@voltro/cli 0.17.0 → 0.18.0

package/dist/{dev-DB7pbLob.js → dev-BOFxC21E.js}

@@ -1,4 +1,4 @@
-import { $ as e, A as t, B as n, C as r, E as i, G as a, H as o, K as s, O as c, U as l, W as u, Z as d, at as f, ft as p, ht as m, it as h, j as g, l as _, q as ee, st as te, t as ne, w as re } from "./inspectMetrics-DWh56Qas.js";
+import { $ as e, A as t, B as n, C as r, E as i, G as a, H as o, K as s, O as c, U as l, W as u, Z as d, at as f, ft as p, ht as m, it as h, j as g, l as _, q as ee, st as te, t as ne, w as re } from "./inspectMetrics-D1DmLeJs.js";
 import { i as ie, n as ae, o as v, r as oe, s as y } from "./seedRunner-D6eu-u5U.js";
 import { n as b } from "./appModuleLoader-C9r9mxZt.js";
 import { r as se } from "./devActivity-BhIu6ncs.js";
@@ -14,34 +14,35 @@ import { FetchHttpClient as ft } from "@effect/platform";
 import { Cause as pt, Cron as mt, Deferred as M, Duration as ht, Effect as N, Fiber as gt, Layer as P, ManagedRuntime as _t, Option as vt, Ref as yt, Schema as bt, Stream as xt } from "effect";
 import { createLogger as F, printAppSurface as St, printReadyBlock as Ct } from "@voltro/logger";
 import { appendFileSync as wt, chownSync as I, existsSync as L, promises as R, readFileSync as Tt, readdirSync as Et, statSync as Dt, writeFileSync as Ot } from "node:fs";
-import { AggregateError as kt, AggregateMaintainer as At, AggregateNotFound as jt, AggregateRegistry as Mt, AggregateStale as Nt, AnalyticsSink as z, DORMANCY_WAKEUP_TENANT as Pt, Dispatcher as Ft, InMemoryDataStore as It, ReactionRateLimiter as Lt, ReplicatedDataStore as Rt, SYSTEM_SUBJECT as zt, apiKeyManagementRoutes as Bt, applySoftDeleteScope as Vt, applyTenantScope as Ht, applyUndoInvocation as Ut, assertConnectionCipherConfigured as Wt, attachAnalyticsMirror as Gt, awaitServerListening as Kt, bindMutation as qt, bindStream as Jt, bindSubscription as Yt, buildTracingLayer as Xt, cancelWakeup as Zt, compileCron as Qt, completeOAuthConnect as $t, dataStoreApiKeyStore as en, dataStoreIdempotencyStore as tn, drainOutbox as nn, enableGraphObservation as rn, extractDbCause as an, formatServerOnlyLeaks as on, frameworkApiKeyStrategy as sn, getConnectionSubject as cn, getTimelineRecorder as ln, installPolicyGuardResolver as un, isAggregateDefinition as dn, isEmptyTenantScopedRead as fn, isOrglessUserSubject as pn, isScheduleDefinition as mn, isWorkflowEventTriggerDefinition as hn, listRetentions as gn, loadResourceTuples as _n, localityAwareSelector as vn, makeActionRunner as yn, makeAdvisoryLockCoordinator as bn, makeApiKeyService as xn, makeApiKeyUsageBuffer as Sn, makeApiKeyUsageFlusher as Cn, makeAppAccess as wn, makeAsyncKv as Tn, makeBufferingSpanProcessor as En, makeConnectionRegistry as Dn, makeConnectionResolver as On, makeConnectionsFacade as kn, makeCoordinatedScheduler as An, makeDataLoader as jn, makeDisconnectConnectionExecutor as Mn, makeEffectStoreLayer as Nn, makeEventsFacade as Pn, makeLazyWorkflowFacade as Fn, makeListConnectionsExecutor as In, makeMutationRunner as Ln, makeOneShotQueryRunner as Rn, makeOutboxFacade as zn, makePostCommitWorkflowFacade as Bn, makeQueryDescriptorProducer as Vn, makeQueryReauthorizer as Hn, makeQuerySubscriber as Un, makeSchemaRegistry as Wn, makeStartConnectionExecutor as Gn, makeSubmitTokenExecutor as Kn, makeUndoCapture as qn, makeWorkflowFacade as Jn, makeWorkflowFacadeWithCallerContext as Yn, makeWorkflowLayers as Xn, memoryRywPositionStore as Zn, nextFiring as Qn, noopAnalytics as B, noopAnalyticsSpec as $n, observedGraph as er, powerOfTwoSelector as tr, recordSubscriptionDelivery as nr, recordTimelineEvent as rr, redisRywPositionStore as ir, redoUndoInvocation as ar, registerRetention as or, registerWakeup as sr, resolveCurrentRegion as cr, resolveSecretsBackend as lr, retentionTtlMsFromEnv as ur, runProvidedEffect as dr, runReaction as fr, sanitizeRedirectTo as pr, serverOnlyLeaks as mr, setConnectionResolver as hr, setSecretsBackend as gr, setSystemStoreHandle as _r, setTupleSource as vr, singleCoordinator as yr, ssrfGuardHttpClientLayer as br, startRpcServer as xr, startScheduler as Sr, sweepRetention as Cr, tracingHttpClientLayer as wr, undoCaptureEnabled as Tr, undoLogExecutor as Er, wrapStoreWithMixinBehaviour as Dr } from "@voltro/runtime";
-import { Rpc as Or, RpcGroup as kr } from "@effect/rpc";
-import { SqlClient as V } from "@effect/sql";
-import { WorkflowEngine as Ar } from "@effect/workflow";
-import { WorkflowStepInterceptorTag as jr, closeWorkflowChildrenForParent as Mr, completeSuspendingSignal as Nr, getWorkflowVersionMetadata as Pr, isWorkflowWorkerLayer as Fr, makeWorkflowRunRecorder as Ir, sendWorkflowSignal as Lr, sendWorkflowUpdate as Rr, serialiseWorkflowRowForWire as zr, wrapWorkflowExecuteWithRunRecording as Br } from "@voltro/workflow";
-import { makeClusterCronLayer as Vr, parseShardLockMode as Hr, resolveRunnerIdentity as Ur, resolveRunnerStorage as Wr, workflowEngineLayer as Gr } from "@voltro/workflow/cluster";
-import { loadAgentMessages as Kr, runAgentTurn as qr } from "@voltro/ai";
-import { actorsTable as Jr, allRegisteredTables as Yr, and as Xr, auditAllTableIndexes as Zr, drainIdentifierWarnings as Qr, ensureTableRegistered as $r, eq as H, formatIndexAuditIssue as ei, isSqliteFamily as ti, lt as ni, or as ri, registerCoreTables as ii, registerDiscoveredRelations as ai, resolveTenantNamespace as oi, serverOnlyColumns as si, validateRegisteredRelations as ci, walkLeaves as li } from "@voltro/database";
-import { AuthMiddleware as ui, ConnectionInfoMiddleware as di, Unauthenticated as fi, WorkflowRunHandleSchema as pi, actionToRpc as mi, advisoryResourceGuardWarning as hi, anonymousSubject as gi, checkFrameworkCompat as _i, composeAuthStrategies as vi, composeRpcInterceptors as yi, connectionDisconnectDescriptor as bi, connectionStartDescriptor as xi, connectionSubmitTokenDescriptor as Si, connectionsListQueryDescriptor as Ci, findAdvisoryResourceGuards as wi, mutationToRpc as Ti, publishServerError as Ei, queryToRpc as Di, streamToRpc as Oi, tenantScopedSubject as ki, undoApplyDescriptor as Ai, undoLogQueryDescriptor as ji, undoRedoDescriptor as Mi, workflowCancelDescriptor as Ni, workflowDomainEventsQueryDescriptor as Pi, workflowEventDeliveriesQueryDescriptor as Fi, workflowResumeDescriptor as Ii, workflowRunEventsQueryDescriptor as Li, workflowRunQueryDescriptor as Ri, workflowRunStepsQueryDescriptor as zi, workflowRunsQueryDescriptor as Bi, workflowSignalDescriptor as Vi, workflowUpdateDescriptor as Hi } from "@voltro/protocol";
-import { isEnvContract as Ui } from "@voltro/env";
-import { readCookie as Wi, resolveOptionalSessionSecrets as Gi, verifySessionKeyed as Ki } from "@voltro/protocol/session";
-import { createHash as qi, randomBytes as Ji } from "node:crypto";
-import { declaredSnapshot as Yi, describeOutcome as Xi, fingerprintSchema as Zi, introspectSchema as Qi, pendingFileMigrationIds as $i, planMigrations as ea, runFileBasedMigrations as ta, runFrameworkBootstrap as na, runPlannedMigrations as ra } from "@voltro/database/sql";
-import { Cache as ia, CacheLayer as aa, InvalidationBus as U } from "@voltro/cache";
-import { Kv as oa } from "@voltro/kv";
-import { getAuthSessionStrategy as sa } from "@voltro/plugin-auth";
-import { collectPublicApiRoutes as ca, restRoutesToHttpRoutes as la } from "@voltro/protocol/rest";
-import { spawn as ua } from "node:child_process";
-import { watch as da } from "chokidar";
-import { agentRouteDescriptors as fa, isAgentDescriptor as pa } from "@voltro/ai/agent";
-import { ArrayFormatter as ma } from "effect/ParseResult";
-import { buildDeliverWebhookExecute as ha, buildWebhooksService as ga, defaultIncomingPath as _a, deliverWebhookWorkflow as va, isWebhookDescriptor as ya, mountIncomingWebhook as ba } from "@voltro/plugin-webhooks";
-import { isEmailTemplate as xa, registerEmailTemplates as Sa } from "@voltro/plugin-mail";
-import { attachBroadcastBus as Ca, getBroadcastPlugin as wa } from "@voltro/plugin-broadcast";
-import { runImport as Ta } from "@voltro/data-transfer";
-import { createServer as Ea } from "node:http";
+import { AggregateError as kt, AggregateMaintainer as At, AggregateNotFound as jt, AggregateRegistry as Mt, AggregateStale as Nt, AnalyticsSink as z, DORMANCY_WAKEUP_TENANT as Pt, Dispatcher as Ft, InMemoryDataStore as It, ReactionRateLimiter as Lt, ReplicatedDataStore as Rt, SYSTEM_SUBJECT as zt, apiKeyManagementRoutes as Bt, applySoftDeleteScope as Vt, applyTenantScope as Ht, applyUndoInvocation as Ut, assertConnectionCipherConfigured as Wt, attachAnalyticsMirror as Gt, awaitServerListening as Kt, bindMutation as qt, bindStream as Jt, bindSubscription as Yt, buildTracingLayer as Xt, cancelWakeup as Zt, compileCron as Qt, completeOAuthConnect as $t, dataStoreApiKeyStore as en, dataStoreIdempotencyStore as tn, drainOutbox as nn, enableGraphObservation as rn, extractDbCause as an, formatServerOnlyLeaks as on, frameworkApiKeyStrategy as sn, getConnectionSubject as cn, getTimelineRecorder as ln, installPolicyGuardResolver as un, isAggregateDefinition as dn, isEmptyTenantScopedRead as fn, isOrglessUserSubject as pn, isScheduleDefinition as mn, isWorkflowEventTriggerDefinition as hn, listRetentions as gn, loadResourceTuples as _n, localityAwareSelector as vn, makeActionRunner as yn, makeAdvisoryLockCoordinator as bn, makeApiKeyService as xn, makeApiKeyUsageBuffer as Sn, makeApiKeyUsageFlusher as Cn, makeAppAccess as wn, makeAsyncKv as Tn, makeBufferingSpanProcessor as En, makeConnectionRegistry as Dn, makeConnectionResolver as On, makeConnectionsFacade as kn, makeCoordinatedScheduler as An, makeDataLoader as jn, makeDisconnectConnectionExecutor as Mn, makeEffectStoreLayer as Nn, makeEventsFacade as Pn, makeLazyWorkflowFacade as Fn, makeListConnectionsExecutor as In, makeMutationRunner as Ln, makeOneShotQueryRunner as Rn, makeOutboxFacade as zn, makePostCommitWorkflowFacade as Bn, makeQueryDescriptorProducer as Vn, makeQueryReauthorizer as Hn, makeQuerySubscriber as Un, makeSchemaRegistry as Wn, makeStartConnectionExecutor as Gn, makeSubmitTokenExecutor as Kn, makeUndoCapture as qn, makeWorkflowFacade as Jn, makeWorkflowFacadeWithCallerContext as Yn, makeWorkflowLayers as Xn, memoryRywPositionStore as Zn, nextFiring as Qn, noopAnalytics as B, noopAnalyticsSpec as $n, observedGraph as er, powerOfTwoSelector as tr, recordSubscriptionDelivery as nr, recordTimelineEvent as rr, redisRywPositionStore as ir, redoUndoInvocation as ar, registerRetention as or, registerWakeup as sr, resolveCurrentRegion as cr, resolveSecretsBackend as lr, retentionTtlMsFromEnv as ur, runProvidedEffect as dr, runReaction as fr, sanitizeRedirectTo as pr, serverOnlyLeaks as mr, setConnectionResolver as hr, setSecretsBackend as gr, setSystemStoreHandle as _r, setTupleSource as vr, singleCoordinator as yr, ssrfGuardHttpClientLayer as br, startRpcServer as xr, startScheduler as Sr, sweepRetention as Cr, tracingHttpClientLayer as wr, undoCaptureEnabled as Tr, undoLogExecutor as Er, wrapStoreWithBootCodec as Dr, wrapStoreWithMixinBehaviour as Or } from "@voltro/runtime";
+import { createRequire as kr } from "node:module";
+import { Rpc as Ar, RpcGroup as jr } from "@effect/rpc";
+import { SqlClient as Mr } from "@effect/sql";
+import { WorkflowEngine as Nr } from "@effect/workflow";
+import { WorkflowStepInterceptorTag as Pr, closeWorkflowChildrenForParent as Fr, completeSuspendingSignal as Ir, getWorkflowVersionMetadata as Lr, isWorkflowWorkerLayer as Rr, makeWorkflowRunRecorder as zr, sendWorkflowSignal as Br, sendWorkflowUpdate as Vr, serialiseWorkflowRowForWire as Hr, wrapWorkflowExecuteWithRunRecording as Ur } from "@voltro/workflow";
+import { makeClusterCronLayer as Wr, parseShardLockMode as Gr, resolveRunnerIdentity as Kr, resolveRunnerStorage as qr, workflowEngineLayer as Jr } from "@voltro/workflow/cluster";
+import { loadAgentMessages as Yr, runAgentTurn as Xr } from "@voltro/ai";
+import { actorsTable as Zr, allRegisteredTables as Qr, and as $r, auditAllTableIndexes as ei, drainIdentifierWarnings as ti, ensureTableRegistered as ni, eq as V, formatIndexAuditIssue as ri, isSqliteFamily as ii, lt as ai, or as oi, registerCoreTables as si, registerDiscoveredRelations as ci, resolveTenantNamespace as li, serverOnlyColumns as ui, validateRegisteredRelations as di, walkLeaves as fi } from "@voltro/database";
+import { AuthMiddleware as pi, ConnectionInfoMiddleware as mi, Unauthenticated as hi, WorkflowRunHandleSchema as gi, actionToRpc as _i, advisoryResourceGuardWarning as vi, anonymousSubject as yi, checkFrameworkCompat as bi, composeAuthStrategies as xi, composeRpcInterceptors as Si, connectionDisconnectDescriptor as Ci, connectionStartDescriptor as wi, connectionSubmitTokenDescriptor as Ti, connectionsListQueryDescriptor as Ei, findAdvisoryResourceGuards as Di, mutationToRpc as Oi, publishServerError as ki, queryToRpc as Ai, streamToRpc as ji, tenantScopedSubject as Mi, undoApplyDescriptor as Ni, undoLogQueryDescriptor as Pi, undoRedoDescriptor as Fi, workflowCancelDescriptor as Ii, workflowDomainEventsQueryDescriptor as Li, workflowEventDeliveriesQueryDescriptor as Ri, workflowResumeDescriptor as zi, workflowRunEventsQueryDescriptor as Bi, workflowRunQueryDescriptor as Vi, workflowRunStepsQueryDescriptor as Hi, workflowRunsQueryDescriptor as Ui, workflowSignalDescriptor as Wi, workflowUpdateDescriptor as Gi } from "@voltro/protocol";
+import { isEnvContract as Ki } from "@voltro/env";
+import { readCookie as qi, resolveOptionalSessionSecrets as Ji, verifySessionKeyed as Yi } from "@voltro/protocol/session";
+import { createHash as Xi, randomBytes as Zi } from "node:crypto";
+import { declaredSnapshot as Qi, describeOutcome as $i, fingerprintSchema as ea, introspectSchema as ta, pendingFileMigrationIds as na, planMigrations as ra, runFileBasedMigrations as ia, runFrameworkBootstrap as aa, runPlannedMigrations as oa } from "@voltro/database/sql";
+import { Cache as sa, CacheLayer as H, InvalidationBus as ca } from "@voltro/cache";
+import { Kv as la } from "@voltro/kv";
+import { getAuthSessionStrategy as ua } from "@voltro/plugin-auth";
+import { collectPublicApiRoutes as da, restRoutesToHttpRoutes as fa } from "@voltro/protocol/rest";
+import { spawn as pa } from "node:child_process";
+import { watch as ma } from "chokidar";
+import { agentRouteDescriptors as ha, isAgentDescriptor as ga } from "@voltro/ai/agent";
+import { ArrayFormatter as _a } from "effect/ParseResult";
+import { buildDeliverWebhookExecute as va, buildWebhooksService as ya, defaultIncomingPath as ba, deliverWebhookWorkflow as xa, isWebhookDescriptor as Sa, mountIncomingWebhook as Ca } from "@voltro/plugin-webhooks";
+import { isEmailTemplate as wa, registerEmailTemplates as Ta } from "@voltro/plugin-mail";
+import { attachBroadcastBus as Ea, getBroadcastPlugin as Da } from "@voltro/plugin-broadcast";
+import { runImport as Oa } from "@voltro/data-transfer";
+import { createServer as ka } from "node:http";
 //#region src/envSecretMint.ts
-var Da = (e, t) => {
+var U = (e, t) => {
 	if (typeof process.getuid != "function") return;
 	let n;
 	try {
@@ -56,7 +57,7 @@ var Da = (e, t) => {
 	} catch (t) {
 		return `${e} was written as uid ${r} but the workspace is owned by uid ${n.uid}, and it could not be handed over (${t.message}). The file is mode 0600, so tools running as uid ${n.uid} — your tests, your editor, \`voltro doctor\` — will fail to read it with EACCES. Run this container as the workspace owner (docker \`--user ${n.uid}:${n.gid}\`), or set the variable(s) yourself so nothing needs minting.`;
 	}
-}, W = ".env.local", Oa = (e) => {
+}, W = ".env.local", Aa = (e) => {
 	let t = O(e, ".gitignore"), n = "";
 	try {
 		L(t) && (n = Tt(t, "utf8"));
@@ -69,17 +70,17 @@ var Da = (e, t) => {
 	} catch {
 		return !1;
 	}
-}, ka = (e) => Ji(32).toString(e), G = [{
+}, G = (e) => Zi(32).toString(e), ja = [{
 	key: "VOLTRO_INSPECT_TOKEN",
 	encoding: "base64url",
 	description: "Bearer token for /_voltro/inspect/* — minted so the dev inspect surface is not open to the network."
-}], Aa = (e, t, n = process.env) => {
+}], Ma = (e, t, n = process.env) => {
 	let r = [];
-	for (let e of G) {
+	for (let e of ja) {
 		let t = n[e.key];
 		t !== void 0 && t.trim() !== "" || r.push({
 			key: e.key,
-			value: ka(e.encoding),
+			value: G(e.encoding),
 			description: e.description
 		});
 	}
@@ -88,12 +89,12 @@ var Da = (e, t) => {
 		let e = n[t];
 		e !== void 0 && e.trim() !== "" || r.push({
 			key: t,
-			value: ka(i.generate),
+			value: G(i.generate),
 			description: i.description
 		});
 	}
 	if (r.length === 0) return { minted: [] };
-	if (!Oa(t)) throw Error(`cannot mint ${r.map((e) => e.key).join(", ")}: failed to add "${W}" to ${O(t, ".gitignore")}. Refusing to write a secret to a path that might be committed — add the entry by hand, or set the variable(s) yourself (\`voltro secret generate\`).`);
+	if (!Aa(t)) throw Error(`cannot mint ${r.map((e) => e.key).join(", ")}: failed to add "${W}" to ${O(t, ".gitignore")}. Refusing to write a secret to a path that might be committed — add the entry by hand, or set the variable(s) yourself (\`voltro secret generate\`).`);
 	let i = O(t, W), a = r.map((e) => `${e.description ? `# ${e.description}\n` : ""}${e.key}=${e.value}`).join("\n"), o;
 	try {
 		if (L(i)) {
@@ -105,7 +106,7 @@ var Da = (e, t) => {
 \n${a}\n`, {
 			encoding: "utf8",
 			mode: 384
-		}), o = Da(i, t);
+		}), o = U(i, t);
 	} catch (e) {
 		throw Error(`cannot mint ${r.map((e) => e.key).join(", ")}: failed to write ${i} — ${e.message}`);
 	}
@@ -115,7 +116,7 @@ var Da = (e, t) => {
 		file: i,
 		...o ? { ownershipWarning: o } : {}
 	};
-}, ja = [".framework", ".env.local"], Ma = /\.generated\./i, Na = (e) => {
+}, Na = [".framework", ".env.local"], Pa = /\.generated\./i, Fa = (e) => {
 	try {
 		let t = Dt(e);
 		return {
@@ -125,7 +126,7 @@ var Da = (e, t) => {
 	} catch {
 		return;
 	}
-}, Pa = (e, t, n) => {
+}, Ia = (e, t, n) => {
 	let r = !0;
 	try {
 		I(e, t, n);
@@ -139,44 +140,44 @@ var Da = (e, t) => {
 	} catch {
 		return r;
 	}
-	for (let a of i) Pa(O(e, a), t, n) || (r = !1);
+	for (let a of i) Ia(O(e, a), t, n) || (r = !1);
 	return r;
-}, Fa = (e) => {
+}, La = (e) => {
 	if (typeof process.getuid != "function") return { adopted: [] };
-	let t = Na(e);
+	let t = Fa(e);
 	if (t === void 0) return { adopted: [] };
 	let n = process.getuid();
 	if (t.uid === n) return { adopted: [] };
-	let r = [...ja];
+	let r = [...Na];
 	try {
-		for (let t of Et(e)) Ma.test(t) && r.push(t);
+		for (let t of Et(e)) Pa.test(t) && r.push(t);
 	} catch {}
 	let i = [], a = !1;
 	for (let n of r) {
 		let r = O(e, n);
-		Na(r) !== void 0 && (Pa(r, t.uid, t.gid) ? i.push(n) : a = !0);
+		Fa(r) !== void 0 && (Ia(r, t.uid, t.gid) ? i.push(n) : a = !0);
 	}
 	return a ? {
 		adopted: i,
 		warning: `generated files under ${e} are owned by uid ${n} but the workspace is owned by uid ${t.uid}, and they could not be handed over. On the host, tools running as uid ${t.uid} will fail with EACCES — \`voltro build\` cannot read \`.framework\`, and \`vitest\` cannot read \`.env.local\`. Run this container as the workspace owner (docker \`--user ${t.uid}:${t.gid}\`).`
 	} : { adopted: i };
-}, Ia = (e) => e.startsWith("_voltro_"), La = (e) => e === void 0 || e === "" || !/^file:/i.test(e) || (process.env.TURSO_SYNC_URL ?? "") !== "", Ra = (e) => {
-	if (e.dialect === "turso" && La(e.dbUrl)) return [{
+}, Ra = (e) => e.startsWith("_voltro_"), za = (e) => e === void 0 || e === "" || !/^file:/i.test(e) || (process.env.TURSO_SYNC_URL ?? "") !== "", Ba = (e) => {
+	if (e.dialect === "turso" && za(e.dbUrl)) return [{
 		level: "warn",
 		message: "turso is configured against a shared primary, but this dialect has no NATIVE cross-instance change capture: it reuses the SQLite store, which emits inline only. Subscribers see writes made by THEIR OWN instance and never another's — for every table, regardless of .nonReactive(). Add @voltro/plugin-broadcast (Redis / NATS) to fan changes out between instances, or run a single instance."
 	}];
 	if (e.changeStrategy !== "cdc" || e.dialect === "sqlite" || e.dialect === "turso") return [];
-	let t = new Set(e.querySources.filter((e) => !Ia(e))), n = e.tables.filter((e) => !Ia(e.tableName)).filter((e) => e.isReactive === !1 && t.has(e.tableName)).map((e) => e.tableName).sort();
+	let t = new Set(e.querySources.filter((e) => !Ra(e))), n = e.tables.filter((e) => !Ra(e.tableName)).filter((e) => e.isReactive === !1 && t.has(e.tableName)).map((e) => e.tableName).sort();
 	if (n.length === 0) return [];
 	let r = n.slice(0, 8).join(", "), i = n.length > 8 ? `, … (+${n.length - 8})` : "";
 	return [{
 		level: "warn",
 		message: `${n.length} table(s) are .nonReactive() but a query declares them as a source — ${r}${i}. Those subscriptions will NEVER fire: a non-reactive table emits no change events at all, in this process or any other, so the query returns its first snapshot and then goes quiet forever. Either drop .nonReactive() from the table, or stop subscribing to it.`
 	}];
-}, za = "VOLTRO_REMOTE_MIGRATIONS_OK", Ba = /^(10\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.)/, K = (e) => {
+}, Va = "VOLTRO_REMOTE_MIGRATIONS_OK", K = /^(10\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.)/, Ha = (e) => {
 	let t = e.toLowerCase().replace(/^\[|\]$/g, "");
-	return !!(t === "" || t === "localhost" || t === "ip6-localhost" || t === "::1" || t === "0.0.0.0" || t === "::" || t.startsWith("127.") || t === "host.docker.internal" || t === "gateway.docker.internal" || t.endsWith(".localhost") || t.endsWith(".local") || Ba.test(t) || !t.includes(".") && !t.includes(":"));
-}, Va = (e) => {
+	return !!(t === "" || t === "localhost" || t === "ip6-localhost" || t === "::1" || t === "0.0.0.0" || t === "::" || t.startsWith("127.") || t === "host.docker.internal" || t === "gateway.docker.internal" || t.endsWith(".localhost") || t.endsWith(".local") || K.test(t) || !t.includes(".") && !t.includes(":"));
+}, Ua = (e) => {
 	if (e.url !== void 0 && e.url !== "") {
 		if (/^(file|sqlite):/i.test(e.url)) return {
 			kind: "local",
@@ -185,7 +186,7 @@ var Da = (e, t) => {
 		try {
 			let t = new URL(e.url).hostname;
 			return {
-				kind: K(t) ? "local" : "remote",
+				kind: Ha(t) ? "local" : "remote",
 				host: t
 			};
 		} catch {
@@ -197,12 +198,12 @@ var Da = (e, t) => {
 	}
 	let t = e.host ?? "localhost";
 	return {
-		kind: K(t) ? "local" : "remote",
+		kind: Ha(t) ? "local" : "remote",
 		host: t
 	};
-}, Ha = (e) => {
+}, Wa = (e) => {
 	if (e.pendingIds.length === 0 || e.optIn) return { allowed: !0 };
-	let t = Va(e.conn);
+	let t = Ua(e.conn);
 	if (t.kind === "local") return { allowed: !0 };
 	let n = e.pendingIds.map((e) => `    • ${e}`).join("\n");
 	return {
@@ -221,11 +222,11 @@ var Da = (e, t) => {
 			"  Choose one:",
 			"    • Point the app at a local database (DB_URL), which is what dev boot assumes.",
 			"    • Apply them deliberately, once:  voltro db files .",
-			`    • Accept it for this environment:  ${za}=1`
+			`    • Accept it for this environment:  ${Va}=1`
 		].join("\n")
 	};
-}, Ua = async ({ env: e = process.env } = {}) => {
-	let t = _t.make(P.mergeAll(aa.layer, U.Default)), n = await t.runPromise(ia), r = await t.runPromise(U), i = (e.CACHE_BACKEND ?? "memory").toLowerCase();
+}, Ga = async ({ env: e = process.env } = {}) => {
+	let t = _t.make(P.mergeAll(H.layer, ca.Default)), n = await t.runPromise(sa), r = await t.runPromise(ca), i = (e.CACHE_BACKEND ?? "memory").toLowerCase();
 	return await t.runPromise(r.addSink((e) => n.invalidateTag(e))), {
 		service: n,
 		invalidationBus: r,
@@ -257,7 +258,7 @@ var Da = (e, t) => {
 		stats: () => t.runSync(n.stats()),
 		dispose: () => t.dispose()
 	};
-}, Wa = ({ store: e, dialect: t, env: n = process.env }) => {
+}, Ka = ({ store: e, dialect: t, env: n = process.env }) => {
 	if (t !== "postgres") return { stop: () => {} };
 	or({
 		table: "_voltro_schedule_runs",
@@ -267,7 +268,7 @@ var Da = (e, t) => {
 		table: "_voltro_workflow_runs",
 		timeColumn: "completedAt",
 		ttlMs: ur(n.VOLTRO_WORKFLOW_RUNS_TTL_HOURS, 720),
-		where: ri(H("status", "succeeded"), H("status", "failed"), H("status", "cancelled"))
+		where: oi(V("status", "succeeded"), V("status", "failed"), V("status", "cancelled"))
 	}), or({
 		table: "_voltro_outbox_attempts",
 		timeColumn: "startedAt",
@@ -276,7 +277,7 @@ var Da = (e, t) => {
 		table: "_voltro_outbox",
 		timeColumn: "deliveredAt",
 		ttlMs: ur(n.VOLTRO_OUTBOX_TTL_HOURS, 720),
-		where: H("status", "delivered")
+		where: V("status", "delivered")
 	});
 	let r = e.raw?.bind(e), i = (e) => {
 		if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(e)) throw Error(`retention: unsafe identifier "${e}"`);
@@ -291,7 +292,7 @@ var Da = (e, t) => {
 			};
 			return (await r(e)).length;
 		}
-		let d = ni(l, a), f = s === void 0 ? d : Xr(d, s), p = await e.query({
+		let d = ai(l, a), f = s === void 0 ? d : $r(d, s), p = await e.query({
 			table: c,
 			order: [],
 			predicate: f,
@@ -312,14 +313,14 @@ var Da = (e, t) => {
 		o();
 	}, 5 * 6e4);
 	return s.unref?.(), { stop: () => clearInterval(s) };
-}, Ga = (e) => {
+}, qa = (e) => {
 	let t = jn({ store: e.store });
 	return {
-		storeForTenant: (t) => Dr(e.store, {
-			subject: ki(zt, t),
+		storeForTenant: (t) => Or(e.store, {
+			subject: Mi(zt, t),
 			schemaRegistry: e.schemaRegistry
 		}),
-		store: Dr(e.store, {
+		store: Or(e.store, {
 			subject: zt,
 			schemaRegistry: e.schemaRegistry
 		}),
@@ -333,11 +334,11 @@ var Da = (e, t) => {
 		cache: e.cache,
 		kv: e.kv
 	};
-}, Ka = (e) => {
+}, Ja = (e) => {
 	let { store: t, schemaRegistry: n, cache: r, kv: i, webhooksService: a, workflowsProxy: o, eventTriggers: s, namespaceIsolationOn: c, onEventEmit: l, outbox: u, connections: d } = e, f = (e, t) => {
 		if (!c) return e;
 		if (e.withNamespace === void 0) throw Error("tenantIsolation=namespace is set but the active store has no physical-namespace support (withNamespace).");
-		return e.withNamespace(oi(t.tenantId));
+		return e.withNamespace(li(t.tenantId));
 	};
 	return (e, c = t, p, m = "app-context", h) => {
 		let g = f(c, e.subject), _ = o === void 0 ? void 0 : Yn(o, {
@@ -371,14 +372,14 @@ var Da = (e, t) => {
 		}), re = jn({ store: g }), ie = e.rowFilter === void 0 ? {} : { rowFilter: e.rowFilter };
 		return {
 			storeForTenant: (t) => {
-				let r = ki(e.subject, t);
-				return Dr(f(c, r), {
+				let r = Mi(e.subject, t);
+				return Or(f(c, r), {
 					subject: r,
 					schemaRegistry: n,
 					...ie
 				});
 			},
-			store: Dr(g, {
+			store: Or(g, {
 				subject: e.subject,
 				schemaRegistry: n,
 				...e.rowFilter === void 0 ? {} : { rowFilter: e.rowFilter }
@@ -396,9 +397,9 @@ var Da = (e, t) => {
 			..._ === void 0 ? {} : { workflows: p ? Bn(_, p.afterCommit) : _ }
 		};
 	};
-}, qa = async (e, t, n) => {
-	if (t.type === "anonymous" || t.id == null) throw new fi({ reason: "workflow control requires an authenticated subject" });
-	let r = "id" in n ? H("id", n.id) : H("executionId", n.executionId), i = (await e.query({
+}, Ya = async (e, t, n) => {
+	if (t.type === "anonymous" || t.id == null) throw new hi({ reason: "workflow control requires an authenticated subject" });
+	let r = "id" in n ? V("id", n.id) : V("executionId", n.executionId), i = (await e.query({
 		table: "_voltro_workflow_runs",
 		order: [],
 		predicate: r,
@@ -406,9 +407,9 @@ var Da = (e, t) => {
 		skip: void 0,
 		take: 1
 	}))[0], a = i?.subject?.tenantId ?? null, o = t.tenantId ?? null;
-	if (i === void 0 || a !== o) throw new fi({ reason: "not authorized for this workflow run" });
-}, Ja = (e = {}) => wr.pipe(P.provide(br(e)), P.provide(ft.layer), P.provide(P.succeed(ft.RequestInit, { redirect: "manual" }))), Ya = (e) => {
-	let t = P.succeed(ia, e.cacheService), n = P.succeed(oa, e.kvService), r = [
+	if (i === void 0 || a !== o) throw new hi({ reason: "not authorized for this workflow run" });
+}, Xa = (e = {}) => wr.pipe(P.provide(br(e)), P.provide(ft.layer), P.provide(P.succeed(ft.RequestInit, { redirect: "manual" }))), Za = (e) => {
+	let t = P.succeed(sa, e.cacheService), n = P.succeed(la, e.kvService), r = [
 		e.analyticsLayer,
 		t,
 		n,
@@ -416,57 +417,101 @@ var Da = (e, t) => {
 		...e.userLayers
 	];
 	return P.mergeAll(...r);
-}, Xa = [
-	Ri,
+}, Qa = [
+	Vi,
+	Ui,
+	Hi,
 	Bi,
-	zi,
 	Li,
-	Pi,
-	Fi
-], Za = (e, t, n) => {
+	Ri
+], $a = (e, t, n) => {
 	let r = new Set(t);
-	if (n) for (let e of Xa) r.add(e.name);
+	if (n) for (let e of Qa) r.add(e.name);
 	let i = {};
 	for (let [t, n] of Object.entries(e)) i[t] = r.has(t) ? (e) => n(e).pipe(xt.take(1)) : n;
 	return i;
-}, Qa = F({ scope: "voltro:dev:supervisor" }), $a = /\.generated\./, eo = /\.([cm]?[jt]sx?|json)$/, to = (e) => {
+}, eo = "VOLTRO_TSX_IMPORT", to = /^--(?:import|loader|experimental-loader|require)(?:=|$)/, no = (e) => /(?:^|[/\\])tsx(?:$|[/\\])/.test(e), ro = (e) => e.some((t, n) => {
+	if (!to.test(t)) return !1;
+	let r = t.indexOf("=");
+	return no(r === -1 ? e[n + 1] ?? "" : t.slice(r + 1));
+}), io = () => {
+	try {
+		return import.meta.resolve("tsx");
+	} catch {
+		try {
+			return j(kr(import.meta.url).resolve("tsx")).href;
+		} catch {
+			return;
+		}
+	}
+}, ao = (e = {}) => {
+	let t = e.env ?? process.env, n = e.execArgv ?? process.execArgv;
+	if (ro(n)) return {
+		execArgv: [...n],
+		source: "inherited"
+	};
+	let r = t[eo];
+	if (r !== void 0 && r !== "") return {
+		execArgv: [
+			...n,
+			"--import",
+			r
+		],
+		source: "shim-env"
+	};
+	let i = (e.resolve ?? io)();
+	return i === void 0 ? {
+		execArgv: [
+			...n,
+			"--import",
+			"tsx"
+		],
+		source: "unresolved"
+	} : {
+		execArgv: [
+			...n,
+			"--import",
+			i
+		],
+		source: "resolved"
+	};
+}, oo = (e) => e.source === "unresolved" ? "could not resolve the tsx loader from @voltro/cli — falling back to a bare `--import tsx`, which Node resolves against the working directory. If the child dies with \"Cannot find package 'tsx'\", reinstall @voltro/cli with its optional dependencies (a `--no-optional` install omits tsx, which `voltro dev` needs to load your `.ts` sources)." : void 0, q = F({ scope: "voltro:dev:supervisor" }), so = /\.generated\./, co = /\.([cm]?[jt]sx?|json)$/, lo = (e) => {
 	let t = E(e);
-	return !$a.test(t) && eo.test(t);
-}, no = (e) => e.startsWith("node_modules") || e.startsWith(".framework") || e.startsWith(".turbo") || e.startsWith(".vite") || e.startsWith("dist") || e.startsWith(".git"), ro = process.env.WATCH_POLL === "1" || process.env.CHOKIDAR_USEPOLLING === "1", io = 1e3, ao = (e) => xt.async((t) => {
-	let n = A(e), r = (e) => k(n, e), i = da(n, {
+	return !so.test(t) && co.test(t);
+}, uo = (e) => e.startsWith("node_modules") || e.startsWith(".framework") || e.startsWith(".turbo") || e.startsWith(".vite") || e.startsWith("dist") || e.startsWith(".git"), J = process.env.WATCH_POLL === "1" || process.env.CHOKIDAR_USEPOLLING === "1", fo = 1e3, po = (e) => xt.async((t) => {
+	let n = A(e), r = (e) => k(n, e), i = ma(n, {
 		persistent: !0,
 		ignoreInitial: !0,
 		atomic: !0,
-		usePolling: ro,
-		interval: io,
-		binaryInterval: io,
+		usePolling: J,
+		interval: fo,
+		binaryInterval: fo,
 		ignored: (e) => {
 			let t = r(e);
-			return t === "" ? !1 : no(t) || $a.test(E(e));
+			return t === "" ? !1 : uo(t) || so.test(E(e));
 		}
 	});
 	return i.on("all", (e, n) => {
 		let i = r(n);
-		process.env.WATCH_DEBUG === "1" && Qa.trace("watcher fired", {
+		process.env.WATCH_DEBUG === "1" && q.trace("watcher fired", {
 			event: e,
 			file: i
-		}), !no(i) && to(i) && t.single({ file: i });
+		}), !uo(i) && lo(i) && t.single({ file: i });
 	}), i.on("error", (e) => {
-		Qa.error("watcher error", { hint: ro ? void 0 : "on a bind-mount (k8s hostPath / Docker volume) set WATCH_POLL=1" }, e);
+		q.error("watcher error", { hint: J ? void 0 : "on a bind-mount (k8s hostPath / Docker volume) set WATCH_POLL=1" }, e);
 	}), N.sync(() => {
 		i.close();
 	});
-}), oo = (e) => N.async((t) => {
+}), mo = (e) => N.async((t) => {
 	if (e.exitCode !== null) {
 		t(N.succeed(e.exitCode));
 		return;
 	}
 	e.once("exit", (e, n) => t(N.succeed(e ?? +!!n)));
-}), so = (e) => N.acquireUseRelease(N.sync(() => {
-	let t = process.argv[1] ?? "";
-	return ua(process.execPath, [
-		"--import",
-		"tsx",
+}), Y = (e) => N.acquireUseRelease(N.sync(() => {
+	let t = process.argv[1] ?? "", n = ao(), r = oo(n);
+	return r !== void 0 && q.warn(r), pa(process.execPath, [
+		...n.execArgv,
 		t,
 		"dev",
 		e
@@ -477,7 +522,7 @@ var Da = (e, t) => {
 			FRAMEWORK_DEV_INNER: "1"
 		}
 	});
-}), oo, (e) => N.async((t) => {
+}), mo, (e) => N.async((t) => {
 	if (e.exitCode !== null || e.killed) {
 		t(N.void);
 		return;
@@ -489,20 +534,20 @@ var Da = (e, t) => {
 	e.once("exit", () => {
 		clearTimeout(n), t(N.void);
 	});
-})), co = (e) => e.exitCode === 0 ? "stop" : e.keepAlive === "1" ? "wait-for-fix" : e.keepAlive === "0" ? "stop" : e.interactive ? "wait-for-fix" : "stop", lo = (e) => N.gen(function* () {
-	Qa.info("supervisor active — watching project root", {
+})), ho = (e) => e.exitCode === 0 ? "stop" : e.keepAlive === "1" ? "wait-for-fix" : e.keepAlive === "0" ? "stop" : e.interactive ? "wait-for-fix" : "stop", go = (e) => N.gen(function* () {
+	q.info("supervisor active — watching project root", {
 		root: e.root,
 		patterns: ["**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs,json} (excl. *.generated.*)"],
-		watcher: ro ? "chokidar (polling)" : "chokidar (native)",
+		watcher: J ? "chokidar (polling)" : "chokidar (native)",
 		hint: "WATCH=0 disables, WATCH_DEBUG=1 traces every event, WATCH_POLL=1 for bind-mounts (k8s/Docker)"
 	});
 	let t = yield* yt.make(vt.none()), n = yield* M.make(), r = N.gen(function* () {
-		let r = yield* N.fork(so(e.root).pipe(N.flatMap((e) => co({
+		let r = yield* N.fork(Y(e.root).pipe(N.flatMap((e) => ho({
 			exitCode: e,
 			interactive: process.stdout.isTTY === !0,
 			keepAlive: process.env.VOLTRO_DEV_KEEP_ALIVE
 		}) === "stop" ? M.succeed(n, e) : N.sync(() => {
-			Qa.error("dev server crashed — waiting for a file change", {
+			q.error("dev server crashed — waiting for a file change", {
 				exitCode: e,
 				hint: "fix the cause and save; Ctrl-C to stop. VOLTRO_DEV_KEEP_ALIVE=0 exits instead."
 			});
@@ -516,14 +561,14 @@ var Da = (e, t) => {
 		}), yield* yt.set(t, vt.none());
 	});
 	yield* r;
-	let a = ao(e.root).pipe(xt.debounce(ht.millis(80)), xt.runForEach((e) => N.gen(function* () {
+	let a = po(e.root).pipe(xt.debounce(ht.millis(80)), xt.runForEach((e) => N.gen(function* () {
 		let t = Date.now();
-		Qa.info("file changed — restarting", { file: e.file }), yield* i, yield* r, Qa.info("restart complete", { ms: Date.now() - t });
+		q.info("file changed — restarting", { file: e.file }), yield* i, yield* r, q.info("restart complete", { ms: Date.now() - t });
 	})), N.andThen(N.never), N.as(0)), o = yield* N.raceFirst(a, M.await(n));
-	o === 0 ? Qa.info("dev server exited — supervisor stopping") : Qa.error("dev server exited — supervisor stopping", { exitCode: o }), yield* N.sync(() => {
+	o === 0 ? q.info("dev server exited — supervisor stopping") : q.error("dev server exited — supervisor stopping", { exitCode: o }), yield* N.sync(() => {
 		process.exitCode = o;
 	});
-}), uo = /* @__PURE__ */ new Set(/* @__PURE__ */ "crypto.fs.path.os.net.http.https.http2.tls.dns.dgram.stream.zlib.child_process.worker_threads.cluster.readline.vm.module.perf_hooks.async_hooks.inspector.v8.process.tty.repl.constants.sys.string_decoder".split(".")), q = (e) => e.startsWith("node:") || uo.has(e) || e === "@voltro/workflow" ? !0 : e === "@voltro/database/wire" ? !1 : e === "@voltro/database" || e.startsWith("@voltro/database/") || e === "@voltro/runtime" || e.startsWith("@voltro/runtime/") ? !0 : e === "@voltro/ai/agent" || e === "@voltro/ai/events" ? !1 : !!(e === "@voltro/ai" || e.startsWith("@voltro/ai/") || [
+}), _o = /* @__PURE__ */ new Set(/* @__PURE__ */ "crypto.fs.path.os.net.http.https.http2.tls.dns.dgram.stream.zlib.child_process.worker_threads.cluster.readline.vm.module.perf_hooks.async_hooks.inspector.v8.process.tty.repl.constants.sys.string_decoder".split(".")), vo = (e) => e.startsWith("node:") || _o.has(e) || e === "@voltro/workflow" ? !0 : e === "@voltro/database/wire" ? !1 : e === "@voltro/database" || e.startsWith("@voltro/database/") || e === "@voltro/runtime" || e.startsWith("@voltro/runtime/") ? !0 : e === "@voltro/ai/agent" || e === "@voltro/ai/events" ? !1 : !!(e === "@voltro/ai" || e.startsWith("@voltro/ai/") || [
 	"@voltro/protocol/session",
 	"@voltro/protocol/jwt",
 	"@voltro/protocol/apikey"
@@ -542,8 +587,8 @@ var Da = (e, t) => {
 	"@prisma/client",
 	"nodemailer",
 	"jose"
-].includes(e)), fo = (e) => e.replace(/\/\*[\s\S]*?\*\//g, " ").replace(/(^|[^:])\/\/[^\n]*/g, "$1"), po = (e) => {
-	let t = fo(e), n = [], r = /(?:^|[\n;}])\s*(?:import|export)\s+([^;'"]*?)\s+from\s+['"]([^'"]+)['"]/g, i;
+].includes(e)), yo = (e) => e.replace(/\/\*[\s\S]*?\*\//g, " ").replace(/(^|[^:])\/\/[^\n]*/g, "$1"), bo = (e) => {
+	let t = yo(e), n = [], r = /(?:^|[\n;}])\s*(?:import|export)\s+([^;'"]*?)\s+from\s+['"]([^'"]+)['"]/g, i;
 	for (; (i = r.exec(t)) !== null;) {
 		let e = i[1].trim();
 		if (e === "type" || e.startsWith("type ")) continue;
@@ -559,8 +604,8 @@ var Da = (e, t) => {
 	let o = /\bimport\(\s*['"]([^'"]+)['"]\s*\)/g;
 	for (; (i = o.exec(t)) !== null;) n.push(i[1]);
 	return n;
-}, mo = (e) => e.endsWith(".ts") || e.endsWith(".tsx"), J = async (e) => {
-	let t = mo(e) ? [e] : [
+}, xo = (e) => e.endsWith(".ts") || e.endsWith(".tsx"), So = async (e) => {
+	let t = xo(e) ? [e] : [
 		`${e}.ts`,
 		`${e}.tsx`,
 		O(e, "index.ts"),
@@ -570,7 +615,7 @@ var Da = (e, t) => {
 		if ((await R.stat(e)).isFile()) return e;
 	} catch {}
 	return null;
-}, ho = async (e, t) => {
+}, Co = async (e, t) => {
 	let n = t;
 	for (;;) {
 		let t = O(n, "node_modules", e);
@@ -581,7 +626,7 @@ var Da = (e, t) => {
 		if (r === n) return null;
 		n = r;
 	}
-}, go = (e) => {
+}, wo = (e) => {
 	if (typeof e == "string") return e;
 	if (typeof e == "object" && e) {
 		let t = e;
@@ -591,23 +636,23 @@ var Da = (e, t) => {
 			"node",
 			"default"
 		]) if (e in t) {
-			let n = go(t[e]);
+			let n = wo(t[e]);
 			if (n !== void 0) return n;
 		}
 	}
-}, _o = async (e, t) => {
-	if (e.startsWith(".")) return J(A(D(t), e));
-	let n = e.split("/"), r = e.startsWith("@"), i = r ? `${n[0]}/${n[1]}` : n[0], a = r ? n.slice(2) : n.slice(1), o = a.length > 0 ? `./${a.join("/")}` : ".", s = await ho(i, D(t));
+}, To = async (e, t) => {
+	if (e.startsWith(".")) return So(A(D(t), e));
+	let n = e.split("/"), r = e.startsWith("@"), i = r ? `${n[0]}/${n[1]}` : n[0], a = r ? n.slice(2) : n.slice(1), o = a.length > 0 ? `./${a.join("/")}` : ".", s = await Co(i, D(t));
 	if (!s) return null;
 	try {
-		let e = JSON.parse(await R.readFile(O(s, "package.json"), "utf8")), t = go(e.exports?.[o]) ?? (o === "." ? e.module ?? e.main : void 0);
-		if (typeof t == "string") return J(A(s, t));
+		let e = JSON.parse(await R.readFile(O(s, "package.json"), "utf8")), t = wo(e.exports?.[o]) ?? (o === "." ? e.module ?? e.main : void 0);
+		if (typeof t == "string") return So(A(s, t));
 	} catch {}
 	return null;
-}, vo = (e, t) => e.startsWith(t) ? e.slice(t.length).replace(/^[/\\]/, "") : e, yo = async (e, t) => {
+}, Eo = (e, t) => e.startsWith(t) ? e.slice(t.length).replace(/^[/\\]/, "") : e, Do = async (e, t) => {
 	let n = /* @__PURE__ */ new Set(), r = [{
 		file: e,
-		chain: [vo(e, t)]
+		chain: [Eo(e, t)]
 	}];
 	for (; r.length > 0;) {
 		let { file: e, chain: i } = r.shift();
@@ -619,37 +664,37 @@ var Da = (e, t) => {
 		} catch {
 			continue;
 		}
-		for (let o of po(a)) {
-			if (q(o)) return {
+		for (let o of bo(a)) {
+			if (vo(o)) return {
 				specifier: o,
 				chain: [...i, o]
 			};
-			let a = await _o(o, e);
+			let a = await To(o, e);
 			a && !n.has(a) && r.push({
 				file: a,
-				chain: [...i, `${o}  (${vo(a, t)})`]
+				chain: [...i, `${o}  (${Eo(a, t)})`]
 			});
 		}
 	}
 	return null;
-}, bo = /\.client\.tsx?$/, xo = async (e, t) => {
+}, Oo = /\.client\.tsx?$/, ko = async (e, t) => {
 	let n = [];
 	for (let r of t) {
-		if (!bo.test(r)) continue;
-		let t = await yo(r, e);
+		if (!Oo.test(r)) continue;
+		let t = await Do(r, e);
 		t !== null && n.push({
-			file: vo(r, e),
+			file: Eo(r, e),
 			violation: t
 		});
 	}
 	return n;
-}, So = (e) => `browser-safety violation — ${e.file} declares itself browser-safe (.client.ts) and is not.\n\n  '${e.violation.specifier}' is server-only (node:* / database / ai / cluster / protocol session / db driver).\n\n  import chain:\n      → ${e.violation.chain.join("\n      → ")}\n\n  The .client suffix is a claim the framework checks, not a hint. Either move the server-only\n  code behind a *.server.ts and keep this file pure, or drop the suffix — an unmarked file\n  makes no claim, and only the rpcGroup guard will judge it (later, and with a longer chain).`, Co = async (e) => {
+}, Ao = (e) => `browser-safety violation — ${e.file} declares itself browser-safe (.client.ts) and is not.\n\n  '${e.violation.specifier}' is server-only (node:* / database / ai / cluster / protocol session / db driver).\n\n  import chain:\n      → ${e.violation.chain.join("\n      → ")}\n\n  The .client suffix is a claim the framework checks, not a hint. Either move the server-only\n  code behind a *.server.ts and keep this file pure, or drop the suffix — an unmarked file\n  makes no claim, and only the rpcGroup guard will judge it (later, and with a longer chain).`, jo = async (e) => {
 	if (process.env.VOLTRO_BROWSER_SAFETY === "off") return;
-	let t = await yo(e, D(e));
+	let t = await Do(e, D(e));
 	if (!t) return;
 	let n = t.chain.join("\n      → ");
 	throw Error(`browser-safety violation — the generated rpcGroup pulls a SERVER-ONLY module into the client bundle.\n\n  '${t.specifier}' is server-only (node:* / database / ai / cluster / protocol session / db driver),\n  and the web client loads rpcGroup VALUE-LEVEL — this crashes the browser with\n  "Module …node:crypto… has been externalized for browser compatibility", or bloats the\n  bundle with the whole server graph.\n\n  import chain:\n      → ${n}\n\n  Fix: keep the descriptor (*.query/.mutation/.action.ts), the workflow descriptor\n  (*.workflow.tsx, import from @voltro/workflow/define), AND any plugin error schema\n  browser-safe. Move DB-backed / node: code behind a *.server.ts file or a browser-safe\n  subpath (e.g. a plugin's '/errors' export). Escape hatch (not recommended):\n  VOLTRO_BROWSER_SAFETY=off.`);
-}, wo = /\.(query|mutation|action|stream)\.ts$/, To = /\.(query|mutation|action|stream)\.server\.ts$/, Eo = /\.workflow\.tsx$/, Do = /(?<!\.server)\.agent\.tsx?$/, Oo = /\.connection\.tsx?$/, ko = /* @__PURE__ */ new Set([
+}, Mo = /\.(query|mutation|action|stream)\.ts$/, No = /\.(query|mutation|action|stream)\.server\.ts$/, Po = /\.workflow\.tsx$/, Fo = /(?<!\.server)\.agent\.tsx?$/, Io = /\.connection\.tsx?$/, Lo = /* @__PURE__ */ new Set([
 	"node_modules",
 	"dist",
 	"build",
@@ -657,37 +702,37 @@ var Da = (e, t) => {
 	".vite",
 	".next",
 	".git"
-]), Ao = async (e) => {
+]), Ro = async (e) => {
 	let t = async (e) => {
 		let n = await R.readdir(e, { withFileTypes: !0 }).catch(() => []);
-		for (let r of n) if (!ko.has(r.name)) {
+		for (let r of n) if (!Lo.has(r.name)) {
 			if (r.isDirectory()) {
 				if (await t(O(e, r.name))) return !0;
-			} else if (r.isFile() && Oo.test(r.name)) return !0;
+			} else if (r.isFile() && Io.test(r.name)) return !0;
 		}
 		return !1;
 	};
 	return t(e);
-}, jo = async (e) => {
+}, zo = async (e) => {
 	let t = [], n = async (e) => {
 		let r = await R.readdir(e, { withFileTypes: !0 });
 		for (let i of r) {
-			if (ko.has(i.name)) continue;
+			if (Lo.has(i.name)) continue;
 			let r = O(e, i.name);
-			i.isDirectory() ? await n(r) : i.isFile() && (wo.test(i.name) && !To.test(i.name) || Eo.test(i.name) || Do.test(i.name)) && t.push(r);
+			i.isDirectory() ? await n(r) : i.isFile() && (Mo.test(i.name) && !No.test(i.name) || Po.test(i.name) || Fo.test(i.name)) && t.push(r);
 		}
 	};
 	return await n(e), t;
-}, Mo = (e) => typeof e == "object" && !!e && "kind" in e && "name" in e && (e.kind === "query" || e.kind === "mutation" || e.kind === "action" || e.kind === "stream"), No = Symbol.for("@effect/workflow/Workflow"), Po = (e) => typeof e == "object" && !!e && No in e && "name" in e && typeof e.name == "string", Fo = async (e) => {
+}, Bo = (e) => typeof e == "object" && !!e && "kind" in e && "name" in e && (e.kind === "query" || e.kind === "mutation" || e.kind === "action" || e.kind === "stream"), Vo = Symbol.for("@effect/workflow/Workflow"), Ho = (e) => typeof e == "object" && !!e && Vo in e && "name" in e && typeof e.name == "string", Uo = async (e) => {
 	let t = [];
 	for (let n of e) {
 		let e = await import(j(n).href);
-		for (let [r, i] of Object.entries(e)) Mo(i) ? t.push({
+		for (let [r, i] of Object.entries(e)) Bo(i) ? t.push({
 			file: n,
 			exportName: r,
 			rpcTag: i.name,
 			kind: i.kind
-		}) : Po(i) && t.push({
+		}) : Ho(i) && t.push({
 			file: n,
 			exportName: r,
 			rpcTag: i.name,
@@ -695,23 +740,23 @@ var Da = (e, t) => {
 		});
 	}
 	return t;
-}, Io = async (e) => {
+}, Wo = async (e) => {
 	let t = [];
 	for (let n of e) {
-		if (!Do.test(n)) continue;
+		if (!Fo.test(n)) continue;
 		let e = await import(j(n).href);
-		for (let [r, i] of Object.entries(e)) pa(i) && t.push({
+		for (let [r, i] of Object.entries(e)) ga(i) && t.push({
 			file: n,
 			exportName: r,
 			name: i.name
 		});
 	}
 	return t;
-}, Y = (e) => {
+}, X = (e) => {
 	let t = (e, t) => e.split(/[^a-zA-Z0-9]+/).filter(Boolean).map((e, n) => (n === 0 && !t ? e.charAt(0).toLowerCase() : e.charAt(0).toUpperCase()) + e.slice(1)).join(""), n = e.split(".");
 	return `${t(n[0] ?? "rpc", !1)}${n.slice(1).map((e) => t(e, !0)).join("")}Rpc`;
-}, Lo = /^[A-Za-z][A-Za-z0-9]*([._-][A-Za-z0-9]+)*$/, Ro = (e, t) => {
-	let n = (e) => k(t, e.file).replace(/\\/g, "/"), r = e.filter((e) => !Lo.test(e.rpcTag));
+}, Go = /^[A-Za-z][A-Za-z0-9]*([._-][A-Za-z0-9]+)*$/, Ko = (e, t) => {
+	let n = (e) => k(t, e.file).replace(/\\/g, "/"), r = e.filter((e) => !Go.test(e.rpcTag));
 	if (r.length > 0) throw Error(`invalid rpc tag — a procedure/workflow \`name\` must start with a letter and
 use only letters, digits, and \`.\` \`-\` \`_\` separators (the tag becomes a JS
 identifier in the generated rpcGroup):
@@ -719,7 +764,7 @@ identifier in the generated rpcGroup):
 ${r.map((e) => `  • "${e.rpcTag}"  (${n(e)})`).join("\n")}\n`);
 	let i = /* @__PURE__ */ new Map();
 	for (let t of e) {
-		let e = Y(t.rpcTag), n = i.get(e);
+		let e = X(t.rpcTag), n = i.get(e);
 		n ? n.push(t) : i.set(e, [t]);
 	}
 	let a = [...i.values()].filter((e) => new Set(e.map((e) => e.rpcTag)).size > 1);
@@ -727,8 +772,8 @@ ${r.map((e) => `  • "${e.rpcTag}"  (${n(e)})`).join("\n")}\n`);
 generated identifier (separators are normalized away). Rename one so they
 differ by more than a \`.\`/\`-\`/\`_\`:
 
-${a.map((e) => `  ${Y(e[0].rpcTag)}:\n` + e.map((e) => `    - "${e.rpcTag}"  (${n(e)})`).join("\n")).join("\n\n")}\n`);
-}, zo = (e) => {
+${a.map((e) => `  ${X(e[0].rpcTag)}:\n` + e.map((e) => `    - "${e.rpcTag}"  (${n(e)})`).join("\n")).join("\n\n")}\n`);
+}, qo = (e) => {
 	switch (e) {
 		case "query": return 0;
 		case "mutation": return 1;
@@ -736,7 +781,7 @@ ${a.map((e) => `  ${Y(e[0].rpcTag)}:\n` + e.map((e) => `    - "${e.rpcTag}"  (${
 		case "stream": return 3;
 		case "workflow": return 4;
 	}
-}, Bo = (e, t) => {
+}, Jo = (e, t) => {
 	let n = /* @__PURE__ */ new Map();
 	for (let t of e) n.has(t.rpcTag) || n.set(t.rpcTag, t);
 	let r = [...n.keys()], i = (e) => k(t, n.get(e).file).replace(/\\/g, "/"), a = [];
@@ -751,7 +796,7 @@ can't be both a leaf and a namespace. Rename one side (e.g. give the
 workflow/procedure a nested name like "<prefix>.run"):
 
 ${a.join("\n\n")}\n`);
-}, Vo = (e, t, n, r = [], i = [], a = !1, o = !1, s = []) => {
+}, Yo = (e, t, n, r = [], i = [], a = !1, o = !1, s = []) => {
 	let c = i.length > 0, l = i.flatMap((e) => [{
 		file: e.file,
 		exportName: e.exportName,
@@ -768,20 +813,20 @@ ${a.join("\n\n")}\n`);
 		rpcTag: e.tag,
 		kind: e.kind
 	}));
-	Bo([
+	Jo([
 		...n,
 		...l,
 		...d
-	], e), Ro([
+	], e), Ko([
 		...n,
 		...l,
 		...d
 	], e);
-	let f = (e) => e.replace(/[^a-zA-Z0-9_$]/g, "_"), p = (e) => `__src_agent_${f(e.name)}`, m = (e) => `__agentRoutes_${f(e.name)}`, h = r.length > 0, g = r.map((e, t) => `import { ${e.name} as __pe${t} } from '${e.module}'`), _ = h ? ", __voltroPluginErrors" : "", ee = u.length > 0, te = u.map((e, t) => `import { ${e.name} as __prpc${t} } from '${e.module}'`), ne = (e) => e === "query" ? "queryToRpc" : e === "mutation" ? "mutationToRpc" : "actionToRpc", re = u.map((e, t) => `export const ${Y(e.tag)} = ${ne(e.kind)}(__prpc${t}${_})`), ie = u.map((e) => `  ${Y(e.tag)},`), ae = u.map((e, t) => `  ${JSON.stringify(e.tag)}: normalizeDescriptor(__prpc${t}),`), v = [...n].sort((e, t) => e.kind === t.kind ? e.rpcTag < t.rpcTag ? -1 : 1 : zo(e.kind) - zo(t.kind)), oe = D(t), y = (e) => `__src_${Y(e.rpcTag)}`, b = (e) => {
+	let f = (e) => e.replace(/[^a-zA-Z0-9_$]/g, "_"), p = (e) => `__src_agent_${f(e.name)}`, m = (e) => `__agentRoutes_${f(e.name)}`, h = r.length > 0, g = r.map((e, t) => `import { ${e.name} as __pe${t} } from '${e.module}'`), _ = h ? ", __voltroPluginErrors" : "", ee = u.length > 0, te = u.map((e, t) => `import { ${e.name} as __prpc${t} } from '${e.module}'`), ne = (e) => e === "query" ? "queryToRpc" : e === "mutation" ? "mutationToRpc" : "actionToRpc", re = u.map((e, t) => `export const ${X(e.tag)} = ${ne(e.kind)}(__prpc${t}${_})`), ie = u.map((e) => `  ${X(e.tag)},`), ae = u.map((e, t) => `  ${JSON.stringify(e.tag)}: normalizeDescriptor(__prpc${t}),`), v = [...n].sort((e, t) => e.kind === t.kind ? e.rpcTag < t.rpcTag ? -1 : 1 : qo(e.kind) - qo(t.kind)), oe = D(t), y = (e) => `__src_${X(e.rpcTag)}`, b = (e) => {
 		let t = `./${k(oe, e.file).replace(/\\/g, "/").replace(/\.tsx?$/, "")}`;
 		return `import { ${e.exportName} as ${y(e)} } from '${t}'`;
 	}, se = (e) => {
-		let t = Y(e.rpcTag), n = y(e);
+		let t = X(e.rpcTag), n = y(e);
 		return e.kind === "query" ? `export const ${t} = queryToRpc(${n}${_})` : e.kind === "mutation" ? `export const ${t} = mutationToRpc(${n}${_})` : e.kind === "action" ? `export const ${t} = actionToRpc(${n}${_})` : e.kind === "stream" ? `export const ${t} = streamToRpc(${n}${_})` : [
 			`export const ${t} = Rpc.make('${e.rpcTag}', {`,
 			`  payload: ${n}.payloadSchema,`,
@@ -810,8 +855,8 @@ ${a.join("\n\n")}\n`);
 		"__voltroConnectionSubmitToken",
 		"__voltroConnectionDisconnect"
 	] : [], fe = [
-		...v.map((e) => `  ${Y(e.rpcTag)},`),
-		...i.flatMap((e) => [`  ${Y(`${e.name}.send`)},`, `  ${Y(`${e.name}.messages`)},`]),
+		...v.map((e) => `  ${X(e.rpcTag)},`),
+		...i.flatMap((e) => [`  ${X(`${e.name}.send`)},`, `  ${X(`${e.name}.messages`)},`]),
 		...ue.map((e) => `  ${e},`),
 		...S.map((e) => `  ${e},`),
 		...de.map((e) => `  ${e},`),
@@ -858,7 +903,7 @@ ${a.join("\n\n")}\n`);
 	return [
 		"// THIS FILE IS GENERATED — DO NOT EDIT BY HAND.",
 		"// Re-emitted by `voltro dev` whenever query/mutation/action/stream/workflow files change.",
-		`// descriptor-fingerprint: ${qi("sha1").update(Se.map((e) => {
+		`// descriptor-fingerprint: ${Xi("sha1").update(Se.map((e) => {
 			let t = "";
 			try {
 				t = Tt(e.file, "utf8");
@@ -922,7 +967,7 @@ ${a.join("\n\n")}\n`);
 			""
 		] : [],
 		...v.map(se),
-		...i.flatMap((e) => [`export const ${Y(`${e.name}.send`)} = actionToRpc(${m(e)}.send${_})`, `export const ${Y(`${e.name}.messages`)} = queryToRpc(${m(e)}.messages${_})`]),
+		...i.flatMap((e) => [`export const ${X(`${e.name}.send`)} = actionToRpc(${m(e)}.send${_})`, `export const ${X(`${e.name}.messages`)} = queryToRpc(${m(e)}.messages${_})`]),
 		...x ? [
 			"export const __voltroWorkflowRun = queryToRpc(workflowRunQueryDescriptor)",
 			"export const __voltroWorkflowRuns = queryToRpc(workflowRunsQueryDescriptor)",
@@ -997,8 +1042,8 @@ ${a.join("\n\n")}\n`);
 			""
 		] : []
 	].join("\n");
-}, Ho = async (e) => {
-	let t = A(e.root), n = await jo(t), r = await Fo(n), i = await Io(n), a = await Ao(t);
+}, Xo = async (e) => {
+	let t = A(e.root), n = await zo(t), r = await Uo(n), i = await Wo(n), a = await Ro(t);
 	if (r.length === 0 && i.length === 0 && !a && (e.pluginRpcImports?.length ?? 0) === 0) return;
 	let o = ((e) => {
 		if (e.length === 0) return t;
@@ -1017,7 +1062,7 @@ ${a.join("\n\n")}\n`);
 		"workflows"
 	]), c = (e) => e.slice(e.lastIndexOf("/") + 1), l = o;
 	for (; l !== t && s.has(c(l));) l = l.slice(0, l.lastIndexOf("/")) || "/";
-	let u = A(e.outputFile ?? O(l, "rpcGroup.generated.ts")), d = [...new Map((e.pluginErrorImports ?? []).map((e) => [`${e.module}#${e.name}`, e])).values()], f = [...new Map((e.pluginRpcImports ?? []).map((e) => [e.tag, e])).values()], p = Vo(t, u, r, d, i, Tr(), a, f), m = [];
+	let u = A(e.outputFile ?? O(l, "rpcGroup.generated.ts")), d = [...new Map((e.pluginErrorImports ?? []).map((e) => [`${e.module}#${e.name}`, e])).values()], f = [...new Map((e.pluginRpcImports ?? []).map((e) => [e.tag, e])).values()], p = Yo(t, u, r, d, i, Tr(), a, f), m = [];
 	for (let t of e.pluginContributions ?? []) {
 		let e = null;
 		try {
@@ -1036,8 +1081,8 @@ ${a.join("\n\n")}\n`);
 	try {
 		g = await R.readFile(u, "utf8");
 	} catch {}
-	return g !== h && await R.writeFile(u, h, "utf8"), await Co(u), u;
-}, Uo = (e) => {
+	return g !== h && await R.writeFile(u, h, "utf8"), await jo(u), u;
+}, Zo = (e) => {
 	let t = [];
 	for (let n of e) for (let e of n) {
 		let n = e.descriptor?.tag;
@@ -1049,13 +1094,13 @@ ${a.join("\n\n")}\n`);
 		} : { tag: n });
 	}
 	return t;
-}, Wo = (e, t) => {
-	let n = wi(e);
-	return n.length === 0 ? 0 : (t(hi(n)), n.length);
-}, Go = async (e) => {
+}, Qo = (e, t) => {
+	let n = Di(e);
+	return n.length === 0 ? 0 : (t(vi(n)), n.length);
+}, $o = async (e) => {
 	let t = e.spec ?? $n, n;
 	return t.kind !== "noop" && e.sqlLayer !== void 0 ? n = await N.runPromise(N.gen(function* () {
-		let n = yield* V.SqlClient, r = t.build(n);
+		let n = yield* Mr.SqlClient, r = t.build(n);
 		return t.initialize && (yield* t.initialize(r).pipe(N.catchAll((t) => N.sync(() => e.log.warn("analytics sink initialize failed", {
 			provider: r.info.provider,
 			err: String(t)
@@ -1073,14 +1118,14 @@ ${a.join("\n\n")}\n`);
 			t.dispose && await N.runPromise(t.dispose(n).pipe(N.timeout("1200 millis"), N.ignore));
 		}
 	};
-}, Ko = "@effect/cluster@0.59.0", X = "@effect__cluster@0.59.0.patch", qo = `patches/${X}`, Jo = D(dt(import.meta.url)), Yo = [A(Jo, "..", "templates", "patches", X), A(Jo, "..", "..", "templates", "patches", X)], Xo = async () => {
-	for (let e of Yo) if (L(e)) return R.readFile(e, "utf8");
-	throw Error(`@effect/cluster patch asset not found (looked in: ${Yo.join(", ")}). This is a packaging bug — the CLI should ship it under templates/patches/.`);
-}, Zo = (e) => RegExp(`['"]?${Ko.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}['"]?\\s*:`).test(e), Qo = (e) => {
-	if (Zo(e)) return null;
-	let t = `  '${Ko}': ${qo}`, n = /^patchedDependencies:[ \t]*\n/m;
+}, es = "@effect/cluster@0.59.0", ts = "@effect__cluster@0.59.0.patch", ns = `patches/${ts}`, Z = D(dt(import.meta.url)), rs = [A(Z, "..", "templates", "patches", ts), A(Z, "..", "..", "templates", "patches", ts)], is = async () => {
+	for (let e of rs) if (L(e)) return R.readFile(e, "utf8");
+	throw Error(`@effect/cluster patch asset not found (looked in: ${rs.join(", ")}). This is a packaging bug — the CLI should ship it under templates/patches/.`);
+}, as = (e) => RegExp(`['"]?${es.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}['"]?\\s*:`).test(e), os = (e) => {
+	if (as(e)) return null;
+	let t = `  '${es}': ${ns}`, n = /^patchedDependencies:[ \t]*\n/m;
 	return n.test(e) ? e.replace(n, (e) => `${e}${t}\n`) : `${e}${e.endsWith("\n") ? "" : "\n"}\npatchedDependencies:\n${t}\n`;
-}, $o = (e) => {
+}, ss = (e) => {
 	let t = A(e);
 	for (let e = 0; e < 12; e++) {
 		if (L(O(t, "pnpm-workspace.yaml"))) return t;
@@ -1089,28 +1134,28 @@ ${a.join("\n\n")}\n`);
 		t = e;
 	}
 	return null;
-}, es = async (e) => {
-	let t = $o(e);
+}, cs = async (e) => {
+	let t = ss(e);
 	if (!t) return null;
-	let n = await ts(t);
-	return n.fullyWired ? null : `mssql + durable cluster workflows need the @effect/cluster patch, which a plain install cannot carry. Run \`voltro add mssql\` then \`pnpm install\` to wire it (missing: ${[n.patchFilePresent ? null : qo, n.pnpmEntryPresent ? null : "patchedDependencies in pnpm-workspace.yaml"].filter(Boolean).join(" + ")}). Without it, workflow message/runner storage misbehaves on SQL Server.`;
-}, ts = async (e) => {
-	let t = L(O(e, qo)), n = O(e, "pnpm-workspace.yaml"), r = L(n) && Zo(await R.readFile(n, "utf8"));
+	let n = await ls(t);
+	return n.fullyWired ? null : `mssql + durable cluster workflows need the @effect/cluster patch, which a plain install cannot carry. Run \`voltro add mssql\` then \`pnpm install\` to wire it (missing: ${[n.patchFilePresent ? null : ns, n.pnpmEntryPresent ? null : "patchedDependencies in pnpm-workspace.yaml"].filter(Boolean).join(" + ")}). Without it, workflow message/runner storage misbehaves on SQL Server.`;
+}, ls = async (e) => {
+	let t = L(O(e, ns)), n = O(e, "pnpm-workspace.yaml"), r = L(n) && as(await R.readFile(n, "utf8"));
 	return {
 		patchFilePresent: t,
 		pnpmEntryPresent: r,
 		fullyWired: t && r
 	};
-}, ns = async (e) => {
-	let t = [], n = O(e, qo), r = await Xo();
-	(L(n) ? await R.readFile(n, "utf8") : null) !== r && (await R.mkdir(D(n), { recursive: !0 }), await R.writeFile(n, r, "utf8"), t.push(`patch file → ${qo}`));
+}, us = async (e) => {
+	let t = [], n = O(e, ns), r = await is();
+	(L(n) ? await R.readFile(n, "utf8") : null) !== r && (await R.mkdir(D(n), { recursive: !0 }), await R.writeFile(n, r, "utf8"), t.push(`patch file → ${ns}`));
 	let i = O(e, "pnpm-workspace.yaml");
 	if (L(i)) {
-		let e = Qo(await R.readFile(i, "utf8"));
-		e !== null && (await R.writeFile(i, e, "utf8"), t.push(`patchedDependencies['${Ko}'] → pnpm-workspace.yaml`));
+		let e = os(await R.readFile(i, "utf8"));
+		e !== null && (await R.writeFile(i, e, "utf8"), t.push(`patchedDependencies['${es}'] → pnpm-workspace.yaml`));
 	}
 	return t;
-}, rs = (e) => e.replace(/\.subscribe\.tsx?$/, ""), is = async (e, t) => {
+}, ds = (e) => e.replace(/\.subscribe\.tsx?$/, ""), fs = async (e, t) => {
 	let n = [];
 	for (let r of e) {
 		let e;
@@ -1136,14 +1181,14 @@ ${a.join("\n\n")}\n`);
 		}
 		n.push({
 			file: r,
-			id: rs(E(r)),
+			id: ds(E(r)),
 			definition: a
 		});
 	}
 	return n;
-}, as = (e, t, n, r) => {
+}, ps = (e, t, n, r) => {
 	if (e.length === 0) return () => {};
-	let i = Dr(t, {
+	let i = Or(t, {
 		subject: zt,
 		schemaRegistry: r
 	}), a = [];
@@ -1161,7 +1206,7 @@ ${a.join("\n\n")}\n`);
 					e.warn("subscriber: handler rejected", {
 						table: o,
 						op: t.op
-					}, n), Ei({
+					}, n), ki({
 						error: n,
 						source: "subscriber",
 						name: o,
@@ -1175,7 +1220,7 @@ ${a.join("\n\n")}\n`);
 				e.warn("subscriber: handler threw synchronously", {
 					table: o,
 					op: t.op
-				}, n), Ei({
+				}, n), ki({
 					error: n,
 					source: "subscriber",
 					name: o,
@@ -1196,7 +1241,7 @@ ${a.join("\n\n")}\n`);
 			e();
 		} catch {}
 	};
-}, os = (e) => e.replace(/\.outbox\.tsx?$/, ""), ss = async (e, t) => {
+}, ms = (e) => e.replace(/\.outbox\.tsx?$/, ""), hs = async (e, t) => {
 	let n = [], r = /* @__PURE__ */ new Map();
 	for (let i of e) {
 		let e;
@@ -1231,12 +1276,12 @@ ${a.join("\n\n")}\n`);
 		}
 		r.set(o.effect, i), n.push({
 			file: i,
-			id: os(E(i)),
+			id: ms(E(i)),
 			definition: o
 		});
 	}
 	return n;
-}, cs = (e) => {
+}, gs = (e) => {
 	let { handlers: t, store: n, log: r } = e, i = new Map(t.map((e) => [e.definition.effect, e.definition])), a = !1, o = !1, s = !1, c = async () => {
 		if (a) {
 			o = !0;
@@ -1270,16 +1315,16 @@ ${a.join("\n\n")}\n`);
 		},
 		drainOnce: c
 	};
-}, ls = "<builtin:connections>", us = {
+}, _s = "<builtin:connections>", Q = {
 	registry: Dn([]),
 	queries: [],
 	mutations: [],
 	actions: [],
 	httpRoutes: [],
 	active: !1
-}, ds = (e) => {
+}, vs = (e) => {
 	let { definitions: t, store: n, publicUrl: r, log: i } = e;
-	if (t.length === 0) return us;
+	if (t.length === 0) return Q;
 	Wt(t);
 	let a = Dn(t), o = {
 		registry: a,
@@ -1303,7 +1348,7 @@ ${a.join("\n\n")}\n`);
 			if (l !== null) return i.info("connection consent declined", {
 				connectionId: t[1],
 				error: l
-			}), fs(`/?connection=${encodeURIComponent(t[1] ?? "")}&error=${encodeURIComponent(l)}`);
+			}), ys(`/?connection=${encodeURIComponent(t[1] ?? "")}&error=${encodeURIComponent(l)}`);
 			if (s === "" || c === "") return {
 				status: 400,
 				body: "missing code or state",
@@ -1317,13 +1362,13 @@ ${a.join("\n\n")}\n`);
 					code: c,
 					publicUrl: r
 				});
-				return i.info("connection established", { connectionId: e.connectionId }), fs(e.redirectTo);
+				return i.info("connection established", { connectionId: e.connectionId }), ys(e.redirectTo);
 			} catch (e) {
 				let n = e instanceof Error ? e.message : String(e);
 				return i.warn("connection callback failed", {
 					connectionId: t[1],
 					reason: n
-				}), fs(`/?connection=${encodeURIComponent(t[1] ?? "")}&error=handshake_failed`);
+				}), ys(`/?connection=${encodeURIComponent(t[1] ?? "")}&error=handshake_failed`);
 			}
 		}
 	}] : [];
@@ -1331,40 +1376,40 @@ ${a.join("\n\n")}\n`);
 		connections: t.map((e) => `${e.id} (${e.kind})`),
 		callback: d ? "/_voltro/connections/<id>/callback" : "(no oauth2 connection declared)",
 		routes: [
-			Ci.name,
-			xi.name,
-			Si.name,
-			bi.name
+			Ei.name,
+			wi.name,
+			Ti.name,
+			Ci.name
 		]
 	}), {
 		registry: a,
 		queries: [{
-			file: ls,
-			descriptor: Ci,
+			file: _s,
+			descriptor: Ei,
 			executor: (e, t) => s(e, t)
 		}],
 		mutations: [{
-			file: ls,
-			descriptor: Si,
+			file: _s,
+			descriptor: Ti,
 			executor: (e, t) => l(e, t)
 		}, {
-			file: ls,
-			descriptor: bi,
+			file: _s,
+			descriptor: Ci,
 			executor: (e, t) => u(e, t)
 		}],
 		actions: [{
-			file: ls,
-			descriptor: xi,
+			file: _s,
+			descriptor: wi,
 			executor: (e, t) => c(e, t)
 		}],
 		httpRoutes: f,
 		active: !0
 	};
-}, fs = (e) => ({
+}, ys = (e) => ({
 	status: 302,
 	headers: { location: pr(e.startsWith("/") ? e : `/${e}`) },
 	body: ""
-}), ps = (e) => process.env.VOLTRO_PUBLIC_URL?.replace(/\/+$/, "") ?? `http://localhost:${e}`, ms = (e) => e.replace(/\.reaction\.tsx?$/, ""), hs = async (e, t) => {
+}), bs = (e) => process.env.VOLTRO_PUBLIC_URL?.replace(/\/+$/, "") ?? `http://localhost:${e}`, xs = (e) => e.replace(/\.reaction\.tsx?$/, ""), Ss = async (e, t) => {
 	let n = [];
 	for (let r of e) {
 		let e;
@@ -1398,12 +1443,12 @@ ${a.join("\n\n")}\n`);
 		}
 		n.push({
 			file: r,
-			id: ms(E(r)),
+			id: xs(E(r)),
 			definition: a
 		});
 	}
 	return n;
-}, gs = async (e, t, n) => {
+}, Cs = async (e, t, n) => {
 	let r = n.findAgentSend(e);
 	if (r === void 0) {
 		n.log.warn("reaction agent act — no synthesized agent found (declare a `*.agent.tsx` named this)", { agent: e });
@@ -1418,7 +1463,7 @@ ${a.join("\n\n")}\n`);
 		subject: n.makeSubject(a),
 		traceId: `reaction:${e}`
 	});
-}, _s = (e, t, n, r) => {
+}, ws = (e, t, n, r) => {
 	if (e.length === 0) return () => {};
 	let i = /* @__PURE__ */ new Set(), a = {
 		has: (e) => i.has(e),
@@ -1455,7 +1500,7 @@ ${a.join("\n\n")}\n`);
 			r.warn("reaction: dispatch failed", {
 				table: e.table,
 				op: e.op
-			}, t), Ei({
+			}, t), ki({
 				error: t,
 				source: "reaction",
 				name: n.name,
@@ -1468,7 +1513,7 @@ ${a.join("\n\n")}\n`);
 			l();
 		} catch {}
 	};
-}, Z = "_voltro_aggregate_meta", vs = "_voltro_aggregate_rows", ys = () => {
+}, Ts = "_voltro_aggregate_meta", Es = "_voltro_aggregate_rows", Ds = () => {
 	let e = /* @__PURE__ */ new Map(), t = {
 		refreshedAt: null,
 		rowCount: 0,
@@ -1513,8 +1558,8 @@ ${a.join("\n\n")}\n`);
 		},
 		refreshMirror: async () => {}
 	};
-}, bs = `
-  CREATE TABLE IF NOT EXISTS ${Z} (
+}, Os = `
+  CREATE TABLE IF NOT EXISTS ${Ts} (
     name TEXT PRIMARY KEY,
     generation INTEGER NOT NULL DEFAULT 0,
     refreshed_at TEXT,
@@ -1523,24 +1568,24 @@ ${a.join("\n\n")}\n`);
     last_error TEXT,
     next_refresh_at TEXT
   );
-`.trim(), xs = `
-  CREATE TABLE IF NOT EXISTS ${vs} (
+`.trim(), ks = `
+  CREATE TABLE IF NOT EXISTS ${Es} (
     aggregate_name TEXT NOT NULL,
     generation INTEGER NOT NULL,
     row_index INTEGER NOT NULL,
     row_data TEXT NOT NULL,
     PRIMARY KEY (aggregate_name, generation, row_index)
   );
-`.trim(), Ss = `
-  CREATE INDEX IF NOT EXISTS ${vs}_lookup
-    ON ${vs} (aggregate_name, generation, row_index);
-`.trim(), Q = (e) => ({
+`.trim(), As = `
+  CREATE INDEX IF NOT EXISTS ${Es}_lookup
+    ON ${Es} (aggregate_name, generation, row_index);
+`.trim(), js = (e) => ({
 	refreshedAt: e.refreshed_at === null ? null : new Date(e.refreshed_at),
 	rowCount: e.row_count,
 	durationMs: e.duration_ms,
 	lastError: e.last_error,
 	nextRefreshAt: e.next_refresh_at === null ? null : new Date(e.next_refresh_at)
-}), Cs = (e) => {
+}), Ms = (e) => {
 	let t = /* @__PURE__ */ new Map(), n = {
 		refreshedAt: null,
 		rowCount: 0,
@@ -1548,14 +1593,14 @@ ${a.join("\n\n")}\n`);
 		lastError: null,
 		nextRefreshAt: null
 	}, r = (t) => N.runPromise(t.pipe(N.provide(e))), i = () => N.gen(function* () {
-		let e = yield* V.SqlClient;
-		yield* e.unsafe(bs).pipe(N.orDie), yield* e.unsafe(xs).pipe(N.orDie), yield* e.unsafe(Ss).pipe(N.orDie);
+		let e = yield* Mr.SqlClient;
+		yield* e.unsafe(Os).pipe(N.orDie), yield* e.unsafe(ks).pipe(N.orDie), yield* e.unsafe(As).pipe(N.orDie);
 	}), a = () => N.gen(function* () {
-		let e = yield* V.SqlClient, n = yield* e`SELECT * FROM ${e(Z)}`.pipe(N.orElseSucceed(() => []));
+		let e = yield* Mr.SqlClient, n = yield* e`SELECT * FROM ${e(Ts)}`.pipe(N.orElseSucceed(() => []));
 		for (let r of n) {
 			let n = yield* e`
           SELECT ${e("row_index")} AS row_index, ${e("row_data")} AS row_data
-          FROM ${e(vs)}
+          FROM ${e(Es)}
           WHERE ${e("aggregate_name")} = ${r.name}
             AND ${e("generation")} = ${r.generation}
           ORDER BY ${e("row_index")} ASC
@@ -1565,17 +1610,17 @@ ${a.join("\n\n")}\n`);
 			} catch {}
 			t.set(r.name, {
 				rows: i,
-				meta: Q(r)
+				meta: js(r)
 			});
 		}
 	}), o = (e, t) => N.gen(function* () {
-		let n = yield* V.SqlClient, r = (yield* n`
+		let n = yield* Mr.SqlClient, r = (yield* n`
         SELECT ${n("generation")} AS generation
-        FROM ${n(Z)}
+        FROM ${n(Ts)}
         WHERE ${n("name")} = ${e}
       `.pipe(N.orElseSucceed(() => [])))[0]?.generation ?? 0, i = r + 1;
 		yield* n`
-        UPDATE ${n(Z)} SET
+        UPDATE ${n(Ts)} SET
           ${n("generation")} = ${i},
           ${n("refreshed_at")} = ${t.meta.refreshedAt ? t.meta.refreshedAt.toISOString() : null},
           ${n("duration_ms")} = ${t.meta.durationMs},
@@ -1584,7 +1629,7 @@ ${a.join("\n\n")}\n`);
           ${n("next_refresh_at")} = ${t.meta.nextRefreshAt ? t.meta.nextRefreshAt.toISOString() : null}
         WHERE ${n("name")} = ${e}
       `.pipe(N.orDie), r === 0 && (yield* n`
-          INSERT INTO ${n(Z)}
+          INSERT INTO ${n(Ts)}
             (${n("name")}, ${n("generation")}, ${n("refreshed_at")},
              ${n("duration_ms")}, ${n("row_count")}, ${n("last_error")}, ${n("next_refresh_at")})
           VALUES
@@ -1595,21 +1640,21 @@ ${a.join("\n\n")}\n`);
 		for (let r = 0; r < t.rows.length; r++) {
 			let a = JSON.stringify(t.rows[r]);
 			yield* n`
-          INSERT INTO ${n(vs)}
+          INSERT INTO ${n(Es)}
             (${n("aggregate_name")}, ${n("generation")}, ${n("row_index")}, ${n("row_data")})
           VALUES
             (${e}, ${i}, ${r}, ${a})
         `.pipe(N.orDie);
 		}
 		r > 0 && (yield* n`
-          DELETE FROM ${n(vs)}
+          DELETE FROM ${n(Es)}
           WHERE ${n("aggregate_name")} = ${e}
             AND ${n("generation")} < ${i}
         `.pipe(N.orDie));
 	}), s = (e, t) => N.gen(function* () {
-		let n = yield* V.SqlClient;
+		let n = yield* Mr.SqlClient;
 		yield* n`
-        UPDATE ${n(Z)} SET
+        UPDATE ${n(Ts)} SET
           ${n("refreshed_at")} = ${t.refreshedAt ? t.refreshedAt.toISOString() : null},
           ${n("duration_ms")} = ${t.durationMs},
           ${n("row_count")} = ${t.rowCount},
@@ -1617,10 +1662,10 @@ ${a.join("\n\n")}\n`);
           ${n("next_refresh_at")} = ${t.nextRefreshAt ? t.nextRefreshAt.toISOString() : null}
         WHERE ${n("name")} = ${e}
       `.pipe(N.orDie), (yield* n`
-        SELECT ${n("name")} FROM ${n(Z)}
+        SELECT ${n("name")} FROM ${n(Ts)}
         WHERE ${n("name")} = ${e}
       `.pipe(N.orElseSucceed(() => []))).length === 0 && (yield* n`
-          INSERT INTO ${n(Z)}
+          INSERT INTO ${n(Ts)}
             (${n("name")}, ${n("generation")}, ${n("refreshed_at")},
              ${n("duration_ms")}, ${n("row_count")}, ${n("last_error")}, ${n("next_refresh_at")})
           VALUES
@@ -1668,14 +1713,14 @@ ${a.join("\n\n")}\n`);
 		},
 		refreshMirror: async (e) => {
 			await r(N.gen(function* () {
-				let n = yield* V.SqlClient, r = (yield* n`
-          SELECT * FROM ${n(Z)}
+				let n = yield* Mr.SqlClient, r = (yield* n`
+          SELECT * FROM ${n(Ts)}
           WHERE ${n("name")} = ${e}
         `.pipe(N.orElseSucceed(() => [])))[0];
 				if (!r) return;
 				let i = yield* n`
           SELECT ${n("row_index")} AS row_index, ${n("row_data")} AS row_data
-          FROM ${n(vs)}
+          FROM ${n(Es)}
           WHERE ${n("aggregate_name")} = ${e}
             AND ${n("generation")} = ${r.generation}
           ORDER BY ${n("row_index")} ASC
@@ -1685,12 +1730,12 @@ ${a.join("\n\n")}\n`);
 				} catch {}
 				t.set(e, {
 					rows: a,
-					meta: Q(r)
+					meta: js(r)
 				});
 			}));
 		}
 	};
-}, ws = (e) => e.replace(/\.aggregate\.tsx?$/, ""), Ts = async (e, t) => {
+}, Ns = (e) => e.replace(/\.aggregate\.tsx?$/, ""), Ps = async (e, t) => {
 	let n = [], r = /* @__PURE__ */ new Set();
 	for (let i of e) {
 		let e;
@@ -1709,11 +1754,11 @@ ${a.join("\n\n")}\n`);
 		r.add(a.name), n.push({
 			file: i,
 			definition: a
-		}), ws(E(i));
+		}), Ns(E(i));
 	}
 	return n;
-}, Es = /^(\d+)(ms|s|m|h|d)$/, Ds = (e) => {
-	let t = Es.exec(e.trim());
+}, Fs = /^(\d+)(ms|s|m|h|d)$/, Is = (e) => {
+	let t = Fs.exec(e.trim());
 	if (!t) throw Error(`aggregate: invalid refresh interval '${e}' — expected '<n><ms|s|m|h|d>' (e.g. '5m', '1h', '500ms')`);
 	let n = Number(t[1]);
 	switch (t[2]) {
@@ -1724,7 +1769,7 @@ ${a.join("\n\n")}\n`);
 		case "d": return n * 864e5;
 	}
 	throw Error("unreachable");
-}, Os = (e, t) => {
+}, Ls = (e, t) => {
 	if (t === void 0) return e;
 	let n = Object.entries(t);
 	return n.length === 0 ? e : e.filter((e) => {
@@ -1737,23 +1782,23 @@ ${a.join("\n\n")}\n`);
 		}
 		return !0;
 	});
-}, ks = (e, t, n) => {
+}, Rs = (e, t, n) => {
 	if (t === void 0) return e;
 	let r = n === "desc" ? -1 : 1;
 	return [...e].sort((e, n) => {
 		let i = e[t], a = n[t];
 		return i === a ? 0 : i == null ? -1 * r : a == null ? 1 * r : i < a ? -1 * r : i > a ? 1 * r : 0;
 	});
-}, As = (e, t, n) => {
+}, zs = (e, t, n) => {
 	if (n === void 0 && t === void 0) return e;
 	let r = n ?? 0, i = t === void 0 ? e.length : r + t;
 	return e.slice(r, i);
-}, js = (e, t) => {
+}, Bs = (e, t) => {
 	let n = bt.decodeUnknownEither(e.output), r = [];
 	for (let e = 0; e < t.length; e++) {
 		let i = n(t[e]);
 		if (i._tag === "Left") {
-			let t = ma.formatErrorSync(i.left)[0], n = t?.path?.length ? t.path.join(".") : "<root>";
+			let t = _a.formatErrorSync(i.left)[0], n = t?.path?.length ? t.path.join(".") : "<root>";
 			return {
 				ok: !1,
 				reason: `row[${e}] failed output-schema decode at ${n}: ${t?.message ?? "unknown"}`
@@ -1765,7 +1810,7 @@ ${a.join("\n\n")}\n`);
 		ok: !0,
 		rows: r
 	};
-}, Ms = (e, t) => {
+}, Vs = (e, t) => {
 	let n = e.refresh;
 	if (n.cron) {
 		let e = n.timezone ?? "UTC", r = mt.unsafeParse(n.cron, e);
@@ -1776,7 +1821,7 @@ ${a.join("\n\n")}\n`);
 		};
 	}
 	if (n.interval) {
-		let e = Ds(n.interval);
+		let e = Is(n.interval);
 		return {
 			intervalMs: e,
 			nextAt: new Date(t.getTime() + e),
@@ -1792,7 +1837,7 @@ ${a.join("\n\n")}\n`);
 		nextAt: null,
 		kind: "none"
 	};
-}, Ns = async (e) => {
+}, Hs = async (e) => {
 	let { definition: t, store: n, analytics: r, storage: i, coordinator: a, log: o, refreshState: s, scheduledAt: c } = e;
 	if (s.inFlight) {
 		o.warn("aggregate: refresh overlap, skipping", { name: t.name });
@@ -1803,7 +1848,7 @@ ${a.join("\n\n")}\n`);
 	try {
 		if (!await a.tryClaim(t.name, c)) {
 			l.info("refresh skipped — coordination claim lost");
-			let { nextAt: e } = Ms(t, /* @__PURE__ */ new Date()), n = i.get(t.name);
+			let { nextAt: e } = Vs(t, /* @__PURE__ */ new Date()), n = i.get(t.name);
 			await i.updateMeta(t.name, {
 				...n.meta,
 				nextRefreshAt: e
@@ -1815,7 +1860,7 @@ ${a.join("\n\n")}\n`);
 			analytics: r,
 			log: l,
 			id: t.name
-		}), o = js(t, e instanceof Promise ? await e : await N.runPromise(e));
+		}), o = Bs(t, e instanceof Promise ? await e : await N.runPromise(e));
 		if (!o.ok) throw Error(`output schema mismatch: ${o.reason}`);
 		let s = o.rows;
 		if (t.strategy === "merge") {
@@ -1841,7 +1886,7 @@ ${a.join("\n\n")}\n`);
 				droppedCount: a
 			}), s = Array.from(r.values());
 		}
-		let d = Date.now() - u, { nextAt: f } = Ms(t, /* @__PURE__ */ new Date()), p = {
+		let d = Date.now() - u, { nextAt: f } = Vs(t, /* @__PURE__ */ new Date()), p = {
 			refreshedAt: /* @__PURE__ */ new Date(),
 			rowCount: s.length,
 			durationMs: d,
@@ -1858,12 +1903,12 @@ ${a.join("\n\n")}\n`);
 			durationMs: d
 		});
 	} catch (e) {
-		let n = e instanceof Error ? `${e.name}: ${e.message}` : String(e), r = i.get(t.name), { nextAt: a } = Ms(t, /* @__PURE__ */ new Date());
+		let n = e instanceof Error ? `${e.name}: ${e.message}` : String(e), r = i.get(t.name), { nextAt: a } = Vs(t, /* @__PURE__ */ new Date());
 		await i.updateMeta(t.name, {
 			...r.meta,
 			lastError: n,
 			nextRefreshAt: a
-		}), l.warn("refresh failed — last-good rows preserved", { err: n }), Ei({
+		}), l.warn("refresh failed — last-good rows preserved", { err: n }), ki({
 			error: e,
 			source: "aggregate",
 			name: t.name
@@ -1871,23 +1916,23 @@ ${a.join("\n\n")}\n`);
 	} finally {
 		s.inFlight = !1;
 	}
-}, Ps = (e) => {
+}, Us = (e) => {
 	let { definition: t, schedule: n } = e;
 	n.scheduleTimer !== null && clearTimeout(n.scheduleTimer);
-	let r = /* @__PURE__ */ new Date(), { intervalMs: i, nextAt: a, kind: o } = Ms(t, r);
+	let r = /* @__PURE__ */ new Date(), { intervalMs: i, nextAt: a, kind: o } = Vs(t, r);
 	if (o === "none" && !t.refresh.onChange) {
 		e.log.warn("aggregate: no refresh policy that auto-fires", { name: t.name });
 		return;
 	}
 	if (a === null) return;
 	let s = Math.max(0, a.getTime() - r.getTime()), c = setTimeout(async () => {
-		await Ns({
+		await Hs({
 			...e,
 			scheduledAt: a
-		}), Ps(e);
+		}), Us(e);
 	}, s);
 	c.unref(), n.scheduleTimer = c;
-}, Fs = (e) => {
+}, Ws = (e) => {
 	let { definition: t, store: n, schedule: r, log: i } = e, a = t.refresh.onChange;
 	if (!a || a.length === 0) return;
 	let o = t.refresh.debounceMs ?? 3e4, s = new Set(a);
@@ -1895,7 +1940,7 @@ ${a.join("\n\n")}\n`);
 		if (!s.has(t.table)) return;
 		r.debounceTimer !== null && clearTimeout(r.debounceTimer);
 		let n = setTimeout(async () => {
-			r.debounceTimer = null, await Ns({
+			r.debounceTimer = null, await Hs({
 				...e,
 				scheduledAt: /* @__PURE__ */ new Date()
 			});
@@ -1906,7 +1951,7 @@ ${a.join("\n\n")}\n`);
 		tables: a,
 		debounceMs: o
 	});
-}, Is = (e) => {
+}, Gs = (e) => {
 	let { definition: t, store: n, storage: r, log: i, schedule: a } = e, o = t.incremental;
 	if (o === void 0) return;
 	let s = i.child(`aggregate:${t.name}`), c = new At({
@@ -1921,7 +1966,7 @@ ${a.join("\n\n")}\n`);
 		skip: void 0,
 		projection: void 0
 	}), u = async () => {
-		let e = c.materialize().map((e) => o.toRow(e)), n = js(t, e);
+		let e = c.materialize().map((e) => o.toRow(e)), n = Bs(t, e);
 		if (!n.ok) {
 			s.warn("incremental: output schema mismatch — keeping last-good", { reason: n.reason });
 			return;
@@ -1965,12 +2010,12 @@ ${a.join("\n\n")}\n`);
 			op: o.op
 		});
 	})();
-	let p = t.refresh, m = p.interval === void 0 ? 5 * 6e4 : Ds(p.interval), h = setInterval(() => {
+	let p = t.refresh, m = p.interval === void 0 ? 5 * 6e4 : Is(p.interval), h = setInterval(() => {
 		d().catch(() => void 0);
 	}, m);
 	h.unref(), a.scheduleTimer = h;
-}, Ls = async (e) => {
-	let t = e.storage ?? ys(), n = e.coordinator ?? yr, r = e.analytics ?? B(), i = e.log;
+}, Ks = async (e) => {
+	let t = e.storage ?? Ds(), n = e.coordinator ?? yr, r = e.analytics ?? B(), i = e.log;
 	await t.initialize();
 	let a = /* @__PURE__ */ new Map(), o = /* @__PURE__ */ new Map(), s = /* @__PURE__ */ new Map(), c = {
 		refreshedAt: null,
@@ -1989,7 +2034,7 @@ ${a.join("\n\n")}\n`);
 			detachOnChange: null
 		};
 		a.set(u.name, f), u.incremental !== void 0 || (u.bootRefresh === "async" ? (await t.updateMeta(u.name, c), setImmediate(async () => {
-			await Ns({
+			await Hs({
 				definition: u,
 				store: e.store,
 				analytics: r,
@@ -2000,7 +2045,7 @@ ${a.join("\n\n")}\n`);
 				scheduledAt: /* @__PURE__ */ new Date()
 			});
 		})) : u.bootRefresh === "sync" ? l.push(async () => {
-			await Ns({
+			await Hs({
 				definition: u,
 				store: e.store,
 				analytics: r,
@@ -2011,7 +2056,7 @@ ${a.join("\n\n")}\n`);
 				scheduledAt: /* @__PURE__ */ new Date()
 			});
 		}) : await t.load(u.name) === null && setImmediate(async () => {
-			await Ns({
+			await Hs({
 				definition: u,
 				store: e.store,
 				analytics: r,
@@ -2021,7 +2066,7 @@ ${a.join("\n\n")}\n`);
 				refreshState: d,
 				scheduledAt: /* @__PURE__ */ new Date()
 			});
-		})), u.incremental === void 0 ? (Ps({
+		})), u.incremental === void 0 ? (Us({
 			definition: u,
 			store: e.store,
 			analytics: r,
@@ -2030,7 +2075,7 @@ ${a.join("\n\n")}\n`);
 			log: i,
 			schedule: f,
 			refreshState: d
-		}), Fs({
+		}), Ws({
 			definition: u,
 			store: e.store,
 			analytics: r,
@@ -2039,7 +2084,7 @@ ${a.join("\n\n")}\n`);
 			log: i,
 			schedule: f,
 			refreshState: d
-		})) : Is({
+		})) : Gs({
 			definition: u,
 			store: e.store,
 			storage: t,
@@ -2063,11 +2108,11 @@ ${a.join("\n\n")}\n`);
 								maxAgeMs: e.maxAgeMs
 							}));
 						}
-						return As(ks(Os(n.rows, e?.where), e?.orderBy, e?.direction), e?.limit, e?.offset);
+						return zs(Rs(Ls(n.rows, e?.where), e?.orderBy, e?.direction), e?.limit, e?.offset);
 					}),
 					meta: () => N.succeed(t.get(a.name).meta),
 					refresh: () => N.tryPromise({
-						try: () => Ns({
+						try: () => Hs({
 							definition: s.get(a.name),
 							store: e.store,
 							analytics: r,
@@ -2095,7 +2140,7 @@ ${a.join("\n\n")}\n`);
 			})),
 			refreshByName: async (a) => {
 				let c = s.get(a);
-				return c ? (await Ns({
+				return c ? (await Hs({
 					definition: c,
 					store: e.store,
 					analytics: r,
@@ -2117,7 +2162,7 @@ ${a.join("\n\n")}\n`);
 		},
 		registered: Array.from(s.keys())
 	};
-}, Rs = {
+}, qs = {
 	getHandle: (e) => ({
 		read: () => N.fail(new jt({ name: e.name })),
 		meta: () => N.succeed({
@@ -2131,52 +2176,52 @@ ${a.join("\n\n")}\n`);
 	}),
 	snapshot: () => [],
 	refreshByName: async () => !1
-}, zs = "/_voltro/inspect/aggregates", Bs = /^\/_voltro\/inspect\/aggregates\/([^/]+)\/refresh$/, Vs = (e, t, n) => ({
+}, Js = "/_voltro/inspect/aggregates", Ys = /^\/_voltro\/inspect\/aggregates\/([^/]+)\/refresh$/, Xs = (e, t, n) => ({
 	status: e,
 	contentType: "application/json; charset=utf-8",
 	body: JSON.stringify(t),
 	...n ? { headers: n } : {}
-}), Hs = (e) => ({
+}), Zs = (e) => ({
 	refreshedAt: e.refreshedAt === null ? null : e.refreshedAt.toISOString(),
 	rowCount: e.rowCount,
 	durationMs: e.durationMs,
 	lastError: e.lastError,
 	nextRefreshAt: e.nextRefreshAt === null ? null : e.nextRefreshAt.toISOString()
-}), Us = async (e, t, n, r) => {
-	if (!e.startsWith(zs)) return null;
+}), Qs = async (e, t, n, r) => {
+	if (!e.startsWith(Js)) return null;
 	if (t === "POST") {
-		let t = Bs.exec(e);
+		let t = Ys.exec(e);
 		if (t) {
 			let e = decodeURIComponent(t[1]);
-			if (!await n.refreshByName(e)) return Vs(404, {
+			if (!await n.refreshByName(e)) return Xs(404, {
 				error: "aggregate not found",
 				name: e
 			}, r);
 			let i = n.snapshot().find((t) => t.name === e);
-			return Vs(200, {
+			return Xs(200, {
 				ok: !0,
 				name: e,
-				meta: i ? Hs(i.meta) : null
+				meta: i ? Zs(i.meta) : null
 			}, r);
 		}
-		return Vs(405, {
+		return Xs(405, {
 			error: "method not allowed",
 			allow: "GET, POST <name>/refresh"
 		}, r);
 	}
-	return t === "GET" && (e === zs || e.startsWith(`${zs}?`)) ? Vs(200, {
+	return t === "GET" && (e === Js || e.startsWith(`${Js}?`)) ? Xs(200, {
 		aggregates: n.snapshot().map((e) => ({
 			name: e.name,
-			meta: Hs(e.meta)
+			meta: Zs(e.meta)
 		})),
 		capturedAt: (/* @__PURE__ */ new Date()).toISOString()
 	}, r) : null;
-}, Ws = "/_voltro/inspect/analytics", Gs = (e, t, n) => ({
+}, $s = "/_voltro/inspect/analytics", ec = (e, t, n) => ({
 	status: e,
 	contentType: "application/json; charset=utf-8",
 	body: JSON.stringify(t),
 	...n ? { headers: n } : {}
-}), Ks = (e, t) => {
+}), tc = (e, t) => {
 	let n = e.snapshot(t).buckets.filter((e) => e.kind === "plugin"), r = 0, i = 0, a = n.map((e) => (r += e.count, i += e.errorCount, {
 		tag: e.tag,
 		count: e.count,
@@ -2189,9 +2234,9 @@ ${a.join("\n\n")}\n`);
 		errorCount: i,
 		tags: a
 	};
-}, qs = (e, t, n, r) => {
-	if (e !== Ws && !e.startsWith(`${Ws}?`)) return null;
-	if (t !== "GET") return Gs(405, {
+}, nc = (e, t, n, r) => {
+	if (e !== $s && !e.startsWith(`${$s}?`)) return null;
+	if (t !== "GET") return ec(405, {
 		error: "method not allowed",
 		allow: "GET"
 	}, r);
@@ -2200,8 +2245,8 @@ ${a.join("\n\n")}\n`);
 		if (e === null) return 6e4;
 		let t = Number(e);
 		return Number.isFinite(t) && t > 0 ? Math.min(t, 1440 * 6e4) : 6e4;
-	})(), s = Ks(n.metricsCollector, o);
-	return Gs(200, {
+	})(), s = tc(n.metricsCollector, o);
+	return ec(200, {
 		provider: n.sink.info.provider,
 		capabilities: n.sink.info.capabilities,
 		detail: n.sink.info.detail ?? null,
@@ -2213,40 +2258,40 @@ ${a.join("\n\n")}\n`);
 		},
 		capturedAt: (/* @__PURE__ */ new Date()).toISOString()
 	}, r);
-}, Js = "/_voltro/inspect/timeline", Ys = "/_voltro/inspect/timeline/replay", Xs = (e, t, n) => ({
+}, rc = "/_voltro/inspect/timeline", ic = "/_voltro/inspect/timeline/replay", ac = (e, t, n) => ({
 	status: e,
 	contentType: "application/json; charset=utf-8",
 	body: JSON.stringify(t),
 	...n ? { headers: n } : {}
-}), Zs = (e) => {
+}), oc = (e) => {
 	let t = e.indexOf("?");
 	return new URLSearchParams(t >= 0 ? e.slice(t + 1) : "");
-}, Qs = (e, t) => {
+}, sc = (e, t) => {
 	let n = e.get(t);
 	if (n === null) return;
 	let r = Number(n);
 	return Number.isFinite(r) ? r : void 0;
-}, $s = async (e, t, n, r) => {
-	if (!e.startsWith(Js)) return null;
-	if (t !== "GET") return Xs(405, {
+}, cc = async (e, t, n, r) => {
+	if (!e.startsWith(rc)) return null;
+	if (t !== "GET") return ac(405, {
 		error: "method not allowed",
 		allow: "GET"
 	}, r);
-	let i = Zs(e);
-	if (e === Ys || e.startsWith(`${Ys}?`)) {
-		let e = i.get("table"), t = Qs(i, "seq");
-		if (e === null || t === void 0) return Xs(400, { error: "replay requires ?table=<name>&seq=<n>" }, r);
+	let i = oc(e);
+	if (e === ic || e.startsWith(`${ic}?`)) {
+		let e = i.get("table"), t = sc(i, "seq");
+		if (e === null || t === void 0) return ac(400, { error: "replay requires ?table=<name>&seq=<n>" }, r);
 		let a;
 		try {
 			a = await n.readCurrentRows(e);
 		} catch (t) {
-			return Xs(404, {
+			return ac(404, {
 				error: "unknown or unreadable table",
 				table: e,
 				reason: String(t?.message ?? t)
 			}, r);
 		}
-		return Xs(200, {
+		return ac(200, {
 			table: e,
 			asOfSeq: t,
 			currentSeq: n.recorder.currentSeq(),
@@ -2254,15 +2299,15 @@ ${a.join("\n\n")}\n`);
 			capturedAt: (/* @__PURE__ */ new Date()).toISOString()
 		}, r);
 	}
-	if (e === Js || e.startsWith(`${Js}?`)) {
-		let e = i.get("table"), t = i.get("tenantId"), a = Qs(i, "from"), o = Qs(i, "to"), s = Qs(i, "limit"), c = {
+	if (e === rc || e.startsWith(`${rc}?`)) {
+		let e = i.get("table"), t = i.get("tenantId"), a = sc(i, "from"), o = sc(i, "to"), s = sc(i, "limit"), c = {
 			...e === null ? {} : { table: e },
 			...t === null ? {} : { tenantId: t },
 			...a === void 0 ? {} : { from: a },
 			...o === void 0 ? {} : { to: o },
 			...s === void 0 ? {} : { limit: s }
 		};
-		return Xs(200, {
+		return ac(200, {
 			enabled: n.recorder.enabled,
 			currentSeq: n.recorder.currentSeq(),
 			events: n.recorder.snapshot(c),
@@ -2270,7 +2315,7 @@ ${a.join("\n\n")}\n`);
 		}, r);
 	}
 	return null;
-}, ec = /\.webhook\.tsx?$/, tc = async (e, t) => {
+}, lc = /\.webhook\.tsx?$/, uc = async (e, t) => {
 	let n = [], r = [], i = [];
 	for (let a of e) {
 		let e;
@@ -2280,7 +2325,7 @@ ${a.join("\n\n")}\n`);
 			t.warn("webhook: failed to import", { file: a }, e);
 			continue;
 		}
-		let o = (e.default && ya(e.default) ? e.default : void 0) ?? Object.values(e).find(ya);
+		let o = (e.default && Sa(e.default) ? e.default : void 0) ?? Object.values(e).find(Sa);
 		if (!o) {
 			t.warn("webhook: no descriptor default-exported", { file: a });
 			continue;
@@ -2311,7 +2356,7 @@ ${a.join("\n\n")}\n`);
 		incoming: r,
 		providers: i
 	};
-}, nc = /\.email\.tsx?$/, rc = async (e, t) => {
+}, dc = /\.email\.tsx?$/, fc = async (e, t) => {
 	let n = [];
 	for (let r of e) {
 		let e;
@@ -2321,7 +2366,7 @@ ${a.join("\n\n")}\n`);
 			t.warn("email: failed to import", { file: r }, e);
 			continue;
 		}
-		let i = Object.values(e).filter(xa);
+		let i = Object.values(e).filter(wa);
 		if (i.length === 0) {
 			t.warn("email: no defineEmail export found", { file: r });
 			continue;
@@ -2332,15 +2377,15 @@ ${a.join("\n\n")}\n`);
 		});
 	}
 	return { templates: n };
-}, ic = (e) => N.map(e, (e) => ({ text: e })), ac = (e) => {
-	let { descriptor: t, executor: n, file: r } = e, { send: i, messages: a } = fa(t);
+}, pc = (e) => N.map(e, (e) => ({ text: e })), mc = (e) => {
+	let { descriptor: t, executor: n, file: r } = e, { send: i, messages: a } = ha(t);
 	return [{
 		kind: "action",
 		file: r,
 		descriptor: i,
 		executor: (e, t) => {
 			let { threadId: r, order: i } = e, a = t.request?.subject?.tenantId ?? null;
-			return qr(n, t.store, {
+			return Xr(n, t.store, {
 				threadId: r,
 				input: e,
 				tenantId: a,
@@ -2349,36 +2394,36 @@ ${a.join("\n\n")}\n`);
 					store: t.store,
 					request: t.request
 				}
-			}).pipe(ic);
+			}).pipe(pc);
 		}
 	}, {
 		kind: "query",
 		file: r,
 		descriptor: a,
-		executor: (e, t) => Kr(t.store, e.threadId)
+		executor: (e, t) => Yr(t.store, e.threadId)
 	}];
-}, oc = "<builtin:undo>", sc = () => Tr() ? {
+}, hc = "<builtin:undo>", gc = () => Tr() ? {
 	queries: [{
-		file: oc,
-		descriptor: ji,
+		file: hc,
+		descriptor: Pi,
 		executor: (e, t) => Er(e, t)
 	}],
 	mutations: [{
-		file: oc,
-		descriptor: Ai,
+		file: hc,
+		descriptor: Ni,
 		executor: (e, t) => Ut(e, t)
 	}, {
-		file: oc,
-		descriptor: Mi,
+		file: hc,
+		descriptor: Fi,
 		executor: (e, t) => ar(e, t)
 	}]
 } : {
 	queries: [],
 	mutations: []
-}, cc = () => Tr() ? (e) => qn(e) : (e) => ({
+}, _c = () => Tr() ? (e) => qn(e) : (e) => ({
 	tx: e,
 	persist: async () => {}
-}), lc = {
+}), vc = {
 	interceptMutation: "rpc:intercept:mutation",
 	interceptQuery: "rpc:intercept:query",
 	interceptAction: "rpc:intercept:action",
@@ -2388,38 +2433,38 @@ ${a.join("\n\n")}\n`);
 	onChangeEvent: "store:changes:read",
 	inspectEndpoints: "inspect:read",
 	dashboard: "dashboard:mount"
-}, uc = {
+}, yc = {
 	tables: "store:write",
 	migrations: "migration:run"
-}, dc = (e) => {
+}, bc = (e) => {
 	let t = new Set(e.permissions ?? []), n = [];
-	for (let [r, i] of Object.entries(lc)) {
+	for (let [r, i] of Object.entries(vc)) {
 		let a = e[r];
 		a !== void 0 && (Array.isArray(a) && a.length === 0 || t.has(i) || n.push({
 			hook: r,
 			required: i
 		}));
 	}
-	return e.extendSchema !== void 0 && (e.extendSchema.tables && e.extendSchema.tables.length > 0 && (t.has(uc.tables) || n.push({
+	return e.extendSchema !== void 0 && (e.extendSchema.tables && e.extendSchema.tables.length > 0 && (t.has(yc.tables) || n.push({
 		hook: "extendSchema.tables",
-		required: uc.tables
-	})), e.extendSchema.migrations && e.extendSchema.migrations.length > 0 && (t.has(uc.migrations) || n.push({
+		required: yc.tables
+	})), e.extendSchema.migrations && e.extendSchema.migrations.length > 0 && (t.has(yc.migrations) || n.push({
 		hook: "extendSchema.migrations",
-		required: uc.migrations
+		required: yc.migrations
 	}))), {
 		pluginName: e.name,
 		missing: n
 	};
-}, fc = (e) => {
-	let t = e.map(dc);
+}, xc = (e) => {
+	let t = e.map(bc);
 	return {
 		ok: t.every((e) => e.missing.length === 0),
 		reports: t
 	};
-}, pc = (e) => {
+}, Sc = (e) => {
 	let t = e.reports.filter((e) => e.missing.length > 0);
 	return [`Plugin permission audit failed — ${t.length} plugin(s) ship hooks without the matching declared permission. Add the missing scopes to each plugin's manifest.permissions array:`, ...t.map((e) => `  • ${e.pluginName}:\n` + e.missing.map((e) => `      - ${e.hook} → needs '${e.required}'`).join("\n"))].join("\n");
-}, mc = 5e3, hc = 3e4, gc = async (e, t) => {
+}, Cc = 5e3, wc = 3e4, Tc = async (e, t) => {
 	let n, r = new Promise((e) => {
 		n = setTimeout(() => e({ kind: "timeout" }), t);
 	});
@@ -2434,7 +2479,7 @@ ${a.join("\n\n")}\n`);
 	} finally {
 		n && clearTimeout(n);
 	}
-}, _c = async (e) => {
+}, Ec = async (e) => {
 	if (e !== void 0) {
 		if (typeof e == "object" && e && N.isEffect(e)) {
 			await N.runPromise(e);
@@ -2442,8 +2487,8 @@ ${a.join("\n\n")}\n`);
 		}
 		await Promise.resolve(e);
 	}
-}, vc = /* @__PURE__ */ new Set(), yc = (e) => `${e.name}@${e.version ?? "*"}`, bc = (e) => {
-	let t = e.deactivateTimeoutMs ?? mc, n = e.deactivateTotalBudgetMs ?? hc, r = /* @__PURE__ */ new Set(), i = !1, a = /* @__PURE__ */ new Map();
+}, Dc = /* @__PURE__ */ new Set(), Oc = (e) => `${e.name}@${e.version ?? "*"}`, kc = (e) => {
+	let t = e.deactivateTimeoutMs ?? Cc, n = e.deactivateTotalBudgetMs ?? wc, r = /* @__PURE__ */ new Set(), i = !1, a = /* @__PURE__ */ new Map();
 	for (let t of e.plugins) {
 		if (!t.configSchema) {
 			a.set(t.name, e.pluginConfigs?.[t.name]);
@@ -2469,14 +2514,14 @@ ${a.join("\n\n")}\n`);
 	});
 	return {
 		async activate() {
-			let t = fc(e.plugins);
+			let t = xc(e.plugins);
 			if (!t.ok) {
-				let n = pc(t);
+				let n = Sc(t);
 				throw e.log.error(n), Error(n);
 			}
 			let n = (process.env.VOLTRO_STRICT_PLUGIN_COMPAT ?? "").toLowerCase(), i = n === "1" || n === "true";
 			for (let t of e.plugins) {
-				let n = _i(t.name, t.framework, e.voltroVersion);
+				let n = bi(t.name, t.framework, e.voltroVersion);
 				if (!n.ok) {
 					if (i) {
 						let r = `plugin "${t.name}" is incompatible with framework ${e.voltroVersion}: ${n.reason}. Pin a compatible plugin version, or unset VOLTRO_STRICT_PLUGIN_COMPAT to downgrade this to a warning.`;
@@ -2486,10 +2531,10 @@ ${a.join("\n\n")}\n`);
 				}
 			}
 			for (let t of e.plugins) {
-				let n = yc(t);
-				if (!vc.has(n) && typeof t.onInstall == "function") try {
+				let n = Oc(t);
+				if (!Dc.has(n) && typeof t.onInstall == "function") try {
 					let e = o(t);
-					await Promise.resolve().then(() => _c(t.onInstall(e))), vc.add(n);
+					await Promise.resolve().then(() => Ec(t.onInstall(e))), Dc.add(n);
 				} catch (n) {
 					throw e.log.error("plugin onInstall threw — aborting boot", {
 						plugin: t.name,
@@ -2503,7 +2548,7 @@ ${a.join("\n\n")}\n`);
 				}
 				try {
 					let e = o(t);
-					await Promise.resolve().then(() => _c(t.onActivate(e))), r.add(t.name);
+					await Promise.resolve().then(() => Ec(t.onActivate(e))), r.add(t.name);
 				} catch (n) {
 					throw e.log.error("plugin onActivate threw — aborting boot", {
 						plugin: t.name,
@@ -2526,7 +2571,7 @@ ${a.join("\n\n")}\n`);
 					});
 					break;
 				}
-				let c = o(i), l = i.onDeactivate, u = await gc(Promise.resolve().then(() => _c(l(c))), t);
+				let c = o(i), l = i.onDeactivate, u = await Tc(Promise.resolve().then(() => Ec(l(c))), t);
 				u.kind === "rejected" ? e.log.warn("plugin onDeactivate threw", {
 					plugin: i.name,
 					err: u.err
@@ -2603,16 +2648,16 @@ ${a.join("\n\n")}\n`);
 				services: e.services !== void 0,
 				hasConfigSchema: e.configSchema !== void 0,
 				activated: r.has(e.name),
-				installed: vc.has(yc(e))
+				installed: Dc.has(Oc(e))
 			}));
 		}
 	};
-}, xc = {
+}, Ac = {
 	mutation: "intercept-mutation",
 	query: "intercept-query",
 	action: "intercept-action"
-}, Sc = (e, t, n, r) => {
-	let i = xc[t], a = `plugin.${e}.${i}`, o = a;
+}, jc = (e, t, n, r) => {
+	let i = Ac[t], a = `plugin.${e}.${i}`, o = a;
 	return (t, s) => N.suspend(() => {
 		let c = Date.now();
 		return n(t, s).pipe(N.withSpan(a, { attributes: {
@@ -2636,17 +2681,17 @@ ${a.join("\n\n")}\n`);
 			});
 		})));
 	});
-}, Cc = (e, t, n) => {
+}, Mc = (e, t, n) => {
 	let r = t === "mutation" ? "interceptMutation" : t === "query" ? "interceptQuery" : "interceptAction", i = [];
 	for (let a of e) {
 		let e = a[r];
-		typeof e == "function" && i.push(Sc(a.name, t, e, n));
+		typeof e == "function" && i.push(jc(a.name, t, e, n));
 	}
 	return i;
-}, wc = `${w}/plugins/`, Tc = (e) => e.startsWith("/") ? e : `/${e}`, Ec = (e) => {
+}, Nc = `${w}/plugins/`, Pc = (e) => e.startsWith("/") ? e : `/${e}`, Fc = (e) => {
 	let t = e.indexOf("?");
 	return t >= 0 ? e.slice(0, t) : e;
-}, Dc = (e, t) => e.kind === "json" ? {
+}, Ic = (e, t) => e.kind === "json" ? {
 	status: e.status ?? 200,
 	contentType: "application/json; charset=utf-8",
 	body: JSON.stringify(e.data),
@@ -2656,12 +2701,12 @@ ${a.join("\n\n")}\n`);
 	contentType: e.contentType ?? "text/plain; charset=utf-8",
 	body: e.body,
 	headers: t
-}, Oc = (e) => {
+}, Lc = (e) => {
 	let t = /* @__PURE__ */ new Map(), n = [];
 	for (let r of e) {
 		let e = r.inspectEndpoints ?? [], i = x(r.name);
 		for (let a of e) {
-			let e = `${wc}${i}${Tc(a.path)}`, o = `${a.method} ${e}`, s = t.get(o);
+			let e = `${Nc}${i}${Pc(a.path)}`, o = `${a.method} ${e}`, s = t.get(o);
 			if (s !== void 0) throw Error(`plugin inspect endpoint collision: "${a.method} ${e}" declared by plugin "${r.name}" but already claimed by ${s}`);
 			t.set(o, `plugin "${r.name}"`), n.push({
 				method: a.method,
@@ -2675,8 +2720,8 @@ ${a.join("\n\n")}\n`);
 	return {
 		endpoints: n,
 		async dispatch(e, t, r, i, a) {
-			let o = Ec(e);
-			if (!o.startsWith(wc)) return null;
+			let o = Fc(e);
+			if (!o.startsWith(Nc)) return null;
 			let s = T(r.origin ?? r.Origin), c = t.toUpperCase();
 			if (c === "OPTIONS") return {
 				status: 204,
@@ -2703,7 +2748,7 @@ ${a.join("\n\n")}\n`);
 			let u = n.find((e) => e.method === c && e.path === o);
 			if (!u) return null;
 			try {
-				return Dc(await N.runPromise(u.handler({
+				return Ic(await N.runPromise(u.handler({
 					method: c,
 					url: e,
 					headers: r,
@@ -2723,7 +2768,7 @@ ${a.join("\n\n")}\n`);
 			}
 		}
 	};
-}, kc = (e, t, n) => {
+}, Rc = (e, t, n) => {
 	let r = `plugin.${e}.schedule-fire`;
 	return async (i, a) => {
 		let o = Date.now();
@@ -2751,9 +2796,9 @@ ${a.join("\n\n")}\n`);
 			}), e;
 		}
 	};
-}, Ac = (e, t) => {
+}, zc = (e, t) => {
 	let n = [];
-	for (let r of e) typeof r.onScheduleFire == "function" && n.push(kc(r.name, r.onScheduleFire, t));
+	for (let r of e) typeof r.onScheduleFire == "function" && n.push(Rc(r.name, r.onScheduleFire, t));
 	if (n.length !== 0) return async (e, t) => {
 		let r = e;
 		for (let e = n.length - 1; e >= 0; e--) {
@@ -2762,7 +2807,7 @@ ${a.join("\n\n")}\n`);
 		}
 		return r();
 	};
-}, jc = (e, t, n) => ((r, i) => {
+}, Bc = (e, t, n) => ((r, i) => {
 	let a = `plugin.${e}.workflow-step`, o = a, s = Date.now();
 	return t(r, i).pipe(N.withSpan(a, { attributes: {
 		"plugin.name": e,
@@ -2785,16 +2830,16 @@ ${a.join("\n\n")}\n`);
 			status: "error"
 		});
 	})));
-}), Mc = (e, t) => {
+}), Vc = (e, t) => {
 	let n = [];
-	for (let r of e) typeof r.onWorkflowStep == "function" && n.push(jc(r.name, r.onWorkflowStep, t));
-	return n.length === 0 ? P.succeed(jr, { interceptor: ((e) => e) }) : P.succeed(jr, { interceptor: ((e, t) => n.reduceRight((e, n) => n(e, t), e)) });
-}, Nc = (e) => {
+	for (let r of e) typeof r.onWorkflowStep == "function" && n.push(Bc(r.name, r.onWorkflowStep, t));
+	return n.length === 0 ? P.succeed(Pr, { interceptor: ((e) => e) }) : P.succeed(Pr, { interceptor: ((e, t) => n.reduceRight((e, n) => n(e, t), e)) });
+}, Hc = (e) => {
 	if (!e) return;
 	let t = e.workflowName ?? e.tag, n = [];
-	if (t !== void 0 && n.push(H("tag", t)), e.status !== void 0 && n.push(H("status", e.status)), n.length !== 0) return n.length === 1 ? n[0] : Xr(...n);
-}, Pc = async (e, t) => {
-	let n = Math.max(0, t?.offset ?? 0), r = Math.max(1, Math.min(500, t?.limit ?? 50)), i = Nc(t);
+	if (t !== void 0 && n.push(V("tag", t)), e.status !== void 0 && n.push(V("status", e.status)), n.length !== 0) return n.length === 1 ? n[0] : $r(...n);
+}, Uc = async (e, t) => {
+	let n = Math.max(0, t?.offset ?? 0), r = Math.max(1, Math.min(500, t?.limit ?? 50)), i = Hc(t);
 	return {
 		rows: await e.query({
 			table: "_voltro_workflow_runs",
@@ -2818,7 +2863,7 @@ ${a.join("\n\n")}\n`);
 		offset: n,
 		limit: r
 	};
-}, Fc = (e) => ({
+}, Wc = (e) => ({
 	id: e.id,
 	workflowName: e.tag,
 	executionId: e.executionId,
@@ -2833,14 +2878,14 @@ ${a.join("\n\n")}\n`);
 	durationMs: e.durationMs,
 	traceId: e.traceId,
 	parentExecutionId: e.parentExecutionId
-}), Ic = async (e, t) => {
-	let { rows: n } = await Pc(e, t);
-	return n.map(Fc);
-}, Lc = async (e, t, n) => {
+}), Gc = async (e, t) => {
+	let { rows: n } = await Uc(e, t);
+	return n.map(Wc);
+}, Kc = async (e, t, n) => {
 	let r = (await e.store.query({
 		table: "_voltro_workflow_runs",
 		order: [],
-		predicate: H("id", t),
+		predicate: V("id", t),
 		projection: void 0,
 		skip: void 0,
 		take: 1
@@ -2850,7 +2895,7 @@ ${a.join("\n\n")}\n`);
 	if (!i) throw Error(`retry: no workflow registered with tag '${r.tag}'`);
 	let a = n?.payloadOverride === void 0 ? r.payload : n.payloadOverride, o = await e.runPromise(i.definition.execute(a));
 	return { executionId: typeof o == "string" ? o : "started" };
-}, Rc = (e, t) => {
+}, qc = (e, t) => {
 	let n = e.filter((e) => typeof e.onHttpRequest == "function");
 	if (n.length !== 0) return n.reduceRight((e, n) => {
 		let r = n.onHttpRequest, i = `plugin.${n.name}.http-intercept`;
@@ -2871,7 +2916,7 @@ ${a.join("\n\n")}\n`);
 			}
 		};
 	}, (e) => e());
-}, zc = (e) => {
+}, Jc = (e) => {
 	let t = [];
 	for (let n of e) {
 		let e = n.dashboard ?? [];
@@ -2895,7 +2940,7 @@ ${a.join("\n\n")}\n`);
 		}
 	}
 	return t;
-}, Bc = /\.(query|mutation|action|stream)\.ts$/, Vc = /\.(query|mutation|action|stream)\.server\.ts$/, Hc = /* @__PURE__ */ new Set([
+}, Yc = /\.(query|mutation|action|stream)\.ts$/, Xc = /\.(query|mutation|action|stream)\.server\.ts$/, Zc = /* @__PURE__ */ new Set([
 	"node_modules",
 	"dist",
 	"build",
@@ -2903,7 +2948,7 @@ ${a.join("\n\n")}\n`);
 	".vite",
 	".next",
 	".git"
-]), Uc = async (e) => {
+]), Qc = async (e) => {
 	let t = [], n = async (e) => {
 		let r;
 		try {
@@ -2912,14 +2957,14 @@ ${a.join("\n\n")}\n`);
 			return;
 		}
 		for (let i of r) {
-			if (Hc.has(i.name)) continue;
+			if (Zc.has(i.name)) continue;
 			let r = O(e, i.name);
-			i.isDirectory() ? await n(r) : i.isFile() && (Bc.test(i.name) && !Vc.test(i.name) || C.test(i.name)) && t.push(r);
+			i.isDirectory() ? await n(r) : i.isFile() && (Yc.test(i.name) && !Xc.test(i.name) || C.test(i.name)) && t.push(r);
 		}
 	};
 	return await n(e), t;
-}, Wc = async (e) => {
-	let t = await Uc(e), n = [];
+}, $c = async (e) => {
+	let t = await Qc(e), n = [];
 	for (let e of t) try {
 		let t = await import(j(e).href);
 		for (let r of Object.values(t)) {
@@ -2944,10 +2989,10 @@ ${a.join("\n\n")}\n`);
 		let t = `${e.kind}:${e.tag}`;
 		return r.has(t) ? !1 : (r.add(t), !0);
 	});
-}, Gc = async (e, t, n) => {
+}, el = async (e, t, n) => {
 	let r = e.filter((e) => typeof e.codegen == "function");
 	if (r.length === 0) return [];
-	let i = await Wc(n);
+	let i = await $c(n);
 	return r.map((e) => {
 		let n = we(e.name), r = {
 			pluginName: e.name,
@@ -2961,8 +3006,8 @@ ${a.join("\n\n")}\n`);
 			emit: () => e.codegen(r)
 		};
 	});
-}, Kc = async (e, t, n) => ({
-	pluginContributions: await Gc(e, t, n),
+}, tl = async (e, t, n) => ({
+	pluginContributions: await el(e, t, n),
 	pluginErrorImports: e.flatMap((e) => (e.errorSchemas ?? []).map((e) => e.import)),
 	pluginRpcImports: e.flatMap((e) => (e.rpcClientDescriptors ?? []).map((e) => ({
 		tag: e.tag,
@@ -2970,19 +3015,19 @@ ${a.join("\n\n")}\n`);
 		module: e.import.module,
 		name: e.import.name
 	})))
-}), qc = class extends Error {
+}), nl = class extends Error {
 	constructor(e) {
 		super(e), this.name = "InspectQueryError";
 	}
-}, Jc = /* @__PURE__ */ new Set([
+}, rl = /* @__PURE__ */ new Set([
 	"text",
 	"id",
 	"reference"
-]), Yc = /* @__PURE__ */ new Set([
+]), il = /* @__PURE__ */ new Set([
 	"integer",
 	"timestamp",
 	"date"
-]), Xc = (e, t) => {
+]), al = (e, t) => {
 	switch (e) {
 		case "isNull":
 		case "isNotNull":
@@ -2990,54 +3035,54 @@ ${a.join("\n\n")}\n`);
 		case "neq":
 		case "in":
 		case "notIn": return !0;
-		case "contains": return Jc.has(t);
+		case "contains": return rl.has(t);
 		case "gt":
 		case "gte":
 		case "lt":
-		case "lte": return Yc.has(t);
+		case "lte": return il.has(t);
 	}
-}, Zc = (e, t, n) => {
+}, ol = (e, t, n) => {
 	if (e == null) return e;
 	switch (t) {
 		case "integer": {
 			let t = typeof e == "number" ? e : Number(e);
-			if (!Number.isFinite(t)) throw new qc(`filter on "${n}": "${String(e)}" is not a number`);
+			if (!Number.isFinite(t)) throw new nl(`filter on "${n}": "${String(e)}" is not a number`);
 			return t;
 		}
 		case "boolean":
 			if (typeof e == "boolean") return e;
 			if (e === "true") return !0;
 			if (e === "false") return !1;
-			throw new qc(`filter on "${n}": "${String(e)}" is not a boolean`);
+			throw new nl(`filter on "${n}": "${String(e)}" is not a boolean`);
 		default: return e;
 	}
-}, Qc = (e, t) => {
+}, sl = (e, t) => {
 	let n = t.get(e.column);
-	if (!n) throw new qc(`unknown filter column "${e.column}"`);
-	if (!Xc(e.op, n.type)) throw new qc(`operator "${e.op}" is not valid for ${n.type} column "${e.column}"`);
+	if (!n) throw new nl(`unknown filter column "${e.column}"`);
+	if (!al(e.op, n.type)) throw new nl(`operator "${e.op}" is not valid for ${n.type} column "${e.column}"`);
 	if (e.op === "isNull" || e.op === "isNotNull") return {
 		column: e.column,
 		op: e.op
 	};
 	if (e.op === "in" || e.op === "notIn") {
-		if (!Array.isArray(e.value)) throw new qc(`operator "${e.op}" on "${e.column}" requires an array value`);
+		if (!Array.isArray(e.value)) throw new nl(`operator "${e.op}" on "${e.column}" requires an array value`);
 		return {
 			column: e.column,
 			op: e.op,
-			value: e.value.map((t) => Zc(t, n.type, e.column))
+			value: e.value.map((t) => ol(t, n.type, e.column))
 		};
 	}
 	return {
 		column: e.column,
 		op: e.op,
-		value: Zc(e.value, n.type, e.column)
+		value: ol(e.value, n.type, e.column)
 	};
-}, $c = 200, el = (e, t, n) => {
-	if (++n.n > $c) throw new qc("filter tree too large");
-	if (e.kind === "leaf") return Qc(e, t);
-	let r = e.children.map((e) => el(e, t, n));
+}, cl = 200, ll = (e, t, n) => {
+	if (++n.n > cl) throw new nl("filter tree too large");
+	if (e.kind === "leaf") return sl(e, t);
+	let r = e.children.map((e) => ll(e, t, n));
 	return e.kind === "and" ? { and: r } : { or: r };
-}, tl = (e, t) => {
+}, ul = (e, t) => {
 	let n = e?.trim();
 	if (!n) return null;
 	let r = t.filter((e) => e.type === "text" || (e.oneOf?.length ?? 0) > 0);
@@ -3046,16 +3091,16 @@ ${a.join("\n\n")}\n`);
 		op: "contains",
 		value: n
 	})) };
-}, nl = (e) => {
+}, dl = (e) => {
 	let t = new Map(e.columns.map((e) => [e.name, e])), n = [];
-	e.filter && n.push(el(e.filter, t, { n: 0 }));
-	let r = tl(e.quickSearch, e.columns);
+	e.filter && n.push(ll(e.filter, t, { n: 0 }));
+	let r = ul(e.quickSearch, e.columns);
 	if (r && n.push(r), n.length !== 0) return n.length === 1 ? n[0] : { and: n };
-}, rl = (e, t) => {
+}, fl = (e, t) => {
 	let n = new Set(t.map((e) => e.name)), r = [], i = /* @__PURE__ */ new Set();
 	for (let t of e ?? []) {
-		if (!n.has(t.column)) throw new qc(`unknown sort column "${t.column}"`);
-		if (t.direction !== "asc" && t.direction !== "desc") throw new qc(`invalid sort direction "${t.direction}"`);
+		if (!n.has(t.column)) throw new nl(`unknown sort column "${t.column}"`);
+		if (t.direction !== "asc" && t.direction !== "desc") throw new nl(`invalid sort direction "${t.direction}"`);
 		i.has(t.column) || (i.add(t.column), r.push({
 			column: t.column,
 			direction: t.direction
@@ -3065,16 +3110,16 @@ ${a.join("\n\n")}\n`);
 		column: "id",
 		direction: "asc"
 	}), r;
-}, il = 150, al = 200, ol = (e) => e instanceof Date ? e.toISOString() : typeof e == "bigint" ? e.toString() : e, sl = (e) => {
+}, pl = 150, ml = 200, hl = (e) => e instanceof Date ? e.toISOString() : typeof e == "bigint" ? e.toString() : e, gl = (e) => {
 	if (!e) return null;
 	let t = {};
-	for (let [n, r] of Object.entries(e)) t[n] = ol(r);
+	for (let [n, r] of Object.entries(e)) t[n] = hl(r);
 	return t;
-}, cl = (e, t) => {
+}, _l = (e, t) => {
 	let n = /* @__PURE__ */ new Map(), r, i = () => {
 		r = void 0;
 		for (let [e, r] of n) {
-			if (r.size > al) {
+			if (r.size > ml) {
 				t.emit("cdc", {
 					op: "resync",
 					table: e
@@ -3096,17 +3141,17 @@ ${a.join("\n\n")}\n`);
 		let o = n.get(e.table);
 		o || (o = /* @__PURE__ */ new Map(), n.set(e.table, o)), o.set(a, {
 			op: e.op,
-			row: e.op === "delete" ? null : sl(t)
-		}), r === void 0 && (r = setTimeout(i, il));
+			row: e.op === "delete" ? null : gl(t)
+		}), r === void 0 && (r = setTimeout(i, pl));
 	});
 	return () => {
 		r !== void 0 && clearTimeout(r), a();
 	};
-}, ll = [
+}, vl = [
 	"ok",
 	"error",
 	"unset"
-], ul = (e, t) => {
+], yl = (e, t) => {
 	let n = e.indexOf("?"), r = n === -1 ? new URLSearchParams() : new URLSearchParams(e.slice(n + 1)), i = (() => {
 		let e = r.get("since");
 		if (e === null) return;
@@ -3127,9 +3172,9 @@ ${a.join("\n\n")}\n`);
 			Number.isFinite(t) && (e.minDurationMs = t);
 		}
 		let s = r.get("status");
-		s !== null && ll.includes(s) && (e.status = s);
+		s !== null && vl.includes(s) && (e.status = s);
 		let c = t.query(e);
-		return dl({
+		return bl({
 			capturedAt: Date.now(),
 			bufferCapacity: t.capacityHint(),
 			bufferSize: t.size(),
@@ -3141,22 +3186,22 @@ ${a.join("\n\n")}\n`);
 	let s = {};
 	i !== void 0 && (s.since = i), a !== void 0 && (s.maxTraces = a), r.get("onlyErrors") === "1" && (s.onlyErrors = !0);
 	let c = t.queryGrouped(s);
-	return dl({
+	return bl({
 		capturedAt: Date.now(),
 		bufferCapacity: t.capacityHint(),
 		bufferSize: t.size(),
 		returned: c.length,
 		traces: c
 	});
-}, dl = (e) => ({
+}, bl = (e) => ({
 	status: 200,
 	contentType: "application/json; charset=utf-8",
 	body: JSON.stringify(e)
-}), fl = (e) => {
+}), xl = (e) => {
 	let t = e.now ?? Date.now, n = {
 		phase: "booting",
 		startedAt: t()
-	}, r = Ea((e, r) => {
+	}, r = ka((e, r) => {
 		let i = (e.url ?? "/").split("?")[0], a = n.phase === "ready";
 		if (i === "/internal/liveness") {
 			r.writeHead(200, {
@@ -3211,28 +3256,28 @@ ${a.join("\n\n")}\n`);
 			e.log?.info("dev health server listening", { port: a }), t(i(a));
 		});
 	});
-}, $ = F({ scope: "voltro:dev" }), pl = await (async () => {
+}, $ = F({ scope: "voltro:dev" }), Sl = await (async () => {
 	try {
 		let e = O(D(dt(import.meta.url)), "..", "package.json"), t = await R.readFile(e, "utf8");
 		return JSON.parse(t).version ?? "0.0.0";
 	} catch {
 		return "0.0.0";
 	}
-})(), ml = process.env.TENANT ?? "acme", hl = process.env.VOLTRO_SESSION_COOKIE ?? "voltro:session", gl = {
+})(), Cl = process.env.TENANT ?? "acme", wl = process.env.VOLTRO_SESSION_COOKIE ?? "voltro:session", Tl = {
 	id: "voltro-password",
 	resolve: (e) => {
-		let t = Wi(e.headers.cookie ?? e.headers.Cookie, hl);
+		let t = qi(e.headers.cookie ?? e.headers.Cookie, wl);
 		if (!t) return { kind: "skip" };
-		let n = Gi();
+		let n = Ji();
 		if (!n) return { kind: "skip" };
-		let r = Ki(t, n);
+		let r = Yi(t, n);
 		return r ? {
 			kind: "matched",
 			subject: r.subject
 		} : { kind: "skip" };
 	}
-}, _l = (e = [], t, n = !1, r, i) => (vl([t ?? gl, ...e]), vi([t ?? gl, ...e], {
-	...n ? { anonymousTenantRequired: !0 } : { fallback: (e) => gi(e.headers["x-tenant"] ?? ml) },
+}, El = (e = [], t, n = !1, r, i) => (Dl([t ?? Tl, ...e]), xi([t ?? Tl, ...e], {
+	...n ? { anonymousTenantRequired: !0 } : { fallback: (e) => yi(e.headers["x-tenant"] ?? Cl) },
 	onStrategyFailed: ({ strategyId: e, reason: t }) => {
 		$.warn(`auth strategy "${e}" rejected request: ${t}`);
 	},
@@ -3241,17 +3286,17 @@ ${a.join("\n\n")}\n`);
 		...t,
 		store: i?.()
 	}) }
-})), vl = (e) => {
+})), Dl = (e) => {
 	let t = /* @__PURE__ */ new Map();
 	for (let n of e) {
 		let e = n.claimsBearerPrefix;
 		e === void 0 || e === "" || t.set(e, [...t.get(e) ?? [], n.id]);
 	}
 	for (let [e, n] of t) n.length < 2 || $.warn(`auth: ${n.length} strategies claim the bearer prefix "${e}" (${n.join(", ")}). The chain is first-match-wins, so the FIRST one decides the Subject for every token with this shape — if they resolve to different authority, which one answered decides whether authorization works. If this is \`apiKeys: true\` alongside your own key strategy, either drop one or give them distinct prefixes (\`apiKeys: { prefix: "…" }\`).`);
-}, yl = (e) => P.succeed(ui, ui.of(({ headers: t, clientId: n }) => N.promise(async () => cn(n) || e({
+}, Ol = (e) => P.succeed(pi, pi.of(({ headers: t, clientId: n }) => N.promise(async () => cn(n) || e({
 	headers: t,
 	clientId: n
-})))), bl = P.succeed(di, di.of(({ clientId: e }) => N.succeed({ clientId: e }))), xl = (e) => {
+})))), kl = P.succeed(mi, mi.of(({ clientId: e }) => N.succeed({ clientId: e }))), Al = (e) => {
 	if (pt.isCause(e)) return e;
 	if (typeof e != "object" || !e) return;
 	for (let t of Object.getOwnPropertySymbols(e)) if (t.description === "effect/Runtime/FiberFailure/Cause") {
@@ -3260,17 +3305,17 @@ ${a.join("\n\n")}\n`);
 	}
 	let t = e.cause;
 	return pt.isCause(t) ? t : void 0;
-}, Sl = (e) => {
-	let t = xl(e);
+}, jl = (e) => {
+	let t = Al(e);
 	if (t === void 0) return;
 	let n = pt.failureOption(t);
 	if (vt.isSome(n)) return n.value;
 	let r = pt.dieOption(t);
 	if (vt.isSome(r)) return r.value;
-}, Cl = (e) => {
+}, Ml = (e) => {
 	if (e == null) return { message: "unknown error" };
-	let t = Sl(e);
-	if (t !== void 0 && t !== e) return Cl(t);
+	let t = jl(e);
+	if (t !== void 0 && t !== e) return Ml(t);
 	let n = an(e), r = (n.dbCode ?? n.dbSqlState ?? n.dbErrno ?? n.dbConstraint) === void 0 ? {} : n;
 	if (typeof e == "object" && "_tag" in e) return {
 		...e,
@@ -3287,7 +3332,7 @@ ${a.join("\n\n")}\n`);
 	} catch {
 		return { message: String(e) };
 	}
-}, wl = /* @__PURE__ */ new Set([
+}, Nl = /* @__PURE__ */ new Set([
 	"node_modules",
 	"dist",
 	"build",
@@ -3295,21 +3340,21 @@ ${a.join("\n\n")}\n`);
 	".vite",
 	".next",
 	".git"
-]), Tl = async (e) => {
+]), Pl = async (e) => {
 	let t = [], n = async (e) => {
 		let r = await R.readdir(e, { withFileTypes: !0 });
 		for (let i of r) {
-			if (wl.has(i.name)) continue;
+			if (Nl.has(i.name)) continue;
 			let r = O(e, i.name);
-			i.isDirectory() ? await n(r) : i.isFile() && (je.test(i.name) && !Le.test(i.name) || Le.test(i.name) || C.test(i.name) || De.test(i.name) || Ee.test(i.name) || Me.test(i.name) || Ne.test(i.name) || ke.test(i.name) || ze.test(i.name) || Pe.test(i.name) || Oe.test(i.name) || nc.test(i.name) || Se.test(i.name) || S.test(i.name) || Ae.test(i.name) || Fe.test(i.name) || Ie.test(i.name) || Re.test(i.name)) && t.push(r);
+			i.isDirectory() ? await n(r) : i.isFile() && (je.test(i.name) && !Le.test(i.name) || Le.test(i.name) || C.test(i.name) || De.test(i.name) || Ee.test(i.name) || Me.test(i.name) || Ne.test(i.name) || ke.test(i.name) || ze.test(i.name) || Pe.test(i.name) || Oe.test(i.name) || dc.test(i.name) || Se.test(i.name) || S.test(i.name) || Ae.test(i.name) || Fe.test(i.name) || Ie.test(i.name) || Re.test(i.name)) && t.push(r);
 		}
 	};
 	return await n(e), t;
-}, El = (e) => typeof e == "object" && !!e && "kind" in e && "name" in e && e.kind === "query", Dl = (e) => typeof e == "object" && !!e && "kind" in e && "name" in e && e.kind === "mutation", Ol = (e) => typeof e == "object" && !!e && "kind" in e && "name" in e && e.kind === "action", kl = (e) => typeof e == "object" && !!e && "kind" in e && "name" in e && e.kind === "stream", Al = Symbol.for("@effect/workflow/Workflow"), jl = (e) => typeof e == "object" && !!e && Al in e, Ml = (e) => {
+}, Fl = (e) => typeof e == "object" && !!e && "kind" in e && "name" in e && e.kind === "query", Il = (e) => typeof e == "object" && !!e && "kind" in e && "name" in e && e.kind === "mutation", Ll = (e) => typeof e == "object" && !!e && "kind" in e && "name" in e && e.kind === "action", Rl = (e) => typeof e == "object" && !!e && "kind" in e && "name" in e && e.kind === "stream", zl = Symbol.for("@effect/workflow/Workflow"), Bl = (e) => typeof e == "object" && !!e && zl in e, Vl = (e) => {
 	let t = {};
 	for (let [n, r] of Object.entries(e)) r instanceof Date ? t[n] = r.toISOString() : typeof r == "bigint" ? t[n] = r.toString() : t[n] = r;
 	return t;
-}, Nl = (e) => Object.entries(e.fields).map(([e, t]) => {
+}, Hl = (e) => Object.entries(e.fields).map(([e, t]) => {
 	let n = t, r = n.references?.()?.tableName;
 	return {
 		name: e,
@@ -3320,11 +3365,11 @@ ${a.join("\n\n")}\n`);
 		...r === void 0 ? {} : { referencesTable: r },
 		...n.oneOf === void 0 ? {} : { oneOf: [...n.oneOf] }
 	};
-}), Pl = (e) => e.some((e) => e.name === "id") ? "id" : e.find((e) => e.type === "id")?.name, Fl = (e) => typeof e == "object" && !!e && "tableName" in e && "fields" in e && typeof e.tableName == "string" && typeof e.fields == "object" && e.fields !== null, Il = (e, t) => {
+}), Ul = (e) => e.some((e) => e.name === "id") ? "id" : e.find((e) => e.type === "id")?.name, Wl = (e) => typeof e == "object" && !!e && "tableName" in e && "fields" in e && typeof e.tableName == "string" && typeof e.fields == "object" && e.fields !== null, Gl = (e, t) => {
 	let n = /* @__PURE__ */ new Map();
-	for (let e of t) Fl(e) && n.set(e.tableName, e);
+	for (let e of t) Wl(e) && n.set(e.tableName, e);
 	let r = /* @__PURE__ */ new Set(), i = [], a = (e) => {
-		if (!(!Fl(e) || r.has(e.tableName))) {
+		if (!(!Wl(e) || r.has(e.tableName))) {
 			r.add(e.tableName);
 			for (let t of Object.values(e.fields)) {
 				let e = t.references?.()?.tableName;
@@ -3337,7 +3382,7 @@ ${a.join("\n\n")}\n`);
 	};
 	for (let t of e) a(t);
 	return i;
-}, Ll = "voltro/tenant", Rl = (e) => Fl(e) && (e.appliedMixins ?? []).some((e) => e.id === Ll), zl = "voltro/softDelete", Bl = (e) => Fl(e) && (e.appliedMixins ?? []).some((e) => e.id === zl), Vl = (e) => {
+}, Kl = "voltro/tenant", ql = (e) => Wl(e) && (e.appliedMixins ?? []).some((e) => e.id === Kl), Jl = "voltro/softDelete", Yl = (e) => Wl(e) && (e.appliedMixins ?? []).some((e) => e.id === Jl), Xl = (e) => {
 	let t = e.traceId, n = e.spanId;
 	if (typeof t != "string" || typeof n != "string") return null;
 	let r = (e) => e instanceof Date ? e.getTime() : typeof e == "string" ? new Date(e).getTime() : typeof e == "number" ? e : 0, i = r(e.startedAt), a = r(e.endedAt);
@@ -3355,7 +3400,7 @@ ${a.join("\n\n")}\n`);
 		...typeof e.statusMessage == "string" ? { statusMessage: e.statusMessage } : {},
 		...Array.isArray(e.events) ? { events: e.events } : {}
 	};
-}, Hl = async (e, t, n) => {
+}, Zl = async (e, t, n) => {
 	let r = e.indexOf("?"), i = (r === -1 ? new URLSearchParams() : new URLSearchParams(e.slice(r + 1))).get("traceId"), a = [];
 	try {
 		a = await n.query({
@@ -3364,7 +3409,7 @@ ${a.join("\n\n")}\n`);
 				column: "startedAt",
 				direction: "desc"
 			}],
-			predicate: i !== null && i.length > 0 ? H("traceId", i) : void 0,
+			predicate: i !== null && i.length > 0 ? V("traceId", i) : void 0,
 			projection: void 0,
 			skip: void 0,
 			take: i !== null && i.length > 0 ? 1e3 : 2e3
@@ -3374,25 +3419,25 @@ ${a.join("\n\n")}\n`);
 	}
 	let o = /* @__PURE__ */ new Map();
 	for (let e of a) {
-		let t = Vl(e);
+		let t = Xl(e);
 		t && o.set(`${t.traceId}:${t.spanId}`, t);
 	}
 	for (let e of t.query({ max: t.capacityHint() })) o.set(`${e.traceId}:${e.spanId}`, e);
 	let s = new le(Math.max(o.size + 16, 1024));
 	for (let e of [...o.values()].sort((e, t) => e.startMs - t.startMs)) s.append(e);
 	return s;
-}, Ul = async (e, t) => {
+}, Ql = async (e, t) => {
 	let n = [], r = [], i = [], a = [], o = [], s = [], c = [], l = [], u = /* @__PURE__ */ new Set(), d = /* @__PURE__ */ new Set(), f = /* @__PURE__ */ new Map(), p = [], m = /* @__PURE__ */ new Map();
 	for (let t of e) {
 		let e = E(t);
 		if (Me.test(e)) {
 			let e = await b(t);
-			for (let t of Object.values(e)) Fl(t) && (f.set(t.tableName, t), Rl(t) && u.add(t.tableName), Bl(t) && d.add(t.tableName));
-			ai(e);
+			for (let t of Object.values(e)) Wl(t) && (f.set(t.tableName, t), ql(t) && u.add(t.tableName), Yl(t) && d.add(t.tableName));
+			ci(e);
 			continue;
 		}
 		if (Ne.test(e)) {
-			ai(await b(t)) === 0 && $.warn("skipping relations file — no relations(...) export found", { file: t });
+			ci(await b(t)) === 0 && $.warn("skipping relations file — no relations(...) export found", { file: t });
 			continue;
 		}
 		if (Te(e)) {
@@ -3403,7 +3448,7 @@ ${a.join("\n\n")}\n`);
 			continue;
 		}
 		if (C.test(e)) {
-			let e = await b(t), n = Object.values(e).find(jl);
+			let e = await b(t), n = Object.values(e).find(Bl);
 			if (!n) {
 				$.warn("skipping workflow — no workflow(...) export", { file: t });
 				continue;
@@ -3428,7 +3473,7 @@ ${a.join("\n\n")}\n`);
 				definition: n,
 				buildExecute: a
 			});
-			for (let t of [...Object.values(e), ...Object.values(i)]) Fr(t) && s.push(t);
+			for (let t of [...Object.values(e), ...Object.values(i)]) Rr(t) && s.push(t);
 			continue;
 		}
 		if (Ee.test(e)) {
@@ -3475,7 +3520,7 @@ ${a.join("\n\n")}\n`);
 		}
 	}
 	for (let e of p) {
-		let t = await b(e), o = Object.values(t).find(El) ?? Object.values(t).find(Dl) ?? Object.values(t).find(Ol) ?? Object.values(t).find(kl);
+		let t = await b(e), o = Object.values(t).find(Fl) ?? Object.values(t).find(Il) ?? Object.values(t).find(Ll) ?? Object.values(t).find(Rl);
 		if (!o) {
 			$.warn("skipping procedure descriptor — no defineQuery / defineMutation / defineAction / defineStream export", { file: e });
 			continue;
@@ -3513,7 +3558,7 @@ ${a.join("\n\n")}\n`);
 	}
 	let h = /* @__PURE__ */ new Map();
 	for (let [e, t] of f) {
-		let n = si(t);
+		let n = ui(t);
 		n.length > 0 && h.set(e, n);
 	}
 	if (h.size > 0) {
@@ -3524,9 +3569,9 @@ ${a.join("\n\n")}\n`);
 		}, h)));
 		e !== void 0 && $.warn(`[serverOnly] ${e}`);
 	}
-	f.has("actors") || f.set("actors", Jr);
+	f.has("actors") || f.set("actors", Zr);
 	let g = f.get("actors"), _ = f.get("tenants");
-	(g !== void 0 || _ !== void 0) && ii({
+	(g !== void 0 || _ !== void 0) && si({
 		...g === void 0 ? {} : { actors: () => g },
 		..._ === void 0 ? {} : { tenants: () => _ }
 	});
@@ -3538,7 +3583,7 @@ ${a.join("\n\n")}\n`);
 		outbox: e.some((e) => Fe.test(E(e))),
 		connections: ee.length > 0
 	};
-	return ci(), {
+	return di(), {
 		queries: n,
 		mutations: r,
 		actions: i,
@@ -3553,7 +3598,7 @@ ${a.join("\n\n")}\n`);
 		tenantScopedTables: u,
 		softDeleteScopedTables: d
 	};
-}, Wl = async (e) => {
+}, $l = async (e) => {
 	let t = O(e, "app.config.ts");
 	try {
 		let e = (await b(t)).default;
@@ -3561,8 +3606,8 @@ ${a.join("\n\n")}\n`);
 	} catch {
 		return null;
 	}
-}, Gl = () => {
-	let e = ql(), t = process.env.DB_SCHEMA, n = t && t.length > 0 ? { schema: t } : {}, r = Kl(), i = r === void 0 ? {} : { ssl: r }, a = process.env.DB_URL ?? process.env.DB_PRIMARY_URL;
+}, eu = () => {
+	let e = nu(), t = process.env.DB_SCHEMA, n = t && t.length > 0 ? { schema: t } : {}, r = tu(), i = r === void 0 ? {} : { ssl: r }, a = process.env.DB_URL ?? process.env.DB_PRIMARY_URL;
 	return a ? {
 		url: a,
 		...e === void 0 ? {} : { maxConnections: e },
@@ -3578,19 +3623,19 @@ ${a.join("\n\n")}\n`);
 		...i,
 		...n
 	};
-}, Kl = () => {
+}, tu = () => {
 	let e = process.env.PG_SSL;
 	if (!(e === void 0 || e === "")) {
 		if (e === "require") return !0;
 		if (e === "disable") return !1;
 		throw Error(`PG_SSL '${e}' is not supported — use 'require' (TLS without certificate verification) or 'disable' (plaintext).`);
 	}
-}, ql = () => {
+}, nu = () => {
 	let e = process.env.DB_MAX_CONNECTIONS ?? process.env.PG_MAX_CONNECTIONS;
 	if (e === void 0 || e === "") return;
 	let t = Number(e);
 	return Number.isInteger(t) && t > 0 ? t : void 0;
-}, Jl = (e) => {
+}, ru = (e) => {
 	let t = process.env.DB_URL !== void 0 || process.env.DB_PRIMARY_URL !== void 0 || process.env.DB_HOST !== void 0 || process.env.PG_HOST !== void 0;
 	if ("url" in e && e.url) try {
 		let n = new URL(e.url), r = n.username ? `${n.username}@` : "", i = n.port ? `:${n.port}` : "";
@@ -3609,25 +3654,25 @@ ${a.join("\n\n")}\n`);
 		summary: `postgres://${n.username}@${n.host}:${n.port}/${n.database}`,
 		fromEnv: t
 	};
-}, Yl = () => {
+}, iu = () => {
 	let e = process.env.DB_REPLICA_URLS;
 	return e === void 0 || e.trim() === "" ? [] : e.split(",").map((e) => e.trim()).filter((e) => e.length > 0);
-}, Xl = (e) => {
+}, au = (e) => {
 	let t = 2166136261;
 	for (let n = 0; n < e.length; n++) t ^= e.charCodeAt(n), t = Math.imul(t, 16777619);
 	return 1e3 + (t >>> 0) % 2147482647;
-}, Zl = (e) => (process.env.DB_DIALECT ?? e?.store ?? "memory").toLowerCase(), Ql = async (e, t) => {
-	let n = Zl(e);
+}, ou = (e) => (process.env.DB_DIALECT ?? e?.store ?? "memory").toLowerCase(), su = async (e, t) => {
+	let n = ou(e);
 	if (n === "memory") return $.info("sql dialect resolved: memory — in-process store, no persistence"), new It({});
-	let r = (process.env.CDC ?? "1") !== "0", i = await y(n), a = i.id === "postgres" ? "LISTEN/NOTIFY" : ti(i.id) ? "in-process bus" : i.id === "mariadb" ? "binlog CDC (ROW)" : i.id === "mssql" ? "Change Tracking (polled)" : i.id === "mysql" ? "binlog CDC (ROW)" : "inline only", o = i.id === "postgres" ? "native" : i.id === "mysql" ? "INSERT/UPDATE/DELETE then SELECT (no RETURNING)" : i.id === "mariadb" ? "native (INSERT/DELETE); UPDATE then SELECT" : i.id === "mssql" ? "OUTPUT INSERTED/DELETED" : ti(i.id) ? "native" : "unknown";
+	let r = (process.env.CDC ?? "1") !== "0", i = await y(n), a = i.id === "postgres" ? "LISTEN/NOTIFY" : ii(i.id) ? "in-process bus" : i.id === "mariadb" ? "binlog CDC (ROW)" : i.id === "mssql" ? "Change Tracking (polled)" : i.id === "mysql" ? "binlog CDC (ROW)" : "inline only", o = i.id === "postgres" ? "native" : i.id === "mysql" ? "INSERT/UPDATE/DELETE then SELECT (no RETURNING)" : i.id === "mariadb" ? "native (INSERT/DELETE); UPDATE then SELECT" : i.id === "mssql" ? "OUTPUT INSERTED/DELETED" : ii(i.id) ? "native" : "unknown";
 	$.info(`sql dialect resolved: ${i.id} — CDC: ${r ? a : "inline emit (CDC=0)"}, RETURNING: ${o}`);
-	let s = Gl(), { summary: c, fromEnv: l } = Jl(s);
+	let s = eu(), { summary: c, fromEnv: l } = ru(s);
 	$.info(`db connection: ${c}${l ? "" : " (DEFAULT FALLBACK — no DB_URL / PG_HOST set)"}`), l || $.warn("db connection: falling back to localhost:5432/app — no DB_URL or PG_HOST env var set.\n  If this app should run against its OWN postgres (e.g. its docker-compose), set DB_URL.\n  Copy `.env.example` to `.env` in the app dir, or set DB_URL in the shell.\n  Otherwise this app is silently using whatever DB is at localhost:5432/app — which is\n  voltro-starter's docker default + may carry foreign tables that confuse the planner.");
 	let u;
 	if (r && (i.id === "mysql" || i.id === "mariadb")) {
-		let { connectionFromConfig: e } = await v("@voltro/sql-mysql"), t = process.env.POD_NAME ?? process.env.HOSTNAME ?? `dev-${process.pid}`, n = Yr().filter((e) => e.isReactive !== !1).map((e) => e.tableName).filter((e) => !e.startsWith("_voltro_"));
+		let { connectionFromConfig: e } = await v("@voltro/sql-mysql"), t = process.env.POD_NAME ?? process.env.HOSTNAME ?? `dev-${process.pid}`, n = Qr().filter((e) => e.isReactive !== !1).map((e) => e.tableName).filter((e) => !e.startsWith("_voltro_"));
 		u = {
-			serverId: Xl(t),
+			serverId: au(t),
 			replicaId: t,
 			connection: e(s),
 			includeTables: n
@@ -3637,7 +3682,7 @@ ${a.join("\n\n")}\n`);
 			tables: n.length
 		});
 	} else if (r && i.id === "mssql") {
-		let { connectionFromConfig: e } = await v("@voltro/sql-mssql"), t = e(s), n = process.env.POD_NAME ?? process.env.HOSTNAME ?? `dev-${process.pid}`, i = Yr().filter((e) => e.isReactive !== !1).map((e) => e.tableName).filter((e) => !e.startsWith("_voltro_"));
+		let { connectionFromConfig: e } = await v("@voltro/sql-mssql"), t = e(s), n = process.env.POD_NAME ?? process.env.HOSTNAME ?? `dev-${process.pid}`, i = Qr().filter((e) => e.isReactive !== !1).map((e) => e.tableName).filter((e) => !e.startsWith("_voltro_"));
 		u = {
 			serverId: 0,
 			replicaId: n,
@@ -3659,7 +3704,7 @@ ${a.join("\n\n")}\n`);
 		...t ? { tracerLayer: t } : {},
 		changeStrategy: r ? "cdc" : "inline",
 		...u ? { cdcConfig: u } : {}
-	}), f = Yl();
+	}), f = iu();
 	if (f.length === 0) return $.info("read replicas: none configured (DB_REPLICA_URLS unset) — all queries → primary"), ut.recordReplication({
 		replicaCount: 0,
 		rywPolicy: "off",
@@ -3667,14 +3712,14 @@ ${a.join("\n\n")}\n`);
 		region: null,
 		localityEnabled: !1
 	}), d;
-	if (ti(i.id)) return $.warn(`read replicas: not applicable (${i.id} is single-process); ignoring DB_REPLICA_URLS`), ut.recordReplication({
+	if (ii(i.id)) return $.warn(`read replicas: not applicable (${i.id} is single-process); ignoring DB_REPLICA_URLS`), ut.recordReplication({
 		replicaCount: 0,
 		rywPolicy: "off",
 		rywStore: "memory",
 		region: null,
 		localityEnabled: !1
 	}), d;
-	let p = await ru(i.id);
+	let p = await fu(i.id);
 	if (p === null) return $.warn(`read replicas: no replication adapter for dialect ${i.id}; falling back to primary-only routing`), ut.recordReplication({
 		replicaCount: 0,
 		rywPolicy: "off",
@@ -3700,15 +3745,15 @@ ${a.join("\n\n")}\n`);
 			_ = ir({
 				client: n,
 				subscriber: n.duplicate()
-			}), ee = "redis", $.info(`read replicas: ryw store = redis @ ${eu(e)}`);
+			}), ee = "redis", $.info(`read replicas: ryw store = redis @ ${lu(e)}`);
 		} catch (e) {
 			$.warn("RYW_STORE=redis but ioredis import / connect failed — falling back to memory store", { err: e });
 		}
 	}
 	_ ||= Zn();
-	let te = tu(f.length), ne = cr(), re = ne && te.length > 0 ? vn({
+	let te = uu(f.length), ne = cr(), re = ne && te.length > 0 ? vn({
 		currentRegion: ne,
-		replicaRegions: nu(m, te),
+		replicaRegions: du(m, te),
 		inner: tr()
 	}) : tr();
 	return $.info(`read replicas: ${m.length} configured, ryw policy '${h}', dialect=${i.id}, region=${ne ?? "unknown"}` + (te.length > 0 ? ", replica-locality=on" : "")), ut.recordReplication({
@@ -3725,33 +3770,33 @@ ${a.join("\n\n")}\n`);
 		rywStore: _,
 		replicaSelector: re
 	});
-}, $l = async (e, t, n, r) => {
-	let i = wa(t?.plugins ?? []), a = n === "postgres" || n === "mysql" || n === "mariadb", o = n === "postgres" ? "LISTEN/NOTIFY" : "binlog CDC";
+}, cu = async (e, t, n, r) => {
+	let i = Da(t?.plugins ?? []), a = n === "postgres" || n === "mysql" || n === "mariadb", o = n === "postgres" ? "LISTEN/NOTIFY" : "binlog CDC";
 	if (!i) return n === "memory" || n === "sqlite" || n === "turso" ? r.info(`reactivity: single-instance (${n}) — no cross-replica fan-out needed`) : a ? r.info(`reactivity: cross-instance via native ${o} (${n})`) : r.warn(`reactivity: cross-instance fan-out is OFF for dialect '${n}'. A write on one replica will NOT reach clients on other replicas. Add @voltro/plugin-broadcast (Redis / NATS) to close the gap, or use postgres (LISTEN/NOTIFY) / mariadb (binlog CDC).`), null;
 	let s = process.env.POD_NAME ?? process.env.HOSTNAME ?? `dev-${process.pid}`;
-	return i.broadcast.crossReplica ? a ? r.info(`reactivity: native ${o} (${n}) + @voltro/plugin-broadcast (${i.broadcast.provider.name}) — both paths active (own-origin skip dedups)`) : r.info(`reactivity: cross-instance via @voltro/plugin-broadcast (${i.broadcast.provider.name}) for dialect '${n}'`) : r.warn("reactivity: @voltro/plugin-broadcast resolved to the in-process memory provider — NO real cross-replica fan-out. Set BROADCAST_URL (redis:// or nats://) for a real bus."), await Ca({
+	return i.broadcast.crossReplica ? a ? r.info(`reactivity: native ${o} (${n}) + @voltro/plugin-broadcast (${i.broadcast.provider.name}) — both paths active (own-origin skip dedups)`) : r.info(`reactivity: cross-instance via @voltro/plugin-broadcast (${i.broadcast.provider.name}) for dialect '${n}'`) : r.warn("reactivity: @voltro/plugin-broadcast resolved to the in-process memory provider — NO real cross-replica fan-out. Set BROADCAST_URL (redis:// or nats://) for a real bus."), await Ea({
 		store: e,
 		provider: i.broadcast.provider,
 		replicaId: s,
 		logger: r
 	});
-}, eu = (e) => {
+}, lu = (e) => {
 	try {
 		let t = new URL(e);
 		return t.password &&= "***", t.toString();
 	} catch {
 		return "***";
 	}
-}, tu = (e) => {
+}, uu = (e) => {
 	let t = process.env.DB_REPLICA_REGIONS;
 	if (!t) return [];
 	let n = t.split(",").map((e) => e.trim()).filter((e) => e.length > 0);
 	return n.length === e ? n : ($.warn(`DB_REPLICA_REGIONS has ${n.length} entries but DB_REPLICA_URLS has ${e} — region awareness disabled. Provide one region per replica in the same order.`), []);
-}, nu = (e, t) => {
+}, du = (e, t) => {
 	let n = /* @__PURE__ */ new Map();
 	for (let r = 0; r < e.length && r < t.length; r++) n.set(e[r], t[r]);
 	return n;
-}, ru = async (e) => {
+}, fu = async (e) => {
 	switch (e) {
 		case "postgres": return (await v("@voltro/sql-postgres")).postgresReplicationAdapter();
 		case "mysql":
@@ -3759,11 +3804,11 @@ ${a.join("\n\n")}\n`);
 		case "mssql": return (await v("@voltro/sql-mssql")).mssqlReplicationAdapter();
 		default: return null;
 	}
-}, iu = async (e) => {
+}, pu = async (e) => {
 	let t = A(e.find((e) => !e.startsWith("-")) ?? process.cwd()), n = await _(t);
-	return n.ran ? n.exitCode : process.env.FRAMEWORK_DEV_INNER !== "1" && process.env.WATCH !== "0" ? (m(lo({ root: t }), { scope: "voltro:dev" }), new Promise(() => {})) : au(t);
-}, au = async (m) => {
-	let _ = Date.now(), v = await Wl(m), b = Number(process.env.PORT ?? v?.port ?? 4e3), le = v?.name ?? E(m), x = c("api", le, b), ue = i(le);
+	return n.ran ? n.exitCode : process.env.FRAMEWORK_DEV_INNER !== "1" && process.env.WATCH !== "0" ? (m(go({ root: t }), { scope: "voltro:dev" }), new Promise(() => {})) : mu(t);
+}, mu = async (m) => {
+	let _ = Date.now(), v = await $l(m), b = Number(process.env.PORT ?? v?.port ?? 4e3), le = v?.name ?? E(m), x = c("api", le, b), ue = i(le);
 	await g({
 		id: x,
 		name: le,
@@ -3776,18 +3821,18 @@ ${a.join("\n\n")}\n`);
 	let S = s();
 	l(S), $.info("booting voltro dev", {
 		root: m,
-		version: pl,
+		version: Sl,
 		logFile: ue.path
 	});
 	let he = await se({
 		project: E(m),
-		cliVersion: pl
+		cliVersion: Sl
 	});
 	if (he.kind === "not-personal") return $.error(`voltro dev needs a personal login — the stored credential belongs to no user.
   ${he.message}`), 1;
 	he.kind === "reported" && he.seat === "claimed" && $.info("cloud: this machine now counts toward your organisation's seats (voltro cloud whoami)");
 	let we = process.env.VOLTRO_DEV_HEALTH_PORT, Te = we === void 0 ? b + 1 : Number(we), Ee;
-	Te > 0 && Number.isFinite(Te) && (Ee = await fl({
+	Te > 0 && Number.isFinite(Te) && (Ee = await xl({
 		port: Te,
 		log: {
 			info: (e, t) => $.debug(e, t),
@@ -3801,22 +3846,22 @@ ${a.join("\n\n")}\n`);
 	}).catch((e) => {
 		$.warn("agent-instructions seed failed (non-fatal)", {}, e);
 	});
-	let C = await Tl(m);
+	let C = await Pl(m);
 	$.info(`discovered ${C.length} files`, { count: C.length });
-	let { pluginContributions: De, pluginErrorImports: ke, pluginRpcImports: je } = await Kc(v?.plugins ?? [], v?.name ?? E(m), m), Me = await Ho({
+	let { pluginContributions: De, pluginErrorImports: ke, pluginRpcImports: je } = await tl(v?.plugins ?? [], v?.name ?? E(m), m), Me = await Xo({
 		root: m,
 		...De.length > 0 ? { pluginContributions: De } : {},
 		...ke.length > 0 ? { pluginErrorImports: ke } : {},
 		...je.length > 0 ? { pluginRpcImports: je } : {},
 		...v?.name === void 0 ? {} : { apiName: v.name }
 	});
-	if (Me ? ($.info("codegen wrote rpcGroup", { path: k(m, Me) }), await Co(Me)) : $.debug("codegen skipped — no descriptors discovered"), process.env.VOLTRO_BROWSER_SAFETY !== "off") {
-		let e = await xo(m, C);
-		if (e.length > 0) throw Error(e.map(So).join("\n\n"));
+	if (Me ? ($.info("codegen wrote rpcGroup", { path: k(m, Me) }), await jo(Me)) : $.debug("codegen skipped — no descriptors discovered"), process.env.VOLTRO_BROWSER_SAFETY !== "off") {
+		let e = await ko(m, C);
+		if (e.length > 0) throw Error(e.map(Ao).join("\n\n"));
 	}
-	let Ne = Zl(v ?? null), Pe = Ne === "mariadb" ? "mariadb" : Ne === "mssql" ? "mssql" : void 0, Le = Pe !== void 0 && (process.env.CDC ?? "1") !== "0", { queries: w, mutations: D, actions: A, streams: dt, workflows: j, workflowWorkers: ft, eventTriggers: mt, schedules: M, connections: ht, tables: gt, featureMix: vt, tenantScopedTables: yt, softDeleteScopedTables: bt } = await Ul(C, { cdc: Le }), xt = j.length > 0 || mt.length > 0, F = await Wl(m), wt = Ja(F?.http ?? {});
+	let Ne = ou(v ?? null), Pe = Ne === "mariadb" ? "mariadb" : Ne === "mssql" ? "mssql" : void 0, Le = Pe !== void 0 && (process.env.CDC ?? "1") !== "0", { queries: w, mutations: D, actions: A, streams: dt, workflows: j, workflowWorkers: ft, eventTriggers: mt, schedules: M, connections: ht, tables: gt, featureMix: vt, tenantScopedTables: yt, softDeleteScopedTables: bt } = await Ql(C, { cdc: Le }), xt = j.length > 0 || mt.length > 0, F = await $l(m), wt = Xa(F?.http ?? {});
 	gr(lr(F?.secrets));
-	let I = Aa(Ui(F?.env) ? F.env : void 0, m);
+	let I = Ma(Ki(F?.env) ? F.env : void 0, m);
 	I.minted.length > 0 && I.file !== void 0 && ($.warn(`minted ${I.minted.length} project secret(s) into ${k(m, I.file)} — unique to this project, gitignored. Your DEPLOYMENT needs its own values (\`voltro secret generate\`).`, {
 		keys: I.minted,
 		file: k(m, I.file)
@@ -3836,7 +3881,7 @@ ${a.join("\n\n")}\n`);
 			"apikeys:issue:other"
 		].some((t) => e.has(t)) && !e.has("admin:full") && $.warn("apiKeys is enabled but no role declares any of apikeys:issue:self / :org / :other. The management routes are mounted and every issue request will fail its guard — the capability is on and reachable by nobody. Grant the right one in your role map (`:self` lets a user mint their own key, `:org` a shared one, `:other` on behalf of a colleague).");
 	}
-	let Et = (typeof Tt == "object" ? Tt.prefix : void 0) ?? "voltro_", Dt, Ot = Tt ? [sn({ resolveByHash: (e, t) => Dt ? Dt.resolveByHash(e, t) : Promise.resolve(null) }, { prefix: Et })] : [], kt = _l([...F?.auth?.strategies ?? [], ...Ot], sa(F?.plugins ?? []), F?.auth?.anonymousTenantRequired ?? !1, F?.auth?.resolveScopes, () => L.current), At = yl(kt), jt = _e({
+	let Et = (typeof Tt == "object" ? Tt.prefix : void 0) ?? "voltro_", Dt, Ot = Tt ? [sn({ resolveByHash: (e, t) => Dt ? Dt.resolveByHash(e, t) : Promise.resolve(null) }, { prefix: Et })] : [], kt = El([...F?.auth?.strategies ?? [], ...Ot], ua(F?.plugins ?? []), F?.auth?.anonymousTenantRequired ?? !1, F?.auth?.resolveScopes, () => L.current), At = Ol(kt), jt = _e({
 		mix: vt,
 		plugins: F?.plugins ?? [],
 		cdc: Le,
@@ -3849,8 +3894,8 @@ ${a.join("\n\n")}\n`);
 		}
 		return t;
 	})();
-	for (let e of z) $r(e);
-	let It = bc({
+	for (let e of z) ni(e);
+	let It = kc({
 		plugins: F?.plugins ?? [],
 		appName: F?.name ?? E(m),
 		appType: "api",
@@ -3858,12 +3903,12 @@ ${a.join("\n\n")}\n`);
 		log: $
 	});
 	F?.plugins?.length && ($.info("plugins loaded", { plugins: F.plugins.map((e) => e.name) }), await It.activate());
-	let Lt = await It.gatherObservability(), Rt = Oc(F?.plugins ?? []);
+	let Lt = await It.gatherObservability(), Rt = Lc(F?.plugins ?? []);
 	Rt.endpoints.length > 0 && $.info("plugin inspect endpoints registered", {
 		count: Rt.endpoints.length,
 		endpoints: Rt.endpoints.map((e) => `${e.method} ${e.path}`)
 	});
-	let zt = zc(F?.plugins ?? []);
+	let zt = Jc(F?.plugins ?? []);
 	zt.length > 0 && $.info("plugin dashboard mounts registered", {
 		count: zt.length,
 		mounts: zt.map((e) => `${e.fullId} (${e.slot})`)
@@ -3905,7 +3950,7 @@ ${a.join("\n\n")}\n`);
 	if (an.length > 0) {
 		let e = await ye(an, $t);
 		on = e.agents.map((e) => e.descriptor.name);
-		for (let t of e.agents) for (let e of ac(t)) e.kind === "action" ? A.push({
+		for (let t of e.agents) for (let e of mc(t)) e.kind === "action" ? A.push({
 			file: e.file,
 			descriptor: e.descriptor,
 			executor: e.executor
@@ -3919,16 +3964,16 @@ ${a.join("\n\n")}\n`);
 			routes: e.agents.flatMap((e) => [`${e.descriptor.name}.send`, `${e.descriptor.name}.messages`])
 		});
 	}
-	let cn = sc();
+	let cn = gc();
 	(cn.queries.length > 0 || cn.mutations.length > 0) && (w.push(...cn.queries), D.push(...cn.mutations), $.info("undo built-ins registered", { routes: [
 		"__voltro.undo.log",
 		"__voltro.undo.apply",
 		"__voltro.undo.redo"
 	] }));
-	let dn = $.child("aggregate"), mn = C.filter((e) => Re.test(e)), hn = mn.length > 0 ? await Ts(mn, dn) : [], gn = hn.map((e) => e.definition.name);
-	for (let e of Qr()) $.warn(`identifier length · ${e}`);
-	let vn = F?.restRoutes ?? [], wn = C.filter((e) => Ae.test(e)).length, Dn = C.filter((e) => ze.test(e)).length, On = C.filter((e) => /\.seed\.ts$/.test(e)).length, kn = C.filter((e) => Oe.test(e)).length, jn = C.filter((e) => nc.test(e)).length;
-	Wo(Uo([
+	let dn = $.child("aggregate"), mn = C.filter((e) => Re.test(e)), hn = mn.length > 0 ? await Ps(mn, dn) : [], gn = hn.map((e) => e.definition.name);
+	for (let e of ti()) $.warn(`identifier length · ${e}`);
+	let vn = F?.restRoutes ?? [], wn = C.filter((e) => Ae.test(e)).length, Dn = C.filter((e) => ze.test(e)).length, On = C.filter((e) => /\.seed\.ts$/.test(e)).length, kn = C.filter((e) => Oe.test(e)).length, jn = C.filter((e) => dc.test(e)).length;
+	Qo(Zo([
 		w,
 		D,
 		A,
@@ -3989,13 +4034,13 @@ ${a.join("\n\n")}\n`);
 		...Lt.sampler === void 0 ? {} : { sampler: Lt.sampler }
 	});
 	qn.mode === "off" ? qn.bufferOnly || $.info("tracing disabled", { reason: "buffer off" }) : $.info("tracing enabled", { mode: qn.mode });
-	let Zn = qn.mode === "off" && qn.bufferOnly === !1 ? void 0 : qn.layer, B = await Ql(F, Zn);
-	L.current = B;
-	for (let e of Ra({
-		dialect: Zl(F ?? null),
+	let Zn = qn.mode === "off" && qn.bufferOnly === !1 ? void 0 : qn.layer, B = await su(F, Zn);
+	L.current = Dr(B, ou(F ?? null));
+	for (let e of Ba({
+		dialect: ou(F ?? null),
 		changeStrategy: (process.env.CDC ?? "1") === "0" ? "inline" : "cdc",
 		dbUrl: process.env.DB_URL,
-		tables: Yr().map((e) => ({
+		tables: Qr().map((e) => ({
 			tableName: e.tableName,
 			isReactive: e.isReactive === !0
 		})),
@@ -4013,17 +4058,17 @@ ${a.join("\n\n")}\n`);
 			usage: t
 		}), $.info("api keys active", { prefix: Et });
 	}
-	let $n = ds({
+	let $n = vs({
 		definitions: ht.map((e) => e.definition),
 		store: B,
-		publicUrl: ps(b),
+		publicUrl: bs(b),
 		log: $.child("connections")
 	});
 	w.push(...$n.queries), D.push(...$n.mutations), A.push(...$n.actions);
-	let tr = Zl(F), ir = process.env.POD_NAME ?? process.env.HOSTNAME ?? `dev-${process.pid}`, ar, or;
+	let tr = ou(F), ir = process.env.POD_NAME ?? process.env.HOSTNAME ?? `dev-${process.pid}`, ar, or;
 	if (tr !== "memory") {
 		let e = await y(tr);
-		ar = _t.make(e.makeSqlLayer(Gl())), or = await ar.runPromise(V.SqlClient);
+		ar = _t.make(e.makeSqlLayer(eu())), or = await ar.runPromise(Mr.SqlClient);
 	}
 	let cr = An({
 		coordinator: [
@@ -4042,34 +4087,34 @@ ${a.join("\n\n")}\n`);
 		}
 	};
 	for (let e of F?.plugins ?? []) e.bindDataStore?.(B, fr);
-	let pr = await $l(B, F, Zl(F), $);
+	let pr = await cu(B, F, ou(F), $);
 	F?.cache && !process.env.CACHE_BACKEND && (process.env.CACHE_BACKEND = F.cache), F?.cacheRedisUrl && !process.env.CACHE_REDIS_URL && (process.env.CACHE_REDIS_URL = F.cacheRedisUrl), F?.cacheRedisDriver && !process.env.CACHE_REDIS_DRIVER && (process.env.CACHE_REDIS_DRIVER = F.cacheRedisDriver), F?.cacheKeyPrefix && !process.env.CACHE_KEY_PREFIX && (process.env.CACHE_KEY_PREFIX = F.cacheKeyPrefix);
-	let { service: mr, invalidationBus: hr, snapshotCache: br, cache: Cr, backend: wr, stats: Tr, dispose: Er } = await Ua({ env: process.env });
+	let { service: mr, invalidationBus: hr, snapshotCache: br, cache: Cr, backend: wr, stats: Tr, dispose: Er } = await Ga({ env: process.env });
 	$.info(`cache backend resolved: ${wr}` + (wr === "redis" ? ` (driver ${process.env.CACHE_REDIS_DRIVER ?? "resp"})` : " — in-process, not cross-instance")), F?.kv && !process.env.KV_BACKEND && (process.env.KV_BACKEND = F.kv), F?.kvRedisUrl && !process.env.KV_REDIS_URL && (process.env.KV_REDIS_URL = F.kvRedisUrl), F?.kvKeyPrefix && !process.env.KV_KEY_PREFIX && (process.env.KV_KEY_PREFIX = F.kvKeyPrefix);
-	let { kv: Dr, service: jr, backend: Fr } = await Tn({ store: B });
-	$.info(`kv backend resolved: ${Fr}` + (Fr === "database" ? " (durable, _voltro_kv)" : Fr === "memory" ? " — in-process, non-durable" : ` (driver ${process.env.KV_REDIS_DRIVER ?? "resp"}, non-durable)`));
-	let Kr = Zl(F), qr = F?.analytics !== void 0 && F.analytics.kind !== "noop" && Kr !== "memory" ? (await y(Kr)).makeSqlLayer(Gl()) : void 0, Jr = await Go({
+	let { kv: Or, service: kr, backend: Pr } = await Tn({ store: B });
+	$.info(`kv backend resolved: ${Pr}` + (Pr === "database" ? " (durable, _voltro_kv)" : Pr === "memory" ? " — in-process, non-durable" : ` (driver ${process.env.KV_REDIS_DRIVER ?? "resp"}, non-durable)`));
+	let Rr = ou(F), Yr = F?.analytics !== void 0 && F.analytics.kind !== "noop" && Rr !== "memory" ? (await y(Rr)).makeSqlLayer(eu()) : void 0, Xr = await $o({
 		spec: F?.analytics,
-		sqlLayer: qr,
+		sqlLayer: Yr,
 		log: $
 	});
-	Jr.spec;
-	let ni = Jr.sink, ii = Gt({
+	Xr.spec;
+	let Zr = Xr.sink, ai = Gt({
 		store: B,
-		sink: ni,
+		sink: Zr,
 		log: $
 	});
-	ii.tables.length > 0 && $.info("analytics mirror", {
-		provider: ni.info.provider,
-		tables: ii.tables
+	ai.tables.length > 0 && $.info("analytics mirror", {
+		provider: Zr.info.provider,
+		tables: ai.tables
 	}), process.on("beforeExit", () => {
-		ii.detach();
+		ai.detach();
 	});
-	let ai = Jr.dispose, oi = Zl(F), si;
-	if (oi !== "memory" && process.env.VOLTRO_AUTO_MIGRATE !== "0") {
+	let si = Xr.dispose, ci = ou(F), li;
+	if (ci !== "memory" && process.env.VOLTRO_AUTO_MIGRATE !== "0") {
 		let e = Date.now(), t = (process.env.NODE_ENV ?? "").toLowerCase() === "production" ? "prod" : (process.env.NODE_ENV ?? "").toLowerCase() === "staging" ? "staging" : "dev";
 		$.info("auto-migrate: planning schema", {
-			dialect: oi,
+			dialect: ci,
 			env: t,
 			tables: z.length
 		}), Ee?.set({
@@ -4077,37 +4122,37 @@ ${a.join("\n\n")}\n`);
 			tablesTotal: z.length
 		});
 		try {
-			let n = await y(oi), r = n.makeSqlLayer(Gl());
-			si = r, await na(Il(z.filter((e) => e.tableName.startsWith("_voltro_") || e.tableName === "voltro_isr_cache"), z), r, n.id);
-			let i = Ha({
-				conn: Gl(),
-				pendingIds: await N.runPromise(V.SqlClient.pipe(N.flatMap((e) => $i(e, m)), N.provide(r))),
-				optIn: process.env[za] === "1"
+			let n = await y(ci), r = n.makeSqlLayer(eu());
+			li = r, await aa(Gl(z.filter((e) => e.tableName.startsWith("_voltro_") || e.tableName === "voltro_isr_cache"), z), r, n.id);
+			let i = Wa({
+				conn: eu(),
+				pendingIds: await N.runPromise(Mr.SqlClient.pipe(N.flatMap((e) => na(e, m)), N.provide(r))),
+				optIn: process.env[Va] === "1"
 			});
 			if (!i.allowed) throw $.error(`file-based migrations: ${i.message}`), Error("file-based migrations refused — see error above");
-			let a = await N.runPromise(V.SqlClient.pipe(N.flatMap((e) => ta(e, {
+			let a = await N.runPromise(Mr.SqlClient.pipe(N.flatMap((e) => ia(e, {
 				projectRoot: m,
 				env: t,
 				appliedBy: `boot:${t}`
 			})), N.provide(r)));
 			a.applied.length > 0 && $.info(`file-based migrations: applied ${a.applied.length}`, { applied: a.applied.map((e) => `${e.id} (${e.durationMs}ms)`) });
-			let o = await N.runPromise(V.SqlClient.pipe(N.flatMap((e) => ra(e, z, {
+			let o = await N.runPromise(Mr.SqlClient.pipe(N.flatMap((e) => oa(e, z, {
 				appliedBy: `boot:${t}`,
 				environment: t,
 				dialectId: n.id
 			})), N.provide(r)));
-			if (o.kind === "refused-blocked" || o.kind === "prod-mismatch") throw $.error(Xi(o, n.id)), Error("auto-migrate refused — see error above");
-			$.info(Xi(o, n.id), { durationMs: Date.now() - e });
+			if (o.kind === "refused-blocked" || o.kind === "prod-mismatch") throw $.error($i(o, n.id)), Error("auto-migrate refused — see error above");
+			$.info($i(o, n.id), { durationMs: Date.now() - e });
 		} catch (e) {
 			throw $.error("auto-migrate failed — aborting boot", { err: e }), Ee?.set({
 				phase: "error",
 				error: e instanceof Error ? e.message : String(e)
 			}), e;
 		}
-	} else oi !== "memory" && $.info("auto-migrate: skipped (VOLTRO_AUTO_MIGRATE=0)");
-	let ci = Zl(F);
-	if ((F?.plugins ?? []).some((e) => (e.extendSchema?.migrations?.length ?? 0) > 0) && ci !== "memory") {
-		let e = (await y(ci)).makeSqlLayer(Gl());
+	} else ci !== "memory" && $.info("auto-migrate: skipped (VOLTRO_AUTO_MIGRATE=0)");
+	let ui = ou(F);
+	if ((F?.plugins ?? []).some((e) => (e.extendSchema?.migrations?.length ?? 0) > 0) && ui !== "memory") {
+		let e = (await y(ui)).makeSqlLayer(eu());
 		try {
 			let t = await N.runPromise(pe(F.plugins).pipe(N.provide(e))), n = t.filter((e) => e.status === "applied"), r = t.filter((e) => e.status === "skipped");
 			$.info("plugin migrations complete", {
@@ -4118,108 +4163,108 @@ ${a.join("\n\n")}\n`);
 			throw $.error("plugin migrations failed — aborting boot", { err: e }), e;
 		}
 	}
-	let fi = cl(B, S);
+	let di = _l(B, S);
 	process.on("beforeExit", () => {
-		fi();
+		di();
 	});
 	let hi = Wn(z);
 	_r({
 		dataStore: B,
 		schemaRegistry: hi
 	});
-	let _i = $.child("seeds"), vi = C.filter((e) => /\.seed\.ts$/.test(e)), bi = vi.length > 0 ? await ae(vi, _i) : [];
-	if (bi.length > 0) {
-		_i.info("discovered seeds", { ids: bi.map((e) => e.definition.id) });
-		for (let e of bi) ut.registerSeed(e);
-		let e = await oe(bi, B, _i);
+	let vi = $.child("seeds"), bi = C.filter((e) => /\.seed\.ts$/.test(e)), xi = bi.length > 0 ? await ae(bi, vi) : [];
+	if (xi.length > 0) {
+		vi.info("discovered seeds", { ids: xi.map((e) => e.definition.id) });
+		for (let e of xi) ut.registerSeed(e);
+		let e = await oe(xi, B, vi);
 		for (let t of e) ut.recordSeedResult(t);
 		let t = e.filter((e) => e.status === "failed");
-		t.length > 0 && _i.warn("one or more seeds failed (server continues)", { failedIds: t.map((e) => e.seedId) });
+		t.length > 0 && vi.warn("one or more seeds failed (server continues)", { failedIds: t.map((e) => e.seedId) });
 	}
-	let xi = $.child("startup"), Si = C.filter((e) => ze.test(e)), Ci = Si.length > 0 ? await lt(Si, xi) : [], wi;
-	Ci.length > 0 && (xi.info("discovered startups", { ids: Ci.map((e) => e.id) }), wi = await ct(Ci, B, xi)), wi && process.on("beforeExit", () => {
-		wi.shutdown();
+	let Ci = $.child("startup"), wi = C.filter((e) => ze.test(e)), Ti = wi.length > 0 ? await lt(wi, Ci) : [], Ei;
+	Ti.length > 0 && (Ci.info("discovered startups", { ids: Ti.map((e) => e.id) }), Ei = await ct(Ti, B, Ci)), Ei && process.on("beforeExit", () => {
+		Ei.shutdown();
 	});
-	let Ei = $.child("subscribe"), ki = C.filter((e) => Ae.test(e)), Ai = ki.length > 0 ? await is(ki, Ei) : [], ji;
-	Ai.length > 0 && (Ei.info("discovered subscribers", { subscribers: Ai.map((e) => `${e.id}@${e.definition.table}`) }), ji = as(Ai, B, Ei, hi)), ji && process.on("beforeExit", () => {
-		ji();
+	let Di = $.child("subscribe"), ki = C.filter((e) => Ae.test(e)), Mi = ki.length > 0 ? await fs(ki, Di) : [], Ni;
+	Mi.length > 0 && (Di.info("discovered subscribers", { subscribers: Mi.map((e) => `${e.id}@${e.definition.table}`) }), Ni = ps(Mi, B, Di, hi)), Ni && process.on("beforeExit", () => {
+		Ni();
 	}), un(), vr((e) => _n(B, e.subjectId, e.resourceType, e.resourceId));
-	let Mi = $.child("outbox"), Wi = C.filter((e) => Fe.test(e)), Gi = Wi.length > 0 ? await ss(Wi, Mi) : [], Ki = Gi.length > 0 ? cs({
-		handlers: Gi,
+	let Pi = $.child("outbox"), Fi = C.filter((e) => Fe.test(e)), qi = Fi.length > 0 ? await hs(Fi, Pi) : [], Ji = qi.length > 0 ? gs({
+		handlers: qi,
 		store: B,
-		log: Mi
+		log: Pi
 	}) : void 0;
-	Ki && process.on("beforeExit", () => {
-		Ki.stop();
+	Ji && process.on("beforeExit", () => {
+		Ji.stop();
 	});
-	let qi = ys(), Ji = Zl(F);
-	if (hn.length > 0 && Ji !== "memory") try {
-		qi = Cs((await y(Ji)).makeSqlLayer(Gl()));
+	let Yi = Ds(), Xi = ou(F);
+	if (hn.length > 0 && Xi !== "memory") try {
+		Yi = Ms((await y(Xi)).makeSqlLayer(eu()));
 	} catch (e) {
 		dn.warn("aggregate: SQL storage init failed — falling back to in-process", { err: e });
 	}
-	let ia = Ji === "memory" ? yr : bn(B, `aggregate@${process.pid}`, dn), aa = hn.length > 0 ? await Ls({
+	let Zi = Xi === "memory" ? yr : bn(B, `aggregate@${process.pid}`, dn), sa = hn.length > 0 ? await Ks({
 		discovered: hn,
 		store: B,
-		analytics: ni,
-		storage: qi,
-		coordinator: ia,
+		analytics: Zr,
+		storage: Yi,
+		coordinator: Zi,
 		log: dn
 	}) : {
-		registry: Rs,
+		registry: qs,
 		detach: () => {},
 		registered: []
 	};
-	aa.registered.length > 0 && dn.info("aggregates registered", {
-		names: aa.registered,
-		storage: Ji === "memory" ? "in-process" : "sql-backed",
-		coordination: ia.kind
+	sa.registered.length > 0 && dn.info("aggregates registered", {
+		names: sa.registered,
+		storage: Xi === "memory" ? "in-process" : "sql-backed",
+		coordination: Zi.kind
 	}), process.on("beforeExit", () => {
-		aa.detach();
+		sa.detach();
 	});
-	let U = Zl(F), oa, ua = F?.scheduling ?? {}, da = ua.trigger ?? "self", fa = ua.coordination ?? ([
+	let H = ou(F), ca, la = F?.scheduling ?? {}, pa = la.trigger ?? "self", ma = la.coordination ?? ([
 		"postgres",
 		"mariadb",
 		"mysql",
 		"mssql"
-	].includes(U) ? "advisoryLock" : "single"), pa = fa === "cluster" && (/* @__PURE__ */ new Set([
+	].includes(H) ? "advisoryLock" : "single"), ha = ma === "cluster" && (/* @__PURE__ */ new Set([
 		"postgres",
 		"mysql",
 		"mariadb",
 		"mssql"
-	])).has(U), ma = pa ? M.filter((e) => (e.trigger ?? da) === "self").map((e) => Vr({
+	])).has(H), ga = ha ? M.filter((e) => (e.trigger ?? pa) === "self").map((e) => Wr({
 		name: e.name,
 		cron: Qt(e),
 		execute: async () => {
-			await oa?.fireFromCluster(e.name);
+			await ca?.fireFromCluster(e.name);
 		}
-	})) : [], ya = await (async () => {
-		if (U === "memory") return Ar.layerMemory;
-		let e = await y(U), t = e.makeSqlLayer(Gl()), n = Wr({ sqliteFamily: ti(e.id) });
-		if ($.info(`workflow engine: cluster-${n}, dialect=${e.id}` + (n === "memory" ? " — single-process durable replay, no horizontal scaling" + (ti(e.id) ? "" : " (VOLTRO_WORKFLOW_RUNNER_STORAGE=memory: SqlRunnerStorage/cluster_runners + GET_LOCK skipped)") : "")), e.id === "mssql") {
-			let e = await es(process.cwd());
+	})) : [], _a = await (async () => {
+		if (H === "memory") return Nr.layerMemory;
+		let e = await y(H), t = e.makeSqlLayer(eu()), n = qr({ sqliteFamily: ii(e.id) });
+		if ($.info(`workflow engine: cluster-${n}, dialect=${e.id}` + (n === "memory" ? " — single-process durable replay, no horizontal scaling" + (ii(e.id) ? "" : " (VOLTRO_WORKFLOW_RUNNER_STORAGE=memory: SqlRunnerStorage/cluster_runners + GET_LOCK skipped)") : "")), e.id === "mssql") {
+			let e = await cs(process.cwd());
 			e && $.warn(e);
 		}
-		return Gr({
+		return Jr({
 			sqlClientLayer: t,
 			runnerStorage: n,
 			dialectId: e.id,
 			...process.env.VOLTRO_WORKFLOW_RUNNER_PORT ? { runnerListenPort: Number(process.env.VOLTRO_WORKFLOW_RUNNER_PORT) } : {},
-			...ma.length > 0 ? { extraShardingLayers: ma } : {}
+			...ga.length > 0 ? { extraShardingLayers: ga } : {}
 		});
 	})();
-	$.info("workflow engine selected", { engine: U === "postgres" ? "cluster-postgres" : "in-memory" });
-	let xa, Ca = /* @__PURE__ */ new Map(), wa = () => `wfctx_${globalThis.crypto?.randomUUID?.() ?? `${Date.now().toString(36)}${Math.random().toString(36).slice(2)}`}`, Ea = async (e, t, n) => {
+	$.info("workflow engine selected", { engine: H === "postgres" ? "cluster-postgres" : "in-memory" });
+	let Sa, wa = /* @__PURE__ */ new Map(), Ea = () => `wfctx_${globalThis.crypto?.randomUUID?.() ?? `${Date.now().toString(36)}${Math.random().toString(36).slice(2)}`}`, Da = async (e, t, n) => {
 		let r = {
 			...n,
 			source: n.source ?? `workflow:${e}`
 		};
-		Ca.set(t, r);
+		wa.set(t, r);
 		try {
 			let n = await B.query({
 				table: "_voltro_workflow_start_contexts",
 				order: [],
-				predicate: H("executionId", t),
+				predicate: V("executionId", t),
 				projection: ["id"],
 				skip: void 0,
 				take: 1
@@ -4234,7 +4279,7 @@ ${a.join("\n\n")}\n`);
 				createdAt: /* @__PURE__ */ new Date()
 			};
 			n[0] === void 0 ? await B.insert("_voltro_workflow_start_contexts", {
-				id: wa(),
+				id: Ea(),
 				...i
 			}) : await B.update("_voltro_workflow_start_contexts", n[0].id, i);
 		} catch (n) {
@@ -4244,14 +4289,14 @@ ${a.join("\n\n")}\n`);
 				reason: n?.message ?? String(n)
 			});
 		}
-	}, Da = async (e, t) => {
-		let n = Ca.get(t);
+	}, ka = async (e, t) => {
+		let n = wa.get(t);
 		if (n !== void 0) return n;
 		try {
 			let e = (await B.query({
 				table: "_voltro_workflow_start_contexts",
 				order: [],
-				predicate: H("executionId", t),
+				predicate: V("executionId", t),
 				projection: void 0,
 				skip: void 0,
 				take: 1
@@ -4270,7 +4315,7 @@ ${a.join("\n\n")}\n`);
 				...e.parentExecutionId === null ? {} : { parentExecutionId: e.parentExecutionId },
 				...e.parentClosePolicy === null ? {} : { parentClosePolicy: e.parentClosePolicy }
 			};
-			return Ca.set(t, r), r;
+			return wa.set(t, r), r;
 		} catch (e) {
 			$.warn("workflow.startContext.resolve failed", {
 				executionId: t,
@@ -4278,26 +4323,26 @@ ${a.join("\n\n")}\n`);
 			});
 			return;
 		}
-	}, W = j.length > 0 ? Fn(() => xa) : void 0, Oa = $.child("webhooks"), ka = C.filter((e) => Oe.test(e)), G = ka.length > 0 ? await tc(ka, Oa) : {
+	}, U = j.length > 0 ? Fn(() => Sa) : void 0, W = $.child("webhooks"), Aa = C.filter((e) => Oe.test(e)), G = Aa.length > 0 ? await uc(Aa, W) : {
 		outgoing: [],
 		incoming: [],
 		providers: []
 	};
-	G.outgoing.length + G.incoming.length + G.providers.length > 0 && Oa.info("discovered webhooks", {
+	G.outgoing.length + G.incoming.length + G.providers.length > 0 && W.info("discovered webhooks", {
 		outgoing: G.outgoing.map((e) => e.descriptor.id),
 		incoming: G.incoming.map((e) => e.descriptor.id),
 		providers: G.providers.map((e) => e.descriptor.id)
 	});
-	let ja = C.filter((e) => nc.test(e));
+	let ja = C.filter((e) => dc.test(e));
 	if (ja.length > 0) {
-		let e = $.child("mail"), t = await rc(ja, e);
-		t.templates.length > 0 && (Sa(t.templates.map((e) => e.template)), e.info("discovered email templates", { templates: t.templates.map((e) => e.template.name) }));
+		let e = $.child("mail"), t = await fc(ja, e);
+		t.templates.length > 0 && (Ta(t.templates.map((e) => e.template)), e.info("discovered email templates", { templates: t.templates.map((e) => e.template.name) }));
 	}
-	let Ma = /* @__PURE__ */ new Map();
+	let Na = /* @__PURE__ */ new Map();
 	for (let e of G.incoming) {
-		let t = e.descriptor.path ?? _a(e.descriptor.id), n = `VOLTRO_WEBHOOK_SECRET_${e.descriptor.id.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`, r = ba(e.descriptor, {
+		let t = e.descriptor.path ?? ba(e.descriptor.id), n = `VOLTRO_WEBHOOK_SECRET_${e.descriptor.id.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`, r = Ca(e.descriptor, {
 			resolveSecret: async () => process.env[n] ?? null,
-			resolveWorkflows: () => W === void 0 ? void 0 : Yn(W, {
+			resolveWorkflows: () => U === void 0 ? void 0 : Yn(U, {
 				traceId: `incoming:${e.descriptor.id}`,
 				source: `incoming:${e.descriptor.id}`
 			}),
@@ -4309,36 +4354,36 @@ ${a.join("\n\n")}\n`);
 					idempotency: e.idempotency,
 					durationMs: e.durationMs
 				};
-				e.status >= 500 ? Oa.error("incoming delivery failed", t) : e.status >= 400 ? Oa.warn("incoming delivery rejected", t) : Oa.info("incoming delivery handled", t);
+				e.status >= 500 ? W.error("incoming delivery failed", t) : e.status >= 400 ? W.warn("incoming delivery rejected", t) : W.info("incoming delivery handled", t);
 			}
 		});
-		Ma.set(t, r), Oa.info("mounted incoming webhook", {
+		Na.set(t, r), W.info("mounted incoming webhook", {
 			id: e.descriptor.id,
 			path: t,
 			secretEnvKey: n
 		});
 	}
-	let Na = $.child("reaction"), Pa = C.filter((e) => Ie.test(e)), Ia = Pa.length > 0 ? await hs(Pa, Na) : [], La;
-	Ia.length > 0 && (Na.info("discovered reactions", { reactions: Ia.map((e) => `${e.definition.name}@${e.definition.watch.table}`) }), La = _s(Ia, B, {
+	let Pa = $.child("reaction"), Fa = C.filter((e) => Ie.test(e)), Ia = Fa.length > 0 ? await Ss(Fa, Pa) : [], Ra;
+	Ia.length > 0 && (Pa.info("discovered reactions", { reactions: Ia.map((e) => `${e.definition.name}@${e.definition.watch.table}`) }), Ra = ws(Ia, B, {
 		runAct: async (e, t) => {
 			if (e.kind === "workflow") {
-				if (W === void 0) {
-					Na.warn("reaction workflow act skipped — no workflow engine in this app", { workflow: e.workflow });
+				if (U === void 0) {
+					Pa.warn("reaction workflow act skipped — no workflow engine in this app", { workflow: e.workflow });
 					return;
 				}
 				let n = t.new ?? t.old ?? {};
-				await Yn(W, {
+				await Yn(U, {
 					traceId: `reaction:${e.workflow}`,
 					source: `reaction:${e.workflow}`
 				}).start(e.workflow, n);
 				return;
 			}
-			await gs(e.agent, t, {
+			await Cs(e.agent, t, {
 				findAgentSend: (e) => A.find((t) => t.descriptor.name === `${e}.send`),
 				runAction: (e, t, n) => Promise.resolve(Po(e, t, n)),
-				makeSubject: (e) => gi(e),
+				makeSubject: (e) => yi(e),
 				now: () => Date.now(),
-				log: Na
+				log: Pa
 			});
 		},
 		checkBudget: async (e, t) => {
@@ -4349,13 +4394,13 @@ ${a.join("\n\n")}\n`);
 					limitUsd: t
 				}))))._tag === "Right";
 			} catch (t) {
-				return Na.warn("reaction budget check failed — refusing the act", { tenantId: e }, t), !1;
+				return Pa.warn("reaction budget check failed — refusing the act", { tenantId: e }, t), !1;
 			}
 		}
-	}, Na)), La && process.on("beforeExit", () => {
-		La();
+	}, Pa)), Ra && process.on("beforeExit", () => {
+		Ra();
 	});
-	let Ba = 0, K = new Ft({
+	let za = 0, K = new Ft({
 		store: B,
 		cache: br,
 		recordDelivery: (e) => {
@@ -4366,7 +4411,7 @@ ${a.join("\n\n")}\n`);
 				rowCount: e.rowCount
 			}), Gn({
 				traceId: e.traceId,
-				spanId: (Ba++).toString(16).padStart(16, "0"),
+				spanId: (za++).toString(16).padStart(16, "0"),
 				parentSpanId: e.parentSpanId ?? null,
 				name: `${e.label}.${e.kind}`,
 				kind: "internal",
@@ -4380,10 +4425,10 @@ ${a.join("\n\n")}\n`);
 				status: "ok"
 			});
 		}
-	}), Va = () => {
+	}), Ha = () => {
 		let e = K.subscriptionSnapshot(), t = K.matcherStats(), n = e.map((e) => {
 			let t = [];
-			for (let n of li(e.predicate)) n.conjunctive && t.push(n.column);
+			for (let n of fi(e.predicate)) n.conjunctive && t.push(n.column);
 			return {
 				fingerprint: e.fingerprint,
 				table: e.table,
@@ -4399,10 +4444,10 @@ ${a.join("\n\n")}\n`);
 			capturedAt: Date.now()
 		});
 	};
-	K.onSubscriptionsChange(Va), Va();
-	let Xa = $.child("store"), Qa = (F?.plugins ?? []).filter((e) => typeof e.onChangeEvent == "function"), $a = B.changeScope ?? "local";
+	K.onSubscriptionsChange(Ha), Ha();
+	let Ua = $.child("store"), Qa = (F?.plugins ?? []).filter((e) => typeof e.onChangeEvent == "function"), eo = B.changeScope ?? "local";
 	B.onChange((e) => {
-		if (Xa.debug(`${e.op} on ${e.table}`, {
+		if (Ua.debug(`${e.op} on ${e.table}`, {
 			op: e.op,
 			table: e.table
 		}), rr({
@@ -4417,10 +4462,10 @@ ${a.join("\n\n")}\n`);
 				new: e.new ?? null,
 				old: e.old ?? null,
 				...e.origin === void 0 ? {} : { origin: e.origin },
-				changeScope: $a
+				changeScope: eo
 			};
 			for (let n of Qa) {
-				let r = Xa.child(`plugin:${n.name}`);
+				let r = Ua.child(`plugin:${n.name}`);
 				N.runFork(n.onChangeEvent(t).pipe(N.catchAllCause((t) => N.sync(() => r.warn("onChangeEvent failed", {
 					table: e.table,
 					op: e.op
@@ -4428,59 +4473,59 @@ ${a.join("\n\n")}\n`);
 			}
 		}
 	});
-	let eo = j.map((e) => Or.make(e.definition.name, {
+	let to = j.map((e) => Ar.make(e.definition.name, {
 		payload: e.definition.payloadSchema,
-		success: pi,
+		success: gi,
 		error: e.definition.errorSchema
-	})), to = xt ? [
-		Di(Ri),
-		Di(Bi),
-		Di(zi),
-		Di(Li),
-		Di(Pi),
-		Di(Fi),
-		mi(Ni),
-		mi(Ii),
-		mi(Vi),
-		mi(Hi)
-	] : [], no = (F?.plugins ?? []).flatMap((e) => (e.errorSchemas ?? []).map((e) => e.schema)), ro = no.length > 0 ? no : void 0, io = [
-		...w.map((e) => Di(e.descriptor, ro)),
-		...D.map((e) => Ti(e.descriptor, ro)),
-		...A.map((e) => mi(e.descriptor, ro)),
-		...dt.map((e) => Oi(e.descriptor, ro)),
-		...eo,
-		...to
-	], ao = kr.make(...io).middleware(ui).middleware(di), oo = F?.layers ?? [], so = (F?.plugins ?? []).map((e) => e.services).filter((e) => e !== void 0), co = P.succeed(Mt, aa.registry), lo = P.mergeAll(Ya({
-		analyticsLayer: Jr.layer,
+	})), no = xt ? [
+		Ai(Vi),
+		Ai(Ui),
+		Ai(Hi),
+		Ai(Bi),
+		Ai(Li),
+		Ai(Ri),
+		_i(Ii),
+		_i(zi),
+		_i(Wi),
+		_i(Gi)
+	] : [], ro = (F?.plugins ?? []).flatMap((e) => (e.errorSchemas ?? []).map((e) => e.schema)), io = ro.length > 0 ? ro : void 0, ao = [
+		...w.map((e) => Ai(e.descriptor, io)),
+		...D.map((e) => Oi(e.descriptor, io)),
+		...A.map((e) => _i(e.descriptor, io)),
+		...dt.map((e) => ji(e.descriptor, io)),
+		...to,
+		...no
+	], oo = jr.make(...ao).middleware(pi).middleware(mi), q = F?.layers ?? [], so = (F?.plugins ?? []).map((e) => e.services).filter((e) => e !== void 0), co = P.succeed(Mt, sa.registry), lo = P.mergeAll(Za({
+		analyticsLayer: Xr.layer,
 		cacheService: mr,
-		kvService: jr,
+		kvService: kr,
 		pluginServices: so,
-		userLayers: oo
+		userLayers: q
 	}), co);
-	(oo.length > 0 || so.length > 0) && $.info("layers loaded", {
-		userLayers: oo.length,
+	(q.length > 0 || so.length > 0) && $.info("layers loaded", {
+		userLayers: q.length,
 		pluginLayers: so.length
 	});
 	let uo = (e, t) => dr(e.pipe(N.provide(Nn(t)), N.provide(lo), N.provide(wt)));
 	if ((process.env.VOLTRO_INDEX_AUDIT ?? "on") !== "off") {
-		let e = Zr(z), t = process.stdout.isTTY === !0 && (process.env.NO_COLOR ?? "") === "";
-		for (let n of e) $.warn("\n" + ei(n, {
+		let e = ei(z), t = process.stdout.isTTY === !0 && (process.env.NO_COLOR ?? "") === "";
+		for (let n of e) $.warn("\n" + ri(n, {
 			color: t,
 			indent: "  "
 		}));
 	}
-	let q;
+	let J;
 	if (G.outgoing.length > 0) {
-		let e = Ga({
+		let e = qa({
 			store: B,
 			schemaRegistry: hi,
 			cache: Cr,
-			kv: Dr
+			kv: Or
 		}), t = G.outgoing.map((e) => e.descriptor);
-		q = ga(e, async (n) => {
-			let r = va.execute(n).pipe(N.provide(va.toLayer(ha(e, { events: t })).pipe(P.provideMerge(ya))));
+		J = ya(e, async (n) => {
+			let r = xa.execute(n).pipe(N.provide(xa.toLayer(va(e, { events: t })).pipe(P.provideMerge(_a))));
 			N.runPromise(r).catch((e) => {
-				Oa.error("deliverWebhook workflow crashed", {
+				W.error("deliverWebhook workflow crashed", {
 					deliveryId: n.deliveryId,
 					targetId: n.targetId
 				}, e);
@@ -4489,32 +4534,32 @@ ${a.join("\n\n")}\n`);
 	}
 	let fo = (process.env.VOLTRO_TENANT_ISOLATION ?? F?.tenancy?.isolation) === "namespace";
 	fo && $.info("multi-tenancy: PHYSICAL namespace isolation ON — each request runs against its tenant's own namespace (schema/database/attached file). Requests without a resolvable tenant fail closed.");
-	let po = Ka({
+	let po = Ja({
 		store: B,
 		schemaRegistry: hi,
 		cache: Cr,
-		kv: Dr,
-		...q === void 0 ? {} : { webhooksService: q },
-		...W === void 0 ? {} : { workflowsProxy: W },
+		kv: Or,
+		...J === void 0 ? {} : { webhooksService: J },
+		...U === void 0 ? {} : { workflowsProxy: U },
 		eventTriggers: mt,
 		namespaceIsolationOn: fo,
 		onEventEmit: (e, t) => S.emit(e, t),
-		...Ki === void 0 ? {} : { outbox: { nudge: Ki.nudge } },
+		...Ji === void 0 ? {} : { outbox: { nudge: Ji.nudge } },
 		...$n.active ? { connections: { registry: $n.registry } } : {}
 	}), mo = async () => {
 		if (M.length === 0) return;
 		let e = process.env.HOSTNAME ?? `pid-${process.pid}`, t;
-		pa ? t = yr : fa === "cluster" ? ($.warn("scheduling.coordination=cluster needs store=postgres — falling back to single (dev/memory)"), t = yr) : fa === "advisoryLock" ? U === "memory" ? ($.warn("scheduling.coordination=advisoryLock needs a SQL store (the claim-row gate) — falling back to single (memory)"), t = yr) : t = bn(B, e, {
+		ha ? t = yr : ma === "cluster" ? ($.warn("scheduling.coordination=cluster needs store=postgres — falling back to single (dev/memory)"), t = yr) : ma === "advisoryLock" ? H === "memory" ? ($.warn("scheduling.coordination=advisoryLock needs a SQL store (the claim-row gate) — falling back to single (memory)"), t = yr) : t = bn(B, e, {
 			info: (e, t) => $.info(e, t ?? {}),
 			warn: (e, t) => $.warn(e, t ?? {})
 		}) : t = yr;
-		let n = Ac(F?.plugins ?? [], Oo);
-		oa = await Sr(M, {
+		let n = zc(F?.plugins ?? [], To);
+		ca = await Sr(M, {
 			store: B,
 			coordinator: t,
-			defaultTrigger: da,
+			defaultTrigger: pa,
 			replicaId: e,
-			armSelf: !pa,
+			armSelf: !ha,
 			dormancy: F?.dormancy ?? "always-on",
 			buildContext: ({ traceId: e, scheduleName: t, subject: n }) => po({
 				subject: n,
@@ -4533,12 +4578,12 @@ ${a.join("\n\n")}\n`);
 			...n === void 0 ? {} : { interceptFire: n }
 		}), $.info("scheduler ready", {
 			schedules: M.length,
-			coordination: pa ? "cluster" : t.kind,
-			clusterCrons: ma.length
+			coordination: ha ? "cluster" : t.kind,
+			clusterCrons: ga.length
 		}), process.on("beforeExit", () => {
-			oa?.shutdown();
+			ca?.shutdown();
 		});
-	}, J = {}, ho = /* @__PURE__ */ new Set(), go = (e, t) => {
+	}, Y = {}, ho = /* @__PURE__ */ new Set(), go = (e, t) => {
 		fn(e, yt, t) && (ho.has(e.table) || (ho.add(e.table), $.warn("tenant-scoped read with an EMPTY tenant — every row is filtered out", {
 			table: e.table,
 			tenantId: "",
@@ -4551,10 +4596,10 @@ ${a.join("\n\n")}\n`);
 			cause: "the session resolved a user but no organization/tenant; the empty-string sentinel fails closed",
 			fix: "resolve the user to an active org during auth, or route org-less users to an onboarding flow"
 		}));
-	}, yo = (e, t) => (vo(t.subject), go(e, t.subject.tenantId), Vt(Ht(e, yt, t.subject.tenantId), bt)), bo = /* @__PURE__ */ new Set(), wo = (e) => {
+	}, yo = (e, t) => (vo(t.subject), go(e, t.subject.tenantId), Vt(Ht(e, yt, t.subject.tenantId), bt)), bo = /* @__PURE__ */ new Set(), xo = (e) => {
 		if (e.usingIndex !== void 0 || e.predicate === void 0) return;
 		let t = /* @__PURE__ */ new Set();
-		for (let n of li(e.predicate)) n.conjunctive && t.add(n.column);
+		for (let n of fi(e.predicate)) n.conjunctive && t.add(n.column);
 		if (t.size === 0 || hi.anyFieldIndexed(e.table, t)) return;
 		let n = `${e.table}::${[...t].sort().join(",")}`;
 		bo.has(n) || (bo.add(n), $.warn("non-indexed predicate — slow at scale", {
@@ -4562,7 +4607,7 @@ ${a.join("\n\n")}\n`);
 			fields: [...t],
 			hint: "declare `.index()` on a column, add `.index(name, [...fields])` to the table, or annotate the query with `.using('indexName')` if a covering index exists"
 		}));
-	}, To = (e) => {
+	}, So = (e) => {
 		if (e.usingIndex === void 0) return;
 		let t = hi.tables.get(e.table);
 		if (!t) return;
@@ -4571,7 +4616,7 @@ ${a.join("\n\n")}\n`);
 			name: n.name,
 			fields: n.fields
 		};
-	}, Eo = (e) => JSON.stringify(e, (e, t) => typeof t == "object" && t && !Array.isArray(t) ? Object.fromEntries(Object.entries(t).sort(([e], [t]) => e.localeCompare(t))) : t), Do = (e, t) => {
+	}, Co = (e) => JSON.stringify(e, (e, t) => typeof t == "object" && t && !Array.isArray(t) ? Object.fromEntries(Object.entries(t).sort(([e], [t]) => e.localeCompare(t))) : t), wo = (e, t) => {
 		let n = e.cache;
 		if (n === void 0) return;
 		let r = h(n.ttl);
@@ -4579,54 +4624,54 @@ ${a.join("\n\n")}\n`);
 			ttlMs: r,
 			swrMs: n.swr === void 0 ? void 0 : h(n.swr) ?? void 0,
 			scope: n.scope,
-			baseKey: `q:${e.name}:${Eo(t)}`
+			baseKey: `q:${e.name}:${Co(t)}`
 		};
-	}, Oo = ne(), ko = F?.plugins ?? [], Ao = yi(Cc(ko, "mutation", Oo)), jo = yi(Cc(ko, "action", Oo)), Mo = yi(Cc(ko, "query", Oo)), No = Ln({
+	}, To = ne(), Eo = F?.plugins ?? [], Do = Si(Mc(Eo, "mutation", To)), Oo = Si(Mc(Eo, "action", To)), Mo = Si(Mc(Eo, "query", To)), No = Ln({
 		store: B,
 		buildContext: (e, t, n) => po(e, t, n),
 		runEffect: (e, t) => uo(e, t),
-		...Ao ? { interceptor: Ao } : {},
-		recordMetric: (e) => Oo.record(e),
-		undoCapture: cc()
+		...Do ? { interceptor: Do } : {},
+		recordMetric: (e) => To.record(e),
+		undoCapture: _c()
 	}), Po = yn({
 		buildContext: (e) => po(e),
 		runEffect: (e, t) => uo(e, t),
-		...jo ? { interceptor: jo } : {},
-		recordMetric: (e) => Oo.record(e)
+		...Oo ? { interceptor: Oo } : {},
+		recordMetric: (e) => To.record(e)
 	}), Fo = {
 		buildContext: (e) => po(e),
 		finalize: (e, t) => {
 			let n = yo(e, t);
-			return wo(n), n;
+			return xo(n), n;
 		},
 		provideEffect: (e, t) => e.pipe(N.provide(Nn(t)), N.provide(wt)),
 		...Mo ? { interceptor: Mo } : {}
-	}, Io = Vn(Fo), Y = Rn({
+	}, Io = Vn(Fo), Lo = Rn({
 		...Fo,
 		queryRows: (e) => B.query(e)
-	}), Lo = Un({
+	}), Ro = Un({
 		...Fo,
 		subscribeDescriptor: (e, t, n) => K.subscribe(e, t, n),
 		subscribeComputed: (e, t, n) => K.subscribeComputed(e, t, n)
 	});
-	for (let e of w) J[e.descriptor.name] = (t) => Yt(Io(e, t), K, `subscription.${e.descriptor.name}`, To, Do(e.descriptor, t), Hn(e, t));
+	for (let e of w) Y[e.descriptor.name] = (t) => Yt(Io(e, t), K, `subscription.${e.descriptor.name}`, So, wo(e.descriptor, t), Hn(e, t));
 	for (let e of D) {
 		let t = `mutation.${e.descriptor.name}`;
-		J[e.descriptor.name] = (n) => qt(async (t, n) => No(e, t, n), n, t);
+		Y[e.descriptor.name] = (n) => qt(async (t, n) => No(e, t, n), n, t);
 	}
 	for (let e of A) {
 		let t = `action.${e.descriptor.name}`;
-		J[e.descriptor.name] = (n) => qt(async (t, n) => Po(e, t, n), n, t);
+		Y[e.descriptor.name] = (n) => qt(async (t, n) => Po(e, t, n), n, t);
 	}
 	for (let e of dt) {
 		let t = `stream.${e.descriptor.name}`;
-		J[e.descriptor.name] = (n) => Jt((t) => {
+		Y[e.descriptor.name] = (n) => Jt((t) => {
 			let r = po(t), i = e.executor(n, r);
 			return N.isEffect(i) ? i.pipe(N.provide(Nn(r.store)), N.provide(lo), N.provide(wt)) : typeof i == "object" && i && typeof i.then == "function" ? N.promise(() => i) : i;
 		}, t);
 	}
-	xt && (J[Ri.name] = (e) => Yt(Io({
-		descriptor: Ri,
+	xt && (Y[Vi.name] = (e) => Yt(Io({
+		descriptor: Vi,
 		executor: (e) => {
 			let t = e.id;
 			return {
@@ -4635,30 +4680,30 @@ ${a.join("\n\n")}\n`);
 					column: "startedAt",
 					direction: "desc"
 				}],
-				predicate: ri(H("id", t), H("executionId", t)),
+				predicate: oi(V("id", t), V("executionId", t)),
 				take: 1,
 				skip: void 0,
 				projection: void 0
 			};
 		}
-	}, e), K, `subscription.${Ri.name}`), J[Bi.name] = (e) => Yt(Io({
-		descriptor: Bi,
+	}, e), K, `subscription.${Vi.name}`), Y[Ui.name] = (e) => Yt(Io({
+		descriptor: Ui,
 		executor: (e) => {
-			let t = e, n = [...t.tag === void 0 ? [] : [H("tag", t.tag)], ...t.status === void 0 ? [] : [H("status", t.status)]], r = Number.isFinite(t.limit) && t.limit !== void 0 ? Math.min(Math.max(Math.floor(t.limit), 1), 500) : 100;
+			let t = e, n = [...t.tag === void 0 ? [] : [V("tag", t.tag)], ...t.status === void 0 ? [] : [V("status", t.status)]], r = Number.isFinite(t.limit) && t.limit !== void 0 ? Math.min(Math.max(Math.floor(t.limit), 1), 500) : 100;
 			return {
 				table: "_voltro_workflow_runs",
 				order: [{
 					column: "startedAt",
 					direction: "desc"
 				}],
-				predicate: n.length === 0 ? void 0 : n.length === 1 ? n[0] : Xr(...n),
+				predicate: n.length === 0 ? void 0 : n.length === 1 ? n[0] : $r(...n),
 				take: r,
 				skip: void 0,
 				projection: void 0
 			};
 		}
-	}, e), K, `subscription.${Bi.name}`), J[zi.name] = (e) => Yt(Io({
-		descriptor: zi,
+	}, e), K, `subscription.${Ui.name}`), Y[Hi.name] = (e) => Yt(Io({
+		descriptor: Hi,
 		executor: (e) => {
 			let t = e.runId;
 			return {
@@ -4667,14 +4712,14 @@ ${a.join("\n\n")}\n`);
 					column: "startedAt",
 					direction: "asc"
 				}],
-				predicate: H("runId", t),
+				predicate: V("runId", t),
 				take: 1e3,
 				skip: void 0,
 				projection: void 0
 			};
 		}
-	}, e), K, `subscription.${zi.name}`), J[Li.name] = (e) => Yt(Io({
-		descriptor: Li,
+	}, e), K, `subscription.${Hi.name}`), Y[Bi.name] = (e) => Yt(Io({
+		descriptor: Bi,
 		executor: (e) => {
 			let t = e.runId;
 			return {
@@ -4683,14 +4728,14 @@ ${a.join("\n\n")}\n`);
 					column: "occurredAt",
 					direction: "asc"
 				}],
-				predicate: H("runId", t),
+				predicate: V("runId", t),
 				take: 1e3,
 				skip: void 0,
 				projection: void 0
 			};
 		}
-	}, e), K, `subscription.${Li.name}`), J[Pi.name] = (e) => Yt(Io({
-		descriptor: Pi,
+	}, e), K, `subscription.${Bi.name}`), Y[Li.name] = (e) => Yt(Io({
+		descriptor: Li,
 		executor: (e) => {
 			let t = e;
 			return {
@@ -4699,14 +4744,14 @@ ${a.join("\n\n")}\n`);
 					column: "occurredAt",
 					direction: "desc"
 				}],
-				predicate: t.name === void 0 ? void 0 : H("name", t.name),
+				predicate: t.name === void 0 ? void 0 : V("name", t.name),
 				take: Math.max(1, Math.min(500, t.limit ?? 100)),
 				skip: void 0,
 				projection: void 0
 			};
 		}
-	}, e), K, `subscription.${Pi.name}`), J[Fi.name] = (e) => Yt(Io({
-		descriptor: Fi,
+	}, e), K, `subscription.${Li.name}`), Y[Ri.name] = (e) => Yt(Io({
+		descriptor: Ri,
 		executor: (e) => {
 			let t = e.eventId;
 			return {
@@ -4715,37 +4760,37 @@ ${a.join("\n\n")}\n`);
 					column: "createdAt",
 					direction: "asc"
 				}],
-				predicate: H("eventId", t),
+				predicate: V("eventId", t),
 				take: 500,
 				skip: void 0,
 				projection: void 0
 			};
 		}
-	}, e), K, `subscription.${Fi.name}`), J[Ni.name] = (e) => qt(async (e, t) => {
+	}, e), K, `subscription.${Ri.name}`), Y[Ii.name] = (e) => qt(async (e, t) => {
 		let n = e;
-		return await qa(B, t.subject, { executionId: n.executionId }), await W.cancel(n.workflowName, n.executionId), await Jo(n.workflowName, n.executionId, "workflow.cancel"), { ok: !0 };
-	}, e, `action.${Ni.name}`), J[Ii.name] = (e) => qt(async (e, t) => {
+		return await Ya(B, t.subject, { executionId: n.executionId }), await U.cancel(n.workflowName, n.executionId), await Go(n.workflowName, n.executionId, "workflow.cancel"), { ok: !0 };
+	}, e, `action.${Ii.name}`), Y[zi.name] = (e) => qt(async (e, t) => {
 		let n = e;
-		return await qa(B, t.subject, { executionId: n.executionId }), await W.resume(n.workflowName, n.executionId), { ok: !0 };
-	}, e, `action.${Ii.name}`), J[Vi.name] = (e) => qt(async (e, t) => {
+		return await Ya(B, t.subject, { executionId: n.executionId }), await U.resume(n.workflowName, n.executionId), { ok: !0 };
+	}, e, `action.${zi.name}`), Y[Wi.name] = (e) => qt(async (e, t) => {
 		let n = e;
-		return await qa(B, t.subject, { id: n.id }), W.signal({ id: n.id }, n.signalName, n.payload);
-	}, e, `action.${Vi.name}`), J[Hi.name] = (e) => qt(async (e, t) => {
+		return await Ya(B, t.subject, { id: n.id }), U.signal({ id: n.id }, n.signalName, n.payload);
+	}, e, `action.${Wi.name}`), Y[Gi.name] = (e) => qt(async (e, t) => {
 		let n = e;
-		return await qa(B, t.subject, { id: n.id }), W.update({ id: n.id }, n.updateName, n.payload, n.timeoutMs === void 0 ? void 0 : { timeoutMs: n.timeoutMs });
-	}, e, `action.${Hi.name}`));
-	for (let e of j) J[e.definition.name] = (t) => qt(async (t, n) => {
+		return await Ya(B, t.subject, { id: n.id }), U.update({ id: n.id }, n.updateName, n.payload, n.timeoutMs === void 0 ? void 0 : { timeoutMs: n.timeoutMs });
+	}, e, `action.${Gi.name}`));
+	for (let e of j) Y[e.definition.name] = (t) => qt(async (t, n) => {
 		let r = n;
-		return Yn(W, {
+		return Yn(U, {
 			subject: r.subject,
 			traceId: r.traceId,
 			source: "workflow-rpc"
 		}).start(e.definition.name, t);
 	}, t, `workflow.${e.definition.name}`);
-	let Ro = (e, t) => po({
+	let zo = (e, t) => po({
 		subject: e.subject,
 		traceId: e.traceId
-	}, B, void 0, `workflow:${t.workflowName}`, { parentExecutionId: t.executionId }), zo = Mc(F?.plugins ?? [], Oo), Bo = zr, Vo = (e, t) => S.emit(e, t), Ko = F?.dormancy === "sleep" ? {
+	}, B, void 0, `workflow:${t.workflowName}`, { parentExecutionId: t.executionId }), Bo = Vc(F?.plugins ?? [], To), Vo = Hr, Ho = (e, t) => S.emit(e, t), Uo = F?.dormancy === "sleep" ? {
 		register: (e, t, n) => sr(B, {
 			tenantId: n ?? Pt,
 			kind: "workflow",
@@ -4757,23 +4802,23 @@ ${a.join("\n\n")}\n`);
 			kind: "workflow",
 			refId: e
 		}).then(() => {})
-	} : void 0, X = Ir({
+	} : void 0, Wo = zr({
 		store: B,
-		emit: Vo,
+		emit: Ho,
 		log: $,
-		...Ko === void 0 ? {} : { wakeups: Ko }
-	}), qo = async (e, t) => {
-		await Mr({
+		...Uo === void 0 ? {} : { wakeups: Uo }
+	}), X = async (e, t) => {
+		await Fr({
 			store: B,
 			parentExecutionId: e,
 			parentStatus: t,
-			recorder: X,
-			emit: Vo,
+			recorder: Wo,
+			emit: Ho,
 			log: $,
 			interruptChild: async (t, n, r) => {
 				let i = j.find((e) => e.definition.name === t);
 				if (!i) throw Error(`Unknown child workflow: ${t}`);
-				await Qo.runPromise(i.definition.interrupt(n)), $.info("workflow.parentClose.childInterrupted", {
+				await Yo.runPromise(i.definition.interrupt(n)), $.info("workflow.parentClose.childInterrupted", {
 					parentExecutionId: e,
 					childWorkflowName: t,
 					childExecutionId: n,
@@ -4781,11 +4826,11 @@ ${a.join("\n\n")}\n`);
 				});
 			}
 		});
-	}, Jo = async (e, t, n) => {
+	}, Go = async (e, t, n) => {
 		let r = (await B.query({
 			table: "_voltro_workflow_runs",
 			order: [],
-			predicate: H("executionId", t),
+			predicate: V("executionId", t),
 			projection: void 0,
 			skip: void 0,
 			take: 1
@@ -4798,10 +4843,10 @@ ${a.join("\n\n")}\n`);
 		});
 		i && S.emit("workflowRuns", {
 			op: "update",
-			row: Bo(i)
+			row: Vo(i)
 		});
 		let a = r.subject?.tenantId ?? void 0;
-		i && await X.recordEvent({
+		i && await Wo.recordEvent({
 			runId: r.id,
 			eventType: "run-cancelled",
 			payload: {
@@ -4810,10 +4855,10 @@ ${a.join("\n\n")}\n`);
 				executionId: t,
 				...a == null ? {} : { tenantId: a }
 			}
-		}), i && await qo(t, "cancelled");
-	}, Yo = (e, t, n, r) => {
-		let i = Pr(t);
-		return Br({
+		}), i && await X(t, "cancelled");
+	}, Ko = (e, t, n, r) => {
+		let i = Lr(t);
+		return Ur({
 			name: e,
 			store: B,
 			subject: r.subject,
@@ -4824,68 +4869,68 @@ ${a.join("\n\n")}\n`);
 			workflowPatches: i.patches,
 			parentExecutionId: r?.parentExecutionId ?? null,
 			parentClosePolicy: r?.parentClosePolicy ?? null,
-			onParentClose: ({ executionId: e, status: t }) => qo(e, t),
-			recorder: X,
-			pluginWorkflowStepLayer: zo,
-			emit: Vo,
+			onParentClose: ({ executionId: e, status: t }) => X(e, t),
+			recorder: Wo,
+			pluginWorkflowStepLayer: Bo,
+			emit: Ho,
 			log: $
 		}, n);
-	}, Xo = [...Xn(j, {
-		buildContext: Ro,
-		resolveStartContext: Da
-	}, (e, t, n) => Yo(e.definition.name, e.definition, t, n)), ...ft], Zo = Xo.length > 0 ? P.mergeAll(...Xo) : P.empty, Qo = _t.make(Zo.pipe(P.provideMerge(ya), P.provideMerge(lo), P.provideMerge(wt)));
+	}, qo = [...Xn(j, {
+		buildContext: zo,
+		resolveStartContext: ka
+	}, (e, t, n) => Ko(e.definition.name, e.definition, t, n)), ...ft], Jo = qo.length > 0 ? P.mergeAll(...qo) : P.empty, Yo = _t.make(Jo.pipe(P.provideMerge(_a), P.provideMerge(lo), P.provideMerge(wt)));
 	process.on("beforeExit", () => {
-		Qo.dispose();
-	}), xa = j.length > 0 ? Jn({
+		Yo.dispose();
+	}), Sa = j.length > 0 ? Jn({
 		workflows: j,
-		runEffect: (e) => Qo.runPromise(e),
-		rememberStartContext: Ea,
+		runEffect: (e) => Yo.runPromise(e),
+		rememberStartContext: Da,
 		signal: async (e, t, n) => {
-			let r = await Lr({
+			let r = await Br({
 				store: B,
-				recorder: X,
+				recorder: Wo,
 				target: e,
 				signalName: t,
 				payload: n
 			});
-			return await Qo.runPromise(Nr({
+			return await Yo.runPromise(Ir({
 				store: B,
 				target: e,
 				signalName: t,
 				payload: n
 			})).catch(() => {}), r;
 		},
-		update: (e, t, n, r) => Rr({
+		update: (e, t, n, r) => Vr({
 			store: B,
-			recorder: X,
+			recorder: Wo,
 			target: e,
 			updateName: t,
 			payload: n,
 			...r === void 0 ? {} : { options: r }
 		}),
-		listRuns: (e) => Ic(B, e),
-		retry: (e, t) => Lc({
+		listRuns: (e) => Gc(B, e),
+		retry: (e, t) => Kc({
 			store: B,
 			workflows: j,
-			runPromise: (e) => Qo.runPromise(e)
+			runPromise: (e) => Yo.runPromise(e)
 		}, e, t)
 	}) : void 0;
-	let $o = P.mergeAll(ao.toLayer(J), At, bl), ts = Za(J, w.map((e) => e.descriptor.name), xt), ns = P.mergeAll(ao.toLayer(ts), At, bl), rs = U, os = (rs === "postgres" || rs === "mysql" || rs === "mariadb" || rs === "mssql") && (process.env.CDC ?? "1") !== "0";
-	if (rs === "postgres" && me()) {
+	let es = P.mergeAll(oo.toLayer(Y), At, kl), ts = $a(Y, w.map((e) => e.descriptor.name), xt), ns = P.mergeAll(oo.toLayer(ts), At, kl), Z = H, rs = (Z === "postgres" || Z === "mysql" || Z === "mariadb" || Z === "mssql") && (process.env.CDC ?? "1") !== "0";
+	if (Z === "postgres" && me()) {
 		let e = be({
 			store: B,
 			log: $
 		});
 		zn = e.persistTraceSpan, process.on("beforeExit", e.stop);
 	}
-	let ls = Wa({
+	let is = Ka({
 		store: B,
-		dialect: rs
+		dialect: Z
 	});
 	process.on("beforeExit", () => {
-		ls.stop();
+		is.stop();
 	});
-	let us = [
+	let as = [
 		...w.map((e) => st(e.descriptor, "query", k(m, e.file))),
 		...D.map((e) => st(e.descriptor, "mutation", k(m, e.file))),
 		...A.map((e) => st(e.descriptor, "action", k(m, e.file))),
@@ -4895,11 +4940,11 @@ ${a.join("\n\n")}\n`);
 			output: e.descriptor.element,
 			error: e.descriptor.error
 		}, "stream", k(m, e.file)))
-	], fs = j.map((e) => ({
+	], os = j.map((e) => ({
 		tag: e.definition.name,
 		file: k(m, e.file)
 	}));
-	R.writeFile(O(m, "app.manifest.generated.json"), `${JSON.stringify(tt(us, fs, [], F?.plugins ?? []), null, 2)}\n`, "utf8").catch(() => {}), (async () => {
+	R.writeFile(O(m, "app.manifest.generated.json"), `${JSON.stringify(tt(as, os, [], F?.plugins ?? []), null, 2)}\n`, "utf8").catch(() => {}), (async () => {
 		let e = O(m, ".gitignore"), t = "";
 		try {
 			t = await R.readFile(e, "utf8");
@@ -4907,19 +4952,19 @@ ${a.join("\n\n")}\n`);
 		let n = t.split("\n").filter((e) => e.trim() !== "");
 		n.includes("app.manifest.generated.json") || (n.push("app.manifest.generated.json"), await R.writeFile(e, `${n.join("\n")}\n`, "utf8"));
 	})().catch(() => {}), rn();
-	let ms = O(m, "app.graph.observed.generated.json");
+	let ss = O(m, "app.graph.observed.generated.json");
 	R.rm(O(m, "app.graph.observed.json"), { force: !0 }).catch(() => {});
-	let Z = Fa(m);
-	Z.warning === void 0 ? Z.adopted.length > 0 && $.debug("handed generated output to the workspace owner", { paths: Z.adopted.join(", ") }) : $.warn(Z.warning);
-	let vs = async () => {
+	let ls = La(m);
+	ls.warning === void 0 ? ls.adopted.length > 0 && $.debug("handed generated output to the workspace owner", { paths: ls.adopted.join(", ") }) : $.warn(ls.warning);
+	let us = async () => {
 		try {
-			await R.writeFile(ms, `${JSON.stringify(er(), null, 2)}\n`, "utf8");
+			await R.writeFile(ss, `${JSON.stringify(er(), null, 2)}\n`, "utf8");
 		} catch {}
 	};
 	setInterval(() => {
-		vs();
+		us();
 	}, 1e4).unref(), process.once("exit", () => {
-		vs();
+		us();
 	}), (async () => {
 		let e = O(m, ".gitignore"), t = "";
 		try {
@@ -4928,8 +4973,8 @@ ${a.join("\n\n")}\n`);
 		let n = t.split("\n").filter((e) => e.trim() !== "");
 		n.includes("app.graph.observed.generated.json") || (n.push("app.graph.observed.generated.json"), await R.writeFile(e, `${n.join("\n")}\n`, "utf8"));
 	})().catch(() => {});
-	let bs = /* @__PURE__ */ new Map();
-	for (let e of D) bs.set(e.descriptor.name, async (t, n) => {
+	let ds = /* @__PURE__ */ new Map();
+	for (let e of D) ds.set(e.descriptor.name, async (t, n) => {
 		let r = {
 			subject: await kt({
 				headers: n,
@@ -4943,7 +4988,7 @@ ${a.join("\n\n")}\n`);
 				result: await No(e, t, r)
 			};
 		} catch (t) {
-			let n = Cl(t);
+			let n = Ml(t);
 			return $.warn(`inspect invoke failed: ${e.descriptor.name}`, {
 				tag: e.descriptor.name,
 				error: n
@@ -4953,7 +4998,7 @@ ${a.join("\n\n")}\n`);
 			};
 		}
 	});
-	for (let e of A) bs.set(e.descriptor.name, async (t, n) => {
+	for (let e of A) ds.set(e.descriptor.name, async (t, n) => {
 		let r = {
 			subject: await kt({
 				headers: n,
@@ -4967,7 +5012,7 @@ ${a.join("\n\n")}\n`);
 				result: await Po(e, t, r)
 			};
 		} catch (t) {
-			let n = Cl(t);
+			let n = Ml(t);
 			return $.warn(`inspect invoke failed: ${e.descriptor.name}`, {
 				tag: e.descriptor.name,
 				error: n
@@ -4977,8 +5022,8 @@ ${a.join("\n\n")}\n`);
 			};
 		}
 	});
-	let xs = () => ({
-		dialect: U,
+	let ms = () => ({
+		dialect: H,
 		replication: ut.replicationSnapshot() ?? {
 			replicaCount: 0,
 			rywPolicy: "off",
@@ -5009,7 +5054,7 @@ ${a.join("\n\n")}\n`);
 			...e.lastRunRowsTouched === void 0 ? {} : { lastRunRowsTouched: e.lastRunRowsTouched },
 			...e.lastError ? { lastError: e.lastError } : {}
 		}))
-	}), Ss = async () => {
+	}), _s = async () => {
 		let e = {
 			drift: {
 				isDrifted: !1,
@@ -5020,9 +5065,9 @@ ${a.join("\n\n")}\n`);
 			history: [],
 			softDropSnapshots: []
 		};
-		if (!si) return e;
+		if (!li) return e;
 		let t = N.gen(function* () {
-			let e = yield* V.SqlClient, t = yield* e`
+			let e = yield* Mr.SqlClient, t = yield* e`
         SELECT ${e("id")}, ${e("fingerprint")},
                ${e("appliedAt")}::text AS ${e("appliedAt")},
                ${e("appliedBy")}, ${e("environment")}, ${e("source")},
@@ -5031,17 +5076,17 @@ ${a.join("\n\n")}\n`);
         FROM ${e("_voltro_migration_plans")}
         ORDER BY ${e("appliedAt")} DESC
         LIMIT 20
-      `.pipe(N.orElseSucceed(() => [])), n = yield* Qi(e), r = Zi({ tables: n.tables.filter((e) => !e.name.startsWith("_voltro_")) }), i = t[0], a = {
+      `.pipe(N.orElseSucceed(() => [])), n = yield* ta(e), r = ea({ tables: n.tables.filter((e) => !e.name.startsWith("_voltro_")) }), i = t[0], a = {
 				isDrifted: i ? i.fingerprint !== r : !1,
 				liveFingerprint: r,
 				liveSnapshot: n
 			};
 			i && (a.lastAppliedFingerprint = i.fingerprint, a.lastAppliedAt = i.appliedAt, a.lastAppliedId = i.id);
-			let o = z, s = ea({
+			let o = z, s = ra({
 				declared: o,
 				live: n
 			});
-			return Zi(Yi(o)), {
+			return ea(Qi(o)), {
 				drift: a,
 				pending: {
 					operations: s.operations.map((e) => {
@@ -5080,7 +5125,7 @@ ${a.join("\n\n")}\n`);
 			};
 		});
 		try {
-			return await N.runPromise(t.pipe(N.provide(si)));
+			return await N.runPromise(t.pipe(N.provide(li)));
 		} catch (t) {
 			return $.warn("inspect.migrations: snapshot build failed", { err: String(t) }), e;
 		}
@@ -5088,15 +5133,15 @@ ${a.join("\n\n")}\n`);
 		kind: "api",
 		meta: {
 			name: F?.name ?? E(m),
-			voltroVersion: pl,
+			voltroVersion: Sl,
 			port: b,
 			mode: "dev",
-			store: rs,
-			cdc: os ? "on" : "off"
+			store: Z,
+			cdc: rs ? "on" : "off"
 		},
-		rpc: us,
-		workflows: fs,
-		metrics: (e) => Oo.snapshot(e),
+		rpc: as,
+		workflows: os,
+		metrics: (e) => To.snapshot(e),
 		dataCache: () => {
 			let e = Tr(), t = (process.env.CACHE_REDIS_DRIVER ?? "resp") === "http" ? "http" : "resp", n = wr === "redis" ? (process.env.CACHE_REDIS_URL ?? process.env.REDIS_URL ?? "").includes("upstash") ? "upstash" : "redis" : "memory";
 			return {
@@ -5108,13 +5153,13 @@ ${a.join("\n\n")}\n`);
 				hitRate: e.hitRate
 			};
 		},
-		invokers: bs,
+		invokers: ds,
 		plugins: () => ({
 			plugins: It.snapshot(),
 			capturedAt: Date.now()
 		}),
 		env: () => f(F?.name ?? E(m), {
-			contract: Ui(F?.env) ? F.env : void 0,
+			contract: Ki(F?.env) ? F.env : void 0,
 			plugins: F?.plugins ?? []
 		}),
 		subscriptions: () => {
@@ -5122,7 +5167,7 @@ ${a.join("\n\n")}\n`);
 			return {
 				subscriptions: e.map((e) => {
 					let t = [];
-					for (let n of li(e.predicate)) n.conjunctive && t.push(n.column);
+					for (let n of fi(e.predicate)) n.conjunctive && t.push(n.column);
 					return {
 						fingerprint: e.fingerprint,
 						table: e.table,
@@ -5136,10 +5181,10 @@ ${a.join("\n\n")}\n`);
 				capturedAt: Date.now()
 			};
 		},
-		database: xs,
-		migrations: async () => Ss(),
+		database: ms,
+		migrations: async () => _s(),
 		inspectTables: () => ({ tables: z.map((e) => {
-			let t = Nl(e), n = Pl(t);
+			let t = Hl(e), n = Ul(t);
 			return {
 				name: e.tableName,
 				isFrameworkTable: e.tableName.startsWith("_voltro_"),
@@ -5152,11 +5197,11 @@ ${a.join("\n\n")}\n`);
 		inspectRows: async (e) => {
 			let t = Math.max(0, e.offset ?? 0), n = Math.max(1, Math.min(500, e.limit ?? 50)), r = z.find((t) => t.tableName === e.table);
 			if (!r) throw Error(`unknown table: ${e.table}`);
-			let i = Nl(r), a = nl({
+			let i = Hl(r), a = dl({
 				filter: e.filter,
 				quickSearch: e.quickSearch,
 				columns: i
-			}), o = rl(e.sort, i), s = await B.query({
+			}), o = fl(e.sort, i), s = await B.query({
 				table: e.table,
 				order: o,
 				skip: t,
@@ -5172,7 +5217,7 @@ ${a.join("\n\n")}\n`);
 				skip: void 0,
 				take: void 0
 			})).length, u = "exact"), {
-				rows: s.map(Ml),
+				rows: s.map(Vl),
 				total: l,
 				countMode: u,
 				offset: t,
@@ -5186,7 +5231,7 @@ ${a.join("\n\n")}\n`);
 			return $.info("inspect.data.insert", {
 				table: e.table,
 				id: t?.id ?? null
-			}), { row: Ml(t) };
+			}), { row: Vl(t) };
 		},
 		inspectUpdateRow: async (e) => {
 			if (e.table.startsWith("_voltro_")) throw Error(`inspect data viewer cannot write to framework-internal table: ${e.table}`);
@@ -5196,7 +5241,7 @@ ${a.join("\n\n")}\n`);
 				table: e.table,
 				id: e.id,
 				patch: Object.keys(e.patch)
-			}), { row: t ? Ml(t) : null };
+			}), { row: t ? Vl(t) : null };
 		},
 		inspectDeleteRow: async (e) => {
 			if (e.table.startsWith("_voltro_")) throw Error(`inspect data viewer cannot delete from framework-internal table: ${e.table}`);
@@ -5209,7 +5254,7 @@ ${a.join("\n\n")}\n`);
 			}), { deleted: t };
 		},
 		inspectImport: async (e) => {
-			let t = await N.runPromise(Ta({
+			let t = await N.runPromise(Oa({
 				store: B,
 				bundleDir: e.bundleDir,
 				...e.mode ? { mode: e.mode } : {},
@@ -5228,14 +5273,14 @@ ${a.join("\n\n")}\n`);
 		},
 		...xt ? {
 			inspectStartWorkflow: async (e) => {
-				if (W === void 0) throw Error("workflow runtime is not configured");
-				return Yn(W, {
+				if (U === void 0) throw Error("workflow runtime is not configured");
+				return Yn(U, {
 					traceId: `inspect-workflow-start-${Date.now()}`,
 					source: "inspect"
 				}).start(e.name, e.payload);
 			},
 			inspectWorkflowRuns: async (e) => {
-				let { rows: t, total: n, offset: r, limit: i } = await Pc(B, {
+				let { rows: t, total: n, offset: r, limit: i } = await Uc(B, {
 					...e.tag === void 0 ? {} : { tag: e.tag },
 					...e.status === void 0 ? {} : { status: e.status },
 					...e.offset === void 0 ? {} : { offset: e.offset },
@@ -5271,7 +5316,7 @@ ${a.join("\n\n")}\n`);
 				let t = (await B.query({
 					table: "_voltro_workflow_runs",
 					order: [],
-					predicate: H("id", e.runId),
+					predicate: V("id", e.runId),
 					projection: void 0,
 					skip: void 0,
 					take: 1
@@ -5279,7 +5324,7 @@ ${a.join("\n\n")}\n`);
 				if (!t) return $.warn("inspect.workflow.cancel: run not found", { runId: e.runId }), { cancelled: !1 };
 				let n = j.find((e) => e.definition.name === t.tag);
 				if (n && t.status === "running") try {
-					await Qo.runPromise(n.definition.interrupt(t.executionId)), $.info("inspect.workflow.interrupt: engine notified", {
+					await Yo.runPromise(n.definition.interrupt(t.executionId)), $.info("inspect.workflow.interrupt: engine notified", {
 						runId: e.runId,
 						tag: t.tag,
 						executionId: t.executionId
@@ -5297,17 +5342,17 @@ ${a.join("\n\n")}\n`);
 				});
 				r && S.emit("workflowRuns", {
 					op: "update",
-					row: Bo(r)
+					row: Vo(r)
 				});
 				let i = r?.subject?.tenantId ?? void 0;
-				return r && await X.recordEvent({
+				return r && await Wo.recordEvent({
 					runId: e.runId,
 					eventType: "run-cancelled",
 					payload: {
 						reason: "inspect.cancel",
 						...i == null ? {} : { tenantId: i }
 					}
-				}), r && await qo(t.executionId, "cancelled"), $.info("inspect.workflow.cancel", {
+				}), r && await X(t.executionId, "cancelled"), $.info("inspect.workflow.cancel", {
 					runId: e.runId,
 					didUpdate: r !== null
 				}), { cancelled: r !== null };
@@ -5318,7 +5363,7 @@ ${a.join("\n\n")}\n`);
 					column: "startedAt",
 					direction: "asc"
 				}],
-				predicate: H("runId", e.runId),
+				predicate: V("runId", e.runId),
 				projection: void 0,
 				skip: void 0,
 				take: 1e3
@@ -5344,7 +5389,7 @@ ${a.join("\n\n")}\n`);
 					column: "occurredAt",
 					direction: "asc"
 				}],
-				predicate: H("runId", e.runId),
+				predicate: V("runId", e.runId),
 				projection: void 0,
 				skip: void 0,
 				take: 2e3
@@ -5358,7 +5403,7 @@ ${a.join("\n\n")}\n`);
 				attempt: e.attempt
 			})) }),
 			inspectWorkflowDomainEvents: async (e) => {
-				let t = Math.max(0, e.offset ?? 0), n = Math.max(1, Math.min(500, e.limit ?? 100)), r = e.name === void 0 ? void 0 : H("name", e.name), i = await B.query({
+				let t = Math.max(0, e.offset ?? 0), n = Math.max(1, Math.min(500, e.limit ?? 100)), r = e.name === void 0 ? void 0 : V("name", e.name), i = await B.query({
 					table: "_voltro_workflow_events",
 					order: [{
 						column: "occurredAt",
@@ -5397,7 +5442,7 @@ ${a.join("\n\n")}\n`);
 					column: "createdAt",
 					direction: "asc"
 				}],
-				predicate: H("eventId", e.eventId),
+				predicate: V("eventId", e.eventId),
 				projection: void 0,
 				skip: void 0,
 				take: 500
@@ -5422,7 +5467,7 @@ ${a.join("\n\n")}\n`);
 						column: "startedAt",
 						direction: "asc"
 					}],
-					predicate: H("parentExecutionId", e.parentExecutionId),
+					predicate: V("parentExecutionId", e.parentExecutionId),
 					projection: void 0,
 					skip: void 0,
 					take: 200
@@ -5457,7 +5502,7 @@ ${a.join("\n\n")}\n`);
 				let t = (await B.query({
 					table: "_voltro_workflow_runs",
 					order: [],
-					predicate: H("id", e.runId),
+					predicate: V("id", e.runId),
 					projection: void 0,
 					skip: void 0,
 					take: 1
@@ -5465,7 +5510,7 @@ ${a.join("\n\n")}\n`);
 				if (!t || t.status !== "running") return { suspended: !1 };
 				let n = j.find((e) => e.definition.name === t.tag);
 				if (n) try {
-					await Qo.runPromise(n.definition.interrupt(t.executionId));
+					await Yo.runPromise(n.definition.interrupt(t.executionId));
 				} catch (t) {
 					$.warn("inspect.workflow.suspend: interrupt failed (continuing)", {
 						runId: e.runId,
@@ -5478,8 +5523,8 @@ ${a.join("\n\n")}\n`);
 				});
 				return r && S.emit("workflowRuns", {
 					op: "update",
-					row: Bo(r)
-				}), r && await X.recordEvent({
+					row: Vo(r)
+				}), r && await Wo.recordEvent({
 					runId: e.runId,
 					eventType: "run-suspended",
 					payload: { reason: "inspect.suspend" }
@@ -5489,7 +5534,7 @@ ${a.join("\n\n")}\n`);
 				let t = (await B.query({
 					table: "_voltro_workflow_runs",
 					order: [],
-					predicate: H("id", e.runId),
+					predicate: V("id", e.runId),
 					projection: void 0,
 					skip: void 0,
 					take: 1
@@ -5497,7 +5542,7 @@ ${a.join("\n\n")}\n`);
 				if (!t) return { resumed: !1 };
 				let n = j.find((e) => e.definition.name === t.tag);
 				if (n) try {
-					await Qo.runPromise(n.definition.resume(t.executionId));
+					await Yo.runPromise(n.definition.resume(t.executionId));
 				} catch (t) {
 					return $.warn("inspect.workflow.resume: engine.resume failed", {
 						runId: e.runId,
@@ -5510,8 +5555,8 @@ ${a.join("\n\n")}\n`);
 				});
 				return r && S.emit("workflowRuns", {
 					op: "update",
-					row: Bo(r)
-				}), r && await X.recordEvent({
+					row: Vo(r)
+				}), r && await Wo.recordEvent({
 					runId: e.runId,
 					eventType: "run-resumed",
 					payload: { reason: "inspect.resume" }
@@ -5520,10 +5565,10 @@ ${a.join("\n\n")}\n`);
 			inspectRetryWorkflowRun: async (e) => {
 				let t = e.payloadOverride !== void 0;
 				try {
-					let n = await Lc({
+					let n = await Kc({
 						store: B,
 						workflows: j,
-						runPromise: (e) => Qo.runPromise(e)
+						runPromise: (e) => Yo.runPromise(e)
 					}, e.runId, t ? { payloadOverride: e.payloadOverride } : void 0);
 					return $.info("inspect.workflow.retry", {
 						runId: e.runId,
@@ -5537,9 +5582,9 @@ ${a.join("\n\n")}\n`);
 				}
 			},
 			inspectSignalWorkflowRun: async (e) => {
-				let t = await Lr({
+				let t = await Br({
 					store: B,
-					recorder: X,
+					recorder: Wo,
 					target: { id: e.runId },
 					signalName: e.signalName,
 					payload: e.payload
@@ -5551,9 +5596,9 @@ ${a.join("\n\n")}\n`);
 				}), t;
 			},
 			inspectUpdateWorkflowRun: async (e) => {
-				let t = await Rr({
+				let t = await Vr({
 					store: B,
-					recorder: X,
+					recorder: Wo,
 					target: { id: e.runId },
 					updateName: e.updateName,
 					payload: e.payload,
@@ -5574,17 +5619,17 @@ ${a.join("\n\n")}\n`);
 					name: e.name,
 					cron: e.cron,
 					timezone: e.timezone,
-					trigger: e.trigger ?? da,
+					trigger: e.trigger ?? pa,
 					onOverlap: e.onOverlap ?? "skip",
 					backfill: e.backfill ?? "skip",
 					maxRuntimeMs: e.maxRuntimeMs ?? 30 * 6e4,
 					...e.description === void 0 ? {} : { description: e.description },
 					nextFiringAt: Qn(e).toISOString()
 				})),
-				coordination: pa ? "cluster" : fa === "advisoryLock" && U === "postgres" ? "advisoryLock" : "single"
+				coordination: ha ? "cluster" : ma === "advisoryLock" && H === "postgres" ? "advisoryLock" : "single"
 			}),
 			inspectScheduleRuns: async (e) => {
-				let t = Math.max(0, e.offset ?? 0), n = Math.max(1, Math.min(500, e.limit ?? 50)), r = e.name === void 0 ? void 0 : H("name", e.name), i = await B.query({
+				let t = Math.max(0, e.offset ?? 0), n = Math.max(1, Math.min(500, e.limit ?? 50)), r = e.name === void 0 ? void 0 : V("name", e.name), i = await B.query({
 					table: "_voltro_schedule_runs",
 					order: [{
 						column: "scheduledAt",
@@ -5623,21 +5668,21 @@ ${a.join("\n\n")}\n`);
 				};
 			},
 			inspectFireSchedule: async (e) => {
-				if (!oa) throw Error("scheduler not started (no self-triggered schedules?)");
-				return { runId: await oa.fireNow(e.name, e.trigger) ?? null };
+				if (!ca) throw Error("scheduler not started (no self-triggered schedules?)");
+				return { runId: await ca.fireNow(e.name, e.trigger) ?? null };
 			}
 		} : {},
 		cluster: async () => {
-			let e = process.env.POD_NAME ?? process.env.HOSTNAME ?? `dev-${process.pid}`, t = U, n = t === "memory", r = n ? "none" : Wr({ sqliteFamily: t === "sqlite" || t === "turso" }), i = Ur({
+			let e = process.env.POD_NAME ?? process.env.HOSTNAME ?? `dev-${process.pid}`, t = H, n = t === "memory", r = n ? "none" : qr({ sqliteFamily: t === "sqlite" || t === "turso" }), i = Kr({
 				runnerStorage: r === "sql" ? "sql" : "memory",
 				...process.env.VOLTRO_WORKFLOW_RUNNER_PORT ? { runnerListenPort: Number(process.env.VOLTRO_WORKFLOW_RUNNER_PORT) } : {}
-			}), a = !n && (process.env.CDC ?? "1") !== "0", o = t === "postgres" ? "LISTEN/NOTIFY" : t === "sqlite" || t === "turso" ? "in-process bus" : t === "mariadb" || t === "mysql" ? "binlog CDC (ROW)" : t === "mssql" ? "inline only" : t === "memory" ? "none (single-process)" : "inline only", s = t === "postgres" || t === "mariadb" || t === "mssql" ? "full" : t === "mysql" ? "inline-only" : t === "sqlite" || t === "turso" ? "single-process" : "none", c = pa ? "cluster" : fa === "advisoryLock" && U === "postgres" ? "advisoryLock" : "single", l = a && t === "mariadb" ? Xl(e) : void 0, u = {
+			}), a = !n && (process.env.CDC ?? "1") !== "0", o = t === "postgres" ? "LISTEN/NOTIFY" : t === "sqlite" || t === "turso" ? "in-process bus" : t === "mariadb" || t === "mysql" ? "binlog CDC (ROW)" : t === "mssql" ? "inline only" : t === "memory" ? "none (single-process)" : "inline only", s = t === "postgres" || t === "mariadb" || t === "mssql" ? "full" : t === "mysql" ? "inline-only" : t === "sqlite" || t === "turso" ? "single-process" : "none", c = ha ? "cluster" : ma === "advisoryLock" && H === "postgres" ? "advisoryLock" : "single", l = a && t === "mariadb" ? au(e) : void 0, u = {
 				replicaId: e,
 				dialect: t,
 				runnerHost: i.host,
 				runnerPort: r === "none" ? 0 : i.port,
 				runnerStorage: r,
-				shardLock: r === "sql" ? Hr() : "none",
+				shardLock: r === "sql" ? Gr() : "none",
 				coordination: c,
 				cdc: {
 					enabled: a,
@@ -5684,7 +5729,7 @@ ${a.join("\n\n")}\n`);
 					runningWorkflowRuns: (await d({
 						table: "_voltro_workflow_runs",
 						order: [],
-						predicate: H("status", "running"),
+						predicate: V("status", "running"),
 						projection: ["id"],
 						skip: void 0,
 						take: void 0
@@ -5694,10 +5739,10 @@ ${a.join("\n\n")}\n`);
 			};
 		},
 		runSeed: async (e) => {
-			let t = await ie(bi, e, B, _i);
-			return ut.recordSeedResult(t), xs();
+			let t = await ie(xi, e, B, vi);
+			return ut.recordSeedResult(t), ms();
 		},
-		rollbackMigration: async (e) => (_i.warn("rollbackMigration called but only memory store is wired — no-op"), xs()),
+		rollbackMigration: async (e) => (vi.warn("rollbackMigration called but only memory store is wired — no-op"), ms()),
 		webhooks: async () => {
 			let e = G.outgoing.map((e) => ({
 				id: e.descriptor.id,
@@ -5750,84 +5795,102 @@ ${a.join("\n\n")}\n`);
 				deliveries: r
 			};
 		},
-		...q === void 0 ? {} : { webhookActions: {
-			subscribe: (e) => q.subscribe(e).then((e) => ({
+		...J === void 0 ? {} : { webhookActions: {
+			subscribe: (e) => J.subscribe(e).then((e) => ({
 				id: e.id,
 				event: e.event,
 				url: e.url,
 				secret: e.secret
 			})),
-			pause: (e) => q.pauseTarget(e),
-			resume: (e) => q.resumeTarget(e),
-			delete: (e) => q.deleteTarget(e),
-			rotateSecret: (e) => q.rotateSecret(e),
-			replay: (e) => q.replay(e),
-			updateTargetPayloadVersion: (e, t) => q.updateTargetPayloadVersion(e, t)
+			pause: (e) => J.pauseTarget(e),
+			resume: (e) => J.resumeTarget(e),
+			delete: (e) => J.deleteTarget(e),
+			rotateSecret: (e) => J.rotateSecret(e),
+			replay: (e) => J.replay(e),
+			updateTargetPayloadVersion: (e, t) => J.updateTargetPayloadVersion(e, t)
 		} }
-	}, ws = Rc(F?.plugins ?? [], Oo);
-	ws !== void 0 && $.info("plugin http-request interceptor active", { plugins: (F?.plugins ?? []).filter((e) => typeof e.onHttpRequest == "function").map((e) => e.name) });
-	let Es = (F?.plugins ?? []).flatMap((e) => e.httpRoutes ?? []), Ds = typeof Tt == "object" ? Tt.managementPath : void 0, Os = () => `public-${Math.random().toString(36).slice(2, 10)}`, ks = ca([
+	}, ys = qc(F?.plugins ?? [], To);
+	ys !== void 0 && $.info("plugin http-request interceptor active", { plugins: (F?.plugins ?? []).filter((e) => typeof e.onHttpRequest == "function").map((e) => e.name) });
+	let xs = (F?.plugins ?? []).flatMap((e) => e.httpRoutes ?? []), Ts = typeof Tt == "object" ? Tt.managementPath : void 0, Es = () => `public-${Math.random().toString(36).slice(2, 10)}`, Os = da([
 		...w.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
 			descriptor: e.descriptor,
-			invoke: (t, n) => Y(e, t, {
+			invoke: (t, n) => Lo(e, t, {
 				subject: n.subject,
-				traceId: Os()
+				traceId: Es()
 			}),
-			subscribe: (t, n, r) => Lo(e, t, {
+			subscribe: (t, n, r) => Ro(e, t, {
 				subject: n.subject,
-				traceId: Os()
+				traceId: Es()
 			}, r)
 		})),
 		...D.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
 			descriptor: e.descriptor,
 			invoke: (t, n) => No(e, t, {
 				subject: n.subject,
-				traceId: Os()
+				traceId: Es()
 			})
 		})),
 		...A.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
 			descriptor: e.descriptor,
 			invoke: (t, n) => Po(e, t, {
 				subject: n.subject,
-				traceId: Os()
+				traceId: Es()
 			})
 		}))
-	]), As = [
+	]), ks = [
 		...F?.restRoutes ?? [],
-		...Dt ? Bt(Dt, Ds ?? "/v1/api-keys") : [],
-		...ks
+		...Dt ? Bt(Dt, Ts ?? "/v1/api-keys") : [],
+		...Os
 	];
-	ks.length > 0 && $.info("public-api routes projected from descriptors", { routes: ks.map((e) => `${e.method} ${e.path}`) });
-	let js = F?.idempotency, Ms = js ? {
+	Os.length > 0 && $.info("public-api routes projected from descriptors", { routes: Os.map((e) => `${e.method} ${e.path}`) });
+	let As = F?.idempotency, js = As ? {
 		store: tn(B),
-		header: (typeof js == "object" ? js.header : void 0) ?? "Idempotency-Key",
-		ttlMs: (typeof js == "object" ? js.ttlMs : void 0) ?? 864e5
-	} : void 0, Ns = As.length > 0 ? la(As, {
+		header: (typeof As == "object" ? As.header : void 0) ?? "Idempotency-Key",
+		ttlMs: (typeof As == "object" ? As.ttlMs : void 0) ?? 864e5
+	} : void 0, Ns = ks.length > 0 ? fa(ks, {
 		store: B,
 		resolveSubject: (e) => kt({
 			headers: e,
 			clientId: -1
 		}),
-		...Ms ? { idempotency: Ms } : {}
+		...js ? { idempotency: js } : {}
 	}) : [];
-	Ms && As.length > 0 && $.info("rest idempotency active", {
-		header: Ms.header,
-		ttlMs: Ms.ttlMs
-	}), Ns.length > 0 && $.info("rest routes mounted", { routes: As.map((e) => `${e.method} ${e.path}`) });
-	let Ps = [
-		...Es,
+	js && ks.length > 0 && $.info("rest idempotency active", {
+		header: js.header,
+		ttlMs: js.ttlMs
+	}), Ns.length > 0 && $.info("rest routes mounted", { routes: ks.map((e) => `${e.method} ${e.path}`) });
+	let Fs = [
+		...xs,
 		...Ns,
 		...$n.httpRoutes
-	], { server: Fs } = xr({
-		group: ao,
-		handlersLayer: $o,
+	], { server: Is } = xr({
+		group: oo,
+		handlersLayer: es,
 		httpHandlersLayer: ns,
 		port: b,
 		path: F?.transport?.wsPath ?? "/ws",
-		...ws ? { pluginHttpInterceptor: ws } : {},
-		...Ps.length > 0 ? { httpRoutes: Ps } : {},
+		...ys ? { pluginHttpInterceptor: ys } : {},
+		...Fs.length > 0 ? { httpRoutes: Fs } : {},
 		getStore: () => L.current,
 		inspectRoute: { handle: async (e, t, r, i) => {
+			if (r !== "OPTIONS") {
+				if (Ve()) return {
+					status: 503,
+					contentType: "application/json",
+					body: JSON.stringify({ error: "inspect disabled (VOLTRO_INSPECT=off)" }),
+					headers: T(t.origin)
+				};
+				let e = We(t);
+				if (!e.ok) return {
+					status: 401,
+					contentType: "application/json",
+					body: JSON.stringify({
+						error: "unauthorized",
+						reason: e.reason
+					}),
+					headers: T(t.origin)
+				};
+			}
 			if (r === "GET" && e === "/_voltro/inspect/plugins/dashboard-mounts") return {
 				status: 200,
 				contentType: "application/json; charset=utf-8",
@@ -5858,7 +5921,7 @@ ${a.join("\n\n")}\n`);
 			if (r === "GET" && (e === "/_voltro/inspect/traces" || e.startsWith("/_voltro/inspect/traces?"))) {
 				let n = ve();
 				return {
-					...ul(e, rs === "postgres" && me() ? await Hl(e, n, B) : n),
+					...yl(e, Z === "postgres" && me() ? await Zl(e, n, B) : n),
 					headers: T(t.origin)
 				};
 			}
@@ -5919,11 +5982,11 @@ ${a.join("\n\n")}\n`);
 				if (n) return n;
 			}
 			if (e.startsWith("/_voltro/inspect/aggregates")) {
-				let n = await Us(e, r, aa.registry, T(t.origin));
+				let n = await Qs(e, r, sa.registry, T(t.origin));
 				if (n) return n;
 			}
 			if (e.startsWith("/_voltro/inspect/timeline")) {
-				let n = await $s(e, r, {
+				let n = await cc(e, r, {
 					recorder: ln(),
 					readCurrentRows: async (e) => Q.inspectRows === void 0 ? [] : (await Q.inspectRows({
 						table: e,
@@ -5935,9 +5998,9 @@ ${a.join("\n\n")}\n`);
 				if (n) return n;
 			}
 			if (e.startsWith("/_voltro/inspect/analytics")) {
-				let n = qs(e, r, {
-					sink: ni,
-					metricsCollector: Oo
+				let n = nc(e, r, {
+					sink: Zr,
+					metricsCollector: To
 				}, T(t.origin));
 				if (n) return n;
 			}
@@ -5971,19 +6034,19 @@ ${a.join("\n\n")}\n`);
 			corsHeaders: (e) => T(e),
 			keepAlive: () => ee()
 		},
-		webhookRoutes: new Map(Array.from(Ma.entries()).map(([e, t]) => [e, { handle: t }])),
+		webhookRoutes: new Map(Array.from(Na.entries()).map(([e, t]) => [e, { handle: t }])),
 		...Zn ? { tracerLayer: Zn } : {}
 	});
 	try {
-		await Kt(Fs);
+		await Kt(Is);
 	} catch (e) {
 		$.error(`rpc server failed to bind on port ${b} — aborting boot`, { port: b }, e), process.exit(1);
 	}
 	$.info(`listening on http://localhost:${b}`, {
 		port: b,
 		ws: `ws://localhost:${b}/ws`,
-		store: rs
-	}), Ee?.set({ phase: "ready" }), rs === "postgres" && $.info("postgres change-data-capture", { enabled: (process.env.CDC ?? "1") !== "0" }), await mo();
+		store: Z
+	}), Ee?.set({ phase: "ready" }), Z === "postgres" && $.info("postgres change-data-capture", { enabled: (process.env.CDC ?? "1") !== "0" }), await mo();
 	try {
 		await g({
 			id: x,
@@ -6013,7 +6076,7 @@ ${a.join("\n\n")}\n`);
 		let n = async () => {
 			It.deactivate();
 			for (let e of ur) e.stop();
-			ar?.dispose(), t(x), ue.dispose(), Er(), pr?.close(), await ai();
+			ar?.dispose(), t(x), ue.dispose(), Er(), pr?.close(), await si();
 		};
 		process.on("SIGINT", () => {
 			n();
@@ -6034,9 +6097,9 @@ ${a.join("\n\n")}\n`);
 		root: m,
 		onBeforeRestart: () => {
 			try {
-				Fs.closeAllConnections?.();
+				Is.closeAllConnections?.();
 			} catch {}
-			Fs.close();
+			Is.close();
 		}
 	}), Ct({
 		app: le,
@@ -6050,4 +6113,4 @@ ${a.join("\n\n")}\n`);
 	}), new Promise(() => {});
 };
 //#endregion
-export { Ua as $, gs as A, Go as B, tc as C, ys as D, Ts as E, cs as F, xo as G, Wo as H, as as I, Ya as J, Za as K, is as L, ps as M, ds as N, Cs as O, ss as P, Wa as Q, ns as R, ec as S, Rs as T, Ho as U, Uo as V, bo as W, Ka as X, qa as Y, Ga as Z, Ac as _, Gl as a, cc as b, Ul as c, Kl as d, Ra as et, Tl as f, Lc as g, Ic as h, Il as i, hs as j, _s as k, ql as l, Kc as m, _l as n, Cl as o, $l as p, Ja as q, Ql as r, Wl as s, vl as t, Fa as tt, iu as u, bc as v, Ls as w, ac as x, sc as y, es as z };
+export { qa as $, Cs as A, $o as B, uc as C, Ds as D, Ps as E, gs as F, ko as G, Qo as H, ps as I, $a as J, ao as K, fs as L, bs as M, vs as N, Ms as O, hs as P, Ja as Q, us as R, lc as S, qs as T, Xo as U, Zo as V, Oo as W, Za as X, Xa as Y, Ya as Z, zc as _, eu as a, _c as b, Ql as c, tu as d, Ka as et, Pl as f, Kc as g, Gc as h, Gl as i, Ss as j, ws as k, nu as l, tl as m, El as n, Ba as nt, Ml as o, cu as p, oo as q, su as r, La as rt, $l as s, Dl as t, Ga as tt, pu as u, kc as v, Ks as w, mc as x, gc as y, cs as z };