@voltro/cli 0.45.0 → 0.46.0

package/dist/serveCommand-BBhT2U94.js

@@ -1,1885 +0,0 @@
-import { t as e } from "./nodeEnvironment-cGFAj1J8.js";
-import { t } from "./frameworkInspectState-CX2250XB.js";
-import { r as n, t as r } from "./appModuleLoader-C9r9mxZt.js";
-import { t as i } from "./bootRefusal-pgvDxlrU.js";
-import { n as a, r as o } from "./startupRunner-CEqQq7ax.js";
-import { $ as s, $t as c, A as l, At as u, B as d, C as ee, Cn as f, Ct as p, D as te, Dt as ne, E as m, Et as h, F as re, Ft as ie, G as g, Gt as ae, H as oe, I as se, It as ce, J as le, Jt as _, K as ue, Kt as v, L as de, Lt as y, M as fe, Mt as pe, N as me, Nt as he, O as ge, Ot as _e, P as ve, Pt as ye, Q as be, Qt as xe, R as b, Rt as Se, S as Ce, Sn as we, St as Te, T as x, Tn as Ee, Tt as De, U as Oe, Ut as ke, V as Ae, Vt as je, W as Me, Wt as Ne, X as Pe, Xt as Fe, Y as Ie, Yt as S, Z as Le, Zt as C, _ as Re, _n as ze, _t as Be, an as Ve, at as He, b as Ue, bn as We, bt as Ge, c as Ke, cn as w, ct as qe, dn as Je, dt as Ye, en as Xe, et as Ze, f as Qe, fn as $e, ft as et, g as tt, gn as nt, gt as rt, h as it, ht as at, i as ot, in as st, it as ct, j as lt, jt as ut, k as T, kt as dt, ln as ft, lt as pt, m as E, mn as D, mt, nn as ht, nt as gt, o as O, on as _t, ot as vt, p as yt, pn as bt, pt as xt, q as St, qt as Ct, r as wt, rn as Tt, rt as Et, sn as Dt, st as Ot, t as kt, tn as At, tt as jt, u as k, un as A, ut as Mt, v as Nt, vn as j, vt as Pt, w as Ft, wn as It, wt as Lt, x as Rt, xt as zt, y as Bt, yn as Vt, yt as Ht, zt as Ut } from "./dev-DAM5CnAa.js";
-import { n as Wt } from "./cliArgs-D4p8n7EE.js";
-import { r as M } from "./appPort-B_HpJ_ck.js";
-import { ht as Gt, pt as Kt } from "./webDev-101csg6Q.js";
-import { r as N } from "./dialectDriver-czCHYpeH.js";
-import { i as qt, n as Jt } from "./connectionConfig-Bk9IC7D0.js";
-import { c as Yt, n as P, o as Xt } from "./seedRunner-IdHEprqf.js";
-import { C as Zt, S as Qt, _ as $t, d as en, g as tn, l as nn, m as rn, r as an, u as on, v as sn } from "./frameworkTableAssembly-oMPBKqlE.js";
-import { S as cn, c as ln, n as un, p as dn, s as fn, x as pn } from "./fileConventions-Cof68_BL.js";
-import { h as mn, o as hn } from "./inspect-B7U7Cl_Z.js";
-import { n as gn } from "./mssqlClusterPatch-_4cE_nun.js";
-import { i as _n, n as vn, r as yn, t as bn } from "./webhookDiscovery-CphsQe59.js";
-import { t as xn } from "./inspectMetrics-CfdKLh6t.js";
-import { r as Sn, u as Cn } from "./apiBuild-CDQBNRDx.js";
-import { t as wn } from "./bootTiming-BdyP9nYw.js";
-import { t as Tn } from "./dataProfile-Cm0YVKSy.js";
-import F, { basename as En, join as Dn } from "node:path";
-import { createWriteStream as On, existsSync as kn } from "node:fs";
-import { pathToFileURL as An } from "node:url";
-import { createLogger as I } from "@voltro/logger";
-import { AuthMiddleware as jn, ConnectionInfoMiddleware as Mn, actionToRpc as L, anonymousSubject as Nn, isWireReachable as Pn, mutationToRpc as Fn, queryToRpc as R, streamToRpc as In, wireErrorUnion as z, workflowCancelDescriptor as Ln, workflowDomainEventsQueryDescriptor as B, workflowEventDeliveriesQueryDescriptor as V, workflowResumeDescriptor as Rn, workflowRunEventsQueryDescriptor as zn, workflowRunQueryDescriptor as Bn, workflowRunStepsQueryDescriptor as Vn, workflowRunsQueryDescriptor as Hn, workflowSignalDescriptor as Un, workflowUpdateDescriptor as Wn } from "@voltro/protocol";
-import { Cause as Gn, Effect as H, Layer as U, ManagedRuntime as Kn } from "effect";
-import { SqlClient as qn } from "@effect/sql";
-import { declaredSnapshot as Jn, describeOutcome as Yn, pendingFileMigrationIds as Xn, runPlannedMigrations as Zn } from "@voltro/database/sql";
-import W from "node:os";
-import { RpcGroup as Qn } from "@effect/rpc";
-import { allRegisteredTables as $n, and as er, connectionIdentity as tr, ensureTableRegistered as nr, eq as G, or as rr } from "@voltro/database";
-import { AggregateRegistry as ir, CostRegistry as K, DORMANCY_WAKEUP_TENANT as ar, Dispatcher as or, ExpectationRegistry as sr, ExperimentRegistry as cr, apiKeyManagementRoutes as lr, attachAnalyticsMirror as ur, attachExpectations as dr, attachExperiments as fr, attachFinops as pr, awaitServerListening as mr, bindMutation as q, bindStream as hr, bindSubscription as J, buildTracingLayer as gr, cancelWakeup as _r, compileCron as vr, dataStoreApiKeyStore as yr, formatServerOnlyLeaks as br, formatUnresolvedSources as xr, frameworkApiKeyStrategy as Sr, getResourcePolicy as Cr, installPolicyGuardResolver as wr, loadResourceTuples as Tr, makeActionRunner as Er, makeAdvisoryLockCoordinator as Dr, makeApiKeyService as Or, makeApiKeyUsageBuffer as kr, makeApiKeyUsageFlusher as Ar, makeAsyncKv as jr, makeAuthMiddlewareLayers as Mr, makeCoordinatedScheduler as Nr, makeEffectStoreLayer as Pr, makeLazyWorkflowFacade as Fr, makeMutationOutputCodec as Ir, makeMutationRunner as Lr, makeOneShotQueryRunner as Rr, makeQueryDescriptorProducer as zr, makeQueryFinalizer as Br, makeQueryReauthorizer as Y, makeQuerySubscriber as Vr, makeSchemaRegistry as Hr, makeWorkflowFacade as Ur, makeWorkflowFacadeWithCallerContext as Wr, makeWorkflowLayers as Gr, noopKv as Kr, onProcessShutdown as qr, recordSubscriptionDelivery as Jr, recordWorkflowRun as Yr, registerDefaultTupleSource as X, registerWakeup as Xr, resolveSecretsBackend as Zr, runProvidedEffect as Qr, setSecretsBackend as $r, setSystemStoreHandle as ei, shutdownGraceMsFromEnv as ti, singleCoordinator as ni, startRpcServer as ri, startScheduler as ii, stripForbiddenForWire as ai, undoCaptureEnabled as oi, unresolvedSources as si, withScopedRequest as ci, workflowToRpc as li, wrapStoreWithBootCodec as ui } from "@voltro/runtime";
-import { appStorageProvider as di, fromNodeReadable as fi, getObjectStream as pi, putObjectStream as mi, toNodeReadable as hi } from "@voltro/plugin-storage";
-import { isEnvContract as gi } from "@voltro/env";
-import { assertProductionSessionSecret as _i } from "@voltro/protocol/session";
-import Z from "node:fs/promises";
-import { createHash as vi, timingSafeEqual as yi } from "node:crypto";
-import { buildDeliverWebhookExecute as bi, buildWebhooksService as xi, defaultIncomingPath as Si, deliverWebhookWorkflow as Ci, makeDeferredEmitHandler as wi, mountIncomingWebhook as Ti } from "@voltro/plugin-webhooks";
-import { getAuthSessionStrategy as Ei } from "@voltro/plugin-auth";
-import { registerEmailTemplates as Di } from "@voltro/plugin-mail";
-import { channelFor as Oi, getBroadcastPlugin as ki } from "@voltro/plugin-broadcast";
-import { packBundle as Ai, runExport as ji, runImport as Mi, storageBlobSink as Ni, storageRefsBlobSource as Pi, unpackBundle as Fi, unpackBundleToDir as Ii } from "@voltro/data-transfer";
-//#region src/serveDrain.ts
-var Li = () => Math.max(500, Math.floor(ti() * .6)), Ri = (e) => new Promise((t) => setTimeout(t, e)), zi = (e) => {
-	let t = /* @__PURE__ */ new Set(), n = /* @__PURE__ */ new Set(), r = 0;
-	e.on("connection", (e) => {
-		t.add(e), e.once("close", () => {
-			t.delete(e), n.delete(e);
-		});
-	}), e.on("upgrade", (e, t) => {
-		n.add(t);
-	}), e.on("request", (e, t) => {
-		r += 1, t.once("close", () => {
-			--r;
-		});
-	});
-	let i, a = async (t = {}) => {
-		let n = t.budgetMs ?? Li();
-		i ??= new Promise((t) => {
-			e.close(() => {
-				t();
-			});
-		}), e.closeIdleConnections();
-		let a = Date.now() + n;
-		for (; r > 0 && Date.now() < a;) await Ri(25), e.closeIdleConnections();
-		e.closeIdleConnections();
-	}, o = async () => {
-		i ??= new Promise((t) => {
-			e.close(() => {
-				t();
-			});
-		});
-		for (let e of t) if (n.has(e)) try {
-			e.write(Buffer.from([
-				136,
-				2,
-				3,
-				233
-			]));
-		} catch {}
-		else e.destroy();
-		for (let e = 0; t.size > 0 && e < 250; e += 25) await Ri(25);
-		for (let e of t) e.destroy();
-		await i;
-	};
-	return {
-		activeRequests: () => r,
-		drainRequests: a,
-		finish: o,
-		drain: async (e = {}) => {
-			await a(e), await o();
-		}
-	};
-}, Bi = "/_voltro/admin/import", Vi = "/_voltro/admin/export", Q = (e, t) => ({
-	status: e,
-	contentType: "application/json; charset=utf-8",
-	body: JSON.stringify(t)
-}), Hi = (e) => {
-	let t = e.authorization ?? e.Authorization, n = t ? /^Bearer\s+(.+)$/i.exec(t) : null;
-	return n ? n[1] : null;
-}, Ui = (e, t) => yi(vi("sha256").update(e).digest(), vi("sha256").update(t).digest()), Wi = (e, t) => {
-	if (e.method.toUpperCase() !== "POST") return Q(405, { error: "method not allowed" });
-	if (!t || t.length < 16) return Q(503, { error: "data transfer misconfigured (no/weak secret)" });
-	let n = Hi(e.headers);
-	return !n || !Ui(n, t) ? Q(401, { error: "unauthorized" }) : null;
-}, Gi = /^[A-Za-z0-9_-]{8,64}$/, Ki = (e) => Gi.test(e), qi = () => F.join(W.tmpdir(), "voltro-import-uploads"), Ji = (e) => F.join(qi(), e), Yi = (e) => F.join(Ji(e), "archive.bin"), Xi = (e) => F.join(Ji(e), "meta.json"), Zi = async (e = Date.now()) => {
-	let t = 0;
-	try {
-		for (let n of await Z.readdir(qi())) {
-			let r = await Z.stat(Ji(n)).catch(() => null);
-			r !== null && (e - r.mtimeMs <= 864e5 || (await Z.rm(Ji(n), {
-				recursive: !0,
-				force: !0
-			}).catch(() => void 0), t++));
-		}
-	} catch {}
-	return t;
-}, Qi = async (e) => {
-	if (!Ki(e)) return {
-		bytes: 0,
-		key: null
-	};
-	let t = await Z.stat(Yi(e)).catch(() => null);
-	if (t === null) return {
-		bytes: 0,
-		key: null
-	};
-	let n = await Z.readFile(Xi(e), "utf8").then((e) => JSON.parse(e), () => ({}));
-	return {
-		bytes: t.size,
-		key: n.key ?? null
-	};
-}, $i = async (e) => {
-	if (!Ki(e.id)) return {
-		reason: "bad-id",
-		message: `upload id must match ${String(Gi)}`
-	};
-	let t = await Qi(e.id);
-	return t.key !== null && t.key !== e.key ? {
-		reason: "key-mismatch",
-		message: "this upload id already holds a different bundle. Use a new upload id, or delete the partial upload."
-	} : e.offset === t.bytes ? (await Z.mkdir(Ji(e.id), { recursive: !0 }), t.key === null && await Z.writeFile(Xi(e.id), JSON.stringify({
-		key: e.key,
-		startedAt: (/* @__PURE__ */ new Date()).toISOString()
-	})), await new Promise((t, n) => {
-		let r = On(Yi(e.id), { flags: "a" });
-		r.on("error", n), r.on("finish", () => t()), r.end(Buffer.from(e.bytes));
-	}), { total: t.bytes + e.bytes.byteLength }) : {
-		reason: "offset-mismatch",
-		message: `chunk starts at ${e.offset} but the server holds ${t.bytes} byte(s)`,
-		expectedOffset: t.bytes
-	};
-}, ea = async (e) => {
-	let t = await Z.stat(Yi(e));
-	return {
-		path: Yi(e),
-		bytes: t.size
-	};
-}, ta = async (e) => {
-	Ki(e) && await Z.rm(Ji(e), {
-		recursive: !0,
-		force: !0
-	}).catch(() => void 0);
-}, na = I({ scope: "voltro:admin-import" }), ra = "VBUNDLE2", ia = async function* (e) {
-	yield e;
-}, aa = (e) => async (t) => {
-	let n = Wi(t, e.secret);
-	if (n) return n;
-	let r = t.headers["x-import-mode"], i = t.headers["x-import-on-conflict"], a = t.headers["x-import-atomic"], o = a === "0" || a === "false" ? !1 : a === "1" || a === "true" || r === "replace", s = t.headers["x-import-force"] === "1" || t.headers["x-import-force"] === "true", c = t.headers["x-import-dry-run"] === "1" || t.headers["x-import-dry-run"] === "true", l = (t.headers["x-import-tables"] ?? "").split(",").map((e) => e.trim()).filter(Boolean), u = t.headers["x-import-upload-id"], d;
-	if (u !== void 0 && u !== "") {
-		if (Zi(), t.headers["x-import-probe"] === "1") return Q(200, {
-			uploadId: u,
-			bytes: (await Qi(u)).bytes
-		});
-		let e = t.headers["x-import-upload-key"] ?? "", n = Number(t.headers["x-import-chunk-offset"] ?? "0");
-		if (e === "" || !Number.isFinite(n) || n < 0) return Q(400, { error: "a chunked upload needs x-import-upload-key and a numeric x-import-chunk-offset" });
-		let r = await $i({
-			id: u,
-			key: e,
-			offset: n,
-			bytes: t.rawBody
-		});
-		if ("reason" in r) return na.warn("admin.import chunk refused", {
-			uploadId: u,
-			reason: r.reason
-		}), Q(409, {
-			error: "chunk refused",
-			reason: r.reason,
-			message: r.message,
-			...r.expectedOffset === void 0 ? {} : { expectedOffset: r.expectedOffset }
-		});
-		if (t.headers["x-import-chunk-final"] !== "1") return Q(202, {
-			uploadId: u,
-			bytes: r.total
-		});
-		d = (await ea(u)).path;
-	}
-	let ee = t.rawBody.byteLength >= 8 && Buffer.from(t.rawBody.subarray(0, 8)).toString("latin1") === ra, f, p;
-	if (d !== void 0) {
-		let { createReadStream: e } = await import("node:fs");
-		f = e(d), p = "chunked";
-	} else if (ee) f = ia(t.rawBody), p = "upload";
-	else {
-		let n;
-		try {
-			n = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
-		} catch {
-			return Q(400, { error: "body must be a packed bundle archive or { bundleKey } JSON" });
-		}
-		if (typeof n.bundleKey != "string" || !n.bundleKey) return Q(400, { error: "body.bundleKey (string) is required for the storage transport" });
-		if (!e.openArchive) return Q(501, { error: "storage transport not configured on this instance" });
-		f = e.openArchive(n.bundleKey), p = "storage";
-	}
-	let te = await import("node:os"), ne = await import("node:fs/promises"), m = await import("node:path"), h = await ne.mkdtemp(m.join(te.tmpdir(), "voltro-admin-import-"));
-	try {
-		e.assetSink ? await Fi(f, {
-			dir: h,
-			blobs: e.assetSink
-		}) : await Ii(f, h);
-		let t = await H.runPromiseExit(Mi({
-			store: e.store,
-			bundleDir: h,
-			...r ? { mode: r } : {},
-			...i ? { onConflict: i } : {},
-			...o ? { atomic: o } : {},
-			...c ? { dryRun: c } : {},
-			...l.length > 0 ? { tables: l } : {},
-			...e.snapshot ? { targetSnapshot: e.snapshot } : {},
-			force: s,
-			onWarn: (e) => na.warn("admin.import", { message: e }),
-			...e.assetSink ? { assetsAlreadyRestored: !0 } : {}
-		}));
-		if (t._tag === "Failure") {
-			let e = t.cause._tag === "Fail" ? t.cause.error : void 0;
-			if (e && e._tag === "SchemaDriftError") {
-				let t = e;
-				return na.warn("admin.import refused (schema drift)", {
-					transport: p,
-					bundle: t.bundleFingerprint.slice(0, 16),
-					target: t.targetFingerprint.slice(0, 16)
-				}), Q(409, {
-					error: "schema drift",
-					bundleFingerprint: t.bundleFingerprint,
-					targetFingerprint: t.targetFingerprint,
-					diff: t.diff,
-					hint: "each line above would break the load: a table or column the bundle carries that the target cannot take, or a column the target requires that the bundle has no value for. Fix the target schema, re-export against it, or resend with x-import-force: 1 to write anyway."
-				});
-			}
-			let n = typeof e?.reason == "string" ? e.reason : void 0;
-			if (n !== void 0 && e._tag === "ImportModeError") return na.warn("admin.import refused (mode)", {
-				transport: p,
-				mode: e.mode
-			}), Q(409, {
-				error: "import mode refused",
-				mode: e.mode,
-				message: n
-			});
-			throw Error(n ?? String(e?.message ?? e ?? "import failed"));
-		}
-		let n = t.value, a = n.manifest.tables.reduce((e, t) => e + t.rowCount, 0), u = n.rowsWritten;
-		return na.info(c ? "admin.import (dry run — nothing written)" : "admin.import", {
-			transport: p,
-			tables: n.tablesWritten,
-			rows: u,
-			carried: a,
-			mode: r ?? "upsert",
-			atomic: o,
-			...n.tablesSkipped > 0 ? {
-				skippedTables: n.tablesSkipped,
-				skippedRows: n.rowsSkipped
-			} : {}
-		}), c || e.refreshSubscriptions?.(`data import: ${n.tablesWritten} table(s), mode ${r ?? "upsert"}`), Q(200, {
-			tables: n.tablesWritten,
-			rows: u,
-			carried: a,
-			transport: p,
-			...n.tablesSkipped > 0 ? {
-				skippedTables: n.tablesSkipped,
-				skippedRows: n.rowsSkipped,
-				fullyResumed: n.fullyResumed
-			} : {},
-			...c ? {
-				dryRun: !0,
-				wrote: !1
-			} : {}
-		});
-	} catch (e) {
-		return na.warn("admin.import failed", {
-			transport: p,
-			error: e?.message ?? String(e)
-		}), Q(500, {
-			error: "import failed",
-			message: e?.message ?? String(e)
-		});
-	} finally {
-		await ne.rm(h, {
-			recursive: !0,
-			force: !0
-		}), u !== void 0 && u !== "" && d !== void 0 && await ta(u);
-	}
-}, oa = I({ scope: "voltro:admin-export" }), sa = async (e) => {
-	let t = [];
-	for await (let n of e) t.push(Buffer.from(n));
-	return new Uint8Array(Buffer.concat(t));
-}, ca = (e) => typeof e.tenant == "string" && e.tenant ? {
-	kind: "tenant",
-	tenantId: e.tenant
-} : Array.isArray(e.tables) && e.tables.length ? {
-	kind: "tables",
-	tables: e.tables.filter((e) => typeof e == "string")
-} : { kind: "all" }, la = (e) => async (t) => {
-	let n = Wi(t, e.secret);
-	if (n) return n;
-	let r;
-	try {
-		r = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
-	} catch {
-		return Q(400, { error: "body must be JSON: { profile?, tenant?, tables?, consistency?, compression?, bundleKey? }" });
-	}
-	let i = {};
-	if (typeof r.profile == "string" && r.profile) {
-		if (!e.loadProfile) return Q(501, { error: "server-side profiles not configured on this instance" });
-		try {
-			i = await e.loadProfile(r.profile);
-		} catch (e) {
-			return Q(400, {
-				error: `profile '${r.profile}' could not be loaded`,
-				message: e?.message ?? String(e)
-			});
-		}
-	}
-	let a = r.consistency === "snapshot" ? "snapshot" : i.consistency ?? "live", o = (typeof r.compression == "string" ? r.compression : void 0) ?? i.compression, s = i.scope ?? ca(r), c = typeof r.bundleKey == "string" && r.bundleKey.length > 0, l = r.assets === !0 && e.assetSource ? { blobs: e.assetSource } : {}, u = await import("node:os"), d = await import("node:fs/promises"), ee = await import("node:path"), f = await d.mkdtemp(ee.join(u.tmpdir(), "voltro-admin-export-"));
-	try {
-		let t = await H.runPromise(ji({
-			store: e.store,
-			snapshot: e.snapshot,
-			dialect: e.dialect,
-			outDir: f,
-			...i.subset ? { subset: i.subset } : {
-				scope: s,
-				...e.tenantTables && e.tenantTables.length > 0 ? { tenantTables: e.tenantTables } : {}
-			},
-			consistency: a,
-			...o ? { compression: o } : {},
-			...i.masking ? { masking: i.masking } : {}
-		})), n = t.tables.reduce((e, t) => e + t.rowCount, 0), u = t.masking?.transformed.length ?? 0;
-		if (c) {
-			if (!e.putArchive) return Q(501, { error: "storage transport not configured on this instance" });
-			let i = r.bundleKey;
-			return await e.putArchive(i, () => Ai({
-				dir: f,
-				...l
-			})), oa.info("admin.export", {
-				transport: "storage",
-				tables: t.tables.length,
-				rows: n,
-				masked: u,
-				bundleKey: i
-			}), Q(200, {
-				bundleKey: i,
-				tables: t.tables.length,
-				rows: n,
-				masked: u,
-				transport: "storage"
-			});
-		}
-		let d = await sa(Ai({
-			dir: f,
-			...l
-		}));
-		return oa.info("admin.export", {
-			transport: "download",
-			tables: t.tables.length,
-			rows: n,
-			masked: u,
-			bytes: d.byteLength
-		}), {
-			status: 200,
-			contentType: "application/octet-stream",
-			body: d,
-			headers: {
-				"x-export-tables": String(t.tables.length),
-				"x-export-rows": String(n),
-				"x-export-masked": String(u)
-			}
-		};
-	} catch (e) {
-		return oa.warn("admin.export failed", { error: e?.message ?? String(e) }), Q(500, {
-			error: "export failed",
-			message: e?.message ?? String(e)
-		});
-	} finally {
-		await d.rm(f, {
-			recursive: !0,
-			force: !0
-		});
-	}
-}, ua = (e, t, n = {}) => (async function* () {
-	let r = await H.runPromise(pi(e, t).pipe(H.timeout(n.openTimeout ?? "30 seconds"))), i = await hi(r.stream), a = n.stallMs ?? 12e4, o, s = () => {
-		o && clearTimeout(o), o = setTimeout(() => i.destroy(/* @__PURE__ */ Error(`storage read stalled for ${a}ms reading '${t}'`)), a);
-	};
-	try {
-		s();
-		for await (let e of i) s(), yield e instanceof Uint8Array ? e : new Uint8Array(e);
-	} finally {
-		o && clearTimeout(o), i.destroy();
-	}
-})(), da = {
-	get: async () => void 0,
-	set: async () => {},
-	setWithTags: async () => {},
-	remove: async () => !1,
-	has: async () => !1,
-	clear: async () => {},
-	invalidateTag: async () => 0,
-	wrap: async (e, t, n) => n()
-}, fa = async (e) => {
-	Ut(e.appProcedures ?? e.discovered, {
-		defaultDeny: e.security?.defaultDeny ?? !0,
-		commandHint: "`voltro serve`"
-	}), ei({
-		dataStore: e.store,
-		schemaRegistry: e.schemaRegistry
-	});
-	let t = (e.discovered.budgets?.length ?? 0) > 0, n, r = new or({
-		store: e.store,
-		...e.snapshotCache ? { cache: e.snapshotCache } : {},
-		...e.reactive === void 0 ? {} : { reactive: e.reactive },
-		...t ? { recordCost: (e) => n?.record(e) } : {},
-		recordDelivery: (e) => Jr({
-			label: e.label,
-			kind: e.kind,
-			durationMs: e.durationMs,
-			rowCount: e.rowCount
-		})
-	}), i = e.cache ?? da, a = e.kv ?? Kr, o, c = () => void 0, l, ee, f, p, te, ne, m, ce = ae({
-		store: e.store,
-		warn: (e, t) => {
-			process.stderr.write(`[workflow] ${e} ${JSON.stringify(t)}\n`);
-		}
-	}), le = ce.remember, ue = ce.resolve, de = v({
-		authority: e.authority,
-		getStore: () => e.store
-	}), y = (e.discovered.workflows?.length ?? 0) > 0 ? Fr(() => o) : void 0, pe = (e.discovered.workflows?.length ?? 0) > 0 || (e.discovered.eventTriggers?.length ?? 0) > 0, he = pe || (e.discovered.workflowWorkers?.length ?? 0) > 0 || e.scheduleCoordination === "cluster", ge = e.tenantIsolation === "namespace", _e = (e.log ?? I({ scope: "voltro:serve" })).child("webhooks"), ve, xe, b = e.discovered.webhooks;
-	if (b && b.outgoing.length > 0 && e.workflowEngineLayer !== void 0) {
-		e.workflowEngineLayer;
-		let t = w({
-			store: e.store,
-			schemaRegistry: e.schemaRegistry,
-			cache: i,
-			kv: a
-		}), n = b.outgoing.map((e) => e.descriptor);
-		xe = Ci.toLayer(bi(t, { events: n })), ve = xi(t, async (e) => {
-			let t = f;
-			if (t === void 0) {
-				_e.error("webhook delivery skipped — the workflow runtime was never built. This is a framework defect, not a configuration problem: report it with your engine setting. Deliveries are NOT queued and will not be retried.", {
-					deliveryId: e.deliveryId,
-					targetId: e.targetId
-				});
-				return;
-			}
-			t.runPromise(Ci.execute(e)).catch((t) => {
-				_e.error("deliverWebhook workflow crashed", {
-					deliveryId: e.deliveryId,
-					targetId: e.targetId
-				}, t);
-			});
-		}, { events: n });
-	}
-	let Se = /* @__PURE__ */ new Map();
-	if (b) for (let e of b.incoming) {
-		let t = e.descriptor.path ?? Si(e.descriptor.id), n = `VOLTRO_WEBHOOK_SECRET_${e.descriptor.id.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`, r = Ti(e.descriptor, {
-			resolveSecret: async () => process.env[n] ?? null,
-			resolveWorkflows: () => y === void 0 ? void 0 : Wr(y, {
-				traceId: `incoming:${e.descriptor.id}`,
-				source: `incoming:${e.descriptor.id}`
-			}),
-			log: (e) => {
-				let t = {
-					webhookId: e.webhookId,
-					status: e.status,
-					signatureOk: String(e.signatureOk),
-					idempotency: e.idempotency,
-					durationMs: e.durationMs
-				};
-				e.status >= 500 ? _e.error("incoming delivery failed", t) : e.status >= 400 ? _e.warn("incoming delivery rejected", t) : _e.info("incoming delivery handled", t);
-			}
-		});
-		Se.set(t, { handle: r });
-	}
-	wr(), X((t) => Tr(e.store, t.subjectId, t.resourceType, t.resourceId)) || I({ scope: "voltro:serve" }).info("policy guards: using the app-registered tuple source");
-	let Ce = [], we = [...e.discovered.outboxHandlers ?? [], ...vn((b?.outgoing.length ?? 0) + (b?.incoming.length ?? 0) + (b?.providers.length ?? 0), []) ? [{
-		file: "<framework>/webhooks",
-		id: "voltro-webhook-emit",
-		definition: wi(() => ve)
-	}] : []], Te = we.length > 0 ? Fe({
-		handlers: we,
-		store: e.store,
-		log: (e.log ?? I({ scope: "voltro:serve" })).child("outbox"),
-		onChange: (t) => e.store.onChange((e) => t({
-			table: e.table,
-			op: e.op
-		})),
-		onShutdown: (e) => {
-			Ce.push(e);
-		}
-	}) : void 0, x = _({
-		definitions: (e.discovered.connections ?? []).map((e) => e.definition),
-		store: e.store,
-		publicUrl: Ct(e.port ?? 4e3),
-		log: (e.log ?? I({ scope: "voltro:serve" })).child("connections")
-	});
-	lt({
-		events: e.discovered.events ?? [],
-		rpcTags: [
-			...e.discovered.queries.map((e) => e.descriptor.name),
-			...e.discovered.mutations.map((e) => e.descriptor.name),
-			...e.discovered.actions.map((e) => e.descriptor.name),
-			...(e.discovered.streams ?? []).map((e) => e.descriptor.name)
-		]
-	});
-	let Ee = (e.log ?? I({ scope: "voltro:serve" })).child("events"), ke = e.broadcastNamespace ?? tt(e.plugins, void 0), je = Re(e.plugins, ke, Ee), Ne = e.membership?.instanceId ?? process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, Ie = e.membership ?? Nt(e.plugins, {
-		instanceId: Ne,
-		namespace: ke,
-		meta: { mode: "serve" },
-		logger: Ee
-	}), S = fe({
-		events: e.discovered.events ?? [],
-		origin: Ne,
-		...je.publishRemote === void 0 ? {} : { publishRemote: je.publishRemote }
-	}), ze = (e.discovered.events ?? []).length > 0 ? await je.attach(S.bus) : null, Be = Dt({
-		store: e.store,
-		schemaRegistry: e.schemaRegistry,
-		cache: i,
-		kv: a,
-		...ve === void 0 ? {} : { webhooksService: ve },
-		...y === void 0 ? {} : { workflowsProxy: y },
-		eventTriggers: e.discovered.eventTriggers ?? [],
-		namespaceIsolationOn: ge,
-		...e.ensureTenantProvisioned === void 0 ? {} : { ensureTenantProvisioned: e.ensureTenantProvisioned },
-		...e.resolveResidentStore === void 0 ? {} : { resolveResidentStore: e.resolveResidentStore },
-		...Te === void 0 ? {} : { outbox: { nudge: Te.nudge } },
-		...x.active ? { connections: { registry: x.registry } } : {},
-		eventBus: S.bus
-	}), Ve = U.succeed(ir, h), He = U.succeed(sr, Ge), Ue = U.succeed(K, Ht), We = U.succeed(cr, zt), Ke = (t, n) => {
-		let r = t.pipe(H.provide(Pr(n)));
-		return (e.baseLayer ? r.pipe(H.provide(e.baseLayer)) : r).pipe(H.provide(Ve)).pipe(H.provide(He)).pipe(H.provide(Ue)).pipe(H.provide(We));
-	}, Je = (e, t) => {
-		let n = Ke(e, t);
-		return Qr(n);
-	}, Xe = xn(), Ze = St(e.plugins ?? [], Xe), Qe = d({
-		plugins: e.plugins ?? [],
-		metrics: Xe,
-		log: e.log ?? I({ scope: "voltro:serve" })
-	}), $e = g(e.plugins ?? [], Xe), et = e.security?.defaultDeny ?? !0, nt = Lr({
-		store: e.store,
-		defaultDeny: et,
-		recordMetric: (e) => {
-			Xe.record(e);
-		},
-		...Ze.mutation === void 0 ? {} : { interceptor: Ze.mutation },
-		buildContext: (e, t, n) => Be(e, t, n),
-		runEffect: Je,
-		undoCapture: be()
-	}), rt = Le();
-	{
-		let t = s();
-		t !== void 0 && (e.log ?? I({ scope: "voltro:serve" })).info(t);
-	}
-	let it = Pe({
-		store: e.store,
-		...e.approvals === void 0 ? {} : { defaultExpiryMs: e.approvals.defaultExpiryMs }
-	}), ot = Er({
-		defaultDeny: et,
-		buildContext: (e) => Be(e),
-		runEffect: Je,
-		recordMetric: (e) => {
-			Xe.record(e);
-		},
-		...Ze.action === void 0 ? {} : { interceptor: Ze.action }
-	}), st = Br({
-		tenantScopedTables: e.tenantScopedTables,
-		softDeleteScopedTables: e.softDeleteScopedTables
-	}), ct = {
-		defaultDeny: et,
-		buildContext: (e) => Be(e),
-		finalize: (e, t) => st(e, t.subject),
-		provideEffect: Ke,
-		...Ze.query === void 0 ? {} : { interceptor: Ze.query }
-	}, T = zr(ct), dt = Rr({
-		...ct,
-		queryRows: (t, n) => e.store.query(t).then((e) => ai(t.table, e, n.subject))
-	}), ft = Vr({
-		...ct,
-		subscribeDescriptor: (e, t, n) => r.subscribe(e, t, n),
-		subscribeComputed: (e, t, n) => r.subscribeComputed(e, t, n)
-	}), E = (e) => e.filter((e) => Pn(e.descriptor)), D = {};
-	for (let t of [
-		...E(e.discovered.queries),
-		...rt.queries,
-		...it.queries,
-		...x.queries
-	]) D[t.descriptor.name] = (e) => J(T(t, e), r, `subscription.${t.descriptor.name}`, void 0, void 0, Y(t, e));
-	for (let t of [
-		...E(e.discovered.mutations),
-		...rt.mutations,
-		...it.mutations,
-		...x.mutations
-	]) {
-		let n = Ir(t.descriptor.output);
-		D[t.descriptor.name] = (r) => q(async (e, n) => nt(t, e, n), r, `mutation.${t.descriptor.name}`, n, e.idempotency, z(t.descriptor, "mutation"));
-	}
-	for (let t of [...E(e.discovered.actions), ...x.actions]) {
-		let n = Ir(t.descriptor.output);
-		D[t.descriptor.name] = (r) => q(async (e, n) => ot(t, e, n), r, `action.${t.descriptor.name}`, n, e.idempotency, z(t.descriptor, "action"));
-	}
-	let mt = () => `public-${Math.random().toString(36).slice(2, 10)}`, ht = [
-		...e.discovered.queries.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
-			descriptor: e.descriptor,
-			invoke: (t, n) => dt(e, t, {
-				subject: n.subject,
-				traceId: mt()
-			}),
-			subscribe: (t, n, r) => ft(e, t, {
-				subject: n.subject,
-				traceId: mt()
-			}, r)
-		})),
-		...e.discovered.mutations.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
-			descriptor: e.descriptor,
-			invoke: (t, n) => nt(e, t, {
-				subject: n.subject,
-				traceId: mt()
-			})
-		})),
-		...e.discovered.actions.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
-			descriptor: e.descriptor,
-			invoke: (t, n) => ot(e, t, {
-				subject: n.subject,
-				traceId: mt()
-			})
-		}))
-	], gt = {
-		candidates: ie({
-			queries: e.discovered.queries,
-			mutations: e.discovered.mutations,
-			actions: e.discovered.actions,
-			descriptorOf: (e) => e.descriptor,
-			runQuery: (e, t, n) => Promise.resolve(dt(e, t, n)),
-			runMutation: (e, t, n) => Promise.resolve(nt(e, t, n)),
-			runAction: (e, t, n) => Promise.resolve(ot(e, t, n))
-		}),
-		policy: e.agents?.tools ?? {},
-		mcpEnabled: e.agents?.mcp === !0,
-		resolveSubject: (t) => e.resolveSubject(t, -1).then((e) => e.subject)
-	}, O = At({
-		...e.restRoutes === void 0 ? {} : { restRoutes: e.restRoutes },
-		publicApiEntries: ht,
-		store: e.store,
-		resolveSubject: (t) => e.resolveSubject(t, -1).then((e) => e.subject),
-		...e.idempotency === void 0 ? {} : { idempotency: e.idempotency },
-		log: e.log ?? I({ scope: "voltro:serve" })
-	}), vt = e.dataTransferSecret ?? process.env.VOLTRO_DATA_TRANSFER_SECRET, yt = vt && vt.length >= 16 ? [{
-		method: "POST",
-		path: Bi,
-		handle: aa({
-			secret: vt,
-			store: e.store,
-			...e.dataTransferSnapshot ? { snapshot: e.dataTransferSnapshot } : {},
-			assetSink: Ni(di()),
-			openArchive: (e) => ua(di(), e),
-			refreshSubscriptions: (e) => {
-				r.refreshAll(e);
-			}
-		})
-	}, {
-		method: "POST",
-		path: Vi,
-		handle: la({
-			secret: vt,
-			store: e.store,
-			snapshot: e.dataTransferSnapshot ?? { tables: [] },
-			dialect: e.dataTransferDialect ?? "memory",
-			tenantTables: [...e.tenantScopedTables],
-			loadProfile: Tn,
-			assetSource: Pi(di(), e.store),
-			putArchive: async (e, t) => {
-				let { Readable: n } = await import("node:stream"), r = di(), i = fi("storage", () => n.from(t()));
-				await H.runPromise(mi(r, e, i, { contentType: "application/octet-stream" }));
-			}
-		})
-	}] : [], bt = [
-		...e.httpRoutes ?? [],
-		...O.httpRoutes,
-		...yt,
-		...x.httpRoutes
-	];
-	Object.assign(D, S.handlers);
-	for (let t of E(e.discovered.streams ?? [])) D[t.descriptor.name] = (n) => hr((r) => ci(r, (r) => {
-		let i = Be(r), a = t.executor(n, i);
-		if (H.isEffect(a)) {
-			let t = a.pipe(H.provide(Pr(i.store)));
-			return (e.baseLayer ? t.pipe(H.provide(e.baseLayer)) : t).pipe(H.provide(Ve)).pipe(H.provide(He)).pipe(H.provide(Ue)).pipe(H.provide(We));
-		}
-		return typeof a == "object" && a && typeof a.then == "function" ? H.promise(() => a) : a;
-	}), `stream.${t.descriptor.name}`);
-	for (let t of e.discovered.workflows ?? []) D[t.definition.name] = (e) => q(async (e, n) => {
-		let r = n;
-		return Wr(y, {
-			subject: r.subject,
-			traceId: r.traceId,
-			source: "workflow-rpc"
-		}).start(t.definition.name, e);
-	}, e, `workflow.${t.definition.name}`);
-	pe && (D[Bn.name] = (e) => J(T({
-		descriptor: Bn,
-		executor: (e) => {
-			let t = e.id;
-			return {
-				table: "_voltro_workflow_runs",
-				order: [{
-					column: "startedAt",
-					direction: "desc"
-				}],
-				predicate: rr(G("id", t), G("executionId", t)),
-				take: 1,
-				skip: void 0,
-				projection: void 0
-			};
-		}
-	}, e), r, `subscription.${Bn.name}`), D[Hn.name] = (e) => J(T({
-		descriptor: Hn,
-		executor: (e) => {
-			let t = e, n = [...t.tag === void 0 ? [] : [G("tag", t.tag)], ...t.status === void 0 ? [] : [G("status", t.status)]], r = Number.isFinite(t.limit) && t.limit !== void 0 ? Math.min(Math.max(Math.floor(t.limit), 1), 500) : 100;
-			return {
-				table: "_voltro_workflow_runs",
-				order: [{
-					column: "startedAt",
-					direction: "desc"
-				}],
-				predicate: n.length === 0 ? void 0 : n.length === 1 ? n[0] : er(...n),
-				take: r,
-				skip: void 0,
-				projection: void 0
-			};
-		}
-	}, e), r, `subscription.${Hn.name}`), D[Vn.name] = (e) => J(T({
-		descriptor: Vn,
-		executor: (e) => {
-			let t = e.runId;
-			return {
-				table: "_voltro_workflow_run_steps",
-				order: [{
-					column: "startedAt",
-					direction: "asc"
-				}],
-				predicate: G("runId", t),
-				take: 1e3,
-				skip: void 0,
-				projection: void 0
-			};
-		}
-	}, e), r, `subscription.${Vn.name}`), D[zn.name] = (e) => J(T({
-		descriptor: zn,
-		executor: (e) => {
-			let t = e.runId;
-			return {
-				table: "_voltro_workflow_run_events",
-				order: [{
-					column: "occurredAt",
-					direction: "asc"
-				}],
-				predicate: G("runId", t),
-				take: 1e3,
-				skip: void 0,
-				projection: void 0
-			};
-		}
-	}, e), r, `subscription.${zn.name}`), D[B.name] = (e) => J(T({
-		descriptor: B,
-		executor: (e) => {
-			let t = e;
-			return {
-				table: "_voltro_workflow_events",
-				order: [{
-					column: "occurredAt",
-					direction: "desc"
-				}],
-				predicate: t.name === void 0 ? void 0 : G("name", t.name),
-				take: Math.max(1, Math.min(500, t.limit ?? 100)),
-				skip: void 0,
-				projection: void 0
-			};
-		}
-	}, e), r, `subscription.${B.name}`), D[V.name] = (e) => J(T({
-		descriptor: V,
-		executor: (e) => {
-			let t = e.eventId;
-			return {
-				table: "_voltro_workflow_event_deliveries",
-				order: [{
-					column: "createdAt",
-					direction: "asc"
-				}],
-				predicate: G("eventId", t),
-				take: 500,
-				skip: void 0,
-				projection: void 0
-			};
-		}
-	}, e), r, `subscription.${V.name}`), D[Ln.name] = (t) => q(async (t, n) => {
-		let r = t;
-		return await _t(e.store, n.subject, { executionId: r.executionId }), await y.cancel(r.workflowName, r.executionId), await Ft(r.workflowName, r.executionId, "workflow.cancel"), { ok: !0 };
-	}, t, `action.${Ln.name}`), D[Rn.name] = (t) => q(async (t, n) => {
-		let r = t;
-		return await _t(e.store, n.subject, { executionId: r.executionId }), await y.resume(r.workflowName, r.executionId), { ok: !0 };
-	}, t, `action.${Rn.name}`), D[Un.name] = (t) => q(async (t, n) => {
-		let r = t;
-		return await _t(e.store, n.subject, { id: r.id }), y.signal({ id: r.id }, r.signalName, r.payload);
-	}, t, `action.${Un.name}`), D[Wn.name] = (t) => q(async (t, n) => {
-		let r = t;
-		return await _t(e.store, n.subject, { id: r.id }), y.update({ id: r.id }, r.updateName, r.payload, r.timeoutMs === void 0 ? void 0 : { timeoutMs: r.timeoutMs });
-	}, t, `action.${Wn.name}`));
-	let xt = [
-		...E(e.discovered.queries).map((e) => R(e.descriptor)),
-		...E(e.discovered.mutations).map((e) => Fn(e.descriptor)),
-		...E(e.discovered.actions).map((e) => L(e.descriptor)),
-		...rt.queries.map((e) => R(e.descriptor)),
-		...rt.mutations.map((e) => Fn(e.descriptor)),
-		...it.queries.map((e) => R(e.descriptor)),
-		...it.mutations.map((e) => Fn(e.descriptor)),
-		...x.queries.map((e) => R(e.descriptor)),
-		...x.mutations.map((e) => Fn(e.descriptor)),
-		...x.actions.map((e) => L(e.descriptor)),
-		...E(e.discovered.streams ?? []).map((e) => In(e.descriptor)),
-		...S.rpcs,
-		...(e.discovered.workflows ?? []).map((e) => li(e.definition)),
-		...pe ? [
-			R(Bn),
-			R(Hn),
-			R(Vn),
-			R(zn),
-			R(B),
-			R(V),
-			L(Ln),
-			L(Rn),
-			L(Un),
-			L(Wn)
-		] : []
-	], wt = Qn.make(...xt).middleware(jn).middleware(Mn), Et = Mr({ resolveSubject: ({ headers: t, clientId: n }) => e.resolveSubject(t, n) }), kt = e.dormancyTenantId ?? ar, jt = e.dormancy === "sleep" ? {
-		register: (t, n, r) => Xr(e.store, {
-			tenantId: r ?? kt,
-			kind: "workflow",
-			refId: t,
-			wakeAt: n
-		}),
-		cancel: (t, n) => _r(e.store, {
-			tenantId: n ?? kt,
-			kind: "workflow",
-			refId: t
-		}).then(() => {})
-	} : void 0, k = he ? await import("@voltro/workflow") : void 0, A = k?.makeWorkflowRunRecorder({
-		store: e.store,
-		...e.workflowRecording === void 0 ? {} : { recording: e.workflowRecording },
-		...jt === void 0 ? {} : { wakeups: jt }
-	}), Pt = async (t, n) => {
-		await k.closeWorkflowChildrenForParent({
-			store: e.store,
-			parentExecutionId: t,
-			parentStatus: n,
-			recorder: A,
-			log: { warn: (e, t) => {
-				process.stderr.write(`[workflow] ${e} ${t ? JSON.stringify(t) : ""}\n`);
-			} },
-			interruptChild: async (t, n) => {
-				let r = (e.discovered.workflows ?? []).find((e) => e.definition.name === t);
-				if (!r) throw Error(`Unknown child workflow: ${t}`);
-				if (!f) throw Error("Workflow runtime is not ready");
-				await f.runPromise(r.definition.interrupt(n));
-			}
-		});
-	}, Ft = async (t, n, r) => {
-		let i = (await e.store.query({
-			table: "_voltro_workflow_runs",
-			order: [],
-			predicate: G("executionId", n),
-			projection: void 0,
-			skip: void 0,
-			take: 1
-		}))[0];
-		if (i === void 0) return;
-		let a = await e.store.update("_voltro_workflow_runs", i.id, {
-			status: "cancelled",
-			cancelled: !0,
-			completedAt: /* @__PURE__ */ new Date()
-		}), o = i.subject?.tenantId ?? void 0;
-		a && await A.recordEvent({
-			runId: i.id,
-			eventType: "run-cancelled",
-			payload: {
-				reason: r,
-				workflowName: t,
-				executionId: n,
-				...o == null ? {} : { tenantId: o }
-			}
-		}), a && await Pt(n, "cancelled");
-	}, It = [
-		...Gr(e.discovered.workflows ?? [], {
-			buildContext: (t, n) => e.buildContextForWorkflow?.(t, n) ?? Be({
-				subject: t.subject,
-				traceId: t.traceId
-			}, e.store, void 0, `workflow:${n.workflowName}`, { parentExecutionId: n.executionId }),
-			resolveStartContext: ue,
-			...de === void 0 ? {} : { resolveAuthority: de }
-		}, (t, n, r) => {
-			let i = k.getWorkflowVersionMetadata(t.definition);
-			return k.wrapWorkflowExecuteWithRunRecording({
-				name: t.definition.name,
-				store: e.store,
-				subject: r.subject,
-				source: r.source ?? null,
-				traceId: r.traceId,
-				workflowVersion: i.version,
-				workflowCompatibleVersions: i.compatibleWith,
-				workflowPatches: i.patches,
-				parentExecutionId: r?.parentExecutionId ?? null,
-				parentClosePolicy: r?.parentClosePolicy ?? null,
-				onParentClose: ({ executionId: e, status: t }) => Pt(e, t),
-				...qe(t.definition),
-				onTerminal: async ({ executionId: e }) => {
-					await ee?.gate.release(e);
-				},
-				recorder: A,
-				pluginWorkflowStepLayer: $e,
-				recordRun: Yr
-			}, n);
-		}),
-		...e.discovered.workflowWorkers ?? [],
-		...xe === void 0 ? [] : [xe]
-	], Lt = [...(e.discovered.workflows ?? []).map((e) => e.definition.name).filter(Boolean), ...xe === void 0 ? [] : ["voltro.deliverWebhook"]], Rt = It.length > 0 ? U.mergeAll(...It) : U.empty;
-	if (((e.discovered.workflows?.length ?? 0) > 0 || (e.discovered.workflowWorkers?.length ?? 0) > 0 || e.scheduleCoordination === "cluster" || xe !== void 0) && e.workflowEngineLayer !== void 0) {
-		let t = Rt.pipe(U.provideMerge(e.workflowEngineLayer));
-		f = Kn.make(e.baseLayer === void 0 ? t : t.pipe(U.provideMerge(e.baseLayer))), await f.runPromise(H.void), (e.log ?? I({ scope: "voltro:serve" })).child("workflow").info(`workflow runtime ready — ${Lt.length} entity type(s) registered`, { entities: Lt });
-		let n = await import("@voltro/workflow/cluster"), r = (e) => f.runPromise(n.redriveFailedRun(e)), i = (e) => f.runPromise(n.resumeRunFromStep(e));
-		ne = await j({
-			provider: ki(e.plugins ?? [])?.broadcast?.provider,
-			crossReplica: ki(e.plugins ?? [])?.broadcast?.crossReplica ?? !1,
-			namespace: ke,
-			replicaId: crypto.randomUUID(),
-			pollStorage: () => f.runPromise(n.pollWorkflowStorage),
-			onChange: (t) => e.store.onChange((e) => t({
-				table: e.table,
-				op: e.op,
-				...e.origin === void 0 ? {} : { origin: e.origin }
-			})),
-			log: (e.log ?? I({ scope: "voltro:serve" })).child("workflow")
-		}), p = async (t) => {
-			let n = await oe({
-				store: e.store,
-				workflows: e.discovered.workflows ?? [],
-				runRedrive: r
-			}, t.runId);
-			return n.statusReset && await A.recordEvent({
-				runId: t.runId,
-				eventType: "run-redriven",
-				payload: {
-					reason: "inspect.redrive",
-					activitiesReset: n.outcome.activitiesReset
-				}
-			}), {
-				redriven: n.outcome.redriven,
-				activitiesReset: n.outcome.activitiesReset,
-				reason: n.outcome.reason
-			};
-		}, te = async (t) => {
-			let n = await Oe({
-				store: e.store,
-				workflows: e.discovered.workflows ?? [],
-				runResume: i
-			}, t.runId, t.step);
-			return n.statusReset && await A.recordEvent({
-				runId: t.runId,
-				eventType: "run-redriven",
-				payload: {
-					reason: "inspect.resume-from-step",
-					step: n.stepName,
-					activitiesReset: n.outcome.activitiesReset
-				}
-			}), {
-				redriven: n.outcome.redriven,
-				stepName: n.stepName,
-				activitiesReset: n.outcome.activitiesReset,
-				reason: n.outcome.reason
-			};
-		};
-		let a = (e.scheduleCoordination ?? "single") === "advisoryLock" ? Dr(e.store, e.scheduleReplicaId ?? `pid-${process.pid}`) : ni, s = Nr({
-			coordinator: a,
-			replicaId: e.scheduleReplicaId ?? `pid-${process.pid}`
-		}), u = {
-			info: (e, t) => {
-				process.stdout.write(`[flow-control] ${e} ${t ? JSON.stringify(t) : ""}\n`);
-			},
-			warn: (e, t) => {
-				process.stderr.write(`[flow-control] ${e} ${t ? JSON.stringify(t) : ""}\n`);
-			},
-			error: (e, t) => {
-				process.stderr.write(`[flow-control] ERROR ${e} ${t ? JSON.stringify(t) : ""}\n`);
-			}
-		}, d, m = () => {
-			if (d !== void 0) return d;
-			if (o !== void 0 && A !== void 0) return d = re({
-				store: e.store,
-				log: P,
-				workflows: e.discovered.workflows ?? [],
-				workflowsProxy: o,
-				workflowRuntime: f,
-				workflowRunRecorder: A,
-				closeChildrenForParent: Pt
-			}), d;
-		};
-		c = m, ee = at({
-			store: e.store,
-			onChange: (t) => e.store.onChange((e) => t({
-				table: e.table,
-				op: e.op
-			})),
-			...e.scheduling === void 0 ? {} : {
-				disarmWhenIdle: e.scheduling.disarmWhenIdle,
-				drainIntervalMs: e.scheduling.admissionDrainMs,
-				cancelSweepIntervalMs: e.scheduling.cancelSweepMs,
-				stalenessSweepIntervalMs: e.scheduling.stalenessSweepMs
-			},
-			workflows: e.discovered.workflows ?? [],
-			facade: () => o,
-			cancelRunWithReason: m,
-			recordRunEvent: () => A?.recordEvent,
-			...e.workflowStaleness === void 0 ? {} : { staleness: e.workflowStaleness },
-			...e.workflowSuspendSignalHintMs === void 0 ? {} : { suspendSignalHintMs: e.workflowSuspendSignalHintMs },
-			scheduleCoordinated: s,
-			onAbandoned: async (t) => {
-				await Ot({
-					workflows: e.discovered.workflows ?? [],
-					facade: () => o,
-					log: u,
-					...t
-				});
-			},
-			log: u
-		});
-		let h = ee;
-		h !== void 0 && qr(() => h.stop()), l = Ye({
-			store: e.store,
-			onChange: (t) => e.store.onChange((e) => t({
-				table: e.table,
-				op: e.op
-			})),
-			...e.scheduling === void 0 ? {} : {
-				disarmWhenIdle: e.scheduling.disarmWhenIdle,
-				tickIntervalMs: e.scheduling.inferenceTickMs
-			},
-			enabled: (e.discovered.workflows?.length ?? 0) > 0,
-			resumeSignal: () => f === void 0 || k === void 0 ? void 0 : async ({ executionId: t, workflowName: n, signalName: r, payload: i }) => {
-				await f.runPromise(k.completeSuspendingSignal({
-					store: e.store,
-					target: Mt(t, n),
-					signalName: r,
-					payload: i
-				}));
-			},
-			runEffect: (e) => f.runPromise(e),
-			scheduleCoordinated: s,
-			log: u
-		});
-		let ie = l;
-		ie !== void 0 && qr(() => ie.stop()), o = (e.discovered.workflows?.length ?? 0) > 0 ? Ur({
-			workflows: e.discovered.workflows ?? [],
-			runEffect: (e) => f.runPromise(e),
-			onEnqueue: () => ne?.publishWake(),
-			...h === void 0 ? {} : {
-				admitStart: h.gate.admitStart,
-				startPayloadSchema: h.gate.startPayloadSchema,
-				parkDelayedStart: h.gate.parkDelayed
-			},
-			rememberStartContext: le,
-			signal: async (t, n, r) => {
-				let i = await k.sendWorkflowSignal({
-					store: e.store,
-					recorder: A,
-					target: t,
-					signalName: n,
-					payload: r
-				});
-				return await f.runPromise(k.completeSuspendingSignal({
-					store: e.store,
-					target: t,
-					signalName: n,
-					payload: r
-				})).catch(() => {}), i;
-			},
-			update: (t, n, r, i) => k.sendWorkflowUpdate({
-				store: e.store,
-				recorder: A,
-				target: t,
-				updateName: n,
-				payload: r,
-				...i === void 0 ? {} : { options: i }
-			}),
-			listRuns: (t) => Ae(e.store, t),
-			retry: (t, n) => Me({
-				store: e.store,
-				workflows: e.discovered.workflows ?? [],
-				runPromise: (e) => f.runPromise(e)
-			}, t, n),
-			redrive: (t) => oe({
-				store: e.store,
-				workflows: e.discovered.workflows ?? [],
-				runRedrive: r
-			}, t).then((e) => e.outcome)
-		}) : void 0;
-	}
-	let Bt = U.mergeAll(wt.toLayer(D), Et), Vt = Tt(D, e.discovered.queries.map((e) => e.descriptor.name), pe), Wt = U.mergeAll(wt.toLayer(Vt), Et), M = e.observability, Gt = await gr({
-		...e.appName === void 0 ? {} : { serviceName: e.appName },
-		...M && M.spanProcessors.length > 0 ? { extraSpanProcessors: M.spanProcessors } : {},
-		...M && M.metricReaders.length > 0 ? { extraMetricReaders: M.metricReaders } : {},
-		...M && Object.keys(M.resourceAttributes).length > 0 ? { resourceAttributes: M.resourceAttributes } : {},
-		...M && M.sampler !== void 0 ? { sampler: M.sampler } : {}
-	}), Kt = !1, N = e.store.ping ? () => e.store.ping().then(() => !0).catch(() => !1) : void 0, { server: qt, shutdown: Jt } = ri({
-		group: wt,
-		handlersLayer: Bt,
-		httpHandlersLayer: Wt,
-		port: e.port ?? 4e3,
-		...e.host === void 0 ? {} : { host: e.host },
-		path: e.path ?? "/ws",
-		tracerLayer: Gt.layer,
-		security: ye(e),
-		...Qe,
-		healthCheck: {
-			isReady: () => Kt,
-			...N ? { ping: N } : {}
-		},
-		...bt.length > 0 ? { httpRoutes: bt } : {},
-		...e.getStore === void 0 ? {} : { getStore: e.getStore },
-		...Se.size > 0 ? { webhookRoutes: Se } : {},
-		...e.inspectRoute === void 0 ? {} : { inspectRoute: e.inspectRoute }
-	}), Yt = zi(qt);
-	if (await mr(qt), (e.discovered.schedules?.length ?? 0) > 0) {
-		let t = (e.scheduleCoordination ?? "single") === "advisoryLock" ? Dr(e.store, e.scheduleReplicaId ?? `pid-${process.pid}`) : ni;
-		m = await ii(e.discovered.schedules ?? [], {
-			store: e.store,
-			coordinator: t,
-			defaultTrigger: e.scheduleDefaultTrigger ?? "self",
-			replicaId: e.scheduleReplicaId ?? `pid-${process.pid}`,
-			armSelf: e.scheduleArmSelf ?? !0,
-			dormancy: e.dormancy ?? "always-on",
-			...e.dormancyTenantId === void 0 ? {} : { dormancyTenantId: e.dormancyTenantId },
-			buildContext: ({ traceId: t, scheduleName: n, subject: r }) => Be({
-				subject: r,
-				traceId: t
-			}, e.store, void 0, `schedule:${n}`),
-			log: {
-				info: (e, t) => {
-					process.stdout.write(`[schedule] ${e} ${t ? JSON.stringify(t) : ""}\n`);
-				},
-				warn: (e, t) => {
-					process.stderr.write(`[schedule] ${e} ${t ? JSON.stringify(t) : ""}\n`);
-				},
-				error: (e, t) => {
-					process.stderr.write(`[schedule] ERROR ${e} ${t ? JSON.stringify(t) : ""}\n`);
-				},
-				debug: () => {}
-			},
-			...e.scheduleFireInterceptor === void 0 ? {} : { interceptFire: e.scheduleFireInterceptor },
-			...e.onScheduleRunEvent === void 0 ? {} : { onRunEvent: e.onScheduleRunEvent }
-		}), e.onSchedulerReady?.(m);
-	}
-	let P = e.log ?? I({ scope: "voltro:serve" }), Xt, Zt;
-	if ((e.discovered.subscribers?.length ?? 0) > 0 && (Xt = C(e.discovered.subscribers ?? [], e.store, P.child("subscribe"), e.schemaRegistry, S.bus)), (e.discovered.reactions?.length ?? 0) > 0) {
-		let t = P.child("reaction"), n = async (n, r) => {
-			if (n.kind === "workflow") {
-				if (y === void 0) {
-					t.warn("reaction workflow act skipped — no workflow engine in this app", { workflow: n.workflow });
-					return;
-				}
-				let e = n.payload === void 0 ? r.new ?? r.old ?? {} : n.payload(r);
-				await Wr(y, {
-					traceId: `reaction:${n.workflow}`,
-					source: `reaction:${n.workflow}`
-				}).start(n.workflow, e);
-				return;
-			}
-			await ut(n.agent, r, {
-				findAgentSend: (t) => e.discovered.actions.find((e) => e.descriptor.name === `${t}.send`),
-				runAction: (e, t, n) => Promise.resolve(ot(e, t, n)),
-				makeSubject: (e) => Nn(e),
-				now: () => Date.now(),
-				log: t
-			});
-		}, r = async (n, r) => {
-			try {
-				let { requireAiBudget: t } = await import("@voltro/ai");
-				return (await H.runPromise(H.either(t(e.store, {
-					tenantId: n,
-					limitUsd: r
-				}))))._tag === "Right";
-			} catch (e) {
-				return t.warn("reaction budget check failed — refusing the act", { tenantId: n }, e), !1;
-			}
-		}, i = pt(e.store, { onError: (e) => t.warn("reaction: rate-slot claim failed; refusing the act", { cause: String(e) }) });
-		Zt = u(e.discovered.reactions ?? [], e.store, {
-			runAct: n,
-			checkBudget: r,
-			claimRateSlot: (e) => i.claim(e)
-		}, t);
-	}
-	let Qt;
-	(e.discovered.aggregates?.length ?? 0) > 0 && (Qt = await De({
-		discovered: e.discovered.aggregates ?? [],
-		store: e.store,
-		log: P.child("aggregate"),
-		...e.analytics === void 0 ? {} : { analytics: e.analytics },
-		...e.aggregateStorage === void 0 ? {} : { storage: e.aggregateStorage },
-		...e.aggregateCoordinator === void 0 ? {} : { coordinator: e.aggregateCoordinator }
-	}), Ve = U.succeed(ir, Qt.registry));
-	let $t;
-	(e.discovered.expectations?.length ?? 0) > 0 && ($t = dr({
-		discovered: e.discovered.expectations ?? [],
-		store: e.store,
-		log: P.child("expectation")
-	}), He = U.succeed(sr, $t.registry)), (e.discovered.budgets?.length ?? 0) > 0 && (n = pr({
-		discovered: e.discovered.budgets ?? [],
-		log: P.child("finops")
-	}), Ue = U.succeed(K, n.registry));
-	let en;
-	return (e.discovered.experiments?.length ?? 0) > 0 && (en = fr({
-		discovered: e.discovered.experiments ?? [],
-		store: e.store,
-		log: P.child("experiment")
-	}), We = U.succeed(cr, en.registry)), Kt = !0, e.bootTiming?.mark("ready"), {
-		dispatcher: r,
-		server: qt,
-		scheduler: m,
-		eventsSnapshot: me(S.bus, S.declared),
-		membersSnapshot: () => ({
-			members: Ie.membership.list(),
-			capturedAt: Date.now()
-		}),
-		agentTools: () => gt,
-		rpcMetrics: () => Xe,
-		webhooksService: () => ve,
-		runCanceller: () => c(),
-		flowControlHealth: () => ee?.cancelHealth(),
-		inferenceHealth: () => l?.health(),
-		workflowWriteActions: () => y === void 0 || A === void 0 ? void 0 : se({
-			store: e.store,
-			log: P,
-			workflows: e.discovered.workflows ?? [],
-			workflowsProxy: o,
-			workflowRuntime: f,
-			workflowRunRecorder: A,
-			closeChildrenForParent: Pt
-		}),
-		redriveWorkflowRun: (e) => p ? p(e) : Promise.reject(/* @__PURE__ */ Error("redrive: this app registers no workflows")),
-		resumeWorkflowRunFromStep: (e) => te ? te(e) : Promise.reject(/* @__PURE__ */ Error("resume-from-step: this app registers no workflows")),
-		close: async () => {
-			Kt = !1, await Yt.drainRequests();
-			for (let e of Ce) try {
-				await e();
-			} catch (e) {
-				P.warn("serve: teardown step failed", {}, e);
-			}
-			await ze?.detach(), await Ie.detach(), Qt?.detach(), $t?.detach(), n?.detach(), en?.detach(), Zt?.(), Xt?.(), await m?.shutdown(), r.close(), await ne?.detach(), await f?.dispose(), await Jt(), await Yt.finish();
-		}
-	};
-}, $ = I({ scope: "voltro:serve" }), pa = (e, t, n) => (e === "production" || e === "staging") && t !== "memory" && n !== "0", ma = Wt, ha = async (e) => {
-	let t = Cn(process.cwd());
-	if (kn(t)) {
-		let n;
-		try {
-			let e = await import(An(t).href);
-			typeof e.runServe == "function" ? n = e.runServe : $.warn("serve bundle has no runServe export — using the standard serve path");
-		} catch (e) {
-			$.warn("serve bundle failed to load — using the standard serve path", {}, e);
-		}
-		if (n) return $.info("serve: booting from the precompiled serve bundle"), n(e);
-	}
-	return ga(e);
-}, ga = async (s) => {
-	let u = wn();
-	e("serve");
-	try {
-		_i();
-	} catch (e) {
-		throw i(e instanceof Error ? e.message : String(e));
-	}
-	let d = process.cwd(), h = await Ke(d), re = M({
-		kind: "api",
-		configPort: h?.port,
-		env: process.env,
-		flagPort: ma(s, "--port")
-	});
-	for (let e of re.warnings) $.warn(e);
-	let ie = re.port;
-	$r(Zr(h?.secrets)), await Gt({
-		rawEnv: h?.env,
-		appType: "api",
-		root: d,
-		log: $,
-		generateTypes: !1
-	}), u.mark("config");
-	let g = (process.env.DB_DIALECT ?? h?.store ?? "memory").toLowerCase(), ae = (g === "mariadb" || g === "postgres" || g === "mssql") && (process.env.CDC ?? "1") !== "0", oe = g === "mariadb" ? "mariadb" : g === "mssql" ? "mssql" : void 0, se = Sn(d);
-	if (!r() && kn(se)) try {
-		let e = await import(An(se).href);
-		if (e.modules) {
-			let t = {};
-			for (let [n, r] of Object.entries(e.modules)) t[Dn(d, n)] = r;
-			n(t), $.info("precompiled api bundle loaded", { modules: Object.keys(t).length });
-		}
-	} catch (e) {
-		$.warn("precompiled api bundle failed to load — falling back to source", {}, e);
-	}
-	let _ = await Qe(d), v = await k(_, { cdc: ae && oe !== void 0 }), fe = Se(v);
-	{
-		let e = /* @__PURE__ */ new Set([
-			...v.queries.filter((e) => e.descriptor.overridesPlugin === !0).map((e) => e.descriptor.name),
-			...v.mutations.filter((e) => e.descriptor.overridesPlugin === !0).map((e) => e.descriptor.name),
-			...v.actions.filter((e) => e.descriptor.overridesPlugin === !0).map((e) => e.descriptor.name)
-		]);
-		Qt(Zt(h?.plugins ?? []), [
-			...v.queries.map((e) => e.descriptor.name),
-			...v.mutations.map((e) => e.descriptor.name),
-			...v.actions.map((e) => e.descriptor.name),
-			...v.streams.map((e) => e.descriptor.name)
-		], e);
-		let t = Ne(v.serverOnlyLeaks, ke(process.env, "strict"), br, "`voltro serve`");
-		if (t.action === "fail") throw i(t.message ?? "");
-		t.action === "warn" && $.warn(t.message ?? "");
-	}
-	let me = _.filter((e) => bn.test(e)), be = me.length > 0 ? await yn(me, $.child("webhooks")) : {
-		outgoing: [],
-		incoming: [],
-		providers: []
-	}, De = _n(v.events), Oe = be.outgoing.length + be.incoming.length + be.providers.length + De.length === 0 ? void 0 : {
-		...be,
-		outgoing: [...be.outgoing, ...De]
-	}, Ae = on({
-		nodeEnv: process.env.NODE_ENV,
-		cdcDialect: oe,
-		declared: h?.schema
-	}), Me = en({
-		gates: Ae,
-		runtime: {
-			traces: ve(),
-			undo: oi()
-		}
-	});
-	if (Me !== void 0) throw i(`serve: ${Me}`);
-	let Pe = an({
-		mix: v.featureMix,
-		plugins: h?.plugins ?? [],
-		gates: Ae,
-		...oe ? { cdcDialect: oe } : {}
-	}), Fe = h?.analytics !== void 0 && h.analytics.kind !== "noop" && g !== "memory" ? (await N(g)).makeSqlLayer(O()) : void 0, Le = await c({
-		spec: h?.analytics,
-		sqlLayer: Fe,
-		log: $
-	}), C = (() => {
-		let e = new Set(v.tables.map((e) => e.tableName)), t = [...v.tables];
-		for (let n of [...Pe, ...Le.tables]) e.has(n.tableName) || (e.add(n.tableName), t.push(n));
-		return t;
-	})();
-	for (let e of C) nr(e);
-	{
-		let e = xr(si(Vt(v), We(C)));
-		e !== void 0 && $.warn(e);
-	}
-	let Re = (process.env.NODE_ENV ?? "").toLowerCase();
-	if (pa(Re, g, process.env.VOLTRO_AUTO_MIGRATE)) {
-		let e = (await N(g)).makeSqlLayer(O()), t = await H.runPromise(qn.SqlClient.pipe(H.flatMap((e) => Xn(e, d)), H.provide(e), H.catchAll(() => H.succeed([]))));
-		t.length > 0 && ($.error(`serve: refusing to boot — ${t.length} pending file-based migration(s) have never run against this database. They perform the changes a schema diff cannot infer (data moves, backfills, table splits), so the declarative fingerprint check below cannot see them and would have let this process serve un-migrated data.`, { pending: t }), $.error("Run them from your pre-deploy job — `voltro db migrate .` (schema + files) or `voltro db files .` (files alone) — or set VOLTRO_AUTO_MIGRATE=0 to bypass every boot schema check. `voltro serve` never applies them itself: a rolling deploy would start N replicas and each would try."), process.exit(1));
-		let n = await H.runPromise(qn.SqlClient.pipe(H.flatMap((e) => Zn(e, C, {
-			appliedBy: `serve:${Re}`,
-			environment: "prod",
-			dialectId: g
-		})), H.provide(e)));
-		n.kind === "prod-mismatch" && ($.error(Yn(n, g)), $.error(nn({
-			gates: Ae,
-			nodeEnv: process.env.NODE_ENV,
-			cdcDialect: oe,
-			declared: h?.schema
-		})), $.error("serve: refusing to boot — apply the schema first (voltro db apply in a pre-deploy step), or set VOLTRO_AUTO_MIGRATE=0 to bypass this check."), process.exit(1)), $.info(Yn(n, g));
-	}
-	await Xt({
-		dialectId: g,
-		tables: C,
-		mode: Yt(h?.reactiveTriggers),
-		lockSchema: O().schema,
-		makeLayer: async () => (await N(g)).makeSqlLayer(O()),
-		log: {
-			info: (e, t) => $.info(e, t ?? {}),
-			warn: (e, t) => $.warn(e, t ?? {})
-		}
-	});
-	let Ge = Hr(C);
-	u.mark("discover");
-	let w = await ot(h, void 0), qe = ui(w, g);
-	for (let e of D({
-		dialect: String(h?.store ?? process.env.DB_DIALECT ?? "postgres"),
-		changeStrategy: (process.env.CDC ?? "1") === "0" ? "inline" : "cdc",
-		dbUrl: process.env.DB_URL,
-		crossReplicaBus: ki(h?.plugins ?? [])?.broadcast.crossReplica === !0,
-		tables: v.tables.map((e) => ({
-			tableName: e.tableName,
-			isReactive: e.isReactive === !0
-		})),
-		querySources: v.queries.flatMap((e) => {
-			let t = e.descriptor.source;
-			return t === void 0 ? [] : typeof t == "string" ? [t] : [...t];
-		})
-	})) e.level === "warn" ? $.warn(e.message) : $.info(e.message);
-	{
-		let e = $e({
-			tables: $n().map((e) => ({ tableName: e.tableName })),
-			queries: v.queries.map((e) => ({
-				name: e.descriptor.name,
-				source: e.descriptor.source
-			}))
-		}), t = bt(e);
-		t !== void 0 && $.warn(t);
-	}
-	h?.cache && !process.env.CACHE_BACKEND && (process.env.CACHE_BACKEND = h.cache), h?.cacheRedisUrl && !process.env.CACHE_REDIS_URL && (process.env.CACHE_REDIS_URL = h.cacheRedisUrl), h?.cacheRedisDriver && !process.env.CACHE_REDIS_DRIVER && (process.env.CACHE_REDIS_DRIVER = h.cacheRedisDriver), h?.cacheKeyPrefix && !process.env.CACHE_KEY_PREFIX && (process.env.CACHE_KEY_PREFIX = h.cacheKeyPrefix);
-	let { service: Ye, invalidationBus: at, snapshotCache: lt, cache: ut, semantic: pt, evictSource: _t, backend: St, stats: Ct, dispose: Tt } = await Je({
-		env: process.env,
-		semantic: h?.cacheSemantic ?? !1
-	});
-	pt !== void 0 && $.info("semantic cache enabled — reactive eviction on live writes"), $.info(`cache backend resolved: ${St}` + (St === "redis" ? ` (driver ${process.env.CACHE_REDIS_DRIVER ?? "resp"})` : " — in-process, not cross-instance")), w.onChange((e) => {
-		if (H.runFork(at.publish(e.table)), _t !== void 0) {
-			let t = (e.new ?? e.old)?.id;
-			_t({
-				table: e.table,
-				op: e.op,
-				...t === void 0 ? {} : { id: t }
-			});
-		}
-	}), h?.kv && !process.env.KV_BACKEND && (process.env.KV_BACKEND = h.kv), h?.kvRedisUrl && !process.env.KV_REDIS_URL && (process.env.KV_REDIS_URL = h.kvRedisUrl), h?.kvKeyPrefix && !process.env.KV_KEY_PREFIX && (process.env.KV_KEY_PREFIX = h.kvKeyPrefix);
-	let { kv: Dt, service: Ot } = await jr({ store: w });
-	f({
-		log: $,
-		max: Jt(),
-		outOfPool: we(g, (process.env.CDC ?? "1") !== "0"),
-		readPools: t.replicationSnapshot()?.replicaCount ?? 0,
-		always: !0
-	}), u.mark("store");
-	let At = ur({
-		store: w,
-		sink: Le.sink,
-		log: $
-	}), Mt = A({
-		store: w,
-		dialect: g,
-		log: { info: (e) => $.info(e) }
-	}), j = h?.plugins ?? [], zt = process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, Ht, Ut;
-	g !== "memory" && (Ht = Kn.make((await N(g)).makeSqlLayer(O())), Ut = await Ht.runPromise(qn.SqlClient));
-	let Wt = [
-		"postgres",
-		"mariadb",
-		"mysql",
-		"mssql"
-	].includes(g) ? Dr(w, zt, $) : ni, vn = Be(h?.scheduling), Cn = Nr({
-		maxIdleIntervalMs: vn.pollCeilingMs,
-		coordinator: Wt,
-		replicaId: zt,
-		log: $
-	}), Tn = [], F = process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, On = ki(h?.plugins ?? [])?.broadcast?.provider, I = tt(h?.plugins, h?.name ?? En(d));
-	{
-		let e = it(h?.plugins, h?.name ?? En(d));
-		e !== void 0 && $.warn(e);
-	}
-	let jn = Nt(h?.plugins, {
-		instanceId: F,
-		namespace: I,
-		meta: { mode: "serve" },
-		logger: $
-	}), Mn = {
-		...Ut ? { sql: Ut } : {},
-		instanceId: F,
-		membership: jn.membership,
-		...On === void 0 ? {} : { broadcast: On },
-		broadcastChannels: { presence: Oi(I, "presence") },
-		scheduleCoordinated: (e, t, n) => {
-			let r = Cn(e, t, n);
-			return Tn.push(r), r;
-		}
-	};
-	for (let e of j) e.bindDataStore?.(qe, Mn);
-	l({
-		store: w,
-		...T(),
-		log: $
-	});
-	let L = j.filter((e) => typeof e.onChangeEvent == "function");
-	if (L.length > 0) {
-		let e = w.changeScope ?? "local";
-		w.onChange((t) => {
-			let n = he(t, e);
-			for (let e of L) H.runFork(e.onChangeEvent(n).pipe(H.catchAllCause((t) => H.sync(() => $.warn(`plugin ${e.name} onChangeEvent failed`, { error: Gn.pretty(t) })))));
-		});
-	}
-	let Nn = le({
-		plugins: j,
-		appName: h?.name ?? "voltro-api",
-		appType: "api",
-		voltroVersion: process.env.npm_package_version ?? "0.0.0",
-		log: $
-	});
-	j.length && await Nn.activate(), u.mark("plugins");
-	let Pn = await Nn.gatherObservability(), Fn = {
-		info: (e, t) => process.stdout.write(`[broadcast] ${e} ${t ? JSON.stringify(t) : ""}\n`),
-		warn: (e, t) => process.stderr.write(`[broadcast] ${e} ${t ? JSON.stringify(t) : ""}\n`),
-		debug: () => {}
-	}, R, In = await yt(w, h, g, I, Fn, (e, t) => {
-		R?.refreshAll(`broadcast gap: missed ${t} change(s) from ${e}`);
-	}), z = h?.apiKeys, Ln = (typeof z == "object" ? z.prefix : void 0) ?? "voltro_", B = z ? yr(w) : void 0, V = B ? kr({ flush: Ar(B) }) : void 0;
-	V && qr(() => V.shutdown());
-	let Rn = B ? Or(B, {
-		prefix: Ln,
-		...V ? { usage: V } : {}
-	}) : void 0, zn = Rn ? [Sr(Rn, { prefix: Ln })] : [], Bn = wt([...h?.auth?.strategies ?? [], ...zn], Ei(h?.plugins ?? []), h?.auth?.anonymousTenantRequired ?? !1, h?.auth, () => qe), Vn = [...h?.restRoutes ?? [], ...Rn ? lr(Rn, (typeof z == "object" ? z.managementPath : void 0) ?? "/v1/api-keys") : []], Hn = ht(h?.idempotency, w), Un = j.map((e) => e.services).filter((e) => e !== void 0), Wn = U.mergeAll(Ve({
-		analyticsLayer: Le.layer,
-		cacheService: Ye,
-		kvService: Ot,
-		...pt === void 0 ? {} : { semanticCache: pt },
-		pluginServices: Un,
-		userLayers: h?.layers ?? []
-	}), st(h?.http ?? {})), W = await ct({
-		files: _,
-		store: w,
-		log: $,
-		seedPolicy: "report",
-		seedPattern: pn,
-		loadSeedFiles: P,
-		startupPattern: cn,
-		loadStartupFiles: a,
-		runStartups: o,
-		emailPattern: He,
-		loadEmailFiles: vt,
-		registerEmailTemplates: Di
-	});
-	(W.startupCount > 0 || W.emailCount > 0) && $.info("boot lifecycle", {
-		startups: W.startupCount,
-		emailTemplates: W.emailCount
-	}), W.startups !== void 0 && qr(async () => {
-		await W.startups.stop();
-	}), ce({
-		demands: y(fe),
-		isRegistered: (e) => Cr(e) !== void 0
-	});
-	let Qn = gt({
-		schedules: Et({
-			schedules: v.schedules,
-			seeds: W.seeds,
-			store: w,
-			log: $.child("seeds")
-		}),
-		workflows: v.workflows ?? [],
-		log: $.child("workflow-schedules")
-	}), er = h?.scheduling ?? {}, G = er.trigger ?? "self", rr = /* @__PURE__ */ new Set([
-		"postgres",
-		"mysql",
-		"mariadb",
-		"mssql"
-	]), ir = er.coordination ?? (rr.has(g) ? "advisoryLock" : "single"), K = ir === "cluster" && rr.has(g), ar = K ? "cluster" : ir === "advisoryLock" && rr.has(g) ? "advisoryLock" : "single";
-	ir === "cluster" && !K && $.warn("scheduling.coordination=cluster needs a sql-backed store except sqlite — falling back to single"), ir === "advisoryLock" && !rr.has(g) && $.warn("scheduling.coordination=advisoryLock needs a SQL store (the claim-row gate) — falling back to single");
-	let or, sr = v.workflows.length > 0 || v.workflowWorkers.length > 0 || v.eventTriggers.length > 0 || (Oe?.outgoing.length ?? 0) > 0 || K, cr;
-	if (sr) {
-		if (g === "mssql") {
-			let e = await gn(process.cwd());
-			e && $.warn(e);
-		}
-		let [{ WorkflowEngine: e }, { makeClusterCronLayer: t, workflowEngineLayer: n, resolveRunnerStorage: r, resolveFailoverTuning: i }] = await Promise.all([import("@effect/workflow"), import("@voltro/workflow/cluster")]), a = K ? Qn.filter((e) => (e.trigger ?? G) === "self").map((e) => t({
-			name: e.name,
-			cron: vr(e),
-			execute: async () => {
-				await or?.fireFromCluster(e.name);
-			}
-		})) : [];
-		cr = g === "memory" ? e.layerMemory : await (async () => {
-			let e = await N(g), t = r({ sqliteFamily: e.id === "sqlite" || e.id === "turso" });
-			return $.info(`workflow engine: cluster-${t}, dialect=${e.id}` + (t === "memory" ? " — single-process durable replay, no cross-pod shard handoff" + (e.id !== "sqlite" && e.id !== "turso" ? " (VOLTRO_WORKFLOW_RUNNER_STORAGE=memory: SqlRunnerStorage/cluster_runners + GET_LOCK skipped)" : "") : "")), n({
-				sqlClientLayer: e.makeSqlLayer(O()),
-				runnerStorage: t,
-				dialectId: e.id,
-				...process.env.VOLTRO_WORKFLOW_RUNNER_PORT ? { runnerListenPort: Number(process.env.VOLTRO_WORKFLOW_RUNNER_PORT) } : {},
-				...i(),
-				...a.length > 0 ? { extraShardingLayers: a } : {}
-			});
-		})();
-	}
-	let dr = ue(j, xn()), fr = _.filter((e) => /\.subscribe\.tsx?$/.test(e)), pr = fr.length > 0 ? await xe(fr, $) : [], mr = _.filter((e) => /\.reaction\.tsx?$/.test(e)), q = mr.length > 0 ? await pe(mr, $) : [], hr = _.filter((e) => dn.test(e)), J = hr.length > 0 ? await S(hr, $) : [], gr = _.filter((e) => /\.aggregate\.tsx?$/.test(e)), _r = gr.length > 0 ? await ne(gr, $) : [], wr = _e();
-	if (_r.length > 0 && g !== "memory") try {
-		let e = (await N(g)).makeSqlLayer(O());
-		wr = dt(e);
-	} catch (e) {
-		$.warn("aggregate: SQL storage init failed — falling back to in-process", { err: String(e) });
-	}
-	let Tr = g === "memory" ? ni : Dr(w, `aggregate@${process.pid}`, $), Er = _.filter((e) => fn.test(e)), Mr = Er.length > 0 ? await p(Er, $) : [], Pr = _.filter((e) => un.test(e)), Fr = Pr.length > 0 ? await Te(Pr, $) : [], Ir = _.filter((e) => ln.test(e)), Lr = Ir.length > 0 ? await Lt(Ir, $) : [], Rr = [], zr = [], Br = _.filter((e) => rn.test(e));
-	if (Br.length > 0) {
-		let e = $.child("agent"), t = _.filter((e) => tn.test(e));
-		t.length > 0 && await sn(t, e);
-		let n = await $t(Br, e);
-		for (let e of n.agents) for (let t of Ze(e)) (t.kind === "action" ? Rr : zr).push({
-			file: t.file,
-			descriptor: t.descriptor,
-			executor: t.executor
-		});
-		n.agents.length > 0 && e.info("synthesized agent routes", { agents: n.agents.map((e) => e.descriptor.name) });
-	}
-	u.mark("workflow");
-	let Y = () => {
-		let e = X.workflowWriteActions();
-		if (e === void 0) throw Error("workflow actions: this app registers no workflows");
-		return e;
-	}, Vr = tr({
-		dialect: g,
-		...O()
-	}), Ur = g === "memory" ? void 0 : (await N(g)).makeSqlLayer(O()), Wr = async () => jt({
-		sqlLayer: Ur,
-		declared: C,
-		log: $
-	}), Gr = {
-		kind: "api",
-		meta: {
-			name: h?.name ?? "voltro-api",
-			voltroVersion: kt,
-			port: ie,
-			mode: "start",
-			store: g,
-			cdc: ae ? "on" : "off",
-			...Vr === void 0 ? {} : { databaseId: Vr }
-		},
-		rpc: nt(v, d),
-		workflows: ze(v, d),
-		migrations: Wr,
-		events: () => X.eventsSnapshot(),
-		agentTools: () => X.agentTools(),
-		invariantChecks: () => ({
-			mode: "serve",
-			accessGate: fe,
-			config: h,
-			serverOnlyLeaks: v.serverOnlyLeaks,
-			migrations: Wr
-		}),
-		members: () => X.membersSnapshot(),
-		inspectFireSchedule: async ({ name: e, trigger: t }) => {
-			if (!or) throw Error("scheduler not started — this app registers no self-triggered schedules (all schedules are trigger:'external', or there are none).");
-			return { runId: await or.fireNow(e, t) ?? null };
-		},
-		inspectBackfillSchedule: m({
-			getHandle: () => or,
-			getSchedules: () => Qn
-		}),
-		...Oe === void 0 ? {} : { webhooks: () => ge({
-			store: w,
-			discoveredWebhooks: Oe
-		}) },
-		plugins: () => ({
-			plugins: Nn.snapshot(),
-			capturedAt: Date.now()
-		}),
-		env: () => Kt(h?.name ?? En(d), {
-			...h?.env !== void 0 && gi(h.env) ? { contract: h.env } : {},
-			plugins: h?.plugins ?? []
-		}),
-		dataCache: () => Ue({
-			stats: Ct,
-			backendKind: St
-		}),
-		subscriptions: () => Rt(() => R),
-		inspectTables: () => de(v.tables),
-		inspectRows: b({
-			store: w,
-			tables: v.tables,
-			mask: !0
-		}),
-		metrics: (e) => X.rpcMetrics().snapshot(e),
-		cluster: () => Bt({
-			store: w,
-			dialect: g,
-			useClusterCron: K,
-			scheduleCoordChoice: ir
-		}),
-		inspectSchedules: () => x({
-			schedules: Qn,
-			defaultTrigger: G,
-			coordination: ar
-		}),
-		inspectScheduleRuns: (e) => Ft(w, e),
-		...ee(w, {
-			controls: mt(v.workflows ?? []),
-			active: (v.workflows?.length ?? 0) > 0,
-			cancellation: () => X.flowControlHealth()
-		}),
-		webhookActions: Ce(() => X.webhooksService()),
-		inspectStartWorkflow: (e) => Y().inspectStartWorkflow(e),
-		inspectCancelWorkflowRun: (e) => Y().inspectCancelWorkflowRun(e),
-		inspectSuspendWorkflowRun: (e) => Y().inspectSuspendWorkflowRun(e),
-		inspectResumeWorkflowRun: (e) => Y().inspectResumeWorkflowRun(e),
-		inspectDiscardWorkflowRun: (e) => Y().inspectDiscardWorkflowRun(e),
-		inspectRetryWorkflowRun: (e) => Y().inspectRetryWorkflowRun(e),
-		inspectSignalWorkflowRun: (e) => Y().inspectSignalWorkflowRun(e),
-		inspectUpdateWorkflowRun: (e) => Y().inspectUpdateWorkflowRun(e),
-		inspectInferences: (e) => et({
-			store: w,
-			active: (v.workflows?.length ?? 0) > 0,
-			dispatcher: () => X.inferenceHealth()
-		}, e.limit === void 0 ? {} : { limit: e.limit }),
-		...xt({
-			store: w,
-			cancelRun: async (e) => await X.runCanceller()?.(e) ?? !1,
-			retryRun: async (e) => Y().inspectRetryWorkflowRun({ runId: e }),
-			redriveRun: async (e) => X.redriveWorkflowRun({ runId: e }),
-			log: $
-		}),
-		inspectRedriveWorkflowRun: (e) => X.redriveWorkflowRun(e),
-		inspectResumeWorkflowRunFromStep: (e) => X.resumeWorkflowRunFromStep(e)
-	}, Kr = (process.env.VOLTRO_TENANT_ISOLATION ?? h?.tenancy?.isolation) === "namespace", Jr = Kr && g !== "memory" ? await (async () => {
-		let e = await N(g);
-		return ft({
-			tables: C,
-			sqlLayer: e.makeSqlLayer(O()),
-			dialect: g,
-			options: { retryFilter: e.retryFilter },
-			log: {
-				info: (e, t) => $.info(e, t),
-				error: (e, t, n) => $.error(e, t ?? {}, n)
-			}
-		});
-	})() : void 0, Yr = await E({
-		input: h?.tenancy?.residency,
-		namespaceIsolationOn: Kr,
-		makeStoreForUrl: (e, t) => ot(h, void 0, qt(O(), t)),
-		log: {
-			info: (e, t) => $.info(e, t),
-			warn: (e, t) => $.warn(e, t)
-		}
-	});
-	Yr !== void 0 && qr(async () => {
-		await Yr.close();
-	});
-	let X = await fa({
-		bootTiming: u,
-		broadcastNamespace: I,
-		scheduling: (() => {
-			let e = vn;
-			return {
-				admissionDrainMs: e.admissionDrainMs,
-				inferenceTickMs: e.inferenceTickMs,
-				cancelSweepMs: e.cancelSweepMs,
-				stalenessSweepMs: e.stalenessSweepMs,
-				disarmWhenIdle: rt({
-					changeScope: w.changeScope,
-					broadcastAttached: In !== void 0
-				})
-			};
-		})(),
-		...h?.workflows?.staleness === void 0 ? {} : { workflowStaleness: h.workflows.staleness },
-		...h?.workflows?.suspendSignalHintMs === void 0 ? {} : { workflowSuspendSignalHintMs: h.workflows.suspendSignalHintMs },
-		workflowRecording: Pt(h?.workflows?.recording),
-		membership: {
-			...jn,
-			instanceId: F
-		},
-		security: {
-			defaultDeny: je(h),
-			...ye(h)
-		},
-		approvals: { defaultExpiryMs: Ie(h) },
-		...h?.plugins === void 0 ? {} : { plugins: h.plugins },
-		...Hn ? { idempotency: Hn } : {},
-		restRoutes: Vn,
-		appProcedures: fe,
-		discovered: {
-			queries: [...v.queries, ...zr],
-			mutations: v.mutations,
-			actions: [...v.actions, ...Rr],
-			streams: v.streams,
-			events: v.events,
-			workflows: v.workflows,
-			workflowWorkers: v.workflowWorkers,
-			eventTriggers: v.eventTriggers,
-			schedules: Qn,
-			subscribers: pr,
-			outboxHandlers: J,
-			connections: v.connections,
-			reactions: q,
-			aggregates: _r,
-			expectations: Mr,
-			budgets: Fr,
-			experiments: Lr,
-			...Oe === void 0 ? {} : { webhooks: Oe }
-		},
-		log: $,
-		analytics: Le.sink,
-		aggregateStorage: wr,
-		aggregateCoordinator: Tr,
-		store: w,
-		kv: Dt,
-		cache: ut,
-		snapshotCache: lt,
-		...h?.reactive === void 0 ? {} : { reactive: h.reactive },
-		schemaRegistry: Ge,
-		tenantScopedTables: v.tenantScopedTables,
-		softDeleteScopedTables: v.softDeleteScopedTables,
-		dataTransferSnapshot: Jn(C, g),
-		dataTransferDialect: g,
-		...Jr === void 0 ? {} : { ensureTenantProvisioned: Jr.ensure },
-		...Yr === void 0 ? {} : { resolveResidentStore: Yr.resolveStore },
-		tenantIsolation: (process.env.VOLTRO_TENANT_ISOLATION ?? h?.tenancy?.isolation) === "namespace" ? "namespace" : "shared-schema",
-		resolveSubject: (e, t) => Bn({
-			headers: e,
-			clientId: t
-		}),
-		...h?.auth === void 0 ? {} : { authority: h.auth },
-		...h?.agents === void 0 ? {} : { agents: h.agents },
-		httpRoutes: j.flatMap((e) => e.httpRoutes ?? []),
-		getStore: () => qe,
-		...Wn ? { baseLayer: Wn } : {},
-		...cr === void 0 ? {} : { workflowEngineLayer: cr },
-		scheduleDefaultTrigger: G,
-		scheduleCoordination: ar,
-		scheduleArmSelf: !K,
-		dormancy: process.env.VOLTRO_DORMANCY === "sleep" || process.env.VOLTRO_DORMANCY === "always-on" ? process.env.VOLTRO_DORMANCY : h?.dormancy ?? "always-on",
-		scheduleReplicaId: process.env.HOSTNAME ?? `pid-${process.pid}`,
-		...dr === void 0 ? {} : { scheduleFireInterceptor: dr },
-		onSchedulerReady: (e) => {
-			or = e;
-		},
-		inspectRoute: { handle: async (e, t, n, r) => await te(e, Gr, t, {
-			method: n,
-			...r === void 0 ? {} : { body: r }
-		}) || ((n === "GET" ? await hn(e, Gr, t, { method: n }) : null) ?? mn(e, Gr, t, {
-			method: n,
-			...r === void 0 ? {} : { body: r }
-		}) ?? {
-			status: 404,
-			contentType: "application/json",
-			body: JSON.stringify({ error: "not an inspect route" })
-		}) },
-		...h?.name === void 0 ? {} : { appName: h.name },
-		observability: Pn,
-		port: ie,
-		...h?.transport?.wsPath ? { path: h.transport.wsPath } : {}
-	});
-	return R = X.dispatcher, Ee(It([
-		v.queries,
-		v.mutations,
-		v.actions,
-		v.streams
-	]), (e) => {
-		$.warn(e);
-	}), $.info(`API listening on :${ie}`, {
-		dialect: g,
-		queries: v.queries.length,
-		mutations: v.mutations.length,
-		actions: v.actions.length,
-		streams: v.streams.length,
-		workflows: v.workflows.length,
-		workflowWorkers: v.workflowWorkers.length,
-		schedules: Qn.length,
-		scheduleCoordination: ar
-	}), u.finish($), qr(async () => {
-		for (let e of Tn) e.stop();
-		Mt.stop();
-		try {
-			await X.close(), Tt(), Ht?.dispose(), await Nn.deactivate(), await In?.close(), await Xe({
-				mirror: At,
-				log: $
-			}), await Le.dispose(), await w.close?.();
-		} catch (e) {
-			console.error("serve: shutdown step failed, exiting anyway:", e);
-		}
-	}), await new Promise(() => {}), 0;
-};
-//#endregion
-export { ha as n, pa as r, ga as t };