@voltro/cli 0.48.0 → 0.49.0

package/dist/serveCommand-N3udT49p.js

@@ -0,0 +1,2362 @@
+import { t as e } from "./nodeEnvironment-cGFAj1J8.js";
+import { t } from "./frameworkInspectState-CX2250XB.js";
+import { r as n, t as r } from "./appModuleLoader-C9r9mxZt.js";
+import { t as i } from "./bootRefusal-pgvDxlrU.js";
+import { n as a, r as o } from "./startupRunner-CEqQq7ax.js";
+import { t as s } from "./interruptedReplace-C1ZI84xi.js";
+import { $ as c, $t as l, A as u, At as d, Bt as f, C as ee, Cn as te, Ct as ne, D as p, Dt as m, E as h, En as re, Et as g, F as ie, Ft as ae, G as oe, Gt as se, H as _, Ht as ce, I as le, It as ue, J as de, Jt as v, K as y, Kt as fe, L as b, Lt as pe, M as me, Mt as he, N as ge, Nt as _e, O as ve, Ot as ye, P as be, Pt as xe, Q as Se, Qt as Ce, R as x, Rt as we, S as Te, St as Ee, T as De, Tn as Oe, Tt as S, U as ke, V as Ae, W as je, Wt as Me, X as Ne, Xt as Pe, Y as Fe, Yt as C, Z as Ie, Zt as Le, _ as w, _n as Re, _t as T, an as ze, at as Be, b as Ve, bn as He, bt as Ue, c as We, cn as Ge, ct as Ke, dn as qe, dt as Je, en as Ye, et as Xe, f as Ze, fn as Qe, ft as $e, g as et, gt as tt, h as nt, hn as rt, ht as it, i as at, in as ot, it as st, j as ct, jt as lt, k as ut, kt as dt, ln as ft, lt as pt, m as mt, mn as ht, mt as gt, nn as _t, nt as E, o as D, on as vt, ot as O, p as k, pn as yt, pt as bt, q as xt, qt as St, r as Ct, rn as A, rt as wt, sn as j, st as Tt, t as Et, tn as Dt, tt as Ot, u as kt, un as At, ut as jt, v as Mt, vn as Nt, vt as M, w as N, wn as Pt, wt as Ft, x as It, xn as Lt, xt as Rt, y as zt, yn as Bt, yt as Vt, zt as Ht } from "./dev-C31Nvlbv.js";
+import { n as Ut } from "./cliArgs-D4p8n7EE.js";
+import { r as P } from "./appPort-B_HpJ_ck.js";
+import { ht as Wt, pt as Gt } from "./webDev-B4IEMB0n.js";
+import { r as F } from "./dialectDriver-czCHYpeH.js";
+import { i as Kt, n as qt } from "./connectionConfig-Bk9IC7D0.js";
+import { c as Jt, n as I, o as Yt } from "./seedRunner-Dgsiwk_e.js";
+import { b as Xt, d as Zt, h as Qt, m as $t, p as en, r as tn, y as nn } from "./frameworkTableAssembly-BwJVEKLr.js";
+import { n as rn, r as an, t as on } from "./declaredSchemaGates-BlcwObhb.js";
+import { S as sn, c as cn, n as ln, p as un, s as dn, x as fn } from "./fileConventions-Cof68_BL.js";
+import { h as pn, o as mn } from "./inspect-B7U7Cl_Z.js";
+import { n as hn } from "./mssqlClusterPatch-_4cE_nun.js";
+import { i as gn, n as _n, r as vn, t as yn } from "./webhookDiscovery-CphsQe59.js";
+import { t as bn } from "./inspectMetrics-CfdKLh6t.js";
+import { r as xn, u as Sn } from "./apiBuild-QmYHaCF4.js";
+import { t as Cn } from "./bootTiming-BdyP9nYw.js";
+import { a as wn, o as Tn, t as En } from "./dataProfile-Du3ztYxv.js";
+import L, { basename as Dn, join as On } from "node:path";
+import { createWriteStream as kn, existsSync as An } from "node:fs";
+import { pathToFileURL as jn } from "node:url";
+import { createLogger as R } from "@voltro/logger";
+import { AuthMiddleware as Mn, ConnectionInfoMiddleware as Nn, actionToRpc as Pn, anonymousSubject as Fn, isWireReachable as In, mutationToRpc as Ln, queryToRpc as z, streamToRpc as Rn, wireErrorUnion as zn, workflowCancelDescriptor as Bn, workflowDomainEventsQueryDescriptor as B, workflowEventDeliveriesQueryDescriptor as Vn, workflowResumeDescriptor as Hn, workflowRunEventsQueryDescriptor as Un, workflowRunQueryDescriptor as Wn, workflowRunStepsQueryDescriptor as Gn, workflowRunsQueryDescriptor as Kn, workflowSignalDescriptor as V, workflowUpdateDescriptor as H } from "@voltro/protocol";
+import { DATA_TRANSFERS_TABLE as U, _voltroDataTransfersTable as qn, allRegisteredTables as Jn, and as Yn, connectionIdentity as Xn, derivedRowId as Zn, describeTransferRun as Qn, ensureTableRegistered as $n, eq as W, or as er } from "@voltro/database";
+import { Cause as tr, Effect as G, Layer as K, ManagedRuntime as nr } from "effect";
+import { SqlClient as rr } from "@effect/sql";
+import { declaredSnapshot as ir, describeOutcome as ar, pendingFileMigrationIds as or, runPlannedMigrations as sr } from "@voltro/database/sql";
+import { AggregateRegistry as cr, CostRegistry as lr, DORMANCY_WAKEUP_TENANT as ur, Dispatcher as dr, ExpectationRegistry as fr, ExperimentRegistry as pr, apiKeyManagementRoutes as mr, attachAnalyticsMirror as hr, attachExpectations as gr, attachExperiments as _r, attachFinops as vr, awaitServerListening as yr, bindMutation as q, bindStream as br, bindSubscription as xr, buildTracingLayer as Sr, cancelWakeup as Cr, compileCron as wr, dataStoreApiKeyStore as Tr, formatServerOnlyLeaks as Er, formatUnresolvedSources as Dr, frameworkApiKeyStrategy as Or, getResourcePolicy as kr, installPolicyGuardResolver as Ar, loadResourceTuples as jr, makeActionRunner as Mr, makeAdvisoryLockCoordinator as Nr, makeApiKeyService as Pr, makeApiKeyUsageBuffer as Fr, makeApiKeyUsageFlusher as Ir, makeAsyncKv as Lr, makeAuthMiddlewareLayers as Rr, makeCoordinatedScheduler as zr, makeEffectStoreLayer as Br, makeLazyWorkflowFacade as Vr, makeMutationOutputCodec as Hr, makeMutationRunner as J, makeOneShotQueryRunner as Ur, makeQueryDescriptorProducer as Wr, makeQueryFinalizer as Gr, makeQueryReauthorizer as Kr, makeQuerySubscriber as qr, makeSchemaRegistry as Jr, makeWorkflowFacade as Yr, makeWorkflowFacadeWithCallerContext as Xr, makeWorkflowLayers as Y, noopKv as Zr, onProcessShutdown as Qr, recordSubscriptionDelivery as $r, recordWorkflowRun as ei, registerDefaultTupleSource as ti, registerWakeup as ni, resolveSecretsBackend as ri, runProvidedEffect as ii, setSecretsBackend as ai, setSystemStoreHandle as oi, shutdownGraceMsFromEnv as si, singleCoordinator as ci, startRpcServer as li, startScheduler as ui, stripForbiddenForWire as di, undoCaptureEnabled as fi, unresolvedSources as pi, withScopedRequest as mi, workflowToRpc as hi, wrapStoreWithBootCodec as gi } from "@voltro/runtime";
+import _i, { tmpdir as vi } from "node:os";
+import { RpcGroup as yi } from "@effect/rpc";
+import { appStorageProvider as bi, durabilityNotice as xi, fromNodeReadable as Si, getObjectStream as Ci, putObjectStream as wi, toNodeReadable as Ti } from "@voltro/plugin-storage";
+import { isEnvContract as Ei } from "@voltro/env";
+import { assertProductionSessionSecret as Di } from "@voltro/protocol/session";
+import X from "node:fs/promises";
+import { createHash as Oi, timingSafeEqual as ki } from "node:crypto";
+import { buildDeliverWebhookExecute as Ai, buildWebhooksService as ji, defaultIncomingPath as Mi, deliverWebhookWorkflow as Ni, makeDeferredEmitHandler as Pi, mountIncomingWebhook as Fi } from "@voltro/plugin-webhooks";
+import { getAuthSessionStrategy as Ii } from "@voltro/plugin-auth";
+import { registerEmailTemplates as Li } from "@voltro/plugin-mail";
+import { channelFor as Ri, getBroadcastPlugin as zi } from "@voltro/plugin-broadcast";
+import { checkSchemaDrift as Bi, decideStaging as Vi, isEnvironmentLocal as Hi, packBundle as Ui, peekBundle as Wi, runExport as Gi, runImport as Ki, storageBlobSink as qi, storageRefsBlobSource as Ji, unpackBundle as Yi, unpackBundleToDir as Xi } from "@voltro/data-transfer";
+//#region \0rolldown/runtime.js
+var Zi = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy < "u" ? new Proxy(e, { get: (e, t) => (typeof require < "u" ? require : e)[t] }) : e)(function(e) {
+	if (typeof require < "u") return require.apply(this, arguments);
+	throw Error("Calling `require` for \"" + e + "\" in an environment that doesn't expose the `require` function. See https://rolldown.rs/in-depth/bundling-cjs#require-external-modules for more details.");
+}), Qi = () => Math.max(500, Math.floor(si() * .6)), $i = (e) => new Promise((t) => setTimeout(t, e)), ea = (e) => {
+	let t = /* @__PURE__ */ new Set(), n = /* @__PURE__ */ new Set(), r = 0;
+	e.on("connection", (e) => {
+		t.add(e), e.once("close", () => {
+			t.delete(e), n.delete(e);
+		});
+	}), e.on("upgrade", (e, t) => {
+		n.add(t);
+	}), e.on("request", (e, t) => {
+		r += 1, t.once("close", () => {
+			--r;
+		});
+	});
+	let i, a = async (t = {}) => {
+		let n = t.budgetMs ?? Qi();
+		i ??= new Promise((t) => {
+			e.close(() => {
+				t();
+			});
+		}), e.closeIdleConnections();
+		let a = Date.now() + n;
+		for (; r > 0 && Date.now() < a;) await $i(25), e.closeIdleConnections();
+		e.closeIdleConnections();
+	}, o = async () => {
+		i ??= new Promise((t) => {
+			e.close(() => {
+				t();
+			});
+		});
+		for (let e of t) if (n.has(e)) try {
+			e.write(Buffer.from([
+				136,
+				2,
+				3,
+				233
+			]));
+		} catch {}
+		else e.destroy();
+		for (let e = 0; t.size > 0 && e < 250; e += 25) await $i(25);
+		for (let e of t) e.destroy();
+		await i;
+	};
+	return {
+		activeRequests: () => r,
+		drainRequests: a,
+		finish: o,
+		drain: async (e = {}) => {
+			await a(e), await o();
+		}
+	};
+}, ta = "/_voltro/admin/import", na = "/_voltro/admin/import/start", ra = "/_voltro/admin/export", ia = "/_voltro/admin/export/download", aa = "/_voltro/admin/imports", Z = (e, t) => ({
+	status: e,
+	contentType: "application/json; charset=utf-8",
+	body: JSON.stringify(t)
+}), oa = (e) => {
+	let t = e.authorization ?? e.Authorization, n = t ? /^Bearer\s+(.+)$/i.exec(t) : null;
+	return n ? n[1] : null;
+}, sa = (e, t) => ki(Oi("sha256").update(e).digest(), Oi("sha256").update(t).digest()), ca = (e, t, n = "POST") => {
+	if (e.method.toUpperCase() !== n) return Z(405, { error: "method not allowed" });
+	if (!t || t.length < 16) return Z(503, { error: "data transfer misconfigured (no/weak secret)" });
+	let r = oa(e.headers);
+	return !r || !sa(r, t) ? Z(401, { error: "unauthorized" }) : null;
+}, la = /^[A-Za-z0-9_-]{8,64}$/, ua = (e) => la.test(e), da = () => process.env.VOLTRO_IMPORT_UPLOAD_DIR ?? L.join(_i.tmpdir(), "voltro-import-uploads"), fa = (e) => L.join(da(), e), pa = (e) => L.join(fa(e), "archive.bin"), ma = (e) => L.join(fa(e), "meta.json"), ha = async (e = Date.now()) => {
+	let t = 0;
+	try {
+		for (let n of await X.readdir(da())) {
+			if (n === ".runs") continue;
+			let r = await X.stat(fa(n)).catch(() => null);
+			r !== null && (e - r.mtimeMs <= 864e5 || (await X.rm(fa(n), {
+				recursive: !0,
+				force: !0
+			}).catch(() => void 0), t++));
+		}
+	} catch {}
+	return t;
+}, ga = async (e) => {
+	if (!ua(e)) return {
+		bytes: 0,
+		key: null,
+		runId: null
+	};
+	let t = await X.stat(pa(e)).catch(() => null);
+	if (t === null) return {
+		bytes: 0,
+		key: null,
+		runId: null
+	};
+	let n = await _a(e);
+	return {
+		bytes: t.size,
+		key: n.key ?? null,
+		runId: n.runId ?? null
+	};
+}, _a = async (e) => {
+	try {
+		let t = await X.readFile(ma(e), "utf8");
+		return JSON.parse(t);
+	} catch {
+		return {};
+	}
+}, va = async (e, t) => {
+	let n = ma(e), r = `${n}.${process.pid}.${Math.random().toString(36).slice(2, 8)}.tmp`;
+	await X.writeFile(r, JSON.stringify(t)), await X.rename(r, n);
+}, ya = async (e, t, n) => {
+	if (!ua(e)) return t;
+	await X.mkdir(fa(e), { recursive: !0 });
+	let r = await _a(e), i = typeof r.runId == "string" && r.runId.length > 0 ? r.runId : null;
+	return i !== null && n?.takeOver !== !0 ? i : (await va(e, {
+		...r,
+		runId: t
+	}), t);
+}, ba = async (e) => {
+	if (!ua(e)) return;
+	let t = await _a(e);
+	if (t.runId === void 0) return;
+	let { runId: n, ...r } = t;
+	await va(e, r).catch(() => void 0);
+}, xa = async (e, t, n) => (await X.mkdir(fa(e), { recursive: !0 }), await X.writeFile(pa(e), Buffer.from(t)), await va(e, {
+	...await _a(e),
+	key: n,
+	startedAt: (/* @__PURE__ */ new Date()).toISOString()
+}), t.byteLength), Sa = (e) => `up-${Oi("sha256").update(e).digest("hex").slice(0, 32)}`, Ca = async (e) => {
+	if (!ua(e.id)) return {
+		reason: "bad-id",
+		message: `upload id must match ${String(la)}`
+	};
+	let t = await ga(e.id);
+	if (t.key !== null && t.key !== e.key) return {
+		reason: "key-mismatch",
+		message: "this upload id already holds a different bundle. Use a new upload id, or delete the partial upload."
+	};
+	if (e.offset !== t.bytes) return {
+		reason: "offset-mismatch",
+		message: `chunk starts at ${e.offset} but the server holds ${t.bytes} byte(s)`,
+		expectedOffset: t.bytes
+	};
+	if (await X.mkdir(fa(e.id), { recursive: !0 }), t.key === null) {
+		let t = await _a(e.id);
+		await va(e.id, {
+			...t,
+			key: e.key,
+			startedAt: (/* @__PURE__ */ new Date()).toISOString()
+		});
+	}
+	return await new Promise((t, n) => {
+		let r = kn(pa(e.id), { flags: "a" });
+		r.on("error", n), r.on("finish", () => t()), r.end(Buffer.from(e.bytes));
+	}), { total: t.bytes + e.bytes.byteLength };
+}, wa = async (e) => {
+	let t = await X.stat(pa(e));
+	return {
+		path: pa(e),
+		bytes: t.size
+	};
+}, Ta = () => L.join(da(), ".runs"), Ea = (e) => L.join(Ta(), `${e}.bin`), Da = async (e, t) => {
+	if (!ua(e)) return null;
+	let n = pa(e), r = await X.stat(n).catch(() => null);
+	if (r === null || r.size === 0) return null;
+	await X.mkdir(Ta(), { recursive: !0 });
+	let i = Ea(t);
+	return await X.rename(n, i), i;
+}, Oa = async (e) => {
+	await X.rm(Ea(e), { force: !0 }).catch(() => void 0);
+}, Q = R({ scope: "voltro:admin-import" }), ka = "VBUNDLE2", Aa = (e) => {
+	let t = e.req.headers["x-import-rollback-key"];
+	if (e.mode !== "replace") return { options: {} };
+	if (typeof t != "string" || t.length === 0) return Q.warn("admin.import: no rollback capture — this run empties the target first, and nothing was asked to be kept. Send `x-import-rollback-key: <storage key>` (voltro data import --rollback-key <key>) to have the instance store the target's current rows before deleting them."), { options: {} };
+	if (e.deps.putArchive === void 0) return {
+		options: {},
+		refusal: Z(409, {
+			error: "rollback capture requested but this instance has no object storage configured",
+			hint: "A capture written to the pod would not survive the failure it exists for. Configure storage (the same one the storage-push export uses), or re-send without `x-import-rollback-key` to accept that a run which does not finish can leave the target emptied. Note that CONFIGURED is not the same question as SURVIVES: a `filesystem` provider pointed at a container directory with no volume behind it passes this check and dies with the pod. The run says so when it can observe it — the capture path being on the same filesystem as `/`."
+		})
+	};
+	let n = On(vi(), `voltro-rollback-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`), r = e.deps.putArchive;
+	return {
+		key: t,
+		options: {
+			rollbackDir: n,
+			onRollbackCaptured: async () => {
+				let e = xi(n);
+				e !== void 0 && Q.warn(`admin.import: ${e}`), await r(t, () => Ui({ dir: n })), Q.info("admin.import: rollback capture stored", { bundleKey: t });
+			}
+		}
+	};
+}, ja = (e) => {
+	let t = e["x-import-mode"], n = e["x-import-atomic"];
+	return {
+		mode: t,
+		onConflict: e["x-import-on-conflict"],
+		atomic: n === "0" || n === "false" ? !1 : n === "1" || n === "true" || t === "replace",
+		force: e["x-import-force"] === "1" || e["x-import-force"] === "true",
+		dryRun: e["x-import-dry-run"] === "1" || e["x-import-dry-run"] === "true",
+		tables: (e["x-import-tables"] ?? "").split(",").map((e) => e.trim()).filter(Boolean)
+	};
+}, Ma = async (e, t) => {
+	if (typeof t.bundleKey == "string" && t.bundleKey !== "") {
+		if (!e.openArchive) return { refusal: Z(501, { error: "storage transport not configured on this instance" }) };
+		let n = e.openArchive, r = t.bundleKey;
+		return {
+			source: () => n(r),
+			transport: "storage",
+			uploadId: Sa(r)
+		};
+	}
+	let n = t.uploadId;
+	if (typeof n != "string" || !ua(n)) return { refusal: Z(400, { error: "start needs { uploadId } from an upload, or { bundleKey } for the storage transport" }) };
+	let r = await wa(n).catch(() => null);
+	return r === null || r.bytes === 0 ? { refusal: Z(409, {
+		error: "no such upload",
+		message: `this instance holds no bytes for upload '${n}'. Upload the bundle first, or re-upload if it has expired.`
+	}) } : {
+		source: () => Na(r.path),
+		transport: "upload",
+		uploadId: n
+	};
+}, Na = (e) => {
+	let { createReadStream: t } = Zi("node:fs");
+	return t(e);
+}, Pa = (e) => async (t) => {
+	let n = ca(t, e.secret);
+	if (n) return n;
+	let r = ja(t.headers), i = Aa({
+		req: t,
+		mode: r.mode,
+		deps: e
+	});
+	if (i.refusal !== void 0) return i.refusal;
+	if (t.headers["x-import-preflight"] === "1" || t.headers["x-import-preflight"] === "true") {
+		let n;
+		try {
+			n = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
+		} catch {
+			return Z(400, { error: "a preflight body must be JSON: { tables: string[] } or { bundleKey: string }" });
+		}
+		let a = Array.isArray(n.tables) ? n.tables.filter((e) => typeof e == "string") : [];
+		if (a.length === 0 && typeof n.bundleKey == "string" && n.bundleKey !== "" && e.openArchive && (a = [...await Fa(e.openArchive(n.bundleKey))]), a.length === 0) return Z(400, {
+			error: "a preflight needs { tables: string[] } — the bundle's table names, so the staging decision can be made against them",
+			hint: "or { bundleKey } on an instance with storage configured, where this endpoint reads the table list out of the archive itself"
+		});
+		let o = Vi({
+			mode: r.mode ?? "upsert",
+			...e.dialect === void 0 ? {} : { targetDialect: e.dialect },
+			...e.snapshot === void 0 ? {} : { targetSnapshot: e.snapshot },
+			bundleTables: a,
+			isSkipped: Hi,
+			canRunSql: !0
+		});
+		return Z(200, {
+			preflight: !0,
+			mode: r.mode ?? "upsert",
+			atomic: r.atomic,
+			staged: o.active,
+			...o.blocker === void 0 ? {} : { reason: o.blocker },
+			stagedTables: o.tables.length,
+			rollback: i.key === void 0 ? { taken: !1 } : {
+				taken: !0,
+				key: i.key
+			},
+			dialect: e.dialect ?? null
+		});
+	}
+	let a = t.headers["x-import-upload-id"];
+	if (a !== void 0 && a !== "") {
+		if (ha(), t.headers["x-import-probe"] === "1") {
+			let e = await ga(a);
+			return Z(200, {
+				uploadId: a,
+				bytes: e.bytes,
+				...e.runId === null ? {} : { runId: e.runId }
+			});
+		}
+		let e = t.headers["x-import-upload-key"] ?? "", n = Number(t.headers["x-import-chunk-offset"] ?? "0");
+		if (e === "" || !Number.isFinite(n) || n < 0) return Z(400, { error: "a chunked upload needs x-import-upload-key and a numeric x-import-chunk-offset" });
+		let r = await Ca({
+			id: a,
+			key: e,
+			offset: n,
+			bytes: t.rawBody
+		});
+		if ("reason" in r) return Q.warn("admin.import chunk refused", {
+			uploadId: a,
+			reason: r.reason
+		}), Z(409, {
+			error: "chunk refused",
+			reason: r.reason,
+			message: r.message,
+			...r.expectedOffset === void 0 ? {} : { expectedOffset: r.expectedOffset }
+		});
+		let i = t.headers["x-import-chunk-final"] === "1";
+		return Z(202, {
+			uploadId: a,
+			bytes: r.total,
+			complete: i
+		});
+	}
+	if (t.rawBody.byteLength >= 8 && Buffer.from(t.rawBody.subarray(0, 8)).toString("latin1") === ka) {
+		ha();
+		let e = Oi("sha256").update(Buffer.from(t.rawBody)).digest("hex"), n = Sa(e);
+		return Z(202, {
+			uploadId: n,
+			bytes: await xa(n, t.rawBody, e),
+			complete: !0
+		});
+	}
+	let o;
+	try {
+		o = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
+	} catch {
+		return Z(400, { error: "body must be a packed bundle archive or { bundleKey } JSON" });
+	}
+	return typeof o.bundleKey != "string" || !o.bundleKey ? Z(400, { error: "body.bundleKey (string) is required for the storage transport" }) : e.openArchive ? Z(202, {
+		uploadId: Sa(o.bundleKey),
+		bundleKey: o.bundleKey,
+		complete: !0
+	}) : Z(501, { error: "storage transport not configured on this instance" });
+}, Fa = async (e) => {
+	let t = await Wi(e, ["manifest.json"]).then((e) => e.get("manifest.json"), () => void 0);
+	if (t === void 0) return [];
+	try {
+		return (JSON.parse(Buffer.from(t).toString("utf8")).tables ?? []).map((e) => e.name).filter((e) => typeof e == "string");
+	} catch {
+		return [];
+	}
+}, Ia = (e) => async (t) => {
+	let n = ca(t, e.secret);
+	if (n) return n;
+	let r = ja(t.headers), i = Aa({
+		req: t,
+		mode: r.mode,
+		deps: e
+	});
+	if (i.refusal !== void 0) return i.refusal;
+	let a;
+	try {
+		a = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
+	} catch {
+		return Z(400, { error: "body must be JSON: { uploadId } or { bundleKey }" });
+	}
+	let o = typeof a.bundleKey == "string" && a.bundleKey !== "" ? Sa(a.bundleKey) : typeof a.uploadId == "string" ? a.uploadId : "";
+	if (!ua(o)) return Z(400, { error: "start needs { uploadId } from an upload, or { bundleKey } for the storage transport" });
+	let s = Zn("dimp", `${o}-${Date.now()}-${Math.random()}`), c = await ya(o, s);
+	if (c !== s) {
+		let t = await wn(e.store, c);
+		if (Tn(t) === void 0 && t !== null) return Q.info("admin.import start: already running", {
+			uploadId: o,
+			runId: c
+		}), Z(202, {
+			runId: c,
+			uploadId: o,
+			alreadyStarted: !0
+		});
+		Q.info("admin.import start: taking over a claim whose run is not running", {
+			uploadId: o,
+			staleRunId: c,
+			outcome: Tn(t) ?? "no record"
+		}), c = await ya(o, s, { takeOver: !0 });
+	}
+	let l = async (e) => (await ba(o).catch(() => void 0), e), u = await Ma(e, {
+		...typeof a.uploadId == "string" ? { uploadId: a.uploadId } : {},
+		...typeof a.bundleKey == "string" ? { bundleKey: a.bundleKey } : {}
+	});
+	if ("refusal" in u) return l(u.refusal);
+	if (e.snapshot !== void 0 && !r.force) {
+		let t = await La(u.source());
+		if (t !== null) {
+			let n = Bi(t.source?.schemaFingerprint ?? "", e.snapshot, Ra(t));
+			if (n.drifted) return Q.warn("admin.import refused (schema drift)", {
+				transport: u.transport,
+				bundle: n.bundleFingerprint.slice(0, 16),
+				target: n.targetFingerprint.slice(0, 16)
+			}), l(Z(409, {
+				error: "schema drift",
+				bundleFingerprint: n.bundleFingerprint,
+				targetFingerprint: n.targetFingerprint,
+				diff: n.diff,
+				hint: "each line above would break the load: a table or column the bundle carries that the target cannot take, or a column the target requires that the bundle has no value for. Fix the target schema, re-export against it, or resend with x-import-force: 1 to write anyway."
+			}));
+		}
+	}
+	let d = null;
+	if (u.transport === "upload" && (d = await Da(u.uploadId, c), d === null)) return l(Z(409, {
+		error: "no such upload",
+		message: `the bytes for upload '${u.uploadId}' are gone. Re-upload the bundle.`
+	}));
+	let f = await za(e.store, {
+		runId: c,
+		mode: r.mode ?? "upsert",
+		via: "api",
+		bundle: u.transport === "storage" ? String(a.bundleKey) : u.uploadId
+	});
+	return Ba({
+		deps: e,
+		opts: r,
+		rollback: i,
+		runId: c,
+		traced: f,
+		resolved: d === null ? u : {
+			...u,
+			source: () => Na(d)
+		}
+	}), Q.info("admin.import started", {
+		runId: c,
+		uploadId: u.uploadId,
+		transport: u.transport,
+		mode: r.mode ?? "upsert",
+		atomic: r.atomic,
+		dryRun: r.dryRun
+	}), Z(202, {
+		runId: c,
+		uploadId: u.uploadId,
+		transport: u.transport,
+		mode: r.mode ?? "upsert",
+		atomic: r.atomic,
+		...r.dryRun ? { dryRun: !0 } : {},
+		recorded: f,
+		outcome: "poll /_voltro/admin/imports for this runId — a 202 means started, not finished"
+	});
+}, La = async (e) => {
+	let t = await Wi(e, ["manifest.json"]).then((e) => e.get("manifest.json"), () => null);
+	if (t == null) return null;
+	try {
+		return JSON.parse(Buffer.from(t).toString("utf8"));
+	} catch {
+		return null;
+	}
+}, Ra = (e) => ({ tables: (e.tables ?? []).map((e) => ({
+	name: e.name,
+	indexes: [],
+	columns: Object.entries(e.columnTypes ?? {}).map(([e, t]) => ({
+		name: e,
+		type: t,
+		nullable: !0,
+		unique: !1,
+		hasDefault: !1
+	}))
+})) }), za = async (e, t) => {
+	try {
+		return $n(qn), await e.insert(U, {
+			id: t.runId,
+			direction: "import",
+			startedAt: /* @__PURE__ */ new Date(),
+			finishedAt: null,
+			failure: null,
+			mode: t.mode,
+			via: t.via,
+			bundle: t.bundle,
+			sourceFingerprint: null,
+			tablesWritten: 0,
+			rowsWritten: 0,
+			staged: null
+		}), !0;
+	} catch (e) {
+		return Q.warn("admin.import: the run could not be recorded", {
+			runId: t.runId,
+			error: e?.message ?? String(e)
+		}), !1;
+	}
+}, Ba = async (e) => {
+	let { deps: t, opts: n, rollback: r, resolved: i, runId: a } = e, o = await import("node:os"), s = await import("node:fs/promises"), c = await import("node:path"), l = await s.mkdtemp(c.join(o.tmpdir(), "voltro-admin-import-")), u = async (n) => {
+		Q.warn("admin.import failed", {
+			runId: a,
+			transport: i.transport,
+			error: n
+		}), e.traced && await t.store.update(U, a, {
+			failure: n,
+			finishedAt: null
+		}).then(() => void 0, () => void 0);
+	};
+	try {
+		t.assetSink ? await Yi(i.source(), {
+			dir: l,
+			blobs: t.assetSink
+		}) : await Xi(i.source(), l);
+		let o = await G.runPromiseExit(Ki({
+			store: t.store,
+			bundleDir: l,
+			...n.mode ? { mode: n.mode } : {},
+			...n.onConflict ? { onConflict: n.onConflict } : {},
+			atomic: n.atomic,
+			...r.options,
+			recordInterruption: !0,
+			via: "api",
+			...e.traced ? { traceId: a } : {},
+			...n.dryRun ? { dryRun: n.dryRun } : {},
+			...n.tables.length > 0 ? { tables: [...n.tables] } : {},
+			...t.snapshot ? { targetSnapshot: t.snapshot } : {},
+			...t.dialect ? { targetDialect: t.dialect } : {},
+			force: n.force,
+			onWarn: (e) => Q.warn("admin.import", {
+				runId: a,
+				message: e
+			}),
+			...t.assetSink ? { assetsAlreadyRestored: !0 } : {}
+		}));
+		if (o._tag === "Failure") {
+			let e = o.cause._tag === "Fail" ? o.cause.error : void 0, t = typeof e?.reason == "string" ? e.reason : void 0, n = e?.diff;
+			await u(t ?? (Array.isArray(n) ? `schema drift: ${n.join("; ")}` : void 0) ?? String(e?.message ?? e ?? "import failed"));
+			return;
+		}
+		let s = o.value;
+		Q.info(n.dryRun ? "admin.import (dry run — nothing written)" : "admin.import complete", {
+			runId: a,
+			transport: i.transport,
+			tables: s.tablesWritten,
+			rows: s.rowsWritten,
+			mode: n.mode ?? "upsert",
+			atomic: n.atomic,
+			...s.tablesSkipped > 0 ? {
+				skippedTables: s.tablesSkipped,
+				skippedRows: s.rowsSkipped
+			} : {}
+		}), n.dryRun || t.refreshSubscriptions?.(`data import: ${s.tablesWritten} table(s), mode ${n.mode ?? "upsert"}`);
+	} catch (e) {
+		await u(e?.message ?? String(e));
+	} finally {
+		await s.rm(l, {
+			recursive: !0,
+			force: !0
+		}).catch(() => void 0), await Oa(a).catch(() => void 0), await ba(i.uploadId).catch(() => void 0);
+	}
+}, Va = /^[A-Za-z0-9_-]{8,64}$/, Ha = (e) => Va.test(e), Ua = () => process.env.VOLTRO_EXPORT_ARTIFACT_DIR ?? L.join(_i.tmpdir(), "voltro-export-artifacts"), Wa = (e) => L.join(Ua(), e), Ga = (e) => L.join(Wa(e), "archive.bin"), Ka = async (e = Date.now()) => {
+	let t = 0;
+	try {
+		for (let n of await X.readdir(Ua())) {
+			let r = await X.stat(Wa(n)).catch(() => null);
+			r !== null && (e - r.mtimeMs <= 864e5 || (await X.rm(Wa(n), {
+				recursive: !0,
+				force: !0
+			}).catch(() => void 0), t++));
+		}
+	} catch {}
+	return t;
+}, qa = async (e, t) => {
+	if (!Ha(e)) throw Error(`invalid run id: ${e}`);
+	await X.mkdir(Wa(e), { recursive: !0 });
+	let { createWriteStream: n } = await import("node:fs"), r = n(Ga(e)), i = 0;
+	try {
+		for await (let e of t) i += e.byteLength, r.write(Buffer.from(e)) || await new Promise((e, t) => {
+			r.once("drain", e), r.once("error", t);
+		});
+	} finally {
+		await new Promise((e, t) => {
+			r.end(() => e()), r.once("error", t);
+		});
+	}
+	return i;
+}, Ja = async (e) => {
+	if (!Ha(e)) return null;
+	let t = await X.stat(Ga(e)).catch(() => null);
+	return t === null ? null : t.size;
+}, Ya = async (e, t, n) => {
+	let r = await Ja(e);
+	if (r === null) return null;
+	if (t >= r) return {
+		bytes: Buffer.alloc(0),
+		total: r
+	};
+	let i = await X.open(Ga(e), "r");
+	try {
+		let e = Math.max(0, Math.min(n, r - t)), a = Buffer.alloc(e);
+		return await i.read(a, 0, e, t), {
+			bytes: a,
+			total: r
+		};
+	} finally {
+		await i.close();
+	}
+}, Xa = async (e) => {
+	Ha(e) && await X.rm(Wa(e), {
+		recursive: !0,
+		force: !0
+	}).catch(() => void 0);
+}, Za = R({ scope: "voltro:admin-export" }), Qa = (e) => Array.isArray(e) ? e.filter((e) => typeof e == "string") : [], $a = (e) => {
+	if (typeof e.tenant == "string" && e.tenant) return {
+		kind: "tenant",
+		tenantId: e.tenant
+	};
+	if (Array.isArray(e.tables) && e.tables.length) return {
+		kind: "tables",
+		tables: Qa(e.tables)
+	};
+	let t = Qa(e.exclude);
+	return t.length > 0 ? {
+		kind: "all",
+		exclude: t
+	} : { kind: "all" };
+}, eo = (e) => async (t) => {
+	let n = ca(t, e.secret);
+	if (n) return n;
+	let r;
+	try {
+		r = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
+	} catch {
+		return Z(400, { error: "body must be JSON: { profile?, tenant?, tables?, consistency?, compression?, bundleKey? }" });
+	}
+	let i = {};
+	if (typeof r.profile == "string" && r.profile) {
+		if (!e.loadProfile) return Z(501, { error: "server-side profiles not configured on this instance" });
+		try {
+			i = await e.loadProfile(r.profile);
+		} catch (e) {
+			return Z(400, {
+				error: `profile '${r.profile}' could not be loaded`,
+				message: e?.message ?? String(e)
+			});
+		}
+	}
+	let a = r.consistency === "snapshot" ? "snapshot" : i.consistency ?? "live", o = (typeof r.compression == "string" ? r.compression : void 0) ?? i.compression, s = i.scope ?? $a(r), c = typeof r.bundleKey == "string" && r.bundleKey.length > 0, l = r.assets === !0 && e.assetSource ? { blobs: e.assetSource } : {}, u = Zn("dexp", `${Date.now()}-${Math.random()}`), d = await to(e.store, {
+		runId: u,
+		mode: i.subset ? "subset" : s.kind,
+		bundle: c ? String(r.bundleKey) : null
+	});
+	return no({
+		deps: e,
+		runId: u,
+		recorded: d,
+		profile: i,
+		scope: s,
+		consistency: a,
+		blobs: l,
+		...o ? { compression: o } : {},
+		...c ? { bundleKey: String(r.bundleKey) } : {}
+	}), Ka(), Za.info("admin.export started", {
+		runId: u,
+		scope: s.kind,
+		storage: c
+	}), Z(202, {
+		runId: u,
+		transport: c ? "storage" : "download",
+		...c ? { bundleKey: r.bundleKey } : {},
+		recorded: d,
+		outcome: "poll /_voltro/admin/imports for this runId; fetch the bytes from /_voltro/admin/export/download"
+	});
+}, to = async (e, t) => {
+	try {
+		return $n(qn), await e.insert(U, {
+			id: t.runId,
+			direction: "export",
+			startedAt: /* @__PURE__ */ new Date(),
+			finishedAt: null,
+			failure: null,
+			mode: t.mode,
+			via: "api",
+			bundle: t.bundle,
+			sourceFingerprint: null,
+			tablesWritten: 0,
+			rowsWritten: 0,
+			staged: null
+		}), !0;
+	} catch (e) {
+		return Za.warn("admin.export: the run could not be recorded", {
+			runId: t.runId,
+			error: e?.message ?? String(e)
+		}), !1;
+	}
+}, no = async (e) => {
+	let { deps: t, runId: n } = e, r = await import("node:os"), i = await import("node:fs/promises"), a = await import("node:path"), o = await i.mkdtemp(a.join(r.tmpdir(), "voltro-admin-export-")), s = async (r) => {
+		e.recorded && await t.store.update(U, n, r).then(() => void 0, () => void 0);
+	};
+	try {
+		let r = await G.runPromise(Gi({
+			store: t.store,
+			snapshot: t.snapshot,
+			dialect: t.dialect,
+			outDir: o,
+			...e.profile.subset ? { subset: e.profile.subset } : {
+				scope: e.scope,
+				...t.tenantTables && t.tenantTables.length > 0 ? { tenantTables: t.tenantTables } : {}
+			},
+			consistency: e.consistency,
+			...e.compression ? { compression: e.compression } : {},
+			...e.profile.masking ? { masking: e.profile.masking } : {}
+		})), i = r.tables.reduce((e, t) => e + t.rowCount, 0), a = r.masking?.transformed.length ?? 0;
+		if (e.bundleKey !== void 0) {
+			if (!t.putArchive) throw Error("storage transport not configured on this instance");
+			await t.putArchive(e.bundleKey, () => Ui({
+				dir: o,
+				...e.blobs
+			}));
+		}
+		let c = await qa(n, Ui({
+			dir: o,
+			...e.blobs
+		}));
+		Za.info("admin.export complete", {
+			runId: n,
+			tables: r.tables.length,
+			rows: i,
+			masked: a,
+			bytes: c,
+			...e.bundleKey === void 0 ? {} : { bundleKey: e.bundleKey }
+		}), await s({
+			finishedAt: /* @__PURE__ */ new Date(),
+			failure: null,
+			tablesWritten: r.tables.length,
+			rowsWritten: i,
+			sourceFingerprint: r.source?.schemaFingerprint ?? null
+		});
+	} catch (e) {
+		let t = e?.message ?? String(e);
+		Za.warn("admin.export failed", {
+			runId: n,
+			error: t
+		}), await s({
+			failure: t,
+			finishedAt: null
+		}), await Xa(n);
+	} finally {
+		await i.rm(o, {
+			recursive: !0,
+			force: !0
+		}).catch(() => void 0);
+	}
+}, ro = (e) => async (t) => {
+	let n = ca(t, e.secret, "GET");
+	if (n) return n;
+	let r = new URLSearchParams(t.query ?? ""), i = r.get("runId") ?? "";
+	if (!Ha(i)) return Z(400, { error: "download needs ?runId=<id> from the 202 the export answered with" });
+	let a = Math.max(0, Number(r.get("offset") ?? "0") || 0), o = Number(r.get("length") ?? "8388608"), s = await Ya(i, a, Number.isFinite(o) && o > 0 ? Math.min(o, ao) : io);
+	return s === null ? Z(404, {
+		error: "no artefact",
+		message: `this instance holds no produced bundle for run '${i}'. It may have expired, or the export may still be running — poll the run first.`
+	}) : {
+		status: 200,
+		contentType: "application/octet-stream",
+		body: new Uint8Array(s.bytes),
+		headers: {
+			"x-export-total-bytes": String(s.total),
+			"x-export-offset": String(a),
+			"x-export-length": String(s.bytes.byteLength)
+		}
+	};
+}, io = 8388608, ao = 33554432, oo = async (e, t) => await e.query({
+	table: U,
+	order: [{
+		column: "startedAt",
+		direction: "desc"
+	}],
+	predicate: void 0,
+	projection: void 0,
+	skip: 0,
+	take: t
+}), so = (e) => {
+	let t = new Date(e);
+	return Number.isFinite(t.getTime()) ? t : /* @__PURE__ */ new Date(0);
+}, co = (e) => ({
+	...e,
+	startedAt: so(e.startedAt),
+	finishedAt: e.finishedAt === null || e.finishedAt === void 0 ? null : so(e.finishedAt)
+}), lo = (e) => async (t) => {
+	let n = ca(t, e.secret, "GET");
+	if (n) return n;
+	let r = Number(new URLSearchParams(t.query ?? "").get("limit") ?? "20"), i = Number.isFinite(r) ? Math.max(1, Math.min(200, Math.trunc(r))) : 20, a;
+	try {
+		a = (await oo(e.store, i)).map(co);
+	} catch (e) {
+		return Z(409, {
+			error: "no import history",
+			message: `this instance has no \`${U}\` table, so no import has been recorded. Run \`voltro db apply\` against it; imports themselves are unaffected.`,
+			detail: e?.message ?? String(e)
+		});
+	}
+	return Z(200, {
+		running: a.filter((e) => e.finishedAt === null && e.failure === null).length,
+		runs: a.map((e) => ({
+			id: e.id,
+			startedAt: e.startedAt.toISOString(),
+			finishedAt: e.finishedAt === null ? null : e.finishedAt.toISOString(),
+			mode: e.mode,
+			via: e.via,
+			bundle: e.bundle,
+			sourceFingerprint: e.sourceFingerprint,
+			tablesWritten: e.tablesWritten,
+			rowsWritten: e.rowsWritten,
+			direction: e.direction,
+			failure: e.failure,
+			staged: e.staged,
+			line: Qn(e)
+		}))
+	});
+}, uo = (e, t, n = {}) => (async function* () {
+	let r = await G.runPromise(Ci(e, t).pipe(G.timeout(n.openTimeout ?? "30 seconds"))), i = await Ti(r.stream), a = n.stallMs ?? 12e4, o, s = () => {
+		o && clearTimeout(o), o = setTimeout(() => i.destroy(/* @__PURE__ */ Error(`storage read stalled for ${a}ms reading '${t}'`)), a);
+	};
+	try {
+		s();
+		for await (let e of i) s(), yield e instanceof Uint8Array ? e : new Uint8Array(e);
+	} finally {
+		o && clearTimeout(o), i.destroy();
+	}
+})(), fo = {
+	get: async () => void 0,
+	set: async () => {},
+	setWithTags: async () => {},
+	remove: async () => !1,
+	has: async () => !1,
+	clear: async () => {},
+	invalidateTag: async () => 0,
+	wrap: async (e, t, n) => n()
+}, po = async (e) => {
+	f(e.appProcedures ?? e.discovered, {
+		defaultDeny: e.security?.defaultDeny ?? !0,
+		commandHint: "`voltro serve`"
+	}), oi({
+		dataStore: e.store,
+		schemaRegistry: e.schemaRegistry
+	});
+	let t = (e.discovered.budgets?.length ?? 0) > 0, n, r = new dr({
+		store: e.store,
+		...e.snapshotCache ? { cache: e.snapshotCache } : {},
+		...e.reactive === void 0 ? {} : { reactive: e.reactive },
+		...t ? { recordCost: (e) => n?.record(e) } : {},
+		recordDelivery: (e) => $r({
+			label: e.label,
+			kind: e.kind,
+			durationMs: e.durationMs,
+			rowCount: e.rowCount
+		})
+	}), i = e.cache ?? fo, a = e.kv ?? Zr, o, s = () => void 0, l, u, d, ee, te, ne, p, h = fe({
+		store: e.store,
+		warn: (e, t) => {
+			process.stderr.write(`[workflow] ${e} ${JSON.stringify(t)}\n`);
+		}
+	}), re = h.remember, se = h.resolve, ce = St({
+		authority: e.authority,
+		getStore: () => e.store
+	}), b = (e.discovered.workflows?.length ?? 0) > 0 ? Vr(() => o) : void 0, pe = (e.discovered.workflows?.length ?? 0) > 0 || (e.discovered.eventTriggers?.length ?? 0) > 0, _e = pe || (e.discovered.workflowWorkers?.length ?? 0) > 0 || e.scheduleCoordination === "cluster", ve = e.tenantIsolation === "namespace", ye = (e.log ?? R({ scope: "voltro:serve" })).child("webhooks"), be, xe, x = e.discovered.webhooks;
+	if (x && x.outgoing.length > 0 && e.workflowEngineLayer !== void 0) {
+		e.workflowEngineLayer;
+		let t = ft({
+			store: e.store,
+			schemaRegistry: e.schemaRegistry,
+			cache: i,
+			kv: a
+		}), n = x.outgoing.map((e) => e.descriptor);
+		xe = Ni.toLayer(Ai(t, { events: n })), be = ji(t, async (e) => {
+			let t = d;
+			if (t === void 0) {
+				ye.error("webhook delivery skipped — the workflow runtime was never built. This is a framework defect, not a configuration problem: report it with your engine setting. Deliveries are NOT queued and will not be retried.", {
+					deliveryId: e.deliveryId,
+					targetId: e.targetId
+				});
+				return;
+			}
+			t.runPromise(Ni.execute(e)).catch((t) => {
+				ye.error("deliverWebhook workflow crashed", {
+					deliveryId: e.deliveryId,
+					targetId: e.targetId
+				}, t);
+			});
+		}, { events: n });
+	}
+	let we = /* @__PURE__ */ new Map();
+	if (x) for (let e of x.incoming) {
+		let t = e.descriptor.path ?? Mi(e.descriptor.id), n = `VOLTRO_WEBHOOK_SECRET_${e.descriptor.id.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`, r = Fi(e.descriptor, {
+			resolveSecret: async () => process.env[n] ?? null,
+			resolveWorkflows: () => b === void 0 ? void 0 : Xr(b, {
+				traceId: `incoming:${e.descriptor.id}`,
+				source: `incoming:${e.descriptor.id}`
+			}),
+			log: (e) => {
+				let t = {
+					webhookId: e.webhookId,
+					status: e.status,
+					signatureOk: String(e.signatureOk),
+					idempotency: e.idempotency,
+					durationMs: e.durationMs
+				};
+				e.status >= 500 ? ye.error("incoming delivery failed", t) : e.status >= 400 ? ye.warn("incoming delivery rejected", t) : ye.info("incoming delivery handled", t);
+			}
+		});
+		we.set(t, { handle: r });
+	}
+	Ar(), ti((t) => jr(e.store, t.subjectId, t.resourceType, t.resourceId)) || R({ scope: "voltro:serve" }).info("policy guards: using the app-registered tuple source");
+	let Te = [], De = [...e.discovered.outboxHandlers ?? [], ..._n((x?.outgoing.length ?? 0) + (x?.incoming.length ?? 0) + (x?.providers.length ?? 0), []) ? [{
+		file: "<framework>/webhooks",
+		id: "voltro-webhook-emit",
+		definition: Pi(() => be)
+	}] : []], Oe = De.length > 0 ? Le({
+		handlers: De,
+		store: e.store,
+		log: (e.log ?? R({ scope: "voltro:serve" })).child("outbox"),
+		onChange: (t) => e.store.onChange((e) => t({
+			table: e.table,
+			op: e.op
+		})),
+		onShutdown: (e) => {
+			Te.push(e);
+		}
+	}) : void 0, S = C({
+		definitions: (e.discovered.connections ?? []).map((e) => e.definition),
+		store: e.store,
+		publicUrl: v(e.port ?? 4e3),
+		log: (e.log ?? R({ scope: "voltro:serve" })).child("connections")
+	});
+	ct({
+		events: e.discovered.events ?? [],
+		rpcTags: [
+			...e.discovered.queries.map((e) => e.descriptor.name),
+			...e.discovered.mutations.map((e) => e.descriptor.name),
+			...e.discovered.actions.map((e) => e.descriptor.name),
+			...(e.discovered.streams ?? []).map((e) => e.descriptor.name)
+		]
+	});
+	let Me = (e.log ?? R({ scope: "voltro:serve" })).child("events"), Ne = e.broadcastNamespace ?? et(e.plugins, void 0), Pe = w(e.plugins, Ne, Me), Fe = e.membership?.instanceId ?? process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, Re = e.membership ?? Mt(e.plugins, {
+		instanceId: Fe,
+		namespace: Ne,
+		meta: { mode: "serve" },
+		logger: Me
+	}), T = me({
+		events: e.discovered.events ?? [],
+		origin: Fe,
+		...Pe.publishRemote === void 0 ? {} : { publishRemote: Pe.publishRemote }
+	}), ze = (e.discovered.events ?? []).length > 0 ? await Pe.attach(T.bus) : null, Be = Ge({
+		store: e.store,
+		schemaRegistry: e.schemaRegistry,
+		cache: i,
+		kv: a,
+		...be === void 0 ? {} : { webhooksService: be },
+		...b === void 0 ? {} : { workflowsProxy: b },
+		eventTriggers: e.discovered.eventTriggers ?? [],
+		namespaceIsolationOn: ve,
+		...e.ensureTenantProvisioned === void 0 ? {} : { ensureTenantProvisioned: e.ensureTenantProvisioned },
+		...e.resolveResidentStore === void 0 ? {} : { resolveResidentStore: e.resolveResidentStore },
+		...Oe === void 0 ? {} : { outbox: { nudge: Oe.nudge } },
+		...S.active ? { connections: { registry: S.registry } } : {},
+		eventBus: T.bus
+	}), Ve = K.succeed(cr, m), He = K.succeed(fr, Rt), We = K.succeed(lr, Ue), qe = K.succeed(pr, Ee), Ye = (t, n) => {
+		let r = t.pipe(G.provide(Br(n)));
+		return (e.baseLayer ? r.pipe(G.provide(e.baseLayer)) : r).pipe(G.provide(Ve)).pipe(G.provide(He)).pipe(G.provide(We)).pipe(G.provide(qe));
+	}, Ze = (e, t) => {
+		let n = Ye(e, t);
+		return ii(n);
+	}, Qe = bn(), nt = de(e.plugins ?? [], Qe), rt = Ae({
+		plugins: e.plugins ?? [],
+		metrics: Qe,
+		log: e.log ?? R({ scope: "voltro:serve" })
+	}), it = y(e.plugins ?? [], Qe), at = e.security?.defaultDeny ?? !0, st = J({
+		store: e.store,
+		defaultDeny: at,
+		recordMetric: (e) => {
+			Qe.record(e);
+		},
+		...nt.mutation === void 0 ? {} : { interceptor: nt.mutation },
+		buildContext: (e, t, n) => Be(e, t, n),
+		runEffect: Ze,
+		undoCapture: c()
+	}), ut = Se();
+	{
+		let t = Xe();
+		t !== void 0 && (e.log ?? R({ scope: "voltro:serve" })).info(t);
+	}
+	let dt = Ie({
+		store: e.store,
+		...e.approvals === void 0 ? {} : { defaultExpiryMs: e.approvals.defaultExpiryMs }
+	}), mt = Mr({
+		defaultDeny: at,
+		buildContext: (e) => Be(e),
+		runEffect: Ze,
+		recordMetric: (e) => {
+			Qe.record(e);
+		},
+		...nt.action === void 0 ? {} : { interceptor: nt.action }
+	}), ht = Gr({
+		tenantScopedTables: e.tenantScopedTables,
+		softDeleteScopedTables: e.softDeleteScopedTables
+	}), gt = {
+		defaultDeny: at,
+		buildContext: (e) => Be(e),
+		finalize: (e, t) => ht(e, t.subject),
+		provideEffect: Ye,
+		...nt.query === void 0 ? {} : { interceptor: nt.query }
+	}, E = Wr(gt), D = Ur({
+		...gt,
+		queryRows: (t, n) => e.store.query(t).then((e) => di(t.table, e, n.subject))
+	}), vt = qr({
+		...gt,
+		subscribeDescriptor: (e, t, n) => r.subscribe(e, t, n),
+		subscribeComputed: (e, t, n) => r.subscribeComputed(e, t, n)
+	}), O = (e) => e.filter((e) => In(e.descriptor)), k = {};
+	for (let t of [
+		...O(e.discovered.queries),
+		...ut.queries,
+		...dt.queries,
+		...S.queries
+	]) k[t.descriptor.name] = (e) => xr(E(t, e), r, `subscription.${t.descriptor.name}`, void 0, void 0, Kr(t, e));
+	for (let t of [
+		...O(e.discovered.mutations),
+		...ut.mutations,
+		...dt.mutations,
+		...S.mutations
+	]) {
+		let n = Hr(t.descriptor.output);
+		k[t.descriptor.name] = (r) => q(async (e, n) => st(t, e, n), r, `mutation.${t.descriptor.name}`, n, e.idempotency, zn(t.descriptor, "mutation"));
+	}
+	for (let t of [...O(e.discovered.actions), ...S.actions]) {
+		let n = Hr(t.descriptor.output);
+		k[t.descriptor.name] = (r) => q(async (e, n) => mt(t, e, n), r, `action.${t.descriptor.name}`, n, e.idempotency, zn(t.descriptor, "action"));
+	}
+	let yt = () => `public-${Math.random().toString(36).slice(2, 10)}`, bt = [
+		...e.discovered.queries.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => D(e, t, {
+				subject: n.subject,
+				traceId: yt()
+			}),
+			subscribe: (t, n, r) => vt(e, t, {
+				subject: n.subject,
+				traceId: yt()
+			}, r)
+		})),
+		...e.discovered.mutations.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => st(e, t, {
+				subject: n.subject,
+				traceId: yt()
+			})
+		})),
+		...e.discovered.actions.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => mt(e, t, {
+				subject: n.subject,
+				traceId: yt()
+			})
+		}))
+	], xt = {
+		candidates: ue({
+			queries: e.discovered.queries,
+			mutations: e.discovered.mutations,
+			actions: e.discovered.actions,
+			descriptorOf: (e) => e.descriptor,
+			runQuery: (e, t, n) => Promise.resolve(D(e, t, n)),
+			runMutation: (e, t, n) => Promise.resolve(st(e, t, n)),
+			runAction: (e, t, n) => Promise.resolve(mt(e, t, n))
+		}),
+		policy: e.agents?.tools ?? {},
+		mcpEnabled: e.agents?.mcp === !0,
+		resolveSubject: (t) => e.resolveSubject(t, -1).then((e) => e.subject)
+	}, Ct = _t({
+		...e.restRoutes === void 0 ? {} : { restRoutes: e.restRoutes },
+		publicApiEntries: bt,
+		store: e.store,
+		resolveSubject: (t) => e.resolveSubject(t, -1).then((e) => e.subject),
+		...e.idempotency === void 0 ? {} : { idempotency: e.idempotency },
+		log: e.log ?? R({ scope: "voltro:serve" })
+	}), A = e.dataTransferSecret ?? process.env.VOLTRO_DATA_TRANSFER_SECRET, wt = async (e, t) => {
+		let { Readable: n } = await import("node:stream"), r = bi(), i = Si("storage", () => n.from(t()));
+		await G.runPromise(wi(r, e, i, { contentType: "application/octet-stream" }));
+	}, Tt = A && A.length >= 16 ? [
+		{
+			method: "POST",
+			path: ta,
+			handle: Pa({
+				secret: A,
+				store: e.store,
+				...e.dataTransferSnapshot ? { snapshot: e.dataTransferSnapshot } : {},
+				...e.dataTransferDialect ? { dialect: e.dataTransferDialect } : {},
+				assetSink: qi(bi()),
+				openArchive: (e) => uo(bi(), e),
+				refreshSubscriptions: (e) => {
+					r.refreshAll(e);
+				},
+				putArchive: wt,
+				...e.dataTransferDialect ? { dialect: e.dataTransferDialect } : {}
+			})
+		},
+		{
+			method: "POST",
+			path: na,
+			handle: Ia({
+				secret: A,
+				store: e.store,
+				...e.dataTransferSnapshot ? { snapshot: e.dataTransferSnapshot } : {},
+				...e.dataTransferDialect ? { dialect: e.dataTransferDialect } : {},
+				assetSink: qi(bi()),
+				openArchive: (e) => uo(bi(), e),
+				refreshSubscriptions: (e) => {
+					r.refreshAll(e);
+				},
+				putArchive: wt
+			})
+		},
+		{
+			method: "GET",
+			path: aa,
+			handle: lo({
+				secret: A,
+				store: e.store
+			})
+		},
+		{
+			method: "GET",
+			path: ia,
+			handle: ro({ secret: A })
+		},
+		{
+			method: "POST",
+			path: ra,
+			handle: eo({
+				secret: A,
+				store: e.store,
+				snapshot: e.dataTransferSnapshot ?? { tables: [] },
+				dialect: e.dataTransferDialect ?? "memory",
+				tenantTables: [...e.tenantScopedTables],
+				loadProfile: En,
+				assetSource: Ji(bi(), e.store),
+				putArchive: wt
+			})
+		}
+	] : [], Et = [
+		...e.httpRoutes ?? [],
+		...Ct.httpRoutes,
+		...Tt,
+		...S.httpRoutes
+	];
+	Object.assign(k, T.handlers);
+	for (let t of O(e.discovered.streams ?? [])) k[t.descriptor.name] = (n) => br((r) => mi(r, (r) => {
+		let i = Be(r), a = t.executor(n, i);
+		if (G.isEffect(a)) {
+			let t = a.pipe(G.provide(Br(i.store)));
+			return (e.baseLayer ? t.pipe(G.provide(e.baseLayer)) : t).pipe(G.provide(Ve)).pipe(G.provide(He)).pipe(G.provide(We)).pipe(G.provide(qe));
+		}
+		return typeof a == "object" && a && typeof a.then == "function" ? G.promise(() => a) : a;
+	}), `stream.${t.descriptor.name}`);
+	for (let t of e.discovered.workflows ?? []) k[t.definition.name] = (e) => q(async (e, n) => {
+		let r = n;
+		return Xr(b, {
+			subject: r.subject,
+			traceId: r.traceId,
+			source: "workflow-rpc"
+		}).start(t.definition.name, e);
+	}, e, `workflow.${t.definition.name}`);
+	pe && (k[Wn.name] = (e) => xr(E({
+		descriptor: Wn,
+		executor: (e) => {
+			let t = e.id;
+			return {
+				table: "_voltro_workflow_runs",
+				order: [{
+					column: "startedAt",
+					direction: "desc"
+				}],
+				predicate: er(W("id", t), W("executionId", t)),
+				take: 1,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${Wn.name}`), k[Kn.name] = (e) => xr(E({
+		descriptor: Kn,
+		executor: (e) => {
+			let t = e, n = [...t.tag === void 0 ? [] : [W("tag", t.tag)], ...t.status === void 0 ? [] : [W("status", t.status)]], r = Number.isFinite(t.limit) && t.limit !== void 0 ? Math.min(Math.max(Math.floor(t.limit), 1), 500) : 100;
+			return {
+				table: "_voltro_workflow_runs",
+				order: [{
+					column: "startedAt",
+					direction: "desc"
+				}],
+				predicate: n.length === 0 ? void 0 : n.length === 1 ? n[0] : Yn(...n),
+				take: r,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${Kn.name}`), k[Gn.name] = (e) => xr(E({
+		descriptor: Gn,
+		executor: (e) => {
+			let t = e.runId;
+			return {
+				table: "_voltro_workflow_run_steps",
+				order: [{
+					column: "startedAt",
+					direction: "asc"
+				}],
+				predicate: W("runId", t),
+				take: 1e3,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${Gn.name}`), k[Un.name] = (e) => xr(E({
+		descriptor: Un,
+		executor: (e) => {
+			let t = e.runId;
+			return {
+				table: "_voltro_workflow_run_events",
+				order: [{
+					column: "occurredAt",
+					direction: "asc"
+				}],
+				predicate: W("runId", t),
+				take: 1e3,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${Un.name}`), k[B.name] = (e) => xr(E({
+		descriptor: B,
+		executor: (e) => {
+			let t = e;
+			return {
+				table: "_voltro_workflow_events",
+				order: [{
+					column: "occurredAt",
+					direction: "desc"
+				}],
+				predicate: t.name === void 0 ? void 0 : W("name", t.name),
+				take: Math.max(1, Math.min(500, t.limit ?? 100)),
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${B.name}`), k[Vn.name] = (e) => xr(E({
+		descriptor: Vn,
+		executor: (e) => {
+			let t = e.eventId;
+			return {
+				table: "_voltro_workflow_event_deliveries",
+				order: [{
+					column: "createdAt",
+					direction: "asc"
+				}],
+				predicate: W("eventId", t),
+				take: 500,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${Vn.name}`), k[Bn.name] = (t) => q(async (t, n) => {
+		let r = t;
+		return await j(e.store, n.subject, { executionId: r.executionId }), await b.cancel(r.workflowName, r.executionId), await Ft(r.workflowName, r.executionId, "workflow.cancel"), { ok: !0 };
+	}, t, `action.${Bn.name}`), k[Hn.name] = (t) => q(async (t, n) => {
+		let r = t;
+		return await j(e.store, n.subject, { executionId: r.executionId }), await b.resume(r.workflowName, r.executionId), { ok: !0 };
+	}, t, `action.${Hn.name}`), k[V.name] = (t) => q(async (t, n) => {
+		let r = t;
+		return await j(e.store, n.subject, { id: r.id }), b.signal({ id: r.id }, r.signalName, r.payload);
+	}, t, `action.${V.name}`), k[H.name] = (t) => q(async (t, n) => {
+		let r = t;
+		return await j(e.store, n.subject, { id: r.id }), b.update({ id: r.id }, r.updateName, r.payload, r.timeoutMs === void 0 ? void 0 : { timeoutMs: r.timeoutMs });
+	}, t, `action.${H.name}`));
+	let Dt = [
+		...O(e.discovered.queries).map((e) => z(e.descriptor)),
+		...O(e.discovered.mutations).map((e) => Ln(e.descriptor)),
+		...O(e.discovered.actions).map((e) => Pn(e.descriptor)),
+		...ut.queries.map((e) => z(e.descriptor)),
+		...ut.mutations.map((e) => Ln(e.descriptor)),
+		...dt.queries.map((e) => z(e.descriptor)),
+		...dt.mutations.map((e) => Ln(e.descriptor)),
+		...S.queries.map((e) => z(e.descriptor)),
+		...S.mutations.map((e) => Ln(e.descriptor)),
+		...S.actions.map((e) => Pn(e.descriptor)),
+		...O(e.discovered.streams ?? []).map((e) => Rn(e.descriptor)),
+		...T.rpcs,
+		...(e.discovered.workflows ?? []).map((e) => hi(e.definition)),
+		...pe ? [
+			z(Wn),
+			z(Kn),
+			z(Gn),
+			z(Un),
+			z(B),
+			z(Vn),
+			Pn(Bn),
+			Pn(Hn),
+			Pn(V),
+			Pn(H)
+		] : []
+	], Ot = yi.make(...Dt).middleware(Mn).middleware(Nn), kt = Rr({ resolveSubject: ({ headers: t, clientId: n }) => e.resolveSubject(t, n) }), At = e.dormancyTenantId ?? ur, Nt = e.dormancy === "sleep" ? {
+		register: (t, n, r) => ni(e.store, {
+			tenantId: r ?? At,
+			kind: "workflow",
+			refId: t,
+			wakeAt: n
+		}),
+		cancel: (t, n) => Cr(e.store, {
+			tenantId: n ?? At,
+			kind: "workflow",
+			refId: t
+		}).then(() => {})
+	} : void 0, M = _e ? await import("@voltro/workflow") : void 0, N = M?.makeWorkflowRunRecorder({
+		store: e.store,
+		...e.workflowRecording === void 0 ? {} : { recording: e.workflowRecording },
+		...Nt === void 0 ? {} : { wakeups: Nt }
+	}), Pt = async (t, n) => {
+		await M.closeWorkflowChildrenForParent({
+			store: e.store,
+			parentExecutionId: t,
+			parentStatus: n,
+			recorder: N,
+			log: { warn: (e, t) => {
+				process.stderr.write(`[workflow] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+			} },
+			interruptChild: async (t, n) => {
+				let r = (e.discovered.workflows ?? []).find((e) => e.definition.name === t);
+				if (!r) throw Error(`Unknown child workflow: ${t}`);
+				if (!d) throw Error("Workflow runtime is not ready");
+				await d.runPromise(r.definition.interrupt(n));
+			}
+		});
+	}, Ft = async (t, n, r) => {
+		let i = (await e.store.query({
+			table: "_voltro_workflow_runs",
+			order: [],
+			predicate: W("executionId", n),
+			projection: void 0,
+			skip: void 0,
+			take: 1
+		}))[0];
+		if (i === void 0) return;
+		let a = await e.store.update("_voltro_workflow_runs", i.id, {
+			status: "cancelled",
+			cancelled: !0,
+			completedAt: /* @__PURE__ */ new Date()
+		}), o = i.subject?.tenantId ?? void 0;
+		a && await N.recordEvent({
+			runId: i.id,
+			eventType: "run-cancelled",
+			payload: {
+				reason: r,
+				workflowName: t,
+				executionId: n,
+				...o == null ? {} : { tenantId: o }
+			}
+		}), a && await Pt(n, "cancelled");
+	}, It = [
+		...Y(e.discovered.workflows ?? [], {
+			buildContext: (t, n) => e.buildContextForWorkflow?.(t, n) ?? Be({
+				subject: t.subject,
+				traceId: t.traceId
+			}, e.store, void 0, `workflow:${n.workflowName}`, { parentExecutionId: n.executionId }),
+			resolveStartContext: se,
+			...ce === void 0 ? {} : { resolveAuthority: ce }
+		}, (t, n, r) => {
+			let i = M.getWorkflowVersionMetadata(t.definition);
+			return M.wrapWorkflowExecuteWithRunRecording({
+				name: t.definition.name,
+				store: e.store,
+				subject: r.subject,
+				source: r.source ?? null,
+				traceId: r.traceId,
+				workflowVersion: i.version,
+				workflowCompatibleVersions: i.compatibleWith,
+				workflowPatches: i.patches,
+				parentExecutionId: r?.parentExecutionId ?? null,
+				parentClosePolicy: r?.parentClosePolicy ?? null,
+				onParentClose: ({ executionId: e, status: t }) => Pt(e, t),
+				...pt(t.definition),
+				onTerminal: async ({ executionId: e }) => {
+					await u?.gate.release(e);
+				},
+				recorder: N,
+				pluginWorkflowStepLayer: it,
+				recordRun: ei
+			}, n);
+		}),
+		...e.discovered.workflowWorkers ?? [],
+		...xe === void 0 ? [] : [xe]
+	], Lt = [...(e.discovered.workflows ?? []).map((e) => e.definition.name).filter(Boolean), ...xe === void 0 ? [] : ["voltro.deliverWebhook"]], zt = It.length > 0 ? K.mergeAll(...It) : K.empty;
+	if (((e.discovered.workflows?.length ?? 0) > 0 || (e.discovered.workflowWorkers?.length ?? 0) > 0 || e.scheduleCoordination === "cluster" || xe !== void 0) && e.workflowEngineLayer !== void 0) {
+		let t = zt.pipe(K.provideMerge(e.workflowEngineLayer));
+		d = nr.make(e.baseLayer === void 0 ? t : t.pipe(K.provideMerge(e.baseLayer))), await d.runPromise(G.void), (e.log ?? R({ scope: "voltro:serve" })).child("workflow").info(`workflow runtime ready — ${Lt.length} entity type(s) registered`, { entities: Lt });
+		let n = await import("@voltro/workflow/cluster"), r = (e) => d.runPromise(n.redriveFailedRun(e)), i = (e) => d.runPromise(n.resumeRunFromStep(e));
+		ne = await Bt({
+			provider: zi(e.plugins ?? [])?.broadcast?.provider,
+			crossReplica: zi(e.plugins ?? [])?.broadcast?.crossReplica ?? !1,
+			namespace: Ne,
+			replicaId: crypto.randomUUID(),
+			pollStorage: () => d.runPromise(n.pollWorkflowStorage),
+			onChange: (t) => e.store.onChange((e) => t({
+				table: e.table,
+				op: e.op,
+				...e.origin === void 0 ? {} : { origin: e.origin }
+			})),
+			log: (e.log ?? R({ scope: "voltro:serve" })).child("workflow")
+		}), ee = async (t) => {
+			let n = await ke({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runRedrive: r
+			}, t.runId);
+			return n.statusReset && await N.recordEvent({
+				runId: t.runId,
+				eventType: "run-redriven",
+				payload: {
+					reason: "inspect.redrive",
+					activitiesReset: n.outcome.activitiesReset
+				}
+			}), {
+				redriven: n.outcome.redriven,
+				activitiesReset: n.outcome.activitiesReset,
+				reason: n.outcome.reason
+			};
+		}, te = async (t) => {
+			let n = await je({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runResume: i
+			}, t.runId, t.step);
+			return n.statusReset && await N.recordEvent({
+				runId: t.runId,
+				eventType: "run-redriven",
+				payload: {
+					reason: "inspect.resume-from-step",
+					step: n.stepName,
+					activitiesReset: n.outcome.activitiesReset
+				}
+			}), {
+				redriven: n.outcome.redriven,
+				stepName: n.stepName,
+				activitiesReset: n.outcome.activitiesReset,
+				reason: n.outcome.reason
+			};
+		};
+		let a = (e.scheduleCoordination ?? "single") === "advisoryLock" ? Nr(e.store, e.scheduleReplicaId ?? `pid-${process.pid}`) : ci, c = zr({
+			coordinator: a,
+			replicaId: e.scheduleReplicaId ?? `pid-${process.pid}`
+		}), f = {
+			info: (e, t) => {
+				process.stdout.write(`[flow-control] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+			},
+			warn: (e, t) => {
+				process.stderr.write(`[flow-control] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+			},
+			error: (e, t) => {
+				process.stderr.write(`[flow-control] ERROR ${e} ${t ? JSON.stringify(t) : ""}\n`);
+			}
+		}, p, m = () => {
+			if (p !== void 0) return p;
+			if (o !== void 0 && N !== void 0) return p = ie({
+				store: e.store,
+				log: I,
+				workflows: e.discovered.workflows ?? [],
+				workflowsProxy: o,
+				workflowRuntime: d,
+				workflowRunRecorder: N,
+				closeChildrenForParent: Pt
+			}), p;
+		};
+		s = m, u = tt({
+			store: e.store,
+			onChange: (t) => e.store.onChange((e) => t({
+				table: e.table,
+				op: e.op
+			})),
+			...e.scheduling === void 0 ? {} : {
+				disarmWhenIdle: e.scheduling.disarmWhenIdle,
+				drainIntervalMs: e.scheduling.admissionDrainMs,
+				cancelSweepIntervalMs: e.scheduling.cancelSweepMs,
+				stalenessSweepIntervalMs: e.scheduling.stalenessSweepMs
+			},
+			workflows: e.discovered.workflows ?? [],
+			facade: () => o,
+			cancelRunWithReason: m,
+			recordRunEvent: () => N?.recordEvent,
+			...e.workflowStaleness === void 0 ? {} : { staleness: e.workflowStaleness },
+			...e.workflowSuspendSignalHintMs === void 0 ? {} : { suspendSignalHintMs: e.workflowSuspendSignalHintMs },
+			scheduleCoordinated: c,
+			onAbandoned: async (t) => {
+				await Ke({
+					workflows: e.discovered.workflows ?? [],
+					facade: () => o,
+					log: f,
+					...t
+				});
+			},
+			log: f
+		});
+		let h = u;
+		h !== void 0 && Qr(() => h.stop()), l = $e({
+			store: e.store,
+			onChange: (t) => e.store.onChange((e) => t({
+				table: e.table,
+				op: e.op
+			})),
+			...e.scheduling === void 0 ? {} : {
+				disarmWhenIdle: e.scheduling.disarmWhenIdle,
+				tickIntervalMs: e.scheduling.inferenceTickMs
+			},
+			enabled: (e.discovered.workflows?.length ?? 0) > 0,
+			resumeSignal: () => d === void 0 || M === void 0 ? void 0 : async ({ executionId: t, workflowName: n, signalName: r, payload: i }) => {
+				await d.runPromise(M.completeSuspendingSignal({
+					store: e.store,
+					target: Je(t, n),
+					signalName: r,
+					payload: i
+				}));
+			},
+			runEffect: (e) => d.runPromise(e),
+			scheduleCoordinated: c,
+			log: f
+		});
+		let g = l;
+		g !== void 0 && Qr(() => g.stop()), o = (e.discovered.workflows?.length ?? 0) > 0 ? Yr({
+			workflows: e.discovered.workflows ?? [],
+			runEffect: (e) => d.runPromise(e),
+			onEnqueue: () => ne?.publishWake(),
+			...h === void 0 ? {} : {
+				admitStart: h.gate.admitStart,
+				startPayloadSchema: h.gate.startPayloadSchema,
+				parkDelayedStart: h.gate.parkDelayed
+			},
+			rememberStartContext: re,
+			signal: async (t, n, r) => {
+				let i = await M.sendWorkflowSignal({
+					store: e.store,
+					recorder: N,
+					target: t,
+					signalName: n,
+					payload: r
+				});
+				return await d.runPromise(M.completeSuspendingSignal({
+					store: e.store,
+					target: t,
+					signalName: n,
+					payload: r
+				})).catch(() => {}), i;
+			},
+			update: (t, n, r, i) => M.sendWorkflowUpdate({
+				store: e.store,
+				recorder: N,
+				target: t,
+				updateName: n,
+				payload: r,
+				...i === void 0 ? {} : { options: i }
+			}),
+			listRuns: (t) => _(e.store, t),
+			retry: (t, n) => oe({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runPromise: (e) => d.runPromise(e)
+			}, t, n),
+			redrive: (t) => ke({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runRedrive: r
+			}, t).then((e) => e.outcome)
+		}) : void 0;
+	}
+	let Vt = K.mergeAll(Ot.toLayer(k), kt), Ht = ot(k, e.discovered.queries.map((e) => e.descriptor.name), pe), Ut = K.mergeAll(Ot.toLayer(Ht), kt), P = e.observability, Wt = await Sr({
+		...e.appName === void 0 ? {} : { serviceName: e.appName },
+		...P && P.spanProcessors.length > 0 ? { extraSpanProcessors: P.spanProcessors } : {},
+		...P && P.metricReaders.length > 0 ? { extraMetricReaders: P.metricReaders } : {},
+		...P && Object.keys(P.resourceAttributes).length > 0 ? { resourceAttributes: P.resourceAttributes } : {},
+		...P && P.sampler !== void 0 ? { sampler: P.sampler } : {}
+	}), Gt = !1, F = e.store.ping ? () => e.store.ping().then(() => !0).catch(() => !1) : void 0, { server: Kt, shutdown: qt } = li({
+		group: Ot,
+		handlersLayer: Vt,
+		httpHandlersLayer: Ut,
+		port: e.port ?? 4e3,
+		...e.host === void 0 ? {} : { host: e.host },
+		path: e.path ?? "/ws",
+		tracerLayer: Wt.layer,
+		security: ae(e),
+		...rt,
+		healthCheck: {
+			isReady: () => Gt,
+			...F ? { ping: F } : {}
+		},
+		...Et.length > 0 ? { httpRoutes: Et } : {},
+		...e.getStore === void 0 ? {} : { getStore: e.getStore },
+		...we.size > 0 ? { webhookRoutes: we } : {},
+		...e.inspectRoute === void 0 ? {} : { inspectRoute: e.inspectRoute }
+	}), Jt = ea(Kt);
+	if (await yr(Kt), (e.discovered.schedules?.length ?? 0) > 0) {
+		let t = (e.scheduleCoordination ?? "single") === "advisoryLock" ? Nr(e.store, e.scheduleReplicaId ?? `pid-${process.pid}`) : ci;
+		p = await ui(e.discovered.schedules ?? [], {
+			store: e.store,
+			coordinator: t,
+			defaultTrigger: e.scheduleDefaultTrigger ?? "self",
+			replicaId: e.scheduleReplicaId ?? `pid-${process.pid}`,
+			armSelf: e.scheduleArmSelf ?? !0,
+			dormancy: e.dormancy ?? "always-on",
+			...e.dormancyTenantId === void 0 ? {} : { dormancyTenantId: e.dormancyTenantId },
+			buildContext: ({ traceId: t, scheduleName: n, subject: r }) => Be({
+				subject: r,
+				traceId: t
+			}, e.store, void 0, `schedule:${n}`),
+			log: {
+				info: (e, t) => {
+					process.stdout.write(`[schedule] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+				},
+				warn: (e, t) => {
+					process.stderr.write(`[schedule] ${e} ${t ? JSON.stringify(t) : ""}\n`);
+				},
+				error: (e, t) => {
+					process.stderr.write(`[schedule] ERROR ${e} ${t ? JSON.stringify(t) : ""}\n`);
+				},
+				debug: () => {}
+			},
+			...e.scheduleFireInterceptor === void 0 ? {} : { interceptFire: e.scheduleFireInterceptor },
+			...e.onScheduleRunEvent === void 0 ? {} : { onRunEvent: e.onScheduleRunEvent }
+		}), e.onSchedulerReady?.(p);
+	}
+	let I = e.log ?? R({ scope: "voltro:serve" }), Yt, Xt;
+	if ((e.discovered.subscribers?.length ?? 0) > 0 && (Yt = Ce(e.discovered.subscribers ?? [], e.store, I.child("subscribe"), e.schemaRegistry, T.bus)), (e.discovered.reactions?.length ?? 0) > 0) {
+		let t = I.child("reaction"), n = async (n, r) => {
+			if (n.kind === "workflow") {
+				if (b === void 0) {
+					t.warn("reaction workflow act skipped — no workflow engine in this app", { workflow: n.workflow });
+					return;
+				}
+				let e = n.payload === void 0 ? r.new ?? r.old ?? {} : n.payload(r);
+				await Xr(b, {
+					traceId: `reaction:${n.workflow}`,
+					source: `reaction:${n.workflow}`
+				}).start(n.workflow, e);
+				return;
+			}
+			await he(n.agent, r, {
+				findAgentSend: (t) => e.discovered.actions.find((e) => e.descriptor.name === `${t}.send`),
+				runAction: (e, t, n) => Promise.resolve(mt(e, t, n)),
+				makeSubject: (e) => Fn(e),
+				now: () => Date.now(),
+				log: t
+			});
+		}, r = async (n, r) => {
+			try {
+				let { requireAiBudget: t } = await import("@voltro/ai");
+				return (await G.runPromise(G.either(t(e.store, {
+					tenantId: n,
+					limitUsd: r
+				}))))._tag === "Right";
+			} catch (e) {
+				return t.warn("reaction budget check failed — refusing the act", { tenantId: n }, e), !1;
+			}
+		}, i = jt(e.store, { onError: (e) => t.warn("reaction: rate-slot claim failed; refusing the act", { cause: String(e) }) });
+		Xt = lt(e.discovered.reactions ?? [], e.store, {
+			runAct: n,
+			checkBudget: r,
+			claimRateSlot: (e) => i.claim(e)
+		}, t);
+	}
+	let Zt;
+	(e.discovered.aggregates?.length ?? 0) > 0 && (Zt = await g({
+		discovered: e.discovered.aggregates ?? [],
+		store: e.store,
+		log: I.child("aggregate"),
+		...e.analytics === void 0 ? {} : { analytics: e.analytics },
+		...e.aggregateStorage === void 0 ? {} : { storage: e.aggregateStorage },
+		...e.aggregateCoordinator === void 0 ? {} : { coordinator: e.aggregateCoordinator }
+	}), Ve = K.succeed(cr, Zt.registry));
+	let Qt;
+	(e.discovered.expectations?.length ?? 0) > 0 && (Qt = gr({
+		discovered: e.discovered.expectations ?? [],
+		store: e.store,
+		log: I.child("expectation")
+	}), He = K.succeed(fr, Qt.registry)), (e.discovered.budgets?.length ?? 0) > 0 && (n = vr({
+		discovered: e.discovered.budgets ?? [],
+		log: I.child("finops")
+	}), We = K.succeed(lr, n.registry));
+	let $t;
+	return (e.discovered.experiments?.length ?? 0) > 0 && ($t = _r({
+		discovered: e.discovered.experiments ?? [],
+		store: e.store,
+		log: I.child("experiment")
+	}), qe = K.succeed(pr, $t.registry)), Gt = !0, e.bootTiming?.mark("ready"), {
+		dispatcher: r,
+		server: Kt,
+		scheduler: p,
+		eventsSnapshot: ge(T.bus, T.declared),
+		membersSnapshot: () => ({
+			members: Re.membership.list(),
+			capturedAt: Date.now()
+		}),
+		agentTools: () => xt,
+		rpcMetrics: () => Qe,
+		webhooksService: () => be,
+		runCanceller: () => s(),
+		flowControlHealth: () => u?.cancelHealth(),
+		inferenceHealth: () => l?.health(),
+		workflowWriteActions: () => b === void 0 || N === void 0 ? void 0 : le({
+			store: e.store,
+			log: I,
+			workflows: e.discovered.workflows ?? [],
+			workflowsProxy: o,
+			workflowRuntime: d,
+			workflowRunRecorder: N,
+			closeChildrenForParent: Pt
+		}),
+		redriveWorkflowRun: (e) => ee ? ee(e) : Promise.reject(/* @__PURE__ */ Error("redrive: this app registers no workflows")),
+		resumeWorkflowRunFromStep: (e) => te ? te(e) : Promise.reject(/* @__PURE__ */ Error("resume-from-step: this app registers no workflows")),
+		close: async () => {
+			Gt = !1, await Jt.drainRequests();
+			for (let e of Te) try {
+				await e();
+			} catch (e) {
+				I.warn("serve: teardown step failed", {}, e);
+			}
+			await ze?.detach(), await Re.detach(), Zt?.detach(), Qt?.detach(), n?.detach(), $t?.detach(), Xt?.(), Yt?.(), await p?.shutdown(), r.close(), await ne?.detach(), await d?.dispose(), await qt(), await Jt.finish();
+		}
+	};
+}, $ = R({ scope: "voltro:serve" }), mo = (e, t, n) => (e === "production" || e === "staging") && t !== "memory" && n !== "0", ho = Ut, go = async (e) => {
+	let t = Sn(process.cwd());
+	if (An(t)) {
+		let n;
+		try {
+			let e = await import(jn(t).href);
+			typeof e.runServe == "function" ? n = e.runServe : $.warn("serve bundle has no runServe export — using the standard serve path");
+		} catch (e) {
+			$.warn("serve bundle failed to load — using the standard serve path", {}, e);
+		}
+		if (n) return $.info("serve: booting from the precompiled serve bundle"), n(e);
+	}
+	return _o(e);
+}, _o = async (c) => {
+	let f = Cn();
+	e("serve");
+	try {
+		Di();
+	} catch (e) {
+		throw i(e instanceof Error ? e.message : String(e));
+	}
+	let m = process.cwd(), g = await We(m), ie = P({
+		kind: "api",
+		configPort: g?.port,
+		env: process.env,
+		flagPort: ho(c, "--port")
+	});
+	for (let e of ie.warnings) $.warn(e);
+	let oe = ie.port;
+	ai(ri(g?.secrets)), await Wt({
+		rawEnv: g?.env,
+		appType: "api",
+		root: m,
+		log: $,
+		generateTypes: !1
+	}), f.mark("config");
+	let _ = (process.env.DB_DIALECT ?? g?.store ?? "memory").toLowerCase(), le = (_ === "mariadb" || _ === "postgres" || _ === "mssql") && (process.env.CDC ?? "1") !== "0", ue = _ === "mariadb" ? "mariadb" : _ === "mssql" ? "mssql" : void 0, de = xn(m);
+	if (!r() && An(de)) try {
+		let e = await import(jn(de).href);
+		if (e.modules) {
+			let t = {};
+			for (let [n, r] of Object.entries(e.modules)) t[On(m, n)] = r;
+			n(t), $.info("precompiled api bundle loaded", { modules: Object.keys(t).length });
+		}
+	} catch (e) {
+		$.warn("precompiled api bundle failed to load — falling back to source", {}, e);
+	}
+	let v = await Ze(m), y = await kt(v, { cdc: le && ue !== void 0 }), fe = Ht(y);
+	{
+		let e = /* @__PURE__ */ new Set([
+			...y.queries.filter((e) => e.descriptor.overridesPlugin === !0).map((e) => e.descriptor.name),
+			...y.mutations.filter((e) => e.descriptor.overridesPlugin === !0).map((e) => e.descriptor.name),
+			...y.actions.filter((e) => e.descriptor.overridesPlugin === !0).map((e) => e.descriptor.name)
+		]);
+		nn(Xt(g?.plugins ?? []), [
+			...y.queries.map((e) => e.descriptor.name),
+			...y.mutations.map((e) => e.descriptor.name),
+			...y.actions.map((e) => e.descriptor.name),
+			...y.streams.map((e) => e.descriptor.name)
+		], e);
+		let t = se(y.serverOnlyLeaks, Me(process.env, "strict"), Er, "`voltro serve`");
+		if (t.action === "fail") throw i(t.message ?? "");
+		t.action === "warn" && $.warn(t.message ?? "");
+	}
+	let me = v.filter((e) => yn.test(e)), he = me.length > 0 ? await vn(me, $.child("webhooks")) : {
+		outgoing: [],
+		incoming: [],
+		providers: []
+	}, ge = gn(y.events), Se = he.outgoing.length + he.incoming.length + he.providers.length + ge.length === 0 ? void 0 : {
+		...he,
+		outgoing: [...he.outgoing, ...ge]
+	}, Ce = rn({
+		nodeEnv: process.env.NODE_ENV,
+		cdcDialect: ue,
+		declared: g?.schema
+	}), Ee = an({
+		gates: Ce,
+		runtime: {
+			traces: be(),
+			undo: fi()
+		}
+	});
+	if (Ee !== void 0) throw i(`serve: ${Ee}`);
+	let ke = tn({
+		mix: y.featureMix,
+		plugins: g?.plugins ?? [],
+		gates: Ce,
+		...ue ? { cdcDialect: ue } : {}
+	}), Ae = g?.analytics !== void 0 && g.analytics.kind !== "noop" && _ !== "memory" ? (await F(_)).makeSqlLayer(D()) : void 0, je = await Ye({
+		spec: g?.analytics,
+		sqlLayer: Ae,
+		log: $
+	}), C = (() => {
+		let e = new Set(y.tables.map((e) => e.tableName)), t = [...y.tables];
+		for (let n of [...ke, ...je.tables]) e.has(n.tableName) || (e.add(n.tableName), t.push(n));
+		return t;
+	})();
+	for (let e of C) $n(e);
+	{
+		let e = Dr(pi(He(y), Lt(C)));
+		e !== void 0 && $.warn(e);
+	}
+	let Ie = (process.env.NODE_ENV ?? "").toLowerCase();
+	if (mo(Ie, _, process.env.VOLTRO_AUTO_MIGRATE)) {
+		let e = (await F(_)).makeSqlLayer(D()), t = await G.runPromise(rr.SqlClient.pipe(G.flatMap((e) => or(e, m)), G.provide(e), G.catchAll(() => G.succeed([]))));
+		t.length > 0 && ($.error(`serve: refusing to boot — ${t.length} pending file-based migration(s) have never run against this database. They perform the changes a schema diff cannot infer (data moves, backfills, table splits), so the declarative fingerprint check below cannot see them and would have let this process serve un-migrated data.`, { pending: t }), $.error("Run them from your pre-deploy job — `voltro db migrate .` (schema + files) or `voltro db files .` (files alone) — or set VOLTRO_AUTO_MIGRATE=0 to bypass every boot schema check. `voltro serve` never applies them itself: a rolling deploy would start N replicas and each would try."), process.exit(1));
+		let n = await G.runPromise(rr.SqlClient.pipe(G.flatMap((e) => sr(e, C, {
+			appliedBy: `serve:${Ie}`,
+			environment: "prod",
+			dialectId: _
+		})), G.provide(e)));
+		n.kind === "prod-mismatch" && ($.error(ar(n, _)), $.error(on({
+			gates: Ce,
+			nodeEnv: process.env.NODE_ENV,
+			cdcDialect: ue,
+			declared: g?.schema
+		})), $.error("serve: refusing to boot — apply the schema first (voltro db apply in a pre-deploy step), or set VOLTRO_AUTO_MIGRATE=0 to bypass this check."), process.exit(1)), $.info(ar(n, _));
+	}
+	await Yt({
+		dialectId: _,
+		tables: C,
+		mode: Jt(g?.reactiveTriggers),
+		lockSchema: D().schema,
+		makeLayer: async () => (await F(_)).makeSqlLayer(D()),
+		log: {
+			info: (e, t) => $.info(e, t ?? {}),
+			warn: (e, t) => $.warn(e, t ?? {})
+		}
+	});
+	let Le = Jr(C);
+	f.mark("discover");
+	let w = await at(g, void 0);
+	{
+		let e = await s(w);
+		if (e !== void 0) throw i(`serve: ${e}`);
+	}
+	let Ue = gi(w, _);
+	for (let e of rt({
+		dialect: String(g?.store ?? process.env.DB_DIALECT ?? "postgres"),
+		changeStrategy: (process.env.CDC ?? "1") === "0" ? "inline" : "cdc",
+		dbUrl: process.env.DB_URL,
+		crossReplicaBus: zi(g?.plugins ?? [])?.broadcast.crossReplica === !0,
+		tables: y.tables.map((e) => ({
+			tableName: e.tableName,
+			isReactive: e.isReactive === !0
+		})),
+		querySources: y.queries.flatMap((e) => {
+			let t = e.descriptor.source;
+			return t === void 0 ? [] : typeof t == "string" ? [t] : [...t];
+		})
+	})) e.level === "warn" ? $.warn(e.message) : $.info(e.message);
+	{
+		let e = yt({
+			tables: Jn().map((e) => ({ tableName: e.tableName })),
+			queries: y.queries.map((e) => ({
+				name: e.descriptor.name,
+				source: e.descriptor.source
+			}))
+		}), t = ht(e);
+		t !== void 0 && $.warn(t);
+	}
+	g?.cache && !process.env.CACHE_BACKEND && (process.env.CACHE_BACKEND = g.cache), g?.cacheRedisUrl && !process.env.CACHE_REDIS_URL && (process.env.CACHE_REDIS_URL = g.cacheRedisUrl), g?.cacheRedisDriver && !process.env.CACHE_REDIS_DRIVER && (process.env.CACHE_REDIS_DRIVER = g.cacheRedisDriver), g?.cacheKeyPrefix && !process.env.CACHE_KEY_PREFIX && (process.env.CACHE_KEY_PREFIX = g.cacheKeyPrefix);
+	let { service: Ge, invalidationBus: Ke, snapshotCache: Je, cache: Xe, semantic: $e, evictSource: tt, backend: ot, stats: ct, dispose: lt } = await Qe({
+		env: process.env,
+		semantic: g?.cacheSemantic ?? !1
+	});
+	$e !== void 0 && $.info("semantic cache enabled — reactive eviction on live writes"), $.info(`cache backend resolved: ${ot}` + (ot === "redis" ? ` (driver ${process.env.CACHE_REDIS_DRIVER ?? "resp"})` : " — in-process, not cross-instance")), w.onChange((e) => {
+		if (G.runFork(Ke.publish(e.table)), tt !== void 0) {
+			let t = (e.new ?? e.old)?.id;
+			tt({
+				table: e.table,
+				op: e.op,
+				...t === void 0 ? {} : { id: t }
+			});
+		}
+	}), g?.kv && !process.env.KV_BACKEND && (process.env.KV_BACKEND = g.kv), g?.kvRedisUrl && !process.env.KV_REDIS_URL && (process.env.KV_REDIS_URL = g.kvRedisUrl), g?.kvKeyPrefix && !process.env.KV_KEY_PREFIX && (process.env.KV_KEY_PREFIX = g.kvKeyPrefix);
+	let { kv: ft, service: pt } = await Lr({ store: w });
+	Pt({
+		log: $,
+		max: qt(),
+		outOfPool: te(_, (process.env.CDC ?? "1") !== "0"),
+		readPools: t.replicationSnapshot()?.replicaCount ?? 0,
+		always: !0
+	}), f.mark("store");
+	let _t = hr({
+		store: w,
+		sink: je.sink,
+		log: $
+	}), St = qe({
+		store: w,
+		dialect: _,
+		log: { info: (e) => $.info(e) }
+	}), j = g?.plugins ?? [], jt = process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, Rt, Bt;
+	_ !== "memory" && (Rt = nr.make((await F(_)).makeSqlLayer(D())), Bt = await Rt.runPromise(rr.SqlClient));
+	let Ut = [
+		"postgres",
+		"mariadb",
+		"mysql",
+		"mssql"
+	].includes(_) ? Nr(w, jt, $) : ci, _n = M(g?.scheduling), Sn = zr({
+		maxIdleIntervalMs: _n.pollCeilingMs,
+		coordinator: Ut,
+		replicaId: jt,
+		log: $
+	}), wn = [], Tn = process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, En = zi(g?.plugins ?? [])?.broadcast?.provider, L = et(g?.plugins, g?.name ?? Dn(m));
+	{
+		let e = nt(g?.plugins, g?.name ?? Dn(m));
+		e !== void 0 && $.warn(e);
+	}
+	let kn = Mt(g?.plugins, {
+		instanceId: Tn,
+		namespace: L,
+		meta: { mode: "serve" },
+		logger: $
+	}), R = {
+		...Bt ? { sql: Bt } : {},
+		instanceId: Tn,
+		membership: kn.membership,
+		...En === void 0 ? {} : { broadcast: En },
+		broadcastChannels: { presence: Ri(L, "presence") },
+		scheduleCoordinated: (e, t, n) => {
+			let r = Sn(e, t, n);
+			return wn.push(r), r;
+		}
+	};
+	for (let e of j) e.bindDataStore?.(Ue, R);
+	u({
+		store: w,
+		...ut(),
+		log: $
+	});
+	let Mn = j.filter((e) => typeof e.onChangeEvent == "function");
+	if (Mn.length > 0) {
+		let e = w.changeScope ?? "local";
+		w.onChange((t) => {
+			let n = xe(t, e);
+			for (let e of Mn) G.runFork(e.onChangeEvent(n).pipe(G.catchAllCause((t) => G.sync(() => $.warn(`plugin ${e.name} onChangeEvent failed`, { error: tr.pretty(t) })))));
+		});
+	}
+	let Nn = Fe({
+		plugins: j,
+		appName: g?.name ?? "voltro-api",
+		appType: "api",
+		voltroVersion: process.env.npm_package_version ?? "0.0.0",
+		log: $
+	});
+	j.length && await Nn.activate(), f.mark("plugins");
+	let Pn = await Nn.gatherObservability(), Fn = {
+		info: (e, t) => process.stdout.write(`[broadcast] ${e} ${t ? JSON.stringify(t) : ""}\n`),
+		warn: (e, t) => process.stderr.write(`[broadcast] ${e} ${t ? JSON.stringify(t) : ""}\n`),
+		debug: () => {}
+	}, In, Ln = await k(w, g, _, L, Fn, (e, t) => {
+		In?.refreshAll(`broadcast gap: missed ${t} change(s) from ${e}`);
+	}), z = g?.apiKeys, Rn = (typeof z == "object" ? z.prefix : void 0) ?? "voltro_", zn = z ? Tr(w) : void 0, Bn = zn ? Fr({ flush: Ir(zn) }) : void 0;
+	Bn && Qr(() => Bn.shutdown());
+	let B = zn ? Pr(zn, {
+		prefix: Rn,
+		...Bn ? { usage: Bn } : {}
+	}) : void 0, Vn = B ? [Or(B, { prefix: Rn })] : [], Hn = Ct([...g?.auth?.strategies ?? [], ...Vn], Ii(g?.plugins ?? []), g?.auth?.anonymousTenantRequired ?? !1, g?.auth, () => Ue), Un = [...g?.restRoutes ?? [], ...B ? mr(B, (typeof z == "object" ? z.managementPath : void 0) ?? "/v1/api-keys") : []], Wn = A(g?.idempotency, w), Gn = j.map((e) => e.services).filter((e) => e !== void 0), Kn = K.mergeAll(vt({
+		analyticsLayer: je.layer,
+		cacheService: Ge,
+		kvService: pt,
+		...$e === void 0 ? {} : { semanticCache: $e },
+		pluginServices: Gn,
+		userLayers: g?.layers ?? []
+	}), ze(g?.http ?? {})), V = await Be({
+		files: v,
+		store: w,
+		log: $,
+		seedPolicy: "report",
+		seedPattern: fn,
+		loadSeedFiles: I,
+		startupPattern: sn,
+		loadStartupFiles: a,
+		runStartups: o,
+		emailPattern: O,
+		loadEmailFiles: Tt,
+		registerEmailTemplates: Li
+	});
+	(V.startupCount > 0 || V.emailCount > 0) && $.info("boot lifecycle", {
+		startups: V.startupCount,
+		emailTemplates: V.emailCount
+	}), V.startups !== void 0 && Qr(async () => {
+		await V.startups.stop();
+	}), pe({
+		demands: we(fe),
+		isRegistered: (e) => kr(e) !== void 0
+	});
+	let H = wt({
+		schedules: st({
+			schedules: y.schedules,
+			seeds: V.seeds,
+			store: w,
+			log: $.child("seeds")
+		}),
+		workflows: y.workflows ?? [],
+		log: $.child("workflow-schedules")
+	}), U = g?.scheduling ?? {}, qn = U.trigger ?? "self", Yn = /* @__PURE__ */ new Set([
+		"postgres",
+		"mysql",
+		"mariadb",
+		"mssql"
+	]), Zn = U.coordination ?? (Yn.has(_) ? "advisoryLock" : "single"), Qn = Zn === "cluster" && Yn.has(_), W = Qn ? "cluster" : Zn === "advisoryLock" && Yn.has(_) ? "advisoryLock" : "single";
+	Zn === "cluster" && !Qn && $.warn("scheduling.coordination=cluster needs a sql-backed store except sqlite — falling back to single"), Zn === "advisoryLock" && !Yn.has(_) && $.warn("scheduling.coordination=advisoryLock needs a SQL store (the claim-row gate) — falling back to single");
+	let er, cr = y.workflows.length > 0 || y.workflowWorkers.length > 0 || y.eventTriggers.length > 0 || (Se?.outgoing.length ?? 0) > 0 || Qn, lr;
+	if (cr) {
+		if (_ === "mssql") {
+			let e = await hn(process.cwd());
+			e && $.warn(e);
+		}
+		let [{ WorkflowEngine: e }, { makeClusterCronLayer: t, workflowEngineLayer: n, resolveRunnerStorage: r, resolveFailoverTuning: i }] = await Promise.all([import("@effect/workflow"), import("@voltro/workflow/cluster")]), a = Qn ? H.filter((e) => (e.trigger ?? qn) === "self").map((e) => t({
+			name: e.name,
+			cron: wr(e),
+			execute: async () => {
+				await er?.fireFromCluster(e.name);
+			}
+		})) : [];
+		lr = _ === "memory" ? e.layerMemory : await (async () => {
+			let e = await F(_), t = r({ sqliteFamily: e.id === "sqlite" || e.id === "turso" });
+			return $.info(`workflow engine: cluster-${t}, dialect=${e.id}` + (t === "memory" ? " — single-process durable replay, no cross-pod shard handoff" + (e.id !== "sqlite" && e.id !== "turso" ? " (VOLTRO_WORKFLOW_RUNNER_STORAGE=memory: SqlRunnerStorage/cluster_runners + GET_LOCK skipped)" : "") : "")), n({
+				sqlClientLayer: e.makeSqlLayer(D()),
+				runnerStorage: t,
+				dialectId: e.id,
+				...process.env.VOLTRO_WORKFLOW_RUNNER_PORT ? { runnerListenPort: Number(process.env.VOLTRO_WORKFLOW_RUNNER_PORT) } : {},
+				...i(),
+				...a.length > 0 ? { extraShardingLayers: a } : {}
+			});
+		})();
+	}
+	let ur = xt(j, bn()), dr = v.filter((e) => /\.subscribe\.tsx?$/.test(e)), fr = dr.length > 0 ? await l(dr, $) : [], pr = v.filter((e) => /\.reaction\.tsx?$/.test(e)), gr = pr.length > 0 ? await _e(pr, $) : [], _r = v.filter((e) => un.test(e)), vr = _r.length > 0 ? await Pe(_r, $) : [], yr = v.filter((e) => /\.aggregate\.tsx?$/.test(e)), q = yr.length > 0 ? await ye(yr, $) : [];
+	{
+		let e = Dr(pi(He({ aggregates: q.map((e) => e.definition) }), Lt(C)));
+		e !== void 0 && $.warn(e);
+	}
+	let br = dt();
+	if (q.length > 0 && _ !== "memory") try {
+		let e = (await F(_)).makeSqlLayer(D());
+		br = d(e);
+	} catch (e) {
+		$.warn("aggregate: SQL storage init failed — falling back to in-process", { err: String(e) });
+	}
+	let xr = _ === "memory" ? ci : Nr(w, `aggregate@${process.pid}`, $), Sr = v.filter((e) => dn.test(e)), Cr = Sr.length > 0 ? await Ft(Sr, $) : [], Ar = v.filter((e) => ln.test(e)), jr = Ar.length > 0 ? await ne(Ar, $) : [], Mr = v.filter((e) => cn.test(e)), Rr = Mr.length > 0 ? await S(Mr, $) : [], Br = [], Vr = [], Hr = v.filter((e) => Zt.test(e));
+	if (Hr.length > 0) {
+		let e = $.child("agent"), t = v.filter((e) => en.test(e));
+		t.length > 0 && await Qt(t, e);
+		let n = await $t(Hr, e);
+		for (let e of n.agents) for (let t of Ot(e)) (t.kind === "action" ? Br : Vr).push({
+			file: t.file,
+			descriptor: t.descriptor,
+			executor: t.executor
+		});
+		n.agents.length > 0 && e.info("synthesized agent routes", { agents: n.agents.map((e) => e.descriptor.name) });
+	}
+	f.mark("workflow");
+	let J = () => {
+		let e = Y.workflowWriteActions();
+		if (e === void 0) throw Error("workflow actions: this app registers no workflows");
+		return e;
+	}, Ur = Xn({
+		dialect: _,
+		...D()
+	}), Wr = _ === "memory" ? void 0 : (await F(_)).makeSqlLayer(D()), Gr = async () => E({
+		sqlLayer: Wr,
+		declared: C,
+		log: $
+	}), Kr = {
+		kind: "api",
+		meta: {
+			name: g?.name ?? "voltro-api",
+			voltroVersion: Et,
+			port: oe,
+			mode: "start",
+			store: _,
+			cdc: le ? "on" : "off",
+			...Ur === void 0 ? {} : { databaseId: Ur }
+		},
+		rpc: Re(y, m),
+		workflows: Nt(y, m),
+		migrations: Gr,
+		events: () => Y.eventsSnapshot(),
+		agentTools: () => Y.agentTools(),
+		invariantChecks: () => ({
+			mode: "serve",
+			accessGate: fe,
+			config: g,
+			serverOnlyLeaks: y.serverOnlyLeaks,
+			migrations: Gr
+		}),
+		members: () => Y.membersSnapshot(),
+		inspectFireSchedule: async ({ name: e, trigger: t }) => {
+			if (!er) throw Error("scheduler not started — this app registers no self-triggered schedules (all schedules are trigger:'external', or there are none).");
+			return { runId: await er.fireNow(e, t) ?? null };
+		},
+		inspectBackfillSchedule: h({
+			getHandle: () => er,
+			getSchedules: () => H
+		}),
+		...Se === void 0 ? {} : { webhooks: () => ve({
+			store: w,
+			discoveredWebhooks: Se
+		}) },
+		plugins: () => ({
+			plugins: Nn.snapshot(),
+			capturedAt: Date.now()
+		}),
+		env: () => Gt(g?.name ?? Dn(m), {
+			...g?.env !== void 0 && Ei(g.env) ? { contract: g.env } : {},
+			plugins: g?.plugins ?? []
+		}),
+		dataCache: () => Ve({
+			stats: ct,
+			backendKind: ot
+		}),
+		subscriptions: () => It(() => In),
+		inspectTables: () => b(y.tables),
+		inspectRows: x({
+			store: w,
+			tables: y.tables,
+			mask: !0
+		}),
+		metrics: (e) => Y.rpcMetrics().snapshot(e),
+		cluster: () => zt({
+			store: w,
+			dialect: _,
+			useClusterCron: Qn,
+			scheduleCoordChoice: Zn
+		}),
+		inspectSchedules: () => De({
+			schedules: H,
+			defaultTrigger: qn,
+			coordination: W
+		}),
+		inspectScheduleRuns: (e) => N(w, e),
+		...ee(w, {
+			controls: it(y.workflows ?? []),
+			active: (y.workflows?.length ?? 0) > 0,
+			cancellation: () => Y.flowControlHealth()
+		}),
+		webhookActions: Te(() => Y.webhooksService()),
+		inspectStartWorkflow: (e) => J().inspectStartWorkflow(e),
+		inspectCancelWorkflowRun: (e) => J().inspectCancelWorkflowRun(e),
+		inspectSuspendWorkflowRun: (e) => J().inspectSuspendWorkflowRun(e),
+		inspectResumeWorkflowRun: (e) => J().inspectResumeWorkflowRun(e),
+		inspectDiscardWorkflowRun: (e) => J().inspectDiscardWorkflowRun(e),
+		inspectRetryWorkflowRun: (e) => J().inspectRetryWorkflowRun(e),
+		inspectSignalWorkflowRun: (e) => J().inspectSignalWorkflowRun(e),
+		inspectUpdateWorkflowRun: (e) => J().inspectUpdateWorkflowRun(e),
+		inspectInferences: (e) => bt({
+			store: w,
+			active: (y.workflows?.length ?? 0) > 0,
+			dispatcher: () => Y.inferenceHealth()
+		}, e.limit === void 0 ? {} : { limit: e.limit }),
+		...gt({
+			store: w,
+			cancelRun: async (e) => await Y.runCanceller()?.(e) ?? !1,
+			retryRun: async (e) => J().inspectRetryWorkflowRun({ runId: e }),
+			redriveRun: async (e) => Y.redriveWorkflowRun({ runId: e }),
+			log: $
+		}),
+		inspectRedriveWorkflowRun: (e) => Y.redriveWorkflowRun(e),
+		inspectResumeWorkflowRunFromStep: (e) => Y.resumeWorkflowRunFromStep(e)
+	}, qr = (process.env.VOLTRO_TENANT_ISOLATION ?? g?.tenancy?.isolation) === "namespace", Yr = qr && _ !== "memory" ? await (async () => {
+		let e = await F(_);
+		return At({
+			tables: C,
+			sqlLayer: e.makeSqlLayer(D()),
+			dialect: _,
+			options: { retryFilter: e.retryFilter },
+			log: {
+				info: (e, t) => $.info(e, t),
+				error: (e, t, n) => $.error(e, t ?? {}, n)
+			}
+		});
+	})() : void 0, Xr = await mt({
+		input: g?.tenancy?.residency,
+		namespaceIsolationOn: qr,
+		makeStoreForUrl: (e, t) => at(g, void 0, Kt(D(), t)),
+		log: {
+			info: (e, t) => $.info(e, t),
+			warn: (e, t) => $.warn(e, t)
+		}
+	});
+	Xr !== void 0 && Qr(async () => {
+		await Xr.close();
+	});
+	let Y = await po({
+		bootTiming: f,
+		broadcastNamespace: L,
+		scheduling: (() => {
+			let e = _n;
+			return {
+				admissionDrainMs: e.admissionDrainMs,
+				inferenceTickMs: e.inferenceTickMs,
+				cancelSweepMs: e.cancelSweepMs,
+				stalenessSweepMs: e.stalenessSweepMs,
+				disarmWhenIdle: T({
+					changeScope: w.changeScope,
+					broadcastAttached: Ln !== void 0
+				})
+			};
+		})(),
+		...g?.workflows?.staleness === void 0 ? {} : { workflowStaleness: g.workflows.staleness },
+		...g?.workflows?.suspendSignalHintMs === void 0 ? {} : { workflowSuspendSignalHintMs: g.workflows.suspendSignalHintMs },
+		workflowRecording: Vt(g?.workflows?.recording),
+		membership: {
+			...kn,
+			instanceId: Tn
+		},
+		security: {
+			defaultDeny: ce(g),
+			...ae(g)
+		},
+		approvals: { defaultExpiryMs: Ne(g) },
+		...g?.plugins === void 0 ? {} : { plugins: g.plugins },
+		...Wn ? { idempotency: Wn } : {},
+		restRoutes: Un,
+		appProcedures: fe,
+		discovered: {
+			queries: [...y.queries, ...Vr],
+			mutations: y.mutations,
+			actions: [...y.actions, ...Br],
+			streams: y.streams,
+			events: y.events,
+			workflows: y.workflows,
+			workflowWorkers: y.workflowWorkers,
+			eventTriggers: y.eventTriggers,
+			schedules: H,
+			subscribers: fr,
+			outboxHandlers: vr,
+			connections: y.connections,
+			reactions: gr,
+			aggregates: q,
+			expectations: Cr,
+			budgets: jr,
+			experiments: Rr,
+			...Se === void 0 ? {} : { webhooks: Se }
+		},
+		log: $,
+		analytics: je.sink,
+		aggregateStorage: br,
+		aggregateCoordinator: xr,
+		store: w,
+		kv: ft,
+		cache: Xe,
+		snapshotCache: Je,
+		...g?.reactive === void 0 ? {} : { reactive: g.reactive },
+		schemaRegistry: Le,
+		tenantScopedTables: y.tenantScopedTables,
+		softDeleteScopedTables: y.softDeleteScopedTables,
+		dataTransferSnapshot: ir(C, _),
+		dataTransferDialect: _,
+		...Yr === void 0 ? {} : { ensureTenantProvisioned: Yr.ensure },
+		...Xr === void 0 ? {} : { resolveResidentStore: Xr.resolveStore },
+		tenantIsolation: (process.env.VOLTRO_TENANT_ISOLATION ?? g?.tenancy?.isolation) === "namespace" ? "namespace" : "shared-schema",
+		resolveSubject: (e, t) => Hn({
+			headers: e,
+			clientId: t
+		}),
+		...g?.auth === void 0 ? {} : { authority: g.auth },
+		...g?.agents === void 0 ? {} : { agents: g.agents },
+		httpRoutes: j.flatMap((e) => e.httpRoutes ?? []),
+		getStore: () => Ue,
+		...Kn ? { baseLayer: Kn } : {},
+		...lr === void 0 ? {} : { workflowEngineLayer: lr },
+		scheduleDefaultTrigger: qn,
+		scheduleCoordination: W,
+		scheduleArmSelf: !Qn,
+		dormancy: process.env.VOLTRO_DORMANCY === "sleep" || process.env.VOLTRO_DORMANCY === "always-on" ? process.env.VOLTRO_DORMANCY : g?.dormancy ?? "always-on",
+		scheduleReplicaId: process.env.HOSTNAME ?? `pid-${process.pid}`,
+		...ur === void 0 ? {} : { scheduleFireInterceptor: ur },
+		onSchedulerReady: (e) => {
+			er = e;
+		},
+		inspectRoute: { handle: async (e, t, n, r) => await p(e, Kr, t, {
+			method: n,
+			...r === void 0 ? {} : { body: r }
+		}) || ((n === "GET" ? await mn(e, Kr, t, { method: n }) : null) ?? pn(e, Kr, t, {
+			method: n,
+			...r === void 0 ? {} : { body: r }
+		}) ?? {
+			status: 404,
+			contentType: "application/json",
+			body: JSON.stringify({ error: "not an inspect route" })
+		}) },
+		...g?.name === void 0 ? {} : { appName: g.name },
+		observability: Pn,
+		port: oe,
+		...g?.transport?.wsPath ? { path: g.transport.wsPath } : {}
+	});
+	return In = Y.dispatcher, re(Oe([
+		y.queries,
+		y.mutations,
+		y.actions,
+		y.streams
+	]), (e) => {
+		$.warn(e);
+	}), $.info(`API listening on :${oe}`, {
+		dialect: _,
+		queries: y.queries.length,
+		mutations: y.mutations.length,
+		actions: y.actions.length,
+		streams: y.streams.length,
+		workflows: y.workflows.length,
+		workflowWorkers: y.workflowWorkers.length,
+		schedules: H.length,
+		scheduleCoordination: W
+	}), f.finish($), Qr(async () => {
+		for (let e of wn) e.stop();
+		St.stop();
+		try {
+			await Y.close(), lt(), Rt?.dispose(), await Nn.deactivate(), await Ln?.close(), await Dt({
+				mirror: _t,
+				log: $
+			}), await je.dispose(), await w.close?.();
+		} catch (e) {
+			console.error("serve: shutdown step failed, exiting anyway:", e);
+		}
+	}), await new Promise(() => {}), 0;
+};
+//#endregion
+export { go as n, mo as r, _o as t };