@voltro/cli 0.38.0 → 0.39.0

package/dist/serveCommand-B6TATyCj.js

@@ -0,0 +1,1770 @@
+import { t as e } from "./nodeEnvironment-cGFAj1J8.js";
+import { t } from "./frameworkInspectState-CX2250XB.js";
+import { r as n, t as r } from "./appModuleLoader-C9r9mxZt.js";
+import { t as i } from "./bootRefusal-pgvDxlrU.js";
+import { n as a, r as o } from "./startupRunner-CEqQq7ax.js";
+import { $ as s, $t as c, A as l, At as u, B as d, C as f, Ct as p, D as ee, Dt as te, E as ne, Et as m, F as re, Ft as h, G as g, Gt as ie, H as ae, I as oe, It as se, J as ce, Jt as _, K as le, Kt as v, L as ue, Lt as de, M as fe, Mt as y, N as pe, Nt as me, O as he, Ot as ge, P as _e, Pt as ve, Q as ye, Qt as be, R as xe, Rt as b, S as Se, Sn as Ce, St as we, T as Te, Tt as Ee, U as De, Ut as x, V as Oe, Vt as ke, W as Ae, Wt as je, X as Me, Xt as Ne, Y as Pe, Yt as Fe, Z as Ie, Zt as S, _ as Le, _n as Re, _t as C, an as ze, at as Be, b as Ve, bn as He, bt as Ue, c as We, cn as w, ct as Ge, dn as Ke, dt as qe, en as Je, et as Ye, f as Xe, fn as Ze, ft as Qe, g as $e, gn as et, gt as tt, h as nt, ht as rt, i as it, in as at, it as ot, j as st, jt as ct, k as lt, kt as ut, ln as T, lt as dt, m as ft, mn as pt, mt as E, nn as D, nt as mt, o as O, on as ht, ot as gt, p as _t, pn as vt, pt as yt, q as bt, qt as xt, r as St, rn as Ct, rt as wt, sn as Tt, st as Et, t as Dt, tn as Ot, tt as kt, u as At, un as jt, ut as Mt, v as Nt, vn as k, vt as A, w as j, wt as Pt, x as Ft, xn as It, xt as Lt, y as Rt, yn as zt, yt as Bt, zt as Vt } from "./dev-gqpnzVhI.js";
+import { n as Ht } from "./cliArgs-D4p8n7EE.js";
+import { r as Ut } from "./appPort-B_HpJ_ck.js";
+import { at as Wt, st as M } from "./webDev-CTpSY-e_.js";
+import { r as N } from "./dialectDriver-czCHYpeH.js";
+import { i as Gt, n as Kt } from "./connectionConfig-Bk9IC7D0.js";
+import { c as qt, n as Jt, o as Yt } from "./seedRunner-IdHEprqf.js";
+import { C as P, S as Xt, _ as Zt, d as Qt, g as $t, l as en, m as tn, r as nn, u as rn, v as an } from "./frameworkTableAssembly-oMPBKqlE.js";
+import { S as on, c as sn, n as cn, p as ln, s as un, x as dn } from "./fileConventions-Cof68_BL.js";
+import { h as fn, o as pn } from "./inspect-B7U7Cl_Z.js";
+import { n as mn } from "./mssqlClusterPatch-_4cE_nun.js";
+import { i as hn, n as gn, r as _n, t as vn } from "./webhookDiscovery-CphsQe59.js";
+import { t as yn } from "./inspectMetrics-CfdKLh6t.js";
+import { r as bn, u as xn } from "./apiBuild-DGalUk9v.js";
+import { t as Sn } from "./bootTiming-BdyP9nYw.js";
+import { t as Cn } from "./dataProfile-dW-PsfLB.js";
+import { basename as wn, join as Tn } from "node:path";
+import { existsSync as En } from "node:fs";
+import { pathToFileURL as Dn } from "node:url";
+import { createLogger as F } from "@voltro/logger";
+import { AuthMiddleware as On, ConnectionInfoMiddleware as kn, actionToRpc as I, anonymousSubject as An, isWireReachable as jn, mutationToRpc as L, queryToRpc as R, streamToRpc as Mn, workflowCancelDescriptor as Nn, workflowDomainEventsQueryDescriptor as Pn, workflowEventDeliveriesQueryDescriptor as z, workflowResumeDescriptor as Fn, workflowRunEventsQueryDescriptor as B, workflowRunQueryDescriptor as V, workflowRunStepsQueryDescriptor as H, workflowRunsQueryDescriptor as In, workflowSignalDescriptor as Ln, workflowUpdateDescriptor as Rn } from "@voltro/protocol";
+import { Cause as zn, Effect as U, Layer as W, ManagedRuntime as Bn } from "effect";
+import { SqlClient as Vn } from "@effect/sql";
+import { declaredSnapshot as Hn, describeOutcome as Un, pendingFileMigrationIds as Wn, runPlannedMigrations as Gn } from "@voltro/database/sql";
+import { RpcGroup as Kn } from "@effect/rpc";
+import { allRegisteredTables as qn, and as Jn, connectionIdentity as Yn, ensureTableRegistered as Xn, eq as G, or as K } from "@voltro/database";
+import { AggregateRegistry as Zn, CostRegistry as Qn, DORMANCY_WAKEUP_TENANT as $n, Dispatcher as er, ExpectationRegistry as tr, ExperimentRegistry as q, apiKeyManagementRoutes as nr, attachAnalyticsMirror as rr, attachExpectations as ir, attachExperiments as ar, attachFinops as or, awaitServerListening as sr, bindMutation as J, bindStream as cr, bindSubscription as Y, buildTracingLayer as lr, cancelWakeup as ur, compileCron as dr, dataStoreApiKeyStore as fr, formatServerOnlyLeaks as pr, formatUnresolvedSources as mr, frameworkApiKeyStrategy as hr, getResourcePolicy as gr, installPolicyGuardResolver as _r, loadResourceTuples as vr, makeActionRunner as yr, makeAdvisoryLockCoordinator as br, makeApiKeyService as xr, makeApiKeyUsageBuffer as Sr, makeApiKeyUsageFlusher as Cr, makeAsyncKv as wr, makeAuthMiddlewareLayers as Tr, makeCoordinatedScheduler as Er, makeEffectStoreLayer as Dr, makeLazyWorkflowFacade as Or, makeMutationOutputCodec as kr, makeMutationRunner as Ar, makeOneShotQueryRunner as jr, makeQueryDescriptorProducer as Mr, makeQueryFinalizer as Nr, makeQueryReauthorizer as Pr, makeQuerySubscriber as Fr, makeSchemaRegistry as Ir, makeWorkflowFacade as Lr, makeWorkflowFacadeWithCallerContext as Rr, makeWorkflowLayers as X, noopKv as zr, onProcessShutdown as Br, recordSubscriptionDelivery as Vr, recordWorkflowRun as Hr, registerWakeup as Ur, resolveSecretsBackend as Wr, runProvidedEffect as Gr, setSecretsBackend as Kr, setSystemStoreHandle as qr, setTupleSource as Jr, shutdownGraceMsFromEnv as Z, singleCoordinator as Yr, startRpcServer as Xr, startScheduler as Zr, stripForbiddenForWire as Qr, undoCaptureEnabled as $r, unresolvedSources as ei, withScopedRequest as ti, workflowToRpc as ni, wrapStoreWithBootCodec as ri } from "@voltro/runtime";
+import { appStorageProvider as ii, fromNodeReadable as ai, getObjectStream as oi, putObjectStream as si, toNodeReadable as ci } from "@voltro/plugin-storage";
+import { isEnvContract as li } from "@voltro/env";
+import { assertProductionSessionSecret as ui } from "@voltro/protocol/session";
+import { createHash as di, timingSafeEqual as fi } from "node:crypto";
+import { buildDeliverWebhookExecute as pi, buildWebhooksService as mi, defaultIncomingPath as hi, deliverWebhookWorkflow as gi, makeDeferredEmitHandler as _i, mountIncomingWebhook as vi } from "@voltro/plugin-webhooks";
+import { getAuthSessionStrategy as yi } from "@voltro/plugin-auth";
+import { registerEmailTemplates as bi } from "@voltro/plugin-mail";
+import { channelFor as xi, getBroadcastPlugin as Si } from "@voltro/plugin-broadcast";
+import { packBundle as Ci, runExport as wi, runImport as Ti, storageBlobSink as Ei, storageRefsBlobSource as Di, unpackBundle as Oi, unpackBundleToDir as ki } from "@voltro/data-transfer";
+//#region src/serveDrain.ts
+var Ai = () => Math.max(500, Math.floor(Z() * .6)), ji = (e) => new Promise((t) => setTimeout(t, e)), Mi = (e) => {
+	let t = /* @__PURE__ */ new Set(), n = /* @__PURE__ */ new Set(), r = 0;
+	e.on("connection", (e) => {
+		t.add(e), e.once("close", () => {
+			t.delete(e), n.delete(e);
+		});
+	}), e.on("upgrade", (e, t) => {
+		n.add(t);
+	}), e.on("request", (e, t) => {
+		r += 1, t.once("close", () => {
+			--r;
+		});
+	});
+	let i, a = async (t = {}) => {
+		let n = t.budgetMs ?? Ai();
+		i ??= new Promise((t) => {
+			e.close(() => {
+				t();
+			});
+		}), e.closeIdleConnections();
+		let a = Date.now() + n;
+		for (; r > 0 && Date.now() < a;) await ji(25), e.closeIdleConnections();
+		e.closeIdleConnections();
+	}, o = async () => {
+		i ??= new Promise((t) => {
+			e.close(() => {
+				t();
+			});
+		});
+		for (let e of t) if (n.has(e)) try {
+			e.write(Buffer.from([
+				136,
+				2,
+				3,
+				233
+			]));
+		} catch {}
+		else e.destroy();
+		for (let e = 0; t.size > 0 && e < 250; e += 25) await ji(25);
+		for (let e of t) e.destroy();
+		await i;
+	};
+	return {
+		activeRequests: () => r,
+		drainRequests: a,
+		finish: o,
+		drain: async (e = {}) => {
+			await a(e), await o();
+		}
+	};
+}, Ni = "/_voltro/admin/import", Pi = "/_voltro/admin/export", Q = (e, t) => ({
+	status: e,
+	contentType: "application/json; charset=utf-8",
+	body: JSON.stringify(t)
+}), Fi = (e) => {
+	let t = e.authorization ?? e.Authorization, n = t ? /^Bearer\s+(.+)$/i.exec(t) : null;
+	return n ? n[1] : null;
+}, Ii = (e, t) => fi(di("sha256").update(e).digest(), di("sha256").update(t).digest()), Li = (e, t) => {
+	if (e.method.toUpperCase() !== "POST") return Q(405, { error: "method not allowed" });
+	if (!t || t.length < 16) return Q(503, { error: "data transfer misconfigured (no/weak secret)" });
+	let n = Fi(e.headers);
+	return !n || !Ii(n, t) ? Q(401, { error: "unauthorized" }) : null;
+}, Ri = F({ scope: "voltro:admin-import" }), zi = "VBUNDLE2", Bi = async function* (e) {
+	yield e;
+}, Vi = (e) => async (t) => {
+	let n = Li(t, e.secret);
+	if (n) return n;
+	let r = t.headers["x-import-mode"], i = t.headers["x-import-on-conflict"], a = t.headers["x-import-atomic"] === "1" || t.headers["x-import-atomic"] === "true", o = t.headers["x-import-force"] === "1" || t.headers["x-import-force"] === "true", s = t.rawBody.byteLength >= 8 && Buffer.from(t.rawBody.subarray(0, 8)).toString("latin1") === zi, c, l;
+	if (s) c = Bi(t.rawBody), l = "upload";
+	else {
+		let n;
+		try {
+			n = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
+		} catch {
+			return Q(400, { error: "body must be a packed bundle archive or { bundleKey } JSON" });
+		}
+		if (typeof n.bundleKey != "string" || !n.bundleKey) return Q(400, { error: "body.bundleKey (string) is required for the storage transport" });
+		if (!e.openArchive) return Q(501, { error: "storage transport not configured on this instance" });
+		c = e.openArchive(n.bundleKey), l = "storage";
+	}
+	let u = await import("node:os"), d = await import("node:fs/promises"), f = await import("node:path"), p = await d.mkdtemp(f.join(u.tmpdir(), "voltro-admin-import-"));
+	try {
+		e.assetSink ? await Oi(c, {
+			dir: p,
+			blobs: e.assetSink
+		}) : await ki(c, p);
+		let t = await U.runPromiseExit(Ti({
+			store: e.store,
+			bundleDir: p,
+			...r ? { mode: r } : {},
+			...i ? { onConflict: i } : {},
+			...a ? { atomic: a } : {},
+			...e.snapshot ? { targetSnapshot: e.snapshot } : {},
+			force: o,
+			onWarn: (e) => Ri.warn("admin.import", { message: e }),
+			...e.assetSink ? { assetsAlreadyRestored: !0 } : {}
+		}));
+		if (t._tag === "Failure") {
+			let e = t.cause._tag === "Fail" ? t.cause.error : void 0;
+			if (e && e._tag === "SchemaDriftError") {
+				let t = e;
+				return Ri.warn("admin.import refused (schema drift)", {
+					transport: l,
+					bundle: t.bundleFingerprint.slice(0, 16),
+					target: t.targetFingerprint.slice(0, 16)
+				}), Q(409, {
+					error: "schema drift",
+					bundleFingerprint: t.bundleFingerprint,
+					targetFingerprint: t.targetFingerprint,
+					diff: t.diff,
+					hint: "re-export against the current schema, or resend with x-import-force: 1"
+				});
+			}
+			throw Error(String(e?.message ?? e ?? "import failed"));
+		}
+		let n = t.value, s = n.tables.reduce((e, t) => e + t.rowCount, 0);
+		return Ri.info("admin.import", {
+			transport: l,
+			tables: n.tables.length,
+			rows: s,
+			mode: r ?? "upsert",
+			atomic: a
+		}), Q(200, {
+			tables: n.tables.length,
+			rows: s,
+			transport: l
+		});
+	} catch (e) {
+		return Ri.warn("admin.import failed", {
+			transport: l,
+			error: e?.message ?? String(e)
+		}), Q(500, {
+			error: "import failed",
+			message: e?.message ?? String(e)
+		});
+	} finally {
+		await d.rm(p, {
+			recursive: !0,
+			force: !0
+		});
+	}
+}, Hi = F({ scope: "voltro:admin-export" }), Ui = async (e) => {
+	let t = [];
+	for await (let n of e) t.push(Buffer.from(n));
+	return new Uint8Array(Buffer.concat(t));
+}, Wi = (e) => typeof e.tenant == "string" && e.tenant ? {
+	kind: "tenant",
+	tenantId: e.tenant
+} : Array.isArray(e.tables) && e.tables.length ? {
+	kind: "tables",
+	tables: e.tables.filter((e) => typeof e == "string")
+} : { kind: "all" }, Gi = (e) => async (t) => {
+	let n = Li(t, e.secret);
+	if (n) return n;
+	let r;
+	try {
+		r = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
+	} catch {
+		return Q(400, { error: "body must be JSON: { profile?, tenant?, tables?, consistency?, compression?, bundleKey? }" });
+	}
+	let i = {};
+	if (typeof r.profile == "string" && r.profile) {
+		if (!e.loadProfile) return Q(501, { error: "server-side profiles not configured on this instance" });
+		try {
+			i = await e.loadProfile(r.profile);
+		} catch (e) {
+			return Q(400, {
+				error: `profile '${r.profile}' could not be loaded`,
+				message: e?.message ?? String(e)
+			});
+		}
+	}
+	let a = r.consistency === "snapshot" ? "snapshot" : i.consistency ?? "live", o = (typeof r.compression == "string" ? r.compression : void 0) ?? i.compression, s = i.scope ?? Wi(r), c = typeof r.bundleKey == "string" && r.bundleKey.length > 0, l = r.assets === !0 && e.assetSource ? { blobs: e.assetSource } : {}, u = await import("node:os"), d = await import("node:fs/promises"), f = await import("node:path"), p = await d.mkdtemp(f.join(u.tmpdir(), "voltro-admin-export-"));
+	try {
+		let t = await U.runPromise(wi({
+			store: e.store,
+			snapshot: e.snapshot,
+			dialect: e.dialect,
+			outDir: p,
+			...i.subset ? { subset: i.subset } : {
+				scope: s,
+				...e.tenantTables && e.tenantTables.length > 0 ? { tenantTables: e.tenantTables } : {}
+			},
+			consistency: a,
+			...o ? { compression: o } : {},
+			...i.masking ? { masking: i.masking } : {}
+		})), n = t.tables.reduce((e, t) => e + t.rowCount, 0), u = t.masking?.transformed.length ?? 0;
+		if (c) {
+			if (!e.putArchive) return Q(501, { error: "storage transport not configured on this instance" });
+			let i = r.bundleKey;
+			return await e.putArchive(i, () => Ci({
+				dir: p,
+				...l
+			})), Hi.info("admin.export", {
+				transport: "storage",
+				tables: t.tables.length,
+				rows: n,
+				masked: u,
+				bundleKey: i
+			}), Q(200, {
+				bundleKey: i,
+				tables: t.tables.length,
+				rows: n,
+				masked: u,
+				transport: "storage"
+			});
+		}
+		let d = await Ui(Ci({
+			dir: p,
+			...l
+		}));
+		return Hi.info("admin.export", {
+			transport: "download",
+			tables: t.tables.length,
+			rows: n,
+			masked: u,
+			bytes: d.byteLength
+		}), {
+			status: 200,
+			contentType: "application/octet-stream",
+			body: d,
+			headers: {
+				"x-export-tables": String(t.tables.length),
+				"x-export-rows": String(n),
+				"x-export-masked": String(u)
+			}
+		};
+	} catch (e) {
+		return Hi.warn("admin.export failed", { error: e?.message ?? String(e) }), Q(500, {
+			error: "export failed",
+			message: e?.message ?? String(e)
+		});
+	} finally {
+		await d.rm(p, {
+			recursive: !0,
+			force: !0
+		});
+	}
+}, Ki = (e, t, n = {}) => (async function* () {
+	let r = await U.runPromise(oi(e, t).pipe(U.timeout(n.openTimeout ?? "30 seconds"))), i = await ci(r.stream), a = n.stallMs ?? 12e4, o, s = () => {
+		o && clearTimeout(o), o = setTimeout(() => i.destroy(/* @__PURE__ */ Error(`storage read stalled for ${a}ms reading '${t}'`)), a);
+	};
+	try {
+		s();
+		for await (let e of i) s(), yield e instanceof Uint8Array ? e : new Uint8Array(e);
+	} finally {
+		o && clearTimeout(o), i.destroy();
+	}
+})(), qi = {
+	get: async () => void 0,
+	set: async () => {},
+	setWithTags: async () => {},
+	remove: async () => !1,
+	has: async () => !1,
+	clear: async () => {},
+	invalidateTag: async () => 0,
+	wrap: async (e, t, n) => n()
+}, Ji = async (e) => {
+	Vt(e.appProcedures ?? e.discovered, {
+		defaultDeny: e.security?.defaultDeny ?? !0,
+		commandHint: "`voltro serve`"
+	}), qr({
+		dataStore: e.store,
+		schemaRegistry: e.schemaRegistry
+	});
+	let t = (e.discovered.budgets?.length ?? 0) > 0, n, r = new er({
+		store: e.store,
+		...e.snapshotCache ? { cache: e.snapshotCache } : {},
+		...e.reactive === void 0 ? {} : { reactive: e.reactive },
+		...t ? { recordCost: (e) => n?.record(e) } : {},
+		recordDelivery: (e) => Vr({
+			label: e.label,
+			kind: e.kind,
+			durationMs: e.durationMs,
+			rowCount: e.rowCount
+		})
+	}), i = e.cache ?? qi, a = e.kv ?? zr, o, c = () => void 0, l, f, p, ee, te, ne, se, ce = ie({
+		store: e.store,
+		warn: (e, t) => {
+			process.stderr.write(`[workflow] ${e} ${JSON.stringify(t)}\n`);
+		}
+	}), le = ce.remember, ue = ce.resolve, de = v({
+		authority: e.authority,
+		getStore: () => e.store
+	}), y = (e.discovered.workflows?.length ?? 0) > 0 ? Or(() => o) : void 0, me = (e.discovered.workflows?.length ?? 0) > 0 || (e.discovered.eventTriggers?.length ?? 0) > 0, he = me || (e.discovered.workflowWorkers?.length ?? 0) > 0 || e.scheduleCoordination === "cluster", ge = e.tenantIsolation === "namespace", _e = (e.log ?? F({ scope: "voltro:serve" })).child("webhooks"), be, xe, b = e.discovered.webhooks;
+	if (b && b.outgoing.length > 0 && e.workflowEngineLayer !== void 0) {
+		e.workflowEngineLayer;
+		let t = w({
+			store: e.store,
+			schemaRegistry: e.schemaRegistry,
+			cache: i,
+			kv: a
+		}), n = b.outgoing.map((e) => e.descriptor);
+		xe = gi.toLayer(pi(t, { events: n })), be = mi(t, async (e) => {
+			let t = p;
+			if (t === void 0) {
+				_e.error("webhook delivery skipped — the workflow runtime was never built. This is a framework defect, not a configuration problem: report it with your engine setting. Deliveries are NOT queued and will not be retried.", {
+					deliveryId: e.deliveryId,
+					targetId: e.targetId
+				});
+				return;
+			}
+			t.runPromise(gi.execute(e)).catch((t) => {
+				_e.error("deliverWebhook workflow crashed", {
+					deliveryId: e.deliveryId,
+					targetId: e.targetId
+				}, t);
+			});
+		}, { events: n });
+	}
+	let Se = /* @__PURE__ */ new Map();
+	if (b) for (let e of b.incoming) {
+		let t = e.descriptor.path ?? hi(e.descriptor.id), n = `VOLTRO_WEBHOOK_SECRET_${e.descriptor.id.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`, r = vi(e.descriptor, {
+			resolveSecret: async () => process.env[n] ?? null,
+			resolveWorkflows: () => y === void 0 ? void 0 : Rr(y, {
+				traceId: `incoming:${e.descriptor.id}`,
+				source: `incoming:${e.descriptor.id}`
+			}),
+			log: (e) => {
+				let t = {
+					webhookId: e.webhookId,
+					status: e.status,
+					signatureOk: String(e.signatureOk),
+					idempotency: e.idempotency,
+					durationMs: e.durationMs
+				};
+				e.status >= 500 ? _e.error("incoming delivery failed", t) : e.status >= 400 ? _e.warn("incoming delivery rejected", t) : _e.info("incoming delivery handled", t);
+			}
+		});
+		Se.set(t, { handle: r });
+	}
+	_r(), Jr((t) => vr(e.store, t.subjectId, t.resourceType, t.resourceId));
+	let Ce = [], we = [...e.discovered.outboxHandlers ?? [], ...gn((b?.outgoing.length ?? 0) + (b?.incoming.length ?? 0) + (b?.providers.length ?? 0), []) ? [{
+		file: "<framework>/webhooks",
+		id: "voltro-webhook-emit",
+		definition: _i(() => be)
+	}] : []], Te = we.length > 0 ? Ne({
+		handlers: we,
+		store: e.store,
+		log: (e.log ?? F({ scope: "voltro:serve" })).child("outbox"),
+		onChange: (t) => e.store.onChange((e) => t({
+			table: e.table,
+			op: e.op
+		})),
+		onShutdown: (e) => {
+			Ce.push(e);
+		}
+	}) : void 0, x = _({
+		definitions: (e.discovered.connections ?? []).map((e) => e.definition),
+		store: e.store,
+		publicUrl: xt(e.port ?? 4e3),
+		log: (e.log ?? F({ scope: "voltro:serve" })).child("connections")
+	});
+	st({
+		events: e.discovered.events ?? [],
+		rpcTags: [
+			...e.discovered.queries.map((e) => e.descriptor.name),
+			...e.discovered.mutations.map((e) => e.descriptor.name),
+			...e.discovered.actions.map((e) => e.descriptor.name),
+			...(e.discovered.streams ?? []).map((e) => e.descriptor.name)
+		]
+	});
+	let ke = (e.log ?? F({ scope: "voltro:serve" })).child("events"), je = e.broadcastNamespace ?? $e(e.plugins, void 0), Pe = Le(e.plugins, je, ke), Fe = e.membership?.instanceId ?? process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, Re = e.membership ?? Nt(e.plugins, {
+		instanceId: Fe,
+		namespace: je,
+		meta: { mode: "serve" },
+		logger: ke
+	}), C = fe({
+		events: e.discovered.events ?? [],
+		origin: Fe,
+		...Pe.publishRemote === void 0 ? {} : { publishRemote: Pe.publishRemote }
+	}), ze = (e.discovered.events ?? []).length > 0 ? await Pe.attach(C.bus) : null, Be = Tt({
+		store: e.store,
+		schemaRegistry: e.schemaRegistry,
+		cache: i,
+		kv: a,
+		...be === void 0 ? {} : { webhooksService: be },
+		...y === void 0 ? {} : { workflowsProxy: y },
+		eventTriggers: e.discovered.eventTriggers ?? [],
+		namespaceIsolationOn: ge,
+		...e.ensureTenantProvisioned === void 0 ? {} : { ensureTenantProvisioned: e.ensureTenantProvisioned },
+		...e.resolveResidentStore === void 0 ? {} : { resolveResidentStore: e.resolveResidentStore },
+		...Te === void 0 ? {} : { outbox: { nudge: Te.nudge } },
+		...x.active ? { connections: { registry: x.registry } } : {},
+		eventBus: C.bus
+	}), Ve = W.succeed(Zn, m), He = W.succeed(tr, Ue), We = W.succeed(Qn, Bt), Ke = W.succeed(q, Lt), Je = (t, n) => {
+		let r = t.pipe(U.provide(Dr(n)));
+		return (e.baseLayer ? r.pipe(U.provide(e.baseLayer)) : r).pipe(U.provide(Ve)).pipe(U.provide(He)).pipe(U.provide(We)).pipe(U.provide(Ke));
+	}, Ye = (e, t) => {
+		let n = Je(e, t);
+		return Gr(n);
+	}, Xe = yn(), Ze = bt(e.plugins ?? [], Xe), Qe = d({
+		plugins: e.plugins ?? [],
+		metrics: Xe,
+		log: e.log ?? F({ scope: "voltro:serve" })
+	}), et = g(e.plugins ?? [], Xe), tt = e.security?.defaultDeny ?? !0, nt = Ar({
+		store: e.store,
+		defaultDeny: tt,
+		recordMetric: (e) => {
+			Xe.record(e);
+		},
+		...Ze.mutation === void 0 ? {} : { interceptor: Ze.mutation },
+		buildContext: (e, t, n) => Be(e, t, n),
+		runEffect: Ye,
+		undoCapture: ye()
+	}), it = Ie();
+	{
+		let t = s();
+		t !== void 0 && (e.log ?? F({ scope: "voltro:serve" })).info(t);
+	}
+	let at = Me({
+		store: e.store,
+		...e.approvals === void 0 ? {} : { defaultExpiryMs: e.approvals.defaultExpiryMs }
+	}), ot = yr({
+		defaultDeny: tt,
+		buildContext: (e) => Be(e),
+		runEffect: Ye,
+		recordMetric: (e) => {
+			Xe.record(e);
+		},
+		...Ze.action === void 0 ? {} : { interceptor: Ze.action }
+	}), lt = Nr({
+		tenantScopedTables: e.tenantScopedTables,
+		softDeleteScopedTables: e.softDeleteScopedTables
+	}), ut = {
+		defaultDeny: tt,
+		buildContext: (e) => Be(e),
+		finalize: (e, t) => lt(e, t.subject),
+		provideEffect: Je,
+		...Ze.query === void 0 ? {} : { interceptor: Ze.query }
+	}, T = Mr(ut), ft = jr({
+		...ut,
+		queryRows: (t, n) => e.store.query(t).then((e) => Qr(t.table, e, n.subject))
+	}), pt = Fr({
+		...ut,
+		subscribeDescriptor: (e, t, n) => r.subscribe(e, t, n),
+		subscribeComputed: (e, t, n) => r.subscribeComputed(e, t, n)
+	}), E = (e) => e.filter((e) => jn(e.descriptor)), D = {};
+	for (let t of [
+		...E(e.discovered.queries),
+		...it.queries,
+		...at.queries,
+		...x.queries
+	]) D[t.descriptor.name] = (e) => Y(T(t, e), r, `subscription.${t.descriptor.name}`, void 0, void 0, Pr(t, e));
+	for (let t of [
+		...E(e.discovered.mutations),
+		...it.mutations,
+		...at.mutations,
+		...x.mutations
+	]) {
+		let n = kr(t.descriptor.output);
+		D[t.descriptor.name] = (r) => J(async (e, n) => nt(t, e, n), r, `mutation.${t.descriptor.name}`, n, e.idempotency, t.descriptor.error);
+	}
+	for (let t of [...E(e.discovered.actions), ...x.actions]) {
+		let n = kr(t.descriptor.output);
+		D[t.descriptor.name] = (r) => J(async (e, n) => ot(t, e, n), r, `action.${t.descriptor.name}`, n, e.idempotency, t.descriptor.error);
+	}
+	let mt = () => `public-${Math.random().toString(36).slice(2, 10)}`, O = [
+		...e.discovered.queries.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => ft(e, t, {
+				subject: n.subject,
+				traceId: mt()
+			}),
+			subscribe: (t, n, r) => pt(e, t, {
+				subject: n.subject,
+				traceId: mt()
+			}, r)
+		})),
+		...e.discovered.mutations.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => nt(e, t, {
+				subject: n.subject,
+				traceId: mt()
+			})
+		})),
+		...e.discovered.actions.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => ot(e, t, {
+				subject: n.subject,
+				traceId: mt()
+			})
+		}))
+	], gt = {
+		candidates: h({
+			queries: e.discovered.queries,
+			mutations: e.discovered.mutations,
+			actions: e.discovered.actions,
+			descriptorOf: (e) => e.descriptor,
+			runQuery: (e, t, n) => Promise.resolve(ft(e, t, n)),
+			runMutation: (e, t, n) => Promise.resolve(nt(e, t, n)),
+			runAction: (e, t, n) => Promise.resolve(ot(e, t, n))
+		}),
+		policy: e.agents?.tools ?? {},
+		mcpEnabled: e.agents?.mcp === !0,
+		resolveSubject: (t) => e.resolveSubject(t, -1).then((e) => e.subject)
+	}, _t = Ot({
+		...e.restRoutes === void 0 ? {} : { restRoutes: e.restRoutes },
+		publicApiEntries: O,
+		store: e.store,
+		resolveSubject: (t) => e.resolveSubject(t, -1).then((e) => e.subject),
+		...e.idempotency === void 0 ? {} : { idempotency: e.idempotency },
+		log: e.log ?? F({ scope: "voltro:serve" })
+	}), vt = e.dataTransferSecret ?? process.env.VOLTRO_DATA_TRANSFER_SECRET, yt = vt && vt.length >= 16 ? [{
+		method: "POST",
+		path: Ni,
+		handle: Vi({
+			secret: vt,
+			store: e.store,
+			...e.dataTransferSnapshot ? { snapshot: e.dataTransferSnapshot } : {},
+			assetSink: Ei(ii()),
+			openArchive: (e) => Ki(ii(), e)
+		})
+	}, {
+		method: "POST",
+		path: Pi,
+		handle: Gi({
+			secret: vt,
+			store: e.store,
+			snapshot: e.dataTransferSnapshot ?? { tables: [] },
+			dialect: e.dataTransferDialect ?? "memory",
+			tenantTables: [...e.tenantScopedTables],
+			loadProfile: Cn,
+			assetSource: Di(ii(), e.store),
+			putArchive: async (e, t) => {
+				let { Readable: n } = await import("node:stream"), r = ii(), i = ai("storage", () => n.from(t()));
+				await U.runPromise(si(r, e, i, { contentType: "application/octet-stream" }));
+			}
+		})
+	}] : [], St = [
+		...e.httpRoutes ?? [],
+		..._t.httpRoutes,
+		...yt,
+		...x.httpRoutes
+	];
+	Object.assign(D, C.handlers);
+	for (let t of E(e.discovered.streams ?? [])) D[t.descriptor.name] = (n) => cr((r) => ti(r, (r) => {
+		let i = Be(r), a = t.executor(n, i);
+		if (U.isEffect(a)) {
+			let t = a.pipe(U.provide(Dr(i.store)));
+			return (e.baseLayer ? t.pipe(U.provide(e.baseLayer)) : t).pipe(U.provide(Ve)).pipe(U.provide(He)).pipe(U.provide(We)).pipe(U.provide(Ke));
+		}
+		return typeof a == "object" && a && typeof a.then == "function" ? U.promise(() => a) : a;
+	}), `stream.${t.descriptor.name}`);
+	for (let t of e.discovered.workflows ?? []) D[t.definition.name] = (e) => J(async (e, n) => {
+		let r = n;
+		return Rr(y, {
+			subject: r.subject,
+			traceId: r.traceId,
+			source: "workflow-rpc"
+		}).start(t.definition.name, e);
+	}, e, `workflow.${t.definition.name}`);
+	me && (D[V.name] = (e) => Y(T({
+		descriptor: V,
+		executor: (e) => {
+			let t = e.id;
+			return {
+				table: "_voltro_workflow_runs",
+				order: [{
+					column: "startedAt",
+					direction: "desc"
+				}],
+				predicate: K(G("id", t), G("executionId", t)),
+				take: 1,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${V.name}`), D[In.name] = (e) => Y(T({
+		descriptor: In,
+		executor: (e) => {
+			let t = e, n = [...t.tag === void 0 ? [] : [G("tag", t.tag)], ...t.status === void 0 ? [] : [G("status", t.status)]], r = Number.isFinite(t.limit) && t.limit !== void 0 ? Math.min(Math.max(Math.floor(t.limit), 1), 500) : 100;
+			return {
+				table: "_voltro_workflow_runs",
+				order: [{
+					column: "startedAt",
+					direction: "desc"
+				}],
+				predicate: n.length === 0 ? void 0 : n.length === 1 ? n[0] : Jn(...n),
+				take: r,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${In.name}`), D[H.name] = (e) => Y(T({
+		descriptor: H,
+		executor: (e) => {
+			let t = e.runId;
+			return {
+				table: "_voltro_workflow_run_steps",
+				order: [{
+					column: "startedAt",
+					direction: "asc"
+				}],
+				predicate: G("runId", t),
+				take: 1e3,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${H.name}`), D[B.name] = (e) => Y(T({
+		descriptor: B,
+		executor: (e) => {
+			let t = e.runId;
+			return {
+				table: "_voltro_workflow_run_events",
+				order: [{
+					column: "occurredAt",
+					direction: "asc"
+				}],
+				predicate: G("runId", t),
+				take: 1e3,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${B.name}`), D[Pn.name] = (e) => Y(T({
+		descriptor: Pn,
+		executor: (e) => {
+			let t = e;
+			return {
+				table: "_voltro_workflow_events",
+				order: [{
+					column: "occurredAt",
+					direction: "desc"
+				}],
+				predicate: t.name === void 0 ? void 0 : G("name", t.name),
+				take: Math.max(1, Math.min(500, t.limit ?? 100)),
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${Pn.name}`), D[z.name] = (e) => Y(T({
+		descriptor: z,
+		executor: (e) => {
+			let t = e.eventId;
+			return {
+				table: "_voltro_workflow_event_deliveries",
+				order: [{
+					column: "createdAt",
+					direction: "asc"
+				}],
+				predicate: G("eventId", t),
+				take: 500,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${z.name}`), D[Nn.name] = (t) => J(async (t, n) => {
+		let r = t;
+		return await ht(e.store, n.subject, { executionId: r.executionId }), await y.cancel(r.workflowName, r.executionId), await Ft(r.workflowName, r.executionId, "workflow.cancel"), { ok: !0 };
+	}, t, `action.${Nn.name}`), D[Fn.name] = (t) => J(async (t, n) => {
+		let r = t;
+		return await ht(e.store, n.subject, { executionId: r.executionId }), await y.resume(r.workflowName, r.executionId), { ok: !0 };
+	}, t, `action.${Fn.name}`), D[Ln.name] = (t) => J(async (t, n) => {
+		let r = t;
+		return await ht(e.store, n.subject, { id: r.id }), y.signal({ id: r.id }, r.signalName, r.payload);
+	}, t, `action.${Ln.name}`), D[Rn.name] = (t) => J(async (t, n) => {
+		let r = t;
+		return await ht(e.store, n.subject, { id: r.id }), y.update({ id: r.id }, r.updateName, r.payload, r.timeoutMs === void 0 ? void 0 : { timeoutMs: r.timeoutMs });
+	}, t, `action.${Rn.name}`));
+	let wt = [
+		...E(e.discovered.queries).map((e) => R(e.descriptor)),
+		...E(e.discovered.mutations).map((e) => L(e.descriptor)),
+		...E(e.discovered.actions).map((e) => I(e.descriptor)),
+		...it.queries.map((e) => R(e.descriptor)),
+		...it.mutations.map((e) => L(e.descriptor)),
+		...at.queries.map((e) => R(e.descriptor)),
+		...at.mutations.map((e) => L(e.descriptor)),
+		...x.queries.map((e) => R(e.descriptor)),
+		...x.mutations.map((e) => L(e.descriptor)),
+		...x.actions.map((e) => I(e.descriptor)),
+		...E(e.discovered.streams ?? []).map((e) => Mn(e.descriptor)),
+		...C.rpcs,
+		...(e.discovered.workflows ?? []).map((e) => ni(e.definition)),
+		...me ? [
+			R(V),
+			R(In),
+			R(H),
+			R(B),
+			R(Pn),
+			R(z),
+			I(Nn),
+			I(Fn),
+			I(Ln),
+			I(Rn)
+		] : []
+	], Dt = Kn.make(...wt).middleware(On).middleware(kn), kt = Tr({ resolveSubject: ({ headers: t, clientId: n }) => e.resolveSubject(t, n) }), At = e.dormancyTenantId ?? $n, jt = e.dormancy === "sleep" ? {
+		register: (t, n, r) => Ur(e.store, {
+			tenantId: r ?? At,
+			kind: "workflow",
+			refId: t,
+			wakeAt: n
+		}),
+		cancel: (t, n) => ur(e.store, {
+			tenantId: n ?? At,
+			kind: "workflow",
+			refId: t
+		}).then(() => {})
+	} : void 0, A = he ? await import("@voltro/workflow") : void 0, j = A?.makeWorkflowRunRecorder({
+		store: e.store,
+		...e.workflowRecording === void 0 ? {} : { recording: e.workflowRecording },
+		...jt === void 0 ? {} : { wakeups: jt }
+	}), Pt = async (t, n) => {
+		await A.closeWorkflowChildrenForParent({
+			store: e.store,
+			parentExecutionId: t,
+			parentStatus: n,
+			recorder: j,
+			log: { warn: (e, t) => {
+				process.stderr.write(`[workflow] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+			} },
+			interruptChild: async (t, n) => {
+				let r = (e.discovered.workflows ?? []).find((e) => e.definition.name === t);
+				if (!r) throw Error(`Unknown child workflow: ${t}`);
+				if (!p) throw Error("Workflow runtime is not ready");
+				await p.runPromise(r.definition.interrupt(n));
+			}
+		});
+	}, Ft = async (t, n, r) => {
+		let i = (await e.store.query({
+			table: "_voltro_workflow_runs",
+			order: [],
+			predicate: G("executionId", n),
+			projection: void 0,
+			skip: void 0,
+			take: 1
+		}))[0];
+		if (i === void 0) return;
+		let a = await e.store.update("_voltro_workflow_runs", i.id, {
+			status: "cancelled",
+			cancelled: !0,
+			completedAt: /* @__PURE__ */ new Date()
+		}), o = i.subject?.tenantId ?? void 0;
+		a && await j.recordEvent({
+			runId: i.id,
+			eventType: "run-cancelled",
+			payload: {
+				reason: r,
+				workflowName: t,
+				executionId: n,
+				...o == null ? {} : { tenantId: o }
+			}
+		}), a && await Pt(n, "cancelled");
+	}, It = [
+		...X(e.discovered.workflows ?? [], {
+			buildContext: (t, n) => e.buildContextForWorkflow?.(t, n) ?? Be({
+				subject: t.subject,
+				traceId: t.traceId
+			}, e.store, void 0, `workflow:${n.workflowName}`, { parentExecutionId: n.executionId }),
+			resolveStartContext: ue,
+			...de === void 0 ? {} : { resolveAuthority: de }
+		}, (t, n, r) => {
+			let i = A.getWorkflowVersionMetadata(t.definition);
+			return A.wrapWorkflowExecuteWithRunRecording({
+				name: t.definition.name,
+				store: e.store,
+				subject: r.subject,
+				source: r.source ?? null,
+				traceId: r.traceId,
+				workflowVersion: i.version,
+				workflowCompatibleVersions: i.compatibleWith,
+				workflowPatches: i.patches,
+				parentExecutionId: r?.parentExecutionId ?? null,
+				parentClosePolicy: r?.parentClosePolicy ?? null,
+				onParentClose: ({ executionId: e, status: t }) => Pt(e, t),
+				...Ge(t.definition),
+				onTerminal: async ({ executionId: e }) => {
+					await f?.gate.release(e);
+				},
+				recorder: j,
+				pluginWorkflowStepLayer: et,
+				recordRun: Hr
+			}, n);
+		}),
+		...e.discovered.workflowWorkers ?? [],
+		...xe === void 0 ? [] : [xe]
+	], Rt = [...(e.discovered.workflows ?? []).map((e) => e.definition.name).filter(Boolean), ...xe === void 0 ? [] : ["voltro.deliverWebhook"]], zt = It.length > 0 ? W.mergeAll(...It) : W.empty;
+	if (((e.discovered.workflows?.length ?? 0) > 0 || (e.discovered.workflowWorkers?.length ?? 0) > 0 || e.scheduleCoordination === "cluster" || xe !== void 0) && e.workflowEngineLayer !== void 0) {
+		let t = zt.pipe(W.provideMerge(e.workflowEngineLayer));
+		p = Bn.make(e.baseLayer === void 0 ? t : t.pipe(W.provideMerge(e.baseLayer))), await p.runPromise(U.void), (e.log ?? F({ scope: "voltro:serve" })).child("workflow").info(`workflow runtime ready — ${Rt.length} entity type(s) registered`, { entities: Rt });
+		let n = await import("@voltro/workflow/cluster"), r = (e) => p.runPromise(n.redriveFailedRun(e)), i = (e) => p.runPromise(n.resumeRunFromStep(e));
+		ne = await k({
+			provider: Si(e.plugins ?? [])?.broadcast?.provider,
+			crossReplica: Si(e.plugins ?? [])?.broadcast?.crossReplica ?? !1,
+			namespace: je,
+			replicaId: crypto.randomUUID(),
+			pollStorage: () => p.runPromise(n.pollWorkflowStorage),
+			onChange: (t) => e.store.onChange((e) => t({
+				table: e.table,
+				op: e.op,
+				...e.origin === void 0 ? {} : { origin: e.origin }
+			})),
+			log: (e.log ?? F({ scope: "voltro:serve" })).child("workflow")
+		}), ee = async (t) => {
+			let n = await ae({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runRedrive: r
+			}, t.runId);
+			return n.statusReset && await j.recordEvent({
+				runId: t.runId,
+				eventType: "run-redriven",
+				payload: {
+					reason: "inspect.redrive",
+					activitiesReset: n.outcome.activitiesReset
+				}
+			}), {
+				redriven: n.outcome.redriven,
+				activitiesReset: n.outcome.activitiesReset,
+				reason: n.outcome.reason
+			};
+		}, te = async (t) => {
+			let n = await De({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runResume: i
+			}, t.runId, t.step);
+			return n.statusReset && await j.recordEvent({
+				runId: t.runId,
+				eventType: "run-redriven",
+				payload: {
+					reason: "inspect.resume-from-step",
+					step: n.stepName,
+					activitiesReset: n.outcome.activitiesReset
+				}
+			}), {
+				redriven: n.outcome.redriven,
+				stepName: n.stepName,
+				activitiesReset: n.outcome.activitiesReset,
+				reason: n.outcome.reason
+			};
+		};
+		let a = (e.scheduleCoordination ?? "single") === "advisoryLock" ? br(e.store, e.scheduleReplicaId ?? `pid-${process.pid}`) : Yr, s = Er({
+			coordinator: a,
+			replicaId: e.scheduleReplicaId ?? `pid-${process.pid}`
+		}), u = {
+			info: (e, t) => {
+				process.stdout.write(`[flow-control] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+			},
+			warn: (e, t) => {
+				process.stderr.write(`[flow-control] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+			},
+			error: (e, t) => {
+				process.stderr.write(`[flow-control] ERROR ${e} ${t ? JSON.stringify(t) : ""}\n`);
+			}
+		}, d, m = () => {
+			if (d !== void 0) return d;
+			if (o !== void 0 && j !== void 0) return d = re({
+				store: e.store,
+				log: P,
+				workflows: e.discovered.workflows ?? [],
+				workflowsProxy: o,
+				workflowRuntime: p,
+				workflowRunRecorder: j,
+				closeChildrenForParent: Pt
+			}), d;
+		};
+		c = m, f = rt({
+			store: e.store,
+			onChange: (t) => e.store.onChange((e) => t({
+				table: e.table,
+				op: e.op
+			})),
+			...e.scheduling === void 0 ? {} : {
+				disarmWhenIdle: e.scheduling.disarmWhenIdle,
+				drainIntervalMs: e.scheduling.admissionDrainMs,
+				cancelSweepIntervalMs: e.scheduling.cancelSweepMs,
+				stalenessSweepIntervalMs: e.scheduling.stalenessSweepMs
+			},
+			workflows: e.discovered.workflows ?? [],
+			facade: () => o,
+			cancelRunWithReason: m,
+			recordRunEvent: () => j?.recordEvent,
+			...e.workflowStaleness === void 0 ? {} : { staleness: e.workflowStaleness },
+			...e.workflowSuspendSignalHintMs === void 0 ? {} : { suspendSignalHintMs: e.workflowSuspendSignalHintMs },
+			scheduleCoordinated: s,
+			onAbandoned: async (t) => {
+				await Et({
+					workflows: e.discovered.workflows ?? [],
+					facade: () => o,
+					log: u,
+					...t
+				});
+			},
+			log: u
+		});
+		let h = f;
+		h !== void 0 && Br(() => h.stop()), l = qe({
+			store: e.store,
+			onChange: (t) => e.store.onChange((e) => t({
+				table: e.table,
+				op: e.op
+			})),
+			...e.scheduling === void 0 ? {} : {
+				disarmWhenIdle: e.scheduling.disarmWhenIdle,
+				tickIntervalMs: e.scheduling.inferenceTickMs
+			},
+			enabled: (e.discovered.workflows?.length ?? 0) > 0,
+			resumeSignal: () => p === void 0 || A === void 0 ? void 0 : async ({ executionId: t, workflowName: n, signalName: r, payload: i }) => {
+				await p.runPromise(A.completeSuspendingSignal({
+					store: e.store,
+					target: Mt(t, n),
+					signalName: r,
+					payload: i
+				}));
+			},
+			runEffect: (e) => p.runPromise(e),
+			scheduleCoordinated: s,
+			log: u
+		});
+		let g = l;
+		g !== void 0 && Br(() => g.stop()), o = (e.discovered.workflows?.length ?? 0) > 0 ? Lr({
+			workflows: e.discovered.workflows ?? [],
+			runEffect: (e) => p.runPromise(e),
+			onEnqueue: () => ne?.publishWake(),
+			...h === void 0 ? {} : {
+				admitStart: h.gate.admitStart,
+				startPayloadSchema: h.gate.startPayloadSchema,
+				parkDelayedStart: h.gate.parkDelayed
+			},
+			rememberStartContext: le,
+			signal: async (t, n, r) => {
+				let i = await A.sendWorkflowSignal({
+					store: e.store,
+					recorder: j,
+					target: t,
+					signalName: n,
+					payload: r
+				});
+				return await p.runPromise(A.completeSuspendingSignal({
+					store: e.store,
+					target: t,
+					signalName: n,
+					payload: r
+				})).catch(() => {}), i;
+			},
+			update: (t, n, r, i) => A.sendWorkflowUpdate({
+				store: e.store,
+				recorder: j,
+				target: t,
+				updateName: n,
+				payload: r,
+				...i === void 0 ? {} : { options: i }
+			}),
+			listRuns: (t) => Oe(e.store, t),
+			retry: (t, n) => Ae({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runPromise: (e) => p.runPromise(e)
+			}, t, n),
+			redrive: (t) => ae({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runRedrive: r
+			}, t).then((e) => e.outcome)
+		}) : void 0;
+	}
+	let Ht = W.mergeAll(Dt.toLayer(D), kt), Ut = Ct(D, e.discovered.queries.map((e) => e.descriptor.name), me), Wt = W.mergeAll(Dt.toLayer(Ut), kt), M = e.observability, N = await lr({
+		...e.appName === void 0 ? {} : { serviceName: e.appName },
+		...M && M.spanProcessors.length > 0 ? { extraSpanProcessors: M.spanProcessors } : {},
+		...M && M.metricReaders.length > 0 ? { extraMetricReaders: M.metricReaders } : {},
+		...M && Object.keys(M.resourceAttributes).length > 0 ? { resourceAttributes: M.resourceAttributes } : {},
+		...M && M.sampler !== void 0 ? { sampler: M.sampler } : {}
+	}), Gt = !1, Kt = e.store.ping ? () => e.store.ping().then(() => !0).catch(() => !1) : void 0, { server: qt, shutdown: Jt } = Xr({
+		group: Dt,
+		handlersLayer: Ht,
+		httpHandlersLayer: Wt,
+		port: e.port ?? 4e3,
+		...e.host === void 0 ? {} : { host: e.host },
+		path: e.path ?? "/ws",
+		tracerLayer: N.layer,
+		security: ve(e),
+		...Qe,
+		healthCheck: {
+			isReady: () => Gt,
+			...Kt ? { ping: Kt } : {}
+		},
+		...St.length > 0 ? { httpRoutes: St } : {},
+		...e.getStore === void 0 ? {} : { getStore: e.getStore },
+		...Se.size > 0 ? { webhookRoutes: Se } : {},
+		...e.inspectRoute === void 0 ? {} : { inspectRoute: e.inspectRoute }
+	}), Yt = Mi(qt);
+	if (await sr(qt), (e.discovered.schedules?.length ?? 0) > 0) {
+		let t = (e.scheduleCoordination ?? "single") === "advisoryLock" ? br(e.store, e.scheduleReplicaId ?? `pid-${process.pid}`) : Yr;
+		se = await Zr(e.discovered.schedules ?? [], {
+			store: e.store,
+			coordinator: t,
+			defaultTrigger: e.scheduleDefaultTrigger ?? "self",
+			replicaId: e.scheduleReplicaId ?? `pid-${process.pid}`,
+			armSelf: e.scheduleArmSelf ?? !0,
+			dormancy: e.dormancy ?? "always-on",
+			...e.dormancyTenantId === void 0 ? {} : { dormancyTenantId: e.dormancyTenantId },
+			buildContext: ({ traceId: t, scheduleName: n, subject: r }) => Be({
+				subject: r,
+				traceId: t
+			}, e.store, void 0, `schedule:${n}`),
+			log: {
+				info: (e, t) => {
+					process.stdout.write(`[schedule] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+				},
+				warn: (e, t) => {
+					process.stderr.write(`[schedule] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+				},
+				error: (e, t) => {
+					process.stderr.write(`[schedule] ERROR ${e} ${t ? JSON.stringify(t) : ""}\n`);
+				},
+				debug: () => {}
+			},
+			...e.scheduleFireInterceptor === void 0 ? {} : { interceptFire: e.scheduleFireInterceptor },
+			...e.onScheduleRunEvent === void 0 ? {} : { onRunEvent: e.onScheduleRunEvent }
+		}), e.onSchedulerReady?.(se);
+	}
+	let P = e.log ?? F({ scope: "voltro:serve" }), Xt, Zt;
+	if ((e.discovered.subscribers?.length ?? 0) > 0 && (Xt = S(e.discovered.subscribers ?? [], e.store, P.child("subscribe"), e.schemaRegistry, C.bus)), (e.discovered.reactions?.length ?? 0) > 0) {
+		let t = P.child("reaction"), n = async (n, r) => {
+			if (n.kind === "workflow") {
+				if (y === void 0) {
+					t.warn("reaction workflow act skipped — no workflow engine in this app", { workflow: n.workflow });
+					return;
+				}
+				let e = n.payload === void 0 ? r.new ?? r.old ?? {} : n.payload(r);
+				await Rr(y, {
+					traceId: `reaction:${n.workflow}`,
+					source: `reaction:${n.workflow}`
+				}).start(n.workflow, e);
+				return;
+			}
+			await ct(n.agent, r, {
+				findAgentSend: (t) => e.discovered.actions.find((e) => e.descriptor.name === `${t}.send`),
+				runAction: (e, t, n) => Promise.resolve(ot(e, t, n)),
+				makeSubject: (e) => An(e),
+				now: () => Date.now(),
+				log: t
+			});
+		}, r = async (n, r) => {
+			try {
+				let { requireAiBudget: t } = await import("@voltro/ai");
+				return (await U.runPromise(U.either(t(e.store, {
+					tenantId: n,
+					limitUsd: r
+				}))))._tag === "Right";
+			} catch (e) {
+				return t.warn("reaction budget check failed — refusing the act", { tenantId: n }, e), !1;
+			}
+		}, i = dt(e.store, { onError: (e) => t.warn("reaction: rate-slot claim failed; refusing the act", { cause: String(e) }) });
+		Zt = u(e.discovered.reactions ?? [], e.store, {
+			runAct: n,
+			checkBudget: r,
+			claimRateSlot: (e) => i.claim(e)
+		}, t);
+	}
+	let Qt;
+	(e.discovered.aggregates?.length ?? 0) > 0 && (Qt = await Ee({
+		discovered: e.discovered.aggregates ?? [],
+		store: e.store,
+		log: P.child("aggregate"),
+		...e.analytics === void 0 ? {} : { analytics: e.analytics },
+		...e.aggregateStorage === void 0 ? {} : { storage: e.aggregateStorage },
+		...e.aggregateCoordinator === void 0 ? {} : { coordinator: e.aggregateCoordinator }
+	}), Ve = W.succeed(Zn, Qt.registry));
+	let $t;
+	(e.discovered.expectations?.length ?? 0) > 0 && ($t = ir({
+		discovered: e.discovered.expectations ?? [],
+		store: e.store,
+		log: P.child("expectation")
+	}), He = W.succeed(tr, $t.registry)), (e.discovered.budgets?.length ?? 0) > 0 && (n = or({
+		discovered: e.discovered.budgets ?? [],
+		log: P.child("finops")
+	}), We = W.succeed(Qn, n.registry));
+	let en;
+	return (e.discovered.experiments?.length ?? 0) > 0 && (en = ar({
+		discovered: e.discovered.experiments ?? [],
+		store: e.store,
+		log: P.child("experiment")
+	}), Ke = W.succeed(q, en.registry)), Gt = !0, e.bootTiming?.mark("ready"), {
+		dispatcher: r,
+		server: qt,
+		scheduler: se,
+		eventsSnapshot: pe(C.bus, C.declared),
+		membersSnapshot: () => ({
+			members: Re.membership.list(),
+			capturedAt: Date.now()
+		}),
+		agentTools: () => gt,
+		rpcMetrics: () => Xe,
+		webhooksService: () => be,
+		runCanceller: () => c(),
+		flowControlHealth: () => f?.cancelHealth(),
+		inferenceHealth: () => l?.health(),
+		workflowWriteActions: () => y === void 0 || j === void 0 ? void 0 : oe({
+			store: e.store,
+			log: P,
+			workflows: e.discovered.workflows ?? [],
+			workflowsProxy: o,
+			workflowRuntime: p,
+			workflowRunRecorder: j,
+			closeChildrenForParent: Pt
+		}),
+		redriveWorkflowRun: (e) => ee ? ee(e) : Promise.reject(/* @__PURE__ */ Error("redrive: this app registers no workflows")),
+		resumeWorkflowRunFromStep: (e) => te ? te(e) : Promise.reject(/* @__PURE__ */ Error("resume-from-step: this app registers no workflows")),
+		close: async () => {
+			Gt = !1, await Yt.drainRequests();
+			for (let e of Ce) try {
+				await e();
+			} catch (e) {
+				P.warn("serve: teardown step failed", {}, e);
+			}
+			await ze?.detach(), await Re.detach(), Qt?.detach(), $t?.detach(), n?.detach(), en?.detach(), Zt?.(), Xt?.(), await se?.shutdown(), r.close(), await ne?.detach(), await p?.dispose(), await Jt(), await Yt.finish();
+		}
+	};
+}, $ = F({ scope: "voltro:serve" }), Yi = (e, t, n) => (e === "production" || e === "staging") && t !== "memory" && n !== "0", Xi = Ht, Zi = async (e) => {
+	let t = xn(process.cwd());
+	if (En(t)) {
+		let n;
+		try {
+			let e = await import(Dn(t).href);
+			typeof e.runServe == "function" ? n = e.runServe : $.warn("serve bundle has no runServe export — using the standard serve path");
+		} catch (e) {
+			$.warn("serve bundle failed to load — using the standard serve path", {}, e);
+		}
+		if (n) return $.info("serve: booting from the precompiled serve bundle"), n(e);
+	}
+	return Qi(e);
+}, Qi = async (s) => {
+	let u = Sn();
+	e("serve");
+	try {
+		ui();
+	} catch (e) {
+		throw i(e instanceof Error ? e.message : String(e));
+	}
+	let d = process.cwd(), m = await We(d), re = Ut({
+		kind: "api",
+		configPort: m?.port,
+		env: process.env,
+		flagPort: Xi(s, "--port")
+	});
+	for (let e of re.warnings) $.warn(e);
+	let h = re.port;
+	Kr(Wr(m?.secrets)), await M({
+		rawEnv: m?.env,
+		appType: "api",
+		root: d,
+		log: $,
+		generateTypes: !1
+	}), u.mark("config");
+	let g = (process.env.DB_DIALECT ?? m?.store ?? "memory").toLowerCase(), ie = (g === "mariadb" || g === "postgres" || g === "mssql") && (process.env.CDC ?? "1") !== "0", ae = g === "mariadb" ? "mariadb" : g === "mssql" ? "mssql" : void 0, oe = bn(d);
+	if (!r() && En(oe)) try {
+		let e = await import(Dn(oe).href);
+		if (e.modules) {
+			let t = {};
+			for (let [n, r] of Object.entries(e.modules)) t[Tn(d, n)] = r;
+			n(t), $.info("precompiled api bundle loaded", { modules: Object.keys(t).length });
+		}
+	} catch (e) {
+		$.warn("precompiled api bundle failed to load — falling back to source", {}, e);
+	}
+	let _ = await Xe(d), v = await At(_, { cdc: ie && ae !== void 0 }), fe = b(v);
+	{
+		let e = /* @__PURE__ */ new Set([
+			...v.queries.filter((e) => e.descriptor.overridesPlugin === !0).map((e) => e.descriptor.name),
+			...v.mutations.filter((e) => e.descriptor.overridesPlugin === !0).map((e) => e.descriptor.name),
+			...v.actions.filter((e) => e.descriptor.overridesPlugin === !0).map((e) => e.descriptor.name)
+		]);
+		Xt(P(m?.plugins ?? []), [
+			...v.queries.map((e) => e.descriptor.name),
+			...v.mutations.map((e) => e.descriptor.name),
+			...v.actions.map((e) => e.descriptor.name),
+			...v.streams.map((e) => e.descriptor.name)
+		], e);
+		let t = je(v.serverOnlyLeaks, x(process.env, "strict"), pr, "`voltro serve`");
+		if (t.action === "fail") throw i(t.message ?? "");
+		t.action === "warn" && $.warn(t.message ?? "");
+	}
+	let pe = _.filter((e) => vn.test(e)), ye = pe.length > 0 ? await _n(pe, $.child("webhooks")) : {
+		outgoing: [],
+		incoming: [],
+		providers: []
+	}, Ee = hn(v.events), De = ye.outgoing.length + ye.incoming.length + ye.providers.length + Ee.length === 0 ? void 0 : {
+		...ye,
+		outgoing: [...ye.outgoing, ...Ee]
+	}, Oe = rn({
+		nodeEnv: process.env.NODE_ENV,
+		cdcDialect: ae,
+		declared: m?.schema
+	}), Ae = Qt({
+		gates: Oe,
+		runtime: {
+			traces: _e(),
+			undo: $r()
+		}
+	});
+	if (Ae !== void 0) throw i(`serve: ${Ae}`);
+	let Me = nn({
+		mix: v.featureMix,
+		plugins: m?.plugins ?? [],
+		gates: Oe,
+		...ae ? { cdcDialect: ae } : {}
+	}), Ne = m?.analytics !== void 0 && m.analytics.kind !== "noop" && g !== "memory" ? (await N(g)).makeSqlLayer(O()) : void 0, Ie = await c({
+		spec: m?.analytics,
+		sqlLayer: Ne,
+		log: $
+	}), S = (() => {
+		let e = new Set(v.tables.map((e) => e.tableName)), t = [...v.tables];
+		for (let n of [...Me, ...Ie.tables]) e.has(n.tableName) || (e.add(n.tableName), t.push(n));
+		return t;
+	})();
+	for (let e of S) Xn(e);
+	{
+		let e = mr(ei(v.queries.map((e) => ({
+			name: e.descriptor.name,
+			source: e.descriptor.source
+		})), new Set(S.flatMap((e) => {
+			let t = e.tableName;
+			return t === void 0 ? [] : [t];
+		}))));
+		e !== void 0 && $.warn(e);
+	}
+	let Le = (process.env.NODE_ENV ?? "").toLowerCase();
+	if (Yi(Le, g, process.env.VOLTRO_AUTO_MIGRATE)) {
+		let e = (await N(g)).makeSqlLayer(O()), t = await U.runPromise(Vn.SqlClient.pipe(U.flatMap((e) => Wn(e, d)), U.provide(e), U.catchAll(() => U.succeed([]))));
+		t.length > 0 && ($.error(`serve: refusing to boot — ${t.length} pending file-based migration(s) have never run against this database. They perform the changes a schema diff cannot infer (data moves, backfills, table splits), so the declarative fingerprint check below cannot see them and would have let this process serve un-migrated data.`, { pending: t }), $.error("Run them from your pre-deploy job — `voltro db migrate .` (schema + files) or `voltro db files .` (files alone) — or set VOLTRO_AUTO_MIGRATE=0 to bypass every boot schema check. `voltro serve` never applies them itself: a rolling deploy would start N replicas and each would try."), process.exit(1));
+		let n = await U.runPromise(Vn.SqlClient.pipe(U.flatMap((e) => Gn(e, S, {
+			appliedBy: `serve:${Le}`,
+			environment: "prod",
+			dialectId: g
+		})), U.provide(e)));
+		n.kind === "prod-mismatch" && ($.error(Un(n, g)), $.error(en({
+			gates: Oe,
+			nodeEnv: process.env.NODE_ENV,
+			cdcDialect: ae,
+			declared: m?.schema
+		})), $.error("serve: refusing to boot — apply the schema first (voltro db apply in a pre-deploy step), or set VOLTRO_AUTO_MIGRATE=0 to bypass this check."), process.exit(1)), $.info(Un(n, g));
+	}
+	await Yt({
+		dialectId: g,
+		tables: S,
+		mode: qt(m?.reactiveTriggers),
+		lockSchema: O().schema,
+		makeLayer: async () => (await N(g)).makeSqlLayer(O()),
+		log: {
+			info: (e, t) => $.info(e, t ?? {}),
+			warn: (e, t) => $.warn(e, t ?? {})
+		}
+	});
+	let Ue = Ir(S);
+	u.mark("discover");
+	let w = await it(m, void 0), Ge = ri(w, g);
+	for (let e of pt({
+		dialect: String(m?.store ?? process.env.DB_DIALECT ?? "postgres"),
+		changeStrategy: (process.env.CDC ?? "1") === "0" ? "inline" : "cdc",
+		dbUrl: process.env.DB_URL,
+		crossReplicaBus: Si(m?.plugins ?? [])?.broadcast.crossReplica === !0,
+		tables: v.tables.map((e) => ({
+			tableName: e.tableName,
+			isReactive: e.isReactive === !0
+		})),
+		querySources: v.queries.flatMap((e) => {
+			let t = e.descriptor.source;
+			return t === void 0 ? [] : typeof t == "string" ? [t] : [...t];
+		})
+	})) e.level === "warn" ? $.warn(e.message) : $.info(e.message);
+	{
+		let e = Ze({
+			tables: qn().map((e) => ({ tableName: e.tableName })),
+			queries: v.queries.map((e) => ({
+				name: e.descriptor.name,
+				source: e.descriptor.source
+			}))
+		}), t = vt(e);
+		t !== void 0 && $.warn(t);
+	}
+	m?.cache && !process.env.CACHE_BACKEND && (process.env.CACHE_BACKEND = m.cache), m?.cacheRedisUrl && !process.env.CACHE_REDIS_URL && (process.env.CACHE_REDIS_URL = m.cacheRedisUrl), m?.cacheRedisDriver && !process.env.CACHE_REDIS_DRIVER && (process.env.CACHE_REDIS_DRIVER = m.cacheRedisDriver), m?.cacheKeyPrefix && !process.env.CACHE_KEY_PREFIX && (process.env.CACHE_KEY_PREFIX = m.cacheKeyPrefix);
+	let { service: qe, invalidationBus: rt, snapshotCache: st, cache: ct, semantic: dt, evictSource: ht, backend: bt, stats: xt, dispose: Ct } = await Ke({
+		env: process.env,
+		semantic: m?.cacheSemantic ?? !1
+	});
+	dt !== void 0 && $.info("semantic cache enabled — reactive eviction on live writes"), $.info(`cache backend resolved: ${bt}` + (bt === "redis" ? ` (driver ${process.env.CACHE_REDIS_DRIVER ?? "resp"})` : " — in-process, not cross-instance")), w.onChange((e) => {
+		if (U.runFork(rt.publish(e.table)), ht !== void 0) {
+			let t = (e.new ?? e.old)?.id;
+			ht({
+				table: e.table,
+				op: e.op,
+				...t === void 0 ? {} : { id: t }
+			});
+		}
+	}), m?.kv && !process.env.KV_BACKEND && (process.env.KV_BACKEND = m.kv), m?.kvRedisUrl && !process.env.KV_REDIS_URL && (process.env.KV_REDIS_URL = m.kvRedisUrl), m?.kvKeyPrefix && !process.env.KV_KEY_PREFIX && (process.env.KV_KEY_PREFIX = m.kvKeyPrefix);
+	let { kv: Tt, service: Et } = await wr({ store: w });
+	He({
+		log: $,
+		max: Kt(),
+		outOfPool: zt(g, (process.env.CDC ?? "1") !== "0"),
+		readPools: t.replicationSnapshot()?.replicaCount ?? 0,
+		always: !0
+	}), u.mark("store");
+	let Ot = rr({
+		store: w,
+		sink: Ie.sink,
+		log: $
+	}), Mt = jt({
+		store: w,
+		dialect: g,
+		log: { info: (e) => $.info(e) }
+	}), k = m?.plugins ?? [], Lt = process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, Bt, Vt;
+	g !== "memory" && (Bt = Bn.make((await N(g)).makeSqlLayer(O())), Vt = await Bt.runPromise(Vn.SqlClient));
+	let Ht = [
+		"postgres",
+		"mariadb",
+		"mysql",
+		"mssql"
+	].includes(g) ? br(w, Lt, $) : Yr, gn = C(m?.scheduling), xn = Er({
+		maxIdleIntervalMs: gn.pollCeilingMs,
+		coordinator: Ht,
+		replicaId: Lt,
+		log: $
+	}), Cn = [], F = process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, On = Si(m?.plugins ?? [])?.broadcast?.provider, kn = $e(m?.plugins, m?.name ?? wn(d));
+	{
+		let e = nt(m?.plugins, m?.name ?? wn(d));
+		e !== void 0 && $.warn(e);
+	}
+	let I = Nt(m?.plugins, {
+		instanceId: F,
+		namespace: kn,
+		meta: { mode: "serve" },
+		logger: $
+	}), An = {
+		...Vt ? { sql: Vt } : {},
+		instanceId: F,
+		membership: I.membership,
+		...On === void 0 ? {} : { broadcast: On },
+		broadcastChannels: { presence: xi(kn, "presence") },
+		scheduleCoordinated: (e, t, n) => {
+			let r = xn(e, t, n);
+			return Cn.push(r), r;
+		}
+	};
+	for (let e of k) e.bindDataStore?.(Ge, An);
+	l({
+		store: w,
+		...lt(),
+		log: $
+	});
+	let jn = k.filter((e) => typeof e.onChangeEvent == "function");
+	if (jn.length > 0) {
+		let e = w.changeScope ?? "local";
+		w.onChange((t) => {
+			let n = me(t, e);
+			for (let e of jn) U.runFork(e.onChangeEvent(n).pipe(U.catchAllCause((t) => U.sync(() => $.warn(`plugin ${e.name} onChangeEvent failed`, { error: zn.pretty(t) })))));
+		});
+	}
+	let L = ce({
+		plugins: k,
+		appName: m?.name ?? "voltro-api",
+		appType: "api",
+		voltroVersion: process.env.npm_package_version ?? "0.0.0",
+		log: $
+	});
+	k.length && await L.activate(), u.mark("plugins");
+	let R = await L.gatherObservability(), Mn = {
+		info: (e, t) => process.stdout.write(`[broadcast] ${e} ${t ? JSON.stringify(t) : ""}\n`),
+		warn: (e, t) => process.stderr.write(`[broadcast] ${e} ${t ? JSON.stringify(t) : ""}\n`),
+		debug: () => {}
+	}, Nn, Pn = await _t(w, m, g, kn, Mn, (e, t) => {
+		Nn?.refreshAll(`broadcast gap: missed ${t} change(s) from ${e}`);
+	}), z = m?.apiKeys, Fn = (typeof z == "object" ? z.prefix : void 0) ?? "voltro_", B = z ? fr(w) : void 0, V = B ? Sr({ flush: Cr(B) }) : void 0;
+	V && Br(() => V.shutdown());
+	let H = B ? xr(B, {
+		prefix: Fn,
+		...V ? { usage: V } : {}
+	}) : void 0, In = H ? [hr(H, { prefix: Fn })] : [], Ln = St([...m?.auth?.strategies ?? [], ...In], yi(m?.plugins ?? []), m?.auth?.anonymousTenantRequired ?? !1, m?.auth, () => Ge), Rn = [...m?.restRoutes ?? [], ...H ? nr(H, (typeof z == "object" ? z.managementPath : void 0) ?? "/v1/api-keys") : []], Kn = D(m?.idempotency, w), Jn = k.map((e) => e.services).filter((e) => e !== void 0), G = W.mergeAll(ze({
+		analyticsLayer: Ie.layer,
+		cacheService: qe,
+		kvService: Et,
+		...dt === void 0 ? {} : { semanticCache: dt },
+		pluginServices: Jn,
+		userLayers: m?.layers ?? []
+	}), at(m?.http ?? {})), K = await ot({
+		files: _,
+		store: w,
+		log: $,
+		seedPolicy: "report",
+		seedPattern: dn,
+		loadSeedFiles: Jt,
+		startupPattern: on,
+		loadStartupFiles: a,
+		runStartups: o,
+		emailPattern: Be,
+		loadEmailFiles: gt,
+		registerEmailTemplates: bi
+	});
+	(K.startupCount > 0 || K.emailCount > 0) && $.info("boot lifecycle", {
+		startups: K.startupCount,
+		emailTemplates: K.emailCount
+	}), K.startups !== void 0 && Br(async () => {
+		await K.startups.stop();
+	}), se({
+		demands: de(fe),
+		isRegistered: (e) => gr(e) !== void 0
+	});
+	let Zn = mt({
+		schedules: wt({
+			schedules: v.schedules,
+			seeds: K.seeds,
+			store: w,
+			log: $.child("seeds")
+		}),
+		workflows: v.workflows ?? [],
+		log: $.child("workflow-schedules")
+	}), Qn = m?.scheduling ?? {}, $n = Qn.trigger ?? "self", er = /* @__PURE__ */ new Set([
+		"postgres",
+		"mysql",
+		"mariadb",
+		"mssql"
+	]), tr = Qn.coordination ?? (er.has(g) ? "advisoryLock" : "single"), q = tr === "cluster" && er.has(g), ir = q ? "cluster" : tr === "advisoryLock" && er.has(g) ? "advisoryLock" : "single";
+	tr === "cluster" && !q && $.warn("scheduling.coordination=cluster needs a sql-backed store except sqlite — falling back to single"), tr === "advisoryLock" && !er.has(g) && $.warn("scheduling.coordination=advisoryLock needs a SQL store (the claim-row gate) — falling back to single");
+	let ar, or = v.workflows.length > 0 || v.workflowWorkers.length > 0 || v.eventTriggers.length > 0 || (De?.outgoing.length ?? 0) > 0 || q, sr;
+	if (or) {
+		if (g === "mssql") {
+			let e = await mn(process.cwd());
+			e && $.warn(e);
+		}
+		let [{ WorkflowEngine: e }, { makeClusterCronLayer: t, workflowEngineLayer: n, resolveRunnerStorage: r, resolveFailoverTuning: i }] = await Promise.all([import("@effect/workflow"), import("@voltro/workflow/cluster")]), a = q ? Zn.filter((e) => (e.trigger ?? $n) === "self").map((e) => t({
+			name: e.name,
+			cron: dr(e),
+			execute: async () => {
+				await ar?.fireFromCluster(e.name);
+			}
+		})) : [];
+		sr = g === "memory" ? e.layerMemory : await (async () => {
+			let e = await N(g), t = r({ sqliteFamily: e.id === "sqlite" || e.id === "turso" });
+			return $.info(`workflow engine: cluster-${t}, dialect=${e.id}` + (t === "memory" ? " — single-process durable replay, no cross-pod shard handoff" + (e.id !== "sqlite" && e.id !== "turso" ? " (VOLTRO_WORKFLOW_RUNNER_STORAGE=memory: SqlRunnerStorage/cluster_runners + GET_LOCK skipped)" : "") : "")), n({
+				sqlClientLayer: e.makeSqlLayer(O()),
+				runnerStorage: t,
+				dialectId: e.id,
+				...process.env.VOLTRO_WORKFLOW_RUNNER_PORT ? { runnerListenPort: Number(process.env.VOLTRO_WORKFLOW_RUNNER_PORT) } : {},
+				...i(),
+				...a.length > 0 ? { extraShardingLayers: a } : {}
+			});
+		})();
+	}
+	let J = le(k, yn()), cr = _.filter((e) => /\.subscribe\.tsx?$/.test(e)), Y = cr.length > 0 ? await be(cr, $) : [], lr = _.filter((e) => /\.reaction\.tsx?$/.test(e)), ur = lr.length > 0 ? await y(lr, $) : [], _r = _.filter((e) => ln.test(e)), vr = _r.length > 0 ? await Fe(_r, $) : [], yr = _.filter((e) => /\.aggregate\.tsx?$/.test(e)), Tr = yr.length > 0 ? await te(yr, $) : [], Dr = ge();
+	if (Tr.length > 0 && g !== "memory") try {
+		let e = (await N(g)).makeSqlLayer(O());
+		Dr = ut(e);
+	} catch (e) {
+		$.warn("aggregate: SQL storage init failed — falling back to in-process", { err: String(e) });
+	}
+	let Or = g === "memory" ? Yr : br(w, `aggregate@${process.pid}`, $), kr = _.filter((e) => un.test(e)), Ar = kr.length > 0 ? await p(kr, $) : [], jr = _.filter((e) => cn.test(e)), Mr = jr.length > 0 ? await we(jr, $) : [], Nr = _.filter((e) => sn.test(e)), Pr = Nr.length > 0 ? await Pt(Nr, $) : [], Fr = [], Lr = [], Rr = _.filter((e) => tn.test(e));
+	if (Rr.length > 0) {
+		let e = $.child("agent"), t = _.filter((e) => $t.test(e));
+		t.length > 0 && await an(t, e);
+		let n = await Zt(Rr, e);
+		for (let e of n.agents) for (let t of Ye(e)) (t.kind === "action" ? Fr : Lr).push({
+			file: t.file,
+			descriptor: t.descriptor,
+			executor: t.executor
+		});
+		n.agents.length > 0 && e.info("synthesized agent routes", { agents: n.agents.map((e) => e.descriptor.name) });
+	}
+	u.mark("workflow");
+	let X = () => {
+		let e = Z.workflowWriteActions();
+		if (e === void 0) throw Error("workflow actions: this app registers no workflows");
+		return e;
+	}, zr = Yn({
+		dialect: g,
+		...O()
+	}), Vr = g === "memory" ? void 0 : (await N(g)).makeSqlLayer(O()), Hr = async () => kt({
+		sqlLayer: Vr,
+		declared: S,
+		log: $
+	}), Ur = {
+		kind: "api",
+		meta: {
+			name: m?.name ?? "voltro-api",
+			voltroVersion: Dt,
+			port: h,
+			mode: "start",
+			store: g,
+			cdc: ie ? "on" : "off",
+			...zr === void 0 ? {} : { databaseId: zr }
+		},
+		rpc: et(v, d),
+		workflows: Re(v, d),
+		migrations: Hr,
+		events: () => Z.eventsSnapshot(),
+		agentTools: () => Z.agentTools(),
+		invariantChecks: () => ({
+			mode: "serve",
+			accessGate: fe,
+			config: m,
+			serverOnlyLeaks: v.serverOnlyLeaks,
+			migrations: Hr
+		}),
+		members: () => Z.membersSnapshot(),
+		inspectFireSchedule: async ({ name: e, trigger: t }) => {
+			if (!ar) throw Error("scheduler not started — this app registers no self-triggered schedules (all schedules are trigger:'external', or there are none).");
+			return { runId: await ar.fireNow(e, t) ?? null };
+		},
+		inspectBackfillSchedule: ne({
+			getHandle: () => ar,
+			getSchedules: () => Zn
+		}),
+		...De === void 0 ? {} : { webhooks: () => he({
+			store: w,
+			discoveredWebhooks: De
+		}) },
+		plugins: () => ({
+			plugins: L.snapshot(),
+			capturedAt: Date.now()
+		}),
+		env: () => Wt(m?.name ?? wn(d), {
+			...m?.env !== void 0 && li(m.env) ? { contract: m.env } : {},
+			plugins: m?.plugins ?? []
+		}),
+		dataCache: () => Ve({
+			stats: xt,
+			backendKind: bt
+		}),
+		subscriptions: () => Ft(() => Nn),
+		inspectTables: () => ue(v.tables),
+		inspectRows: xe({
+			store: w,
+			tables: v.tables,
+			mask: !0
+		}),
+		metrics: (e) => Z.rpcMetrics().snapshot(e),
+		cluster: () => Rt({
+			store: w,
+			dialect: g,
+			useClusterCron: q,
+			scheduleCoordChoice: tr
+		}),
+		inspectSchedules: () => Te({
+			schedules: Zn,
+			defaultTrigger: $n,
+			coordination: ir
+		}),
+		inspectScheduleRuns: (e) => j(w, e),
+		...f(w, {
+			controls: E(v.workflows ?? []),
+			active: (v.workflows?.length ?? 0) > 0,
+			cancellation: () => Z.flowControlHealth()
+		}),
+		webhookActions: Se(() => Z.webhooksService()),
+		inspectStartWorkflow: (e) => X().inspectStartWorkflow(e),
+		inspectCancelWorkflowRun: (e) => X().inspectCancelWorkflowRun(e),
+		inspectSuspendWorkflowRun: (e) => X().inspectSuspendWorkflowRun(e),
+		inspectResumeWorkflowRun: (e) => X().inspectResumeWorkflowRun(e),
+		inspectDiscardWorkflowRun: (e) => X().inspectDiscardWorkflowRun(e),
+		inspectRetryWorkflowRun: (e) => X().inspectRetryWorkflowRun(e),
+		inspectSignalWorkflowRun: (e) => X().inspectSignalWorkflowRun(e),
+		inspectUpdateWorkflowRun: (e) => X().inspectUpdateWorkflowRun(e),
+		inspectInferences: (e) => Qe({
+			store: w,
+			active: (v.workflows?.length ?? 0) > 0,
+			dispatcher: () => Z.inferenceHealth()
+		}, e.limit === void 0 ? {} : { limit: e.limit }),
+		...yt({
+			store: w,
+			cancelRun: async (e) => await Z.runCanceller()?.(e) ?? !1,
+			retryRun: async (e) => X().inspectRetryWorkflowRun({ runId: e }),
+			redriveRun: async (e) => Z.redriveWorkflowRun({ runId: e }),
+			log: $
+		}),
+		inspectRedriveWorkflowRun: (e) => Z.redriveWorkflowRun(e),
+		inspectResumeWorkflowRunFromStep: (e) => Z.resumeWorkflowRunFromStep(e)
+	}, Gr = (process.env.VOLTRO_TENANT_ISOLATION ?? m?.tenancy?.isolation) === "namespace", qr = Gr && g !== "memory" ? await (async () => {
+		let e = await N(g);
+		return T({
+			tables: S,
+			sqlLayer: e.makeSqlLayer(O()),
+			dialect: g,
+			options: { retryFilter: e.retryFilter },
+			log: {
+				info: (e, t) => $.info(e, t),
+				error: (e, t, n) => $.error(e, t ?? {}, n)
+			}
+		});
+	})() : void 0, Jr = await ft({
+		input: m?.tenancy?.residency,
+		namespaceIsolationOn: Gr,
+		makeStoreForUrl: (e, t) => it(m, void 0, Gt(O(), t)),
+		log: {
+			info: (e, t) => $.info(e, t),
+			warn: (e, t) => $.warn(e, t)
+		}
+	});
+	Jr !== void 0 && Br(async () => {
+		await Jr.close();
+	});
+	let Z = await Ji({
+		bootTiming: u,
+		broadcastNamespace: kn,
+		scheduling: (() => {
+			let e = gn;
+			return {
+				admissionDrainMs: e.admissionDrainMs,
+				inferenceTickMs: e.inferenceTickMs,
+				cancelSweepMs: e.cancelSweepMs,
+				stalenessSweepMs: e.stalenessSweepMs,
+				disarmWhenIdle: tt({
+					changeScope: w.changeScope,
+					broadcastAttached: Pn !== void 0
+				})
+			};
+		})(),
+		...m?.workflows?.staleness === void 0 ? {} : { workflowStaleness: m.workflows.staleness },
+		...m?.workflows?.suspendSignalHintMs === void 0 ? {} : { workflowSuspendSignalHintMs: m.workflows.suspendSignalHintMs },
+		workflowRecording: A(m?.workflows?.recording),
+		membership: {
+			...I,
+			instanceId: F
+		},
+		security: {
+			defaultDeny: ke(m),
+			...ve(m)
+		},
+		approvals: { defaultExpiryMs: Pe(m) },
+		...m?.plugins === void 0 ? {} : { plugins: m.plugins },
+		...Kn ? { idempotency: Kn } : {},
+		restRoutes: Rn,
+		appProcedures: fe,
+		discovered: {
+			queries: [...v.queries, ...Lr],
+			mutations: v.mutations,
+			actions: [...v.actions, ...Fr],
+			streams: v.streams,
+			events: v.events,
+			workflows: v.workflows,
+			workflowWorkers: v.workflowWorkers,
+			eventTriggers: v.eventTriggers,
+			schedules: Zn,
+			subscribers: Y,
+			outboxHandlers: vr,
+			connections: v.connections,
+			reactions: ur,
+			aggregates: Tr,
+			expectations: Ar,
+			budgets: Mr,
+			experiments: Pr,
+			...De === void 0 ? {} : { webhooks: De }
+		},
+		log: $,
+		analytics: Ie.sink,
+		aggregateStorage: Dr,
+		aggregateCoordinator: Or,
+		store: w,
+		kv: Tt,
+		cache: ct,
+		snapshotCache: st,
+		...m?.reactive === void 0 ? {} : { reactive: m.reactive },
+		schemaRegistry: Ue,
+		tenantScopedTables: v.tenantScopedTables,
+		softDeleteScopedTables: v.softDeleteScopedTables,
+		dataTransferSnapshot: Hn(S),
+		dataTransferDialect: g,
+		...qr === void 0 ? {} : { ensureTenantProvisioned: qr.ensure },
+		...Jr === void 0 ? {} : { resolveResidentStore: Jr.resolveStore },
+		tenantIsolation: (process.env.VOLTRO_TENANT_ISOLATION ?? m?.tenancy?.isolation) === "namespace" ? "namespace" : "shared-schema",
+		resolveSubject: (e, t) => Ln({
+			headers: e,
+			clientId: t
+		}),
+		...m?.auth === void 0 ? {} : { authority: m.auth },
+		...m?.agents === void 0 ? {} : { agents: m.agents },
+		httpRoutes: k.flatMap((e) => e.httpRoutes ?? []),
+		getStore: () => Ge,
+		...G ? { baseLayer: G } : {},
+		...sr === void 0 ? {} : { workflowEngineLayer: sr },
+		scheduleDefaultTrigger: $n,
+		scheduleCoordination: ir,
+		scheduleArmSelf: !q,
+		dormancy: process.env.VOLTRO_DORMANCY === "sleep" || process.env.VOLTRO_DORMANCY === "always-on" ? process.env.VOLTRO_DORMANCY : m?.dormancy ?? "always-on",
+		scheduleReplicaId: process.env.HOSTNAME ?? `pid-${process.pid}`,
+		...J === void 0 ? {} : { scheduleFireInterceptor: J },
+		onSchedulerReady: (e) => {
+			ar = e;
+		},
+		inspectRoute: { handle: async (e, t, n, r) => await ee(e, Ur, t, {
+			method: n,
+			...r === void 0 ? {} : { body: r }
+		}) || ((n === "GET" ? await pn(e, Ur, t, { method: n }) : null) ?? fn(e, Ur, t, {
+			method: n,
+			...r === void 0 ? {} : { body: r }
+		}) ?? {
+			status: 404,
+			contentType: "application/json",
+			body: JSON.stringify({ error: "not an inspect route" })
+		}) },
+		...m?.name === void 0 ? {} : { appName: m.name },
+		observability: R,
+		port: h,
+		...m?.transport?.wsPath ? { path: m.transport.wsPath } : {}
+	});
+	return Nn = Z.dispatcher, Ce(It([
+		v.queries,
+		v.mutations,
+		v.actions,
+		v.streams
+	]), (e) => {
+		$.warn(e);
+	}), $.info(`API listening on :${h}`, {
+		dialect: g,
+		queries: v.queries.length,
+		mutations: v.mutations.length,
+		actions: v.actions.length,
+		streams: v.streams.length,
+		workflows: v.workflows.length,
+		workflowWorkers: v.workflowWorkers.length,
+		schedules: Zn.length,
+		scheduleCoordination: ir
+	}), u.finish($), Br(async () => {
+		for (let e of Cn) e.stop();
+		Mt.stop();
+		try {
+			await Z.close(), Ct(), Bt?.dispose(), await L.deactivate(), await Pn?.close(), await Je({
+				mirror: Ot,
+				log: $
+			}), await Ie.dispose(), await w.close?.();
+		} catch (e) {
+			console.error("serve: shutdown step failed, exiting anyway:", e);
+		}
+	}), await new Promise(() => {}), 0;
+};
+//#endregion
+export { Zi as n, Yi as r, Qi as t };