@voltro/cli 0.52.0 → 0.54.0

package/dist/{start-jw89Xbqy.js → start-Clz-1BHB.js}

@@ -1,43 +1,43 @@
 import { i as e, t } from "./nodeEnvironment-cGFAj1J8.js";
 import { r as n } from "./appPort-B_HpJ_ck.js";
-import { $ as r, A as i, At as a, B as o, C as s, Dt as c, E as l, F as u, G as d, H as f, I as p, J as m, K as h, L as g, M as _, N as v, O as ee, P as y, S as b, T as x, Y as S, a as C, at as te, b as w, c as ne, ct as T, dt as re, et as E, f as D, ft as ie, it as ae, j as oe, k as se, mt as O, n as ce, nt as k, o as le, p as ue, pt as A, q as de, rt as fe, tt as pe, w as me, x as j, z as M } from "./webDev-BgWL9gKV.js";
-import { o as N, t as P } from "./connectionConfig-Bk9IC7D0.js";
-import { A as he, D as F, a as ge, h as _e, j as ve, k as I } from "./inspect-CtL_xTbu.js";
-import { n as ye, r as be, t as xe } from "./inspectMetrics-CGF94puw.js";
-import { a as Se, c as L, d as Ce, f as we, l as Te, p as R, u as Ee } from "./renderModeScan-CcH2X1_D.js";
-import { i as De, n as Oe, r as ke, t as Ae } from "./runtimeRegistry-DMeKfTHP.js";
-import { n as je } from "./logFileSink-B4uP8pvf.js";
-import { t as Me } from "./bootTiming-BdyP9nYw.js";
-import { dirname as Ne, extname as Pe, join as z, resolve as B } from "node:path";
-import { promises as V } from "node:fs";
-import { fileURLToPath as H, pathToFileURL as U } from "node:url";
-import { createLogger as W, printReadyBlock as Fe } from "@voltro/logger";
-import { Effect as Ie } from "effect";
-import { maybeCompress as Le, snapshotMetricsSync as Re } from "@voltro/runtime";
-import { createHash as ze } from "node:crypto";
-import { resolveBroadcastProvider as Be } from "@voltro/plugin-broadcast";
-import { createServer as Ve } from "node:http";
+import { $ as r, A as i, At as a, B as o, C as s, D as c, E as l, F as u, G as d, H as f, I as ee, J as p, K as m, Kt as h, L as te, M as g, Mt as _, N as ne, O as re, Ot as v, R as y, S as b, T as x, Tt as S, U as C, Ut as ie, V as w, W as ae, X as oe, Y as T, Z as E, at as D, bt as O, ct as se, et as ce, ht as le, i as ue, j as de, jt as k, k as fe, kt as A, l as pe, lt as me, m as he, mt as j, n as M, nt as N, o as ge, ot as P, p as _e, q as F, s as I, st as ve, w as ye, x as be, z as xe } from "./webDev-DSI9SOhs.js";
+import { o as Se, t as Ce } from "./connectionConfig-Bk9IC7D0.js";
+import { A as L, D as we, a as Te, h as Ee, j as De, k as Oe } from "./inspect-Bd8-9wsi.js";
+import { n as ke, r as Ae, t as je } from "./inspectMetrics-CGF94puw.js";
+import { a as Me, c as R, d as Ne, f as Pe, l as Fe, p as z, u as Ie } from "./renderModeScan-43yQ2opo.js";
+import { i as Le, n as Re, r as ze, t as Be } from "./runtimeRegistry-DMeKfTHP.js";
+import { n as Ve } from "./logFileSink-B4uP8pvf.js";
+import { t as He } from "./bootTiming-BdyP9nYw.js";
+import { dirname as B, extname as V, join as H, resolve as Ue } from "node:path";
+import { promises as U } from "node:fs";
+import { fileURLToPath as We, pathToFileURL as W } from "node:url";
+import { createLogger as G, printReadyBlock as Ge } from "@voltro/logger";
+import { Effect as Ke } from "effect";
+import { maybeCompress as K, snapshotMetricsSync as qe } from "@voltro/runtime";
+import { createHash as q } from "node:crypto";
+import { resolveBroadcastProvider as Je } from "@voltro/plugin-broadcast";
+import { createServer as Ye } from "node:http";
 //#region src/httpResponseWrite.ts
-var G = (e) => `W/"${ze("md5").update(e).digest("hex")}"`, He = (e) => {
+var Xe = (e) => `W/"${q("md5").update(e).digest("hex")}"`, Ze = (e) => {
 	let { response: t, status: n, headers: r, body: i, requestHeaders: a } = e, o = r["cache-control"], s = (typeof o == "string" ? o : "").toLowerCase();
 	if (i === void 0 || n !== 200 || s.includes("no-store")) return !1;
-	let c = r["content-type"], l = typeof c == "string" ? c : void 0, u = G(i), d = a["if-none-match"];
+	let c = r["content-type"], l = typeof c == "string" ? c : void 0, u = Xe(i), d = a["if-none-match"];
 	if (d !== void 0 && d.split(",").some((e) => e.trim() === u)) return t.writeHead(304, {
 		...r,
 		etag: u
 	}), t.end(), !0;
-	let f = Le({
+	let f = K({
 		body: typeof i == "string" ? new TextEncoder().encode(i) : new Uint8Array(i),
 		contentType: l,
 		acceptEncoding: a["accept-encoding"],
 		options: e.compression
-	}), p = {
+	}), ee = {
 		...r,
 		...f.headers,
 		etag: u
 	};
-	return f.compressed && delete p["content-length"], t.writeHead(n, p), t.end(Buffer.from(f.bytes)), !0;
-}, K = W({ scope: "voltro:start:cdc" }), Ue = (e) => (t) => {
+	return f.compressed && delete ee["content-length"], t.writeHead(n, ee), t.end(Buffer.from(f.bytes)), !0;
+}, J = G({ scope: "voltro:start:cdc" }), Qe = (e) => (t) => {
 	let n = 0;
 	for (let [r, i] of e.tableSubscriptionsByPattern) {
 		if (!i.includes(t)) continue;
@@ -48,15 +48,15 @@ var G = (e) => `W/"${ze("md5").update(e).digest("hex")}"`, He = (e) => {
 		}));
 	}
 	return n;
-}, q = () => P() ? N() : null, We = (e) => {
-	let t = e.channel ?? "framework_changes", n = e.revalidateChannel ?? "voltro_revalidate", r = Ue(e), i = null, a = null;
+}, $e = () => Ce() ? Se() : null, et = (e) => {
+	let t = e.channel ?? "framework_changes", n = e.revalidateChannel ?? "voltro_revalidate", r = Qe(e), i = null, a = null;
 	return {
 		start: async () => {
 			let o = e.tableSubscriptionsByPattern.size > 0, s = e.onRevalidate !== void 0;
-			if (!o && !s) return K.debug("skipped — no pages declare cacheInvalidatesOn and no revalidation handler is wired"), !1;
-			let c = q();
-			if (!c && !o) return K.debug("no database configured — the revalidation LISTEN line is unavailable"), !1;
-			if (!c) return K.warn(`${e.tableSubscriptionsByPattern.size} route(s) declare \`cacheInvalidatesOn\` and will NOT be invalidated live — no database is configured for this web process. Set DB_URL (or DB_HOST / PG_HOST) so the CDC listener can connect; until then those routes go stale until their \`revalidate\` window expires.`, { routes: [...e.tableSubscriptionsByPattern.keys()] }), !1;
+			if (!o && !s) return J.debug("skipped — no pages declare cacheInvalidatesOn and no revalidation handler is wired"), !1;
+			let c = $e();
+			if (!c && !o) return J.debug("no database configured — the revalidation LISTEN line is unavailable"), !1;
+			if (!c) return J.warn(`${e.tableSubscriptionsByPattern.size} route(s) declare \`cacheInvalidatesOn\` and will NOT be invalidated live — no database is configured for this web process. Set DB_URL (or DB_HOST / PG_HOST) so the CDC listener can connect; until then those routes go stale until their \`revalidate\` window expires.`, { routes: [...e.tableSubscriptionsByPattern.keys()] }), !1;
 			i = new (await (import("pg"))).default.Client(c), await i.connect(), a = (i) => {
 				if (i.channel === n && i.payload && e.onRevalidate) {
 					e.onRevalidate(i.payload);
@@ -67,18 +67,18 @@ var G = (e) => `W/"${ze("md5").update(e).digest("hex")}"`, He = (e) => {
 				try {
 					a = JSON.parse(i.payload);
 				} catch (e) {
-					K.warn("bad CDC payload", {}, e);
+					J.warn("bad CDC payload", {}, e);
 					return;
 				}
 				let o = r(a.table);
-				o > 0 && K.info(`${a.op} on '${a.table}' → dropped ${o} cache entries`, {
+				o > 0 && J.info(`${a.op} on '${a.table}' → dropped ${o} cache entries`, {
 					op: a.op,
 					table: a.table,
 					dropped: o
 				});
 			}, i.on("notification", a), o && await i.query(`LISTEN ${t}`), s && await i.query(`LISTEN ${n}`);
 			let l = [...o ? [t] : [], ...s ? [n] : []];
-			return K.info(`LISTEN ${l.join(", ")}`, {
+			return J.info(`LISTEN ${l.join(", ")}`, {
 				channels: l,
 				..."connectionString" in c ? { target: c.connectionString.replace(/\/\/[^@/]*@/, "//") } : {
 					host: c.host,
@@ -96,7 +96,7 @@ var G = (e) => `W/"${ze("md5").update(e).digest("hex")}"`, He = (e) => {
 			}
 		}
 	};
-}, Ge = W({ scope: "voltro:start:isr-cache" }), J = "voltro_isr_cache", Ke = (e) => `
+}, Y = G({ scope: "voltro:start:isr-cache" }), tt = "voltro_isr_cache", X = (e) => `
 CREATE TABLE IF NOT EXISTS ${e} (
   cache_key                TEXT PRIMARY KEY,
   html                     TEXT NOT NULL,
@@ -107,9 +107,9 @@ CREATE TABLE IF NOT EXISTS ${e} (
   stale_while_revalidate_ms BIGINT NOT NULL DEFAULT 0
 );
 CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
-`, qe = (e) => {
-	let t = e.tableName ?? J, { client: n } = e, r = /* @__PURE__ */ new Map(), i = !1, a = (async () => {
-		i || (i = !0, await n.query(Ke(t)));
+`, nt = (e) => {
+	let t = e.tableName ?? tt, { client: n } = e, r = /* @__PURE__ */ new Map(), i = !1, a = (async () => {
+		i || (i = !0, await n.query(X(t)));
 	})().then(async () => {
 		let e = await n.query(`SELECT * FROM ${t}`);
 		for (let t of e.rows) r.set(t.cache_key, {
@@ -121,10 +121,10 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 			staleWhileRevalidateMs: Number(t.stale_while_revalidate_ms)
 		});
 	}).catch((e) => {
-		Ge.warn("postgres bootstrap failed", {}, e);
+		Y.warn("postgres bootstrap failed", {}, e);
 	}), o = (e, t) => {
 		a.then(() => n.query(e, t)).catch((e) => {
-			Ge.warn("postgres write failed", {}, e);
+			Y.warn("postgres write failed", {}, e);
 		});
 	}, s = /* @__PURE__ */ new Map(), c = (e) => {
 		s.set(e, (s.get(e) ?? 0) + 1);
@@ -175,21 +175,21 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 			return Array.from(r.entries());
 		}
 	};
-}, Y = W({ scope: "voltro:start:revalidate" }), Je = (e) => {
+}, Z = G({ scope: "voltro:start:revalidate" }), rt = (e) => {
 	try {
 		let t = JSON.parse(e);
 		return (t.kind === "path" || t.kind === "table" || t.kind === "tag") && typeof t.value == "string" && t.value.length > 0 && (t.tenant === void 0 || typeof t.tenant == "string") ? {
 			kind: t.kind,
 			value: t.value,
 			...t.tenant === void 0 ? {} : { tenant: t.tenant }
-		} : (Y.warn("bad revalidation payload (shape)", { payload: e }), null);
+		} : (Z.warn("bad revalidation payload (shape)", { payload: e }), null);
 	} catch {
-		return Y.warn("bad revalidation payload (not JSON)", { payload: e }), null;
+		return Z.warn("bad revalidation payload (not JSON)", { payload: e }), null;
 	}
-}, Ye = (e, t) => {
+}, it = (e, t) => {
 	if (t.kind === "table" || t.kind === "tag") {
 		let n = e.tableSink(t.value);
-		return Y.info(`revalidate ${t.kind} '${t.value}' → dropped ${n} cache entries`, {
+		return Z.info(`revalidate ${t.kind} '${t.value}' → dropped ${n} cache entries`, {
 			kind: t.kind,
 			value: t.value,
 			dropped: n
@@ -198,7 +198,7 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 	let n = t.value, r = (e) => t.tenant === void 0 || e.split("|").includes(`tenant=${t.tenant}`), i = e.regexByPattern.get(n);
 	if (i !== void 0) {
 		let a = e.renderModeByPattern.get(n);
-		if (a !== "isr") return Y.error(`revalidatePath('${n}') targets a '${a ?? "unknown"}' route — only \`renderMode: 'isr'\` routes have cache entries to drop. Static HTML is a build artifact this process never re-renders; rebuild to change it.`, {
+		if (a !== "isr") return Z.error(`revalidatePath('${n}') targets a '${a ?? "unknown"}' route — only \`renderMode: 'isr'\` routes have cache entries to drop. Static HTML is a build artifact this process never re-renders; rebuild to change it.`, {
 			path: n,
 			renderMode: a ?? "unknown"
 		}), 0;
@@ -206,34 +206,34 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 			let t = e.split("|")[0] ?? e;
 			return i.test(t) && r(e);
 		});
-		return Y.info(`revalidate path pattern '${n}' → dropped ${o} cache entries`, {
+		return Z.info(`revalidate path pattern '${n}' → dropped ${o} cache entries`, {
 			path: n,
 			dropped: o,
 			...t.tenant === void 0 ? {} : { tenant: t.tenant }
 		}), o;
 	}
 	let a = [...e.regexByPattern.entries()].find(([, e]) => e.test(n));
-	if (a === void 0) return Y.error(`revalidatePath('${n}') matches no declared route — nothing was dropped. Pass a declared route pattern (e.g. /blog/[slug]) or a concrete path of one.`, { path: n }), 0;
+	if (a === void 0) return Z.error(`revalidatePath('${n}') matches no declared route — nothing was dropped. Pass a declared route pattern (e.g. /blog/[slug]) or a concrete path of one.`, { path: n }), 0;
 	let o = e.renderModeByPattern.get(a[0]);
-	if (o !== "isr") return Y.error(`revalidatePath('${n}') targets a '${o ?? "unknown"}' route (${a[0]}) — only \`renderMode: 'isr'\` routes have cache entries to drop.`, {
+	if (o !== "isr") return Z.error(`revalidatePath('${n}') targets a '${o ?? "unknown"}' route (${a[0]}) — only \`renderMode: 'isr'\` routes have cache entries to drop.`, {
 		path: n,
 		route: a[0],
 		renderMode: o ?? "unknown"
 	}), 0;
 	let s = e.cache.invalidateBy((e) => (e.split("|")[0] ?? e) === n && r(e));
-	return Y.info(`revalidate path '${n}' → dropped ${s} cache entries`, {
+	return Z.info(`revalidate path '${n}' → dropped ${s} cache entries`, {
 		path: n,
 		dropped: s,
 		...t.tenant === void 0 ? {} : { tenant: t.tenant }
 	}), s;
-}, X = W({ scope: "voltro:start" }), Xe = await (async () => {
+}, Q = G({ scope: "voltro:start" }), at = await (async () => {
 	try {
-		let e = z(Ne(H(import.meta.url)), "..", "package.json"), t = await V.readFile(e, "utf8");
+		let e = H(B(We(import.meta.url)), "..", "package.json"), t = await U.readFile(e, "utf8");
 		return JSON.parse(t).version ?? "0.0.0";
 	} catch {
 		return "0.0.0";
 	}
-})(), Ze = (e) => e instanceof Error && e._voltroControl === "redirect" && typeof e.location == "string", Qe = (e) => e instanceof Error && e._voltroControl === "not-found", Z = {
+})(), ot = (e) => e instanceof Error && e._voltroControl === "redirect" && typeof e.location == "string", st = (e) => e instanceof Error && e._voltroControl === "not-found", ct = {
 	".html": "text/html; charset=utf-8",
 	".js": "application/javascript",
 	".mjs": "application/javascript",
@@ -251,13 +251,13 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 	".woff": "font/woff",
 	".woff2": "font/woff2",
 	".txt": "text/plain; charset=utf-8"
-}, $e = (e) => Z[Pe(e).toLowerCase()] ?? "application/octet-stream", et = (e) => e.replace(/<script\b(?=[^>]*\btype="module")(?:(?!<\/script>).)*<\/script>/gi, "").replace(/<script\b(?=[^>]*\bsrc=)(?:(?!<\/script>).)*<\/script>/gi, "").replace(/<link\b[^>]*\brel="modulepreload"[^>]*>/gi, ""), Q = async (e) => {
+}, lt = (e) => ct[V(e).toLowerCase()] ?? "application/octet-stream", ut = (e) => e.replace(/<script\b(?=[^>]*\btype="module")(?:(?!<\/script>).)*<\/script>/gi, "").replace(/<script\b(?=[^>]*\bsrc=)(?:(?!<\/script>).)*<\/script>/gi, "").replace(/<link\b[^>]*\brel="modulepreload"[^>]*>/gi, ""), dt = async (e) => {
 	try {
-		return await V.stat(e), !0;
+		return await U.stat(e), !0;
 	} catch {
 		return !1;
 	}
-}, tt = (e) => {
+}, ft = (e) => {
 	let t = [], n = 0, r = e.split("/").filter(Boolean), i = [];
 	for (let e of r) e.startsWith("[[...") && e.endsWith("]]") ? (i.push("(.*)"), t.push(e.slice(5, -2)), n += 2) : e.startsWith("[...") && e.endsWith("]") ? (i.push("(.+)"), t.push(e.slice(4, -1)), n += 3) : e.startsWith("[") && e.endsWith("]") ? (i.push("([^/]+)"), t.push(e.slice(1, -1)), n += 1) : i.push(e.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"));
 	let a = i.join("/");
@@ -266,8 +266,8 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 		paramNames: t,
 		priority: n
 	};
-}, nt = (e) => e.map((e) => {
-	let { regex: t, paramNames: n, priority: r } = tt(e.pattern);
+}, pt = (e) => e.map((e) => {
+	let { regex: t, paramNames: n, priority: r } = ft(e.pattern);
 	return {
 		pattern: e.pattern,
 		file: e.file,
@@ -276,7 +276,7 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 		paramNames: n,
 		priority: r
 	};
-}).slice().sort((e, t) => e.priority - t.priority), rt = (e, t) => {
+}).slice().sort((e, t) => e.priority - t.priority), mt = (e, t) => {
 	for (let n of t) {
 		let t = n.regex.exec(e);
 		if (!t) continue;
@@ -288,225 +288,261 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 		};
 	}
 	return null;
-}, it = async (e) => {
-	let { provider: t, route: n, params: r, pathname: a, dirs: o, shellTemplate: c, requestHeaders: l, requestUrl: d = "", apiOrigin: f, apiName: m } = e, { search: h } = ae(d), g = await se(i(e.middlewares ?? [], {
+}, ht = null, gt = async (e) => {
+	let { provider: t, route: n, params: r, pathname: a, dirs: s, shellTemplate: d, requestHeaders: h, requestUrl: _ = "", apiOrigin: ne, apiName: re } = e, { search: v } = oe(_), y = await ee(te(e.middlewares ?? [], {
 		route: n.pattern,
 		pathname: a
 	}), {
 		pathname: a,
-		search: h,
-		headers: l,
-		cookies: ee(l.cookie),
+		search: v,
+		headers: h,
+		cookies: u(h.cookie),
 		route: n.pattern
-	}, e.onCookieWarning), S = await t.getPage(n.pattern, n.file), w = L(S, n.file), T = w === "isr" ? s(g.headers) : g.headers, re = C(f, T.cookie, {
-		apiName: m,
-		headers: T
-	}), D = w === "spa" && ne(o, n.dirChain).some((e) => e.hasLayout);
-	if (w !== "ssr" && w !== "isr" && !D) return null;
-	let ie = ne(o, n.dirChain), oe = {}, O = null, ce, ue = new AbortController();
+	}, e.onCookieWarning), b = await t.getPage(n.pattern, n.file), S = e.forceSsrRender === !0 ? "ssr" : R(b, n.file), ie = S === "isr" && b.ppr === !0, E = S === "isr" && e.holesOnly !== !0 ? i(y.headers) : y.headers, D = ge(ne, E.cookie, {
+		apiName: re,
+		headers: E
+	});
+	if (e.holesOnly === !0) {
+		if (typeof b.loader != "function") return null;
+		let e = new AbortController();
+		return {
+			holes: {
+				loader: b.loader,
+				ctx: {
+					params: r,
+					pathname: a,
+					search: v,
+					signal: e.signal,
+					headers: E,
+					query: D,
+					isServer: !0
+				},
+				helpers: await t.getHelpers(),
+				page: n.pattern
+			},
+			setCookies: y.setCookies
+		};
+	}
+	let O = S === "spa" && pe(s, n.dirChain).some((e) => e.hasLayout);
+	if (S !== "ssr" && S !== "isr" && !O) return null;
+	let se = pe(s, n.dirChain), ce = {}, le = null, ue, de = new AbortController(), k = ie ? c(E, n.pattern) : E;
 	try {
-		(await t.getHelpers()).beginStoreSeeds(), {chain: ce, segmentLoaderData: oe} = await le({
-			entries: ie,
+		(await t.getHelpers()).beginStoreSeeds(), {chain: ue, segmentLoaderData: ce} = await I({
+			entries: se,
 			loadLayout: (e) => t.getLayout(e.dir),
 			loadError: (e) => t.getError(e.dir),
 			loadPending: (e) => t.getPending(e.dir),
 			ctx: {
 				params: r,
 				pathname: a,
-				search: h,
-				signal: ue.signal,
-				headers: T,
-				query: re,
+				search: v,
+				signal: de.signal,
+				headers: k,
+				query: D,
 				isServer: !0
 			}
-		}), typeof S.loader == "function" && !D && (O = await S.loader({
+		}), typeof b.loader == "function" && !O && (le = await b.loader({
 			params: r,
 			pathname: a,
-			search: h,
-			signal: ue.signal,
-			headers: T,
-			query: re,
+			search: v,
+			signal: de.signal,
+			headers: k,
+			query: D,
 			isServer: !0
 		}));
 	} catch (e) {
-		if (Ze(e)) return {
+		if (ot(e)) return {
 			control: "redirect",
 			status: e.status,
 			location: e.location,
-			setCookies: g.setCookies,
-			responseHeaders: g.responseHeaders
+			setCookies: y.setCookies,
+			responseHeaders: y.responseHeaders
 		};
-		if (Qe(e)) return {
+		if (st(e)) return {
 			control: "not-found",
-			setCookies: g.setCookies,
-			responseHeaders: g.responseHeaders
+			setCookies: y.setCookies,
+			responseHeaders: y.responseHeaders
 		};
 		throw e;
 	}
 	let A = await t.getHelpers();
-	D || await _({
-		pageMod: S,
+	O || await xe({
+		pageMod: b,
 		params: r,
-		query: re,
-		apiName: m,
+		query: D,
+		apiName: re,
 		seed: A.seedPreloadedSubscription,
 		seedFailure: A.seedPreloadedSubscriptionFailure,
-		onError: ({ tag: e, apiName: t }, n) => X.warn("preload seed failed", {
+		onError: ({ tag: e, apiName: t }, n) => Q.warn("preload seed failed", {
 			tag: e,
 			apiName: t,
 			pathname: a
 		}, n)
 	});
-	let de = {
+	let me = {
 		pattern: n.pattern,
-		Component: S.default,
-		meta: S.meta,
-		loader: S.loader,
-		ErrorBoundary: S.ErrorBoundary,
-		Pending: S.Pending,
-		renderMode: w,
-		chain: ce
+		Component: b.default,
+		meta: b.meta,
+		loader: b.loader,
+		ErrorBoundary: b.ErrorBoundary,
+		Pending: b.Pending,
+		renderMode: S,
+		chain: ue
 	};
-	if (w === "isr" && g.cspNonce !== void 0) throw Error(`page '${n.pattern}' is renderMode 'isr' while middleware.ts mints a cspNonce — an isr render is CACHED and a cached nonce is a lie the browser enforces. Use renderMode 'ssr' for nonce'd pages, or a hash-based CSP for isr.`);
-	let me = {
-		cookies: w === "isr" ? b(g.cookies) : g.cookies,
-		headers: T,
-		url: d,
+	if (S === "isr" && y.cspNonce !== void 0) throw Error(`page '${n.pattern}' is renderMode 'isr' while middleware.ts mints a cspNonce — an isr render is CACHED and a cached nonce is a lie the browser enforces. Use renderMode 'ssr' for nonce'd pages, or a hash-based CSP for isr.`);
+	let he = {
+		cookies: ie ? l(fe(y.cookies), n.pattern) : S === "isr" ? fe(y.cookies) : y.cookies,
+		headers: k,
+		url: _,
 		...e.formFlash === void 0 ? {} : { formFlash: e.formFlash }
-	}, j = A.i18n?.resolve(T.cookie, T["accept-language"]), M = {
-		lang: j?.locale ?? me.cookies["voltro:locale"] ?? "en",
+	}, j = A.i18n?.resolve(E.cookie, E["accept-language"]), M = {
+		lang: j?.locale ?? he.cookies["voltro:locale"] ?? "en",
 		...j?.timeZone === void 0 ? {} : { timeZone: j.timeZone },
 		renderedAt: Date.now()
-	}, N = S.interactive ?? "full";
-	if (D) {
-		let e = pe({
+	}, N = b.interactive ?? "full";
+	if (O) {
+		let e = F({
 			helpers: A,
 			page: n.pattern,
 			interactive: N,
 			delivery: "stream",
 			renderInput: {
-				descriptor: de,
+				descriptor: me,
 				params: r,
 				pathname: a,
-				search: h,
-				segmentLoaderData: oe,
-				requestContext: me,
+				search: v,
+				segmentLoaderData: ce,
+				requestContext: he,
 				...j ? {
 					outerWrap: j.outerWrap,
 					locale: j.locale
 				} : {}
 			}
-		}), t = (t) => fe({
+		}), t = (t) => T({
 			helpers: A,
 			prepared: e,
 			meta: t,
 			interactive: N
 		});
 		if (e.hasDeferred) {
-			let n = u({ shell: c });
+			let n = f({ shell: d });
 			return {
 				renderMode: "spa",
-				setCookies: g.setCookies,
-				responseHeaders: g.responseHeaders,
-				stream: (r) => p({
+				setCookies: y.setCookies,
+				responseHeaders: y.responseHeaders,
+				stream: (r) => ae({
 					res: r,
 					shell: n,
 					documentAttrs: M,
 					headers: {
-						...g.responseHeaders,
+						...y.responseHeaders,
 						"content-type": "text/html; charset=utf-8",
 						"x-voltro-rendered-by": "spa",
-						...x(g.setCookies)
+						...g(y.setCookies)
 					},
 					headInjection: t,
+					...y.cspNonce === void 0 ? {} : { nonce: y.cspNonce },
 					render: (t) => A.renderPageToStream({
 						...e.renderInput,
-						...t
+						...t,
+						...y.cspNonce === void 0 ? {} : { nonce: y.cspNonce }
 					}),
 					onShellError: (e) => {
-						X.error("spa layout shell render failed", { pathname: a }, e), r.writeHead(500, { "content-type": "text/plain; charset=utf-8" }), r.end("server error");
+						Q.error("spa layout shell render failed", { pathname: a }, e), r.writeHead(500, { "content-type": "text/plain; charset=utf-8" }), r.end("server error");
 					}
 				})
 			};
 		}
-		let i = k({
+		let i = p({
 			helpers: A,
 			prepared: e
-		});
+		}), s = o(w(d.replace("<div id=\"root\"></div>", `<div id="root">${i.body}</div>`), t(i.meta)), M);
 		return {
-			html: v(y(c.replace("<div id=\"root\"></div>", `<div id="root">${i.body}</div>`), t(i.meta)), M),
+			html: y.cspNonce === void 0 ? s : C(s, y.cspNonce),
 			renderMode: "spa",
 			revalidateMs: null,
-			setCookies: g.setCookies,
-			responseHeaders: g.responseHeaders
+			setCookies: y.setCookies,
+			responseHeaders: y.responseHeaders
 		};
 	}
-	let P = E({
+	let P = m({
 		helpers: A,
 		page: n.pattern,
 		pathname: a,
-		renderMode: w,
+		renderMode: S,
 		interactive: N,
-		loaderData: O,
-		segmentLoaderData: oe,
-		pageLoaderRan: typeof S.loader == "function"
-	}), he = {
-		descriptor: de,
+		loaderData: le,
+		segmentLoaderData: ce,
+		pageLoaderRan: typeof b.loader == "function",
+		...ie ? { ppr: !0 } : {}
+	});
+	ie && x(P.stateInput, n.pattern);
+	let _e = {
+		descriptor: me,
 		params: r,
 		pathname: a,
-		search: h,
+		search: v,
 		loaderData: P.loaderData,
 		segmentLoaderData: P.segmentLoaderData,
-		requestContext: me,
+		requestContext: he,
 		...j ? {
 			outerWrap: j.outerWrap,
 			locale: j.locale
 		} : {}
-	}, F = (e) => [
-		A.renderMetaToHtml(e),
+	}, ve = (t) => {
+		if (ht === null || S !== "ssr" && S !== "isr" || typeof b.ogImage != "function" || t.includes("og:image")) return "";
+		let r = E["x-tenant"], i = ht.signOgUrl({
+			pattern: n.pattern,
+			params: e.params,
+			...r === void 0 ? {} : { tenant: r }
+		});
+		return `<meta property="og:image" content="${i}" /><meta name="twitter:image" content="${i}" /><meta name="twitter:card" content="summary_large_image" />`;
+	}, ye = (e) => [
+		A.renderMetaToHtml(e) + ve(A.renderMetaToHtml(e)),
 		`<meta name="voltro-interactive" content="${N}" />`,
 		...P.hasDeferred ? [A.renderDeferredRegistryScript()] : [],
 		A.renderRouterStateScript(P.stateInput)
 	].filter((e) => e.length > 0).join("\n    ");
-	if (w === "ssr" && N === "full" && e.buffered !== !0) {
-		let e = u({ shell: c });
+	if (S === "ssr" && N === "full" && e.buffered !== !0) {
+		let e = f({ shell: d });
 		return {
 			renderMode: "ssr",
-			setCookies: g.setCookies,
-			stream: (t) => p({
+			setCookies: y.setCookies,
+			stream: (t) => ae({
 				res: t,
 				shell: e,
 				documentAttrs: M,
 				headers: {
-					...g.responseHeaders,
+					...y.responseHeaders,
 					"content-type": "text/html; charset=utf-8",
 					"x-voltro-rendered-by": "ssr",
-					...x(g.setCookies)
+					...g(y.setCookies)
 				},
-				headInjection: F,
+				headInjection: ye,
+				...y.cspNonce === void 0 ? {} : { nonce: y.cspNonce },
 				render: (e) => A.renderPageToStream({
-					...he,
+					..._e,
 					...e,
-					...g.cspNonce === void 0 ? {} : { nonce: g.cspNonce }
+					...y.cspNonce === void 0 ? {} : { nonce: y.cspNonce }
 				}),
 				onShellError: (e) => {
-					X.error("ssr shell render failed", { pathname: a }, e), t.writeHead(500, { "content-type": "text/plain; charset=utf-8" }), t.end("server error");
+					Q.error("ssr shell render failed", { pathname: a }, e), t.writeHead(500, { "content-type": "text/plain; charset=utf-8" }), t.end("server error");
 				}
 			})
 		};
 	}
-	let { html: ge, meta: _e } = A.renderPageToHtml(he), ve = F(_e), I = v(y(c.replace("<div id=\"root\"></div>", `<div id="root">${ge}</div>`), ve), M);
-	N === "none" && (I = et(I));
-	let ye = w === "isr" ? R(S.revalidate) : null;
+	let { html: be, meta: Se } = A.renderPageToHtml(_e), Ce = ye(Se), L = o(w(d.replace("<div id=\"root\"></div>", `<div id="root">${be}</div>`), Ce), M);
+	N === "none" && (L = ut(L));
+	let we = S === "isr" ? z(b.revalidate) : null;
 	return {
-		html: g.cspNonce === void 0 ? I : te(I, g.cspNonce),
-		renderMode: w,
-		revalidateMs: ye,
-		setCookies: g.setCookies,
-		responseHeaders: g.responseHeaders
+		html: y.cspNonce === void 0 ? L : C(L, y.cspNonce),
+		renderMode: S,
+		revalidateMs: we,
+		setCookies: y.setCookies,
+		responseHeaders: y.responseHeaders
 	};
-}, $ = (e) => e === "" ? "/" : e, at = async (e) => {
-	let t = await import(U(e).href);
+}, $ = (e) => e === "" ? "/" : e, _t = async (e) => {
+	let t = await import(W(e).href);
 	return {
 		kind: "bundle",
 		getPageMeta: () => t.pageMeta,
@@ -535,8 +571,8 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 		},
 		async close() {}
 	};
-}, ot = async (e, t) => {
-	let n = await a("vite", () => import("vite")), r = (await import("@vitejs/plugin-react")).default, i = (await import("@tailwindcss/vite")).default, o = await n.createServer({
+}, vt = async (e, t) => {
+	let n = await h("vite", () => import("vite")), r = (await import("@vitejs/plugin-react")).default, i = (await import("@tailwindcss/vite")).default, a = await n.createServer({
 		root: t,
 		envPrefix: "__VOLTRO_VITE_ENV_DISABLED__",
 		plugins: [r(), i()],
@@ -553,174 +589,202 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 		},
 		appType: "custom",
 		logLevel: "warn"
-	}), s = z(e, "src", "pages"), c = (e) => e === "" ? s : z(s, e), l = A({
-		limit: O(),
-		onColdStart: (e) => X.debug("ssr cold-compile start", { id: e }),
-		onColdEnd: (e, { durationMs: t, failed: n }) => X.debug(`ssr cold-compile ${n ? "FAILED" : "end"} ${t}ms`, {
+	}), o = H(e, "src", "pages"), s = (e) => e === "" ? o : H(o, e), c = k({
+		limit: _(),
+		onColdStart: (e) => Q.debug("ssr cold-compile start", { id: e }),
+		onColdEnd: (e, { durationMs: t, failed: n }) => Q.debug(`ssr cold-compile ${n ? "FAILED" : "end"} ${t}ms`, {
 			id: e,
 			ms: t,
 			...n ? { failed: !0 } : {}
 		})
-	}), u = (e) => l.load(e, async () => await o.ssrLoadModule(e));
+	}), l = (e) => c.load(e, async () => await a.ssrLoadModule(e));
 	return {
 		kind: "middleware",
 		async getPage(e, t) {
-			return u(z(s, t));
+			return l(H(o, t));
 		},
 		async getLayout(e) {
-			return u(z(c(e), "layout.tsx"));
+			return l(H(s(e), "layout.tsx"));
 		},
 		async getError(e) {
-			return u(z(c(e), "error.tsx"));
+			return l(H(s(e), "error.tsx"));
 		},
 		async getPending(e) {
-			return u(z(c(e), "loading.tsx"));
+			return l(H(s(e), "loading.tsx"));
 		},
 		async getHelpers() {
-			return await u("@voltro/web/ssr");
+			return await l("@voltro/web/ssr");
 		},
 		async close() {
-			await o.close();
+			await a.close();
 		}
 	};
-}, st = async (t) => {
-	let a = Me(), s = await D(t);
-	if (!s) return {
+}, yt = async (t) => {
+	let i = He(), o = await _e(t);
+	if (!o) return {
 		ran: !1,
 		exitCode: 0
 	};
-	if (s.type !== "web") return X.error("only web apps are supported by `voltro start`"), {
+	if (o.type !== "web") return Q.error("only web apps are supported by `voltro start`"), {
 		ran: !0,
 		exitCode: 1
 	};
-	let { resolved: u } = await c({
-		rawEnv: s.env,
+	{
+		let e = b(o);
+		if (e !== void 0) return Q.error(`voltro start: refusing to boot — ${e}`), {
+			ran: !0,
+			exitCode: 1
+		};
+	}
+	let { resolved: c } = await ie({
+		rawEnv: o.env,
 		appType: "web",
 		root: t,
-		log: X,
+		log: Q,
 		generateTypes: !1
-	}), p = u.publicValues;
-	a.mark("config");
-	let _ = m();
-	d(_), X.info("booting voltro start", { app: s.name ?? "(unnamed)" });
-	let v = n({
+	}), l = c.publicValues;
+	i.mark("config");
+	let f = se();
+	D(f), Q.info("booting voltro start", { app: o.name ?? "(unnamed)" });
+	let p = n({
 		kind: "web",
-		configPort: s.port,
+		configPort: o.port,
 		env: process.env,
-		dashboardPin: process.env[g] === "1"
+		dashboardPin: process.env[E] === "1"
 	});
-	for (let e of v.warnings) X.warn(e);
-	let y = v.port, b = z(t, ".framework"), x = z(b, "dist"), te = z(x, "index.html");
-	if (!await Q(te)) return X.error("no built dist found — run `voltro build` first", { distDir: x }), {
+	for (let e of p.warnings) Q.warn(e);
+	let m = p.port, h = H(t, ".framework"), g = H(h, "dist"), _ = H(g, "index.html");
+	if (!await dt(_)) return Q.error("no built dist found — run `voltro build` first", { distDir: g }), {
 		ran: !0,
 		exitCode: 1
 	};
-	let E = s.name ?? "unnamed", O = Ae("web", E, y), k = je(E);
-	await De({
-		id: O,
-		name: E,
+	let x = o.name ?? "unnamed", C = Be("web", x, m), w = Ve(x);
+	await Le({
+		id: C,
+		name: x,
 		kind: "web",
-		url: `http://localhost:${y}`,
+		url: `http://localhost:${m}`,
 		pid: process.pid,
 		status: "booting",
-		logFile: k.path
+		logFile: w.path
 	}).catch(() => {});
-	let le = z(x, "_voltro", "shell.html"), A = await Q(le) ? await V.readFile(le, "utf8") : await V.readFile(te, "utf8"), fe = await ue(t, s), pe = ye(s), L = ce(fe[0]), R = fe[0]?.name, Ne = /* @__PURE__ */ new Set(), Pe = (e) => {
-		Ne.has(e.name) || (Ne.add(e.name), X.warn(`middleware.ts wrote the cookie "${e.name}" with the HttpOnly default — a browser SDK cannot read it`, {
+	let ae = H(g, "_voltro", "shell.html"), T = await dt(ae) ? await U.readFile(ae, "utf8") : await U.readFile(_, "utf8"), k = await he(t, o), fe = ke(o), F = M(k[0]), I = k[0]?.name, xe = /* @__PURE__ */ new Set(), R = (e) => {
+		xe.has(e.name) || (xe.add(e.name), Q.warn(`middleware.ts wrote the cookie "${e.name}" with the HttpOnly default — a browser SDK cannot read it`, {
 			cookie: e.name,
 			hint: "If your IdP client reads this from `document.cookie` (Supabase's `createBrowserClient` does), pass `httpOnly: false`. Otherwise the SSR render succeeds and the user is signed out at the first client-side call. Set `httpOnly: true` explicitly to silence this."
 		}));
-	}, B = await l(t);
-	B.length > 0 && X.info(`middleware.ts loaded — ${B.length} middleware(s): ` + B.map((e) => e.exportName).join(", "));
-	let H, U = null, W = process.env.SSR_CACHE === "postgres";
-	if (W && P()) U = new (await (import("pg"))).default.Client(N()), await U.connect(), H = qe({ client: U }), X.info("isr cache backend: postgres", { table: "voltro_isr_cache" });
-	else if (W) {
+	}, z = await ne(t);
+	z.length > 0 && Q.info(`middleware.ts loaded — ${z.length} middleware(s): ` + z.map((e) => e.exportName).join(", "));
+	let B, V = null, Ue = process.env.SSR_CACHE === "postgres";
+	if (Ue && Ce()) V = new (await (import("pg"))).default.Client(Se()), await V.connect(), B = nt({ client: V }), Q.info("isr cache backend: postgres", { table: "voltro_isr_cache" });
+	else if (Ue) {
 		let t = "SSR_CACHE=postgres, but nothing in the environment names a database (looked for DB_URL, DB_PRIMARY_URL, DB_DIRECT_URL, DB_MIGRATE_URL, DB_HOST, PG_HOST).";
-		if (e()) throw X.fatal(`${t} Refusing to fall back to the per-process memory cache: it is not shared between instances and does not survive a restart, so the pages this process serves would differ from its replicas' with nothing to indicate it.`), Error("[voltro start] SSR_CACHE=postgres with no database configured");
-		H = we(), X.warn(`${t} Falling back to the per-process memory cache — this would be a hard failure in production.`);
-	} else H = we(), X.info("isr cache backend: memory (per-process)", { hint: "set SSR_CACHE=postgres for persistent storage" });
-	await j(t, s, fe, p);
-	let Le = z(t, "src", "pages"), { pages: ze, dirs: G } = await w(Le), K = nt(ze);
-	me(B, K.map((e) => e.pattern)), a.mark("scan");
-	let q = z(x, "server", "ssrEntry.js"), Ge = await Q(q);
-	if (!Ge && process.env.NODE_ENV === "production") throw X.fatal(`production \`voltro start\` requires a precompiled SSR bundle at ${q} but it is missing. Run \`voltro build\` before serving — production renders from the bundle and never compiles on demand.`), Error(`[voltro start] missing SSR bundle at ${q}`);
-	let J = Ge ? await at(q) : await ot(t, b);
-	X.info(`ssr loader: ${J.kind}`, {
+		if (e()) throw Q.fatal(`${t} Refusing to fall back to the per-process memory cache: it is not shared between instances and does not survive a restart, so the pages this process serves would differ from its replicas' with nothing to indicate it.`), Error("[voltro start] SSR_CACHE=postgres with no database configured");
+		B = Pe(), Q.warn(`${t} Falling back to the per-process memory cache — this would be a hard failure in production.`);
+	} else B = Pe(), Q.info("isr cache backend: memory (per-process)", { hint: "set SSR_CACHE=postgres for persistent storage" });
+	await s(t, o, k, l);
+	let We = H(t, "src", "pages"), { pages: W, dirs: G } = await be(We), K = pt(W);
+	de(z, K.map((e) => e.pattern)), i.mark("scan");
+	let q = H(g, "server", "ssrEntry.js"), Xe = await dt(q);
+	if (!Xe && process.env.NODE_ENV === "production") throw Q.fatal(`production \`voltro start\` requires a precompiled SSR bundle at ${q} but it is missing. Run \`voltro build\` before serving — production renders from the bundle and never compiles on demand.`), Error(`[voltro start] missing SSR bundle at ${q}`);
+	let J = Xe ? await _t(q) : await vt(t, h);
+	Q.info(`ssr loader: ${J.kind}`, {
 		kind: J.kind,
 		...J.kind === "middleware" ? { hint: "no pre-built SSR bundle found; run `voltro build` to enable bundle mode" } : {}
-	}), a.mark("provider");
-	let Ke = J.getPageMeta?.(), Y = /* @__PURE__ */ new Map(), Ze = 0;
-	for (let e of ze) {
-		let t = Ke?.[e.pattern];
+	}), i.mark("provider");
+	let $e = J.getPageMeta?.();
+	O(t);
+	let Y = /* @__PURE__ */ new Map(), tt = 0;
+	for (let e of W) {
+		let t = $e?.[e.pattern];
 		if (t) {
 			Y.set(e.pattern, t);
 			continue;
 		}
 		try {
 			let t = await J.getPage(e.pattern, e.file);
-			Y.set(e.pattern, Se(t, e.file)), Ze++;
+			Y.set(e.pattern, Me(t, e.file)), tt++;
 		} catch (t) {
-			X.warn("failed to load page metadata", { pattern: e.pattern }, t);
+			Q.warn("failed to load page metadata", { pattern: e.pattern }, t);
 		}
 	}
-	let Qe = /* @__PURE__ */ new Map();
+	let X = /* @__PURE__ */ new Map();
 	for (let [e, t] of Y) {
 		if (t.interactive !== "islands") continue;
-		let n = z(x, "island-shells", `${T(e)}.html`);
+		let n = H(g, "island-shells", `${S(e)}.html`);
 		try {
-			Qe.set(e, await V.readFile(n, "utf8"));
+			X.set(e, await U.readFile(n, "utf8"));
 		} catch {
-			X.warn("islands page has no built per-page shell — serving the full app shell", {
+			Q.warn("islands page has no built per-page shell — serving the full app shell", {
 				pattern: e,
 				expected: n
 			});
 		}
 	}
-	X.info(`registered ${Y.size} route(s)`, {
+	Q.info(`registered ${Y.size} route(s)`, {
 		count: Y.size,
-		fromManifest: Y.size - Ze,
-		fromModules: Ze
-	}), a.mark("routes");
+		fromManifest: Y.size - tt,
+		fromModules: tt
+	}), i.mark("routes");
 	let Z = /* @__PURE__ */ new Set();
-	for (let e of K) Y.get(e.pattern)?.renderMode === "spa" && ne(G, e.dirChain).some((e) => e.hasLayout) && Z.add(e.pattern);
-	Z.size > 0 && X.info(`${Z.size} spa route(s) render an SSR layout shell`, { patterns: [...Z] });
-	let et = /* @__PURE__ */ new Map();
-	for (let [e, t] of Y) t.cacheInvalidatesOn.length > 0 && et.set(e, t.cacheInvalidatesOn);
-	let tt = /* @__PURE__ */ new Map();
-	for (let e of K) tt.set(e.pattern, e.regex);
-	let $ = /* @__PURE__ */ new Map();
-	for (let [e, t] of Y) $.set(e, t.renderMode);
-	let st = [...Y.values()].some((e) => e.renderMode === "isr"), ct = {
-		cache: H,
-		tableSink: Ue({
-			cache: H,
-			tableSubscriptionsByPattern: et,
-			regexByPattern: tt
+	for (let e of K) Y.get(e.pattern)?.renderMode === "spa" && pe(G, e.dirChain).some((e) => e.hasLayout) && Z.add(e.pattern);
+	Z.size > 0 && Q.info(`${Z.size} spa route(s) render an SSR layout shell`, { patterns: [...Z] });
+	let ot = /* @__PURE__ */ new Map();
+	for (let [e, t] of Y) t.cacheInvalidatesOn.length > 0 && ot.set(e, t.cacheInvalidatesOn);
+	let st = /* @__PURE__ */ new Map();
+	for (let e of K) st.set(e.pattern, e.regex);
+	{
+		let n = new Set([...Y].filter(([, e]) => (e.renderMode === "ssr" || e.renderMode === "isr") && e.hasOgImage).map(([e]) => e));
+		if (n.size > 0) {
+			let { secret: r, fromEnv: i } = le();
+			if (!i && e()) throw Q.fatal(`${n.size} ssr route(s) export ogImage, but VOLTRO_OG_SECRET is unset. Behind a load balancer the signing replica and the fetching replica differ, so a per-boot secret would 403 every cross-replica image fetch. Set VOLTRO_OG_SECRET (any long random value, same on every replica).`), Error("[voltro start] ssr ogImage routes need VOLTRO_OG_SECRET in a deploy environment");
+			let a = new Map(W.map((e) => [e.pattern, e.file]));
+			ht = j({
+				root: t,
+				fonts: o.fonts,
+				cache: B,
+				secret: r,
+				isOgSsrRoute: (e) => n.has(e),
+				getPageModule: async (e) => {
+					let t = a.get(e);
+					return t === void 0 ? null : await J.getPage(e, t);
+				}
+			}), Q.info(`og route active for ${n.size} ssr route(s)`, { secret: i ? "env" : "per-boot" });
+		}
+	}
+	let ct = /* @__PURE__ */ new Map();
+	for (let [e, t] of Y) ct.set(e, t.renderMode);
+	let ut = [...Y.values()].some((e) => e.renderMode === "isr"), ft = {
+		cache: B,
+		tableSink: Qe({
+			cache: B,
+			tableSubscriptionsByPattern: ot,
+			regexByPattern: st
 		}),
-		regexByPattern: tt,
-		renderModeByPattern: $
-	}, lt = (e) => {
-		let t = Je(e);
-		t && Ye(ct, t);
-	}, ut = We({
-		cache: H,
-		tableSubscriptionsByPattern: et,
-		regexByPattern: tt,
-		...st ? { onRevalidate: lt } : {}
-	}), dt = await ut.start(), ft = null, pt = null;
-	if (st) {
-		let e = Be({}, process.env);
+		regexByPattern: st,
+		renderModeByPattern: ct
+	}, $ = (e) => {
+		let t = rt(e);
+		t && it(ft, t);
+	}, yt = et({
+		cache: B,
+		tableSubscriptionsByPattern: ot,
+		regexByPattern: st,
+		...ut ? { onRevalidate: $ } : {}
+	}), bt = await yt.start(), xt = null, St = null;
+	if (ut) {
+		let e = Je({}, process.env);
 		if (e.crossReplica) try {
-			pt = e.provider;
-			let t = be(process.env);
-			ft = await Ie.runPromise(e.provider.subscribe(t, lt)), X.info(`revalidation subscriber: broker (${e.provider.name})`, { channel: t });
+			St = e.provider;
+			let t = Ae(process.env);
+			xt = await Ke.runPromise(e.provider.subscribe(t, $)), Q.info(`revalidation subscriber: broker (${e.provider.name})`, { channel: t });
 		} catch (e) {
-			X.warn("revalidation broker subscribe failed — broker leg disabled", {}, e), pt = null;
+			Q.warn("revalidation broker subscribe failed — broker leg disabled", {}, e), St = null;
 		}
-		dt && ft === null && X.info("revalidation subscriber: postgres LISTEN (voltro_revalidate)"), !dt && ft === null && X.warn("isr routes exist, but this web process has NO revalidation transport: no database is configured for the LISTEN line and no broker is configured. `revalidatePath` / `revalidateTable` / `revalidateTag` from the api will not reach this process — cached pages stay until their own `revalidate` window expires. Set DB_URL (postgres) or BROADCAST_URL (redis:// or nats://) on BOTH the api and this web deployment.");
+		bt && xt === null && Q.info("revalidation subscriber: postgres LISTEN (voltro_revalidate)"), !bt && xt === null && Q.warn("isr routes exist, but this web process has NO revalidation transport: no database is configured for the LISTEN line and no broker is configured. `revalidatePath` / `revalidateTable` / `revalidateTag` from the api will not reach this process — cached pages stay until their own `revalidate` window expires. Set DB_URL (postgres) or BROADCAST_URL (redis:// or nats://) on BOTH the api and this web deployment.");
 	}
-	a.mark("cdc");
-	let mt = xe(), ht = ze.map((e) => {
+	i.mark("cdc");
+	let Ct = je(), wt = W.map((e) => {
 		let t = Y.get(e.pattern);
 		return {
 			pattern: e.pattern,
@@ -736,20 +800,20 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 			hasMeta: t?.hasMeta ?? !1,
 			hasGetStaticPaths: t?.hasGetStaticPaths ?? !1
 		};
-	}), gt = G.map((e) => ({
+	}), Tt = G.map((e) => ({
 		dir: e.dir,
 		hasLayout: e.hasLayout,
 		hasError: e.hasError,
 		hasPending: e.hasPending,
 		hasNotFound: e.hasNotFound
-	})), _t = U ? "postgres" : "memory", vt = {
+	})), Et = V ? "postgres" : "memory", Dt = {
 		kind: "web",
 		meta: {
-			name: s.name ?? "(unnamed)",
-			voltroVersion: Xe,
-			port: y,
+			name: o.name ?? "(unnamed)",
+			voltroVersion: at,
+			port: m,
 			mode: "start",
-			apis: Object.entries(s.apis ?? {}).map(([e, t]) => {
+			apis: Object.entries(o.apis ?? {}).map(([e, t]) => {
 				let n = {
 					name: e,
 					package: t.package
@@ -757,10 +821,10 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 				return t.url !== void 0 && (n.url = t.url), n;
 			})
 		},
-		routes: ht,
-		dirs: gt,
+		routes: wt,
+		dirs: Tt,
 		cache: () => {
-			let e = Date.now(), t = H.snapshot().map(([t, n]) => ({
+			let e = Date.now(), t = B.snapshot().map(([t, n]) => ({
 				key: t,
 				renderedAt: n.renderedAt,
 				expiresAt: n.expiresAt,
@@ -771,16 +835,16 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 				staleWhileRevalidateMs: n.staleWhileRevalidateMs
 			}));
 			return {
-				backend: _t,
-				size: H.size(),
+				backend: Et,
+				size: B.size(),
 				entries: t
 			};
 		},
-		metrics: () => Re()
-	}, yt = async (e, n) => {
-		let a = e.split("?")[0] ?? "/";
-		if (s.name === "voltroDashboard" && a === "/api/dashboard/registry") try {
-			let e = await Oe();
+		metrics: () => qe()
+	}, Ot = async (e, n) => {
+		let r = e.split("?")[0] ?? "/";
+		if (o.name === "voltroDashboard" && r === "/api/dashboard/registry") try {
+			let e = await Re();
 			return {
 				status: 200,
 				headers: { "content-type": "application/json; charset=utf-8" },
@@ -793,7 +857,7 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 				body: `registry read error: ${e.message}`
 			};
 		}
-		if (s.name === "voltroDashboard" && a === "/api/dashboard/config") {
+		if (o.name === "voltroDashboard" && r === "/api/dashboard/config") {
 			let e = process.env.VOLTRO_DASHBOARD_APPS, t = [];
 			if (e && e.trim().length > 0) {
 				let n;
@@ -822,19 +886,27 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 				body: JSON.stringify({ apps: t })
 			};
 		}
-		if (a === "/_voltro/inspect/logs") {
-			let t = f(e, h(), n);
+		if (ht !== null && r === "/_voltro/og") {
+			let t = await ht.handle(new URL(e, "http://localhost"));
+			if (t !== null) return {
+				status: t.status,
+				headers: { ...t.headers },
+				body: Buffer.from(t.body)
+			};
+		}
+		if (r === "/_voltro/inspect/logs") {
+			let t = N(e, P(), n);
 			return {
 				status: t.status,
 				headers: {
 					"content-type": t.contentType,
-					...F(n.origin)
+					...we(n.origin)
 				},
 				body: t.body
 			};
 		}
-		if (a !== "/_voltro/inspect/stream") {
-			let t = _e(e, vt, n);
+		if (r !== "/_voltro/inspect/stream") {
+			let t = Ee(e, Dt, n);
 			if (t !== null) return {
 				status: t.status,
 				headers: {
@@ -844,161 +916,252 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 				body: t.body
 			};
 		}
-		let o = rt(a, K), c = o ? Y.get(o.route.pattern)?.renderMode : void 0, l = c === "ssr" || c === "isr" || (o ? Z.has(o.route.pattern) : !1), u = [];
-		if (!l && B.length > 0) {
-			let t = i(B, {
+		let i = mt(r, K), a = i ? Y.get(i.route.pattern)?.renderMode : void 0, s = a === "ssr" || a === "isr" || (i ? Z.has(i.route.pattern) : !1), c = [];
+		if (!s && z.length > 0) {
+			let t = te(z, {
 				route: void 0,
-				pathname: a
+				pathname: r
 			});
 			if (t !== void 0) {
-				let r = await se(t, {
-					pathname: a,
-					search: e.slice(a.length),
+				let i = await ee(t, {
+					pathname: r,
+					search: e.slice(r.length),
 					headers: n,
-					cookies: ee(n.cookie),
+					cookies: u(n.cookie),
 					route: void 0
 				});
-				u.push(...r.setCookies);
+				c.push(...i.setCookies);
 			}
 		}
-		let d = (e) => u.length === 0 ? e : {
+		let l = (e) => c.length === 0 ? e : {
 			...e,
-			"set-cookie": u.map(oe)
-		}, p = a === "/" ? z(x, "index.html") : z(x, a.replace(/^\//, ""), "index.html");
-		if (!l && await Q(p)) {
-			let e = await V.readFile(p);
+			"set-cookie": c.map(y)
+		}, p = r === "/" ? H(g, "index.html") : H(g, r.replace(/^\//, ""), "index.html");
+		if (!s && await dt(p)) {
+			let e = await U.readFile(p);
 			return {
 				status: 200,
-				headers: d({ "content-type": "text/html; charset=utf-8" }),
+				headers: l({ "content-type": "text/html; charset=utf-8" }),
 				body: e
 			};
 		}
-		if (/\.[a-z0-9]+$/i.test(a)) {
-			let e = z(x, a.replace(/^\//, ""));
-			if (await Q(e)) {
-				let t = await V.readFile(e);
+		if (/\.[a-z0-9]+$/i.test(r)) {
+			let e = H(g, r.replace(/^\//, ""));
+			if (await dt(e)) {
+				let t = await U.readFile(e);
 				return {
 					status: 200,
-					headers: d({ "content-type": $e(e) }),
+					headers: l({ "content-type": lt(e) }),
 					body: t
 				};
 			}
 		}
-		let m = rt(a, K);
-		if (!m) return {
-			status: 404,
-			headers: d({ "content-type": "text/plain" }),
-			body: "not found"
-		};
-		let g = Y.get(m.route.pattern), v = n["x-tenant"] ?? "anonymous", y = (await J.getHelpers()).i18n?.resolve(n.cookie, n["accept-language"])?.locale, b = Te(a, {
-			...g?.tenantAware ? { tenant: v } : {},
-			...y ? { locale: y } : {}
-		}), S = H.get(b), C = Date.now();
-		if (S && Ee(S, C)) return _.emit("cache", {
+		let m = mt(r, K);
+		if (!m) {
+			let i = ue(G, r);
+			if (i !== void 0) try {
+				let a = await gt({
+					provider: J,
+					root: t,
+					route: {
+						pattern: "<not-found>",
+						file: i.dir === "" ? "not-found.tsx" : `${i.dir}/not-found.tsx`,
+						dirChain: i.chain,
+						regex: /^$/,
+						paramNames: [],
+						priority: 2 ** 53 - 1
+					},
+					params: {},
+					pathname: r,
+					dirs: G,
+					shellTemplate: T,
+					requestHeaders: n,
+					apiOrigin: F,
+					apiName: I,
+					middlewares: z,
+					onCookieWarning: R,
+					requestUrl: e,
+					buffered: !0,
+					forceSsrRender: !0
+				});
+				if (a && "html" in a && typeof a.html == "string") return {
+					status: 404,
+					headers: l({
+						"content-type": "text/html; charset=utf-8",
+						"x-voltro-rendered-by": "ssr-not-found"
+					}),
+					body: a.html
+				};
+			} catch (e) {
+				Q.warn("not-found.tsx failed to render — serving the plain 404", { pathname: r }, e instanceof Error ? e : Error(String(e)));
+			}
+			return {
+				status: 404,
+				headers: l({
+					"content-type": "text/plain",
+					"x-voltro-rendered-by": "plain-not-found"
+				}),
+				body: "not found"
+			};
+		}
+		let h = Y.get(m.route.pattern), _ = n["x-tenant"] ?? "anonymous", ne = (await J.getHelpers()).i18n?.resolve(n.cookie, n["accept-language"])?.locale, v = Fe(r, {
+			...h?.tenantAware ? { tenant: _ } : {},
+			...ne ? { locale: ne } : {}
+		}), b = h?.ppr === !0 && h.renderMode === "isr", x = (i, a) => ({
+			status: 200,
+			headers: {},
+			body: "",
+			stream: (o) => {
+				re(m.route.pattern), o.writeHead(200, {
+					"content-type": "text/html; charset=utf-8",
+					"x-voltro-rendered-by": "isr",
+					"x-voltro-ppr": "shell+holes",
+					...a
+				}), o.write(i), (async () => {
+					try {
+						let i = await gt({
+							provider: J,
+							root: t,
+							route: m.route,
+							params: m.params,
+							pathname: r,
+							dirs: G,
+							shellTemplate: X.get(m.route.pattern) ?? T,
+							requestHeaders: n,
+							apiOrigin: F,
+							apiName: I,
+							middlewares: z,
+							onCookieWarning: R,
+							requestUrl: e,
+							holesOnly: !0
+						});
+						i !== null && "holes" in i ? await ye({
+							loader: i.holes.loader,
+							ctx: i.holes.ctx,
+							res: o,
+							helpers: i.holes.helpers,
+							page: i.holes.page,
+							log: Q
+						}) : o.writableEnded || o.end();
+					} catch (e) {
+						Q.warn("ppr hole pass failed", { url: r }, e), o.writableEnded || o.end();
+					}
+				})();
+			}
+		}), S = B.get(v), C = Date.now();
+		if (S && Ie(S, C)) return f.emit("cache", {
 			kind: "HIT",
-			key: b,
+			key: v,
 			ageMs: C - S.renderedAt
-		}), {
+		}), b ? x(S.html, {
+			"x-voltro-cache": "HIT",
+			"x-voltro-cache-key": v,
+			"x-voltro-cache-age-ms": String(C - S.renderedAt)
+		}) : {
 			status: 200,
 			headers: {
 				"content-type": "text/html; charset=utf-8",
 				"x-voltro-rendered-by": "isr",
 				"x-voltro-cache": "HIT",
-				"x-voltro-cache-key": b,
+				"x-voltro-cache-key": v,
 				"x-voltro-cache-age-ms": String(C - S.renderedAt)
 			},
 			body: S.html
 		};
-		if (S && Ce(S, C)) {
-			_.emit("cache", {
+		if (S && Ne(S, C)) {
+			f.emit("cache", {
 				kind: "STALE",
-				key: b,
+				key: v,
 				ageMs: C - S.renderedAt
 			});
-			let r = H.generation(b);
+			let i = B.generation(v);
 			return (async () => {
 				try {
-					let i = await it({
+					let a = await gt({
 						provider: J,
 						root: t,
 						route: m.route,
 						params: m.params,
-						pathname: a,
+						pathname: r,
 						dirs: G,
-						shellTemplate: Qe.get(m.route.pattern) ?? A,
+						shellTemplate: X.get(m.route.pattern) ?? T,
 						requestHeaders: n,
-						apiOrigin: L,
-						apiName: R,
-						middlewares: B,
-						onCookieWarning: Pe,
+						apiOrigin: F,
+						apiName: I,
+						middlewares: z,
+						onCookieWarning: R,
 						requestUrl: e,
 						buffered: !0
 					});
-					if (i && "html" in i && i.renderMode === "isr" && i.revalidateMs !== null) {
+					if (a && "html" in a && a.renderMode === "isr" && a.revalidateMs !== null) {
 						let e = Y.get(m.route.pattern)?.staleWhileRevalidateMs ?? 0, t = Date.now();
-						H.set(b, {
-							html: i.html,
+						B.set(v, {
+							html: a.html,
 							renderedAt: t,
-							expiresAt: t + i.revalidateMs,
-							servableUntil: t + i.revalidateMs + e,
-							revalidateMs: i.revalidateMs,
+							expiresAt: t + a.revalidateMs,
+							servableUntil: t + a.revalidateMs + e,
+							revalidateMs: a.revalidateMs,
 							staleWhileRevalidateMs: e
-						}, { ifGeneration: r }) || X.info("SWR refresh discarded — the entry was purged while it rendered", { key: b });
+						}, { ifGeneration: i }) || Q.info("SWR refresh discarded — the entry was purged while it rendered", { key: v });
 					}
 				} catch (e) {
-					X.warn("background SWR refresh failed", { url: a }, e);
+					Q.warn("background SWR refresh failed", { url: r }, e);
 				}
-			})(), {
+			})(), b ? x(S.html, {
+				"x-voltro-cache": "STALE",
+				"x-voltro-cache-key": v,
+				"x-voltro-cache-age-ms": String(C - S.renderedAt)
+			}) : {
 				status: 200,
 				headers: {
 					"content-type": "text/html; charset=utf-8",
 					"x-voltro-rendered-by": "isr",
 					"x-voltro-cache": "STALE",
-					"x-voltro-cache-key": b,
+					"x-voltro-cache-key": v,
 					"x-voltro-cache-age-ms": String(C - S.renderedAt)
 				},
 				body: S.html
 			};
 		}
 		try {
-			let r = H.generation(b), i = await it({
+			let i = B.generation(v), a = await gt({
 				provider: J,
 				root: t,
 				route: m.route,
 				params: m.params,
-				pathname: a,
+				pathname: r,
 				dirs: G,
-				shellTemplate: Qe.get(m.route.pattern) ?? A,
+				shellTemplate: X.get(m.route.pattern) ?? T,
 				requestHeaders: n,
-				apiOrigin: L,
-				apiName: R,
-				middlewares: B,
-				onCookieWarning: Pe,
+				apiOrigin: F,
+				apiName: I,
+				middlewares: z,
+				onCookieWarning: R,
 				requestUrl: e
 			});
-			if (!i) return {
+			if (!a) return {
 				status: 200,
 				headers: {
 					"content-type": "text/html; charset=utf-8",
 					"x-voltro-rendered-by": "spa-fallback"
 				},
-				body: A
+				body: T
 			};
-			let o = i.setCookies ?? [], s = i.responseHeaders ?? {}, c = (e) => ({
+			let o = a.setCookies ?? [], s = a.responseHeaders ?? {}, c = (e) => ({
 				...s,
 				...e,
-				...o.length === 0 ? {} : { "set-cookie": o.map(oe) }
+				...o.length === 0 ? {} : { "set-cookie": o.map(y) }
 			});
-			if ("stream" in i) return {
+			if ("stream" in a) return {
 				status: 200,
-				headers: { "x-voltro-rendered-by": i.renderMode },
+				headers: { "x-voltro-rendered-by": a.renderMode },
 				body: "",
-				stream: i.stream
+				stream: a.stream
 			};
-			if ("control" in i) return i.control === "redirect" ? {
-				status: i.status,
+			if ("control" in a) return a.control === "redirect" ? {
+				status: a.status,
 				headers: c({
-					location: i.location,
+					location: a.location,
 					"x-voltro-rendered-by": "loader-redirect"
 				}),
 				body: ""
@@ -1010,86 +1173,101 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 				}),
 				body: "not found"
 			};
+			if ("holes" in a) throw Error("renderPageForRequest returned a holes arm without holesOnly");
 			let l = c({
 				"content-type": "text/html; charset=utf-8",
-				"x-voltro-rendered-by": i.renderMode
+				"x-voltro-rendered-by": a.renderMode
 			});
-			if (i.renderMode === "isr" && i.revalidateMs !== null) {
+			if (a.renderMode === "isr" && a.revalidateMs !== null) {
 				let e = Date.now(), t = Y.get(m.route.pattern)?.staleWhileRevalidateMs ?? 0;
-				H.set(b, {
-					html: i.html,
+				B.set(v, {
+					html: a.html,
 					renderedAt: e,
-					expiresAt: e + i.revalidateMs,
-					servableUntil: e + i.revalidateMs + t,
-					revalidateMs: i.revalidateMs,
+					expiresAt: e + a.revalidateMs,
+					servableUntil: e + a.revalidateMs + t,
+					revalidateMs: a.revalidateMs,
 					staleWhileRevalidateMs: t
-				}, { ifGeneration: r }) || X.info("miss fill discarded — the entry was purged while it rendered", { key: b }), l["x-voltro-cache"] = "MISS", l["x-voltro-cache-key"] = b, l["x-voltro-cache-revalidate-ms"] = String(i.revalidateMs), t > 0 && (l["x-voltro-cache-swr-ms"] = String(t)), _.emit("cache", {
+				}, { ifGeneration: i }) || Q.info("miss fill discarded — the entry was purged while it rendered", { key: v }), l["x-voltro-cache"] = "MISS", l["x-voltro-cache-key"] = v, l["x-voltro-cache-revalidate-ms"] = String(a.revalidateMs), t > 0 && (l["x-voltro-cache-swr-ms"] = String(t)), f.emit("cache", {
 					kind: "MISS",
-					key: b,
-					revalidateMs: i.revalidateMs,
+					key: v,
+					revalidateMs: a.revalidateMs,
 					swrMs: t
 				});
-			} else i.renderMode === "isr" && (l["x-voltro-cache"] = "BYPASS", _.emit("cache", {
+			} else a.renderMode === "isr" && (l["x-voltro-cache"] = "BYPASS", f.emit("cache", {
 				kind: "BYPASS",
-				key: b
+				key: v
 			}));
-			return {
+			return b && a.renderMode === "isr" ? x(a.html, {
+				"x-voltro-cache": l["x-voltro-cache"] ?? "MISS",
+				"x-voltro-cache-key": v
+			}) : {
 				status: 200,
 				headers: l,
-				body: i.html
+				body: a.html
 			};
 		} catch (e) {
-			return X.error("render error", { url: a }, e), r(e) ? {
+			return Q.error("render error", { url: r }, e), d(e) ? {
 				status: 500,
 				headers: {
 					"content-type": "text/plain; charset=utf-8",
 					"x-voltro-rendered-by": "defer-unsupported"
 				},
 				body: e.message
+			} : e instanceof Error && e.name === "PprShellCredentialAccessError" ? {
+				status: 500,
+				headers: {
+					"content-type": "text/plain; charset=utf-8",
+					"x-voltro-rendered-by": "ppr-shell-credential"
+				},
+				body: e.message
 			} : {
 				status: 500,
 				headers: { "content-type": "text/plain" },
 				body: "server error"
 			};
 		}
-	}, bt = !1, xt = ie({
-		apiName: R,
-		apiOrigin: L,
+	}, kt = !1, At = a({
+		apiName: I,
+		apiOrigin: F,
 		loadDescriptors: async () => {
-			if (R === void 0) return;
-			let e = (await J.getHelpers()).apiDescriptors?.[R];
+			if (I === void 0) return;
+			let e = (await J.getHelpers()).apiDescriptors?.[I];
 			return e === void 0 ? void 0 : await e();
 		},
-		rpcQuery: (e, t) => C(L, e, {
-			apiName: R,
+		rpcQuery: (e, t) => ge(F, e, {
+			apiName: I,
 			headers: t
 		}),
+		resolveLocale: async (e, t) => {
+			let n = await J.getHelpers(), r = A(t, n.i18n?.locales);
+			return r === void 0 ? n.i18n?.resolve(e.cookie, e["accept-language"])?.locale ?? "en" : r;
+		},
 		renderErrorPage: async ({ path: e, headers: n, flash: r }) => {
-			let { pathname: i } = ae(e), a = rt(i, K);
+			let { pathname: i } = oe(e), a = mt(i, K);
 			if (!a) return;
-			let o = await it({
+			let o = await gt({
 				provider: J,
 				root: t,
 				route: a.route,
 				params: a.params,
 				pathname: i,
 				dirs: G,
-				shellTemplate: A,
+				shellTemplate: T,
 				requestHeaders: n,
-				apiOrigin: L,
-				apiName: R,
-				middlewares: B,
-				onCookieWarning: Pe,
+				apiOrigin: F,
+				apiName: I,
+				middlewares: z,
+				onCookieWarning: R,
 				requestUrl: e,
 				formFlash: r,
 				buffered: !0
 			});
 			return o !== null && "html" in o ? o.html : void 0;
 		}
-	}), St = Ve(async (e, t) => {
+	}), jt = Ye(async (e, t) => {
 		let n = e.url ?? "/", r = Date.now(), i = {};
 		for (let [t, n] of Object.entries(e.headers)) n !== void 0 && (i[t.toLowerCase()] = Array.isArray(n) ? n.join(", ") : n);
-		let a = n.split("?")[0] ?? "/", o = (e.method ?? "GET").toUpperCase();
+		let a = n.split("?")[0] ?? "/", s = (e.method ?? "GET").toUpperCase();
 		if (a === "/internal/liveness") {
 			t.writeHead(200, {
 				"content-type": "text/plain",
@@ -1098,45 +1276,45 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 			return;
 		}
 		if (a === "/internal/readiness") {
-			let e = bt ? 200 : 503;
+			let e = kt ? 200 : 503;
 			t.writeHead(e, {
 				"content-type": "text/plain",
 				"cache-control": "no-store"
-			}), t.end(bt ? "ready" : "not-ready");
+			}), t.end(kt ? "ready" : "not-ready");
 			return;
 		}
-		if (!(a.startsWith(re) && await xt(e, t))) {
-			if (o === "OPTIONS" && a.startsWith("/_voltro/inspect")) {
-				let e = F(i.origin);
+		if (!(a.startsWith(v) && await At(e, t))) {
+			if (s === "OPTIONS" && a.startsWith("/_voltro/inspect")) {
+				let e = we(i.origin);
 				t.writeHead(204, e), t.end();
 				return;
 			}
-			if (s.name === "voltroDashboard" && a === "/api/dashboard/proxy") {
+			if (o.name === "voltroDashboard" && a === "/api/dashboard/proxy") {
 				let r = new URL(n, "http://x").searchParams.get("target");
 				if (!r) {
 					t.writeHead(400, { "content-type": "text/plain" }), t.end("missing ?target=");
 					return;
 				}
-				if (!I(r)) {
+				if (!Oe(r)) {
 					t.writeHead(400, { "content-type": "text/plain" }), t.end("target not allowed: must be loopback or an origin configured in VOLTRO_DASHBOARD_APPS");
 					return;
 				}
 				try {
 					let n = { accept: i.accept ?? "application/json" }, a = i.authorization;
-					a ? n.authorization = Array.isArray(a) ? a[0] : a : ve(r) && process.env.VOLTRO_INSPECT_TOKEN && (n.authorization = `Bearer ${process.env.VOLTRO_INSPECT_TOKEN}`);
-					let s;
-					if (o && o !== "GET" && o !== "HEAD") {
+					a ? n.authorization = Array.isArray(a) ? a[0] : a : De(r) && process.env.VOLTRO_INSPECT_TOKEN && (n.authorization = `Bearer ${process.env.VOLTRO_INSPECT_TOKEN}`);
+					let o;
+					if (s && s !== "GET" && s !== "HEAD") {
 						let t = [];
 						for await (let n of e) t.push(n);
-						s = Buffer.concat(t);
+						o = Buffer.concat(t);
 						let r = i["content-type"];
 						r && (n["content-type"] = Array.isArray(r) ? r[0] : r);
 					}
 					let c = await fetch(r, {
 						redirect: "manual",
-						method: o,
+						method: s,
 						headers: n,
-						...s ? { body: new Uint8Array(s.buffer, s.byteOffset, s.byteLength) } : {}
+						...o ? { body: new Uint8Array(o.buffer, o.byteOffset, o.byteLength) } : {}
 					}), l = Buffer.from(await c.arrayBuffer());
 					t.writeHead(c.status, {
 						"content-type": c.headers.get("content-type") ?? "application/octet-stream",
@@ -1147,20 +1325,20 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 				}
 				return;
 			}
-			if (s.name === "voltroDashboard" && a === "/api/dashboard/proxy/stream") {
+			if (o.name === "voltroDashboard" && a === "/api/dashboard/proxy/stream") {
 				let r = new URL(n, "http://x").searchParams.get("target");
 				if (!r) {
 					t.writeHead(400, { "content-type": "text/plain" }), t.end("missing ?target=");
 					return;
 				}
-				if (!I(r)) {
+				if (!Oe(r)) {
 					t.writeHead(400, { "content-type": "text/plain" }), t.end("target not allowed: must be loopback or an origin configured in VOLTRO_DASHBOARD_APPS");
 					return;
 				}
 				let a = new AbortController();
 				e.on("close", () => a.abort()), t.on("close", () => a.abort());
 				try {
-					let e = i.authorization ?? (ve(r) && process.env.VOLTRO_INSPECT_TOKEN ? `Bearer ${process.env.VOLTRO_INSPECT_TOKEN}` : void 0), n = await fetch(r, {
+					let e = i.authorization ?? (De(r) && process.env.VOLTRO_INSPECT_TOKEN ? `Bearer ${process.env.VOLTRO_INSPECT_TOKEN}` : void 0), n = await fetch(r, {
 						redirect: "manual",
 						method: "GET",
 						headers: {
@@ -1195,15 +1373,15 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 				return;
 			}
 			if (a === "/_voltro/inspect/stream") {
-				let n = F(i.origin);
-				if (he()) {
+				let n = we(i.origin);
+				if (L()) {
 					t.writeHead(503, {
 						"content-type": "application/json",
 						...n
 					}), t.end(JSON.stringify({ error: "inspect disabled (VOLTRO_INSPECT=off)" }));
 					return;
 				}
-				let r = ge(i, "GET");
+				let r = Te(i, "GET");
 				if (!r.ok) {
 					t.writeHead(401, {
 						"content-type": "application/json",
@@ -1221,11 +1399,11 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 					"x-accel-buffering": "no",
 					...n
 				}), t.flushHeaders(), t.write("retry: 5000\n\n");
-				for (let e of _.buffered()) t.write(de(e));
-				let a = _.subscribe((e) => {
-					t.write(de(e));
+				for (let e of f.buffered()) t.write(ve(e));
+				let a = f.subscribe((e) => {
+					t.write(ve(e));
 				}), o = setInterval(() => {
-					t.write(S());
+					t.write(me());
 				}, 15e3), s = () => {
 					clearInterval(o), a();
 				};
@@ -1233,25 +1411,25 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 				return;
 			}
 			try {
-				let e = await yt(n, i);
-				if (e.stream ? e.stream(t) : He({
+				let e = await Ot(n, i);
+				if (e.stream ? e.stream(t) : Ze({
 					response: t,
 					status: e.status,
 					headers: e.headers,
 					body: e.body,
 					requestHeaders: i,
-					compression: pe.compression
+					compression: fe.compression
 				}) || (t.writeHead(e.status, e.headers), t.end(e.body)), !a.startsWith("/_voltro/inspect")) {
 					let t = Date.now() - r;
-					_.emit("request", {
+					f.emit("request", {
 						url: a,
 						status: e.status,
 						durationMs: t,
 						renderedBy: e.headers["x-voltro-rendered-by"],
 						cache: e.headers["x-voltro-cache"]
 					});
-					let n = rt(a, K)?.route.pattern ?? (e.status === 404 ? "<unmatched>" : "<asset>");
-					mt.record({
+					let n = mt(a, K)?.route.pattern ?? (e.status === 404 ? "<unmatched>" : "<asset>");
+					Ct.record({
 						kind: "request",
 						tag: n,
 						durationMs: t,
@@ -1263,77 +1441,77 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 			}
 		}
 	});
-	await new Promise((e) => St.listen(y, "::", e)), bt = !0, a.mark("ready"), X.info(`listening on http://localhost:${y}`, {
-		port: y,
-		distDir: x
-	}), X.debug("dynamic + ssr/isr routes resolve via SSR loader");
+	await new Promise((e) => jt.listen(m, "::", e)), kt = !0, i.mark("ready"), Q.info(`listening on http://localhost:${m}`, {
+		port: m,
+		distDir: g
+	}), Q.debug("dynamic + ssr/isr routes resolve via SSR loader");
 	try {
-		await De({
-			id: O,
-			name: E,
+		await Le({
+			id: C,
+			name: x,
 			kind: "web",
-			url: `http://localhost:${y}`,
+			url: `http://localhost:${m}`,
 			pid: process.pid,
 			status: "live",
-			logFile: k.path
+			logFile: w.path
 		});
-		let e = o(t);
+		let e = ce(t);
 		if (e) {
-			let t = await M({ dashboardAppPath: e });
-			t.status === "launched" ? X.info(`dashboard launched at http://localhost:${t.port}`, { port: t.port }) : t.status === "already-running" && X.debug(`dashboard already running on :${t.port}`, { port: t.port });
+			let t = await r({ dashboardAppPath: e });
+			t.status === "launched" ? Q.info(`dashboard launched at http://localhost:${t.port}`, { port: t.port }) : t.status === "already-running" && Q.debug(`dashboard already running on :${t.port}`, { port: t.port });
 		}
 		setInterval(() => {
-			De({
-				id: O,
-				name: E,
+			Le({
+				id: C,
+				name: x,
 				kind: "web",
-				url: `http://localhost:${y}`,
+				url: `http://localhost:${m}`,
 				pid: process.pid,
 				status: "live",
-				logFile: k.path
+				logFile: w.path
 			}).catch(() => {});
 		}, 1e4).unref();
 	} catch (e) {
-		X.warn("runtime-registry write failed", {}, e);
+		Q.warn("runtime-registry write failed", {}, e);
 	}
-	Fe({
-		app: s.name ?? "unnamed",
+	Ge({
+		app: o.name ?? "unnamed",
 		kind: "web",
-		url: `http://localhost:${y}`,
-		bootMs: a.total()
+		url: `http://localhost:${m}`,
+		bootMs: i.total()
 	});
-	let Ct = a.phaseBreakdown();
-	X.info(`start: ready in ${a.total()}ms`, {
-		bootMs: a.total(),
-		...Ct ? { phases: Ct } : {}
+	let Mt = i.phaseBreakdown();
+	Q.info(`start: ready in ${i.total()}ms`, {
+		bootMs: i.total(),
+		...Mt ? { phases: Mt } : {}
 	});
-	let wt = !1, Tt = (e) => async () => {
-		if (!wt) {
-			if (wt = !0, X.info(`received ${e}, shutting down`, { signal: e }), St.close(), await ut.stop(), ft) try {
-				ft();
+	let Nt = !1, Pt = (e) => async () => {
+		if (!Nt) {
+			if (Nt = !0, Q.info(`received ${e}, shutting down`, { signal: e }), jt.close(), await yt.stop(), xt) try {
+				xt();
 			} catch {}
-			if (pt) try {
-				await Ie.runPromise(pt.close());
+			if (St) try {
+				await Ke.runPromise(St.close());
 			} catch {}
-			if (U) try {
-				await U.end();
+			if (V) try {
+				await V.end();
 			} catch {}
-			await J.close(), await ke(O), await k.dispose(), process.exit(0);
+			await J.close(), await ze(C), await w.dispose(), process.exit(0);
 		}
 	};
-	process.on("SIGINT", Tt("SIGINT")), process.on("SIGTERM", Tt("SIGTERM"));
-	let Et = process.ppid;
-	if (Et > 1) {
+	process.on("SIGINT", Pt("SIGINT")), process.on("SIGTERM", Pt("SIGTERM"));
+	let Ft = process.ppid;
+	if (Ft > 1) {
 		let e = setInterval(() => {
-			(process.ppid !== Et || process.ppid === 1) && (clearInterval(e), Tt("SIGTERM")());
+			(process.ppid !== Ft || process.ppid === 1) && (clearInterval(e), Pt("SIGTERM")());
 		}, 2e3);
 		e.unref();
 	}
 	return new Promise(() => {});
-}, ct = async (e) => {
+}, bt = async (e) => {
 	t("start");
-	let n = e.find((e) => !e.startsWith("-")) ?? process.cwd(), r = await st(B(n));
-	return r.ran ? r.exitCode : (X.error("no web app found at this path"), 1);
+	let n = e.find((e) => !e.startsWith("-")) ?? process.cwd(), r = await yt(Ue(n));
+	return r.ran ? r.exitCode : (Q.error("no web app found at this path"), 1);
 };
 //#endregion
-export { st as n, ct as t };
+export { yt as n, bt as t };