@voltro/cli 0.57.0 → 0.59.0

package/dist/{serveCommand-B_w-Mpb_.js → serveCommand-Dr4KXmTS.js}

@@ -4,31 +4,31 @@ import { r as n, t as r } from "./appModuleLoader-C9r9mxZt.js";
 import { t as i } from "./bootRefusal-pgvDxlrU.js";
 import { n as a, r as o } from "./startupRunner-CEqQq7ax.js";
 import { n as s, t as c } from "./interruptedReplace-CwnkBb2X.js";
-import { $ as l, $t as u, A as d, An as f, At as p, Bn as ee, Bt as te, C as ne, Cn as m, Ct as h, D as re, Dn as g, Dt as ie, E as ae, En as oe, Et as se, F as ce, Fn as le, Ft as _, G as ue, Gt as de, H as v, Hn as fe, Ht as pe, I as me, It as he, J as ge, Kt as _e, L as y, Ln as ve, Lt as ye, M as be, Mn as xe, Mt as b, N as Se, Nn as Ce, Nt as x, O as we, On as Te, Ot as S, P as Ee, Pn as De, Pt as Oe, Q as ke, Qt as Ae, R as je, Rn as Me, Rt as Ne, S as C, Sn as Pe, St as Fe, T as Ie, Tn as Le, Tt as Re, U as ze, Ut as Be, V as Ve, Vn as He, Vt as Ue, W as We, Wt as Ge, X as Ke, Y as qe, Yt as Je, Z as Ye, Zt as Xe, _ as Ze, _n as Qe, _t as $e, an as w, at as et, b as tt, bn as nt, bt as rt, c as it, cn as T, ct as at, d as ot, dn as st, dt as ct, en as lt, et as E, fn as ut, ft as dt, g as D, gn as O, gt as ft, h as pt, hn as mt, ht, i as gt, in as _t, it as k, j as vt, jn as yt, jt as bt, k as xt, kt as St, ln as Ct, lt as wt, m as Tt, mn as Et, mt as Dt, nn as Ot, nt as A, o as j, on as kt, ot as At, p as jt, pn as Mt, pt as Nt, qt as Pt, r as Ft, rn as It, rt as Lt, sn as Rt, st as zt, t as Bt, tn as Vt, tt as Ht, u as Ut, un as M, ut as Wt, v as Gt, vn as N, vt as Kt, w as qt, wn as Jt, wt as Yt, x as Xt, xn as Zt, xt as P, y as F, yn as Qt, yt as $t, z as en, zn as tn, zt as nn } from "./dev-DOEJXicj.js";
-import { Kt as rn, Wt as an, Zt as on, dt as sn, ft as cn, lt as ln, ot as un, ut as dn } from "./webDev-BgdkyjP6.js";
-import { g as fn, s as pn } from "./inspect-DZnan87F.js";
-import { n as mn } from "./cliArgs-D4p8n7EE.js";
-import { r as hn } from "./appPort-B_HpJ_ck.js";
-import { r as gn, u as _n } from "./apiBuild-DDr2aNFd.js";
-import { r as vn } from "./dialectDriver-czCHYpeH.js";
-import { i as yn, n as bn } from "./connectionConfig-Bk9IC7D0.js";
-import { c as xn, n as Sn, o as Cn } from "./seedRunner-DISBKow-.js";
-import { f as wn, g as Tn, h as En, m as Dn, r as On } from "./frameworkTableAssembly-vfkzuzEo.js";
-import { n as kn, r as An, t as jn } from "./declaredSchemaGates-BlcwObhb.js";
-import { C as Mn, a as Nn, h as Pn, l as Fn, n as In, u as Ln, w as Rn } from "./fileConventions-l-RIXbx8.js";
-import { i as zn, n as Bn, t as Vn } from "./inspectMetrics-BY0Sjb2F.js";
-import { n as Hn } from "./mssqlClusterPatch-_4cE_nun.js";
-import { i as Un, n as Wn, r as Gn, t as Kn } from "./webhookDiscovery-CphsQe59.js";
-import { t as qn } from "./bootTiming-BdyP9nYw.js";
-import { a as Jn, o as Yn, t as Xn } from "./dataProfile-Du3ztYxv.js";
-import I, { basename as Zn, join as Qn } from "node:path";
-import { createWriteStream as $n, existsSync as er } from "node:fs";
-import { pathToFileURL as tr } from "node:url";
-import { LoggerLayer as nr, createLogger as L } from "@voltro/logger";
-import { AuthMiddleware as rr, ConnectionInfoMiddleware as R, actionToRpc as z, anonymousSubject as ir, isWireReachable as ar, mutationToRpc as or, queryToRpc as B, streamToRpc as sr, wireErrorUnion as cr, workflowCancelDescriptor as lr, workflowDomainEventsQueryDescriptor as ur, workflowEventDeliveriesQueryDescriptor as dr, workflowResumeDescriptor as fr, workflowRunEventsQueryDescriptor as pr, workflowRunQueryDescriptor as mr, workflowRunStepsQueryDescriptor as hr, workflowRunsQueryDescriptor as gr, workflowSignalDescriptor as _r, workflowUpdateDescriptor as vr } from "@voltro/protocol";
-import { DATA_TRANSFERS_TABLE as V, _voltroDataTransfersTable as yr, allRegisteredTables as br, and as xr, connectionIdentity as Sr, derivedRowId as Cr, describeTransferRun as wr, ensureTableRegistered as Tr, eq as H, or as Er } from "@voltro/database";
-import { appMode as Dr, frameworkVersion as Or, instanceId as kr, replicaId as Ar, resolveAdvertisedHost as jr, setProcessAdvertisedAddress as Mr, setProcessBootPath as Nr } from "@voltro/protocol/identity";
-import { AggregateRegistry as Pr, CostRegistry as U, DORMANCY_WAKEUP_TENANT as Fr, Dispatcher as Ir, ExpectationRegistry as Lr, ExperimentRegistry as Rr, apiKeyManagementRoutes as zr, attachAnalyticsMirror as Br, attachExpectations as Vr, attachExperiments as Hr, attachFinops as Ur, awaitServerListening as Wr, bindMutation as Gr, bindStream as Kr, bindSubscription as W, buildTracingLayer as qr, cancelWakeup as Jr, compileCron as Yr, dataStoreApiKeyStore as Xr, formatServerOnlyLeaks as Zr, formatUnresolvedSources as Qr, frameworkApiKeyStrategy as $r, getResourcePolicy as ei, installPolicyGuardResolver as ti, loadResourceTuples as ni, makeActionRunner as ri, makeAdvisoryLockCoordinator as ii, makeApiKeyService as ai, makeApiKeyUsageBuffer as oi, makeApiKeyUsageFlusher as si, makeAsyncKv as ci, makeAuthMiddlewareLayers as li, makeBufferingSpanProcessor as ui, makeCoordinatedScheduler as di, makeEffectStoreLayer as fi, makeLazyWorkflowFacade as pi, makeMutationOutputCodec as mi, makeMutationRunner as hi, makeOneShotQueryRunner as gi, makeQueryDescriptorProducer as _i, makeQueryFinalizer as vi, makeQueryReauthorizer as yi, makeQuerySubscriber as bi, makeSchemaRegistry as xi, makeWorkflowFacade as Si, makeWorkflowFacadeWithCallerContext as Ci, makeWorkflowLayers as wi, noopKv as Ti, onProcessShutdown as G, recordSubscriptionDelivery as K, recordWorkflowRun as Ei, registerDefaultTupleSource as Di, registerWakeup as Oi, resolveSecretsBackend as ki, runProvidedEffect as Ai, setSecretsBackend as ji, setSystemStoreHandle as Mi, shutdownGraceMsFromEnv as Ni, singleCoordinator as Pi, startRpcServer as Fi, startScheduler as q, stripForbiddenForWire as Ii, undoCaptureEnabled as Li, unresolvedSources as Ri, withScopedRequest as zi, workflowToRpc as Bi, wrapStoreWithBootCodec as Vi } from "@voltro/runtime";
+import { $ as l, $t as u, A as d, At as f, B as ee, Bn as te, Bt as p, C as ne, Cn as m, Ct as re, D as ie, Dn as h, Dt as ae, E as oe, En as se, Et as g, F as _, Fn as ce, Ft as le, G as ue, Gt as de, H as fe, Hn as pe, Ht as me, I as he, In as v, It as ge, Jt as y, K as _e, Kt as ve, L as ye, Lt as b, M as be, Mn as xe, Mt as Se, N as Ce, Nn as we, Nt as Te, O as Ee, On as De, Ot as Oe, P as ke, Pn as Ae, Pt as x, Q as S, Qt as je, R as Me, Rn as Ne, Rt as Pe, S as Fe, Sn as Ie, St as Le, T as Re, Tn as ze, Tt as Be, U as Ve, Un as He, Ut as Ue, Vn as We, Vt as Ge, W as Ke, Wt as qe, X as Je, Xt as Ye, Y as Xe, Z as Ze, _ as Qe, _n as $e, _t as et, a as tt, an as nt, at as C, b as rt, bn as it, bt as at, cn as ot, ct as w, d as st, dn as T, dt as E, en as ct, et as lt, f as ut, fn as dt, ft, g as pt, gn as D, gt as mt, h as ht, hn as gt, ht as _t, i as vt, in as yt, it as bt, j as xt, jn as St, jt as Ct, k as O, kn as k, kt as wt, l as Tt, ln as Et, lt as Dt, m as Ot, mn as kt, mt as At, nn as jt, nt as Mt, on as Nt, ot as Pt, pn as Ft, pt as It, qt as Lt, rn as Rt, rt as zt, s as A, sn as Bt, st as Vt, t as j, tn as Ht, tt as Ut, un as Wt, ut as Gt, v as Kt, vn as qt, vt as Jt, w as Yt, wn as Xt, wt as Zt, x as Qt, xn as $t, xt as M, y as en, yn as tn, yt as nn, z as rn, zn as an, zt as on } from "./dev-Ce2gEziv.js";
+import { Yt as sn, en as cn, ft as ln, ht as un, lt as dn, mt as fn, pt as pn, qt as mn } from "./webDev-CBN9KkyQ.js";
+import { g as hn, s as gn } from "./inspect-PcC5J-Dl.js";
+import { n as _n } from "./cliArgs-D4p8n7EE.js";
+import { r as vn } from "./appPort-B_HpJ_ck.js";
+import { r as yn, u as bn } from "./apiBuild-BU5cd-Fn.js";
+import { r as xn } from "./dialectDriver-czCHYpeH.js";
+import { i as Sn, n as Cn } from "./connectionConfig-Bk9IC7D0.js";
+import { c as wn, n as Tn, o as En } from "./seedRunner-DISBKow-.js";
+import { f as Dn, g as On, h as kn, m as An, r as jn } from "./frameworkTableAssembly-vfkzuzEo.js";
+import { n as Mn, r as Nn, t as Pn } from "./declaredSchemaGates-BlcwObhb.js";
+import { C as Fn, a as In, h as Ln, l as Rn, n as zn, u as Bn, w as Vn } from "./fileConventions-l-RIXbx8.js";
+import { i as Hn, n as Un, t as Wn } from "./inspectMetrics-BY0Sjb2F.js";
+import { n as Gn } from "./mssqlClusterPatch-_4cE_nun.js";
+import { i as Kn, n as qn, r as Jn, t as Yn } from "./webhookDiscovery-CphsQe59.js";
+import { t as Xn } from "./bootTiming-BdyP9nYw.js";
+import { a as Zn, o as Qn, t as $n } from "./dataProfile-Du3ztYxv.js";
+import N, { basename as er, join as tr } from "node:path";
+import { createWriteStream as nr, existsSync as rr } from "node:fs";
+import { pathToFileURL as ir } from "node:url";
+import { LoggerLayer as ar, createLogger as P } from "@voltro/logger";
+import { AuthMiddleware as or, ConnectionInfoMiddleware as F, actionToRpc as I, anonymousSubject as sr, isWireReachable as cr, mutationToRpc as lr, queryToRpc as L, streamToRpc as ur, wireErrorUnion as dr, workflowCancelDescriptor as fr, workflowDomainEventsQueryDescriptor as pr, workflowEventDeliveriesQueryDescriptor as mr, workflowResumeDescriptor as hr, workflowRunEventsQueryDescriptor as gr, workflowRunQueryDescriptor as R, workflowRunStepsQueryDescriptor as _r, workflowRunsQueryDescriptor as vr, workflowSignalDescriptor as z, workflowUpdateDescriptor as yr } from "@voltro/protocol";
+import { DATA_TRANSFERS_TABLE as B, _voltroDataTransfersTable as br, allRegisteredTables as xr, and as Sr, connectionIdentity as Cr, derivedRowId as wr, describeTransferRun as Tr, ensureTableRegistered as Er, eq as V, or as Dr } from "@voltro/database";
+import { appMode as Or, frameworkVersion as kr, instanceId as Ar, replicaId as jr, resolveAdvertisedHost as Mr, setProcessAdvertisedAddress as Nr, setProcessBootPath as Pr } from "@voltro/protocol/identity";
+import { AggregateRegistry as Fr, CostRegistry as H, DORMANCY_WAKEUP_TENANT as Ir, Dispatcher as Lr, ExpectationRegistry as Rr, ExperimentRegistry as zr, apiKeyManagementRoutes as Br, attachAnalyticsMirror as Vr, attachExpectations as Hr, attachExperiments as Ur, attachFinops as Wr, awaitServerListening as Gr, bindMutation as U, bindStream as Kr, bindSubscription as W, buildTracingLayer as qr, cancelWakeup as Jr, compileCron as Yr, dataStoreApiKeyStore as Xr, formatServerOnlyLeaks as Zr, formatUnresolvedSources as Qr, frameworkApiKeyStrategy as $r, getResourcePolicy as ei, installPolicyGuardResolver as ti, loadResourceTuples as ni, makeActionRunner as ri, makeAdvisoryLockCoordinator as ii, makeApiKeyService as ai, makeApiKeyUsageBuffer as oi, makeApiKeyUsageFlusher as si, makeAsyncKv as ci, makeAuthMiddlewareLayers as li, makeBufferingSpanProcessor as ui, makeCoordinatedScheduler as di, makeEffectStoreLayer as fi, makeLazyWorkflowFacade as pi, makeMutationOutputCodec as mi, makeMutationRunner as hi, makeOneShotQueryRunner as gi, makeQueryDescriptorProducer as _i, makeQueryFinalizer as vi, makeQueryReauthorizer as yi, makeQuerySubscriber as bi, makeSchemaRegistry as xi, makeWorkflowFacade as Si, makeWorkflowFacadeWithCallerContext as Ci, makeWorkflowLayers as wi, noopKv as Ti, onProcessShutdown as G, recordSubscriptionDelivery as K, recordWorkflowRun as Ei, registerDefaultTupleSource as Di, registerWakeup as Oi, resolveSecretsBackend as ki, runProvidedEffect as Ai, setSecretsBackend as ji, setSystemStoreHandle as Mi, shutdownGraceMsFromEnv as Ni, singleCoordinator as Pi, startRpcServer as Fi, startScheduler as q, stripForbiddenForWire as Ii, undoCaptureEnabled as Li, unresolvedSources as Ri, withScopedRequest as zi, workflowToRpc as Bi, wrapStoreWithBootCodec as Vi } from "@voltro/runtime";
 import { assertProductionSessionSecret as Hi } from "@voltro/protocol/session";
 import { Cause as Ui, Effect as J, Layer as Y, ManagedRuntime as Wi } from "effect";
 import { SqlClient as Gi } from "@effect/sql";
@@ -110,7 +110,7 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 	if (!t || t.length < 16) return Z(503, { error: "data transfer misconfigured (no/weak secret)" });
 	let r = Ra(e.headers);
 	return !r || !za(r, t) ? Z(401, { error: "unauthorized" }) : null;
-}, Va = /^[A-Za-z0-9_-]{8,64}$/, Ha = (e) => Va.test(e), Ua = () => process.env.VOLTRO_IMPORT_UPLOAD_DIR ?? I.join(Xi.tmpdir(), "voltro-import-uploads"), Wa = (e) => I.join(Ua(), e), Ga = (e) => I.join(Wa(e), "archive.bin"), Ka = (e) => I.join(Wa(e), "meta.json"), qa = async (e = Date.now()) => {
+}, Va = /^[A-Za-z0-9_-]{8,64}$/, Ha = (e) => Va.test(e), Ua = () => process.env.VOLTRO_IMPORT_UPLOAD_DIR ?? N.join(Xi.tmpdir(), "voltro-import-uploads"), Wa = (e) => N.join(Ua(), e), Ga = (e) => N.join(Wa(e), "archive.bin"), Ka = (e) => N.join(Wa(e), "meta.json"), qa = async (e = Date.now()) => {
 	let t = 0;
 	try {
 		for (let n of await X.readdir(Ua())) {
@@ -193,7 +193,7 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 		});
 	}
 	return await new Promise((t, n) => {
-		let r = $n(Ga(e.id), { flags: "a" });
+		let r = nr(Ga(e.id), { flags: "a" });
 		r.on("error", n), r.on("finish", () => t()), r.end(Buffer.from(e.bytes));
 	}), { total: t.bytes + e.bytes.byteLength };
 }, no = async (e) => {
@@ -202,7 +202,7 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 		path: Ga(e),
 		bytes: t.size
 	};
-}, ro = () => I.join(Ua(), ".runs"), io = (e) => I.join(ro(), `${e}.bin`), ao = async (e, t) => {
+}, ro = () => N.join(Ua(), ".runs"), io = (e) => N.join(ro(), `${e}.bin`), ao = async (e, t) => {
 	if (!Ha(e)) return null;
 	let n = Ga(e), r = await X.stat(n).catch(() => null);
 	if (r === null || r.size === 0) return null;
@@ -211,7 +211,7 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 	return await X.rename(n, i), i;
 }, oo = async (e) => {
 	await X.rm(io(e), { force: !0 }).catch(() => void 0);
-}, Q = L({ scope: "voltro:admin-import" }), so = "VBUNDLE2", co = (e) => {
+}, Q = P({ scope: "voltro:admin-import" }), so = "VBUNDLE2", co = (e) => {
 	let t = e.req.headers["x-import-rollback-key"];
 	if (e.mode !== "replace") return { options: {} };
 	if (typeof t != "string" || t.length === 0) return Q.warn("admin.import: no rollback capture — this run empties the target first, and nothing was asked to be kept. Send `x-import-rollback-key: <storage key>` (voltro data import --rollback-key <key>) to have the instance store the target's current rows before deleting them."), { options: {} };
@@ -222,7 +222,7 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 			hint: "A capture written to the pod would not survive the failure it exists for. Configure storage (the same one the storage-push export uses), or re-send without `x-import-rollback-key` to accept that a run which does not finish can leave the target emptied. Note that CONFIGURED is not the same question as SURVIVES: a `filesystem` provider pointed at a container directory with no volume behind it passes this check and dies with the pod. The run says so when it can observe it — the capture path being on the same filesystem as `/`."
 		})
 	};
-	let n = Qn(Zi(), `voltro-rollback-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`), r = e.deps.putArchive;
+	let n = tr(Zi(), `voltro-rollback-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 8)}`), r = e.deps.putArchive;
 	return {
 		key: t,
 		options: {
@@ -389,10 +389,10 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 	}
 	let o = typeof a.bundleKey == "string" && a.bundleKey !== "" ? eo(a.bundleKey) : typeof a.uploadId == "string" ? a.uploadId : "";
 	if (!Ha(o)) return Z(400, { error: "start needs { uploadId } from an upload, or { bundleKey } for the storage transport" });
-	let s = Cr("dimp", `${o}-${Date.now()}-${Math.random()}`), c = await Za(o, s);
+	let s = wr("dimp", `${o}-${Date.now()}-${Math.random()}`), c = await Za(o, s);
 	if (c !== s) {
-		let t = await Jn(e.store, c);
-		if (Yn(t) === void 0 && t !== null) return Q.info("admin.import start: already running", {
+		let t = await Zn(e.store, c);
+		if (Qn(t) === void 0 && t !== null) return Q.info("admin.import start: already running", {
 			uploadId: o,
 			runId: c
 		}), Z(202, {
@@ -403,7 +403,7 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 		Q.info("admin.import start: taking over a claim whose run is not running", {
 			uploadId: o,
 			staleRunId: c,
-			outcome: Yn(t) ?? "no record"
+			outcome: Qn(t) ?? "no record"
 		}), c = await Za(o, s, { takeOver: !0 });
 	}
 	let l = async (e) => (await Qa(o).catch(() => void 0), e), u = await uo(e, {
@@ -486,7 +486,7 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 	}))
 })) }), vo = async (e, t) => {
 	try {
-		return Tr(yr), await e.insert(V, {
+		return Er(br), await e.insert(B, {
 			id: t.runId,
 			direction: "import",
 			startedAt: /* @__PURE__ */ new Date(),
@@ -512,7 +512,7 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 			runId: a,
 			transport: i.transport,
 			error: n
-		}), e.traced && await t.store.update(V, a, {
+		}), e.traced && await t.store.update(B, a, {
 			failure: n,
 			finishedAt: null
 		}).then(() => void 0, () => void 0);
@@ -569,7 +569,7 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 			force: !0
 		}).catch(() => void 0), await oo(a).catch(() => void 0), await Qa(i.uploadId).catch(() => void 0);
 	}
-}, bo = /^[A-Za-z0-9_-]{8,64}$/, xo = (e) => bo.test(e), So = () => process.env.VOLTRO_EXPORT_ARTIFACT_DIR ?? I.join(Xi.tmpdir(), "voltro-export-artifacts"), Co = (e) => I.join(So(), e), wo = (e) => I.join(Co(e), "archive.bin"), To = async (e = Date.now()) => {
+}, bo = /^[A-Za-z0-9_-]{8,64}$/, xo = (e) => bo.test(e), So = () => process.env.VOLTRO_EXPORT_ARTIFACT_DIR ?? N.join(Xi.tmpdir(), "voltro-export-artifacts"), Co = (e) => N.join(So(), e), wo = (e) => N.join(Co(e), "archive.bin"), To = async (e = Date.now()) => {
 	let t = 0;
 	try {
 		for (let n of await X.readdir(So())) {
@@ -621,7 +621,7 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 		recursive: !0,
 		force: !0
 	}).catch(() => void 0);
-}, Ao = L({ scope: "voltro:admin-export" }), jo = (e) => Array.isArray(e) ? e.filter((e) => typeof e == "string") : [], Mo = (e) => {
+}, Ao = P({ scope: "voltro:admin-export" }), jo = (e) => Array.isArray(e) ? e.filter((e) => typeof e == "string") : [], Mo = (e) => {
 	if (typeof e.tenant == "string" && e.tenant) return {
 		kind: "tenant",
 		tenantId: e.tenant
@@ -656,7 +656,7 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 			});
 		}
 	}
-	let a = r.consistency === "snapshot" ? "snapshot" : i.consistency ?? "live", o = (typeof r.compression == "string" ? r.compression : void 0) ?? i.compression, s = i.scope ?? Mo(r), c = typeof r.bundleKey == "string" && r.bundleKey.length > 0, l = r.assets === !0 && e.assetSource ? { blobs: e.assetSource } : {}, u = Cr("dexp", `${Date.now()}-${Math.random()}`), d = await Po(e.store, {
+	let a = r.consistency === "snapshot" ? "snapshot" : i.consistency ?? "live", o = (typeof r.compression == "string" ? r.compression : void 0) ?? i.compression, s = i.scope ?? Mo(r), c = typeof r.bundleKey == "string" && r.bundleKey.length > 0, l = r.assets === !0 && e.assetSource ? { blobs: e.assetSource } : {}, u = wr("dexp", `${Date.now()}-${Math.random()}`), d = await Po(e.store, {
 		runId: u,
 		mode: i.subset ? "subset" : s.kind,
 		bundle: c ? String(r.bundleKey) : null
@@ -684,7 +684,7 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 	});
 }, Po = async (e, t) => {
 	try {
-		return Tr(yr), await e.insert(V, {
+		return Er(br), await e.insert(B, {
 			id: t.runId,
 			direction: "export",
 			startedAt: /* @__PURE__ */ new Date(),
@@ -706,7 +706,7 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 	}
 }, Fo = async (e) => {
 	let { deps: t, runId: n } = e, r = await import("node:os"), i = await import("node:fs/promises"), a = await import("node:path"), o = await i.mkdtemp(a.join(r.tmpdir(), "voltro-admin-export-")), s = async (r) => {
-		e.recorded && await t.store.update(V, n, r).then(() => void 0, () => void 0);
+		e.recorded && await t.store.update(B, n, r).then(() => void 0, () => void 0);
 	};
 	try {
 		let r = await J.runPromise(Ca({
@@ -782,7 +782,7 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 		}
 	};
 }, Lo = 8388608, Ro = 33554432, zo = async (e, t) => await e.query({
-	table: V,
+	table: B,
 	order: [{
 		column: "startedAt",
 		direction: "desc"
@@ -807,7 +807,7 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 	} catch (e) {
 		return Z(409, {
 			error: "no import history",
-			message: `this instance has no \`${V}\` table, so no import has been recorded. Run \`voltro db apply\` against it; imports themselves are unaffected.`,
+			message: `this instance has no \`${B}\` table, so no import has been recorded. Run \`voltro db apply\` against it; imports themselves are unaffected.`,
 			detail: e?.message ?? String(e)
 		});
 	}
@@ -826,7 +826,7 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 			direction: e.direction,
 			failure: e.failure,
 			staged: e.staged,
-			line: wr(e)
+			line: Tr(e)
 		}))
 	});
 }, Uo = (e, t, n = {}) => (async function* () {
@@ -849,14 +849,14 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 	invalidateTag: async () => 0,
 	wrap: async (e, t, n) => n()
 }, Go = async (e) => {
-	Pt(e.appProcedures ?? e.discovered, {
+	y(e.appProcedures ?? e.discovered, {
 		defaultDeny: e.security?.defaultDeny ?? !0,
 		commandHint: "`voltro serve`"
 	}), Mi({
 		dataStore: e.store,
 		schemaRegistry: e.schemaRegistry
 	});
-	let t = (e.discovered.budgets?.length ?? 0) > 0, n, r = new Ir({
+	let t = (e.discovered.budgets?.length ?? 0) > 0, n, r = new Lr({
 		crdtColumnsOf: (t) => e.schemaRegistry.crdtColumns(t),
 		store: e.store,
 		...e.snapshotCache ? { cache: e.snapshotCache } : {},
@@ -868,43 +868,43 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 			durationMs: e.durationMs,
 			rowCount: e.rowCount
 		})
-	}), i = e.cache ?? Wo, a = e.kv ?? Ti, o, s = () => void 0, c, d, p, ee, te, ne, m, re = L({ scope: "voltro:workflow" }), g = L({ scope: "voltro:schedule" }), ae = u({
+	}), i = e.cache ?? Wo, a = e.kv ?? Ti, o, s = () => void 0, c, u, d, ee, te, ne, m, re = P({ scope: "voltro:workflow" }), ie = P({ scope: "voltro:schedule" }), h = ct({
 		store: e.store,
 		warn: (e, t) => re.warn(e, t)
-	}), oe = ae.remember, se = ae.resolve, le = lt({
+	}), ae = h.remember, oe = h.resolve, se = Ht({
 		authority: e.authority,
 		getStore: () => e.store
-	}), _ = (e.discovered.workflows?.length ?? 0) > 0 ? pi(() => o) : void 0, ue = (e.discovered.workflows?.length ?? 0) > 0 || (e.discovered.eventTriggers?.length ?? 0) > 0, de = ue || (e.discovered.workflowWorkers?.length ?? 0) > 0 || e.scheduleCoordination === "cluster", fe = e.tenantIsolation === "namespace", me = (e.log ?? L({ scope: "voltro:serve" })).child("webhooks"), he, _e, y = e.discovered.webhooks;
-	if (y && y.outgoing.length > 0 && e.workflowEngineLayer !== void 0) {
+	}), g = (e.discovered.workflows?.length ?? 0) > 0 ? pi(() => o) : void 0, ce = (e.discovered.workflows?.length ?? 0) > 0 || (e.discovered.eventTriggers?.length ?? 0) > 0, ue = ce || (e.discovered.workflowWorkers?.length ?? 0) > 0 || e.scheduleCoordination === "cluster", de = e.tenantIsolation === "namespace", fe = (e.log ?? P({ scope: "voltro:serve" })).child("webhooks"), pe, me, v = e.discovered.webhooks;
+	if (v && v.outgoing.length > 0 && e.workflowEngineLayer !== void 0) {
 		e.workflowEngineLayer;
-		let t = nt({
+		let t = $t({
 			store: e.store,
 			schemaRegistry: e.schemaRegistry,
 			cache: i,
 			kv: a
-		}), n = y.outgoing.map((e) => e.descriptor);
-		_e = pa.toLayer(ua(t, { events: n })), he = da(t, async (e) => {
-			let t = p;
+		}), n = v.outgoing.map((e) => e.descriptor);
+		me = pa.toLayer(ua(t, { events: n })), pe = da(t, async (e) => {
+			let t = d;
 			if (t === void 0) {
-				me.error("webhook delivery skipped — the workflow runtime was never built. This is a framework defect, not a configuration problem: report it with your engine setting. Deliveries are NOT queued and will not be retried.", {
+				fe.error("webhook delivery skipped — the workflow runtime was never built. This is a framework defect, not a configuration problem: report it with your engine setting. Deliveries are NOT queued and will not be retried.", {
 					deliveryId: e.deliveryId,
 					targetId: e.targetId
 				});
 				return;
 			}
 			t.runPromise(pa.execute(e)).catch((t) => {
-				me.error("deliverWebhook workflow crashed", {
+				fe.error("deliverWebhook workflow crashed", {
 					deliveryId: e.deliveryId,
 					targetId: e.targetId
 				}, t);
 			});
 		}, { events: n });
 	}
-	let ve = /* @__PURE__ */ new Map();
-	if (y) for (let e of y.incoming) {
+	let ge = /* @__PURE__ */ new Map();
+	if (v) for (let e of v.incoming) {
 		let t = e.descriptor.path ?? fa(e.descriptor.id), n = `VOLTRO_WEBHOOK_SECRET_${e.descriptor.id.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`, r = ha(e.descriptor, {
 			resolveSecret: async () => process.env[n] ?? null,
-			resolveWorkflows: () => _ === void 0 ? void 0 : Ci(_, {
+			resolveWorkflows: () => g === void 0 ? void 0 : Ci(g, {
 				traceId: `incoming:${e.descriptor.id}`,
 				source: `incoming:${e.descriptor.id}`
 			}),
@@ -916,34 +916,34 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 					idempotency: e.idempotency,
 					durationMs: e.durationMs
 				};
-				e.status >= 500 ? me.error("incoming delivery failed", t) : e.status >= 400 ? me.warn("incoming delivery rejected", t) : me.info("incoming delivery handled", t);
+				e.status >= 500 ? fe.error("incoming delivery failed", t) : e.status >= 400 ? fe.warn("incoming delivery rejected", t) : fe.info("incoming delivery handled", t);
 			}
 		});
-		ve.set(t, { handle: r });
+		ge.set(t, { handle: r });
 	}
-	ti(), Di((t) => ni(e.store, t.subjectId, t.resourceType, t.resourceId)) || L({ scope: "voltro:serve" }).info("policy guards: using the app-registered tuple source");
-	let ye = [], be = [...e.discovered.outboxHandlers ?? [], ...Wn((y?.outgoing.length ?? 0) + (y?.incoming.length ?? 0) + (y?.providers.length ?? 0), []) ? [{
+	ti(), Di((t) => ni(e.store, t.subjectId, t.resourceType, t.resourceId)) || P({ scope: "voltro:serve" }).info("policy guards: using the app-registered tuple source");
+	let _e = [], ve = [...e.discovered.outboxHandlers ?? [], ...qn((v?.outgoing.length ?? 0) + (v?.incoming.length ?? 0) + (v?.providers.length ?? 0), []) ? [{
 		file: "<framework>/webhooks",
 		id: "voltro-webhook-emit",
-		definition: ma(() => he)
-	}] : []], xe = be.length > 0 ? w({
-		handlers: be,
+		definition: ma(() => pe)
+	}] : []], ye = ve.length > 0 ? Nt({
+		handlers: ve,
 		store: e.store,
-		log: (e.log ?? L({ scope: "voltro:serve" })).child("outbox"),
+		log: (e.log ?? P({ scope: "voltro:serve" })).child("outbox"),
 		onChange: (t) => e.store.onChange((e) => t({
 			table: e.table,
 			op: e.op
 		})),
 		onShutdown: (e) => {
-			ye.push(e);
+			_e.push(e);
 		}
-	}) : void 0, b = Ot({
+	}) : void 0, b = Rt({
 		definitions: (e.discovered.connections ?? []).map((e) => e.definition),
 		store: e.store,
-		publicUrl: Vt(e.port ?? 4e3),
-		log: (e.log ?? L({ scope: "voltro:serve" })).child("connections")
+		publicUrl: jt(e.port ?? 4e3),
+		log: (e.log ?? P({ scope: "voltro:serve" })).child("connections")
 	});
-	Se({
+	ke({
 		events: e.discovered.events ?? [],
 		rpcTags: [
 			...e.discovered.queries.map((e) => e.descriptor.name),
@@ -952,136 +952,136 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 			...(e.discovered.streams ?? []).map((e) => e.descriptor.name)
 		]
 	});
-	let we = (e.log ?? L({ scope: "voltro:serve" })).child("events"), Te = e.broadcastNamespace ?? Gt(e.plugins, void 0), De = F(e.plugins, Te, we), Ae = e.membership?.instanceId ?? Ar(), je = kr(), Me = e.membership ?? tt(e.plugins, {
-		instanceId: Ae,
-		namespace: Te,
+	let be = (e.log ?? P({ scope: "voltro:serve" })).child("events"), xe = e.broadcastNamespace ?? en(e.plugins, void 0), Se = rt(e.plugins, xe, be), Ce = e.membership?.instanceId ?? jr(), we = Ar(), Te = e.membership ?? Qt(e.plugins, {
+		instanceId: Ce,
+		namespace: xe,
 		meta: { mode: "serve" },
-		logger: we
-	}), C = Ee({
+		logger: be
+	}), Ee = _({
 		events: e.discovered.events ?? [],
-		origin: je,
-		...De.publishRemote === void 0 ? {} : { publishRemote: De.publishRemote }
-	}), Pe = (e.discovered.events ?? []).length > 0 ? await De.attach(C.bus) : null, Fe = Qt({
+		origin: we,
+		...Se.publishRemote === void 0 ? {} : { publishRemote: Se.publishRemote }
+	}), De = (e.discovered.events ?? []).length > 0 ? await Se.attach(Ee.bus) : null, je = it({
 		store: e.store,
 		schemaRegistry: e.schemaRegistry,
 		cache: i,
 		kv: a,
-		...he === void 0 ? {} : { webhooksService: he },
-		..._ === void 0 ? {} : { workflowsProxy: _ },
+		...pe === void 0 ? {} : { webhooksService: pe },
+		...g === void 0 ? {} : { workflowsProxy: g },
 		eventTriggers: e.discovered.eventTriggers ?? [],
-		namespaceIsolationOn: fe,
+		namespaceIsolationOn: de,
 		...e.ensureTenantProvisioned === void 0 ? {} : { ensureTenantProvisioned: e.ensureTenantProvisioned },
 		...e.resolveResidentStore === void 0 ? {} : { resolveResidentStore: e.resolveResidentStore },
-		...xe === void 0 ? {} : { outbox: { nudge: xe.nudge } },
+		...ye === void 0 ? {} : { outbox: { nudge: ye.nudge } },
 		...b.active ? { connections: { registry: b.registry } } : {},
-		eventBus: C.bus
-	}), Ie = Y.succeed(Pr, Oe), Le = Y.succeed(Lr, S), Re = Y.succeed(U, ie), Ve = Y.succeed(Rr, St), He = (t, n) => {
+		eventBus: Ee.bus
+	}), Me = Y.succeed(Fr, le), Ne = Y.succeed(Rr, wt), Pe = Y.succeed(H, Oe), Fe = Y.succeed(zr, f), Ie = (t, n) => {
 		let r = t.pipe(J.provide(fi(n)));
-		return (e.baseLayer ? r.pipe(J.provide(e.baseLayer)) : r).pipe(J.provide(Ie)).pipe(J.provide(Le)).pipe(J.provide(Re)).pipe(J.provide(Ve));
-	}, Ue = (e, t) => {
-		let n = He(e, t);
+		return (e.baseLayer ? r.pipe(J.provide(e.baseLayer)) : r).pipe(J.provide(Me)).pipe(J.provide(Ne)).pipe(J.provide(Pe)).pipe(J.provide(Fe));
+	}, Le = (e, t) => {
+		let n = Ie(e, t);
 		return Ai(n);
-	}, We = Vn(), Ge = Ht(e.plugins ?? [], We), Je = ge({
+	}, Re = Wn(), ze = Mt(e.plugins ?? [], Re), Be = Xe({
 		plugins: e.plugins ?? [],
-		metrics: We,
-		log: e.log ?? L({ scope: "voltro:serve" })
-	}), Xe = l(e.plugins ?? [], We), Ze = e.security?.defaultDeny ?? !0, Qe = hi({
+		metrics: Re,
+		log: e.log ?? P({ scope: "voltro:serve" })
+	}), He = lt(e.plugins ?? [], Re), We = e.security?.defaultDeny ?? !0, Ge = hi({
 		store: e.store,
-		defaultDeny: Ze,
+		defaultDeny: We,
 		recordMetric: (e) => {
-			We.record(e);
+			Re.record(e);
 		},
-		...Ge.mutation === void 0 ? {} : { interceptor: Ge.mutation },
-		buildContext: (e, t, n) => Fe(e, t, n),
-		runEffect: Ue,
-		undoCapture: zt((t) => e.schemaRegistry.crdtColumns(t))
-	}), rt = At();
+		...ze.mutation === void 0 ? {} : { interceptor: ze.mutation },
+		buildContext: (e, t, n) => je(e, t, n),
+		runEffect: Le,
+		undoCapture: w((t) => e.schemaRegistry.crdtColumns(t))
+	}), Ye = Vt();
 	{
-		let t = at();
-		t !== void 0 && (e.log ?? L({ scope: "voltro:serve" })).info(t);
+		let t = Dt();
+		t !== void 0 && (e.log ?? P({ scope: "voltro:serve" })).info(t);
 	}
-	let it = et({
+	let Qe = Pt({
 		store: e.store,
 		...e.approvals === void 0 ? {} : { defaultExpiryMs: e.approvals.defaultExpiryMs }
-	}), ot = ri({
-		defaultDeny: Ze,
-		buildContext: (e) => Fe(e),
-		runEffect: Ue,
+	}), $e = ri({
+		defaultDeny: We,
+		buildContext: (e) => je(e),
+		runEffect: Le,
 		recordMetric: (e) => {
-			We.record(e);
+			Re.record(e);
 		},
-		...Ge.action === void 0 ? {} : { interceptor: Ge.action }
-	}), st = vi({
+		...ze.action === void 0 ? {} : { interceptor: ze.action }
+	}), tt = vi({
 		tenantScopedTables: e.tenantScopedTables,
 		softDeleteScopedTables: e.softDeleteScopedTables
-	}), ct = {
-		defaultDeny: Ze,
-		buildContext: (e) => Fe(e),
-		finalize: (e, t) => st(e, t.subject),
-		provideEffect: He,
-		...Ge.query === void 0 ? {} : { interceptor: Ge.query }
-	}, E = _i(ct), ut = gi({
-		...ct,
+	}), nt = {
+		defaultDeny: We,
+		buildContext: (e) => je(e),
+		finalize: (e, t) => tt(e, t.subject),
+		provideEffect: Ie,
+		...ze.query === void 0 ? {} : { interceptor: ze.query }
+	}, C = _i(nt), ot = gi({
+		...nt,
 		queryRows: (t, n) => e.store.query(t).then((e) => Ii(t.table, e, n.subject))
-	}), dt = bi({
-		...ct,
+	}), st = bi({
+		...nt,
 		subscribeDescriptor: (e, t, n, i, a) => r.subscribe(e, t, n, void 0, void 0, void 0, i, a),
 		subscribeComputed: (e, t, n) => r.subscribeComputed(e, t, n)
-	}), D = (e) => e.filter((e) => ar(e.descriptor)), O = {};
+	}), T = (e) => e.filter((e) => cr(e.descriptor)), E = {};
 	for (let t of [
-		...D(e.discovered.queries),
-		...rt.queries,
-		...it.queries,
+		...T(e.discovered.queries),
+		...Ye.queries,
+		...Qe.queries,
 		...b.queries
-	]) O[t.descriptor.name] = (e) => W(E(t, e), r, `subscription.${t.descriptor.name}`, void 0, void 0, yi(t, e));
+	]) E[t.descriptor.name] = (e) => W(C(t, e), r, `subscription.${t.descriptor.name}`, void 0, void 0, yi(t, e));
 	for (let t of [
-		...D(e.discovered.mutations),
-		...rt.mutations,
-		...it.mutations,
+		...T(e.discovered.mutations),
+		...Ye.mutations,
+		...Qe.mutations,
 		...b.mutations
 	]) {
 		let n = mi(t.descriptor.output);
-		O[t.descriptor.name] = (r) => Gr(async (e, n) => Qe(t, e, n), r, `mutation.${t.descriptor.name}`, n, e.idempotency, cr(t.descriptor, "mutation"));
+		E[t.descriptor.name] = (r) => U(async (e, n) => Ge(t, e, n), r, `mutation.${t.descriptor.name}`, n, e.idempotency, dr(t.descriptor, "mutation"));
 	}
-	for (let t of [...D(e.discovered.actions), ...b.actions]) {
+	for (let t of [...T(e.discovered.actions), ...b.actions]) {
 		let n = mi(t.descriptor.output);
-		O[t.descriptor.name] = (r) => Gr(async (e, n) => ot(t, e, n), r, `action.${t.descriptor.name}`, n, e.idempotency, cr(t.descriptor, "action"));
+		E[t.descriptor.name] = (r) => U(async (e, n) => $e(t, e, n), r, `action.${t.descriptor.name}`, n, e.idempotency, dr(t.descriptor, "action"));
 	}
-	let pt = () => `public-${Math.random().toString(36).slice(2, 10)}`, ht = [
+	let ut = () => `public-${Math.random().toString(36).slice(2, 10)}`, dt = [
 		...e.discovered.queries.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
 			descriptor: e.descriptor,
-			invoke: (t, n) => ut(e, t, {
+			invoke: (t, n) => ot(e, t, {
 				subject: n.subject,
-				traceId: pt()
+				traceId: ut()
 			}),
-			subscribe: (t, n, r) => dt(e, t, {
+			subscribe: (t, n, r) => st(e, t, {
 				subject: n.subject,
-				traceId: pt()
+				traceId: ut()
 			}, r)
 		})),
 		...e.discovered.mutations.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
 			descriptor: e.descriptor,
-			invoke: (t, n) => Qe(e, t, {
+			invoke: (t, n) => Ge(e, t, {
 				subject: n.subject,
-				traceId: pt()
+				traceId: ut()
 			})
 		})),
 		...e.discovered.actions.filter((e) => e.descriptor.publicApi !== void 0).map((e) => ({
 			descriptor: e.descriptor,
-			invoke: (t, n) => ot(e, t, {
+			invoke: (t, n) => $e(e, t, {
 				subject: n.subject,
-				traceId: pt()
+				traceId: ut()
 			})
 		}))
-	], gt = {
-		candidates: Be({
+	], ft = {
+		candidates: qe({
 			queries: e.discovered.queries,
 			mutations: e.discovered.mutations,
 			actions: e.discovered.actions,
 			descriptorOf: (e) => e.descriptor,
-			runQuery: (e, t, n) => Promise.resolve(ut(e, t, n)),
-			runMutation: (e, t, n) => Promise.resolve(Qe(e, t, n)),
-			runAction: (e, t, n) => Promise.resolve(ot(e, t, n))
+			runQuery: (e, t, n) => Promise.resolve(ot(e, t, n)),
+			runMutation: (e, t, n) => Promise.resolve(Ge(e, t, n)),
+			runAction: (e, t, n) => Promise.resolve($e(e, t, n))
 		}),
 		policy: e.agents?.tools ?? {},
 		mcpEnabled: e.agents?.mcp === !0,
@@ -1094,12 +1094,12 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 				kind: "query",
 				input: e.descriptor.input,
 				output: e.descriptor.output,
-				invoke: (n, r, i) => ut(e, n, {
+				invoke: (n, r, i) => ot(e, n, {
 					subject: r.subject,
 					traceId: t(),
 					signal: i
 				}),
-				subscribe: (n, r, i) => dt(e, n, {
+				subscribe: (n, r, i) => st(e, n, {
 					subject: r.subject,
 					traceId: t()
 				}, i)
@@ -1109,7 +1109,7 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 				kind: "mutation",
 				input: e.descriptor.input,
 				output: e.descriptor.output,
-				invoke: (n, r, i) => Qe(e, n, {
+				invoke: (n, r, i) => Ge(e, n, {
 					subject: r.subject,
 					traceId: t(),
 					signal: i
@@ -1120,14 +1120,14 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 				kind: "action",
 				input: e.descriptor.input,
 				output: e.descriptor.output,
-				invoke: async (n, r, i) => ot(e, n, {
+				invoke: async (n, r, i) => $e(e, n, {
 					subject: r.subject,
 					traceId: t(),
 					signal: i
 				})
 			}))
 		];
-		await f({
+		await St({
 			config: e.grpc.config,
 			candidates: n,
 			resolveSubject: async (t) => {
@@ -1139,26 +1139,26 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 			},
 			store: e.store,
 			root: e.grpc.root,
-			log: e.log ?? L({ scope: "voltro:serve" }),
+			log: e.log ?? P({ scope: "voltro:serve" }),
 			onShutdown: (e) => G(e)
 		});
 	}
-	let _t = Mt({
+	let pt = kt({
 		...e.restRoutes === void 0 ? {} : { restRoutes: e.restRoutes },
-		publicApiEntries: ht,
+		publicApiEntries: dt,
 		store: e.store,
 		resolveSubject: (t) => e.resolveSubject(t, -1).then((e) => e.subject),
 		...e.idempotency === void 0 ? {} : { idempotency: e.idempotency },
-		log: e.log ?? L({ scope: "voltro:serve" })
-	}), k = e.dataTransferSecret ?? process.env.VOLTRO_DATA_TRANSFER_SECRET, vt = async (e, t) => {
+		log: e.log ?? P({ scope: "voltro:serve" })
+	}), mt = e.dataTransferSecret ?? process.env.VOLTRO_DATA_TRANSFER_SECRET, ht = async (e, t) => {
 		let { Readable: n } = await import("node:stream"), r = $i(), i = ta("storage", () => n.from(t()));
 		await J.runPromise(ra(r, e, i, { contentType: "application/octet-stream" }));
-	}, yt = k && k.length >= 16 ? [
+	}, gt = mt && mt.length >= 16 ? [
 		{
 			method: "POST",
 			path: Na,
 			handle: po({
-				secret: k,
+				secret: mt,
 				store: e.store,
 				...e.dataTransferSnapshot ? { snapshot: e.dataTransferSnapshot } : {},
 				...e.dataTransferDialect ? { dialect: e.dataTransferDialect } : {},
@@ -1167,7 +1167,7 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 				refreshSubscriptions: (e) => {
 					r.refreshAll(e);
 				},
-				putArchive: vt,
+				putArchive: ht,
 				...e.dataTransferDialect ? { dialect: e.dataTransferDialect } : {}
 			})
 		},
@@ -1175,7 +1175,7 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 			method: "POST",
 			path: Pa,
 			handle: ho({
-				secret: k,
+				secret: mt,
 				store: e.store,
 				...e.dataTransferSnapshot ? { snapshot: e.dataTransferSnapshot } : {},
 				...e.dataTransferDialect ? { dialect: e.dataTransferDialect } : {},
@@ -1184,61 +1184,61 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 				refreshSubscriptions: (e) => {
 					r.refreshAll(e);
 				},
-				putArchive: vt
+				putArchive: ht
 			})
 		},
 		{
 			method: "GET",
 			path: La,
 			handle: Ho({
-				secret: k,
+				secret: mt,
 				store: e.store
 			})
 		},
 		{
 			method: "GET",
 			path: Ia,
-			handle: Io({ secret: k })
+			handle: Io({ secret: mt })
 		},
 		{
 			method: "POST",
 			path: Fa,
 			handle: No({
-				secret: k,
+				secret: mt,
 				store: e.store,
 				snapshot: e.dataTransferSnapshot ?? { tables: [] },
 				dialect: e.dataTransferDialect ?? "memory",
 				tenantTables: [...e.tenantScopedTables],
-				loadProfile: Xn,
+				loadProfile: $n,
 				assetSource: Ea($i(), e.store),
-				putArchive: vt
+				putArchive: ht
 			})
 		}
-	] : [], bt = [
+	] : [], _t = [
 		...e.httpRoutes ?? [],
-		..._t.httpRoutes,
-		...yt,
+		...pt.httpRoutes,
+		...gt,
 		...b.httpRoutes
 	];
-	Object.assign(O, C.handlers);
-	for (let t of D(e.discovered.streams ?? [])) O[t.descriptor.name] = (n) => Kr((r) => zi(r, (r) => {
-		let i = Fe(r), a = t.executor(n, i);
+	Object.assign(E, Ee.handlers);
+	for (let t of T(e.discovered.streams ?? [])) E[t.descriptor.name] = (n) => Kr((r) => zi(r, (r) => {
+		let i = je(r), a = t.executor(n, i);
 		if (J.isEffect(a)) {
 			let t = a.pipe(J.provide(fi(i.store)));
-			return (e.baseLayer ? t.pipe(J.provide(e.baseLayer)) : t).pipe(J.provide(Ie)).pipe(J.provide(Le)).pipe(J.provide(Re)).pipe(J.provide(Ve));
+			return (e.baseLayer ? t.pipe(J.provide(e.baseLayer)) : t).pipe(J.provide(Me)).pipe(J.provide(Ne)).pipe(J.provide(Pe)).pipe(J.provide(Fe));
 		}
 		return typeof a == "object" && a && typeof a.then == "function" ? J.promise(() => a) : a;
-	}), `stream.${t.descriptor.name}`);
-	for (let t of e.discovered.workflows ?? []) O[t.definition.name] = (e) => Gr(async (e, n) => {
+	}), `stream.${t.descriptor.name}`, t.descriptor.guards, n);
+	for (let t of e.discovered.workflows ?? []) E[t.definition.name] = (e) => U(async (e, n) => {
 		let r = n;
-		return Ci(_, {
+		return Ci(g, {
 			subject: r.subject,
 			traceId: r.traceId,
 			source: "workflow-rpc"
 		}).start(t.definition.name, e);
 	}, e, `workflow.${t.definition.name}`);
-	ue && (O[mr.name] = (e) => W(E({
-		descriptor: mr,
+	ce && (E[R.name] = (e) => W(C({
+		descriptor: R,
 		executor: (e) => {
 			let t = e.id;
 			return {
@@ -1247,30 +1247,30 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 					column: "startedAt",
 					direction: "desc"
 				}],
-				predicate: Er(H("id", t), H("executionId", t)),
+				predicate: Dr(V("id", t), V("executionId", t)),
 				take: 1,
 				skip: void 0,
 				projection: void 0
 			};
 		}
-	}, e), r, `subscription.${mr.name}`), O[gr.name] = (e) => W(E({
-		descriptor: gr,
+	}, e), r, `subscription.${R.name}`), E[vr.name] = (e) => W(C({
+		descriptor: vr,
 		executor: (e) => {
-			let t = e, n = [...t.tag === void 0 ? [] : [H("tag", t.tag)], ...t.status === void 0 ? [] : [H("status", t.status)]], r = Number.isFinite(t.limit) && t.limit !== void 0 ? Math.min(Math.max(Math.floor(t.limit), 1), 500) : 100;
+			let t = e, n = [...t.tag === void 0 ? [] : [V("tag", t.tag)], ...t.status === void 0 ? [] : [V("status", t.status)]], r = Number.isFinite(t.limit) && t.limit !== void 0 ? Math.min(Math.max(Math.floor(t.limit), 1), 500) : 100;
 			return {
 				table: "_voltro_workflow_runs",
 				order: [{
 					column: "startedAt",
 					direction: "desc"
 				}],
-				predicate: n.length === 0 ? void 0 : n.length === 1 ? n[0] : xr(...n),
+				predicate: n.length === 0 ? void 0 : n.length === 1 ? n[0] : Sr(...n),
 				take: r,
 				skip: void 0,
 				projection: void 0
 			};
 		}
-	}, e), r, `subscription.${gr.name}`), O[hr.name] = (e) => W(E({
-		descriptor: hr,
+	}, e), r, `subscription.${vr.name}`), E[_r.name] = (e) => W(C({
+		descriptor: _r,
 		executor: (e) => {
 			let t = e.runId;
 			return {
@@ -1279,14 +1279,14 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 					column: "startedAt",
 					direction: "asc"
 				}],
-				predicate: H("runId", t),
+				predicate: V("runId", t),
 				take: 1e3,
 				skip: void 0,
 				projection: void 0
 			};
 		}
-	}, e), r, `subscription.${hr.name}`), O[pr.name] = (e) => W(E({
-		descriptor: pr,
+	}, e), r, `subscription.${_r.name}`), E[gr.name] = (e) => W(C({
+		descriptor: gr,
 		executor: (e) => {
 			let t = e.runId;
 			return {
@@ -1295,14 +1295,14 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 					column: "occurredAt",
 					direction: "asc"
 				}],
-				predicate: H("runId", t),
+				predicate: V("runId", t),
 				take: 1e3,
 				skip: void 0,
 				projection: void 0
 			};
 		}
-	}, e), r, `subscription.${pr.name}`), O[ur.name] = (e) => W(E({
-		descriptor: ur,
+	}, e), r, `subscription.${gr.name}`), E[pr.name] = (e) => W(C({
+		descriptor: pr,
 		executor: (e) => {
 			let t = e;
 			return {
@@ -1311,14 +1311,14 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 					column: "occurredAt",
 					direction: "desc"
 				}],
-				predicate: t.name === void 0 ? void 0 : H("name", t.name),
+				predicate: t.name === void 0 ? void 0 : V("name", t.name),
 				take: Math.max(1, Math.min(500, t.limit ?? 100)),
 				skip: void 0,
 				projection: void 0
 			};
 		}
-	}, e), r, `subscription.${ur.name}`), O[dr.name] = (e) => W(E({
-		descriptor: dr,
+	}, e), r, `subscription.${pr.name}`), E[mr.name] = (e) => W(C({
+		descriptor: mr,
 		executor: (e) => {
 			let t = e.eventId;
 			return {
@@ -1327,86 +1327,86 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 					column: "createdAt",
 					direction: "asc"
 				}],
-				predicate: H("eventId", t),
+				predicate: V("eventId", t),
 				take: 500,
 				skip: void 0,
 				projection: void 0
 			};
 		}
-	}, e), r, `subscription.${dr.name}`), O[lr.name] = (t) => Gr(async (t, n) => {
+	}, e), r, `subscription.${mr.name}`), E[fr.name] = (t) => U(async (t, n) => {
 		let r = t;
-		return await N(e.store, n.subject, { executionId: r.executionId }), await _.cancel(r.workflowName, r.executionId), await Nt(r.workflowName, r.executionId, "workflow.cancel"), { ok: !0 };
-	}, t, `action.${lr.name}`), O[fr.name] = (t) => Gr(async (t, n) => {
+		return await tn(e.store, n.subject, { executionId: r.executionId }), await g.cancel(r.workflowName, r.executionId), await Ot(r.workflowName, r.executionId, "workflow.cancel"), { ok: !0 };
+	}, t, `action.${fr.name}`), E[hr.name] = (t) => U(async (t, n) => {
 		let r = t;
-		return await N(e.store, n.subject, { executionId: r.executionId }), await _.resume(r.workflowName, r.executionId), { ok: !0 };
-	}, t, `action.${fr.name}`), O[_r.name] = (t) => Gr(async (t, n) => {
+		return await tn(e.store, n.subject, { executionId: r.executionId }), await g.resume(r.workflowName, r.executionId), { ok: !0 };
+	}, t, `action.${hr.name}`), E[z.name] = (t) => U(async (t, n) => {
 		let r = t;
-		return await N(e.store, n.subject, { id: r.id }), _.signal({ id: r.id }, r.signalName, r.payload);
-	}, t, `action.${_r.name}`), O[vr.name] = (t) => Gr(async (t, n) => {
+		return await tn(e.store, n.subject, { id: r.id }), g.signal({ id: r.id }, r.signalName, r.payload);
+	}, t, `action.${z.name}`), E[yr.name] = (t) => U(async (t, n) => {
 		let r = t;
-		return await N(e.store, n.subject, { id: r.id }), _.update({ id: r.id }, r.updateName, r.payload, r.timeoutMs === void 0 ? void 0 : { timeoutMs: r.timeoutMs });
-	}, t, `action.${vr.name}`));
-	let xt = [
-		...D(e.discovered.queries).map((e) => B(e.descriptor)),
-		...D(e.discovered.mutations).map((e) => or(e.descriptor)),
-		...D(e.discovered.actions).map((e) => z(e.descriptor)),
-		...rt.queries.map((e) => B(e.descriptor)),
-		...rt.mutations.map((e) => or(e.descriptor)),
-		...it.queries.map((e) => B(e.descriptor)),
-		...it.mutations.map((e) => or(e.descriptor)),
-		...b.queries.map((e) => B(e.descriptor)),
-		...b.mutations.map((e) => or(e.descriptor)),
-		...b.actions.map((e) => z(e.descriptor)),
-		...D(e.discovered.streams ?? []).map((e) => sr(e.descriptor)),
-		...C.rpcs,
+		return await tn(e.store, n.subject, { id: r.id }), g.update({ id: r.id }, r.updateName, r.payload, r.timeoutMs === void 0 ? void 0 : { timeoutMs: r.timeoutMs });
+	}, t, `action.${yr.name}`));
+	let vt = [
+		...T(e.discovered.queries).map((e) => L(e.descriptor)),
+		...T(e.discovered.mutations).map((e) => lr(e.descriptor)),
+		...T(e.discovered.actions).map((e) => I(e.descriptor)),
+		...Ye.queries.map((e) => L(e.descriptor)),
+		...Ye.mutations.map((e) => lr(e.descriptor)),
+		...Qe.queries.map((e) => L(e.descriptor)),
+		...Qe.mutations.map((e) => lr(e.descriptor)),
+		...b.queries.map((e) => L(e.descriptor)),
+		...b.mutations.map((e) => lr(e.descriptor)),
+		...b.actions.map((e) => I(e.descriptor)),
+		...T(e.discovered.streams ?? []).map((e) => ur(e.descriptor)),
+		...Ee.rpcs,
 		...(e.discovered.workflows ?? []).map((e) => Bi(e.definition)),
-		...ue ? [
-			B(mr),
-			B(gr),
-			B(hr),
-			B(pr),
-			B(ur),
-			B(dr),
-			z(lr),
-			z(fr),
-			z(_r),
-			z(vr)
+		...ce ? [
+			L(R),
+			L(vr),
+			L(_r),
+			L(gr),
+			L(pr),
+			L(mr),
+			I(fr),
+			I(hr),
+			I(z),
+			I(yr)
 		] : []
-	], wt = Qi.make(...xt).middleware(rr).middleware(R), Tt = li({ resolveSubject: ({ headers: t, clientId: n }) => e.resolveSubject(t, n) }), Et = e.dormancyTenantId ?? Fr, Dt = e.dormancy === "sleep" ? {
+	], yt = Qi.make(...vt).middleware(or).middleware(F), bt = li({ resolveSubject: ({ headers: t, clientId: n }) => e.resolveSubject(t, n) }), xt = e.dormancyTenantId ?? Ir, Ct = e.dormancy === "sleep" ? {
 		register: (t, n, r) => Oi(e.store, {
-			tenantId: r ?? Et,
+			tenantId: r ?? xt,
 			kind: "workflow",
 			refId: t,
 			wakeAt: n
 		}),
 		cancel: (t, n) => Jr(e.store, {
-			tenantId: n ?? Et,
+			tenantId: n ?? xt,
 			kind: "workflow",
 			refId: t
 		}).then(() => {})
-	} : void 0, A = de ? await import("@voltro/workflow") : void 0, j = A?.makeWorkflowRunRecorder({
+	} : void 0, O = ue ? await import("@voltro/workflow") : void 0, k = O?.makeWorkflowRunRecorder({
 		store: e.store,
 		...e.workflowRecording === void 0 ? {} : { recording: e.workflowRecording },
-		...Dt === void 0 ? {} : { wakeups: Dt }
-	}), jt = async (t, n) => {
-		await A.closeWorkflowChildrenForParent({
+		...Ct === void 0 ? {} : { wakeups: Ct }
+	}), Tt = async (t, n) => {
+		await O.closeWorkflowChildrenForParent({
 			store: e.store,
 			parentExecutionId: t,
 			parentStatus: n,
-			recorder: j,
+			recorder: k,
 			log: { warn: (e, t) => re.warn(e, t ?? {}) },
 			interruptChild: async (t, n) => {
 				let r = (e.discovered.workflows ?? []).find((e) => e.definition.name === t);
 				if (!r) throw Error(`Unknown child workflow: ${t}`);
-				if (!p) throw Error("Workflow runtime is not ready");
-				await p.runPromise(r.definition.interrupt(n));
+				if (!d) throw Error("Workflow runtime is not ready");
+				await d.runPromise(r.definition.interrupt(n));
 			}
 		});
-	}, Nt = async (t, n, r) => {
+	}, Ot = async (t, n, r) => {
 		let i = (await e.store.query({
 			table: "_voltro_workflow_runs",
 			order: [],
-			predicate: H("executionId", n),
+			predicate: V("executionId", n),
 			projection: void 0,
 			skip: void 0,
 			take: 1
@@ -1417,7 +1417,7 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 			cancelled: !0,
 			completedAt: /* @__PURE__ */ new Date()
 		}), o = i.subject?.tenantId ?? void 0;
-		a && await j.recordEvent({
+		a && await k.recordEvent({
 			runId: i.id,
 			eventType: "run-cancelled",
 			payload: {
@@ -1426,18 +1426,19 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 				executionId: n,
 				...o == null ? {} : { tenantId: o }
 			}
-		}), a && await jt(n, "cancelled");
-	}, Ft = [
+		}), a && await Tt(n, "cancelled");
+	}, At = [
 		...wi(e.discovered.workflows ?? [], {
-			buildContext: (t, n) => e.buildContextForWorkflow?.(t, n) ?? Fe({
+			buildContext: (t, n) => e.buildContextForWorkflow?.(t, n) ?? je({
 				subject: t.subject,
-				traceId: t.traceId
+				traceId: t.traceId,
+				rowFilter: t.rowFilter
 			}, e.store, void 0, `workflow:${n.workflowName}`, { parentExecutionId: n.executionId }),
-			resolveStartContext: se,
-			...le === void 0 ? {} : { resolveAuthority: le }
+			resolveStartContext: oe,
+			...se === void 0 ? {} : { resolveAuthority: se }
 		}, (t, n, r) => {
-			let i = A.getWorkflowVersionMetadata(t.definition);
-			return A.wrapWorkflowExecuteWithRunRecording({
+			let i = O.getWorkflowVersionMetadata(t.definition);
+			return O.wrapWorkflowExecuteWithRunRecording({
 				name: t.definition.name,
 				store: e.store,
 				subject: r.subject,
@@ -1448,42 +1449,42 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 				workflowPatches: i.patches,
 				parentExecutionId: r?.parentExecutionId ?? null,
 				parentClosePolicy: r?.parentClosePolicy ?? null,
-				onParentClose: ({ executionId: e, status: t }) => jt(e, t),
-				...$e(t.definition),
+				onParentClose: ({ executionId: e, status: t }) => Tt(e, t),
+				...Jt(t.definition),
 				onTerminal: async ({ executionId: e }) => {
-					await d?.gate.release(e);
+					await u?.gate.release(e);
 				},
-				recorder: j,
-				pluginWorkflowStepLayer: Xe,
+				recorder: k,
+				pluginWorkflowStepLayer: He,
 				recordRun: Ei
 			}, n);
 		}),
 		...e.discovered.workflowWorkers ?? [],
-		..._e === void 0 ? [] : [_e]
-	], It = [...(e.discovered.workflows ?? []).map((e) => e.definition.name).filter(Boolean), ..._e === void 0 ? [] : ["voltro.deliverWebhook"]], Lt = Ft.length > 0 ? Y.mergeAll(...Ft) : Y.empty;
-	if (((e.discovered.workflows?.length ?? 0) > 0 || (e.discovered.workflowWorkers?.length ?? 0) > 0 || e.scheduleCoordination === "cluster" || _e !== void 0) && e.workflowEngineLayer !== void 0) {
-		let t = Lt.pipe(Y.provideMerge(e.workflowEngineLayer));
-		p = Wi.make((e.baseLayer === void 0 ? t : t.pipe(Y.provideMerge(e.baseLayer))).pipe(Y.provideMerge(nr({})))), await p.runPromise(J.void), (e.log ?? L({ scope: "voltro:serve" })).child("workflow").info(`workflow runtime ready — ${It.length} entity type(s) registered`, { entities: It });
-		let n = await import("@voltro/workflow/cluster"), r = (e) => p.runPromise(n.redriveFailedRun(e)), i = (e) => p.runPromise(n.resumeRunFromStep(e));
-		ne = await Ce({
+		...me === void 0 ? [] : [me]
+	], Ft = [...(e.discovered.workflows ?? []).map((e) => e.definition.name).filter(Boolean), ...me === void 0 ? [] : ["voltro.deliverWebhook"]], It = At.length > 0 ? Y.mergeAll(...At) : Y.empty;
+	if (((e.discovered.workflows?.length ?? 0) > 0 || (e.discovered.workflowWorkers?.length ?? 0) > 0 || e.scheduleCoordination === "cluster" || me !== void 0) && e.workflowEngineLayer !== void 0) {
+		let t = It.pipe(Y.provideMerge(e.workflowEngineLayer));
+		d = Wi.make((e.baseLayer === void 0 ? t : t.pipe(Y.provideMerge(e.baseLayer))).pipe(Y.provideMerge(ar({})))), await d.runPromise(J.void), (e.log ?? P({ scope: "voltro:serve" })).child("workflow").info(`workflow runtime ready — ${Ft.length} entity type(s) registered`, { entities: Ft });
+		let n = await import("@voltro/workflow/cluster"), r = (e) => d.runPromise(n.redriveFailedRun(e)), i = (e) => d.runPromise(n.resumeRunFromStep(e));
+		ne = await Ae({
 			provider: la(e.plugins ?? [])?.broadcast?.provider,
 			crossReplica: la(e.plugins ?? [])?.broadcast?.crossReplica ?? !1,
-			namespace: Te,
+			namespace: xe,
 			replicaId: crypto.randomUUID(),
-			pollStorage: () => p.runPromise(n.pollWorkflowStorage),
+			pollStorage: () => d.runPromise(n.pollWorkflowStorage),
 			onChange: (t) => e.store.onChange((e) => t({
 				table: e.table,
 				op: e.op,
 				...e.origin === void 0 ? {} : { origin: e.origin }
 			})),
-			log: (e.log ?? L({ scope: "voltro:serve" })).child("workflow")
+			log: (e.log ?? P({ scope: "voltro:serve" })).child("workflow")
 		}), ee = async (t) => {
-			let n = await Ke({
+			let n = await Ze({
 				store: e.store,
 				workflows: e.discovered.workflows ?? [],
 				runRedrive: r
 			}, t.runId);
-			return n.statusReset && await j.recordEvent({
+			return n.statusReset && await k.recordEvent({
 				runId: t.runId,
 				eventType: "run-redriven",
 				payload: {
@@ -1496,12 +1497,12 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 				reason: n.outcome.reason
 			};
 		}, te = async (t) => {
-			let n = await Ye({
+			let n = await S({
 				store: e.store,
 				workflows: e.discovered.workflows ?? [],
 				runResume: i
 			}, t.runId, t.step);
-			return n.statusReset && await j.recordEvent({
+			return n.statusReset && await k.recordEvent({
 				runId: t.runId,
 				eventType: "run-redriven",
 				payload: {
@@ -1516,32 +1517,32 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 				reason: n.outcome.reason
 			};
 		};
-		let a = (e.scheduleCoordination ?? "single") === "advisoryLock" ? ii(e.store, e.scheduleReplicaId ?? `pid-${process.pid}`) : Pi, l = di({
+		let a = (e.scheduleCoordination ?? "single") === "advisoryLock" ? ii(e.store, e.scheduleReplicaId ?? `pid-${process.pid}`) : Pi, f = di({
 			coordinator: a,
 			replicaId: e.scheduleReplicaId ?? `pid-${process.pid}`
-		}), u = L({ scope: "voltro:flow-control" }), f = {
+		}), p = P({ scope: "voltro:flow-control" }), m = {
 			info: (e, t) => {
-				u.info(e, t);
+				p.info(e, t);
 			},
 			warn: (e, t) => {
-				u.warn(e, t);
+				p.warn(e, t);
 			},
 			error: (e, t) => {
-				u.error(e, t ?? {});
+				p.error(e, t ?? {});
 			}
-		}, m, re = () => {
-			if (m !== void 0) return m;
-			if (o !== void 0 && j !== void 0) return m = v({
+		}, re, ie = () => {
+			if (re !== void 0) return re;
+			if (o !== void 0 && k !== void 0) return re = Ve({
 				store: e.store,
-				log: P,
+				log: M,
 				workflows: e.discovered.workflows ?? [],
 				workflowsProxy: o,
-				workflowRuntime: p,
-				workflowRunRecorder: j,
-				closeChildrenForParent: jt
-			}), m;
+				workflowRuntime: d,
+				workflowRunRecorder: k,
+				closeChildrenForParent: Tt
+			}), re;
 		};
-		s = re, d = h({
+		s = ie, u = Zt({
 			store: e.store,
 			onChange: (t) => e.store.onChange((e) => t({
 				table: e.table,
@@ -1555,23 +1556,23 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 			},
 			workflows: e.discovered.workflows ?? [],
 			facade: () => o,
-			cancelRunWithReason: re,
-			recordRunEvent: () => j?.recordEvent,
+			cancelRunWithReason: ie,
+			recordRunEvent: () => k?.recordEvent,
 			...e.workflowStaleness === void 0 ? {} : { staleness: e.workflowStaleness },
 			...e.workflowSuspendSignalHintMs === void 0 ? {} : { suspendSignalHintMs: e.workflowSuspendSignalHintMs },
-			scheduleCoordinated: l,
+			scheduleCoordinated: f,
 			onAbandoned: async (t) => {
-				await ft({
+				await et({
 					workflows: e.discovered.workflows ?? [],
 					facade: () => o,
-					log: f,
+					log: m,
 					...t
 				});
 			},
-			log: f
+			log: m
 		});
-		let g = d;
-		g !== void 0 && G(() => g.stop()), c = $t({
+		let h = u;
+		h !== void 0 && G(() => h.stop()), c = at({
 			store: e.store,
 			onChange: (t) => e.store.onChange((e) => t({
 				table: e.table,
@@ -1582,82 +1583,82 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 				tickIntervalMs: e.scheduling.inferenceTickMs
 			},
 			enabled: (e.discovered.workflows?.length ?? 0) > 0,
-			resumeSignal: () => p === void 0 || A === void 0 ? void 0 : async ({ executionId: t, workflowName: n, signalName: r, payload: i }) => {
-				await p.runPromise(A.completeSuspendingSignal({
+			resumeSignal: () => d === void 0 || O === void 0 ? void 0 : async ({ executionId: t, workflowName: n, signalName: r, payload: i }) => {
+				await d.runPromise(O.completeSuspendingSignal({
 					store: e.store,
-					target: Kt(t, n),
+					target: nn(t, n),
 					signalName: r,
 					payload: i
 				}));
 			},
-			runEffect: (e) => p.runPromise(e),
-			scheduleCoordinated: l,
-			log: f
+			runEffect: (e) => d.runPromise(e),
+			scheduleCoordinated: f,
+			log: m
 		});
-		let ie = c;
-		ie !== void 0 && G(() => ie.stop()), o = (e.discovered.workflows?.length ?? 0) > 0 ? Si({
+		let oe = c;
+		oe !== void 0 && G(() => oe.stop()), o = (e.discovered.workflows?.length ?? 0) > 0 ? Si({
 			workflows: e.discovered.workflows ?? [],
-			runEffect: (e) => p.runPromise(e),
+			runEffect: (e) => d.runPromise(e),
 			onEnqueue: () => ne?.publishWake(),
-			...g === void 0 ? {} : {
-				admitStart: g.gate.admitStart,
-				startPayloadSchema: g.gate.startPayloadSchema,
-				parkDelayedStart: g.gate.parkDelayed
+			...h === void 0 ? {} : {
+				admitStart: h.gate.admitStart,
+				startPayloadSchema: h.gate.startPayloadSchema,
+				parkDelayedStart: h.gate.parkDelayed
 			},
-			rememberStartContext: oe,
+			rememberStartContext: ae,
 			signal: async (t, n, r) => {
-				let i = await A.sendWorkflowSignal({
+				let i = await O.sendWorkflowSignal({
 					store: e.store,
-					recorder: j,
+					recorder: k,
 					target: t,
 					signalName: n,
 					payload: r
 				});
-				return await p.runPromise(A.completeSuspendingSignal({
+				return await d.runPromise(O.completeSuspendingSignal({
 					store: e.store,
 					target: t,
 					signalName: n,
 					payload: r
 				})).catch(() => {}), i;
 			},
-			update: (t, n, r, i) => A.sendWorkflowUpdate({
+			update: (t, n, r, i) => O.sendWorkflowUpdate({
 				store: e.store,
-				recorder: j,
+				recorder: k,
 				target: t,
 				updateName: n,
 				payload: r,
 				...i === void 0 ? {} : { options: i }
 			}),
-			listRuns: (t) => qe(e.store, t),
-			retry: (t, n) => ke({
+			listRuns: (t) => Je(e.store, t),
+			retry: (t, n) => l({
 				store: e.store,
 				workflows: e.discovered.workflows ?? [],
-				runPromise: (e) => p.runPromise(e)
+				runPromise: (e) => d.runPromise(e)
 			}, t, n),
-			redrive: (t) => Ke({
+			redrive: (t) => Ze({
 				store: e.store,
 				workflows: e.discovered.workflows ?? [],
 				runRedrive: r
 			}, t).then((e) => e.outcome)
 		}) : void 0;
 	}
-	let Rt = Y.mergeAll(wt.toLayer(O), Tt), Bt = mt(O, e.discovered.queries.map((e) => e.descriptor.name), ue), Ut = Y.mergeAll(wt.toLayer(Bt), Tt), M = e.observability, Wt = await qr({
+	let Lt = Y.mergeAll(yt.toLayer(E), bt), zt = D(E, e.discovered.queries.map((e) => e.descriptor.name), ce), A = Y.mergeAll(yt.toLayer(zt), bt), j = e.observability, Ut = await qr({
 		...e.traceSink === void 0 ? {} : { traceSink: e.traceSink },
 		...e.appName === void 0 ? {} : { serviceName: e.appName },
-		...M && M.spanProcessors.length > 0 ? { extraSpanProcessors: M.spanProcessors } : {},
-		...M && M.metricReaders.length > 0 ? { extraMetricReaders: M.metricReaders } : {},
-		...M && Object.keys(M.resourceAttributes).length > 0 ? { resourceAttributes: M.resourceAttributes } : {},
-		...M && M.sampler !== void 0 ? { sampler: M.sampler } : {}
-	}), qt = !1, Jt = e.store.ping ? () => e.store.ping().then(() => !0).catch(() => !1) : void 0, { server: Yt, shutdown: Xt } = Fi({
-		group: wt,
-		handlersLayer: Rt,
-		httpHandlersLayer: Ut,
+		...j && j.spanProcessors.length > 0 ? { extraSpanProcessors: j.spanProcessors } : {},
+		...j && j.metricReaders.length > 0 ? { extraMetricReaders: j.metricReaders } : {},
+		...j && Object.keys(j.resourceAttributes).length > 0 ? { resourceAttributes: j.resourceAttributes } : {},
+		...j && j.sampler !== void 0 ? { sampler: j.sampler } : {}
+	}), Gt = !1, Kt = e.store.ping ? () => e.store.ping().then(() => !0).catch(() => !1) : void 0, { server: qt, shutdown: Yt } = Fi({
+		group: yt,
+		handlersLayer: Lt,
+		httpHandlersLayer: A,
 		port: e.port ?? 4e3,
 		...e.host === void 0 ? {} : { host: e.host },
 		path: e.path ?? "/ws",
-		tracerLayer: Wt.layer,
-		security: pe(e),
-		...Bn(e),
+		tracerLayer: Ut.layer,
+		security: Ue(e),
+		...Un(e),
 		...e.discovered.wsGateways !== void 0 && e.discovered.wsGateways.length > 0 ? { webSocketGateways: e.discovered.wsGateways } : {},
 		resolveGatewaySubject: async (t) => {
 			let n = await e.resolveSubject(t, -1);
@@ -1666,13 +1667,13 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 				...n.credentialExpiresAt === void 0 ? {} : { credentialExpiresAt: n.credentialExpiresAt * 1e3 }
 			};
 		},
-		...Je,
+		...Be,
 		healthCheck: (() => {
 			let t = e.health;
 			if (t?.readiness !== void 0) {
 				let e = t.readiness;
 				return {
-					isReady: () => qt,
+					isReady: () => Gt,
 					ping: async () => {
 						try {
 							return await e();
@@ -1683,17 +1684,17 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 				};
 			}
 			return {
-				isReady: () => qt,
-				...Jt ? { ping: Jt } : {}
+				isReady: () => Gt,
+				...Kt ? { ping: Kt } : {}
 			};
 		})(),
-		...bt.length > 0 ? { httpRoutes: bt } : {},
+		..._t.length > 0 ? { httpRoutes: _t } : {},
 		...e.getStore === void 0 ? {} : { getStore: e.getStore },
-		...ve.size > 0 ? { webhookRoutes: ve } : {},
+		...ge.size > 0 ? { webhookRoutes: ge } : {},
 		...e.inspectRoute === void 0 ? {} : { inspectRoute: e.inspectRoute },
 		...e.inspectStream === void 0 ? {} : { inspectStream: e.inspectStream }
-	}), Zt = Ma(Yt);
-	if (await Wr(Yt), (e.discovered.schedules?.length ?? 0) > 0) {
+	}), Xt = Ma(qt);
+	if (await Gr(qt), (e.discovered.schedules?.length ?? 0) > 0) {
 		let t = (e.scheduleCoordination ?? "single") === "advisoryLock" ? ii(e.store, e.scheduleReplicaId ?? `pid-${process.pid}`) : Pi;
 		m = await q(e.discovered.schedules ?? [], {
 			store: e.store,
@@ -1704,19 +1705,19 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 			dormancy: e.dormancy ?? "always-on",
 			...e.scheduling === void 0 ? {} : { runHeartbeatMs: e.scheduling.scheduleHeartbeatMs },
 			...e.dormancyTenantId === void 0 ? {} : { dormancyTenantId: e.dormancyTenantId },
-			buildContext: ({ traceId: t, scheduleName: n, subject: r }) => Fe({
+			buildContext: ({ traceId: t, scheduleName: n, subject: r }) => je({
 				subject: r,
 				traceId: t
 			}, e.store, void 0, `schedule:${n}`),
 			log: {
 				info: (e, t) => {
-					g.info(e, t);
+					ie.info(e, t);
 				},
 				warn: (e, t) => {
-					g.warn(e, t);
+					ie.warn(e, t);
 				},
 				error: (e, t) => {
-					g.error(e, t ?? {});
+					ie.error(e, t ?? {});
 				},
 				debug: () => {}
 			},
@@ -1724,30 +1725,30 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 			...e.onScheduleRunEvent === void 0 ? {} : { onRunEvent: e.onScheduleRunEvent }
 		}), e.onSchedulerReady?.(m);
 	}
-	let P = e.log ?? L({ scope: "voltro:serve" }), en, tn, rn = e.claimChange;
-	if ((e.discovered.subscribers?.length ?? 0) > 0 && (en = kt(e.discovered.subscribers ?? [], e.store, P.child("subscribe"), e.schemaRegistry, {
-		eventBus: C.bus,
-		...rn === void 0 ? {} : { claimOnce: rn }
+	let M = e.log ?? P({ scope: "voltro:serve" }), rn, an, sn = e.claimChange;
+	if ((e.discovered.subscribers?.length ?? 0) > 0 && (rn = Bt(e.discovered.subscribers ?? [], e.store, M.child("subscribe"), e.schemaRegistry, {
+		eventBus: Ee.bus,
+		...sn === void 0 ? {} : { claimOnce: sn }
 	})), (e.discovered.reactions?.length ?? 0) > 0) {
-		let t = P.child("reaction");
-		tn = Ne(e.discovered.reactions ?? [], e.store, {
+		let t = M.child("reaction");
+		an = on(e.discovered.reactions ?? [], e.store, {
 			runAct: async (n, r) => {
 				if (n.kind === "workflow") {
-					if (_ === void 0) {
+					if (g === void 0) {
 						t.warn("reaction workflow act skipped — no workflow engine in this app", { workflow: n.workflow });
 						return;
 					}
 					let e = n.payload === void 0 ? r.new ?? r.old ?? {} : n.payload(r);
-					await Ci(_, {
+					await Ci(g, {
 						traceId: `reaction:${n.workflow}`,
 						source: `reaction:${n.workflow}`
 					}).start(n.workflow, e);
 					return;
 				}
-				await nn(n.agent, r, {
+				await p(n.agent, r, {
 					findAgentSend: (t) => e.discovered.actions.find((e) => e.descriptor.name === `${t}.send`),
-					runAction: (e, t, n) => Promise.resolve(ot(e, t, n)),
-					makeSubject: (e) => ir(e),
+					runAction: (e, t, n) => Promise.resolve($e(e, t, n)),
+					makeSubject: (e) => sr(e),
 					now: () => Date.now(),
 					log: t
 				});
@@ -1763,67 +1764,67 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 					return t.warn("reaction budget check failed — refusing the act", { tenantId: n }, e), !1;
 				}
 			},
-			...rn === void 0 ? {} : { claimRateSlot: (e) => rn(Ct, e) },
-			...rn === void 0 ? {} : { claimDedupe: (e) => rn(T, e) }
+			...sn === void 0 ? {} : { claimRateSlot: (e) => sn(Wt, e) },
+			...sn === void 0 ? {} : { claimDedupe: (e) => sn(Et, e) }
 		}, t);
 	}
-	let an;
-	(e.discovered.aggregates?.length ?? 0) > 0 && (an = await x({
+	let cn;
+	(e.discovered.aggregates?.length ?? 0) > 0 && (cn = await x({
 		discovered: e.discovered.aggregates ?? [],
 		store: e.store,
-		log: P.child("aggregate"),
+		log: M.child("aggregate"),
 		...e.analytics === void 0 ? {} : { analytics: e.analytics },
 		...e.aggregateStorage === void 0 ? {} : { storage: e.aggregateStorage },
 		...e.aggregateCoordinator === void 0 ? {} : { coordinator: e.aggregateCoordinator }
-	}), Ie = Y.succeed(Pr, an.registry));
-	let on;
-	(e.discovered.expectations?.length ?? 0) > 0 && (on = Vr({
+	}), Me = Y.succeed(Fr, cn.registry));
+	let ln;
+	(e.discovered.expectations?.length ?? 0) > 0 && (ln = Hr({
 		discovered: e.discovered.expectations ?? [],
 		store: e.store,
-		log: P.child("expectation")
-	}), Le = Y.succeed(Lr, on.registry)), (e.discovered.budgets?.length ?? 0) > 0 && (n = Ur({
+		log: M.child("expectation")
+	}), Ne = Y.succeed(Rr, ln.registry)), (e.discovered.budgets?.length ?? 0) > 0 && (n = Wr({
 		discovered: e.discovered.budgets ?? [],
-		log: P.child("finops")
-	}), Re = Y.succeed(U, n.registry));
-	let sn;
-	return (e.discovered.experiments?.length ?? 0) > 0 && (sn = Hr({
+		log: M.child("finops")
+	}), Pe = Y.succeed(H, n.registry));
+	let un;
+	return (e.discovered.experiments?.length ?? 0) > 0 && (un = Ur({
 		discovered: e.discovered.experiments ?? [],
 		store: e.store,
-		log: P.child("experiment")
-	}), Ve = Y.succeed(Rr, sn.registry)), qt = !0, e.bootTiming?.mark("ready"), {
+		log: M.child("experiment")
+	}), Fe = Y.succeed(zr, un.registry)), Gt = !0, e.bootTiming?.mark("ready"), {
 		dispatcher: r,
-		server: Yt,
+		server: qt,
 		scheduler: m,
-		eventsSnapshot: ce(C.bus, C.declared),
+		eventsSnapshot: he(Ee.bus, Ee.declared),
 		membersSnapshot: () => ({
-			members: Me.membership.list(),
+			members: Te.membership.list(),
 			capturedAt: Date.now()
 		}),
-		agentTools: () => gt,
-		rpcMetrics: () => We,
-		webhooksService: () => he,
+		agentTools: () => ft,
+		rpcMetrics: () => Re,
+		webhooksService: () => pe,
 		runCanceller: () => s(),
-		flowControlHealth: () => d?.cancelHealth(),
+		flowControlHealth: () => u?.cancelHealth(),
 		inferenceHealth: () => c?.health(),
-		workflowWriteActions: () => _ === void 0 || j === void 0 ? void 0 : ze({
+		workflowWriteActions: () => g === void 0 || k === void 0 ? void 0 : Ke({
 			store: e.store,
-			log: P,
+			log: M,
 			workflows: e.discovered.workflows ?? [],
 			workflowsProxy: o,
-			workflowRuntime: p,
-			workflowRunRecorder: j,
-			closeChildrenForParent: jt
+			workflowRuntime: d,
+			workflowRunRecorder: k,
+			closeChildrenForParent: Tt
 		}),
 		redriveWorkflowRun: (e) => ee ? ee(e) : Promise.reject(/* @__PURE__ */ Error("redrive: this app registers no workflows")),
 		resumeWorkflowRunFromStep: (e) => te ? te(e) : Promise.reject(/* @__PURE__ */ Error("resume-from-step: this app registers no workflows")),
 		close: async () => {
-			qt = !1, await Zt.drainRequests();
-			for (let e of ye) try {
+			Gt = !1, await Xt.drainRequests();
+			for (let e of _e) try {
 				await e();
 			} catch (e) {
-				P.warn("serve: teardown step failed", {}, e);
+				M.warn("serve: teardown step failed", {}, e);
 			}
-			await Pe?.detach(), await Me.detach(), an?.detach(), on?.detach(), n?.detach(), sn?.detach(), tn?.(), en?.(), await m?.shutdown(), r.close(), await ne?.detach(), await p?.dispose(), await Xt(), await Zt.finish();
+			await De?.detach(), await Te.detach(), cn?.detach(), ln?.detach(), n?.detach(), un?.detach(), an?.(), rn?.(), await m?.shutdown(), r.close(), await ne?.detach(), await d?.dispose(), await Yt(), await Xt.finish();
 		}
 	};
 }, Ko = (e) => {
@@ -1856,12 +1857,12 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 }, Jo = (e, t = process.env) => ({
 	logs: qo(e?.logs, t.VOLTRO_INSPECT_LOGS),
 	traces: qo(e?.traces, t.VOLTRO_INSPECT_TRACES)
-}), $ = L({ scope: "voltro:serve" }), Yo = (e, t, n) => (e === "production" || e === "staging") && t !== "memory" && n !== "0", Xo = mn, Zo = async (e) => {
-	let t = _n(process.cwd());
-	if (er(t)) {
+}), $ = P({ scope: "voltro:serve" }), Yo = (e, t, n) => (e === "production" || e === "staging") && t !== "memory" && n !== "0", Xo = _n, Zo = async (e) => {
+	let t = bn(process.cwd());
+	if (rr(t)) {
 		let n;
 		try {
-			let e = await import(tr(t).href);
+			let e = await import(ir(t).href);
 			typeof e.runServe == "function" ? n = e.runServe : $.warn("serve bundle has no runServe export — using the standard serve path");
 		} catch (e) {
 			$.warn("serve bundle failed to load — using the standard serve path", {}, e);
@@ -1870,138 +1871,138 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 	}
 	return Qo(e);
 }, Qo = async (l) => {
-	Nr("serve");
-	let u = qn();
+	Pr("serve");
+	let f = Xn();
 	e("serve");
 	try {
 		Hi();
 	} catch (e) {
 		throw i(e instanceof Error ? e.message : String(e));
 	}
-	let f = process.cwd(), h = await it(f), ie = hn({
+	let p = process.cwd(), _ = await Tt(p), le = vn({
 		kind: "api",
-		configPort: h?.port,
+		configPort: _?.port,
 		env: process.env,
 		flagPort: Xo(l, "--port")
 	});
-	for (let e of ie.warnings) $.warn(e);
-	let ce = ie.port;
-	ji(ki(h?.secrets)), await rn({
-		rawEnv: h?.env,
+	for (let e of le.warnings) $.warn(e);
+	let he = le.port;
+	ji(ki(_?.secrets)), await sn({
+		rawEnv: _?.env,
 		appType: "api",
-		root: f,
+		root: p,
 		log: $,
 		generateTypes: !1,
-		plugins: h?.plugins ?? []
-	}), u.mark("config");
-	let v = (process.env.DB_DIALECT ?? h?.store ?? "memory").toLowerCase(), ge = (v === "mariadb" || v === "postgres" || v === "mssql") && (process.env.CDC ?? "1") !== "0", Se = v === "mariadb" ? "mariadb" : v === "mssql" ? "mssql" : void 0, Ce = gn(f);
-	if (!r() && er(Ce)) try {
-		let e = await import(tr(Ce).href);
+		plugins: _?.plugins ?? []
+	}), f.mark("config");
+	let y = (process.env.DB_DIALECT ?? _?.store ?? "memory").toLowerCase(), Oe = (y === "mariadb" || y === "postgres" || y === "mssql") && (process.env.CDC ?? "1") !== "0", ke = y === "mariadb" ? "mariadb" : y === "mssql" ? "mssql" : void 0, Ae = yn(p);
+	if (!r() && rr(Ae)) try {
+		let e = await import(ir(Ae).href);
 		if (e.modules) {
 			let t = {};
-			for (let [n, r] of Object.entries(e.modules)) t[Qn(f, n)] = r;
+			for (let [n, r] of Object.entries(e.modules)) t[tr(p, n)] = r;
 			n(t), $.info("precompiled api bundle loaded", { modules: Object.keys(t).length });
 		}
 	} catch (e) {
 		$.warn("precompiled api bundle failed to load — falling back to source", {}, e);
 	}
-	let x = await jt(f), S = await Ut(x, {
-		root: f,
-		cdc: ge && Se !== void 0
-	}), Ee = _e(S);
+	let x = await Ot(p), S = await st(x, {
+		root: p,
+		cdc: Oe && ke !== void 0
+	}), Ve = Lt(S);
 	{
-		ot({
-			plugins: h?.plugins ?? [],
+		ut({
+			plugins: _?.plugins ?? [],
 			queries: S.queries,
 			mutations: S.mutations,
 			actions: S.actions,
 			streams: S.streams,
 			log: $
 		});
-		let e = Ae(S.serverOnlyLeaks, Xe(process.env, "strict"), Zr, "`voltro serve`");
+		let e = u(S.serverOnlyLeaks, je(process.env, "strict"), Zr, "`voltro serve`");
 		if (e.action === "fail") throw i(e.message ?? "");
 		e.action === "warn" && $.warn(e.message ?? "");
 	}
-	let Oe = x.filter((e) => Kn.test(e)), ke = Oe.length > 0 ? await Gn(Oe, $.child("webhooks")) : {
+	let Ke = x.filter((e) => Yn.test(e)), qe = Ke.length > 0 ? await Jn(Ke, $.child("webhooks")) : {
 		outgoing: [],
 		incoming: [],
 		providers: []
-	}, Ne = Un(S.events), ze = ke.outgoing.length + ke.incoming.length + ke.providers.length + Ne.length === 0 ? void 0 : {
-		...ke,
-		outgoing: [...ke.outgoing, ...Ne]
-	}, Be = kn({
+	}, Je = Kn(S.events), Xe = qe.outgoing.length + qe.incoming.length + qe.providers.length + Je.length === 0 ? void 0 : {
+		...qe,
+		outgoing: [...qe.outgoing, ...Je]
+	}, Ze = Mn({
 		nodeEnv: process.env.NODE_ENV,
-		cdcDialect: Se,
-		declared: h?.schema
-	}), Ke = An({
-		gates: Be,
+		cdcDialect: ke,
+		declared: _?.schema
+	}), et = Nn({
+		gates: Ze,
 		runtime: {
-			traces: me(),
+			traces: ye(),
 			undo: Li()
 		}
 	});
-	if (Ke !== void 0) throw i(`serve: ${Ke}`);
-	let qe = On({
+	if (et !== void 0) throw i(`serve: ${et}`);
+	let rt = jn({
 		mix: S.featureMix,
-		plugins: h?.plugins ?? [],
-		gates: Be,
-		...Se ? { cdcDialect: Se } : {}
-	}), Ye = h?.analytics !== void 0 && h.analytics.kind !== "noop" && v !== "memory" ? (await vn(v)).makeSqlLayer(j()) : void 0, $e = await st({
-		spec: h?.analytics,
-		sqlLayer: Ye,
+		plugins: _?.plugins ?? [],
+		gates: Ze,
+		...ke ? { cdcDialect: ke } : {}
+	}), it = _?.analytics !== void 0 && _.analytics.kind !== "noop" && y !== "memory" ? (await xn(y)).makeSqlLayer(A()) : void 0, at = await dt({
+		spec: _?.analytics,
+		sqlLayer: it,
 		log: $
 	}), w = (() => {
 		let e = new Set(S.tables.map((e) => e.tableName)), t = [...S.tables];
-		for (let n of [...qe, ...$e.tables]) e.has(n.tableName) || (e.add(n.tableName), t.push(n));
+		for (let n of [...rt, ...at.tables]) e.has(n.tableName) || (e.add(n.tableName), t.push(n));
 		return t;
 	})();
-	for (let e of w) Tr(e);
+	for (let e of w) Er(e);
 	{
-		let e = Qr(Ri(De(S), le(w)));
+		let e = Qr(Ri(ce(S), v(w)));
 		e !== void 0 && $.warn(e);
 	}
-	let et = (process.env.NODE_ENV ?? "").toLowerCase();
-	if (Yo(et, v, process.env.VOLTRO_AUTO_MIGRATE)) {
-		let e = (await vn(v)).makeSqlLayer(j()), t = await J.runPromise(Gi.SqlClient.pipe(J.flatMap((e) => Ji(e, f)), J.provide(e), J.catchAll(() => J.succeed([]))));
+	let ct = (process.env.NODE_ENV ?? "").toLowerCase();
+	if (Yo(ct, y, process.env.VOLTRO_AUTO_MIGRATE)) {
+		let e = (await xn(y)).makeSqlLayer(A()), t = await J.runPromise(Gi.SqlClient.pipe(J.flatMap((e) => Ji(e, p)), J.provide(e), J.catchAll(() => J.succeed([]))));
 		t.length > 0 && ($.error(`serve: refusing to boot — ${t.length} pending file-based migration(s) have never run against this database. They perform the changes a schema diff cannot infer (data moves, backfills, table splits), so the declarative fingerprint check below cannot see them and would have let this process serve un-migrated data.`, { pending: t }), $.error("Run them from your pre-deploy job — `voltro db migrate .` (schema + files) or `voltro db files .` (files alone) — or set VOLTRO_AUTO_MIGRATE=0 to bypass every boot schema check. `voltro serve` never applies them itself: a rolling deploy would start N replicas and each would try."), process.exit(1));
 		let n = await J.runPromise(Gi.SqlClient.pipe(J.flatMap((e) => Yi(e, w, {
-			appliedBy: `serve:${et}`,
+			appliedBy: `serve:${ct}`,
 			environment: "prod",
-			dialectId: v
+			dialectId: y
 		})), J.provide(e)));
-		n.kind === "prod-mismatch" && ($.error(qi(n, v)), $.error(jn({
-			gates: Be,
+		n.kind === "prod-mismatch" && ($.error(qi(n, y)), $.error(Pn({
+			gates: Ze,
 			nodeEnv: process.env.NODE_ENV,
-			cdcDialect: Se,
-			declared: h?.schema
-		})), $.error("serve: refusing to boot — apply the schema first (voltro db apply in a pre-deploy step), or set VOLTRO_AUTO_MIGRATE=0 to bypass this check."), process.exit(1)), $.info(qi(n, v));
+			cdcDialect: ke,
+			declared: _?.schema
+		})), $.error("serve: refusing to boot — apply the schema first (voltro db apply in a pre-deploy step), or set VOLTRO_AUTO_MIGRATE=0 to bypass this check."), process.exit(1)), $.info(qi(n, y));
 	}
-	await Cn({
-		dialectId: v,
+	await En({
+		dialectId: y,
 		tables: w,
-		mode: xn(h?.reactiveTriggers),
-		lockSchema: j().schema,
-		makeLayer: async () => (await vn(v)).makeSqlLayer(j()),
+		mode: wn(_?.reactiveTriggers),
+		lockSchema: A().schema,
+		makeLayer: async () => (await xn(y)).makeSqlLayer(A()),
 		log: {
 			info: (e, t) => $.info(e, t ?? {}),
 			warn: (e, t) => $.warn(e, t ?? {})
 		}
 	});
-	let nt = xi(w);
-	u.mark("discover");
-	let T = await gt(h, void 0);
+	let lt = xi(w);
+	f.mark("discover");
+	let D = await tt(_, void 0);
 	{
-		let e = await c(T);
+		let e = await c(D);
 		if (e !== void 0) throw i(`serve: ${e}`);
-		let t = await s(T, v, h);
+		let t = await s(D, y, _);
 		t !== void 0 && $.warn(t);
 	}
-	let at = Vi(T, v);
-	for (let e of Te({
-		dialect: String(h?.store ?? process.env.DB_DIALECT ?? "postgres"),
+	let St = Vi(D, y);
+	for (let e of k({
+		dialect: String(_?.store ?? process.env.DB_DIALECT ?? "postgres"),
 		changeStrategy: (process.env.CDC ?? "1") === "0" ? "inline" : "cdc",
 		dbUrl: process.env.DB_URL,
-		crossReplicaBus: la(h?.plugins ?? [])?.broadcast.crossReplica === !0,
+		crossReplicaBus: la(_?.plugins ?? [])?.broadcast.crossReplica === !0,
 		tables: S.tables.map((e) => ({
 			tableName: e.tableName,
 			isReactive: e.isReactive === !0
@@ -2012,214 +2013,214 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 		})
 	})) e.level === "warn" ? $.warn(e.message) : $.info(e.message);
 	{
-		let e = oe({
-			tables: br().map((e) => ({ tableName: e.tableName })),
+		let e = h({
+			tables: xr().map((e) => ({ tableName: e.tableName })),
 			queries: S.queries.map((e) => ({
 				name: e.descriptor.name,
 				source: e.descriptor.source
 			}))
-		}), t = g(e);
+		}), t = De(e);
 		t !== void 0 && $.warn(t);
 	}
-	h?.cache && !process.env.CACHE_BACKEND && (process.env.CACHE_BACKEND = h.cache), h?.cacheRedisUrl && !process.env.CACHE_REDIS_URL && (process.env.CACHE_REDIS_URL = h.cacheRedisUrl), h?.cacheRedisDriver && !process.env.CACHE_REDIS_DRIVER && (process.env.CACHE_REDIS_DRIVER = h.cacheRedisDriver), h?.cacheKeyPrefix && !process.env.CACHE_KEY_PREFIX && (process.env.CACHE_KEY_PREFIX = h.cacheKeyPrefix);
-	let { service: lt, invalidationBus: ft, snapshotCache: mt, cache: St, semantic: Ct, evictSource: Ot, backend: kt, stats: At, dispose: Mt } = await Le({
+	_?.cache && !process.env.CACHE_BACKEND && (process.env.CACHE_BACKEND = _.cache), _?.cacheRedisUrl && !process.env.CACHE_REDIS_URL && (process.env.CACHE_REDIS_URL = _.cacheRedisUrl), _?.cacheRedisDriver && !process.env.CACHE_REDIS_DRIVER && (process.env.CACHE_REDIS_DRIVER = _.cacheRedisDriver), _?.cacheKeyPrefix && !process.env.CACHE_KEY_PREFIX && (process.env.CACHE_KEY_PREFIX = _.cacheKeyPrefix);
+	let { service: wt, invalidationBus: Et, snapshotCache: Dt, cache: kt, semantic: jt, evictSource: Mt, backend: Nt, stats: Pt, dispose: Rt } = await se({
 		env: process.env,
-		semantic: h?.cacheSemantic ?? !1
+		semantic: _?.cacheSemantic ?? !1
 	});
-	Ct !== void 0 && $.info("semantic cache enabled — reactive eviction on live writes"), $.info(`cache backend resolved: ${kt}` + (kt === "redis" ? ` (driver ${process.env.CACHE_REDIS_DRIVER ?? "resp"})` : " — in-process, not cross-instance"));
-	let Pt = (e) => {
-		J.runFork(ft.publish(e));
+	jt !== void 0 && $.info("semantic cache enabled — reactive eviction on live writes"), $.info(`cache backend resolved: ${Nt}` + (Nt === "redis" ? ` (driver ${process.env.CACHE_REDIS_DRIVER ?? "resp"})` : " — in-process, not cross-instance"));
+	let Bt = (e) => {
+		J.runFork(Et.publish(e));
 	};
-	T.onChange((e) => {
-		if (J.runFork(ft.publish(e.table)), Ot !== void 0) {
+	D.onChange((e) => {
+		if (J.runFork(Et.publish(e.table)), Mt !== void 0) {
 			let t = (e.new ?? e.old)?.id;
-			Ot({
+			Mt({
 				table: e.table,
 				op: e.op,
 				...t === void 0 ? {} : { id: t }
 			});
 		}
-	}), h?.kv && !process.env.KV_BACKEND && (process.env.KV_BACKEND = h.kv), h?.kvRedisUrl && !process.env.KV_REDIS_URL && (process.env.KV_REDIS_URL = h.kvRedisUrl), h?.kvKeyPrefix && !process.env.KV_KEY_PREFIX && (process.env.KV_KEY_PREFIX = h.kvKeyPrefix);
-	let { kv: zt, service: Vt } = await ci({ store: T });
-	Me({
+	}), _?.kv && !process.env.KV_BACKEND && (process.env.KV_BACKEND = _.kv), _?.kvRedisUrl && !process.env.KV_REDIS_URL && (process.env.KV_REDIS_URL = _.kvRedisUrl), _?.kvKeyPrefix && !process.env.KV_KEY_PREFIX && (process.env.KV_KEY_PREFIX = _.kvKeyPrefix);
+	let { kv: Vt, service: Ht } = await ci({ store: D });
+	an({
 		log: $,
-		max: bn(),
-		outOfPool: ve(v, (process.env.CDC ?? "1") !== "0"),
+		max: Cn(),
+		outOfPool: Ne(y, (process.env.CDC ?? "1") !== "0"),
 		readPools: t.replicationSnapshot()?.replicaCount ?? 0,
 		always: !0
-	}), u.mark("store");
-	let Ht = Br({
-		store: T,
-		sink: $e.sink,
+	}), f.mark("store");
+	let Wt = Vr({
+		store: D,
+		sink: at.sink,
 		log: $
-	}), N = Et(h?.idempotency, T), Kt = Jt({
-		store: T,
-		dialect: v,
+	}), Jt = gt(_?.idempotency, D), Zt = ze({
+		store: D,
+		dialect: y,
 		log: { info: (e) => $.info(e) },
-		...N === void 0 ? {} : { idempotencyTtlMs: N.ttlMs }
-	}), F = h?.plugins ?? [], Qt = Ar(), $t, nn;
-	v !== "memory" && ($t = Wi.make((await vn(v)).makeSqlLayer(j()).pipe(Y.provideMerge(nr({})))), nn = await $t.runPromise(Gi.SqlClient));
-	let mn = [
+		...Jt === void 0 ? {} : { idempotencyTtlMs: Jt.ttlMs }
+	}), $t = _?.plugins ?? [], tn = jr(), nn, on;
+	y !== "memory" && (nn = Wi.make((await xn(y)).makeSqlLayer(A()).pipe(Y.provideMerge(ar({})))), on = await nn.runPromise(Gi.SqlClient));
+	let _n = [
 		"postgres",
 		"mariadb",
 		"mysql",
 		"mssql"
-	].includes(v) ? ii(T, Qt, $) : Pi, _n = Re(h?.scheduling), Bn = di({
-		maxIdleIntervalMs: _n.pollCeilingMs,
-		coordinator: mn,
-		replicaId: Qt,
+	].includes(y) ? ii(D, tn, $) : Pi, bn = g(_?.scheduling), Un = di({
+		maxIdleIntervalMs: bn.pollCeilingMs,
+		coordinator: _n,
+		replicaId: tn,
 		log: $
-	}), Wn = [], Jn = Ar(), Yn = la(h?.plugins ?? [])?.broadcast?.provider, Xn = Gt(h?.plugins, h?.name ?? Zn(f));
+	}), qn = [], Zn = jr(), Qn = la(_?.plugins ?? [])?.broadcast?.provider, $n = en(_?.plugins, _?.name ?? er(p));
 	{
-		let e = Ze(h?.plugins, h?.name ?? Zn(f));
+		let e = Kt(_?.plugins, _?.name ?? er(p));
 		e !== void 0 && $.warn(e);
 	}
-	let I = tt(h?.plugins, {
-		instanceId: Jn,
-		namespace: Xn,
+	let N = Qt(_?.plugins, {
+		instanceId: Zn,
+		namespace: $n,
 		meta: { mode: "serve" },
 		logger: $
-	}), $n = jr();
-	Mr(`${$n.host}:${ce}`, $n.declared);
-	let rr = on(), R = Jo(h?.inspect), z = fe({
-		store: T,
-		members: () => I.membership?.list() ?? []
-	}), ir = () => {
-		let e = I.membership?.list().length;
+	}), nr = Mr();
+	Nr(`${nr.host}:${he}`, nr.declared);
+	let or = cn(), F = Jo(_?.inspect), I = He({
+		store: D,
+		members: () => N.membership?.list() ?? []
+	}), sr = () => {
+		let e = N.membership?.list().length;
 		return typeof e == "number" && e > 0 ? { fleetSize: e } : {};
-	}, ar = zn({
+	}, cr = Hn({
 		mode: "serve",
-		dialect: v,
-		...Yn === void 0 ? {} : { provider: Yn },
+		dialect: y,
+		...Qn === void 0 ? {} : { provider: Qn },
 		logger: $
 	});
 	G(async () => {
-		await ar.stop();
-	}), m(h?.reactive), Pe(h);
-	let or = M(T, {
-		claimedBy: kr(),
+		await cr.stop();
+	}), Xt(_?.reactive), m(_);
+	let lr = T(D, {
+		claimedBy: Ar(),
 		onError: (e) => $.warn("change claim failed — the claimed effect is being SKIPPED, not duplicated", { cause: String(e) })
-	}), B = {
-		...nn ? { sql: nn } : {},
-		instanceId: Jn,
-		membership: I.membership,
-		...Yn === void 0 ? {} : { broadcast: Yn },
-		broadcastChannels: { presence: ca(Xn, "presence") },
+	}), L = {
+		...on ? { sql: on } : {},
+		instanceId: Zn,
+		membership: N.membership,
+		...Qn === void 0 ? {} : { broadcast: Qn },
+		broadcastChannels: { presence: ca($n, "presence") },
 		scheduleCoordinated: (e, t, n) => {
-			let r = Bn(e, t, n);
-			return Wn.push(r), r;
+			let r = Un(e, t, n);
+			return qn.push(r), r;
 		},
-		claimChange: or.claim
+		claimChange: lr.claim
 	};
-	for (let e of F) e.bindDataStore?.(at, B);
-	be({
-		store: T,
-		...vt(),
+	for (let e of $t) e.bindDataStore?.(St, L);
+	Ce({
+		store: D,
+		...be(),
 		log: $
 	});
-	let sr = F.filter((e) => typeof e.onChangeEvent == "function");
-	if (sr.length > 0) {
-		let e = T.changeScope ?? "local";
-		T.onChange((t) => {
-			let n = Ue(t, e);
-			for (let e of sr) J.runFork(e.onChangeEvent(n).pipe(J.catchAllCause((t) => J.sync(() => $.warn(`plugin ${e.name} onChangeEvent failed`, { error: Ui.pretty(t) })))));
+	let ur = $t.filter((e) => typeof e.onChangeEvent == "function");
+	if (ur.length > 0) {
+		let e = D.changeScope ?? "local";
+		D.onChange((t) => {
+			let n = me(t, e);
+			for (let e of ur) J.runFork(e.onChangeEvent(n).pipe(J.catchAllCause((t) => J.sync(() => $.warn(`plugin ${e.name} onChangeEvent failed`, { error: Ui.pretty(t) })))));
 		});
 	}
-	let cr = x.filter((e) => Nn.test(e));
-	cr.length > 0 && (await It(cr, $), $.info(`queue: ${cr.length} consumer file(s) loaded`));
-	let lr = A({
-		plugins: F,
-		appName: h?.name ?? "voltro-api",
+	let dr = x.filter((e) => In.test(e));
+	dr.length > 0 && (await yt(dr, $), $.info(`queue: ${dr.length} consumer file(s) loaded`));
+	let fr = zt({
+		plugins: $t,
+		appName: _?.name ?? "voltro-api",
 		appType: "api",
-		voltroVersion: Or() ?? "unknown",
+		voltroVersion: kr() ?? "unknown",
 		log: $
 	});
-	F.length && await lr.activate(), u.mark("plugins");
-	let ur = await lr.gatherObservability(), dr = L({ scope: "voltro:broadcast" }), fr = {
+	$t.length && await fr.activate(), f.mark("plugins");
+	let pr = await fr.gatherObservability(), mr = P({ scope: "voltro:broadcast" }), hr = {
 		info: (e, t) => {
-			dr.info(e, t);
+			mr.info(e, t);
 		},
 		warn: (e, t) => {
-			dr.warn(e, t);
+			mr.warn(e, t);
 		},
 		debug: () => {}
 	};
-	R.logs.on && (cn(new dn(R.logs.size)), G(ln(rr)), fr.info("inspect: serving /_voltro/inspect/logs", { ring: R.logs.size }));
-	let pr;
-	R.traces.on && (en(new y(R.traces.size)), pr = ui(pt({ buffer: je() })), fr.info("inspect: serving /_voltro/inspect/traces", { ring: R.traces.size }));
-	let mr, hr = Lt({
-		store: T,
-		dispatcher: () => mr,
-		invalidateTable: () => Pt,
-		log: fr
-	}), gr = await Tt(T, h, v, Xn, fr, hr.onBroadcastGap), _r = h?.apiKeys, vr = (typeof _r == "object" ? _r.prefix : void 0) ?? "voltro_", V = _r ? Xr(T) : void 0, yr = V ? oi({ flush: si(V) }) : void 0;
-	yr && G(() => yr.shutdown());
-	let xr = V ? ai(V, {
-		prefix: vr,
-		...yr ? { usage: yr } : {}
-	}) : void 0, Cr = xr ? [$r(xr, { prefix: vr })] : [], wr = Ft([...h?.auth?.strategies ?? [], ...Cr], ga(h?.plugins ?? []), h?.auth?.anonymousTenantRequired ?? !1, h?.auth, () => at), H = [...h?.restRoutes ?? [], ...xr ? zr(xr, (typeof _r == "object" ? _r.managementPath : void 0) ?? "/v1/api-keys") : []], Er = F.map((e) => e.services).filter((e) => e !== void 0), Pr = Y.mergeAll(Qe({
-		analyticsLayer: $e.layer,
-		cacheService: lt,
-		kvService: Vt,
-		...Ct === void 0 ? {} : { semanticCache: Ct },
-		pluginServices: Er,
-		userLayers: h?.layers ?? []
-	}), O(h?.http ?? {})), U = await Nt({
+	F.logs.on && (un(new pn(F.logs.size)), G(ln(or)), hr.info("inspect: serving /_voltro/inspect/logs", { ring: F.logs.size }));
+	let gr;
+	F.traces.on && (ee(new Me(F.traces.size)), gr = ui(pt({ buffer: rn() })), hr.info("inspect: serving /_voltro/inspect/traces", { ring: F.traces.size }));
+	let R, _r = bt({
+		store: D,
+		dispatcher: () => R,
+		invalidateTable: () => Bt,
+		log: hr
+	}), vr = await ht(D, _, y, $n, hr, _r.onBroadcastGap), z = _?.apiKeys, yr = (typeof z == "object" ? z.prefix : void 0) ?? "voltro_", B = z ? Xr(D) : void 0, br = B ? oi({ flush: si(B) }) : void 0;
+	br && G(() => br.shutdown());
+	let Sr = B ? ai(B, {
+		prefix: yr,
+		...br ? { usage: br } : {}
+	}) : void 0, wr = Sr ? [$r(Sr, { prefix: yr })] : [], Tr = vt([..._?.auth?.strategies ?? [], ...wr], ga(_?.plugins ?? []), _?.auth?.anonymousTenantRequired ?? !1, _?.auth, () => St), V = [..._?.restRoutes ?? [], ...Sr ? Br(Sr, (typeof z == "object" ? z.managementPath : void 0) ?? "/v1/api-keys") : []], Dr = $t.map((e) => e.services).filter((e) => e !== void 0), Fr = Y.mergeAll(qt({
+		analyticsLayer: at.layer,
+		cacheService: wt,
+		kvService: Ht,
+		...jt === void 0 ? {} : { semanticCache: jt },
+		pluginServices: Dr,
+		userLayers: _?.layers ?? []
+	}), $e(_?.http ?? {})), H = await At({
 		files: x,
-		store: T,
+		store: D,
 		log: $,
 		seedPolicy: "report",
-		seedPattern: Mn,
-		loadSeedFiles: Sn,
-		startupPattern: Rn,
+		seedPattern: Fn,
+		loadSeedFiles: Tn,
+		startupPattern: Vn,
 		loadStartupFiles: a,
 		runStartups: o,
-		emailPattern: Dt,
-		loadEmailFiles: ht,
+		emailPattern: _t,
+		loadEmailFiles: mt,
 		registerEmailTemplates: _a
 	});
-	(U.startupCount > 0 || U.emailCount > 0) && $.info("boot lifecycle", {
-		startups: U.startupCount,
-		emailTemplates: U.emailCount
-	}), U.startups !== void 0 && G(async () => {
-		await U.startups.stop();
-	}), Ge({
-		demands: de(Ee),
+	(H.startupCount > 0 || H.emailCount > 0) && $.info("boot lifecycle", {
+		startups: H.startupCount,
+		emailTemplates: H.emailCount
+	}), H.startups !== void 0 && G(async () => {
+		await H.startups.stop();
+	}), de({
+		demands: ve(Ve),
 		isRegistered: (e) => ei(e) !== void 0
 	});
-	let Fr = ct({
-		schedules: dt({
+	let Ir = ft({
+		schedules: It({
 			schedules: S.schedules,
-			seeds: U.seeds,
-			store: T,
+			seeds: H.seeds,
+			store: D,
 			log: $.child("seeds")
 		}),
 		workflows: S.workflows ?? [],
 		log: $.child("workflow-schedules")
-	}), Ir = h?.scheduling ?? {}, Lr = Ir.trigger ?? "self", Rr = /* @__PURE__ */ new Set([
+	}), Lr = _?.scheduling ?? {}, Rr = Lr.trigger ?? "self", zr = /* @__PURE__ */ new Set([
 		"postgres",
 		"mysql",
 		"mariadb",
 		"mssql"
-	]), Vr = Ir.coordination ?? (Rr.has(v) ? "advisoryLock" : "single"), Hr = Vr === "cluster" && Rr.has(v), Ur = Hr ? "cluster" : Vr === "advisoryLock" && Rr.has(v) ? "advisoryLock" : "single";
-	Vr === "cluster" && !Hr && $.warn("scheduling.coordination=cluster needs a sql-backed store except sqlite — falling back to single"), Vr === "advisoryLock" && !Rr.has(v) && $.warn("scheduling.coordination=advisoryLock needs a SQL store (the claim-row gate) — falling back to single");
-	let Wr, Gr = S.workflows.length > 0 || S.workflowWorkers.length > 0 || S.eventTriggers.length > 0 || (ze?.outgoing.length ?? 0) > 0 || Hr, Kr;
-	if (Gr) {
-		if (v === "mssql") {
-			let e = await Hn(process.cwd());
+	]), Hr = Lr.coordination ?? (zr.has(y) ? "advisoryLock" : "single"), Ur = Hr === "cluster" && zr.has(y), Wr = Ur ? "cluster" : Hr === "advisoryLock" && zr.has(y) ? "advisoryLock" : "single";
+	Hr === "cluster" && !Ur && $.warn("scheduling.coordination=cluster needs a sql-backed store except sqlite — falling back to single"), Hr === "advisoryLock" && !zr.has(y) && $.warn("scheduling.coordination=advisoryLock needs a SQL store (the claim-row gate) — falling back to single");
+	let Gr, U = S.workflows.length > 0 || S.workflowWorkers.length > 0 || S.eventTriggers.length > 0 || (Xe?.outgoing.length ?? 0) > 0 || Ur, Kr;
+	if (U) {
+		if (y === "mssql") {
+			let e = await Gn(process.cwd());
 			e && $.warn(e);
 		}
-		let [{ WorkflowEngine: e }, { makeClusterCronLayer: t, workflowEngineLayer: n, resolveRunnerStorage: r, resolveFailoverTuning: i }] = await Promise.all([import("@effect/workflow"), import("@voltro/workflow/cluster")]), a = Hr ? Fr.filter((e) => (e.trigger ?? Lr) === "self").map((e) => t({
+		let [{ WorkflowEngine: e }, { makeClusterCronLayer: t, workflowEngineLayer: n, resolveRunnerStorage: r, resolveFailoverTuning: i }] = await Promise.all([import("@effect/workflow"), import("@voltro/workflow/cluster")]), a = Ur ? Ir.filter((e) => (e.trigger ?? Rr) === "self").map((e) => t({
 			name: e.name,
 			cron: Yr(e),
 			execute: async () => {
-				await Wr?.fireFromCluster(e.name);
+				await Gr?.fireFromCluster(e.name);
 			}
 		})) : [];
-		Kr = v === "memory" ? e.layerMemory : await (async () => {
-			let e = await vn(v), t = r({ sqliteFamily: e.id === "sqlite" || e.id === "turso" });
+		Kr = y === "memory" ? e.layerMemory : await (async () => {
+			let e = await xn(y), t = r({ sqliteFamily: e.id === "sqlite" || e.id === "turso" });
 			return $.info(`workflow engine: cluster-${t}, dialect=${e.id}` + (t === "memory" ? " — single-process durable replay, no cross-pod shard handoff" + (e.id !== "sqlite" && e.id !== "turso" ? " (VOLTRO_WORKFLOW_RUNNER_STORAGE=memory: SqlRunnerStorage/cluster_runners + GET_LOCK skipped)" : "") : "")), n({
-				sqlClientLayer: e.makeSqlLayer(j()),
+				sqlClientLayer: e.makeSqlLayer(A()),
 				runnerStorage: t,
 				dialectId: e.id,
 				...process.env.VOLTRO_WORKFLOW_RUNNER_PORT ? { runnerListenPort: Number(process.env.VOLTRO_WORKFLOW_RUNNER_PORT) } : {},
@@ -2228,118 +2229,118 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 			});
 		})();
 	}
-	let W = E(F, Vn()), qr = x.filter((e) => /\.subscribe\.tsx?$/.test(e)), Jr = qr.length > 0 ? await Rt(qr, $) : [], ti = x.filter((e) => /\.reaction\.tsx?$/.test(e)), ni = ti.length > 0 ? await te(ti, $) : [], ri = x.filter((e) => Pn.test(e)), li = ri.length > 0 ? await _t(ri, $) : [], fi = x.filter((e) => /\.aggregate\.tsx?$/.test(e)), pi = fi.length > 0 ? await _(fi, $) : [];
+	let W = Ut($t, Wn()), qr = x.filter((e) => /\.subscribe\.tsx?$/.test(e)), Jr = qr.length > 0 ? await ot(qr, $) : [], ti = x.filter((e) => /\.reaction\.tsx?$/.test(e)), ni = ti.length > 0 ? await Ge(ti, $) : [], ri = x.filter((e) => Ln.test(e)), li = ri.length > 0 ? await nt(ri, $) : [], fi = x.filter((e) => /\.aggregate\.tsx?$/.test(e)), pi = fi.length > 0 ? await ge(fi, $) : [];
 	{
-		let e = Qr(Ri(De({ aggregates: pi.map((e) => e.definition) }), le(w)));
+		let e = Qr(Ri(ce({ aggregates: pi.map((e) => e.definition) }), v(w)));
 		e !== void 0 && $.warn(e);
 	}
-	let mi = he();
-	if (pi.length > 0 && v !== "memory") try {
-		let e = (await vn(v)).makeSqlLayer(j());
-		mi = ye(e);
+	let mi = b();
+	if (pi.length > 0 && y !== "memory") try {
+		let e = (await xn(y)).makeSqlLayer(A());
+		mi = Pe(e);
 	} catch (e) {
 		$.warn("aggregate: SQL storage init failed — falling back to in-process", { err: String(e) });
 	}
-	let hi = v === "memory" ? Pi : ii(T, `aggregate@${process.pid}`, $), gi = x.filter((e) => Fn.test(e)), _i = gi.length > 0 ? await bt(gi, $) : [], vi = x.filter((e) => In.test(e)), yi = vi.length > 0 ? await p(vi, $) : [], bi = x.filter((e) => Ln.test(e)), Si = bi.length > 0 ? await b(bi, $) : [], Ci = [], wi = [], Ti = x.filter((e) => wn.test(e));
+	let hi = y === "memory" ? Pi : ii(D, `aggregate@${process.pid}`, $), gi = x.filter((e) => Rn.test(e)), _i = gi.length > 0 ? await Se(gi, $) : [], vi = x.filter((e) => zn.test(e)), yi = vi.length > 0 ? await Ct(vi, $) : [], bi = x.filter((e) => Bn.test(e)), Si = bi.length > 0 ? await Te(bi, $) : [], Ci = [], wi = [], Ti = x.filter((e) => Dn.test(e));
 	if (Ti.length > 0) {
-		let e = $.child("agent"), t = x.filter((e) => Dn.test(e));
-		t.length > 0 && await Tn(t, e);
-		let n = await En(Ti, e);
-		for (let e of n.agents) for (let t of wt(e)) (t.kind === "action" ? Ci : wi).push({
+		let e = $.child("agent"), t = x.filter((e) => An.test(e));
+		t.length > 0 && await On(t, e);
+		let n = await kn(Ti, e);
+		for (let e of n.agents) for (let t of Gt(e)) (t.kind === "action" ? Ci : wi).push({
 			file: t.file,
 			descriptor: t.descriptor,
 			executor: t.executor
 		});
 		n.agents.length > 0 && e.info("synthesized agent routes", { agents: n.agents.map((e) => e.descriptor.name) });
 	}
-	u.mark("workflow");
+	f.mark("workflow");
 	let K = () => {
 		let e = q.workflowWriteActions();
 		if (e === void 0) throw Error("workflow actions: this app registers no workflows");
 		return e;
-	}, Ei = Sr({
-		dialect: v,
-		...j()
-	}), Di = v === "memory" ? void 0 : (await vn(v)).makeSqlLayer(j()), Oi = async () => Wt({
+	}, Ei = Cr({
+		dialect: y,
+		...A()
+	}), Di = y === "memory" ? void 0 : (await xn(y)).makeSqlLayer(A()), Oi = async () => E({
 		sqlLayer: Di,
 		declared: w,
 		log: $
 	}), Ai = {
 		kind: "api",
 		meta: {
-			name: h?.name ?? "voltro-api",
-			voltroVersion: Bt,
-			port: ce,
-			mode: Dr(),
-			store: v,
-			cdc: ge ? "on" : "off",
+			name: _?.name ?? "voltro-api",
+			voltroVersion: j,
+			port: he,
+			mode: Or(),
+			store: y,
+			cdc: Oe ? "on" : "off",
 			...Ei === void 0 ? {} : { databaseId: Ei }
 		},
-		rpc: yt(S, f),
-		workflows: xe(S, f),
+		rpc: xe(S, p),
+		workflows: we(S, p),
 		migrations: Oi,
 		events: () => q.eventsSnapshot(),
 		agentTools: () => q.agentTools(),
 		invariantChecks: () => ({
 			mode: "serve",
-			accessGate: Ee,
-			config: h,
+			accessGate: Ve,
+			config: _,
 			serverOnlyLeaks: S.serverOnlyLeaks,
 			migrations: Oi
 		}),
 		members: () => q.membersSnapshot(),
 		inspectFireSchedule: async ({ name: e, trigger: t }) => {
-			if (!Wr) throw Error("scheduler not started — this app registers no self-triggered schedules (all schedules are trigger:'external', or there are none).");
-			return { runId: await Wr.fireNow(e, t) ?? null };
+			if (!Gr) throw Error("scheduler not started — this app registers no self-triggered schedules (all schedules are trigger:'external', or there are none).");
+			return { runId: await Gr.fireNow(e, t) ?? null };
 		},
-		inspectBackfillSchedule: we({
-			getHandle: () => Wr,
-			getSchedules: () => Fr
+		inspectBackfillSchedule: O({
+			getHandle: () => Gr,
+			getSchedules: () => Ir
 		}),
-		...ze === void 0 ? {} : { webhooks: () => d({
-			store: T,
-			discoveredWebhooks: ze
+		...Xe === void 0 ? {} : { webhooks: () => xt({
+			store: D,
+			discoveredWebhooks: Xe
 		}) },
 		plugins: () => ({
-			plugins: lr.snapshot(),
+			plugins: fr.snapshot(),
 			capturedAt: Date.now()
 		}),
-		env: () => an(h?.name ?? Zn(f), {
-			...h?.env !== void 0 && aa(h.env) ? { contract: h.env } : {},
-			plugins: h?.plugins ?? []
+		env: () => mn(_?.name ?? er(p), {
+			..._?.env !== void 0 && aa(_.env) ? { contract: _.env } : {},
+			plugins: _?.plugins ?? []
 		}),
-		dataCache: () => C({
-			stats: At,
-			backendKind: kt
+		dataCache: () => ne({
+			stats: Pt,
+			backendKind: Nt
 		}),
-		subscriptions: () => ne(() => mr),
-		fleetObservations: (e) => z.fleet(e),
-		peerAddress: (e) => z.addressOf(e),
-		inspectTables: () => We(w),
-		inspectRows: ue({
-			store: T,
+		subscriptions: () => Yt(() => R),
+		fleetObservations: (e) => I.fleet(e),
+		peerAddress: (e) => I.addressOf(e),
+		inspectTables: () => ue(w),
+		inspectRows: _e({
+			store: D,
 			tables: w,
 			mask: !0
 		}),
 		metrics: (e) => q.rpcMetrics().snapshot(e),
-		cluster: () => Xt({
-			store: T,
-			dialect: v,
-			useClusterCron: Hr,
-			scheduleCoordChoice: Vr
+		cluster: () => Fe({
+			store: D,
+			dialect: y,
+			useClusterCron: Ur,
+			scheduleCoordChoice: Hr
 		}),
-		inspectSchedules: () => re({
-			schedules: Fr,
-			defaultTrigger: Lr,
-			coordination: Ur
+		inspectSchedules: () => Ee({
+			schedules: Ir,
+			defaultTrigger: Rr,
+			coordination: Wr
 		}),
-		inspectScheduleRuns: (e) => ae(T, e),
-		...Ie(T, {
-			controls: Fe(S.workflows ?? []),
+		inspectScheduleRuns: (e) => ie(D, e),
+		...oe(D, {
+			controls: re(S.workflows ?? []),
 			active: (S.workflows?.length ?? 0) > 0,
 			cancellation: () => q.flowControlHealth()
 		}),
-		webhookActions: qt(() => q.webhooksService()),
+		webhookActions: Re(() => q.webhooksService()),
 		inspectStartWorkflow: (e) => K().inspectStartWorkflow(e),
 		inspectCancelWorkflowRun: (e) => K().inspectCancelWorkflowRun(e),
 		inspectSuspendWorkflowRun: (e) => K().inspectSuspendWorkflowRun(e),
@@ -2348,13 +2349,13 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 		inspectRetryWorkflowRun: (e) => K().inspectRetryWorkflowRun(e),
 		inspectSignalWorkflowRun: (e) => K().inspectSignalWorkflowRun(e),
 		inspectUpdateWorkflowRun: (e) => K().inspectUpdateWorkflowRun(e),
-		inspectInferences: (e) => rt({
-			store: T,
+		inspectInferences: (e) => M({
+			store: D,
 			active: (S.workflows?.length ?? 0) > 0,
 			dispatcher: () => q.inferenceHealth()
 		}, e.limit === void 0 ? {} : { limit: e.limit }),
-		...P({
-			store: T,
+		...Le({
+			store: D,
 			cancelRun: async (e) => await q.runCanceller()?.(e) ?? !1,
 			retryRun: async (e) => K().inspectRetryWorkflowRun({ runId: e }),
 			redriveRun: async (e) => q.redriveWorkflowRun({ runId: e }),
@@ -2362,22 +2363,22 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 		}),
 		inspectRedriveWorkflowRun: (e) => q.redriveWorkflowRun(e),
 		inspectResumeWorkflowRunFromStep: (e) => q.resumeWorkflowRunFromStep(e)
-	}, Mi = (process.env.VOLTRO_TENANT_ISOLATION ?? h?.tenancy?.isolation) === "namespace", Ni = Mi && v !== "memory" ? await (async () => {
-		let e = await vn(v);
-		return Zt({
+	}, Mi = (process.env.VOLTRO_TENANT_ISOLATION ?? _?.tenancy?.isolation) === "namespace", Ni = Mi && y !== "memory" ? await (async () => {
+		let e = await xn(y);
+		return Ie({
 			tables: w,
-			sqlLayer: e.makeSqlLayer(j()),
-			dialect: v,
+			sqlLayer: e.makeSqlLayer(A()),
+			dialect: y,
 			options: { retryFilter: e.retryFilter },
 			log: {
 				info: (e, t) => $.info(e, t),
 				error: (e, t, n) => $.error(e, t ?? {}, n)
 			}
 		});
-	})() : void 0, Fi = await D({
-		input: h?.tenancy?.residency,
+	})() : void 0, Fi = await Qe({
+		input: _?.tenancy?.residency,
 		namespaceIsolationOn: Mi,
-		makeStoreForUrl: (e, t) => gt(h, void 0, yn(j(), t)),
+		makeStoreForUrl: (e, t) => tt(_, void 0, Sn(A(), t)),
 		log: {
 			info: (e, t) => $.info(e, t),
 			warn: (e, t) => $.warn(e, t)
@@ -2387,43 +2388,43 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 		await Fi.close();
 	});
 	let q = await Go({
-		bootTiming: u,
-		claimChange: or.claim,
-		broadcastNamespace: Xn,
+		bootTiming: f,
+		claimChange: lr.claim,
+		broadcastNamespace: $n,
 		scheduling: (() => {
-			let e = _n;
+			let e = bn;
 			return {
 				admissionDrainMs: e.admissionDrainMs,
 				inferenceTickMs: e.inferenceTickMs,
 				cancelSweepMs: e.cancelSweepMs,
 				stalenessSweepMs: e.stalenessSweepMs,
 				scheduleHeartbeatMs: e.scheduleHeartbeatMs,
-				disarmWhenIdle: Yt({
-					changeScope: T.changeScope,
-					broadcastAttached: gr !== void 0
+				disarmWhenIdle: Be({
+					changeScope: D.changeScope,
+					broadcastAttached: vr !== void 0
 				})
 			};
 		})(),
-		...h?.workflows?.staleness === void 0 ? {} : { workflowStaleness: h.workflows.staleness },
-		...h?.workflows?.suspendSignalHintMs === void 0 ? {} : { workflowSuspendSignalHintMs: h.workflows.suspendSignalHintMs },
-		workflowRecording: se(h?.workflows?.recording),
+		..._?.workflows?.staleness === void 0 ? {} : { workflowStaleness: _.workflows.staleness },
+		..._?.workflows?.suspendSignalHintMs === void 0 ? {} : { workflowSuspendSignalHintMs: _.workflows.suspendSignalHintMs },
+		workflowRecording: ae(_?.workflows?.recording),
 		membership: {
-			...I,
-			instanceId: Jn
+			...N,
+			instanceId: Zn
 		},
 		security: {
-			defaultDeny: Je(h),
-			...pe(h)
+			defaultDeny: Ye(_),
+			...Ue(_)
 		},
-		approvals: { defaultExpiryMs: k(h) },
-		...h?.plugins === void 0 ? {} : { plugins: h.plugins },
-		...N ? { idempotency: N } : {},
-		restRoutes: H,
-		...h?.grpc === void 0 ? {} : { grpc: {
-			config: h.grpc,
-			root: f
+		approvals: { defaultExpiryMs: C(_) },
+		..._?.plugins === void 0 ? {} : { plugins: _.plugins },
+		...Jt ? { idempotency: Jt } : {},
+		restRoutes: V,
+		..._?.grpc === void 0 ? {} : { grpc: {
+			config: _.grpc,
+			root: p
 		} },
-		appProcedures: Ee,
+		appProcedures: Ve,
 		discovered: {
 			wsGateways: S.wsGateways,
 			queries: [...S.queries, ...wi],
@@ -2434,7 +2435,7 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 			workflows: S.workflows,
 			workflowWorkers: S.workflowWorkers,
 			eventTriggers: S.eventTriggers,
-			schedules: Fr,
+			schedules: Ir,
 			subscribers: Jr,
 			outboxHandlers: li,
 			connections: S.connections,
@@ -2443,98 +2444,98 @@ var ka = /* @__PURE__ */ ((e) => typeof require < "u" ? require : typeof Proxy <
 			expectations: _i,
 			budgets: yi,
 			experiments: Si,
-			...ze === void 0 ? {} : { webhooks: ze }
+			...Xe === void 0 ? {} : { webhooks: Xe }
 		},
 		log: $,
-		analytics: $e.sink,
+		analytics: at.sink,
 		aggregateStorage: mi,
 		aggregateCoordinator: hi,
-		store: T,
-		kv: zt,
-		cache: St,
-		snapshotCache: mt,
-		...h?.reactive === void 0 ? {} : { reactive: h.reactive },
-		schemaRegistry: nt,
+		store: D,
+		kv: Vt,
+		cache: kt,
+		snapshotCache: Dt,
+		..._?.reactive === void 0 ? {} : { reactive: _.reactive },
+		schemaRegistry: lt,
 		tenantScopedTables: S.tenantScopedTables,
 		softDeleteScopedTables: S.softDeleteScopedTables,
-		dataTransferSnapshot: Ki(w, v),
-		dataTransferDialect: v,
+		dataTransferSnapshot: Ki(w, y),
+		dataTransferDialect: y,
 		...Ni === void 0 ? {} : { ensureTenantProvisioned: Ni.ensure },
 		...Fi === void 0 ? {} : { resolveResidentStore: Fi.resolveStore },
-		tenantIsolation: (process.env.VOLTRO_TENANT_ISOLATION ?? h?.tenancy?.isolation) === "namespace" ? "namespace" : "shared-schema",
-		resolveSubject: (e, t) => wr({
+		tenantIsolation: (process.env.VOLTRO_TENANT_ISOLATION ?? _?.tenancy?.isolation) === "namespace" ? "namespace" : "shared-schema",
+		resolveSubject: (e, t) => Tr({
 			headers: e,
 			clientId: t
 		}),
-		...h?.auth === void 0 ? {} : { authority: h.auth },
-		...h?.agents === void 0 ? {} : { agents: h.agents },
-		httpRoutes: F.flatMap((e) => e.httpRoutes ?? []),
-		getStore: () => at,
-		...Pr ? { baseLayer: Pr } : {},
+		..._?.auth === void 0 ? {} : { authority: _.auth },
+		..._?.agents === void 0 ? {} : { agents: _.agents },
+		httpRoutes: $t.flatMap((e) => e.httpRoutes ?? []),
+		getStore: () => St,
+		...Fr ? { baseLayer: Fr } : {},
 		...Kr === void 0 ? {} : { workflowEngineLayer: Kr },
-		scheduleDefaultTrigger: Lr,
-		scheduleCoordination: Ur,
-		scheduleArmSelf: !Hr,
-		dormancy: process.env.VOLTRO_DORMANCY === "sleep" || process.env.VOLTRO_DORMANCY === "always-on" ? process.env.VOLTRO_DORMANCY : h?.dormancy ?? "always-on",
-		scheduleReplicaId: Ar(),
+		scheduleDefaultTrigger: Rr,
+		scheduleCoordination: Wr,
+		scheduleArmSelf: !Ur,
+		dormancy: process.env.VOLTRO_DORMANCY === "sleep" || process.env.VOLTRO_DORMANCY === "always-on" ? process.env.VOLTRO_DORMANCY : _?.dormancy ?? "always-on",
+		scheduleReplicaId: jr(),
 		...W === void 0 ? {} : { scheduleFireInterceptor: W },
 		onSchedulerReady: (e) => {
-			Wr = e;
+			Gr = e;
 		},
-		inspectStream: He(rr),
-		inspectRoute: { handle: async (e, t, n, r) => R.logs.on && n === "GET" && (e === "/_voltro/inspect/logs" || e.startsWith("/_voltro/inspect/logs?")) ? un(e, sn(), t) : R.traces.on && n === "GET" && (e === "/_voltro/inspect/traces" || e.startsWith("/_voltro/inspect/traces?")) ? Ve(e, je()) : await xt(e, Ai, t, {
+		inspectStream: pe(or),
+		inspectRoute: { handle: async (e, t, n, r) => F.logs.on && n === "GET" && (e === "/_voltro/inspect/logs" || e.startsWith("/_voltro/inspect/logs?")) ? dn(e, fn(), t) : F.traces.on && n === "GET" && (e === "/_voltro/inspect/traces" || e.startsWith("/_voltro/inspect/traces?")) ? fe(e, rn()) : await d(e, Ai, t, {
 			method: n,
 			...r === void 0 ? {} : { body: r },
-			...ir()
-		}) || ((n === "GET" ? await pn(e, Ai, t, {
+			...sr()
+		}) || ((n === "GET" ? await gn(e, Ai, t, {
 			method: n,
-			...ir()
-		}) : null) ?? fn(e, Ai, t, {
+			...sr()
+		}) : null) ?? hn(e, Ai, t, {
 			method: n,
 			...r === void 0 ? {} : { body: r },
-			...ir()
+			...sr()
 		}) ?? {
 			status: 404,
 			contentType: "application/json",
 			body: JSON.stringify({ error: "not an inspect route" })
 		}) },
-		...h?.name === void 0 ? {} : { appName: h.name },
-		observability: ur,
-		...h?.health === void 0 ? {} : { health: h.health },
-		...pr === void 0 ? {} : { traceSink: pr },
-		port: ce,
-		...h?.transport?.wsPath ? { path: h.transport.wsPath } : {},
-		...h?.http === void 0 ? {} : { http: h.http }
+		..._?.name === void 0 ? {} : { appName: _.name },
+		observability: pr,
+		..._?.health === void 0 ? {} : { health: _.health },
+		...gr === void 0 ? {} : { traceSink: gr },
+		port: he,
+		..._?.transport?.wsPath ? { path: _.transport.wsPath } : {},
+		..._?.http === void 0 ? {} : { http: _.http }
 	});
-	mr = q.dispatcher;
+	R = q.dispatcher;
 	let Ii = () => {
-		rr.emit("subscriptions", ne(() => mr));
+		or.emit("subscriptions", Yt(() => R));
 	}, zi = q.dispatcher.onSubscriptionsChange(Ii);
-	return Ii(), ee(tn([
+	return Ii(), We(te([
 		S.queries,
 		S.mutations,
 		S.actions,
 		S.streams
 	]), (e) => {
 		$.warn(e);
-	}), $.info(`API listening on :${ce}`, {
-		dialect: v,
+	}), $.info(`API listening on :${he}`, {
+		dialect: y,
 		queries: S.queries.length,
 		mutations: S.mutations.length,
 		actions: S.actions.length,
 		streams: S.streams.length,
 		workflows: S.workflows.length,
 		workflowWorkers: S.workflowWorkers.length,
-		schedules: Fr.length,
-		scheduleCoordination: Ur
-	}), u.finish($), G(async () => {
-		for (let e of Wn) e.stop();
-		Kt.stop(), zi(), z.stop();
+		schedules: Ir.length,
+		scheduleCoordination: Wr
+	}), f.finish($), G(async () => {
+		for (let e of qn) e.stop();
+		Zt.stop(), zi(), I.stop();
 		try {
-			await q.close(), Mt(), $t?.dispose(), await lr.deactivate(), await gr?.close(), await ut({
-				mirror: Ht,
+			await q.close(), Rt(), nn?.dispose(), await fr.deactivate(), await vr?.close(), await Ft({
+				mirror: Wt,
 				log: $
-			}), await $e.dispose(), await T.close?.();
+			}), await at.dispose(), await D.close?.();
 		} catch (e) {
 			console.error("serve: shutdown step failed, exiting anyway:", e);
 		}