@voltro/cli 0.15.0 → 0.16.0

package/dist/{dev-C2lCUhYI.js → dev-DGjEvvkV.js}

@@ -13,39 +13,39 @@ import { fileURLToPath as dt, pathToFileURL as j } from "node:url";
 import { FetchHttpClient as ft } from "@effect/platform";
 import { Cause as pt, Cron as mt, Deferred as M, Duration as ht, Effect as N, Fiber as gt, Layer as P, ManagedRuntime as _t, Option as vt, Ref as yt, Schema as bt, Stream as xt } from "effect";
 import { createLogger as F, printAppSurface as St, printReadyBlock as Ct } from "@voltro/logger";
-import { appendFileSync as wt, chownSync as I, existsSync as Tt, promises as L, readFileSync as Et, readdirSync as Dt, statSync as Ot, writeFileSync as kt } from "node:fs";
-import { AggregateError as At, AggregateMaintainer as jt, AggregateNotFound as Mt, AggregateRegistry as Nt, AggregateStale as Pt, AnalyticsSink as R, DORMANCY_WAKEUP_TENANT as Ft, Dispatcher as It, InMemoryDataStore as Lt, ReactionRateLimiter as Rt, ReplicatedDataStore as zt, SYSTEM_SUBJECT as Bt, apiKeyManagementRoutes as Vt, applySoftDeleteScope as Ht, applyTenantScope as Ut, applyUndoInvocation as Wt, assertConnectionCipherConfigured as Gt, attachAnalyticsMirror as Kt, awaitServerListening as qt, bindMutation as Jt, bindStream as Yt, bindSubscription as Xt, buildTracingLayer as Zt, cancelWakeup as Qt, compileCron as $t, completeOAuthConnect as en, dataStoreApiKeyStore as tn, dataStoreIdempotencyStore as nn, drainOutbox as rn, enableGraphObservation as an, extractDbCause as on, formatServerOnlyLeaks as sn, frameworkApiKeyStrategy as cn, getConnectionSubject as ln, getTimelineRecorder as un, installPolicyGuardResolver as dn, isAggregateDefinition as fn, isEmptyTenantScopedRead as pn, isOrglessUserSubject as mn, isScheduleDefinition as hn, isWorkflowEventTriggerDefinition as gn, listRetentions as _n, loadResourceTuples as vn, localityAwareSelector as yn, makeActionRunner as bn, makeAdvisoryLockCoordinator as xn, makeApiKeyService as Sn, makeApiKeyUsageBuffer as Cn, makeApiKeyUsageFlusher as wn, makeAppAccess as Tn, makeAsyncKv as En, makeBufferingSpanProcessor as Dn, makeConnectionRegistry as On, makeConnectionResolver as kn, makeConnectionsFacade as An, makeCoordinatedScheduler as jn, makeDataLoader as Mn, makeDisconnectConnectionExecutor as Nn, makeEffectStoreLayer as Pn, makeEventsFacade as Fn, makeLazyWorkflowFacade as In, makeListConnectionsExecutor as Ln, makeMutationRunner as Rn, makeOneShotQueryRunner as zn, makeOutboxFacade as Bn, makePostCommitWorkflowFacade as Vn, makeQueryDescriptorProducer as Hn, makeQueryReauthorizer as Un, makeQuerySubscriber as Wn, makeSchemaRegistry as Gn, makeStartConnectionExecutor as Kn, makeSubmitTokenExecutor as qn, makeUndoCapture as Jn, makeWorkflowFacade as Yn, makeWorkflowFacadeWithCallerContext as Xn, makeWorkflowLayers as Zn, memoryRywPositionStore as Qn, nextFiring as $n, noopAnalytics as z, noopAnalyticsSpec as er, observedGraph as tr, powerOfTwoSelector as nr, recordSubscriptionDelivery as rr, recordTimelineEvent as ir, redisRywPositionStore as ar, redoUndoInvocation as or, registerRetention as sr, registerWakeup as cr, resolveCurrentRegion as lr, resolveSecretsBackend as ur, retentionTtlMsFromEnv as dr, runProvidedEffect as fr, runReaction as pr, sanitizeRedirectTo as mr, serverOnlyLeaks as hr, setConnectionResolver as gr, setSecretsBackend as _r, setSystemStoreHandle as vr, setTupleSource as yr, singleCoordinator as br, ssrfGuardHttpClientLayer as xr, startRpcServer as Sr, startScheduler as Cr, sweepRetention as wr, tracingHttpClientLayer as Tr, undoCaptureEnabled as Er, undoLogExecutor as Dr, wrapStoreWithMixinBehaviour as Or } from "@voltro/runtime";
-import { Rpc as kr, RpcGroup as Ar } from "@effect/rpc";
-import { SqlClient as B } from "@effect/sql";
-import { WorkflowEngine as jr } from "@effect/workflow";
-import { WorkflowStepInterceptorTag as Mr, closeWorkflowChildrenForParent as Nr, completeSuspendingSignal as Pr, getWorkflowVersionMetadata as Fr, isWorkflowWorkerLayer as Ir, makeWorkflowRunRecorder as Lr, sendWorkflowSignal as Rr, sendWorkflowUpdate as zr, serialiseWorkflowRowForWire as Br, wrapWorkflowExecuteWithRunRecording as Vr } from "@voltro/workflow";
-import { makeClusterCronLayer as Hr, parseShardLockMode as Ur, resolveRunnerIdentity as Wr, resolveRunnerStorage as Gr, workflowEngineLayer as Kr } from "@voltro/workflow/cluster";
-import { loadAgentMessages as qr, runAgentTurn as Jr } from "@voltro/ai";
-import { actorsTable as Yr, allRegisteredTables as Xr, and as Zr, auditAllTableIndexes as Qr, drainIdentifierWarnings as $r, ensureTableRegistered as ei, eq as V, formatIndexAuditIssue as ti, isSqliteFamily as ni, lt as ri, or as ii, registerCoreTables as ai, registerDiscoveredRelations as oi, resolveTenantNamespace as si, serverOnlyColumns as ci, validateRegisteredRelations as li, walkLeaves as ui } from "@voltro/database";
-import { AuthMiddleware as di, ConnectionInfoMiddleware as fi, Unauthenticated as pi, WorkflowRunHandleSchema as mi, actionToRpc as hi, advisoryResourceGuardWarning as gi, anonymousSubject as _i, checkFrameworkCompat as vi, composeAuthStrategies as yi, composeRpcInterceptors as bi, connectionDisconnectDescriptor as xi, connectionStartDescriptor as Si, connectionSubmitTokenDescriptor as Ci, connectionsListQueryDescriptor as wi, findAdvisoryResourceGuards as Ti, mutationToRpc as Ei, publishServerError as Di, queryToRpc as Oi, streamToRpc as ki, tenantScopedSubject as Ai, undoApplyDescriptor as ji, undoLogQueryDescriptor as Mi, undoRedoDescriptor as Ni, workflowCancelDescriptor as Pi, workflowDomainEventsQueryDescriptor as Fi, workflowEventDeliveriesQueryDescriptor as Ii, workflowResumeDescriptor as Li, workflowRunEventsQueryDescriptor as Ri, workflowRunQueryDescriptor as zi, workflowRunStepsQueryDescriptor as Bi, workflowRunsQueryDescriptor as Vi, workflowSignalDescriptor as Hi, workflowUpdateDescriptor as Ui } from "@voltro/protocol";
-import { isEnvContract as Wi } from "@voltro/env";
-import { readCookie as Gi, resolveOptionalSessionSecrets as Ki, verifySessionKeyed as qi } from "@voltro/protocol/session";
-import { createHash as Ji, randomBytes as Yi } from "node:crypto";
-import { declaredSnapshot as Xi, describeOutcome as Zi, fingerprintSchema as Qi, introspectSchema as $i, pendingFileMigrationIds as ea, planMigrations as ta, runFileBasedMigrations as na, runFrameworkBootstrap as ra, runPlannedMigrations as ia } from "@voltro/database/sql";
-import { Cache as aa, CacheLayer as oa, InvalidationBus as H } from "@voltro/cache";
-import { Kv as sa } from "@voltro/kv";
-import { getAuthSessionStrategy as ca } from "@voltro/plugin-auth";
-import { collectPublicApiRoutes as la, restRoutesToHttpRoutes as ua } from "@voltro/protocol/rest";
-import { spawn as da } from "node:child_process";
-import { watch as fa } from "chokidar";
-import { agentRouteDescriptors as pa, isAgentDescriptor as ma } from "@voltro/ai/agent";
-import { ArrayFormatter as ha } from "effect/ParseResult";
-import { buildDeliverWebhookExecute as ga, buildWebhooksService as _a, defaultIncomingPath as va, deliverWebhookWorkflow as ya, isWebhookDescriptor as ba, mountIncomingWebhook as xa } from "@voltro/plugin-webhooks";
-import { isEmailTemplate as Sa, registerEmailTemplates as Ca } from "@voltro/plugin-mail";
-import { attachBroadcastBus as wa, getBroadcastPlugin as Ta } from "@voltro/plugin-broadcast";
-import { runImport as Ea } from "@voltro/data-transfer";
-import { createServer as Da } from "node:http";
+import { appendFileSync as wt, chownSync as I, existsSync as L, promises as R, readFileSync as Tt, readdirSync as Et, statSync as Dt, writeFileSync as Ot } from "node:fs";
+import { AggregateError as kt, AggregateMaintainer as At, AggregateNotFound as jt, AggregateRegistry as Mt, AggregateStale as Nt, AnalyticsSink as z, DORMANCY_WAKEUP_TENANT as Pt, Dispatcher as Ft, InMemoryDataStore as It, ReactionRateLimiter as Lt, ReplicatedDataStore as Rt, SYSTEM_SUBJECT as zt, apiKeyManagementRoutes as Bt, applySoftDeleteScope as Vt, applyTenantScope as Ht, applyUndoInvocation as Ut, assertConnectionCipherConfigured as Wt, attachAnalyticsMirror as Gt, awaitServerListening as Kt, bindMutation as qt, bindStream as Jt, bindSubscription as Yt, buildTracingLayer as Xt, cancelWakeup as Zt, compileCron as Qt, completeOAuthConnect as $t, dataStoreApiKeyStore as en, dataStoreIdempotencyStore as tn, drainOutbox as nn, enableGraphObservation as rn, extractDbCause as an, formatServerOnlyLeaks as on, frameworkApiKeyStrategy as sn, getConnectionSubject as cn, getTimelineRecorder as ln, installPolicyGuardResolver as un, isAggregateDefinition as dn, isEmptyTenantScopedRead as fn, isOrglessUserSubject as pn, isScheduleDefinition as mn, isWorkflowEventTriggerDefinition as hn, listRetentions as gn, loadResourceTuples as _n, localityAwareSelector as vn, makeActionRunner as yn, makeAdvisoryLockCoordinator as bn, makeApiKeyService as xn, makeApiKeyUsageBuffer as Sn, makeApiKeyUsageFlusher as Cn, makeAppAccess as wn, makeAsyncKv as Tn, makeBufferingSpanProcessor as En, makeConnectionRegistry as Dn, makeConnectionResolver as On, makeConnectionsFacade as kn, makeCoordinatedScheduler as An, makeDataLoader as jn, makeDisconnectConnectionExecutor as Mn, makeEffectStoreLayer as Nn, makeEventsFacade as Pn, makeLazyWorkflowFacade as Fn, makeListConnectionsExecutor as In, makeMutationRunner as Ln, makeOneShotQueryRunner as Rn, makeOutboxFacade as zn, makePostCommitWorkflowFacade as Bn, makeQueryDescriptorProducer as Vn, makeQueryReauthorizer as Hn, makeQuerySubscriber as Un, makeSchemaRegistry as Wn, makeStartConnectionExecutor as Gn, makeSubmitTokenExecutor as Kn, makeUndoCapture as qn, makeWorkflowFacade as Jn, makeWorkflowFacadeWithCallerContext as Yn, makeWorkflowLayers as Xn, memoryRywPositionStore as Zn, nextFiring as Qn, noopAnalytics as B, noopAnalyticsSpec as $n, observedGraph as er, powerOfTwoSelector as tr, recordSubscriptionDelivery as nr, recordTimelineEvent as rr, redisRywPositionStore as ir, redoUndoInvocation as ar, registerRetention as or, registerWakeup as sr, resolveCurrentRegion as cr, resolveSecretsBackend as lr, retentionTtlMsFromEnv as ur, runProvidedEffect as dr, runReaction as fr, sanitizeRedirectTo as pr, serverOnlyLeaks as mr, setConnectionResolver as hr, setSecretsBackend as gr, setSystemStoreHandle as _r, setTupleSource as vr, singleCoordinator as yr, ssrfGuardHttpClientLayer as br, startRpcServer as xr, startScheduler as Sr, sweepRetention as Cr, tracingHttpClientLayer as wr, undoCaptureEnabled as Tr, undoLogExecutor as Er, wrapStoreWithMixinBehaviour as Dr } from "@voltro/runtime";
+import { Rpc as Or, RpcGroup as kr } from "@effect/rpc";
+import { SqlClient as V } from "@effect/sql";
+import { WorkflowEngine as Ar } from "@effect/workflow";
+import { WorkflowStepInterceptorTag as jr, closeWorkflowChildrenForParent as Mr, completeSuspendingSignal as Nr, getWorkflowVersionMetadata as Pr, isWorkflowWorkerLayer as Fr, makeWorkflowRunRecorder as Ir, sendWorkflowSignal as Lr, sendWorkflowUpdate as Rr, serialiseWorkflowRowForWire as zr, wrapWorkflowExecuteWithRunRecording as Br } from "@voltro/workflow";
+import { makeClusterCronLayer as Vr, parseShardLockMode as Hr, resolveRunnerIdentity as Ur, resolveRunnerStorage as Wr, workflowEngineLayer as Gr } from "@voltro/workflow/cluster";
+import { loadAgentMessages as Kr, runAgentTurn as qr } from "@voltro/ai";
+import { actorsTable as Jr, allRegisteredTables as Yr, and as Xr, auditAllTableIndexes as Zr, drainIdentifierWarnings as Qr, ensureTableRegistered as $r, eq as H, formatIndexAuditIssue as ei, isSqliteFamily as ti, lt as ni, or as ri, registerCoreTables as ii, registerDiscoveredRelations as ai, resolveTenantNamespace as oi, serverOnlyColumns as si, validateRegisteredRelations as ci, walkLeaves as li } from "@voltro/database";
+import { AuthMiddleware as ui, ConnectionInfoMiddleware as di, Unauthenticated as fi, WorkflowRunHandleSchema as pi, actionToRpc as mi, advisoryResourceGuardWarning as hi, anonymousSubject as gi, checkFrameworkCompat as _i, composeAuthStrategies as vi, composeRpcInterceptors as yi, connectionDisconnectDescriptor as bi, connectionStartDescriptor as xi, connectionSubmitTokenDescriptor as Si, connectionsListQueryDescriptor as Ci, findAdvisoryResourceGuards as wi, mutationToRpc as Ti, publishServerError as Ei, queryToRpc as Di, streamToRpc as Oi, tenantScopedSubject as ki, undoApplyDescriptor as Ai, undoLogQueryDescriptor as ji, undoRedoDescriptor as Mi, workflowCancelDescriptor as Ni, workflowDomainEventsQueryDescriptor as Pi, workflowEventDeliveriesQueryDescriptor as Fi, workflowResumeDescriptor as Ii, workflowRunEventsQueryDescriptor as Li, workflowRunQueryDescriptor as Ri, workflowRunStepsQueryDescriptor as zi, workflowRunsQueryDescriptor as Bi, workflowSignalDescriptor as Vi, workflowUpdateDescriptor as Hi } from "@voltro/protocol";
+import { isEnvContract as Ui } from "@voltro/env";
+import { readCookie as Wi, resolveOptionalSessionSecrets as Gi, verifySessionKeyed as Ki } from "@voltro/protocol/session";
+import { createHash as qi, randomBytes as Ji } from "node:crypto";
+import { declaredSnapshot as Yi, describeOutcome as Xi, fingerprintSchema as Zi, introspectSchema as Qi, pendingFileMigrationIds as $i, planMigrations as ea, runFileBasedMigrations as ta, runFrameworkBootstrap as na, runPlannedMigrations as ra } from "@voltro/database/sql";
+import { Cache as ia, CacheLayer as aa, InvalidationBus as U } from "@voltro/cache";
+import { Kv as oa } from "@voltro/kv";
+import { getAuthSessionStrategy as sa } from "@voltro/plugin-auth";
+import { collectPublicApiRoutes as ca, restRoutesToHttpRoutes as la } from "@voltro/protocol/rest";
+import { spawn as ua } from "node:child_process";
+import { watch as da } from "chokidar";
+import { agentRouteDescriptors as fa, isAgentDescriptor as pa } from "@voltro/ai/agent";
+import { ArrayFormatter as ma } from "effect/ParseResult";
+import { buildDeliverWebhookExecute as ha, buildWebhooksService as ga, defaultIncomingPath as _a, deliverWebhookWorkflow as va, isWebhookDescriptor as ya, mountIncomingWebhook as ba } from "@voltro/plugin-webhooks";
+import { isEmailTemplate as xa, registerEmailTemplates as Sa } from "@voltro/plugin-mail";
+import { attachBroadcastBus as Ca, getBroadcastPlugin as wa } from "@voltro/plugin-broadcast";
+import { runImport as Ta } from "@voltro/data-transfer";
+import { createServer as Ea } from "node:http";
 //#region src/envSecretMint.ts
-var Oa = (e, t) => {
+var Da = (e, t) => {
 	if (typeof process.getuid != "function") return;
 	let n;
 	try {
-		n = Ot(t);
+		n = Dt(t);
 	} catch {
 		return;
 	}
@@ -56,30 +56,30 @@ var Oa = (e, t) => {
 	} catch (t) {
 		return `${e} was written as uid ${r} but the workspace is owned by uid ${n.uid}, and it could not be handed over (${t.message}). The file is mode 0600, so tools running as uid ${n.uid} — your tests, your editor, \`voltro doctor\` — will fail to read it with EACCES. Run this container as the workspace owner (docker \`--user ${n.uid}:${n.gid}\`), or set the variable(s) yourself so nothing needs minting.`;
 	}
-}, U = ".env.local", ka = (e) => {
+}, W = ".env.local", Oa = (e) => {
 	let t = O(e, ".gitignore"), n = "";
 	try {
-		Tt(t) && (n = Et(t, "utf8"));
+		L(t) && (n = Tt(t, "utf8"));
 	} catch {
 		return !1;
 	}
-	if (n.split(/\r?\n/).map((e) => e.trim()).some((e) => e === U || e === `/${U}` || e === ".env*" || e === ".env.*" || e === ".env.local*")) return !0;
+	if (n.split(/\r?\n/).map((e) => e.trim()).some((e) => e === W || e === `/${W}` || e === ".env*" || e === ".env.*" || e === ".env.local*")) return !0;
 	try {
-		return wt(t, `${n === "" || n.endsWith("\n") ? "" : "\n"}\n# Local secrets minted by \`voltro dev\` — machine-specific, never commit.\n${U}\n`, "utf8"), !0;
+		return wt(t, `${n === "" || n.endsWith("\n") ? "" : "\n"}\n# Local secrets minted by \`voltro dev\` — machine-specific, never commit.\n${W}\n`, "utf8"), !0;
 	} catch {
 		return !1;
 	}
-}, Aa = (e) => Yi(32).toString(e), W = [{
+}, ka = (e) => Ji(32).toString(e), G = [{
 	key: "VOLTRO_INSPECT_TOKEN",
 	encoding: "base64url",
 	description: "Bearer token for /_voltro/inspect/* — minted so the dev inspect surface is not open to the network."
-}], ja = (e, t, n = process.env) => {
+}], Aa = (e, t, n = process.env) => {
 	let r = [];
-	for (let e of W) {
+	for (let e of G) {
 		let t = n[e.key];
 		t !== void 0 && t.trim() !== "" || r.push({
 			key: e.key,
-			value: Aa(e.encoding),
+			value: ka(e.encoding),
 			description: e.description
 		});
 	}
@@ -88,24 +88,24 @@ var Oa = (e, t) => {
 		let e = n[t];
 		e !== void 0 && e.trim() !== "" || r.push({
 			key: t,
-			value: Aa(i.generate),
+			value: ka(i.generate),
 			description: i.description
 		});
 	}
 	if (r.length === 0) return { minted: [] };
-	if (!ka(t)) throw Error(`cannot mint ${r.map((e) => e.key).join(", ")}: failed to add "${U}" to ${O(t, ".gitignore")}. Refusing to write a secret to a path that might be committed — add the entry by hand, or set the variable(s) yourself (\`voltro secret generate\`).`);
-	let i = O(t, U), a = r.map((e) => `${e.description ? `# ${e.description}\n` : ""}${e.key}=${e.value}`).join("\n"), o;
+	if (!Oa(t)) throw Error(`cannot mint ${r.map((e) => e.key).join(", ")}: failed to add "${W}" to ${O(t, ".gitignore")}. Refusing to write a secret to a path that might be committed — add the entry by hand, or set the variable(s) yourself (\`voltro secret generate\`).`);
+	let i = O(t, W), a = r.map((e) => `${e.description ? `# ${e.description}\n` : ""}${e.key}=${e.value}`).join("\n"), o;
 	try {
-		if (Tt(i)) {
-			let e = Et(i, "utf8");
+		if (L(i)) {
+			let e = Tt(i, "utf8");
 			wt(i, `${e === "" || e.endsWith("\n") ? "" : "\n"}\n${a}\n`, "utf8");
-		} else kt(i, `# Minted by \`voltro dev\` — unique to this project and this machine.
+		} else Ot(i, `# Minted by \`voltro dev\` — unique to this project and this machine.
 # Not committed (see .gitignore). Your deployment needs its OWN values:
 #   voltro secret generate
 \n${a}\n`, {
 			encoding: "utf8",
 			mode: 384
-		}), o = Oa(i, t);
+		}), o = Da(i, t);
 	} catch (e) {
 		throw Error(`cannot mint ${r.map((e) => e.key).join(", ")}: failed to write ${i} — ${e.message}`);
 	}
@@ -115,9 +115,9 @@ var Oa = (e, t) => {
 		file: i,
 		...o ? { ownershipWarning: o } : {}
 	};
-}, Ma = [".framework", ".env.local"], Na = /\.generated\./i, Pa = (e) => {
+}, ja = [".framework", ".env.local"], Ma = /\.generated\./i, Na = (e) => {
 	try {
-		let t = Ot(e);
+		let t = Dt(e);
 		return {
 			uid: t.uid,
 			gid: t.gid
@@ -125,7 +125,7 @@ var Oa = (e, t) => {
 	} catch {
 		return;
 	}
-}, Fa = (e, t, n) => {
+}, Pa = (e, t, n) => {
 	let r = !0;
 	try {
 		I(e, t, n);
@@ -134,49 +134,49 @@ var Oa = (e, t) => {
 	}
 	let i = [];
 	try {
-		if (!Ot(e).isDirectory()) return r;
-		i = Dt(e);
+		if (!Dt(e).isDirectory()) return r;
+		i = Et(e);
 	} catch {
 		return r;
 	}
-	for (let a of i) Fa(O(e, a), t, n) || (r = !1);
+	for (let a of i) Pa(O(e, a), t, n) || (r = !1);
 	return r;
-}, Ia = (e) => {
+}, Fa = (e) => {
 	if (typeof process.getuid != "function") return { adopted: [] };
-	let t = Pa(e);
+	let t = Na(e);
 	if (t === void 0) return { adopted: [] };
 	let n = process.getuid();
 	if (t.uid === n) return { adopted: [] };
-	let r = [...Ma];
+	let r = [...ja];
 	try {
-		for (let t of Dt(e)) Na.test(t) && r.push(t);
+		for (let t of Et(e)) Ma.test(t) && r.push(t);
 	} catch {}
 	let i = [], a = !1;
 	for (let n of r) {
 		let r = O(e, n);
-		Pa(r) !== void 0 && (Fa(r, t.uid, t.gid) ? i.push(n) : a = !0);
+		Na(r) !== void 0 && (Pa(r, t.uid, t.gid) ? i.push(n) : a = !0);
 	}
 	return a ? {
 		adopted: i,
 		warning: `generated files under ${e} are owned by uid ${n} but the workspace is owned by uid ${t.uid}, and they could not be handed over. On the host, tools running as uid ${t.uid} will fail with EACCES — \`voltro build\` cannot read \`.framework\`, and \`vitest\` cannot read \`.env.local\`. Run this container as the workspace owner (docker \`--user ${t.uid}:${t.gid}\`).`
 	} : { adopted: i };
-}, La = (e) => e.startsWith("_voltro_"), Ra = (e) => e === void 0 || e === "" || !/^file:/i.test(e) || (process.env.TURSO_SYNC_URL ?? "") !== "", za = (e) => {
-	if (e.dialect === "turso" && Ra(e.dbUrl)) return [{
+}, Ia = (e) => e.startsWith("_voltro_"), La = (e) => e === void 0 || e === "" || !/^file:/i.test(e) || (process.env.TURSO_SYNC_URL ?? "") !== "", Ra = (e) => {
+	if (e.dialect === "turso" && La(e.dbUrl)) return [{
 		level: "warn",
 		message: "turso is configured against a shared primary, but this dialect has no NATIVE cross-instance change capture: it reuses the SQLite store, which emits inline only. Subscribers see writes made by THEIR OWN instance and never another's — for every table, regardless of .nonReactive(). Add @voltro/plugin-broadcast (Redis / NATS) to fan changes out between instances, or run a single instance."
 	}];
 	if (e.changeStrategy !== "cdc" || e.dialect === "sqlite" || e.dialect === "turso") return [];
-	let t = new Set(e.querySources.filter((e) => !La(e))), n = e.tables.filter((e) => !La(e.tableName)).filter((e) => e.isReactive === !1 && t.has(e.tableName)).map((e) => e.tableName).sort();
+	let t = new Set(e.querySources.filter((e) => !Ia(e))), n = e.tables.filter((e) => !Ia(e.tableName)).filter((e) => e.isReactive === !1 && t.has(e.tableName)).map((e) => e.tableName).sort();
 	if (n.length === 0) return [];
 	let r = n.slice(0, 8).join(", "), i = n.length > 8 ? `, … (+${n.length - 8})` : "";
 	return [{
 		level: "warn",
 		message: `${n.length} table(s) are .nonReactive() but a query declares them as a source — ${r}${i}. Those subscriptions will NEVER fire: a non-reactive table emits no change events at all, in this process or any other, so the query returns its first snapshot and then goes quiet forever. Either drop .nonReactive() from the table, or stop subscribing to it.`
 	}];
-}, Ba = "VOLTRO_REMOTE_MIGRATIONS_OK", Va = /^(10\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.)/, G = (e) => {
+}, za = "VOLTRO_REMOTE_MIGRATIONS_OK", Ba = /^(10\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.)/, K = (e) => {
 	let t = e.toLowerCase().replace(/^\[|\]$/g, "");
-	return !!(t === "" || t === "localhost" || t === "ip6-localhost" || t === "::1" || t === "0.0.0.0" || t === "::" || t.startsWith("127.") || t === "host.docker.internal" || t === "gateway.docker.internal" || t.endsWith(".localhost") || t.endsWith(".local") || Va.test(t) || !t.includes(".") && !t.includes(":"));
-}, Ha = (e) => {
+	return !!(t === "" || t === "localhost" || t === "ip6-localhost" || t === "::1" || t === "0.0.0.0" || t === "::" || t.startsWith("127.") || t === "host.docker.internal" || t === "gateway.docker.internal" || t.endsWith(".localhost") || t.endsWith(".local") || Ba.test(t) || !t.includes(".") && !t.includes(":"));
+}, Va = (e) => {
 	if (e.url !== void 0 && e.url !== "") {
 		if (/^(file|sqlite):/i.test(e.url)) return {
 			kind: "local",
@@ -185,7 +185,7 @@ var Oa = (e, t) => {
 		try {
 			let t = new URL(e.url).hostname;
 			return {
-				kind: G(t) ? "local" : "remote",
+				kind: K(t) ? "local" : "remote",
 				host: t
 			};
 		} catch {
@@ -197,12 +197,12 @@ var Oa = (e, t) => {
 	}
 	let t = e.host ?? "localhost";
 	return {
-		kind: G(t) ? "local" : "remote",
+		kind: K(t) ? "local" : "remote",
 		host: t
 	};
-}, Ua = (e) => {
+}, Ha = (e) => {
 	if (e.pendingIds.length === 0 || e.optIn) return { allowed: !0 };
-	let t = Ha(e.conn);
+	let t = Va(e.conn);
 	if (t.kind === "local") return { allowed: !0 };
 	let n = e.pendingIds.map((e) => `    • ${e}`).join("\n");
 	return {
@@ -221,11 +221,11 @@ var Oa = (e, t) => {
 			"  Choose one:",
 			"    • Point the app at a local database (DB_URL), which is what dev boot assumes.",
 			"    • Apply them deliberately, once:  voltro db files .",
-			`    • Accept it for this environment:  ${Ba}=1`
+			`    • Accept it for this environment:  ${za}=1`
 		].join("\n")
 	};
-}, Wa = async ({ env: e = process.env } = {}) => {
-	let t = _t.make(P.mergeAll(oa.layer, H.Default)), n = await t.runPromise(aa), r = await t.runPromise(H), i = (e.CACHE_BACKEND ?? "memory").toLowerCase();
+}, Ua = async ({ env: e = process.env } = {}) => {
+	let t = _t.make(P.mergeAll(aa.layer, U.Default)), n = await t.runPromise(ia), r = await t.runPromise(U), i = (e.CACHE_BACKEND ?? "memory").toLowerCase();
 	return await t.runPromise(r.addSink((e) => n.invalidateTag(e))), {
 		service: n,
 		invalidationBus: r,
@@ -257,26 +257,26 @@ var Oa = (e, t) => {
 		stats: () => t.runSync(n.stats()),
 		dispose: () => t.dispose()
 	};
-}, Ga = ({ store: e, dialect: t, env: n = process.env }) => {
+}, Wa = ({ store: e, dialect: t, env: n = process.env }) => {
 	if (t !== "postgres") return { stop: () => {} };
-	sr({
+	or({
 		table: "_voltro_schedule_runs",
 		timeColumn: "scheduledAt",
-		ttlMs: dr(n.VOLTRO_SCHEDULE_RUNS_TTL_HOURS, 720)
-	}), sr({
+		ttlMs: ur(n.VOLTRO_SCHEDULE_RUNS_TTL_HOURS, 720)
+	}), or({
 		table: "_voltro_workflow_runs",
 		timeColumn: "completedAt",
-		ttlMs: dr(n.VOLTRO_WORKFLOW_RUNS_TTL_HOURS, 720),
-		where: ii(V("status", "succeeded"), V("status", "failed"), V("status", "cancelled"))
-	}), sr({
+		ttlMs: ur(n.VOLTRO_WORKFLOW_RUNS_TTL_HOURS, 720),
+		where: ri(H("status", "succeeded"), H("status", "failed"), H("status", "cancelled"))
+	}), or({
 		table: "_voltro_outbox_attempts",
 		timeColumn: "startedAt",
-		ttlMs: dr(n.VOLTRO_OUTBOX_ATTEMPTS_TTL_HOURS, 720)
-	}), sr({
+		ttlMs: ur(n.VOLTRO_OUTBOX_ATTEMPTS_TTL_HOURS, 720)
+	}), or({
 		table: "_voltro_outbox",
 		timeColumn: "deliveredAt",
-		ttlMs: dr(n.VOLTRO_OUTBOX_TTL_HOURS, 720),
-		where: V("status", "delivered")
+		ttlMs: ur(n.VOLTRO_OUTBOX_TTL_HOURS, 720),
+		where: H("status", "delivered")
 	});
 	let r = e.raw?.bind(e), i = (e) => {
 		if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(e)) throw Error(`retention: unsafe identifier "${e}"`);
@@ -291,7 +291,7 @@ var Oa = (e, t) => {
 			};
 			return (await r(e)).length;
 		}
-		let d = ri(l, a), f = s === void 0 ? d : Zr(d, s), p = await e.query({
+		let d = ni(l, a), f = s === void 0 ? d : Xr(d, s), p = await e.query({
 			table: c,
 			order: [],
 			predicate: f,
@@ -305,48 +305,48 @@ var Oa = (e, t) => {
 		return p.length;
 	}, o = async () => {
 		let e = Date.now();
-		for (let t of _n()) try {
-			await wr(t, e, a, 2e4);
+		for (let t of gn()) try {
+			await Cr(t, e, a, 2e4);
 		} catch {}
 	}, s = setInterval(() => {
 		o();
 	}, 5 * 6e4);
 	return s.unref?.(), { stop: () => clearInterval(s) };
-}, Ka = (e) => {
-	let t = Mn({ store: e.store });
+}, Ga = (e) => {
+	let t = jn({ store: e.store });
 	return {
-		storeForTenant: (t) => Or(e.store, {
-			subject: Ai(Bt, t),
+		storeForTenant: (t) => Dr(e.store, {
+			subject: ki(zt, t),
 			schemaRegistry: e.schemaRegistry
 		}),
-		store: Or(e.store, {
-			subject: Bt,
+		store: Dr(e.store, {
+			subject: zt,
 			schemaRegistry: e.schemaRegistry
 		}),
 		request: {
-			subject: Bt,
+			subject: zt,
 			traceId: "webhooks:trigger"
 		},
-		access: Tn(Bt),
+		access: wn(zt),
 		load: t.load,
 		loadMany: t.loadMany,
 		cache: e.cache,
 		kv: e.kv
 	};
-}, qa = (e) => {
+}, Ka = (e) => {
 	let { store: t, schemaRegistry: n, cache: r, kv: i, webhooksService: a, workflowsProxy: o, eventTriggers: s, namespaceIsolationOn: c, onEventEmit: l, outbox: u, connections: d } = e, f = (e, t) => {
 		if (!c) return e;
 		if (e.withNamespace === void 0) throw Error("tenantIsolation=namespace is set but the active store has no physical-namespace support (withNamespace).");
-		return e.withNamespace(si(t.tenantId));
+		return e.withNamespace(oi(t.tenantId));
 	};
 	return (e, c = t, p, m = "app-context", h) => {
-		let g = f(c, e.subject), _ = o === void 0 ? void 0 : Xn(o, {
+		let g = f(c, e.subject), _ = o === void 0 ? void 0 : Yn(o, {
 			subject: e.subject,
 			traceId: e.traceId,
 			source: m,
 			...h?.parentExecutionId === void 0 ? {} : { parentExecutionId: h.parentExecutionId },
 			...h?.parentClosePolicy === void 0 ? {} : { parentClosePolicy: h.parentClosePolicy }
-		}), ee = s.length === 0 || o === void 0 ? void 0 : Fn({
+		}), ee = s.length === 0 || o === void 0 ? void 0 : Pn({
 			triggers: s,
 			store: g,
 			source: m,
@@ -355,30 +355,30 @@ var Oa = (e, t) => {
 			...l === void 0 ? {} : { emit: l },
 			...h?.parentExecutionId === void 0 ? {} : { parentExecutionId: h.parentExecutionId },
 			startWorkflow: (e, t, n) => {
-				let r = Xn(o, n);
-				return (p ? Vn(r, p.afterCommit) : r).start(e, t);
+				let r = Yn(o, n);
+				return (p ? Bn(r, p.afterCommit) : r).start(e, t);
 			}
-		}), te = u === void 0 ? void 0 : Bn({
+		}), te = u === void 0 ? void 0 : zn({
 			store: g,
 			subject: e.subject,
 			traceId: e.traceId,
 			nudge: u.nudge,
 			...p === void 0 ? {} : { afterCommit: p.afterCommit }
-		}), ne = d === void 0 ? void 0 : An({
+		}), ne = d === void 0 ? void 0 : kn({
 			store: g,
 			registry: d.registry,
 			subject: e.subject
-		}), re = Mn({ store: g }), ie = e.rowFilter === void 0 ? {} : { rowFilter: e.rowFilter };
+		}), re = jn({ store: g }), ie = e.rowFilter === void 0 ? {} : { rowFilter: e.rowFilter };
 		return {
 			storeForTenant: (t) => {
-				let r = Ai(e.subject, t);
-				return Or(f(c, r), {
+				let r = ki(e.subject, t);
+				return Dr(f(c, r), {
 					subject: r,
 					schemaRegistry: n,
 					...ie
 				});
 			},
-			store: Or(g, {
+			store: Dr(g, {
 				subject: e.subject,
 				schemaRegistry: n,
 				...e.rowFilter === void 0 ? {} : { rowFilter: e.rowFilter }
@@ -386,19 +386,19 @@ var Oa = (e, t) => {
 			load: re.load,
 			loadMany: re.loadMany,
 			request: e,
-			access: Tn(e.subject),
+			access: wn(e.subject),
 			cache: r,
 			kv: i,
 			...a === void 0 ? {} : { webhooks: a },
 			...ee === void 0 ? {} : { events: ee },
 			...te === void 0 ? {} : { outbox: te },
 			...ne === void 0 ? {} : { connections: ne },
-			..._ === void 0 ? {} : { workflows: p ? Vn(_, p.afterCommit) : _ }
+			..._ === void 0 ? {} : { workflows: p ? Bn(_, p.afterCommit) : _ }
 		};
 	};
-}, Ja = async (e, t, n) => {
-	if (t.type === "anonymous" || t.id == null) throw new pi({ reason: "workflow control requires an authenticated subject" });
-	let r = "id" in n ? V("id", n.id) : V("executionId", n.executionId), i = (await e.query({
+}, qa = async (e, t, n) => {
+	if (t.type === "anonymous" || t.id == null) throw new fi({ reason: "workflow control requires an authenticated subject" });
+	let r = "id" in n ? H("id", n.id) : H("executionId", n.executionId), i = (await e.query({
 		table: "_voltro_workflow_runs",
 		order: [],
 		predicate: r,
@@ -406,9 +406,9 @@ var Oa = (e, t) => {
 		skip: void 0,
 		take: 1
 	}))[0], a = i?.subject?.tenantId ?? null, o = t.tenantId ?? null;
-	if (i === void 0 || a !== o) throw new pi({ reason: "not authorized for this workflow run" });
-}, Ya = (e = {}) => Tr.pipe(P.provide(xr(e)), P.provide(ft.layer), P.provide(P.succeed(ft.RequestInit, { redirect: "manual" }))), Xa = (e) => {
-	let t = P.succeed(aa, e.cacheService), n = P.succeed(sa, e.kvService), r = [
+	if (i === void 0 || a !== o) throw new fi({ reason: "not authorized for this workflow run" });
+}, Ja = (e = {}) => wr.pipe(P.provide(br(e)), P.provide(ft.layer), P.provide(P.succeed(ft.RequestInit, { redirect: "manual" }))), Ya = (e) => {
+	let t = P.succeed(ia, e.cacheService), n = P.succeed(oa, e.kvService), r = [
 		e.analyticsLayer,
 		t,
 		n,
@@ -416,55 +416,55 @@ var Oa = (e, t) => {
 		...e.userLayers
 	];
 	return P.mergeAll(...r);
-}, Za = [
-	zi,
-	Vi,
-	Bi,
+}, Xa = [
 	Ri,
-	Fi,
-	Ii
-], Qa = (e, t, n) => {
+	Bi,
+	zi,
+	Li,
+	Pi,
+	Fi
+], Za = (e, t, n) => {
 	let r = new Set(t);
-	if (n) for (let e of Za) r.add(e.name);
+	if (n) for (let e of Xa) r.add(e.name);
 	let i = {};
 	for (let [t, n] of Object.entries(e)) i[t] = r.has(t) ? (e) => n(e).pipe(xt.take(1)) : n;
 	return i;
-}, $a = F({ scope: "voltro:dev:supervisor" }), eo = /\.generated\./, to = /\.([cm]?[jt]sx?|json)$/, no = (e) => {
+}, Qa = F({ scope: "voltro:dev:supervisor" }), $a = /\.generated\./, eo = /\.([cm]?[jt]sx?|json)$/, to = (e) => {
 	let t = E(e);
-	return !eo.test(t) && to.test(t);
-}, ro = (e) => e.startsWith("node_modules") || e.startsWith(".framework") || e.startsWith(".turbo") || e.startsWith(".vite") || e.startsWith("dist") || e.startsWith(".git"), io = process.env.WATCH_POLL === "1" || process.env.CHOKIDAR_USEPOLLING === "1", ao = 1e3, oo = (e) => xt.async((t) => {
-	let n = A(e), r = (e) => k(n, e), i = fa(n, {
+	return !$a.test(t) && eo.test(t);
+}, no = (e) => e.startsWith("node_modules") || e.startsWith(".framework") || e.startsWith(".turbo") || e.startsWith(".vite") || e.startsWith("dist") || e.startsWith(".git"), ro = process.env.WATCH_POLL === "1" || process.env.CHOKIDAR_USEPOLLING === "1", io = 1e3, ao = (e) => xt.async((t) => {
+	let n = A(e), r = (e) => k(n, e), i = da(n, {
 		persistent: !0,
 		ignoreInitial: !0,
 		atomic: !0,
-		usePolling: io,
-		interval: ao,
-		binaryInterval: ao,
+		usePolling: ro,
+		interval: io,
+		binaryInterval: io,
 		ignored: (e) => {
 			let t = r(e);
-			return t === "" ? !1 : ro(t) || eo.test(E(e));
+			return t === "" ? !1 : no(t) || $a.test(E(e));
 		}
 	});
 	return i.on("all", (e, n) => {
 		let i = r(n);
-		process.env.WATCH_DEBUG === "1" && $a.trace("watcher fired", {
+		process.env.WATCH_DEBUG === "1" && Qa.trace("watcher fired", {
 			event: e,
 			file: i
-		}), !ro(i) && no(i) && t.single({ file: i });
+		}), !no(i) && to(i) && t.single({ file: i });
 	}), i.on("error", (e) => {
-		$a.error("watcher error", { hint: io ? void 0 : "on a bind-mount (k8s hostPath / Docker volume) set WATCH_POLL=1" }, e);
+		Qa.error("watcher error", { hint: ro ? void 0 : "on a bind-mount (k8s hostPath / Docker volume) set WATCH_POLL=1" }, e);
 	}), N.sync(() => {
 		i.close();
 	});
-}), so = (e) => N.async((t) => {
+}), oo = (e) => N.async((t) => {
 	if (e.exitCode !== null) {
 		t(N.succeed(e.exitCode));
 		return;
 	}
 	e.once("exit", (e, n) => t(N.succeed(e ?? +!!n)));
-}), co = (e) => N.acquireUseRelease(N.sync(() => {
+}), so = (e) => N.acquireUseRelease(N.sync(() => {
 	let t = process.argv[1] ?? "";
-	return da(process.execPath, [
+	return ua(process.execPath, [
 		"--import",
 		"tsx",
 		t,
@@ -477,7 +477,7 @@ var Oa = (e, t) => {
 			FRAMEWORK_DEV_INNER: "1"
 		}
 	});
-}), so, (e) => N.async((t) => {
+}), oo, (e) => N.async((t) => {
 	if (e.exitCode !== null || e.killed) {
 		t(N.void);
 		return;
@@ -489,20 +489,20 @@ var Oa = (e, t) => {
 	e.once("exit", () => {
 		clearTimeout(n), t(N.void);
 	});
-})), lo = (e) => e.exitCode === 0 ? "stop" : e.keepAlive === "1" ? "wait-for-fix" : e.keepAlive === "0" ? "stop" : e.interactive ? "wait-for-fix" : "stop", uo = (e) => N.gen(function* () {
-	$a.info("supervisor active — watching project root", {
+})), co = (e) => e.exitCode === 0 ? "stop" : e.keepAlive === "1" ? "wait-for-fix" : e.keepAlive === "0" ? "stop" : e.interactive ? "wait-for-fix" : "stop", lo = (e) => N.gen(function* () {
+	Qa.info("supervisor active — watching project root", {
 		root: e.root,
 		patterns: ["**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs,json} (excl. *.generated.*)"],
-		watcher: io ? "chokidar (polling)" : "chokidar (native)",
+		watcher: ro ? "chokidar (polling)" : "chokidar (native)",
 		hint: "WATCH=0 disables, WATCH_DEBUG=1 traces every event, WATCH_POLL=1 for bind-mounts (k8s/Docker)"
 	});
 	let t = yield* yt.make(vt.none()), n = yield* M.make(), r = N.gen(function* () {
-		let r = yield* N.fork(co(e.root).pipe(N.flatMap((e) => lo({
+		let r = yield* N.fork(so(e.root).pipe(N.flatMap((e) => co({
 			exitCode: e,
 			interactive: process.stdout.isTTY === !0,
 			keepAlive: process.env.VOLTRO_DEV_KEEP_ALIVE
 		}) === "stop" ? M.succeed(n, e) : N.sync(() => {
-			$a.error("dev server crashed — waiting for a file change", {
+			Qa.error("dev server crashed — waiting for a file change", {
 				exitCode: e,
 				hint: "fix the cause and save; Ctrl-C to stop. VOLTRO_DEV_KEEP_ALIVE=0 exits instead."
 			});
@@ -516,14 +516,14 @@ var Oa = (e, t) => {
 		}), yield* yt.set(t, vt.none());
 	});
 	yield* r;
-	let a = oo(e.root).pipe(xt.debounce(ht.millis(80)), xt.runForEach((e) => N.gen(function* () {
+	let a = ao(e.root).pipe(xt.debounce(ht.millis(80)), xt.runForEach((e) => N.gen(function* () {
 		let t = Date.now();
-		$a.info("file changed — restarting", { file: e.file }), yield* i, yield* r, $a.info("restart complete", { ms: Date.now() - t });
+		Qa.info("file changed — restarting", { file: e.file }), yield* i, yield* r, Qa.info("restart complete", { ms: Date.now() - t });
 	})), N.andThen(N.never), N.as(0)), o = yield* N.raceFirst(a, M.await(n));
-	o === 0 ? $a.info("dev server exited — supervisor stopping") : $a.error("dev server exited — supervisor stopping", { exitCode: o }), yield* N.sync(() => {
+	o === 0 ? Qa.info("dev server exited — supervisor stopping") : Qa.error("dev server exited — supervisor stopping", { exitCode: o }), yield* N.sync(() => {
 		process.exitCode = o;
 	});
-}), fo = /* @__PURE__ */ new Set(/* @__PURE__ */ "crypto.fs.path.os.net.http.https.http2.tls.dns.dgram.stream.zlib.child_process.worker_threads.cluster.readline.vm.module.perf_hooks.async_hooks.inspector.v8.process.tty.repl.constants.sys.string_decoder".split(".")), K = (e) => e.startsWith("node:") || fo.has(e) || e === "@voltro/workflow" ? !0 : e === "@voltro/database/wire" ? !1 : e === "@voltro/database" || e.startsWith("@voltro/database/") || e === "@voltro/runtime" || e.startsWith("@voltro/runtime/") ? !0 : e === "@voltro/ai/agent" || e === "@voltro/ai/events" ? !1 : !!(e === "@voltro/ai" || e.startsWith("@voltro/ai/") || [
+}), uo = /* @__PURE__ */ new Set(/* @__PURE__ */ "crypto.fs.path.os.net.http.https.http2.tls.dns.dgram.stream.zlib.child_process.worker_threads.cluster.readline.vm.module.perf_hooks.async_hooks.inspector.v8.process.tty.repl.constants.sys.string_decoder".split(".")), q = (e) => e.startsWith("node:") || uo.has(e) || e === "@voltro/workflow" ? !0 : e === "@voltro/database/wire" ? !1 : e === "@voltro/database" || e.startsWith("@voltro/database/") || e === "@voltro/runtime" || e.startsWith("@voltro/runtime/") ? !0 : e === "@voltro/ai/agent" || e === "@voltro/ai/events" ? !1 : !!(e === "@voltro/ai" || e.startsWith("@voltro/ai/") || [
 	"@voltro/protocol/session",
 	"@voltro/protocol/jwt",
 	"@voltro/protocol/apikey"
@@ -542,8 +542,8 @@ var Oa = (e, t) => {
 	"@prisma/client",
 	"nodemailer",
 	"jose"
-].includes(e)), po = (e) => e.replace(/\/\*[\s\S]*?\*\//g, " ").replace(/(^|[^:])\/\/[^\n]*/g, "$1"), mo = (e) => {
-	let t = po(e), n = [], r = /(?:^|[\n;}])\s*(?:import|export)\s+([^;'"]*?)\s+from\s+['"]([^'"]+)['"]/g, i;
+].includes(e)), fo = (e) => e.replace(/\/\*[\s\S]*?\*\//g, " ").replace(/(^|[^:])\/\/[^\n]*/g, "$1"), po = (e) => {
+	let t = fo(e), n = [], r = /(?:^|[\n;}])\s*(?:import|export)\s+([^;'"]*?)\s+from\s+['"]([^'"]+)['"]/g, i;
 	for (; (i = r.exec(t)) !== null;) {
 		let e = i[1].trim();
 		if (e === "type" || e.startsWith("type ")) continue;
@@ -559,29 +559,29 @@ var Oa = (e, t) => {
 	let o = /\bimport\(\s*['"]([^'"]+)['"]\s*\)/g;
 	for (; (i = o.exec(t)) !== null;) n.push(i[1]);
 	return n;
-}, ho = (e) => e.endsWith(".ts") || e.endsWith(".tsx"), q = async (e) => {
-	let t = ho(e) ? [e] : [
+}, mo = (e) => e.endsWith(".ts") || e.endsWith(".tsx"), J = async (e) => {
+	let t = mo(e) ? [e] : [
 		`${e}.ts`,
 		`${e}.tsx`,
 		O(e, "index.ts"),
 		O(e, "index.tsx")
 	];
 	for (let e of t) try {
-		if ((await L.stat(e)).isFile()) return e;
+		if ((await R.stat(e)).isFile()) return e;
 	} catch {}
 	return null;
-}, go = async (e, t) => {
+}, ho = async (e, t) => {
 	let n = t;
 	for (;;) {
 		let t = O(n, "node_modules", e);
 		try {
-			if ((await L.stat(t)).isDirectory()) return t;
+			if ((await R.stat(t)).isDirectory()) return t;
 		} catch {}
 		let r = D(n);
 		if (r === n) return null;
 		n = r;
 	}
-}, _o = (e) => {
+}, go = (e) => {
 	if (typeof e == "string") return e;
 	if (typeof e == "object" && e) {
 		let t = e;
@@ -591,23 +591,23 @@ var Oa = (e, t) => {
 			"node",
 			"default"
 		]) if (e in t) {
-			let n = _o(t[e]);
+			let n = go(t[e]);
 			if (n !== void 0) return n;
 		}
 	}
-}, vo = async (e, t) => {
-	if (e.startsWith(".")) return q(A(D(t), e));
-	let n = e.split("/"), r = e.startsWith("@"), i = r ? `${n[0]}/${n[1]}` : n[0], a = r ? n.slice(2) : n.slice(1), o = a.length > 0 ? `./${a.join("/")}` : ".", s = await go(i, D(t));
+}, _o = async (e, t) => {
+	if (e.startsWith(".")) return J(A(D(t), e));
+	let n = e.split("/"), r = e.startsWith("@"), i = r ? `${n[0]}/${n[1]}` : n[0], a = r ? n.slice(2) : n.slice(1), o = a.length > 0 ? `./${a.join("/")}` : ".", s = await ho(i, D(t));
 	if (!s) return null;
 	try {
-		let e = JSON.parse(await L.readFile(O(s, "package.json"), "utf8")), t = _o(e.exports?.[o]) ?? (o === "." ? e.module ?? e.main : void 0);
-		if (typeof t == "string") return q(A(s, t));
+		let e = JSON.parse(await R.readFile(O(s, "package.json"), "utf8")), t = go(e.exports?.[o]) ?? (o === "." ? e.module ?? e.main : void 0);
+		if (typeof t == "string") return J(A(s, t));
 	} catch {}
 	return null;
-}, yo = (e, t) => e.startsWith(t) ? e.slice(t.length).replace(/^[/\\]/, "") : e, bo = async (e, t) => {
+}, vo = (e, t) => e.startsWith(t) ? e.slice(t.length).replace(/^[/\\]/, "") : e, yo = async (e, t) => {
 	let n = /* @__PURE__ */ new Set(), r = [{
 		file: e,
-		chain: [yo(e, t)]
+		chain: [vo(e, t)]
 	}];
 	for (; r.length > 0;) {
 		let { file: e, chain: i } = r.shift();
@@ -615,41 +615,41 @@ var Oa = (e, t) => {
 		n.add(e);
 		let a;
 		try {
-			a = await L.readFile(e, "utf8");
+			a = await R.readFile(e, "utf8");
 		} catch {
 			continue;
 		}
-		for (let o of mo(a)) {
-			if (K(o)) return {
+		for (let o of po(a)) {
+			if (q(o)) return {
 				specifier: o,
 				chain: [...i, o]
 			};
-			let a = await vo(o, e);
+			let a = await _o(o, e);
 			a && !n.has(a) && r.push({
 				file: a,
-				chain: [...i, `${o}  (${yo(a, t)})`]
+				chain: [...i, `${o}  (${vo(a, t)})`]
 			});
 		}
 	}
 	return null;
-}, xo = /\.client\.tsx?$/, So = async (e, t) => {
+}, bo = /\.client\.tsx?$/, xo = async (e, t) => {
 	let n = [];
 	for (let r of t) {
-		if (!xo.test(r)) continue;
-		let t = await bo(r, e);
+		if (!bo.test(r)) continue;
+		let t = await yo(r, e);
 		t !== null && n.push({
-			file: yo(r, e),
+			file: vo(r, e),
 			violation: t
 		});
 	}
 	return n;
-}, Co = (e) => `browser-safety violation — ${e.file} declares itself browser-safe (.client.ts) and is not.\n\n  '${e.violation.specifier}' is server-only (node:* / database / ai / cluster / protocol session / db driver).\n\n  import chain:\n      → ${e.violation.chain.join("\n      → ")}\n\n  The .client suffix is a claim the framework checks, not a hint. Either move the server-only\n  code behind a *.server.ts and keep this file pure, or drop the suffix — an unmarked file\n  makes no claim, and only the rpcGroup guard will judge it (later, and with a longer chain).`, wo = async (e) => {
+}, So = (e) => `browser-safety violation — ${e.file} declares itself browser-safe (.client.ts) and is not.\n\n  '${e.violation.specifier}' is server-only (node:* / database / ai / cluster / protocol session / db driver).\n\n  import chain:\n      → ${e.violation.chain.join("\n      → ")}\n\n  The .client suffix is a claim the framework checks, not a hint. Either move the server-only\n  code behind a *.server.ts and keep this file pure, or drop the suffix — an unmarked file\n  makes no claim, and only the rpcGroup guard will judge it (later, and with a longer chain).`, Co = async (e) => {
 	if (process.env.VOLTRO_BROWSER_SAFETY === "off") return;
-	let t = await bo(e, D(e));
+	let t = await yo(e, D(e));
 	if (!t) return;
 	let n = t.chain.join("\n      → ");
 	throw Error(`browser-safety violation — the generated rpcGroup pulls a SERVER-ONLY module into the client bundle.\n\n  '${t.specifier}' is server-only (node:* / database / ai / cluster / protocol session / db driver),\n  and the web client loads rpcGroup VALUE-LEVEL — this crashes the browser with\n  "Module …node:crypto… has been externalized for browser compatibility", or bloats the\n  bundle with the whole server graph.\n\n  import chain:\n      → ${n}\n\n  Fix: keep the descriptor (*.query/.mutation/.action.ts), the workflow descriptor\n  (*.workflow.tsx, import from @voltro/workflow/define), AND any plugin error schema\n  browser-safe. Move DB-backed / node: code behind a *.server.ts file or a browser-safe\n  subpath (e.g. a plugin's '/errors' export). Escape hatch (not recommended):\n  VOLTRO_BROWSER_SAFETY=off.`);
-}, To = /\.(query|mutation|action|stream)\.ts$/, Eo = /\.(query|mutation|action|stream)\.server\.ts$/, Do = /\.workflow\.tsx$/, Oo = /(?<!\.server)\.agent\.tsx?$/, J = /\.connection\.tsx?$/, ko = /* @__PURE__ */ new Set([
+}, wo = /\.(query|mutation|action|stream)\.ts$/, To = /\.(query|mutation|action|stream)\.server\.ts$/, Eo = /\.workflow\.tsx$/, Do = /(?<!\.server)\.agent\.tsx?$/, Oo = /\.connection\.tsx?$/, ko = /* @__PURE__ */ new Set([
 	"node_modules",
 	"dist",
 	"build",
@@ -659,22 +659,22 @@ var Oa = (e, t) => {
 	".git"
 ]), Ao = async (e) => {
 	let t = async (e) => {
-		let n = await L.readdir(e, { withFileTypes: !0 }).catch(() => []);
+		let n = await R.readdir(e, { withFileTypes: !0 }).catch(() => []);
 		for (let r of n) if (!ko.has(r.name)) {
 			if (r.isDirectory()) {
 				if (await t(O(e, r.name))) return !0;
-			} else if (r.isFile() && J.test(r.name)) return !0;
+			} else if (r.isFile() && Oo.test(r.name)) return !0;
 		}
 		return !1;
 	};
 	return t(e);
 }, jo = async (e) => {
 	let t = [], n = async (e) => {
-		let r = await L.readdir(e, { withFileTypes: !0 });
+		let r = await R.readdir(e, { withFileTypes: !0 });
 		for (let i of r) {
 			if (ko.has(i.name)) continue;
 			let r = O(e, i.name);
-			i.isDirectory() ? await n(r) : i.isFile() && (To.test(i.name) && !Eo.test(i.name) || Do.test(i.name) || Oo.test(i.name)) && t.push(r);
+			i.isDirectory() ? await n(r) : i.isFile() && (wo.test(i.name) && !To.test(i.name) || Eo.test(i.name) || Do.test(i.name)) && t.push(r);
 		}
 	};
 	return await n(e), t;
@@ -698,9 +698,9 @@ var Oa = (e, t) => {
 }, Io = async (e) => {
 	let t = [];
 	for (let n of e) {
-		if (!Oo.test(n)) continue;
+		if (!Do.test(n)) continue;
 		let e = await import(j(n).href);
-		for (let [r, i] of Object.entries(e)) ma(i) && t.push({
+		for (let [r, i] of Object.entries(e)) pa(i) && t.push({
 			file: n,
 			exportName: r,
 			name: i.name
@@ -858,10 +858,10 @@ ${a.join("\n\n")}\n`);
 	return [
 		"// THIS FILE IS GENERATED — DO NOT EDIT BY HAND.",
 		"// Re-emitted by `voltro dev` whenever query/mutation/action/stream/workflow files change.",
-		`// descriptor-fingerprint: ${Ji("sha1").update(Se.map((e) => {
+		`// descriptor-fingerprint: ${qi("sha1").update(Se.map((e) => {
 			let t = "";
 			try {
-				t = Et(e.file, "utf8");
+				t = Tt(e.file, "utf8");
 			} catch {}
 			return `${e.rpcTag}${t}`;
 		}).join("
")).digest("hex").slice(0, 16)}`,
@@ -1017,7 +1017,7 @@ ${a.join("\n\n")}\n`);
 		"workflows"
 	]), c = (e) => e.slice(e.lastIndexOf("/") + 1), l = o;
 	for (; l !== t && s.has(c(l));) l = l.slice(0, l.lastIndexOf("/")) || "/";
-	let u = A(e.outputFile ?? O(l, "rpcGroup.generated.ts")), d = [...new Map((e.pluginErrorImports ?? []).map((e) => [`${e.module}#${e.name}`, e])).values()], f = [...new Map((e.pluginRpcImports ?? []).map((e) => [e.tag, e])).values()], p = Vo(t, u, r, d, i, Er(), a, f), m = [];
+	let u = A(e.outputFile ?? O(l, "rpcGroup.generated.ts")), d = [...new Map((e.pluginErrorImports ?? []).map((e) => [`${e.module}#${e.name}`, e])).values()], f = [...new Map((e.pluginRpcImports ?? []).map((e) => [e.tag, e])).values()], p = Vo(t, u, r, d, i, Tr(), a, f), m = [];
 	for (let t of e.pluginContributions ?? []) {
 		let e = null;
 		try {
@@ -1034,9 +1034,9 @@ ${a.join("\n\n")}\n`);
 	}
 	let h = m.length === 0 ? p : `${p}\n\n// ---- plugin codegen ----\n\n${m.join("\n")}`, g = null;
 	try {
-		g = await L.readFile(u, "utf8");
+		g = await R.readFile(u, "utf8");
 	} catch {}
-	return g !== h && await L.writeFile(u, h, "utf8"), await wo(u), u;
+	return g !== h && await R.writeFile(u, h, "utf8"), await Co(u), u;
 }, Uo = (e) => {
 	let t = [];
 	for (let n of e) for (let e of n) {
@@ -1050,31 +1050,31 @@ ${a.join("\n\n")}\n`);
 	}
 	return t;
 }, Wo = (e, t) => {
-	let n = Ti(e);
-	return n.length === 0 ? 0 : (t(gi(n)), n.length);
+	let n = wi(e);
+	return n.length === 0 ? 0 : (t(hi(n)), n.length);
 }, Go = async (e) => {
-	let t = e.spec ?? er, n;
+	let t = e.spec ?? $n, n;
 	return t.kind !== "noop" && e.sqlLayer !== void 0 ? n = await N.runPromise(N.gen(function* () {
-		let n = yield* B.SqlClient, r = t.build(n);
+		let n = yield* V.SqlClient, r = t.build(n);
 		return t.initialize && (yield* t.initialize(r).pipe(N.catchAll((t) => N.sync(() => e.log.warn("analytics sink initialize failed", {
 			provider: r.info.provider,
 			err: String(t)
 		}))))), r;
-	}).pipe(N.provide(e.sqlLayer))) : (t.kind !== "noop" && e.sqlLayer === void 0 && e.log.warn(`analytics sink '${t.kind}' requires a real SQL store — falling back to noop`), n = z()), e.log.info("analytics sink", {
+	}).pipe(N.provide(e.sqlLayer))) : (t.kind !== "noop" && e.sqlLayer === void 0 && e.log.warn(`analytics sink '${t.kind}' requires a real SQL store — falling back to noop`), n = B()), e.log.info("analytics sink", {
 		provider: n.info.provider,
 		capabilities: n.info.capabilities,
 		...n.info.detail ?? {}
 	}), {
 		spec: t,
 		sink: n,
-		layer: P.succeed(R, n),
+		layer: P.succeed(z, n),
 		tables: t.tables ?? [],
 		dispose: async () => {
 			t.dispose && await N.runPromise(t.dispose(n).pipe(N.timeout("1200 millis"), N.ignore));
 		}
 	};
 }, Ko = "@effect/cluster@0.59.0", X = "@effect__cluster@0.59.0.patch", qo = `patches/${X}`, Jo = D(dt(import.meta.url)), Yo = [A(Jo, "..", "templates", "patches", X), A(Jo, "..", "..", "templates", "patches", X)], Xo = async () => {
-	for (let e of Yo) if (Tt(e)) return L.readFile(e, "utf8");
+	for (let e of Yo) if (L(e)) return R.readFile(e, "utf8");
 	throw Error(`@effect/cluster patch asset not found (looked in: ${Yo.join(", ")}). This is a packaging bug — the CLI should ship it under templates/patches/.`);
 }, Zo = (e) => RegExp(`['"]?${Ko.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}['"]?\\s*:`).test(e), Qo = (e) => {
 	if (Zo(e)) return null;
@@ -1083,7 +1083,7 @@ ${a.join("\n\n")}\n`);
 }, $o = (e) => {
 	let t = A(e);
 	for (let e = 0; e < 12; e++) {
-		if (Tt(O(t, "pnpm-workspace.yaml"))) return t;
+		if (L(O(t, "pnpm-workspace.yaml"))) return t;
 		let e = D(t);
 		if (e === t) break;
 		t = e;
@@ -1095,7 +1095,7 @@ ${a.join("\n\n")}\n`);
 	let n = await ts(t);
 	return n.fullyWired ? null : `mssql + durable cluster workflows need the @effect/cluster patch, which a plain install cannot carry. Run \`voltro add mssql\` then \`pnpm install\` to wire it (missing: ${[n.patchFilePresent ? null : qo, n.pnpmEntryPresent ? null : "patchedDependencies in pnpm-workspace.yaml"].filter(Boolean).join(" + ")}). Without it, workflow message/runner storage misbehaves on SQL Server.`;
 }, ts = async (e) => {
-	let t = Tt(O(e, qo)), n = O(e, "pnpm-workspace.yaml"), r = Tt(n) && Zo(await L.readFile(n, "utf8"));
+	let t = L(O(e, qo)), n = O(e, "pnpm-workspace.yaml"), r = L(n) && Zo(await R.readFile(n, "utf8"));
 	return {
 		patchFilePresent: t,
 		pnpmEntryPresent: r,
@@ -1103,11 +1103,11 @@ ${a.join("\n\n")}\n`);
 	};
 }, ns = async (e) => {
 	let t = [], n = O(e, qo), r = await Xo();
-	(Tt(n) ? await L.readFile(n, "utf8") : null) !== r && (await L.mkdir(D(n), { recursive: !0 }), await L.writeFile(n, r, "utf8"), t.push(`patch file → ${qo}`));
+	(L(n) ? await R.readFile(n, "utf8") : null) !== r && (await R.mkdir(D(n), { recursive: !0 }), await R.writeFile(n, r, "utf8"), t.push(`patch file → ${qo}`));
 	let i = O(e, "pnpm-workspace.yaml");
-	if (Tt(i)) {
-		let e = Qo(await L.readFile(i, "utf8"));
-		e !== null && (await L.writeFile(i, e, "utf8"), t.push(`patchedDependencies['${Ko}'] → pnpm-workspace.yaml`));
+	if (L(i)) {
+		let e = Qo(await R.readFile(i, "utf8"));
+		e !== null && (await R.writeFile(i, e, "utf8"), t.push(`patchedDependencies['${Ko}'] → pnpm-workspace.yaml`));
 	}
 	return t;
 }, rs = (e) => e.replace(/\.subscribe\.tsx?$/, ""), is = async (e, t) => {
@@ -1143,8 +1143,8 @@ ${a.join("\n\n")}\n`);
 	return n;
 }, as = (e, t, n, r) => {
 	if (e.length === 0) return () => {};
-	let i = Or(t, {
-		subject: Bt,
+	let i = Dr(t, {
+		subject: zt,
 		schemaRegistry: r
 	}), a = [];
 	for (let r of e) {
@@ -1161,7 +1161,7 @@ ${a.join("\n\n")}\n`);
 					e.warn("subscriber: handler rejected", {
 						table: o,
 						op: t.op
-					}, n), Di({
+					}, n), Ei({
 						error: n,
 						source: "subscriber",
 						name: o,
@@ -1175,7 +1175,7 @@ ${a.join("\n\n")}\n`);
 				e.warn("subscriber: handler threw synchronously", {
 					table: o,
 					op: t.op
-				}, n), Di({
+				}, n), Ei({
 					error: n,
 					source: "subscriber",
 					name: o,
@@ -1244,7 +1244,7 @@ ${a.join("\n\n")}\n`);
 		}
 		a = !0;
 		try {
-			let t = await rn({
+			let t = await nn({
 				store: n,
 				handlers: i,
 				...e.batchSize === void 0 ? {} : { batchSize: e.batchSize }
@@ -1271,7 +1271,7 @@ ${a.join("\n\n")}\n`);
 		drainOnce: c
 	};
 }, ls = "<builtin:connections>", us = {
-	registry: On([]),
+	registry: Dn([]),
 	queries: [],
 	mutations: [],
 	actions: [],
@@ -1280,16 +1280,16 @@ ${a.join("\n\n")}\n`);
 }, ds = (e) => {
 	let { definitions: t, store: n, publicUrl: r, log: i } = e;
 	if (t.length === 0) return us;
-	Gt(t);
-	let a = On(t), o = {
+	Wt(t);
+	let a = Dn(t), o = {
 		registry: a,
 		publicUrl: r
 	};
-	gr(kn({
+	hr(On({
 		store: n,
 		registry: a
 	}));
-	let s = Ln(o), c = Kn(o), l = qn(o), u = Nn(o), d = t.some((e) => e.kind === "oauth2"), f = d ? [{
+	let s = In(o), c = Gn(o), l = Kn(o), u = Mn(o), d = t.some((e) => e.kind === "oauth2"), f = d ? [{
 		method: "GET",
 		path: "/_voltro/connections",
 		handle: async (e) => {
@@ -1310,7 +1310,7 @@ ${a.join("\n\n")}\n`);
 				contentType: "text/plain"
 			};
 			try {
-				let e = await en({
+				let e = await $t({
 					store: n,
 					registry: a,
 					state: s,
@@ -1331,30 +1331,30 @@ ${a.join("\n\n")}\n`);
 		connections: t.map((e) => `${e.id} (${e.kind})`),
 		callback: d ? "/_voltro/connections/<id>/callback" : "(no oauth2 connection declared)",
 		routes: [
-			wi.name,
-			Si.name,
 			Ci.name,
-			xi.name
+			xi.name,
+			Si.name,
+			bi.name
 		]
 	}), {
 		registry: a,
 		queries: [{
 			file: ls,
-			descriptor: wi,
+			descriptor: Ci,
 			executor: (e, t) => s(e, t)
 		}],
 		mutations: [{
 			file: ls,
-			descriptor: Ci,
+			descriptor: Si,
 			executor: (e, t) => l(e, t)
 		}, {
 			file: ls,
-			descriptor: xi,
+			descriptor: bi,
 			executor: (e, t) => u(e, t)
 		}],
 		actions: [{
 			file: ls,
-			descriptor: Si,
+			descriptor: xi,
 			executor: (e, t) => c(e, t)
 		}],
 		httpRoutes: f,
@@ -1362,7 +1362,7 @@ ${a.join("\n\n")}\n`);
 	};
 }, fs = (e) => ({
 	status: 302,
-	headers: { location: mr(e.startsWith("/") ? e : `/${e}`) },
+	headers: { location: pr(e.startsWith("/") ? e : `/${e}`) },
 	body: ""
 }), ps = (e) => process.env.VOLTRO_PUBLIC_URL?.replace(/\/+$/, "") ?? `http://localhost:${e}`, ms = (e) => e.replace(/\.reaction\.tsx?$/, ""), hs = async (e, t) => {
 	let n = [];
@@ -1425,7 +1425,7 @@ ${a.join("\n\n")}\n`);
 		add: (e) => {
 			i.add(e);
 		}
-	}, o = new Rt(), s = /* @__PURE__ */ new Map();
+	}, o = new Lt(), s = /* @__PURE__ */ new Map();
 	for (let t of e) {
 		let e = r.child(`reaction:${t.id}`), n = s.get(t.definition.watch.table) ?? [];
 		n.push({
@@ -1446,7 +1446,7 @@ ${a.join("\n\n")}\n`);
 		...e
 	}), l = t.onChange((e) => {
 		let t = s.get(e.table);
-		if (t !== void 0) for (let { reaction: n, log: r } of t) pr(n, e, c()).then((t) => {
+		if (t !== void 0) for (let { reaction: n, log: r } of t) fr(n, e, c()).then((t) => {
 			t === "acted" && r.info("reaction: acted", {
 				table: e.table,
 				op: e.op
@@ -1455,7 +1455,7 @@ ${a.join("\n\n")}\n`);
 			r.warn("reaction: dispatch failed", {
 				table: e.table,
 				op: e.op
-			}, t), Di({
+			}, t), Ei({
 				error: t,
 				source: "reaction",
 				name: n.name,
@@ -1548,10 +1548,10 @@ ${a.join("\n\n")}\n`);
 		lastError: null,
 		nextRefreshAt: null
 	}, r = (t) => N.runPromise(t.pipe(N.provide(e))), i = () => N.gen(function* () {
-		let e = yield* B.SqlClient;
+		let e = yield* V.SqlClient;
 		yield* e.unsafe(bs).pipe(N.orDie), yield* e.unsafe(xs).pipe(N.orDie), yield* e.unsafe(Ss).pipe(N.orDie);
 	}), a = () => N.gen(function* () {
-		let e = yield* B.SqlClient, n = yield* e`SELECT * FROM ${e(Z)}`.pipe(N.orElseSucceed(() => []));
+		let e = yield* V.SqlClient, n = yield* e`SELECT * FROM ${e(Z)}`.pipe(N.orElseSucceed(() => []));
 		for (let r of n) {
 			let n = yield* e`
           SELECT ${e("row_index")} AS row_index, ${e("row_data")} AS row_data
@@ -1569,7 +1569,7 @@ ${a.join("\n\n")}\n`);
 			});
 		}
 	}), o = (e, t) => N.gen(function* () {
-		let n = yield* B.SqlClient, r = (yield* n`
+		let n = yield* V.SqlClient, r = (yield* n`
         SELECT ${n("generation")} AS generation
         FROM ${n(Z)}
         WHERE ${n("name")} = ${e}
@@ -1607,7 +1607,7 @@ ${a.join("\n\n")}\n`);
             AND ${n("generation")} < ${i}
         `.pipe(N.orDie));
 	}), s = (e, t) => N.gen(function* () {
-		let n = yield* B.SqlClient;
+		let n = yield* V.SqlClient;
 		yield* n`
         UPDATE ${n(Z)} SET
           ${n("refreshed_at")} = ${t.refreshedAt ? t.refreshedAt.toISOString() : null},
@@ -1668,7 +1668,7 @@ ${a.join("\n\n")}\n`);
 		},
 		refreshMirror: async (e) => {
 			await r(N.gen(function* () {
-				let n = yield* B.SqlClient, r = (yield* n`
+				let n = yield* V.SqlClient, r = (yield* n`
           SELECT * FROM ${n(Z)}
           WHERE ${n("name")} = ${e}
         `.pipe(N.orElseSucceed(() => [])))[0];
@@ -1701,7 +1701,7 @@ ${a.join("\n\n")}\n`);
 			continue;
 		}
 		let a = e.default;
-		if (!fn(a)) {
+		if (!dn(a)) {
 			t.warn("aggregate: default export is not a defineAggregate() result", { file: i });
 			continue;
 		}
@@ -1753,7 +1753,7 @@ ${a.join("\n\n")}\n`);
 	for (let e = 0; e < t.length; e++) {
 		let i = n(t[e]);
 		if (i._tag === "Left") {
-			let t = ha.formatErrorSync(i.left)[0], n = t?.path?.length ? t.path.join(".") : "<root>";
+			let t = ma.formatErrorSync(i.left)[0], n = t?.path?.length ? t.path.join(".") : "<root>";
 			return {
 				ok: !1,
 				reason: `row[${e}] failed output-schema decode at ${n}: ${t?.message ?? "unknown"}`
@@ -1863,7 +1863,7 @@ ${a.join("\n\n")}\n`);
 			...r.meta,
 			lastError: n,
 			nextRefreshAt: a
-		}), l.warn("refresh failed — last-good rows preserved", { err: n }), Di({
+		}), l.warn("refresh failed — last-good rows preserved", { err: n }), Ei({
 			error: e,
 			source: "aggregate",
 			name: t.name
@@ -1909,7 +1909,7 @@ ${a.join("\n\n")}\n`);
 }, Is = (e) => {
 	let { definition: t, store: n, storage: r, log: i, schedule: a } = e, o = t.incremental;
 	if (o === void 0) return;
-	let s = i.child(`aggregate:${t.name}`), c = new jt({
+	let s = i.child(`aggregate:${t.name}`), c = new At({
 		op: o.op,
 		...o.column === void 0 ? {} : { column: o.column },
 		...o.groupBy === void 0 ? {} : { groupBy: o.groupBy }
@@ -1970,7 +1970,7 @@ ${a.join("\n\n")}\n`);
 	}, m);
 	h.unref(), a.scheduleTimer = h;
 }, Ls = async (e) => {
-	let t = e.storage ?? ys(), n = e.coordinator ?? br, r = e.analytics ?? z(), i = e.log;
+	let t = e.storage ?? ys(), n = e.coordinator ?? yr, r = e.analytics ?? B(), i = e.log;
 	await t.initialize();
 	let a = /* @__PURE__ */ new Map(), o = /* @__PURE__ */ new Map(), s = /* @__PURE__ */ new Map(), c = {
 		refreshedAt: null,
@@ -2051,13 +2051,13 @@ ${a.join("\n\n")}\n`);
 	return {
 		registry: {
 			getHandle: (a) => {
-				let l = s.has(a.name), u = () => N.fail(new Mt({ name: a.name }));
+				let l = s.has(a.name), u = () => N.fail(new jt({ name: a.name }));
 				return l ? {
 					read: (e) => N.gen(function* () {
 						let n = t.get(a.name);
 						if (e?.maxAgeMs !== void 0) {
 							let t = n.meta.refreshedAt, r = t === null ? Infinity : Date.now() - t.getTime();
-							if (r > e.maxAgeMs) return yield* N.fail(new Pt({
+							if (r > e.maxAgeMs) return yield* N.fail(new Nt({
 								name: a.name,
 								ageMs: Number.isFinite(r) ? r : -1,
 								maxAgeMs: e.maxAgeMs
@@ -2077,7 +2077,7 @@ ${a.join("\n\n")}\n`);
 							refreshState: o.get(a.name),
 							scheduledAt: /* @__PURE__ */ new Date()
 						}),
-						catch: (e) => new At({
+						catch: (e) => new kt({
 							name: a.name,
 							operation: "refresh",
 							cause: e instanceof Error ? `${e.name}: ${e.message}` : String(e)
@@ -2119,7 +2119,7 @@ ${a.join("\n\n")}\n`);
 	};
 }, Rs = {
 	getHandle: (e) => ({
-		read: () => N.fail(new Mt({ name: e.name })),
+		read: () => N.fail(new jt({ name: e.name })),
 		meta: () => N.succeed({
 			refreshedAt: null,
 			rowCount: 0,
@@ -2127,7 +2127,7 @@ ${a.join("\n\n")}\n`);
 			lastError: null,
 			nextRefreshAt: null
 		}),
-		refresh: () => N.fail(new Mt({ name: e.name }))
+		refresh: () => N.fail(new jt({ name: e.name }))
 	}),
 	snapshot: () => [],
 	refreshByName: async () => !1
@@ -2280,7 +2280,7 @@ ${a.join("\n\n")}\n`);
 			t.warn("webhook: failed to import", { file: a }, e);
 			continue;
 		}
-		let o = (e.default && ba(e.default) ? e.default : void 0) ?? Object.values(e).find(ba);
+		let o = (e.default && ya(e.default) ? e.default : void 0) ?? Object.values(e).find(ya);
 		if (!o) {
 			t.warn("webhook: no descriptor default-exported", { file: a });
 			continue;
@@ -2321,7 +2321,7 @@ ${a.join("\n\n")}\n`);
 			t.warn("email: failed to import", { file: r }, e);
 			continue;
 		}
-		let i = Object.values(e).filter(Sa);
+		let i = Object.values(e).filter(xa);
 		if (i.length === 0) {
 			t.warn("email: no defineEmail export found", { file: r });
 			continue;
@@ -2333,14 +2333,14 @@ ${a.join("\n\n")}\n`);
 	}
 	return { templates: n };
 }, ic = (e) => N.map(e, (e) => ({ text: e })), ac = (e) => {
-	let { descriptor: t, executor: n, file: r } = e, { send: i, messages: a } = pa(t);
+	let { descriptor: t, executor: n, file: r } = e, { send: i, messages: a } = fa(t);
 	return [{
 		kind: "action",
 		file: r,
 		descriptor: i,
 		executor: (e, t) => {
 			let { threadId: r, order: i } = e, a = t.request?.subject?.tenantId ?? null;
-			return Jr(n, t.store, {
+			return qr(n, t.store, {
 				threadId: r,
 				input: e,
 				tenantId: a,
@@ -2355,27 +2355,27 @@ ${a.join("\n\n")}\n`);
 		kind: "query",
 		file: r,
 		descriptor: a,
-		executor: (e, t) => qr(t.store, e.threadId)
+		executor: (e, t) => Kr(t.store, e.threadId)
 	}];
-}, oc = "<builtin:undo>", sc = () => Er() ? {
+}, oc = "<builtin:undo>", sc = () => Tr() ? {
 	queries: [{
 		file: oc,
-		descriptor: Mi,
-		executor: (e, t) => Dr(e, t)
+		descriptor: ji,
+		executor: (e, t) => Er(e, t)
 	}],
 	mutations: [{
 		file: oc,
-		descriptor: ji,
-		executor: (e, t) => Wt(e, t)
+		descriptor: Ai,
+		executor: (e, t) => Ut(e, t)
 	}, {
 		file: oc,
-		descriptor: Ni,
-		executor: (e, t) => or(e, t)
+		descriptor: Mi,
+		executor: (e, t) => ar(e, t)
 	}]
 } : {
 	queries: [],
 	mutations: []
-}, cc = () => Er() ? (e) => Jn(e) : (e) => ({
+}, cc = () => Tr() ? (e) => qn(e) : (e) => ({
 	tx: e,
 	persist: async () => {}
 }), lc = {
@@ -2476,7 +2476,7 @@ ${a.join("\n\n")}\n`);
 			}
 			let n = (process.env.VOLTRO_STRICT_PLUGIN_COMPAT ?? "").toLowerCase(), i = n === "1" || n === "true";
 			for (let t of e.plugins) {
-				let n = vi(t.name, t.framework, e.voltroVersion);
+				let n = _i(t.name, t.framework, e.voltroVersion);
 				if (!n.ok) {
 					if (i) {
 						let r = `plugin "${t.name}" is incompatible with framework ${e.voltroVersion}: ${n.reason}. Pin a compatible plugin version, or unset VOLTRO_STRICT_PLUGIN_COMPAT to downgrade this to a warning.`;
@@ -2788,11 +2788,11 @@ ${a.join("\n\n")}\n`);
 }), Mc = (e, t) => {
 	let n = [];
 	for (let r of e) typeof r.onWorkflowStep == "function" && n.push(jc(r.name, r.onWorkflowStep, t));
-	return n.length === 0 ? P.succeed(Mr, { interceptor: ((e) => e) }) : P.succeed(Mr, { interceptor: ((e, t) => n.reduceRight((e, n) => n(e, t), e)) });
+	return n.length === 0 ? P.succeed(jr, { interceptor: ((e) => e) }) : P.succeed(jr, { interceptor: ((e, t) => n.reduceRight((e, n) => n(e, t), e)) });
 }, Nc = (e) => {
 	if (!e) return;
 	let t = e.workflowName ?? e.tag, n = [];
-	if (t !== void 0 && n.push(V("tag", t)), e.status !== void 0 && n.push(V("status", e.status)), n.length !== 0) return n.length === 1 ? n[0] : Zr(...n);
+	if (t !== void 0 && n.push(H("tag", t)), e.status !== void 0 && n.push(H("status", e.status)), n.length !== 0) return n.length === 1 ? n[0] : Xr(...n);
 }, Pc = async (e, t) => {
 	let n = Math.max(0, t?.offset ?? 0), r = Math.max(1, Math.min(500, t?.limit ?? 50)), i = Nc(t);
 	return {
@@ -2840,7 +2840,7 @@ ${a.join("\n\n")}\n`);
 	let r = (await e.store.query({
 		table: "_voltro_workflow_runs",
 		order: [],
-		predicate: V("id", t),
+		predicate: H("id", t),
 		projection: void 0,
 		skip: void 0,
 		take: 1
@@ -2907,7 +2907,7 @@ ${a.join("\n\n")}\n`);
 	let t = [], n = async (e) => {
 		let r;
 		try {
-			r = await L.readdir(e, { withFileTypes: !0 });
+			r = await R.readdir(e, { withFileTypes: !0 });
 		} catch {
 			return;
 		}
@@ -3156,7 +3156,7 @@ ${a.join("\n\n")}\n`);
 	let t = e.now ?? Date.now, n = {
 		phase: "booting",
 		startedAt: t()
-	}, r = Da((e, r) => {
+	}, r = Ea((e, r) => {
 		let i = (e.url ?? "/").split("?")[0], a = n.phase === "ready";
 		if (i === "/internal/liveness") {
 			r.writeHead(200, {
@@ -3213,7 +3213,7 @@ ${a.join("\n\n")}\n`);
 	});
 }, $ = F({ scope: "voltro:dev" }), pl = await (async () => {
 	try {
-		let e = O(D(dt(import.meta.url)), "..", "package.json"), t = await L.readFile(e, "utf8");
+		let e = O(D(dt(import.meta.url)), "..", "package.json"), t = await R.readFile(e, "utf8");
 		return JSON.parse(t).version ?? "0.0.0";
 	} catch {
 		return "0.0.0";
@@ -3221,18 +3221,18 @@ ${a.join("\n\n")}\n`);
 })(), ml = process.env.TENANT ?? "acme", hl = process.env.VOLTRO_SESSION_COOKIE ?? "voltro:session", gl = {
 	id: "voltro-password",
 	resolve: (e) => {
-		let t = Gi(e.headers.cookie ?? e.headers.Cookie, hl);
+		let t = Wi(e.headers.cookie ?? e.headers.Cookie, hl);
 		if (!t) return { kind: "skip" };
-		let n = Ki();
+		let n = Gi();
 		if (!n) return { kind: "skip" };
-		let r = qi(t, n);
+		let r = Ki(t, n);
 		return r ? {
 			kind: "matched",
 			subject: r.subject
 		} : { kind: "skip" };
 	}
-}, _l = (e = [], t, n = !1, r, i) => (vl([t ?? gl, ...e]), yi([t ?? gl, ...e], {
-	...n ? { anonymousTenantRequired: !0 } : { fallback: (e) => _i(e.headers["x-tenant"] ?? ml) },
+}, _l = (e = [], t, n = !1, r, i) => (vl([t ?? gl, ...e]), vi([t ?? gl, ...e], {
+	...n ? { anonymousTenantRequired: !0 } : { fallback: (e) => gi(e.headers["x-tenant"] ?? ml) },
 	onStrategyFailed: ({ strategyId: e, reason: t }) => {
 		$.warn(`auth strategy "${e}" rejected request: ${t}`);
 	},
@@ -3248,10 +3248,10 @@ ${a.join("\n\n")}\n`);
 		e === void 0 || e === "" || t.set(e, [...t.get(e) ?? [], n.id]);
 	}
 	for (let [e, n] of t) n.length < 2 || $.warn(`auth: ${n.length} strategies claim the bearer prefix "${e}" (${n.join(", ")}). The chain is first-match-wins, so the FIRST one decides the Subject for every token with this shape — if they resolve to different authority, which one answered decides whether authorization works. If this is \`apiKeys: true\` alongside your own key strategy, either drop one or give them distinct prefixes (\`apiKeys: { prefix: "…" }\`).`);
-}, yl = (e) => P.succeed(di, di.of(({ headers: t, clientId: n }) => N.promise(async () => ln(n) || e({
+}, yl = (e) => P.succeed(ui, ui.of(({ headers: t, clientId: n }) => N.promise(async () => cn(n) || e({
 	headers: t,
 	clientId: n
-})))), bl = P.succeed(fi, fi.of(({ clientId: e }) => N.succeed({ clientId: e }))), xl = (e) => {
+})))), bl = P.succeed(di, di.of(({ clientId: e }) => N.succeed({ clientId: e }))), xl = (e) => {
 	if (pt.isCause(e)) return e;
 	if (typeof e != "object" || !e) return;
 	for (let t of Object.getOwnPropertySymbols(e)) if (t.description === "effect/Runtime/FiberFailure/Cause") {
@@ -3271,7 +3271,7 @@ ${a.join("\n\n")}\n`);
 	if (e == null) return { message: "unknown error" };
 	let t = Sl(e);
 	if (t !== void 0 && t !== e) return Cl(t);
-	let n = on(e), r = (n.dbCode ?? n.dbSqlState ?? n.dbErrno ?? n.dbConstraint) === void 0 ? {} : n;
+	let n = an(e), r = (n.dbCode ?? n.dbSqlState ?? n.dbErrno ?? n.dbConstraint) === void 0 ? {} : n;
 	if (typeof e == "object" && "_tag" in e) return {
 		...e,
 		...r
@@ -3297,7 +3297,7 @@ ${a.join("\n\n")}\n`);
 	".git"
 ]), Tl = async (e) => {
 	let t = [], n = async (e) => {
-		let r = await L.readdir(e, { withFileTypes: !0 });
+		let r = await R.readdir(e, { withFileTypes: !0 });
 		for (let i of r) {
 			if (wl.has(i.name)) continue;
 			let r = O(e, i.name);
@@ -3364,7 +3364,7 @@ ${a.join("\n\n")}\n`);
 				column: "startedAt",
 				direction: "desc"
 			}],
-			predicate: i !== null && i.length > 0 ? V("traceId", i) : void 0,
+			predicate: i !== null && i.length > 0 ? H("traceId", i) : void 0,
 			projection: void 0,
 			skip: void 0,
 			take: i !== null && i.length > 0 ? 1e3 : 2e3
@@ -3388,11 +3388,11 @@ ${a.join("\n\n")}\n`);
 		if (Me.test(e)) {
 			let e = await b(t);
 			for (let t of Object.values(e)) Fl(t) && (f.set(t.tableName, t), Rl(t) && u.add(t.tableName), Bl(t) && d.add(t.tableName));
-			oi(e);
+			ai(e);
 			continue;
 		}
 		if (Ne.test(e)) {
-			oi(await b(t)) === 0 && $.warn("skipping relations file — no relations(...) export found", { file: t });
+			ai(await b(t)) === 0 && $.warn("skipping relations file — no relations(...) export found", { file: t });
 			continue;
 		}
 		if (Te(e)) {
@@ -3428,12 +3428,12 @@ ${a.join("\n\n")}\n`);
 				definition: n,
 				buildExecute: a
 			});
-			for (let t of [...Object.values(e), ...Object.values(i)]) Ir(t) && s.push(t);
+			for (let t of [...Object.values(e), ...Object.values(i)]) Fr(t) && s.push(t);
 			continue;
 		}
 		if (Ee.test(e)) {
-			let n = await b(t), r = n.default ?? Object.values(n).find(gn);
-			if (!gn(r)) {
+			let n = await b(t), r = n.default ?? Object.values(n).find(hn);
+			if (!hn(r)) {
 				$.warn("skipping trigger — default export is not triggerWorkflow(...)", { file: t });
 				continue;
 			}
@@ -3450,7 +3450,7 @@ ${a.join("\n\n")}\n`);
 		}
 		if (Pe.test(e)) {
 			let e = (await b(t)).default;
-			if (!hn(e)) {
+			if (!mn(e)) {
 				$.warn("skipping cron — default export is not defineSchedule(...)", { file: t });
 				continue;
 			}
@@ -3513,20 +3513,20 @@ ${a.join("\n\n")}\n`);
 	}
 	let h = /* @__PURE__ */ new Map();
 	for (let [e, t] of f) {
-		let n = ci(t);
+		let n = si(t);
 		n.length > 0 && h.set(e, n);
 	}
 	if (h.size > 0) {
-		let e = sn(n.flatMap((e) => hr({
+		let e = on(n.flatMap((e) => mr({
 			name: e.descriptor.name,
 			output: e.descriptor.output,
 			source: e.descriptor.source
 		}, h)));
 		e !== void 0 && $.warn(`[serverOnly] ${e}`);
 	}
-	f.has("actors") || f.set("actors", Yr);
+	f.has("actors") || f.set("actors", Jr);
 	let g = f.get("actors"), _ = f.get("tenants");
-	(g !== void 0 || _ !== void 0) && ai({
+	(g !== void 0 || _ !== void 0) && ii({
 		...g === void 0 ? {} : { actors: () => g },
 		..._ === void 0 ? {} : { tenants: () => _ }
 	});
@@ -3538,7 +3538,7 @@ ${a.join("\n\n")}\n`);
 		outbox: e.some((e) => Fe.test(E(e))),
 		connections: ee.length > 0
 	};
-	return li(), {
+	return ci(), {
 		queries: n,
 		mutations: r,
 		actions: i,
@@ -3618,14 +3618,14 @@ ${a.join("\n\n")}\n`);
 	return 1e3 + (t >>> 0) % 2147482647;
 }, Zl = (e) => (process.env.DB_DIALECT ?? e?.store ?? "memory").toLowerCase(), Ql = async (e, t) => {
 	let n = Zl(e);
-	if (n === "memory") return $.info("sql dialect resolved: memory — in-process store, no persistence"), new Lt({});
-	let r = (process.env.CDC ?? "1") !== "0", i = await y(n), a = i.id === "postgres" ? "LISTEN/NOTIFY" : ni(i.id) ? "in-process bus" : i.id === "mariadb" ? "binlog CDC (ROW)" : i.id === "mssql" ? "Change Tracking (polled)" : i.id === "mysql" ? "binlog CDC (ROW)" : "inline only", o = i.id === "postgres" ? "native" : i.id === "mysql" ? "INSERT/UPDATE/DELETE then SELECT (no RETURNING)" : i.id === "mariadb" ? "native (INSERT/DELETE); UPDATE then SELECT" : i.id === "mssql" ? "OUTPUT INSERTED/DELETED" : ni(i.id) ? "native" : "unknown";
+	if (n === "memory") return $.info("sql dialect resolved: memory — in-process store, no persistence"), new It({});
+	let r = (process.env.CDC ?? "1") !== "0", i = await y(n), a = i.id === "postgres" ? "LISTEN/NOTIFY" : ti(i.id) ? "in-process bus" : i.id === "mariadb" ? "binlog CDC (ROW)" : i.id === "mssql" ? "Change Tracking (polled)" : i.id === "mysql" ? "binlog CDC (ROW)" : "inline only", o = i.id === "postgres" ? "native" : i.id === "mysql" ? "INSERT/UPDATE/DELETE then SELECT (no RETURNING)" : i.id === "mariadb" ? "native (INSERT/DELETE); UPDATE then SELECT" : i.id === "mssql" ? "OUTPUT INSERTED/DELETED" : ti(i.id) ? "native" : "unknown";
 	$.info(`sql dialect resolved: ${i.id} — CDC: ${r ? a : "inline emit (CDC=0)"}, RETURNING: ${o}`);
 	let s = Gl(), { summary: c, fromEnv: l } = Jl(s);
 	$.info(`db connection: ${c}${l ? "" : " (DEFAULT FALLBACK — no DB_URL / PG_HOST set)"}`), l || $.warn("db connection: falling back to localhost:5432/app — no DB_URL or PG_HOST env var set.\n  If this app should run against its OWN postgres (e.g. its docker-compose), set DB_URL.\n  Copy `.env.example` to `.env` in the app dir, or set DB_URL in the shell.\n  Otherwise this app is silently using whatever DB is at localhost:5432/app — which is\n  voltro-starter's docker default + may carry foreign tables that confuse the planner.");
 	let u;
 	if (r && (i.id === "mysql" || i.id === "mariadb")) {
-		let { connectionFromConfig: e } = await v("@voltro/sql-mysql"), t = process.env.POD_NAME ?? process.env.HOSTNAME ?? `dev-${process.pid}`, n = Xr().filter((e) => e.isReactive !== !1).map((e) => e.tableName).filter((e) => !e.startsWith("_voltro_"));
+		let { connectionFromConfig: e } = await v("@voltro/sql-mysql"), t = process.env.POD_NAME ?? process.env.HOSTNAME ?? `dev-${process.pid}`, n = Yr().filter((e) => e.isReactive !== !1).map((e) => e.tableName).filter((e) => !e.startsWith("_voltro_"));
 		u = {
 			serverId: Xl(t),
 			replicaId: t,
@@ -3637,7 +3637,7 @@ ${a.join("\n\n")}\n`);
 			tables: n.length
 		});
 	} else if (r && i.id === "mssql") {
-		let { connectionFromConfig: e } = await v("@voltro/sql-mssql"), t = e(s), n = process.env.POD_NAME ?? process.env.HOSTNAME ?? `dev-${process.pid}`, i = Xr().filter((e) => e.isReactive !== !1).map((e) => e.tableName).filter((e) => !e.startsWith("_voltro_"));
+		let { connectionFromConfig: e } = await v("@voltro/sql-mssql"), t = e(s), n = process.env.POD_NAME ?? process.env.HOSTNAME ?? `dev-${process.pid}`, i = Yr().filter((e) => e.isReactive !== !1).map((e) => e.tableName).filter((e) => !e.startsWith("_voltro_"));
 		u = {
 			serverId: 0,
 			replicaId: n,
@@ -3667,7 +3667,7 @@ ${a.join("\n\n")}\n`);
 		region: null,
 		localityEnabled: !1
 	}), d;
-	if (ni(i.id)) return $.warn(`read replicas: not applicable (${i.id} is single-process); ignoring DB_REPLICA_URLS`), ut.recordReplication({
+	if (ti(i.id)) return $.warn(`read replicas: not applicable (${i.id} is single-process); ignoring DB_REPLICA_URLS`), ut.recordReplication({
 		replicaCount: 0,
 		rywPolicy: "off",
 		rywStore: "memory",
@@ -3697,7 +3697,7 @@ ${a.join("\n\n")}\n`);
 		if (!e) $.warn("RYW_STORE=redis set but REDIS_URL is empty — falling back to memory store");
 		else try {
 			let { default: t } = await import("ioredis"), n = new t(e);
-			_ = ar({
+			_ = ir({
 				client: n,
 				subscriber: n.duplicate()
 			}), ee = "redis", $.info(`read replicas: ryw store = redis @ ${eu(e)}`);
@@ -3705,19 +3705,19 @@ ${a.join("\n\n")}\n`);
 			$.warn("RYW_STORE=redis but ioredis import / connect failed — falling back to memory store", { err: e });
 		}
 	}
-	_ ||= Qn();
-	let te = tu(f.length), ne = lr(), re = ne && te.length > 0 ? yn({
+	_ ||= Zn();
+	let te = tu(f.length), ne = cr(), re = ne && te.length > 0 ? vn({
 		currentRegion: ne,
 		replicaRegions: nu(m, te),
-		inner: nr()
-	}) : nr();
+		inner: tr()
+	}) : tr();
 	return $.info(`read replicas: ${m.length} configured, ryw policy '${h}', dialect=${i.id}, region=${ne ?? "unknown"}` + (te.length > 0 ? ", replica-locality=on" : "")), ut.recordReplication({
 		replicaCount: m.length,
 		rywPolicy: h,
 		rywStore: ee,
 		region: ne ?? null,
 		localityEnabled: te.length > 0 && ne !== void 0
-	}), new zt({
+	}), new Rt({
 		primary: d,
 		replicas: m,
 		replicationAdapter: p,
@@ -3726,10 +3726,10 @@ ${a.join("\n\n")}\n`);
 		replicaSelector: re
 	});
 }, $l = async (e, t, n, r) => {
-	let i = Ta(t?.plugins ?? []), a = n === "postgres" || n === "mysql" || n === "mariadb", o = n === "postgres" ? "LISTEN/NOTIFY" : "binlog CDC";
+	let i = wa(t?.plugins ?? []), a = n === "postgres" || n === "mysql" || n === "mariadb", o = n === "postgres" ? "LISTEN/NOTIFY" : "binlog CDC";
 	if (!i) return n === "memory" || n === "sqlite" || n === "turso" ? r.info(`reactivity: single-instance (${n}) — no cross-replica fan-out needed`) : a ? r.info(`reactivity: cross-instance via native ${o} (${n})`) : r.warn(`reactivity: cross-instance fan-out is OFF for dialect '${n}'. A write on one replica will NOT reach clients on other replicas. Add @voltro/plugin-broadcast (Redis / NATS) to close the gap, or use postgres (LISTEN/NOTIFY) / mariadb (binlog CDC).`), null;
 	let s = process.env.POD_NAME ?? process.env.HOSTNAME ?? `dev-${process.pid}`;
-	return i.broadcast.crossReplica ? a ? r.info(`reactivity: native ${o} (${n}) + @voltro/plugin-broadcast (${i.broadcast.provider.name}) — both paths active (own-origin skip dedups)`) : r.info(`reactivity: cross-instance via @voltro/plugin-broadcast (${i.broadcast.provider.name}) for dialect '${n}'`) : r.warn("reactivity: @voltro/plugin-broadcast resolved to the in-process memory provider — NO real cross-replica fan-out. Set BROADCAST_URL (redis:// or nats://) for a real bus."), await wa({
+	return i.broadcast.crossReplica ? a ? r.info(`reactivity: native ${o} (${n}) + @voltro/plugin-broadcast (${i.broadcast.provider.name}) — both paths active (own-origin skip dedups)`) : r.info(`reactivity: cross-instance via @voltro/plugin-broadcast (${i.broadcast.provider.name}) for dialect '${n}'`) : r.warn("reactivity: @voltro/plugin-broadcast resolved to the in-process memory provider — NO real cross-replica fan-out. Set BROADCAST_URL (redis:// or nats://) for a real bus."), await Ca({
 		store: e,
 		provider: i.broadcast.provider,
 		replicaId: s,
@@ -3761,7 +3761,7 @@ ${a.join("\n\n")}\n`);
 	}
 }, iu = async (e) => {
 	let t = A(e.find((e) => !e.startsWith("-")) ?? process.cwd()), n = await g(t);
-	return n.ran ? n.exitCode : process.env.FRAMEWORK_DEV_INNER !== "1" && process.env.WATCH !== "0" ? (m(uo({ root: t }), { scope: "voltro:dev" }), new Promise(() => {})) : au(t);
+	return n.ran ? n.exitCode : process.env.FRAMEWORK_DEV_INNER !== "1" && process.env.WATCH !== "0" ? (m(lo({ root: t }), { scope: "voltro:dev" }), new Promise(() => {})) : au(t);
 }, au = async (m) => {
 	let g = Date.now(), v = await Wl(m), b = Number(process.env.PORT ?? v?.port ?? 4e3), le = v?.name ?? E(m), x = o("api", le, b), ue = n(le);
 	await h({
@@ -3810,13 +3810,13 @@ ${a.join("\n\n")}\n`);
 		...je.length > 0 ? { pluginRpcImports: je } : {},
 		...v?.name === void 0 ? {} : { apiName: v.name }
 	});
-	if (Me ? ($.info("codegen wrote rpcGroup", { path: k(m, Me) }), await wo(Me)) : $.debug("codegen skipped — no descriptors discovered"), process.env.VOLTRO_BROWSER_SAFETY !== "off") {
-		let e = await So(m, C);
-		if (e.length > 0) throw Error(e.map(Co).join("\n\n"));
+	if (Me ? ($.info("codegen wrote rpcGroup", { path: k(m, Me) }), await Co(Me)) : $.debug("codegen skipped — no descriptors discovered"), process.env.VOLTRO_BROWSER_SAFETY !== "off") {
+		let e = await xo(m, C);
+		if (e.length > 0) throw Error(e.map(So).join("\n\n"));
 	}
-	let Ne = Zl(v ?? null), Pe = Ne === "mariadb" ? "mariadb" : Ne === "mssql" ? "mssql" : void 0, Le = Pe !== void 0 && (process.env.CDC ?? "1") !== "0", { queries: w, mutations: D, actions: A, streams: dt, workflows: j, workflowWorkers: ft, eventTriggers: mt, schedules: M, connections: ht, tables: gt, featureMix: vt, tenantScopedTables: yt, softDeleteScopedTables: bt } = await Ul(C, { cdc: Le }), xt = j.length > 0 || mt.length > 0, F = await Wl(m), wt = Ya(F?.http ?? {});
-	_r(ur(F?.secrets));
-	let I = ja(Wi(F?.env) ? F.env : void 0, m);
+	let Ne = Zl(v ?? null), Pe = Ne === "mariadb" ? "mariadb" : Ne === "mssql" ? "mssql" : void 0, Le = Pe !== void 0 && (process.env.CDC ?? "1") !== "0", { queries: w, mutations: D, actions: A, streams: dt, workflows: j, workflowWorkers: ft, eventTriggers: mt, schedules: M, connections: ht, tables: gt, featureMix: vt, tenantScopedTables: yt, softDeleteScopedTables: bt } = await Ul(C, { cdc: Le }), xt = j.length > 0 || mt.length > 0, F = await Wl(m), wt = Ja(F?.http ?? {});
+	gr(lr(F?.secrets));
+	let I = Aa(Ui(F?.env) ? F.env : void 0, m);
 	I.minted.length > 0 && I.file !== void 0 && ($.warn(`minted ${I.minted.length} project secret(s) into ${k(m, I.file)} — unique to this project, gitignored. Your DEPLOYMENT needs its own values (\`voltro secret generate\`).`, {
 		keys: I.minted,
 		file: k(m, I.file)
@@ -3827,8 +3827,8 @@ ${a.join("\n\n")}\n`);
 		log: $,
 		generateTypes: !0
 	});
-	let Tt = { current: void 0 }, Et = F?.apiKeys;
-	if (Et) {
+	let L = { current: void 0 }, Tt = F?.apiKeys;
+	if (Tt) {
 		let e = new Set((F?.plugins ?? []).flatMap((e) => e.declaredScopes ?? []));
 		e.size > 0 && ![
 			"apikeys:issue:self",
@@ -3836,49 +3836,49 @@ ${a.join("\n\n")}\n`);
 			"apikeys:issue:other"
 		].some((t) => e.has(t)) && !e.has("admin:full") && $.warn("apiKeys is enabled but no role declares any of apikeys:issue:self / :org / :other. The management routes are mounted and every issue request will fail its guard — the capability is on and reachable by nobody. Grant the right one in your role map (`:self` lets a user mint their own key, `:org` a shared one, `:other` on behalf of a colleague).");
 	}
-	let Dt = (typeof Et == "object" ? Et.prefix : void 0) ?? "voltro_", Ot, kt = Et ? [cn({ resolveByHash: (e, t) => Ot ? Ot.resolveByHash(e, t) : Promise.resolve(null) }, { prefix: Dt })] : [], At = _l([...F?.auth?.strategies ?? [], ...kt], ca(F?.plugins ?? []), F?.auth?.anonymousTenantRequired ?? !1, F?.auth?.resolveScopes, () => Tt.current), jt = yl(At), Mt = _e({
+	let Et = (typeof Tt == "object" ? Tt.prefix : void 0) ?? "voltro_", Dt, Ot = Tt ? [sn({ resolveByHash: (e, t) => Dt ? Dt.resolveByHash(e, t) : Promise.resolve(null) }, { prefix: Et })] : [], kt = _l([...F?.auth?.strategies ?? [], ...Ot], sa(F?.plugins ?? []), F?.auth?.anonymousTenantRequired ?? !1, F?.auth?.resolveScopes, () => L.current), At = yl(kt), jt = _e({
 		mix: vt,
 		plugins: F?.plugins ?? [],
 		cdc: Le,
 		...Pe ? { cdcDialect: Pe } : {}
-	}), Pt = F?.analytics?.tables ?? [], R = (() => {
+	}), Nt = F?.analytics?.tables ?? [], z = (() => {
 		let e = new Set(gt.map((e) => e.tableName)), t = [...gt];
-		for (let n of [...Mt, ...Pt]) {
+		for (let n of [...jt, ...Nt]) {
 			let r = n.tableName;
 			r === void 0 || e.has(r) || (e.add(r), t.push(n));
 		}
 		return t;
 	})();
-	for (let e of R) ei(e);
-	let Lt = bc({
+	for (let e of z) $r(e);
+	let It = bc({
 		plugins: F?.plugins ?? [],
 		appName: F?.name ?? E(m),
 		appType: "api",
 		voltroVersion: process.env.npm_package_version ?? "0.0.0",
 		log: $
 	});
-	F?.plugins?.length && ($.info("plugins loaded", { plugins: F.plugins.map((e) => e.name) }), await Lt.activate());
-	let Rt = await Lt.gatherObservability(), zt = Oc(F?.plugins ?? []);
-	zt.endpoints.length > 0 && $.info("plugin inspect endpoints registered", {
-		count: zt.endpoints.length,
-		endpoints: zt.endpoints.map((e) => `${e.method} ${e.path}`)
+	F?.plugins?.length && ($.info("plugins loaded", { plugins: F.plugins.map((e) => e.name) }), await It.activate());
+	let Lt = await It.gatherObservability(), Rt = Oc(F?.plugins ?? []);
+	Rt.endpoints.length > 0 && $.info("plugin inspect endpoints registered", {
+		count: Rt.endpoints.length,
+		endpoints: Rt.endpoints.map((e) => `${e.method} ${e.path}`)
 	});
-	let Bt = zc(F?.plugins ?? []);
-	Bt.length > 0 && $.info("plugin dashboard mounts registered", {
-		count: Bt.length,
-		mounts: Bt.map((e) => `${e.fullId} (${e.slot})`)
+	let zt = zc(F?.plugins ?? []);
+	zt.length > 0 && $.info("plugin dashboard mounts registered", {
+		count: zt.length,
+		mounts: zt.map((e) => `${e.fullId} (${e.slot})`)
 	});
-	let Wt = fe(F?.plugins ?? []);
-	Wt.length > 0 && $.info("plugin schema contributions", { plugins: Wt.map((e) => `${e.pluginName}: ${e.tables}t/${e.migrations}m`) });
-	let Gt = Ce(F?.plugins ?? []);
-	if (Gt.length > 0) {
-		ce(Gt, [
+	let Ut = fe(F?.plugins ?? []);
+	Ut.length > 0 && $.info("plugin schema contributions", { plugins: Ut.map((e) => `${e.pluginName}: ${e.tables}t/${e.migrations}m`) });
+	let Wt = Ce(F?.plugins ?? []);
+	if (Wt.length > 0) {
+		ce(Wt, [
 			...w.map((e) => e.descriptor.name),
 			...D.map((e) => e.descriptor.name),
 			...A.map((e) => e.descriptor.name),
 			...dt.map((e) => e.descriptor.name)
 		]);
-		for (let e of Gt) e.kind === "query" ? w.push({
+		for (let e of Wt) e.kind === "query" ? w.push({
 			file: e.file,
 			descriptor: e.descriptor,
 			executor: e.executor
@@ -3892,19 +3892,19 @@ ${a.join("\n\n")}\n`);
 			executor: e.executor
 		});
 		$.info("plugin routes registered", {
-			count: Gt.length,
-			routes: Gt.map((e) => `${e.plugin.name}:${e.descriptor.name} (${e.kind})`)
+			count: Wt.length,
+			routes: Wt.map((e) => `${e.plugin.name}:${e.descriptor.name} (${e.kind})`)
 		});
 	}
-	let en = $.child("agent"), rn = C.filter((e) => de.test(E(e)));
-	if (rn.length > 0) {
-		let e = await ge(rn, en);
-		e > 0 && en.info("wired tool handlers", { tools: e });
+	let $t = $.child("agent"), nn = C.filter((e) => de.test(E(e)));
+	if (nn.length > 0) {
+		let e = await ge(nn, $t);
+		e > 0 && $t.info("wired tool handlers", { tools: e });
 	}
-	let on = C.filter((e) => Se.test(E(e))), sn = [];
-	if (on.length > 0) {
-		let e = await ye(on, en);
-		sn = e.agents.map((e) => e.descriptor.name);
+	let an = C.filter((e) => Se.test(E(e))), on = [];
+	if (an.length > 0) {
+		let e = await ye(an, $t);
+		on = e.agents.map((e) => e.descriptor.name);
 		for (let t of e.agents) for (let e of ac(t)) e.kind === "action" ? A.push({
 			file: e.file,
 			descriptor: e.descriptor,
@@ -3914,20 +3914,20 @@ ${a.join("\n\n")}\n`);
 			descriptor: e.descriptor,
 			executor: e.executor
 		});
-		e.agents.length > 0 && en.info("discovered agents", {
+		e.agents.length > 0 && $t.info("discovered agents", {
 			agents: e.agents.map((e) => e.descriptor.name),
 			routes: e.agents.flatMap((e) => [`${e.descriptor.name}.send`, `${e.descriptor.name}.messages`])
 		});
 	}
-	let ln = sc();
-	(ln.queries.length > 0 || ln.mutations.length > 0) && (w.push(...ln.queries), D.push(...ln.mutations), $.info("undo built-ins registered", { routes: [
+	let cn = sc();
+	(cn.queries.length > 0 || cn.mutations.length > 0) && (w.push(...cn.queries), D.push(...cn.mutations), $.info("undo built-ins registered", { routes: [
 		"__voltro.undo.log",
 		"__voltro.undo.apply",
 		"__voltro.undo.redo"
 	] }));
-	let fn = $.child("aggregate"), hn = C.filter((e) => Re.test(e)), gn = hn.length > 0 ? await Ts(hn, fn) : [], _n = gn.map((e) => e.definition.name);
-	for (let e of $r()) $.warn(`identifier length · ${e}`);
-	let yn = F?.restRoutes ?? [], Tn = C.filter((e) => Ae.test(e)).length, On = C.filter((e) => ze.test(e)).length, kn = C.filter((e) => /\.seed\.ts$/.test(e)).length, An = C.filter((e) => Oe.test(e)).length, Mn = C.filter((e) => nc.test(e)).length;
+	let dn = $.child("aggregate"), mn = C.filter((e) => Re.test(e)), hn = mn.length > 0 ? await Ts(mn, dn) : [], gn = hn.map((e) => e.definition.name);
+	for (let e of Qr()) $.warn(`identifier length · ${e}`);
+	let vn = F?.restRoutes ?? [], wn = C.filter((e) => Ae.test(e)).length, Dn = C.filter((e) => ze.test(e)).length, On = C.filter((e) => /\.seed\.ts$/.test(e)).length, kn = C.filter((e) => Oe.test(e)).length, jn = C.filter((e) => nc.test(e)).length;
 	Wo(Uo([
 		w,
 		D,
@@ -3940,18 +3940,18 @@ ${a.join("\n\n")}\n`);
 		mutationCount: D.length,
 		actionCount: A.length,
 		streamCount: dt.length,
-		restRouteCount: yn.length,
+		restRouteCount: vn.length,
 		workflowCount: j.length,
 		workflowWorkerCount: ft.length,
 		triggerCount: mt.length,
 		scheduleCount: M.length,
-		agentCount: sn.length,
-		aggregateCount: _n.length,
-		subscriberCount: Tn,
-		startupCount: On,
-		seedCount: kn,
-		webhookCount: An,
-		emailCount: Mn,
+		agentCount: on.length,
+		aggregateCount: gn.length,
+		subscriberCount: wn,
+		startupCount: Dn,
+		seedCount: On,
+		webhookCount: kn,
+		emailCount: jn,
 		tenantTables: [...yt]
 	}), St({
 		appName: F?.name ?? E(m),
@@ -3959,43 +3959,43 @@ ${a.join("\n\n")}\n`);
 		mutations: D.map((e) => e.descriptor.name),
 		actions: A.map((e) => e.descriptor.name),
 		streams: dt.map((e) => e.descriptor.name),
-		restRoutes: yn.map((e) => `${e.method} ${e.path}`),
+		restRoutes: vn.map((e) => `${e.method} ${e.path}`),
 		workflows: j.map((e) => e.definition.name),
 		triggers: mt.map((e) => `${e.event}→${e.workflow}`),
 		schedules: M.map((e) => e.name),
-		agents: sn,
-		aggregates: _n,
+		agents: on,
+		aggregates: gn,
 		lifecycle: {
-			seeds: kn,
-			startups: On,
-			subscribers: Tn,
-			webhooks: An,
-			emails: Mn
+			seeds: On,
+			startups: Dn,
+			subscribers: wn,
+			webhooks: kn,
+			emails: jn
 		},
 		tenantTables: [...yt]
 	});
-	let Nn = ve(), Fn = (process.env.VOLTRO_TRACING_BUFFER ?? "").toLowerCase() === "off", Ln = (process.env.VOLTRO_TRACING_STREAM ?? "").toLowerCase() === "all", Bn = () => {}, Vn = (e) => {
+	let Mn = ve(), Pn = (process.env.VOLTRO_TRACING_BUFFER ?? "").toLowerCase() === "off", In = (process.env.VOLTRO_TRACING_STREAM ?? "").toLowerCase() === "all", zn = () => {}, Bn = (e) => {
 		if (!e.name.startsWith("http.server")) return !1;
 		let t = e.attributes, n = String(t["url.path"] ?? t["http.route"] ?? t["http.target"] ?? "");
 		return n.startsWith("/_voltro/") || n === "/ws" || n.startsWith("/ws/") || n.startsWith("/ws?");
-	}, Kn = (e) => {
-		Vn(e) || xe(e) || e.name.startsWith("RpcServer.") || (Nn.append(e), (Ln || e.status === "error") && S.emit("trace", e), Bn(e));
-	}, qn = Fn ? void 0 : Dn(Kn), Jn = await Zt({
+	}, Gn = (e) => {
+		Bn(e) || xe(e) || e.name.startsWith("RpcServer.") || (Mn.append(e), (In || e.status === "error") && S.emit("trace", e), zn(e));
+	}, Kn = Pn ? void 0 : En(Gn), qn = await Xt({
 		serviceName: process.env.OTEL_SERVICE_NAME ?? F?.name ?? "voltro-api",
-		...qn ? { traceSink: qn } : {},
-		...Rt.spanProcessors.length > 0 ? { extraSpanProcessors: Rt.spanProcessors } : {},
-		...Rt.metricReaders.length > 0 ? { extraMetricReaders: Rt.metricReaders } : {},
-		...Object.keys(Rt.resourceAttributes).length > 0 ? { resourceAttributes: Rt.resourceAttributes } : {},
-		...Rt.sampler === void 0 ? {} : { sampler: Rt.sampler }
+		...Kn ? { traceSink: Kn } : {},
+		...Lt.spanProcessors.length > 0 ? { extraSpanProcessors: Lt.spanProcessors } : {},
+		...Lt.metricReaders.length > 0 ? { extraMetricReaders: Lt.metricReaders } : {},
+		...Object.keys(Lt.resourceAttributes).length > 0 ? { resourceAttributes: Lt.resourceAttributes } : {},
+		...Lt.sampler === void 0 ? {} : { sampler: Lt.sampler }
 	});
-	Jn.mode === "off" ? Jn.bufferOnly || $.info("tracing disabled", { reason: "buffer off" }) : $.info("tracing enabled", { mode: Jn.mode });
-	let Qn = Jn.mode === "off" && Jn.bufferOnly === !1 ? void 0 : Jn.layer, z = await Ql(F, Qn);
-	Tt.current = z;
-	for (let e of za({
+	qn.mode === "off" ? qn.bufferOnly || $.info("tracing disabled", { reason: "buffer off" }) : $.info("tracing enabled", { mode: qn.mode });
+	let Zn = qn.mode === "off" && qn.bufferOnly === !1 ? void 0 : qn.layer, B = await Ql(F, Zn);
+	L.current = B;
+	for (let e of Ra({
 		dialect: Zl(F ?? null),
 		changeStrategy: (process.env.CDC ?? "1") === "0" ? "inline" : "cdc",
 		dbUrl: process.env.DB_URL,
-		tables: Xr().map((e) => ({
+		tables: Yr().map((e) => ({
 			tableName: e.tableName,
 			isReactive: e.isReactive === !0
 		})),
@@ -4004,110 +4004,110 @@ ${a.join("\n\n")}\n`);
 			return t === void 0 ? [] : typeof t == "string" ? [t] : [...t];
 		})
 	})) e.level === "warn" ? $.warn(e.message) : $.info(e.message);
-	if (Et) {
-		let e = tn(z), t = Cn({ flush: wn(e) });
+	if (Tt) {
+		let e = en(B), t = Sn({ flush: Cn(e) });
 		process.once("exit", () => {
 			t.shutdown();
-		}), Ot = Sn(e, {
-			prefix: Dt,
+		}), Dt = xn(e, {
+			prefix: Et,
 			usage: t
-		}), $.info("api keys active", { prefix: Dt });
+		}), $.info("api keys active", { prefix: Et });
 	}
-	let er = ds({
+	let $n = ds({
 		definitions: ht.map((e) => e.definition),
-		store: z,
+		store: B,
 		publicUrl: ps(b),
 		log: $.child("connections")
 	});
-	w.push(...er.queries), D.push(...er.mutations), A.push(...er.actions);
-	let nr = Zl(F), ar = process.env.POD_NAME ?? process.env.HOSTNAME ?? `dev-${process.pid}`, or, sr;
-	if (nr !== "memory") {
-		let e = await y(nr);
-		or = _t.make(e.makeSqlLayer(Gl())), sr = await or.runPromise(B.SqlClient);
+	w.push(...$n.queries), D.push(...$n.mutations), A.push(...$n.actions);
+	let tr = Zl(F), ir = process.env.POD_NAME ?? process.env.HOSTNAME ?? `dev-${process.pid}`, ar, or;
+	if (tr !== "memory") {
+		let e = await y(tr);
+		ar = _t.make(e.makeSqlLayer(Gl())), or = await ar.runPromise(V.SqlClient);
 	}
-	let lr = jn({
+	let cr = An({
 		coordinator: [
 			"postgres",
 			"mariadb",
 			"mysql",
 			"mssql"
-		].includes(nr) ? xn(z, ar, $) : br,
-		replicaId: ar,
+		].includes(tr) ? bn(B, ir, $) : yr,
+		replicaId: ir,
 		log: $
-	}), dr = [], pr = {
-		...sr ? { sql: sr } : {},
+	}), ur = [], fr = {
+		...or ? { sql: or } : {},
 		scheduleCoordinated: (e, t, n) => {
-			let r = lr(e, t, n);
-			return dr.push(r), r;
+			let r = cr(e, t, n);
+			return ur.push(r), r;
 		}
 	};
-	for (let e of F?.plugins ?? []) e.bindDataStore?.(z, pr);
-	let mr = await $l(z, F, Zl(F), $);
+	for (let e of F?.plugins ?? []) e.bindDataStore?.(B, fr);
+	let pr = await $l(B, F, Zl(F), $);
 	F?.cache && !process.env.CACHE_BACKEND && (process.env.CACHE_BACKEND = F.cache), F?.cacheRedisUrl && !process.env.CACHE_REDIS_URL && (process.env.CACHE_REDIS_URL = F.cacheRedisUrl), F?.cacheRedisDriver && !process.env.CACHE_REDIS_DRIVER && (process.env.CACHE_REDIS_DRIVER = F.cacheRedisDriver), F?.cacheKeyPrefix && !process.env.CACHE_KEY_PREFIX && (process.env.CACHE_KEY_PREFIX = F.cacheKeyPrefix);
-	let { service: hr, invalidationBus: gr, snapshotCache: xr, cache: wr, backend: Tr, stats: Er, dispose: Dr } = await Wa({ env: process.env });
-	$.info(`cache backend resolved: ${Tr}` + (Tr === "redis" ? ` (driver ${process.env.CACHE_REDIS_DRIVER ?? "resp"})` : " — in-process, not cross-instance")), F?.kv && !process.env.KV_BACKEND && (process.env.KV_BACKEND = F.kv), F?.kvRedisUrl && !process.env.KV_REDIS_URL && (process.env.KV_REDIS_URL = F.kvRedisUrl), F?.kvKeyPrefix && !process.env.KV_KEY_PREFIX && (process.env.KV_KEY_PREFIX = F.kvKeyPrefix);
-	let { kv: Or, service: Mr, backend: Ir } = await En({ store: z });
-	$.info(`kv backend resolved: ${Ir}` + (Ir === "database" ? " (durable, _voltro_kv)" : Ir === "memory" ? " — in-process, non-durable" : ` (driver ${process.env.KV_REDIS_DRIVER ?? "resp"}, non-durable)`));
-	let qr = Zl(F), Jr = F?.analytics !== void 0 && F.analytics.kind !== "noop" && qr !== "memory" ? (await y(qr)).makeSqlLayer(Gl()) : void 0, Yr = await Go({
+	let { service: mr, invalidationBus: hr, snapshotCache: br, cache: Cr, backend: wr, stats: Tr, dispose: Er } = await Ua({ env: process.env });
+	$.info(`cache backend resolved: ${wr}` + (wr === "redis" ? ` (driver ${process.env.CACHE_REDIS_DRIVER ?? "resp"})` : " — in-process, not cross-instance")), F?.kv && !process.env.KV_BACKEND && (process.env.KV_BACKEND = F.kv), F?.kvRedisUrl && !process.env.KV_REDIS_URL && (process.env.KV_REDIS_URL = F.kvRedisUrl), F?.kvKeyPrefix && !process.env.KV_KEY_PREFIX && (process.env.KV_KEY_PREFIX = F.kvKeyPrefix);
+	let { kv: Dr, service: jr, backend: Fr } = await Tn({ store: B });
+	$.info(`kv backend resolved: ${Fr}` + (Fr === "database" ? " (durable, _voltro_kv)" : Fr === "memory" ? " — in-process, non-durable" : ` (driver ${process.env.KV_REDIS_DRIVER ?? "resp"}, non-durable)`));
+	let Kr = Zl(F), qr = F?.analytics !== void 0 && F.analytics.kind !== "noop" && Kr !== "memory" ? (await y(Kr)).makeSqlLayer(Gl()) : void 0, Jr = await Go({
 		spec: F?.analytics,
-		sqlLayer: Jr,
+		sqlLayer: qr,
 		log: $
 	});
-	Yr.spec;
-	let ri = Yr.sink, ai = Kt({
-		store: z,
-		sink: ri,
+	Jr.spec;
+	let ni = Jr.sink, ii = Gt({
+		store: B,
+		sink: ni,
 		log: $
 	});
-	ai.tables.length > 0 && $.info("analytics mirror", {
-		provider: ri.info.provider,
-		tables: ai.tables
+	ii.tables.length > 0 && $.info("analytics mirror", {
+		provider: ni.info.provider,
+		tables: ii.tables
 	}), process.on("beforeExit", () => {
-		ai.detach();
+		ii.detach();
 	});
-	let oi = Yr.dispose, si = Zl(F), ci;
-	if (si !== "memory" && process.env.VOLTRO_AUTO_MIGRATE !== "0") {
+	let ai = Jr.dispose, oi = Zl(F), si;
+	if (oi !== "memory" && process.env.VOLTRO_AUTO_MIGRATE !== "0") {
 		let e = Date.now(), t = (process.env.NODE_ENV ?? "").toLowerCase() === "production" ? "prod" : (process.env.NODE_ENV ?? "").toLowerCase() === "staging" ? "staging" : "dev";
 		$.info("auto-migrate: planning schema", {
-			dialect: si,
+			dialect: oi,
 			env: t,
-			tables: R.length
+			tables: z.length
 		}), Ee?.set({
 			phase: "migrating",
-			tablesTotal: R.length
+			tablesTotal: z.length
 		});
 		try {
-			let n = await y(si), r = n.makeSqlLayer(Gl());
-			ci = r, await ra(Il(R.filter((e) => e.tableName.startsWith("_voltro_") || e.tableName === "voltro_isr_cache"), R), r, n.id);
-			let i = Ua({
+			let n = await y(oi), r = n.makeSqlLayer(Gl());
+			si = r, await na(Il(z.filter((e) => e.tableName.startsWith("_voltro_") || e.tableName === "voltro_isr_cache"), z), r, n.id);
+			let i = Ha({
 				conn: Gl(),
-				pendingIds: await N.runPromise(B.SqlClient.pipe(N.flatMap((e) => ea(e, m)), N.provide(r))),
-				optIn: process.env[Ba] === "1"
+				pendingIds: await N.runPromise(V.SqlClient.pipe(N.flatMap((e) => $i(e, m)), N.provide(r))),
+				optIn: process.env[za] === "1"
 			});
 			if (!i.allowed) throw $.error(`file-based migrations: ${i.message}`), Error("file-based migrations refused — see error above");
-			let a = await N.runPromise(B.SqlClient.pipe(N.flatMap((e) => na(e, {
+			let a = await N.runPromise(V.SqlClient.pipe(N.flatMap((e) => ta(e, {
 				projectRoot: m,
 				env: t,
 				appliedBy: `boot:${t}`
 			})), N.provide(r)));
 			a.applied.length > 0 && $.info(`file-based migrations: applied ${a.applied.length}`, { applied: a.applied.map((e) => `${e.id} (${e.durationMs}ms)`) });
-			let o = await N.runPromise(B.SqlClient.pipe(N.flatMap((e) => ia(e, R, {
+			let o = await N.runPromise(V.SqlClient.pipe(N.flatMap((e) => ra(e, z, {
 				appliedBy: `boot:${t}`,
 				environment: t,
 				dialectId: n.id
 			})), N.provide(r)));
-			if (o.kind === "refused-blocked" || o.kind === "prod-mismatch") throw $.error(Zi(o, n.id)), Error("auto-migrate refused — see error above");
-			$.info(Zi(o, n.id), { durationMs: Date.now() - e });
+			if (o.kind === "refused-blocked" || o.kind === "prod-mismatch") throw $.error(Xi(o, n.id)), Error("auto-migrate refused — see error above");
+			$.info(Xi(o, n.id), { durationMs: Date.now() - e });
 		} catch (e) {
 			throw $.error("auto-migrate failed — aborting boot", { err: e }), Ee?.set({
 				phase: "error",
 				error: e instanceof Error ? e.message : String(e)
 			}), e;
 		}
-	} else si !== "memory" && $.info("auto-migrate: skipped (VOLTRO_AUTO_MIGRATE=0)");
-	let li = Zl(F);
-	if ((F?.plugins ?? []).some((e) => (e.extendSchema?.migrations?.length ?? 0) > 0) && li !== "memory") {
-		let e = (await y(li)).makeSqlLayer(Gl());
+	} else oi !== "memory" && $.info("auto-migrate: skipped (VOLTRO_AUTO_MIGRATE=0)");
+	let ci = Zl(F);
+	if ((F?.plugins ?? []).some((e) => (e.extendSchema?.migrations?.length ?? 0) > 0) && ci !== "memory") {
+		let e = (await y(ci)).makeSqlLayer(Gl());
 		try {
 			let t = await N.runPromise(pe(F.plugins).pipe(N.provide(e))), n = t.filter((e) => e.status === "applied"), r = t.filter((e) => e.status === "skipped");
 			$.info("plugin migrations complete", {
@@ -4118,108 +4118,108 @@ ${a.join("\n\n")}\n`);
 			throw $.error("plugin migrations failed — aborting boot", { err: e }), e;
 		}
 	}
-	let pi = cl(z, S);
+	let fi = cl(B, S);
 	process.on("beforeExit", () => {
-		pi();
+		fi();
 	});
-	let gi = Gn(R);
-	vr({
-		dataStore: z,
-		schemaRegistry: gi
+	let hi = Wn(z);
+	_r({
+		dataStore: B,
+		schemaRegistry: hi
 	});
-	let vi = $.child("seeds"), yi = C.filter((e) => /\.seed\.ts$/.test(e)), xi = yi.length > 0 ? await ae(yi, vi) : [];
-	if (xi.length > 0) {
-		vi.info("discovered seeds", { ids: xi.map((e) => e.definition.id) });
-		for (let e of xi) ut.registerSeed(e);
-		let e = await oe(xi, z, vi);
+	let _i = $.child("seeds"), vi = C.filter((e) => /\.seed\.ts$/.test(e)), bi = vi.length > 0 ? await ae(vi, _i) : [];
+	if (bi.length > 0) {
+		_i.info("discovered seeds", { ids: bi.map((e) => e.definition.id) });
+		for (let e of bi) ut.registerSeed(e);
+		let e = await oe(bi, B, _i);
 		for (let t of e) ut.recordSeedResult(t);
 		let t = e.filter((e) => e.status === "failed");
-		t.length > 0 && vi.warn("one or more seeds failed (server continues)", { failedIds: t.map((e) => e.seedId) });
+		t.length > 0 && _i.warn("one or more seeds failed (server continues)", { failedIds: t.map((e) => e.seedId) });
 	}
-	let Si = $.child("startup"), Ci = C.filter((e) => ze.test(e)), wi = Ci.length > 0 ? await lt(Ci, Si) : [], Ti;
-	wi.length > 0 && (Si.info("discovered startups", { ids: wi.map((e) => e.id) }), Ti = await ct(wi, z, Si)), Ti && process.on("beforeExit", () => {
-		Ti.shutdown();
+	let xi = $.child("startup"), Si = C.filter((e) => ze.test(e)), Ci = Si.length > 0 ? await lt(Si, xi) : [], wi;
+	Ci.length > 0 && (xi.info("discovered startups", { ids: Ci.map((e) => e.id) }), wi = await ct(Ci, B, xi)), wi && process.on("beforeExit", () => {
+		wi.shutdown();
 	});
-	let Di = $.child("subscribe"), Ai = C.filter((e) => Ae.test(e)), ji = Ai.length > 0 ? await is(Ai, Di) : [], Mi;
-	ji.length > 0 && (Di.info("discovered subscribers", { subscribers: ji.map((e) => `${e.id}@${e.definition.table}`) }), Mi = as(ji, z, Di, gi)), Mi && process.on("beforeExit", () => {
-		Mi();
-	}), dn(), yr((e) => vn(z, e.subjectId, e.resourceType, e.resourceId));
-	let Ni = $.child("outbox"), Gi = C.filter((e) => Fe.test(e)), Ki = Gi.length > 0 ? await ss(Gi, Ni) : [], qi = Ki.length > 0 ? cs({
-		handlers: Ki,
-		store: z,
-		log: Ni
+	let Ei = $.child("subscribe"), ki = C.filter((e) => Ae.test(e)), Ai = ki.length > 0 ? await is(ki, Ei) : [], ji;
+	Ai.length > 0 && (Ei.info("discovered subscribers", { subscribers: Ai.map((e) => `${e.id}@${e.definition.table}`) }), ji = as(Ai, B, Ei, hi)), ji && process.on("beforeExit", () => {
+		ji();
+	}), un(), vr((e) => _n(B, e.subjectId, e.resourceType, e.resourceId));
+	let Mi = $.child("outbox"), Wi = C.filter((e) => Fe.test(e)), Gi = Wi.length > 0 ? await ss(Wi, Mi) : [], Ki = Gi.length > 0 ? cs({
+		handlers: Gi,
+		store: B,
+		log: Mi
 	}) : void 0;
-	qi && process.on("beforeExit", () => {
-		qi.stop();
+	Ki && process.on("beforeExit", () => {
+		Ki.stop();
 	});
-	let Ji = ys(), Yi = Zl(F);
-	if (gn.length > 0 && Yi !== "memory") try {
-		Ji = Cs((await y(Yi)).makeSqlLayer(Gl()));
+	let qi = ys(), Ji = Zl(F);
+	if (hn.length > 0 && Ji !== "memory") try {
+		qi = Cs((await y(Ji)).makeSqlLayer(Gl()));
 	} catch (e) {
-		fn.warn("aggregate: SQL storage init failed — falling back to in-process", { err: e });
+		dn.warn("aggregate: SQL storage init failed — falling back to in-process", { err: e });
 	}
-	let aa = Yi === "memory" ? br : xn(z, `aggregate@${process.pid}`, fn), oa = gn.length > 0 ? await Ls({
-		discovered: gn,
-		store: z,
-		analytics: ri,
-		storage: Ji,
-		coordinator: aa,
-		log: fn
+	let ia = Ji === "memory" ? yr : bn(B, `aggregate@${process.pid}`, dn), aa = hn.length > 0 ? await Ls({
+		discovered: hn,
+		store: B,
+		analytics: ni,
+		storage: qi,
+		coordinator: ia,
+		log: dn
 	}) : {
 		registry: Rs,
 		detach: () => {},
 		registered: []
 	};
-	oa.registered.length > 0 && fn.info("aggregates registered", {
-		names: oa.registered,
-		storage: Yi === "memory" ? "in-process" : "sql-backed",
-		coordination: aa.kind
+	aa.registered.length > 0 && dn.info("aggregates registered", {
+		names: aa.registered,
+		storage: Ji === "memory" ? "in-process" : "sql-backed",
+		coordination: ia.kind
 	}), process.on("beforeExit", () => {
-		oa.detach();
+		aa.detach();
 	});
-	let H = Zl(F), sa, da = F?.scheduling ?? {}, fa = da.trigger ?? "self", pa = da.coordination ?? ([
+	let U = Zl(F), oa, ua = F?.scheduling ?? {}, da = ua.trigger ?? "self", fa = ua.coordination ?? ([
 		"postgres",
 		"mariadb",
 		"mysql",
 		"mssql"
-	].includes(H) ? "advisoryLock" : "single"), ma = pa === "cluster" && (/* @__PURE__ */ new Set([
+	].includes(U) ? "advisoryLock" : "single"), pa = fa === "cluster" && (/* @__PURE__ */ new Set([
 		"postgres",
 		"mysql",
 		"mariadb",
 		"mssql"
-	])).has(H), ha = ma ? M.filter((e) => (e.trigger ?? fa) === "self").map((e) => Hr({
+	])).has(U), ma = pa ? M.filter((e) => (e.trigger ?? da) === "self").map((e) => Vr({
 		name: e.name,
-		cron: $t(e),
+		cron: Qt(e),
 		execute: async () => {
-			await sa?.fireFromCluster(e.name);
+			await oa?.fireFromCluster(e.name);
 		}
-	})) : [], ba = await (async () => {
-		if (H === "memory") return jr.layerMemory;
-		let e = await y(H), t = e.makeSqlLayer(Gl()), n = Gr({ sqliteFamily: ni(e.id) });
-		if ($.info(`workflow engine: cluster-${n}, dialect=${e.id}` + (n === "memory" ? " — single-process durable replay, no horizontal scaling" + (ni(e.id) ? "" : " (VOLTRO_WORKFLOW_RUNNER_STORAGE=memory: SqlRunnerStorage/cluster_runners + GET_LOCK skipped)") : "")), e.id === "mssql") {
+	})) : [], ya = await (async () => {
+		if (U === "memory") return Ar.layerMemory;
+		let e = await y(U), t = e.makeSqlLayer(Gl()), n = Wr({ sqliteFamily: ti(e.id) });
+		if ($.info(`workflow engine: cluster-${n}, dialect=${e.id}` + (n === "memory" ? " — single-process durable replay, no horizontal scaling" + (ti(e.id) ? "" : " (VOLTRO_WORKFLOW_RUNNER_STORAGE=memory: SqlRunnerStorage/cluster_runners + GET_LOCK skipped)") : "")), e.id === "mssql") {
 			let e = await es(process.cwd());
 			e && $.warn(e);
 		}
-		return Kr({
+		return Gr({
 			sqlClientLayer: t,
 			runnerStorage: n,
 			dialectId: e.id,
 			...process.env.VOLTRO_WORKFLOW_RUNNER_PORT ? { runnerListenPort: Number(process.env.VOLTRO_WORKFLOW_RUNNER_PORT) } : {},
-			...ha.length > 0 ? { extraShardingLayers: ha } : {}
+			...ma.length > 0 ? { extraShardingLayers: ma } : {}
 		});
 	})();
-	$.info("workflow engine selected", { engine: H === "postgres" ? "cluster-postgres" : "in-memory" });
-	let Sa, wa = /* @__PURE__ */ new Map(), Ta = () => `wfctx_${globalThis.crypto?.randomUUID?.() ?? `${Date.now().toString(36)}${Math.random().toString(36).slice(2)}`}`, Da = async (e, t, n) => {
+	$.info("workflow engine selected", { engine: U === "postgres" ? "cluster-postgres" : "in-memory" });
+	let xa, Ca = /* @__PURE__ */ new Map(), wa = () => `wfctx_${globalThis.crypto?.randomUUID?.() ?? `${Date.now().toString(36)}${Math.random().toString(36).slice(2)}`}`, Ea = async (e, t, n) => {
 		let r = {
 			...n,
 			source: n.source ?? `workflow:${e}`
 		};
-		wa.set(t, r);
+		Ca.set(t, r);
 		try {
-			let n = await z.query({
+			let n = await B.query({
 				table: "_voltro_workflow_start_contexts",
 				order: [],
-				predicate: V("executionId", t),
+				predicate: H("executionId", t),
 				projection: ["id"],
 				skip: void 0,
 				take: 1
@@ -4233,10 +4233,10 @@ ${a.join("\n\n")}\n`);
 				parentClosePolicy: r.parentClosePolicy ?? null,
 				createdAt: /* @__PURE__ */ new Date()
 			};
-			n[0] === void 0 ? await z.insert("_voltro_workflow_start_contexts", {
-				id: Ta(),
+			n[0] === void 0 ? await B.insert("_voltro_workflow_start_contexts", {
+				id: wa(),
 				...i
-			}) : await z.update("_voltro_workflow_start_contexts", n[0].id, i);
+			}) : await B.update("_voltro_workflow_start_contexts", n[0].id, i);
 		} catch (n) {
 			$.warn("workflow.startContext.persist failed", {
 				workflowName: e,
@@ -4244,14 +4244,14 @@ ${a.join("\n\n")}\n`);
 				reason: n?.message ?? String(n)
 			});
 		}
-	}, Oa = async (e, t) => {
-		let n = wa.get(t);
+	}, Da = async (e, t) => {
+		let n = Ca.get(t);
 		if (n !== void 0) return n;
 		try {
-			let e = (await z.query({
+			let e = (await B.query({
 				table: "_voltro_workflow_start_contexts",
 				order: [],
-				predicate: V("executionId", t),
+				predicate: H("executionId", t),
 				projection: void 0,
 				skip: void 0,
 				take: 1
@@ -4270,7 +4270,7 @@ ${a.join("\n\n")}\n`);
 				...e.parentExecutionId === null ? {} : { parentExecutionId: e.parentExecutionId },
 				...e.parentClosePolicy === null ? {} : { parentClosePolicy: e.parentClosePolicy }
 			};
-			return wa.set(t, r), r;
+			return Ca.set(t, r), r;
 		} catch (e) {
 			$.warn("workflow.startContext.resolve failed", {
 				executionId: t,
@@ -4278,26 +4278,26 @@ ${a.join("\n\n")}\n`);
 			});
 			return;
 		}
-	}, U = j.length > 0 ? In(() => Sa) : void 0, ka = $.child("webhooks"), Aa = C.filter((e) => Oe.test(e)), W = Aa.length > 0 ? await tc(Aa, ka) : {
+	}, W = j.length > 0 ? Fn(() => xa) : void 0, Oa = $.child("webhooks"), ka = C.filter((e) => Oe.test(e)), G = ka.length > 0 ? await tc(ka, Oa) : {
 		outgoing: [],
 		incoming: [],
 		providers: []
 	};
-	W.outgoing.length + W.incoming.length + W.providers.length > 0 && ka.info("discovered webhooks", {
-		outgoing: W.outgoing.map((e) => e.descriptor.id),
-		incoming: W.incoming.map((e) => e.descriptor.id),
-		providers: W.providers.map((e) => e.descriptor.id)
+	G.outgoing.length + G.incoming.length + G.providers.length > 0 && Oa.info("discovered webhooks", {
+		outgoing: G.outgoing.map((e) => e.descriptor.id),
+		incoming: G.incoming.map((e) => e.descriptor.id),
+		providers: G.providers.map((e) => e.descriptor.id)
 	});
-	let Ma = C.filter((e) => nc.test(e));
-	if (Ma.length > 0) {
-		let e = $.child("mail"), t = await rc(Ma, e);
-		t.templates.length > 0 && (Ca(t.templates.map((e) => e.template)), e.info("discovered email templates", { templates: t.templates.map((e) => e.template.name) }));
+	let ja = C.filter((e) => nc.test(e));
+	if (ja.length > 0) {
+		let e = $.child("mail"), t = await rc(ja, e);
+		t.templates.length > 0 && (Sa(t.templates.map((e) => e.template)), e.info("discovered email templates", { templates: t.templates.map((e) => e.template.name) }));
 	}
-	let Na = /* @__PURE__ */ new Map();
-	for (let e of W.incoming) {
-		let t = e.descriptor.path ?? va(e.descriptor.id), n = `VOLTRO_WEBHOOK_SECRET_${e.descriptor.id.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`, r = xa(e.descriptor, {
+	let Ma = /* @__PURE__ */ new Map();
+	for (let e of G.incoming) {
+		let t = e.descriptor.path ?? _a(e.descriptor.id), n = `VOLTRO_WEBHOOK_SECRET_${e.descriptor.id.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`, r = ba(e.descriptor, {
 			resolveSecret: async () => process.env[n] ?? null,
-			resolveWorkflows: () => U === void 0 ? void 0 : Xn(U, {
+			resolveWorkflows: () => W === void 0 ? void 0 : Yn(W, {
 				traceId: `incoming:${e.descriptor.id}`,
 				source: `incoming:${e.descriptor.id}`
 			}),
@@ -4309,25 +4309,25 @@ ${a.join("\n\n")}\n`);
 					idempotency: e.idempotency,
 					durationMs: e.durationMs
 				};
-				e.status >= 500 ? ka.error("incoming delivery failed", t) : e.status >= 400 ? ka.warn("incoming delivery rejected", t) : ka.info("incoming delivery handled", t);
+				e.status >= 500 ? Oa.error("incoming delivery failed", t) : e.status >= 400 ? Oa.warn("incoming delivery rejected", t) : Oa.info("incoming delivery handled", t);
 			}
 		});
-		Na.set(t, r), ka.info("mounted incoming webhook", {
+		Ma.set(t, r), Oa.info("mounted incoming webhook", {
 			id: e.descriptor.id,
 			path: t,
 			secretEnvKey: n
 		});
 	}
-	let Pa = $.child("reaction"), Fa = C.filter((e) => Ie.test(e)), La = Fa.length > 0 ? await hs(Fa, Pa) : [], Ra;
-	La.length > 0 && (Pa.info("discovered reactions", { reactions: La.map((e) => `${e.definition.name}@${e.definition.watch.table}`) }), Ra = _s(La, z, {
+	let Na = $.child("reaction"), Pa = C.filter((e) => Ie.test(e)), Ia = Pa.length > 0 ? await hs(Pa, Na) : [], La;
+	Ia.length > 0 && (Na.info("discovered reactions", { reactions: Ia.map((e) => `${e.definition.name}@${e.definition.watch.table}`) }), La = _s(Ia, B, {
 		runAct: async (e, t) => {
 			if (e.kind === "workflow") {
-				if (U === void 0) {
-					Pa.warn("reaction workflow act skipped — no workflow engine in this app", { workflow: e.workflow });
+				if (W === void 0) {
+					Na.warn("reaction workflow act skipped — no workflow engine in this app", { workflow: e.workflow });
 					return;
 				}
 				let n = t.new ?? t.old ?? {};
-				await Xn(U, {
+				await Yn(W, {
 					traceId: `reaction:${e.workflow}`,
 					source: `reaction:${e.workflow}`
 				}).start(e.workflow, n);
@@ -4336,37 +4336,37 @@ ${a.join("\n\n")}\n`);
 			await gs(e.agent, t, {
 				findAgentSend: (e) => A.find((t) => t.descriptor.name === `${e}.send`),
 				runAction: (e, t, n) => Promise.resolve(Po(e, t, n)),
-				makeSubject: (e) => _i(e),
+				makeSubject: (e) => gi(e),
 				now: () => Date.now(),
-				log: Pa
+				log: Na
 			});
 		},
 		checkBudget: async (e, t) => {
 			try {
 				let { requireAiBudget: n } = await import("@voltro/ai");
-				return (await N.runPromise(N.either(n(z, {
+				return (await N.runPromise(N.either(n(B, {
 					tenantId: e,
 					limitUsd: t
 				}))))._tag === "Right";
 			} catch (t) {
-				return Pa.warn("reaction budget check failed — refusing the act", { tenantId: e }, t), !1;
+				return Na.warn("reaction budget check failed — refusing the act", { tenantId: e }, t), !1;
 			}
 		}
-	}, Pa)), Ra && process.on("beforeExit", () => {
-		Ra();
+	}, Na)), La && process.on("beforeExit", () => {
+		La();
 	});
-	let Va = 0, G = new It({
-		store: z,
-		cache: xr,
+	let Ba = 0, K = new Ft({
+		store: B,
+		cache: br,
 		recordDelivery: (e) => {
-			rr({
+			nr({
 				label: e.label,
 				kind: e.kind,
 				durationMs: e.durationMs,
 				rowCount: e.rowCount
-			}), Kn({
+			}), Gn({
 				traceId: e.traceId,
-				spanId: (Va++).toString(16).padStart(16, "0"),
+				spanId: (Ba++).toString(16).padStart(16, "0"),
 				parentSpanId: e.parentSpanId ?? null,
 				name: `${e.label}.${e.kind}`,
 				kind: "internal",
@@ -4380,10 +4380,10 @@ ${a.join("\n\n")}\n`);
 				status: "ok"
 			});
 		}
-	}), Ha = () => {
-		let e = G.subscriptionSnapshot(), t = G.matcherStats(), n = e.map((e) => {
+	}), Va = () => {
+		let e = K.subscriptionSnapshot(), t = K.matcherStats(), n = e.map((e) => {
 			let t = [];
-			for (let n of ui(e.predicate)) n.conjunctive && t.push(n.column);
+			for (let n of li(e.predicate)) n.conjunctive && t.push(n.column);
 			return {
 				fingerprint: e.fingerprint,
 				table: e.table,
@@ -4399,28 +4399,28 @@ ${a.join("\n\n")}\n`);
 			capturedAt: Date.now()
 		});
 	};
-	G.onSubscriptionsChange(Ha), Ha();
-	let Za = $.child("store"), $a = (F?.plugins ?? []).filter((e) => typeof e.onChangeEvent == "function"), eo = z.changeScope ?? "local";
-	z.onChange((e) => {
-		if (Za.debug(`${e.op} on ${e.table}`, {
+	K.onSubscriptionsChange(Va), Va();
+	let Xa = $.child("store"), Qa = (F?.plugins ?? []).filter((e) => typeof e.onChangeEvent == "function"), $a = B.changeScope ?? "local";
+	B.onChange((e) => {
+		if (Xa.debug(`${e.op} on ${e.table}`, {
 			op: e.op,
 			table: e.table
-		}), ir({
+		}), rr({
 			table: e.table,
 			op: e.op,
 			old: e.old ?? null,
 			new: e.new ?? null
-		}), N.runFork(gr.publish(e.table)), $a.length > 0) {
+		}), N.runFork(hr.publish(e.table)), Qa.length > 0) {
 			let t = {
 				table: e.table,
 				op: e.op,
 				new: e.new ?? null,
 				old: e.old ?? null,
 				...e.origin === void 0 ? {} : { origin: e.origin },
-				changeScope: eo
+				changeScope: $a
 			};
-			for (let n of $a) {
-				let r = Za.child(`plugin:${n.name}`);
+			for (let n of Qa) {
+				let r = Xa.child(`plugin:${n.name}`);
 				N.runFork(n.onChangeEvent(t).pipe(N.catchAllCause((t) => N.sync(() => r.warn("onChangeEvent failed", {
 					table: e.table,
 					op: e.op
@@ -4428,98 +4428,98 @@ ${a.join("\n\n")}\n`);
 			}
 		}
 	});
-	let to = j.map((e) => kr.make(e.definition.name, {
+	let eo = j.map((e) => Or.make(e.definition.name, {
 		payload: e.definition.payloadSchema,
-		success: mi,
+		success: pi,
 		error: e.definition.errorSchema
-	})), no = xt ? [
-		Oi(zi),
-		Oi(Vi),
-		Oi(Bi),
-		Oi(Ri),
-		Oi(Fi),
-		Oi(Ii),
-		hi(Pi),
-		hi(Li),
-		hi(Hi),
-		hi(Ui)
-	] : [], ro = (F?.plugins ?? []).flatMap((e) => (e.errorSchemas ?? []).map((e) => e.schema)), io = ro.length > 0 ? ro : void 0, ao = [
-		...w.map((e) => Oi(e.descriptor, io)),
-		...D.map((e) => Ei(e.descriptor, io)),
-		...A.map((e) => hi(e.descriptor, io)),
-		...dt.map((e) => ki(e.descriptor, io)),
-		...to,
-		...no
-	], oo = Ar.make(...ao).middleware(di).middleware(fi), so = F?.layers ?? [], co = (F?.plugins ?? []).map((e) => e.services).filter((e) => e !== void 0), lo = P.succeed(Nt, oa.registry), uo = P.mergeAll(Xa({
-		analyticsLayer: Yr.layer,
-		cacheService: hr,
-		kvService: Mr,
-		pluginServices: co,
-		userLayers: so
-	}), lo);
-	(so.length > 0 || co.length > 0) && $.info("layers loaded", {
-		userLayers: so.length,
-		pluginLayers: co.length
+	})), to = xt ? [
+		Di(Ri),
+		Di(Bi),
+		Di(zi),
+		Di(Li),
+		Di(Pi),
+		Di(Fi),
+		mi(Ni),
+		mi(Ii),
+		mi(Vi),
+		mi(Hi)
+	] : [], no = (F?.plugins ?? []).flatMap((e) => (e.errorSchemas ?? []).map((e) => e.schema)), ro = no.length > 0 ? no : void 0, io = [
+		...w.map((e) => Di(e.descriptor, ro)),
+		...D.map((e) => Ti(e.descriptor, ro)),
+		...A.map((e) => mi(e.descriptor, ro)),
+		...dt.map((e) => Oi(e.descriptor, ro)),
+		...eo,
+		...to
+	], ao = kr.make(...io).middleware(ui).middleware(di), oo = F?.layers ?? [], so = (F?.plugins ?? []).map((e) => e.services).filter((e) => e !== void 0), co = P.succeed(Mt, aa.registry), lo = P.mergeAll(Ya({
+		analyticsLayer: Jr.layer,
+		cacheService: mr,
+		kvService: jr,
+		pluginServices: so,
+		userLayers: oo
+	}), co);
+	(oo.length > 0 || so.length > 0) && $.info("layers loaded", {
+		userLayers: oo.length,
+		pluginLayers: so.length
 	});
-	let fo = (e, t) => fr(e.pipe(N.provide(Pn(t)), N.provide(uo), N.provide(wt)));
+	let uo = (e, t) => dr(e.pipe(N.provide(Nn(t)), N.provide(lo), N.provide(wt)));
 	if ((process.env.VOLTRO_INDEX_AUDIT ?? "on") !== "off") {
-		let e = Qr(R), t = process.stdout.isTTY === !0 && (process.env.NO_COLOR ?? "") === "";
-		for (let n of e) $.warn("\n" + ti(n, {
+		let e = Zr(z), t = process.stdout.isTTY === !0 && (process.env.NO_COLOR ?? "") === "";
+		for (let n of e) $.warn("\n" + ei(n, {
 			color: t,
 			indent: "  "
 		}));
 	}
-	let K;
-	if (W.outgoing.length > 0) {
-		let e = Ka({
-			store: z,
-			schemaRegistry: gi,
-			cache: wr,
-			kv: Or
-		}), t = W.outgoing.map((e) => e.descriptor);
-		K = _a(e, async (n) => {
-			let r = ya.execute(n).pipe(N.provide(ya.toLayer(ga(e, { events: t })).pipe(P.provideMerge(ba))));
+	let q;
+	if (G.outgoing.length > 0) {
+		let e = Ga({
+			store: B,
+			schemaRegistry: hi,
+			cache: Cr,
+			kv: Dr
+		}), t = G.outgoing.map((e) => e.descriptor);
+		q = ga(e, async (n) => {
+			let r = va.execute(n).pipe(N.provide(va.toLayer(ha(e, { events: t })).pipe(P.provideMerge(ya))));
 			N.runPromise(r).catch((e) => {
-				ka.error("deliverWebhook workflow crashed", {
+				Oa.error("deliverWebhook workflow crashed", {
 					deliveryId: n.deliveryId,
 					targetId: n.targetId
 				}, e);
 			});
 		}, { events: t });
 	}
-	let po = (process.env.VOLTRO_TENANT_ISOLATION ?? F?.tenancy?.isolation) === "namespace";
-	po && $.info("multi-tenancy: PHYSICAL namespace isolation ON — each request runs against its tenant's own namespace (schema/database/attached file). Requests without a resolvable tenant fail closed.");
-	let mo = qa({
-		store: z,
-		schemaRegistry: gi,
-		cache: wr,
-		kv: Or,
-		...K === void 0 ? {} : { webhooksService: K },
-		...U === void 0 ? {} : { workflowsProxy: U },
+	let fo = (process.env.VOLTRO_TENANT_ISOLATION ?? F?.tenancy?.isolation) === "namespace";
+	fo && $.info("multi-tenancy: PHYSICAL namespace isolation ON — each request runs against its tenant's own namespace (schema/database/attached file). Requests without a resolvable tenant fail closed.");
+	let po = Ka({
+		store: B,
+		schemaRegistry: hi,
+		cache: Cr,
+		kv: Dr,
+		...q === void 0 ? {} : { webhooksService: q },
+		...W === void 0 ? {} : { workflowsProxy: W },
 		eventTriggers: mt,
-		namespaceIsolationOn: po,
+		namespaceIsolationOn: fo,
 		onEventEmit: (e, t) => S.emit(e, t),
-		...qi === void 0 ? {} : { outbox: { nudge: qi.nudge } },
-		...er.active ? { connections: { registry: er.registry } } : {}
-	}), ho = async () => {
+		...Ki === void 0 ? {} : { outbox: { nudge: Ki.nudge } },
+		...$n.active ? { connections: { registry: $n.registry } } : {}
+	}), mo = async () => {
 		if (M.length === 0) return;
 		let e = process.env.HOSTNAME ?? `pid-${process.pid}`, t;
-		ma ? t = br : pa === "cluster" ? ($.warn("scheduling.coordination=cluster needs store=postgres — falling back to single (dev/memory)"), t = br) : pa === "advisoryLock" ? H === "memory" ? ($.warn("scheduling.coordination=advisoryLock needs a SQL store (the claim-row gate) — falling back to single (memory)"), t = br) : t = xn(z, e, {
+		pa ? t = yr : fa === "cluster" ? ($.warn("scheduling.coordination=cluster needs store=postgres — falling back to single (dev/memory)"), t = yr) : fa === "advisoryLock" ? U === "memory" ? ($.warn("scheduling.coordination=advisoryLock needs a SQL store (the claim-row gate) — falling back to single (memory)"), t = yr) : t = bn(B, e, {
 			info: (e, t) => $.info(e, t ?? {}),
 			warn: (e, t) => $.warn(e, t ?? {})
-		}) : t = br;
-		let n = Ac(F?.plugins ?? [], J);
-		sa = await Cr(M, {
-			store: z,
+		}) : t = yr;
+		let n = Ac(F?.plugins ?? [], Oo);
+		oa = await Sr(M, {
+			store: B,
 			coordinator: t,
-			defaultTrigger: fa,
+			defaultTrigger: da,
 			replicaId: e,
-			armSelf: !ma,
+			armSelf: !pa,
 			dormancy: F?.dormancy ?? "always-on",
-			buildContext: ({ traceId: e, scheduleName: t, subject: n }) => mo({
+			buildContext: ({ traceId: e, scheduleName: t, subject: n }) => po({
 				subject: n,
 				traceId: e
-			}, z, void 0, `schedule:${t}`),
+			}, B, void 0, `schedule:${t}`),
 			log: {
 				info: (e, t) => $.info(e, t ?? {}),
 				warn: (e, t) => $.warn(e, t ?? {}),
@@ -4533,45 +4533,45 @@ ${a.join("\n\n")}\n`);
 			...n === void 0 ? {} : { interceptFire: n }
 		}), $.info("scheduler ready", {
 			schedules: M.length,
-			coordination: ma ? "cluster" : t.kind,
-			clusterCrons: ha.length
+			coordination: pa ? "cluster" : t.kind,
+			clusterCrons: ma.length
 		}), process.on("beforeExit", () => {
-			sa?.shutdown();
+			oa?.shutdown();
 		});
-	}, q = {}, go = /* @__PURE__ */ new Set(), _o = (e, t) => {
-		pn(e, yt, t) && (go.has(e.table) || (go.add(e.table), $.warn("tenant-scoped read with an EMPTY tenant — every row is filtered out", {
+	}, J = {}, ho = /* @__PURE__ */ new Set(), go = (e, t) => {
+		fn(e, yt, t) && (ho.has(e.table) || (ho.add(e.table), $.warn("tenant-scoped read with an EMPTY tenant — every row is filtered out", {
 			table: e.table,
 			tenantId: "",
 			cause: "the subject authenticated but has no resolved org (tenantId=''), so the auto-merged `eq('tenantId', '')` matches no real row — this is NOT 'no such row'",
 			fix: "resolve the subject to an active org before the read, or mark the query `.unscoped()` if it is deliberately cross-tenant"
 		})));
-	}, vo = !1, yo = (e) => {
-		vo || !mn(e) || (vo = !0, $.warn("authenticated subject has NO active org (tenantId='') — every tenant-scoped read will be empty", {
+	}, _o = !1, vo = (e) => {
+		_o || !pn(e) || (_o = !0, $.warn("authenticated subject has NO active org (tenantId='') — every tenant-scoped read will be empty", {
 			subjectType: "user",
 			cause: "the session resolved a user but no organization/tenant; the empty-string sentinel fails closed",
 			fix: "resolve the user to an active org during auth, or route org-less users to an onboarding flow"
 		}));
-	}, bo = (e, t) => (yo(t.subject), _o(e, t.subject.tenantId), Ht(Ut(e, yt, t.subject.tenantId), bt)), xo = /* @__PURE__ */ new Set(), To = (e) => {
+	}, yo = (e, t) => (vo(t.subject), go(e, t.subject.tenantId), Vt(Ht(e, yt, t.subject.tenantId), bt)), bo = /* @__PURE__ */ new Set(), wo = (e) => {
 		if (e.usingIndex !== void 0 || e.predicate === void 0) return;
 		let t = /* @__PURE__ */ new Set();
-		for (let n of ui(e.predicate)) n.conjunctive && t.add(n.column);
-		if (t.size === 0 || gi.anyFieldIndexed(e.table, t)) return;
+		for (let n of li(e.predicate)) n.conjunctive && t.add(n.column);
+		if (t.size === 0 || hi.anyFieldIndexed(e.table, t)) return;
 		let n = `${e.table}::${[...t].sort().join(",")}`;
-		xo.has(n) || (xo.add(n), $.warn("non-indexed predicate — slow at scale", {
+		bo.has(n) || (bo.add(n), $.warn("non-indexed predicate — slow at scale", {
 			table: e.table,
 			fields: [...t],
 			hint: "declare `.index()` on a column, add `.index(name, [...fields])` to the table, or annotate the query with `.using('indexName')` if a covering index exists"
 		}));
-	}, Eo = (e) => {
+	}, To = (e) => {
 		if (e.usingIndex === void 0) return;
-		let t = gi.tables.get(e.table);
+		let t = hi.tables.get(e.table);
 		if (!t) return;
 		let n = t.compositeIndexes.find((t) => t.name === e.usingIndex);
 		if (n) return {
 			name: n.name,
 			fields: n.fields
 		};
-	}, Do = (e) => JSON.stringify(e, (e, t) => typeof t == "object" && t && !Array.isArray(t) ? Object.fromEntries(Object.entries(t).sort(([e], [t]) => e.localeCompare(t))) : t), Oo = (e, t) => {
+	}, Eo = (e) => JSON.stringify(e, (e, t) => typeof t == "object" && t && !Array.isArray(t) ? Object.fromEntries(Object.entries(t).sort(([e], [t]) => e.localeCompare(t))) : t), Do = (e, t) => {
 		let n = e.cache;
 		if (n === void 0) return;
 		let r = d(n.ttl);
@@ -4579,54 +4579,54 @@ ${a.join("\n\n")}\n`);
 			ttlMs: r,
 			swrMs: n.swr === void 0 ? void 0 : d(n.swr) ?? void 0,
 			scope: n.scope,
-			baseKey: `q:${e.name}:${Do(t)}`
+			baseKey: `q:${e.name}:${Eo(t)}`
 		};
-	}, J = ne(), ko = F?.plugins ?? [], Ao = bi(Cc(ko, "mutation", J)), jo = bi(Cc(ko, "action", J)), Mo = bi(Cc(ko, "query", J)), No = Rn({
-		store: z,
-		buildContext: (e, t, n) => mo(e, t, n),
-		runEffect: (e, t) => fo(e, t),
+	}, Oo = ne(), ko = F?.plugins ?? [], Ao = yi(Cc(ko, "mutation", Oo)), jo = yi(Cc(ko, "action", Oo)), Mo = yi(Cc(ko, "query", Oo)), No = Ln({
+		store: B,
+		buildContext: (e, t, n) => po(e, t, n),
+		runEffect: (e, t) => uo(e, t),
 		...Ao ? { interceptor: Ao } : {},
-		recordMetric: (e) => J.record(e),
+		recordMetric: (e) => Oo.record(e),
 		undoCapture: cc()
-	}), Po = bn({
-		buildContext: (e) => mo(e),
-		runEffect: (e, t) => fo(e, t),
+	}), Po = yn({
+		buildContext: (e) => po(e),
+		runEffect: (e, t) => uo(e, t),
 		...jo ? { interceptor: jo } : {},
-		recordMetric: (e) => J.record(e)
+		recordMetric: (e) => Oo.record(e)
 	}), Fo = {
-		buildContext: (e) => mo(e),
+		buildContext: (e) => po(e),
 		finalize: (e, t) => {
-			let n = bo(e, t);
-			return To(n), n;
+			let n = yo(e, t);
+			return wo(n), n;
 		},
-		provideEffect: (e, t) => e.pipe(N.provide(Pn(t)), N.provide(wt)),
+		provideEffect: (e, t) => e.pipe(N.provide(Nn(t)), N.provide(wt)),
 		...Mo ? { interceptor: Mo } : {}
-	}, Io = Hn(Fo), Y = zn({
+	}, Io = Vn(Fo), Y = Rn({
 		...Fo,
-		queryRows: (e) => z.query(e)
-	}), Lo = Wn({
+		queryRows: (e) => B.query(e)
+	}), Lo = Un({
 		...Fo,
-		subscribeDescriptor: (e, t, n) => G.subscribe(e, t, n),
-		subscribeComputed: (e, t, n) => G.subscribeComputed(e, t, n)
+		subscribeDescriptor: (e, t, n) => K.subscribe(e, t, n),
+		subscribeComputed: (e, t, n) => K.subscribeComputed(e, t, n)
 	});
-	for (let e of w) q[e.descriptor.name] = (t) => Xt(Io(e, t), G, `subscription.${e.descriptor.name}`, Eo, Oo(e.descriptor, t), Un(e, t));
+	for (let e of w) J[e.descriptor.name] = (t) => Yt(Io(e, t), K, `subscription.${e.descriptor.name}`, To, Do(e.descriptor, t), Hn(e, t));
 	for (let e of D) {
 		let t = `mutation.${e.descriptor.name}`;
-		q[e.descriptor.name] = (n) => Jt(async (t, n) => No(e, t, n), n, t);
+		J[e.descriptor.name] = (n) => qt(async (t, n) => No(e, t, n), n, t);
 	}
 	for (let e of A) {
 		let t = `action.${e.descriptor.name}`;
-		q[e.descriptor.name] = (n) => Jt(async (t, n) => Po(e, t, n), n, t);
+		J[e.descriptor.name] = (n) => qt(async (t, n) => Po(e, t, n), n, t);
 	}
 	for (let e of dt) {
 		let t = `stream.${e.descriptor.name}`;
-		q[e.descriptor.name] = (n) => Yt((t) => {
-			let r = mo(t), i = e.executor(n, r);
-			return N.isEffect(i) ? i.pipe(N.provide(Pn(r.store)), N.provide(uo), N.provide(wt)) : typeof i == "object" && i && typeof i.then == "function" ? N.promise(() => i) : i;
+		J[e.descriptor.name] = (n) => Jt((t) => {
+			let r = po(t), i = e.executor(n, r);
+			return N.isEffect(i) ? i.pipe(N.provide(Nn(r.store)), N.provide(lo), N.provide(wt)) : typeof i == "object" && i && typeof i.then == "function" ? N.promise(() => i) : i;
 		}, t);
 	}
-	xt && (q[zi.name] = (e) => Xt(Io({
-		descriptor: zi,
+	xt && (J[Ri.name] = (e) => Yt(Io({
+		descriptor: Ri,
 		executor: (e) => {
 			let t = e.id;
 			return {
@@ -4635,30 +4635,30 @@ ${a.join("\n\n")}\n`);
 					column: "startedAt",
 					direction: "desc"
 				}],
-				predicate: ii(V("id", t), V("executionId", t)),
+				predicate: ri(H("id", t), H("executionId", t)),
 				take: 1,
 				skip: void 0,
 				projection: void 0
 			};
 		}
-	}, e), G, `subscription.${zi.name}`), q[Vi.name] = (e) => Xt(Io({
-		descriptor: Vi,
+	}, e), K, `subscription.${Ri.name}`), J[Bi.name] = (e) => Yt(Io({
+		descriptor: Bi,
 		executor: (e) => {
-			let t = e, n = [...t.tag === void 0 ? [] : [V("tag", t.tag)], ...t.status === void 0 ? [] : [V("status", t.status)]], r = Number.isFinite(t.limit) && t.limit !== void 0 ? Math.min(Math.max(Math.floor(t.limit), 1), 500) : 100;
+			let t = e, n = [...t.tag === void 0 ? [] : [H("tag", t.tag)], ...t.status === void 0 ? [] : [H("status", t.status)]], r = Number.isFinite(t.limit) && t.limit !== void 0 ? Math.min(Math.max(Math.floor(t.limit), 1), 500) : 100;
 			return {
 				table: "_voltro_workflow_runs",
 				order: [{
 					column: "startedAt",
 					direction: "desc"
 				}],
-				predicate: n.length === 0 ? void 0 : n.length === 1 ? n[0] : Zr(...n),
+				predicate: n.length === 0 ? void 0 : n.length === 1 ? n[0] : Xr(...n),
 				take: r,
 				skip: void 0,
 				projection: void 0
 			};
 		}
-	}, e), G, `subscription.${Vi.name}`), q[Bi.name] = (e) => Xt(Io({
-		descriptor: Bi,
+	}, e), K, `subscription.${Bi.name}`), J[zi.name] = (e) => Yt(Io({
+		descriptor: zi,
 		executor: (e) => {
 			let t = e.runId;
 			return {
@@ -4667,14 +4667,14 @@ ${a.join("\n\n")}\n`);
 					column: "startedAt",
 					direction: "asc"
 				}],
-				predicate: V("runId", t),
+				predicate: H("runId", t),
 				take: 1e3,
 				skip: void 0,
 				projection: void 0
 			};
 		}
-	}, e), G, `subscription.${Bi.name}`), q[Ri.name] = (e) => Xt(Io({
-		descriptor: Ri,
+	}, e), K, `subscription.${zi.name}`), J[Li.name] = (e) => Yt(Io({
+		descriptor: Li,
 		executor: (e) => {
 			let t = e.runId;
 			return {
@@ -4683,14 +4683,14 @@ ${a.join("\n\n")}\n`);
 					column: "occurredAt",
 					direction: "asc"
 				}],
-				predicate: V("runId", t),
+				predicate: H("runId", t),
 				take: 1e3,
 				skip: void 0,
 				projection: void 0
 			};
 		}
-	}, e), G, `subscription.${Ri.name}`), q[Fi.name] = (e) => Xt(Io({
-		descriptor: Fi,
+	}, e), K, `subscription.${Li.name}`), J[Pi.name] = (e) => Yt(Io({
+		descriptor: Pi,
 		executor: (e) => {
 			let t = e;
 			return {
@@ -4699,14 +4699,14 @@ ${a.join("\n\n")}\n`);
 					column: "occurredAt",
 					direction: "desc"
 				}],
-				predicate: t.name === void 0 ? void 0 : V("name", t.name),
+				predicate: t.name === void 0 ? void 0 : H("name", t.name),
 				take: Math.max(1, Math.min(500, t.limit ?? 100)),
 				skip: void 0,
 				projection: void 0
 			};
 		}
-	}, e), G, `subscription.${Fi.name}`), q[Ii.name] = (e) => Xt(Io({
-		descriptor: Ii,
+	}, e), K, `subscription.${Pi.name}`), J[Fi.name] = (e) => Yt(Io({
+		descriptor: Fi,
 		executor: (e) => {
 			let t = e.eventId;
 			return {
@@ -4715,56 +4715,56 @@ ${a.join("\n\n")}\n`);
 					column: "createdAt",
 					direction: "asc"
 				}],
-				predicate: V("eventId", t),
+				predicate: H("eventId", t),
 				take: 500,
 				skip: void 0,
 				projection: void 0
 			};
 		}
-	}, e), G, `subscription.${Ii.name}`), q[Pi.name] = (e) => Jt(async (e, t) => {
+	}, e), K, `subscription.${Fi.name}`), J[Ni.name] = (e) => qt(async (e, t) => {
 		let n = e;
-		return await Ja(z, t.subject, { executionId: n.executionId }), await U.cancel(n.workflowName, n.executionId), await Jo(n.workflowName, n.executionId, "workflow.cancel"), { ok: !0 };
-	}, e, `action.${Pi.name}`), q[Li.name] = (e) => Jt(async (e, t) => {
+		return await qa(B, t.subject, { executionId: n.executionId }), await W.cancel(n.workflowName, n.executionId), await Jo(n.workflowName, n.executionId, "workflow.cancel"), { ok: !0 };
+	}, e, `action.${Ni.name}`), J[Ii.name] = (e) => qt(async (e, t) => {
 		let n = e;
-		return await Ja(z, t.subject, { executionId: n.executionId }), await U.resume(n.workflowName, n.executionId), { ok: !0 };
-	}, e, `action.${Li.name}`), q[Hi.name] = (e) => Jt(async (e, t) => {
+		return await qa(B, t.subject, { executionId: n.executionId }), await W.resume(n.workflowName, n.executionId), { ok: !0 };
+	}, e, `action.${Ii.name}`), J[Vi.name] = (e) => qt(async (e, t) => {
 		let n = e;
-		return await Ja(z, t.subject, { id: n.id }), U.signal({ id: n.id }, n.signalName, n.payload);
-	}, e, `action.${Hi.name}`), q[Ui.name] = (e) => Jt(async (e, t) => {
+		return await qa(B, t.subject, { id: n.id }), W.signal({ id: n.id }, n.signalName, n.payload);
+	}, e, `action.${Vi.name}`), J[Hi.name] = (e) => qt(async (e, t) => {
 		let n = e;
-		return await Ja(z, t.subject, { id: n.id }), U.update({ id: n.id }, n.updateName, n.payload, n.timeoutMs === void 0 ? void 0 : { timeoutMs: n.timeoutMs });
-	}, e, `action.${Ui.name}`));
-	for (let e of j) q[e.definition.name] = (t) => Jt(async (t, n) => {
+		return await qa(B, t.subject, { id: n.id }), W.update({ id: n.id }, n.updateName, n.payload, n.timeoutMs === void 0 ? void 0 : { timeoutMs: n.timeoutMs });
+	}, e, `action.${Hi.name}`));
+	for (let e of j) J[e.definition.name] = (t) => qt(async (t, n) => {
 		let r = n;
-		return Xn(U, {
+		return Yn(W, {
 			subject: r.subject,
 			traceId: r.traceId,
 			source: "workflow-rpc"
 		}).start(e.definition.name, t);
 	}, t, `workflow.${e.definition.name}`);
-	let Ro = (e, t) => mo({
+	let Ro = (e, t) => po({
 		subject: e.subject,
 		traceId: e.traceId
-	}, z, void 0, `workflow:${t.workflowName}`, { parentExecutionId: t.executionId }), zo = Mc(F?.plugins ?? [], J), Bo = Br, Vo = (e, t) => S.emit(e, t), Ko = F?.dormancy === "sleep" ? {
-		register: (e, t, n) => cr(z, {
-			tenantId: n ?? Ft,
+	}, B, void 0, `workflow:${t.workflowName}`, { parentExecutionId: t.executionId }), zo = Mc(F?.plugins ?? [], Oo), Bo = zr, Vo = (e, t) => S.emit(e, t), Ko = F?.dormancy === "sleep" ? {
+		register: (e, t, n) => sr(B, {
+			tenantId: n ?? Pt,
 			kind: "workflow",
 			refId: e,
 			wakeAt: t
 		}),
-		cancel: (e, t) => Qt(z, {
-			tenantId: t ?? Ft,
+		cancel: (e, t) => Zt(B, {
+			tenantId: t ?? Pt,
 			kind: "workflow",
 			refId: e
 		}).then(() => {})
-	} : void 0, X = Lr({
-		store: z,
+	} : void 0, X = Ir({
+		store: B,
 		emit: Vo,
 		log: $,
 		...Ko === void 0 ? {} : { wakeups: Ko }
 	}), qo = async (e, t) => {
-		await Nr({
-			store: z,
+		await Mr({
+			store: B,
 			parentExecutionId: e,
 			parentStatus: t,
 			recorder: X,
@@ -4782,16 +4782,16 @@ ${a.join("\n\n")}\n`);
 			}
 		});
 	}, Jo = async (e, t, n) => {
-		let r = (await z.query({
+		let r = (await B.query({
 			table: "_voltro_workflow_runs",
 			order: [],
-			predicate: V("executionId", t),
+			predicate: H("executionId", t),
 			projection: void 0,
 			skip: void 0,
 			take: 1
 		}))[0];
 		if (r === void 0) return;
-		let i = await z.update("_voltro_workflow_runs", r.id, {
+		let i = await B.update("_voltro_workflow_runs", r.id, {
 			status: "cancelled",
 			cancelled: !0,
 			completedAt: /* @__PURE__ */ new Date()
@@ -4812,10 +4812,10 @@ ${a.join("\n\n")}\n`);
 			}
 		}), i && await qo(t, "cancelled");
 	}, Yo = (e, t, n, r) => {
-		let i = Fr(t);
-		return Vr({
+		let i = Pr(t);
+		return Br({
 			name: e,
-			store: z,
+			store: B,
 			subject: r.subject,
 			source: r.source ?? null,
 			traceId: r.traceId,
@@ -4830,56 +4830,56 @@ ${a.join("\n\n")}\n`);
 			emit: Vo,
 			log: $
 		}, n);
-	}, Xo = [...Zn(j, {
+	}, Xo = [...Xn(j, {
 		buildContext: Ro,
-		resolveStartContext: Oa
-	}, (e, t, n) => Yo(e.definition.name, e.definition, t, n)), ...ft], Zo = Xo.length > 0 ? P.mergeAll(...Xo) : P.empty, Qo = _t.make(Zo.pipe(P.provideMerge(ba), P.provideMerge(uo), P.provideMerge(wt)));
+		resolveStartContext: Da
+	}, (e, t, n) => Yo(e.definition.name, e.definition, t, n)), ...ft], Zo = Xo.length > 0 ? P.mergeAll(...Xo) : P.empty, Qo = _t.make(Zo.pipe(P.provideMerge(ya), P.provideMerge(lo), P.provideMerge(wt)));
 	process.on("beforeExit", () => {
 		Qo.dispose();
-	}), Sa = j.length > 0 ? Yn({
+	}), xa = j.length > 0 ? Jn({
 		workflows: j,
 		runEffect: (e) => Qo.runPromise(e),
-		rememberStartContext: Da,
+		rememberStartContext: Ea,
 		signal: async (e, t, n) => {
-			let r = await Rr({
-				store: z,
+			let r = await Lr({
+				store: B,
 				recorder: X,
 				target: e,
 				signalName: t,
 				payload: n
 			});
-			return await Qo.runPromise(Pr({
-				store: z,
+			return await Qo.runPromise(Nr({
+				store: B,
 				target: e,
 				signalName: t,
 				payload: n
 			})).catch(() => {}), r;
 		},
-		update: (e, t, n, r) => zr({
-			store: z,
+		update: (e, t, n, r) => Rr({
+			store: B,
 			recorder: X,
 			target: e,
 			updateName: t,
 			payload: n,
 			...r === void 0 ? {} : { options: r }
 		}),
-		listRuns: (e) => Ic(z, e),
+		listRuns: (e) => Ic(B, e),
 		retry: (e, t) => Lc({
-			store: z,
+			store: B,
 			workflows: j,
 			runPromise: (e) => Qo.runPromise(e)
 		}, e, t)
 	}) : void 0;
-	let $o = P.mergeAll(oo.toLayer(q), jt, bl), ts = Qa(q, w.map((e) => e.descriptor.name), xt), ns = P.mergeAll(oo.toLayer(ts), jt, bl), rs = H, os = (rs === "postgres" || rs === "mysql" || rs === "mariadb" || rs === "mssql") && (process.env.CDC ?? "1") !== "0";
+	let $o = P.mergeAll(ao.toLayer(J), At, bl), ts = Za(J, w.map((e) => e.descriptor.name), xt), ns = P.mergeAll(ao.toLayer(ts), At, bl), rs = U, os = (rs === "postgres" || rs === "mysql" || rs === "mariadb" || rs === "mssql") && (process.env.CDC ?? "1") !== "0";
 	if (rs === "postgres" && me()) {
 		let e = be({
-			store: z,
+			store: B,
 			log: $
 		});
-		Bn = e.persistTraceSpan, process.on("beforeExit", e.stop);
+		zn = e.persistTraceSpan, process.on("beforeExit", e.stop);
 	}
-	let ls = Ga({
-		store: z,
+	let ls = Wa({
+		store: B,
 		dialect: rs
 	});
 	process.on("beforeExit", () => {
@@ -4899,21 +4899,21 @@ ${a.join("\n\n")}\n`);
 		tag: e.definition.name,
 		file: k(m, e.file)
 	}));
-	L.writeFile(O(m, "app.manifest.generated.json"), `${JSON.stringify(tt(us, fs, [], F?.plugins ?? []), null, 2)}\n`, "utf8").catch(() => {}), (async () => {
+	R.writeFile(O(m, "app.manifest.generated.json"), `${JSON.stringify(tt(us, fs, [], F?.plugins ?? []), null, 2)}\n`, "utf8").catch(() => {}), (async () => {
 		let e = O(m, ".gitignore"), t = "";
 		try {
-			t = await L.readFile(e, "utf8");
+			t = await R.readFile(e, "utf8");
 		} catch {}
 		let n = t.split("\n").filter((e) => e.trim() !== "");
-		n.includes("app.manifest.generated.json") || (n.push("app.manifest.generated.json"), await L.writeFile(e, `${n.join("\n")}\n`, "utf8"));
-	})().catch(() => {}), an();
+		n.includes("app.manifest.generated.json") || (n.push("app.manifest.generated.json"), await R.writeFile(e, `${n.join("\n")}\n`, "utf8"));
+	})().catch(() => {}), rn();
 	let ms = O(m, "app.graph.observed.generated.json");
-	L.rm(O(m, "app.graph.observed.json"), { force: !0 }).catch(() => {});
-	let Z = Ia(m);
+	R.rm(O(m, "app.graph.observed.json"), { force: !0 }).catch(() => {});
+	let Z = Fa(m);
 	Z.warning === void 0 ? Z.adopted.length > 0 && $.debug("handed generated output to the workspace owner", { paths: Z.adopted.join(", ") }) : $.warn(Z.warning);
 	let vs = async () => {
 		try {
-			await L.writeFile(ms, `${JSON.stringify(tr(), null, 2)}\n`, "utf8");
+			await R.writeFile(ms, `${JSON.stringify(er(), null, 2)}\n`, "utf8");
 		} catch {}
 	};
 	setInterval(() => {
@@ -4923,15 +4923,15 @@ ${a.join("\n\n")}\n`);
 	}), (async () => {
 		let e = O(m, ".gitignore"), t = "";
 		try {
-			t = await L.readFile(e, "utf8");
+			t = await R.readFile(e, "utf8");
 		} catch {}
 		let n = t.split("\n").filter((e) => e.trim() !== "");
-		n.includes("app.graph.observed.generated.json") || (n.push("app.graph.observed.generated.json"), await L.writeFile(e, `${n.join("\n")}\n`, "utf8"));
+		n.includes("app.graph.observed.generated.json") || (n.push("app.graph.observed.generated.json"), await R.writeFile(e, `${n.join("\n")}\n`, "utf8"));
 	})().catch(() => {});
 	let bs = /* @__PURE__ */ new Map();
 	for (let e of D) bs.set(e.descriptor.name, async (t, n) => {
 		let r = {
-			subject: await At({
+			subject: await kt({
 				headers: n,
 				clientId: -1
 			}),
@@ -4955,7 +4955,7 @@ ${a.join("\n\n")}\n`);
 	});
 	for (let e of A) bs.set(e.descriptor.name, async (t, n) => {
 		let r = {
-			subject: await At({
+			subject: await kt({
 				headers: n,
 				clientId: -1
 			}),
@@ -4978,7 +4978,7 @@ ${a.join("\n\n")}\n`);
 		}
 	});
 	let xs = () => ({
-		dialect: H,
+		dialect: U,
 		replication: ut.replicationSnapshot() ?? {
 			replicaCount: 0,
 			rywPolicy: "off",
@@ -5020,9 +5020,9 @@ ${a.join("\n\n")}\n`);
 			history: [],
 			softDropSnapshots: []
 		};
-		if (!ci) return e;
+		if (!si) return e;
 		let t = N.gen(function* () {
-			let e = yield* B.SqlClient, t = yield* e`
+			let e = yield* V.SqlClient, t = yield* e`
         SELECT ${e("id")}, ${e("fingerprint")},
                ${e("appliedAt")}::text AS ${e("appliedAt")},
                ${e("appliedBy")}, ${e("environment")}, ${e("source")},
@@ -5031,17 +5031,17 @@ ${a.join("\n\n")}\n`);
         FROM ${e("_voltro_migration_plans")}
         ORDER BY ${e("appliedAt")} DESC
         LIMIT 20
-      `.pipe(N.orElseSucceed(() => [])), n = yield* $i(e), r = Qi({ tables: n.tables.filter((e) => !e.name.startsWith("_voltro_")) }), i = t[0], a = {
+      `.pipe(N.orElseSucceed(() => [])), n = yield* Qi(e), r = Zi({ tables: n.tables.filter((e) => !e.name.startsWith("_voltro_")) }), i = t[0], a = {
 				isDrifted: i ? i.fingerprint !== r : !1,
 				liveFingerprint: r,
 				liveSnapshot: n
 			};
 			i && (a.lastAppliedFingerprint = i.fingerprint, a.lastAppliedAt = i.appliedAt, a.lastAppliedId = i.id);
-			let o = R, s = ta({
+			let o = z, s = ea({
 				declared: o,
 				live: n
 			});
-			return Qi(Xi(o)), {
+			return Zi(Yi(o)), {
 				drift: a,
 				pending: {
 					operations: s.operations.map((e) => {
@@ -5080,7 +5080,7 @@ ${a.join("\n\n")}\n`);
 			};
 		});
 		try {
-			return await N.runPromise(t.pipe(N.provide(ci)));
+			return await N.runPromise(t.pipe(N.provide(si)));
 		} catch (t) {
 			return $.warn("inspect.migrations: snapshot build failed", { err: String(t) }), e;
 		}
@@ -5096,11 +5096,11 @@ ${a.join("\n\n")}\n`);
 		},
 		rpc: us,
 		workflows: fs,
-		metrics: (e) => J.snapshot(e),
+		metrics: (e) => Oo.snapshot(e),
 		dataCache: () => {
-			let e = Er(), t = (process.env.CACHE_REDIS_DRIVER ?? "resp") === "http" ? "http" : "resp", n = Tr === "redis" ? (process.env.CACHE_REDIS_URL ?? process.env.REDIS_URL ?? "").includes("upstash") ? "upstash" : "redis" : "memory";
+			let e = Tr(), t = (process.env.CACHE_REDIS_DRIVER ?? "resp") === "http" ? "http" : "resp", n = wr === "redis" ? (process.env.CACHE_REDIS_URL ?? process.env.REDIS_URL ?? "").includes("upstash") ? "upstash" : "redis" : "memory";
 			return {
-				backend: Tr === "redis" ? "redis" : "memory",
+				backend: wr === "redis" ? "redis" : "memory",
 				engine: n,
 				driver: t,
 				hits: e.hits,
@@ -5110,19 +5110,19 @@ ${a.join("\n\n")}\n`);
 		},
 		invokers: bs,
 		plugins: () => ({
-			plugins: Lt.snapshot(),
+			plugins: It.snapshot(),
 			capturedAt: Date.now()
 		}),
 		env: () => _(F?.name ?? E(m), {
-			contract: Wi(F?.env) ? F.env : void 0,
+			contract: Ui(F?.env) ? F.env : void 0,
 			plugins: F?.plugins ?? []
 		}),
 		subscriptions: () => {
-			let e = G.subscriptionSnapshot(), t = G.matcherStats();
+			let e = K.subscriptionSnapshot(), t = K.matcherStats();
 			return {
 				subscriptions: e.map((e) => {
 					let t = [];
-					for (let n of ui(e.predicate)) n.conjunctive && t.push(n.column);
+					for (let n of li(e.predicate)) n.conjunctive && t.push(n.column);
 					return {
 						fingerprint: e.fingerprint,
 						table: e.table,
@@ -5138,7 +5138,7 @@ ${a.join("\n\n")}\n`);
 		},
 		database: xs,
 		migrations: async () => Ss(),
-		inspectTables: () => ({ tables: R.map((e) => {
+		inspectTables: () => ({ tables: z.map((e) => {
 			let t = Nl(e), n = Pl(t);
 			return {
 				name: e.tableName,
@@ -5150,13 +5150,13 @@ ${a.join("\n\n")}\n`);
 			};
 		}) }),
 		inspectRows: async (e) => {
-			let t = Math.max(0, e.offset ?? 0), n = Math.max(1, Math.min(500, e.limit ?? 50)), r = R.find((t) => t.tableName === e.table);
+			let t = Math.max(0, e.offset ?? 0), n = Math.max(1, Math.min(500, e.limit ?? 50)), r = z.find((t) => t.tableName === e.table);
 			if (!r) throw Error(`unknown table: ${e.table}`);
 			let i = Nl(r), a = nl({
 				filter: e.filter,
 				quickSearch: e.quickSearch,
 				columns: i
-			}), o = rl(e.sort, i), s = await z.query({
+			}), o = rl(e.sort, i), s = await B.query({
 				table: e.table,
 				order: o,
 				skip: t,
@@ -5164,7 +5164,7 @@ ${a.join("\n\n")}\n`);
 				predicate: a,
 				projection: void 0
 			}), c = e.count ?? (t === 0 ? "exact" : "none"), l = null, u = "none";
-			return (c === "exact" || c === "estimate") && (l = (await z.query({
+			return (c === "exact" || c === "estimate") && (l = (await B.query({
 				table: e.table,
 				order: [],
 				predicate: a,
@@ -5181,8 +5181,8 @@ ${a.join("\n\n")}\n`);
 		},
 		inspectInsertRow: async (e) => {
 			if (e.table.startsWith("_voltro_")) throw Error(`inspect data viewer cannot write to framework-internal table: ${e.table}`);
-			if (!R.some((t) => t.tableName === e.table)) throw Error(`unknown table: ${e.table}`);
-			let t = await z.insert(e.table, e.row);
+			if (!z.some((t) => t.tableName === e.table)) throw Error(`unknown table: ${e.table}`);
+			let t = await B.insert(e.table, e.row);
 			return $.info("inspect.data.insert", {
 				table: e.table,
 				id: t?.id ?? null
@@ -5190,8 +5190,8 @@ ${a.join("\n\n")}\n`);
 		},
 		inspectUpdateRow: async (e) => {
 			if (e.table.startsWith("_voltro_")) throw Error(`inspect data viewer cannot write to framework-internal table: ${e.table}`);
-			if (!R.some((t) => t.tableName === e.table)) throw Error(`unknown table: ${e.table}`);
-			let t = await z.update(e.table, e.id, e.patch);
+			if (!z.some((t) => t.tableName === e.table)) throw Error(`unknown table: ${e.table}`);
+			let t = await B.update(e.table, e.id, e.patch);
 			return $.info("inspect.data.update", {
 				table: e.table,
 				id: e.id,
@@ -5200,8 +5200,8 @@ ${a.join("\n\n")}\n`);
 		},
 		inspectDeleteRow: async (e) => {
 			if (e.table.startsWith("_voltro_")) throw Error(`inspect data viewer cannot delete from framework-internal table: ${e.table}`);
-			if (!R.some((t) => t.tableName === e.table)) throw Error(`unknown table: ${e.table}`);
-			let t = await z.delete(e.table, e.id);
+			if (!z.some((t) => t.tableName === e.table)) throw Error(`unknown table: ${e.table}`);
+			let t = await B.delete(e.table, e.id);
 			return $.info("inspect.data.delete", {
 				table: e.table,
 				id: e.id,
@@ -5209,8 +5209,8 @@ ${a.join("\n\n")}\n`);
 			}), { deleted: t };
 		},
 		inspectImport: async (e) => {
-			let t = await N.runPromise(Ea({
-				store: z,
+			let t = await N.runPromise(Ta({
+				store: B,
 				bundleDir: e.bundleDir,
 				...e.mode ? { mode: e.mode } : {},
 				...e.onConflict ? { onConflict: e.onConflict } : {},
@@ -5228,14 +5228,14 @@ ${a.join("\n\n")}\n`);
 		},
 		...xt ? {
 			inspectStartWorkflow: async (e) => {
-				if (U === void 0) throw Error("workflow runtime is not configured");
-				return Xn(U, {
+				if (W === void 0) throw Error("workflow runtime is not configured");
+				return Yn(W, {
 					traceId: `inspect-workflow-start-${Date.now()}`,
 					source: "inspect"
 				}).start(e.name, e.payload);
 			},
 			inspectWorkflowRuns: async (e) => {
-				let { rows: t, total: n, offset: r, limit: i } = await Pc(z, {
+				let { rows: t, total: n, offset: r, limit: i } = await Pc(B, {
 					...e.tag === void 0 ? {} : { tag: e.tag },
 					...e.status === void 0 ? {} : { status: e.status },
 					...e.offset === void 0 ? {} : { offset: e.offset },
@@ -5268,10 +5268,10 @@ ${a.join("\n\n")}\n`);
 				};
 			},
 			inspectCancelWorkflowRun: async (e) => {
-				let t = (await z.query({
+				let t = (await B.query({
 					table: "_voltro_workflow_runs",
 					order: [],
-					predicate: V("id", e.runId),
+					predicate: H("id", e.runId),
 					projection: void 0,
 					skip: void 0,
 					take: 1
@@ -5290,7 +5290,7 @@ ${a.join("\n\n")}\n`);
 						reason: t?.message ?? String(t)
 					});
 				}
-				let r = await z.update("_voltro_workflow_runs", e.runId, {
+				let r = await B.update("_voltro_workflow_runs", e.runId, {
 					status: "cancelled",
 					cancelled: !0,
 					completedAt: /* @__PURE__ */ new Date()
@@ -5312,13 +5312,13 @@ ${a.join("\n\n")}\n`);
 					didUpdate: r !== null
 				}), { cancelled: r !== null };
 			},
-			inspectWorkflowRunSteps: async (e) => ({ steps: (await z.query({
+			inspectWorkflowRunSteps: async (e) => ({ steps: (await B.query({
 				table: "_voltro_workflow_run_steps",
 				order: [{
 					column: "startedAt",
 					direction: "asc"
 				}],
-				predicate: V("runId", e.runId),
+				predicate: H("runId", e.runId),
 				projection: void 0,
 				skip: void 0,
 				take: 1e3
@@ -5338,13 +5338,13 @@ ${a.join("\n\n")}\n`);
 				completedAt: e.completedAt ? e.completedAt.toISOString() : null,
 				durationMs: e.durationMs
 			})) }),
-			inspectWorkflowRunEvents: async (e) => ({ events: (await z.query({
+			inspectWorkflowRunEvents: async (e) => ({ events: (await B.query({
 				table: "_voltro_workflow_run_events",
 				order: [{
 					column: "occurredAt",
 					direction: "asc"
 				}],
-				predicate: V("runId", e.runId),
+				predicate: H("runId", e.runId),
 				projection: void 0,
 				skip: void 0,
 				take: 2e3
@@ -5358,7 +5358,7 @@ ${a.join("\n\n")}\n`);
 				attempt: e.attempt
 			})) }),
 			inspectWorkflowDomainEvents: async (e) => {
-				let t = Math.max(0, e.offset ?? 0), n = Math.max(1, Math.min(500, e.limit ?? 100)), r = e.name === void 0 ? void 0 : V("name", e.name), i = await z.query({
+				let t = Math.max(0, e.offset ?? 0), n = Math.max(1, Math.min(500, e.limit ?? 100)), r = e.name === void 0 ? void 0 : H("name", e.name), i = await B.query({
 					table: "_voltro_workflow_events",
 					order: [{
 						column: "occurredAt",
@@ -5368,7 +5368,7 @@ ${a.join("\n\n")}\n`);
 					projection: void 0,
 					skip: t,
 					take: n
-				}), a = await z.query({
+				}), a = await B.query({
 					table: "_voltro_workflow_events",
 					order: [],
 					predicate: r,
@@ -5391,13 +5391,13 @@ ${a.join("\n\n")}\n`);
 					limit: n
 				};
 			},
-			inspectWorkflowEventDeliveries: async (e) => ({ deliveries: (await z.query({
+			inspectWorkflowEventDeliveries: async (e) => ({ deliveries: (await B.query({
 				table: "_voltro_workflow_event_deliveries",
 				order: [{
 					column: "createdAt",
 					direction: "asc"
 				}],
-				predicate: V("eventId", e.eventId),
+				predicate: H("eventId", e.eventId),
 				projection: void 0,
 				skip: void 0,
 				take: 500
@@ -5416,13 +5416,13 @@ ${a.join("\n\n")}\n`);
 				completedAt: e.completedAt ? e.completedAt.toISOString() : null
 			})) }),
 			inspectWorkflowChildren: async (e) => {
-				let t = (await z.query({
+				let t = (await B.query({
 					table: "_voltro_workflow_runs",
 					order: [{
 						column: "startedAt",
 						direction: "asc"
 					}],
-					predicate: V("parentExecutionId", e.parentExecutionId),
+					predicate: H("parentExecutionId", e.parentExecutionId),
 					projection: void 0,
 					skip: void 0,
 					take: 200
@@ -5454,10 +5454,10 @@ ${a.join("\n\n")}\n`);
 				};
 			},
 			inspectSuspendWorkflowRun: async (e) => {
-				let t = (await z.query({
+				let t = (await B.query({
 					table: "_voltro_workflow_runs",
 					order: [],
-					predicate: V("id", e.runId),
+					predicate: H("id", e.runId),
 					projection: void 0,
 					skip: void 0,
 					take: 1
@@ -5472,7 +5472,7 @@ ${a.join("\n\n")}\n`);
 						reason: t?.message ?? String(t)
 					});
 				}
-				let r = await z.update("_voltro_workflow_runs", e.runId, {
+				let r = await B.update("_voltro_workflow_runs", e.runId, {
 					status: "suspended",
 					completedAt: /* @__PURE__ */ new Date()
 				});
@@ -5486,10 +5486,10 @@ ${a.join("\n\n")}\n`);
 				}), { suspended: r !== null };
 			},
 			inspectResumeWorkflowRun: async (e) => {
-				let t = (await z.query({
+				let t = (await B.query({
 					table: "_voltro_workflow_runs",
 					order: [],
-					predicate: V("id", e.runId),
+					predicate: H("id", e.runId),
 					projection: void 0,
 					skip: void 0,
 					take: 1
@@ -5504,7 +5504,7 @@ ${a.join("\n\n")}\n`);
 						reason: t?.message ?? String(t)
 					}), { resumed: !1 };
 				}
-				let r = await z.update("_voltro_workflow_runs", e.runId, {
+				let r = await B.update("_voltro_workflow_runs", e.runId, {
 					status: "running",
 					completedAt: null
 				});
@@ -5521,7 +5521,7 @@ ${a.join("\n\n")}\n`);
 				let t = e.payloadOverride !== void 0;
 				try {
 					let n = await Lc({
-						store: z,
+						store: B,
 						workflows: j,
 						runPromise: (e) => Qo.runPromise(e)
 					}, e.runId, t ? { payloadOverride: e.payloadOverride } : void 0);
@@ -5537,8 +5537,8 @@ ${a.join("\n\n")}\n`);
 				}
 			},
 			inspectSignalWorkflowRun: async (e) => {
-				let t = await Rr({
-					store: z,
+				let t = await Lr({
+					store: B,
 					recorder: X,
 					target: { id: e.runId },
 					signalName: e.signalName,
@@ -5551,8 +5551,8 @@ ${a.join("\n\n")}\n`);
 				}), t;
 			},
 			inspectUpdateWorkflowRun: async (e) => {
-				let t = await zr({
-					store: z,
+				let t = await Rr({
+					store: B,
 					recorder: X,
 					target: { id: e.runId },
 					updateName: e.updateName,
@@ -5574,17 +5574,17 @@ ${a.join("\n\n")}\n`);
 					name: e.name,
 					cron: e.cron,
 					timezone: e.timezone,
-					trigger: e.trigger ?? fa,
+					trigger: e.trigger ?? da,
 					onOverlap: e.onOverlap ?? "skip",
 					backfill: e.backfill ?? "skip",
 					maxRuntimeMs: e.maxRuntimeMs ?? 30 * 6e4,
 					...e.description === void 0 ? {} : { description: e.description },
-					nextFiringAt: $n(e).toISOString()
+					nextFiringAt: Qn(e).toISOString()
 				})),
-				coordination: ma ? "cluster" : pa === "advisoryLock" && H === "postgres" ? "advisoryLock" : "single"
+				coordination: pa ? "cluster" : fa === "advisoryLock" && U === "postgres" ? "advisoryLock" : "single"
 			}),
 			inspectScheduleRuns: async (e) => {
-				let t = Math.max(0, e.offset ?? 0), n = Math.max(1, Math.min(500, e.limit ?? 50)), r = e.name === void 0 ? void 0 : V("name", e.name), i = await z.query({
+				let t = Math.max(0, e.offset ?? 0), n = Math.max(1, Math.min(500, e.limit ?? 50)), r = e.name === void 0 ? void 0 : H("name", e.name), i = await B.query({
 					table: "_voltro_schedule_runs",
 					order: [{
 						column: "scheduledAt",
@@ -5594,7 +5594,7 @@ ${a.join("\n\n")}\n`);
 					projection: void 0,
 					skip: t,
 					take: n
-				}), a = await z.query({
+				}), a = await B.query({
 					table: "_voltro_schedule_runs",
 					order: [],
 					predicate: r,
@@ -5623,21 +5623,21 @@ ${a.join("\n\n")}\n`);
 				};
 			},
 			inspectFireSchedule: async (e) => {
-				if (!sa) throw Error("scheduler not started (no self-triggered schedules?)");
-				return { runId: await sa.fireNow(e.name, e.trigger) ?? null };
+				if (!oa) throw Error("scheduler not started (no self-triggered schedules?)");
+				return { runId: await oa.fireNow(e.name, e.trigger) ?? null };
 			}
 		} : {},
 		cluster: async () => {
-			let e = process.env.POD_NAME ?? process.env.HOSTNAME ?? `dev-${process.pid}`, t = H, n = t === "memory", r = n ? "none" : Gr({ sqliteFamily: t === "sqlite" || t === "turso" }), i = Wr({
+			let e = process.env.POD_NAME ?? process.env.HOSTNAME ?? `dev-${process.pid}`, t = U, n = t === "memory", r = n ? "none" : Wr({ sqliteFamily: t === "sqlite" || t === "turso" }), i = Ur({
 				runnerStorage: r === "sql" ? "sql" : "memory",
 				...process.env.VOLTRO_WORKFLOW_RUNNER_PORT ? { runnerListenPort: Number(process.env.VOLTRO_WORKFLOW_RUNNER_PORT) } : {}
-			}), a = !n && (process.env.CDC ?? "1") !== "0", o = t === "postgres" ? "LISTEN/NOTIFY" : t === "sqlite" || t === "turso" ? "in-process bus" : t === "mariadb" || t === "mysql" ? "binlog CDC (ROW)" : t === "mssql" ? "inline only" : t === "memory" ? "none (single-process)" : "inline only", s = t === "postgres" || t === "mariadb" || t === "mssql" ? "full" : t === "mysql" ? "inline-only" : t === "sqlite" || t === "turso" ? "single-process" : "none", c = ma ? "cluster" : pa === "advisoryLock" && H === "postgres" ? "advisoryLock" : "single", l = a && t === "mariadb" ? Xl(e) : void 0, u = {
+			}), a = !n && (process.env.CDC ?? "1") !== "0", o = t === "postgres" ? "LISTEN/NOTIFY" : t === "sqlite" || t === "turso" ? "in-process bus" : t === "mariadb" || t === "mysql" ? "binlog CDC (ROW)" : t === "mssql" ? "inline only" : t === "memory" ? "none (single-process)" : "inline only", s = t === "postgres" || t === "mariadb" || t === "mssql" ? "full" : t === "mysql" ? "inline-only" : t === "sqlite" || t === "turso" ? "single-process" : "none", c = pa ? "cluster" : fa === "advisoryLock" && U === "postgres" ? "advisoryLock" : "single", l = a && t === "mariadb" ? Xl(e) : void 0, u = {
 				replicaId: e,
 				dialect: t,
 				runnerHost: i.host,
 				runnerPort: r === "none" ? 0 : i.port,
 				runnerStorage: r,
-				shardLock: r === "sql" ? Ur() : "none",
+				shardLock: r === "sql" ? Hr() : "none",
 				coordination: c,
 				cdc: {
 					enabled: a,
@@ -5649,7 +5649,7 @@ ${a.join("\n\n")}\n`);
 			}, d = async (e) => {
 				if (n) return [];
 				try {
-					return await z.query(e);
+					return await B.query(e);
 				} catch {
 					return [];
 				}
@@ -5684,7 +5684,7 @@ ${a.join("\n\n")}\n`);
 					runningWorkflowRuns: (await d({
 						table: "_voltro_workflow_runs",
 						order: [],
-						predicate: V("status", "running"),
+						predicate: H("status", "running"),
 						projection: ["id"],
 						skip: void 0,
 						take: void 0
@@ -5694,17 +5694,17 @@ ${a.join("\n\n")}\n`);
 			};
 		},
 		runSeed: async (e) => {
-			let t = await ie(xi, e, z, vi);
+			let t = await ie(bi, e, B, _i);
 			return ut.recordSeedResult(t), xs();
 		},
-		rollbackMigration: async (e) => (vi.warn("rollbackMigration called but only memory store is wired — no-op"), xs()),
+		rollbackMigration: async (e) => (_i.warn("rollbackMigration called but only memory store is wired — no-op"), xs()),
 		webhooks: async () => {
-			let e = W.outgoing.map((e) => ({
+			let e = G.outgoing.map((e) => ({
 				id: e.descriptor.id,
 				...e.descriptor.description === void 0 ? {} : { description: e.descriptor.description },
 				version: e.descriptor.version ?? 1,
 				file: e.file
-			})), t = W.incoming.map((e) => {
+			})), t = G.incoming.map((e) => {
 				let t = e.descriptor.path ?? `/webhooks/${e.descriptor.id}`, n = e.descriptor.provider?.id, r = e.descriptor.signature !== void 0 || e.descriptor.provider?.signature !== void 0;
 				return {
 					id: e.descriptor.id,
@@ -5715,7 +5715,7 @@ ${a.join("\n\n")}\n`);
 				};
 			}), n = [], r = [];
 			try {
-				n = (await z.query({
+				n = (await B.query({
 					table: "_voltro_webhook_targets",
 					order: [{
 						column: "createdAt",
@@ -5730,7 +5730,7 @@ ${a.join("\n\n")}\n`);
 				}));
 			} catch {}
 			try {
-				r = (await z.query({
+				r = (await B.query({
 					table: "_voltro_webhook_deliveries",
 					order: [{
 						column: "createdAt",
@@ -5750,23 +5750,23 @@ ${a.join("\n\n")}\n`);
 				deliveries: r
 			};
 		},
-		...K === void 0 ? {} : { webhookActions: {
-			subscribe: (e) => K.subscribe(e).then((e) => ({
+		...q === void 0 ? {} : { webhookActions: {
+			subscribe: (e) => q.subscribe(e).then((e) => ({
 				id: e.id,
 				event: e.event,
 				url: e.url,
 				secret: e.secret
 			})),
-			pause: (e) => K.pauseTarget(e),
-			resume: (e) => K.resumeTarget(e),
-			delete: (e) => K.deleteTarget(e),
-			rotateSecret: (e) => K.rotateSecret(e),
-			replay: (e) => K.replay(e),
-			updateTargetPayloadVersion: (e, t) => K.updateTargetPayloadVersion(e, t)
+			pause: (e) => q.pauseTarget(e),
+			resume: (e) => q.resumeTarget(e),
+			delete: (e) => q.deleteTarget(e),
+			rotateSecret: (e) => q.rotateSecret(e),
+			replay: (e) => q.replay(e),
+			updateTargetPayloadVersion: (e, t) => q.updateTargetPayloadVersion(e, t)
 		} }
-	}, ws = Rc(F?.plugins ?? [], J);
+	}, ws = Rc(F?.plugins ?? [], Oo);
 	ws !== void 0 && $.info("plugin http-request interceptor active", { plugins: (F?.plugins ?? []).filter((e) => typeof e.onHttpRequest == "function").map((e) => e.name) });
-	let Es = (F?.plugins ?? []).flatMap((e) => e.httpRoutes ?? []), Ds = typeof Et == "object" ? Et.managementPath : void 0, Os = () => `public-${Math.random().toString(36).slice(2, 10)}`, ks = la([
+	let Es = (F?.plugins ?? []).flatMap((e) => e.httpRoutes ?? []), Ds = typeof Tt == "object" ? Tt.managementPath : void 0, Os = () => `public-${Math.random().toString(36).slice(2, 10)}`, ks = ca([
 		...w.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
 			descriptor: e.descriptor,
 			invoke: (t, n) => Y(e, t, {
@@ -5794,17 +5794,17 @@ ${a.join("\n\n")}\n`);
 		}))
 	]), As = [
 		...F?.restRoutes ?? [],
-		...Ot ? Vt(Ot, Ds ?? "/v1/api-keys") : [],
+		...Dt ? Bt(Dt, Ds ?? "/v1/api-keys") : [],
 		...ks
 	];
 	ks.length > 0 && $.info("public-api routes projected from descriptors", { routes: ks.map((e) => `${e.method} ${e.path}`) });
 	let js = F?.idempotency, Ms = js ? {
-		store: nn(z),
+		store: tn(B),
 		header: (typeof js == "object" ? js.header : void 0) ?? "Idempotency-Key",
 		ttlMs: (typeof js == "object" ? js.ttlMs : void 0) ?? 864e5
-	} : void 0, Ns = As.length > 0 ? ua(As, {
-		store: z,
-		resolveSubject: (e) => At({
+	} : void 0, Ns = As.length > 0 ? la(As, {
+		store: B,
+		resolveSubject: (e) => kt({
 			headers: e,
 			clientId: -1
 		}),
@@ -5817,21 +5817,22 @@ ${a.join("\n\n")}\n`);
 	let Ps = [
 		...Es,
 		...Ns,
-		...er.httpRoutes
-	], { server: Fs } = Sr({
-		group: oo,
+		...$n.httpRoutes
+	], { server: Fs } = xr({
+		group: ao,
 		handlersLayer: $o,
 		httpHandlersLayer: ns,
 		port: b,
 		path: F?.transport?.wsPath ?? "/ws",
 		...ws ? { pluginHttpInterceptor: ws } : {},
 		...Ps.length > 0 ? { httpRoutes: Ps } : {},
+		getStore: () => L.current,
 		inspectRoute: { handle: async (e, t, n, i) => {
 			if (n === "GET" && e === "/_voltro/inspect/plugins/dashboard-mounts") return {
 				status: 200,
 				contentType: "application/json; charset=utf-8",
 				body: JSON.stringify({
-					mounts: Bt,
+					mounts: zt,
 					capturedAt: Date.now()
 				}),
 				headers: T(t.origin)
@@ -5857,7 +5858,7 @@ ${a.join("\n\n")}\n`);
 			if (n === "GET" && (e === "/_voltro/inspect/traces" || e.startsWith("/_voltro/inspect/traces?"))) {
 				let n = ve();
 				return {
-					...ul(e, rs === "postgres" && me() ? await Hl(e, n, z) : n),
+					...ul(e, rs === "postgres" && me() ? await Hl(e, n, B) : n),
 					headers: T(t.origin)
 				};
 			}
@@ -5918,12 +5919,12 @@ ${a.join("\n\n")}\n`);
 				if (r) return r;
 			}
 			if (e.startsWith("/_voltro/inspect/aggregates")) {
-				let r = await Us(e, n, oa.registry, T(t.origin));
+				let r = await Us(e, n, aa.registry, T(t.origin));
 				if (r) return r;
 			}
 			if (e.startsWith("/_voltro/inspect/timeline")) {
 				let r = await $s(e, n, {
-					recorder: un(),
+					recorder: ln(),
 					readCurrentRows: async (e) => Q.inspectRows === void 0 ? [] : (await Q.inspectRows({
 						table: e,
 						offset: 0,
@@ -5935,8 +5936,8 @@ ${a.join("\n\n")}\n`);
 			}
 			if (e.startsWith("/_voltro/inspect/analytics")) {
 				let r = qs(e, n, {
-					sink: ri,
-					metricsCollector: J
+					sink: ni,
+					metricsCollector: Oo
 				}, T(t.origin));
 				if (r) return r;
 			}
@@ -5957,7 +5958,7 @@ ${a.join("\n\n")}\n`);
 				headers: T(t.origin)
 			}));
 			if (e.startsWith("/_voltro/inspect/plugins/")) {
-				let r = await zt.dispatch(e, n, t, i ?? "");
+				let r = await Rt.dispatch(e, n, t, i ?? "");
 				if (r) return r;
 			}
 			return et(e, Q, t, { method: n });
@@ -5970,11 +5971,11 @@ ${a.join("\n\n")}\n`);
 			corsHeaders: (e) => T(e),
 			keepAlive: () => i()
 		},
-		webhookRoutes: new Map(Array.from(Na.entries()).map(([e, t]) => [e, { handle: t }])),
-		...Qn ? { tracerLayer: Qn } : {}
+		webhookRoutes: new Map(Array.from(Ma.entries()).map(([e, t]) => [e, { handle: t }])),
+		...Zn ? { tracerLayer: Zn } : {}
 	});
 	try {
-		await qt(Fs);
+		await Kt(Fs);
 	} catch (e) {
 		$.error(`rpc server failed to bind on port ${b} — aborting boot`, { port: b }, e), process.exit(1);
 	}
@@ -5982,7 +5983,7 @@ ${a.join("\n\n")}\n`);
 		port: b,
 		ws: `ws://localhost:${b}/ws`,
 		store: rs
-	}), Ee?.set({ phase: "ready" }), rs === "postgres" && $.info("postgres change-data-capture", { enabled: (process.env.CDC ?? "1") !== "0" }), await ho();
+	}), Ee?.set({ phase: "ready" }), rs === "postgres" && $.info("postgres change-data-capture", { enabled: (process.env.CDC ?? "1") !== "0" }), await mo();
 	try {
 		await h({
 			id: x,
@@ -6010,9 +6011,9 @@ ${a.join("\n\n")}\n`);
 			}).catch(() => {});
 		}, 1e4).unref();
 		let r = async () => {
-			Lt.deactivate();
-			for (let e of dr) e.stop();
-			or?.dispose(), e(x), ue.dispose(), Dr(), mr?.close(), await oi();
+			It.deactivate();
+			for (let e of ur) e.stop();
+			ar?.dispose(), e(x), ue.dispose(), Er(), pr?.close(), await ai();
 		};
 		process.on("SIGINT", () => {
 			r();
@@ -6049,4 +6050,4 @@ ${a.join("\n\n")}\n`);
 	}), new Promise(() => {});
 };
 //#endregion
-export { Wa as $, gs as A, Go as B, tc as C, ys as D, Ts as E, cs as F, So as G, Wo as H, as as I, Xa as J, Qa as K, is as L, ps as M, ds as N, Cs as O, ss as P, Ga as Q, ns as R, ec as S, Rs as T, Ho as U, Uo as V, xo as W, qa as X, Ja as Y, Ka as Z, Ac as _, Gl as a, cc as b, Ul as c, Kl as d, za as et, Tl as f, Lc as g, Ic as h, Il as i, hs as j, _s as k, ql as l, Kc as m, _l as n, Cl as o, $l as p, Ya as q, Ql as r, Wl as s, vl as t, Ia as tt, iu as u, bc as v, Ls as w, ac as x, sc as y, es as z };
+export { Ua as $, gs as A, Go as B, tc as C, ys as D, Ts as E, cs as F, xo as G, Wo as H, as as I, Ya as J, Za as K, is as L, ps as M, ds as N, Cs as O, ss as P, Wa as Q, ns as R, ec as S, Rs as T, Ho as U, Uo as V, bo as W, Ka as X, qa as Y, Ga as Z, Ac as _, Gl as a, cc as b, Ul as c, Kl as d, Ra as et, Tl as f, Lc as g, Ic as h, Il as i, hs as j, _s as k, ql as l, Kc as m, _l as n, Cl as o, $l as p, Ja as q, Ql as r, Wl as s, vl as t, Fa as tt, iu as u, bc as v, Ls as w, ac as x, sc as y, es as z };