@voltro/cli 0.25.0 → 0.27.0

package/dist/serveCommand-DfkisVWP.js

@@ -0,0 +1,1310 @@
+import { ot as e, t } from "./inspectMetrics-BU90mvJN.js";
+import { s as n } from "./seedRunner-D6eu-u5U.js";
+import { r, t as i } from "./appModuleLoader-C9r9mxZt.js";
+import { A as a, B as o, C as s, Ct as c, D as l, E as u, F as d, G as f, H as p, I as ee, J as te, K as ne, L as re, M as ie, N as ae, O as oe, P as se, Q as m, R as ce, S as h, St as le, T as g, U as ue, V as de, W as fe, X as _, Y as pe, Z as me, _ as v, _t as he, b as ge, c as _e, dt as y, et as ve, ft as b, g as ye, gt as be, h as xe, ht as Se, i as x, j as Ce, k as we, lt as Te, mt as Ee, nt as S, o as C, pt as w, q as De, r as Oe, rt as ke, t as Ae, tt as je, u as Me, ut as Ne, v as Pe, vt as T, x as Fe, xt as Ie, y as E, yt as Le, z as D } from "./dev-DcbIJrWg.js";
+import { _ as O, f as Re, m as ze, n as Be, p as Ve, u as He, v as Ue } from "./frameworkTableAssembly-BwHU9Euq.js";
+import { u as We } from "./fileConventions-3bffWssN.js";
+import { p as Ge } from "./inspect-CUCCzw2I.js";
+import { r as Ke, u as qe } from "./apiBuild-D22_EpoR.js";
+import { t as Je } from "./bootTiming-BdyP9nYw.js";
+import { n as Ye } from "./cliArgs-qdZSElM3.js";
+import { basename as k, join as A } from "node:path";
+import { pathToFileURL as Xe } from "node:url";
+import { Cause as Ze, Effect as j, Layer as M, ManagedRuntime as Qe } from "effect";
+import { createLogger as N } from "@voltro/logger";
+import { existsSync as $e } from "node:fs";
+import { AggregateRegistry as et, Dispatcher as tt, apiKeyManagementRoutes as nt, applySoftDeleteScope as rt, applyTenantScope as it, attachAnalyticsMirror as at, awaitServerListening as ot, bindMutation as P, bindStream as st, bindSubscription as F, buildTracingLayer as I, cancelWakeup as ct, compileCron as lt, dataStoreApiKeyStore as ut, dataStoreIdempotencyStore as L, formatServerOnlyLeaks as dt, formatUnresolvedSources as ft, frameworkApiKeyStrategy as pt, getCredentialExpiry as mt, installPolicyGuardResolver as ht, loadResourceTuples as gt, makeActionRunner as _t, makeAdvisoryLockCoordinator as vt, makeApiKeyService as yt, makeApiKeyUsageBuffer as bt, makeApiKeyUsageFlusher as xt, makeAsyncKv as St, makeCoordinatedScheduler as Ct, makeEffectStoreLayer as wt, makeLazyWorkflowFacade as Tt, makeMutationOutputCodec as R, makeMutationRunner as Et, makeOneShotQueryRunner as Dt, makeQueryDescriptorProducer as Ot, makeQueryReauthorizer as kt, makeQuerySubscriber as At, makeSchemaRegistry as jt, makeWorkflowFacade as Mt, makeWorkflowFacadeWithCallerContext as Nt, makeWorkflowLayers as Pt, noopKv as z, onProcessShutdown as Ft, recordCredentialExpiry as It, recordSubscriptionDelivery as Lt, recordWorkflowRun as Rt, registerWakeup as zt, resolveSecretsBackend as Bt, runProvidedEffect as Vt, setSecretsBackend as Ht, setSystemStoreHandle as Ut, setTupleSource as Wt, singleCoordinator as Gt, startRpcServer as Kt, startScheduler as B, unresolvedSources as qt, workflowToRpc as V, wrapStoreWithBootCodec as Jt } from "@voltro/runtime";
+import { RpcGroup as Yt } from "@effect/rpc";
+import { SqlClient as Xt } from "@effect/sql";
+import { and as Zt, ensureTableRegistered as Qt, eq as H, or as $t } from "@voltro/database";
+import { appStorageProvider as U, fromNodeReadable as en, getObjectStream as tn, putObjectStream as W, toNodeReadable as nn } from "@voltro/plugin-storage";
+import { AuthMiddleware as G, ConnectionInfoMiddleware as rn, actionToRpc as K, anonymousSubject as an, isWireReachable as on, mutationToRpc as sn, queryToRpc as q, streamToRpc as cn, workflowCancelDescriptor as ln, workflowDomainEventsQueryDescriptor as un, workflowEventDeliveriesQueryDescriptor as J, workflowResumeDescriptor as dn, workflowRunEventsQueryDescriptor as Y, workflowRunQueryDescriptor as fn, workflowRunStepsQueryDescriptor as pn, workflowRunsQueryDescriptor as X, workflowSignalDescriptor as mn, workflowUpdateDescriptor as Z } from "@voltro/protocol";
+import { assertProductionSessionSecret as hn, sessionExpiryFromHeaders as gn } from "@voltro/protocol/session";
+import { createHash as _n, timingSafeEqual as vn } from "node:crypto";
+import { declaredSnapshot as yn, describeOutcome as bn, runPlannedMigrations as xn } from "@voltro/database/sql";
+import { getAuthSessionStrategy as Sn } from "@voltro/plugin-auth";
+import { collectPublicApiRoutes as Cn, restRoutesToHttpRoutes as wn } from "@voltro/protocol/rest";
+import { buildDeliverWebhookExecute as Tn, buildWebhooksService as En, defaultIncomingPath as Dn, deliverWebhookWorkflow as On, mountIncomingWebhook as kn } from "@voltro/plugin-webhooks";
+import { channelFor as An, getBroadcastPlugin as jn } from "@voltro/plugin-broadcast";
+import { packBundle as Mn, runExport as Nn, runImport as Pn, storageBlobSink as Fn, storageRefsBlobSource as In, unpackBundle as Ln, unpackBundleToDir as Rn } from "@voltro/data-transfer";
+//#region src/bootRefusal.ts
+var zn = "VoltroBootRefusal", Bn = (e) => {
+	let t = Error(e);
+	return t.name = zn, t;
+}, Vn = "/_voltro/admin/import", Hn = "/_voltro/admin/export", Q = (e, t) => ({
+	status: e,
+	contentType: "application/json; charset=utf-8",
+	body: JSON.stringify(t)
+}), Un = (e) => {
+	let t = e.authorization ?? e.Authorization, n = t ? /^Bearer\s+(.+)$/i.exec(t) : null;
+	return n ? n[1] : null;
+}, Wn = (e, t) => vn(_n("sha256").update(e).digest(), _n("sha256").update(t).digest()), Gn = (e, t) => {
+	if (e.method.toUpperCase() !== "POST") return Q(405, { error: "method not allowed" });
+	if (!t || t.length < 16) return Q(503, { error: "data transfer misconfigured (no/weak secret)" });
+	let n = Un(e.headers);
+	return !n || !Wn(n, t) ? Q(401, { error: "unauthorized" }) : null;
+}, Kn = N({ scope: "voltro:admin-import" }), qn = "VBUNDLE2", Jn = async function* (e) {
+	yield e;
+}, Yn = (e) => async (t) => {
+	let n = Gn(t, e.secret);
+	if (n) return n;
+	let r = t.headers["x-import-mode"], i = t.headers["x-import-on-conflict"], a = t.headers["x-import-atomic"] === "1" || t.headers["x-import-atomic"] === "true", o = t.headers["x-import-force"] === "1" || t.headers["x-import-force"] === "true", s = t.rawBody.byteLength >= 8 && Buffer.from(t.rawBody.subarray(0, 8)).toString("latin1") === qn, c, l;
+	if (s) c = Jn(t.rawBody), l = "upload";
+	else {
+		let n;
+		try {
+			n = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
+		} catch {
+			return Q(400, { error: "body must be a packed bundle archive or { bundleKey } JSON" });
+		}
+		if (typeof n.bundleKey != "string" || !n.bundleKey) return Q(400, { error: "body.bundleKey (string) is required for the storage transport" });
+		if (!e.openArchive) return Q(501, { error: "storage transport not configured on this instance" });
+		c = e.openArchive(n.bundleKey), l = "storage";
+	}
+	let u = await import("node:os"), d = await import("node:fs/promises"), f = await import("node:path"), p = await d.mkdtemp(f.join(u.tmpdir(), "voltro-admin-import-"));
+	try {
+		e.assetSink ? await Ln(c, {
+			dir: p,
+			blobs: e.assetSink
+		}) : await Rn(c, p);
+		let t = await j.runPromiseExit(Pn({
+			store: e.store,
+			bundleDir: p,
+			...r ? { mode: r } : {},
+			...i ? { onConflict: i } : {},
+			...a ? { atomic: a } : {},
+			...e.snapshot ? { targetSnapshot: e.snapshot } : {},
+			force: o,
+			onWarn: (e) => Kn.warn("admin.import", { message: e }),
+			...e.assetSink ? { assetsAlreadyRestored: !0 } : {}
+		}));
+		if (t._tag === "Failure") {
+			let e = t.cause._tag === "Fail" ? t.cause.error : void 0;
+			if (e && e._tag === "SchemaDriftError") {
+				let t = e;
+				return Kn.warn("admin.import refused (schema drift)", {
+					transport: l,
+					bundle: t.bundleFingerprint.slice(0, 16),
+					target: t.targetFingerprint.slice(0, 16)
+				}), Q(409, {
+					error: "schema drift",
+					bundleFingerprint: t.bundleFingerprint,
+					targetFingerprint: t.targetFingerprint,
+					diff: t.diff,
+					hint: "re-export against the current schema, or resend with x-import-force: 1"
+				});
+			}
+			throw Error(String(e?.message ?? e ?? "import failed"));
+		}
+		let n = t.value, s = n.tables.reduce((e, t) => e + t.rowCount, 0);
+		return Kn.info("admin.import", {
+			transport: l,
+			tables: n.tables.length,
+			rows: s,
+			mode: r ?? "upsert",
+			atomic: a
+		}), Q(200, {
+			tables: n.tables.length,
+			rows: s,
+			transport: l
+		});
+	} catch (e) {
+		return Kn.warn("admin.import failed", {
+			transport: l,
+			error: e?.message ?? String(e)
+		}), Q(500, {
+			error: "import failed",
+			message: e?.message ?? String(e)
+		});
+	} finally {
+		await d.rm(p, {
+			recursive: !0,
+			force: !0
+		});
+	}
+}, Xn = N({ scope: "voltro:admin-export" }), Zn = async (e) => {
+	let t = [];
+	for await (let n of e) t.push(Buffer.from(n));
+	return new Uint8Array(Buffer.concat(t));
+}, Qn = (e) => typeof e.tenant == "string" && e.tenant ? {
+	kind: "tenant",
+	tenantId: e.tenant
+} : Array.isArray(e.tables) && e.tables.length ? {
+	kind: "tables",
+	tables: e.tables.filter((e) => typeof e == "string")
+} : { kind: "all" }, $n = (e) => async (t) => {
+	let n = Gn(t, e.secret);
+	if (n) return n;
+	let r;
+	try {
+		r = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
+	} catch {
+		return Q(400, { error: "body must be JSON: { profile?, tenant?, tables?, consistency?, compression?, bundleKey? }" });
+	}
+	let i = {};
+	if (typeof r.profile == "string" && r.profile) {
+		if (!e.loadProfile) return Q(501, { error: "server-side profiles not configured on this instance" });
+		try {
+			i = await e.loadProfile(r.profile);
+		} catch (e) {
+			return Q(400, {
+				error: `profile '${r.profile}' could not be loaded`,
+				message: e?.message ?? String(e)
+			});
+		}
+	}
+	let a = r.consistency === "snapshot" ? "snapshot" : i.consistency ?? "live", o = (typeof r.compression == "string" ? r.compression : void 0) ?? i.compression, s = i.scope ?? Qn(r), c = typeof r.bundleKey == "string" && r.bundleKey.length > 0, l = r.assets === !0 && e.assetSource ? { blobs: e.assetSource } : {}, u = await import("node:os"), d = await import("node:fs/promises"), f = await import("node:path"), p = await d.mkdtemp(f.join(u.tmpdir(), "voltro-admin-export-"));
+	try {
+		let t = await j.runPromise(Nn({
+			store: e.store,
+			snapshot: e.snapshot,
+			dialect: e.dialect,
+			outDir: p,
+			...i.subset ? { subset: i.subset } : {
+				scope: s,
+				...e.tenantTables && e.tenantTables.length > 0 ? { tenantTables: e.tenantTables } : {}
+			},
+			consistency: a,
+			...o ? { compression: o } : {},
+			...i.masking ? { masking: i.masking } : {}
+		})), n = t.tables.reduce((e, t) => e + t.rowCount, 0), u = t.masking?.transformed.length ?? 0;
+		if (c) {
+			if (!e.putArchive) return Q(501, { error: "storage transport not configured on this instance" });
+			let i = r.bundleKey;
+			return await e.putArchive(i, () => Mn({
+				dir: p,
+				...l
+			})), Xn.info("admin.export", {
+				transport: "storage",
+				tables: t.tables.length,
+				rows: n,
+				masked: u,
+				bundleKey: i
+			}), Q(200, {
+				bundleKey: i,
+				tables: t.tables.length,
+				rows: n,
+				masked: u,
+				transport: "storage"
+			});
+		}
+		let d = await Zn(Mn({
+			dir: p,
+			...l
+		}));
+		return Xn.info("admin.export", {
+			transport: "download",
+			tables: t.tables.length,
+			rows: n,
+			masked: u,
+			bytes: d.byteLength
+		}), {
+			status: 200,
+			contentType: "application/octet-stream",
+			body: d,
+			headers: {
+				"x-export-tables": String(t.tables.length),
+				"x-export-rows": String(n),
+				"x-export-masked": String(u)
+			}
+		};
+	} catch (e) {
+		return Xn.warn("admin.export failed", { error: e?.message ?? String(e) }), Q(500, {
+			error: "export failed",
+			message: e?.message ?? String(e)
+		});
+	} finally {
+		await d.rm(p, {
+			recursive: !0,
+			force: !0
+		});
+	}
+}, er = async (e) => {
+	let { resolve: t } = await import("node:path"), { existsSync: n } = await import("node:fs"), r = [
+		e,
+		`${e}.profile.ts`,
+		`data-profiles/${e}.ts`,
+		`data-profiles/${e}.profile.ts`
+	].map((e) => t(process.cwd(), e)), i = r.find((e) => n(e));
+	if (!i) throw Error(`data profile '${e}' not found (looked for: ${r.join(", ")})`);
+	let a = await import(i), o = a.default ?? a.profile;
+	if (!o) throw Error(`data profile '${i}' has no default export`);
+	return o;
+}, tr = (e, t, n = {}) => (async function* () {
+	let r = await nn((await j.runPromise(tn(e, t).pipe(j.timeout(n.openTimeout ?? "30 seconds")))).stream), i = n.stallMs ?? 12e4, a, o = () => {
+		a && clearTimeout(a), a = setTimeout(() => r.destroy(/* @__PURE__ */ Error(`storage read stalled for ${i}ms reading '${t}'`)), i);
+	};
+	try {
+		o();
+		for await (let e of r) o(), yield e instanceof Uint8Array ? e : new Uint8Array(e);
+	} finally {
+		a && clearTimeout(a), r.destroy();
+	}
+})(), nr = {
+	get: async () => void 0,
+	set: async () => {},
+	setWithTags: async () => {},
+	remove: async () => !1,
+	has: async () => !1,
+	clear: async () => {},
+	invalidateTag: async () => 0,
+	wrap: async (e, t, n) => n()
+}, rr = async (e) => {
+	Ut({
+		dataStore: e.store,
+		schemaRegistry: e.schemaRegistry
+	});
+	let t = new tt({
+		store: e.store,
+		...e.snapshotCache ? { cache: e.snapshotCache } : {},
+		recordDelivery: (e) => Lt({
+			label: e.label,
+			kind: e.kind,
+			durationMs: e.durationMs,
+			rowCount: e.rowCount
+		})
+	}), n = e.cache ?? nr, r = e.kv ?? z, i, o, d, f, ne, ie = /* @__PURE__ */ new Map(), ae = () => `wfctx_${globalThis.crypto?.randomUUID?.() ?? `${Date.now().toString(36)}${Math.random().toString(36).slice(2)}`}`, oe = async (t, n, r) => {
+		let i = {
+			...r,
+			source: r.source ?? `workflow:${t}`
+		};
+		ie.set(n, i);
+		try {
+			let r = await e.store.query({
+				table: "_voltro_workflow_start_contexts",
+				order: [],
+				predicate: H("executionId", n),
+				projection: ["id"],
+				skip: void 0,
+				take: 1
+			}), a = {
+				workflowName: t,
+				executionId: n,
+				subject: i.subject ?? null,
+				traceId: i.traceId ?? null,
+				source: i.source ?? null,
+				parentExecutionId: i.parentExecutionId ?? null,
+				parentClosePolicy: i.parentClosePolicy ?? null,
+				createdAt: /* @__PURE__ */ new Date()
+			};
+			r[0] === void 0 ? await e.store.insert("_voltro_workflow_start_contexts", {
+				id: ae(),
+				...a
+			}) : await e.store.update("_voltro_workflow_start_contexts", r[0].id, a);
+		} catch (e) {
+			process.stderr.write(`[workflow] failed to persist start context for ${t}/${n}: ${e?.message ?? String(e)}\n`);
+		}
+	}, se = async (t, n) => {
+		let r = ie.get(n);
+		if (r !== void 0) return r;
+		try {
+			let t = (await e.store.query({
+				table: "_voltro_workflow_start_contexts",
+				order: [],
+				predicate: H("executionId", n),
+				projection: void 0,
+				skip: void 0,
+				take: 1
+			}))[0];
+			if (t === void 0) return;
+			let r = {
+				...t.subject === null ? {} : { subject: t.subject },
+				...t.traceId === null ? {} : { traceId: t.traceId },
+				...t.source === null ? {} : { source: t.source },
+				...t.parentExecutionId === null ? {} : { parentExecutionId: t.parentExecutionId },
+				...t.parentClosePolicy === null ? {} : { parentClosePolicy: t.parentClosePolicy }
+			};
+			return ie.set(n, r), r;
+		} catch (e) {
+			process.stderr.write(`[workflow] failed to load start context for ${n}: ${e?.message ?? String(e)}\n`);
+			return;
+		}
+	}, m = (e.discovered.workflows?.length ?? 0) > 0 ? Tt(() => i) : void 0, ce = (e.discovered.workflows?.length ?? 0) > 0 || (e.discovered.eventTriggers?.length ?? 0) > 0, le = ce || (e.discovered.workflowWorkers?.length ?? 0) > 0 || e.scheduleCoordination === "cluster", ue = e.tenantIsolation === "namespace", fe = (e.log ?? N({ scope: "voltro:serve" })).child("webhooks"), pe, v = e.discovered.webhooks;
+	if (v && v.outgoing.length > 0 && e.workflowEngineLayer !== void 0) {
+		let t = e.workflowEngineLayer, i = Ee({
+			store: e.store,
+			schemaRegistry: e.schemaRegistry,
+			cache: n,
+			kv: r
+		}), a = v.outgoing.map((e) => e.descriptor);
+		pe = En(i, async (e) => {
+			let n = On.execute(e).pipe(j.provide(On.toLayer(Tn(i, { events: a })).pipe(M.provideMerge(t))));
+			j.runPromise(n).catch((t) => {
+				fe.error("deliverWebhook workflow crashed", {
+					deliveryId: e.deliveryId,
+					targetId: e.targetId
+				}, t);
+			});
+		}, { events: a });
+	}
+	let he = /* @__PURE__ */ new Map();
+	if (v) for (let e of v.incoming) {
+		let t = e.descriptor.path ?? Dn(e.descriptor.id), n = `VOLTRO_WEBHOOK_SECRET_${e.descriptor.id.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`, r = kn(e.descriptor, {
+			resolveSecret: async () => process.env[n] ?? null,
+			resolveWorkflows: () => m === void 0 ? void 0 : Nt(m, {
+				traceId: `incoming:${e.descriptor.id}`,
+				source: `incoming:${e.descriptor.id}`
+			}),
+			log: (e) => {
+				let t = {
+					webhookId: e.webhookId,
+					status: e.status,
+					signatureOk: String(e.signatureOk),
+					idempotency: e.idempotency,
+					durationMs: e.durationMs
+				};
+				e.status >= 500 ? fe.error("incoming delivery failed", t) : e.status >= 400 ? fe.warn("incoming delivery rejected", t) : fe.info("incoming delivery handled", t);
+			}
+		});
+		he.set(t, { handle: r });
+	}
+	ht(), Wt((t) => gt(e.store, t.subjectId, t.resourceType, t.resourceId));
+	let _e = (e.discovered.outboxHandlers?.length ?? 0) > 0 ? _({
+		handlers: e.discovered.outboxHandlers ?? [],
+		store: e.store,
+		log: (e.log ?? N({ scope: "voltro:serve" })).child("outbox")
+	}) : void 0, y = te({
+		definitions: (e.discovered.connections ?? []).map((e) => e.definition),
+		store: e.store,
+		publicUrl: De(e.port ?? 4e3),
+		log: (e.log ?? N({ scope: "voltro:serve" })).child("connections")
+	});
+	Fe({
+		events: e.discovered.events ?? [],
+		rpcTags: [
+			...e.discovered.queries.map((e) => e.descriptor.name),
+			...e.discovered.mutations.map((e) => e.descriptor.name),
+			...e.discovered.actions.map((e) => e.descriptor.name),
+			...(e.discovered.streams ?? []).map((e) => e.descriptor.name)
+		]
+	});
+	let ve = (e.log ?? N({ scope: "voltro:serve" })).child("events"), ye = e.broadcastNamespace ?? Pe(e.plugins, void 0), be = E(e.plugins, ye, ve), xe = e.membership?.instanceId ?? process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, Se = e.membership ?? ge(e.plugins, {
+		instanceId: xe,
+		namespace: ye,
+		meta: { mode: "serve" },
+		logger: ve
+	}), x = h({
+		events: e.discovered.events ?? [],
+		origin: xe,
+		...be.publishRemote === void 0 ? {} : { publishRemote: be.publishRemote }
+	}), we = (e.discovered.events ?? []).length > 0 ? await be.attach(x.bus) : null, S = w({
+		store: e.store,
+		schemaRegistry: e.schemaRegistry,
+		cache: n,
+		kv: r,
+		...pe === void 0 ? {} : { webhooksService: pe },
+		...m === void 0 ? {} : { workflowsProxy: m },
+		eventTriggers: e.discovered.eventTriggers ?? [],
+		namespaceIsolationOn: ue,
+		..._e === void 0 ? {} : { outbox: { nudge: _e.nudge } },
+		...y.active ? { connections: { registry: y.registry } } : {},
+		eventBus: x.bus
+	}), C = M.succeed(et, re), Oe = (t, n) => {
+		let r = t.pipe(j.provide(wt(n)));
+		return (e.baseLayer ? r.pipe(j.provide(e.baseLayer)) : r).pipe(j.provide(C));
+	}, ke = (e, t) => Vt(Oe(e, t)), Ae = Et({
+		store: e.store,
+		buildContext: (e, t, n) => S(e, t, n),
+		runEffect: ke,
+		undoCapture: Ce()
+	}), je = a(), Me = _t({
+		buildContext: (e) => S(e),
+		runEffect: ke
+	}), Ne = {
+		buildContext: (e) => S(e),
+		finalize: (t, n) => rt(it(t, e.tenantScopedTables, n.subject.tenantId), e.softDeleteScopedTables),
+		provideEffect: Oe
+	}, T = Ot(Ne), Ie = Dt({
+		...Ne,
+		queryRows: (t) => e.store.query(t)
+	}), Le = At({
+		...Ne,
+		subscribeDescriptor: (e, n, r) => t.subscribe(e, n, r),
+		subscribeComputed: (e, n, r) => t.subscribeComputed(e, n, r)
+	}), D = (e) => e.filter((e) => on(e.descriptor)), O = {};
+	for (let n of [
+		...D(e.discovered.queries),
+		...je.queries,
+		...y.queries
+	]) O[n.descriptor.name] = (e) => F(T(n, e), t, `subscription.${n.descriptor.name}`, void 0, void 0, kt(n, e));
+	for (let t of [
+		...D(e.discovered.mutations),
+		...je.mutations,
+		...y.mutations
+	]) {
+		let n = R(t.descriptor.output);
+		O[t.descriptor.name] = (r) => P(async (e, n) => Ae(t, e, n), r, `mutation.${t.descriptor.name}`, n, e.idempotency);
+	}
+	for (let t of [...D(e.discovered.actions), ...y.actions]) {
+		let n = R(t.descriptor.output);
+		O[t.descriptor.name] = (r) => P(async (e, n) => Me(t, e, n), r, `action.${t.descriptor.name}`, n, e.idempotency);
+	}
+	let Re = () => `public-${Math.random().toString(36).slice(2, 10)}`, ze = [
+		...e.discovered.queries.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => Ie(e, t, {
+				subject: n.subject,
+				traceId: Re()
+			}),
+			subscribe: (t, n, r) => Le(e, t, {
+				subject: n.subject,
+				traceId: Re()
+			}, r)
+		})),
+		...e.discovered.mutations.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => Ae(e, t, {
+				subject: n.subject,
+				traceId: Re()
+			})
+		})),
+		...e.discovered.actions.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => Me(e, t, {
+				subject: n.subject,
+				traceId: Re()
+			})
+		}))
+	], Be = ze.length > 0 ? wn(Cn(ze), {
+		store: e.store,
+		resolveSubject: (t) => e.resolveSubject(t, -1)
+	}) : [], Ve = e.dataTransferSecret ?? process.env.VOLTRO_DATA_TRANSFER_SECRET, He = Ve && Ve.length >= 16 ? [{
+		method: "POST",
+		path: Vn,
+		handle: Yn({
+			secret: Ve,
+			store: e.store,
+			...e.dataTransferSnapshot ? { snapshot: e.dataTransferSnapshot } : {},
+			assetSink: Fn(U()),
+			openArchive: (e) => tr(U(), e)
+		})
+	}, {
+		method: "POST",
+		path: Hn,
+		handle: $n({
+			secret: Ve,
+			store: e.store,
+			snapshot: e.dataTransferSnapshot ?? { tables: [] },
+			dialect: e.dataTransferDialect ?? "memory",
+			tenantTables: [...e.tenantScopedTables],
+			loadProfile: er,
+			assetSource: In(U(), e.store),
+			putArchive: async (e, t) => {
+				let { Readable: n } = await import("node:stream"), r = U(), i = en("storage", () => n.from(t()));
+				await j.runPromise(W(r, e, i, { contentType: "application/octet-stream" }));
+			}
+		})
+	}] : [], Ue = [
+		...e.httpRoutes ?? [],
+		...Be,
+		...He,
+		...y.httpRoutes
+	];
+	Object.assign(O, x.handlers);
+	for (let t of D(e.discovered.streams ?? [])) O[t.descriptor.name] = (n) => st((r) => {
+		let i = S(r), a = t.executor(n, i);
+		if (j.isEffect(a)) {
+			let t = a.pipe(j.provide(wt(i.store)));
+			return (e.baseLayer ? t.pipe(j.provide(e.baseLayer)) : t).pipe(j.provide(C));
+		}
+		return typeof a == "object" && a && typeof a.then == "function" ? j.promise(() => a) : a;
+	}, `stream.${t.descriptor.name}`);
+	for (let t of e.discovered.workflows ?? []) O[t.definition.name] = (e) => P(async (e, n) => {
+		let r = n;
+		return Nt(m, {
+			subject: r.subject,
+			traceId: r.traceId,
+			source: "workflow-rpc"
+		}).start(t.definition.name, e);
+	}, e, `workflow.${t.definition.name}`);
+	ce && (O[fn.name] = (e) => F(T({
+		descriptor: fn,
+		executor: (e) => {
+			let t = e.id;
+			return {
+				table: "_voltro_workflow_runs",
+				order: [{
+					column: "startedAt",
+					direction: "desc"
+				}],
+				predicate: $t(H("id", t), H("executionId", t)),
+				take: 1,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${fn.name}`), O[X.name] = (e) => F(T({
+		descriptor: X,
+		executor: (e) => {
+			let t = e, n = [...t.tag === void 0 ? [] : [H("tag", t.tag)], ...t.status === void 0 ? [] : [H("status", t.status)]], r = Number.isFinite(t.limit) && t.limit !== void 0 ? Math.min(Math.max(Math.floor(t.limit), 1), 500) : 100;
+			return {
+				table: "_voltro_workflow_runs",
+				order: [{
+					column: "startedAt",
+					direction: "desc"
+				}],
+				predicate: n.length === 0 ? void 0 : n.length === 1 ? n[0] : Zt(...n),
+				take: r,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${X.name}`), O[pn.name] = (e) => F(T({
+		descriptor: pn,
+		executor: (e) => {
+			let t = e.runId;
+			return {
+				table: "_voltro_workflow_run_steps",
+				order: [{
+					column: "startedAt",
+					direction: "asc"
+				}],
+				predicate: H("runId", t),
+				take: 1e3,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${pn.name}`), O[Y.name] = (e) => F(T({
+		descriptor: Y,
+		executor: (e) => {
+			let t = e.runId;
+			return {
+				table: "_voltro_workflow_run_events",
+				order: [{
+					column: "occurredAt",
+					direction: "asc"
+				}],
+				predicate: H("runId", t),
+				take: 1e3,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${Y.name}`), O[un.name] = (e) => F(T({
+		descriptor: un,
+		executor: (e) => {
+			let t = e;
+			return {
+				table: "_voltro_workflow_events",
+				order: [{
+					column: "occurredAt",
+					direction: "desc"
+				}],
+				predicate: t.name === void 0 ? void 0 : H("name", t.name),
+				take: Math.max(1, Math.min(500, t.limit ?? 100)),
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${un.name}`), O[J.name] = (e) => F(T({
+		descriptor: J,
+		executor: (e) => {
+			let t = e.eventId;
+			return {
+				table: "_voltro_workflow_event_deliveries",
+				order: [{
+					column: "createdAt",
+					direction: "asc"
+				}],
+				predicate: H("eventId", t),
+				take: 500,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${J.name}`), O[ln.name] = (t) => P(async (t, n) => {
+		let r = t;
+		return await b(e.store, n.subject, { executionId: r.executionId }), await m.cancel(r.workflowName, r.executionId), await Ze(r.workflowName, r.executionId, "workflow.cancel"), { ok: !0 };
+	}, t, `action.${ln.name}`), O[dn.name] = (t) => P(async (t, n) => {
+		let r = t;
+		return await b(e.store, n.subject, { executionId: r.executionId }), await m.resume(r.workflowName, r.executionId), { ok: !0 };
+	}, t, `action.${dn.name}`), O[mn.name] = (t) => P(async (t, n) => {
+		let r = t;
+		return await b(e.store, n.subject, { id: r.id }), m.signal({ id: r.id }, r.signalName, r.payload);
+	}, t, `action.${mn.name}`), O[Z.name] = (t) => P(async (t, n) => {
+		let r = t;
+		return await b(e.store, n.subject, { id: r.id }), m.update({ id: r.id }, r.updateName, r.payload, r.timeoutMs === void 0 ? void 0 : { timeoutMs: r.timeoutMs });
+	}, t, `action.${Z.name}`));
+	let We = [
+		...D(e.discovered.queries).map((e) => q(e.descriptor)),
+		...D(e.discovered.mutations).map((e) => sn(e.descriptor)),
+		...D(e.discovered.actions).map((e) => K(e.descriptor)),
+		...je.queries.map((e) => q(e.descriptor)),
+		...je.mutations.map((e) => sn(e.descriptor)),
+		...y.queries.map((e) => q(e.descriptor)),
+		...y.mutations.map((e) => sn(e.descriptor)),
+		...y.actions.map((e) => K(e.descriptor)),
+		...D(e.discovered.streams ?? []).map((e) => cn(e.descriptor)),
+		...x.rpcs,
+		...(e.discovered.workflows ?? []).map((e) => V(e.definition)),
+		...ce ? [
+			q(fn),
+			q(X),
+			q(pn),
+			q(Y),
+			q(un),
+			q(J),
+			K(ln),
+			K(dn),
+			K(mn),
+			K(Z)
+		] : []
+	], Ge = Yt.make(...We).middleware(G).middleware(rn), Ke = M.succeed(G, G.of(({ headers: t, clientId: n }) => j.promise(() => e.resolveSubject(t, n)))), qe = M.succeed(rn, rn.of(({ headers: e, clientId: t }) => j.sync(() => {
+		let n = mt(t) ?? gn(e);
+		return {
+			clientId: t,
+			...e["idempotency-key"] ? { idempotencyKey: e["idempotency-key"] } : {},
+			...n === void 0 ? {} : { credentialExpiresAt: n }
+		};
+	}))), Je = e.dormancyTenantId ?? "default", Ye = e.dormancy === "sleep" ? {
+		register: (t, n, r) => zt(e.store, {
+			tenantId: r ?? Je,
+			kind: "workflow",
+			refId: t,
+			wakeAt: n
+		}),
+		cancel: (t, n) => ct(e.store, {
+			tenantId: n ?? Je,
+			kind: "workflow",
+			refId: t
+		}).then(() => {})
+	} : void 0, k = le ? await import("@voltro/workflow") : void 0, A = k?.makeWorkflowRunRecorder({
+		store: e.store,
+		...Ye === void 0 ? {} : { wakeups: Ye }
+	}), Xe = async (t, n) => {
+		await k.closeWorkflowChildrenForParent({
+			store: e.store,
+			parentExecutionId: t,
+			parentStatus: n,
+			recorder: A,
+			log: { warn: (e, t) => {
+				process.stderr.write(`[workflow] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+			} },
+			interruptChild: async (t, n) => {
+				let r = (e.discovered.workflows ?? []).find((e) => e.definition.name === t);
+				if (!r) throw Error(`Unknown child workflow: ${t}`);
+				if (!o) throw Error("Workflow runtime is not ready");
+				await o.runPromise(r.definition.interrupt(n));
+			}
+		});
+	}, Ze = async (t, n, r) => {
+		let i = (await e.store.query({
+			table: "_voltro_workflow_runs",
+			order: [],
+			predicate: H("executionId", n),
+			projection: void 0,
+			skip: void 0,
+			take: 1
+		}))[0];
+		if (i === void 0) return;
+		let a = await e.store.update("_voltro_workflow_runs", i.id, {
+			status: "cancelled",
+			cancelled: !0,
+			completedAt: /* @__PURE__ */ new Date()
+		}), o = i.subject?.tenantId ?? void 0;
+		a && await A.recordEvent({
+			runId: i.id,
+			eventType: "run-cancelled",
+			payload: {
+				reason: r,
+				workflowName: t,
+				executionId: n,
+				...o == null ? {} : { tenantId: o }
+			}
+		}), a && await Xe(n, "cancelled");
+	}, $e = [...Pt(e.discovered.workflows ?? [], {
+		buildContext: (t, n) => e.buildContextForWorkflow?.(t, n) ?? S({
+			subject: t.subject,
+			traceId: t.traceId
+		}, e.store, void 0, `workflow:${n.workflowName}`, { parentExecutionId: n.executionId }),
+		resolveStartContext: se
+	}, (t, n, r) => {
+		let i = k.getWorkflowVersionMetadata(t.definition);
+		return k.wrapWorkflowExecuteWithRunRecording({
+			name: t.definition.name,
+			store: e.store,
+			subject: r.subject,
+			source: r.source ?? null,
+			traceId: r.traceId,
+			workflowVersion: i.version,
+			workflowCompatibleVersions: i.compatibleWith,
+			workflowPatches: i.patches,
+			parentExecutionId: r?.parentExecutionId ?? null,
+			parentClosePolicy: r?.parentClosePolicy ?? null,
+			onParentClose: ({ executionId: e, status: t }) => Xe(e, t),
+			recorder: A,
+			recordRun: Rt
+		}, n);
+	}), ...e.discovered.workflowWorkers ?? []], nt = $e.length > 0 ? M.mergeAll(...$e) : M.empty;
+	if (((e.discovered.workflows?.length ?? 0) > 0 || (e.discovered.workflowWorkers?.length ?? 0) > 0 || e.scheduleCoordination === "cluster") && e.workflowEngineLayer !== void 0) {
+		let t = nt.pipe(M.provideMerge(e.workflowEngineLayer));
+		o = Qe.make(e.baseLayer === void 0 ? t : t.pipe(M.provideMerge(e.baseLayer))), await o.runPromise(j.void);
+		let n = await import("@voltro/workflow/cluster"), r = (e) => o.runPromise(n.redriveFailedRun(e));
+		f = await c({
+			provider: jn(e.plugins ?? [])?.broadcast?.provider,
+			crossReplica: jn(e.plugins ?? [])?.broadcast?.crossReplica ?? !1,
+			namespace: ye,
+			replicaId: crypto.randomUUID(),
+			pollStorage: () => o.runPromise(n.pollWorkflowStorage),
+			log: (e.log ?? N({ scope: "voltro:serve" })).child("workflow")
+		}), d = async (t) => {
+			let n = await u({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runRedrive: r
+			}, t.runId);
+			return n.statusReset && await A.recordEvent({
+				runId: t.runId,
+				eventType: "run-redriven",
+				payload: {
+					reason: "inspect.redrive",
+					activitiesReset: n.outcome.activitiesReset
+				}
+			}), {
+				redriven: n.outcome.redriven,
+				activitiesReset: n.outcome.activitiesReset,
+				reason: n.outcome.reason
+			};
+		}, i = (e.discovered.workflows?.length ?? 0) > 0 ? Mt({
+			workflows: e.discovered.workflows ?? [],
+			runEffect: (e) => o.runPromise(e),
+			onEnqueue: () => f?.publishWake(),
+			rememberStartContext: oe,
+			signal: async (t, n, r) => {
+				let i = await k.sendWorkflowSignal({
+					store: e.store,
+					recorder: A,
+					target: t,
+					signalName: n,
+					payload: r
+				});
+				return await o.runPromise(k.completeSuspendingSignal({
+					store: e.store,
+					target: t,
+					signalName: n,
+					payload: r
+				})).catch(() => {}), i;
+			},
+			update: (t, n, r, i) => k.sendWorkflowUpdate({
+				store: e.store,
+				recorder: A,
+				target: t,
+				updateName: n,
+				payload: r,
+				...i === void 0 ? {} : { options: i }
+			}),
+			listRuns: (t) => g(e.store, t),
+			retry: (t, n) => l({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runPromise: (e) => o.runPromise(e)
+			}, t, n),
+			redrive: (t) => u({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runRedrive: r
+			}, t).then((e) => e.outcome)
+		}) : void 0;
+	}
+	let at = M.mergeAll(Ge.toLayer(O), Ke, qe), lt = Te(O, e.discovered.queries.map((e) => e.descriptor.name), ce), ut = M.mergeAll(Ge.toLayer(lt), Ke, qe), L = e.observability, dt = await I({
+		...L && L.spanProcessors.length > 0 ? { extraSpanProcessors: L.spanProcessors } : {},
+		...L && L.metricReaders.length > 0 ? { extraMetricReaders: L.metricReaders } : {},
+		...L && Object.keys(L.resourceAttributes).length > 0 ? { resourceAttributes: L.resourceAttributes } : {},
+		...L && L.sampler !== void 0 ? { sampler: L.sampler } : {}
+	}), ft = !1, pt = e.store.ping ? () => e.store.ping().then(() => !0).catch(() => !1) : void 0, { server: yt, shutdown: bt } = Kt({
+		group: Ge,
+		handlersLayer: at,
+		httpHandlersLayer: ut,
+		port: e.port ?? 4e3,
+		...e.host === void 0 ? {} : { host: e.host },
+		path: e.path ?? "/ws",
+		tracerLayer: dt.layer,
+		healthCheck: {
+			isReady: () => ft,
+			...pt ? { ping: pt } : {}
+		},
+		...Ue.length > 0 ? { httpRoutes: Ue } : {},
+		...e.getStore === void 0 ? {} : { getStore: e.getStore },
+		...he.size > 0 ? { webhookRoutes: he } : {},
+		...e.inspectRoute === void 0 ? {} : { inspectRoute: e.inspectRoute }
+	});
+	if (await ot(yt), (e.discovered.schedules?.length ?? 0) > 0) {
+		let t = (e.scheduleCoordination ?? "single") === "advisoryLock" ? vt(e.store, e.scheduleReplicaId ?? `pid-${process.pid}`) : Gt;
+		ne = await B(e.discovered.schedules ?? [], {
+			store: e.store,
+			coordinator: t,
+			defaultTrigger: e.scheduleDefaultTrigger ?? "self",
+			replicaId: e.scheduleReplicaId ?? `pid-${process.pid}`,
+			armSelf: e.scheduleArmSelf ?? !0,
+			dormancy: e.dormancy ?? "always-on",
+			...e.dormancyTenantId === void 0 ? {} : { dormancyTenantId: e.dormancyTenantId },
+			buildContext: ({ traceId: t, scheduleName: n, subject: r }) => S({
+				subject: r,
+				traceId: t
+			}, e.store, void 0, `schedule:${n}`),
+			log: {
+				info: (e, t) => {
+					process.stdout.write(`[schedule] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+				},
+				warn: (e, t) => {
+					process.stderr.write(`[schedule] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+				},
+				error: (e, t) => {
+					process.stderr.write(`[schedule] ERROR ${e} ${t ? JSON.stringify(t) : ""}\n`);
+				},
+				debug: () => {}
+			},
+			...e.scheduleFireInterceptor === void 0 ? {} : { interceptFire: e.scheduleFireInterceptor },
+			...e.onScheduleRunEvent === void 0 ? {} : { onRunEvent: e.onScheduleRunEvent }
+		}), e.onSchedulerReady?.(ne);
+	}
+	let xt = e.log ?? N({ scope: "voltro:serve" }), St, Ct;
+	if ((e.discovered.subscribers?.length ?? 0) > 0 && (St = me(e.discovered.subscribers ?? [], e.store, xt.child("subscribe"), e.schemaRegistry, x.bus)), (e.discovered.reactions?.length ?? 0) > 0) {
+		let t = xt.child("reaction");
+		Ct = de(e.discovered.reactions ?? [], e.store, {
+			runAct: async (n, r) => {
+				if (n.kind === "workflow") {
+					if (m === void 0) {
+						t.warn("reaction workflow act skipped — no workflow engine in this app", { workflow: n.workflow });
+						return;
+					}
+					let e = r.new ?? r.old ?? {};
+					await Nt(m, {
+						traceId: `reaction:${n.workflow}`,
+						source: `reaction:${n.workflow}`
+					}).start(n.workflow, e);
+					return;
+				}
+				await p(n.agent, r, {
+					findAgentSend: (t) => e.discovered.actions.find((e) => e.descriptor.name === `${t}.send`),
+					runAction: (e, t, n) => Promise.resolve(Me(e, t, n)),
+					makeSubject: (e) => an(e),
+					now: () => Date.now(),
+					log: t
+				});
+			},
+			checkBudget: async (n, r) => {
+				try {
+					let { requireAiBudget: t } = await import("@voltro/ai");
+					return (await j.runPromise(j.either(t(e.store, {
+						tenantId: n,
+						limitUsd: r
+					}))))._tag === "Right";
+				} catch (e) {
+					return t.warn("reaction budget check failed — refusing the act", { tenantId: n }, e), !1;
+				}
+			}
+		}, t);
+	}
+	let jt;
+	return (e.discovered.aggregates?.length ?? 0) > 0 && (jt = await ee({
+		discovered: e.discovered.aggregates ?? [],
+		store: e.store,
+		log: xt.child("aggregate"),
+		...e.analytics === void 0 ? {} : { analytics: e.analytics },
+		...e.aggregateStorage === void 0 ? {} : { storage: e.aggregateStorage },
+		...e.aggregateCoordinator === void 0 ? {} : { coordinator: e.aggregateCoordinator }
+	}), C = M.succeed(et, jt.registry)), ft = !0, e.bootTiming?.mark("ready"), {
+		dispatcher: t,
+		server: yt,
+		scheduler: ne,
+		eventsSnapshot: s(x.bus, x.declared),
+		membersSnapshot: () => ({
+			members: Se.membership.list(),
+			capturedAt: Date.now()
+		}),
+		redriveWorkflowRun: (e) => d ? d(e) : Promise.reject(/* @__PURE__ */ Error("redrive: this app registers no workflows")),
+		close: async () => {
+			ft = !1, await we?.detach(), await Se.detach(), jt?.detach(), Ct?.(), St?.(), await ne?.shutdown(), t.close(), await f?.detach(), await o?.dispose(), await new Promise((e) => yt.close(() => e())), await bt();
+		}
+	};
+}, $ = N({ scope: "voltro:serve" }), ir = (e, t, n) => (e === "production" || e === "staging") && t !== "memory" && n !== "0", ar = Ye, or = async (e) => {
+	let t = qe(process.cwd());
+	if ($e(t)) {
+		let n;
+		try {
+			let e = await import(Xe(t).href);
+			typeof e.runServe == "function" ? n = e.runServe : $.warn("serve bundle has no runServe export — using the standard serve path");
+		} catch (e) {
+			$.warn("serve bundle failed to load — using the standard serve path", {}, e);
+		}
+		if (n) return $.info("serve: booting from the precompiled serve bundle"), n(e);
+	}
+	return sr(e);
+}, sr = async (a) => {
+	let s = Je();
+	process.env.NODE_ENV || (process.env.NODE_ENV = "production");
+	try {
+		hn();
+	} catch (e) {
+		throw Bn(e instanceof Error ? e.message : String(e));
+	}
+	let c = process.cwd(), l = Number(process.env.PORT ?? ar(a, "--port") ?? 4e3), u = await _e(c);
+	Ht(Bt(u?.secrets)), await e({
+		rawEnv: u?.env,
+		appType: "api",
+		root: c,
+		log: $,
+		generateTypes: !1
+	}), s.mark("config");
+	let p = (process.env.DB_DIALECT ?? u?.store ?? "memory").toLowerCase(), ee = (p === "mariadb" || p === "postgres" || p === "mssql") && (process.env.CDC ?? "1") !== "0", te = p === "mariadb" ? "mariadb" : p === "mssql" ? "mssql" : void 0, re = Ke(c);
+	if (!i() && $e(re)) try {
+		let e = await import(Xe(re).href);
+		if (e.modules) {
+			let t = {};
+			for (let [n, r] of Object.entries(e.modules)) t[A(c, n)] = r;
+			r(t), $.info("precompiled api bundle loaded", { modules: Object.keys(t).length });
+		}
+	} catch (e) {
+		$.warn("precompiled api bundle failed to load — falling back to source", {}, e);
+	}
+	let h = await xe(c), g = await Me(h, { cdc: ee && te !== void 0 });
+	{
+		let e = /* @__PURE__ */ new Set([
+			...g.queries.filter((e) => e.descriptor.overridesPlugin === !0).map((e) => e.descriptor.name),
+			...g.mutations.filter((e) => e.descriptor.overridesPlugin === !0).map((e) => e.descriptor.name),
+			...g.actions.filter((e) => e.descriptor.overridesPlugin === !0).map((e) => e.descriptor.name)
+		]);
+		O(Ue(u?.plugins ?? []), [
+			...g.queries.map((e) => e.descriptor.name),
+			...g.mutations.map((e) => e.descriptor.name),
+			...g.actions.map((e) => e.descriptor.name),
+			...g.streams.map((e) => e.descriptor.name)
+		], e);
+		let t = ne(g.serverOnlyLeaks, f(process.env, "strict"), dt, "`voltro serve`");
+		if (t.action === "fail") throw Bn(t.message ?? "");
+		t.action === "warn" && $.warn(t.message ?? "");
+	}
+	let de = h.filter((e) => ae.test(e)), _ = de.length > 0 ? await se(de, $.child("webhooks")) : {
+		outgoing: [],
+		incoming: [],
+		providers: []
+	}, me = d(g.events), b = _.outgoing.length + _.incoming.length + _.providers.length + me.length === 0 ? void 0 : {
+		..._,
+		outgoing: [..._.outgoing, ...me]
+	}, Ce = Be({
+		mix: g.featureMix,
+		plugins: u?.plugins ?? [],
+		cdc: ee && te !== void 0,
+		...te ? { cdcDialect: te } : {}
+	}), Te = u?.analytics !== void 0 && u.analytics.kind !== "noop" && p !== "memory" ? (await n(p)).makeSqlLayer(C()) : void 0, Ee = await je({
+		spec: u?.analytics,
+		sqlLayer: Te,
+		log: $
+	}), w = (() => {
+		let e = new Set(g.tables.map((e) => e.tableName)), t = [...g.tables];
+		for (let n of [...Ce, ...Ee.tables]) e.has(n.tableName) || (e.add(n.tableName), t.push(n));
+		return t;
+	})();
+	for (let e of w) Qt(e);
+	{
+		let e = ft(qt(g.queries.map((e) => ({
+			name: e.descriptor.name,
+			source: e.descriptor.source
+		})), new Set(w.flatMap((e) => {
+			let t = e.tableName;
+			return t === void 0 ? [] : [t];
+		}))));
+		e !== void 0 && $.warn(e);
+	}
+	let De = (process.env.NODE_ENV ?? "").toLowerCase();
+	if (ir(De, p, process.env.VOLTRO_AUTO_MIGRATE)) {
+		let e = (await n(p)).makeSqlLayer(C()), t = await j.runPromise(Xt.SqlClient.pipe(j.flatMap((e) => xn(e, w, {
+			appliedBy: `serve:${De}`,
+			environment: "prod",
+			dialectId: p
+		})), j.provide(e)));
+		t.kind === "prod-mismatch" && ($.error(bn(t, p)), $.error("serve: refusing to boot — apply the schema first (voltro db apply in a pre-deploy step), or set VOLTRO_AUTO_MIGRATE=0 to bypass this check."), process.exit(1)), $.info(bn(t, p));
+	}
+	let Fe = jt(w);
+	s.mark("discover");
+	let E = await x(u, void 0), qe = Jt(E, p);
+	for (let e of Le({
+		dialect: String(u?.store ?? process.env.DB_DIALECT ?? "postgres"),
+		changeStrategy: (process.env.CDC ?? "1") === "0" ? "inline" : "cdc",
+		dbUrl: process.env.DB_URL,
+		tables: g.tables.map((e) => ({
+			tableName: e.tableName,
+			isReactive: e.isReactive === !0
+		})),
+		querySources: g.queries.flatMap((e) => {
+			let t = e.descriptor.source;
+			return t === void 0 ? [] : typeof t == "string" ? [t] : [...t];
+		})
+	})) e.level === "warn" ? $.warn(e.message) : $.info(e.message);
+	{
+		let e = T(he({
+			tables: g.tables.map((e) => ({ tableName: e.tableName })),
+			queries: g.queries.map((e) => ({
+				name: e.descriptor.name,
+				source: e.descriptor.source
+			}))
+		}));
+		e !== void 0 && $.warn(e);
+	}
+	u?.cache && !process.env.CACHE_BACKEND && (process.env.CACHE_BACKEND = u.cache), u?.cacheRedisUrl && !process.env.CACHE_REDIS_URL && (process.env.CACHE_REDIS_URL = u.cacheRedisUrl), u?.cacheRedisDriver && !process.env.CACHE_REDIS_DRIVER && (process.env.CACHE_REDIS_DRIVER = u.cacheRedisDriver), u?.cacheKeyPrefix && !process.env.CACHE_KEY_PREFIX && (process.env.CACHE_KEY_PREFIX = u.cacheKeyPrefix);
+	let { service: Ye, invalidationBus: N, snapshotCache: et, cache: tt, backend: rt, dispose: it } = await be({ env: process.env });
+	$.info(`cache backend resolved: ${rt}` + (rt === "redis" ? ` (driver ${process.env.CACHE_REDIS_DRIVER ?? "resp"})` : " — in-process, not cross-instance")), E.onChange((e) => {
+		j.runFork(N.publish(e.table));
+	}), u?.kv && !process.env.KV_BACKEND && (process.env.KV_BACKEND = u.kv), u?.kvRedisUrl && !process.env.KV_REDIS_URL && (process.env.KV_REDIS_URL = u.kvRedisUrl), u?.kvKeyPrefix && !process.env.KV_KEY_PREFIX && (process.env.KV_KEY_PREFIX = u.kvKeyPrefix);
+	let { kv: ot, service: P } = await St({ store: E });
+	s.mark("store");
+	let st = at({
+		store: E,
+		sink: Ee.sink,
+		log: $
+	}), F = Se({
+		store: E,
+		dialect: p
+	}), I = u?.plugins ?? [], ct = process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, mt, ht;
+	p !== "memory" && (mt = Qe.make((await n(p)).makeSqlLayer(C())), ht = await mt.runPromise(Xt.SqlClient));
+	let gt = Ct({
+		coordinator: [
+			"postgres",
+			"mariadb",
+			"mysql",
+			"mssql"
+		].includes(p) ? vt(E, ct, $) : Gt,
+		replicaId: ct,
+		log: $
+	}), _t = [], wt = process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, Tt = jn(u?.plugins ?? [])?.broadcast?.provider, R = Pe(u?.plugins, u?.name ?? k(c));
+	{
+		let e = v(u?.plugins, u?.name ?? k(c));
+		e !== void 0 && $.warn(e);
+	}
+	let Et = ge(u?.plugins, {
+		instanceId: wt,
+		namespace: R,
+		meta: { mode: "serve" },
+		logger: $
+	}), Dt = {
+		...ht ? { sql: ht } : {},
+		instanceId: wt,
+		membership: Et.membership,
+		...Tt === void 0 ? {} : { broadcast: Tt },
+		broadcastChannels: { presence: An(R, "presence") },
+		scheduleCoordinated: (e, t, n) => {
+			let r = gt(e, t, n);
+			return _t.push(r), r;
+		}
+	};
+	for (let e of I) e.bindDataStore?.(E, Dt);
+	let Ot = I.filter((e) => typeof e.onChangeEvent == "function");
+	if (Ot.length > 0) {
+		let e = E.changeScope ?? "local";
+		E.onChange((t) => {
+			let n = fe(t, e);
+			for (let e of Ot) j.runFork(e.onChangeEvent(n).pipe(j.catchAllCause((t) => j.sync(() => $.warn(`plugin ${e.name} onChangeEvent failed`, { error: Ze.pretty(t) })))));
+		});
+	}
+	let kt = we({
+		plugins: I,
+		appName: u?.name ?? "voltro-api",
+		appType: "api",
+		voltroVersion: process.env.npm_package_version ?? "0.0.0",
+		log: $
+	});
+	I.length && await kt.activate(), s.mark("plugins");
+	let At = await kt.gatherObservability(), Mt = {
+		info: (e, t) => process.stdout.write(`[broadcast] ${e} ${t ? JSON.stringify(t) : ""}\n`),
+		warn: (e, t) => process.stderr.write(`[broadcast] ${e} ${t ? JSON.stringify(t) : ""}\n`),
+		debug: () => {}
+	}, Nt, Pt = await ye(E, u, p, R, Mt, (e, t) => {
+		Nt?.refreshAll(`broadcast gap: missed ${t} change(s) from ${e}`);
+	}), z = u?.apiKeys, Lt = (typeof z == "object" ? z.prefix : void 0) ?? "voltro_", Rt = z ? ut(E) : void 0, zt = Rt ? bt({ flush: xt(Rt) }) : void 0;
+	zt && Ft(() => zt.shutdown());
+	let Vt = Rt ? yt(Rt, {
+		prefix: Lt,
+		...zt ? { usage: zt } : {}
+	}) : void 0, Ut = Vt ? [pt(Vt, { prefix: Lt })] : [], Wt = Oe([...u?.auth?.strategies ?? [], ...Ut], Sn(u?.plugins ?? []), u?.auth?.anonymousTenantRequired ?? !1, u?.auth?.resolveScopes, () => qe), Kt = [...u?.restRoutes ?? [], ...Vt ? nt(Vt, (typeof z == "object" ? z.managementPath : void 0) ?? "/v1/api-keys") : []], B = u?.idempotency, V = B ? {
+		store: L(E),
+		header: (typeof B == "object" ? B.header : void 0) ?? "Idempotency-Key",
+		ttlMs: (typeof B == "object" ? B.ttlMs : void 0) ?? 864e5
+	} : void 0, Yt = Kt.length > 0 ? wn(Kt, {
+		store: E,
+		resolveSubject: async (e) => (await Wt({
+			headers: e,
+			clientId: -1
+		})).subject,
+		...V ? { idempotency: V } : {}
+	}) : [], Zt = I.map((e) => e.services).filter((e) => e !== void 0), H = M.mergeAll(y({
+		analyticsLayer: Ee.layer,
+		cacheService: Ye,
+		kvService: P,
+		pluginServices: Zt,
+		userLayers: u?.layers ?? []
+	}), Ne(u?.http ?? {})), $t = u?.scheduling ?? {}, U = $t.trigger ?? "self", en = /* @__PURE__ */ new Set([
+		"postgres",
+		"mysql",
+		"mariadb",
+		"mssql"
+	]), tn = $t.coordination ?? (en.has(p) ? "advisoryLock" : "single"), W = tn === "cluster" && en.has(p), nn = W ? "cluster" : tn === "advisoryLock" && en.has(p) ? "advisoryLock" : "single";
+	tn === "cluster" && !W && $.warn("scheduling.coordination=cluster needs a sql-backed store except sqlite — falling back to single"), tn === "advisoryLock" && !en.has(p) && $.warn("scheduling.coordination=advisoryLock needs a SQL store (the claim-row gate) — falling back to single");
+	let G, rn = g.workflows.length > 0 || g.workflowWorkers.length > 0 || g.eventTriggers.length > 0 || (b?.outgoing.length ?? 0) > 0 || W, K;
+	if (rn) {
+		if (p === "mssql") {
+			let e = await ve(process.cwd());
+			e && $.warn(e);
+		}
+		let [{ WorkflowEngine: e }, { makeClusterCronLayer: t, workflowEngineLayer: r, resolveRunnerStorage: i, resolveFailoverTuning: a }] = await Promise.all([import("@effect/workflow"), import("@voltro/workflow/cluster")]), o = W ? g.schedules.filter((e) => (e.trigger ?? U) === "self").map((e) => t({
+			name: e.name,
+			cron: lt(e),
+			execute: async () => {
+				await G?.fireFromCluster(e.name);
+			}
+		})) : [];
+		K = p === "memory" ? e.layerMemory : await (async () => {
+			let e = await n(p), t = i({ sqliteFamily: e.id === "sqlite" || e.id === "turso" });
+			return $.info(`workflow engine: cluster-${t}, dialect=${e.id}` + (t === "memory" ? " — single-process durable replay, no cross-pod shard handoff" + (e.id !== "sqlite" && e.id !== "turso" ? " (VOLTRO_WORKFLOW_RUNNER_STORAGE=memory: SqlRunnerStorage/cluster_runners + GET_LOCK skipped)" : "") : "")), r({
+				sqlClientLayer: e.makeSqlLayer(C()),
+				runnerStorage: t,
+				dialectId: e.id,
+				...process.env.VOLTRO_WORKFLOW_RUNNER_PORT ? { runnerListenPort: Number(process.env.VOLTRO_WORKFLOW_RUNNER_PORT) } : {},
+				...a(),
+				...o.length > 0 ? { extraShardingLayers: o } : {}
+			});
+		})();
+	}
+	let an = oe(I, t()), on = h.filter((e) => /\.subscribe\.tsx?$/.test(e)), sn = on.length > 0 ? await m(on, $) : [], q = h.filter((e) => /\.reaction\.tsx?$/.test(e)), cn = q.length > 0 ? await ue(q, $) : [], ln = h.filter((e) => We.test(e)), un = ln.length > 0 ? await pe(ln, $) : [], J = h.filter((e) => /\.aggregate\.tsx?$/.test(e)), dn = J.length > 0 ? await ce(J, $) : [], Y = D();
+	if (dn.length > 0 && p !== "memory") try {
+		Y = o((await n(p)).makeSqlLayer(C()));
+	} catch (e) {
+		$.warn("aggregate: SQL storage init failed — falling back to in-process", { err: String(e) });
+	}
+	let fn = p === "memory" ? Gt : vt(E, `aggregate@${process.pid}`, $), pn = [], X = [], mn = h.filter((e) => He.test(e));
+	if (mn.length > 0) {
+		let e = $.child("agent"), t = h.filter((e) => Re.test(e));
+		t.length > 0 && await ze(t, e);
+		let n = await Ve(mn, e);
+		for (let e of n.agents) for (let t of ie(e)) (t.kind === "action" ? pn : X).push({
+			file: t.file,
+			descriptor: t.descriptor,
+			executor: t.executor
+		});
+		n.agents.length > 0 && e.info("synthesized agent routes", { agents: n.agents.map((e) => e.descriptor.name) });
+	}
+	s.mark("workflow");
+	let Z = await rr({
+		bootTiming: s,
+		broadcastNamespace: R,
+		membership: {
+			...Et,
+			instanceId: wt
+		},
+		...u?.plugins === void 0 ? {} : { plugins: u.plugins },
+		...V ? { idempotency: {
+			store: V.store,
+			ttlMs: V.ttlMs
+		} } : {},
+		discovered: {
+			queries: [...g.queries, ...X],
+			mutations: g.mutations,
+			actions: [...g.actions, ...pn],
+			streams: g.streams,
+			events: g.events,
+			workflows: g.workflows,
+			workflowWorkers: g.workflowWorkers,
+			eventTriggers: g.eventTriggers,
+			schedules: g.schedules,
+			subscribers: sn,
+			outboxHandlers: un,
+			connections: g.connections,
+			reactions: cn,
+			aggregates: dn,
+			...b === void 0 ? {} : { webhooks: b }
+		},
+		log: $,
+		analytics: Ee.sink,
+		aggregateStorage: Y,
+		aggregateCoordinator: fn,
+		store: E,
+		kv: ot,
+		cache: tt,
+		snapshotCache: et,
+		schemaRegistry: Fe,
+		tenantScopedTables: g.tenantScopedTables,
+		softDeleteScopedTables: g.softDeleteScopedTables,
+		dataTransferSnapshot: yn(w),
+		dataTransferDialect: p,
+		tenantIsolation: (process.env.VOLTRO_TENANT_ISOLATION ?? u?.tenancy?.isolation) === "namespace" ? "namespace" : "shared-schema",
+		resolveSubject: async (e, t) => {
+			let n = await Wt({
+				headers: e,
+				clientId: t
+			});
+			return It(t, n.credentialExpiresAt), n.subject;
+		},
+		httpRoutes: [...I.flatMap((e) => e.httpRoutes ?? []), ...Yt],
+		getStore: () => qe,
+		...H ? { baseLayer: H } : {},
+		...K === void 0 ? {} : { workflowEngineLayer: K },
+		scheduleDefaultTrigger: U,
+		scheduleCoordination: nn,
+		scheduleArmSelf: !W,
+		dormancy: process.env.VOLTRO_DORMANCY === "sleep" || process.env.VOLTRO_DORMANCY === "always-on" ? process.env.VOLTRO_DORMANCY : u?.dormancy ?? "always-on",
+		scheduleReplicaId: process.env.HOSTNAME ?? `pid-${process.pid}`,
+		...an === void 0 ? {} : { scheduleFireInterceptor: an },
+		onSchedulerReady: (e) => {
+			G = e;
+		},
+		inspectRoute: { handle: (e, t, n, r) => Ge(e, {
+			kind: "api",
+			meta: {
+				name: u?.name ?? "voltro-api",
+				voltroVersion: Ae,
+				port: l,
+				mode: "start",
+				store: p,
+				cdc: ee ? "on" : "off"
+			},
+			rpc: Ie(g, c),
+			workflows: le(g, c),
+			events: () => Z.eventsSnapshot(),
+			members: () => Z.membersSnapshot(),
+			inspectFireSchedule: async ({ name: e, trigger: t }) => {
+				if (!G) throw Error("scheduler not started — this app registers no self-triggered schedules (all schedules are trigger:'external', or there are none).");
+				return { runId: await G.fireNow(e, t) ?? null };
+			},
+			inspectRedriveWorkflowRun: (e) => Z.redriveWorkflowRun(e)
+		}, t, {
+			method: n,
+			...r === void 0 ? {} : { body: r }
+		}) ?? {
+			status: 404,
+			contentType: "application/json",
+			body: JSON.stringify({ error: "not an inspect route" })
+		} },
+		observability: At,
+		port: l,
+		...u?.transport?.wsPath ? { path: u.transport.wsPath } : {}
+	});
+	return Nt = Z.dispatcher, ke(S([
+		g.queries,
+		g.mutations,
+		g.actions,
+		g.streams
+	]), (e) => {
+		$.warn(e);
+	}), $.info(`API listening on :${l}`, {
+		dialect: p,
+		queries: g.queries.length,
+		mutations: g.mutations.length,
+		actions: g.actions.length,
+		streams: g.streams.length,
+		workflows: g.workflows.length,
+		workflowWorkers: g.workflowWorkers.length,
+		schedules: g.schedules.length,
+		scheduleCoordination: nn
+	}), s.finish($), Ft(async () => {
+		for (let e of _t) e.stop();
+		st.detach(), F.stop(), it(), mt?.dispose();
+		try {
+			await kt.deactivate(), await Pt?.close(), await Ee.dispose(), await Z.close(), await E.close?.();
+		} catch (e) {
+			console.error("serve: shutdown step failed, exiting anyway:", e);
+		}
+	}), await new Promise(() => {}), 0;
+};
+//#endregion
+export { or as n, er as r, sr as t };