@voltro/cli 0.47.0 → 0.48.0

package/dist/{serveCommand-BU0wfV6V.js → serveCommand-CV3YO9L3.js}

@@ -4,20 +4,21 @@ import { r as n, t as r } from "./appModuleLoader-C9r9mxZt.js";
 import { t as i } from "./bootRefusal-pgvDxlrU.js";
 import { n as a, r as o } from "./startupRunner-CEqQq7ax.js";
 import { t as ee } from "./interruptedReplace-C1ZI84xi.js";
-import { $ as s, $t as c, A as l, At as u, Bt as d, C as f, Cn as p, Ct as m, D as h, Dt as g, E as _, En as te, Et as v, F as ne, Ft as re, G as ie, Gt as ae, H as y, Ht as oe, I as se, It as ce, J as le, Jt as b, K as x, Kt as ue, L as S, Lt as de, M as fe, Mt as pe, N as me, Nt as he, O as ge, Ot as _e, P as ve, Pt as ye, Q as be, Qt as xe, R as C, Rt as Se, S as Ce, St as we, T as Te, Tn as Ee, Tt as w, U as De, V as Oe, W as ke, Wt as Ae, X as je, Xt as Me, Y as Ne, Yt as T, Z as Pe, Zt as Fe, _ as E, _n as Ie, _t as D, an as Le, at as Re, b as ze, bn as Be, bt as Ve, c as He, cn as Ue, ct as We, dn as Ge, dt as Ke, en as qe, et as Je, f as Ye, fn as Xe, ft as Ze, g as Qe, gt as $e, h as et, hn as tt, ht as nt, i as rt, in as it, it as at, j as ot, jt as st, k as ct, kt as lt, ln as ut, lt as dt, m as ft, mn as pt, mt, nn as ht, nt as gt, o as O, on as _t, ot as k, p as A, pn as vt, pt as yt, q as bt, qt as xt, r as St, rn as Ct, rt as wt, sn as j, st as Tt, t as Et, tn as Dt, tt as Ot, u as kt, un as At, ut as jt, v as Mt, vn as Nt, vt as M, w as N, wn as Pt, wt as Ft, x as It, xn as Lt, xt as Rt, y as zt, yn as Bt, yt as Vt, zt as Ht } from "./dev-RjB7eE_B.js";
+import { $ as s, $t as c, A as l, At as u, Bt as d, C as f, Cn as p, Ct as m, D as h, Dt as g, E as _, En as te, Et as v, F as ne, Ft as re, G as ie, Gt as ae, H as y, Ht as oe, I as se, It as ce, J as le, Jt as b, K as x, Kt as ue, L as S, Lt as de, M as fe, Mt as pe, N as me, Nt as he, O as ge, Ot as _e, P as ve, Pt as ye, Q as be, Qt as xe, R as C, Rt as Se, S as Ce, St as we, T as Te, Tn as Ee, Tt as w, U as De, V as Oe, W as ke, Wt as Ae, X as je, Xt as Me, Y as Ne, Yt as T, Z as Pe, Zt as Fe, _ as E, _n as Ie, _t as Le, an as Re, at as ze, b as Be, bn as Ve, bt as He, c as Ue, cn as We, ct as Ge, dn as Ke, dt as qe, en as Je, et as Ye, f as Xe, fn as Ze, ft as Qe, g as $e, gt as et, h as tt, hn as nt, ht as rt, i as it, in as at, it as ot, j as st, jt as ct, k as lt, kt as ut, ln as dt, lt as ft, m as pt, mn as mt, mt as ht, nn as gt, nt as D, o as O, on as _t, ot as k, p as A, pn as vt, pt as yt, q as bt, qt as xt, r as St, rn as Ct, rt as wt, sn as j, st as Tt, t as Et, tn as Dt, tt as Ot, u as kt, un as At, ut as jt, v as Mt, vn as Nt, vt as M, w as N, wn as Pt, wt as Ft, x as It, xn as Lt, xt as Rt, y as zt, yn as Bt, yt as Vt, zt as Ht } from "./dev-lvnVq5RD.js";
 import { n as Ut } from "./cliArgs-D4p8n7EE.js";
 import { r as P } from "./appPort-B_HpJ_ck.js";
 import { ht as Wt, pt as Gt } from "./webDev-B4IEMB0n.js";
 import { r as F } from "./dialectDriver-czCHYpeH.js";
 import { i as Kt, n as qt } from "./connectionConfig-Bk9IC7D0.js";
 import { c as Jt, n as I, o as Yt } from "./seedRunner-Dgsiwk_e.js";
-import { C as Xt, S as Zt, _ as Qt, d as $t, g as en, l as tn, m as nn, r as rn, u as an, v as on } from "./frameworkTableAssembly-BvZ0Lil_.js";
+import { b as Xt, d as Zt, h as Qt, m as $t, p as en, r as tn, y as nn } from "./frameworkTableAssembly-BNod_DKN.js";
+import { n as rn, r as an, t as on } from "./declaredSchemaGates-BlcwObhb.js";
 import { S as sn, c as cn, n as ln, p as un, s as dn, x as fn } from "./fileConventions-Cof68_BL.js";
 import { h as pn, o as mn } from "./inspect-B7U7Cl_Z.js";
 import { n as hn } from "./mssqlClusterPatch-_4cE_nun.js";
 import { i as gn, n as _n, r as vn, t as yn } from "./webhookDiscovery-CphsQe59.js";
 import { t as bn } from "./inspectMetrics-CfdKLh6t.js";
-import { r as xn, u as Sn } from "./apiBuild-FpHCWiv6.js";
+import { r as xn, u as Sn } from "./apiBuild-Dz8TJSxp.js";
 import { t as Cn } from "./bootTiming-BdyP9nYw.js";
 import { t as wn } from "./dataProfile-Cm0YVKSy.js";
 import Tn, { basename as En, join as Dn } from "node:path";
@@ -25,25 +26,25 @@ import { createWriteStream as On, existsSync as kn } from "node:fs";
 import { pathToFileURL as An } from "node:url";
 import { createLogger as L } from "@voltro/logger";
 import { AuthMiddleware as jn, ConnectionInfoMiddleware as Mn, actionToRpc as R, anonymousSubject as Nn, isWireReachable as Pn, mutationToRpc as Fn, queryToRpc as z, streamToRpc as In, wireErrorUnion as Ln, workflowCancelDescriptor as Rn, workflowDomainEventsQueryDescriptor as B, workflowEventDeliveriesQueryDescriptor as V, workflowResumeDescriptor as zn, workflowRunEventsQueryDescriptor as Bn, workflowRunQueryDescriptor as Vn, workflowRunStepsQueryDescriptor as Hn, workflowRunsQueryDescriptor as Un, workflowSignalDescriptor as Wn, workflowUpdateDescriptor as Gn } from "@voltro/protocol";
-import { allRegisteredTables as Kn, and as H, connectionIdentity as qn, ensureTableRegistered as Jn, eq as U, or as Yn } from "@voltro/database";
-import { Cause as Xn, Effect as W, Layer as G, ManagedRuntime as Zn } from "effect";
-import { SqlClient as Qn } from "@effect/sql";
-import { declaredSnapshot as $n, describeOutcome as er, pendingFileMigrationIds as tr, runPlannedMigrations as nr } from "@voltro/database/sql";
-import { AggregateRegistry as rr, CostRegistry as ir, DORMANCY_WAKEUP_TENANT as ar, Dispatcher as or, ExpectationRegistry as sr, ExperimentRegistry as cr, apiKeyManagementRoutes as lr, attachAnalyticsMirror as ur, attachExpectations as dr, attachExperiments as fr, attachFinops as pr, awaitServerListening as mr, bindMutation as K, bindStream as hr, bindSubscription as q, buildTracingLayer as gr, cancelWakeup as _r, compileCron as vr, dataStoreApiKeyStore as yr, formatServerOnlyLeaks as br, formatUnresolvedSources as xr, frameworkApiKeyStrategy as Sr, getResourcePolicy as Cr, installPolicyGuardResolver as wr, loadResourceTuples as Tr, makeActionRunner as Er, makeAdvisoryLockCoordinator as Dr, makeApiKeyService as Or, makeApiKeyUsageBuffer as kr, makeApiKeyUsageFlusher as Ar, makeAsyncKv as jr, makeAuthMiddlewareLayers as Mr, makeCoordinatedScheduler as Nr, makeEffectStoreLayer as Pr, makeLazyWorkflowFacade as Fr, makeMutationOutputCodec as Ir, makeMutationRunner as Lr, makeOneShotQueryRunner as Rr, makeQueryDescriptorProducer as zr, makeQueryFinalizer as Br, makeQueryReauthorizer as Vr, makeQuerySubscriber as Hr, makeSchemaRegistry as Ur, makeWorkflowFacade as J, makeWorkflowFacadeWithCallerContext as Wr, makeWorkflowLayers as Gr, noopKv as Kr, onProcessShutdown as qr, recordSubscriptionDelivery as Jr, recordWorkflowRun as Yr, registerDefaultTupleSource as Xr, registerWakeup as Zr, resolveSecretsBackend as Qr, runProvidedEffect as Y, setSecretsBackend as $r, setSystemStoreHandle as ei, shutdownGraceMsFromEnv as ti, singleCoordinator as ni, startRpcServer as ri, startScheduler as ii, stripForbiddenForWire as ai, undoCaptureEnabled as oi, unresolvedSources as si, withScopedRequest as ci, workflowToRpc as li, wrapStoreWithBootCodec as ui } from "@voltro/runtime";
-import di, { tmpdir as fi } from "node:os";
-import { RpcGroup as pi } from "@effect/rpc";
-import { appStorageProvider as mi, durabilityNotice as hi, fromNodeReadable as gi, getObjectStream as _i, putObjectStream as vi, toNodeReadable as yi } from "@voltro/plugin-storage";
-import { isEnvContract as bi } from "@voltro/env";
-import { assertProductionSessionSecret as xi } from "@voltro/protocol/session";
+import { IMPORT_RUNS_TABLE as H, allRegisteredTables as Kn, and as qn, connectionIdentity as Jn, describeImportRun as Yn, ensureTableRegistered as Xn, eq as U, or as Zn } from "@voltro/database";
+import { Cause as Qn, Effect as W, Layer as G, ManagedRuntime as $n } from "effect";
+import { SqlClient as er } from "@effect/sql";
+import { declaredSnapshot as tr, describeOutcome as nr, pendingFileMigrationIds as rr, runPlannedMigrations as ir } from "@voltro/database/sql";
+import { AggregateRegistry as ar, CostRegistry as K, DORMANCY_WAKEUP_TENANT as or, Dispatcher as sr, ExpectationRegistry as cr, ExperimentRegistry as lr, apiKeyManagementRoutes as ur, attachAnalyticsMirror as dr, attachExpectations as fr, attachExperiments as pr, attachFinops as mr, awaitServerListening as hr, bindMutation as q, bindStream as gr, bindSubscription as _r, buildTracingLayer as vr, cancelWakeup as yr, compileCron as br, dataStoreApiKeyStore as xr, formatServerOnlyLeaks as Sr, formatUnresolvedSources as Cr, frameworkApiKeyStrategy as wr, getResourcePolicy as Tr, installPolicyGuardResolver as Er, loadResourceTuples as Dr, makeActionRunner as Or, makeAdvisoryLockCoordinator as kr, makeApiKeyService as Ar, makeApiKeyUsageBuffer as jr, makeApiKeyUsageFlusher as Mr, makeAsyncKv as Nr, makeAuthMiddlewareLayers as Pr, makeCoordinatedScheduler as Fr, makeEffectStoreLayer as Ir, makeLazyWorkflowFacade as Lr, makeMutationOutputCodec as Rr, makeMutationRunner as zr, makeOneShotQueryRunner as Br, makeQueryDescriptorProducer as Vr, makeQueryFinalizer as Hr, makeQueryReauthorizer as J, makeQuerySubscriber as Ur, makeSchemaRegistry as Wr, makeWorkflowFacade as Gr, makeWorkflowFacadeWithCallerContext as Kr, makeWorkflowLayers as qr, noopKv as Jr, onProcessShutdown as Yr, recordSubscriptionDelivery as Xr, recordWorkflowRun as Zr, registerDefaultTupleSource as Y, registerWakeup as Qr, resolveSecretsBackend as $r, runProvidedEffect as ei, setSecretsBackend as ti, setSystemStoreHandle as ni, shutdownGraceMsFromEnv as ri, singleCoordinator as ii, startRpcServer as ai, startScheduler as oi, stripForbiddenForWire as si, undoCaptureEnabled as ci, unresolvedSources as li, withScopedRequest as ui, workflowToRpc as di, wrapStoreWithBootCodec as fi } from "@voltro/runtime";
+import pi, { tmpdir as mi } from "node:os";
+import { RpcGroup as hi } from "@effect/rpc";
+import { appStorageProvider as gi, durabilityNotice as _i, fromNodeReadable as vi, getObjectStream as yi, putObjectStream as bi, toNodeReadable as xi } from "@voltro/plugin-storage";
+import { isEnvContract as Si } from "@voltro/env";
+import { assertProductionSessionSecret as Ci } from "@voltro/protocol/session";
 import X from "node:fs/promises";
-import { createHash as Si, timingSafeEqual as Ci } from "node:crypto";
-import { buildDeliverWebhookExecute as wi, buildWebhooksService as Ti, defaultIncomingPath as Ei, deliverWebhookWorkflow as Di, makeDeferredEmitHandler as Oi, mountIncomingWebhook as ki } from "@voltro/plugin-webhooks";
-import { getAuthSessionStrategy as Ai } from "@voltro/plugin-auth";
-import { registerEmailTemplates as ji } from "@voltro/plugin-mail";
-import { channelFor as Mi, getBroadcastPlugin as Ni } from "@voltro/plugin-broadcast";
-import { packBundle as Pi, runExport as Fi, runImport as Ii, storageBlobSink as Li, storageRefsBlobSource as Ri, unpackBundle as zi, unpackBundleToDir as Bi } from "@voltro/data-transfer";
+import { createHash as wi, timingSafeEqual as Ti } from "node:crypto";
+import { buildDeliverWebhookExecute as Ei, buildWebhooksService as Di, defaultIncomingPath as Oi, deliverWebhookWorkflow as ki, makeDeferredEmitHandler as Ai, mountIncomingWebhook as ji } from "@voltro/plugin-webhooks";
+import { getAuthSessionStrategy as Mi } from "@voltro/plugin-auth";
+import { registerEmailTemplates as Ni } from "@voltro/plugin-mail";
+import { channelFor as Pi, getBroadcastPlugin as Fi } from "@voltro/plugin-broadcast";
+import { decideStaging as Ii, isEnvironmentLocal as Li, packBundle as Ri, peekBundle as zi, runExport as Bi, runImport as Vi, storageBlobSink as Hi, storageRefsBlobSource as Ui, unpackBundle as Wi, unpackBundleToDir as Gi } from "@voltro/data-transfer";
 //#region src/serveDrain.ts
-var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t) => setTimeout(t, e)), Ui = (e) => {
+var Ki = () => Math.max(500, Math.floor(ri() * .6)), qi = (e) => new Promise((t) => setTimeout(t, e)), Ji = (e) => {
 	let t = /* @__PURE__ */ new Set(), n = /* @__PURE__ */ new Set(), r = 0;
 	e.on("connection", (e) => {
 		t.add(e), e.once("close", () => {
@@ -57,14 +58,14 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 		});
 	});
 	let i, a = async (t = {}) => {
-		let n = t.budgetMs ?? Vi();
+		let n = t.budgetMs ?? Ki();
 		i ??= new Promise((t) => {
 			e.close(() => {
 				t();
 			});
 		}), e.closeIdleConnections();
 		let a = Date.now() + n;
-		for (; r > 0 && Date.now() < a;) await Hi(25), e.closeIdleConnections();
+		for (; r > 0 && Date.now() < a;) await qi(25), e.closeIdleConnections();
 		e.closeIdleConnections();
 	}, o = async () => {
 		i ??= new Promise((t) => {
@@ -81,7 +82,7 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 			]));
 		} catch {}
 		else e.destroy();
-		for (let e = 0; t.size > 0 && e < 250; e += 25) await Hi(25);
+		for (let e = 0; t.size > 0 && e < 250; e += 25) await qi(25);
 		for (let e of t) e.destroy();
 		await i;
 	};
@@ -93,77 +94,77 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 			await a(e), await o();
 		}
 	};
-}, Wi = "/_voltro/admin/import", Gi = "/_voltro/admin/export", Z = (e, t) => ({
+}, Yi = "/_voltro/admin/import", Xi = "/_voltro/admin/export", Zi = "/_voltro/admin/imports", Z = (e, t) => ({
 	status: e,
 	contentType: "application/json; charset=utf-8",
 	body: JSON.stringify(t)
-}), Ki = (e) => {
+}), Qi = (e) => {
 	let t = e.authorization ?? e.Authorization, n = t ? /^Bearer\s+(.+)$/i.exec(t) : null;
 	return n ? n[1] : null;
-}, qi = (e, t) => Ci(Si("sha256").update(e).digest(), Si("sha256").update(t).digest()), Ji = (e, t) => {
-	if (e.method.toUpperCase() !== "POST") return Z(405, { error: "method not allowed" });
+}, $i = (e, t) => Ti(wi("sha256").update(e).digest(), wi("sha256").update(t).digest()), ea = (e, t, n = "POST") => {
+	if (e.method.toUpperCase() !== n) return Z(405, { error: "method not allowed" });
 	if (!t || t.length < 16) return Z(503, { error: "data transfer misconfigured (no/weak secret)" });
-	let n = Ki(e.headers);
-	return !n || !qi(n, t) ? Z(401, { error: "unauthorized" }) : null;
-}, Yi = /^[A-Za-z0-9_-]{8,64}$/, Xi = (e) => Yi.test(e), Zi = () => Tn.join(di.tmpdir(), "voltro-import-uploads"), Qi = (e) => Tn.join(Zi(), e), $i = (e) => Tn.join(Qi(e), "archive.bin"), ea = (e) => Tn.join(Qi(e), "meta.json"), ta = async (e = Date.now()) => {
+	let r = Qi(e.headers);
+	return !r || !$i(r, t) ? Z(401, { error: "unauthorized" }) : null;
+}, ta = /^[A-Za-z0-9_-]{8,64}$/, na = (e) => ta.test(e), ra = () => Tn.join(pi.tmpdir(), "voltro-import-uploads"), ia = (e) => Tn.join(ra(), e), aa = (e) => Tn.join(ia(e), "archive.bin"), oa = (e) => Tn.join(ia(e), "meta.json"), sa = async (e = Date.now()) => {
 	let t = 0;
 	try {
-		for (let n of await X.readdir(Zi())) {
-			let r = await X.stat(Qi(n)).catch(() => null);
-			r !== null && (e - r.mtimeMs <= 864e5 || (await X.rm(Qi(n), {
+		for (let n of await X.readdir(ra())) {
+			let r = await X.stat(ia(n)).catch(() => null);
+			r !== null && (e - r.mtimeMs <= 864e5 || (await X.rm(ia(n), {
 				recursive: !0,
 				force: !0
 			}).catch(() => void 0), t++));
 		}
 	} catch {}
 	return t;
-}, na = async (e) => {
-	if (!Xi(e)) return {
+}, ca = async (e) => {
+	if (!na(e)) return {
 		bytes: 0,
 		key: null
 	};
-	let t = await X.stat($i(e)).catch(() => null);
+	let t = await X.stat(aa(e)).catch(() => null);
 	if (t === null) return {
 		bytes: 0,
 		key: null
 	};
-	let n = await X.readFile(ea(e), "utf8").then((e) => JSON.parse(e), () => ({}));
+	let n = await X.readFile(oa(e), "utf8").then((e) => JSON.parse(e), () => ({}));
 	return {
 		bytes: t.size,
 		key: n.key ?? null
 	};
-}, ra = async (e) => {
-	if (!Xi(e.id)) return {
+}, la = async (e) => {
+	if (!na(e.id)) return {
 		reason: "bad-id",
-		message: `upload id must match ${String(Yi)}`
+		message: `upload id must match ${String(ta)}`
 	};
-	let t = await na(e.id);
+	let t = await ca(e.id);
 	return t.key !== null && t.key !== e.key ? {
 		reason: "key-mismatch",
 		message: "this upload id already holds a different bundle. Use a new upload id, or delete the partial upload."
-	} : e.offset === t.bytes ? (await X.mkdir(Qi(e.id), { recursive: !0 }), t.key === null && await X.writeFile(ea(e.id), JSON.stringify({
+	} : e.offset === t.bytes ? (await X.mkdir(ia(e.id), { recursive: !0 }), t.key === null && await X.writeFile(oa(e.id), JSON.stringify({
 		key: e.key,
 		startedAt: (/* @__PURE__ */ new Date()).toISOString()
 	})), await new Promise((t, n) => {
-		let r = On($i(e.id), { flags: "a" });
+		let r = On(aa(e.id), { flags: "a" });
 		r.on("error", n), r.on("finish", () => t()), r.end(Buffer.from(e.bytes));
 	}), { total: t.bytes + e.bytes.byteLength }) : {
 		reason: "offset-mismatch",
 		message: `chunk starts at ${e.offset} but the server holds ${t.bytes} byte(s)`,
 		expectedOffset: t.bytes
 	};
-}, ia = async (e) => {
-	let t = await X.stat($i(e));
+}, ua = async (e) => {
+	let t = await X.stat(aa(e));
 	return {
-		path: $i(e),
+		path: aa(e),
 		bytes: t.size
 	};
-}, aa = async (e) => {
-	Xi(e) && await X.rm(Qi(e), {
+}, da = async (e) => {
+	na(e) && await X.rm(ia(e), {
 		recursive: !0,
 		force: !0
 	}).catch(() => void 0);
-}, Q = L({ scope: "voltro:admin-import" }), oa = "VBUNDLE2", sa = (e) => {
+}, Q = L({ scope: "voltro:admin-import" }), fa = "VBUNDLE2", pa = (e) => {
 	let t = e.req.headers["x-import-rollback-key"];
 	if (e.mode !== "replace") return { options: {} };
 	if (typeof t != "string" || t.length === 0) return Q.warn("admin.import: no rollback capture — this run empties the target first, and nothing was asked to be kept. Send `x-import-rollback-key: <storage key>` (voltro data import --rollback-key <key>) to have the instance store the target's current rows before deleting them."), { options: {} };
@@ -174,37 +175,78 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 			hint: "A capture written to the pod would not survive the failure it exists for. Configure storage (the same one the storage-push export uses), or re-send without `x-import-rollback-key` to accept that a run which does not finish can leave the target emptied. Note that CONFIGURED is not the same question as SURVIVES: a `filesystem` provider pointed at a container directory with no volume behind it passes this check and dies with the pod. The run says so when it can observe it — the capture path being on the same filesystem as `/`."
 		})
 	};
-	let n = Dn(fi(), `voltro-rollback-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`), r = e.deps.putArchive;
+	let n = Dn(mi(), `voltro-rollback-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`), r = e.deps.putArchive;
 	return {
 		key: t,
 		options: {
 			rollbackDir: n,
 			onRollbackCaptured: async () => {
-				let e = hi(n);
-				e !== void 0 && Q.warn(`admin.import: ${e}`), await r(t, () => Pi({ dir: n })), Q.info("admin.import: rollback capture stored", { bundleKey: t });
+				let e = _i(n);
+				e !== void 0 && Q.warn(`admin.import: ${e}`), await r(t, () => Ri({ dir: n })), Q.info("admin.import: rollback capture stored", { bundleKey: t });
 			}
 		}
 	};
-}, ca = async function* (e) {
+}, ma = async function* (e) {
 	yield e;
-}, la = (e) => async (t) => {
-	let n = Ji(t, e.secret);
+}, ha = (e) => async (t) => {
+	let n = ea(t, e.secret);
 	if (n) return n;
-	let r = t.headers["x-import-mode"], i = t.headers["x-import-on-conflict"], a = t.headers["x-import-atomic"], o = a === "0" || a === "false" ? !1 : a === "1" || a === "true" || r === "replace", ee = t.headers["x-import-force"] === "1" || t.headers["x-import-force"] === "true", s = sa({
+	let r = t.headers["x-import-mode"], i = t.headers["x-import-on-conflict"], a = t.headers["x-import-atomic"], o = a === "0" || a === "false" ? !1 : a === "1" || a === "true" || r === "replace", ee = t.headers["x-import-force"] === "1" || t.headers["x-import-force"] === "true", s = pa({
 		req: t,
 		mode: r,
 		deps: e
 	});
 	if (s.refusal !== void 0) return s.refusal;
-	let c = t.headers["x-import-dry-run"] === "1" || t.headers["x-import-dry-run"] === "true", l = (t.headers["x-import-tables"] ?? "").split(",").map((e) => e.trim()).filter(Boolean), u = t.headers["x-import-upload-id"], d;
+	let c = t.headers["x-import-dry-run"] === "1" || t.headers["x-import-dry-run"] === "true", l = (t.headers["x-import-tables"] ?? "").split(",").map((e) => e.trim()).filter(Boolean);
+	if (t.headers["x-import-preflight"] === "1" || t.headers["x-import-preflight"] === "true") {
+		let n;
+		try {
+			n = JSON.parse(Buffer.from(t.rawBody).toString("utf8") || "{}");
+		} catch {
+			return Z(400, { error: "a preflight body must be JSON: { tables: string[] } or { bundleKey: string }" });
+		}
+		let i = Array.isArray(n.tables) ? n.tables.filter((e) => typeof e == "string") : [];
+		if (i.length === 0 && typeof n.bundleKey == "string" && n.bundleKey !== "" && e.openArchive) {
+			let t = await zi(e.openArchive(n.bundleKey), ["manifest.json"]).then((e) => e.get("manifest.json"), () => void 0);
+			if (t !== void 0) try {
+				i = (JSON.parse(Buffer.from(t).toString("utf8")).tables ?? []).map((e) => e.name).filter((e) => typeof e == "string");
+			} catch {}
+		}
+		if (i.length === 0) return Z(400, {
+			error: "a preflight needs { tables: string[] } — the bundle's table names, so the staging decision can be made against them",
+			hint: "or { bundleKey } on an instance with storage configured, where this endpoint reads the table list out of the archive itself"
+		});
+		let a = Ii({
+			mode: r ?? "upsert",
+			...e.dialect === void 0 ? {} : { targetDialect: e.dialect },
+			...e.snapshot === void 0 ? {} : { targetSnapshot: e.snapshot },
+			bundleTables: i,
+			isSkipped: Li,
+			canRunSql: !0
+		});
+		return Z(200, {
+			preflight: !0,
+			mode: r ?? "upsert",
+			atomic: o,
+			staged: a.active,
+			...a.blocker === void 0 ? {} : { reason: a.blocker },
+			stagedTables: a.tables.length,
+			rollback: s.key === void 0 ? { taken: !1 } : {
+				taken: !0,
+				key: s.key
+			},
+			dialect: e.dialect ?? null
+		});
+	}
+	let u = t.headers["x-import-upload-id"], d;
 	if (u !== void 0 && u !== "") {
-		if (ta(), t.headers["x-import-probe"] === "1") return Z(200, {
+		if (sa(), t.headers["x-import-probe"] === "1") return Z(200, {
 			uploadId: u,
-			bytes: (await na(u)).bytes
+			bytes: (await ca(u)).bytes
 		});
 		let e = t.headers["x-import-upload-key"] ?? "", n = Number(t.headers["x-import-chunk-offset"] ?? "0");
 		if (e === "" || !Number.isFinite(n) || n < 0) return Z(400, { error: "a chunked upload needs x-import-upload-key and a numeric x-import-chunk-offset" });
-		let r = await ra({
+		let r = await la({
 			id: u,
 			key: e,
 			offset: n,
@@ -223,13 +265,13 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 			uploadId: u,
 			bytes: r.total
 		});
-		d = (await ia(u)).path;
+		d = (await ua(u)).path;
 	}
-	let f = t.rawBody.byteLength >= 8 && Buffer.from(t.rawBody.subarray(0, 8)).toString("latin1") === oa, p, m;
+	let f = t.rawBody.byteLength >= 8 && Buffer.from(t.rawBody.subarray(0, 8)).toString("latin1") === fa, p, m;
 	if (d !== void 0) {
 		let { createReadStream: e } = await import("node:fs");
 		p = e(d), m = "chunked";
-	} else if (f) p = ca(t.rawBody), m = "upload";
+	} else if (f) p = ma(t.rawBody), m = "upload";
 	else {
 		let n;
 		try {
@@ -243,11 +285,11 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 	}
 	let h = await import("node:os"), g = await import("node:fs/promises"), _ = await import("node:path"), te = await g.mkdtemp(_.join(h.tmpdir(), "voltro-admin-import-"));
 	try {
-		e.assetSink ? await zi(p, {
+		e.assetSink ? await Wi(p, {
 			dir: te,
 			blobs: e.assetSink
-		}) : await Bi(p, te);
-		let t = await W.runPromiseExit(Ii({
+		}) : await Gi(p, te);
+		let t = await W.runPromiseExit(Vi({
 			store: e.store,
 			bundleDir: te,
 			...r ? { mode: r } : {},
@@ -330,20 +372,28 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 		await g.rm(te, {
 			recursive: !0,
 			force: !0
-		}), u !== void 0 && u !== "" && d !== void 0 && await aa(u);
+		}), u !== void 0 && u !== "" && d !== void 0 && await da(u);
 	}
-}, ua = L({ scope: "voltro:admin-export" }), da = async (e) => {
+}, ga = L({ scope: "voltro:admin-export" }), _a = async (e) => {
 	let t = [];
 	for await (let n of e) t.push(Buffer.from(n));
 	return new Uint8Array(Buffer.concat(t));
-}, fa = (e) => typeof e.tenant == "string" && e.tenant ? {
-	kind: "tenant",
-	tenantId: e.tenant
-} : Array.isArray(e.tables) && e.tables.length ? {
-	kind: "tables",
-	tables: e.tables.filter((e) => typeof e == "string")
-} : { kind: "all" }, pa = (e) => async (t) => {
-	let n = Ji(t, e.secret);
+}, va = (e) => Array.isArray(e) ? e.filter((e) => typeof e == "string") : [], ya = (e) => {
+	if (typeof e.tenant == "string" && e.tenant) return {
+		kind: "tenant",
+		tenantId: e.tenant
+	};
+	if (Array.isArray(e.tables) && e.tables.length) return {
+		kind: "tables",
+		tables: va(e.tables)
+	};
+	let t = va(e.exclude);
+	return t.length > 0 ? {
+		kind: "all",
+		exclude: t
+	} : { kind: "all" };
+}, ba = (e) => async (t) => {
+	let n = ea(t, e.secret);
 	if (n) return n;
 	let r;
 	try {
@@ -363,9 +413,9 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 			});
 		}
 	}
-	let a = r.consistency === "snapshot" ? "snapshot" : i.consistency ?? "live", o = (typeof r.compression == "string" ? r.compression : void 0) ?? i.compression, ee = i.scope ?? fa(r), s = typeof r.bundleKey == "string" && r.bundleKey.length > 0, c = r.assets === !0 && e.assetSource ? { blobs: e.assetSource } : {}, l = await import("node:os"), u = await import("node:fs/promises"), d = await import("node:path"), f = await u.mkdtemp(d.join(l.tmpdir(), "voltro-admin-export-"));
+	let a = r.consistency === "snapshot" ? "snapshot" : i.consistency ?? "live", o = (typeof r.compression == "string" ? r.compression : void 0) ?? i.compression, ee = i.scope ?? ya(r), s = typeof r.bundleKey == "string" && r.bundleKey.length > 0, c = r.assets === !0 && e.assetSource ? { blobs: e.assetSource } : {}, l = await import("node:os"), u = await import("node:fs/promises"), d = await import("node:path"), f = await u.mkdtemp(d.join(l.tmpdir(), "voltro-admin-export-"));
 	try {
-		let t = await W.runPromise(Fi({
+		let t = await W.runPromise(Bi({
 			store: e.store,
 			snapshot: e.snapshot,
 			dialect: e.dialect,
@@ -381,10 +431,10 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 		if (s) {
 			if (!e.putArchive) return Z(501, { error: "storage transport not configured on this instance" });
 			let i = r.bundleKey;
-			return await e.putArchive(i, () => Pi({
+			return await e.putArchive(i, () => Ri({
 				dir: f,
 				...c
-			})), ua.info("admin.export", {
+			})), ga.info("admin.export", {
 				transport: "storage",
 				tables: t.tables.length,
 				rows: n,
@@ -398,11 +448,11 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 				transport: "storage"
 			});
 		}
-		let u = await da(Pi({
+		let u = await _a(Ri({
 			dir: f,
 			...c
 		}));
-		return ua.info("admin.export", {
+		return ga.info("admin.export", {
 			transport: "download",
 			tables: t.tables.length,
 			rows: n,
@@ -419,7 +469,7 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 			}
 		};
 	} catch (e) {
-		return ua.warn("admin.export failed", { error: e?.message ?? String(e) }), Z(500, {
+		return ga.warn("admin.export failed", { error: e?.message ?? String(e) }), Z(500, {
 			error: "export failed",
 			message: e?.message ?? String(e)
 		});
@@ -429,8 +479,51 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 			force: !0
 		});
 	}
-}, ma = (e, t, n = {}) => (async function* () {
-	let r = await W.runPromise(_i(e, t).pipe(W.timeout(n.openTimeout ?? "30 seconds"))), i = await yi(r.stream), a = n.stallMs ?? 12e4, o, ee = () => {
+}, xa = async (e, t) => await e.query({
+	table: H,
+	order: [{
+		column: "startedAt",
+		direction: "desc"
+	}],
+	predicate: void 0,
+	projection: void 0,
+	skip: 0,
+	take: t
+}), Sa = (e) => ({
+	...e,
+	startedAt: new Date(e.startedAt),
+	finishedAt: e.finishedAt === null ? null : new Date(e.finishedAt)
+}), Ca = (e) => async (t) => {
+	let n = ea(t, e.secret, "GET");
+	if (n) return n;
+	let r = Number(new URLSearchParams(t.query ?? "").get("limit") ?? "20"), i = Number.isFinite(r) ? Math.max(1, Math.min(200, Math.trunc(r))) : 20, a;
+	try {
+		a = (await xa(e.store, i)).map(Sa);
+	} catch (e) {
+		return Z(409, {
+			error: "no import history",
+			message: `this instance has no \`${H}\` table, so no import has been recorded. Run \`voltro db apply\` against it; imports themselves are unaffected.`,
+			detail: e?.message ?? String(e)
+		});
+	}
+	return Z(200, {
+		running: a.filter((e) => e.finishedAt === null && e.failure === null).length,
+		runs: a.map((e) => ({
+			id: e.id,
+			startedAt: e.startedAt.toISOString(),
+			finishedAt: e.finishedAt === null ? null : e.finishedAt.toISOString(),
+			mode: e.mode,
+			via: e.via,
+			bundle: e.bundle,
+			sourceFingerprint: e.sourceFingerprint,
+			tablesWritten: e.tablesWritten,
+			rowsWritten: e.rowsWritten,
+			failure: e.failure,
+			line: Yn(e)
+		}))
+	});
+}, wa = (e, t, n = {}) => (async function* () {
+	let r = await W.runPromise(yi(e, t).pipe(W.timeout(n.openTimeout ?? "30 seconds"))), i = await xi(r.stream), a = n.stallMs ?? 12e4, o, ee = () => {
 		o && clearTimeout(o), o = setTimeout(() => i.destroy(/* @__PURE__ */ Error(`storage read stalled for ${a}ms reading '${t}'`)), a);
 	};
 	try {
@@ -439,7 +532,7 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 	} finally {
 		o && clearTimeout(o), i.destroy();
 	}
-})(), ha = {
+})(), Ta = {
 	get: async () => void 0,
 	set: async () => {},
 	setWithTags: async () => {},
@@ -448,26 +541,26 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 	clear: async () => {},
 	invalidateTag: async () => 0,
 	wrap: async (e, t, n) => n()
-}, ga = async (e) => {
+}, Ea = async (e) => {
 	d(e.appProcedures ?? e.discovered, {
 		defaultDeny: e.security?.defaultDeny ?? !0,
 		commandHint: "`voltro serve`"
-	}), ei({
+	}), ni({
 		dataStore: e.store,
 		schemaRegistry: e.schemaRegistry
 	});
-	let t = (e.discovered.budgets?.length ?? 0) > 0, n, r = new or({
+	let t = (e.discovered.budgets?.length ?? 0) > 0, n, r = new sr({
 		store: e.store,
 		...e.snapshotCache ? { cache: e.snapshotCache } : {},
 		...e.reactive === void 0 ? {} : { reactive: e.reactive },
 		...t ? { recordCost: (e) => n?.record(e) } : {},
-		recordDelivery: (e) => Jr({
+		recordDelivery: (e) => Xr({
 			label: e.label,
 			kind: e.kind,
 			durationMs: e.durationMs,
 			rowCount: e.rowCount
 		})
-	}), i = e.cache ?? ha, a = e.kv ?? Kr, o, ee = () => void 0, c, l, u, f, p, m, h, _ = ue({
+	}), i = e.cache ?? Ta, a = e.kv ?? Jr, o, ee = () => void 0, c, l, u, f, p, m, h, _ = ue({
 		store: e.store,
 		warn: (e, t) => {
 			process.stderr.write(`[workflow] ${e} ${JSON.stringify(t)}\n`);
@@ -475,16 +568,16 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 	}), te = _.remember, ae = _.resolve, oe = xt({
 		authority: e.authority,
 		getStore: () => e.store
-	}), S = (e.discovered.workflows?.length ?? 0) > 0 ? Fr(() => o) : void 0, de = (e.discovered.workflows?.length ?? 0) > 0 || (e.discovered.eventTriggers?.length ?? 0) > 0, he = de || (e.discovered.workflowWorkers?.length ?? 0) > 0 || e.scheduleCoordination === "cluster", ge = e.tenantIsolation === "namespace", _e = (e.log ?? L({ scope: "voltro:serve" })).child("webhooks"), ve, ye, C = e.discovered.webhooks;
+	}), S = (e.discovered.workflows?.length ?? 0) > 0 ? Lr(() => o) : void 0, de = (e.discovered.workflows?.length ?? 0) > 0 || (e.discovered.eventTriggers?.length ?? 0) > 0, he = de || (e.discovered.workflowWorkers?.length ?? 0) > 0 || e.scheduleCoordination === "cluster", ge = e.tenantIsolation === "namespace", _e = (e.log ?? L({ scope: "voltro:serve" })).child("webhooks"), ve, ye, C = e.discovered.webhooks;
 	if (C && C.outgoing.length > 0 && e.workflowEngineLayer !== void 0) {
 		e.workflowEngineLayer;
-		let t = ut({
+		let t = dt({
 			store: e.store,
 			schemaRegistry: e.schemaRegistry,
 			cache: i,
 			kv: a
 		}), n = C.outgoing.map((e) => e.descriptor);
-		ye = Di.toLayer(wi(t, { events: n })), ve = Ti(t, async (e) => {
+		ye = ki.toLayer(Ei(t, { events: n })), ve = Di(t, async (e) => {
 			let t = u;
 			if (t === void 0) {
 				_e.error("webhook delivery skipped — the workflow runtime was never built. This is a framework defect, not a configuration problem: report it with your engine setting. Deliveries are NOT queued and will not be retried.", {
@@ -493,7 +586,7 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 				});
 				return;
 			}
-			t.runPromise(Di.execute(e)).catch((t) => {
+			t.runPromise(ki.execute(e)).catch((t) => {
 				_e.error("deliverWebhook workflow crashed", {
 					deliveryId: e.deliveryId,
 					targetId: e.targetId
@@ -503,9 +596,9 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 	}
 	let Se = /* @__PURE__ */ new Map();
 	if (C) for (let e of C.incoming) {
-		let t = e.descriptor.path ?? Ei(e.descriptor.id), n = `VOLTRO_WEBHOOK_SECRET_${e.descriptor.id.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`, r = ki(e.descriptor, {
+		let t = e.descriptor.path ?? Oi(e.descriptor.id), n = `VOLTRO_WEBHOOK_SECRET_${e.descriptor.id.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`, r = ji(e.descriptor, {
 			resolveSecret: async () => process.env[n] ?? null,
-			resolveWorkflows: () => S === void 0 ? void 0 : Wr(S, {
+			resolveWorkflows: () => S === void 0 ? void 0 : Kr(S, {
 				traceId: `incoming:${e.descriptor.id}`,
 				source: `incoming:${e.descriptor.id}`
 			}),
@@ -522,11 +615,11 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 		});
 		Se.set(t, { handle: r });
 	}
-	wr(), Xr((t) => Tr(e.store, t.subjectId, t.resourceType, t.resourceId)) || L({ scope: "voltro:serve" }).info("policy guards: using the app-registered tuple source");
+	Er(), Y((t) => Dr(e.store, t.subjectId, t.resourceType, t.resourceId)) || L({ scope: "voltro:serve" }).info("policy guards: using the app-registered tuple source");
 	let Ce = [], Te = [...e.discovered.outboxHandlers ?? [], ..._n((C?.outgoing.length ?? 0) + (C?.incoming.length ?? 0) + (C?.providers.length ?? 0), []) ? [{
 		file: "<framework>/webhooks",
 		id: "voltro-webhook-emit",
-		definition: Oi(() => ve)
+		definition: Ai(() => ve)
 	}] : []], Ee = Te.length > 0 ? Fe({
 		handlers: Te,
 		store: e.store,
@@ -544,7 +637,7 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 		publicUrl: b(e.port ?? 4e3),
 		log: (e.log ?? L({ scope: "voltro:serve" })).child("connections")
 	});
-	ot({
+	st({
 		events: e.discovered.events ?? [],
 		rpcTags: [
 			...e.discovered.queries.map((e) => e.descriptor.name),
@@ -553,16 +646,16 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 			...(e.discovered.streams ?? []).map((e) => e.descriptor.name)
 		]
 	});
-	let Ae = (e.log ?? L({ scope: "voltro:serve" })).child("events"), je = e.broadcastNamespace ?? Qe(e.plugins, void 0), Me = E(e.plugins, je, Ae), Ne = e.membership?.instanceId ?? process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, Ie = e.membership ?? Mt(e.plugins, {
+	let Ae = (e.log ?? L({ scope: "voltro:serve" })).child("events"), je = e.broadcastNamespace ?? $e(e.plugins, void 0), Me = E(e.plugins, je, Ae), Ne = e.membership?.instanceId ?? process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, Ie = e.membership ?? Mt(e.plugins, {
 		instanceId: Ne,
 		namespace: je,
 		meta: { mode: "serve" },
 		logger: Ae
-	}), D = fe({
+	}), Le = fe({
 		events: e.discovered.events ?? [],
 		origin: Ne,
 		...Me.publishRemote === void 0 ? {} : { publishRemote: Me.publishRemote }
-	}), Le = (e.discovered.events ?? []).length > 0 ? await Me.attach(D.bus) : null, Re = Ue({
+	}), Re = (e.discovered.events ?? []).length > 0 ? await Me.attach(Le.bus) : null, ze = We({
 		store: e.store,
 		schemaRegistry: e.schemaRegistry,
 		cache: i,
@@ -575,78 +668,78 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 		...e.resolveResidentStore === void 0 ? {} : { resolveResidentStore: e.resolveResidentStore },
 		...Ee === void 0 ? {} : { outbox: { nudge: Ee.nudge } },
 		...w.active ? { connections: { registry: w.registry } } : {},
-		eventBus: D.bus
-	}), ze = G.succeed(rr, g), Be = G.succeed(sr, Rt), He = G.succeed(ir, Ve), Ge = G.succeed(cr, we), qe = (t, n) => {
-		let r = t.pipe(W.provide(Pr(n)));
-		return (e.baseLayer ? r.pipe(W.provide(e.baseLayer)) : r).pipe(W.provide(ze)).pipe(W.provide(Be)).pipe(W.provide(He)).pipe(W.provide(Ge));
-	}, Ye = (e, t) => {
-		let n = qe(e, t);
-		return Y(n);
-	}, Xe = bn(), et = le(e.plugins ?? [], Xe), tt = Oe({
+		eventBus: Le.bus
+	}), Be = G.succeed(ar, g), Ve = G.succeed(cr, Rt), Ue = G.succeed(K, He), Ke = G.succeed(lr, we), Je = (t, n) => {
+		let r = t.pipe(W.provide(Ir(n)));
+		return (e.baseLayer ? r.pipe(W.provide(e.baseLayer)) : r).pipe(W.provide(Be)).pipe(W.provide(Ve)).pipe(W.provide(Ue)).pipe(W.provide(Ke));
+	}, Xe = (e, t) => {
+		let n = Je(e, t);
+		return ei(n);
+	}, Ze = bn(), tt = le(e.plugins ?? [], Ze), nt = Oe({
 		plugins: e.plugins ?? [],
-		metrics: Xe,
+		metrics: Ze,
 		log: e.log ?? L({ scope: "voltro:serve" })
-	}), nt = x(e.plugins ?? [], Xe), rt = e.security?.defaultDeny ?? !0, at = Lr({
+	}), rt = x(e.plugins ?? [], Ze), it = e.security?.defaultDeny ?? !0, ot = zr({
 		store: e.store,
-		defaultDeny: rt,
+		defaultDeny: it,
 		recordMetric: (e) => {
-			Xe.record(e);
+			Ze.record(e);
 		},
-		...et.mutation === void 0 ? {} : { interceptor: et.mutation },
-		buildContext: (e, t, n) => Re(e, t, n),
-		runEffect: Ye,
+		...tt.mutation === void 0 ? {} : { interceptor: tt.mutation },
+		buildContext: (e, t, n) => ze(e, t, n),
+		runEffect: Xe,
 		undoCapture: s()
-	}), ct = be();
+	}), lt = be();
 	{
-		let t = Je();
+		let t = Ye();
 		t !== void 0 && (e.log ?? L({ scope: "voltro:serve" })).info(t);
 	}
-	let lt = Pe({
+	let ut = Pe({
 		store: e.store,
 		...e.approvals === void 0 ? {} : { defaultExpiryMs: e.approvals.defaultExpiryMs }
-	}), ft = Er({
-		defaultDeny: rt,
-		buildContext: (e) => Re(e),
-		runEffect: Ye,
+	}), pt = Or({
+		defaultDeny: it,
+		buildContext: (e) => ze(e),
+		runEffect: Xe,
 		recordMetric: (e) => {
-			Xe.record(e);
+			Ze.record(e);
 		},
-		...et.action === void 0 ? {} : { interceptor: et.action }
-	}), pt = Br({
+		...tt.action === void 0 ? {} : { interceptor: tt.action }
+	}), mt = Hr({
 		tenantScopedTables: e.tenantScopedTables,
 		softDeleteScopedTables: e.softDeleteScopedTables
-	}), mt = {
-		defaultDeny: rt,
-		buildContext: (e) => Re(e),
-		finalize: (e, t) => pt(e, t.subject),
-		provideEffect: qe,
-		...et.query === void 0 ? {} : { interceptor: et.query }
-	}, gt = zr(mt), O = Rr({
-		...mt,
-		queryRows: (t, n) => e.store.query(t).then((e) => ai(t.table, e, n.subject))
-	}), _t = Hr({
-		...mt,
+	}), ht = {
+		defaultDeny: it,
+		buildContext: (e) => ze(e),
+		finalize: (e, t) => mt(e, t.subject),
+		provideEffect: Je,
+		...tt.query === void 0 ? {} : { interceptor: tt.query }
+	}, D = Vr(ht), O = Br({
+		...ht,
+		queryRows: (t, n) => e.store.query(t).then((e) => si(t.table, e, n.subject))
+	}), _t = Ur({
+		...ht,
 		subscribeDescriptor: (e, t, n) => r.subscribe(e, t, n),
 		subscribeComputed: (e, t, n) => r.subscribeComputed(e, t, n)
 	}), k = (e) => e.filter((e) => Pn(e.descriptor)), A = {};
 	for (let t of [
 		...k(e.discovered.queries),
-		...ct.queries,
 		...lt.queries,
+		...ut.queries,
 		...w.queries
-	]) A[t.descriptor.name] = (e) => q(gt(t, e), r, `subscription.${t.descriptor.name}`, void 0, void 0, Vr(t, e));
+	]) A[t.descriptor.name] = (e) => _r(D(t, e), r, `subscription.${t.descriptor.name}`, void 0, void 0, J(t, e));
 	for (let t of [
 		...k(e.discovered.mutations),
-		...ct.mutations,
 		...lt.mutations,
+		...ut.mutations,
 		...w.mutations
 	]) {
-		let n = Ir(t.descriptor.output);
-		A[t.descriptor.name] = (r) => K(async (e, n) => at(t, e, n), r, `mutation.${t.descriptor.name}`, n, e.idempotency, Ln(t.descriptor, "mutation"));
+		let n = Rr(t.descriptor.output);
+		A[t.descriptor.name] = (r) => q(async (e, n) => ot(t, e, n), r, `mutation.${t.descriptor.name}`, n, e.idempotency, Ln(t.descriptor, "mutation"));
 	}
 	for (let t of [...k(e.discovered.actions), ...w.actions]) {
-		let n = Ir(t.descriptor.output);
-		A[t.descriptor.name] = (r) => K(async (e, n) => ft(t, e, n), r, `action.${t.descriptor.name}`, n, e.idempotency, Ln(t.descriptor, "action"));
+		let n = Rr(t.descriptor.output);
+		A[t.descriptor.name] = (r) => q(async (e, n) => pt(t, e, n), r, `action.${t.descriptor.name}`, n, e.idempotency, Ln(t.descriptor, "action"));
 	}
 	let vt = () => `public-${Math.random().toString(36).slice(2, 10)}`, yt = [
 		...e.discovered.queries.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
@@ -662,14 +755,14 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 		})),
 		...e.discovered.mutations.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
 			descriptor: e.descriptor,
-			invoke: (t, n) => at(e, t, {
+			invoke: (t, n) => ot(e, t, {
 				subject: n.subject,
 				traceId: vt()
 			})
 		})),
 		...e.discovered.actions.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
 			descriptor: e.descriptor,
-			invoke: (t, n) => ft(e, t, {
+			invoke: (t, n) => pt(e, t, {
 				subject: n.subject,
 				traceId: vt()
 			})
@@ -681,13 +774,13 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 			actions: e.discovered.actions,
 			descriptorOf: (e) => e.descriptor,
 			runQuery: (e, t, n) => Promise.resolve(O(e, t, n)),
-			runMutation: (e, t, n) => Promise.resolve(at(e, t, n)),
-			runAction: (e, t, n) => Promise.resolve(ft(e, t, n))
+			runMutation: (e, t, n) => Promise.resolve(ot(e, t, n)),
+			runAction: (e, t, n) => Promise.resolve(pt(e, t, n))
 		}),
 		policy: e.agents?.tools ?? {},
 		mcpEnabled: e.agents?.mcp === !0,
 		resolveSubject: (t) => e.resolveSubject(t, -1).then((e) => e.subject)
-	}, St = ht({
+	}, St = gt({
 		...e.restRoutes === void 0 ? {} : { restRoutes: e.restRoutes },
 		publicApiEntries: yt,
 		store: e.store,
@@ -695,61 +788,72 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 		...e.idempotency === void 0 ? {} : { idempotency: e.idempotency },
 		log: e.log ?? L({ scope: "voltro:serve" })
 	}), Ct = e.dataTransferSecret ?? process.env.VOLTRO_DATA_TRANSFER_SECRET, wt = async (e, t) => {
-		let { Readable: n } = await import("node:stream"), r = mi(), i = gi("storage", () => n.from(t()));
-		await W.runPromise(vi(r, e, i, { contentType: "application/octet-stream" }));
-	}, Tt = Ct && Ct.length >= 16 ? [{
-		method: "POST",
-		path: Wi,
-		handle: la({
-			secret: Ct,
-			store: e.store,
-			...e.dataTransferSnapshot ? { snapshot: e.dataTransferSnapshot } : {},
-			...e.dataTransferDialect ? { dialect: e.dataTransferDialect } : {},
-			assetSink: Li(mi()),
-			openArchive: (e) => ma(mi(), e),
-			refreshSubscriptions: (e) => {
-				r.refreshAll(e);
-			},
-			putArchive: wt,
-			...e.dataTransferDialect ? { dialect: e.dataTransferDialect } : {}
-		})
-	}, {
-		method: "POST",
-		path: Gi,
-		handle: pa({
-			secret: Ct,
-			store: e.store,
-			snapshot: e.dataTransferSnapshot ?? { tables: [] },
-			dialect: e.dataTransferDialect ?? "memory",
-			tenantTables: [...e.tenantScopedTables],
-			loadProfile: wn,
-			assetSource: Ri(mi(), e.store),
-			putArchive: wt
-		})
-	}] : [], Et = [
+		let { Readable: n } = await import("node:stream"), r = gi(), i = vi("storage", () => n.from(t()));
+		await W.runPromise(bi(r, e, i, { contentType: "application/octet-stream" }));
+	}, Tt = Ct && Ct.length >= 16 ? [
+		{
+			method: "POST",
+			path: Yi,
+			handle: ha({
+				secret: Ct,
+				store: e.store,
+				...e.dataTransferSnapshot ? { snapshot: e.dataTransferSnapshot } : {},
+				...e.dataTransferDialect ? { dialect: e.dataTransferDialect } : {},
+				assetSink: Hi(gi()),
+				openArchive: (e) => wa(gi(), e),
+				refreshSubscriptions: (e) => {
+					r.refreshAll(e);
+				},
+				putArchive: wt,
+				...e.dataTransferDialect ? { dialect: e.dataTransferDialect } : {}
+			})
+		},
+		{
+			method: "GET",
+			path: Zi,
+			handle: Ca({
+				secret: Ct,
+				store: e.store
+			})
+		},
+		{
+			method: "POST",
+			path: Xi,
+			handle: ba({
+				secret: Ct,
+				store: e.store,
+				snapshot: e.dataTransferSnapshot ?? { tables: [] },
+				dialect: e.dataTransferDialect ?? "memory",
+				tenantTables: [...e.tenantScopedTables],
+				loadProfile: wn,
+				assetSource: Ui(gi(), e.store),
+				putArchive: wt
+			})
+		}
+	] : [], Et = [
 		...e.httpRoutes ?? [],
 		...St.httpRoutes,
 		...Tt,
 		...w.httpRoutes
 	];
-	Object.assign(A, D.handlers);
-	for (let t of k(e.discovered.streams ?? [])) A[t.descriptor.name] = (n) => hr((r) => ci(r, (r) => {
-		let i = Re(r), a = t.executor(n, i);
+	Object.assign(A, Le.handlers);
+	for (let t of k(e.discovered.streams ?? [])) A[t.descriptor.name] = (n) => gr((r) => ui(r, (r) => {
+		let i = ze(r), a = t.executor(n, i);
 		if (W.isEffect(a)) {
-			let t = a.pipe(W.provide(Pr(i.store)));
-			return (e.baseLayer ? t.pipe(W.provide(e.baseLayer)) : t).pipe(W.provide(ze)).pipe(W.provide(Be)).pipe(W.provide(He)).pipe(W.provide(Ge));
+			let t = a.pipe(W.provide(Ir(i.store)));
+			return (e.baseLayer ? t.pipe(W.provide(e.baseLayer)) : t).pipe(W.provide(Be)).pipe(W.provide(Ve)).pipe(W.provide(Ue)).pipe(W.provide(Ke));
 		}
 		return typeof a == "object" && a && typeof a.then == "function" ? W.promise(() => a) : a;
 	}), `stream.${t.descriptor.name}`);
-	for (let t of e.discovered.workflows ?? []) A[t.definition.name] = (e) => K(async (e, n) => {
+	for (let t of e.discovered.workflows ?? []) A[t.definition.name] = (e) => q(async (e, n) => {
 		let r = n;
-		return Wr(S, {
+		return Kr(S, {
 			subject: r.subject,
 			traceId: r.traceId,
 			source: "workflow-rpc"
 		}).start(t.definition.name, e);
 	}, e, `workflow.${t.definition.name}`);
-	de && (A[Vn.name] = (e) => q(gt({
+	de && (A[Vn.name] = (e) => _r(D({
 		descriptor: Vn,
 		executor: (e) => {
 			let t = e.id;
@@ -759,13 +863,13 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 					column: "startedAt",
 					direction: "desc"
 				}],
-				predicate: Yn(U("id", t), U("executionId", t)),
+				predicate: Zn(U("id", t), U("executionId", t)),
 				take: 1,
 				skip: void 0,
 				projection: void 0
 			};
 		}
-	}, e), r, `subscription.${Vn.name}`), A[Un.name] = (e) => q(gt({
+	}, e), r, `subscription.${Vn.name}`), A[Un.name] = (e) => _r(D({
 		descriptor: Un,
 		executor: (e) => {
 			let t = e, n = [...t.tag === void 0 ? [] : [U("tag", t.tag)], ...t.status === void 0 ? [] : [U("status", t.status)]], r = Number.isFinite(t.limit) && t.limit !== void 0 ? Math.min(Math.max(Math.floor(t.limit), 1), 500) : 100;
@@ -775,13 +879,13 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 					column: "startedAt",
 					direction: "desc"
 				}],
-				predicate: n.length === 0 ? void 0 : n.length === 1 ? n[0] : H(...n),
+				predicate: n.length === 0 ? void 0 : n.length === 1 ? n[0] : qn(...n),
 				take: r,
 				skip: void 0,
 				projection: void 0
 			};
 		}
-	}, e), r, `subscription.${Un.name}`), A[Hn.name] = (e) => q(gt({
+	}, e), r, `subscription.${Un.name}`), A[Hn.name] = (e) => _r(D({
 		descriptor: Hn,
 		executor: (e) => {
 			let t = e.runId;
@@ -797,7 +901,7 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 				projection: void 0
 			};
 		}
-	}, e), r, `subscription.${Hn.name}`), A[Bn.name] = (e) => q(gt({
+	}, e), r, `subscription.${Hn.name}`), A[Bn.name] = (e) => _r(D({
 		descriptor: Bn,
 		executor: (e) => {
 			let t = e.runId;
@@ -813,7 +917,7 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 				projection: void 0
 			};
 		}
-	}, e), r, `subscription.${Bn.name}`), A[B.name] = (e) => q(gt({
+	}, e), r, `subscription.${Bn.name}`), A[B.name] = (e) => _r(D({
 		descriptor: B,
 		executor: (e) => {
 			let t = e;
@@ -829,7 +933,7 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 				projection: void 0
 			};
 		}
-	}, e), r, `subscription.${B.name}`), A[V.name] = (e) => q(gt({
+	}, e), r, `subscription.${B.name}`), A[V.name] = (e) => _r(D({
 		descriptor: V,
 		executor: (e) => {
 			let t = e.eventId;
@@ -845,16 +949,16 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 				projection: void 0
 			};
 		}
-	}, e), r, `subscription.${V.name}`), A[Rn.name] = (t) => K(async (t, n) => {
+	}, e), r, `subscription.${V.name}`), A[Rn.name] = (t) => q(async (t, n) => {
 		let r = t;
 		return await j(e.store, n.subject, { executionId: r.executionId }), await S.cancel(r.workflowName, r.executionId), await Ft(r.workflowName, r.executionId, "workflow.cancel"), { ok: !0 };
-	}, t, `action.${Rn.name}`), A[zn.name] = (t) => K(async (t, n) => {
+	}, t, `action.${Rn.name}`), A[zn.name] = (t) => q(async (t, n) => {
 		let r = t;
 		return await j(e.store, n.subject, { executionId: r.executionId }), await S.resume(r.workflowName, r.executionId), { ok: !0 };
-	}, t, `action.${zn.name}`), A[Wn.name] = (t) => K(async (t, n) => {
+	}, t, `action.${zn.name}`), A[Wn.name] = (t) => q(async (t, n) => {
 		let r = t;
 		return await j(e.store, n.subject, { id: r.id }), S.signal({ id: r.id }, r.signalName, r.payload);
-	}, t, `action.${Wn.name}`), A[Gn.name] = (t) => K(async (t, n) => {
+	}, t, `action.${Wn.name}`), A[Gn.name] = (t) => q(async (t, n) => {
 		let r = t;
 		return await j(e.store, n.subject, { id: r.id }), S.update({ id: r.id }, r.updateName, r.payload, r.timeoutMs === void 0 ? void 0 : { timeoutMs: r.timeoutMs });
 	}, t, `action.${Gn.name}`));
@@ -862,16 +966,16 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 		...k(e.discovered.queries).map((e) => z(e.descriptor)),
 		...k(e.discovered.mutations).map((e) => Fn(e.descriptor)),
 		...k(e.discovered.actions).map((e) => R(e.descriptor)),
-		...ct.queries.map((e) => z(e.descriptor)),
-		...ct.mutations.map((e) => Fn(e.descriptor)),
 		...lt.queries.map((e) => z(e.descriptor)),
 		...lt.mutations.map((e) => Fn(e.descriptor)),
+		...ut.queries.map((e) => z(e.descriptor)),
+		...ut.mutations.map((e) => Fn(e.descriptor)),
 		...w.queries.map((e) => z(e.descriptor)),
 		...w.mutations.map((e) => Fn(e.descriptor)),
 		...w.actions.map((e) => R(e.descriptor)),
 		...k(e.discovered.streams ?? []).map((e) => In(e.descriptor)),
-		...D.rpcs,
-		...(e.discovered.workflows ?? []).map((e) => li(e.definition)),
+		...Le.rpcs,
+		...(e.discovered.workflows ?? []).map((e) => di(e.definition)),
 		...de ? [
 			z(Vn),
 			z(Un),
@@ -884,14 +988,14 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 			R(Wn),
 			R(Gn)
 		] : []
-	], Ot = pi.make(...Dt).middleware(jn).middleware(Mn), kt = Mr({ resolveSubject: ({ headers: t, clientId: n }) => e.resolveSubject(t, n) }), At = e.dormancyTenantId ?? ar, Nt = e.dormancy === "sleep" ? {
-		register: (t, n, r) => Zr(e.store, {
+	], Ot = hi.make(...Dt).middleware(jn).middleware(Mn), kt = Pr({ resolveSubject: ({ headers: t, clientId: n }) => e.resolveSubject(t, n) }), At = e.dormancyTenantId ?? or, Nt = e.dormancy === "sleep" ? {
+		register: (t, n, r) => Qr(e.store, {
 			tenantId: r ?? At,
 			kind: "workflow",
 			refId: t,
 			wakeAt: n
 		}),
-		cancel: (t, n) => _r(e.store, {
+		cancel: (t, n) => yr(e.store, {
 			tenantId: n ?? At,
 			kind: "workflow",
 			refId: t
@@ -942,8 +1046,8 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 			}
 		}), a && await Pt(n, "cancelled");
 	}, It = [
-		...Gr(e.discovered.workflows ?? [], {
-			buildContext: (t, n) => e.buildContextForWorkflow?.(t, n) ?? Re({
+		...qr(e.discovered.workflows ?? [], {
+			buildContext: (t, n) => e.buildContextForWorkflow?.(t, n) ?? ze({
 				subject: t.subject,
 				traceId: t.traceId
 			}, e.store, void 0, `workflow:${n.workflowName}`, { parentExecutionId: n.executionId }),
@@ -963,13 +1067,13 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 				parentExecutionId: r?.parentExecutionId ?? null,
 				parentClosePolicy: r?.parentClosePolicy ?? null,
 				onParentClose: ({ executionId: e, status: t }) => Pt(e, t),
-				...dt(t.definition),
+				...ft(t.definition),
 				onTerminal: async ({ executionId: e }) => {
 					await l?.gate.release(e);
 				},
 				recorder: N,
-				pluginWorkflowStepLayer: nt,
-				recordRun: Yr
+				pluginWorkflowStepLayer: rt,
+				recordRun: Zr
 			}, n);
 		}),
 		...e.discovered.workflowWorkers ?? [],
@@ -977,11 +1081,11 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 	], Lt = [...(e.discovered.workflows ?? []).map((e) => e.definition.name).filter(Boolean), ...ye === void 0 ? [] : ["voltro.deliverWebhook"]], zt = It.length > 0 ? G.mergeAll(...It) : G.empty;
 	if (((e.discovered.workflows?.length ?? 0) > 0 || (e.discovered.workflowWorkers?.length ?? 0) > 0 || e.scheduleCoordination === "cluster" || ye !== void 0) && e.workflowEngineLayer !== void 0) {
 		let t = zt.pipe(G.provideMerge(e.workflowEngineLayer));
-		u = Zn.make(e.baseLayer === void 0 ? t : t.pipe(G.provideMerge(e.baseLayer))), await u.runPromise(W.void), (e.log ?? L({ scope: "voltro:serve" })).child("workflow").info(`workflow runtime ready — ${Lt.length} entity type(s) registered`, { entities: Lt });
+		u = $n.make(e.baseLayer === void 0 ? t : t.pipe(G.provideMerge(e.baseLayer))), await u.runPromise(W.void), (e.log ?? L({ scope: "voltro:serve" })).child("workflow").info(`workflow runtime ready — ${Lt.length} entity type(s) registered`, { entities: Lt });
 		let n = await import("@voltro/workflow/cluster"), r = (e) => u.runPromise(n.redriveFailedRun(e)), i = (e) => u.runPromise(n.resumeRunFromStep(e));
 		m = await Bt({
-			provider: Ni(e.plugins ?? [])?.broadcast?.provider,
-			crossReplica: Ni(e.plugins ?? [])?.broadcast?.crossReplica ?? !1,
+			provider: Fi(e.plugins ?? [])?.broadcast?.provider,
+			crossReplica: Fi(e.plugins ?? [])?.broadcast?.crossReplica ?? !1,
 			namespace: je,
 			replicaId: crypto.randomUUID(),
 			pollStorage: () => u.runPromise(n.pollWorkflowStorage),
@@ -1030,7 +1134,7 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 				reason: n.outcome.reason
 			};
 		};
-		let a = (e.scheduleCoordination ?? "single") === "advisoryLock" ? Dr(e.store, e.scheduleReplicaId ?? `pid-${process.pid}`) : ni, s = Nr({
+		let a = (e.scheduleCoordination ?? "single") === "advisoryLock" ? kr(e.store, e.scheduleReplicaId ?? `pid-${process.pid}`) : ii, s = Fr({
 			coordinator: a,
 			replicaId: e.scheduleReplicaId ?? `pid-${process.pid}`
 		}), d = {
@@ -1055,7 +1159,7 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 				closeChildrenForParent: Pt
 			}), h;
 		};
-		ee = g, l = $e({
+		ee = g, l = et({
 			store: e.store,
 			onChange: (t) => e.store.onChange((e) => t({
 				table: e.table,
@@ -1075,7 +1179,7 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 			...e.workflowSuspendSignalHintMs === void 0 ? {} : { suspendSignalHintMs: e.workflowSuspendSignalHintMs },
 			scheduleCoordinated: s,
 			onAbandoned: async (t) => {
-				await We({
+				await Ge({
 					workflows: e.discovered.workflows ?? [],
 					facade: () => o,
 					log: d,
@@ -1085,7 +1189,7 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 			log: d
 		});
 		let _ = l;
-		_ !== void 0 && qr(() => _.stop()), c = Ze({
+		_ !== void 0 && Yr(() => _.stop()), c = Qe({
 			store: e.store,
 			onChange: (t) => e.store.onChange((e) => t({
 				table: e.table,
@@ -1099,7 +1203,7 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 			resumeSignal: () => u === void 0 || M === void 0 ? void 0 : async ({ executionId: t, workflowName: n, signalName: r, payload: i }) => {
 				await u.runPromise(M.completeSuspendingSignal({
 					store: e.store,
-					target: Ke(t, n),
+					target: qe(t, n),
 					signalName: r,
 					payload: i
 				}));
@@ -1109,7 +1213,7 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 			log: d
 		});
 		let v = c;
-		v !== void 0 && qr(() => v.stop()), o = (e.discovered.workflows?.length ?? 0) > 0 ? J({
+		v !== void 0 && Yr(() => v.stop()), o = (e.discovered.workflows?.length ?? 0) > 0 ? Gr({
 			workflows: e.discovered.workflows ?? [],
 			runEffect: (e) => u.runPromise(e),
 			onEnqueue: () => m?.publishWake(),
@@ -1155,13 +1259,13 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 			}, t).then((e) => e.outcome)
 		}) : void 0;
 	}
-	let Vt = G.mergeAll(Ot.toLayer(A), kt), Ht = it(A, e.discovered.queries.map((e) => e.descriptor.name), de), Ut = G.mergeAll(Ot.toLayer(Ht), kt), P = e.observability, Wt = await gr({
+	let Vt = G.mergeAll(Ot.toLayer(A), kt), Ht = at(A, e.discovered.queries.map((e) => e.descriptor.name), de), Ut = G.mergeAll(Ot.toLayer(Ht), kt), P = e.observability, Wt = await vr({
 		...e.appName === void 0 ? {} : { serviceName: e.appName },
 		...P && P.spanProcessors.length > 0 ? { extraSpanProcessors: P.spanProcessors } : {},
 		...P && P.metricReaders.length > 0 ? { extraMetricReaders: P.metricReaders } : {},
 		...P && Object.keys(P.resourceAttributes).length > 0 ? { resourceAttributes: P.resourceAttributes } : {},
 		...P && P.sampler !== void 0 ? { sampler: P.sampler } : {}
-	}), Gt = !1, F = e.store.ping ? () => e.store.ping().then(() => !0).catch(() => !1) : void 0, { server: Kt, shutdown: qt } = ri({
+	}), Gt = !1, F = e.store.ping ? () => e.store.ping().then(() => !0).catch(() => !1) : void 0, { server: Kt, shutdown: qt } = ai({
 		group: Ot,
 		handlersLayer: Vt,
 		httpHandlersLayer: Ut,
@@ -1170,7 +1274,7 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 		path: e.path ?? "/ws",
 		tracerLayer: Wt.layer,
 		security: re(e),
-		...tt,
+		...nt,
 		healthCheck: {
 			isReady: () => Gt,
 			...F ? { ping: F } : {}
@@ -1179,10 +1283,10 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 		...e.getStore === void 0 ? {} : { getStore: e.getStore },
 		...Se.size > 0 ? { webhookRoutes: Se } : {},
 		...e.inspectRoute === void 0 ? {} : { inspectRoute: e.inspectRoute }
-	}), Jt = Ui(Kt);
-	if (await mr(Kt), (e.discovered.schedules?.length ?? 0) > 0) {
-		let t = (e.scheduleCoordination ?? "single") === "advisoryLock" ? Dr(e.store, e.scheduleReplicaId ?? `pid-${process.pid}`) : ni;
-		h = await ii(e.discovered.schedules ?? [], {
+	}), Jt = Ji(Kt);
+	if (await hr(Kt), (e.discovered.schedules?.length ?? 0) > 0) {
+		let t = (e.scheduleCoordination ?? "single") === "advisoryLock" ? kr(e.store, e.scheduleReplicaId ?? `pid-${process.pid}`) : ii;
+		h = await oi(e.discovered.schedules ?? [], {
 			store: e.store,
 			coordinator: t,
 			defaultTrigger: e.scheduleDefaultTrigger ?? "self",
@@ -1190,7 +1294,7 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 			armSelf: e.scheduleArmSelf ?? !0,
 			dormancy: e.dormancy ?? "always-on",
 			...e.dormancyTenantId === void 0 ? {} : { dormancyTenantId: e.dormancyTenantId },
-			buildContext: ({ traceId: t, scheduleName: n, subject: r }) => Re({
+			buildContext: ({ traceId: t, scheduleName: n, subject: r }) => ze({
 				subject: r,
 				traceId: t
 			}, e.store, void 0, `schedule:${n}`),
@@ -1211,7 +1315,7 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 		}), e.onSchedulerReady?.(h);
 	}
 	let I = e.log ?? L({ scope: "voltro:serve" }), Yt, Xt;
-	if ((e.discovered.subscribers?.length ?? 0) > 0 && (Yt = xe(e.discovered.subscribers ?? [], e.store, I.child("subscribe"), e.schemaRegistry, D.bus)), (e.discovered.reactions?.length ?? 0) > 0) {
+	if ((e.discovered.subscribers?.length ?? 0) > 0 && (Yt = xe(e.discovered.subscribers ?? [], e.store, I.child("subscribe"), e.schemaRegistry, Le.bus)), (e.discovered.reactions?.length ?? 0) > 0) {
 		let t = I.child("reaction"), n = async (n, r) => {
 			if (n.kind === "workflow") {
 				if (S === void 0) {
@@ -1219,7 +1323,7 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 					return;
 				}
 				let e = n.payload === void 0 ? r.new ?? r.old ?? {} : n.payload(r);
-				await Wr(S, {
+				await Kr(S, {
 					traceId: `reaction:${n.workflow}`,
 					source: `reaction:${n.workflow}`
 				}).start(n.workflow, e);
@@ -1227,7 +1331,7 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 			}
 			await pe(n.agent, r, {
 				findAgentSend: (t) => e.discovered.actions.find((e) => e.descriptor.name === `${t}.send`),
-				runAction: (e, t, n) => Promise.resolve(ft(e, t, n)),
+				runAction: (e, t, n) => Promise.resolve(pt(e, t, n)),
 				makeSubject: (e) => Nn(e),
 				now: () => Date.now(),
 				log: t
@@ -1243,7 +1347,7 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 				return t.warn("reaction budget check failed — refusing the act", { tenantId: n }, e), !1;
 			}
 		}, i = jt(e.store, { onError: (e) => t.warn("reaction: rate-slot claim failed; refusing the act", { cause: String(e) }) });
-		Xt = st(e.discovered.reactions ?? [], e.store, {
+		Xt = ct(e.discovered.reactions ?? [], e.store, {
 			runAct: n,
 			checkBudget: r,
 			claimRateSlot: (e) => i.claim(e)
@@ -1257,32 +1361,32 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 		...e.analytics === void 0 ? {} : { analytics: e.analytics },
 		...e.aggregateStorage === void 0 ? {} : { storage: e.aggregateStorage },
 		...e.aggregateCoordinator === void 0 ? {} : { coordinator: e.aggregateCoordinator }
-	}), ze = G.succeed(rr, Zt.registry));
+	}), Be = G.succeed(ar, Zt.registry));
 	let Qt;
-	(e.discovered.expectations?.length ?? 0) > 0 && (Qt = dr({
+	(e.discovered.expectations?.length ?? 0) > 0 && (Qt = fr({
 		discovered: e.discovered.expectations ?? [],
 		store: e.store,
 		log: I.child("expectation")
-	}), Be = G.succeed(sr, Qt.registry)), (e.discovered.budgets?.length ?? 0) > 0 && (n = pr({
+	}), Ve = G.succeed(cr, Qt.registry)), (e.discovered.budgets?.length ?? 0) > 0 && (n = mr({
 		discovered: e.discovered.budgets ?? [],
 		log: I.child("finops")
-	}), He = G.succeed(ir, n.registry));
+	}), Ue = G.succeed(K, n.registry));
 	let $t;
-	return (e.discovered.experiments?.length ?? 0) > 0 && ($t = fr({
+	return (e.discovered.experiments?.length ?? 0) > 0 && ($t = pr({
 		discovered: e.discovered.experiments ?? [],
 		store: e.store,
 		log: I.child("experiment")
-	}), Ge = G.succeed(cr, $t.registry)), Gt = !0, e.bootTiming?.mark("ready"), {
+	}), Ke = G.succeed(lr, $t.registry)), Gt = !0, e.bootTiming?.mark("ready"), {
 		dispatcher: r,
 		server: Kt,
 		scheduler: h,
-		eventsSnapshot: me(D.bus, D.declared),
+		eventsSnapshot: me(Le.bus, Le.declared),
 		membersSnapshot: () => ({
 			members: Ie.membership.list(),
 			capturedAt: Date.now()
 		}),
 		agentTools: () => bt,
-		rpcMetrics: () => Xe,
+		rpcMetrics: () => Ze,
 		webhooksService: () => ve,
 		runCanceller: () => ee(),
 		flowControlHealth: () => l?.cancelHealth(),
@@ -1305,10 +1409,10 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 			} catch (e) {
 				I.warn("serve: teardown step failed", {}, e);
 			}
-			await Le?.detach(), await Ie.detach(), Zt?.detach(), Qt?.detach(), n?.detach(), $t?.detach(), Xt?.(), Yt?.(), await h?.shutdown(), r.close(), await m?.detach(), await u?.dispose(), await qt(), await Jt.finish();
+			await Re?.detach(), await Ie.detach(), Zt?.detach(), Qt?.detach(), n?.detach(), $t?.detach(), Xt?.(), Yt?.(), await h?.shutdown(), r.close(), await m?.detach(), await u?.dispose(), await qt(), await Jt.finish();
 		}
 	};
-}, $ = L({ scope: "voltro:serve" }), _a = (e, t, n) => (e === "production" || e === "staging") && t !== "memory" && n !== "0", va = Ut, ya = async (e) => {
+}, $ = L({ scope: "voltro:serve" }), Da = (e, t, n) => (e === "production" || e === "staging") && t !== "memory" && n !== "0", Oa = Ut, ka = async (e) => {
 	let t = Sn(process.cwd());
 	if (kn(t)) {
 		let n;
@@ -1320,24 +1424,24 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 		}
 		if (n) return $.info("serve: booting from the precompiled serve bundle"), n(e);
 	}
-	return ba(e);
-}, ba = async (s) => {
+	return Aa(e);
+}, Aa = async (s) => {
 	let d = Cn();
 	e("serve");
 	try {
-		xi();
+		Ci();
 	} catch (e) {
 		throw i(e instanceof Error ? e.message : String(e));
 	}
-	let g = process.cwd(), v = await He(g), ne = P({
+	let g = process.cwd(), v = await Ue(g), ne = P({
 		kind: "api",
 		configPort: v?.port,
 		env: process.env,
-		flagPort: va(s, "--port")
+		flagPort: Oa(s, "--port")
 	});
 	for (let e of ne.warnings) $.warn(e);
 	let ie = ne.port;
-	$r(Qr(v?.secrets)), await Wt({
+	ti($r(v?.secrets)), await Wt({
 		rawEnv: v?.env,
 		appType: "api",
 		root: g,
@@ -1355,20 +1459,20 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 	} catch (e) {
 		$.warn("precompiled api bundle failed to load — falling back to source", {}, e);
 	}
-	let b = await Ye(g), x = await kt(b, { cdc: se && ce !== void 0 }), ue = Ht(x);
+	let b = await Xe(g), x = await kt(b, { cdc: se && ce !== void 0 }), ue = Ht(x);
 	{
 		let e = /* @__PURE__ */ new Set([
 			...x.queries.filter((e) => e.descriptor.overridesPlugin === !0).map((e) => e.descriptor.name),
 			...x.mutations.filter((e) => e.descriptor.overridesPlugin === !0).map((e) => e.descriptor.name),
 			...x.actions.filter((e) => e.descriptor.overridesPlugin === !0).map((e) => e.descriptor.name)
 		]);
-		Zt(Xt(v?.plugins ?? []), [
+		nn(Xt(v?.plugins ?? []), [
 			...x.queries.map((e) => e.descriptor.name),
 			...x.mutations.map((e) => e.descriptor.name),
 			...x.actions.map((e) => e.descriptor.name),
 			...x.streams.map((e) => e.descriptor.name)
 		], e);
-		let t = ae(x.serverOnlyLeaks, Ae(process.env, "strict"), br, "`voltro serve`");
+		let t = ae(x.serverOnlyLeaks, Ae(process.env, "strict"), Sr, "`voltro serve`");
 		if (t.action === "fail") throw i(t.message ?? "");
 		t.action === "warn" && $.warn(t.message ?? "");
 	}
@@ -1379,24 +1483,24 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 	}, me = gn(x.events), be = pe.outgoing.length + pe.incoming.length + pe.providers.length + me.length === 0 ? void 0 : {
 		...pe,
 		outgoing: [...pe.outgoing, ...me]
-	}, xe = an({
+	}, xe = rn({
 		nodeEnv: process.env.NODE_ENV,
 		cdcDialect: ce,
 		declared: v?.schema
-	}), we = $t({
+	}), we = an({
 		gates: xe,
 		runtime: {
 			traces: ve(),
-			undo: oi()
+			undo: ci()
 		}
 	});
 	if (we !== void 0) throw i(`serve: ${we}`);
-	let De = rn({
+	let De = tn({
 		mix: x.featureMix,
 		plugins: v?.plugins ?? [],
 		gates: xe,
 		...ce ? { cdcDialect: ce } : {}
-	}), Oe = v?.analytics !== void 0 && v.analytics.kind !== "noop" && y !== "memory" ? (await F(y)).makeSqlLayer(O()) : void 0, ke = await qe({
+	}), Oe = v?.analytics !== void 0 && v.analytics.kind !== "noop" && y !== "memory" ? (await F(y)).makeSqlLayer(O()) : void 0, ke = await Je({
 		spec: v?.analytics,
 		sqlLayer: Oe,
 		log: $
@@ -1405,26 +1509,26 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 		for (let n of [...De, ...ke.tables]) e.has(n.tableName) || (e.add(n.tableName), t.push(n));
 		return t;
 	})();
-	for (let e of T) Jn(e);
+	for (let e of T) Xn(e);
 	{
-		let e = xr(si(Be(x), Lt(T)));
+		let e = Cr(li(Ve(x), Lt(T)));
 		e !== void 0 && $.warn(e);
 	}
 	let Pe = (process.env.NODE_ENV ?? "").toLowerCase();
-	if (_a(Pe, y, process.env.VOLTRO_AUTO_MIGRATE)) {
-		let e = (await F(y)).makeSqlLayer(O()), t = await W.runPromise(Qn.SqlClient.pipe(W.flatMap((e) => tr(e, g)), W.provide(e), W.catchAll(() => W.succeed([]))));
+	if (Da(Pe, y, process.env.VOLTRO_AUTO_MIGRATE)) {
+		let e = (await F(y)).makeSqlLayer(O()), t = await W.runPromise(er.SqlClient.pipe(W.flatMap((e) => rr(e, g)), W.provide(e), W.catchAll(() => W.succeed([]))));
 		t.length > 0 && ($.error(`serve: refusing to boot — ${t.length} pending file-based migration(s) have never run against this database. They perform the changes a schema diff cannot infer (data moves, backfills, table splits), so the declarative fingerprint check below cannot see them and would have let this process serve un-migrated data.`, { pending: t }), $.error("Run them from your pre-deploy job — `voltro db migrate .` (schema + files) or `voltro db files .` (files alone) — or set VOLTRO_AUTO_MIGRATE=0 to bypass every boot schema check. `voltro serve` never applies them itself: a rolling deploy would start N replicas and each would try."), process.exit(1));
-		let n = await W.runPromise(Qn.SqlClient.pipe(W.flatMap((e) => nr(e, T, {
+		let n = await W.runPromise(er.SqlClient.pipe(W.flatMap((e) => ir(e, T, {
 			appliedBy: `serve:${Pe}`,
 			environment: "prod",
 			dialectId: y
 		})), W.provide(e)));
-		n.kind === "prod-mismatch" && ($.error(er(n, y)), $.error(tn({
+		n.kind === "prod-mismatch" && ($.error(nr(n, y)), $.error(on({
 			gates: xe,
 			nodeEnv: process.env.NODE_ENV,
 			cdcDialect: ce,
 			declared: v?.schema
-		})), $.error("serve: refusing to boot — apply the schema first (voltro db apply in a pre-deploy step), or set VOLTRO_AUTO_MIGRATE=0 to bypass this check."), process.exit(1)), $.info(er(n, y));
+		})), $.error("serve: refusing to boot — apply the schema first (voltro db apply in a pre-deploy step), or set VOLTRO_AUTO_MIGRATE=0 to bypass this check."), process.exit(1)), $.info(nr(n, y));
 	}
 	await Yt({
 		dialectId: y,
@@ -1437,19 +1541,19 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 			warn: (e, t) => $.warn(e, t ?? {})
 		}
 	});
-	let Fe = Ur(T);
+	let Fe = Wr(T);
 	d.mark("discover");
-	let E = await rt(v, void 0);
+	let E = await it(v, void 0);
 	{
 		let e = await ee(E);
 		if (e !== void 0) throw i(`serve: ${e}`);
 	}
-	let Ve = ui(E, y);
-	for (let e of tt({
+	let He = fi(E, y);
+	for (let e of nt({
 		dialect: String(v?.store ?? process.env.DB_DIALECT ?? "postgres"),
 		changeStrategy: (process.env.CDC ?? "1") === "0" ? "inline" : "cdc",
 		dbUrl: process.env.DB_URL,
-		crossReplicaBus: Ni(v?.plugins ?? [])?.broadcast.crossReplica === !0,
+		crossReplicaBus: Fi(v?.plugins ?? [])?.broadcast.crossReplica === !0,
 		tables: x.tables.map((e) => ({
 			tableName: e.tableName,
 			isReactive: e.isReactive === !0
@@ -1466,25 +1570,25 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 				name: e.descriptor.name,
 				source: e.descriptor.source
 			}))
-		}), t = pt(e);
+		}), t = mt(e);
 		t !== void 0 && $.warn(t);
 	}
 	v?.cache && !process.env.CACHE_BACKEND && (process.env.CACHE_BACKEND = v.cache), v?.cacheRedisUrl && !process.env.CACHE_REDIS_URL && (process.env.CACHE_REDIS_URL = v.cacheRedisUrl), v?.cacheRedisDriver && !process.env.CACHE_REDIS_DRIVER && (process.env.CACHE_REDIS_DRIVER = v.cacheRedisDriver), v?.cacheKeyPrefix && !process.env.CACHE_KEY_PREFIX && (process.env.CACHE_KEY_PREFIX = v.cacheKeyPrefix);
-	let { service: Ue, invalidationBus: We, snapshotCache: Ke, cache: Je, semantic: Ze, evictSource: $e, backend: it, stats: ot, dispose: st } = await Xe({
+	let { service: We, invalidationBus: Ge, snapshotCache: qe, cache: Ye, semantic: Qe, evictSource: et, backend: at, stats: st, dispose: ct } = await Ze({
 		env: process.env,
 		semantic: v?.cacheSemantic ?? !1
 	});
-	Ze !== void 0 && $.info("semantic cache enabled — reactive eviction on live writes"), $.info(`cache backend resolved: ${it}` + (it === "redis" ? ` (driver ${process.env.CACHE_REDIS_DRIVER ?? "resp"})` : " — in-process, not cross-instance")), E.onChange((e) => {
-		if (W.runFork(We.publish(e.table)), $e !== void 0) {
+	Qe !== void 0 && $.info("semantic cache enabled — reactive eviction on live writes"), $.info(`cache backend resolved: ${at}` + (at === "redis" ? ` (driver ${process.env.CACHE_REDIS_DRIVER ?? "resp"})` : " — in-process, not cross-instance")), E.onChange((e) => {
+		if (W.runFork(Ge.publish(e.table)), et !== void 0) {
 			let t = (e.new ?? e.old)?.id;
-			$e({
+			et({
 				table: e.table,
 				op: e.op,
 				...t === void 0 ? {} : { id: t }
 			});
 		}
 	}), v?.kv && !process.env.KV_BACKEND && (process.env.KV_BACKEND = v.kv), v?.kvRedisUrl && !process.env.KV_REDIS_URL && (process.env.KV_REDIS_URL = v.kvRedisUrl), v?.kvKeyPrefix && !process.env.KV_KEY_PREFIX && (process.env.KV_KEY_PREFIX = v.kvKeyPrefix);
-	let { kv: ut, service: dt } = await jr({ store: E });
+	let { kv: dt, service: ft } = await Nr({ store: E });
 	Pt({
 		log: $,
 		max: qt(),
@@ -1492,29 +1596,29 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 		readPools: t.replicationSnapshot()?.replicaCount ?? 0,
 		always: !0
 	}), d.mark("store");
-	let ht = ur({
+	let gt = dr({
 		store: E,
 		sink: ke.sink,
 		log: $
-	}), xt = Ge({
+	}), xt = Ke({
 		store: E,
 		dialect: y,
 		log: { info: (e) => $.info(e) }
 	}), j = v?.plugins ?? [], jt = process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, Rt, Bt;
-	y !== "memory" && (Rt = Zn.make((await F(y)).makeSqlLayer(O())), Bt = await Rt.runPromise(Qn.SqlClient));
+	y !== "memory" && (Rt = $n.make((await F(y)).makeSqlLayer(O())), Bt = await Rt.runPromise(er.SqlClient));
 	let Ut = [
 		"postgres",
 		"mariadb",
 		"mysql",
 		"mssql"
-	].includes(y) ? Dr(E, jt, $) : ni, _n = M(v?.scheduling), Sn = Nr({
+	].includes(y) ? kr(E, jt, $) : ii, _n = M(v?.scheduling), Sn = Fr({
 		maxIdleIntervalMs: _n.pollCeilingMs,
 		coordinator: Ut,
 		replicaId: jt,
 		log: $
-	}), wn = [], Tn = process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, On = Ni(v?.plugins ?? [])?.broadcast?.provider, L = Qe(v?.plugins, v?.name ?? En(g));
+	}), wn = [], Tn = process.env.POD_NAME ?? process.env.HOSTNAME ?? `serve-${process.pid}`, On = Fi(v?.plugins ?? [])?.broadcast?.provider, L = $e(v?.plugins, v?.name ?? En(g));
 	{
-		let e = et(v?.plugins, v?.name ?? En(g));
+		let e = tt(v?.plugins, v?.name ?? En(g));
 		e !== void 0 && $.warn(e);
 	}
 	let jn = Mt(v?.plugins, {
@@ -1527,16 +1631,16 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 		instanceId: Tn,
 		membership: jn.membership,
 		...On === void 0 ? {} : { broadcast: On },
-		broadcastChannels: { presence: Mi(L, "presence") },
+		broadcastChannels: { presence: Pi(L, "presence") },
 		scheduleCoordinated: (e, t, n) => {
 			let r = Sn(e, t, n);
 			return wn.push(r), r;
 		}
 	};
-	for (let e of j) e.bindDataStore?.(Ve, Mn);
+	for (let e of j) e.bindDataStore?.(He, Mn);
 	l({
 		store: E,
-		...ct(),
+		...lt(),
 		log: $
 	});
 	let R = j.filter((e) => typeof e.onChangeEvent == "function");
@@ -1544,7 +1648,7 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 		let e = E.changeScope ?? "local";
 		E.onChange((t) => {
 			let n = ye(t, e);
-			for (let e of R) W.runFork(e.onChangeEvent(n).pipe(W.catchAllCause((t) => W.sync(() => $.warn(`plugin ${e.name} onChangeEvent failed`, { error: Xn.pretty(t) })))));
+			for (let e of R) W.runFork(e.onChangeEvent(n).pipe(W.catchAllCause((t) => W.sync(() => $.warn(`plugin ${e.name} onChangeEvent failed`, { error: Qn.pretty(t) })))));
 		});
 	}
 	let Nn = Ne({
@@ -1561,19 +1665,19 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 		debug: () => {}
 	}, z, In = await A(E, v, y, L, Fn, (e, t) => {
 		z?.refreshAll(`broadcast gap: missed ${t} change(s) from ${e}`);
-	}), Ln = v?.apiKeys, Rn = (typeof Ln == "object" ? Ln.prefix : void 0) ?? "voltro_", B = Ln ? yr(E) : void 0, V = B ? kr({ flush: Ar(B) }) : void 0;
-	V && qr(() => V.shutdown());
-	let zn = B ? Or(B, {
+	}), Ln = v?.apiKeys, Rn = (typeof Ln == "object" ? Ln.prefix : void 0) ?? "voltro_", B = Ln ? xr(E) : void 0, V = B ? jr({ flush: Mr(B) }) : void 0;
+	V && Yr(() => V.shutdown());
+	let zn = B ? Ar(B, {
 		prefix: Rn,
 		...V ? { usage: V } : {}
-	}) : void 0, Bn = zn ? [Sr(zn, { prefix: Rn })] : [], Vn = St([...v?.auth?.strategies ?? [], ...Bn], Ai(v?.plugins ?? []), v?.auth?.anonymousTenantRequired ?? !1, v?.auth, () => Ve), Hn = [...v?.restRoutes ?? [], ...zn ? lr(zn, (typeof Ln == "object" ? Ln.managementPath : void 0) ?? "/v1/api-keys") : []], Un = Ct(v?.idempotency, E), Wn = j.map((e) => e.services).filter((e) => e !== void 0), Gn = G.mergeAll(_t({
+	}) : void 0, Bn = zn ? [wr(zn, { prefix: Rn })] : [], Vn = St([...v?.auth?.strategies ?? [], ...Bn], Mi(v?.plugins ?? []), v?.auth?.anonymousTenantRequired ?? !1, v?.auth, () => He), Hn = [...v?.restRoutes ?? [], ...zn ? ur(zn, (typeof Ln == "object" ? Ln.managementPath : void 0) ?? "/v1/api-keys") : []], Un = Ct(v?.idempotency, E), Wn = j.map((e) => e.services).filter((e) => e !== void 0), Gn = G.mergeAll(_t({
 		analyticsLayer: ke.layer,
-		cacheService: Ue,
-		kvService: dt,
-		...Ze === void 0 ? {} : { semanticCache: Ze },
+		cacheService: We,
+		kvService: ft,
+		...Qe === void 0 ? {} : { semanticCache: Qe },
 		pluginServices: Wn,
 		userLayers: v?.layers ?? []
-	}), Le(v?.http ?? {})), H = await Re({
+	}), Re(v?.http ?? {})), H = await ze({
 		files: b,
 		store: E,
 		log: $,
@@ -1585,19 +1689,19 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 		runStartups: o,
 		emailPattern: k,
 		loadEmailFiles: Tt,
-		registerEmailTemplates: ji
+		registerEmailTemplates: Ni
 	});
 	(H.startupCount > 0 || H.emailCount > 0) && $.info("boot lifecycle", {
 		startups: H.startupCount,
 		emailTemplates: H.emailCount
-	}), H.startups !== void 0 && qr(async () => {
+	}), H.startups !== void 0 && Yr(async () => {
 		await H.startups.stop();
 	}), de({
 		demands: Se(ue),
-		isRegistered: (e) => Cr(e) !== void 0
+		isRegistered: (e) => Tr(e) !== void 0
 	});
-	let U = wt({
-		schedules: at({
+	let qn = wt({
+		schedules: ot({
 			schedules: x.schedules,
 			seeds: H.seeds,
 			store: E,
@@ -1605,27 +1709,27 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 		}),
 		workflows: x.workflows ?? [],
 		log: $.child("workflow-schedules")
-	}), Yn = v?.scheduling ?? {}, rr = Yn.trigger ?? "self", ir = /* @__PURE__ */ new Set([
+	}), Yn = v?.scheduling ?? {}, U = Yn.trigger ?? "self", Zn = /* @__PURE__ */ new Set([
 		"postgres",
 		"mysql",
 		"mariadb",
 		"mssql"
-	]), ar = Yn.coordination ?? (ir.has(y) ? "advisoryLock" : "single"), or = ar === "cluster" && ir.has(y), sr = or ? "cluster" : ar === "advisoryLock" && ir.has(y) ? "advisoryLock" : "single";
-	ar === "cluster" && !or && $.warn("scheduling.coordination=cluster needs a sql-backed store except sqlite — falling back to single"), ar === "advisoryLock" && !ir.has(y) && $.warn("scheduling.coordination=advisoryLock needs a SQL store (the claim-row gate) — falling back to single");
-	let cr, dr = x.workflows.length > 0 || x.workflowWorkers.length > 0 || x.eventTriggers.length > 0 || (be?.outgoing.length ?? 0) > 0 || or, fr;
-	if (dr) {
+	]), ar = Yn.coordination ?? (Zn.has(y) ? "advisoryLock" : "single"), K = ar === "cluster" && Zn.has(y), or = K ? "cluster" : ar === "advisoryLock" && Zn.has(y) ? "advisoryLock" : "single";
+	ar === "cluster" && !K && $.warn("scheduling.coordination=cluster needs a sql-backed store except sqlite — falling back to single"), ar === "advisoryLock" && !Zn.has(y) && $.warn("scheduling.coordination=advisoryLock needs a SQL store (the claim-row gate) — falling back to single");
+	let sr, cr = x.workflows.length > 0 || x.workflowWorkers.length > 0 || x.eventTriggers.length > 0 || (be?.outgoing.length ?? 0) > 0 || K, lr;
+	if (cr) {
 		if (y === "mssql") {
 			let e = await hn(process.cwd());
 			e && $.warn(e);
 		}
-		let [{ WorkflowEngine: e }, { makeClusterCronLayer: t, workflowEngineLayer: n, resolveRunnerStorage: r, resolveFailoverTuning: i }] = await Promise.all([import("@effect/workflow"), import("@voltro/workflow/cluster")]), a = or ? U.filter((e) => (e.trigger ?? rr) === "self").map((e) => t({
+		let [{ WorkflowEngine: e }, { makeClusterCronLayer: t, workflowEngineLayer: n, resolveRunnerStorage: r, resolveFailoverTuning: i }] = await Promise.all([import("@effect/workflow"), import("@voltro/workflow/cluster")]), a = K ? qn.filter((e) => (e.trigger ?? U) === "self").map((e) => t({
 			name: e.name,
-			cron: vr(e),
+			cron: br(e),
 			execute: async () => {
-				await cr?.fireFromCluster(e.name);
+				await sr?.fireFromCluster(e.name);
 			}
 		})) : [];
-		fr = y === "memory" ? e.layerMemory : await (async () => {
+		lr = y === "memory" ? e.layerMemory : await (async () => {
 			let e = await F(y), t = r({ sqliteFamily: e.id === "sqlite" || e.id === "turso" });
 			return $.info(`workflow engine: cluster-${t}, dialect=${e.id}` + (t === "memory" ? " — single-process durable replay, no cross-pod shard handoff" + (e.id !== "sqlite" && e.id !== "turso" ? " (VOLTRO_WORKFLOW_RUNNER_STORAGE=memory: SqlRunnerStorage/cluster_runners + GET_LOCK skipped)" : "") : "")), n({
 				sqlClientLayer: e.makeSqlLayer(O()),
@@ -1637,23 +1741,23 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 			});
 		})();
 	}
-	let pr = bt(j, bn()), mr = b.filter((e) => /\.subscribe\.tsx?$/.test(e)), K = mr.length > 0 ? await c(mr, $) : [], hr = b.filter((e) => /\.reaction\.tsx?$/.test(e)), q = hr.length > 0 ? await he(hr, $) : [], gr = b.filter((e) => un.test(e)), _r = gr.length > 0 ? await Me(gr, $) : [], wr = b.filter((e) => /\.aggregate\.tsx?$/.test(e)), Tr = wr.length > 0 ? await _e(wr, $) : [];
+	let fr = bt(j, bn()), pr = b.filter((e) => /\.subscribe\.tsx?$/.test(e)), mr = pr.length > 0 ? await c(pr, $) : [], hr = b.filter((e) => /\.reaction\.tsx?$/.test(e)), q = hr.length > 0 ? await he(hr, $) : [], gr = b.filter((e) => un.test(e)), _r = gr.length > 0 ? await Me(gr, $) : [], vr = b.filter((e) => /\.aggregate\.tsx?$/.test(e)), yr = vr.length > 0 ? await _e(vr, $) : [];
 	{
-		let e = xr(si(Be({ aggregates: Tr.map((e) => e.definition) }), Lt(T)));
+		let e = Cr(li(Ve({ aggregates: yr.map((e) => e.definition) }), Lt(T)));
 		e !== void 0 && $.warn(e);
 	}
-	let Er = lt();
-	if (Tr.length > 0 && y !== "memory") try {
+	let Er = ut();
+	if (yr.length > 0 && y !== "memory") try {
 		let e = (await F(y)).makeSqlLayer(O());
 		Er = u(e);
 	} catch (e) {
 		$.warn("aggregate: SQL storage init failed — falling back to in-process", { err: String(e) });
 	}
-	let Mr = y === "memory" ? ni : Dr(E, `aggregate@${process.pid}`, $), Pr = b.filter((e) => dn.test(e)), Fr = Pr.length > 0 ? await Ft(Pr, $) : [], Ir = b.filter((e) => ln.test(e)), Lr = Ir.length > 0 ? await m(Ir, $) : [], Rr = b.filter((e) => cn.test(e)), zr = Rr.length > 0 ? await w(Rr, $) : [], Br = [], Vr = [], Hr = b.filter((e) => nn.test(e));
+	let Dr = y === "memory" ? ii : kr(E, `aggregate@${process.pid}`, $), Or = b.filter((e) => dn.test(e)), Pr = Or.length > 0 ? await Ft(Or, $) : [], Ir = b.filter((e) => ln.test(e)), Lr = Ir.length > 0 ? await m(Ir, $) : [], Rr = b.filter((e) => cn.test(e)), zr = Rr.length > 0 ? await w(Rr, $) : [], Br = [], Vr = [], Hr = b.filter((e) => Zt.test(e));
 	if (Hr.length > 0) {
 		let e = $.child("agent"), t = b.filter((e) => en.test(e));
-		t.length > 0 && await on(t, e);
-		let n = await Qt(Hr, e);
+		t.length > 0 && await Qt(t, e);
+		let n = await $t(Hr, e);
 		for (let e of n.agents) for (let t of Ot(e)) (t.kind === "action" ? Br : Vr).push({
 			file: t.file,
 			descriptor: t.descriptor,
@@ -1666,14 +1770,14 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 		let e = Y.workflowWriteActions();
 		if (e === void 0) throw Error("workflow actions: this app registers no workflows");
 		return e;
-	}, Wr = qn({
+	}, Ur = Jn({
 		dialect: y,
 		...O()
-	}), Gr = y === "memory" ? void 0 : (await F(y)).makeSqlLayer(O()), Kr = async () => gt({
+	}), Gr = y === "memory" ? void 0 : (await F(y)).makeSqlLayer(O()), Kr = async () => D({
 		sqlLayer: Gr,
 		declared: T,
 		log: $
-	}), Jr = {
+	}), qr = {
 		kind: "api",
 		meta: {
 			name: v?.name ?? "voltro-api",
@@ -1682,7 +1786,7 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 			mode: "start",
 			store: y,
 			cdc: se ? "on" : "off",
-			...Wr === void 0 ? {} : { databaseId: Wr }
+			...Ur === void 0 ? {} : { databaseId: Ur }
 		},
 		rpc: Ie(x, g),
 		workflows: Nt(x, g),
@@ -1698,12 +1802,12 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 		}),
 		members: () => Y.membersSnapshot(),
 		inspectFireSchedule: async ({ name: e, trigger: t }) => {
-			if (!cr) throw Error("scheduler not started — this app registers no self-triggered schedules (all schedules are trigger:'external', or there are none).");
-			return { runId: await cr.fireNow(e, t) ?? null };
+			if (!sr) throw Error("scheduler not started — this app registers no self-triggered schedules (all schedules are trigger:'external', or there are none).");
+			return { runId: await sr.fireNow(e, t) ?? null };
 		},
 		inspectBackfillSchedule: _({
-			getHandle: () => cr,
-			getSchedules: () => U
+			getHandle: () => sr,
+			getSchedules: () => qn
 		}),
 		...be === void 0 ? {} : { webhooks: () => ge({
 			store: E,
@@ -1714,12 +1818,12 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 			capturedAt: Date.now()
 		}),
 		env: () => Gt(v?.name ?? En(g), {
-			...v?.env !== void 0 && bi(v.env) ? { contract: v.env } : {},
+			...v?.env !== void 0 && Si(v.env) ? { contract: v.env } : {},
 			plugins: v?.plugins ?? []
 		}),
-		dataCache: () => ze({
-			stats: ot,
-			backendKind: it
+		dataCache: () => Be({
+			stats: st,
+			backendKind: at
 		}),
 		subscriptions: () => It(() => z),
 		inspectTables: () => S(x.tables),
@@ -1732,17 +1836,17 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 		cluster: () => zt({
 			store: E,
 			dialect: y,
-			useClusterCron: or,
+			useClusterCron: K,
 			scheduleCoordChoice: ar
 		}),
 		inspectSchedules: () => Te({
-			schedules: U,
-			defaultTrigger: rr,
-			coordination: sr
+			schedules: qn,
+			defaultTrigger: U,
+			coordination: or
 		}),
 		inspectScheduleRuns: (e) => N(E, e),
 		...f(E, {
-			controls: nt(x.workflows ?? []),
+			controls: rt(x.workflows ?? []),
 			active: (x.workflows?.length ?? 0) > 0,
 			cancellation: () => Y.flowControlHealth()
 		}),
@@ -1760,7 +1864,7 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 			active: (x.workflows?.length ?? 0) > 0,
 			dispatcher: () => Y.inferenceHealth()
 		}, e.limit === void 0 ? {} : { limit: e.limit }),
-		...mt({
+		...ht({
 			store: E,
 			cancelRun: async (e) => await Y.runCanceller()?.(e) ?? !1,
 			retryRun: async (e) => J().inspectRetryWorkflowRun({ runId: e }),
@@ -1769,7 +1873,7 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 		}),
 		inspectRedriveWorkflowRun: (e) => Y.redriveWorkflowRun(e),
 		inspectResumeWorkflowRunFromStep: (e) => Y.resumeWorkflowRunFromStep(e)
-	}, Yr = (process.env.VOLTRO_TENANT_ISOLATION ?? v?.tenancy?.isolation) === "namespace", Xr = Yr && y !== "memory" ? await (async () => {
+	}, Jr = (process.env.VOLTRO_TENANT_ISOLATION ?? v?.tenancy?.isolation) === "namespace", Xr = Jr && y !== "memory" ? await (async () => {
 		let e = await F(y);
 		return At({
 			tables: T,
@@ -1781,19 +1885,19 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 				error: (e, t, n) => $.error(e, t ?? {}, n)
 			}
 		});
-	})() : void 0, Zr = await ft({
+	})() : void 0, Zr = await pt({
 		input: v?.tenancy?.residency,
-		namespaceIsolationOn: Yr,
-		makeStoreForUrl: (e, t) => rt(v, void 0, Kt(O(), t)),
+		namespaceIsolationOn: Jr,
+		makeStoreForUrl: (e, t) => it(v, void 0, Kt(O(), t)),
 		log: {
 			info: (e, t) => $.info(e, t),
 			warn: (e, t) => $.warn(e, t)
 		}
 	});
-	Zr !== void 0 && qr(async () => {
+	Zr !== void 0 && Yr(async () => {
 		await Zr.close();
 	});
-	let Y = await ga({
+	let Y = await Ea({
 		bootTiming: d,
 		broadcastNamespace: L,
 		scheduling: (() => {
@@ -1803,7 +1907,7 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 				inferenceTickMs: e.inferenceTickMs,
 				cancelSweepMs: e.cancelSweepMs,
 				stalenessSweepMs: e.stalenessSweepMs,
-				disarmWhenIdle: D({
+				disarmWhenIdle: Le({
 					changeScope: E.changeScope,
 					broadcastAttached: In !== void 0
 				})
@@ -1834,13 +1938,13 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 			workflows: x.workflows,
 			workflowWorkers: x.workflowWorkers,
 			eventTriggers: x.eventTriggers,
-			schedules: U,
-			subscribers: K,
+			schedules: qn,
+			subscribers: mr,
 			outboxHandlers: _r,
 			connections: x.connections,
 			reactions: q,
-			aggregates: Tr,
-			expectations: Fr,
+			aggregates: yr,
+			expectations: Pr,
 			budgets: Lr,
 			experiments: zr,
 			...be === void 0 ? {} : { webhooks: be }
@@ -1848,16 +1952,16 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 		log: $,
 		analytics: ke.sink,
 		aggregateStorage: Er,
-		aggregateCoordinator: Mr,
+		aggregateCoordinator: Dr,
 		store: E,
-		kv: ut,
-		cache: Je,
-		snapshotCache: Ke,
+		kv: dt,
+		cache: Ye,
+		snapshotCache: qe,
 		...v?.reactive === void 0 ? {} : { reactive: v.reactive },
 		schemaRegistry: Fe,
 		tenantScopedTables: x.tenantScopedTables,
 		softDeleteScopedTables: x.softDeleteScopedTables,
-		dataTransferSnapshot: $n(T, y),
+		dataTransferSnapshot: tr(T, y),
 		dataTransferDialect: y,
 		...Xr === void 0 ? {} : { ensureTenantProvisioned: Xr.ensure },
 		...Zr === void 0 ? {} : { resolveResidentStore: Zr.resolveStore },
@@ -1869,22 +1973,22 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 		...v?.auth === void 0 ? {} : { authority: v.auth },
 		...v?.agents === void 0 ? {} : { agents: v.agents },
 		httpRoutes: j.flatMap((e) => e.httpRoutes ?? []),
-		getStore: () => Ve,
+		getStore: () => He,
 		...Gn ? { baseLayer: Gn } : {},
-		...fr === void 0 ? {} : { workflowEngineLayer: fr },
-		scheduleDefaultTrigger: rr,
-		scheduleCoordination: sr,
-		scheduleArmSelf: !or,
+		...lr === void 0 ? {} : { workflowEngineLayer: lr },
+		scheduleDefaultTrigger: U,
+		scheduleCoordination: or,
+		scheduleArmSelf: !K,
 		dormancy: process.env.VOLTRO_DORMANCY === "sleep" || process.env.VOLTRO_DORMANCY === "always-on" ? process.env.VOLTRO_DORMANCY : v?.dormancy ?? "always-on",
 		scheduleReplicaId: process.env.HOSTNAME ?? `pid-${process.pid}`,
-		...pr === void 0 ? {} : { scheduleFireInterceptor: pr },
+		...fr === void 0 ? {} : { scheduleFireInterceptor: fr },
 		onSchedulerReady: (e) => {
-			cr = e;
+			sr = e;
 		},
-		inspectRoute: { handle: async (e, t, n, r) => await h(e, Jr, t, {
+		inspectRoute: { handle: async (e, t, n, r) => await h(e, qr, t, {
 			method: n,
 			...r === void 0 ? {} : { body: r }
-		}) || ((n === "GET" ? await mn(e, Jr, t, { method: n }) : null) ?? pn(e, Jr, t, {
+		}) || ((n === "GET" ? await mn(e, qr, t, { method: n }) : null) ?? pn(e, qr, t, {
 			method: n,
 			...r === void 0 ? {} : { body: r }
 		}) ?? {
@@ -1912,14 +2016,14 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 		streams: x.streams.length,
 		workflows: x.workflows.length,
 		workflowWorkers: x.workflowWorkers.length,
-		schedules: U.length,
-		scheduleCoordination: sr
-	}), d.finish($), qr(async () => {
+		schedules: qn.length,
+		scheduleCoordination: or
+	}), d.finish($), Yr(async () => {
 		for (let e of wn) e.stop();
 		xt.stop();
 		try {
-			await Y.close(), st(), Rt?.dispose(), await Nn.deactivate(), await In?.close(), await Dt({
-				mirror: ht,
+			await Y.close(), ct(), Rt?.dispose(), await Nn.deactivate(), await In?.close(), await Dt({
+				mirror: gt,
 				log: $
 			}), await ke.dispose(), await E.close?.();
 		} catch (e) {
@@ -1928,4 +2032,4 @@ var Vi = () => Math.max(500, Math.floor(ti() * .6)), Hi = (e) => new Promise((t)
 	}), await new Promise(() => {}), 0;
 };
 //#endregion
-export { ya as n, _a as r, ba as t };
+export { ka as n, Da as r, Aa as t };