@voltro/cli 0.24.0 → 0.25.0

package/dist/serveCommand-5ZFiNO1R.js

@@ -0,0 +1,1241 @@
+import { ot as e, t } from "./inspectMetrics-EQwH7BI4.js";
+import { s as n } from "./seedRunner-D6eu-u5U.js";
+import { r, t as i } from "./appModuleLoader-C9r9mxZt.js";
+import { f as a, m as o, n as s, p as c, u as l } from "./frameworkTableAssembly-Cw5zJz6n.js";
+import { u } from "./fileConventions-3bffWssN.js";
+import { p as d } from "./inspect-DuLUrZp9.js";
+import { $ as f, A as p, B as ee, D as te, E as ne, F as m, G as h, H as re, I as g, J as ie, K as _, L as ae, M as oe, N as v, O as y, P as se, Q as ce, R as le, S as ue, T as de, U as fe, V as pe, W as me, X as b, Y as x, _ as he, _t as ge, b as S, bt as C, c as _e, ct as ve, dt as ye, et as be, ft as w, g as xe, gt as Se, h as Ce, ht as we, i as T, j as Te, k as Ee, lt as De, mt as E, o as D, pt as Oe, q as ke, r as Ae, st as je, t as Me, tt as Ne, u as Pe, ut as Fe, v as Ie, w as O, x as Le, y as Re, yt as ze, z as Be } from "./dev-MacSQ1Ll.js";
+import { r as Ve, u as He } from "./apiBuild-BqhCSytw.js";
+import { t as Ue } from "./bootTiming-BdyP9nYw.js";
+import { n as k } from "./cliArgs-qdZSElM3.js";
+import { basename as We, join as A } from "node:path";
+import { pathToFileURL as j } from "node:url";
+import { Cause as Ge, Effect as M, Layer as N, ManagedRuntime as Ke } from "effect";
+import { createLogger as P } from "@voltro/logger";
+import { existsSync as qe } from "node:fs";
+import { AggregateRegistry as Je, Dispatcher as Ye, apiKeyManagementRoutes as Xe, applySoftDeleteScope as Ze, applyTenantScope as Qe, attachAnalyticsMirror as $e, awaitServerListening as et, bindMutation as F, bindStream as tt, bindSubscription as I, buildTracingLayer as nt, cancelWakeup as rt, compileCron as it, dataStoreApiKeyStore as at, dataStoreIdempotencyStore as ot, formatServerOnlyLeaks as L, frameworkApiKeyStrategy as st, installPolicyGuardResolver as R, loadResourceTuples as ct, makeActionRunner as lt, makeAdvisoryLockCoordinator as ut, makeApiKeyService as dt, makeApiKeyUsageBuffer as ft, makeApiKeyUsageFlusher as pt, makeAsyncKv as mt, makeCoordinatedScheduler as ht, makeEffectStoreLayer as gt, makeLazyWorkflowFacade as _t, makeMutationOutputCodec as vt, makeMutationRunner as yt, makeOneShotQueryRunner as bt, makeQueryDescriptorProducer as xt, makeQueryReauthorizer as St, makeQuerySubscriber as Ct, makeSchemaRegistry as wt, makeWorkflowFacade as Tt, makeWorkflowFacadeWithCallerContext as z, makeWorkflowLayers as Et, noopKv as Dt, onProcessShutdown as Ot, recordSubscriptionDelivery as kt, recordWorkflowRun as At, registerWakeup as B, resolveSecretsBackend as jt, runProvidedEffect as Mt, setSecretsBackend as Nt, setSystemStoreHandle as Pt, setTupleSource as Ft, singleCoordinator as It, startRpcServer as Lt, startScheduler as Rt, workflowToRpc as zt, wrapStoreWithBootCodec as Bt } from "@voltro/runtime";
+import { RpcGroup as Vt } from "@effect/rpc";
+import { SqlClient as Ht } from "@effect/sql";
+import { and as V, ensureTableRegistered as Ut, eq as H, or as Wt } from "@voltro/database";
+import { appStorageProvider as Gt, fromNodeReadable as Kt, getObjectStream as qt, putObjectStream as Jt, toNodeReadable as Yt } from "@voltro/plugin-storage";
+import { AuthMiddleware as U, ConnectionInfoMiddleware as W, actionToRpc as G, anonymousSubject as Xt, isWireReachable as Zt, mutationToRpc as K, queryToRpc as q, streamToRpc as Qt, workflowCancelDescriptor as $t, workflowDomainEventsQueryDescriptor as J, workflowEventDeliveriesQueryDescriptor as en, workflowResumeDescriptor as tn, workflowRunEventsQueryDescriptor as nn, workflowRunQueryDescriptor as Y, workflowRunStepsQueryDescriptor as X, workflowRunsQueryDescriptor as Z, workflowSignalDescriptor as rn, workflowUpdateDescriptor as an } from "@voltro/protocol";
+import { assertProductionSessionSecret as on } from "@voltro/protocol/session";
+import { createHash as sn, timingSafeEqual as cn } from "node:crypto";
+import { declaredSnapshot as ln, describeOutcome as un, runPlannedMigrations as dn } from "@voltro/database/sql";
+import { getAuthSessionStrategy as fn } from "@voltro/plugin-auth";
+import { collectPublicApiRoutes as pn, restRoutesToHttpRoutes as mn } from "@voltro/protocol/rest";
+import { buildDeliverWebhookExecute as hn, buildWebhooksService as gn, defaultIncomingPath as _n, deliverWebhookWorkflow as vn, mountIncomingWebhook as yn } from "@voltro/plugin-webhooks";
+import { channelFor as bn, getBroadcastPlugin as xn } from "@voltro/plugin-broadcast";
+import { packBundle as Sn, runExport as Cn, runImport as wn, storageBlobSink as Tn, storageRefsBlobSource as En, unpackBundle as Dn, unpackBundleToDir as On } from "@voltro/data-transfer";
+//#region src/bootRefusal.ts
+var kn = "VoltroBootRefusal", An = (e) => {
+	let t = Error(e);
+	return t.name = kn, t;
+}, jn = "/_voltro/admin/import", Mn = "/_voltro/admin/export", Q = (e, t) => ({
+	status: e,
+	contentType: "application/json; charset=utf-8",
+	body: JSON.stringify(t)
+}), Nn = (e) => {
+	let t = e.authorization ?? e.Authorization, n = t ? /^Bearer\s+(.+)$/i.exec(t) : null;
+	return n ? n[1] : null;
+}, Pn = (e, t) => cn(sn("sha256").update(e).digest(), sn("sha256").update(t).digest()), Fn = (e, t) => {
+	if (e.method.toUpperCase() !== "POST") return Q(405, { error: "method not allowed" });
+	if (!t || t.length < 16) return Q(503, { error: "data transfer misconfigured (no/weak secret)" });
+	let n = Nn(e.headers);
+	return !n || !Pn(n, t) ? Q(401, { error: "unauthorized" }) : null;
+}, In = P({ scope: "voltro:admin-import" }), Ln = "VBUNDLE2", Rn = async function* (e) {
+	yield e;
+}, zn = (e) => async (t) => {
+	let n = Fn(t, e.secret);
+	if (n) return n;
+	let r = t.headers["x-import-mode"], i = t.headers["x-import-on-conflict"], a = t.headers["x-import-atomic"] === "1" || t.headers["x-import-atomic"] === "true", o = t.headers["x-import-force"] === "1" || t.headers["x-import-force"] === "true", s = t.rawBody.byteLength >= 8 && Buffer.from(t.rawBody.subarray(0, 8)).toString("latin1") === Ln, c, l;
+	if (s) c = Rn(t.rawBody), l = "upload";
+	else {
+		let n;
+		try {
+			n = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
+		} catch {
+			return Q(400, { error: "body must be a packed bundle archive or { bundleKey } JSON" });
+		}
+		if (typeof n.bundleKey != "string" || !n.bundleKey) return Q(400, { error: "body.bundleKey (string) is required for the storage transport" });
+		if (!e.openArchive) return Q(501, { error: "storage transport not configured on this instance" });
+		c = e.openArchive(n.bundleKey), l = "storage";
+	}
+	let u = await import("node:os"), d = await import("node:fs/promises"), f = await import("node:path"), p = await d.mkdtemp(f.join(u.tmpdir(), "voltro-admin-import-"));
+	try {
+		e.assetSink ? await Dn(c, {
+			dir: p,
+			blobs: e.assetSink
+		}) : await On(c, p);
+		let t = await M.runPromiseExit(wn({
+			store: e.store,
+			bundleDir: p,
+			...r ? { mode: r } : {},
+			...i ? { onConflict: i } : {},
+			...a ? { atomic: a } : {},
+			...e.snapshot ? { targetSnapshot: e.snapshot } : {},
+			force: o,
+			onWarn: (e) => In.warn("admin.import", { message: e }),
+			...e.assetSink ? { assetsAlreadyRestored: !0 } : {}
+		}));
+		if (t._tag === "Failure") {
+			let e = t.cause._tag === "Fail" ? t.cause.error : void 0;
+			if (e && e._tag === "SchemaDriftError") {
+				let t = e;
+				return In.warn("admin.import refused (schema drift)", {
+					transport: l,
+					bundle: t.bundleFingerprint.slice(0, 16),
+					target: t.targetFingerprint.slice(0, 16)
+				}), Q(409, {
+					error: "schema drift",
+					bundleFingerprint: t.bundleFingerprint,
+					targetFingerprint: t.targetFingerprint,
+					diff: t.diff,
+					hint: "re-export against the current schema, or resend with x-import-force: 1"
+				});
+			}
+			throw Error(String(e?.message ?? e ?? "import failed"));
+		}
+		let n = t.value, s = n.tables.reduce((e, t) => e + t.rowCount, 0);
+		return In.info("admin.import", {
+			transport: l,
+			tables: n.tables.length,
+			rows: s,
+			mode: r ?? "upsert",
+			atomic: a
+		}), Q(200, {
+			tables: n.tables.length,
+			rows: s,
+			transport: l
+		});
+	} catch (e) {
+		return In.warn("admin.import failed", {
+			transport: l,
+			error: e?.message ?? String(e)
+		}), Q(500, {
+			error: "import failed",
+			message: e?.message ?? String(e)
+		});
+	} finally {
+		await d.rm(p, {
+			recursive: !0,
+			force: !0
+		});
+	}
+}, Bn = P({ scope: "voltro:admin-export" }), Vn = async (e) => {
+	let t = [];
+	for await (let n of e) t.push(Buffer.from(n));
+	return new Uint8Array(Buffer.concat(t));
+}, Hn = (e) => typeof e.tenant == "string" && e.tenant ? {
+	kind: "tenant",
+	tenantId: e.tenant
+} : Array.isArray(e.tables) && e.tables.length ? {
+	kind: "tables",
+	tables: e.tables.filter((e) => typeof e == "string")
+} : { kind: "all" }, Un = (e) => async (t) => {
+	let n = Fn(t, e.secret);
+	if (n) return n;
+	let r;
+	try {
+		r = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
+	} catch {
+		return Q(400, { error: "body must be JSON: { profile?, tenant?, tables?, consistency?, compression?, bundleKey? }" });
+	}
+	let i = {};
+	if (typeof r.profile == "string" && r.profile) {
+		if (!e.loadProfile) return Q(501, { error: "server-side profiles not configured on this instance" });
+		try {
+			i = await e.loadProfile(r.profile);
+		} catch (e) {
+			return Q(400, {
+				error: `profile '${r.profile}' could not be loaded`,
+				message: e?.message ?? String(e)
+			});
+		}
+	}
+	let a = r.consistency === "snapshot" ? "snapshot" : i.consistency ?? "live", o = (typeof r.compression == "string" ? r.compression : void 0) ?? i.compression, s = i.scope ?? Hn(r), c = typeof r.bundleKey == "string" && r.bundleKey.length > 0, l = r.assets === !0 && e.assetSource ? { blobs: e.assetSource } : {}, u = await import("node:os"), d = await import("node:fs/promises"), f = await import("node:path"), p = await d.mkdtemp(f.join(u.tmpdir(), "voltro-admin-export-"));
+	try {
+		let t = await M.runPromise(Cn({
+			store: e.store,
+			snapshot: e.snapshot,
+			dialect: e.dialect,
+			outDir: p,
+			...i.subset ? { subset: i.subset } : {
+				scope: s,
+				...e.tenantTables && e.tenantTables.length > 0 ? { tenantTables: e.tenantTables } : {}
+			},
+			consistency: a,
+			...o ? { compression: o } : {},
+			...i.masking ? { masking: i.masking } : {}
+		})), n = t.tables.reduce((e, t) => e + t.rowCount, 0), u = t.masking?.transformed.length ?? 0;
+		if (c) {
+			if (!e.putArchive) return Q(501, { error: "storage transport not configured on this instance" });
+			let i = r.bundleKey;
+			return await e.putArchive(i, () => Sn({
+				dir: p,
+				...l
+			})), Bn.info("admin.export", {
+				transport: "storage",
+				tables: t.tables.length,
+				rows: n,
+				masked: u,
+				bundleKey: i
+			}), Q(200, {
+				bundleKey: i,
+				tables: t.tables.length,
+				rows: n,
+				masked: u,
+				transport: "storage"
+			});
+		}
+		let d = await Vn(Sn({
+			dir: p,
+			...l
+		}));
+		return Bn.info("admin.export", {
+			transport: "download",
+			tables: t.tables.length,
+			rows: n,
+			masked: u,
+			bytes: d.byteLength
+		}), {
+			status: 200,
+			contentType: "application/octet-stream",
+			body: d,
+			headers: {
+				"x-export-tables": String(t.tables.length),
+				"x-export-rows": String(n),
+				"x-export-masked": String(u)
+			}
+		};
+	} catch (e) {
+		return Bn.warn("admin.export failed", { error: e?.message ?? String(e) }), Q(500, {
+			error: "export failed",
+			message: e?.message ?? String(e)
+		});
+	} finally {
+		await d.rm(p, {
+			recursive: !0,
+			force: !0
+		});
+	}
+}, Wn = async (e) => {
+	let { resolve: t } = await import("node:path"), { existsSync: n } = await import("node:fs"), r = [
+		e,
+		`${e}.profile.ts`,
+		`data-profiles/${e}.ts`,
+		`data-profiles/${e}.profile.ts`
+	].map((e) => t(process.cwd(), e)), i = r.find((e) => n(e));
+	if (!i) throw Error(`data profile '${e}' not found (looked for: ${r.join(", ")})`);
+	let a = await import(i), o = a.default ?? a.profile;
+	if (!o) throw Error(`data profile '${i}' has no default export`);
+	return o;
+}, Gn = (e, t, n = {}) => (async function* () {
+	let r = await Yt((await M.runPromise(qt(e, t).pipe(M.timeout(n.openTimeout ?? "30 seconds")))).stream), i = n.stallMs ?? 12e4, a, o = () => {
+		a && clearTimeout(a), a = setTimeout(() => r.destroy(/* @__PURE__ */ Error(`storage read stalled for ${i}ms reading '${t}'`)), i);
+	};
+	try {
+		o();
+		for await (let e of r) o(), yield e instanceof Uint8Array ? e : new Uint8Array(e);
+	} finally {
+		a && clearTimeout(a), r.destroy();
+	}
+})(), Kn = {
+	get: async () => void 0,
+	set: async () => {},
+	setWithTags: async () => {},
+	remove: async () => !1,
+	has: async () => !1,
+	clear: async () => {},
+	invalidateTag: async () => 0,
+	wrap: async (e, t, n) => n()
+}, qn = async (e) => {
+	Pt({
+		dataStore: e.store,
+		schemaRegistry: e.schemaRegistry
+	});
+	let t = new Ye({
+		store: e.store,
+		...e.snapshotCache ? { cache: e.snapshotCache } : {},
+		recordDelivery: (e) => kt({
+			label: e.label,
+			kind: e.kind,
+			durationMs: e.durationMs,
+			rowCount: e.rowCount
+		})
+	}), n = e.cache ?? Kn, r = e.kv ?? Dt, i, a, o, s = /* @__PURE__ */ new Map(), c = () => `wfctx_${globalThis.crypto?.randomUUID?.() ?? `${Date.now().toString(36)}${Math.random().toString(36).slice(2)}`}`, l = async (t, n, r) => {
+		let i = {
+			...r,
+			source: r.source ?? `workflow:${t}`
+		};
+		s.set(n, i);
+		try {
+			let r = await e.store.query({
+				table: "_voltro_workflow_start_contexts",
+				order: [],
+				predicate: H("executionId", n),
+				projection: ["id"],
+				skip: void 0,
+				take: 1
+			}), a = {
+				workflowName: t,
+				executionId: n,
+				subject: i.subject ?? null,
+				traceId: i.traceId ?? null,
+				source: i.source ?? null,
+				parentExecutionId: i.parentExecutionId ?? null,
+				parentClosePolicy: i.parentClosePolicy ?? null,
+				createdAt: /* @__PURE__ */ new Date()
+			};
+			r[0] === void 0 ? await e.store.insert("_voltro_workflow_start_contexts", {
+				id: c(),
+				...a
+			}) : await e.store.update("_voltro_workflow_start_contexts", r[0].id, a);
+		} catch (e) {
+			process.stderr.write(`[workflow] failed to persist start context for ${t}/${n}: ${e?.message ?? String(e)}\n`);
+		}
+	}, u = async (t, n) => {
+		let r = s.get(n);
+		if (r !== void 0) return r;
+		try {
+			let t = (await e.store.query({
+				table: "_voltro_workflow_start_contexts",
+				order: [],
+				predicate: H("executionId", n),
+				projection: void 0,
+				skip: void 0,
+				take: 1
+			}))[0];
+			if (t === void 0) return;
+			let r = {
+				...t.subject === null ? {} : { subject: t.subject },
+				...t.traceId === null ? {} : { traceId: t.traceId },
+				...t.source === null ? {} : { source: t.source },
+				...t.parentExecutionId === null ? {} : { parentExecutionId: t.parentExecutionId },
+				...t.parentClosePolicy === null ? {} : { parentClosePolicy: t.parentClosePolicy }
+			};
+			return s.set(n, r), r;
+		} catch (e) {
+			process.stderr.write(`[workflow] failed to load start context for ${n}: ${e?.message ?? String(e)}\n`);
+			return;
+		}
+	}, d = (e.discovered.workflows?.length ?? 0) > 0 ? _t(() => i) : void 0, f = (e.discovered.workflows?.length ?? 0) > 0 || (e.discovered.eventTriggers?.length ?? 0) > 0, p = f || (e.discovered.workflowWorkers?.length ?? 0) > 0 || e.scheduleCoordination === "cluster", te = e.tenantIsolation === "namespace", ne = (e.log ?? P({ scope: "voltro:serve" })).child("webhooks"), re, g = e.discovered.webhooks;
+	if (g && g.outgoing.length > 0 && e.workflowEngineLayer !== void 0) {
+		let t = e.workflowEngineLayer, i = w({
+			store: e.store,
+			schemaRegistry: e.schemaRegistry,
+			cache: n,
+			kv: r
+		}), a = g.outgoing.map((e) => e.descriptor);
+		re = gn(i, async (e) => {
+			let n = vn.execute(e).pipe(M.provide(vn.toLayer(hn(i, { events: a })).pipe(N.provideMerge(t))));
+			M.runPromise(n).catch((t) => {
+				ne.error("deliverWebhook workflow crashed", {
+					deliveryId: e.deliveryId,
+					targetId: e.targetId
+				}, t);
+			});
+		}, { events: a });
+	}
+	let ae = /* @__PURE__ */ new Map();
+	if (g) for (let e of g.incoming) {
+		let t = e.descriptor.path ?? _n(e.descriptor.id), n = `VOLTRO_WEBHOOK_SECRET_${e.descriptor.id.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`, r = yn(e.descriptor, {
+			resolveSecret: async () => process.env[n] ?? null,
+			resolveWorkflows: () => d === void 0 ? void 0 : z(d, {
+				traceId: `incoming:${e.descriptor.id}`,
+				source: `incoming:${e.descriptor.id}`
+			}),
+			log: (e) => {
+				let t = {
+					webhookId: e.webhookId,
+					status: e.status,
+					signatureOk: String(e.signatureOk),
+					idempotency: e.idempotency,
+					durationMs: e.durationMs
+				};
+				e.status >= 500 ? ne.error("incoming delivery failed", t) : e.status >= 400 ? ne.warn("incoming delivery rejected", t) : ne.info("incoming delivery handled", t);
+			}
+		});
+		ae.set(t, { handle: r });
+	}
+	R(), Ft((t) => ct(e.store, t.subjectId, t.resourceType, t.resourceId));
+	let oe = (e.discovered.outboxHandlers?.length ?? 0) > 0 ? ie({
+		handlers: e.discovered.outboxHandlers ?? [],
+		store: e.store,
+		log: (e.log ?? P({ scope: "voltro:serve" })).child("outbox")
+	}) : void 0, v = _({
+		definitions: (e.discovered.connections ?? []).map((e) => e.definition),
+		store: e.store,
+		publicUrl: h(e.port ?? 4e3),
+		log: (e.log ?? P({ scope: "voltro:serve" })).child("connections")
+	});
+	S({
+		events: e.discovered.events ?? [],
+		rpcTags: [
+			...e.discovered.queries.map((e) => e.descriptor.name),
+			...e.discovered.mutations.map((e) => e.descriptor.name),
+			...e.discovered.actions.map((e) => e.descriptor.name),
+			...(e.discovered.streams ?? []).map((e) => e.descriptor.name)
+		]
+	});
+	let ce = (e.log ?? P({ scope: "voltro:serve" })).child("events"), le = e.broadcastNamespace ?? he(e.plugins, void 0), fe = Ie(e.plugins, le, ce), pe = e.membership?.instanceId ?? process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, me = e.membership ?? Re(e.plugins, {
+		instanceId: pe,
+		namespace: le,
+		meta: { mode: "serve" },
+		logger: ce
+	}), b = Le({
+		events: e.discovered.events ?? [],
+		origin: pe,
+		...fe.publishRemote === void 0 ? {} : { publishRemote: fe.publishRemote }
+	}), ge = (e.discovered.events ?? []).length > 0 ? await fe.attach(b.bus) : null, C = ye({
+		store: e.store,
+		schemaRegistry: e.schemaRegistry,
+		cache: n,
+		kv: r,
+		...re === void 0 ? {} : { webhooksService: re },
+		...d === void 0 ? {} : { workflowsProxy: d },
+		eventTriggers: e.discovered.eventTriggers ?? [],
+		namespaceIsolationOn: te,
+		...oe === void 0 ? {} : { outbox: { nudge: oe.nudge } },
+		...v.active ? { connections: { registry: v.registry } } : {},
+		eventBus: b.bus
+	}), _e = N.succeed(Je, m), ve = (t, n) => {
+		let r = t.pipe(M.provide(gt(n)));
+		return (e.baseLayer ? r.pipe(M.provide(e.baseLayer)) : r).pipe(M.provide(_e));
+	}, be = (e, t) => Mt(ve(e, t)), xe = yt({
+		store: e.store,
+		buildContext: (e, t, n) => C(e, t, n),
+		runEffect: be,
+		undoCapture: Ee()
+	}), Se = y(), Ce = lt({
+		buildContext: (e) => C(e),
+		runEffect: be
+	}), we = {
+		buildContext: (e) => C(e),
+		finalize: (t, n) => Ze(Qe(t, e.tenantScopedTables, n.subject.tenantId), e.softDeleteScopedTables),
+		provideEffect: ve
+	}, T = xt(we), Te = bt({
+		...we,
+		queryRows: (t) => e.store.query(t)
+	}), De = Ct({
+		...we,
+		subscribeDescriptor: (e, n, r) => t.subscribe(e, n, r),
+		subscribeComputed: (e, n, r) => t.subscribeComputed(e, n, r)
+	}), E = (e) => e.filter((e) => Zt(e.descriptor)), D = {};
+	for (let n of [
+		...E(e.discovered.queries),
+		...Se.queries,
+		...v.queries
+	]) D[n.descriptor.name] = (e) => I(T(n, e), t, `subscription.${n.descriptor.name}`, void 0, void 0, St(n, e));
+	for (let t of [
+		...E(e.discovered.mutations),
+		...Se.mutations,
+		...v.mutations
+	]) {
+		let n = vt(t.descriptor.output);
+		D[t.descriptor.name] = (r) => F(async (e, n) => xe(t, e, n), r, `mutation.${t.descriptor.name}`, n, e.idempotency);
+	}
+	for (let t of [...E(e.discovered.actions), ...v.actions]) {
+		let n = vt(t.descriptor.output);
+		D[t.descriptor.name] = (r) => F(async (e, n) => Ce(t, e, n), r, `action.${t.descriptor.name}`, n, e.idempotency);
+	}
+	let Oe = () => `public-${Math.random().toString(36).slice(2, 10)}`, ke = [
+		...e.discovered.queries.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => Te(e, t, {
+				subject: n.subject,
+				traceId: Oe()
+			}),
+			subscribe: (t, n, r) => De(e, t, {
+				subject: n.subject,
+				traceId: Oe()
+			}, r)
+		})),
+		...e.discovered.mutations.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => xe(e, t, {
+				subject: n.subject,
+				traceId: Oe()
+			})
+		})),
+		...e.discovered.actions.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => Ce(e, t, {
+				subject: n.subject,
+				traceId: Oe()
+			})
+		}))
+	], Ae = ke.length > 0 ? mn(pn(ke), {
+		store: e.store,
+		resolveSubject: (t) => e.resolveSubject(t, -1)
+	}) : [], Me = e.dataTransferSecret ?? process.env.VOLTRO_DATA_TRANSFER_SECRET, Ne = Me && Me.length >= 16 ? [{
+		method: "POST",
+		path: jn,
+		handle: zn({
+			secret: Me,
+			store: e.store,
+			...e.dataTransferSnapshot ? { snapshot: e.dataTransferSnapshot } : {},
+			assetSink: Tn(Gt()),
+			openArchive: (e) => Gn(Gt(), e)
+		})
+	}, {
+		method: "POST",
+		path: Mn,
+		handle: Un({
+			secret: Me,
+			store: e.store,
+			snapshot: e.dataTransferSnapshot ?? { tables: [] },
+			dialect: e.dataTransferDialect ?? "memory",
+			tenantTables: [...e.tenantScopedTables],
+			loadProfile: Wn,
+			assetSource: En(Gt(), e.store),
+			putArchive: async (e, t) => {
+				let { Readable: n } = await import("node:stream"), r = Gt(), i = Kt("storage", () => n.from(t()));
+				await M.runPromise(Jt(r, e, i, { contentType: "application/octet-stream" }));
+			}
+		})
+	}] : [], Pe = [
+		...e.httpRoutes ?? [],
+		...Ae,
+		...Ne,
+		...v.httpRoutes
+	];
+	Object.assign(D, b.handlers);
+	for (let t of E(e.discovered.streams ?? [])) D[t.descriptor.name] = (n) => tt((r) => {
+		let i = C(r), a = t.executor(n, i);
+		if (M.isEffect(a)) {
+			let t = a.pipe(M.provide(gt(i.store)));
+			return (e.baseLayer ? t.pipe(M.provide(e.baseLayer)) : t).pipe(M.provide(_e));
+		}
+		return typeof a == "object" && a && typeof a.then == "function" ? M.promise(() => a) : a;
+	}, `stream.${t.descriptor.name}`);
+	for (let t of e.discovered.workflows ?? []) D[t.definition.name] = (e) => F(async (e, n) => {
+		let r = n;
+		return z(d, {
+			subject: r.subject,
+			traceId: r.traceId,
+			source: "workflow-rpc"
+		}).start(t.definition.name, e);
+	}, e, `workflow.${t.definition.name}`);
+	f && (D[Y.name] = (e) => I(T({
+		descriptor: Y,
+		executor: (e) => {
+			let t = e.id;
+			return {
+				table: "_voltro_workflow_runs",
+				order: [{
+					column: "startedAt",
+					direction: "desc"
+				}],
+				predicate: Wt(H("id", t), H("executionId", t)),
+				take: 1,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${Y.name}`), D[Z.name] = (e) => I(T({
+		descriptor: Z,
+		executor: (e) => {
+			let t = e, n = [...t.tag === void 0 ? [] : [H("tag", t.tag)], ...t.status === void 0 ? [] : [H("status", t.status)]], r = Number.isFinite(t.limit) && t.limit !== void 0 ? Math.min(Math.max(Math.floor(t.limit), 1), 500) : 100;
+			return {
+				table: "_voltro_workflow_runs",
+				order: [{
+					column: "startedAt",
+					direction: "desc"
+				}],
+				predicate: n.length === 0 ? void 0 : n.length === 1 ? n[0] : V(...n),
+				take: r,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${Z.name}`), D[X.name] = (e) => I(T({
+		descriptor: X,
+		executor: (e) => {
+			let t = e.runId;
+			return {
+				table: "_voltro_workflow_run_steps",
+				order: [{
+					column: "startedAt",
+					direction: "asc"
+				}],
+				predicate: H("runId", t),
+				take: 1e3,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${X.name}`), D[nn.name] = (e) => I(T({
+		descriptor: nn,
+		executor: (e) => {
+			let t = e.runId;
+			return {
+				table: "_voltro_workflow_run_events",
+				order: [{
+					column: "occurredAt",
+					direction: "asc"
+				}],
+				predicate: H("runId", t),
+				take: 1e3,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${nn.name}`), D[J.name] = (e) => I(T({
+		descriptor: J,
+		executor: (e) => {
+			let t = e;
+			return {
+				table: "_voltro_workflow_events",
+				order: [{
+					column: "occurredAt",
+					direction: "desc"
+				}],
+				predicate: t.name === void 0 ? void 0 : H("name", t.name),
+				take: Math.max(1, Math.min(500, t.limit ?? 100)),
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${J.name}`), D[en.name] = (e) => I(T({
+		descriptor: en,
+		executor: (e) => {
+			let t = e.eventId;
+			return {
+				table: "_voltro_workflow_event_deliveries",
+				order: [{
+					column: "createdAt",
+					direction: "asc"
+				}],
+				predicate: H("eventId", t),
+				take: 500,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${en.name}`), D[$t.name] = (t) => F(async (t, n) => {
+		let r = t;
+		return await Fe(e.store, n.subject, { executionId: r.executionId }), await d.cancel(r.workflowName, r.executionId), await qe(r.workflowName, r.executionId, "workflow.cancel"), { ok: !0 };
+	}, t, `action.${$t.name}`), D[tn.name] = (t) => F(async (t, n) => {
+		let r = t;
+		return await Fe(e.store, n.subject, { executionId: r.executionId }), await d.resume(r.workflowName, r.executionId), { ok: !0 };
+	}, t, `action.${tn.name}`), D[rn.name] = (t) => F(async (t, n) => {
+		let r = t;
+		return await Fe(e.store, n.subject, { id: r.id }), d.signal({ id: r.id }, r.signalName, r.payload);
+	}, t, `action.${rn.name}`), D[an.name] = (t) => F(async (t, n) => {
+		let r = t;
+		return await Fe(e.store, n.subject, { id: r.id }), d.update({ id: r.id }, r.updateName, r.payload, r.timeoutMs === void 0 ? void 0 : { timeoutMs: r.timeoutMs });
+	}, t, `action.${an.name}`));
+	let ze = [
+		...E(e.discovered.queries).map((e) => q(e.descriptor)),
+		...E(e.discovered.mutations).map((e) => K(e.descriptor)),
+		...E(e.discovered.actions).map((e) => G(e.descriptor)),
+		...Se.queries.map((e) => q(e.descriptor)),
+		...Se.mutations.map((e) => K(e.descriptor)),
+		...v.queries.map((e) => q(e.descriptor)),
+		...v.mutations.map((e) => K(e.descriptor)),
+		...v.actions.map((e) => G(e.descriptor)),
+		...E(e.discovered.streams ?? []).map((e) => Qt(e.descriptor)),
+		...b.rpcs,
+		...(e.discovered.workflows ?? []).map((e) => zt(e.definition)),
+		...f ? [
+			q(Y),
+			q(Z),
+			q(X),
+			q(nn),
+			q(J),
+			q(en),
+			G($t),
+			G(tn),
+			G(rn),
+			G(an)
+		] : []
+	], Ve = Vt.make(...ze).middleware(U).middleware(W), He = N.succeed(U, U.of(({ headers: t, clientId: n }) => M.promise(() => e.resolveSubject(t, n)))), Ue = N.succeed(W, W.of(({ headers: e, clientId: t }) => M.succeed({
+		clientId: t,
+		...e["idempotency-key"] ? { idempotencyKey: e["idempotency-key"] } : {}
+	}))), k = e.dormancyTenantId ?? "default", We = e.dormancy === "sleep" ? {
+		register: (t, n, r) => B(e.store, {
+			tenantId: r ?? k,
+			kind: "workflow",
+			refId: t,
+			wakeAt: n
+		}),
+		cancel: (t, n) => rt(e.store, {
+			tenantId: n ?? k,
+			kind: "workflow",
+			refId: t
+		}).then(() => {})
+	} : void 0, A = p ? await import("@voltro/workflow") : void 0, j = A?.makeWorkflowRunRecorder({
+		store: e.store,
+		...We === void 0 ? {} : { wakeups: We }
+	}), Ge = async (t, n) => {
+		await A.closeWorkflowChildrenForParent({
+			store: e.store,
+			parentExecutionId: t,
+			parentStatus: n,
+			recorder: j,
+			log: { warn: (e, t) => {
+				process.stderr.write(`[workflow] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+			} },
+			interruptChild: async (t, n) => {
+				let r = (e.discovered.workflows ?? []).find((e) => e.definition.name === t);
+				if (!r) throw Error(`Unknown child workflow: ${t}`);
+				if (!a) throw Error("Workflow runtime is not ready");
+				await a.runPromise(r.definition.interrupt(n));
+			}
+		});
+	}, qe = async (t, n, r) => {
+		let i = (await e.store.query({
+			table: "_voltro_workflow_runs",
+			order: [],
+			predicate: H("executionId", n),
+			projection: void 0,
+			skip: void 0,
+			take: 1
+		}))[0];
+		if (i === void 0) return;
+		let a = await e.store.update("_voltro_workflow_runs", i.id, {
+			status: "cancelled",
+			cancelled: !0,
+			completedAt: /* @__PURE__ */ new Date()
+		}), o = i.subject?.tenantId ?? void 0;
+		a && await j.recordEvent({
+			runId: i.id,
+			eventType: "run-cancelled",
+			payload: {
+				reason: r,
+				workflowName: t,
+				executionId: n,
+				...o == null ? {} : { tenantId: o }
+			}
+		}), a && await Ge(n, "cancelled");
+	}, Xe = [...Et(e.discovered.workflows ?? [], {
+		buildContext: (t, n) => e.buildContextForWorkflow?.(t, n) ?? C({
+			subject: t.subject,
+			traceId: t.traceId
+		}, e.store, void 0, `workflow:${n.workflowName}`, { parentExecutionId: n.executionId }),
+		resolveStartContext: u
+	}, (t, n, r) => {
+		let i = A.getWorkflowVersionMetadata(t.definition);
+		return A.wrapWorkflowExecuteWithRunRecording({
+			name: t.definition.name,
+			store: e.store,
+			subject: r.subject,
+			source: r.source ?? null,
+			traceId: r.traceId,
+			workflowVersion: i.version,
+			workflowCompatibleVersions: i.compatibleWith,
+			workflowPatches: i.patches,
+			parentExecutionId: r?.parentExecutionId ?? null,
+			parentClosePolicy: r?.parentClosePolicy ?? null,
+			onParentClose: ({ executionId: e, status: t }) => Ge(e, t),
+			recorder: j,
+			recordRun: At
+		}, n);
+	}), ...e.discovered.workflowWorkers ?? []], $e = Xe.length > 0 ? N.mergeAll(...Xe) : N.empty;
+	if (((e.discovered.workflows?.length ?? 0) > 0 || (e.discovered.workflowWorkers?.length ?? 0) > 0 || e.scheduleCoordination === "cluster") && e.workflowEngineLayer !== void 0) {
+		let t = $e.pipe(N.provideMerge(e.workflowEngineLayer));
+		a = Ke.make(e.baseLayer === void 0 ? t : t.pipe(N.provideMerge(e.baseLayer))), await a.runPromise(M.void), i = (e.discovered.workflows?.length ?? 0) > 0 ? Tt({
+			workflows: e.discovered.workflows ?? [],
+			runEffect: (e) => a.runPromise(e),
+			rememberStartContext: l,
+			signal: async (t, n, r) => {
+				let i = await A.sendWorkflowSignal({
+					store: e.store,
+					recorder: j,
+					target: t,
+					signalName: n,
+					payload: r
+				});
+				return await a.runPromise(A.completeSuspendingSignal({
+					store: e.store,
+					target: t,
+					signalName: n,
+					payload: r
+				})).catch(() => {}), i;
+			},
+			update: (t, n, r, i) => A.sendWorkflowUpdate({
+				store: e.store,
+				recorder: j,
+				target: t,
+				updateName: n,
+				payload: r,
+				...i === void 0 ? {} : { options: i }
+			}),
+			listRuns: (t) => O(e.store, t),
+			retry: (t, n) => de({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runPromise: (e) => a.runPromise(e)
+			}, t, n)
+		}) : void 0;
+	}
+	let it = N.mergeAll(Ve.toLayer(D), He, Ue), at = je(D, e.discovered.queries.map((e) => e.descriptor.name), f), ot = N.mergeAll(Ve.toLayer(at), He, Ue), L = e.observability, st = await nt({
+		...L && L.spanProcessors.length > 0 ? { extraSpanProcessors: L.spanProcessors } : {},
+		...L && L.metricReaders.length > 0 ? { extraMetricReaders: L.metricReaders } : {},
+		...L && Object.keys(L.resourceAttributes).length > 0 ? { resourceAttributes: L.resourceAttributes } : {},
+		...L && L.sampler !== void 0 ? { sampler: L.sampler } : {}
+	}), dt = !1, ft = e.store.ping ? () => e.store.ping().then(() => !0).catch(() => !1) : void 0, { server: pt, shutdown: mt } = Lt({
+		group: Ve,
+		handlersLayer: it,
+		httpHandlersLayer: ot,
+		port: e.port ?? 4e3,
+		...e.host === void 0 ? {} : { host: e.host },
+		path: e.path ?? "/ws",
+		tracerLayer: st.layer,
+		healthCheck: {
+			isReady: () => dt,
+			...ft ? { ping: ft } : {}
+		},
+		...Pe.length > 0 ? { httpRoutes: Pe } : {},
+		...e.getStore === void 0 ? {} : { getStore: e.getStore },
+		...ae.size > 0 ? { webhookRoutes: ae } : {},
+		...e.inspectRoute === void 0 ? {} : { inspectRoute: e.inspectRoute }
+	});
+	if (await et(pt), (e.discovered.schedules?.length ?? 0) > 0) {
+		let t = (e.scheduleCoordination ?? "single") === "advisoryLock" ? ut(e.store, e.scheduleReplicaId ?? `pid-${process.pid}`) : It;
+		o = await Rt(e.discovered.schedules ?? [], {
+			store: e.store,
+			coordinator: t,
+			defaultTrigger: e.scheduleDefaultTrigger ?? "self",
+			replicaId: e.scheduleReplicaId ?? `pid-${process.pid}`,
+			armSelf: e.scheduleArmSelf ?? !0,
+			dormancy: e.dormancy ?? "always-on",
+			...e.dormancyTenantId === void 0 ? {} : { dormancyTenantId: e.dormancyTenantId },
+			buildContext: ({ traceId: t, scheduleName: n, subject: r }) => C({
+				subject: r,
+				traceId: t
+			}, e.store, void 0, `schedule:${n}`),
+			log: {
+				info: (e, t) => {
+					process.stdout.write(`[schedule] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+				},
+				warn: (e, t) => {
+					process.stderr.write(`[schedule] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+				},
+				error: (e, t) => {
+					process.stderr.write(`[schedule] ERROR ${e} ${t ? JSON.stringify(t) : ""}\n`);
+				},
+				debug: () => {}
+			},
+			...e.scheduleFireInterceptor === void 0 ? {} : { interceptFire: e.scheduleFireInterceptor },
+			...e.onScheduleRunEvent === void 0 ? {} : { onRunEvent: e.onScheduleRunEvent }
+		}), e.onSchedulerReady?.(o);
+	}
+	let ht = e.log ?? P({ scope: "voltro:serve" }), wt, Ot;
+	if ((e.discovered.subscribers?.length ?? 0) > 0 && (wt = x(e.discovered.subscribers ?? [], e.store, ht.child("subscribe"), e.schemaRegistry, b.bus)), (e.discovered.reactions?.length ?? 0) > 0) {
+		let t = ht.child("reaction");
+		Ot = Be(e.discovered.reactions ?? [], e.store, {
+			runAct: async (n, r) => {
+				if (n.kind === "workflow") {
+					if (d === void 0) {
+						t.warn("reaction workflow act skipped — no workflow engine in this app", { workflow: n.workflow });
+						return;
+					}
+					let e = r.new ?? r.old ?? {};
+					await z(d, {
+						traceId: `reaction:${n.workflow}`,
+						source: `reaction:${n.workflow}`
+					}).start(n.workflow, e);
+					return;
+				}
+				await ee(n.agent, r, {
+					findAgentSend: (t) => e.discovered.actions.find((e) => e.descriptor.name === `${t}.send`),
+					runAction: (e, t, n) => Promise.resolve(Ce(e, t, n)),
+					makeSubject: (e) => Xt(e),
+					now: () => Date.now(),
+					log: t
+				});
+			},
+			checkBudget: async (n, r) => {
+				try {
+					let { requireAiBudget: t } = await import("@voltro/ai");
+					return (await M.runPromise(M.either(t(e.store, {
+						tenantId: n,
+						limitUsd: r
+					}))))._tag === "Right";
+				} catch (e) {
+					return t.warn("reaction budget check failed — refusing the act", { tenantId: n }, e), !1;
+				}
+			}
+		}, t);
+	}
+	let jt;
+	return (e.discovered.aggregates?.length ?? 0) > 0 && (jt = await se({
+		discovered: e.discovered.aggregates ?? [],
+		store: e.store,
+		log: ht.child("aggregate"),
+		...e.analytics === void 0 ? {} : { analytics: e.analytics },
+		...e.aggregateStorage === void 0 ? {} : { storage: e.aggregateStorage },
+		...e.aggregateCoordinator === void 0 ? {} : { coordinator: e.aggregateCoordinator }
+	}), _e = N.succeed(Je, jt.registry)), dt = !0, e.bootTiming?.mark("ready"), {
+		dispatcher: t,
+		server: pt,
+		scheduler: o,
+		eventsSnapshot: ue(b.bus, b.declared),
+		membersSnapshot: () => ({
+			members: me.membership.list(),
+			capturedAt: Date.now()
+		}),
+		close: async () => {
+			dt = !1, await ge?.detach(), await me.detach(), jt?.detach(), Ot?.(), wt?.(), await o?.shutdown(), t.close(), await a?.dispose(), await new Promise((e) => pt.close(() => e())), await mt();
+		}
+	};
+}, $ = P({ scope: "voltro:serve" }), Jn = (e, t, n) => (e === "production" || e === "staging") && t !== "memory" && n !== "0", Yn = k, Xn = async (e) => {
+	let t = He(process.cwd());
+	if (qe(t)) {
+		let n;
+		try {
+			let e = await import(j(t).href);
+			typeof e.runServe == "function" ? n = e.runServe : $.warn("serve bundle has no runServe export — using the standard serve path");
+		} catch (e) {
+			$.warn("serve bundle failed to load — using the standard serve path", {}, e);
+		}
+		if (n) return $.info("serve: booting from the precompiled serve bundle"), n(e);
+	}
+	return Zn(e);
+}, Zn = async (ee) => {
+	let m = Ue();
+	process.env.NODE_ENV || (process.env.NODE_ENV = "production");
+	try {
+		on();
+	} catch (e) {
+		throw An(e instanceof Error ? e.message : String(e));
+	}
+	let h = process.cwd(), ie = Number(process.env.PORT ?? Yn(ee, "--port") ?? 4e3), _ = await _e(h);
+	Nt(jt(_?.secrets)), await e({
+		rawEnv: _?.env,
+		appType: "api",
+		root: h,
+		log: $,
+		generateTypes: !1
+	}), m.mark("config");
+	let y = (process.env.DB_DIALECT ?? _?.store ?? "memory").toLowerCase(), se = (y === "mariadb" || y === "postgres" || y === "mssql") && (process.env.CDC ?? "1") !== "0", ue = y === "mariadb" ? "mariadb" : y === "mssql" ? "mssql" : void 0, de = Ve(h);
+	if (!i() && qe(de)) try {
+		let e = await import(j(de).href);
+		if (e.modules) {
+			let t = {};
+			for (let [n, r] of Object.entries(e.modules)) t[A(h, n)] = r;
+			r(t), $.info("precompiled api bundle loaded", { modules: Object.keys(t).length });
+		}
+	} catch (e) {
+		$.warn("precompiled api bundle failed to load — falling back to source", {}, e);
+	}
+	let x = await Ce(h), S = await Pe(x, { cdc: se && ue !== void 0 });
+	{
+		let e = me(S.serverOnlyLeaks, fe(process.env, "strict"), L, "`voltro serve`");
+		if (e.action === "fail") throw An(e.message ?? "");
+		e.action === "warn" && $.warn(e.message ?? "");
+	}
+	let ye = x.filter((e) => Te.test(e)), w = ye.length > 0 ? await oe(ye, $.child("webhooks")) : {
+		outgoing: [],
+		incoming: [],
+		providers: []
+	}, Ee = v(S.events), je = w.outgoing.length + w.incoming.length + w.providers.length + Ee.length === 0 ? void 0 : {
+		...w,
+		outgoing: [...w.outgoing, ...Ee]
+	}, Fe = s({
+		mix: S.featureMix,
+		plugins: _?.plugins ?? [],
+		cdc: se && ue !== void 0,
+		...ue ? { cdcDialect: ue } : {}
+	}), Ie = _?.analytics !== void 0 && _.analytics.kind !== "noop" && y !== "memory" ? (await n(y)).makeSqlLayer(D()) : void 0, O = await f({
+		spec: _?.analytics,
+		sqlLayer: Ie,
+		log: $
+	}), Le = (() => {
+		let e = new Set(S.tables.map((e) => e.tableName)), t = [...S.tables];
+		for (let n of [...Fe, ...O.tables]) e.has(n.tableName) || (e.add(n.tableName), t.push(n));
+		return t;
+	})();
+	for (let e of Le) Ut(e);
+	let Be = (process.env.NODE_ENV ?? "").toLowerCase();
+	if (Jn(Be, y, process.env.VOLTRO_AUTO_MIGRATE)) {
+		let e = (await n(y)).makeSqlLayer(D()), t = await M.runPromise(Ht.SqlClient.pipe(M.flatMap((e) => dn(e, Le, {
+			appliedBy: `serve:${Be}`,
+			environment: "prod",
+			dialectId: y
+		})), M.provide(e)));
+		t.kind === "prod-mismatch" && ($.error(un(t, y)), $.error("serve: refusing to boot — apply the schema first (voltro db apply in a pre-deploy step), or set VOLTRO_AUTO_MIGRATE=0 to bypass this check."), process.exit(1)), $.info(un(t, y));
+	}
+	let He = wt(Le);
+	m.mark("discover");
+	let k = await T(_, void 0), P = Bt(k, y);
+	for (let e of ge({
+		dialect: String(_?.store ?? process.env.DB_DIALECT ?? "postgres"),
+		changeStrategy: (process.env.CDC ?? "1") === "0" ? "inline" : "cdc",
+		dbUrl: process.env.DB_URL,
+		tables: S.tables.map((e) => ({
+			tableName: e.tableName,
+			isReactive: e.isReactive === !0
+		})),
+		querySources: S.queries.flatMap((e) => {
+			let t = e.descriptor.source;
+			return t === void 0 ? [] : typeof t == "string" ? [t] : [...t];
+		})
+	})) e.level === "warn" ? $.warn(e.message) : $.info(e.message);
+	{
+		let e = Se(we({
+			tables: S.tables.map((e) => ({ tableName: e.tableName })),
+			queries: S.queries.map((e) => ({
+				name: e.descriptor.name,
+				source: e.descriptor.source
+			}))
+		}));
+		e !== void 0 && $.warn(e);
+	}
+	_?.cache && !process.env.CACHE_BACKEND && (process.env.CACHE_BACKEND = _.cache), _?.cacheRedisUrl && !process.env.CACHE_REDIS_URL && (process.env.CACHE_REDIS_URL = _.cacheRedisUrl), _?.cacheRedisDriver && !process.env.CACHE_REDIS_DRIVER && (process.env.CACHE_REDIS_DRIVER = _.cacheRedisDriver), _?.cacheKeyPrefix && !process.env.CACHE_KEY_PREFIX && (process.env.CACHE_KEY_PREFIX = _.cacheKeyPrefix);
+	let { service: Je, invalidationBus: Ye, snapshotCache: Ze, cache: Qe, backend: et, dispose: F } = await E({ env: process.env });
+	$.info(`cache backend resolved: ${et}` + (et === "redis" ? ` (driver ${process.env.CACHE_REDIS_DRIVER ?? "resp"})` : " — in-process, not cross-instance")), k.onChange((e) => {
+		M.runFork(Ye.publish(e.table));
+	}), _?.kv && !process.env.KV_BACKEND && (process.env.KV_BACKEND = _.kv), _?.kvRedisUrl && !process.env.KV_REDIS_URL && (process.env.KV_REDIS_URL = _.kvRedisUrl), _?.kvKeyPrefix && !process.env.KV_KEY_PREFIX && (process.env.KV_KEY_PREFIX = _.kvKeyPrefix);
+	let { kv: tt, service: I } = await mt({ store: k });
+	m.mark("store");
+	let nt = $e({
+		store: k,
+		sink: O.sink,
+		log: $
+	}), rt = Oe({
+		store: k,
+		dialect: y
+	}), R = _?.plugins ?? [], ct = process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, lt, gt;
+	y !== "memory" && (lt = Ke.make((await n(y)).makeSqlLayer(D())), gt = await lt.runPromise(Ht.SqlClient));
+	let _t = ht({
+		coordinator: [
+			"postgres",
+			"mariadb",
+			"mysql",
+			"mssql"
+		].includes(y) ? ut(k, ct, $) : It,
+		replicaId: ct,
+		log: $
+	}), vt = [], yt = process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, bt = xn(_?.plugins ?? [])?.broadcast?.provider, xt = he(_?.plugins, _?.name ?? We(h)), St = Re(_?.plugins, {
+		instanceId: yt,
+		namespace: xt,
+		meta: { mode: "serve" },
+		logger: $
+	}), Ct = {
+		...gt ? { sql: gt } : {},
+		instanceId: yt,
+		membership: St.membership,
+		...bt === void 0 ? {} : { broadcast: bt },
+		broadcastChannels: { presence: bn(xt, "presence") },
+		scheduleCoordinated: (e, t, n) => {
+			let r = _t(e, t, n);
+			return vt.push(r), r;
+		}
+	};
+	for (let e of R) e.bindDataStore?.(k, Ct);
+	let Tt = R.filter((e) => typeof e.onChangeEvent == "function");
+	if (Tt.length > 0) {
+		let e = k.changeScope ?? "local";
+		k.onChange((t) => {
+			let n = re(t, e);
+			for (let e of Tt) M.runFork(e.onChangeEvent(n).pipe(M.catchAllCause((t) => M.sync(() => $.warn(`plugin ${e.name} onChangeEvent failed`, { error: Ge.pretty(t) })))));
+		});
+	}
+	let z = te({
+		plugins: R,
+		appName: _?.name ?? "voltro-api",
+		appType: "api",
+		voltroVersion: process.env.npm_package_version ?? "0.0.0",
+		log: $
+	});
+	R.length && await z.activate(), m.mark("plugins");
+	let Et = await z.gatherObservability(), Dt = {
+		info: (e, t) => process.stdout.write(`[broadcast] ${e} ${t ? JSON.stringify(t) : ""}\n`),
+		warn: (e, t) => process.stderr.write(`[broadcast] ${e} ${t ? JSON.stringify(t) : ""}\n`),
+		debug: () => {}
+	}, kt, At = await xe(k, _, y, xt, Dt, (e, t) => {
+		kt?.refreshAll(`broadcast gap: missed ${t} change(s) from ${e}`);
+	}), B = _?.apiKeys, Mt = (typeof B == "object" ? B.prefix : void 0) ?? "voltro_", Pt = B ? at(k) : void 0, Ft = Pt ? ft({ flush: pt(Pt) }) : void 0;
+	Ft && Ot(() => Ft.shutdown());
+	let Lt = Pt ? dt(Pt, {
+		prefix: Mt,
+		...Ft ? { usage: Ft } : {}
+	}) : void 0, Rt = Lt ? [st(Lt, { prefix: Mt })] : [], zt = Ae([..._?.auth?.strategies ?? [], ...Rt], fn(_?.plugins ?? []), _?.auth?.anonymousTenantRequired ?? !1, _?.auth?.resolveScopes, () => P), Vt = [..._?.restRoutes ?? [], ...Lt ? Xe(Lt, (typeof B == "object" ? B.managementPath : void 0) ?? "/v1/api-keys") : []], V = _?.idempotency, H = V ? {
+		store: ot(k),
+		header: (typeof V == "object" ? V.header : void 0) ?? "Idempotency-Key",
+		ttlMs: (typeof V == "object" ? V.ttlMs : void 0) ?? 864e5
+	} : void 0, Wt = Vt.length > 0 ? mn(Vt, {
+		store: k,
+		resolveSubject: (e) => zt({
+			headers: e,
+			clientId: -1
+		}),
+		...H ? { idempotency: H } : {}
+	}) : [], Gt = R.map((e) => e.services).filter((e) => e !== void 0), Kt = N.mergeAll(De({
+		analyticsLayer: O.layer,
+		cacheService: Je,
+		kvService: I,
+		pluginServices: Gt,
+		userLayers: _?.layers ?? []
+	}), ve(_?.http ?? {})), qt = _?.scheduling ?? {}, Jt = qt.trigger ?? "self", Yt = /* @__PURE__ */ new Set([
+		"postgres",
+		"mysql",
+		"mariadb",
+		"mssql"
+	]), U = qt.coordination ?? (Yt.has(y) ? "advisoryLock" : "single"), W = U === "cluster" && Yt.has(y), G = W ? "cluster" : U === "advisoryLock" && Yt.has(y) ? "advisoryLock" : "single";
+	U === "cluster" && !W && $.warn("scheduling.coordination=cluster needs a sql-backed store except sqlite — falling back to single"), U === "advisoryLock" && !Yt.has(y) && $.warn("scheduling.coordination=advisoryLock needs a SQL store (the claim-row gate) — falling back to single");
+	let Xt, Zt = S.workflows.length > 0 || S.workflowWorkers.length > 0 || S.eventTriggers.length > 0 || (je?.outgoing.length ?? 0) > 0 || W, K;
+	if (Zt) {
+		if (y === "mssql") {
+			let e = await ce(process.cwd());
+			e && $.warn(e);
+		}
+		let [{ WorkflowEngine: e }, { makeClusterCronLayer: t, workflowEngineLayer: r, resolveRunnerStorage: i }] = await Promise.all([import("@effect/workflow"), import("@voltro/workflow/cluster")]), a = W ? S.schedules.filter((e) => (e.trigger ?? Jt) === "self").map((e) => t({
+			name: e.name,
+			cron: it(e),
+			execute: async () => {
+				await Xt?.fireFromCluster(e.name);
+			}
+		})) : [];
+		K = y === "memory" ? e.layerMemory : await (async () => {
+			let e = await n(y), t = i({ sqliteFamily: e.id === "sqlite" || e.id === "turso" });
+			return $.info(`workflow engine: cluster-${t}, dialect=${e.id}` + (t === "memory" ? " — single-process durable replay, no cross-pod shard handoff" + (e.id !== "sqlite" && e.id !== "turso" ? " (VOLTRO_WORKFLOW_RUNNER_STORAGE=memory: SqlRunnerStorage/cluster_runners + GET_LOCK skipped)" : "") : "")), r({
+				sqlClientLayer: e.makeSqlLayer(D()),
+				runnerStorage: t,
+				dialectId: e.id,
+				...process.env.VOLTRO_WORKFLOW_RUNNER_PORT ? { runnerListenPort: Number(process.env.VOLTRO_WORKFLOW_RUNNER_PORT) } : {},
+				...a.length > 0 ? { extraShardingLayers: a } : {}
+			});
+		})();
+	}
+	let q = ne(R, t()), Qt = x.filter((e) => /\.subscribe\.tsx?$/.test(e)), $t = Qt.length > 0 ? await b(Qt, $) : [], J = x.filter((e) => /\.reaction\.tsx?$/.test(e)), en = J.length > 0 ? await pe(J, $) : [], tn = x.filter((e) => u.test(e)), nn = tn.length > 0 ? await ke(tn, $) : [], Y = x.filter((e) => /\.aggregate\.tsx?$/.test(e)), X = Y.length > 0 ? await g(Y, $) : [], Z = ae();
+	if (X.length > 0 && y !== "memory") try {
+		Z = le((await n(y)).makeSqlLayer(D()));
+	} catch (e) {
+		$.warn("aggregate: SQL storage init failed — falling back to in-process", { err: String(e) });
+	}
+	let rn = y === "memory" ? It : ut(k, `aggregate@${process.pid}`, $), an = [], sn = [], cn = x.filter((e) => l.test(e));
+	if (cn.length > 0) {
+		let e = $.child("agent"), t = x.filter((e) => a.test(e));
+		t.length > 0 && await o(t, e);
+		let n = await c(cn, e);
+		for (let e of n.agents) for (let t of p(e)) (t.kind === "action" ? an : sn).push({
+			file: t.file,
+			descriptor: t.descriptor,
+			executor: t.executor
+		});
+		n.agents.length > 0 && e.info("synthesized agent routes", { agents: n.agents.map((e) => e.descriptor.name) });
+	}
+	m.mark("workflow");
+	let pn = await qn({
+		bootTiming: m,
+		broadcastNamespace: xt,
+		membership: {
+			...St,
+			instanceId: yt
+		},
+		..._?.plugins === void 0 ? {} : { plugins: _.plugins },
+		...H ? { idempotency: {
+			store: H.store,
+			ttlMs: H.ttlMs
+		} } : {},
+		discovered: {
+			queries: [...S.queries, ...sn],
+			mutations: S.mutations,
+			actions: [...S.actions, ...an],
+			streams: S.streams,
+			events: S.events,
+			workflows: S.workflows,
+			workflowWorkers: S.workflowWorkers,
+			eventTriggers: S.eventTriggers,
+			schedules: S.schedules,
+			subscribers: $t,
+			outboxHandlers: nn,
+			connections: S.connections,
+			reactions: en,
+			aggregates: X,
+			...je === void 0 ? {} : { webhooks: je }
+		},
+		log: $,
+		analytics: O.sink,
+		aggregateStorage: Z,
+		aggregateCoordinator: rn,
+		store: k,
+		kv: tt,
+		cache: Qe,
+		snapshotCache: Ze,
+		schemaRegistry: He,
+		tenantScopedTables: S.tenantScopedTables,
+		softDeleteScopedTables: S.softDeleteScopedTables,
+		dataTransferSnapshot: ln(Le),
+		dataTransferDialect: y,
+		tenantIsolation: (process.env.VOLTRO_TENANT_ISOLATION ?? _?.tenancy?.isolation) === "namespace" ? "namespace" : "shared-schema",
+		resolveSubject: (e, t) => zt({
+			headers: e,
+			clientId: t
+		}),
+		httpRoutes: [...R.flatMap((e) => e.httpRoutes ?? []), ...Wt],
+		getStore: () => P,
+		...Kt ? { baseLayer: Kt } : {},
+		...K === void 0 ? {} : { workflowEngineLayer: K },
+		scheduleDefaultTrigger: Jt,
+		scheduleCoordination: G,
+		scheduleArmSelf: !W,
+		dormancy: process.env.VOLTRO_DORMANCY === "sleep" || process.env.VOLTRO_DORMANCY === "always-on" ? process.env.VOLTRO_DORMANCY : _?.dormancy ?? "always-on",
+		scheduleReplicaId: process.env.HOSTNAME ?? `pid-${process.pid}`,
+		...q === void 0 ? {} : { scheduleFireInterceptor: q },
+		onSchedulerReady: (e) => {
+			Xt = e;
+		},
+		inspectRoute: { handle: (e, t, n, r) => d(e, {
+			kind: "api",
+			meta: {
+				name: _?.name ?? "voltro-api",
+				voltroVersion: Me,
+				port: ie,
+				mode: "start",
+				store: y,
+				cdc: se ? "on" : "off"
+			},
+			rpc: ze(S, h),
+			workflows: C(S, h),
+			events: () => pn.eventsSnapshot(),
+			members: () => pn.membersSnapshot(),
+			inspectFireSchedule: async ({ name: e, trigger: t }) => {
+				if (!Xt) throw Error("scheduler not started — this app registers no self-triggered schedules (all schedules are trigger:'external', or there are none).");
+				return { runId: await Xt.fireNow(e, t) ?? null };
+			}
+		}, t, {
+			method: n,
+			...r === void 0 ? {} : { body: r }
+		}) ?? {
+			status: 404,
+			contentType: "application/json",
+			body: JSON.stringify({ error: "not an inspect route" })
+		} },
+		observability: Et,
+		port: ie,
+		..._?.transport?.wsPath ? { path: _.transport.wsPath } : {}
+	});
+	return kt = pn.dispatcher, Ne(be([
+		S.queries,
+		S.mutations,
+		S.actions,
+		S.streams
+	]), (e) => {
+		$.warn(e);
+	}), $.info(`API listening on :${ie}`, {
+		dialect: y,
+		queries: S.queries.length,
+		mutations: S.mutations.length,
+		actions: S.actions.length,
+		streams: S.streams.length,
+		workflows: S.workflows.length,
+		workflowWorkers: S.workflowWorkers.length,
+		schedules: S.schedules.length,
+		scheduleCoordination: G
+	}), m.finish($), Ot(async () => {
+		for (let e of vt) e.stop();
+		nt.detach(), rt.stop(), F(), lt?.dispose();
+		try {
+			await z.deactivate(), await At?.close(), await O.dispose(), await pn.close(), await k.close?.();
+		} catch (e) {
+			console.error("serve: shutdown step failed, exiting anyway:", e);
+		}
+	}), await new Promise(() => {}), 0;
+};
+//#endregion
+export { Xn as n, Wn as r, Zn as t };