@voltro/cli 0.47.0 → 0.49.0

package/dist/serveCommand-BU0wfV6V.js

@@ -1,1931 +0,0 @@
-import { t as e } from "./nodeEnvironment-cGFAj1J8.js";
-import { t } from "./frameworkInspectState-CX2250XB.js";
-import { r as n, t as r } from "./appModuleLoader-C9r9mxZt.js";
-import { t as i } from "./bootRefusal-pgvDxlrU.js";
-import { n as a, r as o } from "./startupRunner-CEqQq7ax.js";
-import { t as ee } from "./interruptedReplace-C1ZI84xi.js";
-import { $ as s, $t as c, A as l, At as u, Bt as d, C as f, Cn as p, Ct as m, D as h, Dt as g, E as _, En as te, Et as v, F as ne, Ft as re, G as ie, Gt as ae, H as y, Ht as oe, I as se, It as ce, J as le, Jt as b, K as x, Kt as ue, L as S, Lt as de, M as fe, Mt as pe, N as me, Nt as he, O as ge, Ot as _e, P as ve, Pt as ye, Q as be, Qt as xe, R as C, Rt as Se, S as Ce, St as we, T as Te, Tn as Ee, Tt as w, U as De, V as Oe, W as ke, Wt as Ae, X as je, Xt as Me, Y as Ne, Yt as T, Z as Pe, Zt as Fe, _ as E, _n as Ie, _t as D, an as Le, at as Re, b as ze, bn as Be, bt as Ve, c as He, cn as Ue, ct as We, dn as Ge, dt as Ke, en as qe, et as Je, f as Ye, fn as Xe, ft as Ze, g as Qe, gt as $e, h as et, hn as tt, ht as nt, i as rt, in as it, it as at, j as ot, jt as st, k as ct, kt as lt, ln as ut, lt as dt, m as ft, mn as pt, mt, nn as ht, nt as gt, o as O, on as _t, ot as k, p as A, pn as vt, pt as yt, q as bt, qt as xt, r as St, rn as Ct, rt as wt, sn as j, st as Tt, t as Et, tn as Dt, tt as Ot, u as kt, un as At, ut as jt, v as Mt, vn as Nt, vt as M, w as N, wn as Pt, wt as Ft, x as It, xn as Lt, xt as Rt, y as zt, yn as Bt, yt as Vt, zt as Ht } from "./dev-RjB7eE_B.js";
-import { n as Ut } from "./cliArgs-D4p8n7EE.js";
-import { r as P } from "./appPort-B_HpJ_ck.js";
-import { ht as Wt, pt as Gt } from "./webDev-B4IEMB0n.js";
-import { r as F } from "./dialectDriver-czCHYpeH.js";
-import { i as Kt, n as qt } from "./connectionConfig-Bk9IC7D0.js";
-import { c as Jt, n as I, o as Yt } from "./seedRunner-Dgsiwk_e.js";
-import { C as Xt, S as Zt, _ as Qt, d as $t, g as en, l as tn, m as nn, r as rn, u as an, v as on } from "./frameworkTableAssembly-BvZ0Lil_.js";
-import { S as sn, c as cn, n as ln, p as un, s as dn, x as fn } from "./fileConventions-Cof68_BL.js";
-import { h as pn, o as mn } from "./inspect-B7U7Cl_Z.js";
-import { n as hn } from "./mssqlClusterPatch-_4cE_nun.js";
-import { i as gn, n as _n, r as vn, t as yn } from "./webhookDiscovery-CphsQe59.js";
-import { t as bn } from "./inspectMetrics-CfdKLh6t.js";
-import { r as xn, u as Sn } from "./apiBuild-FpHCWiv6.js";
-import { t as Cn } from "./bootTiming-BdyP9nYw.js";
-import { t as wn } from "./dataProfile-Cm0YVKSy.js";
-import Tn, { basename as En, join as Dn } from "node:path";
-import { createWriteStream as On, existsSync as kn } from "node:fs";
-import { pathToFileURL as An } from "node:url";
-import { createLogger as L } from "@voltro/logger";
-import { AuthMiddleware as jn, ConnectionInfoMiddleware as Mn, actionToRpc as R, anonymousSubject as Nn, isWireReachable as Pn, mutationToRpc as Fn, queryToRpc as z, streamToRpc as In, wireErrorUnion as Ln, workflowCancelDescriptor as Rn, workflowDomainEventsQueryDescriptor as B, workflowEventDeliveriesQueryDescriptor as V, workflowResumeDescriptor as zn, workflowRunEventsQueryDescriptor as Bn, workflowRunQueryDescriptor as Vn, workflowRunStepsQueryDescriptor as Hn, workflowRunsQueryDescriptor as Un, workflowSignalDescriptor as Wn, workflowUpdateDescriptor as Gn } from "@voltro/protocol";
-import { allRegisteredTables as Kn, and as H, connectionIdentity as qn, ensureTableRegistered as Jn, eq as U, or as Yn } from "@voltro/database";
-import { Cause as Xn, Effect as W, Layer as G, ManagedRuntime as Zn } from "effect";
-import { SqlClient as Qn } from "@effect/sql";
-import { declaredSnapshot as $n, describeOutcome as er, pendingFileMigrationIds as tr, runPlannedMigrations as nr } from "@voltro/database/sql";
-import { AggregateRegistry as rr, CostRegistry as ir, DORMANCY_WAKEUP_TENANT as ar, Dispatcher as or, ExpectationRegistry as sr, ExperimentRegistry as cr, apiKeyManagementRoutes as lr, attachAnalyticsMirror as ur, attachExpectations as dr, attachExperiments as fr, attachFinops as pr, awaitServerListening as mr, bindMutation as K, bindStream as hr, bindSubscription as q, buildTracingLayer as gr, cancelWakeup as _r, compileCron as vr, dataStoreApiKeyStore as yr, formatServerOnlyLeaks as br, formatUnresolvedSources as xr, frameworkApiKeyStrategy as Sr, getResourcePolicy as Cr, installPolicyGuardResolver as wr, loadResourceTuples as Tr, makeActionRunner as Er, makeAdvisoryLockCoordinator as Dr, makeApiKeyService as Or, makeApiKeyUsageBuffer as kr, makeApiKeyUsageFlusher as Ar, makeAsyncKv as jr, makeAuthMiddlewareLayers as Mr, makeCoordinatedScheduler as Nr, makeEffectStoreLayer as Pr, makeLazyWorkflowFacade as Fr, makeMutationOutputCodec as Ir, makeMutationRunner as Lr, makeOneShotQueryRunner as Rr, makeQueryDescriptorProducer as zr, makeQueryFinalizer as Br, makeQueryReauthorizer as Vr, makeQuerySubscriber as Hr, makeSchemaRegistry as Ur, makeWorkflowFacade as J, makeWorkflowFacadeWithCallerContext as Wr, makeWorkflowLayers as Gr, noopKv as Kr, onProcessShutdown as qr, recordSubscriptionDelivery as Jr, recordWorkflowRun as Yr, registerDefaultTupleSource as Xr, registerWakeup as Zr, resolveSecretsBackend as Qr, runProvidedEffect as Y, setSecretsBackend as $r, setSystemStoreHandle as ei, shutdownGraceMsFromEnv as ti, singleCoordinator as ni, startRpcServer as ri, startScheduler as ii, stripForbiddenForWire as ai, undoCaptureEnabled as oi, unresolvedSources as si, withScopedRequest as ci, workflowToRpc as li, wrapStoreWithBootCodec as ui } from "@voltro/runtime";
-import di, { tmpdir as fi } from "node:os";
-import { RpcGroup as pi } from "@effect/rpc";
-import { appStorageProvider as mi, durabilityNotice as hi, fromNodeReadable as gi, getObjectStream as _i, putObjectStream as vi, toNodeReadable as yi } from "@voltro/plugin-storage";
-import { isEnvContract as bi } from "@voltro/env";
-import { assertProductionSessionSecret as xi } from "@voltro/protocol/session";
-import X from "node:fs/promises";
-import { createHash as Si, timingSafeEqual as Ci } from "node:crypto";
-import { buildDeliverWebhookExecute as wi, buildWebhooksService as Ti, defaultIncomingPath as Ei, deliverWebhookWorkflow as Di, makeDeferredEmitHandler as Oi, mountIncomingWebhook as ki } from "@voltro/plugin-webhooks";
-import { getAuthSessionStrategy as Ai } from "@voltro/plugin-auth";
-import { registerEmailTemplates as ji } from "@voltro/plugin-mail";
-import { channelFor as Mi, getBroadcastPlugin as Ni } from "@voltro/plugin-broadcast";
-import { packBundle as Pi, runExport as Fi, runImport as Ii, storageBlobSink as Li, storageRefsBlobSource as Ri, unpackBundle as zi, unpackBundleToDir as Bi } from "@voltro/data-transfer";
-//#region src/serveDrain.ts
-var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t) => setTimeout(t, e)), Ui = (e) => {
-	let t = /* @__PURE__ */ new Set(), n = /* @__PURE__ */ new Set(), r = 0;
-	e.on("connection", (e) => {
-		t.add(e), e.once("close", () => {
-			t.delete(e), n.delete(e);
-		});
-	}), e.on("upgrade", (e, t) => {
-		n.add(t);
-	}), e.on("request", (e, t) => {
-		r += 1, t.once("close", () => {
-			--r;
-		});
-	});
-	let i, a = async (t = {}) => {
-		let n = t.budgetMs ?? Vi();
-		i ??= new Promise((t) => {
-			e.close(() => {
-				t();
-			});
-		}), e.closeIdleConnections();
-		let a = Date.now() + n;
-		for (; r > 0 && Date.now() < a;) await Hi(25), e.closeIdleConnections();
-		e.closeIdleConnections();
-	}, o = async () => {
-		i ??= new Promise((t) => {
-			e.close(() => {
-				t();
-			});
-		});
-		for (let e of t) if (n.has(e)) try {
-			e.write(Buffer.from([
-				136,
-				2,
-				3,
-				233
-			]));
-		} catch {}
-		else e.destroy();
-		for (let e = 0; t.size > 0 && e < 250; e += 25) await Hi(25);
-		for (let e of t) e.destroy();
-		await i;
-	};
-	return {
-		activeRequests: () => r,
-		drainRequests: a,
-		finish: o,
-		drain: async (e = {}) => {
-			await a(e), await o();
-		}
-	};
-}, Wi = "/_voltro/admin/import", Gi = "/_voltro/admin/export", Z = (e, t) => ({
-	status: e,
-	contentType: "application/json; charset=utf-8",
-	body: JSON.stringify(t)
-}), Ki = (e) => {
-	let t = e.authorization ?? e.Authorization, n = t ? /^Bearer\s+(.+)$/i.exec(t) : null;
-	return n ? n[1] : null;
-}, qi = (e, t) => Ci(Si("sha256").update(e).digest(), Si("sha256").update(t).digest()), Ji = (e, t) => {
-	if (e.method.toUpperCase() !== "POST") return Z(405, { error: "method not allowed" });
-	if (!t || t.length < 16) return Z(503, { error: "data transfer misconfigured (no/weak secret)" });
-	let n = Ki(e.headers);
-	return !n || !qi(n, t) ? Z(401, { error: "unauthorized" }) : null;
-}, Yi = /^[A-Za-z0-9_-]{8,64}$/, Xi = (e) => Yi.test(e), Zi = () => Tn.join(di.tmpdir(), "voltro-import-uploads"), Qi = (e) => Tn.join(Zi(), e), $i = (e) => Tn.join(Qi(e), "archive.bin"), ea = (e) => Tn.join(Qi(e), "meta.json"), ta = async (e = Date.now()) => {
-	let t = 0;
-	try {
-		for (let n of await X.readdir(Zi())) {
-			let r = await X.stat(Qi(n)).catch(() => null);
-			r !== null && (e - r.mtimeMs <= 864e5 || (await X.rm(Qi(n), {
-				recursive: !0,
-				force: !0
-			}).catch(() => void 0), t++));
-		}
-	} catch {}
-	return t;
-}, na = async (e) => {
-	if (!Xi(e)) return {
-		bytes: 0,
-		key: null
-	};
-	let t = await X.stat($i(e)).catch(() => null);
-	if (t === null) return {
-		bytes: 0,
-		key: null
-	};
-	let n = await X.readFile(ea(e), "utf8").then((e) => JSON.parse(e), () => ({}));
-	return {
-		bytes: t.size,
-		key: n.key ?? null
-	};
-}, ra = async (e) => {
-	if (!Xi(e.id)) return {
-		reason: "bad-id",
-		message: `upload id must match ${String(Yi)}`
-	};
-	let t = await na(e.id);
-	return t.key !== null && t.key !== e.key ? {
-		reason: "key-mismatch",
-		message: "this upload id already holds a different bundle. Use a new upload id, or delete the partial upload."
-	} : e.offset === t.bytes ? (await X.mkdir(Qi(e.id), { recursive: !0 }), t.key === null && await X.writeFile(ea(e.id), JSON.stringify({
-		key: e.key,
-		startedAt: (/* @__PURE__ */ new Date()).toISOString()
-	})), await new Promise((t, n) => {
-		let r = On($i(e.id), { flags: "a" });
-		r.on("error", n), r.on("finish", () => t()), r.end(Buffer.from(e.bytes));
-	}), { total: t.bytes + e.bytes.byteLength }) : {
-		reason: "offset-mismatch",
-		message: `chunk starts at ${e.offset} but the server holds ${t.bytes} byte(s)`,
-		expectedOffset: t.bytes
-	};
-}, ia = async (e) => {
-	let t = await X.stat($i(e));
-	return {
-		path: $i(e),
-		bytes: t.size
-	};
-}, aa = async (e) => {
-	Xi(e) && await X.rm(Qi(e), {
-		recursive: !0,
-		force: !0
-	}).catch(() => void 0);
-}, Q = L({ scope: "voltro:admin-import" }), oa = "VBUNDLE2", sa = (e) => {
-	let t = e.req.headers["x-import-rollback-key"];
-	if (e.mode !== "replace") return { options: {} };
-	if (typeof t != "string" || t.length === 0) return Q.warn("admin.import: no rollback capture — this run empties the target first, and nothing was asked to be kept. Send `x-import-rollback-key: <storage key>` (voltro data import --rollback-key <key>) to have the instance store the target's current rows before deleting them."), { options: {} };
-	if (e.deps.putArchive === void 0) return {
-		options: {},
-		refusal: Z(409, {
-			error: "rollback capture requested but this instance has no object storage configured",
-			hint: "A capture written to the pod would not survive the failure it exists for. Configure storage (the same one the storage-push export uses), or re-send without `x-import-rollback-key` to accept that a run which does not finish can leave the target emptied. Note that CONFIGURED is not the same question as SURVIVES: a `filesystem` provider pointed at a container directory with no volume behind it passes this check and dies with the pod. The run says so when it can observe it — the capture path being on the same filesystem as `/`."
-		})
-	};
-	let n = Dn(fi(), `voltro-rollback-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`), r = e.deps.putArchive;
-	return {
-		key: t,
-		options: {
-			rollbackDir: n,
-			onRollbackCaptured: async () => {
-				let e = hi(n);
-				e !== void 0 && Q.warn(`admin.import: ${e}`), await r(t, () => Pi({ dir: n })), Q.info("admin.import: rollback capture stored", { bundleKey: t });
-			}
-		}
-	};
-}, ca = async function* (e) {
-	yield e;
-}, la = (e) => async (t) => {
-	let n = Ji(t, e.secret);
-	if (n) return n;
-	let r = t.headers["x-import-mode"], i = t.headers["x-import-on-conflict"], a = t.headers["x-import-atomic"], o = a === "0" || a === "false" ? !1 : a === "1" || a === "true" || r === "replace", ee = t.headers["x-import-force"] === "1" || t.headers["x-import-force"] === "true", s = sa({
-		req: t,
-		mode: r,
-		deps: e
-	});
-	if (s.refusal !== void 0) return s.refusal;
-	let c = t.headers["x-import-dry-run"] === "1" || t.headers["x-import-dry-run"] === "true", l = (t.headers["x-import-tables"] ?? "").split(",").map((e) => e.trim()).filter(Boolean), u = t.headers["x-import-upload-id"], d;
-	if (u !== void 0 && u !== "") {
-		if (ta(), t.headers["x-import-probe"] === "1") return Z(200, {
-			uploadId: u,
-			bytes: (await na(u)).bytes
-		});
-		let e = t.headers["x-import-upload-key"] ?? "", n = Number(t.headers["x-import-chunk-offset"] ?? "0");
-		if (e === "" || !Number.isFinite(n) || n < 0) return Z(400, { error: "a chunked upload needs x-import-upload-key and a numeric x-import-chunk-offset" });
-		let r = await ra({
-			id: u,
-			key: e,
-			offset: n,
-			bytes: t.rawBody
-		});
-		if ("reason" in r) return Q.warn("admin.import chunk refused", {
-			uploadId: u,
-			reason: r.reason
-		}), Z(409, {
-			error: "chunk refused",
-			reason: r.reason,
-			message: r.message,
-			...r.expectedOffset === void 0 ? {} : { expectedOffset: r.expectedOffset }
-		});
-		if (t.headers["x-import-chunk-final"] !== "1") return Z(202, {
-			uploadId: u,
-			bytes: r.total
-		});
-		d = (await ia(u)).path;
-	}
-	let f = t.rawBody.byteLength >= 8 && Buffer.from(t.rawBody.subarray(0, 8)).toString("latin1") === oa, p, m;
-	if (d !== void 0) {
-		let { createReadStream: e } = await import("node:fs");
-		p = e(d), m = "chunked";
-	} else if (f) p = ca(t.rawBody), m = "upload";
-	else {
-		let n;
-		try {
-			n = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
-		} catch {
-			return Z(400, { error: "body must be a packed bundle archive or { bundleKey } JSON" });
-		}
-		if (typeof n.bundleKey != "string" || !n.bundleKey) return Z(400, { error: "body.bundleKey (string) is required for the storage transport" });
-		if (!e.openArchive) return Z(501, { error: "storage transport not configured on this instance" });
-		p = e.openArchive(n.bundleKey), m = "storage";
-	}
-	let h = await import("node:os"), g = await import("node:fs/promises"), _ = await import("node:path"), te = await g.mkdtemp(_.join(h.tmpdir(), "voltro-admin-import-"));
-	try {
-		e.assetSink ? await zi(p, {
-			dir: te,
-			blobs: e.assetSink
-		}) : await Bi(p, te);
-		let t = await W.runPromiseExit(Ii({
-			store: e.store,
-			bundleDir: te,
-			...r ? { mode: r } : {},
-			...i ? { onConflict: i } : {},
-			atomic: o,
-			...s.options,
-			recordInterruption: !0,
-			via: "api",
-			...c ? { dryRun: c } : {},
-			...l.length > 0 ? { tables: l } : {},
-			...e.snapshot ? { targetSnapshot: e.snapshot } : {},
-			...e.dialect ? { targetDialect: e.dialect } : {},
-			force: ee,
-			onWarn: (e) => Q.warn("admin.import", { message: e }),
-			...e.assetSink ? { assetsAlreadyRestored: !0 } : {}
-		}));
-		if (t._tag === "Failure") {
-			let e = t.cause._tag === "Fail" ? t.cause.error : void 0;
-			if (e && e._tag === "SchemaDriftError") {
-				let t = e;
-				return Q.warn("admin.import refused (schema drift)", {
-					transport: m,
-					bundle: t.bundleFingerprint.slice(0, 16),
-					target: t.targetFingerprint.slice(0, 16)
-				}), Z(409, {
-					error: "schema drift",
-					bundleFingerprint: t.bundleFingerprint,
-					targetFingerprint: t.targetFingerprint,
-					diff: t.diff,
-					hint: "each line above would break the load: a table or column the bundle carries that the target cannot take, or a column the target requires that the bundle has no value for. Fix the target schema, re-export against it, or resend with x-import-force: 1 to write anyway."
-				});
-			}
-			let n = typeof e?.reason == "string" ? e.reason : void 0;
-			if (n !== void 0 && e._tag === "ImportModeError") return Q.warn("admin.import refused (mode)", {
-				transport: m,
-				mode: e.mode
-			}), Z(409, {
-				error: "import mode refused",
-				mode: e.mode,
-				message: n
-			});
-			throw Error(n ?? String(e?.message ?? e ?? "import failed"));
-		}
-		let n = t.value, a = n.manifest.tables.reduce((e, t) => e + t.rowCount, 0), u = n.rowsWritten;
-		return Q.info(c ? "admin.import (dry run — nothing written)" : "admin.import", {
-			transport: m,
-			tables: n.tablesWritten,
-			rows: u,
-			carried: a,
-			mode: r ?? "upsert",
-			atomic: o,
-			...n.tablesSkipped > 0 ? {
-				skippedTables: n.tablesSkipped,
-				skippedRows: n.rowsSkipped
-			} : {}
-		}), c || e.refreshSubscriptions?.(`data import: ${n.tablesWritten} table(s), mode ${r ?? "upsert"}`), Z(200, {
-			tables: n.tablesWritten,
-			rows: u,
-			carried: a,
-			transport: m,
-			...n.tablesSkipped > 0 ? {
-				skippedTables: n.tablesSkipped,
-				skippedRows: n.rowsSkipped,
-				fullyResumed: n.fullyResumed
-			} : {},
-			...c ? {
-				dryRun: !0,
-				wrote: !1
-			} : {}
-		});
-	} catch (e) {
-		return Q.warn("admin.import failed", {
-			transport: m,
-			error: e?.message ?? String(e)
-		}), Z(500, {
-			error: "import failed",
-			message: e?.message ?? String(e)
-		});
-	} finally {
-		await g.rm(te, {
-			recursive: !0,
-			force: !0
-		}), u !== void 0 && u !== "" && d !== void 0 && await aa(u);
-	}
-}, ua = L({ scope: "voltro:admin-export" }), da = async (e) => {
-	let t = [];
-	for await (let n of e) t.push(Buffer.from(n));
-	return new Uint8Array(Buffer.concat(t));
-}, fa = (e) => typeof e.tenant == "string" && e.tenant ? {
-	kind: "tenant",
-	tenantId: e.tenant
-} : Array.isArray(e.tables) && e.tables.length ? {
-	kind: "tables",
-	tables: e.tables.filter((e) => typeof e == "string")
-} : { kind: "all" }, pa = (e) => async (t) => {
-	let n = Ji(t, e.secret);
-	if (n) return n;
-	let r;
-	try {
-		r = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
-	} catch {
-		return Z(400, { error: "body must be JSON: { profile?, tenant?, tables?, consistency?, compression?, bundleKey? }" });
-	}
-	let i = {};
-	if (typeof r.profile == "string" && r.profile) {
-		if (!e.loadProfile) return Z(501, { error: "server-side profiles not configured on this instance" });
-		try {
-			i = await e.loadProfile(r.profile);
-		} catch (e) {
-			return Z(400, {
-				error: `profile '${r.profile}' could not be loaded`,
-				message: e?.message ?? String(e)
-			});
-		}
-	}
-	let a = r.consistency === "snapshot" ? "snapshot" : i.consistency ?? "live", o = (typeof r.compression == "string" ? r.compression : void 0) ?? i.compression, ee = i.scope ?? fa(r), s = typeof r.bundleKey == "string" && r.bundleKey.length > 0, c = r.assets === !0 && e.assetSource ? { blobs: e.assetSource } : {}, l = await import("node:os"), u = await import("node:fs/promises"), d = await import("node:path"), f = await u.mkdtemp(d.join(l.tmpdir(), "voltro-admin-export-"));
-	try {
-		let t = await W.runPromise(Fi({
-			store: e.store,
-			snapshot: e.snapshot,
-			dialect: e.dialect,
-			outDir: f,
-			...i.subset ? { subset: i.subset } : {
-				scope: ee,
-				...e.tenantTables && e.tenantTables.length > 0 ? { tenantTables: e.tenantTables } : {}
-			},
-			consistency: a,
-			...o ? { compression: o } : {},
-			...i.masking ? { masking: i.masking } : {}
-		})), n = t.tables.reduce((e, t) => e + t.rowCount, 0), l = t.masking?.transformed.length ?? 0;
-		if (s) {
-			if (!e.putArchive) return Z(501, { error: "storage transport not configured on this instance" });
-			let i = r.bundleKey;
-			return await e.putArchive(i, () => Pi({
-				dir: f,
-				...c
-			})), ua.info("admin.export", {
-				transport: "storage",
-				tables: t.tables.length,
-				rows: n,
-				masked: l,
-				bundleKey: i
-			}), Z(200, {
-				bundleKey: i,
-				tables: t.tables.length,
-				rows: n,
-				masked: l,
-				transport: "storage"
-			});
-		}
-		let u = await da(Pi({
-			dir: f,
-			...c
-		}));
-		return ua.info("admin.export", {
-			transport: "download",
-			tables: t.tables.length,
-			rows: n,
-			masked: l,
-			bytes: u.byteLength
-		}), {
-			status: 200,
-			contentType: "application/octet-stream",
-			body: u,
-			headers: {
-				"x-export-tables": String(t.tables.length),
-				"x-export-rows": String(n),
-				"x-export-masked": String(l)
-			}
-		};
-	} catch (e) {
-		return ua.warn("admin.export failed", { error: e?.message ?? String(e) }), Z(500, {
-			error: "export failed",
-			message: e?.message ?? String(e)
-		});
-	} finally {
-		await u.rm(f, {
-			recursive: !0,
-			force: !0
-		});
-	}
-}, ma = (e, t, n = {}) => (async function* () {
-	let r = await W.runPromise(_i(e, t).pipe(W.timeout(n.openTimeout ?? "30 seconds"))), i = await yi(r.stream), a = n.stallMs ?? 12e4, o, ee = () => {
-		o && clearTimeout(o), o = setTimeout(() => i.destroy(/* @__PURE__ */ Error(`storage read stalled for ${a}ms reading '${t}'`)), a);
-	};
-	try {
-		ee();
-		for await (let e of i) ee(), yield e instanceof Uint8Array ? e : new Uint8Array(e);
-	} finally {
-		o && clearTimeout(o), i.destroy();
-	}
-})(), ha = {
-	get: async () => void 0,
-	set: async () => {},
-	setWithTags: async () => {},
-	remove: async () => !1,
-	has: async () => !1,
-	clear: async () => {},
-	invalidateTag: async () => 0,
-	wrap: async (e, t, n) => n()
-}, ga = async (e) => {
-	d(e.appProcedures ?? e.discovered, {
-		defaultDeny: e.security?.defaultDeny ?? !0,
-		commandHint: "`voltro serve`"
-	}), ei({
-		dataStore: e.store,
-		schemaRegistry: e.schemaRegistry
-	});
-	let t = (e.discovered.budgets?.length ?? 0) > 0, n, r = new or({
-		store: e.store,
-		...e.snapshotCache ? { cache: e.snapshotCache } : {},
-		...e.reactive === void 0 ? {} : { reactive: e.reactive },
-		...t ? { recordCost: (e) => n?.record(e) } : {},
-		recordDelivery: (e) => Jr({
-			label: e.label,
-			kind: e.kind,
-			durationMs: e.durationMs,
-			rowCount: e.rowCount
-		})
-	}), i = e.cache ?? ha, a = e.kv ?? Kr, o, ee = () => void 0, c, l, u, f, p, m, h, _ = ue({
-		store: e.store,
-		warn: (e, t) => {
-			process.stderr.write(`[workflow] ${e} ${JSON.stringify(t)}\n`);
-		}
-	}), te = _.remember, ae = _.resolve, oe = xt({
-		authority: e.authority,
-		getStore: () => e.store
-	}), S = (e.discovered.workflows?.length ?? 0) > 0 ? Fr(() => o) : void 0, de = (e.discovered.workflows?.length ?? 0) > 0 || (e.discovered.eventTriggers?.length ?? 0) > 0, he = de || (e.discovered.workflowWorkers?.length ?? 0) > 0 || e.scheduleCoordination === "cluster", ge = e.tenantIsolation === "namespace", _e = (e.log ?? L({ scope: "voltro:serve" })).child("webhooks"), ve, ye, C = e.discovered.webhooks;
-	if (C && C.outgoing.length > 0 && e.workflowEngineLayer !== void 0) {
-		e.workflowEngineLayer;
-		let t = ut({
-			store: e.store,
-			schemaRegistry: e.schemaRegistry,
-			cache: i,
-			kv: a
-		}), n = C.outgoing.map((e) => e.descriptor);
-		ye = Di.toLayer(wi(t, { events: n })), ve = Ti(t, async (e) => {
-			let t = u;
-			if (t === void 0) {
-				_e.error("webhook delivery skipped — the workflow runtime was never built. This is a framework defect, not a configuration problem: report it with your engine setting. Deliveries are NOT queued and will not be retried.", {
-					deliveryId: e.deliveryId,
-					targetId: e.targetId
-				});
-				return;
-			}
-			t.runPromise(Di.execute(e)).catch((t) => {
-				_e.error("deliverWebhook workflow crashed", {
-					deliveryId: e.deliveryId,
-					targetId: e.targetId
-				}, t);
-			});
-		}, { events: n });
-	}
-	let Se = /* @__PURE__ */ new Map();
-	if (C) for (let e of C.incoming) {
-		let t = e.descriptor.path ?? Ei(e.descriptor.id), n = `VOLTRO_WEBHOOK_SECRET_${e.descriptor.id.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`, r = ki(e.descriptor, {
-			resolveSecret: async () => process.env[n] ?? null,
-			resolveWorkflows: () => S === void 0 ? void 0 : Wr(S, {
-				traceId: `incoming:${e.descriptor.id}`,
-				source: `incoming:${e.descriptor.id}`
-			}),
-			log: (e) => {
-				let t = {
-					webhookId: e.webhookId,
-					status: e.status,
-					signatureOk: String(e.signatureOk),
-					idempotency: e.idempotency,
-					durationMs: e.durationMs
-				};
-				e.status >= 500 ? _e.error("incoming delivery failed", t) : e.status >= 400 ? _e.warn("incoming delivery rejected", t) : _e.info("incoming delivery handled", t);
-			}
-		});
-		Se.set(t, { handle: r });
-	}
-	wr(), Xr((t) => Tr(e.store, t.subjectId, t.resourceType, t.resourceId)) || L({ scope: "voltro:serve" }).info("policy guards: using the app-registered tuple source");
-	let Ce = [], Te = [...e.discovered.outboxHandlers ?? [], ..._n((C?.outgoing.length ?? 0) + (C?.incoming.length ?? 0) + (C?.providers.length ?? 0), []) ? [{
-		file: "<framework>/webhooks",
-		id: "voltro-webhook-emit",
-		definition: Oi(() => ve)
-	}] : []], Ee = Te.length > 0 ? Fe({
-		handlers: Te,
-		store: e.store,
-		log: (e.log ?? L({ scope: "voltro:serve" })).child("outbox"),
-		onChange: (t) => e.store.onChange((e) => t({
-			table: e.table,
-			op: e.op
-		})),
-		onShutdown: (e) => {
-			Ce.push(e);
-		}
-	}) : void 0, w = T({
-		definitions: (e.discovered.connections ?? []).map((e) => e.definition),
-		store: e.store,
-		publicUrl: b(e.port ?? 4e3),
-		log: (e.log ?? L({ scope: "voltro:serve" })).child("connections")
-	});
-	ot({
-		events: e.discovered.events ?? [],
-		rpcTags: [
-			...e.discovered.queries.map((e) => e.descriptor.name),
-			...e.discovered.mutations.map((e) => e.descriptor.name),
-			...e.discovered.actions.map((e) => e.descriptor.name),
-			...(e.discovered.streams ?? []).map((e) => e.descriptor.name)
-		]
-	});
-	let Ae = (e.log ?? L({ scope: "voltro:serve" })).child("events"), je = e.broadcastNamespace ?? Qe(e.plugins, void 0), Me = E(e.plugins, je, Ae), Ne = e.membership?.instanceId ?? process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, Ie = e.membership ?? Mt(e.plugins, {
-		instanceId: Ne,
-		namespace: je,
-		meta: { mode: "serve" },
-		logger: Ae
-	}), D = fe({
-		events: e.discovered.events ?? [],
-		origin: Ne,
-		...Me.publishRemote === void 0 ? {} : { publishRemote: Me.publishRemote }
-	}), Le = (e.discovered.events ?? []).length > 0 ? await Me.attach(D.bus) : null, Re = Ue({
-		store: e.store,
-		schemaRegistry: e.schemaRegistry,
-		cache: i,
-		kv: a,
-		...ve === void 0 ? {} : { webhooksService: ve },
-		...S === void 0 ? {} : { workflowsProxy: S },
-		eventTriggers: e.discovered.eventTriggers ?? [],
-		namespaceIsolationOn: ge,
-		...e.ensureTenantProvisioned === void 0 ? {} : { ensureTenantProvisioned: e.ensureTenantProvisioned },
-		...e.resolveResidentStore === void 0 ? {} : { resolveResidentStore: e.resolveResidentStore },
-		...Ee === void 0 ? {} : { outbox: { nudge: Ee.nudge } },
-		...w.active ? { connections: { registry: w.registry } } : {},
-		eventBus: D.bus
-	}), ze = G.succeed(rr, g), Be = G.succeed(sr, Rt), He = G.succeed(ir, Ve), Ge = G.succeed(cr, we), qe = (t, n) => {
-		let r = t.pipe(W.provide(Pr(n)));
-		return (e.baseLayer ? r.pipe(W.provide(e.baseLayer)) : r).pipe(W.provide(ze)).pipe(W.provide(Be)).pipe(W.provide(He)).pipe(W.provide(Ge));
-	}, Ye = (e, t) => {
-		let n = qe(e, t);
-		return Y(n);
-	}, Xe = bn(), et = le(e.plugins ?? [], Xe), tt = Oe({
-		plugins: e.plugins ?? [],
-		metrics: Xe,
-		log: e.log ?? L({ scope: "voltro:serve" })
-	}), nt = x(e.plugins ?? [], Xe), rt = e.security?.defaultDeny ?? !0, at = Lr({
-		store: e.store,
-		defaultDeny: rt,
-		recordMetric: (e) => {
-			Xe.record(e);
-		},
-		...et.mutation === void 0 ? {} : { interceptor: et.mutation },
-		buildContext: (e, t, n) => Re(e, t, n),
-		runEffect: Ye,
-		undoCapture: s()
-	}), ct = be();
-	{
-		let t = Je();
-		t !== void 0 && (e.log ?? L({ scope: "voltro:serve" })).info(t);
-	}
-	let lt = Pe({
-		store: e.store,
-		...e.approvals === void 0 ? {} : { defaultExpiryMs: e.approvals.defaultExpiryMs }
-	}), ft = Er({
-		defaultDeny: rt,
-		buildContext: (e) => Re(e),
-		runEffect: Ye,
-		recordMetric: (e) => {
-			Xe.record(e);
-		},
-		...et.action === void 0 ? {} : { interceptor: et.action }
-	}), pt = Br({
-		tenantScopedTables: e.tenantScopedTables,
-		softDeleteScopedTables: e.softDeleteScopedTables
-	}), mt = {
-		defaultDeny: rt,
-		buildContext: (e) => Re(e),
-		finalize: (e, t) => pt(e, t.subject),
-		provideEffect: qe,
-		...et.query === void 0 ? {} : { interceptor: et.query }
-	}, gt = zr(mt), O = Rr({
-		...mt,
-		queryRows: (t, n) => e.store.query(t).then((e) => ai(t.table, e, n.subject))
-	}), _t = Hr({
-		...mt,
-		subscribeDescriptor: (e, t, n) => r.subscribe(e, t, n),
-		subscribeComputed: (e, t, n) => r.subscribeComputed(e, t, n)
-	}), k = (e) => e.filter((e) => Pn(e.descriptor)), A = {};
-	for (let t of [
-		...k(e.discovered.queries),
-		...ct.queries,
-		...lt.queries,
-		...w.queries
-	]) A[t.descriptor.name] = (e) => q(gt(t, e), r, `subscription.${t.descriptor.name}`, void 0, void 0, Vr(t, e));
-	for (let t of [
-		...k(e.discovered.mutations),
-		...ct.mutations,
-		...lt.mutations,
-		...w.mutations
-	]) {
-		let n = Ir(t.descriptor.output);
-		A[t.descriptor.name] = (r) => K(async (e, n) => at(t, e, n), r, `mutation.${t.descriptor.name}`, n, e.idempotency, Ln(t.descriptor, "mutation"));
-	}
-	for (let t of [...k(e.discovered.actions), ...w.actions]) {
-		let n = Ir(t.descriptor.output);
-		A[t.descriptor.name] = (r) => K(async (e, n) => ft(t, e, n), r, `action.${t.descriptor.name}`, n, e.idempotency, Ln(t.descriptor, "action"));
-	}
-	let vt = () => `public-${Math.random().toString(36).slice(2, 10)}`, yt = [
-		...e.discovered.queries.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
-			descriptor: e.descriptor,
-			invoke: (t, n) => O(e, t, {
-				subject: n.subject,
-				traceId: vt()
-			}),
-			subscribe: (t, n, r) => _t(e, t, {
-				subject: n.subject,
-				traceId: vt()
-			}, r)
-		})),
-		...e.discovered.mutations.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
-			descriptor: e.descriptor,
-			invoke: (t, n) => at(e, t, {
-				subject: n.subject,
-				traceId: vt()
-			})
-		})),
-		...e.discovered.actions.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
-			descriptor: e.descriptor,
-			invoke: (t, n) => ft(e, t, {
-				subject: n.subject,
-				traceId: vt()
-			})
-		}))
-	], bt = {
-		candidates: ce({
-			queries: e.discovered.queries,
-			mutations: e.discovered.mutations,
-			actions: e.discovered.actions,
-			descriptorOf: (e) => e.descriptor,
-			runQuery: (e, t, n) => Promise.resolve(O(e, t, n)),
-			runMutation: (e, t, n) => Promise.resolve(at(e, t, n)),
-			runAction: (e, t, n) => Promise.resolve(ft(e, t, n))
-		}),
-		policy: e.agents?.tools ?? {},
-		mcpEnabled: e.agents?.mcp === !0,
-		resolveSubject: (t) => e.resolveSubject(t, -1).then((e) => e.subject)
-	}, St = ht({
-		...e.restRoutes === void 0 ? {} : { restRoutes: e.restRoutes },
-		publicApiEntries: yt,
-		store: e.store,
-		resolveSubject: (t) => e.resolveSubject(t, -1).then((e) => e.subject),
-		...e.idempotency === void 0 ? {} : { idempotency: e.idempotency },
-		log: e.log ?? L({ scope: "voltro:serve" })
-	}), Ct = e.dataTransferSecret ?? process.env.VOLTRO_DATA_TRANSFER_SECRET, wt = async (e, t) => {
-		let { Readable: n } = await import("node:stream"), r = mi(), i = gi("storage", () => n.from(t()));
-		await W.runPromise(vi(r, e, i, { contentType: "application/octet-stream" }));
-	}, Tt = Ct && Ct.length >= 16 ? [{
-		method: "POST",
-		path: Wi,
-		handle: la({
-			secret: Ct,
-			store: e.store,
-			...e.dataTransferSnapshot ? { snapshot: e.dataTransferSnapshot } : {},
-			...e.dataTransferDialect ? { dialect: e.dataTransferDialect } : {},
-			assetSink: Li(mi()),
-			openArchive: (e) => ma(mi(), e),
-			refreshSubscriptions: (e) => {
-				r.refreshAll(e);
-			},
-			putArchive: wt,
-			...e.dataTransferDialect ? { dialect: e.dataTransferDialect } : {}
-		})
-	}, {
-		method: "POST",
-		path: Gi,
-		handle: pa({
-			secret: Ct,
-			store: e.store,
-			snapshot: e.dataTransferSnapshot ?? { tables: [] },
-			dialect: e.dataTransferDialect ?? "memory",
-			tenantTables: [...e.tenantScopedTables],
-			loadProfile: wn,
-			assetSource: Ri(mi(), e.store),
-			putArchive: wt
-		})
-	}] : [], Et = [
-		...e.httpRoutes ?? [],
-		...St.httpRoutes,
-		...Tt,
-		...w.httpRoutes
-	];
-	Object.assign(A, D.handlers);
-	for (let t of k(e.discovered.streams ?? [])) A[t.descriptor.name] = (n) => hr((r) => ci(r, (r) => {
-		let i = Re(r), a = t.executor(n, i);
-		if (W.isEffect(a)) {
-			let t = a.pipe(W.provide(Pr(i.store)));
-			return (e.baseLayer ? t.pipe(W.provide(e.baseLayer)) : t).pipe(W.provide(ze)).pipe(W.provide(Be)).pipe(W.provide(He)).pipe(W.provide(Ge));
-		}
-		return typeof a == "object" && a && typeof a.then == "function" ? W.promise(() => a) : a;
-	}), `stream.${t.descriptor.name}`);
-	for (let t of e.discovered.workflows ?? []) A[t.definition.name] = (e) => K(async (e, n) => {
-		let r = n;
-		return Wr(S, {
-			subject: r.subject,
-			traceId: r.traceId,
-			source: "workflow-rpc"
-		}).start(t.definition.name, e);
-	}, e, `workflow.${t.definition.name}`);
-	de && (A[Vn.name] = (e) => q(gt({
-		descriptor: Vn,
-		executor: (e) => {
-			let t = e.id;
-			return {
-				table: "_voltro_workflow_runs",
-				order: [{
-					column: "startedAt",
-					direction: "desc"
-				}],
-				predicate: Yn(U("id", t), U("executionId", t)),
-				take: 1,
-				skip: void 0,
-				projection: void 0
-			};
-		}
-	}, e), r, `subscription.${Vn.name}`), A[Un.name] = (e) => q(gt({
-		descriptor: Un,
-		executor: (e) => {
-			let t = e, n = [...t.tag === void 0 ? [] : [U("tag", t.tag)], ...t.status === void 0 ? [] : [U("status", t.status)]], r = Number.isFinite(t.limit) && t.limit !== void 0 ? Math.min(Math.max(Math.floor(t.limit), 1), 500) : 100;
-			return {
-				table: "_voltro_workflow_runs",
-				order: [{
-					column: "startedAt",
-					direction: "desc"
-				}],
-				predicate: n.length === 0 ? void 0 : n.length === 1 ? n[0] : H(...n),
-				take: r,
-				skip: void 0,
-				projection: void 0
-			};
-		}
-	}, e), r, `subscription.${Un.name}`), A[Hn.name] = (e) => q(gt({
-		descriptor: Hn,
-		executor: (e) => {
-			let t = e.runId;
-			return {
-				table: "_voltro_workflow_run_steps",
-				order: [{
-					column: "startedAt",
-					direction: "asc"
-				}],
-				predicate: U("runId", t),
-				take: 1e3,
-				skip: void 0,
-				projection: void 0
-			};
-		}
-	}, e), r, `subscription.${Hn.name}`), A[Bn.name] = (e) => q(gt({
-		descriptor: Bn,
-		executor: (e) => {
-			let t = e.runId;
-			return {
-				table: "_voltro_workflow_run_events",
-				order: [{
-					column: "occurredAt",
-					direction: "asc"
-				}],
-				predicate: U("runId", t),
-				take: 1e3,
-				skip: void 0,
-				projection: void 0
-			};
-		}
-	}, e), r, `subscription.${Bn.name}`), A[B.name] = (e) => q(gt({
-		descriptor: B,
-		executor: (e) => {
-			let t = e;
-			return {
-				table: "_voltro_workflow_events",
-				order: [{
-					column: "occurredAt",
-					direction: "desc"
-				}],
-				predicate: t.name === void 0 ? void 0 : U("name", t.name),
-				take: Math.max(1, Math.min(500, t.limit ?? 100)),
-				skip: void 0,
-				projection: void 0
-			};
-		}
-	}, e), r, `subscription.${B.name}`), A[V.name] = (e) => q(gt({
-		descriptor: V,
-		executor: (e) => {
-			let t = e.eventId;
-			return {
-				table: "_voltro_workflow_event_deliveries",
-				order: [{
-					column: "createdAt",
-					direction: "asc"
-				}],
-				predicate: U("eventId", t),
-				take: 500,
-				skip: void 0,
-				projection: void 0
-			};
-		}
-	}, e), r, `subscription.${V.name}`), A[Rn.name] = (t) => K(async (t, n) => {
-		let r = t;
-		return await j(e.store, n.subject, { executionId: r.executionId }), await S.cancel(r.workflowName, r.executionId), await Ft(r.workflowName, r.executionId, "workflow.cancel"), { ok: !0 };
-	}, t, `action.${Rn.name}`), A[zn.name] = (t) => K(async (t, n) => {
-		let r = t;
-		return await j(e.store, n.subject, { executionId: r.executionId }), await S.resume(r.workflowName, r.executionId), { ok: !0 };
-	}, t, `action.${zn.name}`), A[Wn.name] = (t) => K(async (t, n) => {
-		let r = t;
-		return await j(e.store, n.subject, { id: r.id }), S.signal({ id: r.id }, r.signalName, r.payload);
-	}, t, `action.${Wn.name}`), A[Gn.name] = (t) => K(async (t, n) => {
-		let r = t;
-		return await j(e.store, n.subject, { id: r.id }), S.update({ id: r.id }, r.updateName, r.payload, r.timeoutMs === void 0 ? void 0 : { timeoutMs: r.timeoutMs });
-	}, t, `action.${Gn.name}`));
-	let Dt = [
-		...k(e.discovered.queries).map((e) => z(e.descriptor)),
-		...k(e.discovered.mutations).map((e) => Fn(e.descriptor)),
-		...k(e.discovered.actions).map((e) => R(e.descriptor)),
-		...ct.queries.map((e) => z(e.descriptor)),
-		...ct.mutations.map((e) => Fn(e.descriptor)),
-		...lt.queries.map((e) => z(e.descriptor)),
-		...lt.mutations.map((e) => Fn(e.descriptor)),
-		...w.queries.map((e) => z(e.descriptor)),
-		...w.mutations.map((e) => Fn(e.descriptor)),
-		...w.actions.map((e) => R(e.descriptor)),
-		...k(e.discovered.streams ?? []).map((e) => In(e.descriptor)),
-		...D.rpcs,
-		...(e.discovered.workflows ?? []).map((e) => li(e.definition)),
-		...de ? [
-			z(Vn),
-			z(Un),
-			z(Hn),
-			z(Bn),
-			z(B),
-			z(V),
-			R(Rn),
-			R(zn),
-			R(Wn),
-			R(Gn)
-		] : []
-	], Ot = pi.make(...Dt).middleware(jn).middleware(Mn), kt = Mr({ resolveSubject: ({ headers: t, clientId: n }) => e.resolveSubject(t, n) }), At = e.dormancyTenantId ?? ar, Nt = e.dormancy === "sleep" ? {
-		register: (t, n, r) => Zr(e.store, {
-			tenantId: r ?? At,
-			kind: "workflow",
-			refId: t,
-			wakeAt: n
-		}),
-		cancel: (t, n) => _r(e.store, {
-			tenantId: n ?? At,
-			kind: "workflow",
-			refId: t
-		}).then(() => {})
-	} : void 0, M = he ? await import("@voltro/workflow") : void 0, N = M?.makeWorkflowRunRecorder({
-		store: e.store,
-		...e.workflowRecording === void 0 ? {} : { recording: e.workflowRecording },
-		...Nt === void 0 ? {} : { wakeups: Nt }
-	}), Pt = async (t, n) => {
-		await M.closeWorkflowChildrenForParent({
-			store: e.store,
-			parentExecutionId: t,
-			parentStatus: n,
-			recorder: N,
-			log: { warn: (e, t) => {
-				process.stderr.write(`[workflow] ${e} ${t ? JSON.stringify(t) : ""}\n`);
-			} },
-			interruptChild: async (t, n) => {
-				let r = (e.discovered.workflows ?? []).find((e) => e.definition.name === t);
-				if (!r) throw Error(`Unknown child workflow: ${t}`);
-				if (!u) throw Error("Workflow runtime is not ready");
-				await u.runPromise(r.definition.interrupt(n));
-			}
-		});
-	}, Ft = async (t, n, r) => {
-		let i = (await e.store.query({
-			table: "_voltro_workflow_runs",
-			order: [],
-			predicate: U("executionId", n),
-			projection: void 0,
-			skip: void 0,
-			take: 1
-		}))[0];
-		if (i === void 0) return;
-		let a = await e.store.update("_voltro_workflow_runs", i.id, {
-			status: "cancelled",
-			cancelled: !0,
-			completedAt: /* @__PURE__ */ new Date()
-		}), o = i.subject?.tenantId ?? void 0;
-		a && await N.recordEvent({
-			runId: i.id,
-			eventType: "run-cancelled",
-			payload: {
-				reason: r,
-				workflowName: t,
-				executionId: n,
-				...o == null ? {} : { tenantId: o }
-			}
-		}), a && await Pt(n, "cancelled");
-	}, It = [
-		...Gr(e.discovered.workflows ?? [], {
-			buildContext: (t, n) => e.buildContextForWorkflow?.(t, n) ?? Re({
-				subject: t.subject,
-				traceId: t.traceId
-			}, e.store, void 0, `workflow:${n.workflowName}`, { parentExecutionId: n.executionId }),
-			resolveStartContext: ae,
-			...oe === void 0 ? {} : { resolveAuthority: oe }
-		}, (t, n, r) => {
-			let i = M.getWorkflowVersionMetadata(t.definition);
-			return M.wrapWorkflowExecuteWithRunRecording({
-				name: t.definition.name,
-				store: e.store,
-				subject: r.subject,
-				source: r.source ?? null,
-				traceId: r.traceId,
-				workflowVersion: i.version,
-				workflowCompatibleVersions: i.compatibleWith,
-				workflowPatches: i.patches,
-				parentExecutionId: r?.parentExecutionId ?? null,
-				parentClosePolicy: r?.parentClosePolicy ?? null,
-				onParentClose: ({ executionId: e, status: t }) => Pt(e, t),
-				...dt(t.definition),
-				onTerminal: async ({ executionId: e }) => {
-					await l?.gate.release(e);
-				},
-				recorder: N,
-				pluginWorkflowStepLayer: nt,
-				recordRun: Yr
-			}, n);
-		}),
-		...e.discovered.workflowWorkers ?? [],
-		...ye === void 0 ? [] : [ye]
-	], Lt = [...(e.discovered.workflows ?? []).map((e) => e.definition.name).filter(Boolean), ...ye === void 0 ? [] : ["voltro.deliverWebhook"]], zt = It.length > 0 ? G.mergeAll(...It) : G.empty;
-	if (((e.discovered.workflows?.length ?? 0) > 0 || (e.discovered.workflowWorkers?.length ?? 0) > 0 || e.scheduleCoordination === "cluster" || ye !== void 0) && e.workflowEngineLayer !== void 0) {
-		let t = zt.pipe(G.provideMerge(e.workflowEngineLayer));
-		u = Zn.make(e.baseLayer === void 0 ? t : t.pipe(G.provideMerge(e.baseLayer))), await u.runPromise(W.void), (e.log ?? L({ scope: "voltro:serve" })).child("workflow").info(`workflow runtime ready — ${Lt.length} entity type(s) registered`, { entities: Lt });
-		let n = await import("@voltro/workflow/cluster"), r = (e) => u.runPromise(n.redriveFailedRun(e)), i = (e) => u.runPromise(n.resumeRunFromStep(e));
-		m = await Bt({
-			provider: Ni(e.plugins ?? [])?.broadcast?.provider,
-			crossReplica: Ni(e.plugins ?? [])?.broadcast?.crossReplica ?? !1,
-			namespace: je,
-			replicaId: crypto.randomUUID(),
-			pollStorage: () => u.runPromise(n.pollWorkflowStorage),
-			onChange: (t) => e.store.onChange((e) => t({
-				table: e.table,
-				op: e.op,
-				...e.origin === void 0 ? {} : { origin: e.origin }
-			})),
-			log: (e.log ?? L({ scope: "voltro:serve" })).child("workflow")
-		}), f = async (t) => {
-			let n = await De({
-				store: e.store,
-				workflows: e.discovered.workflows ?? [],
-				runRedrive: r
-			}, t.runId);
-			return n.statusReset && await N.recordEvent({
-				runId: t.runId,
-				eventType: "run-redriven",
-				payload: {
-					reason: "inspect.redrive",
-					activitiesReset: n.outcome.activitiesReset
-				}
-			}), {
-				redriven: n.outcome.redriven,
-				activitiesReset: n.outcome.activitiesReset,
-				reason: n.outcome.reason
-			};
-		}, p = async (t) => {
-			let n = await ke({
-				store: e.store,
-				workflows: e.discovered.workflows ?? [],
-				runResume: i
-			}, t.runId, t.step);
-			return n.statusReset && await N.recordEvent({
-				runId: t.runId,
-				eventType: "run-redriven",
-				payload: {
-					reason: "inspect.resume-from-step",
-					step: n.stepName,
-					activitiesReset: n.outcome.activitiesReset
-				}
-			}), {
-				redriven: n.outcome.redriven,
-				stepName: n.stepName,
-				activitiesReset: n.outcome.activitiesReset,
-				reason: n.outcome.reason
-			};
-		};
-		let a = (e.scheduleCoordination ?? "single") === "advisoryLock" ? Dr(e.store, e.scheduleReplicaId ?? `pid-${process.pid}`) : ni, s = Nr({
-			coordinator: a,
-			replicaId: e.scheduleReplicaId ?? `pid-${process.pid}`
-		}), d = {
-			info: (e, t) => {
-				process.stdout.write(`[flow-control] ${e} ${t ? JSON.stringify(t) : ""}\n`);
-			},
-			warn: (e, t) => {
-				process.stderr.write(`[flow-control] ${e} ${t ? JSON.stringify(t) : ""}\n`);
-			},
-			error: (e, t) => {
-				process.stderr.write(`[flow-control] ERROR ${e} ${t ? JSON.stringify(t) : ""}\n`);
-			}
-		}, h, g = () => {
-			if (h !== void 0) return h;
-			if (o !== void 0 && N !== void 0) return h = ne({
-				store: e.store,
-				log: I,
-				workflows: e.discovered.workflows ?? [],
-				workflowsProxy: o,
-				workflowRuntime: u,
-				workflowRunRecorder: N,
-				closeChildrenForParent: Pt
-			}), h;
-		};
-		ee = g, l = $e({
-			store: e.store,
-			onChange: (t) => e.store.onChange((e) => t({
-				table: e.table,
-				op: e.op
-			})),
-			...e.scheduling === void 0 ? {} : {
-				disarmWhenIdle: e.scheduling.disarmWhenIdle,
-				drainIntervalMs: e.scheduling.admissionDrainMs,
-				cancelSweepIntervalMs: e.scheduling.cancelSweepMs,
-				stalenessSweepIntervalMs: e.scheduling.stalenessSweepMs
-			},
-			workflows: e.discovered.workflows ?? [],
-			facade: () => o,
-			cancelRunWithReason: g,
-			recordRunEvent: () => N?.recordEvent,
-			...e.workflowStaleness === void 0 ? {} : { staleness: e.workflowStaleness },
-			...e.workflowSuspendSignalHintMs === void 0 ? {} : { suspendSignalHintMs: e.workflowSuspendSignalHintMs },
-			scheduleCoordinated: s,
-			onAbandoned: async (t) => {
-				await We({
-					workflows: e.discovered.workflows ?? [],
-					facade: () => o,
-					log: d,
-					...t
-				});
-			},
-			log: d
-		});
-		let _ = l;
-		_ !== void 0 && qr(() => _.stop()), c = Ze({
-			store: e.store,
-			onChange: (t) => e.store.onChange((e) => t({
-				table: e.table,
-				op: e.op
-			})),
-			...e.scheduling === void 0 ? {} : {
-				disarmWhenIdle: e.scheduling.disarmWhenIdle,
-				tickIntervalMs: e.scheduling.inferenceTickMs
-			},
-			enabled: (e.discovered.workflows?.length ?? 0) > 0,
-			resumeSignal: () => u === void 0 || M === void 0 ? void 0 : async ({ executionId: t, workflowName: n, signalName: r, payload: i }) => {
-				await u.runPromise(M.completeSuspendingSignal({
-					store: e.store,
-					target: Ke(t, n),
-					signalName: r,
-					payload: i
-				}));
-			},
-			runEffect: (e) => u.runPromise(e),
-			scheduleCoordinated: s,
-			log: d
-		});
-		let v = c;
-		v !== void 0 && qr(() => v.stop()), o = (e.discovered.workflows?.length ?? 0) > 0 ? J({
-			workflows: e.discovered.workflows ?? [],
-			runEffect: (e) => u.runPromise(e),
-			onEnqueue: () => m?.publishWake(),
-			..._ === void 0 ? {} : {
-				admitStart: _.gate.admitStart,
-				startPayloadSchema: _.gate.startPayloadSchema,
-				parkDelayedStart: _.gate.parkDelayed
-			},
-			rememberStartContext: te,
-			signal: async (t, n, r) => {
-				let i = await M.sendWorkflowSignal({
-					store: e.store,
-					recorder: N,
-					target: t,
-					signalName: n,
-					payload: r
-				});
-				return await u.runPromise(M.completeSuspendingSignal({
-					store: e.store,
-					target: t,
-					signalName: n,
-					payload: r
-				})).catch(() => {}), i;
-			},
-			update: (t, n, r, i) => M.sendWorkflowUpdate({
-				store: e.store,
-				recorder: N,
-				target: t,
-				updateName: n,
-				payload: r,
-				...i === void 0 ? {} : { options: i }
-			}),
-			listRuns: (t) => y(e.store, t),
-			retry: (t, n) => ie({
-				store: e.store,
-				workflows: e.discovered.workflows ?? [],
-				runPromise: (e) => u.runPromise(e)
-			}, t, n),
-			redrive: (t) => De({
-				store: e.store,
-				workflows: e.discovered.workflows ?? [],
-				runRedrive: r
-			}, t).then((e) => e.outcome)
-		}) : void 0;
-	}
-	let Vt = G.mergeAll(Ot.toLayer(A), kt), Ht = it(A, e.discovered.queries.map((e) => e.descriptor.name), de), Ut = G.mergeAll(Ot.toLayer(Ht), kt), P = e.observability, Wt = await gr({
-		...e.appName === void 0 ? {} : { serviceName: e.appName },
-		...P && P.spanProcessors.length > 0 ? { extraSpanProcessors: P.spanProcessors } : {},
-		...P && P.metricReaders.length > 0 ? { extraMetricReaders: P.metricReaders } : {},
-		...P && Object.keys(P.resourceAttributes).length > 0 ? { resourceAttributes: P.resourceAttributes } : {},
-		...P && P.sampler !== void 0 ? { sampler: P.sampler } : {}
-	}), Gt = !1, F = e.store.ping ? () => e.store.ping().then(() => !0).catch(() => !1) : void 0, { server: Kt, shutdown: qt } = ri({
-		group: Ot,
-		handlersLayer: Vt,
-		httpHandlersLayer: Ut,
-		port: e.port ?? 4e3,
-		...e.host === void 0 ? {} : { host: e.host },
-		path: e.path ?? "/ws",
-		tracerLayer: Wt.layer,
-		security: re(e),
-		...tt,
-		healthCheck: {
-			isReady: () => Gt,
-			...F ? { ping: F } : {}
-		},
-		...Et.length > 0 ? { httpRoutes: Et } : {},
-		...e.getStore === void 0 ? {} : { getStore: e.getStore },
-		...Se.size > 0 ? { webhookRoutes: Se } : {},
-		...e.inspectRoute === void 0 ? {} : { inspectRoute: e.inspectRoute }
-	}), Jt = Ui(Kt);
-	if (await mr(Kt), (e.discovered.schedules?.length ?? 0) > 0) {
-		let t = (e.scheduleCoordination ?? "single") === "advisoryLock" ? Dr(e.store, e.scheduleReplicaId ?? `pid-${process.pid}`) : ni;
-		h = await ii(e.discovered.schedules ?? [], {
-			store: e.store,
-			coordinator: t,
-			defaultTrigger: e.scheduleDefaultTrigger ?? "self",
-			replicaId: e.scheduleReplicaId ?? `pid-${process.pid}`,
-			armSelf: e.scheduleArmSelf ?? !0,
-			dormancy: e.dormancy ?? "always-on",
-			...e.dormancyTenantId === void 0 ? {} : { dormancyTenantId: e.dormancyTenantId },
-			buildContext: ({ traceId: t, scheduleName: n, subject: r }) => Re({
-				subject: r,
-				traceId: t
-			}, e.store, void 0, `schedule:${n}`),
-			log: {
-				info: (e, t) => {
-					process.stdout.write(`[schedule] ${e} ${t ? JSON.stringify(t) : ""}\n`);
-				},
-				warn: (e, t) => {
-					process.stderr.write(`[schedule] ${e} ${t ? JSON.stringify(t) : ""}\n`);
-				},
-				error: (e, t) => {
-					process.stderr.write(`[schedule] ERROR ${e} ${t ? JSON.stringify(t) : ""}\n`);
-				},
-				debug: () => {}
-			},
-			...e.scheduleFireInterceptor === void 0 ? {} : { interceptFire: e.scheduleFireInterceptor },
-			...e.onScheduleRunEvent === void 0 ? {} : { onRunEvent: e.onScheduleRunEvent }
-		}), e.onSchedulerReady?.(h);
-	}
-	let I = e.log ?? L({ scope: "voltro:serve" }), Yt, Xt;
-	if ((e.discovered.subscribers?.length ?? 0) > 0 && (Yt = xe(e.discovered.subscribers ?? [], e.store, I.child("subscribe"), e.schemaRegistry, D.bus)), (e.discovered.reactions?.length ?? 0) > 0) {
-		let t = I.child("reaction"), n = async (n, r) => {
-			if (n.kind === "workflow") {
-				if (S === void 0) {
-					t.warn("reaction workflow act skipped — no workflow engine in this app", { workflow: n.workflow });
-					return;
-				}
-				let e = n.payload === void 0 ? r.new ?? r.old ?? {} : n.payload(r);
-				await Wr(S, {
-					traceId: `reaction:${n.workflow}`,
-					source: `reaction:${n.workflow}`
-				}).start(n.workflow, e);
-				return;
-			}
-			await pe(n.agent, r, {
-				findAgentSend: (t) => e.discovered.actions.find((e) => e.descriptor.name === `${t}.send`),
-				runAction: (e, t, n) => Promise.resolve(ft(e, t, n)),
-				makeSubject: (e) => Nn(e),
-				now: () => Date.now(),
-				log: t
-			});
-		}, r = async (n, r) => {
-			try {
-				let { requireAiBudget: t } = await import("@voltro/ai");
-				return (await W.runPromise(W.either(t(e.store, {
-					tenantId: n,
-					limitUsd: r
-				}))))._tag === "Right";
-			} catch (e) {
-				return t.warn("reaction budget check failed — refusing the act", { tenantId: n }, e), !1;
-			}
-		}, i = jt(e.store, { onError: (e) => t.warn("reaction: rate-slot claim failed; refusing the act", { cause: String(e) }) });
-		Xt = st(e.discovered.reactions ?? [], e.store, {
-			runAct: n,
-			checkBudget: r,
-			claimRateSlot: (e) => i.claim(e)
-		}, t);
-	}
-	let Zt;
-	(e.discovered.aggregates?.length ?? 0) > 0 && (Zt = await v({
-		discovered: e.discovered.aggregates ?? [],
-		store: e.store,
-		log: I.child("aggregate"),
-		...e.analytics === void 0 ? {} : { analytics: e.analytics },
-		...e.aggregateStorage === void 0 ? {} : { storage: e.aggregateStorage },
-		...e.aggregateCoordinator === void 0 ? {} : { coordinator: e.aggregateCoordinator }
-	}), ze = G.succeed(rr, Zt.registry));
-	let Qt;
-	(e.discovered.expectations?.length ?? 0) > 0 && (Qt = dr({
-		discovered: e.discovered.expectations ?? [],
-		store: e.store,
-		log: I.child("expectation")
-	}), Be = G.succeed(sr, Qt.registry)), (e.discovered.budgets?.length ?? 0) > 0 && (n = pr({
-		discovered: e.discovered.budgets ?? [],
-		log: I.child("finops")
-	}), He = G.succeed(ir, n.registry));
-	let $t;
-	return (e.discovered.experiments?.length ?? 0) > 0 && ($t = fr({
-		discovered: e.discovered.experiments ?? [],
-		store: e.store,
-		log: I.child("experiment")
-	}), Ge = G.succeed(cr, $t.registry)), Gt = !0, e.bootTiming?.mark("ready"), {
-		dispatcher: r,
-		server: Kt,
-		scheduler: h,
-		eventsSnapshot: me(D.bus, D.declared),
-		membersSnapshot: () => ({
-			members: Ie.membership.list(),
-			capturedAt: Date.now()
-		}),
-		agentTools: () => bt,
-		rpcMetrics: () => Xe,
-		webhooksService: () => ve,
-		runCanceller: () => ee(),
-		flowControlHealth: () => l?.cancelHealth(),
-		inferenceHealth: () => c?.health(),
-		workflowWriteActions: () => S === void 0 || N === void 0 ? void 0 : se({
-			store: e.store,
-			log: I,
-			workflows: e.discovered.workflows ?? [],
-			workflowsProxy: o,
-			workflowRuntime: u,
-			workflowRunRecorder: N,
-			closeChildrenForParent: Pt
-		}),
-		redriveWorkflowRun: (e) => f ? f(e) : Promise.reject(/* @__PURE__ */ Error("redrive: this app registers no workflows")),
-		resumeWorkflowRunFromStep: (e) => p ? p(e) : Promise.reject(/* @__PURE__ */ Error("resume-from-step: this app registers no workflows")),
-		close: async () => {
-			Gt = !1, await Jt.drainRequests();
-			for (let e of Ce) try {
-				await e();
-			} catch (e) {
-				I.warn("serve: teardown step failed", {}, e);
-			}
-			await Le?.detach(), await Ie.detach(), Zt?.detach(), Qt?.detach(), n?.detach(), $t?.detach(), Xt?.(), Yt?.(), await h?.shutdown(), r.close(), await m?.detach(), await u?.dispose(), await qt(), await Jt.finish();
-		}
-	};
-}, $ = L({ scope: "voltro:serve" }), _a = (e, t, n) => (e === "production" || e === "staging") && t !== "memory" && n !== "0", va = Ut, ya = async (e) => {
-	let t = Sn(process.cwd());
-	if (kn(t)) {
-		let n;
-		try {
-			let e = await import(An(t).href);
-			typeof e.runServe == "function" ? n = e.runServe : $.warn("serve bundle has no runServe export — using the standard serve path");
-		} catch (e) {
-			$.warn("serve bundle failed to load — using the standard serve path", {}, e);
-		}
-		if (n) return $.info("serve: booting from the precompiled serve bundle"), n(e);
-	}
-	return ba(e);
-}, ba = async (s) => {
-	let d = Cn();
-	e("serve");
-	try {
-		xi();
-	} catch (e) {
-		throw i(e instanceof Error ? e.message : String(e));
-	}
-	let g = process.cwd(), v = await He(g), ne = P({
-		kind: "api",
-		configPort: v?.port,
-		env: process.env,
-		flagPort: va(s, "--port")
-	});
-	for (let e of ne.warnings) $.warn(e);
-	let ie = ne.port;
-	$r(Qr(v?.secrets)), await Wt({
-		rawEnv: v?.env,
-		appType: "api",
-		root: g,
-		log: $,
-		generateTypes: !1
-	}), d.mark("config");
-	let y = (process.env.DB_DIALECT ?? v?.store ?? "memory").toLowerCase(), se = (y === "mariadb" || y === "postgres" || y === "mssql") && (process.env.CDC ?? "1") !== "0", ce = y === "mariadb" ? "mariadb" : y === "mssql" ? "mssql" : void 0, le = xn(g);
-	if (!r() && kn(le)) try {
-		let e = await import(An(le).href);
-		if (e.modules) {
-			let t = {};
-			for (let [n, r] of Object.entries(e.modules)) t[Dn(g, n)] = r;
-			n(t), $.info("precompiled api bundle loaded", { modules: Object.keys(t).length });
-		}
-	} catch (e) {
-		$.warn("precompiled api bundle failed to load — falling back to source", {}, e);
-	}
-	let b = await Ye(g), x = await kt(b, { cdc: se && ce !== void 0 }), ue = Ht(x);
-	{
-		let e = /* @__PURE__ */ new Set([
-			...x.queries.filter((e) => e.descriptor.overridesPlugin === !0).map((e) => e.descriptor.name),
-			...x.mutations.filter((e) => e.descriptor.overridesPlugin === !0).map((e) => e.descriptor.name),
-			...x.actions.filter((e) => e.descriptor.overridesPlugin === !0).map((e) => e.descriptor.name)
-		]);
-		Zt(Xt(v?.plugins ?? []), [
-			...x.queries.map((e) => e.descriptor.name),
-			...x.mutations.map((e) => e.descriptor.name),
-			...x.actions.map((e) => e.descriptor.name),
-			...x.streams.map((e) => e.descriptor.name)
-		], e);
-		let t = ae(x.serverOnlyLeaks, Ae(process.env, "strict"), br, "`voltro serve`");
-		if (t.action === "fail") throw i(t.message ?? "");
-		t.action === "warn" && $.warn(t.message ?? "");
-	}
-	let fe = b.filter((e) => yn.test(e)), pe = fe.length > 0 ? await vn(fe, $.child("webhooks")) : {
-		outgoing: [],
-		incoming: [],
-		providers: []
-	}, me = gn(x.events), be = pe.outgoing.length + pe.incoming.length + pe.providers.length + me.length === 0 ? void 0 : {
-		...pe,
-		outgoing: [...pe.outgoing, ...me]
-	}, xe = an({
-		nodeEnv: process.env.NODE_ENV,
-		cdcDialect: ce,
-		declared: v?.schema
-	}), we = $t({
-		gates: xe,
-		runtime: {
-			traces: ve(),
-			undo: oi()
-		}
-	});
-	if (we !== void 0) throw i(`serve: ${we}`);
-	let De = rn({
-		mix: x.featureMix,
-		plugins: v?.plugins ?? [],
-		gates: xe,
-		...ce ? { cdcDialect: ce } : {}
-	}), Oe = v?.analytics !== void 0 && v.analytics.kind !== "noop" && y !== "memory" ? (await F(y)).makeSqlLayer(O()) : void 0, ke = await qe({
-		spec: v?.analytics,
-		sqlLayer: Oe,
-		log: $
-	}), T = (() => {
-		let e = new Set(x.tables.map((e) => e.tableName)), t = [...x.tables];
-		for (let n of [...De, ...ke.tables]) e.has(n.tableName) || (e.add(n.tableName), t.push(n));
-		return t;
-	})();
-	for (let e of T) Jn(e);
-	{
-		let e = xr(si(Be(x), Lt(T)));
-		e !== void 0 && $.warn(e);
-	}
-	let Pe = (process.env.NODE_ENV ?? "").toLowerCase();
-	if (_a(Pe, y, process.env.VOLTRO_AUTO_MIGRATE)) {
-		let e = (await F(y)).makeSqlLayer(O()), t = await W.runPromise(Qn.SqlClient.pipe(W.flatMap((e) => tr(e, g)), W.provide(e), W.catchAll(() => W.succeed([]))));
-		t.length > 0 && ($.error(`serve: refusing to boot — ${t.length} pending file-based migration(s) have never run against this database. They perform the changes a schema diff cannot infer (data moves, backfills, table splits), so the declarative fingerprint check below cannot see them and would have let this process serve un-migrated data.`, { pending: t }), $.error("Run them from your pre-deploy job — `voltro db migrate .` (schema + files) or `voltro db files .` (files alone) — or set VOLTRO_AUTO_MIGRATE=0 to bypass every boot schema check. `voltro serve` never applies them itself: a rolling deploy would start N replicas and each would try."), process.exit(1));
-		let n = await W.runPromise(Qn.SqlClient.pipe(W.flatMap((e) => nr(e, T, {
-			appliedBy: `serve:${Pe}`,
-			environment: "prod",
-			dialectId: y
-		})), W.provide(e)));
-		n.kind === "prod-mismatch" && ($.error(er(n, y)), $.error(tn({
-			gates: xe,
-			nodeEnv: process.env.NODE_ENV,
-			cdcDialect: ce,
-			declared: v?.schema
-		})), $.error("serve: refusing to boot — apply the schema first (voltro db apply in a pre-deploy step), or set VOLTRO_AUTO_MIGRATE=0 to bypass this check."), process.exit(1)), $.info(er(n, y));
-	}
-	await Yt({
-		dialectId: y,
-		tables: T,
-		mode: Jt(v?.reactiveTriggers),
-		lockSchema: O().schema,
-		makeLayer: async () => (await F(y)).makeSqlLayer(O()),
-		log: {
-			info: (e, t) => $.info(e, t ?? {}),
-			warn: (e, t) => $.warn(e, t ?? {})
-		}
-	});
-	let Fe = Ur(T);
-	d.mark("discover");
-	let E = await rt(v, void 0);
-	{
-		let e = await ee(E);
-		if (e !== void 0) throw i(`serve: ${e}`);
-	}
-	let Ve = ui(E, y);
-	for (let e of tt({
-		dialect: String(v?.store ?? process.env.DB_DIALECT ?? "postgres"),
-		changeStrategy: (process.env.CDC ?? "1") === "0" ? "inline" : "cdc",
-		dbUrl: process.env.DB_URL,
-		crossReplicaBus: Ni(v?.plugins ?? [])?.broadcast.crossReplica === !0,
-		tables: x.tables.map((e) => ({
-			tableName: e.tableName,
-			isReactive: e.isReactive === !0
-		})),
-		querySources: x.queries.flatMap((e) => {
-			let t = e.descriptor.source;
-			return t === void 0 ? [] : typeof t == "string" ? [t] : [...t];
-		})
-	})) e.level === "warn" ? $.warn(e.message) : $.info(e.message);
-	{
-		let e = vt({
-			tables: Kn().map((e) => ({ tableName: e.tableName })),
-			queries: x.queries.map((e) => ({
-				name: e.descriptor.name,
-				source: e.descriptor.source
-			}))
-		}), t = pt(e);
-		t !== void 0 && $.warn(t);
-	}
-	v?.cache && !process.env.CACHE_BACKEND && (process.env.CACHE_BACKEND = v.cache), v?.cacheRedisUrl && !process.env.CACHE_REDIS_URL && (process.env.CACHE_REDIS_URL = v.cacheRedisUrl), v?.cacheRedisDriver && !process.env.CACHE_REDIS_DRIVER && (process.env.CACHE_REDIS_DRIVER = v.cacheRedisDriver), v?.cacheKeyPrefix && !process.env.CACHE_KEY_PREFIX && (process.env.CACHE_KEY_PREFIX = v.cacheKeyPrefix);
-	let { service: Ue, invalidationBus: We, snapshotCache: Ke, cache: Je, semantic: Ze, evictSource: $e, backend: it, stats: ot, dispose: st } = await Xe({
-		env: process.env,
-		semantic: v?.cacheSemantic ?? !1
-	});
-	Ze !== void 0 && $.info("semantic cache enabled — reactive eviction on live writes"), $.info(`cache backend resolved: ${it}` + (it === "redis" ? ` (driver ${process.env.CACHE_REDIS_DRIVER ?? "resp"})` : " — in-process, not cross-instance")), E.onChange((e) => {
-		if (W.runFork(We.publish(e.table)), $e !== void 0) {
-			let t = (e.new ?? e.old)?.id;
-			$e({
-				table: e.table,
-				op: e.op,
-				...t === void 0 ? {} : { id: t }
-			});
-		}
-	}), v?.kv && !process.env.KV_BACKEND && (process.env.KV_BACKEND = v.kv), v?.kvRedisUrl && !process.env.KV_REDIS_URL && (process.env.KV_REDIS_URL = v.kvRedisUrl), v?.kvKeyPrefix && !process.env.KV_KEY_PREFIX && (process.env.KV_KEY_PREFIX = v.kvKeyPrefix);
-	let { kv: ut, service: dt } = await jr({ store: E });
-	Pt({
-		log: $,
-		max: qt(),
-		outOfPool: p(y, (process.env.CDC ?? "1") !== "0"),
-		readPools: t.replicationSnapshot()?.replicaCount ?? 0,
-		always: !0
-	}), d.mark("store");
-	let ht = ur({
-		store: E,
-		sink: ke.sink,
-		log: $
-	}), xt = Ge({
-		store: E,
-		dialect: y,
-		log: { info: (e) => $.info(e) }
-	}), j = v?.plugins ?? [], jt = process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, Rt, Bt;
-	y !== "memory" && (Rt = Zn.make((await F(y)).makeSqlLayer(O())), Bt = await Rt.runPromise(Qn.SqlClient));
-	let Ut = [
-		"postgres",
-		"mariadb",
-		"mysql",
-		"mssql"
-	].includes(y) ? Dr(E, jt, $) : ni, _n = M(v?.scheduling), Sn = Nr({
-		maxIdleIntervalMs: _n.pollCeilingMs,
-		coordinator: Ut,
-		replicaId: jt,
-		log: $
-	}), wn = [], Tn = process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, On = Ni(v?.plugins ?? [])?.broadcast?.provider, L = Qe(v?.plugins, v?.name ?? En(g));
-	{
-		let e = et(v?.plugins, v?.name ?? En(g));
-		e !== void 0 && $.warn(e);
-	}
-	let jn = Mt(v?.plugins, {
-		instanceId: Tn,
-		namespace: L,
-		meta: { mode: "serve" },
-		logger: $
-	}), Mn = {
-		...Bt ? { sql: Bt } : {},
-		instanceId: Tn,
-		membership: jn.membership,
-		...On === void 0 ? {} : { broadcast: On },
-		broadcastChannels: { presence: Mi(L, "presence") },
-		scheduleCoordinated: (e, t, n) => {
-			let r = Sn(e, t, n);
-			return wn.push(r), r;
-		}
-	};
-	for (let e of j) e.bindDataStore?.(Ve, Mn);
-	l({
-		store: E,
-		...ct(),
-		log: $
-	});
-	let R = j.filter((e) => typeof e.onChangeEvent == "function");
-	if (R.length > 0) {
-		let e = E.changeScope ?? "local";
-		E.onChange((t) => {
-			let n = ye(t, e);
-			for (let e of R) W.runFork(e.onChangeEvent(n).pipe(W.catchAllCause((t) => W.sync(() => $.warn(`plugin ${e.name} onChangeEvent failed`, { error: Xn.pretty(t) })))));
-		});
-	}
-	let Nn = Ne({
-		plugins: j,
-		appName: v?.name ?? "voltro-api",
-		appType: "api",
-		voltroVersion: process.env.npm_package_version ?? "0.0.0",
-		log: $
-	});
-	j.length && await Nn.activate(), d.mark("plugins");
-	let Pn = await Nn.gatherObservability(), Fn = {
-		info: (e, t) => process.stdout.write(`[broadcast] ${e} ${t ? JSON.stringify(t) : ""}\n`),
-		warn: (e, t) => process.stderr.write(`[broadcast] ${e} ${t ? JSON.stringify(t) : ""}\n`),
-		debug: () => {}
-	}, z, In = await A(E, v, y, L, Fn, (e, t) => {
-		z?.refreshAll(`broadcast gap: missed ${t} change(s) from ${e}`);
-	}), Ln = v?.apiKeys, Rn = (typeof Ln == "object" ? Ln.prefix : void 0) ?? "voltro_", B = Ln ? yr(E) : void 0, V = B ? kr({ flush: Ar(B) }) : void 0;
-	V && qr(() => V.shutdown());
-	let zn = B ? Or(B, {
-		prefix: Rn,
-		...V ? { usage: V } : {}
-	}) : void 0, Bn = zn ? [Sr(zn, { prefix: Rn })] : [], Vn = St([...v?.auth?.strategies ?? [], ...Bn], Ai(v?.plugins ?? []), v?.auth?.anonymousTenantRequired ?? !1, v?.auth, () => Ve), Hn = [...v?.restRoutes ?? [], ...zn ? lr(zn, (typeof Ln == "object" ? Ln.managementPath : void 0) ?? "/v1/api-keys") : []], Un = Ct(v?.idempotency, E), Wn = j.map((e) => e.services).filter((e) => e !== void 0), Gn = G.mergeAll(_t({
-		analyticsLayer: ke.layer,
-		cacheService: Ue,
-		kvService: dt,
-		...Ze === void 0 ? {} : { semanticCache: Ze },
-		pluginServices: Wn,
-		userLayers: v?.layers ?? []
-	}), Le(v?.http ?? {})), H = await Re({
-		files: b,
-		store: E,
-		log: $,
-		seedPolicy: "report",
-		seedPattern: fn,
-		loadSeedFiles: I,
-		startupPattern: sn,
-		loadStartupFiles: a,
-		runStartups: o,
-		emailPattern: k,
-		loadEmailFiles: Tt,
-		registerEmailTemplates: ji
-	});
-	(H.startupCount > 0 || H.emailCount > 0) && $.info("boot lifecycle", {
-		startups: H.startupCount,
-		emailTemplates: H.emailCount
-	}), H.startups !== void 0 && qr(async () => {
-		await H.startups.stop();
-	}), de({
-		demands: Se(ue),
-		isRegistered: (e) => Cr(e) !== void 0
-	});
-	let U = wt({
-		schedules: at({
-			schedules: x.schedules,
-			seeds: H.seeds,
-			store: E,
-			log: $.child("seeds")
-		}),
-		workflows: x.workflows ?? [],
-		log: $.child("workflow-schedules")
-	}), Yn = v?.scheduling ?? {}, rr = Yn.trigger ?? "self", ir = /* @__PURE__ */ new Set([
-		"postgres",
-		"mysql",
-		"mariadb",
-		"mssql"
-	]), ar = Yn.coordination ?? (ir.has(y) ? "advisoryLock" : "single"), or = ar === "cluster" && ir.has(y), sr = or ? "cluster" : ar === "advisoryLock" && ir.has(y) ? "advisoryLock" : "single";
-	ar === "cluster" && !or && $.warn("scheduling.coordination=cluster needs a sql-backed store except sqlite — falling back to single"), ar === "advisoryLock" && !ir.has(y) && $.warn("scheduling.coordination=advisoryLock needs a SQL store (the claim-row gate) — falling back to single");
-	let cr, dr = x.workflows.length > 0 || x.workflowWorkers.length > 0 || x.eventTriggers.length > 0 || (be?.outgoing.length ?? 0) > 0 || or, fr;
-	if (dr) {
-		if (y === "mssql") {
-			let e = await hn(process.cwd());
-			e && $.warn(e);
-		}
-		let [{ WorkflowEngine: e }, { makeClusterCronLayer: t, workflowEngineLayer: n, resolveRunnerStorage: r, resolveFailoverTuning: i }] = await Promise.all([import("@effect/workflow"), import("@voltro/workflow/cluster")]), a = or ? U.filter((e) => (e.trigger ?? rr) === "self").map((e) => t({
-			name: e.name,
-			cron: vr(e),
-			execute: async () => {
-				await cr?.fireFromCluster(e.name);
-			}
-		})) : [];
-		fr = y === "memory" ? e.layerMemory : await (async () => {
-			let e = await F(y), t = r({ sqliteFamily: e.id === "sqlite" || e.id === "turso" });
-			return $.info(`workflow engine: cluster-${t}, dialect=${e.id}` + (t === "memory" ? " — single-process durable replay, no cross-pod shard handoff" + (e.id !== "sqlite" && e.id !== "turso" ? " (VOLTRO_WORKFLOW_RUNNER_STORAGE=memory: SqlRunnerStorage/cluster_runners + GET_LOCK skipped)" : "") : "")), n({
-				sqlClientLayer: e.makeSqlLayer(O()),
-				runnerStorage: t,
-				dialectId: e.id,
-				...process.env.VOLTRO_WORKFLOW_RUNNER_PORT ? { runnerListenPort: Number(process.env.VOLTRO_WORKFLOW_RUNNER_PORT) } : {},
-				...i(),
-				...a.length > 0 ? { extraShardingLayers: a } : {}
-			});
-		})();
-	}
-	let pr = bt(j, bn()), mr = b.filter((e) => /\.subscribe\.tsx?$/.test(e)), K = mr.length > 0 ? await c(mr, $) : [], hr = b.filter((e) => /\.reaction\.tsx?$/.test(e)), q = hr.length > 0 ? await he(hr, $) : [], gr = b.filter((e) => un.test(e)), _r = gr.length > 0 ? await Me(gr, $) : [], wr = b.filter((e) => /\.aggregate\.tsx?$/.test(e)), Tr = wr.length > 0 ? await _e(wr, $) : [];
-	{
-		let e = xr(si(Be({ aggregates: Tr.map((e) => e.definition) }), Lt(T)));
-		e !== void 0 && $.warn(e);
-	}
-	let Er = lt();
-	if (Tr.length > 0 && y !== "memory") try {
-		let e = (await F(y)).makeSqlLayer(O());
-		Er = u(e);
-	} catch (e) {
-		$.warn("aggregate: SQL storage init failed — falling back to in-process", { err: String(e) });
-	}
-	let Mr = y === "memory" ? ni : Dr(E, `aggregate@${process.pid}`, $), Pr = b.filter((e) => dn.test(e)), Fr = Pr.length > 0 ? await Ft(Pr, $) : [], Ir = b.filter((e) => ln.test(e)), Lr = Ir.length > 0 ? await m(Ir, $) : [], Rr = b.filter((e) => cn.test(e)), zr = Rr.length > 0 ? await w(Rr, $) : [], Br = [], Vr = [], Hr = b.filter((e) => nn.test(e));
-	if (Hr.length > 0) {
-		let e = $.child("agent"), t = b.filter((e) => en.test(e));
-		t.length > 0 && await on(t, e);
-		let n = await Qt(Hr, e);
-		for (let e of n.agents) for (let t of Ot(e)) (t.kind === "action" ? Br : Vr).push({
-			file: t.file,
-			descriptor: t.descriptor,
-			executor: t.executor
-		});
-		n.agents.length > 0 && e.info("synthesized agent routes", { agents: n.agents.map((e) => e.descriptor.name) });
-	}
-	d.mark("workflow");
-	let J = () => {
-		let e = Y.workflowWriteActions();
-		if (e === void 0) throw Error("workflow actions: this app registers no workflows");
-		return e;
-	}, Wr = qn({
-		dialect: y,
-		...O()
-	}), Gr = y === "memory" ? void 0 : (await F(y)).makeSqlLayer(O()), Kr = async () => gt({
-		sqlLayer: Gr,
-		declared: T,
-		log: $
-	}), Jr = {
-		kind: "api",
-		meta: {
-			name: v?.name ?? "voltro-api",
-			voltroVersion: Et,
-			port: ie,
-			mode: "start",
-			store: y,
-			cdc: se ? "on" : "off",
-			...Wr === void 0 ? {} : { databaseId: Wr }
-		},
-		rpc: Ie(x, g),
-		workflows: Nt(x, g),
-		migrations: Kr,
-		events: () => Y.eventsSnapshot(),
-		agentTools: () => Y.agentTools(),
-		invariantChecks: () => ({
-			mode: "serve",
-			accessGate: ue,
-			config: v,
-			serverOnlyLeaks: x.serverOnlyLeaks,
-			migrations: Kr
-		}),
-		members: () => Y.membersSnapshot(),
-		inspectFireSchedule: async ({ name: e, trigger: t }) => {
-			if (!cr) throw Error("scheduler not started — this app registers no self-triggered schedules (all schedules are trigger:'external', or there are none).");
-			return { runId: await cr.fireNow(e, t) ?? null };
-		},
-		inspectBackfillSchedule: _({
-			getHandle: () => cr,
-			getSchedules: () => U
-		}),
-		...be === void 0 ? {} : { webhooks: () => ge({
-			store: E,
-			discoveredWebhooks: be
-		}) },
-		plugins: () => ({
-			plugins: Nn.snapshot(),
-			capturedAt: Date.now()
-		}),
-		env: () => Gt(v?.name ?? En(g), {
-			...v?.env !== void 0 && bi(v.env) ? { contract: v.env } : {},
-			plugins: v?.plugins ?? []
-		}),
-		dataCache: () => ze({
-			stats: ot,
-			backendKind: it
-		}),
-		subscriptions: () => It(() => z),
-		inspectTables: () => S(x.tables),
-		inspectRows: C({
-			store: E,
-			tables: x.tables,
-			mask: !0
-		}),
-		metrics: (e) => Y.rpcMetrics().snapshot(e),
-		cluster: () => zt({
-			store: E,
-			dialect: y,
-			useClusterCron: or,
-			scheduleCoordChoice: ar
-		}),
-		inspectSchedules: () => Te({
-			schedules: U,
-			defaultTrigger: rr,
-			coordination: sr
-		}),
-		inspectScheduleRuns: (e) => N(E, e),
-		...f(E, {
-			controls: nt(x.workflows ?? []),
-			active: (x.workflows?.length ?? 0) > 0,
-			cancellation: () => Y.flowControlHealth()
-		}),
-		webhookActions: Ce(() => Y.webhooksService()),
-		inspectStartWorkflow: (e) => J().inspectStartWorkflow(e),
-		inspectCancelWorkflowRun: (e) => J().inspectCancelWorkflowRun(e),
-		inspectSuspendWorkflowRun: (e) => J().inspectSuspendWorkflowRun(e),
-		inspectResumeWorkflowRun: (e) => J().inspectResumeWorkflowRun(e),
-		inspectDiscardWorkflowRun: (e) => J().inspectDiscardWorkflowRun(e),
-		inspectRetryWorkflowRun: (e) => J().inspectRetryWorkflowRun(e),
-		inspectSignalWorkflowRun: (e) => J().inspectSignalWorkflowRun(e),
-		inspectUpdateWorkflowRun: (e) => J().inspectUpdateWorkflowRun(e),
-		inspectInferences: (e) => yt({
-			store: E,
-			active: (x.workflows?.length ?? 0) > 0,
-			dispatcher: () => Y.inferenceHealth()
-		}, e.limit === void 0 ? {} : { limit: e.limit }),
-		...mt({
-			store: E,
-			cancelRun: async (e) => await Y.runCanceller()?.(e) ?? !1,
-			retryRun: async (e) => J().inspectRetryWorkflowRun({ runId: e }),
-			redriveRun: async (e) => Y.redriveWorkflowRun({ runId: e }),
-			log: $
-		}),
-		inspectRedriveWorkflowRun: (e) => Y.redriveWorkflowRun(e),
-		inspectResumeWorkflowRunFromStep: (e) => Y.resumeWorkflowRunFromStep(e)
-	}, Yr = (process.env.VOLTRO_TENANT_ISOLATION ?? v?.tenancy?.isolation) === "namespace", Xr = Yr && y !== "memory" ? await (async () => {
-		let e = await F(y);
-		return At({
-			tables: T,
-			sqlLayer: e.makeSqlLayer(O()),
-			dialect: y,
-			options: { retryFilter: e.retryFilter },
-			log: {
-				info: (e, t) => $.info(e, t),
-				error: (e, t, n) => $.error(e, t ?? {}, n)
-			}
-		});
-	})() : void 0, Zr = await ft({
-		input: v?.tenancy?.residency,
-		namespaceIsolationOn: Yr,
-		makeStoreForUrl: (e, t) => rt(v, void 0, Kt(O(), t)),
-		log: {
-			info: (e, t) => $.info(e, t),
-			warn: (e, t) => $.warn(e, t)
-		}
-	});
-	Zr !== void 0 && qr(async () => {
-		await Zr.close();
-	});
-	let Y = await ga({
-		bootTiming: d,
-		broadcastNamespace: L,
-		scheduling: (() => {
-			let e = _n;
-			return {
-				admissionDrainMs: e.admissionDrainMs,
-				inferenceTickMs: e.inferenceTickMs,
-				cancelSweepMs: e.cancelSweepMs,
-				stalenessSweepMs: e.stalenessSweepMs,
-				disarmWhenIdle: D({
-					changeScope: E.changeScope,
-					broadcastAttached: In !== void 0
-				})
-			};
-		})(),
-		...v?.workflows?.staleness === void 0 ? {} : { workflowStaleness: v.workflows.staleness },
-		...v?.workflows?.suspendSignalHintMs === void 0 ? {} : { workflowSuspendSignalHintMs: v.workflows.suspendSignalHintMs },
-		workflowRecording: Vt(v?.workflows?.recording),
-		membership: {
-			...jn,
-			instanceId: Tn
-		},
-		security: {
-			defaultDeny: oe(v),
-			...re(v)
-		},
-		approvals: { defaultExpiryMs: je(v) },
-		...v?.plugins === void 0 ? {} : { plugins: v.plugins },
-		...Un ? { idempotency: Un } : {},
-		restRoutes: Hn,
-		appProcedures: ue,
-		discovered: {
-			queries: [...x.queries, ...Vr],
-			mutations: x.mutations,
-			actions: [...x.actions, ...Br],
-			streams: x.streams,
-			events: x.events,
-			workflows: x.workflows,
-			workflowWorkers: x.workflowWorkers,
-			eventTriggers: x.eventTriggers,
-			schedules: U,
-			subscribers: K,
-			outboxHandlers: _r,
-			connections: x.connections,
-			reactions: q,
-			aggregates: Tr,
-			expectations: Fr,
-			budgets: Lr,
-			experiments: zr,
-			...be === void 0 ? {} : { webhooks: be }
-		},
-		log: $,
-		analytics: ke.sink,
-		aggregateStorage: Er,
-		aggregateCoordinator: Mr,
-		store: E,
-		kv: ut,
-		cache: Je,
-		snapshotCache: Ke,
-		...v?.reactive === void 0 ? {} : { reactive: v.reactive },
-		schemaRegistry: Fe,
-		tenantScopedTables: x.tenantScopedTables,
-		softDeleteScopedTables: x.softDeleteScopedTables,
-		dataTransferSnapshot: $n(T, y),
-		dataTransferDialect: y,
-		...Xr === void 0 ? {} : { ensureTenantProvisioned: Xr.ensure },
-		...Zr === void 0 ? {} : { resolveResidentStore: Zr.resolveStore },
-		tenantIsolation: (process.env.VOLTRO_TENANT_ISOLATION ?? v?.tenancy?.isolation) === "namespace" ? "namespace" : "shared-schema",
-		resolveSubject: (e, t) => Vn({
-			headers: e,
-			clientId: t
-		}),
-		...v?.auth === void 0 ? {} : { authority: v.auth },
-		...v?.agents === void 0 ? {} : { agents: v.agents },
-		httpRoutes: j.flatMap((e) => e.httpRoutes ?? []),
-		getStore: () => Ve,
-		...Gn ? { baseLayer: Gn } : {},
-		...fr === void 0 ? {} : { workflowEngineLayer: fr },
-		scheduleDefaultTrigger: rr,
-		scheduleCoordination: sr,
-		scheduleArmSelf: !or,
-		dormancy: process.env.VOLTRO_DORMANCY === "sleep" || process.env.VOLTRO_DORMANCY === "always-on" ? process.env.VOLTRO_DORMANCY : v?.dormancy ?? "always-on",
-		scheduleReplicaId: process.env.HOSTNAME ?? `pid-${process.pid}`,
-		...pr === void 0 ? {} : { scheduleFireInterceptor: pr },
-		onSchedulerReady: (e) => {
-			cr = e;
-		},
-		inspectRoute: { handle: async (e, t, n, r) => await h(e, Jr, t, {
-			method: n,
-			...r === void 0 ? {} : { body: r }
-		}) || ((n === "GET" ? await mn(e, Jr, t, { method: n }) : null) ?? pn(e, Jr, t, {
-			method: n,
-			...r === void 0 ? {} : { body: r }
-		}) ?? {
-			status: 404,
-			contentType: "application/json",
-			body: JSON.stringify({ error: "not an inspect route" })
-		}) },
-		...v?.name === void 0 ? {} : { appName: v.name },
-		observability: Pn,
-		port: ie,
-		...v?.transport?.wsPath ? { path: v.transport.wsPath } : {}
-	});
-	return z = Y.dispatcher, te(Ee([
-		x.queries,
-		x.mutations,
-		x.actions,
-		x.streams
-	]), (e) => {
-		$.warn(e);
-	}), $.info(`API listening on :${ie}`, {
-		dialect: y,
-		queries: x.queries.length,
-		mutations: x.mutations.length,
-		actions: x.actions.length,
-		streams: x.streams.length,
-		workflows: x.workflows.length,
-		workflowWorkers: x.workflowWorkers.length,
-		schedules: U.length,
-		scheduleCoordination: sr
-	}), d.finish($), qr(async () => {
-		for (let e of wn) e.stop();
-		xt.stop();
-		try {
-			await Y.close(), st(), Rt?.dispose(), await Nn.deactivate(), await In?.close(), await Dt({
-				mirror: ht,
-				log: $
-			}), await ke.dispose(), await E.close?.();
-		} catch (e) {
-			console.error("serve: shutdown step failed, exiting anyway:", e);
-		}
-	}), await new Promise(() => {}), 0;
-};
-//#endregion
-export { ya as n, _a as r, ba as t };