scope: s,
+				...e.tenantTables && e.tenantTables.length > 0 ? { tenantTables: e.tenantTables } : {}
+			},
+			consistency: a,
+			...o ? { compression: o } : {},
+			...i.masking ? { masking: i.masking } : {}
+		})), n = t.tables.reduce((e, t) => e + t.rowCount, 0), u = t.masking?.transformed.length ?? 0;
+		if (c) {
+			if (!e.putArchive) return Q(501, { error: "storage transport not configured on this instance" });
+			let i = r.bundleKey;
+			return await e.putArchive(i, () => Yt({
+				dir: p,
+				...l
+			})), fn.info("admin.export", {
+				transport: "storage",
+				tables: t.tables.length,
+				rows: n,
+				masked: u,
+				bundleKey: i
+			}), Q(200, {
+				bundleKey: i,
+				tables: t.tables.length,
+				rows: n,
+				masked: u,
+				transport: "storage"
+			});
+		}
+		let d = await pn(Yt({
+			dir: p,
+			...l
+		}));
+		return fn.info("admin.export", {
+			transport: "download",
+			tables: t.tables.length,
+			rows: n,
+			masked: u,
+			bytes: d.byteLength
+		}), {
+			status: 200,
+			contentType: "application/octet-stream",
+			body: d,
+			headers: {
+				"x-export-tables": String(t.tables.length),
+				"x-export-rows": String(n),
+				"x-export-masked": String(u)
+			}
+		};
+	} catch (e) {
+		return fn.warn("admin.export failed", { error: e?.message ?? String(e) }), Q(500, {
+			error: "export failed",
+			message: e?.message ?? String(e)
+		});
+	} finally {
+		await d.rm(p, {
+			recursive: !0,
+			force: !0
+		});
+	}
+}, gn = async (e) => {
+	let { resolve: t } = await import("node:path"), { existsSync: n } = await import("node:fs"), r = [
+		e,
+		`${e}.profile.ts`,
+		`data-profiles/${e}.ts`,
+		`data-profiles/${e}.profile.ts`
+	].map((e) => t(process.cwd(), e)), i = r.find((e) => n(e));
+	if (!i) throw Error(`data profile '${e}' not found (looked for: ${r.join(", ")})`);
+	let a = await import(i), o = a.default ?? a.profile;
+	if (!o) throw Error(`data profile '${i}' has no default export`);
+	return o;
+}, _n = (e, t, n = {}) => (async function* () {
+	let r = await G((await O.runPromise(U(e, t).pipe(O.timeout(n.openTimeout ?? "30 seconds")))).stream), i = n.stallMs ?? 12e4, a, o = () => {
+		a && clearTimeout(a), a = setTimeout(() => r.destroy(/* @__PURE__ */ Error(`storage read stalled for ${i}ms reading '${t}'`)), i);
+	};
+	try {
+		o();
+		for await (let e of r) o(), yield e instanceof Uint8Array ? e : new Uint8Array(e);
+	} finally {
+		a && clearTimeout(a), r.destroy();
+	}
+})(), vn = {
+	get: async () => void 0,
+	set: async () => {},
+	setWithTags: async () => {},
+	remove: async () => !1,
+	has: async () => !1,
+	clear: async () => {},
+	invalidateTag: async () => 0,
+	wrap: async (e, t, n) => n()
+}, yn = async (e) => {
+	pt({
+		dataStore: e.store,
+		schemaRegistry: e.schemaRegistry
+	});
+	let t = new Ne({
+		store: e.store,
+		...e.snapshotCache ? { cache: e.snapshotCache } : {},
+		recordDelivery: (e) => ct({
+			label: e.label,
+			kind: e.kind,
+			durationMs: e.durationMs,
+			rowCount: e.rowCount
+		})
+	}), n = e.cache ?? vn, r = e.kv ?? st, i, a, o, s = /* @__PURE__ */ new Map(), c = () => `wfctx_${globalThis.crypto?.randomUUID?.() ?? `${Date.now().toString(36)}${Math.random().toString(36).slice(2)}`}`, l = async (t, n, r) => {
+		let i = {
+			...r,
+			source: r.source ?? `workflow:${t}`
+		};
+		s.set(n, i);
+		try {
+			let r = await e.store.query({
+				table: "_voltro_workflow_start_contexts",
+				order: [],
+				predicate: V("executionId", n),
+				projection: ["id"],
+				skip: void 0,
+				take: 1
+			}), a = {
+				workflowName: t,
+				executionId: n,
+				subject: i.subject ?? null,
+				traceId: i.traceId ?? null,
+				source: i.source ?? null,
+				parentExecutionId: i.parentExecutionId ?? null,
+				parentClosePolicy: i.parentClosePolicy ?? null,
+				createdAt: /* @__PURE__ */ new Date()
+			};
+			r[0] === void 0 ? await e.store.insert("_voltro_workflow_start_contexts", {
+				id: c(),
+				...a
+			}) : await e.store.update("_voltro_workflow_start_contexts", r[0].id, a);
+		} catch (e) {
+			process.stderr.write(`[workflow] failed to persist start context for ${t}/${n}: ${e?.message ?? String(e)}\n`);
+		}
+	}, u = async (t, n) => {
+		let r = s.get(n);
+		if (r !== void 0) return r;
+		try {
+			let t = (await e.store.query({
+				table: "_voltro_workflow_start_contexts",
+				order: [],
+				predicate: V("executionId", n),
+				projection: void 0,
+				skip: void 0,
+				take: 1
+			}))[0];
+			if (t === void 0) return;
+			let r = {
+				...t.subject === null ? {} : { subject: t.subject },
+				...t.traceId === null ? {} : { traceId: t.traceId },
+				...t.source === null ? {} : { source: t.source },
+				...t.parentExecutionId === null ? {} : { parentExecutionId: t.parentExecutionId },
+				...t.parentClosePolicy === null ? {} : { parentClosePolicy: t.parentClosePolicy }
+			};
+			return s.set(n, r), r;
+		} catch (e) {
+			process.stderr.write(`[workflow] failed to load start context for ${n}: ${e?.message ?? String(e)}\n`);
+			return;
+		}
+	}, f = (e.discovered.workflows?.length ?? 0) > 0 ? Qe(() => i) : void 0, p = (e.discovered.workflows?.length ?? 0) > 0 || (e.discovered.eventTriggers?.length ?? 0) > 0, ee = p || (e.discovered.workflowWorkers?.length ?? 0) > 0 || e.scheduleCoordination === "cluster", te = e.tenantIsolation === "namespace", ne = (e.log ?? A({ scope: "voltro:serve" })).child("webhooks"), re, g = e.discovered.webhooks;
+	if (g && g.outgoing.length > 0 && e.workflowEngineLayer !== void 0) {
+		let t = e.workflowEngineLayer, i = de({
+			store: e.store,
+			schemaRegistry: e.schemaRegistry,
+			cache: n,
+			kv: r
+		}), a = g.outgoing.map((e) => e.descriptor);
+		re = Gt(i, async (e) => {
+			let n = qt.execute(e).pipe(O.provide(qt.toLayer(Wt(i, { events: a })).pipe(k.provideMerge(t))));
+			O.runPromise(n).catch((t) => {
+				ne.error("deliverWebhook workflow crashed", {
+					deliveryId: e.deliveryId,
+					targetId: e.targetId
+				}, t);
+			});
+		}, { events: a });
+	}
+	let ae = /* @__PURE__ */ new Map();
+	if (g) for (let e of g.incoming) {
+		let t = e.descriptor.path ?? Kt(e.descriptor.id), n = `VOLTRO_WEBHOOK_SECRET_${e.descriptor.id.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`, r = Jt(e.descriptor, {
+			resolveSecret: async () => process.env[n] ?? null,
+			resolveWorkflows: () => f === void 0 ? void 0 : ot(f, {
+				traceId: `incoming:${e.descriptor.id}`,
+				source: `incoming:${e.descriptor.id}`
+			}),
+			log: (e) => {
+				let t = {
+					webhookId: e.webhookId,
+					status: e.status,
+					signatureOk: String(e.signatureOk),
+					idempotency: e.idempotency,
+					durationMs: e.durationMs
+				};
+				e.status >= 500 ? ne.error("incoming delivery failed", t) : e.status >= 400 ? ne.warn("incoming delivery rejected", t) : ne.info("incoming delivery handled", t);
+			}
+		});
+		ae.set(t, { handle: r });
+	}
+	Ge(), mt((t) => I(e.store, t.subjectId, t.resourceType, t.resourceId));
+	let oe = (e.discovered.outboxHandlers?.length ?? 0) > 0 ? m({
+		handlers: e.discovered.outboxHandlers ?? [],
+		store: e.store,
+		log: (e.log ?? A({ scope: "voltro:serve" })).child("outbox")
+	}) : void 0, y = v({
+		definitions: (e.discovered.connections ?? []).map((e) => e.definition),
+		store: e.store,
+		publicUrl: _(e.port ?? 4e3),
+		log: (e.log ?? A({ scope: "voltro:serve" })).child("connections")
+	}), b = ie({
+		store: e.store,
+		schemaRegistry: e.schemaRegistry,
+		cache: n,
+		kv: r,
+		...re === void 0 ? {} : { webhooksService: re },
+		...f === void 0 ? {} : { workflowsProxy: f },
+		eventTriggers: e.discovered.eventTriggers ?? [],
+		namespaceIsolationOn: te,
+		...oe === void 0 ? {} : { outbox: { nudge: oe.nudge } },
+		...y.active ? { connections: { registry: y.registry } } : {}
+	}), ce = k.succeed(M, se), ue = (t, n) => {
+		let r = t.pipe(O.provide(R(n)));
+		return dt((e.baseLayer ? r.pipe(O.provide(e.baseLayer)) : r).pipe(O.provide(ce)));
+	}, fe = $e({
+		store: e.store,
+		buildContext: (e, t, n) => b(e, t, n),
+		runEffect: ue,
+		undoCapture: S()
+	}), pe = E(), x = Ke({
+		buildContext: (e) => b(e),
+		runEffect: ue
+	}), me = {
+		buildContext: (e) => b(e),
+		finalize: (t, n) => Pe(Fe(t, e.tenantScopedTables, n.subject.tenantId), e.softDeleteScopedTables),
+		provideEffect: (e, t) => e.pipe(O.provide(R(t)))
+	}, C = tt(me), ge = et({
+		...me,
+		queryRows: (t) => e.store.query(t)
+	}), ve = rt({
+		...me,
+		subscribeDescriptor: (e, n, r) => t.subscribe(e, n, r),
+		subscribeComputed: (e, n, r) => t.subscribeComputed(e, n, r)
+	}), T = {};
+	for (let n of [
+		...e.discovered.queries,
+		...pe.queries,
+		...y.queries
+	]) T[n.descriptor.name] = (e) => F(C(n, e), t, `subscription.${n.descriptor.name}`, void 0, void 0, nt(n, e));
+	for (let t of [
+		...e.discovered.mutations,
+		...pe.mutations,
+		...y.mutations
+	]) T[t.descriptor.name] = (e) => P(async (e, n) => fe(t, e, n), e, `mutation.${t.descriptor.name}`);
+	for (let t of [...e.discovered.actions, ...y.actions]) T[t.descriptor.name] = (e) => P(async (e, n) => x(t, e, n), e, `action.${t.descriptor.name}`);
+	let be = () => `public-${Math.random().toString(36).slice(2, 10)}`, xe = [
+		...e.discovered.queries.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => ge(e, t, {
+				subject: n.subject,
+				traceId: be()
+			}),
+			subscribe: (t, n, r) => ve(e, t, {
+				subject: n.subject,
+				traceId: be()
+			}, r)
+		})),
+		...e.discovered.mutations.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => fe(e, t, {
+				subject: n.subject,
+				traceId: be()
+			})
+		})),
+		...e.discovered.actions.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => x(e, t, {
+				subject: n.subject,
+				traceId: be()
+			})
+		}))
+	], Se = xe.length > 0 ? Ut(Ht(xe), {
+		store: e.store,
+		resolveSubject: (t) => e.resolveSubject(t, -1)
+	}) : [], we = e.dataTransferSecret ?? process.env.VOLTRO_DATA_TRANSFER_SECRET, Te = we && we.length >= 16 ? [{
+		method: "POST",
+		path: nn,
+		handle: dn({
+			secret: we,
+			store: e.store,
+			...e.dataTransferSnapshot ? { snapshot: e.dataTransferSnapshot } : {},
+			assetSink: Qt(H()),
+			openArchive: (e) => _n(H(), e)
+		})
+	}, {
+		method: "POST",
+		path: rn,
+		handle: hn({
+			secret: we,
+			store: e.store,
+			snapshot: e.dataTransferSnapshot ?? { tables: [] },
+			dialect: e.dataTransferDialect ?? "memory",
+			tenantTables: [...e.tenantScopedTables],
+			loadProfile: gn,
+			assetSource: $t(H(), e.store),
+			putArchive: async (e, t) => {
+				let { Readable: n } = await import("node:stream"), r = H(), i = Ct("storage", () => n.from(t()));
+				await O.runPromise(W(r, e, i, { contentType: "application/octet-stream" }));
+			}
+		})
+	}] : [], D = [
+		...e.httpRoutes ?? [],
+		...Se,
+		...Te,
+		...y.httpRoutes
+	];
+	for (let t of e.discovered.streams ?? []) T[t.descriptor.name] = (n) => Re((r) => {
+		let i = b(r), a = t.executor(n, i);
+		if (O.isEffect(a)) {
+			let t = a.pipe(O.provide(R(i.store)));
+			return (e.baseLayer ? t.pipe(O.provide(e.baseLayer)) : t).pipe(O.provide(ce));
+		}
+		return typeof a == "object" && a && typeof a.then == "function" ? O.promise(() => a) : a;
+	}, `stream.${t.descriptor.name}`);
+	for (let t of e.discovered.workflows ?? []) T[t.definition.name] = (e) => P(async (e, n) => {
+		let r = n;
+		return ot(f, {
+			subject: r.subject,
+			traceId: r.traceId,
+			source: "workflow-rpc"
+		}).start(t.definition.name, e);
+	}, e, `workflow.${t.definition.name}`);
+	p && (T[X.name] = (e) => F(C({
+		descriptor: X,
+		executor: (e) => {
+			let t = e.id;
+			return {
+				table: "_voltro_workflow_runs",
+				order: [{
+					column: "startedAt",
+					direction: "desc"
+				}],
+				predicate: St(V("id", t), V("executionId", t)),
+				take: 1,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${X.name}`), T[Z.name] = (e) => F(C({
+		descriptor: Z,
+		executor: (e) => {
+			let t = e, n = [...t.tag === void 0 ? [] : [V("tag", t.tag)], ...t.status === void 0 ? [] : [V("status", t.status)]], r = Number.isFinite(t.limit) && t.limit !== void 0 ? Math.min(Math.max(Math.floor(t.limit), 1), 500) : 100;
+			return {
+				table: "_voltro_workflow_runs",
+				order: [{
+					column: "startedAt",
+					direction: "desc"
+				}],
+				predicate: n.length === 0 ? void 0 : n.length === 1 ? n[0] : bt(...n),
+				take: r,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${Z.name}`), T[Mt.name] = (e) => F(C({
+		descriptor: Mt,
+		executor: (e) => {
+			let t = e.runId;
+			return {
+				table: "_voltro_workflow_run_steps",
+				order: [{
+					column: "startedAt",
+					direction: "asc"
+				}],
+				predicate: V("runId", t),
+				take: 1e3,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${Mt.name}`), T[Y.name] = (e) => F(C({
+		descriptor: Y,
+		executor: (e) => {
+			let t = e.runId;
+			return {
+				table: "_voltro_workflow_run_events",
+				order: [{
+					column: "occurredAt",
+					direction: "asc"
+				}],
+				predicate: V("runId", t),
+				take: 1e3,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${Y.name}`), T[J.name] = (e) => F(C({
+		descriptor: J,
+		executor: (e) => {
+			let t = e;
+			return {
+				table: "_voltro_workflow_events",
+				order: [{
+					column: "occurredAt",
+					direction: "desc"
+				}],
+				predicate: t.name === void 0 ? void 0 : V("name", t.name),
+				take: Math.max(1, Math.min(500, t.limit ?? 100)),
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${J.name}`), T[At.name] = (e) => F(C({
+		descriptor: At,
+		executor: (e) => {
+			let t = e.eventId;
+			return {
+				table: "_voltro_workflow_event_deliveries",
+				order: [{
+					column: "createdAt",
+					direction: "asc"
+				}],
+				predicate: V("eventId", t),
+				take: 500,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${At.name}`), T[kt.name] = (t) => P(async (t, n) => {
+		let r = t;
+		return await ye(e.store, n.subject, { executionId: r.executionId }), await f.cancel(r.workflowName, r.executionId), await Ve(r.workflowName, r.executionId, "workflow.cancel"), { ok: !0 };
+	}, t, `action.${kt.name}`), T[jt.name] = (t) => P(async (t, n) => {
+		let r = t;
+		return await ye(e.store, n.subject, { executionId: r.executionId }), await f.resume(r.workflowName, r.executionId), { ok: !0 };
+	}, t, `action.${jt.name}`), T[Nt.name] = (t) => P(async (t, n) => {
+		let r = t;
+		return await ye(e.store, n.subject, { id: r.id }), f.signal({ id: r.id }, r.signalName, r.payload);
+	}, t, `action.${Nt.name}`), T[Pt.name] = (t) => P(async (t, n) => {
+		let r = t;
+		return await ye(e.store, n.subject, { id: r.id }), f.update({ id: r.id }, r.updateName, r.payload, r.timeoutMs === void 0 ? void 0 : { timeoutMs: r.timeoutMs });
+	}, t, `action.${Pt.name}`));
+	let Ee = [
+		...e.discovered.queries.map((e) => q(e.descriptor)),
+		...e.discovered.mutations.map((e) => Dt(e.descriptor)),
+		...e.discovered.actions.map((e) => K(e.descriptor)),
+		...pe.queries.map((e) => q(e.descriptor)),
+		...pe.mutations.map((e) => Dt(e.descriptor)),
+		...y.queries.map((e) => q(e.descriptor)),
+		...y.mutations.map((e) => Dt(e.descriptor)),
+		...y.actions.map((e) => K(e.descriptor)),
+		...(e.discovered.streams ?? []).map((e) => Ot(e.descriptor)),
+		...(e.discovered.workflows ?? []).map((e) => _t(e.definition)),
+		...p ? [
+			q(X),
+			q(Z),
+			q(Mt),
+			q(Y),
+			q(J),
+			q(At),
+			K(kt),
+			K(jt),
+			K(Nt),
+			K(Pt)
+		] : []
+	], De = vt.make(...Ee).middleware(wt).middleware(Tt), Oe = k.succeed(wt, wt.of(({ headers: t, clientId: n }) => O.promise(() => e.resolveSubject(t, n)))), ke = k.succeed(Tt, Tt.of(({ clientId: e }) => O.succeed({ clientId: e }))), Ae = e.dormancyTenantId ?? "default", je = e.dormancy === "sleep" ? {
+		register: (t, n, r) => lt(e.store, {
+			tenantId: r ?? Ae,
+			kind: "workflow",
+			refId: t,
+			wakeAt: n
+		}),
+		cancel: (t, n) => Be(e.store, {
+			tenantId: n ?? Ae,
+			kind: "workflow",
+			refId: t
+		}).then(() => {})
+	} : void 0, j = ee ? await import("@voltro/workflow") : void 0, N = j?.makeWorkflowRunRecorder({
+		store: e.store,
+		...je === void 0 ? {} : { wakeups: je }
+	}), Ie = async (t, n) => {
+		await j.closeWorkflowChildrenForParent({
+			store: e.store,
+			parentExecutionId: t,
+			parentStatus: n,
+			recorder: N,
+			log: { warn: (e, t) => {
+				process.stderr.write(`[workflow] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+			} },
+			interruptChild: async (t, n) => {
+				let r = (e.discovered.workflows ?? []).find((e) => e.definition.name === t);
+				if (!r) throw Error(`Unknown child workflow: ${t}`);
+				if (!a) throw Error("Workflow runtime is not ready");
+				await a.runPromise(r.definition.interrupt(n));
+			}
+		});
+	}, Ve = async (t, n, r) => {
+		let i = (await e.store.query({
+			table: "_voltro_workflow_runs",
+			order: [],
+			predicate: V("executionId", n),
+			projection: void 0,
+			skip: void 0,
+			take: 1
+		}))[0];
+		if (i === void 0) return;
+		let a = await e.store.update("_voltro_workflow_runs", i.id, {
+			status: "cancelled",
+			cancelled: !0,
+			completedAt: /* @__PURE__ */ new Date()
+		}), o = i.subject?.tenantId ?? void 0;
+		a && await N.recordEvent({
+			runId: i.id,
+			eventType: "run-cancelled",
+			payload: {
+				reason: r,
+				workflowName: t,
+				executionId: n,
+				...o == null ? {} : { tenantId: o }
+			}
+		}), a && await Ie(n, "cancelled");
+	}, He = [...z(e.discovered.workflows ?? [], {
+		buildContext: (t, n) => e.buildContextForWorkflow?.(t, n) ?? b({
+			subject: t.subject,
+			traceId: t.traceId
+		}, e.store, void 0, `workflow:${n.workflowName}`, { parentExecutionId: n.executionId }),
+		resolveStartContext: u
+	}, (t, n, r) => {
+		let i = j.getWorkflowVersionMetadata(t.definition);
+		return j.wrapWorkflowExecuteWithRunRecording({
+			name: t.definition.name,
+			store: e.store,
+			subject: r.subject,
+			source: r.source ?? null,
+			traceId: r.traceId,
+			workflowVersion: i.version,
+			workflowCompatibleVersions: i.compatibleWith,
+			workflowPatches: i.patches,
+			parentExecutionId: r?.parentExecutionId ?? null,
+			parentClosePolicy: r?.parentClosePolicy ?? null,
+			onParentClose: ({ executionId: e, status: t }) => Ie(e, t),
+			recorder: N
+		}, n);
+	}), ...e.discovered.workflowWorkers ?? []], Ue = He.length > 0 ? k.mergeAll(...He) : k.empty;
+	if (((e.discovered.workflows?.length ?? 0) > 0 || (e.discovered.workflowWorkers?.length ?? 0) > 0 || e.scheduleCoordination === "cluster") && e.workflowEngineLayer !== void 0) {
+		let t = Ue.pipe(k.provideMerge(e.workflowEngineLayer));
+		a = Me.make(e.baseLayer === void 0 ? t : t.pipe(k.provideMerge(e.baseLayer))), await a.runPromise(O.void), i = (e.discovered.workflows?.length ?? 0) > 0 ? at({
+			workflows: e.discovered.workflows ?? [],
+			runEffect: (e) => a.runPromise(e),
+			rememberStartContext: l,
+			signal: async (t, n, r) => {
+				let i = await j.sendWorkflowSignal({
+					store: e.store,
+					recorder: N,
+					target: t,
+					signalName: n,
+					payload: r
+				});
+				return await a.runPromise(j.completeSuspendingSignal({
+					store: e.store,
+					target: t,
+					signalName: n,
+					payload: r
+				})).catch(() => {}), i;
+			},
+			update: (t, n, r, i) => j.sendWorkflowUpdate({
+				store: e.store,
+				recorder: N,
+				target: t,
+				updateName: n,
+				payload: r,
+				...i === void 0 ? {} : { options: i }
+			}),
+			listRuns: (t) => he(e.store, t),
+			retry: (t, n) => w({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runPromise: (e) => a.runPromise(e)
+			}, t, n)
+		}) : void 0;
+	}
+	let We = k.mergeAll(De.toLayer(T), Oe, ke), Je = le(T, e.discovered.queries.map((e) => e.descriptor.name), p), Ye = k.mergeAll(De.toLayer(Je), Oe, ke), L = e.observability, Xe = await ze({
+		...L && L.spanProcessors.length > 0 ? { extraSpanProcessors: L.spanProcessors } : {},
+		...L && L.metricReaders.length > 0 ? { extraMetricReaders: L.metricReaders } : {},
+		...L && Object.keys(L.resourceAttributes).length > 0 ? { resourceAttributes: L.resourceAttributes } : {},
+		...L && L.sampler !== void 0 ? { sampler: L.sampler } : {}
+	}), Ze = !1, it = e.store.ping ? () => e.store.ping().then(() => !0).catch(() => !1) : void 0, { server: ut, shutdown: ft } = gt({
+		group: De,
+		handlersLayer: We,
+		httpHandlersLayer: Ye,
+		port: e.port ?? 4e3,
+		path: e.path ?? "/ws",
+		tracerLayer: Xe.layer,
+		healthCheck: {
+			isReady: () => Ze,
+			...it ? { ping: it } : {}
+		},
+		...D.length > 0 ? { httpRoutes: D } : {},
+		...ae.size > 0 ? { webhookRoutes: ae } : {}
+	});
+	if (await Le(ut), (e.discovered.schedules?.length ?? 0) > 0) {
+		let t = (e.scheduleCoordination ?? "single") === "advisoryLock" ? qe(e.store, e.scheduleReplicaId ?? `pid-${process.pid}`) : ht;
+		o = await B(e.discovered.schedules ?? [], {
+			store: e.store,
+			coordinator: t,
+			defaultTrigger: e.scheduleDefaultTrigger ?? "self",
+			replicaId: e.scheduleReplicaId ?? `pid-${process.pid}`,
+			armSelf: e.scheduleArmSelf ?? !0,
+			dormancy: e.dormancy ?? "always-on",
+			...e.dormancyTenantId === void 0 ? {} : { dormancyTenantId: e.dormancyTenantId },
+			buildContext: ({ traceId: t, scheduleName: n, subject: r }) => b({
+				subject: r,
+				traceId: t
+			}, e.store, void 0, `schedule:${n}`),
+			log: {
+				info: (e, t) => {
+					process.stdout.write(`[schedule] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+				},
+				warn: (e, t) => {
+					process.stderr.write(`[schedule] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+				},
+				error: (e, t) => {
+					process.stderr.write(`[schedule] ERROR ${e} ${t ? JSON.stringify(t) : ""}\n`);
+				},
+				debug: () => {}
+			},
+			...e.scheduleFireInterceptor === void 0 ? {} : { interceptFire: e.scheduleFireInterceptor },
+			...e.onScheduleRunEvent === void 0 ? {} : { onRunEvent: e.onScheduleRunEvent }
+		}), e.onSchedulerReady?.(o);
+	}
+	let yt = e.log ?? A({ scope: "voltro:serve" }), xt, U;
+	if ((e.discovered.subscribers?.length ?? 0) > 0 && (xt = h(e.discovered.subscribers ?? [], e.store, yt.child("subscribe"), e.schemaRegistry)), (e.discovered.reactions?.length ?? 0) > 0) {
+		let t = yt.child("reaction");
+		U = _e(e.discovered.reactions ?? [], e.store, {
+			runAct: async (n, r) => {
+				if (n.kind === "workflow") {
+					if (f === void 0) {
+						t.warn("reaction workflow act skipped — no workflow engine in this app", { workflow: n.workflow });
+						return;
+					}
+					let e = r.new ?? r.old ?? {};
+					await ot(f, {
+						traceId: `reaction:${n.workflow}`,
+						source: `reaction:${n.workflow}`
+					}).start(n.workflow, e);
+					return;
+				}
+				await d(n.agent, r, {
+					findAgentSend: (t) => e.discovered.actions.find((e) => e.descriptor.name === `${t}.send`),
+					runAction: (e, t, n) => Promise.resolve(x(e, t, n)),
+					makeSubject: (e) => Et(e),
+					now: () => Date.now(),
+					log: t
+				});
+			},
+			checkBudget: async (n, r) => {
+				try {
+					let { requireAiBudget: t } = await import("@voltro/ai");
+					return (await O.runPromise(O.either(t(e.store, {
+						tenantId: n,
+						limitUsd: r
+					}))))._tag === "Right";
+				} catch (e) {
+					return t.warn("reaction budget check failed — refusing the act", { tenantId: n }, e), !1;
+				}
+			}
+		}, t);
+	}
+	let G;
+	return (e.discovered.aggregates?.length ?? 0) > 0 && (G = await Ce({
+		discovered: e.discovered.aggregates ?? [],
+		store: e.store,
+		log: yt.child("aggregate"),
+		...e.analytics === void 0 ? {} : { analytics: e.analytics },
+		...e.aggregateStorage === void 0 ? {} : { storage: e.aggregateStorage },
+		...e.aggregateCoordinator === void 0 ? {} : { coordinator: e.aggregateCoordinator }
+	}), ce = k.succeed(M, G.registry)), Ze = !0, e.bootTiming?.mark("ready"), {
+		dispatcher: t,
+		server: ut,
+		scheduler: o,
+		close: async () => {
+			Ze = !1, G?.detach(), U?.(), xt?.(), await o?.shutdown(), t.close(), await a?.dispose(), await new Promise((e) => ut.close(() => e())), await ft();
+		}
+	};
+}, $ = A({ scope: "voltro:serve" }), bn = (e, t, n) => (e === "production" || e === "staging") && t !== "memory" && n !== "0", xn = Oe, Sn = async (e) => {
+	let t = D(process.cwd());
+	if (j(t)) {
+		let n;
+		try {
+			let e = await import(Ae(t).href);
+			typeof e.runServe == "function" ? n = e.runServe : $.warn("serve bundle has no runServe export — using the standard serve path");
+		} catch (e) {
+			$.warn("serve bundle failed to load — using the standard serve path", {}, e);
+		}
+		if (n) return $.info("serve: booting from the precompiled serve bundle"), n(e);
+	}
+	return Cn(e);
+}, Cn = async (d) => {
+	let m = De();
+	process.env.NODE_ENV || (process.env.NODE_ENV = "production"), Ft();
+	let h = process.cwd(), ie = Number(process.env.PORT ?? xn(d, "--port") ?? 4e3), _ = await xe(h);
+	ft(ut(_?.secrets)), await e({
+		rawEnv: _?.env,
+		appType: "api",
+		root: h,
+		log: $,
+		generateTypes: !1
+	}), m.mark("config");
+	let v = (process.env.DB_DIALECT ?? _?.store ?? "memory").toLowerCase(), se = (v === "mariadb" || v === "postgres" || v === "mssql") && (process.env.CDC ?? "1") !== "0", le = v === "mariadb" ? "mariadb" : v === "mssql" ? "mssql" : void 0, de = Ee(h);
+	if (!i() && j(de)) try {
+		let e = await import(Ae(de).href);
+		if (e.modules) {
+			let t = {};
+			for (let [n, r] of Object.entries(e.modules)) t[ke(h, n)] = r;
+			r(t), $.info("precompiled api bundle loaded", { modules: Object.keys(t).length });
+		}
+	} catch (e) {
+		$.warn("precompiled api bundle failed to load — falling back to source", {}, e);
+	}
+	let S = await C(h), w = await me(S, { cdc: se && le !== void 0 }), he = S.filter((e) => b.test(e)), _e = he.length > 0 ? await p(he, $.child("webhooks")) : void 0, ye = u({
+		mix: w.featureMix,
+		plugins: _?.plugins ?? [],
+		cdc: se && le !== void 0,
+		...le ? { cdcDialect: le } : {}
+	}), Ce = _?.analytics !== void 0 && _.analytics.kind !== "noop" && v !== "memory" ? (await n(v)).makeSqlLayer(x()) : void 0, E = await f({
+		spec: _?.analytics,
+		sqlLayer: Ce,
+		log: $
+	}), D = (() => {
+		let e = new Set(w.tables.map((e) => e.tableName)), t = [...w.tables];
+		for (let n of [...ye, ...E.tables]) e.has(n.tableName) || (e.add(n.tableName), t.push(n));
+		return t;
+	})();
+	for (let e of D) xt(e);
+	let Oe = (process.env.NODE_ENV ?? "").toLowerCase();
+	if (bn(Oe, v, process.env.VOLTRO_AUTO_MIGRATE)) {
+		let e = (await n(v)).makeSqlLayer(x()), t = await O.runPromise(yt.SqlClient.pipe(O.flatMap((e) => Bt(e, D, {
+			appliedBy: `serve:${Oe}`,
+			environment: "prod",
+			dialectId: v
+		})), O.provide(e)));
+		t.kind === "prod-mismatch" && ($.error(zt(t, v)), $.error("serve: refusing to boot — apply the schema first (voltro db apply in a pre-deploy step), or set VOLTRO_AUTO_MIGRATE=0 to bypass this check."), process.exit(1)), $.info(zt(t, v));
+	}
+	let A = it(D);
+	m.mark("discover");
+	let M = await be(_, void 0);
+	_?.cache && !process.env.CACHE_BACKEND && (process.env.CACHE_BACKEND = _.cache), _?.cacheRedisUrl && !process.env.CACHE_REDIS_URL && (process.env.CACHE_REDIS_URL = _.cacheRedisUrl), _?.cacheRedisDriver && !process.env.CACHE_REDIS_DRIVER && (process.env.CACHE_REDIS_DRIVER = _.cacheRedisDriver), _?.cacheKeyPrefix && !process.env.CACHE_KEY_PREFIX && (process.env.CACHE_KEY_PREFIX = _.cacheKeyPrefix);
+	let { service: Ne, invalidationBus: Pe, snapshotCache: Fe, cache: Le, backend: P, dispose: Re } = await fe({ env: process.env });
+	$.info(`cache backend resolved: ${P}` + (P === "redis" ? ` (driver ${process.env.CACHE_REDIS_DRIVER ?? "resp"})` : " — in-process, not cross-instance")), M.onChange((e) => {
+		O.runFork(Pe.publish(e.table));
+	}), _?.kv && !process.env.KV_BACKEND && (process.env.KV_BACKEND = _.kv), _?.kvRedisUrl && !process.env.KV_REDIS_URL && (process.env.KV_REDIS_URL = _.kvRedisUrl), _?.kvKeyPrefix && !process.env.KV_KEY_PREFIX && (process.env.KV_KEY_PREFIX = _.kvKeyPrefix);
+	let { kv: F, service: ze } = await Xe({ store: M });
+	m.mark("store");
+	let Be = Ie({
+		store: M,
+		sink: E.sink,
+		log: $
+	}), Ge = ue({
+		store: M,
+		dialect: v
+	}), I = _?.plugins ?? [], Ke = process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, R, Qe;
+	v !== "memory" && (R = Me.make((await n(v)).makeSqlLayer(x())), Qe = await R.runPromise(yt.SqlClient));
+	let $e = Ze({
+		coordinator: [
+			"postgres",
+			"mariadb",
+			"mysql",
+			"mssql"
+		].includes(v) ? qe(M, Ke, $) : ht,
+		replicaId: Ke,
+		log: $
+	}), et = [], tt = {
+		...Qe ? { sql: Qe } : {},
+		scheduleCoordinated: (e, t, n) => {
+			let r = $e(e, t, n);
+			return et.push(r), r;
+		}
+	};
+	for (let e of I) e.bindDataStore?.(M, tt);
+	let nt = I.filter((e) => typeof e.onChangeEvent == "function");
+	if (nt.length > 0) {
+		let e = M.changeScope ?? "local";
+		M.onChange((t) => {
+			let n = {
+				table: t.table,
+				op: t.op,
+				new: t.new ?? null,
+				old: t.old ?? null,
+				...t.origin === void 0 ? {} : { origin: t.origin },
+				changeScope: e
+			};
+			for (let e of nt) O.runFork(e.onChangeEvent(n).pipe(O.catchAllCause((t) => O.sync(() => $.warn(`plugin ${e.name} onChangeEvent failed`, { error: je.pretty(t) })))));
+		});
+	}
+	let rt = Se({
+		plugins: I,
+		appName: _?.name ?? "voltro-api",
+		appType: "api",
+		voltroVersion: process.env.npm_package_version ?? "0.0.0",
+		log: $
+	});
+	I.length && await rt.activate(), m.mark("plugins");
+	let at = await rt.gatherObservability(), ot = await T(M, _, v, {
+		info: (e, t) => process.stdout.write(`[broadcast] ${e} ${t ? JSON.stringify(t) : ""}\n`),
+		warn: (e, t) => process.stderr.write(`[broadcast] ${e} ${t ? JSON.stringify(t) : ""}\n`),
+		debug: () => {}
+	}), z = _?.apiKeys, st = (typeof z == "object" ? z.prefix : void 0) ?? "voltro_", ct = z ? He(M) : void 0, lt = ct ? Ye({ flush: L(ct) }) : void 0;
+	lt && process.once("exit", () => {
+		lt.shutdown();
+	});
+	let dt = ct ? Je(ct, {
+		prefix: st,
+		...lt ? { usage: lt } : {}
+	}) : void 0, pt = dt ? [We(dt, { prefix: st })] : [], mt = ve([..._?.auth?.strategies ?? [], ...pt], Vt(_?.plugins ?? []), _?.auth?.anonymousTenantRequired ?? !1, _?.auth?.resolveScopes), gt = [..._?.restRoutes ?? [], ...dt ? N(dt, (typeof z == "object" ? z.managementPath : void 0) ?? "/v1/api-keys") : []], B = _?.idempotency, _t = B ? {
+		store: Ue(M),
+		header: (typeof B == "object" ? B.header : void 0) ?? "Idempotency-Key",
+		ttlMs: (typeof B == "object" ? B.ttlMs : void 0) ?? 864e5
+	} : void 0, vt = gt.length > 0 ? Ut(gt, {
+		store: M,
+		resolveSubject: (e) => mt({
+			headers: e,
+			clientId: -1
+		}),
+		..._t ? { idempotency: _t } : {}
+	}) : [], bt = I.map((e) => e.services).filter((e) => e !== void 0), V = k.mergeAll(g({
+		analyticsLayer: E.layer,
+		cacheService: Ne,
+		kvService: ze,
+		pluginServices: bt,
+		userLayers: _?.layers ?? []
+	}), ne(_?.http ?? {})), St = _?.scheduling ?? {}, H = St.trigger ?? "self", Ct = /* @__PURE__ */ new Set([
+		"postgres",
+		"mysql",
+		"mariadb",
+		"mssql"
+	]), U = St.coordination ?? (Ct.has(v) ? "advisoryLock" : "single"), W = U === "cluster" && Ct.has(v), G = W ? "cluster" : U === "advisoryLock" && Ct.has(v) ? "advisoryLock" : "single";
+	U === "cluster" && !W && $.warn("scheduling.coordination=cluster needs a sql-backed store except sqlite — falling back to single"), U === "advisoryLock" && !Ct.has(v) && $.warn("scheduling.coordination=advisoryLock needs a SQL store (the claim-row gate) — falling back to single");
+	let wt, Tt = w.workflows.length > 0 || w.workflowWorkers.length > 0 || w.eventTriggers.length > 0 || (_e?.outgoing.length ?? 0) > 0 || W, K;
+	if (Tt) {
+		if (v === "mssql") {
+			let e = await Te(process.cwd());
+			e && $.warn(e);
+		}
+		let [{ WorkflowEngine: e }, { makeClusterCronLayer: t, workflowEngineLayer: r, resolveRunnerStorage: i }] = await Promise.all([import("@effect/workflow"), import("@voltro/workflow/cluster")]), a = W ? w.schedules.filter((e) => (e.trigger ?? H) === "self").map((e) => t({
+			name: e.name,
+			cron: Ve(e),
+			execute: async () => {
+				await wt?.fireFromCluster(e.name);
+			}
+		})) : [];
+		K = v === "memory" ? e.layerMemory : await (async () => {
+			let e = await n(v), t = i({ sqliteFamily: e.id === "sqlite" || e.id === "turso" });
+			return $.info(`workflow engine: cluster-${t}, dialect=${e.id}` + (t === "memory" ? " — single-process durable replay, no cross-pod shard handoff" + (e.id !== "sqlite" && e.id !== "turso" ? " (VOLTRO_WORKFLOW_RUNNER_STORAGE=memory: SqlRunnerStorage/cluster_runners + GET_LOCK skipped)" : "") : "")), r({
+				sqlClientLayer: e.makeSqlLayer(x()),
+				runnerStorage: t,
+				dialectId: e.id,
+				...process.env.VOLTRO_WORKFLOW_RUNNER_PORT ? { runnerListenPort: Number(process.env.VOLTRO_WORKFLOW_RUNNER_PORT) } : {},
+				...a.length > 0 ? { extraShardingLayers: a } : {}
+			});
+		})();
+	}
+	let Et = pe(I, t()), Dt = S.filter((e) => /\.subscribe\.tsx?$/.test(e)), q = Dt.length > 0 ? await ae(Dt, $) : [], Ot = S.filter((e) => /\.reaction\.tsx?$/.test(e)), kt = Ot.length > 0 ? await ge(Ot, $) : [], J = S.filter((e) => s.test(e)), At = J.length > 0 ? await y(J, $) : [], jt = S.filter((e) => /\.aggregate\.tsx?$/.test(e)), Y = jt.length > 0 ? await te(jt, $) : [], X = ee();
+	if (Y.length > 0 && v !== "memory") try {
+		X = oe((await n(v)).makeSqlLayer(x()));
+	} catch (e) {
+		$.warn("aggregate: SQL storage init failed — falling back to in-process", { err: String(e) });
+	}
+	let Mt = v === "memory" ? ht : qe(M, `aggregate@${process.pid}`, $), Z = [], Nt = [], Pt = S.filter((e) => o.test(e));
+	if (Pt.length > 0) {
+		let e = $.child("agent"), t = S.filter((e) => l.test(e));
+		t.length > 0 && await c(t, e);
+		let n = await a(Pt, e);
+		for (let e of n.agents) for (let t of we(e)) (t.kind === "action" ? Z : Nt).push({
+			file: t.file,
+			descriptor: t.descriptor,
+			executor: t.executor
+		});
+		n.agents.length > 0 && e.info("synthesized agent routes", { agents: n.agents.map((e) => e.descriptor.name) });
+	}
+	m.mark("workflow");
+	let It = await yn({
+		bootTiming: m,
+		discovered: {
+			queries: [...w.queries, ...Nt],
+			mutations: w.mutations,
+			actions: [...w.actions, ...Z],
+			streams: w.streams,
+			workflows: w.workflows,
+			workflowWorkers: w.workflowWorkers,
+			eventTriggers: w.eventTriggers,
+			schedules: w.schedules,
+			subscribers: q,
+			outboxHandlers: At,
+			connections: w.connections,
+			reactions: kt,
+			aggregates: Y,
+			..._e === void 0 ? {} : { webhooks: _e }
+		},
+		log: $,
+		analytics: E.sink,
+		aggregateStorage: X,
+		aggregateCoordinator: Mt,
+		store: M,
+		kv: F,
+		cache: Le,
+		snapshotCache: Fe,
+		schemaRegistry: A,
+		tenantScopedTables: w.tenantScopedTables,
+		softDeleteScopedTables: w.softDeleteScopedTables,
+		dataTransferSnapshot: Rt(D),
+		dataTransferDialect: v,
+		tenantIsolation: (process.env.VOLTRO_TENANT_ISOLATION ?? _?.tenancy?.isolation) === "namespace" ? "namespace" : "shared-schema",
+		resolveSubject: (e, t) => mt({
+			headers: e,
+			clientId: t
+		}),
+		httpRoutes: [...I.flatMap((e) => e.httpRoutes ?? []), ...vt],
+		...V ? { baseLayer: V } : {},
+		...K === void 0 ? {} : { workflowEngineLayer: K },
+		scheduleDefaultTrigger: H,
+		scheduleCoordination: G,
+		scheduleArmSelf: !W,
+		dormancy: process.env.VOLTRO_DORMANCY === "sleep" || process.env.VOLTRO_DORMANCY === "always-on" ? process.env.VOLTRO_DORMANCY : _?.dormancy ?? "always-on",
+		scheduleReplicaId: process.env.HOSTNAME ?? `pid-${process.pid}`,
+		...Et === void 0 ? {} : { scheduleFireInterceptor: Et },
+		onSchedulerReady: (e) => {
+			wt = e;
+		},
+		observability: at,
+		port: ie,
+		..._?.transport?.wsPath ? { path: _.transport.wsPath } : {}
+	});
+	re(ce([
+		w.queries,
+		w.mutations,
+		w.actions,
+		w.streams
+	]), (e) => {
+		$.warn(e);
+	}), $.info(`API listening on :${ie}`, {
+		dialect: v,
+		queries: w.queries.length,
+		mutations: w.mutations.length,
+		actions: w.actions.length,
+		streams: w.streams.length,
+		workflows: w.workflows.length,
+		workflowWorkers: w.workflowWorkers.length,
+		schedules: w.schedules.length,
+		scheduleCoordination: G
+	}), m.finish($);
+	let Lt = () => {
+		for (let e of et) e.stop();
+		Be.detach(), Ge.stop(), Re(), R?.dispose(), setTimeout(() => process.exit(0), 1e4).unref?.(), Promise.resolve(rt.deactivate()).then(() => ot?.close()).then(() => E.dispose()).then(() => It.close()).then(() => M.close?.()).then(() => process.exit(0)).catch((e) => {
+			console.error("serve: shutdown step failed, exiting anyway:", e), process.exit(0);
+		});
+	};
+	return process.on("SIGINT", Lt), process.on("SIGTERM", Lt), await new Promise(() => {}), 0;
+};
+//#endregion
+export { Sn as n, gn as r, Cn as t };