@voltro/cli 0.20.2 → 0.22.0

package/dist/serveCommand-DEVTtnLy.js

@@ -0,0 +1,1161 @@
+import { at as e, t } from "./inspectMetrics-4AVPn6IS.js";
+import { s as n } from "./seedRunner-D6eu-u5U.js";
+import { r, t as i } from "./appModuleLoader-C9r9mxZt.js";
+import { f as a, m as o, n as s, p as c, u as l } from "./frameworkTableAssembly-sg41s14F.js";
+import { l as u } from "./fileConventions-CBNPZVOV.js";
+import { p as d } from "./inspect-_ldwsAwH.js";
+import { $ as ee, A as f, B as p, C as te, D as m, E as ne, F as re, G as ie, H as ae, I as h, K as oe, L as g, M as _, N as se, O as v, P as y, R as ce, S as le, T as ue, V as de, W as fe, _ as b, at as pe, b as me, c as he, et as ge, h as x, i as _e, it as S, j as ve, k as ye, lt as C, m as be, nt as w, o as T, ot as xe, q as E, r as Se, rt as Ce, st as we, t as Te, tt as Ee, u as De, ut as Oe, v as ke, w as Ae, x as D, y as je, z as Me } from "./dev-DeHVUxQx.js";
+import { l as O, r as k } from "./apiBuild-2zRxj2hJ.js";
+import { t as Ne } from "./bootTiming-BdyP9nYw.js";
+import { n as Pe } from "./cliArgs-qdZSElM3.js";
+import { join as Fe } from "node:path";
+import { pathToFileURL as Ie } from "node:url";
+import { Cause as Le, Effect as A, Layer as j, ManagedRuntime as Re } from "effect";
+import { createLogger as M } from "@voltro/logger";
+import { existsSync as ze } from "node:fs";
+import { AggregateRegistry as N, Dispatcher as Be, apiKeyManagementRoutes as Ve, applySoftDeleteScope as He, applyTenantScope as Ue, attachAnalyticsMirror as P, awaitServerListening as We, bindMutation as F, bindStream as Ge, bindSubscription as I, buildTracingLayer as Ke, cancelWakeup as qe, compileCron as Je, dataStoreApiKeyStore as Ye, dataStoreIdempotencyStore as Xe, formatServerOnlyLeaks as Ze, frameworkApiKeyStrategy as Qe, installPolicyGuardResolver as $e, loadResourceTuples as et, makeActionRunner as L, makeAdvisoryLockCoordinator as tt, makeApiKeyService as nt, makeApiKeyUsageBuffer as rt, makeApiKeyUsageFlusher as it, makeAsyncKv as at, makeCoordinatedScheduler as ot, makeEffectStoreLayer as st, makeLazyWorkflowFacade as ct, makeMutationRunner as lt, makeOneShotQueryRunner as ut, makeQueryDescriptorProducer as dt, makeQueryReauthorizer as ft, makeQuerySubscriber as pt, makeSchemaRegistry as mt, makeWorkflowFacade as ht, makeWorkflowFacadeWithCallerContext as gt, makeWorkflowLayers as _t, noopKv as R, onProcessShutdown as vt, recordSubscriptionDelivery as yt, registerWakeup as bt, resolveSecretsBackend as xt, runProvidedEffect as St, setSecretsBackend as Ct, setSystemStoreHandle as z, setTupleSource as wt, singleCoordinator as Tt, startRpcServer as Et, startScheduler as Dt, workflowToRpc as B, wrapStoreWithBootCodec as Ot } from "@voltro/runtime";
+import { RpcGroup as kt } from "@effect/rpc";
+import { SqlClient as At } from "@effect/sql";
+import { and as jt, ensureTableRegistered as Mt, eq as V, or as Nt } from "@voltro/database";
+import { appStorageProvider as H, fromNodeReadable as Pt, getObjectStream as Ft, putObjectStream as It, toNodeReadable as U } from "@voltro/plugin-storage";
+import { AuthMiddleware as W, ConnectionInfoMiddleware as G, actionToRpc as K, anonymousSubject as Lt, isWireReachable as Rt, mutationToRpc as zt, queryToRpc as q, streamToRpc as Bt, workflowCancelDescriptor as Vt, workflowDomainEventsQueryDescriptor as J, workflowEventDeliveriesQueryDescriptor as Ht, workflowResumeDescriptor as Ut, workflowRunEventsQueryDescriptor as Y, workflowRunQueryDescriptor as X, workflowRunStepsQueryDescriptor as Wt, workflowRunsQueryDescriptor as Z, workflowSignalDescriptor as Gt, workflowUpdateDescriptor as Kt } from "@voltro/protocol";
+import { assertProductionSessionSecret as qt } from "@voltro/protocol/session";
+import { createHash as Jt, timingSafeEqual as Yt } from "node:crypto";
+import { declaredSnapshot as Xt, describeOutcome as Zt, runPlannedMigrations as Qt } from "@voltro/database/sql";
+import { getAuthSessionStrategy as $t } from "@voltro/plugin-auth";
+import { collectPublicApiRoutes as en, restRoutesToHttpRoutes as tn } from "@voltro/protocol/rest";
+import { buildDeliverWebhookExecute as nn, buildWebhooksService as rn, defaultIncomingPath as an, deliverWebhookWorkflow as on, mountIncomingWebhook as sn } from "@voltro/plugin-webhooks";
+import { packBundle as cn, runExport as ln, runImport as un, storageBlobSink as dn, storageRefsBlobSource as fn, unpackBundle as pn, unpackBundleToDir as mn } from "@voltro/data-transfer";
+//#region src/bootRefusal.ts
+var hn = "VoltroBootRefusal", gn = (e) => {
+	let t = Error(e);
+	return t.name = hn, t;
+}, _n = "/_voltro/admin/import", vn = "/_voltro/admin/export", Q = (e, t) => ({
+	status: e,
+	contentType: "application/json; charset=utf-8",
+	body: JSON.stringify(t)
+}), yn = (e) => {
+	let t = e.authorization ?? e.Authorization, n = t ? /^Bearer\s+(.+)$/i.exec(t) : null;
+	return n ? n[1] : null;
+}, bn = (e, t) => Yt(Jt("sha256").update(e).digest(), Jt("sha256").update(t).digest()), xn = (e, t) => {
+	if (e.method.toUpperCase() !== "POST") return Q(405, { error: "method not allowed" });
+	if (!t || t.length < 16) return Q(503, { error: "data transfer misconfigured (no/weak secret)" });
+	let n = yn(e.headers);
+	return !n || !bn(n, t) ? Q(401, { error: "unauthorized" }) : null;
+}, Sn = M({ scope: "voltro:admin-import" }), Cn = "VBUNDLE2", wn = async function* (e) {
+	yield e;
+}, Tn = (e) => async (t) => {
+	let n = xn(t, e.secret);
+	if (n) return n;
+	let r = t.headers["x-import-mode"], i = t.headers["x-import-on-conflict"], a = t.headers["x-import-atomic"] === "1" || t.headers["x-import-atomic"] === "true", o = t.headers["x-import-force"] === "1" || t.headers["x-import-force"] === "true", s = t.rawBody.byteLength >= 8 && Buffer.from(t.rawBody.subarray(0, 8)).toString("latin1") === Cn, c, l;
+	if (s) c = wn(t.rawBody), l = "upload";
+	else {
+		let n;
+		try {
+			n = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
+		} catch {
+			return Q(400, { error: "body must be a packed bundle archive or { bundleKey } JSON" });
+		}
+		if (typeof n.bundleKey != "string" || !n.bundleKey) return Q(400, { error: "body.bundleKey (string) is required for the storage transport" });
+		if (!e.openArchive) return Q(501, { error: "storage transport not configured on this instance" });
+		c = e.openArchive(n.bundleKey), l = "storage";
+	}
+	let u = await import("node:os"), d = await import("node:fs/promises"), ee = await import("node:path"), f = await d.mkdtemp(ee.join(u.tmpdir(), "voltro-admin-import-"));
+	try {
+		e.assetSink ? await pn(c, {
+			dir: f,
+			blobs: e.assetSink
+		}) : await mn(c, f);
+		let t = await A.runPromiseExit(un({
+			store: e.store,
+			bundleDir: f,
+			...r ? { mode: r } : {},
+			...i ? { onConflict: i } : {},
+			...a ? { atomic: a } : {},
+			...e.snapshot ? { targetSnapshot: e.snapshot } : {},
+			force: o,
+			onWarn: (e) => Sn.warn("admin.import", { message: e }),
+			...e.assetSink ? { assetsAlreadyRestored: !0 } : {}
+		}));
+		if (t._tag === "Failure") {
+			let e = t.cause._tag === "Fail" ? t.cause.error : void 0;
+			if (e && e._tag === "SchemaDriftError") {
+				let t = e;
+				return Sn.warn("admin.import refused (schema drift)", {
+					transport: l,
+					bundle: t.bundleFingerprint.slice(0, 16),
+					target: t.targetFingerprint.slice(0, 16)
+				}), Q(409, {
+					error: "schema drift",
+					bundleFingerprint: t.bundleFingerprint,
+					targetFingerprint: t.targetFingerprint,
+					diff: t.diff,
+					hint: "re-export against the current schema, or resend with x-import-force: 1"
+				});
+			}
+			throw Error(String(e?.message ?? e ?? "import failed"));
+		}
+		let n = t.value, s = n.tables.reduce((e, t) => e + t.rowCount, 0);
+		return Sn.info("admin.import", {
+			transport: l,
+			tables: n.tables.length,
+			rows: s,
+			mode: r ?? "upsert",
+			atomic: a
+		}), Q(200, {
+			tables: n.tables.length,
+			rows: s,
+			transport: l
+		});
+	} catch (e) {
+		return Sn.warn("admin.import failed", {
+			transport: l,
+			error: e?.message ?? String(e)
+		}), Q(500, {
+			error: "import failed",
+			message: e?.message ?? String(e)
+		});
+	} finally {
+		await d.rm(f, {
+			recursive: !0,
+			force: !0
+		});
+	}
+}, En = M({ scope: "voltro:admin-export" }), Dn = async (e) => {
+	let t = [];
+	for await (let n of e) t.push(Buffer.from(n));
+	return new Uint8Array(Buffer.concat(t));
+}, On = (e) => typeof e.tenant == "string" && e.tenant ? {
+	kind: "tenant",
+	tenantId: e.tenant
+} : Array.isArray(e.tables) && e.tables.length ? {
+	kind: "tables",
+	tables: e.tables.filter((e) => typeof e == "string")
+} : { kind: "all" }, kn = (e) => async (t) => {
+	let n = xn(t, e.secret);
+	if (n) return n;
+	let r;
+	try {
+		r = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
+	} catch {
+		return Q(400, { error: "body must be JSON: { profile?, tenant?, tables?, consistency?, compression?, bundleKey? }" });
+	}
+	let i = {};
+	if (typeof r.profile == "string" && r.profile) {
+		if (!e.loadProfile) return Q(501, { error: "server-side profiles not configured on this instance" });
+		try {
+			i = await e.loadProfile(r.profile);
+		} catch (e) {
+			return Q(400, {
+				error: `profile '${r.profile}' could not be loaded`,
+				message: e?.message ?? String(e)
+			});
+		}
+	}
+	let a = r.consistency === "snapshot" ? "snapshot" : i.consistency ?? "live", o = (typeof r.compression == "string" ? r.compression : void 0) ?? i.compression, s = i.scope ?? On(r), c = typeof r.bundleKey == "string" && r.bundleKey.length > 0, l = r.assets === !0 && e.assetSource ? { blobs: e.assetSource } : {}, u = await import("node:os"), d = await import("node:fs/promises"), ee = await import("node:path"), f = await d.mkdtemp(ee.join(u.tmpdir(), "voltro-admin-export-"));
+	try {
+		let t = await A.runPromise(ln({
+			store: e.store,
+			snapshot: e.snapshot,
+			dialect: e.dialect,
+			outDir: f,
+			...i.subset ? { subset: i.subset } : {
+				scope: s,
+				...e.tenantTables && e.tenantTables.length > 0 ? { tenantTables: e.tenantTables } : {}
+			},
+			consistency: a,
+			...o ? { compression: o } : {},
+			...i.masking ? { masking: i.masking } : {}
+		})), n = t.tables.reduce((e, t) => e + t.rowCount, 0), u = t.masking?.transformed.length ?? 0;
+		if (c) {
+			if (!e.putArchive) return Q(501, { error: "storage transport not configured on this instance" });
+			let i = r.bundleKey;
+			return await e.putArchive(i, () => cn({
+				dir: f,
+				...l
+			})), En.info("admin.export", {
+				transport: "storage",
+				tables: t.tables.length,
+				rows: n,
+				masked: u,
+				bundleKey: i
+			}), Q(200, {
+				bundleKey: i,
+				tables: t.tables.length,
+				rows: n,
+				masked: u,
+				transport: "storage"
+			});
+		}
+		let d = await Dn(cn({
+			dir: f,
+			...l
+		}));
+		return En.info("admin.export", {
+			transport: "download",
+			tables: t.tables.length,
+			rows: n,
+			masked: u,
+			bytes: d.byteLength
+		}), {
+			status: 200,
+			contentType: "application/octet-stream",
+			body: d,
+			headers: {
+				"x-export-tables": String(t.tables.length),
+				"x-export-rows": String(n),
+				"x-export-masked": String(u)
+			}
+		};
+	} catch (e) {
+		return En.warn("admin.export failed", { error: e?.message ?? String(e) }), Q(500, {
+			error: "export failed",
+			message: e?.message ?? String(e)
+		});
+	} finally {
+		await d.rm(f, {
+			recursive: !0,
+			force: !0
+		});
+	}
+}, An = async (e) => {
+	let { resolve: t } = await import("node:path"), { existsSync: n } = await import("node:fs"), r = [
+		e,
+		`${e}.profile.ts`,
+		`data-profiles/${e}.ts`,
+		`data-profiles/${e}.profile.ts`
+	].map((e) => t(process.cwd(), e)), i = r.find((e) => n(e));
+	if (!i) throw Error(`data profile '${e}' not found (looked for: ${r.join(", ")})`);
+	let a = await import(i), o = a.default ?? a.profile;
+	if (!o) throw Error(`data profile '${i}' has no default export`);
+	return o;
+}, jn = (e, t, n = {}) => (async function* () {
+	let r = await U((await A.runPromise(Ft(e, t).pipe(A.timeout(n.openTimeout ?? "30 seconds")))).stream), i = n.stallMs ?? 12e4, a, o = () => {
+		a && clearTimeout(a), a = setTimeout(() => r.destroy(/* @__PURE__ */ Error(`storage read stalled for ${i}ms reading '${t}'`)), i);
+	};
+	try {
+		o();
+		for await (let e of r) o(), yield e instanceof Uint8Array ? e : new Uint8Array(e);
+	} finally {
+		a && clearTimeout(a), r.destroy();
+	}
+})(), Mn = {
+	get: async () => void 0,
+	set: async () => {},
+	setWithTags: async () => {},
+	remove: async () => !1,
+	has: async () => !1,
+	clear: async () => {},
+	invalidateTag: async () => 0,
+	wrap: async (e, t, n) => n()
+}, Nn = async (e) => {
+	z({
+		dataStore: e.store,
+		schemaRegistry: e.schemaRegistry
+	});
+	let t = new Be({
+		store: e.store,
+		...e.snapshotCache ? { cache: e.snapshotCache } : {},
+		recordDelivery: (e) => yt({
+			label: e.label,
+			kind: e.kind,
+			durationMs: e.durationMs,
+			rowCount: e.rowCount
+		})
+	}), n = e.cache ?? Mn, r = e.kv ?? R, i, a, o, s = /* @__PURE__ */ new Map(), c = () => `wfctx_${globalThis.crypto?.randomUUID?.() ?? `${Date.now().toString(36)}${Math.random().toString(36).slice(2)}`}`, l = async (t, n, r) => {
+		let i = {
+			...r,
+			source: r.source ?? `workflow:${t}`
+		};
+		s.set(n, i);
+		try {
+			let r = await e.store.query({
+				table: "_voltro_workflow_start_contexts",
+				order: [],
+				predicate: V("executionId", n),
+				projection: ["id"],
+				skip: void 0,
+				take: 1
+			}), a = {
+				workflowName: t,
+				executionId: n,
+				subject: i.subject ?? null,
+				traceId: i.traceId ?? null,
+				source: i.source ?? null,
+				parentExecutionId: i.parentExecutionId ?? null,
+				parentClosePolicy: i.parentClosePolicy ?? null,
+				createdAt: /* @__PURE__ */ new Date()
+			};
+			r[0] === void 0 ? await e.store.insert("_voltro_workflow_start_contexts", {
+				id: c(),
+				...a
+			}) : await e.store.update("_voltro_workflow_start_contexts", r[0].id, a);
+		} catch (e) {
+			process.stderr.write(`[workflow] failed to persist start context for ${t}/${n}: ${e?.message ?? String(e)}\n`);
+		}
+	}, u = async (t, n) => {
+		let r = s.get(n);
+		if (r !== void 0) return r;
+		try {
+			let t = (await e.store.query({
+				table: "_voltro_workflow_start_contexts",
+				order: [],
+				predicate: V("executionId", n),
+				projection: void 0,
+				skip: void 0,
+				take: 1
+			}))[0];
+			if (t === void 0) return;
+			let r = {
+				...t.subject === null ? {} : { subject: t.subject },
+				...t.traceId === null ? {} : { traceId: t.traceId },
+				...t.source === null ? {} : { source: t.source },
+				...t.parentExecutionId === null ? {} : { parentExecutionId: t.parentExecutionId },
+				...t.parentClosePolicy === null ? {} : { parentClosePolicy: t.parentClosePolicy }
+			};
+			return s.set(n, r), r;
+		} catch (e) {
+			process.stderr.write(`[workflow] failed to load start context for ${n}: ${e?.message ?? String(e)}\n`);
+			return;
+		}
+	}, d = (e.discovered.workflows?.length ?? 0) > 0 ? ct(() => i) : void 0, f = (e.discovered.workflows?.length ?? 0) > 0 || (e.discovered.eventTriggers?.length ?? 0) > 0, te = f || (e.discovered.workflowWorkers?.length ?? 0) > 0 || e.scheduleCoordination === "cluster", re = e.tenantIsolation === "namespace", ie = (e.log ?? M({ scope: "voltro:serve" })).child("webhooks"), ae, h = e.discovered.webhooks;
+	if (h && h.outgoing.length > 0 && e.workflowEngineLayer !== void 0) {
+		let t = e.workflowEngineLayer, i = S({
+			store: e.store,
+			schemaRegistry: e.schemaRegistry,
+			cache: n,
+			kv: r
+		}), a = h.outgoing.map((e) => e.descriptor);
+		ae = rn(i, async (e) => {
+			let n = on.execute(e).pipe(A.provide(on.toLayer(nn(i, { events: a })).pipe(j.provideMerge(t))));
+			A.runPromise(n).catch((t) => {
+				ie.error("deliverWebhook workflow crashed", {
+					deliveryId: e.deliveryId,
+					targetId: e.targetId
+				}, t);
+			});
+		}, { events: a });
+	}
+	let oe = /* @__PURE__ */ new Map();
+	if (h) for (let e of h.incoming) {
+		let t = e.descriptor.path ?? an(e.descriptor.id), n = `VOLTRO_WEBHOOK_SECRET_${e.descriptor.id.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`, r = sn(e.descriptor, {
+			resolveSecret: async () => process.env[n] ?? null,
+			resolveWorkflows: () => d === void 0 ? void 0 : gt(d, {
+				traceId: `incoming:${e.descriptor.id}`,
+				source: `incoming:${e.descriptor.id}`
+			}),
+			log: (e) => {
+				let t = {
+					webhookId: e.webhookId,
+					status: e.status,
+					signatureOk: String(e.signatureOk),
+					idempotency: e.idempotency,
+					durationMs: e.durationMs
+				};
+				e.status >= 500 ? ie.error("incoming delivery failed", t) : e.status >= 400 ? ie.warn("incoming delivery rejected", t) : ie.info("incoming delivery handled", t);
+			}
+		});
+		oe.set(t, { handle: r });
+	}
+	$e(), wt((t) => et(e.store, t.subjectId, t.resourceType, t.resourceId));
+	let se = (e.discovered.outboxHandlers?.length ?? 0) > 0 ? p({
+		handlers: e.discovered.outboxHandlers ?? [],
+		store: e.store,
+		log: (e.log ?? M({ scope: "voltro:serve" })).child("outbox")
+	}) : void 0, v = ce({
+		definitions: (e.discovered.connections ?? []).map((e) => e.definition),
+		store: e.store,
+		publicUrl: g(e.port ?? 4e3),
+		log: (e.log ?? M({ scope: "voltro:serve" })).child("connections")
+	}), y = Ce({
+		store: e.store,
+		schemaRegistry: e.schemaRegistry,
+		cache: n,
+		kv: r,
+		...ae === void 0 ? {} : { webhooksService: ae },
+		...d === void 0 ? {} : { workflowsProxy: d },
+		eventTriggers: e.discovered.eventTriggers ?? [],
+		namespaceIsolationOn: re,
+		...se === void 0 ? {} : { outbox: { nudge: se.nudge } },
+		...v.active ? { connections: { registry: v.registry } } : {}
+	}), ue = j.succeed(N, m), fe = (t, n) => {
+		let r = t.pipe(A.provide(st(n)));
+		return St((e.baseLayer ? r.pipe(A.provide(e.baseLayer)) : r).pipe(A.provide(ue)));
+	}, pe = lt({
+		store: e.store,
+		buildContext: (e, t, n) => y(e, t, n),
+		runEffect: fe,
+		undoCapture: le()
+	}), me = D(), he = L({
+		buildContext: (e) => y(e),
+		runEffect: fe
+	}), ge = {
+		buildContext: (e) => y(e),
+		finalize: (t, n) => He(Ue(t, e.tenantScopedTables, n.subject.tenantId), e.softDeleteScopedTables),
+		provideEffect: (e, t) => e.pipe(A.provide(st(t)))
+	}, x = dt(ge), _e = ut({
+		...ge,
+		queryRows: (t) => e.store.query(t)
+	}), ye = pt({
+		...ge,
+		subscribeDescriptor: (e, n, r) => t.subscribe(e, n, r),
+		subscribeComputed: (e, n, r) => t.subscribeComputed(e, n, r)
+	}), C = {};
+	for (let n of [
+		...e.discovered.queries,
+		...me.queries,
+		...v.queries
+	]) C[n.descriptor.name] = (e) => I(x(n, e), t, `subscription.${n.descriptor.name}`, void 0, void 0, ft(n, e));
+	for (let t of [
+		...e.discovered.mutations,
+		...me.mutations,
+		...v.mutations
+	]) C[t.descriptor.name] = (e) => F(async (e, n) => pe(t, e, n), e, `mutation.${t.descriptor.name}`);
+	for (let t of [...e.discovered.actions, ...v.actions]) C[t.descriptor.name] = (e) => F(async (e, n) => he(t, e, n), e, `action.${t.descriptor.name}`);
+	let be = () => `public-${Math.random().toString(36).slice(2, 10)}`, T = [
+		...e.discovered.queries.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => _e(e, t, {
+				subject: n.subject,
+				traceId: be()
+			}),
+			subscribe: (t, n, r) => ye(e, t, {
+				subject: n.subject,
+				traceId: be()
+			}, r)
+		})),
+		...e.discovered.mutations.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => pe(e, t, {
+				subject: n.subject,
+				traceId: be()
+			})
+		})),
+		...e.discovered.actions.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => he(e, t, {
+				subject: n.subject,
+				traceId: be()
+			})
+		}))
+	], xe = T.length > 0 ? tn(en(T), {
+		store: e.store,
+		resolveSubject: (t) => e.resolveSubject(t, -1)
+	}) : [], E = e.dataTransferSecret ?? process.env.VOLTRO_DATA_TRANSFER_SECRET, Se = E && E.length >= 16 ? [{
+		method: "POST",
+		path: _n,
+		handle: Tn({
+			secret: E,
+			store: e.store,
+			...e.dataTransferSnapshot ? { snapshot: e.dataTransferSnapshot } : {},
+			assetSink: dn(H()),
+			openArchive: (e) => jn(H(), e)
+		})
+	}, {
+		method: "POST",
+		path: vn,
+		handle: kn({
+			secret: E,
+			store: e.store,
+			snapshot: e.dataTransferSnapshot ?? { tables: [] },
+			dialect: e.dataTransferDialect ?? "memory",
+			tenantTables: [...e.tenantScopedTables],
+			loadProfile: An,
+			assetSource: fn(H(), e.store),
+			putArchive: async (e, t) => {
+				let { Readable: n } = await import("node:stream"), r = H(), i = Pt("storage", () => n.from(t()));
+				await A.runPromise(It(r, e, i, { contentType: "application/octet-stream" }));
+			}
+		})
+	}] : [], we = [
+		...e.httpRoutes ?? [],
+		...xe,
+		...Se,
+		...v.httpRoutes
+	];
+	for (let t of e.discovered.streams ?? []) C[t.descriptor.name] = (n) => Ge((r) => {
+		let i = y(r), a = t.executor(n, i);
+		if (A.isEffect(a)) {
+			let t = a.pipe(A.provide(st(i.store)));
+			return (e.baseLayer ? t.pipe(A.provide(e.baseLayer)) : t).pipe(A.provide(ue));
+		}
+		return typeof a == "object" && a && typeof a.then == "function" ? A.promise(() => a) : a;
+	}, `stream.${t.descriptor.name}`);
+	for (let t of e.discovered.workflows ?? []) C[t.definition.name] = (e) => F(async (e, n) => {
+		let r = n;
+		return gt(d, {
+			subject: r.subject,
+			traceId: r.traceId,
+			source: "workflow-rpc"
+		}).start(t.definition.name, e);
+	}, e, `workflow.${t.definition.name}`);
+	f && (C[X.name] = (e) => I(x({
+		descriptor: X,
+		executor: (e) => {
+			let t = e.id;
+			return {
+				table: "_voltro_workflow_runs",
+				order: [{
+					column: "startedAt",
+					direction: "desc"
+				}],
+				predicate: Nt(V("id", t), V("executionId", t)),
+				take: 1,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${X.name}`), C[Z.name] = (e) => I(x({
+		descriptor: Z,
+		executor: (e) => {
+			let t = e, n = [...t.tag === void 0 ? [] : [V("tag", t.tag)], ...t.status === void 0 ? [] : [V("status", t.status)]], r = Number.isFinite(t.limit) && t.limit !== void 0 ? Math.min(Math.max(Math.floor(t.limit), 1), 500) : 100;
+			return {
+				table: "_voltro_workflow_runs",
+				order: [{
+					column: "startedAt",
+					direction: "desc"
+				}],
+				predicate: n.length === 0 ? void 0 : n.length === 1 ? n[0] : jt(...n),
+				take: r,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${Z.name}`), C[Wt.name] = (e) => I(x({
+		descriptor: Wt,
+		executor: (e) => {
+			let t = e.runId;
+			return {
+				table: "_voltro_workflow_run_steps",
+				order: [{
+					column: "startedAt",
+					direction: "asc"
+				}],
+				predicate: V("runId", t),
+				take: 1e3,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${Wt.name}`), C[Y.name] = (e) => I(x({
+		descriptor: Y,
+		executor: (e) => {
+			let t = e.runId;
+			return {
+				table: "_voltro_workflow_run_events",
+				order: [{
+					column: "occurredAt",
+					direction: "asc"
+				}],
+				predicate: V("runId", t),
+				take: 1e3,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${Y.name}`), C[J.name] = (e) => I(x({
+		descriptor: J,
+		executor: (e) => {
+			let t = e;
+			return {
+				table: "_voltro_workflow_events",
+				order: [{
+					column: "occurredAt",
+					direction: "desc"
+				}],
+				predicate: t.name === void 0 ? void 0 : V("name", t.name),
+				take: Math.max(1, Math.min(500, t.limit ?? 100)),
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${J.name}`), C[Ht.name] = (e) => I(x({
+		descriptor: Ht,
+		executor: (e) => {
+			let t = e.eventId;
+			return {
+				table: "_voltro_workflow_event_deliveries",
+				order: [{
+					column: "createdAt",
+					direction: "asc"
+				}],
+				predicate: V("eventId", t),
+				take: 500,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${Ht.name}`), C[Vt.name] = (t) => F(async (t, n) => {
+		let r = t;
+		return await w(e.store, n.subject, { executionId: r.executionId }), await d.cancel(r.workflowName, r.executionId), await Pe(r.workflowName, r.executionId, "workflow.cancel"), { ok: !0 };
+	}, t, `action.${Vt.name}`), C[Ut.name] = (t) => F(async (t, n) => {
+		let r = t;
+		return await w(e.store, n.subject, { executionId: r.executionId }), await d.resume(r.workflowName, r.executionId), { ok: !0 };
+	}, t, `action.${Ut.name}`), C[Gt.name] = (t) => F(async (t, n) => {
+		let r = t;
+		return await w(e.store, n.subject, { id: r.id }), d.signal({ id: r.id }, r.signalName, r.payload);
+	}, t, `action.${Gt.name}`), C[Kt.name] = (t) => F(async (t, n) => {
+		let r = t;
+		return await w(e.store, n.subject, { id: r.id }), d.update({ id: r.id }, r.updateName, r.payload, r.timeoutMs === void 0 ? void 0 : { timeoutMs: r.timeoutMs });
+	}, t, `action.${Kt.name}`));
+	let Te = (e) => e.filter((e) => Rt(e.descriptor)), Ee = [
+		...Te(e.discovered.queries).map((e) => q(e.descriptor)),
+		...Te(e.discovered.mutations).map((e) => zt(e.descriptor)),
+		...Te(e.discovered.actions).map((e) => K(e.descriptor)),
+		...me.queries.map((e) => q(e.descriptor)),
+		...me.mutations.map((e) => zt(e.descriptor)),
+		...v.queries.map((e) => q(e.descriptor)),
+		...v.mutations.map((e) => zt(e.descriptor)),
+		...v.actions.map((e) => K(e.descriptor)),
+		...(e.discovered.streams ?? []).map((e) => Bt(e.descriptor)),
+		...(e.discovered.workflows ?? []).map((e) => B(e.definition)),
+		...f ? [
+			q(X),
+			q(Z),
+			q(Wt),
+			q(Y),
+			q(J),
+			q(Ht),
+			K(Vt),
+			K(Ut),
+			K(Gt),
+			K(Kt)
+		] : []
+	], De = kt.make(...Ee).middleware(W).middleware(G), Oe = j.succeed(W, W.of(({ headers: t, clientId: n }) => A.promise(() => e.resolveSubject(t, n)))), Ae = j.succeed(G, G.of(({ clientId: e }) => A.succeed({ clientId: e }))), je = e.dormancyTenantId ?? "default", Me = e.dormancy === "sleep" ? {
+		register: (t, n, r) => bt(e.store, {
+			tenantId: r ?? je,
+			kind: "workflow",
+			refId: t,
+			wakeAt: n
+		}),
+		cancel: (t, n) => qe(e.store, {
+			tenantId: n ?? je,
+			kind: "workflow",
+			refId: t
+		}).then(() => {})
+	} : void 0, O = te ? await import("@voltro/workflow") : void 0, k = O?.makeWorkflowRunRecorder({
+		store: e.store,
+		...Me === void 0 ? {} : { wakeups: Me }
+	}), Ne = async (t, n) => {
+		await O.closeWorkflowChildrenForParent({
+			store: e.store,
+			parentExecutionId: t,
+			parentStatus: n,
+			recorder: k,
+			log: { warn: (e, t) => {
+				process.stderr.write(`[workflow] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+			} },
+			interruptChild: async (t, n) => {
+				let r = (e.discovered.workflows ?? []).find((e) => e.definition.name === t);
+				if (!r) throw Error(`Unknown child workflow: ${t}`);
+				if (!a) throw Error("Workflow runtime is not ready");
+				await a.runPromise(r.definition.interrupt(n));
+			}
+		});
+	}, Pe = async (t, n, r) => {
+		let i = (await e.store.query({
+			table: "_voltro_workflow_runs",
+			order: [],
+			predicate: V("executionId", n),
+			projection: void 0,
+			skip: void 0,
+			take: 1
+		}))[0];
+		if (i === void 0) return;
+		let a = await e.store.update("_voltro_workflow_runs", i.id, {
+			status: "cancelled",
+			cancelled: !0,
+			completedAt: /* @__PURE__ */ new Date()
+		}), o = i.subject?.tenantId ?? void 0;
+		a && await k.recordEvent({
+			runId: i.id,
+			eventType: "run-cancelled",
+			payload: {
+				reason: r,
+				workflowName: t,
+				executionId: n,
+				...o == null ? {} : { tenantId: o }
+			}
+		}), a && await Ne(n, "cancelled");
+	}, Fe = [..._t(e.discovered.workflows ?? [], {
+		buildContext: (t, n) => e.buildContextForWorkflow?.(t, n) ?? y({
+			subject: t.subject,
+			traceId: t.traceId
+		}, e.store, void 0, `workflow:${n.workflowName}`, { parentExecutionId: n.executionId }),
+		resolveStartContext: u
+	}, (t, n, r) => {
+		let i = O.getWorkflowVersionMetadata(t.definition);
+		return O.wrapWorkflowExecuteWithRunRecording({
+			name: t.definition.name,
+			store: e.store,
+			subject: r.subject,
+			source: r.source ?? null,
+			traceId: r.traceId,
+			workflowVersion: i.version,
+			workflowCompatibleVersions: i.compatibleWith,
+			workflowPatches: i.patches,
+			parentExecutionId: r?.parentExecutionId ?? null,
+			parentClosePolicy: r?.parentClosePolicy ?? null,
+			onParentClose: ({ executionId: e, status: t }) => Ne(e, t),
+			recorder: k
+		}, n);
+	}), ...e.discovered.workflowWorkers ?? []], Ie = Fe.length > 0 ? j.mergeAll(...Fe) : j.empty;
+	if (((e.discovered.workflows?.length ?? 0) > 0 || (e.discovered.workflowWorkers?.length ?? 0) > 0 || e.scheduleCoordination === "cluster") && e.workflowEngineLayer !== void 0) {
+		let t = Ie.pipe(j.provideMerge(e.workflowEngineLayer));
+		a = Re.make(e.baseLayer === void 0 ? t : t.pipe(j.provideMerge(e.baseLayer))), await a.runPromise(A.void), i = (e.discovered.workflows?.length ?? 0) > 0 ? ht({
+			workflows: e.discovered.workflows ?? [],
+			runEffect: (e) => a.runPromise(e),
+			rememberStartContext: l,
+			signal: async (t, n, r) => {
+				let i = await O.sendWorkflowSignal({
+					store: e.store,
+					recorder: k,
+					target: t,
+					signalName: n,
+					payload: r
+				});
+				return await a.runPromise(O.completeSuspendingSignal({
+					store: e.store,
+					target: t,
+					signalName: n,
+					payload: r
+				})).catch(() => {}), i;
+			},
+			update: (t, n, r, i) => O.sendWorkflowUpdate({
+				store: e.store,
+				recorder: k,
+				target: t,
+				updateName: n,
+				payload: r,
+				...i === void 0 ? {} : { options: i }
+			}),
+			listRuns: (t) => b(e.store, t),
+			retry: (t, n) => ke({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runPromise: (e) => a.runPromise(e)
+			}, t, n)
+		}) : void 0;
+	}
+	let Le = j.mergeAll(De.toLayer(C), Oe, Ae), ze = ee(C, e.discovered.queries.map((e) => e.descriptor.name), f), Ve = j.mergeAll(De.toLayer(ze), Oe, Ae), P = e.observability, Je = await Ke({
+		...P && P.spanProcessors.length > 0 ? { extraSpanProcessors: P.spanProcessors } : {},
+		...P && P.metricReaders.length > 0 ? { extraMetricReaders: P.metricReaders } : {},
+		...P && Object.keys(P.resourceAttributes).length > 0 ? { resourceAttributes: P.resourceAttributes } : {},
+		...P && P.sampler !== void 0 ? { sampler: P.sampler } : {}
+	}), Ye = !1, Xe = e.store.ping ? () => e.store.ping().then(() => !0).catch(() => !1) : void 0, { server: Ze, shutdown: Qe } = Et({
+		group: De,
+		handlersLayer: Le,
+		httpHandlersLayer: Ve,
+		port: e.port ?? 4e3,
+		path: e.path ?? "/ws",
+		tracerLayer: Je.layer,
+		healthCheck: {
+			isReady: () => Ye,
+			...Xe ? { ping: Xe } : {}
+		},
+		...we.length > 0 ? { httpRoutes: we } : {},
+		...e.getStore === void 0 ? {} : { getStore: e.getStore },
+		...oe.size > 0 ? { webhookRoutes: oe } : {},
+		...e.inspectRoute === void 0 ? {} : { inspectRoute: e.inspectRoute }
+	});
+	if (await We(Ze), (e.discovered.schedules?.length ?? 0) > 0) {
+		let t = (e.scheduleCoordination ?? "single") === "advisoryLock" ? tt(e.store, e.scheduleReplicaId ?? `pid-${process.pid}`) : Tt;
+		o = await Dt(e.discovered.schedules ?? [], {
+			store: e.store,
+			coordinator: t,
+			defaultTrigger: e.scheduleDefaultTrigger ?? "self",
+			replicaId: e.scheduleReplicaId ?? `pid-${process.pid}`,
+			armSelf: e.scheduleArmSelf ?? !0,
+			dormancy: e.dormancy ?? "always-on",
+			...e.dormancyTenantId === void 0 ? {} : { dormancyTenantId: e.dormancyTenantId },
+			buildContext: ({ traceId: t, scheduleName: n, subject: r }) => y({
+				subject: r,
+				traceId: t
+			}, e.store, void 0, `schedule:${n}`),
+			log: {
+				info: (e, t) => {
+					process.stdout.write(`[schedule] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+				},
+				warn: (e, t) => {
+					process.stderr.write(`[schedule] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+				},
+				error: (e, t) => {
+					process.stderr.write(`[schedule] ERROR ${e} ${t ? JSON.stringify(t) : ""}\n`);
+				},
+				debug: () => {}
+			},
+			...e.scheduleFireInterceptor === void 0 ? {} : { interceptFire: e.scheduleFireInterceptor },
+			...e.onScheduleRunEvent === void 0 ? {} : { onRunEvent: e.onScheduleRunEvent }
+		}), e.onSchedulerReady?.(o);
+	}
+	let nt = e.log ?? M({ scope: "voltro:serve" }), rt, it;
+	if ((e.discovered.subscribers?.length ?? 0) > 0 && (rt = de(e.discovered.subscribers ?? [], e.store, nt.child("subscribe"), e.schemaRegistry)), (e.discovered.reactions?.length ?? 0) > 0) {
+		let t = nt.child("reaction");
+		it = ve(e.discovered.reactions ?? [], e.store, {
+			runAct: async (n, r) => {
+				if (n.kind === "workflow") {
+					if (d === void 0) {
+						t.warn("reaction workflow act skipped — no workflow engine in this app", { workflow: n.workflow });
+						return;
+					}
+					let e = r.new ?? r.old ?? {};
+					await gt(d, {
+						traceId: `reaction:${n.workflow}`,
+						source: `reaction:${n.workflow}`
+					}).start(n.workflow, e);
+					return;
+				}
+				await _(n.agent, r, {
+					findAgentSend: (t) => e.discovered.actions.find((e) => e.descriptor.name === `${t}.send`),
+					runAction: (e, t, n) => Promise.resolve(he(e, t, n)),
+					makeSubject: (e) => Lt(e),
+					now: () => Date.now(),
+					log: t
+				});
+			},
+			checkBudget: async (n, r) => {
+				try {
+					let { requireAiBudget: t } = await import("@voltro/ai");
+					return (await A.runPromise(A.either(t(e.store, {
+						tenantId: n,
+						limitUsd: r
+					}))))._tag === "Right";
+				} catch (e) {
+					return t.warn("reaction budget check failed — refusing the act", { tenantId: n }, e), !1;
+				}
+			}
+		}, t);
+	}
+	let at;
+	return (e.discovered.aggregates?.length ?? 0) > 0 && (at = await ne({
+		discovered: e.discovered.aggregates ?? [],
+		store: e.store,
+		log: nt.child("aggregate"),
+		...e.analytics === void 0 ? {} : { analytics: e.analytics },
+		...e.aggregateStorage === void 0 ? {} : { storage: e.aggregateStorage },
+		...e.aggregateCoordinator === void 0 ? {} : { coordinator: e.aggregateCoordinator }
+	}), ue = j.succeed(N, at.registry)), Ye = !0, e.bootTiming?.mark("ready"), {
+		dispatcher: t,
+		server: Ze,
+		scheduler: o,
+		close: async () => {
+			Ye = !1, at?.detach(), it?.(), rt?.(), await o?.shutdown(), t.close(), await a?.dispose(), await new Promise((e) => Ze.close(() => e())), await Qe();
+		}
+	};
+}, $ = M({ scope: "voltro:serve" }), Pn = (e, t, n) => (e === "production" || e === "staging") && t !== "memory" && n !== "0", Fn = Pe, In = async (e) => {
+	let t = O(process.cwd());
+	if (ze(t)) {
+		let n;
+		try {
+			let e = await import(Ie(t).href);
+			typeof e.runServe == "function" ? n = e.runServe : $.warn("serve bundle has no runServe export — using the standard serve path");
+		} catch (e) {
+			$.warn("serve bundle failed to load — using the standard serve path", {}, e);
+		}
+		if (n) return $.info("serve: booting from the precompiled serve bundle"), n(e);
+	}
+	return Ln(e);
+}, Ln = async (ee) => {
+	let p = Ne();
+	process.env.NODE_ENV || (process.env.NODE_ENV = "production");
+	try {
+		qt();
+	} catch (e) {
+		throw gn(e instanceof Error ? e.message : String(e));
+	}
+	let m = process.cwd(), ne = Number(process.env.PORT ?? Fn(ee, "--port") ?? 4e3), g = await he(m);
+	Ct(xt(g?.secrets)), await e({
+		rawEnv: g?.env,
+		appType: "api",
+		root: m,
+		log: $,
+		generateTypes: !1
+	}), p.mark("config");
+	let _ = (process.env.DB_DIALECT ?? g?.store ?? "memory").toLowerCase(), ce = (_ === "mariadb" || _ === "postgres" || _ === "mssql") && (process.env.CDC ?? "1") !== "0", le = _ === "mariadb" ? "mariadb" : _ === "mssql" ? "mssql" : void 0, de = k(m);
+	if (!i() && ze(de)) try {
+		let e = await import(Ie(de).href);
+		if (e.modules) {
+			let t = {};
+			for (let [n, r] of Object.entries(e.modules)) t[Fe(m, n)] = r;
+			r(t), $.info("precompiled api bundle loaded", { modules: Object.keys(t).length });
+		}
+	} catch (e) {
+		$.warn("precompiled api bundle failed to load — falling back to source", {}, e);
+	}
+	let b = await be(m), S = await De(b, { cdc: ce && le !== void 0 });
+	{
+		let e = h(S.serverOnlyLeaks, re(process.env, "strict"), Ze, "`voltro serve`");
+		if (e.action === "fail") throw gn(e.message ?? "");
+		e.action === "warn" && $.warn(e.message ?? "");
+	}
+	let ve = b.filter((e) => Ae.test(e)), w = ve.length > 0 ? await ue(ve, $.child("webhooks")) : void 0, Ce = s({
+		mix: S.featureMix,
+		plugins: g?.plugins ?? [],
+		cdc: ce && le !== void 0,
+		...le ? { cdcDialect: le } : {}
+	}), ke = g?.analytics !== void 0 && g.analytics.kind !== "noop" && _ !== "memory" ? (await n(_)).makeSqlLayer(T()) : void 0, D = await ie({
+		spec: g?.analytics,
+		sqlLayer: ke,
+		log: $
+	}), O = (() => {
+		let e = new Set(S.tables.map((e) => e.tableName)), t = [...S.tables];
+		for (let n of [...Ce, ...D.tables]) e.has(n.tableName) || (e.add(n.tableName), t.push(n));
+		return t;
+	})();
+	for (let e of O) Mt(e);
+	let Pe = (process.env.NODE_ENV ?? "").toLowerCase();
+	if (Pn(Pe, _, process.env.VOLTRO_AUTO_MIGRATE)) {
+		let e = (await n(_)).makeSqlLayer(T()), t = await A.runPromise(At.SqlClient.pipe(A.flatMap((e) => Qt(e, O, {
+			appliedBy: `serve:${Pe}`,
+			environment: "prod",
+			dialectId: _
+		})), A.provide(e)));
+		t.kind === "prod-mismatch" && ($.error(Zt(t, _)), $.error("serve: refusing to boot — apply the schema first (voltro db apply in a pre-deploy step), or set VOLTRO_AUTO_MIGRATE=0 to bypass this check."), process.exit(1)), $.info(Zt(t, _));
+	}
+	let M = mt(O);
+	p.mark("discover");
+	let N = await _e(g, void 0), Be = Ot(N, _);
+	for (let e of we({
+		dialect: String(g?.store ?? process.env.DB_DIALECT ?? "postgres"),
+		changeStrategy: (process.env.CDC ?? "1") === "0" ? "inline" : "cdc",
+		dbUrl: process.env.DB_URL,
+		tables: S.tables.map((e) => ({
+			tableName: e.tableName,
+			isReactive: e.isReactive === !0
+		})),
+		querySources: S.queries.flatMap((e) => {
+			let t = e.descriptor.source;
+			return t === void 0 ? [] : typeof t == "string" ? [t] : [...t];
+		})
+	})) e.level === "warn" ? $.warn(e.message) : $.info(e.message);
+	g?.cache && !process.env.CACHE_BACKEND && (process.env.CACHE_BACKEND = g.cache), g?.cacheRedisUrl && !process.env.CACHE_REDIS_URL && (process.env.CACHE_REDIS_URL = g.cacheRedisUrl), g?.cacheRedisDriver && !process.env.CACHE_REDIS_DRIVER && (process.env.CACHE_REDIS_DRIVER = g.cacheRedisDriver), g?.cacheKeyPrefix && !process.env.CACHE_KEY_PREFIX && (process.env.CACHE_KEY_PREFIX = g.cacheKeyPrefix);
+	let { service: He, invalidationBus: Ue, snapshotCache: We, cache: F, backend: Ge, dispose: I } = await xe({ env: process.env });
+	$.info(`cache backend resolved: ${Ge}` + (Ge === "redis" ? ` (driver ${process.env.CACHE_REDIS_DRIVER ?? "resp"})` : " — in-process, not cross-instance")), N.onChange((e) => {
+		A.runFork(Ue.publish(e.table));
+	}), g?.kv && !process.env.KV_BACKEND && (process.env.KV_BACKEND = g.kv), g?.kvRedisUrl && !process.env.KV_REDIS_URL && (process.env.KV_REDIS_URL = g.kvRedisUrl), g?.kvKeyPrefix && !process.env.KV_KEY_PREFIX && (process.env.KV_KEY_PREFIX = g.kvKeyPrefix);
+	let { kv: Ke, service: qe } = await at({ store: N });
+	p.mark("store");
+	let $e = P({
+		store: N,
+		sink: D.sink,
+		log: $
+	}), et = pe({
+		store: N,
+		dialect: _
+	}), L = g?.plugins ?? [], st = process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, ct, lt;
+	_ !== "memory" && (ct = Re.make((await n(_)).makeSqlLayer(T())), lt = await ct.runPromise(At.SqlClient));
+	let ut = ot({
+		coordinator: [
+			"postgres",
+			"mariadb",
+			"mysql",
+			"mssql"
+		].includes(_) ? tt(N, st, $) : Tt,
+		replicaId: st,
+		log: $
+	}), dt = [], ft = {
+		...lt ? { sql: lt } : {},
+		scheduleCoordinated: (e, t, n) => {
+			let r = ut(e, t, n);
+			return dt.push(r), r;
+		}
+	};
+	for (let e of L) e.bindDataStore?.(N, ft);
+	let pt = L.filter((e) => typeof e.onChangeEvent == "function");
+	if (pt.length > 0) {
+		let e = N.changeScope ?? "local";
+		N.onChange((t) => {
+			let n = y(t, e);
+			for (let e of pt) A.runFork(e.onChangeEvent(n).pipe(A.catchAllCause((t) => A.sync(() => $.warn(`plugin ${e.name} onChangeEvent failed`, { error: Le.pretty(t) })))));
+		});
+	}
+	let ht = me({
+		plugins: L,
+		appName: g?.name ?? "voltro-api",
+		appType: "api",
+		voltroVersion: process.env.npm_package_version ?? "0.0.0",
+		log: $
+	});
+	L.length && await ht.activate(), p.mark("plugins");
+	let gt = await ht.gatherObservability(), _t = await x(N, g, _, {
+		info: (e, t) => process.stdout.write(`[broadcast] ${e} ${t ? JSON.stringify(t) : ""}\n`),
+		warn: (e, t) => process.stderr.write(`[broadcast] ${e} ${t ? JSON.stringify(t) : ""}\n`),
+		debug: () => {}
+	}), R = g?.apiKeys, yt = (typeof R == "object" ? R.prefix : void 0) ?? "voltro_", bt = R ? Ye(N) : void 0, St = bt ? rt({ flush: it(bt) }) : void 0;
+	St && vt(() => St.shutdown());
+	let z = bt ? nt(bt, {
+		prefix: yt,
+		...St ? { usage: St } : {}
+	}) : void 0, wt = z ? [Qe(z, { prefix: yt })] : [], Et = Se([...g?.auth?.strategies ?? [], ...wt], $t(g?.plugins ?? []), g?.auth?.anonymousTenantRequired ?? !1, g?.auth?.resolveScopes, () => Be), Dt = [...g?.restRoutes ?? [], ...z ? Ve(z, (typeof R == "object" ? R.managementPath : void 0) ?? "/v1/api-keys") : []], B = g?.idempotency, kt = B ? {
+		store: Xe(N),
+		header: (typeof B == "object" ? B.header : void 0) ?? "Idempotency-Key",
+		ttlMs: (typeof B == "object" ? B.ttlMs : void 0) ?? 864e5
+	} : void 0, jt = Dt.length > 0 ? tn(Dt, {
+		store: N,
+		resolveSubject: (e) => Et({
+			headers: e,
+			clientId: -1
+		}),
+		...kt ? { idempotency: kt } : {}
+	}) : [], V = L.map((e) => e.services).filter((e) => e !== void 0), Nt = j.mergeAll(Ee({
+		analyticsLayer: D.layer,
+		cacheService: He,
+		kvService: qe,
+		pluginServices: V,
+		userLayers: g?.layers ?? []
+	}), ge(g?.http ?? {})), H = g?.scheduling ?? {}, Pt = H.trigger ?? "self", Ft = /* @__PURE__ */ new Set([
+		"postgres",
+		"mysql",
+		"mariadb",
+		"mssql"
+	]), It = H.coordination ?? (Ft.has(_) ? "advisoryLock" : "single"), U = It === "cluster" && Ft.has(_), W = U ? "cluster" : It === "advisoryLock" && Ft.has(_) ? "advisoryLock" : "single";
+	It === "cluster" && !U && $.warn("scheduling.coordination=cluster needs a sql-backed store except sqlite — falling back to single"), It === "advisoryLock" && !Ft.has(_) && $.warn("scheduling.coordination=advisoryLock needs a SQL store (the claim-row gate) — falling back to single");
+	let G, K = S.workflows.length > 0 || S.workflowWorkers.length > 0 || S.eventTriggers.length > 0 || (w?.outgoing.length ?? 0) > 0 || U, Lt;
+	if (K) {
+		if (_ === "mssql") {
+			let e = await fe(process.cwd());
+			e && $.warn(e);
+		}
+		let [{ WorkflowEngine: e }, { makeClusterCronLayer: t, workflowEngineLayer: r, resolveRunnerStorage: i }] = await Promise.all([import("@effect/workflow"), import("@voltro/workflow/cluster")]), a = U ? S.schedules.filter((e) => (e.trigger ?? Pt) === "self").map((e) => t({
+			name: e.name,
+			cron: Je(e),
+			execute: async () => {
+				await G?.fireFromCluster(e.name);
+			}
+		})) : [];
+		Lt = _ === "memory" ? e.layerMemory : await (async () => {
+			let e = await n(_), t = i({ sqliteFamily: e.id === "sqlite" || e.id === "turso" });
+			return $.info(`workflow engine: cluster-${t}, dialect=${e.id}` + (t === "memory" ? " — single-process durable replay, no cross-pod shard handoff" + (e.id !== "sqlite" && e.id !== "turso" ? " (VOLTRO_WORKFLOW_RUNNER_STORAGE=memory: SqlRunnerStorage/cluster_runners + GET_LOCK skipped)" : "") : "")), r({
+				sqlClientLayer: e.makeSqlLayer(T()),
+				runnerStorage: t,
+				dialectId: e.id,
+				...process.env.VOLTRO_WORKFLOW_RUNNER_PORT ? { runnerListenPort: Number(process.env.VOLTRO_WORKFLOW_RUNNER_PORT) } : {},
+				...a.length > 0 ? { extraShardingLayers: a } : {}
+			});
+		})();
+	}
+	let Rt = je(L, t()), zt = b.filter((e) => /\.subscribe\.tsx?$/.test(e)), q = zt.length > 0 ? await ae(zt, $) : [], Bt = b.filter((e) => /\.reaction\.tsx?$/.test(e)), Vt = Bt.length > 0 ? await se(Bt, $) : [], J = b.filter((e) => u.test(e)), Ht = J.length > 0 ? await Me(J, $) : [], Ut = b.filter((e) => /\.aggregate\.tsx?$/.test(e)), Y = Ut.length > 0 ? await v(Ut, $) : [], X = ye();
+	if (Y.length > 0 && _ !== "memory") try {
+		X = f((await n(_)).makeSqlLayer(T()));
+	} catch (e) {
+		$.warn("aggregate: SQL storage init failed — falling back to in-process", { err: String(e) });
+	}
+	let Wt = _ === "memory" ? Tt : tt(N, `aggregate@${process.pid}`, $), Z = [], Gt = [], Kt = b.filter((e) => l.test(e));
+	if (Kt.length > 0) {
+		let e = $.child("agent"), t = b.filter((e) => a.test(e));
+		t.length > 0 && await o(t, e);
+		let n = await c(Kt, e);
+		for (let e of n.agents) for (let t of te(e)) (t.kind === "action" ? Z : Gt).push({
+			file: t.file,
+			descriptor: t.descriptor,
+			executor: t.executor
+		});
+		n.agents.length > 0 && e.info("synthesized agent routes", { agents: n.agents.map((e) => e.descriptor.name) });
+	}
+	p.mark("workflow");
+	let Jt = await Nn({
+		bootTiming: p,
+		discovered: {
+			queries: [...S.queries, ...Gt],
+			mutations: S.mutations,
+			actions: [...S.actions, ...Z],
+			streams: S.streams,
+			workflows: S.workflows,
+			workflowWorkers: S.workflowWorkers,
+			eventTriggers: S.eventTriggers,
+			schedules: S.schedules,
+			subscribers: q,
+			outboxHandlers: Ht,
+			connections: S.connections,
+			reactions: Vt,
+			aggregates: Y,
+			...w === void 0 ? {} : { webhooks: w }
+		},
+		log: $,
+		analytics: D.sink,
+		aggregateStorage: X,
+		aggregateCoordinator: Wt,
+		store: N,
+		kv: Ke,
+		cache: F,
+		snapshotCache: We,
+		schemaRegistry: M,
+		tenantScopedTables: S.tenantScopedTables,
+		softDeleteScopedTables: S.softDeleteScopedTables,
+		dataTransferSnapshot: Xt(O),
+		dataTransferDialect: _,
+		tenantIsolation: (process.env.VOLTRO_TENANT_ISOLATION ?? g?.tenancy?.isolation) === "namespace" ? "namespace" : "shared-schema",
+		resolveSubject: (e, t) => Et({
+			headers: e,
+			clientId: t
+		}),
+		httpRoutes: [...L.flatMap((e) => e.httpRoutes ?? []), ...jt],
+		getStore: () => Be,
+		...Nt ? { baseLayer: Nt } : {},
+		...Lt === void 0 ? {} : { workflowEngineLayer: Lt },
+		scheduleDefaultTrigger: Pt,
+		scheduleCoordination: W,
+		scheduleArmSelf: !U,
+		dormancy: process.env.VOLTRO_DORMANCY === "sleep" || process.env.VOLTRO_DORMANCY === "always-on" ? process.env.VOLTRO_DORMANCY : g?.dormancy ?? "always-on",
+		scheduleReplicaId: process.env.HOSTNAME ?? `pid-${process.pid}`,
+		...Rt === void 0 ? {} : { scheduleFireInterceptor: Rt },
+		onSchedulerReady: (e) => {
+			G = e;
+		},
+		inspectRoute: { handle: (e, t, n, r) => d(e, {
+			kind: "api",
+			meta: {
+				name: g?.name ?? "voltro-api",
+				voltroVersion: Te,
+				port: ne,
+				mode: "start",
+				store: _,
+				cdc: ce ? "on" : "off"
+			},
+			rpc: C(S, m),
+			workflows: Oe(S, m),
+			inspectFireSchedule: async ({ name: e, trigger: t }) => {
+				if (!G) throw Error("scheduler not started — this app registers no self-triggered schedules (all schedules are trigger:'external', or there are none).");
+				return { runId: await G.fireNow(e, t) ?? null };
+			}
+		}, t, {
+			method: n,
+			...r === void 0 ? {} : { body: r }
+		}) ?? {
+			status: 404,
+			contentType: "application/json",
+			body: JSON.stringify({ error: "not an inspect route" })
+		} },
+		observability: gt,
+		port: ne,
+		...g?.transport?.wsPath ? { path: g.transport.wsPath } : {}
+	});
+	return E(oe([
+		S.queries,
+		S.mutations,
+		S.actions,
+		S.streams
+	]), (e) => {
+		$.warn(e);
+	}), $.info(`API listening on :${ne}`, {
+		dialect: _,
+		queries: S.queries.length,
+		mutations: S.mutations.length,
+		actions: S.actions.length,
+		streams: S.streams.length,
+		workflows: S.workflows.length,
+		workflowWorkers: S.workflowWorkers.length,
+		schedules: S.schedules.length,
+		scheduleCoordination: W
+	}), p.finish($), vt(async () => {
+		for (let e of dt) e.stop();
+		$e.detach(), et.stop(), I(), ct?.dispose();
+		try {
+			await ht.deactivate(), await _t?.close(), await D.dispose(), await Jt.close(), await N.close?.();
+		} catch (e) {
+			console.error("serve: shutdown step failed, exiting anyway:", e);
+		}
+	}), await new Promise(() => {}), 0;
+};
+//#endregion
+export { In as n, An as r, Ln as t };