@voltro/cli 0.24.0 → 0.26.0

package/dist/serveCommand-XBXuwJty.js

@@ -0,0 +1,1294 @@
+import { ot as e, t } from "./inspectMetrics-BU90mvJN.js";
+import { s as n } from "./seedRunner-D6eu-u5U.js";
+import { r, t as i } from "./appModuleLoader-C9r9mxZt.js";
+import { $ as a, A as o, B as s, D as c, E as l, F as u, G as d, H as f, I as p, J as ee, K as m, L as te, M as ne, N as re, O as h, P as ie, R as ae, S as oe, St as se, T as ce, U as le, V as g, W as ue, X as _, Y as de, Z as fe, _ as pe, _t as v, b as y, bt as me, c as he, ct as ge, dt as b, et as x, ft as _e, g as ve, gt as ye, h as be, ht as xe, i as Se, j as S, k as Ce, lt as we, mt as C, nt as Te, o as w, pt as T, q as Ee, r as De, t as Oe, tt as ke, u as Ae, ut as je, v as Me, vt as E, w as Ne, x as D, xt as Pe, y as Fe, z as Ie } from "./dev-Dbm6SWtn.js";
+import { _ as O, f as k, m as Le, n as Re, p as ze, u as Be, v as Ve } from "./frameworkTableAssembly-BwHU9Euq.js";
+import { u as He } from "./fileConventions-3bffWssN.js";
+import { p as Ue } from "./inspect-CUCCzw2I.js";
+import { r as We, u as Ge } from "./apiBuild-BtrTyKnF.js";
+import { t as Ke } from "./bootTiming-BdyP9nYw.js";
+import { n as qe } from "./cliArgs-qdZSElM3.js";
+import { basename as Je, join as A } from "node:path";
+import { pathToFileURL as j } from "node:url";
+import { Cause as Ye, Effect as M, Layer as N, ManagedRuntime as Xe } from "effect";
+import { createLogger as P } from "@voltro/logger";
+import { existsSync as Ze } from "node:fs";
+import { AggregateRegistry as Qe, Dispatcher as $e, apiKeyManagementRoutes as et, applySoftDeleteScope as tt, applyTenantScope as nt, attachAnalyticsMirror as rt, awaitServerListening as it, bindMutation as F, bindStream as at, bindSubscription as I, buildTracingLayer as L, cancelWakeup as ot, compileCron as st, dataStoreApiKeyStore as ct, dataStoreIdempotencyStore as lt, formatServerOnlyLeaks as R, formatUnresolvedSources as ut, frameworkApiKeyStrategy as dt, installPolicyGuardResolver as ft, loadResourceTuples as pt, makeActionRunner as mt, makeAdvisoryLockCoordinator as ht, makeApiKeyService as gt, makeApiKeyUsageBuffer as _t, makeApiKeyUsageFlusher as vt, makeAsyncKv as yt, makeCoordinatedScheduler as bt, makeEffectStoreLayer as xt, makeLazyWorkflowFacade as St, makeMutationOutputCodec as Ct, makeMutationRunner as wt, makeOneShotQueryRunner as Tt, makeQueryDescriptorProducer as Et, makeQueryReauthorizer as Dt, makeQuerySubscriber as Ot, makeSchemaRegistry as kt, makeWorkflowFacade as At, makeWorkflowFacadeWithCallerContext as jt, makeWorkflowLayers as Mt, noopKv as Nt, onProcessShutdown as Pt, recordSubscriptionDelivery as z, recordWorkflowRun as Ft, registerWakeup as It, resolveSecretsBackend as Lt, runProvidedEffect as Rt, setSecretsBackend as zt, setSystemStoreHandle as Bt, setTupleSource as Vt, singleCoordinator as Ht, startRpcServer as Ut, startScheduler as Wt, workflowToRpc as B, wrapStoreWithBootCodec as Gt } from "@voltro/runtime";
+import { RpcGroup as V } from "@effect/rpc";
+import { SqlClient as Kt } from "@effect/sql";
+import { and as qt, ensureTableRegistered as Jt, eq as H, or as Yt } from "@voltro/database";
+import { appStorageProvider as U, fromNodeReadable as Xt, getObjectStream as Zt, putObjectStream as Qt, toNodeReadable as W } from "@voltro/plugin-storage";
+import { AuthMiddleware as $t, ConnectionInfoMiddleware as G, actionToRpc as K, anonymousSubject as en, isWireReachable as tn, mutationToRpc as nn, queryToRpc as q, streamToRpc as rn, workflowCancelDescriptor as an, workflowDomainEventsQueryDescriptor as J, workflowEventDeliveriesQueryDescriptor as on, workflowResumeDescriptor as sn, workflowRunEventsQueryDescriptor as Y, workflowRunQueryDescriptor as X, workflowRunStepsQueryDescriptor as cn, workflowRunsQueryDescriptor as Z, workflowSignalDescriptor as ln, workflowUpdateDescriptor as un } from "@voltro/protocol";
+import { assertProductionSessionSecret as dn, sessionExpiryFromHeaders as fn } from "@voltro/protocol/session";
+import { createHash as pn, timingSafeEqual as mn } from "node:crypto";
+import { declaredSnapshot as hn, describeOutcome as gn, runPlannedMigrations as _n } from "@voltro/database/sql";
+import { getAuthSessionStrategy as vn } from "@voltro/plugin-auth";
+import { collectPublicApiRoutes as yn, restRoutesToHttpRoutes as bn } from "@voltro/protocol/rest";
+import { buildDeliverWebhookExecute as xn, buildWebhooksService as Sn, defaultIncomingPath as Cn, deliverWebhookWorkflow as wn, mountIncomingWebhook as Tn } from "@voltro/plugin-webhooks";
+import { channelFor as En, getBroadcastPlugin as Dn } from "@voltro/plugin-broadcast";
+import { packBundle as On, runExport as kn, runImport as An, storageBlobSink as jn, storageRefsBlobSource as Mn, unpackBundle as Nn, unpackBundleToDir as Pn } from "@voltro/data-transfer";
+//#region src/bootRefusal.ts
+var Fn = "VoltroBootRefusal", In = (e) => {
+	let t = Error(e);
+	return t.name = Fn, t;
+}, Ln = "/_voltro/admin/import", Rn = "/_voltro/admin/export", Q = (e, t) => ({
+	status: e,
+	contentType: "application/json; charset=utf-8",
+	body: JSON.stringify(t)
+}), zn = (e) => {
+	let t = e.authorization ?? e.Authorization, n = t ? /^Bearer\s+(.+)$/i.exec(t) : null;
+	return n ? n[1] : null;
+}, Bn = (e, t) => mn(pn("sha256").update(e).digest(), pn("sha256").update(t).digest()), Vn = (e, t) => {
+	if (e.method.toUpperCase() !== "POST") return Q(405, { error: "method not allowed" });
+	if (!t || t.length < 16) return Q(503, { error: "data transfer misconfigured (no/weak secret)" });
+	let n = zn(e.headers);
+	return !n || !Bn(n, t) ? Q(401, { error: "unauthorized" }) : null;
+}, Hn = P({ scope: "voltro:admin-import" }), Un = "VBUNDLE2", Wn = async function* (e) {
+	yield e;
+}, Gn = (e) => async (t) => {
+	let n = Vn(t, e.secret);
+	if (n) return n;
+	let r = t.headers["x-import-mode"], i = t.headers["x-import-on-conflict"], a = t.headers["x-import-atomic"] === "1" || t.headers["x-import-atomic"] === "true", o = t.headers["x-import-force"] === "1" || t.headers["x-import-force"] === "true", s = t.rawBody.byteLength >= 8 && Buffer.from(t.rawBody.subarray(0, 8)).toString("latin1") === Un, c, l;
+	if (s) c = Wn(t.rawBody), l = "upload";
+	else {
+		let n;
+		try {
+			n = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
+		} catch {
+			return Q(400, { error: "body must be a packed bundle archive or { bundleKey } JSON" });
+		}
+		if (typeof n.bundleKey != "string" || !n.bundleKey) return Q(400, { error: "body.bundleKey (string) is required for the storage transport" });
+		if (!e.openArchive) return Q(501, { error: "storage transport not configured on this instance" });
+		c = e.openArchive(n.bundleKey), l = "storage";
+	}
+	let u = await import("node:os"), d = await import("node:fs/promises"), f = await import("node:path"), p = await d.mkdtemp(f.join(u.tmpdir(), "voltro-admin-import-"));
+	try {
+		e.assetSink ? await Nn(c, {
+			dir: p,
+			blobs: e.assetSink
+		}) : await Pn(c, p);
+		let t = await M.runPromiseExit(An({
+			store: e.store,
+			bundleDir: p,
+			...r ? { mode: r } : {},
+			...i ? { onConflict: i } : {},
+			...a ? { atomic: a } : {},
+			...e.snapshot ? { targetSnapshot: e.snapshot } : {},
+			force: o,
+			onWarn: (e) => Hn.warn("admin.import", { message: e }),
+			...e.assetSink ? { assetsAlreadyRestored: !0 } : {}
+		}));
+		if (t._tag === "Failure") {
+			let e = t.cause._tag === "Fail" ? t.cause.error : void 0;
+			if (e && e._tag === "SchemaDriftError") {
+				let t = e;
+				return Hn.warn("admin.import refused (schema drift)", {
+					transport: l,
+					bundle: t.bundleFingerprint.slice(0, 16),
+					target: t.targetFingerprint.slice(0, 16)
+				}), Q(409, {
+					error: "schema drift",
+					bundleFingerprint: t.bundleFingerprint,
+					targetFingerprint: t.targetFingerprint,
+					diff: t.diff,
+					hint: "re-export against the current schema, or resend with x-import-force: 1"
+				});
+			}
+			throw Error(String(e?.message ?? e ?? "import failed"));
+		}
+		let n = t.value, s = n.tables.reduce((e, t) => e + t.rowCount, 0);
+		return Hn.info("admin.import", {
+			transport: l,
+			tables: n.tables.length,
+			rows: s,
+			mode: r ?? "upsert",
+			atomic: a
+		}), Q(200, {
+			tables: n.tables.length,
+			rows: s,
+			transport: l
+		});
+	} catch (e) {
+		return Hn.warn("admin.import failed", {
+			transport: l,
+			error: e?.message ?? String(e)
+		}), Q(500, {
+			error: "import failed",
+			message: e?.message ?? String(e)
+		});
+	} finally {
+		await d.rm(p, {
+			recursive: !0,
+			force: !0
+		});
+	}
+}, Kn = P({ scope: "voltro:admin-export" }), qn = async (e) => {
+	let t = [];
+	for await (let n of e) t.push(Buffer.from(n));
+	return new Uint8Array(Buffer.concat(t));
+}, Jn = (e) => typeof e.tenant == "string" && e.tenant ? {
+	kind: "tenant",
+	tenantId: e.tenant
+} : Array.isArray(e.tables) && e.tables.length ? {
+	kind: "tables",
+	tables: e.tables.filter((e) => typeof e == "string")
+} : { kind: "all" }, Yn = (e) => async (t) => {
+	let n = Vn(t, e.secret);
+	if (n) return n;
+	let r;
+	try {
+		r = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
+	} catch {
+		return Q(400, { error: "body must be JSON: { profile?, tenant?, tables?, consistency?, compression?, bundleKey? }" });
+	}
+	let i = {};
+	if (typeof r.profile == "string" && r.profile) {
+		if (!e.loadProfile) return Q(501, { error: "server-side profiles not configured on this instance" });
+		try {
+			i = await e.loadProfile(r.profile);
+		} catch (e) {
+			return Q(400, {
+				error: `profile '${r.profile}' could not be loaded`,
+				message: e?.message ?? String(e)
+			});
+		}
+	}
+	let a = r.consistency === "snapshot" ? "snapshot" : i.consistency ?? "live", o = (typeof r.compression == "string" ? r.compression : void 0) ?? i.compression, s = i.scope ?? Jn(r), c = typeof r.bundleKey == "string" && r.bundleKey.length > 0, l = r.assets === !0 && e.assetSource ? { blobs: e.assetSource } : {}, u = await import("node:os"), d = await import("node:fs/promises"), f = await import("node:path"), p = await d.mkdtemp(f.join(u.tmpdir(), "voltro-admin-export-"));
+	try {
+		let t = await M.runPromise(kn({
+			store: e.store,
+			snapshot: e.snapshot,
+			dialect: e.dialect,
+			outDir: p,
+			...i.subset ? { subset: i.subset } : {
+				scope: s,
+				...e.tenantTables && e.tenantTables.length > 0 ? { tenantTables: e.tenantTables } : {}
+			},
+			consistency: a,
+			...o ? { compression: o } : {},
+			...i.masking ? { masking: i.masking } : {}
+		})), n = t.tables.reduce((e, t) => e + t.rowCount, 0), u = t.masking?.transformed.length ?? 0;
+		if (c) {
+			if (!e.putArchive) return Q(501, { error: "storage transport not configured on this instance" });
+			let i = r.bundleKey;
+			return await e.putArchive(i, () => On({
+				dir: p,
+				...l
+			})), Kn.info("admin.export", {
+				transport: "storage",
+				tables: t.tables.length,
+				rows: n,
+				masked: u,
+				bundleKey: i
+			}), Q(200, {
+				bundleKey: i,
+				tables: t.tables.length,
+				rows: n,
+				masked: u,
+				transport: "storage"
+			});
+		}
+		let d = await qn(On({
+			dir: p,
+			...l
+		}));
+		return Kn.info("admin.export", {
+			transport: "download",
+			tables: t.tables.length,
+			rows: n,
+			masked: u,
+			bytes: d.byteLength
+		}), {
+			status: 200,
+			contentType: "application/octet-stream",
+			body: d,
+			headers: {
+				"x-export-tables": String(t.tables.length),
+				"x-export-rows": String(n),
+				"x-export-masked": String(u)
+			}
+		};
+	} catch (e) {
+		return Kn.warn("admin.export failed", { error: e?.message ?? String(e) }), Q(500, {
+			error: "export failed",
+			message: e?.message ?? String(e)
+		});
+	} finally {
+		await d.rm(p, {
+			recursive: !0,
+			force: !0
+		});
+	}
+}, Xn = async (e) => {
+	let { resolve: t } = await import("node:path"), { existsSync: n } = await import("node:fs"), r = [
+		e,
+		`${e}.profile.ts`,
+		`data-profiles/${e}.ts`,
+		`data-profiles/${e}.profile.ts`
+	].map((e) => t(process.cwd(), e)), i = r.find((e) => n(e));
+	if (!i) throw Error(`data profile '${e}' not found (looked for: ${r.join(", ")})`);
+	let a = await import(i), o = a.default ?? a.profile;
+	if (!o) throw Error(`data profile '${i}' has no default export`);
+	return o;
+}, Zn = (e, t, n = {}) => (async function* () {
+	let r = await W((await M.runPromise(Zt(e, t).pipe(M.timeout(n.openTimeout ?? "30 seconds")))).stream), i = n.stallMs ?? 12e4, a, o = () => {
+		a && clearTimeout(a), a = setTimeout(() => r.destroy(/* @__PURE__ */ Error(`storage read stalled for ${i}ms reading '${t}'`)), i);
+	};
+	try {
+		o();
+		for await (let e of r) o(), yield e instanceof Uint8Array ? e : new Uint8Array(e);
+	} finally {
+		a && clearTimeout(a), r.destroy();
+	}
+})(), Qn = {
+	get: async () => void 0,
+	set: async () => {},
+	setWithTags: async () => {},
+	remove: async () => !1,
+	has: async () => !1,
+	clear: async () => {},
+	invalidateTag: async () => 0,
+	wrap: async (e, t, n) => n()
+}, $n = async (e) => {
+	Bt({
+		dataStore: e.store,
+		schemaRegistry: e.schemaRegistry
+	});
+	let t = new $e({
+		store: e.store,
+		...e.snapshotCache ? { cache: e.snapshotCache } : {},
+		recordDelivery: (e) => z({
+			label: e.label,
+			kind: e.kind,
+			durationMs: e.durationMs,
+			rowCount: e.rowCount
+		})
+	}), n = e.cache ?? Qn, r = e.kv ?? Nt, i, a, c, d, f, ee = /* @__PURE__ */ new Map(), te = () => `wfctx_${globalThis.crypto?.randomUUID?.() ?? `${Date.now().toString(36)}${Math.random().toString(36).slice(2)}`}`, ne = async (t, n, r) => {
+		let i = {
+			...r,
+			source: r.source ?? `workflow:${t}`
+		};
+		ee.set(n, i);
+		try {
+			let r = await e.store.query({
+				table: "_voltro_workflow_start_contexts",
+				order: [],
+				predicate: H("executionId", n),
+				projection: ["id"],
+				skip: void 0,
+				take: 1
+			}), a = {
+				workflowName: t,
+				executionId: n,
+				subject: i.subject ?? null,
+				traceId: i.traceId ?? null,
+				source: i.source ?? null,
+				parentExecutionId: i.parentExecutionId ?? null,
+				parentClosePolicy: i.parentClosePolicy ?? null,
+				createdAt: /* @__PURE__ */ new Date()
+			};
+			r[0] === void 0 ? await e.store.insert("_voltro_workflow_start_contexts", {
+				id: te(),
+				...a
+			}) : await e.store.update("_voltro_workflow_start_contexts", r[0].id, a);
+		} catch (e) {
+			process.stderr.write(`[workflow] failed to persist start context for ${t}/${n}: ${e?.message ?? String(e)}\n`);
+		}
+	}, re = async (t, n) => {
+		let r = ee.get(n);
+		if (r !== void 0) return r;
+		try {
+			let t = (await e.store.query({
+				table: "_voltro_workflow_start_contexts",
+				order: [],
+				predicate: H("executionId", n),
+				projection: void 0,
+				skip: void 0,
+				take: 1
+			}))[0];
+			if (t === void 0) return;
+			let r = {
+				...t.subject === null ? {} : { subject: t.subject },
+				...t.traceId === null ? {} : { traceId: t.traceId },
+				...t.source === null ? {} : { source: t.source },
+				...t.parentExecutionId === null ? {} : { parentExecutionId: t.parentExecutionId },
+				...t.parentClosePolicy === null ? {} : { parentClosePolicy: t.parentClosePolicy }
+			};
+			return ee.set(n, r), r;
+		} catch (e) {
+			process.stderr.write(`[workflow] failed to load start context for ${n}: ${e?.message ?? String(e)}\n`);
+			return;
+		}
+	}, h = (e.discovered.workflows?.length ?? 0) > 0 ? St(() => i) : void 0, ie = (e.discovered.workflows?.length ?? 0) > 0 || (e.discovered.eventTriggers?.length ?? 0) > 0, ae = ie || (e.discovered.workflowWorkers?.length ?? 0) > 0 || e.scheduleCoordination === "cluster", le = e.tenantIsolation === "namespace", ue = (e.log ?? P({ scope: "voltro:serve" })).child("webhooks"), fe, v = e.discovered.webhooks;
+	if (v && v.outgoing.length > 0 && e.workflowEngineLayer !== void 0) {
+		let t = e.workflowEngineLayer, i = T({
+			store: e.store,
+			schemaRegistry: e.schemaRegistry,
+			cache: n,
+			kv: r
+		}), a = v.outgoing.map((e) => e.descriptor);
+		fe = Sn(i, async (e) => {
+			let n = wn.execute(e).pipe(M.provide(wn.toLayer(xn(i, { events: a })).pipe(N.provideMerge(t))));
+			M.runPromise(n).catch((t) => {
+				ue.error("deliverWebhook workflow crashed", {
+					deliveryId: e.deliveryId,
+					targetId: e.targetId
+				}, t);
+			});
+		}, { events: a });
+	}
+	let me = /* @__PURE__ */ new Map();
+	if (v) for (let e of v.incoming) {
+		let t = e.descriptor.path ?? Cn(e.descriptor.id), n = `VOLTRO_WEBHOOK_SECRET_${e.descriptor.id.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`, r = Tn(e.descriptor, {
+			resolveSecret: async () => process.env[n] ?? null,
+			resolveWorkflows: () => h === void 0 ? void 0 : jt(h, {
+				traceId: `incoming:${e.descriptor.id}`,
+				source: `incoming:${e.descriptor.id}`
+			}),
+			log: (e) => {
+				let t = {
+					webhookId: e.webhookId,
+					status: e.status,
+					signatureOk: String(e.signatureOk),
+					idempotency: e.idempotency,
+					durationMs: e.durationMs
+				};
+				e.status >= 500 ? ue.error("incoming delivery failed", t) : e.status >= 400 ? ue.warn("incoming delivery rejected", t) : ue.info("incoming delivery handled", t);
+			}
+		});
+		me.set(t, { handle: r });
+	}
+	ft(), Vt((t) => pt(e.store, t.subjectId, t.resourceType, t.resourceId));
+	let he = (e.discovered.outboxHandlers?.length ?? 0) > 0 ? de({
+		handlers: e.discovered.outboxHandlers ?? [],
+		store: e.store,
+		log: (e.log ?? P({ scope: "voltro:serve" })).child("outbox")
+	}) : void 0, x = Ee({
+		definitions: (e.discovered.connections ?? []).map((e) => e.definition),
+		store: e.store,
+		publicUrl: m(e.port ?? 4e3),
+		log: (e.log ?? P({ scope: "voltro:serve" })).child("connections")
+	});
+	y({
+		events: e.discovered.events ?? [],
+		rpcTags: [
+			...e.discovered.queries.map((e) => e.descriptor.name),
+			...e.discovered.mutations.map((e) => e.descriptor.name),
+			...e.discovered.actions.map((e) => e.descriptor.name),
+			...(e.discovered.streams ?? []).map((e) => e.descriptor.name)
+		]
+	});
+	let ve = (e.log ?? P({ scope: "voltro:serve" })).child("events"), ye = e.broadcastNamespace ?? pe(e.plugins, void 0), be = Me(e.plugins, ye, ve), xe = e.membership?.instanceId ?? process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, Se = e.membership ?? Fe(e.plugins, {
+		instanceId: xe,
+		namespace: ye,
+		meta: { mode: "serve" },
+		logger: ve
+	}), S = D({
+		events: e.discovered.events ?? [],
+		origin: xe,
+		...be.publishRemote === void 0 ? {} : { publishRemote: be.publishRemote }
+	}), we = (e.discovered.events ?? []).length > 0 ? await be.attach(S.bus) : null, C = _e({
+		store: e.store,
+		schemaRegistry: e.schemaRegistry,
+		cache: n,
+		kv: r,
+		...fe === void 0 ? {} : { webhooksService: fe },
+		...h === void 0 ? {} : { workflowsProxy: h },
+		eventTriggers: e.discovered.eventTriggers ?? [],
+		namespaceIsolationOn: le,
+		...he === void 0 ? {} : { outbox: { nudge: he.nudge } },
+		...x.active ? { connections: { registry: x.registry } } : {},
+		eventBus: S.bus
+	}), Te = N.succeed(Qe, p), w = (t, n) => {
+		let r = t.pipe(M.provide(xt(n)));
+		return (e.baseLayer ? r.pipe(M.provide(e.baseLayer)) : r).pipe(M.provide(Te));
+	}, De = (e, t) => Rt(w(e, t)), Oe = wt({
+		store: e.store,
+		buildContext: (e, t, n) => C(e, t, n),
+		runEffect: De,
+		undoCapture: o()
+	}), ke = Ce(), Ae = mt({
+		buildContext: (e) => C(e),
+		runEffect: De
+	}), je = {
+		buildContext: (e) => C(e),
+		finalize: (t, n) => tt(nt(t, e.tenantScopedTables, n.subject.tenantId), e.softDeleteScopedTables),
+		provideEffect: w
+	}, E = Et(je), Pe = Tt({
+		...je,
+		queryRows: (t) => e.store.query(t)
+	}), Ie = Ot({
+		...je,
+		subscribeDescriptor: (e, n, r) => t.subscribe(e, n, r),
+		subscribeComputed: (e, n, r) => t.subscribeComputed(e, n, r)
+	}), O = (e) => e.filter((e) => tn(e.descriptor)), k = {};
+	for (let n of [
+		...O(e.discovered.queries),
+		...ke.queries,
+		...x.queries
+	]) k[n.descriptor.name] = (e) => I(E(n, e), t, `subscription.${n.descriptor.name}`, void 0, void 0, Dt(n, e));
+	for (let t of [
+		...O(e.discovered.mutations),
+		...ke.mutations,
+		...x.mutations
+	]) {
+		let n = Ct(t.descriptor.output);
+		k[t.descriptor.name] = (r) => F(async (e, n) => Oe(t, e, n), r, `mutation.${t.descriptor.name}`, n, e.idempotency);
+	}
+	for (let t of [...O(e.discovered.actions), ...x.actions]) {
+		let n = Ct(t.descriptor.output);
+		k[t.descriptor.name] = (r) => F(async (e, n) => Ae(t, e, n), r, `action.${t.descriptor.name}`, n, e.idempotency);
+	}
+	let Le = () => `public-${Math.random().toString(36).slice(2, 10)}`, Re = [
+		...e.discovered.queries.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => Pe(e, t, {
+				subject: n.subject,
+				traceId: Le()
+			}),
+			subscribe: (t, n, r) => Ie(e, t, {
+				subject: n.subject,
+				traceId: Le()
+			}, r)
+		})),
+		...e.discovered.mutations.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => Oe(e, t, {
+				subject: n.subject,
+				traceId: Le()
+			})
+		})),
+		...e.discovered.actions.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => Ae(e, t, {
+				subject: n.subject,
+				traceId: Le()
+			})
+		}))
+	], ze = Re.length > 0 ? bn(yn(Re), {
+		store: e.store,
+		resolveSubject: (t) => e.resolveSubject(t, -1)
+	}) : [], Be = e.dataTransferSecret ?? process.env.VOLTRO_DATA_TRANSFER_SECRET, Ve = Be && Be.length >= 16 ? [{
+		method: "POST",
+		path: Ln,
+		handle: Gn({
+			secret: Be,
+			store: e.store,
+			...e.dataTransferSnapshot ? { snapshot: e.dataTransferSnapshot } : {},
+			assetSink: jn(U()),
+			openArchive: (e) => Zn(U(), e)
+		})
+	}, {
+		method: "POST",
+		path: Rn,
+		handle: Yn({
+			secret: Be,
+			store: e.store,
+			snapshot: e.dataTransferSnapshot ?? { tables: [] },
+			dialect: e.dataTransferDialect ?? "memory",
+			tenantTables: [...e.tenantScopedTables],
+			loadProfile: Xn,
+			assetSource: Mn(U(), e.store),
+			putArchive: async (e, t) => {
+				let { Readable: n } = await import("node:stream"), r = U(), i = Xt("storage", () => n.from(t()));
+				await M.runPromise(Qt(r, e, i, { contentType: "application/octet-stream" }));
+			}
+		})
+	}] : [], He = [
+		...e.httpRoutes ?? [],
+		...ze,
+		...Ve,
+		...x.httpRoutes
+	];
+	Object.assign(k, S.handlers);
+	for (let t of O(e.discovered.streams ?? [])) k[t.descriptor.name] = (n) => at((r) => {
+		let i = C(r), a = t.executor(n, i);
+		if (M.isEffect(a)) {
+			let t = a.pipe(M.provide(xt(i.store)));
+			return (e.baseLayer ? t.pipe(M.provide(e.baseLayer)) : t).pipe(M.provide(Te));
+		}
+		return typeof a == "object" && a && typeof a.then == "function" ? M.promise(() => a) : a;
+	}, `stream.${t.descriptor.name}`);
+	for (let t of e.discovered.workflows ?? []) k[t.definition.name] = (e) => F(async (e, n) => {
+		let r = n;
+		return jt(h, {
+			subject: r.subject,
+			traceId: r.traceId,
+			source: "workflow-rpc"
+		}).start(t.definition.name, e);
+	}, e, `workflow.${t.definition.name}`);
+	ie && (k[X.name] = (e) => I(E({
+		descriptor: X,
+		executor: (e) => {
+			let t = e.id;
+			return {
+				table: "_voltro_workflow_runs",
+				order: [{
+					column: "startedAt",
+					direction: "desc"
+				}],
+				predicate: Yt(H("id", t), H("executionId", t)),
+				take: 1,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${X.name}`), k[Z.name] = (e) => I(E({
+		descriptor: Z,
+		executor: (e) => {
+			let t = e, n = [...t.tag === void 0 ? [] : [H("tag", t.tag)], ...t.status === void 0 ? [] : [H("status", t.status)]], r = Number.isFinite(t.limit) && t.limit !== void 0 ? Math.min(Math.max(Math.floor(t.limit), 1), 500) : 100;
+			return {
+				table: "_voltro_workflow_runs",
+				order: [{
+					column: "startedAt",
+					direction: "desc"
+				}],
+				predicate: n.length === 0 ? void 0 : n.length === 1 ? n[0] : qt(...n),
+				take: r,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${Z.name}`), k[cn.name] = (e) => I(E({
+		descriptor: cn,
+		executor: (e) => {
+			let t = e.runId;
+			return {
+				table: "_voltro_workflow_run_steps",
+				order: [{
+					column: "startedAt",
+					direction: "asc"
+				}],
+				predicate: H("runId", t),
+				take: 1e3,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${cn.name}`), k[Y.name] = (e) => I(E({
+		descriptor: Y,
+		executor: (e) => {
+			let t = e.runId;
+			return {
+				table: "_voltro_workflow_run_events",
+				order: [{
+					column: "occurredAt",
+					direction: "asc"
+				}],
+				predicate: H("runId", t),
+				take: 1e3,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${Y.name}`), k[J.name] = (e) => I(E({
+		descriptor: J,
+		executor: (e) => {
+			let t = e;
+			return {
+				table: "_voltro_workflow_events",
+				order: [{
+					column: "occurredAt",
+					direction: "desc"
+				}],
+				predicate: t.name === void 0 ? void 0 : H("name", t.name),
+				take: Math.max(1, Math.min(500, t.limit ?? 100)),
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${J.name}`), k[on.name] = (e) => I(E({
+		descriptor: on,
+		executor: (e) => {
+			let t = e.eventId;
+			return {
+				table: "_voltro_workflow_event_deliveries",
+				order: [{
+					column: "createdAt",
+					direction: "asc"
+				}],
+				predicate: H("eventId", t),
+				take: 500,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${on.name}`), k[an.name] = (t) => F(async (t, n) => {
+		let r = t;
+		return await b(e.store, n.subject, { executionId: r.executionId }), await h.cancel(r.workflowName, r.executionId), await Ze(r.workflowName, r.executionId, "workflow.cancel"), { ok: !0 };
+	}, t, `action.${an.name}`), k[sn.name] = (t) => F(async (t, n) => {
+		let r = t;
+		return await b(e.store, n.subject, { executionId: r.executionId }), await h.resume(r.workflowName, r.executionId), { ok: !0 };
+	}, t, `action.${sn.name}`), k[ln.name] = (t) => F(async (t, n) => {
+		let r = t;
+		return await b(e.store, n.subject, { id: r.id }), h.signal({ id: r.id }, r.signalName, r.payload);
+	}, t, `action.${ln.name}`), k[un.name] = (t) => F(async (t, n) => {
+		let r = t;
+		return await b(e.store, n.subject, { id: r.id }), h.update({ id: r.id }, r.updateName, r.payload, r.timeoutMs === void 0 ? void 0 : { timeoutMs: r.timeoutMs });
+	}, t, `action.${un.name}`));
+	let Ue = [
+		...O(e.discovered.queries).map((e) => q(e.descriptor)),
+		...O(e.discovered.mutations).map((e) => nn(e.descriptor)),
+		...O(e.discovered.actions).map((e) => K(e.descriptor)),
+		...ke.queries.map((e) => q(e.descriptor)),
+		...ke.mutations.map((e) => nn(e.descriptor)),
+		...x.queries.map((e) => q(e.descriptor)),
+		...x.mutations.map((e) => nn(e.descriptor)),
+		...x.actions.map((e) => K(e.descriptor)),
+		...O(e.discovered.streams ?? []).map((e) => rn(e.descriptor)),
+		...S.rpcs,
+		...(e.discovered.workflows ?? []).map((e) => B(e.definition)),
+		...ie ? [
+			q(X),
+			q(Z),
+			q(cn),
+			q(Y),
+			q(J),
+			q(on),
+			K(an),
+			K(sn),
+			K(ln),
+			K(un)
+		] : []
+	], We = V.make(...Ue).middleware($t).middleware(G), Ge = N.succeed($t, $t.of(({ headers: t, clientId: n }) => M.promise(() => e.resolveSubject(t, n)))), Ke = N.succeed(G, G.of(({ headers: e, clientId: t }) => M.sync(() => {
+		let n = fn(e);
+		return {
+			clientId: t,
+			...e["idempotency-key"] ? { idempotencyKey: e["idempotency-key"] } : {},
+			...n === void 0 ? {} : { credentialExpiresAt: n }
+		};
+	}))), qe = e.dormancyTenantId ?? "default", Je = e.dormancy === "sleep" ? {
+		register: (t, n, r) => It(e.store, {
+			tenantId: r ?? qe,
+			kind: "workflow",
+			refId: t,
+			wakeAt: n
+		}),
+		cancel: (t, n) => ot(e.store, {
+			tenantId: n ?? qe,
+			kind: "workflow",
+			refId: t
+		}).then(() => {})
+	} : void 0, A = ae ? await import("@voltro/workflow") : void 0, j = A?.makeWorkflowRunRecorder({
+		store: e.store,
+		...Je === void 0 ? {} : { wakeups: Je }
+	}), Ye = async (t, n) => {
+		await A.closeWorkflowChildrenForParent({
+			store: e.store,
+			parentExecutionId: t,
+			parentStatus: n,
+			recorder: j,
+			log: { warn: (e, t) => {
+				process.stderr.write(`[workflow] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+			} },
+			interruptChild: async (t, n) => {
+				let r = (e.discovered.workflows ?? []).find((e) => e.definition.name === t);
+				if (!r) throw Error(`Unknown child workflow: ${t}`);
+				if (!a) throw Error("Workflow runtime is not ready");
+				await a.runPromise(r.definition.interrupt(n));
+			}
+		});
+	}, Ze = async (t, n, r) => {
+		let i = (await e.store.query({
+			table: "_voltro_workflow_runs",
+			order: [],
+			predicate: H("executionId", n),
+			projection: void 0,
+			skip: void 0,
+			take: 1
+		}))[0];
+		if (i === void 0) return;
+		let a = await e.store.update("_voltro_workflow_runs", i.id, {
+			status: "cancelled",
+			cancelled: !0,
+			completedAt: /* @__PURE__ */ new Date()
+		}), o = i.subject?.tenantId ?? void 0;
+		a && await j.recordEvent({
+			runId: i.id,
+			eventType: "run-cancelled",
+			payload: {
+				reason: r,
+				workflowName: t,
+				executionId: n,
+				...o == null ? {} : { tenantId: o }
+			}
+		}), a && await Ye(n, "cancelled");
+	}, et = [...Mt(e.discovered.workflows ?? [], {
+		buildContext: (t, n) => e.buildContextForWorkflow?.(t, n) ?? C({
+			subject: t.subject,
+			traceId: t.traceId
+		}, e.store, void 0, `workflow:${n.workflowName}`, { parentExecutionId: n.executionId }),
+		resolveStartContext: re
+	}, (t, n, r) => {
+		let i = A.getWorkflowVersionMetadata(t.definition);
+		return A.wrapWorkflowExecuteWithRunRecording({
+			name: t.definition.name,
+			store: e.store,
+			subject: r.subject,
+			source: r.source ?? null,
+			traceId: r.traceId,
+			workflowVersion: i.version,
+			workflowCompatibleVersions: i.compatibleWith,
+			workflowPatches: i.patches,
+			parentExecutionId: r?.parentExecutionId ?? null,
+			parentClosePolicy: r?.parentClosePolicy ?? null,
+			onParentClose: ({ executionId: e, status: t }) => Ye(e, t),
+			recorder: j,
+			recordRun: Ft
+		}, n);
+	}), ...e.discovered.workflowWorkers ?? []], rt = et.length > 0 ? N.mergeAll(...et) : N.empty;
+	if (((e.discovered.workflows?.length ?? 0) > 0 || (e.discovered.workflowWorkers?.length ?? 0) > 0 || e.scheduleCoordination === "cluster") && e.workflowEngineLayer !== void 0) {
+		let t = rt.pipe(N.provideMerge(e.workflowEngineLayer));
+		a = Xe.make(e.baseLayer === void 0 ? t : t.pipe(N.provideMerge(e.baseLayer))), await a.runPromise(M.void);
+		let n = await import("@voltro/workflow/cluster"), r = (e) => a.runPromise(n.redriveFailedRun(e));
+		d = await se({
+			provider: Dn(e.plugins ?? [])?.broadcast?.provider,
+			crossReplica: Dn(e.plugins ?? [])?.broadcast?.crossReplica ?? !1,
+			namespace: ye,
+			replicaId: crypto.randomUUID(),
+			pollStorage: () => a.runPromise(n.pollWorkflowStorage),
+			log: (e.log ?? P({ scope: "voltro:serve" })).child("workflow")
+		}), c = async (t) => {
+			let n = await ce({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runRedrive: r
+			}, t.runId);
+			return n.statusReset && await j.recordEvent({
+				runId: t.runId,
+				eventType: "run-redriven",
+				payload: {
+					reason: "inspect.redrive",
+					activitiesReset: n.outcome.activitiesReset
+				}
+			}), {
+				redriven: n.outcome.redriven,
+				activitiesReset: n.outcome.activitiesReset,
+				reason: n.outcome.reason
+			};
+		}, i = (e.discovered.workflows?.length ?? 0) > 0 ? At({
+			workflows: e.discovered.workflows ?? [],
+			runEffect: (e) => a.runPromise(e),
+			onEnqueue: () => d?.publishWake(),
+			rememberStartContext: ne,
+			signal: async (t, n, r) => {
+				let i = await A.sendWorkflowSignal({
+					store: e.store,
+					recorder: j,
+					target: t,
+					signalName: n,
+					payload: r
+				});
+				return await a.runPromise(A.completeSuspendingSignal({
+					store: e.store,
+					target: t,
+					signalName: n,
+					payload: r
+				})).catch(() => {}), i;
+			},
+			update: (t, n, r, i) => A.sendWorkflowUpdate({
+				store: e.store,
+				recorder: j,
+				target: t,
+				updateName: n,
+				payload: r,
+				...i === void 0 ? {} : { options: i }
+			}),
+			listRuns: (t) => Ne(e.store, t),
+			retry: (t, n) => l({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runPromise: (e) => a.runPromise(e)
+			}, t, n),
+			redrive: (t) => ce({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runRedrive: r
+			}, t).then((e) => e.outcome)
+		}) : void 0;
+	}
+	let st = N.mergeAll(We.toLayer(k), Ge, Ke), ct = ge(k, e.discovered.queries.map((e) => e.descriptor.name), ie), lt = N.mergeAll(We.toLayer(ct), Ge, Ke), R = e.observability, ut = await L({
+		...R && R.spanProcessors.length > 0 ? { extraSpanProcessors: R.spanProcessors } : {},
+		...R && R.metricReaders.length > 0 ? { extraMetricReaders: R.metricReaders } : {},
+		...R && Object.keys(R.resourceAttributes).length > 0 ? { resourceAttributes: R.resourceAttributes } : {},
+		...R && R.sampler !== void 0 ? { sampler: R.sampler } : {}
+	}), dt = !1, gt = e.store.ping ? () => e.store.ping().then(() => !0).catch(() => !1) : void 0, { server: _t, shutdown: vt } = Ut({
+		group: We,
+		handlersLayer: st,
+		httpHandlersLayer: lt,
+		port: e.port ?? 4e3,
+		...e.host === void 0 ? {} : { host: e.host },
+		path: e.path ?? "/ws",
+		tracerLayer: ut.layer,
+		healthCheck: {
+			isReady: () => dt,
+			...gt ? { ping: gt } : {}
+		},
+		...He.length > 0 ? { httpRoutes: He } : {},
+		...e.getStore === void 0 ? {} : { getStore: e.getStore },
+		...me.size > 0 ? { webhookRoutes: me } : {},
+		...e.inspectRoute === void 0 ? {} : { inspectRoute: e.inspectRoute }
+	});
+	if (await it(_t), (e.discovered.schedules?.length ?? 0) > 0) {
+		let t = (e.scheduleCoordination ?? "single") === "advisoryLock" ? ht(e.store, e.scheduleReplicaId ?? `pid-${process.pid}`) : Ht;
+		f = await Wt(e.discovered.schedules ?? [], {
+			store: e.store,
+			coordinator: t,
+			defaultTrigger: e.scheduleDefaultTrigger ?? "self",
+			replicaId: e.scheduleReplicaId ?? `pid-${process.pid}`,
+			armSelf: e.scheduleArmSelf ?? !0,
+			dormancy: e.dormancy ?? "always-on",
+			...e.dormancyTenantId === void 0 ? {} : { dormancyTenantId: e.dormancyTenantId },
+			buildContext: ({ traceId: t, scheduleName: n, subject: r }) => C({
+				subject: r,
+				traceId: t
+			}, e.store, void 0, `schedule:${n}`),
+			log: {
+				info: (e, t) => {
+					process.stdout.write(`[schedule] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+				},
+				warn: (e, t) => {
+					process.stderr.write(`[schedule] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+				},
+				error: (e, t) => {
+					process.stderr.write(`[schedule] ERROR ${e} ${t ? JSON.stringify(t) : ""}\n`);
+				},
+				debug: () => {}
+			},
+			...e.scheduleFireInterceptor === void 0 ? {} : { interceptFire: e.scheduleFireInterceptor },
+			...e.onScheduleRunEvent === void 0 ? {} : { onRunEvent: e.onScheduleRunEvent }
+		}), e.onSchedulerReady?.(f);
+	}
+	let yt = e.log ?? P({ scope: "voltro:serve" }), bt, kt;
+	if ((e.discovered.subscribers?.length ?? 0) > 0 && (bt = _(e.discovered.subscribers ?? [], e.store, yt.child("subscribe"), e.schemaRegistry, S.bus)), (e.discovered.reactions?.length ?? 0) > 0) {
+		let t = yt.child("reaction");
+		kt = s(e.discovered.reactions ?? [], e.store, {
+			runAct: async (n, r) => {
+				if (n.kind === "workflow") {
+					if (h === void 0) {
+						t.warn("reaction workflow act skipped — no workflow engine in this app", { workflow: n.workflow });
+						return;
+					}
+					let e = r.new ?? r.old ?? {};
+					await jt(h, {
+						traceId: `reaction:${n.workflow}`,
+						source: `reaction:${n.workflow}`
+					}).start(n.workflow, e);
+					return;
+				}
+				await g(n.agent, r, {
+					findAgentSend: (t) => e.discovered.actions.find((e) => e.descriptor.name === `${t}.send`),
+					runAction: (e, t, n) => Promise.resolve(Ae(e, t, n)),
+					makeSubject: (e) => en(e),
+					now: () => Date.now(),
+					log: t
+				});
+			},
+			checkBudget: async (n, r) => {
+				try {
+					let { requireAiBudget: t } = await import("@voltro/ai");
+					return (await M.runPromise(M.either(t(e.store, {
+						tenantId: n,
+						limitUsd: r
+					}))))._tag === "Right";
+				} catch (e) {
+					return t.warn("reaction budget check failed — refusing the act", { tenantId: n }, e), !1;
+				}
+			}
+		}, t);
+	}
+	let Pt;
+	return (e.discovered.aggregates?.length ?? 0) > 0 && (Pt = await u({
+		discovered: e.discovered.aggregates ?? [],
+		store: e.store,
+		log: yt.child("aggregate"),
+		...e.analytics === void 0 ? {} : { analytics: e.analytics },
+		...e.aggregateStorage === void 0 ? {} : { storage: e.aggregateStorage },
+		...e.aggregateCoordinator === void 0 ? {} : { coordinator: e.aggregateCoordinator }
+	}), Te = N.succeed(Qe, Pt.registry)), dt = !0, e.bootTiming?.mark("ready"), {
+		dispatcher: t,
+		server: _t,
+		scheduler: f,
+		eventsSnapshot: oe(S.bus, S.declared),
+		membersSnapshot: () => ({
+			members: Se.membership.list(),
+			capturedAt: Date.now()
+		}),
+		redriveWorkflowRun: (e) => c ? c(e) : Promise.reject(/* @__PURE__ */ Error("redrive: this app registers no workflows")),
+		close: async () => {
+			dt = !1, await we?.detach(), await Se.detach(), Pt?.detach(), kt?.(), bt?.(), await f?.shutdown(), t.close(), await d?.detach(), await a?.dispose(), await new Promise((e) => _t.close(() => e())), await vt();
+		}
+	};
+}, $ = P({ scope: "voltro:serve" }), er = (e, t, n) => (e === "production" || e === "staging") && t !== "memory" && n !== "0", tr = qe, nr = async (e) => {
+	let t = Ge(process.cwd());
+	if (Ze(t)) {
+		let n;
+		try {
+			let e = await import(j(t).href);
+			typeof e.runServe == "function" ? n = e.runServe : $.warn("serve bundle has no runServe export — using the standard serve path");
+		} catch (e) {
+			$.warn("serve bundle failed to load — using the standard serve path", {}, e);
+		}
+		if (n) return $.info("serve: booting from the precompiled serve bundle"), n(e);
+	}
+	return rr(e);
+}, rr = async (o) => {
+	let s = Ke();
+	process.env.NODE_ENV || (process.env.NODE_ENV = "production");
+	try {
+		dn();
+	} catch (e) {
+		throw In(e instanceof Error ? e.message : String(e));
+	}
+	let l = process.cwd(), u = Number(process.env.PORT ?? tr(o, "--port") ?? 4e3), p = await he(l);
+	zt(Lt(p?.secrets)), await e({
+		rawEnv: p?.env,
+		appType: "api",
+		root: l,
+		log: $,
+		generateTypes: !1
+	}), s.mark("config");
+	let m = (process.env.DB_DIALECT ?? p?.store ?? "memory").toLowerCase(), oe = (m === "mariadb" || m === "postgres" || m === "mssql") && (process.env.CDC ?? "1") !== "0", se = m === "mariadb" ? "mariadb" : m === "mssql" ? "mssql" : void 0, ce = We(l);
+	if (!i() && Ze(ce)) try {
+		let e = await import(j(ce).href);
+		if (e.modules) {
+			let t = {};
+			for (let [n, r] of Object.entries(e.modules)) t[A(l, n)] = r;
+			r(t), $.info("precompiled api bundle loaded", { modules: Object.keys(t).length });
+		}
+	} catch (e) {
+		$.warn("precompiled api bundle failed to load — falling back to source", {}, e);
+	}
+	let g = await be(l), _ = await Ae(g, { cdc: oe && se !== void 0 });
+	{
+		let e = /* @__PURE__ */ new Set([
+			..._.queries.filter((e) => e.descriptor.overridesPlugin === !0).map((e) => e.descriptor.name),
+			..._.mutations.filter((e) => e.descriptor.overridesPlugin === !0).map((e) => e.descriptor.name),
+			..._.actions.filter((e) => e.descriptor.overridesPlugin === !0).map((e) => e.descriptor.name)
+		]);
+		O(Ve(p?.plugins ?? []), [
+			..._.queries.map((e) => e.descriptor.name),
+			..._.mutations.map((e) => e.descriptor.name),
+			..._.actions.map((e) => e.descriptor.name),
+			..._.streams.map((e) => e.descriptor.name)
+		], e);
+		let t = ut(_.unresolvedSources);
+		t !== void 0 && $.warn(t);
+		let n = d(_.serverOnlyLeaks, ue(process.env, "strict"), R, "`voltro serve`");
+		if (n.action === "fail") throw In(n.message ?? "");
+		n.action === "warn" && $.warn(n.message ?? "");
+	}
+	let de = g.filter((e) => ne.test(e)), y = de.length > 0 ? await re(de, $.child("webhooks")) : {
+		outgoing: [],
+		incoming: [],
+		providers: []
+	}, ge = ie(_.events), b = y.outgoing.length + y.incoming.length + y.providers.length + ge.length === 0 ? void 0 : {
+		...y,
+		outgoing: [...y.outgoing, ...ge]
+	}, _e = Re({
+		mix: _.featureMix,
+		plugins: p?.plugins ?? [],
+		cdc: oe && se !== void 0,
+		...se ? { cdcDialect: se } : {}
+	}), Ce = p?.analytics !== void 0 && p.analytics.kind !== "noop" && m !== "memory" ? (await n(m)).makeSqlLayer(w()) : void 0, T = await x({
+		spec: p?.analytics,
+		sqlLayer: Ce,
+		log: $
+	}), Ee = (() => {
+		let e = new Set(_.tables.map((e) => e.tableName)), t = [..._.tables];
+		for (let n of [..._e, ...T.tables]) e.has(n.tableName) || (e.add(n.tableName), t.push(n));
+		return t;
+	})();
+	for (let e of Ee) Jt(e);
+	let Me = (process.env.NODE_ENV ?? "").toLowerCase();
+	if (er(Me, m, process.env.VOLTRO_AUTO_MIGRATE)) {
+		let e = (await n(m)).makeSqlLayer(w()), t = await M.runPromise(Kt.SqlClient.pipe(M.flatMap((e) => _n(e, Ee, {
+			appliedBy: `serve:${Me}`,
+			environment: "prod",
+			dialectId: m
+		})), M.provide(e)));
+		t.kind === "prod-mismatch" && ($.error(gn(t, m)), $.error("serve: refusing to boot — apply the schema first (voltro db apply in a pre-deploy step), or set VOLTRO_AUTO_MIGRATE=0 to bypass this check."), process.exit(1)), $.info(gn(t, m));
+	}
+	let Ne = kt(Ee);
+	s.mark("discover");
+	let D = await Se(p, void 0), Ge = Gt(D, m);
+	for (let e of E({
+		dialect: String(p?.store ?? process.env.DB_DIALECT ?? "postgres"),
+		changeStrategy: (process.env.CDC ?? "1") === "0" ? "inline" : "cdc",
+		dbUrl: process.env.DB_URL,
+		tables: _.tables.map((e) => ({
+			tableName: e.tableName,
+			isReactive: e.isReactive === !0
+		})),
+		querySources: _.queries.flatMap((e) => {
+			let t = e.descriptor.source;
+			return t === void 0 ? [] : typeof t == "string" ? [t] : [...t];
+		})
+	})) e.level === "warn" ? $.warn(e.message) : $.info(e.message);
+	{
+		let e = v(ye({
+			tables: _.tables.map((e) => ({ tableName: e.tableName })),
+			queries: _.queries.map((e) => ({
+				name: e.descriptor.name,
+				source: e.descriptor.source
+			}))
+		}));
+		e !== void 0 && $.warn(e);
+	}
+	p?.cache && !process.env.CACHE_BACKEND && (process.env.CACHE_BACKEND = p.cache), p?.cacheRedisUrl && !process.env.CACHE_REDIS_URL && (process.env.CACHE_REDIS_URL = p.cacheRedisUrl), p?.cacheRedisDriver && !process.env.CACHE_REDIS_DRIVER && (process.env.CACHE_REDIS_DRIVER = p.cacheRedisDriver), p?.cacheKeyPrefix && !process.env.CACHE_KEY_PREFIX && (process.env.CACHE_KEY_PREFIX = p.cacheKeyPrefix);
+	let { service: qe, invalidationBus: P, snapshotCache: Qe, cache: $e, backend: tt, dispose: nt } = await xe({ env: process.env });
+	$.info(`cache backend resolved: ${tt}` + (tt === "redis" ? ` (driver ${process.env.CACHE_REDIS_DRIVER ?? "resp"})` : " — in-process, not cross-instance")), D.onChange((e) => {
+		M.runFork(P.publish(e.table));
+	}), p?.kv && !process.env.KV_BACKEND && (process.env.KV_BACKEND = p.kv), p?.kvRedisUrl && !process.env.KV_REDIS_URL && (process.env.KV_REDIS_URL = p.kvRedisUrl), p?.kvKeyPrefix && !process.env.KV_KEY_PREFIX && (process.env.KV_KEY_PREFIX = p.kvKeyPrefix);
+	let { kv: it, service: F } = await yt({ store: D });
+	s.mark("store");
+	let at = rt({
+		store: D,
+		sink: T.sink,
+		log: $
+	}), I = C({
+		store: D,
+		dialect: m
+	}), L = p?.plugins ?? [], ot = process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, ft, pt;
+	m !== "memory" && (ft = Xe.make((await n(m)).makeSqlLayer(w())), pt = await ft.runPromise(Kt.SqlClient));
+	let mt = bt({
+		coordinator: [
+			"postgres",
+			"mariadb",
+			"mysql",
+			"mssql"
+		].includes(m) ? ht(D, ot, $) : Ht,
+		replicaId: ot,
+		log: $
+	}), xt = [], St = process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, Ct = Dn(p?.plugins ?? [])?.broadcast?.provider, wt = pe(p?.plugins, p?.name ?? Je(l)), Tt = Fe(p?.plugins, {
+		instanceId: St,
+		namespace: wt,
+		meta: { mode: "serve" },
+		logger: $
+	}), Et = {
+		...pt ? { sql: pt } : {},
+		instanceId: St,
+		membership: Tt.membership,
+		...Ct === void 0 ? {} : { broadcast: Ct },
+		broadcastChannels: { presence: En(wt, "presence") },
+		scheduleCoordinated: (e, t, n) => {
+			let r = mt(e, t, n);
+			return xt.push(r), r;
+		}
+	};
+	for (let e of L) e.bindDataStore?.(D, Et);
+	let Dt = L.filter((e) => typeof e.onChangeEvent == "function");
+	if (Dt.length > 0) {
+		let e = D.changeScope ?? "local";
+		D.onChange((t) => {
+			let n = le(t, e);
+			for (let e of Dt) M.runFork(e.onChangeEvent(n).pipe(M.catchAllCause((t) => M.sync(() => $.warn(`plugin ${e.name} onChangeEvent failed`, { error: Ye.pretty(t) })))));
+		});
+	}
+	let Ot = h({
+		plugins: L,
+		appName: p?.name ?? "voltro-api",
+		appType: "api",
+		voltroVersion: process.env.npm_package_version ?? "0.0.0",
+		log: $
+	});
+	L.length && await Ot.activate(), s.mark("plugins");
+	let At = await Ot.gatherObservability(), jt = {
+		info: (e, t) => process.stdout.write(`[broadcast] ${e} ${t ? JSON.stringify(t) : ""}\n`),
+		warn: (e, t) => process.stderr.write(`[broadcast] ${e} ${t ? JSON.stringify(t) : ""}\n`),
+		debug: () => {}
+	}, Mt, Nt = await ve(D, p, m, wt, jt, (e, t) => {
+		Mt?.refreshAll(`broadcast gap: missed ${t} change(s) from ${e}`);
+	}), z = p?.apiKeys, Ft = (typeof z == "object" ? z.prefix : void 0) ?? "voltro_", It = z ? ct(D) : void 0, Rt = It ? _t({ flush: vt(It) }) : void 0;
+	Rt && Pt(() => Rt.shutdown());
+	let Bt = It ? gt(It, {
+		prefix: Ft,
+		...Rt ? { usage: Rt } : {}
+	}) : void 0, Vt = Bt ? [dt(Bt, { prefix: Ft })] : [], Ut = De([...p?.auth?.strategies ?? [], ...Vt], vn(p?.plugins ?? []), p?.auth?.anonymousTenantRequired ?? !1, p?.auth?.resolveScopes, () => Ge), Wt = [...p?.restRoutes ?? [], ...Bt ? et(Bt, (typeof z == "object" ? z.managementPath : void 0) ?? "/v1/api-keys") : []], B = p?.idempotency, V = B ? {
+		store: lt(D),
+		header: (typeof B == "object" ? B.header : void 0) ?? "Idempotency-Key",
+		ttlMs: (typeof B == "object" ? B.ttlMs : void 0) ?? 864e5
+	} : void 0, qt = Wt.length > 0 ? bn(Wt, {
+		store: D,
+		resolveSubject: (e) => Ut({
+			headers: e,
+			clientId: -1
+		}),
+		...V ? { idempotency: V } : {}
+	}) : [], H = L.map((e) => e.services).filter((e) => e !== void 0), Yt = N.mergeAll(je({
+		analyticsLayer: T.layer,
+		cacheService: qe,
+		kvService: F,
+		pluginServices: H,
+		userLayers: p?.layers ?? []
+	}), we(p?.http ?? {})), U = p?.scheduling ?? {}, Xt = U.trigger ?? "self", Zt = /* @__PURE__ */ new Set([
+		"postgres",
+		"mysql",
+		"mariadb",
+		"mssql"
+	]), Qt = U.coordination ?? (Zt.has(m) ? "advisoryLock" : "single"), W = Qt === "cluster" && Zt.has(m), $t = W ? "cluster" : Qt === "advisoryLock" && Zt.has(m) ? "advisoryLock" : "single";
+	Qt === "cluster" && !W && $.warn("scheduling.coordination=cluster needs a sql-backed store except sqlite — falling back to single"), Qt === "advisoryLock" && !Zt.has(m) && $.warn("scheduling.coordination=advisoryLock needs a SQL store (the claim-row gate) — falling back to single");
+	let G, K = _.workflows.length > 0 || _.workflowWorkers.length > 0 || _.eventTriggers.length > 0 || (b?.outgoing.length ?? 0) > 0 || W, en;
+	if (K) {
+		if (m === "mssql") {
+			let e = await a(process.cwd());
+			e && $.warn(e);
+		}
+		let [{ WorkflowEngine: e }, { makeClusterCronLayer: t, workflowEngineLayer: r, resolveRunnerStorage: i, resolveFailoverTuning: o }] = await Promise.all([import("@effect/workflow"), import("@voltro/workflow/cluster")]), s = W ? _.schedules.filter((e) => (e.trigger ?? Xt) === "self").map((e) => t({
+			name: e.name,
+			cron: st(e),
+			execute: async () => {
+				await G?.fireFromCluster(e.name);
+			}
+		})) : [];
+		en = m === "memory" ? e.layerMemory : await (async () => {
+			let e = await n(m), t = i({ sqliteFamily: e.id === "sqlite" || e.id === "turso" });
+			return $.info(`workflow engine: cluster-${t}, dialect=${e.id}` + (t === "memory" ? " — single-process durable replay, no cross-pod shard handoff" + (e.id !== "sqlite" && e.id !== "turso" ? " (VOLTRO_WORKFLOW_RUNNER_STORAGE=memory: SqlRunnerStorage/cluster_runners + GET_LOCK skipped)" : "") : "")), r({
+				sqlClientLayer: e.makeSqlLayer(w()),
+				runnerStorage: t,
+				dialectId: e.id,
+				...process.env.VOLTRO_WORKFLOW_RUNNER_PORT ? { runnerListenPort: Number(process.env.VOLTRO_WORKFLOW_RUNNER_PORT) } : {},
+				...o(),
+				...s.length > 0 ? { extraShardingLayers: s } : {}
+			});
+		})();
+	}
+	let tn = c(L, t()), nn = g.filter((e) => /\.subscribe\.tsx?$/.test(e)), q = nn.length > 0 ? await fe(nn, $) : [], rn = g.filter((e) => /\.reaction\.tsx?$/.test(e)), an = rn.length > 0 ? await f(rn, $) : [], J = g.filter((e) => He.test(e)), on = J.length > 0 ? await ee(J, $) : [], sn = g.filter((e) => /\.aggregate\.tsx?$/.test(e)), Y = sn.length > 0 ? await te(sn, $) : [], X = ae();
+	if (Y.length > 0 && m !== "memory") try {
+		X = Ie((await n(m)).makeSqlLayer(w()));
+	} catch (e) {
+		$.warn("aggregate: SQL storage init failed — falling back to in-process", { err: String(e) });
+	}
+	let cn = m === "memory" ? Ht : ht(D, `aggregate@${process.pid}`, $), Z = [], ln = [], un = g.filter((e) => Be.test(e));
+	if (un.length > 0) {
+		let e = $.child("agent"), t = g.filter((e) => k.test(e));
+		t.length > 0 && await Le(t, e);
+		let n = await ze(un, e);
+		for (let e of n.agents) for (let t of S(e)) (t.kind === "action" ? Z : ln).push({
+			file: t.file,
+			descriptor: t.descriptor,
+			executor: t.executor
+		});
+		n.agents.length > 0 && e.info("synthesized agent routes", { agents: n.agents.map((e) => e.descriptor.name) });
+	}
+	s.mark("workflow");
+	let fn = await $n({
+		bootTiming: s,
+		broadcastNamespace: wt,
+		membership: {
+			...Tt,
+			instanceId: St
+		},
+		...p?.plugins === void 0 ? {} : { plugins: p.plugins },
+		...V ? { idempotency: {
+			store: V.store,
+			ttlMs: V.ttlMs
+		} } : {},
+		discovered: {
+			queries: [..._.queries, ...ln],
+			mutations: _.mutations,
+			actions: [..._.actions, ...Z],
+			streams: _.streams,
+			events: _.events,
+			workflows: _.workflows,
+			workflowWorkers: _.workflowWorkers,
+			eventTriggers: _.eventTriggers,
+			schedules: _.schedules,
+			subscribers: q,
+			outboxHandlers: on,
+			connections: _.connections,
+			reactions: an,
+			aggregates: Y,
+			...b === void 0 ? {} : { webhooks: b }
+		},
+		log: $,
+		analytics: T.sink,
+		aggregateStorage: X,
+		aggregateCoordinator: cn,
+		store: D,
+		kv: it,
+		cache: $e,
+		snapshotCache: Qe,
+		schemaRegistry: Ne,
+		tenantScopedTables: _.tenantScopedTables,
+		softDeleteScopedTables: _.softDeleteScopedTables,
+		dataTransferSnapshot: hn(Ee),
+		dataTransferDialect: m,
+		tenantIsolation: (process.env.VOLTRO_TENANT_ISOLATION ?? p?.tenancy?.isolation) === "namespace" ? "namespace" : "shared-schema",
+		resolveSubject: (e, t) => Ut({
+			headers: e,
+			clientId: t
+		}),
+		httpRoutes: [...L.flatMap((e) => e.httpRoutes ?? []), ...qt],
+		getStore: () => Ge,
+		...Yt ? { baseLayer: Yt } : {},
+		...en === void 0 ? {} : { workflowEngineLayer: en },
+		scheduleDefaultTrigger: Xt,
+		scheduleCoordination: $t,
+		scheduleArmSelf: !W,
+		dormancy: process.env.VOLTRO_DORMANCY === "sleep" || process.env.VOLTRO_DORMANCY === "always-on" ? process.env.VOLTRO_DORMANCY : p?.dormancy ?? "always-on",
+		scheduleReplicaId: process.env.HOSTNAME ?? `pid-${process.pid}`,
+		...tn === void 0 ? {} : { scheduleFireInterceptor: tn },
+		onSchedulerReady: (e) => {
+			G = e;
+		},
+		inspectRoute: { handle: (e, t, n, r) => Ue(e, {
+			kind: "api",
+			meta: {
+				name: p?.name ?? "voltro-api",
+				voltroVersion: Oe,
+				port: u,
+				mode: "start",
+				store: m,
+				cdc: oe ? "on" : "off"
+			},
+			rpc: me(_, l),
+			workflows: Pe(_, l),
+			events: () => fn.eventsSnapshot(),
+			members: () => fn.membersSnapshot(),
+			inspectFireSchedule: async ({ name: e, trigger: t }) => {
+				if (!G) throw Error("scheduler not started — this app registers no self-triggered schedules (all schedules are trigger:'external', or there are none).");
+				return { runId: await G.fireNow(e, t) ?? null };
+			},
+			inspectRedriveWorkflowRun: (e) => fn.redriveWorkflowRun(e)
+		}, t, {
+			method: n,
+			...r === void 0 ? {} : { body: r }
+		}) ?? {
+			status: 404,
+			contentType: "application/json",
+			body: JSON.stringify({ error: "not an inspect route" })
+		} },
+		observability: At,
+		port: u,
+		...p?.transport?.wsPath ? { path: p.transport.wsPath } : {}
+	});
+	return Mt = fn.dispatcher, Te(ke([
+		_.queries,
+		_.mutations,
+		_.actions,
+		_.streams
+	]), (e) => {
+		$.warn(e);
+	}), $.info(`API listening on :${u}`, {
+		dialect: m,
+		queries: _.queries.length,
+		mutations: _.mutations.length,
+		actions: _.actions.length,
+		streams: _.streams.length,
+		workflows: _.workflows.length,
+		workflowWorkers: _.workflowWorkers.length,
+		schedules: _.schedules.length,
+		scheduleCoordination: $t
+	}), s.finish($), Pt(async () => {
+		for (let e of xt) e.stop();
+		at.detach(), I.stop(), nt(), ft?.dispose();
+		try {
+			await Ot.deactivate(), await Nt?.close(), await T.dispose(), await fn.close(), await D.close?.();
+		} catch (e) {
+			console.error("serve: shutdown step failed, exiting anyway:", e);
+		}
+	}), await new Promise(() => {}), 0;
+};
+//#endregion
+export { nr as n, Xn as r, rr as t };