@voltro/cli 0.34.0 → 0.35.0

package/dist/serveCommand-iwlUBNS1.js

@@ -0,0 +1,1766 @@
+import { t as e } from "./nodeEnvironment-cGFAj1J8.js";
+import { t } from "./frameworkInspectState-CX2250XB.js";
+import { r as n, t as r } from "./appModuleLoader-C9r9mxZt.js";
+import { n as i, t as a } from "./startupRunner-DPGFchOa.js";
+import { $ as o, $t as s, A as c, At as l, B as u, C as d, Ct as ee, D as f, Dt as p, E as te, Et as ne, F as re, Ft as m, G as ie, Gt as ae, H as oe, Ht as se, I as h, It as ce, J as le, Jt as g, K as ue, Kt as de, L as fe, Lt as pe, M as me, Mt as he, N as ge, Nt as _e, O as _, Ot as ve, P as ye, Pt as be, Q as xe, Qt as Se, R as Ce, S as we, St as Te, T as v, Tt as Ee, U as De, Ut as Oe, V as ke, Vt as Ae, W as je, Wt as y, X as Me, Xt as Ne, Y as Pe, Yt as Fe, Z as b, Zt as Ie, _ as Le, _n as x, _t as Re, an as ze, at as Be, b as Ve, bt as He, c as Ue, cn as We, ct as Ge, dn as S, dt as Ke, en as qe, et as C, f as Je, fn as Ye, ft as Xe, g as Ze, gn as Qe, gt as $e, h as et, hn as tt, ht as nt, i as w, in as rt, it, j as at, jt as ot, k as st, kt as ct, ln as lt, lt as ut, m as dt, mn as ft, mt as pt, nn as mt, nt as ht, o as T, on as gt, ot as E, p as _t, pt as vt, q as yt, qt as D, r as O, rn as bt, rt as xt, sn as St, st as Ct, t as wt, tn as k, tt as Tt, u as Et, un as Dt, ut as Ot, v as kt, vn as At, vt as jt, w as Mt, wt as Nt, x as Pt, xt as Ft, y as A, yt as It, zt as j } from "./dev-C7sFZq3m.js";
+import { n as Lt } from "./cliArgs-D4p8n7EE.js";
+import { r as Rt } from "./appPort-B_HpJ_ck.js";
+import { at as zt, nt as Bt, st as Vt } from "./webDev-Dybxew86.js";
+import { r as M } from "./dialectDriver-CgXnDfec.js";
+import { i as Ht, n as Ut } from "./connectionConfig-UFlIEiys.js";
+import { c as N, n as Wt, o as Gt } from "./seedRunner-ZmLSqNe2.js";
+import { C as Kt, S as qt, _ as Jt, d as Yt, g as P, l as Xt, m as Zt, r as Qt, u as $t, v as en } from "./frameworkTableAssembly-oMPBKqlE.js";
+import { S as tn, c as nn, n as rn, p as an, s as on, x as sn } from "./fileConventions-Cof68_BL.js";
+import { h as cn, o as ln } from "./inspect-CjTYzAs_.js";
+import { n as un } from "./mssqlClusterPatch-_4cE_nun.js";
+import { i as dn, n as fn, r as pn, t as mn } from "./webhookDiscovery-D7VaeMlz.js";
+import { t as hn } from "./inspectMetrics-CfdKLh6t.js";
+import { r as gn, u as _n } from "./apiBuild-DYD_ONLD.js";
+import { t as vn } from "./bootTiming-BdyP9nYw.js";
+import { t as yn } from "./dataProfile-dW-PsfLB.js";
+import { basename as bn, join as xn } from "node:path";
+import { existsSync as Sn } from "node:fs";
+import { pathToFileURL as Cn } from "node:url";
+import { createLogger as F } from "@voltro/logger";
+import { AuthMiddleware as wn, ConnectionInfoMiddleware as Tn, actionToRpc as I, anonymousSubject as En, isWireReachable as Dn, mutationToRpc as L, queryToRpc as R, streamToRpc as On, workflowCancelDescriptor as kn, workflowDomainEventsQueryDescriptor as An, workflowEventDeliveriesQueryDescriptor as z, workflowResumeDescriptor as jn, workflowRunEventsQueryDescriptor as B, workflowRunQueryDescriptor as V, workflowRunStepsQueryDescriptor as H, workflowRunsQueryDescriptor as Mn, workflowSignalDescriptor as Nn, workflowUpdateDescriptor as Pn } from "@voltro/protocol";
+import { Cause as Fn, Effect as U, Layer as W, ManagedRuntime as In } from "effect";
+import { SqlClient as Ln } from "@effect/sql";
+import { declaredSnapshot as Rn, describeOutcome as zn, pendingFileMigrationIds as Bn, runPlannedMigrations as Vn } from "@voltro/database/sql";
+import { RpcGroup as Hn } from "@effect/rpc";
+import { allRegisteredTables as Un, and as Wn, connectionIdentity as Gn, ensureTableRegistered as Kn, eq as G, or as K } from "@voltro/database";
+import { AggregateRegistry as qn, CostRegistry as Jn, DORMANCY_WAKEUP_TENANT as Yn, Dispatcher as Xn, ExpectationRegistry as Zn, ExperimentRegistry as q, apiKeyManagementRoutes as Qn, attachAnalyticsMirror as $n, attachExpectations as er, attachExperiments as tr, attachFinops as nr, awaitServerListening as rr, bindMutation as J, bindStream as ir, bindSubscription as Y, buildTracingLayer as ar, cancelWakeup as or, compileCron as sr, dataStoreApiKeyStore as cr, formatServerOnlyLeaks as lr, formatUnresolvedSources as ur, frameworkApiKeyStrategy as dr, installPolicyGuardResolver as fr, loadResourceTuples as pr, makeActionRunner as mr, makeAdvisoryLockCoordinator as hr, makeApiKeyService as gr, makeApiKeyUsageBuffer as _r, makeApiKeyUsageFlusher as vr, makeAsyncKv as yr, makeAuthMiddlewareLayers as br, makeCoordinatedScheduler as xr, makeEffectStoreLayer as Sr, makeLazyWorkflowFacade as Cr, makeMutationOutputCodec as wr, makeMutationRunner as Tr, makeOneShotQueryRunner as Er, makeQueryDescriptorProducer as Dr, makeQueryFinalizer as Or, makeQueryReauthorizer as kr, makeQuerySubscriber as Ar, makeSchemaRegistry as jr, makeWorkflowFacade as Mr, makeWorkflowFacadeWithCallerContext as Nr, makeWorkflowLayers as X, noopKv as Pr, onProcessShutdown as Fr, recordSubscriptionDelivery as Ir, recordWorkflowRun as Lr, registerWakeup as Rr, resolveSecretsBackend as zr, runProvidedEffect as Br, setSecretsBackend as Vr, setSystemStoreHandle as Hr, setTupleSource as Ur, shutdownGraceMsFromEnv as Z, singleCoordinator as Wr, startRpcServer as Gr, startScheduler as Kr, stripForbiddenForWire as qr, undoCaptureEnabled as Jr, unresolvedSources as Yr, workflowToRpc as Xr, wrapStoreWithBootCodec as Zr } from "@voltro/runtime";
+import { appStorageProvider as Qr, fromNodeReadable as $r, getObjectStream as ei, putObjectStream as ti, toNodeReadable as ni } from "@voltro/plugin-storage";
+import { isEnvContract as ri } from "@voltro/env";
+import { assertProductionSessionSecret as ii } from "@voltro/protocol/session";
+import { createHash as ai, timingSafeEqual as oi } from "node:crypto";
+import { buildDeliverWebhookExecute as si, buildWebhooksService as ci, defaultIncomingPath as li, deliverWebhookWorkflow as ui, makeDeferredEmitHandler as di, mountIncomingWebhook as fi } from "@voltro/plugin-webhooks";
+import { getAuthSessionStrategy as pi } from "@voltro/plugin-auth";
+import { registerEmailTemplates as mi } from "@voltro/plugin-mail";
+import { channelFor as hi, getBroadcastPlugin as gi } from "@voltro/plugin-broadcast";
+import { packBundle as _i, runExport as vi, runImport as yi, storageBlobSink as bi, storageRefsBlobSource as xi, unpackBundle as Si, unpackBundleToDir as Ci } from "@voltro/data-transfer";
+//#region src/dbPoolReport.ts
+var wi = (e, t, n = [], r = 0) => {
+	let i = n.length, a = 1 + Math.max(0, r), o = e === void 0 ? void 0 : e * a + i, s = o !== void 0 && t !== void 0 ? o * t : void 0, c = i === 0 ? " No connections outside the pool in this process." : ` PLUS ${i} outside the pool (${n.map((e) => e.reason).join("; ")}) — those do not come out of the pool budget, they come out of the DATABASE's.`, l = r > 0 ? ` This process opens ${a} pools of that size — 1 primary + ${r} read replica(s) (DB_REPLICA_URLS), each with its own DB_MAX_CONNECTIONS.` : "";
+	if (e === void 0) return "db pool: max per replica UNSET (DB_MAX_CONNECTIONS) — each replica opens the driver's default pool, so the fleet total is that default × replicas. Set DB_MAX_CONNECTIONS so the total stays under your database's connection limit; the pool scales with replicaCount and the database does not." + l + c + Ti;
+	let u = (r > 0 ? `max × ${a}` : "max") + (i === 0 ? "" : ` + ${i}`), d = r === 0 ? i === 0 ? "" : ` + ${i} = ${o}` : ` → ${u} = ${o} per pod`, ee = r === 0 && i === 0 ? "max" : `(${u})`;
+	return `db pool: max=${e} per replica (DB_MAX_CONNECTIONS)` + d + (s === void 0 ? ` — the fleet opens up to ${ee} × replicas connections. Check that against your database's limit before raising replicaCount.` : ` × ${t} replicas = up to ${s} connections. Check that against your database's limit.`) + l + c + Ti;
+}, Ti = " A rolling update runs BOTH generations at once, so budget for (replicas + surge), not replicas — a surge pod that cannot get a connection crashloops, and a rollout that never completes cannot free the connections it is waiting for.", Ei = (e = process.env) => {
+	let t = e.REPLICA_COUNT;
+	if (t === void 0 || t === "") return;
+	let n = Number(t);
+	return Number.isInteger(n) && n > 0 ? n : void 0;
+}, Di = () => Math.max(500, Math.floor(Z() * .6)), Oi = (e) => new Promise((t) => setTimeout(t, e)), ki = (e) => {
+	let t = /* @__PURE__ */ new Set(), n = /* @__PURE__ */ new Set(), r = 0;
+	e.on("connection", (e) => {
+		t.add(e), e.once("close", () => {
+			t.delete(e), n.delete(e);
+		});
+	}), e.on("upgrade", (e, t) => {
+		n.add(t);
+	}), e.on("request", (e, t) => {
+		r += 1, t.once("close", () => {
+			--r;
+		});
+	});
+	let i, a = async (t = {}) => {
+		let n = t.budgetMs ?? Di();
+		i ??= new Promise((t) => {
+			e.close(() => {
+				t();
+			});
+		}), e.closeIdleConnections();
+		let a = Date.now() + n;
+		for (; r > 0 && Date.now() < a;) await Oi(25), e.closeIdleConnections();
+		e.closeIdleConnections();
+	}, o = async () => {
+		i ??= new Promise((t) => {
+			e.close(() => {
+				t();
+			});
+		});
+		for (let e of t) if (n.has(e)) try {
+			e.write(Buffer.from([
+				136,
+				2,
+				3,
+				233
+			]));
+		} catch {}
+		else e.destroy();
+		for (let e = 0; t.size > 0 && e < 250; e += 25) await Oi(25);
+		for (let e of t) e.destroy();
+		await i;
+	};
+	return {
+		activeRequests: () => r,
+		drainRequests: a,
+		finish: o,
+		drain: async (e = {}) => {
+			await a(e), await o();
+		}
+	};
+}, Ai = "/_voltro/admin/import", ji = "/_voltro/admin/export", Q = (e, t) => ({
+	status: e,
+	contentType: "application/json; charset=utf-8",
+	body: JSON.stringify(t)
+}), Mi = (e) => {
+	let t = e.authorization ?? e.Authorization, n = t ? /^Bearer\s+(.+)$/i.exec(t) : null;
+	return n ? n[1] : null;
+}, Ni = (e, t) => oi(ai("sha256").update(e).digest(), ai("sha256").update(t).digest()), Pi = (e, t) => {
+	if (e.method.toUpperCase() !== "POST") return Q(405, { error: "method not allowed" });
+	if (!t || t.length < 16) return Q(503, { error: "data transfer misconfigured (no/weak secret)" });
+	let n = Mi(e.headers);
+	return !n || !Ni(n, t) ? Q(401, { error: "unauthorized" }) : null;
+}, Fi = F({ scope: "voltro:admin-import" }), Ii = "VBUNDLE2", Li = async function* (e) {
+	yield e;
+}, Ri = (e) => async (t) => {
+	let n = Pi(t, e.secret);
+	if (n) return n;
+	let r = t.headers["x-import-mode"], i = t.headers["x-import-on-conflict"], a = t.headers["x-import-atomic"] === "1" || t.headers["x-import-atomic"] === "true", o = t.headers["x-import-force"] === "1" || t.headers["x-import-force"] === "true", s = t.rawBody.byteLength >= 8 && Buffer.from(t.rawBody.subarray(0, 8)).toString("latin1") === Ii, c, l;
+	if (s) c = Li(t.rawBody), l = "upload";
+	else {
+		let n;
+		try {
+			n = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
+		} catch {
+			return Q(400, { error: "body must be a packed bundle archive or { bundleKey } JSON" });
+		}
+		if (typeof n.bundleKey != "string" || !n.bundleKey) return Q(400, { error: "body.bundleKey (string) is required for the storage transport" });
+		if (!e.openArchive) return Q(501, { error: "storage transport not configured on this instance" });
+		c = e.openArchive(n.bundleKey), l = "storage";
+	}
+	let u = await import("node:os"), d = await import("node:fs/promises"), ee = await import("node:path"), f = await d.mkdtemp(ee.join(u.tmpdir(), "voltro-admin-import-"));
+	try {
+		e.assetSink ? await Si(c, {
+			dir: f,
+			blobs: e.assetSink
+		}) : await Ci(c, f);
+		let t = await U.runPromiseExit(yi({
+			store: e.store,
+			bundleDir: f,
+			...r ? { mode: r } : {},
+			...i ? { onConflict: i } : {},
+			...a ? { atomic: a } : {},
+			...e.snapshot ? { targetSnapshot: e.snapshot } : {},
+			force: o,
+			onWarn: (e) => Fi.warn("admin.import", { message: e }),
+			...e.assetSink ? { assetsAlreadyRestored: !0 } : {}
+		}));
+		if (t._tag === "Failure") {
+			let e = t.cause._tag === "Fail" ? t.cause.error : void 0;
+			if (e && e._tag === "SchemaDriftError") {
+				let t = e;
+				return Fi.warn("admin.import refused (schema drift)", {
+					transport: l,
+					bundle: t.bundleFingerprint.slice(0, 16),
+					target: t.targetFingerprint.slice(0, 16)
+				}), Q(409, {
+					error: "schema drift",
+					bundleFingerprint: t.bundleFingerprint,
+					targetFingerprint: t.targetFingerprint,
+					diff: t.diff,
+					hint: "re-export against the current schema, or resend with x-import-force: 1"
+				});
+			}
+			throw Error(String(e?.message ?? e ?? "import failed"));
+		}
+		let n = t.value, s = n.tables.reduce((e, t) => e + t.rowCount, 0);
+		return Fi.info("admin.import", {
+			transport: l,
+			tables: n.tables.length,
+			rows: s,
+			mode: r ?? "upsert",
+			atomic: a
+		}), Q(200, {
+			tables: n.tables.length,
+			rows: s,
+			transport: l
+		});
+	} catch (e) {
+		return Fi.warn("admin.import failed", {
+			transport: l,
+			error: e?.message ?? String(e)
+		}), Q(500, {
+			error: "import failed",
+			message: e?.message ?? String(e)
+		});
+	} finally {
+		await d.rm(f, {
+			recursive: !0,
+			force: !0
+		});
+	}
+}, zi = F({ scope: "voltro:admin-export" }), Bi = async (e) => {
+	let t = [];
+	for await (let n of e) t.push(Buffer.from(n));
+	return new Uint8Array(Buffer.concat(t));
+}, Vi = (e) => typeof e.tenant == "string" && e.tenant ? {
+	kind: "tenant",
+	tenantId: e.tenant
+} : Array.isArray(e.tables) && e.tables.length ? {
+	kind: "tables",
+	tables: e.tables.filter((e) => typeof e == "string")
+} : { kind: "all" }, Hi = (e) => async (t) => {
+	let n = Pi(t, e.secret);
+	if (n) return n;
+	let r;
+	try {
+		r = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
+	} catch {
+		return Q(400, { error: "body must be JSON: { profile?, tenant?, tables?, consistency?, compression?, bundleKey? }" });
+	}
+	let i = {};
+	if (typeof r.profile == "string" && r.profile) {
+		if (!e.loadProfile) return Q(501, { error: "server-side profiles not configured on this instance" });
+		try {
+			i = await e.loadProfile(r.profile);
+		} catch (e) {
+			return Q(400, {
+				error: `profile '${r.profile}' could not be loaded`,
+				message: e?.message ?? String(e)
+			});
+		}
+	}
+	let a = r.consistency === "snapshot" ? "snapshot" : i.consistency ?? "live", o = (typeof r.compression == "string" ? r.compression : void 0) ?? i.compression, s = i.scope ?? Vi(r), c = typeof r.bundleKey == "string" && r.bundleKey.length > 0, l = r.assets === !0 && e.assetSource ? { blobs: e.assetSource } : {}, u = await import("node:os"), d = await import("node:fs/promises"), ee = await import("node:path"), f = await d.mkdtemp(ee.join(u.tmpdir(), "voltro-admin-export-"));
+	try {
+		let t = await U.runPromise(vi({
+			store: e.store,
+			snapshot: e.snapshot,
+			dialect: e.dialect,
+			outDir: f,
+			...i.subset ? { subset: i.subset } : {
+				scope: s,
+				...e.tenantTables && e.tenantTables.length > 0 ? { tenantTables: e.tenantTables } : {}
+			},
+			consistency: a,
+			...o ? { compression: o } : {},
+			...i.masking ? { masking: i.masking } : {}
+		})), n = t.tables.reduce((e, t) => e + t.rowCount, 0), u = t.masking?.transformed.length ?? 0;
+		if (c) {
+			if (!e.putArchive) return Q(501, { error: "storage transport not configured on this instance" });
+			let i = r.bundleKey;
+			return await e.putArchive(i, () => _i({
+				dir: f,
+				...l
+			})), zi.info("admin.export", {
+				transport: "storage",
+				tables: t.tables.length,
+				rows: n,
+				masked: u,
+				bundleKey: i
+			}), Q(200, {
+				bundleKey: i,
+				tables: t.tables.length,
+				rows: n,
+				masked: u,
+				transport: "storage"
+			});
+		}
+		let d = await Bi(_i({
+			dir: f,
+			...l
+		}));
+		return zi.info("admin.export", {
+			transport: "download",
+			tables: t.tables.length,
+			rows: n,
+			masked: u,
+			bytes: d.byteLength
+		}), {
+			status: 200,
+			contentType: "application/octet-stream",
+			body: d,
+			headers: {
+				"x-export-tables": String(t.tables.length),
+				"x-export-rows": String(n),
+				"x-export-masked": String(u)
+			}
+		};
+	} catch (e) {
+		return zi.warn("admin.export failed", { error: e?.message ?? String(e) }), Q(500, {
+			error: "export failed",
+			message: e?.message ?? String(e)
+		});
+	} finally {
+		await d.rm(f, {
+			recursive: !0,
+			force: !0
+		});
+	}
+}, Ui = (e, t, n = {}) => (async function* () {
+	let r = await ni((await U.runPromise(ei(e, t).pipe(U.timeout(n.openTimeout ?? "30 seconds")))).stream), i = n.stallMs ?? 12e4, a, o = () => {
+		a && clearTimeout(a), a = setTimeout(() => r.destroy(/* @__PURE__ */ Error(`storage read stalled for ${i}ms reading '${t}'`)), i);
+	};
+	try {
+		o();
+		for await (let e of r) o(), yield e instanceof Uint8Array ? e : new Uint8Array(e);
+	} finally {
+		a && clearTimeout(a), r.destroy();
+	}
+})(), Wi = {
+	get: async () => void 0,
+	set: async () => {},
+	setWithTags: async () => {},
+	remove: async () => !1,
+	has: async () => !1,
+	clear: async () => {},
+	invalidateTag: async () => 0,
+	wrap: async (e, t, n) => n()
+}, Gi = async (e) => {
+	pe(e.appProcedures ?? e.discovered, {
+		defaultDeny: e.security?.defaultDeny ?? !0,
+		commandHint: "`voltro serve`"
+	}), Hr({
+		dataStore: e.store,
+		schemaRegistry: e.schemaRegistry
+	});
+	let t = (e.discovered.budgets?.length ?? 0) > 0, n, r = new Xn({
+		store: e.store,
+		...e.snapshotCache ? { cache: e.snapshotCache } : {},
+		...e.reactive === void 0 ? {} : { reactive: e.reactive },
+		...t ? { recordCost: (e) => n?.record(e) } : {},
+		recordDelivery: (e) => Ir({
+			label: e.label,
+			kind: e.kind,
+			durationMs: e.durationMs,
+			rowCount: e.rowCount
+		})
+	}), i = e.cache ?? Wi, a = e.kv ?? Pr, c, d = () => void 0, ee, f, p, te, se, ce, le, ue = Oe({
+		store: e.store,
+		warn: (e, t) => {
+			process.stderr.write(`[workflow] ${e} ${JSON.stringify(t)}\n`);
+		}
+	}), fe = ue.remember, he = ue.resolve, _e = y({
+		authority: e.authority,
+		getStore: () => e.store
+	}), _ = (e.discovered.workflows?.length ?? 0) > 0 ? Cr(() => c) : void 0, ve = (e.discovered.workflows?.length ?? 0) > 0 || (e.discovered.eventTriggers?.length ?? 0) > 0, ye = ve || (e.discovered.workflowWorkers?.length ?? 0) > 0 || e.scheduleCoordination === "cluster", Se = e.tenantIsolation === "namespace", Ce = (e.log ?? F({ scope: "voltro:serve" })).child("webhooks"), we, Te, v = e.discovered.webhooks;
+	if (v && v.outgoing.length > 0 && e.workflowEngineLayer !== void 0) {
+		e.workflowEngineLayer;
+		let t = gt({
+			store: e.store,
+			schemaRegistry: e.schemaRegistry,
+			cache: i,
+			kv: a
+		}), n = v.outgoing.map((e) => e.descriptor);
+		Te = ui.toLayer(si(t, { events: n })), we = ci(t, async (e) => {
+			let t = p;
+			if (t === void 0) {
+				Ce.error("webhook delivery skipped — the workflow runtime was never built. This is a framework defect, not a configuration problem: report it with your engine setting. Deliveries are NOT queued and will not be retried.", {
+					deliveryId: e.deliveryId,
+					targetId: e.targetId
+				});
+				return;
+			}
+			t.runPromise(ui.execute(e)).catch((t) => {
+				Ce.error("deliverWebhook workflow crashed", {
+					deliveryId: e.deliveryId,
+					targetId: e.targetId
+				}, t);
+			});
+		}, { events: n });
+	}
+	let Ae = /* @__PURE__ */ new Map();
+	if (v) for (let e of v.incoming) {
+		let t = e.descriptor.path ?? li(e.descriptor.id), n = `VOLTRO_WEBHOOK_SECRET_${e.descriptor.id.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`, r = fi(e.descriptor, {
+			resolveSecret: async () => process.env[n] ?? null,
+			resolveWorkflows: () => _ === void 0 ? void 0 : Nr(_, {
+				traceId: `incoming:${e.descriptor.id}`,
+				source: `incoming:${e.descriptor.id}`
+			}),
+			log: (e) => {
+				let t = {
+					webhookId: e.webhookId,
+					status: e.status,
+					signatureOk: String(e.signatureOk),
+					idempotency: e.idempotency,
+					durationMs: e.durationMs
+				};
+				e.status >= 500 ? Ce.error("incoming delivery failed", t) : e.status >= 400 ? Ce.warn("incoming delivery rejected", t) : Ce.info("incoming delivery handled", t);
+			}
+		});
+		Ae.set(t, { handle: r });
+	}
+	fr(), Ur((t) => pr(e.store, t.subjectId, t.resourceType, t.resourceId));
+	let Ne = [], Pe = [...e.discovered.outboxHandlers ?? [], ...fn((v?.outgoing.length ?? 0) + (v?.incoming.length ?? 0) + (v?.providers.length ?? 0), []) ? [{
+		file: "<framework>/webhooks",
+		id: "voltro-webhook-emit",
+		definition: di(() => we)
+	}] : []], Ie = Pe.length > 0 ? g({
+		handlers: Pe,
+		store: e.store,
+		log: (e.log ?? F({ scope: "voltro:serve" })).child("outbox"),
+		onChange: (t) => e.store.onChange((e) => t({
+			table: e.table,
+			op: e.op
+		})),
+		onShutdown: (e) => {
+			Ne.push(e);
+		}
+	}) : void 0, x = de({
+		definitions: (e.discovered.connections ?? []).map((e) => e.definition),
+		store: e.store,
+		publicUrl: ae(e.port ?? 4e3),
+		log: (e.log ?? F({ scope: "voltro:serve" })).child("connections")
+	});
+	at({
+		events: e.discovered.events ?? [],
+		rpcTags: [
+			...e.discovered.queries.map((e) => e.descriptor.name),
+			...e.discovered.mutations.map((e) => e.descriptor.name),
+			...e.discovered.actions.map((e) => e.descriptor.name),
+			...(e.discovered.streams ?? []).map((e) => e.descriptor.name)
+		]
+	});
+	let Re = (e.log ?? F({ scope: "voltro:serve" })).child("events"), Be = e.broadcastNamespace ?? Ze(e.plugins, void 0), Ve = Le(e.plugins, Be, Re), Ue = e.membership?.instanceId ?? process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, We = e.membership ?? kt(e.plugins, {
+		instanceId: Ue,
+		namespace: Be,
+		meta: { mode: "serve" },
+		logger: Re
+	}), S = me({
+		events: e.discovered.events ?? [],
+		origin: Ue,
+		...Ve.publishRemote === void 0 ? {} : { publishRemote: Ve.publishRemote }
+	}), qe = (e.discovered.events ?? []).length > 0 ? await Ve.attach(S.bus) : null, C = ze({
+		store: e.store,
+		schemaRegistry: e.schemaRegistry,
+		cache: i,
+		kv: a,
+		...we === void 0 ? {} : { webhooksService: we },
+		..._ === void 0 ? {} : { workflowsProxy: _ },
+		eventTriggers: e.discovered.eventTriggers ?? [],
+		namespaceIsolationOn: Se,
+		...e.ensureTenantProvisioned === void 0 ? {} : { ensureTenantProvisioned: e.ensureTenantProvisioned },
+		...e.resolveResidentStore === void 0 ? {} : { resolveResidentStore: e.resolveResidentStore },
+		...Ie === void 0 ? {} : { outbox: { nudge: Ie.nudge } },
+		...x.active ? { connections: { registry: x.registry } } : {},
+		eventBus: S.bus
+	}), Je = W.succeed(qn, ne), Ye = W.succeed(Zn, He), Xe = W.succeed(Jn, It), $e = W.succeed(q, Ft), et = (t, n) => {
+		let r = t.pipe(U.provide(Sr(n)));
+		return (e.baseLayer ? r.pipe(U.provide(e.baseLayer)) : r).pipe(U.provide(Je)).pipe(U.provide(Ye)).pipe(U.provide(Xe)).pipe(U.provide($e));
+	}, tt = (e, t) => Br(et(e, t)), w = hn(), it = yt(e.plugins ?? [], w), st = u({
+		plugins: e.plugins ?? [],
+		metrics: w,
+		log: e.log ?? F({ scope: "voltro:serve" })
+	}), ct = ie(e.plugins ?? [], w), lt = e.security?.defaultDeny ?? !0, dt = Tr({
+		store: e.store,
+		defaultDeny: lt,
+		recordMetric: (e) => {
+			w.record(e);
+		},
+		...it.mutation === void 0 ? {} : { interceptor: it.mutation },
+		buildContext: (e, t, n) => C(e, t, n),
+		runEffect: tt,
+		undoCapture: xe()
+	}), ft = b();
+	{
+		let t = o();
+		t !== void 0 && (e.log ?? F({ scope: "voltro:serve" })).info(t);
+	}
+	let pt = Me({
+		store: e.store,
+		...e.approvals === void 0 ? {} : { defaultExpiryMs: e.approvals.defaultExpiryMs }
+	}), mt = mr({
+		defaultDeny: lt,
+		buildContext: (e) => C(e),
+		runEffect: tt,
+		recordMetric: (e) => {
+			w.record(e);
+		},
+		...it.action === void 0 ? {} : { interceptor: it.action }
+	}), ht = Or({
+		tenantScopedTables: e.tenantScopedTables,
+		softDeleteScopedTables: e.softDeleteScopedTables
+	}), T = {
+		defaultDeny: lt,
+		buildContext: (e) => C(e),
+		finalize: (e, t) => ht(e, t.subject),
+		provideEffect: et,
+		...it.query === void 0 ? {} : { interceptor: it.query }
+	}, E = Dr(T), _t = Er({
+		...T,
+		queryRows: (t, n) => e.store.query(t).then((e) => qr(t.table, e, n.subject))
+	}), vt = Ar({
+		...T,
+		subscribeDescriptor: (e, t, n) => r.subscribe(e, t, n),
+		subscribeComputed: (e, t, n) => r.subscribeComputed(e, t, n)
+	}), D = (e) => e.filter((e) => Dn(e.descriptor)), O = {};
+	for (let t of [
+		...D(e.discovered.queries),
+		...ft.queries,
+		...pt.queries,
+		...x.queries
+	]) O[t.descriptor.name] = (e) => Y(E(t, e), r, `subscription.${t.descriptor.name}`, void 0, void 0, kr(t, e));
+	for (let t of [
+		...D(e.discovered.mutations),
+		...ft.mutations,
+		...pt.mutations,
+		...x.mutations
+	]) {
+		let n = wr(t.descriptor.output);
+		O[t.descriptor.name] = (r) => J(async (e, n) => dt(t, e, n), r, `mutation.${t.descriptor.name}`, n, e.idempotency, t.descriptor.error);
+	}
+	for (let t of [...D(e.discovered.actions), ...x.actions]) {
+		let n = wr(t.descriptor.output);
+		O[t.descriptor.name] = (r) => J(async (e, n) => mt(t, e, n), r, `action.${t.descriptor.name}`, n, e.idempotency, t.descriptor.error);
+	}
+	let bt = () => `public-${Math.random().toString(36).slice(2, 10)}`, xt = [
+		...e.discovered.queries.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => _t(e, t, {
+				subject: n.subject,
+				traceId: bt()
+			}),
+			subscribe: (t, n, r) => vt(e, t, {
+				subject: n.subject,
+				traceId: bt()
+			}, r)
+		})),
+		...e.discovered.mutations.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => dt(e, t, {
+				subject: n.subject,
+				traceId: bt()
+			})
+		})),
+		...e.discovered.actions.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => mt(e, t, {
+				subject: n.subject,
+				traceId: bt()
+			})
+		}))
+	], St = {
+		candidates: m({
+			queries: e.discovered.queries,
+			mutations: e.discovered.mutations,
+			actions: e.discovered.actions,
+			descriptorOf: (e) => e.descriptor,
+			runQuery: (e, t, n) => Promise.resolve(_t(e, t, n)),
+			runMutation: (e, t, n) => Promise.resolve(dt(e, t, n)),
+			runAction: (e, t, n) => Promise.resolve(mt(e, t, n))
+		}),
+		policy: e.agents?.tools ?? {},
+		mcpEnabled: e.agents?.mcp === !0,
+		resolveSubject: (t) => e.resolveSubject(t, -1).then((e) => e.subject)
+	}, wt = s({
+		...e.restRoutes === void 0 ? {} : { restRoutes: e.restRoutes },
+		publicApiEntries: xt,
+		store: e.store,
+		resolveSubject: (t) => e.resolveSubject(t, -1).then((e) => e.subject),
+		...e.idempotency === void 0 ? {} : { idempotency: e.idempotency },
+		log: e.log ?? F({ scope: "voltro:serve" })
+	}), Tt = e.dataTransferSecret ?? process.env.VOLTRO_DATA_TRANSFER_SECRET, Et = Tt && Tt.length >= 16 ? [{
+		method: "POST",
+		path: Ai,
+		handle: Ri({
+			secret: Tt,
+			store: e.store,
+			...e.dataTransferSnapshot ? { snapshot: e.dataTransferSnapshot } : {},
+			assetSink: bi(Qr()),
+			openArchive: (e) => Ui(Qr(), e)
+		})
+	}, {
+		method: "POST",
+		path: ji,
+		handle: Hi({
+			secret: Tt,
+			store: e.store,
+			snapshot: e.dataTransferSnapshot ?? { tables: [] },
+			dialect: e.dataTransferDialect ?? "memory",
+			tenantTables: [...e.tenantScopedTables],
+			loadProfile: yn,
+			assetSource: xi(Qr(), e.store),
+			putArchive: async (e, t) => {
+				let { Readable: n } = await import("node:stream"), r = Qr(), i = $r("storage", () => n.from(t()));
+				await U.runPromise(ti(r, e, i, { contentType: "application/octet-stream" }));
+			}
+		})
+	}] : [], Dt = [
+		...e.httpRoutes ?? [],
+		...wt.httpRoutes,
+		...Et,
+		...x.httpRoutes
+	];
+	Object.assign(O, S.handlers);
+	for (let t of D(e.discovered.streams ?? [])) O[t.descriptor.name] = (n) => ir((r) => {
+		let i = C(r), a = t.executor(n, i);
+		if (U.isEffect(a)) {
+			let t = a.pipe(U.provide(Sr(i.store)));
+			return (e.baseLayer ? t.pipe(U.provide(e.baseLayer)) : t).pipe(U.provide(Je)).pipe(U.provide(Ye)).pipe(U.provide(Xe)).pipe(U.provide($e));
+		}
+		return typeof a == "object" && a && typeof a.then == "function" ? U.promise(() => a) : a;
+	}, `stream.${t.descriptor.name}`);
+	for (let t of e.discovered.workflows ?? []) O[t.definition.name] = (e) => J(async (e, n) => {
+		let r = n;
+		return Nr(_, {
+			subject: r.subject,
+			traceId: r.traceId,
+			source: "workflow-rpc"
+		}).start(t.definition.name, e);
+	}, e, `workflow.${t.definition.name}`);
+	ve && (O[V.name] = (e) => Y(E({
+		descriptor: V,
+		executor: (e) => {
+			let t = e.id;
+			return {
+				table: "_voltro_workflow_runs",
+				order: [{
+					column: "startedAt",
+					direction: "desc"
+				}],
+				predicate: K(G("id", t), G("executionId", t)),
+				take: 1,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${V.name}`), O[Mn.name] = (e) => Y(E({
+		descriptor: Mn,
+		executor: (e) => {
+			let t = e, n = [...t.tag === void 0 ? [] : [G("tag", t.tag)], ...t.status === void 0 ? [] : [G("status", t.status)]], r = Number.isFinite(t.limit) && t.limit !== void 0 ? Math.min(Math.max(Math.floor(t.limit), 1), 500) : 100;
+			return {
+				table: "_voltro_workflow_runs",
+				order: [{
+					column: "startedAt",
+					direction: "desc"
+				}],
+				predicate: n.length === 0 ? void 0 : n.length === 1 ? n[0] : Wn(...n),
+				take: r,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${Mn.name}`), O[H.name] = (e) => Y(E({
+		descriptor: H,
+		executor: (e) => {
+			let t = e.runId;
+			return {
+				table: "_voltro_workflow_run_steps",
+				order: [{
+					column: "startedAt",
+					direction: "asc"
+				}],
+				predicate: G("runId", t),
+				take: 1e3,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${H.name}`), O[B.name] = (e) => Y(E({
+		descriptor: B,
+		executor: (e) => {
+			let t = e.runId;
+			return {
+				table: "_voltro_workflow_run_events",
+				order: [{
+					column: "occurredAt",
+					direction: "asc"
+				}],
+				predicate: G("runId", t),
+				take: 1e3,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${B.name}`), O[An.name] = (e) => Y(E({
+		descriptor: An,
+		executor: (e) => {
+			let t = e;
+			return {
+				table: "_voltro_workflow_events",
+				order: [{
+					column: "occurredAt",
+					direction: "desc"
+				}],
+				predicate: t.name === void 0 ? void 0 : G("name", t.name),
+				take: Math.max(1, Math.min(500, t.limit ?? 100)),
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${An.name}`), O[z.name] = (e) => Y(E({
+		descriptor: z,
+		executor: (e) => {
+			let t = e.eventId;
+			return {
+				table: "_voltro_workflow_event_deliveries",
+				order: [{
+					column: "createdAt",
+					direction: "asc"
+				}],
+				predicate: G("eventId", t),
+				take: 500,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${z.name}`), O[kn.name] = (t) => J(async (t, n) => {
+		let r = t;
+		return await rt(e.store, n.subject, { executionId: r.executionId }), await _.cancel(r.workflowName, r.executionId), await Rt(r.workflowName, r.executionId, "workflow.cancel"), { ok: !0 };
+	}, t, `action.${kn.name}`), O[jn.name] = (t) => J(async (t, n) => {
+		let r = t;
+		return await rt(e.store, n.subject, { executionId: r.executionId }), await _.resume(r.workflowName, r.executionId), { ok: !0 };
+	}, t, `action.${jn.name}`), O[Nn.name] = (t) => J(async (t, n) => {
+		let r = t;
+		return await rt(e.store, n.subject, { id: r.id }), _.signal({ id: r.id }, r.signalName, r.payload);
+	}, t, `action.${Nn.name}`), O[Pn.name] = (t) => J(async (t, n) => {
+		let r = t;
+		return await rt(e.store, n.subject, { id: r.id }), _.update({ id: r.id }, r.updateName, r.payload, r.timeoutMs === void 0 ? void 0 : { timeoutMs: r.timeoutMs });
+	}, t, `action.${Pn.name}`));
+	let At = [
+		...D(e.discovered.queries).map((e) => R(e.descriptor)),
+		...D(e.discovered.mutations).map((e) => L(e.descriptor)),
+		...D(e.discovered.actions).map((e) => I(e.descriptor)),
+		...ft.queries.map((e) => R(e.descriptor)),
+		...ft.mutations.map((e) => L(e.descriptor)),
+		...pt.queries.map((e) => R(e.descriptor)),
+		...pt.mutations.map((e) => L(e.descriptor)),
+		...x.queries.map((e) => R(e.descriptor)),
+		...x.mutations.map((e) => L(e.descriptor)),
+		...x.actions.map((e) => I(e.descriptor)),
+		...D(e.discovered.streams ?? []).map((e) => On(e.descriptor)),
+		...S.rpcs,
+		...(e.discovered.workflows ?? []).map((e) => Xr(e.definition)),
+		...ve ? [
+			R(V),
+			R(Mn),
+			R(H),
+			R(B),
+			R(An),
+			R(z),
+			I(kn),
+			I(jn),
+			I(Nn),
+			I(Pn)
+		] : []
+	], jt = Hn.make(...At).middleware(wn).middleware(Tn), Mt = br({ resolveSubject: ({ headers: t, clientId: n }) => e.resolveSubject(t, n) }), Nt = e.dormancyTenantId ?? Yn, Pt = e.dormancy === "sleep" ? {
+		register: (t, n, r) => Rr(e.store, {
+			tenantId: r ?? Nt,
+			kind: "workflow",
+			refId: t,
+			wakeAt: n
+		}),
+		cancel: (t, n) => or(e.store, {
+			tenantId: n ?? Nt,
+			kind: "workflow",
+			refId: t
+		}).then(() => {})
+	} : void 0, A = ye ? await import("@voltro/workflow") : void 0, j = A?.makeWorkflowRunRecorder({
+		store: e.store,
+		...e.workflowRecording === void 0 ? {} : { recording: e.workflowRecording },
+		...Pt === void 0 ? {} : { wakeups: Pt }
+	}), Lt = async (t, n) => {
+		await A.closeWorkflowChildrenForParent({
+			store: e.store,
+			parentExecutionId: t,
+			parentStatus: n,
+			recorder: j,
+			log: { warn: (e, t) => {
+				process.stderr.write(`[workflow] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+			} },
+			interruptChild: async (t, n) => {
+				let r = (e.discovered.workflows ?? []).find((e) => e.definition.name === t);
+				if (!r) throw Error(`Unknown child workflow: ${t}`);
+				if (!p) throw Error("Workflow runtime is not ready");
+				await p.runPromise(r.definition.interrupt(n));
+			}
+		});
+	}, Rt = async (t, n, r) => {
+		let i = (await e.store.query({
+			table: "_voltro_workflow_runs",
+			order: [],
+			predicate: G("executionId", n),
+			projection: void 0,
+			skip: void 0,
+			take: 1
+		}))[0];
+		if (i === void 0) return;
+		let a = await e.store.update("_voltro_workflow_runs", i.id, {
+			status: "cancelled",
+			cancelled: !0,
+			completedAt: /* @__PURE__ */ new Date()
+		}), o = i.subject?.tenantId ?? void 0;
+		a && await j.recordEvent({
+			runId: i.id,
+			eventType: "run-cancelled",
+			payload: {
+				reason: r,
+				workflowName: t,
+				executionId: n,
+				...o == null ? {} : { tenantId: o }
+			}
+		}), a && await Lt(n, "cancelled");
+	}, zt = [
+		...X(e.discovered.workflows ?? [], {
+			buildContext: (t, n) => e.buildContextForWorkflow?.(t, n) ?? C({
+				subject: t.subject,
+				traceId: t.traceId
+			}, e.store, void 0, `workflow:${n.workflowName}`, { parentExecutionId: n.executionId }),
+			resolveStartContext: he,
+			..._e === void 0 ? {} : { resolveAuthority: _e }
+		}, (t, n, r) => {
+			let i = A.getWorkflowVersionMetadata(t.definition);
+			return A.wrapWorkflowExecuteWithRunRecording({
+				name: t.definition.name,
+				store: e.store,
+				subject: r.subject,
+				source: r.source ?? null,
+				traceId: r.traceId,
+				workflowVersion: i.version,
+				workflowCompatibleVersions: i.compatibleWith,
+				workflowPatches: i.patches,
+				parentExecutionId: r?.parentExecutionId ?? null,
+				parentClosePolicy: r?.parentClosePolicy ?? null,
+				onParentClose: ({ executionId: e, status: t }) => Lt(e, t),
+				...Ge(t.definition),
+				onTerminal: async ({ executionId: e }) => {
+					await f?.gate.release(e);
+				},
+				recorder: j,
+				pluginWorkflowStepLayer: ct,
+				recordRun: Lr
+			}, n);
+		}),
+		...e.discovered.workflowWorkers ?? [],
+		...Te === void 0 ? [] : [Te]
+	], Bt = [...(e.discovered.workflows ?? []).map((e) => e.definition.name).filter(Boolean), ...Te === void 0 ? [] : ["voltro.deliverWebhook"]], Vt = zt.length > 0 ? W.mergeAll(...zt) : W.empty;
+	if (((e.discovered.workflows?.length ?? 0) > 0 || (e.discovered.workflowWorkers?.length ?? 0) > 0 || e.scheduleCoordination === "cluster" || Te !== void 0) && e.workflowEngineLayer !== void 0) {
+		let t = Vt.pipe(W.provideMerge(e.workflowEngineLayer));
+		p = In.make(e.baseLayer === void 0 ? t : t.pipe(W.provideMerge(e.baseLayer))), await p.runPromise(U.void), (e.log ?? F({ scope: "voltro:serve" })).child("workflow").info(`workflow runtime ready — ${Bt.length} entity type(s) registered`, { entities: Bt });
+		let n = await import("@voltro/workflow/cluster"), r = (e) => p.runPromise(n.redriveFailedRun(e)), i = (e) => p.runPromise(n.resumeRunFromStep(e));
+		ce = await Qe({
+			provider: gi(e.plugins ?? [])?.broadcast?.provider,
+			crossReplica: gi(e.plugins ?? [])?.broadcast?.crossReplica ?? !1,
+			namespace: Be,
+			replicaId: crypto.randomUUID(),
+			pollStorage: () => p.runPromise(n.pollWorkflowStorage),
+			onChange: (t) => e.store.onChange((e) => t({
+				table: e.table,
+				op: e.op,
+				...e.origin === void 0 ? {} : { origin: e.origin }
+			})),
+			log: (e.log ?? F({ scope: "voltro:serve" })).child("workflow")
+		}), te = async (t) => {
+			let n = await oe({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runRedrive: r
+			}, t.runId);
+			return n.statusReset && await j.recordEvent({
+				runId: t.runId,
+				eventType: "run-redriven",
+				payload: {
+					reason: "inspect.redrive",
+					activitiesReset: n.outcome.activitiesReset
+				}
+			}), {
+				redriven: n.outcome.redriven,
+				activitiesReset: n.outcome.activitiesReset,
+				reason: n.outcome.reason
+			};
+		}, se = async (t) => {
+			let n = await De({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runResume: i
+			}, t.runId, t.step);
+			return n.statusReset && await j.recordEvent({
+				runId: t.runId,
+				eventType: "run-redriven",
+				payload: {
+					reason: "inspect.resume-from-step",
+					step: n.stepName,
+					activitiesReset: n.outcome.activitiesReset
+				}
+			}), {
+				redriven: n.outcome.redriven,
+				stepName: n.stepName,
+				activitiesReset: n.outcome.activitiesReset,
+				reason: n.outcome.reason
+			};
+		};
+		let a = xr({
+			coordinator: (e.scheduleCoordination ?? "single") === "advisoryLock" ? hr(e.store, e.scheduleReplicaId ?? `pid-${process.pid}`) : Wr,
+			replicaId: e.scheduleReplicaId ?? `pid-${process.pid}`
+		}), o = {
+			info: (e, t) => {
+				process.stdout.write(`[flow-control] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+			},
+			warn: (e, t) => {
+				process.stderr.write(`[flow-control] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+			},
+			error: (e, t) => {
+				process.stderr.write(`[flow-control] ERROR ${e} ${t ? JSON.stringify(t) : ""}\n`);
+			}
+		}, s, l = () => {
+			if (s !== void 0) return s;
+			if (!(c === void 0 || j === void 0)) return s = re({
+				store: e.store,
+				log: P,
+				workflows: e.discovered.workflows ?? [],
+				workflowsProxy: c,
+				workflowRuntime: p,
+				workflowRunRecorder: j,
+				closeChildrenForParent: Lt
+			}), s;
+		};
+		d = l, f = nt({
+			store: e.store,
+			onChange: (t) => e.store.onChange((e) => t({
+				table: e.table,
+				op: e.op
+			})),
+			...e.scheduling === void 0 ? {} : {
+				disarmWhenIdle: e.scheduling.disarmWhenIdle,
+				drainIntervalMs: e.scheduling.admissionDrainMs,
+				cancelSweepIntervalMs: e.scheduling.cancelSweepMs,
+				stalenessSweepIntervalMs: e.scheduling.stalenessSweepMs
+			},
+			workflows: e.discovered.workflows ?? [],
+			facade: () => c,
+			cancelRunWithReason: l,
+			recordRunEvent: () => j?.recordEvent,
+			...e.workflowStaleness === void 0 ? {} : { staleness: e.workflowStaleness },
+			...e.workflowSuspendSignalHintMs === void 0 ? {} : { suspendSignalHintMs: e.workflowSuspendSignalHintMs },
+			scheduleCoordinated: a,
+			onAbandoned: async (t) => {
+				await Ct({
+					workflows: e.discovered.workflows ?? [],
+					facade: () => c,
+					log: o,
+					...t
+				});
+			},
+			log: o
+		});
+		let u = f;
+		u !== void 0 && Fr(() => u.stop()), ee = Ke({
+			store: e.store,
+			onChange: (t) => e.store.onChange((e) => t({
+				table: e.table,
+				op: e.op
+			})),
+			...e.scheduling === void 0 ? {} : {
+				disarmWhenIdle: e.scheduling.disarmWhenIdle,
+				tickIntervalMs: e.scheduling.inferenceTickMs
+			},
+			enabled: (e.discovered.workflows?.length ?? 0) > 0,
+			resumeSignal: () => p === void 0 || A === void 0 ? void 0 : async ({ executionId: t, workflowName: n, signalName: r, payload: i }) => {
+				await p.runPromise(A.completeSuspendingSignal({
+					store: e.store,
+					target: Ot(t, n),
+					signalName: r,
+					payload: i
+				}));
+			},
+			runEffect: (e) => p.runPromise(e),
+			scheduleCoordinated: a,
+			log: o
+		});
+		let ne = ee;
+		ne !== void 0 && Fr(() => ne.stop()), c = (e.discovered.workflows?.length ?? 0) > 0 ? Mr({
+			workflows: e.discovered.workflows ?? [],
+			runEffect: (e) => p.runPromise(e),
+			onEnqueue: () => ce?.publishWake(),
+			...u === void 0 ? {} : {
+				admitStart: u.gate.admitStart,
+				startPayloadSchema: u.gate.startPayloadSchema,
+				parkDelayedStart: u.gate.parkDelayed
+			},
+			rememberStartContext: fe,
+			signal: async (t, n, r) => {
+				let i = await A.sendWorkflowSignal({
+					store: e.store,
+					recorder: j,
+					target: t,
+					signalName: n,
+					payload: r
+				});
+				return await p.runPromise(A.completeSuspendingSignal({
+					store: e.store,
+					target: t,
+					signalName: n,
+					payload: r
+				})).catch(() => {}), i;
+			},
+			update: (t, n, r, i) => A.sendWorkflowUpdate({
+				store: e.store,
+				recorder: j,
+				target: t,
+				updateName: n,
+				payload: r,
+				...i === void 0 ? {} : { options: i }
+			}),
+			listRuns: (t) => ke(e.store, t),
+			retry: (t, n) => je({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runPromise: (e) => p.runPromise(e)
+			}, t, n),
+			redrive: (t) => oe({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runRedrive: r
+			}, t).then((e) => e.outcome)
+		}) : void 0;
+	}
+	let M = W.mergeAll(jt.toLayer(O), Mt), Ht = k(O, e.discovered.queries.map((e) => e.descriptor.name), ve), Ut = W.mergeAll(jt.toLayer(Ht), Mt), N = e.observability, Wt = await ar({
+		...e.appName === void 0 ? {} : { serviceName: e.appName },
+		...N && N.spanProcessors.length > 0 ? { extraSpanProcessors: N.spanProcessors } : {},
+		...N && N.metricReaders.length > 0 ? { extraMetricReaders: N.metricReaders } : {},
+		...N && Object.keys(N.resourceAttributes).length > 0 ? { resourceAttributes: N.resourceAttributes } : {},
+		...N && N.sampler !== void 0 ? { sampler: N.sampler } : {}
+	}), Gt = !1, Kt = e.store.ping ? () => e.store.ping().then(() => !0).catch(() => !1) : void 0, { server: qt, shutdown: Jt } = Gr({
+		group: jt,
+		handlersLayer: M,
+		httpHandlersLayer: Ut,
+		port: e.port ?? 4e3,
+		...e.host === void 0 ? {} : { host: e.host },
+		path: e.path ?? "/ws",
+		tracerLayer: Wt.layer,
+		security: be(e),
+		...st,
+		healthCheck: {
+			isReady: () => Gt,
+			...Kt ? { ping: Kt } : {}
+		},
+		...Dt.length > 0 ? { httpRoutes: Dt } : {},
+		...e.getStore === void 0 ? {} : { getStore: e.getStore },
+		...Ae.size > 0 ? { webhookRoutes: Ae } : {},
+		...e.inspectRoute === void 0 ? {} : { inspectRoute: e.inspectRoute }
+	}), Yt = ki(qt);
+	if (await rr(qt), (e.discovered.schedules?.length ?? 0) > 0) {
+		let t = (e.scheduleCoordination ?? "single") === "advisoryLock" ? hr(e.store, e.scheduleReplicaId ?? `pid-${process.pid}`) : Wr;
+		le = await Kr(e.discovered.schedules ?? [], {
+			store: e.store,
+			coordinator: t,
+			defaultTrigger: e.scheduleDefaultTrigger ?? "self",
+			replicaId: e.scheduleReplicaId ?? `pid-${process.pid}`,
+			armSelf: e.scheduleArmSelf ?? !0,
+			dormancy: e.dormancy ?? "always-on",
+			...e.dormancyTenantId === void 0 ? {} : { dormancyTenantId: e.dormancyTenantId },
+			buildContext: ({ traceId: t, scheduleName: n, subject: r }) => C({
+				subject: r,
+				traceId: t
+			}, e.store, void 0, `schedule:${n}`),
+			log: {
+				info: (e, t) => {
+					process.stdout.write(`[schedule] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+				},
+				warn: (e, t) => {
+					process.stderr.write(`[schedule] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+				},
+				error: (e, t) => {
+					process.stderr.write(`[schedule] ERROR ${e} ${t ? JSON.stringify(t) : ""}\n`);
+				},
+				debug: () => {}
+			},
+			...e.scheduleFireInterceptor === void 0 ? {} : { interceptFire: e.scheduleFireInterceptor },
+			...e.onScheduleRunEvent === void 0 ? {} : { onRunEvent: e.onScheduleRunEvent }
+		}), e.onSchedulerReady?.(le);
+	}
+	let P = e.log ?? F({ scope: "voltro:serve" }), Xt, Zt;
+	if ((e.discovered.subscribers?.length ?? 0) > 0 && (Xt = Fe(e.discovered.subscribers ?? [], e.store, P.child("subscribe"), e.schemaRegistry, S.bus)), (e.discovered.reactions?.length ?? 0) > 0) {
+		let t = P.child("reaction"), n = async (n, r) => {
+			if (n.kind === "workflow") {
+				if (_ === void 0) {
+					t.warn("reaction workflow act skipped — no workflow engine in this app", { workflow: n.workflow });
+					return;
+				}
+				let e = n.payload === void 0 ? r.new ?? r.old ?? {} : n.payload(r);
+				await Nr(_, {
+					traceId: `reaction:${n.workflow}`,
+					source: `reaction:${n.workflow}`
+				}).start(n.workflow, e);
+				return;
+			}
+			await ot(n.agent, r, {
+				findAgentSend: (t) => e.discovered.actions.find((e) => e.descriptor.name === `${t}.send`),
+				runAction: (e, t, n) => Promise.resolve(mt(e, t, n)),
+				makeSubject: (e) => En(e),
+				now: () => Date.now(),
+				log: t
+			});
+		}, r = async (n, r) => {
+			try {
+				let { requireAiBudget: t } = await import("@voltro/ai");
+				return (await U.runPromise(U.either(t(e.store, {
+					tenantId: n,
+					limitUsd: r
+				}))))._tag === "Right";
+			} catch (e) {
+				return t.warn("reaction budget check failed — refusing the act", { tenantId: n }, e), !1;
+			}
+		}, i = ut(e.store, { onError: (e) => t.warn("reaction: rate-slot claim failed; refusing the act", { cause: String(e) }) });
+		Zt = l(e.discovered.reactions ?? [], e.store, {
+			runAct: n,
+			checkBudget: r,
+			claimRateSlot: (e) => i.claim(e)
+		}, t);
+	}
+	let Qt;
+	(e.discovered.aggregates?.length ?? 0) > 0 && (Qt = await Ee({
+		discovered: e.discovered.aggregates ?? [],
+		store: e.store,
+		log: P.child("aggregate"),
+		...e.analytics === void 0 ? {} : { analytics: e.analytics },
+		...e.aggregateStorage === void 0 ? {} : { storage: e.aggregateStorage },
+		...e.aggregateCoordinator === void 0 ? {} : { coordinator: e.aggregateCoordinator }
+	}), Je = W.succeed(qn, Qt.registry));
+	let $t;
+	(e.discovered.expectations?.length ?? 0) > 0 && ($t = er({
+		discovered: e.discovered.expectations ?? [],
+		store: e.store,
+		log: P.child("expectation")
+	}), Ye = W.succeed(Zn, $t.registry)), (e.discovered.budgets?.length ?? 0) > 0 && (n = nr({
+		discovered: e.discovered.budgets ?? [],
+		log: P.child("finops")
+	}), Xe = W.succeed(Jn, n.registry));
+	let en;
+	return (e.discovered.experiments?.length ?? 0) > 0 && (en = tr({
+		discovered: e.discovered.experiments ?? [],
+		store: e.store,
+		log: P.child("experiment")
+	}), $e = W.succeed(q, en.registry)), Gt = !0, e.bootTiming?.mark("ready"), {
+		dispatcher: r,
+		server: qt,
+		scheduler: le,
+		eventsSnapshot: ge(S.bus, S.declared),
+		membersSnapshot: () => ({
+			members: We.membership.list(),
+			capturedAt: Date.now()
+		}),
+		agentTools: () => St,
+		rpcMetrics: () => w,
+		webhooksService: () => we,
+		runCanceller: () => d(),
+		flowControlHealth: () => f?.cancelHealth(),
+		inferenceHealth: () => ee?.health(),
+		workflowWriteActions: () => _ === void 0 || j === void 0 ? void 0 : h({
+			store: e.store,
+			log: P,
+			workflows: e.discovered.workflows ?? [],
+			workflowsProxy: c,
+			workflowRuntime: p,
+			workflowRunRecorder: j,
+			closeChildrenForParent: Lt
+		}),
+		redriveWorkflowRun: (e) => te ? te(e) : Promise.reject(/* @__PURE__ */ Error("redrive: this app registers no workflows")),
+		resumeWorkflowRunFromStep: (e) => se ? se(e) : Promise.reject(/* @__PURE__ */ Error("resume-from-step: this app registers no workflows")),
+		close: async () => {
+			Gt = !1, await Yt.drainRequests();
+			for (let e of Ne) try {
+				await e();
+			} catch (e) {
+				P.warn("serve: teardown step failed", {}, e);
+			}
+			await qe?.detach(), await We.detach(), Qt?.detach(), $t?.detach(), n?.detach(), en?.detach(), Zt?.(), Xt?.(), await le?.shutdown(), r.close(), await ce?.detach(), await p?.dispose(), await Jt(), await Yt.finish();
+		}
+	};
+}, $ = F({ scope: "voltro:serve" }), Ki = (e, t, n) => (e === "production" || e === "staging") && t !== "memory" && n !== "0", qi = Lt, Ji = async (e) => {
+	let t = _n(process.cwd());
+	if (Sn(t)) {
+		let n;
+		try {
+			let e = await import(Cn(t).href);
+			typeof e.runServe == "function" ? n = e.runServe : $.warn("serve bundle has no runServe export — using the standard serve path");
+		} catch (e) {
+			$.warn("serve bundle failed to load — using the standard serve path", {}, e);
+		}
+		if (n) return $.info("serve: booting from the precompiled serve bundle"), n(e);
+	}
+	return Yi(e);
+}, Yi = async (o) => {
+	let s = vn();
+	e("serve");
+	try {
+		ii();
+	} catch (e) {
+		throw Bt(e instanceof Error ? e.message : String(e));
+	}
+	let l = process.cwd(), u = await Ue(l), ne = Rt({
+		kind: "api",
+		configPort: u?.port,
+		env: process.env,
+		flagPort: qi(o, "--port")
+	});
+	for (let e of ne.warnings) $.warn(e);
+	let re = ne.port;
+	Vr(zr(u?.secrets)), await Vt({
+		rawEnv: u?.env,
+		appType: "api",
+		root: l,
+		log: $,
+		generateTypes: !1
+	}), s.mark("config");
+	let m = (process.env.DB_DIALECT ?? u?.store ?? "memory").toLowerCase(), ie = (m === "mariadb" || m === "postgres" || m === "mssql") && (process.env.CDC ?? "1") !== "0", ae = m === "mariadb" ? "mariadb" : m === "mssql" ? "mssql" : void 0, oe = gn(l);
+	if (!r() && Sn(oe)) try {
+		let e = await import(Cn(oe).href);
+		if (e.modules) {
+			let t = {};
+			for (let [n, r] of Object.entries(e.modules)) t[xn(l, n)] = r;
+			n(t), $.info("precompiled api bundle loaded", { modules: Object.keys(t).length });
+		}
+	} catch (e) {
+		$.warn("precompiled api bundle failed to load — falling back to source", {}, e);
+	}
+	let h = await Je(l), g = await Et(h, { cdc: ie && ae !== void 0 }), de = ce(g);
+	{
+		let e = /* @__PURE__ */ new Set([
+			...g.queries.filter((e) => e.descriptor.overridesPlugin === !0).map((e) => e.descriptor.name),
+			...g.mutations.filter((e) => e.descriptor.overridesPlugin === !0).map((e) => e.descriptor.name),
+			...g.actions.filter((e) => e.descriptor.overridesPlugin === !0).map((e) => e.descriptor.name)
+		]);
+		qt(Kt(u?.plugins ?? []), [
+			...g.queries.map((e) => e.descriptor.name),
+			...g.mutations.map((e) => e.descriptor.name),
+			...g.actions.map((e) => e.descriptor.name),
+			...g.streams.map((e) => e.descriptor.name)
+		], e);
+		let t = se(g.serverOnlyLeaks, Ae(process.env, "strict"), lr, "`voltro serve`");
+		if (t.action === "fail") throw Bt(t.message ?? "");
+		t.action === "warn" && $.warn(t.message ?? "");
+	}
+	let pe = h.filter((e) => mn.test(e)), me = pe.length > 0 ? await pn(pe, $.child("webhooks")) : {
+		outgoing: [],
+		incoming: [],
+		providers: []
+	}, ge = dn(g.events), xe = me.outgoing.length + me.incoming.length + me.providers.length + ge.length === 0 ? void 0 : {
+		...me,
+		outgoing: [...me.outgoing, ...ge]
+	}, Ee = $t({
+		nodeEnv: process.env.NODE_ENV,
+		cdcDialect: ae,
+		declared: u?.schema
+	}), De = Yt({
+		gates: Ee,
+		runtime: {
+			traces: ye(),
+			undo: Jr()
+		}
+	});
+	if (De !== void 0) throw Bt(`serve: ${De}`);
+	let Oe = Qt({
+		mix: g.featureMix,
+		plugins: u?.plugins ?? [],
+		gates: Ee,
+		...ae ? { cdcDialect: ae } : {}
+	}), ke = u?.analytics !== void 0 && u.analytics.kind !== "noop" && m !== "memory" ? (await M(m)).makeSqlLayer(T()) : void 0, je = await Ie({
+		spec: u?.analytics,
+		sqlLayer: ke,
+		log: $
+	}), y = (() => {
+		let e = new Set(g.tables.map((e) => e.tableName)), t = [...g.tables];
+		for (let n of [...Oe, ...je.tables]) e.has(n.tableName) || (e.add(n.tableName), t.push(n));
+		return t;
+	})();
+	for (let e of y) Kn(e);
+	{
+		let e = ur(Yr(g.queries.map((e) => ({
+			name: e.descriptor.name,
+			source: e.descriptor.source
+		})), new Set(y.flatMap((e) => {
+			let t = e.tableName;
+			return t === void 0 ? [] : [t];
+		}))));
+		e !== void 0 && $.warn(e);
+	}
+	let Me = (process.env.NODE_ENV ?? "").toLowerCase();
+	if (Ki(Me, m, process.env.VOLTRO_AUTO_MIGRATE)) {
+		let e = (await M(m)).makeSqlLayer(T()), t = await U.runPromise(Ln.SqlClient.pipe(U.flatMap((e) => Bn(e, l)), U.provide(e), U.catchAll(() => U.succeed([]))));
+		t.length > 0 && ($.error(`serve: refusing to boot — ${t.length} pending file-based migration(s) have never run against this database. They perform the changes a schema diff cannot infer (data moves, backfills, table splits), so the declarative fingerprint check below cannot see them and would have let this process serve un-migrated data.`, { pending: t }), $.error("Run them from your pre-deploy job — `voltro db migrate .` (schema + files) or `voltro db files .` (files alone) — or set VOLTRO_AUTO_MIGRATE=0 to bypass every boot schema check. `voltro serve` never applies them itself: a rolling deploy would start N replicas and each would try."), process.exit(1));
+		let n = await U.runPromise(Ln.SqlClient.pipe(U.flatMap((e) => Vn(e, y, {
+			appliedBy: `serve:${Me}`,
+			environment: "prod",
+			dialectId: m
+		})), U.provide(e)));
+		n.kind === "prod-mismatch" && ($.error(zn(n, m)), $.error(Xt({
+			gates: Ee,
+			nodeEnv: process.env.NODE_ENV,
+			cdcDialect: ae,
+			declared: u?.schema
+		})), $.error("serve: refusing to boot — apply the schema first (voltro db apply in a pre-deploy step), or set VOLTRO_AUTO_MIGRATE=0 to bypass this check."), process.exit(1)), $.info(zn(n, m));
+	}
+	await Gt({
+		dialectId: m,
+		tables: y,
+		mode: N(u?.reactiveTriggers),
+		lockSchema: T().schema,
+		makeLayer: async () => (await M(m)).makeSqlLayer(T()),
+		log: {
+			info: (e, t) => $.info(e, t ?? {}),
+			warn: (e, t) => $.warn(e, t ?? {})
+		}
+	});
+	let Fe = jr(y);
+	s.mark("discover");
+	let b = await w(u, void 0), Le = Zr(b, m);
+	for (let e of Ye({
+		dialect: String(u?.store ?? process.env.DB_DIALECT ?? "postgres"),
+		changeStrategy: (process.env.CDC ?? "1") === "0" ? "inline" : "cdc",
+		dbUrl: process.env.DB_URL,
+		crossReplicaBus: gi(u?.plugins ?? [])?.broadcast.crossReplica === !0,
+		tables: g.tables.map((e) => ({
+			tableName: e.tableName,
+			isReactive: e.isReactive === !0
+		})),
+		querySources: g.queries.flatMap((e) => {
+			let t = e.descriptor.source;
+			return t === void 0 ? [] : typeof t == "string" ? [t] : [...t];
+		})
+	})) e.level === "warn" ? $.warn(e.message) : $.info(e.message);
+	{
+		let e = S(Dt({
+			tables: Un().map((e) => ({ tableName: e.tableName })),
+			queries: g.queries.map((e) => ({
+				name: e.descriptor.name,
+				source: e.descriptor.source
+			}))
+		}));
+		e !== void 0 && $.warn(e);
+	}
+	u?.cache && !process.env.CACHE_BACKEND && (process.env.CACHE_BACKEND = u.cache), u?.cacheRedisUrl && !process.env.CACHE_REDIS_URL && (process.env.CACHE_REDIS_URL = u.cacheRedisUrl), u?.cacheRedisDriver && !process.env.CACHE_REDIS_DRIVER && (process.env.CACHE_REDIS_DRIVER = u.cacheRedisDriver), u?.cacheKeyPrefix && !process.env.CACHE_KEY_PREFIX && (process.env.CACHE_KEY_PREFIX = u.cacheKeyPrefix);
+	let { service: ze, invalidationBus: He, snapshotCache: Ge, cache: Ke, semantic: Qe, evictSource: nt, backend: rt, stats: at, dispose: ot } = await lt({
+		env: process.env,
+		semantic: u?.cacheSemantic ?? !1
+	});
+	Qe !== void 0 && $.info("semantic cache enabled — reactive eviction on live writes"), $.info(`cache backend resolved: ${rt}` + (rt === "redis" ? ` (driver ${process.env.CACHE_REDIS_DRIVER ?? "resp"})` : " — in-process, not cross-instance")), b.onChange((e) => {
+		if (U.runFork(He.publish(e.table)), nt !== void 0) {
+			let t = (e.new ?? e.old)?.id;
+			nt({
+				table: e.table,
+				op: e.op,
+				...t === void 0 ? {} : { id: t }
+			});
+		}
+	}), u?.kv && !process.env.KV_BACKEND && (process.env.KV_BACKEND = u.kv), u?.kvRedisUrl && !process.env.KV_REDIS_URL && (process.env.KV_REDIS_URL = u.kvRedisUrl), u?.kvKeyPrefix && !process.env.KV_KEY_PREFIX && (process.env.KV_KEY_PREFIX = u.kvKeyPrefix);
+	let { kv: ut, service: gt } = await yr({ store: b });
+	$.info(wi(Ut(), Ei(), m === "postgres" && (process.env.CDC ?? "1") !== "0" ? [{ reason: "CDC LISTEN consumer" }] : [], t.replicationSnapshot()?.replicaCount ?? 0)), s.mark("store");
+	let yt = $n({
+		store: b,
+		sink: je.sink,
+		log: $
+	}), Ct = We({
+		store: b,
+		dialect: m,
+		log: { info: (e) => $.info(e) }
+	}), k = u?.plugins ?? [], Ot = process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, Ft, It;
+	m !== "memory" && (Ft = In.make((await M(m)).makeSqlLayer(T())), It = await Ft.runPromise(Ln.SqlClient));
+	let Lt = [
+		"postgres",
+		"mariadb",
+		"mysql",
+		"mssql"
+	].includes(m) ? hr(b, Ot, $) : Wr, fn = Re(u?.scheduling), _n = xr({
+		maxIdleIntervalMs: fn.pollCeilingMs,
+		coordinator: Lt,
+		replicaId: Ot,
+		log: $
+	}), yn = [], F = process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, wn = gi(u?.plugins ?? [])?.broadcast?.provider, Tn = Ze(u?.plugins, u?.name ?? bn(l));
+	{
+		let e = et(u?.plugins, u?.name ?? bn(l));
+		e !== void 0 && $.warn(e);
+	}
+	let I = kt(u?.plugins, {
+		instanceId: F,
+		namespace: Tn,
+		meta: { mode: "serve" },
+		logger: $
+	}), En = {
+		...It ? { sql: It } : {},
+		instanceId: F,
+		membership: I.membership,
+		...wn === void 0 ? {} : { broadcast: wn },
+		broadcastChannels: { presence: hi(Tn, "presence") },
+		scheduleCoordinated: (e, t, n) => {
+			let r = _n(e, t, n);
+			return yn.push(r), r;
+		}
+	};
+	for (let e of k) e.bindDataStore?.(b, En);
+	c({
+		store: b,
+		...st(),
+		log: $
+	});
+	let Dn = k.filter((e) => typeof e.onChangeEvent == "function");
+	if (Dn.length > 0) {
+		let e = b.changeScope ?? "local";
+		b.onChange((t) => {
+			let n = _e(t, e);
+			for (let e of Dn) U.runFork(e.onChangeEvent(n).pipe(U.catchAllCause((t) => U.sync(() => $.warn(`plugin ${e.name} onChangeEvent failed`, { error: Fn.pretty(t) })))));
+		});
+	}
+	let L = le({
+		plugins: k,
+		appName: u?.name ?? "voltro-api",
+		appType: "api",
+		voltroVersion: process.env.npm_package_version ?? "0.0.0",
+		log: $
+	});
+	k.length && await L.activate(), s.mark("plugins");
+	let R = await L.gatherObservability(), On = {
+		info: (e, t) => process.stdout.write(`[broadcast] ${e} ${t ? JSON.stringify(t) : ""}\n`),
+		warn: (e, t) => process.stderr.write(`[broadcast] ${e} ${t ? JSON.stringify(t) : ""}\n`),
+		debug: () => {}
+	}, kn, An = await _t(b, u, m, Tn, On, (e, t) => {
+		kn?.refreshAll(`broadcast gap: missed ${t} change(s) from ${e}`);
+	}), z = u?.apiKeys, jn = (typeof z == "object" ? z.prefix : void 0) ?? "voltro_", B = z ? cr(b) : void 0, V = B ? _r({ flush: vr(B) }) : void 0;
+	V && Fr(() => V.shutdown());
+	let H = B ? gr(B, {
+		prefix: jn,
+		...V ? { usage: V } : {}
+	}) : void 0, Mn = H ? [dr(H, { prefix: jn })] : [], Nn = O([...u?.auth?.strategies ?? [], ...Mn], pi(u?.plugins ?? []), u?.auth?.anonymousTenantRequired ?? !1, u?.auth, () => Le), Pn = [...u?.restRoutes ?? [], ...H ? Qn(H, (typeof z == "object" ? z.managementPath : void 0) ?? "/v1/api-keys") : []], Hn = qe(u?.idempotency, b), Wn = k.map((e) => e.services).filter((e) => e !== void 0), G = W.mergeAll(bt({
+		analyticsLayer: je.layer,
+		cacheService: ze,
+		kvService: gt,
+		...Qe === void 0 ? {} : { semanticCache: Qe },
+		pluginServices: Wn,
+		userLayers: u?.layers ?? []
+	}), mt(u?.http ?? {})), K = await it({
+		files: h,
+		store: b,
+		log: $,
+		seedPolicy: "report",
+		seedPattern: sn,
+		loadSeedFiles: Wt,
+		startupPattern: tn,
+		loadStartupFiles: a,
+		runStartups: i,
+		emailPattern: Be,
+		loadEmailFiles: E,
+		registerEmailTemplates: mi
+	});
+	(K.startupCount > 0 || K.emailCount > 0) && $.info("boot lifecycle", {
+		startups: K.startupCount,
+		emailTemplates: K.emailCount
+	}), K.startups !== void 0 && Fr(async () => {
+		await K.startups.stop();
+	});
+	let qn = ht({
+		schedules: xt({
+			schedules: g.schedules,
+			seeds: K.seeds,
+			store: b,
+			log: $.child("seeds")
+		}),
+		workflows: g.workflows ?? [],
+		log: $.child("workflow-schedules")
+	}), Jn = u?.scheduling ?? {}, Yn = Jn.trigger ?? "self", Xn = /* @__PURE__ */ new Set([
+		"postgres",
+		"mysql",
+		"mariadb",
+		"mssql"
+	]), Zn = Jn.coordination ?? (Xn.has(m) ? "advisoryLock" : "single"), q = Zn === "cluster" && Xn.has(m), er = q ? "cluster" : Zn === "advisoryLock" && Xn.has(m) ? "advisoryLock" : "single";
+	Zn === "cluster" && !q && $.warn("scheduling.coordination=cluster needs a sql-backed store except sqlite — falling back to single"), Zn === "advisoryLock" && !Xn.has(m) && $.warn("scheduling.coordination=advisoryLock needs a SQL store (the claim-row gate) — falling back to single");
+	let tr, nr = g.workflows.length > 0 || g.workflowWorkers.length > 0 || g.eventTriggers.length > 0 || (xe?.outgoing.length ?? 0) > 0 || q, rr;
+	if (nr) {
+		if (m === "mssql") {
+			let e = await un(process.cwd());
+			e && $.warn(e);
+		}
+		let [{ WorkflowEngine: e }, { makeClusterCronLayer: t, workflowEngineLayer: n, resolveRunnerStorage: r, resolveFailoverTuning: i }] = await Promise.all([import("@effect/workflow"), import("@voltro/workflow/cluster")]), a = q ? qn.filter((e) => (e.trigger ?? Yn) === "self").map((e) => t({
+			name: e.name,
+			cron: sr(e),
+			execute: async () => {
+				await tr?.fireFromCluster(e.name);
+			}
+		})) : [];
+		rr = m === "memory" ? e.layerMemory : await (async () => {
+			let e = await M(m), t = r({ sqliteFamily: e.id === "sqlite" || e.id === "turso" });
+			return $.info(`workflow engine: cluster-${t}, dialect=${e.id}` + (t === "memory" ? " — single-process durable replay, no cross-pod shard handoff" + (e.id !== "sqlite" && e.id !== "turso" ? " (VOLTRO_WORKFLOW_RUNNER_STORAGE=memory: SqlRunnerStorage/cluster_runners + GET_LOCK skipped)" : "") : "")), n({
+				sqlClientLayer: e.makeSqlLayer(T()),
+				runnerStorage: t,
+				dialectId: e.id,
+				...process.env.VOLTRO_WORKFLOW_RUNNER_PORT ? { runnerListenPort: Number(process.env.VOLTRO_WORKFLOW_RUNNER_PORT) } : {},
+				...i(),
+				...a.length > 0 ? { extraShardingLayers: a } : {}
+			});
+		})();
+	}
+	let J = ue(k, hn()), ir = h.filter((e) => /\.subscribe\.tsx?$/.test(e)), Y = ir.length > 0 ? await Ne(ir, $) : [], ar = h.filter((e) => /\.reaction\.tsx?$/.test(e)), or = ar.length > 0 ? await he(ar, $) : [], fr = h.filter((e) => an.test(e)), pr = fr.length > 0 ? await D(fr, $) : [], mr = h.filter((e) => /\.aggregate\.tsx?$/.test(e)), br = mr.length > 0 ? await p(mr, $) : [], Sr = ve();
+	if (br.length > 0 && m !== "memory") try {
+		Sr = ct((await M(m)).makeSqlLayer(T()));
+	} catch (e) {
+		$.warn("aggregate: SQL storage init failed — falling back to in-process", { err: String(e) });
+	}
+	let Cr = m === "memory" ? Wr : hr(b, `aggregate@${process.pid}`, $), wr = h.filter((e) => on.test(e)), Tr = wr.length > 0 ? await ee(wr, $) : [], Er = h.filter((e) => rn.test(e)), Dr = Er.length > 0 ? await Te(Er, $) : [], Or = h.filter((e) => nn.test(e)), kr = Or.length > 0 ? await Nt(Or, $) : [], Ar = [], Mr = [], Nr = h.filter((e) => Zt.test(e));
+	if (Nr.length > 0) {
+		let e = $.child("agent"), t = h.filter((e) => P.test(e));
+		t.length > 0 && await en(t, e);
+		let n = await Jt(Nr, e);
+		for (let e of n.agents) for (let t of C(e)) (t.kind === "action" ? Ar : Mr).push({
+			file: t.file,
+			descriptor: t.descriptor,
+			executor: t.executor
+		});
+		n.agents.length > 0 && e.info("synthesized agent routes", { agents: n.agents.map((e) => e.descriptor.name) });
+	}
+	s.mark("workflow");
+	let X = () => {
+		let e = Z.workflowWriteActions();
+		if (e === void 0) throw Error("workflow actions: this app registers no workflows");
+		return e;
+	}, Pr = Gn({
+		dialect: m,
+		...T()
+	}), Ir = m === "memory" ? void 0 : (await M(m)).makeSqlLayer(T()), Lr = async () => Tt({
+		sqlLayer: Ir,
+		declared: y,
+		log: $
+	}), Rr = {
+		kind: "api",
+		meta: {
+			name: u?.name ?? "voltro-api",
+			voltroVersion: wt,
+			port: re,
+			mode: "start",
+			store: m,
+			cdc: ie ? "on" : "off",
+			...Pr === void 0 ? {} : { databaseId: Pr }
+		},
+		rpc: ft(g, l),
+		workflows: tt(g, l),
+		migrations: Lr,
+		events: () => Z.eventsSnapshot(),
+		agentTools: () => Z.agentTools(),
+		invariantChecks: () => ({
+			mode: "serve",
+			accessGate: de,
+			config: u,
+			serverOnlyLeaks: g.serverOnlyLeaks,
+			migrations: Lr
+		}),
+		members: () => Z.membersSnapshot(),
+		inspectFireSchedule: async ({ name: e, trigger: t }) => {
+			if (!tr) throw Error("scheduler not started — this app registers no self-triggered schedules (all schedules are trigger:'external', or there are none).");
+			return { runId: await tr.fireNow(e, t) ?? null };
+		},
+		inspectBackfillSchedule: te({
+			getHandle: () => tr,
+			getSchedules: () => qn
+		}),
+		...xe === void 0 ? {} : { webhooks: () => _({
+			store: b,
+			discoveredWebhooks: xe
+		}) },
+		plugins: () => ({
+			plugins: L.snapshot(),
+			capturedAt: Date.now()
+		}),
+		env: () => zt(u?.name ?? bn(l), {
+			...u?.env !== void 0 && ri(u.env) ? { contract: u.env } : {},
+			plugins: u?.plugins ?? []
+		}),
+		dataCache: () => Ve({
+			stats: at,
+			backendKind: rt
+		}),
+		subscriptions: () => Pt(() => kn),
+		inspectTables: () => fe(g.tables),
+		inspectRows: Ce({
+			store: b,
+			tables: g.tables,
+			mask: !0
+		}),
+		metrics: (e) => Z.rpcMetrics().snapshot(e),
+		cluster: () => A({
+			store: b,
+			dialect: m,
+			useClusterCron: q,
+			scheduleCoordChoice: Zn
+		}),
+		inspectSchedules: () => v({
+			schedules: qn,
+			defaultTrigger: Yn,
+			coordination: er
+		}),
+		inspectScheduleRuns: (e) => Mt(b, e),
+		...d(b, {
+			controls: pt(g.workflows ?? []),
+			active: (g.workflows?.length ?? 0) > 0,
+			cancellation: () => Z.flowControlHealth()
+		}),
+		webhookActions: we(() => Z.webhooksService()),
+		inspectStartWorkflow: (e) => X().inspectStartWorkflow(e),
+		inspectCancelWorkflowRun: (e) => X().inspectCancelWorkflowRun(e),
+		inspectSuspendWorkflowRun: (e) => X().inspectSuspendWorkflowRun(e),
+		inspectResumeWorkflowRun: (e) => X().inspectResumeWorkflowRun(e),
+		inspectDiscardWorkflowRun: (e) => X().inspectDiscardWorkflowRun(e),
+		inspectRetryWorkflowRun: (e) => X().inspectRetryWorkflowRun(e),
+		inspectSignalWorkflowRun: (e) => X().inspectSignalWorkflowRun(e),
+		inspectUpdateWorkflowRun: (e) => X().inspectUpdateWorkflowRun(e),
+		inspectInferences: (e) => Xe({
+			store: b,
+			active: (g.workflows?.length ?? 0) > 0,
+			dispatcher: () => Z.inferenceHealth()
+		}, e.limit === void 0 ? {} : { limit: e.limit }),
+		...vt({
+			store: b,
+			cancelRun: async (e) => await Z.runCanceller()?.(e) ?? !1,
+			retryRun: async (e) => X().inspectRetryWorkflowRun({ runId: e }),
+			redriveRun: async (e) => Z.redriveWorkflowRun({ runId: e }),
+			log: $
+		}),
+		inspectRedriveWorkflowRun: (e) => Z.redriveWorkflowRun(e),
+		inspectResumeWorkflowRunFromStep: (e) => Z.resumeWorkflowRunFromStep(e)
+	}, Br = (process.env.VOLTRO_TENANT_ISOLATION ?? u?.tenancy?.isolation) === "namespace", Hr = Br && m !== "memory" ? await (async () => {
+		let e = await M(m);
+		return St({
+			tables: y,
+			sqlLayer: e.makeSqlLayer(T()),
+			dialect: m,
+			options: { retryFilter: e.retryFilter },
+			log: {
+				info: (e, t) => $.info(e, t),
+				error: (e, t, n) => $.error(e, t ?? {}, n)
+			}
+		});
+	})() : void 0, Ur = await dt({
+		input: u?.tenancy?.residency,
+		namespaceIsolationOn: Br,
+		makeStoreForUrl: (e, t) => w(u, void 0, Ht(T(), t)),
+		log: {
+			info: (e, t) => $.info(e, t),
+			warn: (e, t) => $.warn(e, t)
+		}
+	});
+	Ur !== void 0 && Fr(async () => {
+		await Ur.close();
+	});
+	let Z = await Gi({
+		bootTiming: s,
+		broadcastNamespace: Tn,
+		scheduling: (() => {
+			let e = fn;
+			return {
+				admissionDrainMs: e.admissionDrainMs,
+				inferenceTickMs: e.inferenceTickMs,
+				cancelSweepMs: e.cancelSweepMs,
+				stalenessSweepMs: e.stalenessSweepMs,
+				disarmWhenIdle: $e({
+					changeScope: b.changeScope,
+					broadcastAttached: An !== void 0
+				})
+			};
+		})(),
+		...u?.workflows?.staleness === void 0 ? {} : { workflowStaleness: u.workflows.staleness },
+		...u?.workflows?.suspendSignalHintMs === void 0 ? {} : { workflowSuspendSignalHintMs: u.workflows.suspendSignalHintMs },
+		workflowRecording: jt(u?.workflows?.recording),
+		membership: {
+			...I,
+			instanceId: F
+		},
+		security: {
+			defaultDeny: j(u),
+			...be(u)
+		},
+		approvals: { defaultExpiryMs: Pe(u) },
+		...u?.plugins === void 0 ? {} : { plugins: u.plugins },
+		...Hn ? { idempotency: Hn } : {},
+		restRoutes: Pn,
+		appProcedures: de,
+		discovered: {
+			queries: [...g.queries, ...Mr],
+			mutations: g.mutations,
+			actions: [...g.actions, ...Ar],
+			streams: g.streams,
+			events: g.events,
+			workflows: g.workflows,
+			workflowWorkers: g.workflowWorkers,
+			eventTriggers: g.eventTriggers,
+			schedules: qn,
+			subscribers: Y,
+			outboxHandlers: pr,
+			connections: g.connections,
+			reactions: or,
+			aggregates: br,
+			expectations: Tr,
+			budgets: Dr,
+			experiments: kr,
+			...xe === void 0 ? {} : { webhooks: xe }
+		},
+		log: $,
+		analytics: je.sink,
+		aggregateStorage: Sr,
+		aggregateCoordinator: Cr,
+		store: b,
+		kv: ut,
+		cache: Ke,
+		snapshotCache: Ge,
+		...u?.reactive === void 0 ? {} : { reactive: u.reactive },
+		schemaRegistry: Fe,
+		tenantScopedTables: g.tenantScopedTables,
+		softDeleteScopedTables: g.softDeleteScopedTables,
+		dataTransferSnapshot: Rn(y),
+		dataTransferDialect: m,
+		...Hr === void 0 ? {} : { ensureTenantProvisioned: Hr.ensure },
+		...Ur === void 0 ? {} : { resolveResidentStore: Ur.resolveStore },
+		tenantIsolation: (process.env.VOLTRO_TENANT_ISOLATION ?? u?.tenancy?.isolation) === "namespace" ? "namespace" : "shared-schema",
+		resolveSubject: (e, t) => Nn({
+			headers: e,
+			clientId: t
+		}),
+		...u?.auth === void 0 ? {} : { authority: u.auth },
+		...u?.agents === void 0 ? {} : { agents: u.agents },
+		httpRoutes: k.flatMap((e) => e.httpRoutes ?? []),
+		getStore: () => Le,
+		...G ? { baseLayer: G } : {},
+		...rr === void 0 ? {} : { workflowEngineLayer: rr },
+		scheduleDefaultTrigger: Yn,
+		scheduleCoordination: er,
+		scheduleArmSelf: !q,
+		dormancy: process.env.VOLTRO_DORMANCY === "sleep" || process.env.VOLTRO_DORMANCY === "always-on" ? process.env.VOLTRO_DORMANCY : u?.dormancy ?? "always-on",
+		scheduleReplicaId: process.env.HOSTNAME ?? `pid-${process.pid}`,
+		...J === void 0 ? {} : { scheduleFireInterceptor: J },
+		onSchedulerReady: (e) => {
+			tr = e;
+		},
+		inspectRoute: { handle: async (e, t, n, r) => await f(e, Rr, t, {
+			method: n,
+			...r === void 0 ? {} : { body: r }
+		}) || ((n === "GET" ? await ln(e, Rr, t, { method: n }) : null) ?? cn(e, Rr, t, {
+			method: n,
+			...r === void 0 ? {} : { body: r }
+		}) ?? {
+			status: 404,
+			contentType: "application/json",
+			body: JSON.stringify({ error: "not an inspect route" })
+		}) },
+		...u?.name === void 0 ? {} : { appName: u.name },
+		observability: R,
+		port: re,
+		...u?.transport?.wsPath ? { path: u.transport.wsPath } : {}
+	});
+	return kn = Z.dispatcher, At(x([
+		g.queries,
+		g.mutations,
+		g.actions,
+		g.streams
+	]), (e) => {
+		$.warn(e);
+	}), $.info(`API listening on :${re}`, {
+		dialect: m,
+		queries: g.queries.length,
+		mutations: g.mutations.length,
+		actions: g.actions.length,
+		streams: g.streams.length,
+		workflows: g.workflows.length,
+		workflowWorkers: g.workflowWorkers.length,
+		schedules: qn.length,
+		scheduleCoordination: er
+	}), s.finish($), Fr(async () => {
+		for (let e of yn) e.stop();
+		Ct.stop();
+		try {
+			await Z.close(), ot(), Ft?.dispose(), await L.deactivate(), await An?.close(), await Se({
+				mirror: yt,
+				log: $
+			}), await je.dispose(), await b.close?.();
+		} catch (e) {
+			console.error("serve: shutdown step failed, exiting anyway:", e);
+		}
+	}), await new Promise(() => {}), 0;
+};
+//#endregion
+export { Ji as n, Ki as r, Yi as t };