@voltro/cli 0.18.0 → 0.19.0

package/dist/serveCommand-vPF5ucXC.js

@@ -0,0 +1,1136 @@
+import { st as e, t } from "./inspectMetrics-D1DmLeJs.js";
+import { s as n } from "./seedRunner-D6eu-u5U.js";
+import { r, t as i } from "./appModuleLoader-C9r9mxZt.js";
+import { f as a, m as o, n as s, p as c, u as l } from "./frameworkTableAssembly-sg41s14F.js";
+import { l as u } from "./fileConventions-CBNPZVOV.js";
+import { $ as d, A as ee, B as f, C as te, D as ne, E as p, F as m, G as re, H as h, I as g, L as ie, M as ae, N as _, O as v, P as oe, Q as se, R as ce, S as le, T as y, U as ue, W as de, Z as b, _ as fe, a as x, at as pe, b as me, c as he, et as S, f as C, g as ge, h as w, it as _e, j as ve, k as T, n as ye, nt as be, p as xe, r as Se, rt as Ce, s as we, tt as Te, v as Ee, w as De, x as Oe, y as ke, z as E } from "./dev-B6rfgKfo.js";
+import { c as D, r as Ae } from "./apiBuild-CY5pEwwq.js";
+import { t as je } from "./bootTiming-BdyP9nYw.js";
+import { n as O } from "./cliArgs-qdZSElM3.js";
+import { join as k } from "node:path";
+import { pathToFileURL as Me } from "node:url";
+import { Cause as Ne, Effect as A, Layer as j, ManagedRuntime as Pe } from "effect";
+import { createLogger as M } from "@voltro/logger";
+import { existsSync as Fe } from "node:fs";
+import { AggregateRegistry as N, Dispatcher as Ie, apiKeyManagementRoutes as Le, applySoftDeleteScope as Re, applyTenantScope as ze, attachAnalyticsMirror as Be, awaitServerListening as Ve, bindMutation as P, bindStream as He, bindSubscription as F, buildTracingLayer as Ue, cancelWakeup as We, compileCron as Ge, dataStoreApiKeyStore as Ke, dataStoreIdempotencyStore as I, formatServerOnlyLeaks as qe, frameworkApiKeyStrategy as Je, installPolicyGuardResolver as Ye, loadResourceTuples as Xe, makeActionRunner as L, makeAdvisoryLockCoordinator as Ze, makeApiKeyService as Qe, makeApiKeyUsageBuffer as $e, makeApiKeyUsageFlusher as et, makeAsyncKv as tt, makeCoordinatedScheduler as nt, makeEffectStoreLayer as R, makeLazyWorkflowFacade as rt, makeMutationRunner as it, makeOneShotQueryRunner as at, makeQueryDescriptorProducer as ot, makeQueryReauthorizer as st, makeQuerySubscriber as ct, makeSchemaRegistry as lt, makeWorkflowFacade as ut, makeWorkflowFacadeWithCallerContext as dt, makeWorkflowLayers as ft, noopKv as z, recordSubscriptionDelivery as pt, registerWakeup as B, resolveSecretsBackend as mt, runProvidedEffect as V, setSecretsBackend as ht, setSystemStoreHandle as gt, setTupleSource as _t, singleCoordinator as vt, startRpcServer as yt, startScheduler as bt, workflowToRpc as H, wrapStoreWithBootCodec as xt } from "@voltro/runtime";
+import { RpcGroup as St } from "@effect/rpc";
+import { SqlClient as Ct } from "@effect/sql";
+import { and as wt, ensureTableRegistered as Tt, eq as U, or as Et } from "@voltro/database";
+import { appStorageProvider as W, fromNodeReadable as Dt, getObjectStream as Ot, putObjectStream as kt, toNodeReadable as G } from "@voltro/plugin-storage";
+import { AuthMiddleware as At, ConnectionInfoMiddleware as jt, actionToRpc as K, anonymousSubject as Mt, mutationToRpc as Nt, queryToRpc as q, streamToRpc as Pt, workflowCancelDescriptor as Ft, workflowDomainEventsQueryDescriptor as It, workflowEventDeliveriesQueryDescriptor as J, workflowResumeDescriptor as Lt, workflowRunEventsQueryDescriptor as Y, workflowRunQueryDescriptor as X, workflowRunStepsQueryDescriptor as Z, workflowRunsQueryDescriptor as Rt, workflowSignalDescriptor as zt, workflowUpdateDescriptor as Bt } from "@voltro/protocol";
+import { assertProductionSessionSecret as Vt } from "@voltro/protocol/session";
+import { createHash as Ht, timingSafeEqual as Ut } from "node:crypto";
+import { declaredSnapshot as Wt, describeOutcome as Gt, runPlannedMigrations as Kt } from "@voltro/database/sql";
+import { getAuthSessionStrategy as qt } from "@voltro/plugin-auth";
+import { collectPublicApiRoutes as Jt, restRoutesToHttpRoutes as Yt } from "@voltro/protocol/rest";
+import { buildDeliverWebhookExecute as Xt, buildWebhooksService as Zt, defaultIncomingPath as Qt, deliverWebhookWorkflow as $t, mountIncomingWebhook as en } from "@voltro/plugin-webhooks";
+import { packBundle as tn, runExport as nn, runImport as rn, storageBlobSink as an, storageRefsBlobSource as on, unpackBundle as sn, unpackBundleToDir as cn } from "@voltro/data-transfer";
+//#region src/bootRefusal.ts
+var ln = "VoltroBootRefusal", un = (e) => {
+	let t = Error(e);
+	return t.name = ln, t;
+}, dn = "/_voltro/admin/import", fn = "/_voltro/admin/export", Q = (e, t) => ({
+	status: e,
+	contentType: "application/json; charset=utf-8",
+	body: JSON.stringify(t)
+}), pn = (e) => {
+	let t = e.authorization ?? e.Authorization, n = t ? /^Bearer\s+(.+)$/i.exec(t) : null;
+	return n ? n[1] : null;
+}, mn = (e, t) => Ut(Ht("sha256").update(e).digest(), Ht("sha256").update(t).digest()), hn = (e, t) => {
+	if (e.method.toUpperCase() !== "POST") return Q(405, { error: "method not allowed" });
+	if (!t || t.length < 16) return Q(503, { error: "data transfer misconfigured (no/weak secret)" });
+	let n = pn(e.headers);
+	return !n || !mn(n, t) ? Q(401, { error: "unauthorized" }) : null;
+}, gn = M({ scope: "voltro:admin-import" }), _n = "VBUNDLE2", vn = async function* (e) {
+	yield e;
+}, yn = (e) => async (t) => {
+	let n = hn(t, e.secret);
+	if (n) return n;
+	let r = t.headers["x-import-mode"], i = t.headers["x-import-on-conflict"], a = t.headers["x-import-atomic"] === "1" || t.headers["x-import-atomic"] === "true", o = t.headers["x-import-force"] === "1" || t.headers["x-import-force"] === "true", s = t.rawBody.byteLength >= 8 && Buffer.from(t.rawBody.subarray(0, 8)).toString("latin1") === _n, c, l;
+	if (s) c = vn(t.rawBody), l = "upload";
+	else {
+		let n;
+		try {
+			n = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
+		} catch {
+			return Q(400, { error: "body must be a packed bundle archive or { bundleKey } JSON" });
+		}
+		if (typeof n.bundleKey != "string" || !n.bundleKey) return Q(400, { error: "body.bundleKey (string) is required for the storage transport" });
+		if (!e.openArchive) return Q(501, { error: "storage transport not configured on this instance" });
+		c = e.openArchive(n.bundleKey), l = "storage";
+	}
+	let u = await import("node:os"), d = await import("node:fs/promises"), ee = await import("node:path"), f = await d.mkdtemp(ee.join(u.tmpdir(), "voltro-admin-import-"));
+	try {
+		e.assetSink ? await sn(c, {
+			dir: f,
+			blobs: e.assetSink
+		}) : await cn(c, f);
+		let t = await A.runPromiseExit(rn({
+			store: e.store,
+			bundleDir: f,
+			...r ? { mode: r } : {},
+			...i ? { onConflict: i } : {},
+			...a ? { atomic: a } : {},
+			...e.snapshot ? { targetSnapshot: e.snapshot } : {},
+			force: o,
+			onWarn: (e) => gn.warn("admin.import", { message: e }),
+			...e.assetSink ? { assetsAlreadyRestored: !0 } : {}
+		}));
+		if (t._tag === "Failure") {
+			let e = t.cause._tag === "Fail" ? t.cause.error : void 0;
+			if (e && e._tag === "SchemaDriftError") {
+				let t = e;
+				return gn.warn("admin.import refused (schema drift)", {
+					transport: l,
+					bundle: t.bundleFingerprint.slice(0, 16),
+					target: t.targetFingerprint.slice(0, 16)
+				}), Q(409, {
+					error: "schema drift",
+					bundleFingerprint: t.bundleFingerprint,
+					targetFingerprint: t.targetFingerprint,
+					diff: t.diff,
+					hint: "re-export against the current schema, or resend with x-import-force: 1"
+				});
+			}
+			throw Error(String(e?.message ?? e ?? "import failed"));
+		}
+		let n = t.value, s = n.tables.reduce((e, t) => e + t.rowCount, 0);
+		return gn.info("admin.import", {
+			transport: l,
+			tables: n.tables.length,
+			rows: s,
+			mode: r ?? "upsert",
+			atomic: a
+		}), Q(200, {
+			tables: n.tables.length,
+			rows: s,
+			transport: l
+		});
+	} catch (e) {
+		return gn.warn("admin.import failed", {
+			transport: l,
+			error: e?.message ?? String(e)
+		}), Q(500, {
+			error: "import failed",
+			message: e?.message ?? String(e)
+		});
+	} finally {
+		await d.rm(f, {
+			recursive: !0,
+			force: !0
+		});
+	}
+}, bn = M({ scope: "voltro:admin-export" }), xn = async (e) => {
+	let t = [];
+	for await (let n of e) t.push(Buffer.from(n));
+	return new Uint8Array(Buffer.concat(t));
+}, Sn = (e) => typeof e.tenant == "string" && e.tenant ? {
+	kind: "tenant",
+	tenantId: e.tenant
+} : Array.isArray(e.tables) && e.tables.length ? {
+	kind: "tables",
+	tables: e.tables.filter((e) => typeof e == "string")
+} : { kind: "all" }, Cn = (e) => async (t) => {
+	let n = hn(t, e.secret);
+	if (n) return n;
+	let r;
+	try {
+		r = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
+	} catch {
+		return Q(400, { error: "body must be JSON: { profile?, tenant?, tables?, consistency?, compression?, bundleKey? }" });
+	}
+	let i = {};
+	if (typeof r.profile == "string" && r.profile) {
+		if (!e.loadProfile) return Q(501, { error: "server-side profiles not configured on this instance" });
+		try {
+			i = await e.loadProfile(r.profile);
+		} catch (e) {
+			return Q(400, {
+				error: `profile '${r.profile}' could not be loaded`,
+				message: e?.message ?? String(e)
+			});
+		}
+	}
+	let a = r.consistency === "snapshot" ? "snapshot" : i.consistency ?? "live", o = (typeof r.compression == "string" ? r.compression : void 0) ?? i.compression, s = i.scope ?? Sn(r), c = typeof r.bundleKey == "string" && r.bundleKey.length > 0, l = r.assets === !0 && e.assetSource ? { blobs: e.assetSource } : {}, u = await import("node:os"), d = await import("node:fs/promises"), ee = await import("node:path"), f = await d.mkdtemp(ee.join(u.tmpdir(), "voltro-admin-export-"));
+	try {
+		let t = await A.runPromise(nn({
+			store: e.store,
+			snapshot: e.snapshot,
+			dialect: e.dialect,
+			outDir: f,
+			...i.subset ? { subset: i.subset } : {
+				scope: s,
+				...e.tenantTables && e.tenantTables.length > 0 ? { tenantTables: e.tenantTables } : {}
+			},
+			consistency: a,
+			...o ? { compression: o } : {},
+			...i.masking ? { masking: i.masking } : {}
+		})), n = t.tables.reduce((e, t) => e + t.rowCount, 0), u = t.masking?.transformed.length ?? 0;
+		if (c) {
+			if (!e.putArchive) return Q(501, { error: "storage transport not configured on this instance" });
+			let i = r.bundleKey;
+			return await e.putArchive(i, () => tn({
+				dir: f,
+				...l
+			})), bn.info("admin.export", {
+				transport: "storage",
+				tables: t.tables.length,
+				rows: n,
+				masked: u,
+				bundleKey: i
+			}), Q(200, {
+				bundleKey: i,
+				tables: t.tables.length,
+				rows: n,
+				masked: u,
+				transport: "storage"
+			});
+		}
+		let d = await xn(tn({
+			dir: f,
+			...l
+		}));
+		return bn.info("admin.export", {
+			transport: "download",
+			tables: t.tables.length,
+			rows: n,
+			masked: u,
+			bytes: d.byteLength
+		}), {
+			status: 200,
+			contentType: "application/octet-stream",
+			body: d,
+			headers: {
+				"x-export-tables": String(t.tables.length),
+				"x-export-rows": String(n),
+				"x-export-masked": String(u)
+			}
+		};
+	} catch (e) {
+		return bn.warn("admin.export failed", { error: e?.message ?? String(e) }), Q(500, {
+			error: "export failed",
+			message: e?.message ?? String(e)
+		});
+	} finally {
+		await d.rm(f, {
+			recursive: !0,
+			force: !0
+		});
+	}
+}, wn = async (e) => {
+	let { resolve: t } = await import("node:path"), { existsSync: n } = await import("node:fs"), r = [
+		e,
+		`${e}.profile.ts`,
+		`data-profiles/${e}.ts`,
+		`data-profiles/${e}.profile.ts`
+	].map((e) => t(process.cwd(), e)), i = r.find((e) => n(e));
+	if (!i) throw Error(`data profile '${e}' not found (looked for: ${r.join(", ")})`);
+	let a = await import(i), o = a.default ?? a.profile;
+	if (!o) throw Error(`data profile '${i}' has no default export`);
+	return o;
+}, Tn = (e, t, n = {}) => (async function* () {
+	let r = await G((await A.runPromise(Ot(e, t).pipe(A.timeout(n.openTimeout ?? "30 seconds")))).stream), i = n.stallMs ?? 12e4, a, o = () => {
+		a && clearTimeout(a), a = setTimeout(() => r.destroy(/* @__PURE__ */ Error(`storage read stalled for ${i}ms reading '${t}'`)), i);
+	};
+	try {
+		o();
+		for await (let e of r) o(), yield e instanceof Uint8Array ? e : new Uint8Array(e);
+	} finally {
+		a && clearTimeout(a), r.destroy();
+	}
+})(), En = {
+	get: async () => void 0,
+	set: async () => {},
+	setWithTags: async () => {},
+	remove: async () => !1,
+	has: async () => !1,
+	clear: async () => {},
+	invalidateTag: async () => 0,
+	wrap: async (e, t, n) => n()
+}, Dn = async (e) => {
+	gt({
+		dataStore: e.store,
+		schemaRegistry: e.schemaRegistry
+	});
+	let t = new Ie({
+		store: e.store,
+		...e.snapshotCache ? { cache: e.snapshotCache } : {},
+		recordDelivery: (e) => pt({
+			label: e.label,
+			kind: e.kind,
+			durationMs: e.durationMs,
+			rowCount: e.rowCount
+		})
+	}), n = e.cache ?? En, r = e.kv ?? z, i, a, o, s = /* @__PURE__ */ new Map(), c = () => `wfctx_${globalThis.crypto?.randomUUID?.() ?? `${Date.now().toString(36)}${Math.random().toString(36).slice(2)}`}`, l = async (t, n, r) => {
+		let i = {
+			...r,
+			source: r.source ?? `workflow:${t}`
+		};
+		s.set(n, i);
+		try {
+			let r = await e.store.query({
+				table: "_voltro_workflow_start_contexts",
+				order: [],
+				predicate: U("executionId", n),
+				projection: ["id"],
+				skip: void 0,
+				take: 1
+			}), a = {
+				workflowName: t,
+				executionId: n,
+				subject: i.subject ?? null,
+				traceId: i.traceId ?? null,
+				source: i.source ?? null,
+				parentExecutionId: i.parentExecutionId ?? null,
+				parentClosePolicy: i.parentClosePolicy ?? null,
+				createdAt: /* @__PURE__ */ new Date()
+			};
+			r[0] === void 0 ? await e.store.insert("_voltro_workflow_start_contexts", {
+				id: c(),
+				...a
+			}) : await e.store.update("_voltro_workflow_start_contexts", r[0].id, a);
+		} catch (e) {
+			process.stderr.write(`[workflow] failed to persist start context for ${t}/${n}: ${e?.message ?? String(e)}\n`);
+		}
+	}, u = async (t, n) => {
+		let r = s.get(n);
+		if (r !== void 0) return r;
+		try {
+			let t = (await e.store.query({
+				table: "_voltro_workflow_start_contexts",
+				order: [],
+				predicate: U("executionId", n),
+				projection: void 0,
+				skip: void 0,
+				take: 1
+			}))[0];
+			if (t === void 0) return;
+			let r = {
+				...t.subject === null ? {} : { subject: t.subject },
+				...t.traceId === null ? {} : { traceId: t.traceId },
+				...t.source === null ? {} : { source: t.source },
+				...t.parentExecutionId === null ? {} : { parentExecutionId: t.parentExecutionId },
+				...t.parentClosePolicy === null ? {} : { parentClosePolicy: t.parentClosePolicy }
+			};
+			return s.set(n, r), r;
+		} catch (e) {
+			process.stderr.write(`[workflow] failed to load start context for ${n}: ${e?.message ?? String(e)}\n`);
+			return;
+		}
+	}, d = (e.discovered.workflows?.length ?? 0) > 0 ? rt(() => i) : void 0, f = (e.discovered.workflows?.length ?? 0) > 0 || (e.discovered.eventTriggers?.length ?? 0) > 0, te = f || (e.discovered.workflowWorkers?.length ?? 0) > 0 || e.scheduleCoordination === "cluster", ne = e.tenantIsolation === "namespace", p = (e.log ?? M({ scope: "voltro:serve" })).child("webhooks"), re, h = e.discovered.webhooks;
+	if (h && h.outgoing.length > 0 && e.workflowEngineLayer !== void 0) {
+		let t = e.workflowEngineLayer, i = be({
+			store: e.store,
+			schemaRegistry: e.schemaRegistry,
+			cache: n,
+			kv: r
+		}), a = h.outgoing.map((e) => e.descriptor);
+		re = Zt(i, async (e) => {
+			let n = $t.execute(e).pipe(A.provide($t.toLayer(Xt(i, { events: a })).pipe(j.provideMerge(t))));
+			A.runPromise(n).catch((t) => {
+				p.error("deliverWebhook workflow crashed", {
+					deliveryId: e.deliveryId,
+					targetId: e.targetId
+				}, t);
+			});
+		}, { events: a });
+	}
+	let ie = /* @__PURE__ */ new Map();
+	if (h) for (let e of h.incoming) {
+		let t = e.descriptor.path ?? Qt(e.descriptor.id), n = `VOLTRO_WEBHOOK_SECRET_${e.descriptor.id.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`, r = en(e.descriptor, {
+			resolveSecret: async () => process.env[n] ?? null,
+			resolveWorkflows: () => d === void 0 ? void 0 : dt(d, {
+				traceId: `incoming:${e.descriptor.id}`,
+				source: `incoming:${e.descriptor.id}`
+			}),
+			log: (e) => {
+				let t = {
+					webhookId: e.webhookId,
+					status: e.status,
+					signatureOk: String(e.signatureOk),
+					idempotency: e.idempotency,
+					durationMs: e.durationMs
+				};
+				e.status >= 500 ? p.error("incoming delivery failed", t) : e.status >= 400 ? p.warn("incoming delivery rejected", t) : p.info("incoming delivery handled", t);
+			}
+		});
+		ie.set(t, { handle: r });
+	}
+	Ye(), _t((t) => Xe(e.store, t.subjectId, t.resourceType, t.resourceId));
+	let ae = (e.discovered.outboxHandlers?.length ?? 0) > 0 ? ce({
+		handlers: e.discovered.outboxHandlers ?? [],
+		store: e.store,
+		log: (e.log ?? M({ scope: "voltro:serve" })).child("outbox")
+	}) : void 0, _ = g({
+		definitions: (e.discovered.connections ?? []).map((e) => e.definition),
+		store: e.store,
+		publicUrl: m(e.port ?? 4e3),
+		log: (e.log ?? M({ scope: "voltro:serve" })).child("connections")
+	}), v = Te({
+		store: e.store,
+		schemaRegistry: e.schemaRegistry,
+		cache: n,
+		kv: r,
+		...re === void 0 ? {} : { webhooksService: re },
+		...d === void 0 ? {} : { workflowsProxy: d },
+		eventTriggers: e.discovered.eventTriggers ?? [],
+		namespaceIsolationOn: ne,
+		...ae === void 0 ? {} : { outbox: { nudge: ae.nudge } },
+		..._.active ? { connections: { registry: _.registry } } : {}
+	}), oe = j.succeed(N, y), se = (t, n) => {
+		let r = t.pipe(A.provide(R(n)));
+		return V((e.baseLayer ? r.pipe(A.provide(e.baseLayer)) : r).pipe(A.provide(oe)));
+	}, le = it({
+		store: e.store,
+		buildContext: (e, t, n) => v(e, t, n),
+		runEffect: se,
+		undoCapture: me()
+	}), ue = ke(), de = L({
+		buildContext: (e) => v(e),
+		runEffect: se
+	}), fe = {
+		buildContext: (e) => v(e),
+		finalize: (t, n) => Re(ze(t, e.tenantScopedTables, n.subject.tenantId), e.softDeleteScopedTables),
+		provideEffect: (e, t) => e.pipe(A.provide(R(t)))
+	}, x = ot(fe), pe = at({
+		...fe,
+		queryRows: (t) => e.store.query(t)
+	}), he = ct({
+		...fe,
+		subscribeDescriptor: (e, n, r) => t.subscribe(e, n, r),
+		subscribeComputed: (e, n, r) => t.subscribeComputed(e, n, r)
+	}), C = {};
+	for (let n of [
+		...e.discovered.queries,
+		...ue.queries,
+		..._.queries
+	]) C[n.descriptor.name] = (e) => F(x(n, e), t, `subscription.${n.descriptor.name}`, void 0, void 0, st(n, e));
+	for (let t of [
+		...e.discovered.mutations,
+		...ue.mutations,
+		..._.mutations
+	]) C[t.descriptor.name] = (e) => P(async (e, n) => le(t, e, n), e, `mutation.${t.descriptor.name}`);
+	for (let t of [...e.discovered.actions, ..._.actions]) C[t.descriptor.name] = (e) => P(async (e, n) => de(t, e, n), e, `action.${t.descriptor.name}`);
+	let _e = () => `public-${Math.random().toString(36).slice(2, 10)}`, ve = [
+		...e.discovered.queries.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => pe(e, t, {
+				subject: n.subject,
+				traceId: _e()
+			}),
+			subscribe: (t, n, r) => he(e, t, {
+				subject: n.subject,
+				traceId: _e()
+			}, r)
+		})),
+		...e.discovered.mutations.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => le(e, t, {
+				subject: n.subject,
+				traceId: _e()
+			})
+		})),
+		...e.discovered.actions.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => de(e, t, {
+				subject: n.subject,
+				traceId: _e()
+			})
+		}))
+	], ye = ve.length > 0 ? Yt(Jt(ve), {
+		store: e.store,
+		resolveSubject: (t) => e.resolveSubject(t, -1)
+	}) : [], xe = e.dataTransferSecret ?? process.env.VOLTRO_DATA_TRANSFER_SECRET, Se = xe && xe.length >= 16 ? [{
+		method: "POST",
+		path: dn,
+		handle: yn({
+			secret: xe,
+			store: e.store,
+			...e.dataTransferSnapshot ? { snapshot: e.dataTransferSnapshot } : {},
+			assetSink: an(W()),
+			openArchive: (e) => Tn(W(), e)
+		})
+	}, {
+		method: "POST",
+		path: fn,
+		handle: Cn({
+			secret: xe,
+			store: e.store,
+			snapshot: e.dataTransferSnapshot ?? { tables: [] },
+			dialect: e.dataTransferDialect ?? "memory",
+			tenantTables: [...e.tenantScopedTables],
+			loadProfile: wn,
+			assetSource: on(W(), e.store),
+			putArchive: async (e, t) => {
+				let { Readable: n } = await import("node:stream"), r = W(), i = Dt("storage", () => n.from(t()));
+				await A.runPromise(kt(r, e, i, { contentType: "application/octet-stream" }));
+			}
+		})
+	}] : [], Ce = [
+		...e.httpRoutes ?? [],
+		...ye,
+		...Se,
+		..._.httpRoutes
+	];
+	for (let t of e.discovered.streams ?? []) C[t.descriptor.name] = (n) => He((r) => {
+		let i = v(r), a = t.executor(n, i);
+		if (A.isEffect(a)) {
+			let t = a.pipe(A.provide(R(i.store)));
+			return (e.baseLayer ? t.pipe(A.provide(e.baseLayer)) : t).pipe(A.provide(oe));
+		}
+		return typeof a == "object" && a && typeof a.then == "function" ? A.promise(() => a) : a;
+	}, `stream.${t.descriptor.name}`);
+	for (let t of e.discovered.workflows ?? []) C[t.definition.name] = (e) => P(async (e, n) => {
+		let r = n;
+		return dt(d, {
+			subject: r.subject,
+			traceId: r.traceId,
+			source: "workflow-rpc"
+		}).start(t.definition.name, e);
+	}, e, `workflow.${t.definition.name}`);
+	f && (C[X.name] = (e) => F(x({
+		descriptor: X,
+		executor: (e) => {
+			let t = e.id;
+			return {
+				table: "_voltro_workflow_runs",
+				order: [{
+					column: "startedAt",
+					direction: "desc"
+				}],
+				predicate: Et(U("id", t), U("executionId", t)),
+				take: 1,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${X.name}`), C[Rt.name] = (e) => F(x({
+		descriptor: Rt,
+		executor: (e) => {
+			let t = e, n = [...t.tag === void 0 ? [] : [U("tag", t.tag)], ...t.status === void 0 ? [] : [U("status", t.status)]], r = Number.isFinite(t.limit) && t.limit !== void 0 ? Math.min(Math.max(Math.floor(t.limit), 1), 500) : 100;
+			return {
+				table: "_voltro_workflow_runs",
+				order: [{
+					column: "startedAt",
+					direction: "desc"
+				}],
+				predicate: n.length === 0 ? void 0 : n.length === 1 ? n[0] : wt(...n),
+				take: r,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${Rt.name}`), C[Z.name] = (e) => F(x({
+		descriptor: Z,
+		executor: (e) => {
+			let t = e.runId;
+			return {
+				table: "_voltro_workflow_run_steps",
+				order: [{
+					column: "startedAt",
+					direction: "asc"
+				}],
+				predicate: U("runId", t),
+				take: 1e3,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${Z.name}`), C[Y.name] = (e) => F(x({
+		descriptor: Y,
+		executor: (e) => {
+			let t = e.runId;
+			return {
+				table: "_voltro_workflow_run_events",
+				order: [{
+					column: "occurredAt",
+					direction: "asc"
+				}],
+				predicate: U("runId", t),
+				take: 1e3,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${Y.name}`), C[It.name] = (e) => F(x({
+		descriptor: It,
+		executor: (e) => {
+			let t = e;
+			return {
+				table: "_voltro_workflow_events",
+				order: [{
+					column: "occurredAt",
+					direction: "desc"
+				}],
+				predicate: t.name === void 0 ? void 0 : U("name", t.name),
+				take: Math.max(1, Math.min(500, t.limit ?? 100)),
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${It.name}`), C[J.name] = (e) => F(x({
+		descriptor: J,
+		executor: (e) => {
+			let t = e.eventId;
+			return {
+				table: "_voltro_workflow_event_deliveries",
+				order: [{
+					column: "createdAt",
+					direction: "asc"
+				}],
+				predicate: U("eventId", t),
+				take: 500,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${J.name}`), C[Ft.name] = (t) => P(async (t, n) => {
+		let r = t;
+		return await S(e.store, n.subject, { executionId: r.executionId }), await d.cancel(r.workflowName, r.executionId), await Ne(r.workflowName, r.executionId, "workflow.cancel"), { ok: !0 };
+	}, t, `action.${Ft.name}`), C[Lt.name] = (t) => P(async (t, n) => {
+		let r = t;
+		return await S(e.store, n.subject, { executionId: r.executionId }), await d.resume(r.workflowName, r.executionId), { ok: !0 };
+	}, t, `action.${Lt.name}`), C[zt.name] = (t) => P(async (t, n) => {
+		let r = t;
+		return await S(e.store, n.subject, { id: r.id }), d.signal({ id: r.id }, r.signalName, r.payload);
+	}, t, `action.${zt.name}`), C[Bt.name] = (t) => P(async (t, n) => {
+		let r = t;
+		return await S(e.store, n.subject, { id: r.id }), d.update({ id: r.id }, r.updateName, r.payload, r.timeoutMs === void 0 ? void 0 : { timeoutMs: r.timeoutMs });
+	}, t, `action.${Bt.name}`));
+	let we = [
+		...e.discovered.queries.map((e) => q(e.descriptor)),
+		...e.discovered.mutations.map((e) => Nt(e.descriptor)),
+		...e.discovered.actions.map((e) => K(e.descriptor)),
+		...ue.queries.map((e) => q(e.descriptor)),
+		...ue.mutations.map((e) => Nt(e.descriptor)),
+		..._.queries.map((e) => q(e.descriptor)),
+		..._.mutations.map((e) => Nt(e.descriptor)),
+		..._.actions.map((e) => K(e.descriptor)),
+		...(e.discovered.streams ?? []).map((e) => Pt(e.descriptor)),
+		...(e.discovered.workflows ?? []).map((e) => H(e.definition)),
+		...f ? [
+			q(X),
+			q(Rt),
+			q(Z),
+			q(Y),
+			q(It),
+			q(J),
+			K(Ft),
+			K(Lt),
+			K(zt),
+			K(Bt)
+		] : []
+	], Ee = St.make(...we).middleware(At).middleware(jt), Oe = j.succeed(At, At.of(({ headers: t, clientId: n }) => A.promise(() => e.resolveSubject(t, n)))), D = j.succeed(jt, jt.of(({ clientId: e }) => A.succeed({ clientId: e }))), Ae = e.dormancyTenantId ?? "default", je = e.dormancy === "sleep" ? {
+		register: (t, n, r) => B(e.store, {
+			tenantId: r ?? Ae,
+			kind: "workflow",
+			refId: t,
+			wakeAt: n
+		}),
+		cancel: (t, n) => We(e.store, {
+			tenantId: n ?? Ae,
+			kind: "workflow",
+			refId: t
+		}).then(() => {})
+	} : void 0, O = te ? await import("@voltro/workflow") : void 0, k = O?.makeWorkflowRunRecorder({
+		store: e.store,
+		...je === void 0 ? {} : { wakeups: je }
+	}), Me = async (t, n) => {
+		await O.closeWorkflowChildrenForParent({
+			store: e.store,
+			parentExecutionId: t,
+			parentStatus: n,
+			recorder: k,
+			log: { warn: (e, t) => {
+				process.stderr.write(`[workflow] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+			} },
+			interruptChild: async (t, n) => {
+				let r = (e.discovered.workflows ?? []).find((e) => e.definition.name === t);
+				if (!r) throw Error(`Unknown child workflow: ${t}`);
+				if (!a) throw Error("Workflow runtime is not ready");
+				await a.runPromise(r.definition.interrupt(n));
+			}
+		});
+	}, Ne = async (t, n, r) => {
+		let i = (await e.store.query({
+			table: "_voltro_workflow_runs",
+			order: [],
+			predicate: U("executionId", n),
+			projection: void 0,
+			skip: void 0,
+			take: 1
+		}))[0];
+		if (i === void 0) return;
+		let a = await e.store.update("_voltro_workflow_runs", i.id, {
+			status: "cancelled",
+			cancelled: !0,
+			completedAt: /* @__PURE__ */ new Date()
+		}), o = i.subject?.tenantId ?? void 0;
+		a && await k.recordEvent({
+			runId: i.id,
+			eventType: "run-cancelled",
+			payload: {
+				reason: r,
+				workflowName: t,
+				executionId: n,
+				...o == null ? {} : { tenantId: o }
+			}
+		}), a && await Me(n, "cancelled");
+	}, Fe = [...ft(e.discovered.workflows ?? [], {
+		buildContext: (t, n) => e.buildContextForWorkflow?.(t, n) ?? v({
+			subject: t.subject,
+			traceId: t.traceId
+		}, e.store, void 0, `workflow:${n.workflowName}`, { parentExecutionId: n.executionId }),
+		resolveStartContext: u
+	}, (t, n, r) => {
+		let i = O.getWorkflowVersionMetadata(t.definition);
+		return O.wrapWorkflowExecuteWithRunRecording({
+			name: t.definition.name,
+			store: e.store,
+			subject: r.subject,
+			source: r.source ?? null,
+			traceId: r.traceId,
+			workflowVersion: i.version,
+			workflowCompatibleVersions: i.compatibleWith,
+			workflowPatches: i.patches,
+			parentExecutionId: r?.parentExecutionId ?? null,
+			parentClosePolicy: r?.parentClosePolicy ?? null,
+			onParentClose: ({ executionId: e, status: t }) => Me(e, t),
+			recorder: k
+		}, n);
+	}), ...e.discovered.workflowWorkers ?? []], Le = Fe.length > 0 ? j.mergeAll(...Fe) : j.empty;
+	if (((e.discovered.workflows?.length ?? 0) > 0 || (e.discovered.workflowWorkers?.length ?? 0) > 0 || e.scheduleCoordination === "cluster") && e.workflowEngineLayer !== void 0) {
+		let t = Le.pipe(j.provideMerge(e.workflowEngineLayer));
+		a = Pe.make(e.baseLayer === void 0 ? t : t.pipe(j.provideMerge(e.baseLayer))), await a.runPromise(A.void), i = (e.discovered.workflows?.length ?? 0) > 0 ? ut({
+			workflows: e.discovered.workflows ?? [],
+			runEffect: (e) => a.runPromise(e),
+			rememberStartContext: l,
+			signal: async (t, n, r) => {
+				let i = await O.sendWorkflowSignal({
+					store: e.store,
+					recorder: k,
+					target: t,
+					signalName: n,
+					payload: r
+				});
+				return await a.runPromise(O.completeSuspendingSignal({
+					store: e.store,
+					target: t,
+					signalName: n,
+					payload: r
+				})).catch(() => {}), i;
+			},
+			update: (t, n, r, i) => O.sendWorkflowUpdate({
+				store: e.store,
+				recorder: k,
+				target: t,
+				updateName: n,
+				payload: r,
+				...i === void 0 ? {} : { options: i }
+			}),
+			listRuns: (t) => w(e.store, t),
+			retry: (t, n) => ge({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runPromise: (e) => a.runPromise(e)
+			}, t, n)
+		}) : void 0;
+	}
+	let Be = j.mergeAll(Ee.toLayer(C), Oe, D), Ge = b(C, e.discovered.queries.map((e) => e.descriptor.name), f), Ke = j.mergeAll(Ee.toLayer(Ge), Oe, D), I = e.observability, qe = await Ue({
+		...I && I.spanProcessors.length > 0 ? { extraSpanProcessors: I.spanProcessors } : {},
+		...I && I.metricReaders.length > 0 ? { extraMetricReaders: I.metricReaders } : {},
+		...I && Object.keys(I.resourceAttributes).length > 0 ? { resourceAttributes: I.resourceAttributes } : {},
+		...I && I.sampler !== void 0 ? { sampler: I.sampler } : {}
+	}), Je = !1, Qe = e.store.ping ? () => e.store.ping().then(() => !0).catch(() => !1) : void 0, { server: $e, shutdown: et } = yt({
+		group: Ee,
+		handlersLayer: Be,
+		httpHandlersLayer: Ke,
+		port: e.port ?? 4e3,
+		path: e.path ?? "/ws",
+		tracerLayer: qe.layer,
+		healthCheck: {
+			isReady: () => Je,
+			...Qe ? { ping: Qe } : {}
+		},
+		...Ce.length > 0 ? { httpRoutes: Ce } : {},
+		...e.getStore === void 0 ? {} : { getStore: e.getStore },
+		...ie.size > 0 ? { webhookRoutes: ie } : {}
+	});
+	if (await Ve($e), (e.discovered.schedules?.length ?? 0) > 0) {
+		let t = (e.scheduleCoordination ?? "single") === "advisoryLock" ? Ze(e.store, e.scheduleReplicaId ?? `pid-${process.pid}`) : vt;
+		o = await bt(e.discovered.schedules ?? [], {
+			store: e.store,
+			coordinator: t,
+			defaultTrigger: e.scheduleDefaultTrigger ?? "self",
+			replicaId: e.scheduleReplicaId ?? `pid-${process.pid}`,
+			armSelf: e.scheduleArmSelf ?? !0,
+			dormancy: e.dormancy ?? "always-on",
+			...e.dormancyTenantId === void 0 ? {} : { dormancyTenantId: e.dormancyTenantId },
+			buildContext: ({ traceId: t, scheduleName: n, subject: r }) => v({
+				subject: r,
+				traceId: t
+			}, e.store, void 0, `schedule:${n}`),
+			log: {
+				info: (e, t) => {
+					process.stdout.write(`[schedule] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+				},
+				warn: (e, t) => {
+					process.stderr.write(`[schedule] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+				},
+				error: (e, t) => {
+					process.stderr.write(`[schedule] ERROR ${e} ${t ? JSON.stringify(t) : ""}\n`);
+				},
+				debug: () => {}
+			},
+			...e.scheduleFireInterceptor === void 0 ? {} : { interceptFire: e.scheduleFireInterceptor },
+			...e.onScheduleRunEvent === void 0 ? {} : { onRunEvent: e.onScheduleRunEvent }
+		}), e.onSchedulerReady?.(o);
+	}
+	let tt = e.log ?? M({ scope: "voltro:serve" }), nt, lt;
+	if ((e.discovered.subscribers?.length ?? 0) > 0 && (nt = E(e.discovered.subscribers ?? [], e.store, tt.child("subscribe"), e.schemaRegistry)), (e.discovered.reactions?.length ?? 0) > 0) {
+		let t = tt.child("reaction");
+		lt = T(e.discovered.reactions ?? [], e.store, {
+			runAct: async (n, r) => {
+				if (n.kind === "workflow") {
+					if (d === void 0) {
+						t.warn("reaction workflow act skipped — no workflow engine in this app", { workflow: n.workflow });
+						return;
+					}
+					let e = r.new ?? r.old ?? {};
+					await dt(d, {
+						traceId: `reaction:${n.workflow}`,
+						source: `reaction:${n.workflow}`
+					}).start(n.workflow, e);
+					return;
+				}
+				await ee(n.agent, r, {
+					findAgentSend: (t) => e.discovered.actions.find((e) => e.descriptor.name === `${t}.send`),
+					runAction: (e, t, n) => Promise.resolve(de(e, t, n)),
+					makeSubject: (e) => Mt(e),
+					now: () => Date.now(),
+					log: t
+				});
+			},
+			checkBudget: async (n, r) => {
+				try {
+					let { requireAiBudget: t } = await import("@voltro/ai");
+					return (await A.runPromise(A.either(t(e.store, {
+						tenantId: n,
+						limitUsd: r
+					}))))._tag === "Right";
+				} catch (e) {
+					return t.warn("reaction budget check failed — refusing the act", { tenantId: n }, e), !1;
+				}
+			}
+		}, t);
+	}
+	let mt;
+	return (e.discovered.aggregates?.length ?? 0) > 0 && (mt = await De({
+		discovered: e.discovered.aggregates ?? [],
+		store: e.store,
+		log: tt.child("aggregate"),
+		...e.analytics === void 0 ? {} : { analytics: e.analytics },
+		...e.aggregateStorage === void 0 ? {} : { storage: e.aggregateStorage },
+		...e.aggregateCoordinator === void 0 ? {} : { coordinator: e.aggregateCoordinator }
+	}), oe = j.succeed(N, mt.registry)), Je = !0, e.bootTiming?.mark("ready"), {
+		dispatcher: t,
+		server: $e,
+		scheduler: o,
+		close: async () => {
+			Je = !1, mt?.detach(), lt?.(), nt?.(), await o?.shutdown(), t.close(), await a?.dispose(), await new Promise((e) => $e.close(() => e())), await et();
+		}
+	};
+}, $ = M({ scope: "voltro:serve" }), On = (e, t, n) => (e === "production" || e === "staging") && t !== "memory" && n !== "0", kn = O, An = async (e) => {
+	let t = D(process.cwd());
+	if (Fe(t)) {
+		let n;
+		try {
+			let e = await import(Me(t).href);
+			typeof e.runServe == "function" ? n = e.runServe : $.warn("serve bundle has no runServe export — using the standard serve path");
+		} catch (e) {
+			$.warn("serve bundle failed to load — using the standard serve path", {}, e);
+		}
+		if (n) return $.info("serve: booting from the precompiled serve bundle"), n(e);
+	}
+	return jn(e);
+}, jn = async (ee) => {
+	let m = je();
+	process.env.NODE_ENV || (process.env.NODE_ENV = "production");
+	try {
+		Vt();
+	} catch (e) {
+		throw un(e instanceof Error ? e.message : String(e));
+	}
+	let g = process.cwd(), ce = Number(process.env.PORT ?? kn(ee, "--port") ?? 4e3), y = await we(g);
+	ht(mt(y?.secrets)), await e({
+		rawEnv: y?.env,
+		appType: "api",
+		root: g,
+		log: $,
+		generateTypes: !1
+	}), m.mark("config");
+	let b = (process.env.DB_DIALECT ?? y?.store ?? "memory").toLowerCase(), me = (b === "mariadb" || b === "postgres" || b === "mssql") && (process.env.CDC ?? "1") !== "0", S = b === "mariadb" ? "mariadb" : b === "mssql" ? "mssql" : void 0, ge = Ae(g);
+	if (!i() && Fe(ge)) try {
+		let e = await import(Me(ge).href);
+		if (e.modules) {
+			let t = {};
+			for (let [n, r] of Object.entries(e.modules)) t[k(g, n)] = r;
+			r(t), $.info("precompiled api bundle loaded", { modules: Object.keys(t).length });
+		}
+	} catch (e) {
+		$.warn("precompiled api bundle failed to load — falling back to source", {}, e);
+	}
+	let w = await C(g), T = await he(w, { cdc: me && S !== void 0 });
+	{
+		let e = oe(T.serverOnlyLeaks, _(process.env, "strict"), qe, "`voltro serve`");
+		if (e.action === "fail") throw un(e.message ?? "");
+		e.action === "warn" && $.warn(e.message ?? "");
+	}
+	let be = w.filter((e) => le.test(e)), Te = be.length > 0 ? await te(be, $.child("webhooks")) : void 0, De = s({
+		mix: T.featureMix,
+		plugins: y?.plugins ?? [],
+		cdc: me && S !== void 0,
+		...S ? { cdcDialect: S } : {}
+	}), ke = y?.analytics !== void 0 && y.analytics.kind !== "noop" && b !== "memory" ? (await n(b)).makeSqlLayer(x()) : void 0, E = await ue({
+		spec: y?.analytics,
+		sqlLayer: ke,
+		log: $
+	}), D = (() => {
+		let e = new Set(T.tables.map((e) => e.tableName)), t = [...T.tables];
+		for (let n of [...De, ...E.tables]) e.has(n.tableName) || (e.add(n.tableName), t.push(n));
+		return t;
+	})();
+	for (let e of D) Tt(e);
+	let O = (process.env.NODE_ENV ?? "").toLowerCase();
+	if (On(O, b, process.env.VOLTRO_AUTO_MIGRATE)) {
+		let e = (await n(b)).makeSqlLayer(x()), t = await A.runPromise(Ct.SqlClient.pipe(A.flatMap((e) => Kt(e, D, {
+			appliedBy: `serve:${O}`,
+			environment: "prod",
+			dialectId: b
+		})), A.provide(e)));
+		t.kind === "prod-mismatch" && ($.error(Gt(t, b)), $.error("serve: refusing to boot — apply the schema first (voltro db apply in a pre-deploy step), or set VOLTRO_AUTO_MIGRATE=0 to bypass this check."), process.exit(1)), $.info(Gt(t, b));
+	}
+	let M = lt(D);
+	m.mark("discover");
+	let N = await Se(y, void 0), Ie = xt(N, b);
+	for (let e of pe({
+		dialect: String(y?.store ?? process.env.DB_DIALECT ?? "postgres"),
+		changeStrategy: (process.env.CDC ?? "1") === "0" ? "inline" : "cdc",
+		dbUrl: process.env.DB_URL,
+		tables: T.tables.map((e) => ({
+			tableName: e.tableName,
+			isReactive: e.isReactive === !0
+		})),
+		querySources: T.queries.flatMap((e) => {
+			let t = e.descriptor.source;
+			return t === void 0 ? [] : typeof t == "string" ? [t] : [...t];
+		})
+	})) e.level === "warn" ? $.warn(e.message) : $.info(e.message);
+	y?.cache && !process.env.CACHE_BACKEND && (process.env.CACHE_BACKEND = y.cache), y?.cacheRedisUrl && !process.env.CACHE_REDIS_URL && (process.env.CACHE_REDIS_URL = y.cacheRedisUrl), y?.cacheRedisDriver && !process.env.CACHE_REDIS_DRIVER && (process.env.CACHE_REDIS_DRIVER = y.cacheRedisDriver), y?.cacheKeyPrefix && !process.env.CACHE_KEY_PREFIX && (process.env.CACHE_KEY_PREFIX = y.cacheKeyPrefix);
+	let { service: Re, invalidationBus: ze, snapshotCache: Ve, cache: P, backend: He, dispose: F } = await _e({ env: process.env });
+	$.info(`cache backend resolved: ${He}` + (He === "redis" ? ` (driver ${process.env.CACHE_REDIS_DRIVER ?? "resp"})` : " — in-process, not cross-instance")), N.onChange((e) => {
+		A.runFork(ze.publish(e.table));
+	}), y?.kv && !process.env.KV_BACKEND && (process.env.KV_BACKEND = y.kv), y?.kvRedisUrl && !process.env.KV_REDIS_URL && (process.env.KV_REDIS_URL = y.kvRedisUrl), y?.kvKeyPrefix && !process.env.KV_KEY_PREFIX && (process.env.KV_KEY_PREFIX = y.kvKeyPrefix);
+	let { kv: Ue, service: We } = await tt({ store: N });
+	m.mark("store");
+	let Ye = Be({
+		store: N,
+		sink: E.sink,
+		log: $
+	}), Xe = Ce({
+		store: N,
+		dialect: b
+	}), L = y?.plugins ?? [], R = process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, rt, it;
+	b !== "memory" && (rt = Pe.make((await n(b)).makeSqlLayer(x())), it = await rt.runPromise(Ct.SqlClient));
+	let at = nt({
+		coordinator: [
+			"postgres",
+			"mariadb",
+			"mysql",
+			"mssql"
+		].includes(b) ? Ze(N, R, $) : vt,
+		replicaId: R,
+		log: $
+	}), ot = [], st = {
+		...it ? { sql: it } : {},
+		scheduleCoordinated: (e, t, n) => {
+			let r = at(e, t, n);
+			return ot.push(r), r;
+		}
+	};
+	for (let e of L) e.bindDataStore?.(N, st);
+	let ct = L.filter((e) => typeof e.onChangeEvent == "function");
+	if (ct.length > 0) {
+		let e = N.changeScope ?? "local";
+		N.onChange((t) => {
+			let n = ae(t, e);
+			for (let e of ct) A.runFork(e.onChangeEvent(n).pipe(A.catchAllCause((t) => A.sync(() => $.warn(`plugin ${e.name} onChangeEvent failed`, { error: Ne.pretty(t) })))));
+		});
+	}
+	let ut = Ee({
+		plugins: L,
+		appName: y?.name ?? "voltro-api",
+		appType: "api",
+		voltroVersion: process.env.npm_package_version ?? "0.0.0",
+		log: $
+	});
+	L.length && await ut.activate(), m.mark("plugins");
+	let dt = await ut.gatherObservability(), ft = await xe(N, y, b, {
+		info: (e, t) => process.stdout.write(`[broadcast] ${e} ${t ? JSON.stringify(t) : ""}\n`),
+		warn: (e, t) => process.stderr.write(`[broadcast] ${e} ${t ? JSON.stringify(t) : ""}\n`),
+		debug: () => {}
+	}), z = y?.apiKeys, pt = (typeof z == "object" ? z.prefix : void 0) ?? "voltro_", B = z ? Ke(N) : void 0, V = B ? $e({ flush: et(B) }) : void 0;
+	V && process.once("exit", () => {
+		V.shutdown();
+	});
+	let gt = B ? Qe(B, {
+		prefix: pt,
+		...V ? { usage: V } : {}
+	}) : void 0, _t = gt ? [Je(gt, { prefix: pt })] : [], yt = ye([...y?.auth?.strategies ?? [], ..._t], qt(y?.plugins ?? []), y?.auth?.anonymousTenantRequired ?? !1, y?.auth?.resolveScopes, () => Ie), bt = [...y?.restRoutes ?? [], ...gt ? Le(gt, (typeof z == "object" ? z.managementPath : void 0) ?? "/v1/api-keys") : []], H = y?.idempotency, St = H ? {
+		store: I(N),
+		header: (typeof H == "object" ? H.header : void 0) ?? "Idempotency-Key",
+		ttlMs: (typeof H == "object" ? H.ttlMs : void 0) ?? 864e5
+	} : void 0, wt = bt.length > 0 ? Yt(bt, {
+		store: N,
+		resolveSubject: (e) => yt({
+			headers: e,
+			clientId: -1
+		}),
+		...St ? { idempotency: St } : {}
+	}) : [], U = L.map((e) => e.services).filter((e) => e !== void 0), Et = j.mergeAll(d({
+		analyticsLayer: E.layer,
+		cacheService: Re,
+		kvService: We,
+		pluginServices: U,
+		userLayers: y?.layers ?? []
+	}), se(y?.http ?? {})), W = y?.scheduling ?? {}, Dt = W.trigger ?? "self", Ot = /* @__PURE__ */ new Set([
+		"postgres",
+		"mysql",
+		"mariadb",
+		"mssql"
+	]), kt = W.coordination ?? (Ot.has(b) ? "advisoryLock" : "single"), G = kt === "cluster" && Ot.has(b), At = G ? "cluster" : kt === "advisoryLock" && Ot.has(b) ? "advisoryLock" : "single";
+	kt === "cluster" && !G && $.warn("scheduling.coordination=cluster needs a sql-backed store except sqlite — falling back to single"), kt === "advisoryLock" && !Ot.has(b) && $.warn("scheduling.coordination=advisoryLock needs a SQL store (the claim-row gate) — falling back to single");
+	let jt, K = T.workflows.length > 0 || T.workflowWorkers.length > 0 || T.eventTriggers.length > 0 || (Te?.outgoing.length ?? 0) > 0 || G, Mt;
+	if (K) {
+		if (b === "mssql") {
+			let e = await h(process.cwd());
+			e && $.warn(e);
+		}
+		let [{ WorkflowEngine: e }, { makeClusterCronLayer: t, workflowEngineLayer: r, resolveRunnerStorage: i }] = await Promise.all([import("@effect/workflow"), import("@voltro/workflow/cluster")]), a = G ? T.schedules.filter((e) => (e.trigger ?? Dt) === "self").map((e) => t({
+			name: e.name,
+			cron: Ge(e),
+			execute: async () => {
+				await jt?.fireFromCluster(e.name);
+			}
+		})) : [];
+		Mt = b === "memory" ? e.layerMemory : await (async () => {
+			let e = await n(b), t = i({ sqliteFamily: e.id === "sqlite" || e.id === "turso" });
+			return $.info(`workflow engine: cluster-${t}, dialect=${e.id}` + (t === "memory" ? " — single-process durable replay, no cross-pod shard handoff" + (e.id !== "sqlite" && e.id !== "turso" ? " (VOLTRO_WORKFLOW_RUNNER_STORAGE=memory: SqlRunnerStorage/cluster_runners + GET_LOCK skipped)" : "") : "")), r({
+				sqlClientLayer: e.makeSqlLayer(x()),
+				runnerStorage: t,
+				dialectId: e.id,
+				...process.env.VOLTRO_WORKFLOW_RUNNER_PORT ? { runnerListenPort: Number(process.env.VOLTRO_WORKFLOW_RUNNER_PORT) } : {},
+				...a.length > 0 ? { extraShardingLayers: a } : {}
+			});
+		})();
+	}
+	let Nt = fe(L, t()), q = w.filter((e) => /\.subscribe\.tsx?$/.test(e)), Pt = q.length > 0 ? await f(q, $) : [], Ft = w.filter((e) => /\.reaction\.tsx?$/.test(e)), It = Ft.length > 0 ? await ve(Ft, $) : [], J = w.filter((e) => u.test(e)), Lt = J.length > 0 ? await ie(J, $) : [], Y = w.filter((e) => /\.aggregate\.tsx?$/.test(e)), X = Y.length > 0 ? await p(Y, $) : [], Z = ne();
+	if (X.length > 0 && b !== "memory") try {
+		Z = v((await n(b)).makeSqlLayer(x()));
+	} catch (e) {
+		$.warn("aggregate: SQL storage init failed — falling back to in-process", { err: String(e) });
+	}
+	let Rt = b === "memory" ? vt : Ze(N, `aggregate@${process.pid}`, $), zt = [], Bt = [], Ht = w.filter((e) => l.test(e));
+	if (Ht.length > 0) {
+		let e = $.child("agent"), t = w.filter((e) => a.test(e));
+		t.length > 0 && await o(t, e);
+		let n = await c(Ht, e);
+		for (let e of n.agents) for (let t of Oe(e)) (t.kind === "action" ? zt : Bt).push({
+			file: t.file,
+			descriptor: t.descriptor,
+			executor: t.executor
+		});
+		n.agents.length > 0 && e.info("synthesized agent routes", { agents: n.agents.map((e) => e.descriptor.name) });
+	}
+	m.mark("workflow");
+	let Ut = await Dn({
+		bootTiming: m,
+		discovered: {
+			queries: [...T.queries, ...Bt],
+			mutations: T.mutations,
+			actions: [...T.actions, ...zt],
+			streams: T.streams,
+			workflows: T.workflows,
+			workflowWorkers: T.workflowWorkers,
+			eventTriggers: T.eventTriggers,
+			schedules: T.schedules,
+			subscribers: Pt,
+			outboxHandlers: Lt,
+			connections: T.connections,
+			reactions: It,
+			aggregates: X,
+			...Te === void 0 ? {} : { webhooks: Te }
+		},
+		log: $,
+		analytics: E.sink,
+		aggregateStorage: Z,
+		aggregateCoordinator: Rt,
+		store: N,
+		kv: Ue,
+		cache: P,
+		snapshotCache: Ve,
+		schemaRegistry: M,
+		tenantScopedTables: T.tenantScopedTables,
+		softDeleteScopedTables: T.softDeleteScopedTables,
+		dataTransferSnapshot: Wt(D),
+		dataTransferDialect: b,
+		tenantIsolation: (process.env.VOLTRO_TENANT_ISOLATION ?? y?.tenancy?.isolation) === "namespace" ? "namespace" : "shared-schema",
+		resolveSubject: (e, t) => yt({
+			headers: e,
+			clientId: t
+		}),
+		httpRoutes: [...L.flatMap((e) => e.httpRoutes ?? []), ...wt],
+		getStore: () => Ie,
+		...Et ? { baseLayer: Et } : {},
+		...Mt === void 0 ? {} : { workflowEngineLayer: Mt },
+		scheduleDefaultTrigger: Dt,
+		scheduleCoordination: At,
+		scheduleArmSelf: !G,
+		dormancy: process.env.VOLTRO_DORMANCY === "sleep" || process.env.VOLTRO_DORMANCY === "always-on" ? process.env.VOLTRO_DORMANCY : y?.dormancy ?? "always-on",
+		scheduleReplicaId: process.env.HOSTNAME ?? `pid-${process.pid}`,
+		...Nt === void 0 ? {} : { scheduleFireInterceptor: Nt },
+		onSchedulerReady: (e) => {
+			jt = e;
+		},
+		observability: dt,
+		port: ce,
+		...y?.transport?.wsPath ? { path: y.transport.wsPath } : {}
+	});
+	re(de([
+		T.queries,
+		T.mutations,
+		T.actions,
+		T.streams
+	]), (e) => {
+		$.warn(e);
+	}), $.info(`API listening on :${ce}`, {
+		dialect: b,
+		queries: T.queries.length,
+		mutations: T.mutations.length,
+		actions: T.actions.length,
+		streams: T.streams.length,
+		workflows: T.workflows.length,
+		workflowWorkers: T.workflowWorkers.length,
+		schedules: T.schedules.length,
+		scheduleCoordination: At
+	}), m.finish($);
+	let Jt = () => {
+		for (let e of ot) e.stop();
+		Ye.detach(), Xe.stop(), F(), rt?.dispose(), setTimeout(() => process.exit(0), 1e4).unref?.(), Promise.resolve(ut.deactivate()).then(() => ft?.close()).then(() => E.dispose()).then(() => Ut.close()).then(() => N.close?.()).then(() => process.exit(0)).catch((e) => {
+			console.error("serve: shutdown step failed, exiting anyway:", e), process.exit(0);
+		});
+	};
+	return process.on("SIGINT", Jt), process.on("SIGTERM", Jt), await new Promise(() => {}), 0;
+};
+//#endregion
+export { An as n, wn as r, jn as t };