@voltro/cli 0.43.1 → 0.44.0

package/dist/serveCommand-BlnAlNQg.js

@@ -0,0 +1,1891 @@
+import { t as e } from "./nodeEnvironment-cGFAj1J8.js";
+import { t } from "./frameworkInspectState-CX2250XB.js";
+import { r as n, t as r } from "./appModuleLoader-C9r9mxZt.js";
+import { t as i } from "./bootRefusal-pgvDxlrU.js";
+import { n as a, r as o } from "./startupRunner-CEqQq7ax.js";
+import { $ as s, $t as c, A as l, At as u, B as d, C as ee, Ct as f, D as p, Dt as te, E as ne, Et as m, F as h, Ft as g, G as _, Gt as re, H as ie, I as ae, It as oe, J as se, Jt as v, K as ce, Kt as y, L as le, Lt as ue, M as de, Mt as b, N as fe, Nt as pe, O as me, Ot as he, P as ge, Pt as _e, Q as ve, Qt as ye, R as be, Rt as x, S as xe, Sn as Se, St as Ce, T as we, Tt as Te, U as Ee, Ut as S, V as De, Vt as Oe, W as ke, Wt as Ae, X as je, Xt as Me, Y as Ne, Yt as Pe, Z as Fe, Zt as C, _ as Ie, _n as Le, _t as w, an as Re, at as ze, b as Be, bn as Ve, bt as He, c as Ue, cn as T, ct as We, dn as Ge, dt as Ke, en as qe, et as Je, f as Ye, fn as Xe, ft as Ze, g as Qe, gn as $e, gt as et, h as tt, ht as nt, i as rt, in as it, it as at, j as ot, jt as st, k as ct, kt as lt, ln as E, lt as ut, m as dt, mn as ft, mt as D, nn as O, nt as pt, o as k, on as mt, ot as ht, p as gt, pn as _t, pt as vt, q as yt, qt as bt, r as xt, rn as St, rt as Ct, sn as wt, st as Tt, t as Et, tn as Dt, tt as Ot, u as kt, un as At, ut as jt, v as Mt, vn as A, vt as j, w as M, wt as Nt, x as Pt, xn as Ft, xt as It, y as Lt, yn as Rt, yt as zt, zt as Bt } from "./dev-D-JZ6CGQ.js";
+import { n as Vt } from "./cliArgs-D4p8n7EE.js";
+import { r as Ht } from "./appPort-B_HpJ_ck.js";
+import { ht as Ut, pt as N } from "./webDev-101csg6Q.js";
+import { r as P } from "./dialectDriver-czCHYpeH.js";
+import { i as Wt, n as Gt } from "./connectionConfig-Bk9IC7D0.js";
+import { c as Kt, n as qt, o as Jt } from "./seedRunner-IdHEprqf.js";
+import { C as F, S as Yt, _ as Xt, d as Zt, g as Qt, l as $t, m as en, r as tn, u as nn, v as rn } from "./frameworkTableAssembly-oMPBKqlE.js";
+import { S as an, c as on, n as sn, p as cn, s as ln, x as un } from "./fileConventions-Cof68_BL.js";
+import { h as dn, o as fn } from "./inspect-B7U7Cl_Z.js";
+import { n as pn } from "./mssqlClusterPatch-_4cE_nun.js";
+import { i as mn, n as hn, r as gn, t as _n } from "./webhookDiscovery-CphsQe59.js";
+import { t as vn } from "./inspectMetrics-CfdKLh6t.js";
+import { r as yn, u as bn } from "./apiBuild-DvWreIQP.js";
+import { t as xn } from "./bootTiming-BdyP9nYw.js";
+import { t as Sn } from "./dataProfile-Cm0YVKSy.js";
+import I, { basename as Cn, join as wn } from "node:path";
+import { createWriteStream as Tn, existsSync as En } from "node:fs";
+import { pathToFileURL as Dn } from "node:url";
+import { createLogger as L } from "@voltro/logger";
+import { AuthMiddleware as On, ConnectionInfoMiddleware as kn, actionToRpc as R, anonymousSubject as An, isWireReachable as jn, mutationToRpc as Mn, queryToRpc as z, streamToRpc as Nn, wireErrorUnion as Pn, workflowCancelDescriptor as Fn, workflowDomainEventsQueryDescriptor as B, workflowEventDeliveriesQueryDescriptor as V, workflowResumeDescriptor as In, workflowRunEventsQueryDescriptor as Ln, workflowRunQueryDescriptor as Rn, workflowRunStepsQueryDescriptor as zn, workflowRunsQueryDescriptor as Bn, workflowSignalDescriptor as Vn, workflowUpdateDescriptor as Hn } from "@voltro/protocol";
+import { Cause as Un, Effect as H, Layer as U, ManagedRuntime as Wn } from "effect";
+import { SqlClient as Gn } from "@effect/sql";
+import { declaredSnapshot as Kn, describeOutcome as qn, pendingFileMigrationIds as Jn, runPlannedMigrations as Yn } from "@voltro/database/sql";
+import W from "node:os";
+import { RpcGroup as Xn } from "@effect/rpc";
+import { allRegisteredTables as Zn, and as Qn, connectionIdentity as $n, ensureTableRegistered as er, eq as G, or as tr } from "@voltro/database";
+import { AggregateRegistry as nr, CostRegistry as K, DORMANCY_WAKEUP_TENANT as rr, Dispatcher as ir, ExpectationRegistry as ar, ExperimentRegistry as or, apiKeyManagementRoutes as sr, attachAnalyticsMirror as cr, attachExpectations as lr, attachExperiments as ur, attachFinops as dr, awaitServerListening as fr, bindMutation as q, bindStream as pr, bindSubscription as J, buildTracingLayer as mr, cancelWakeup as hr, compileCron as gr, dataStoreApiKeyStore as _r, formatServerOnlyLeaks as vr, formatUnresolvedSources as yr, frameworkApiKeyStrategy as br, getResourcePolicy as xr, installPolicyGuardResolver as Sr, loadResourceTuples as Cr, makeActionRunner as wr, makeAdvisoryLockCoordinator as Tr, makeApiKeyService as Er, makeApiKeyUsageBuffer as Dr, makeApiKeyUsageFlusher as Or, makeAsyncKv as kr, makeAuthMiddlewareLayers as Ar, makeCoordinatedScheduler as jr, makeEffectStoreLayer as Mr, makeLazyWorkflowFacade as Nr, makeMutationOutputCodec as Pr, makeMutationRunner as Fr, makeOneShotQueryRunner as Ir, makeQueryDescriptorProducer as Lr, makeQueryFinalizer as Rr, makeQueryReauthorizer as Y, makeQuerySubscriber as zr, makeSchemaRegistry as Br, makeWorkflowFacade as Vr, makeWorkflowFacadeWithCallerContext as Hr, makeWorkflowLayers as Ur, noopKv as Wr, onProcessShutdown as Gr, recordSubscriptionDelivery as Kr, recordWorkflowRun as qr, registerDefaultTupleSource as X, registerWakeup as Jr, resolveSecretsBackend as Yr, runProvidedEffect as Xr, setSecretsBackend as Zr, setSystemStoreHandle as Qr, shutdownGraceMsFromEnv as $r, singleCoordinator as ei, startRpcServer as ti, startScheduler as ni, stripForbiddenForWire as ri, undoCaptureEnabled as ii, unresolvedSources as ai, withScopedRequest as oi, workflowToRpc as si, wrapStoreWithBootCodec as ci } from "@voltro/runtime";
+import { appStorageProvider as li, fromNodeReadable as ui, getObjectStream as di, putObjectStream as fi, toNodeReadable as pi } from "@voltro/plugin-storage";
+import { isEnvContract as mi } from "@voltro/env";
+import { assertProductionSessionSecret as hi } from "@voltro/protocol/session";
+import Z from "node:fs/promises";
+import { createHash as gi, timingSafeEqual as _i } from "node:crypto";
+import { buildDeliverWebhookExecute as vi, buildWebhooksService as yi, defaultIncomingPath as bi, deliverWebhookWorkflow as xi, makeDeferredEmitHandler as Si, mountIncomingWebhook as Ci } from "@voltro/plugin-webhooks";
+import { getAuthSessionStrategy as wi } from "@voltro/plugin-auth";
+import { registerEmailTemplates as Ti } from "@voltro/plugin-mail";
+import { channelFor as Ei, getBroadcastPlugin as Di } from "@voltro/plugin-broadcast";
+import { packBundle as Oi, runExport as ki, runImport as Ai, storageBlobSink as ji, storageRefsBlobSource as Mi, unpackBundle as Ni, unpackBundleToDir as Pi } from "@voltro/data-transfer";
+//#region src/serveDrain.ts
+var Fi = () => Math.max(500, Math.floor($r() * .6)), Ii = (e) => new Promise((t) => setTimeout(t, e)), Li = (e) => {
+	let t = /* @__PURE__ */ new Set(), n = /* @__PURE__ */ new Set(), r = 0;
+	e.on("connection", (e) => {
+		t.add(e), e.once("close", () => {
+			t.delete(e), n.delete(e);
+		});
+	}), e.on("upgrade", (e, t) => {
+		n.add(t);
+	}), e.on("request", (e, t) => {
+		r += 1, t.once("close", () => {
+			--r;
+		});
+	});
+	let i, a = async (t = {}) => {
+		let n = t.budgetMs ?? Fi();
+		i ??= new Promise((t) => {
+			e.close(() => {
+				t();
+			});
+		}), e.closeIdleConnections();
+		let a = Date.now() + n;
+		for (; r > 0 && Date.now() < a;) await Ii(25), e.closeIdleConnections();
+		e.closeIdleConnections();
+	}, o = async () => {
+		i ??= new Promise((t) => {
+			e.close(() => {
+				t();
+			});
+		});
+		for (let e of t) if (n.has(e)) try {
+			e.write(Buffer.from([
+				136,
+				2,
+				3,
+				233
+			]));
+		} catch {}
+		else e.destroy();
+		for (let e = 0; t.size > 0 && e < 250; e += 25) await Ii(25);
+		for (let e of t) e.destroy();
+		await i;
+	};
+	return {
+		activeRequests: () => r,
+		drainRequests: a,
+		finish: o,
+		drain: async (e = {}) => {
+			await a(e), await o();
+		}
+	};
+}, Ri = "/_voltro/admin/import", zi = "/_voltro/admin/export", Q = (e, t) => ({
+	status: e,
+	contentType: "application/json; charset=utf-8",
+	body: JSON.stringify(t)
+}), Bi = (e) => {
+	let t = e.authorization ?? e.Authorization, n = t ? /^Bearer\s+(.+)$/i.exec(t) : null;
+	return n ? n[1] : null;
+}, Vi = (e, t) => _i(gi("sha256").update(e).digest(), gi("sha256").update(t).digest()), Hi = (e, t) => {
+	if (e.method.toUpperCase() !== "POST") return Q(405, { error: "method not allowed" });
+	if (!t || t.length < 16) return Q(503, { error: "data transfer misconfigured (no/weak secret)" });
+	let n = Bi(e.headers);
+	return !n || !Vi(n, t) ? Q(401, { error: "unauthorized" }) : null;
+}, Ui = /^[A-Za-z0-9_-]{8,64}$/, Wi = (e) => Ui.test(e), Gi = () => I.join(W.tmpdir(), "voltro-import-uploads"), Ki = (e) => I.join(Gi(), e), qi = (e) => I.join(Ki(e), "archive.bin"), Ji = (e) => I.join(Ki(e), "meta.json"), Yi = async (e = Date.now()) => {
+	let t = 0;
+	try {
+		for (let n of await Z.readdir(Gi())) {
+			let r = await Z.stat(Ki(n)).catch(() => null);
+			r !== null && (e - r.mtimeMs <= 864e5 || (await Z.rm(Ki(n), {
+				recursive: !0,
+				force: !0
+			}).catch(() => void 0), t++));
+		}
+	} catch {}
+	return t;
+}, Xi = async (e) => {
+	if (!Wi(e)) return {
+		bytes: 0,
+		key: null
+	};
+	let t = await Z.stat(qi(e)).catch(() => null);
+	if (t === null) return {
+		bytes: 0,
+		key: null
+	};
+	let n = await Z.readFile(Ji(e), "utf8").then((e) => JSON.parse(e), () => ({}));
+	return {
+		bytes: t.size,
+		key: n.key ?? null
+	};
+}, Zi = async (e) => {
+	if (!Wi(e.id)) return {
+		reason: "bad-id",
+		message: `upload id must match ${String(Ui)}`
+	};
+	let t = await Xi(e.id);
+	return t.key !== null && t.key !== e.key ? {
+		reason: "key-mismatch",
+		message: "this upload id already holds a different bundle. Use a new upload id, or delete the partial upload."
+	} : e.offset === t.bytes ? (await Z.mkdir(Ki(e.id), { recursive: !0 }), t.key === null && await Z.writeFile(Ji(e.id), JSON.stringify({
+		key: e.key,
+		startedAt: (/* @__PURE__ */ new Date()).toISOString()
+	})), await new Promise((t, n) => {
+		let r = Tn(qi(e.id), { flags: "a" });
+		r.on("error", n), r.on("finish", () => t()), r.end(Buffer.from(e.bytes));
+	}), { total: t.bytes + e.bytes.byteLength }) : {
+		reason: "offset-mismatch",
+		message: `chunk starts at ${e.offset} but the server holds ${t.bytes} byte(s)`,
+		expectedOffset: t.bytes
+	};
+}, Qi = async (e) => {
+	let t = await Z.stat(qi(e));
+	return {
+		path: qi(e),
+		bytes: t.size
+	};
+}, $i = async (e) => {
+	Wi(e) && await Z.rm(Ki(e), {
+		recursive: !0,
+		force: !0
+	}).catch(() => void 0);
+}, ea = L({ scope: "voltro:admin-import" }), ta = "VBUNDLE2", na = async function* (e) {
+	yield e;
+}, ra = (e) => async (t) => {
+	let n = Hi(t, e.secret);
+	if (n) return n;
+	let r = t.headers["x-import-mode"], i = t.headers["x-import-on-conflict"], a = t.headers["x-import-atomic"], o = a === "0" || a === "false" ? !1 : a === "1" || a === "true" || r === "replace", s = t.headers["x-import-force"] === "1" || t.headers["x-import-force"] === "true", c = t.headers["x-import-dry-run"] === "1" || t.headers["x-import-dry-run"] === "true", l = (t.headers["x-import-tables"] ?? "").split(",").map((e) => e.trim()).filter(Boolean), u = t.headers["x-import-upload-id"], d;
+	if (u !== void 0 && u !== "") {
+		if (Yi(), t.headers["x-import-probe"] === "1") return Q(200, {
+			uploadId: u,
+			bytes: (await Xi(u)).bytes
+		});
+		let e = t.headers["x-import-upload-key"] ?? "", n = Number(t.headers["x-import-chunk-offset"] ?? "0");
+		if (e === "" || !Number.isFinite(n) || n < 0) return Q(400, { error: "a chunked upload needs x-import-upload-key and a numeric x-import-chunk-offset" });
+		let r = await Zi({
+			id: u,
+			key: e,
+			offset: n,
+			bytes: t.rawBody
+		});
+		if ("reason" in r) return ea.warn("admin.import chunk refused", {
+			uploadId: u,
+			reason: r.reason
+		}), Q(409, {
+			error: "chunk refused",
+			reason: r.reason,
+			message: r.message,
+			...r.expectedOffset === void 0 ? {} : { expectedOffset: r.expectedOffset }
+		});
+		if (t.headers["x-import-chunk-final"] !== "1") return Q(202, {
+			uploadId: u,
+			bytes: r.total
+		});
+		d = (await Qi(u)).path;
+	}
+	let ee = t.rawBody.byteLength >= 8 && Buffer.from(t.rawBody.subarray(0, 8)).toString("latin1") === ta, f, p;
+	if (d !== void 0) {
+		let { createReadStream: e } = await import("node:fs");
+		f = e(d), p = "chunked";
+	} else if (ee) f = na(t.rawBody), p = "upload";
+	else {
+		let n;
+		try {
+			n = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
+		} catch {
+			return Q(400, { error: "body must be a packed bundle archive or { bundleKey } JSON" });
+		}
+		if (typeof n.bundleKey != "string" || !n.bundleKey) return Q(400, { error: "body.bundleKey (string) is required for the storage transport" });
+		if (!e.openArchive) return Q(501, { error: "storage transport not configured on this instance" });
+		f = e.openArchive(n.bundleKey), p = "storage";
+	}
+	let te = await import("node:os"), ne = await import("node:fs/promises"), m = await import("node:path"), h = await ne.mkdtemp(m.join(te.tmpdir(), "voltro-admin-import-"));
+	try {
+		e.assetSink ? await Ni(f, {
+			dir: h,
+			blobs: e.assetSink
+		}) : await Pi(f, h);
+		let t = await H.runPromiseExit(Ai({
+			store: e.store,
+			bundleDir: h,
+			...r ? { mode: r } : {},
+			...i ? { onConflict: i } : {},
+			...o ? { atomic: o } : {},
+			...c ? { dryRun: c } : {},
+			...l.length > 0 ? { tables: l } : {},
+			...e.snapshot ? { targetSnapshot: e.snapshot } : {},
+			force: s,
+			onWarn: (e) => ea.warn("admin.import", { message: e }),
+			...e.assetSink ? { assetsAlreadyRestored: !0 } : {}
+		}));
+		if (t._tag === "Failure") {
+			let e = t.cause._tag === "Fail" ? t.cause.error : void 0;
+			if (e && e._tag === "SchemaDriftError") {
+				let t = e;
+				return ea.warn("admin.import refused (schema drift)", {
+					transport: p,
+					bundle: t.bundleFingerprint.slice(0, 16),
+					target: t.targetFingerprint.slice(0, 16)
+				}), Q(409, {
+					error: "schema drift",
+					bundleFingerprint: t.bundleFingerprint,
+					targetFingerprint: t.targetFingerprint,
+					diff: t.diff,
+					hint: "each line above would break the load: a table or column the bundle carries that the target cannot take, or a column the target requires that the bundle has no value for. Fix the target schema, re-export against it, or resend with x-import-force: 1 to write anyway."
+				});
+			}
+			let n = typeof e?.reason == "string" ? e.reason : void 0;
+			if (n !== void 0 && e._tag === "ImportModeError") return ea.warn("admin.import refused (mode)", {
+				transport: p,
+				mode: e.mode
+			}), Q(409, {
+				error: "import mode refused",
+				mode: e.mode,
+				message: n
+			});
+			throw Error(n ?? String(e?.message ?? e ?? "import failed"));
+		}
+		let n = t.value, a = n.manifest.tables.reduce((e, t) => e + t.rowCount, 0), u = n.rowsWritten;
+		return ea.info(c ? "admin.import (dry run — nothing written)" : "admin.import", {
+			transport: p,
+			tables: n.tablesWritten,
+			rows: u,
+			carried: a,
+			mode: r ?? "upsert",
+			atomic: o,
+			...n.tablesSkipped > 0 ? {
+				skippedTables: n.tablesSkipped,
+				skippedRows: n.rowsSkipped
+			} : {}
+		}), c || e.refreshSubscriptions?.(`data import: ${n.tablesWritten} table(s), mode ${r ?? "upsert"}`), Q(200, {
+			tables: n.tablesWritten,
+			rows: u,
+			carried: a,
+			transport: p,
+			...n.tablesSkipped > 0 ? {
+				skippedTables: n.tablesSkipped,
+				skippedRows: n.rowsSkipped,
+				fullyResumed: n.fullyResumed
+			} : {},
+			...c ? {
+				dryRun: !0,
+				wrote: !1
+			} : {}
+		});
+	} catch (e) {
+		return ea.warn("admin.import failed", {
+			transport: p,
+			error: e?.message ?? String(e)
+		}), Q(500, {
+			error: "import failed",
+			message: e?.message ?? String(e)
+		});
+	} finally {
+		await ne.rm(h, {
+			recursive: !0,
+			force: !0
+		}), u !== void 0 && u !== "" && d !== void 0 && await $i(u);
+	}
+}, ia = L({ scope: "voltro:admin-export" }), aa = async (e) => {
+	let t = [];
+	for await (let n of e) t.push(Buffer.from(n));
+	return new Uint8Array(Buffer.concat(t));
+}, oa = (e) => typeof e.tenant == "string" && e.tenant ? {
+	kind: "tenant",
+	tenantId: e.tenant
+} : Array.isArray(e.tables) && e.tables.length ? {
+	kind: "tables",
+	tables: e.tables.filter((e) => typeof e == "string")
+} : { kind: "all" }, sa = (e) => async (t) => {
+	let n = Hi(t, e.secret);
+	if (n) return n;
+	let r;
+	try {
+		r = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
+	} catch {
+		return Q(400, { error: "body must be JSON: { profile?, tenant?, tables?, consistency?, compression?, bundleKey? }" });
+	}
+	let i = {};
+	if (typeof r.profile == "string" && r.profile) {
+		if (!e.loadProfile) return Q(501, { error: "server-side profiles not configured on this instance" });
+		try {
+			i = await e.loadProfile(r.profile);
+		} catch (e) {
+			return Q(400, {
+				error: `profile '${r.profile}' could not be loaded`,
+				message: e?.message ?? String(e)
+			});
+		}
+	}
+	let a = r.consistency === "snapshot" ? "snapshot" : i.consistency ?? "live", o = (typeof r.compression == "string" ? r.compression : void 0) ?? i.compression, s = i.scope ?? oa(r), c = typeof r.bundleKey == "string" && r.bundleKey.length > 0, l = r.assets === !0 && e.assetSource ? { blobs: e.assetSource } : {}, u = await import("node:os"), d = await import("node:fs/promises"), ee = await import("node:path"), f = await d.mkdtemp(ee.join(u.tmpdir(), "voltro-admin-export-"));
+	try {
+		let t = await H.runPromise(ki({
+			store: e.store,
+			snapshot: e.snapshot,
+			dialect: e.dialect,
+			outDir: f,
+			...i.subset ? { subset: i.subset } : {
+				scope: s,
+				...e.tenantTables && e.tenantTables.length > 0 ? { tenantTables: e.tenantTables } : {}
+			},
+			consistency: a,
+			...o ? { compression: o } : {},
+			...i.masking ? { masking: i.masking } : {}
+		})), n = t.tables.reduce((e, t) => e + t.rowCount, 0), u = t.masking?.transformed.length ?? 0;
+		if (c) {
+			if (!e.putArchive) return Q(501, { error: "storage transport not configured on this instance" });
+			let i = r.bundleKey;
+			return await e.putArchive(i, () => Oi({
+				dir: f,
+				...l
+			})), ia.info("admin.export", {
+				transport: "storage",
+				tables: t.tables.length,
+				rows: n,
+				masked: u,
+				bundleKey: i
+			}), Q(200, {
+				bundleKey: i,
+				tables: t.tables.length,
+				rows: n,
+				masked: u,
+				transport: "storage"
+			});
+		}
+		let d = await aa(Oi({
+			dir: f,
+			...l
+		}));
+		return ia.info("admin.export", {
+			transport: "download",
+			tables: t.tables.length,
+			rows: n,
+			masked: u,
+			bytes: d.byteLength
+		}), {
+			status: 200,
+			contentType: "application/octet-stream",
+			body: d,
+			headers: {
+				"x-export-tables": String(t.tables.length),
+				"x-export-rows": String(n),
+				"x-export-masked": String(u)
+			}
+		};
+	} catch (e) {
+		return ia.warn("admin.export failed", { error: e?.message ?? String(e) }), Q(500, {
+			error: "export failed",
+			message: e?.message ?? String(e)
+		});
+	} finally {
+		await d.rm(f, {
+			recursive: !0,
+			force: !0
+		});
+	}
+}, ca = (e, t, n = {}) => (async function* () {
+	let r = await H.runPromise(di(e, t).pipe(H.timeout(n.openTimeout ?? "30 seconds"))), i = await pi(r.stream), a = n.stallMs ?? 12e4, o, s = () => {
+		o && clearTimeout(o), o = setTimeout(() => i.destroy(/* @__PURE__ */ Error(`storage read stalled for ${a}ms reading '${t}'`)), a);
+	};
+	try {
+		s();
+		for await (let e of i) s(), yield e instanceof Uint8Array ? e : new Uint8Array(e);
+	} finally {
+		o && clearTimeout(o), i.destroy();
+	}
+})(), la = {
+	get: async () => void 0,
+	set: async () => {},
+	setWithTags: async () => {},
+	remove: async () => !1,
+	has: async () => !1,
+	clear: async () => {},
+	invalidateTag: async () => 0,
+	wrap: async (e, t, n) => n()
+}, ua = async (e) => {
+	Bt(e.appProcedures ?? e.discovered, {
+		defaultDeny: e.security?.defaultDeny ?? !0,
+		commandHint: "`voltro serve`"
+	}), Qr({
+		dataStore: e.store,
+		schemaRegistry: e.schemaRegistry
+	});
+	let t = (e.discovered.budgets?.length ?? 0) > 0, n, r = new ir({
+		store: e.store,
+		...e.snapshotCache ? { cache: e.snapshotCache } : {},
+		...e.reactive === void 0 ? {} : { reactive: e.reactive },
+		...t ? { recordCost: (e) => n?.record(e) } : {},
+		recordDelivery: (e) => Kr({
+			label: e.label,
+			kind: e.kind,
+			durationMs: e.durationMs,
+			rowCount: e.rowCount
+		})
+	}), i = e.cache ?? la, a = e.kv ?? Wr, o, c = () => void 0, l, ee, f, p, te, ne, oe, se = re({
+		store: e.store,
+		warn: (e, t) => {
+			process.stderr.write(`[workflow] ${e} ${JSON.stringify(t)}\n`);
+		}
+	}), ce = se.remember, le = se.resolve, ue = y({
+		authority: e.authority,
+		getStore: () => e.store
+	}), b = (e.discovered.workflows?.length ?? 0) > 0 ? Nr(() => o) : void 0, pe = (e.discovered.workflows?.length ?? 0) > 0 || (e.discovered.eventTriggers?.length ?? 0) > 0, me = pe || (e.discovered.workflowWorkers?.length ?? 0) > 0 || e.scheduleCoordination === "cluster", he = e.tenantIsolation === "namespace", ge = (e.log ?? L({ scope: "voltro:serve" })).child("webhooks"), ye, be, x = e.discovered.webhooks;
+	if (x && x.outgoing.length > 0 && e.workflowEngineLayer !== void 0) {
+		e.workflowEngineLayer;
+		let t = T({
+			store: e.store,
+			schemaRegistry: e.schemaRegistry,
+			cache: i,
+			kv: a
+		}), n = x.outgoing.map((e) => e.descriptor);
+		be = xi.toLayer(vi(t, { events: n })), ye = yi(t, async (e) => {
+			let t = f;
+			if (t === void 0) {
+				ge.error("webhook delivery skipped — the workflow runtime was never built. This is a framework defect, not a configuration problem: report it with your engine setting. Deliveries are NOT queued and will not be retried.", {
+					deliveryId: e.deliveryId,
+					targetId: e.targetId
+				});
+				return;
+			}
+			t.runPromise(xi.execute(e)).catch((t) => {
+				ge.error("deliverWebhook workflow crashed", {
+					deliveryId: e.deliveryId,
+					targetId: e.targetId
+				}, t);
+			});
+		}, { events: n });
+	}
+	let xe = /* @__PURE__ */ new Map();
+	if (x) for (let e of x.incoming) {
+		let t = e.descriptor.path ?? bi(e.descriptor.id), n = `VOLTRO_WEBHOOK_SECRET_${e.descriptor.id.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`, r = Ci(e.descriptor, {
+			resolveSecret: async () => process.env[n] ?? null,
+			resolveWorkflows: () => b === void 0 ? void 0 : Hr(b, {
+				traceId: `incoming:${e.descriptor.id}`,
+				source: `incoming:${e.descriptor.id}`
+			}),
+			log: (e) => {
+				let t = {
+					webhookId: e.webhookId,
+					status: e.status,
+					signatureOk: String(e.signatureOk),
+					idempotency: e.idempotency,
+					durationMs: e.durationMs
+				};
+				e.status >= 500 ? ge.error("incoming delivery failed", t) : e.status >= 400 ? ge.warn("incoming delivery rejected", t) : ge.info("incoming delivery handled", t);
+			}
+		});
+		xe.set(t, { handle: r });
+	}
+	Sr(), X((t) => Cr(e.store, t.subjectId, t.resourceType, t.resourceId)) || L({ scope: "voltro:serve" }).info("policy guards: using the app-registered tuple source");
+	let Se = [], Ce = [...e.discovered.outboxHandlers ?? [], ...hn((x?.outgoing.length ?? 0) + (x?.incoming.length ?? 0) + (x?.providers.length ?? 0), []) ? [{
+		file: "<framework>/webhooks",
+		id: "voltro-webhook-emit",
+		definition: Si(() => ye)
+	}] : []], we = Ce.length > 0 ? Me({
+		handlers: Ce,
+		store: e.store,
+		log: (e.log ?? L({ scope: "voltro:serve" })).child("outbox"),
+		onChange: (t) => e.store.onChange((e) => t({
+			table: e.table,
+			op: e.op
+		})),
+		onShutdown: (e) => {
+			Se.push(e);
+		}
+	}) : void 0, S = v({
+		definitions: (e.discovered.connections ?? []).map((e) => e.definition),
+		store: e.store,
+		publicUrl: bt(e.port ?? 4e3),
+		log: (e.log ?? L({ scope: "voltro:serve" })).child("connections")
+	});
+	ot({
+		events: e.discovered.events ?? [],
+		rpcTags: [
+			...e.discovered.queries.map((e) => e.descriptor.name),
+			...e.discovered.mutations.map((e) => e.descriptor.name),
+			...e.discovered.actions.map((e) => e.descriptor.name),
+			...(e.discovered.streams ?? []).map((e) => e.descriptor.name)
+		]
+	});
+	let Oe = (e.log ?? L({ scope: "voltro:serve" })).child("events"), Ae = e.broadcastNamespace ?? Qe(e.plugins, void 0), Ne = Ie(e.plugins, Ae, Oe), Pe = e.membership?.instanceId ?? process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, Le = e.membership ?? Mt(e.plugins, {
+		instanceId: Pe,
+		namespace: Ae,
+		meta: { mode: "serve" },
+		logger: Oe
+	}), w = de({
+		events: e.discovered.events ?? [],
+		origin: Pe,
+		...Ne.publishRemote === void 0 ? {} : { publishRemote: Ne.publishRemote }
+	}), Re = (e.discovered.events ?? []).length > 0 ? await Ne.attach(w.bus) : null, ze = wt({
+		store: e.store,
+		schemaRegistry: e.schemaRegistry,
+		cache: i,
+		kv: a,
+		...ye === void 0 ? {} : { webhooksService: ye },
+		...b === void 0 ? {} : { workflowsProxy: b },
+		eventTriggers: e.discovered.eventTriggers ?? [],
+		namespaceIsolationOn: he,
+		...e.ensureTenantProvisioned === void 0 ? {} : { ensureTenantProvisioned: e.ensureTenantProvisioned },
+		...e.resolveResidentStore === void 0 ? {} : { resolveResidentStore: e.resolveResidentStore },
+		...we === void 0 ? {} : { outbox: { nudge: we.nudge } },
+		...S.active ? { connections: { registry: S.registry } } : {},
+		eventBus: w.bus
+	}), Be = U.succeed(nr, m), Ve = U.succeed(ar, He), Ue = U.succeed(K, zt), Ge = U.succeed(or, It), qe = (t, n) => {
+		let r = t.pipe(H.provide(Mr(n)));
+		return (e.baseLayer ? r.pipe(H.provide(e.baseLayer)) : r).pipe(H.provide(Be)).pipe(H.provide(Ve)).pipe(H.provide(Ue)).pipe(H.provide(Ge));
+	}, Je = (e, t) => {
+		let n = qe(e, t);
+		return Xr(n);
+	}, Ye = vn(), Xe = yt(e.plugins ?? [], Ye), Ze = d({
+		plugins: e.plugins ?? [],
+		metrics: Ye,
+		log: e.log ?? L({ scope: "voltro:serve" })
+	}), $e = _(e.plugins ?? [], Ye), et = e.security?.defaultDeny ?? !0, tt = Fr({
+		store: e.store,
+		defaultDeny: et,
+		recordMetric: (e) => {
+			Ye.record(e);
+		},
+		...Xe.mutation === void 0 ? {} : { interceptor: Xe.mutation },
+		buildContext: (e, t, n) => ze(e, t, n),
+		runEffect: Je,
+		undoCapture: ve()
+	}), rt = Fe();
+	{
+		let t = s();
+		t !== void 0 && (e.log ?? L({ scope: "voltro:serve" })).info(t);
+	}
+	let it = je({
+		store: e.store,
+		...e.approvals === void 0 ? {} : { defaultExpiryMs: e.approvals.defaultExpiryMs }
+	}), at = wr({
+		defaultDeny: et,
+		buildContext: (e) => ze(e),
+		runEffect: Je,
+		recordMetric: (e) => {
+			Ye.record(e);
+		},
+		...Xe.action === void 0 ? {} : { interceptor: Xe.action }
+	}), ct = Rr({
+		tenantScopedTables: e.tenantScopedTables,
+		softDeleteScopedTables: e.softDeleteScopedTables
+	}), lt = {
+		defaultDeny: et,
+		buildContext: (e) => ze(e),
+		finalize: (e, t) => ct(e, t.subject),
+		provideEffect: qe,
+		...Xe.query === void 0 ? {} : { interceptor: Xe.query }
+	}, E = Lr(lt), dt = Ir({
+		...lt,
+		queryRows: (t, n) => e.store.query(t).then((e) => ri(t.table, e, n.subject))
+	}), ft = zr({
+		...lt,
+		subscribeDescriptor: (e, t, n) => r.subscribe(e, t, n),
+		subscribeComputed: (e, t, n) => r.subscribeComputed(e, t, n)
+	}), D = (e) => e.filter((e) => jn(e.descriptor)), O = {};
+	for (let t of [
+		...D(e.discovered.queries),
+		...rt.queries,
+		...it.queries,
+		...S.queries
+	]) O[t.descriptor.name] = (e) => J(E(t, e), r, `subscription.${t.descriptor.name}`, void 0, void 0, Y(t, e));
+	for (let t of [
+		...D(e.discovered.mutations),
+		...rt.mutations,
+		...it.mutations,
+		...S.mutations
+	]) {
+		let n = Pr(t.descriptor.output);
+		O[t.descriptor.name] = (r) => q(async (e, n) => tt(t, e, n), r, `mutation.${t.descriptor.name}`, n, e.idempotency, Pn(t.descriptor, "mutation"));
+	}
+	for (let t of [...D(e.discovered.actions), ...S.actions]) {
+		let n = Pr(t.descriptor.output);
+		O[t.descriptor.name] = (r) => q(async (e, n) => at(t, e, n), r, `action.${t.descriptor.name}`, n, e.idempotency, Pn(t.descriptor, "action"));
+	}
+	let pt = () => `public-${Math.random().toString(36).slice(2, 10)}`, k = [
+		...e.discovered.queries.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => dt(e, t, {
+				subject: n.subject,
+				traceId: pt()
+			}),
+			subscribe: (t, n, r) => ft(e, t, {
+				subject: n.subject,
+				traceId: pt()
+			}, r)
+		})),
+		...e.discovered.mutations.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => tt(e, t, {
+				subject: n.subject,
+				traceId: pt()
+			})
+		})),
+		...e.discovered.actions.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => at(e, t, {
+				subject: n.subject,
+				traceId: pt()
+			})
+		}))
+	], ht = {
+		candidates: g({
+			queries: e.discovered.queries,
+			mutations: e.discovered.mutations,
+			actions: e.discovered.actions,
+			descriptorOf: (e) => e.descriptor,
+			runQuery: (e, t, n) => Promise.resolve(dt(e, t, n)),
+			runMutation: (e, t, n) => Promise.resolve(tt(e, t, n)),
+			runAction: (e, t, n) => Promise.resolve(at(e, t, n))
+		}),
+		policy: e.agents?.tools ?? {},
+		mcpEnabled: e.agents?.mcp === !0,
+		resolveSubject: (t) => e.resolveSubject(t, -1).then((e) => e.subject)
+	}, gt = Dt({
+		...e.restRoutes === void 0 ? {} : { restRoutes: e.restRoutes },
+		publicApiEntries: k,
+		store: e.store,
+		resolveSubject: (t) => e.resolveSubject(t, -1).then((e) => e.subject),
+		...e.idempotency === void 0 ? {} : { idempotency: e.idempotency },
+		log: e.log ?? L({ scope: "voltro:serve" })
+	}), _t = e.dataTransferSecret ?? process.env.VOLTRO_DATA_TRANSFER_SECRET, vt = _t && _t.length >= 16 ? [{
+		method: "POST",
+		path: Ri,
+		handle: ra({
+			secret: _t,
+			store: e.store,
+			...e.dataTransferSnapshot ? { snapshot: e.dataTransferSnapshot } : {},
+			assetSink: ji(li()),
+			openArchive: (e) => ca(li(), e),
+			refreshSubscriptions: (e) => {
+				r.refreshAll(e);
+			}
+		})
+	}, {
+		method: "POST",
+		path: zi,
+		handle: sa({
+			secret: _t,
+			store: e.store,
+			snapshot: e.dataTransferSnapshot ?? { tables: [] },
+			dialect: e.dataTransferDialect ?? "memory",
+			tenantTables: [...e.tenantScopedTables],
+			loadProfile: Sn,
+			assetSource: Mi(li(), e.store),
+			putArchive: async (e, t) => {
+				let { Readable: n } = await import("node:stream"), r = li(), i = ui("storage", () => n.from(t()));
+				await H.runPromise(fi(r, e, i, { contentType: "application/octet-stream" }));
+			}
+		})
+	}] : [], xt = [
+		...e.httpRoutes ?? [],
+		...gt.httpRoutes,
+		...vt,
+		...S.httpRoutes
+	];
+	Object.assign(O, w.handlers);
+	for (let t of D(e.discovered.streams ?? [])) O[t.descriptor.name] = (n) => pr((r) => oi(r, (r) => {
+		let i = ze(r), a = t.executor(n, i);
+		if (H.isEffect(a)) {
+			let t = a.pipe(H.provide(Mr(i.store)));
+			return (e.baseLayer ? t.pipe(H.provide(e.baseLayer)) : t).pipe(H.provide(Be)).pipe(H.provide(Ve)).pipe(H.provide(Ue)).pipe(H.provide(Ge));
+		}
+		return typeof a == "object" && a && typeof a.then == "function" ? H.promise(() => a) : a;
+	}), `stream.${t.descriptor.name}`);
+	for (let t of e.discovered.workflows ?? []) O[t.definition.name] = (e) => q(async (e, n) => {
+		let r = n;
+		return Hr(b, {
+			subject: r.subject,
+			traceId: r.traceId,
+			source: "workflow-rpc"
+		}).start(t.definition.name, e);
+	}, e, `workflow.${t.definition.name}`);
+	pe && (O[Rn.name] = (e) => J(E({
+		descriptor: Rn,
+		executor: (e) => {
+			let t = e.id;
+			return {
+				table: "_voltro_workflow_runs",
+				order: [{
+					column: "startedAt",
+					direction: "desc"
+				}],
+				predicate: tr(G("id", t), G("executionId", t)),
+				take: 1,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${Rn.name}`), O[Bn.name] = (e) => J(E({
+		descriptor: Bn,
+		executor: (e) => {
+			let t = e, n = [...t.tag === void 0 ? [] : [G("tag", t.tag)], ...t.status === void 0 ? [] : [G("status", t.status)]], r = Number.isFinite(t.limit) && t.limit !== void 0 ? Math.min(Math.max(Math.floor(t.limit), 1), 500) : 100;
+			return {
+				table: "_voltro_workflow_runs",
+				order: [{
+					column: "startedAt",
+					direction: "desc"
+				}],
+				predicate: n.length === 0 ? void 0 : n.length === 1 ? n[0] : Qn(...n),
+				take: r,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${Bn.name}`), O[zn.name] = (e) => J(E({
+		descriptor: zn,
+		executor: (e) => {
+			let t = e.runId;
+			return {
+				table: "_voltro_workflow_run_steps",
+				order: [{
+					column: "startedAt",
+					direction: "asc"
+				}],
+				predicate: G("runId", t),
+				take: 1e3,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${zn.name}`), O[Ln.name] = (e) => J(E({
+		descriptor: Ln,
+		executor: (e) => {
+			let t = e.runId;
+			return {
+				table: "_voltro_workflow_run_events",
+				order: [{
+					column: "occurredAt",
+					direction: "asc"
+				}],
+				predicate: G("runId", t),
+				take: 1e3,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${Ln.name}`), O[B.name] = (e) => J(E({
+		descriptor: B,
+		executor: (e) => {
+			let t = e;
+			return {
+				table: "_voltro_workflow_events",
+				order: [{
+					column: "occurredAt",
+					direction: "desc"
+				}],
+				predicate: t.name === void 0 ? void 0 : G("name", t.name),
+				take: Math.max(1, Math.min(500, t.limit ?? 100)),
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${B.name}`), O[V.name] = (e) => J(E({
+		descriptor: V,
+		executor: (e) => {
+			let t = e.eventId;
+			return {
+				table: "_voltro_workflow_event_deliveries",
+				order: [{
+					column: "createdAt",
+					direction: "asc"
+				}],
+				predicate: G("eventId", t),
+				take: 500,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${V.name}`), O[Fn.name] = (t) => q(async (t, n) => {
+		let r = t;
+		return await mt(e.store, n.subject, { executionId: r.executionId }), await b.cancel(r.workflowName, r.executionId), await Pt(r.workflowName, r.executionId, "workflow.cancel"), { ok: !0 };
+	}, t, `action.${Fn.name}`), O[In.name] = (t) => q(async (t, n) => {
+		let r = t;
+		return await mt(e.store, n.subject, { executionId: r.executionId }), await b.resume(r.workflowName, r.executionId), { ok: !0 };
+	}, t, `action.${In.name}`), O[Vn.name] = (t) => q(async (t, n) => {
+		let r = t;
+		return await mt(e.store, n.subject, { id: r.id }), b.signal({ id: r.id }, r.signalName, r.payload);
+	}, t, `action.${Vn.name}`), O[Hn.name] = (t) => q(async (t, n) => {
+		let r = t;
+		return await mt(e.store, n.subject, { id: r.id }), b.update({ id: r.id }, r.updateName, r.payload, r.timeoutMs === void 0 ? void 0 : { timeoutMs: r.timeoutMs });
+	}, t, `action.${Hn.name}`));
+	let Ct = [
+		...D(e.discovered.queries).map((e) => z(e.descriptor)),
+		...D(e.discovered.mutations).map((e) => Mn(e.descriptor)),
+		...D(e.discovered.actions).map((e) => R(e.descriptor)),
+		...rt.queries.map((e) => z(e.descriptor)),
+		...rt.mutations.map((e) => Mn(e.descriptor)),
+		...it.queries.map((e) => z(e.descriptor)),
+		...it.mutations.map((e) => Mn(e.descriptor)),
+		...S.queries.map((e) => z(e.descriptor)),
+		...S.mutations.map((e) => Mn(e.descriptor)),
+		...S.actions.map((e) => R(e.descriptor)),
+		...D(e.discovered.streams ?? []).map((e) => Nn(e.descriptor)),
+		...w.rpcs,
+		...(e.discovered.workflows ?? []).map((e) => si(e.definition)),
+		...pe ? [
+			z(Rn),
+			z(Bn),
+			z(zn),
+			z(Ln),
+			z(B),
+			z(V),
+			R(Fn),
+			R(In),
+			R(Vn),
+			R(Hn)
+		] : []
+	], Et = Xn.make(...Ct).middleware(On).middleware(kn), Ot = Ar({ resolveSubject: ({ headers: t, clientId: n }) => e.resolveSubject(t, n) }), kt = e.dormancyTenantId ?? rr, At = e.dormancy === "sleep" ? {
+		register: (t, n, r) => Jr(e.store, {
+			tenantId: r ?? kt,
+			kind: "workflow",
+			refId: t,
+			wakeAt: n
+		}),
+		cancel: (t, n) => hr(e.store, {
+			tenantId: n ?? kt,
+			kind: "workflow",
+			refId: t
+		}).then(() => {})
+	} : void 0, j = me ? await import("@voltro/workflow") : void 0, M = j?.makeWorkflowRunRecorder({
+		store: e.store,
+		...e.workflowRecording === void 0 ? {} : { recording: e.workflowRecording },
+		...At === void 0 ? {} : { wakeups: At }
+	}), Nt = async (t, n) => {
+		await j.closeWorkflowChildrenForParent({
+			store: e.store,
+			parentExecutionId: t,
+			parentStatus: n,
+			recorder: M,
+			log: { warn: (e, t) => {
+				process.stderr.write(`[workflow] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+			} },
+			interruptChild: async (t, n) => {
+				let r = (e.discovered.workflows ?? []).find((e) => e.definition.name === t);
+				if (!r) throw Error(`Unknown child workflow: ${t}`);
+				if (!f) throw Error("Workflow runtime is not ready");
+				await f.runPromise(r.definition.interrupt(n));
+			}
+		});
+	}, Pt = async (t, n, r) => {
+		let i = (await e.store.query({
+			table: "_voltro_workflow_runs",
+			order: [],
+			predicate: G("executionId", n),
+			projection: void 0,
+			skip: void 0,
+			take: 1
+		}))[0];
+		if (i === void 0) return;
+		let a = await e.store.update("_voltro_workflow_runs", i.id, {
+			status: "cancelled",
+			cancelled: !0,
+			completedAt: /* @__PURE__ */ new Date()
+		}), o = i.subject?.tenantId ?? void 0;
+		a && await M.recordEvent({
+			runId: i.id,
+			eventType: "run-cancelled",
+			payload: {
+				reason: r,
+				workflowName: t,
+				executionId: n,
+				...o == null ? {} : { tenantId: o }
+			}
+		}), a && await Nt(n, "cancelled");
+	}, Ft = [
+		...Ur(e.discovered.workflows ?? [], {
+			buildContext: (t, n) => e.buildContextForWorkflow?.(t, n) ?? ze({
+				subject: t.subject,
+				traceId: t.traceId
+			}, e.store, void 0, `workflow:${n.workflowName}`, { parentExecutionId: n.executionId }),
+			resolveStartContext: le,
+			...ue === void 0 ? {} : { resolveAuthority: ue }
+		}, (t, n, r) => {
+			let i = j.getWorkflowVersionMetadata(t.definition);
+			return j.wrapWorkflowExecuteWithRunRecording({
+				name: t.definition.name,
+				store: e.store,
+				subject: r.subject,
+				source: r.source ?? null,
+				traceId: r.traceId,
+				workflowVersion: i.version,
+				workflowCompatibleVersions: i.compatibleWith,
+				workflowPatches: i.patches,
+				parentExecutionId: r?.parentExecutionId ?? null,
+				parentClosePolicy: r?.parentClosePolicy ?? null,
+				onParentClose: ({ executionId: e, status: t }) => Nt(e, t),
+				...We(t.definition),
+				onTerminal: async ({ executionId: e }) => {
+					await ee?.gate.release(e);
+				},
+				recorder: M,
+				pluginWorkflowStepLayer: $e,
+				recordRun: qr
+			}, n);
+		}),
+		...e.discovered.workflowWorkers ?? [],
+		...be === void 0 ? [] : [be]
+	], Lt = [...(e.discovered.workflows ?? []).map((e) => e.definition.name).filter(Boolean), ...be === void 0 ? [] : ["voltro.deliverWebhook"]], Rt = Ft.length > 0 ? U.mergeAll(...Ft) : U.empty;
+	if (((e.discovered.workflows?.length ?? 0) > 0 || (e.discovered.workflowWorkers?.length ?? 0) > 0 || e.scheduleCoordination === "cluster" || be !== void 0) && e.workflowEngineLayer !== void 0) {
+		let t = Rt.pipe(U.provideMerge(e.workflowEngineLayer));
+		f = Wn.make(e.baseLayer === void 0 ? t : t.pipe(U.provideMerge(e.baseLayer))), await f.runPromise(H.void), (e.log ?? L({ scope: "voltro:serve" })).child("workflow").info(`workflow runtime ready — ${Lt.length} entity type(s) registered`, { entities: Lt });
+		let n = await import("@voltro/workflow/cluster"), r = (e) => f.runPromise(n.redriveFailedRun(e)), i = (e) => f.runPromise(n.resumeRunFromStep(e));
+		ne = await A({
+			provider: Di(e.plugins ?? [])?.broadcast?.provider,
+			crossReplica: Di(e.plugins ?? [])?.broadcast?.crossReplica ?? !1,
+			namespace: Ae,
+			replicaId: crypto.randomUUID(),
+			pollStorage: () => f.runPromise(n.pollWorkflowStorage),
+			onChange: (t) => e.store.onChange((e) => t({
+				table: e.table,
+				op: e.op,
+				...e.origin === void 0 ? {} : { origin: e.origin }
+			})),
+			log: (e.log ?? L({ scope: "voltro:serve" })).child("workflow")
+		}), p = async (t) => {
+			let n = await ie({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runRedrive: r
+			}, t.runId);
+			return n.statusReset && await M.recordEvent({
+				runId: t.runId,
+				eventType: "run-redriven",
+				payload: {
+					reason: "inspect.redrive",
+					activitiesReset: n.outcome.activitiesReset
+				}
+			}), {
+				redriven: n.outcome.redriven,
+				activitiesReset: n.outcome.activitiesReset,
+				reason: n.outcome.reason
+			};
+		}, te = async (t) => {
+			let n = await Ee({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runResume: i
+			}, t.runId, t.step);
+			return n.statusReset && await M.recordEvent({
+				runId: t.runId,
+				eventType: "run-redriven",
+				payload: {
+					reason: "inspect.resume-from-step",
+					step: n.stepName,
+					activitiesReset: n.outcome.activitiesReset
+				}
+			}), {
+				redriven: n.outcome.redriven,
+				stepName: n.stepName,
+				activitiesReset: n.outcome.activitiesReset,
+				reason: n.outcome.reason
+			};
+		};
+		let a = (e.scheduleCoordination ?? "single") === "advisoryLock" ? Tr(e.store, e.scheduleReplicaId ?? `pid-${process.pid}`) : ei, s = jr({
+			coordinator: a,
+			replicaId: e.scheduleReplicaId ?? `pid-${process.pid}`
+		}), u = {
+			info: (e, t) => {
+				process.stdout.write(`[flow-control] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+			},
+			warn: (e, t) => {
+				process.stderr.write(`[flow-control] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+			},
+			error: (e, t) => {
+				process.stderr.write(`[flow-control] ERROR ${e} ${t ? JSON.stringify(t) : ""}\n`);
+			}
+		}, d, m = () => {
+			if (d !== void 0) return d;
+			if (o !== void 0 && M !== void 0) return d = h({
+				store: e.store,
+				log: F,
+				workflows: e.discovered.workflows ?? [],
+				workflowsProxy: o,
+				workflowRuntime: f,
+				workflowRunRecorder: M,
+				closeChildrenForParent: Nt
+			}), d;
+		};
+		c = m, ee = nt({
+			store: e.store,
+			onChange: (t) => e.store.onChange((e) => t({
+				table: e.table,
+				op: e.op
+			})),
+			...e.scheduling === void 0 ? {} : {
+				disarmWhenIdle: e.scheduling.disarmWhenIdle,
+				drainIntervalMs: e.scheduling.admissionDrainMs,
+				cancelSweepIntervalMs: e.scheduling.cancelSweepMs,
+				stalenessSweepIntervalMs: e.scheduling.stalenessSweepMs
+			},
+			workflows: e.discovered.workflows ?? [],
+			facade: () => o,
+			cancelRunWithReason: m,
+			recordRunEvent: () => M?.recordEvent,
+			...e.workflowStaleness === void 0 ? {} : { staleness: e.workflowStaleness },
+			...e.workflowSuspendSignalHintMs === void 0 ? {} : { suspendSignalHintMs: e.workflowSuspendSignalHintMs },
+			scheduleCoordinated: s,
+			onAbandoned: async (t) => {
+				await Tt({
+					workflows: e.discovered.workflows ?? [],
+					facade: () => o,
+					log: u,
+					...t
+				});
+			},
+			log: u
+		});
+		let g = ee;
+		g !== void 0 && Gr(() => g.stop()), l = Ke({
+			store: e.store,
+			onChange: (t) => e.store.onChange((e) => t({
+				table: e.table,
+				op: e.op
+			})),
+			...e.scheduling === void 0 ? {} : {
+				disarmWhenIdle: e.scheduling.disarmWhenIdle,
+				tickIntervalMs: e.scheduling.inferenceTickMs
+			},
+			enabled: (e.discovered.workflows?.length ?? 0) > 0,
+			resumeSignal: () => f === void 0 || j === void 0 ? void 0 : async ({ executionId: t, workflowName: n, signalName: r, payload: i }) => {
+				await f.runPromise(j.completeSuspendingSignal({
+					store: e.store,
+					target: jt(t, n),
+					signalName: r,
+					payload: i
+				}));
+			},
+			runEffect: (e) => f.runPromise(e),
+			scheduleCoordinated: s,
+			log: u
+		});
+		let _ = l;
+		_ !== void 0 && Gr(() => _.stop()), o = (e.discovered.workflows?.length ?? 0) > 0 ? Vr({
+			workflows: e.discovered.workflows ?? [],
+			runEffect: (e) => f.runPromise(e),
+			onEnqueue: () => ne?.publishWake(),
+			...g === void 0 ? {} : {
+				admitStart: g.gate.admitStart,
+				startPayloadSchema: g.gate.startPayloadSchema,
+				parkDelayedStart: g.gate.parkDelayed
+			},
+			rememberStartContext: ce,
+			signal: async (t, n, r) => {
+				let i = await j.sendWorkflowSignal({
+					store: e.store,
+					recorder: M,
+					target: t,
+					signalName: n,
+					payload: r
+				});
+				return await f.runPromise(j.completeSuspendingSignal({
+					store: e.store,
+					target: t,
+					signalName: n,
+					payload: r
+				})).catch(() => {}), i;
+			},
+			update: (t, n, r, i) => j.sendWorkflowUpdate({
+				store: e.store,
+				recorder: M,
+				target: t,
+				updateName: n,
+				payload: r,
+				...i === void 0 ? {} : { options: i }
+			}),
+			listRuns: (t) => De(e.store, t),
+			retry: (t, n) => ke({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runPromise: (e) => f.runPromise(e)
+			}, t, n),
+			redrive: (t) => ie({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runRedrive: r
+			}, t).then((e) => e.outcome)
+		}) : void 0;
+	}
+	let Vt = U.mergeAll(Et.toLayer(O), Ot), Ht = St(O, e.discovered.queries.map((e) => e.descriptor.name), pe), Ut = U.mergeAll(Et.toLayer(Ht), Ot), N = e.observability, P = await mr({
+		...e.appName === void 0 ? {} : { serviceName: e.appName },
+		...N && N.spanProcessors.length > 0 ? { extraSpanProcessors: N.spanProcessors } : {},
+		...N && N.metricReaders.length > 0 ? { extraMetricReaders: N.metricReaders } : {},
+		...N && Object.keys(N.resourceAttributes).length > 0 ? { resourceAttributes: N.resourceAttributes } : {},
+		...N && N.sampler !== void 0 ? { sampler: N.sampler } : {}
+	}), Wt = !1, Gt = e.store.ping ? () => e.store.ping().then(() => !0).catch(() => !1) : void 0, { server: Kt, shutdown: qt } = ti({
+		group: Et,
+		handlersLayer: Vt,
+		httpHandlersLayer: Ut,
+		port: e.port ?? 4e3,
+		...e.host === void 0 ? {} : { host: e.host },
+		path: e.path ?? "/ws",
+		tracerLayer: P.layer,
+		security: _e(e),
+		...Ze,
+		healthCheck: {
+			isReady: () => Wt,
+			...Gt ? { ping: Gt } : {}
+		},
+		...xt.length > 0 ? { httpRoutes: xt } : {},
+		...e.getStore === void 0 ? {} : { getStore: e.getStore },
+		...xe.size > 0 ? { webhookRoutes: xe } : {},
+		...e.inspectRoute === void 0 ? {} : { inspectRoute: e.inspectRoute }
+	}), Jt = Li(Kt);
+	if (await fr(Kt), (e.discovered.schedules?.length ?? 0) > 0) {
+		let t = (e.scheduleCoordination ?? "single") === "advisoryLock" ? Tr(e.store, e.scheduleReplicaId ?? `pid-${process.pid}`) : ei;
+		oe = await ni(e.discovered.schedules ?? [], {
+			store: e.store,
+			coordinator: t,
+			defaultTrigger: e.scheduleDefaultTrigger ?? "self",
+			replicaId: e.scheduleReplicaId ?? `pid-${process.pid}`,
+			armSelf: e.scheduleArmSelf ?? !0,
+			dormancy: e.dormancy ?? "always-on",
+			...e.dormancyTenantId === void 0 ? {} : { dormancyTenantId: e.dormancyTenantId },
+			buildContext: ({ traceId: t, scheduleName: n, subject: r }) => ze({
+				subject: r,
+				traceId: t
+			}, e.store, void 0, `schedule:${n}`),
+			log: {
+				info: (e, t) => {
+					process.stdout.write(`[schedule] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+				},
+				warn: (e, t) => {
+					process.stderr.write(`[schedule] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+				},
+				error: (e, t) => {
+					process.stderr.write(`[schedule] ERROR ${e} ${t ? JSON.stringify(t) : ""}\n`);
+				},
+				debug: () => {}
+			},
+			...e.scheduleFireInterceptor === void 0 ? {} : { interceptFire: e.scheduleFireInterceptor },
+			...e.onScheduleRunEvent === void 0 ? {} : { onRunEvent: e.onScheduleRunEvent }
+		}), e.onSchedulerReady?.(oe);
+	}
+	let F = e.log ?? L({ scope: "voltro:serve" }), Yt, Xt;
+	if ((e.discovered.subscribers?.length ?? 0) > 0 && (Yt = C(e.discovered.subscribers ?? [], e.store, F.child("subscribe"), e.schemaRegistry, w.bus)), (e.discovered.reactions?.length ?? 0) > 0) {
+		let t = F.child("reaction"), n = async (n, r) => {
+			if (n.kind === "workflow") {
+				if (b === void 0) {
+					t.warn("reaction workflow act skipped — no workflow engine in this app", { workflow: n.workflow });
+					return;
+				}
+				let e = n.payload === void 0 ? r.new ?? r.old ?? {} : n.payload(r);
+				await Hr(b, {
+					traceId: `reaction:${n.workflow}`,
+					source: `reaction:${n.workflow}`
+				}).start(n.workflow, e);
+				return;
+			}
+			await st(n.agent, r, {
+				findAgentSend: (t) => e.discovered.actions.find((e) => e.descriptor.name === `${t}.send`),
+				runAction: (e, t, n) => Promise.resolve(at(e, t, n)),
+				makeSubject: (e) => An(e),
+				now: () => Date.now(),
+				log: t
+			});
+		}, r = async (n, r) => {
+			try {
+				let { requireAiBudget: t } = await import("@voltro/ai");
+				return (await H.runPromise(H.either(t(e.store, {
+					tenantId: n,
+					limitUsd: r
+				}))))._tag === "Right";
+			} catch (e) {
+				return t.warn("reaction budget check failed — refusing the act", { tenantId: n }, e), !1;
+			}
+		}, i = ut(e.store, { onError: (e) => t.warn("reaction: rate-slot claim failed; refusing the act", { cause: String(e) }) });
+		Xt = u(e.discovered.reactions ?? [], e.store, {
+			runAct: n,
+			checkBudget: r,
+			claimRateSlot: (e) => i.claim(e)
+		}, t);
+	}
+	let Zt;
+	(e.discovered.aggregates?.length ?? 0) > 0 && (Zt = await Te({
+		discovered: e.discovered.aggregates ?? [],
+		store: e.store,
+		log: F.child("aggregate"),
+		...e.analytics === void 0 ? {} : { analytics: e.analytics },
+		...e.aggregateStorage === void 0 ? {} : { storage: e.aggregateStorage },
+		...e.aggregateCoordinator === void 0 ? {} : { coordinator: e.aggregateCoordinator }
+	}), Be = U.succeed(nr, Zt.registry));
+	let Qt;
+	(e.discovered.expectations?.length ?? 0) > 0 && (Qt = lr({
+		discovered: e.discovered.expectations ?? [],
+		store: e.store,
+		log: F.child("expectation")
+	}), Ve = U.succeed(ar, Qt.registry)), (e.discovered.budgets?.length ?? 0) > 0 && (n = dr({
+		discovered: e.discovered.budgets ?? [],
+		log: F.child("finops")
+	}), Ue = U.succeed(K, n.registry));
+	let $t;
+	return (e.discovered.experiments?.length ?? 0) > 0 && ($t = ur({
+		discovered: e.discovered.experiments ?? [],
+		store: e.store,
+		log: F.child("experiment")
+	}), Ge = U.succeed(or, $t.registry)), Wt = !0, e.bootTiming?.mark("ready"), {
+		dispatcher: r,
+		server: Kt,
+		scheduler: oe,
+		eventsSnapshot: fe(w.bus, w.declared),
+		membersSnapshot: () => ({
+			members: Le.membership.list(),
+			capturedAt: Date.now()
+		}),
+		agentTools: () => ht,
+		rpcMetrics: () => Ye,
+		webhooksService: () => ye,
+		runCanceller: () => c(),
+		flowControlHealth: () => ee?.cancelHealth(),
+		inferenceHealth: () => l?.health(),
+		workflowWriteActions: () => b === void 0 || M === void 0 ? void 0 : ae({
+			store: e.store,
+			log: F,
+			workflows: e.discovered.workflows ?? [],
+			workflowsProxy: o,
+			workflowRuntime: f,
+			workflowRunRecorder: M,
+			closeChildrenForParent: Nt
+		}),
+		redriveWorkflowRun: (e) => p ? p(e) : Promise.reject(/* @__PURE__ */ Error("redrive: this app registers no workflows")),
+		resumeWorkflowRunFromStep: (e) => te ? te(e) : Promise.reject(/* @__PURE__ */ Error("resume-from-step: this app registers no workflows")),
+		close: async () => {
+			Wt = !1, await Jt.drainRequests();
+			for (let e of Se) try {
+				await e();
+			} catch (e) {
+				F.warn("serve: teardown step failed", {}, e);
+			}
+			await Re?.detach(), await Le.detach(), Zt?.detach(), Qt?.detach(), n?.detach(), $t?.detach(), Xt?.(), Yt?.(), await oe?.shutdown(), r.close(), await ne?.detach(), await f?.dispose(), await qt(), await Jt.finish();
+		}
+	};
+}, $ = L({ scope: "voltro:serve" }), da = (e, t, n) => (e === "production" || e === "staging") && t !== "memory" && n !== "0", fa = Vt, pa = async (e) => {
+	let t = bn(process.cwd());
+	if (En(t)) {
+		let n;
+		try {
+			let e = await import(Dn(t).href);
+			typeof e.runServe == "function" ? n = e.runServe : $.warn("serve bundle has no runServe export — using the standard serve path");
+		} catch (e) {
+			$.warn("serve bundle failed to load — using the standard serve path", {}, e);
+		}
+		if (n) return $.info("serve: booting from the precompiled serve bundle"), n(e);
+	}
+	return ma(e);
+}, ma = async (s) => {
+	let u = xn();
+	e("serve");
+	try {
+		hi();
+	} catch (e) {
+		throw i(e instanceof Error ? e.message : String(e));
+	}
+	let d = process.cwd(), m = await Ue(d), h = Ht({
+		kind: "api",
+		configPort: m?.port,
+		env: process.env,
+		flagPort: fa(s, "--port")
+	});
+	for (let e of h.warnings) $.warn(e);
+	let g = h.port;
+	Zr(Yr(m?.secrets)), await Ut({
+		rawEnv: m?.env,
+		appType: "api",
+		root: d,
+		log: $,
+		generateTypes: !1
+	}), u.mark("config");
+	let _ = (process.env.DB_DIALECT ?? m?.store ?? "memory").toLowerCase(), re = (_ === "mariadb" || _ === "postgres" || _ === "mssql") && (process.env.CDC ?? "1") !== "0", ie = _ === "mariadb" ? "mariadb" : _ === "mssql" ? "mssql" : void 0, ae = yn(d);
+	if (!r() && En(ae)) try {
+		let e = await import(Dn(ae).href);
+		if (e.modules) {
+			let t = {};
+			for (let [n, r] of Object.entries(e.modules)) t[wn(d, n)] = r;
+			n(t), $.info("precompiled api bundle loaded", { modules: Object.keys(t).length });
+		}
+	} catch (e) {
+		$.warn("precompiled api bundle failed to load — falling back to source", {}, e);
+	}
+	let v = await Ye(d), y = await kt(v, { cdc: re && ie !== void 0 }), de = x(y);
+	{
+		let e = /* @__PURE__ */ new Set([
+			...y.queries.filter((e) => e.descriptor.overridesPlugin === !0).map((e) => e.descriptor.name),
+			...y.mutations.filter((e) => e.descriptor.overridesPlugin === !0).map((e) => e.descriptor.name),
+			...y.actions.filter((e) => e.descriptor.overridesPlugin === !0).map((e) => e.descriptor.name)
+		]);
+		Yt(F(m?.plugins ?? []), [
+			...y.queries.map((e) => e.descriptor.name),
+			...y.mutations.map((e) => e.descriptor.name),
+			...y.actions.map((e) => e.descriptor.name),
+			...y.streams.map((e) => e.descriptor.name)
+		], e);
+		let t = Ae(y.serverOnlyLeaks, S(process.env, "strict"), vr, "`voltro serve`");
+		if (t.action === "fail") throw i(t.message ?? "");
+		t.action === "warn" && $.warn(t.message ?? "");
+	}
+	let fe = v.filter((e) => _n.test(e)), ve = fe.length > 0 ? await gn(fe, $.child("webhooks")) : {
+		outgoing: [],
+		incoming: [],
+		providers: []
+	}, Te = mn(y.events), Ee = ve.outgoing.length + ve.incoming.length + ve.providers.length + Te.length === 0 ? void 0 : {
+		...ve,
+		outgoing: [...ve.outgoing, ...Te]
+	}, De = nn({
+		nodeEnv: process.env.NODE_ENV,
+		cdcDialect: ie,
+		declared: m?.schema
+	}), ke = Zt({
+		gates: De,
+		runtime: {
+			traces: ge(),
+			undo: ii()
+		}
+	});
+	if (ke !== void 0) throw i(`serve: ${ke}`);
+	let je = tn({
+		mix: y.featureMix,
+		plugins: m?.plugins ?? [],
+		gates: De,
+		...ie ? { cdcDialect: ie } : {}
+	}), Me = m?.analytics !== void 0 && m.analytics.kind !== "noop" && _ !== "memory" ? (await P(_)).makeSqlLayer(k()) : void 0, Fe = await c({
+		spec: m?.analytics,
+		sqlLayer: Me,
+		log: $
+	}), C = (() => {
+		let e = new Set(y.tables.map((e) => e.tableName)), t = [...y.tables];
+		for (let n of [...je, ...Fe.tables]) e.has(n.tableName) || (e.add(n.tableName), t.push(n));
+		return t;
+	})();
+	for (let e of C) er(e);
+	{
+		let e = yr(ai(y.queries.map((e) => ({
+			name: e.descriptor.name,
+			source: e.descriptor.source
+		})), new Set(C.flatMap((e) => {
+			let t = e.tableName;
+			return t === void 0 ? [] : [t];
+		}))));
+		e !== void 0 && $.warn(e);
+	}
+	let Ie = (process.env.NODE_ENV ?? "").toLowerCase();
+	if (da(Ie, _, process.env.VOLTRO_AUTO_MIGRATE)) {
+		let e = (await P(_)).makeSqlLayer(k()), t = await H.runPromise(Gn.SqlClient.pipe(H.flatMap((e) => Jn(e, d)), H.provide(e), H.catchAll(() => H.succeed([]))));
+		t.length > 0 && ($.error(`serve: refusing to boot — ${t.length} pending file-based migration(s) have never run against this database. They perform the changes a schema diff cannot infer (data moves, backfills, table splits), so the declarative fingerprint check below cannot see them and would have let this process serve un-migrated data.`, { pending: t }), $.error("Run them from your pre-deploy job — `voltro db migrate .` (schema + files) or `voltro db files .` (files alone) — or set VOLTRO_AUTO_MIGRATE=0 to bypass every boot schema check. `voltro serve` never applies them itself: a rolling deploy would start N replicas and each would try."), process.exit(1));
+		let n = await H.runPromise(Gn.SqlClient.pipe(H.flatMap((e) => Yn(e, C, {
+			appliedBy: `serve:${Ie}`,
+			environment: "prod",
+			dialectId: _
+		})), H.provide(e)));
+		n.kind === "prod-mismatch" && ($.error(qn(n, _)), $.error($t({
+			gates: De,
+			nodeEnv: process.env.NODE_ENV,
+			cdcDialect: ie,
+			declared: m?.schema
+		})), $.error("serve: refusing to boot — apply the schema first (voltro db apply in a pre-deploy step), or set VOLTRO_AUTO_MIGRATE=0 to bypass this check."), process.exit(1)), $.info(qn(n, _));
+	}
+	await Jt({
+		dialectId: _,
+		tables: C,
+		mode: Kt(m?.reactiveTriggers),
+		lockSchema: k().schema,
+		makeLayer: async () => (await P(_)).makeSqlLayer(k()),
+		log: {
+			info: (e, t) => $.info(e, t ?? {}),
+			warn: (e, t) => $.warn(e, t ?? {})
+		}
+	});
+	let He = Br(C);
+	u.mark("discover");
+	let T = await rt(m, void 0), We = ci(T, _);
+	for (let e of ft({
+		dialect: String(m?.store ?? process.env.DB_DIALECT ?? "postgres"),
+		changeStrategy: (process.env.CDC ?? "1") === "0" ? "inline" : "cdc",
+		dbUrl: process.env.DB_URL,
+		crossReplicaBus: Di(m?.plugins ?? [])?.broadcast.crossReplica === !0,
+		tables: y.tables.map((e) => ({
+			tableName: e.tableName,
+			isReactive: e.isReactive === !0
+		})),
+		querySources: y.queries.flatMap((e) => {
+			let t = e.descriptor.source;
+			return t === void 0 ? [] : typeof t == "string" ? [t] : [...t];
+		})
+	})) e.level === "warn" ? $.warn(e.message) : $.info(e.message);
+	{
+		let e = Xe({
+			tables: Zn().map((e) => ({ tableName: e.tableName })),
+			queries: y.queries.map((e) => ({
+				name: e.descriptor.name,
+				source: e.descriptor.source
+			}))
+		}), t = _t(e);
+		t !== void 0 && $.warn(t);
+	}
+	m?.cache && !process.env.CACHE_BACKEND && (process.env.CACHE_BACKEND = m.cache), m?.cacheRedisUrl && !process.env.CACHE_REDIS_URL && (process.env.CACHE_REDIS_URL = m.cacheRedisUrl), m?.cacheRedisDriver && !process.env.CACHE_REDIS_DRIVER && (process.env.CACHE_REDIS_DRIVER = m.cacheRedisDriver), m?.cacheKeyPrefix && !process.env.CACHE_KEY_PREFIX && (process.env.CACHE_KEY_PREFIX = m.cacheKeyPrefix);
+	let { service: Ke, invalidationBus: nt, snapshotCache: ot, cache: st, semantic: ut, evictSource: mt, backend: yt, stats: bt, dispose: St } = await Ge({
+		env: process.env,
+		semantic: m?.cacheSemantic ?? !1
+	});
+	ut !== void 0 && $.info("semantic cache enabled — reactive eviction on live writes"), $.info(`cache backend resolved: ${yt}` + (yt === "redis" ? ` (driver ${process.env.CACHE_REDIS_DRIVER ?? "resp"})` : " — in-process, not cross-instance")), T.onChange((e) => {
+		if (H.runFork(nt.publish(e.table)), mt !== void 0) {
+			let t = (e.new ?? e.old)?.id;
+			mt({
+				table: e.table,
+				op: e.op,
+				...t === void 0 ? {} : { id: t }
+			});
+		}
+	}), m?.kv && !process.env.KV_BACKEND && (process.env.KV_BACKEND = m.kv), m?.kvRedisUrl && !process.env.KV_REDIS_URL && (process.env.KV_REDIS_URL = m.kvRedisUrl), m?.kvKeyPrefix && !process.env.KV_KEY_PREFIX && (process.env.KV_KEY_PREFIX = m.kvKeyPrefix);
+	let { kv: wt, service: Tt } = await kr({ store: T });
+	Ve({
+		log: $,
+		max: Gt(),
+		outOfPool: Rt(_, (process.env.CDC ?? "1") !== "0"),
+		readPools: t.replicationSnapshot()?.replicaCount ?? 0,
+		always: !0
+	}), u.mark("store");
+	let Dt = cr({
+		store: T,
+		sink: Fe.sink,
+		log: $
+	}), jt = At({
+		store: T,
+		dialect: _,
+		log: { info: (e) => $.info(e) }
+	}), A = m?.plugins ?? [], It = process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, zt, Bt;
+	_ !== "memory" && (zt = Wn.make((await P(_)).makeSqlLayer(k())), Bt = await zt.runPromise(Gn.SqlClient));
+	let Vt = [
+		"postgres",
+		"mariadb",
+		"mysql",
+		"mssql"
+	].includes(_) ? Tr(T, It, $) : ei, hn = w(m?.scheduling), bn = jr({
+		maxIdleIntervalMs: hn.pollCeilingMs,
+		coordinator: Vt,
+		replicaId: It,
+		log: $
+	}), Sn = [], I = process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, Tn = Di(m?.plugins ?? [])?.broadcast?.provider, L = Qe(m?.plugins, m?.name ?? Cn(d));
+	{
+		let e = tt(m?.plugins, m?.name ?? Cn(d));
+		e !== void 0 && $.warn(e);
+	}
+	let On = Mt(m?.plugins, {
+		instanceId: I,
+		namespace: L,
+		meta: { mode: "serve" },
+		logger: $
+	}), kn = {
+		...Bt ? { sql: Bt } : {},
+		instanceId: I,
+		membership: On.membership,
+		...Tn === void 0 ? {} : { broadcast: Tn },
+		broadcastChannels: { presence: Ei(L, "presence") },
+		scheduleCoordinated: (e, t, n) => {
+			let r = bn(e, t, n);
+			return Sn.push(r), r;
+		}
+	};
+	for (let e of A) e.bindDataStore?.(We, kn);
+	l({
+		store: T,
+		...ct(),
+		log: $
+	});
+	let R = A.filter((e) => typeof e.onChangeEvent == "function");
+	if (R.length > 0) {
+		let e = T.changeScope ?? "local";
+		T.onChange((t) => {
+			let n = pe(t, e);
+			for (let e of R) H.runFork(e.onChangeEvent(n).pipe(H.catchAllCause((t) => H.sync(() => $.warn(`plugin ${e.name} onChangeEvent failed`, { error: Un.pretty(t) })))));
+		});
+	}
+	let An = se({
+		plugins: A,
+		appName: m?.name ?? "voltro-api",
+		appType: "api",
+		voltroVersion: process.env.npm_package_version ?? "0.0.0",
+		log: $
+	});
+	A.length && await An.activate(), u.mark("plugins");
+	let jn = await An.gatherObservability(), Mn = {
+		info: (e, t) => process.stdout.write(`[broadcast] ${e} ${t ? JSON.stringify(t) : ""}\n`),
+		warn: (e, t) => process.stderr.write(`[broadcast] ${e} ${t ? JSON.stringify(t) : ""}\n`),
+		debug: () => {}
+	}, z, Nn = await gt(T, m, _, L, Mn, (e, t) => {
+		z?.refreshAll(`broadcast gap: missed ${t} change(s) from ${e}`);
+	}), Pn = m?.apiKeys, Fn = (typeof Pn == "object" ? Pn.prefix : void 0) ?? "voltro_", B = Pn ? _r(T) : void 0, V = B ? Dr({ flush: Or(B) }) : void 0;
+	V && Gr(() => V.shutdown());
+	let In = B ? Er(B, {
+		prefix: Fn,
+		...V ? { usage: V } : {}
+	}) : void 0, Ln = In ? [br(In, { prefix: Fn })] : [], Rn = xt([...m?.auth?.strategies ?? [], ...Ln], wi(m?.plugins ?? []), m?.auth?.anonymousTenantRequired ?? !1, m?.auth, () => We), zn = [...m?.restRoutes ?? [], ...In ? sr(In, (typeof Pn == "object" ? Pn.managementPath : void 0) ?? "/v1/api-keys") : []], Bn = O(m?.idempotency, T), Vn = A.map((e) => e.services).filter((e) => e !== void 0), Hn = U.mergeAll(Re({
+		analyticsLayer: Fe.layer,
+		cacheService: Ke,
+		kvService: Tt,
+		...ut === void 0 ? {} : { semanticCache: ut },
+		pluginServices: Vn,
+		userLayers: m?.layers ?? []
+	}), it(m?.http ?? {})), W = await at({
+		files: v,
+		store: T,
+		log: $,
+		seedPolicy: "report",
+		seedPattern: un,
+		loadSeedFiles: qt,
+		startupPattern: an,
+		loadStartupFiles: a,
+		runStartups: o,
+		emailPattern: ze,
+		loadEmailFiles: ht,
+		registerEmailTemplates: Ti
+	});
+	(W.startupCount > 0 || W.emailCount > 0) && $.info("boot lifecycle", {
+		startups: W.startupCount,
+		emailTemplates: W.emailCount
+	}), W.startups !== void 0 && Gr(async () => {
+		await W.startups.stop();
+	}), oe({
+		demands: ue(de),
+		isRegistered: (e) => xr(e) !== void 0
+	});
+	let Xn = pt({
+		schedules: Ct({
+			schedules: y.schedules,
+			seeds: W.seeds,
+			store: T,
+			log: $.child("seeds")
+		}),
+		workflows: y.workflows ?? [],
+		log: $.child("workflow-schedules")
+	}), Qn = m?.scheduling ?? {}, G = Qn.trigger ?? "self", tr = /* @__PURE__ */ new Set([
+		"postgres",
+		"mysql",
+		"mariadb",
+		"mssql"
+	]), nr = Qn.coordination ?? (tr.has(_) ? "advisoryLock" : "single"), K = nr === "cluster" && tr.has(_), rr = K ? "cluster" : nr === "advisoryLock" && tr.has(_) ? "advisoryLock" : "single";
+	nr === "cluster" && !K && $.warn("scheduling.coordination=cluster needs a sql-backed store except sqlite — falling back to single"), nr === "advisoryLock" && !tr.has(_) && $.warn("scheduling.coordination=advisoryLock needs a SQL store (the claim-row gate) — falling back to single");
+	let ir, ar = y.workflows.length > 0 || y.workflowWorkers.length > 0 || y.eventTriggers.length > 0 || (Ee?.outgoing.length ?? 0) > 0 || K, or;
+	if (ar) {
+		if (_ === "mssql") {
+			let e = await pn(process.cwd());
+			e && $.warn(e);
+		}
+		let [{ WorkflowEngine: e }, { makeClusterCronLayer: t, workflowEngineLayer: n, resolveRunnerStorage: r, resolveFailoverTuning: i }] = await Promise.all([import("@effect/workflow"), import("@voltro/workflow/cluster")]), a = K ? Xn.filter((e) => (e.trigger ?? G) === "self").map((e) => t({
+			name: e.name,
+			cron: gr(e),
+			execute: async () => {
+				await ir?.fireFromCluster(e.name);
+			}
+		})) : [];
+		or = _ === "memory" ? e.layerMemory : await (async () => {
+			let e = await P(_), t = r({ sqliteFamily: e.id === "sqlite" || e.id === "turso" });
+			return $.info(`workflow engine: cluster-${t}, dialect=${e.id}` + (t === "memory" ? " — single-process durable replay, no cross-pod shard handoff" + (e.id !== "sqlite" && e.id !== "turso" ? " (VOLTRO_WORKFLOW_RUNNER_STORAGE=memory: SqlRunnerStorage/cluster_runners + GET_LOCK skipped)" : "") : "")), n({
+				sqlClientLayer: e.makeSqlLayer(k()),
+				runnerStorage: t,
+				dialectId: e.id,
+				...process.env.VOLTRO_WORKFLOW_RUNNER_PORT ? { runnerListenPort: Number(process.env.VOLTRO_WORKFLOW_RUNNER_PORT) } : {},
+				...i(),
+				...a.length > 0 ? { extraShardingLayers: a } : {}
+			});
+		})();
+	}
+	let lr = ce(A, vn()), ur = v.filter((e) => /\.subscribe\.tsx?$/.test(e)), dr = ur.length > 0 ? await ye(ur, $) : [], fr = v.filter((e) => /\.reaction\.tsx?$/.test(e)), q = fr.length > 0 ? await b(fr, $) : [], pr = v.filter((e) => cn.test(e)), J = pr.length > 0 ? await Pe(pr, $) : [], mr = v.filter((e) => /\.aggregate\.tsx?$/.test(e)), hr = mr.length > 0 ? await te(mr, $) : [], Sr = he();
+	if (hr.length > 0 && _ !== "memory") try {
+		let e = (await P(_)).makeSqlLayer(k());
+		Sr = lt(e);
+	} catch (e) {
+		$.warn("aggregate: SQL storage init failed — falling back to in-process", { err: String(e) });
+	}
+	let Cr = _ === "memory" ? ei : Tr(T, `aggregate@${process.pid}`, $), wr = v.filter((e) => ln.test(e)), Ar = wr.length > 0 ? await f(wr, $) : [], Mr = v.filter((e) => sn.test(e)), Nr = Mr.length > 0 ? await Ce(Mr, $) : [], Pr = v.filter((e) => on.test(e)), Fr = Pr.length > 0 ? await Nt(Pr, $) : [], Ir = [], Lr = [], Rr = v.filter((e) => en.test(e));
+	if (Rr.length > 0) {
+		let e = $.child("agent"), t = v.filter((e) => Qt.test(e));
+		t.length > 0 && await rn(t, e);
+		let n = await Xt(Rr, e);
+		for (let e of n.agents) for (let t of Je(e)) (t.kind === "action" ? Ir : Lr).push({
+			file: t.file,
+			descriptor: t.descriptor,
+			executor: t.executor
+		});
+		n.agents.length > 0 && e.info("synthesized agent routes", { agents: n.agents.map((e) => e.descriptor.name) });
+	}
+	u.mark("workflow");
+	let Y = () => {
+		let e = X.workflowWriteActions();
+		if (e === void 0) throw Error("workflow actions: this app registers no workflows");
+		return e;
+	}, zr = $n({
+		dialect: _,
+		...k()
+	}), Vr = _ === "memory" ? void 0 : (await P(_)).makeSqlLayer(k()), Hr = async () => Ot({
+		sqlLayer: Vr,
+		declared: C,
+		log: $
+	}), Ur = {
+		kind: "api",
+		meta: {
+			name: m?.name ?? "voltro-api",
+			voltroVersion: Et,
+			port: g,
+			mode: "start",
+			store: _,
+			cdc: re ? "on" : "off",
+			...zr === void 0 ? {} : { databaseId: zr }
+		},
+		rpc: $e(y, d),
+		workflows: Le(y, d),
+		migrations: Hr,
+		events: () => X.eventsSnapshot(),
+		agentTools: () => X.agentTools(),
+		invariantChecks: () => ({
+			mode: "serve",
+			accessGate: de,
+			config: m,
+			serverOnlyLeaks: y.serverOnlyLeaks,
+			migrations: Hr
+		}),
+		members: () => X.membersSnapshot(),
+		inspectFireSchedule: async ({ name: e, trigger: t }) => {
+			if (!ir) throw Error("scheduler not started — this app registers no self-triggered schedules (all schedules are trigger:'external', or there are none).");
+			return { runId: await ir.fireNow(e, t) ?? null };
+		},
+		inspectBackfillSchedule: ne({
+			getHandle: () => ir,
+			getSchedules: () => Xn
+		}),
+		...Ee === void 0 ? {} : { webhooks: () => me({
+			store: T,
+			discoveredWebhooks: Ee
+		}) },
+		plugins: () => ({
+			plugins: An.snapshot(),
+			capturedAt: Date.now()
+		}),
+		env: () => N(m?.name ?? Cn(d), {
+			...m?.env !== void 0 && mi(m.env) ? { contract: m.env } : {},
+			plugins: m?.plugins ?? []
+		}),
+		dataCache: () => Be({
+			stats: bt,
+			backendKind: yt
+		}),
+		subscriptions: () => Pt(() => z),
+		inspectTables: () => le(y.tables),
+		inspectRows: be({
+			store: T,
+			tables: y.tables,
+			mask: !0
+		}),
+		metrics: (e) => X.rpcMetrics().snapshot(e),
+		cluster: () => Lt({
+			store: T,
+			dialect: _,
+			useClusterCron: K,
+			scheduleCoordChoice: nr
+		}),
+		inspectSchedules: () => we({
+			schedules: Xn,
+			defaultTrigger: G,
+			coordination: rr
+		}),
+		inspectScheduleRuns: (e) => M(T, e),
+		...ee(T, {
+			controls: D(y.workflows ?? []),
+			active: (y.workflows?.length ?? 0) > 0,
+			cancellation: () => X.flowControlHealth()
+		}),
+		webhookActions: xe(() => X.webhooksService()),
+		inspectStartWorkflow: (e) => Y().inspectStartWorkflow(e),
+		inspectCancelWorkflowRun: (e) => Y().inspectCancelWorkflowRun(e),
+		inspectSuspendWorkflowRun: (e) => Y().inspectSuspendWorkflowRun(e),
+		inspectResumeWorkflowRun: (e) => Y().inspectResumeWorkflowRun(e),
+		inspectDiscardWorkflowRun: (e) => Y().inspectDiscardWorkflowRun(e),
+		inspectRetryWorkflowRun: (e) => Y().inspectRetryWorkflowRun(e),
+		inspectSignalWorkflowRun: (e) => Y().inspectSignalWorkflowRun(e),
+		inspectUpdateWorkflowRun: (e) => Y().inspectUpdateWorkflowRun(e),
+		inspectInferences: (e) => Ze({
+			store: T,
+			active: (y.workflows?.length ?? 0) > 0,
+			dispatcher: () => X.inferenceHealth()
+		}, e.limit === void 0 ? {} : { limit: e.limit }),
+		...vt({
+			store: T,
+			cancelRun: async (e) => await X.runCanceller()?.(e) ?? !1,
+			retryRun: async (e) => Y().inspectRetryWorkflowRun({ runId: e }),
+			redriveRun: async (e) => X.redriveWorkflowRun({ runId: e }),
+			log: $
+		}),
+		inspectRedriveWorkflowRun: (e) => X.redriveWorkflowRun(e),
+		inspectResumeWorkflowRunFromStep: (e) => X.resumeWorkflowRunFromStep(e)
+	}, Wr = (process.env.VOLTRO_TENANT_ISOLATION ?? m?.tenancy?.isolation) === "namespace", Kr = Wr && _ !== "memory" ? await (async () => {
+		let e = await P(_);
+		return E({
+			tables: C,
+			sqlLayer: e.makeSqlLayer(k()),
+			dialect: _,
+			options: { retryFilter: e.retryFilter },
+			log: {
+				info: (e, t) => $.info(e, t),
+				error: (e, t, n) => $.error(e, t ?? {}, n)
+			}
+		});
+	})() : void 0, qr = await dt({
+		input: m?.tenancy?.residency,
+		namespaceIsolationOn: Wr,
+		makeStoreForUrl: (e, t) => rt(m, void 0, Wt(k(), t)),
+		log: {
+			info: (e, t) => $.info(e, t),
+			warn: (e, t) => $.warn(e, t)
+		}
+	});
+	qr !== void 0 && Gr(async () => {
+		await qr.close();
+	});
+	let X = await ua({
+		bootTiming: u,
+		broadcastNamespace: L,
+		scheduling: (() => {
+			let e = hn;
+			return {
+				admissionDrainMs: e.admissionDrainMs,
+				inferenceTickMs: e.inferenceTickMs,
+				cancelSweepMs: e.cancelSweepMs,
+				stalenessSweepMs: e.stalenessSweepMs,
+				disarmWhenIdle: et({
+					changeScope: T.changeScope,
+					broadcastAttached: Nn !== void 0
+				})
+			};
+		})(),
+		...m?.workflows?.staleness === void 0 ? {} : { workflowStaleness: m.workflows.staleness },
+		...m?.workflows?.suspendSignalHintMs === void 0 ? {} : { workflowSuspendSignalHintMs: m.workflows.suspendSignalHintMs },
+		workflowRecording: j(m?.workflows?.recording),
+		membership: {
+			...On,
+			instanceId: I
+		},
+		security: {
+			defaultDeny: Oe(m),
+			..._e(m)
+		},
+		approvals: { defaultExpiryMs: Ne(m) },
+		...m?.plugins === void 0 ? {} : { plugins: m.plugins },
+		...Bn ? { idempotency: Bn } : {},
+		restRoutes: zn,
+		appProcedures: de,
+		discovered: {
+			queries: [...y.queries, ...Lr],
+			mutations: y.mutations,
+			actions: [...y.actions, ...Ir],
+			streams: y.streams,
+			events: y.events,
+			workflows: y.workflows,
+			workflowWorkers: y.workflowWorkers,
+			eventTriggers: y.eventTriggers,
+			schedules: Xn,
+			subscribers: dr,
+			outboxHandlers: J,
+			connections: y.connections,
+			reactions: q,
+			aggregates: hr,
+			expectations: Ar,
+			budgets: Nr,
+			experiments: Fr,
+			...Ee === void 0 ? {} : { webhooks: Ee }
+		},
+		log: $,
+		analytics: Fe.sink,
+		aggregateStorage: Sr,
+		aggregateCoordinator: Cr,
+		store: T,
+		kv: wt,
+		cache: st,
+		snapshotCache: ot,
+		...m?.reactive === void 0 ? {} : { reactive: m.reactive },
+		schemaRegistry: He,
+		tenantScopedTables: y.tenantScopedTables,
+		softDeleteScopedTables: y.softDeleteScopedTables,
+		dataTransferSnapshot: Kn(C, _),
+		dataTransferDialect: _,
+		...Kr === void 0 ? {} : { ensureTenantProvisioned: Kr.ensure },
+		...qr === void 0 ? {} : { resolveResidentStore: qr.resolveStore },
+		tenantIsolation: (process.env.VOLTRO_TENANT_ISOLATION ?? m?.tenancy?.isolation) === "namespace" ? "namespace" : "shared-schema",
+		resolveSubject: (e, t) => Rn({
+			headers: e,
+			clientId: t
+		}),
+		...m?.auth === void 0 ? {} : { authority: m.auth },
+		...m?.agents === void 0 ? {} : { agents: m.agents },
+		httpRoutes: A.flatMap((e) => e.httpRoutes ?? []),
+		getStore: () => We,
+		...Hn ? { baseLayer: Hn } : {},
+		...or === void 0 ? {} : { workflowEngineLayer: or },
+		scheduleDefaultTrigger: G,
+		scheduleCoordination: rr,
+		scheduleArmSelf: !K,
+		dormancy: process.env.VOLTRO_DORMANCY === "sleep" || process.env.VOLTRO_DORMANCY === "always-on" ? process.env.VOLTRO_DORMANCY : m?.dormancy ?? "always-on",
+		scheduleReplicaId: process.env.HOSTNAME ?? `pid-${process.pid}`,
+		...lr === void 0 ? {} : { scheduleFireInterceptor: lr },
+		onSchedulerReady: (e) => {
+			ir = e;
+		},
+		inspectRoute: { handle: async (e, t, n, r) => await p(e, Ur, t, {
+			method: n,
+			...r === void 0 ? {} : { body: r }
+		}) || ((n === "GET" ? await fn(e, Ur, t, { method: n }) : null) ?? dn(e, Ur, t, {
+			method: n,
+			...r === void 0 ? {} : { body: r }
+		}) ?? {
+			status: 404,
+			contentType: "application/json",
+			body: JSON.stringify({ error: "not an inspect route" })
+		}) },
+		...m?.name === void 0 ? {} : { appName: m.name },
+		observability: jn,
+		port: g,
+		...m?.transport?.wsPath ? { path: m.transport.wsPath } : {}
+	});
+	return z = X.dispatcher, Se(Ft([
+		y.queries,
+		y.mutations,
+		y.actions,
+		y.streams
+	]), (e) => {
+		$.warn(e);
+	}), $.info(`API listening on :${g}`, {
+		dialect: _,
+		queries: y.queries.length,
+		mutations: y.mutations.length,
+		actions: y.actions.length,
+		streams: y.streams.length,
+		workflows: y.workflows.length,
+		workflowWorkers: y.workflowWorkers.length,
+		schedules: Xn.length,
+		scheduleCoordination: rr
+	}), u.finish($), Gr(async () => {
+		for (let e of Sn) e.stop();
+		jt.stop();
+		try {
+			await X.close(), St(), zt?.dispose(), await An.deactivate(), await Nn?.close(), await qe({
+				mirror: Dt,
+				log: $
+			}), await Fe.dispose(), await T.close?.();
+		} catch (e) {
+			console.error("serve: shutdown step failed, exiting anyway:", e);
+		}
+	}), await new Promise(() => {}), 0;
+};
+//#endregion
+export { pa as n, da as r, ma as t };