@voltro/cli 0.55.0 → 0.57.0

package/dist/serveCommand-B_w-Mpb_.js

@@ -0,0 +1,2544 @@
+import { t as e } from "./nodeEnvironment-cGFAj1J8.js";
+import { t } from "./frameworkInspectState-CX2250XB.js";
+import { r as n, t as r } from "./appModuleLoader-C9r9mxZt.js";
+import { t as i } from "./bootRefusal-pgvDxlrU.js";
+import { n as a, r as o } from "./startupRunner-CEqQq7ax.js";
+import { n as s, t as c } from "./interruptedReplace-CwnkBb2X.js";
+import { $ as l, $t as u, A as d, An as f, At as p, Bn as ee, Bt as te, C as ne, Cn as m, Ct as h, D as re, Dn as g, Dt as ie, E as ae, En as oe, Et as se, F as ce, Fn as le, Ft as _, G as ue, Gt as de, H as v, Hn as fe, Ht as pe, I as me, It as he, J as ge, Kt as _e, L as y, Ln as ve, Lt as ye, M as be, Mn as xe, Mt as b, N as Se, Nn as Ce, Nt as x, O as we, On as Te, Ot as S, P as Ee, Pn as De, Pt as Oe, Q as ke, Qt as Ae, R as je, Rn as Me, Rt as Ne, S as C, Sn as Pe, St as Fe, T as Ie, Tn as Le, Tt as Re, U as ze, Ut as Be, V as Ve, Vn as He, Vt as Ue, W as We, Wt as Ge, X as Ke, Y as qe, Yt as Je, Z as Ye, Zt as Xe, _ as Ze, _n as Qe, _t as $e, an as w, at as et, b as tt, bn as nt, bt as rt, c as it, cn as T, ct as at, d as ot, dn as st, dt as ct, en as lt, et as E, fn as ut, ft as dt, g as D, gn as O, gt as ft, h as pt, hn as mt, ht, i as gt, in as _t, it as k, j as vt, jn as yt, jt as bt, k as xt, kt as St, ln as Ct, lt as wt, m as Tt, mn as Et, mt as Dt, nn as Ot, nt as A, o as j, on as kt, ot as At, p as jt, pn as Mt, pt as Nt, qt as Pt, r as Ft, rn as It, rt as Lt, sn as Rt, st as zt, t as Bt, tn as Vt, tt as Ht, u as Ut, un as M, ut as Wt, v as Gt, vn as N, vt as Kt, w as qt, wn as Jt, wt as Yt, x as Xt, xn as Zt, xt as P, y as F, yn as Qt, yt as $t, z as en, zn as tn, zt as nn } from "./dev-DOEJXicj.js";
+import { Kt as rn, Wt as an, Zt as on, dt as sn, ft as cn, lt as ln, ot as un, ut as dn } from "./webDev-BgdkyjP6.js";
+import { g as fn, s as pn } from "./inspect-DZnan87F.js";
+import { n as mn } from "./cliArgs-D4p8n7EE.js";
+import { r as hn } from "./appPort-B_HpJ_ck.js";
+import { r as gn, u as _n } from "./apiBuild-DDr2aNFd.js";
+import { r as vn } from "./dialectDriver-czCHYpeH.js";
+import { i as yn, n as bn } from "./connectionConfig-Bk9IC7D0.js";
+import { c as xn, n as Sn, o as Cn } from "./seedRunner-DISBKow-.js";
+import { f as wn, g as Tn, h as En, m as Dn, r as On } from "./frameworkTableAssembly-vfkzuzEo.js";
+import { n as kn, r as An, t as jn } from "./declaredSchemaGates-BlcwObhb.js";
+import { C as Mn, a as Nn, h as Pn, l as Fn, n as In, u as Ln, w as Rn } from "./fileConventions-l-RIXbx8.js";
+import { i as zn, n as Bn, t as Vn } from "./inspectMetrics-BY0Sjb2F.js";
+import { n as Hn } from "./mssqlClusterPatch-_4cE_nun.js";
+import { i as Un, n as Wn, r as Gn, t as Kn } from "./webhookDiscovery-CphsQe59.js";
+import { t as qn } from "./bootTiming-BdyP9nYw.js";
+import { a as Jn, o as Yn, t as Xn } from "./dataProfile-Du3ztYxv.js";
+import I, { basename as Zn, join as Qn } from "node:path";
+import { createWriteStream as $n, existsSync as er } from "node:fs";
+import { pathToFileURL as tr } from "node:url";
+import { LoggerLayer as nr, createLogger as L } from "@voltro/logger";
+import { AuthMiddleware as rr, ConnectionInfoMiddleware as R, actionToRpc as z, anonymousSubject as ir, isWireReachable as ar, mutationToRpc as or, queryToRpc as B, streamToRpc as sr, wireErrorUnion as cr, workflowCancelDescriptor as lr, workflowDomainEventsQueryDescriptor as ur, workflowEventDeliveriesQueryDescriptor as dr, workflowResumeDescriptor as fr, workflowRunEventsQueryDescriptor as pr, workflowRunQueryDescriptor as mr, workflowRunStepsQueryDescriptor as hr, workflowRunsQueryDescriptor as gr, workflowSignalDescriptor as _r, workflowUpdateDescriptor as vr } from "@voltro/protocol";
+import { DATA_TRANSFERS_TABLE as V, _voltroDataTransfersTable as yr, allRegisteredTables as br, and as xr, connectionIdentity as Sr, derivedRowId as Cr, describeTransferRun as wr, ensureTableRegistered as Tr, eq as H, or as Er } from "@voltro/database";
+import { appMode as Dr, frameworkVersion as Or, instanceId as kr, replicaId as Ar, resolveAdvertisedHost as jr, setProcessAdvertisedAddress as Mr, setProcessBootPath as Nr } from "@voltro/protocol/identity";
+import { AggregateRegistry as Pr, CostRegistry as U, DORMANCY_WAKEUP_TENANT as Fr, Dispatcher as Ir, ExpectationRegistry as Lr, ExperimentRegistry as Rr, apiKeyManagementRoutes as zr, attachAnalyticsMirror as Br, attachExpectations as Vr, attachExperiments as Hr, attachFinops as Ur, awaitServerListening as Wr, bindMutation as Gr, bindStream as Kr, bindSubscription as W, buildTracingLayer as qr, cancelWakeup as Jr, compileCron as Yr, dataStoreApiKeyStore as Xr, formatServerOnlyLeaks as Zr, formatUnresolvedSources as Qr, frameworkApiKeyStrategy as $r, getResourcePolicy as ei, installPolicyGuardResolver as ti, loadResourceTuples as ni, makeActionRunner as ri, makeAdvisoryLockCoordinator as ii, makeApiKeyService as ai, makeApiKeyUsageBuffer as oi, makeApiKeyUsageFlusher as si, makeAsyncKv as ci, makeAuthMiddlewareLayers as li, makeBufferingSpanProcessor as ui, makeCoordinatedScheduler as di, makeEffectStoreLayer as fi, makeLazyWorkflowFacade as pi, makeMutationOutputCodec as mi, makeMutationRunner as hi, makeOneShotQueryRunner as gi, makeQueryDescriptorProducer as _i, makeQueryFinalizer as vi, makeQueryReauthorizer as yi, makeQuerySubscriber as bi, makeSchemaRegistry as xi, makeWorkflowFacade as Si, makeWorkflowFacadeWithCallerContext as Ci, makeWorkflowLayers as wi, noopKv as Ti, onProcessShutdown as G, recordSubscriptionDelivery as K, recordWorkflowRun as Ei, registerDefaultTupleSource as Di, registerWakeup as Oi, resolveSecretsBackend as ki, runProvidedEffect as Ai, setSecretsBackend as ji, setSystemStoreHandle as Mi, shutdownGraceMsFromEnv as Ni, singleCoordinator as Pi, startRpcServer as Fi, startScheduler as q, stripForbiddenForWire as Ii, undoCaptureEnabled as Li, unresolvedSources as Ri, withScopedRequest as zi, workflowToRpc as Bi, wrapStoreWithBootCodec as Vi } from "@voltro/runtime";
+import { assertProductionSessionSecret as Hi } from "@voltro/protocol/session";
+import { Cause as Ui, Effect as J, Layer as Y, ManagedRuntime as Wi } from "effect";
+import { SqlClient as Gi } from "@effect/sql";
+import { declaredSnapshot as Ki, describeOutcome as qi, pendingFileMigrationIds as Ji, runPlannedMigrations as Yi } from "@voltro/database/sql";
+import Xi, { tmpdir as Zi } from "node:os";
+import { RpcGroup as Qi } from "@effect/rpc";
+import { appStorageProvider as $i, durabilityNotice as ea, fromNodeReadable as ta, getObjectStream as na, putObjectStream as ra, toNodeReadable as ia } from "@voltro/plugin-storage";
+import { isEnvContract as aa } from "@voltro/env";
+import X from "node:fs/promises";
+import { createHash as oa, timingSafeEqual as sa } from "node:crypto";
+import { channelFor as ca, getBroadcastPlugin as la } from "@voltro/plugin-broadcast";
+import { buildDeliverWebhookExecute as ua, buildWebhooksService as da, defaultIncomingPath as fa, deliverWebhookWorkflow as pa, makeDeferredEmitHandler as ma, mountIncomingWebhook as ha } from "@voltro/plugin-webhooks";
+import { getAuthSessionStrategy as ga } from "@voltro/plugin-auth";
+import { registerEmailTemplates as _a } from "@voltro/plugin-mail";
+import { checkSchemaDrift as va, decideStaging as ya, isEnvironmentLocal as ba, packBundle as xa, peekBundle as Sa, runExport as Ca, runImport as wa, storageBlobSink as Ta, storageRefsBlobSource as Ea, unpackBundle as Da, unpackBundleToDir as Oa } from "@voltro/data-transfer";
+//#region \0rolldown/runtime.js
+var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy < "u" ? new Proxy(e, { get: (e, t) => (typeof require < "u" ? require : e)[t] }) : e)(function(e) {
+	if (typeof require < "u") return require.apply(this, arguments);
+	throw Error("Calling `require` for \"" + e + "\" in an environment that doesn't expose the `require` function. See https://rolldown.rs/in-depth/bundling-cjs#require-external-modules for more details.");
+}), Aa = () => Math.max(500, Math.floor(Ni() * .6)), ja = (e) => new Promise((t) => setTimeout(t, e)), Ma = (e) => {
+	let t = /* @__PURE__ */ new Set(), n = /* @__PURE__ */ new Set(), r = 0;
+	e.on("connection", (e) => {
+		t.add(e), e.once("close", () => {
+			t.delete(e), n.delete(e);
+		});
+	}), e.on("upgrade", (e, t) => {
+		n.add(t);
+	}), e.on("request", (e, t) => {
+		r += 1, t.once("close", () => {
+			--r;
+		});
+	});
+	let i, a = async (t = {}) => {
+		let n = t.budgetMs ?? Aa();
+		i ??= new Promise((t) => {
+			e.close(() => {
+				t();
+			});
+		}), e.closeIdleConnections();
+		let a = Date.now() + n;
+		for (; r > 0 && Date.now() < a;) await ja(25), e.closeIdleConnections();
+		e.closeIdleConnections();
+	}, o = async () => {
+		i ??= new Promise((t) => {
+			e.close(() => {
+				t();
+			});
+		});
+		for (let e of t) if (n.has(e)) try {
+			e.write(Buffer.from([
+				136,
+				2,
+				3,
+				233
+			]));
+		} catch {}
+		else e.destroy();
+		for (let e = 0; t.size > 0 && e < 250; e += 25) await ja(25);
+		for (let e of t) e.destroy();
+		await i;
+	};
+	return {
+		activeRequests: () => r,
+		drainRequests: a,
+		finish: o,
+		drain: async (e = {}) => {
+			await a(e), await o();
+		}
+	};
+}, Na = "/_voltro/admin/import", Pa = "/_voltro/admin/import/start", Fa = "/_voltro/admin/export", Ia = "/_voltro/admin/export/download", La = "/_voltro/admin/transfers", Z = (e, t) => ({
+	status: e,
+	contentType: "application/json; charset=utf-8",
+	body: JSON.stringify(t)
+}), Ra = (e) => {
+	let t = e.authorization ?? e.Authorization, n = t ? /^Bearer\s+(.+)$/i.exec(t) : null;
+	return n ? n[1] : null;
+}, za = (e, t) => sa(oa("sha256").update(e).digest(), oa("sha256").update(t).digest()), Ba = (e, t, n = "POST") => {
+	if (e.method.toUpperCase() !== n) return Z(405, { error: "method not allowed" });
+	if (!t || t.length < 16) return Z(503, { error: "data transfer misconfigured (no/weak secret)" });
+	let r = Ra(e.headers);
+	return !r || !za(r, t) ? Z(401, { error: "unauthorized" }) : null;
+}, Va = /^[A-Za-z0-9_-]{8,64}$/, Ha = (e) => Va.test(e), Ua = () => process.env.VOLTRO_IMPORT_UPLOAD_DIR ?? I.join(Xi.tmpdir(), "voltro-import-uploads"), Wa = (e) => I.join(Ua(), e), Ga = (e) => I.join(Wa(e), "archive.bin"), Ka = (e) => I.join(Wa(e), "meta.json"), qa = async (e = Date.now()) => {
+	let t = 0;
+	try {
+		for (let n of await X.readdir(Ua())) {
+			if (n === ".runs") continue;
+			let r = await X.stat(Wa(n)).catch(() => null);
+			r !== null && (e - r.mtimeMs <= 864e5 || (await X.rm(Wa(n), {
+				recursive: !0,
+				force: !0
+			}).catch(() => void 0), t++));
+		}
+	} catch {}
+	return t;
+}, Ja = async (e) => {
+	if (!Ha(e)) return {
+		bytes: 0,
+		key: null,
+		runId: null
+	};
+	let t = await X.stat(Ga(e)).catch(() => null);
+	if (t === null) return {
+		bytes: 0,
+		key: null,
+		runId: null
+	};
+	let n = await Ya(e);
+	return {
+		bytes: t.size,
+		key: n.key ?? null,
+		runId: n.runId ?? null
+	};
+}, Ya = async (e) => {
+	try {
+		let t = await X.readFile(Ka(e), "utf8");
+		return JSON.parse(t);
+	} catch {
+		return {};
+	}
+}, Xa = async (e, t) => {
+	let n = Ka(e), r = `${n}.${process.pid}.${Math.random().toString(36).slice(2, 8)}.tmp`;
+	await X.writeFile(r, JSON.stringify(t)), await X.rename(r, n);
+}, Za = async (e, t, n) => {
+	if (!Ha(e)) return t;
+	await X.mkdir(Wa(e), { recursive: !0 });
+	let r = await Ya(e), i = typeof r.runId == "string" && r.runId.length > 0 ? r.runId : null;
+	return i !== null && n?.takeOver !== !0 ? i : (await Xa(e, {
+		...r,
+		runId: t
+	}), t);
+}, Qa = async (e) => {
+	if (!Ha(e)) return;
+	let t = await Ya(e);
+	if (t.runId === void 0) return;
+	let { runId: n, ...r } = t;
+	await Xa(e, r).catch(() => void 0);
+}, $a = async (e, t, n) => (await X.mkdir(Wa(e), { recursive: !0 }), await X.writeFile(Ga(e), Buffer.from(t)), await Xa(e, {
+	...await Ya(e),
+	key: n,
+	startedAt: (/* @__PURE__ */ new Date()).toISOString()
+}), t.byteLength), eo = (e) => `up-${oa("sha256").update(e).digest("hex").slice(0, 32)}`, to = async (e) => {
+	if (!Ha(e.id)) return {
+		reason: "bad-id",
+		message: `upload id must match ${String(Va)}`
+	};
+	let t = await Ja(e.id);
+	if (t.key !== null && t.key !== e.key) return {
+		reason: "key-mismatch",
+		message: "this upload id already holds a different bundle. Use a new upload id, or delete the partial upload."
+	};
+	if (e.offset !== t.bytes) return {
+		reason: "offset-mismatch",
+		message: `chunk starts at ${e.offset} but the server holds ${t.bytes} byte(s)`,
+		expectedOffset: t.bytes
+	};
+	if (await X.mkdir(Wa(e.id), { recursive: !0 }), t.key === null) {
+		let t = await Ya(e.id);
+		await Xa(e.id, {
+			...t,
+			key: e.key,
+			startedAt: (/* @__PURE__ */ new Date()).toISOString()
+		});
+	}
+	return await new Promise((t, n) => {
+		let r = $n(Ga(e.id), { flags: "a" });
+		r.on("error", n), r.on("finish", () => t()), r.end(Buffer.from(e.bytes));
+	}), { total: t.bytes + e.bytes.byteLength };
+}, no = async (e) => {
+	let t = await X.stat(Ga(e));
+	return {
+		path: Ga(e),
+		bytes: t.size
+	};
+}, ro = () => I.join(Ua(), ".runs"), io = (e) => I.join(ro(), `${e}.bin`), ao = async (e, t) => {
+	if (!Ha(e)) return null;
+	let n = Ga(e), r = await X.stat(n).catch(() => null);
+	if (r === null || r.size === 0) return null;
+	await X.mkdir(ro(), { recursive: !0 });
+	let i = io(t);
+	return await X.rename(n, i), i;
+}, oo = async (e) => {
+	await X.rm(io(e), { force: !0 }).catch(() => void 0);
+}, Q = L({ scope: "voltro:admin-import" }), so = "VBUNDLE2", co = (e) => {
+	let t = e.req.headers["x-import-rollback-key"];
+	if (e.mode !== "replace") return { options: {} };
+	if (typeof t != "string" || t.length === 0) return Q.warn("admin.import: no rollback capture — this run empties the target first, and nothing was asked to be kept. Send `x-import-rollback-key: <storage key>` (voltro data import --rollback-key <key>) to have the instance store the target's current rows before deleting them."), { options: {} };
+	if (e.deps.putArchive === void 0) return {
+		options: {},
+		refusal: Z(409, {
+			error: "rollback capture requested but this instance has no object storage configured",
+			hint: "A capture written to the pod would not survive the failure it exists for. Configure storage (the same one the storage-push export uses), or re-send without `x-import-rollback-key` to accept that a run which does not finish can leave the target emptied. Note that CONFIGURED is not the same question as SURVIVES: a `filesystem` provider pointed at a container directory with no volume behind it passes this check and dies with the pod. The run says so when it can observe it — the capture path being on the same filesystem as `/`."
+		})
+	};
+	let n = Qn(Zi(), `voltro-rollback-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`), r = e.deps.putArchive;
+	return {
+		key: t,
+		options: {
+			rollbackDir: n,
+			onRollbackCaptured: async () => {
+				let e = ea(n);
+				e !== void 0 && Q.warn(`admin.import: ${e}`), await r(t, () => xa({ dir: n })), Q.info("admin.import: rollback capture stored", { bundleKey: t });
+			}
+		}
+	};
+}, lo = (e) => {
+	let t = e["x-import-mode"], n = e["x-import-atomic"];
+	return {
+		mode: t,
+		onConflict: e["x-import-on-conflict"],
+		atomic: n === "0" || n === "false" ? !1 : n === "1" || n === "true" || t === "replace",
+		force: e["x-import-force"] === "1" || e["x-import-force"] === "true",
+		dryRun: e["x-import-dry-run"] === "1" || e["x-import-dry-run"] === "true",
+		tables: (e["x-import-tables"] ?? "").split(",").map((e) => e.trim()).filter(Boolean)
+	};
+}, uo = async (e, t) => {
+	if (typeof t.bundleKey == "string" && t.bundleKey !== "") {
+		if (!e.openArchive) return { refusal: Z(501, { error: "storage transport not configured on this instance" }) };
+		let n = e.openArchive, r = t.bundleKey;
+		return {
+			source: () => n(r),
+			transport: "storage",
+			uploadId: eo(r)
+		};
+	}
+	let n = t.uploadId;
+	if (typeof n != "string" || !Ha(n)) return { refusal: Z(400, { error: "start needs { uploadId } from an upload, or { bundleKey } for the storage transport" }) };
+	let r = await no(n).catch(() => null);
+	return r === null || r.bytes === 0 ? { refusal: Z(409, {
+		error: "no such upload",
+		message: `this instance holds no bytes for upload '${n}'. Upload the bundle first, or re-upload if it has expired.`
+	}) } : {
+		source: () => fo(r.path),
+		transport: "upload",
+		uploadId: n
+	};
+}, fo = (e) => {
+	let { createReadStream: t } = ka("node:fs");
+	return t(e);
+}, po = (e) => async (t) => {
+	let n = Ba(t, e.secret);
+	if (n) return n;
+	let r = lo(t.headers), i = co({
+		req: t,
+		mode: r.mode,
+		deps: e
+	});
+	if (i.refusal !== void 0) return i.refusal;
+	if (t.headers["x-import-preflight"] === "1" || t.headers["x-import-preflight"] === "true") {
+		let n;
+		try {
+			n = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
+		} catch {
+			return Z(400, { error: "a preflight body must be JSON: { tables: string[] } or { bundleKey: string }" });
+		}
+		let a = Array.isArray(n.tables) ? n.tables.filter((e) => typeof e == "string") : [];
+		if (a.length === 0 && typeof n.bundleKey == "string" && n.bundleKey !== "" && e.openArchive && (a = [...await mo(e.openArchive(n.bundleKey))]), a.length === 0) return Z(400, {
+			error: "a preflight needs { tables: string[] } — the bundle's table names, so the staging decision can be made against them",
+			hint: "or { bundleKey } on an instance with storage configured, where this endpoint reads the table list out of the archive itself"
+		});
+		let o = ya({
+			mode: r.mode ?? "upsert",
+			...e.dialect === void 0 ? {} : { targetDialect: e.dialect },
+			...e.snapshot === void 0 ? {} : { targetSnapshot: e.snapshot },
+			bundleTables: a,
+			isSkipped: ba,
+			canRunSql: !0
+		});
+		return Z(200, {
+			preflight: !0,
+			mode: r.mode ?? "upsert",
+			atomic: r.atomic,
+			staged: o.active,
+			...o.blocker === void 0 ? {} : { reason: o.blocker },
+			stagedTables: o.tables.length,
+			rollback: i.key === void 0 ? { taken: !1 } : {
+				taken: !0,
+				key: i.key
+			},
+			dialect: e.dialect ?? null
+		});
+	}
+	let a = t.headers["x-import-upload-id"];
+	if (a !== void 0 && a !== "") {
+		if (qa(), t.headers["x-import-probe"] === "1") {
+			let e = await Ja(a);
+			return Z(200, {
+				uploadId: a,
+				bytes: e.bytes,
+				...e.runId === null ? {} : { runId: e.runId }
+			});
+		}
+		let e = t.headers["x-import-upload-key"] ?? "", n = Number(t.headers["x-import-chunk-offset"] ?? "0");
+		if (e === "" || !Number.isFinite(n) || n < 0) return Z(400, { error: "a chunked upload needs x-import-upload-key and a numeric x-import-chunk-offset" });
+		let r = await to({
+			id: a,
+			key: e,
+			offset: n,
+			bytes: t.rawBody
+		});
+		if ("reason" in r) return Q.warn("admin.import chunk refused", {
+			uploadId: a,
+			reason: r.reason
+		}), Z(409, {
+			error: "chunk refused",
+			reason: r.reason,
+			message: r.message,
+			...r.expectedOffset === void 0 ? {} : { expectedOffset: r.expectedOffset }
+		});
+		let i = t.headers["x-import-chunk-final"] === "1";
+		return Z(202, {
+			uploadId: a,
+			bytes: r.total,
+			complete: i
+		});
+	}
+	if (t.rawBody.byteLength >= 8 && Buffer.from(t.rawBody.subarray(0, 8)).toString("latin1") === so) {
+		qa();
+		let e = oa("sha256").update(Buffer.from(t.rawBody)).digest("hex"), n = eo(e);
+		return Z(202, {
+			uploadId: n,
+			bytes: await $a(n, t.rawBody, e),
+			complete: !0
+		});
+	}
+	let o;
+	try {
+		o = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
+	} catch {
+		return Z(400, { error: "body must be a packed bundle archive or { bundleKey } JSON" });
+	}
+	return typeof o.bundleKey != "string" || !o.bundleKey ? Z(400, { error: "body.bundleKey (string) is required for the storage transport" }) : e.openArchive ? Z(202, {
+		uploadId: eo(o.bundleKey),
+		bundleKey: o.bundleKey,
+		complete: !0
+	}) : Z(501, { error: "storage transport not configured on this instance" });
+}, mo = async (e) => {
+	let t = await Sa(e, ["manifest.json"]).then((e) => e.get("manifest.json"), () => void 0);
+	if (t === void 0) return [];
+	try {
+		return (JSON.parse(Buffer.from(t).toString("utf8")).tables ?? []).map((e) => e.name).filter((e) => typeof e == "string");
+	} catch {
+		return [];
+	}
+}, ho = (e) => async (t) => {
+	let n = Ba(t, e.secret);
+	if (n) return n;
+	let r = lo(t.headers), i = co({
+		req: t,
+		mode: r.mode,
+		deps: e
+	});
+	if (i.refusal !== void 0) return i.refusal;
+	let a;
+	try {
+		a = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
+	} catch {
+		return Z(400, { error: "body must be JSON: { uploadId } or { bundleKey }" });
+	}
+	let o = typeof a.bundleKey == "string" && a.bundleKey !== "" ? eo(a.bundleKey) : typeof a.uploadId == "string" ? a.uploadId : "";
+	if (!Ha(o)) return Z(400, { error: "start needs { uploadId } from an upload, or { bundleKey } for the storage transport" });
+	let s = Cr("dimp", `${o}-${Date.now()}-${Math.random()}`), c = await Za(o, s);
+	if (c !== s) {
+		let t = await Jn(e.store, c);
+		if (Yn(t) === void 0 && t !== null) return Q.info("admin.import start: already running", {
+			uploadId: o,
+			runId: c
+		}), Z(202, {
+			runId: c,
+			uploadId: o,
+			alreadyStarted: !0
+		});
+		Q.info("admin.import start: taking over a claim whose run is not running", {
+			uploadId: o,
+			staleRunId: c,
+			outcome: Yn(t) ?? "no record"
+		}), c = await Za(o, s, { takeOver: !0 });
+	}
+	let l = async (e) => (await Qa(o).catch(() => void 0), e), u = await uo(e, {
+		...typeof a.uploadId == "string" ? { uploadId: a.uploadId } : {},
+		...typeof a.bundleKey == "string" ? { bundleKey: a.bundleKey } : {}
+	});
+	if ("refusal" in u) return l(u.refusal);
+	if (e.snapshot !== void 0 && !r.force) {
+		let t = await go(u.source());
+		if (t !== null) {
+			let n = va(t.source?.schemaFingerprint ?? "", e.snapshot, _o(t));
+			if (n.drifted) return Q.warn("admin.import refused (schema drift)", {
+				transport: u.transport,
+				bundle: n.bundleFingerprint.slice(0, 16),
+				target: n.targetFingerprint.slice(0, 16)
+			}), l(Z(409, {
+				error: "schema drift",
+				bundleFingerprint: n.bundleFingerprint,
+				targetFingerprint: n.targetFingerprint,
+				diff: n.diff,
+				hint: "each line above would break the load: a table or column the bundle carries that the target cannot take, or a column the target requires that the bundle has no value for. Fix the target schema, re-export against it, or resend with x-import-force: 1 to write anyway."
+			}));
+		}
+	}
+	let d = null;
+	if (u.transport === "upload" && (d = await ao(u.uploadId, c), d === null)) return l(Z(409, {
+		error: "no such upload",
+		message: `the bytes for upload '${u.uploadId}' are gone. Re-upload the bundle.`
+	}));
+	let f = await vo(e.store, {
+		runId: c,
+		mode: r.mode ?? "upsert",
+		via: "api",
+		bundle: u.transport === "storage" ? String(a.bundleKey) : u.uploadId
+	});
+	return yo({
+		deps: e,
+		opts: r,
+		rollback: i,
+		runId: c,
+		traced: f,
+		resolved: d === null ? u : {
+			...u,
+			source: () => fo(d)
+		}
+	}), Q.info("admin.import started", {
+		runId: c,
+		uploadId: u.uploadId,
+		transport: u.transport,
+		mode: r.mode ?? "upsert",
+		atomic: r.atomic,
+		dryRun: r.dryRun
+	}), Z(202, {
+		runId: c,
+		uploadId: u.uploadId,
+		transport: u.transport,
+		mode: r.mode ?? "upsert",
+		atomic: r.atomic,
+		...r.dryRun ? { dryRun: !0 } : {},
+		recorded: f,
+		outcome: "poll /_voltro/admin/transfers for this runId — a 202 means started, not finished"
+	});
+}, go = async (e) => {
+	let t = await Sa(e, ["manifest.json"]).then((e) => e.get("manifest.json"), () => null);
+	if (t == null) return null;
+	try {
+		return JSON.parse(Buffer.from(t).toString("utf8"));
+	} catch {
+		return null;
+	}
+}, _o = (e) => ({ tables: (e.tables ?? []).map((e) => ({
+	name: e.name,
+	indexes: [],
+	columns: Object.entries(e.columnTypes ?? {}).map(([e, t]) => ({
+		name: e,
+		type: t,
+		nullable: !0,
+		unique: !1,
+		hasDefault: !1
+	}))
+})) }), vo = async (e, t) => {
+	try {
+		return Tr(yr), await e.insert(V, {
+			id: t.runId,
+			direction: "import",
+			startedAt: /* @__PURE__ */ new Date(),
+			finishedAt: null,
+			failure: null,
+			mode: t.mode,
+			via: t.via,
+			bundle: t.bundle,
+			sourceFingerprint: null,
+			tablesWritten: 0,
+			rowsWritten: 0,
+			staged: null
+		}), !0;
+	} catch (e) {
+		return Q.warn("admin.import: the run could not be recorded", {
+			runId: t.runId,
+			error: e?.message ?? String(e)
+		}), !1;
+	}
+}, yo = async (e) => {
+	let { deps: t, opts: n, rollback: r, resolved: i, runId: a } = e, o = await import("node:os"), s = await import("node:fs/promises"), c = await import("node:path"), l = await s.mkdtemp(c.join(o.tmpdir(), "voltro-admin-import-")), u = async (n) => {
+		Q.warn("admin.import failed", {
+			runId: a,
+			transport: i.transport,
+			error: n
+		}), e.traced && await t.store.update(V, a, {
+			failure: n,
+			finishedAt: null
+		}).then(() => void 0, () => void 0);
+	};
+	try {
+		t.assetSink ? await Da(i.source(), {
+			dir: l,
+			blobs: t.assetSink
+		}) : await Oa(i.source(), l);
+		let o = await J.runPromiseExit(wa({
+			store: t.store,
+			bundleDir: l,
+			...n.mode ? { mode: n.mode } : {},
+			...n.onConflict ? { onConflict: n.onConflict } : {},
+			atomic: n.atomic,
+			...r.options,
+			recordInterruption: !0,
+			via: "api",
+			...e.traced ? { traceId: a } : {},
+			...n.dryRun ? { dryRun: n.dryRun } : {},
+			...n.tables.length > 0 ? { tables: [...n.tables] } : {},
+			...t.snapshot ? { targetSnapshot: t.snapshot } : {},
+			...t.dialect ? { targetDialect: t.dialect } : {},
+			force: n.force,
+			onWarn: (e) => Q.warn("admin.import", {
+				runId: a,
+				message: e
+			}),
+			...t.assetSink ? { assetsAlreadyRestored: !0 } : {}
+		}));
+		if (o._tag === "Failure") {
+			let e = o.cause._tag === "Fail" ? o.cause.error : void 0, t = typeof e?.reason == "string" ? e.reason : void 0, n = e?.diff;
+			await u(t ?? (Array.isArray(n) ? `schema drift: ${n.join("; ")}` : void 0) ?? String(e?.message ?? e ?? "import failed"));
+			return;
+		}
+		let s = o.value;
+		Q.info(n.dryRun ? "admin.import (dry run — nothing written)" : "admin.import complete", {
+			runId: a,
+			transport: i.transport,
+			tables: s.tablesWritten,
+			rows: s.rowsWritten,
+			mode: n.mode ?? "upsert",
+			atomic: n.atomic,
+			...s.tablesSkipped > 0 ? {
+				skippedTables: s.tablesSkipped,
+				skippedRows: s.rowsSkipped
+			} : {}
+		}), n.dryRun || t.refreshSubscriptions?.(`data import: ${s.tablesWritten} table(s), mode ${n.mode ?? "upsert"}`);
+	} catch (e) {
+		await u(e?.message ?? String(e));
+	} finally {
+		await s.rm(l, {
+			recursive: !0,
+			force: !0
+		}).catch(() => void 0), await oo(a).catch(() => void 0), await Qa(i.uploadId).catch(() => void 0);
+	}
+}, bo = /^[A-Za-z0-9_-]{8,64}$/, xo = (e) => bo.test(e), So = () => process.env.VOLTRO_EXPORT_ARTIFACT_DIR ?? I.join(Xi.tmpdir(), "voltro-export-artifacts"), Co = (e) => I.join(So(), e), wo = (e) => I.join(Co(e), "archive.bin"), To = async (e = Date.now()) => {
+	let t = 0;
+	try {
+		for (let n of await X.readdir(So())) {
+			let r = await X.stat(Co(n)).catch(() => null);
+			r !== null && (e - r.mtimeMs <= 864e5 || (await X.rm(Co(n), {
+				recursive: !0,
+				force: !0
+			}).catch(() => void 0), t++));
+		}
+	} catch {}
+	return t;
+}, Eo = async (e, t) => {
+	if (!xo(e)) throw Error(`invalid run id: ${e}`);
+	await X.mkdir(Co(e), { recursive: !0 });
+	let { createWriteStream: n } = await import("node:fs"), r = n(wo(e)), i = 0;
+	try {
+		for await (let e of t) i += e.byteLength, r.write(Buffer.from(e)) || await new Promise((e, t) => {
+			r.once("drain", e), r.once("error", t);
+		});
+	} finally {
+		await new Promise((e, t) => {
+			r.end(() => e()), r.once("error", t);
+		});
+	}
+	return i;
+}, Do = async (e) => {
+	if (!xo(e)) return null;
+	let t = await X.stat(wo(e)).catch(() => null);
+	return t === null ? null : t.size;
+}, Oo = async (e, t, n) => {
+	let r = await Do(e);
+	if (r === null) return null;
+	if (t >= r) return {
+		bytes: Buffer.alloc(0),
+		total: r
+	};
+	let i = await X.open(wo(e), "r");
+	try {
+		let e = Math.max(0, Math.min(n, r - t)), a = Buffer.alloc(e);
+		return await i.read(a, 0, e, t), {
+			bytes: a,
+			total: r
+		};
+	} finally {
+		await i.close();
+	}
+}, ko = async (e) => {
+	xo(e) && await X.rm(Co(e), {
+		recursive: !0,
+		force: !0
+	}).catch(() => void 0);
+}, Ao = L({ scope: "voltro:admin-export" }), jo = (e) => Array.isArray(e) ? e.filter((e) => typeof e == "string") : [], Mo = (e) => {
+	if (typeof e.tenant == "string" && e.tenant) return {
+		kind: "tenant",
+		tenantId: e.tenant
+	};
+	if (Array.isArray(e.tables) && e.tables.length) return {
+		kind: "tables",
+		tables: jo(e.tables)
+	};
+	let t = jo(e.exclude);
+	return t.length > 0 ? {
+		kind: "all",
+		exclude: t
+	} : { kind: "all" };
+}, No = (e) => async (t) => {
+	let n = Ba(t, e.secret);
+	if (n) return n;
+	let r;
+	try {
+		r = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
+	} catch {
+		return Z(400, { error: "body must be JSON: { profile?, tenant?, tables?, consistency?, compression?, bundleKey? }" });
+	}
+	let i = {};
+	if (typeof r.profile == "string" && r.profile) {
+		if (!e.loadProfile) return Z(501, { error: "server-side profiles not configured on this instance" });
+		try {
+			i = await e.loadProfile(r.profile);
+		} catch (e) {
+			return Z(400, {
+				error: `profile '${r.profile}' could not be loaded`,
+				message: e?.message ?? String(e)
+			});
+		}
+	}
+	let a = r.consistency === "snapshot" ? "snapshot" : i.consistency ?? "live", o = (typeof r.compression == "string" ? r.compression : void 0) ?? i.compression, s = i.scope ?? Mo(r), c = typeof r.bundleKey == "string" && r.bundleKey.length > 0, l = r.assets === !0 && e.assetSource ? { blobs: e.assetSource } : {}, u = Cr("dexp", `${Date.now()}-${Math.random()}`), d = await Po(e.store, {
+		runId: u,
+		mode: i.subset ? "subset" : s.kind,
+		bundle: c ? String(r.bundleKey) : null
+	});
+	return Fo({
+		deps: e,
+		runId: u,
+		recorded: d,
+		profile: i,
+		scope: s,
+		consistency: a,
+		blobs: l,
+		...o ? { compression: o } : {},
+		...c ? { bundleKey: String(r.bundleKey) } : {}
+	}), To(), Ao.info("admin.export started", {
+		runId: u,
+		scope: s.kind,
+		storage: c
+	}), Z(202, {
+		runId: u,
+		transport: c ? "storage" : "download",
+		...c ? { bundleKey: r.bundleKey } : {},
+		recorded: d,
+		outcome: "poll /_voltro/admin/transfers for this runId; fetch the bytes from /_voltro/admin/export/download"
+	});
+}, Po = async (e, t) => {
+	try {
+		return Tr(yr), await e.insert(V, {
+			id: t.runId,
+			direction: "export",
+			startedAt: /* @__PURE__ */ new Date(),
+			finishedAt: null,
+			failure: null,
+			mode: t.mode,
+			via: "api",
+			bundle: t.bundle,
+			sourceFingerprint: null,
+			tablesWritten: 0,
+			rowsWritten: 0,
+			staged: null
+		}), !0;
+	} catch (e) {
+		return Ao.warn("admin.export: the run could not be recorded", {
+			runId: t.runId,
+			error: e?.message ?? String(e)
+		}), !1;
+	}
+}, Fo = async (e) => {
+	let { deps: t, runId: n } = e, r = await import("node:os"), i = await import("node:fs/promises"), a = await import("node:path"), o = await i.mkdtemp(a.join(r.tmpdir(), "voltro-admin-export-")), s = async (r) => {
+		e.recorded && await t.store.update(V, n, r).then(() => void 0, () => void 0);
+	};
+	try {
+		let r = await J.runPromise(Ca({
+			store: t.store,
+			snapshot: t.snapshot,
+			dialect: t.dialect,
+			outDir: o,
+			...e.profile.subset ? { subset: e.profile.subset } : {
+				scope: e.scope,
+				...t.tenantTables && t.tenantTables.length > 0 ? { tenantTables: t.tenantTables } : {}
+			},
+			consistency: e.consistency,
+			...e.compression ? { compression: e.compression } : {},
+			...e.profile.masking ? { masking: e.profile.masking } : {}
+		})), i = r.tables.reduce((e, t) => e + t.rowCount, 0), a = r.masking?.transformed.length ?? 0;
+		if (e.bundleKey !== void 0) {
+			if (!t.putArchive) throw Error("storage transport not configured on this instance");
+			await t.putArchive(e.bundleKey, () => xa({
+				dir: o,
+				...e.blobs
+			}));
+		}
+		let c = await Eo(n, xa({
+			dir: o,
+			...e.blobs
+		}));
+		Ao.info("admin.export complete", {
+			runId: n,
+			tables: r.tables.length,
+			rows: i,
+			masked: a,
+			bytes: c,
+			...e.bundleKey === void 0 ? {} : { bundleKey: e.bundleKey }
+		}), await s({
+			finishedAt: /* @__PURE__ */ new Date(),
+			failure: null,
+			tablesWritten: r.tables.length,
+			rowsWritten: i,
+			sourceFingerprint: r.source?.schemaFingerprint ?? null
+		});
+	} catch (e) {
+		let t = e?.message ?? String(e);
+		Ao.warn("admin.export failed", {
+			runId: n,
+			error: t
+		}), await s({
+			failure: t,
+			finishedAt: null
+		}), await ko(n);
+	} finally {
+		await i.rm(o, {
+			recursive: !0,
+			force: !0
+		}).catch(() => void 0);
+	}
+}, Io = (e) => async (t) => {
+	let n = Ba(t, e.secret, "GET");
+	if (n) return n;
+	let r = new URLSearchParams(t.query ?? ""), i = r.get("runId") ?? "";
+	if (!xo(i)) return Z(400, { error: "download needs ?runId=<id> from the 202 the export answered with" });
+	let a = Math.max(0, Number(r.get("offset") ?? "0") || 0), o = Number(r.get("length") ?? "8388608"), s = await Oo(i, a, Number.isFinite(o) && o > 0 ? Math.min(o, Ro) : Lo);
+	return s === null ? Z(404, {
+		error: "no artefact",
+		message: `this instance holds no produced bundle for run '${i}'. It may have expired, or the export may still be running — poll the run first.`
+	}) : {
+		status: 200,
+		contentType: "application/octet-stream",
+		body: new Uint8Array(s.bytes),
+		headers: {
+			"x-export-total-bytes": String(s.total),
+			"x-export-offset": String(a),
+			"x-export-length": String(s.bytes.byteLength)
+		}
+	};
+}, Lo = 8388608, Ro = 33554432, zo = async (e, t) => await e.query({
+	table: V,
+	order: [{
+		column: "startedAt",
+		direction: "desc"
+	}],
+	predicate: void 0,
+	projection: void 0,
+	skip: 0,
+	take: t
+}), Bo = (e) => {
+	let t = new Date(e);
+	return Number.isFinite(t.getTime()) ? t : /* @__PURE__ */ new Date(0);
+}, Vo = (e) => ({
+	...e,
+	startedAt: Bo(e.startedAt),
+	finishedAt: e.finishedAt === null || e.finishedAt === void 0 ? null : Bo(e.finishedAt)
+}), Ho = (e) => async (t) => {
+	let n = Ba(t, e.secret, "GET");
+	if (n) return n;
+	let r = Number(new URLSearchParams(t.query ?? "").get("limit") ?? "20"), i = Number.isFinite(r) ? Math.max(1, Math.min(200, Math.trunc(r))) : 20, a;
+	try {
+		a = (await zo(e.store, i)).map(Vo);
+	} catch (e) {
+		return Z(409, {
+			error: "no import history",
+			message: `this instance has no \`${V}\` table, so no import has been recorded. Run \`voltro db apply\` against it; imports themselves are unaffected.`,
+			detail: e?.message ?? String(e)
+		});
+	}
+	return Z(200, {
+		running: a.filter((e) => e.finishedAt === null && e.failure === null).length,
+		runs: a.map((e) => ({
+			id: e.id,
+			startedAt: e.startedAt.toISOString(),
+			finishedAt: e.finishedAt === null ? null : e.finishedAt.toISOString(),
+			mode: e.mode,
+			via: e.via,
+			bundle: e.bundle,
+			sourceFingerprint: e.sourceFingerprint,
+			tablesWritten: e.tablesWritten,
+			rowsWritten: e.rowsWritten,
+			direction: e.direction,
+			failure: e.failure,
+			staged: e.staged,
+			line: wr(e)
+		}))
+	});
+}, Uo = (e, t, n = {}) => (async function* () {
+	let r = await J.runPromise(na(e, t).pipe(J.timeout(n.openTimeout ?? "30 seconds"))), i = await ia(r.stream), a = n.stallMs ?? 12e4, o, s = () => {
+		o && clearTimeout(o), o = setTimeout(() => i.destroy(/* @__PURE__ */ Error(`storage read stalled for ${a}ms reading '${t}'`)), a);
+	};
+	try {
+		s();
+		for await (let e of i) s(), yield e instanceof Uint8Array ? e : new Uint8Array(e);
+	} finally {
+		o && clearTimeout(o), i.destroy();
+	}
+})(), Wo = {
+	get: async () => void 0,
+	set: async () => {},
+	setWithTags: async () => {},
+	remove: async () => !1,
+	has: async () => !1,
+	clear: async () => {},
+	invalidateTag: async () => 0,
+	wrap: async (e, t, n) => n()
+}, Go = async (e) => {
+	Pt(e.appProcedures ?? e.discovered, {
+		defaultDeny: e.security?.defaultDeny ?? !0,
+		commandHint: "`voltro serve`"
+	}), Mi({
+		dataStore: e.store,
+		schemaRegistry: e.schemaRegistry
+	});
+	let t = (e.discovered.budgets?.length ?? 0) > 0, n, r = new Ir({
+		crdtColumnsOf: (t) => e.schemaRegistry.crdtColumns(t),
+		store: e.store,
+		...e.snapshotCache ? { cache: e.snapshotCache } : {},
+		...e.reactive === void 0 ? {} : { reactive: e.reactive },
+		...t ? { recordCost: (e) => n?.record(e) } : {},
+		recordDelivery: (e) => K({
+			label: e.label,
+			kind: e.kind,
+			durationMs: e.durationMs,
+			rowCount: e.rowCount
+		})
+	}), i = e.cache ?? Wo, a = e.kv ?? Ti, o, s = () => void 0, c, d, p, ee, te, ne, m, re = L({ scope: "voltro:workflow" }), g = L({ scope: "voltro:schedule" }), ae = u({
+		store: e.store,
+		warn: (e, t) => re.warn(e, t)
+	}), oe = ae.remember, se = ae.resolve, le = lt({
+		authority: e.authority,
+		getStore: () => e.store
+	}), _ = (e.discovered.workflows?.length ?? 0) > 0 ? pi(() => o) : void 0, ue = (e.discovered.workflows?.length ?? 0) > 0 || (e.discovered.eventTriggers?.length ?? 0) > 0, de = ue || (e.discovered.workflowWorkers?.length ?? 0) > 0 || e.scheduleCoordination === "cluster", fe = e.tenantIsolation === "namespace", me = (e.log ?? L({ scope: "voltro:serve" })).child("webhooks"), he, _e, y = e.discovered.webhooks;
+	if (y && y.outgoing.length > 0 && e.workflowEngineLayer !== void 0) {
+		e.workflowEngineLayer;
+		let t = nt({
+			store: e.store,
+			schemaRegistry: e.schemaRegistry,
+			cache: i,
+			kv: a
+		}), n = y.outgoing.map((e) => e.descriptor);
+		_e = pa.toLayer(ua(t, { events: n })), he = da(t, async (e) => {
+			let t = p;
+			if (t === void 0) {
+				me.error("webhook delivery skipped — the workflow runtime was never built. This is a framework defect, not a configuration problem: report it with your engine setting. Deliveries are NOT queued and will not be retried.", {
+					deliveryId: e.deliveryId,
+					targetId: e.targetId
+				});
+				return;
+			}
+			t.runPromise(pa.execute(e)).catch((t) => {
+				me.error("deliverWebhook workflow crashed", {
+					deliveryId: e.deliveryId,
+					targetId: e.targetId
+				}, t);
+			});
+		}, { events: n });
+	}
+	let ve = /* @__PURE__ */ new Map();
+	if (y) for (let e of y.incoming) {
+		let t = e.descriptor.path ?? fa(e.descriptor.id), n = `VOLTRO_WEBHOOK_SECRET_${e.descriptor.id.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`, r = ha(e.descriptor, {
+			resolveSecret: async () => process.env[n] ?? null,
+			resolveWorkflows: () => _ === void 0 ? void 0 : Ci(_, {
+				traceId: `incoming:${e.descriptor.id}`,
+				source: `incoming:${e.descriptor.id}`
+			}),
+			log: (e) => {
+				let t = {
+					webhookId: e.webhookId,
+					status: e.status,
+					signatureOk: String(e.signatureOk),
+					idempotency: e.idempotency,
+					durationMs: e.durationMs
+				};
+				e.status >= 500 ? me.error("incoming delivery failed", t) : e.status >= 400 ? me.warn("incoming delivery rejected", t) : me.info("incoming delivery handled", t);
+			}
+		});
+		ve.set(t, { handle: r });
+	}
+	ti(), Di((t) => ni(e.store, t.subjectId, t.resourceType, t.resourceId)) || L({ scope: "voltro:serve" }).info("policy guards: using the app-registered tuple source");
+	let ye = [], be = [...e.discovered.outboxHandlers ?? [], ...Wn((y?.outgoing.length ?? 0) + (y?.incoming.length ?? 0) + (y?.providers.length ?? 0), []) ? [{
+		file: "<framework>/webhooks",
+		id: "voltro-webhook-emit",
+		definition: ma(() => he)
+	}] : []], xe = be.length > 0 ? w({
+		handlers: be,
+		store: e.store,
+		log: (e.log ?? L({ scope: "voltro:serve" })).child("outbox"),
+		onChange: (t) => e.store.onChange((e) => t({
+			table: e.table,
+			op: e.op
+		})),
+		onShutdown: (e) => {
+			ye.push(e);
+		}
+	}) : void 0, b = Ot({
+		definitions: (e.discovered.connections ?? []).map((e) => e.definition),
+		store: e.store,
+		publicUrl: Vt(e.port ?? 4e3),
+		log: (e.log ?? L({ scope: "voltro:serve" })).child("connections")
+	});
+	Se({
+		events: e.discovered.events ?? [],
+		rpcTags: [
+			...e.discovered.queries.map((e) => e.descriptor.name),
+			...e.discovered.mutations.map((e) => e.descriptor.name),
+			...e.discovered.actions.map((e) => e.descriptor.name),
+			...(e.discovered.streams ?? []).map((e) => e.descriptor.name)
+		]
+	});
+	let we = (e.log ?? L({ scope: "voltro:serve" })).child("events"), Te = e.broadcastNamespace ?? Gt(e.plugins, void 0), De = F(e.plugins, Te, we), Ae = e.membership?.instanceId ?? Ar(), je = kr(), Me = e.membership ?? tt(e.plugins, {
+		instanceId: Ae,
+		namespace: Te,
+		meta: { mode: "serve" },
+		logger: we
+	}), C = Ee({
+		events: e.discovered.events ?? [],
+		origin: je,
+		...De.publishRemote === void 0 ? {} : { publishRemote: De.publishRemote }
+	}), Pe = (e.discovered.events ?? []).length > 0 ? await De.attach(C.bus) : null, Fe = Qt({
+		store: e.store,
+		schemaRegistry: e.schemaRegistry,
+		cache: i,
+		kv: a,
+		...he === void 0 ? {} : { webhooksService: he },
+		..._ === void 0 ? {} : { workflowsProxy: _ },
+		eventTriggers: e.discovered.eventTriggers ?? [],
+		namespaceIsolationOn: fe,
+		...e.ensureTenantProvisioned === void 0 ? {} : { ensureTenantProvisioned: e.ensureTenantProvisioned },
+		...e.resolveResidentStore === void 0 ? {} : { resolveResidentStore: e.resolveResidentStore },
+		...xe === void 0 ? {} : { outbox: { nudge: xe.nudge } },
+		...b.active ? { connections: { registry: b.registry } } : {},
+		eventBus: C.bus
+	}), Ie = Y.succeed(Pr, Oe), Le = Y.succeed(Lr, S), Re = Y.succeed(U, ie), Ve = Y.succeed(Rr, St), He = (t, n) => {
+		let r = t.pipe(J.provide(fi(n)));
+		return (e.baseLayer ? r.pipe(J.provide(e.baseLayer)) : r).pipe(J.provide(Ie)).pipe(J.provide(Le)).pipe(J.provide(Re)).pipe(J.provide(Ve));
+	}, Ue = (e, t) => {
+		let n = He(e, t);
+		return Ai(n);
+	}, We = Vn(), Ge = Ht(e.plugins ?? [], We), Je = ge({
+		plugins: e.plugins ?? [],
+		metrics: We,
+		log: e.log ?? L({ scope: "voltro:serve" })
+	}), Xe = l(e.plugins ?? [], We), Ze = e.security?.defaultDeny ?? !0, Qe = hi({
+		store: e.store,
+		defaultDeny: Ze,
+		recordMetric: (e) => {
+			We.record(e);
+		},
+		...Ge.mutation === void 0 ? {} : { interceptor: Ge.mutation },
+		buildContext: (e, t, n) => Fe(e, t, n),
+		runEffect: Ue,
+		undoCapture: zt((t) => e.schemaRegistry.crdtColumns(t))
+	}), rt = At();
+	{
+		let t = at();
+		t !== void 0 && (e.log ?? L({ scope: "voltro:serve" })).info(t);
+	}
+	let it = et({
+		store: e.store,
+		...e.approvals === void 0 ? {} : { defaultExpiryMs: e.approvals.defaultExpiryMs }
+	}), ot = ri({
+		defaultDeny: Ze,
+		buildContext: (e) => Fe(e),
+		runEffect: Ue,
+		recordMetric: (e) => {
+			We.record(e);
+		},
+		...Ge.action === void 0 ? {} : { interceptor: Ge.action }
+	}), st = vi({
+		tenantScopedTables: e.tenantScopedTables,
+		softDeleteScopedTables: e.softDeleteScopedTables
+	}), ct = {
+		defaultDeny: Ze,
+		buildContext: (e) => Fe(e),
+		finalize: (e, t) => st(e, t.subject),
+		provideEffect: He,
+		...Ge.query === void 0 ? {} : { interceptor: Ge.query }
+	}, E = _i(ct), ut = gi({
+		...ct,
+		queryRows: (t, n) => e.store.query(t).then((e) => Ii(t.table, e, n.subject))
+	}), dt = bi({
+		...ct,
+		subscribeDescriptor: (e, t, n, i, a) => r.subscribe(e, t, n, void 0, void 0, void 0, i, a),
+		subscribeComputed: (e, t, n) => r.subscribeComputed(e, t, n)
+	}), D = (e) => e.filter((e) => ar(e.descriptor)), O = {};
+	for (let t of [
+		...D(e.discovered.queries),
+		...rt.queries,
+		...it.queries,
+		...b.queries
+	]) O[t.descriptor.name] = (e) => W(E(t, e), r, `subscription.${t.descriptor.name}`, void 0, void 0, yi(t, e));
+	for (let t of [
+		...D(e.discovered.mutations),
+		...rt.mutations,
+		...it.mutations,
+		...b.mutations
+	]) {
+		let n = mi(t.descriptor.output);
+		O[t.descriptor.name] = (r) => Gr(async (e, n) => Qe(t, e, n), r, `mutation.${t.descriptor.name}`, n, e.idempotency, cr(t.descriptor, "mutation"));
+	}
+	for (let t of [...D(e.discovered.actions), ...b.actions]) {
+		let n = mi(t.descriptor.output);
+		O[t.descriptor.name] = (r) => Gr(async (e, n) => ot(t, e, n), r, `action.${t.descriptor.name}`, n, e.idempotency, cr(t.descriptor, "action"));
+	}
+	let pt = () => `public-${Math.random().toString(36).slice(2, 10)}`, ht = [
+		...e.discovered.queries.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => ut(e, t, {
+				subject: n.subject,
+				traceId: pt()
+			}),
+			subscribe: (t, n, r) => dt(e, t, {
+				subject: n.subject,
+				traceId: pt()
+			}, r)
+		})),
+		...e.discovered.mutations.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => Qe(e, t, {
+				subject: n.subject,
+				traceId: pt()
+			})
+		})),
+		...e.discovered.actions.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => ot(e, t, {
+				subject: n.subject,
+				traceId: pt()
+			})
+		}))
+	], gt = {
+		candidates: Be({
+			queries: e.discovered.queries,
+			mutations: e.discovered.mutations,
+			actions: e.discovered.actions,
+			descriptorOf: (e) => e.descriptor,
+			runQuery: (e, t, n) => Promise.resolve(ut(e, t, n)),
+			runMutation: (e, t, n) => Promise.resolve(Qe(e, t, n)),
+			runAction: (e, t, n) => Promise.resolve(ot(e, t, n))
+		}),
+		policy: e.agents?.tools ?? {},
+		mcpEnabled: e.agents?.mcp === !0,
+		resolveSubject: (t) => e.resolveSubject(t, -1).then((e) => e.subject)
+	};
+	if (e.grpc !== void 0) {
+		let t = () => `grpc-${Math.random().toString(36).slice(2, 10)}`, n = [
+			...e.discovered.queries.map((e) => ({
+				tag: e.descriptor.name,
+				kind: "query",
+				input: e.descriptor.input,
+				output: e.descriptor.output,
+				invoke: (n, r, i) => ut(e, n, {
+					subject: r.subject,
+					traceId: t(),
+					signal: i
+				}),
+				subscribe: (n, r, i) => dt(e, n, {
+					subject: r.subject,
+					traceId: t()
+				}, i)
+			})),
+			...e.discovered.mutations.map((e) => ({
+				tag: e.descriptor.name,
+				kind: "mutation",
+				input: e.descriptor.input,
+				output: e.descriptor.output,
+				invoke: (n, r, i) => Qe(e, n, {
+					subject: r.subject,
+					traceId: t(),
+					signal: i
+				})
+			})),
+			...e.discovered.actions.map((e) => ({
+				tag: e.descriptor.name,
+				kind: "action",
+				input: e.descriptor.input,
+				output: e.descriptor.output,
+				invoke: async (n, r, i) => ot(e, n, {
+					subject: r.subject,
+					traceId: t(),
+					signal: i
+				})
+			}))
+		];
+		await f({
+			config: e.grpc.config,
+			candidates: n,
+			resolveSubject: async (t) => {
+				let { subject: n } = await e.resolveSubject(t, -1), r = n;
+				return r.type === "anonymous" && r.credentialRejected !== void 0 ? null : {
+					subject: n,
+					anonymous: r.type === "anonymous"
+				};
+			},
+			store: e.store,
+			root: e.grpc.root,
+			log: e.log ?? L({ scope: "voltro:serve" }),
+			onShutdown: (e) => G(e)
+		});
+	}
+	let _t = Mt({
+		...e.restRoutes === void 0 ? {} : { restRoutes: e.restRoutes },
+		publicApiEntries: ht,
+		store: e.store,
+		resolveSubject: (t) => e.resolveSubject(t, -1).then((e) => e.subject),
+		...e.idempotency === void 0 ? {} : { idempotency: e.idempotency },
+		log: e.log ?? L({ scope: "voltro:serve" })
+	}), k = e.dataTransferSecret ?? process.env.VOLTRO_DATA_TRANSFER_SECRET, vt = async (e, t) => {
+		let { Readable: n } = await import("node:stream"), r = $i(), i = ta("storage", () => n.from(t()));
+		await J.runPromise(ra(r, e, i, { contentType: "application/octet-stream" }));
+	}, yt = k && k.length >= 16 ? [
+		{
+			method: "POST",
+			path: Na,
+			handle: po({
+				secret: k,
+				store: e.store,
+				...e.dataTransferSnapshot ? { snapshot: e.dataTransferSnapshot } : {},
+				...e.dataTransferDialect ? { dialect: e.dataTransferDialect } : {},
+				assetSink: Ta($i()),
+				openArchive: (e) => Uo($i(), e),
+				refreshSubscriptions: (e) => {
+					r.refreshAll(e);
+				},
+				putArchive: vt,
+				...e.dataTransferDialect ? { dialect: e.dataTransferDialect } : {}
+			})
+		},
+		{
+			method: "POST",
+			path: Pa,
+			handle: ho({
+				secret: k,
+				store: e.store,
+				...e.dataTransferSnapshot ? { snapshot: e.dataTransferSnapshot } : {},
+				...e.dataTransferDialect ? { dialect: e.dataTransferDialect } : {},
+				assetSink: Ta($i()),
+				openArchive: (e) => Uo($i(), e),
+				refreshSubscriptions: (e) => {
+					r.refreshAll(e);
+				},
+				putArchive: vt
+			})
+		},
+		{
+			method: "GET",
+			path: La,
+			handle: Ho({
+				secret: k,
+				store: e.store
+			})
+		},
+		{
+			method: "GET",
+			path: Ia,
+			handle: Io({ secret: k })
+		},
+		{
+			method: "POST",
+			path: Fa,
+			handle: No({
+				secret: k,
+				store: e.store,
+				snapshot: e.dataTransferSnapshot ?? { tables: [] },
+				dialect: e.dataTransferDialect ?? "memory",
+				tenantTables: [...e.tenantScopedTables],
+				loadProfile: Xn,
+				assetSource: Ea($i(), e.store),
+				putArchive: vt
+			})
+		}
+	] : [], bt = [
+		...e.httpRoutes ?? [],
+		..._t.httpRoutes,
+		...yt,
+		...b.httpRoutes
+	];
+	Object.assign(O, C.handlers);
+	for (let t of D(e.discovered.streams ?? [])) O[t.descriptor.name] = (n) => Kr((r) => zi(r, (r) => {
+		let i = Fe(r), a = t.executor(n, i);
+		if (J.isEffect(a)) {
+			let t = a.pipe(J.provide(fi(i.store)));
+			return (e.baseLayer ? t.pipe(J.provide(e.baseLayer)) : t).pipe(J.provide(Ie)).pipe(J.provide(Le)).pipe(J.provide(Re)).pipe(J.provide(Ve));
+		}
+		return typeof a == "object" && a && typeof a.then == "function" ? J.promise(() => a) : a;
+	}), `stream.${t.descriptor.name}`);
+	for (let t of e.discovered.workflows ?? []) O[t.definition.name] = (e) => Gr(async (e, n) => {
+		let r = n;
+		return Ci(_, {
+			subject: r.subject,
+			traceId: r.traceId,
+			source: "workflow-rpc"
+		}).start(t.definition.name, e);
+	}, e, `workflow.${t.definition.name}`);
+	ue && (O[mr.name] = (e) => W(E({
+		descriptor: mr,
+		executor: (e) => {
+			let t = e.id;
+			return {
+				table: "_voltro_workflow_runs",
+				order: [{
+					column: "startedAt",
+					direction: "desc"
+				}],
+				predicate: Er(H("id", t), H("executionId", t)),
+				take: 1,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${mr.name}`), O[gr.name] = (e) => W(E({
+		descriptor: gr,
+		executor: (e) => {
+			let t = e, n = [...t.tag === void 0 ? [] : [H("tag", t.tag)], ...t.status === void 0 ? [] : [H("status", t.status)]], r = Number.isFinite(t.limit) && t.limit !== void 0 ? Math.min(Math.max(Math.floor(t.limit), 1), 500) : 100;
+			return {
+				table: "_voltro_workflow_runs",
+				order: [{
+					column: "startedAt",
+					direction: "desc"
+				}],
+				predicate: n.length === 0 ? void 0 : n.length === 1 ? n[0] : xr(...n),
+				take: r,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${gr.name}`), O[hr.name] = (e) => W(E({
+		descriptor: hr,
+		executor: (e) => {
+			let t = e.runId;
+			return {
+				table: "_voltro_workflow_run_steps",
+				order: [{
+					column: "startedAt",
+					direction: "asc"
+				}],
+				predicate: H("runId", t),
+				take: 1e3,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${hr.name}`), O[pr.name] = (e) => W(E({
+		descriptor: pr,
+		executor: (e) => {
+			let t = e.runId;
+			return {
+				table: "_voltro_workflow_run_events",
+				order: [{
+					column: "occurredAt",
+					direction: "asc"
+				}],
+				predicate: H("runId", t),
+				take: 1e3,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${pr.name}`), O[ur.name] = (e) => W(E({
+		descriptor: ur,
+		executor: (e) => {
+			let t = e;
+			return {
+				table: "_voltro_workflow_events",
+				order: [{
+					column: "occurredAt",
+					direction: "desc"
+				}],
+				predicate: t.name === void 0 ? void 0 : H("name", t.name),
+				take: Math.max(1, Math.min(500, t.limit ?? 100)),
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${ur.name}`), O[dr.name] = (e) => W(E({
+		descriptor: dr,
+		executor: (e) => {
+			let t = e.eventId;
+			return {
+				table: "_voltro_workflow_event_deliveries",
+				order: [{
+					column: "createdAt",
+					direction: "asc"
+				}],
+				predicate: H("eventId", t),
+				take: 500,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${dr.name}`), O[lr.name] = (t) => Gr(async (t, n) => {
+		let r = t;
+		return await N(e.store, n.subject, { executionId: r.executionId }), await _.cancel(r.workflowName, r.executionId), await Nt(r.workflowName, r.executionId, "workflow.cancel"), { ok: !0 };
+	}, t, `action.${lr.name}`), O[fr.name] = (t) => Gr(async (t, n) => {
+		let r = t;
+		return await N(e.store, n.subject, { executionId: r.executionId }), await _.resume(r.workflowName, r.executionId), { ok: !0 };
+	}, t, `action.${fr.name}`), O[_r.name] = (t) => Gr(async (t, n) => {
+		let r = t;
+		return await N(e.store, n.subject, { id: r.id }), _.signal({ id: r.id }, r.signalName, r.payload);
+	}, t, `action.${_r.name}`), O[vr.name] = (t) => Gr(async (t, n) => {
+		let r = t;
+		return await N(e.store, n.subject, { id: r.id }), _.update({ id: r.id }, r.updateName, r.payload, r.timeoutMs === void 0 ? void 0 : { timeoutMs: r.timeoutMs });
+	}, t, `action.${vr.name}`));
+	let xt = [
+		...D(e.discovered.queries).map((e) => B(e.descriptor)),
+		...D(e.discovered.mutations).map((e) => or(e.descriptor)),
+		...D(e.discovered.actions).map((e) => z(e.descriptor)),
+		...rt.queries.map((e) => B(e.descriptor)),
+		...rt.mutations.map((e) => or(e.descriptor)),
+		...it.queries.map((e) => B(e.descriptor)),
+		...it.mutations.map((e) => or(e.descriptor)),
+		...b.queries.map((e) => B(e.descriptor)),
+		...b.mutations.map((e) => or(e.descriptor)),
+		...b.actions.map((e) => z(e.descriptor)),
+		...D(e.discovered.streams ?? []).map((e) => sr(e.descriptor)),
+		...C.rpcs,
+		...(e.discovered.workflows ?? []).map((e) => Bi(e.definition)),
+		...ue ? [
+			B(mr),
+			B(gr),
+			B(hr),
+			B(pr),
+			B(ur),
+			B(dr),
+			z(lr),
+			z(fr),
+			z(_r),
+			z(vr)
+		] : []
+	], wt = Qi.make(...xt).middleware(rr).middleware(R), Tt = li({ resolveSubject: ({ headers: t, clientId: n }) => e.resolveSubject(t, n) }), Et = e.dormancyTenantId ?? Fr, Dt = e.dormancy === "sleep" ? {
+		register: (t, n, r) => Oi(e.store, {
+			tenantId: r ?? Et,
+			kind: "workflow",
+			refId: t,
+			wakeAt: n
+		}),
+		cancel: (t, n) => Jr(e.store, {
+			tenantId: n ?? Et,
+			kind: "workflow",
+			refId: t
+		}).then(() => {})
+	} : void 0, A = de ? await import("@voltro/workflow") : void 0, j = A?.makeWorkflowRunRecorder({
+		store: e.store,
+		...e.workflowRecording === void 0 ? {} : { recording: e.workflowRecording },
+		...Dt === void 0 ? {} : { wakeups: Dt }
+	}), jt = async (t, n) => {
+		await A.closeWorkflowChildrenForParent({
+			store: e.store,
+			parentExecutionId: t,
+			parentStatus: n,
+			recorder: j,
+			log: { warn: (e, t) => re.warn(e, t ?? {}) },
+			interruptChild: async (t, n) => {
+				let r = (e.discovered.workflows ?? []).find((e) => e.definition.name === t);
+				if (!r) throw Error(`Unknown child workflow: ${t}`);
+				if (!p) throw Error("Workflow runtime is not ready");
+				await p.runPromise(r.definition.interrupt(n));
+			}
+		});
+	}, Nt = async (t, n, r) => {
+		let i = (await e.store.query({
+			table: "_voltro_workflow_runs",
+			order: [],
+			predicate: H("executionId", n),
+			projection: void 0,
+			skip: void 0,
+			take: 1
+		}))[0];
+		if (i === void 0) return;
+		let a = await e.store.update("_voltro_workflow_runs", i.id, {
+			status: "cancelled",
+			cancelled: !0,
+			completedAt: /* @__PURE__ */ new Date()
+		}), o = i.subject?.tenantId ?? void 0;
+		a && await j.recordEvent({
+			runId: i.id,
+			eventType: "run-cancelled",
+			payload: {
+				reason: r,
+				workflowName: t,
+				executionId: n,
+				...o == null ? {} : { tenantId: o }
+			}
+		}), a && await jt(n, "cancelled");
+	}, Ft = [
+		...wi(e.discovered.workflows ?? [], {
+			buildContext: (t, n) => e.buildContextForWorkflow?.(t, n) ?? Fe({
+				subject: t.subject,
+				traceId: t.traceId
+			}, e.store, void 0, `workflow:${n.workflowName}`, { parentExecutionId: n.executionId }),
+			resolveStartContext: se,
+			...le === void 0 ? {} : { resolveAuthority: le }
+		}, (t, n, r) => {
+			let i = A.getWorkflowVersionMetadata(t.definition);
+			return A.wrapWorkflowExecuteWithRunRecording({
+				name: t.definition.name,
+				store: e.store,
+				subject: r.subject,
+				source: r.source ?? null,
+				traceId: r.traceId,
+				workflowVersion: i.version,
+				workflowCompatibleVersions: i.compatibleWith,
+				workflowPatches: i.patches,
+				parentExecutionId: r?.parentExecutionId ?? null,
+				parentClosePolicy: r?.parentClosePolicy ?? null,
+				onParentClose: ({ executionId: e, status: t }) => jt(e, t),
+				...$e(t.definition),
+				onTerminal: async ({ executionId: e }) => {
+					await d?.gate.release(e);
+				},
+				recorder: j,
+				pluginWorkflowStepLayer: Xe,
+				recordRun: Ei
+			}, n);
+		}),
+		...e.discovered.workflowWorkers ?? [],
+		..._e === void 0 ? [] : [_e]
+	], It = [...(e.discovered.workflows ?? []).map((e) => e.definition.name).filter(Boolean), ..._e === void 0 ? [] : ["voltro.deliverWebhook"]], Lt = Ft.length > 0 ? Y.mergeAll(...Ft) : Y.empty;
+	if (((e.discovered.workflows?.length ?? 0) > 0 || (e.discovered.workflowWorkers?.length ?? 0) > 0 || e.scheduleCoordination === "cluster" || _e !== void 0) && e.workflowEngineLayer !== void 0) {
+		let t = Lt.pipe(Y.provideMerge(e.workflowEngineLayer));
+		p = Wi.make((e.baseLayer === void 0 ? t : t.pipe(Y.provideMerge(e.baseLayer))).pipe(Y.provideMerge(nr({})))), await p.runPromise(J.void), (e.log ?? L({ scope: "voltro:serve" })).child("workflow").info(`workflow runtime ready — ${It.length} entity type(s) registered`, { entities: It });
+		let n = await import("@voltro/workflow/cluster"), r = (e) => p.runPromise(n.redriveFailedRun(e)), i = (e) => p.runPromise(n.resumeRunFromStep(e));
+		ne = await Ce({
+			provider: la(e.plugins ?? [])?.broadcast?.provider,
+			crossReplica: la(e.plugins ?? [])?.broadcast?.crossReplica ?? !1,
+			namespace: Te,
+			replicaId: crypto.randomUUID(),
+			pollStorage: () => p.runPromise(n.pollWorkflowStorage),
+			onChange: (t) => e.store.onChange((e) => t({
+				table: e.table,
+				op: e.op,
+				...e.origin === void 0 ? {} : { origin: e.origin }
+			})),
+			log: (e.log ?? L({ scope: "voltro:serve" })).child("workflow")
+		}), ee = async (t) => {
+			let n = await Ke({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runRedrive: r
+			}, t.runId);
+			return n.statusReset && await j.recordEvent({
+				runId: t.runId,
+				eventType: "run-redriven",
+				payload: {
+					reason: "inspect.redrive",
+					activitiesReset: n.outcome.activitiesReset
+				}
+			}), {
+				redriven: n.outcome.redriven,
+				activitiesReset: n.outcome.activitiesReset,
+				reason: n.outcome.reason
+			};
+		}, te = async (t) => {
+			let n = await Ye({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runResume: i
+			}, t.runId, t.step);
+			return n.statusReset && await j.recordEvent({
+				runId: t.runId,
+				eventType: "run-redriven",
+				payload: {
+					reason: "inspect.resume-from-step",
+					step: n.stepName,
+					activitiesReset: n.outcome.activitiesReset
+				}
+			}), {
+				redriven: n.outcome.redriven,
+				stepName: n.stepName,
+				activitiesReset: n.outcome.activitiesReset,
+				reason: n.outcome.reason
+			};
+		};
+		let a = (e.scheduleCoordination ?? "single") === "advisoryLock" ? ii(e.store, e.scheduleReplicaId ?? `pid-${process.pid}`) : Pi, l = di({
+			coordinator: a,
+			replicaId: e.scheduleReplicaId ?? `pid-${process.pid}`
+		}), u = L({ scope: "voltro:flow-control" }), f = {
+			info: (e, t) => {
+				u.info(e, t);
+			},
+			warn: (e, t) => {
+				u.warn(e, t);
+			},
+			error: (e, t) => {
+				u.error(e, t ?? {});
+			}
+		}, m, re = () => {
+			if (m !== void 0) return m;
+			if (o !== void 0 && j !== void 0) return m = v({
+				store: e.store,
+				log: P,
+				workflows: e.discovered.workflows ?? [],
+				workflowsProxy: o,
+				workflowRuntime: p,
+				workflowRunRecorder: j,
+				closeChildrenForParent: jt
+			}), m;
+		};
+		s = re, d = h({
+			store: e.store,
+			onChange: (t) => e.store.onChange((e) => t({
+				table: e.table,
+				op: e.op
+			})),
+			...e.scheduling === void 0 ? {} : {
+				disarmWhenIdle: e.scheduling.disarmWhenIdle,
+				drainIntervalMs: e.scheduling.admissionDrainMs,
+				cancelSweepIntervalMs: e.scheduling.cancelSweepMs,
+				stalenessSweepIntervalMs: e.scheduling.stalenessSweepMs
+			},
+			workflows: e.discovered.workflows ?? [],
+			facade: () => o,
+			cancelRunWithReason: re,
+			recordRunEvent: () => j?.recordEvent,
+			...e.workflowStaleness === void 0 ? {} : { staleness: e.workflowStaleness },
+			...e.workflowSuspendSignalHintMs === void 0 ? {} : { suspendSignalHintMs: e.workflowSuspendSignalHintMs },
+			scheduleCoordinated: l,
+			onAbandoned: async (t) => {
+				await ft({
+					workflows: e.discovered.workflows ?? [],
+					facade: () => o,
+					log: f,
+					...t
+				});
+			},
+			log: f
+		});
+		let g = d;
+		g !== void 0 && G(() => g.stop()), c = $t({
+			store: e.store,
+			onChange: (t) => e.store.onChange((e) => t({
+				table: e.table,
+				op: e.op
+			})),
+			...e.scheduling === void 0 ? {} : {
+				disarmWhenIdle: e.scheduling.disarmWhenIdle,
+				tickIntervalMs: e.scheduling.inferenceTickMs
+			},
+			enabled: (e.discovered.workflows?.length ?? 0) > 0,
+			resumeSignal: () => p === void 0 || A === void 0 ? void 0 : async ({ executionId: t, workflowName: n, signalName: r, payload: i }) => {
+				await p.runPromise(A.completeSuspendingSignal({
+					store: e.store,
+					target: Kt(t, n),
+					signalName: r,
+					payload: i
+				}));
+			},
+			runEffect: (e) => p.runPromise(e),
+			scheduleCoordinated: l,
+			log: f
+		});
+		let ie = c;
+		ie !== void 0 && G(() => ie.stop()), o = (e.discovered.workflows?.length ?? 0) > 0 ? Si({
+			workflows: e.discovered.workflows ?? [],
+			runEffect: (e) => p.runPromise(e),
+			onEnqueue: () => ne?.publishWake(),
+			...g === void 0 ? {} : {
+				admitStart: g.gate.admitStart,
+				startPayloadSchema: g.gate.startPayloadSchema,
+				parkDelayedStart: g.gate.parkDelayed
+			},
+			rememberStartContext: oe,
+			signal: async (t, n, r) => {
+				let i = await A.sendWorkflowSignal({
+					store: e.store,
+					recorder: j,
+					target: t,
+					signalName: n,
+					payload: r
+				});
+				return await p.runPromise(A.completeSuspendingSignal({
+					store: e.store,
+					target: t,
+					signalName: n,
+					payload: r
+				})).catch(() => {}), i;
+			},
+			update: (t, n, r, i) => A.sendWorkflowUpdate({
+				store: e.store,
+				recorder: j,
+				target: t,
+				updateName: n,
+				payload: r,
+				...i === void 0 ? {} : { options: i }
+			}),
+			listRuns: (t) => qe(e.store, t),
+			retry: (t, n) => ke({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runPromise: (e) => p.runPromise(e)
+			}, t, n),
+			redrive: (t) => Ke({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runRedrive: r
+			}, t).then((e) => e.outcome)
+		}) : void 0;
+	}
+	let Rt = Y.mergeAll(wt.toLayer(O), Tt), Bt = mt(O, e.discovered.queries.map((e) => e.descriptor.name), ue), Ut = Y.mergeAll(wt.toLayer(Bt), Tt), M = e.observability, Wt = await qr({
+		...e.traceSink === void 0 ? {} : { traceSink: e.traceSink },
+		...e.appName === void 0 ? {} : { serviceName: e.appName },
+		...M && M.spanProcessors.length > 0 ? { extraSpanProcessors: M.spanProcessors } : {},
+		...M && M.metricReaders.length > 0 ? { extraMetricReaders: M.metricReaders } : {},
+		...M && Object.keys(M.resourceAttributes).length > 0 ? { resourceAttributes: M.resourceAttributes } : {},
+		...M && M.sampler !== void 0 ? { sampler: M.sampler } : {}
+	}), qt = !1, Jt = e.store.ping ? () => e.store.ping().then(() => !0).catch(() => !1) : void 0, { server: Yt, shutdown: Xt } = Fi({
+		group: wt,
+		handlersLayer: Rt,
+		httpHandlersLayer: Ut,
+		port: e.port ?? 4e3,
+		...e.host === void 0 ? {} : { host: e.host },
+		path: e.path ?? "/ws",
+		tracerLayer: Wt.layer,
+		security: pe(e),
+		...Bn(e),
+		...e.discovered.wsGateways !== void 0 && e.discovered.wsGateways.length > 0 ? { webSocketGateways: e.discovered.wsGateways } : {},
+		resolveGatewaySubject: async (t) => {
+			let n = await e.resolveSubject(t, -1);
+			return n.subject.type === "anonymous" ? null : {
+				subject: n.subject,
+				...n.credentialExpiresAt === void 0 ? {} : { credentialExpiresAt: n.credentialExpiresAt * 1e3 }
+			};
+		},
+		...Je,
+		healthCheck: (() => {
+			let t = e.health;
+			if (t?.readiness !== void 0) {
+				let e = t.readiness;
+				return {
+					isReady: () => qt,
+					ping: async () => {
+						try {
+							return await e();
+						} catch {
+							return !1;
+						}
+					}
+				};
+			}
+			return {
+				isReady: () => qt,
+				...Jt ? { ping: Jt } : {}
+			};
+		})(),
+		...bt.length > 0 ? { httpRoutes: bt } : {},
+		...e.getStore === void 0 ? {} : { getStore: e.getStore },
+		...ve.size > 0 ? { webhookRoutes: ve } : {},
+		...e.inspectRoute === void 0 ? {} : { inspectRoute: e.inspectRoute },
+		...e.inspectStream === void 0 ? {} : { inspectStream: e.inspectStream }
+	}), Zt = Ma(Yt);
+	if (await Wr(Yt), (e.discovered.schedules?.length ?? 0) > 0) {
+		let t = (e.scheduleCoordination ?? "single") === "advisoryLock" ? ii(e.store, e.scheduleReplicaId ?? `pid-${process.pid}`) : Pi;
+		m = await q(e.discovered.schedules ?? [], {
+			store: e.store,
+			coordinator: t,
+			defaultTrigger: e.scheduleDefaultTrigger ?? "self",
+			replicaId: e.scheduleReplicaId ?? `pid-${process.pid}`,
+			armSelf: e.scheduleArmSelf ?? !0,
+			dormancy: e.dormancy ?? "always-on",
+			...e.scheduling === void 0 ? {} : { runHeartbeatMs: e.scheduling.scheduleHeartbeatMs },
+			...e.dormancyTenantId === void 0 ? {} : { dormancyTenantId: e.dormancyTenantId },
+			buildContext: ({ traceId: t, scheduleName: n, subject: r }) => Fe({
+				subject: r,
+				traceId: t
+			}, e.store, void 0, `schedule:${n}`),
+			log: {
+				info: (e, t) => {
+					g.info(e, t);
+				},
+				warn: (e, t) => {
+					g.warn(e, t);
+				},
+				error: (e, t) => {
+					g.error(e, t ?? {});
+				},
+				debug: () => {}
+			},
+			...e.scheduleFireInterceptor === void 0 ? {} : { interceptFire: e.scheduleFireInterceptor },
+			...e.onScheduleRunEvent === void 0 ? {} : { onRunEvent: e.onScheduleRunEvent }
+		}), e.onSchedulerReady?.(m);
+	}
+	let P = e.log ?? L({ scope: "voltro:serve" }), en, tn, rn = e.claimChange;
+	if ((e.discovered.subscribers?.length ?? 0) > 0 && (en = kt(e.discovered.subscribers ?? [], e.store, P.child("subscribe"), e.schemaRegistry, {
+		eventBus: C.bus,
+		...rn === void 0 ? {} : { claimOnce: rn }
+	})), (e.discovered.reactions?.length ?? 0) > 0) {
+		let t = P.child("reaction");
+		tn = Ne(e.discovered.reactions ?? [], e.store, {
+			runAct: async (n, r) => {
+				if (n.kind === "workflow") {
+					if (_ === void 0) {
+						t.warn("reaction workflow act skipped — no workflow engine in this app", { workflow: n.workflow });
+						return;
+					}
+					let e = n.payload === void 0 ? r.new ?? r.old ?? {} : n.payload(r);
+					await Ci(_, {
+						traceId: `reaction:${n.workflow}`,
+						source: `reaction:${n.workflow}`
+					}).start(n.workflow, e);
+					return;
+				}
+				await nn(n.agent, r, {
+					findAgentSend: (t) => e.discovered.actions.find((e) => e.descriptor.name === `${t}.send`),
+					runAction: (e, t, n) => Promise.resolve(ot(e, t, n)),
+					makeSubject: (e) => ir(e),
+					now: () => Date.now(),
+					log: t
+				});
+			},
+			checkBudget: async (n, r) => {
+				try {
+					let { requireAiBudget: t } = await import("@voltro/ai");
+					return (await J.runPromise(J.either(t(e.store, {
+						tenantId: n,
+						limitUsd: r
+					}))))._tag === "Right";
+				} catch (e) {
+					return t.warn("reaction budget check failed — refusing the act", { tenantId: n }, e), !1;
+				}
+			},
+			...rn === void 0 ? {} : { claimRateSlot: (e) => rn(Ct, e) },
+			...rn === void 0 ? {} : { claimDedupe: (e) => rn(T, e) }
+		}, t);
+	}
+	let an;
+	(e.discovered.aggregates?.length ?? 0) > 0 && (an = await x({
+		discovered: e.discovered.aggregates ?? [],
+		store: e.store,
+		log: P.child("aggregate"),
+		...e.analytics === void 0 ? {} : { analytics: e.analytics },
+		...e.aggregateStorage === void 0 ? {} : { storage: e.aggregateStorage },
+		...e.aggregateCoordinator === void 0 ? {} : { coordinator: e.aggregateCoordinator }
+	}), Ie = Y.succeed(Pr, an.registry));
+	let on;
+	(e.discovered.expectations?.length ?? 0) > 0 && (on = Vr({
+		discovered: e.discovered.expectations ?? [],
+		store: e.store,
+		log: P.child("expectation")
+	}), Le = Y.succeed(Lr, on.registry)), (e.discovered.budgets?.length ?? 0) > 0 && (n = Ur({
+		discovered: e.discovered.budgets ?? [],
+		log: P.child("finops")
+	}), Re = Y.succeed(U, n.registry));
+	let sn;
+	return (e.discovered.experiments?.length ?? 0) > 0 && (sn = Hr({
+		discovered: e.discovered.experiments ?? [],
+		store: e.store,
+		log: P.child("experiment")
+	}), Ve = Y.succeed(Rr, sn.registry)), qt = !0, e.bootTiming?.mark("ready"), {
+		dispatcher: r,
+		server: Yt,
+		scheduler: m,
+		eventsSnapshot: ce(C.bus, C.declared),
+		membersSnapshot: () => ({
+			members: Me.membership.list(),
+			capturedAt: Date.now()
+		}),
+		agentTools: () => gt,
+		rpcMetrics: () => We,
+		webhooksService: () => he,
+		runCanceller: () => s(),
+		flowControlHealth: () => d?.cancelHealth(),
+		inferenceHealth: () => c?.health(),
+		workflowWriteActions: () => _ === void 0 || j === void 0 ? void 0 : ze({
+			store: e.store,
+			log: P,
+			workflows: e.discovered.workflows ?? [],
+			workflowsProxy: o,
+			workflowRuntime: p,
+			workflowRunRecorder: j,
+			closeChildrenForParent: jt
+		}),
+		redriveWorkflowRun: (e) => ee ? ee(e) : Promise.reject(/* @__PURE__ */ Error("redrive: this app registers no workflows")),
+		resumeWorkflowRunFromStep: (e) => te ? te(e) : Promise.reject(/* @__PURE__ */ Error("resume-from-step: this app registers no workflows")),
+		close: async () => {
+			qt = !1, await Zt.drainRequests();
+			for (let e of ye) try {
+				await e();
+			} catch (e) {
+				P.warn("serve: teardown step failed", {}, e);
+			}
+			await Pe?.detach(), await Me.detach(), an?.detach(), on?.detach(), n?.detach(), sn?.detach(), tn?.(), en?.(), await m?.shutdown(), r.close(), await ne?.detach(), await p?.dispose(), await Xt(), await Zt.finish();
+		}
+	};
+}, Ko = (e) => {
+	if (e == null || e === "") return;
+	let t = Number(e);
+	return Number.isFinite(t) && t > 0 ? t : void 0;
+}, qo = (e, t) => {
+	let n = e === void 0 || e === !1 ? {
+		on: !1,
+		size: 500
+	} : {
+		on: !0,
+		size: Ko(e === !0 ? void 0 : e.size) ?? 500
+	};
+	if (t === void 0 || t.trim() === "") return n;
+	let r = t.trim().toLowerCase();
+	if (r === "off" || r === "false" || r === "0") return {
+		on: !1,
+		size: n.size
+	};
+	if (r === "on" || r === "true") return {
+		on: !0,
+		size: n.size
+	};
+	let i = Ko(r);
+	return i === void 0 ? n : {
+		on: !0,
+		size: i
+	};
+}, Jo = (e, t = process.env) => ({
+	logs: qo(e?.logs, t.VOLTRO_INSPECT_LOGS),
+	traces: qo(e?.traces, t.VOLTRO_INSPECT_TRACES)
+}), $ = L({ scope: "voltro:serve" }), Yo = (e, t, n) => (e === "production" || e === "staging") && t !== "memory" && n !== "0", Xo = mn, Zo = async (e) => {
+	let t = _n(process.cwd());
+	if (er(t)) {
+		let n;
+		try {
+			let e = await import(tr(t).href);
+			typeof e.runServe == "function" ? n = e.runServe : $.warn("serve bundle has no runServe export — using the standard serve path");
+		} catch (e) {
+			$.warn("serve bundle failed to load — using the standard serve path", {}, e);
+		}
+		if (n) return $.info("serve: booting from the precompiled serve bundle"), n(e);
+	}
+	return Qo(e);
+}, Qo = async (l) => {
+	Nr("serve");
+	let u = qn();
+	e("serve");
+	try {
+		Hi();
+	} catch (e) {
+		throw i(e instanceof Error ? e.message : String(e));
+	}
+	let f = process.cwd(), h = await it(f), ie = hn({
+		kind: "api",
+		configPort: h?.port,
+		env: process.env,
+		flagPort: Xo(l, "--port")
+	});
+	for (let e of ie.warnings) $.warn(e);
+	let ce = ie.port;
+	ji(ki(h?.secrets)), await rn({
+		rawEnv: h?.env,
+		appType: "api",
+		root: f,
+		log: $,
+		generateTypes: !1,
+		plugins: h?.plugins ?? []
+	}), u.mark("config");
+	let v = (process.env.DB_DIALECT ?? h?.store ?? "memory").toLowerCase(), ge = (v === "mariadb" || v === "postgres" || v === "mssql") && (process.env.CDC ?? "1") !== "0", Se = v === "mariadb" ? "mariadb" : v === "mssql" ? "mssql" : void 0, Ce = gn(f);
+	if (!r() && er(Ce)) try {
+		let e = await import(tr(Ce).href);
+		if (e.modules) {
+			let t = {};
+			for (let [n, r] of Object.entries(e.modules)) t[Qn(f, n)] = r;
+			n(t), $.info("precompiled api bundle loaded", { modules: Object.keys(t).length });
+		}
+	} catch (e) {
+		$.warn("precompiled api bundle failed to load — falling back to source", {}, e);
+	}
+	let x = await jt(f), S = await Ut(x, {
+		root: f,
+		cdc: ge && Se !== void 0
+	}), Ee = _e(S);
+	{
+		ot({
+			plugins: h?.plugins ?? [],
+			queries: S.queries,
+			mutations: S.mutations,
+			actions: S.actions,
+			streams: S.streams,
+			log: $
+		});
+		let e = Ae(S.serverOnlyLeaks, Xe(process.env, "strict"), Zr, "`voltro serve`");
+		if (e.action === "fail") throw i(e.message ?? "");
+		e.action === "warn" && $.warn(e.message ?? "");
+	}
+	let Oe = x.filter((e) => Kn.test(e)), ke = Oe.length > 0 ? await Gn(Oe, $.child("webhooks")) : {
+		outgoing: [],
+		incoming: [],
+		providers: []
+	}, Ne = Un(S.events), ze = ke.outgoing.length + ke.incoming.length + ke.providers.length + Ne.length === 0 ? void 0 : {
+		...ke,
+		outgoing: [...ke.outgoing, ...Ne]
+	}, Be = kn({
+		nodeEnv: process.env.NODE_ENV,
+		cdcDialect: Se,
+		declared: h?.schema
+	}), Ke = An({
+		gates: Be,
+		runtime: {
+			traces: me(),
+			undo: Li()
+		}
+	});
+	if (Ke !== void 0) throw i(`serve: ${Ke}`);
+	let qe = On({
+		mix: S.featureMix,
+		plugins: h?.plugins ?? [],
+		gates: Be,
+		...Se ? { cdcDialect: Se } : {}
+	}), Ye = h?.analytics !== void 0 && h.analytics.kind !== "noop" && v !== "memory" ? (await vn(v)).makeSqlLayer(j()) : void 0, $e = await st({
+		spec: h?.analytics,
+		sqlLayer: Ye,
+		log: $
+	}), w = (() => {
+		let e = new Set(S.tables.map((e) => e.tableName)), t = [...S.tables];
+		for (let n of [...qe, ...$e.tables]) e.has(n.tableName) || (e.add(n.tableName), t.push(n));
+		return t;
+	})();
+	for (let e of w) Tr(e);
+	{
+		let e = Qr(Ri(De(S), le(w)));
+		e !== void 0 && $.warn(e);
+	}
+	let et = (process.env.NODE_ENV ?? "").toLowerCase();
+	if (Yo(et, v, process.env.VOLTRO_AUTO_MIGRATE)) {
+		let e = (await vn(v)).makeSqlLayer(j()), t = await J.runPromise(Gi.SqlClient.pipe(J.flatMap((e) => Ji(e, f)), J.provide(e), J.catchAll(() => J.succeed([]))));
+		t.length > 0 && ($.error(`serve: refusing to boot — ${t.length} pending file-based migration(s) have never run against this database. They perform the changes a schema diff cannot infer (data moves, backfills, table splits), so the declarative fingerprint check below cannot see them and would have let this process serve un-migrated data.`, { pending: t }), $.error("Run them from your pre-deploy job — `voltro db migrate .` (schema + files) or `voltro db files .` (files alone) — or set VOLTRO_AUTO_MIGRATE=0 to bypass every boot schema check. `voltro serve` never applies them itself: a rolling deploy would start N replicas and each would try."), process.exit(1));
+		let n = await J.runPromise(Gi.SqlClient.pipe(J.flatMap((e) => Yi(e, w, {
+			appliedBy: `serve:${et}`,
+			environment: "prod",
+			dialectId: v
+		})), J.provide(e)));
+		n.kind === "prod-mismatch" && ($.error(qi(n, v)), $.error(jn({
+			gates: Be,
+			nodeEnv: process.env.NODE_ENV,
+			cdcDialect: Se,
+			declared: h?.schema
+		})), $.error("serve: refusing to boot — apply the schema first (voltro db apply in a pre-deploy step), or set VOLTRO_AUTO_MIGRATE=0 to bypass this check."), process.exit(1)), $.info(qi(n, v));
+	}
+	await Cn({
+		dialectId: v,
+		tables: w,
+		mode: xn(h?.reactiveTriggers),
+		lockSchema: j().schema,
+		makeLayer: async () => (await vn(v)).makeSqlLayer(j()),
+		log: {
+			info: (e, t) => $.info(e, t ?? {}),
+			warn: (e, t) => $.warn(e, t ?? {})
+		}
+	});
+	let nt = xi(w);
+	u.mark("discover");
+	let T = await gt(h, void 0);
+	{
+		let e = await c(T);
+		if (e !== void 0) throw i(`serve: ${e}`);
+		let t = await s(T, v, h);
+		t !== void 0 && $.warn(t);
+	}
+	let at = Vi(T, v);
+	for (let e of Te({
+		dialect: String(h?.store ?? process.env.DB_DIALECT ?? "postgres"),
+		changeStrategy: (process.env.CDC ?? "1") === "0" ? "inline" : "cdc",
+		dbUrl: process.env.DB_URL,
+		crossReplicaBus: la(h?.plugins ?? [])?.broadcast.crossReplica === !0,
+		tables: S.tables.map((e) => ({
+			tableName: e.tableName,
+			isReactive: e.isReactive === !0
+		})),
+		querySources: S.queries.flatMap((e) => {
+			let t = e.descriptor.source;
+			return t === void 0 ? [] : typeof t == "string" ? [t] : [...t];
+		})
+	})) e.level === "warn" ? $.warn(e.message) : $.info(e.message);
+	{
+		let e = oe({
+			tables: br().map((e) => ({ tableName: e.tableName })),
+			queries: S.queries.map((e) => ({
+				name: e.descriptor.name,
+				source: e.descriptor.source
+			}))
+		}), t = g(e);
+		t !== void 0 && $.warn(t);
+	}
+	h?.cache && !process.env.CACHE_BACKEND && (process.env.CACHE_BACKEND = h.cache), h?.cacheRedisUrl && !process.env.CACHE_REDIS_URL && (process.env.CACHE_REDIS_URL = h.cacheRedisUrl), h?.cacheRedisDriver && !process.env.CACHE_REDIS_DRIVER && (process.env.CACHE_REDIS_DRIVER = h.cacheRedisDriver), h?.cacheKeyPrefix && !process.env.CACHE_KEY_PREFIX && (process.env.CACHE_KEY_PREFIX = h.cacheKeyPrefix);
+	let { service: lt, invalidationBus: ft, snapshotCache: mt, cache: St, semantic: Ct, evictSource: Ot, backend: kt, stats: At, dispose: Mt } = await Le({
+		env: process.env,
+		semantic: h?.cacheSemantic ?? !1
+	});
+	Ct !== void 0 && $.info("semantic cache enabled — reactive eviction on live writes"), $.info(`cache backend resolved: ${kt}` + (kt === "redis" ? ` (driver ${process.env.CACHE_REDIS_DRIVER ?? "resp"})` : " — in-process, not cross-instance"));
+	let Pt = (e) => {
+		J.runFork(ft.publish(e));
+	};
+	T.onChange((e) => {
+		if (J.runFork(ft.publish(e.table)), Ot !== void 0) {
+			let t = (e.new ?? e.old)?.id;
+			Ot({
+				table: e.table,
+				op: e.op,
+				...t === void 0 ? {} : { id: t }
+			});
+		}
+	}), h?.kv && !process.env.KV_BACKEND && (process.env.KV_BACKEND = h.kv), h?.kvRedisUrl && !process.env.KV_REDIS_URL && (process.env.KV_REDIS_URL = h.kvRedisUrl), h?.kvKeyPrefix && !process.env.KV_KEY_PREFIX && (process.env.KV_KEY_PREFIX = h.kvKeyPrefix);
+	let { kv: zt, service: Vt } = await ci({ store: T });
+	Me({
+		log: $,
+		max: bn(),
+		outOfPool: ve(v, (process.env.CDC ?? "1") !== "0"),
+		readPools: t.replicationSnapshot()?.replicaCount ?? 0,
+		always: !0
+	}), u.mark("store");
+	let Ht = Br({
+		store: T,
+		sink: $e.sink,
+		log: $
+	}), N = Et(h?.idempotency, T), Kt = Jt({
+		store: T,
+		dialect: v,
+		log: { info: (e) => $.info(e) },
+		...N === void 0 ? {} : { idempotencyTtlMs: N.ttlMs }
+	}), F = h?.plugins ?? [], Qt = Ar(), $t, nn;
+	v !== "memory" && ($t = Wi.make((await vn(v)).makeSqlLayer(j()).pipe(Y.provideMerge(nr({})))), nn = await $t.runPromise(Gi.SqlClient));
+	let mn = [
+		"postgres",
+		"mariadb",
+		"mysql",
+		"mssql"
+	].includes(v) ? ii(T, Qt, $) : Pi, _n = Re(h?.scheduling), Bn = di({
+		maxIdleIntervalMs: _n.pollCeilingMs,
+		coordinator: mn,
+		replicaId: Qt,
+		log: $
+	}), Wn = [], Jn = Ar(), Yn = la(h?.plugins ?? [])?.broadcast?.provider, Xn = Gt(h?.plugins, h?.name ?? Zn(f));
+	{
+		let e = Ze(h?.plugins, h?.name ?? Zn(f));
+		e !== void 0 && $.warn(e);
+	}
+	let I = tt(h?.plugins, {
+		instanceId: Jn,
+		namespace: Xn,
+		meta: { mode: "serve" },
+		logger: $
+	}), $n = jr();
+	Mr(`${$n.host}:${ce}`, $n.declared);
+	let rr = on(), R = Jo(h?.inspect), z = fe({
+		store: T,
+		members: () => I.membership?.list() ?? []
+	}), ir = () => {
+		let e = I.membership?.list().length;
+		return typeof e == "number" && e > 0 ? { fleetSize: e } : {};
+	}, ar = zn({
+		mode: "serve",
+		dialect: v,
+		...Yn === void 0 ? {} : { provider: Yn },
+		logger: $
+	});
+	G(async () => {
+		await ar.stop();
+	}), m(h?.reactive), Pe(h);
+	let or = M(T, {
+		claimedBy: kr(),
+		onError: (e) => $.warn("change claim failed — the claimed effect is being SKIPPED, not duplicated", { cause: String(e) })
+	}), B = {
+		...nn ? { sql: nn } : {},
+		instanceId: Jn,
+		membership: I.membership,
+		...Yn === void 0 ? {} : { broadcast: Yn },
+		broadcastChannels: { presence: ca(Xn, "presence") },
+		scheduleCoordinated: (e, t, n) => {
+			let r = Bn(e, t, n);
+			return Wn.push(r), r;
+		},
+		claimChange: or.claim
+	};
+	for (let e of F) e.bindDataStore?.(at, B);
+	be({
+		store: T,
+		...vt(),
+		log: $
+	});
+	let sr = F.filter((e) => typeof e.onChangeEvent == "function");
+	if (sr.length > 0) {
+		let e = T.changeScope ?? "local";
+		T.onChange((t) => {
+			let n = Ue(t, e);
+			for (let e of sr) J.runFork(e.onChangeEvent(n).pipe(J.catchAllCause((t) => J.sync(() => $.warn(`plugin ${e.name} onChangeEvent failed`, { error: Ui.pretty(t) })))));
+		});
+	}
+	let cr = x.filter((e) => Nn.test(e));
+	cr.length > 0 && (await It(cr, $), $.info(`queue: ${cr.length} consumer file(s) loaded`));
+	let lr = A({
+		plugins: F,
+		appName: h?.name ?? "voltro-api",
+		appType: "api",
+		voltroVersion: Or() ?? "unknown",
+		log: $
+	});
+	F.length && await lr.activate(), u.mark("plugins");
+	let ur = await lr.gatherObservability(), dr = L({ scope: "voltro:broadcast" }), fr = {
+		info: (e, t) => {
+			dr.info(e, t);
+		},
+		warn: (e, t) => {
+			dr.warn(e, t);
+		},
+		debug: () => {}
+	};
+	R.logs.on && (cn(new dn(R.logs.size)), G(ln(rr)), fr.info("inspect: serving /_voltro/inspect/logs", { ring: R.logs.size }));
+	let pr;
+	R.traces.on && (en(new y(R.traces.size)), pr = ui(pt({ buffer: je() })), fr.info("inspect: serving /_voltro/inspect/traces", { ring: R.traces.size }));
+	let mr, hr = Lt({
+		store: T,
+		dispatcher: () => mr,
+		invalidateTable: () => Pt,
+		log: fr
+	}), gr = await Tt(T, h, v, Xn, fr, hr.onBroadcastGap), _r = h?.apiKeys, vr = (typeof _r == "object" ? _r.prefix : void 0) ?? "voltro_", V = _r ? Xr(T) : void 0, yr = V ? oi({ flush: si(V) }) : void 0;
+	yr && G(() => yr.shutdown());
+	let xr = V ? ai(V, {
+		prefix: vr,
+		...yr ? { usage: yr } : {}
+	}) : void 0, Cr = xr ? [$r(xr, { prefix: vr })] : [], wr = Ft([...h?.auth?.strategies ?? [], ...Cr], ga(h?.plugins ?? []), h?.auth?.anonymousTenantRequired ?? !1, h?.auth, () => at), H = [...h?.restRoutes ?? [], ...xr ? zr(xr, (typeof _r == "object" ? _r.managementPath : void 0) ?? "/v1/api-keys") : []], Er = F.map((e) => e.services).filter((e) => e !== void 0), Pr = Y.mergeAll(Qe({
+		analyticsLayer: $e.layer,
+		cacheService: lt,
+		kvService: Vt,
+		...Ct === void 0 ? {} : { semanticCache: Ct },
+		pluginServices: Er,
+		userLayers: h?.layers ?? []
+	}), O(h?.http ?? {})), U = await Nt({
+		files: x,
+		store: T,
+		log: $,
+		seedPolicy: "report",
+		seedPattern: Mn,
+		loadSeedFiles: Sn,
+		startupPattern: Rn,
+		loadStartupFiles: a,
+		runStartups: o,
+		emailPattern: Dt,
+		loadEmailFiles: ht,
+		registerEmailTemplates: _a
+	});
+	(U.startupCount > 0 || U.emailCount > 0) && $.info("boot lifecycle", {
+		startups: U.startupCount,
+		emailTemplates: U.emailCount
+	}), U.startups !== void 0 && G(async () => {
+		await U.startups.stop();
+	}), Ge({
+		demands: de(Ee),
+		isRegistered: (e) => ei(e) !== void 0
+	});
+	let Fr = ct({
+		schedules: dt({
+			schedules: S.schedules,
+			seeds: U.seeds,
+			store: T,
+			log: $.child("seeds")
+		}),
+		workflows: S.workflows ?? [],
+		log: $.child("workflow-schedules")
+	}), Ir = h?.scheduling ?? {}, Lr = Ir.trigger ?? "self", Rr = /* @__PURE__ */ new Set([
+		"postgres",
+		"mysql",
+		"mariadb",
+		"mssql"
+	]), Vr = Ir.coordination ?? (Rr.has(v) ? "advisoryLock" : "single"), Hr = Vr === "cluster" && Rr.has(v), Ur = Hr ? "cluster" : Vr === "advisoryLock" && Rr.has(v) ? "advisoryLock" : "single";
+	Vr === "cluster" && !Hr && $.warn("scheduling.coordination=cluster needs a sql-backed store except sqlite — falling back to single"), Vr === "advisoryLock" && !Rr.has(v) && $.warn("scheduling.coordination=advisoryLock needs a SQL store (the claim-row gate) — falling back to single");
+	let Wr, Gr = S.workflows.length > 0 || S.workflowWorkers.length > 0 || S.eventTriggers.length > 0 || (ze?.outgoing.length ?? 0) > 0 || Hr, Kr;
+	if (Gr) {
+		if (v === "mssql") {
+			let e = await Hn(process.cwd());
+			e && $.warn(e);
+		}
+		let [{ WorkflowEngine: e }, { makeClusterCronLayer: t, workflowEngineLayer: n, resolveRunnerStorage: r, resolveFailoverTuning: i }] = await Promise.all([import("@effect/workflow"), import("@voltro/workflow/cluster")]), a = Hr ? Fr.filter((e) => (e.trigger ?? Lr) === "self").map((e) => t({
+			name: e.name,
+			cron: Yr(e),
+			execute: async () => {
+				await Wr?.fireFromCluster(e.name);
+			}
+		})) : [];
+		Kr = v === "memory" ? e.layerMemory : await (async () => {
+			let e = await vn(v), t = r({ sqliteFamily: e.id === "sqlite" || e.id === "turso" });
+			return $.info(`workflow engine: cluster-${t}, dialect=${e.id}` + (t === "memory" ? " — single-process durable replay, no cross-pod shard handoff" + (e.id !== "sqlite" && e.id !== "turso" ? " (VOLTRO_WORKFLOW_RUNNER_STORAGE=memory: SqlRunnerStorage/cluster_runners + GET_LOCK skipped)" : "") : "")), n({
+				sqlClientLayer: e.makeSqlLayer(j()),
+				runnerStorage: t,
+				dialectId: e.id,
+				...process.env.VOLTRO_WORKFLOW_RUNNER_PORT ? { runnerListenPort: Number(process.env.VOLTRO_WORKFLOW_RUNNER_PORT) } : {},
+				...i(),
+				...a.length > 0 ? { extraShardingLayers: a } : {}
+			});
+		})();
+	}
+	let W = E(F, Vn()), qr = x.filter((e) => /\.subscribe\.tsx?$/.test(e)), Jr = qr.length > 0 ? await Rt(qr, $) : [], ti = x.filter((e) => /\.reaction\.tsx?$/.test(e)), ni = ti.length > 0 ? await te(ti, $) : [], ri = x.filter((e) => Pn.test(e)), li = ri.length > 0 ? await _t(ri, $) : [], fi = x.filter((e) => /\.aggregate\.tsx?$/.test(e)), pi = fi.length > 0 ? await _(fi, $) : [];
+	{
+		let e = Qr(Ri(De({ aggregates: pi.map((e) => e.definition) }), le(w)));
+		e !== void 0 && $.warn(e);
+	}
+	let mi = he();
+	if (pi.length > 0 && v !== "memory") try {
+		let e = (await vn(v)).makeSqlLayer(j());
+		mi = ye(e);
+	} catch (e) {
+		$.warn("aggregate: SQL storage init failed — falling back to in-process", { err: String(e) });
+	}
+	let hi = v === "memory" ? Pi : ii(T, `aggregate@${process.pid}`, $), gi = x.filter((e) => Fn.test(e)), _i = gi.length > 0 ? await bt(gi, $) : [], vi = x.filter((e) => In.test(e)), yi = vi.length > 0 ? await p(vi, $) : [], bi = x.filter((e) => Ln.test(e)), Si = bi.length > 0 ? await b(bi, $) : [], Ci = [], wi = [], Ti = x.filter((e) => wn.test(e));
+	if (Ti.length > 0) {
+		let e = $.child("agent"), t = x.filter((e) => Dn.test(e));
+		t.length > 0 && await Tn(t, e);
+		let n = await En(Ti, e);
+		for (let e of n.agents) for (let t of wt(e)) (t.kind === "action" ? Ci : wi).push({
+			file: t.file,
+			descriptor: t.descriptor,
+			executor: t.executor
+		});
+		n.agents.length > 0 && e.info("synthesized agent routes", { agents: n.agents.map((e) => e.descriptor.name) });
+	}
+	u.mark("workflow");
+	let K = () => {
+		let e = q.workflowWriteActions();
+		if (e === void 0) throw Error("workflow actions: this app registers no workflows");
+		return e;
+	}, Ei = Sr({
+		dialect: v,
+		...j()
+	}), Di = v === "memory" ? void 0 : (await vn(v)).makeSqlLayer(j()), Oi = async () => Wt({
+		sqlLayer: Di,
+		declared: w,
+		log: $
+	}), Ai = {
+		kind: "api",
+		meta: {
+			name: h?.name ?? "voltro-api",
+			voltroVersion: Bt,
+			port: ce,
+			mode: Dr(),
+			store: v,
+			cdc: ge ? "on" : "off",
+			...Ei === void 0 ? {} : { databaseId: Ei }
+		},
+		rpc: yt(S, f),
+		workflows: xe(S, f),
+		migrations: Oi,
+		events: () => q.eventsSnapshot(),
+		agentTools: () => q.agentTools(),
+		invariantChecks: () => ({
+			mode: "serve",
+			accessGate: Ee,
+			config: h,
+			serverOnlyLeaks: S.serverOnlyLeaks,
+			migrations: Oi
+		}),
+		members: () => q.membersSnapshot(),
+		inspectFireSchedule: async ({ name: e, trigger: t }) => {
+			if (!Wr) throw Error("scheduler not started — this app registers no self-triggered schedules (all schedules are trigger:'external', or there are none).");
+			return { runId: await Wr.fireNow(e, t) ?? null };
+		},
+		inspectBackfillSchedule: we({
+			getHandle: () => Wr,
+			getSchedules: () => Fr
+		}),
+		...ze === void 0 ? {} : { webhooks: () => d({
+			store: T,
+			discoveredWebhooks: ze
+		}) },
+		plugins: () => ({
+			plugins: lr.snapshot(),
+			capturedAt: Date.now()
+		}),
+		env: () => an(h?.name ?? Zn(f), {
+			...h?.env !== void 0 && aa(h.env) ? { contract: h.env } : {},
+			plugins: h?.plugins ?? []
+		}),
+		dataCache: () => C({
+			stats: At,
+			backendKind: kt
+		}),
+		subscriptions: () => ne(() => mr),
+		fleetObservations: (e) => z.fleet(e),
+		peerAddress: (e) => z.addressOf(e),
+		inspectTables: () => We(w),
+		inspectRows: ue({
+			store: T,
+			tables: w,
+			mask: !0
+		}),
+		metrics: (e) => q.rpcMetrics().snapshot(e),
+		cluster: () => Xt({
+			store: T,
+			dialect: v,
+			useClusterCron: Hr,
+			scheduleCoordChoice: Vr
+		}),
+		inspectSchedules: () => re({
+			schedules: Fr,
+			defaultTrigger: Lr,
+			coordination: Ur
+		}),
+		inspectScheduleRuns: (e) => ae(T, e),
+		...Ie(T, {
+			controls: Fe(S.workflows ?? []),
+			active: (S.workflows?.length ?? 0) > 0,
+			cancellation: () => q.flowControlHealth()
+		}),
+		webhookActions: qt(() => q.webhooksService()),
+		inspectStartWorkflow: (e) => K().inspectStartWorkflow(e),
+		inspectCancelWorkflowRun: (e) => K().inspectCancelWorkflowRun(e),
+		inspectSuspendWorkflowRun: (e) => K().inspectSuspendWorkflowRun(e),
+		inspectResumeWorkflowRun: (e) => K().inspectResumeWorkflowRun(e),
+		inspectDiscardWorkflowRun: (e) => K().inspectDiscardWorkflowRun(e),
+		inspectRetryWorkflowRun: (e) => K().inspectRetryWorkflowRun(e),
+		inspectSignalWorkflowRun: (e) => K().inspectSignalWorkflowRun(e),
+		inspectUpdateWorkflowRun: (e) => K().inspectUpdateWorkflowRun(e),
+		inspectInferences: (e) => rt({
+			store: T,
+			active: (S.workflows?.length ?? 0) > 0,
+			dispatcher: () => q.inferenceHealth()
+		}, e.limit === void 0 ? {} : { limit: e.limit }),
+		...P({
+			store: T,
+			cancelRun: async (e) => await q.runCanceller()?.(e) ?? !1,
+			retryRun: async (e) => K().inspectRetryWorkflowRun({ runId: e }),
+			redriveRun: async (e) => q.redriveWorkflowRun({ runId: e }),
+			log: $
+		}),
+		inspectRedriveWorkflowRun: (e) => q.redriveWorkflowRun(e),
+		inspectResumeWorkflowRunFromStep: (e) => q.resumeWorkflowRunFromStep(e)
+	}, Mi = (process.env.VOLTRO_TENANT_ISOLATION ?? h?.tenancy?.isolation) === "namespace", Ni = Mi && v !== "memory" ? await (async () => {
+		let e = await vn(v);
+		return Zt({
+			tables: w,
+			sqlLayer: e.makeSqlLayer(j()),
+			dialect: v,
+			options: { retryFilter: e.retryFilter },
+			log: {
+				info: (e, t) => $.info(e, t),
+				error: (e, t, n) => $.error(e, t ?? {}, n)
+			}
+		});
+	})() : void 0, Fi = await D({
+		input: h?.tenancy?.residency,
+		namespaceIsolationOn: Mi,
+		makeStoreForUrl: (e, t) => gt(h, void 0, yn(j(), t)),
+		log: {
+			info: (e, t) => $.info(e, t),
+			warn: (e, t) => $.warn(e, t)
+		}
+	});
+	Fi !== void 0 && G(async () => {
+		await Fi.close();
+	});
+	let q = await Go({
+		bootTiming: u,
+		claimChange: or.claim,
+		broadcastNamespace: Xn,
+		scheduling: (() => {
+			let e = _n;
+			return {
+				admissionDrainMs: e.admissionDrainMs,
+				inferenceTickMs: e.inferenceTickMs,
+				cancelSweepMs: e.cancelSweepMs,
+				stalenessSweepMs: e.stalenessSweepMs,
+				scheduleHeartbeatMs: e.scheduleHeartbeatMs,
+				disarmWhenIdle: Yt({
+					changeScope: T.changeScope,
+					broadcastAttached: gr !== void 0
+				})
+			};
+		})(),
+		...h?.workflows?.staleness === void 0 ? {} : { workflowStaleness: h.workflows.staleness },
+		...h?.workflows?.suspendSignalHintMs === void 0 ? {} : { workflowSuspendSignalHintMs: h.workflows.suspendSignalHintMs },
+		workflowRecording: se(h?.workflows?.recording),
+		membership: {
+			...I,
+			instanceId: Jn
+		},
+		security: {
+			defaultDeny: Je(h),
+			...pe(h)
+		},
+		approvals: { defaultExpiryMs: k(h) },
+		...h?.plugins === void 0 ? {} : { plugins: h.plugins },
+		...N ? { idempotency: N } : {},
+		restRoutes: H,
+		...h?.grpc === void 0 ? {} : { grpc: {
+			config: h.grpc,
+			root: f
+		} },
+		appProcedures: Ee,
+		discovered: {
+			wsGateways: S.wsGateways,
+			queries: [...S.queries, ...wi],
+			mutations: S.mutations,
+			actions: [...S.actions, ...Ci],
+			streams: S.streams,
+			events: S.events,
+			workflows: S.workflows,
+			workflowWorkers: S.workflowWorkers,
+			eventTriggers: S.eventTriggers,
+			schedules: Fr,
+			subscribers: Jr,
+			outboxHandlers: li,
+			connections: S.connections,
+			reactions: ni,
+			aggregates: pi,
+			expectations: _i,
+			budgets: yi,
+			experiments: Si,
+			...ze === void 0 ? {} : { webhooks: ze }
+		},
+		log: $,
+		analytics: $e.sink,
+		aggregateStorage: mi,
+		aggregateCoordinator: hi,
+		store: T,
+		kv: zt,
+		cache: St,
+		snapshotCache: mt,
+		...h?.reactive === void 0 ? {} : { reactive: h.reactive },
+		schemaRegistry: nt,
+		tenantScopedTables: S.tenantScopedTables,
+		softDeleteScopedTables: S.softDeleteScopedTables,
+		dataTransferSnapshot: Ki(w, v),
+		dataTransferDialect: v,
+		...Ni === void 0 ? {} : { ensureTenantProvisioned: Ni.ensure },
+		...Fi === void 0 ? {} : { resolveResidentStore: Fi.resolveStore },
+		tenantIsolation: (process.env.VOLTRO_TENANT_ISOLATION ?? h?.tenancy?.isolation) === "namespace" ? "namespace" : "shared-schema",
+		resolveSubject: (e, t) => wr({
+			headers: e,
+			clientId: t
+		}),
+		...h?.auth === void 0 ? {} : { authority: h.auth },
+		...h?.agents === void 0 ? {} : { agents: h.agents },
+		httpRoutes: F.flatMap((e) => e.httpRoutes ?? []),
+		getStore: () => at,
+		...Pr ? { baseLayer: Pr } : {},
+		...Kr === void 0 ? {} : { workflowEngineLayer: Kr },
+		scheduleDefaultTrigger: Lr,
+		scheduleCoordination: Ur,
+		scheduleArmSelf: !Hr,
+		dormancy: process.env.VOLTRO_DORMANCY === "sleep" || process.env.VOLTRO_DORMANCY === "always-on" ? process.env.VOLTRO_DORMANCY : h?.dormancy ?? "always-on",
+		scheduleReplicaId: Ar(),
+		...W === void 0 ? {} : { scheduleFireInterceptor: W },
+		onSchedulerReady: (e) => {
+			Wr = e;
+		},
+		inspectStream: He(rr),
+		inspectRoute: { handle: async (e, t, n, r) => R.logs.on && n === "GET" && (e === "/_voltro/inspect/logs" || e.startsWith("/_voltro/inspect/logs?")) ? un(e, sn(), t) : R.traces.on && n === "GET" && (e === "/_voltro/inspect/traces" || e.startsWith("/_voltro/inspect/traces?")) ? Ve(e, je()) : await xt(e, Ai, t, {
+			method: n,
+			...r === void 0 ? {} : { body: r },
+			...ir()
+		}) || ((n === "GET" ? await pn(e, Ai, t, {
+			method: n,
+			...ir()
+		}) : null) ?? fn(e, Ai, t, {
+			method: n,
+			...r === void 0 ? {} : { body: r },
+			...ir()
+		}) ?? {
+			status: 404,
+			contentType: "application/json",
+			body: JSON.stringify({ error: "not an inspect route" })
+		}) },
+		...h?.name === void 0 ? {} : { appName: h.name },
+		observability: ur,
+		...h?.health === void 0 ? {} : { health: h.health },
+		...pr === void 0 ? {} : { traceSink: pr },
+		port: ce,
+		...h?.transport?.wsPath ? { path: h.transport.wsPath } : {},
+		...h?.http === void 0 ? {} : { http: h.http }
+	});
+	mr = q.dispatcher;
+	let Ii = () => {
+		rr.emit("subscriptions", ne(() => mr));
+	}, zi = q.dispatcher.onSubscriptionsChange(Ii);
+	return Ii(), ee(tn([
+		S.queries,
+		S.mutations,
+		S.actions,
+		S.streams
+	]), (e) => {
+		$.warn(e);
+	}), $.info(`API listening on :${ce}`, {
+		dialect: v,
+		queries: S.queries.length,
+		mutations: S.mutations.length,
+		actions: S.actions.length,
+		streams: S.streams.length,
+		workflows: S.workflows.length,
+		workflowWorkers: S.workflowWorkers.length,
+		schedules: Fr.length,
+		scheduleCoordination: Ur
+	}), u.finish($), G(async () => {
+		for (let e of Wn) e.stop();
+		Kt.stop(), zi(), z.stop();
+		try {
+			await q.close(), Mt(), $t?.dispose(), await lr.deactivate(), await gr?.close(), await ut({
+				mirror: Ht,
+				log: $
+			}), await $e.dispose(), await T.close?.();
+		} catch (e) {
+			console.error("serve: shutdown step failed, exiting anyway:", e);
+		}
+	}), await new Promise(() => {}), 0;
+};
+//#endregion
+export { Zo as n, Yo as r, Qo as t };