@voltro/cli 0.23.0 → 0.24.0

package/dist/{dev-jM07kq_D.js → dev-NCuEhNxs.js}

@@ -14,35 +14,35 @@ import { FetchHttpClient as ut } from "@effect/platform";
 import { Cause as dt, Cron as ft, Deferred as pt, Duration as mt, Effect as P, Fiber as ht, Layer as F, ManagedRuntime as gt, Option as _t, Ref as vt, Schema as yt, Stream as bt } from "effect";
 import { createLogger as xt, printAppSurface as St, printReadyBlock as Ct } from "@voltro/logger";
 import { appendFileSync as I, chownSync as wt, existsSync as L, promises as R, readFileSync as Tt, readdirSync as Et, statSync as Dt, writeFileSync as Ot } from "node:fs";
-import { AggregateError as kt, AggregateMaintainer as At, AggregateNotFound as jt, AggregateRegistry as Mt, AggregateStale as Nt, AnalyticsSink as Pt, DORMANCY_WAKEUP_TENANT as Ft, Dispatcher as It, InMemoryDataStore as z, ReactionRateLimiter as Lt, ReplicatedDataStore as Rt, SYSTEM_SUBJECT as zt, actingUserId as Bt, apiKeyManagementRoutes as Vt, applySoftDeleteScope as Ht, applyTenantScope as Ut, applyUndoInvocation as Wt, assertConnectionCipherConfigured as Gt, attachAnalyticsMirror as Kt, awaitServerListening as qt, bindMutation as Jt, bindStream as Yt, bindSubscription as Xt, buildTracingLayer as Zt, cacheScopeLeaks as Qt, cancelWakeup as $t, compileCron as en, completeOAuthConnect as tn, dataStoreApiKeyStore as nn, dataStoreIdempotencyStore as rn, drainOutbox as an, enableGraphObservation as on, enterRequestLoader as sn, extractDbCause as cn, formatCacheScopeLeaks as ln, formatServerOnlyLeaks as un, frameworkApiKeyStrategy as dn, getConnectionSubject as fn, getTimelineRecorder as pn, installPolicyGuardResolver as mn, isAggregateDefinition as hn, isEmptyTenantScopedRead as gn, isOrglessUserSubject as _n, isScheduleDefinition as vn, isWorkflowEventTriggerDefinition as yn, listRetentions as bn, loadResourceTuples as xn, localityAwareSelector as Sn, makeActionRunner as Cn, makeAdvisoryLockCoordinator as wn, makeApiKeyService as Tn, makeApiKeyUsageBuffer as En, makeApiKeyUsageFlusher as Dn, makeAppAccess as On, makeAsyncKv as kn, makeBufferingSpanProcessor as An, makeConnectionRegistry as jn, makeConnectionResolver as Mn, makeConnectionsFacade as Nn, makeCoordinatedScheduler as Pn, makeDataLoader as Fn, makeDisconnectConnectionExecutor as In, makeEffectStoreLayer as Ln, makeEventsFacade as Rn, makeLazyWorkflowFacade as zn, makeListConnectionsExecutor as Bn, makeMutationRunner as Vn, makeOneShotQueryRunner as Hn, makeOutboxFacade as Un, makePostCommitWorkflowFacade as Wn, makeQueryDescriptorProducer as Gn, makeQueryReauthorizer as Kn, makeQuerySubscriber as qn, makeSchemaRegistry as Jn, makeStartConnectionExecutor as Yn, makeSubmitTokenExecutor as Xn, makeUndoCapture as Zn, makeWorkflowFacade as Qn, makeWorkflowFacadeWithCallerContext as $n, makeWorkflowLayers as er, memoryRywPositionStore as tr, nextFiring as nr, noopAnalytics as B, noopAnalyticsSpec as rr, observedGraph as ir, onProcessShutdown as V, powerOfTwoSelector as ar, recordSubscriptionDelivery as or, recordTimelineEvent as sr, redisRywPositionStore as cr, redoUndoInvocation as lr, registerRetention as ur, registerWakeup as dr, resolveCurrentRegion as fr, resolveSecretsBackend as pr, retentionTtlMsFromEnv as mr, runProvidedEffect as hr, runReaction as gr, sanitizeRedirectTo as _r, serverOnlyLeaks as vr, setConnectionResolver as yr, setSecretsBackend as br, setSystemStoreHandle as xr, setTupleSource as Sr, singleCoordinator as Cr, ssrfGuardHttpClientLayer as wr, startRpcServer as Tr, startScheduler as Er, sweepRetention as Dr, tracingHttpClientLayer as Or, undoCaptureEnabled as kr, undoLogExecutor as Ar, wrapStoreWithBootCodec as jr, wrapStoreWithMixinBehaviour as Mr } from "@voltro/runtime";
-import { createRequire as Nr } from "node:module";
-import { Rpc as Pr, RpcGroup as Fr } from "@effect/rpc";
-import { SqlClient as Ir } from "@effect/sql";
-import { WorkflowEngine as Lr } from "@effect/workflow";
-import { WorkflowStepInterceptorTag as Rr, closeWorkflowChildrenForParent as zr, completeSuspendingSignal as Br, getWorkflowVersionMetadata as Vr, isWorkflowWorkerLayer as Hr, makeWorkflowRunRecorder as Ur, sendWorkflowSignal as Wr, sendWorkflowUpdate as Gr, serialiseWorkflowRowForWire as Kr, wrapWorkflowExecuteWithRunRecording as qr } from "@voltro/workflow";
-import { makeClusterCronLayer as Jr, parseShardLockMode as Yr, resolveRunnerIdentity as Xr, resolveRunnerStorage as Zr, workflowEngineLayer as Qr } from "@voltro/workflow/cluster";
-import { loadAgentMessages as $r, runAgentTurn as ei } from "@voltro/ai";
-import { actorsTable as ti, allRegisteredTables as ni, and as ri, auditAllTableIndexes as ii, drainIdentifierWarnings as ai, ensureTableRegistered as oi, eq as H, formatIndexAuditIssue as si, isEmptyRelationsSpec as ci, isSqliteFamily as li, lt as ui, or as di, registerCoreTables as fi, registerDiscoveredRelations as pi, resolveTenantNamespace as mi, runWithWriteAttribution as hi, serverOnlyColumns as gi, validateRegisteredRelations as _i, walkLeaves as vi } from "@voltro/database";
-import { AuthMiddleware as yi, ConnectionInfoMiddleware as bi, Unauthenticated as xi, WorkflowRunHandleSchema as Si, actionToRpc as Ci, advisoryResourceGuardWarning as wi, anonymousSubject as Ti, checkFrameworkCompat as Ei, composeAuthStrategies as Di, composeRpcInterceptors as Oi, connectionDisconnectDescriptor as ki, connectionStartDescriptor as Ai, connectionSubmitTokenDescriptor as ji, connectionsListQueryDescriptor as Mi, findAdvisoryResourceGuards as Ni, isWireReachable as Pi, mutationToRpc as Fi, publishServerError as Ii, queryToRpc as Li, streamToRpc as Ri, tenantScopedSubject as zi, undoApplyDescriptor as Bi, undoLogQueryDescriptor as Vi, undoRedoDescriptor as Hi, workflowCancelDescriptor as Ui, workflowDomainEventsQueryDescriptor as Wi, workflowEventDeliveriesQueryDescriptor as Gi, workflowResumeDescriptor as Ki, workflowRunEventsQueryDescriptor as qi, workflowRunQueryDescriptor as Ji, workflowRunStepsQueryDescriptor as Yi, workflowRunsQueryDescriptor as Xi, workflowSignalDescriptor as Zi, workflowUpdateDescriptor as Qi } from "@voltro/protocol";
-import { isEnvContract as $i } from "@voltro/env";
-import { readCookie as ea, resolveOptionalSessionSecrets as ta, verifySessionKeyed as na } from "@voltro/protocol/session";
-import { createHash as ra, randomBytes as ia } from "node:crypto";
-import { declaredSnapshot as aa, describeOutcome as oa, fingerprintSchema as sa, introspectSchema as ca, pendingFileMigrationIds as la, planMigrations as ua, runFileBasedMigrations as da, runFrameworkBootstrap as fa, runPlannedMigrations as pa } from "@voltro/database/sql";
-import { Cache as U, CacheLayer as ma, InvalidationBus as ha } from "@voltro/cache";
-import { Kv as ga } from "@voltro/kv";
-import { getAuthSessionStrategy as _a } from "@voltro/plugin-auth";
-import { collectPublicApiRoutes as va, restRoutesToHttpRoutes as ya } from "@voltro/protocol/rest";
-import { spawn as ba } from "node:child_process";
-import { watch as xa } from "chokidar";
-import { agentRouteDescriptors as Sa, isAgentDescriptor as Ca } from "@voltro/ai/agent";
-import { ArrayFormatter as wa } from "effect/ParseResult";
-import { buildDeliverWebhookExecute as Ta, buildWebhooksService as Ea, defaultIncomingPath as Da, deliverWebhookWorkflow as Oa, isWebhookDescriptor as ka, mountIncomingWebhook as Aa } from "@voltro/plugin-webhooks";
-import { isEmailTemplate as ja, registerEmailTemplates as Ma } from "@voltro/plugin-mail";
-import { attachBroadcastBus as Na, getBroadcastPlugin as Pa } from "@voltro/plugin-broadcast";
-import { runImport as Fa } from "@voltro/data-transfer";
-import { createServer as W } from "node:http";
+import { AggregateError as kt, AggregateMaintainer as At, AggregateNotFound as jt, AggregateRegistry as Mt, AggregateStale as Nt, AnalyticsSink as Pt, DORMANCY_WAKEUP_TENANT as Ft, Dispatcher as It, InMemoryDataStore as z, ReactionRateLimiter as Lt, ReplicatedDataStore as Rt, SYSTEM_SUBJECT as zt, actingUserId as Bt, apiKeyManagementRoutes as Vt, applySoftDeleteScope as Ht, applyTenantScope as Ut, applyUndoInvocation as Wt, assertConnectionCipherConfigured as Gt, attachAnalyticsMirror as Kt, awaitServerListening as qt, bindMutation as Jt, bindStream as Yt, bindSubscription as Xt, buildTracingLayer as Zt, cacheScopeLeaks as Qt, cancelWakeup as $t, compileCron as en, completeOAuthConnect as tn, dataStoreApiKeyStore as nn, dataStoreIdempotencyStore as rn, drainOutbox as an, enableGraphObservation as on, enterRequestLoader as sn, extractDbCause as cn, formatCacheScopeLeaks as ln, formatServerOnlyLeaks as un, frameworkApiKeyStrategy as dn, getConnectionSubject as fn, getTimelineRecorder as pn, installPolicyGuardResolver as mn, isAggregateDefinition as hn, isEmptyTenantScopedRead as gn, isOrglessUserSubject as _n, isScheduleDefinition as vn, isWorkflowEventTriggerDefinition as yn, listRetentions as bn, loadResourceTuples as xn, localityAwareSelector as Sn, makeActionRunner as Cn, makeAdvisoryLockCoordinator as wn, makeApiKeyService as Tn, makeApiKeyUsageBuffer as En, makeApiKeyUsageFlusher as Dn, makeAppAccess as On, makeAsyncKv as kn, makeBufferingSpanProcessor as An, makeConnectionRegistry as jn, makeConnectionResolver as Mn, makeConnectionsFacade as Nn, makeCoordinatedScheduler as Pn, makeDataLoader as Fn, makeDisconnectConnectionExecutor as In, makeEffectStoreLayer as Ln, makeEventsFacade as Rn, makeLazyWorkflowFacade as zn, makeListConnectionsExecutor as Bn, makeMutationOutputCodec as Vn, makeMutationRunner as Hn, makeOneShotQueryRunner as Un, makeOutboxFacade as Wn, makePostCommitWorkflowFacade as Gn, makeQueryDescriptorProducer as Kn, makeQueryReauthorizer as qn, makeQuerySubscriber as Jn, makeSchemaRegistry as Yn, makeStartConnectionExecutor as Xn, makeSubmitTokenExecutor as Zn, makeUndoCapture as Qn, makeWorkflowFacade as $n, makeWorkflowFacadeWithCallerContext as er, makeWorkflowLayers as tr, memoryRywPositionStore as nr, nextFiring as rr, noopAnalytics as B, noopAnalyticsSpec as ir, observedGraph as ar, onProcessShutdown as V, powerOfTwoSelector as or, recordSubscriptionDelivery as sr, recordTimelineEvent as cr, redisRywPositionStore as lr, redoUndoInvocation as ur, registerRetention as dr, registerWakeup as fr, resolveCurrentRegion as pr, resolveSecretsBackend as mr, retentionTtlMsFromEnv as hr, runProvidedEffect as gr, runReaction as _r, sanitizeRedirectTo as vr, serverOnlyLeaks as yr, setConnectionResolver as br, setSecretsBackend as xr, setSystemStoreHandle as Sr, setTupleSource as Cr, settleHandlerBody as wr, singleCoordinator as Tr, ssrfGuardHttpClientLayer as Er, startRpcServer as Dr, startScheduler as Or, sweepRetention as kr, tracingHttpClientLayer as Ar, undoCaptureEnabled as jr, undoLogExecutor as Mr, wrapStoreWithBootCodec as Nr, wrapStoreWithMixinBehaviour as Pr } from "@voltro/runtime";
+import { createRequire as Fr } from "node:module";
+import { Rpc as Ir, RpcGroup as Lr } from "@effect/rpc";
+import { SqlClient as Rr } from "@effect/sql";
+import { WorkflowEngine as zr } from "@effect/workflow";
+import { WorkflowStepInterceptorTag as Br, closeWorkflowChildrenForParent as Vr, completeSuspendingSignal as Hr, getWorkflowVersionMetadata as Ur, isWorkflowWorkerLayer as Wr, makeWorkflowRunRecorder as Gr, sendWorkflowSignal as Kr, sendWorkflowUpdate as qr, serialiseWorkflowRowForWire as Jr, wrapWorkflowExecuteWithRunRecording as Yr } from "@voltro/workflow";
+import { makeClusterCronLayer as Xr, parseShardLockMode as Zr, resolveRunnerIdentity as Qr, resolveRunnerStorage as $r, workflowEngineLayer as ei } from "@voltro/workflow/cluster";
+import { loadAgentMessages as ti, runAgentTurn as ni } from "@voltro/ai";
+import { actorsTable as ri, allRegisteredTables as ii, and as ai, auditAllTableIndexes as oi, drainIdentifierWarnings as si, ensureTableRegistered as ci, eq as H, formatIndexAuditIssue as li, isEmptyRelationsSpec as ui, isSqliteFamily as di, lt as fi, or as pi, registerCoreTables as mi, registerDiscoveredRelations as hi, resolveTenantNamespace as gi, runWithWriteAttribution as _i, serverOnlyColumns as vi, validateRegisteredRelations as yi, walkLeaves as bi } from "@voltro/database";
+import { AuthMiddleware as xi, ConnectionInfoMiddleware as Si, Unauthenticated as Ci, WorkflowRunHandleSchema as wi, actionToRpc as Ti, advisoryResourceGuardWarning as Ei, anonymousSubject as Di, checkFrameworkCompat as Oi, composeAuthStrategies as ki, composeRpcInterceptors as Ai, connectionDisconnectDescriptor as ji, connectionStartDescriptor as Mi, connectionSubmitTokenDescriptor as Ni, connectionsListQueryDescriptor as Pi, findAdvisoryResourceGuards as Fi, isWireReachable as Ii, mutationToRpc as Li, publishServerError as Ri, queryToRpc as zi, streamToRpc as Bi, tenantScopedSubject as Vi, undoApplyDescriptor as Hi, undoLogQueryDescriptor as Ui, undoRedoDescriptor as Wi, workflowCancelDescriptor as Gi, workflowDomainEventsQueryDescriptor as Ki, workflowEventDeliveriesQueryDescriptor as qi, workflowResumeDescriptor as Ji, workflowRunEventsQueryDescriptor as Yi, workflowRunQueryDescriptor as Xi, workflowRunStepsQueryDescriptor as Zi, workflowRunsQueryDescriptor as Qi, workflowSignalDescriptor as $i, workflowUpdateDescriptor as ea } from "@voltro/protocol";
+import { isEnvContract as ta } from "@voltro/env";
+import { readCookie as na, resolveOptionalSessionSecrets as ra, verifySessionKeyed as ia } from "@voltro/protocol/session";
+import { createHash as aa, randomBytes as U } from "node:crypto";
+import { declaredSnapshot as oa, describeOutcome as sa, fingerprintSchema as ca, introspectSchema as la, pendingFileMigrationIds as ua, planMigrations as da, runFileBasedMigrations as fa, runFrameworkBootstrap as pa, runPlannedMigrations as ma } from "@voltro/database/sql";
+import { Cache as ha, CacheLayer as ga, InvalidationBus as _a } from "@voltro/cache";
+import { Kv as va } from "@voltro/kv";
+import { getAuthSessionStrategy as ya } from "@voltro/plugin-auth";
+import { collectPublicApiRoutes as ba, restRoutesToHttpRoutes as xa } from "@voltro/protocol/rest";
+import { spawn as Sa } from "node:child_process";
+import { watch as Ca } from "chokidar";
+import { agentRouteDescriptors as wa, isAgentDescriptor as Ta } from "@voltro/ai/agent";
+import { ArrayFormatter as Ea } from "effect/ParseResult";
+import { buildDeliverWebhookExecute as Da, buildWebhooksService as Oa, defaultIncomingPath as ka, deliverWebhookWorkflow as Aa, isWebhookDescriptor as ja, mountIncomingWebhook as Ma } from "@voltro/plugin-webhooks";
+import { isEmailTemplate as Na, registerEmailTemplates as Pa } from "@voltro/plugin-mail";
+import { attachBroadcastBus as Fa, getBroadcastPlugin as W } from "@voltro/plugin-broadcast";
+import { runImport as Ia } from "@voltro/data-transfer";
+import { createServer as La } from "node:http";
 //#region src/inspectEntries.ts
-var Ia = (e) => {
+var Ra = (e) => {
 	let t = e;
 	return {
 		name: t.name,
@@ -50,15 +50,15 @@ var Ia = (e) => {
 		output: t.element,
 		error: t.error
 	};
-}, La = (e, t) => [
+}, za = (e, t) => [
 	...e.queries.map((e) => D(e.descriptor, "query", j(t, e.file))),
 	...e.mutations.map((e) => D(e.descriptor, "mutation", j(t, e.file))),
 	...e.actions.map((e) => D(e.descriptor, "action", j(t, e.file))),
-	...(e.streams ?? []).map((e) => D(Ia(e.descriptor), "stream", j(t, e.file)))
-], Ra = (e, t) => e.workflows.map((e) => ({
+	...(e.streams ?? []).map((e) => D(Ra(e.descriptor), "stream", j(t, e.file)))
+], Ba = (e, t) => e.workflows.map((e) => ({
 	tag: String(e.definition.name),
 	file: j(t, e.file)
-})), za = (e, t) => {
+})), G = (e, t) => {
 	if (typeof process.getuid != "function") return;
 	let n;
 	try {
@@ -73,20 +73,20 @@ var Ia = (e) => {
 	} catch (t) {
 		return `${e} was written as uid ${r} but the workspace is owned by uid ${n.uid}, and it could not be handed over (${t.message}). The file is mode 0600, so tools running as uid ${n.uid} — your tests, your editor, \`voltro doctor\` — will fail to read it with EACCES. Run this container as the workspace owner (docker \`--user ${n.uid}:${n.gid}\`), or set the variable(s) yourself so nothing needs minting.`;
 	}
-}, G = ".env.local", Ba = (e) => {
+}, Va = ".env.local", Ha = (e) => {
 	let t = A(e, ".gitignore"), n = "";
 	try {
 		L(t) && (n = Tt(t, "utf8"));
 	} catch {
 		return !1;
 	}
-	if (n.split(/\r?\n/).map((e) => e.trim()).some((e) => e === G || e === `/${G}` || e === ".env*" || e === ".env.*" || e === ".env.local*")) return !0;
+	if (n.split(/\r?\n/).map((e) => e.trim()).some((e) => e === Va || e === `/${Va}` || e === ".env*" || e === ".env.*" || e === ".env.local*")) return !0;
 	try {
-		return I(t, `${n === "" || n.endsWith("\n") ? "" : "\n"}\n# Local secrets minted by \`voltro dev\` — machine-specific, never commit.\n${G}\n`, "utf8"), !0;
+		return I(t, `${n === "" || n.endsWith("\n") ? "" : "\n"}\n# Local secrets minted by \`voltro dev\` — machine-specific, never commit.\n${Va}\n`, "utf8"), !0;
 	} catch {
 		return !1;
 	}
-}, Va = (e) => ia(32).toString(e), Ha = [{
+}, Ua = (e) => U(32).toString(e), Wa = [{
 	key: "VOLTRO_INSPECT_TOKEN",
 	encoding: "base64url",
 	description: "Bearer token for /_voltro/inspect/* — minted so the dev inspect surface is not open to the network."
@@ -94,13 +94,13 @@ var Ia = (e) => {
 	key: "VOLTRO_INSPECT_WRITE_TOKEN",
 	encoding: "base64url",
 	description: "Second factor for MUTATING /_voltro/inspect/* endpoints (GDPR erase/export, storage share/revoke)."
-}], Ua = (e, t, n = process.env) => {
+}], Ga = (e, t, n = process.env) => {
 	let r = [];
-	for (let e of Ha) {
+	for (let e of Wa) {
 		let t = n[e.key];
 		t !== void 0 && t.trim() !== "" || r.push({
 			key: e.key,
-			value: Va(e.encoding),
+			value: Ua(e.encoding),
 			description: e.description
 		});
 	}
@@ -109,13 +109,13 @@ var Ia = (e) => {
 		let e = n[t];
 		e !== void 0 && e.trim() !== "" || r.push({
 			key: t,
-			value: Va(i.generate),
+			value: Ua(i.generate),
 			description: i.description
 		});
 	}
 	if (r.length === 0) return { minted: [] };
-	if (!Ba(t)) throw Error(`cannot mint ${r.map((e) => e.key).join(", ")}: failed to add "${G}" to ${A(t, ".gitignore")}. Refusing to write a secret to a path that might be committed — add the entry by hand, or set the variable(s) yourself (\`voltro secret generate\`).`);
-	let i = A(t, G), a = r.map((e) => `${e.description ? `# ${e.description}\n` : ""}${e.key}=${e.value}`).join("\n"), o;
+	if (!Ha(t)) throw Error(`cannot mint ${r.map((e) => e.key).join(", ")}: failed to add "${Va}" to ${A(t, ".gitignore")}. Refusing to write a secret to a path that might be committed — add the entry by hand, or set the variable(s) yourself (\`voltro secret generate\`).`);
+	let i = A(t, Va), a = r.map((e) => `${e.description ? `# ${e.description}\n` : ""}${e.key}=${e.value}`).join("\n"), o;
 	try {
 		if (L(i)) {
 			let e = Tt(i, "utf8");
@@ -126,7 +126,7 @@ var Ia = (e) => {
 \n${a}\n`, {
 			encoding: "utf8",
 			mode: 384
-		}), o = za(i, t);
+		}), o = G(i, t);
 	} catch (e) {
 		throw Error(`cannot mint ${r.map((e) => e.key).join(", ")}: failed to write ${i} — ${e.message}`);
 	}
@@ -136,7 +136,7 @@ var Ia = (e) => {
 		file: i,
 		...o ? { ownershipWarning: o } : {}
 	};
-}, Wa = [".framework", ".env.local"], Ga = /\.generated\./i, Ka = (e) => {
+}, Ka = [".framework", ".env.local"], qa = /\.generated\./i, Ja = (e) => {
 	try {
 		let t = Dt(e);
 		return {
@@ -146,7 +146,7 @@ var Ia = (e) => {
 	} catch {
 		return;
 	}
-}, qa = (e, t, n) => {
+}, K = (e, t, n) => {
 	let r = !0;
 	try {
 		wt(e, t, n);
@@ -160,44 +160,44 @@ var Ia = (e) => {
 	} catch {
 		return r;
 	}
-	for (let a of i) qa(A(e, a), t, n) || (r = !1);
+	for (let a of i) K(A(e, a), t, n) || (r = !1);
 	return r;
-}, Ja = (e) => {
+}, Ya = (e) => {
 	if (typeof process.getuid != "function") return { adopted: [] };
-	let t = Ka(e);
+	let t = Ja(e);
 	if (t === void 0) return { adopted: [] };
 	let n = process.getuid();
 	if (t.uid === n) return { adopted: [] };
-	let r = [...Wa];
+	let r = [...Ka];
 	try {
-		for (let t of Et(e)) Ga.test(t) && r.push(t);
+		for (let t of Et(e)) qa.test(t) && r.push(t);
 	} catch {}
 	let i = [], a = !1;
 	for (let n of r) {
 		let r = A(e, n);
-		Ka(r) !== void 0 && (qa(r, t.uid, t.gid) ? i.push(n) : a = !0);
+		Ja(r) !== void 0 && (K(r, t.uid, t.gid) ? i.push(n) : a = !0);
 	}
 	return a ? {
 		adopted: i,
 		warning: `generated files under ${e} are owned by uid ${n} but the workspace is owned by uid ${t.uid}, and they could not be handed over. On the host, tools running as uid ${t.uid} will fail with EACCES — \`voltro build\` cannot read \`.framework\`, and \`vitest\` cannot read \`.env.local\`. Run this container as the workspace owner (docker \`--user ${t.uid}:${t.gid}\`).`
 	} : { adopted: i };
-}, K = (e) => e.startsWith("_voltro_"), Ya = (e) => e === void 0 || e === "" || !/^file:/i.test(e) || (process.env.TURSO_SYNC_URL ?? "") !== "", Xa = (e) => {
-	if (e.dialect === "turso" && Ya(e.dbUrl)) return [{
+}, Xa = (e) => e.startsWith("_voltro_"), Za = (e) => e === void 0 || e === "" || !/^file:/i.test(e) || (process.env.TURSO_SYNC_URL ?? "") !== "", Qa = (e) => {
+	if (e.dialect === "turso" && Za(e.dbUrl)) return [{
 		level: "warn",
 		message: "turso is configured against a shared primary, but this dialect has no NATIVE cross-instance change capture: it reuses the SQLite store, which emits inline only. Subscribers see writes made by THEIR OWN instance and never another's — for every table, regardless of .nonReactive(). Add @voltro/plugin-broadcast (Redis / NATS) to fan changes out between instances, or run a single instance."
 	}];
 	if (e.changeStrategy !== "cdc" || e.dialect === "sqlite" || e.dialect === "turso") return [];
-	let t = new Set(e.querySources.filter((e) => !K(e))), n = e.tables.filter((e) => !K(e.tableName)).filter((e) => e.isReactive === !1 && t.has(e.tableName)).map((e) => e.tableName).sort();
+	let t = new Set(e.querySources.filter((e) => !Xa(e))), n = e.tables.filter((e) => !Xa(e.tableName)).filter((e) => e.isReactive === !1 && t.has(e.tableName)).map((e) => e.tableName).sort();
 	if (n.length === 0) return [];
 	let r = n.slice(0, 8).join(", "), i = n.length > 8 ? `, … (+${n.length - 8})` : "";
 	return [{
 		level: "warn",
 		message: `${n.length} table(s) are .nonReactive() but a query declares them as a source — ${r}${i}. Those subscriptions will NEVER fire: a non-reactive table emits no change events at all, in this process or any other, so the query returns its first snapshot and then goes quiet forever. Either drop .nonReactive() from the table, or stop subscribing to it.`
 	}];
-}, Za = "VOLTRO_REMOTE_MIGRATIONS_OK", Qa = /^(10\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.)/, $a = (e) => {
+}, $a = "VOLTRO_REMOTE_MIGRATIONS_OK", eo = /^(10\.|192\.168\.|172\.(1[6-9]|2\d|3[01])\.)/, to = (e) => {
 	let t = e.toLowerCase().replace(/^\[|\]$/g, "");
-	return !!(t === "" || t === "localhost" || t === "ip6-localhost" || t === "::1" || t === "0.0.0.0" || t === "::" || t.startsWith("127.") || t === "host.docker.internal" || t === "gateway.docker.internal" || t.endsWith(".localhost") || t.endsWith(".local") || Qa.test(t) || !t.includes(".") && !t.includes(":"));
-}, eo = (e) => {
+	return !!(t === "" || t === "localhost" || t === "ip6-localhost" || t === "::1" || t === "0.0.0.0" || t === "::" || t.startsWith("127.") || t === "host.docker.internal" || t === "gateway.docker.internal" || t.endsWith(".localhost") || t.endsWith(".local") || eo.test(t) || !t.includes(".") && !t.includes(":"));
+}, no = (e) => {
 	if (e.url !== void 0 && e.url !== "") {
 		if (/^(file|sqlite):/i.test(e.url)) return {
 			kind: "local",
@@ -206,7 +206,7 @@ var Ia = (e) => {
 		try {
 			let t = new URL(e.url).hostname;
 			return {
-				kind: $a(t) ? "local" : "remote",
+				kind: to(t) ? "local" : "remote",
 				host: t
 			};
 		} catch {
@@ -218,12 +218,12 @@ var Ia = (e) => {
 	}
 	let t = e.host ?? "localhost";
 	return {
-		kind: $a(t) ? "local" : "remote",
+		kind: to(t) ? "local" : "remote",
 		host: t
 	};
-}, to = (e) => {
+}, ro = (e) => {
 	if (e.pendingIds.length === 0 || e.optIn) return { allowed: !0 };
-	let t = eo(e.conn);
+	let t = no(e.conn);
 	if (t.kind === "local") return { allowed: !0 };
 	let n = e.pendingIds.map((e) => `    • ${e}`).join("\n");
 	return {
@@ -242,11 +242,11 @@ var Ia = (e) => {
 			"  Choose one:",
 			"    • Point the app at a local database (DB_URL), which is what dev boot assumes.",
 			"    • Apply them deliberately, once:  voltro db files .",
-			`    • Accept it for this environment:  ${Za}=1`
+			`    • Accept it for this environment:  ${$a}=1`
 		].join("\n")
 	};
-}, no = async ({ env: e = process.env } = {}) => {
-	let t = gt.make(F.mergeAll(ma.layer, ha.Default)), n = await t.runPromise(U), r = await t.runPromise(ha), i = (e.CACHE_BACKEND ?? "memory").toLowerCase();
+}, io = async ({ env: e = process.env } = {}) => {
+	let t = gt.make(F.mergeAll(ga.layer, _a.Default)), n = await t.runPromise(ha), r = await t.runPromise(_a), i = (e.CACHE_BACKEND ?? "memory").toLowerCase();
 	return await t.runPromise(r.addSink((e) => n.invalidateTag(e))), {
 		service: n,
 		invalidationBus: r,
@@ -278,25 +278,29 @@ var Ia = (e) => {
 		stats: () => t.runSync(n.stats()),
 		dispose: () => t.dispose()
 	};
-}, ro = ({ store: e, dialect: t, env: n = process.env }) => {
+}, ao = ({ store: e, dialect: t, env: n = process.env }) => {
 	if (t !== "postgres") return { stop: () => {} };
-	ur({
+	dr({
 		table: "_voltro_schedule_runs",
 		timeColumn: "scheduledAt",
-		ttlMs: mr(n.VOLTRO_SCHEDULE_RUNS_TTL_HOURS, 720)
-	}), ur({
+		ttlMs: hr(n.VOLTRO_SCHEDULE_RUNS_TTL_HOURS, 720)
+	}), dr({
+		table: "_voltro_schedule_claims",
+		timeColumn: "claimedAt",
+		ttlMs: hr(n.VOLTRO_SCHEDULE_CLAIMS_TTL_HOURS, 720)
+	}), dr({
 		table: "_voltro_workflow_runs",
 		timeColumn: "completedAt",
-		ttlMs: mr(n.VOLTRO_WORKFLOW_RUNS_TTL_HOURS, 720),
-		where: di(H("status", "succeeded"), H("status", "failed"), H("status", "cancelled"))
-	}), ur({
+		ttlMs: hr(n.VOLTRO_WORKFLOW_RUNS_TTL_HOURS, 720),
+		where: pi(H("status", "succeeded"), H("status", "failed"), H("status", "cancelled"))
+	}), dr({
 		table: "_voltro_outbox_attempts",
 		timeColumn: "startedAt",
-		ttlMs: mr(n.VOLTRO_OUTBOX_ATTEMPTS_TTL_HOURS, 720)
-	}), ur({
+		ttlMs: hr(n.VOLTRO_OUTBOX_ATTEMPTS_TTL_HOURS, 720)
+	}), dr({
 		table: "_voltro_outbox",
 		timeColumn: "deliveredAt",
-		ttlMs: mr(n.VOLTRO_OUTBOX_TTL_HOURS, 720),
+		ttlMs: hr(n.VOLTRO_OUTBOX_TTL_HOURS, 720),
 		where: H("status", "delivered")
 	});
 	let r = e.raw?.bind(e), i = (e) => {
@@ -312,7 +316,7 @@ var Ia = (e) => {
 			};
 			return (await r(e)).length;
 		}
-		let d = ui(l, a), f = s === void 0 ? d : ri(d, s), p = await e.query({
+		let d = fi(l, a), f = s === void 0 ? d : ai(d, s), p = await e.query({
 			table: c,
 			order: [],
 			predicate: f,
@@ -327,20 +331,20 @@ var Ia = (e) => {
 	}, o = async () => {
 		let e = Date.now();
 		for (let t of bn()) try {
-			await Dr(t, e, a, 2e4);
+			await kr(t, e, a, 2e4);
 		} catch {}
 	}, s = setInterval(() => {
 		o();
 	}, 5 * 6e4);
 	return s.unref?.(), { stop: () => clearInterval(s) };
-}, io = (e) => {
+}, oo = (e) => {
 	let t = Fn({ store: e.store });
 	return sn(t), {
-		storeForTenant: (t) => Mr(e.store, {
-			subject: zi(zt, t),
+		storeForTenant: (t) => Pr(e.store, {
+			subject: Vi(zt, t),
 			schemaRegistry: e.schemaRegistry
 		}),
-		store: Mr(e.store, {
+		store: Pr(e.store, {
 			subject: zt,
 			schemaRegistry: e.schemaRegistry
 		}),
@@ -354,14 +358,14 @@ var Ia = (e) => {
 		cache: e.cache,
 		kv: e.kv
 	};
-}, ao = (e) => {
+}, so = (e) => {
 	let { store: t, schemaRegistry: n, cache: r, kv: i, webhooksService: a, workflowsProxy: o, eventTriggers: s, namespaceIsolationOn: c, onEventEmit: l, outbox: u, connections: d } = e, f = (e, t) => {
 		if (!c) return e;
 		if (e.withNamespace === void 0) throw Error("tenantIsolation=namespace is set but the active store has no physical-namespace support (withNamespace).");
-		return e.withNamespace(mi(t.tenantId));
+		return e.withNamespace(gi(t.tenantId));
 	};
 	return (e, c = t, p, m = "app-context", h) => {
-		let ee = f(c, e.subject), g = o === void 0 ? void 0 : $n(o, {
+		let ee = f(c, e.subject), g = o === void 0 ? void 0 : er(o, {
 			subject: e.subject,
 			traceId: e.traceId,
 			source: m,
@@ -376,10 +380,10 @@ var Ia = (e) => {
 			...l === void 0 ? {} : { emit: l },
 			...h?.parentExecutionId === void 0 ? {} : { parentExecutionId: h.parentExecutionId },
 			startWorkflow: (e, t, n) => {
-				let r = $n(o, n);
-				return (p ? Wn(r, p.afterCommit) : r).start(e, t);
+				let r = er(o, n);
+				return (p ? Gn(r, p.afterCommit) : r).start(e, t);
 			}
-		}), _ = u === void 0 ? void 0 : Un({
+		}), _ = u === void 0 ? void 0 : Wn({
 			store: ee,
 			subject: e.subject,
 			traceId: e.traceId,
@@ -394,14 +398,14 @@ var Ia = (e) => {
 		let re = e.rowFilter === void 0 ? {} : { rowFilter: e.rowFilter };
 		return {
 			storeForTenant: (t) => {
-				let r = zi(e.subject, t);
-				return Mr(f(c, r), {
+				let r = Vi(e.subject, t);
+				return Pr(f(c, r), {
 					subject: r,
 					schemaRegistry: n,
 					...re
 				});
 			},
-			store: Mr(ee, {
+			store: Pr(ee, {
 				subject: e.subject,
 				schemaRegistry: n,
 				...e.rowFilter === void 0 ? {} : { rowFilter: e.rowFilter }
@@ -416,11 +420,11 @@ var Ia = (e) => {
 			...te === void 0 ? {} : { events: te },
 			..._ === void 0 ? {} : { outbox: _ },
 			...v === void 0 ? {} : { connections: v },
-			...g === void 0 ? {} : { workflows: p ? Wn(g, p.afterCommit) : g }
+			...g === void 0 ? {} : { workflows: p ? Gn(g, p.afterCommit) : g }
 		};
 	};
-}, oo = async (e, t, n) => {
-	if (t.type === "anonymous" || t.id == null) throw new xi({ reason: "workflow control requires an authenticated subject" });
+}, co = async (e, t, n) => {
+	if (t.type === "anonymous" || t.id == null) throw new Ci({ reason: "workflow control requires an authenticated subject" });
 	let r = "id" in n ? H("id", n.id) : H("executionId", n.executionId), i = (await e.query({
 		table: "_voltro_workflow_runs",
 		order: [],
@@ -429,9 +433,9 @@ var Ia = (e) => {
 		skip: void 0,
 		take: 1
 	}))[0], a = i?.subject?.tenantId ?? null, o = t.tenantId ?? null;
-	if (i === void 0 || a !== o) throw new xi({ reason: "not authorized for this workflow run" });
-}, so = (e = {}) => Or.pipe(F.provide(wr(e)), F.provide(ut.layer), F.provide(F.succeed(ut.RequestInit, { redirect: "manual" }))), co = (e) => {
-	let t = F.succeed(U, e.cacheService), n = F.succeed(ga, e.kvService), r = [
+	if (i === void 0 || a !== o) throw new Ci({ reason: "not authorized for this workflow run" });
+}, lo = (e = {}) => Ar.pipe(F.provide(Er(e)), F.provide(ut.layer), F.provide(F.succeed(ut.RequestInit, { redirect: "manual" }))), uo = (e) => {
+	let t = F.succeed(ha, e.cacheService), n = F.succeed(va, e.kvService), r = [
 		e.analyticsLayer,
 		t,
 		n,
@@ -439,40 +443,40 @@ var Ia = (e) => {
 		...e.userLayers
 	];
 	return F.mergeAll(...r);
-}, lo = [
-	Ji,
+}, fo = [
 	Xi,
+	Qi,
+	Zi,
 	Yi,
-	qi,
-	Wi,
-	Gi
-], uo = (e, t, n) => {
+	Ki,
+	qi
+], po = (e, t, n) => {
 	let r = new Set(t);
-	if (n) for (let e of lo) r.add(e.name);
+	if (n) for (let e of fo) r.add(e.name);
 	let i = {};
 	for (let [t, n] of Object.entries(e)) i[t] = r.has(t) ? (e) => n(e).pipe(bt.take(1)) : n;
 	return i;
-}, fo = "VOLTRO_TSX_IMPORT", po = /^--(?:import|loader|experimental-loader|require)(?:=|$)/, mo = (e) => /(?:^|[/\\])tsx(?:$|[/\\])/.test(e), ho = (e) => e.some((t, n) => {
-	if (!po.test(t)) return !1;
+}, mo = "VOLTRO_TSX_IMPORT", ho = /^--(?:import|loader|experimental-loader|require)(?:=|$)/, go = (e) => /(?:^|[/\\])tsx(?:$|[/\\])/.test(e), _o = (e) => e.some((t, n) => {
+	if (!ho.test(t)) return !1;
 	let r = t.indexOf("=");
-	return mo(r === -1 ? e[n + 1] ?? "" : t.slice(r + 1));
-}), go = () => {
+	return go(r === -1 ? e[n + 1] ?? "" : t.slice(r + 1));
+}), vo = () => {
 	try {
 		return import.meta.resolve("tsx");
 	} catch {
 		try {
-			return lt(Nr(import.meta.url).resolve("tsx")).href;
+			return lt(Fr(import.meta.url).resolve("tsx")).href;
 		} catch {
 			return;
 		}
 	}
-}, _o = (e = {}) => {
+}, yo = (e = {}) => {
 	let t = e.env ?? process.env, n = e.execArgv ?? process.execArgv;
-	if (ho(n)) return {
+	if (_o(n)) return {
 		execArgv: [...n],
 		source: "inherited"
 	};
-	let r = t[fo];
+	let r = t[mo];
 	if (r !== void 0 && r !== "") return {
 		execArgv: [
 			...n,
@@ -481,7 +485,7 @@ var Ia = (e) => {
 		],
 		source: "shim-env"
 	};
-	let i = (e.resolve ?? go)();
+	let i = (e.resolve ?? vo)();
 	return i === void 0 ? {
 		execArgv: [
 			...n,
@@ -497,20 +501,20 @@ var Ia = (e) => {
 		],
 		source: "resolved"
 	};
-}, vo = (e) => e.source === "unresolved" ? "could not resolve the tsx loader from @voltro/cli — falling back to a bare `--import tsx`, which Node resolves against the working directory. If the child dies with \"Cannot find package 'tsx'\", reinstall @voltro/cli with its optional dependencies (a `--no-optional` install omits tsx, which `voltro dev` needs to load your `.ts` sources)." : void 0, q = xt({ scope: "voltro:dev:supervisor" }), yo = /\.generated\./, bo = /\.([cm]?[jt]sx?|json)$/, xo = (e) => {
+}, bo = (e) => e.source === "unresolved" ? "could not resolve the tsx loader from @voltro/cli — falling back to a bare `--import tsx`, which Node resolves against the working directory. If the child dies with \"Cannot find package 'tsx'\", reinstall @voltro/cli with its optional dependencies (a `--no-optional` install omits tsx, which `voltro dev` needs to load your `.ts` sources)." : void 0, q = xt({ scope: "voltro:dev:supervisor" }), xo = /\.generated\./, So = /\.([cm]?[jt]sx?|json)$/, Co = (e) => {
 	let t = O(e);
-	return !yo.test(t) && bo.test(t);
-}, So = (e) => e.startsWith("node_modules") || e.startsWith(".framework") || e.startsWith(".turbo") || e.startsWith(".vite") || e.startsWith("dist") || e.startsWith(".git"), Co = process.env.WATCH_POLL === "1" || process.env.CHOKIDAR_USEPOLLING === "1", wo = 1e3, To = (e) => bt.async((t) => {
-	let n = M(e), r = (e) => j(n, e), i = xa(n, {
+	return !xo.test(t) && So.test(t);
+}, wo = (e) => e.startsWith("node_modules") || e.startsWith(".framework") || e.startsWith(".turbo") || e.startsWith(".vite") || e.startsWith("dist") || e.startsWith(".git"), To = process.env.WATCH_POLL === "1" || process.env.CHOKIDAR_USEPOLLING === "1", Eo = 1e3, J = (e) => bt.async((t) => {
+	let n = M(e), r = (e) => j(n, e), i = Ca(n, {
 		persistent: !0,
 		ignoreInitial: !0,
 		atomic: !0,
-		usePolling: Co,
-		interval: wo,
-		binaryInterval: wo,
+		usePolling: To,
+		interval: Eo,
+		binaryInterval: Eo,
 		ignored: (e) => {
 			let t = r(e);
-			return t === "" ? !1 : So(t) || yo.test(O(e));
+			return t === "" ? !1 : wo(t) || xo.test(O(e));
 		}
 	});
 	return i.on("all", (e, n) => {
@@ -518,20 +522,20 @@ var Ia = (e) => {
 		process.env.WATCH_DEBUG === "1" && q.trace("watcher fired", {
 			event: e,
 			file: i
-		}), !So(i) && xo(i) && t.single({ file: i });
+		}), !wo(i) && Co(i) && t.single({ file: i });
 	}), i.on("error", (e) => {
-		q.error("watcher error", { hint: Co ? void 0 : "on a bind-mount (k8s hostPath / Docker volume) set WATCH_POLL=1" }, e);
+		q.error("watcher error", { hint: To ? void 0 : "on a bind-mount (k8s hostPath / Docker volume) set WATCH_POLL=1" }, e);
 	}), P.sync(() => {
 		i.close();
 	});
-}), J = (e) => P.async((t) => {
+}), Do = (e) => P.async((t) => {
 	if (e.exitCode !== null) {
 		t(P.succeed(e.exitCode));
 		return;
 	}
 	e.once("exit", (e, n) => t(P.succeed(e ?? +!!n)));
-}), Eo = (e) => e.exitCode === null && e.signalCode === null, Do = (e, t = {}) => P.async((n) => {
-	if (!Eo(e)) {
+}), Oo = (e) => e.exitCode === null && e.signalCode === null, ko = (e, t = {}) => P.async((n) => {
+	if (!Oo(e)) {
 		n(P.succeed("already-exited"));
 		return;
 	}
@@ -546,17 +550,17 @@ var Ia = (e) => {
 		c(s ? "killed" : "terminated");
 	}
 	e.once("exit", l), e.kill("SIGTERM"), a.push(setTimeout(() => {
-		if (!Eo(e)) {
+		if (!Oo(e)) {
 			c("terminated");
 			return;
 		}
 		s = !0, e.kill("SIGKILL"), a.push(setTimeout(() => {
-			c(Eo(e) ? "abandoned" : "killed");
+			c(Oo(e) ? "abandoned" : "killed");
 		}, i));
 	}, r));
-}), Oo = (e) => P.acquireUseRelease(P.sync(() => {
-	let t = process.argv[1] ?? "", n = _o(), r = vo(n);
-	return r !== void 0 && q.warn(r), ba(process.execPath, [
+}), Y = (e) => P.acquireUseRelease(P.sync(() => {
+	let t = process.argv[1] ?? "", n = yo(), r = bo(n);
+	return r !== void 0 && q.warn(r), Sa(process.execPath, [
 		...n.execArgv,
 		t,
 		"dev",
@@ -568,7 +572,7 @@ var Ia = (e) => {
 			FRAMEWORK_DEV_INNER: "1"
 		}
 	});
-}), J, (e) => Do(e).pipe(P.tap((t) => P.sync(() => {
+}), Do, (e) => ko(e).pipe(P.tap((t) => P.sync(() => {
 	t === "killed" && q.warn("child ignored SIGTERM — escalated to SIGKILL", {
 		pid: e.pid,
 		hint: "a shutdown hook or a pool drain is not completing"
@@ -576,15 +580,15 @@ var Ia = (e) => {
 		pid: e.pid,
 		hint: "it still holds the port; the next boot will fail to bind. kill -9 it by hand"
 	});
-})), P.asVoid)), Y = (e) => e.exitCode === 0 ? "stop" : e.keepAlive === "1" ? "wait-for-fix" : e.keepAlive === "0" ? "stop" : e.interactive ? "wait-for-fix" : "stop", ko = (e) => P.gen(function* () {
+})), P.asVoid)), Ao = (e) => e.exitCode === 0 ? "stop" : e.keepAlive === "1" ? "wait-for-fix" : e.keepAlive === "0" ? "stop" : e.interactive ? "wait-for-fix" : "stop", jo = (e) => P.gen(function* () {
 	q.info("supervisor active — watching project root", {
 		root: e.root,
 		patterns: ["**/*.{ts,tsx,mts,cts,js,jsx,mjs,cjs,json} (excl. *.generated.*)"],
-		watcher: Co ? "chokidar (polling)" : "chokidar (native)",
+		watcher: To ? "chokidar (polling)" : "chokidar (native)",
 		hint: "WATCH=0 disables, WATCH_DEBUG=1 traces every event, WATCH_POLL=1 for bind-mounts (k8s/Docker)"
 	});
 	let t = yield* vt.make(_t.none()), n = yield* pt.make(), r = P.gen(function* () {
-		let r = yield* P.fork(Oo(e.root).pipe(P.flatMap((e) => Y({
+		let r = yield* P.fork(Y(e.root).pipe(P.flatMap((e) => Ao({
 			exitCode: e,
 			interactive: process.stdout.isTTY === !0,
 			keepAlive: process.env.VOLTRO_DEV_KEEP_ALIVE
@@ -603,14 +607,14 @@ var Ia = (e) => {
 		}), yield* vt.set(t, _t.none());
 	});
 	yield* r;
-	let a = To(e.root).pipe(bt.debounce(mt.millis(80)), bt.runForEach((e) => P.gen(function* () {
+	let a = J(e.root).pipe(bt.debounce(mt.millis(80)), bt.runForEach((e) => P.gen(function* () {
 		let t = Date.now();
 		q.info("file changed — restarting", { file: e.file }), yield* i, yield* r, q.info("restart complete", { ms: Date.now() - t });
 	})), P.andThen(P.never), P.as(0)), o = yield* P.raceFirst(a, pt.await(n));
 	o === 0 ? q.info("dev server exited — supervisor stopping") : q.error("dev server exited — supervisor stopping", { exitCode: o }), yield* P.sync(() => {
 		process.exitCode = o;
 	});
-}), Ao = /* @__PURE__ */ new Set(/* @__PURE__ */ "crypto.fs.path.os.net.http.https.http2.tls.dns.dgram.stream.zlib.child_process.worker_threads.cluster.readline.vm.module.perf_hooks.async_hooks.inspector.v8.process.tty.repl.constants.sys.string_decoder".split(".")), jo = (e) => e.startsWith("node:") || Ao.has(e) || e === "@voltro/workflow" ? !0 : e === "@voltro/database/wire" ? !1 : e === "@voltro/database" || e.startsWith("@voltro/database/") || e === "@voltro/runtime" || e.startsWith("@voltro/runtime/") ? !0 : e === "@voltro/ai/agent" || e === "@voltro/ai/events" ? !1 : !!(e === "@voltro/ai" || e.startsWith("@voltro/ai/") || [
+}), Mo = /* @__PURE__ */ new Set(/* @__PURE__ */ "crypto.fs.path.os.net.http.https.http2.tls.dns.dgram.stream.zlib.child_process.worker_threads.cluster.readline.vm.module.perf_hooks.async_hooks.inspector.v8.process.tty.repl.constants.sys.string_decoder".split(".")), No = (e) => e.startsWith("node:") || Mo.has(e) || e === "@voltro/workflow" ? !0 : e === "@voltro/database/wire" ? !1 : e === "@voltro/database" || e.startsWith("@voltro/database/") || e === "@voltro/runtime" || e.startsWith("@voltro/runtime/") ? !0 : e === "@voltro/ai/agent" || e === "@voltro/ai/events" ? !1 : !!(e === "@voltro/ai" || e.startsWith("@voltro/ai/") || [
 	"@voltro/protocol/session",
 	"@voltro/protocol/jwt",
 	"@voltro/protocol/apikey"
@@ -629,8 +633,8 @@ var Ia = (e) => {
 	"@prisma/client",
 	"nodemailer",
 	"jose"
-].includes(e)), Mo = (e) => e.replace(/\/\*[\s\S]*?\*\//g, " ").replace(/(^|[^:])\/\/[^\n]*/g, "$1"), No = (e) => {
-	let t = Mo(e), n = [], r = /(?:^|[\n;}])\s*(?:import|export)\s+([^;'"]*?)\s+from\s+['"]([^'"]+)['"]/g, i;
+].includes(e)), Po = (e) => e.replace(/\/\*[\s\S]*?\*\//g, " ").replace(/(^|[^:])\/\/[^\n]*/g, "$1"), Fo = (e) => {
+	let t = Po(e), n = [], r = /(?:^|[\n;}])\s*(?:import|export)\s+([^;'"]*?)\s+from\s+['"]([^'"]+)['"]/g, i;
 	for (; (i = r.exec(t)) !== null;) {
 		let e = i[1].trim();
 		if (e === "type" || e.startsWith("type ")) continue;
@@ -646,8 +650,8 @@ var Ia = (e) => {
 	let o = /\bimport\(\s*['"]([^'"]+)['"]\s*\)/g;
 	for (; (i = o.exec(t)) !== null;) n.push(i[1]);
 	return n;
-}, Po = (e) => e.endsWith(".ts") || e.endsWith(".tsx"), Fo = async (e) => {
-	let t = Po(e) ? [e] : [
+}, Io = (e) => e.endsWith(".ts") || e.endsWith(".tsx"), Lo = async (e) => {
+	let t = Io(e) ? [e] : [
 		`${e}.ts`,
 		`${e}.tsx`,
 		A(e, "index.ts"),
@@ -657,7 +661,7 @@ var Ia = (e) => {
 		if ((await R.stat(e)).isFile()) return e;
 	} catch {}
 	return null;
-}, Io = async (e, t) => {
+}, Ro = async (e, t) => {
 	let n = t;
 	for (;;) {
 		let t = A(n, "node_modules", e);
@@ -668,7 +672,7 @@ var Ia = (e) => {
 		if (r === n) return null;
 		n = r;
 	}
-}, Lo = (e) => {
+}, zo = (e) => {
 	if (typeof e == "string") return e;
 	if (typeof e == "object" && e) {
 		let t = e;
@@ -678,23 +682,23 @@ var Ia = (e) => {
 			"node",
 			"default"
 		]) if (e in t) {
-			let n = Lo(t[e]);
+			let n = zo(t[e]);
 			if (n !== void 0) return n;
 		}
 	}
-}, Ro = async (e, t) => {
-	if (e.startsWith(".")) return Fo(M(k(t), e));
-	let n = e.split("/"), r = e.startsWith("@"), i = r ? `${n[0]}/${n[1]}` : n[0], a = r ? n.slice(2) : n.slice(1), o = a.length > 0 ? `./${a.join("/")}` : ".", s = await Io(i, k(t));
+}, Bo = async (e, t) => {
+	if (e.startsWith(".")) return Lo(M(k(t), e));
+	let n = e.split("/"), r = e.startsWith("@"), i = r ? `${n[0]}/${n[1]}` : n[0], a = r ? n.slice(2) : n.slice(1), o = a.length > 0 ? `./${a.join("/")}` : ".", s = await Ro(i, k(t));
 	if (!s) return null;
 	try {
-		let e = JSON.parse(await R.readFile(A(s, "package.json"), "utf8")), t = Lo(e.exports?.[o]) ?? (o === "." ? e.module ?? e.main : void 0);
-		if (typeof t == "string") return Fo(M(s, t));
+		let e = JSON.parse(await R.readFile(A(s, "package.json"), "utf8")), t = zo(e.exports?.[o]) ?? (o === "." ? e.module ?? e.main : void 0);
+		if (typeof t == "string") return Lo(M(s, t));
 	} catch {}
 	return null;
-}, X = (e, t) => e.startsWith(t) ? e.slice(t.length).replace(/^[/\\]/, "") : e, zo = async (e, t) => {
+}, Vo = (e, t) => e.startsWith(t) ? e.slice(t.length).replace(/^[/\\]/, "") : e, Ho = async (e, t) => {
 	let n = /* @__PURE__ */ new Set(), r = [{
 		file: e,
-		chain: [X(e, t)]
+		chain: [Vo(e, t)]
 	}];
 	for (; r.length > 0;) {
 		let { file: e, chain: i } = r.shift();
@@ -706,37 +710,37 @@ var Ia = (e) => {
 		} catch {
 			continue;
 		}
-		for (let o of No(a)) {
-			if (jo(o)) return {
+		for (let o of Fo(a)) {
+			if (No(o)) return {
 				specifier: o,
 				chain: [...i, o]
 			};
-			let a = await Ro(o, e);
+			let a = await Bo(o, e);
 			a && !n.has(a) && r.push({
 				file: a,
-				chain: [...i, `${o}  (${X(a, t)})`]
+				chain: [...i, `${o}  (${Vo(a, t)})`]
 			});
 		}
 	}
 	return null;
-}, Bo = /\.client\.tsx?$/, Vo = async (e, t) => {
+}, Uo = /\.client\.tsx?$/, Wo = async (e, t) => {
 	let n = [];
 	for (let r of t) {
-		if (!Bo.test(r)) continue;
-		let t = await zo(r, e);
+		if (!Uo.test(r)) continue;
+		let t = await Ho(r, e);
 		t !== null && n.push({
-			file: X(r, e),
+			file: Vo(r, e),
 			violation: t
 		});
 	}
 	return n;
-}, Ho = (e) => `browser-safety violation — ${e.file} declares itself browser-safe (.client.ts) and is not.\n\n  '${e.violation.specifier}' is server-only (node:* / database / ai / cluster / protocol session / db driver).\n\n  import chain:\n      → ${e.violation.chain.join("\n      → ")}\n\n  The .client suffix is a claim the framework checks, not a hint. Either move the server-only\n  code behind a *.server.ts and keep this file pure, or drop the suffix — an unmarked file\n  makes no claim, and only the rpcGroup guard will judge it (later, and with a longer chain).`, Uo = async (e) => {
+}, Go = (e) => `browser-safety violation — ${e.file} declares itself browser-safe (.client.ts) and is not.\n\n  '${e.violation.specifier}' is server-only (node:* / database / ai / cluster / protocol session / db driver).\n\n  import chain:\n      → ${e.violation.chain.join("\n      → ")}\n\n  The .client suffix is a claim the framework checks, not a hint. Either move the server-only\n  code behind a *.server.ts and keep this file pure, or drop the suffix — an unmarked file\n  makes no claim, and only the rpcGroup guard will judge it (later, and with a longer chain).`, Ko = async (e) => {
 	if (process.env.VOLTRO_BROWSER_SAFETY === "off") return;
-	let t = await zo(e, k(e));
+	let t = await Ho(e, k(e));
 	if (!t) return;
 	let n = t.chain.join("\n      → ");
 	throw Error(`browser-safety violation — the generated rpcGroup pulls a SERVER-ONLY module into the client bundle.\n\n  '${t.specifier}' is server-only (node:* / database / ai / cluster / protocol session / db driver),\n  and the web client loads rpcGroup VALUE-LEVEL — this crashes the browser with\n  "Module …node:crypto… has been externalized for browser compatibility", or bloats the\n  bundle with the whole server graph.\n\n  import chain:\n      → ${n}\n\n  Fix: keep the descriptor (*.query/.mutation/.action.ts), the workflow descriptor\n  (*.workflow.tsx, import from @voltro/workflow/define), AND any plugin error schema\n  browser-safe. Move DB-backed / node: code behind a *.server.ts file or a browser-safe\n  subpath (e.g. a plugin's '/errors' export). Escape hatch (not recommended):\n  VOLTRO_BROWSER_SAFETY=off.`);
-}, Wo = /\.(query|mutation|action|stream)\.ts$/, Go = /\.(query|mutation|action|stream)\.server\.ts$/, Ko = /\.workflow\.tsx$/, qo = /(?<!\.server)\.agent\.tsx?$/, Jo = /\.connection\.tsx?$/, Yo = /* @__PURE__ */ new Set([
+}, qo = /\.(query|mutation|action|stream)\.ts$/, Jo = /\.(query|mutation|action|stream)\.server\.ts$/, Yo = /\.workflow\.tsx$/, Xo = /(?<!\.server)\.agent\.tsx?$/, Zo = /\.connection\.tsx?$/, Qo = /* @__PURE__ */ new Set([
 	"node_modules",
 	"dist",
 	"build",
@@ -744,40 +748,40 @@ var Ia = (e) => {
 	".vite",
 	".next",
 	".git"
-]), Xo = async (e) => {
+]), $o = async (e) => {
 	let t = async (e) => {
 		let n = await R.readdir(e, { withFileTypes: !0 }).catch(() => []);
-		for (let r of n) if (!Yo.has(r.name)) {
+		for (let r of n) if (!Qo.has(r.name)) {
 			if (r.isDirectory()) {
 				if (await t(A(e, r.name))) return !0;
-			} else if (r.isFile() && Jo.test(r.name)) return !0;
+			} else if (r.isFile() && Zo.test(r.name)) return !0;
 		}
 		return !1;
 	};
 	return t(e);
-}, Zo = async (e) => {
+}, es = async (e) => {
 	let t = [], n = async (e) => {
 		let r = await R.readdir(e, { withFileTypes: !0 });
 		for (let i of r) {
-			if (Yo.has(i.name)) continue;
+			if (Qo.has(i.name)) continue;
 			let r = A(e, i.name);
-			i.isDirectory() ? await n(r) : i.isFile() && (Wo.test(i.name) && !Go.test(i.name) || Ko.test(i.name) || qo.test(i.name)) && t.push(r);
+			i.isDirectory() ? await n(r) : i.isFile() && (qo.test(i.name) && !Jo.test(i.name) || Yo.test(i.name) || Xo.test(i.name)) && t.push(r);
 		}
 	};
 	return await n(e), t;
-}, Qo = (e) => typeof e == "object" && !!e && "kind" in e && "name" in e && (e.kind === "query" || e.kind === "mutation" || e.kind === "action" || e.kind === "stream"), $o = Symbol.for("@effect/workflow/Workflow"), es = (e) => typeof e == "object" && !!e && $o in e && "name" in e && typeof e.name == "string", ts = async (e) => {
+}, ts = (e) => typeof e == "object" && !!e && "kind" in e && "name" in e && (e.kind === "query" || e.kind === "mutation" || e.kind === "action" || e.kind === "stream"), ns = Symbol.for("@effect/workflow/Workflow"), rs = (e) => typeof e == "object" && !!e && ns in e && "name" in e && typeof e.name == "string", is = async (e) => {
 	let t = [];
 	for (let n of e) {
 		let e = await import(lt(n).href);
-		for (let [r, i] of Object.entries(e)) if (Qo(i)) {
-			if (!Pi(i)) continue;
+		for (let [r, i] of Object.entries(e)) if (ts(i)) {
+			if (!Ii(i)) continue;
 			t.push({
 				file: n,
 				exportName: r,
 				rpcTag: i.name,
 				kind: i.kind
 			});
-		} else es(i) && t.push({
+		} else rs(i) && t.push({
 			file: n,
 			exportName: r,
 			rpcTag: i.name,
@@ -785,23 +789,23 @@ var Ia = (e) => {
 		});
 	}
 	return t;
-}, ns = async (e) => {
+}, as = async (e) => {
 	let t = [];
 	for (let n of e) {
-		if (!qo.test(n)) continue;
+		if (!Xo.test(n)) continue;
 		let e = await import(lt(n).href);
-		for (let [r, i] of Object.entries(e)) Ca(i) && t.push({
+		for (let [r, i] of Object.entries(e)) Ta(i) && t.push({
 			file: n,
 			exportName: r,
 			name: i.name
 		});
 	}
 	return t;
-}, Z = (e) => {
+}, X = (e) => {
 	let t = (e, t) => e.split(/[^a-zA-Z0-9]+/).filter(Boolean).map((e, n) => (n === 0 && !t ? e.charAt(0).toLowerCase() : e.charAt(0).toUpperCase()) + e.slice(1)).join(""), n = e.split(".");
 	return `${t(n[0] ?? "rpc", !1)}${n.slice(1).map((e) => t(e, !0)).join("")}Rpc`;
-}, rs = /^[A-Za-z][A-Za-z0-9]*([._-][A-Za-z0-9]+)*$/, is = (e, t) => {
-	let n = (e) => j(t, e.file).replace(/\\/g, "/"), r = e.filter((e) => !rs.test(e.rpcTag));
+}, os = /^[A-Za-z][A-Za-z0-9]*([._-][A-Za-z0-9]+)*$/, ss = (e, t) => {
+	let n = (e) => j(t, e.file).replace(/\\/g, "/"), r = e.filter((e) => !os.test(e.rpcTag));
 	if (r.length > 0) throw Error(`invalid rpc tag — a procedure/workflow \`name\` must start with a letter and
 use only letters, digits, and \`.\` \`-\` \`_\` separators (the tag becomes a JS
 identifier in the generated rpcGroup):
@@ -809,7 +813,7 @@ identifier in the generated rpcGroup):
 ${r.map((e) => `  • "${e.rpcTag}"  (${n(e)})`).join("\n")}\n`);
 	let i = /* @__PURE__ */ new Map();
 	for (let t of e) {
-		let e = Z(t.rpcTag), n = i.get(e);
+		let e = X(t.rpcTag), n = i.get(e);
 		n ? n.push(t) : i.set(e, [t]);
 	}
 	let a = [...i.values()].filter((e) => new Set(e.map((e) => e.rpcTag)).size > 1);
@@ -817,8 +821,8 @@ ${r.map((e) => `  • "${e.rpcTag}"  (${n(e)})`).join("\n")}\n`);
 generated identifier (separators are normalized away). Rename one so they
 differ by more than a \`.\`/\`-\`/\`_\`:
 
-${a.map((e) => `  ${Z(e[0].rpcTag)}:\n` + e.map((e) => `    - "${e.rpcTag}"  (${n(e)})`).join("\n")).join("\n\n")}\n`);
-}, as = (e) => {
+${a.map((e) => `  ${X(e[0].rpcTag)}:\n` + e.map((e) => `    - "${e.rpcTag}"  (${n(e)})`).join("\n")).join("\n\n")}\n`);
+}, cs = (e) => {
 	switch (e) {
 		case "query": return 0;
 		case "mutation": return 1;
@@ -826,7 +830,7 @@ ${a.map((e) => `  ${Z(e[0].rpcTag)}:\n` + e.map((e) => `    - "${e.rpcTag}"  (${
 		case "stream": return 3;
 		case "workflow": return 4;
 	}
-}, os = (e, t) => {
+}, ls = (e, t) => {
 	let n = /* @__PURE__ */ new Map();
 	for (let t of e) n.has(t.rpcTag) || n.set(t.rpcTag, t);
 	let r = [...n.keys()], i = (e) => j(t, n.get(e).file).replace(/\\/g, "/"), a = [];
@@ -841,7 +845,7 @@ can't be both a leaf and a namespace. Rename one side (e.g. give the
 workflow/procedure a nested name like "<prefix>.run"):
 
 ${a.join("\n\n")}\n`);
-}, ss = (e, t, n, r = [], i = [], a = !1, o = !1, s = []) => {
+}, us = (e, t, n, r = [], i = [], a = !1, o = !1, s = []) => {
 	let c = i.length > 0, l = i.flatMap((e) => [{
 		file: e.file,
 		exportName: e.exportName,
@@ -858,20 +862,20 @@ ${a.join("\n\n")}\n`);
 		rpcTag: e.tag,
 		kind: e.kind
 	}));
-	os([
+	ls([
 		...n,
 		...l,
 		...d
-	], e), is([
+	], e), ss([
 		...n,
 		...l,
 		...d
 	], e);
-	let f = (e) => e.replace(/[^a-zA-Z0-9_$]/g, "_"), p = (e) => `__src_agent_${f(e.name)}`, m = (e) => `__agentRoutes_${f(e.name)}`, h = r.length > 0, ee = r.map((e, t) => `import { ${e.name} as __pe${t} } from '${e.module}'`), g = h ? ", __voltroPluginErrors" : "", te = u.length > 0, _ = u.map((e, t) => `import { ${e.name} as __prpc${t} } from '${e.module}'`), v = (e) => e === "query" ? "queryToRpc" : e === "mutation" ? "mutationToRpc" : "actionToRpc", ne = u.map((e, t) => `export const ${Z(e.tag)} = ${v(e.kind)}(__prpc${t}${g})`), re = u.map((e) => `  ${Z(e.tag)},`), ie = u.map((e, t) => `  ${JSON.stringify(e.tag)}: normalizeDescriptor(__prpc${t}),`), y = [...n].sort((e, t) => e.kind === t.kind ? e.rpcTag < t.rpcTag ? -1 : 1 : as(e.kind) - as(t.kind)), ae = k(t), b = (e) => `__src_${Z(e.rpcTag)}`, x = (e) => {
+	let f = (e) => e.replace(/[^a-zA-Z0-9_$]/g, "_"), p = (e) => `__src_agent_${f(e.name)}`, m = (e) => `__agentRoutes_${f(e.name)}`, h = r.length > 0, ee = r.map((e, t) => `import { ${e.name} as __pe${t} } from '${e.module}'`), g = h ? ", __voltroPluginErrors" : "", te = u.length > 0, _ = u.map((e, t) => `import { ${e.name} as __prpc${t} } from '${e.module}'`), v = (e) => e === "query" ? "queryToRpc" : e === "mutation" ? "mutationToRpc" : "actionToRpc", ne = u.map((e, t) => `export const ${X(e.tag)} = ${v(e.kind)}(__prpc${t}${g})`), re = u.map((e) => `  ${X(e.tag)},`), ie = u.map((e, t) => `  ${JSON.stringify(e.tag)}: normalizeDescriptor(__prpc${t}),`), y = [...n].sort((e, t) => e.kind === t.kind ? e.rpcTag < t.rpcTag ? -1 : 1 : cs(e.kind) - cs(t.kind)), ae = k(t), b = (e) => `__src_${X(e.rpcTag)}`, x = (e) => {
 		let t = `./${j(ae, e.file).replace(/\\/g, "/").replace(/\.tsx?$/, "")}`;
 		return `import { ${e.exportName} as ${b(e)} } from '${t}'`;
 	}, oe = (e) => {
-		let t = Z(e.rpcTag), n = b(e);
+		let t = X(e.rpcTag), n = b(e);
 		return e.kind === "query" ? `export const ${t} = queryToRpc(${n}${g})` : e.kind === "mutation" ? `export const ${t} = mutationToRpc(${n}${g})` : e.kind === "action" ? `export const ${t} = actionToRpc(${n}${g})` : e.kind === "stream" ? `export const ${t} = streamToRpc(${n}${g})` : [
 			`export const ${t} = Rpc.make('${e.rpcTag}', {`,
 			`  payload: ${n}.payloadSchema,`,
@@ -900,8 +904,8 @@ ${a.join("\n\n")}\n`);
 		"__voltroConnectionSubmitToken",
 		"__voltroConnectionDisconnect"
 	] : [], de = [
-		...y.map((e) => `  ${Z(e.rpcTag)},`),
-		...i.flatMap((e) => [`  ${Z(`${e.name}.send`)},`, `  ${Z(`${e.name}.messages`)},`]),
+		...y.map((e) => `  ${X(e.rpcTag)},`),
+		...i.flatMap((e) => [`  ${X(`${e.name}.send`)},`, `  ${X(`${e.name}.messages`)},`]),
 		...le.map((e) => `  ${e},`),
 		...C.map((e) => `  ${e},`),
 		...ue.map((e) => `  ${e},`),
@@ -948,7 +952,7 @@ ${a.join("\n\n")}\n`);
 	return [
 		"// THIS FILE IS GENERATED — DO NOT EDIT BY HAND.",
 		"// Re-emitted by `voltro dev` whenever query/mutation/action/stream/workflow files change.",
-		`// descriptor-fingerprint: ${ra("sha1").update(xe.map((e) => {
+		`// descriptor-fingerprint: ${aa("sha1").update(xe.map((e) => {
 			let t = "";
 			try {
 				t = Tt(e.file, "utf8");
@@ -1012,7 +1016,7 @@ ${a.join("\n\n")}\n`);
 			""
 		] : [],
 		...y.map(oe),
-		...i.flatMap((e) => [`export const ${Z(`${e.name}.send`)} = actionToRpc(${m(e)}.send${g})`, `export const ${Z(`${e.name}.messages`)} = queryToRpc(${m(e)}.messages${g})`]),
+		...i.flatMap((e) => [`export const ${X(`${e.name}.send`)} = actionToRpc(${m(e)}.send${g})`, `export const ${X(`${e.name}.messages`)} = queryToRpc(${m(e)}.messages${g})`]),
 		...S ? [
 			"export const __voltroWorkflowRun = queryToRpc(workflowRunQueryDescriptor)",
 			"export const __voltroWorkflowRuns = queryToRpc(workflowRunsQueryDescriptor)",
@@ -1087,8 +1091,8 @@ ${a.join("\n\n")}\n`);
 			""
 		] : []
 	].join("\n");
-}, cs = async (e) => {
-	let t = M(e.root), n = await Zo(t), r = await ts(n), i = await ns(n), a = await Xo(t);
+}, ds = async (e) => {
+	let t = M(e.root), n = await es(t), r = await is(n), i = await as(n), a = await $o(t);
 	if (r.length === 0 && i.length === 0 && !a && (e.pluginRpcImports?.length ?? 0) === 0) return;
 	let o = ((e) => {
 		if (e.length === 0) return t;
@@ -1107,7 +1111,7 @@ ${a.join("\n\n")}\n`);
 		"workflows"
 	]), c = (e) => e.slice(e.lastIndexOf("/") + 1), l = o;
 	for (; l !== t && s.has(c(l));) l = l.slice(0, l.lastIndexOf("/")) || "/";
-	let u = M(e.outputFile ?? A(l, "rpcGroup.generated.ts")), d = [...new Map((e.pluginErrorImports ?? []).map((e) => [`${e.module}#${e.name}`, e])).values()], f = [...new Map((e.pluginRpcImports ?? []).map((e) => [e.tag, e])).values()], p = ss(t, u, r, d, i, kr(), a, f), m = [];
+	let u = M(e.outputFile ?? A(l, "rpcGroup.generated.ts")), d = [...new Map((e.pluginErrorImports ?? []).map((e) => [`${e.module}#${e.name}`, e])).values()], f = [...new Map((e.pluginRpcImports ?? []).map((e) => [e.tag, e])).values()], p = us(t, u, r, d, i, jr(), a, f), m = [];
 	for (let t of e.pluginContributions ?? []) {
 		let e = null;
 		try {
@@ -1126,8 +1130,8 @@ ${a.join("\n\n")}\n`);
 	try {
 		ee = await R.readFile(u, "utf8");
 	} catch {}
-	return ee !== h && await R.writeFile(u, h, "utf8"), await Uo(u), u;
-}, ls = (e) => {
+	return ee !== h && await R.writeFile(u, h, "utf8"), await Ko(u), u;
+}, fs = (e) => {
 	let t = [];
 	for (let n of e) for (let e of n) {
 		let n = e.descriptor?.tag;
@@ -1139,13 +1143,13 @@ ${a.join("\n\n")}\n`);
 		} : { tag: n });
 	}
 	return t;
-}, us = (e, t) => {
-	let n = Ni(e);
-	return n.length === 0 ? 0 : (t(wi(n)), n.length);
-}, ds = async (e) => {
-	let t = e.spec ?? rr, n;
+}, ps = (e, t) => {
+	let n = Fi(e);
+	return n.length === 0 ? 0 : (t(Ei(n)), n.length);
+}, ms = async (e) => {
+	let t = e.spec ?? ir, n;
 	return t.kind !== "noop" && e.sqlLayer !== void 0 ? n = await P.runPromise(P.gen(function* () {
-		let n = yield* Ir.SqlClient, r = t.build(n);
+		let n = yield* Rr.SqlClient, r = t.build(n);
 		return t.initialize && (yield* t.initialize(r).pipe(P.catchAll((t) => P.sync(() => e.log.warn("analytics sink initialize failed", {
 			provider: r.info.provider,
 			err: String(t)
@@ -1163,14 +1167,14 @@ ${a.join("\n\n")}\n`);
 			t.dispose && await P.runPromise(t.dispose(n).pipe(P.timeout("1200 millis"), P.ignore));
 		}
 	};
-}, fs = "@effect/cluster@0.60.0", ps = "@effect__cluster@0.60.0.patch", ms = `patches/${ps}`, hs = k(N(import.meta.url)), gs = [M(hs, "..", "templates", "patches", ps), M(hs, "..", "..", "templates", "patches", ps)], _s = async () => {
-	for (let e of gs) if (L(e)) return R.readFile(e, "utf8");
-	throw Error(`@effect/cluster patch asset not found (looked in: ${gs.join(", ")}). This is a packaging bug — the CLI should ship it under templates/patches/.`);
-}, vs = (e) => RegExp(`['"]?${fs.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}['"]?\\s*:`).test(e), ys = (e) => {
-	if (vs(e)) return null;
-	let t = `  '${fs}': ${ms}`, n = /^patchedDependencies:[ \t]*\n/m;
+}, hs = "@effect/cluster@0.60.0", Z = "@effect__cluster@0.60.0.patch", gs = `patches/${Z}`, _s = k(N(import.meta.url)), vs = [M(_s, "..", "templates", "patches", Z), M(_s, "..", "..", "templates", "patches", Z)], ys = async () => {
+	for (let e of vs) if (L(e)) return R.readFile(e, "utf8");
+	throw Error(`@effect/cluster patch asset not found (looked in: ${vs.join(", ")}). This is a packaging bug — the CLI should ship it under templates/patches/.`);
+}, bs = (e) => RegExp(`['"]?${hs.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}['"]?\\s*:`).test(e), xs = (e) => {
+	if (bs(e)) return null;
+	let t = `  '${hs}': ${gs}`, n = /^patchedDependencies:[ \t]*\n/m;
 	return n.test(e) ? e.replace(n, (e) => `${e}${t}\n`) : `${e}${e.endsWith("\n") ? "" : "\n"}\npatchedDependencies:\n${t}\n`;
-}, bs = (e) => {
+}, Ss = (e) => {
 	let t = M(e);
 	for (let e = 0; e < 12; e++) {
 		if (L(A(t, "pnpm-workspace.yaml"))) return t;
@@ -1179,28 +1183,28 @@ ${a.join("\n\n")}\n`);
 		t = e;
 	}
 	return null;
-}, xs = async (e) => {
-	let t = bs(e);
+}, Cs = async (e) => {
+	let t = Ss(e);
 	if (!t) return null;
-	let n = await Ss(t);
-	return n.fullyWired ? null : `mssql + durable cluster workflows need the @effect/cluster patch, which a plain install cannot carry. Run \`voltro add mssql\` then \`pnpm install\` to wire it (missing: ${[n.patchFilePresent ? null : ms, n.pnpmEntryPresent ? null : "patchedDependencies in pnpm-workspace.yaml"].filter(Boolean).join(" + ")}). Without it, workflow message/runner storage misbehaves on SQL Server.`;
-}, Ss = async (e) => {
-	let t = L(A(e, ms)), n = A(e, "pnpm-workspace.yaml"), r = L(n) && vs(await R.readFile(n, "utf8"));
+	let n = await ws(t);
+	return n.fullyWired ? null : `mssql + durable cluster workflows need the @effect/cluster patch, which a plain install cannot carry. Run \`voltro add mssql\` then \`pnpm install\` to wire it (missing: ${[n.patchFilePresent ? null : gs, n.pnpmEntryPresent ? null : "patchedDependencies in pnpm-workspace.yaml"].filter(Boolean).join(" + ")}). Without it, workflow message/runner storage misbehaves on SQL Server.`;
+}, ws = async (e) => {
+	let t = L(A(e, gs)), n = A(e, "pnpm-workspace.yaml"), r = L(n) && bs(await R.readFile(n, "utf8"));
 	return {
 		patchFilePresent: t,
 		pnpmEntryPresent: r,
 		fullyWired: t && r
 	};
-}, Cs = async (e) => {
-	let t = [], n = A(e, ms), r = await _s();
-	(L(n) ? await R.readFile(n, "utf8") : null) !== r && (await R.mkdir(k(n), { recursive: !0 }), await R.writeFile(n, r, "utf8"), t.push(`patch file → ${ms}`));
+}, Ts = async (e) => {
+	let t = [], n = A(e, gs), r = await ys();
+	(L(n) ? await R.readFile(n, "utf8") : null) !== r && (await R.mkdir(k(n), { recursive: !0 }), await R.writeFile(n, r, "utf8"), t.push(`patch file → ${gs}`));
 	let i = A(e, "pnpm-workspace.yaml");
 	if (L(i)) {
-		let e = ys(await R.readFile(i, "utf8"));
-		e !== null && (await R.writeFile(i, e, "utf8"), t.push(`patchedDependencies['${fs}'] → pnpm-workspace.yaml`));
+		let e = xs(await R.readFile(i, "utf8"));
+		e !== null && (await R.writeFile(i, e, "utf8"), t.push(`patchedDependencies['${hs}'] → pnpm-workspace.yaml`));
 	}
 	return t;
-}, ws = (e) => e.replace(/\.subscribe\.tsx?$/, ""), Ts = async (e, t) => {
+}, Es = (e) => e.replace(/\.subscribe\.tsx?$/, ""), Ds = async (e, t) => {
 	let n = [];
 	for (let r of e) {
 		let e;
@@ -1226,14 +1230,14 @@ ${a.join("\n\n")}\n`);
 		}
 		n.push({
 			file: r,
-			id: ws(O(r)),
+			id: Es(O(r)),
 			definition: a
 		});
 	}
 	return n;
-}, Es = (e, t, n, r) => {
+}, Os = (e, t, n, r) => {
 	if (e.length === 0) return () => {};
-	let i = Mr(t, {
+	let i = Pr(t, {
 		subject: zt,
 		schemaRegistry: r
 	}), a = [];
@@ -1246,12 +1250,12 @@ ${a.join("\n\n")}\n`);
 				store: i
 			};
 			try {
-				let i = s(t, n);
-				i instanceof Promise && i.catch((n) => {
+				let i = wr(s(t, n));
+				i !== void 0 && i.catch((n) => {
 					e.warn("subscriber: handler rejected", {
 						table: o,
 						op: t.op
-					}, n), Ii({
+					}, n), Ri({
 						error: n,
 						source: "subscriber",
 						name: o,
@@ -1265,7 +1269,7 @@ ${a.join("\n\n")}\n`);
 				e.warn("subscriber: handler threw synchronously", {
 					table: o,
 					op: t.op
-				}, n), Ii({
+				}, n), Ri({
 					error: n,
 					source: "subscriber",
 					name: o,
@@ -1286,7 +1290,7 @@ ${a.join("\n\n")}\n`);
 			e();
 		} catch {}
 	};
-}, Ds = (e) => e.replace(/\.outbox\.tsx?$/, ""), Os = async (e, t) => {
+}, ks = (e) => e.replace(/\.outbox\.tsx?$/, ""), As = async (e, t) => {
 	let n = [], r = /* @__PURE__ */ new Map();
 	for (let i of e) {
 		let e;
@@ -1321,12 +1325,12 @@ ${a.join("\n\n")}\n`);
 		}
 		r.set(o.effect, i), n.push({
 			file: i,
-			id: Ds(O(i)),
+			id: ks(O(i)),
 			definition: o
 		});
 	}
 	return n;
-}, ks = (e) => {
+}, js = (e) => {
 	let { handlers: t, store: n, log: r } = e, i = new Map(t.map((e) => [e.definition.effect, e.definition])), a = !1, o = !1, s = !1, c = async () => {
 		if (a) {
 			o = !0;
@@ -1360,26 +1364,26 @@ ${a.join("\n\n")}\n`);
 		},
 		drainOnce: c
 	};
-}, As = "<builtin:connections>", js = {
+}, Ms = "<builtin:connections>", Ns = {
 	registry: jn([]),
 	queries: [],
 	mutations: [],
 	actions: [],
 	httpRoutes: [],
 	active: !1
-}, Ms = (e) => {
+}, Ps = (e) => {
 	let { definitions: t, store: n, publicUrl: r, log: i } = e;
-	if (t.length === 0) return js;
+	if (t.length === 0) return Ns;
 	Gt(t);
 	let a = jn(t), o = {
 		registry: a,
 		publicUrl: r
 	};
-	yr(Mn({
+	br(Mn({
 		store: n,
 		registry: a
 	}));
-	let s = Bn(o), c = Yn(o), l = Xn(o), u = In(o), d = t.some((e) => e.kind === "oauth2"), f = d ? [{
+	let s = Bn(o), c = Xn(o), l = Zn(o), u = In(o), d = t.some((e) => e.kind === "oauth2"), f = d ? [{
 		method: "GET",
 		path: "/_voltro/connections",
 		handle: async (e) => {
@@ -1393,7 +1397,7 @@ ${a.join("\n\n")}\n`);
 			if (l !== null) return i.info("connection consent declined", {
 				connectionId: t[1],
 				error: l
-			}), Q(`/?connection=${encodeURIComponent(t[1] ?? "")}&error=${encodeURIComponent(l)}`);
+			}), Fs(`/?connection=${encodeURIComponent(t[1] ?? "")}&error=${encodeURIComponent(l)}`);
 			if (s === "" || c === "") return {
 				status: 400,
 				body: "missing code or state",
@@ -1407,13 +1411,13 @@ ${a.join("\n\n")}\n`);
 					code: c,
 					publicUrl: r
 				});
-				return i.info("connection established", { connectionId: e.connectionId }), Q(e.redirectTo);
+				return i.info("connection established", { connectionId: e.connectionId }), Fs(e.redirectTo);
 			} catch (e) {
 				let n = e instanceof Error ? e.message : String(e);
 				return i.warn("connection callback failed", {
 					connectionId: t[1],
 					reason: n
-				}), Q(`/?connection=${encodeURIComponent(t[1] ?? "")}&error=handshake_failed`);
+				}), Fs(`/?connection=${encodeURIComponent(t[1] ?? "")}&error=handshake_failed`);
 			}
 		}
 	}] : [];
@@ -1421,53 +1425,53 @@ ${a.join("\n\n")}\n`);
 		connections: t.map((e) => `${e.id} (${e.kind})`),
 		callback: d ? "/_voltro/connections/<id>/callback" : "(no oauth2 connection declared)",
 		routes: [
+			Pi.name,
 			Mi.name,
-			Ai.name,
-			ji.name,
-			ki.name
+			Ni.name,
+			ji.name
 		]
 	}), {
 		registry: a,
 		queries: [{
-			file: As,
-			descriptor: Mi,
+			file: Ms,
+			descriptor: Pi,
 			executor: (e, t) => s(e, t)
 		}],
 		mutations: [{
-			file: As,
-			descriptor: ji,
+			file: Ms,
+			descriptor: Ni,
 			executor: (e, t) => l(e, t)
 		}, {
-			file: As,
-			descriptor: ki,
+			file: Ms,
+			descriptor: ji,
 			executor: (e, t) => u(e, t)
 		}],
 		actions: [{
-			file: As,
-			descriptor: Ai,
+			file: Ms,
+			descriptor: Mi,
 			executor: (e, t) => c(e, t)
 		}],
 		httpRoutes: f,
 		active: !0
 	};
-}, Q = (e) => ({
+}, Fs = (e) => ({
 	status: 302,
-	headers: { location: _r(e.startsWith("/") ? e : `/${e}`) },
+	headers: { location: vr(e.startsWith("/") ? e : `/${e}`) },
 	body: ""
-}), Ns = (e) => process.env.VOLTRO_PUBLIC_URL?.replace(/\/+$/, "") ?? `http://localhost:${e}`, Ps = /* @__PURE__ */ new Set([
+}), Is = (e) => process.env.VOLTRO_PUBLIC_URL?.replace(/\/+$/, "") ?? `http://localhost:${e}`, Q = /* @__PURE__ */ new Set([
 	"strict",
 	"warn",
 	"off"
-]), Fs = (e, t) => {
+]), Ls = (e, t) => {
 	let n = e.VOLTRO_SERVER_ONLY?.trim().toLowerCase();
-	return n !== void 0 && Ps.has(n) ? {
+	return n !== void 0 && Q.has(n) ? {
 		mode: n,
 		source: "env"
 	} : {
 		mode: t,
 		source: "default"
 	};
-}, Is = (e, t, n, r) => {
+}, Rs = (e, t, n, r) => {
 	let i = typeof t == "string" ? {
 		mode: t,
 		source: "default"
@@ -1480,7 +1484,7 @@ ${a.join("\n\n")}\n`);
 		action: o,
 		message: `[serverOnly] ${a}${o === "fail" ? `\nThis is a boot failure in ${r}. VOLTRO_SERVER_ONLY=warn downgrades it to a warning; VOLTRO_SERVER_ONLY=off silences it. Both are worse than fixing the output schema.` : i.source === "env" ? `\nThis is only a warning because VOLTRO_SERVER_ONLY=warn is set. Unset it and ${r} refuses to boot — which is the behaviour the marker is for.` : `\nThis is a WARNING in ${r} and a boot FAILURE in \`voltro serve\` and \`voltro doctor\`. Set VOLTRO_SERVER_ONLY=strict to fail here too.`}`
 	};
-}, Ls = (e, t) => ({
+}, zs = (e, t) => ({
 	table: e.table,
 	op: e.op,
 	new: e.new ?? null,
@@ -1489,7 +1493,7 @@ ${a.join("\n\n")}\n`);
 	...e.traceId === void 0 ? {} : { traceId: e.traceId },
 	...e.subjectId === void 0 ? {} : { subjectId: e.subjectId },
 	changeScope: t
-}), Rs = (e) => e.replace(/\.reaction\.tsx?$/, ""), zs = async (e, t) => {
+}), Bs = (e) => e.replace(/\.reaction\.tsx?$/, ""), Vs = async (e, t) => {
 	let n = [];
 	for (let r of e) {
 		let e;
@@ -1523,12 +1527,12 @@ ${a.join("\n\n")}\n`);
 		}
 		n.push({
 			file: r,
-			id: Rs(O(r)),
+			id: Bs(O(r)),
 			definition: a
 		});
 	}
 	return n;
-}, Bs = async (e, t, n) => {
+}, Hs = async (e, t, n) => {
 	let r = n.findAgentSend(e);
 	if (r === void 0) {
 		n.log.warn("reaction agent act — no synthesized agent found (declare a `*.agent.tsx` named this)", { agent: e });
@@ -1543,7 +1547,7 @@ ${a.join("\n\n")}\n`);
 		subject: n.makeSubject(a),
 		traceId: `reaction:${e}`
 	});
-}, Vs = (e, t, n, r) => {
+}, Us = (e, t, n, r) => {
 	if (e.length === 0) return () => {};
 	let i = /* @__PURE__ */ new Set(), a = {
 		has: (e) => i.has(e),
@@ -1571,7 +1575,7 @@ ${a.join("\n\n")}\n`);
 		...e
 	}), l = t.onChange((e) => {
 		let t = s.get(e.table);
-		if (t !== void 0) for (let { reaction: n, log: r } of t) gr(n, e, c()).then((t) => {
+		if (t !== void 0) for (let { reaction: n, log: r } of t) _r(n, e, c()).then((t) => {
 			t === "acted" && r.info("reaction: acted", {
 				table: e.table,
 				op: e.op
@@ -1580,7 +1584,7 @@ ${a.join("\n\n")}\n`);
 			r.warn("reaction: dispatch failed", {
 				table: e.table,
 				op: e.op
-			}, t), Ii({
+			}, t), Ri({
 				error: t,
 				source: "reaction",
 				name: n.name,
@@ -1593,7 +1597,7 @@ ${a.join("\n\n")}\n`);
 			l();
 		} catch {}
 	};
-}, Hs = "_voltro_aggregate_meta", Us = "_voltro_aggregate_rows", Ws = () => {
+}, Ws = "_voltro_aggregate_meta", Gs = "_voltro_aggregate_rows", Ks = () => {
 	let e = /* @__PURE__ */ new Map(), t = {
 		refreshedAt: null,
 		rowCount: 0,
@@ -1638,8 +1642,8 @@ ${a.join("\n\n")}\n`);
 		},
 		refreshMirror: async () => {}
 	};
-}, Gs = `
-  CREATE TABLE IF NOT EXISTS ${Hs} (
+}, qs = `
+  CREATE TABLE IF NOT EXISTS ${Ws} (
     name TEXT PRIMARY KEY,
     generation INTEGER NOT NULL DEFAULT 0,
     refreshed_at TEXT,
@@ -1648,24 +1652,24 @@ ${a.join("\n\n")}\n`);
     last_error TEXT,
     next_refresh_at TEXT
   );
-`.trim(), Ks = `
-  CREATE TABLE IF NOT EXISTS ${Us} (
+`.trim(), Js = `
+  CREATE TABLE IF NOT EXISTS ${Gs} (
     aggregate_name TEXT NOT NULL,
     generation INTEGER NOT NULL,
     row_index INTEGER NOT NULL,
     row_data TEXT NOT NULL,
     PRIMARY KEY (aggregate_name, generation, row_index)
   );
-`.trim(), qs = `
-  CREATE INDEX IF NOT EXISTS ${Us}_lookup
-    ON ${Us} (aggregate_name, generation, row_index);
-`.trim(), Js = (e) => ({
+`.trim(), Ys = `
+  CREATE INDEX IF NOT EXISTS ${Gs}_lookup
+    ON ${Gs} (aggregate_name, generation, row_index);
+`.trim(), Xs = (e) => ({
 	refreshedAt: e.refreshed_at === null ? null : new Date(e.refreshed_at),
 	rowCount: e.row_count,
 	durationMs: e.duration_ms,
 	lastError: e.last_error,
 	nextRefreshAt: e.next_refresh_at === null ? null : new Date(e.next_refresh_at)
-}), Ys = (e) => {
+}), Zs = (e) => {
 	let t = /* @__PURE__ */ new Map(), n = {
 		refreshedAt: null,
 		rowCount: 0,
@@ -1673,14 +1677,14 @@ ${a.join("\n\n")}\n`);
 		lastError: null,
 		nextRefreshAt: null
 	}, r = (t) => P.runPromise(t.pipe(P.provide(e))), i = () => P.gen(function* () {
-		let e = yield* Ir.SqlClient;
-		yield* e.unsafe(Gs).pipe(P.orDie), yield* e.unsafe(Ks).pipe(P.orDie), yield* e.unsafe(qs).pipe(P.orDie);
+		let e = yield* Rr.SqlClient;
+		yield* e.unsafe(qs).pipe(P.orDie), yield* e.unsafe(Js).pipe(P.orDie), yield* e.unsafe(Ys).pipe(P.orDie);
 	}), a = () => P.gen(function* () {
-		let e = yield* Ir.SqlClient, n = yield* e`SELECT * FROM ${e(Hs)}`.pipe(P.orElseSucceed(() => []));
+		let e = yield* Rr.SqlClient, n = yield* e`SELECT * FROM ${e(Ws)}`.pipe(P.orElseSucceed(() => []));
 		for (let r of n) {
 			let n = yield* e`
           SELECT ${e("row_index")} AS row_index, ${e("row_data")} AS row_data
-          FROM ${e(Us)}
+          FROM ${e(Gs)}
           WHERE ${e("aggregate_name")} = ${r.name}
             AND ${e("generation")} = ${r.generation}
           ORDER BY ${e("row_index")} ASC
@@ -1690,17 +1694,17 @@ ${a.join("\n\n")}\n`);
 			} catch {}
 			t.set(r.name, {
 				rows: i,
-				meta: Js(r)
+				meta: Xs(r)
 			});
 		}
 	}), o = (e, t) => P.gen(function* () {
-		let n = yield* Ir.SqlClient, r = (yield* n`
+		let n = yield* Rr.SqlClient, r = (yield* n`
         SELECT ${n("generation")} AS generation
-        FROM ${n(Hs)}
+        FROM ${n(Ws)}
         WHERE ${n("name")} = ${e}
       `.pipe(P.orElseSucceed(() => [])))[0]?.generation ?? 0, i = r + 1;
 		yield* n`
-        UPDATE ${n(Hs)} SET
+        UPDATE ${n(Ws)} SET
           ${n("generation")} = ${i},
           ${n("refreshed_at")} = ${t.meta.refreshedAt ? t.meta.refreshedAt.toISOString() : null},
           ${n("duration_ms")} = ${t.meta.durationMs},
@@ -1709,7 +1713,7 @@ ${a.join("\n\n")}\n`);
           ${n("next_refresh_at")} = ${t.meta.nextRefreshAt ? t.meta.nextRefreshAt.toISOString() : null}
         WHERE ${n("name")} = ${e}
       `.pipe(P.orDie), r === 0 && (yield* n`
-          INSERT INTO ${n(Hs)}
+          INSERT INTO ${n(Ws)}
             (${n("name")}, ${n("generation")}, ${n("refreshed_at")},
              ${n("duration_ms")}, ${n("row_count")}, ${n("last_error")}, ${n("next_refresh_at")})
           VALUES
@@ -1720,21 +1724,21 @@ ${a.join("\n\n")}\n`);
 		for (let r = 0; r < t.rows.length; r++) {
 			let a = JSON.stringify(t.rows[r]);
 			yield* n`
-          INSERT INTO ${n(Us)}
+          INSERT INTO ${n(Gs)}
             (${n("aggregate_name")}, ${n("generation")}, ${n("row_index")}, ${n("row_data")})
           VALUES
             (${e}, ${i}, ${r}, ${a})
         `.pipe(P.orDie);
 		}
 		r > 0 && (yield* n`
-          DELETE FROM ${n(Us)}
+          DELETE FROM ${n(Gs)}
           WHERE ${n("aggregate_name")} = ${e}
             AND ${n("generation")} < ${i}
         `.pipe(P.orDie));
 	}), s = (e, t) => P.gen(function* () {
-		let n = yield* Ir.SqlClient;
+		let n = yield* Rr.SqlClient;
 		yield* n`
-        UPDATE ${n(Hs)} SET
+        UPDATE ${n(Ws)} SET
           ${n("refreshed_at")} = ${t.refreshedAt ? t.refreshedAt.toISOString() : null},
           ${n("duration_ms")} = ${t.durationMs},
           ${n("row_count")} = ${t.rowCount},
@@ -1742,10 +1746,10 @@ ${a.join("\n\n")}\n`);
           ${n("next_refresh_at")} = ${t.nextRefreshAt ? t.nextRefreshAt.toISOString() : null}
         WHERE ${n("name")} = ${e}
       `.pipe(P.orDie), (yield* n`
-        SELECT ${n("name")} FROM ${n(Hs)}
+        SELECT ${n("name")} FROM ${n(Ws)}
         WHERE ${n("name")} = ${e}
       `.pipe(P.orElseSucceed(() => []))).length === 0 && (yield* n`
-          INSERT INTO ${n(Hs)}
+          INSERT INTO ${n(Ws)}
             (${n("name")}, ${n("generation")}, ${n("refreshed_at")},
              ${n("duration_ms")}, ${n("row_count")}, ${n("last_error")}, ${n("next_refresh_at")})
           VALUES
@@ -1793,14 +1797,14 @@ ${a.join("\n\n")}\n`);
 		},
 		refreshMirror: async (e) => {
 			await r(P.gen(function* () {
-				let n = yield* Ir.SqlClient, r = (yield* n`
-          SELECT * FROM ${n(Hs)}
+				let n = yield* Rr.SqlClient, r = (yield* n`
+          SELECT * FROM ${n(Ws)}
           WHERE ${n("name")} = ${e}
         `.pipe(P.orElseSucceed(() => [])))[0];
 				if (!r) return;
 				let i = yield* n`
           SELECT ${n("row_index")} AS row_index, ${n("row_data")} AS row_data
-          FROM ${n(Us)}
+          FROM ${n(Gs)}
           WHERE ${n("aggregate_name")} = ${e}
             AND ${n("generation")} = ${r.generation}
           ORDER BY ${n("row_index")} ASC
@@ -1810,12 +1814,12 @@ ${a.join("\n\n")}\n`);
 				} catch {}
 				t.set(e, {
 					rows: a,
-					meta: Js(r)
+					meta: Xs(r)
 				});
 			}));
 		}
 	};
-}, Xs = (e) => e.replace(/\.aggregate\.tsx?$/, ""), Zs = async (e, t) => {
+}, Qs = (e) => e.replace(/\.aggregate\.tsx?$/, ""), $s = async (e, t) => {
 	let n = [], r = /* @__PURE__ */ new Set();
 	for (let i of e) {
 		let e;
@@ -1834,11 +1838,11 @@ ${a.join("\n\n")}\n`);
 		r.add(a.name), n.push({
 			file: i,
 			definition: a
-		}), Xs(O(i));
+		}), Qs(O(i));
 	}
 	return n;
-}, Qs = /^(\d+)(ms|s|m|h|d)$/, $s = (e) => {
-	let t = Qs.exec(e.trim());
+}, ec = /^(\d+)(ms|s|m|h|d)$/, tc = (e) => {
+	let t = ec.exec(e.trim());
 	if (!t) throw Error(`aggregate: invalid refresh interval '${e}' — expected '<n><ms|s|m|h|d>' (e.g. '5m', '1h', '500ms')`);
 	let n = Number(t[1]);
 	switch (t[2]) {
@@ -1849,7 +1853,7 @@ ${a.join("\n\n")}\n`);
 		case "d": return n * 864e5;
 	}
 	throw Error("unreachable");
-}, ec = (e, t) => {
+}, nc = (e, t) => {
 	if (t === void 0) return e;
 	let n = Object.entries(t);
 	return n.length === 0 ? e : e.filter((e) => {
@@ -1862,23 +1866,23 @@ ${a.join("\n\n")}\n`);
 		}
 		return !0;
 	});
-}, tc = (e, t, n) => {
+}, rc = (e, t, n) => {
 	if (t === void 0) return e;
 	let r = n === "desc" ? -1 : 1;
 	return [...e].sort((e, n) => {
 		let i = e[t], a = n[t];
 		return i === a ? 0 : i == null ? -1 * r : a == null ? 1 * r : i < a ? -1 * r : i > a ? 1 * r : 0;
 	});
-}, nc = (e, t, n) => {
+}, ic = (e, t, n) => {
 	if (n === void 0 && t === void 0) return e;
 	let r = n ?? 0, i = t === void 0 ? e.length : r + t;
 	return e.slice(r, i);
-}, rc = (e, t) => {
+}, ac = (e, t) => {
 	let n = yt.decodeUnknownEither(e.output), r = [];
 	for (let e = 0; e < t.length; e++) {
 		let i = n(t[e]);
 		if (i._tag === "Left") {
-			let t = wa.formatErrorSync(i.left)[0], n = t?.path?.length ? t.path.join(".") : "<root>";
+			let t = Ea.formatErrorSync(i.left)[0], n = t?.path?.length ? t.path.join(".") : "<root>";
 			return {
 				ok: !1,
 				reason: `row[${e}] failed output-schema decode at ${n}: ${t?.message ?? "unknown"}`
@@ -1890,7 +1894,7 @@ ${a.join("\n\n")}\n`);
 		ok: !0,
 		rows: r
 	};
-}, ic = (e, t) => {
+}, oc = (e, t) => {
 	let n = e.refresh;
 	if (n.cron) {
 		let e = n.timezone ?? "UTC", r = ft.unsafeParse(n.cron, e);
@@ -1901,7 +1905,7 @@ ${a.join("\n\n")}\n`);
 		};
 	}
 	if (n.interval) {
-		let e = $s(n.interval);
+		let e = tc(n.interval);
 		return {
 			intervalMs: e,
 			nextAt: new Date(t.getTime() + e),
@@ -1917,7 +1921,7 @@ ${a.join("\n\n")}\n`);
 		nextAt: null,
 		kind: "none"
 	};
-}, ac = async (e) => {
+}, sc = async (e) => {
 	let { definition: t, store: n, analytics: r, storage: i, coordinator: a, log: o, refreshState: s, scheduledAt: c } = e;
 	if (s.inFlight) {
 		o.warn("aggregate: refresh overlap, skipping", { name: t.name });
@@ -1928,7 +1932,7 @@ ${a.join("\n\n")}\n`);
 	try {
 		if (!await a.tryClaim(t.name, c)) {
 			l.info("refresh skipped — coordination claim lost");
-			let { nextAt: e } = ic(t, /* @__PURE__ */ new Date()), n = i.get(t.name);
+			let { nextAt: e } = oc(t, /* @__PURE__ */ new Date()), n = i.get(t.name);
 			await i.updateMeta(t.name, {
 				...n.meta,
 				nextRefreshAt: e
@@ -1940,7 +1944,7 @@ ${a.join("\n\n")}\n`);
 			analytics: r,
 			log: l,
 			id: t.name
-		}), o = rc(t, e instanceof Promise ? await e : await P.runPromise(e));
+		}), o = ac(t, e instanceof Promise ? await e : await P.runPromise(e));
 		if (!o.ok) throw Error(`output schema mismatch: ${o.reason}`);
 		let s = o.rows;
 		if (t.strategy === "merge") {
@@ -1966,7 +1970,7 @@ ${a.join("\n\n")}\n`);
 				droppedCount: a
 			}), s = Array.from(r.values());
 		}
-		let d = Date.now() - u, { nextAt: f } = ic(t, /* @__PURE__ */ new Date()), p = {
+		let d = Date.now() - u, { nextAt: f } = oc(t, /* @__PURE__ */ new Date()), p = {
 			refreshedAt: /* @__PURE__ */ new Date(),
 			rowCount: s.length,
 			durationMs: d,
@@ -1983,12 +1987,12 @@ ${a.join("\n\n")}\n`);
 			durationMs: d
 		});
 	} catch (e) {
-		let n = e instanceof Error ? `${e.name}: ${e.message}` : String(e), r = i.get(t.name), { nextAt: a } = ic(t, /* @__PURE__ */ new Date());
+		let n = e instanceof Error ? `${e.name}: ${e.message}` : String(e), r = i.get(t.name), { nextAt: a } = oc(t, /* @__PURE__ */ new Date());
 		await i.updateMeta(t.name, {
 			...r.meta,
 			lastError: n,
 			nextRefreshAt: a
-		}), l.warn("refresh failed — last-good rows preserved", { err: n }), Ii({
+		}), l.warn("refresh failed — last-good rows preserved", { err: n }), Ri({
 			error: e,
 			source: "aggregate",
 			name: t.name
@@ -1996,23 +2000,23 @@ ${a.join("\n\n")}\n`);
 	} finally {
 		s.inFlight = !1;
 	}
-}, oc = (e) => {
+}, cc = (e) => {
 	let { definition: t, schedule: n } = e;
 	n.scheduleTimer !== null && clearTimeout(n.scheduleTimer);
-	let r = /* @__PURE__ */ new Date(), { intervalMs: i, nextAt: a, kind: o } = ic(t, r);
+	let r = /* @__PURE__ */ new Date(), { intervalMs: i, nextAt: a, kind: o } = oc(t, r);
 	if (o === "none" && !t.refresh.onChange) {
 		e.log.warn("aggregate: no refresh policy that auto-fires", { name: t.name });
 		return;
 	}
 	if (a === null) return;
 	let s = Math.max(0, a.getTime() - r.getTime()), c = setTimeout(async () => {
-		await ac({
+		await sc({
 			...e,
 			scheduledAt: a
-		}), oc(e);
+		}), cc(e);
 	}, s);
 	c.unref(), n.scheduleTimer = c;
-}, sc = (e) => {
+}, lc = (e) => {
 	let { definition: t, store: n, schedule: r, log: i } = e, a = t.refresh.onChange;
 	if (!a || a.length === 0) return;
 	let o = t.refresh.debounceMs ?? 3e4, s = new Set(a);
@@ -2020,7 +2024,7 @@ ${a.join("\n\n")}\n`);
 		if (!s.has(t.table)) return;
 		r.debounceTimer !== null && clearTimeout(r.debounceTimer);
 		let n = setTimeout(async () => {
-			r.debounceTimer = null, await ac({
+			r.debounceTimer = null, await sc({
 				...e,
 				scheduledAt: /* @__PURE__ */ new Date()
 			});
@@ -2031,7 +2035,7 @@ ${a.join("\n\n")}\n`);
 		tables: a,
 		debounceMs: o
 	});
-}, cc = (e) => {
+}, uc = (e) => {
 	let { definition: t, store: n, storage: r, log: i, schedule: a } = e, o = t.incremental;
 	if (o === void 0) return;
 	let s = i.child(`aggregate:${t.name}`), c = new At({
@@ -2046,7 +2050,7 @@ ${a.join("\n\n")}\n`);
 		skip: void 0,
 		projection: void 0
 	}), u = async () => {
-		let e = c.materialize().map((e) => o.toRow(e)), n = rc(t, e);
+		let e = c.materialize().map((e) => o.toRow(e)), n = ac(t, e);
 		if (!n.ok) {
 			s.warn("incremental: output schema mismatch — keeping last-good", { reason: n.reason });
 			return;
@@ -2090,12 +2094,12 @@ ${a.join("\n\n")}\n`);
 			op: o.op
 		});
 	})();
-	let p = t.refresh, m = p.interval === void 0 ? 5 * 6e4 : $s(p.interval), h = setInterval(() => {
+	let p = t.refresh, m = p.interval === void 0 ? 5 * 6e4 : tc(p.interval), h = setInterval(() => {
 		d().catch(() => void 0);
 	}, m);
 	h.unref(), a.scheduleTimer = h;
-}, lc = async (e) => {
-	let t = e.storage ?? Ws(), n = e.coordinator ?? Cr, r = e.analytics ?? B(), i = e.log;
+}, dc = async (e) => {
+	let t = e.storage ?? Ks(), n = e.coordinator ?? Tr, r = e.analytics ?? B(), i = e.log;
 	await t.initialize();
 	let a = /* @__PURE__ */ new Map(), o = /* @__PURE__ */ new Map(), s = /* @__PURE__ */ new Map(), c = {
 		refreshedAt: null,
@@ -2114,7 +2118,7 @@ ${a.join("\n\n")}\n`);
 			detachOnChange: null
 		};
 		a.set(u.name, f), u.incremental !== void 0 || (u.bootRefresh === "async" ? (await t.updateMeta(u.name, c), setImmediate(async () => {
-			await ac({
+			await sc({
 				definition: u,
 				store: e.store,
 				analytics: r,
@@ -2125,7 +2129,7 @@ ${a.join("\n\n")}\n`);
 				scheduledAt: /* @__PURE__ */ new Date()
 			});
 		})) : u.bootRefresh === "sync" ? l.push(async () => {
-			await ac({
+			await sc({
 				definition: u,
 				store: e.store,
 				analytics: r,
@@ -2136,7 +2140,7 @@ ${a.join("\n\n")}\n`);
 				scheduledAt: /* @__PURE__ */ new Date()
 			});
 		}) : await t.load(u.name) === null && setImmediate(async () => {
-			await ac({
+			await sc({
 				definition: u,
 				store: e.store,
 				analytics: r,
@@ -2146,7 +2150,7 @@ ${a.join("\n\n")}\n`);
 				refreshState: d,
 				scheduledAt: /* @__PURE__ */ new Date()
 			});
-		})), u.incremental === void 0 ? (oc({
+		})), u.incremental === void 0 ? (cc({
 			definition: u,
 			store: e.store,
 			analytics: r,
@@ -2155,7 +2159,7 @@ ${a.join("\n\n")}\n`);
 			log: i,
 			schedule: f,
 			refreshState: d
-		}), sc({
+		}), lc({
 			definition: u,
 			store: e.store,
 			analytics: r,
@@ -2164,7 +2168,7 @@ ${a.join("\n\n")}\n`);
 			log: i,
 			schedule: f,
 			refreshState: d
-		})) : cc({
+		})) : uc({
 			definition: u,
 			store: e.store,
 			storage: t,
@@ -2188,11 +2192,11 @@ ${a.join("\n\n")}\n`);
 								maxAgeMs: e.maxAgeMs
 							}));
 						}
-						return nc(tc(ec(n.rows, e?.where), e?.orderBy, e?.direction), e?.limit, e?.offset);
+						return ic(rc(nc(n.rows, e?.where), e?.orderBy, e?.direction), e?.limit, e?.offset);
 					}),
 					meta: () => P.succeed(t.get(a.name).meta),
 					refresh: () => P.tryPromise({
-						try: () => ac({
+						try: () => sc({
 							definition: s.get(a.name),
 							store: e.store,
 							analytics: r,
@@ -2220,7 +2224,7 @@ ${a.join("\n\n")}\n`);
 			})),
 			refreshByName: async (a) => {
 				let c = s.get(a);
-				return c ? (await ac({
+				return c ? (await sc({
 					definition: c,
 					store: e.store,
 					analytics: r,
@@ -2242,7 +2246,7 @@ ${a.join("\n\n")}\n`);
 		},
 		registered: Array.from(s.keys())
 	};
-}, uc = {
+}, fc = {
 	getHandle: (e) => ({
 		read: () => P.fail(new jt({ name: e.name })),
 		meta: () => P.succeed({
@@ -2256,52 +2260,52 @@ ${a.join("\n\n")}\n`);
 	}),
 	snapshot: () => [],
 	refreshByName: async () => !1
-}, dc = "/_voltro/inspect/aggregates", fc = /^\/_voltro\/inspect\/aggregates\/([^/]+)\/refresh$/, pc = (e, t, n) => ({
+}, pc = "/_voltro/inspect/aggregates", mc = /^\/_voltro\/inspect\/aggregates\/([^/]+)\/refresh$/, hc = (e, t, n) => ({
 	status: e,
 	contentType: "application/json; charset=utf-8",
 	body: JSON.stringify(t),
 	...n ? { headers: n } : {}
-}), mc = (e) => ({
+}), gc = (e) => ({
 	refreshedAt: e.refreshedAt === null ? null : e.refreshedAt.toISOString(),
 	rowCount: e.rowCount,
 	durationMs: e.durationMs,
 	lastError: e.lastError,
 	nextRefreshAt: e.nextRefreshAt === null ? null : e.nextRefreshAt.toISOString()
-}), hc = async (e, t, n, r) => {
-	if (!e.startsWith(dc)) return null;
+}), _c = async (e, t, n, r) => {
+	if (!e.startsWith(pc)) return null;
 	if (t === "POST") {
-		let t = fc.exec(e);
+		let t = mc.exec(e);
 		if (t) {
 			let e = decodeURIComponent(t[1]);
-			if (!await n.refreshByName(e)) return pc(404, {
+			if (!await n.refreshByName(e)) return hc(404, {
 				error: "aggregate not found",
 				name: e
 			}, r);
 			let i = n.snapshot().find((t) => t.name === e);
-			return pc(200, {
+			return hc(200, {
 				ok: !0,
 				name: e,
-				meta: i ? mc(i.meta) : null
+				meta: i ? gc(i.meta) : null
 			}, r);
 		}
-		return pc(405, {
+		return hc(405, {
 			error: "method not allowed",
 			allow: "GET, POST <name>/refresh"
 		}, r);
 	}
-	return t === "GET" && (e === dc || e.startsWith(`${dc}?`)) ? pc(200, {
+	return t === "GET" && (e === pc || e.startsWith(`${pc}?`)) ? hc(200, {
 		aggregates: n.snapshot().map((e) => ({
 			name: e.name,
-			meta: mc(e.meta)
+			meta: gc(e.meta)
 		})),
 		capturedAt: (/* @__PURE__ */ new Date()).toISOString()
 	}, r) : null;
-}, gc = "/_voltro/inspect/analytics", _c = (e, t, n) => ({
+}, vc = "/_voltro/inspect/analytics", yc = (e, t, n) => ({
 	status: e,
 	contentType: "application/json; charset=utf-8",
 	body: JSON.stringify(t),
 	...n ? { headers: n } : {}
-}), vc = (e, t) => {
+}), bc = (e, t) => {
 	let n = e.snapshot(t).buckets.filter((e) => e.kind === "plugin"), r = 0, i = 0, a = n.map((e) => (r += e.count, i += e.errorCount, {
 		tag: e.tag,
 		count: e.count,
@@ -2314,9 +2318,9 @@ ${a.join("\n\n")}\n`);
 		errorCount: i,
 		tags: a
 	};
-}, yc = (e, t, n, r) => {
-	if (e !== gc && !e.startsWith(`${gc}?`)) return null;
-	if (t !== "GET") return _c(405, {
+}, xc = (e, t, n, r) => {
+	if (e !== vc && !e.startsWith(`${vc}?`)) return null;
+	if (t !== "GET") return yc(405, {
 		error: "method not allowed",
 		allow: "GET"
 	}, r);
@@ -2325,8 +2329,8 @@ ${a.join("\n\n")}\n`);
 		if (e === null) return 6e4;
 		let t = Number(e);
 		return Number.isFinite(t) && t > 0 ? Math.min(t, 1440 * 6e4) : 6e4;
-	})(), s = vc(n.metricsCollector, o);
-	return _c(200, {
+	})(), s = bc(n.metricsCollector, o);
+	return yc(200, {
 		provider: n.sink.info.provider,
 		capabilities: n.sink.info.capabilities,
 		detail: n.sink.info.detail ?? null,
@@ -2338,40 +2342,40 @@ ${a.join("\n\n")}\n`);
 		},
 		capturedAt: (/* @__PURE__ */ new Date()).toISOString()
 	}, r);
-}, bc = "/_voltro/inspect/timeline", xc = "/_voltro/inspect/timeline/replay", Sc = (e, t, n) => ({
+}, Sc = "/_voltro/inspect/timeline", Cc = "/_voltro/inspect/timeline/replay", wc = (e, t, n) => ({
 	status: e,
 	contentType: "application/json; charset=utf-8",
 	body: JSON.stringify(t),
 	...n ? { headers: n } : {}
-}), Cc = (e) => {
+}), Tc = (e) => {
 	let t = e.indexOf("?");
 	return new URLSearchParams(t >= 0 ? e.slice(t + 1) : "");
-}, wc = (e, t) => {
+}, Ec = (e, t) => {
 	let n = e.get(t);
 	if (n === null) return;
 	let r = Number(n);
 	return Number.isFinite(r) ? r : void 0;
-}, Tc = async (e, t, n, r) => {
-	if (!e.startsWith(bc)) return null;
-	if (t !== "GET") return Sc(405, {
+}, Dc = async (e, t, n, r) => {
+	if (!e.startsWith(Sc)) return null;
+	if (t !== "GET") return wc(405, {
 		error: "method not allowed",
 		allow: "GET"
 	}, r);
-	let i = Cc(e);
-	if (e === xc || e.startsWith(`${xc}?`)) {
-		let e = i.get("table"), t = wc(i, "seq");
-		if (e === null || t === void 0) return Sc(400, { error: "replay requires ?table=<name>&seq=<n>" }, r);
+	let i = Tc(e);
+	if (e === Cc || e.startsWith(`${Cc}?`)) {
+		let e = i.get("table"), t = Ec(i, "seq");
+		if (e === null || t === void 0) return wc(400, { error: "replay requires ?table=<name>&seq=<n>" }, r);
 		let a;
 		try {
 			a = await n.readCurrentRows(e);
 		} catch (t) {
-			return Sc(404, {
+			return wc(404, {
 				error: "unknown or unreadable table",
 				table: e,
 				reason: String(t?.message ?? t)
 			}, r);
 		}
-		return Sc(200, {
+		return wc(200, {
 			table: e,
 			asOfSeq: t,
 			currentSeq: n.recorder.currentSeq(),
@@ -2379,15 +2383,15 @@ ${a.join("\n\n")}\n`);
 			capturedAt: (/* @__PURE__ */ new Date()).toISOString()
 		}, r);
 	}
-	if (e === bc || e.startsWith(`${bc}?`)) {
-		let e = i.get("table"), t = i.get("tenantId"), a = wc(i, "from"), o = wc(i, "to"), s = wc(i, "limit"), c = {
+	if (e === Sc || e.startsWith(`${Sc}?`)) {
+		let e = i.get("table"), t = i.get("tenantId"), a = Ec(i, "from"), o = Ec(i, "to"), s = Ec(i, "limit"), c = {
 			...e === null ? {} : { table: e },
 			...t === null ? {} : { tenantId: t },
 			...a === void 0 ? {} : { from: a },
 			...o === void 0 ? {} : { to: o },
 			...s === void 0 ? {} : { limit: s }
 		};
-		return Sc(200, {
+		return wc(200, {
 			enabled: n.recorder.enabled,
 			currentSeq: n.recorder.currentSeq(),
 			events: n.recorder.snapshot(c),
@@ -2395,7 +2399,7 @@ ${a.join("\n\n")}\n`);
 		}, r);
 	}
 	return null;
-}, Ec = /\.webhook\.tsx?$/, Dc = async (e, t) => {
+}, Oc = /\.webhook\.tsx?$/, kc = async (e, t) => {
 	let n = [], r = [], i = [];
 	for (let a of e) {
 		let e;
@@ -2405,7 +2409,7 @@ ${a.join("\n\n")}\n`);
 			t.warn("webhook: failed to import", { file: a }, e);
 			continue;
 		}
-		let o = (e.default && ka(e.default) ? e.default : void 0) ?? Object.values(e).find(ka);
+		let o = (e.default && ja(e.default) ? e.default : void 0) ?? Object.values(e).find(ja);
 		if (!o) {
 			t.warn("webhook: no descriptor default-exported", { file: a });
 			continue;
@@ -2436,7 +2440,7 @@ ${a.join("\n\n")}\n`);
 		incoming: r,
 		providers: i
 	};
-}, Oc = /\.email\.tsx?$/, kc = async (e, t) => {
+}, Ac = /\.email\.tsx?$/, jc = async (e, t) => {
 	let n = [];
 	for (let r of e) {
 		let e;
@@ -2446,7 +2450,7 @@ ${a.join("\n\n")}\n`);
 			t.warn("email: failed to import", { file: r }, e);
 			continue;
 		}
-		let i = Object.values(e).filter(ja);
+		let i = Object.values(e).filter(Na);
 		if (i.length === 0) {
 			t.warn("email: no defineEmail export found", { file: r });
 			continue;
@@ -2457,15 +2461,15 @@ ${a.join("\n\n")}\n`);
 		});
 	}
 	return { templates: n };
-}, Ac = (e) => P.map(e, (e) => ({ text: e })), jc = (e) => {
-	let { descriptor: t, executor: n, file: r } = e, { send: i, messages: a } = Sa(t);
+}, Mc = (e) => P.map(e, (e) => ({ text: e })), Nc = (e) => {
+	let { descriptor: t, executor: n, file: r } = e, { send: i, messages: a } = wa(t);
 	return [{
 		kind: "action",
 		file: r,
 		descriptor: i,
 		executor: (e, t) => {
 			let { threadId: r, order: i } = e, a = t.request?.subject?.tenantId ?? null;
-			return ei(n, t.store, {
+			return ni(n, t.store, {
 				threadId: r,
 				input: e,
 				tenantId: a,
@@ -2474,36 +2478,36 @@ ${a.join("\n\n")}\n`);
 					store: t.store,
 					request: t.request
 				}
-			}).pipe(Ac);
+			}).pipe(Mc);
 		}
 	}, {
 		kind: "query",
 		file: r,
 		descriptor: a,
-		executor: (e, t) => $r(t.store, e.threadId)
+		executor: (e, t) => ti(t.store, e.threadId)
 	}];
-}, Mc = "<builtin:undo>", Nc = () => kr() ? {
+}, Pc = "<builtin:undo>", Fc = () => jr() ? {
 	queries: [{
-		file: Mc,
-		descriptor: Vi,
-		executor: (e, t) => Ar(e, t)
+		file: Pc,
+		descriptor: Ui,
+		executor: (e, t) => Mr(e, t)
 	}],
 	mutations: [{
-		file: Mc,
-		descriptor: Bi,
+		file: Pc,
+		descriptor: Hi,
 		executor: (e, t) => Wt(e, t)
 	}, {
-		file: Mc,
-		descriptor: Hi,
-		executor: (e, t) => lr(e, t)
+		file: Pc,
+		descriptor: Wi,
+		executor: (e, t) => ur(e, t)
 	}]
 } : {
 	queries: [],
 	mutations: []
-}, Pc = () => kr() ? (e) => Zn(e) : (e) => ({
+}, Ic = () => jr() ? (e) => Qn(e) : (e) => ({
 	tx: e,
 	persist: async () => {}
-}), Fc = {
+}), Lc = {
 	interceptMutation: "rpc:intercept:mutation",
 	interceptQuery: "rpc:intercept:query",
 	interceptAction: "rpc:intercept:action",
@@ -2513,12 +2517,12 @@ ${a.join("\n\n")}\n`);
 	onChangeEvent: "store:changes:read",
 	inspectEndpoints: "inspect:read",
 	dashboard: "dashboard:mount"
-}, Ic = {
+}, Rc = {
 	tables: "store:write",
 	migrations: "migration:run"
-}, Lc = (e) => {
+}, zc = (e) => {
 	let t = new Set(e.permissions ?? []), n = [];
-	for (let [r, i] of Object.entries(Fc)) {
+	for (let [r, i] of Object.entries(Lc)) {
 		let a = e[r];
 		a !== void 0 && (Array.isArray(a) && a.length === 0 || t.has(i) || n.push({
 			hook: r,
@@ -2533,26 +2537,26 @@ ${a.join("\n\n")}\n`);
 	return r.length > 0 && !t.has("inspect:write") && n.push({
 		hook: `inspectEndpoints (${r.map((e) => `${e.method} ${e.path}`).join(", ")})`,
 		required: "inspect:write"
-	}), e.extendSchema !== void 0 && (e.extendSchema.tables && e.extendSchema.tables.length > 0 && (t.has(Ic.tables) || n.push({
+	}), e.extendSchema !== void 0 && (e.extendSchema.tables && e.extendSchema.tables.length > 0 && (t.has(Rc.tables) || n.push({
 		hook: "extendSchema.tables",
-		required: Ic.tables
-	})), e.extendSchema.migrations && e.extendSchema.migrations.length > 0 && (t.has(Ic.migrations) || n.push({
+		required: Rc.tables
+	})), e.extendSchema.migrations && e.extendSchema.migrations.length > 0 && (t.has(Rc.migrations) || n.push({
 		hook: "extendSchema.migrations",
-		required: Ic.migrations
+		required: Rc.migrations
 	}))), {
 		pluginName: e.name,
 		missing: n
 	};
-}, Rc = (e) => {
-	let t = e.map(Lc);
+}, Bc = (e) => {
+	let t = e.map(zc);
 	return {
 		ok: t.every((e) => e.missing.length === 0),
 		reports: t
 	};
-}, zc = (e) => {
+}, Vc = (e) => {
 	let t = e.reports.filter((e) => e.missing.length > 0);
 	return [`Plugin permission audit failed — ${t.length} plugin(s) ship hooks without the matching declared permission. Add the missing scopes to each plugin's manifest.permissions array:`, ...t.map((e) => `  • ${e.pluginName}:\n` + e.missing.map((e) => `      - ${e.hook} → needs '${e.required}'`).join("\n"))].join("\n");
-}, Bc = 5e3, Vc = 3e4, Hc = async (e, t) => {
+}, Hc = 5e3, Uc = 3e4, Wc = async (e, t) => {
 	let n, r = new Promise((e) => {
 		n = setTimeout(() => e({ kind: "timeout" }), t);
 	});
@@ -2567,7 +2571,7 @@ ${a.join("\n\n")}\n`);
 	} finally {
 		n && clearTimeout(n);
 	}
-}, Uc = async (e) => {
+}, Gc = async (e) => {
 	if (e !== void 0) {
 		if (typeof e == "object" && e && P.isEffect(e)) {
 			await P.runPromise(e);
@@ -2575,8 +2579,8 @@ ${a.join("\n\n")}\n`);
 		}
 		await Promise.resolve(e);
 	}
-}, Wc = /* @__PURE__ */ new Set(), Gc = (e) => `${e.name}@${e.version ?? "*"}`, Kc = (e) => {
-	let t = e.deactivateTimeoutMs ?? Bc, n = e.deactivateTotalBudgetMs ?? Vc, r = /* @__PURE__ */ new Set(), i = !1, a = /* @__PURE__ */ new Map();
+}, Kc = /* @__PURE__ */ new Set(), qc = (e) => `${e.name}@${e.version ?? "*"}`, Jc = (e) => {
+	let t = e.deactivateTimeoutMs ?? Hc, n = e.deactivateTotalBudgetMs ?? Uc, r = /* @__PURE__ */ new Set(), i = !1, a = /* @__PURE__ */ new Map();
 	for (let t of e.plugins) {
 		if (!t.configSchema) {
 			a.set(t.name, e.pluginConfigs?.[t.name]);
@@ -2602,14 +2606,14 @@ ${a.join("\n\n")}\n`);
 	});
 	return {
 		async activate() {
-			let t = Rc(e.plugins);
+			let t = Bc(e.plugins);
 			if (!t.ok) {
-				let n = zc(t);
+				let n = Vc(t);
 				throw e.log.error(n), Error(n);
 			}
 			let n = (process.env.VOLTRO_STRICT_PLUGIN_COMPAT ?? "").toLowerCase(), i = n === "1" || n === "true";
 			for (let t of e.plugins) {
-				let n = Ei(t.name, t.framework, e.voltroVersion);
+				let n = Oi(t.name, t.framework, e.voltroVersion);
 				if (!n.ok) {
 					if (i) {
 						let r = `plugin "${t.name}" is incompatible with framework ${e.voltroVersion}: ${n.reason}. Pin a compatible plugin version, or unset VOLTRO_STRICT_PLUGIN_COMPAT to downgrade this to a warning.`;
@@ -2619,10 +2623,10 @@ ${a.join("\n\n")}\n`);
 				}
 			}
 			for (let t of e.plugins) {
-				let n = Gc(t);
-				if (!Wc.has(n) && typeof t.onInstall == "function") try {
+				let n = qc(t);
+				if (!Kc.has(n) && typeof t.onInstall == "function") try {
 					let e = o(t);
-					await Promise.resolve().then(() => Uc(t.onInstall(e))), Wc.add(n);
+					await Promise.resolve().then(() => Gc(t.onInstall(e))), Kc.add(n);
 				} catch (n) {
 					throw e.log.error("plugin onInstall threw — aborting boot", {
 						plugin: t.name,
@@ -2636,7 +2640,7 @@ ${a.join("\n\n")}\n`);
 				}
 				try {
 					let e = o(t);
-					await Promise.resolve().then(() => Uc(t.onActivate(e))), r.add(t.name);
+					await Promise.resolve().then(() => Gc(t.onActivate(e))), r.add(t.name);
 				} catch (n) {
 					throw e.log.error("plugin onActivate threw — aborting boot", {
 						plugin: t.name,
@@ -2659,7 +2663,7 @@ ${a.join("\n\n")}\n`);
 					});
 					break;
 				}
-				let c = o(i), l = i.onDeactivate, u = await Hc(Promise.resolve().then(() => Uc(l(c))), t);
+				let c = o(i), l = i.onDeactivate, u = await Wc(Promise.resolve().then(() => Gc(l(c))), t);
 				u.kind === "rejected" ? e.log.warn("plugin onDeactivate threw", {
 					plugin: i.name,
 					err: u.err
@@ -2736,16 +2740,16 @@ ${a.join("\n\n")}\n`);
 				services: e.services !== void 0,
 				hasConfigSchema: e.configSchema !== void 0,
 				activated: r.has(e.name),
-				installed: Wc.has(Gc(e))
+				installed: Kc.has(qc(e))
 			}));
 		}
 	};
-}, qc = {
+}, Yc = {
 	mutation: "intercept-mutation",
 	query: "intercept-query",
 	action: "intercept-action"
-}, Jc = (e, t, n, r) => {
-	let i = qc[t], a = `plugin.${e}.${i}`, o = a;
+}, Xc = (e, t, n, r) => {
+	let i = Yc[t], a = `plugin.${e}.${i}`, o = a;
 	return (t, s) => P.suspend(() => {
 		let c = Date.now();
 		return n(t, s).pipe(P.withSpan(a, { attributes: {
@@ -2769,17 +2773,17 @@ ${a.join("\n\n")}\n`);
 			});
 		})));
 	});
-}, Yc = (e, t, n) => {
+}, Zc = (e, t, n) => {
 	let r = t === "mutation" ? "interceptMutation" : t === "query" ? "interceptQuery" : "interceptAction", i = [];
 	for (let a of e) {
 		let e = a[r];
-		typeof e == "function" && i.push(Jc(a.name, t, e, n));
+		typeof e == "function" && i.push(Xc(a.name, t, e, n));
 	}
 	return i;
-}, Xc = `${T}/plugins/`, Zc = (e) => e.startsWith("/") ? e : `/${e}`, Qc = (e) => {
+}, Qc = `${T}/plugins/`, $c = (e) => e.startsWith("/") ? e : `/${e}`, el = (e) => {
 	let t = e.indexOf("?");
 	return t >= 0 ? e.slice(0, t) : e;
-}, $c = (e, t) => e.kind === "json" ? {
+}, tl = (e, t) => e.kind === "json" ? {
 	status: e.status ?? 200,
 	contentType: "application/json; charset=utf-8",
 	body: JSON.stringify(e.data),
@@ -2789,12 +2793,12 @@ ${a.join("\n\n")}\n`);
 	contentType: e.contentType ?? "text/plain; charset=utf-8",
 	body: e.body,
 	headers: t
-}, el = (e) => {
+}, nl = (e) => {
 	let t = /* @__PURE__ */ new Map(), n = [];
 	for (let r of e) {
 		let e = r.inspectEndpoints ?? [], i = S(r.name);
 		for (let a of e) {
-			let e = `${Xc}${i}${Zc(a.path)}`, o = `${a.method} ${e}`, s = t.get(o);
+			let e = `${Qc}${i}${$c(a.path)}`, o = `${a.method} ${e}`, s = t.get(o);
 			if (s !== void 0) throw Error(`plugin inspect endpoint collision: "${a.method} ${e}" declared by plugin "${r.name}" but already claimed by ${s}`);
 			t.set(o, `plugin "${r.name}"`), n.push({
 				method: a.method,
@@ -2808,8 +2812,8 @@ ${a.join("\n\n")}\n`);
 	return {
 		endpoints: n,
 		async dispatch(e, t, r, i, a) {
-			let o = Qc(e);
-			if (!o.startsWith(Xc)) return null;
+			let o = el(e);
+			if (!o.startsWith(Qc)) return null;
 			let s = E(r.origin ?? r.Origin), c = t.toUpperCase();
 			if (c === "OPTIONS") return {
 				status: 204,
@@ -2836,7 +2840,7 @@ ${a.join("\n\n")}\n`);
 			let u = n.find((e) => e.method === c && e.path === o);
 			if (!u) return null;
 			try {
-				return $c(await P.runPromise(u.handler({
+				return tl(await P.runPromise(u.handler({
 					method: c,
 					url: e,
 					headers: r,
@@ -2856,7 +2860,7 @@ ${a.join("\n\n")}\n`);
 			}
 		}
 	};
-}, tl = (e, t, n) => {
+}, rl = (e, t, n) => {
 	let r = `plugin.${e}.schedule-fire`;
 	return async (i, a) => {
 		let o = Date.now();
@@ -2884,9 +2888,9 @@ ${a.join("\n\n")}\n`);
 			}), e;
 		}
 	};
-}, nl = (e, t) => {
+}, il = (e, t) => {
 	let n = [];
-	for (let r of e) typeof r.onScheduleFire == "function" && n.push(tl(r.name, r.onScheduleFire, t));
+	for (let r of e) typeof r.onScheduleFire == "function" && n.push(rl(r.name, r.onScheduleFire, t));
 	if (n.length !== 0) return async (e, t) => {
 		let r = e;
 		for (let e = n.length - 1; e >= 0; e--) {
@@ -2895,7 +2899,7 @@ ${a.join("\n\n")}\n`);
 		}
 		return r();
 	};
-}, rl = (e, t, n) => ((r, i) => {
+}, al = (e, t, n) => ((r, i) => {
 	let a = `plugin.${e}.workflow-step`, o = a, s = Date.now();
 	return t(r, i).pipe(P.withSpan(a, { attributes: {
 		"plugin.name": e,
@@ -2918,16 +2922,16 @@ ${a.join("\n\n")}\n`);
 			status: "error"
 		});
 	})));
-}), il = (e, t) => {
+}), ol = (e, t) => {
 	let n = [];
-	for (let r of e) typeof r.onWorkflowStep == "function" && n.push(rl(r.name, r.onWorkflowStep, t));
-	return n.length === 0 ? F.succeed(Rr, { interceptor: ((e) => e) }) : F.succeed(Rr, { interceptor: ((e, t) => n.reduceRight((e, n) => n(e, t), e)) });
-}, al = (e) => {
+	for (let r of e) typeof r.onWorkflowStep == "function" && n.push(al(r.name, r.onWorkflowStep, t));
+	return n.length === 0 ? F.succeed(Br, { interceptor: ((e) => e) }) : F.succeed(Br, { interceptor: ((e, t) => n.reduceRight((e, n) => n(e, t), e)) });
+}, sl = (e) => {
 	if (!e) return;
 	let t = e.workflowName ?? e.tag, n = [];
-	if (t !== void 0 && n.push(H("tag", t)), e.status !== void 0 && n.push(H("status", e.status)), n.length !== 0) return n.length === 1 ? n[0] : ri(...n);
-}, ol = async (e, t) => {
-	let n = Math.max(0, t?.offset ?? 0), r = Math.max(1, Math.min(500, t?.limit ?? 50)), i = al(t);
+	if (t !== void 0 && n.push(H("tag", t)), e.status !== void 0 && n.push(H("status", e.status)), n.length !== 0) return n.length === 1 ? n[0] : ai(...n);
+}, cl = async (e, t) => {
+	let n = Math.max(0, t?.offset ?? 0), r = Math.max(1, Math.min(500, t?.limit ?? 50)), i = sl(t);
 	return {
 		rows: await e.query({
 			table: "_voltro_workflow_runs",
@@ -2951,7 +2955,7 @@ ${a.join("\n\n")}\n`);
 		offset: n,
 		limit: r
 	};
-}, sl = (e) => ({
+}, ll = (e) => ({
 	id: e.id,
 	workflowName: e.tag,
 	executionId: e.executionId,
@@ -2966,10 +2970,10 @@ ${a.join("\n\n")}\n`);
 	durationMs: e.durationMs,
 	traceId: e.traceId,
 	parentExecutionId: e.parentExecutionId
-}), cl = async (e, t) => {
-	let { rows: n } = await ol(e, t);
-	return n.map(sl);
-}, ll = async (e, t, n) => {
+}), ul = async (e, t) => {
+	let { rows: n } = await cl(e, t);
+	return n.map(ll);
+}, dl = async (e, t, n) => {
 	let r = (await e.store.query({
 		table: "_voltro_workflow_runs",
 		order: [],
@@ -2983,7 +2987,7 @@ ${a.join("\n\n")}\n`);
 	if (!i) throw Error(`retry: no workflow registered with tag '${r.tag}'`);
 	let a = n?.payloadOverride === void 0 ? r.payload : n.payloadOverride, o = await e.runPromise(i.definition.execute(a));
 	return { executionId: typeof o == "string" ? o : "started" };
-}, ul = (e, t) => {
+}, fl = (e, t) => {
 	let n = e.filter((e) => typeof e.onHttpRequest == "function");
 	if (n.length !== 0) return n.reduceRight((e, n) => {
 		let r = n.onHttpRequest, i = `plugin.${n.name}.http-intercept`;
@@ -3004,7 +3008,7 @@ ${a.join("\n\n")}\n`);
 			}
 		};
 	}, (e) => e());
-}, dl = (e) => {
+}, pl = (e) => {
 	let t = [];
 	for (let n of e) {
 		let e = n.dashboard ?? [];
@@ -3028,7 +3032,7 @@ ${a.join("\n\n")}\n`);
 		}
 	}
 	return t;
-}, fl = /\.(query|mutation|action|stream)\.ts$/, pl = /\.(query|mutation|action|stream)\.server\.ts$/, ml = /* @__PURE__ */ new Set([
+}, ml = /\.(query|mutation|action|stream)\.ts$/, hl = /\.(query|mutation|action|stream)\.server\.ts$/, gl = /* @__PURE__ */ new Set([
 	"node_modules",
 	"dist",
 	"build",
@@ -3036,7 +3040,7 @@ ${a.join("\n\n")}\n`);
 	".vite",
 	".next",
 	".git"
-]), hl = async (e) => {
+]), _l = async (e) => {
 	let t = [], n = async (e) => {
 		let r;
 		try {
@@ -3045,14 +3049,14 @@ ${a.join("\n\n")}\n`);
 			return;
 		}
 		for (let i of r) {
-			if (ml.has(i.name)) continue;
+			if (gl.has(i.name)) continue;
 			let r = A(e, i.name);
-			i.isDirectory() ? await n(r) : i.isFile() && (fl.test(i.name) && !pl.test(i.name) || w.test(i.name)) && t.push(r);
+			i.isDirectory() ? await n(r) : i.isFile() && (ml.test(i.name) && !hl.test(i.name) || w.test(i.name)) && t.push(r);
 		}
 	};
 	return await n(e), t;
-}, gl = async (e) => {
-	let t = await hl(e), n = [];
+}, vl = async (e) => {
+	let t = await _l(e), n = [];
 	for (let e of t) try {
 		let t = await import(lt(e).href);
 		for (let r of Object.values(t)) {
@@ -3077,10 +3081,10 @@ ${a.join("\n\n")}\n`);
 		let t = `${e.kind}:${e.tag}`;
 		return r.has(t) ? !1 : (r.add(t), !0);
 	});
-}, _l = async (e, t, n) => {
+}, yl = async (e, t, n) => {
 	let r = e.filter((e) => typeof e.codegen == "function");
 	if (r.length === 0) return [];
-	let i = await gl(n);
+	let i = await vl(n);
 	return r.map((e) => {
 		let n = Ce(e.name), r = {
 			pluginName: e.name,
@@ -3094,8 +3098,8 @@ ${a.join("\n\n")}\n`);
 			emit: () => e.codegen(r)
 		};
 	});
-}, vl = async (e, t, n) => ({
-	pluginContributions: await _l(e, t, n),
+}, bl = async (e, t, n) => ({
+	pluginContributions: await yl(e, t, n),
 	pluginErrorImports: e.flatMap((e) => (e.errorSchemas ?? []).map((e) => e.import)),
 	pluginRpcImports: e.flatMap((e) => (e.rpcClientDescriptors ?? []).map((e) => ({
 		tag: e.tag,
@@ -3103,19 +3107,19 @@ ${a.join("\n\n")}\n`);
 		module: e.import.module,
 		name: e.import.name
 	})))
-}), yl = class extends Error {
+}), xl = class extends Error {
 	constructor(e) {
 		super(e), this.name = "InspectQueryError";
 	}
-}, bl = /* @__PURE__ */ new Set([
+}, Sl = /* @__PURE__ */ new Set([
 	"text",
 	"id",
 	"reference"
-]), xl = /* @__PURE__ */ new Set([
+]), Cl = /* @__PURE__ */ new Set([
 	"integer",
 	"timestamp",
 	"date"
-]), Sl = (e, t) => {
+]), wl = (e, t) => {
 	switch (e) {
 		case "isNull":
 		case "isNotNull":
@@ -3123,54 +3127,54 @@ ${a.join("\n\n")}\n`);
 		case "neq":
 		case "in":
 		case "notIn": return !0;
-		case "contains": return bl.has(t);
+		case "contains": return Sl.has(t);
 		case "gt":
 		case "gte":
 		case "lt":
-		case "lte": return xl.has(t);
+		case "lte": return Cl.has(t);
 	}
-}, Cl = (e, t, n) => {
+}, Tl = (e, t, n) => {
 	if (e == null) return e;
 	switch (t) {
 		case "integer": {
 			let t = typeof e == "number" ? e : Number(e);
-			if (!Number.isFinite(t)) throw new yl(`filter on "${n}": "${String(e)}" is not a number`);
+			if (!Number.isFinite(t)) throw new xl(`filter on "${n}": "${String(e)}" is not a number`);
 			return t;
 		}
 		case "boolean":
 			if (typeof e == "boolean") return e;
 			if (e === "true") return !0;
 			if (e === "false") return !1;
-			throw new yl(`filter on "${n}": "${String(e)}" is not a boolean`);
+			throw new xl(`filter on "${n}": "${String(e)}" is not a boolean`);
 		default: return e;
 	}
-}, wl = (e, t) => {
+}, El = (e, t) => {
 	let n = t.get(e.column);
-	if (!n) throw new yl(`unknown filter column "${e.column}"`);
-	if (!Sl(e.op, n.type)) throw new yl(`operator "${e.op}" is not valid for ${n.type} column "${e.column}"`);
+	if (!n) throw new xl(`unknown filter column "${e.column}"`);
+	if (!wl(e.op, n.type)) throw new xl(`operator "${e.op}" is not valid for ${n.type} column "${e.column}"`);
 	if (e.op === "isNull" || e.op === "isNotNull") return {
 		column: e.column,
 		op: e.op
 	};
 	if (e.op === "in" || e.op === "notIn") {
-		if (!Array.isArray(e.value)) throw new yl(`operator "${e.op}" on "${e.column}" requires an array value`);
+		if (!Array.isArray(e.value)) throw new xl(`operator "${e.op}" on "${e.column}" requires an array value`);
 		return {
 			column: e.column,
 			op: e.op,
-			value: e.value.map((t) => Cl(t, n.type, e.column))
+			value: e.value.map((t) => Tl(t, n.type, e.column))
 		};
 	}
 	return {
 		column: e.column,
 		op: e.op,
-		value: Cl(e.value, n.type, e.column)
+		value: Tl(e.value, n.type, e.column)
 	};
-}, Tl = 200, El = (e, t, n) => {
-	if (++n.n > Tl) throw new yl("filter tree too large");
-	if (e.kind === "leaf") return wl(e, t);
-	let r = e.children.map((e) => El(e, t, n));
+}, Dl = 200, Ol = (e, t, n) => {
+	if (++n.n > Dl) throw new xl("filter tree too large");
+	if (e.kind === "leaf") return El(e, t);
+	let r = e.children.map((e) => Ol(e, t, n));
 	return e.kind === "and" ? { and: r } : { or: r };
-}, Dl = (e, t) => {
+}, kl = (e, t) => {
 	let n = e?.trim();
 	if (!n) return null;
 	let r = t.filter((e) => e.type === "text" || (e.oneOf?.length ?? 0) > 0);
@@ -3179,16 +3183,16 @@ ${a.join("\n\n")}\n`);
 		op: "contains",
 		value: n
 	})) };
-}, Ol = (e) => {
+}, Al = (e) => {
 	let t = new Map(e.columns.map((e) => [e.name, e])), n = [];
-	e.filter && n.push(El(e.filter, t, { n: 0 }));
-	let r = Dl(e.quickSearch, e.columns);
+	e.filter && n.push(Ol(e.filter, t, { n: 0 }));
+	let r = kl(e.quickSearch, e.columns);
 	if (r && n.push(r), n.length !== 0) return n.length === 1 ? n[0] : { and: n };
-}, kl = (e, t) => {
+}, jl = (e, t) => {
 	let n = new Set(t.map((e) => e.name)), r = [], i = /* @__PURE__ */ new Set();
 	for (let t of e ?? []) {
-		if (!n.has(t.column)) throw new yl(`unknown sort column "${t.column}"`);
-		if (t.direction !== "asc" && t.direction !== "desc") throw new yl(`invalid sort direction "${t.direction}"`);
+		if (!n.has(t.column)) throw new xl(`unknown sort column "${t.column}"`);
+		if (t.direction !== "asc" && t.direction !== "desc") throw new xl(`invalid sort direction "${t.direction}"`);
 		i.has(t.column) || (i.add(t.column), r.push({
 			column: t.column,
 			direction: t.direction
@@ -3198,16 +3202,16 @@ ${a.join("\n\n")}\n`);
 		column: "id",
 		direction: "asc"
 	}), r;
-}, Al = 150, jl = 200, Ml = (e) => e instanceof Date ? e.toISOString() : typeof e == "bigint" ? e.toString() : e, Nl = (e) => {
+}, Ml = 150, Nl = 200, Pl = (e) => e instanceof Date ? e.toISOString() : typeof e == "bigint" ? e.toString() : e, Fl = (e) => {
 	if (!e) return null;
 	let t = {};
-	for (let [n, r] of Object.entries(e)) t[n] = Ml(r);
+	for (let [n, r] of Object.entries(e)) t[n] = Pl(r);
 	return t;
-}, Pl = (e, t) => {
+}, Il = (e, t) => {
 	let n = /* @__PURE__ */ new Map(), r, i = () => {
 		r = void 0;
 		for (let [e, r] of n) {
-			if (r.size > jl) {
+			if (r.size > Nl) {
 				t.emit("cdc", {
 					op: "resync",
 					table: e
@@ -3229,17 +3233,17 @@ ${a.join("\n\n")}\n`);
 		let o = n.get(e.table);
 		o || (o = /* @__PURE__ */ new Map(), n.set(e.table, o)), o.set(a, {
 			op: e.op,
-			row: e.op === "delete" ? null : Nl(t)
-		}), r === void 0 && (r = setTimeout(i, Al));
+			row: e.op === "delete" ? null : Fl(t)
+		}), r === void 0 && (r = setTimeout(i, Ml));
 	});
 	return () => {
 		r !== void 0 && clearTimeout(r), a();
 	};
-}, Fl = [
+}, Ll = [
 	"ok",
 	"error",
 	"unset"
-], Il = (e, t) => {
+], Rl = (e, t) => {
 	let n = e.indexOf("?"), r = n === -1 ? new URLSearchParams() : new URLSearchParams(e.slice(n + 1)), i = (() => {
 		let e = r.get("since");
 		if (e === null) return;
@@ -3260,9 +3264,9 @@ ${a.join("\n\n")}\n`);
 			Number.isFinite(t) && (e.minDurationMs = t);
 		}
 		let s = r.get("status");
-		s !== null && Fl.includes(s) && (e.status = s);
+		s !== null && Ll.includes(s) && (e.status = s);
 		let c = t.query(e);
-		return Ll({
+		return zl({
 			capturedAt: Date.now(),
 			bufferCapacity: t.capacityHint(),
 			bufferSize: t.size(),
@@ -3274,22 +3278,22 @@ ${a.join("\n\n")}\n`);
 	let s = {};
 	i !== void 0 && (s.since = i), a !== void 0 && (s.maxTraces = a), r.get("onlyErrors") === "1" && (s.onlyErrors = !0);
 	let c = t.queryGrouped(s);
-	return Ll({
+	return zl({
 		capturedAt: Date.now(),
 		bufferCapacity: t.capacityHint(),
 		bufferSize: t.size(),
 		returned: c.length,
 		traces: c
 	});
-}, Ll = (e) => ({
+}, zl = (e) => ({
 	status: 200,
 	contentType: "application/json; charset=utf-8",
 	body: JSON.stringify(e)
-}), Rl = (e) => {
+}), Bl = (e) => {
 	let t = e.now ?? Date.now, n = {
 		phase: "booting",
 		startedAt: t()
-	}, r = W((e, r) => {
+	}, r = La((e, r) => {
 		let i = (e.url ?? "/").split("?")[0], a = n.phase === "ready";
 		if (i === "/internal/liveness") {
 			r.writeHead(200, {
@@ -3344,31 +3348,31 @@ ${a.join("\n\n")}\n`);
 			e.log?.info("dev health server listening", { port: a }), t(i(a));
 		});
 	});
-}, zl = () => {
+}, Vl = () => {
 	let e = globalThis.crypto?.randomUUID?.();
 	return e === void 0 ? `${Date.now().toString(16)}${Math.random().toString(16).slice(2)}`.padEnd(32, "0").slice(0, 32) : e.replace(/-/g, "");
-}, $ = xt({ scope: "voltro:dev" }), Bl = await (async () => {
+}, $ = xt({ scope: "voltro:dev" }), Hl = await (async () => {
 	try {
 		let e = A(k(N(import.meta.url)), "..", "package.json"), t = await R.readFile(e, "utf8");
 		return JSON.parse(t).version ?? "0.0.0";
 	} catch {
 		return "0.0.0";
 	}
-})(), Vl = process.env.TENANT ?? "acme", Hl = process.env.VOLTRO_SESSION_COOKIE ?? "voltro:session", Ul = {
+})(), Ul = process.env.TENANT ?? "acme", Wl = process.env.VOLTRO_SESSION_COOKIE ?? "voltro:session", Gl = {
 	id: "voltro-password",
 	resolve: (e) => {
-		let t = ea(e.headers.cookie ?? e.headers.Cookie, Hl);
+		let t = na(e.headers.cookie ?? e.headers.Cookie, Wl);
 		if (!t) return { kind: "skip" };
-		let n = ta();
+		let n = ra();
 		if (!n) return { kind: "skip" };
-		let r = na(t, n);
+		let r = ia(t, n);
 		return r ? {
 			kind: "matched",
 			subject: r.subject
 		} : { kind: "skip" };
 	}
-}, Wl = (e = [], t, n = !1, r, i) => (Gl([t ?? Ul, ...e]), Di([t ?? Ul, ...e], {
-	...n ? { anonymousTenantRequired: !0 } : { fallback: (e) => Ti(e.headers["x-tenant"] ?? Vl) },
+}, Kl = (e = [], t, n = !1, r, i) => (ql([t ?? Gl, ...e]), ki([t ?? Gl, ...e], {
+	...n ? { anonymousTenantRequired: !0 } : { fallback: (e) => Di(e.headers["x-tenant"] ?? Ul) },
 	onStrategyFailed: ({ strategyId: e, reason: t }) => {
 		$.warn(`auth strategy "${e}" rejected request: ${t}`);
 	},
@@ -3377,17 +3381,20 @@ ${a.join("\n\n")}\n`);
 		...t,
 		store: i?.()
 	}) }
-})), Gl = (e) => {
+})), ql = (e) => {
 	let t = /* @__PURE__ */ new Map();
 	for (let n of e) {
 		let e = n.claimsBearerPrefix;
 		e === void 0 || e === "" || t.set(e, [...t.get(e) ?? [], n.id]);
 	}
 	for (let [e, n] of t) n.length < 2 || $.warn(`auth: ${n.length} strategies claim the bearer prefix "${e}" (${n.join(", ")}). The chain is first-match-wins, so the FIRST one decides the Subject for every token with this shape — if they resolve to different authority, which one answered decides whether authorization works. If this is \`apiKeys: true\` alongside your own key strategy, either drop one or give them distinct prefixes (\`apiKeys: { prefix: "…" }\`).`);
-}, Kl = (e) => F.succeed(yi, yi.of(({ headers: t, clientId: n }) => P.promise(async () => fn(n) || e({
+}, Jl = (e) => F.succeed(xi, xi.of(({ headers: t, clientId: n }) => P.promise(async () => fn(n) || e({
 	headers: t,
 	clientId: n
-})))), ql = F.succeed(bi, bi.of(({ clientId: e }) => P.succeed({ clientId: e }))), Jl = (e) => {
+})))), Yl = F.succeed(Si, Si.of(({ headers: e, clientId: t }) => P.succeed({
+	clientId: t,
+	...e["idempotency-key"] ? { idempotencyKey: e["idempotency-key"] } : {}
+}))), Xl = (e) => {
 	if (dt.isCause(e)) return e;
 	if (typeof e != "object" || !e) return;
 	for (let t of Object.getOwnPropertySymbols(e)) if (t.description === "effect/Runtime/FiberFailure/Cause") {
@@ -3396,17 +3403,17 @@ ${a.join("\n\n")}\n`);
 	}
 	let t = e.cause;
 	return dt.isCause(t) ? t : void 0;
-}, Yl = (e) => {
-	let t = Jl(e);
+}, Zl = (e) => {
+	let t = Xl(e);
 	if (t === void 0) return;
 	let n = dt.failureOption(t);
 	if (_t.isSome(n)) return n.value;
 	let r = dt.dieOption(t);
 	if (_t.isSome(r)) return r.value;
-}, Xl = (e) => {
+}, Ql = (e) => {
 	if (e == null) return { message: "unknown error" };
-	let t = Yl(e);
-	if (t !== void 0 && t !== e) return Xl(t);
+	let t = Zl(e);
+	if (t !== void 0 && t !== e) return Ql(t);
 	let n = cn(e), r = (n.dbCode ?? n.dbSqlState ?? n.dbErrno ?? n.dbConstraint) === void 0 ? {} : n;
 	if (typeof e == "object" && "_tag" in e) return {
 		...e,
@@ -3423,7 +3430,7 @@ ${a.join("\n\n")}\n`);
 	} catch {
 		return { message: String(e) };
 	}
-}, Zl = /* @__PURE__ */ new Set([
+}, $l = /* @__PURE__ */ new Set([
 	"node_modules",
 	"dist",
 	"build",
@@ -3431,21 +3438,21 @@ ${a.join("\n\n")}\n`);
 	".vite",
 	".next",
 	".git"
-]), Ql = async (e) => {
+]), eu = async (e) => {
 	let t = [], n = async (e) => {
 		let r = await R.readdir(e, { withFileTypes: !0 });
 		for (let i of r) {
-			if (Zl.has(i.name)) continue;
+			if ($l.has(i.name)) continue;
 			let r = A(e, i.name);
-			i.isDirectory() ? await n(r) : i.isFile() && (Ae.test(i.name) && !Ie.test(i.name) || Ie.test(i.name) || w.test(i.name) || Ee.test(i.name) || Te.test(i.name) || je.test(i.name) || Me.test(i.name) || Oe.test(i.name) || Re.test(i.name) || Ne.test(i.name) || De.test(i.name) || Oc.test(i.name) || xe.test(i.name) || C.test(i.name) || ke.test(i.name) || Pe.test(i.name) || Fe.test(i.name) || Le.test(i.name)) && t.push(r);
+			i.isDirectory() ? await n(r) : i.isFile() && (Ae.test(i.name) && !Ie.test(i.name) || Ie.test(i.name) || w.test(i.name) || Ee.test(i.name) || Te.test(i.name) || je.test(i.name) || Me.test(i.name) || Oe.test(i.name) || Re.test(i.name) || Ne.test(i.name) || De.test(i.name) || Ac.test(i.name) || xe.test(i.name) || C.test(i.name) || ke.test(i.name) || Pe.test(i.name) || Fe.test(i.name) || Le.test(i.name)) && t.push(r);
 		}
 	};
 	return await n(e), t;
-}, $l = (e) => typeof e == "object" && !!e && "kind" in e && "name" in e && e.kind === "query", eu = (e) => typeof e == "object" && !!e && "kind" in e && "name" in e && e.kind === "mutation", tu = (e) => typeof e == "object" && !!e && "kind" in e && "name" in e && e.kind === "action", nu = (e) => typeof e == "object" && !!e && "kind" in e && "name" in e && e.kind === "stream", ru = Symbol.for("@effect/workflow/Workflow"), iu = (e) => typeof e == "object" && !!e && ru in e, au = (e) => {
+}, tu = (e) => typeof e == "object" && !!e && "kind" in e && "name" in e && e.kind === "query", nu = (e) => typeof e == "object" && !!e && "kind" in e && "name" in e && e.kind === "mutation", ru = (e) => typeof e == "object" && !!e && "kind" in e && "name" in e && e.kind === "action", iu = (e) => typeof e == "object" && !!e && "kind" in e && "name" in e && e.kind === "stream", au = Symbol.for("@effect/workflow/Workflow"), ou = (e) => typeof e == "object" && !!e && au in e, su = (e) => {
 	let t = {};
 	for (let [n, r] of Object.entries(e)) r instanceof Date ? t[n] = r.toISOString() : typeof r == "bigint" ? t[n] = r.toString() : t[n] = r;
 	return t;
-}, ou = (e) => Object.entries(e.fields).map(([e, t]) => {
+}, cu = (e) => Object.entries(e.fields).map(([e, t]) => {
 	let n = t, r = n.references?.()?.tableName;
 	return {
 		name: e,
@@ -3456,11 +3463,11 @@ ${a.join("\n\n")}\n`);
 		...r === void 0 ? {} : { referencesTable: r },
 		...n.oneOf === void 0 ? {} : { oneOf: [...n.oneOf] }
 	};
-}), su = (e) => e.some((e) => e.name === "id") ? "id" : e.find((e) => e.type === "id")?.name, cu = (e) => typeof e == "object" && !!e && "tableName" in e && "fields" in e && typeof e.tableName == "string" && typeof e.fields == "object" && e.fields !== null, lu = (e, t) => {
+}), lu = (e) => e.some((e) => e.name === "id") ? "id" : e.find((e) => e.type === "id")?.name, uu = (e) => typeof e == "object" && !!e && "tableName" in e && "fields" in e && typeof e.tableName == "string" && typeof e.fields == "object" && e.fields !== null, du = (e, t) => {
 	let n = /* @__PURE__ */ new Map();
-	for (let e of t) cu(e) && n.set(e.tableName, e);
+	for (let e of t) uu(e) && n.set(e.tableName, e);
 	let r = /* @__PURE__ */ new Set(), i = [], a = (e) => {
-		if (!(!cu(e) || r.has(e.tableName))) {
+		if (!(!uu(e) || r.has(e.tableName))) {
 			r.add(e.tableName);
 			for (let t of Object.values(e.fields)) {
 				let e = t.references?.()?.tableName;
@@ -3473,7 +3480,7 @@ ${a.join("\n\n")}\n`);
 	};
 	for (let t of e) a(t);
 	return i;
-}, uu = "voltro/tenant", du = (e) => cu(e) && (e.appliedMixins ?? []).some((e) => e.id === uu), fu = "voltro/softDelete", pu = (e) => cu(e) && (e.appliedMixins ?? []).some((e) => e.id === fu), mu = (e) => {
+}, fu = "voltro/tenant", pu = (e) => uu(e) && (e.appliedMixins ?? []).some((e) => e.id === fu), mu = "voltro/softDelete", hu = (e) => uu(e) && (e.appliedMixins ?? []).some((e) => e.id === mu), gu = (e) => {
 	let t = e.traceId, n = e.spanId;
 	if (typeof t != "string" || typeof n != "string") return null;
 	let r = (e) => e instanceof Date ? e.getTime() : typeof e == "string" ? new Date(e).getTime() : typeof e == "number" ? e : 0, i = r(e.startedAt), a = r(e.endedAt);
@@ -3491,7 +3498,7 @@ ${a.join("\n\n")}\n`);
 		...typeof e.statusMessage == "string" ? { statusMessage: e.statusMessage } : {},
 		...Array.isArray(e.events) ? { events: e.events } : {}
 	};
-}, hu = async (e, t, n) => {
+}, _u = async (e, t, n) => {
 	let r = e.indexOf("?"), i = (r === -1 ? new URLSearchParams() : new URLSearchParams(e.slice(r + 1))).get("traceId"), a = [];
 	try {
 		a = await n.query({
@@ -3510,27 +3517,27 @@ ${a.join("\n\n")}\n`);
 	}
 	let o = /* @__PURE__ */ new Map();
 	for (let e of a) {
-		let t = mu(e);
+		let t = gu(e);
 		t && o.set(`${t.traceId}:${t.spanId}`, t);
 	}
 	for (let e of t.query({ max: t.capacityHint() })) o.set(`${e.traceId}:${e.spanId}`, e);
 	let s = new ce(Math.max(o.size + 16, 1024));
 	for (let e of [...o.values()].sort((e, t) => e.startMs - t.startMs)) s.append(e);
 	return s;
-}, gu = async (e, t) => {
+}, vu = async (e, t) => {
 	let n = [], r = [], i = [], a = [], o = [], s = [], c = [], l = [], u = /* @__PURE__ */ new Set(), d = /* @__PURE__ */ new Set(), f = /* @__PURE__ */ new Map(), p = [], m = /* @__PURE__ */ new Map();
 	for (let t of e) {
 		let e = O(t);
 		if (je.test(e)) {
 			let e = await x(t);
-			for (let t of Object.values(e)) cu(t) && (f.set(t.tableName, t), du(t) && u.add(t.tableName), pu(t) && d.add(t.tableName));
-			pi(e);
+			for (let t of Object.values(e)) uu(t) && (f.set(t.tableName, t), pu(t) && u.add(t.tableName), hu(t) && d.add(t.tableName));
+			hi(e);
 			continue;
 		}
 		if (Me.test(e)) {
 			let e = await x(t);
-			if (pi(e) === 0) {
-				let n = Object.entries(e).filter(([, e]) => ci(e)).map(([e]) => e);
+			if (hi(e) === 0) {
+				let n = Object.entries(e).filter(([, e]) => ui(e)).map(([e]) => e);
 				n.length > 0 ? $.warn(`relations file declares nothing — ${n.join(", ")} call relations(...) with an empty map, so no relation is registered and .with() cannot resolve one. Fill it in or delete the file.`, {
 					file: t,
 					exports: n
@@ -3546,7 +3553,7 @@ ${a.join("\n\n")}\n`);
 			continue;
 		}
 		if (w.test(e)) {
-			let e = await x(t), n = Object.values(e).find(iu);
+			let e = await x(t), n = Object.values(e).find(ou);
 			if (!n) {
 				$.warn("skipping workflow — no workflow(...) export", { file: t });
 				continue;
@@ -3571,7 +3578,7 @@ ${a.join("\n\n")}\n`);
 				definition: n,
 				buildExecute: a
 			});
-			for (let t of [...Object.values(e), ...Object.values(i)]) Hr(t) && s.push(t);
+			for (let t of [...Object.values(e), ...Object.values(i)]) Wr(t) && s.push(t);
 			continue;
 		}
 		if (Te.test(e)) {
@@ -3618,7 +3625,7 @@ ${a.join("\n\n")}\n`);
 		}
 	}
 	for (let e of p) {
-		let t = await x(e), o = Object.values(t).find($l) ?? Object.values(t).find(eu) ?? Object.values(t).find(tu) ?? Object.values(t).find(nu);
+		let t = await x(e), o = Object.values(t).find(tu) ?? Object.values(t).find(nu) ?? Object.values(t).find(ru) ?? Object.values(t).find(iu);
 		if (!o) {
 			$.warn("skipping procedure descriptor — no defineQuery / defineMutation / defineAction / defineStream export", { file: e });
 			continue;
@@ -3656,10 +3663,10 @@ ${a.join("\n\n")}\n`);
 	}
 	let h = /* @__PURE__ */ new Map();
 	for (let [e, t] of f) {
-		let n = gi(t);
+		let n = vi(t);
 		n.length > 0 && h.set(e, n);
 	}
-	let ee = h.size === 0 ? [] : n.flatMap((e) => vr({
+	let ee = h.size === 0 ? [] : n.flatMap((e) => yr({
 		name: e.descriptor.name,
 		output: e.descriptor.output,
 		source: e.descriptor.source
@@ -3669,9 +3676,9 @@ ${a.join("\n\n")}\n`);
 		source: e.descriptor.source,
 		...e.descriptor.cache === void 0 ? {} : { cache: e.descriptor.cache }
 	}, u));
-	f.has("actors") || f.set("actors", ti);
+	f.has("actors") || f.set("actors", ri);
 	let te = f.get("actors"), _ = f.get("tenants");
-	(te !== void 0 || _ !== void 0) && fi({
+	(te !== void 0 || _ !== void 0) && mi({
 		...te === void 0 ? {} : { actors: () => te },
 		..._ === void 0 ? {} : { tenants: () => _ }
 	});
@@ -3683,7 +3690,7 @@ ${a.join("\n\n")}\n`);
 		outbox: e.some((e) => Pe.test(O(e))),
 		connections: v.length > 0
 	};
-	return _i(), {
+	return yi(), {
 		queries: n,
 		mutations: r,
 		actions: i,
@@ -3700,7 +3707,7 @@ ${a.join("\n\n")}\n`);
 		serverOnlyLeaks: ee,
 		cacheScopeLeaks: g
 	};
-}, _u = async (e) => {
+}, yu = async (e) => {
 	let t = A(e, "app.config.ts"), n = L(t);
 	try {
 		let e = (await x(t)).default;
@@ -3718,13 +3725,14 @@ ${a.join("\n\n")}\n`);
 			...n ? { error: e } : {}
 		};
 	}
-}, vu = async (e) => (await _u(e)).config, yu = () => {
-	let e = xu(), t = process.env.DB_SCHEMA, n = t && t.length > 0 ? { schema: t } : {}, r = bu(), i = r === void 0 ? {} : { ssl: r }, a = process.env.DB_URL ?? process.env.DB_PRIMARY_URL;
-	return a ? {
-		url: a,
+}, bu = async (e) => (await yu(e)).config, xu = () => {
+	let e = wu(), t = process.env.DB_SCHEMA, n = t && t.length > 0 ? { schema: t } : {}, r = Cu(), i = r === void 0 ? {} : { ssl: r }, a = Su(), o = a === void 0 ? {} : { statementTimeoutMs: a }, s = process.env.DB_URL ?? process.env.DB_PRIMARY_URL;
+	return s ? {
+		url: s,
 		...e === void 0 ? {} : { maxConnections: e },
 		...i,
-		...n
+		...n,
+		...o
 	} : {
 		host: process.env.DB_HOST ?? process.env.PG_HOST ?? "localhost",
 		port: Number(process.env.DB_PORT ?? process.env.PG_PORT ?? 5432),
@@ -3733,21 +3741,27 @@ ${a.join("\n\n")}\n`);
 		database: process.env.DB_DATABASE ?? process.env.PG_DATABASE ?? "app",
 		...e === void 0 ? {} : { maxConnections: e },
 		...i,
-		...n
+		...n,
+		...o
 	};
-}, bu = () => {
+}, Su = () => {
+	let e = process.env.DB_STATEMENT_TIMEOUT_MS;
+	if (e === void 0 || e === "") return;
+	let t = Number(e);
+	return Number.isInteger(t) && t > 0 ? t : void 0;
+}, Cu = () => {
 	let e = process.env.PG_SSL;
 	if (!(e === void 0 || e === "")) {
 		if (e === "require") return !0;
 		if (e === "disable") return !1;
 		throw Error(`PG_SSL '${e}' is not supported — use 'require' (TLS without certificate verification) or 'disable' (plaintext).`);
 	}
-}, xu = () => {
+}, wu = () => {
 	let e = process.env.DB_MAX_CONNECTIONS ?? process.env.PG_MAX_CONNECTIONS;
 	if (e === void 0 || e === "") return;
 	let t = Number(e);
 	return Number.isInteger(t) && t > 0 ? t : void 0;
-}, Su = (e) => {
+}, Tu = (e) => {
 	let t = process.env.DB_URL !== void 0 || process.env.DB_PRIMARY_URL !== void 0 || process.env.DB_HOST !== void 0 || process.env.PG_HOST !== void 0;
 	if ("url" in e && e.url) try {
 		let n = new URL(e.url), r = n.username ? `${n.username}@` : "", i = n.port ? `:${n.port}` : "";
@@ -3766,25 +3780,25 @@ ${a.join("\n\n")}\n`);
 		summary: `postgres://${n.username}@${n.host}:${n.port}/${n.database}`,
 		fromEnv: t
 	};
-}, Cu = () => {
+}, Eu = () => {
 	let e = process.env.DB_REPLICA_URLS;
 	return e === void 0 || e.trim() === "" ? [] : e.split(",").map((e) => e.trim()).filter((e) => e.length > 0);
-}, wu = (e) => {
+}, Du = (e) => {
 	let t = 2166136261;
 	for (let n = 0; n < e.length; n++) t ^= e.charCodeAt(n), t = Math.imul(t, 16777619);
 	return 1e3 + (t >>> 0) % 2147482647;
-}, Tu = (e) => (process.env.DB_DIALECT ?? e?.store ?? "memory").toLowerCase(), Eu = async (e, t) => {
-	let n = Tu(e);
+}, Ou = (e) => (process.env.DB_DIALECT ?? e?.store ?? "memory").toLowerCase(), ku = async (e, t) => {
+	let n = Ou(e);
 	if (n === "memory") return $.info("sql dialect resolved: memory — in-process store, no persistence"), new z({});
-	let r = (process.env.CDC ?? "1") !== "0", i = await b(n), a = i.id === "postgres" ? "LISTEN/NOTIFY" : li(i.id) ? "in-process bus" : i.id === "mariadb" ? "binlog CDC (ROW)" : i.id === "mssql" ? "Change Tracking (polled)" : i.id === "mysql" ? "binlog CDC (ROW)" : "inline only", o = i.id === "postgres" ? "native" : i.id === "mysql" ? "INSERT/UPDATE/DELETE then SELECT (no RETURNING)" : i.id === "mariadb" ? "native (INSERT/DELETE); UPDATE then SELECT" : i.id === "mssql" ? "OUTPUT INSERTED/DELETED" : li(i.id) ? "native" : "unknown";
+	let r = (process.env.CDC ?? "1") !== "0", i = await b(n), a = i.id === "postgres" ? "LISTEN/NOTIFY" : di(i.id) ? "in-process bus" : i.id === "mariadb" ? "binlog CDC (ROW)" : i.id === "mssql" ? "Change Tracking (polled)" : i.id === "mysql" ? "binlog CDC (ROW)" : "inline only", o = i.id === "postgres" ? "native" : i.id === "mysql" ? "INSERT/UPDATE/DELETE then SELECT (no RETURNING)" : i.id === "mariadb" ? "native (INSERT/DELETE); UPDATE then SELECT" : i.id === "mssql" ? "OUTPUT INSERTED/DELETED" : di(i.id) ? "native" : "unknown";
 	$.info(`sql dialect resolved: ${i.id} — CDC: ${r ? a : "inline emit (CDC=0)"}, RETURNING: ${o}`);
-	let s = yu(), { summary: c, fromEnv: l } = Su(s);
+	let s = xu(), { summary: c, fromEnv: l } = Tu(s);
 	$.info(`db connection: ${c}${l ? "" : " (DEFAULT FALLBACK — no DB_URL / PG_HOST set)"}`), l || $.warn("db connection: falling back to localhost:5432/app — no DB_URL or PG_HOST env var set.\n  If this app should run against its OWN postgres (e.g. its docker-compose), set DB_URL.\n  Copy `.env.example` to `.env` in the app dir, or set DB_URL in the shell.\n  Otherwise this app is silently using whatever DB is at localhost:5432/app — which is\n  voltro-starter's docker default + may carry foreign tables that confuse the planner.");
 	let u;
 	if (r && (i.id === "mysql" || i.id === "mariadb")) {
-		let { connectionFromConfig: e } = await y("@voltro/sql-mysql"), t = process.env.POD_NAME ?? process.env.HOSTNAME ?? `dev-${process.pid}`, n = ni().filter((e) => e.isReactive !== !1).map((e) => e.tableName).filter((e) => !e.startsWith("_voltro_"));
+		let { connectionFromConfig: e } = await y("@voltro/sql-mysql"), t = process.env.POD_NAME ?? process.env.HOSTNAME ?? `dev-${process.pid}`, n = ii().filter((e) => e.isReactive !== !1).map((e) => e.tableName).filter((e) => !e.startsWith("_voltro_"));
 		u = {
-			serverId: wu(t),
+			serverId: Du(t),
 			replicaId: t,
 			connection: e(s),
 			includeTables: n
@@ -3794,7 +3808,7 @@ ${a.join("\n\n")}\n`);
 			tables: n.length
 		});
 	} else if (r && i.id === "mssql") {
-		let { connectionFromConfig: e } = await y("@voltro/sql-mssql"), t = e(s), n = process.env.POD_NAME ?? process.env.HOSTNAME ?? `dev-${process.pid}`, i = ni().filter((e) => e.isReactive !== !1).map((e) => e.tableName).filter((e) => !e.startsWith("_voltro_"));
+		let { connectionFromConfig: e } = await y("@voltro/sql-mssql"), t = e(s), n = process.env.POD_NAME ?? process.env.HOSTNAME ?? `dev-${process.pid}`, i = ii().filter((e) => e.isReactive !== !1).map((e) => e.tableName).filter((e) => !e.startsWith("_voltro_"));
 		u = {
 			serverId: 0,
 			replicaId: n,
@@ -3816,7 +3830,7 @@ ${a.join("\n\n")}\n`);
 		...t ? { tracerLayer: t } : {},
 		changeStrategy: r ? "cdc" : "inline",
 		...u ? { cdcConfig: u } : {}
-	}), f = Cu();
+	}), f = Eu();
 	if (f.length === 0) return $.info("read replicas: none configured (DB_REPLICA_URLS unset) — all queries → primary"), ct.recordReplication({
 		replicaCount: 0,
 		rywPolicy: "off",
@@ -3824,14 +3838,14 @@ ${a.join("\n\n")}\n`);
 		region: null,
 		localityEnabled: !1
 	}), d;
-	if (li(i.id)) return $.warn(`read replicas: not applicable (${i.id} is single-process); ignoring DB_REPLICA_URLS`), ct.recordReplication({
+	if (di(i.id)) return $.warn(`read replicas: not applicable (${i.id} is single-process); ignoring DB_REPLICA_URLS`), ct.recordReplication({
 		replicaCount: 0,
 		rywPolicy: "off",
 		rywStore: "memory",
 		region: null,
 		localityEnabled: !1
 	}), d;
-	let p = await ju(i.id);
+	let p = await Pu(i.id);
 	if (p === null) return $.warn(`read replicas: no replication adapter for dialect ${i.id}; falling back to primary-only routing`), ct.recordReplication({
 		replicaCount: 0,
 		rywPolicy: "off",
@@ -3854,20 +3868,20 @@ ${a.join("\n\n")}\n`);
 		if (!e) $.warn("RYW_STORE=redis set but REDIS_URL is empty — falling back to memory store");
 		else try {
 			let { default: t } = await import("ioredis"), n = new t(e);
-			g = cr({
+			g = lr({
 				client: n,
 				subscriber: n.duplicate()
-			}), te = "redis", $.info(`read replicas: ryw store = redis @ ${Ou(e)}`);
+			}), te = "redis", $.info(`read replicas: ryw store = redis @ ${ju(e)}`);
 		} catch (e) {
 			$.warn("RYW_STORE=redis but ioredis import / connect failed — falling back to memory store", { err: e });
 		}
 	}
-	g ||= tr();
-	let _ = ku(f.length), v = fr(), ne = v && _.length > 0 ? Sn({
+	g ||= nr();
+	let _ = Mu(f.length), v = pr(), ne = v && _.length > 0 ? Sn({
 		currentRegion: v,
-		replicaRegions: Au(m, _),
-		inner: ar()
-	}) : ar();
+		replicaRegions: Nu(m, _),
+		inner: or()
+	}) : or();
 	return $.info(`read replicas: ${m.length} configured, ryw policy '${h}', dialect=${i.id}, region=${v ?? "unknown"}` + (_.length > 0 ? ", replica-locality=on" : "")), ct.recordReplication({
 		replicaCount: m.length,
 		rywPolicy: h,
@@ -3882,33 +3896,33 @@ ${a.join("\n\n")}\n`);
 		rywStore: g,
 		replicaSelector: ne
 	});
-}, Du = async (e, t, n, r) => {
-	let i = Pa(t?.plugins ?? []), a = n === "postgres" || n === "mysql" || n === "mariadb", o = n === "postgres" ? "LISTEN/NOTIFY" : "binlog CDC";
+}, Au = async (e, t, n, r) => {
+	let i = W(t?.plugins ?? []), a = n === "postgres" || n === "mysql" || n === "mariadb", o = n === "postgres" ? "LISTEN/NOTIFY" : "binlog CDC";
 	if (!i) return n === "memory" || n === "sqlite" || n === "turso" ? r.info(`reactivity: single-instance (${n}) — no cross-replica fan-out needed`) : a ? r.info(`reactivity: cross-instance via native ${o} (${n})`) : r.warn(`reactivity: cross-instance fan-out is OFF for dialect '${n}'. A write on one replica will NOT reach clients on other replicas. Add @voltro/plugin-broadcast (Redis / NATS) to close the gap, or use postgres (LISTEN/NOTIFY) / mariadb (binlog CDC).`), null;
 	let s = process.env.POD_NAME ?? process.env.HOSTNAME ?? `dev-${process.pid}`;
-	return i.broadcast.crossReplica ? a ? r.info(`reactivity: native ${o} (${n}) + @voltro/plugin-broadcast (${i.broadcast.provider.name}) — both paths active (own-origin skip dedups)`) : r.info(`reactivity: cross-instance via @voltro/plugin-broadcast (${i.broadcast.provider.name}) for dialect '${n}'`) : r.warn("reactivity: @voltro/plugin-broadcast resolved to the in-process memory provider — NO real cross-replica fan-out. Set BROADCAST_URL (redis:// or nats://) for a real bus."), await Na({
+	return i.broadcast.crossReplica ? a ? r.info(`reactivity: native ${o} (${n}) + @voltro/plugin-broadcast (${i.broadcast.provider.name}) — both paths active (own-origin skip dedups)`) : r.info(`reactivity: cross-instance via @voltro/plugin-broadcast (${i.broadcast.provider.name}) for dialect '${n}'`) : r.warn("reactivity: @voltro/plugin-broadcast resolved to the in-process memory provider — NO real cross-replica fan-out. Set BROADCAST_URL (redis:// or nats://) for a real bus."), await Fa({
 		store: e,
 		provider: i.broadcast.provider,
 		replicaId: s,
 		logger: r
 	});
-}, Ou = (e) => {
+}, ju = (e) => {
 	try {
 		let t = new URL(e);
 		return t.password &&= "***", t.toString();
 	} catch {
 		return "***";
 	}
-}, ku = (e) => {
+}, Mu = (e) => {
 	let t = process.env.DB_REPLICA_REGIONS;
 	if (!t) return [];
 	let n = t.split(",").map((e) => e.trim()).filter((e) => e.length > 0);
 	return n.length === e ? n : ($.warn(`DB_REPLICA_REGIONS has ${n.length} entries but DB_REPLICA_URLS has ${e} — region awareness disabled. Provide one region per replica in the same order.`), []);
-}, Au = (e, t) => {
+}, Nu = (e, t) => {
 	let n = /* @__PURE__ */ new Map();
 	for (let r = 0; r < e.length && r < t.length; r++) n.set(e[r], t[r]);
 	return n;
-}, ju = async (e) => {
+}, Pu = async (e) => {
 	switch (e) {
 		case "postgres": return (await y("@voltro/sql-postgres")).postgresReplicationAdapter();
 		case "mysql":
@@ -3916,11 +3930,11 @@ ${a.join("\n\n")}\n`);
 		case "mssql": return (await y("@voltro/sql-mssql")).mssqlReplicationAdapter();
 		default: return null;
 	}
-}, Mu = async (e) => {
+}, Fu = async (e) => {
 	let t = M(e.find((e) => !e.startsWith("-")) ?? process.cwd()), n = await p(t);
-	return n.ran ? n.exitCode : process.env.FRAMEWORK_DEV_INNER !== "1" && process.env.WATCH !== "0" ? (_(ko({ root: t }), { scope: "voltro:dev" }), new Promise(() => {})) : Nu(t);
-}, Nu = async (p) => {
-	let _ = Date.now(), y = await vu(p), x = Number(process.env.PORT ?? y?.port ?? 4e3), ce = y?.name ?? O(p), S = u("api", ce, x), le = e(ce);
+	return n.ran ? n.exitCode : process.env.FRAMEWORK_DEV_INNER !== "1" && process.env.WATCH !== "0" ? (_(jo({ root: t }), { scope: "voltro:dev" }), new Promise(() => {})) : Iu(t);
+}, Iu = async (p) => {
+	let _ = Date.now(), y = await bu(p), x = Number(process.env.PORT ?? y?.port ?? 4e3), ce = y?.name ?? O(p), S = u("api", ce, x), le = e(ce);
 	await m({
 		id: S,
 		name: ce,
@@ -3933,18 +3947,18 @@ ${a.join("\n\n")}\n`);
 	let C = t();
 	n(C), $.info("booting voltro dev", {
 		root: p,
-		version: Bl,
+		version: Hl,
 		logFile: le.path
 	});
 	let me = await oe({
 		project: O(p),
-		cliVersion: Bl
+		cliVersion: Hl
 	});
 	if (me.kind === "not-personal") return $.error(`voltro dev needs a personal login — the stored credential belongs to no user.
   ${me.message}`), 1;
 	me.kind === "reported" && me.seat === "claimed" && $.info("cloud: this machine now counts toward your organisation's seats (voltro cloud whoami)");
 	let Ce = process.env.VOLTRO_DEV_HEALTH_PORT, we = Ce === void 0 ? x + 1 : Number(Ce), Te;
-	we > 0 && Number.isFinite(we) && (Te = await Rl({
+	we > 0 && Number.isFinite(we) && (Te = await Bl({
 		port: we,
 		log: {
 			info: (e, t) => $.debug(e, t),
@@ -3958,33 +3972,33 @@ ${a.join("\n\n")}\n`);
 	}).catch((e) => {
 		$.warn("agent-instructions seed failed (non-fatal)", {}, e);
 	});
-	let w = await Ql(p);
+	let w = await eu(p);
 	$.info(`discovered ${w.length} files`, { count: w.length });
-	let { pluginContributions: Ee, pluginErrorImports: Oe, pluginRpcImports: Ae } = await vl(y?.plugins ?? [], y?.name ?? O(p), p), je = await cs({
+	let { pluginContributions: Ee, pluginErrorImports: Oe, pluginRpcImports: Ae } = await bl(y?.plugins ?? [], y?.name ?? O(p), p), je = await ds({
 		root: p,
 		...Ee.length > 0 ? { pluginContributions: Ee } : {},
 		...Oe.length > 0 ? { pluginErrorImports: Oe } : {},
 		...Ae.length > 0 ? { pluginRpcImports: Ae } : {},
 		...y?.name === void 0 ? {} : { apiName: y.name }
 	});
-	if (je ? ($.info("codegen wrote rpcGroup", { path: j(p, je) }), await Uo(je)) : $.debug("codegen skipped — no descriptors discovered"), process.env.VOLTRO_BROWSER_SAFETY !== "off") {
-		let e = await Vo(p, w);
-		if (e.length > 0) throw Error(e.map(Ho).join("\n\n"));
+	if (je ? ($.info("codegen wrote rpcGroup", { path: j(p, je) }), await Ko(je)) : $.debug("codegen skipped — no descriptors discovered"), process.env.VOLTRO_BROWSER_SAFETY !== "off") {
+		let e = await Wo(p, w);
+		if (e.length > 0) throw Error(e.map(Go).join("\n\n"));
 	}
-	let Me = Tu(y ?? null), Ne = Me === "mariadb" ? "mariadb" : Me === "mssql" ? "mssql" : void 0, Ie = Ne !== void 0 && (process.env.CDC ?? "1") !== "0", { queries: T, mutations: D, actions: k, streams: M, workflows: N, workflowWorkers: lt, eventTriggers: ut, schedules: ft, connections: pt, tables: mt, featureMix: ht, tenantScopedTables: _t, softDeleteScopedTables: vt, serverOnlyLeaks: yt, cacheScopeLeaks: bt } = await gu(w, { cdc: Ie });
+	let Me = Ou(y ?? null), Ne = Me === "mariadb" ? "mariadb" : Me === "mssql" ? "mssql" : void 0, Ie = Ne !== void 0 && (process.env.CDC ?? "1") !== "0", { queries: T, mutations: D, actions: k, streams: M, workflows: N, workflowWorkers: lt, eventTriggers: ut, schedules: ft, connections: pt, tables: mt, featureMix: ht, tenantScopedTables: _t, softDeleteScopedTables: vt, serverOnlyLeaks: yt, cacheScopeLeaks: bt } = await vu(w, { cdc: Ie });
 	{
-		let e = Is(yt, Fs(process.env, "warn"), un, "`voltro dev`");
+		let e = Rs(yt, Ls(process.env, "warn"), un, "`voltro dev`");
 		if (e.action === "fail") throw Error(e.message);
 		e.action === "warn" && $.warn(e.message ?? "");
 	}
 	{
-		let e = Is(bt, Fs(process.env, "warn"), ln, "`voltro dev`");
+		let e = Rs(bt, Ls(process.env, "warn"), ln, "`voltro dev`");
 		if (e.action === "fail") throw Error(e.message);
 		e.action === "warn" && $.warn(e.message ?? "");
 	}
-	let xt = N.length > 0 || ut.length > 0, I = await vu(p), wt = so(I?.http ?? {});
-	br(pr(I?.secrets));
-	let L = Ua($i(I?.env) ? I.env : void 0, p);
+	let xt = N.length > 0 || ut.length > 0, I = await bu(p), wt = lo(I?.http ?? {});
+	xr(mr(I?.secrets));
+	let L = Ga(ta(I?.env) ? I.env : void 0, p);
 	L.minted.length > 0 && L.file !== void 0 && ($.warn(`minted ${L.minted.length} project secret(s) into ${j(p, L.file)} — unique to this project, gitignored. Your DEPLOYMENT needs its own values (\`voltro secret generate\`).`, {
 		keys: L.minted,
 		file: j(p, L.file)
@@ -4004,7 +4018,7 @@ ${a.join("\n\n")}\n`);
 			"apikeys:issue:other"
 		].some((t) => e.has(t)) && !e.has("admin:full") && $.warn("apiKeys is enabled but no role declares any of apikeys:issue:self / :org / :other. The management routes are mounted and every issue request will fail its guard — the capability is on and reachable by nobody. Grant the right one in your role map (`:self` lets a user mint their own key, `:org` a shared one, `:other` on behalf of a colleague).");
 	}
-	let Dt = (typeof Et == "object" ? Et.prefix : void 0) ?? "voltro_", Ot, kt = Et ? [dn({ resolveByHash: (e, t) => Ot ? Ot.resolveByHash(e, t) : Promise.resolve(null) }, { prefix: Dt })] : [], At = Wl([...I?.auth?.strategies ?? [], ...kt], _a(I?.plugins ?? []), I?.auth?.anonymousTenantRequired ?? !1, I?.auth?.resolveScopes, () => Tt.current), jt = Kl(At), Nt = ge({
+	let Dt = (typeof Et == "object" ? Et.prefix : void 0) ?? "voltro_", Ot, kt = Et ? [dn({ resolveByHash: (e, t) => Ot ? Ot.resolveByHash(e, t) : Promise.resolve(null) }, { prefix: Dt })] : [], At = Kl([...I?.auth?.strategies ?? [], ...kt], ya(I?.plugins ?? []), I?.auth?.anonymousTenantRequired ?? !1, I?.auth?.resolveScopes, () => Tt.current), jt = Jl(At), Nt = ge({
 		mix: ht,
 		plugins: I?.plugins ?? [],
 		cdc: Ie,
@@ -4017,8 +4031,8 @@ ${a.join("\n\n")}\n`);
 		}
 		return t;
 	})();
-	for (let e of z) oi(e);
-	let Lt = Kc({
+	for (let e of z) ci(e);
+	let Lt = Jc({
 		plugins: I?.plugins ?? [],
 		appName: I?.name ?? O(p),
 		appType: "api",
@@ -4026,12 +4040,12 @@ ${a.join("\n\n")}\n`);
 		log: $
 	});
 	I?.plugins?.length && ($.info("plugins loaded", { plugins: I.plugins.map((e) => e.name) }), await Lt.activate());
-	let Rt = await Lt.gatherObservability(), zt = el(I?.plugins ?? []);
+	let Rt = await Lt.gatherObservability(), zt = nl(I?.plugins ?? []);
 	zt.endpoints.length > 0 && $.info("plugin inspect endpoints registered", {
 		count: zt.endpoints.length,
 		endpoints: zt.endpoints.map((e) => `${e.method} ${e.path}`)
 	});
-	let Wt = dl(I?.plugins ?? []);
+	let Wt = pl(I?.plugins ?? []);
 	Wt.length > 0 && $.info("plugin dashboard mounts registered", {
 		count: Wt.length,
 		mounts: Wt.map((e) => `${e.fullId} (${e.slot})`)
@@ -4073,7 +4087,7 @@ ${a.join("\n\n")}\n`);
 	if (sn.length > 0) {
 		let e = await ve(sn, tn);
 		cn = e.agents.map((e) => e.descriptor.name);
-		for (let t of e.agents) for (let e of jc(t)) e.kind === "action" ? k.push({
+		for (let t of e.agents) for (let e of Nc(t)) e.kind === "action" ? k.push({
 			file: e.file,
 			descriptor: e.descriptor,
 			executor: e.executor
@@ -4087,16 +4101,16 @@ ${a.join("\n\n")}\n`);
 			routes: e.agents.flatMap((e) => [`${e.descriptor.name}.send`, `${e.descriptor.name}.messages`])
 		});
 	}
-	let fn = Nc();
+	let fn = Fc();
 	(fn.queries.length > 0 || fn.mutations.length > 0) && (T.push(...fn.queries), D.push(...fn.mutations), $.info("undo built-ins registered", { routes: [
 		"__voltro.undo.log",
 		"__voltro.undo.apply",
 		"__voltro.undo.redo"
 	] }));
-	let hn = $.child("aggregate"), vn = w.filter((e) => Le.test(e)), yn = vn.length > 0 ? await Zs(vn, hn) : [], bn = yn.map((e) => e.definition.name);
-	for (let e of ai()) $.warn(`identifier length · ${e}`);
-	let Sn = I?.restRoutes ?? [], On = w.filter((e) => ke.test(e)).length, jn = w.filter((e) => Re.test(e)).length, Mn = w.filter((e) => /\.seed\.ts$/.test(e)).length, Nn = w.filter((e) => De.test(e)).length, Fn = w.filter((e) => Oc.test(e)).length;
-	us(ls([
+	let hn = $.child("aggregate"), vn = w.filter((e) => Le.test(e)), yn = vn.length > 0 ? await $s(vn, hn) : [], bn = yn.map((e) => e.definition.name);
+	for (let e of si()) $.warn(`identifier length · ${e}`);
+	let Sn = I?.restRoutes ?? [], On = w.filter((e) => ke.test(e)).length, jn = w.filter((e) => Re.test(e)).length, Mn = w.filter((e) => /\.seed\.ts$/.test(e)).length, Nn = w.filter((e) => De.test(e)).length, Fn = w.filter((e) => Ac.test(e)).length;
+	ps(fs([
 		T,
 		D,
 		k,
@@ -4142,28 +4156,28 @@ ${a.join("\n\n")}\n`);
 		},
 		tenantTables: [..._t]
 	});
-	let In = _e(), Rn = (process.env.VOLTRO_TRACING_BUFFER ?? "").toLowerCase() === "off", Bn = (process.env.VOLTRO_TRACING_STREAM ?? "").toLowerCase() === "all", Un = () => {}, Wn = (e) => {
+	let In = _e(), Rn = (process.env.VOLTRO_TRACING_BUFFER ?? "").toLowerCase() === "off", Bn = (process.env.VOLTRO_TRACING_STREAM ?? "").toLowerCase() === "all", Wn = () => {}, Gn = (e) => {
 		if (!e.name.startsWith("http.server")) return !1;
 		let t = e.attributes, n = String(t["url.path"] ?? t["http.route"] ?? t["http.target"] ?? "");
 		return n.startsWith("/_voltro/") || n === "/ws" || n.startsWith("/ws/") || n.startsWith("/ws?");
-	}, Yn = (e) => {
-		Wn(e) || be(e) || e.name.startsWith("RpcServer.") || (In.append(e), (Bn || e.status === "error") && C.emit("trace", e), Un(e));
-	}, Xn = Rn ? void 0 : An(Yn), Zn = await Zt({
+	}, Xn = (e) => {
+		Gn(e) || be(e) || e.name.startsWith("RpcServer.") || (In.append(e), (Bn || e.status === "error") && C.emit("trace", e), Wn(e));
+	}, Zn = Rn ? void 0 : An(Xn), Qn = await Zt({
 		serviceName: process.env.OTEL_SERVICE_NAME ?? I?.name ?? "voltro-api",
-		...Xn ? { traceSink: Xn } : {},
+		...Zn ? { traceSink: Zn } : {},
 		...Rt.spanProcessors.length > 0 ? { extraSpanProcessors: Rt.spanProcessors } : {},
 		...Rt.metricReaders.length > 0 ? { extraMetricReaders: Rt.metricReaders } : {},
 		...Object.keys(Rt.resourceAttributes).length > 0 ? { resourceAttributes: Rt.resourceAttributes } : {},
 		...Rt.sampler === void 0 ? {} : { sampler: Rt.sampler }
 	});
-	Zn.mode === "off" ? Zn.bufferOnly || $.info("tracing disabled", { reason: "buffer off" }) : $.info("tracing enabled", { mode: Zn.mode });
-	let tr = Zn.mode === "off" && Zn.bufferOnly === !1 ? void 0 : Zn.layer, B = await Eu(I, tr);
-	Tt.current = jr(B, Tu(I ?? null));
-	for (let e of Xa({
-		dialect: Tu(I ?? null),
+	Qn.mode === "off" ? Qn.bufferOnly || $.info("tracing disabled", { reason: "buffer off" }) : $.info("tracing enabled", { mode: Qn.mode });
+	let nr = Qn.mode === "off" && Qn.bufferOnly === !1 ? void 0 : Qn.layer, B = await ku(I, nr);
+	Tt.current = Nr(B, Ou(I ?? null));
+	for (let e of Qa({
+		dialect: Ou(I ?? null),
 		changeStrategy: (process.env.CDC ?? "1") === "0" ? "inline" : "cdc",
 		dbUrl: process.env.DB_URL,
-		tables: ni().map((e) => ({
+		tables: ii().map((e) => ({
 			tableName: e.tableName,
 			isReactive: e.isReactive === !0
 		})),
@@ -4179,59 +4193,59 @@ ${a.join("\n\n")}\n`);
 			usage: t
 		}), $.info("api keys active", { prefix: Dt });
 	}
-	let rr = Ms({
+	let ir = Ps({
 		definitions: pt.map((e) => e.definition),
 		store: B,
-		publicUrl: Ns(x),
+		publicUrl: Is(x),
 		log: $.child("connections")
 	});
-	T.push(...rr.queries), D.push(...rr.mutations), k.push(...rr.actions);
-	let ar = Tu(I), cr = process.env.POD_NAME ?? process.env.HOSTNAME ?? `dev-${process.pid}`, lr, ur;
-	if (ar !== "memory") {
-		let e = await b(ar);
-		lr = gt.make(e.makeSqlLayer(yu())), ur = await lr.runPromise(Ir.SqlClient);
+	T.push(...ir.queries), D.push(...ir.mutations), k.push(...ir.actions);
+	let or = Ou(I), lr = process.env.POD_NAME ?? process.env.HOSTNAME ?? `dev-${process.pid}`, ur, dr;
+	if (or !== "memory") {
+		let e = await b(or);
+		ur = gt.make(e.makeSqlLayer(xu())), dr = await ur.runPromise(Rr.SqlClient);
 	}
-	let fr = Pn({
+	let pr = Pn({
 		coordinator: [
 			"postgres",
 			"mariadb",
 			"mysql",
 			"mssql"
-		].includes(ar) ? wn(B, cr, $) : Cr,
-		replicaId: cr,
+		].includes(or) ? wn(B, lr, $) : Tr,
+		replicaId: lr,
 		log: $
-	}), mr = [], gr = {
-		...ur ? { sql: ur } : {},
+	}), hr = [], _r = {
+		...dr ? { sql: dr } : {},
 		scheduleCoordinated: (e, t, n) => {
-			let r = fr(e, t, n);
-			return mr.push(r), r;
+			let r = pr(e, t, n);
+			return hr.push(r), r;
 		}
 	};
-	for (let e of I?.plugins ?? []) e.bindDataStore?.(B, gr);
-	let _r = await Du(B, I, Tu(I), $);
+	for (let e of I?.plugins ?? []) e.bindDataStore?.(B, _r);
+	let vr = await Au(B, I, Ou(I), $);
 	I?.cache && !process.env.CACHE_BACKEND && (process.env.CACHE_BACKEND = I.cache), I?.cacheRedisUrl && !process.env.CACHE_REDIS_URL && (process.env.CACHE_REDIS_URL = I.cacheRedisUrl), I?.cacheRedisDriver && !process.env.CACHE_REDIS_DRIVER && (process.env.CACHE_REDIS_DRIVER = I.cacheRedisDriver), I?.cacheKeyPrefix && !process.env.CACHE_KEY_PREFIX && (process.env.CACHE_KEY_PREFIX = I.cacheKeyPrefix);
-	let { service: vr, invalidationBus: yr, snapshotCache: wr, cache: Dr, backend: Or, stats: kr, dispose: Ar } = await no({ env: process.env });
-	$.info(`cache backend resolved: ${Or}` + (Or === "redis" ? ` (driver ${process.env.CACHE_REDIS_DRIVER ?? "resp"})` : " — in-process, not cross-instance")), I?.kv && !process.env.KV_BACKEND && (process.env.KV_BACKEND = I.kv), I?.kvRedisUrl && !process.env.KV_REDIS_URL && (process.env.KV_REDIS_URL = I.kvRedisUrl), I?.kvKeyPrefix && !process.env.KV_KEY_PREFIX && (process.env.KV_KEY_PREFIX = I.kvKeyPrefix);
-	let { kv: Mr, service: Nr, backend: Rr } = await kn({ store: B });
-	$.info(`kv backend resolved: ${Rr}` + (Rr === "database" ? " (durable, _voltro_kv)" : Rr === "memory" ? " — in-process, non-durable" : ` (driver ${process.env.KV_REDIS_DRIVER ?? "resp"}, non-durable)`));
-	let Hr = Tu(I), $r = I?.analytics !== void 0 && I.analytics.kind !== "noop" && Hr !== "memory" ? (await b(Hr)).makeSqlLayer(yu()) : void 0, ei = await ds({
+	let { service: yr, invalidationBus: br, snapshotCache: wr, cache: Er, backend: kr, stats: Ar, dispose: jr } = await io({ env: process.env });
+	$.info(`cache backend resolved: ${kr}` + (kr === "redis" ? ` (driver ${process.env.CACHE_REDIS_DRIVER ?? "resp"})` : " — in-process, not cross-instance")), I?.kv && !process.env.KV_BACKEND && (process.env.KV_BACKEND = I.kv), I?.kvRedisUrl && !process.env.KV_REDIS_URL && (process.env.KV_REDIS_URL = I.kvRedisUrl), I?.kvKeyPrefix && !process.env.KV_KEY_PREFIX && (process.env.KV_KEY_PREFIX = I.kvKeyPrefix);
+	let { kv: Mr, service: Pr, backend: Fr } = await kn({ store: B });
+	$.info(`kv backend resolved: ${Fr}` + (Fr === "database" ? " (durable, _voltro_kv)" : Fr === "memory" ? " — in-process, non-durable" : ` (driver ${process.env.KV_REDIS_DRIVER ?? "resp"}, non-durable)`));
+	let Br = Ou(I), Wr = I?.analytics !== void 0 && I.analytics.kind !== "noop" && Br !== "memory" ? (await b(Br)).makeSqlLayer(xu()) : void 0, ti = await ms({
 		spec: I?.analytics,
-		sqlLayer: $r,
+		sqlLayer: Wr,
 		log: $
 	});
-	ei.spec;
-	let ti = ei.sink, ci = Kt({
+	ti.spec;
+	let ni = ti.sink, ri = Kt({
 		store: B,
-		sink: ti,
+		sink: ni,
 		log: $
 	});
-	ci.tables.length > 0 && $.info("analytics mirror", {
-		provider: ti.info.provider,
-		tables: ci.tables
+	ri.tables.length > 0 && $.info("analytics mirror", {
+		provider: ni.info.provider,
+		tables: ri.tables
 	}), V(() => {
-		ci.detach();
+		ri.detach();
 	});
-	let ui = ei.dispose, fi = Tu(I), pi;
+	let ui = ti.dispose, fi = Ou(I), mi;
 	if (fi !== "memory" && process.env.VOLTRO_AUTO_MIGRATE !== "0") {
 		let e = Date.now(), t = (process.env.NODE_ENV ?? "").toLowerCase() === "production" ? "prod" : (process.env.NODE_ENV ?? "").toLowerCase() === "staging" ? "staging" : "dev";
 		$.info("auto-migrate: planning schema", {
@@ -4243,27 +4257,27 @@ ${a.join("\n\n")}\n`);
 			tablesTotal: z.length
 		});
 		try {
-			let n = await b(fi), r = n.makeSqlLayer(yu());
-			pi = r, await fa(lu(z.filter((e) => e.tableName.startsWith("_voltro_") || e.tableName === "voltro_isr_cache"), z), r, n.id);
-			let i = to({
-				conn: yu(),
-				pendingIds: await P.runPromise(Ir.SqlClient.pipe(P.flatMap((e) => la(e, p)), P.provide(r))),
-				optIn: process.env[Za] === "1"
+			let n = await b(fi), r = n.makeSqlLayer(xu());
+			mi = r, await pa(du(z.filter((e) => e.tableName.startsWith("_voltro_") || e.tableName === "voltro_isr_cache"), z), r, n.id);
+			let i = ro({
+				conn: xu(),
+				pendingIds: await P.runPromise(Rr.SqlClient.pipe(P.flatMap((e) => ua(e, p)), P.provide(r))),
+				optIn: process.env[$a] === "1"
 			});
 			if (!i.allowed) throw $.error(`file-based migrations: ${i.message}`), Error("file-based migrations refused — see error above");
-			let a = await P.runPromise(Ir.SqlClient.pipe(P.flatMap((e) => da(e, {
+			let a = await P.runPromise(Rr.SqlClient.pipe(P.flatMap((e) => fa(e, {
 				projectRoot: p,
 				env: t,
 				appliedBy: `boot:${t}`
 			})), P.provide(r)));
 			a.applied.length > 0 && $.info(`file-based migrations: applied ${a.applied.length}`, { applied: a.applied.map((e) => `${e.id} (${e.durationMs}ms)`) });
-			let o = await P.runPromise(Ir.SqlClient.pipe(P.flatMap((e) => pa(e, z, {
+			let o = await P.runPromise(Rr.SqlClient.pipe(P.flatMap((e) => ma(e, z, {
 				appliedBy: `boot:${t}`,
 				environment: t,
 				dialectId: n.id
 			})), P.provide(r)));
-			if (o.kind === "refused-blocked" || o.kind === "prod-mismatch") throw $.error(oa(o, n.id)), Error("auto-migrate refused — see error above");
-			$.info(oa(o, n.id), { durationMs: Date.now() - e });
+			if (o.kind === "refused-blocked" || o.kind === "prod-mismatch") throw $.error(sa(o, n.id)), Error("auto-migrate refused — see error above");
+			$.info(sa(o, n.id), { durationMs: Date.now() - e });
 		} catch (e) {
 			throw $.error("auto-migrate failed — aborting boot", { err: e }), Te?.set({
 				phase: "error",
@@ -4271,9 +4285,9 @@ ${a.join("\n\n")}\n`);
 			}), e;
 		}
 	} else fi !== "memory" && $.info("auto-migrate: skipped (VOLTRO_AUTO_MIGRATE=0)");
-	let mi = Tu(I);
-	if ((I?.plugins ?? []).some((e) => (e.extendSchema?.migrations?.length ?? 0) > 0) && mi !== "memory") {
-		let e = (await b(mi)).makeSqlLayer(yu());
+	let hi = Ou(I);
+	if ((I?.plugins ?? []).some((e) => (e.extendSchema?.migrations?.length ?? 0) > 0) && hi !== "memory") {
+		let e = (await b(hi)).makeSqlLayer(xu());
 		try {
 			let t = await P.runPromise(fe(I.plugins).pipe(P.provide(e))), n = t.filter((e) => e.status === "applied"), r = t.filter((e) => e.status === "skipped");
 			$.info("plugin migrations complete", {
@@ -4284,101 +4298,101 @@ ${a.join("\n\n")}\n`);
 			throw $.error("plugin migrations failed — aborting boot", { err: e }), e;
 		}
 	}
-	let gi = Pl(B, C);
+	let gi = Il(B, C);
 	V(() => {
 		gi();
 	});
-	let _i = Jn(z);
-	xr({
+	let vi = Yn(z);
+	Sr({
 		dataStore: B,
-		schemaRegistry: _i
+		schemaRegistry: vi
 	});
-	let xi = $.child("seeds"), wi = w.filter((e) => /\.seed\.ts$/.test(e)), Ei = wi.length > 0 ? await ie(wi, xi) : [];
+	let yi = $.child("seeds"), Ci = w.filter((e) => /\.seed\.ts$/.test(e)), Ei = Ci.length > 0 ? await ie(Ci, yi) : [];
 	if (Ei.length > 0) {
-		xi.info("discovered seeds", { ids: Ei.map((e) => e.definition.id) });
+		yi.info("discovered seeds", { ids: Ei.map((e) => e.definition.id) });
 		for (let e of Ei) ct.registerSeed(e);
-		let e = await ae(Ei, B, xi);
+		let e = await ae(Ei, B, yi);
 		for (let t of e) ct.recordSeedResult(t);
 		let t = e.filter((e) => e.status === "failed");
-		t.length > 0 && xi.warn("one or more seeds failed (server continues)", { failedIds: t.map((e) => e.seedId) });
+		t.length > 0 && yi.warn("one or more seeds failed (server continues)", { failedIds: t.map((e) => e.seedId) });
 	}
-	let Di = $.child("startup"), ki = w.filter((e) => Re.test(e)), Ai = ki.length > 0 ? await st(ki, Di) : [], ji;
-	Ai.length > 0 && (Di.info("discovered startups", { ids: Ai.map((e) => e.id) }), ji = await ot(Ai, B, Di)), ji && V(() => ji.shutdown());
-	let Mi = $.child("subscribe"), Ni = w.filter((e) => ke.test(e)), Ii = Ni.length > 0 ? await Ts(Ni, Mi) : [], zi;
-	Ii.length > 0 && (Mi.info("discovered subscribers", { subscribers: Ii.map((e) => `${e.id}@${e.definition.table}`) }), zi = Es(Ii, B, Mi, _i)), zi && V(() => {
-		zi();
-	}), mn(), Sr((e) => xn(B, e.subjectId, e.resourceType, e.resourceId));
-	let Bi = $.child("outbox"), Vi = w.filter((e) => Pe.test(e)), Hi = Vi.length > 0 ? await Os(Vi, Bi) : [], ea = Hi.length > 0 ? ks({
-		handlers: Hi,
+	let Oi = $.child("startup"), ki = w.filter((e) => Re.test(e)), ji = ki.length > 0 ? await st(ki, Oi) : [], Mi;
+	ji.length > 0 && (Oi.info("discovered startups", { ids: ji.map((e) => e.id) }), Mi = await ot(ji, B, Oi)), Mi && V(() => Mi.shutdown());
+	let Ni = $.child("subscribe"), Pi = w.filter((e) => ke.test(e)), Fi = Pi.length > 0 ? await Ds(Pi, Ni) : [], Ri;
+	Fi.length > 0 && (Ni.info("discovered subscribers", { subscribers: Fi.map((e) => `${e.id}@${e.definition.table}`) }), Ri = Os(Fi, B, Ni, vi)), Ri && V(() => {
+		Ri();
+	}), mn(), Cr((e) => xn(B, e.subjectId, e.resourceType, e.resourceId));
+	let Vi = $.child("outbox"), Hi = w.filter((e) => Pe.test(e)), Ui = Hi.length > 0 ? await As(Hi, Vi) : [], Wi = Ui.length > 0 ? js({
+		handlers: Ui,
 		store: B,
-		log: Bi
+		log: Vi
 	}) : void 0;
-	ea && V(() => {
-		ea.stop();
+	Wi && V(() => {
+		Wi.stop();
 	});
-	let ta = Ws(), na = Tu(I);
-	if (yn.length > 0 && na !== "memory") try {
-		ta = Ys((await b(na)).makeSqlLayer(yu()));
+	let na = Ks(), ra = Ou(I);
+	if (yn.length > 0 && ra !== "memory") try {
+		na = Zs((await b(ra)).makeSqlLayer(xu()));
 	} catch (e) {
 		hn.warn("aggregate: SQL storage init failed — falling back to in-process", { err: e });
 	}
-	let ra = na === "memory" ? Cr : wn(B, `aggregate@${process.pid}`, hn), ia = yn.length > 0 ? await lc({
+	let ia = ra === "memory" ? Tr : wn(B, `aggregate@${process.pid}`, hn), aa = yn.length > 0 ? await dc({
 		discovered: yn,
 		store: B,
-		analytics: ti,
-		storage: ta,
-		coordinator: ra,
+		analytics: ni,
+		storage: na,
+		coordinator: ia,
 		log: hn
 	}) : {
-		registry: uc,
+		registry: fc,
 		detach: () => {},
 		registered: []
 	};
-	ia.registered.length > 0 && hn.info("aggregates registered", {
-		names: ia.registered,
-		storage: na === "memory" ? "in-process" : "sql-backed",
-		coordination: ra.kind
+	aa.registered.length > 0 && hn.info("aggregates registered", {
+		names: aa.registered,
+		storage: ra === "memory" ? "in-process" : "sql-backed",
+		coordination: ia.kind
 	}), V(() => {
-		ia.detach();
+		aa.detach();
 	});
-	let U = Tu(I), ma, ha = I?.scheduling ?? {}, ga = ha.trigger ?? "self", ba = ha.coordination ?? ([
+	let U = Ou(I), ha, ga = I?.scheduling ?? {}, _a = ga.trigger ?? "self", va = ga.coordination ?? ([
 		"postgres",
 		"mariadb",
 		"mysql",
 		"mssql"
-	].includes(U) ? "advisoryLock" : "single"), xa = ba === "cluster" && (/* @__PURE__ */ new Set([
+	].includes(U) ? "advisoryLock" : "single"), Sa = va === "cluster" && (/* @__PURE__ */ new Set([
 		"postgres",
 		"mysql",
 		"mariadb",
 		"mssql"
-	])).has(U), Sa = xa ? ft.filter((e) => (e.trigger ?? ga) === "self").map((e) => Jr({
+	])).has(U), Ca = Sa ? ft.filter((e) => (e.trigger ?? _a) === "self").map((e) => Xr({
 		name: e.name,
 		cron: en(e),
 		execute: async () => {
-			await ma?.fireFromCluster(e.name);
+			await ha?.fireFromCluster(e.name);
 		}
-	})) : [], Ca = await (async () => {
-		if (U === "memory") return Lr.layerMemory;
-		let e = await b(U), t = e.makeSqlLayer(yu()), n = Zr({ sqliteFamily: li(e.id) });
-		if ($.info(`workflow engine: cluster-${n}, dialect=${e.id}` + (n === "memory" ? " — single-process durable replay, no horizontal scaling" + (li(e.id) ? "" : " (VOLTRO_WORKFLOW_RUNNER_STORAGE=memory: SqlRunnerStorage/cluster_runners + GET_LOCK skipped)") : "")), e.id === "mssql") {
-			let e = await xs(process.cwd());
+	})) : [], wa = await (async () => {
+		if (U === "memory") return zr.layerMemory;
+		let e = await b(U), t = e.makeSqlLayer(xu()), n = $r({ sqliteFamily: di(e.id) });
+		if ($.info(`workflow engine: cluster-${n}, dialect=${e.id}` + (n === "memory" ? " — single-process durable replay, no horizontal scaling" + (di(e.id) ? "" : " (VOLTRO_WORKFLOW_RUNNER_STORAGE=memory: SqlRunnerStorage/cluster_runners + GET_LOCK skipped)") : "")), e.id === "mssql") {
+			let e = await Cs(process.cwd());
 			e && $.warn(e);
 		}
-		return Qr({
+		return ei({
 			sqlClientLayer: t,
 			runnerStorage: n,
 			dialectId: e.id,
 			...process.env.VOLTRO_WORKFLOW_RUNNER_PORT ? { runnerListenPort: Number(process.env.VOLTRO_WORKFLOW_RUNNER_PORT) } : {},
-			...Sa.length > 0 ? { extraShardingLayers: Sa } : {}
+			...Ca.length > 0 ? { extraShardingLayers: Ca } : {}
 		});
 	})();
 	$.info("workflow engine selected", { engine: U === "postgres" ? "cluster-postgres" : "in-memory" });
-	let wa, ka = /* @__PURE__ */ new Map(), ja = () => `wfctx_${globalThis.crypto?.randomUUID?.() ?? `${Date.now().toString(36)}${Math.random().toString(36).slice(2)}`}`, Na = async (e, t, n) => {
+	let Ta, Ea = /* @__PURE__ */ new Map(), ja = () => `wfctx_${globalThis.crypto?.randomUUID?.() ?? `${Date.now().toString(36)}${Math.random().toString(36).slice(2)}`}`, Na = async (e, t, n) => {
 		let r = {
 			...n,
 			source: n.source ?? `workflow:${e}`
 		};
-		ka.set(t, r);
+		Ea.set(t, r);
 		try {
 			let n = await B.query({
 				table: "_voltro_workflow_start_contexts",
@@ -4408,8 +4422,8 @@ ${a.join("\n\n")}\n`);
 				reason: n?.message ?? String(n)
 			});
 		}
-	}, Pa = async (e, t) => {
-		let n = ka.get(t);
+	}, Fa = async (e, t) => {
+		let n = Ea.get(t);
 		if (n !== void 0) return n;
 		try {
 			let e = (await B.query({
@@ -4434,7 +4448,7 @@ ${a.join("\n\n")}\n`);
 				...e.parentExecutionId === null ? {} : { parentExecutionId: e.parentExecutionId },
 				...e.parentClosePolicy === null ? {} : { parentClosePolicy: e.parentClosePolicy }
 			};
-			return ka.set(t, r), r;
+			return Ea.set(t, r), r;
 		} catch (e) {
 			$.warn("workflow.startContext.resolve failed", {
 				executionId: t,
@@ -4442,26 +4456,26 @@ ${a.join("\n\n")}\n`);
 			});
 			return;
 		}
-	}, W = N.length > 0 ? zn(() => wa) : void 0, Ia = $.child("webhooks"), za = w.filter((e) => De.test(e)), G = za.length > 0 ? await Dc(za, Ia) : {
+	}, W = N.length > 0 ? zn(() => Ta) : void 0, La = $.child("webhooks"), Ra = w.filter((e) => De.test(e)), G = Ra.length > 0 ? await kc(Ra, La) : {
 		outgoing: [],
 		incoming: [],
 		providers: []
 	};
-	G.outgoing.length + G.incoming.length + G.providers.length > 0 && Ia.info("discovered webhooks", {
+	G.outgoing.length + G.incoming.length + G.providers.length > 0 && La.info("discovered webhooks", {
 		outgoing: G.outgoing.map((e) => e.descriptor.id),
 		incoming: G.incoming.map((e) => e.descriptor.id),
 		providers: G.providers.map((e) => e.descriptor.id)
 	});
-	let Ba = w.filter((e) => Oc.test(e));
-	if (Ba.length > 0) {
-		let e = $.child("mail"), t = await kc(Ba, e);
-		t.templates.length > 0 && (Ma(t.templates.map((e) => e.template)), e.info("discovered email templates", { templates: t.templates.map((e) => e.template.name) }));
+	let Va = w.filter((e) => Ac.test(e));
+	if (Va.length > 0) {
+		let e = $.child("mail"), t = await jc(Va, e);
+		t.templates.length > 0 && (Pa(t.templates.map((e) => e.template)), e.info("discovered email templates", { templates: t.templates.map((e) => e.template.name) }));
 	}
-	let Va = /* @__PURE__ */ new Map();
+	let Ha = /* @__PURE__ */ new Map();
 	for (let e of G.incoming) {
-		let t = e.descriptor.path ?? Da(e.descriptor.id), n = `VOLTRO_WEBHOOK_SECRET_${e.descriptor.id.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`, r = Aa(e.descriptor, {
+		let t = e.descriptor.path ?? ka(e.descriptor.id), n = `VOLTRO_WEBHOOK_SECRET_${e.descriptor.id.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`, r = Ma(e.descriptor, {
 			resolveSecret: async () => process.env[n] ?? null,
-			resolveWorkflows: () => W === void 0 ? void 0 : $n(W, {
+			resolveWorkflows: () => W === void 0 ? void 0 : er(W, {
 				traceId: `incoming:${e.descriptor.id}`,
 				source: `incoming:${e.descriptor.id}`
 			}),
@@ -4473,36 +4487,36 @@ ${a.join("\n\n")}\n`);
 					idempotency: e.idempotency,
 					durationMs: e.durationMs
 				};
-				e.status >= 500 ? Ia.error("incoming delivery failed", t) : e.status >= 400 ? Ia.warn("incoming delivery rejected", t) : Ia.info("incoming delivery handled", t);
+				e.status >= 500 ? La.error("incoming delivery failed", t) : e.status >= 400 ? La.warn("incoming delivery rejected", t) : La.info("incoming delivery handled", t);
 			}
 		});
-		Va.set(t, r), Ia.info("mounted incoming webhook", {
+		Ha.set(t, r), La.info("mounted incoming webhook", {
 			id: e.descriptor.id,
 			path: t,
 			secretEnvKey: n
 		});
 	}
-	let Ha = $.child("reaction"), Wa = w.filter((e) => Fe.test(e)), Ga = Wa.length > 0 ? await zs(Wa, Ha) : [], Ka;
-	Ga.length > 0 && (Ha.info("discovered reactions", { reactions: Ga.map((e) => `${e.definition.name}@${e.definition.watch.table}`) }), Ka = Vs(Ga, B, {
+	let Ua = $.child("reaction"), Wa = w.filter((e) => Fe.test(e)), Ka = Wa.length > 0 ? await Vs(Wa, Ua) : [], qa;
+	Ka.length > 0 && (Ua.info("discovered reactions", { reactions: Ka.map((e) => `${e.definition.name}@${e.definition.watch.table}`) }), qa = Us(Ka, B, {
 		runAct: async (e, t) => {
 			if (e.kind === "workflow") {
 				if (W === void 0) {
-					Ha.warn("reaction workflow act skipped — no workflow engine in this app", { workflow: e.workflow });
+					Ua.warn("reaction workflow act skipped — no workflow engine in this app", { workflow: e.workflow });
 					return;
 				}
 				let n = t.new ?? t.old ?? {};
-				await $n(W, {
+				await er(W, {
 					traceId: `reaction:${e.workflow}`,
 					source: `reaction:${e.workflow}`
 				}).start(e.workflow, n);
 				return;
 			}
-			await Bs(e.agent, t, {
+			await Hs(e.agent, t, {
 				findAgentSend: (e) => k.find((t) => t.descriptor.name === `${e}.send`),
-				runAction: (e, t, n) => Promise.resolve(qo(e, t, n)),
-				makeSubject: (e) => Ti(e),
+				runAction: (e, t, n) => Promise.resolve(Yo(e, t, n)),
+				makeSubject: (e) => Di(e),
 				now: () => Date.now(),
-				log: Ha
+				log: Ua
 			});
 		},
 		checkBudget: async (e, t) => {
@@ -4513,24 +4527,24 @@ ${a.join("\n\n")}\n`);
 					limitUsd: t
 				}))))._tag === "Right";
 			} catch (t) {
-				return Ha.warn("reaction budget check failed — refusing the act", { tenantId: e }, t), !1;
+				return Ua.warn("reaction budget check failed — refusing the act", { tenantId: e }, t), !1;
 			}
 		}
-	}, Ha)), Ka && V(() => {
-		Ka();
+	}, Ua)), qa && V(() => {
+		qa();
 	});
-	let qa = 0, K = new It({
+	let Ja = 0, K = new It({
 		store: B,
 		cache: wr,
 		recordDelivery: (e) => {
-			or({
+			sr({
 				label: e.label,
 				kind: e.kind,
 				durationMs: e.durationMs,
 				rowCount: e.rowCount
-			}), Yn({
+			}), Xn({
 				traceId: e.traceId,
-				spanId: (qa++).toString(16).padStart(16, "0"),
+				spanId: (Ja++).toString(16).padStart(16, "0"),
 				parentSpanId: e.parentSpanId ?? null,
 				name: `${e.label}.${e.kind}`,
 				kind: "internal",
@@ -4544,10 +4558,10 @@ ${a.join("\n\n")}\n`);
 				status: "ok"
 			});
 		}
-	}), Ya = () => {
+	}), Xa = () => {
 		let e = K.subscriptionSnapshot(), t = K.matcherStats(), n = e.map((e) => {
 			let t = [];
-			for (let n of vi(e.predicate)) n.conjunctive && t.push(n.column);
+			for (let n of bi(e.predicate)) n.conjunctive && t.push(n.column);
 			return {
 				fingerprint: e.fingerprint,
 				table: e.table,
@@ -4563,21 +4577,21 @@ ${a.join("\n\n")}\n`);
 			capturedAt: Date.now()
 		});
 	};
-	K.onSubscriptionsChange(Ya), Ya();
-	let Qa = $.child("store"), $a = (I?.plugins ?? []).filter((e) => typeof e.onChangeEvent == "function"), eo = B.changeScope ?? "local";
+	K.onSubscriptionsChange(Xa), Xa();
+	let Za = $.child("store"), eo = (I?.plugins ?? []).filter((e) => typeof e.onChangeEvent == "function"), to = B.changeScope ?? "local";
 	B.onChange((e) => {
-		if (Qa.debug(`${e.op} on ${e.table}`, {
+		if (Za.debug(`${e.op} on ${e.table}`, {
 			op: e.op,
 			table: e.table
-		}), sr({
+		}), cr({
 			table: e.table,
 			op: e.op,
 			old: e.old ?? null,
 			new: e.new ?? null
-		}), P.runFork(yr.publish(e.table)), $a.length > 0) {
-			let t = Ls(e, eo);
-			for (let n of $a) {
-				let r = Qa.child(`plugin:${n.name}`);
+		}), P.runFork(br.publish(e.table)), eo.length > 0) {
+			let t = zs(e, to);
+			for (let n of eo) {
+				let r = Za.child(`plugin:${n.name}`);
 				P.runFork(n.onChangeEvent(t).pipe(P.catchAllCause((t) => P.sync(() => r.warn("onChangeEvent failed", {
 					table: e.table,
 					op: e.op
@@ -4585,95 +4599,95 @@ ${a.join("\n\n")}\n`);
 			}
 		}
 	});
-	let lo = N.map((e) => Pr.make(e.definition.name, {
+	let no = N.map((e) => Ir.make(e.definition.name, {
 		payload: e.definition.payloadSchema,
-		success: Si,
+		success: wi,
 		error: e.definition.errorSchema
 	})), fo = xt ? [
-		Li(Ji),
-		Li(Xi),
-		Li(Yi),
-		Li(qi),
-		Li(Wi),
-		Li(Gi),
-		Ci(Ui),
-		Ci(Ki),
-		Ci(Zi),
-		Ci(Qi)
-	] : [], po = (I?.plugins ?? []).flatMap((e) => (e.errorSchemas ?? []).map((e) => e.schema)), mo = po.length > 0 ? po : void 0, ho = (e) => e.filter((e) => Pi(e.descriptor)), go = ho(T), _o = ho(D), vo = ho(k), q = ho(M), yo = [
-		...go.map((e) => Li(e.descriptor, mo)),
-		..._o.map((e) => Fi(e.descriptor, mo)),
-		...vo.map((e) => Ci(e.descriptor, mo)),
-		...q.map((e) => Ri(e.descriptor, mo)),
-		...lo,
+		zi(Xi),
+		zi(Qi),
+		zi(Zi),
+		zi(Yi),
+		zi(Ki),
+		zi(qi),
+		Ti(Gi),
+		Ti(Ji),
+		Ti($i),
+		Ti(ea)
+	] : [], mo = (I?.plugins ?? []).flatMap((e) => (e.errorSchemas ?? []).map((e) => e.schema)), ho = mo.length > 0 ? mo : void 0, go = (e) => e.filter((e) => Ii(e.descriptor)), _o = go(T), vo = go(D), yo = go(k), bo = go(M), q = [
+		..._o.map((e) => zi(e.descriptor, ho)),
+		...vo.map((e) => Li(e.descriptor, ho)),
+		...yo.map((e) => Ti(e.descriptor, ho)),
+		...bo.map((e) => Bi(e.descriptor, ho)),
+		...no,
 		...fo
-	], bo = Fr.make(...yo).middleware(yi).middleware(bi), xo = I?.layers ?? [], So = (I?.plugins ?? []).map((e) => e.services).filter((e) => e !== void 0), Co = F.succeed(Mt, ia.registry), wo = F.mergeAll(co({
-		analyticsLayer: ei.layer,
-		cacheService: vr,
-		kvService: Nr,
-		pluginServices: So,
-		userLayers: xo
-	}), Co);
-	(xo.length > 0 || So.length > 0) && $.info("layers loaded", {
-		userLayers: xo.length,
-		pluginLayers: So.length
+	], xo = Lr.make(...q).middleware(xi).middleware(Si), So = I?.layers ?? [], Co = (I?.plugins ?? []).map((e) => e.services).filter((e) => e !== void 0), wo = F.succeed(Mt, aa.registry), To = F.mergeAll(uo({
+		analyticsLayer: ti.layer,
+		cacheService: yr,
+		kvService: Pr,
+		pluginServices: Co,
+		userLayers: So
+	}), wo);
+	(So.length > 0 || Co.length > 0) && $.info("layers loaded", {
+		userLayers: So.length,
+		pluginLayers: Co.length
 	});
-	let To = (e, t) => hr(e.pipe(P.provide(Ln(t)), P.provide(wo), P.provide(wt)));
+	let Eo = (e, t) => gr(e.pipe(P.provide(Ln(t)), P.provide(To), P.provide(wt)));
 	if ((process.env.VOLTRO_INDEX_AUDIT ?? "on") !== "off") {
-		let e = ii(z), t = process.stdout.isTTY === !0 && (process.env.NO_COLOR ?? "") === "";
-		for (let n of e) $.warn("\n" + si(n, {
+		let e = oi(z), t = process.stdout.isTTY === !0 && (process.env.NO_COLOR ?? "") === "";
+		for (let n of e) $.warn("\n" + li(n, {
 			color: t,
 			indent: "  "
 		}));
 	}
 	let J;
 	if (G.outgoing.length > 0) {
-		let e = io({
+		let e = oo({
 			store: B,
-			schemaRegistry: _i,
-			cache: Dr,
+			schemaRegistry: vi,
+			cache: Er,
 			kv: Mr
 		}), t = G.outgoing.map((e) => e.descriptor);
-		J = Ea(e, async (n) => {
-			let r = Oa.execute(n).pipe(P.provide(Oa.toLayer(Ta(e, { events: t })).pipe(F.provideMerge(Ca))));
+		J = Oa(e, async (n) => {
+			let r = Aa.execute(n).pipe(P.provide(Aa.toLayer(Da(e, { events: t })).pipe(F.provideMerge(wa))));
 			P.runPromise(r).catch((e) => {
-				Ia.error("deliverWebhook workflow crashed", {
+				La.error("deliverWebhook workflow crashed", {
 					deliveryId: n.deliveryId,
 					targetId: n.targetId
 				}, e);
 			});
 		}, { events: t });
 	}
-	let Eo = (process.env.VOLTRO_TENANT_ISOLATION ?? I?.tenancy?.isolation) === "namespace";
-	Eo && $.info("multi-tenancy: PHYSICAL namespace isolation ON — each request runs against its tenant's own namespace (schema/database/attached file). Requests without a resolvable tenant fail closed.");
-	let Do = ao({
+	let Do = (process.env.VOLTRO_TENANT_ISOLATION ?? I?.tenancy?.isolation) === "namespace";
+	Do && $.info("multi-tenancy: PHYSICAL namespace isolation ON — each request runs against its tenant's own namespace (schema/database/attached file). Requests without a resolvable tenant fail closed.");
+	let Oo = so({
 		store: B,
-		schemaRegistry: _i,
-		cache: Dr,
+		schemaRegistry: vi,
+		cache: Er,
 		kv: Mr,
 		...J === void 0 ? {} : { webhooksService: J },
 		...W === void 0 ? {} : { workflowsProxy: W },
 		eventTriggers: ut,
-		namespaceIsolationOn: Eo,
+		namespaceIsolationOn: Do,
 		onEventEmit: (e, t) => C.emit(e, t),
-		...ea === void 0 ? {} : { outbox: { nudge: ea.nudge } },
-		...rr.active ? { connections: { registry: rr.registry } } : {}
-	}), Oo = async () => {
+		...Wi === void 0 ? {} : { outbox: { nudge: Wi.nudge } },
+		...ir.active ? { connections: { registry: ir.registry } } : {}
+	}), ko = async () => {
 		if (ft.length === 0) return;
 		let e = process.env.HOSTNAME ?? `pid-${process.pid}`, t;
-		xa ? t = Cr : ba === "cluster" ? ($.warn("scheduling.coordination=cluster needs store=postgres — falling back to single (dev/memory)"), t = Cr) : ba === "advisoryLock" ? U === "memory" ? ($.warn("scheduling.coordination=advisoryLock needs a SQL store (the claim-row gate) — falling back to single (memory)"), t = Cr) : t = wn(B, e, {
+		Sa ? t = Tr : va === "cluster" ? ($.warn("scheduling.coordination=cluster needs store=postgres — falling back to single (dev/memory)"), t = Tr) : va === "advisoryLock" ? U === "memory" ? ($.warn("scheduling.coordination=advisoryLock needs a SQL store (the claim-row gate) — falling back to single (memory)"), t = Tr) : t = wn(B, e, {
 			info: (e, t) => $.info(e, t ?? {}),
 			warn: (e, t) => $.warn(e, t ?? {})
-		}) : t = Cr;
-		let n = nl(I?.plugins ?? [], X);
-		ma = await Er(ft, {
+		}) : t = Tr;
+		let n = il(I?.plugins ?? [], Bo);
+		ha = await Or(ft, {
 			store: B,
 			coordinator: t,
-			defaultTrigger: ga,
+			defaultTrigger: _a,
 			replicaId: e,
-			armSelf: !xa,
+			armSelf: !Sa,
 			dormancy: I?.dormancy ?? "always-on",
-			buildContext: ({ traceId: e, scheduleName: t, subject: n }) => Do({
+			buildContext: ({ traceId: e, scheduleName: t, subject: n }) => Oo({
 				subject: n,
 				traceId: e
 			}, B, void 0, `schedule:${t}`),
@@ -4690,43 +4704,43 @@ ${a.join("\n\n")}\n`);
 			...n === void 0 ? {} : { interceptFire: n }
 		}), $.info("scheduler ready", {
 			schedules: ft.length,
-			coordination: xa ? "cluster" : t.kind,
-			clusterCrons: Sa.length
-		}), V(() => ma?.shutdown());
-	}, Y = {}, ko = /* @__PURE__ */ new Set(), Ao = (e, t) => {
-		gn(e, _t, t) && (ko.has(e.table) || (ko.add(e.table), $.warn("tenant-scoped read with an EMPTY tenant — every row is filtered out", {
+			coordination: Sa ? "cluster" : t.kind,
+			clusterCrons: Ca.length
+		}), V(() => ha?.shutdown());
+	}, Y = {}, Ao = /* @__PURE__ */ new Set(), jo = (e, t) => {
+		gn(e, _t, t) && (Ao.has(e.table) || (Ao.add(e.table), $.warn("tenant-scoped read with an EMPTY tenant — every row is filtered out", {
 			table: e.table,
 			tenantId: "",
 			cause: "the subject authenticated but has no resolved org (tenantId=''), so the auto-merged `eq('tenantId', '')` matches no real row — this is NOT 'no such row'",
 			fix: "resolve the subject to an active org before the read, or mark the query `.unscoped()` if it is deliberately cross-tenant"
 		})));
-	}, jo = !1, Mo = (e) => {
-		jo || !_n(e) || (jo = !0, $.warn("authenticated subject has NO active org (tenantId='') — every tenant-scoped read will be empty", {
+	}, Mo = !1, No = (e) => {
+		Mo || !_n(e) || (Mo = !0, $.warn("authenticated subject has NO active org (tenantId='') — every tenant-scoped read will be empty", {
 			subjectType: "user",
 			cause: "the session resolved a user but no organization/tenant; the empty-string sentinel fails closed",
 			fix: "resolve the user to an active org during auth, or route org-less users to an onboarding flow"
 		}));
-	}, No = (e, t) => (Mo(t.subject), Ao(e, t.subject.tenantId), Ht(Ut(e, _t, t.subject.tenantId), vt)), Po = /* @__PURE__ */ new Set(), Fo = (e) => {
+	}, Po = (e, t) => (No(t.subject), jo(e, t.subject.tenantId), Ht(Ut(e, _t, t.subject.tenantId), vt)), Fo = /* @__PURE__ */ new Set(), Io = (e) => {
 		if (e.usingIndex !== void 0 || e.predicate === void 0) return;
 		let t = /* @__PURE__ */ new Set();
-		for (let n of vi(e.predicate)) n.conjunctive && t.add(n.column);
-		if (t.size === 0 || _i.anyFieldIndexed(e.table, t)) return;
+		for (let n of bi(e.predicate)) n.conjunctive && t.add(n.column);
+		if (t.size === 0 || vi.anyFieldIndexed(e.table, t)) return;
 		let n = `${e.table}::${[...t].sort().join(",")}`;
-		Po.has(n) || (Po.add(n), $.warn("non-indexed predicate — slow at scale", {
+		Fo.has(n) || (Fo.add(n), $.warn("non-indexed predicate — slow at scale", {
 			table: e.table,
 			fields: [...t],
 			hint: "declare `.index()` on a column, add `.index(name, [...fields])` to the table, or annotate the query with `.using('indexName')` if a covering index exists"
 		}));
-	}, Io = (e) => {
+	}, Lo = (e) => {
 		if (e.usingIndex === void 0) return;
-		let t = _i.tables.get(e.table);
+		let t = vi.tables.get(e.table);
 		if (!t) return;
 		let n = t.compositeIndexes.find((t) => t.name === e.usingIndex);
 		if (n) return {
 			name: n.name,
 			fields: n.fields
 		};
-	}, Lo = (e) => JSON.stringify(e, (e, t) => typeof t == "object" && t && !Array.isArray(t) ? Object.fromEntries(Object.entries(t).sort(([e], [t]) => e.localeCompare(t))) : t), Ro = (e, t) => {
+	}, Ro = (e) => JSON.stringify(e, (e, t) => typeof t == "object" && t && !Array.isArray(t) ? Object.fromEntries(Object.entries(t).sort(([e], [t]) => e.localeCompare(t))) : t), zo = (e, t) => {
 		let n = e.cache;
 		if (n === void 0) return;
 		let r = g(n.ttl);
@@ -4734,54 +4748,58 @@ ${a.join("\n\n")}\n`);
 			ttlMs: r,
 			swrMs: n.swr === void 0 ? void 0 : g(n.swr) ?? void 0,
 			scope: n.scope,
-			baseKey: `q:${e.name}:${Lo(t)}`
+			baseKey: `q:${e.name}:${Ro(t)}`
 		};
-	}, X = te(), zo = I?.plugins ?? [], Bo = Oi(Yc(zo, "mutation", X)), Wo = Oi(Yc(zo, "action", X)), Go = Oi(Yc(zo, "query", X)), Ko = Vn({
+	}, Bo = te(), Vo = I?.plugins ?? [], Ho = Ai(Zc(Vo, "mutation", Bo)), Uo = Ai(Zc(Vo, "action", Bo)), qo = Ai(Zc(Vo, "query", Bo)), Jo = Hn({
 		store: B,
-		buildContext: (e, t, n) => Do(e, t, n),
-		runEffect: (e, t) => To(e, t),
-		...Bo ? { interceptor: Bo } : {},
-		recordMetric: (e) => X.record(e),
-		undoCapture: Pc()
-	}), qo = Cn({
-		buildContext: (e) => Do(e),
-		runEffect: (e, t) => To(e, t),
-		...Wo ? { interceptor: Wo } : {},
-		recordMetric: (e) => X.record(e)
-	}), Jo = {
-		buildContext: (e) => Do(e),
+		buildContext: (e, t, n) => Oo(e, t, n),
+		runEffect: (e, t) => Eo(e, t),
+		...Ho ? { interceptor: Ho } : {},
+		recordMetric: (e) => Bo.record(e),
+		undoCapture: Ic()
+	}), Yo = Cn({
+		buildContext: (e) => Oo(e),
+		runEffect: (e, t) => Eo(e, t),
+		...Uo ? { interceptor: Uo } : {},
+		recordMetric: (e) => Bo.record(e)
+	}), Xo = {
+		buildContext: (e) => Oo(e),
 		finalize: (e, t) => {
-			let n = No(e, t);
-			return Fo(n), n;
+			let n = Po(e, t);
+			return Io(n), n;
 		},
-		provideEffect: (e, t) => e.pipe(P.provide(Ln(t)), P.provide(wo), P.provide(wt)),
-		...Go ? { interceptor: Go } : {}
-	}, Yo = Gn(Jo), Xo = Hn({
-		...Jo,
+		provideEffect: (e, t) => e.pipe(P.provide(Ln(t)), P.provide(To), P.provide(wt)),
+		...qo ? { interceptor: qo } : {}
+	}, Zo = Kn(Xo), Qo = Un({
+		...Xo,
 		queryRows: (e) => B.query(e)
-	}), Zo = qn({
-		...Jo,
+	}), $o = Jn({
+		...Xo,
 		subscribeDescriptor: (e, t, n) => K.subscribe(e, t, n),
 		subscribeComputed: (e, t, n) => K.subscribeComputed(e, t, n)
 	});
-	for (let e of go) Y[e.descriptor.name] = (t) => Xt(Yo(e, t), K, `subscription.${e.descriptor.name}`, Io, Ro(e.descriptor, t), Kn(e, t));
-	for (let e of _o) {
-		let t = `mutation.${e.descriptor.name}`;
-		Y[e.descriptor.name] = (n) => Jt(async (t, n) => Ko(e, t, n), n, t);
-	}
+	for (let e of _o) Y[e.descriptor.name] = (t) => Xt(Zo(e, t), K, `subscription.${e.descriptor.name}`, Lo, zo(e.descriptor, t), qn(e, t));
+	let es = I?.idempotency, ts = es ? {
+		store: rn(B),
+		ttlMs: (typeof es == "object" ? es.ttlMs : void 0) ?? 864e5
+	} : void 0;
 	for (let e of vo) {
-		let t = `action.${e.descriptor.name}`;
-		Y[e.descriptor.name] = (n) => Jt(async (t, n) => qo(e, t, n), n, t);
+		let t = `mutation.${e.descriptor.name}`, n = Vn(e.descriptor.output);
+		Y[e.descriptor.name] = (r) => Jt(async (t, n) => Jo(e, t, n), r, t, n, ts);
+	}
+	for (let e of yo) {
+		let t = `action.${e.descriptor.name}`, n = Vn(e.descriptor.output);
+		Y[e.descriptor.name] = (r) => Jt(async (t, n) => Yo(e, t, n), r, t, n, ts);
 	}
-	for (let e of q) {
+	for (let e of bo) {
 		let t = `stream.${e.descriptor.name}`;
 		Y[e.descriptor.name] = (n) => Yt((t) => {
-			let r = Do(t), i = e.executor(n, r);
-			return P.isEffect(i) ? i.pipe(P.provide(Ln(r.store)), P.provide(wo), P.provide(wt)) : typeof i == "object" && i && typeof i.then == "function" ? P.promise(() => i) : i;
+			let r = Oo(t), i = e.executor(n, r);
+			return P.isEffect(i) ? i.pipe(P.provide(Ln(r.store)), P.provide(To), P.provide(wt)) : typeof i == "object" && i && typeof i.then == "function" ? P.promise(() => i) : i;
 		}, t);
 	}
-	xt && (Y[Ji.name] = (e) => Xt(Yo({
-		descriptor: Ji,
+	xt && (Y[Xi.name] = (e) => Xt(Zo({
+		descriptor: Xi,
 		executor: (e) => {
 			let t = e.id;
 			return {
@@ -4790,14 +4808,14 @@ ${a.join("\n\n")}\n`);
 					column: "startedAt",
 					direction: "desc"
 				}],
-				predicate: di(H("id", t), H("executionId", t)),
+				predicate: pi(H("id", t), H("executionId", t)),
 				take: 1,
 				skip: void 0,
 				projection: void 0
 			};
 		}
-	}, e), K, `subscription.${Ji.name}`), Y[Xi.name] = (e) => Xt(Yo({
-		descriptor: Xi,
+	}, e), K, `subscription.${Xi.name}`), Y[Qi.name] = (e) => Xt(Zo({
+		descriptor: Qi,
 		executor: (e) => {
 			let t = e, n = [...t.tag === void 0 ? [] : [H("tag", t.tag)], ...t.status === void 0 ? [] : [H("status", t.status)]], r = Number.isFinite(t.limit) && t.limit !== void 0 ? Math.min(Math.max(Math.floor(t.limit), 1), 500) : 100;
 			return {
@@ -4806,14 +4824,14 @@ ${a.join("\n\n")}\n`);
 					column: "startedAt",
 					direction: "desc"
 				}],
-				predicate: n.length === 0 ? void 0 : n.length === 1 ? n[0] : ri(...n),
+				predicate: n.length === 0 ? void 0 : n.length === 1 ? n[0] : ai(...n),
 				take: r,
 				skip: void 0,
 				projection: void 0
 			};
 		}
-	}, e), K, `subscription.${Xi.name}`), Y[Yi.name] = (e) => Xt(Yo({
-		descriptor: Yi,
+	}, e), K, `subscription.${Qi.name}`), Y[Zi.name] = (e) => Xt(Zo({
+		descriptor: Zi,
 		executor: (e) => {
 			let t = e.runId;
 			return {
@@ -4828,8 +4846,8 @@ ${a.join("\n\n")}\n`);
 				projection: void 0
 			};
 		}
-	}, e), K, `subscription.${Yi.name}`), Y[qi.name] = (e) => Xt(Yo({
-		descriptor: qi,
+	}, e), K, `subscription.${Zi.name}`), Y[Yi.name] = (e) => Xt(Zo({
+		descriptor: Yi,
 		executor: (e) => {
 			let t = e.runId;
 			return {
@@ -4844,8 +4862,8 @@ ${a.join("\n\n")}\n`);
 				projection: void 0
 			};
 		}
-	}, e), K, `subscription.${qi.name}`), Y[Wi.name] = (e) => Xt(Yo({
-		descriptor: Wi,
+	}, e), K, `subscription.${Yi.name}`), Y[Ki.name] = (e) => Xt(Zo({
+		descriptor: Ki,
 		executor: (e) => {
 			let t = e;
 			return {
@@ -4860,8 +4878,8 @@ ${a.join("\n\n")}\n`);
 				projection: void 0
 			};
 		}
-	}, e), K, `subscription.${Wi.name}`), Y[Gi.name] = (e) => Xt(Yo({
-		descriptor: Gi,
+	}, e), K, `subscription.${Ki.name}`), Y[qi.name] = (e) => Xt(Zo({
+		descriptor: qi,
 		executor: (e) => {
 			let t = e.eventId;
 			return {
@@ -4876,32 +4894,32 @@ ${a.join("\n\n")}\n`);
 				projection: void 0
 			};
 		}
-	}, e), K, `subscription.${Gi.name}`), Y[Ui.name] = (e) => Jt(async (e, t) => {
+	}, e), K, `subscription.${qi.name}`), Y[Gi.name] = (e) => Jt(async (e, t) => {
 		let n = e;
-		return await oo(B, t.subject, { executionId: n.executionId }), await W.cancel(n.workflowName, n.executionId), await is(n.workflowName, n.executionId, "workflow.cancel"), { ok: !0 };
-	}, e, `action.${Ui.name}`), Y[Ki.name] = (e) => Jt(async (e, t) => {
+		return await co(B, t.subject, { executionId: n.executionId }), await W.cancel(n.workflowName, n.executionId), await cs(n.workflowName, n.executionId, "workflow.cancel"), { ok: !0 };
+	}, e, `action.${Gi.name}`), Y[Ji.name] = (e) => Jt(async (e, t) => {
 		let n = e;
-		return await oo(B, t.subject, { executionId: n.executionId }), await W.resume(n.workflowName, n.executionId), { ok: !0 };
-	}, e, `action.${Ki.name}`), Y[Zi.name] = (e) => Jt(async (e, t) => {
+		return await co(B, t.subject, { executionId: n.executionId }), await W.resume(n.workflowName, n.executionId), { ok: !0 };
+	}, e, `action.${Ji.name}`), Y[$i.name] = (e) => Jt(async (e, t) => {
 		let n = e;
-		return await oo(B, t.subject, { id: n.id }), W.signal({ id: n.id }, n.signalName, n.payload);
-	}, e, `action.${Zi.name}`), Y[Qi.name] = (e) => Jt(async (e, t) => {
+		return await co(B, t.subject, { id: n.id }), W.signal({ id: n.id }, n.signalName, n.payload);
+	}, e, `action.${$i.name}`), Y[ea.name] = (e) => Jt(async (e, t) => {
 		let n = e;
-		return await oo(B, t.subject, { id: n.id }), W.update({ id: n.id }, n.updateName, n.payload, n.timeoutMs === void 0 ? void 0 : { timeoutMs: n.timeoutMs });
-	}, e, `action.${Qi.name}`));
+		return await co(B, t.subject, { id: n.id }), W.update({ id: n.id }, n.updateName, n.payload, n.timeoutMs === void 0 ? void 0 : { timeoutMs: n.timeoutMs });
+	}, e, `action.${ea.name}`));
 	for (let e of N) Y[e.definition.name] = (t) => Jt(async (t, n) => {
 		let r = n;
-		return $n(W, {
+		return er(W, {
 			subject: r.subject,
 			traceId: r.traceId,
 			source: "workflow-rpc"
 		}).start(e.definition.name, t);
 	}, t, `workflow.${e.definition.name}`);
-	let Qo = (e, t) => Do({
+	let ns = (e, t) => Oo({
 		subject: e.subject,
 		traceId: e.traceId
-	}, B, void 0, `workflow:${t.workflowName}`, { parentExecutionId: t.executionId }), $o = il(I?.plugins ?? [], X), es = Kr, ts = (e, t) => C.emit(e, t), ns = I?.dormancy === "sleep" ? {
-		register: (e, t, n) => dr(B, {
+	}, B, void 0, `workflow:${t.workflowName}`, { parentExecutionId: t.executionId }), rs = ol(I?.plugins ?? [], Bo), is = Jr, as = (e, t) => C.emit(e, t), X = I?.dormancy === "sleep" ? {
+		register: (e, t, n) => fr(B, {
 			tenantId: n ?? Ft,
 			kind: "workflow",
 			refId: e,
@@ -4912,23 +4930,23 @@ ${a.join("\n\n")}\n`);
 			kind: "workflow",
 			refId: e
 		}).then(() => {})
-	} : void 0, Z = Ur({
+	} : void 0, os = Gr({
 		store: B,
-		emit: ts,
+		emit: as,
 		log: $,
-		...ns === void 0 ? {} : { wakeups: ns }
-	}), rs = async (e, t) => {
-		await zr({
+		...X === void 0 ? {} : { wakeups: X }
+	}), ss = async (e, t) => {
+		await Vr({
 			store: B,
 			parentExecutionId: e,
 			parentStatus: t,
-			recorder: Z,
-			emit: ts,
+			recorder: os,
+			emit: as,
 			log: $,
 			interruptChild: async (t, n, r) => {
 				let i = N.find((e) => e.definition.name === t);
 				if (!i) throw Error(`Unknown child workflow: ${t}`);
-				await fs.runPromise(i.definition.interrupt(n)), $.info("workflow.parentClose.childInterrupted", {
+				await Z.runPromise(i.definition.interrupt(n)), $.info("workflow.parentClose.childInterrupted", {
 					parentExecutionId: e,
 					childWorkflowName: t,
 					childExecutionId: n,
@@ -4936,7 +4954,7 @@ ${a.join("\n\n")}\n`);
 				});
 			}
 		});
-	}, is = async (e, t, n) => {
+	}, cs = async (e, t, n) => {
 		let r = (await B.query({
 			table: "_voltro_workflow_runs",
 			order: [],
@@ -4953,10 +4971,10 @@ ${a.join("\n\n")}\n`);
 		});
 		i && C.emit("workflowRuns", {
 			op: "update",
-			row: es(i)
+			row: is(i)
 		});
 		let a = r.subject?.tenantId ?? void 0;
-		i && await Z.recordEvent({
+		i && await os.recordEvent({
 			runId: r.id,
 			eventType: "run-cancelled",
 			payload: {
@@ -4965,10 +4983,10 @@ ${a.join("\n\n")}\n`);
 				executionId: t,
 				...a == null ? {} : { tenantId: a }
 			}
-		}), i && await rs(t, "cancelled");
-	}, as = (e, t, n, r) => {
-		let i = Vr(t);
-		return qr({
+		}), i && await ss(t, "cancelled");
+	}, ls = (e, t, n, r) => {
+		let i = Ur(t);
+		return Yr({
 			name: e,
 			store: B,
 			subject: r.subject,
@@ -4979,79 +4997,79 @@ ${a.join("\n\n")}\n`);
 			workflowPatches: i.patches,
 			parentExecutionId: r?.parentExecutionId ?? null,
 			parentClosePolicy: r?.parentClosePolicy ?? null,
-			onParentClose: ({ executionId: e, status: t }) => rs(e, t),
-			recorder: Z,
-			pluginWorkflowStepLayer: $o,
-			emit: ts,
+			onParentClose: ({ executionId: e, status: t }) => ss(e, t),
+			recorder: os,
+			pluginWorkflowStepLayer: rs,
+			emit: as,
 			log: $
 		}, n);
-	}, os = [...er(N, {
-		buildContext: Qo,
-		resolveStartContext: Pa
-	}, (e, t, n) => as(e.definition.name, e.definition, t, n)), ...lt], ss = os.length > 0 ? F.mergeAll(...os) : F.empty, fs = gt.make(ss.pipe(F.provideMerge(Ca), F.provideMerge(wo), F.provideMerge(wt)));
-	V(() => fs.dispose()), wa = N.length > 0 ? Qn({
+	}, us = [...tr(N, {
+		buildContext: ns,
+		resolveStartContext: Fa
+	}, (e, t, n) => ls(e.definition.name, e.definition, t, n)), ...lt], hs = us.length > 0 ? F.mergeAll(...us) : F.empty, Z = gt.make(hs.pipe(F.provideMerge(wa), F.provideMerge(To), F.provideMerge(wt)));
+	V(() => Z.dispose()), Ta = N.length > 0 ? $n({
 		workflows: N,
-		runEffect: (e) => fs.runPromise(e),
+		runEffect: (e) => Z.runPromise(e),
 		rememberStartContext: Na,
 		signal: async (e, t, n) => {
-			let r = await Wr({
+			let r = await Kr({
 				store: B,
-				recorder: Z,
+				recorder: os,
 				target: e,
 				signalName: t,
 				payload: n
 			});
-			return await fs.runPromise(Br({
+			return await Z.runPromise(Hr({
 				store: B,
 				target: e,
 				signalName: t,
 				payload: n
 			})).catch(() => {}), r;
 		},
-		update: (e, t, n, r) => Gr({
+		update: (e, t, n, r) => qr({
 			store: B,
-			recorder: Z,
+			recorder: os,
 			target: e,
 			updateName: t,
 			payload: n,
 			...r === void 0 ? {} : { options: r }
 		}),
-		listRuns: (e) => cl(B, e),
-		retry: (e, t) => ll({
+		listRuns: (e) => ul(B, e),
+		retry: (e, t) => dl({
 			store: B,
 			workflows: N,
-			runPromise: (e) => fs.runPromise(e)
+			runPromise: (e) => Z.runPromise(e)
 		}, e, t)
 	}) : void 0;
-	let ps = F.mergeAll(bo.toLayer(Y), jt, ql), ms = uo(Y, T.map((e) => e.descriptor.name), xt), hs = F.mergeAll(bo.toLayer(ms), jt, ql), gs = U, _s = (gs === "postgres" || gs === "mysql" || gs === "mariadb" || gs === "mssql") && (process.env.CDC ?? "1") !== "0";
-	if (gs === "postgres" && pe()) {
+	let gs = F.mergeAll(xo.toLayer(Y), jt, Yl), _s = po(Y, T.map((e) => e.descriptor.name), xt), vs = F.mergeAll(xo.toLayer(_s), jt, Yl), ys = U, bs = (ys === "postgres" || ys === "mysql" || ys === "mariadb" || ys === "mssql") && (process.env.CDC ?? "1") !== "0";
+	if (ys === "postgres" && pe()) {
 		let e = ye({
 			store: B,
 			log: $
 		});
-		Un = e.persistTraceSpan, V(e.stop);
+		Wn = e.persistTraceSpan, V(e.stop);
 	}
-	let vs = ro({
+	let xs = ao({
 		store: B,
-		dialect: gs
+		dialect: ys
 	});
 	V(() => {
-		vs.stop();
+		xs.stop();
 	});
-	let ys = La({
+	let Ss = za({
 		queries: T,
 		mutations: D,
 		actions: k,
 		streams: M,
 		workflows: N
-	}, p), bs = Ra({
+	}, p), ws = Ba({
 		queries: T,
 		mutations: D,
 		actions: k,
 		streams: M,
 		workflows: N
 	}, p);
-	R.writeFile(A(p, "app.manifest.generated.json"), `${JSON.stringify(et(ys, bs, [], I?.plugins ?? []), null, 2)}\n`, "utf8").catch(() => {}), (async () => {
+	R.writeFile(A(p, "app.manifest.generated.json"), `${JSON.stringify(et(Ss, ws, [], I?.plugins ?? []), null, 2)}\n`, "utf8").catch(() => {}), (async () => {
 		let e = A(p, ".gitignore"), t = "";
 		try {
 			t = await R.readFile(e, "utf8");
@@ -5059,18 +5077,18 @@ ${a.join("\n\n")}\n`);
 		let n = t.split("\n").filter((e) => e.trim() !== "");
 		n.includes("app.manifest.generated.json") || (n.push("app.manifest.generated.json"), await R.writeFile(e, `${n.join("\n")}\n`, "utf8"));
 	})().catch(() => {}), on();
-	let Ss = A(p, "app.graph.observed.generated.json");
+	let Ts = A(p, "app.graph.observed.generated.json");
 	R.rm(A(p, "app.graph.observed.json"), { force: !0 }).catch(() => {});
-	let Cs = Ja(p);
-	Cs.warning === void 0 ? Cs.adopted.length > 0 && $.debug("handed generated output to the workspace owner", { paths: Cs.adopted.join(", ") }) : $.warn(Cs.warning);
-	let ws = async () => {
+	let Es = Ya(p);
+	Es.warning === void 0 ? Es.adopted.length > 0 && $.debug("handed generated output to the workspace owner", { paths: Es.adopted.join(", ") }) : $.warn(Es.warning);
+	let ks = async () => {
 		try {
-			await R.writeFile(Ss, `${JSON.stringify(ir(), null, 2)}\n`, "utf8");
+			await R.writeFile(Ts, `${JSON.stringify(ar(), null, 2)}\n`, "utf8");
 		} catch {}
 	};
 	setInterval(() => {
-		ws();
-	}, 1e4).unref(), V(() => ws()), (async () => {
+		ks();
+	}, 1e4).unref(), V(() => ks()), (async () => {
 		let e = A(p, ".gitignore"), t = "";
 		try {
 			t = await R.readFile(e, "utf8");
@@ -5078,26 +5096,26 @@ ${a.join("\n\n")}\n`);
 		let n = t.split("\n").filter((e) => e.trim() !== "");
 		n.includes("app.graph.observed.generated.json") || (n.push("app.graph.observed.generated.json"), await R.writeFile(e, `${n.join("\n")}\n`, "utf8"));
 	})().catch(() => {});
-	let Ds = /* @__PURE__ */ new Map();
-	for (let e of _o) Ds.set(e.descriptor.name, async (t, n) => {
+	let Ms = /* @__PURE__ */ new Map();
+	for (let e of vo) Ms.set(e.descriptor.name, async (t, n) => {
 		let r = {
 			subject: await At({
 				headers: n,
 				clientId: -1
 			}),
-			traceId: zl()
+			traceId: Vl()
 		};
 		try {
 			return {
 				ok: !0,
-				result: await hi({
+				result: await _i({
 					traceId: r.traceId,
 					subjectId: Bt(r.subject),
 					procedure: e.descriptor.name
-				}, () => Ko(e, t, r))
+				}, () => Jo(e, t, r))
 			};
 		} catch (t) {
-			let n = Xl(t);
+			let n = Ql(t);
 			return $.warn(`inspect invoke failed: ${e.descriptor.name}`, {
 				tag: e.descriptor.name,
 				error: n
@@ -5107,25 +5125,25 @@ ${a.join("\n\n")}\n`);
 			};
 		}
 	});
-	for (let e of vo) Ds.set(e.descriptor.name, async (t, n) => {
+	for (let e of yo) Ms.set(e.descriptor.name, async (t, n) => {
 		let r = {
 			subject: await At({
 				headers: n,
 				clientId: -1
 			}),
-			traceId: zl()
+			traceId: Vl()
 		};
 		try {
 			return {
 				ok: !0,
-				result: await hi({
+				result: await _i({
 					traceId: r.traceId,
 					subjectId: Bt(r.subject),
 					procedure: e.descriptor.name
-				}, () => qo(e, t, r))
+				}, () => Yo(e, t, r))
 			};
 		} catch (t) {
-			let n = Xl(t);
+			let n = Ql(t);
 			return $.warn(`inspect invoke failed: ${e.descriptor.name}`, {
 				tag: e.descriptor.name,
 				error: n
@@ -5135,7 +5153,7 @@ ${a.join("\n\n")}\n`);
 			};
 		}
 	});
-	let As = () => ({
+	let Ns = () => ({
 		dialect: U,
 		replication: ct.replicationSnapshot() ?? {
 			replicaCount: 0,
@@ -5167,7 +5185,7 @@ ${a.join("\n\n")}\n`);
 			...e.lastRunRowsTouched === void 0 ? {} : { lastRunRowsTouched: e.lastRunRowsTouched },
 			...e.lastError ? { lastError: e.lastError } : {}
 		}))
-	}), js = async () => {
+	}), Fs = async () => {
 		let e = {
 			drift: {
 				isDrifted: !1,
@@ -5178,23 +5196,23 @@ ${a.join("\n\n")}\n`);
 			history: [],
 			softDropSnapshots: []
 		};
-		if (!pi) return e;
+		if (!mi) return e;
 		let t = (e) => typeof e == "string" ? e : e instanceof Date ? e.toISOString() : e == null ? "" : JSON.stringify(e), n = P.gen(function* () {
-			let e = yield* Ir.SqlClient, n = yield* e`
+			let e = yield* Rr.SqlClient, n = yield* e`
         SELECT * FROM ${e("_voltro_migration_plans")}
         ORDER BY ${e("appliedAt")} DESC
         LIMIT 20
-      `.pipe(P.orElseSucceed(() => [])), r = yield* ca(e), i = sa(r), a = n[0], o = a?.liveFingerprint ?? null, s = {
+      `.pipe(P.orElseSucceed(() => [])), r = yield* la(e), i = ca(r), a = n[0], o = a?.liveFingerprint ?? null, s = {
 				isDrifted: o !== null && o !== i,
 				liveFingerprint: i,
 				liveSnapshot: r
 			};
 			a && (o !== null && (s.lastAppliedFingerprint = o), s.lastAppliedAt = t(a.appliedAt), s.lastAppliedId = a.id);
-			let c = z, l = ua({
+			let c = z, l = da({
 				declared: c,
 				live: r
 			});
-			return sa(aa(c)), {
+			return ca(oa(c)), {
 				drift: s,
 				pending: {
 					operations: l.operations.map((e) => {
@@ -5233,7 +5251,7 @@ ${a.join("\n\n")}\n`);
 			};
 		});
 		try {
-			return await P.runPromise(n.pipe(P.provide(pi)));
+			return await P.runPromise(n.pipe(P.provide(mi)));
 		} catch (t) {
 			return $.warn("inspect.migrations: snapshot build failed", { err: String(t) }), e;
 		}
@@ -5241,19 +5259,19 @@ ${a.join("\n\n")}\n`);
 		kind: "api",
 		meta: {
 			name: I?.name ?? O(p),
-			voltroVersion: Bl,
+			voltroVersion: Hl,
 			port: x,
 			mode: "dev",
-			store: gs,
-			cdc: _s ? "on" : "off"
+			store: ys,
+			cdc: bs ? "on" : "off"
 		},
-		rpc: ys,
-		workflows: bs,
-		metrics: (e) => X.snapshot(e),
+		rpc: Ss,
+		workflows: ws,
+		metrics: (e) => Bo.snapshot(e),
 		dataCache: () => {
-			let e = kr(), t = (process.env.CACHE_REDIS_DRIVER ?? "resp") === "http" ? "http" : "resp", n = Or === "redis" ? (process.env.CACHE_REDIS_URL ?? process.env.REDIS_URL ?? "").includes("upstash") ? "upstash" : "redis" : "memory";
+			let e = Ar(), t = (process.env.CACHE_REDIS_DRIVER ?? "resp") === "http" ? "http" : "resp", n = kr === "redis" ? (process.env.CACHE_REDIS_URL ?? process.env.REDIS_URL ?? "").includes("upstash") ? "upstash" : "redis" : "memory";
 			return {
-				backend: Or === "redis" ? "redis" : "memory",
+				backend: kr === "redis" ? "redis" : "memory",
 				engine: n,
 				driver: t,
 				hits: e.hits,
@@ -5261,13 +5279,13 @@ ${a.join("\n\n")}\n`);
 				hitRate: e.hitRate
 			};
 		},
-		invokers: Ds,
+		invokers: Ms,
 		plugins: () => ({
 			plugins: Lt.snapshot(),
 			capturedAt: Date.now()
 		}),
 		env: () => f(I?.name ?? O(p), {
-			contract: $i(I?.env) ? I.env : void 0,
+			contract: ta(I?.env) ? I.env : void 0,
 			plugins: I?.plugins ?? []
 		}),
 		subscriptions: () => {
@@ -5275,7 +5293,7 @@ ${a.join("\n\n")}\n`);
 			return {
 				subscriptions: e.map((e) => {
 					let t = [];
-					for (let n of vi(e.predicate)) n.conjunctive && t.push(n.column);
+					for (let n of bi(e.predicate)) n.conjunctive && t.push(n.column);
 					return {
 						fingerprint: e.fingerprint,
 						table: e.table,
@@ -5289,10 +5307,10 @@ ${a.join("\n\n")}\n`);
 				capturedAt: Date.now()
 			};
 		},
-		database: As,
-		migrations: async () => js(),
+		database: Ns,
+		migrations: async () => Fs(),
 		inspectTables: () => ({ tables: z.map((e) => {
-			let t = ou(e), n = su(t);
+			let t = cu(e), n = lu(t);
 			return {
 				name: e.tableName,
 				isFrameworkTable: e.tableName.startsWith("_voltro_"),
@@ -5305,11 +5323,11 @@ ${a.join("\n\n")}\n`);
 		inspectRows: async (e) => {
 			let t = Math.max(0, e.offset ?? 0), n = Math.max(1, Math.min(500, e.limit ?? 50)), r = z.find((t) => t.tableName === e.table);
 			if (!r) throw Error(`unknown table: ${e.table}`);
-			let i = ou(r), a = Ol({
+			let i = cu(r), a = Al({
 				filter: e.filter,
 				quickSearch: e.quickSearch,
 				columns: i
-			}), o = kl(e.sort, i), s = await B.query({
+			}), o = jl(e.sort, i), s = await B.query({
 				table: e.table,
 				order: o,
 				skip: t,
@@ -5325,7 +5343,7 @@ ${a.join("\n\n")}\n`);
 				skip: void 0,
 				take: void 0
 			})).length, u = "exact"), {
-				rows: s.map(au),
+				rows: s.map(su),
 				total: l,
 				countMode: u,
 				offset: t,
@@ -5339,7 +5357,7 @@ ${a.join("\n\n")}\n`);
 			return $.info("inspect.data.insert", {
 				table: e.table,
 				id: t?.id ?? null
-			}), { row: au(t) };
+			}), { row: su(t) };
 		},
 		inspectUpdateRow: async (e) => {
 			if (e.table.startsWith("_voltro_")) throw Error(`inspect data viewer cannot write to framework-internal table: ${e.table}`);
@@ -5349,7 +5367,7 @@ ${a.join("\n\n")}\n`);
 				table: e.table,
 				id: e.id,
 				patch: Object.keys(e.patch)
-			}), { row: t ? au(t) : null };
+			}), { row: t ? su(t) : null };
 		},
 		inspectDeleteRow: async (e) => {
 			if (e.table.startsWith("_voltro_")) throw Error(`inspect data viewer cannot delete from framework-internal table: ${e.table}`);
@@ -5362,7 +5380,7 @@ ${a.join("\n\n")}\n`);
 			}), { deleted: t };
 		},
 		inspectImport: async (e) => {
-			let t = await P.runPromise(Fa({
+			let t = await P.runPromise(Ia({
 				store: B,
 				bundleDir: e.bundleDir,
 				...e.mode ? { mode: e.mode } : {},
@@ -5382,13 +5400,13 @@ ${a.join("\n\n")}\n`);
 		...xt ? {
 			inspectStartWorkflow: async (e) => {
 				if (W === void 0) throw Error("workflow runtime is not configured");
-				return $n(W, {
+				return er(W, {
 					traceId: `inspect-workflow-start-${Date.now()}`,
 					source: "inspect"
 				}).start(e.name, e.payload);
 			},
 			inspectWorkflowRuns: async (e) => {
-				let { rows: t, total: n, offset: r, limit: i } = await ol(B, {
+				let { rows: t, total: n, offset: r, limit: i } = await cl(B, {
 					...e.tag === void 0 ? {} : { tag: e.tag },
 					...e.status === void 0 ? {} : { status: e.status },
 					...e.offset === void 0 ? {} : { offset: e.offset },
@@ -5432,7 +5450,7 @@ ${a.join("\n\n")}\n`);
 				if (!t) return $.warn("inspect.workflow.cancel: run not found", { runId: e.runId }), { cancelled: !1 };
 				let n = N.find((e) => e.definition.name === t.tag);
 				if (n && t.status === "running") try {
-					await fs.runPromise(n.definition.interrupt(t.executionId)), $.info("inspect.workflow.interrupt: engine notified", {
+					await Z.runPromise(n.definition.interrupt(t.executionId)), $.info("inspect.workflow.interrupt: engine notified", {
 						runId: e.runId,
 						tag: t.tag,
 						executionId: t.executionId
@@ -5450,17 +5468,17 @@ ${a.join("\n\n")}\n`);
 				});
 				r && C.emit("workflowRuns", {
 					op: "update",
-					row: es(r)
+					row: is(r)
 				});
 				let i = r?.subject?.tenantId ?? void 0;
-				return r && await Z.recordEvent({
+				return r && await os.recordEvent({
 					runId: e.runId,
 					eventType: "run-cancelled",
 					payload: {
 						reason: "inspect.cancel",
 						...i == null ? {} : { tenantId: i }
 					}
-				}), r && await rs(t.executionId, "cancelled"), $.info("inspect.workflow.cancel", {
+				}), r && await ss(t.executionId, "cancelled"), $.info("inspect.workflow.cancel", {
 					runId: e.runId,
 					didUpdate: r !== null
 				}), { cancelled: r !== null };
@@ -5618,7 +5636,7 @@ ${a.join("\n\n")}\n`);
 				if (!t || t.status !== "running") return { suspended: !1 };
 				let n = N.find((e) => e.definition.name === t.tag);
 				if (n) try {
-					await fs.runPromise(n.definition.interrupt(t.executionId));
+					await Z.runPromise(n.definition.interrupt(t.executionId));
 				} catch (t) {
 					$.warn("inspect.workflow.suspend: interrupt failed (continuing)", {
 						runId: e.runId,
@@ -5631,8 +5649,8 @@ ${a.join("\n\n")}\n`);
 				});
 				return r && C.emit("workflowRuns", {
 					op: "update",
-					row: es(r)
-				}), r && await Z.recordEvent({
+					row: is(r)
+				}), r && await os.recordEvent({
 					runId: e.runId,
 					eventType: "run-suspended",
 					payload: { reason: "inspect.suspend" }
@@ -5650,7 +5668,7 @@ ${a.join("\n\n")}\n`);
 				if (!t) return { resumed: !1 };
 				let n = N.find((e) => e.definition.name === t.tag);
 				if (n) try {
-					await fs.runPromise(n.definition.resume(t.executionId));
+					await Z.runPromise(n.definition.resume(t.executionId));
 				} catch (t) {
 					return $.warn("inspect.workflow.resume: engine.resume failed", {
 						runId: e.runId,
@@ -5663,8 +5681,8 @@ ${a.join("\n\n")}\n`);
 				});
 				return r && C.emit("workflowRuns", {
 					op: "update",
-					row: es(r)
-				}), r && await Z.recordEvent({
+					row: is(r)
+				}), r && await os.recordEvent({
 					runId: e.runId,
 					eventType: "run-resumed",
 					payload: { reason: "inspect.resume" }
@@ -5673,10 +5691,10 @@ ${a.join("\n\n")}\n`);
 			inspectRetryWorkflowRun: async (e) => {
 				let t = e.payloadOverride !== void 0;
 				try {
-					let n = await ll({
+					let n = await dl({
 						store: B,
 						workflows: N,
-						runPromise: (e) => fs.runPromise(e)
+						runPromise: (e) => Z.runPromise(e)
 					}, e.runId, t ? { payloadOverride: e.payloadOverride } : void 0);
 					return $.info("inspect.workflow.retry", {
 						runId: e.runId,
@@ -5690,9 +5708,9 @@ ${a.join("\n\n")}\n`);
 				}
 			},
 			inspectSignalWorkflowRun: async (e) => {
-				let t = await Wr({
+				let t = await Kr({
 					store: B,
-					recorder: Z,
+					recorder: os,
 					target: { id: e.runId },
 					signalName: e.signalName,
 					payload: e.payload
@@ -5704,9 +5722,9 @@ ${a.join("\n\n")}\n`);
 				}), t;
 			},
 			inspectUpdateWorkflowRun: async (e) => {
-				let t = await Gr({
+				let t = await qr({
 					store: B,
-					recorder: Z,
+					recorder: os,
 					target: { id: e.runId },
 					updateName: e.updateName,
 					payload: e.payload,
@@ -5727,14 +5745,14 @@ ${a.join("\n\n")}\n`);
 					name: e.name,
 					cron: e.cron,
 					timezone: e.timezone,
-					trigger: e.trigger ?? ga,
+					trigger: e.trigger ?? _a,
 					onOverlap: e.onOverlap ?? "skip",
 					backfill: e.backfill ?? "skip",
 					maxRuntimeMs: e.maxRuntimeMs ?? 30 * 6e4,
 					...e.description === void 0 ? {} : { description: e.description },
-					nextFiringAt: nr(e).toISOString()
+					nextFiringAt: rr(e).toISOString()
 				})),
-				coordination: xa ? "cluster" : ba === "advisoryLock" && U === "postgres" ? "advisoryLock" : "single"
+				coordination: Sa ? "cluster" : va === "advisoryLock" && U === "postgres" ? "advisoryLock" : "single"
 			}),
 			inspectScheduleRuns: async (e) => {
 				let t = Math.max(0, e.offset ?? 0), n = Math.max(1, Math.min(500, e.limit ?? 50)), r = e.name === void 0 ? void 0 : H("name", e.name), i = await B.query({
@@ -5776,21 +5794,21 @@ ${a.join("\n\n")}\n`);
 				};
 			},
 			inspectFireSchedule: async (e) => {
-				if (!ma) throw Error("scheduler not started (no self-triggered schedules?)");
-				return { runId: await ma.fireNow(e.name, e.trigger) ?? null };
+				if (!ha) throw Error("scheduler not started (no self-triggered schedules?)");
+				return { runId: await ha.fireNow(e.name, e.trigger) ?? null };
 			}
 		} : {},
 		cluster: async () => {
-			let e = process.env.POD_NAME ?? process.env.HOSTNAME ?? `dev-${process.pid}`, t = U, n = t === "memory", r = n ? "none" : Zr({ sqliteFamily: t === "sqlite" || t === "turso" }), i = Xr({
+			let e = process.env.POD_NAME ?? process.env.HOSTNAME ?? `dev-${process.pid}`, t = U, n = t === "memory", r = n ? "none" : $r({ sqliteFamily: t === "sqlite" || t === "turso" }), i = Qr({
 				runnerStorage: r === "sql" ? "sql" : "memory",
 				...process.env.VOLTRO_WORKFLOW_RUNNER_PORT ? { runnerListenPort: Number(process.env.VOLTRO_WORKFLOW_RUNNER_PORT) } : {}
-			}), a = !n && (process.env.CDC ?? "1") !== "0", o = t === "postgres" ? "LISTEN/NOTIFY" : t === "sqlite" || t === "turso" ? "in-process bus" : t === "mariadb" || t === "mysql" ? "binlog CDC (ROW)" : t === "mssql" ? "inline only" : t === "memory" ? "none (single-process)" : "inline only", s = t === "postgres" || t === "mariadb" || t === "mssql" ? "full" : t === "mysql" ? "inline-only" : t === "sqlite" || t === "turso" ? "single-process" : "none", c = xa ? "cluster" : ba === "advisoryLock" && U === "postgres" ? "advisoryLock" : "single", l = a && t === "mariadb" ? wu(e) : void 0, u = {
+			}), a = !n && (process.env.CDC ?? "1") !== "0", o = t === "postgres" ? "LISTEN/NOTIFY" : t === "sqlite" || t === "turso" ? "in-process bus" : t === "mariadb" || t === "mysql" ? "binlog CDC (ROW)" : t === "mssql" ? "inline only" : t === "memory" ? "none (single-process)" : "inline only", s = t === "postgres" || t === "mariadb" || t === "mssql" ? "full" : t === "mysql" ? "inline-only" : t === "sqlite" || t === "turso" ? "single-process" : "none", c = Sa ? "cluster" : va === "advisoryLock" && U === "postgres" ? "advisoryLock" : "single", l = a && t === "mariadb" ? Du(e) : void 0, u = {
 				replicaId: e,
 				dialect: t,
 				runnerHost: i.host,
 				runnerPort: r === "none" ? 0 : i.port,
 				runnerStorage: r,
-				shardLock: r === "sql" ? Yr() : "none",
+				shardLock: r === "sql" ? Zr() : "none",
 				coordination: c,
 				cdc: {
 					enabled: a,
@@ -5847,10 +5865,10 @@ ${a.join("\n\n")}\n`);
 			};
 		},
 		runSeed: async (e) => {
-			let t = await re(Ei, e, B, xi);
-			return ct.recordSeedResult(t), As();
+			let t = await re(Ei, e, B, yi);
+			return ct.recordSeedResult(t), Ns();
 		},
-		rollbackMigration: async (e) => (xi.warn("rollbackMigration called but only memory store is wired — no-op"), As()),
+		rollbackMigration: async (e) => (yi.warn("rollbackMigration called but only memory store is wired — no-op"), Ns()),
 		webhooks: async () => {
 			let e = G.outgoing.map((e) => ({
 				id: e.descriptor.id,
@@ -5917,68 +5935,68 @@ ${a.join("\n\n")}\n`);
 			replay: (e) => J.replay(e),
 			updateTargetPayloadVersion: (e, t) => J.updateTargetPayloadVersion(e, t)
 		} }
-	}, Ps = ul(I?.plugins ?? [], X);
-	Ps !== void 0 && $.info("plugin http-request interceptor active", { plugins: (I?.plugins ?? []).filter((e) => typeof e.onHttpRequest == "function").map((e) => e.name) });
-	let Rs = (I?.plugins ?? []).flatMap((e) => e.httpRoutes ?? []), Hs = typeof Et == "object" ? Et.managementPath : void 0, Us = () => `public-${Math.random().toString(36).slice(2, 10)}`, Gs = va([
+	}, Bs = fl(I?.plugins ?? [], Bo);
+	Bs !== void 0 && $.info("plugin http-request interceptor active", { plugins: (I?.plugins ?? []).filter((e) => typeof e.onHttpRequest == "function").map((e) => e.name) });
+	let Ws = (I?.plugins ?? []).flatMap((e) => e.httpRoutes ?? []), Gs = typeof Et == "object" ? Et.managementPath : void 0, qs = () => `public-${Math.random().toString(36).slice(2, 10)}`, Js = ba([
 		...T.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
 			descriptor: e.descriptor,
-			invoke: (t, n) => Xo(e, t, {
+			invoke: (t, n) => Qo(e, t, {
 				subject: n.subject,
-				traceId: Us()
+				traceId: qs()
 			}),
-			subscribe: (t, n, r) => Zo(e, t, {
+			subscribe: (t, n, r) => $o(e, t, {
 				subject: n.subject,
-				traceId: Us()
+				traceId: qs()
 			}, r)
 		})),
 		...D.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
 			descriptor: e.descriptor,
-			invoke: (t, n) => Ko(e, t, {
+			invoke: (t, n) => Jo(e, t, {
 				subject: n.subject,
-				traceId: Us()
+				traceId: qs()
 			})
 		})),
 		...k.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
 			descriptor: e.descriptor,
-			invoke: (t, n) => qo(e, t, {
+			invoke: (t, n) => Yo(e, t, {
 				subject: n.subject,
-				traceId: Us()
+				traceId: qs()
 			})
 		}))
-	]), Ks = [
+	]), Ys = [
 		...I?.restRoutes ?? [],
-		...Ot ? Vt(Ot, Hs ?? "/v1/api-keys") : [],
-		...Gs
+		...Ot ? Vt(Ot, Gs ?? "/v1/api-keys") : [],
+		...Js
 	];
-	Gs.length > 0 && $.info("public-api routes projected from descriptors", { routes: Gs.map((e) => `${e.method} ${e.path}`) });
-	let qs = I?.idempotency, Js = qs ? {
+	Js.length > 0 && $.info("public-api routes projected from descriptors", { routes: Js.map((e) => `${e.method} ${e.path}`) });
+	let Xs = I?.idempotency, Qs = Xs ? {
 		store: rn(B),
-		header: (typeof qs == "object" ? qs.header : void 0) ?? "Idempotency-Key",
-		ttlMs: (typeof qs == "object" ? qs.ttlMs : void 0) ?? 864e5
-	} : void 0, Xs = Ks.length > 0 ? ya(Ks, {
+		header: (typeof Xs == "object" ? Xs.header : void 0) ?? "Idempotency-Key",
+		ttlMs: (typeof Xs == "object" ? Xs.ttlMs : void 0) ?? 864e5
+	} : void 0, ec = Ys.length > 0 ? xa(Ys, {
 		store: B,
 		resolveSubject: (e) => At({
 			headers: e,
 			clientId: -1
 		}),
-		...Js ? { idempotency: Js } : {}
+		...Qs ? { idempotency: Qs } : {}
 	}) : [];
-	Js && Ks.length > 0 && $.info("rest idempotency active", {
-		header: Js.header,
-		ttlMs: Js.ttlMs
-	}), Xs.length > 0 && $.info("rest routes mounted", { routes: Ks.map((e) => `${e.method} ${e.path}`) });
-	let Qs = [
-		...Rs,
-		...Xs,
-		...rr.httpRoutes
-	], { server: $s } = Tr({
-		group: bo,
-		handlersLayer: ps,
-		httpHandlersLayer: hs,
+	Qs && Ys.length > 0 && $.info("rest idempotency active", {
+		header: Qs.header,
+		ttlMs: Qs.ttlMs
+	}), ec.length > 0 && $.info("rest routes mounted", { routes: Ys.map((e) => `${e.method} ${e.path}`) });
+	let tc = [
+		...Ws,
+		...ec,
+		...ir.httpRoutes
+	], { server: nc } = Dr({
+		group: xo,
+		handlersLayer: gs,
+		httpHandlersLayer: vs,
 		port: x,
 		path: I?.transport?.wsPath ?? "/ws",
-		...Ps ? { pluginHttpInterceptor: Ps } : {},
-		...Qs.length > 0 ? { httpRoutes: Qs } : {},
+		...Bs ? { pluginHttpInterceptor: Bs } : {},
+		...tc.length > 0 ? { httpRoutes: tc } : {},
 		getStore: () => Tt.current,
 		inspectRoute: { handle: async (e, t, n, r) => {
 			if (n !== "OPTIONS") {
@@ -6029,7 +6047,7 @@ ${a.join("\n\n")}\n`);
 			if (n === "GET" && (e === "/_voltro/inspect/traces" || e.startsWith("/_voltro/inspect/traces?"))) {
 				let n = _e();
 				return {
-					...Il(e, gs === "postgres" && pe() ? await hu(e, n, B) : n),
+					...Rl(e, ys === "postgres" && pe() ? await _u(e, n, B) : n),
 					headers: E(t.origin)
 				};
 			}
@@ -6090,11 +6108,11 @@ ${a.join("\n\n")}\n`);
 				if (r) return r;
 			}
 			if (e.startsWith("/_voltro/inspect/aggregates")) {
-				let r = await hc(e, n, ia.registry, E(t.origin));
+				let r = await _c(e, n, aa.registry, E(t.origin));
 				if (r) return r;
 			}
 			if (e.startsWith("/_voltro/inspect/timeline")) {
-				let r = await Tc(e, n, {
+				let r = await Dc(e, n, {
 					recorder: pn(),
 					readCurrentRows: async (e) => Q.inspectRows === void 0 ? [] : (await Q.inspectRows({
 						table: e,
@@ -6106,9 +6124,9 @@ ${a.join("\n\n")}\n`);
 				if (r) return r;
 			}
 			if (e.startsWith("/_voltro/inspect/analytics")) {
-				let r = yc(e, n, {
-					sink: ti,
-					metricsCollector: X
+				let r = xc(e, n, {
+					sink: ni,
+					metricsCollector: Bo
 				}, E(t.origin));
 				if (r) return r;
 			}
@@ -6142,19 +6160,19 @@ ${a.join("\n\n")}\n`);
 			corsHeaders: (e) => E(e),
 			keepAlive: () => r()
 		},
-		webhookRoutes: new Map(Array.from(Va.entries()).map(([e, t]) => [e, { handle: t }])),
-		...tr ? { tracerLayer: tr } : {}
+		webhookRoutes: new Map(Array.from(Ha.entries()).map(([e, t]) => [e, { handle: t }])),
+		...nr ? { tracerLayer: nr } : {}
 	});
 	try {
-		await qt($s);
+		await qt(nc);
 	} catch (e) {
 		$.error(`rpc server failed to bind on port ${x} — aborting boot`, { port: x }, e), process.exit(1);
 	}
 	$.info(`listening on http://localhost:${x}`, {
 		port: x,
 		ws: `ws://localhost:${x}/ws`,
-		store: gs
-	}), Te?.set({ phase: "ready" }), gs === "postgres" && $.info("postgres change-data-capture", { enabled: (process.env.CDC ?? "1") !== "0" }), await Oo();
+		store: ys
+	}), Te?.set({ phase: "ready" }), ys === "postgres" && $.info("postgres change-data-capture", { enabled: (process.env.CDC ?? "1") !== "0" }), await ko();
 	try {
 		await m({
 			id: S,
@@ -6183,8 +6201,8 @@ ${a.join("\n\n")}\n`);
 		}, 1e4).unref();
 		let t = async () => {
 			Lt.deactivate();
-			for (let e of mr) e.stop();
-			lr?.dispose(), ee(S), le.dispose(), Ar(), _r?.close(), await ui();
+			for (let e of hr) e.stop();
+			ur?.dispose(), ee(S), le.dispose(), jr(), vr?.close(), await ui();
 		};
 		V(t);
 		let n = process.ppid;
@@ -6201,9 +6219,9 @@ ${a.join("\n\n")}\n`);
 		root: p,
 		onBeforeRestart: () => {
 			try {
-				$s.closeAllConnections?.();
+				nc.closeAllConnections?.();
 			} catch {}
-			$s.close();
+			nc.close();
 		}
 	}), Ct({
 		app: ce,
@@ -6217,4 +6235,4 @@ ${a.join("\n\n")}\n`);
 	}), new Promise(() => {});
 };
 //#endregion
-export { uo as $, Ys as A, ks as B, jc as C, uc as D, lc as E, Fs as F, ds as G, Ts as H, Is as I, cs as J, ls as K, Ns as L, Bs as M, zs as N, Zs as O, Ls as P, vo as Q, Ms as R, Pc as S, Dc as T, Cs as U, Es as V, xs as W, Vo as X, Bo as Y, _o as Z, cl as _, lu as a, ro as at, Kc as b, vu as c, Ja as ct, xu as d, so as et, Mu as f, vl as g, Du as h, Eu as i, io as it, Vs as j, Ws as k, _u as l, La as lt, Ql as m, Gl as n, oo as nt, yu as o, no as ot, bu as p, us as q, Wl as r, ao as rt, Xl as s, Xa as st, Bl as t, co as tt, gu as u, Ra as ut, ll as v, Ec as w, Nc as x, nl as y, Os as z };
+export { bo as $, Ks as A, As as B, Ic as C, dc as D, kc as E, zs as F, Cs as G, Os as H, Ls as I, ps as J, ms as K, Rs as L, Us as M, Hs as N, fc as O, Vs as P, yo as Q, Is as R, Fc as S, Oc as T, Ds as U, js as V, Ts as W, Uo as X, ds as Y, Wo as Z, bl as _, du as a, oo as at, il as b, bu as c, Qa as ct, wu as d, Ba as dt, po as et, Fu as f, Au as g, eu as h, ku as i, so as it, Zs as j, $s as k, yu as l, Ya as lt, Su as m, ql as n, uo as nt, xu as o, ao as ot, Cu as p, fs as q, Kl as r, co as rt, Ql as s, io as st, Hl as t, lo as tt, vu as u, za as ut, ul as v, Nc as w, Jc as x, dl as y, Ps as z };