@voltro/cli 0.51.0 → 0.53.0

package/dist/serveCommand-CueKQgzl.js

@@ -0,0 +1,2443 @@
+import { t as e } from "./nodeEnvironment-cGFAj1J8.js";
+import { t } from "./frameworkInspectState-CX2250XB.js";
+import { r as n, t as r } from "./appModuleLoader-C9r9mxZt.js";
+import { t as i } from "./bootRefusal-pgvDxlrU.js";
+import { n as a, r as o } from "./startupRunner-CEqQq7ax.js";
+import { t as s } from "./interruptedReplace-C3O3M1MM.js";
+import { $ as c, $t as l, A as u, An as d, At as f, Bt as ee, C as te, Cn as p, Ct as m, D as ne, Dn as h, Dt as re, E as g, Et as ie, F as ae, Ft as oe, G as se, Gt as ce, H as _, I as le, It as ue, J as de, Jt as fe, K as pe, Kt as v, L as y, Lt as b, M as me, Mt as he, N as ge, Nt as _e, O as ve, On as ye, Ot as be, P as xe, Pt as Se, Q as Ce, Qt as we, R as Te, Rt as Ee, S as x, Sn as De, St as Oe, T as ke, Tn as Ae, Tt as je, U as Me, Ut as S, Vt as Ne, W as C, X as Pe, Xt as Fe, Y as Ie, Yt as w, Z as Le, Zt as Re, _ as ze, _n as Be, _t as Ve, an as He, at as T, b as Ue, bn as We, bt as Ge, c as Ke, cn as qe, ct as Je, d as Ye, dn as Xe, dt as Ze, en as Qe, et as $e, fn as et, ft as tt, g as nt, gn as rt, gt as it, h as at, hn as ot, ht as st, i as ct, in as lt, it as ut, j as dt, jt as ft, k as pt, kn as mt, kt as ht, ln as gt, lt as _t, m as vt, mn as yt, mt as E, nn as D, nt as bt, o as O, on as xt, ot as St, p as Ct, pn as k, pt as wt, q as Tt, qt as Et, r as Dt, rn as Ot, rt as kt, sn as At, st as jt, t as Mt, tn as Nt, tt as A, u as Pt, un as Ft, ut as It, v as Lt, vn as j, vt as M, w as Rt, wn as zt, wt as Bt, x as Vt, xn as Ht, xt as Ut, y as Wt, yt as Gt, z as Kt, zt as qt } from "./dev-C6LGF4iY.js";
+import { n as N } from "./cliArgs-D4p8n7EE.js";
+import { r as Jt } from "./appPort-B_HpJ_ck.js";
+import { Ht as Yt, Wt as Xt } from "./webDev-oczpugbx.js";
+import { r as P } from "./dialectDriver-czCHYpeH.js";
+import { i as Zt, n as Qt } from "./connectionConfig-Bk9IC7D0.js";
+import { c as F, n as $t, o as en } from "./seedRunner-Dgsiwk_e.js";
+import { d as tn, h as nn, m as rn, p as an, r as on } from "./frameworkTableAssembly-DKx3ba3S.js";
+import { n as sn, r as cn, t as ln } from "./declaredSchemaGates-BlcwObhb.js";
+import { C as un, S as dn, a as fn, c as pn, l as mn, m as hn, n as gn } from "./fileConventions-DASGEmj-.js";
+import { h as _n, o as vn } from "./inspect-Bd8-9wsi.js";
+import { i as yn, n as bn, t as xn } from "./inspectMetrics-CGF94puw.js";
+import { n as Sn } from "./mssqlClusterPatch-_4cE_nun.js";
+import { i as Cn, n as wn, r as Tn, t as En } from "./webhookDiscovery-CphsQe59.js";
+import { r as Dn, u as On } from "./apiBuild-CaPfoWku.js";
+import { t as kn } from "./bootTiming-BdyP9nYw.js";
+import { a as An, o as jn, t as Mn } from "./dataProfile-Du3ztYxv.js";
+import I, { basename as Nn, join as Pn } from "node:path";
+import { createWriteStream as Fn, existsSync as In } from "node:fs";
+import { pathToFileURL as Ln } from "node:url";
+import { LoggerLayer as Rn, createLogger as L } from "@voltro/logger";
+import { AuthMiddleware as zn, ConnectionInfoMiddleware as Bn, actionToRpc as R, anonymousSubject as Vn, isWireReachable as Hn, mutationToRpc as Un, queryToRpc as z, streamToRpc as Wn, wireErrorUnion as Gn, workflowCancelDescriptor as Kn, workflowDomainEventsQueryDescriptor as B, workflowEventDeliveriesQueryDescriptor as V, workflowResumeDescriptor as qn, workflowRunEventsQueryDescriptor as Jn, workflowRunQueryDescriptor as Yn, workflowRunStepsQueryDescriptor as Xn, workflowRunsQueryDescriptor as Zn, workflowSignalDescriptor as Qn, workflowUpdateDescriptor as $n } from "@voltro/protocol";
+import { DATA_TRANSFERS_TABLE as H, _voltroDataTransfersTable as er, allRegisteredTables as tr, and as nr, connectionIdentity as rr, derivedRowId as ir, describeTransferRun as ar, ensureTableRegistered as or, eq as U, or as sr } from "@voltro/database";
+import { Cause as cr, Effect as W, Layer as G, ManagedRuntime as lr } from "effect";
+import { SqlClient as ur } from "@effect/sql";
+import { declaredSnapshot as dr, describeOutcome as fr, pendingFileMigrationIds as pr, runPlannedMigrations as mr } from "@voltro/database/sql";
+import { AggregateRegistry as hr, CostRegistry as gr, DORMANCY_WAKEUP_TENANT as _r, Dispatcher as vr, ExpectationRegistry as yr, ExperimentRegistry as br, apiKeyManagementRoutes as xr, attachAnalyticsMirror as Sr, attachExpectations as Cr, attachExperiments as wr, attachFinops as Tr, awaitServerListening as Er, bindMutation as Dr, bindStream as Or, bindSubscription as K, buildTracingLayer as kr, cancelWakeup as Ar, compileCron as jr, dataStoreApiKeyStore as Mr, formatServerOnlyLeaks as Nr, formatUnresolvedSources as Pr, frameworkApiKeyStrategy as Fr, getResourcePolicy as Ir, installPolicyGuardResolver as Lr, loadResourceTuples as Rr, makeActionRunner as zr, makeAdvisoryLockCoordinator as Br, makeApiKeyService as Vr, makeApiKeyUsageBuffer as Hr, makeApiKeyUsageFlusher as Ur, makeAsyncKv as Wr, makeAuthMiddlewareLayers as Gr, makeCoordinatedScheduler as Kr, makeEffectStoreLayer as qr, makeLazyWorkflowFacade as Jr, makeMutationOutputCodec as Yr, makeMutationRunner as Xr, makeOneShotQueryRunner as Zr, makeQueryDescriptorProducer as q, makeQueryFinalizer as Qr, makeQueryReauthorizer as $r, makeQuerySubscriber as ei, makeSchemaRegistry as ti, makeWorkflowFacade as ni, makeWorkflowFacadeWithCallerContext as ri, makeWorkflowLayers as ii, noopKv as ai, onProcessShutdown as J, recordSubscriptionDelivery as Y, recordWorkflowRun as oi, registerDefaultTupleSource as si, registerWakeup as ci, resolveSecretsBackend as li, runProvidedEffect as ui, setSecretsBackend as di, setSystemStoreHandle as fi, shutdownGraceMsFromEnv as pi, singleCoordinator as mi, startRpcServer as hi, startScheduler as gi, stripForbiddenForWire as _i, undoCaptureEnabled as vi, unresolvedSources as yi, withScopedRequest as bi, workflowToRpc as xi, wrapStoreWithBootCodec as Si } from "@voltro/runtime";
+import Ci, { tmpdir as wi } from "node:os";
+import { RpcGroup as Ti } from "@effect/rpc";
+import { appStorageProvider as Ei, durabilityNotice as Di, fromNodeReadable as Oi, getObjectStream as ki, putObjectStream as Ai, toNodeReadable as ji } from "@voltro/plugin-storage";
+import { isEnvContract as Mi } from "@voltro/env";
+import { assertProductionSessionSecret as Ni } from "@voltro/protocol/session";
+import X from "node:fs/promises";
+import { createHash as Pi, timingSafeEqual as Fi } from "node:crypto";
+import { channelFor as Ii, getBroadcastPlugin as Li } from "@voltro/plugin-broadcast";
+import { buildDeliverWebhookExecute as Ri, buildWebhooksService as zi, defaultIncomingPath as Bi, deliverWebhookWorkflow as Vi, makeDeferredEmitHandler as Hi, mountIncomingWebhook as Ui } from "@voltro/plugin-webhooks";
+import { getAuthSessionStrategy as Wi } from "@voltro/plugin-auth";
+import { registerEmailTemplates as Gi } from "@voltro/plugin-mail";
+import { checkSchemaDrift as Ki, decideStaging as qi, isEnvironmentLocal as Ji, packBundle as Yi, peekBundle as Xi, runExport as Zi, runImport as Qi, storageBlobSink as $i, storageRefsBlobSource as ea, unpackBundle as ta, unpackBundleToDir as na } from "@voltro/data-transfer";
+//#region \0rolldown/runtime.js
+var ra = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy < "u" ? new Proxy(e, { get: (e, t) => (typeof require < "u" ? require : e)[t] }) : e)(function(e) {
+	if (typeof require < "u") return require.apply(this, arguments);
+	throw Error("Calling `require` for \"" + e + "\" in an environment that doesn't expose the `require` function. See https://rolldown.rs/in-depth/bundling-cjs#require-external-modules for more details.");
+}), ia = () => Math.max(500, Math.floor(pi() * .6)), aa = (e) => new Promise((t) => setTimeout(t, e)), oa = (e) => {
+	let t = /* @__PURE__ */ new Set(), n = /* @__PURE__ */ new Set(), r = 0;
+	e.on("connection", (e) => {
+		t.add(e), e.once("close", () => {
+			t.delete(e), n.delete(e);
+		});
+	}), e.on("upgrade", (e, t) => {
+		n.add(t);
+	}), e.on("request", (e, t) => {
+		r += 1, t.once("close", () => {
+			--r;
+		});
+	});
+	let i, a = async (t = {}) => {
+		let n = t.budgetMs ?? ia();
+		i ??= new Promise((t) => {
+			e.close(() => {
+				t();
+			});
+		}), e.closeIdleConnections();
+		let a = Date.now() + n;
+		for (; r > 0 && Date.now() < a;) await aa(25), e.closeIdleConnections();
+		e.closeIdleConnections();
+	}, o = async () => {
+		i ??= new Promise((t) => {
+			e.close(() => {
+				t();
+			});
+		});
+		for (let e of t) if (n.has(e)) try {
+			e.write(Buffer.from([
+				136,
+				2,
+				3,
+				233
+			]));
+		} catch {}
+		else e.destroy();
+		for (let e = 0; t.size > 0 && e < 250; e += 25) await aa(25);
+		for (let e of t) e.destroy();
+		await i;
+	};
+	return {
+		activeRequests: () => r,
+		drainRequests: a,
+		finish: o,
+		drain: async (e = {}) => {
+			await a(e), await o();
+		}
+	};
+}, sa = "/_voltro/admin/import", ca = "/_voltro/admin/import/start", la = "/_voltro/admin/export", ua = "/_voltro/admin/export/download", da = "/_voltro/admin/transfers", Z = (e, t) => ({
+	status: e,
+	contentType: "application/json; charset=utf-8",
+	body: JSON.stringify(t)
+}), fa = (e) => {
+	let t = e.authorization ?? e.Authorization, n = t ? /^Bearer\s+(.+)$/i.exec(t) : null;
+	return n ? n[1] : null;
+}, pa = (e, t) => Fi(Pi("sha256").update(e).digest(), Pi("sha256").update(t).digest()), ma = (e, t, n = "POST") => {
+	if (e.method.toUpperCase() !== n) return Z(405, { error: "method not allowed" });
+	if (!t || t.length < 16) return Z(503, { error: "data transfer misconfigured (no/weak secret)" });
+	let r = fa(e.headers);
+	return !r || !pa(r, t) ? Z(401, { error: "unauthorized" }) : null;
+}, ha = /^[A-Za-z0-9_-]{8,64}$/, ga = (e) => ha.test(e), _a = () => process.env.VOLTRO_IMPORT_UPLOAD_DIR ?? I.join(Ci.tmpdir(), "voltro-import-uploads"), va = (e) => I.join(_a(), e), ya = (e) => I.join(va(e), "archive.bin"), ba = (e) => I.join(va(e), "meta.json"), xa = async (e = Date.now()) => {
+	let t = 0;
+	try {
+		for (let n of await X.readdir(_a())) {
+			if (n === ".runs") continue;
+			let r = await X.stat(va(n)).catch(() => null);
+			r !== null && (e - r.mtimeMs <= 864e5 || (await X.rm(va(n), {
+				recursive: !0,
+				force: !0
+			}).catch(() => void 0), t++));
+		}
+	} catch {}
+	return t;
+}, Sa = async (e) => {
+	if (!ga(e)) return {
+		bytes: 0,
+		key: null,
+		runId: null
+	};
+	let t = await X.stat(ya(e)).catch(() => null);
+	if (t === null) return {
+		bytes: 0,
+		key: null,
+		runId: null
+	};
+	let n = await Ca(e);
+	return {
+		bytes: t.size,
+		key: n.key ?? null,
+		runId: n.runId ?? null
+	};
+}, Ca = async (e) => {
+	try {
+		let t = await X.readFile(ba(e), "utf8");
+		return JSON.parse(t);
+	} catch {
+		return {};
+	}
+}, wa = async (e, t) => {
+	let n = ba(e), r = `${n}.${process.pid}.${Math.random().toString(36).slice(2, 8)}.tmp`;
+	await X.writeFile(r, JSON.stringify(t)), await X.rename(r, n);
+}, Ta = async (e, t, n) => {
+	if (!ga(e)) return t;
+	await X.mkdir(va(e), { recursive: !0 });
+	let r = await Ca(e), i = typeof r.runId == "string" && r.runId.length > 0 ? r.runId : null;
+	return i !== null && n?.takeOver !== !0 ? i : (await wa(e, {
+		...r,
+		runId: t
+	}), t);
+}, Ea = async (e) => {
+	if (!ga(e)) return;
+	let t = await Ca(e);
+	if (t.runId === void 0) return;
+	let { runId: n, ...r } = t;
+	await wa(e, r).catch(() => void 0);
+}, Da = async (e, t, n) => (await X.mkdir(va(e), { recursive: !0 }), await X.writeFile(ya(e), Buffer.from(t)), await wa(e, {
+	...await Ca(e),
+	key: n,
+	startedAt: (/* @__PURE__ */ new Date()).toISOString()
+}), t.byteLength), Oa = (e) => `up-${Pi("sha256").update(e).digest("hex").slice(0, 32)}`, ka = async (e) => {
+	if (!ga(e.id)) return {
+		reason: "bad-id",
+		message: `upload id must match ${String(ha)}`
+	};
+	let t = await Sa(e.id);
+	if (t.key !== null && t.key !== e.key) return {
+		reason: "key-mismatch",
+		message: "this upload id already holds a different bundle. Use a new upload id, or delete the partial upload."
+	};
+	if (e.offset !== t.bytes) return {
+		reason: "offset-mismatch",
+		message: `chunk starts at ${e.offset} but the server holds ${t.bytes} byte(s)`,
+		expectedOffset: t.bytes
+	};
+	if (await X.mkdir(va(e.id), { recursive: !0 }), t.key === null) {
+		let t = await Ca(e.id);
+		await wa(e.id, {
+			...t,
+			key: e.key,
+			startedAt: (/* @__PURE__ */ new Date()).toISOString()
+		});
+	}
+	return await new Promise((t, n) => {
+		let r = Fn(ya(e.id), { flags: "a" });
+		r.on("error", n), r.on("finish", () => t()), r.end(Buffer.from(e.bytes));
+	}), { total: t.bytes + e.bytes.byteLength };
+}, Aa = async (e) => {
+	let t = await X.stat(ya(e));
+	return {
+		path: ya(e),
+		bytes: t.size
+	};
+}, ja = () => I.join(_a(), ".runs"), Ma = (e) => I.join(ja(), `${e}.bin`), Na = async (e, t) => {
+	if (!ga(e)) return null;
+	let n = ya(e), r = await X.stat(n).catch(() => null);
+	if (r === null || r.size === 0) return null;
+	await X.mkdir(ja(), { recursive: !0 });
+	let i = Ma(t);
+	return await X.rename(n, i), i;
+}, Pa = async (e) => {
+	await X.rm(Ma(e), { force: !0 }).catch(() => void 0);
+}, Q = L({ scope: "voltro:admin-import" }), Fa = "VBUNDLE2", Ia = (e) => {
+	let t = e.req.headers["x-import-rollback-key"];
+	if (e.mode !== "replace") return { options: {} };
+	if (typeof t != "string" || t.length === 0) return Q.warn("admin.import: no rollback capture — this run empties the target first, and nothing was asked to be kept. Send `x-import-rollback-key: <storage key>` (voltro data import --rollback-key <key>) to have the instance store the target's current rows before deleting them."), { options: {} };
+	if (e.deps.putArchive === void 0) return {
+		options: {},
+		refusal: Z(409, {
+			error: "rollback capture requested but this instance has no object storage configured",
+			hint: "A capture written to the pod would not survive the failure it exists for. Configure storage (the same one the storage-push export uses), or re-send without `x-import-rollback-key` to accept that a run which does not finish can leave the target emptied. Note that CONFIGURED is not the same question as SURVIVES: a `filesystem` provider pointed at a container directory with no volume behind it passes this check and dies with the pod. The run says so when it can observe it — the capture path being on the same filesystem as `/`."
+		})
+	};
+	let n = Pn(wi(), `voltro-rollback-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`), r = e.deps.putArchive;
+	return {
+		key: t,
+		options: {
+			rollbackDir: n,
+			onRollbackCaptured: async () => {
+				let e = Di(n);
+				e !== void 0 && Q.warn(`admin.import: ${e}`), await r(t, () => Yi({ dir: n })), Q.info("admin.import: rollback capture stored", { bundleKey: t });
+			}
+		}
+	};
+}, La = (e) => {
+	let t = e["x-import-mode"], n = e["x-import-atomic"];
+	return {
+		mode: t,
+		onConflict: e["x-import-on-conflict"],
+		atomic: n === "0" || n === "false" ? !1 : n === "1" || n === "true" || t === "replace",
+		force: e["x-import-force"] === "1" || e["x-import-force"] === "true",
+		dryRun: e["x-import-dry-run"] === "1" || e["x-import-dry-run"] === "true",
+		tables: (e["x-import-tables"] ?? "").split(",").map((e) => e.trim()).filter(Boolean)
+	};
+}, Ra = async (e, t) => {
+	if (typeof t.bundleKey == "string" && t.bundleKey !== "") {
+		if (!e.openArchive) return { refusal: Z(501, { error: "storage transport not configured on this instance" }) };
+		let n = e.openArchive, r = t.bundleKey;
+		return {
+			source: () => n(r),
+			transport: "storage",
+			uploadId: Oa(r)
+		};
+	}
+	let n = t.uploadId;
+	if (typeof n != "string" || !ga(n)) return { refusal: Z(400, { error: "start needs { uploadId } from an upload, or { bundleKey } for the storage transport" }) };
+	let r = await Aa(n).catch(() => null);
+	return r === null || r.bytes === 0 ? { refusal: Z(409, {
+		error: "no such upload",
+		message: `this instance holds no bytes for upload '${n}'. Upload the bundle first, or re-upload if it has expired.`
+	}) } : {
+		source: () => za(r.path),
+		transport: "upload",
+		uploadId: n
+	};
+}, za = (e) => {
+	let { createReadStream: t } = ra("node:fs");
+	return t(e);
+}, Ba = (e) => async (t) => {
+	let n = ma(t, e.secret);
+	if (n) return n;
+	let r = La(t.headers), i = Ia({
+		req: t,
+		mode: r.mode,
+		deps: e
+	});
+	if (i.refusal !== void 0) return i.refusal;
+	if (t.headers["x-import-preflight"] === "1" || t.headers["x-import-preflight"] === "true") {
+		let n;
+		try {
+			n = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
+		} catch {
+			return Z(400, { error: "a preflight body must be JSON: { tables: string[] } or { bundleKey: string }" });
+		}
+		let a = Array.isArray(n.tables) ? n.tables.filter((e) => typeof e == "string") : [];
+		if (a.length === 0 && typeof n.bundleKey == "string" && n.bundleKey !== "" && e.openArchive && (a = [...await Va(e.openArchive(n.bundleKey))]), a.length === 0) return Z(400, {
+			error: "a preflight needs { tables: string[] } — the bundle's table names, so the staging decision can be made against them",
+			hint: "or { bundleKey } on an instance with storage configured, where this endpoint reads the table list out of the archive itself"
+		});
+		let o = qi({
+			mode: r.mode ?? "upsert",
+			...e.dialect === void 0 ? {} : { targetDialect: e.dialect },
+			...e.snapshot === void 0 ? {} : { targetSnapshot: e.snapshot },
+			bundleTables: a,
+			isSkipped: Ji,
+			canRunSql: !0
+		});
+		return Z(200, {
+			preflight: !0,
+			mode: r.mode ?? "upsert",
+			atomic: r.atomic,
+			staged: o.active,
+			...o.blocker === void 0 ? {} : { reason: o.blocker },
+			stagedTables: o.tables.length,
+			rollback: i.key === void 0 ? { taken: !1 } : {
+				taken: !0,
+				key: i.key
+			},
+			dialect: e.dialect ?? null
+		});
+	}
+	let a = t.headers["x-import-upload-id"];
+	if (a !== void 0 && a !== "") {
+		if (xa(), t.headers["x-import-probe"] === "1") {
+			let e = await Sa(a);
+			return Z(200, {
+				uploadId: a,
+				bytes: e.bytes,
+				...e.runId === null ? {} : { runId: e.runId }
+			});
+		}
+		let e = t.headers["x-import-upload-key"] ?? "", n = Number(t.headers["x-import-chunk-offset"] ?? "0");
+		if (e === "" || !Number.isFinite(n) || n < 0) return Z(400, { error: "a chunked upload needs x-import-upload-key and a numeric x-import-chunk-offset" });
+		let r = await ka({
+			id: a,
+			key: e,
+			offset: n,
+			bytes: t.rawBody
+		});
+		if ("reason" in r) return Q.warn("admin.import chunk refused", {
+			uploadId: a,
+			reason: r.reason
+		}), Z(409, {
+			error: "chunk refused",
+			reason: r.reason,
+			message: r.message,
+			...r.expectedOffset === void 0 ? {} : { expectedOffset: r.expectedOffset }
+		});
+		let i = t.headers["x-import-chunk-final"] === "1";
+		return Z(202, {
+			uploadId: a,
+			bytes: r.total,
+			complete: i
+		});
+	}
+	if (t.rawBody.byteLength >= 8 && Buffer.from(t.rawBody.subarray(0, 8)).toString("latin1") === Fa) {
+		xa();
+		let e = Pi("sha256").update(Buffer.from(t.rawBody)).digest("hex"), n = Oa(e);
+		return Z(202, {
+			uploadId: n,
+			bytes: await Da(n, t.rawBody, e),
+			complete: !0
+		});
+	}
+	let o;
+	try {
+		o = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
+	} catch {
+		return Z(400, { error: "body must be a packed bundle archive or { bundleKey } JSON" });
+	}
+	return typeof o.bundleKey != "string" || !o.bundleKey ? Z(400, { error: "body.bundleKey (string) is required for the storage transport" }) : e.openArchive ? Z(202, {
+		uploadId: Oa(o.bundleKey),
+		bundleKey: o.bundleKey,
+		complete: !0
+	}) : Z(501, { error: "storage transport not configured on this instance" });
+}, Va = async (e) => {
+	let t = await Xi(e, ["manifest.json"]).then((e) => e.get("manifest.json"), () => void 0);
+	if (t === void 0) return [];
+	try {
+		return (JSON.parse(Buffer.from(t).toString("utf8")).tables ?? []).map((e) => e.name).filter((e) => typeof e == "string");
+	} catch {
+		return [];
+	}
+}, Ha = (e) => async (t) => {
+	let n = ma(t, e.secret);
+	if (n) return n;
+	let r = La(t.headers), i = Ia({
+		req: t,
+		mode: r.mode,
+		deps: e
+	});
+	if (i.refusal !== void 0) return i.refusal;
+	let a;
+	try {
+		a = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
+	} catch {
+		return Z(400, { error: "body must be JSON: { uploadId } or { bundleKey }" });
+	}
+	let o = typeof a.bundleKey == "string" && a.bundleKey !== "" ? Oa(a.bundleKey) : typeof a.uploadId == "string" ? a.uploadId : "";
+	if (!ga(o)) return Z(400, { error: "start needs { uploadId } from an upload, or { bundleKey } for the storage transport" });
+	let s = ir("dimp", `${o}-${Date.now()}-${Math.random()}`), c = await Ta(o, s);
+	if (c !== s) {
+		let t = await An(e.store, c);
+		if (jn(t) === void 0 && t !== null) return Q.info("admin.import start: already running", {
+			uploadId: o,
+			runId: c
+		}), Z(202, {
+			runId: c,
+			uploadId: o,
+			alreadyStarted: !0
+		});
+		Q.info("admin.import start: taking over a claim whose run is not running", {
+			uploadId: o,
+			staleRunId: c,
+			outcome: jn(t) ?? "no record"
+		}), c = await Ta(o, s, { takeOver: !0 });
+	}
+	let l = async (e) => (await Ea(o).catch(() => void 0), e), u = await Ra(e, {
+		...typeof a.uploadId == "string" ? { uploadId: a.uploadId } : {},
+		...typeof a.bundleKey == "string" ? { bundleKey: a.bundleKey } : {}
+	});
+	if ("refusal" in u) return l(u.refusal);
+	if (e.snapshot !== void 0 && !r.force) {
+		let t = await Ua(u.source());
+		if (t !== null) {
+			let n = Ki(t.source?.schemaFingerprint ?? "", e.snapshot, Wa(t));
+			if (n.drifted) return Q.warn("admin.import refused (schema drift)", {
+				transport: u.transport,
+				bundle: n.bundleFingerprint.slice(0, 16),
+				target: n.targetFingerprint.slice(0, 16)
+			}), l(Z(409, {
+				error: "schema drift",
+				bundleFingerprint: n.bundleFingerprint,
+				targetFingerprint: n.targetFingerprint,
+				diff: n.diff,
+				hint: "each line above would break the load: a table or column the bundle carries that the target cannot take, or a column the target requires that the bundle has no value for. Fix the target schema, re-export against it, or resend with x-import-force: 1 to write anyway."
+			}));
+		}
+	}
+	let d = null;
+	if (u.transport === "upload" && (d = await Na(u.uploadId, c), d === null)) return l(Z(409, {
+		error: "no such upload",
+		message: `the bytes for upload '${u.uploadId}' are gone. Re-upload the bundle.`
+	}));
+	let f = await Ga(e.store, {
+		runId: c,
+		mode: r.mode ?? "upsert",
+		via: "api",
+		bundle: u.transport === "storage" ? String(a.bundleKey) : u.uploadId
+	});
+	return Ka({
+		deps: e,
+		opts: r,
+		rollback: i,
+		runId: c,
+		traced: f,
+		resolved: d === null ? u : {
+			...u,
+			source: () => za(d)
+		}
+	}), Q.info("admin.import started", {
+		runId: c,
+		uploadId: u.uploadId,
+		transport: u.transport,
+		mode: r.mode ?? "upsert",
+		atomic: r.atomic,
+		dryRun: r.dryRun
+	}), Z(202, {
+		runId: c,
+		uploadId: u.uploadId,
+		transport: u.transport,
+		mode: r.mode ?? "upsert",
+		atomic: r.atomic,
+		...r.dryRun ? { dryRun: !0 } : {},
+		recorded: f,
+		outcome: "poll /_voltro/admin/transfers for this runId — a 202 means started, not finished"
+	});
+}, Ua = async (e) => {
+	let t = await Xi(e, ["manifest.json"]).then((e) => e.get("manifest.json"), () => null);
+	if (t == null) return null;
+	try {
+		return JSON.parse(Buffer.from(t).toString("utf8"));
+	} catch {
+		return null;
+	}
+}, Wa = (e) => ({ tables: (e.tables ?? []).map((e) => ({
+	name: e.name,
+	indexes: [],
+	columns: Object.entries(e.columnTypes ?? {}).map(([e, t]) => ({
+		name: e,
+		type: t,
+		nullable: !0,
+		unique: !1,
+		hasDefault: !1
+	}))
+})) }), Ga = async (e, t) => {
+	try {
+		return or(er), await e.insert(H, {
+			id: t.runId,
+			direction: "import",
+			startedAt: /* @__PURE__ */ new Date(),
+			finishedAt: null,
+			failure: null,
+			mode: t.mode,
+			via: t.via,
+			bundle: t.bundle,
+			sourceFingerprint: null,
+			tablesWritten: 0,
+			rowsWritten: 0,
+			staged: null
+		}), !0;
+	} catch (e) {
+		return Q.warn("admin.import: the run could not be recorded", {
+			runId: t.runId,
+			error: e?.message ?? String(e)
+		}), !1;
+	}
+}, Ka = async (e) => {
+	let { deps: t, opts: n, rollback: r, resolved: i, runId: a } = e, o = await import("node:os"), s = await import("node:fs/promises"), c = await import("node:path"), l = await s.mkdtemp(c.join(o.tmpdir(), "voltro-admin-import-")), u = async (n) => {
+		Q.warn("admin.import failed", {
+			runId: a,
+			transport: i.transport,
+			error: n
+		}), e.traced && await t.store.update(H, a, {
+			failure: n,
+			finishedAt: null
+		}).then(() => void 0, () => void 0);
+	};
+	try {
+		t.assetSink ? await ta(i.source(), {
+			dir: l,
+			blobs: t.assetSink
+		}) : await na(i.source(), l);
+		let o = await W.runPromiseExit(Qi({
+			store: t.store,
+			bundleDir: l,
+			...n.mode ? { mode: n.mode } : {},
+			...n.onConflict ? { onConflict: n.onConflict } : {},
+			atomic: n.atomic,
+			...r.options,
+			recordInterruption: !0,
+			via: "api",
+			...e.traced ? { traceId: a } : {},
+			...n.dryRun ? { dryRun: n.dryRun } : {},
+			...n.tables.length > 0 ? { tables: [...n.tables] } : {},
+			...t.snapshot ? { targetSnapshot: t.snapshot } : {},
+			...t.dialect ? { targetDialect: t.dialect } : {},
+			force: n.force,
+			onWarn: (e) => Q.warn("admin.import", {
+				runId: a,
+				message: e
+			}),
+			...t.assetSink ? { assetsAlreadyRestored: !0 } : {}
+		}));
+		if (o._tag === "Failure") {
+			let e = o.cause._tag === "Fail" ? o.cause.error : void 0, t = typeof e?.reason == "string" ? e.reason : void 0, n = e?.diff;
+			await u(t ?? (Array.isArray(n) ? `schema drift: ${n.join("; ")}` : void 0) ?? String(e?.message ?? e ?? "import failed"));
+			return;
+		}
+		let s = o.value;
+		Q.info(n.dryRun ? "admin.import (dry run — nothing written)" : "admin.import complete", {
+			runId: a,
+			transport: i.transport,
+			tables: s.tablesWritten,
+			rows: s.rowsWritten,
+			mode: n.mode ?? "upsert",
+			atomic: n.atomic,
+			...s.tablesSkipped > 0 ? {
+				skippedTables: s.tablesSkipped,
+				skippedRows: s.rowsSkipped
+			} : {}
+		}), n.dryRun || t.refreshSubscriptions?.(`data import: ${s.tablesWritten} table(s), mode ${n.mode ?? "upsert"}`);
+	} catch (e) {
+		await u(e?.message ?? String(e));
+	} finally {
+		await s.rm(l, {
+			recursive: !0,
+			force: !0
+		}).catch(() => void 0), await Pa(a).catch(() => void 0), await Ea(i.uploadId).catch(() => void 0);
+	}
+}, qa = /^[A-Za-z0-9_-]{8,64}$/, Ja = (e) => qa.test(e), Ya = () => process.env.VOLTRO_EXPORT_ARTIFACT_DIR ?? I.join(Ci.tmpdir(), "voltro-export-artifacts"), Xa = (e) => I.join(Ya(), e), Za = (e) => I.join(Xa(e), "archive.bin"), Qa = async (e = Date.now()) => {
+	let t = 0;
+	try {
+		for (let n of await X.readdir(Ya())) {
+			let r = await X.stat(Xa(n)).catch(() => null);
+			r !== null && (e - r.mtimeMs <= 864e5 || (await X.rm(Xa(n), {
+				recursive: !0,
+				force: !0
+			}).catch(() => void 0), t++));
+		}
+	} catch {}
+	return t;
+}, $a = async (e, t) => {
+	if (!Ja(e)) throw Error(`invalid run id: ${e}`);
+	await X.mkdir(Xa(e), { recursive: !0 });
+	let { createWriteStream: n } = await import("node:fs"), r = n(Za(e)), i = 0;
+	try {
+		for await (let e of t) i += e.byteLength, r.write(Buffer.from(e)) || await new Promise((e, t) => {
+			r.once("drain", e), r.once("error", t);
+		});
+	} finally {
+		await new Promise((e, t) => {
+			r.end(() => e()), r.once("error", t);
+		});
+	}
+	return i;
+}, eo = async (e) => {
+	if (!Ja(e)) return null;
+	let t = await X.stat(Za(e)).catch(() => null);
+	return t === null ? null : t.size;
+}, to = async (e, t, n) => {
+	let r = await eo(e);
+	if (r === null) return null;
+	if (t >= r) return {
+		bytes: Buffer.alloc(0),
+		total: r
+	};
+	let i = await X.open(Za(e), "r");
+	try {
+		let e = Math.max(0, Math.min(n, r - t)), a = Buffer.alloc(e);
+		return await i.read(a, 0, e, t), {
+			bytes: a,
+			total: r
+		};
+	} finally {
+		await i.close();
+	}
+}, no = async (e) => {
+	Ja(e) && await X.rm(Xa(e), {
+		recursive: !0,
+		force: !0
+	}).catch(() => void 0);
+}, ro = L({ scope: "voltro:admin-export" }), io = (e) => Array.isArray(e) ? e.filter((e) => typeof e == "string") : [], ao = (e) => {
+	if (typeof e.tenant == "string" && e.tenant) return {
+		kind: "tenant",
+		tenantId: e.tenant
+	};
+	if (Array.isArray(e.tables) && e.tables.length) return {
+		kind: "tables",
+		tables: io(e.tables)
+	};
+	let t = io(e.exclude);
+	return t.length > 0 ? {
+		kind: "all",
+		exclude: t
+	} : { kind: "all" };
+}, oo = (e) => async (t) => {
+	let n = ma(t, e.secret);
+	if (n) return n;
+	let r;
+	try {
+		r = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
+	} catch {
+		return Z(400, { error: "body must be JSON: { profile?, tenant?, tables?, consistency?, compression?, bundleKey? }" });
+	}
+	let i = {};
+	if (typeof r.profile == "string" && r.profile) {
+		if (!e.loadProfile) return Z(501, { error: "server-side profiles not configured on this instance" });
+		try {
+			i = await e.loadProfile(r.profile);
+		} catch (e) {
+			return Z(400, {
+				error: `profile '${r.profile}' could not be loaded`,
+				message: e?.message ?? String(e)
+			});
+		}
+	}
+	let a = r.consistency === "snapshot" ? "snapshot" : i.consistency ?? "live", o = (typeof r.compression == "string" ? r.compression : void 0) ?? i.compression, s = i.scope ?? ao(r), c = typeof r.bundleKey == "string" && r.bundleKey.length > 0, l = r.assets === !0 && e.assetSource ? { blobs: e.assetSource } : {}, u = ir("dexp", `${Date.now()}-${Math.random()}`), d = await so(e.store, {
+		runId: u,
+		mode: i.subset ? "subset" : s.kind,
+		bundle: c ? String(r.bundleKey) : null
+	});
+	return co({
+		deps: e,
+		runId: u,
+		recorded: d,
+		profile: i,
+		scope: s,
+		consistency: a,
+		blobs: l,
+		...o ? { compression: o } : {},
+		...c ? { bundleKey: String(r.bundleKey) } : {}
+	}), Qa(), ro.info("admin.export started", {
+		runId: u,
+		scope: s.kind,
+		storage: c
+	}), Z(202, {
+		runId: u,
+		transport: c ? "storage" : "download",
+		...c ? { bundleKey: r.bundleKey } : {},
+		recorded: d,
+		outcome: "poll /_voltro/admin/transfers for this runId; fetch the bytes from /_voltro/admin/export/download"
+	});
+}, so = async (e, t) => {
+	try {
+		return or(er), await e.insert(H, {
+			id: t.runId,
+			direction: "export",
+			startedAt: /* @__PURE__ */ new Date(),
+			finishedAt: null,
+			failure: null,
+			mode: t.mode,
+			via: "api",
+			bundle: t.bundle,
+			sourceFingerprint: null,
+			tablesWritten: 0,
+			rowsWritten: 0,
+			staged: null
+		}), !0;
+	} catch (e) {
+		return ro.warn("admin.export: the run could not be recorded", {
+			runId: t.runId,
+			error: e?.message ?? String(e)
+		}), !1;
+	}
+}, co = async (e) => {
+	let { deps: t, runId: n } = e, r = await import("node:os"), i = await import("node:fs/promises"), a = await import("node:path"), o = await i.mkdtemp(a.join(r.tmpdir(), "voltro-admin-export-")), s = async (r) => {
+		e.recorded && await t.store.update(H, n, r).then(() => void 0, () => void 0);
+	};
+	try {
+		let r = await W.runPromise(Zi({
+			store: t.store,
+			snapshot: t.snapshot,
+			dialect: t.dialect,
+			outDir: o,
+			...e.profile.subset ? { subset: e.profile.subset } : {
+				scope: e.scope,
+				...t.tenantTables && t.tenantTables.length > 0 ? { tenantTables: t.tenantTables } : {}
+			},
+			consistency: e.consistency,
+			...e.compression ? { compression: e.compression } : {},
+			...e.profile.masking ? { masking: e.profile.masking } : {}
+		})), i = r.tables.reduce((e, t) => e + t.rowCount, 0), a = r.masking?.transformed.length ?? 0;
+		if (e.bundleKey !== void 0) {
+			if (!t.putArchive) throw Error("storage transport not configured on this instance");
+			await t.putArchive(e.bundleKey, () => Yi({
+				dir: o,
+				...e.blobs
+			}));
+		}
+		let c = await $a(n, Yi({
+			dir: o,
+			...e.blobs
+		}));
+		ro.info("admin.export complete", {
+			runId: n,
+			tables: r.tables.length,
+			rows: i,
+			masked: a,
+			bytes: c,
+			...e.bundleKey === void 0 ? {} : { bundleKey: e.bundleKey }
+		}), await s({
+			finishedAt: /* @__PURE__ */ new Date(),
+			failure: null,
+			tablesWritten: r.tables.length,
+			rowsWritten: i,
+			sourceFingerprint: r.source?.schemaFingerprint ?? null
+		});
+	} catch (e) {
+		let t = e?.message ?? String(e);
+		ro.warn("admin.export failed", {
+			runId: n,
+			error: t
+		}), await s({
+			failure: t,
+			finishedAt: null
+		}), await no(n);
+	} finally {
+		await i.rm(o, {
+			recursive: !0,
+			force: !0
+		}).catch(() => void 0);
+	}
+}, lo = (e) => async (t) => {
+	let n = ma(t, e.secret, "GET");
+	if (n) return n;
+	let r = new URLSearchParams(t.query ?? ""), i = r.get("runId") ?? "";
+	if (!Ja(i)) return Z(400, { error: "download needs ?runId=<id> from the 202 the export answered with" });
+	let a = Math.max(0, Number(r.get("offset") ?? "0") || 0), o = Number(r.get("length") ?? "8388608"), s = await to(i, a, Number.isFinite(o) && o > 0 ? Math.min(o, fo) : uo);
+	return s === null ? Z(404, {
+		error: "no artefact",
+		message: `this instance holds no produced bundle for run '${i}'. It may have expired, or the export may still be running — poll the run first.`
+	}) : {
+		status: 200,
+		contentType: "application/octet-stream",
+		body: new Uint8Array(s.bytes),
+		headers: {
+			"x-export-total-bytes": String(s.total),
+			"x-export-offset": String(a),
+			"x-export-length": String(s.bytes.byteLength)
+		}
+	};
+}, uo = 8388608, fo = 33554432, po = async (e, t) => await e.query({
+	table: H,
+	order: [{
+		column: "startedAt",
+		direction: "desc"
+	}],
+	predicate: void 0,
+	projection: void 0,
+	skip: 0,
+	take: t
+}), mo = (e) => {
+	let t = new Date(e);
+	return Number.isFinite(t.getTime()) ? t : /* @__PURE__ */ new Date(0);
+}, ho = (e) => ({
+	...e,
+	startedAt: mo(e.startedAt),
+	finishedAt: e.finishedAt === null || e.finishedAt === void 0 ? null : mo(e.finishedAt)
+}), go = (e) => async (t) => {
+	let n = ma(t, e.secret, "GET");
+	if (n) return n;
+	let r = Number(new URLSearchParams(t.query ?? "").get("limit") ?? "20"), i = Number.isFinite(r) ? Math.max(1, Math.min(200, Math.trunc(r))) : 20, a;
+	try {
+		a = (await po(e.store, i)).map(ho);
+	} catch (e) {
+		return Z(409, {
+			error: "no import history",
+			message: `this instance has no \`${H}\` table, so no import has been recorded. Run \`voltro db apply\` against it; imports themselves are unaffected.`,
+			detail: e?.message ?? String(e)
+		});
+	}
+	return Z(200, {
+		running: a.filter((e) => e.finishedAt === null && e.failure === null).length,
+		runs: a.map((e) => ({
+			id: e.id,
+			startedAt: e.startedAt.toISOString(),
+			finishedAt: e.finishedAt === null ? null : e.finishedAt.toISOString(),
+			mode: e.mode,
+			via: e.via,
+			bundle: e.bundle,
+			sourceFingerprint: e.sourceFingerprint,
+			tablesWritten: e.tablesWritten,
+			rowsWritten: e.rowsWritten,
+			direction: e.direction,
+			failure: e.failure,
+			staged: e.staged,
+			line: ar(e)
+		}))
+	});
+}, _o = (e, t, n = {}) => (async function* () {
+	let r = await W.runPromise(ki(e, t).pipe(W.timeout(n.openTimeout ?? "30 seconds"))), i = await ji(r.stream), a = n.stallMs ?? 12e4, o, s = () => {
+		o && clearTimeout(o), o = setTimeout(() => i.destroy(/* @__PURE__ */ Error(`storage read stalled for ${a}ms reading '${t}'`)), a);
+	};
+	try {
+		s();
+		for await (let e of i) s(), yield e instanceof Uint8Array ? e : new Uint8Array(e);
+	} finally {
+		o && clearTimeout(o), i.destroy();
+	}
+})(), vo = {
+	get: async () => void 0,
+	set: async () => {},
+	setWithTags: async () => {},
+	remove: async () => !1,
+	has: async () => !1,
+	clear: async () => {},
+	invalidateTag: async () => 0,
+	wrap: async (e, t, n) => n()
+}, yo = async (e) => {
+	Ne(e.appProcedures ?? e.discovered, {
+		defaultDeny: e.security?.defaultDeny ?? !0,
+		commandHint: "`voltro serve`"
+	}), fi({
+		dataStore: e.store,
+		schemaRegistry: e.schemaRegistry
+	});
+	let t = (e.discovered.budgets?.length ?? 0) > 0, n, r = new vr({
+		crdtColumnsOf: (t) => e.schemaRegistry.crdtColumns(t),
+		store: e.store,
+		...e.snapshotCache ? { cache: e.snapshotCache } : {},
+		...e.reactive === void 0 ? {} : { reactive: e.reactive },
+		...t ? { recordCost: (e) => n?.record(e) } : {},
+		recordDelivery: (e) => Y({
+			label: e.label,
+			kind: e.kind,
+			durationMs: e.durationMs,
+			rowCount: e.rowCount
+		})
+	}), i = e.cache ?? vo, a = e.kv ?? ai, o, s = () => void 0, u, d, f, ee, te, ne, h, g = L({ scope: "voltro:workflow" }), ie = L({ scope: "voltro:schedule" }), ae = Et({
+		store: e.store,
+		warn: (e, t) => g.warn(e, t)
+	}), oe = ae.remember, ce = ae.resolve, de = fe({
+		authority: e.authority,
+		getStore: () => e.store
+	}), v = (e.discovered.workflows?.length ?? 0) > 0 ? Jr(() => o) : void 0, ve = (e.discovered.workflows?.length ?? 0) > 0 || (e.discovered.eventTriggers?.length ?? 0) > 0, ye = ve || (e.discovered.workflowWorkers?.length ?? 0) > 0 || e.scheduleCoordination === "cluster", Se = e.tenantIsolation === "namespace", we = (e.log ?? L({ scope: "voltro:serve" })).child("webhooks"), Te, Ee, x = e.discovered.webhooks;
+	if (x && x.outgoing.length > 0 && e.workflowEngineLayer !== void 0) {
+		e.workflowEngineLayer;
+		let t = Xe({
+			store: e.store,
+			schemaRegistry: e.schemaRegistry,
+			cache: i,
+			kv: a
+		}), n = x.outgoing.map((e) => e.descriptor);
+		Ee = Vi.toLayer(Ri(t, { events: n })), Te = zi(t, async (e) => {
+			let t = f;
+			if (t === void 0) {
+				we.error("webhook delivery skipped — the workflow runtime was never built. This is a framework defect, not a configuration problem: report it with your engine setting. Deliveries are NOT queued and will not be retried.", {
+					deliveryId: e.deliveryId,
+					targetId: e.targetId
+				});
+				return;
+			}
+			t.runPromise(Vi.execute(e)).catch((t) => {
+				we.error("deliverWebhook workflow crashed", {
+					deliveryId: e.deliveryId,
+					targetId: e.targetId
+				}, t);
+			});
+		}, { events: n });
+	}
+	let De = /* @__PURE__ */ new Map();
+	if (x) for (let e of x.incoming) {
+		let t = e.descriptor.path ?? Bi(e.descriptor.id), n = `VOLTRO_WEBHOOK_SECRET_${e.descriptor.id.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`, r = Ui(e.descriptor, {
+			resolveSecret: async () => process.env[n] ?? null,
+			resolveWorkflows: () => v === void 0 ? void 0 : ri(v, {
+				traceId: `incoming:${e.descriptor.id}`,
+				source: `incoming:${e.descriptor.id}`
+			}),
+			log: (e) => {
+				let t = {
+					webhookId: e.webhookId,
+					status: e.status,
+					signatureOk: String(e.signatureOk),
+					idempotency: e.idempotency,
+					durationMs: e.durationMs
+				};
+				e.status >= 500 ? we.error("incoming delivery failed", t) : e.status >= 400 ? we.warn("incoming delivery rejected", t) : we.info("incoming delivery handled", t);
+			}
+		});
+		De.set(t, { handle: r });
+	}
+	Lr(), si((t) => Rr(e.store, t.subjectId, t.resourceType, t.resourceId)) || L({ scope: "voltro:serve" }).info("policy guards: using the app-registered tuple source");
+	let ke = [], Ae = [...e.discovered.outboxHandlers ?? [], ...wn((x?.outgoing.length ?? 0) + (x?.incoming.length ?? 0) + (x?.providers.length ?? 0), []) ? [{
+		file: "<framework>/webhooks",
+		id: "voltro-webhook-emit",
+		definition: Hi(() => Te)
+	}] : []], je = Ae.length > 0 ? l({
+		handlers: Ae,
+		store: e.store,
+		log: (e.log ?? L({ scope: "voltro:serve" })).child("outbox"),
+		onChange: (t) => e.store.onChange((e) => t({
+			table: e.table,
+			op: e.op
+		})),
+		onShutdown: (e) => {
+			ke.push(e);
+		}
+	}) : void 0, S = Fe({
+		definitions: (e.discovered.connections ?? []).map((e) => e.definition),
+		store: e.store,
+		publicUrl: w(e.port ?? 4e3),
+		log: (e.log ?? L({ scope: "voltro:serve" })).child("connections")
+	});
+	me({
+		events: e.discovered.events ?? [],
+		rpcTags: [
+			...e.discovered.queries.map((e) => e.descriptor.name),
+			...e.discovered.mutations.map((e) => e.descriptor.name),
+			...e.discovered.actions.map((e) => e.descriptor.name),
+			...(e.discovered.streams ?? []).map((e) => e.descriptor.name)
+		]
+	});
+	let Pe = (e.log ?? L({ scope: "voltro:serve" })).child("events"), Le = e.broadcastNamespace ?? ze(e.plugins, void 0), Re = Lt(e.plugins, Le, Pe), Be = e.membership?.instanceId ?? process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, He = e.membership ?? Wt(e.plugins, {
+		instanceId: Be,
+		namespace: Le,
+		meta: { mode: "serve" },
+		logger: Pe
+	}), T = ge({
+		events: e.discovered.events ?? [],
+		origin: Be,
+		...Re.publishRemote === void 0 ? {} : { publishRemote: Re.publishRemote }
+	}), Ue = (e.discovered.events ?? []).length > 0 ? await Re.attach(T.bus) : null, Ge = Ft({
+		store: e.store,
+		schemaRegistry: e.schemaRegistry,
+		cache: i,
+		kv: a,
+		...Te === void 0 ? {} : { webhooksService: Te },
+		...v === void 0 ? {} : { workflowsProxy: v },
+		eventTriggers: e.discovered.eventTriggers ?? [],
+		namespaceIsolationOn: Se,
+		...e.ensureTenantProvisioned === void 0 ? {} : { ensureTenantProvisioned: e.ensureTenantProvisioned },
+		...e.resolveResidentStore === void 0 ? {} : { resolveResidentStore: e.resolveResidentStore },
+		...je === void 0 ? {} : { outbox: { nudge: je.nudge } },
+		...S.active ? { connections: { registry: S.registry } } : {},
+		eventBus: T.bus
+	}), Ke = G.succeed(hr, be), qe = G.succeed(yr, Oe), Je = G.succeed(gr, Ut), Ye = G.succeed(br, m), et = (t, n) => {
+		let r = t.pipe(W.provide(qr(n)));
+		return (e.baseLayer ? r.pipe(W.provide(e.baseLayer)) : r).pipe(W.provide(Ke)).pipe(W.provide(qe)).pipe(W.provide(Je)).pipe(W.provide(Ye));
+	}, nt = (e, t) => {
+		let n = et(e, t);
+		return ui(n);
+	}, rt = xn(), it = Ie(e.plugins ?? [], rt), at = _({
+		plugins: e.plugins ?? [],
+		metrics: rt,
+		log: e.log ?? L({ scope: "voltro:serve" })
+	}), ot = Tt(e.plugins ?? [], rt), st = e.security?.defaultDeny ?? !0, ct = Xr({
+		store: e.store,
+		defaultDeny: st,
+		recordMetric: (e) => {
+			rt.record(e);
+		},
+		...it.mutation === void 0 ? {} : { interceptor: it.mutation },
+		buildContext: (e, t, n) => Ge(e, t, n),
+		runEffect: nt,
+		undoCapture: $e((t) => e.schemaRegistry.crdtColumns(t))
+	}), ut = c();
+	{
+		let t = A();
+		t !== void 0 && (e.log ?? L({ scope: "voltro:serve" })).info(t);
+	}
+	let dt = Ce({
+		store: e.store,
+		...e.approvals === void 0 ? {} : { defaultExpiryMs: e.approvals.defaultExpiryMs }
+	}), ft = zr({
+		defaultDeny: st,
+		buildContext: (e) => Ge(e),
+		runEffect: nt,
+		recordMetric: (e) => {
+			rt.record(e);
+		},
+		...it.action === void 0 ? {} : { interceptor: it.action }
+	}), pt = Qr({
+		tenantScopedTables: e.tenantScopedTables,
+		softDeleteScopedTables: e.softDeleteScopedTables
+	}), mt = {
+		defaultDeny: st,
+		buildContext: (e) => Ge(e),
+		finalize: (e, t) => pt(e, t.subject),
+		provideEffect: et,
+		...it.query === void 0 ? {} : { interceptor: it.query }
+	}, ht = q(mt), vt = Zr({
+		...mt,
+		queryRows: (t, n) => e.store.query(t).then((e) => _i(t.table, e, n.subject))
+	}), yt = ei({
+		...mt,
+		subscribeDescriptor: (e, t, n) => r.subscribe(e, t, n),
+		subscribeComputed: (e, t, n) => r.subscribeComputed(e, t, n)
+	}), E = (e) => e.filter((e) => Hn(e.descriptor)), D = {};
+	for (let t of [
+		...E(e.discovered.queries),
+		...ut.queries,
+		...dt.queries,
+		...S.queries
+	]) D[t.descriptor.name] = (e) => K(ht(t, e), r, `subscription.${t.descriptor.name}`, void 0, void 0, $r(t, e));
+	for (let t of [
+		...E(e.discovered.mutations),
+		...ut.mutations,
+		...dt.mutations,
+		...S.mutations
+	]) {
+		let n = Yr(t.descriptor.output);
+		D[t.descriptor.name] = (r) => Dr(async (e, n) => ct(t, e, n), r, `mutation.${t.descriptor.name}`, n, e.idempotency, Gn(t.descriptor, "mutation"));
+	}
+	for (let t of [...E(e.discovered.actions), ...S.actions]) {
+		let n = Yr(t.descriptor.output);
+		D[t.descriptor.name] = (r) => Dr(async (e, n) => ft(t, e, n), r, `action.${t.descriptor.name}`, n, e.idempotency, Gn(t.descriptor, "action"));
+	}
+	let bt = () => `public-${Math.random().toString(36).slice(2, 10)}`, O = [
+		...e.discovered.queries.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => vt(e, t, {
+				subject: n.subject,
+				traceId: bt()
+			}),
+			subscribe: (t, n, r) => yt(e, t, {
+				subject: n.subject,
+				traceId: bt()
+			}, r)
+		})),
+		...e.discovered.mutations.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => ct(e, t, {
+				subject: n.subject,
+				traceId: bt()
+			})
+		})),
+		...e.discovered.actions.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => ft(e, t, {
+				subject: n.subject,
+				traceId: bt()
+			})
+		}))
+	], St = {
+		candidates: b({
+			queries: e.discovered.queries,
+			mutations: e.discovered.mutations,
+			actions: e.discovered.actions,
+			descriptorOf: (e) => e.descriptor,
+			runQuery: (e, t, n) => Promise.resolve(vt(e, t, n)),
+			runMutation: (e, t, n) => Promise.resolve(ct(e, t, n)),
+			runAction: (e, t, n) => Promise.resolve(ft(e, t, n))
+		}),
+		policy: e.agents?.tools ?? {},
+		mcpEnabled: e.agents?.mcp === !0,
+		resolveSubject: (t) => e.resolveSubject(t, -1).then((e) => e.subject)
+	};
+	if (e.grpc !== void 0) {
+		let t = () => `grpc-${Math.random().toString(36).slice(2, 10)}`, n = [
+			...e.discovered.queries.map((e) => ({
+				tag: e.descriptor.name,
+				kind: "query",
+				input: e.descriptor.input,
+				output: e.descriptor.output,
+				invoke: (n, r, i) => vt(e, n, {
+					subject: r.subject,
+					traceId: t(),
+					signal: i
+				}),
+				subscribe: (n, r, i) => yt(e, n, {
+					subject: r.subject,
+					traceId: t()
+				}, i)
+			})),
+			...e.discovered.mutations.map((e) => ({
+				tag: e.descriptor.name,
+				kind: "mutation",
+				input: e.descriptor.input,
+				output: e.descriptor.output,
+				invoke: (n, r, i) => ct(e, n, {
+					subject: r.subject,
+					traceId: t(),
+					signal: i
+				})
+			})),
+			...e.discovered.actions.map((e) => ({
+				tag: e.descriptor.name,
+				kind: "action",
+				input: e.descriptor.input,
+				output: e.descriptor.output,
+				invoke: async (n, r, i) => ft(e, n, {
+					subject: r.subject,
+					traceId: t(),
+					signal: i
+				})
+			}))
+		];
+		await We({
+			config: e.grpc.config,
+			candidates: n,
+			resolveSubject: async (t) => {
+				let { subject: n } = await e.resolveSubject(t, -1), r = n;
+				return r.type === "anonymous" && r.credentialRejected !== void 0 ? null : {
+					subject: n,
+					anonymous: r.type === "anonymous"
+				};
+			},
+			store: e.store,
+			root: e.grpc.root,
+			log: e.log ?? L({ scope: "voltro:serve" }),
+			onShutdown: (e) => J(e)
+		});
+	}
+	let Ct = lt({
+		...e.restRoutes === void 0 ? {} : { restRoutes: e.restRoutes },
+		publicApiEntries: O,
+		store: e.store,
+		resolveSubject: (t) => e.resolveSubject(t, -1).then((e) => e.subject),
+		...e.idempotency === void 0 ? {} : { idempotency: e.idempotency },
+		log: e.log ?? L({ scope: "voltro:serve" })
+	}), k = e.dataTransferSecret ?? process.env.VOLTRO_DATA_TRANSFER_SECRET, Dt = async (e, t) => {
+		let { Readable: n } = await import("node:stream"), r = Ei(), i = Oi("storage", () => n.from(t()));
+		await W.runPromise(Ai(r, e, i, { contentType: "application/octet-stream" }));
+	}, Ot = k && k.length >= 16 ? [
+		{
+			method: "POST",
+			path: sa,
+			handle: Ba({
+				secret: k,
+				store: e.store,
+				...e.dataTransferSnapshot ? { snapshot: e.dataTransferSnapshot } : {},
+				...e.dataTransferDialect ? { dialect: e.dataTransferDialect } : {},
+				assetSink: $i(Ei()),
+				openArchive: (e) => _o(Ei(), e),
+				refreshSubscriptions: (e) => {
+					r.refreshAll(e);
+				},
+				putArchive: Dt,
+				...e.dataTransferDialect ? { dialect: e.dataTransferDialect } : {}
+			})
+		},
+		{
+			method: "POST",
+			path: ca,
+			handle: Ha({
+				secret: k,
+				store: e.store,
+				...e.dataTransferSnapshot ? { snapshot: e.dataTransferSnapshot } : {},
+				...e.dataTransferDialect ? { dialect: e.dataTransferDialect } : {},
+				assetSink: $i(Ei()),
+				openArchive: (e) => _o(Ei(), e),
+				refreshSubscriptions: (e) => {
+					r.refreshAll(e);
+				},
+				putArchive: Dt
+			})
+		},
+		{
+			method: "GET",
+			path: da,
+			handle: go({
+				secret: k,
+				store: e.store
+			})
+		},
+		{
+			method: "GET",
+			path: ua,
+			handle: lo({ secret: k })
+		},
+		{
+			method: "POST",
+			path: la,
+			handle: oo({
+				secret: k,
+				store: e.store,
+				snapshot: e.dataTransferSnapshot ?? { tables: [] },
+				dialect: e.dataTransferDialect ?? "memory",
+				tenantTables: [...e.tenantScopedTables],
+				loadProfile: Mn,
+				assetSource: ea(Ei(), e.store),
+				putArchive: Dt
+			})
+		}
+	] : [], kt = [
+		...e.httpRoutes ?? [],
+		...Ct.httpRoutes,
+		...Ot,
+		...S.httpRoutes
+	];
+	Object.assign(D, T.handlers);
+	for (let t of E(e.discovered.streams ?? [])) D[t.descriptor.name] = (n) => Or((r) => bi(r, (r) => {
+		let i = Ge(r), a = t.executor(n, i);
+		if (W.isEffect(a)) {
+			let t = a.pipe(W.provide(qr(i.store)));
+			return (e.baseLayer ? t.pipe(W.provide(e.baseLayer)) : t).pipe(W.provide(Ke)).pipe(W.provide(qe)).pipe(W.provide(Je)).pipe(W.provide(Ye));
+		}
+		return typeof a == "object" && a && typeof a.then == "function" ? W.promise(() => a) : a;
+	}), `stream.${t.descriptor.name}`);
+	for (let t of e.discovered.workflows ?? []) D[t.definition.name] = (e) => Dr(async (e, n) => {
+		let r = n;
+		return ri(v, {
+			subject: r.subject,
+			traceId: r.traceId,
+			source: "workflow-rpc"
+		}).start(t.definition.name, e);
+	}, e, `workflow.${t.definition.name}`);
+	ve && (D[Yn.name] = (e) => K(ht({
+		descriptor: Yn,
+		executor: (e) => {
+			let t = e.id;
+			return {
+				table: "_voltro_workflow_runs",
+				order: [{
+					column: "startedAt",
+					direction: "desc"
+				}],
+				predicate: sr(U("id", t), U("executionId", t)),
+				take: 1,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${Yn.name}`), D[Zn.name] = (e) => K(ht({
+		descriptor: Zn,
+		executor: (e) => {
+			let t = e, n = [...t.tag === void 0 ? [] : [U("tag", t.tag)], ...t.status === void 0 ? [] : [U("status", t.status)]], r = Number.isFinite(t.limit) && t.limit !== void 0 ? Math.min(Math.max(Math.floor(t.limit), 1), 500) : 100;
+			return {
+				table: "_voltro_workflow_runs",
+				order: [{
+					column: "startedAt",
+					direction: "desc"
+				}],
+				predicate: n.length === 0 ? void 0 : n.length === 1 ? n[0] : nr(...n),
+				take: r,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${Zn.name}`), D[Xn.name] = (e) => K(ht({
+		descriptor: Xn,
+		executor: (e) => {
+			let t = e.runId;
+			return {
+				table: "_voltro_workflow_run_steps",
+				order: [{
+					column: "startedAt",
+					direction: "asc"
+				}],
+				predicate: U("runId", t),
+				take: 1e3,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${Xn.name}`), D[Jn.name] = (e) => K(ht({
+		descriptor: Jn,
+		executor: (e) => {
+			let t = e.runId;
+			return {
+				table: "_voltro_workflow_run_events",
+				order: [{
+					column: "occurredAt",
+					direction: "asc"
+				}],
+				predicate: U("runId", t),
+				take: 1e3,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${Jn.name}`), D[B.name] = (e) => K(ht({
+		descriptor: B,
+		executor: (e) => {
+			let t = e;
+			return {
+				table: "_voltro_workflow_events",
+				order: [{
+					column: "occurredAt",
+					direction: "desc"
+				}],
+				predicate: t.name === void 0 ? void 0 : U("name", t.name),
+				take: Math.max(1, Math.min(500, t.limit ?? 100)),
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${B.name}`), D[V.name] = (e) => K(ht({
+		descriptor: V,
+		executor: (e) => {
+			let t = e.eventId;
+			return {
+				table: "_voltro_workflow_event_deliveries",
+				order: [{
+					column: "createdAt",
+					direction: "asc"
+				}],
+				predicate: U("eventId", t),
+				take: 500,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${V.name}`), D[Kn.name] = (t) => Dr(async (t, n) => {
+		let r = t;
+		return await gt(e.store, n.subject, { executionId: r.executionId }), await v.cancel(r.workflowName, r.executionId), await zt(r.workflowName, r.executionId, "workflow.cancel"), { ok: !0 };
+	}, t, `action.${Kn.name}`), D[qn.name] = (t) => Dr(async (t, n) => {
+		let r = t;
+		return await gt(e.store, n.subject, { executionId: r.executionId }), await v.resume(r.workflowName, r.executionId), { ok: !0 };
+	}, t, `action.${qn.name}`), D[Qn.name] = (t) => Dr(async (t, n) => {
+		let r = t;
+		return await gt(e.store, n.subject, { id: r.id }), v.signal({ id: r.id }, r.signalName, r.payload);
+	}, t, `action.${Qn.name}`), D[$n.name] = (t) => Dr(async (t, n) => {
+		let r = t;
+		return await gt(e.store, n.subject, { id: r.id }), v.update({ id: r.id }, r.updateName, r.payload, r.timeoutMs === void 0 ? void 0 : { timeoutMs: r.timeoutMs });
+	}, t, `action.${$n.name}`));
+	let At = [
+		...E(e.discovered.queries).map((e) => z(e.descriptor)),
+		...E(e.discovered.mutations).map((e) => Un(e.descriptor)),
+		...E(e.discovered.actions).map((e) => R(e.descriptor)),
+		...ut.queries.map((e) => z(e.descriptor)),
+		...ut.mutations.map((e) => Un(e.descriptor)),
+		...dt.queries.map((e) => z(e.descriptor)),
+		...dt.mutations.map((e) => Un(e.descriptor)),
+		...S.queries.map((e) => z(e.descriptor)),
+		...S.mutations.map((e) => Un(e.descriptor)),
+		...S.actions.map((e) => R(e.descriptor)),
+		...E(e.discovered.streams ?? []).map((e) => Wn(e.descriptor)),
+		...T.rpcs,
+		...(e.discovered.workflows ?? []).map((e) => xi(e.definition)),
+		...ve ? [
+			z(Yn),
+			z(Zn),
+			z(Xn),
+			z(Jn),
+			z(B),
+			z(V),
+			R(Kn),
+			R(qn),
+			R(Qn),
+			R($n)
+		] : []
+	], jt = Ti.make(...At).middleware(zn).middleware(Bn), Mt = Gr({ resolveSubject: ({ headers: t, clientId: n }) => e.resolveSubject(t, n) }), Nt = e.dormancyTenantId ?? _r, Pt = e.dormancy === "sleep" ? {
+		register: (t, n, r) => ci(e.store, {
+			tenantId: r ?? Nt,
+			kind: "workflow",
+			refId: t,
+			wakeAt: n
+		}),
+		cancel: (t, n) => Ar(e.store, {
+			tenantId: n ?? Nt,
+			kind: "workflow",
+			refId: t
+		}).then(() => {})
+	} : void 0, j = ye ? await import("@voltro/workflow") : void 0, M = j?.makeWorkflowRunRecorder({
+		store: e.store,
+		...e.workflowRecording === void 0 ? {} : { recording: e.workflowRecording },
+		...Pt === void 0 ? {} : { wakeups: Pt }
+	}), Rt = async (t, n) => {
+		await j.closeWorkflowChildrenForParent({
+			store: e.store,
+			parentExecutionId: t,
+			parentStatus: n,
+			recorder: M,
+			log: { warn: (e, t) => g.warn(e, t ?? {}) },
+			interruptChild: async (t, n) => {
+				let r = (e.discovered.workflows ?? []).find((e) => e.definition.name === t);
+				if (!r) throw Error(`Unknown child workflow: ${t}`);
+				if (!f) throw Error("Workflow runtime is not ready");
+				await f.runPromise(r.definition.interrupt(n));
+			}
+		});
+	}, zt = async (t, n, r) => {
+		let i = (await e.store.query({
+			table: "_voltro_workflow_runs",
+			order: [],
+			predicate: U("executionId", n),
+			projection: void 0,
+			skip: void 0,
+			take: 1
+		}))[0];
+		if (i === void 0) return;
+		let a = await e.store.update("_voltro_workflow_runs", i.id, {
+			status: "cancelled",
+			cancelled: !0,
+			completedAt: /* @__PURE__ */ new Date()
+		}), o = i.subject?.tenantId ?? void 0;
+		a && await M.recordEvent({
+			runId: i.id,
+			eventType: "run-cancelled",
+			payload: {
+				reason: r,
+				workflowName: t,
+				executionId: n,
+				...o == null ? {} : { tenantId: o }
+			}
+		}), a && await Rt(n, "cancelled");
+	}, Bt = [
+		...ii(e.discovered.workflows ?? [], {
+			buildContext: (t, n) => e.buildContextForWorkflow?.(t, n) ?? Ge({
+				subject: t.subject,
+				traceId: t.traceId
+			}, e.store, void 0, `workflow:${n.workflowName}`, { parentExecutionId: n.executionId }),
+			resolveStartContext: ce,
+			...de === void 0 ? {} : { resolveAuthority: de }
+		}, (t, n, r) => {
+			let i = j.getWorkflowVersionMetadata(t.definition);
+			return j.wrapWorkflowExecuteWithRunRecording({
+				name: t.definition.name,
+				store: e.store,
+				subject: r.subject,
+				source: r.source ?? null,
+				traceId: r.traceId,
+				workflowVersion: i.version,
+				workflowCompatibleVersions: i.compatibleWith,
+				workflowPatches: i.patches,
+				parentExecutionId: r?.parentExecutionId ?? null,
+				parentClosePolicy: r?.parentClosePolicy ?? null,
+				onParentClose: ({ executionId: e, status: t }) => Rt(e, t),
+				...It(t.definition),
+				onTerminal: async ({ executionId: e }) => {
+					await d?.gate.release(e);
+				},
+				recorder: M,
+				pluginWorkflowStepLayer: ot,
+				recordRun: oi
+			}, n);
+		}),
+		...e.discovered.workflowWorkers ?? [],
+		...Ee === void 0 ? [] : [Ee]
+	], Vt = [...(e.discovered.workflows ?? []).map((e) => e.definition.name).filter(Boolean), ...Ee === void 0 ? [] : ["voltro.deliverWebhook"]], Ht = Bt.length > 0 ? G.mergeAll(...Bt) : G.empty;
+	if (((e.discovered.workflows?.length ?? 0) > 0 || (e.discovered.workflowWorkers?.length ?? 0) > 0 || e.scheduleCoordination === "cluster" || Ee !== void 0) && e.workflowEngineLayer !== void 0) {
+		let t = Ht.pipe(G.provideMerge(e.workflowEngineLayer));
+		f = lr.make((e.baseLayer === void 0 ? t : t.pipe(G.provideMerge(e.baseLayer))).pipe(G.provideMerge(Rn({})))), await f.runPromise(W.void), (e.log ?? L({ scope: "voltro:serve" })).child("workflow").info(`workflow runtime ready — ${Vt.length} entity type(s) registered`, { entities: Vt });
+		let n = await import("@voltro/workflow/cluster"), r = (e) => f.runPromise(n.redriveFailedRun(e)), i = (e) => f.runPromise(n.resumeRunFromStep(e));
+		ne = await p({
+			provider: Li(e.plugins ?? [])?.broadcast?.provider,
+			crossReplica: Li(e.plugins ?? [])?.broadcast?.crossReplica ?? !1,
+			namespace: Le,
+			replicaId: crypto.randomUUID(),
+			pollStorage: () => f.runPromise(n.pollWorkflowStorage),
+			onChange: (t) => e.store.onChange((e) => t({
+				table: e.table,
+				op: e.op,
+				...e.origin === void 0 ? {} : { origin: e.origin }
+			})),
+			log: (e.log ?? L({ scope: "voltro:serve" })).child("workflow")
+		}), ee = async (t) => {
+			let n = await C({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runRedrive: r
+			}, t.runId);
+			return n.statusReset && await M.recordEvent({
+				runId: t.runId,
+				eventType: "run-redriven",
+				payload: {
+					reason: "inspect.redrive",
+					activitiesReset: n.outcome.activitiesReset
+				}
+			}), {
+				redriven: n.outcome.redriven,
+				activitiesReset: n.outcome.activitiesReset,
+				reason: n.outcome.reason
+			};
+		}, te = async (t) => {
+			let n = await se({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runResume: i
+			}, t.runId, t.step);
+			return n.statusReset && await M.recordEvent({
+				runId: t.runId,
+				eventType: "run-redriven",
+				payload: {
+					reason: "inspect.resume-from-step",
+					step: n.stepName,
+					activitiesReset: n.outcome.activitiesReset
+				}
+			}), {
+				redriven: n.outcome.redriven,
+				stepName: n.stepName,
+				activitiesReset: n.outcome.activitiesReset,
+				reason: n.outcome.reason
+			};
+		};
+		let a = (e.scheduleCoordination ?? "single") === "advisoryLock" ? Br(e.store, e.scheduleReplicaId ?? `pid-${process.pid}`) : mi, c = Kr({
+			coordinator: a,
+			replicaId: e.scheduleReplicaId ?? `pid-${process.pid}`
+		}), l = L({ scope: "voltro:flow-control" }), m = {
+			info: (e, t) => {
+				l.info(e, t);
+			},
+			warn: (e, t) => {
+				l.warn(e, t);
+			},
+			error: (e, t) => {
+				l.error(e, t ?? {});
+			}
+		}, h, re = () => {
+			if (h !== void 0) return h;
+			if (o !== void 0 && M !== void 0) return h = le({
+				store: e.store,
+				log: F,
+				workflows: e.discovered.workflows ?? [],
+				workflowsProxy: o,
+				workflowRuntime: f,
+				workflowRunRecorder: M,
+				closeChildrenForParent: Rt
+			}), h;
+		};
+		s = re, d = Ve({
+			store: e.store,
+			onChange: (t) => e.store.onChange((e) => t({
+				table: e.table,
+				op: e.op
+			})),
+			...e.scheduling === void 0 ? {} : {
+				disarmWhenIdle: e.scheduling.disarmWhenIdle,
+				drainIntervalMs: e.scheduling.admissionDrainMs,
+				cancelSweepIntervalMs: e.scheduling.cancelSweepMs,
+				stalenessSweepIntervalMs: e.scheduling.stalenessSweepMs
+			},
+			workflows: e.discovered.workflows ?? [],
+			facade: () => o,
+			cancelRunWithReason: re,
+			recordRunEvent: () => M?.recordEvent,
+			...e.workflowStaleness === void 0 ? {} : { staleness: e.workflowStaleness },
+			...e.workflowSuspendSignalHintMs === void 0 ? {} : { suspendSignalHintMs: e.workflowSuspendSignalHintMs },
+			scheduleCoordinated: c,
+			onAbandoned: async (t) => {
+				await _t({
+					workflows: e.discovered.workflows ?? [],
+					facade: () => o,
+					log: m,
+					...t
+				});
+			},
+			log: m
+		});
+		let g = d;
+		g !== void 0 && J(() => g.stop()), u = wt({
+			store: e.store,
+			onChange: (t) => e.store.onChange((e) => t({
+				table: e.table,
+				op: e.op
+			})),
+			...e.scheduling === void 0 ? {} : {
+				disarmWhenIdle: e.scheduling.disarmWhenIdle,
+				tickIntervalMs: e.scheduling.inferenceTickMs
+			},
+			enabled: (e.discovered.workflows?.length ?? 0) > 0,
+			resumeSignal: () => f === void 0 || j === void 0 ? void 0 : async ({ executionId: t, workflowName: n, signalName: r, payload: i }) => {
+				await f.runPromise(j.completeSuspendingSignal({
+					store: e.store,
+					target: tt(t, n),
+					signalName: r,
+					payload: i
+				}));
+			},
+			runEffect: (e) => f.runPromise(e),
+			scheduleCoordinated: c,
+			log: m
+		});
+		let ie = u;
+		ie !== void 0 && J(() => ie.stop()), o = (e.discovered.workflows?.length ?? 0) > 0 ? ni({
+			workflows: e.discovered.workflows ?? [],
+			runEffect: (e) => f.runPromise(e),
+			onEnqueue: () => ne?.publishWake(),
+			...g === void 0 ? {} : {
+				admitStart: g.gate.admitStart,
+				startPayloadSchema: g.gate.startPayloadSchema,
+				parkDelayedStart: g.gate.parkDelayed
+			},
+			rememberStartContext: oe,
+			signal: async (t, n, r) => {
+				let i = await j.sendWorkflowSignal({
+					store: e.store,
+					recorder: M,
+					target: t,
+					signalName: n,
+					payload: r
+				});
+				return await f.runPromise(j.completeSuspendingSignal({
+					store: e.store,
+					target: t,
+					signalName: n,
+					payload: r
+				})).catch(() => {}), i;
+			},
+			update: (t, n, r, i) => j.sendWorkflowUpdate({
+				store: e.store,
+				recorder: M,
+				target: t,
+				updateName: n,
+				payload: r,
+				...i === void 0 ? {} : { options: i }
+			}),
+			listRuns: (t) => Me(e.store, t),
+			retry: (t, n) => pe({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runPromise: (e) => f.runPromise(e)
+			}, t, n),
+			redrive: (t) => C({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runRedrive: r
+			}, t).then((e) => e.outcome)
+		}) : void 0;
+	}
+	let Gt = G.mergeAll(jt.toLayer(D), Mt), Kt = xt(D, e.discovered.queries.map((e) => e.descriptor.name), ve), qt = G.mergeAll(jt.toLayer(Kt), Mt), N = e.observability, Jt = await kr({
+		...e.appName === void 0 ? {} : { serviceName: e.appName },
+		...N && N.spanProcessors.length > 0 ? { extraSpanProcessors: N.spanProcessors } : {},
+		...N && N.metricReaders.length > 0 ? { extraMetricReaders: N.metricReaders } : {},
+		...N && Object.keys(N.resourceAttributes).length > 0 ? { resourceAttributes: N.resourceAttributes } : {},
+		...N && N.sampler !== void 0 ? { sampler: N.sampler } : {}
+	}), Yt = !1, Xt = e.store.ping ? () => e.store.ping().then(() => !0).catch(() => !1) : void 0, { server: P, shutdown: Zt } = hi({
+		group: jt,
+		handlersLayer: Gt,
+		httpHandlersLayer: qt,
+		port: e.port ?? 4e3,
+		...e.host === void 0 ? {} : { host: e.host },
+		path: e.path ?? "/ws",
+		tracerLayer: Jt.layer,
+		security: ue(e),
+		...bn(e),
+		...e.discovered.wsGateways !== void 0 && e.discovered.wsGateways.length > 0 ? { webSocketGateways: e.discovered.wsGateways } : {},
+		resolveGatewaySubject: async (t) => {
+			let n = await e.resolveSubject(t, -1);
+			return n.subject.type === "anonymous" ? null : {
+				subject: n.subject,
+				...n.credentialExpiresAt === void 0 ? {} : { credentialExpiresAt: n.credentialExpiresAt * 1e3 }
+			};
+		},
+		...at,
+		healthCheck: {
+			isReady: () => Yt,
+			...Xt ? { ping: Xt } : {}
+		},
+		...kt.length > 0 ? { httpRoutes: kt } : {},
+		...e.getStore === void 0 ? {} : { getStore: e.getStore },
+		...De.size > 0 ? { webhookRoutes: De } : {},
+		...e.inspectRoute === void 0 ? {} : { inspectRoute: e.inspectRoute }
+	}), Qt = oa(P);
+	if (await Er(P), (e.discovered.schedules?.length ?? 0) > 0) {
+		let t = (e.scheduleCoordination ?? "single") === "advisoryLock" ? Br(e.store, e.scheduleReplicaId ?? `pid-${process.pid}`) : mi;
+		h = await gi(e.discovered.schedules ?? [], {
+			store: e.store,
+			coordinator: t,
+			defaultTrigger: e.scheduleDefaultTrigger ?? "self",
+			replicaId: e.scheduleReplicaId ?? `pid-${process.pid}`,
+			armSelf: e.scheduleArmSelf ?? !0,
+			dormancy: e.dormancy ?? "always-on",
+			...e.dormancyTenantId === void 0 ? {} : { dormancyTenantId: e.dormancyTenantId },
+			buildContext: ({ traceId: t, scheduleName: n, subject: r }) => Ge({
+				subject: r,
+				traceId: t
+			}, e.store, void 0, `schedule:${n}`),
+			log: {
+				info: (e, t) => {
+					ie.info(e, t);
+				},
+				warn: (e, t) => {
+					ie.warn(e, t);
+				},
+				error: (e, t) => {
+					ie.error(e, t ?? {});
+				},
+				debug: () => {}
+			},
+			...e.scheduleFireInterceptor === void 0 ? {} : { interceptFire: e.scheduleFireInterceptor },
+			...e.onScheduleRunEvent === void 0 ? {} : { onRunEvent: e.onScheduleRunEvent }
+		}), e.onSchedulerReady?.(h);
+	}
+	let F = e.log ?? L({ scope: "voltro:serve" }), $t, en;
+	if ((e.discovered.subscribers?.length ?? 0) > 0 && ($t = Qe(e.discovered.subscribers ?? [], e.store, F.child("subscribe"), e.schemaRegistry, T.bus)), (e.discovered.reactions?.length ?? 0) > 0) {
+		let t = F.child("reaction"), n = async (n, r) => {
+			if (n.kind === "workflow") {
+				if (v === void 0) {
+					t.warn("reaction workflow act skipped — no workflow engine in this app", { workflow: n.workflow });
+					return;
+				}
+				let e = n.payload === void 0 ? r.new ?? r.old ?? {} : n.payload(r);
+				await ri(v, {
+					traceId: `reaction:${n.workflow}`,
+					source: `reaction:${n.workflow}`
+				}).start(n.workflow, e);
+				return;
+			}
+			await _e(n.agent, r, {
+				findAgentSend: (t) => e.discovered.actions.find((e) => e.descriptor.name === `${t}.send`),
+				runAction: (e, t, n) => Promise.resolve(ft(e, t, n)),
+				makeSubject: (e) => Vn(e),
+				now: () => Date.now(),
+				log: t
+			});
+		}, r = async (n, r) => {
+			try {
+				let { requireAiBudget: t } = await import("@voltro/ai");
+				return (await W.runPromise(W.either(t(e.store, {
+					tenantId: n,
+					limitUsd: r
+				}))))._tag === "Right";
+			} catch (e) {
+				return t.warn("reaction budget check failed — refusing the act", { tenantId: n }, e), !1;
+			}
+		}, i = Ze(e.store, { onError: (e) => t.warn("reaction: rate-slot claim failed; refusing the act", { cause: String(e) }) });
+		en = he(e.discovered.reactions ?? [], e.store, {
+			runAct: n,
+			checkBudget: r,
+			claimRateSlot: (e) => i.claim(e)
+		}, t);
+	}
+	let tn;
+	(e.discovered.aggregates?.length ?? 0) > 0 && (tn = await re({
+		discovered: e.discovered.aggregates ?? [],
+		store: e.store,
+		log: F.child("aggregate"),
+		...e.analytics === void 0 ? {} : { analytics: e.analytics },
+		...e.aggregateStorage === void 0 ? {} : { storage: e.aggregateStorage },
+		...e.aggregateCoordinator === void 0 ? {} : { coordinator: e.aggregateCoordinator }
+	}), Ke = G.succeed(hr, tn.registry));
+	let nn;
+	(e.discovered.expectations?.length ?? 0) > 0 && (nn = Cr({
+		discovered: e.discovered.expectations ?? [],
+		store: e.store,
+		log: F.child("expectation")
+	}), qe = G.succeed(yr, nn.registry)), (e.discovered.budgets?.length ?? 0) > 0 && (n = Tr({
+		discovered: e.discovered.budgets ?? [],
+		log: F.child("finops")
+	}), Je = G.succeed(gr, n.registry));
+	let rn;
+	return (e.discovered.experiments?.length ?? 0) > 0 && (rn = wr({
+		discovered: e.discovered.experiments ?? [],
+		store: e.store,
+		log: F.child("experiment")
+	}), Ye = G.succeed(br, rn.registry)), Yt = !0, e.bootTiming?.mark("ready"), {
+		dispatcher: r,
+		server: P,
+		scheduler: h,
+		eventsSnapshot: xe(T.bus, T.declared),
+		membersSnapshot: () => ({
+			members: He.membership.list(),
+			capturedAt: Date.now()
+		}),
+		agentTools: () => St,
+		rpcMetrics: () => rt,
+		webhooksService: () => Te,
+		runCanceller: () => s(),
+		flowControlHealth: () => d?.cancelHealth(),
+		inferenceHealth: () => u?.health(),
+		workflowWriteActions: () => v === void 0 || M === void 0 ? void 0 : y({
+			store: e.store,
+			log: F,
+			workflows: e.discovered.workflows ?? [],
+			workflowsProxy: o,
+			workflowRuntime: f,
+			workflowRunRecorder: M,
+			closeChildrenForParent: Rt
+		}),
+		redriveWorkflowRun: (e) => ee ? ee(e) : Promise.reject(/* @__PURE__ */ Error("redrive: this app registers no workflows")),
+		resumeWorkflowRunFromStep: (e) => te ? te(e) : Promise.reject(/* @__PURE__ */ Error("resume-from-step: this app registers no workflows")),
+		close: async () => {
+			Yt = !1, await Qt.drainRequests();
+			for (let e of ke) try {
+				await e();
+			} catch (e) {
+				F.warn("serve: teardown step failed", {}, e);
+			}
+			await Ue?.detach(), await He.detach(), tn?.detach(), nn?.detach(), n?.detach(), rn?.detach(), en?.(), $t?.(), await h?.shutdown(), r.close(), await ne?.detach(), await f?.dispose(), await Zt(), await Qt.finish();
+		}
+	};
+}, $ = L({ scope: "voltro:serve" }), bo = (e, t, n) => (e === "production" || e === "staging") && t !== "memory" && n !== "0", xo = N, So = async (e) => {
+	let t = On(process.cwd());
+	if (In(t)) {
+		let n;
+		try {
+			let e = await import(Ln(t).href);
+			typeof e.runServe == "function" ? n = e.runServe : $.warn("serve bundle has no runServe export — using the standard serve path");
+		} catch (e) {
+			$.warn("serve bundle failed to load — using the standard serve path", {}, e);
+		}
+		if (n) return $.info("serve: booting from the precompiled serve bundle"), n(e);
+	}
+	return Co(e);
+}, Co = async (c) => {
+	let l = kn();
+	e("serve");
+	try {
+		Ni();
+	} catch (e) {
+		throw i(e instanceof Error ? e.message : String(e));
+	}
+	let p = process.cwd(), m = await Ke(p), re = Jt({
+		kind: "api",
+		configPort: m?.port,
+		env: process.env,
+		flagPort: xo(c, "--port")
+	});
+	for (let e of re.warnings) $.warn(e);
+	let se = re.port;
+	di(li(m?.secrets)), await Xt({
+		rawEnv: m?.env,
+		appType: "api",
+		root: p,
+		log: $,
+		generateTypes: !1
+	}), l.mark("config");
+	let _ = (process.env.DB_DIALECT ?? m?.store ?? "memory").toLowerCase(), le = (_ === "mariadb" || _ === "postgres" || _ === "mssql") && (process.env.CDC ?? "1") !== "0", fe = _ === "mariadb" ? "mariadb" : _ === "mssql" ? "mssql" : void 0, pe = Dn(p);
+	if (!r() && In(pe)) try {
+		let e = await import(Ln(pe).href);
+		if (e.modules) {
+			let t = {};
+			for (let [n, r] of Object.entries(e.modules)) t[Pn(p, n)] = r;
+			n(t), $.info("precompiled api bundle loaded", { modules: Object.keys(t).length });
+		}
+	} catch (e) {
+		$.warn("precompiled api bundle failed to load — falling back to source", {}, e);
+	}
+	let y = await Ct(p), b = await Pt(y, { cdc: le && fe !== void 0 }), me = ee(b);
+	{
+		Ye({
+			plugins: m?.plugins ?? [],
+			queries: b.queries,
+			mutations: b.mutations,
+			actions: b.actions,
+			streams: b.streams,
+			log: $
+		});
+		let e = v(b.serverOnlyLeaks, ce(process.env, "strict"), Nr, "`voltro serve`");
+		if (e.action === "fail") throw i(e.message ?? "");
+		e.action === "warn" && $.warn(e.message ?? "");
+	}
+	let he = y.filter((e) => En.test(e)), ge = he.length > 0 ? await Tn(he, $.child("webhooks")) : {
+		outgoing: [],
+		incoming: [],
+		providers: []
+	}, _e = Cn(b.events), be = ge.outgoing.length + ge.incoming.length + ge.providers.length + _e.length === 0 ? void 0 : {
+		...ge,
+		outgoing: [...ge.outgoing, ..._e]
+	}, xe = sn({
+		nodeEnv: process.env.NODE_ENV,
+		cdcDialect: fe,
+		declared: m?.schema
+	}), Ce = cn({
+		gates: xe,
+		runtime: {
+			traces: ae(),
+			undo: vi()
+		}
+	});
+	if (Ce !== void 0) throw i(`serve: ${Ce}`);
+	let Oe = on({
+		mix: b.featureMix,
+		plugins: m?.plugins ?? [],
+		gates: xe,
+		...fe ? { cdcDialect: fe } : {}
+	}), Me = m?.analytics !== void 0 && m.analytics.kind !== "noop" && _ !== "memory" ? (await P(_)).makeSqlLayer(O()) : void 0, Ne = await D({
+		spec: m?.analytics,
+		sqlLayer: Me,
+		log: $
+	}), C = (() => {
+		let e = new Set(b.tables.map((e) => e.tableName)), t = [...b.tables];
+		for (let n of [...Oe, ...Ne.tables]) e.has(n.tableName) || (e.add(n.tableName), t.push(n));
+		return t;
+	})();
+	for (let e of C) or(e);
+	{
+		let e = Pr(yi(zt(b), Ae(C)));
+		e !== void 0 && $.warn(e);
+	}
+	let Fe = (process.env.NODE_ENV ?? "").toLowerCase();
+	if (bo(Fe, _, process.env.VOLTRO_AUTO_MIGRATE)) {
+		let e = (await P(_)).makeSqlLayer(O()), t = await W.runPromise(ur.SqlClient.pipe(W.flatMap((e) => pr(e, p)), W.provide(e), W.catchAll(() => W.succeed([]))));
+		t.length > 0 && ($.error(`serve: refusing to boot — ${t.length} pending file-based migration(s) have never run against this database. They perform the changes a schema diff cannot infer (data moves, backfills, table splits), so the declarative fingerprint check below cannot see them and would have let this process serve un-migrated data.`, { pending: t }), $.error("Run them from your pre-deploy job — `voltro db migrate .` (schema + files) or `voltro db files .` (files alone) — or set VOLTRO_AUTO_MIGRATE=0 to bypass every boot schema check. `voltro serve` never applies them itself: a rolling deploy would start N replicas and each would try."), process.exit(1));
+		let n = await W.runPromise(ur.SqlClient.pipe(W.flatMap((e) => mr(e, C, {
+			appliedBy: `serve:${Fe}`,
+			environment: "prod",
+			dialectId: _
+		})), W.provide(e)));
+		n.kind === "prod-mismatch" && ($.error(fr(n, _)), $.error(ln({
+			gates: xe,
+			nodeEnv: process.env.NODE_ENV,
+			cdcDialect: fe,
+			declared: m?.schema
+		})), $.error("serve: refusing to boot — apply the schema first (voltro db apply in a pre-deploy step), or set VOLTRO_AUTO_MIGRATE=0 to bypass this check."), process.exit(1)), $.info(fr(n, _));
+	}
+	await en({
+		dialectId: _,
+		tables: C,
+		mode: F(m?.reactiveTriggers),
+		lockSchema: O().schema,
+		makeLayer: async () => (await P(_)).makeSqlLayer(O()),
+		log: {
+			info: (e, t) => $.info(e, t ?? {}),
+			warn: (e, t) => $.warn(e, t ?? {})
+		}
+	});
+	let Ie = ti(C);
+	l.mark("discover");
+	let w = await ct(m, void 0);
+	{
+		let e = await s(w);
+		if (e !== void 0) throw i(`serve: ${e}`);
+	}
+	let Ve = Si(w, _);
+	for (let e of j({
+		dialect: String(m?.store ?? process.env.DB_DIALECT ?? "postgres"),
+		changeStrategy: (process.env.CDC ?? "1") === "0" ? "inline" : "cdc",
+		dbUrl: process.env.DB_URL,
+		crossReplicaBus: Li(m?.plugins ?? [])?.broadcast.crossReplica === !0,
+		tables: b.tables.map((e) => ({
+			tableName: e.tableName,
+			isReactive: e.isReactive === !0
+		})),
+		querySources: b.queries.flatMap((e) => {
+			let t = e.descriptor.source;
+			return t === void 0 ? [] : typeof t == "string" ? [t] : [...t];
+		})
+	})) e.level === "warn" ? $.warn(e.message) : $.info(e.message);
+	{
+		let e = rt({
+			tables: tr().map((e) => ({ tableName: e.tableName })),
+			queries: b.queries.map((e) => ({
+				name: e.descriptor.name,
+				source: e.descriptor.source
+			}))
+		}), t = Be(e);
+		t !== void 0 && $.warn(t);
+	}
+	m?.cache && !process.env.CACHE_BACKEND && (process.env.CACHE_BACKEND = m.cache), m?.cacheRedisUrl && !process.env.CACHE_REDIS_URL && (process.env.CACHE_REDIS_URL = m.cacheRedisUrl), m?.cacheRedisDriver && !process.env.CACHE_REDIS_DRIVER && (process.env.CACHE_REDIS_DRIVER = m.cacheRedisDriver), m?.cacheKeyPrefix && !process.env.CACHE_KEY_PREFIX && (process.env.CACHE_KEY_PREFIX = m.cacheKeyPrefix);
+	let { service: We, invalidationBus: Xe, snapshotCache: Ze, cache: Qe, semantic: $e, evictSource: tt, backend: lt, stats: gt, dispose: _t } = await ot({
+		env: process.env,
+		semantic: m?.cacheSemantic ?? !1
+	});
+	$e !== void 0 && $.info("semantic cache enabled — reactive eviction on live writes"), $.info(`cache backend resolved: ${lt}` + (lt === "redis" ? ` (driver ${process.env.CACHE_REDIS_DRIVER ?? "resp"})` : " — in-process, not cross-instance")), w.onChange((e) => {
+		if (W.runFork(Xe.publish(e.table)), tt !== void 0) {
+			let t = (e.new ?? e.old)?.id;
+			tt({
+				table: e.table,
+				op: e.op,
+				...t === void 0 ? {} : { id: t }
+			});
+		}
+	}), m?.kv && !process.env.KV_BACKEND && (process.env.KV_BACKEND = m.kv), m?.kvRedisUrl && !process.env.KV_REDIS_URL && (process.env.KV_REDIS_URL = m.kvRedisUrl), m?.kvKeyPrefix && !process.env.KV_KEY_PREFIX && (process.env.KV_KEY_PREFIX = m.kvKeyPrefix);
+	let { kv: xt, service: wt } = await Wr({ store: w });
+	ye({
+		log: $,
+		max: Qt(),
+		outOfPool: h(_, (process.env.CDC ?? "1") !== "0"),
+		readPools: t.replicationSnapshot()?.replicaCount ?? 0,
+		always: !0
+	}), l.mark("store");
+	let Tt = Sr({
+		store: w,
+		sink: Ne.sink,
+		log: $
+	}), Et = yt({
+		store: w,
+		dialect: _,
+		log: { info: (e) => $.info(e) }
+	}), A = m?.plugins ?? [], Ft = process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, It, Lt;
+	_ !== "memory" && (It = lr.make((await P(_)).makeSqlLayer(O()).pipe(G.provideMerge(Rn({})))), Lt = await It.runPromise(ur.SqlClient));
+	let Ut = [
+		"postgres",
+		"mariadb",
+		"mysql",
+		"mssql"
+	].includes(_) ? Br(w, Ft, $) : mi, N = Gt(m?.scheduling), bn = Kr({
+		maxIdleIntervalMs: N.pollCeilingMs,
+		coordinator: Ut,
+		replicaId: Ft,
+		log: $
+	}), wn = [], On = process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, An = Li(m?.plugins ?? [])?.broadcast?.provider, jn = ze(m?.plugins, m?.name ?? Nn(p));
+	{
+		let e = nt(m?.plugins, m?.name ?? Nn(p));
+		e !== void 0 && $.warn(e);
+	}
+	let Mn = Wt(m?.plugins, {
+		instanceId: On,
+		namespace: jn,
+		meta: { mode: "serve" },
+		logger: $
+	}), I = yn({
+		mode: "serve",
+		dialect: _,
+		...An === void 0 ? {} : { provider: An },
+		logger: $
+	});
+	J(async () => {
+		await I.stop();
+	}), k(m?.reactive);
+	let Fn = {
+		...Lt ? { sql: Lt } : {},
+		instanceId: On,
+		membership: Mn.membership,
+		...An === void 0 ? {} : { broadcast: An },
+		broadcastChannels: { presence: Ii(jn, "presence") },
+		scheduleCoordinated: (e, t, n) => {
+			let r = bn(e, t, n);
+			return wn.push(r), r;
+		}
+	};
+	for (let e of A) e.bindDataStore?.(Ve, Fn);
+	dt({
+		store: w,
+		...u(),
+		log: $
+	});
+	let zn = A.filter((e) => typeof e.onChangeEvent == "function");
+	if (zn.length > 0) {
+		let e = w.changeScope ?? "local";
+		w.onChange((t) => {
+			let n = oe(t, e);
+			for (let e of zn) W.runFork(e.onChangeEvent(n).pipe(W.catchAllCause((t) => W.sync(() => $.warn(`plugin ${e.name} onChangeEvent failed`, { error: cr.pretty(t) })))));
+		});
+	}
+	let Bn = y.filter((e) => fn.test(e));
+	Bn.length > 0 && (await Re(Bn, $), $.info(`queue: ${Bn.length} consumer file(s) loaded`));
+	let R = Pe({
+		plugins: A,
+		appName: m?.name ?? "voltro-api",
+		appType: "api",
+		voltroVersion: process.env.npm_package_version ?? "0.0.0",
+		log: $
+	});
+	A.length && await R.activate(), l.mark("plugins");
+	let Vn = await R.gatherObservability(), Hn = L({ scope: "voltro:broadcast" }), Un = {
+		info: (e, t) => {
+			Hn.info(e, t);
+		},
+		warn: (e, t) => {
+			Hn.warn(e, t);
+		},
+		debug: () => {}
+	}, z, Wn = await vt(w, m, _, jn, Un, (e, t) => {
+		z?.refreshAll(`broadcast gap: missed ${t} change(s) from ${e}`);
+	}), Gn = m?.apiKeys, Kn = (typeof Gn == "object" ? Gn.prefix : void 0) ?? "voltro_", B = Gn ? Mr(w) : void 0, V = B ? Hr({ flush: Ur(B) }) : void 0;
+	V && J(() => V.shutdown());
+	let qn = B ? Vr(B, {
+		prefix: Kn,
+		...V ? { usage: V } : {}
+	}) : void 0, Jn = qn ? [Fr(qn, { prefix: Kn })] : [], Yn = Dt([...m?.auth?.strategies ?? [], ...Jn], Wi(m?.plugins ?? []), m?.auth?.anonymousTenantRequired ?? !1, m?.auth, () => Ve), Xn = [...m?.restRoutes ?? [], ...qn ? xr(qn, (typeof Gn == "object" ? Gn.managementPath : void 0) ?? "/v1/api-keys") : []], Zn = He(m?.idempotency, w), Qn = A.map((e) => e.services).filter((e) => e !== void 0), $n = G.mergeAll(qe({
+		analyticsLayer: Ne.layer,
+		cacheService: We,
+		kvService: wt,
+		...$e === void 0 ? {} : { semanticCache: $e },
+		pluginServices: Qn,
+		userLayers: m?.layers ?? []
+	}), At(m?.http ?? {})), H = await St({
+		files: y,
+		store: w,
+		log: $,
+		seedPolicy: "report",
+		seedPattern: dn,
+		loadSeedFiles: $t,
+		startupPattern: un,
+		loadStartupFiles: a,
+		runStartups: o,
+		emailPattern: jt,
+		loadEmailFiles: Je,
+		registerEmailTemplates: Gi
+	});
+	(H.startupCount > 0 || H.emailCount > 0) && $.info("boot lifecycle", {
+		startups: H.startupCount,
+		emailTemplates: H.emailCount
+	}), H.startups !== void 0 && J(async () => {
+		await H.startups.stop();
+	}), Ee({
+		demands: qt(me),
+		isRegistered: (e) => Ir(e) !== void 0
+	});
+	let er = ut({
+		schedules: T({
+			schedules: b.schedules,
+			seeds: H.seeds,
+			store: w,
+			log: $.child("seeds")
+		}),
+		workflows: b.workflows ?? [],
+		log: $.child("workflow-schedules")
+	}), nr = m?.scheduling ?? {}, ir = nr.trigger ?? "self", ar = /* @__PURE__ */ new Set([
+		"postgres",
+		"mysql",
+		"mariadb",
+		"mssql"
+	]), U = nr.coordination ?? (ar.has(_) ? "advisoryLock" : "single"), sr = U === "cluster" && ar.has(_), hr = sr ? "cluster" : U === "advisoryLock" && ar.has(_) ? "advisoryLock" : "single";
+	U === "cluster" && !sr && $.warn("scheduling.coordination=cluster needs a sql-backed store except sqlite — falling back to single"), U === "advisoryLock" && !ar.has(_) && $.warn("scheduling.coordination=advisoryLock needs a SQL store (the claim-row gate) — falling back to single");
+	let gr, _r = b.workflows.length > 0 || b.workflowWorkers.length > 0 || b.eventTriggers.length > 0 || (be?.outgoing.length ?? 0) > 0 || sr, vr;
+	if (_r) {
+		if (_ === "mssql") {
+			let e = await Sn(process.cwd());
+			e && $.warn(e);
+		}
+		let [{ WorkflowEngine: e }, { makeClusterCronLayer: t, workflowEngineLayer: n, resolveRunnerStorage: r, resolveFailoverTuning: i }] = await Promise.all([import("@effect/workflow"), import("@voltro/workflow/cluster")]), a = sr ? er.filter((e) => (e.trigger ?? ir) === "self").map((e) => t({
+			name: e.name,
+			cron: jr(e),
+			execute: async () => {
+				await gr?.fireFromCluster(e.name);
+			}
+		})) : [];
+		vr = _ === "memory" ? e.layerMemory : await (async () => {
+			let e = await P(_), t = r({ sqliteFamily: e.id === "sqlite" || e.id === "turso" });
+			return $.info(`workflow engine: cluster-${t}, dialect=${e.id}` + (t === "memory" ? " — single-process durable replay, no cross-pod shard handoff" + (e.id !== "sqlite" && e.id !== "turso" ? " (VOLTRO_WORKFLOW_RUNNER_STORAGE=memory: SqlRunnerStorage/cluster_runners + GET_LOCK skipped)" : "") : "")), n({
+				sqlClientLayer: e.makeSqlLayer(O()),
+				runnerStorage: t,
+				dialectId: e.id,
+				...process.env.VOLTRO_WORKFLOW_RUNNER_PORT ? { runnerListenPort: Number(process.env.VOLTRO_WORKFLOW_RUNNER_PORT) } : {},
+				...i(),
+				...a.length > 0 ? { extraShardingLayers: a } : {}
+			});
+		})();
+	}
+	let yr = de(A, xn()), br = y.filter((e) => /\.subscribe\.tsx?$/.test(e)), Cr = br.length > 0 ? await Nt(br, $) : [], wr = y.filter((e) => /\.reaction\.tsx?$/.test(e)), Tr = wr.length > 0 ? await Se(wr, $) : [], Er = y.filter((e) => hn.test(e)), Dr = Er.length > 0 ? await we(Er, $) : [], Or = y.filter((e) => /\.aggregate\.tsx?$/.test(e)), K = Or.length > 0 ? await ht(Or, $) : [];
+	{
+		let e = Pr(yi(zt({ aggregates: K.map((e) => e.definition) }), Ae(C)));
+		e !== void 0 && $.warn(e);
+	}
+	let kr = f();
+	if (K.length > 0 && _ !== "memory") try {
+		let e = (await P(_)).makeSqlLayer(O());
+		kr = ft(e);
+	} catch (e) {
+		$.warn("aggregate: SQL storage init failed — falling back to in-process", { err: String(e) });
+	}
+	let Ar = _ === "memory" ? mi : Br(w, `aggregate@${process.pid}`, $), Lr = y.filter((e) => pn.test(e)), Rr = Lr.length > 0 ? await je(Lr, $) : [], zr = y.filter((e) => gn.test(e)), Gr = zr.length > 0 ? await Bt(zr, $) : [], qr = y.filter((e) => mn.test(e)), Jr = qr.length > 0 ? await ie(qr, $) : [], Yr = [], Xr = [], Zr = y.filter((e) => tn.test(e));
+	if (Zr.length > 0) {
+		let e = $.child("agent"), t = y.filter((e) => an.test(e));
+		t.length > 0 && await nn(t, e);
+		let n = await rn(Zr, e);
+		for (let e of n.agents) for (let t of bt(e)) (t.kind === "action" ? Yr : Xr).push({
+			file: t.file,
+			descriptor: t.descriptor,
+			executor: t.executor
+		});
+		n.agents.length > 0 && e.info("synthesized agent routes", { agents: n.agents.map((e) => e.descriptor.name) });
+	}
+	l.mark("workflow");
+	let q = () => {
+		let e = Y.workflowWriteActions();
+		if (e === void 0) throw Error("workflow actions: this app registers no workflows");
+		return e;
+	}, Qr = rr({
+		dialect: _,
+		...O()
+	}), $r = _ === "memory" ? void 0 : (await P(_)).makeSqlLayer(O()), ei = async () => kt({
+		sqlLayer: $r,
+		declared: C,
+		log: $
+	}), ni = {
+		kind: "api",
+		meta: {
+			name: m?.name ?? "voltro-api",
+			voltroVersion: Mt,
+			port: se,
+			mode: "start",
+			store: _,
+			cdc: le ? "on" : "off",
+			...Qr === void 0 ? {} : { databaseId: Qr }
+		},
+		rpc: Ht(b, p),
+		workflows: De(b, p),
+		migrations: ei,
+		events: () => Y.eventsSnapshot(),
+		agentTools: () => Y.agentTools(),
+		invariantChecks: () => ({
+			mode: "serve",
+			accessGate: me,
+			config: m,
+			serverOnlyLeaks: b.serverOnlyLeaks,
+			migrations: ei
+		}),
+		members: () => Y.membersSnapshot(),
+		inspectFireSchedule: async ({ name: e, trigger: t }) => {
+			if (!gr) throw Error("scheduler not started — this app registers no self-triggered schedules (all schedules are trigger:'external', or there are none).");
+			return { runId: await gr.fireNow(e, t) ?? null };
+		},
+		inspectBackfillSchedule: ne({
+			getHandle: () => gr,
+			getSchedules: () => er
+		}),
+		...be === void 0 ? {} : { webhooks: () => pt({
+			store: w,
+			discoveredWebhooks: be
+		}) },
+		plugins: () => ({
+			plugins: R.snapshot(),
+			capturedAt: Date.now()
+		}),
+		env: () => Yt(m?.name ?? Nn(p), {
+			...m?.env !== void 0 && Mi(m.env) ? { contract: m.env } : {},
+			plugins: m?.plugins ?? []
+		}),
+		dataCache: () => Vt({
+			stats: gt,
+			backendKind: lt
+		}),
+		subscriptions: () => x(() => z),
+		inspectTables: () => Te(C),
+		inspectRows: Kt({
+			store: w,
+			tables: C,
+			mask: !0
+		}),
+		metrics: (e) => Y.rpcMetrics().snapshot(e),
+		cluster: () => Ue({
+			store: w,
+			dialect: _,
+			useClusterCron: sr,
+			scheduleCoordChoice: U
+		}),
+		inspectSchedules: () => g({
+			schedules: er,
+			defaultTrigger: ir,
+			coordination: hr
+		}),
+		inspectScheduleRuns: (e) => ke(w, e),
+		...Rt(w, {
+			controls: it(b.workflows ?? []),
+			active: (b.workflows?.length ?? 0) > 0,
+			cancellation: () => Y.flowControlHealth()
+		}),
+		webhookActions: te(() => Y.webhooksService()),
+		inspectStartWorkflow: (e) => q().inspectStartWorkflow(e),
+		inspectCancelWorkflowRun: (e) => q().inspectCancelWorkflowRun(e),
+		inspectSuspendWorkflowRun: (e) => q().inspectSuspendWorkflowRun(e),
+		inspectResumeWorkflowRun: (e) => q().inspectResumeWorkflowRun(e),
+		inspectDiscardWorkflowRun: (e) => q().inspectDiscardWorkflowRun(e),
+		inspectRetryWorkflowRun: (e) => q().inspectRetryWorkflowRun(e),
+		inspectSignalWorkflowRun: (e) => q().inspectSignalWorkflowRun(e),
+		inspectUpdateWorkflowRun: (e) => q().inspectUpdateWorkflowRun(e),
+		inspectInferences: (e) => E({
+			store: w,
+			active: (b.workflows?.length ?? 0) > 0,
+			dispatcher: () => Y.inferenceHealth()
+		}, e.limit === void 0 ? {} : { limit: e.limit }),
+		...st({
+			store: w,
+			cancelRun: async (e) => await Y.runCanceller()?.(e) ?? !1,
+			retryRun: async (e) => q().inspectRetryWorkflowRun({ runId: e }),
+			redriveRun: async (e) => Y.redriveWorkflowRun({ runId: e }),
+			log: $
+		}),
+		inspectRedriveWorkflowRun: (e) => Y.redriveWorkflowRun(e),
+		inspectResumeWorkflowRunFromStep: (e) => Y.resumeWorkflowRunFromStep(e)
+	}, ri = (process.env.VOLTRO_TENANT_ISOLATION ?? m?.tenancy?.isolation) === "namespace", ii = ri && _ !== "memory" ? await (async () => {
+		let e = await P(_);
+		return et({
+			tables: C,
+			sqlLayer: e.makeSqlLayer(O()),
+			dialect: _,
+			options: { retryFilter: e.retryFilter },
+			log: {
+				info: (e, t) => $.info(e, t),
+				error: (e, t, n) => $.error(e, t ?? {}, n)
+			}
+		});
+	})() : void 0, ai = await at({
+		input: m?.tenancy?.residency,
+		namespaceIsolationOn: ri,
+		makeStoreForUrl: (e, t) => ct(m, void 0, Zt(O(), t)),
+		log: {
+			info: (e, t) => $.info(e, t),
+			warn: (e, t) => $.warn(e, t)
+		}
+	});
+	ai !== void 0 && J(async () => {
+		await ai.close();
+	});
+	let Y = await yo({
+		bootTiming: l,
+		broadcastNamespace: jn,
+		scheduling: (() => {
+			let e = N;
+			return {
+				admissionDrainMs: e.admissionDrainMs,
+				inferenceTickMs: e.inferenceTickMs,
+				cancelSweepMs: e.cancelSweepMs,
+				stalenessSweepMs: e.stalenessSweepMs,
+				disarmWhenIdle: M({
+					changeScope: w.changeScope,
+					broadcastAttached: Wn !== void 0
+				})
+			};
+		})(),
+		...m?.workflows?.staleness === void 0 ? {} : { workflowStaleness: m.workflows.staleness },
+		...m?.workflows?.suspendSignalHintMs === void 0 ? {} : { workflowSuspendSignalHintMs: m.workflows.suspendSignalHintMs },
+		workflowRecording: Ge(m?.workflows?.recording),
+		membership: {
+			...Mn,
+			instanceId: On
+		},
+		security: {
+			defaultDeny: S(m),
+			...ue(m)
+		},
+		approvals: { defaultExpiryMs: Le(m) },
+		...m?.plugins === void 0 ? {} : { plugins: m.plugins },
+		...Zn ? { idempotency: Zn } : {},
+		restRoutes: Xn,
+		...m?.grpc === void 0 ? {} : { grpc: {
+			config: m.grpc,
+			root: p
+		} },
+		appProcedures: me,
+		discovered: {
+			wsGateways: b.wsGateways,
+			queries: [...b.queries, ...Xr],
+			mutations: b.mutations,
+			actions: [...b.actions, ...Yr],
+			streams: b.streams,
+			events: b.events,
+			workflows: b.workflows,
+			workflowWorkers: b.workflowWorkers,
+			eventTriggers: b.eventTriggers,
+			schedules: er,
+			subscribers: Cr,
+			outboxHandlers: Dr,
+			connections: b.connections,
+			reactions: Tr,
+			aggregates: K,
+			expectations: Rr,
+			budgets: Gr,
+			experiments: Jr,
+			...be === void 0 ? {} : { webhooks: be }
+		},
+		log: $,
+		analytics: Ne.sink,
+		aggregateStorage: kr,
+		aggregateCoordinator: Ar,
+		store: w,
+		kv: xt,
+		cache: Qe,
+		snapshotCache: Ze,
+		...m?.reactive === void 0 ? {} : { reactive: m.reactive },
+		schemaRegistry: Ie,
+		tenantScopedTables: b.tenantScopedTables,
+		softDeleteScopedTables: b.softDeleteScopedTables,
+		dataTransferSnapshot: dr(C, _),
+		dataTransferDialect: _,
+		...ii === void 0 ? {} : { ensureTenantProvisioned: ii.ensure },
+		...ai === void 0 ? {} : { resolveResidentStore: ai.resolveStore },
+		tenantIsolation: (process.env.VOLTRO_TENANT_ISOLATION ?? m?.tenancy?.isolation) === "namespace" ? "namespace" : "shared-schema",
+		resolveSubject: (e, t) => Yn({
+			headers: e,
+			clientId: t
+		}),
+		...m?.auth === void 0 ? {} : { authority: m.auth },
+		...m?.agents === void 0 ? {} : { agents: m.agents },
+		httpRoutes: A.flatMap((e) => e.httpRoutes ?? []),
+		getStore: () => Ve,
+		...$n ? { baseLayer: $n } : {},
+		...vr === void 0 ? {} : { workflowEngineLayer: vr },
+		scheduleDefaultTrigger: ir,
+		scheduleCoordination: hr,
+		scheduleArmSelf: !sr,
+		dormancy: process.env.VOLTRO_DORMANCY === "sleep" || process.env.VOLTRO_DORMANCY === "always-on" ? process.env.VOLTRO_DORMANCY : m?.dormancy ?? "always-on",
+		scheduleReplicaId: process.env.HOSTNAME ?? `pid-${process.pid}`,
+		...yr === void 0 ? {} : { scheduleFireInterceptor: yr },
+		onSchedulerReady: (e) => {
+			gr = e;
+		},
+		inspectRoute: { handle: async (e, t, n, r) => await ve(e, ni, t, {
+			method: n,
+			...r === void 0 ? {} : { body: r }
+		}) || ((n === "GET" ? await vn(e, ni, t, { method: n }) : null) ?? _n(e, ni, t, {
+			method: n,
+			...r === void 0 ? {} : { body: r }
+		}) ?? {
+			status: 404,
+			contentType: "application/json",
+			body: JSON.stringify({ error: "not an inspect route" })
+		}) },
+		...m?.name === void 0 ? {} : { appName: m.name },
+		observability: Vn,
+		port: se,
+		...m?.transport?.wsPath ? { path: m.transport.wsPath } : {},
+		...m?.http === void 0 ? {} : { http: m.http }
+	});
+	return z = Y.dispatcher, d(mt([
+		b.queries,
+		b.mutations,
+		b.actions,
+		b.streams
+	]), (e) => {
+		$.warn(e);
+	}), $.info(`API listening on :${se}`, {
+		dialect: _,
+		queries: b.queries.length,
+		mutations: b.mutations.length,
+		actions: b.actions.length,
+		streams: b.streams.length,
+		workflows: b.workflows.length,
+		workflowWorkers: b.workflowWorkers.length,
+		schedules: er.length,
+		scheduleCoordination: hr
+	}), l.finish($), J(async () => {
+		for (let e of wn) e.stop();
+		Et.stop();
+		try {
+			await Y.close(), _t(), It?.dispose(), await R.deactivate(), await Wn?.close(), await Ot({
+				mirror: Tt,
+				log: $
+			}), await Ne.dispose(), await w.close?.();
+		} catch (e) {
+			console.error("serve: shutdown step failed, exiting anyway:", e);
+		}
+	}), await new Promise(() => {}), 0;
+};
+//#endregion
+export { So as n, bo as r, Co as t };