@voltro/cli 0.27.0 → 0.28.0

package/dist/serveCommand-ZTn-dPFa.js

@@ -0,0 +1,1425 @@
+import { it as e, ot as t, t as n } from "./inspectMetrics-BU90mvJN.js";
+import { n as r, s as i, t as a } from "./seedRunner-Bqxgp7HZ.js";
+import { r as o, t as s } from "./appModuleLoader-C9r9mxZt.js";
+import { $ as c, A as l, At as u, B as d, Bt as ee, C as f, D as te, E as p, F as m, Ft as ne, G as re, H as h, Ht as ie, I as ae, It as oe, J as se, K as g, L as ce, Lt as le, M as _, Mt as ue, N as de, Nt as fe, O as pe, Ot as v, P as y, Pt as b, Q as me, Rt as he, S as ge, St as _e, T as ve, U as x, V as ye, Vt as be, W as xe, X as S, Y as Se, Z as Ce, _ as we, _t as C, at as w, b as Te, bt as Ee, c as De, ct as Oe, d as ke, dt as Ae, et as je, ft as Me, g as T, gt as Ne, h as Pe, ht as Fe, i as Ie, it as E, j as D, jt as Le, k as Re, kt as ze, lt as Be, mt as Ve, nt as O, o as k, ot as A, pt as He, q as Ue, r as We, rt as Ge, st as j, t as Ke, tt as qe, u as Je, ut as Ye, v as Xe, w as Ze, x as Qe, xt as M, y as $e, yt as N, z as et } from "./dev-CEZwJhmb.js";
+import { _ as tt, f as nt, m as rt, n as it, p as at, u as ot, v as st } from "./frameworkTableAssembly-BwHU9Euq.js";
+import { u as P, y as ct } from "./fileConventions-3bffWssN.js";
+import { p as lt } from "./inspect-CUCCzw2I.js";
+import { n as ut, t as dt } from "./startupRunner-DPGFchOa.js";
+import { r as ft, u as F } from "./apiBuild-eUM32r1u.js";
+import { t as pt } from "./bootTiming-BdyP9nYw.js";
+import { n as mt } from "./cliArgs-qdZSElM3.js";
+import { basename as I, join as ht } from "node:path";
+import { pathToFileURL as gt } from "node:url";
+import { Cause as _t, Effect as L, Layer as R, ManagedRuntime as vt } from "effect";
+import { createLogger as z } from "@voltro/logger";
+import { existsSync as yt } from "node:fs";
+import { AggregateRegistry as bt, Dispatcher as xt, apiKeyManagementRoutes as St, attachAnalyticsMirror as Ct, awaitServerListening as wt, bindMutation as B, bindStream as Tt, bindSubscription as V, buildTracingLayer as H, cancelWakeup as Et, compileCron as Dt, dataStoreApiKeyStore as Ot, dataStoreIdempotencyStore as kt, formatServerOnlyLeaks as At, formatUnresolvedSources as jt, frameworkApiKeyStrategy as Mt, getCredentialExpiry as Nt, installPolicyGuardResolver as Pt, loadResourceTuples as Ft, makeActionRunner as It, makeAdvisoryLockCoordinator as Lt, makeApiKeyService as Rt, makeApiKeyUsageBuffer as zt, makeApiKeyUsageFlusher as Bt, makeAsyncKv as Vt, makeCoordinatedScheduler as Ht, makeEffectStoreLayer as Ut, makeLazyWorkflowFacade as Wt, makeMutationOutputCodec as Gt, makeMutationRunner as Kt, makeOneShotQueryRunner as qt, makeQueryDescriptorProducer as Jt, makeQueryFinalizer as Yt, makeQueryReauthorizer as Xt, makeQuerySubscriber as Zt, makeSchemaRegistry as Qt, makeWorkflowFacade as $t, makeWorkflowFacadeWithCallerContext as en, makeWorkflowLayers as tn, noopKv as nn, onProcessShutdown as rn, recordCredentialExpiry as an, recordSubscriptionDelivery as on, recordWorkflowRun as sn, registerWakeup as cn, resolveSecretsBackend as ln, runProvidedEffect as un, setSecretsBackend as dn, setSystemStoreHandle as fn, setTupleSource as pn, singleCoordinator as mn, startRpcServer as hn, startScheduler as gn, unresolvedSources as _n, workflowToRpc as vn, wrapStoreWithBootCodec as yn } from "@voltro/runtime";
+import { RpcGroup as bn } from "@effect/rpc";
+import { SqlClient as xn } from "@effect/sql";
+import { and as Sn, ensureTableRegistered as Cn, eq as U, or as wn } from "@voltro/database";
+import { appStorageProvider as W, fromNodeReadable as Tn, getObjectStream as G, putObjectStream as En, toNodeReadable as Dn } from "@voltro/plugin-storage";
+import { AuthMiddleware as On, ConnectionInfoMiddleware as kn, actionToRpc as K, anonymousSubject as An, isWireReachable as jn, mutationToRpc as Mn, queryToRpc as q, streamToRpc as Nn, workflowCancelDescriptor as Pn, workflowDomainEventsQueryDescriptor as Fn, workflowEventDeliveriesQueryDescriptor as In, workflowResumeDescriptor as Ln, workflowRunEventsQueryDescriptor as Rn, workflowRunQueryDescriptor as zn, workflowRunStepsQueryDescriptor as Bn, workflowRunsQueryDescriptor as J, workflowSignalDescriptor as Y, workflowUpdateDescriptor as X } from "@voltro/protocol";
+import { isEnvContract as Vn } from "@voltro/env";
+import { assertProductionSessionSecret as Hn, sessionExpiryFromHeaders as Un } from "@voltro/protocol/session";
+import { createHash as Z, timingSafeEqual as Wn } from "node:crypto";
+import { declaredSnapshot as Gn, describeOutcome as Kn, runPlannedMigrations as qn } from "@voltro/database/sql";
+import { getAuthSessionStrategy as Jn } from "@voltro/plugin-auth";
+import { collectPublicApiRoutes as Yn, restRoutesToHttpRoutes as Xn } from "@voltro/protocol/rest";
+import { buildDeliverWebhookExecute as Zn, buildWebhooksService as Qn, defaultIncomingPath as $n, deliverWebhookWorkflow as er, mountIncomingWebhook as tr } from "@voltro/plugin-webhooks";
+import { registerEmailTemplates as nr } from "@voltro/plugin-mail";
+import { channelFor as rr, getBroadcastPlugin as ir } from "@voltro/plugin-broadcast";
+import { packBundle as ar, runExport as or, runImport as sr, storageBlobSink as cr, storageRefsBlobSource as lr, unpackBundle as ur, unpackBundleToDir as dr } from "@voltro/data-transfer";
+//#region src/bootRefusal.ts
+var fr = "VoltroBootRefusal", pr = (e) => {
+	let t = Error(e);
+	return t.name = fr, t;
+}, mr = (e, t) => {
+	let n = e !== void 0 && t !== void 0 ? e * t : void 0;
+	return e === void 0 ? "db pool: max per replica UNSET (DB_MAX_CONNECTIONS) — each replica opens the driver's default pool, so the fleet total is that default × replicas. Set DB_MAX_CONNECTIONS so the total stays under your database's connection limit; the pool scales with replicaCount and the database does not." : `db pool: max=${e} per replica (DB_MAX_CONNECTIONS)` + (n === void 0 ? " — the fleet opens up to max × replicas connections. Check that against your database's limit before raising replicaCount." : ` × ${t} replicas = up to ${n} connections. Check that against your database's limit.`);
+}, hr = (e = process.env) => {
+	let t = e.REPLICA_COUNT;
+	if (t === void 0 || t === "") return;
+	let n = Number(t);
+	return Number.isInteger(n) && n > 0 ? n : void 0;
+}, gr = "/_voltro/admin/import", _r = "/_voltro/admin/export", Q = (e, t) => ({
+	status: e,
+	contentType: "application/json; charset=utf-8",
+	body: JSON.stringify(t)
+}), vr = (e) => {
+	let t = e.authorization ?? e.Authorization, n = t ? /^Bearer\s+(.+)$/i.exec(t) : null;
+	return n ? n[1] : null;
+}, yr = (e, t) => Wn(Z("sha256").update(e).digest(), Z("sha256").update(t).digest()), br = (e, t) => {
+	if (e.method.toUpperCase() !== "POST") return Q(405, { error: "method not allowed" });
+	if (!t || t.length < 16) return Q(503, { error: "data transfer misconfigured (no/weak secret)" });
+	let n = vr(e.headers);
+	return !n || !yr(n, t) ? Q(401, { error: "unauthorized" }) : null;
+}, xr = z({ scope: "voltro:admin-import" }), Sr = "VBUNDLE2", Cr = async function* (e) {
+	yield e;
+}, wr = (e) => async (t) => {
+	let n = br(t, e.secret);
+	if (n) return n;
+	let r = t.headers["x-import-mode"], i = t.headers["x-import-on-conflict"], a = t.headers["x-import-atomic"] === "1" || t.headers["x-import-atomic"] === "true", o = t.headers["x-import-force"] === "1" || t.headers["x-import-force"] === "true", s = t.rawBody.byteLength >= 8 && Buffer.from(t.rawBody.subarray(0, 8)).toString("latin1") === Sr, c, l;
+	if (s) c = Cr(t.rawBody), l = "upload";
+	else {
+		let n;
+		try {
+			n = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
+		} catch {
+			return Q(400, { error: "body must be a packed bundle archive or { bundleKey } JSON" });
+		}
+		if (typeof n.bundleKey != "string" || !n.bundleKey) return Q(400, { error: "body.bundleKey (string) is required for the storage transport" });
+		if (!e.openArchive) return Q(501, { error: "storage transport not configured on this instance" });
+		c = e.openArchive(n.bundleKey), l = "storage";
+	}
+	let u = await import("node:os"), d = await import("node:fs/promises"), ee = await import("node:path"), f = await d.mkdtemp(ee.join(u.tmpdir(), "voltro-admin-import-"));
+	try {
+		e.assetSink ? await ur(c, {
+			dir: f,
+			blobs: e.assetSink
+		}) : await dr(c, f);
+		let t = await L.runPromiseExit(sr({
+			store: e.store,
+			bundleDir: f,
+			...r ? { mode: r } : {},
+			...i ? { onConflict: i } : {},
+			...a ? { atomic: a } : {},
+			...e.snapshot ? { targetSnapshot: e.snapshot } : {},
+			force: o,
+			onWarn: (e) => xr.warn("admin.import", { message: e }),
+			...e.assetSink ? { assetsAlreadyRestored: !0 } : {}
+		}));
+		if (t._tag === "Failure") {
+			let e = t.cause._tag === "Fail" ? t.cause.error : void 0;
+			if (e && e._tag === "SchemaDriftError") {
+				let t = e;
+				return xr.warn("admin.import refused (schema drift)", {
+					transport: l,
+					bundle: t.bundleFingerprint.slice(0, 16),
+					target: t.targetFingerprint.slice(0, 16)
+				}), Q(409, {
+					error: "schema drift",
+					bundleFingerprint: t.bundleFingerprint,
+					targetFingerprint: t.targetFingerprint,
+					diff: t.diff,
+					hint: "re-export against the current schema, or resend with x-import-force: 1"
+				});
+			}
+			throw Error(String(e?.message ?? e ?? "import failed"));
+		}
+		let n = t.value, s = n.tables.reduce((e, t) => e + t.rowCount, 0);
+		return xr.info("admin.import", {
+			transport: l,
+			tables: n.tables.length,
+			rows: s,
+			mode: r ?? "upsert",
+			atomic: a
+		}), Q(200, {
+			tables: n.tables.length,
+			rows: s,
+			transport: l
+		});
+	} catch (e) {
+		return xr.warn("admin.import failed", {
+			transport: l,
+			error: e?.message ?? String(e)
+		}), Q(500, {
+			error: "import failed",
+			message: e?.message ?? String(e)
+		});
+	} finally {
+		await d.rm(f, {
+			recursive: !0,
+			force: !0
+		});
+	}
+}, Tr = z({ scope: "voltro:admin-export" }), Er = async (e) => {
+	let t = [];
+	for await (let n of e) t.push(Buffer.from(n));
+	return new Uint8Array(Buffer.concat(t));
+}, Dr = (e) => typeof e.tenant == "string" && e.tenant ? {
+	kind: "tenant",
+	tenantId: e.tenant
+} : Array.isArray(e.tables) && e.tables.length ? {
+	kind: "tables",
+	tables: e.tables.filter((e) => typeof e == "string")
+} : { kind: "all" }, Or = (e) => async (t) => {
+	let n = br(t, e.secret);
+	if (n) return n;
+	let r;
+	try {
+		r = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
+	} catch {
+		return Q(400, { error: "body must be JSON: { profile?, tenant?, tables?, consistency?, compression?, bundleKey? }" });
+	}
+	let i = {};
+	if (typeof r.profile == "string" && r.profile) {
+		if (!e.loadProfile) return Q(501, { error: "server-side profiles not configured on this instance" });
+		try {
+			i = await e.loadProfile(r.profile);
+		} catch (e) {
+			return Q(400, {
+				error: `profile '${r.profile}' could not be loaded`,
+				message: e?.message ?? String(e)
+			});
+		}
+	}
+	let a = r.consistency === "snapshot" ? "snapshot" : i.consistency ?? "live", o = (typeof r.compression == "string" ? r.compression : void 0) ?? i.compression, s = i.scope ?? Dr(r), c = typeof r.bundleKey == "string" && r.bundleKey.length > 0, l = r.assets === !0 && e.assetSource ? { blobs: e.assetSource } : {}, u = await import("node:os"), d = await import("node:fs/promises"), ee = await import("node:path"), f = await d.mkdtemp(ee.join(u.tmpdir(), "voltro-admin-export-"));
+	try {
+		let t = await L.runPromise(or({
+			store: e.store,
+			snapshot: e.snapshot,
+			dialect: e.dialect,
+			outDir: f,
+			...i.subset ? { subset: i.subset } : {
+				scope: s,
+				...e.tenantTables && e.tenantTables.length > 0 ? { tenantTables: e.tenantTables } : {}
+			},
+			consistency: a,
+			...o ? { compression: o } : {},
+			...i.masking ? { masking: i.masking } : {}
+		})), n = t.tables.reduce((e, t) => e + t.rowCount, 0), u = t.masking?.transformed.length ?? 0;
+		if (c) {
+			if (!e.putArchive) return Q(501, { error: "storage transport not configured on this instance" });
+			let i = r.bundleKey;
+			return await e.putArchive(i, () => ar({
+				dir: f,
+				...l
+			})), Tr.info("admin.export", {
+				transport: "storage",
+				tables: t.tables.length,
+				rows: n,
+				masked: u,
+				bundleKey: i
+			}), Q(200, {
+				bundleKey: i,
+				tables: t.tables.length,
+				rows: n,
+				masked: u,
+				transport: "storage"
+			});
+		}
+		let d = await Er(ar({
+			dir: f,
+			...l
+		}));
+		return Tr.info("admin.export", {
+			transport: "download",
+			tables: t.tables.length,
+			rows: n,
+			masked: u,
+			bytes: d.byteLength
+		}), {
+			status: 200,
+			contentType: "application/octet-stream",
+			body: d,
+			headers: {
+				"x-export-tables": String(t.tables.length),
+				"x-export-rows": String(n),
+				"x-export-masked": String(u)
+			}
+		};
+	} catch (e) {
+		return Tr.warn("admin.export failed", { error: e?.message ?? String(e) }), Q(500, {
+			error: "export failed",
+			message: e?.message ?? String(e)
+		});
+	} finally {
+		await d.rm(f, {
+			recursive: !0,
+			force: !0
+		});
+	}
+}, kr = async (e) => {
+	let { resolve: t } = await import("node:path"), { existsSync: n } = await import("node:fs"), r = [
+		e,
+		`${e}.profile.ts`,
+		`data-profiles/${e}.ts`,
+		`data-profiles/${e}.profile.ts`
+	].map((e) => t(process.cwd(), e)), i = r.find((e) => n(e));
+	if (!i) throw Error(`data profile '${e}' not found (looked for: ${r.join(", ")})`);
+	let a = await import(i), o = a.default ?? a.profile;
+	if (!o) throw Error(`data profile '${i}' has no default export`);
+	return o;
+}, Ar = (e, t, n = {}) => (async function* () {
+	let r = await Dn((await L.runPromise(G(e, t).pipe(L.timeout(n.openTimeout ?? "30 seconds")))).stream), i = n.stallMs ?? 12e4, a, o = () => {
+		a && clearTimeout(a), a = setTimeout(() => r.destroy(/* @__PURE__ */ Error(`storage read stalled for ${i}ms reading '${t}'`)), i);
+	};
+	try {
+		o();
+		for await (let e of r) o(), yield e instanceof Uint8Array ? e : new Uint8Array(e);
+	} finally {
+		a && clearTimeout(a), r.destroy();
+	}
+})(), jr = {
+	get: async () => void 0,
+	set: async () => {},
+	setWithTags: async () => {},
+	remove: async () => !1,
+	has: async () => !1,
+	clear: async () => {},
+	invalidateTag: async () => 0,
+	wrap: async (e, t, n) => n()
+}, Mr = async (e) => {
+	fn({
+		dataStore: e.store,
+		schemaRegistry: e.schemaRegistry
+	});
+	let t = new xt({
+		store: e.store,
+		...e.snapshotCache ? { cache: e.snapshotCache } : {},
+		recordDelivery: (e) => on({
+			label: e.label,
+			kind: e.kind,
+			durationMs: e.durationMs,
+			rowCount: e.rowCount
+		})
+	}), r = e.cache ?? jr, i = e.kv ?? nn, a, o, s, c, l, u = /* @__PURE__ */ new Map(), ee = () => `wfctx_${globalThis.crypto?.randomUUID?.() ?? `${Date.now().toString(36)}${Math.random().toString(36).slice(2)}`}`, f = async (t, n, r) => {
+		let i = {
+			...r,
+			source: r.source ?? `workflow:${t}`
+		};
+		u.set(n, i);
+		try {
+			let r = await e.store.query({
+				table: "_voltro_workflow_start_contexts",
+				order: [],
+				predicate: U("executionId", n),
+				projection: ["id"],
+				skip: void 0,
+				take: 1
+			}), a = {
+				workflowName: t,
+				executionId: n,
+				subject: i.subject ?? null,
+				traceId: i.traceId ?? null,
+				source: i.source ?? null,
+				parentExecutionId: i.parentExecutionId ?? null,
+				parentClosePolicy: i.parentClosePolicy ?? null,
+				createdAt: /* @__PURE__ */ new Date()
+			};
+			r[0] === void 0 ? await e.store.insert("_voltro_workflow_start_contexts", {
+				id: ee(),
+				...a
+			}) : await e.store.update("_voltro_workflow_start_contexts", r[0].id, a);
+		} catch (e) {
+			process.stderr.write(`[workflow] failed to persist start context for ${t}/${n}: ${e?.message ?? String(e)}\n`);
+		}
+	}, te = async (t, n) => {
+		let r = u.get(n);
+		if (r !== void 0) return r;
+		try {
+			let t = (await e.store.query({
+				table: "_voltro_workflow_start_contexts",
+				order: [],
+				predicate: U("executionId", n),
+				projection: void 0,
+				skip: void 0,
+				take: 1
+			}))[0];
+			if (t === void 0) return;
+			let r = {
+				...t.subject === null ? {} : { subject: t.subject },
+				...t.traceId === null ? {} : { traceId: t.traceId },
+				...t.source === null ? {} : { source: t.source },
+				...t.parentExecutionId === null ? {} : { parentExecutionId: t.parentExecutionId },
+				...t.parentClosePolicy === null ? {} : { parentClosePolicy: t.parentClosePolicy }
+			};
+			return u.set(n, r), r;
+		} catch (e) {
+			process.stderr.write(`[workflow] failed to load start context for ${n}: ${e?.message ?? String(e)}\n`);
+			return;
+		}
+	}, p = (e.discovered.workflows?.length ?? 0) > 0 ? Wt(() => a) : void 0, ne = (e.discovered.workflows?.length ?? 0) > 0 || (e.discovered.eventTriggers?.length ?? 0) > 0, re = ne || (e.discovered.workflowWorkers?.length ?? 0) > 0 || e.scheduleCoordination === "cluster", ae = e.tenantIsolation === "namespace", oe = (e.log ?? z({ scope: "voltro:serve" })).child("webhooks"), se, ce = e.discovered.webhooks;
+	if (ce && ce.outgoing.length > 0 && e.workflowEngineLayer !== void 0) {
+		let t = e.workflowEngineLayer, n = fe({
+			store: e.store,
+			schemaRegistry: e.schemaRegistry,
+			cache: r,
+			kv: i
+		}), a = ce.outgoing.map((e) => e.descriptor);
+		se = Qn(n, async (e) => {
+			let r = er.execute(e).pipe(L.provide(er.toLayer(Zn(n, { events: a })).pipe(R.provideMerge(t))));
+			L.runPromise(r).catch((t) => {
+				oe.error("deliverWebhook workflow crashed", {
+					deliveryId: e.deliveryId,
+					targetId: e.targetId
+				}, t);
+			});
+		}, { events: a });
+	}
+	let le = /* @__PURE__ */ new Map();
+	if (ce) for (let e of ce.incoming) {
+		let t = e.descriptor.path ?? $n(e.descriptor.id), n = `VOLTRO_WEBHOOK_SECRET_${e.descriptor.id.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`, r = tr(e.descriptor, {
+			resolveSecret: async () => process.env[n] ?? null,
+			resolveWorkflows: () => p === void 0 ? void 0 : en(p, {
+				traceId: `incoming:${e.descriptor.id}`,
+				source: `incoming:${e.descriptor.id}`
+			}),
+			log: (e) => {
+				let t = {
+					webhookId: e.webhookId,
+					status: e.status,
+					signatureOk: String(e.signatureOk),
+					idempotency: e.idempotency,
+					durationMs: e.durationMs
+				};
+				e.status >= 500 ? oe.error("incoming delivery failed", t) : e.status >= 400 ? oe.warn("incoming delivery rejected", t) : oe.info("incoming delivery handled", t);
+			}
+		});
+		le.set(t, { handle: r });
+	}
+	Pt(), pn((t) => Ft(e.store, t.subjectId, t.resourceType, t.resourceId));
+	let pe = (e.discovered.outboxHandlers?.length ?? 0) > 0 ? Fe({
+		handlers: e.discovered.outboxHandlers ?? [],
+		store: e.store,
+		log: (e.log ?? z({ scope: "voltro:serve" })).child("outbox")
+	}) : void 0, b = He({
+		definitions: (e.discovered.connections ?? []).map((e) => e.definition),
+		store: e.store,
+		publicUrl: Me(e.port ?? 4e3),
+		log: (e.log ?? z({ scope: "voltro:serve" })).child("connections")
+	});
+	_({
+		events: e.discovered.events ?? [],
+		rpcTags: [
+			...e.discovered.queries.map((e) => e.descriptor.name),
+			...e.discovered.mutations.map((e) => e.descriptor.name),
+			...e.discovered.actions.map((e) => e.descriptor.name),
+			...(e.discovered.streams ?? []).map((e) => e.descriptor.name)
+		]
+	});
+	let me = (e.log ?? z({ scope: "voltro:serve" })).child("events"), he = e.broadcastNamespace ?? Xe(e.plugins, void 0), ge = $e(e.plugins, he, me), _e = e.membership?.instanceId ?? process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, ve = e.membership ?? Te(e.plugins, {
+		instanceId: _e,
+		namespace: he,
+		meta: { mode: "serve" },
+		logger: me
+	}), x = de({
+		events: e.discovered.events ?? [],
+		origin: _e,
+		...ge.publishRemote === void 0 ? {} : { publishRemote: ge.publishRemote }
+	}), be = (e.discovered.events ?? []).length > 0 ? await ge.attach(x.bus) : null, S = ue({
+		store: e.store,
+		schemaRegistry: e.schemaRegistry,
+		cache: r,
+		kv: i,
+		...se === void 0 ? {} : { webhooksService: se },
+		...p === void 0 ? {} : { workflowsProxy: p },
+		eventTriggers: e.discovered.eventTriggers ?? [],
+		namespaceIsolationOn: ae,
+		...pe === void 0 ? {} : { outbox: { nudge: pe.nudge } },
+		...b.active ? { connections: { registry: b.registry } } : {},
+		eventBus: x.bus
+	}), Se = R.succeed(bt, O), Ce = (t, n) => {
+		let r = t.pipe(L.provide(Ut(n)));
+		return (e.baseLayer ? r.pipe(L.provide(e.baseLayer)) : r).pipe(L.provide(Se));
+	}, we = (e, t) => un(Ce(e, t)), C = n(), w = xe(e.plugins ?? [], C), Ee = h(e.plugins ?? [], C), De = Kt({
+		store: e.store,
+		recordMetric: (e) => {
+			C.record(e);
+		},
+		...w.mutation === void 0 ? {} : { interceptor: w.mutation },
+		buildContext: (e, t, n) => S(e, t, n),
+		runEffect: we,
+		undoCapture: Ue()
+	}), Oe = g(), ke = It({
+		buildContext: (e) => S(e),
+		runEffect: we,
+		recordMetric: (e) => {
+			C.record(e);
+		},
+		...w.action === void 0 ? {} : { interceptor: w.action }
+	}), Ae = Yt({
+		tenantScopedTables: e.tenantScopedTables,
+		softDeleteScopedTables: e.softDeleteScopedTables
+	}), je = {
+		buildContext: (e) => S(e),
+		finalize: (e, t) => Ae(e, t.subject),
+		provideEffect: Ce,
+		...w.query === void 0 ? {} : { interceptor: w.query }
+	}, T = Jt(je), Pe = qt({
+		...je,
+		queryRows: (t) => e.store.query(t)
+	}), Ie = Zt({
+		...je,
+		subscribeDescriptor: (e, n, r) => t.subscribe(e, n, r),
+		subscribeComputed: (e, n, r) => t.subscribeComputed(e, n, r)
+	}), E = (e) => e.filter((e) => jn(e.descriptor)), D = {};
+	for (let n of [
+		...E(e.discovered.queries),
+		...Oe.queries,
+		...b.queries
+	]) D[n.descriptor.name] = (e) => V(T(n, e), t, `subscription.${n.descriptor.name}`, void 0, void 0, Xt(n, e));
+	for (let t of [
+		...E(e.discovered.mutations),
+		...Oe.mutations,
+		...b.mutations
+	]) {
+		let n = Gt(t.descriptor.output);
+		D[t.descriptor.name] = (r) => B(async (e, n) => De(t, e, n), r, `mutation.${t.descriptor.name}`, n, e.idempotency);
+	}
+	for (let t of [...E(e.discovered.actions), ...b.actions]) {
+		let n = Gt(t.descriptor.output);
+		D[t.descriptor.name] = (r) => B(async (e, n) => ke(t, e, n), r, `action.${t.descriptor.name}`, n, e.idempotency);
+	}
+	let Re = () => `public-${Math.random().toString(36).slice(2, 10)}`, ze = [
+		...e.discovered.queries.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => Pe(e, t, {
+				subject: n.subject,
+				traceId: Re()
+			}),
+			subscribe: (t, n, r) => Ie(e, t, {
+				subject: n.subject,
+				traceId: Re()
+			}, r)
+		})),
+		...e.discovered.mutations.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => De(e, t, {
+				subject: n.subject,
+				traceId: Re()
+			})
+		})),
+		...e.discovered.actions.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => ke(e, t, {
+				subject: n.subject,
+				traceId: Re()
+			})
+		}))
+	], Be = ze.length > 0 ? Xn(Yn(ze), {
+		store: e.store,
+		resolveSubject: (t) => e.resolveSubject(t, -1)
+	}) : [], Ve = e.dataTransferSecret ?? process.env.VOLTRO_DATA_TRANSFER_SECRET, k = Ve && Ve.length >= 16 ? [{
+		method: "POST",
+		path: gr,
+		handle: wr({
+			secret: Ve,
+			store: e.store,
+			...e.dataTransferSnapshot ? { snapshot: e.dataTransferSnapshot } : {},
+			assetSink: cr(W()),
+			openArchive: (e) => Ar(W(), e)
+		})
+	}, {
+		method: "POST",
+		path: _r,
+		handle: Or({
+			secret: Ve,
+			store: e.store,
+			snapshot: e.dataTransferSnapshot ?? { tables: [] },
+			dialect: e.dataTransferDialect ?? "memory",
+			tenantTables: [...e.tenantScopedTables],
+			loadProfile: kr,
+			assetSource: lr(W(), e.store),
+			putArchive: async (e, t) => {
+				let { Readable: n } = await import("node:stream"), r = W(), i = Tn("storage", () => n.from(t()));
+				await L.runPromise(En(r, e, i, { contentType: "application/octet-stream" }));
+			}
+		})
+	}] : [], We = [
+		...e.httpRoutes ?? [],
+		...Be,
+		...k,
+		...b.httpRoutes
+	];
+	Object.assign(D, x.handlers);
+	for (let t of E(e.discovered.streams ?? [])) D[t.descriptor.name] = (n) => Tt((r) => {
+		let i = S(r), a = t.executor(n, i);
+		if (L.isEffect(a)) {
+			let t = a.pipe(L.provide(Ut(i.store)));
+			return (e.baseLayer ? t.pipe(L.provide(e.baseLayer)) : t).pipe(L.provide(Se));
+		}
+		return typeof a == "object" && a && typeof a.then == "function" ? L.promise(() => a) : a;
+	}, `stream.${t.descriptor.name}`);
+	for (let t of e.discovered.workflows ?? []) D[t.definition.name] = (e) => B(async (e, n) => {
+		let r = n;
+		return en(p, {
+			subject: r.subject,
+			traceId: r.traceId,
+			source: "workflow-rpc"
+		}).start(t.definition.name, e);
+	}, e, `workflow.${t.definition.name}`);
+	ne && (D[zn.name] = (e) => V(T({
+		descriptor: zn,
+		executor: (e) => {
+			let t = e.id;
+			return {
+				table: "_voltro_workflow_runs",
+				order: [{
+					column: "startedAt",
+					direction: "desc"
+				}],
+				predicate: wn(U("id", t), U("executionId", t)),
+				take: 1,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${zn.name}`), D[J.name] = (e) => V(T({
+		descriptor: J,
+		executor: (e) => {
+			let t = e, n = [...t.tag === void 0 ? [] : [U("tag", t.tag)], ...t.status === void 0 ? [] : [U("status", t.status)]], r = Number.isFinite(t.limit) && t.limit !== void 0 ? Math.min(Math.max(Math.floor(t.limit), 1), 500) : 100;
+			return {
+				table: "_voltro_workflow_runs",
+				order: [{
+					column: "startedAt",
+					direction: "desc"
+				}],
+				predicate: n.length === 0 ? void 0 : n.length === 1 ? n[0] : Sn(...n),
+				take: r,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${J.name}`), D[Bn.name] = (e) => V(T({
+		descriptor: Bn,
+		executor: (e) => {
+			let t = e.runId;
+			return {
+				table: "_voltro_workflow_run_steps",
+				order: [{
+					column: "startedAt",
+					direction: "asc"
+				}],
+				predicate: U("runId", t),
+				take: 1e3,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${Bn.name}`), D[Rn.name] = (e) => V(T({
+		descriptor: Rn,
+		executor: (e) => {
+			let t = e.runId;
+			return {
+				table: "_voltro_workflow_run_events",
+				order: [{
+					column: "occurredAt",
+					direction: "asc"
+				}],
+				predicate: U("runId", t),
+				take: 1e3,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${Rn.name}`), D[Fn.name] = (e) => V(T({
+		descriptor: Fn,
+		executor: (e) => {
+			let t = e;
+			return {
+				table: "_voltro_workflow_events",
+				order: [{
+					column: "occurredAt",
+					direction: "desc"
+				}],
+				predicate: t.name === void 0 ? void 0 : U("name", t.name),
+				take: Math.max(1, Math.min(500, t.limit ?? 100)),
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${Fn.name}`), D[In.name] = (e) => V(T({
+		descriptor: In,
+		executor: (e) => {
+			let t = e.eventId;
+			return {
+				table: "_voltro_workflow_event_deliveries",
+				order: [{
+					column: "createdAt",
+					direction: "asc"
+				}],
+				predicate: U("eventId", t),
+				take: 500,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), t, `subscription.${In.name}`), D[Pn.name] = (t) => B(async (t, n) => {
+		let r = t;
+		return await Le(e.store, n.subject, { executionId: r.executionId }), await p.cancel(r.workflowName, r.executionId), await nt(r.workflowName, r.executionId, "workflow.cancel"), { ok: !0 };
+	}, t, `action.${Pn.name}`), D[Ln.name] = (t) => B(async (t, n) => {
+		let r = t;
+		return await Le(e.store, n.subject, { executionId: r.executionId }), await p.resume(r.workflowName, r.executionId), { ok: !0 };
+	}, t, `action.${Ln.name}`), D[Y.name] = (t) => B(async (t, n) => {
+		let r = t;
+		return await Le(e.store, n.subject, { id: r.id }), p.signal({ id: r.id }, r.signalName, r.payload);
+	}, t, `action.${Y.name}`), D[X.name] = (t) => B(async (t, n) => {
+		let r = t;
+		return await Le(e.store, n.subject, { id: r.id }), p.update({ id: r.id }, r.updateName, r.payload, r.timeoutMs === void 0 ? void 0 : { timeoutMs: r.timeoutMs });
+	}, t, `action.${X.name}`));
+	let Ge = [
+		...E(e.discovered.queries).map((e) => q(e.descriptor)),
+		...E(e.discovered.mutations).map((e) => Mn(e.descriptor)),
+		...E(e.discovered.actions).map((e) => K(e.descriptor)),
+		...Oe.queries.map((e) => q(e.descriptor)),
+		...Oe.mutations.map((e) => Mn(e.descriptor)),
+		...b.queries.map((e) => q(e.descriptor)),
+		...b.mutations.map((e) => Mn(e.descriptor)),
+		...b.actions.map((e) => K(e.descriptor)),
+		...E(e.discovered.streams ?? []).map((e) => Nn(e.descriptor)),
+		...x.rpcs,
+		...(e.discovered.workflows ?? []).map((e) => vn(e.definition)),
+		...ne ? [
+			q(zn),
+			q(J),
+			q(Bn),
+			q(Rn),
+			q(Fn),
+			q(In),
+			K(Pn),
+			K(Ln),
+			K(Y),
+			K(X)
+		] : []
+	], Ke = bn.make(...Ge).middleware(On).middleware(kn), Je = R.succeed(On, On.of(({ headers: t, clientId: n }) => L.promise(() => e.resolveSubject(t, n)))), Ye = R.succeed(kn, kn.of(({ headers: e, clientId: t }) => L.sync(() => {
+		let n = Nt(t) ?? Un(e);
+		return {
+			clientId: t,
+			...e["idempotency-key"] ? { idempotencyKey: e["idempotency-key"] } : {},
+			...n === void 0 ? {} : { credentialExpiresAt: n }
+		};
+	}))), Ze = e.dormancyTenantId ?? "default", Qe = e.dormancy === "sleep" ? {
+		register: (t, n, r) => cn(e.store, {
+			tenantId: r ?? Ze,
+			kind: "workflow",
+			refId: t,
+			wakeAt: n
+		}),
+		cancel: (t, n) => Et(e.store, {
+			tenantId: n ?? Ze,
+			kind: "workflow",
+			refId: t
+		}).then(() => {})
+	} : void 0, M = re ? await import("@voltro/workflow") : void 0, N = M?.makeWorkflowRunRecorder({
+		store: e.store,
+		...Qe === void 0 ? {} : { wakeups: Qe }
+	}), tt = async (t, n) => {
+		await M.closeWorkflowChildrenForParent({
+			store: e.store,
+			parentExecutionId: t,
+			parentStatus: n,
+			recorder: N,
+			log: { warn: (e, t) => {
+				process.stderr.write(`[workflow] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+			} },
+			interruptChild: async (t, n) => {
+				let r = (e.discovered.workflows ?? []).find((e) => e.definition.name === t);
+				if (!r) throw Error(`Unknown child workflow: ${t}`);
+				if (!o) throw Error("Workflow runtime is not ready");
+				await o.runPromise(r.definition.interrupt(n));
+			}
+		});
+	}, nt = async (t, n, r) => {
+		let i = (await e.store.query({
+			table: "_voltro_workflow_runs",
+			order: [],
+			predicate: U("executionId", n),
+			projection: void 0,
+			skip: void 0,
+			take: 1
+		}))[0];
+		if (i === void 0) return;
+		let a = await e.store.update("_voltro_workflow_runs", i.id, {
+			status: "cancelled",
+			cancelled: !0,
+			completedAt: /* @__PURE__ */ new Date()
+		}), o = i.subject?.tenantId ?? void 0;
+		a && await N.recordEvent({
+			runId: i.id,
+			eventType: "run-cancelled",
+			payload: {
+				reason: r,
+				workflowName: t,
+				executionId: n,
+				...o == null ? {} : { tenantId: o }
+			}
+		}), a && await tt(n, "cancelled");
+	}, rt = [...tn(e.discovered.workflows ?? [], {
+		buildContext: (t, n) => e.buildContextForWorkflow?.(t, n) ?? S({
+			subject: t.subject,
+			traceId: t.traceId
+		}, e.store, void 0, `workflow:${n.workflowName}`, { parentExecutionId: n.executionId }),
+		resolveStartContext: te
+	}, (t, n, r) => {
+		let i = M.getWorkflowVersionMetadata(t.definition);
+		return M.wrapWorkflowExecuteWithRunRecording({
+			name: t.definition.name,
+			store: e.store,
+			subject: r.subject,
+			source: r.source ?? null,
+			traceId: r.traceId,
+			workflowVersion: i.version,
+			workflowCompatibleVersions: i.compatibleWith,
+			workflowPatches: i.patches,
+			parentExecutionId: r?.parentExecutionId ?? null,
+			parentClosePolicy: r?.parentClosePolicy ?? null,
+			onParentClose: ({ executionId: e, status: t }) => tt(e, t),
+			recorder: N,
+			pluginWorkflowStepLayer: Ee,
+			recordRun: sn
+		}, n);
+	}), ...e.discovered.workflowWorkers ?? []], it = rt.length > 0 ? R.mergeAll(...rt) : R.empty;
+	if (((e.discovered.workflows?.length ?? 0) > 0 || (e.discovered.workflowWorkers?.length ?? 0) > 0 || e.scheduleCoordination === "cluster") && e.workflowEngineLayer !== void 0) {
+		let t = it.pipe(R.provideMerge(e.workflowEngineLayer));
+		o = vt.make(e.baseLayer === void 0 ? t : t.pipe(R.provideMerge(e.baseLayer))), await o.runPromise(L.void);
+		let n = await import("@voltro/workflow/cluster"), r = (e) => o.runPromise(n.redriveFailedRun(e));
+		c = await ie({
+			provider: ir(e.plugins ?? [])?.broadcast?.provider,
+			crossReplica: ir(e.plugins ?? [])?.broadcast?.crossReplica ?? !1,
+			namespace: he,
+			replicaId: crypto.randomUUID(),
+			pollStorage: () => o.runPromise(n.pollWorkflowStorage),
+			log: (e.log ?? z({ scope: "voltro:serve" })).child("workflow")
+		}), s = async (t) => {
+			let n = await d({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runRedrive: r
+			}, t.runId);
+			return n.statusReset && await N.recordEvent({
+				runId: t.runId,
+				eventType: "run-redriven",
+				payload: {
+					reason: "inspect.redrive",
+					activitiesReset: n.outcome.activitiesReset
+				}
+			}), {
+				redriven: n.outcome.redriven,
+				activitiesReset: n.outcome.activitiesReset,
+				reason: n.outcome.reason
+			};
+		}, a = (e.discovered.workflows?.length ?? 0) > 0 ? $t({
+			workflows: e.discovered.workflows ?? [],
+			runEffect: (e) => o.runPromise(e),
+			onEnqueue: () => c?.publishWake(),
+			rememberStartContext: f,
+			signal: async (t, n, r) => {
+				let i = await M.sendWorkflowSignal({
+					store: e.store,
+					recorder: N,
+					target: t,
+					signalName: n,
+					payload: r
+				});
+				return await o.runPromise(M.completeSuspendingSignal({
+					store: e.store,
+					target: t,
+					signalName: n,
+					payload: r
+				})).catch(() => {}), i;
+			},
+			update: (t, n, r, i) => M.sendWorkflowUpdate({
+				store: e.store,
+				recorder: N,
+				target: t,
+				updateName: n,
+				payload: r,
+				...i === void 0 ? {} : { options: i }
+			}),
+			listRuns: (t) => et(e.store, t),
+			retry: (t, n) => ye({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runPromise: (e) => o.runPromise(e)
+			}, t, n),
+			redrive: (t) => d({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runRedrive: r
+			}, t).then((e) => e.outcome)
+		}) : void 0;
+	}
+	let at = R.mergeAll(Ke.toLayer(D), Je, Ye), ot = v(D, e.discovered.queries.map((e) => e.descriptor.name), ne), st = R.mergeAll(Ke.toLayer(ot), Je, Ye), P = e.observability, ct = await H({
+		...e.appName === void 0 ? {} : { serviceName: e.appName },
+		...P && P.spanProcessors.length > 0 ? { extraSpanProcessors: P.spanProcessors } : {},
+		...P && P.metricReaders.length > 0 ? { extraMetricReaders: P.metricReaders } : {},
+		...P && Object.keys(P.resourceAttributes).length > 0 ? { resourceAttributes: P.resourceAttributes } : {},
+		...P && P.sampler !== void 0 ? { sampler: P.sampler } : {}
+	}), lt = !1, ut = e.store.ping ? () => e.store.ping().then(() => !0).catch(() => !1) : void 0, { server: dt, shutdown: ft } = hn({
+		group: Ke,
+		handlersLayer: at,
+		httpHandlersLayer: st,
+		port: e.port ?? 4e3,
+		...e.host === void 0 ? {} : { host: e.host },
+		path: e.path ?? "/ws",
+		tracerLayer: ct.layer,
+		healthCheck: {
+			isReady: () => lt,
+			...ut ? { ping: ut } : {}
+		},
+		...We.length > 0 ? { httpRoutes: We } : {},
+		...e.getStore === void 0 ? {} : { getStore: e.getStore },
+		...le.size > 0 ? { webhookRoutes: le } : {},
+		...e.inspectRoute === void 0 ? {} : { inspectRoute: e.inspectRoute }
+	});
+	if (await wt(dt), (e.discovered.schedules?.length ?? 0) > 0) {
+		let t = (e.scheduleCoordination ?? "single") === "advisoryLock" ? Lt(e.store, e.scheduleReplicaId ?? `pid-${process.pid}`) : mn;
+		l = await gn(e.discovered.schedules ?? [], {
+			store: e.store,
+			coordinator: t,
+			defaultTrigger: e.scheduleDefaultTrigger ?? "self",
+			replicaId: e.scheduleReplicaId ?? `pid-${process.pid}`,
+			armSelf: e.scheduleArmSelf ?? !0,
+			dormancy: e.dormancy ?? "always-on",
+			...e.dormancyTenantId === void 0 ? {} : { dormancyTenantId: e.dormancyTenantId },
+			buildContext: ({ traceId: t, scheduleName: n, subject: r }) => S({
+				subject: r,
+				traceId: t
+			}, e.store, void 0, `schedule:${n}`),
+			log: {
+				info: (e, t) => {
+					process.stdout.write(`[schedule] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+				},
+				warn: (e, t) => {
+					process.stderr.write(`[schedule] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+				},
+				error: (e, t) => {
+					process.stderr.write(`[schedule] ERROR ${e} ${t ? JSON.stringify(t) : ""}\n`);
+				},
+				debug: () => {}
+			},
+			...e.scheduleFireInterceptor === void 0 ? {} : { interceptFire: e.scheduleFireInterceptor },
+			...e.onScheduleRunEvent === void 0 ? {} : { onRunEvent: e.onScheduleRunEvent }
+		}), e.onSchedulerReady?.(l);
+	}
+	let F = e.log ?? z({ scope: "voltro:serve" }), pt, mt;
+	if ((e.discovered.subscribers?.length ?? 0) > 0 && (pt = Ne(e.discovered.subscribers ?? [], e.store, F.child("subscribe"), e.schemaRegistry, x.bus)), (e.discovered.reactions?.length ?? 0) > 0) {
+		let t = F.child("reaction");
+		mt = A(e.discovered.reactions ?? [], e.store, {
+			runAct: async (n, r) => {
+				if (n.kind === "workflow") {
+					if (p === void 0) {
+						t.warn("reaction workflow act skipped — no workflow engine in this app", { workflow: n.workflow });
+						return;
+					}
+					let e = r.new ?? r.old ?? {};
+					await en(p, {
+						traceId: `reaction:${n.workflow}`,
+						source: `reaction:${n.workflow}`
+					}).start(n.workflow, e);
+					return;
+				}
+				await j(n.agent, r, {
+					findAgentSend: (t) => e.discovered.actions.find((e) => e.descriptor.name === `${t}.send`),
+					runAction: (e, t, n) => Promise.resolve(ke(e, t, n)),
+					makeSubject: (e) => An(e),
+					now: () => Date.now(),
+					log: t
+				});
+			},
+			checkBudget: async (n, r) => {
+				try {
+					let { requireAiBudget: t } = await import("@voltro/ai");
+					return (await L.runPromise(L.either(t(e.store, {
+						tenantId: n,
+						limitUsd: r
+					}))))._tag === "Right";
+				} catch (e) {
+					return t.warn("reaction budget check failed — refusing the act", { tenantId: n }, e), !1;
+				}
+			}
+		}, t);
+	}
+	let I;
+	return (e.discovered.aggregates?.length ?? 0) > 0 && (I = await qe({
+		discovered: e.discovered.aggregates ?? [],
+		store: e.store,
+		log: F.child("aggregate"),
+		...e.analytics === void 0 ? {} : { analytics: e.analytics },
+		...e.aggregateStorage === void 0 ? {} : { storage: e.aggregateStorage },
+		...e.aggregateCoordinator === void 0 ? {} : { coordinator: e.aggregateCoordinator }
+	}), Se = R.succeed(bt, I.registry)), lt = !0, e.bootTiming?.mark("ready"), {
+		dispatcher: t,
+		server: dt,
+		scheduler: l,
+		eventsSnapshot: y(x.bus, x.declared),
+		membersSnapshot: () => ({
+			members: ve.membership.list(),
+			capturedAt: Date.now()
+		}),
+		rpcMetrics: () => C,
+		webhooksService: () => se,
+		workflowWriteActions: () => p === void 0 || N === void 0 ? void 0 : m({
+			store: e.store,
+			log: F,
+			workflows: e.discovered.workflows ?? [],
+			workflowsProxy: a,
+			workflowRuntime: o,
+			workflowRunRecorder: N,
+			closeChildrenForParent: tt
+		}),
+		redriveWorkflowRun: (e) => s ? s(e) : Promise.reject(/* @__PURE__ */ Error("redrive: this app registers no workflows")),
+		close: async () => {
+			lt = !1, await be?.detach(), await ve.detach(), I?.detach(), mt?.(), pt?.(), await l?.shutdown(), t.close(), await c?.detach(), await o?.dispose(), await new Promise((e) => dt.close(() => e())), await ft();
+		}
+	};
+}, $ = z({ scope: "voltro:serve" }), Nr = (e, t, n) => (e === "production" || e === "staging") && t !== "memory" && n !== "0", Pr = mt, Fr = async (e) => {
+	let t = F(process.cwd());
+	if (yt(t)) {
+		let n;
+		try {
+			let e = await import(gt(t).href);
+			typeof e.runServe == "function" ? n = e.runServe : $.warn("serve bundle has no runServe export — using the standard serve path");
+		} catch (e) {
+			$.warn("serve bundle failed to load — using the standard serve path", {}, e);
+		}
+		if (n) return $.info("serve: booting from the precompiled serve bundle"), n(e);
+	}
+	return Ir(e);
+}, Ir = async (d) => {
+	let m = pt();
+	process.env.NODE_ENV || (process.env.NODE_ENV = "production");
+	try {
+		Hn();
+	} catch (e) {
+		throw pr(e instanceof Error ? e.message : String(e));
+	}
+	let h = process.cwd(), ie = Number(process.env.PORT ?? Pr(d, "--port") ?? 4e3), g = await De(h);
+	dn(ln(g?.secrets)), await t({
+		rawEnv: g?.env,
+		appType: "api",
+		root: h,
+		log: $,
+		generateTypes: !1
+	}), m.mark("config");
+	let _ = (process.env.DB_DIALECT ?? g?.store ?? "memory").toLowerCase(), ue = (_ === "mariadb" || _ === "postgres" || _ === "mssql") && (process.env.CDC ?? "1") !== "0", de = _ === "mariadb" ? "mariadb" : _ === "mssql" ? "mssql" : void 0, fe = ft(h);
+	if (!s() && yt(fe)) try {
+		let e = await import(gt(fe).href);
+		if (e.modules) {
+			let t = {};
+			for (let [n, r] of Object.entries(e.modules)) t[ht(h, n)] = r;
+			o(t), $.info("precompiled api bundle loaded", { modules: Object.keys(t).length });
+		}
+	} catch (e) {
+		$.warn("precompiled api bundle failed to load — falling back to source", {}, e);
+	}
+	let v = await Pe(h), y = await Je(v, { cdc: ue && de !== void 0 });
+	{
+		let e = /* @__PURE__ */ new Set([
+			...y.queries.filter((e) => e.descriptor.overridesPlugin === !0).map((e) => e.descriptor.name),
+			...y.mutations.filter((e) => e.descriptor.overridesPlugin === !0).map((e) => e.descriptor.name),
+			...y.actions.filter((e) => e.descriptor.overridesPlugin === !0).map((e) => e.descriptor.name)
+		]);
+		tt(st(g?.plugins ?? []), [
+			...y.queries.map((e) => e.descriptor.name),
+			...y.mutations.map((e) => e.descriptor.name),
+			...y.actions.map((e) => e.descriptor.name),
+			...y.streams.map((e) => e.descriptor.name)
+		], e);
+		let t = Ae(y.serverOnlyLeaks, Ye(process.env, "strict"), At, "`voltro serve`");
+		if (t.action === "fail") throw pr(t.message ?? "");
+		t.action === "warn" && $.warn(t.message ?? "");
+	}
+	let ye = v.filter((e) => me.test(e)), xe = ye.length > 0 ? await c(ye, $.child("webhooks")) : {
+		outgoing: [],
+		incoming: [],
+		providers: []
+	}, Me = je(y.events), Ne = xe.outgoing.length + xe.incoming.length + xe.providers.length + Me.length === 0 ? void 0 : {
+		...xe,
+		outgoing: [...xe.outgoing, ...Me]
+	}, Fe = it({
+		mix: y.featureMix,
+		plugins: g?.plugins ?? [],
+		cdc: ue && de !== void 0,
+		...de ? { cdcDialect: de } : {}
+	}), Le = g?.analytics !== void 0 && g.analytics.kind !== "noop" && _ !== "memory" ? (await i(_)).makeSqlLayer(k()) : void 0, O = await Ee({
+		spec: g?.analytics,
+		sqlLayer: Le,
+		log: $
+	}), A = (() => {
+		let e = new Set(y.tables.map((e) => e.tableName)), t = [...y.tables];
+		for (let n of [...Fe, ...O.tables]) e.has(n.tableName) || (e.add(n.tableName), t.push(n));
+		return t;
+	})();
+	for (let e of A) Cn(e);
+	{
+		let e = jt(_n(y.queries.map((e) => ({
+			name: e.descriptor.name,
+			source: e.descriptor.source
+		})), new Set(A.flatMap((e) => {
+			let t = e.tableName;
+			return t === void 0 ? [] : [t];
+		}))));
+		e !== void 0 && $.warn(e);
+	}
+	let He = (process.env.NODE_ENV ?? "").toLowerCase();
+	if (Nr(He, _, process.env.VOLTRO_AUTO_MIGRATE)) {
+		let e = (await i(_)).makeSqlLayer(k()), t = await L.runPromise(xn.SqlClient.pipe(L.flatMap((e) => qn(e, A, {
+			appliedBy: `serve:${He}`,
+			environment: "prod",
+			dialectId: _
+		})), L.provide(e)));
+		t.kind === "prod-mismatch" && ($.error(Kn(t, _)), $.error("serve: refusing to boot — apply the schema first (voltro db apply in a pre-deploy step), or set VOLTRO_AUTO_MIGRATE=0 to bypass this check."), process.exit(1)), $.info(Kn(t, _));
+	}
+	let Ue = Qt(A);
+	m.mark("discover");
+	let j = await Ie(g, void 0), qe = yn(j, _);
+	for (let e of he({
+		dialect: String(g?.store ?? process.env.DB_DIALECT ?? "postgres"),
+		changeStrategy: (process.env.CDC ?? "1") === "0" ? "inline" : "cdc",
+		dbUrl: process.env.DB_URL,
+		tables: y.tables.map((e) => ({
+			tableName: e.tableName,
+			isReactive: e.isReactive === !0
+		})),
+		querySources: y.queries.flatMap((e) => {
+			let t = e.descriptor.source;
+			return t === void 0 ? [] : typeof t == "string" ? [t] : [...t];
+		})
+	})) e.level === "warn" ? $.warn(e.message) : $.info(e.message);
+	{
+		let e = le(oe({
+			tables: y.tables.map((e) => ({ tableName: e.tableName })),
+			queries: y.queries.map((e) => ({
+				name: e.descriptor.name,
+				source: e.descriptor.source
+			}))
+		}));
+		e !== void 0 && $.warn(e);
+	}
+	g?.cache && !process.env.CACHE_BACKEND && (process.env.CACHE_BACKEND = g.cache), g?.cacheRedisUrl && !process.env.CACHE_REDIS_URL && (process.env.CACHE_REDIS_URL = g.cacheRedisUrl), g?.cacheRedisDriver && !process.env.CACHE_REDIS_DRIVER && (process.env.CACHE_REDIS_DRIVER = g.cacheRedisDriver), g?.cacheKeyPrefix && !process.env.CACHE_KEY_PREFIX && (process.env.CACHE_KEY_PREFIX = g.cacheKeyPrefix);
+	let { service: $e, invalidationBus: et, snapshotCache: F, cache: mt, backend: z, stats: bt, dispose: xt } = await ne({ env: process.env });
+	$.info(`cache backend resolved: ${z}` + (z === "redis" ? ` (driver ${process.env.CACHE_REDIS_DRIVER ?? "resp"})` : " — in-process, not cross-instance")), j.onChange((e) => {
+		L.runFork(et.publish(e.table));
+	}), g?.kv && !process.env.KV_BACKEND && (process.env.KV_BACKEND = g.kv), g?.kvRedisUrl && !process.env.KV_REDIS_URL && (process.env.KV_REDIS_URL = g.kvRedisUrl), g?.kvKeyPrefix && !process.env.KV_KEY_PREFIX && (process.env.KV_KEY_PREFIX = g.kvKeyPrefix);
+	let { kv: wt, service: B } = await Vt({ store: j });
+	$.info(mr(ke(), hr())), m.mark("store");
+	let Tt = Ct({
+		store: j,
+		sink: O.sink,
+		log: $
+	}), V = b({
+		store: j,
+		dialect: _
+	}), H = g?.plugins ?? [], Et = process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, Nt, Pt;
+	_ !== "memory" && (Nt = vt.make((await i(_)).makeSqlLayer(k())), Pt = await Nt.runPromise(xn.SqlClient));
+	let Ft = Ht({
+		coordinator: [
+			"postgres",
+			"mariadb",
+			"mysql",
+			"mssql"
+		].includes(_) ? Lt(j, Et, $) : mn,
+		replicaId: Et,
+		log: $
+	}), It = [], Ut = process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, Wt = ir(g?.plugins ?? [])?.broadcast?.provider, Gt = Xe(g?.plugins, g?.name ?? I(h));
+	{
+		let e = we(g?.plugins, g?.name ?? I(h));
+		e !== void 0 && $.warn(e);
+	}
+	let Kt = Te(g?.plugins, {
+		instanceId: Ut,
+		namespace: Gt,
+		meta: { mode: "serve" },
+		logger: $
+	}), qt = {
+		...Pt ? { sql: Pt } : {},
+		instanceId: Ut,
+		membership: Kt.membership,
+		...Wt === void 0 ? {} : { broadcast: Wt },
+		broadcastChannels: { presence: rr(Gt, "presence") },
+		scheduleCoordinated: (e, t, n) => {
+			let r = Ft(e, t, n);
+			return It.push(r), r;
+		}
+	};
+	for (let e of H) e.bindDataStore?.(j, qt);
+	D({
+		store: j,
+		...l(),
+		log: $
+	});
+	let Jt = H.filter((e) => typeof e.onChangeEvent == "function");
+	if (Jt.length > 0) {
+		let e = j.changeScope ?? "local";
+		j.onChange((t) => {
+			let n = Be(t, e);
+			for (let e of Jt) L.runFork(e.onChangeEvent(n).pipe(L.catchAllCause((t) => L.sync(() => $.warn(`plugin ${e.name} onChangeEvent failed`, { error: _t.pretty(t) })))));
+		});
+	}
+	let Yt = re({
+		plugins: H,
+		appName: g?.name ?? "voltro-api",
+		appType: "api",
+		voltroVersion: process.env.npm_package_version ?? "0.0.0",
+		log: $
+	});
+	H.length && await Yt.activate(), m.mark("plugins");
+	let Xt = await Yt.gatherObservability(), Zt = {
+		info: (e, t) => process.stdout.write(`[broadcast] ${e} ${t ? JSON.stringify(t) : ""}\n`),
+		warn: (e, t) => process.stderr.write(`[broadcast] ${e} ${t ? JSON.stringify(t) : ""}\n`),
+		debug: () => {}
+	}, $t, en = await T(j, g, _, Gt, Zt, (e, t) => {
+		$t?.refreshAll(`broadcast gap: missed ${t} change(s) from ${e}`);
+	}), tn = g?.apiKeys, nn = (typeof tn == "object" ? tn.prefix : void 0) ?? "voltro_", on = tn ? Ot(j) : void 0, sn = on ? zt({ flush: Bt(on) }) : void 0;
+	sn && rn(() => sn.shutdown());
+	let cn = on ? Rt(on, {
+		prefix: nn,
+		...sn ? { usage: sn } : {}
+	}) : void 0, un = cn ? [Mt(cn, { prefix: nn })] : [], fn = We([...g?.auth?.strategies ?? [], ...un], Jn(g?.plugins ?? []), g?.auth?.anonymousTenantRequired ?? !1, g?.auth?.resolveScopes, () => qe), pn = [...g?.restRoutes ?? [], ...cn ? St(cn, (typeof tn == "object" ? tn.managementPath : void 0) ?? "/v1/api-keys") : []], hn = g?.idempotency, gn = hn ? {
+		store: kt(j),
+		header: (typeof hn == "object" ? hn.header : void 0) ?? "Idempotency-Key",
+		ttlMs: (typeof hn == "object" ? hn.ttlMs : void 0) ?? 864e5
+	} : void 0, vn = pn.length > 0 ? Xn(pn, {
+		store: j,
+		resolveSubject: async (e) => (await fn({
+			headers: e,
+			clientId: -1
+		})).subject,
+		...gn ? { idempotency: gn } : {}
+	}) : [], bn = H.map((e) => e.services).filter((e) => e !== void 0), Sn = R.mergeAll(u({
+		analyticsLayer: O.layer,
+		cacheService: $e,
+		kvService: B,
+		pluginServices: bn,
+		userLayers: g?.layers ?? []
+	}), ze(g?.http ?? {})), U = g?.scheduling ?? {}, wn = U.trigger ?? "self", W = /* @__PURE__ */ new Set([
+		"postgres",
+		"mysql",
+		"mariadb",
+		"mssql"
+	]), Tn = U.coordination ?? (W.has(_) ? "advisoryLock" : "single"), G = Tn === "cluster" && W.has(_), En = G ? "cluster" : Tn === "advisoryLock" && W.has(_) ? "advisoryLock" : "single";
+	Tn === "cluster" && !G && $.warn("scheduling.coordination=cluster needs a sql-backed store except sqlite — falling back to single"), Tn === "advisoryLock" && !W.has(_) && $.warn("scheduling.coordination=advisoryLock needs a SQL store (the claim-row gate) — falling back to single");
+	let Dn, On = y.workflows.length > 0 || y.workflowWorkers.length > 0 || y.eventTriggers.length > 0 || (Ne?.outgoing.length ?? 0) > 0 || G, kn;
+	if (On) {
+		if (_ === "mssql") {
+			let e = await N(process.cwd());
+			e && $.warn(e);
+		}
+		let [{ WorkflowEngine: e }, { makeClusterCronLayer: t, workflowEngineLayer: n, resolveRunnerStorage: r, resolveFailoverTuning: a }] = await Promise.all([import("@effect/workflow"), import("@voltro/workflow/cluster")]), o = G ? y.schedules.filter((e) => (e.trigger ?? wn) === "self").map((e) => t({
+			name: e.name,
+			cron: Dt(e),
+			execute: async () => {
+				await Dn?.fireFromCluster(e.name);
+			}
+		})) : [];
+		kn = _ === "memory" ? e.layerMemory : await (async () => {
+			let e = await i(_), t = r({ sqliteFamily: e.id === "sqlite" || e.id === "turso" });
+			return $.info(`workflow engine: cluster-${t}, dialect=${e.id}` + (t === "memory" ? " — single-process durable replay, no cross-pod shard handoff" + (e.id !== "sqlite" && e.id !== "turso" ? " (VOLTRO_WORKFLOW_RUNNER_STORAGE=memory: SqlRunnerStorage/cluster_runners + GET_LOCK skipped)" : "") : "")), n({
+				sqlClientLayer: e.makeSqlLayer(k()),
+				runnerStorage: t,
+				dialectId: e.id,
+				...process.env.VOLTRO_WORKFLOW_RUNNER_PORT ? { runnerListenPort: Number(process.env.VOLTRO_WORKFLOW_RUNNER_PORT) } : {},
+				...a(),
+				...o.length > 0 ? { extraShardingLayers: o } : {}
+			});
+		})();
+	}
+	let K = x(H, n()), An = v.filter((e) => /\.subscribe\.tsx?$/.test(e)), jn = An.length > 0 ? await C(An, $) : [], Mn = v.filter((e) => /\.reaction\.tsx?$/.test(e)), q = Mn.length > 0 ? await Oe(Mn, $) : [], Nn = v.filter((e) => P.test(e)), Pn = Nn.length > 0 ? await Ve(Nn, $) : [], Fn = v.filter((e) => /\.aggregate\.tsx?$/.test(e)), In = Fn.length > 0 ? await Ge(Fn, $) : [], Ln = E();
+	if (In.length > 0 && _ !== "memory") try {
+		Ln = w((await i(_)).makeSqlLayer(k()));
+	} catch (e) {
+		$.warn("aggregate: SQL storage init failed — falling back to in-process", { err: String(e) });
+	}
+	let Rn = _ === "memory" ? mn : Lt(j, `aggregate@${process.pid}`, $), zn = [], Bn = [], J = v.filter((e) => ot.test(e));
+	if (J.length > 0) {
+		let e = $.child("agent"), t = v.filter((e) => nt.test(e));
+		t.length > 0 && await rt(t, e);
+		let n = await at(J, e);
+		for (let e of n.agents) for (let t of se(e)) (t.kind === "action" ? zn : Bn).push({
+			file: t.file,
+			descriptor: t.descriptor,
+			executor: t.executor
+		});
+		n.agents.length > 0 && e.info("synthesized agent routes", { agents: n.agents.map((e) => e.descriptor.name) });
+	}
+	m.mark("workflow");
+	let Y = () => {
+		let e = Z.workflowWriteActions();
+		if (e === void 0) throw Error("workflow actions: this app registers no workflows");
+		return e;
+	}, X = await Se({
+		files: v,
+		store: j,
+		log: $,
+		seedPolicy: "report",
+		seedPattern: a,
+		loadSeedFiles: r,
+		startupPattern: ct,
+		loadStartupFiles: dt,
+		runStartups: ut,
+		emailPattern: S,
+		loadEmailFiles: Ce,
+		registerEmailTemplates: nr
+	});
+	(X.startupCount > 0 || X.emailCount > 0) && $.info("boot lifecycle", {
+		startups: X.startupCount,
+		emailTemplates: X.emailCount
+	}), X.startups !== void 0 && rn(async () => {
+		await X.startups.stop();
+	});
+	let Un = {
+		kind: "api",
+		meta: {
+			name: g?.name ?? "voltro-api",
+			voltroVersion: Ke,
+			port: ie,
+			mode: "start",
+			store: _,
+			cdc: ue ? "on" : "off"
+		},
+		rpc: ee(y, h),
+		workflows: be(y, h),
+		events: () => Z.eventsSnapshot(),
+		members: () => Z.membersSnapshot(),
+		inspectFireSchedule: async ({ name: e, trigger: t }) => {
+			if (!Dn) throw Error("scheduler not started — this app registers no self-triggered schedules (all schedules are trigger:'external', or there are none).");
+			return { runId: await Dn.fireNow(e, t) ?? null };
+		},
+		...Ne === void 0 ? {} : { webhooks: () => Re({
+			store: j,
+			discoveredWebhooks: Ne
+		}) },
+		plugins: () => ({
+			plugins: Yt.snapshot(),
+			capturedAt: Date.now()
+		}),
+		env: () => e(g?.name ?? I(h), {
+			...g?.env !== void 0 && Vn(g.env) ? { contract: g.env } : {},
+			plugins: g?.plugins ?? []
+		}),
+		dataCache: () => ge({
+			stats: bt,
+			backendKind: z
+		}),
+		subscriptions: () => f(() => $t),
+		inspectTables: () => ae(y.tables),
+		inspectRows: ce({
+			store: j,
+			tables: y.tables,
+			mask: !0
+		}),
+		metrics: (e) => Z.rpcMetrics().snapshot(e),
+		cluster: () => Qe({
+			store: j,
+			dialect: _,
+			useClusterCron: G,
+			scheduleCoordChoice: Tn
+		}),
+		inspectSchedules: () => te({
+			schedules: y.schedules,
+			defaultTrigger: wn,
+			coordination: En
+		}),
+		inspectScheduleRuns: (e) => p(j, e),
+		...ve(j),
+		webhookActions: Ze(() => Z.webhooksService()),
+		inspectStartWorkflow: (e) => Y().inspectStartWorkflow(e),
+		inspectCancelWorkflowRun: (e) => Y().inspectCancelWorkflowRun(e),
+		inspectSuspendWorkflowRun: (e) => Y().inspectSuspendWorkflowRun(e),
+		inspectResumeWorkflowRun: (e) => Y().inspectResumeWorkflowRun(e),
+		inspectDiscardWorkflowRun: (e) => Y().inspectDiscardWorkflowRun(e),
+		inspectRetryWorkflowRun: (e) => Y().inspectRetryWorkflowRun(e),
+		inspectSignalWorkflowRun: (e) => Y().inspectSignalWorkflowRun(e),
+		inspectUpdateWorkflowRun: (e) => Y().inspectUpdateWorkflowRun(e),
+		inspectRedriveWorkflowRun: (e) => Z.redriveWorkflowRun(e)
+	}, Z = await Mr({
+		bootTiming: m,
+		broadcastNamespace: Gt,
+		membership: {
+			...Kt,
+			instanceId: Ut
+		},
+		...g?.plugins === void 0 ? {} : { plugins: g.plugins },
+		...gn ? { idempotency: {
+			store: gn.store,
+			ttlMs: gn.ttlMs
+		} } : {},
+		discovered: {
+			queries: [...y.queries, ...Bn],
+			mutations: y.mutations,
+			actions: [...y.actions, ...zn],
+			streams: y.streams,
+			events: y.events,
+			workflows: y.workflows,
+			workflowWorkers: y.workflowWorkers,
+			eventTriggers: y.eventTriggers,
+			schedules: y.schedules,
+			subscribers: jn,
+			outboxHandlers: Pn,
+			connections: y.connections,
+			reactions: q,
+			aggregates: In,
+			...Ne === void 0 ? {} : { webhooks: Ne }
+		},
+		log: $,
+		analytics: O.sink,
+		aggregateStorage: Ln,
+		aggregateCoordinator: Rn,
+		store: j,
+		kv: wt,
+		cache: mt,
+		snapshotCache: F,
+		schemaRegistry: Ue,
+		tenantScopedTables: y.tenantScopedTables,
+		softDeleteScopedTables: y.softDeleteScopedTables,
+		dataTransferSnapshot: Gn(A),
+		dataTransferDialect: _,
+		tenantIsolation: (process.env.VOLTRO_TENANT_ISOLATION ?? g?.tenancy?.isolation) === "namespace" ? "namespace" : "shared-schema",
+		resolveSubject: async (e, t) => {
+			let n = await fn({
+				headers: e,
+				clientId: t
+			});
+			return an(t, n.credentialExpiresAt), n.subject;
+		},
+		httpRoutes: [...H.flatMap((e) => e.httpRoutes ?? []), ...vn],
+		getStore: () => qe,
+		...Sn ? { baseLayer: Sn } : {},
+		...kn === void 0 ? {} : { workflowEngineLayer: kn },
+		scheduleDefaultTrigger: wn,
+		scheduleCoordination: En,
+		scheduleArmSelf: !G,
+		dormancy: process.env.VOLTRO_DORMANCY === "sleep" || process.env.VOLTRO_DORMANCY === "always-on" ? process.env.VOLTRO_DORMANCY : g?.dormancy ?? "always-on",
+		scheduleReplicaId: process.env.HOSTNAME ?? `pid-${process.pid}`,
+		...K === void 0 ? {} : { scheduleFireInterceptor: K },
+		onSchedulerReady: (e) => {
+			Dn = e;
+		},
+		inspectRoute: { handle: async (e, t, n, r) => await pe(e, Un, t, {
+			method: n,
+			...r === void 0 ? {} : { body: r }
+		}) || (lt(e, Un, t, {
+			method: n,
+			...r === void 0 ? {} : { body: r }
+		}) ?? {
+			status: 404,
+			contentType: "application/json",
+			body: JSON.stringify({ error: "not an inspect route" })
+		}) },
+		...g?.name === void 0 ? {} : { appName: g.name },
+		observability: Xt,
+		port: ie,
+		...g?.transport?.wsPath ? { path: g.transport.wsPath } : {}
+	});
+	return $t = Z.dispatcher, _e(M([
+		y.queries,
+		y.mutations,
+		y.actions,
+		y.streams
+	]), (e) => {
+		$.warn(e);
+	}), $.info(`API listening on :${ie}`, {
+		dialect: _,
+		queries: y.queries.length,
+		mutations: y.mutations.length,
+		actions: y.actions.length,
+		streams: y.streams.length,
+		workflows: y.workflows.length,
+		workflowWorkers: y.workflowWorkers.length,
+		schedules: y.schedules.length,
+		scheduleCoordination: En
+	}), m.finish($), rn(async () => {
+		for (let e of It) e.stop();
+		Tt.detach(), V.stop(), xt(), Nt?.dispose();
+		try {
+			await Yt.deactivate(), await en?.close(), await O.dispose(), await Z.close(), await j.close?.();
+		} catch (e) {
+			console.error("serve: shutdown step failed, exiting anyway:", e);
+		}
+	}), await new Promise(() => {}), 0;
+};
+//#endregion
+export { Fr as n, kr as r, Ir as t };