@voltro/cli 0.20.2 → 0.21.0

package/dist/serveCommand-qHJCs0cX.js

@@ -0,0 +1,1162 @@
+import { at as e, t } from "./inspectMetrics-DMjWBQif.js";
+import { s as n } from "./seedRunner-D6eu-u5U.js";
+import { r, t as i } from "./appModuleLoader-C9r9mxZt.js";
+import { f as a, m as o, n as s, p as c, u as l } from "./frameworkTableAssembly-sg41s14F.js";
+import { l as u } from "./fileConventions-CBNPZVOV.js";
+import { p as d } from "./inspect-Dwx0_tUj.js";
+import { $ as ee, A as f, B as p, C as te, D as m, E as ne, F as re, G as ie, H as ae, I as h, K as oe, L as g, M as _, N as se, O as v, P as y, R as ce, S as le, T as ue, V as de, W as fe, _ as b, at as pe, b as me, c as he, et as ge, h as x, i as _e, it as S, j as ve, k as ye, lt as C, m as be, nt as w, o as T, ot as xe, q as Se, r as Ce, rt as we, st as Te, t as Ee, tt as De, u as Oe, ut as ke, v as Ae, w as je, x as E, y as Me, z as D } from "./dev-DKb92NYX.js";
+import { l as O, r as Ne } from "./apiBuild-BHOtsQkp.js";
+import { t as Pe } from "./bootTiming-BdyP9nYw.js";
+import { n as Fe } from "./cliArgs-qdZSElM3.js";
+import { join as Ie } from "node:path";
+import { pathToFileURL as Le } from "node:url";
+import { Cause as Re, Effect as k, Layer as A, ManagedRuntime as ze } from "effect";
+import { createLogger as j } from "@voltro/logger";
+import { existsSync as Be } from "node:fs";
+import { AggregateRegistry as M, Dispatcher as Ve, apiKeyManagementRoutes as N, applySoftDeleteScope as He, applyTenantScope as Ue, attachAnalyticsMirror as We, awaitServerListening as Ge, bindMutation as P, bindStream as Ke, bindSubscription as F, buildTracingLayer as qe, cancelWakeup as Je, compileCron as Ye, dataStoreApiKeyStore as Xe, dataStoreIdempotencyStore as Ze, formatServerOnlyLeaks as Qe, frameworkApiKeyStrategy as $e, installPolicyGuardResolver as et, loadResourceTuples as tt, makeActionRunner as I, makeAdvisoryLockCoordinator as nt, makeApiKeyService as rt, makeApiKeyUsageBuffer as it, makeApiKeyUsageFlusher as at, makeAsyncKv as ot, makeCoordinatedScheduler as st, makeEffectStoreLayer as L, makeLazyWorkflowFacade as ct, makeMutationRunner as lt, makeOneShotQueryRunner as ut, makeQueryDescriptorProducer as dt, makeQueryReauthorizer as ft, makeQuerySubscriber as pt, makeSchemaRegistry as mt, makeWorkflowFacade as ht, makeWorkflowFacadeWithCallerContext as gt, makeWorkflowLayers as _t, noopKv as R, recordSubscriptionDelivery as vt, registerWakeup as yt, resolveSecretsBackend as bt, runProvidedEffect as z, setSecretsBackend as xt, setSystemStoreHandle as St, setTupleSource as Ct, singleCoordinator as wt, startRpcServer as Tt, startScheduler as Et, workflowToRpc as B, wrapStoreWithBootCodec as Dt } from "@voltro/runtime";
+import { RpcGroup as Ot } from "@effect/rpc";
+import { SqlClient as kt } from "@effect/sql";
+import { and as At, ensureTableRegistered as jt, eq as V, or as Mt } from "@voltro/database";
+import { appStorageProvider as H, fromNodeReadable as Nt, getObjectStream as Pt, putObjectStream as U, toNodeReadable as W } from "@voltro/plugin-storage";
+import { AuthMiddleware as Ft, ConnectionInfoMiddleware as G, actionToRpc as K, anonymousSubject as It, mutationToRpc as Lt, queryToRpc as q, streamToRpc as Rt, workflowCancelDescriptor as zt, workflowDomainEventsQueryDescriptor as Bt, workflowEventDeliveriesQueryDescriptor as J, workflowResumeDescriptor as Vt, workflowRunEventsQueryDescriptor as Y, workflowRunQueryDescriptor as X, workflowRunStepsQueryDescriptor as Z, workflowRunsQueryDescriptor as Ht, workflowSignalDescriptor as Ut, workflowUpdateDescriptor as Wt } from "@voltro/protocol";
+import { assertProductionSessionSecret as Gt } from "@voltro/protocol/session";
+import { createHash as Kt, timingSafeEqual as qt } from "node:crypto";
+import { declaredSnapshot as Jt, describeOutcome as Yt, runPlannedMigrations as Xt } from "@voltro/database/sql";
+import { getAuthSessionStrategy as Zt } from "@voltro/plugin-auth";
+import { collectPublicApiRoutes as Qt, restRoutesToHttpRoutes as $t } from "@voltro/protocol/rest";
+import { buildDeliverWebhookExecute as en, buildWebhooksService as tn, defaultIncomingPath as nn, deliverWebhookWorkflow as rn, mountIncomingWebhook as an } from "@voltro/plugin-webhooks";
+import { packBundle as on, runExport as sn, runImport as cn, storageBlobSink as ln, storageRefsBlobSource as un, unpackBundle as dn, unpackBundleToDir as fn } from "@voltro/data-transfer";
+//#region src/bootRefusal.ts
+var pn = "VoltroBootRefusal", mn = (e) => {
+	let t = Error(e);
+	return t.name = pn, t;
+}, hn = "/_voltro/admin/import", gn = "/_voltro/admin/export", Q = (e, t) => ({
+	status: e,
+	contentType: "application/json; charset=utf-8",
+	body: JSON.stringify(t)
+}), _n = (e) => {
+	let t = e.authorization ?? e.Authorization, n = t ? /^Bearer\s+(.+)$/i.exec(t) : null;
+	return n ? n[1] : null;
+}, vn = (e, t) => qt(Kt("sha256").update(e).digest(), Kt("sha256").update(t).digest()), yn = (e, t) => {
+	if (e.method.toUpperCase() !== "POST") return Q(405, { error: "method not allowed" });
+	if (!t || t.length < 16) return Q(503, { error: "data transfer misconfigured (no/weak secret)" });
+	let n = _n(e.headers);
+	return !n || !vn(n, t) ? Q(401, { error: "unauthorized" }) : null;
+}, bn = j({ scope: "voltro:admin-import" }), xn = "VBUNDLE2", Sn = async function* (e) {
+	yield e;
+}, Cn = (e) => async (t) => {
+	let n = yn(t, e.secret);
+	if (n) return n;
+	let r = t.headers["x-import-mode"], i = t.headers["x-import-on-conflict"], a = t.headers["x-import-atomic"] === "1" || t.headers["x-import-atomic"] === "true", o = t.headers["x-import-force"] === "1" || t.headers["x-import-force"] === "true", s = t.rawBody.byteLength >= 8 && Buffer.from(t.rawBody.subarray(0, 8)).toString("latin1") === xn, c, l;
+	if (s) c = Sn(t.rawBody), l = "upload";
+	else {
+		let n;
+		try {
+			n = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
+		} catch {
+			return Q(400, { error: "body must be a packed bundle archive or { bundleKey } JSON" });
+		}
+		if (typeof n.bundleKey != "string" || !n.bundleKey) return Q(400, { error: "body.bundleKey (string) is required for the storage transport" });
+		if (!e.openArchive) return Q(501, { error: "storage transport not configured on this instance" });
+		c = e.openArchive(n.bundleKey), l = "storage";
+	}
+	let u = await import("node:os"), d = await import("node:fs/promises"), ee = await import("node:path"), f = await d.mkdtemp(ee.join(u.tmpdir(), "voltro-admin-import-"));
+	try {
+		e.assetSink ? await dn(c, {
+			dir: f,
+			blobs: e.assetSink
+		}) : await fn(c, f);
+		let t = await k.runPromiseExit(cn({
+			store: e.store,
+			bundleDir: f,
+			...r ? { mode: r } : {},
+			...i ? { onConflict: i } : {},
+			...a ? { atomic: a } : {},
+			...e.snapshot ? { targetSnapshot: e.snapshot } : {},
+			force: o,
+			onWarn: (e) => bn.warn("admin.import", { message: e }),
+			...e.assetSink ? { assetsAlreadyRestored: !0 } : {}
+		}));
+		if (t._tag === "Failure") {
+			let e = t.cause._tag === "Fail" ? t.cause.error : void 0;
+			if (e && e._tag === "SchemaDriftError") {
+				let t = e;
+				return bn.warn("admin.import refused (schema drift)", {
+					transport: l,
+					bundle: t.bundleFingerprint.slice(0, 16),
+					target: t.targetFingerprint.slice(0, 16)
+				}), Q(409, {
+					error: "schema drift",
+					bundleFingerprint: t.bundleFingerprint,
+					targetFingerprint: t.targetFingerprint,
+					diff: t.diff,
+					hint: "re-export against the current schema, or resend with x-import-force: 1"
+				});
+			}
+			throw Error(String(e?.message ?? e ?? "import failed"));
+		}
+		let n = t.value, s = n.tables.reduce((e, t) => e + t.rowCount, 0);
+		return bn.info("admin.import", {
+			transport: l,
+			tables: n.tables.length,
+			rows: s,
+			mode: r ?? "upsert",
+			atomic: a
+		}), Q(200, {
+			tables: n.tables.length,
+			rows: s,
+			transport: l
+		});
+	} catch (e) {
+		return bn.warn("admin.import failed", {
+			transport: l,
+			error: e?.message ?? String(e)
+		}), Q(500, {
+			error: "import failed",
+			message: e?.message ?? String(e)
+		});
+	} finally {
+		await d.rm(f, {
+			recursive: !0,
+			force: !0
+		});
+	}
+}, wn = j({ scope: "voltro:admin-export" }), Tn = async (e) => {
+	let t = [];
+	for await (let n of e) t.push(Buffer.from(n));
+	return new Uint8Array(Buffer.concat(t));
+}, En = (e) => typeof e.tenant == "string" && e.tenant ? {
+	kind: "tenant",
+	tenantId: e.tenant
+} : Array.isArray(e.tables) && e.tables.length ? {
+	kind: "tables",
+	tables: e.tables.filter((e) => typeof e == "string")
+} : { kind: "all" }, Dn = (e) => async (t) => {
+	let n = yn(t, e.secret);
+	if (n) return n;
+	let r;
+	try {
+		r = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
+	} catch {
+		return Q(400, { error: "body must be JSON: { profile?, tenant?, tables?, consistency?, compression?, bundleKey? }" });
+	}
+	let i = {};
+	if (typeof r.profile == "string" && r.profile) {
+		if (!e.loadProfile) return Q(501, { error: "server-side profiles not configured on this instance" });
+		try {
+			i = await e.loadProfile(r.profile);
+		} catch (e) {
+			return Q(400, {
+				error: `profile '${r.profile}' could not be loaded`,
+				message: e?.message ?? String(e)
+			});
+		}
+	}
+	let a = r.consistency === "snapshot" ? "snapshot" : i.consistency ?? "live", o = (typeof r.compression == "string" ? r.compression : void 0) ?? i.compression, s = i.scope ?? En(r), c = typeof r.bundleKey == "string" && r.bundleKey.length > 0, l = r.assets === !0 && e.assetSource ? { blobs: e.assetSource } : {}, u = await import("node:os"), d = await import("node:fs/promises"), ee = await import("node:path"), f = await d.mkdtemp(ee.join(u.tmpdir(), "voltro-admin-export-"));
+	try {
+		let t = await k.runPromise(sn({
+			store: e.store,
+			snapshot: e.snapshot,
+			dialect: e.dialect,
+			outDir: f,
+			...i.subset ? { subset: i.subset } : {
+				scope: s,
+				...e.tenantTables && e.tenantTables.length > 0 ? { tenantTables: e.tenantTables } : {}
+			},
+			consistency: a,
+			...o ? { compression: o } : {},
+			...i.masking ? { masking: i.masking } : {}
+		})), n = t.tables.reduce((e, t) => e + t.rowCount, 0), u = t.masking?.transformed.length ?? 0;
+		if (c) {
+			if (!e.putArchive) return Q(501, { error: "storage transport not configured on this instance" });
+			let i = r.bundleKey;
+			return await e.putArchive(i, () => on({
+				dir: f,
+				...l
+			})), wn.info("admin.export", {
+				transport: "storage",
+				tables: t.tables.length,
+				rows: n,
+				masked: u,
+				bundleKey: i
+			}), Q(200, {
+				bundleKey: i,
+				tables: t.tables.length,
+				rows: n,
+				masked: u,
+				transport: "storage"
+			});
+		}
+		let d = await Tn(on({
+			dir: f,
+			...l
+		}));
+		return wn.info("admin.export", {
+			transport: "download",
+			tables: t.tables.length,
+			rows: n,
+			masked: u,
+			bytes: d.byteLength
+		}), {
+			status: 200,
+			contentType: "application/octet-stream",
+			body: d,
+			headers: {
+				"x-export-tables": String(t.tables.length),
+				"x-export-rows": String(n),
+				"x-export-masked": String(u)
+			}
+		};
+	} catch (e) {
+		return wn.warn("admin.export failed", { error: e?.message ?? String(e) }), Q(500, {
+			error: "export failed",
+			message: e?.message ?? String(e)
+		});
+	} finally {
+		await d.rm(f, {
+			recursive: !0,
+			force: !0
+		});
+	}
+}, On = async (e) => {
+	let { resolve: t } = await import("node:path"), { existsSync: n } = await import("node:fs"), r = [
+		e,
+		`${e}.profile.ts`,
+		`data-profiles/${e}.ts`,
+		`data-profiles/${e}.profile.ts`
+	].map((e) => t(process.cwd(), e)), i = r.find((e) => n(e));
+	if (!i) throw Error(`data profile '${e}' not found (looked for: ${r.join(", ")})`);
+	let a = await import(i), o = a.default ?? a.profile;
+	if (!o) throw Error(`data profile '${i}' has no default export`);
+	return o;
+}, kn = (e, t, n = {}) => (async function* () {
+	let r = await W((await k.runPromise(Pt(e, t).pipe(k.timeout(n.openTimeout ?? "30 seconds")))).stream), i = n.stallMs ?? 12e4, a, o = () => {
+		a && clearTimeout(a), a = setTimeout(() => r.destroy(/* @__PURE__ */ Error(`storage read stalled for ${i}ms reading '${t}'`)), i);
+	};
+	try {
+		o();
+		for await (let e of r) o(), yield e instanceof Uint8Array ? e : new Uint8Array(e);
+	} finally {
+		a && clearTimeout(a), r.destroy();
+	}
+})(), An = {
+	get: async () => void 0,
+	set: async () => {},
+	setWithTags: async () => {},
+	remove: async () => !1,
+	has: async () => !1,
+	clear: async () => {},
+	invalidateTag: async () => 0,
+	wrap: async (e, t, n) => n()
+}, jn = async (e) => {
+	St({
+		dataStore: e.store,
+		schemaRegistry: e.schemaRegistry
+	});
+	let t = new Ve({
+		store: e.store,
+		...e.snapshotCache ? { cache: e.snapshotCache } : {},
+		recordDelivery: (e) => vt({
+			label: e.label,
+			kind: e.kind,
+			durationMs: e.durationMs,
+			rowCount: e.rowCount
+		})
+	}), n = e.cache ?? An, r = e.kv ?? R, i, a, o, s = /* @__PURE__ */ new Map(), c = () => `wfctx_${globalThis.crypto?.randomUUID?.() ?? `${Date.now().toString(36)}${Math.random().toString(36).slice(2)}`}`, l = async (t, n, r) => {
+		let i = {
+			...r,
+			source: r.source ?? `workflow:${t}`
+		};
+		s.set(n, i);
+		try {
+			let r = await e.store.query({
+				table: "_voltro_workflow_start_contexts",
+				order: [],
+				predicate: V("executionId", n),
+				projection: ["id"],
+				skip: void 0,
+				take: 1
+			}), a = {
+				workflowName: t,
+				executionId: n,
+				subject: i.subject ?? null,
+				traceId: i.traceId ?? null,
+				source: i.source ?? null,
+				parentExecutionId: i.parentExecutionId ?? null,
+				parentClosePolicy: i.parentClosePolicy ?? null,
+				createdAt: /* @__PURE__ */ new Date()
+			};
+			r[0] === void 0 ? await e.store.insert("_voltro_workflow_start_contexts", {
+				id: c(),
+				...a
+			}) : await e.store.update("_voltro_workflow_start_contexts", r[0].id, a);
+		} catch (e) {
+			process.stderr.write(`[workflow] failed to persist start context for ${t}/${n}: ${e?.message ?? String(e)}\n`);
+		}
+	}, u = async (t, n) => {
+		let r = s.get(n);
+		if (r !== void 0) return r;
+		try {
+			let t = (await e.store.query({
+				table: "_voltro_workflow_start_contexts",
+				order: [],
+				predicate: V("executionId", n),
+				projection: void 0,
+				skip: void 0,
+				take: 1
+			}))[0];
+			if (t === void 0) return;
+			let r = {
+				...t.subject === null ? {} : { subject: t.subject },
+				...t.traceId === null ? {} : { traceId: t.traceId },
+				...t.source === null ? {} : { source: t.source },
+				...t.parentExecutionId === null ? {} : { parentExecutionId: t.parentExecutionId },
+				...t.parentClosePolicy === null ? {} : { parentClosePolicy: t.parentClosePolicy }
+			};
+			return s.set(n, r), r;
+		} catch (e) {
+			process.stderr.write(`[workflow] failed to load start context for ${n}: ${e?.message ?? String(e)}\n`);
+			return;
+		}
+	}, d = (e.discovered.workflows?.length ?? 0) > 0 ? ct(() => i) : void 0, f = (e.discovered.workflows?.length ?? 0) > 0 || (e.discovered.eventTriggers?.length ?? 0) > 0, te = f || (e.discovered.workflowWorkers?.length ?? 0) > 0 || e.scheduleCoordination === "cluster", re = e.tenantIsolation === "namespace", ie = (e.log ?? j({ scope: "voltro:serve" })).child("webhooks"), ae, h = e.discovered.webhooks;
+	if (h && h.outgoing.length > 0 && e.workflowEngineLayer !== void 0) {
+		let t = e.workflowEngineLayer, i = S({
+			store: e.store,
+			schemaRegistry: e.schemaRegistry,
+			cache: n,
+			kv: r
+		}), a = h.outgoing.map((e) => e.descriptor);
+		ae = tn(i, async (e) => {
+			let n = rn.execute(e).pipe(k.provide(rn.toLayer(en(i, { events: a })).pipe(A.provideMerge(t))));
+			k.runPromise(n).catch((t) => {
+				ie.error("deliverWebhook workflow crashed", {
+					deliveryId: e.deliveryId,
+					targetId: e.targetId
+				}, t);
+			});
+		}, { events: a });
+	}
+	let oe = /* @__PURE__ */ new Map();
+	if (h) for (let e of h.incoming) {
+		let t = e.descriptor.path ?? nn(e.descriptor.id), n = `VOLTRO_WEBHOOK_SECRET_${e.descriptor.id.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`, r = an(e.descriptor, {
+			resolveSecret: async () => process.env[n] ?? null,
+			resolveWorkflows: () => d === void 0 ? void 0 : gt(d, {
+				traceId: `incoming:${e.descriptor.id}`,
+				source: `incoming:${e.descriptor.id}`
+			}),
+			log: (e) => {
+				let t = {
+					webhookId: e.webhookId,
+					status: e.status,
+					signatureOk: String(e.signatureOk),
+					idempotency: e.idempotency,
+					durationMs: e.durationMs
+				};
+				e.status >= 500 ? ie.error("incoming delivery failed", t) : e.status >= 400 ? ie.warn("incoming delivery rejected", t) : ie.info("incoming delivery handled", t);
+			}
+		});
+		oe.set(t, { handle: r });
+	}
+	et(), Ct((t) => tt(e.store, t.subjectId, t.resourceType, t.resourceId));
+	let se = (e.discovered.outboxHandlers?.length ?? 0) > 0 ? p({
+		handlers: e.discovered.outboxHandlers ?? [],
+		store: e.store,
+		log: (e.log ?? j({ scope: "voltro:serve" })).child("outbox")
+	}) : void 0, v = ce({
+		definitions: (e.discovered.connections ?? []).map((e) => e.definition),
+		store: e.store,
+		publicUrl: g(e.port ?? 4e3),
+		log: (e.log ?? j({ scope: "voltro:serve" })).child("connections")
+	}), y = we({
+		store: e.store,
+		schemaRegistry: e.schemaRegistry,
+		cache: n,
+		kv: r,
+		...ae === void 0 ? {} : { webhooksService: ae },
+		...d === void 0 ? {} : { workflowsProxy: d },
+		eventTriggers: e.discovered.eventTriggers ?? [],
+		namespaceIsolationOn: re,
+		...se === void 0 ? {} : { outbox: { nudge: se.nudge } },
+		...v.active ? { connections: { registry: v.registry } } : {}
+	}), ue = A.succeed(M, m), fe = (t, n) => {
+		let r = t.pipe(k.provide(L(n)));
+		return z((e.baseLayer ? r.pipe(k.provide(e.baseLayer)) : r).pipe(k.provide(ue)));
+	}, pe = lt({
+		store: e.store,
+		buildContext: (e, t, n) => y(e, t, n),
+		runEffect: fe,
+		undoCapture: le()
+	}), me = E(), he = I({
+		buildContext: (e) => y(e),
+		runEffect: fe
+	}), ge = {
+		buildContext: (e) => y(e),
+		finalize: (t, n) => He(Ue(t, e.tenantScopedTables, n.subject.tenantId), e.softDeleteScopedTables),
+		provideEffect: (e, t) => e.pipe(k.provide(L(t)))
+	}, x = dt(ge), _e = ut({
+		...ge,
+		queryRows: (t) => e.store.query(t)
+	}), ye = pt({
+		...ge,
+		subscribeDescriptor: (e, n, r) => t.subscribe(e, n, r),
+		subscribeComputed: (e, n, r) => t.subscribeComputed(e, n, r)
+	}), C = {};
+	for (let n of [
+		...e.discovered.queries,
+		...me.queries,
+		...v.queries
+	]) C[n.descriptor.name] = (e) => F(x(n, e), t, `subscription.${n.descriptor.name}`, void 0, void 0, ft(n, e));
+	for (let t of [
+		...e.discovered.mutations,
+		...me.mutations,
+		...v.mutations
+	]) C[t.descriptor.name] = (e) => P(async (e, n) => pe(t, e, n), e, `mutation.${t.descriptor.name}`);
+	for (let t of [...e.discovered.actions, ...v.actions]) C[t.descriptor.name] = (e) => P(async (e, n) => he(t, e, n), e, `action.${t.descriptor.name}`);
+	let be = () => `public-${Math.random().toString(36).slice(2, 10)}`, T = [
+		...e.discovered.queries.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => _e(e, t, {
+				subject: n.subject,
+				traceId: be()
+			}),
+			subscribe: (t, n, r) => ye(e, t, {
+				subject: n.subject,
+				traceId: be()
+			}, r)
+		})),
+		...e.discovered.mutations.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => pe(e, t, {
+				subject: n.subject,
+				traceId: be()
+			})
+		})),
+		...e.discovered.actions.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => he(e, t, {
+				subject: n.subject,
+				traceId: be()
+			})
+		}))
+	], xe = T.length > 0 ? $t(Qt(T), {
+		store: e.store,
+		resolveSubject: (t) => e.resolveSubject(t, -1)
+	}) : [], Se = e.dataTransferSecret ?? process.env.VOLTRO_DATA_TRANSFER_SECRET, Ce = Se && Se.length >= 16 ? [{
+		method: "POST",
+		path: hn,
+		handle: Cn({
+			secret: Se,
+			store: e.store,
+			...e.dataTransferSnapshot ? { snapshot: e.dataTransferSnapshot } : {},
+			assetSink: ln(H()),
+			openArchive: (e) => kn(H(), e)
+		})
+	}, {
+		method: "POST",
+		path: gn,
+		handle: Dn({
+			secret: Se,
+			store: e.store,
+			snapshot: e.dataTransferSnapshot ?? { tables: [] },
+			dialect: e.dataTransferDialect ?? "memory",
+			tenantTables: [...e.tenantScopedTables],
+			loadProfile: On,
+			assetSource: un(H(), e.store),
+			putArchive: async (e, t) => {
+				let { Readable: n } = await import("node:stream"), r = H(), i = Nt("storage", () => n.from(t()));
+				await k.runPromise(U(r, e, i, { contentType: "application/octet-stream" }));
+			}
+		})
+	}] : [], Te = [
+		...e.httpRoutes ?? [],
+		...xe,
+		...Ce,
+		...v.httpRoutes
+	];
+	for (let t of e.discovered.streams ?? []) C[t.descriptor.name] = (n) => Ke((r) => {
+		let i = y(r), a = t.executor(n, i);
+		if (k.isEffect(a)) {
+			let t = a.pipe(k.provide(L(i.store)));
+			return (e.baseLayer ? t.pipe(k.provide(e.baseLayer)) : t).pipe(k.provide(ue));
+		}
+		return typeof a == "object" && a && typeof a.then == "function" ? k.promise(() => a) : a;
+	}, `stream.${t.descriptor.name}`);
+	for (let t of e.discovered.workflows ?? []) C[t.definition.name] = (e) => P(async (e, n) => {
+		let r = n;
+		return gt(d, {
+			subject: r.subject,
+			traceId: r.traceId,
+			source: "workflow-rpc"
+		}).start(t.definition.name, e);
+	}, e, `workflow.${t.definition.name}`);
+	f && (C[X.name] = (e) => F(x({
+		descriptor: X,
+		executor: (e) => {
+			let t = e.id;
+			return {
+				table: "_voltro_workflow_runs",
+				order: [{
+					column: "startedAt",
+					direction: "desc"
+				}],
+				predicate: Mt(V("id", t), V("executionId", t)),
+				take: 1,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${X.name}`), C[Ht.name] = (e) => F(x({
+		descriptor: Ht,
+		executor: (e) => {
+			let t = e, n = [...t.tag === void 0 ? [] : [V("tag", t.tag)], ...t.status === void 0 ? [] : [V("status", t.status)]], r = Number.isFinite(t.limit) && t.limit !== void 0 ? Math.min(Math.max(Math.floor(t.limit), 1), 500) : 100;
+			return {
+				table: "_voltro_workflow_runs",
+				order: [{
+					column: "startedAt",
+					direction: "desc"
+				}],
+				predicate: n.length === 0 ? void 0 : n.length === 1 ? n[0] : At(...n),
+				take: r,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${Ht.name}`), C[Z.name] = (e) => F(x({
+		descriptor: Z,
+		executor: (e) => {
+			let t = e.runId;
+			return {
+				table: "_voltro_workflow_run_steps",
+				order: [{
+					column: "startedAt",
+					direction: "asc"
+				}],
+				predicate: V("runId", t),
+				take: 1e3,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${Z.name}`), C[Y.name] = (e) => F(x({
+		descriptor: Y,
+		executor: (e) => {
+			let t = e.runId;
+			return {
+				table: "_voltro_workflow_run_events",
+				order: [{
+					column: "occurredAt",
+					direction: "asc"
+				}],
+				predicate: V("runId", t),
+				take: 1e3,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${Y.name}`), C[Bt.name] = (e) => F(x({
+		descriptor: Bt,
+		executor: (e) => {
+			let t = e;
+			return {
+				table: "_voltro_workflow_events",
+				order: [{
+					column: "occurredAt",
+					direction: "desc"
+				}],
+				predicate: t.name === void 0 ? void 0 : V("name", t.name),
+				take: Math.max(1, Math.min(500, t.limit ?? 100)),
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${Bt.name}`), C[J.name] = (e) => F(x({
+		descriptor: J,
+		executor: (e) => {
+			let t = e.eventId;
+			return {
+				table: "_voltro_workflow_event_deliveries",
+				order: [{
+					column: "createdAt",
+					direction: "asc"
+				}],
+				predicate: V("eventId", t),
+				take: 500,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${J.name}`), C[zt.name] = (t) => P(async (t, n) => {
+		let r = t;
+		return await w(e.store, n.subject, { executionId: r.executionId }), await d.cancel(r.workflowName, r.executionId), await Pe(r.workflowName, r.executionId, "workflow.cancel"), { ok: !0 };
+	}, t, `action.${zt.name}`), C[Vt.name] = (t) => P(async (t, n) => {
+		let r = t;
+		return await w(e.store, n.subject, { executionId: r.executionId }), await d.resume(r.workflowName, r.executionId), { ok: !0 };
+	}, t, `action.${Vt.name}`), C[Ut.name] = (t) => P(async (t, n) => {
+		let r = t;
+		return await w(e.store, n.subject, { id: r.id }), d.signal({ id: r.id }, r.signalName, r.payload);
+	}, t, `action.${Ut.name}`), C[Wt.name] = (t) => P(async (t, n) => {
+		let r = t;
+		return await w(e.store, n.subject, { id: r.id }), d.update({ id: r.id }, r.updateName, r.payload, r.timeoutMs === void 0 ? void 0 : { timeoutMs: r.timeoutMs });
+	}, t, `action.${Wt.name}`));
+	let Ee = [
+		...e.discovered.queries.map((e) => q(e.descriptor)),
+		...e.discovered.mutations.map((e) => Lt(e.descriptor)),
+		...e.discovered.actions.map((e) => K(e.descriptor)),
+		...me.queries.map((e) => q(e.descriptor)),
+		...me.mutations.map((e) => Lt(e.descriptor)),
+		...v.queries.map((e) => q(e.descriptor)),
+		...v.mutations.map((e) => Lt(e.descriptor)),
+		...v.actions.map((e) => K(e.descriptor)),
+		...(e.discovered.streams ?? []).map((e) => Rt(e.descriptor)),
+		...(e.discovered.workflows ?? []).map((e) => B(e.definition)),
+		...f ? [
+			q(X),
+			q(Ht),
+			q(Z),
+			q(Y),
+			q(Bt),
+			q(J),
+			K(zt),
+			K(Vt),
+			K(Ut),
+			K(Wt)
+		] : []
+	], De = Ot.make(...Ee).middleware(Ft).middleware(G), Oe = A.succeed(Ft, Ft.of(({ headers: t, clientId: n }) => k.promise(() => e.resolveSubject(t, n)))), ke = A.succeed(G, G.of(({ clientId: e }) => k.succeed({ clientId: e }))), je = e.dormancyTenantId ?? "default", Me = e.dormancy === "sleep" ? {
+		register: (t, n, r) => yt(e.store, {
+			tenantId: r ?? je,
+			kind: "workflow",
+			refId: t,
+			wakeAt: n
+		}),
+		cancel: (t, n) => Je(e.store, {
+			tenantId: n ?? je,
+			kind: "workflow",
+			refId: t
+		}).then(() => {})
+	} : void 0, D = te ? await import("@voltro/workflow") : void 0, O = D?.makeWorkflowRunRecorder({
+		store: e.store,
+		...Me === void 0 ? {} : { wakeups: Me }
+	}), Ne = async (t, n) => {
+		await D.closeWorkflowChildrenForParent({
+			store: e.store,
+			parentExecutionId: t,
+			parentStatus: n,
+			recorder: O,
+			log: { warn: (e, t) => {
+				process.stderr.write(`[workflow] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+			} },
+			interruptChild: async (t, n) => {
+				let r = (e.discovered.workflows ?? []).find((e) => e.definition.name === t);
+				if (!r) throw Error(`Unknown child workflow: ${t}`);
+				if (!a) throw Error("Workflow runtime is not ready");
+				await a.runPromise(r.definition.interrupt(n));
+			}
+		});
+	}, Pe = async (t, n, r) => {
+		let i = (await e.store.query({
+			table: "_voltro_workflow_runs",
+			order: [],
+			predicate: V("executionId", n),
+			projection: void 0,
+			skip: void 0,
+			take: 1
+		}))[0];
+		if (i === void 0) return;
+		let a = await e.store.update("_voltro_workflow_runs", i.id, {
+			status: "cancelled",
+			cancelled: !0,
+			completedAt: /* @__PURE__ */ new Date()
+		}), o = i.subject?.tenantId ?? void 0;
+		a && await O.recordEvent({
+			runId: i.id,
+			eventType: "run-cancelled",
+			payload: {
+				reason: r,
+				workflowName: t,
+				executionId: n,
+				...o == null ? {} : { tenantId: o }
+			}
+		}), a && await Ne(n, "cancelled");
+	}, Fe = [..._t(e.discovered.workflows ?? [], {
+		buildContext: (t, n) => e.buildContextForWorkflow?.(t, n) ?? y({
+			subject: t.subject,
+			traceId: t.traceId
+		}, e.store, void 0, `workflow:${n.workflowName}`, { parentExecutionId: n.executionId }),
+		resolveStartContext: u
+	}, (t, n, r) => {
+		let i = D.getWorkflowVersionMetadata(t.definition);
+		return D.wrapWorkflowExecuteWithRunRecording({
+			name: t.definition.name,
+			store: e.store,
+			subject: r.subject,
+			source: r.source ?? null,
+			traceId: r.traceId,
+			workflowVersion: i.version,
+			workflowCompatibleVersions: i.compatibleWith,
+			workflowPatches: i.patches,
+			parentExecutionId: r?.parentExecutionId ?? null,
+			parentClosePolicy: r?.parentClosePolicy ?? null,
+			onParentClose: ({ executionId: e, status: t }) => Ne(e, t),
+			recorder: O
+		}, n);
+	}), ...e.discovered.workflowWorkers ?? []], Ie = Fe.length > 0 ? A.mergeAll(...Fe) : A.empty;
+	if (((e.discovered.workflows?.length ?? 0) > 0 || (e.discovered.workflowWorkers?.length ?? 0) > 0 || e.scheduleCoordination === "cluster") && e.workflowEngineLayer !== void 0) {
+		let t = Ie.pipe(A.provideMerge(e.workflowEngineLayer));
+		a = ze.make(e.baseLayer === void 0 ? t : t.pipe(A.provideMerge(e.baseLayer))), await a.runPromise(k.void), i = (e.discovered.workflows?.length ?? 0) > 0 ? ht({
+			workflows: e.discovered.workflows ?? [],
+			runEffect: (e) => a.runPromise(e),
+			rememberStartContext: l,
+			signal: async (t, n, r) => {
+				let i = await D.sendWorkflowSignal({
+					store: e.store,
+					recorder: O,
+					target: t,
+					signalName: n,
+					payload: r
+				});
+				return await a.runPromise(D.completeSuspendingSignal({
+					store: e.store,
+					target: t,
+					signalName: n,
+					payload: r
+				})).catch(() => {}), i;
+			},
+			update: (t, n, r, i) => D.sendWorkflowUpdate({
+				store: e.store,
+				recorder: O,
+				target: t,
+				updateName: n,
+				payload: r,
+				...i === void 0 ? {} : { options: i }
+			}),
+			listRuns: (t) => b(e.store, t),
+			retry: (t, n) => Ae({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runPromise: (e) => a.runPromise(e)
+			}, t, n)
+		}) : void 0;
+	}
+	let Le = A.mergeAll(De.toLayer(C), Oe, ke), Re = ee(C, e.discovered.queries.map((e) => e.descriptor.name), f), Be = A.mergeAll(De.toLayer(Re), Oe, ke), N = e.observability, We = await qe({
+		...N && N.spanProcessors.length > 0 ? { extraSpanProcessors: N.spanProcessors } : {},
+		...N && N.metricReaders.length > 0 ? { extraMetricReaders: N.metricReaders } : {},
+		...N && Object.keys(N.resourceAttributes).length > 0 ? { resourceAttributes: N.resourceAttributes } : {},
+		...N && N.sampler !== void 0 ? { sampler: N.sampler } : {}
+	}), Ye = !1, Xe = e.store.ping ? () => e.store.ping().then(() => !0).catch(() => !1) : void 0, { server: Ze, shutdown: Qe } = Tt({
+		group: De,
+		handlersLayer: Le,
+		httpHandlersLayer: Be,
+		port: e.port ?? 4e3,
+		path: e.path ?? "/ws",
+		tracerLayer: We.layer,
+		healthCheck: {
+			isReady: () => Ye,
+			...Xe ? { ping: Xe } : {}
+		},
+		...Te.length > 0 ? { httpRoutes: Te } : {},
+		...e.getStore === void 0 ? {} : { getStore: e.getStore },
+		...oe.size > 0 ? { webhookRoutes: oe } : {},
+		...e.inspectRoute === void 0 ? {} : { inspectRoute: e.inspectRoute }
+	});
+	if (await Ge(Ze), (e.discovered.schedules?.length ?? 0) > 0) {
+		let t = (e.scheduleCoordination ?? "single") === "advisoryLock" ? nt(e.store, e.scheduleReplicaId ?? `pid-${process.pid}`) : wt;
+		o = await Et(e.discovered.schedules ?? [], {
+			store: e.store,
+			coordinator: t,
+			defaultTrigger: e.scheduleDefaultTrigger ?? "self",
+			replicaId: e.scheduleReplicaId ?? `pid-${process.pid}`,
+			armSelf: e.scheduleArmSelf ?? !0,
+			dormancy: e.dormancy ?? "always-on",
+			...e.dormancyTenantId === void 0 ? {} : { dormancyTenantId: e.dormancyTenantId },
+			buildContext: ({ traceId: t, scheduleName: n, subject: r }) => y({
+				subject: r,
+				traceId: t
+			}, e.store, void 0, `schedule:${n}`),
+			log: {
+				info: (e, t) => {
+					process.stdout.write(`[schedule] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+				},
+				warn: (e, t) => {
+					process.stderr.write(`[schedule] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+				},
+				error: (e, t) => {
+					process.stderr.write(`[schedule] ERROR ${e} ${t ? JSON.stringify(t) : ""}\n`);
+				},
+				debug: () => {}
+			},
+			...e.scheduleFireInterceptor === void 0 ? {} : { interceptFire: e.scheduleFireInterceptor },
+			...e.onScheduleRunEvent === void 0 ? {} : { onRunEvent: e.onScheduleRunEvent }
+		}), e.onSchedulerReady?.(o);
+	}
+	let $e = e.log ?? j({ scope: "voltro:serve" }), rt, it;
+	if ((e.discovered.subscribers?.length ?? 0) > 0 && (rt = de(e.discovered.subscribers ?? [], e.store, $e.child("subscribe"), e.schemaRegistry)), (e.discovered.reactions?.length ?? 0) > 0) {
+		let t = $e.child("reaction");
+		it = ve(e.discovered.reactions ?? [], e.store, {
+			runAct: async (n, r) => {
+				if (n.kind === "workflow") {
+					if (d === void 0) {
+						t.warn("reaction workflow act skipped — no workflow engine in this app", { workflow: n.workflow });
+						return;
+					}
+					let e = r.new ?? r.old ?? {};
+					await gt(d, {
+						traceId: `reaction:${n.workflow}`,
+						source: `reaction:${n.workflow}`
+					}).start(n.workflow, e);
+					return;
+				}
+				await _(n.agent, r, {
+					findAgentSend: (t) => e.discovered.actions.find((e) => e.descriptor.name === `${t}.send`),
+					runAction: (e, t, n) => Promise.resolve(he(e, t, n)),
+					makeSubject: (e) => It(e),
+					now: () => Date.now(),
+					log: t
+				});
+			},
+			checkBudget: async (n, r) => {
+				try {
+					let { requireAiBudget: t } = await import("@voltro/ai");
+					return (await k.runPromise(k.either(t(e.store, {
+						tenantId: n,
+						limitUsd: r
+					}))))._tag === "Right";
+				} catch (e) {
+					return t.warn("reaction budget check failed — refusing the act", { tenantId: n }, e), !1;
+				}
+			}
+		}, t);
+	}
+	let at;
+	return (e.discovered.aggregates?.length ?? 0) > 0 && (at = await ne({
+		discovered: e.discovered.aggregates ?? [],
+		store: e.store,
+		log: $e.child("aggregate"),
+		...e.analytics === void 0 ? {} : { analytics: e.analytics },
+		...e.aggregateStorage === void 0 ? {} : { storage: e.aggregateStorage },
+		...e.aggregateCoordinator === void 0 ? {} : { coordinator: e.aggregateCoordinator }
+	}), ue = A.succeed(M, at.registry)), Ye = !0, e.bootTiming?.mark("ready"), {
+		dispatcher: t,
+		server: Ze,
+		scheduler: o,
+		close: async () => {
+			Ye = !1, at?.detach(), it?.(), rt?.(), await o?.shutdown(), t.close(), await a?.dispose(), await new Promise((e) => Ze.close(() => e())), await Qe();
+		}
+	};
+}, $ = j({ scope: "voltro:serve" }), Mn = (e, t, n) => (e === "production" || e === "staging") && t !== "memory" && n !== "0", Nn = Fe, Pn = async (e) => {
+	let t = O(process.cwd());
+	if (Be(t)) {
+		let n;
+		try {
+			let e = await import(Le(t).href);
+			typeof e.runServe == "function" ? n = e.runServe : $.warn("serve bundle has no runServe export — using the standard serve path");
+		} catch (e) {
+			$.warn("serve bundle failed to load — using the standard serve path", {}, e);
+		}
+		if (n) return $.info("serve: booting from the precompiled serve bundle"), n(e);
+	}
+	return Fn(e);
+}, Fn = async (ee) => {
+	let p = Pe();
+	process.env.NODE_ENV || (process.env.NODE_ENV = "production");
+	try {
+		Gt();
+	} catch (e) {
+		throw mn(e instanceof Error ? e.message : String(e));
+	}
+	let m = process.cwd(), ne = Number(process.env.PORT ?? Nn(ee, "--port") ?? 4e3), g = await he(m);
+	xt(bt(g?.secrets)), await e({
+		rawEnv: g?.env,
+		appType: "api",
+		root: m,
+		log: $,
+		generateTypes: !1
+	}), p.mark("config");
+	let _ = (process.env.DB_DIALECT ?? g?.store ?? "memory").toLowerCase(), ce = (_ === "mariadb" || _ === "postgres" || _ === "mssql") && (process.env.CDC ?? "1") !== "0", le = _ === "mariadb" ? "mariadb" : _ === "mssql" ? "mssql" : void 0, de = Ne(m);
+	if (!i() && Be(de)) try {
+		let e = await import(Le(de).href);
+		if (e.modules) {
+			let t = {};
+			for (let [n, r] of Object.entries(e.modules)) t[Ie(m, n)] = r;
+			r(t), $.info("precompiled api bundle loaded", { modules: Object.keys(t).length });
+		}
+	} catch (e) {
+		$.warn("precompiled api bundle failed to load — falling back to source", {}, e);
+	}
+	let b = await be(m), S = await Oe(b, { cdc: ce && le !== void 0 });
+	{
+		let e = h(S.serverOnlyLeaks, re(process.env, "strict"), Qe, "`voltro serve`");
+		if (e.action === "fail") throw mn(e.message ?? "");
+		e.action === "warn" && $.warn(e.message ?? "");
+	}
+	let ve = b.filter((e) => je.test(e)), w = ve.length > 0 ? await ue(ve, $.child("webhooks")) : void 0, we = s({
+		mix: S.featureMix,
+		plugins: g?.plugins ?? [],
+		cdc: ce && le !== void 0,
+		...le ? { cdcDialect: le } : {}
+	}), Ae = g?.analytics !== void 0 && g.analytics.kind !== "noop" && _ !== "memory" ? (await n(_)).makeSqlLayer(T()) : void 0, E = await ie({
+		spec: g?.analytics,
+		sqlLayer: Ae,
+		log: $
+	}), O = (() => {
+		let e = new Set(S.tables.map((e) => e.tableName)), t = [...S.tables];
+		for (let n of [...we, ...E.tables]) e.has(n.tableName) || (e.add(n.tableName), t.push(n));
+		return t;
+	})();
+	for (let e of O) jt(e);
+	let Fe = (process.env.NODE_ENV ?? "").toLowerCase();
+	if (Mn(Fe, _, process.env.VOLTRO_AUTO_MIGRATE)) {
+		let e = (await n(_)).makeSqlLayer(T()), t = await k.runPromise(kt.SqlClient.pipe(k.flatMap((e) => Xt(e, O, {
+			appliedBy: `serve:${Fe}`,
+			environment: "prod",
+			dialectId: _
+		})), k.provide(e)));
+		t.kind === "prod-mismatch" && ($.error(Yt(t, _)), $.error("serve: refusing to boot — apply the schema first (voltro db apply in a pre-deploy step), or set VOLTRO_AUTO_MIGRATE=0 to bypass this check."), process.exit(1)), $.info(Yt(t, _));
+	}
+	let j = mt(O);
+	p.mark("discover");
+	let M = await _e(g, void 0), Ve = Dt(M, _);
+	for (let e of Te({
+		dialect: String(g?.store ?? process.env.DB_DIALECT ?? "postgres"),
+		changeStrategy: (process.env.CDC ?? "1") === "0" ? "inline" : "cdc",
+		dbUrl: process.env.DB_URL,
+		tables: S.tables.map((e) => ({
+			tableName: e.tableName,
+			isReactive: e.isReactive === !0
+		})),
+		querySources: S.queries.flatMap((e) => {
+			let t = e.descriptor.source;
+			return t === void 0 ? [] : typeof t == "string" ? [t] : [...t];
+		})
+	})) e.level === "warn" ? $.warn(e.message) : $.info(e.message);
+	g?.cache && !process.env.CACHE_BACKEND && (process.env.CACHE_BACKEND = g.cache), g?.cacheRedisUrl && !process.env.CACHE_REDIS_URL && (process.env.CACHE_REDIS_URL = g.cacheRedisUrl), g?.cacheRedisDriver && !process.env.CACHE_REDIS_DRIVER && (process.env.CACHE_REDIS_DRIVER = g.cacheRedisDriver), g?.cacheKeyPrefix && !process.env.CACHE_KEY_PREFIX && (process.env.CACHE_KEY_PREFIX = g.cacheKeyPrefix);
+	let { service: He, invalidationBus: Ue, snapshotCache: Ge, cache: P, backend: Ke, dispose: F } = await xe({ env: process.env });
+	$.info(`cache backend resolved: ${Ke}` + (Ke === "redis" ? ` (driver ${process.env.CACHE_REDIS_DRIVER ?? "resp"})` : " — in-process, not cross-instance")), M.onChange((e) => {
+		k.runFork(Ue.publish(e.table));
+	}), g?.kv && !process.env.KV_BACKEND && (process.env.KV_BACKEND = g.kv), g?.kvRedisUrl && !process.env.KV_REDIS_URL && (process.env.KV_REDIS_URL = g.kvRedisUrl), g?.kvKeyPrefix && !process.env.KV_KEY_PREFIX && (process.env.KV_KEY_PREFIX = g.kvKeyPrefix);
+	let { kv: qe, service: Je } = await ot({ store: M });
+	p.mark("store");
+	let et = We({
+		store: M,
+		sink: E.sink,
+		log: $
+	}), tt = pe({
+		store: M,
+		dialect: _
+	}), I = g?.plugins ?? [], L = process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, ct, lt;
+	_ !== "memory" && (ct = ze.make((await n(_)).makeSqlLayer(T())), lt = await ct.runPromise(kt.SqlClient));
+	let ut = st({
+		coordinator: [
+			"postgres",
+			"mariadb",
+			"mysql",
+			"mssql"
+		].includes(_) ? nt(M, L, $) : wt,
+		replicaId: L,
+		log: $
+	}), dt = [], ft = {
+		...lt ? { sql: lt } : {},
+		scheduleCoordinated: (e, t, n) => {
+			let r = ut(e, t, n);
+			return dt.push(r), r;
+		}
+	};
+	for (let e of I) e.bindDataStore?.(M, ft);
+	let pt = I.filter((e) => typeof e.onChangeEvent == "function");
+	if (pt.length > 0) {
+		let e = M.changeScope ?? "local";
+		M.onChange((t) => {
+			let n = y(t, e);
+			for (let e of pt) k.runFork(e.onChangeEvent(n).pipe(k.catchAllCause((t) => k.sync(() => $.warn(`plugin ${e.name} onChangeEvent failed`, { error: Re.pretty(t) })))));
+		});
+	}
+	let ht = me({
+		plugins: I,
+		appName: g?.name ?? "voltro-api",
+		appType: "api",
+		voltroVersion: process.env.npm_package_version ?? "0.0.0",
+		log: $
+	});
+	I.length && await ht.activate(), p.mark("plugins");
+	let gt = await ht.gatherObservability(), _t = await x(M, g, _, {
+		info: (e, t) => process.stdout.write(`[broadcast] ${e} ${t ? JSON.stringify(t) : ""}\n`),
+		warn: (e, t) => process.stderr.write(`[broadcast] ${e} ${t ? JSON.stringify(t) : ""}\n`),
+		debug: () => {}
+	}), R = g?.apiKeys, vt = (typeof R == "object" ? R.prefix : void 0) ?? "voltro_", yt = R ? Xe(M) : void 0, z = yt ? it({ flush: at(yt) }) : void 0;
+	z && process.once("exit", () => {
+		z.shutdown();
+	});
+	let St = yt ? rt(yt, {
+		prefix: vt,
+		...z ? { usage: z } : {}
+	}) : void 0, Ct = St ? [$e(St, { prefix: vt })] : [], Tt = Ce([...g?.auth?.strategies ?? [], ...Ct], Zt(g?.plugins ?? []), g?.auth?.anonymousTenantRequired ?? !1, g?.auth?.resolveScopes, () => Ve), Et = [...g?.restRoutes ?? [], ...St ? N(St, (typeof R == "object" ? R.managementPath : void 0) ?? "/v1/api-keys") : []], B = g?.idempotency, Ot = B ? {
+		store: Ze(M),
+		header: (typeof B == "object" ? B.header : void 0) ?? "Idempotency-Key",
+		ttlMs: (typeof B == "object" ? B.ttlMs : void 0) ?? 864e5
+	} : void 0, At = Et.length > 0 ? $t(Et, {
+		store: M,
+		resolveSubject: (e) => Tt({
+			headers: e,
+			clientId: -1
+		}),
+		...Ot ? { idempotency: Ot } : {}
+	}) : [], V = I.map((e) => e.services).filter((e) => e !== void 0), Mt = A.mergeAll(De({
+		analyticsLayer: E.layer,
+		cacheService: He,
+		kvService: Je,
+		pluginServices: V,
+		userLayers: g?.layers ?? []
+	}), ge(g?.http ?? {})), H = g?.scheduling ?? {}, Nt = H.trigger ?? "self", Pt = /* @__PURE__ */ new Set([
+		"postgres",
+		"mysql",
+		"mariadb",
+		"mssql"
+	]), U = H.coordination ?? (Pt.has(_) ? "advisoryLock" : "single"), W = U === "cluster" && Pt.has(_), Ft = W ? "cluster" : U === "advisoryLock" && Pt.has(_) ? "advisoryLock" : "single";
+	U === "cluster" && !W && $.warn("scheduling.coordination=cluster needs a sql-backed store except sqlite — falling back to single"), U === "advisoryLock" && !Pt.has(_) && $.warn("scheduling.coordination=advisoryLock needs a SQL store (the claim-row gate) — falling back to single");
+	let G, K = S.workflows.length > 0 || S.workflowWorkers.length > 0 || S.eventTriggers.length > 0 || (w?.outgoing.length ?? 0) > 0 || W, It;
+	if (K) {
+		if (_ === "mssql") {
+			let e = await fe(process.cwd());
+			e && $.warn(e);
+		}
+		let [{ WorkflowEngine: e }, { makeClusterCronLayer: t, workflowEngineLayer: r, resolveRunnerStorage: i }] = await Promise.all([import("@effect/workflow"), import("@voltro/workflow/cluster")]), a = W ? S.schedules.filter((e) => (e.trigger ?? Nt) === "self").map((e) => t({
+			name: e.name,
+			cron: Ye(e),
+			execute: async () => {
+				await G?.fireFromCluster(e.name);
+			}
+		})) : [];
+		It = _ === "memory" ? e.layerMemory : await (async () => {
+			let e = await n(_), t = i({ sqliteFamily: e.id === "sqlite" || e.id === "turso" });
+			return $.info(`workflow engine: cluster-${t}, dialect=${e.id}` + (t === "memory" ? " — single-process durable replay, no cross-pod shard handoff" + (e.id !== "sqlite" && e.id !== "turso" ? " (VOLTRO_WORKFLOW_RUNNER_STORAGE=memory: SqlRunnerStorage/cluster_runners + GET_LOCK skipped)" : "") : "")), r({
+				sqlClientLayer: e.makeSqlLayer(T()),
+				runnerStorage: t,
+				dialectId: e.id,
+				...process.env.VOLTRO_WORKFLOW_RUNNER_PORT ? { runnerListenPort: Number(process.env.VOLTRO_WORKFLOW_RUNNER_PORT) } : {},
+				...a.length > 0 ? { extraShardingLayers: a } : {}
+			});
+		})();
+	}
+	let Lt = Me(I, t()), q = b.filter((e) => /\.subscribe\.tsx?$/.test(e)), Rt = q.length > 0 ? await ae(q, $) : [], zt = b.filter((e) => /\.reaction\.tsx?$/.test(e)), Bt = zt.length > 0 ? await se(zt, $) : [], J = b.filter((e) => u.test(e)), Vt = J.length > 0 ? await D(J, $) : [], Y = b.filter((e) => /\.aggregate\.tsx?$/.test(e)), X = Y.length > 0 ? await v(Y, $) : [], Z = ye();
+	if (X.length > 0 && _ !== "memory") try {
+		Z = f((await n(_)).makeSqlLayer(T()));
+	} catch (e) {
+		$.warn("aggregate: SQL storage init failed — falling back to in-process", { err: String(e) });
+	}
+	let Ht = _ === "memory" ? wt : nt(M, `aggregate@${process.pid}`, $), Ut = [], Wt = [], Kt = b.filter((e) => l.test(e));
+	if (Kt.length > 0) {
+		let e = $.child("agent"), t = b.filter((e) => a.test(e));
+		t.length > 0 && await o(t, e);
+		let n = await c(Kt, e);
+		for (let e of n.agents) for (let t of te(e)) (t.kind === "action" ? Ut : Wt).push({
+			file: t.file,
+			descriptor: t.descriptor,
+			executor: t.executor
+		});
+		n.agents.length > 0 && e.info("synthesized agent routes", { agents: n.agents.map((e) => e.descriptor.name) });
+	}
+	p.mark("workflow");
+	let qt = await jn({
+		bootTiming: p,
+		discovered: {
+			queries: [...S.queries, ...Wt],
+			mutations: S.mutations,
+			actions: [...S.actions, ...Ut],
+			streams: S.streams,
+			workflows: S.workflows,
+			workflowWorkers: S.workflowWorkers,
+			eventTriggers: S.eventTriggers,
+			schedules: S.schedules,
+			subscribers: Rt,
+			outboxHandlers: Vt,
+			connections: S.connections,
+			reactions: Bt,
+			aggregates: X,
+			...w === void 0 ? {} : { webhooks: w }
+		},
+		log: $,
+		analytics: E.sink,
+		aggregateStorage: Z,
+		aggregateCoordinator: Ht,
+		store: M,
+		kv: qe,
+		cache: P,
+		snapshotCache: Ge,
+		schemaRegistry: j,
+		tenantScopedTables: S.tenantScopedTables,
+		softDeleteScopedTables: S.softDeleteScopedTables,
+		dataTransferSnapshot: Jt(O),
+		dataTransferDialect: _,
+		tenantIsolation: (process.env.VOLTRO_TENANT_ISOLATION ?? g?.tenancy?.isolation) === "namespace" ? "namespace" : "shared-schema",
+		resolveSubject: (e, t) => Tt({
+			headers: e,
+			clientId: t
+		}),
+		httpRoutes: [...I.flatMap((e) => e.httpRoutes ?? []), ...At],
+		getStore: () => Ve,
+		...Mt ? { baseLayer: Mt } : {},
+		...It === void 0 ? {} : { workflowEngineLayer: It },
+		scheduleDefaultTrigger: Nt,
+		scheduleCoordination: Ft,
+		scheduleArmSelf: !W,
+		dormancy: process.env.VOLTRO_DORMANCY === "sleep" || process.env.VOLTRO_DORMANCY === "always-on" ? process.env.VOLTRO_DORMANCY : g?.dormancy ?? "always-on",
+		scheduleReplicaId: process.env.HOSTNAME ?? `pid-${process.pid}`,
+		...Lt === void 0 ? {} : { scheduleFireInterceptor: Lt },
+		onSchedulerReady: (e) => {
+			G = e;
+		},
+		inspectRoute: { handle: (e, t, n, r) => d(e, {
+			kind: "api",
+			meta: {
+				name: g?.name ?? "voltro-api",
+				voltroVersion: Ee,
+				port: ne,
+				mode: "start",
+				store: _,
+				cdc: ce ? "on" : "off"
+			},
+			rpc: C(S, m),
+			workflows: ke(S, m),
+			inspectFireSchedule: async ({ name: e, trigger: t }) => {
+				if (!G) throw Error("scheduler not started — this app registers no self-triggered schedules (all schedules are trigger:'external', or there are none).");
+				return { runId: await G.fireNow(e, t) ?? null };
+			}
+		}, t, {
+			method: n,
+			...r === void 0 ? {} : { body: r }
+		}) ?? {
+			status: 404,
+			contentType: "application/json",
+			body: JSON.stringify({ error: "not an inspect route" })
+		} },
+		observability: gt,
+		port: ne,
+		...g?.transport?.wsPath ? { path: g.transport.wsPath } : {}
+	});
+	Se(oe([
+		S.queries,
+		S.mutations,
+		S.actions,
+		S.streams
+	]), (e) => {
+		$.warn(e);
+	}), $.info(`API listening on :${ne}`, {
+		dialect: _,
+		queries: S.queries.length,
+		mutations: S.mutations.length,
+		actions: S.actions.length,
+		streams: S.streams.length,
+		workflows: S.workflows.length,
+		workflowWorkers: S.workflowWorkers.length,
+		schedules: S.schedules.length,
+		scheduleCoordination: Ft
+	}), p.finish($);
+	let Qt = () => {
+		for (let e of dt) e.stop();
+		et.detach(), tt.stop(), F(), ct?.dispose(), setTimeout(() => process.exit(0), 1e4).unref?.(), Promise.resolve(ht.deactivate()).then(() => _t?.close()).then(() => E.dispose()).then(() => qt.close()).then(() => M.close?.()).then(() => process.exit(0)).catch((e) => {
+			console.error("serve: shutdown step failed, exiting anyway:", e), process.exit(0);
+		});
+	};
+	return process.on("SIGINT", Qt), process.on("SIGTERM", Qt), await new Promise(() => {}), 0;
+};
+//#endregion
+export { Pn as n, On as r, Fn as t };