@electric-ax/agents-server 0.4.2 → 0.4.4

package/dist/index.cjs

@@ -57,6 +57,7 @@ __export(schema_exports, {
 	entityDispatchState: () => entityDispatchState,
 	entityManifestSources: () => entityManifestSources,
 	entityTypes: () => entityTypes,
+	runnerRuntimeDiagnostics: () => runnerRuntimeDiagnostics,
 	runners: () => runners,
 	scheduledTasks: () => scheduledTasks,
 	subscriptionWebhooks: () => subscriptionWebhooks,
@@ -125,25 +126,35 @@ const users = (0, drizzle_orm_pg_core.pgTable)(`users`, {
 const runners = (0, drizzle_orm_pg_core.pgTable)(`runners`, {
 	tenantId: (0, drizzle_orm_pg_core.text)(`tenant_id`).notNull().default(`default`),
 	id: (0, drizzle_orm_pg_core.text)(`id`).notNull(),
-	ownerUserId: (0, drizzle_orm_pg_core.text)(`owner_user_id`).notNull(),
+	ownerPrincipal: (0, drizzle_orm_pg_core.text)(`owner_principal`).notNull(),
 	label: (0, drizzle_orm_pg_core.text)(`label`).notNull(),
 	kind: (0, drizzle_orm_pg_core.text)(`kind`).notNull().default(`local`),
 	adminStatus: (0, drizzle_orm_pg_core.text)(`admin_status`).notNull().default(`enabled`),
 	wakeStream: (0, drizzle_orm_pg_core.text)(`wake_stream`).notNull(),
-	wakeStreamOffset: (0, drizzle_orm_pg_core.text)(`wake_stream_offset`),
-	lastSeenAt: (0, drizzle_orm_pg_core.timestamp)(`last_seen_at`, { withTimezone: true }),
-	livenessLeaseExpiresAt: (0, drizzle_orm_pg_core.timestamp)(`liveness_lease_expires_at`, { withTimezone: true }),
 	createdAt: (0, drizzle_orm_pg_core.timestamp)(`created_at`, { withTimezone: true }).notNull().defaultNow(),
 	updatedAt: (0, drizzle_orm_pg_core.timestamp)(`updated_at`, { withTimezone: true }).notNull().defaultNow()
 }, (table) => [
 	(0, drizzle_orm_pg_core.primaryKey)({ columns: [table.tenantId, table.id] }),
 	(0, drizzle_orm_pg_core.unique)(`uq_runners_wake_stream`).on(table.tenantId, table.wakeStream),
-	(0, drizzle_orm_pg_core.index)(`idx_runners_owner_user_id`).on(table.tenantId, table.ownerUserId),
+	(0, drizzle_orm_pg_core.index)(`idx_runners_owner_principal`).on(table.tenantId, table.ownerPrincipal),
 	(0, drizzle_orm_pg_core.index)(`idx_runners_admin_status`).on(table.tenantId, table.adminStatus),
-	(0, drizzle_orm_pg_core.index)(`idx_runners_liveness_lease_expires_at`).on(table.tenantId, table.livenessLeaseExpiresAt),
 	(0, drizzle_orm_pg_core.check)(`chk_runners_kind`, drizzle_orm.sql`${table.kind} IN ('local', 'cloud-worker', 'sandbox', 'ci', 'server')`),
 	(0, drizzle_orm_pg_core.check)(`chk_runners_admin_status`, drizzle_orm.sql`${table.adminStatus} IN ('enabled', 'disabled')`)
 ]);
+const runnerRuntimeDiagnostics = (0, drizzle_orm_pg_core.pgTable)(`runner_runtime_diagnostics`, {
+	tenantId: (0, drizzle_orm_pg_core.text)(`tenant_id`).notNull().default(`default`),
+	runnerId: (0, drizzle_orm_pg_core.text)(`runner_id`).notNull(),
+	ownerPrincipal: (0, drizzle_orm_pg_core.text)(`owner_principal`).notNull(),
+	wakeStreamOffset: (0, drizzle_orm_pg_core.text)(`wake_stream_offset`),
+	lastSeenAt: (0, drizzle_orm_pg_core.timestamp)(`last_seen_at`, { withTimezone: true }).notNull(),
+	livenessLeaseExpiresAt: (0, drizzle_orm_pg_core.timestamp)(`liveness_lease_expires_at`, { withTimezone: true }).notNull(),
+	diagnostics: (0, drizzle_orm_pg_core.jsonb)(`diagnostics`),
+	updatedAt: (0, drizzle_orm_pg_core.timestamp)(`updated_at`, { withTimezone: true }).notNull().defaultNow()
+}, (table) => [
+	(0, drizzle_orm_pg_core.primaryKey)({ columns: [table.tenantId, table.runnerId] }),
+	(0, drizzle_orm_pg_core.index)(`idx_runner_runtime_diagnostics_owner`).on(table.tenantId, table.ownerPrincipal),
+	(0, drizzle_orm_pg_core.index)(`idx_runner_runtime_diagnostics_liveness`).on(table.tenantId, table.livenessLeaseExpiresAt)
+]);
 const entityDispatchState = (0, drizzle_orm_pg_core.pgTable)(`entity_dispatch_state`, {
 	tenantId: (0, drizzle_orm_pg_core.text)(`tenant_id`).notNull().default(`default`),
 	entityUrl: (0, drizzle_orm_pg_core.text)(`entity_url`).notNull(),
@@ -453,7 +464,7 @@ var PostgresRegistry = class {
 		await this.db.insert(runners).values({
 			tenantId: this.tenantId,
 			id: input.id,
-			ownerUserId: input.ownerUserId,
+			ownerPrincipal: input.ownerPrincipal,
 			label: input.label,
 			kind: input.kind ?? `local`,
 			adminStatus: input.adminStatus ?? `enabled`,
@@ -462,7 +473,7 @@ var PostgresRegistry = class {
 		}).onConflictDoUpdate({
 			target: [runners.tenantId, runners.id],
 			set: {
-				ownerUserId: input.ownerUserId,
+				ownerPrincipal: input.ownerPrincipal,
 				label: input.label,
 				kind: input.kind ?? `local`,
 				adminStatus: input.adminStatus ?? `enabled`,
@@ -480,20 +491,46 @@ var PostgresRegistry = class {
 	}
 	async listRunners(filter) {
 		const conditions = [(0, drizzle_orm.eq)(runners.tenantId, this.tenantId)];
-		if (filter?.ownerUserId) conditions.push((0, drizzle_orm.eq)(runners.ownerUserId, filter.ownerUserId));
+		if (filter?.ownerPrincipal) conditions.push((0, drizzle_orm.eq)(runners.ownerPrincipal, filter.ownerPrincipal));
 		const rows = await this.db.select().from(runners).where((0, drizzle_orm.and)(...conditions)).orderBy((0, drizzle_orm.desc)(runners.createdAt));
 		return rows.map((row) => this.rowToRunner(row));
 	}
 	async heartbeatRunner(input) {
 		const now = input.heartbeatAt ?? new Date();
 		const leaseExpiresAt = input.livenessLeaseExpiresAt ?? new Date(now.getTime() + (input.leaseMs ?? DEFAULT_RUNNER_LEASE_MS));
-		const rows = await this.db.update(runners).set({
+		await this.db.insert(runnerRuntimeDiagnostics).values({
+			tenantId: this.tenantId,
+			runnerId: input.runnerId,
+			ownerPrincipal: input.ownerPrincipal,
 			lastSeenAt: now,
 			livenessLeaseExpiresAt: leaseExpiresAt,
-			...input.wakeStreamOffset !== void 0 ? { wakeStreamOffset: input.wakeStreamOffset } : {},
+			wakeStreamOffset: input.wakeStreamOffset,
+			diagnostics: input.diagnostics,
 			updatedAt: now
-		}).where((0, drizzle_orm.and)((0, drizzle_orm.eq)(runners.tenantId, this.tenantId), (0, drizzle_orm.eq)(runners.id, input.runnerId))).returning();
-		return rows[0] ? this.rowToRunner(rows[0]) : null;
+		}).onConflictDoUpdate({
+			target: [runnerRuntimeDiagnostics.tenantId, runnerRuntimeDiagnostics.runnerId],
+			set: {
+				lastSeenAt: now,
+				ownerPrincipal: input.ownerPrincipal,
+				livenessLeaseExpiresAt: leaseExpiresAt,
+				...input.wakeStreamOffset !== void 0 ? { wakeStreamOffset: input.wakeStreamOffset } : {},
+				...input.diagnostics !== void 0 ? { diagnostics: input.diagnostics } : {},
+				updatedAt: now
+			}
+		});
+		const runner = await this.getRunner(input.runnerId);
+		if (!runner) return null;
+		return {
+			...runner,
+			last_seen_at: now.toISOString(),
+			liveness_lease_expires_at: leaseExpiresAt.toISOString(),
+			...input.wakeStreamOffset !== void 0 ? { wake_stream_offset: input.wakeStreamOffset } : {},
+			...input.diagnostics !== void 0 ? { diagnostics: input.diagnostics } : {}
+		};
+	}
+	async getRunnerDiagnostics(runnerId) {
+		const rows = await this.db.select().from(runnerRuntimeDiagnostics).where((0, drizzle_orm.and)((0, drizzle_orm.eq)(runnerRuntimeDiagnostics.tenantId, this.tenantId), (0, drizzle_orm.eq)(runnerRuntimeDiagnostics.runnerId, runnerId))).limit(1);
+		return rows[0] ? this.rowToRunnerRuntimeDiagnostics(rows[0]) : null;
 	}
 	async setRunnerAdminStatus(runnerId, adminStatus) {
 		const rows = await this.db.update(runners).set({
@@ -588,6 +625,27 @@ var PostgresRegistry = class {
 		}).where((0, drizzle_orm.and)((0, drizzle_orm.eq)(entityDispatchState.tenantId, this.tenantId), (0, drizzle_orm.eq)(entityDispatchState.entityUrl, claim.entity_url), (0, drizzle_orm.eq)(entityDispatchState.activeConsumerId, input.consumerId), (0, drizzle_orm.eq)(entityDispatchState.activeEpoch, input.epoch)));
 		return claim;
 	}
+	async getActiveClaimsForRunner(runnerId) {
+		const rows = await this.db.select().from(consumerClaims).where((0, drizzle_orm.and)((0, drizzle_orm.eq)(consumerClaims.tenantId, this.tenantId), (0, drizzle_orm.eq)(consumerClaims.runnerId, runnerId), (0, drizzle_orm.eq)(consumerClaims.status, `active`)));
+		return rows.map((row) => this.rowToConsumerClaim(row));
+	}
+	async getDispatchStatsForRunner(runnerId) {
+		const rows = await this.db.select().from(entityDispatchState).where((0, drizzle_orm.and)((0, drizzle_orm.eq)(entityDispatchState.tenantId, this.tenantId), (0, drizzle_orm.eq)(entityDispatchState.activeRunnerId, runnerId)));
+		let activeClaim = 0;
+		let outstandingWake = 0;
+		let pendingWork = 0;
+		for (const row of rows) {
+			if (row.activeConsumerId) activeClaim++;
+			if (row.outstandingWakeId && !row.activeConsumerId) outstandingWake++;
+			const pending = row.pendingSourceStreams;
+			if (pending && pending.length > 0) pendingWork++;
+		}
+		return {
+			entities_with_active_claim: activeClaim,
+			entities_with_outstanding_wake: outstandingWake,
+			entities_with_pending_work: pendingWork
+		};
+	}
 	entityTypeWhere(name) {
 		return (0, drizzle_orm.and)((0, drizzle_orm.eq)(entityTypes.tenantId, this.tenantId), (0, drizzle_orm.eq)(entityTypes.name, name));
 	}
@@ -1053,23 +1111,28 @@ var PostgresRegistry = class {
 		};
 	}
 	rowToRunner(row) {
-		const now = Date.now();
-		const livenessExpiry = row.livenessLeaseExpiresAt?.getTime();
 		return {
 			id: row.id,
-			owner_user_id: row.ownerUserId,
+			owner_principal: row.ownerPrincipal,
 			label: row.label,
 			kind: assertRunnerKind(row.kind),
 			admin_status: assertRunnerAdminStatus(row.adminStatus),
-			liveness: livenessExpiry !== void 0 && livenessExpiry > now ? `online` : `offline`,
-			last_seen_at: row.lastSeenAt?.toISOString(),
-			liveness_lease_expires_at: row.livenessLeaseExpiresAt?.toISOString(),
 			wake_stream: row.wakeStream,
-			wake_stream_offset: row.wakeStreamOffset ?? void 0,
 			created_at: row.createdAt.toISOString(),
 			updated_at: row.updatedAt.toISOString()
 		};
 	}
+	rowToRunnerRuntimeDiagnostics(row) {
+		return {
+			runner_id: row.runnerId,
+			owner_principal: row.ownerPrincipal,
+			wake_stream_offset: row.wakeStreamOffset ?? void 0,
+			last_seen_at: row.lastSeenAt.toISOString(),
+			liveness_lease_expires_at: row.livenessLeaseExpiresAt.toISOString(),
+			diagnostics: row.diagnostics ?? void 0,
+			updated_at: row.updatedAt.toISOString()
+		};
+	}
 	rowToConsumerClaim(row) {
 		return {
 			consumer_id: row.consumerId,
@@ -1741,140 +1804,693 @@ function parseDispatchPolicy(value, label = `dispatch_policy`) {
 }
 
 //#endregion
-//#region src/utils/webhook-url.ts
-function rewriteLoopbackWebhookUrl(value) {
-	if (!value) return void 0;
-	const rewriteTarget = process.env.ELECTRIC_AGENTS_REWRITE_LOOPBACK_WEBHOOKS_TO?.trim();
-	if (!rewriteTarget) return value;
-	const url = new URL(value);
-	if (!isLoopbackHostname(url.hostname)) return value;
-	if (rewriteTarget.includes(`://`)) {
-		const target = new URL(rewriteTarget);
-		url.protocol = target.protocol;
-		url.username = target.username;
-		url.password = target.password;
-		url.hostname = target.hostname;
-		url.port = target.port;
-		return url.toString();
-	}
-	url.host = rewriteTarget;
-	return url.toString();
+//#region src/tracing.ts
+const tracer = __opentelemetry_api.trace.getTracer(`agent-server`);
+const ATTR = {
+	ENTITY_URL: `electric_agents.entity.url`,
+	ENTITY_TYPE: `electric_agents.entity.type`,
+	PARENT_URL: `electric_agents.entity.parent`,
+	WAKE_SOURCE: `electric_agents.wake.source`,
+	WAKE_SUBSCRIBER: `electric_agents.wake.subscriber`,
+	WAKE_KIND: `electric_agents.wake.kind`,
+	STREAM_PATH: `electric_agents.stream.path`,
+	STREAM_OP: `electric_agents.stream.op`,
+	DB_OP: `electric_agents.db.op`,
+	HTTP_METHOD: `http.method`,
+	HTTP_ROUTE: `http.route`,
+	HTTP_STATUS: `http.status_code`
+};
+/**
+* Run `fn` inside an active span. Errors are recorded + status set to ERROR,
+* then re-thrown. Span ends in a finally block.
+*/
+async function withSpan(name, fn, opts) {
+	return await tracer.startActiveSpan(name, opts ?? {}, async (span) => {
+		try {
+			return await fn(span);
+		} catch (err) {
+			span.recordException(err);
+			span.setStatus({
+				code: __opentelemetry_api.SpanStatusCode.ERROR,
+				message: err instanceof Error ? err.message : String(err)
+			});
+			throw err;
+		} finally {
+			span.end();
+		}
+	});
 }
-function isLoopbackHostname(hostname) {
-	return hostname === `localhost` || hostname === `127.0.0.1` || hostname === `::1`;
+function injectTraceHeaders(headers, ctx = __opentelemetry_api.context.active()) {
+	__opentelemetry_api.propagation.inject(ctx, headers);
+}
+function extractTraceContext(headers) {
+	return __opentelemetry_api.propagation.extract(__opentelemetry_api.context.active(), headers);
 }
 
 //#endregion
-//#region src/routing/dispatch-policy.ts
-function subscriptionIdForDispatchTarget(target) {
-	if (target.subscription_id) return target.subscription_id;
-	if (target.type === `runner`) return `runner:${target.runnerId}`;
-	const digest = (0, node_crypto.createHash)(`sha256`).update(target.url).digest(`hex`);
-	return `webhook:${digest.slice(0, 16)}`;
-}
-function subscriptionIdForEntityDispatchTarget(target, entityUrl) {
-	const base = subscriptionIdForDispatchTarget(target);
-	if (!target.subscription_id) return base;
-	const digest = (0, node_crypto.createHash)(`sha256`).update(entityUrl).digest(`hex`);
-	return `${base}:${digest.slice(0, 16)}`;
-}
-async function resolveEffectiveDispatchPolicyForSpawn(ctx, typeName, opts) {
-	if (opts.dispatchPolicy) return opts.dispatchPolicy;
-	const entityType = await ctx.entityManager.registry.getEntityType(typeName);
-	if (opts.parent) {
-		const parent = await ctx.entityManager.registry.getEntity(opts.parent);
-		if (parent?.dispatch_policy) return applyTypeDefaultSubscriptionScope(parent.dispatch_policy, entityType?.default_dispatch_policy);
+//#region src/stream-client.ts
+var DurableStreamsSubscriptionError = class extends Error {
+	code;
+	errorMessage;
+	constructor(message, status$4, body) {
+		super(`${message}: ${status$4} ${body}`);
+		this.status = status$4;
+		this.body = body;
+		this.name = `DurableStreamsSubscriptionError`;
+		try {
+			const parsed = JSON.parse(body);
+			if (typeof parsed.error?.code === `string`) this.code = parsed.error.code;
+			if (typeof parsed.error?.message === `string`) this.errorMessage = parsed.error.message;
+		} catch {}
 	}
-	return entityType?.default_dispatch_policy;
+};
+async function resolveDurableStreamsBearer(bearer) {
+	if (!bearer) return void 0;
+	const value = typeof bearer === `function` ? await bearer() : bearer;
+	const trimmed = value.trim();
+	if (!trimmed) return void 0;
+	return /^Bearer\s+/i.test(trimmed) ? trimmed : `Bearer ${trimmed}`;
 }
-async function resolveEffectiveDispatchPolicyForEntity(ctx, entity) {
-	if (entity.dispatch_policy) return entity.dispatch_policy;
-	const entityType = await ctx.entityManager.registry.getEntityType(entity.type);
-	return entityType?.default_dispatch_policy;
+async function applyDurableStreamsBearer(headers, bearer, opts = {}) {
+	if (!bearer) return;
+	if (!opts.overwrite && headers.has(`authorization`)) return;
+	const value = await resolveDurableStreamsBearer(bearer);
+	if (value) headers.set(`authorization`, value);
 }
-async function backfillEntityDispatchPolicy(ctx, entity) {
-	if (entity.dispatch_policy) return entity;
-	const dispatchPolicy = await resolveEffectiveDispatchPolicyForEntity(ctx, entity);
-	if (!dispatchPolicy) return entity;
-	return await ctx.entityManager.registry.updateEntityDispatchPolicy(entity.url, dispatchPolicy) ?? {
-		...entity,
-		dispatch_policy: dispatchPolicy
-	};
+function appendPathToBaseUrl(baseUrl, path$2) {
+	const url = new URL(baseUrl);
+	const basePath = url.pathname.replace(/\/+$/, ``);
+	const childPath = path$2.replace(/^\/+/, ``);
+	url.pathname = childPath ? `${basePath === `/` ? `` : basePath}/${childPath}` : basePath || `/`;
+	return url.toString().replace(/\/+$/, ``);
 }
-function applyTypeDefaultSubscriptionScope(policy, typeDefault) {
-	const target = policy.targets[0];
-	const defaultTarget = typeDefault?.targets[0];
-	if (!target || !defaultTarget?.subscription_id) return policy;
-	if (!sameDispatchDestination(target, defaultTarget)) return policy;
-	if (target.subscription_id === defaultTarget.subscription_id) return policy;
-	return { targets: [{
-		...target,
-		subscription_id: defaultTarget.subscription_id
-	}] };
+function durableStreamsBearerHeaders(bearer) {
+	if (!bearer) return void 0;
+	return { authorization: async () => await resolveDurableStreamsBearer(bearer) ?? `` };
 }
-function sameDispatchDestination(a, b) {
-	if (a.type !== b.type) return false;
-	if (a.type === `runner` && b.type === `runner`) return a.runnerId === b.runnerId;
-	if (a.type === `webhook` && b.type === `webhook`) return a.url === b.url;
-	return false;
+function isNotFoundError(err) {
+	return err instanceof __durable_streams_client.DurableStreamError && err.code === ErrCodeNotFound || err instanceof __durable_streams_client.FetchError && err.status === 404;
 }
-async function assertDispatchPolicyAllowed(ctx, policy) {
-	const target = policy?.targets[0];
-	if (!target || target.type !== `runner`) return;
-	const runner = await ctx.entityManager.registry.getRunner(target.runnerId);
-	if (!runner) throw new ElectricAgentsError(ErrCodeNotFound, `Runner "${target.runnerId}" not found`, 404);
-	if (ctx.principal && runner.owner_user_id !== ctx.principal.key) throw new ElectricAgentsError(ErrCodeUnauthorized, `Runner dispatch requires the authenticated owner`, 403);
+function isAbortLikeError(err) {
+	return err instanceof Error && (err.name === `AbortError` || err.message === `Stream request was aborted`);
 }
-async function linkEntityDispatchSubscription(ctx, entity) {
-	const dispatchPolicy = await resolveEffectiveDispatchPolicyForEntity(ctx, entity);
-	const target = dispatchPolicy?.targets[0];
-	if (!target) return;
-	await linkStreamToTargetSubscription(ctx, target, entity);
+function normalizeSubscriptionPattern(pattern) {
+	return pattern.replace(/^\/+/, ``);
 }
-async function unlinkEntityDispatchSubscription(ctx, entity) {
-	const dispatchPolicy = await resolveEffectiveDispatchPolicyForEntity(ctx, entity);
-	const target = dispatchPolicy?.targets[0];
-	if (!target) return;
-	const subscriptionId = subscriptionIdForEntityDispatchTarget(target, entity.url);
-	await ctx.streamClient.removeSubscriptionStream(subscriptionId, entity.streams.main).catch((err) => {
-		serverLog.warn(`[dispatch-policy] failed to remove stream from subscription`, {
-			subscriptionId,
-			stream: entity.streams.main
-		}, err);
-	});
+function normalizeSubscriptionStreamPath(path$2) {
+	return path$2.replace(/^\/+/, ``);
 }
-async function linkStreamToTargetSubscription(ctx, target, entity) {
-	const streamPath = entity.streams.main;
-	const subscriptionId = subscriptionIdForEntityDispatchTarget(target, entity.url);
-	const existing = await ctx.streamClient.getSubscription(subscriptionId);
-	if (target.type === `runner`) {
-		const runner = await ctx.entityManager.registry.getRunner(target.runnerId);
-		if (!runner) throw new ElectricAgentsError(ErrCodeNotFound, `Runner "${target.runnerId}" not found`, 404);
-		const wakeStream = runner.wake_stream || runnerWakeStream(target.runnerId);
-		await ctx.streamClient.ensure(wakeStream, { contentType: `application/json` });
-		if (!existing) {
-			await ctx.streamClient.putSubscription(subscriptionId, {
-				type: `pull-wake`,
-				streams: [streamPath],
-				wake_stream: wakeStream,
-				description: `Electric Agents runner ${target.runnerId}`
+function normalizeSubscriptionPath(path$2) {
+	return path$2.replace(/^\/+/, ``).replace(/\/+$/, ``);
+}
+var StreamClient = class {
+	constructor(baseUrl, options = {}) {
+		this.baseUrl = baseUrl;
+		this.options = options;
+	}
+	streamUrl(path$2) {
+		return appendPathToBaseUrl(this.baseUrl, path$2);
+	}
+	streamHeaders() {
+		return durableStreamsBearerHeaders(this.options.bearer);
+	}
+	async requestHeaders(init, opts = {}) {
+		const headers = new Headers(init);
+		await applyDurableStreamsBearer(headers, this.options.bearer, { overwrite: opts.overwriteBearer });
+		return headers;
+	}
+	backendSubscriptionPath(path$2) {
+		return normalizeSubscriptionPath(path$2);
+	}
+	runtimeSubscriptionPath(path$2) {
+		return normalizeSubscriptionPath(path$2);
+	}
+	subscriptionUrl(subscriptionId) {
+		return appendPathToBaseUrl(this.baseUrl, `/__ds/subscriptions/${encodeURIComponent(subscriptionId)}`);
+	}
+	subscriptionChildUrl(subscriptionId, ...segments) {
+		const url = new URL(this.subscriptionUrl(subscriptionId));
+		url.pathname = `${url.pathname.replace(/\/+$/, ``)}/${segments.map((segment) => encodeURIComponent(segment)).join(`/`)}`;
+		return url.toString();
+	}
+	async create(path$2, opts) {
+		return await withSpan(`stream.create`, async (span) => {
+			span.setAttributes({
+				[ATTR.STREAM_PATH]: path$2,
+				[ATTR.STREAM_OP]: `create`
 			});
-			return;
-		}
-		await ctx.streamClient.addSubscriptionStreams(subscriptionId, [streamPath]);
-		return;
+			await __durable_streams_client.DurableStream.create({
+				url: this.streamUrl(path$2),
+				headers: this.streamHeaders(),
+				contentType: opts.contentType,
+				body: opts.body
+			});
+		});
 	}
-	const webhookUrl = rewriteLoopbackWebhookUrl(target.url);
-	if (!webhookUrl) throw new ElectricAgentsError(ErrCodeInvalidRequest, `Webhook dispatch target must include a valid URL`, 400);
-	const forwardUrl = (0, __electric_ax_agents_runtime.appendPathToUrl)(ctx.publicUrl, `/_electric/webhook-forward/${encodeURIComponent(subscriptionId)}`);
-	if (!existing) await ctx.streamClient.putSubscription(subscriptionId, {
-		type: `webhook`,
-		streams: [streamPath],
-		webhook: { url: forwardUrl },
-		description: `Electric Agents webhook ${subscriptionId}`
-	});
-	else await ctx.streamClient.addSubscriptionStreams(subscriptionId, [streamPath]);
-	await ctx.pgDb.insert(subscriptionWebhooks).values({
+	async fork(path$2, sourcePath) {
+		return await withSpan(`stream.fork`, async (span) => {
+			span.setAttributes({
+				[ATTR.STREAM_PATH]: path$2,
+				[ATTR.STREAM_OP]: `fork`
+			});
+			const headers = {
+				"content-type": `application/json`,
+				"Stream-Forked-From": new URL(this.streamUrl(sourcePath)).pathname
+			};
+			injectTraceHeaders(headers);
+			const response = await fetch(this.streamUrl(path$2), {
+				method: `PUT`,
+				headers: await this.requestHeaders(headers)
+			});
+			if (response.ok) return;
+			throw new Error(`Stream fork failed: ${response.status} ${await response.text()}`);
+		});
+	}
+	async append(path$2, data, opts) {
+		return await withSpan(`stream.append`, async (span) => {
+			span.setAttributes({
+				[ATTR.STREAM_PATH]: path$2,
+				[ATTR.STREAM_OP]: opts?.close ? `append+close` : `append`
+			});
+			const handle = new __durable_streams_client.DurableStream({
+				url: this.streamUrl(path$2),
+				headers: this.streamHeaders(),
+				contentType: `application/json`,
+				batching: false
+			});
+			if (opts?.close) {
+				const result = await handle.close({ body: data });
+				return { offset: result.finalOffset };
+			}
+			await handle.append(data);
+			const head = await handle.head();
+			return { offset: head.exists && head.offset || `` };
+		});
+	}
+	async appendIdempotent(path$2, data, opts) {
+		return await withSpan(`stream.appendIdempotent`, async (span) => {
+			span.setAttributes({
+				[ATTR.STREAM_PATH]: path$2,
+				[ATTR.STREAM_OP]: `appendIdempotent`
+			});
+			const stream = new __durable_streams_client.DurableStream({
+				url: this.streamUrl(path$2),
+				headers: this.streamHeaders(),
+				contentType: `application/json`
+			});
+			const producer = new __durable_streams_client.IdempotentProducer(stream, opts.producerId, { epoch: opts.epoch ?? 0 });
+			try {
+				producer.append(data);
+				await producer.flush();
+			} finally {
+				await producer.detach();
+			}
+		});
+	}
+	async appendWithProducerHeaders(path$2, data, opts) {
+		return await withSpan(`stream.appendWithProducerHeaders`, async (span) => {
+			span.setAttributes({
+				[ATTR.STREAM_PATH]: path$2,
+				[ATTR.STREAM_OP]: `appendWithProducerHeaders`
+			});
+			const headers = {
+				"content-type": `application/json`,
+				"Producer-Id": opts.producerId,
+				"Producer-Epoch": String(opts.epoch),
+				"Producer-Seq": String(opts.seq)
+			};
+			injectTraceHeaders(headers);
+			const response = await fetch(this.streamUrl(path$2), {
+				method: `POST`,
+				headers: await this.requestHeaders(headers),
+				body: typeof data === `string` ? data : Buffer.from(data)
+			});
+			if (response.ok || response.status === 204) return;
+			throw new Error(`Stream append failed: ${response.status} ${await response.text()}`);
+		});
+	}
+	async read(path$2, fromOffset) {
+		return await withSpan(`stream.read`, async (span) => {
+			span.setAttributes({
+				[ATTR.STREAM_PATH]: path$2,
+				[ATTR.STREAM_OP]: `read`
+			});
+			const handle = new __durable_streams_client.DurableStream({
+				url: this.streamUrl(path$2),
+				headers: this.streamHeaders()
+			});
+			const response = await handle.stream({
+				offset: fromOffset ?? `-1`,
+				live: false
+			});
+			const messages = [];
+			return await new Promise((resolve$1, reject) => {
+				let settled = false;
+				let unsub = () => {};
+				const finish = (r) => {
+					if (settled) return;
+					settled = true;
+					unsub();
+					resolve$1(r);
+				};
+				unsub = response.subscribeBytes((chunk) => {
+					messages.push({
+						data: chunk.data,
+						offset: chunk.offset
+					});
+					if (chunk.upToDate || chunk.streamClosed) finish({ messages });
+				});
+				response.closed.then(() => finish({ messages })).catch((err) => {
+					if (settled) return;
+					settled = true;
+					unsub();
+					reject(err);
+				});
+			});
+		});
+	}
+	async readJson(path$2, fromOffset) {
+		return await withSpan(`stream.readJson`, async (span) => {
+			span.setAttributes({
+				[ATTR.STREAM_PATH]: path$2,
+				[ATTR.STREAM_OP]: `readJson`
+			});
+			const handle = new __durable_streams_client.DurableStream({
+				url: this.streamUrl(path$2),
+				headers: this.streamHeaders()
+			});
+			const response = await handle.stream({
+				offset: fromOffset ?? `-1`,
+				live: false
+			});
+			return await response.json();
+		});
+	}
+	async waitForMessages(path$2, fromOffset, timeoutMs) {
+		return await withSpan(`stream.waitForMessages`, async (span) => {
+			span.setAttributes({
+				[ATTR.STREAM_PATH]: path$2,
+				[ATTR.STREAM_OP]: `waitForMessages`
+			});
+			const handle = new __durable_streams_client.DurableStream({
+				url: this.streamUrl(path$2),
+				headers: this.streamHeaders()
+			});
+			const controller = new AbortController();
+			const timer = setTimeout(() => controller.abort(), timeoutMs);
+			try {
+				const response = await handle.stream({
+					offset: fromOffset,
+					live: `long-poll`,
+					signal: controller.signal
+				});
+				const messages = [];
+				return await new Promise((resolve$1, reject) => {
+					let settled = false;
+					let unsub = () => {};
+					const finish = (result) => {
+						if (settled) return;
+						settled = true;
+						clearTimeout(timer);
+						unsub();
+						resolve$1(result);
+					};
+					unsub = response.subscribeBytes((chunk) => {
+						messages.push({
+							data: chunk.data,
+							offset: chunk.offset
+						});
+						if (chunk.upToDate) finish({
+							messages,
+							timedOut: false
+						});
+					});
+					response.closed.then(() => finish({
+						messages,
+						timedOut: false
+					})).catch((err) => {
+						if (settled) return;
+						clearTimeout(timer);
+						if (isAbortLikeError(err)) {
+							settled = true;
+							unsub();
+							resolve$1({
+								messages: [],
+								timedOut: true
+							});
+							return;
+						}
+						settled = true;
+						unsub();
+						reject(err);
+					});
+				});
+			} catch (err) {
+				clearTimeout(timer);
+				if (isAbortLikeError(err)) return {
+					messages: [],
+					timedOut: true
+				};
+				throw err;
+			}
+		});
+	}
+	async delete(path$2) {
+		await __durable_streams_client.DurableStream.delete({
+			url: this.streamUrl(path$2),
+			headers: this.streamHeaders()
+		});
+	}
+	async ensure(path$2, opts) {
+		if (await this.exists(path$2)) return;
+		try {
+			await this.create(path$2, opts);
+		} catch (err) {
+			if (err && typeof err === `object` && `status` in err && err.status === 409) return;
+			throw err;
+		}
+	}
+	async exists(path$2) {
+		try {
+			const result = await __durable_streams_client.DurableStream.head({
+				url: this.streamUrl(path$2),
+				headers: this.streamHeaders()
+			});
+			return result.exists;
+		} catch (err) {
+			if (isNotFoundError(err)) return false;
+			throw err;
+		}
+	}
+	async createSubscription(pattern, subscriptionId, webhookUrl, description) {
+		const res = await this.putSubscription(subscriptionId, {
+			type: `webhook`,
+			pattern: normalizeSubscriptionPattern(pattern),
+			webhook: { url: webhookUrl },
+			...description ? { description } : {}
+		});
+		return res;
+	}
+	async putSubscription(subscriptionId, input) {
+		const res = await fetch(this.subscriptionUrl(subscriptionId), {
+			method: `PUT`,
+			headers: await this.requestHeaders({ "content-type": `application/json` }),
+			body: JSON.stringify({
+				...input,
+				pattern: typeof input.pattern === `string` ? this.backendSubscriptionPath(normalizeSubscriptionPattern(input.pattern)) : void 0,
+				streams: input.streams?.map((stream) => this.backendSubscriptionPath(normalizeSubscriptionStreamPath(stream))),
+				wake_stream: typeof input.wake_stream === `string` ? this.backendSubscriptionPath(normalizeSubscriptionStreamPath(input.wake_stream)) : void 0
+			})
+		});
+		return await this.subscriptionJson(res, `Subscription creation failed`);
+	}
+	async getSubscription(subscriptionId) {
+		const res = await fetch(this.subscriptionUrl(subscriptionId), {
+			method: `GET`,
+			headers: await this.requestHeaders()
+		});
+		if (res.status === 404) return null;
+		return await this.subscriptionJson(res, `Subscription query failed`);
+	}
+	async deleteSubscription(subscriptionId) {
+		const res = await fetch(this.subscriptionUrl(subscriptionId), {
+			method: `DELETE`,
+			headers: await this.requestHeaders()
+		});
+		if (res.status === 404 || res.status === 204) return;
+		if (!res.ok) throw new Error(`Subscription delete failed: ${res.status} ${await res.text()}`);
+	}
+	async addSubscriptionStreams(subscriptionId, streams$1) {
+		const res = await fetch(this.subscriptionChildUrl(subscriptionId, `streams`), {
+			method: `POST`,
+			headers: await this.requestHeaders({ "content-type": `application/json` }),
+			body: JSON.stringify({ streams: streams$1.map((stream) => this.backendSubscriptionPath(normalizeSubscriptionStreamPath(stream))) })
+		});
+		return await this.subscriptionJson(res, `Subscription stream add failed`);
+	}
+	async removeSubscriptionStream(subscriptionId, streamPath) {
+		const res = await fetch(this.subscriptionChildUrl(subscriptionId, `streams`, this.backendSubscriptionPath(normalizeSubscriptionStreamPath(streamPath))), {
+			method: `DELETE`,
+			headers: await this.requestHeaders()
+		});
+		if (res.status === 404 || res.status === 204) return;
+		if (!res.ok) throw new Error(`Subscription stream remove failed: ${res.status} ${await res.text()}`);
+	}
+	async claimSubscription(subscriptionId, worker) {
+		const res = await fetch(this.subscriptionChildUrl(subscriptionId, `claim`), {
+			method: `POST`,
+			headers: await this.requestHeaders({ "content-type": `application/json` }),
+			body: JSON.stringify({ worker })
+		});
+		if (res.status === 204 || res.status === 404) return null;
+		return await this.subscriptionJson(res, `Subscription claim failed`);
+	}
+	async ackSubscription(subscriptionId, token, body) {
+		const res = await fetch(this.subscriptionChildUrl(subscriptionId, `ack`), {
+			method: `POST`,
+			headers: await this.requestHeaders({
+				"content-type": `application/json`,
+				authorization: `Bearer ${token}`
+			}),
+			body: JSON.stringify(this.subscriptionRequestBody(body))
+		});
+		return await this.subscriptionJson(res, `Subscription ack failed`);
+	}
+	async releaseSubscription(subscriptionId, token, body) {
+		const res = await fetch(this.subscriptionChildUrl(subscriptionId, `release`), {
+			method: `POST`,
+			headers: await this.requestHeaders({
+				"content-type": `application/json`,
+				authorization: `Bearer ${token}`
+			}),
+			body: JSON.stringify(this.subscriptionRequestBody(body))
+		});
+		return await this.subscriptionJson(res, `Subscription release failed`);
+	}
+	subscriptionRequestBody(body) {
+		const next = { ...body };
+		if (typeof next.stream === `string`) next.stream = this.backendSubscriptionPath(next.stream);
+		if (typeof next.path === `string`) next.path = this.backendSubscriptionPath(next.path);
+		if (Array.isArray(next.acks)) next.acks = next.acks.map((ack) => {
+			if (!ack || typeof ack !== `object`) return ack;
+			const mapped = { ...ack };
+			if (typeof mapped.stream === `string`) mapped.stream = this.backendSubscriptionPath(mapped.stream);
+			if (typeof mapped.path === `string`) mapped.path = this.backendSubscriptionPath(mapped.path);
+			return mapped;
+		});
+		return next;
+	}
+	subscriptionResponseBody(body) {
+		const next = { ...body };
+		if (typeof next.pattern === `string`) next.pattern = this.runtimeSubscriptionPath(next.pattern);
+		if (typeof next.wake_stream === `string`) next.wake_stream = this.runtimeSubscriptionPath(next.wake_stream);
+		if (Array.isArray(next.streams)) next.streams = next.streams.map((stream) => {
+			if (typeof stream === `string`) return this.runtimeSubscriptionPath(stream);
+			return {
+				...stream,
+				path: this.runtimeSubscriptionPath(stream.path)
+			};
+		});
+		if (Array.isArray(next.acks)) next.acks = next.acks.map((ack) => {
+			if (!ack || typeof ack !== `object`) return ack;
+			const mapped = { ...ack };
+			if (typeof mapped.stream === `string`) mapped.stream = this.runtimeSubscriptionPath(mapped.stream);
+			if (typeof mapped.path === `string`) mapped.path = this.runtimeSubscriptionPath(mapped.path);
+			return mapped;
+		});
+		if (typeof next.stream === `string`) next.stream = this.runtimeSubscriptionPath(next.stream);
+		return next;
+	}
+	async subscriptionJson(res, message) {
+		if (!res.ok) throw new DurableStreamsSubscriptionError(message, res.status, await res.text());
+		if (res.status === 204) return {};
+		const text$1 = await res.text();
+		if (!text$1.trim()) return {};
+		return this.subscriptionResponseBody(JSON.parse(text$1));
+	}
+};
+
+//#endregion
+//#region src/utils/webhook-url.ts
+function rewriteLoopbackWebhookUrl(value) {
+	if (!value) return void 0;
+	const rewriteTarget = process.env.ELECTRIC_AGENTS_REWRITE_LOOPBACK_WEBHOOKS_TO?.trim();
+	if (!rewriteTarget) return value;
+	const url = new URL(value);
+	if (!isLoopbackHostname(url.hostname)) return value;
+	if (rewriteTarget.includes(`://`)) {
+		const target = new URL(rewriteTarget);
+		url.protocol = target.protocol;
+		url.username = target.username;
+		url.password = target.password;
+		url.hostname = target.hostname;
+		url.port = target.port;
+		return url.toString();
+	}
+	url.host = rewriteTarget;
+	return url.toString();
+}
+function isLoopbackHostname(hostname) {
+	return hostname === `localhost` || hostname === `127.0.0.1` || hostname === `::1`;
+}
+
+//#endregion
+//#region src/routing/dispatch-policy.ts
+const linkedDispatchSubscriptions = new WeakMap();
+function subscriptionIdForDispatchTarget(target) {
+	if (target.subscription_id) return target.subscription_id;
+	if (target.type === `runner`) return `runner:${target.runnerId}`;
+	const digest = (0, node_crypto.createHash)(`sha256`).update(target.url).digest(`hex`);
+	return `webhook:${digest.slice(0, 16)}`;
+}
+function subscriptionIdForEntityDispatchTarget(target, entityUrl) {
+	const base = subscriptionIdForDispatchTarget(target);
+	if (!target.subscription_id && target.type !== `runner`) return base;
+	const digest = (0, node_crypto.createHash)(`sha256`).update(entityUrl).digest(`hex`);
+	return `${base}:${digest.slice(0, 16)}`;
+}
+async function resolveEffectiveDispatchPolicyForSpawn(ctx, typeName, opts) {
+	if (opts.dispatchPolicy) return opts.dispatchPolicy;
+	const entityType = await ctx.entityManager.registry.getEntityType(typeName);
+	if (opts.parent) {
+		const parent = await ctx.entityManager.registry.getEntity(opts.parent);
+		if (parent?.dispatch_policy) return applyTypeDefaultSubscriptionScope(parent.dispatch_policy, entityType?.default_dispatch_policy);
+	}
+	return entityType?.default_dispatch_policy;
+}
+async function resolveEffectiveDispatchPolicyForEntity(ctx, entity) {
+	if (entity.dispatch_policy) return entity.dispatch_policy;
+	const entityType = await ctx.entityManager.registry.getEntityType(entity.type);
+	return entityType?.default_dispatch_policy;
+}
+async function backfillEntityDispatchPolicy(ctx, entity) {
+	if (entity.dispatch_policy) return entity;
+	const dispatchPolicy = await resolveEffectiveDispatchPolicyForEntity(ctx, entity);
+	if (!dispatchPolicy) return entity;
+	return await ctx.entityManager.registry.updateEntityDispatchPolicy(entity.url, dispatchPolicy) ?? {
+		...entity,
+		dispatch_policy: dispatchPolicy
+	};
+}
+function applyTypeDefaultSubscriptionScope(policy, typeDefault) {
+	const target = policy.targets[0];
+	const defaultTarget = typeDefault?.targets[0];
+	if (!target || !defaultTarget?.subscription_id) return policy;
+	if (!sameDispatchDestination(target, defaultTarget)) return policy;
+	if (target.subscription_id === defaultTarget.subscription_id) return policy;
+	return { targets: [{
+		...target,
+		subscription_id: defaultTarget.subscription_id
+	}] };
+}
+function sameDispatchDestination(a, b) {
+	if (a.type !== b.type) return false;
+	if (a.type === `runner` && b.type === `runner`) return a.runnerId === b.runnerId;
+	if (a.type === `webhook` && b.type === `webhook`) return a.url === b.url;
+	return false;
+}
+function subscriptionHasStream(ctx, existing, streamPath) {
+	const normalizedStream = streamPath.replace(/^\/+/, ``);
+	const backendStream = `${ctx.service}/${normalizedStream}`;
+	return existing.streams?.some((stream) => {
+		const path$2 = typeof stream === `string` ? stream : stream.path;
+		if (!path$2) return false;
+		const normalized = path$2.replace(/^\/+/, ``);
+		return normalized === normalizedStream || normalized === backendStream;
+	}) ?? false;
+}
+function dispatchLinkCacheKey(ctx, subscriptionId, streamPath) {
+	return `${ctx.service}:${subscriptionId}:${streamPath}`;
+}
+function getDispatchLinkCache(ctx) {
+	let cache = linkedDispatchSubscriptions.get(ctx.streamClient);
+	if (!cache) {
+		cache = new Set();
+		linkedDispatchSubscriptions.set(ctx.streamClient, cache);
+	}
+	return cache;
+}
+function isSubscriptionAlreadyExistsError(err) {
+	if (!(err instanceof DurableStreamsSubscriptionError)) return false;
+	if (err.status === 409) return true;
+	return err.code === `SUBSCRIPTION_ALREADY_EXISTS` || err.code === `ALREADY_EXISTS` || /already exists/i.test(err.errorMessage ?? err.body ?? err.message);
+}
+async function ensureSubscriptionIncludesStream(ctx, subscriptionId, streamPath, input, existing) {
+	if (!existing) try {
+		await ctx.streamClient.putSubscription(subscriptionId, input);
+		return;
+	} catch (err) {
+		if (!isSubscriptionAlreadyExistsError(err)) throw err;
+		existing = await ctx.streamClient.getSubscription(subscriptionId);
+		if (!existing) {
+			serverLog.warn(`[dispatch-policy] subscription create raced with existing subscription but it could not be read`, {
+				subscriptionId,
+				stream: streamPath
+			});
+			return;
+		}
+	}
+	if (!subscriptionHasStream(ctx, existing, streamPath)) await ctx.streamClient.addSubscriptionStreams(subscriptionId, [streamPath]);
+}
+async function assertDispatchPolicyAllowed(ctx, policy) {
+	const target = policy?.targets[0];
+	if (!target || target.type !== `runner`) return;
+	if (!ctx.principal) throw new ElectricAgentsError(ErrCodeUnauthorized, `Runner dispatch requires an authenticated owner`, 401);
+	const runner = await ctx.entityManager.registry.getRunner(target.runnerId);
+	if (!runner) throw new ElectricAgentsError(ErrCodeNotFound, `Runner "${target.runnerId}" not found`, 404);
+	if (runner.owner_principal !== ctx.principal.url) throw new ElectricAgentsError(ErrCodeUnauthorized, `Runner dispatch requires the authenticated owner`, 403);
+}
+async function linkEntityDispatchSubscription(ctx, entity) {
+	const dispatchPolicy = await resolveEffectiveDispatchPolicyForEntity(ctx, entity);
+	const target = dispatchPolicy?.targets[0];
+	if (!target) return;
+	const subscriptionId = subscriptionIdForEntityDispatchTarget(target, entity.url);
+	const cacheKey = dispatchLinkCacheKey(ctx, subscriptionId, entity.streams.main);
+	const cache = getDispatchLinkCache(ctx);
+	if (cache.has(cacheKey)) return;
+	await linkStreamToTargetSubscription(ctx, target, entity, subscriptionId);
+	cache.add(cacheKey);
+}
+async function unlinkEntityDispatchSubscription(ctx, entity) {
+	const dispatchPolicy = await resolveEffectiveDispatchPolicyForEntity(ctx, entity);
+	const target = dispatchPolicy?.targets[0];
+	if (!target) return;
+	const subscriptionId = subscriptionIdForEntityDispatchTarget(target, entity.url);
+	getDispatchLinkCache(ctx).delete(dispatchLinkCacheKey(ctx, subscriptionId, entity.streams.main));
+	await ctx.streamClient.removeSubscriptionStream(subscriptionId, entity.streams.main).catch((err) => {
+		serverLog.warn(`[dispatch-policy] failed to remove stream from subscription`, {
+			subscriptionId,
+			stream: entity.streams.main
+		}, err);
+	});
+}
+async function linkStreamToTargetSubscription(ctx, target, entity, subscriptionId) {
+	const streamPath = entity.streams.main;
+	await ctx.streamClient.ensure(streamPath, { contentType: `application/json` });
+	const existing = await ctx.streamClient.getSubscription(subscriptionId);
+	if (target.type === `runner`) {
+		const runner = await ctx.entityManager.registry.getRunner(target.runnerId);
+		if (!runner) throw new ElectricAgentsError(ErrCodeNotFound, `Runner "${target.runnerId}" not found`, 404);
+		const wakeStream = runner.wake_stream || runnerWakeStream(target.runnerId);
+		await ctx.streamClient.ensure(wakeStream, { contentType: `application/json` });
+		await ensureSubscriptionIncludesStream(ctx, subscriptionId, streamPath, {
+			type: `pull-wake`,
+			streams: [streamPath],
+			wake_stream: wakeStream,
+			description: `Electric Agents runner ${target.runnerId}`
+		}, existing);
+		return;
+	}
+	const webhookUrl = rewriteLoopbackWebhookUrl(target.url);
+	if (!webhookUrl) throw new ElectricAgentsError(ErrCodeInvalidRequest, `Webhook dispatch target must include a valid URL`, 400);
+	const forwardUrl = (0, __electric_ax_agents_runtime.appendPathToUrl)(ctx.publicUrl, `/_electric/webhook-forward/${encodeURIComponent(subscriptionId)}`);
+	await ensureSubscriptionIncludesStream(ctx, subscriptionId, streamPath, {
+		type: `webhook`,
+		streams: [streamPath],
+		webhook: { url: forwardUrl },
+		description: `Electric Agents webhook ${subscriptionId}`
+	}, existing);
+	await ctx.pgDb.insert(subscriptionWebhooks).values({
 		tenantId: ctx.service,
 		subscriptionId,
 		webhookUrl
@@ -1886,6 +2502,7 @@ async function linkStreamToTargetSubscription(ctx, target, entity) {
 
 //#endregion
 //#region src/principal.ts
+const ELECTRIC_PRINCIPAL_HEADER = `electric-principal`;
 const PRINCIPAL_KINDS = new Set([
 	`user`,
 	`agent`,
@@ -1894,7 +2511,7 @@ const PRINCIPAL_KINDS = new Set([
 ]);
 function parsePrincipalKey(input) {
 	const colon = input.indexOf(`:`);
-	if (colon <= 0) throw new Error(`Invalid principal key`);
+	if (colon <= 0) throw new Error(`Invalid principal identifier`);
 	const kind = input.slice(0, colon);
 	const id = input.slice(colon + 1);
 	if (!PRINCIPAL_KINDS.has(kind)) throw new Error(`Invalid principal kind`);
@@ -1910,13 +2527,12 @@ function parsePrincipalKey(input) {
 function principalUrl(key) {
 	return parsePrincipalKey(key).url;
 }
-function principalKeyFromUrl(url) {
+function parsePrincipalUrl(url) {
 	if (!url.startsWith(`/principal/`)) return null;
 	const segment = url.slice(`/principal/`.length);
 	if (!segment || segment.includes(`/`)) return null;
 	try {
-		const key = decodeURIComponent(segment);
-		return parsePrincipalKey(key).key;
+		return parsePrincipalKey(decodeURIComponent(segment));
 	} catch {
 		return null;
 	}
@@ -1929,9 +2545,8 @@ const BUILT_IN_SYSTEM_PRINCIPAL_IDS = new Set([
 function isBuiltInSystemPrincipalUrl(url) {
 	if (!url?.startsWith(`/principal/`)) return false;
 	try {
-		const key = principalKeyFromUrl(url);
-		if (!key) return false;
-		const principal = parsePrincipalKey(key);
+		const principal = parsePrincipalUrl(url);
+		if (!principal) return false;
 		return principal.kind === `system` && BUILT_IN_SYSTEM_PRINCIPAL_IDS.has(principal.id);
 	} catch {
 		return false;
@@ -1939,12 +2554,11 @@ function isBuiltInSystemPrincipalUrl(url) {
 }
 function principalFromCreatedBy(createdBy) {
 	if (!createdBy) return void 0;
-	const key = principalKeyFromUrl(createdBy);
-	if (!key) return {
+	const principal = parsePrincipalUrl(createdBy);
+	if (!principal) return {
 		url: createdBy,
 		key: null
 	};
-	const principal = parsePrincipalKey(key);
 	return {
 		url: principal.url,
 		key: principal.key,
@@ -2022,70 +2636,26 @@ function buildManifestWakeRegistration(subscriberUrl, manifest, manifestKey) {
 		subscriberUrl,
 		sourceUrl,
 		condition: `runFinished`,
-		oneShot: false,
-		includeResponse: typeof wake.includeResponse === `boolean` ? wake.includeResponse : void 0,
-		manifestKey
-	};
-	if (wake.on !== `change`) return null;
-	const collections = Array.isArray(wake.collections) ? wake.collections.filter((c) => typeof c === `string`) : void 0;
-	const ops = Array.isArray(wake.ops) ? wake.ops.filter((op) => op === `insert` || op === `update` || op === `delete`) : void 0;
-	return {
-		subscriberUrl,
-		sourceUrl,
-		condition: {
-			on: `change`,
-			...collections ? { collections } : {},
-			...ops ? { ops } : {}
-		},
-		debounceMs: typeof wake.debounceMs === `number` ? wake.debounceMs : void 0,
-		timeoutMs: typeof wake.timeoutMs === `number` ? wake.timeoutMs : void 0,
-		oneShot: false,
-		manifestKey
-	};
-}
-
-//#endregion
-//#region src/tracing.ts
-const tracer = __opentelemetry_api.trace.getTracer(`agent-server`);
-const ATTR = {
-	ENTITY_URL: `electric_agents.entity.url`,
-	ENTITY_TYPE: `electric_agents.entity.type`,
-	PARENT_URL: `electric_agents.entity.parent`,
-	WAKE_SOURCE: `electric_agents.wake.source`,
-	WAKE_SUBSCRIBER: `electric_agents.wake.subscriber`,
-	WAKE_KIND: `electric_agents.wake.kind`,
-	STREAM_PATH: `electric_agents.stream.path`,
-	STREAM_OP: `electric_agents.stream.op`,
-	DB_OP: `electric_agents.db.op`,
-	HTTP_METHOD: `http.method`,
-	HTTP_ROUTE: `http.route`,
-	HTTP_STATUS: `http.status_code`
-};
-/**
-* Run `fn` inside an active span. Errors are recorded + status set to ERROR,
-* then re-thrown. Span ends in a finally block.
-*/
-async function withSpan(name, fn, opts) {
-	return await tracer.startActiveSpan(name, opts ?? {}, async (span) => {
-		try {
-			return await fn(span);
-		} catch (err) {
-			span.recordException(err);
-			span.setStatus({
-				code: __opentelemetry_api.SpanStatusCode.ERROR,
-				message: err instanceof Error ? err.message : String(err)
-			});
-			throw err;
-		} finally {
-			span.end();
-		}
-	});
-}
-function injectTraceHeaders(headers, ctx = __opentelemetry_api.context.active()) {
-	__opentelemetry_api.propagation.inject(ctx, headers);
-}
-function extractTraceContext(headers) {
-	return __opentelemetry_api.propagation.extract(__opentelemetry_api.context.active(), headers);
+		oneShot: false,
+		includeResponse: typeof wake.includeResponse === `boolean` ? wake.includeResponse : void 0,
+		manifestKey
+	};
+	if (wake.on !== `change`) return null;
+	const collections = Array.isArray(wake.collections) ? wake.collections.filter((c) => typeof c === `string`) : void 0;
+	const ops = Array.isArray(wake.ops) ? wake.ops.filter((op) => op === `insert` || op === `update` || op === `delete`) : void 0;
+	return {
+		subscriberUrl,
+		sourceUrl,
+		condition: {
+			on: `change`,
+			...collections ? { collections } : {},
+			...ops ? { ops } : {}
+		},
+		debounceMs: typeof wake.debounceMs === `number` ? wake.debounceMs : void 0,
+		timeoutMs: typeof wake.timeoutMs === `number` ? wake.timeoutMs : void 0,
+		oneShot: false,
+		manifestKey
+	};
 }
 
 //#endregion
@@ -3631,1036 +4201,544 @@ function isPlainObject(value) {
 //#region src/scheduler.ts
 const POSTGRES_TEXT_OID = 25;
 var PostgresSchedulerClient = class {
-	constructor(pgClient, tenantId, wake) {
-		this.pgClient = pgClient;
-		this.tenantId = tenantId;
-		this.wake = wake;
-	}
-	async enqueueDelayedSend(payload, fireAt, opts) {
-		await this.pgClient`
-      insert into scheduled_tasks (
-        tenant_id,
-        kind,
-        payload,
-        fire_at,
-        owner_entity_url,
-        manifest_key
-      )
-      values (
-        ${this.tenantId},
-        'delayed_send',
-        ${JSON.stringify(payload)}::jsonb,
-        ${fireAt.toISOString()}::timestamptz,
-        ${opts?.ownerEntityUrl ?? null},
-        ${opts?.manifestKey ?? null}
-      )
-    `;
-		this.wake?.();
-	}
-	async syncManifestDelayedSend(ownerEntityUrl, manifestKey, payload, fireAt) {
-		await this.pgClient.begin(async (sql$2) => {
-			await sql$2`
-        update scheduled_tasks
-        set completed_at = now(), claimed_at = null, claimed_by = null
-        where tenant_id = ${this.tenantId}
-          and kind = 'delayed_send'
-          and owner_entity_url = ${ownerEntityUrl}
-          and manifest_key = ${manifestKey}
-          and completed_at is null
-      `;
-			await sql$2`
-        insert into scheduled_tasks (
-          tenant_id,
-          kind,
-          payload,
-          fire_at,
-          owner_entity_url,
-          manifest_key
-        )
-        values (
-          ${this.tenantId},
-          'delayed_send',
-          ${JSON.stringify(payload)}::jsonb,
-          ${fireAt.toISOString()}::timestamptz,
-          ${ownerEntityUrl},
-          ${manifestKey}
-        )
-      `;
-		});
-		this.wake?.();
-	}
-	async cancelManifestDelayedSend(ownerEntityUrl, manifestKey) {
-		await this.pgClient`
-      update scheduled_tasks
-      set completed_at = now(), claimed_at = null, claimed_by = null
-      where tenant_id = ${this.tenantId}
-        and kind = 'delayed_send'
-        and owner_entity_url = ${ownerEntityUrl}
-        and manifest_key = ${manifestKey}
-        and completed_at is null
-    `;
-		this.wake?.();
-	}
-	async enqueueCronTick(expression, timezone, tickNumber, streamPath, fireAt) {
-		await this.pgClient`
-      insert into scheduled_tasks (
-        tenant_id,
-        kind,
-        payload,
-        fire_at,
-        cron_expression,
-        cron_timezone,
-        cron_tick_number
-      )
-      values (
-        ${this.tenantId},
-        'cron_tick',
-        ${JSON.stringify({ streamPath })}::jsonb,
-        ${fireAt.toISOString()}::timestamptz,
-        ${expression},
-        ${timezone},
-        ${tickNumber}
-      )
-      on conflict (tenant_id, cron_expression, cron_timezone, cron_tick_number) do nothing
-    `;
-		this.wake?.();
-	}
-};
-function isPermanentElectricAgentsError(err) {
-	const status$4 = typeof err === `object` && err !== null && `status` in err ? err.status : void 0;
-	const name = typeof err === `object` && err !== null && `name` in err ? err.name : void 0;
-	return name === `ElectricAgentsError` && typeof status$4 === `number` && status$4 >= 400 && status$4 < 500;
-}
-function normalizeTask(row) {
-	return {
-		id: Number(row.id),
-		tenantId: row.tenant_id,
-		kind: row.kind,
-		payload: row.payload,
-		fireAt: row.fire_at instanceof Date ? row.fire_at : new Date(row.fire_at),
-		cronExpression: row.cron_expression,
-		cronTimezone: row.cron_timezone,
-		cronTickNumber: row.cron_tick_number,
-		ownerEntityUrl: row.owner_entity_url,
-		manifestKey: row.manifest_key
-	};
-}
-var Scheduler = class {
-	claimExpiryMs;
-	safetyPollMs;
-	listenEnabled;
-	pgClient;
-	instanceId;
-	tenantId;
-	tenantIds;
-	running = false;
-	loopPromise = null;
-	currentSleepResolve = null;
-	currentSleepTimer = null;
-	listenerMeta = null;
-	constructor(options) {
-		this.options = options;
-		this.pgClient = options.pgClient;
-		this.instanceId = options.instanceId;
-		this.tenantId = options.tenantId === void 0 ? DEFAULT_TENANT_ID : options.tenantId;
-		this.tenantIds = options.tenantIds;
-		this.claimExpiryMs = options.claimExpiryMs ?? 3e4;
-		this.safetyPollMs = options.safetyPollMs ?? 1e4;
-		this.listenEnabled = options.listen !== false;
-	}
-	resolveTenantId(tenantId) {
-		if (tenantId) return tenantId;
-		if (this.tenantId) return this.tenantId;
-		throw new Error(`Scheduler tenantId is required in shared mode`);
-	}
-	async start() {
-		if (this.running) return;
-		this.running = true;
-		if (this.listenEnabled) this.listenerMeta = await this.pgClient.listen(`scheduled_tasks_wake`, () => {
-			this.wakeEarly();
-		});
-		this.loopPromise = this.runLoop().catch((err) => {
-			console.error(`[agent-server] scheduler loop failed:`, err);
-			this.running = false;
-			this.wakeEarly();
-		});
-	}
-	async stop() {
-		this.running = false;
-		this.wakeEarly();
-		if (this.loopPromise) {
-			await this.loopPromise;
-			this.loopPromise = null;
-		}
-		if (this.listenerMeta) {
-			await this.listenerMeta.unlisten();
-			this.listenerMeta = null;
-		}
-	}
-	wake() {
-		this.wakeEarly();
-	}
-	async enqueueDelayedSend(payload, fireAt, opts) {
-		const tenantId = this.resolveTenantId();
-		await this.pgClient`
-      insert into scheduled_tasks (
-        tenant_id,
-        kind,
-        payload,
-        fire_at,
-        owner_entity_url,
-        manifest_key
-      )
-      values (
-        ${tenantId},
-        'delayed_send',
-        ${JSON.stringify(payload)}::jsonb,
-        ${fireAt.toISOString()}::timestamptz,
-        ${opts?.ownerEntityUrl ?? null},
-        ${opts?.manifestKey ?? null}
-      )
-    `;
-		this.wakeEarly();
-	}
-	async syncManifestDelayedSend(ownerEntityUrl, manifestKey, payload, fireAt) {
-		const tenantId = this.resolveTenantId();
-		await this.pgClient.begin(async (sql$2) => {
-			await sql$2`
-        update scheduled_tasks
-        set completed_at = now(), claimed_at = null, claimed_by = null
-        where tenant_id = ${tenantId}
-          and kind = 'delayed_send'
-          and owner_entity_url = ${ownerEntityUrl}
-          and manifest_key = ${manifestKey}
-          and completed_at is null
-      `;
-			await sql$2`
-        insert into scheduled_tasks (
-          tenant_id,
-          kind,
-          payload,
-          fire_at,
-          owner_entity_url,
-          manifest_key
-        )
-        values (
-          ${tenantId},
-          'delayed_send',
-          ${JSON.stringify(payload)}::jsonb,
-          ${fireAt.toISOString()}::timestamptz,
-          ${ownerEntityUrl},
-          ${manifestKey}
-        )
-      `;
-		});
-		this.wakeEarly();
-	}
-	async cancelManifestDelayedSend(ownerEntityUrl, manifestKey) {
-		const tenantId = this.resolveTenantId();
-		await this.pgClient`
-      update scheduled_tasks
-      set completed_at = now(), claimed_at = null, claimed_by = null
-      where tenant_id = ${tenantId}
-        and kind = 'delayed_send'
-        and owner_entity_url = ${ownerEntityUrl}
-        and manifest_key = ${manifestKey}
-        and completed_at is null
-    `;
-		this.wakeEarly();
+	constructor(pgClient, tenantId, wake) {
+		this.pgClient = pgClient;
+		this.tenantId = tenantId;
+		this.wake = wake;
 	}
-	async enqueueCronTick(expression, timezone, tickNumber, streamPath, fireAt) {
-		const tenantId = this.resolveTenantId();
+	async enqueueDelayedSend(payload, fireAt, opts) {
 		await this.pgClient`
       insert into scheduled_tasks (
         tenant_id,
         kind,
         payload,
         fire_at,
-        cron_expression,
-        cron_timezone,
-        cron_tick_number
+        owner_entity_url,
+        manifest_key
       )
       values (
-        ${tenantId},
-        'cron_tick',
-        ${JSON.stringify({ streamPath })}::jsonb,
+        ${this.tenantId},
+        'delayed_send',
+        ${JSON.stringify(payload)}::jsonb,
         ${fireAt.toISOString()}::timestamptz,
-        ${expression},
-        ${timezone},
-        ${tickNumber}
-      )
-      on conflict (tenant_id, cron_expression, cron_timezone, cron_tick_number) do nothing
-    `;
-		this.wakeEarly();
-	}
-	async runLoop() {
-		while (this.running) try {
-			await this.reclaimStaleClaims();
-			await this.fireReadyTasks();
-			const nextFireAt = await this.getNextFireAt();
-			const sleepTargetMs = nextFireAt ? Math.max(0, nextFireAt.getTime() - Date.now()) : this.safetyPollMs;
-			await this.sleepOrWake(Math.min(sleepTargetMs, this.safetyPollMs));
-		} catch (err) {
-			console.error(`[agent-server] scheduler iteration failed:`, err);
-			await this.sleepOrWake(this.safetyPollMs);
-		}
-	}
-	async reclaimStaleClaims() {
-		if (this.tenantId === null) {
-			const tenantIds = this.sharedTenantIds();
-			if (tenantIds && tenantIds.length === 0) return;
-			if (tenantIds) {
-				await this.pgClient`
-          update scheduled_tasks
-          set claimed_by = null, claimed_at = null
-          where tenant_id = any(${this.sharedTenantIdsParameter(tenantIds)})
-            and completed_at is null
-            and claimed_at < now() - (${this.claimExpiryMs} * interval '1 millisecond')
-        `;
-				return;
-			}
-			await this.pgClient`
-        update scheduled_tasks
-        set claimed_by = null, claimed_at = null
-        where completed_at is null
-          and claimed_at < now() - (${this.claimExpiryMs} * interval '1 millisecond')
-      `;
-			return;
-		}
-		await this.pgClient`
-      update scheduled_tasks
-      set claimed_by = null, claimed_at = null
-      where tenant_id = ${this.tenantId}
-        and completed_at is null
-        and claimed_at < now() - (${this.claimExpiryMs} * interval '1 millisecond')
-    `;
-	}
-	async fireReadyTasks() {
-		while (this.running) {
-			const tasks = await this.claimReadyTasks();
-			if (tasks.length === 0) return;
-			for (const task of tasks) await this.executeTask(task);
-		}
-	}
-	async claimReadyTasks() {
-		if (this.tenantId === null) {
-			const tenantIds = this.sharedTenantIds();
-			if (tenantIds && tenantIds.length === 0) return [];
-			if (tenantIds) {
-				const rows$2 = await this.pgClient`
-          update scheduled_tasks
-          set claimed_by = ${this.instanceId}, claimed_at = now()
-          where id in (
-            select id
-            from scheduled_tasks
-            where tenant_id = any(${this.sharedTenantIdsParameter(tenantIds)})
-              and completed_at is null
-              and claimed_at is null
-              and fire_at <= now()
-            order by fire_at, id
-            for update skip locked
-            limit 50
-          )
-          returning tenant_id, id, kind, payload, fire_at, cron_expression, cron_timezone, cron_tick_number
-            , owner_entity_url, manifest_key
-        `;
-				return rows$2.map(normalizeTask);
-			}
-			const rows$1 = await this.pgClient`
-        update scheduled_tasks
-        set claimed_by = ${this.instanceId}, claimed_at = now()
-        where id in (
-          select id
-          from scheduled_tasks
-          where completed_at is null
-            and claimed_at is null
-            and fire_at <= now()
-          order by fire_at, id
-          for update skip locked
-          limit 50
-        )
-        returning tenant_id, id, kind, payload, fire_at, cron_expression, cron_timezone, cron_tick_number
-          , owner_entity_url, manifest_key
-      `;
-			return rows$1.map(normalizeTask);
-		}
-		const rows = await this.pgClient`
-      update scheduled_tasks
-      set claimed_by = ${this.instanceId}, claimed_at = now()
-      where tenant_id = ${this.tenantId}
-        and id in (
-        select id
-        from scheduled_tasks
-        where tenant_id = ${this.tenantId}
-          and completed_at is null
-          and claimed_at is null
-          and fire_at <= now()
-        order by fire_at, id
-        for update skip locked
-        limit 50
+        ${opts?.ownerEntityUrl ?? null},
+        ${opts?.manifestKey ?? null}
       )
-      returning tenant_id, id, kind, payload, fire_at, cron_expression, cron_timezone, cron_tick_number
-        , owner_entity_url, manifest_key
-    `;
-		return rows.map(normalizeTask);
-	}
-	async executeTask(task) {
-		try {
-			if (task.kind === `delayed_send`) {
-				await this.options.executors.delayed_send(task.payload, task.id, task.tenantId);
-				await this.markTaskComplete(task.id, task.tenantId);
-				return;
-			}
-			const tickNumber = task.cronTickNumber;
-			if (tickNumber == null || !task.cronExpression || !task.cronTimezone) throw new Error(`cron task ${task.id} is missing cron metadata`);
-			await this.options.executors.cron_tick(task.payload, tickNumber, task.id, task.tenantId);
-			await this.completeAndRescheduleCron(task);
-		} catch (err) {
-			const message = err instanceof Error ? err.message : String(err);
-			if (isUnregisteredTenantError(err)) {
-				await this.releaseClaim(task.id, message, task.tenantId);
-				serverLog.warn(`[scheduler] skipped ${task.kind} task ${task.id} for unregistered tenant "${task.tenantId}": ${message}`);
-				return;
-			}
-			if (isPermanentElectricAgentsError(err)) {
-				await this.markTaskPermanentFailure(task.id, message, task.tenantId);
-				return;
-			}
-			await this.releaseClaim(task.id, message, task.tenantId);
-		}
-	}
-	async markTaskComplete(taskId, tenantId = this.resolveTenantId()) {
-		await this.pgClient`
-      update scheduled_tasks
-      set completed_at = now(), last_error = null
-      where tenant_id = ${tenantId}
-        and id = ${taskId}
-        and claimed_by = ${this.instanceId}
-        and completed_at is null
-    `;
-	}
-	async markTaskPermanentFailure(taskId, message, tenantId = this.resolveTenantId()) {
-		await this.pgClient`
-      update scheduled_tasks
-      set completed_at = now(), last_error = ${message}
-      where tenant_id = ${tenantId}
-        and id = ${taskId}
-        and claimed_by = ${this.instanceId}
-        and completed_at is null
-    `;
-	}
-	async releaseClaim(taskId, message, tenantId = this.resolveTenantId()) {
-		await this.pgClient`
-      update scheduled_tasks
-      set claimed_at = null, claimed_by = null, last_error = ${message}
-      where tenant_id = ${tenantId}
-        and id = ${taskId}
-        and claimed_by = ${this.instanceId}
-        and completed_at is null
     `;
+		this.wake?.();
 	}
-	async completeAndRescheduleCron(task) {
-		const tenantId = task.tenantId ?? this.resolveTenantId();
+	async syncManifestDelayedSend(ownerEntityUrl, manifestKey, payload, fireAt) {
 		await this.pgClient.begin(async (sql$2) => {
-			const completed = await sql$2`
+			await sql$2`
         update scheduled_tasks
-        set completed_at = now(), last_error = null
-        where tenant_id = ${tenantId}
-          and id = ${task.id}
-          and claimed_by = ${this.instanceId}
+        set completed_at = now(), claimed_at = null, claimed_by = null
+        where tenant_id = ${this.tenantId}
+          and kind = 'delayed_send'
+          and owner_entity_url = ${ownerEntityUrl}
+          and manifest_key = ${manifestKey}
           and completed_at is null
-        returning id
       `;
-			if (completed.length === 0) return;
-			const nextFireAt = (0, __electric_ax_agents_runtime.getNextCronFireAt)(task.cronExpression, task.cronTimezone, task.fireAt);
 			await sql$2`
-        insert into scheduled_tasks (
-          tenant_id,
-          kind,
-          payload,
-          fire_at,
-          cron_expression,
-          cron_timezone,
-          cron_tick_number
-        )
-        values (
-          ${tenantId},
-          'cron_tick',
-          ${JSON.stringify(task.payload)}::jsonb,
-          ${nextFireAt.toISOString()}::timestamptz,
-          ${task.cronExpression},
-          ${task.cronTimezone},
-          ${task.cronTickNumber + 1}
-        )
-        on conflict (tenant_id, cron_expression, cron_timezone, cron_tick_number) do nothing
-      `;
-		});
-	}
-	async getNextFireAt() {
-		if (this.tenantId === null) {
-			const tenantIds = this.sharedTenantIds();
-			if (tenantIds && tenantIds.length === 0) return null;
-			if (tenantIds) {
-				const rows$2 = await this.pgClient`
-          select fire_at
-          from scheduled_tasks
-          where tenant_id = any(${this.sharedTenantIdsParameter(tenantIds)})
-            and completed_at is null
-            and claimed_at is null
-          order by fire_at, id
-          limit 1
-        `;
-				if (rows$2.length === 0) return null;
-				const fireAt$2 = rows$2[0].fire_at;
-				return fireAt$2 instanceof Date ? fireAt$2 : new Date(fireAt$2);
-			}
-			const rows$1 = await this.pgClient`
-        select fire_at
-        from scheduled_tasks
-        where completed_at is null
-          and claimed_at is null
-        order by fire_at, id
-        limit 1
+        insert into scheduled_tasks (
+          tenant_id,
+          kind,
+          payload,
+          fire_at,
+          owner_entity_url,
+          manifest_key
+        )
+        values (
+          ${this.tenantId},
+          'delayed_send',
+          ${JSON.stringify(payload)}::jsonb,
+          ${fireAt.toISOString()}::timestamptz,
+          ${ownerEntityUrl},
+          ${manifestKey}
+        )
       `;
-			if (rows$1.length === 0) return null;
-			const fireAt$1 = rows$1[0].fire_at;
-			return fireAt$1 instanceof Date ? fireAt$1 : new Date(fireAt$1);
-		}
-		const rows = await this.pgClient`
-      select fire_at
-      from scheduled_tasks
+		});
+		this.wake?.();
+	}
+	async cancelManifestDelayedSend(ownerEntityUrl, manifestKey) {
+		await this.pgClient`
+      update scheduled_tasks
+      set completed_at = now(), claimed_at = null, claimed_by = null
       where tenant_id = ${this.tenantId}
+        and kind = 'delayed_send'
+        and owner_entity_url = ${ownerEntityUrl}
+        and manifest_key = ${manifestKey}
         and completed_at is null
-        and claimed_at is null
-      order by fire_at, id
-      limit 1
     `;
-		if (rows.length === 0) return null;
-		const fireAt = rows[0].fire_at;
-		return fireAt instanceof Date ? fireAt : new Date(fireAt);
-	}
-	async sleepOrWake(durationMs) {
-		if (!this.running) return;
-		await new Promise((resolve$1) => {
-			const finish = () => {
-				if (this.currentSleepTimer) {
-					clearTimeout(this.currentSleepTimer);
-					this.currentSleepTimer = null;
-				}
-				this.currentSleepResolve = null;
-				resolve$1();
-			};
-			this.currentSleepResolve = finish;
-			this.currentSleepTimer = setTimeout(finish, Math.max(durationMs, 0));
-		});
-	}
-	wakeEarly() {
-		const resolve$1 = this.currentSleepResolve;
-		this.currentSleepResolve = null;
-		if (this.currentSleepTimer) {
-			clearTimeout(this.currentSleepTimer);
-			this.currentSleepTimer = null;
-		}
-		resolve$1?.();
-	}
-	sharedTenantIds() {
-		if (this.tenantId !== null || !this.tenantIds) return null;
-		return [...new Set(this.tenantIds())];
-	}
-	sharedTenantIdsParameter(tenantIds) {
-		return this.pgClient.array(tenantIds, POSTGRES_TEXT_OID);
+		this.wake?.();
 	}
-};
-
-//#endregion
-//#region src/stream-client.ts
-var DurableStreamsSubscriptionError = class extends Error {
-	code;
-	errorMessage;
-	constructor(message, status$4, body) {
-		super(`${message}: ${status$4} ${body}`);
-		this.status = status$4;
-		this.body = body;
-		this.name = `DurableStreamsSubscriptionError`;
-		try {
-			const parsed = JSON.parse(body);
-			if (typeof parsed.error?.code === `string`) this.code = parsed.error.code;
-			if (typeof parsed.error?.message === `string`) this.errorMessage = parsed.error.message;
-		} catch {}
+	async enqueueCronTick(expression, timezone, tickNumber, streamPath, fireAt) {
+		await this.pgClient`
+      insert into scheduled_tasks (
+        tenant_id,
+        kind,
+        payload,
+        fire_at,
+        cron_expression,
+        cron_timezone,
+        cron_tick_number
+      )
+      values (
+        ${this.tenantId},
+        'cron_tick',
+        ${JSON.stringify({ streamPath })}::jsonb,
+        ${fireAt.toISOString()}::timestamptz,
+        ${expression},
+        ${timezone},
+        ${tickNumber}
+      )
+      on conflict (tenant_id, cron_expression, cron_timezone, cron_tick_number) do nothing
+    `;
+		this.wake?.();
 	}
 };
-async function resolveDurableStreamsBearer(bearer) {
-	if (!bearer) return void 0;
-	const value = typeof bearer === `function` ? await bearer() : bearer;
-	const trimmed = value.trim();
-	if (!trimmed) return void 0;
-	return /^Bearer\s+/i.test(trimmed) ? trimmed : `Bearer ${trimmed}`;
-}
-async function applyDurableStreamsBearer(headers, bearer, opts = {}) {
-	if (!bearer) return;
-	if (!opts.overwrite && headers.has(`authorization`)) return;
-	const value = await resolveDurableStreamsBearer(bearer);
-	if (value) headers.set(`authorization`, value);
-}
-function durableStreamsBearerHeaders(bearer) {
-	if (!bearer) return void 0;
-	return { authorization: async () => await resolveDurableStreamsBearer(bearer) ?? `` };
-}
-function durableStreamsServiceUrl(baseUrl, serviceId) {
-	const url = new URL(baseUrl);
-	if (/^\/v1\/stream\/[^/]+\/?$/.test(url.pathname)) return baseUrl.replace(/\/+$/, ``);
-	const base = baseUrl.replace(/\/+$/, ``);
-	return `${base}/v1/stream/${encodeURIComponent(serviceId)}`;
-}
-function isNotFoundError(err) {
-	return err instanceof __durable_streams_client.DurableStreamError && err.code === ErrCodeNotFound || err instanceof __durable_streams_client.FetchError && err.status === 404;
-}
-function isAbortLikeError(err) {
-	return err instanceof Error && (err.name === `AbortError` || err.message === `Stream request was aborted`);
-}
-function normalizeSubscriptionPattern(pattern) {
-	return pattern.replace(/^\/+/, ``);
-}
-function normalizeSubscriptionStreamPath(path$2) {
-	return path$2.replace(/^\/+/, ``);
+function isPermanentElectricAgentsError(err) {
+	const status$4 = typeof err === `object` && err !== null && `status` in err ? err.status : void 0;
+	const name = typeof err === `object` && err !== null && `name` in err ? err.name : void 0;
+	return name === `ElectricAgentsError` && typeof status$4 === `number` && status$4 >= 400 && status$4 < 500;
 }
-function normalizeSubscriptionPath(path$2) {
-	return path$2.replace(/^\/+/, ``).replace(/\/+$/, ``);
+function normalizeTask(row) {
+	return {
+		id: Number(row.id),
+		tenantId: row.tenant_id,
+		kind: row.kind,
+		payload: row.payload,
+		fireAt: row.fire_at instanceof Date ? row.fire_at : new Date(row.fire_at),
+		cronExpression: row.cron_expression,
+		cronTimezone: row.cron_timezone,
+		cronTickNumber: row.cron_tick_number,
+		ownerEntityUrl: row.owner_entity_url,
+		manifestKey: row.manifest_key
+	};
 }
-var StreamClient = class {
-	constructor(baseUrl, options = {}) {
-		this.baseUrl = baseUrl;
+var Scheduler = class {
+	claimExpiryMs;
+	safetyPollMs;
+	listenEnabled;
+	pgClient;
+	instanceId;
+	tenantId;
+	tenantIds;
+	running = false;
+	loopPromise = null;
+	currentSleepResolve = null;
+	currentSleepTimer = null;
+	listenerMeta = null;
+	constructor(options) {
 		this.options = options;
+		this.pgClient = options.pgClient;
+		this.instanceId = options.instanceId;
+		this.tenantId = options.tenantId === void 0 ? DEFAULT_TENANT_ID : options.tenantId;
+		this.tenantIds = options.tenantIds;
+		this.claimExpiryMs = options.claimExpiryMs ?? 3e4;
+		this.safetyPollMs = options.safetyPollMs ?? 1e4;
+		this.listenEnabled = options.listen !== false;
 	}
-	streamUrl(path$2) {
-		return `${this.baseUrl}${path$2}`;
-	}
-	streamHeaders() {
-		return durableStreamsBearerHeaders(this.options.bearer);
-	}
-	async requestHeaders(init, opts = {}) {
-		const headers = new Headers(init);
-		await applyDurableStreamsBearer(headers, this.options.bearer, { overwrite: opts.overwriteBearer });
-		return headers;
-	}
-	subscriptionServiceId() {
-		const url = new URL(this.baseUrl);
-		const match = /^(.*)\/v1\/stream\/([^/]+)\/?$/.exec(url.pathname);
-		return match ? decodeURIComponent(match[2]) : null;
-	}
-	backendSubscriptionPath(path$2) {
-		const normalized = normalizeSubscriptionPath(path$2);
-		const serviceId = this.subscriptionServiceId();
-		if (!serviceId) return normalized;
-		if (normalized === serviceId || normalized.startsWith(`${serviceId}/`)) return normalized;
-		return `${serviceId}/${normalized}`;
-	}
-	runtimeSubscriptionPath(path$2) {
-		const normalized = normalizeSubscriptionPath(path$2);
-		const serviceId = this.subscriptionServiceId();
-		if (!serviceId) return normalized;
-		return normalized.startsWith(`${serviceId}/`) ? normalized.slice(serviceId.length + 1) : normalized;
-	}
-	subscriptionUrl(subscriptionId) {
-		const url = new URL(this.baseUrl);
-		const match = /^(.*)\/v1\/stream\/([^/]+)\/?$/.exec(url.pathname);
-		if (match) {
-			const [, prefix = ``, serviceId] = match;
-			url.pathname = `${prefix}/v1/stream-meta/subscriptions/${encodeURIComponent(subscriptionId)}`;
-			url.searchParams.set(`service`, decodeURIComponent(serviceId));
-			return url.toString();
-		}
-		url.pathname = `${url.pathname.replace(/\/+$/, ``)}/v1/stream-meta/subscriptions/${encodeURIComponent(subscriptionId)}`;
-		return url.toString();
-	}
-	subscriptionChildUrl(subscriptionId, ...segments) {
-		const url = new URL(this.subscriptionUrl(subscriptionId));
-		url.pathname = `${url.pathname.replace(/\/+$/, ``)}/${segments.map((segment) => encodeURIComponent(segment)).join(`/`)}`;
-		return url.toString();
-	}
-	async create(path$2, opts) {
-		return await withSpan(`stream.create`, async (span) => {
-			span.setAttributes({
-				[ATTR.STREAM_PATH]: path$2,
-				[ATTR.STREAM_OP]: `create`
-			});
-			await __durable_streams_client.DurableStream.create({
-				url: this.streamUrl(path$2),
-				headers: this.streamHeaders(),
-				contentType: opts.contentType,
-				body: opts.body
-			});
-		});
-	}
-	async fork(path$2, sourcePath) {
-		return await withSpan(`stream.fork`, async (span) => {
-			span.setAttributes({
-				[ATTR.STREAM_PATH]: path$2,
-				[ATTR.STREAM_OP]: `fork`
-			});
-			const headers = {
-				"content-type": `application/json`,
-				"Stream-Forked-From": sourcePath
-			};
-			injectTraceHeaders(headers);
-			const response = await fetch(this.streamUrl(path$2), {
-				method: `PUT`,
-				headers: await this.requestHeaders(headers)
-			});
-			if (response.ok) return;
-			throw new Error(`Stream fork failed: ${response.status} ${await response.text()}`);
-		});
-	}
-	async append(path$2, data, opts) {
-		return await withSpan(`stream.append`, async (span) => {
-			span.setAttributes({
-				[ATTR.STREAM_PATH]: path$2,
-				[ATTR.STREAM_OP]: opts?.close ? `append+close` : `append`
-			});
-			const handle = new __durable_streams_client.DurableStream({
-				url: this.streamUrl(path$2),
-				headers: this.streamHeaders(),
-				contentType: `application/json`,
-				batching: false
-			});
-			if (opts?.close) {
-				const result = await handle.close({ body: data });
-				return { offset: result.finalOffset };
-			}
-			await handle.append(data);
-			const head = await handle.head();
-			return { offset: head.exists && head.offset || `` };
-		});
-	}
-	async appendIdempotent(path$2, data, opts) {
-		return await withSpan(`stream.appendIdempotent`, async (span) => {
-			span.setAttributes({
-				[ATTR.STREAM_PATH]: path$2,
-				[ATTR.STREAM_OP]: `appendIdempotent`
-			});
-			const stream = new __durable_streams_client.DurableStream({
-				url: this.streamUrl(path$2),
-				headers: this.streamHeaders(),
-				contentType: `application/json`
-			});
-			const producer = new __durable_streams_client.IdempotentProducer(stream, opts.producerId, { epoch: opts.epoch ?? 0 });
-			try {
-				producer.append(data);
-				await producer.flush();
-			} finally {
-				await producer.detach();
-			}
-		});
+	resolveTenantId(tenantId) {
+		if (tenantId) return tenantId;
+		if (this.tenantId) return this.tenantId;
+		throw new Error(`Scheduler tenantId is required in shared mode`);
 	}
-	async appendWithProducerHeaders(path$2, data, opts) {
-		return await withSpan(`stream.appendWithProducerHeaders`, async (span) => {
-			span.setAttributes({
-				[ATTR.STREAM_PATH]: path$2,
-				[ATTR.STREAM_OP]: `appendWithProducerHeaders`
-			});
-			const headers = {
-				"content-type": `application/json`,
-				"Producer-Id": opts.producerId,
-				"Producer-Epoch": String(opts.epoch),
-				"Producer-Seq": String(opts.seq)
-			};
-			injectTraceHeaders(headers);
-			const response = await fetch(this.streamUrl(path$2), {
-				method: `POST`,
-				headers: await this.requestHeaders(headers),
-				body: typeof data === `string` ? data : Buffer.from(data)
-			});
-			if (response.ok || response.status === 204) return;
-			throw new Error(`Stream append failed: ${response.status} ${await response.text()}`);
+	async start() {
+		if (this.running) return;
+		this.running = true;
+		if (this.listenEnabled) this.listenerMeta = await this.pgClient.listen(`scheduled_tasks_wake`, () => {
+			this.wakeEarly();
 		});
-	}
-	async read(path$2, fromOffset) {
-		return await withSpan(`stream.read`, async (span) => {
-			span.setAttributes({
-				[ATTR.STREAM_PATH]: path$2,
-				[ATTR.STREAM_OP]: `read`
-			});
-			const handle = new __durable_streams_client.DurableStream({
-				url: this.streamUrl(path$2),
-				headers: this.streamHeaders()
-			});
-			const response = await handle.stream({
-				offset: fromOffset ?? `-1`,
-				live: false
-			});
-			const messages = [];
-			return await new Promise((resolve$1, reject) => {
-				let settled = false;
-				let unsub = () => {};
-				const finish = (r) => {
-					if (settled) return;
-					settled = true;
-					unsub();
-					resolve$1(r);
-				};
-				unsub = response.subscribeBytes((chunk) => {
-					messages.push({
-						data: chunk.data,
-						offset: chunk.offset
-					});
-					if (chunk.upToDate || chunk.streamClosed) finish({ messages });
-				});
-				response.closed.then(() => finish({ messages })).catch((err) => {
-					if (settled) return;
-					settled = true;
-					unsub();
-					reject(err);
-				});
-			});
+		this.loopPromise = this.runLoop().catch((err) => {
+			console.error(`[agent-server] scheduler loop failed:`, err);
+			this.running = false;
+			this.wakeEarly();
 		});
 	}
-	async readJson(path$2, fromOffset) {
-		return await withSpan(`stream.readJson`, async (span) => {
-			span.setAttributes({
-				[ATTR.STREAM_PATH]: path$2,
-				[ATTR.STREAM_OP]: `readJson`
-			});
-			const handle = new __durable_streams_client.DurableStream({
-				url: this.streamUrl(path$2),
-				headers: this.streamHeaders()
-			});
-			const response = await handle.stream({
-				offset: fromOffset ?? `-1`,
-				live: false
-			});
-			return await response.json();
-		});
+	async stop() {
+		this.running = false;
+		this.wakeEarly();
+		if (this.loopPromise) {
+			await this.loopPromise;
+			this.loopPromise = null;
+		}
+		if (this.listenerMeta) {
+			await this.listenerMeta.unlisten();
+			this.listenerMeta = null;
+		}
 	}
-	async waitForMessages(path$2, fromOffset, timeoutMs) {
-		return await withSpan(`stream.waitForMessages`, async (span) => {
-			span.setAttributes({
-				[ATTR.STREAM_PATH]: path$2,
-				[ATTR.STREAM_OP]: `waitForMessages`
-			});
-			const handle = new __durable_streams_client.DurableStream({
-				url: this.streamUrl(path$2),
-				headers: this.streamHeaders()
-			});
-			const controller = new AbortController();
-			const timer = setTimeout(() => controller.abort(), timeoutMs);
-			try {
-				const response = await handle.stream({
-					offset: fromOffset,
-					live: `long-poll`,
-					signal: controller.signal
-				});
-				const messages = [];
-				return await new Promise((resolve$1, reject) => {
-					let settled = false;
-					let unsub = () => {};
-					const finish = (result) => {
-						if (settled) return;
-						settled = true;
-						clearTimeout(timer);
-						unsub();
-						resolve$1(result);
-					};
-					unsub = response.subscribeBytes((chunk) => {
-						messages.push({
-							data: chunk.data,
-							offset: chunk.offset
-						});
-						if (chunk.upToDate) finish({
-							messages,
-							timedOut: false
-						});
-					});
-					response.closed.then(() => finish({
-						messages,
-						timedOut: false
-					})).catch((err) => {
-						if (settled) return;
-						clearTimeout(timer);
-						if (isAbortLikeError(err)) {
-							settled = true;
-							unsub();
-							resolve$1({
-								messages: [],
-								timedOut: true
-							});
-							return;
-						}
-						settled = true;
-						unsub();
-						reject(err);
-					});
-				});
-			} catch (err) {
-				clearTimeout(timer);
-				if (isAbortLikeError(err)) return {
-					messages: [],
-					timedOut: true
-				};
-				throw err;
-			}
+	wake() {
+		this.wakeEarly();
+	}
+	async enqueueDelayedSend(payload, fireAt, opts) {
+		const tenantId = this.resolveTenantId();
+		await this.pgClient`
+      insert into scheduled_tasks (
+        tenant_id,
+        kind,
+        payload,
+        fire_at,
+        owner_entity_url,
+        manifest_key
+      )
+      values (
+        ${tenantId},
+        'delayed_send',
+        ${JSON.stringify(payload)}::jsonb,
+        ${fireAt.toISOString()}::timestamptz,
+        ${opts?.ownerEntityUrl ?? null},
+        ${opts?.manifestKey ?? null}
+      )
+    `;
+		this.wakeEarly();
+	}
+	async syncManifestDelayedSend(ownerEntityUrl, manifestKey, payload, fireAt) {
+		const tenantId = this.resolveTenantId();
+		await this.pgClient.begin(async (sql$2) => {
+			await sql$2`
+        update scheduled_tasks
+        set completed_at = now(), claimed_at = null, claimed_by = null
+        where tenant_id = ${tenantId}
+          and kind = 'delayed_send'
+          and owner_entity_url = ${ownerEntityUrl}
+          and manifest_key = ${manifestKey}
+          and completed_at is null
+      `;
+			await sql$2`
+        insert into scheduled_tasks (
+          tenant_id,
+          kind,
+          payload,
+          fire_at,
+          owner_entity_url,
+          manifest_key
+        )
+        values (
+          ${tenantId},
+          'delayed_send',
+          ${JSON.stringify(payload)}::jsonb,
+          ${fireAt.toISOString()}::timestamptz,
+          ${ownerEntityUrl},
+          ${manifestKey}
+        )
+      `;
 		});
+		this.wakeEarly();
+	}
+	async cancelManifestDelayedSend(ownerEntityUrl, manifestKey) {
+		const tenantId = this.resolveTenantId();
+		await this.pgClient`
+      update scheduled_tasks
+      set completed_at = now(), claimed_at = null, claimed_by = null
+      where tenant_id = ${tenantId}
+        and kind = 'delayed_send'
+        and owner_entity_url = ${ownerEntityUrl}
+        and manifest_key = ${manifestKey}
+        and completed_at is null
+    `;
+		this.wakeEarly();
 	}
-	async delete(path$2) {
-		await __durable_streams_client.DurableStream.delete({
-			url: this.streamUrl(path$2),
-			headers: this.streamHeaders()
-		});
+	async enqueueCronTick(expression, timezone, tickNumber, streamPath, fireAt) {
+		const tenantId = this.resolveTenantId();
+		await this.pgClient`
+      insert into scheduled_tasks (
+        tenant_id,
+        kind,
+        payload,
+        fire_at,
+        cron_expression,
+        cron_timezone,
+        cron_tick_number
+      )
+      values (
+        ${tenantId},
+        'cron_tick',
+        ${JSON.stringify({ streamPath })}::jsonb,
+        ${fireAt.toISOString()}::timestamptz,
+        ${expression},
+        ${timezone},
+        ${tickNumber}
+      )
+      on conflict (tenant_id, cron_expression, cron_timezone, cron_tick_number) do nothing
+    `;
+		this.wakeEarly();
 	}
-	async ensure(path$2, opts) {
-		if (await this.exists(path$2)) return;
-		try {
-			await this.create(path$2, opts);
+	async runLoop() {
+		while (this.running) try {
+			await this.reclaimStaleClaims();
+			await this.fireReadyTasks();
+			const nextFireAt = await this.getNextFireAt();
+			const sleepTargetMs = nextFireAt ? Math.max(0, nextFireAt.getTime() - Date.now()) : this.safetyPollMs;
+			await this.sleepOrWake(Math.min(sleepTargetMs, this.safetyPollMs));
 		} catch (err) {
-			if (err && typeof err === `object` && `status` in err && err.status === 409) return;
-			throw err;
+			console.error(`[agent-server] scheduler iteration failed:`, err);
+			await this.sleepOrWake(this.safetyPollMs);
 		}
 	}
-	async exists(path$2) {
-		try {
-			const result = await __durable_streams_client.DurableStream.head({
-				url: this.streamUrl(path$2),
-				headers: this.streamHeaders()
-			});
-			return result.exists;
-		} catch (err) {
-			if (isNotFoundError(err)) return false;
-			throw err;
+	async reclaimStaleClaims() {
+		if (this.tenantId === null) {
+			const tenantIds = this.sharedTenantIds();
+			if (tenantIds && tenantIds.length === 0) return;
+			if (tenantIds) {
+				await this.pgClient`
+          update scheduled_tasks
+          set claimed_by = null, claimed_at = null
+          where tenant_id = any(${this.sharedTenantIdsParameter(tenantIds)})
+            and completed_at is null
+            and claimed_at < now() - (${this.claimExpiryMs} * interval '1 millisecond')
+        `;
+				return;
+			}
+			await this.pgClient`
+        update scheduled_tasks
+        set claimed_by = null, claimed_at = null
+        where completed_at is null
+          and claimed_at < now() - (${this.claimExpiryMs} * interval '1 millisecond')
+      `;
+			return;
 		}
+		await this.pgClient`
+      update scheduled_tasks
+      set claimed_by = null, claimed_at = null
+      where tenant_id = ${this.tenantId}
+        and completed_at is null
+        and claimed_at < now() - (${this.claimExpiryMs} * interval '1 millisecond')
+    `;
 	}
-	async createSubscription(pattern, subscriptionId, webhookUrl, description) {
-		const res = await this.putSubscription(subscriptionId, {
-			type: `webhook`,
-			pattern: normalizeSubscriptionPattern(pattern),
-			webhook: { url: webhookUrl },
-			...description ? { description } : {}
-		});
-		return res;
-	}
-	async putSubscription(subscriptionId, input) {
-		const res = await fetch(this.subscriptionUrl(subscriptionId), {
-			method: `PUT`,
-			headers: await this.requestHeaders({ "content-type": `application/json` }),
-			body: JSON.stringify({
-				...input,
-				pattern: typeof input.pattern === `string` ? this.backendSubscriptionPath(normalizeSubscriptionPattern(input.pattern)) : void 0,
-				streams: input.streams?.map((stream) => this.backendSubscriptionPath(normalizeSubscriptionStreamPath(stream))),
-				wake_stream: typeof input.wake_stream === `string` ? this.backendSubscriptionPath(normalizeSubscriptionStreamPath(input.wake_stream)) : void 0
-			})
-		});
-		return await this.subscriptionJson(res, `Subscription creation failed`);
-	}
-	async getSubscription(subscriptionId) {
-		const res = await fetch(this.subscriptionUrl(subscriptionId), {
-			method: `GET`,
-			headers: await this.requestHeaders()
-		});
-		if (res.status === 404) return null;
-		return await this.subscriptionJson(res, `Subscription query failed`);
-	}
-	async deleteSubscription(subscriptionId) {
-		const res = await fetch(this.subscriptionUrl(subscriptionId), {
-			method: `DELETE`,
-			headers: await this.requestHeaders()
-		});
-		if (res.status === 404 || res.status === 204) return;
-		if (!res.ok) throw new Error(`Subscription delete failed: ${res.status} ${await res.text()}`);
+	async fireReadyTasks() {
+		while (this.running) {
+			const tasks = await this.claimReadyTasks();
+			if (tasks.length === 0) return;
+			for (const task of tasks) await this.executeTask(task);
+		}
 	}
-	async addSubscriptionStreams(subscriptionId, streams$1) {
-		const res = await fetch(this.subscriptionChildUrl(subscriptionId, `streams`), {
-			method: `POST`,
-			headers: await this.requestHeaders({ "content-type": `application/json` }),
-			body: JSON.stringify({ streams: streams$1.map((stream) => this.backendSubscriptionPath(normalizeSubscriptionStreamPath(stream))) })
-		});
-		return await this.subscriptionJson(res, `Subscription stream add failed`);
+	async claimReadyTasks() {
+		if (this.tenantId === null) {
+			const tenantIds = this.sharedTenantIds();
+			if (tenantIds && tenantIds.length === 0) return [];
+			if (tenantIds) {
+				const rows$2 = await this.pgClient`
+          update scheduled_tasks
+          set claimed_by = ${this.instanceId}, claimed_at = now()
+          where id in (
+            select id
+            from scheduled_tasks
+            where tenant_id = any(${this.sharedTenantIdsParameter(tenantIds)})
+              and completed_at is null
+              and claimed_at is null
+              and fire_at <= now()
+            order by fire_at, id
+            for update skip locked
+            limit 50
+          )
+          returning tenant_id, id, kind, payload, fire_at, cron_expression, cron_timezone, cron_tick_number
+            , owner_entity_url, manifest_key
+        `;
+				return rows$2.map(normalizeTask);
+			}
+			const rows$1 = await this.pgClient`
+        update scheduled_tasks
+        set claimed_by = ${this.instanceId}, claimed_at = now()
+        where id in (
+          select id
+          from scheduled_tasks
+          where completed_at is null
+            and claimed_at is null
+            and fire_at <= now()
+          order by fire_at, id
+          for update skip locked
+          limit 50
+        )
+        returning tenant_id, id, kind, payload, fire_at, cron_expression, cron_timezone, cron_tick_number
+          , owner_entity_url, manifest_key
+      `;
+			return rows$1.map(normalizeTask);
+		}
+		const rows = await this.pgClient`
+      update scheduled_tasks
+      set claimed_by = ${this.instanceId}, claimed_at = now()
+      where tenant_id = ${this.tenantId}
+        and id in (
+        select id
+        from scheduled_tasks
+        where tenant_id = ${this.tenantId}
+          and completed_at is null
+          and claimed_at is null
+          and fire_at <= now()
+        order by fire_at, id
+        for update skip locked
+        limit 50
+      )
+      returning tenant_id, id, kind, payload, fire_at, cron_expression, cron_timezone, cron_tick_number
+        , owner_entity_url, manifest_key
+    `;
+		return rows.map(normalizeTask);
 	}
-	async removeSubscriptionStream(subscriptionId, streamPath) {
-		const res = await fetch(this.subscriptionChildUrl(subscriptionId, `streams`, this.backendSubscriptionPath(normalizeSubscriptionStreamPath(streamPath))), {
-			method: `DELETE`,
-			headers: await this.requestHeaders()
-		});
-		if (res.status === 404 || res.status === 204) return;
-		if (!res.ok) throw new Error(`Subscription stream remove failed: ${res.status} ${await res.text()}`);
+	async executeTask(task) {
+		try {
+			if (task.kind === `delayed_send`) {
+				await this.options.executors.delayed_send(task.payload, task.id, task.tenantId);
+				await this.markTaskComplete(task.id, task.tenantId);
+				return;
+			}
+			const tickNumber = task.cronTickNumber;
+			if (tickNumber == null || !task.cronExpression || !task.cronTimezone) throw new Error(`cron task ${task.id} is missing cron metadata`);
+			await this.options.executors.cron_tick(task.payload, tickNumber, task.id, task.tenantId);
+			await this.completeAndRescheduleCron(task);
+		} catch (err) {
+			const message = err instanceof Error ? err.message : String(err);
+			if (isUnregisteredTenantError(err)) {
+				await this.releaseClaim(task.id, message, task.tenantId);
+				serverLog.warn(`[scheduler] skipped ${task.kind} task ${task.id} for unregistered tenant "${task.tenantId}": ${message}`);
+				return;
+			}
+			if (isPermanentElectricAgentsError(err)) {
+				await this.markTaskPermanentFailure(task.id, message, task.tenantId);
+				return;
+			}
+			await this.releaseClaim(task.id, message, task.tenantId);
+		}
 	}
-	async claimSubscription(subscriptionId, worker) {
-		const res = await fetch(this.subscriptionChildUrl(subscriptionId, `claim`), {
-			method: `POST`,
-			headers: await this.requestHeaders({ "content-type": `application/json` }),
-			body: JSON.stringify({ worker })
-		});
-		if (res.status === 204 || res.status === 404) return null;
-		return await this.subscriptionJson(res, `Subscription claim failed`);
+	async markTaskComplete(taskId, tenantId = this.resolveTenantId()) {
+		await this.pgClient`
+      update scheduled_tasks
+      set completed_at = now(), last_error = null
+      where tenant_id = ${tenantId}
+        and id = ${taskId}
+        and claimed_by = ${this.instanceId}
+        and completed_at is null
+    `;
 	}
-	async ackSubscription(subscriptionId, token, body) {
-		const res = await fetch(this.subscriptionChildUrl(subscriptionId, `ack`), {
-			method: `POST`,
-			headers: await this.requestHeaders({
-				"content-type": `application/json`,
-				authorization: `Bearer ${token}`
-			}),
-			body: JSON.stringify(this.subscriptionRequestBody(body))
-		});
-		return await this.subscriptionJson(res, `Subscription ack failed`);
+	async markTaskPermanentFailure(taskId, message, tenantId = this.resolveTenantId()) {
+		await this.pgClient`
+      update scheduled_tasks
+      set completed_at = now(), last_error = ${message}
+      where tenant_id = ${tenantId}
+        and id = ${taskId}
+        and claimed_by = ${this.instanceId}
+        and completed_at is null
+    `;
 	}
-	async releaseSubscription(subscriptionId, token, body) {
-		const res = await fetch(this.subscriptionChildUrl(subscriptionId, `release`), {
-			method: `POST`,
-			headers: await this.requestHeaders({
-				"content-type": `application/json`,
-				authorization: `Bearer ${token}`
-			}),
-			body: JSON.stringify(this.subscriptionRequestBody(body))
-		});
-		return await this.subscriptionJson(res, `Subscription release failed`);
+	async releaseClaim(taskId, message, tenantId = this.resolveTenantId()) {
+		await this.pgClient`
+      update scheduled_tasks
+      set claimed_at = null, claimed_by = null, last_error = ${message}
+      where tenant_id = ${tenantId}
+        and id = ${taskId}
+        and claimed_by = ${this.instanceId}
+        and completed_at is null
+    `;
 	}
-	subscriptionRequestBody(body) {
-		const next = { ...body };
-		if (typeof next.stream === `string`) next.stream = this.backendSubscriptionPath(next.stream);
-		if (typeof next.path === `string`) next.path = this.backendSubscriptionPath(next.path);
-		if (Array.isArray(next.acks)) next.acks = next.acks.map((ack) => {
-			if (!ack || typeof ack !== `object`) return ack;
-			const mapped = { ...ack };
-			if (typeof mapped.stream === `string`) mapped.stream = this.backendSubscriptionPath(mapped.stream);
-			if (typeof mapped.path === `string`) mapped.path = this.backendSubscriptionPath(mapped.path);
-			return mapped;
+	async completeAndRescheduleCron(task) {
+		const tenantId = task.tenantId ?? this.resolveTenantId();
+		await this.pgClient.begin(async (sql$2) => {
+			const completed = await sql$2`
+        update scheduled_tasks
+        set completed_at = now(), last_error = null
+        where tenant_id = ${tenantId}
+          and id = ${task.id}
+          and claimed_by = ${this.instanceId}
+          and completed_at is null
+        returning id
+      `;
+			if (completed.length === 0) return;
+			const nextFireAt = (0, __electric_ax_agents_runtime.getNextCronFireAt)(task.cronExpression, task.cronTimezone, task.fireAt);
+			await sql$2`
+        insert into scheduled_tasks (
+          tenant_id,
+          kind,
+          payload,
+          fire_at,
+          cron_expression,
+          cron_timezone,
+          cron_tick_number
+        )
+        values (
+          ${tenantId},
+          'cron_tick',
+          ${JSON.stringify(task.payload)}::jsonb,
+          ${nextFireAt.toISOString()}::timestamptz,
+          ${task.cronExpression},
+          ${task.cronTimezone},
+          ${task.cronTickNumber + 1}
+        )
+        on conflict (tenant_id, cron_expression, cron_timezone, cron_tick_number) do nothing
+      `;
 		});
-		return next;
 	}
-	subscriptionResponseBody(body) {
-		const next = { ...body };
-		if (typeof next.pattern === `string`) next.pattern = this.runtimeSubscriptionPath(next.pattern);
-		if (typeof next.wake_stream === `string`) next.wake_stream = this.runtimeSubscriptionPath(next.wake_stream);
-		if (Array.isArray(next.streams)) next.streams = next.streams.map((stream) => {
-			if (typeof stream === `string`) return this.runtimeSubscriptionPath(stream);
-			return {
-				...stream,
-				path: this.runtimeSubscriptionPath(stream.path)
+	async getNextFireAt() {
+		if (this.tenantId === null) {
+			const tenantIds = this.sharedTenantIds();
+			if (tenantIds && tenantIds.length === 0) return null;
+			if (tenantIds) {
+				const rows$2 = await this.pgClient`
+          select fire_at
+          from scheduled_tasks
+          where tenant_id = any(${this.sharedTenantIdsParameter(tenantIds)})
+            and completed_at is null
+            and claimed_at is null
+          order by fire_at, id
+          limit 1
+        `;
+				if (rows$2.length === 0) return null;
+				const fireAt$2 = rows$2[0].fire_at;
+				return fireAt$2 instanceof Date ? fireAt$2 : new Date(fireAt$2);
+			}
+			const rows$1 = await this.pgClient`
+        select fire_at
+        from scheduled_tasks
+        where completed_at is null
+          and claimed_at is null
+        order by fire_at, id
+        limit 1
+      `;
+			if (rows$1.length === 0) return null;
+			const fireAt$1 = rows$1[0].fire_at;
+			return fireAt$1 instanceof Date ? fireAt$1 : new Date(fireAt$1);
+		}
+		const rows = await this.pgClient`
+      select fire_at
+      from scheduled_tasks
+      where tenant_id = ${this.tenantId}
+        and completed_at is null
+        and claimed_at is null
+      order by fire_at, id
+      limit 1
+    `;
+		if (rows.length === 0) return null;
+		const fireAt = rows[0].fire_at;
+		return fireAt instanceof Date ? fireAt : new Date(fireAt);
+	}
+	async sleepOrWake(durationMs) {
+		if (!this.running) return;
+		await new Promise((resolve$1) => {
+			const finish = () => {
+				if (this.currentSleepTimer) {
+					clearTimeout(this.currentSleepTimer);
+					this.currentSleepTimer = null;
+				}
+				this.currentSleepResolve = null;
+				resolve$1();
 			};
+			this.currentSleepResolve = finish;
+			this.currentSleepTimer = setTimeout(finish, Math.max(durationMs, 0));
 		});
-		if (Array.isArray(next.acks)) next.acks = next.acks.map((ack) => {
-			if (!ack || typeof ack !== `object`) return ack;
-			const mapped = { ...ack };
-			if (typeof mapped.stream === `string`) mapped.stream = this.runtimeSubscriptionPath(mapped.stream);
-			if (typeof mapped.path === `string`) mapped.path = this.runtimeSubscriptionPath(mapped.path);
-			return mapped;
-		});
-		if (typeof next.stream === `string`) next.stream = this.runtimeSubscriptionPath(next.stream);
-		return next;
 	}
-	async subscriptionJson(res, message) {
-		if (!res.ok) throw new DurableStreamsSubscriptionError(message, res.status, await res.text());
-		if (res.status === 204) return {};
-		const text$1 = await res.text();
-		if (!text$1.trim()) return {};
-		return this.subscriptionResponseBody(JSON.parse(text$1));
+	wakeEarly() {
+		const resolve$1 = this.currentSleepResolve;
+		this.currentSleepResolve = null;
+		if (this.currentSleepTimer) {
+			clearTimeout(this.currentSleepTimer);
+			this.currentSleepTimer = null;
+		}
+		resolve$1?.();
 	}
-	async getConsumerState(consumerId) {
-		const res = await fetch(`${this.baseUrl}/consumers/${encodeURIComponent(consumerId)}`, {
-			method: `GET`,
-			headers: await this.requestHeaders()
-		});
-		if (res.status === 404) return null;
-		if (!res.ok) throw new Error(`Consumer query failed: ${res.status} ${await res.text()}`);
-		return res.json();
+	sharedTenantIds() {
+		if (this.tenantId !== null || !this.tenantIds) return null;
+		return [...new Set(this.tenantIds())];
+	}
+	sharedTenantIdsParameter(tenantIds) {
+		return this.pgClient.array(tenantIds, POSTGRES_TEXT_OID);
 	}
 };
 
@@ -4685,7 +4763,7 @@ var ElectricAgentsTenantRuntime = class {
 		this.service = this.serviceId;
 		this.db = options.db;
 		if (options.streamClient) this.streamClient = options.streamClient;
-		else if (options.durableStreamsUrl) this.streamClient = new StreamClient(durableStreamsServiceUrl(options.durableStreamsUrl, this.serviceId), { bearer: options.durableStreamsBearer });
+		else if (options.durableStreamsUrl) this.streamClient = new StreamClient(options.durableStreamsUrl, { bearer: options.durableStreamsBearer });
 		else throw new Error(`Either durableStreamsUrl or streamClient is required`);
 		this.registry = options.registry ?? new PostgresRegistry(this.db, this.serviceId);
 		this.wakeRegistry = options.wakeRegistry;
@@ -5776,7 +5854,7 @@ var AgentsHost = class {
 	}
 	createStreamClient(config) {
 		if (config.streamClient) return config.streamClient;
-		if (config.durableStreamsUrl) return new StreamClient(durableStreamsServiceUrl(config.durableStreamsUrl, config.serviceId), { bearer: config.durableStreamsBearer });
+		if (config.durableStreamsUrl) return new StreamClient(config.durableStreamsUrl, { bearer: config.durableStreamsBearer });
 		throw new Error(`AgentsHost tenant "${config.serviceId}" must provide a streamClient or durableStreamsUrl`);
 	}
 };
@@ -5954,74 +6032,38 @@ function validateParsedBody(schema, parsed) {
 	};
 }
 
-//#endregion
-//#region src/routing/tenant-stream-paths.ts
-function withoutLeadingSlash(path$2) {
-	return path$2.replace(/^\/+/, ``);
-}
-function withLeadingSlash(path$2) {
-	return path$2.startsWith(`/`) ? path$2 : `/${path$2}`;
-}
-function prefixTenantStreamPath(path$2, tenantId) {
-	const normalized = withoutLeadingSlash(path$2);
-	if (!normalized || normalized === tenantId) return tenantId;
-	if (normalized.startsWith(`${tenantId}/`)) return normalized;
-	return `${tenantId}/${normalized}`;
-}
-function stripTenantStreamPrefix(path$2, tenantId) {
-	const normalized = withoutLeadingSlash(path$2);
-	if (normalized === tenantId) return ``;
-	if (normalized.startsWith(`${tenantId}/`)) return normalized.slice(tenantId.length + 1);
-	return normalized;
-}
-
 //#endregion
 //#region src/routing/durable-streams-routing-adapter.ts
 function appendSearch(target, source) {
-	target.search = source.search;
-	return target;
-}
-function removeServiceQuery(target) {
-	target.searchParams.delete(`service`);
+	source.searchParams.forEach((value, key) => {
+		if (key !== `service`) target.searchParams.append(key, value);
+	});
 	return target;
 }
-function logicalStreamPathFromRequest(requestUrl, serviceId) {
-	const incomingUrl = new URL(requestUrl, `http://localhost`);
-	const segments = incomingUrl.pathname.split(`/`).filter(Boolean);
-	if (segments[0] === `v1` && segments[1] === `stream`) return {
-		incomingUrl,
-		streamPath: segments.length > 2 ? `/${segments.slice(3).join(`/`)}` : `/`
-	};
-	return {
-		incomingUrl,
-		streamPath: incomingUrl.pathname || `/${serviceId}`
-	};
-}
-function backendStreamUrl(input, backendStreamPath) {
-	const path$2 = backendStreamPath.replace(/^\/+/, ``);
-	const target = new URL(`/v1/stream/${path$2}`, input.durableStreamsUrl);
-	return target;
+function withoutTrailingSlash(pathname) {
+	return pathname.replace(/\/+$/, ``) || `/`;
 }
-function streamMetaUrlWithoutService(input) {
+function appendRequestPathToStreamRoot(input) {
 	const incomingUrl = new URL(input.requestUrl, `http://localhost`);
-	return removeServiceQuery(appendSearch(new URL(incomingUrl.pathname, input.durableStreamsUrl), incomingUrl));
-}
-const pathPrefixedSingleTenantDurableStreamsRoutingAdapter = {
-	streamUrl(input) {
-		const { incomingUrl, streamPath } = logicalStreamPathFromRequest(input.requestUrl, input.serviceId);
-		const target = backendStreamUrl(input, prefixTenantStreamPath(streamPath, input.serviceId));
-		return removeServiceQuery(appendSearch(target, incomingUrl));
-	},
-	streamMetaUrl: streamMetaUrlWithoutService,
-	toBackendStreamPath(serviceId, streamPath) {
-		return prefixTenantStreamPath(streamPath, serviceId);
+	const path$2 = incomingUrl.pathname.replace(/^\/+/, ``);
+	const target = new URL(input.durableStreamsUrl);
+	target.pathname = path$2 ? `${withoutTrailingSlash(target.pathname)}/${path$2}` : withoutTrailingSlash(target.pathname);
+	return appendSearch(target, incomingUrl);
+}
+const streamRootDurableStreamsRoutingAdapter = {
+	streamUrl: appendRequestPathToStreamRoot,
+	controlUrl: appendRequestPathToStreamRoot,
+	toBackendStreamPath(_serviceId, streamPath) {
+		return streamPath.replace(/^\/+/, ``);
 	},
-	toRuntimeStreamPath(serviceId, streamPath) {
-		return stripTenantStreamPrefix(streamPath, serviceId);
+	toRuntimeStreamPath(_serviceId, streamPath) {
+		return streamPath.replace(/^\/+/, ``);
 	}
 };
-function resolveDurableStreamsRoutingAdapter(adapter) {
-	return adapter ?? pathPrefixedSingleTenantDurableStreamsRoutingAdapter;
+const pathPrefixedSingleTenantDurableStreamsRoutingAdapter = streamRootDurableStreamsRoutingAdapter;
+const tenantRootDurableStreamsRoutingAdapter = streamRootDurableStreamsRoutingAdapter;
+function resolveDurableStreamsRoutingAdapter(adapter, _durableStreamsUrl) {
+	return adapter ?? streamRootDurableStreamsRoutingAdapter;
 }
 
 //#endregion
@@ -6043,8 +6085,11 @@ function buildElectricProxyTarget(options) {
 		target.searchParams.set(`columns`, `"tenant_id","name","description","creation_schema","inbox_schemas","state_schemas","serve_endpoint","default_dispatch_policy","revision","created_at","updated_at"`);
 		applyTenantShapeWhere(target, options.tenantId);
 	} else if (table === `runners`) {
-		target.searchParams.set(`columns`, `"tenant_id","id","owner_user_id","label","kind","admin_status","wake_stream","wake_stream_offset","last_seen_at","liveness_lease_expires_at","created_at","updated_at"`);
-		applyTenantShapeWhere(target, options.tenantId);
+		target.searchParams.set(`columns`, `"tenant_id","id","owner_principal","label","kind","admin_status","wake_stream","created_at","updated_at"`);
+		applyTenantShapeWhere(target, options.tenantId, [`owner_principal = ${sqlStringLiteral(options.principalUrl ?? ``)}`]);
+	} else if (table === `runner_runtime_diagnostics`) {
+		target.searchParams.set(`columns`, `"tenant_id","runner_id","owner_principal","wake_stream_offset","last_seen_at","liveness_lease_expires_at","diagnostics","updated_at"`);
+		applyTenantShapeWhere(target, options.tenantId, [`owner_principal = ${sqlStringLiteral(options.principalUrl ?? ``)}`]);
 	} else if (table === `entity_dispatch_state`) {
 		target.searchParams.set(`columns`, `"tenant_id","entity_url","pending_source_streams","pending_reason","pending_since","outstanding_wake_id","outstanding_wake_target","outstanding_wake_created_at","active_consumer_id","active_runner_id","active_epoch","active_claimed_at","active_lease_expires_at","last_wake_id","last_claimed_at","last_released_at","last_completed_at","last_error","updated_at"`);
 		applyTenantShapeWhere(target, options.tenantId);
@@ -6058,13 +6103,13 @@ function buildElectricProxyTarget(options) {
 	return target;
 }
 async function forwardFetchRequest(options) {
-	const routingAdapter = resolveDurableStreamsRoutingAdapter(options.durableStreamsRouting);
+	const routingAdapter = resolveDurableStreamsRoutingAdapter(options.durableStreamsRouting, options.durableStreamsUrl);
 	const routingInput = {
 		durableStreamsUrl: options.durableStreamsUrl,
 		serviceId: options.serviceId,
 		requestUrl: options.request.url
 	};
-	const upstreamUrl = options.route === `stream-meta` ? routingAdapter.streamMetaUrl(routingInput) : routingAdapter.streamUrl(routingInput);
+	const upstreamUrl = options.route === `control` ? routingAdapter.controlUrl(routingInput) : routingAdapter.streamUrl(routingInput);
 	const headers = new Headers(options.request.headers);
 	if (options.durableStreamsBearerMode !== `none`) await applyDurableStreamsBearer(headers, options.durableStreamsBearer, { overwrite: options.durableStreamsBearerMode !== `if-missing` });
 	const init = {
@@ -6090,8 +6135,8 @@ function decodeJsonObject(body) {
 	} catch {}
 	return null;
 }
-function applyTenantShapeWhere(target, tenantId) {
-	const tenantWhere = `tenant_id = ${sqlStringLiteral(tenantId)}`;
+function applyTenantShapeWhere(target, tenantId, extraConditions = []) {
+	const tenantWhere = [`tenant_id = ${sqlStringLiteral(tenantId)}`, ...extraConditions].join(` AND `);
 	const existingWhere = target.searchParams.get(`where`);
 	target.searchParams.set(`where`, existingWhere ? `${tenantWhere} AND (${existingWhere})` : tenantWhere);
 }
@@ -6102,8 +6147,21 @@ function sqlStringLiteral(value) {
 //#endregion
 //#region src/routing/durable-streams-router.ts
 const subscriptionProxyBodySchema = __sinclair_typebox.Type.Object({ webhook: __sinclair_typebox.Type.Optional(__sinclair_typebox.Type.Object({ url: __sinclair_typebox.Type.String() }, { additionalProperties: true })) }, { additionalProperties: true });
+const subscriptionControlActions = [
+	`callback`,
+	`claim`,
+	`ack`,
+	`release`
+];
 const durableStreamsRouter = (0, itty_router.Router)();
-durableStreamsRouter.all(`/v1/stream-meta/subscriptions/*`, subscriptionProxy);
+durableStreamsRouter.put(`/__ds/subscriptions/:subscriptionId`, putSubscriptionBase);
+durableStreamsRouter.get(`/__ds/subscriptions/:subscriptionId`, getSubscriptionBase);
+durableStreamsRouter.delete(`/__ds/subscriptions/:subscriptionId`, deleteSubscriptionBase);
+durableStreamsRouter.post(`/__ds/subscriptions/:subscriptionId/streams`, postSubscriptionStreams);
+durableStreamsRouter.delete(`/__ds/subscriptions/:subscriptionId/streams/:streamPath+`, deleteSubscriptionStream);
+for (const action of subscriptionControlActions) durableStreamsRouter.post(`/__ds/subscriptions/:subscriptionId/${action}`, subscriptionAction(action));
+durableStreamsRouter.all(`/__ds`, controlPassThrough);
+durableStreamsRouter.all(`/__ds/*`, controlPassThrough);
 durableStreamsRouter.post(`*`, streamAppend);
 durableStreamsRouter.all(`*`, proxyPassThrough);
 function bodyFromBytes$1(body) {
@@ -6116,7 +6174,7 @@ function responseFromUpstream$1(response, body) {
 		headers: responseHeaders(response)
 	});
 }
-async function forwardToDurableStreams(ctx, request, body, route = `stream`, urlOverride) {
+async function forwardToDurableStreams(ctx, request, body, route = `stream`, urlOverride, durableStreamsBearerMode = `overwrite`) {
 	const headers = new Headers(request.headers);
 	headers.delete(`host`);
 	let requestBody = body;
@@ -6130,24 +6188,13 @@ async function forwardToDurableStreams(ctx, request, body, route = `stream`, url
 		body: requestBody,
 		durableStreamsUrl: ctx.durableStreamsUrl,
 		durableStreamsBearer: ctx.durableStreamsBearer,
-		durableStreamsBearerMode: usesSubscriptionScopedBearer(urlOverride ?? request.url) ? `if-missing` : `overwrite`,
+		durableStreamsBearerMode,
 		durableStreamsRouting: ctx.durableStreamsRouting,
 		serviceId: ctx.service,
 		dispatcher: ctx.durableStreamsDispatcher,
 		route
 	});
 }
-function subscriptionIdFromPath(pathname) {
-	const match = /^\/v1\/stream-meta\/subscriptions\/([^/]+)(?:\/.*)?$/.exec(pathname);
-	return match ? decodeURIComponent(match[1]) : null;
-}
-function isSubscriptionBasePath(pathname) {
-	return /^\/v1\/stream-meta\/subscriptions\/[^/]+\/?$/.test(pathname);
-}
-function usesSubscriptionScopedBearer(requestUrl) {
-	const pathname = new URL(requestUrl, `http://localhost`).pathname;
-	return /^\/v1\/stream-meta\/subscriptions\/[^/]+\/(?:ack|release|callback)\/?$/.test(pathname);
-}
 function rewriteSubscriptionBodyForBackend(payload, service, routingAdapter) {
 	if (typeof payload.pattern === `string`) payload.pattern = routingAdapter.toBackendStreamPath(service, payload.pattern);
 	if (Array.isArray(payload.streams)) payload.streams = payload.streams.map((stream) => typeof stream === `string` ? routingAdapter.toBackendStreamPath(service, stream) : stream);
@@ -6192,44 +6239,50 @@ function decodeJson(bytes) {
 		return null;
 	}
 }
-function rewriteSubscriptionStreamPathInUrl(requestUrl, service, routingAdapter) {
-	const match = /^(\/v1\/stream-meta\/subscriptions\/[^/]+\/streams\/)(.+)$/.exec(requestUrl.pathname);
-	if (!match) return requestUrl.toString();
-	const [, prefix, encodedPath] = match;
-	const streamPath = decodeURIComponent(encodedPath);
-	requestUrl.pathname = `${prefix}${encodeURIComponent(routingAdapter.toBackendStreamPath(service, streamPath))}`;
-	return requestUrl.toString();
+function routeParam$2(request, name) {
+	const value = request.params[name];
+	const raw = Array.isArray(value) ? value[0] : value;
+	return decodeURIComponent(raw ?? ``);
 }
-async function subscriptionProxy(request, ctx) {
-	const url = new URL(request.url);
-	const subscriptionId = subscriptionIdFromPath(url.pathname);
-	if (!subscriptionId) return void 0;
-	const routingAdapter = resolveDurableStreamsRoutingAdapter(ctx.durableStreamsRouting);
-	let requestBody;
+function subscriptionRoutingAdapter(ctx) {
+	return resolveDurableStreamsRoutingAdapter(ctx.durableStreamsRouting, ctx.durableStreamsUrl);
+}
+async function rewriteSubscriptionRequestBody(request, ctx, subscriptionId, routingAdapter) {
+	const body = await readRequestBody(request);
+	if (body.length === 0) return {
+		ok: true,
+		body,
+		targetWebhookUrl: null
+	};
+	const validation = validateBody(subscriptionProxyBodySchema, body);
+	if (!validation.ok) return {
+		ok: false,
+		response: validation.response
+	};
+	const payload = validation.value;
 	let targetWebhookUrl = null;
-	let requestUrl = request.url;
-	if ([`PUT`, `POST`].includes(request.method.toUpperCase())) {
-		requestBody = await readRequestBody(request);
-		if (requestBody.length > 0) {
-			const validation = validateBody(subscriptionProxyBodySchema, requestBody);
-			if (!validation.ok) return validation.response;
-			const payload = validation.value;
-			if (payload.webhook?.url !== void 0) {
-				targetWebhookUrl = rewriteLoopbackWebhookUrl(payload.webhook.url) ?? null;
-				payload.webhook.url = (0, __electric_ax_agents_runtime.appendPathToUrl)(ctx.publicUrl, `/_electric/webhook-forward/${encodeURIComponent(subscriptionId)}`);
-			}
-			rewriteSubscriptionBodyForBackend(payload, ctx.service, routingAdapter);
-			requestBody = new TextEncoder().encode(JSON.stringify(payload));
-		}
+	if (payload.webhook?.url !== void 0) {
+		targetWebhookUrl = rewriteLoopbackWebhookUrl(payload.webhook.url) ?? null;
+		payload.webhook.url = (0, __electric_ax_agents_runtime.appendPathToUrl)(ctx.publicUrl, `/_electric/webhook-forward/${encodeURIComponent(subscriptionId)}`);
 	}
-	if (request.method.toUpperCase() === `DELETE` && /\/streams\/.+$/.test(url.pathname)) requestUrl = rewriteSubscriptionStreamPathInUrl(url, ctx.service, routingAdapter);
-	const upstream = await forwardToDurableStreams(ctx, request, requestBody, `stream-meta`, requestUrl);
+	rewriteSubscriptionBodyForBackend(payload, ctx.service, routingAdapter);
+	return {
+		ok: true,
+		body: new TextEncoder().encode(JSON.stringify(payload)),
+		targetWebhookUrl
+	};
+}
+async function forwardSubscriptionRequest(request, ctx, routingAdapter, opts = {}) {
+	const upstream = await forwardToDurableStreams(ctx, request, opts.body, `control`, opts.requestUrl, opts.bearerMode ?? `overwrite`);
 	let responseBytes = upstream.body ? new Uint8Array(await upstream.arrayBuffer()) : new Uint8Array();
 	responseBytes = rewriteSubscriptionResponseForClient(responseBytes, upstream, ctx.service, routingAdapter);
-	const response = responseFromUpstream$1(upstream, responseBytes);
-	if (!upstream.ok) return response;
-	if (request.method.toUpperCase() === `DELETE` && isSubscriptionBasePath(url.pathname)) await ctx.pgDb.delete(subscriptionWebhooks).where((0, drizzle_orm.and)((0, drizzle_orm.eq)(subscriptionWebhooks.tenantId, ctx.service), (0, drizzle_orm.eq)(subscriptionWebhooks.subscriptionId, subscriptionId)));
-	else if (targetWebhookUrl) await ctx.pgDb.insert(subscriptionWebhooks).values({
+	return {
+		upstream,
+		response: responseFromUpstream$1(upstream, responseBytes)
+	};
+}
+async function upsertSubscriptionWebhook(ctx, subscriptionId, targetWebhookUrl) {
+	await ctx.pgDb.insert(subscriptionWebhooks).values({
 		tenantId: ctx.service,
 		subscriptionId,
 		webhookUrl: targetWebhookUrl
@@ -6237,8 +6290,64 @@ async function subscriptionProxy(request, ctx) {
 		target: [subscriptionWebhooks.tenantId, subscriptionWebhooks.subscriptionId],
 		set: { webhookUrl: targetWebhookUrl }
 	});
+}
+async function deleteSubscriptionWebhook(ctx, subscriptionId) {
+	await ctx.pgDb.delete(subscriptionWebhooks).where((0, drizzle_orm.and)((0, drizzle_orm.eq)(subscriptionWebhooks.tenantId, ctx.service), (0, drizzle_orm.eq)(subscriptionWebhooks.subscriptionId, subscriptionId)));
+}
+function rewriteSubscriptionStreamPathInUrl(requestUrl, service, routingAdapter, streamPath) {
+	const prefix = requestUrl.pathname.slice(0, requestUrl.pathname.indexOf(`/streams/`) + `/streams/`.length);
+	requestUrl.pathname = `${prefix}${encodeURIComponent(routingAdapter.toBackendStreamPath(service, streamPath))}`;
+	return requestUrl.toString();
+}
+async function putSubscriptionBase(request, ctx) {
+	const subscriptionId = routeParam$2(request, `subscriptionId`);
+	const routingAdapter = subscriptionRoutingAdapter(ctx);
+	const rewrite = await rewriteSubscriptionRequestBody(request, ctx, subscriptionId, routingAdapter);
+	if (!rewrite.ok) return rewrite.response;
+	const { upstream, response } = await forwardSubscriptionRequest(request, ctx, routingAdapter, { body: rewrite.body });
+	if (upstream.ok && rewrite.targetWebhookUrl) await upsertSubscriptionWebhook(ctx, subscriptionId, rewrite.targetWebhookUrl);
+	return response;
+}
+async function getSubscriptionBase(request, ctx) {
+	const routingAdapter = subscriptionRoutingAdapter(ctx);
+	return (await forwardSubscriptionRequest(request, ctx, routingAdapter)).response;
+}
+async function deleteSubscriptionBase(request, ctx) {
+	const subscriptionId = routeParam$2(request, `subscriptionId`);
+	const routingAdapter = subscriptionRoutingAdapter(ctx);
+	const { upstream, response } = await forwardSubscriptionRequest(request, ctx, routingAdapter);
+	if (upstream.ok) await deleteSubscriptionWebhook(ctx, subscriptionId);
 	return response;
 }
+async function postSubscriptionStreams(request, ctx) {
+	const subscriptionId = routeParam$2(request, `subscriptionId`);
+	const routingAdapter = subscriptionRoutingAdapter(ctx);
+	const rewrite = await rewriteSubscriptionRequestBody(request, ctx, subscriptionId, routingAdapter);
+	if (!rewrite.ok) return rewrite.response;
+	return (await forwardSubscriptionRequest(request, ctx, routingAdapter, { body: rewrite.body })).response;
+}
+async function deleteSubscriptionStream(request, ctx) {
+	const routingAdapter = subscriptionRoutingAdapter(ctx);
+	const requestUrl = rewriteSubscriptionStreamPathInUrl(new URL(request.url), ctx.service, routingAdapter, routeParam$2(request, `streamPath`));
+	return (await forwardSubscriptionRequest(request, ctx, routingAdapter, { requestUrl })).response;
+}
+function subscriptionAction(action) {
+	return async (request, ctx) => {
+		const subscriptionId = routeParam$2(request, `subscriptionId`);
+		const routingAdapter = subscriptionRoutingAdapter(ctx);
+		const rewrite = await rewriteSubscriptionRequestBody(request, ctx, subscriptionId, routingAdapter);
+		if (!rewrite.ok) return rewrite.response;
+		const bearerMode = action === `ack` || action === `release` || action === `callback` ? `if-missing` : `overwrite`;
+		return (await forwardSubscriptionRequest(request, ctx, routingAdapter, {
+			body: rewrite.body,
+			bearerMode
+		})).response;
+	};
+}
+async function controlPassThrough(request, ctx) {
+	const upstream = await forwardToDurableStreams(ctx, request, void 0, `control`);
+	return responseFromUpstream$1(upstream);
+}
 async function streamAppend(request, ctx) {
 	return await electricAgentsStreamAppendRouter.fetch(createStreamAppendRouteRequest(request), ctx.runtime, (req, body) => forwardFetchRequest({
 		request: {
@@ -6259,10 +6368,9 @@ async function proxyPassThrough(request, ctx) {
 	const upstream = await forwardToDurableStreams(ctx, request);
 	const streamPath = new URL(request.url).pathname;
 	const method = request.method.toUpperCase();
-	const isControlPath = streamPath.startsWith(`/v1/stream-meta/`);
-	const endTrackedRead = method === `GET` && !isControlPath ? await ctx.entityBridgeManager.beginClientRead(streamPath) : null;
+	const endTrackedRead = method === `GET` ? await ctx.entityBridgeManager.beginClientRead(streamPath) : null;
 	try {
-		if (method === `HEAD` && !isControlPath) await ctx.entityBridgeManager.touchByStreamPath(streamPath);
+		if (method === `HEAD`) await ctx.entityBridgeManager.touchByStreamPath(streamPath);
 		return responseFromUpstream$1(upstream);
 	} finally {
 		await endTrackedRead?.();
@@ -6293,7 +6401,8 @@ async function proxyElectric(request, ctx) {
 		incomingUrl: new URL(request.url),
 		electricUrl: ctx.electricUrl,
 		electricSecret: ctx.electricSecret,
-		tenantId: ctx.service
+		tenantId: ctx.service,
+		principalUrl: ctx.principal.url
 	});
 	const headers = new Headers(request.headers);
 	headers.delete(`host`);
@@ -6554,10 +6663,8 @@ async function sendEntity(request, ctx) {
 	if (parsed.from !== void 0 && parsed.from !== principal.url) return apiError(400, ErrCodeInvalidRequest, `Request from must match Electric-Principal`);
 	await ctx.entityManager.ensurePrincipal(principal);
 	const { entityUrl, entity } = requireExistingEntityRoute(request);
-	if (!entity.dispatch_policy) {
-		const updatedEntity = await backfillEntityDispatchPolicy(ctx, entity);
-		await linkEntityDispatchSubscription(ctx, updatedEntity);
-	}
+	const dispatchEntity = entity.dispatch_policy ? entity : await backfillEntityDispatchPolicy(ctx, entity);
+	await linkEntityDispatchSubscription(ctx, dispatchEntity);
 	if (parsed.afterMs && parsed.afterMs > 0) await ctx.entityManager.enqueueDelayedSend(entityUrl, {
 		from: principal.url,
 		payload: parsed.payload,
@@ -6606,11 +6713,11 @@ async function spawnEntity(request, ctx) {
 		wake: parsed.wake,
 		created_by: principal.url
 	});
+	await linkEntityDispatchSubscription(ctx, entity);
 	if (parsed.initialMessage !== void 0) await ctx.entityManager.send(entity.url, {
 		from: principal.url,
 		payload: parsed.initialMessage
 	});
-	await linkEntityDispatchSubscription(ctx, entity);
 	return (0, itty_router.json)({
 		...toPublicEntity(entity),
 		txid: entity.txid
@@ -6774,7 +6881,13 @@ function applyCors(response) {
 	const headers = new Headers(response.headers);
 	headers.set(`access-control-allow-origin`, `*`);
 	headers.set(`access-control-allow-methods`, `GET, POST, PUT, PATCH, DELETE, OPTIONS`);
-	headers.set(`access-control-allow-headers`, `content-type, authorization, electric-claim-token, ngrok-skip-browser-warning`);
+	headers.set(`access-control-allow-headers`, [
+		`content-type`,
+		`authorization`,
+		`electric-claim-token`,
+		ELECTRIC_PRINCIPAL_HEADER,
+		`ngrok-skip-browser-warning`
+	].join(`, `));
 	headers.set(`access-control-expose-headers`, `*`);
 	return new Response(response.body, {
 		status: response.status,
@@ -6809,11 +6922,17 @@ function getRequestSpan(req) {
 	return carrier(req)[SPAN_KEY];
 }
 
+//#endregion
+//#region src/routing/tenant-stream-paths.ts
+function withLeadingSlash(path$2) {
+	return path$2.startsWith(`/`) ? path$2 : `/${path$2}`;
+}
+
 //#endregion
 //#region src/routing/runners-router.ts
 const registerRunnerBodySchema = __sinclair_typebox.Type.Object({
 	id: __sinclair_typebox.Type.String(),
-	owner_user_id: __sinclair_typebox.Type.Optional(__sinclair_typebox.Type.String()),
+	owner_principal: __sinclair_typebox.Type.Optional(__sinclair_typebox.Type.String()),
 	label: __sinclair_typebox.Type.String(),
 	kind: __sinclair_typebox.Type.Optional(__sinclair_typebox.Type.Union([
 		__sinclair_typebox.Type.Literal(`local`),
@@ -6829,7 +6948,8 @@ const heartbeatBodySchema = __sinclair_typebox.Type.Object({
 	lease_ms: __sinclair_typebox.Type.Optional(__sinclair_typebox.Type.Number()),
 	wake_stream_offset: __sinclair_typebox.Type.Optional(__sinclair_typebox.Type.String()),
 	wakeStreamOffset: __sinclair_typebox.Type.Optional(__sinclair_typebox.Type.String()),
-	liveness_lease_expires_at: __sinclair_typebox.Type.Optional(__sinclair_typebox.Type.String())
+	liveness_lease_expires_at: __sinclair_typebox.Type.Optional(__sinclair_typebox.Type.String()),
+	diagnostics: __sinclair_typebox.Type.Optional(__sinclair_typebox.Type.Record(__sinclair_typebox.Type.String(), __sinclair_typebox.Type.Unknown()))
 });
 const claimBodySchema = __sinclair_typebox.Type.Object({
 	subscription_id: __sinclair_typebox.Type.Optional(__sinclair_typebox.Type.String()),
@@ -6837,9 +6957,39 @@ const claimBodySchema = __sinclair_typebox.Type.Object({
 	generation: __sinclair_typebox.Type.Optional(__sinclair_typebox.Type.Number()),
 	ts: __sinclair_typebox.Type.Optional(__sinclair_typebox.Type.Union([__sinclair_typebox.Type.String(), __sinclair_typebox.Type.Number()]))
 }, { additionalProperties: true });
+const runnerClientStatuses = new Set([
+	`stopped`,
+	`starting`,
+	`connecting`,
+	`streaming`,
+	`reconnecting`,
+	`stopping`
+]);
+const runnerLastClaimResults = new Set([
+	`claimed`,
+	`no_work`,
+	`error`
+]);
+const runnerStringOrNullDiagnostics = [
+	`started_at`,
+	`stream_connected_since`,
+	`last_error`,
+	`last_error_at`,
+	`last_heartbeat_at`,
+	`last_claim_at`,
+	`last_dispatch_at`
+];
+const runnerNumberDiagnostics = [
+	`reconnect_count`,
+	`events_received`,
+	`claims_succeeded`,
+	`claims_skipped`,
+	`claims_failed`
+];
 const runnersRouter = (0, itty_router.Router)({ base: `/_electric/runners` });
 runnersRouter.post(`/`, withSchema(registerRunnerBodySchema), registerRunner);
 runnersRouter.get(`/`, listRunners);
+runnersRouter.get(`/:id/health`, runnerHealth);
 runnersRouter.get(`/:id`, getRunner);
 runnersRouter.post(`/:id/heartbeat`, withSchema(heartbeatBodySchema), heartbeat);
 runnersRouter.post(`/:id/enable`, setEnabled);
@@ -6852,14 +7002,41 @@ function routeParam$1(request, name) {
 function firstQueryValue(value) {
 	return Array.isArray(value) ? value[0] : value;
 }
+function requireAuthenticatedPrincipal(ctx) {
+	if (ctx.principal) return ctx.principal;
+	throw new ElectricAgentsError(ErrCodeUnauthorized, `Runner route requires an authenticated principal`, 401);
+}
+function canonicalOwnerPrincipal(input) {
+	return parsePrincipalUrl(input)?.url ?? null;
+}
+function sanitizeRunnerDiagnostics(diagnostics) {
+	if (!diagnostics) return void 0;
+	const sanitized = {};
+	if (typeof diagnostics.status === `string` && runnerClientStatuses.has(diagnostics.status)) sanitized.status = diagnostics.status;
+	if (typeof diagnostics.stream_connected === `boolean`) sanitized.stream_connected = diagnostics.stream_connected;
+	if (typeof diagnostics.last_heartbeat_ok === `boolean`) sanitized.last_heartbeat_ok = diagnostics.last_heartbeat_ok;
+	if (diagnostics.last_claim_result === null || typeof diagnostics.last_claim_result === `string` && runnerLastClaimResults.has(diagnostics.last_claim_result)) sanitized.last_claim_result = diagnostics.last_claim_result;
+	for (const key of runnerStringOrNullDiagnostics) {
+		const value = diagnostics[key];
+		if (typeof value === `string` || value === null) sanitized[key] = value;
+	}
+	for (const key of runnerNumberDiagnostics) {
+		const value = diagnostics[key];
+		if (typeof value === `number` && Number.isFinite(value) && value >= 0) sanitized[key] = value;
+	}
+	return Object.keys(sanitized).length > 0 ? sanitized : void 0;
+}
 async function registerRunner(request, ctx) {
 	const parsed = routeBody(request);
-	const ownerUserId = parsed.owner_user_id ?? ctx.principal?.key;
-	if (!ownerUserId) throw new ElectricAgentsError(ErrCodeInvalidRequest, `owner_user_id is required when no authenticated user is present`, 400);
-	if (ctx.principal && ownerUserId !== ctx.principal.key) throw new ElectricAgentsError(ErrCodeUnauthorized, `owner_user_id must match the authenticated user`, 403);
+	const principal = requireAuthenticatedPrincipal(ctx);
+	const ownerPrincipal = parsed.owner_principal ?? principal.url;
+	if (!ownerPrincipal) throw new ElectricAgentsError(ErrCodeInvalidRequest, `owner_principal is required when no authenticated principal is present`, 400);
+	const canonicalOwner = canonicalOwnerPrincipal(ownerPrincipal);
+	if (!canonicalOwner) throw new ElectricAgentsError(ErrCodeInvalidRequest, `owner_principal must be a valid principal URL (e.g. /principal/user%3Aalice), got: ${ownerPrincipal}`, 400);
+	if (canonicalOwner !== principal.url) throw new ElectricAgentsError(ErrCodeUnauthorized, `owner_principal must match the authenticated principal`, 403);
 	const runner = await ctx.entityManager.registry.createRunner({
 		id: parsed.id,
-		ownerUserId,
+		ownerPrincipal: canonicalOwner,
 		label: parsed.label,
 		kind: parsed.kind,
 		adminStatus: parsed.admin_status,
@@ -6869,26 +7046,32 @@ async function registerRunner(request, ctx) {
 	return (0, itty_router.json)(runner, { status: 201 });
 }
 async function listRunners(request, ctx) {
-	const requestedOwner = firstQueryValue(request.query.owner_user_id);
-	if (ctx.principal && requestedOwner && requestedOwner !== ctx.principal.key) throw new ElectricAgentsError(ErrCodeUnauthorized, `owner_user_id must match the authenticated user`, 403);
-	const runners$1 = await ctx.entityManager.registry.listRunners({ ownerUserId: ctx.principal?.key ?? requestedOwner });
+	const principal = requireAuthenticatedPrincipal(ctx);
+	const requestedOwner = firstQueryValue(request.query.owner_principal);
+	const canonicalRequestedOwner = requestedOwner ? canonicalOwnerPrincipal(requestedOwner) : void 0;
+	if (requestedOwner && !canonicalRequestedOwner) throw new ElectricAgentsError(ErrCodeInvalidRequest, `owner_principal must be a valid principal URL (e.g. /principal/user%3Aalice), got: ${requestedOwner}`, 400);
+	if (canonicalRequestedOwner && canonicalRequestedOwner !== principal.url) throw new ElectricAgentsError(ErrCodeUnauthorized, `owner_principal must match the authenticated principal`, 403);
+	const runners$1 = await ctx.entityManager.registry.listRunners({ ownerPrincipal: principal.url });
 	return (0, itty_router.json)(runners$1);
 }
 async function getRunner(request, ctx) {
 	const runner = await requireRunner(ctx, routeParam$1(request, `id`));
-	assertRunnerOwnerIfAuthenticated(ctx, runner.owner_user_id);
+	assertRunnerOwnerIfAuthenticated(ctx, runner.owner_principal);
 	return (0, itty_router.json)(runner);
 }
 async function heartbeat(request, ctx) {
 	const runnerId = routeParam$1(request, `id`);
+	requireAuthenticatedPrincipal(ctx);
 	const existing = await requireRunner(ctx, runnerId);
-	assertRunnerOwnerIfAuthenticated(ctx, existing.owner_user_id);
+	assertRunnerOwnerIfAuthenticated(ctx, existing.owner_principal);
 	const parsed = routeBody(request);
 	const runner = await ctx.entityManager.registry.heartbeatRunner({
 		runnerId,
+		ownerPrincipal: existing.owner_principal,
 		leaseMs: parsed.lease_ms,
 		wakeStreamOffset: parsed.wake_stream_offset ?? parsed.wakeStreamOffset,
-		livenessLeaseExpiresAt: parsed.liveness_lease_expires_at ? new Date(parsed.liveness_lease_expires_at) : void 0
+		livenessLeaseExpiresAt: parsed.liveness_lease_expires_at ? new Date(parsed.liveness_lease_expires_at) : void 0,
+		diagnostics: sanitizeRunnerDiagnostics(parsed.diagnostics)
 	});
 	if (!runner) throw new ElectricAgentsError(ErrCodeNotFound, `Runner not found`, 404);
 	return (0, itty_router.json)(runner);
@@ -6901,16 +7084,18 @@ async function setDisabled(request, ctx) {
 }
 async function setRunnerStatus(request, ctx, adminStatus) {
 	const runnerId = routeParam$1(request, `id`);
+	requireAuthenticatedPrincipal(ctx);
 	const existing = await requireRunner(ctx, runnerId);
-	assertRunnerOwnerIfAuthenticated(ctx, existing.owner_user_id);
+	assertRunnerOwnerIfAuthenticated(ctx, existing.owner_principal);
 	const runner = await ctx.entityManager.registry.setRunnerAdminStatus(runnerId, adminStatus);
 	if (!runner) throw new ElectricAgentsError(ErrCodeNotFound, `Runner not found`, 404);
 	return (0, itty_router.json)(runner);
 }
 async function claimWake(request, ctx) {
 	const runnerId = routeParam$1(request, `id`);
+	const principal = requireAuthenticatedPrincipal(ctx);
 	const runner = await requireRunner(ctx, runnerId);
-	if (ctx.principal && runner.owner_user_id !== ctx.principal.key) throw new ElectricAgentsError(ErrCodeUnauthorized, `Runner claim requires the authenticated owner`, 403);
+	if (runner.owner_principal !== principal.url) throw new ElectricAgentsError(ErrCodeUnauthorized, `Runner claim requires the authenticated owner`, 403);
 	if (runner.admin_status !== `enabled`) throw new ElectricAgentsError(ErrCodeNotRunning, `Runner is disabled`, 409);
 	const parsed = routeBody(request);
 	const expectedSubscriptionId = subscriptionIdForDispatchTarget({
@@ -6941,11 +7126,95 @@ async function requireRunner(ctx, runnerId) {
 	if (!runner) throw new ElectricAgentsError(ErrCodeNotFound, `Runner not found`, 404);
 	return runner;
 }
-function assertRunnerOwnerIfAuthenticated(ctx, ownerUserId) {
-	if (!ctx.principal) return;
-	if (ownerUserId === ctx.principal.key) return;
+function assertRunnerOwnerIfAuthenticated(ctx, ownerPrincipal) {
+	requireAuthenticatedPrincipal(ctx);
+	if (ownerPrincipal === ctx.principal.url) return;
 	throw new ElectricAgentsError(ErrCodeUnauthorized, `Runner access requires the authenticated owner`, 403);
 }
+async function runnerHealth(request, ctx) {
+	const runnerId = routeParam$1(request, `id`);
+	const runner = await requireRunner(ctx, runnerId);
+	assertRunnerOwnerIfAuthenticated(ctx, runner.owner_principal);
+	const runtimeDiagnostics = await ctx.entityManager.registry.getRunnerDiagnostics(runnerId);
+	const now = Date.now();
+	const parsedLeaseExpiresAt = runtimeDiagnostics?.liveness_lease_expires_at ? new Date(runtimeDiagnostics.liveness_lease_expires_at).getTime() : null;
+	const leaseExpiresAt = parsedLeaseExpiresAt !== null && Number.isFinite(parsedLeaseExpiresAt) ? parsedLeaseExpiresAt : null;
+	let livenessStatus;
+	if (runner.admin_status === `disabled`) livenessStatus = `offline`;
+	else if (leaseExpiresAt !== null && leaseExpiresAt > now) livenessStatus = `online`;
+	else if (leaseExpiresAt !== null) livenessStatus = `expired`;
+	else livenessStatus = `offline`;
+	const [activeClaims, dispatchStats] = await Promise.all([ctx.entityManager.registry.getActiveClaimsForRunner(runnerId), ctx.entityManager.registry.getDispatchStatsForRunner(runnerId)]);
+	const clientDiagnostics = sanitizeRunnerDiagnostics(runtimeDiagnostics?.diagnostics) ?? null;
+	const issues = [];
+	let healthStatus = `healthy`;
+	const escalate = (floor) => {
+		if (floor === `unhealthy`) healthStatus = `unhealthy`;
+		else if (healthStatus === `healthy`) healthStatus = `degraded`;
+	};
+	if (runner.admin_status === `disabled`) {
+		escalate(`unhealthy`);
+		issues.push(`Runner is disabled`);
+	}
+	if (livenessStatus === `expired`) {
+		escalate(`unhealthy`);
+		const ago = leaseExpiresAt ? Math.round((now - leaseExpiresAt) / 1e3) : 0;
+		issues.push(`Heartbeat lease expired ${ago}s ago`);
+	}
+	if (livenessStatus === `offline` && runner.admin_status === `enabled`) {
+		escalate(`degraded`);
+		issues.push(`Runner has never sent a heartbeat`);
+	}
+	if (clientDiagnostics) {
+		if (clientDiagnostics.stream_connected === false) {
+			escalate(`degraded`);
+			issues.push(`Client reports stream disconnected`);
+		}
+		if (clientDiagnostics.last_heartbeat_ok === false) {
+			escalate(`degraded`);
+			issues.push(`Client reports last heartbeat failed`);
+		}
+		if (typeof clientDiagnostics.reconnect_count === `number` && clientDiagnostics.reconnect_count > 5) {
+			escalate(`degraded`);
+			issues.push(`Client has reconnected ${clientDiagnostics.reconnect_count} times`);
+		}
+	} else if (runtimeDiagnostics?.last_seen_at) {
+		escalate(`degraded`);
+		issues.push(`No client diagnostics available`);
+	}
+	const body = {
+		runner: {
+			id: runner.id,
+			admin_status: runner.admin_status,
+			liveness_status: livenessStatus,
+			lease_expires_at: leaseExpiresAt !== null ? runtimeDiagnostics?.liveness_lease_expires_at ?? null : null,
+			lease_remaining_ms: leaseExpiresAt !== null ? Math.max(0, leaseExpiresAt - now) : null,
+			wake_stream: runner.wake_stream,
+			wake_stream_offset: runtimeDiagnostics?.wake_stream_offset ?? null,
+			last_seen_at: runtimeDiagnostics?.last_seen_at ?? null,
+			created_at: runner.created_at
+		},
+		client: clientDiagnostics,
+		claims: {
+			active_count: activeClaims.length,
+			active: activeClaims.map((c) => ({
+				consumer_id: c.consumer_id,
+				epoch: c.epoch,
+				entity_url: c.entity_url,
+				stream_path: c.stream_path,
+				claimed_at: c.claimed_at,
+				last_heartbeat_at: c.last_heartbeat_at ?? null,
+				lease_expires_at: c.lease_expires_at ?? null
+			}))
+		},
+		dispatch: dispatchStats,
+		health: {
+			status: healthStatus,
+			issues
+		}
+	};
+	return (0, itty_router.json)(body);
+}
 async function notificationFromClaim(ctx, input) {
 	const primary = input.claim.streams.find((stream) => stream.has_pending === true) ?? input.claim.streams[0];
 	if (!primary?.path) throw new ElectricAgentsError(ErrCodeInvalidRequest, `Claim response did not include a stream`, 502);
@@ -7132,7 +7401,7 @@ async function webhookForward(request, ctx) {
 	let runningEntityUrl = null;
 	const parsedBody = parsedBodyResult.value;
 	const newWebhook = newWebhookPayload(parsedBody);
-	const routingAdapter = resolveDurableStreamsRoutingAdapter(ctx.durableStreamsRouting);
+	const routingAdapter = resolveDurableStreamsRoutingAdapter(ctx.durableStreamsRouting, ctx.durableStreamsUrl);
 	if (parsedBody) {
 		const rawPrimaryStream = newWebhook?.primaryStream ?? parsedBody.primary_stream ?? parsedBody.primaryStream ?? parsedBody.streamPath ?? null;
 		const primaryStream = typeof rawPrimaryStream === `string` ? toRuntimeStreamPath(rawPrimaryStream, ctx.service, routingAdapter) : null;
@@ -7261,7 +7530,7 @@ async function callbackForward(request, ctx) {
 		}
 		return (0, itty_router.json)(responseBody);
 	}
-	const upstreamBody = encodeCallbackForwardBody(ctx.service, consumerId, requestBody, resolveDurableStreamsRoutingAdapter(ctx.durableStreamsRouting));
+	const upstreamBody = encodeCallbackForwardBody(ctx.service, consumerId, requestBody, resolveDurableStreamsRoutingAdapter(ctx.durableStreamsRouting, ctx.durableStreamsUrl));
 	let upstream;
 	try {
 		const subscriptionId = durableStreamsSubscriptionCallback(target.callbackUrl);
@@ -7380,4 +7649,6 @@ exports.createDb = createDb
 exports.globalRouter = globalRouter
 exports.isUnregisteredTenantError = isUnregisteredTenantError
 exports.pathPrefixedSingleTenantDurableStreamsRoutingAdapter = pathPrefixedSingleTenantDurableStreamsRoutingAdapter
-exports.runMigrations = runMigrations
+exports.runMigrations = runMigrations
+exports.streamRootDurableStreamsRoutingAdapter = streamRootDurableStreamsRoutingAdapter
+exports.tenantRootDurableStreamsRoutingAdapter = tenantRootDurableStreamsRoutingAdapter