@voltro/cli 0.56.0 → 0.58.0

package/dist/serveCommand-DhtC7WBq.js

@@ -0,0 +1,2545 @@
+import { t as e } from "./nodeEnvironment-cGFAj1J8.js";
+import { t } from "./frameworkInspectState-CX2250XB.js";
+import { r as n, t as r } from "./appModuleLoader-C9r9mxZt.js";
+import { t as i } from "./bootRefusal-pgvDxlrU.js";
+import { n as a, r as o } from "./startupRunner-CEqQq7ax.js";
+import { n as s, t as c } from "./interruptedReplace-CwnkBb2X.js";
+import { $ as l, $t as u, A as d, At as f, B as ee, Bn as te, Bt as p, C as ne, Cn as m, Ct as re, D as ie, Dn as h, Dt as ae, E as oe, En as se, Et as g, F as _, Fn as ce, Ft as le, G as ue, Gt as de, H as fe, Hn as pe, Ht as me, I as he, In as v, It as ge, Jt as y, K as _e, Kt as ve, L as ye, Lt as b, M as be, Mn as xe, Mt as Se, N as Ce, Nn as we, Nt as Te, O as Ee, On as De, Ot as Oe, P as ke, Pn as Ae, Pt as x, Q as S, Qt as je, R as Me, Rn as Ne, Rt as Pe, S as Fe, Sn as Ie, St as Le, T as Re, Tn as ze, Tt as Be, U as Ve, Un as He, Ut as Ue, Vn as We, Vt as Ge, W as Ke, Wt as qe, X as Je, Xt as Ye, Y as Xe, Z as Ze, _ as Qe, _n as $e, _t as et, a as tt, an as nt, at as C, b as rt, bn as it, bt as at, cn as ot, ct as w, d as st, dn as T, dt as E, en as ct, et as lt, f as ut, fn as dt, ft, g as pt, gn as D, gt as mt, h as ht, hn as gt, ht as _t, i as vt, in as yt, it as bt, j as xt, jn as St, jt as Ct, k as O, kn as k, kt as wt, l as Tt, ln as Et, lt as Dt, m as Ot, mn as kt, mt as At, nn as jt, nt as Mt, on as Nt, ot as Pt, pn as Ft, pt as It, qt as Lt, rn as Rt, rt as zt, s as A, sn as Bt, st as Vt, t as j, tn as Ht, tt as Ut, un as Wt, ut as Gt, v as Kt, vn as qt, vt as Jt, w as Yt, wn as Xt, wt as Zt, x as Qt, xn as $t, xt as M, y as en, yn as tn, yt as nn, z as rn, zn as an, zt as on } from "./dev-Ce2gEziv.js";
+import { Yt as sn, en as cn, ft as ln, ht as un, lt as dn, mt as fn, pt as pn, qt as mn } from "./webDev-CBN9KkyQ.js";
+import { g as hn, s as gn } from "./inspect-PcC5J-Dl.js";
+import { n as _n } from "./cliArgs-D4p8n7EE.js";
+import { r as vn } from "./appPort-B_HpJ_ck.js";
+import { r as yn, u as bn } from "./apiBuild-CkpsCqIu.js";
+import { r as xn } from "./dialectDriver-czCHYpeH.js";
+import { i as Sn, n as Cn } from "./connectionConfig-Bk9IC7D0.js";
+import { c as wn, n as Tn, o as En } from "./seedRunner-DISBKow-.js";
+import { f as Dn, g as On, h as kn, m as An, r as jn } from "./frameworkTableAssembly-vfkzuzEo.js";
+import { n as Mn, r as Nn, t as Pn } from "./declaredSchemaGates-BlcwObhb.js";
+import { C as Fn, a as In, h as Ln, l as Rn, n as zn, u as Bn, w as Vn } from "./fileConventions-l-RIXbx8.js";
+import { i as Hn, n as Un, t as Wn } from "./inspectMetrics-BY0Sjb2F.js";
+import { n as Gn } from "./mssqlClusterPatch-_4cE_nun.js";
+import { i as Kn, n as qn, r as Jn, t as Yn } from "./webhookDiscovery-CphsQe59.js";
+import { t as Xn } from "./bootTiming-BdyP9nYw.js";
+import { a as Zn, o as Qn, t as $n } from "./dataProfile-Du3ztYxv.js";
+import N, { basename as er, join as tr } from "node:path";
+import { createWriteStream as nr, existsSync as rr } from "node:fs";
+import { pathToFileURL as ir } from "node:url";
+import { LoggerLayer as ar, createLogger as P } from "@voltro/logger";
+import { AuthMiddleware as or, ConnectionInfoMiddleware as F, actionToRpc as I, anonymousSubject as sr, isWireReachable as cr, mutationToRpc as lr, queryToRpc as L, streamToRpc as ur, wireErrorUnion as dr, workflowCancelDescriptor as fr, workflowDomainEventsQueryDescriptor as pr, workflowEventDeliveriesQueryDescriptor as mr, workflowResumeDescriptor as hr, workflowRunEventsQueryDescriptor as gr, workflowRunQueryDescriptor as R, workflowRunStepsQueryDescriptor as _r, workflowRunsQueryDescriptor as vr, workflowSignalDescriptor as z, workflowUpdateDescriptor as yr } from "@voltro/protocol";
+import { DATA_TRANSFERS_TABLE as B, _voltroDataTransfersTable as br, allRegisteredTables as xr, and as Sr, connectionIdentity as Cr, derivedRowId as wr, describeTransferRun as Tr, ensureTableRegistered as Er, eq as V, or as Dr } from "@voltro/database";
+import { appMode as Or, frameworkVersion as kr, instanceId as Ar, replicaId as jr, resolveAdvertisedHost as Mr, setProcessAdvertisedAddress as Nr, setProcessBootPath as Pr } from "@voltro/protocol/identity";
+import { AggregateRegistry as Fr, CostRegistry as H, DORMANCY_WAKEUP_TENANT as Ir, Dispatcher as Lr, ExpectationRegistry as Rr, ExperimentRegistry as zr, apiKeyManagementRoutes as Br, attachAnalyticsMirror as Vr, attachExpectations as Hr, attachExperiments as Ur, attachFinops as Wr, awaitServerListening as Gr, bindMutation as U, bindStream as Kr, bindSubscription as W, buildTracingLayer as qr, cancelWakeup as Jr, compileCron as Yr, dataStoreApiKeyStore as Xr, formatServerOnlyLeaks as Zr, formatUnresolvedSources as Qr, frameworkApiKeyStrategy as $r, getResourcePolicy as ei, installPolicyGuardResolver as ti, loadResourceTuples as ni, makeActionRunner as ri, makeAdvisoryLockCoordinator as ii, makeApiKeyService as ai, makeApiKeyUsageBuffer as oi, makeApiKeyUsageFlusher as si, makeAsyncKv as ci, makeAuthMiddlewareLayers as li, makeBufferingSpanProcessor as ui, makeCoordinatedScheduler as di, makeEffectStoreLayer as fi, makeLazyWorkflowFacade as pi, makeMutationOutputCodec as mi, makeMutationRunner as hi, makeOneShotQueryRunner as gi, makeQueryDescriptorProducer as _i, makeQueryFinalizer as vi, makeQueryReauthorizer as yi, makeQuerySubscriber as bi, makeSchemaRegistry as xi, makeWorkflowFacade as Si, makeWorkflowFacadeWithCallerContext as Ci, makeWorkflowLayers as wi, noopKv as Ti, onProcessShutdown as G, recordSubscriptionDelivery as K, recordWorkflowRun as Ei, registerDefaultTupleSource as Di, registerWakeup as Oi, resolveSecretsBackend as ki, runProvidedEffect as Ai, setSecretsBackend as ji, setSystemStoreHandle as Mi, shutdownGraceMsFromEnv as Ni, singleCoordinator as Pi, startRpcServer as Fi, startScheduler as q, stripForbiddenForWire as Ii, undoCaptureEnabled as Li, unresolvedSources as Ri, withScopedRequest as zi, workflowToRpc as Bi, wrapStoreWithBootCodec as Vi } from "@voltro/runtime";
+import { assertProductionSessionSecret as Hi } from "@voltro/protocol/session";
+import { Cause as Ui, Effect as J, Layer as Y, ManagedRuntime as Wi } from "effect";
+import { SqlClient as Gi } from "@effect/sql";
+import { declaredSnapshot as Ki, describeOutcome as qi, pendingFileMigrationIds as Ji, runPlannedMigrations as Yi } from "@voltro/database/sql";
+import Xi, { tmpdir as Zi } from "node:os";
+import { RpcGroup as Qi } from "@effect/rpc";
+import { appStorageProvider as $i, durabilityNotice as ea, fromNodeReadable as ta, getObjectStream as na, putObjectStream as ra, toNodeReadable as ia } from "@voltro/plugin-storage";
+import { isEnvContract as aa } from "@voltro/env";
+import X from "node:fs/promises";
+import { createHash as oa, timingSafeEqual as sa } from "node:crypto";
+import { channelFor as ca, getBroadcastPlugin as la } from "@voltro/plugin-broadcast";
+import { buildDeliverWebhookExecute as ua, buildWebhooksService as da, defaultIncomingPath as fa, deliverWebhookWorkflow as pa, makeDeferredEmitHandler as ma, mountIncomingWebhook as ha } from "@voltro/plugin-webhooks";
+import { getAuthSessionStrategy as ga } from "@voltro/plugin-auth";
+import { registerEmailTemplates as _a } from "@voltro/plugin-mail";
+import { checkSchemaDrift as va, decideStaging as ya, isEnvironmentLocal as ba, packBundle as xa, peekBundle as Sa, runExport as Ca, runImport as wa, storageBlobSink as Ta, storageRefsBlobSource as Ea, unpackBundle as Da, unpackBundleToDir as Oa } from "@voltro/data-transfer";
+//#region \0rolldown/runtime.js
+var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy < "u" ? new Proxy(e, { get: (e, t) => (typeof require < "u" ? require : e)[t] }) : e)(function(e) {
+	if (typeof require < "u") return require.apply(this, arguments);
+	throw Error("Calling `require` for \"" + e + "\" in an environment that doesn't expose the `require` function. See https://rolldown.rs/in-depth/bundling-cjs#require-external-modules for more details.");
+}), Aa = () => Math.max(500, Math.floor(Ni() * .6)), ja = (e) => new Promise((t) => setTimeout(t, e)), Ma = (e) => {
+	let t = /* @__PURE__ */ new Set(), n = /* @__PURE__ */ new Set(), r = 0;
+	e.on("connection", (e) => {
+		t.add(e), e.once("close", () => {
+			t.delete(e), n.delete(e);
+		});
+	}), e.on("upgrade", (e, t) => {
+		n.add(t);
+	}), e.on("request", (e, t) => {
+		r += 1, t.once("close", () => {
+			--r;
+		});
+	});
+	let i, a = async (t = {}) => {
+		let n = t.budgetMs ?? Aa();
+		i ??= new Promise((t) => {
+			e.close(() => {
+				t();
+			});
+		}), e.closeIdleConnections();
+		let a = Date.now() + n;
+		for (; r > 0 && Date.now() < a;) await ja(25), e.closeIdleConnections();
+		e.closeIdleConnections();
+	}, o = async () => {
+		i ??= new Promise((t) => {
+			e.close(() => {
+				t();
+			});
+		});
+		for (let e of t) if (n.has(e)) try {
+			e.write(Buffer.from([
+				136,
+				2,
+				3,
+				233
+			]));
+		} catch {}
+		else e.destroy();
+		for (let e = 0; t.size > 0 && e < 250; e += 25) await ja(25);
+		for (let e of t) e.destroy();
+		await i;
+	};
+	return {
+		activeRequests: () => r,
+		drainRequests: a,
+		finish: o,
+		drain: async (e = {}) => {
+			await a(e), await o();
+		}
+	};
+}, Na = "/_voltro/admin/import", Pa = "/_voltro/admin/import/start", Fa = "/_voltro/admin/export", Ia = "/_voltro/admin/export/download", La = "/_voltro/admin/transfers", Z = (e, t) => ({
+	status: e,
+	contentType: "application/json; charset=utf-8",
+	body: JSON.stringify(t)
+}), Ra = (e) => {
+	let t = e.authorization ?? e.Authorization, n = t ? /^Bearer\s+(.+)$/i.exec(t) : null;
+	return n ? n[1] : null;
+}, za = (e, t) => sa(oa("sha256").update(e).digest(), oa("sha256").update(t).digest()), Ba = (e, t, n = "POST") => {
+	if (e.method.toUpperCase() !== n) return Z(405, { error: "method not allowed" });
+	if (!t || t.length < 16) return Z(503, { error: "data transfer misconfigured (no/weak secret)" });
+	let r = Ra(e.headers);
+	return !r || !za(r, t) ? Z(401, { error: "unauthorized" }) : null;
+}, Va = /^[A-Za-z0-9_-]{8,64}$/, Ha = (e) => Va.test(e), Ua = () => process.env.VOLTRO_IMPORT_UPLOAD_DIR ?? N.join(Xi.tmpdir(), "voltro-import-uploads"), Wa = (e) => N.join(Ua(), e), Ga = (e) => N.join(Wa(e), "archive.bin"), Ka = (e) => N.join(Wa(e), "meta.json"), qa = async (e = Date.now()) => {
+	let t = 0;
+	try {
+		for (let n of await X.readdir(Ua())) {
+			if (n === ".runs") continue;
+			let r = await X.stat(Wa(n)).catch(() => null);
+			r !== null && (e - r.mtimeMs <= 864e5 || (await X.rm(Wa(n), {
+				recursive: !0,
+				force: !0
+			}).catch(() => void 0), t++));
+		}
+	} catch {}
+	return t;
+}, Ja = async (e) => {
+	if (!Ha(e)) return {
+		bytes: 0,
+		key: null,
+		runId: null
+	};
+	let t = await X.stat(Ga(e)).catch(() => null);
+	if (t === null) return {
+		bytes: 0,
+		key: null,
+		runId: null
+	};
+	let n = await Ya(e);
+	return {
+		bytes: t.size,
+		key: n.key ?? null,
+		runId: n.runId ?? null
+	};
+}, Ya = async (e) => {
+	try {
+		let t = await X.readFile(Ka(e), "utf8");
+		return JSON.parse(t);
+	} catch {
+		return {};
+	}
+}, Xa = async (e, t) => {
+	let n = Ka(e), r = `${n}.${process.pid}.${Math.random().toString(36).slice(2, 8)}.tmp`;
+	await X.writeFile(r, JSON.stringify(t)), await X.rename(r, n);
+}, Za = async (e, t, n) => {
+	if (!Ha(e)) return t;
+	await X.mkdir(Wa(e), { recursive: !0 });
+	let r = await Ya(e), i = typeof r.runId == "string" && r.runId.length > 0 ? r.runId : null;
+	return i !== null && n?.takeOver !== !0 ? i : (await Xa(e, {
+		...r,
+		runId: t
+	}), t);
+}, Qa = async (e) => {
+	if (!Ha(e)) return;
+	let t = await Ya(e);
+	if (t.runId === void 0) return;
+	let { runId: n, ...r } = t;
+	await Xa(e, r).catch(() => void 0);
+}, $a = async (e, t, n) => (await X.mkdir(Wa(e), { recursive: !0 }), await X.writeFile(Ga(e), Buffer.from(t)), await Xa(e, {
+	...await Ya(e),
+	key: n,
+	startedAt: (/* @__PURE__ */ new Date()).toISOString()
+}), t.byteLength), eo = (e) => `up-${oa("sha256").update(e).digest("hex").slice(0, 32)}`, to = async (e) => {
+	if (!Ha(e.id)) return {
+		reason: "bad-id",
+		message: `upload id must match ${String(Va)}`
+	};
+	let t = await Ja(e.id);
+	if (t.key !== null && t.key !== e.key) return {
+		reason: "key-mismatch",
+		message: "this upload id already holds a different bundle. Use a new upload id, or delete the partial upload."
+	};
+	if (e.offset !== t.bytes) return {
+		reason: "offset-mismatch",
+		message: `chunk starts at ${e.offset} but the server holds ${t.bytes} byte(s)`,
+		expectedOffset: t.bytes
+	};
+	if (await X.mkdir(Wa(e.id), { recursive: !0 }), t.key === null) {
+		let t = await Ya(e.id);
+		await Xa(e.id, {
+			...t,
+			key: e.key,
+			startedAt: (/* @__PURE__ */ new Date()).toISOString()
+		});
+	}
+	return await new Promise((t, n) => {
+		let r = nr(Ga(e.id), { flags: "a" });
+		r.on("error", n), r.on("finish", () => t()), r.end(Buffer.from(e.bytes));
+	}), { total: t.bytes + e.bytes.byteLength };
+}, no = async (e) => {
+	let t = await X.stat(Ga(e));
+	return {
+		path: Ga(e),
+		bytes: t.size
+	};
+}, ro = () => N.join(Ua(), ".runs"), io = (e) => N.join(ro(), `${e}.bin`), ao = async (e, t) => {
+	if (!Ha(e)) return null;
+	let n = Ga(e), r = await X.stat(n).catch(() => null);
+	if (r === null || r.size === 0) return null;
+	await X.mkdir(ro(), { recursive: !0 });
+	let i = io(t);
+	return await X.rename(n, i), i;
+}, oo = async (e) => {
+	await X.rm(io(e), { force: !0 }).catch(() => void 0);
+}, Q = P({ scope: "voltro:admin-import" }), so = "VBUNDLE2", co = (e) => {
+	let t = e.req.headers["x-import-rollback-key"];
+	if (e.mode !== "replace") return { options: {} };
+	if (typeof t != "string" || t.length === 0) return Q.warn("admin.import: no rollback capture — this run empties the target first, and nothing was asked to be kept. Send `x-import-rollback-key: <storage key>` (voltro data import --rollback-key <key>) to have the instance store the target's current rows before deleting them."), { options: {} };
+	if (e.deps.putArchive === void 0) return {
+		options: {},
+		refusal: Z(409, {
+			error: "rollback capture requested but this instance has no object storage configured",
+			hint: "A capture written to the pod would not survive the failure it exists for. Configure storage (the same one the storage-push export uses), or re-send without `x-import-rollback-key` to accept that a run which does not finish can leave the target emptied. Note that CONFIGURED is not the same question as SURVIVES: a `filesystem` provider pointed at a container directory with no volume behind it passes this check and dies with the pod. The run says so when it can observe it — the capture path being on the same filesystem as `/`."
+		})
+	};
+	let n = tr(Zi(), `voltro-rollback-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`), r = e.deps.putArchive;
+	return {
+		key: t,
+		options: {
+			rollbackDir: n,
+			onRollbackCaptured: async () => {
+				let e = ea(n);
+				e !== void 0 && Q.warn(`admin.import: ${e}`), await r(t, () => xa({ dir: n })), Q.info("admin.import: rollback capture stored", { bundleKey: t });
+			}
+		}
+	};
+}, lo = (e) => {
+	let t = e["x-import-mode"], n = e["x-import-atomic"];
+	return {
+		mode: t,
+		onConflict: e["x-import-on-conflict"],
+		atomic: n === "0" || n === "false" ? !1 : n === "1" || n === "true" || t === "replace",
+		force: e["x-import-force"] === "1" || e["x-import-force"] === "true",
+		dryRun: e["x-import-dry-run"] === "1" || e["x-import-dry-run"] === "true",
+		tables: (e["x-import-tables"] ?? "").split(",").map((e) => e.trim()).filter(Boolean)
+	};
+}, uo = async (e, t) => {
+	if (typeof t.bundleKey == "string" && t.bundleKey !== "") {
+		if (!e.openArchive) return { refusal: Z(501, { error: "storage transport not configured on this instance" }) };
+		let n = e.openArchive, r = t.bundleKey;
+		return {
+			source: () => n(r),
+			transport: "storage",
+			uploadId: eo(r)
+		};
+	}
+	let n = t.uploadId;
+	if (typeof n != "string" || !Ha(n)) return { refusal: Z(400, { error: "start needs { uploadId } from an upload, or { bundleKey } for the storage transport" }) };
+	let r = await no(n).catch(() => null);
+	return r === null || r.bytes === 0 ? { refusal: Z(409, {
+		error: "no such upload",
+		message: `this instance holds no bytes for upload '${n}'. Upload the bundle first, or re-upload if it has expired.`
+	}) } : {
+		source: () => fo(r.path),
+		transport: "upload",
+		uploadId: n
+	};
+}, fo = (e) => {
+	let { createReadStream: t } = ka("node:fs");
+	return t(e);
+}, po = (e) => async (t) => {
+	let n = Ba(t, e.secret);
+	if (n) return n;
+	let r = lo(t.headers), i = co({
+		req: t,
+		mode: r.mode,
+		deps: e
+	});
+	if (i.refusal !== void 0) return i.refusal;
+	if (t.headers["x-import-preflight"] === "1" || t.headers["x-import-preflight"] === "true") {
+		let n;
+		try {
+			n = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
+		} catch {
+			return Z(400, { error: "a preflight body must be JSON: { tables: string[] } or { bundleKey: string }" });
+		}
+		let a = Array.isArray(n.tables) ? n.tables.filter((e) => typeof e == "string") : [];
+		if (a.length === 0 && typeof n.bundleKey == "string" && n.bundleKey !== "" && e.openArchive && (a = [...await mo(e.openArchive(n.bundleKey))]), a.length === 0) return Z(400, {
+			error: "a preflight needs { tables: string[] } — the bundle's table names, so the staging decision can be made against them",
+			hint: "or { bundleKey } on an instance with storage configured, where this endpoint reads the table list out of the archive itself"
+		});
+		let o = ya({
+			mode: r.mode ?? "upsert",
+			...e.dialect === void 0 ? {} : { targetDialect: e.dialect },
+			...e.snapshot === void 0 ? {} : { targetSnapshot: e.snapshot },
+			bundleTables: a,
+			isSkipped: ba,
+			canRunSql: !0
+		});
+		return Z(200, {
+			preflight: !0,
+			mode: r.mode ?? "upsert",
+			atomic: r.atomic,
+			staged: o.active,
+			...o.blocker === void 0 ? {} : { reason: o.blocker },
+			stagedTables: o.tables.length,
+			rollback: i.key === void 0 ? { taken: !1 } : {
+				taken: !0,
+				key: i.key
+			},
+			dialect: e.dialect ?? null
+		});
+	}
+	let a = t.headers["x-import-upload-id"];
+	if (a !== void 0 && a !== "") {
+		if (qa(), t.headers["x-import-probe"] === "1") {
+			let e = await Ja(a);
+			return Z(200, {
+				uploadId: a,
+				bytes: e.bytes,
+				...e.runId === null ? {} : { runId: e.runId }
+			});
+		}
+		let e = t.headers["x-import-upload-key"] ?? "", n = Number(t.headers["x-import-chunk-offset"] ?? "0");
+		if (e === "" || !Number.isFinite(n) || n < 0) return Z(400, { error: "a chunked upload needs x-import-upload-key and a numeric x-import-chunk-offset" });
+		let r = await to({
+			id: a,
+			key: e,
+			offset: n,
+			bytes: t.rawBody
+		});
+		if ("reason" in r) return Q.warn("admin.import chunk refused", {
+			uploadId: a,
+			reason: r.reason
+		}), Z(409, {
+			error: "chunk refused",
+			reason: r.reason,
+			message: r.message,
+			...r.expectedOffset === void 0 ? {} : { expectedOffset: r.expectedOffset }
+		});
+		let i = t.headers["x-import-chunk-final"] === "1";
+		return Z(202, {
+			uploadId: a,
+			bytes: r.total,
+			complete: i
+		});
+	}
+	if (t.rawBody.byteLength >= 8 && Buffer.from(t.rawBody.subarray(0, 8)).toString("latin1") === so) {
+		qa();
+		let e = oa("sha256").update(Buffer.from(t.rawBody)).digest("hex"), n = eo(e);
+		return Z(202, {
+			uploadId: n,
+			bytes: await $a(n, t.rawBody, e),
+			complete: !0
+		});
+	}
+	let o;
+	try {
+		o = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
+	} catch {
+		return Z(400, { error: "body must be a packed bundle archive or { bundleKey } JSON" });
+	}
+	return typeof o.bundleKey != "string" || !o.bundleKey ? Z(400, { error: "body.bundleKey (string) is required for the storage transport" }) : e.openArchive ? Z(202, {
+		uploadId: eo(o.bundleKey),
+		bundleKey: o.bundleKey,
+		complete: !0
+	}) : Z(501, { error: "storage transport not configured on this instance" });
+}, mo = async (e) => {
+	let t = await Sa(e, ["manifest.json"]).then((e) => e.get("manifest.json"), () => void 0);
+	if (t === void 0) return [];
+	try {
+		return (JSON.parse(Buffer.from(t).toString("utf8")).tables ?? []).map((e) => e.name).filter((e) => typeof e == "string");
+	} catch {
+		return [];
+	}
+}, ho = (e) => async (t) => {
+	let n = Ba(t, e.secret);
+	if (n) return n;
+	let r = lo(t.headers), i = co({
+		req: t,
+		mode: r.mode,
+		deps: e
+	});
+	if (i.refusal !== void 0) return i.refusal;
+	let a;
+	try {
+		a = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
+	} catch {
+		return Z(400, { error: "body must be JSON: { uploadId } or { bundleKey }" });
+	}
+	let o = typeof a.bundleKey == "string" && a.bundleKey !== "" ? eo(a.bundleKey) : typeof a.uploadId == "string" ? a.uploadId : "";
+	if (!Ha(o)) return Z(400, { error: "start needs { uploadId } from an upload, or { bundleKey } for the storage transport" });
+	let s = wr("dimp", `${o}-${Date.now()}-${Math.random()}`), c = await Za(o, s);
+	if (c !== s) {
+		let t = await Zn(e.store, c);
+		if (Qn(t) === void 0 && t !== null) return Q.info("admin.import start: already running", {
+			uploadId: o,
+			runId: c
+		}), Z(202, {
+			runId: c,
+			uploadId: o,
+			alreadyStarted: !0
+		});
+		Q.info("admin.import start: taking over a claim whose run is not running", {
+			uploadId: o,
+			staleRunId: c,
+			outcome: Qn(t) ?? "no record"
+		}), c = await Za(o, s, { takeOver: !0 });
+	}
+	let l = async (e) => (await Qa(o).catch(() => void 0), e), u = await uo(e, {
+		...typeof a.uploadId == "string" ? { uploadId: a.uploadId } : {},
+		...typeof a.bundleKey == "string" ? { bundleKey: a.bundleKey } : {}
+	});
+	if ("refusal" in u) return l(u.refusal);
+	if (e.snapshot !== void 0 && !r.force) {
+		let t = await go(u.source());
+		if (t !== null) {
+			let n = va(t.source?.schemaFingerprint ?? "", e.snapshot, _o(t));
+			if (n.drifted) return Q.warn("admin.import refused (schema drift)", {
+				transport: u.transport,
+				bundle: n.bundleFingerprint.slice(0, 16),
+				target: n.targetFingerprint.slice(0, 16)
+			}), l(Z(409, {
+				error: "schema drift",
+				bundleFingerprint: n.bundleFingerprint,
+				targetFingerprint: n.targetFingerprint,
+				diff: n.diff,
+				hint: "each line above would break the load: a table or column the bundle carries that the target cannot take, or a column the target requires that the bundle has no value for. Fix the target schema, re-export against it, or resend with x-import-force: 1 to write anyway."
+			}));
+		}
+	}
+	let d = null;
+	if (u.transport === "upload" && (d = await ao(u.uploadId, c), d === null)) return l(Z(409, {
+		error: "no such upload",
+		message: `the bytes for upload '${u.uploadId}' are gone. Re-upload the bundle.`
+	}));
+	let f = await vo(e.store, {
+		runId: c,
+		mode: r.mode ?? "upsert",
+		via: "api",
+		bundle: u.transport === "storage" ? String(a.bundleKey) : u.uploadId
+	});
+	return yo({
+		deps: e,
+		opts: r,
+		rollback: i,
+		runId: c,
+		traced: f,
+		resolved: d === null ? u : {
+			...u,
+			source: () => fo(d)
+		}
+	}), Q.info("admin.import started", {
+		runId: c,
+		uploadId: u.uploadId,
+		transport: u.transport,
+		mode: r.mode ?? "upsert",
+		atomic: r.atomic,
+		dryRun: r.dryRun
+	}), Z(202, {
+		runId: c,
+		uploadId: u.uploadId,
+		transport: u.transport,
+		mode: r.mode ?? "upsert",
+		atomic: r.atomic,
+		...r.dryRun ? { dryRun: !0 } : {},
+		recorded: f,
+		outcome: "poll /_voltro/admin/transfers for this runId — a 202 means started, not finished"
+	});
+}, go = async (e) => {
+	let t = await Sa(e, ["manifest.json"]).then((e) => e.get("manifest.json"), () => null);
+	if (t == null) return null;
+	try {
+		return JSON.parse(Buffer.from(t).toString("utf8"));
+	} catch {
+		return null;
+	}
+}, _o = (e) => ({ tables: (e.tables ?? []).map((e) => ({
+	name: e.name,
+	indexes: [],
+	columns: Object.entries(e.columnTypes ?? {}).map(([e, t]) => ({
+		name: e,
+		type: t,
+		nullable: !0,
+		unique: !1,
+		hasDefault: !1
+	}))
+})) }), vo = async (e, t) => {
+	try {
+		return Er(br), await e.insert(B, {
+			id: t.runId,
+			direction: "import",
+			startedAt: /* @__PURE__ */ new Date(),
+			finishedAt: null,
+			failure: null,
+			mode: t.mode,
+			via: t.via,
+			bundle: t.bundle,
+			sourceFingerprint: null,
+			tablesWritten: 0,
+			rowsWritten: 0,
+			staged: null
+		}), !0;
+	} catch (e) {
+		return Q.warn("admin.import: the run could not be recorded", {
+			runId: t.runId,
+			error: e?.message ?? String(e)
+		}), !1;
+	}
+}, yo = async (e) => {
+	let { deps: t, opts: n, rollback: r, resolved: i, runId: a } = e, o = await import("node:os"), s = await import("node:fs/promises"), c = await import("node:path"), l = await s.mkdtemp(c.join(o.tmpdir(), "voltro-admin-import-")), u = async (n) => {
+		Q.warn("admin.import failed", {
+			runId: a,
+			transport: i.transport,
+			error: n
+		}), e.traced && await t.store.update(B, a, {
+			failure: n,
+			finishedAt: null
+		}).then(() => void 0, () => void 0);
+	};
+	try {
+		t.assetSink ? await Da(i.source(), {
+			dir: l,
+			blobs: t.assetSink
+		}) : await Oa(i.source(), l);
+		let o = await J.runPromiseExit(wa({
+			store: t.store,
+			bundleDir: l,
+			...n.mode ? { mode: n.mode } : {},
+			...n.onConflict ? { onConflict: n.onConflict } : {},
+			atomic: n.atomic,
+			...r.options,
+			recordInterruption: !0,
+			via: "api",
+			...e.traced ? { traceId: a } : {},
+			...n.dryRun ? { dryRun: n.dryRun } : {},
+			...n.tables.length > 0 ? { tables: [...n.tables] } : {},
+			...t.snapshot ? { targetSnapshot: t.snapshot } : {},
+			...t.dialect ? { targetDialect: t.dialect } : {},
+			force: n.force,
+			onWarn: (e) => Q.warn("admin.import", {
+				runId: a,
+				message: e
+			}),
+			...t.assetSink ? { assetsAlreadyRestored: !0 } : {}
+		}));
+		if (o._tag === "Failure") {
+			let e = o.cause._tag === "Fail" ? o.cause.error : void 0, t = typeof e?.reason == "string" ? e.reason : void 0, n = e?.diff;
+			await u(t ?? (Array.isArray(n) ? `schema drift: ${n.join("; ")}` : void 0) ?? String(e?.message ?? e ?? "import failed"));
+			return;
+		}
+		let s = o.value;
+		Q.info(n.dryRun ? "admin.import (dry run — nothing written)" : "admin.import complete", {
+			runId: a,
+			transport: i.transport,
+			tables: s.tablesWritten,
+			rows: s.rowsWritten,
+			mode: n.mode ?? "upsert",
+			atomic: n.atomic,
+			...s.tablesSkipped > 0 ? {
+				skippedTables: s.tablesSkipped,
+				skippedRows: s.rowsSkipped
+			} : {}
+		}), n.dryRun || t.refreshSubscriptions?.(`data import: ${s.tablesWritten} table(s), mode ${n.mode ?? "upsert"}`);
+	} catch (e) {
+		await u(e?.message ?? String(e));
+	} finally {
+		await s.rm(l, {
+			recursive: !0,
+			force: !0
+		}).catch(() => void 0), await oo(a).catch(() => void 0), await Qa(i.uploadId).catch(() => void 0);
+	}
+}, bo = /^[A-Za-z0-9_-]{8,64}$/, xo = (e) => bo.test(e), So = () => process.env.VOLTRO_EXPORT_ARTIFACT_DIR ?? N.join(Xi.tmpdir(), "voltro-export-artifacts"), Co = (e) => N.join(So(), e), wo = (e) => N.join(Co(e), "archive.bin"), To = async (e = Date.now()) => {
+	let t = 0;
+	try {
+		for (let n of await X.readdir(So())) {
+			let r = await X.stat(Co(n)).catch(() => null);
+			r !== null && (e - r.mtimeMs <= 864e5 || (await X.rm(Co(n), {
+				recursive: !0,
+				force: !0
+			}).catch(() => void 0), t++));
+		}
+	} catch {}
+	return t;
+}, Eo = async (e, t) => {
+	if (!xo(e)) throw Error(`invalid run id: ${e}`);
+	await X.mkdir(Co(e), { recursive: !0 });
+	let { createWriteStream: n } = await import("node:fs"), r = n(wo(e)), i = 0;
+	try {
+		for await (let e of t) i += e.byteLength, r.write(Buffer.from(e)) || await new Promise((e, t) => {
+			r.once("drain", e), r.once("error", t);
+		});
+	} finally {
+		await new Promise((e, t) => {
+			r.end(() => e()), r.once("error", t);
+		});
+	}
+	return i;
+}, Do = async (e) => {
+	if (!xo(e)) return null;
+	let t = await X.stat(wo(e)).catch(() => null);
+	return t === null ? null : t.size;
+}, Oo = async (e, t, n) => {
+	let r = await Do(e);
+	if (r === null) return null;
+	if (t >= r) return {
+		bytes: Buffer.alloc(0),
+		total: r
+	};
+	let i = await X.open(wo(e), "r");
+	try {
+		let e = Math.max(0, Math.min(n, r - t)), a = Buffer.alloc(e);
+		return await i.read(a, 0, e, t), {
+			bytes: a,
+			total: r
+		};
+	} finally {
+		await i.close();
+	}
+}, ko = async (e) => {
+	xo(e) && await X.rm(Co(e), {
+		recursive: !0,
+		force: !0
+	}).catch(() => void 0);
+}, Ao = P({ scope: "voltro:admin-export" }), jo = (e) => Array.isArray(e) ? e.filter((e) => typeof e == "string") : [], Mo = (e) => {
+	if (typeof e.tenant == "string" && e.tenant) return {
+		kind: "tenant",
+		tenantId: e.tenant
+	};
+	if (Array.isArray(e.tables) && e.tables.length) return {
+		kind: "tables",
+		tables: jo(e.tables)
+	};
+	let t = jo(e.exclude);
+	return t.length > 0 ? {
+		kind: "all",
+		exclude: t
+	} : { kind: "all" };
+}, No = (e) => async (t) => {
+	let n = Ba(t, e.secret);
+	if (n) return n;
+	let r;
+	try {
+		r = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
+	} catch {
+		return Z(400, { error: "body must be JSON: { profile?, tenant?, tables?, consistency?, compression?, bundleKey? }" });
+	}
+	let i = {};
+	if (typeof r.profile == "string" && r.profile) {
+		if (!e.loadProfile) return Z(501, { error: "server-side profiles not configured on this instance" });
+		try {
+			i = await e.loadProfile(r.profile);
+		} catch (e) {
+			return Z(400, {
+				error: `profile '${r.profile}' could not be loaded`,
+				message: e?.message ?? String(e)
+			});
+		}
+	}
+	let a = r.consistency === "snapshot" ? "snapshot" : i.consistency ?? "live", o = (typeof r.compression == "string" ? r.compression : void 0) ?? i.compression, s = i.scope ?? Mo(r), c = typeof r.bundleKey == "string" && r.bundleKey.length > 0, l = r.assets === !0 && e.assetSource ? { blobs: e.assetSource } : {}, u = wr("dexp", `${Date.now()}-${Math.random()}`), d = await Po(e.store, {
+		runId: u,
+		mode: i.subset ? "subset" : s.kind,
+		bundle: c ? String(r.bundleKey) : null
+	});
+	return Fo({
+		deps: e,
+		runId: u,
+		recorded: d,
+		profile: i,
+		scope: s,
+		consistency: a,
+		blobs: l,
+		...o ? { compression: o } : {},
+		...c ? { bundleKey: String(r.bundleKey) } : {}
+	}), To(), Ao.info("admin.export started", {
+		runId: u,
+		scope: s.kind,
+		storage: c
+	}), Z(202, {
+		runId: u,
+		transport: c ? "storage" : "download",
+		...c ? { bundleKey: r.bundleKey } : {},
+		recorded: d,
+		outcome: "poll /_voltro/admin/transfers for this runId; fetch the bytes from /_voltro/admin/export/download"
+	});
+}, Po = async (e, t) => {
+	try {
+		return Er(br), await e.insert(B, {
+			id: t.runId,
+			direction: "export",
+			startedAt: /* @__PURE__ */ new Date(),
+			finishedAt: null,
+			failure: null,
+			mode: t.mode,
+			via: "api",
+			bundle: t.bundle,
+			sourceFingerprint: null,
+			tablesWritten: 0,
+			rowsWritten: 0,
+			staged: null
+		}), !0;
+	} catch (e) {
+		return Ao.warn("admin.export: the run could not be recorded", {
+			runId: t.runId,
+			error: e?.message ?? String(e)
+		}), !1;
+	}
+}, Fo = async (e) => {
+	let { deps: t, runId: n } = e, r = await import("node:os"), i = await import("node:fs/promises"), a = await import("node:path"), o = await i.mkdtemp(a.join(r.tmpdir(), "voltro-admin-export-")), s = async (r) => {
+		e.recorded && await t.store.update(B, n, r).then(() => void 0, () => void 0);
+	};
+	try {
+		let r = await J.runPromise(Ca({
+			store: t.store,
+			snapshot: t.snapshot,
+			dialect: t.dialect,
+			outDir: o,
+			...e.profile.subset ? { subset: e.profile.subset } : {
+				scope: e.scope,
+				...t.tenantTables && t.tenantTables.length > 0 ? { tenantTables: t.tenantTables } : {}
+			},
+			consistency: e.consistency,
+			...e.compression ? { compression: e.compression } : {},
+			...e.profile.masking ? { masking: e.profile.masking } : {}
+		})), i = r.tables.reduce((e, t) => e + t.rowCount, 0), a = r.masking?.transformed.length ?? 0;
+		if (e.bundleKey !== void 0) {
+			if (!t.putArchive) throw Error("storage transport not configured on this instance");
+			await t.putArchive(e.bundleKey, () => xa({
+				dir: o,
+				...e.blobs
+			}));
+		}
+		let c = await Eo(n, xa({
+			dir: o,
+			...e.blobs
+		}));
+		Ao.info("admin.export complete", {
+			runId: n,
+			tables: r.tables.length,
+			rows: i,
+			masked: a,
+			bytes: c,
+			...e.bundleKey === void 0 ? {} : { bundleKey: e.bundleKey }
+		}), await s({
+			finishedAt: /* @__PURE__ */ new Date(),
+			failure: null,
+			tablesWritten: r.tables.length,
+			rowsWritten: i,
+			sourceFingerprint: r.source?.schemaFingerprint ?? null
+		});
+	} catch (e) {
+		let t = e?.message ?? String(e);
+		Ao.warn("admin.export failed", {
+			runId: n,
+			error: t
+		}), await s({
+			failure: t,
+			finishedAt: null
+		}), await ko(n);
+	} finally {
+		await i.rm(o, {
+			recursive: !0,
+			force: !0
+		}).catch(() => void 0);
+	}
+}, Io = (e) => async (t) => {
+	let n = Ba(t, e.secret, "GET");
+	if (n) return n;
+	let r = new URLSearchParams(t.query ?? ""), i = r.get("runId") ?? "";
+	if (!xo(i)) return Z(400, { error: "download needs ?runId=<id> from the 202 the export answered with" });
+	let a = Math.max(0, Number(r.get("offset") ?? "0") || 0), o = Number(r.get("length") ?? "8388608"), s = await Oo(i, a, Number.isFinite(o) && o > 0 ? Math.min(o, Ro) : Lo);
+	return s === null ? Z(404, {
+		error: "no artefact",
+		message: `this instance holds no produced bundle for run '${i}'. It may have expired, or the export may still be running — poll the run first.`
+	}) : {
+		status: 200,
+		contentType: "application/octet-stream",
+		body: new Uint8Array(s.bytes),
+		headers: {
+			"x-export-total-bytes": String(s.total),
+			"x-export-offset": String(a),
+			"x-export-length": String(s.bytes.byteLength)
+		}
+	};
+}, Lo = 8388608, Ro = 33554432, zo = async (e, t) => await e.query({
+	table: B,
+	order: [{
+		column: "startedAt",
+		direction: "desc"
+	}],
+	predicate: void 0,
+	projection: void 0,
+	skip: 0,
+	take: t
+}), Bo = (e) => {
+	let t = new Date(e);
+	return Number.isFinite(t.getTime()) ? t : /* @__PURE__ */ new Date(0);
+}, Vo = (e) => ({
+	...e,
+	startedAt: Bo(e.startedAt),
+	finishedAt: e.finishedAt === null || e.finishedAt === void 0 ? null : Bo(e.finishedAt)
+}), Ho = (e) => async (t) => {
+	let n = Ba(t, e.secret, "GET");
+	if (n) return n;
+	let r = Number(new URLSearchParams(t.query ?? "").get("limit") ?? "20"), i = Number.isFinite(r) ? Math.max(1, Math.min(200, Math.trunc(r))) : 20, a;
+	try {
+		a = (await zo(e.store, i)).map(Vo);
+	} catch (e) {
+		return Z(409, {
+			error: "no import history",
+			message: `this instance has no \`${B}\` table, so no import has been recorded. Run \`voltro db apply\` against it; imports themselves are unaffected.`,
+			detail: e?.message ?? String(e)
+		});
+	}
+	return Z(200, {
+		running: a.filter((e) => e.finishedAt === null && e.failure === null).length,
+		runs: a.map((e) => ({
+			id: e.id,
+			startedAt: e.startedAt.toISOString(),
+			finishedAt: e.finishedAt === null ? null : e.finishedAt.toISOString(),
+			mode: e.mode,
+			via: e.via,
+			bundle: e.bundle,
+			sourceFingerprint: e.sourceFingerprint,
+			tablesWritten: e.tablesWritten,
+			rowsWritten: e.rowsWritten,
+			direction: e.direction,
+			failure: e.failure,
+			staged: e.staged,
+			line: Tr(e)
+		}))
+	});
+}, Uo = (e, t, n = {}) => (async function* () {
+	let r = await J.runPromise(na(e, t).pipe(J.timeout(n.openTimeout ?? "30 seconds"))), i = await ia(r.stream), a = n.stallMs ?? 12e4, o, s = () => {
+		o && clearTimeout(o), o = setTimeout(() => i.destroy(/* @__PURE__ */ Error(`storage read stalled for ${a}ms reading '${t}'`)), a);
+	};
+	try {
+		s();
+		for await (let e of i) s(), yield e instanceof Uint8Array ? e : new Uint8Array(e);
+	} finally {
+		o && clearTimeout(o), i.destroy();
+	}
+})(), Wo = {
+	get: async () => void 0,
+	set: async () => {},
+	setWithTags: async () => {},
+	remove: async () => !1,
+	has: async () => !1,
+	clear: async () => {},
+	invalidateTag: async () => 0,
+	wrap: async (e, t, n) => n()
+}, Go = async (e) => {
+	y(e.appProcedures ?? e.discovered, {
+		defaultDeny: e.security?.defaultDeny ?? !0,
+		commandHint: "`voltro serve`"
+	}), Mi({
+		dataStore: e.store,
+		schemaRegistry: e.schemaRegistry
+	});
+	let t = (e.discovered.budgets?.length ?? 0) > 0, n, r = new Lr({
+		crdtColumnsOf: (t) => e.schemaRegistry.crdtColumns(t),
+		store: e.store,
+		...e.snapshotCache ? { cache: e.snapshotCache } : {},
+		...e.reactive === void 0 ? {} : { reactive: e.reactive },
+		...t ? { recordCost: (e) => n?.record(e) } : {},
+		recordDelivery: (e) => K({
+			label: e.label,
+			kind: e.kind,
+			durationMs: e.durationMs,
+			rowCount: e.rowCount
+		})
+	}), i = e.cache ?? Wo, a = e.kv ?? Ti, o, s = () => void 0, c, u, d, ee, te, ne, m, re = P({ scope: "voltro:workflow" }), ie = P({ scope: "voltro:schedule" }), h = ct({
+		store: e.store,
+		warn: (e, t) => re.warn(e, t)
+	}), ae = h.remember, oe = h.resolve, se = Ht({
+		authority: e.authority,
+		getStore: () => e.store
+	}), g = (e.discovered.workflows?.length ?? 0) > 0 ? pi(() => o) : void 0, ce = (e.discovered.workflows?.length ?? 0) > 0 || (e.discovered.eventTriggers?.length ?? 0) > 0, ue = ce || (e.discovered.workflowWorkers?.length ?? 0) > 0 || e.scheduleCoordination === "cluster", de = e.tenantIsolation === "namespace", fe = (e.log ?? P({ scope: "voltro:serve" })).child("webhooks"), pe, me, v = e.discovered.webhooks;
+	if (v && v.outgoing.length > 0 && e.workflowEngineLayer !== void 0) {
+		e.workflowEngineLayer;
+		let t = $t({
+			store: e.store,
+			schemaRegistry: e.schemaRegistry,
+			cache: i,
+			kv: a
+		}), n = v.outgoing.map((e) => e.descriptor);
+		me = pa.toLayer(ua(t, { events: n })), pe = da(t, async (e) => {
+			let t = d;
+			if (t === void 0) {
+				fe.error("webhook delivery skipped — the workflow runtime was never built. This is a framework defect, not a configuration problem: report it with your engine setting. Deliveries are NOT queued and will not be retried.", {
+					deliveryId: e.deliveryId,
+					targetId: e.targetId
+				});
+				return;
+			}
+			t.runPromise(pa.execute(e)).catch((t) => {
+				fe.error("deliverWebhook workflow crashed", {
+					deliveryId: e.deliveryId,
+					targetId: e.targetId
+				}, t);
+			});
+		}, { events: n });
+	}
+	let ge = /* @__PURE__ */ new Map();
+	if (v) for (let e of v.incoming) {
+		let t = e.descriptor.path ?? fa(e.descriptor.id), n = `VOLTRO_WEBHOOK_SECRET_${e.descriptor.id.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`, r = ha(e.descriptor, {
+			resolveSecret: async () => process.env[n] ?? null,
+			resolveWorkflows: () => g === void 0 ? void 0 : Ci(g, {
+				traceId: `incoming:${e.descriptor.id}`,
+				source: `incoming:${e.descriptor.id}`
+			}),
+			log: (e) => {
+				let t = {
+					webhookId: e.webhookId,
+					status: e.status,
+					signatureOk: String(e.signatureOk),
+					idempotency: e.idempotency,
+					durationMs: e.durationMs
+				};
+				e.status >= 500 ? fe.error("incoming delivery failed", t) : e.status >= 400 ? fe.warn("incoming delivery rejected", t) : fe.info("incoming delivery handled", t);
+			}
+		});
+		ge.set(t, { handle: r });
+	}
+	ti(), Di((t) => ni(e.store, t.subjectId, t.resourceType, t.resourceId)) || P({ scope: "voltro:serve" }).info("policy guards: using the app-registered tuple source");
+	let _e = [], ve = [...e.discovered.outboxHandlers ?? [], ...qn((v?.outgoing.length ?? 0) + (v?.incoming.length ?? 0) + (v?.providers.length ?? 0), []) ? [{
+		file: "<framework>/webhooks",
+		id: "voltro-webhook-emit",
+		definition: ma(() => pe)
+	}] : []], ye = ve.length > 0 ? Nt({
+		handlers: ve,
+		store: e.store,
+		log: (e.log ?? P({ scope: "voltro:serve" })).child("outbox"),
+		onChange: (t) => e.store.onChange((e) => t({
+			table: e.table,
+			op: e.op
+		})),
+		onShutdown: (e) => {
+			_e.push(e);
+		}
+	}) : void 0, b = Rt({
+		definitions: (e.discovered.connections ?? []).map((e) => e.definition),
+		store: e.store,
+		publicUrl: jt(e.port ?? 4e3),
+		log: (e.log ?? P({ scope: "voltro:serve" })).child("connections")
+	});
+	ke({
+		events: e.discovered.events ?? [],
+		rpcTags: [
+			...e.discovered.queries.map((e) => e.descriptor.name),
+			...e.discovered.mutations.map((e) => e.descriptor.name),
+			...e.discovered.actions.map((e) => e.descriptor.name),
+			...(e.discovered.streams ?? []).map((e) => e.descriptor.name)
+		]
+	});
+	let be = (e.log ?? P({ scope: "voltro:serve" })).child("events"), xe = e.broadcastNamespace ?? en(e.plugins, void 0), Se = rt(e.plugins, xe, be), Ce = e.membership?.instanceId ?? jr(), we = Ar(), Te = e.membership ?? Qt(e.plugins, {
+		instanceId: Ce,
+		namespace: xe,
+		meta: { mode: "serve" },
+		logger: be
+	}), Ee = _({
+		events: e.discovered.events ?? [],
+		origin: we,
+		...Se.publishRemote === void 0 ? {} : { publishRemote: Se.publishRemote }
+	}), De = (e.discovered.events ?? []).length > 0 ? await Se.attach(Ee.bus) : null, je = it({
+		store: e.store,
+		schemaRegistry: e.schemaRegistry,
+		cache: i,
+		kv: a,
+		...pe === void 0 ? {} : { webhooksService: pe },
+		...g === void 0 ? {} : { workflowsProxy: g },
+		eventTriggers: e.discovered.eventTriggers ?? [],
+		namespaceIsolationOn: de,
+		...e.ensureTenantProvisioned === void 0 ? {} : { ensureTenantProvisioned: e.ensureTenantProvisioned },
+		...e.resolveResidentStore === void 0 ? {} : { resolveResidentStore: e.resolveResidentStore },
+		...ye === void 0 ? {} : { outbox: { nudge: ye.nudge } },
+		...b.active ? { connections: { registry: b.registry } } : {},
+		eventBus: Ee.bus
+	}), Me = Y.succeed(Fr, le), Ne = Y.succeed(Rr, wt), Pe = Y.succeed(H, Oe), Fe = Y.succeed(zr, f), Ie = (t, n) => {
+		let r = t.pipe(J.provide(fi(n)));
+		return (e.baseLayer ? r.pipe(J.provide(e.baseLayer)) : r).pipe(J.provide(Me)).pipe(J.provide(Ne)).pipe(J.provide(Pe)).pipe(J.provide(Fe));
+	}, Le = (e, t) => {
+		let n = Ie(e, t);
+		return Ai(n);
+	}, Re = Wn(), ze = Mt(e.plugins ?? [], Re), Be = Xe({
+		plugins: e.plugins ?? [],
+		metrics: Re,
+		log: e.log ?? P({ scope: "voltro:serve" })
+	}), He = lt(e.plugins ?? [], Re), We = e.security?.defaultDeny ?? !0, Ge = hi({
+		store: e.store,
+		defaultDeny: We,
+		recordMetric: (e) => {
+			Re.record(e);
+		},
+		...ze.mutation === void 0 ? {} : { interceptor: ze.mutation },
+		buildContext: (e, t, n) => je(e, t, n),
+		runEffect: Le,
+		undoCapture: w((t) => e.schemaRegistry.crdtColumns(t))
+	}), Ye = Vt();
+	{
+		let t = Dt();
+		t !== void 0 && (e.log ?? P({ scope: "voltro:serve" })).info(t);
+	}
+	let Qe = Pt({
+		store: e.store,
+		...e.approvals === void 0 ? {} : { defaultExpiryMs: e.approvals.defaultExpiryMs }
+	}), $e = ri({
+		defaultDeny: We,
+		buildContext: (e) => je(e),
+		runEffect: Le,
+		recordMetric: (e) => {
+			Re.record(e);
+		},
+		...ze.action === void 0 ? {} : { interceptor: ze.action }
+	}), tt = vi({
+		tenantScopedTables: e.tenantScopedTables,
+		softDeleteScopedTables: e.softDeleteScopedTables
+	}), nt = {
+		defaultDeny: We,
+		buildContext: (e) => je(e),
+		finalize: (e, t) => tt(e, t.subject),
+		provideEffect: Ie,
+		...ze.query === void 0 ? {} : { interceptor: ze.query }
+	}, C = _i(nt), ot = gi({
+		...nt,
+		queryRows: (t, n) => e.store.query(t).then((e) => Ii(t.table, e, n.subject))
+	}), st = bi({
+		...nt,
+		subscribeDescriptor: (e, t, n, i, a) => r.subscribe(e, t, n, void 0, void 0, void 0, i, a),
+		subscribeComputed: (e, t, n) => r.subscribeComputed(e, t, n)
+	}), T = (e) => e.filter((e) => cr(e.descriptor)), E = {};
+	for (let t of [
+		...T(e.discovered.queries),
+		...Ye.queries,
+		...Qe.queries,
+		...b.queries
+	]) E[t.descriptor.name] = (e) => W(C(t, e), r, `subscription.${t.descriptor.name}`, void 0, void 0, yi(t, e));
+	for (let t of [
+		...T(e.discovered.mutations),
+		...Ye.mutations,
+		...Qe.mutations,
+		...b.mutations
+	]) {
+		let n = mi(t.descriptor.output);
+		E[t.descriptor.name] = (r) => U(async (e, n) => Ge(t, e, n), r, `mutation.${t.descriptor.name}`, n, e.idempotency, dr(t.descriptor, "mutation"));
+	}
+	for (let t of [...T(e.discovered.actions), ...b.actions]) {
+		let n = mi(t.descriptor.output);
+		E[t.descriptor.name] = (r) => U(async (e, n) => $e(t, e, n), r, `action.${t.descriptor.name}`, n, e.idempotency, dr(t.descriptor, "action"));
+	}
+	let ut = () => `public-${Math.random().toString(36).slice(2, 10)}`, dt = [
+		...e.discovered.queries.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => ot(e, t, {
+				subject: n.subject,
+				traceId: ut()
+			}),
+			subscribe: (t, n, r) => st(e, t, {
+				subject: n.subject,
+				traceId: ut()
+			}, r)
+		})),
+		...e.discovered.mutations.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => Ge(e, t, {
+				subject: n.subject,
+				traceId: ut()
+			})
+		})),
+		...e.discovered.actions.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
+			descriptor: e.descriptor,
+			invoke: (t, n) => $e(e, t, {
+				subject: n.subject,
+				traceId: ut()
+			})
+		}))
+	], ft = {
+		candidates: qe({
+			queries: e.discovered.queries,
+			mutations: e.discovered.mutations,
+			actions: e.discovered.actions,
+			descriptorOf: (e) => e.descriptor,
+			runQuery: (e, t, n) => Promise.resolve(ot(e, t, n)),
+			runMutation: (e, t, n) => Promise.resolve(Ge(e, t, n)),
+			runAction: (e, t, n) => Promise.resolve($e(e, t, n))
+		}),
+		policy: e.agents?.tools ?? {},
+		mcpEnabled: e.agents?.mcp === !0,
+		resolveSubject: (t) => e.resolveSubject(t, -1).then((e) => e.subject)
+	};
+	if (e.grpc !== void 0) {
+		let t = () => `grpc-${Math.random().toString(36).slice(2, 10)}`, n = [
+			...e.discovered.queries.map((e) => ({
+				tag: e.descriptor.name,
+				kind: "query",
+				input: e.descriptor.input,
+				output: e.descriptor.output,
+				invoke: (n, r, i) => ot(e, n, {
+					subject: r.subject,
+					traceId: t(),
+					signal: i
+				}),
+				subscribe: (n, r, i) => st(e, n, {
+					subject: r.subject,
+					traceId: t()
+				}, i)
+			})),
+			...e.discovered.mutations.map((e) => ({
+				tag: e.descriptor.name,
+				kind: "mutation",
+				input: e.descriptor.input,
+				output: e.descriptor.output,
+				invoke: (n, r, i) => Ge(e, n, {
+					subject: r.subject,
+					traceId: t(),
+					signal: i
+				})
+			})),
+			...e.discovered.actions.map((e) => ({
+				tag: e.descriptor.name,
+				kind: "action",
+				input: e.descriptor.input,
+				output: e.descriptor.output,
+				invoke: async (n, r, i) => $e(e, n, {
+					subject: r.subject,
+					traceId: t(),
+					signal: i
+				})
+			}))
+		];
+		await St({
+			config: e.grpc.config,
+			candidates: n,
+			resolveSubject: async (t) => {
+				let { subject: n } = await e.resolveSubject(t, -1), r = n;
+				return r.type === "anonymous" && r.credentialRejected !== void 0 ? null : {
+					subject: n,
+					anonymous: r.type === "anonymous"
+				};
+			},
+			store: e.store,
+			root: e.grpc.root,
+			log: e.log ?? P({ scope: "voltro:serve" }),
+			onShutdown: (e) => G(e)
+		});
+	}
+	let pt = kt({
+		...e.restRoutes === void 0 ? {} : { restRoutes: e.restRoutes },
+		publicApiEntries: dt,
+		store: e.store,
+		resolveSubject: (t) => e.resolveSubject(t, -1).then((e) => e.subject),
+		...e.idempotency === void 0 ? {} : { idempotency: e.idempotency },
+		log: e.log ?? P({ scope: "voltro:serve" })
+	}), mt = e.dataTransferSecret ?? process.env.VOLTRO_DATA_TRANSFER_SECRET, ht = async (e, t) => {
+		let { Readable: n } = await import("node:stream"), r = $i(), i = ta("storage", () => n.from(t()));
+		await J.runPromise(ra(r, e, i, { contentType: "application/octet-stream" }));
+	}, gt = mt && mt.length >= 16 ? [
+		{
+			method: "POST",
+			path: Na,
+			handle: po({
+				secret: mt,
+				store: e.store,
+				...e.dataTransferSnapshot ? { snapshot: e.dataTransferSnapshot } : {},
+				...e.dataTransferDialect ? { dialect: e.dataTransferDialect } : {},
+				assetSink: Ta($i()),
+				openArchive: (e) => Uo($i(), e),
+				refreshSubscriptions: (e) => {
+					r.refreshAll(e);
+				},
+				putArchive: ht,
+				...e.dataTransferDialect ? { dialect: e.dataTransferDialect } : {}
+			})
+		},
+		{
+			method: "POST",
+			path: Pa,
+			handle: ho({
+				secret: mt,
+				store: e.store,
+				...e.dataTransferSnapshot ? { snapshot: e.dataTransferSnapshot } : {},
+				...e.dataTransferDialect ? { dialect: e.dataTransferDialect } : {},
+				assetSink: Ta($i()),
+				openArchive: (e) => Uo($i(), e),
+				refreshSubscriptions: (e) => {
+					r.refreshAll(e);
+				},
+				putArchive: ht
+			})
+		},
+		{
+			method: "GET",
+			path: La,
+			handle: Ho({
+				secret: mt,
+				store: e.store
+			})
+		},
+		{
+			method: "GET",
+			path: Ia,
+			handle: Io({ secret: mt })
+		},
+		{
+			method: "POST",
+			path: Fa,
+			handle: No({
+				secret: mt,
+				store: e.store,
+				snapshot: e.dataTransferSnapshot ?? { tables: [] },
+				dialect: e.dataTransferDialect ?? "memory",
+				tenantTables: [...e.tenantScopedTables],
+				loadProfile: $n,
+				assetSource: Ea($i(), e.store),
+				putArchive: ht
+			})
+		}
+	] : [], _t = [
+		...e.httpRoutes ?? [],
+		...pt.httpRoutes,
+		...gt,
+		...b.httpRoutes
+	];
+	Object.assign(E, Ee.handlers);
+	for (let t of T(e.discovered.streams ?? [])) E[t.descriptor.name] = (n) => Kr((r) => zi(r, (r) => {
+		let i = je(r), a = t.executor(n, i);
+		if (J.isEffect(a)) {
+			let t = a.pipe(J.provide(fi(i.store)));
+			return (e.baseLayer ? t.pipe(J.provide(e.baseLayer)) : t).pipe(J.provide(Me)).pipe(J.provide(Ne)).pipe(J.provide(Pe)).pipe(J.provide(Fe));
+		}
+		return typeof a == "object" && a && typeof a.then == "function" ? J.promise(() => a) : a;
+	}), `stream.${t.descriptor.name}`, t.descriptor.guards, n);
+	for (let t of e.discovered.workflows ?? []) E[t.definition.name] = (e) => U(async (e, n) => {
+		let r = n;
+		return Ci(g, {
+			subject: r.subject,
+			traceId: r.traceId,
+			source: "workflow-rpc"
+		}).start(t.definition.name, e);
+	}, e, `workflow.${t.definition.name}`);
+	ce && (E[R.name] = (e) => W(C({
+		descriptor: R,
+		executor: (e) => {
+			let t = e.id;
+			return {
+				table: "_voltro_workflow_runs",
+				order: [{
+					column: "startedAt",
+					direction: "desc"
+				}],
+				predicate: Dr(V("id", t), V("executionId", t)),
+				take: 1,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${R.name}`), E[vr.name] = (e) => W(C({
+		descriptor: vr,
+		executor: (e) => {
+			let t = e, n = [...t.tag === void 0 ? [] : [V("tag", t.tag)], ...t.status === void 0 ? [] : [V("status", t.status)]], r = Number.isFinite(t.limit) && t.limit !== void 0 ? Math.min(Math.max(Math.floor(t.limit), 1), 500) : 100;
+			return {
+				table: "_voltro_workflow_runs",
+				order: [{
+					column: "startedAt",
+					direction: "desc"
+				}],
+				predicate: n.length === 0 ? void 0 : n.length === 1 ? n[0] : Sr(...n),
+				take: r,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${vr.name}`), E[_r.name] = (e) => W(C({
+		descriptor: _r,
+		executor: (e) => {
+			let t = e.runId;
+			return {
+				table: "_voltro_workflow_run_steps",
+				order: [{
+					column: "startedAt",
+					direction: "asc"
+				}],
+				predicate: V("runId", t),
+				take: 1e3,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${_r.name}`), E[gr.name] = (e) => W(C({
+		descriptor: gr,
+		executor: (e) => {
+			let t = e.runId;
+			return {
+				table: "_voltro_workflow_run_events",
+				order: [{
+					column: "occurredAt",
+					direction: "asc"
+				}],
+				predicate: V("runId", t),
+				take: 1e3,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${gr.name}`), E[pr.name] = (e) => W(C({
+		descriptor: pr,
+		executor: (e) => {
+			let t = e;
+			return {
+				table: "_voltro_workflow_events",
+				order: [{
+					column: "occurredAt",
+					direction: "desc"
+				}],
+				predicate: t.name === void 0 ? void 0 : V("name", t.name),
+				take: Math.max(1, Math.min(500, t.limit ?? 100)),
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${pr.name}`), E[mr.name] = (e) => W(C({
+		descriptor: mr,
+		executor: (e) => {
+			let t = e.eventId;
+			return {
+				table: "_voltro_workflow_event_deliveries",
+				order: [{
+					column: "createdAt",
+					direction: "asc"
+				}],
+				predicate: V("eventId", t),
+				take: 500,
+				skip: void 0,
+				projection: void 0
+			};
+		}
+	}, e), r, `subscription.${mr.name}`), E[fr.name] = (t) => U(async (t, n) => {
+		let r = t;
+		return await tn(e.store, n.subject, { executionId: r.executionId }), await g.cancel(r.workflowName, r.executionId), await Ot(r.workflowName, r.executionId, "workflow.cancel"), { ok: !0 };
+	}, t, `action.${fr.name}`), E[hr.name] = (t) => U(async (t, n) => {
+		let r = t;
+		return await tn(e.store, n.subject, { executionId: r.executionId }), await g.resume(r.workflowName, r.executionId), { ok: !0 };
+	}, t, `action.${hr.name}`), E[z.name] = (t) => U(async (t, n) => {
+		let r = t;
+		return await tn(e.store, n.subject, { id: r.id }), g.signal({ id: r.id }, r.signalName, r.payload);
+	}, t, `action.${z.name}`), E[yr.name] = (t) => U(async (t, n) => {
+		let r = t;
+		return await tn(e.store, n.subject, { id: r.id }), g.update({ id: r.id }, r.updateName, r.payload, r.timeoutMs === void 0 ? void 0 : { timeoutMs: r.timeoutMs });
+	}, t, `action.${yr.name}`));
+	let vt = [
+		...T(e.discovered.queries).map((e) => L(e.descriptor)),
+		...T(e.discovered.mutations).map((e) => lr(e.descriptor)),
+		...T(e.discovered.actions).map((e) => I(e.descriptor)),
+		...Ye.queries.map((e) => L(e.descriptor)),
+		...Ye.mutations.map((e) => lr(e.descriptor)),
+		...Qe.queries.map((e) => L(e.descriptor)),
+		...Qe.mutations.map((e) => lr(e.descriptor)),
+		...b.queries.map((e) => L(e.descriptor)),
+		...b.mutations.map((e) => lr(e.descriptor)),
+		...b.actions.map((e) => I(e.descriptor)),
+		...T(e.discovered.streams ?? []).map((e) => ur(e.descriptor)),
+		...Ee.rpcs,
+		...(e.discovered.workflows ?? []).map((e) => Bi(e.definition)),
+		...ce ? [
+			L(R),
+			L(vr),
+			L(_r),
+			L(gr),
+			L(pr),
+			L(mr),
+			I(fr),
+			I(hr),
+			I(z),
+			I(yr)
+		] : []
+	], yt = Qi.make(...vt).middleware(or).middleware(F), bt = li({ resolveSubject: ({ headers: t, clientId: n }) => e.resolveSubject(t, n) }), xt = e.dormancyTenantId ?? Ir, Ct = e.dormancy === "sleep" ? {
+		register: (t, n, r) => Oi(e.store, {
+			tenantId: r ?? xt,
+			kind: "workflow",
+			refId: t,
+			wakeAt: n
+		}),
+		cancel: (t, n) => Jr(e.store, {
+			tenantId: n ?? xt,
+			kind: "workflow",
+			refId: t
+		}).then(() => {})
+	} : void 0, O = ue ? await import("@voltro/workflow") : void 0, k = O?.makeWorkflowRunRecorder({
+		store: e.store,
+		...e.workflowRecording === void 0 ? {} : { recording: e.workflowRecording },
+		...Ct === void 0 ? {} : { wakeups: Ct }
+	}), Tt = async (t, n) => {
+		await O.closeWorkflowChildrenForParent({
+			store: e.store,
+			parentExecutionId: t,
+			parentStatus: n,
+			recorder: k,
+			log: { warn: (e, t) => re.warn(e, t ?? {}) },
+			interruptChild: async (t, n) => {
+				let r = (e.discovered.workflows ?? []).find((e) => e.definition.name === t);
+				if (!r) throw Error(`Unknown child workflow: ${t}`);
+				if (!d) throw Error("Workflow runtime is not ready");
+				await d.runPromise(r.definition.interrupt(n));
+			}
+		});
+	}, Ot = async (t, n, r) => {
+		let i = (await e.store.query({
+			table: "_voltro_workflow_runs",
+			order: [],
+			predicate: V("executionId", n),
+			projection: void 0,
+			skip: void 0,
+			take: 1
+		}))[0];
+		if (i === void 0) return;
+		let a = await e.store.update("_voltro_workflow_runs", i.id, {
+			status: "cancelled",
+			cancelled: !0,
+			completedAt: /* @__PURE__ */ new Date()
+		}), o = i.subject?.tenantId ?? void 0;
+		a && await k.recordEvent({
+			runId: i.id,
+			eventType: "run-cancelled",
+			payload: {
+				reason: r,
+				workflowName: t,
+				executionId: n,
+				...o == null ? {} : { tenantId: o }
+			}
+		}), a && await Tt(n, "cancelled");
+	}, At = [
+		...wi(e.discovered.workflows ?? [], {
+			buildContext: (t, n) => e.buildContextForWorkflow?.(t, n) ?? je({
+				subject: t.subject,
+				traceId: t.traceId,
+				rowFilter: t.rowFilter
+			}, e.store, void 0, `workflow:${n.workflowName}`, { parentExecutionId: n.executionId }),
+			resolveStartContext: oe,
+			...se === void 0 ? {} : { resolveAuthority: se }
+		}, (t, n, r) => {
+			let i = O.getWorkflowVersionMetadata(t.definition);
+			return O.wrapWorkflowExecuteWithRunRecording({
+				name: t.definition.name,
+				store: e.store,
+				subject: r.subject,
+				source: r.source ?? null,
+				traceId: r.traceId,
+				workflowVersion: i.version,
+				workflowCompatibleVersions: i.compatibleWith,
+				workflowPatches: i.patches,
+				parentExecutionId: r?.parentExecutionId ?? null,
+				parentClosePolicy: r?.parentClosePolicy ?? null,
+				onParentClose: ({ executionId: e, status: t }) => Tt(e, t),
+				...Jt(t.definition),
+				onTerminal: async ({ executionId: e }) => {
+					await u?.gate.release(e);
+				},
+				recorder: k,
+				pluginWorkflowStepLayer: He,
+				recordRun: Ei
+			}, n);
+		}),
+		...e.discovered.workflowWorkers ?? [],
+		...me === void 0 ? [] : [me]
+	], Ft = [...(e.discovered.workflows ?? []).map((e) => e.definition.name).filter(Boolean), ...me === void 0 ? [] : ["voltro.deliverWebhook"]], It = At.length > 0 ? Y.mergeAll(...At) : Y.empty;
+	if (((e.discovered.workflows?.length ?? 0) > 0 || (e.discovered.workflowWorkers?.length ?? 0) > 0 || e.scheduleCoordination === "cluster" || me !== void 0) && e.workflowEngineLayer !== void 0) {
+		let t = It.pipe(Y.provideMerge(e.workflowEngineLayer));
+		d = Wi.make((e.baseLayer === void 0 ? t : t.pipe(Y.provideMerge(e.baseLayer))).pipe(Y.provideMerge(ar({})))), await d.runPromise(J.void), (e.log ?? P({ scope: "voltro:serve" })).child("workflow").info(`workflow runtime ready — ${Ft.length} entity type(s) registered`, { entities: Ft });
+		let n = await import("@voltro/workflow/cluster"), r = (e) => d.runPromise(n.redriveFailedRun(e)), i = (e) => d.runPromise(n.resumeRunFromStep(e));
+		ne = await Ae({
+			provider: la(e.plugins ?? [])?.broadcast?.provider,
+			crossReplica: la(e.plugins ?? [])?.broadcast?.crossReplica ?? !1,
+			namespace: xe,
+			replicaId: crypto.randomUUID(),
+			pollStorage: () => d.runPromise(n.pollWorkflowStorage),
+			onChange: (t) => e.store.onChange((e) => t({
+				table: e.table,
+				op: e.op,
+				...e.origin === void 0 ? {} : { origin: e.origin }
+			})),
+			log: (e.log ?? P({ scope: "voltro:serve" })).child("workflow")
+		}), ee = async (t) => {
+			let n = await Ze({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runRedrive: r
+			}, t.runId);
+			return n.statusReset && await k.recordEvent({
+				runId: t.runId,
+				eventType: "run-redriven",
+				payload: {
+					reason: "inspect.redrive",
+					activitiesReset: n.outcome.activitiesReset
+				}
+			}), {
+				redriven: n.outcome.redriven,
+				activitiesReset: n.outcome.activitiesReset,
+				reason: n.outcome.reason
+			};
+		}, te = async (t) => {
+			let n = await S({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runResume: i
+			}, t.runId, t.step);
+			return n.statusReset && await k.recordEvent({
+				runId: t.runId,
+				eventType: "run-redriven",
+				payload: {
+					reason: "inspect.resume-from-step",
+					step: n.stepName,
+					activitiesReset: n.outcome.activitiesReset
+				}
+			}), {
+				redriven: n.outcome.redriven,
+				stepName: n.stepName,
+				activitiesReset: n.outcome.activitiesReset,
+				reason: n.outcome.reason
+			};
+		};
+		let a = (e.scheduleCoordination ?? "single") === "advisoryLock" ? ii(e.store, e.scheduleReplicaId ?? `pid-${process.pid}`) : Pi, f = di({
+			coordinator: a,
+			replicaId: e.scheduleReplicaId ?? `pid-${process.pid}`
+		}), p = P({ scope: "voltro:flow-control" }), m = {
+			info: (e, t) => {
+				p.info(e, t);
+			},
+			warn: (e, t) => {
+				p.warn(e, t);
+			},
+			error: (e, t) => {
+				p.error(e, t ?? {});
+			}
+		}, re, ie = () => {
+			if (re !== void 0) return re;
+			if (o !== void 0 && k !== void 0) return re = Ve({
+				store: e.store,
+				log: M,
+				workflows: e.discovered.workflows ?? [],
+				workflowsProxy: o,
+				workflowRuntime: d,
+				workflowRunRecorder: k,
+				closeChildrenForParent: Tt
+			}), re;
+		};
+		s = ie, u = Zt({
+			store: e.store,
+			onChange: (t) => e.store.onChange((e) => t({
+				table: e.table,
+				op: e.op
+			})),
+			...e.scheduling === void 0 ? {} : {
+				disarmWhenIdle: e.scheduling.disarmWhenIdle,
+				drainIntervalMs: e.scheduling.admissionDrainMs,
+				cancelSweepIntervalMs: e.scheduling.cancelSweepMs,
+				stalenessSweepIntervalMs: e.scheduling.stalenessSweepMs
+			},
+			workflows: e.discovered.workflows ?? [],
+			facade: () => o,
+			cancelRunWithReason: ie,
+			recordRunEvent: () => k?.recordEvent,
+			...e.workflowStaleness === void 0 ? {} : { staleness: e.workflowStaleness },
+			...e.workflowSuspendSignalHintMs === void 0 ? {} : { suspendSignalHintMs: e.workflowSuspendSignalHintMs },
+			scheduleCoordinated: f,
+			onAbandoned: async (t) => {
+				await et({
+					workflows: e.discovered.workflows ?? [],
+					facade: () => o,
+					log: m,
+					...t
+				});
+			},
+			log: m
+		});
+		let h = u;
+		h !== void 0 && G(() => h.stop()), c = at({
+			store: e.store,
+			onChange: (t) => e.store.onChange((e) => t({
+				table: e.table,
+				op: e.op
+			})),
+			...e.scheduling === void 0 ? {} : {
+				disarmWhenIdle: e.scheduling.disarmWhenIdle,
+				tickIntervalMs: e.scheduling.inferenceTickMs
+			},
+			enabled: (e.discovered.workflows?.length ?? 0) > 0,
+			resumeSignal: () => d === void 0 || O === void 0 ? void 0 : async ({ executionId: t, workflowName: n, signalName: r, payload: i }) => {
+				await d.runPromise(O.completeSuspendingSignal({
+					store: e.store,
+					target: nn(t, n),
+					signalName: r,
+					payload: i
+				}));
+			},
+			runEffect: (e) => d.runPromise(e),
+			scheduleCoordinated: f,
+			log: m
+		});
+		let oe = c;
+		oe !== void 0 && G(() => oe.stop()), o = (e.discovered.workflows?.length ?? 0) > 0 ? Si({
+			workflows: e.discovered.workflows ?? [],
+			runEffect: (e) => d.runPromise(e),
+			onEnqueue: () => ne?.publishWake(),
+			...h === void 0 ? {} : {
+				admitStart: h.gate.admitStart,
+				startPayloadSchema: h.gate.startPayloadSchema,
+				parkDelayedStart: h.gate.parkDelayed
+			},
+			rememberStartContext: ae,
+			signal: async (t, n, r) => {
+				let i = await O.sendWorkflowSignal({
+					store: e.store,
+					recorder: k,
+					target: t,
+					signalName: n,
+					payload: r
+				});
+				return await d.runPromise(O.completeSuspendingSignal({
+					store: e.store,
+					target: t,
+					signalName: n,
+					payload: r
+				})).catch(() => {}), i;
+			},
+			update: (t, n, r, i) => O.sendWorkflowUpdate({
+				store: e.store,
+				recorder: k,
+				target: t,
+				updateName: n,
+				payload: r,
+				...i === void 0 ? {} : { options: i }
+			}),
+			listRuns: (t) => Je(e.store, t),
+			retry: (t, n) => l({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runPromise: (e) => d.runPromise(e)
+			}, t, n),
+			redrive: (t) => Ze({
+				store: e.store,
+				workflows: e.discovered.workflows ?? [],
+				runRedrive: r
+			}, t).then((e) => e.outcome)
+		}) : void 0;
+	}
+	let Lt = Y.mergeAll(yt.toLayer(E), bt), zt = D(E, e.discovered.queries.map((e) => e.descriptor.name), ce), A = Y.mergeAll(yt.toLayer(zt), bt), j = e.observability, Ut = await qr({
+		...e.traceSink === void 0 ? {} : { traceSink: e.traceSink },
+		...e.appName === void 0 ? {} : { serviceName: e.appName },
+		...j && j.spanProcessors.length > 0 ? { extraSpanProcessors: j.spanProcessors } : {},
+		...j && j.metricReaders.length > 0 ? { extraMetricReaders: j.metricReaders } : {},
+		...j && Object.keys(j.resourceAttributes).length > 0 ? { resourceAttributes: j.resourceAttributes } : {},
+		...j && j.sampler !== void 0 ? { sampler: j.sampler } : {}
+	}), Gt = !1, Kt = e.store.ping ? () => e.store.ping().then(() => !0).catch(() => !1) : void 0, { server: qt, shutdown: Yt } = Fi({
+		group: yt,
+		handlersLayer: Lt,
+		httpHandlersLayer: A,
+		port: e.port ?? 4e3,
+		...e.host === void 0 ? {} : { host: e.host },
+		path: e.path ?? "/ws",
+		tracerLayer: Ut.layer,
+		security: Ue(e),
+		...Un(e),
+		...e.discovered.wsGateways !== void 0 && e.discovered.wsGateways.length > 0 ? { webSocketGateways: e.discovered.wsGateways } : {},
+		resolveGatewaySubject: async (t) => {
+			let n = await e.resolveSubject(t, -1);
+			return n.subject.type === "anonymous" ? null : {
+				subject: n.subject,
+				...n.credentialExpiresAt === void 0 ? {} : { credentialExpiresAt: n.credentialExpiresAt * 1e3 }
+			};
+		},
+		...Be,
+		healthCheck: (() => {
+			let t = e.health;
+			if (t?.readiness !== void 0) {
+				let e = t.readiness;
+				return {
+					isReady: () => Gt,
+					ping: async () => {
+						try {
+							return await e();
+						} catch {
+							return !1;
+						}
+					}
+				};
+			}
+			return {
+				isReady: () => Gt,
+				...Kt ? { ping: Kt } : {}
+			};
+		})(),
+		..._t.length > 0 ? { httpRoutes: _t } : {},
+		...e.getStore === void 0 ? {} : { getStore: e.getStore },
+		...ge.size > 0 ? { webhookRoutes: ge } : {},
+		...e.inspectRoute === void 0 ? {} : { inspectRoute: e.inspectRoute },
+		...e.inspectStream === void 0 ? {} : { inspectStream: e.inspectStream }
+	}), Xt = Ma(qt);
+	if (await Gr(qt), (e.discovered.schedules?.length ?? 0) > 0) {
+		let t = (e.scheduleCoordination ?? "single") === "advisoryLock" ? ii(e.store, e.scheduleReplicaId ?? `pid-${process.pid}`) : Pi;
+		m = await q(e.discovered.schedules ?? [], {
+			store: e.store,
+			coordinator: t,
+			defaultTrigger: e.scheduleDefaultTrigger ?? "self",
+			replicaId: e.scheduleReplicaId ?? `pid-${process.pid}`,
+			armSelf: e.scheduleArmSelf ?? !0,
+			dormancy: e.dormancy ?? "always-on",
+			...e.scheduling === void 0 ? {} : { runHeartbeatMs: e.scheduling.scheduleHeartbeatMs },
+			...e.dormancyTenantId === void 0 ? {} : { dormancyTenantId: e.dormancyTenantId },
+			buildContext: ({ traceId: t, scheduleName: n, subject: r }) => je({
+				subject: r,
+				traceId: t
+			}, e.store, void 0, `schedule:${n}`),
+			log: {
+				info: (e, t) => {
+					ie.info(e, t);
+				},
+				warn: (e, t) => {
+					ie.warn(e, t);
+				},
+				error: (e, t) => {
+					ie.error(e, t ?? {});
+				},
+				debug: () => {}
+			},
+			...e.scheduleFireInterceptor === void 0 ? {} : { interceptFire: e.scheduleFireInterceptor },
+			...e.onScheduleRunEvent === void 0 ? {} : { onRunEvent: e.onScheduleRunEvent }
+		}), e.onSchedulerReady?.(m);
+	}
+	let M = e.log ?? P({ scope: "voltro:serve" }), rn, an, sn = e.claimChange;
+	if ((e.discovered.subscribers?.length ?? 0) > 0 && (rn = Bt(e.discovered.subscribers ?? [], e.store, M.child("subscribe"), e.schemaRegistry, {
+		eventBus: Ee.bus,
+		...sn === void 0 ? {} : { claimOnce: sn }
+	})), (e.discovered.reactions?.length ?? 0) > 0) {
+		let t = M.child("reaction");
+		an = on(e.discovered.reactions ?? [], e.store, {
+			runAct: async (n, r) => {
+				if (n.kind === "workflow") {
+					if (g === void 0) {
+						t.warn("reaction workflow act skipped — no workflow engine in this app", { workflow: n.workflow });
+						return;
+					}
+					let e = n.payload === void 0 ? r.new ?? r.old ?? {} : n.payload(r);
+					await Ci(g, {
+						traceId: `reaction:${n.workflow}`,
+						source: `reaction:${n.workflow}`
+					}).start(n.workflow, e);
+					return;
+				}
+				await p(n.agent, r, {
+					findAgentSend: (t) => e.discovered.actions.find((e) => e.descriptor.name === `${t}.send`),
+					runAction: (e, t, n) => Promise.resolve($e(e, t, n)),
+					makeSubject: (e) => sr(e),
+					now: () => Date.now(),
+					log: t
+				});
+			},
+			checkBudget: async (n, r) => {
+				try {
+					let { requireAiBudget: t } = await import("@voltro/ai");
+					return (await J.runPromise(J.either(t(e.store, {
+						tenantId: n,
+						limitUsd: r
+					}))))._tag === "Right";
+				} catch (e) {
+					return t.warn("reaction budget check failed — refusing the act", { tenantId: n }, e), !1;
+				}
+			},
+			...sn === void 0 ? {} : { claimRateSlot: (e) => sn(Wt, e) },
+			...sn === void 0 ? {} : { claimDedupe: (e) => sn(Et, e) }
+		}, t);
+	}
+	let cn;
+	(e.discovered.aggregates?.length ?? 0) > 0 && (cn = await x({
+		discovered: e.discovered.aggregates ?? [],
+		store: e.store,
+		log: M.child("aggregate"),
+		...e.analytics === void 0 ? {} : { analytics: e.analytics },
+		...e.aggregateStorage === void 0 ? {} : { storage: e.aggregateStorage },
+		...e.aggregateCoordinator === void 0 ? {} : { coordinator: e.aggregateCoordinator }
+	}), Me = Y.succeed(Fr, cn.registry));
+	let ln;
+	(e.discovered.expectations?.length ?? 0) > 0 && (ln = Hr({
+		discovered: e.discovered.expectations ?? [],
+		store: e.store,
+		log: M.child("expectation")
+	}), Ne = Y.succeed(Rr, ln.registry)), (e.discovered.budgets?.length ?? 0) > 0 && (n = Wr({
+		discovered: e.discovered.budgets ?? [],
+		log: M.child("finops")
+	}), Pe = Y.succeed(H, n.registry));
+	let un;
+	return (e.discovered.experiments?.length ?? 0) > 0 && (un = Ur({
+		discovered: e.discovered.experiments ?? [],
+		store: e.store,
+		log: M.child("experiment")
+	}), Fe = Y.succeed(zr, un.registry)), Gt = !0, e.bootTiming?.mark("ready"), {
+		dispatcher: r,
+		server: qt,
+		scheduler: m,
+		eventsSnapshot: he(Ee.bus, Ee.declared),
+		membersSnapshot: () => ({
+			members: Te.membership.list(),
+			capturedAt: Date.now()
+		}),
+		agentTools: () => ft,
+		rpcMetrics: () => Re,
+		webhooksService: () => pe,
+		runCanceller: () => s(),
+		flowControlHealth: () => u?.cancelHealth(),
+		inferenceHealth: () => c?.health(),
+		workflowWriteActions: () => g === void 0 || k === void 0 ? void 0 : Ke({
+			store: e.store,
+			log: M,
+			workflows: e.discovered.workflows ?? [],
+			workflowsProxy: o,
+			workflowRuntime: d,
+			workflowRunRecorder: k,
+			closeChildrenForParent: Tt
+		}),
+		redriveWorkflowRun: (e) => ee ? ee(e) : Promise.reject(/* @__PURE__ */ Error("redrive: this app registers no workflows")),
+		resumeWorkflowRunFromStep: (e) => te ? te(e) : Promise.reject(/* @__PURE__ */ Error("resume-from-step: this app registers no workflows")),
+		close: async () => {
+			Gt = !1, await Xt.drainRequests();
+			for (let e of _e) try {
+				await e();
+			} catch (e) {
+				M.warn("serve: teardown step failed", {}, e);
+			}
+			await De?.detach(), await Te.detach(), cn?.detach(), ln?.detach(), n?.detach(), un?.detach(), an?.(), rn?.(), await m?.shutdown(), r.close(), await ne?.detach(), await d?.dispose(), await Yt(), await Xt.finish();
+		}
+	};
+}, Ko = (e) => {
+	if (e == null || e === "") return;
+	let t = Number(e);
+	return Number.isFinite(t) && t > 0 ? t : void 0;
+}, qo = (e, t) => {
+	let n = e === void 0 || e === !1 ? {
+		on: !1,
+		size: 500
+	} : {
+		on: !0,
+		size: Ko(e === !0 ? void 0 : e.size) ?? 500
+	};
+	if (t === void 0 || t.trim() === "") return n;
+	let r = t.trim().toLowerCase();
+	if (r === "off" || r === "false" || r === "0") return {
+		on: !1,
+		size: n.size
+	};
+	if (r === "on" || r === "true") return {
+		on: !0,
+		size: n.size
+	};
+	let i = Ko(r);
+	return i === void 0 ? n : {
+		on: !0,
+		size: i
+	};
+}, Jo = (e, t = process.env) => ({
+	logs: qo(e?.logs, t.VOLTRO_INSPECT_LOGS),
+	traces: qo(e?.traces, t.VOLTRO_INSPECT_TRACES)
+}), $ = P({ scope: "voltro:serve" }), Yo = (e, t, n) => (e === "production" || e === "staging") && t !== "memory" && n !== "0", Xo = _n, Zo = async (e) => {
+	let t = bn(process.cwd());
+	if (rr(t)) {
+		let n;
+		try {
+			let e = await import(ir(t).href);
+			typeof e.runServe == "function" ? n = e.runServe : $.warn("serve bundle has no runServe export — using the standard serve path");
+		} catch (e) {
+			$.warn("serve bundle failed to load — using the standard serve path", {}, e);
+		}
+		if (n) return $.info("serve: booting from the precompiled serve bundle"), n(e);
+	}
+	return Qo(e);
+}, Qo = async (l) => {
+	Pr("serve");
+	let f = Xn();
+	e("serve");
+	try {
+		Hi();
+	} catch (e) {
+		throw i(e instanceof Error ? e.message : String(e));
+	}
+	let p = process.cwd(), _ = await Tt(p), le = vn({
+		kind: "api",
+		configPort: _?.port,
+		env: process.env,
+		flagPort: Xo(l, "--port")
+	});
+	for (let e of le.warnings) $.warn(e);
+	let he = le.port;
+	ji(ki(_?.secrets)), await sn({
+		rawEnv: _?.env,
+		appType: "api",
+		root: p,
+		log: $,
+		generateTypes: !1,
+		plugins: _?.plugins ?? []
+	}), f.mark("config");
+	let y = (process.env.DB_DIALECT ?? _?.store ?? "memory").toLowerCase(), Oe = (y === "mariadb" || y === "postgres" || y === "mssql") && (process.env.CDC ?? "1") !== "0", ke = y === "mariadb" ? "mariadb" : y === "mssql" ? "mssql" : void 0, Ae = yn(p);
+	if (!r() && rr(Ae)) try {
+		let e = await import(ir(Ae).href);
+		if (e.modules) {
+			let t = {};
+			for (let [n, r] of Object.entries(e.modules)) t[tr(p, n)] = r;
+			n(t), $.info("precompiled api bundle loaded", { modules: Object.keys(t).length });
+		}
+	} catch (e) {
+		$.warn("precompiled api bundle failed to load — falling back to source", {}, e);
+	}
+	let x = await Ot(p), S = await st(x, {
+		root: p,
+		cdc: Oe && ke !== void 0
+	}), Ve = Lt(S);
+	{
+		ut({
+			plugins: _?.plugins ?? [],
+			queries: S.queries,
+			mutations: S.mutations,
+			actions: S.actions,
+			streams: S.streams,
+			log: $
+		});
+		let e = u(S.serverOnlyLeaks, je(process.env, "strict"), Zr, "`voltro serve`");
+		if (e.action === "fail") throw i(e.message ?? "");
+		e.action === "warn" && $.warn(e.message ?? "");
+	}
+	let Ke = x.filter((e) => Yn.test(e)), qe = Ke.length > 0 ? await Jn(Ke, $.child("webhooks")) : {
+		outgoing: [],
+		incoming: [],
+		providers: []
+	}, Je = Kn(S.events), Xe = qe.outgoing.length + qe.incoming.length + qe.providers.length + Je.length === 0 ? void 0 : {
+		...qe,
+		outgoing: [...qe.outgoing, ...Je]
+	}, Ze = Mn({
+		nodeEnv: process.env.NODE_ENV,
+		cdcDialect: ke,
+		declared: _?.schema
+	}), et = Nn({
+		gates: Ze,
+		runtime: {
+			traces: ye(),
+			undo: Li()
+		}
+	});
+	if (et !== void 0) throw i(`serve: ${et}`);
+	let rt = jn({
+		mix: S.featureMix,
+		plugins: _?.plugins ?? [],
+		gates: Ze,
+		...ke ? { cdcDialect: ke } : {}
+	}), it = _?.analytics !== void 0 && _.analytics.kind !== "noop" && y !== "memory" ? (await xn(y)).makeSqlLayer(A()) : void 0, at = await dt({
+		spec: _?.analytics,
+		sqlLayer: it,
+		log: $
+	}), w = (() => {
+		let e = new Set(S.tables.map((e) => e.tableName)), t = [...S.tables];
+		for (let n of [...rt, ...at.tables]) e.has(n.tableName) || (e.add(n.tableName), t.push(n));
+		return t;
+	})();
+	for (let e of w) Er(e);
+	{
+		let e = Qr(Ri(ce(S), v(w)));
+		e !== void 0 && $.warn(e);
+	}
+	let ct = (process.env.NODE_ENV ?? "").toLowerCase();
+	if (Yo(ct, y, process.env.VOLTRO_AUTO_MIGRATE)) {
+		let e = (await xn(y)).makeSqlLayer(A()), t = await J.runPromise(Gi.SqlClient.pipe(J.flatMap((e) => Ji(e, p)), J.provide(e), J.catchAll(() => J.succeed([]))));
+		t.length > 0 && ($.error(`serve: refusing to boot — ${t.length} pending file-based migration(s) have never run against this database. They perform the changes a schema diff cannot infer (data moves, backfills, table splits), so the declarative fingerprint check below cannot see them and would have let this process serve un-migrated data.`, { pending: t }), $.error("Run them from your pre-deploy job — `voltro db migrate .` (schema + files) or `voltro db files .` (files alone) — or set VOLTRO_AUTO_MIGRATE=0 to bypass every boot schema check. `voltro serve` never applies them itself: a rolling deploy would start N replicas and each would try."), process.exit(1));
+		let n = await J.runPromise(Gi.SqlClient.pipe(J.flatMap((e) => Yi(e, w, {
+			appliedBy: `serve:${ct}`,
+			environment: "prod",
+			dialectId: y
+		})), J.provide(e)));
+		n.kind === "prod-mismatch" && ($.error(qi(n, y)), $.error(Pn({
+			gates: Ze,
+			nodeEnv: process.env.NODE_ENV,
+			cdcDialect: ke,
+			declared: _?.schema
+		})), $.error("serve: refusing to boot — apply the schema first (voltro db apply in a pre-deploy step), or set VOLTRO_AUTO_MIGRATE=0 to bypass this check."), process.exit(1)), $.info(qi(n, y));
+	}
+	await En({
+		dialectId: y,
+		tables: w,
+		mode: wn(_?.reactiveTriggers),
+		lockSchema: A().schema,
+		makeLayer: async () => (await xn(y)).makeSqlLayer(A()),
+		log: {
+			info: (e, t) => $.info(e, t ?? {}),
+			warn: (e, t) => $.warn(e, t ?? {})
+		}
+	});
+	let lt = xi(w);
+	f.mark("discover");
+	let D = await tt(_, void 0);
+	{
+		let e = await c(D);
+		if (e !== void 0) throw i(`serve: ${e}`);
+		let t = await s(D, y, _);
+		t !== void 0 && $.warn(t);
+	}
+	let St = Vi(D, y);
+	for (let e of k({
+		dialect: String(_?.store ?? process.env.DB_DIALECT ?? "postgres"),
+		changeStrategy: (process.env.CDC ?? "1") === "0" ? "inline" : "cdc",
+		dbUrl: process.env.DB_URL,
+		crossReplicaBus: la(_?.plugins ?? [])?.broadcast.crossReplica === !0,
+		tables: S.tables.map((e) => ({
+			tableName: e.tableName,
+			isReactive: e.isReactive === !0
+		})),
+		querySources: S.queries.flatMap((e) => {
+			let t = e.descriptor.source;
+			return t === void 0 ? [] : typeof t == "string" ? [t] : [...t];
+		})
+	})) e.level === "warn" ? $.warn(e.message) : $.info(e.message);
+	{
+		let e = h({
+			tables: xr().map((e) => ({ tableName: e.tableName })),
+			queries: S.queries.map((e) => ({
+				name: e.descriptor.name,
+				source: e.descriptor.source
+			}))
+		}), t = De(e);
+		t !== void 0 && $.warn(t);
+	}
+	_?.cache && !process.env.CACHE_BACKEND && (process.env.CACHE_BACKEND = _.cache), _?.cacheRedisUrl && !process.env.CACHE_REDIS_URL && (process.env.CACHE_REDIS_URL = _.cacheRedisUrl), _?.cacheRedisDriver && !process.env.CACHE_REDIS_DRIVER && (process.env.CACHE_REDIS_DRIVER = _.cacheRedisDriver), _?.cacheKeyPrefix && !process.env.CACHE_KEY_PREFIX && (process.env.CACHE_KEY_PREFIX = _.cacheKeyPrefix);
+	let { service: wt, invalidationBus: Et, snapshotCache: Dt, cache: kt, semantic: jt, evictSource: Mt, backend: Nt, stats: Pt, dispose: Rt } = await se({
+		env: process.env,
+		semantic: _?.cacheSemantic ?? !1
+	});
+	jt !== void 0 && $.info("semantic cache enabled — reactive eviction on live writes"), $.info(`cache backend resolved: ${Nt}` + (Nt === "redis" ? ` (driver ${process.env.CACHE_REDIS_DRIVER ?? "resp"})` : " — in-process, not cross-instance"));
+	let Bt = (e) => {
+		J.runFork(Et.publish(e));
+	};
+	D.onChange((e) => {
+		if (J.runFork(Et.publish(e.table)), Mt !== void 0) {
+			let t = (e.new ?? e.old)?.id;
+			Mt({
+				table: e.table,
+				op: e.op,
+				...t === void 0 ? {} : { id: t }
+			});
+		}
+	}), _?.kv && !process.env.KV_BACKEND && (process.env.KV_BACKEND = _.kv), _?.kvRedisUrl && !process.env.KV_REDIS_URL && (process.env.KV_REDIS_URL = _.kvRedisUrl), _?.kvKeyPrefix && !process.env.KV_KEY_PREFIX && (process.env.KV_KEY_PREFIX = _.kvKeyPrefix);
+	let { kv: Vt, service: Ht } = await ci({ store: D });
+	an({
+		log: $,
+		max: Cn(),
+		outOfPool: Ne(y, (process.env.CDC ?? "1") !== "0"),
+		readPools: t.replicationSnapshot()?.replicaCount ?? 0,
+		always: !0
+	}), f.mark("store");
+	let Wt = Vr({
+		store: D,
+		sink: at.sink,
+		log: $
+	}), Jt = gt(_?.idempotency, D), Zt = ze({
+		store: D,
+		dialect: y,
+		log: { info: (e) => $.info(e) },
+		...Jt === void 0 ? {} : { idempotencyTtlMs: Jt.ttlMs }
+	}), $t = _?.plugins ?? [], tn = jr(), nn, on;
+	y !== "memory" && (nn = Wi.make((await xn(y)).makeSqlLayer(A()).pipe(Y.provideMerge(ar({})))), on = await nn.runPromise(Gi.SqlClient));
+	let _n = [
+		"postgres",
+		"mariadb",
+		"mysql",
+		"mssql"
+	].includes(y) ? ii(D, tn, $) : Pi, bn = g(_?.scheduling), Un = di({
+		maxIdleIntervalMs: bn.pollCeilingMs,
+		coordinator: _n,
+		replicaId: tn,
+		log: $
+	}), qn = [], Zn = jr(), Qn = la(_?.plugins ?? [])?.broadcast?.provider, $n = en(_?.plugins, _?.name ?? er(p));
+	{
+		let e = Kt(_?.plugins, _?.name ?? er(p));
+		e !== void 0 && $.warn(e);
+	}
+	let N = Qt(_?.plugins, {
+		instanceId: Zn,
+		namespace: $n,
+		meta: { mode: "serve" },
+		logger: $
+	}), nr = Mr();
+	Nr(`${nr.host}:${he}`, nr.declared);
+	let or = cn(), F = Jo(_?.inspect), I = He({
+		store: D,
+		members: () => N.membership?.list() ?? []
+	}), sr = () => {
+		let e = N.membership?.list().length;
+		return typeof e == "number" && e > 0 ? { fleetSize: e } : {};
+	}, cr = Hn({
+		mode: "serve",
+		dialect: y,
+		...Qn === void 0 ? {} : { provider: Qn },
+		logger: $
+	});
+	G(async () => {
+		await cr.stop();
+	}), Xt(_?.reactive), m(_);
+	let lr = T(D, {
+		claimedBy: Ar(),
+		onError: (e) => $.warn("change claim failed — the claimed effect is being SKIPPED, not duplicated", { cause: String(e) })
+	}), L = {
+		...on ? { sql: on } : {},
+		instanceId: Zn,
+		membership: N.membership,
+		...Qn === void 0 ? {} : { broadcast: Qn },
+		broadcastChannels: { presence: ca($n, "presence") },
+		scheduleCoordinated: (e, t, n) => {
+			let r = Un(e, t, n);
+			return qn.push(r), r;
+		},
+		claimChange: lr.claim
+	};
+	for (let e of $t) e.bindDataStore?.(St, L);
+	Ce({
+		store: D,
+		...be(),
+		log: $
+	});
+	let ur = $t.filter((e) => typeof e.onChangeEvent == "function");
+	if (ur.length > 0) {
+		let e = D.changeScope ?? "local";
+		D.onChange((t) => {
+			let n = me(t, e);
+			for (let e of ur) J.runFork(e.onChangeEvent(n).pipe(J.catchAllCause((t) => J.sync(() => $.warn(`plugin ${e.name} onChangeEvent failed`, { error: Ui.pretty(t) })))));
+		});
+	}
+	let dr = x.filter((e) => In.test(e));
+	dr.length > 0 && (await yt(dr, $), $.info(`queue: ${dr.length} consumer file(s) loaded`));
+	let fr = zt({
+		plugins: $t,
+		appName: _?.name ?? "voltro-api",
+		appType: "api",
+		voltroVersion: kr() ?? "unknown",
+		log: $
+	});
+	$t.length && await fr.activate(), f.mark("plugins");
+	let pr = await fr.gatherObservability(), mr = P({ scope: "voltro:broadcast" }), hr = {
+		info: (e, t) => {
+			mr.info(e, t);
+		},
+		warn: (e, t) => {
+			mr.warn(e, t);
+		},
+		debug: () => {}
+	};
+	F.logs.on && (un(new pn(F.logs.size)), G(ln(or)), hr.info("inspect: serving /_voltro/inspect/logs", { ring: F.logs.size }));
+	let gr;
+	F.traces.on && (ee(new Me(F.traces.size)), gr = ui(pt({ buffer: rn() })), hr.info("inspect: serving /_voltro/inspect/traces", { ring: F.traces.size }));
+	let R, _r = bt({
+		store: D,
+		dispatcher: () => R,
+		invalidateTable: () => Bt,
+		log: hr
+	}), vr = await ht(D, _, y, $n, hr, _r.onBroadcastGap), z = _?.apiKeys, yr = (typeof z == "object" ? z.prefix : void 0) ?? "voltro_", B = z ? Xr(D) : void 0, br = B ? oi({ flush: si(B) }) : void 0;
+	br && G(() => br.shutdown());
+	let Sr = B ? ai(B, {
+		prefix: yr,
+		...br ? { usage: br } : {}
+	}) : void 0, wr = Sr ? [$r(Sr, { prefix: yr })] : [], Tr = vt([..._?.auth?.strategies ?? [], ...wr], ga(_?.plugins ?? []), _?.auth?.anonymousTenantRequired ?? !1, _?.auth, () => St), V = [..._?.restRoutes ?? [], ...Sr ? Br(Sr, (typeof z == "object" ? z.managementPath : void 0) ?? "/v1/api-keys") : []], Dr = $t.map((e) => e.services).filter((e) => e !== void 0), Fr = Y.mergeAll(qt({
+		analyticsLayer: at.layer,
+		cacheService: wt,
+		kvService: Ht,
+		...jt === void 0 ? {} : { semanticCache: jt },
+		pluginServices: Dr,
+		userLayers: _?.layers ?? []
+	}), $e(_?.http ?? {})), H = await At({
+		files: x,
+		store: D,
+		log: $,
+		seedPolicy: "report",
+		seedPattern: Fn,
+		loadSeedFiles: Tn,
+		startupPattern: Vn,
+		loadStartupFiles: a,
+		runStartups: o,
+		emailPattern: _t,
+		loadEmailFiles: mt,
+		registerEmailTemplates: _a
+	});
+	(H.startupCount > 0 || H.emailCount > 0) && $.info("boot lifecycle", {
+		startups: H.startupCount,
+		emailTemplates: H.emailCount
+	}), H.startups !== void 0 && G(async () => {
+		await H.startups.stop();
+	}), de({
+		demands: ve(Ve),
+		isRegistered: (e) => ei(e) !== void 0
+	});
+	let Ir = ft({
+		schedules: It({
+			schedules: S.schedules,
+			seeds: H.seeds,
+			store: D,
+			log: $.child("seeds")
+		}),
+		workflows: S.workflows ?? [],
+		log: $.child("workflow-schedules")
+	}), Lr = _?.scheduling ?? {}, Rr = Lr.trigger ?? "self", zr = /* @__PURE__ */ new Set([
+		"postgres",
+		"mysql",
+		"mariadb",
+		"mssql"
+	]), Hr = Lr.coordination ?? (zr.has(y) ? "advisoryLock" : "single"), Ur = Hr === "cluster" && zr.has(y), Wr = Ur ? "cluster" : Hr === "advisoryLock" && zr.has(y) ? "advisoryLock" : "single";
+	Hr === "cluster" && !Ur && $.warn("scheduling.coordination=cluster needs a sql-backed store except sqlite — falling back to single"), Hr === "advisoryLock" && !zr.has(y) && $.warn("scheduling.coordination=advisoryLock needs a SQL store (the claim-row gate) — falling back to single");
+	let Gr, U = S.workflows.length > 0 || S.workflowWorkers.length > 0 || S.eventTriggers.length > 0 || (Xe?.outgoing.length ?? 0) > 0 || Ur, Kr;
+	if (U) {
+		if (y === "mssql") {
+			let e = await Gn(process.cwd());
+			e && $.warn(e);
+		}
+		let [{ WorkflowEngine: e }, { makeClusterCronLayer: t, workflowEngineLayer: n, resolveRunnerStorage: r, resolveFailoverTuning: i }] = await Promise.all([import("@effect/workflow"), import("@voltro/workflow/cluster")]), a = Ur ? Ir.filter((e) => (e.trigger ?? Rr) === "self").map((e) => t({
+			name: e.name,
+			cron: Yr(e),
+			execute: async () => {
+				await Gr?.fireFromCluster(e.name);
+			}
+		})) : [];
+		Kr = y === "memory" ? e.layerMemory : await (async () => {
+			let e = await xn(y), t = r({ sqliteFamily: e.id === "sqlite" || e.id === "turso" });
+			return $.info(`workflow engine: cluster-${t}, dialect=${e.id}` + (t === "memory" ? " — single-process durable replay, no cross-pod shard handoff" + (e.id !== "sqlite" && e.id !== "turso" ? " (VOLTRO_WORKFLOW_RUNNER_STORAGE=memory: SqlRunnerStorage/cluster_runners + GET_LOCK skipped)" : "") : "")), n({
+				sqlClientLayer: e.makeSqlLayer(A()),
+				runnerStorage: t,
+				dialectId: e.id,
+				...process.env.VOLTRO_WORKFLOW_RUNNER_PORT ? { runnerListenPort: Number(process.env.VOLTRO_WORKFLOW_RUNNER_PORT) } : {},
+				...i(),
+				...a.length > 0 ? { extraShardingLayers: a } : {}
+			});
+		})();
+	}
+	let W = Ut($t, Wn()), qr = x.filter((e) => /\.subscribe\.tsx?$/.test(e)), Jr = qr.length > 0 ? await ot(qr, $) : [], ti = x.filter((e) => /\.reaction\.tsx?$/.test(e)), ni = ti.length > 0 ? await Ge(ti, $) : [], ri = x.filter((e) => Ln.test(e)), li = ri.length > 0 ? await nt(ri, $) : [], fi = x.filter((e) => /\.aggregate\.tsx?$/.test(e)), pi = fi.length > 0 ? await ge(fi, $) : [];
+	{
+		let e = Qr(Ri(ce({ aggregates: pi.map((e) => e.definition) }), v(w)));
+		e !== void 0 && $.warn(e);
+	}
+	let mi = b();
+	if (pi.length > 0 && y !== "memory") try {
+		let e = (await xn(y)).makeSqlLayer(A());
+		mi = Pe(e);
+	} catch (e) {
+		$.warn("aggregate: SQL storage init failed — falling back to in-process", { err: String(e) });
+	}
+	let hi = y === "memory" ? Pi : ii(D, `aggregate@${process.pid}`, $), gi = x.filter((e) => Rn.test(e)), _i = gi.length > 0 ? await Se(gi, $) : [], vi = x.filter((e) => zn.test(e)), yi = vi.length > 0 ? await Ct(vi, $) : [], bi = x.filter((e) => Bn.test(e)), Si = bi.length > 0 ? await Te(bi, $) : [], Ci = [], wi = [], Ti = x.filter((e) => Dn.test(e));
+	if (Ti.length > 0) {
+		let e = $.child("agent"), t = x.filter((e) => An.test(e));
+		t.length > 0 && await On(t, e);
+		let n = await kn(Ti, e);
+		for (let e of n.agents) for (let t of Gt(e)) (t.kind === "action" ? Ci : wi).push({
+			file: t.file,
+			descriptor: t.descriptor,
+			executor: t.executor
+		});
+		n.agents.length > 0 && e.info("synthesized agent routes", { agents: n.agents.map((e) => e.descriptor.name) });
+	}
+	f.mark("workflow");
+	let K = () => {
+		let e = q.workflowWriteActions();
+		if (e === void 0) throw Error("workflow actions: this app registers no workflows");
+		return e;
+	}, Ei = Cr({
+		dialect: y,
+		...A()
+	}), Di = y === "memory" ? void 0 : (await xn(y)).makeSqlLayer(A()), Oi = async () => E({
+		sqlLayer: Di,
+		declared: w,
+		log: $
+	}), Ai = {
+		kind: "api",
+		meta: {
+			name: _?.name ?? "voltro-api",
+			voltroVersion: j,
+			port: he,
+			mode: Or(),
+			store: y,
+			cdc: Oe ? "on" : "off",
+			...Ei === void 0 ? {} : { databaseId: Ei }
+		},
+		rpc: xe(S, p),
+		workflows: we(S, p),
+		migrations: Oi,
+		events: () => q.eventsSnapshot(),
+		agentTools: () => q.agentTools(),
+		invariantChecks: () => ({
+			mode: "serve",
+			accessGate: Ve,
+			config: _,
+			serverOnlyLeaks: S.serverOnlyLeaks,
+			migrations: Oi
+		}),
+		members: () => q.membersSnapshot(),
+		inspectFireSchedule: async ({ name: e, trigger: t }) => {
+			if (!Gr) throw Error("scheduler not started — this app registers no self-triggered schedules (all schedules are trigger:'external', or there are none).");
+			return { runId: await Gr.fireNow(e, t) ?? null };
+		},
+		inspectBackfillSchedule: O({
+			getHandle: () => Gr,
+			getSchedules: () => Ir
+		}),
+		...Xe === void 0 ? {} : { webhooks: () => xt({
+			store: D,
+			discoveredWebhooks: Xe
+		}) },
+		plugins: () => ({
+			plugins: fr.snapshot(),
+			capturedAt: Date.now()
+		}),
+		env: () => mn(_?.name ?? er(p), {
+			..._?.env !== void 0 && aa(_.env) ? { contract: _.env } : {},
+			plugins: _?.plugins ?? []
+		}),
+		dataCache: () => ne({
+			stats: Pt,
+			backendKind: Nt
+		}),
+		subscriptions: () => Yt(() => R),
+		fleetObservations: (e) => I.fleet(e),
+		peerAddress: (e) => I.addressOf(e),
+		inspectTables: () => ue(w),
+		inspectRows: _e({
+			store: D,
+			tables: w,
+			mask: !0
+		}),
+		metrics: (e) => q.rpcMetrics().snapshot(e),
+		cluster: () => Fe({
+			store: D,
+			dialect: y,
+			useClusterCron: Ur,
+			scheduleCoordChoice: Hr
+		}),
+		inspectSchedules: () => Ee({
+			schedules: Ir,
+			defaultTrigger: Rr,
+			coordination: Wr
+		}),
+		inspectScheduleRuns: (e) => ie(D, e),
+		...oe(D, {
+			controls: re(S.workflows ?? []),
+			active: (S.workflows?.length ?? 0) > 0,
+			cancellation: () => q.flowControlHealth()
+		}),
+		webhookActions: Re(() => q.webhooksService()),
+		inspectStartWorkflow: (e) => K().inspectStartWorkflow(e),
+		inspectCancelWorkflowRun: (e) => K().inspectCancelWorkflowRun(e),
+		inspectSuspendWorkflowRun: (e) => K().inspectSuspendWorkflowRun(e),
+		inspectResumeWorkflowRun: (e) => K().inspectResumeWorkflowRun(e),
+		inspectDiscardWorkflowRun: (e) => K().inspectDiscardWorkflowRun(e),
+		inspectRetryWorkflowRun: (e) => K().inspectRetryWorkflowRun(e),
+		inspectSignalWorkflowRun: (e) => K().inspectSignalWorkflowRun(e),
+		inspectUpdateWorkflowRun: (e) => K().inspectUpdateWorkflowRun(e),
+		inspectInferences: (e) => M({
+			store: D,
+			active: (S.workflows?.length ?? 0) > 0,
+			dispatcher: () => q.inferenceHealth()
+		}, e.limit === void 0 ? {} : { limit: e.limit }),
+		...Le({
+			store: D,
+			cancelRun: async (e) => await q.runCanceller()?.(e) ?? !1,
+			retryRun: async (e) => K().inspectRetryWorkflowRun({ runId: e }),
+			redriveRun: async (e) => q.redriveWorkflowRun({ runId: e }),
+			log: $
+		}),
+		inspectRedriveWorkflowRun: (e) => q.redriveWorkflowRun(e),
+		inspectResumeWorkflowRunFromStep: (e) => q.resumeWorkflowRunFromStep(e)
+	}, Mi = (process.env.VOLTRO_TENANT_ISOLATION ?? _?.tenancy?.isolation) === "namespace", Ni = Mi && y !== "memory" ? await (async () => {
+		let e = await xn(y);
+		return Ie({
+			tables: w,
+			sqlLayer: e.makeSqlLayer(A()),
+			dialect: y,
+			options: { retryFilter: e.retryFilter },
+			log: {
+				info: (e, t) => $.info(e, t),
+				error: (e, t, n) => $.error(e, t ?? {}, n)
+			}
+		});
+	})() : void 0, Fi = await Qe({
+		input: _?.tenancy?.residency,
+		namespaceIsolationOn: Mi,
+		makeStoreForUrl: (e, t) => tt(_, void 0, Sn(A(), t)),
+		log: {
+			info: (e, t) => $.info(e, t),
+			warn: (e, t) => $.warn(e, t)
+		}
+	});
+	Fi !== void 0 && G(async () => {
+		await Fi.close();
+	});
+	let q = await Go({
+		bootTiming: f,
+		claimChange: lr.claim,
+		broadcastNamespace: $n,
+		scheduling: (() => {
+			let e = bn;
+			return {
+				admissionDrainMs: e.admissionDrainMs,
+				inferenceTickMs: e.inferenceTickMs,
+				cancelSweepMs: e.cancelSweepMs,
+				stalenessSweepMs: e.stalenessSweepMs,
+				scheduleHeartbeatMs: e.scheduleHeartbeatMs,
+				disarmWhenIdle: Be({
+					changeScope: D.changeScope,
+					broadcastAttached: vr !== void 0
+				})
+			};
+		})(),
+		..._?.workflows?.staleness === void 0 ? {} : { workflowStaleness: _.workflows.staleness },
+		..._?.workflows?.suspendSignalHintMs === void 0 ? {} : { workflowSuspendSignalHintMs: _.workflows.suspendSignalHintMs },
+		workflowRecording: ae(_?.workflows?.recording),
+		membership: {
+			...N,
+			instanceId: Zn
+		},
+		security: {
+			defaultDeny: Ye(_),
+			...Ue(_)
+		},
+		approvals: { defaultExpiryMs: C(_) },
+		..._?.plugins === void 0 ? {} : { plugins: _.plugins },
+		...Jt ? { idempotency: Jt } : {},
+		restRoutes: V,
+		..._?.grpc === void 0 ? {} : { grpc: {
+			config: _.grpc,
+			root: p
+		} },
+		appProcedures: Ve,
+		discovered: {
+			wsGateways: S.wsGateways,
+			queries: [...S.queries, ...wi],
+			mutations: S.mutations,
+			actions: [...S.actions, ...Ci],
+			streams: S.streams,
+			events: S.events,
+			workflows: S.workflows,
+			workflowWorkers: S.workflowWorkers,
+			eventTriggers: S.eventTriggers,
+			schedules: Ir,
+			subscribers: Jr,
+			outboxHandlers: li,
+			connections: S.connections,
+			reactions: ni,
+			aggregates: pi,
+			expectations: _i,
+			budgets: yi,
+			experiments: Si,
+			...Xe === void 0 ? {} : { webhooks: Xe }
+		},
+		log: $,
+		analytics: at.sink,
+		aggregateStorage: mi,
+		aggregateCoordinator: hi,
+		store: D,
+		kv: Vt,
+		cache: kt,
+		snapshotCache: Dt,
+		..._?.reactive === void 0 ? {} : { reactive: _.reactive },
+		schemaRegistry: lt,
+		tenantScopedTables: S.tenantScopedTables,
+		softDeleteScopedTables: S.softDeleteScopedTables,
+		dataTransferSnapshot: Ki(w, y),
+		dataTransferDialect: y,
+		...Ni === void 0 ? {} : { ensureTenantProvisioned: Ni.ensure },
+		...Fi === void 0 ? {} : { resolveResidentStore: Fi.resolveStore },
+		tenantIsolation: (process.env.VOLTRO_TENANT_ISOLATION ?? _?.tenancy?.isolation) === "namespace" ? "namespace" : "shared-schema",
+		resolveSubject: (e, t) => Tr({
+			headers: e,
+			clientId: t
+		}),
+		..._?.auth === void 0 ? {} : { authority: _.auth },
+		..._?.agents === void 0 ? {} : { agents: _.agents },
+		httpRoutes: $t.flatMap((e) => e.httpRoutes ?? []),
+		getStore: () => St,
+		...Fr ? { baseLayer: Fr } : {},
+		...Kr === void 0 ? {} : { workflowEngineLayer: Kr },
+		scheduleDefaultTrigger: Rr,
+		scheduleCoordination: Wr,
+		scheduleArmSelf: !Ur,
+		dormancy: process.env.VOLTRO_DORMANCY === "sleep" || process.env.VOLTRO_DORMANCY === "always-on" ? process.env.VOLTRO_DORMANCY : _?.dormancy ?? "always-on",
+		scheduleReplicaId: jr(),
+		...W === void 0 ? {} : { scheduleFireInterceptor: W },
+		onSchedulerReady: (e) => {
+			Gr = e;
+		},
+		inspectStream: pe(or),
+		inspectRoute: { handle: async (e, t, n, r) => F.logs.on && n === "GET" && (e === "/_voltro/inspect/logs" || e.startsWith("/_voltro/inspect/logs?")) ? dn(e, fn(), t) : F.traces.on && n === "GET" && (e === "/_voltro/inspect/traces" || e.startsWith("/_voltro/inspect/traces?")) ? fe(e, rn()) : await d(e, Ai, t, {
+			method: n,
+			...r === void 0 ? {} : { body: r },
+			...sr()
+		}) || ((n === "GET" ? await gn(e, Ai, t, {
+			method: n,
+			...sr()
+		}) : null) ?? hn(e, Ai, t, {
+			method: n,
+			...r === void 0 ? {} : { body: r },
+			...sr()
+		}) ?? {
+			status: 404,
+			contentType: "application/json",
+			body: JSON.stringify({ error: "not an inspect route" })
+		}) },
+		..._?.name === void 0 ? {} : { appName: _.name },
+		observability: pr,
+		..._?.health === void 0 ? {} : { health: _.health },
+		...gr === void 0 ? {} : { traceSink: gr },
+		port: he,
+		..._?.transport?.wsPath ? { path: _.transport.wsPath } : {},
+		..._?.http === void 0 ? {} : { http: _.http }
+	});
+	R = q.dispatcher;
+	let Ii = () => {
+		or.emit("subscriptions", Yt(() => R));
+	}, zi = q.dispatcher.onSubscriptionsChange(Ii);
+	return Ii(), We(te([
+		S.queries,
+		S.mutations,
+		S.actions,
+		S.streams
+	]), (e) => {
+		$.warn(e);
+	}), $.info(`API listening on :${he}`, {
+		dialect: y,
+		queries: S.queries.length,
+		mutations: S.mutations.length,
+		actions: S.actions.length,
+		streams: S.streams.length,
+		workflows: S.workflows.length,
+		workflowWorkers: S.workflowWorkers.length,
+		schedules: Ir.length,
+		scheduleCoordination: Wr
+	}), f.finish($), G(async () => {
+		for (let e of qn) e.stop();
+		Zt.stop(), zi(), I.stop();
+		try {
+			await q.close(), Rt(), nn?.dispose(), await fr.deactivate(), await vr?.close(), await Ft({
+				mirror: Wt,
+				log: $
+			}), await at.dispose(), await D.close?.();
+		} catch (e) {
+			console.error("serve: shutdown step failed, exiting anyway:", e);
+		}
+	}), await new Promise(() => {}), 0;
+};
+//#endregion
+export { Zo as n, Yo as r, Qo as t };