@voltro/cli 0.34.0 → 0.36.0

package/dist/serveCommand-VVGcIMIw.js

@@ -0,0 +1,1766 @@
+import { t as e } from "./nodeEnvironment-cGFAj1J8.js";
+import { t } from "./frameworkInspectState-CX2250XB.js";
+import { r as n, t as r } from "./appModuleLoader-C9r9mxZt.js";
+import { n as i, t as a } from "./startupRunner-DPGFchOa.js";
+import { $ as o, $t as s, A as c, At as l, B as u, C as d, Ct as ee, D as f, Dt as p, E as te, Et as ne, F as re, Ft as m, G as ie, Gt as ae, H as oe, Ht as se, I as h, It as ce, J as le, Jt as g, K as ue, Kt as de, L as fe, Lt as pe, M as me, Mt as he, N as ge, Nt as _e, O as _, Ot as ve, P as ye, Pt as be, Q as xe, Qt as Se, R as Ce, S as we, St as Te, T as v, Tt as Ee, U as De, Ut as Oe, V as ke, Vt as Ae, W as je, Wt as y, X as Me, Xt as Ne, Y as Pe, Yt as Fe, Z as b, Zt as Ie, _ as Le, _n as x, _t as Re, an as ze, at as Be, b as Ve, bt as He, c as Ue, cn as We, ct as Ge, dn as S, dt as Ke, en as qe, et as Je, f as Ye, fn as Xe, ft as Ze, g as Qe, gn as $e, gt as et, h as tt, hn as nt, ht as rt, i as C, in as it, it as at, j as ot, jt as st, k as ct, kt as lt, ln as ut, lt as dt, m as ft, mn as pt, mt, nn as ht, nt as gt, o as w, on as _t, ot as T, p as vt, pt as yt, q as bt, qt as E, r as D, rn as xt, rt as St, sn as Ct, st as wt, t as Tt, tn as O, tt as Et, u as Dt, un as Ot, ut as kt, v as At, vn as jt, vt as Mt, w as Nt, wt as Pt, x as Ft, xt as It, y as k, yt as Lt, zt as A } from "./dev-Dc4cpmRl.js";
+import { n as Rt } from "./cliArgs-D4p8n7EE.js";
+import { r as zt } from "./appPort-B_HpJ_ck.js";
+import { at as Bt, nt as Vt, st as Ht } from "./webDev-Dybxew86.js";
+import { r as j } from "./dialectDriver-CgXnDfec.js";
+import { i as Ut, n as Wt } from "./connectionConfig-UFlIEiys.js";
+import { c as M, n as Gt, o as Kt } from "./seedRunner-ZmLSqNe2.js";
+import { C as qt, S as Jt, _ as Yt, d as Xt, g as N, l as Zt, m as Qt, r as $t, u as en, v as tn } from "./frameworkTableAssembly-oMPBKqlE.js";
+import { S as nn, c as rn, n as an, p as on, s as sn, x as cn } from "./fileConventions-Cof68_BL.js";
+import { h as ln, o as un } from "./inspect-CjTYzAs_.js";
+import { n as dn } from "./mssqlClusterPatch-_4cE_nun.js";
+import { i as fn, n as pn, r as mn, t as hn } from "./webhookDiscovery-D7VaeMlz.js";
+import { t as gn } from "./inspectMetrics-CfdKLh6t.js";
+import { r as _n, u as vn } from "./apiBuild-DiE9zcj6.js";
+import { t as yn } from "./bootTiming-BdyP9nYw.js";
+import { t as bn } from "./dataProfile-dW-PsfLB.js";
+import { basename as xn, join as Sn } from "node:path";
+import { existsSync as Cn } from "node:fs";
+import { pathToFileURL as wn } from "node:url";
+import { createLogger as P } from "@voltro/logger";
+import { AuthMiddleware as Tn, ConnectionInfoMiddleware as En, actionToRpc as F, anonymousSubject as Dn, isWireReachable as On, mutationToRpc as I, queryToRpc as L, streamToRpc as kn, workflowCancelDescriptor as An, workflowDomainEventsQueryDescriptor as jn, workflowEventDeliveriesQueryDescriptor as R, workflowResumeDescriptor as Mn, workflowRunEventsQueryDescriptor as z, workflowRunQueryDescriptor as B, workflowRunStepsQueryDescriptor as V, workflowRunsQueryDescriptor as Nn, workflowSignalDescriptor as Pn, workflowUpdateDescriptor as Fn } from "@voltro/protocol";
+import { Cause as In, Effect as H, Layer as U, ManagedRuntime as Ln } from "effect";
+import { SqlClient as Rn } from "@effect/sql";
+import { declaredSnapshot as zn, describeOutcome as Bn, pendingFileMigrationIds as Vn, runPlannedMigrations as Hn } from "@voltro/database/sql";
+import { RpcGroup as Un } from "@effect/rpc";
+import { allRegisteredTables as Wn, and as Gn, connectionIdentity as Kn, ensureTableRegistered as qn, eq as W, or as G } from "@voltro/database";
+import { AggregateRegistry as Jn, CostRegistry as Yn, DORMANCY_WAKEUP_TENANT as Xn, Dispatcher as Zn, ExpectationRegistry as K, ExperimentRegistry as q, apiKeyManagementRoutes as Qn, attachAnalyticsMirror as $n, attachExpectations as er, attachExperiments as tr, attachFinops as nr, awaitServerListening as rr, bindMutation as J, bindStream as ir, bindSubscription as Y, buildTracingLayer as ar, cancelWakeup as or, compileCron as sr, dataStoreApiKeyStore as cr, formatServerOnlyLeaks as lr, formatUnresolvedSources as ur, frameworkApiKeyStrategy as dr, installPolicyGuardResolver as fr, loadResourceTuples as pr, makeActionRunner as mr, makeAdvisoryLockCoordinator as hr, makeApiKeyService as gr, makeApiKeyUsageBuffer as _r, makeApiKeyUsageFlusher as vr, makeAsyncKv as yr, makeAuthMiddlewareLayers as br, makeCoordinatedScheduler as xr, makeEffectStoreLayer as Sr, makeLazyWorkflowFacade as Cr, makeMutationOutputCodec as wr, makeMutationRunner as Tr, makeOneShotQueryRunner as Er, makeQueryDescriptorProducer as Dr, makeQueryFinalizer as Or, makeQueryReauthorizer as kr, makeQuerySubscriber as Ar, makeSchemaRegistry as jr, makeWorkflowFacade as Mr, makeWorkflowFacadeWithCallerContext as Nr, makeWorkflowLayers as X, noopKv as Pr, onProcessShutdown as Fr, recordSubscriptionDelivery as Ir, recordWorkflowRun as Lr, registerWakeup as Rr, resolveSecretsBackend as zr, runProvidedEffect as Br, setSecretsBackend as Vr, setSystemStoreHandle as Hr, setTupleSource as Ur, shutdownGraceMsFromEnv as Z, singleCoordinator as Wr, startRpcServer as Gr, startScheduler as Kr, stripForbiddenForWire as qr, undoCaptureEnabled as Jr, unresolvedSources as Yr, withScopedRequest as Xr, workflowToRpc as Zr, wrapStoreWithBootCodec as Qr } from "@voltro/runtime";
+import { appStorageProvider as $r, fromNodeReadable as ei, getObjectStream as ti, putObjectStream as ni, toNodeReadable as ri } from "@voltro/plugin-storage";
+import { isEnvContract as ii } from "@voltro/env";
+import { assertProductionSessionSecret as ai } from "@voltro/protocol/session";
+import { createHash as oi, timingSafeEqual as si } from "node:crypto";
+import { buildDeliverWebhookExecute as ci, buildWebhooksService as li, defaultIncomingPath as ui, deliverWebhookWorkflow as di, makeDeferredEmitHandler as fi, mountIncomingWebhook as pi } from "@voltro/plugin-webhooks";
+import { getAuthSessionStrategy as mi } from "@voltro/plugin-auth";
+import { registerEmailTemplates as hi } from "@voltro/plugin-mail";
+import { channelFor as gi, getBroadcastPlugin as _i } from "@voltro/plugin-broadcast";
+import { packBundle as vi, runExport as yi, runImport as bi, storageBlobSink as xi, storageRefsBlobSource as Si, unpackBundle as Ci, unpackBundleToDir as wi } from "@voltro/data-transfer";
+//#region src/dbPoolReport.ts
+var Ti = (e, t, n = [], r = 0) => {
+	let i = n.length, a = 1 + Math.max(0, r), o = e === void 0 ? void 0 : e * a + i, s = o !== void 0 && t !== void 0 ? o * t : void 0, c = i === 0 ? " No connections outside the pool in this process." : ` PLUS ${i} outside the pool (${n.map((e) => e.reason).join("; ")}) — those do not come out of the pool budget, they come out of the DATABASE's.`, l = r > 0 ? ` This process opens ${a} pools of that size — 1 primary + ${r} read replica(s) (DB_REPLICA_URLS), each with its own DB_MAX_CONNECTIONS.` : "";
+	if (e === void 0) return "db pool: max per replica UNSET (DB_MAX_CONNECTIONS) — each replica opens the driver's default pool, so the fleet total is that default × replicas. Set DB_MAX_CONNECTIONS so the total stays under your database's connection limit; the pool scales with replicaCount and the database does not." + l + c + Ei;
+	let u = (r > 0 ? `max × ${a}` : "max") + (i === 0 ? "" : ` + ${i}`), d = r === 0 ? i === 0 ? "" : ` + ${i} = ${o}` : ` → ${u} = ${o} per pod`, ee = r === 0 && i === 0 ? "max" : `(${u})`;
+	return `db pool: max=${e} per replica (DB_MAX_CONNECTIONS)` + d + (s === void 0 ? ` — the fleet opens up to ${ee} × replicas connections. Check that against your database's limit before raising replicaCount.` : ` × ${t} replicas = up to ${s} connections. Check that against your database's limit.`) + l + c + Ei;
+}, Ei = " A rolling update runs BOTH generations at once, so budget for (replicas + surge), not replicas — a surge pod that cannot get a connection crashloops, and a rollout that never completes cannot free the connections it is waiting for.", Di = (e = process.env) => {
+	let t = e.REPLICA_COUNT;
+	if (t === void 0 || t === "") return;
+	let n = Number(t);
+	return Number.isInteger(n) && n > 0 ? n : void 0;
+}, Oi = () => Math.max(500, Math.floor(Z() * .6)), ki = (e) => new Promise((t) => setTimeout(t, e)), Ai = (e) => {
+	let t = /* @__PURE__ */ new Set(), n = /* @__PURE__ */ new Set(), r = 0;
+	e.on("connection", (e) => {
+		t.add(e), e.once("close", () => {
+			t.delete(e), n.delete(e);
+		});
+	}), e.on("upgrade", (e, t) => {
+		n.add(t);
+	}), e.on("request", (e, t) => {
+		r += 1, t.once("close", () => {
+			--r;
+		});
+	});
+	let i, a = async (t = {}) => {
+		let n = t.budgetMs ?? Oi();
+		i ??= new Promise((t) => {
+			e.close(() => {
+				t();
+			});
+		}), e.closeIdleConnections();
+		let a = Date.now() + n;
+		for (; r > 0 && Date.now() < a;) await ki(25), e.closeIdleConnections();
+		e.closeIdleConnections();
+	}, o = async () => {
+		i ??= new Promise((t) => {
+			e.close(() => {
+				t();
+			});
+		});
+		for (let e of t) if (n.has(e)) try {
+			e.write(Buffer.from([
+				136,
+				2,
+				3,
+				233
+			]));
+		} catch {}
+		else e.destroy();
+		for (let e = 0; t.size > 0 && e < 250; e += 25) await ki(25);
+		for (let e of t) e.destroy();
+		await i;
+	};
+	return {
+		activeRequests: () => r,
+		drainRequests: a,
+		finish: o,
+		drain: async (e = {}) => {
+			await a(e), await o();
+		}
+	};
+}, ji = "/_voltro/admin/import", Mi = "/_voltro/admin/export", Q = (e, t) => ({
+	status: e,
+	contentType: "application/json; charset=utf-8",
+	body: JSON.stringify(t)
+}), Ni = (e) => {
+	let t = e.authorization ?? e.Authorization, n = t ? /^Bearer\s+(.+)$/i.exec(t) : null;
+	return n ? n[1] : null;
+}, Pi = (e, t) => si(oi("sha256").update(e).digest(), oi("sha256").update(t).digest()), Fi = (e, t) => {
+	if (e.method.toUpperCase() !== "POST") return Q(405, { error: "method not allowed" });
+	if (!t || t.length < 16) return Q(503, { error: "data transfer misconfigured (no/weak secret)" });
+	let n = Ni(e.headers);
+	return !n || !Pi(n, t) ? Q(401, { error: "unauthorized" }) : null;
+}, Ii = P({ scope: "voltro:admin-import" }), Li = "VBUNDLE2", Ri = async function* (e) {
+	yield e;
+}, zi = (e) => async (t) => {
+	let n = Fi(t, e.secret);
+	if (n) return n;
+	let r = t.headers["x-import-mode"], i = t.headers["x-import-on-conflict"], a = t.headers["x-import-atomic"] === "1" || t.headers["x-import-atomic"] === "true", o = t.headers["x-import-force"] === "1" || t.headers["x-import-force"] === "true", s = t.rawBody.byteLength >= 8 && Buffer.from(t.rawBody.subarray(0, 8)).toString("latin1") === Li, c, l;
+	if (s) c = Ri(t.rawBody), l = "upload";
+	else {
+		let n;
+		try {
+			n = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
+		} catch {
+			return Q(400, { error: "body must be a packed bundle archive or { bundleKey } JSON" });
+		}
+		if (typeof n.bundleKey != "string" || !n.bundleKey) return Q(400, { error: "body.bundleKey (string) is required for the storage transport" });
+		if (!e.openArchive) return Q(501, { error: "storage transport not configured on this instance" });
+		c = e.openArchive(n.bundleKey), l = "storage";
+	}
+	let u = await import("node:os"), d = await import("node:fs/promises"), ee = await import("node:path"), f = await d.mkdtemp(ee.join(u.tmpdir(), "voltro-admin-import-"));
+	try {
+		e.assetSink ? await Ci(c, {
+			dir: f,
+			blobs: e.assetSink
+		}) : await wi(c, f);
+		let t = await H.runPromiseExit(bi({
+			store: e.store,
+			bundleDir: f,
+			...r ? { mode: r } : {},
+			...i ? { onConflict: i } : {},
+			...a ? { atomic: a } : {},
+			...e.snapshot ? { targetSnapshot: e.snapshot } : {},
+			force: o,
+			onWarn: (e) => Ii.warn("admin.import", { message: e }),
+			...e.assetSink ? { assetsAlreadyRestored: !0 } : {}
+		}));
+		if (t._tag === "Failure") {
+			let e = t.cause._tag === "Fail" ? t.cause.error : void 0;
+			if (e && e._tag === "SchemaDriftError") {
+				let t = e;
+				return Ii.warn("admin.import refused (schema drift)", {
+					transport: l,
+					bundle: t.bundleFingerprint.slice(0, 16),
+					target: t.targetFingerprint.slice(0, 16)
+				}), Q(409, {
+					error: "schema drift",
+					bundleFingerprint: t.bundleFingerprint,
+					targetFingerprint: t.targetFingerprint,
+					diff: t.diff,
+					hint: "re-export against the current schema, or resend with x-import-force: 1"
+				});
+			}
+			throw Error(String(e?.message ?? e ?? "import failed"));
+		}
+		let n = t.value, s = n.tables.reduce((e, t) => e + t.rowCount, 0);
+		return Ii.info("admin.import", {
+			transport: l,
+			tables: n.tables.length,
+			rows: s,
+			mode: r ?? "upsert",
+			atomic: a
+		}), Q(200, {
+			tables: n.tables.length,
+			rows: s,
+			transport: l
+		});
+	} catch (e) {
+		return Ii.warn("admin.import failed", {
+			transport: l,
+			error: e?.message ?? String(e)
+		}), Q(500, {
+			error: "import failed",
+			message: e?.message ?? String(e)
+		});
+	} finally {
+		await d.rm(f, {
+			recursive: !0,
+			force: !0
+		});
+	}
+}, Bi = P({ scope: "voltro:admin-export" }), Vi = async (e) => {
+	let t = [];
+	for await (let n of e) t.push(Buffer.from(n));
+	return new Uint8Array(Buffer.concat(t));
+}, Hi = (e) => typeof e.tenant == "string" && e.tenant ? {
+	kind: "tenant",
+	tenantId: e.tenant
+} : Array.isArray(e.tables) && e.tables.length ? {
+	kind: "tables",
+	tables: e.tables.filter((e) => typeof e == "string")
+} : { kind: "all" }, Ui = (e) => async (t) => {
+	let n = Fi(t, e.secret);
+	if (n) return n;
+	let r;
+	try {
+		r = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
+	} catch {
+		return Q(400, { error: "body must be JSON: { profile?, tenant?, tables?, consistency?, compression?, bundleKey? }" });
+	}
+	let i = {};
+	if (typeof r.profile == "string" && r.profile) {
+		if (!e.loadProfile) return Q(501, { error: "server-side profiles not configured on this instance" });
+		try {
+			i = await e.loadProfile(r.profile);
+		} catch (e) {
+			return Q(400, {
+				error: `profile '${r.profile}' could not be loaded`,
+				message: e?.message ?? String(e)
+			});
+		}
+	}
+	let a = r.consistency === "snapshot" ? "snapshot" : i.consistency ?? "live", o = (typeof r.compression == "string" ? r.compression : void 0) ?? i.compression, s = i.scope ?? Hi(r), c = typeof r.bundleKey == "string" && r.bundleKey.length > 0, l = r.assets === !0 && e.assetSource ? { blobs: e.assetSource } : {}, u = await import("node:os"), d = await import("node:fs/promises"), ee = await import("node:path"), f = await d.mkdtemp(ee.join(u.tmpdir(), "voltro-admin-export-"));
+	try {
+		let t = await H.runPromise(yi({
+			store: e.store,
+			snapshot: e.snapshot,
+			dialect: e.dialect,
+			outDir: f,
+			...i.subset ? { subset: i.subset } : {
+				scope: s,
+				...e.tenantTables && e.tenantTables.length > 0 ? { tenantTables: e.tenantTables } : {}
+			},
+			consistency: a,
+			...o ? { compression: o } : {},
+			...i.masking ? { masking: i.masking } : {}
+		})), n = t.tables.reduce((e, t) => e + t.rowCount, 0), u = t.masking?.transformed.length ?? 0;
+		if (c) {
+			if (!e.putArchive) return Q(501, { error: "storage transport not configured on this instance" });
+			let i = r.bundleKey;
+			return await e.putArchive(i, () => vi({
+				dir: f,
+				...l
+			})), Bi.info("admin.export", {
+				transport: "storage",
+				tables: t.tables.length,
+				rows: n,
+				masked: u,
+				bundleKey: i
+			}), Q(200, {
+				bundleKey: i,
+				tables: t.tables.length,
+				rows: n,
+				masked: u,
+				transport: "storage"
+			});
+		}
+		let d = await Vi(vi({
+			dir: f,
+			...l
+		}));
+		return Bi.info("admin.export", {
+			transport: "download",
+			tables: t.tables.length,
+			rows: n,
+			masked: u,
+			bytes: d.byteLength
+		}), {
+			status: 200,
+			contentType: "application/octet-stream",
+			body: d,
+			headers: {
+				"x-export-tables": String(t.tables.length),
+				"x-export-rows": String(n),
+				"x-export-masked": String(u)
+			}
+		};
+	} catch (e) {
+		return Bi.warn("admin.export failed", { error: e?.message ?? String(e) }), Q(500, {
+			error: "export failed",
+			message: e?.message ?? String(e)
+		});
+	} finally {
+		await d.rm(f, {
+			recursive: !0,
+			force: !0
+		});
+	}
+}, Wi = (e, t, n = {}) => (async function* () {
+	let r = await ri((await H.runPromise(ti(e, t).pipe(H.timeout(n.openTimeout ?? "30 seconds")))).stream), i = n.stallMs ?? 12e4, a, o = () => {
+		a && clearTimeout(a), a = setTimeout(() => r.destroy(/* @__PURE__ */ Error(`storage read stalled for ${i}ms reading '${t}'`)), i);
+	};
+	try {
+		o();
+		for await (let e of r) o(), yield e instanceof Uint8Array ? e : new Uint8Array(e);
+	} finally {
+		a && clearTimeout(a), r.destroy();
+	}
+})(), Gi = {
+	get: async () => void 0,
+	set: async () => {},
+	setWithTags: async () => {},
+	remove: async () => !1,
+	has: async () => !1,
+	clear: async () => {},
+	invalidateTag: async () => 0,
+	wrap: async (e, t, n) => n()
+}, Ki = async (e) => {
+	pe(e.appProcedures ?? e.discovered, {
+		defaultDeny: e.security?.defaultDeny ?? !0,
+		commandHint: "`voltro serve`"
+	}), Hr({
+		dataStore: e.store,
+		schemaRegistry: e.schemaRegistry
+	});
+	let t = (e.discovered.budgets?.length ?? 0) > 0, n, r = new Zn({
+		store: e.store,
+		...e.snapshotCache ? { cache: e.snapshotCache } : {},
+		...e.reactive === void 0 ? {} : { reactive: e.reactive },
+		...t ? { recordCost: (e) => n?.record(e) } : {},
+		recordDelivery: (e) => Ir({
+			label: e.label,
+			kind: e.kind,
+			durationMs: e.durationMs,
+			rowCount: e.rowCount
+		})
+	}), i = e.cache ?? Gi, a = e.kv ?? Pr, c, d = () => void 0, ee, f, p, te, se, ce, le, ue = Oe({
+		store: e.store,
+		warn: (e, t) => {
+			process.stderr.write(`[workflow] ${e} ${JSON.stringify(t)}\n`);
+		}
+	}), fe = ue.remember, he = ue.resolve, _e = y({
+		authority: e.authority,
+		getStore: () => e.store
+	}), _ = (e.discovered.workflows?.length ?? 0) > 0 ? Cr(() => c) : void 0, ve = (e.discovered.workflows?.length ?? 0) > 0 || (e.discovered.eventTriggers?.length ?? 0) > 0, ye = ve || (e.discovered.workflowWorkers?.length ?? 0) > 0 || e.scheduleCoordination === "cluster", Se = e.tenantIsolation === "namespace", Ce = (e.log ?? P({ scope: "voltro:serve" })).child("webhooks"), we, Te, v = e.discovered.webhooks;
+	if (v && v.outgoing.length > 0 && e.workflowEngineLayer !== void 0) {
+		e.workflowEngineLayer;
+		let t = _t({
+			store: e.store,
+			schemaRegistry: e.schemaRegistry,
+			cache: i,
+			kv: a
+		}), n = v.outgoing.map((e) => e.descriptor);
+		Te = di.toLayer(ci(t, { events: n })), we = li(t, async (e) => {
+			let t = p;
+			if (t === void 0) {
+				Ce.error("webhook delivery skipped — the workflow runtime was never built. This is a framework defect, not a configuration problem: report it with your engine setting. Deliveries are NOT queued and will not be retried.", {
+					deliveryId: e.deliveryId,
+					targetId: e.targetId
+				});
+				return;
+			}
+			t.runPromise(di.execute(e)).catch((t) => {
+				Ce.error("deliverWebhook workflow crashed", {
+					deliveryId: e.deliveryId,
+					targetId: e.targetId
+				}, t);
+			});
+		}, { events: n });
+	}
+	let Ae = /* @__PURE__ */ new Map();
+	if (v) for (let e of v.incoming) {
+		let t = e.descriptor.path ?? ui(e.descriptor.id), n = `VOLTRO_WEBHOOK_SECRET_${e.descriptor.id.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`, r = pi(e.descriptor, {
+			resolveSecret: async () => process.env[n] ?? null,
+			resolveWorkflows: () => _ === void 0 ? void 0 : Nr(_, {
+				traceId: `incoming:${e.descriptor.id}`,
+				source: `incoming:${e.descriptor.id}`
+			}),
+			log: (e) => {
+				let t = {
+					webhookId: e.webhookId,
+					status: e.status,
+					signatureOk: String(e.signatureOk),
+					idempotency: e.idempotency,
+					durationMs: e.durationMs
+				};
+				e.status >= 500 ? Ce.error("incoming delivery failed", t) : e.status >= 400 ? Ce.warn("incoming delivery rejected", t) : Ce.info("incoming delivery handled", t);
+			}
+		});
+		Ae.set(t, { handle: r });
+	}
+	fr(), Ur((t) => pr(e.store, t.subjectId, t.resourceType, t.resourceId));
+	let Ne = [], Pe = [...e.discovered.outboxHandlers ?? [], ...pn((v?.outgoing.length ?? 0) + (v?.incoming.length ?? 0) + (v?.providers.length ?? 0), []) ? [{
+		file: "<framework>/webhooks",
+		id: "voltro-webhook-emit",
+		definition: fi(() => we)
+	}] : []], Ie = Pe.length > 0 ? g({
+		handlers: Pe,
+		store: e.store,
+		log: (e.log ?? P({ scope: "voltro:serve" })).child("outbox"),
+		onChange: (t) => e.store.onChange((e) => t({
+			table: e.table,
+			op: e.op
+		})),
+		onShutdown: (e) => {
+			Ne.push(e);
+		}
+	}) : void 0, x = de({
+		definitions: (e.discovered.connections ?? []).map((e) => e.definition),
+		store: e.store,
+		publicUrl: ae(e.port ?? 4e3),
+		log: (e.log ?? P({ scope: "voltro:serve" })).child("connections")
+	});
+	ot({
+		events: e.discovered.events ?? [],
+		rpcTags: [
+			...e.discovered.queries.map((e) => e.descriptor.name),
+			...e.discovered.mutations.map((e) => e.descriptor.name),
+			...e.discovered.actions.map((e) => e.descriptor.name),
+			...(e.discovered.streams ?? []).map((e) => e.descriptor.name)
+		]
+	});
+	let Re = (e.log ?? P({ scope: "voltro:serve" })).child("events"), Be = e.broadcastNamespace ?? Qe(e.plugins, void 0), Ve = Le(e.plugins, Be, Re), Ue = e.membership?.instanceId ?? process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, We = e.membership ?? At(e.plugins, {
+		instanceId: Ue,
+		namespace: Be,
+		meta: { mode: "serve" },
+		logger: Re
+	}), S = me({
+		events: e.discovered.events ?? [],
+		origin: Ue,
+		...Ve.publishRemote === void 0 ? {} : { publishRemote: Ve.publishRemote }
+	}), qe = (e.discovered.events ?? []).length > 0 ? await Ve.attach(S.bus) : null, Je = ze({
+		store: e.store,
+		schemaRegistry: e.schemaRegistry,
+		cache: i,
+		kv: a,
+		...we === void 0 ? {} : { webhooksService: we },
+		..._ === void 0 ? {} : { workflowsProxy: _ },
+		eventTriggers: e.discovered.eventTriggers ?? [],
+		namespaceIsolationOn: Se,
+		...e.ensureTenantProvisioned === void 0 ? {} : { ensureTenantProvisioned: e.ensureTenantProvisioned },
+		...e.resolveResidentStore === void 0 ? {} : { resolveResidentStore: e.resolveResidentStore },
+		...Ie === void 0 ? {} : { outbox: { nudge: Ie.nudge } },
+		...x.active ? { connections: { registry: x.registry } } : {},
+		eventBus: S.bus
+	}), Ye = U.succeed(Jn, ne), Xe = U.succeed(K, He), Ze = U.succeed(Yn, Lt), et = U.succeed(q, It), tt = (t, n) => {
+		let r = t.pipe(H.provide(Sr(n)));
+		return (e.baseLayer ? r.pipe(H.provide(e.baseLayer)) : r).pipe(H.provide(Ye)).pipe(H.provide(Xe)).pipe(H.provide(Ze)).pipe(H.provide(et));
+	}, nt = (e, t) => Br(tt(e, t)), C = gn(), at = bt(e.plugins ?? [], C), ct = u({
+		plugins: e.plugins ?? [],
+		metrics: C,
+		log: e.log ?? P({ scope: "voltro:serve" })
+	}), lt = ie(e.plugins ?? [], C), ut = e.security?.defaultDeny ?? !0, ft = Tr({
+		store: e.store,
+		defaultDeny: ut,
+		recordMetric: (e) => {
+			C.record(e);
+		},
+		...at.mutation === void 0 ? {} : { interceptor: at.mutation },
+		buildContext: (e, t, n) => Je(e, t, n),
+		runEffect: nt,
+		undoCapture: xe()
+	}), pt = b();
+	{
+		let t = o();
+		t !== void 0 && (e.log ?? P({ scope: "voltro:serve" })).info(t);
+	}
+	let mt = Me({
+		store: e.store,
+		...e.approvals === void 0 ? {} : { defaultExpiryMs: e.approvals.defaultExpiryMs }
+	}), ht = mr({
+		defaultDeny: ut,
+		buildContext: (e) => Je(e),
+		runEffect: nt,
+		recordMetric: (e) => {
+			C.record(e);
+		},
+		...at.action === void 0 ? {} : { interceptor: at.action }
+	}), gt = Or({
+		tenantScopedTables: e.tenantScopedTables,
+		softDeleteScopedTables: e.softDeleteScopedTables
+	}), w = {
+		defaultDeny: ut,
+		buildContext: (e) => Je(e),
+		finalize: (e, t) => gt(e, t.subject),
+		provideEffect: tt,
+		...at.query === void 0 ? {} : { interceptor: at.query }
+	}, T = Dr(w), vt = Er({
+		...w,
+		queryRows: (t, n) => e.store.query(t).then((e) => qr(t.table, e, n.subject))
+	}), yt = Ar({
+		...w,
+		subscribeDescriptor: (e, t, n) => r.subscribe(e, t, n),
+		subscribeComputed: (e, t, n) => r.subscribeComputed(e, t, n)
+	}), E = (e) => e.filter((e) => On(e.descriptor)), D = {};
+	for (let t of [
+		...E(e.discovered.queries),
+		...pt.queries,
+		...mt.queries,
+		...x.queries
+	]) D[t.descriptor.name] = (e) => Y(T(t, e), r, `subscription.${t.descriptor.name}`, void 0, void 0, kr(t, e));
+	for (let t of [
+		...E(e.discovered.mutations),
+		...pt.mutations,
+		...mt.mutations,
+		...x.mutations
+	]) {
+		let n = wr(t.descriptor.output);
+		D[t.descriptor.name] = (r) => J(async (e, n) => ft(t, e, n), r, `mutation.${t.descriptor.name}`, n, e.idempotency, t.descriptor.error);
+	}
+	for (let t of [...E(e.discovered.actions), ...x.actions]) {
+		let n = wr(t.descriptor.output);
+		D[t.descriptor.name] = (r) => J(async (e, n) => ht(t, e, n), r, `action.${t.descriptor.name}`, n, e.idempotency, t.descriptor.error);
+	}
+	let xt = () => `public-${Math.random().toString(36).slice(2, 10)}`, St = [
+		...e.discovered.queries.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => vt(e, t, {
+				subject: n.subject,
+				traceId: xt()
+			}),
+			subscribe: (t, n, r) => yt(e, t, {
+				subject: n.subject,
+				traceId: xt()
+			}, r)
+		})),
+		...e.discovered.mutations.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => ft(e, t, {
+				subject: n.subject,
+				traceId: xt()
+			})
+		})),
+		...e.discovered.actions.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => ht(e, t, {
+				subject: n.subject,
+				traceId: xt()
+			})
+		}))
+	], Ct = {
+		candidates: m({
+			queries: e.discovered.queries,
+			mutations: e.discovered.mutations,
+			actions: e.discovered.actions,
+			descriptorOf: (e) => e.descriptor,
+			runQuery: (e, t, n) => Promise.resolve(vt(e, t, n)),
+			runMutation: (e, t, n) => Promise.resolve(ft(e, t, n)),
+			runAction: (e, t, n) => Promise.resolve(ht(e, t, n))
+		}),
+		policy: e.agents?.tools ?? {},
+		mcpEnabled: e.agents?.mcp === !0,
+		resolveSubject: (t) => e.resolveSubject(t, -1).then((e) => e.subject)
+	}, Tt = s({
+		...e.restRoutes === void 0 ? {} : { restRoutes: e.restRoutes },
+		publicApiEntries: St,
+		store: e.store,
+		resolveSubject: (t) => e.resolveSubject(t, -1).then((e) => e.subject),
+		...e.idempotency === void 0 ? {} : { idempotency: e.idempotency },
+		log: e.log ?? P({ scope: "voltro:serve" })
+	}), Et = e.dataTransferSecret ?? process.env.VOLTRO_DATA_TRANSFER_SECRET, Dt = Et && Et.length >= 16 ? [{
+		method: "POST",
+		path: ji,
+		handle: zi({
+			secret: Et,
+			store: e.store,
+			...e.dataTransferSnapshot ? { snapshot: e.dataTransferSnapshot } : {},
+			assetSink: xi($r()),
+			openArchive: (e) => Wi($r(), e)
+		})
+	}, {
+		method: "POST",
+		path: Mi,
+		handle: Ui({
+			secret: Et,
+			store: e.store,
+			snapshot: e.dataTransferSnapshot ?? { tables: [] },
+			dialect: e.dataTransferDialect ?? "memory",
+			tenantTables: [...e.tenantScopedTables],
+			loadProfile: bn,
+			assetSource: Si($r(), e.store),
+			putArchive: async (e, t) => {
+				let { Readable: n } = await import("node:stream"), r = $r(), i = ei("storage", () => n.from(t()));
+				await H.runPromise(ni(r, e, i, { contentType: "application/octet-stream" }));
+			}
+		})
+	}] : [], Ot = [
+		...e.httpRoutes ?? [],
+		...Tt.httpRoutes,
+		...Dt,
+		...x.httpRoutes
+	];
+	Object.assign(D, S.handlers);
+	for (let t of E(e.discovered.streams ?? [])) D[t.descriptor.name] = (n) => ir((r) => Xr(r, (r) => {
+		let i = Je(r), a = t.executor(n, i);
+		if (H.isEffect(a)) {
+			let t = a.pipe(H.provide(Sr(i.store)));
+			return (e.baseLayer ? t.pipe(H.provide(e.baseLayer)) : t).pipe(H.provide(Ye)).pipe(H.provide(Xe)).pipe(H.provide(Ze)).pipe(H.provide(et));
+		}
+		return typeof a == "object" && a && typeof a.then == "function" ? H.promise(() => a) : a;
+	}), `stream.${t.descriptor.name}`);
+	for (let t of e.discovered.workflows ?? []) D[t.definition.name] = (e) => J(async (e, n) => {
+		let r = n;
+		return Nr(_, {
+			subject: r.subject,
+			traceId: r.traceId,
+			source: "workflow-rpc"
+		}).start(t.definition.name, e);
+	}, e, `workflow.${t.definition.name}`);
+	ve && (D[B.name] = (e) => Y(T({
+		descriptor: B,
+		executor: (e) => {
+			let t = e.id;
+			return {
+				table: "_voltro_workflow_runs",
+				order: [{
+					column: "startedAt",
+					direction: "desc"
+				}],
+				predicate: G(W("id", t), W("executionId", t)),
+				take: 1,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${B.name}`), D[Nn.name] = (e) => Y(T({
+		descriptor: Nn,
+		executor: (e) => {
+			let t = e, n = [...t.tag === void 0 ? [] : [W("tag", t.tag)], ...t.status === void 0 ? [] : [W("status", t.status)]], r = Number.isFinite(t.limit) && t.limit !== void 0 ? Math.min(Math.max(Math.floor(t.limit), 1), 500) : 100;
+			return {
+				table: "_voltro_workflow_runs",
+				order: [{
+					column: "startedAt",
+					direction: "desc"
+				}],
+				predicate: n.length === 0 ? void 0 : n.length === 1 ? n[0] : Gn(...n),
+				take: r,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${Nn.name}`), D[V.name] = (e) => Y(T({
+		descriptor: V,
+		executor: (e) => {
+			let t = e.runId;
+			return {
+				table: "_voltro_workflow_run_steps",
+				order: [{
+					column: "startedAt",
+					direction: "asc"
+				}],
+				predicate: W("runId", t),
+				take: 1e3,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${V.name}`), D[z.name] = (e) => Y(T({
+		descriptor: z,
+		executor: (e) => {
+			let t = e.runId;
+			return {
+				table: "_voltro_workflow_run_events",
+				order: [{
+					column: "occurredAt",
+					direction: "asc"
+				}],
+				predicate: W("runId", t),
+				take: 1e3,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${z.name}`), D[jn.name] = (e) => Y(T({
+		descriptor: jn,
+		executor: (e) => {
+			let t = e;
+			return {
+				table: "_voltro_workflow_events",
+				order: [{
+					column: "occurredAt",
+					direction: "desc"
+				}],
+				predicate: t.name === void 0 ? void 0 : W("name", t.name),
+				take: Math.max(1, Math.min(500, t.limit ?? 100)),
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${jn.name}`), D[R.name] = (e) => Y(T({
+		descriptor: R,
+		executor: (e) => {
+			let t = e.eventId;
+			return {
+				table: "_voltro_workflow_event_deliveries",
+				order: [{
+					column: "createdAt",
+					direction: "asc"
+				}],
+				predicate: W("eventId", t),
+				take: 500,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${R.name}`), D[An.name] = (t) => J(async (t, n) => {
+		let r = t;
+		return await it(e.store, n.subject, { executionId: r.executionId }), await _.cancel(r.workflowName, r.executionId), await zt(r.workflowName, r.executionId, "workflow.cancel"), { ok: !0 };
+	}, t, `action.${An.name}`), D[Mn.name] = (t) => J(async (t, n) => {
+		let r = t;
+		return await it(e.store, n.subject, { executionId: r.executionId }), await _.resume(r.workflowName, r.executionId), { ok: !0 };
+	}, t, `action.${Mn.name}`), D[Pn.name] = (t) => J(async (t, n) => {
+		let r = t;
+		return await it(e.store, n.subject, { id: r.id }), _.signal({ id: r.id }, r.signalName, r.payload);
+	}, t, `action.${Pn.name}`), D[Fn.name] = (t) => J(async (t, n) => {
+		let r = t;
+		return await it(e.store, n.subject, { id: r.id }), _.update({ id: r.id }, r.updateName, r.payload, r.timeoutMs === void 0 ? void 0 : { timeoutMs: r.timeoutMs });
+	}, t, `action.${Fn.name}`));
+	let jt = [
+		...E(e.discovered.queries).map((e) => L(e.descriptor)),
+		...E(e.discovered.mutations).map((e) => I(e.descriptor)),
+		...E(e.discovered.actions).map((e) => F(e.descriptor)),
+		...pt.queries.map((e) => L(e.descriptor)),
+		...pt.mutations.map((e) => I(e.descriptor)),
+		...mt.queries.map((e) => L(e.descriptor)),
+		...mt.mutations.map((e) => I(e.descriptor)),
+		...x.queries.map((e) => L(e.descriptor)),
+		...x.mutations.map((e) => I(e.descriptor)),
+		...x.actions.map((e) => F(e.descriptor)),
+		...E(e.discovered.streams ?? []).map((e) => kn(e.descriptor)),
+		...S.rpcs,
+		...(e.discovered.workflows ?? []).map((e) => Zr(e.definition)),
+		...ve ? [
+			L(B),
+			L(Nn),
+			L(V),
+			L(z),
+			L(jn),
+			L(R),
+			F(An),
+			F(Mn),
+			F(Pn),
+			F(Fn)
+		] : []
+	], Mt = Un.make(...jt).middleware(Tn).middleware(En), Nt = br({ resolveSubject: ({ headers: t, clientId: n }) => e.resolveSubject(t, n) }), Pt = e.dormancyTenantId ?? Xn, Ft = e.dormancy === "sleep" ? {
+		register: (t, n, r) => Rr(e.store, {
+			tenantId: r ?? Pt,
+			kind: "workflow",
+			refId: t,
+			wakeAt: n
+		}),
+		cancel: (t, n) => or(e.store, {
+			tenantId: n ?? Pt,
+			kind: "workflow",
+			refId: t
+		}).then(() => {})
+	} : void 0, k = ye ? await import("@voltro/workflow") : void 0, A = k?.makeWorkflowRunRecorder({
+		store: e.store,
+		...e.workflowRecording === void 0 ? {} : { recording: e.workflowRecording },
+		...Ft === void 0 ? {} : { wakeups: Ft }
+	}), Rt = async (t, n) => {
+		await k.closeWorkflowChildrenForParent({
+			store: e.store,
+			parentExecutionId: t,
+			parentStatus: n,
+			recorder: A,
+			log: { warn: (e, t) => {
+				process.stderr.write(`[workflow] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+			} },
+			interruptChild: async (t, n) => {
+				let r = (e.discovered.workflows ?? []).find((e) => e.definition.name === t);
+				if (!r) throw Error(`Unknown child workflow: ${t}`);
+				if (!p) throw Error("Workflow runtime is not ready");
+				await p.runPromise(r.definition.interrupt(n));
+			}
+		});
+	}, zt = async (t, n, r) => {
+		let i = (await e.store.query({
+			table: "_voltro_workflow_runs",
+			order: [],
+			predicate: W("executionId", n),
+			projection: void 0,
+			skip: void 0,
+			take: 1
+		}))[0];
+		if (i === void 0) return;
+		let a = await e.store.update("_voltro_workflow_runs", i.id, {
+			status: "cancelled",
+			cancelled: !0,
+			completedAt: /* @__PURE__ */ new Date()
+		}), o = i.subject?.tenantId ?? void 0;
+		a && await A.recordEvent({
+			runId: i.id,
+			eventType: "run-cancelled",
+			payload: {
+				reason: r,
+				workflowName: t,
+				executionId: n,
+				...o == null ? {} : { tenantId: o }
+			}
+		}), a && await Rt(n, "cancelled");
+	}, Bt = [
+		...X(e.discovered.workflows ?? [], {
+			buildContext: (t, n) => e.buildContextForWorkflow?.(t, n) ?? Je({
+				subject: t.subject,
+				traceId: t.traceId
+			}, e.store, void 0, `workflow:${n.workflowName}`, { parentExecutionId: n.executionId }),
+			resolveStartContext: he,
+			..._e === void 0 ? {} : { resolveAuthority: _e }
+		}, (t, n, r) => {
+			let i = k.getWorkflowVersionMetadata(t.definition);
+			return k.wrapWorkflowExecuteWithRunRecording({
+				name: t.definition.name,
+				store: e.store,
+				subject: r.subject,
+				source: r.source ?? null,
+				traceId: r.traceId,
+				workflowVersion: i.version,
+				workflowCompatibleVersions: i.compatibleWith,
+				workflowPatches: i.patches,
+				parentExecutionId: r?.parentExecutionId ?? null,
+				parentClosePolicy: r?.parentClosePolicy ?? null,
+				onParentClose: ({ executionId: e, status: t }) => Rt(e, t),
+				...Ge(t.definition),
+				onTerminal: async ({ executionId: e }) => {
+					await f?.gate.release(e);
+				},
+				recorder: A,
+				pluginWorkflowStepLayer: lt,
+				recordRun: Lr
+			}, n);
+		}),
+		...e.discovered.workflowWorkers ?? [],
+		...Te === void 0 ? [] : [Te]
+	], Vt = [...(e.discovered.workflows ?? []).map((e) => e.definition.name).filter(Boolean), ...Te === void 0 ? [] : ["voltro.deliverWebhook"]], Ht = Bt.length > 0 ? U.mergeAll(...Bt) : U.empty;
+	if (((e.discovered.workflows?.length ?? 0) > 0 || (e.discovered.workflowWorkers?.length ?? 0) > 0 || e.scheduleCoordination === "cluster" || Te !== void 0) && e.workflowEngineLayer !== void 0) {
+		let t = Ht.pipe(U.provideMerge(e.workflowEngineLayer));
+		p = Ln.make(e.baseLayer === void 0 ? t : t.pipe(U.provideMerge(e.baseLayer))), await p.runPromise(H.void), (e.log ?? P({ scope: "voltro:serve" })).child("workflow").info(`workflow runtime ready — ${Vt.length} entity type(s) registered`, { entities: Vt });
+		let n = await import("@voltro/workflow/cluster"), r = (e) => p.runPromise(n.redriveFailedRun(e)), i = (e) => p.runPromise(n.resumeRunFromStep(e));
+		ce = await $e({
+			provider: _i(e.plugins ?? [])?.broadcast?.provider,
+			crossReplica: _i(e.plugins ?? [])?.broadcast?.crossReplica ?? !1,
+			namespace: Be,
+			replicaId: crypto.randomUUID(),
+			pollStorage: () => p.runPromise(n.pollWorkflowStorage),
+			onChange: (t) => e.store.onChange((e) => t({
+				table: e.table,
+				op: e.op,
+				...e.origin === void 0 ? {} : { origin: e.origin }
+			})),
+			log: (e.log ?? P({ scope: "voltro:serve" })).child("workflow")
+		}), te = async (t) => {
+			let n = await oe({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runRedrive: r
+			}, t.runId);
+			return n.statusReset && await A.recordEvent({
+				runId: t.runId,
+				eventType: "run-redriven",
+				payload: {
+					reason: "inspect.redrive",
+					activitiesReset: n.outcome.activitiesReset
+				}
+			}), {
+				redriven: n.outcome.redriven,
+				activitiesReset: n.outcome.activitiesReset,
+				reason: n.outcome.reason
+			};
+		}, se = async (t) => {
+			let n = await De({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runResume: i
+			}, t.runId, t.step);
+			return n.statusReset && await A.recordEvent({
+				runId: t.runId,
+				eventType: "run-redriven",
+				payload: {
+					reason: "inspect.resume-from-step",
+					step: n.stepName,
+					activitiesReset: n.outcome.activitiesReset
+				}
+			}), {
+				redriven: n.outcome.redriven,
+				stepName: n.stepName,
+				activitiesReset: n.outcome.activitiesReset,
+				reason: n.outcome.reason
+			};
+		};
+		let a = xr({
+			coordinator: (e.scheduleCoordination ?? "single") === "advisoryLock" ? hr(e.store, e.scheduleReplicaId ?? `pid-${process.pid}`) : Wr,
+			replicaId: e.scheduleReplicaId ?? `pid-${process.pid}`
+		}), o = {
+			info: (e, t) => {
+				process.stdout.write(`[flow-control] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+			},
+			warn: (e, t) => {
+				process.stderr.write(`[flow-control] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+			},
+			error: (e, t) => {
+				process.stderr.write(`[flow-control] ERROR ${e} ${t ? JSON.stringify(t) : ""}\n`);
+			}
+		}, s, l = () => {
+			if (s !== void 0) return s;
+			if (!(c === void 0 || A === void 0)) return s = re({
+				store: e.store,
+				log: N,
+				workflows: e.discovered.workflows ?? [],
+				workflowsProxy: c,
+				workflowRuntime: p,
+				workflowRunRecorder: A,
+				closeChildrenForParent: Rt
+			}), s;
+		};
+		d = l, f = rt({
+			store: e.store,
+			onChange: (t) => e.store.onChange((e) => t({
+				table: e.table,
+				op: e.op
+			})),
+			...e.scheduling === void 0 ? {} : {
+				disarmWhenIdle: e.scheduling.disarmWhenIdle,
+				drainIntervalMs: e.scheduling.admissionDrainMs,
+				cancelSweepIntervalMs: e.scheduling.cancelSweepMs,
+				stalenessSweepIntervalMs: e.scheduling.stalenessSweepMs
+			},
+			workflows: e.discovered.workflows ?? [],
+			facade: () => c,
+			cancelRunWithReason: l,
+			recordRunEvent: () => A?.recordEvent,
+			...e.workflowStaleness === void 0 ? {} : { staleness: e.workflowStaleness },
+			...e.workflowSuspendSignalHintMs === void 0 ? {} : { suspendSignalHintMs: e.workflowSuspendSignalHintMs },
+			scheduleCoordinated: a,
+			onAbandoned: async (t) => {
+				await wt({
+					workflows: e.discovered.workflows ?? [],
+					facade: () => c,
+					log: o,
+					...t
+				});
+			},
+			log: o
+		});
+		let u = f;
+		u !== void 0 && Fr(() => u.stop()), ee = Ke({
+			store: e.store,
+			onChange: (t) => e.store.onChange((e) => t({
+				table: e.table,
+				op: e.op
+			})),
+			...e.scheduling === void 0 ? {} : {
+				disarmWhenIdle: e.scheduling.disarmWhenIdle,
+				tickIntervalMs: e.scheduling.inferenceTickMs
+			},
+			enabled: (e.discovered.workflows?.length ?? 0) > 0,
+			resumeSignal: () => p === void 0 || k === void 0 ? void 0 : async ({ executionId: t, workflowName: n, signalName: r, payload: i }) => {
+				await p.runPromise(k.completeSuspendingSignal({
+					store: e.store,
+					target: kt(t, n),
+					signalName: r,
+					payload: i
+				}));
+			},
+			runEffect: (e) => p.runPromise(e),
+			scheduleCoordinated: a,
+			log: o
+		});
+		let ne = ee;
+		ne !== void 0 && Fr(() => ne.stop()), c = (e.discovered.workflows?.length ?? 0) > 0 ? Mr({
+			workflows: e.discovered.workflows ?? [],
+			runEffect: (e) => p.runPromise(e),
+			onEnqueue: () => ce?.publishWake(),
+			...u === void 0 ? {} : {
+				admitStart: u.gate.admitStart,
+				startPayloadSchema: u.gate.startPayloadSchema,
+				parkDelayedStart: u.gate.parkDelayed
+			},
+			rememberStartContext: fe,
+			signal: async (t, n, r) => {
+				let i = await k.sendWorkflowSignal({
+					store: e.store,
+					recorder: A,
+					target: t,
+					signalName: n,
+					payload: r
+				});
+				return await p.runPromise(k.completeSuspendingSignal({
+					store: e.store,
+					target: t,
+					signalName: n,
+					payload: r
+				})).catch(() => {}), i;
+			},
+			update: (t, n, r, i) => k.sendWorkflowUpdate({
+				store: e.store,
+				recorder: A,
+				target: t,
+				updateName: n,
+				payload: r,
+				...i === void 0 ? {} : { options: i }
+			}),
+			listRuns: (t) => ke(e.store, t),
+			retry: (t, n) => je({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runPromise: (e) => p.runPromise(e)
+			}, t, n),
+			redrive: (t) => oe({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runRedrive: r
+			}, t).then((e) => e.outcome)
+		}) : void 0;
+	}
+	let j = U.mergeAll(Mt.toLayer(D), Nt), Ut = O(D, e.discovered.queries.map((e) => e.descriptor.name), ve), Wt = U.mergeAll(Mt.toLayer(Ut), Nt), M = e.observability, Gt = await ar({
+		...e.appName === void 0 ? {} : { serviceName: e.appName },
+		...M && M.spanProcessors.length > 0 ? { extraSpanProcessors: M.spanProcessors } : {},
+		...M && M.metricReaders.length > 0 ? { extraMetricReaders: M.metricReaders } : {},
+		...M && Object.keys(M.resourceAttributes).length > 0 ? { resourceAttributes: M.resourceAttributes } : {},
+		...M && M.sampler !== void 0 ? { sampler: M.sampler } : {}
+	}), Kt = !1, qt = e.store.ping ? () => e.store.ping().then(() => !0).catch(() => !1) : void 0, { server: Jt, shutdown: Yt } = Gr({
+		group: Mt,
+		handlersLayer: j,
+		httpHandlersLayer: Wt,
+		port: e.port ?? 4e3,
+		...e.host === void 0 ? {} : { host: e.host },
+		path: e.path ?? "/ws",
+		tracerLayer: Gt.layer,
+		security: be(e),
+		...ct,
+		healthCheck: {
+			isReady: () => Kt,
+			...qt ? { ping: qt } : {}
+		},
+		...Ot.length > 0 ? { httpRoutes: Ot } : {},
+		...e.getStore === void 0 ? {} : { getStore: e.getStore },
+		...Ae.size > 0 ? { webhookRoutes: Ae } : {},
+		...e.inspectRoute === void 0 ? {} : { inspectRoute: e.inspectRoute }
+	}), Xt = Ai(Jt);
+	if (await rr(Jt), (e.discovered.schedules?.length ?? 0) > 0) {
+		let t = (e.scheduleCoordination ?? "single") === "advisoryLock" ? hr(e.store, e.scheduleReplicaId ?? `pid-${process.pid}`) : Wr;
+		le = await Kr(e.discovered.schedules ?? [], {
+			store: e.store,
+			coordinator: t,
+			defaultTrigger: e.scheduleDefaultTrigger ?? "self",
+			replicaId: e.scheduleReplicaId ?? `pid-${process.pid}`,
+			armSelf: e.scheduleArmSelf ?? !0,
+			dormancy: e.dormancy ?? "always-on",
+			...e.dormancyTenantId === void 0 ? {} : { dormancyTenantId: e.dormancyTenantId },
+			buildContext: ({ traceId: t, scheduleName: n, subject: r }) => Je({
+				subject: r,
+				traceId: t
+			}, e.store, void 0, `schedule:${n}`),
+			log: {
+				info: (e, t) => {
+					process.stdout.write(`[schedule] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+				},
+				warn: (e, t) => {
+					process.stderr.write(`[schedule] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+				},
+				error: (e, t) => {
+					process.stderr.write(`[schedule] ERROR ${e} ${t ? JSON.stringify(t) : ""}\n`);
+				},
+				debug: () => {}
+			},
+			...e.scheduleFireInterceptor === void 0 ? {} : { interceptFire: e.scheduleFireInterceptor },
+			...e.onScheduleRunEvent === void 0 ? {} : { onRunEvent: e.onScheduleRunEvent }
+		}), e.onSchedulerReady?.(le);
+	}
+	let N = e.log ?? P({ scope: "voltro:serve" }), Zt, Qt;
+	if ((e.discovered.subscribers?.length ?? 0) > 0 && (Zt = Fe(e.discovered.subscribers ?? [], e.store, N.child("subscribe"), e.schemaRegistry, S.bus)), (e.discovered.reactions?.length ?? 0) > 0) {
+		let t = N.child("reaction"), n = async (n, r) => {
+			if (n.kind === "workflow") {
+				if (_ === void 0) {
+					t.warn("reaction workflow act skipped — no workflow engine in this app", { workflow: n.workflow });
+					return;
+				}
+				let e = n.payload === void 0 ? r.new ?? r.old ?? {} : n.payload(r);
+				await Nr(_, {
+					traceId: `reaction:${n.workflow}`,
+					source: `reaction:${n.workflow}`
+				}).start(n.workflow, e);
+				return;
+			}
+			await st(n.agent, r, {
+				findAgentSend: (t) => e.discovered.actions.find((e) => e.descriptor.name === `${t}.send`),
+				runAction: (e, t, n) => Promise.resolve(ht(e, t, n)),
+				makeSubject: (e) => Dn(e),
+				now: () => Date.now(),
+				log: t
+			});
+		}, r = async (n, r) => {
+			try {
+				let { requireAiBudget: t } = await import("@voltro/ai");
+				return (await H.runPromise(H.either(t(e.store, {
+					tenantId: n,
+					limitUsd: r
+				}))))._tag === "Right";
+			} catch (e) {
+				return t.warn("reaction budget check failed — refusing the act", { tenantId: n }, e), !1;
+			}
+		}, i = dt(e.store, { onError: (e) => t.warn("reaction: rate-slot claim failed; refusing the act", { cause: String(e) }) });
+		Qt = l(e.discovered.reactions ?? [], e.store, {
+			runAct: n,
+			checkBudget: r,
+			claimRateSlot: (e) => i.claim(e)
+		}, t);
+	}
+	let $t;
+	(e.discovered.aggregates?.length ?? 0) > 0 && ($t = await Ee({
+		discovered: e.discovered.aggregates ?? [],
+		store: e.store,
+		log: N.child("aggregate"),
+		...e.analytics === void 0 ? {} : { analytics: e.analytics },
+		...e.aggregateStorage === void 0 ? {} : { storage: e.aggregateStorage },
+		...e.aggregateCoordinator === void 0 ? {} : { coordinator: e.aggregateCoordinator }
+	}), Ye = U.succeed(Jn, $t.registry));
+	let en;
+	(e.discovered.expectations?.length ?? 0) > 0 && (en = er({
+		discovered: e.discovered.expectations ?? [],
+		store: e.store,
+		log: N.child("expectation")
+	}), Xe = U.succeed(K, en.registry)), (e.discovered.budgets?.length ?? 0) > 0 && (n = nr({
+		discovered: e.discovered.budgets ?? [],
+		log: N.child("finops")
+	}), Ze = U.succeed(Yn, n.registry));
+	let tn;
+	return (e.discovered.experiments?.length ?? 0) > 0 && (tn = tr({
+		discovered: e.discovered.experiments ?? [],
+		store: e.store,
+		log: N.child("experiment")
+	}), et = U.succeed(q, tn.registry)), Kt = !0, e.bootTiming?.mark("ready"), {
+		dispatcher: r,
+		server: Jt,
+		scheduler: le,
+		eventsSnapshot: ge(S.bus, S.declared),
+		membersSnapshot: () => ({
+			members: We.membership.list(),
+			capturedAt: Date.now()
+		}),
+		agentTools: () => Ct,
+		rpcMetrics: () => C,
+		webhooksService: () => we,
+		runCanceller: () => d(),
+		flowControlHealth: () => f?.cancelHealth(),
+		inferenceHealth: () => ee?.health(),
+		workflowWriteActions: () => _ === void 0 || A === void 0 ? void 0 : h({
+			store: e.store,
+			log: N,
+			workflows: e.discovered.workflows ?? [],
+			workflowsProxy: c,
+			workflowRuntime: p,
+			workflowRunRecorder: A,
+			closeChildrenForParent: Rt
+		}),
+		redriveWorkflowRun: (e) => te ? te(e) : Promise.reject(/* @__PURE__ */ Error("redrive: this app registers no workflows")),
+		resumeWorkflowRunFromStep: (e) => se ? se(e) : Promise.reject(/* @__PURE__ */ Error("resume-from-step: this app registers no workflows")),
+		close: async () => {
+			Kt = !1, await Xt.drainRequests();
+			for (let e of Ne) try {
+				await e();
+			} catch (e) {
+				N.warn("serve: teardown step failed", {}, e);
+			}
+			await qe?.detach(), await We.detach(), $t?.detach(), en?.detach(), n?.detach(), tn?.detach(), Qt?.(), Zt?.(), await le?.shutdown(), r.close(), await ce?.detach(), await p?.dispose(), await Yt(), await Xt.finish();
+		}
+	};
+}, $ = P({ scope: "voltro:serve" }), qi = (e, t, n) => (e === "production" || e === "staging") && t !== "memory" && n !== "0", Ji = Rt, Yi = async (e) => {
+	let t = vn(process.cwd());
+	if (Cn(t)) {
+		let n;
+		try {
+			let e = await import(wn(t).href);
+			typeof e.runServe == "function" ? n = e.runServe : $.warn("serve bundle has no runServe export — using the standard serve path");
+		} catch (e) {
+			$.warn("serve bundle failed to load — using the standard serve path", {}, e);
+		}
+		if (n) return $.info("serve: booting from the precompiled serve bundle"), n(e);
+	}
+	return Xi(e);
+}, Xi = async (o) => {
+	let s = yn();
+	e("serve");
+	try {
+		ai();
+	} catch (e) {
+		throw Vt(e instanceof Error ? e.message : String(e));
+	}
+	let l = process.cwd(), u = await Ue(l), ne = zt({
+		kind: "api",
+		configPort: u?.port,
+		env: process.env,
+		flagPort: Ji(o, "--port")
+	});
+	for (let e of ne.warnings) $.warn(e);
+	let re = ne.port;
+	Vr(zr(u?.secrets)), await Ht({
+		rawEnv: u?.env,
+		appType: "api",
+		root: l,
+		log: $,
+		generateTypes: !1
+	}), s.mark("config");
+	let m = (process.env.DB_DIALECT ?? u?.store ?? "memory").toLowerCase(), ie = (m === "mariadb" || m === "postgres" || m === "mssql") && (process.env.CDC ?? "1") !== "0", ae = m === "mariadb" ? "mariadb" : m === "mssql" ? "mssql" : void 0, oe = _n(l);
+	if (!r() && Cn(oe)) try {
+		let e = await import(wn(oe).href);
+		if (e.modules) {
+			let t = {};
+			for (let [n, r] of Object.entries(e.modules)) t[Sn(l, n)] = r;
+			n(t), $.info("precompiled api bundle loaded", { modules: Object.keys(t).length });
+		}
+	} catch (e) {
+		$.warn("precompiled api bundle failed to load — falling back to source", {}, e);
+	}
+	let h = await Ye(l), g = await Dt(h, { cdc: ie && ae !== void 0 }), de = ce(g);
+	{
+		let e = /* @__PURE__ */ new Set([
+			...g.queries.filter((e) => e.descriptor.overridesPlugin === !0).map((e) => e.descriptor.name),
+			...g.mutations.filter((e) => e.descriptor.overridesPlugin === !0).map((e) => e.descriptor.name),
+			...g.actions.filter((e) => e.descriptor.overridesPlugin === !0).map((e) => e.descriptor.name)
+		]);
+		Jt(qt(u?.plugins ?? []), [
+			...g.queries.map((e) => e.descriptor.name),
+			...g.mutations.map((e) => e.descriptor.name),
+			...g.actions.map((e) => e.descriptor.name),
+			...g.streams.map((e) => e.descriptor.name)
+		], e);
+		let t = se(g.serverOnlyLeaks, Ae(process.env, "strict"), lr, "`voltro serve`");
+		if (t.action === "fail") throw Vt(t.message ?? "");
+		t.action === "warn" && $.warn(t.message ?? "");
+	}
+	let pe = h.filter((e) => hn.test(e)), me = pe.length > 0 ? await mn(pe, $.child("webhooks")) : {
+		outgoing: [],
+		incoming: [],
+		providers: []
+	}, ge = fn(g.events), xe = me.outgoing.length + me.incoming.length + me.providers.length + ge.length === 0 ? void 0 : {
+		...me,
+		outgoing: [...me.outgoing, ...ge]
+	}, Ee = en({
+		nodeEnv: process.env.NODE_ENV,
+		cdcDialect: ae,
+		declared: u?.schema
+	}), De = Xt({
+		gates: Ee,
+		runtime: {
+			traces: ye(),
+			undo: Jr()
+		}
+	});
+	if (De !== void 0) throw Vt(`serve: ${De}`);
+	let Oe = $t({
+		mix: g.featureMix,
+		plugins: u?.plugins ?? [],
+		gates: Ee,
+		...ae ? { cdcDialect: ae } : {}
+	}), ke = u?.analytics !== void 0 && u.analytics.kind !== "noop" && m !== "memory" ? (await j(m)).makeSqlLayer(w()) : void 0, je = await Ie({
+		spec: u?.analytics,
+		sqlLayer: ke,
+		log: $
+	}), y = (() => {
+		let e = new Set(g.tables.map((e) => e.tableName)), t = [...g.tables];
+		for (let n of [...Oe, ...je.tables]) e.has(n.tableName) || (e.add(n.tableName), t.push(n));
+		return t;
+	})();
+	for (let e of y) qn(e);
+	{
+		let e = ur(Yr(g.queries.map((e) => ({
+			name: e.descriptor.name,
+			source: e.descriptor.source
+		})), new Set(y.flatMap((e) => {
+			let t = e.tableName;
+			return t === void 0 ? [] : [t];
+		}))));
+		e !== void 0 && $.warn(e);
+	}
+	let Me = (process.env.NODE_ENV ?? "").toLowerCase();
+	if (qi(Me, m, process.env.VOLTRO_AUTO_MIGRATE)) {
+		let e = (await j(m)).makeSqlLayer(w()), t = await H.runPromise(Rn.SqlClient.pipe(H.flatMap((e) => Vn(e, l)), H.provide(e), H.catchAll(() => H.succeed([]))));
+		t.length > 0 && ($.error(`serve: refusing to boot — ${t.length} pending file-based migration(s) have never run against this database. They perform the changes a schema diff cannot infer (data moves, backfills, table splits), so the declarative fingerprint check below cannot see them and would have let this process serve un-migrated data.`, { pending: t }), $.error("Run them from your pre-deploy job — `voltro db migrate .` (schema + files) or `voltro db files .` (files alone) — or set VOLTRO_AUTO_MIGRATE=0 to bypass every boot schema check. `voltro serve` never applies them itself: a rolling deploy would start N replicas and each would try."), process.exit(1));
+		let n = await H.runPromise(Rn.SqlClient.pipe(H.flatMap((e) => Hn(e, y, {
+			appliedBy: `serve:${Me}`,
+			environment: "prod",
+			dialectId: m
+		})), H.provide(e)));
+		n.kind === "prod-mismatch" && ($.error(Bn(n, m)), $.error(Zt({
+			gates: Ee,
+			nodeEnv: process.env.NODE_ENV,
+			cdcDialect: ae,
+			declared: u?.schema
+		})), $.error("serve: refusing to boot — apply the schema first (voltro db apply in a pre-deploy step), or set VOLTRO_AUTO_MIGRATE=0 to bypass this check."), process.exit(1)), $.info(Bn(n, m));
+	}
+	await Kt({
+		dialectId: m,
+		tables: y,
+		mode: M(u?.reactiveTriggers),
+		lockSchema: w().schema,
+		makeLayer: async () => (await j(m)).makeSqlLayer(w()),
+		log: {
+			info: (e, t) => $.info(e, t ?? {}),
+			warn: (e, t) => $.warn(e, t ?? {})
+		}
+	});
+	let Fe = jr(y);
+	s.mark("discover");
+	let b = await C(u, void 0), Le = Qr(b, m);
+	for (let e of Xe({
+		dialect: String(u?.store ?? process.env.DB_DIALECT ?? "postgres"),
+		changeStrategy: (process.env.CDC ?? "1") === "0" ? "inline" : "cdc",
+		dbUrl: process.env.DB_URL,
+		crossReplicaBus: _i(u?.plugins ?? [])?.broadcast.crossReplica === !0,
+		tables: g.tables.map((e) => ({
+			tableName: e.tableName,
+			isReactive: e.isReactive === !0
+		})),
+		querySources: g.queries.flatMap((e) => {
+			let t = e.descriptor.source;
+			return t === void 0 ? [] : typeof t == "string" ? [t] : [...t];
+		})
+	})) e.level === "warn" ? $.warn(e.message) : $.info(e.message);
+	{
+		let e = S(Ot({
+			tables: Wn().map((e) => ({ tableName: e.tableName })),
+			queries: g.queries.map((e) => ({
+				name: e.descriptor.name,
+				source: e.descriptor.source
+			}))
+		}));
+		e !== void 0 && $.warn(e);
+	}
+	u?.cache && !process.env.CACHE_BACKEND && (process.env.CACHE_BACKEND = u.cache), u?.cacheRedisUrl && !process.env.CACHE_REDIS_URL && (process.env.CACHE_REDIS_URL = u.cacheRedisUrl), u?.cacheRedisDriver && !process.env.CACHE_REDIS_DRIVER && (process.env.CACHE_REDIS_DRIVER = u.cacheRedisDriver), u?.cacheKeyPrefix && !process.env.CACHE_KEY_PREFIX && (process.env.CACHE_KEY_PREFIX = u.cacheKeyPrefix);
+	let { service: ze, invalidationBus: He, snapshotCache: Ge, cache: Ke, semantic: $e, evictSource: rt, backend: it, stats: ot, dispose: st } = await ut({
+		env: process.env,
+		semantic: u?.cacheSemantic ?? !1
+	});
+	$e !== void 0 && $.info("semantic cache enabled — reactive eviction on live writes"), $.info(`cache backend resolved: ${it}` + (it === "redis" ? ` (driver ${process.env.CACHE_REDIS_DRIVER ?? "resp"})` : " — in-process, not cross-instance")), b.onChange((e) => {
+		if (H.runFork(He.publish(e.table)), rt !== void 0) {
+			let t = (e.new ?? e.old)?.id;
+			rt({
+				table: e.table,
+				op: e.op,
+				...t === void 0 ? {} : { id: t }
+			});
+		}
+	}), u?.kv && !process.env.KV_BACKEND && (process.env.KV_BACKEND = u.kv), u?.kvRedisUrl && !process.env.KV_REDIS_URL && (process.env.KV_REDIS_URL = u.kvRedisUrl), u?.kvKeyPrefix && !process.env.KV_KEY_PREFIX && (process.env.KV_KEY_PREFIX = u.kvKeyPrefix);
+	let { kv: dt, service: _t } = await yr({ store: b });
+	$.info(Ti(Wt(), Di(), m === "postgres" && (process.env.CDC ?? "1") !== "0" ? [{ reason: "CDC LISTEN consumer" }] : [], t.replicationSnapshot()?.replicaCount ?? 0)), s.mark("store");
+	let bt = $n({
+		store: b,
+		sink: je.sink,
+		log: $
+	}), wt = We({
+		store: b,
+		dialect: m,
+		log: { info: (e) => $.info(e) }
+	}), O = u?.plugins ?? [], kt = process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, It, Lt;
+	m !== "memory" && (It = Ln.make((await j(m)).makeSqlLayer(w())), Lt = await It.runPromise(Rn.SqlClient));
+	let Rt = [
+		"postgres",
+		"mariadb",
+		"mysql",
+		"mssql"
+	].includes(m) ? hr(b, kt, $) : Wr, pn = Re(u?.scheduling), vn = xr({
+		maxIdleIntervalMs: pn.pollCeilingMs,
+		coordinator: Rt,
+		replicaId: kt,
+		log: $
+	}), bn = [], P = process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, Tn = _i(u?.plugins ?? [])?.broadcast?.provider, En = Qe(u?.plugins, u?.name ?? xn(l));
+	{
+		let e = tt(u?.plugins, u?.name ?? xn(l));
+		e !== void 0 && $.warn(e);
+	}
+	let F = At(u?.plugins, {
+		instanceId: P,
+		namespace: En,
+		meta: { mode: "serve" },
+		logger: $
+	}), Dn = {
+		...Lt ? { sql: Lt } : {},
+		instanceId: P,
+		membership: F.membership,
+		...Tn === void 0 ? {} : { broadcast: Tn },
+		broadcastChannels: { presence: gi(En, "presence") },
+		scheduleCoordinated: (e, t, n) => {
+			let r = vn(e, t, n);
+			return bn.push(r), r;
+		}
+	};
+	for (let e of O) e.bindDataStore?.(Le, Dn);
+	c({
+		store: b,
+		...ct(),
+		log: $
+	});
+	let On = O.filter((e) => typeof e.onChangeEvent == "function");
+	if (On.length > 0) {
+		let e = b.changeScope ?? "local";
+		b.onChange((t) => {
+			let n = _e(t, e);
+			for (let e of On) H.runFork(e.onChangeEvent(n).pipe(H.catchAllCause((t) => H.sync(() => $.warn(`plugin ${e.name} onChangeEvent failed`, { error: In.pretty(t) })))));
+		});
+	}
+	let I = le({
+		plugins: O,
+		appName: u?.name ?? "voltro-api",
+		appType: "api",
+		voltroVersion: process.env.npm_package_version ?? "0.0.0",
+		log: $
+	});
+	O.length && await I.activate(), s.mark("plugins");
+	let L = await I.gatherObservability(), kn = {
+		info: (e, t) => process.stdout.write(`[broadcast] ${e} ${t ? JSON.stringify(t) : ""}\n`),
+		warn: (e, t) => process.stderr.write(`[broadcast] ${e} ${t ? JSON.stringify(t) : ""}\n`),
+		debug: () => {}
+	}, An, jn = await vt(b, u, m, En, kn, (e, t) => {
+		An?.refreshAll(`broadcast gap: missed ${t} change(s) from ${e}`);
+	}), R = u?.apiKeys, Mn = (typeof R == "object" ? R.prefix : void 0) ?? "voltro_", z = R ? cr(b) : void 0, B = z ? _r({ flush: vr(z) }) : void 0;
+	B && Fr(() => B.shutdown());
+	let V = z ? gr(z, {
+		prefix: Mn,
+		...B ? { usage: B } : {}
+	}) : void 0, Nn = V ? [dr(V, { prefix: Mn })] : [], Pn = D([...u?.auth?.strategies ?? [], ...Nn], mi(u?.plugins ?? []), u?.auth?.anonymousTenantRequired ?? !1, u?.auth, () => Le), Fn = [...u?.restRoutes ?? [], ...V ? Qn(V, (typeof R == "object" ? R.managementPath : void 0) ?? "/v1/api-keys") : []], Un = qe(u?.idempotency, b), Gn = O.map((e) => e.services).filter((e) => e !== void 0), W = U.mergeAll(xt({
+		analyticsLayer: je.layer,
+		cacheService: ze,
+		kvService: _t,
+		...$e === void 0 ? {} : { semanticCache: $e },
+		pluginServices: Gn,
+		userLayers: u?.layers ?? []
+	}), ht(u?.http ?? {})), G = await at({
+		files: h,
+		store: b,
+		log: $,
+		seedPolicy: "report",
+		seedPattern: cn,
+		loadSeedFiles: Gt,
+		startupPattern: nn,
+		loadStartupFiles: a,
+		runStartups: i,
+		emailPattern: Be,
+		loadEmailFiles: T,
+		registerEmailTemplates: hi
+	});
+	(G.startupCount > 0 || G.emailCount > 0) && $.info("boot lifecycle", {
+		startups: G.startupCount,
+		emailTemplates: G.emailCount
+	}), G.startups !== void 0 && Fr(async () => {
+		await G.startups.stop();
+	});
+	let Jn = gt({
+		schedules: St({
+			schedules: g.schedules,
+			seeds: G.seeds,
+			store: b,
+			log: $.child("seeds")
+		}),
+		workflows: g.workflows ?? [],
+		log: $.child("workflow-schedules")
+	}), Yn = u?.scheduling ?? {}, Xn = Yn.trigger ?? "self", Zn = /* @__PURE__ */ new Set([
+		"postgres",
+		"mysql",
+		"mariadb",
+		"mssql"
+	]), K = Yn.coordination ?? (Zn.has(m) ? "advisoryLock" : "single"), q = K === "cluster" && Zn.has(m), er = q ? "cluster" : K === "advisoryLock" && Zn.has(m) ? "advisoryLock" : "single";
+	K === "cluster" && !q && $.warn("scheduling.coordination=cluster needs a sql-backed store except sqlite — falling back to single"), K === "advisoryLock" && !Zn.has(m) && $.warn("scheduling.coordination=advisoryLock needs a SQL store (the claim-row gate) — falling back to single");
+	let tr, nr = g.workflows.length > 0 || g.workflowWorkers.length > 0 || g.eventTriggers.length > 0 || (xe?.outgoing.length ?? 0) > 0 || q, rr;
+	if (nr) {
+		if (m === "mssql") {
+			let e = await dn(process.cwd());
+			e && $.warn(e);
+		}
+		let [{ WorkflowEngine: e }, { makeClusterCronLayer: t, workflowEngineLayer: n, resolveRunnerStorage: r, resolveFailoverTuning: i }] = await Promise.all([import("@effect/workflow"), import("@voltro/workflow/cluster")]), a = q ? Jn.filter((e) => (e.trigger ?? Xn) === "self").map((e) => t({
+			name: e.name,
+			cron: sr(e),
+			execute: async () => {
+				await tr?.fireFromCluster(e.name);
+			}
+		})) : [];
+		rr = m === "memory" ? e.layerMemory : await (async () => {
+			let e = await j(m), t = r({ sqliteFamily: e.id === "sqlite" || e.id === "turso" });
+			return $.info(`workflow engine: cluster-${t}, dialect=${e.id}` + (t === "memory" ? " — single-process durable replay, no cross-pod shard handoff" + (e.id !== "sqlite" && e.id !== "turso" ? " (VOLTRO_WORKFLOW_RUNNER_STORAGE=memory: SqlRunnerStorage/cluster_runners + GET_LOCK skipped)" : "") : "")), n({
+				sqlClientLayer: e.makeSqlLayer(w()),
+				runnerStorage: t,
+				dialectId: e.id,
+				...process.env.VOLTRO_WORKFLOW_RUNNER_PORT ? { runnerListenPort: Number(process.env.VOLTRO_WORKFLOW_RUNNER_PORT) } : {},
+				...i(),
+				...a.length > 0 ? { extraShardingLayers: a } : {}
+			});
+		})();
+	}
+	let J = ue(O, gn()), ir = h.filter((e) => /\.subscribe\.tsx?$/.test(e)), Y = ir.length > 0 ? await Ne(ir, $) : [], ar = h.filter((e) => /\.reaction\.tsx?$/.test(e)), or = ar.length > 0 ? await he(ar, $) : [], fr = h.filter((e) => on.test(e)), pr = fr.length > 0 ? await E(fr, $) : [], mr = h.filter((e) => /\.aggregate\.tsx?$/.test(e)), br = mr.length > 0 ? await p(mr, $) : [], Sr = ve();
+	if (br.length > 0 && m !== "memory") try {
+		Sr = lt((await j(m)).makeSqlLayer(w()));
+	} catch (e) {
+		$.warn("aggregate: SQL storage init failed — falling back to in-process", { err: String(e) });
+	}
+	let Cr = m === "memory" ? Wr : hr(b, `aggregate@${process.pid}`, $), wr = h.filter((e) => sn.test(e)), Tr = wr.length > 0 ? await ee(wr, $) : [], Er = h.filter((e) => an.test(e)), Dr = Er.length > 0 ? await Te(Er, $) : [], Or = h.filter((e) => rn.test(e)), kr = Or.length > 0 ? await Pt(Or, $) : [], Ar = [], Mr = [], Nr = h.filter((e) => Qt.test(e));
+	if (Nr.length > 0) {
+		let e = $.child("agent"), t = h.filter((e) => N.test(e));
+		t.length > 0 && await tn(t, e);
+		let n = await Yt(Nr, e);
+		for (let e of n.agents) for (let t of Je(e)) (t.kind === "action" ? Ar : Mr).push({
+			file: t.file,
+			descriptor: t.descriptor,
+			executor: t.executor
+		});
+		n.agents.length > 0 && e.info("synthesized agent routes", { agents: n.agents.map((e) => e.descriptor.name) });
+	}
+	s.mark("workflow");
+	let X = () => {
+		let e = Z.workflowWriteActions();
+		if (e === void 0) throw Error("workflow actions: this app registers no workflows");
+		return e;
+	}, Pr = Kn({
+		dialect: m,
+		...w()
+	}), Ir = m === "memory" ? void 0 : (await j(m)).makeSqlLayer(w()), Lr = async () => Et({
+		sqlLayer: Ir,
+		declared: y,
+		log: $
+	}), Rr = {
+		kind: "api",
+		meta: {
+			name: u?.name ?? "voltro-api",
+			voltroVersion: Tt,
+			port: re,
+			mode: "start",
+			store: m,
+			cdc: ie ? "on" : "off",
+			...Pr === void 0 ? {} : { databaseId: Pr }
+		},
+		rpc: pt(g, l),
+		workflows: nt(g, l),
+		migrations: Lr,
+		events: () => Z.eventsSnapshot(),
+		agentTools: () => Z.agentTools(),
+		invariantChecks: () => ({
+			mode: "serve",
+			accessGate: de,
+			config: u,
+			serverOnlyLeaks: g.serverOnlyLeaks,
+			migrations: Lr
+		}),
+		members: () => Z.membersSnapshot(),
+		inspectFireSchedule: async ({ name: e, trigger: t }) => {
+			if (!tr) throw Error("scheduler not started — this app registers no self-triggered schedules (all schedules are trigger:'external', or there are none).");
+			return { runId: await tr.fireNow(e, t) ?? null };
+		},
+		inspectBackfillSchedule: te({
+			getHandle: () => tr,
+			getSchedules: () => Jn
+		}),
+		...xe === void 0 ? {} : { webhooks: () => _({
+			store: b,
+			discoveredWebhooks: xe
+		}) },
+		plugins: () => ({
+			plugins: I.snapshot(),
+			capturedAt: Date.now()
+		}),
+		env: () => Bt(u?.name ?? xn(l), {
+			...u?.env !== void 0 && ii(u.env) ? { contract: u.env } : {},
+			plugins: u?.plugins ?? []
+		}),
+		dataCache: () => Ve({
+			stats: ot,
+			backendKind: it
+		}),
+		subscriptions: () => Ft(() => An),
+		inspectTables: () => fe(g.tables),
+		inspectRows: Ce({
+			store: b,
+			tables: g.tables,
+			mask: !0
+		}),
+		metrics: (e) => Z.rpcMetrics().snapshot(e),
+		cluster: () => k({
+			store: b,
+			dialect: m,
+			useClusterCron: q,
+			scheduleCoordChoice: K
+		}),
+		inspectSchedules: () => v({
+			schedules: Jn,
+			defaultTrigger: Xn,
+			coordination: er
+		}),
+		inspectScheduleRuns: (e) => Nt(b, e),
+		...d(b, {
+			controls: mt(g.workflows ?? []),
+			active: (g.workflows?.length ?? 0) > 0,
+			cancellation: () => Z.flowControlHealth()
+		}),
+		webhookActions: we(() => Z.webhooksService()),
+		inspectStartWorkflow: (e) => X().inspectStartWorkflow(e),
+		inspectCancelWorkflowRun: (e) => X().inspectCancelWorkflowRun(e),
+		inspectSuspendWorkflowRun: (e) => X().inspectSuspendWorkflowRun(e),
+		inspectResumeWorkflowRun: (e) => X().inspectResumeWorkflowRun(e),
+		inspectDiscardWorkflowRun: (e) => X().inspectDiscardWorkflowRun(e),
+		inspectRetryWorkflowRun: (e) => X().inspectRetryWorkflowRun(e),
+		inspectSignalWorkflowRun: (e) => X().inspectSignalWorkflowRun(e),
+		inspectUpdateWorkflowRun: (e) => X().inspectUpdateWorkflowRun(e),
+		inspectInferences: (e) => Ze({
+			store: b,
+			active: (g.workflows?.length ?? 0) > 0,
+			dispatcher: () => Z.inferenceHealth()
+		}, e.limit === void 0 ? {} : { limit: e.limit }),
+		...yt({
+			store: b,
+			cancelRun: async (e) => await Z.runCanceller()?.(e) ?? !1,
+			retryRun: async (e) => X().inspectRetryWorkflowRun({ runId: e }),
+			redriveRun: async (e) => Z.redriveWorkflowRun({ runId: e }),
+			log: $
+		}),
+		inspectRedriveWorkflowRun: (e) => Z.redriveWorkflowRun(e),
+		inspectResumeWorkflowRunFromStep: (e) => Z.resumeWorkflowRunFromStep(e)
+	}, Br = (process.env.VOLTRO_TENANT_ISOLATION ?? u?.tenancy?.isolation) === "namespace", Hr = Br && m !== "memory" ? await (async () => {
+		let e = await j(m);
+		return Ct({
+			tables: y,
+			sqlLayer: e.makeSqlLayer(w()),
+			dialect: m,
+			options: { retryFilter: e.retryFilter },
+			log: {
+				info: (e, t) => $.info(e, t),
+				error: (e, t, n) => $.error(e, t ?? {}, n)
+			}
+		});
+	})() : void 0, Ur = await ft({
+		input: u?.tenancy?.residency,
+		namespaceIsolationOn: Br,
+		makeStoreForUrl: (e, t) => C(u, void 0, Ut(w(), t)),
+		log: {
+			info: (e, t) => $.info(e, t),
+			warn: (e, t) => $.warn(e, t)
+		}
+	});
+	Ur !== void 0 && Fr(async () => {
+		await Ur.close();
+	});
+	let Z = await Ki({
+		bootTiming: s,
+		broadcastNamespace: En,
+		scheduling: (() => {
+			let e = pn;
+			return {
+				admissionDrainMs: e.admissionDrainMs,
+				inferenceTickMs: e.inferenceTickMs,
+				cancelSweepMs: e.cancelSweepMs,
+				stalenessSweepMs: e.stalenessSweepMs,
+				disarmWhenIdle: et({
+					changeScope: b.changeScope,
+					broadcastAttached: jn !== void 0
+				})
+			};
+		})(),
+		...u?.workflows?.staleness === void 0 ? {} : { workflowStaleness: u.workflows.staleness },
+		...u?.workflows?.suspendSignalHintMs === void 0 ? {} : { workflowSuspendSignalHintMs: u.workflows.suspendSignalHintMs },
+		workflowRecording: Mt(u?.workflows?.recording),
+		membership: {
+			...F,
+			instanceId: P
+		},
+		security: {
+			defaultDeny: A(u),
+			...be(u)
+		},
+		approvals: { defaultExpiryMs: Pe(u) },
+		...u?.plugins === void 0 ? {} : { plugins: u.plugins },
+		...Un ? { idempotency: Un } : {},
+		restRoutes: Fn,
+		appProcedures: de,
+		discovered: {
+			queries: [...g.queries, ...Mr],
+			mutations: g.mutations,
+			actions: [...g.actions, ...Ar],
+			streams: g.streams,
+			events: g.events,
+			workflows: g.workflows,
+			workflowWorkers: g.workflowWorkers,
+			eventTriggers: g.eventTriggers,
+			schedules: Jn,
+			subscribers: Y,
+			outboxHandlers: pr,
+			connections: g.connections,
+			reactions: or,
+			aggregates: br,
+			expectations: Tr,
+			budgets: Dr,
+			experiments: kr,
+			...xe === void 0 ? {} : { webhooks: xe }
+		},
+		log: $,
+		analytics: je.sink,
+		aggregateStorage: Sr,
+		aggregateCoordinator: Cr,
+		store: b,
+		kv: dt,
+		cache: Ke,
+		snapshotCache: Ge,
+		...u?.reactive === void 0 ? {} : { reactive: u.reactive },
+		schemaRegistry: Fe,
+		tenantScopedTables: g.tenantScopedTables,
+		softDeleteScopedTables: g.softDeleteScopedTables,
+		dataTransferSnapshot: zn(y),
+		dataTransferDialect: m,
+		...Hr === void 0 ? {} : { ensureTenantProvisioned: Hr.ensure },
+		...Ur === void 0 ? {} : { resolveResidentStore: Ur.resolveStore },
+		tenantIsolation: (process.env.VOLTRO_TENANT_ISOLATION ?? u?.tenancy?.isolation) === "namespace" ? "namespace" : "shared-schema",
+		resolveSubject: (e, t) => Pn({
+			headers: e,
+			clientId: t
+		}),
+		...u?.auth === void 0 ? {} : { authority: u.auth },
+		...u?.agents === void 0 ? {} : { agents: u.agents },
+		httpRoutes: O.flatMap((e) => e.httpRoutes ?? []),
+		getStore: () => Le,
+		...W ? { baseLayer: W } : {},
+		...rr === void 0 ? {} : { workflowEngineLayer: rr },
+		scheduleDefaultTrigger: Xn,
+		scheduleCoordination: er,
+		scheduleArmSelf: !q,
+		dormancy: process.env.VOLTRO_DORMANCY === "sleep" || process.env.VOLTRO_DORMANCY === "always-on" ? process.env.VOLTRO_DORMANCY : u?.dormancy ?? "always-on",
+		scheduleReplicaId: process.env.HOSTNAME ?? `pid-${process.pid}`,
+		...J === void 0 ? {} : { scheduleFireInterceptor: J },
+		onSchedulerReady: (e) => {
+			tr = e;
+		},
+		inspectRoute: { handle: async (e, t, n, r) => await f(e, Rr, t, {
+			method: n,
+			...r === void 0 ? {} : { body: r }
+		}) || ((n === "GET" ? await un(e, Rr, t, { method: n }) : null) ?? ln(e, Rr, t, {
+			method: n,
+			...r === void 0 ? {} : { body: r }
+		}) ?? {
+			status: 404,
+			contentType: "application/json",
+			body: JSON.stringify({ error: "not an inspect route" })
+		}) },
+		...u?.name === void 0 ? {} : { appName: u.name },
+		observability: L,
+		port: re,
+		...u?.transport?.wsPath ? { path: u.transport.wsPath } : {}
+	});
+	return An = Z.dispatcher, jt(x([
+		g.queries,
+		g.mutations,
+		g.actions,
+		g.streams
+	]), (e) => {
+		$.warn(e);
+	}), $.info(`API listening on :${re}`, {
+		dialect: m,
+		queries: g.queries.length,
+		mutations: g.mutations.length,
+		actions: g.actions.length,
+		streams: g.streams.length,
+		workflows: g.workflows.length,
+		workflowWorkers: g.workflowWorkers.length,
+		schedules: Jn.length,
+		scheduleCoordination: er
+	}), s.finish($), Fr(async () => {
+		for (let e of bn) e.stop();
+		wt.stop();
+		try {
+			await Z.close(), st(), It?.dispose(), await I.deactivate(), await jn?.close(), await Se({
+				mirror: bt,
+				log: $
+			}), await je.dispose(), await b.close?.();
+		} catch (e) {
+			console.error("serve: shutdown step failed, exiting anyway:", e);
+		}
+	}), await new Promise(() => {}), 0;
+};
+//#endregion
+export { Yi as n, qi as r, Xi as t };