@@ -0,0 +1,25 @@
+import { headers } from 'next/headers'
+import { getInternalApiBaseUrl } from '@/lib/core/utils/urls'
+
+/**
+ * Server-side GET against an internal `/api` route, forwarding the incoming
+ * request's cookie so the route authenticates as the current user.
+ *
+ * The legacy path. Reading the data layer and shaping the result through the
+ * route's response contract — as `files/prefetch.ts` does — is canonical: it
+ * drops a server-to-server request and its duplicate auth, and the contract
+ * parse is what guarantees the hydrated entry matches a client fetch. Prefetches
+ * still on this helper have not been converted; a converted one must prove the
+ * viewer itself, since the route's own authorization no longer runs.
+ */
+export async function prefetchInternalJson<T>(path: string): Promise<T> {
+  const cookie = (await headers()).get('cookie')
+  // boundary-raw-fetch: server-side RSC prefetch forwarding the session cookie to an internal API route; requestJson is client-only and cannot run here
+  const response = await fetch(`${getInternalApiBaseUrl()}${path}`, {
+    headers: cookie ? { cookie } : {},
+  })
+  if (!response.ok) {
+    throw new Error(`Prefetch failed for ${path}: ${response.status}`)
+  }
+  return response.json() as Promise<T>
+}
@@ -12,7 +12,7 @@ const {
   mockListFoldersForWorkspace,
   mockListInternalKnowledgeBases,
   mockListPinnedItemsForUser,
-  mockListTables,
+  mockPrefetchInternalJson,
   mockListWorkspaceFileFolders,
   mockListWorkspaceFilesWithShares,
 } = vi.hoisted(() => ({
@@ -23,7 +23,7 @@ const {
   mockListFoldersForWorkspace: vi.fn(),
   mockListInternalKnowledgeBases: vi.fn(),
   mockListPinnedItemsForUser: vi.fn(),
-  mockListTables: vi.fn(),
+  mockPrefetchInternalJson: vi.fn(),
   mockListWorkspaceFileFolders: vi.fn(),
   mockListWorkspaceFilesWithShares: vi.fn(),
 }))
@@ -46,22 +46,8 @@ vi.mock('@/lib/pinned-items/queries', () => ({
 vi.mock('@/lib/workspaces/permissions/utils', () => ({
   getWorkspaceMemberProfiles: mockGetWorkspaceMemberProfiles,
 }))
-/**
- * The barrel is mocked rather than `@/lib/table/wire`, so the prefetch's real
- * `toTableListItem` projection runs and the wire-shape assertions below are
- * meaningful rather than mocked away.
- */
-vi.mock('@/lib/table', () => ({
-  listTables: mockListTables,
-}))
-/**
- * `typeMetadataOf` is the one leaf of the real wire projection that reaches the
- * column-type registry, and through it every type module's icon and editor. Stub
- * that leaf only, so `toTableListItem`'s timestamp, `metadata`, and job
- * normalization stay under test rather than being mocked away wholesale.
- */
-vi.mock('@/lib/table/column-types', () => ({
-  typeMetadataOf: () => ({}),
+vi.mock('@/app/workspace/[workspaceId]/lib/prefetch-internal-fetch', () => ({
+  prefetchInternalJson: mockPrefetchInternalJson,
 }))
 vi.mock('@/lib/api/server/routes', () => ({
   internalSessionAuth: { authenticate: mockAuthenticate },
@@ -104,7 +90,7 @@ describe('workspace list prefetches', () => {
     mockListWorkspaceFileFolders.mockResolvedValue([])
     mockListPinnedItemsForUser.mockResolvedValue([])
     mockGetWorkspaceMemberProfiles.mockResolvedValue([])
-    mockListTables.mockResolvedValue([])
+    mockPrefetchInternalJson.mockResolvedValue({ data: { tables: [] } })
     mockAuthenticate.mockResolvedValue({ kind: 'session', userId: USER_ID, sessionId: 'sess-1' })
     mockListInternalKnowledgeBases.mockResolvedValue({ knowledgeBases: [] })
     mockKnowledgePresenterList.mockReturnValue({ success: true, data: [] })
@@ -197,73 +183,24 @@ describe('workspace list prefetches', () => {
   })
 
   describe('prefetchTables', () => {
-    const TABLE_ROW = {
-      id: 't-1',
-      name: 'people',
-      description: null,
-      schema: { columns: [{ id: 'c1', name: 'name', type: 'string' }] },
-      metadata: { columnWidths: { c1: 120 } },
-      rowCount: 3,
-      maxRows: 10_000,
-      workspaceId: WORKSPACE_ID,
-      folderId: null,
-      createdBy: 'u-1',
-      locks: {
-        schemaLocked: false,
-        insertLocked: false,
-        updateLocked: false,
-        deleteLocked: false,
-      },
-      archivedAt: null,
-      createdAt: new Date('2026-01-01T00:00:00.000Z'),
-      updatedAt: new Date('2026-01-02T00:00:00.000Z'),
-    }
-
-    it('reads tables from the data layer rather than over the wire', async () => {
-      mockListTables.mockResolvedValue([TABLE_ROW])
-      const client = makeClient()
-
-      await prefetchTables(client, WORKSPACE_ID, USER_ID)
-
-      expect(mockListTables).toHaveBeenCalledWith(WORKSPACE_ID, { scope: 'active' })
-    })
-
     /**
-     * `listTablesContract`'s response schema is a passthrough `z.custom`, so a client fetch
-     * caches the route's JSON verbatim. Seeding the raw data-layer row would put `Date`s and
-     * the server-only `metadata` field under a key the hook never sees them on.
+     * The tables list is the one read on this page still served over HTTP: `listTables` lives in
+     * a module graph that reaches the executable tool registry, which
+     * `check:tool-registry-boundary` refuses to let into a page graph.
      */
-    it('seeds the wire shape a client fetch caches, not the raw data-layer row', async () => {
-      mockListTables.mockResolvedValue([TABLE_ROW])
-      const client = makeClient()
-
-      await prefetchTables(client, WORKSPACE_ID, USER_ID)
-
-      const [cached] = client.getQueryData(tableKeys.list(WORKSPACE_ID, 'active')) as Array<
-        Record<string, unknown>
-      >
-      expect(cached.createdAt).toBe('2026-01-01T00:00:00.000Z')
-      expect(cached.updatedAt).toBe('2026-01-02T00:00:00.000Z')
-      expect(cached.archivedAt).toBeNull()
-      expect(cached).not.toHaveProperty('metadata')
-      expect(cached.schema).toEqual({
-        columns: [{ id: 'c1', name: 'name', type: 'string', required: false, unique: false }],
-      })
-      expect(cached.jobStatus).toBeNull()
-      expect(cached.jobRowsProcessed).toBe(0)
-    })
-
-    it('caches no tables when the viewer cannot be proved', async () => {
-      mockGetWorkspaceHostContextForViewer.mockResolvedValue(null)
+    it('primes the exact key useTablesList reads and unwraps data.tables', async () => {
+      const tables = [{ id: 't-1' }]
+      mockPrefetchInternalJson.mockResolvedValue({ data: { tables } })
       const client = makeClient()
 
       await prefetchTables(client, WORKSPACE_ID, USER_ID)
 
-      expect(mockListTables).not.toHaveBeenCalled()
-      expect(client.getQueryData(tableKeys.list(WORKSPACE_ID, 'active'))).toBeUndefined()
+      expect(mockPrefetchInternalJson).toHaveBeenCalledWith(
+        `/api/table?workspaceId=${WORKSPACE_ID}&scope=active`
+      )
+      expect(client.getQueryData(tableKeys.list(WORKSPACE_ID, 'active'))).toEqual(tables)
     })
   })
-
   describe('prefetchFilesBrowser', () => {
     it('primes the folder key the client hook reads', async () => {
       const folders = [{ id: 'folder-1' }]
@@ -398,7 +335,7 @@ describe('workspace list prefetches', () => {
         const boom = new Error('500')
         mockListWorkspaceFilesWithShares.mockRejectedValue(boom)
         mockListFoldersForWorkspace.mockRejectedValue(boom)
-        mockListTables.mockRejectedValue(boom)
+        mockPrefetchInternalJson.mockRejectedValue(boom)
         mockListInternalKnowledgeBases.mockRejectedValue(boom)
         mockListPinnedItemsForUser.mockRejectedValue(boom)
         mockGetWorkspaceMemberProfiles.mockRejectedValue(boom)
 
@@ -1,7 +1,6 @@
 import type { QueryClient } from '@tanstack/react-query'
-import { listTables } from '@/lib/table'
-import { toTableListItem } from '@/lib/table/wire'
-import { getWorkspaceHostContextForViewer } from '@/lib/workspaces/host-context'
+import type { TableDefinition } from '@/lib/table/types'
+import { prefetchInternalJson } from '@/app/workspace/[workspaceId]/lib/prefetch-internal-fetch'
 import { prefetchResourceFolders } from '@/app/workspace/[workspaceId]/lib/prefetch-resource-folders'
 import { prefetchResourceListChrome } from '@/app/workspace/[workspaceId]/lib/prefetch-resource-list-chrome'
 import { TABLE_LIST_STALE_TIME, tableKeys } from '@/hooks/queries/utils/table-keys'
@@ -14,36 +13,30 @@ import { TABLE_LIST_STALE_TIME, tableKeys } from '@/hooks/queries/utils/table-ke
  * only placed correctly relative to the folder rows it sits beside, so
  * prefetching one without the other still flashes an ungrouped list.
  *
- * Both read the data layer directly, with no internal HTTP hop. Folders are
- * mapped with the same `mapFolder` the hook applies, matching the workspace
- * sidebar prefetch. Tables go through {@link toTableListItem}, the projection
- * `GET /api/table` itself returns — table definitions carry `Date` fields whose
- * *serialized* form is what the client caches, and the list contract's response
- * schema is a passthrough that neither coerces nor strips, so seeding raw rows
- * would put `Date` objects under a key a client fetch fills with ISO strings.
+ * The tables list is the one read on this page still served over HTTP rather than from the data
+ * layer, and deliberately so. `listTables` lives in `lib/table/service`, whose module graph
+ * reaches `workflow-columns` — by several independent paths, including `jobs/service` and
+ * `rows/service` — and through it the executor and the executable tool registry. Importing it
+ * here put ~4,700 modules into this page's server graph, which `check:tool-registry-boundary`
+ * catches. Converting this read means untangling `lib/table`'s internals first; until then the
+ * route stays the cheaper option. See {@link prefetchInternalJson}.
  *
- * Neither read carries authorization of its own, so the viewer is proved first.
- * `getWorkspaceHostContextForViewer` resolves the same effective workspace
- * permission the route's own check does (both bottom out in
- * `checkWorkspaceAccess`), and it is `cache`d and already resolved by the layout
- * for this request, so it costs no additional queries. A viewer without access
- * caches nothing and the client fetch reaches the route for the real 403.
+ * Folders and the chrome reads both go through the data layer and prove the viewer themselves,
+ * so an unproven viewer caches nothing and their client fetch reaches the route for the real 403.
  */
 export async function prefetchTables(
   queryClient: QueryClient,
   workspaceId: string,
   userId: string | undefined
 ): Promise<void> {
-  if (!userId) return
-  const hostContext = await getWorkspaceHostContextForViewer(workspaceId, userId)
-  if (!hostContext) return
-
   await Promise.all([
     queryClient.prefetchQuery({
       queryKey: tableKeys.list(workspaceId, 'active'),
       queryFn: async () => {
-        const tables = await listTables(workspaceId, { scope: 'active' })
-        return tables.map(toTableListItem)
+        const response = await prefetchInternalJson<{ data: { tables: TableDefinition[] } }>(
+          `/api/table?workspaceId=${workspaceId}&scope=active`
+        )
+        return response.data.tables
       },
       staleTime: TABLE_LIST_STALE_TIME,
     }),
 
@@ -55,7 +55,7 @@ import {
   UNLOCKED_TABLE_LOCKS,
 } from '@/lib/table/types'
 import { validateTableName, validateTableSchema } from '@/lib/table/validation'
-import { stripGroupDeps } from '@/lib/table/workflow-columns'
+import { stripGroupDeps } from '@/lib/table/workflow-group-deps'
 
 const logger = createLogger('TableService')
 
 
@@ -41,6 +41,7 @@ import type {
   TableSchema,
   WorkflowGroup,
 } from '@/lib/table/types'
+import { stripGroupDeps } from '@/lib/table/workflow-group-deps'
 
 const logger = createLogger('WorkflowGroupScheduler')
 
@@ -1082,23 +1083,6 @@ export async function runWorkflowColumn(opts: {
  * doesn't see an empty object. Returns the same group reference when nothing
  * changed.
  */
-export function stripGroupDeps(group: WorkflowGroup, removed: ReadonlySet<string>): WorkflowGroup {
-  const cols = group.dependencies?.columns ?? []
-  const mappings = group.inputMappings ?? []
-  const filteredDeps = cols.filter((d) => !removed.has(d))
-  const filteredMappings = mappings.filter((m) => !removed.has(m.columnName))
-  const depsChanged = filteredDeps.length !== cols.length
-  const mappingsChanged = filteredMappings.length !== mappings.length
-  if (!depsChanged && !mappingsChanged) return group
-  const next: WorkflowGroup = { ...group }
-  if (depsChanged) {
-    next.dependencies = filteredDeps.length > 0 ? { columns: filteredDeps } : undefined
-  }
-  if (mappingsChanged) {
-    next.inputMappings = filteredMappings.length > 0 ? filteredMappings : undefined
-  }
-  return next
-}
 
 /**
  * Validates schema-level invariants. Run on every `addTableColumn`,
@@ -1365,3 +1349,5 @@ export function assertValidSchema(schema: TableSchema, columnOrder: string[] | u
     throw new OrchestrationError('validation', `Schema validation failed: ${errs.join('; ')}`)
   }
 }
+
+export { stripGroupDeps }
@@ -0,0 +1,29 @@
+import type { WorkflowGroup } from '@/lib/table/types'
+
+/**
+ * Drops the given column ids from a workflow group's dependencies and input
+ * mappings, returning the group unchanged when neither referenced them.
+ *
+ * A pure projection over the group, deliberately kept in its own leaf module
+ * rather than alongside the group runtime in `workflow-columns`: that module
+ * reaches the executor and, through it, the executable tool registry, so any
+ * server graph importing this helper from there pays ~4,700 modules for a
+ * function that only reshapes an object.
+ */
+export function stripGroupDeps(group: WorkflowGroup, removed: ReadonlySet<string>): WorkflowGroup {
+  const cols = group.dependencies?.columns ?? []
+  const mappings = group.inputMappings ?? []
+  const filteredDeps = cols.filter((d) => !removed.has(d))
+  const filteredMappings = mappings.filter((m) => !removed.has(m.columnName))
+  const depsChanged = filteredDeps.length !== cols.length
+  const mappingsChanged = filteredMappings.length !== mappings.length
+  if (!depsChanged && !mappingsChanged) return group
+  const next: WorkflowGroup = { ...group }
+  if (depsChanged) {
+    next.dependencies = filteredDeps.length > 0 ? { columns: filteredDeps } : undefined
+  }
+  if (mappingsChanged) {
+    next.inputMappings = filteredMappings.length > 0 ? filteredMappings : undefined
+  }
+  return next
+}