@rivetkit/supabase 2.3.20 → 2.3.21

package/dist/mod.js

@@ -335,6 +335,202 @@ __export(mod_exports, {
 module.exports = __toCommonJS(mod_exports);
 var wasmBindings = __toESM(require("@rivetkit/rivetkit-wasm"));
 
+// ../rivetkit/dist/tsup/chunk-P2OFXH4G.js
+var INTERNAL_ERROR_CODE = "internal_error";
+var INTERNAL_ERROR_DESCRIPTION = "An internal error occurred";
+var USER_ERROR_CODE = "user_error";
+var BRIDGE_RIVET_ERROR_PREFIX = "__RIVET_ERROR_JSON__:";
+function looksLikeRivetErrorOptions(value) {
+  return typeof value === "object" && value !== null && ("public" in value || "metadata" in value || "rayId" in value || "statusCode" in value || "actor" in value || "cause" in value);
+}
+function isTypedErrorTag(value) {
+  return value === "ActorError" || value === "RivetError";
+}
+function errorMessage(error46, fallback = String(error46)) {
+  if (error46 && typeof error46 === "object" && "message" in error46 && typeof error46.message === "string") {
+    return error46.message;
+  }
+  return fallback;
+}
+function isRivetErrorLike(error46) {
+  return typeof error46 === "object" && error46 !== null && "group" in error46 && typeof error46.group === "string" && "code" in error46 && typeof error46.code === "string" && "message" in error46 && typeof error46.message === "string" && (!("rayId" in error46) || error46.rayId === void 0 || typeof error46.rayId === "string") && (!("__type" in error46) || isTypedErrorTag(error46.__type));
+}
+function isActorAbortedError(error46) {
+  return isRivetErrorLike(error46) && error46.group === "actor" && error46.code === "aborted";
+}
+function isActorSpecifier(value) {
+  return typeof value === "object" && value !== null && "actorId" in value && typeof value.actorId === "string" && "generation" in value && typeof value.generation === "number" && (!("key" in value) || value.key === void 0 || typeof value.key === "string");
+}
+var RivetError = class extends Error {
+  __type = "RivetError";
+  public;
+  metadata;
+  rayId;
+  statusCode;
+  actor;
+  group;
+  code;
+  static isRivetError(error46) {
+    return isRivetErrorLike(error46);
+  }
+  static isActorError(error46) {
+    return isRivetErrorLike(error46);
+  }
+  constructor(group, code, message, options) {
+    const normalized = looksLikeRivetErrorOptions(options) ? options : { metadata: options };
+    super(message, { cause: normalized.cause });
+    this.name = "RivetError";
+    this.group = group;
+    this.code = code;
+    this.public = normalized.public ?? false;
+    this.metadata = normalized.metadata;
+    this.rayId = normalized.rayId ?? void 0;
+    this.statusCode = normalized.statusCode ?? (this.public ? 400 : 500);
+    this.actor = normalized.actor;
+  }
+  toString() {
+    return this.message;
+  }
+};
+var UserError = class extends RivetError {
+  constructor(message, options) {
+    super("user", (options == null ? void 0 : options.code) ?? USER_ERROR_CODE, message, {
+      public: true,
+      metadata: options == null ? void 0 : options.metadata,
+      cause: options == null ? void 0 : options.cause
+    });
+  }
+};
+function toRivetError(error46, fallback) {
+  if (typeof error46 === "string") {
+    const bridged = decodeBridgeRivetError(error46);
+    if (bridged) {
+      return bridged;
+    }
+  }
+  if (error46 instanceof Error) {
+    const bridged = decodeBridgeRivetError(error46.message);
+    if (bridged) {
+      return bridged;
+    }
+  }
+  if (isRivetErrorLike(error46)) {
+    return new RivetError(error46.group, error46.code, error46.message, {
+      public: error46.public,
+      statusCode: error46.statusCode,
+      metadata: error46.metadata,
+      rayId: error46.rayId,
+      actor: error46.actor,
+      cause: error46 instanceof Error ? error46.cause : void 0
+    });
+  }
+  return new RivetError(
+    (fallback == null ? void 0 : fallback.group) ?? "actor",
+    (fallback == null ? void 0 : fallback.code) ?? INTERNAL_ERROR_CODE,
+    errorMessage(error46, (fallback == null ? void 0 : fallback.message) ?? "Unknown error"),
+    {
+      public: fallback == null ? void 0 : fallback.public,
+      statusCode: fallback == null ? void 0 : fallback.statusCode,
+      metadata: fallback == null ? void 0 : fallback.metadata,
+      rayId: fallback == null ? void 0 : fallback.rayId,
+      actor: fallback == null ? void 0 : fallback.actor,
+      cause: error46 instanceof Error ? error46 : void 0
+    }
+  );
+}
+function encodeBridgeRivetError(error46) {
+  return `${BRIDGE_RIVET_ERROR_PREFIX}${JSON.stringify({
+    group: error46.group,
+    code: error46.code,
+    message: error46.message,
+    metadata: error46.metadata,
+    rayId: error46.rayId,
+    public: error46.public,
+    statusCode: error46.statusCode,
+    actor: error46.actor
+  })}`;
+}
+function encodeErrorForBridge(error46) {
+  if (isCanonicalStructuredRivetError(error46)) {
+    return encodeBridgeRivetError(error46);
+  }
+  return String(error46);
+}
+function isCanonicalStructuredRivetError(error46) {
+  return error46 instanceof RivetError || typeof error46 === "object" && error46 !== null && "__type" in error46 && error46.__type === "RivetError" && "group" in error46 && typeof error46.group === "string" && "code" in error46 && typeof error46.code === "string" && "message" in error46 && typeof error46.message === "string";
+}
+function decodeBridgeRivetErrorPayload(value) {
+  if (!value.startsWith(BRIDGE_RIVET_ERROR_PREFIX)) {
+    return void 0;
+  }
+  try {
+    const raw = JSON.parse(
+      value.slice(BRIDGE_RIVET_ERROR_PREFIX.length)
+    );
+    const payload = {
+      ...raw,
+      rayId: raw.rayId ?? void 0
+    };
+    if (!isRivetErrorLike(payload)) {
+      return void 0;
+    }
+    if (payload.actor !== void 0 && payload.actor !== null && !isActorSpecifier(payload.actor)) {
+      return void 0;
+    }
+    return payload;
+  } catch {
+    return void 0;
+  }
+}
+function decodeBridgeRivetError(value) {
+  const payload = decodeBridgeRivetErrorPayload(value);
+  if (!payload) {
+    return void 0;
+  }
+  return new RivetError(payload.group, payload.code, payload.message, {
+    metadata: payload.metadata,
+    rayId: payload.rayId,
+    public: payload.public,
+    statusCode: payload.statusCode,
+    actor: payload.actor ?? void 0
+  });
+}
+function invalidRequest(error46) {
+  return new RivetError(
+    "request",
+    "invalid",
+    `Invalid request: ${errorMessage(error46, String(error46))}`,
+    {
+      public: true,
+      cause: error46 instanceof Error ? error46 : void 0
+    }
+  );
+}
+function actorNotFound(identifier) {
+  return new RivetError(
+    "actor",
+    "not_found",
+    identifier ? `Actor not found: ${identifier} (https://www.rivet.dev/docs/clients/javascript)` : "Actor not found (https://www.rivet.dev/docs/clients/javascript)",
+    { public: true }
+  );
+}
+function forbiddenError() {
+  return new RivetError("auth", "forbidden", "Forbidden", {
+    public: true,
+    statusCode: 403
+  });
+}
+function unsupportedFeature(feature) {
+  return new RivetError(
+    "feature",
+    "unsupported",
+    `Unsupported feature: ${feature}`
+  );
+}
+
+// ../rivetkit/dist/tsup/chunk-RGIZNZYO.js
+var import_pino = require("pino");
+
 // ../../../node_modules/.pnpm/zod@4.1.13/node_modules/zod/v4/classic/external.js
 var external_exports = {};
 __export(external_exports, {
@@ -13005,867 +13201,178 @@ var classic_default = external_exports;
 // ../../../node_modules/.pnpm/zod@4.1.13/node_modules/zod/v4/index.js
 var v4_default = classic_default;
 
-// ../rivetkit/dist/tsup/chunk-CSOHAAZK.js
-function flattenActionHandlers(actions) {
-  const flattened = /* @__PURE__ */ Object.create(null);
-  for (const { name, handler } of collectActionEntries(actions)) {
-    flattened[name] = handler;
+// ../rivetkit/dist/tsup/chunk-RGIZNZYO.js
+var cbor = __toESM(require("cbor-x"), 1);
+var import_invariant = __toESM(require_invariant(), 1);
+var getRivetEngine = () => getEnvUniversal("RIVET_ENGINE");
+var getRivetEndpoint = () => getEnvUniversal("RIVET_ENDPOINT");
+var getRivetToken = () => getEnvUniversal("RIVET_TOKEN");
+var getRivetNamespace = () => getEnvUniversal("RIVET_NAMESPACE");
+var getRivetPool = () => getEnvUniversal("RIVET_POOL");
+var getRivetTotalSlots = () => {
+  const value = getEnvUniversal("RIVET_TOTAL_SLOTS");
+  return value !== void 0 ? parseInt(value, 10) : void 0;
+};
+var getRivetRunEngine = () => getEnvUniversal("RIVET_RUN_ENGINE") === "1";
+var getRivetRunEngineHost = () => getEnvUniversal("RIVET_RUN_ENGINE_HOST");
+var getRivetRunEnginePort = () => {
+  const value = getEnvUniversal("RIVET_RUN_ENGINE_PORT");
+  return value !== void 0 ? parseInt(value, 10) : void 0;
+};
+var getRivetRunEngineVersion = () => getEnvUniversal("RIVET_RUN_ENGINE_VERSION");
+var getRivetRunServices = () => {
+  const value = getEnvUniversal("RIVET_RUN_SERVICES");
+  return value === void 0 ? void 0 : value === "1";
+};
+var getRivetEnvoyVersion = () => {
+  const value = getEnvUniversal("RIVET_ENVOY_VERSION");
+  return value !== void 0 ? parseInt(value, 10) : void 0;
+};
+var getRivetPublicEndpoint = () => getEnvUniversal("RIVET_PUBLIC_ENDPOINT");
+var getRivetPublicToken = () => getEnvUniversal("RIVET_PUBLIC_TOKEN");
+var getRivetkitRuntime = () => getEnvUniversal("RIVETKIT_RUNTIME");
+var getRivetkitRuntimeMode = () => {
+  const value = getEnvUniversal("RIVETKIT_RUNTIME_MODE");
+  if (value === void 0) return "envoy";
+  if (value === "envoy" || value === "serverless") return value;
+  throw new Error(
+    `RIVETKIT_RUNTIME_MODE env var must be "envoy" or "serverless"; got "${value}"`
+  );
+};
+var getRivetkitPublicDir = () => {
+  const value = getEnvUniversal("RIVETKIT_PUBLIC_DIR");
+  return value === void 0 || value === "" ? void 0 : value;
+};
+function parsePortEnv(raw) {
+  if (raw === void 0 || raw === "") return void 0;
+  const parsed = Number.parseInt(raw, 10);
+  if (!Number.isFinite(parsed) || parsed < 1 || parsed > 65535 || String(parsed) !== raw.trim()) {
+    throw new Error(
+      `RIVET_PORT env var must be an integer between 1 and 65535; got "${raw}"`
+    );
   }
-  return flattened;
+  return parsed;
 }
-function flattenActionInputSchemas(actions, schemas) {
-  if (schemas === void 0) return void 0;
-  if (!isRecord(schemas)) {
-    throw new TypeError("actionInputSchemas must be an object");
-  }
-  const flattened = /* @__PURE__ */ Object.create(null);
-  for (const { name, path: path2 } of collectActionEntries(actions)) {
-    const nestedSchema = lookupNestedSchema(schemas, path2);
-    const flatSchema = schemas[name];
-    if (nestedSchema !== void 0 && flatSchema !== void 0 && nestedSchema !== flatSchema) {
-      throw new TypeError(
-        `Action input schema \`${name}\` is defined by both a nested path and a dotted key`
-      );
-    }
-    const schema = nestedSchema ?? flatSchema;
-    if (schema !== void 0) {
-      flattened[name] = schema;
-    }
-  }
-  return flattened;
+var getLogLevel = () => getEnvUniversal("RIVET_LOG_LEVEL") ?? getEnvUniversal("LOG_LEVEL");
+var getLogTarget = () => getEnvUniversal("RIVET_LOG_TARGET") === "1";
+var getLogTimestamp = () => getEnvUniversal("RIVET_LOG_TIMESTAMP") === "1";
+var getLogMessage = () => getEnvUniversal("RIVET_LOG_MESSAGE") === "1";
+var getLogErrorStack = () => getEnvUniversal("RIVET_LOG_ERROR_STACK") === "1";
+var getNodeEnv = () => getEnvUniversal("NODE_ENV");
+var getNextPhase = () => getEnvUniversal("NEXT_PHASE");
+var isDev = () => getNodeEnv() !== "production";
+function assertUnreachable(x) {
+  throw new Error(`Unreachable case: ${x}`);
 }
-function flattenActionTraceSamplers(actions, rates = {}) {
-  const handlers = flattenActionHandlers(actions);
-  const flattened = Object.fromEntries(flattenSampleRates(rates, []));
-  for (const name of Object.keys(flattened)) {
-    if (!Object.hasOwn(handlers, name)) {
-      throw new TypeError(
-        `tracing.actions.${name} does not name an action`
-      );
+function deconstructError(error46, exposeInternalError = false) {
+  let statusCode;
+  let public_;
+  let group;
+  let code;
+  let message;
+  let metadata;
+  let rayId;
+  let actor2;
+  if (isCanonicalStructuredRivetError(error46)) {
+    statusCode = typeof error46.statusCode === "number" ? error46.statusCode : error46.public ? 400 : 500;
+    public_ = error46.public ?? false;
+    group = error46.group;
+    code = error46.code;
+    message = error46.message;
+    metadata = error46.metadata;
+    rayId = error46.rayId;
+    actor2 = error46.actor;
+  } else if (RivetError.isActorError(error46) && error46.public) {
+    statusCode = "statusCode" in error46 && error46.statusCode ? error46.statusCode : 400;
+    public_ = true;
+    group = error46.group;
+    code = error46.code;
+    message = getErrorMessage(error46);
+    metadata = error46.metadata;
+    rayId = error46.rayId;
+    actor2 = error46.actor;
+  } else if (exposeInternalError) {
+    if (RivetError.isActorError(error46)) {
+      statusCode = 500;
+      public_ = false;
+      group = error46.group;
+      code = error46.code;
+      message = getErrorMessage(error46);
+      metadata = error46.metadata;
+      rayId = error46.rayId;
+      actor2 = error46.actor;
+    } else {
+      statusCode = 500;
+      public_ = false;
+      group = "rivetkit";
+      code = INTERNAL_ERROR_CODE;
+      message = getErrorMessage(error46);
     }
-  }
-  return flattened;
-}
-function flattenSampleRates(rates, path2) {
-  return Object.entries(rates).flatMap(
-    ([segment, rate]) => {
-      const childPath = [...path2, segment];
-      return typeof rate === "number" ? [[childPath.join("."), rate]] : flattenSampleRates(rate, childPath);
+  } else {
+    statusCode = 500;
+    public_ = false;
+    group = "rivetkit";
+    code = INTERNAL_ERROR_CODE;
+    message = INTERNAL_ERROR_DESCRIPTION;
+    if (RivetError.isActorError(error46)) {
+      actor2 = error46.actor;
     }
-  );
-}
-function collectActionEntries(actions) {
-  const entries = [];
-  const names = /* @__PURE__ */ new Set();
-  visitActionGroup(actions ?? {}, [], entries, names);
-  return entries;
-}
-function visitActionGroup(value, path2, entries, names) {
-  if (!isRecord(value)) {
-    throw new TypeError(
-      `${formatActionPath(path2)} must be an action handler or group`
-    );
+    metadata = {
+      //url: `https://dashboard.rivet.dev/projects/${actorMetadata.project.slug}/environments/${actorMetadata.environment.slug}/actors?actorId=${actorMetadata.actor.id}`,
+    };
   }
-  for (const [segment, child] of Object.entries(value)) {
-    const childPath = [...path2, segment];
-    if (typeof child === "function") {
-      const name = childPath.join(".");
-      if (names.has(name)) {
-        throw new TypeError(
-          `Multiple action definitions flatten to \`${name}\``
-        );
+  return {
+    __type: "ActorError",
+    statusCode,
+    public: public_,
+    group,
+    code,
+    message,
+    metadata,
+    rayId,
+    actor: actor2
+  };
+}
+function stringifyError(error46) {
+  if (error46 instanceof Error) {
+    if (typeof process !== "undefined" && getLogErrorStack()) {
+      let stack;
+      try {
+        stack = error46.stack;
+      } catch {
+        stack = void 0;
       }
-      names.add(name);
-      entries.push({
-        name,
-        path: childPath,
-        handler: child
-      });
+      return `${error46.name}: ${error46.message}${stack ? `
+${stack}` : ""}`;
     } else {
-      visitActionGroup(child, childPath, entries, names);
+      return `${error46.name}: ${error46.message}`;
     }
-  }
-}
-function lookupNestedSchema(schemas, path2) {
-  let value = schemas;
-  for (const segment of path2) {
-    if (!isRecord(value) || !Object.hasOwn(value, segment)) {
-      return void 0;
+  } else if (typeof error46 === "string") {
+    return error46;
+  } else if (typeof error46 === "object" && error46 !== null) {
+    try {
+      return `${JSON.stringify(error46)}`;
+    } catch {
+      return "[cannot stringify error]";
     }
-    value = value[segment];
+  } else {
+    return `Unknown error: ${getErrorMessage(error46)}`;
   }
-  return value;
 }
-function isRecord(value) {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) {
-    return false;
+function getErrorMessage(err) {
+  if (err && typeof err === "object" && "message" in err && typeof err.message === "string") {
+    return err.message;
+  } else {
+    return String(err);
   }
-  const prototype = Object.getPrototypeOf(value);
-  return prototype === Object.prototype || prototype === null;
 }
-function formatActionPath(path2) {
-  return path2.length === 0 ? "actions" : `Action \`${path2.join(".")}\``;
-}
-var DEFAULT_SLEEP_GRACE_PERIOD = 15e3;
-var ACTOR_CONTEXT_INTERNAL_SYMBOL = /* @__PURE__ */ Symbol(
-  "rivetkit.actor_context_internal"
-);
-var RAW_STATE_SYMBOL = /* @__PURE__ */ Symbol("rivetkit.raw_state");
-var CONN_STATE_MANAGER_SYMBOL = /* @__PURE__ */ Symbol("rivetkit.conn_state_manager");
-var zFunction = () => external_exports.custom((val) => typeof val === "function");
-var zActionTree = external_exports.custom((value) => {
-  if (typeof value !== "object" || value === null || Array.isArray(value)) {
-    return false;
-  }
-  const prototype = Object.getPrototypeOf(value);
-  return prototype === Object.prototype || prototype === null;
-}).superRefine((actions, ctx) => {
-  try {
-    flattenActionHandlers(actions);
-  } catch (error46) {
-    ctx.addIssue({
-      code: "custom",
-      message: error46 instanceof Error ? error46.message : "Invalid action definition"
-    });
-  }
-});
-var WorkflowInspectorConfigSchema = external_exports.object({
-  getHistory: zFunction(),
-  getState: zFunction().optional(),
-  onHistoryUpdated: zFunction().optional(),
-  replayFromStep: zFunction().optional()
-});
-var RunInspectorConfigSchema = external_exports.object({
-  workflow: WorkflowInspectorConfigSchema.optional()
-}).optional();
-var BUILTIN_INSPECTOR_TAB_IDS = [
-  "workflow",
-  "database",
-  "state",
-  "queue",
-  "schedules",
-  "connections",
-  "console"
-];
-var BuiltinInspectorTabIdSchema = external_exports.enum(BUILTIN_INSPECTOR_TAB_IDS);
-var CUSTOM_INSPECTOR_TAB_ID_RE = /^[A-Za-z0-9_-]+$/;
-var CustomInspectorTabEntrySchema = external_exports.object({
-  id: external_exports.string().regex(
-    CUSTOM_INSPECTOR_TAB_ID_RE,
-    "inspector.tabs[].id must contain only letters, digits, underscore, or dash"
-  ),
-  label: external_exports.string().min(1),
-  source: external_exports.string().min(1),
-  /**
-   * Optional icon id. The dashboard maps strings to glyphs (see its
-   * icon registry); unknown ids fall back to a generic icon.
-   */
-  icon: external_exports.string().min(1).optional(),
-  hidden: external_exports.literal(false).optional()
-}).strict();
-var HideInspectorTabEntrySchema = external_exports.object({
-  id: BuiltinInspectorTabIdSchema,
-  hidden: external_exports.literal(true)
-}).strict();
-var InspectorTabEntrySchema = external_exports.union([
-  CustomInspectorTabEntrySchema,
-  HideInspectorTabEntrySchema
-]);
-var ActorInspectorConfigSchema = external_exports.object({
-  tabs: external_exports.array(InspectorTabEntrySchema).default(() => [])
-}).strict().refine(
-  (data) => {
-    const ids = data.tabs.map((t) => t.id);
-    return new Set(ids).size === ids.length;
-  },
-  { message: "Duplicate id in inspector.tabs", path: ["tabs"] }
-).refine(
-  (data) => {
-    const builtinSet = new Set(BUILTIN_INSPECTOR_TAB_IDS);
-    return data.tabs.every(
-      (t) => t.hidden === true || !builtinSet.has(t.id)
-    );
-  },
-  {
-    message: "Custom inspector tab id collides with a built-in (use hidden: true to hide a built-in)",
-    path: ["tabs"]
-  }
-);
-var RunConfigSchema = external_exports.object({
-  /** Display name for the actor in the Inspector UI. */
-  name: external_exports.string().optional(),
-  /** Icon for the actor in the Inspector UI. Can be an emoji or FontAwesome icon name. */
-  icon: external_exports.string().optional(),
-  /** The run handler function. */
-  run: zFunction(),
-  /** Inspector integration for long-running run handlers. */
-  inspector: RunInspectorConfigSchema.optional()
-});
-var RUN_FUNCTION_CONFIG_SYMBOL = /* @__PURE__ */ Symbol.for("rivetkit.run_function_config");
-function defineRunHandler(run, options) {
-  if (options.inspectorKind === void 0 !== (options.createInspector === void 0)) {
-    throw new TypeError(
-      "defineRunHandler requires inspectorKind and createInspector together"
-    );
-  }
-  Object.defineProperty(run, RUN_FUNCTION_CONFIG_SYMBOL, {
-    configurable: false,
-    enumerable: false,
-    writable: false,
-    value: {
-      name: options.name,
-      icon: options.icon,
-      inspectorKind: options.inspectorKind,
-      createInspector: options.createInspector
-    }
-  });
-  return run;
-}
-function getRunInspectorKind(run) {
-  var _a2;
-  if (!run || typeof run !== "function") return void 0;
-  return (_a2 = run[RUN_FUNCTION_CONFIG_SYMBOL]) == null ? void 0 : _a2.inspectorKind;
-}
-function createRunInspector(run, context2) {
-  var _a2, _b;
-  if (!run || typeof run !== "function") return void 0;
-  return (_b = (_a2 = run[RUN_FUNCTION_CONFIG_SYMBOL]) == null ? void 0 : _a2.createInspector) == null ? void 0 : _b.call(_a2, context2);
-}
-var zRunHandler = external_exports.union([zFunction(), RunConfigSchema]).optional();
-function getRunFunction(run) {
-  if (!run) return void 0;
-  if (typeof run === "function") return run;
-  return run.run;
-}
-function getRunMetadata(run) {
-  if (!run) return {};
-  if (typeof run === "function") {
-    const config3 = run[RUN_FUNCTION_CONFIG_SYMBOL];
-    if (!config3) return {};
-    return { name: config3.name, icon: config3.icon };
-  }
-  return { name: run.name, icon: run.icon };
-}
-function getRunInspectorConfig(run, actor2) {
-  if (!run) return void 0;
-  if (typeof run === "function") {
-    const config3 = run[RUN_FUNCTION_CONFIG_SYMBOL];
-    return (config3 == null ? void 0 : config3.inspectorFactory) ? config3.inspectorFactory(actor2) : config3 == null ? void 0 : config3.inspector;
-  }
-  return run.inspector;
-}
-function hasRunInspectorConfig(run) {
-  if (!run) return false;
-  if (typeof run !== "function") return run.inspector !== void 0;
-  const config3 = run[RUN_FUNCTION_CONFIG_SYMBOL];
-  return (config3 == null ? void 0 : config3.inspectorKind) !== void 0 || (config3 == null ? void 0 : config3.createInspector) !== void 0 || (config3 == null ? void 0 : config3.inspector) !== void 0 || (config3 == null ? void 0 : config3.inspectorFactory) !== void 0;
-}
-function disposeRunInspector(run, actorId) {
-  var _a2;
-  if (!run || typeof run !== "function") {
-    return;
-  }
-  const config3 = run[RUN_FUNCTION_CONFIG_SYMBOL];
-  (_a2 = config3 == null ? void 0 : config3.disposeInspector) == null ? void 0 : _a2.call(config3, actorId);
-}
-var GlobalActorOptionsBaseSchema = external_exports.object({
-  /** Display name for the actor in the Inspector UI. */
-  name: external_exports.string().optional(),
-  /** Icon for the actor in the Inspector UI. Can be an emoji or FontAwesome icon name. */
-  icon: external_exports.string().optional(),
-  /** Enables the experimental Actor Runtime Socket for this actor. */
-  enableActorRuntimeSocket: external_exports.boolean().default(false),
-  /**
-   * Can hibernate WebSockets for onWebSocket.
-   *
-   * WebSockets using actions/events are hibernatable by default.
-   *
-   * @experimental
-   **/
-  canHibernateWebSocket: external_exports.union([external_exports.boolean(), zFunction()]).default(false)
-}).strict();
-var GlobalActorOptionsSchema = GlobalActorOptionsBaseSchema.prefault(
-  () => ({})
-);
-var InstanceActorOptionsBaseSchema = external_exports.object({
-  createVarsTimeout: external_exports.number().positive().default(5e3),
-  createConnStateTimeout: external_exports.number().positive().default(5e3),
-  onBeforeConnectTimeout: external_exports.number().positive().default(5e3),
-  onConnectTimeout: external_exports.number().positive().default(5e3),
-  onMigrateTimeout: external_exports.number().positive().default(3e4),
-  sleepGracePeriod: external_exports.number().positive().default(DEFAULT_SLEEP_GRACE_PERIOD),
-  /** @deprecated `onDestroyTimeout` is folded into `sleepGracePeriod`, which now bounds the entire graceful shutdown window for both sleep and destroy. Will be removed in 2.2.0. */
-  onDestroyTimeout: external_exports.number().positive().optional(),
-  /** @deprecated `waitUntilTimeout` is folded into `sleepGracePeriod`, which now bounds the entire graceful shutdown window for both sleep and destroy. Will be removed in 2.2.0. */
-  waitUntilTimeout: external_exports.number().positive().optional(),
-  stateSaveInterval: external_exports.number().positive().default(1e3),
-  actionTimeout: external_exports.number().positive().default(6e4),
-  connectionLivenessTimeout: external_exports.number().positive().default(2500),
-  connectionLivenessInterval: external_exports.number().positive().default(5e3),
-  /** @deprecated Use `c.keepAwake(promise)` to scope keep-awake to a specific operation, or keep `noSleep` for actors that must stay awake indefinitely. Will be removed in 2.2.0. */
-  noSleep: external_exports.boolean().default(false),
-  sleepTimeout: external_exports.number().positive().default(3e4),
-  maxQueueSize: external_exports.number().positive().default(1e3),
-  /** Maximum pending one-shot and recurring schedules. */
-  maxSchedules: external_exports.number().int().nonnegative().default(1e3),
-  maxQueueMessageSize: external_exports.number().positive().default(64 * 1024),
-  /** @deprecated Internal storage moved to SQLite and no longer uses KV preloading, so this option is ignored. Will be removed in 2.2.0. */
-  preloadMaxWorkflowBytes: external_exports.number().nonnegative().optional(),
-  /** @deprecated Internal storage moved to SQLite and no longer uses KV preloading, so this option is ignored. Will be removed in 2.2.0. */
-  preloadMaxConnectionsBytes: external_exports.number().nonnegative().optional()
-}).strict();
-var InstanceActorOptionsSchema = InstanceActorOptionsBaseSchema.prefault(() => ({}));
-var ActorOptionsSchema = GlobalActorOptionsBaseSchema.extend(
-  InstanceActorOptionsBaseSchema.shape
-).strict().prefault(() => ({}));
-var zSampleRate = external_exports.number().min(0).max(1);
-var zActionSampleRates = external_exports.lazy(
-  () => external_exports.record(external_exports.string(), external_exports.union([zSampleRate, zActionSampleRates]))
-);
-var ActorConfigSchema = external_exports.object({
-  onCreate: zFunction().optional(),
-  onDestroy: zFunction().optional(),
-  onMigrate: zFunction().optional(),
-  onWake: zFunction().optional(),
-  onSleep: zFunction().optional(),
-  run: zRunHandler,
-  onStateChange: zFunction().optional(),
-  onBeforeConnect: zFunction().optional(),
-  onConnect: zFunction().optional(),
-  onDisconnect: zFunction().optional(),
-  onBeforeActionResponse: zFunction().optional(),
-  onRequest: zFunction().optional(),
-  onWebSocket: zFunction().optional(),
-  actions: zActionTree.default(() => ({})),
-  actionInputSchemas: external_exports.record(external_exports.string(), external_exports.any()).optional(),
-  tracing: external_exports.object({
-    sampler: zSampleRate.optional(),
-    actions: zActionSampleRates.optional()
-  }).strict().optional(),
-  connParamsSchema: external_exports.any().optional(),
-  events: external_exports.record(external_exports.string(), external_exports.any()).optional(),
-  queues: external_exports.record(external_exports.string(), external_exports.any()).optional(),
-  state: external_exports.any().optional(),
-  createState: zFunction().optional(),
-  connState: external_exports.any().optional(),
-  createConnState: zFunction().optional(),
-  vars: external_exports.any().optional(),
-  db: external_exports.any().optional(),
-  createVars: zFunction().optional(),
-  options: ActorOptionsSchema,
-  inspector: ActorInspectorConfigSchema.optional()
-}).strict().refine(
-  (data) => !(data.state !== void 0 && data.createState !== void 0),
-  {
-    message: "Cannot define both 'state' and 'createState'",
-    path: ["state"]
-  }
-).refine(
-  (data) => !(data.connState !== void 0 && data.createConnState !== void 0),
-  {
-    message: "Cannot define both 'connState' and 'createConnState'",
-    path: ["connState"]
-  }
-).refine(
-  (data) => !(data.vars !== void 0 && data.createVars !== void 0),
-  {
-    message: "Cannot define both 'vars' and 'createVars'",
-    path: ["vars"]
-  }
-);
-var DocActorOptionsSchema = external_exports.object({
-  name: external_exports.string().optional().describe("Display name for the actor in the Inspector UI."),
-  icon: external_exports.string().optional().describe(
-    "Icon for the actor in the Inspector UI. Can be an emoji (e.g., '\u{1F680}') or FontAwesome icon name (e.g., 'rocket')."
-  ),
-  enableActorRuntimeSocket: external_exports.boolean().optional().describe(
-    "Enables the experimental Actor Runtime Socket for this actor. Default: false"
-  ),
-  createVarsTimeout: external_exports.number().optional().describe("Timeout in ms for createVars handler. Default: 5000"),
-  createConnStateTimeout: external_exports.number().optional().describe(
-    "Timeout in ms for createConnState handler. Default: 5000"
-  ),
-  onMigrateTimeout: external_exports.number().optional().describe("Timeout in ms for onMigrate handler. Default: 30000"),
-  onBeforeConnectTimeout: external_exports.number().optional().describe(
-    "Timeout in ms for onBeforeConnect handler. Default: 5000"
-  ),
-  onConnectTimeout: external_exports.number().optional().describe("Timeout in ms for onConnect handler. Default: 5000"),
-  sleepGracePeriod: external_exports.number().optional().describe(
-    `Max time in ms for the graceful shutdown window. Covers lifecycle hooks (onSleep, onDestroy), the run handler wait, async raw WebSocket handlers, disconnect callbacks, and final state serialization. Default: ${DEFAULT_SLEEP_GRACE_PERIOD}.`
-  ),
-  onDestroyTimeout: external_exports.number().optional().describe(
-    "Deprecated. Folded into sleepGracePeriod, which now bounds the entire graceful shutdown window for both sleep and destroy. Will be removed in 2.2.0."
-  ),
-  waitUntilTimeout: external_exports.number().optional().describe(
-    "Deprecated. Folded into sleepGracePeriod, which now bounds the entire graceful shutdown window for both sleep and destroy. Will be removed in 2.2.0."
-  ),
-  stateSaveInterval: external_exports.number().optional().describe(
-    "Interval in ms between automatic state saves. Default: 1000"
-  ),
-  actionTimeout: external_exports.number().optional().describe("Timeout in ms for action handlers. Default: 60000"),
-  connectionLivenessTimeout: external_exports.number().optional().describe(
-    "Timeout in ms for connection liveness checks. Default: 2500"
-  ),
-  connectionLivenessInterval: external_exports.number().optional().describe(
-    "Interval in ms between connection liveness checks. Default: 5000"
-  ),
-  noSleep: external_exports.boolean().optional().describe(
-    "Deprecated. If true, the actor will never sleep. Use c.keepAwake(promise) to scope keep-awake to a specific operation instead. Default: false"
-  ),
-  sleepTimeout: external_exports.number().optional().describe(
-    "Time in ms of inactivity before the actor sleeps. Default: 30000"
-  ),
-  maxQueueSize: external_exports.number().optional().describe(
-    "Maximum number of queue messages before rejecting new messages. Default: 1000"
-  ),
-  maxSchedules: external_exports.number().int().nonnegative().optional().describe(
-    "Maximum pending one-shot and recurring schedules before rejecting new schedules. Default: 1000"
-  ),
-  maxQueueMessageSize: external_exports.number().optional().describe(
-    "Maximum size of each queue message in bytes. Default: 65536"
-  ),
-  canHibernateWebSocket: external_exports.boolean().optional().describe(
-    "Whether WebSockets using onWebSocket can be hibernated. WebSockets using actions/events are hibernatable by default. Default: false"
-  )
-}).describe("Actor options for timeouts and behavior configuration.");
-var DocActorConfigSchema = external_exports.object({
-  state: external_exports.unknown().optional().describe(
-    "Initial state value for the actor. Cannot be used with createState."
-  ),
-  createState: external_exports.unknown().optional().describe(
-    "Function to create initial state. Receives context and input. Cannot be used with state."
-  ),
-  connState: external_exports.unknown().optional().describe(
-    "Initial connection state value. Cannot be used with createConnState."
-  ),
-  createConnState: external_exports.unknown().optional().describe(
-    "Function to create connection state. Receives context and connection params. The pending connection is not visible in c.conns until this succeeds. Cannot be used with connState."
-  ),
-  vars: external_exports.unknown().optional().describe(
-    "Initial ephemeral variables value. Cannot be used with createVars."
-  ),
-  createVars: external_exports.unknown().optional().describe(
-    "Function to create ephemeral variables. Receives context and driver context. Cannot be used with vars."
-  ),
-  db: external_exports.unknown().optional().describe("Database provider instance for the actor."),
-  onCreate: external_exports.unknown().optional().describe(
-    "Called when the actor is first initialized. Use to initialize state."
-  ),
-  onDestroy: external_exports.unknown().optional().describe("Called when the actor is destroyed."),
-  onMigrate: external_exports.unknown().optional().describe(
-    "Called on every actor start after persisted state loads and before onWake. Use for repeatable schema migrations."
-  ),
-  onWake: external_exports.unknown().optional().describe(
-    "Called when the actor wakes up and is ready to receive connections and actions."
-  ),
-  onSleep: external_exports.unknown().optional().describe(
-    "Called when the actor is stopping or sleeping. Use to clean up resources."
-  ),
-  run: external_exports.unknown().optional().describe(
-    "Called after actor starts. Does not block startup. Use for background tasks like queue processing or tick loops. If it exits, the actor follows the normal idle sleep timeout once idle. If it throws, the actor logs the error and then follows the normal idle sleep timeout once idle."
-  ),
-  onStateChange: external_exports.unknown().optional().describe(
-    "Called when the actor's state changes. State changes within this hook won't trigger recursion."
-  ),
-  onBeforeConnect: external_exports.unknown().optional().describe(
-    "Called before a client connects. Throw an error to reject the connection. The pending connection is not visible in c.conns while this runs."
-  ),
-  onConnect: external_exports.unknown().optional().describe(
-    "Called when a client successfully connects. The connection is visible in c.conns before this runs."
-  ),
-  onDisconnect: external_exports.unknown().optional().describe("Called when a client disconnects."),
-  onBeforeActionResponse: external_exports.unknown().optional().describe(
-    "Called before sending an action response. Use to transform output."
-  ),
-  onRequest: external_exports.unknown().optional().describe(
-    "Called for raw HTTP requests to /actors/{name}/http/* endpoints."
-  ),
-  onWebSocket: external_exports.unknown().optional().describe(
-    "Called for raw WebSocket connections to /actors/{name}/websocket/* endpoints."
-  ),
-  actions: external_exports.record(external_exports.string(), external_exports.unknown()).optional().describe(
-    "Tree of action names or nested groups to handler functions. Nested paths use dot-separated low-level action names. Defaults to an empty object."
-  ),
-  actionInputSchemas: external_exports.record(external_exports.string(), external_exports.unknown()).optional().describe(
-    "Optional schemas for validating action argument tuples in native runtimes. May mirror nested action groups or use dot-separated low-level action names."
-  ),
-  tracing: external_exports.unknown().optional().describe(
-    "Trace sampling for this actor: `sampler` is the share of its invocations that are recorded, from 0 to 1, with optional per-action rates under `actions`. A rate lowers what is recorded and never raises it. Defaults to the process sampler from OTEL_TRACES_SAMPLER."
-  ),
-  connParamsSchema: external_exports.unknown().optional().describe(
-    "Optional schema for validating connection params in native runtimes."
-  ),
-  events: external_exports.record(external_exports.string(), external_exports.unknown()).optional().describe("Map of event names to schemas."),
-  queues: external_exports.record(external_exports.string(), external_exports.unknown()).optional().describe("Map of queue names to schemas."),
-  options: DocActorOptionsSchema.optional()
-}).describe("Actor configuration passed to the actor() function.");
-
-// ../rivetkit/dist/tsup/chunk-P2OFXH4G.js
-var INTERNAL_ERROR_CODE = "internal_error";
-var INTERNAL_ERROR_DESCRIPTION = "An internal error occurred";
-var USER_ERROR_CODE = "user_error";
-var BRIDGE_RIVET_ERROR_PREFIX = "__RIVET_ERROR_JSON__:";
-function looksLikeRivetErrorOptions(value) {
-  return typeof value === "object" && value !== null && ("public" in value || "metadata" in value || "rayId" in value || "statusCode" in value || "actor" in value || "cause" in value);
-}
-function isTypedErrorTag(value) {
-  return value === "ActorError" || value === "RivetError";
-}
-function errorMessage(error46, fallback = String(error46)) {
-  if (error46 && typeof error46 === "object" && "message" in error46 && typeof error46.message === "string") {
-    return error46.message;
-  }
-  return fallback;
-}
-function isRivetErrorLike(error46) {
-  return typeof error46 === "object" && error46 !== null && "group" in error46 && typeof error46.group === "string" && "code" in error46 && typeof error46.code === "string" && "message" in error46 && typeof error46.message === "string" && (!("rayId" in error46) || error46.rayId === void 0 || typeof error46.rayId === "string") && (!("__type" in error46) || isTypedErrorTag(error46.__type));
-}
-function isActorAbortedError(error46) {
-  return isRivetErrorLike(error46) && error46.group === "actor" && error46.code === "aborted";
-}
-function isActorSpecifier(value) {
-  return typeof value === "object" && value !== null && "actorId" in value && typeof value.actorId === "string" && "generation" in value && typeof value.generation === "number" && (!("key" in value) || value.key === void 0 || typeof value.key === "string");
-}
-var RivetError = class extends Error {
-  __type = "RivetError";
-  public;
-  metadata;
-  rayId;
-  statusCode;
-  actor;
-  group;
-  code;
-  static isRivetError(error46) {
-    return isRivetErrorLike(error46);
-  }
-  static isActorError(error46) {
-    return isRivetErrorLike(error46);
-  }
-  constructor(group, code, message, options) {
-    const normalized = looksLikeRivetErrorOptions(options) ? options : { metadata: options };
-    super(message, { cause: normalized.cause });
-    this.name = "RivetError";
-    this.group = group;
-    this.code = code;
-    this.public = normalized.public ?? false;
-    this.metadata = normalized.metadata;
-    this.rayId = normalized.rayId ?? void 0;
-    this.statusCode = normalized.statusCode ?? (this.public ? 400 : 500);
-    this.actor = normalized.actor;
-  }
-  toString() {
-    return this.message;
-  }
-};
-var UserError = class extends RivetError {
-  constructor(message, options) {
-    super("user", (options == null ? void 0 : options.code) ?? USER_ERROR_CODE, message, {
-      public: true,
-      metadata: options == null ? void 0 : options.metadata,
-      cause: options == null ? void 0 : options.cause
-    });
-  }
-};
-function toRivetError(error46, fallback) {
-  if (typeof error46 === "string") {
-    const bridged = decodeBridgeRivetError(error46);
-    if (bridged) {
-      return bridged;
-    }
-  }
-  if (error46 instanceof Error) {
-    const bridged = decodeBridgeRivetError(error46.message);
-    if (bridged) {
-      return bridged;
-    }
-  }
-  if (isRivetErrorLike(error46)) {
-    return new RivetError(error46.group, error46.code, error46.message, {
-      public: error46.public,
-      statusCode: error46.statusCode,
-      metadata: error46.metadata,
-      rayId: error46.rayId,
-      actor: error46.actor,
-      cause: error46 instanceof Error ? error46.cause : void 0
-    });
-  }
-  return new RivetError(
-    (fallback == null ? void 0 : fallback.group) ?? "actor",
-    (fallback == null ? void 0 : fallback.code) ?? INTERNAL_ERROR_CODE,
-    errorMessage(error46, (fallback == null ? void 0 : fallback.message) ?? "Unknown error"),
-    {
-      public: fallback == null ? void 0 : fallback.public,
-      statusCode: fallback == null ? void 0 : fallback.statusCode,
-      metadata: fallback == null ? void 0 : fallback.metadata,
-      rayId: fallback == null ? void 0 : fallback.rayId,
-      actor: fallback == null ? void 0 : fallback.actor,
-      cause: error46 instanceof Error ? error46 : void 0
-    }
-  );
-}
-function encodeBridgeRivetError(error46) {
-  return `${BRIDGE_RIVET_ERROR_PREFIX}${JSON.stringify({
-    group: error46.group,
-    code: error46.code,
-    message: error46.message,
-    metadata: error46.metadata,
-    rayId: error46.rayId,
-    public: error46.public,
-    statusCode: error46.statusCode,
-    actor: error46.actor
-  })}`;
-}
-function encodeErrorForBridge(error46) {
-  if (isCanonicalStructuredRivetError(error46)) {
-    return encodeBridgeRivetError(error46);
-  }
-  return String(error46);
-}
-function isCanonicalStructuredRivetError(error46) {
-  return error46 instanceof RivetError || typeof error46 === "object" && error46 !== null && "__type" in error46 && error46.__type === "RivetError" && "group" in error46 && typeof error46.group === "string" && "code" in error46 && typeof error46.code === "string" && "message" in error46 && typeof error46.message === "string";
-}
-function decodeBridgeRivetErrorPayload(value) {
-  if (!value.startsWith(BRIDGE_RIVET_ERROR_PREFIX)) {
-    return void 0;
-  }
-  try {
-    const raw = JSON.parse(
-      value.slice(BRIDGE_RIVET_ERROR_PREFIX.length)
-    );
-    const payload = {
-      ...raw,
-      rayId: raw.rayId ?? void 0
-    };
-    if (!isRivetErrorLike(payload)) {
-      return void 0;
-    }
-    if (payload.actor !== void 0 && payload.actor !== null && !isActorSpecifier(payload.actor)) {
-      return void 0;
-    }
-    return payload;
-  } catch {
-    return void 0;
-  }
-}
-function decodeBridgeRivetError(value) {
-  const payload = decodeBridgeRivetErrorPayload(value);
-  if (!payload) {
-    return void 0;
-  }
-  return new RivetError(payload.group, payload.code, payload.message, {
-    metadata: payload.metadata,
-    rayId: payload.rayId,
-    public: payload.public,
-    statusCode: payload.statusCode,
-    actor: payload.actor ?? void 0
-  });
-}
-function invalidRequest(error46) {
-  return new RivetError(
-    "request",
-    "invalid",
-    `Invalid request: ${errorMessage(error46, String(error46))}`,
-    {
-      public: true,
-      cause: error46 instanceof Error ? error46 : void 0
-    }
-  );
-}
-function actorNotFound(identifier) {
-  return new RivetError(
-    "actor",
-    "not_found",
-    identifier ? `Actor not found: ${identifier} (https://www.rivet.dev/docs/clients/javascript)` : "Actor not found (https://www.rivet.dev/docs/clients/javascript)",
-    { public: true }
-  );
-}
-function forbiddenError() {
-  return new RivetError("auth", "forbidden", "Forbidden", {
-    public: true,
-    statusCode: 403
-  });
-}
-function unsupportedFeature(feature) {
-  return new RivetError(
-    "feature",
-    "unsupported",
-    `Unsupported feature: ${feature}`
-  );
-}
-
-// ../rivetkit/dist/tsup/chunk-DHWZTUKA.js
-var import_pino = require("pino");
-var cbor = __toESM(require("cbor-x"), 1);
-var import_invariant = __toESM(require_invariant(), 1);
-var getRivetEngine = () => getEnvUniversal("RIVET_ENGINE");
-var getRivetEndpoint = () => getEnvUniversal("RIVET_ENDPOINT");
-var getRivetToken = () => getEnvUniversal("RIVET_TOKEN");
-var getRivetNamespace = () => getEnvUniversal("RIVET_NAMESPACE");
-var getRivetPool = () => getEnvUniversal("RIVET_POOL");
-var getRivetTotalSlots = () => {
-  const value = getEnvUniversal("RIVET_TOTAL_SLOTS");
-  return value !== void 0 ? parseInt(value, 10) : void 0;
-};
-var getRivetRunEngine = () => getEnvUniversal("RIVET_RUN_ENGINE") === "1";
-var getRivetRunEngineHost = () => getEnvUniversal("RIVET_RUN_ENGINE_HOST");
-var getRivetRunEnginePort = () => {
-  const value = getEnvUniversal("RIVET_RUN_ENGINE_PORT");
-  return value !== void 0 ? parseInt(value, 10) : void 0;
-};
-var getRivetRunEngineVersion = () => getEnvUniversal("RIVET_RUN_ENGINE_VERSION");
-var getRivetRunServices = () => {
-  const value = getEnvUniversal("RIVET_RUN_SERVICES");
-  return value === void 0 ? void 0 : value === "1";
-};
-var getRivetEnvoyVersion = () => {
-  const value = getEnvUniversal("RIVET_ENVOY_VERSION");
-  return value !== void 0 ? parseInt(value, 10) : void 0;
-};
-var getRivetPublicEndpoint = () => getEnvUniversal("RIVET_PUBLIC_ENDPOINT");
-var getRivetPublicToken = () => getEnvUniversal("RIVET_PUBLIC_TOKEN");
-var getRivetkitRuntime = () => getEnvUniversal("RIVETKIT_RUNTIME");
-var getRivetkitRuntimeMode = () => {
-  const value = getEnvUniversal("RIVETKIT_RUNTIME_MODE");
-  if (value === void 0) return "envoy";
-  if (value === "envoy" || value === "serverless") return value;
-  throw new Error(
-    `RIVETKIT_RUNTIME_MODE env var must be "envoy" or "serverless"; got "${value}"`
-  );
-};
-var getRivetkitPublicDir = () => {
-  const value = getEnvUniversal("RIVETKIT_PUBLIC_DIR");
-  return value === void 0 || value === "" ? void 0 : value;
-};
-function parsePortEnv(raw) {
-  if (raw === void 0 || raw === "") return void 0;
-  const parsed = Number.parseInt(raw, 10);
-  if (!Number.isFinite(parsed) || parsed < 1 || parsed > 65535 || String(parsed) !== raw.trim()) {
-    throw new Error(
-      `RIVET_PORT env var must be an integer between 1 and 65535; got "${raw}"`
-    );
-  }
-  return parsed;
-}
-var getLogLevel = () => getEnvUniversal("RIVET_LOG_LEVEL") ?? getEnvUniversal("LOG_LEVEL");
-var getLogTarget = () => getEnvUniversal("RIVET_LOG_TARGET") === "1";
-var getLogTimestamp = () => getEnvUniversal("RIVET_LOG_TIMESTAMP") === "1";
-var getLogMessage = () => getEnvUniversal("RIVET_LOG_MESSAGE") === "1";
-var getLogErrorStack = () => getEnvUniversal("RIVET_LOG_ERROR_STACK") === "1";
-var getNodeEnv = () => getEnvUniversal("NODE_ENV");
-var getNextPhase = () => getEnvUniversal("NEXT_PHASE");
-var isDev = () => getNodeEnv() !== "production";
-function assertUnreachable(x) {
-  throw new Error(`Unreachable case: ${x}`);
-}
-function deconstructError(error46, exposeInternalError = false) {
-  let statusCode;
-  let public_;
-  let group;
-  let code;
-  let message;
-  let metadata;
-  let rayId;
-  let actor2;
-  if (isCanonicalStructuredRivetError(error46)) {
-    statusCode = typeof error46.statusCode === "number" ? error46.statusCode : error46.public ? 400 : 500;
-    public_ = error46.public ?? false;
-    group = error46.group;
-    code = error46.code;
-    message = error46.message;
-    metadata = error46.metadata;
-    rayId = error46.rayId;
-    actor2 = error46.actor;
-  } else if (RivetError.isActorError(error46) && error46.public) {
-    statusCode = "statusCode" in error46 && error46.statusCode ? error46.statusCode : 400;
-    public_ = true;
-    group = error46.group;
-    code = error46.code;
-    message = getErrorMessage(error46);
-    metadata = error46.metadata;
-    rayId = error46.rayId;
-    actor2 = error46.actor;
-  } else if (exposeInternalError) {
-    if (RivetError.isActorError(error46)) {
-      statusCode = 500;
-      public_ = false;
-      group = error46.group;
-      code = error46.code;
-      message = getErrorMessage(error46);
-      metadata = error46.metadata;
-      rayId = error46.rayId;
-      actor2 = error46.actor;
-    } else {
-      statusCode = 500;
-      public_ = false;
-      group = "rivetkit";
-      code = INTERNAL_ERROR_CODE;
-      message = getErrorMessage(error46);
-    }
-  } else {
-    statusCode = 500;
-    public_ = false;
-    group = "rivetkit";
-    code = INTERNAL_ERROR_CODE;
-    message = INTERNAL_ERROR_DESCRIPTION;
-    if (RivetError.isActorError(error46)) {
-      actor2 = error46.actor;
-    }
-    metadata = {
-      //url: `https://dashboard.rivet.dev/projects/${actorMetadata.project.slug}/environments/${actorMetadata.environment.slug}/actors?actorId=${actorMetadata.actor.id}`,
-    };
-  }
-  return {
-    __type: "ActorError",
-    statusCode,
-    public: public_,
-    group,
-    code,
-    message,
-    metadata,
-    rayId,
-    actor: actor2
-  };
-}
-function stringifyError(error46) {
-  if (error46 instanceof Error) {
-    if (typeof process !== "undefined" && getLogErrorStack()) {
-      let stack;
-      try {
-        stack = error46.stack;
-      } catch {
-        stack = void 0;
-      }
-      return `${error46.name}: ${error46.message}${stack ? `
-${stack}` : ""}`;
-    } else {
-      return `${error46.name}: ${error46.message}`;
-    }
-  } else if (typeof error46 === "string") {
-    return error46;
-  } else if (typeof error46 === "object" && error46 !== null) {
-    try {
-      return `${JSON.stringify(error46)}`;
-    } catch {
-      return "[cannot stringify error]";
-    }
-  } else {
-    return `Unknown error: ${getErrorMessage(error46)}`;
-  }
-}
-function getErrorMessage(err) {
-  if (err && typeof err === "object" && "message" in err && typeof err.message === "string") {
-    return err.message;
-  } else {
-    return String(err);
-  }
-}
-function noopNext() {
-  return async () => {
-  };
+function noopNext() {
+  return async () => {
+  };
 }
 var package_default = {
   name: "rivetkit",
-  version: "2.3.20",
+  version: "2.3.21",
   description: "Lightweight libraries for building stateful actors on edge platforms",
   license: "Apache-2.0",
   keywords: [
@@ -14078,6 +13585,7 @@ var package_default = {
     "@rivet-dev/agent-os-core": "^0.1.1",
     "@rivet-dev/services": "^0.1.5",
     "@rivetkit/bare-ts": "^0.6.2",
+    "@rivetkit/engine-api-full": "workspace:*",
     "@rivetkit/engine-cli": "workspace:*",
     "@rivetkit/engine-envoy-protocol": "workspace:*",
     "@rivetkit/on-change": "6.0.1",
@@ -15171,7 +14679,7 @@ function Config({ initialBufferLength = 1024, maxBufferLength = 1024 * 1024 * 32
   };
 }
 
-// ../rivetkit/dist/tsup/chunk-SNNVRHLX.js
+// ../rivetkit/dist/tsup/chunk-CJXBGTVT.js
 var config2 = /* @__PURE__ */ Config({});
 function readWorkflowCbor(bc) {
   return readData(bc);
@@ -15294,180 +14802,675 @@ function readWorkflowSleepEntry(bc) {
     state: readWorkflowSleepState(bc)
   };
 }
-function readWorkflowMessageEntry(bc) {
-  return {
-    name: readString(bc),
-    messageData: readWorkflowCbor(bc)
-  };
+function readWorkflowMessageEntry(bc) {
+  return {
+    name: readString(bc),
+    messageData: readWorkflowCbor(bc)
+  };
+}
+function readWorkflowRollbackCheckpointEntry(bc) {
+  return {
+    name: readString(bc)
+  };
+}
+function readWorkflowBranchStatus(bc) {
+  return {
+    status: readWorkflowBranchStatusType(bc),
+    output: read0(bc),
+    error: read1(bc)
+  };
+}
+function read2(bc) {
+  const len = readUintSafe(bc);
+  const result = /* @__PURE__ */ new Map();
+  for (let i = 0; i < len; i++) {
+    const offset = bc.offset;
+    const key = readString(bc);
+    if (result.has(key)) {
+      bc.offset = offset;
+      throw new BareError(offset, "duplicated key");
+    }
+    result.set(key, readWorkflowBranchStatus(bc));
+  }
+  return result;
+}
+function readWorkflowJoinEntry(bc) {
+  return {
+    branches: read2(bc)
+  };
+}
+function readWorkflowRaceEntry(bc) {
+  return {
+    winner: read1(bc),
+    branches: read2(bc)
+  };
+}
+function readWorkflowRemovedEntry(bc) {
+  return {
+    originalType: readString(bc),
+    originalName: read1(bc)
+  };
+}
+function readWorkflowVersionCheckEntry(bc) {
+  return {
+    resolved: readU32(bc),
+    latest: readU32(bc)
+  };
+}
+function readWorkflowEntryKind(bc) {
+  const offset = bc.offset;
+  const tag = readU8(bc);
+  switch (tag) {
+    case 0:
+      return { tag: "WorkflowStepEntry", val: readWorkflowStepEntry(bc) };
+    case 1:
+      return { tag: "WorkflowLoopEntry", val: readWorkflowLoopEntry(bc) };
+    case 2:
+      return {
+        tag: "WorkflowSleepEntry",
+        val: readWorkflowSleepEntry(bc)
+      };
+    case 3:
+      return {
+        tag: "WorkflowMessageEntry",
+        val: readWorkflowMessageEntry(bc)
+      };
+    case 4:
+      return {
+        tag: "WorkflowRollbackCheckpointEntry",
+        val: readWorkflowRollbackCheckpointEntry(bc)
+      };
+    case 5:
+      return { tag: "WorkflowJoinEntry", val: readWorkflowJoinEntry(bc) };
+    case 6:
+      return { tag: "WorkflowRaceEntry", val: readWorkflowRaceEntry(bc) };
+    case 7:
+      return {
+        tag: "WorkflowRemovedEntry",
+        val: readWorkflowRemovedEntry(bc)
+      };
+    case 8:
+      return {
+        tag: "WorkflowVersionCheckEntry",
+        val: readWorkflowVersionCheckEntry(bc)
+      };
+    default: {
+      bc.offset = offset;
+      throw new BareError(offset, "invalid tag");
+    }
+  }
+}
+function readWorkflowEntry(bc) {
+  return {
+    id: readString(bc),
+    location: readWorkflowLocation(bc),
+    kind: readWorkflowEntryKind(bc)
+  };
+}
+function read3(bc) {
+  return readBool(bc) ? readU64(bc) : null;
+}
+function readWorkflowEntryMetadata(bc) {
+  return {
+    status: readWorkflowEntryStatus(bc),
+    error: read1(bc),
+    attempts: readU32(bc),
+    lastAttemptAt: readU64(bc),
+    createdAt: readU64(bc),
+    completedAt: read3(bc),
+    rollbackCompletedAt: read3(bc),
+    rollbackError: read1(bc)
+  };
+}
+function read4(bc) {
+  const len = readUintSafe(bc);
+  if (len === 0) {
+    return [];
+  }
+  const result = [readString(bc)];
+  for (let i = 1; i < len; i++) {
+    result[i] = readString(bc);
+  }
+  return result;
+}
+function read5(bc) {
+  const len = readUintSafe(bc);
+  if (len === 0) {
+    return [];
+  }
+  const result = [readWorkflowEntry(bc)];
+  for (let i = 1; i < len; i++) {
+    result[i] = readWorkflowEntry(bc);
+  }
+  return result;
+}
+function read6(bc) {
+  const len = readUintSafe(bc);
+  const result = /* @__PURE__ */ new Map();
+  for (let i = 0; i < len; i++) {
+    const offset = bc.offset;
+    const key = readString(bc);
+    if (result.has(key)) {
+      bc.offset = offset;
+      throw new BareError(offset, "duplicated key");
+    }
+    result.set(key, readWorkflowEntryMetadata(bc));
+  }
+  return result;
+}
+function readWorkflowHistory(bc) {
+  return {
+    nameRegistry: read4(bc),
+    entries: read5(bc),
+    entryMetadata: read6(bc)
+  };
+}
+function decodeWorkflowHistory(bytes) {
+  const bc = new ByteCursor(bytes, config2);
+  const result = readWorkflowHistory(bc);
+  if (bc.offset < bc.view.byteLength) {
+    throw new BareError(bc.offset, "remaining bytes");
+  }
+  return result;
+}
+function decodeWorkflowHistoryTransport(data) {
+  return decodeWorkflowHistory(toUint8Array(data));
+}
+
+// ../rivetkit/dist/tsup/chunk-CSOHAAZK.js
+function flattenActionHandlers(actions) {
+  const flattened = /* @__PURE__ */ Object.create(null);
+  for (const { name, handler } of collectActionEntries(actions)) {
+    flattened[name] = handler;
+  }
+  return flattened;
+}
+function flattenActionInputSchemas(actions, schemas) {
+  if (schemas === void 0) return void 0;
+  if (!isRecord(schemas)) {
+    throw new TypeError("actionInputSchemas must be an object");
+  }
+  const flattened = /* @__PURE__ */ Object.create(null);
+  for (const { name, path: path2 } of collectActionEntries(actions)) {
+    const nestedSchema = lookupNestedSchema(schemas, path2);
+    const flatSchema = schemas[name];
+    if (nestedSchema !== void 0 && flatSchema !== void 0 && nestedSchema !== flatSchema) {
+      throw new TypeError(
+        `Action input schema \`${name}\` is defined by both a nested path and a dotted key`
+      );
+    }
+    const schema = nestedSchema ?? flatSchema;
+    if (schema !== void 0) {
+      flattened[name] = schema;
+    }
+  }
+  return flattened;
+}
+function flattenActionTraceSamplers(actions, rates = {}) {
+  const handlers = flattenActionHandlers(actions);
+  const flattened = Object.fromEntries(flattenSampleRates(rates, []));
+  for (const name of Object.keys(flattened)) {
+    if (!Object.hasOwn(handlers, name)) {
+      throw new TypeError(
+        `tracing.actions.${name} does not name an action`
+      );
+    }
+  }
+  return flattened;
 }
-function readWorkflowRollbackCheckpointEntry(bc) {
-  return {
-    name: readString(bc)
-  };
+function flattenSampleRates(rates, path2) {
+  return Object.entries(rates).flatMap(
+    ([segment, rate]) => {
+      const childPath = [...path2, segment];
+      return typeof rate === "number" ? [[childPath.join("."), rate]] : flattenSampleRates(rate, childPath);
+    }
+  );
 }
-function readWorkflowBranchStatus(bc) {
-  return {
-    status: readWorkflowBranchStatusType(bc),
-    output: read0(bc),
-    error: read1(bc)
-  };
+function collectActionEntries(actions) {
+  const entries = [];
+  const names = /* @__PURE__ */ new Set();
+  visitActionGroup(actions ?? {}, [], entries, names);
+  return entries;
 }
-function read2(bc) {
-  const len = readUintSafe(bc);
-  const result = /* @__PURE__ */ new Map();
-  for (let i = 0; i < len; i++) {
-    const offset = bc.offset;
-    const key = readString(bc);
-    if (result.has(key)) {
-      bc.offset = offset;
-      throw new BareError(offset, "duplicated key");
+function visitActionGroup(value, path2, entries, names) {
+  if (!isRecord(value)) {
+    throw new TypeError(
+      `${formatActionPath(path2)} must be an action handler or group`
+    );
+  }
+  for (const [segment, child] of Object.entries(value)) {
+    const childPath = [...path2, segment];
+    if (typeof child === "function") {
+      const name = childPath.join(".");
+      if (names.has(name)) {
+        throw new TypeError(
+          `Multiple action definitions flatten to \`${name}\``
+        );
+      }
+      names.add(name);
+      entries.push({
+        name,
+        path: childPath,
+        handler: child
+      });
+    } else {
+      visitActionGroup(child, childPath, entries, names);
     }
-    result.set(key, readWorkflowBranchStatus(bc));
   }
-  return result;
-}
-function readWorkflowJoinEntry(bc) {
-  return {
-    branches: read2(bc)
-  };
 }
-function readWorkflowRaceEntry(bc) {
-  return {
-    winner: read1(bc),
-    branches: read2(bc)
-  };
+function lookupNestedSchema(schemas, path2) {
+  let value = schemas;
+  for (const segment of path2) {
+    if (!isRecord(value) || !Object.hasOwn(value, segment)) {
+      return void 0;
+    }
+    value = value[segment];
+  }
+  return value;
 }
-function readWorkflowRemovedEntry(bc) {
-  return {
-    originalType: readString(bc),
-    originalName: read1(bc)
-  };
+function isRecord(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return false;
+  }
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
 }
-function readWorkflowVersionCheckEntry(bc) {
-  return {
-    resolved: readU32(bc),
-    latest: readU32(bc)
-  };
+function formatActionPath(path2) {
+  return path2.length === 0 ? "actions" : `Action \`${path2.join(".")}\``;
 }
-function readWorkflowEntryKind(bc) {
-  const offset = bc.offset;
-  const tag = readU8(bc);
-  switch (tag) {
-    case 0:
-      return { tag: "WorkflowStepEntry", val: readWorkflowStepEntry(bc) };
-    case 1:
-      return { tag: "WorkflowLoopEntry", val: readWorkflowLoopEntry(bc) };
-    case 2:
-      return {
-        tag: "WorkflowSleepEntry",
-        val: readWorkflowSleepEntry(bc)
-      };
-    case 3:
-      return {
-        tag: "WorkflowMessageEntry",
-        val: readWorkflowMessageEntry(bc)
-      };
-    case 4:
-      return {
-        tag: "WorkflowRollbackCheckpointEntry",
-        val: readWorkflowRollbackCheckpointEntry(bc)
-      };
-    case 5:
-      return { tag: "WorkflowJoinEntry", val: readWorkflowJoinEntry(bc) };
-    case 6:
-      return { tag: "WorkflowRaceEntry", val: readWorkflowRaceEntry(bc) };
-    case 7:
-      return {
-        tag: "WorkflowRemovedEntry",
-        val: readWorkflowRemovedEntry(bc)
-      };
-    case 8:
-      return {
-        tag: "WorkflowVersionCheckEntry",
-        val: readWorkflowVersionCheckEntry(bc)
-      };
-    default: {
-      bc.offset = offset;
-      throw new BareError(offset, "invalid tag");
-    }
+var DEFAULT_SLEEP_GRACE_PERIOD = 15e3;
+var ACTOR_CONTEXT_INTERNAL_SYMBOL = /* @__PURE__ */ Symbol(
+  "rivetkit.actor_context_internal"
+);
+var RAW_STATE_SYMBOL = /* @__PURE__ */ Symbol("rivetkit.raw_state");
+var CONN_STATE_MANAGER_SYMBOL = /* @__PURE__ */ Symbol("rivetkit.conn_state_manager");
+var zFunction = () => external_exports.custom((val) => typeof val === "function");
+var zActionTree = external_exports.custom((value) => {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return false;
+  }
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}).superRefine((actions, ctx) => {
+  try {
+    flattenActionHandlers(actions);
+  } catch (error46) {
+    ctx.addIssue({
+      code: "custom",
+      message: error46 instanceof Error ? error46.message : "Invalid action definition"
+    });
+  }
+});
+var WorkflowInspectorConfigSchema = external_exports.object({
+  getHistory: zFunction(),
+  getState: zFunction().optional(),
+  onHistoryUpdated: zFunction().optional(),
+  replayFromStep: zFunction().optional()
+});
+var RunInspectorConfigSchema = external_exports.object({
+  workflow: WorkflowInspectorConfigSchema.optional()
+}).optional();
+var BUILTIN_INSPECTOR_TAB_IDS = [
+  "workflow",
+  "database",
+  "state",
+  "queue",
+  "schedules",
+  "connections",
+  "console"
+];
+var BuiltinInspectorTabIdSchema = external_exports.enum(BUILTIN_INSPECTOR_TAB_IDS);
+var CUSTOM_INSPECTOR_TAB_ID_RE = /^[A-Za-z0-9_-]+$/;
+var CustomInspectorTabEntrySchema = external_exports.object({
+  id: external_exports.string().regex(
+    CUSTOM_INSPECTOR_TAB_ID_RE,
+    "inspector.tabs[].id must contain only letters, digits, underscore, or dash"
+  ),
+  label: external_exports.string().min(1),
+  source: external_exports.string().min(1),
+  /**
+   * Optional icon id. The dashboard maps strings to glyphs (see its
+   * icon registry); unknown ids fall back to a generic icon.
+   */
+  icon: external_exports.string().min(1).optional(),
+  hidden: external_exports.literal(false).optional()
+}).strict();
+var HideInspectorTabEntrySchema = external_exports.object({
+  id: BuiltinInspectorTabIdSchema,
+  hidden: external_exports.literal(true)
+}).strict();
+var InspectorTabEntrySchema = external_exports.union([
+  CustomInspectorTabEntrySchema,
+  HideInspectorTabEntrySchema
+]);
+var ActorInspectorConfigSchema = external_exports.object({
+  tabs: external_exports.array(InspectorTabEntrySchema).default(() => [])
+}).strict().refine(
+  (data) => {
+    const ids = data.tabs.map((t) => t.id);
+    return new Set(ids).size === ids.length;
+  },
+  { message: "Duplicate id in inspector.tabs", path: ["tabs"] }
+).refine(
+  (data) => {
+    const builtinSet = new Set(BUILTIN_INSPECTOR_TAB_IDS);
+    return data.tabs.every(
+      (t) => t.hidden === true || !builtinSet.has(t.id)
+    );
+  },
+  {
+    message: "Custom inspector tab id collides with a built-in (use hidden: true to hide a built-in)",
+    path: ["tabs"]
+  }
+);
+var RunConfigSchema = external_exports.object({
+  /** Display name for the actor in the Inspector UI. */
+  name: external_exports.string().optional(),
+  /** Icon for the actor in the Inspector UI. Can be an emoji or FontAwesome icon name. */
+  icon: external_exports.string().optional(),
+  /** The run handler function. */
+  run: zFunction(),
+  /** Inspector integration for long-running run handlers. */
+  inspector: RunInspectorConfigSchema.optional()
+});
+var RUN_FUNCTION_CONFIG_SYMBOL = /* @__PURE__ */ Symbol.for("rivetkit.run_function_config");
+function defineRunHandler(run, options) {
+  if (options.inspectorKind === void 0 !== (options.createInspector === void 0)) {
+    throw new TypeError(
+      "defineRunHandler requires inspectorKind and createInspector together"
+    );
   }
+  Object.defineProperty(run, RUN_FUNCTION_CONFIG_SYMBOL, {
+    configurable: false,
+    enumerable: false,
+    writable: false,
+    value: {
+      name: options.name,
+      icon: options.icon,
+      inspectorKind: options.inspectorKind,
+      createInspector: options.createInspector
+    }
+  });
+  return run;
 }
-function readWorkflowEntry(bc) {
-  return {
-    id: readString(bc),
-    location: readWorkflowLocation(bc),
-    kind: readWorkflowEntryKind(bc)
-  };
-}
-function read3(bc) {
-  return readBool(bc) ? readU64(bc) : null;
+function getRunInspectorKind(run) {
+  var _a2;
+  if (!run || typeof run !== "function") return void 0;
+  return (_a2 = run[RUN_FUNCTION_CONFIG_SYMBOL]) == null ? void 0 : _a2.inspectorKind;
 }
-function readWorkflowEntryMetadata(bc) {
-  return {
-    status: readWorkflowEntryStatus(bc),
-    error: read1(bc),
-    attempts: readU32(bc),
-    lastAttemptAt: readU64(bc),
-    createdAt: readU64(bc),
-    completedAt: read3(bc),
-    rollbackCompletedAt: read3(bc),
-    rollbackError: read1(bc)
-  };
+function createRunInspector(run, context2) {
+  var _a2, _b;
+  if (!run || typeof run !== "function") return void 0;
+  return (_b = (_a2 = run[RUN_FUNCTION_CONFIG_SYMBOL]) == null ? void 0 : _a2.createInspector) == null ? void 0 : _b.call(_a2, context2);
 }
-function read4(bc) {
-  const len = readUintSafe(bc);
-  if (len === 0) {
-    return [];
-  }
-  const result = [readString(bc)];
-  for (let i = 1; i < len; i++) {
-    result[i] = readString(bc);
-  }
-  return result;
+var zRunHandler = external_exports.union([zFunction(), RunConfigSchema]).optional();
+function getRunFunction(run) {
+  if (!run) return void 0;
+  if (typeof run === "function") return run;
+  return run.run;
 }
-function read5(bc) {
-  const len = readUintSafe(bc);
-  if (len === 0) {
-    return [];
-  }
-  const result = [readWorkflowEntry(bc)];
-  for (let i = 1; i < len; i++) {
-    result[i] = readWorkflowEntry(bc);
+function getRunMetadata(run) {
+  if (!run) return {};
+  if (typeof run === "function") {
+    const config3 = run[RUN_FUNCTION_CONFIG_SYMBOL];
+    if (!config3) return {};
+    return { name: config3.name, icon: config3.icon };
   }
-  return result;
+  return { name: run.name, icon: run.icon };
 }
-function read6(bc) {
-  const len = readUintSafe(bc);
-  const result = /* @__PURE__ */ new Map();
-  for (let i = 0; i < len; i++) {
-    const offset = bc.offset;
-    const key = readString(bc);
-    if (result.has(key)) {
-      bc.offset = offset;
-      throw new BareError(offset, "duplicated key");
-    }
-    result.set(key, readWorkflowEntryMetadata(bc));
+function getRunInspectorConfig(run, actor2) {
+  if (!run) return void 0;
+  if (typeof run === "function") {
+    const config3 = run[RUN_FUNCTION_CONFIG_SYMBOL];
+    return (config3 == null ? void 0 : config3.inspectorFactory) ? config3.inspectorFactory(actor2) : config3 == null ? void 0 : config3.inspector;
   }
-  return result;
+  return run.inspector;
 }
-function readWorkflowHistory(bc) {
-  return {
-    nameRegistry: read4(bc),
-    entries: read5(bc),
-    entryMetadata: read6(bc)
-  };
+function hasRunInspectorConfig(run) {
+  if (!run) return false;
+  if (typeof run !== "function") return run.inspector !== void 0;
+  const config3 = run[RUN_FUNCTION_CONFIG_SYMBOL];
+  return (config3 == null ? void 0 : config3.inspectorKind) !== void 0 || (config3 == null ? void 0 : config3.createInspector) !== void 0 || (config3 == null ? void 0 : config3.inspector) !== void 0 || (config3 == null ? void 0 : config3.inspectorFactory) !== void 0;
 }
-function decodeWorkflowHistory(bytes) {
-  const bc = new ByteCursor(bytes, config2);
-  const result = readWorkflowHistory(bc);
-  if (bc.offset < bc.view.byteLength) {
-    throw new BareError(bc.offset, "remaining bytes");
+function disposeRunInspector(run, actorId) {
+  var _a2;
+  if (!run || typeof run !== "function") {
+    return;
   }
-  return result;
-}
-function decodeWorkflowHistoryTransport(data) {
-  return decodeWorkflowHistory(toUint8Array(data));
+  const config3 = run[RUN_FUNCTION_CONFIG_SYMBOL];
+  (_a2 = config3 == null ? void 0 : config3.disposeInspector) == null ? void 0 : _a2.call(config3, actorId);
 }
+var GlobalActorOptionsBaseSchema = external_exports.object({
+  /** Display name for the actor in the Inspector UI. */
+  name: external_exports.string().optional(),
+  /** Icon for the actor in the Inspector UI. Can be an emoji or FontAwesome icon name. */
+  icon: external_exports.string().optional(),
+  /** Enables the experimental Actor Runtime Socket for this actor. */
+  enableActorRuntimeSocket: external_exports.boolean().default(false),
+  /**
+   * Can hibernate WebSockets for onWebSocket.
+   *
+   * WebSockets using actions/events are hibernatable by default.
+   *
+   * @experimental
+   **/
+  canHibernateWebSocket: external_exports.union([external_exports.boolean(), zFunction()]).default(false)
+}).strict();
+var GlobalActorOptionsSchema = GlobalActorOptionsBaseSchema.prefault(
+  () => ({})
+);
+var InstanceActorOptionsBaseSchema = external_exports.object({
+  createVarsTimeout: external_exports.number().positive().default(5e3),
+  createConnStateTimeout: external_exports.number().positive().default(5e3),
+  onBeforeConnectTimeout: external_exports.number().positive().default(5e3),
+  onConnectTimeout: external_exports.number().positive().default(5e3),
+  onMigrateTimeout: external_exports.number().positive().default(3e4),
+  sleepGracePeriod: external_exports.number().positive().default(DEFAULT_SLEEP_GRACE_PERIOD),
+  /** @deprecated `onDestroyTimeout` is folded into `sleepGracePeriod`, which now bounds the entire graceful shutdown window for both sleep and destroy. Will be removed in 2.2.0. */
+  onDestroyTimeout: external_exports.number().positive().optional(),
+  /** @deprecated `waitUntilTimeout` is folded into `sleepGracePeriod`, which now bounds the entire graceful shutdown window for both sleep and destroy. Will be removed in 2.2.0. */
+  waitUntilTimeout: external_exports.number().positive().optional(),
+  stateSaveInterval: external_exports.number().positive().default(1e3),
+  actionTimeout: external_exports.number().positive().default(6e4),
+  connectionLivenessTimeout: external_exports.number().positive().default(2500),
+  connectionLivenessInterval: external_exports.number().positive().default(5e3),
+  /** @deprecated Use `c.keepAwake(promise)` to scope keep-awake to a specific operation, or keep `noSleep` for actors that must stay awake indefinitely. Will be removed in 2.2.0. */
+  noSleep: external_exports.boolean().default(false),
+  sleepTimeout: external_exports.number().positive().default(3e4),
+  maxQueueSize: external_exports.number().positive().default(1e3),
+  /** Maximum pending one-shot and recurring schedules. */
+  maxSchedules: external_exports.number().int().nonnegative().default(1e3),
+  maxQueueMessageSize: external_exports.number().positive().default(64 * 1024),
+  /** @deprecated Internal storage moved to SQLite and no longer uses KV preloading, so this option is ignored. Will be removed in 2.2.0. */
+  preloadMaxWorkflowBytes: external_exports.number().nonnegative().optional(),
+  /** @deprecated Internal storage moved to SQLite and no longer uses KV preloading, so this option is ignored. Will be removed in 2.2.0. */
+  preloadMaxConnectionsBytes: external_exports.number().nonnegative().optional()
+}).strict();
+var InstanceActorOptionsSchema = InstanceActorOptionsBaseSchema.prefault(() => ({}));
+var ActorOptionsSchema = GlobalActorOptionsBaseSchema.extend(
+  InstanceActorOptionsBaseSchema.shape
+).strict().prefault(() => ({}));
+var zSampleRate = external_exports.number().min(0).max(1);
+var zActionSampleRates = external_exports.lazy(
+  () => external_exports.record(external_exports.string(), external_exports.union([zSampleRate, zActionSampleRates]))
+);
+var ActorConfigSchema = external_exports.object({
+  onCreate: zFunction().optional(),
+  onDestroy: zFunction().optional(),
+  onMigrate: zFunction().optional(),
+  onWake: zFunction().optional(),
+  onSleep: zFunction().optional(),
+  run: zRunHandler,
+  onStateChange: zFunction().optional(),
+  onBeforeConnect: zFunction().optional(),
+  onConnect: zFunction().optional(),
+  onDisconnect: zFunction().optional(),
+  onBeforeActionResponse: zFunction().optional(),
+  onRequest: zFunction().optional(),
+  onWebSocket: zFunction().optional(),
+  actions: zActionTree.default(() => ({})),
+  actionInputSchemas: external_exports.record(external_exports.string(), external_exports.any()).optional(),
+  tracing: external_exports.object({
+    sampler: zSampleRate.optional(),
+    actions: zActionSampleRates.optional()
+  }).strict().optional(),
+  connParamsSchema: external_exports.any().optional(),
+  events: external_exports.record(external_exports.string(), external_exports.any()).optional(),
+  queues: external_exports.record(external_exports.string(), external_exports.any()).optional(),
+  state: external_exports.any().optional(),
+  createState: zFunction().optional(),
+  connState: external_exports.any().optional(),
+  createConnState: zFunction().optional(),
+  vars: external_exports.any().optional(),
+  db: external_exports.any().optional(),
+  createVars: zFunction().optional(),
+  options: ActorOptionsSchema,
+  inspector: ActorInspectorConfigSchema.optional()
+}).strict().refine(
+  (data) => !(data.state !== void 0 && data.createState !== void 0),
+  {
+    message: "Cannot define both 'state' and 'createState'",
+    path: ["state"]
+  }
+).refine(
+  (data) => !(data.connState !== void 0 && data.createConnState !== void 0),
+  {
+    message: "Cannot define both 'connState' and 'createConnState'",
+    path: ["connState"]
+  }
+).refine(
+  (data) => !(data.vars !== void 0 && data.createVars !== void 0),
+  {
+    message: "Cannot define both 'vars' and 'createVars'",
+    path: ["vars"]
+  }
+);
+var DocActorOptionsSchema = external_exports.object({
+  name: external_exports.string().optional().describe("Display name for the actor in the Inspector UI."),
+  icon: external_exports.string().optional().describe(
+    "Icon for the actor in the Inspector UI. Can be an emoji (e.g., '\u{1F680}') or FontAwesome icon name (e.g., 'rocket')."
+  ),
+  enableActorRuntimeSocket: external_exports.boolean().optional().describe(
+    "Enables the experimental Actor Runtime Socket for this actor. Default: false"
+  ),
+  createVarsTimeout: external_exports.number().optional().describe("Timeout in ms for createVars handler. Default: 5000"),
+  createConnStateTimeout: external_exports.number().optional().describe(
+    "Timeout in ms for createConnState handler. Default: 5000"
+  ),
+  onMigrateTimeout: external_exports.number().optional().describe("Timeout in ms for onMigrate handler. Default: 30000"),
+  onBeforeConnectTimeout: external_exports.number().optional().describe(
+    "Timeout in ms for onBeforeConnect handler. Default: 5000"
+  ),
+  onConnectTimeout: external_exports.number().optional().describe("Timeout in ms for onConnect handler. Default: 5000"),
+  sleepGracePeriod: external_exports.number().optional().describe(
+    `Max time in ms for the graceful shutdown window. Covers lifecycle hooks (onSleep, onDestroy), the run handler wait, async raw WebSocket handlers, disconnect callbacks, and final state serialization. Default: ${DEFAULT_SLEEP_GRACE_PERIOD}.`
+  ),
+  onDestroyTimeout: external_exports.number().optional().describe(
+    "Deprecated. Folded into sleepGracePeriod, which now bounds the entire graceful shutdown window for both sleep and destroy. Will be removed in 2.2.0."
+  ),
+  waitUntilTimeout: external_exports.number().optional().describe(
+    "Deprecated. Folded into sleepGracePeriod, which now bounds the entire graceful shutdown window for both sleep and destroy. Will be removed in 2.2.0."
+  ),
+  stateSaveInterval: external_exports.number().optional().describe(
+    "Interval in ms between automatic state saves. Default: 1000"
+  ),
+  actionTimeout: external_exports.number().optional().describe("Timeout in ms for action handlers. Default: 60000"),
+  connectionLivenessTimeout: external_exports.number().optional().describe(
+    "Timeout in ms for connection liveness checks. Default: 2500"
+  ),
+  connectionLivenessInterval: external_exports.number().optional().describe(
+    "Interval in ms between connection liveness checks. Default: 5000"
+  ),
+  noSleep: external_exports.boolean().optional().describe(
+    "Deprecated. If true, the actor will never sleep. Use c.keepAwake(promise) to scope keep-awake to a specific operation instead. Default: false"
+  ),
+  sleepTimeout: external_exports.number().optional().describe(
+    "Time in ms of inactivity before the actor sleeps. Default: 30000"
+  ),
+  maxQueueSize: external_exports.number().optional().describe(
+    "Maximum number of queue messages before rejecting new messages. Default: 1000"
+  ),
+  maxSchedules: external_exports.number().int().nonnegative().optional().describe(
+    "Maximum pending one-shot and recurring schedules before rejecting new schedules. Default: 1000"
+  ),
+  maxQueueMessageSize: external_exports.number().optional().describe(
+    "Maximum size of each queue message in bytes. Default: 65536"
+  ),
+  canHibernateWebSocket: external_exports.boolean().optional().describe(
+    "Whether WebSockets using onWebSocket can be hibernated. WebSockets using actions/events are hibernatable by default. Default: false"
+  )
+}).describe("Actor options for timeouts and behavior configuration.");
+var DocActorConfigSchema = external_exports.object({
+  state: external_exports.unknown().optional().describe(
+    "Initial state value for the actor. Cannot be used with createState."
+  ),
+  createState: external_exports.unknown().optional().describe(
+    "Function to create initial state. Receives context and input. Cannot be used with state."
+  ),
+  connState: external_exports.unknown().optional().describe(
+    "Initial connection state value. Cannot be used with createConnState."
+  ),
+  createConnState: external_exports.unknown().optional().describe(
+    "Function to create connection state. Receives context and connection params. The pending connection is not visible in c.conns until this succeeds. Cannot be used with connState."
+  ),
+  vars: external_exports.unknown().optional().describe(
+    "Initial ephemeral variables value. Cannot be used with createVars."
+  ),
+  createVars: external_exports.unknown().optional().describe(
+    "Function to create ephemeral variables. Receives context and driver context. Cannot be used with vars."
+  ),
+  db: external_exports.unknown().optional().describe("Database provider instance for the actor."),
+  onCreate: external_exports.unknown().optional().describe(
+    "Called when the actor is first initialized. Use to initialize state."
+  ),
+  onDestroy: external_exports.unknown().optional().describe("Called when the actor is destroyed."),
+  onMigrate: external_exports.unknown().optional().describe(
+    "Called on every actor start after persisted state loads and before onWake. Use for repeatable schema migrations."
+  ),
+  onWake: external_exports.unknown().optional().describe(
+    "Called when the actor wakes up and is ready to receive connections and actions."
+  ),
+  onSleep: external_exports.unknown().optional().describe(
+    "Called when the actor is stopping or sleeping. Use to clean up resources."
+  ),
+  run: external_exports.unknown().optional().describe(
+    "Called after actor starts. Does not block startup. Use for background tasks like queue processing or tick loops. If it exits, the actor follows the normal idle sleep timeout once idle. If it throws, the actor logs the error and then follows the normal idle sleep timeout once idle."
+  ),
+  onStateChange: external_exports.unknown().optional().describe(
+    "Called when the actor's state changes. State changes within this hook won't trigger recursion."
+  ),
+  onBeforeConnect: external_exports.unknown().optional().describe(
+    "Called before a client connects. Throw an error to reject the connection. The pending connection is not visible in c.conns while this runs."
+  ),
+  onConnect: external_exports.unknown().optional().describe(
+    "Called when a client successfully connects. The connection is visible in c.conns before this runs."
+  ),
+  onDisconnect: external_exports.unknown().optional().describe("Called when a client disconnects."),
+  onBeforeActionResponse: external_exports.unknown().optional().describe(
+    "Called before sending an action response. Use to transform output."
+  ),
+  onRequest: external_exports.unknown().optional().describe(
+    "Called for raw HTTP requests to /actors/{name}/http/* endpoints."
+  ),
+  onWebSocket: external_exports.unknown().optional().describe(
+    "Called for raw WebSocket connections to /actors/{name}/websocket/* endpoints."
+  ),
+  actions: external_exports.record(external_exports.string(), external_exports.unknown()).optional().describe(
+    "Tree of action names or nested groups to handler functions. Nested paths use dot-separated low-level action names. Defaults to an empty object."
+  ),
+  actionInputSchemas: external_exports.record(external_exports.string(), external_exports.unknown()).optional().describe(
+    "Optional schemas for validating action argument tuples in native runtimes. May mirror nested action groups or use dot-separated low-level action names."
+  ),
+  tracing: external_exports.unknown().optional().describe(
+    "Trace sampling for this actor: `sampler` is the share of its invocations that are recorded, from 0 to 1, with optional per-action rates under `actions`. A rate lowers what is recorded and never raises it. Defaults to the process sampler from OTEL_TRACES_SAMPLER."
+  ),
+  connParamsSchema: external_exports.unknown().optional().describe(
+    "Optional schema for validating connection params in native runtimes."
+  ),
+  events: external_exports.record(external_exports.string(), external_exports.unknown()).optional().describe("Map of event names to schemas."),
+  queues: external_exports.record(external_exports.string(), external_exports.unknown()).optional().describe("Map of queue names to schemas."),
+  options: DocActorOptionsSchema.optional()
+}).describe("Actor configuration passed to the actor() function.");
 
 // ../rivetkit/dist/tsup/chunk-JI6GZ2C2.js
 var EMPTY_KEY = "/";
@@ -15586,7 +15589,7 @@ function removePrefixFromKey(prefixedKey) {
   return prefixedKey.slice(KEYS.KV.length);
 }
 
-// ../rivetkit/dist/tsup/chunk-553CIQJY.js
+// ../rivetkit/dist/tsup/chunk-2CI2IEVN.js
 function logger() {
   return getLogger("actor-client");
 }
@@ -15707,7 +15710,7 @@ var AsyncMutex = class {
   }
 };
 
-// ../rivetkit/dist/tsup/chunk-5G2J26VM.js
+// ../rivetkit/dist/tsup/chunk-PYRI75DL.js
 var import_invariant2 = __toESM(require_invariant(), 1);
 
 // ../../../node_modules/.pnpm/p-retry@6.2.1/node_modules/p-retry/index.js
@@ -16922,7 +16925,7 @@ var TraceAPI = (
 // ../../../node_modules/.pnpm/@opentelemetry+api@1.9.0/node_modules/@opentelemetry/api/build/esm/trace-api.js
 var trace = TraceAPI.getInstance();
 
-// ../rivetkit/dist/tsup/chunk-5G2J26VM.js
+// ../rivetkit/dist/tsup/chunk-PYRI75DL.js
 var import_invariant3 = __toESM(require_invariant(), 1);
 var import_invariant4 = __toESM(require_invariant(), 1);
 var PATH_CONNECT = "/connect";
@@ -19396,7 +19399,8 @@ async function sendHttpRequest(opts) {
         {
           metadata: responseData.metadata,
           rayId: rayId ?? void 0,
-          actor: responseData.actor
+          actor: responseData.actor,
+          statusCode: response.status
         }
       );
     } catch (error46) {
@@ -20304,6 +20308,22 @@ var ActorHandleRaw = class {
       "dynamic actor resolution did not produce a direct actor id"
     );
   }
+  /** Issue a token scoped to this actor. Defaults to actor gateway read access. */
+  async issueToken(options = {}) {
+    const actorId = await this.resolve();
+    const permissions = options.permissions ?? {
+      actor_gateway: ["read"]
+    };
+    const grants = Object.keys(permissions).flatMap((resource) => {
+      const operations = permissions[resource];
+      return operations ? [{ resource, target: { id: actorId }, operations }] : [];
+    });
+    return this.#driver.issueToken({
+      subject: options.subject,
+      expiresIn: options.expiresIn,
+      grants
+    });
+  }
   /**
    * Returns the raw URL for routing traffic to the actor.
    */
@@ -20336,6 +20356,8 @@ var ACTOR_CONNS_SYMBOL = /* @__PURE__ */ Symbol("actorConns");
 var CREATE_ACTOR_CONN_PROXY = /* @__PURE__ */ Symbol("createActorConnProxy");
 var ClientRaw = class {
   #disposed = false;
+  /** Issue namespace-scoped tokens with an explicit grant list. */
+  auth;
   [ACTOR_CONNS_SYMBOL] = /* @__PURE__ */ new Set();
   #driver;
   #encodingKind;
@@ -20347,6 +20369,9 @@ var ClientRaw = class {
    */
   constructor(driver, options = {}) {
     this.#driver = driver;
+    this.auth = {
+      issueToken: (issueOptions) => this.#driver.issueToken(issueOptions)
+    };
     this.#encodingKind = options.encoding ?? "bare";
     this.#gatewayOptions = options.gateway ?? {};
     this.#currentActorInvocation = options.currentActorInvocation;
@@ -20638,6 +20663,72 @@ function createActorProxy(handle) {
     }
   });
 }
+function isInvalidToken(group, code) {
+  return group === "auth" && (code === "invalid_token" || code === "token_expired");
+}
+function isInvalidTokenResponse(response) {
+  if (response.status !== 401) return false;
+  const error46 = response.headers.get("x-rivet-error");
+  if (!error46) return false;
+  const separator = error46.indexOf(".");
+  return separator > 0 && isInvalidToken(error46.slice(0, separator), error46.slice(separator + 1));
+}
+var TokenProvider = class {
+  constructor(getToken) {
+    this.getToken = getToken;
+  }
+  #cached;
+  #pending;
+  #pendingForce = false;
+  async current() {
+    if (this.#cached && (this.#cached.expiresAt === void 0 || Date.now() < this.#cached.expiresAt - 5e3)) {
+      return this.#cached.token;
+    }
+    return this.#load(false);
+  }
+  /** A late rejection for an older token must never erase a newer credential. */
+  async refreshIfCurrent(failedToken) {
+    var _a2;
+    if (this.#pending !== void 0) {
+      const wasForced = this.#pendingForce;
+      const refreshed = await this.#pending;
+      if (wasForced || refreshed !== failedToken) return refreshed;
+    }
+    if (((_a2 = this.#cached) == null ? void 0 : _a2.token) !== failedToken) {
+      return this.current();
+    }
+    return this.#load(true);
+  }
+  #load(forceRefresh) {
+    if (this.#pending !== void 0) return this.#pending;
+    const pending = Promise.resolve().then(() => this.getToken({ forceRefresh })).then((token) => {
+      if (typeof token !== "string" || token.length === 0) {
+        throw new Error(
+          "getToken must resolve to a nonempty string"
+        );
+      }
+      this.#cached = { token, expiresAt: jwtExpiration(token) };
+      return token;
+    }).finally(() => {
+      if (this.#pending === pending) this.#pending = void 0;
+    });
+    this.#pending = pending;
+    this.#pendingForce = forceRefresh;
+    return pending;
+  }
+};
+function jwtExpiration(token) {
+  try {
+    const payload = token.split(".")[1];
+    if (!payload) return void 0;
+    const claims = JSON.parse(
+      atob(payload.replace(/-/g, "+").replace(/_/g, "/"))
+    );
+    return typeof claims.exp === "number" && Number.isSafeInteger(claims.exp) ? claims.exp * 1e3 : void 0;
+  } catch {
+    return void 0;
+  }
+}
 var CONNECT_SYMBOL = /* @__PURE__ */ Symbol("connect");
 var ActorConnRaw = class {
   #disposed = false;
@@ -20666,6 +20757,7 @@ var ActorConnRaw = class {
   /** Promise used to indicate the socket has connected successfully. This will be rejected if the connection fails. */
   #onOpenPromise;
   #websocket;
+  #authRetryAvailable = true;
   #client;
   #driver;
   #currentActorInvocation;
@@ -20911,6 +21003,10 @@ var ActorConnRaw = class {
     if (error46 instanceof ActorConnDisposed) {
       return false;
     }
+    if (error46 instanceof RivetError && isInvalidToken(error46.group, error46.code) && this.#driver.refreshAuthToken && this.#authRetryAvailable) {
+      this.#authRetryAvailable = false;
+      return true;
+    }
     if (error46 instanceof RivetError && this.#shouldReconnectForStaleActor(error46.group, error46.code)) {
       return true;
     }
@@ -21035,6 +21131,7 @@ var ActorConnRaw = class {
         messageQueueLength: this.#messageQueue.length,
         connId: this.#connId
       });
+      this.#authRetryAvailable = true;
       this.#setConnStatus("connected");
       if (this.#onOpenPromise) {
         this.#onOpenPromise.resolve(void 0);
@@ -21177,7 +21274,8 @@ var ActorConnRaw = class {
   }
   /** Called by the onclose event from drivers. */
   async #handleOnClose(event2) {
-    var _a2;
+    var _a2, _b, _c;
+    const failedSocket = this.#websocket;
     const closeEvent = event2;
     const wasClean = closeEvent.wasClean;
     const wasConnected = this.#connStatus === "connected";
@@ -21199,9 +21297,24 @@ var ActorConnRaw = class {
       const parsed = parseWebSocketCloseReason(reason);
       if (parsed) {
         const { group, code, rayId } = parsed;
+        if (isInvalidToken(group, code) && closeEvent.code === 1008 && failedSocket) {
+          try {
+            if (!await ((_b = (_a2 = this.#driver).refreshAuthToken) == null ? void 0 : _b.call(
+              _a2,
+              failedSocket
+            ))) {
+              this.#authRetryAvailable = false;
+            }
+          } catch {
+            logger().warn("token renewal failed");
+            this.#authRetryAvailable = false;
+          }
+        } else if (isInvalidToken(group, code)) {
+          this.#authRetryAvailable = false;
+        }
         if (this.#shouldReconnectForStaleActor(group, code)) {
           this.#clearResolvedActorIdentity();
-          (_a2 = this.#onOpenPromise) == null ? void 0 : _a2.reject(
+          (_c = this.#onOpenPromise) == null ? void 0 : _c.reject(
             new RivetError(
               group,
               code,
@@ -21248,7 +21361,7 @@ var ActorConnRaw = class {
       if (error46 instanceof RivetError) {
         this.#dispatchActorError(error46);
       }
-      if (wasConnected) {
+      if (wasConnected && this.#authRetryAvailable) {
         logger().debug({
           msg: "triggering reconnect",
           connId: this.#connId
@@ -21717,6 +21830,23 @@ var ActorConnRaw = class {
     );
   }
 };
+var ENGINE_HOST = "127.0.0.1";
+var ENGINE_PORT = 6420;
+var ENGINE_ENDPOINT = buildEngineEndpoint(ENGINE_HOST, ENGINE_PORT);
+function buildEngineEndpoint(host, port) {
+  const urlHost = host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
+  return `http://${urlHost}:${port}`;
+}
+function isLocalEngineEndpoint(endpoint) {
+  let url2;
+  try {
+    url2 = new URL(endpoint);
+  } catch {
+    return false;
+  }
+  const hostname3 = url2.hostname.toLowerCase();
+  return hostname3 === "localhost" || hostname3 === "0.0.0.0" || hostname3 === "::" || hostname3 === "[::]" || hostname3 === "::1" || hostname3 === "[::1]" || /^127(?:\.\d{1,3}){0,3}$/.test(hostname3);
+}
 function tryParseEndpoint(ctx, options) {
   const {
     endpoint,
@@ -21811,6 +21941,8 @@ var ClientConfigSchemaBase = v4_default.object({
   }),
   /** Token to use to authenticate with the API. */
   token: v4_default.string().optional().transform((val) => val ?? getRivetToken()),
+  /** Issue and renew a client token on demand. Overrides the static token when provided. */
+  getToken: v4_default.custom().optional(),
   /** Namespace to connect to. */
   namespace: v4_default.string().optional().transform((val) => val ?? getRivetNamespace()),
   /** Name of the envoy pool. This is used to group together envoys in to different pools. */
@@ -21855,7 +21987,7 @@ function transformClientConfig(config3, ctx) {
     ...config3,
     endpoint: parsedEndpoint == null ? void 0 : parsedEndpoint.endpoint,
     namespace: (parsedEndpoint == null ? void 0 : parsedEndpoint.namespace) ?? config3.namespace ?? "default",
-    token: (parsedEndpoint == null ? void 0 : parsedEndpoint.token) ?? config3.token
+    token: (parsedEndpoint == null ? void 0 : parsedEndpoint.token) ?? config3.token ?? (config3.endpoint && isLocalEngineEndpoint(config3.endpoint) ? "default" : void 0)
   };
 }
 function convertRegistryConfigToClientConfig(config3) {
@@ -21863,6 +21995,7 @@ function convertRegistryConfigToClientConfig(config3) {
   return {
     endpoint: config3.endpoint,
     token: config3.token,
+    getToken: void 0,
     namespace: config3.namespace,
     poolName: config3.envoy.poolName,
     headers: config3.headers,
@@ -22194,7 +22327,8 @@ async function openWebSocketToGateway(runConfig, gatewayUrl, encoding, params, o
   const ackHookToken = typeof process !== "undefined" && process.env.VITEST ? crypto.randomUUID() : void 0;
   logger2().debug({
     msg: "opening websocket to actor via guard",
-    gatewayUrl
+    // Gateway URLs can embed credentials; never include the path or query in logs.
+    origin: new URL(gatewayUrl).origin
   });
   const ws = new WebSocket2(
     gatewayUrl,
@@ -22284,6 +22418,14 @@ async function apiCall(config3, method2, path2, body) {
     responseFromBare: (value) => value
   });
 }
+async function issueToken(config3, options) {
+  return apiCall(config3, "POST", "/auth/tokens", {
+    namespace: config3.namespace,
+    subject: options.subject,
+    duration: options.expiresIn,
+    grants: options.grants
+  });
+}
 async function getActor(config3, _, actorId) {
   return apiCall(
     config3,
@@ -22525,6 +22667,8 @@ function closeWebSocketIfOpen(ws, code, reason) {
 var RemoteEngineControlClient = class {
   #config;
   #metadataPromise;
+  #tokenProvider;
+  #webSocketTokens = /* @__PURE__ */ new WeakMap();
   constructor(runConfig) {
     if (getNextPhase() === "phase-production-build") {
       logger2().info(
@@ -22533,6 +22677,8 @@ var RemoteEngineControlClient = class {
       runConfig.disableMetadataLookup = true;
     }
     this.#config = { ...runConfig };
+    if (runConfig.getToken)
+      this.#tokenProvider = new TokenProvider(runConfig.getToken);
     if (!runConfig.disableMetadataLookup) {
       this.#metadataPromise = lookupMetadataCached(this.#config).then(
         (metadataData) => {
@@ -22541,14 +22687,13 @@ var RemoteEngineControlClient = class {
             if (metadataData.clientNamespace) {
               this.#config.namespace = metadataData.clientNamespace;
             }
-            if (metadataData.clientToken) {
+            if (metadataData.clientToken && !this.#tokenProvider) {
               this.#config.token = metadataData.clientToken;
             }
             logger2().info({
               msg: "overriding client endpoint",
               endpoint: metadataData.clientEndpoint,
-              namespace: metadataData.clientNamespace,
-              token: metadataData.clientToken
+              namespace: metadataData.clientNamespace
             });
           }
           logger2().info({
@@ -22561,12 +22706,47 @@ var RemoteEngineControlClient = class {
       );
     }
   }
+  async #authorizedConfig() {
+    if (!this.#tokenProvider) return this.#config;
+    return { ...this.#config, token: await this.#tokenProvider.current() };
+  }
+  async #withCredential(request, readOnly = false) {
+    const config3 = await this.#authorizedConfig();
+    try {
+      return await request(config3);
+    } catch (error46) {
+      if (this.#tokenProvider && config3.token && error46 instanceof RivetError && error46.statusCode === 401 && isInvalidToken(error46.group, error46.code)) {
+        if (readOnly) {
+          const token = await this.#tokenProvider.refreshIfCurrent(
+            config3.token
+          );
+          return request({ ...this.#config, token });
+        }
+        await this.#tokenProvider.refreshIfCurrent(config3.token);
+      }
+      throw error46;
+    }
+  }
+  async issueToken(options) {
+    await this.#metadataPromise;
+    const response = await this.#withCredential(
+      (config3) => issueToken(config3, options)
+    );
+    return {
+      token: response.token,
+      issuedAt: response.issued_ts,
+      expiresAt: response.expires_ts
+    };
+  }
   async getForId({
     name,
     actorId
   }) {
     await this.#metadataPromise;
-    const response = await getActor(this.#config, name, actorId);
+    const response = await this.#withCredential(
+      (config3) => getActor(config3, name, actorId),
+      true
+    );
     const actor2 = response.actors[0];
     if (!actor2) return void 0;
     if (actor2.name !== name) {
@@ -22587,7 +22767,10 @@ var RemoteEngineControlClient = class {
     await this.#metadataPromise;
     logger2().debug({ msg: "getWithKey: searching for actor", name, key });
     try {
-      const response = await getActorByKey(this.#config, name, key);
+      const response = await this.#withCredential(
+        (config3) => getActorByKey(config3, name, key),
+        true
+      );
       const actor2 = response.actors[0];
       if (!actor2) return void 0;
       logger2().debug({
@@ -22620,16 +22803,18 @@ var RemoteEngineControlClient = class {
       key
     });
     try {
-      const { actor: actor2, created } = await getOrCreateActor(this.#config, {
-        datacenter: region,
-        name,
-        key: serializeActorKey(key),
-        runner_name_selector: poolName ?? this.#config.poolName,
-        input: actorInput ? uint8ArrayToBase642(
-          encodeCborCompat(actorInput)
-        ) : void 0,
-        crash_policy: crashPolicy ?? "sleep"
-      });
+      const { actor: actor2, created } = await this.#withCredential(
+        (config3) => getOrCreateActor(config3, {
+          datacenter: region,
+          name,
+          key: serializeActorKey(key),
+          runner_name_selector: poolName ?? this.#config.poolName,
+          input: actorInput ? uint8ArrayToBase642(
+            encodeCborCompat(actorInput)
+          ) : void 0,
+          crash_policy: crashPolicy ?? "sleep"
+        })
+      );
       logger2().info({
         msg: "getOrCreateWithKey: actor ready",
         actorId: actor2.actor_id,
@@ -22645,7 +22830,10 @@ var RemoteEngineControlClient = class {
           name,
           key
         });
-        const response = await getActorByKey(this.#config, name, key);
+        const response = await this.#withCredential(
+          (config3) => getActorByKey(config3, name, key),
+          true
+        );
         const existing = response.actors[0];
         if (!existing) throw error46;
         logger2().info({
@@ -22669,14 +22857,18 @@ var RemoteEngineControlClient = class {
   }) {
     await this.#metadataPromise;
     logger2().info({ msg: "creating actor via engine api", name, key });
-    const result = await createActor(this.#config, {
-      datacenter: region,
-      name,
-      runner_name_selector: poolName ?? this.#config.poolName,
-      key: serializeActorKey(key),
-      input: input ? uint8ArrayToBase642(encodeCborCompat(input)) : void 0,
-      crash_policy: crashPolicy ?? "sleep"
-    });
+    const result = await this.#withCredential(
+      (config3) => createActor(config3, {
+        datacenter: region,
+        name,
+        runner_name_selector: poolName ?? this.#config.poolName,
+        key: serializeActorKey(key),
+        input: input ? uint8ArrayToBase642(
+          encodeCborCompat(input)
+        ) : void 0,
+        crash_policy: crashPolicy ?? "sleep"
+      })
+    );
     logger2().info({
       msg: "actor created",
       actorId: result.actor.actor_id,
@@ -22688,43 +22880,61 @@ var RemoteEngineControlClient = class {
   async listActors({ name }) {
     await this.#metadataPromise;
     logger2().debug({ msg: "listing actors via engine api", name });
-    const response = await listActorsByName(this.#config, name);
+    const response = await this.#withCredential(
+      (config3) => listActorsByName(config3, name),
+      true
+    );
     return response.actors.map(apiActorToOutput);
   }
   async destroyActor(actorId) {
     await this.#metadataPromise;
     logger2().info({ msg: "destroying actor via engine api", actorId });
-    await destroyActor(this.#config, actorId);
+    await this.#withCredential((config3) => destroyActor(config3, actorId));
     logger2().info({ msg: "actor destroyed", actorId });
   }
   async sendRequest(target, actorRequest, options = {}) {
+    var _a2;
     await this.#metadataPromise;
-    const path2 = requestPath(actorRequest);
-    const gatewayUrl = this.#buildGatewayUrlForTarget(
-      target,
-      path2,
-      options
-    );
+    const config3 = await this.#authorizedConfig();
     const httpOptions = {
       ...options,
       directActorId: shouldSkipReadyWait(options) ? directActorIdFromTarget(target) : void 0
     };
-    return sendHttpRequestToGateway(
-      this.#config,
-      gatewayUrl,
+    const send = (current) => sendHttpRequestToGateway(
+      current,
+      this.#buildGatewayUrlForTarget(
+        current,
+        target,
+        requestPath(actorRequest),
+        options
+      ),
       actorRequest,
       httpOptions
     );
+    const response = await send(config3);
+    if (!this.#tokenProvider || !config3.token || !isInvalidTokenResponse(response))
+      return response;
+    if ((actorRequest.method === "GET" || actorRequest.method === "HEAD") && !("getOrCreateForKey" in target)) {
+      const token = await this.#tokenProvider.refreshIfCurrent(
+        config3.token
+      );
+      await ((_a2 = response.body) == null ? void 0 : _a2.cancel());
+      return send({ ...this.#config, token });
+    }
+    await this.#tokenProvider.refreshIfCurrent(config3.token);
+    return response;
   }
   async openWebSocket(path2, target, encoding, params, options = {}) {
     await this.#metadataPromise;
+    const config3 = await this.#authorizedConfig();
     const gatewayUrl = this.#buildGatewayUrlForTarget(
+      config3,
       target,
       path2,
       options
     );
-    return openWebSocketToGateway(
-      this.#config,
+    const ws = await openWebSocketToGateway(
+      config3,
       gatewayUrl,
       encoding,
       params,
@@ -22733,25 +22943,59 @@ var RemoteEngineControlClient = class {
         directActorId: shouldSkipReadyWait(options) ? directActorIdFromTarget(target) : void 0
       }
     );
+    this.#watchWebSocketAuth(ws, config3.token);
+    return ws;
+  }
+  async refreshAuthToken(ws) {
+    const context2 = this.#webSocketTokens.get(ws);
+    if (!(context2 == null ? void 0 : context2.refresh)) return false;
+    await context2.refresh;
+    return true;
+  }
+  #watchWebSocketAuth(ws, token) {
+    const tokenProvider = this.#tokenProvider;
+    if (!tokenProvider || !token) return;
+    const context2 = {};
+    this.#webSocketTokens.set(ws, context2);
+    ws.addEventListener(
+      "close",
+      (event2) => {
+        if (event2.code !== 1008 || !event2.reason) return;
+        const separator = event2.reason.indexOf(".");
+        if (separator < 0) return;
+        const code = event2.reason.slice(separator + 1).split(/[\s:#]/, 1)[0];
+        if (isInvalidToken(event2.reason.slice(0, separator), code)) {
+          context2.refresh = tokenProvider.refreshIfCurrent(token).catch((error46) => {
+            logger2().warn(
+              "failed to renew authentication token"
+            );
+            throw error46;
+          });
+          context2.refresh.catch(() => {
+          });
+        }
+      }
+    );
   }
   async buildGatewayUrl(target, options = {}) {
     await this.#metadataPromise;
-    return this.#buildGatewayUrlForTarget(target, "", options);
+    return this.#buildGatewayUrlForTarget(
+      await this.#authorizedConfig(),
+      target,
+      "",
+      options
+    );
   }
   async proxyRequest(_c, actorRequest, actorId) {
-    await this.#metadataPromise;
-    const gatewayUrl = this.#buildGatewayUrlForTarget(
-      { directId: actorId },
-      requestPath(actorRequest)
-    );
-    return sendHttpRequestToGateway(this.#config, gatewayUrl, actorRequest);
+    return this.sendRequest({ directId: actorId }, actorRequest);
   }
   async proxyWebSocket(c, path2, actorId, encoding, params) {
-    var _a2, _b;
+    var _a2;
     await this.#metadataPromise;
-    const upgradeWebSocket = (_b = (_a2 = this.#config).getUpgradeWebSocket) == null ? void 0 : _b.call(_a2);
+    const config3 = await this.#authorizedConfig();
+    const upgradeWebSocket = (_a2 = config3.getUpgradeWebSocket) == null ? void 0 : _a2.call(config3);
     (0, import_invariant4.default)(upgradeWebSocket, "missing getUpgradeWebSocket");
-    const endpoint = getEndpoint(this.#config);
+    const endpoint = getEndpoint(config3);
     const guardUrl = combineUrlPath(endpoint, path2);
     const wsGuardUrl = guardUrl.replace("http://", "ws://");
     logger2().debug({
@@ -22761,7 +23005,7 @@ var RemoteEngineControlClient = class {
       guardUrl
     });
     const protocols = buildWebSocketProtocols(
-      this.#config,
+      config3,
       encoding,
       params,
       void 0,
@@ -22779,8 +23023,8 @@ var RemoteEngineControlClient = class {
   setGetUpgradeWebSocket(getUpgradeWebSocket) {
     this.#config.getUpgradeWebSocket = getUpgradeWebSocket;
   }
-  #buildGatewayUrlForTarget(target, path2, options = {}) {
-    const endpoint = getEndpoint(this.#config);
+  #buildGatewayUrlForTarget(config3, target, path2, options = {}) {
+    const endpoint = getEndpoint(config3);
     if (shouldSkipReadyWait(options) && directActorIdFromTarget(target) && canUseDirectSkipReadyWaitPath(path2)) {
       return combineUrlPath(endpoint, path2);
     }
@@ -22788,7 +23032,7 @@ var RemoteEngineControlClient = class {
       return buildActorGatewayUrl(
         endpoint,
         target.directId,
-        this.#config.token,
+        config3.token,
         path2
       );
     }
@@ -22796,20 +23040,20 @@ var RemoteEngineControlClient = class {
       return buildActorGatewayUrl(
         endpoint,
         target.getForId.actorId,
-        this.#config.token,
+        config3.token,
         path2
       );
     }
     if ("getForKey" in target || "getOrCreateForKey" in target) {
       return buildActorQueryGatewayUrl(
         endpoint,
-        this.#config.namespace,
+        config3.namespace,
         target,
-        this.#config.token,
+        config3.token,
         path2,
-        this.#config.maxInputSize,
+        config3.maxInputSize,
         void 0,
-        "getOrCreateForKey" in target ? target.getOrCreateForKey.poolName ?? this.#config.poolName : void 0,
+        "getOrCreateForKey" in target ? target.getOrCreateForKey.poolName ?? config3.poolName : void 0,
         options
       );
     }
@@ -22858,7 +23102,7 @@ function apiActorToOutput(actor2) {
   };
 }
 
-// ../rivetkit/dist/tsup/chunk-W2PXGWMR.js
+// ../rivetkit/dist/tsup/chunk-5EGLHQJJ.js
 var nativeStateTransactionOpeners = /* @__PURE__ */ new WeakMap();
 var nativeStateTransactionClientBinders = /* @__PURE__ */ new WeakMap();
 function registerNativeStateTransactionOpener(provider, opener) {
@@ -24600,23 +24844,6 @@ var InlineWebSocketAdapter = class {
     }
   }
 };
-var ENGINE_HOST = "127.0.0.1";
-var ENGINE_PORT = 6420;
-var ENGINE_ENDPOINT = buildEngineEndpoint(ENGINE_HOST, ENGINE_PORT);
-function buildEngineEndpoint(host, port) {
-  const urlHost = host.includes(":") && !host.startsWith("[") ? `[${host}]` : host;
-  return `http://${urlHost}:${port}`;
-}
-function isLocalEngineEndpoint(endpoint) {
-  let url2;
-  try {
-    url2 = new URL(endpoint);
-  } catch {
-    return false;
-  }
-  const hostname3 = url2.hostname.toLowerCase();
-  return hostname3 === "localhost" || hostname3 === "0.0.0.0" || hostname3 === "::" || hostname3 === "[::]" || hostname3 === "::1" || hostname3 === "[::1]" || /^127(?:\.\d{1,3}){0,3}$/.test(hostname3);
-}
 function logger22() {
   return getLogger("registry");
 }
@@ -24714,20 +24941,9 @@ async function configureServerlessPool(config3) {
   });
   throw lastError;
 }
-var warnedMissingVersion = false;
 var EnvoyConfigSchema = external_exports.object({
   poolName: external_exports.string().default(() => getRivetPool() ?? "default"),
-  version: external_exports.number().default(() => {
-    const version2 = getRivetEnvoyVersion();
-    if (version2 !== void 0) return version2;
-    if (getNodeEnv() === "production" && !warnedMissingVersion) {
-      warnedMissingVersion = true;
-      getLogger("rivetkit").error(
-        "RIVET_ENVOY_VERSION is not set. Actors will not be versioned, which means they won't be drained on deploy. This is only needed when self-hosting or using a custom envoy (not needed for Rivet Compute). Set this as a build arg in your Dockerfile. See https://rivet.dev/docs/actors/versions"
-      );
-    }
-    return 1;
-  }),
+  version: external_exports.number().default(() => getRivetEnvoyVersion() ?? 1),
   // Deprecated.
   totalSlots: external_exports.number().default(() => getRivetTotalSlots() ?? 1e5),
   envoyKey: external_exports.string().optional()
@@ -25027,7 +25243,7 @@ var RegistryConfigSchema = external_exports.object({
     config3.startEngine || parsedEndpoint
   );
   const namespace = (parsedEndpoint == null ? void 0 : parsedEndpoint.namespace) ?? config3.namespace ?? "default";
-  const token = (parsedEndpoint == null ? void 0 : parsedEndpoint.token) ?? config3.token ?? "dev";
+  const token = (parsedEndpoint == null ? void 0 : parsedEndpoint.token) ?? config3.token ?? (endpoint && isLocalEngineEndpoint(endpoint) ? "default" : void 0);
   const parsedPublicEndpoint = config3.serverless.publicEndpoint ? tryParseEndpoint(ctx, {
     endpoint: config3.serverless.publicEndpoint,
     path: ["serverless", "publicEndpoint"]
@@ -31992,7 +32208,23 @@ var Registry = class {
    * Starts an actor envoy for standalone server deployments.
    */
   #startEnvoy(config3, printWelcome) {
+    var _a2;
     if (!this.#runtimeServePromise) {
+      const configuredEnvoyVersion = (_a2 = this.#config.envoy) == null ? void 0 : _a2.version;
+      const envoyVersionSource = configuredEnvoyVersion !== void 0 ? "config" : getRivetEnvoyVersion() !== void 0 ? "environment" : "default";
+      logger22().info({
+        msg: "starting rivetkit envoy",
+        rivetkitVersion: VERSION,
+        envoyVersion: config3.envoy.version,
+        envoyVersionSource
+      });
+      if (envoyVersionSource === "default" && getNodeEnv() === "production") {
+        logger22().error({
+          msg: "envoy version defaulted because neither config.envoy.version nor RIVET_ENVOY_VERSION is set; actors will not drain automatically across deploys. See https://rivet.dev/docs/actors/versions",
+          envoyVersion: config3.envoy.version,
+          envoyVersionSource
+        });
+      }
       const configuredRegistryPromise = this.#buildConfiguredRegistry(config3);
       this.#runtimeServeConfiguredPromise = configuredRegistryPromise;
       this.#runtimeServeLifecyclePromise = configuredRegistryPromise.then(