@voltro/protocol 0.32.0 → 0.34.0

package/dist/index.js

@@ -1,9 +1,9 @@
-import { C as e, D as t, E as n, O as r, S as i, T as a, _ as o, a as ee, b as te, c as ne, d as re, f as ie, g as ae, h as oe, i as se, l as ce, m as le, n as ue, o as de, p as s, r as fe, s as pe, t as me, u as he, v as ge, w as _e, x as ve, y as ye } from "./serverErrorBus-C3JTqgIc.js";
-import { a as be, c as xe, d as Se, f as Ce, i as we, l as Te, n as Ee, o as De, p as Oe, r as ke, s as Ae, t as je, u as Me } from "./auth-CXMrvPyX.js";
-import { Context as Ne, Layer as Pe, Schema as c } from "effect";
+import { A as e, B as t, C as n, D as r, E as i, F as a, H as ee, I as te, L as ne, M as re, N as ie, O as ae, P as oe, R as o, S as se, T as s, U as ce, V as le, _ as ue, a as de, b as fe, c as pe, d as me, f as he, g as ge, h as _e, i as ve, j as ye, k as be, l as xe, m as Se, n as Ce, o as we, p as Te, r as Ee, s as De, t as Oe, u as ke, v as Ae, w as je, x as Me, y as Ne, z as Pe } from "./auth-B6YZuSBr.js";
+import { a as Fe, c as Ie, i as Le, n as Re, o as ze, r as Be, s as Ve, t as He } from "./serverErrorBus-BeN9pOpY.js";
+import { Context as Ue, Layer as We, Schema as c } from "effect";
 import { Rpc as l } from "@effect/rpc";
 //#region src/rowPatch.ts
-var Fe = c.Union(c.String, c.Number), u = c.Record({
+var Ge = c.Union(c.String, c.Number), u = c.Record({
 	key: c.String,
 	value: c.Unknown
 }).pipe(c.filter((e) => "id" in e, { message: () => "patch row must carry an id" })), d = c.Union(c.Struct({
@@ -19,12 +19,12 @@ var Fe = c.Union(c.String, c.Number), u = c.Record({
 	path: c.String
 })), f = c.Struct({
 	ops: c.Array(d),
-	order: c.Array(Fe)
-}), p = (e) => `/${String(e).replace(/~/g, "~0").replace(/\//g, "~1")}`, Ie = (e) => (e.startsWith("/") ? e.slice(1) : e).replace(/~1/g, "/").replace(/~0/g, "~"), m = (e) => {
+	order: c.Array(Ge)
+}), p = (e) => `/${String(e).replace(/~/g, "~0").replace(/\//g, "~1")}`, Ke = (e) => (e.startsWith("/") ? e.slice(1) : e).replace(/~1/g, "/").replace(/~0/g, "~"), m = (e) => {
 	let t = Object.keys(e).sort(), n = {};
 	for (let r of t) n[r] = e[r];
 	return JSON.stringify(n);
-}, Le = (e, t) => m(e) === m(t), Re = (e, t) => {
+}, qe = (e, t) => m(e) === m(t), Je = (e, t) => {
 	let n = /* @__PURE__ */ new Map();
 	for (let t of e) n.set(t.id, t);
 	let r = [], i = [], a = /* @__PURE__ */ new Set();
@@ -35,7 +35,7 @@ var Fe = c.Union(c.String, c.Number), u = c.Record({
 			op: "add",
 			path: p(e.id),
 			value: e
-		}) : Le(t, e) || r.push({
+		}) : qe(t, e) || r.push({
 			op: "replace",
 			path: p(e.id),
 			value: e
@@ -49,10 +49,10 @@ var Fe = c.Union(c.String, c.Number), u = c.Record({
 		ops: r,
 		order: i
 	};
-}, ze = (e) => e.every((e) => {
+}, Ye = (e) => e.every((e) => {
 	let t = e.id;
 	return typeof t == "string" || typeof t == "number";
-}), Be = (e, t) => {
+}), Xe = (e, t) => {
 	let n = /* @__PURE__ */ new Map();
 	for (let t of e) n.set(t.id, t);
 	for (let e of t.ops) (e.op === "add" || e.op === "replace") && n.set(e.value.id, e.value);
@@ -62,7 +62,7 @@ var Fe = c.Union(c.String, c.Number), u = c.Record({
 		t !== void 0 && r.push(t);
 	}
 	return r;
-}, Ve = (e) => c.Union(c.Struct({
+}, h = (e) => c.Union(c.Struct({
 	_tag: c.Literal("snapshot"),
 	revision: c.Number,
 	data: e,
@@ -76,7 +76,7 @@ var Fe = c.Union(c.String, c.Number), u = c.Record({
 	_tag: c.Literal("error"),
 	error: c.Unknown,
 	revision: c.optional(c.Number)
-})), h = class extends c.TaggedError()("BusinessRuleViolation", {
+})), g = class extends c.TaggedError()("BusinessRuleViolation", {
 	rule: c.String,
 	params: c.optional(c.Record({
 		key: c.String,
@@ -85,59 +85,155 @@ var Fe = c.Union(c.String, c.Number), u = c.Record({
 	field: c.optional(c.String),
 	message: c.optional(c.String),
 	severity: c.Literal("error", "warning")
-}) {}, He = (e) => e.internal !== !0, g = (e) => {
-	if (Array.isArray(e.guards) && e.guards.length === 0) throw Error(`${e.name}: \`guards: []\` is empty, so it enforces nothing — but it reads\n  at the call site as if this procedure were protected. Omit the field for an
+}) {}, _ = class extends c.TaggedError()("ApprovalRequired", {
+	approvalId: c.String,
+	procedure: c.String,
+	expiresAt: c.String,
+	requiredScopes: c.Array(c.String),
+	reason: c.NullOr(c.String),
+	created: c.Boolean
+}) {}, v = class extends c.TaggedError()("ApprovalNotFound", { approvalId: c.String }) {}, y = class extends c.TaggedError()("ApprovalSelfApproval", {
+	approvalId: c.String,
+	subjectId: c.NullOr(c.String)
+}) {}, b = class extends c.TaggedError()("ApprovalRejected", {
+	approvalId: c.String,
+	decidedBy: c.NullOr(c.String),
+	note: c.NullOr(c.String)
+}) {}, x = class extends c.TaggedError()("ApprovalExpired", {
+	approvalId: c.String,
+	expiredAt: c.String
+}) {}, S = class extends c.TaggedError()("ApprovalNotPending", {
+	approvalId: c.String,
+	status: c.String
+}) {}, C = class extends c.TaggedError()("ApprovalForbidden", {
+	approvalId: c.String,
+	required: c.NullOr(c.String),
+	message: c.String
+}) {}, w = class extends c.TaggedError()("ApprovalUnavailable", {
+	procedure: c.String,
+	message: c.String
+}) {}, T = c.Union(_, b, x, w), E = c.Union(v, y, x, S, C, w), D = c.Struct({
+	id: c.String,
+	procedure: c.String,
+	kind: c.Literal("mutation", "action"),
+	requestedBy: c.NullOr(c.String),
+	status: c.Literal("pending", "approved", "rejected", "expired", "consumed"),
+	reason: c.NullOr(c.String),
+	requiredScopes: c.Array(c.String),
+	requestedAt: c.String,
+	expiresAt: c.String,
+	decidedBy: c.NullOr(c.String),
+	decidedAt: c.NullOr(c.String),
+	note: c.NullOr(c.String),
+	relation: c.Literal("to-decide", "requested")
+}), O = "channel:", k = Symbol.for("@voltro/protocol/reactivityChannels"), A = globalThis, j = A[k] ?? (A[k] = /* @__PURE__ */ new Map()), Ze = /^[a-z][a-z0-9-]*(\.[a-z0-9-]+)*$/, Qe = (e) => {
+	if (!Ze.test(e)) throw Error(`reactivityChannel('${e}'): invalid channel name.\n  Use lowercase kebab segments separated by dots — \`presence\`, \`job-queue\`,
+  \`billing.usage\`. A \`:\` is refused because it is the namespace separator in
+  the routing key (\`${O}<name>\`), and an uppercase letter is\n  refused because a key that differs only by case reads as one channel and
+  routes as two.`);
+	let t = j.get(e);
+	if (t !== void 0) return t;
+	let n = `${O}${e}`, r = Object.freeze({
+		kind: "reactivity-channel",
+		name: e,
+		key: n,
+		toString: () => n
+	});
+	return j.set(e, r), r;
+}, M = (e) => typeof e == "object" && !!e && e.kind === "reactivity-channel", N = (e) => e.startsWith(O), P = () => new Set([...j.values()].map((e) => e.key)), F = (e) => M(e) ? e.key : e, I = (e) => e === void 0 ? [] : Array.isArray(e) ? e.map(F) : [F(e)], L = (e) => e === void 0 ? void 0 : Array.isArray(e) ? e.map(F) : F(e), $e = (e) => {
+	let t = P(), n = [];
+	for (let r of e) for (let e of I(r.source)) !N(e) || t.has(e) || n.push({
+		procedure: r.name,
+		key: e
+	});
+	return n;
+}, et = (e, t) => {
+	let n = e?.injectExternalChange;
+	return n === void 0 ? !1 : (n.call(e, {
+		table: t.key,
+		op: "update",
+		new: {},
+		old: {}
+	}), !0);
+}, tt = (e) => e.internal !== !0, R = (e) => {
+	if (nt(e), Array.isArray(e.guards) && e.guards.length === 0) throw Error(`${e.name}: \`guards: []\` is empty, so it enforces nothing — but it reads\n  at the call site as if this procedure were protected. Omit the field for an
   unguarded procedure, or list the scopes required to call it.`);
 	let t = typeof e.source == "string" ? [e.source] : Array.isArray(e.source) ? e.source : void 0;
 	if (t !== void 0 && (t.length === 0 || t.some((e) => String(e).trim() === ""))) throw Error(`${e.name}: \`source\` is empty, so this query declares reactivity and\n  subscribes to nothing — it serves one snapshot and never updates again,
   which is indistinguishable from "nothing changed". Name the table(s) it
   reads, or omit \`source\` for a non-reactive query.`);
 	if (e.internal !== !0) return e;
+	if (e.openAccess !== void 0) throw Error(`${e.name}: \`internal: true\` cannot be combined with \`openAccess\`.\n  \`internal\` takes the procedure OFF the wire, and \`openAccess\` declares who may
+  call it there — together they describe a decision about a surface that does not
+  exist. Drop \`openAccess\` (an internal procedure needs no wire decision), or drop
+  \`internal: true\` if the procedure really is meant to be callable.`);
 	if (e.overridesPlugin === !0) throw Error(`${e.name}: \`internal: true\` cannot be combined with \`overridesPlugin\`.\n  The override REMOVES the plugin route, and an internal procedure is not
   wire-reachable — so the plugin's route would vanish with nothing callable
   in its place, and callers would get a 404 for something that used to work.`);
 	let n = [e.publicApi === void 0 ? void 0 : "publicApi", e.exposeAsTool === void 0 ? void 0 : "exposeAsTool"].filter((e) => e !== void 0);
 	if (n.length === 0) return e;
 	throw Error(`${e.name}: \`internal: true\` cannot be combined with ${n.map((e) => `\`${e}\``).join(" or ")}. \`internal\` takes the procedure OFF the wire; those put it back ON a different one (${n.includes("publicApi") ? "a REST route" : "an agent tool"}), and that surface is projected without consulting the flag — so the procedure would be unreachable from your client and reachable from the internet. Drop \`internal: true\` if the wider surface is intended, or remove the ${n.join(" / ")} annotation if it is not.`);
-}, Ue = (e) => e.action !== void 0 && e.resourceType !== void 0, _ = (e) => g({
+}, nt = (e) => {
+	let t = e.requiresApproval;
+	if (t !== void 0) {
+		if (!Array.isArray(t.approvers) || t.approvers.length === 0) throw Error(`${e.name}: \`requiresApproval.approvers\` is empty, so NOBODY can approve this\n  procedure and every call would park forever. Name the scope(s) an approver must hold
+  — e.g. \`approvers: [{ scope: 'invoices:approve' }]\`.`);
+		if (e.openAccess !== void 0) throw Error(`${e.name}: \`requiresApproval\` cannot be combined with \`openAccess\`.\n  The self-approval refusal compares subject ids, and an unauthenticated caller has
+  none — so on an open procedure every anonymous caller would count as a DIFFERENT
+  human from every other, and the second-pair-of-eyes control would enforce nothing.
+  Give the procedure a \`guards:\` decision, or drop \`requiresApproval\`.`);
+	}
+}, rt = (e) => e.action !== void 0 && e.resourceType !== void 0, it = (e) => e.openAccess !== void 0 || e.guards !== void 0 && e.guards.length > 0, z = (e, t, n) => {
+	if (n === void 0) return t;
+	if (n.trim() === "") throw Error(`${e}: \`openAccess\` needs a REASON, not an empty string. It is the sentence a\n  reviewer reads to decide whether this procedure should really be callable
+  without an authorization check — e.g. \`openAccess: 'public pricing, no caller data'\`.`);
+	if (t !== void 0 && t.length > 0) throw Error(`${e}: \`openAccess\` and \`guards\` are two different access decisions, so\n  declaring both says the procedure is protected AND open. Keep the guards if a
+  caller must hold a scope; drop them if anyone may call it.`);
+	return [o(n.trim())];
+}, B = (e) => R({
 	kind: "query",
 	name: e.name,
 	input: e.input,
 	output: e.output,
 	error: e.error ?? c.Never,
-	source: e.source,
+	source: L(e.source),
 	cache: e.cache,
-	guards: e.guards,
+	guards: z(e.name, e.guards, e.openAccess),
+	openAccess: e.openAccess,
 	publicApi: e.publicApi,
 	exposeAsTool: e.exposeAsTool,
 	internal: e.internal,
 	overridesPlugin: e.overridesPlugin
-}), v = (e) => g({
+}), V = (e) => R({
 	kind: "mutation",
 	name: e.name,
 	input: e.input,
 	output: e.output,
 	error: e.error ?? c.Never,
 	target: e.target,
-	guards: e.guards,
+	guards: z(e.name, e.guards, e.openAccess),
+	openAccess: e.openAccess,
 	publicApi: e.publicApi,
 	exposeAsTool: e.exposeAsTool,
+	requiresApproval: e.requiresApproval,
 	internal: e.internal,
 	overridesPlugin: e.overridesPlugin
-}), y = (e) => g({
+}), H = (e) => R({
 	kind: "action",
 	name: e.name,
 	input: e.input,
 	output: e.output,
 	error: e.error ?? c.Never,
-	guards: e.guards,
+	guards: z(e.name, e.guards, e.openAccess),
+	openAccess: e.openAccess,
 	source: e.source,
 	target: e.target,
 	publicApi: e.publicApi,
 	exposeAsTool: e.exposeAsTool,
+	requiresApproval: e.requiresApproval,
 	internal: e.internal,
 	overridesPlugin: e.overridesPlugin
-}), We = (e) => g({
+}), at = (e) => R({
 	kind: "stream",
 	name: e.name,
 	input: e.input,
@@ -145,37 +241,38 @@ var Fe = c.Union(c.String, c.Number), u = c.Record({
 	error: e.error ?? c.Never,
 	internal: e.internal,
 	overridesPlugin: e.overridesPlugin,
-	guards: e.guards
-}), b = (e, t) => t && t.length > 0 ? c.Union(e, ...t) : e, x = (e, t) => t && t.length > 0 ? c.Union(e, s) : e, Ge = (e) => c.Union(e, h), Ke = (e, t) => l.make(e.name, {
+	guards: z(e.name, e.guards, e.openAccess),
+	openAccess: e.openAccess
+}), U = (e, t) => t && t.length > 0 ? c.Union(e, ...t) : e, W = (e, t) => t && t.some((e) => !a(e)) ? c.Union(e, s) : e, ot = (e) => c.Union(e, g), st = (e, t) => t === void 0 ? e : c.Union(e, T), ct = (e, t) => l.make(e.name, {
 	payload: e.input,
-	success: Ve(e.output),
-	error: b(x(e.error, e.guards), t),
+	success: h(e.output),
+	error: U(W(e.error, e.guards), t),
 	stream: !0
-}), qe = (e, t) => l.make(e.name, {
+}), lt = (e, t) => l.make(e.name, {
 	payload: e.input,
 	success: e.output,
-	error: b(Ge(x(e.error, e.guards)), t)
-}), Je = (e, t) => l.make(e.name, {
+	error: U(st(ot(W(e.error, e.guards)), e.requiresApproval), t)
+}), ut = (e, t) => l.make(e.name, {
 	payload: e.input,
 	success: e.output,
-	error: b(x(e.error, e.guards), t)
-}), S = (e, t) => l.make(e.name, {
+	error: U(st(W(e.error, e.guards), e.requiresApproval), t)
+}), dt = (e, t) => l.make(e.name, {
 	payload: e.input,
 	success: e.element,
-	error: b(e.error, t),
+	error: U(e.error, t),
 	stream: !0
-}), Ye = (e) => {
+}), ft = (e) => {
 	if (typeof e != "object" || !e) return;
 	let t = e._tag;
 	return typeof t == "string" ? t : void 0;
-}, Xe = (e) => {
+}, pt = (e) => {
 	switch (e.kind) {
-		case "query": return Ke(e);
-		case "mutation": return qe(e);
-		case "action": return Je(e);
-		case "stream": return S(e);
+		case "query": return ct(e);
+		case "mutation": return lt(e);
+		case "action": return ut(e);
+		case "stream": return dt(e);
 	}
-}, Ze = (e) => {
+}, mt = (e) => {
 	let t = e.input, n = t === void 0 ? {} : { input: t }, r = e.output, i = r === void 0 ? {} : { output: r };
 	if (e.kind === "query") return {
 		kind: "query",
@@ -199,12 +296,12 @@ var Fe = c.Union(c.String, c.Number), u = c.Record({
 		...n,
 		...i
 	};
-	let o = Array.isArray(a) ? a : [a];
+	let ee = Array.isArray(a) ? a : [a];
 	return {
 		kind: "mutation",
 		...n,
 		...i,
-		targets: o.map((e) => ({
+		targets: ee.map((e) => ({
 			table: e.table,
 			op: e.op,
 			..."order" in e && e.order !== void 0 ? { order: e.order } : {},
@@ -216,7 +313,7 @@ var Fe = c.Union(c.String, c.Number), u = c.Record({
 			..."shapeItem" in e && e.shapeItem !== void 0 ? { shapeItem: e.shapeItem } : {}
 		}))
 	};
-}, Qe = 7500, $e = (e) => typeof e == "object" && !!e && e.kind === "event", et = (e) => {
+}, ht = 7500, gt = (e) => typeof e == "object" && !!e && e.kind === "event", _t = (e) => {
 	if (e.name.length === 0) throw Error("defineEvent: `name` must not be empty");
 	if (/\s/.test(e.name)) throw Error(`defineEvent("${e.name}"): \`name\` must not contain whitespace.\n  The name is used as a broker subject segment. NATS refuses a subject with
   whitespace and delivers nothing — silently, and only on that broker, so an
@@ -243,66 +340,69 @@ var Fe = c.Union(c.String, c.Number), u = c.Record({
 		webhook: e.webhook,
 		delivery: e.delivery
 	};
-}, C = (e) => c.Struct({
+}, vt = (e) => c.Struct({
 	_tag: c.Literal("event"),
 	origin: c.String,
 	n: c.Number,
 	emittedAt: c.Number,
 	payload: e
-}), w = c.Struct({
+}), yt = c.Struct({
 	_tag: c.Literal("gap"),
 	missed: c.Number,
 	reason: c.Literal("buffer", "resume")
-}), T = c.Struct({ _tag: c.Literal("attached") }), E = (e) => c.Union(T, C(e), w), D = c.Struct({
+}), bt = c.Struct({ _tag: c.Literal("attached") }), xt = (e) => c.Union(bt, vt(e), yt), G = c.Struct({
 	origin: c.String,
 	n: c.Number
-}), O = (e) => c.Struct({
+}), St = (e) => c.Struct({
 	key: e,
-	resume: c.optional(c.Array(D))
-}), tt = (e, t) => {
+	resume: c.optional(c.Array(G))
+}), Ct = (e, t) => {
 	let n = e.guards && e.guards.length > 0 ? s : c.Never, r = t && t.length > 0 ? c.Union(n, ...t) : n;
 	return l.make(e.name, {
-		payload: O(e.key),
-		success: E(e.payload),
+		payload: St(e.key),
+		success: xt(e.payload),
 		error: r,
 		stream: !0
 	});
-}, nt = class extends c.TaggedError()("EventPayloadInvalid", {
+}, wt = class extends c.TaggedError()("EventPayloadInvalid", {
 	event: c.String,
 	message: c.String
-}) {}, rt = class extends c.TaggedError()("EventKeyInvalid", {
+}) {}, Tt = class extends c.TaggedError()("EventKeyInvalid", {
 	event: c.String,
 	message: c.String
-}) {}, it = class extends c.TaggedError()("EventPayloadTooLarge", {
+}) {}, Et = class extends c.TaggedError()("EventPayloadTooLarge", {
 	event: c.String,
 	bytes: c.Number,
 	limit: c.Number
-}) {}, k = (e) => {
+}) {}, Dt = (e) => {
 	if (typeof e != "object" || !e) return JSON.stringify(e) ?? "null";
 	let t = Object.entries(e).filter(([, e]) => e !== void 0).sort(([e], [t]) => e < t ? -1 : +(e > t));
 	return JSON.stringify(t);
-}, at = "\0", ot = (e, t, n) => [
+}, Ot = "\0", kt = (e, t, n) => [
 	e ?? "~",
 	t,
-	k(n)
-].join("\0"), st = (e) => {
+	Dt(n)
+].join("\0"), At = (e) => {
 	let [t = "~", n = "", r = ""] = e.split("\0");
 	return {
 		tenantId: t === "~" ? null : t,
 		event: n,
 		key: r
 	};
-}, ct = (e) => e.split("\0").join(" · "), lt = (e) => e, ut = (e) => e, dt = (e) => {
+}, jt = (e) => e.split("\0").join(" · "), Mt = (e) => e, Nt = (e) => e, Pt = (e) => {
+	let t = e.alias?.trim(), n = e.instance?.trim(), r = t !== void 0 && t !== "" ? t : e.base;
+	return n !== void 0 && n !== "" ? `${r}#${n}` : r;
+}, Ft = (e) => {
 	if (e.length !== 0) return (t, n) => e.reduceRight((e, t) => t(e, n), t);
-}, ft = (e, t) => {
-	let n = Ne.GenericTag(e);
+}, It = (e, t) => {
+	let n = Ue.GenericTag(e);
 	return {
 		Tag: n,
-		Live: Pe.succeed(n, t)
+		Live: We.succeed(n, t)
 	};
-}, pt = (e, t, n) => {
+}, Lt = (e, t, n) => {
 	if (!t) return { ok: !0 };
-	let r = A(n);
+	let r = K(n);
 	if (!r) return {
 		ok: !1,
 		reason: `cannot parse runningVersion "${n}"`
@@ -310,12 +410,12 @@ var Fe = c.Union(c.String, c.Number), u = c.Record({
 	let i = t.trim();
 	if (i === "*" || i === "") return { ok: !0 };
 	let a = i.split(/\s+/).filter((e) => e.length > 0);
-	for (let i of a) if (!mt(i, r)) return {
+	for (let i of a) if (!Rt(i, r)) return {
 		ok: !1,
 		reason: `plugin "${e}" requires framework ${t}, running ${n}`
 	};
 	return { ok: !0 };
-}, A = (e) => {
+}, K = (e) => {
 	let t = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9a-zA-Z.-]+))?$/.exec(e.trim());
 	return t ? {
 		major: Number(t[1]),
@@ -323,44 +423,44 @@ var Fe = c.Union(c.String, c.Number), u = c.Record({
 		patch: Number(t[3]),
 		pre: t[4] ?? ""
 	} : null;
-}, j = (e, t) => e.major === t.major ? e.minor === t.minor ? e.patch === t.patch ? e.pre && !t.pre ? -1 : !e.pre && t.pre ? 1 : e.pre && t.pre ? e.pre < t.pre ? -1 : +(e.pre > t.pre) : 0 : e.patch - t.patch : e.minor - t.minor : e.major - t.major, mt = (e, t) => {
+}, q = (e, t) => e.major === t.major ? e.minor === t.minor ? e.patch === t.patch ? e.pre && !t.pre ? -1 : !e.pre && t.pre ? 1 : e.pre && t.pre ? e.pre < t.pre ? -1 : +(e.pre > t.pre) : 0 : e.patch - t.patch : e.minor - t.minor : e.major - t.major, Rt = (e, t) => {
 	if (e === "*") return !0;
 	if (e.startsWith("^")) {
-		let n = A(e.slice(1));
-		return !n || t.major !== n.major ? !1 : j(t, n) >= 0;
+		let n = K(e.slice(1));
+		return !n || t.major !== n.major ? !1 : q(t, n) >= 0;
 	}
 	if (e.startsWith("~")) {
-		let n = A(e.slice(1));
-		return !n || t.major !== n.major || t.minor !== n.minor ? !1 : j(t, n) >= 0;
+		let n = K(e.slice(1));
+		return !n || t.major !== n.major || t.minor !== n.minor ? !1 : q(t, n) >= 0;
 	}
 	let n = /^(>=|<=|>|<)(.+)$/.exec(e);
 	if (n) {
-		let e = n[1], r = A(n[2]);
+		let e = n[1], r = K(n[2]);
 		if (!r) return !1;
-		let i = j(t, r);
+		let i = q(t, r);
 		if (e === ">=") return i >= 0;
 		if (e === "<=") return i <= 0;
 		if (e === ">") return i > 0;
 		if (e === "<") return i < 0;
 	}
-	let r = A(e);
-	return r ? j(t, r) === 0 : !1;
-}, M = c.Literal("running", "succeeded", "failed", "cancelled", "suspended"), N = c.Literal("cancel", "terminate", "abandon"), P = c.Struct({
+	let r = K(e);
+	return r ? q(t, r) === 0 : !1;
+}, J = c.Literal("running", "succeeded", "failed", "cancelled", "suspended"), zt = c.Literal("cancel", "terminate", "abandon"), Bt = c.Struct({
 	mode: c.String,
 	dueAt: c.NullOr(c.Number),
 	retryAfterMs: c.NullOr(c.Number),
 	intentId: c.NullOr(c.String)
-}), ht = c.Struct({
+}), Vt = c.Struct({
 	id: c.String,
 	workflowName: c.String,
 	executionId: c.NullOr(c.String),
 	status: c.Literal("running", "queued", "dropped", "skipped"),
-	deferral: c.optional(P)
-}), F = c.Struct({
+	deferral: c.optional(Bt)
+}), Y = c.Struct({
 	id: c.String,
 	tag: c.String,
 	executionId: c.String,
-	status: M,
+	status: J,
 	payload: c.Unknown,
 	workflowVersion: c.NullOr(c.String),
 	workflowPatches: c.NullOr(c.Unknown),
@@ -375,12 +475,12 @@ var Fe = c.Union(c.String, c.Number), u = c.Record({
 	durationMs: c.NullOr(c.Number),
 	traceId: c.NullOr(c.String),
 	parentExecutionId: c.NullOr(c.String),
-	parentClosePolicy: c.NullOr(N)
-}), I = c.Struct({
+	parentClosePolicy: c.NullOr(zt)
+}), Ht = c.Struct({
 	tag: c.optional(c.String),
-	status: c.optional(M),
+	status: c.optional(J),
 	limit: c.optional(c.Number)
-}), L = c.Struct({
+}), Ut = c.Struct({
 	id: c.String,
 	runId: c.String,
 	stepName: c.String,
@@ -395,7 +495,7 @@ var Fe = c.Union(c.String, c.Number), u = c.Record({
 	startedAt: c.Date,
 	completedAt: c.NullOr(c.Date),
 	durationMs: c.NullOr(c.Number)
-}), R = c.Struct({
+}), Wt = c.Struct({
 	id: c.String,
 	runId: c.String,
 	eventType: c.String,
@@ -403,7 +503,7 @@ var Fe = c.Union(c.String, c.Number), u = c.Record({
 	occurredAt: c.Date,
 	stepName: c.NullOr(c.String),
 	attempt: c.NullOr(c.Number)
-}), z = c.Struct({
+}), Gt = c.Struct({
 	id: c.String,
 	name: c.String,
 	payload: c.Unknown,
@@ -411,7 +511,7 @@ var Fe = c.Union(c.String, c.Number), u = c.Record({
 	subject: c.NullOr(c.Unknown),
 	traceId: c.NullOr(c.String),
 	occurredAt: c.Date
-}), B = c.Struct({
+}), Kt = c.Struct({
 	id: c.String,
 	eventId: c.String,
 	eventName: c.String,
@@ -424,123 +524,142 @@ var Fe = c.Union(c.String, c.Number), u = c.Record({
 	errorMessage: c.NullOr(c.String),
 	createdAt: c.Date,
 	completedAt: c.NullOr(c.Date)
-}), V = c.Struct({ id: c.String }), H = c.Struct({ runId: c.String }), U = c.Struct({
+}), qt = c.Struct({ id: c.String }), X = c.Struct({ runId: c.String }), Jt = c.Struct({
 	name: c.optional(c.String),
 	limit: c.optional(c.Number)
-}), W = c.Struct({ eventId: c.String }), G = c.Struct({
+}), Yt = c.Struct({ eventId: c.String }), Z = c.Struct({
 	workflowName: c.String,
 	executionId: c.String
-}), K = c.Struct({
+}), Xt = c.Struct({
 	id: c.String,
 	signalName: c.String,
 	payload: c.optional(c.Unknown)
-}), q = c.Struct({
+}), Zt = c.Struct({
 	id: c.String,
 	updateName: c.String,
 	payload: c.optional(c.Unknown),
 	timeoutMs: c.optional(c.Number)
-}), J = c.Struct({
+}), Qt = c.Struct({
 	eventId: c.String,
 	updateId: c.String,
 	completedEventId: c.String,
 	result: c.Unknown
-}), gt = _({
+}), $t = B({
 	name: "__voltro.workflow.run",
 	source: "_voltro_workflow_runs",
-	input: V,
-	output: c.Array(F)
-}), _t = _({
+	input: qt,
+	output: c.Array(Y)
+}), en = B({
 	name: "__voltro.workflow.runs",
 	source: "_voltro_workflow_runs",
-	input: I,
-	output: c.Array(F)
-}), vt = _({
+	input: Ht,
+	output: c.Array(Y)
+}), tn = B({
 	name: "__voltro.workflow.run.steps",
 	source: "_voltro_workflow_run_steps",
-	input: H,
-	output: c.Array(L)
-}), yt = _({
+	input: X,
+	output: c.Array(Ut)
+}), nn = B({
 	name: "__voltro.workflow.run.events",
 	source: "_voltro_workflow_run_events",
-	input: H,
-	output: c.Array(R)
-}), bt = _({
+	input: X,
+	output: c.Array(Wt)
+}), rn = B({
 	name: "__voltro.workflow.domainEvents",
 	source: "_voltro_workflow_events",
-	input: U,
-	output: c.Array(z)
-}), xt = _({
+	input: Jt,
+	output: c.Array(Gt)
+}), an = B({
 	name: "__voltro.workflow.event.deliveries",
 	source: "_voltro_workflow_event_deliveries",
-	input: W,
-	output: c.Array(B)
-}), St = y({
+	input: Yt,
+	output: c.Array(Kt)
+}), on = H({
 	name: "__voltro.workflow.cancel",
-	input: G,
+	input: Z,
 	output: c.Struct({ ok: c.Boolean })
-}), Ct = y({
+}), sn = H({
 	name: "__voltro.workflow.resume",
-	input: G,
+	input: Z,
 	output: c.Struct({ ok: c.Boolean })
-}), wt = y({
+}), cn = H({
 	name: "__voltro.workflow.signal",
-	input: K,
+	input: Xt,
 	output: c.Struct({ eventId: c.String })
-}), Tt = y({
+}), ln = H({
 	name: "__voltro.workflow.update",
-	input: q,
-	output: J
-}), Y = "__voltro.undo.log", X = "__voltro.undo.apply", Et = "__voltro.undo.redo", Dt = c.Struct({
+	input: Zt,
+	output: Qt
+}), un = "__voltro.undo.log", dn = "__voltro.undo.apply", fn = "__voltro.undo.redo", pn = c.Struct({
 	id: c.String,
 	tag: c.String,
 	label: c.NullOr(c.String),
 	undone: c.Boolean,
 	crossesAction: c.Boolean,
 	createdAt: c.String
-}), Ot = class extends c.TaggedError()("UndoNotFound", { invocationId: c.String }) {}, kt = class extends c.TaggedError()("UndoForbidden", { invocationId: c.String }) {}, At = class extends c.TaggedError()("UndoConflict", {
+}), mn = class extends c.TaggedError()("UndoNotFound", { invocationId: c.String }) {}, hn = class extends c.TaggedError()("UndoForbidden", { invocationId: c.String }) {}, gn = class extends c.TaggedError()("UndoConflict", {
 	invocationId: c.String,
 	reason: c.Literal("conflict", "action")
-}) {}, jt = c.Union(Ot, kt, At), Mt = _({
-	name: Y,
+}) {}, _n = c.Union(mn, hn, gn), vn = B({
+	name: un,
 	source: "_voltro_undo_log",
 	input: c.Struct({ limit: c.optional(c.Number) }),
-	output: c.Array(Dt)
-}), Nt = v({
-	name: X,
+	output: c.Array(pn)
+}), yn = V({
+	name: dn,
 	input: c.Struct({ invocationId: c.String }),
 	output: c.Struct({ ok: c.Boolean }),
-	error: jt
-}), Pt = v({
-	name: Et,
+	error: _n
+}), bn = V({
+	name: fn,
 	input: c.Struct({ invocationId: c.String }),
 	output: c.Struct({ ok: c.Boolean }),
-	error: jt
-}), Ft = "__voltro.connections.list", It = "__voltro.connections.start", Lt = "__voltro.connections.submitToken", Rt = "__voltro.connections.disconnect", Z = c.Literal("oauth2", "pat"), zt = c.Literal("disconnected", "connected", "expired", "revoked", "error"), Q = c.Struct({
+	error: _n
+}), xn = "__voltro.approvals.pending", Sn = "__voltro.approvals.decide", Cn = B({
+	name: xn,
+	source: "_voltro_approvals",
+	input: c.Struct({ limit: c.optional(c.Number) }),
+	output: c.Array(D),
+	openAccess: "the answer is scoped to the caller — a row appears only if they requested it or hold its recorded approver scopes, so an anonymous caller sees nothing"
+}), wn = V({
+	name: Sn,
+	input: c.Struct({
+		approvalId: c.String,
+		decision: c.Literal("approve", "reject"),
+		note: c.optional(c.String)
+	}),
+	output: c.Struct({
+		approvalId: c.String,
+		status: c.Literal("approved", "rejected")
+	}),
+	error: E,
+	openAccess: "the approver authority is the PENDING ROW's own recorded scopes (plus an unconditional self-approval refusal), checked in-handler — a descriptor-level scope would have to be the union of every approval-requiring procedure in the app"
+}), Tn = "__voltro.connections.list", En = "__voltro.connections.start", Dn = "__voltro.connections.submitToken", On = "__voltro.connections.disconnect", Q = c.Literal("oauth2", "pat"), kn = c.Literal("disconnected", "connected", "expired", "revoked", "error"), An = c.Struct({
 	connectionId: c.String,
-	kind: Z,
+	kind: Q,
 	label: c.String,
-	status: zt,
+	status: kn,
 	accountId: c.NullOr(c.String),
 	accountLabel: c.NullOr(c.String),
 	scopes: c.Array(c.String),
 	expiresAt: c.NullOr(c.String),
 	lastError: c.NullOr(c.String),
 	connectedAt: c.NullOr(c.String)
-}), Bt = class extends c.TaggedError()("ConnectionNotDeclared", { connectionId: c.String }) {}, Vt = class extends c.TaggedError()("ConnectionSubjectRequired", { connectionId: c.String }) {}, Ht = class extends c.TaggedError()("ConnectionKindMismatch", {
+}), jn = class extends c.TaggedError()("ConnectionNotDeclared", { connectionId: c.String }) {}, Mn = class extends c.TaggedError()("ConnectionSubjectRequired", { connectionId: c.String }) {}, Nn = class extends c.TaggedError()("ConnectionKindMismatch", {
 	connectionId: c.String,
-	expected: Z,
-	actual: Z
-}) {}, Ut = class extends c.TaggedError()("ConnectionHandshakeFailed", {
+	expected: Q,
+	actual: Q
+}) {}, Pn = class extends c.TaggedError()("ConnectionHandshakeFailed", {
 	connectionId: c.String,
 	reason: c.String,
 	transient: c.Boolean
-}) {}, $ = c.Union(Bt, Vt, Ht, Ut), Wt = _({
-	name: Ft,
+}) {}, $ = c.Union(jn, Mn, Nn, Pn), Fn = B({
+	name: Tn,
 	source: "_voltro_connections",
 	input: c.Struct({}),
-	output: c.Array(Q)
-}), Gt = y({
-	name: It,
+	output: c.Array(An)
+}), In = H({
+	name: En,
 	input: c.Struct({
 		connectionId: c.String,
 		redirectTo: c.optional(c.String)
@@ -550,22 +669,22 @@ var Fe = c.Union(c.String, c.Number), u = c.Record({
 		state: c.String
 	}),
 	error: $
-}), Kt = v({
-	name: Lt,
+}), Ln = V({
+	name: Dn,
 	input: c.Struct({
 		connectionId: c.String,
 		token: c.String
 	}),
 	output: c.Struct({ ok: c.Boolean }),
 	error: $
-}), qt = v({
-	name: Rt,
+}), Rn = V({
+	name: On,
 	input: c.Struct({ connectionId: c.String }),
 	output: c.Struct({ ok: c.Boolean }),
 	error: $
-}), Jt = (e) => {
+}), zn = (e) => {
 	let t = e instanceof Date ? e.getTime() : typeof e == "number" ? e : typeof e == "string" ? new Date(e).getTime() : 0;
 	return Number.isNaN(t) ? 0 : t;
-}, Yt = 1;
+}, Bn = 1;
 //#endregion
-export { ce as ADMIN_SCOPE, he as APIKEY_ISSUE_ORG_SCOPE, re as APIKEY_ISSUE_OTHER_SCOPE, ie as APIKEY_ISSUE_SELF_SCOPE, je as AuthMiddleware, h as BusinessRuleViolation, Ft as CONNECTIONS_LIST_TAG, Rt as CONNECTION_DISCONNECT_TAG, It as CONNECTION_START_TAG, Lt as CONNECTION_SUBMIT_TOKEN_TAG, Ut as ConnectionHandshakeFailed, Ee as ConnectionInfo, ke as ConnectionInfoMiddleware, Z as ConnectionKind, Ht as ConnectionKindMismatch, Bt as ConnectionNotDeclared, Q as ConnectionState, zt as ConnectionStatus, Vt as ConnectionSubjectRequired, at as EVENT_ROUTE_SEP, rt as EventKeyInvalid, nt as EventPayloadInvalid, it as EventPayloadTooLarge, Qe as MAX_EVENT_ENVELOPE_BYTES, Yt as PROTOCOL_VERSION, s as ScopeError, we as Subject, be as SubjectService, X as UNDO_APPLY_TAG, Y as UNDO_LOG_TAG, Et as UNDO_REDO_TAG, De as Unauthenticated, At as UndoConflict, kt as UndoForbidden, Dt as UndoLogEntry, Ot as UndoNotFound, G as WorkflowControlInputSchema, z as WorkflowDomainEventRowSchema, U as WorkflowDomainEventsInputSchema, W as WorkflowEventDeliveriesInputSchema, B as WorkflowEventDeliveryRowSchema, N as WorkflowParentClosePolicySchema, R as WorkflowRunEventRowSchema, ht as WorkflowRunHandleSchema, V as WorkflowRunRefSchema, F as WorkflowRunRowSchema, M as WorkflowRunStatusSchema, L as WorkflowRunStepRowSchema, H as WorkflowRunTableRefSchema, I as WorkflowRunsInputSchema, K as WorkflowSignalInputSchema, P as WorkflowStartDeferralSchema, q as WorkflowUpdateInputSchema, J as WorkflowUpdateResultSchema, Je as actionToRpc, le as advisoryResourceGuardWarning, Ae as anonymousSubject, Be as applyRowPatch, xe as assertAuthenticated, fe as beginIdempotent, pt as checkFrameworkCompat, oe as checkGuards, ae as checkGuardsEffect, Te as composeAuthStrategies, dt as composeRpcInterceptors, qt as connectionDisconnectDescriptor, Gt as connectionStartDescriptor, Kt as connectionSubmitTokenDescriptor, Wt as connectionsListQueryDescriptor, y as defineAction, et as defineEvent, v as defineMutation, lt as definePlugin, ut as definePluginRoute, ft as definePluginService, _ as defineQuery, We as defineStream, Re as diffRows, o as effectiveScopes, k as encodeEventKey, Ye as errorTag, T as eventAttached, C as eventEnvelope, w as eventGap, D as eventResumePoint, ot as eventRoute, E as eventStreamEvent, O as eventSubscribeInput, tt as eventToRpc, se as failIdempotent, ge as findAdvisoryResourceGuards, ee as finishIdempotent, ct as formatEventRoute, ye as getPolicyGuardResolver, te as getResourceScopeResolver, Me as hasCallbackRoutes, ve as hasEffectiveScope, i as hasScope, p as idToPath, de as idempotencyScope, $e as isEventDescriptor, ze as isIdKeyed, e as isPolicyCheck, Ue as isPolicyGuard, Se as isSystemSubject, He as isWireReachable, pe as memoryIdempotencyStore, qe as mutationToRpc, Ze as normalizeDescriptor, st as parseEventRoute, Ie as pathToId, me as publishServerError, Ke as queryToRpc, _e as requireScope, d as rowPatchOpSchema, f as rowPatchSchema, a as setEffectiveScopes, n as setPolicyGuardResolver, t as setResourceScopeResolver, S as streamToRpc, r as subjectScopes, ue as subscribeServerErrors, Ve as subscriptionEvent, Ce as systemSubject, Oe as tenantScopedSubject, Xe as toRpc, Jt as tsMs, Nt as undoApplyDescriptor, Mt as undoLogQueryDescriptor, Pt as undoRedoDescriptor, St as workflowCancelDescriptor, bt as workflowDomainEventsQueryDescriptor, xt as workflowEventDeliveriesQueryDescriptor, Ct as workflowResumeDescriptor, yt as workflowRunEventsQueryDescriptor, gt as workflowRunQueryDescriptor, vt as workflowRunStepsQueryDescriptor, _t as workflowRunsQueryDescriptor, wt as workflowSignalDescriptor, Tt as workflowUpdateDescriptor, ne as wsMutationIdempotencyScope };
+export { Me as ADMIN_SCOPE, se as APIKEY_ISSUE_ORG_SCOPE, n as APIKEY_ISSUE_OTHER_SCOPE, je as APIKEY_ISSUE_SELF_SCOPE, Sn as APPROVALS_DECIDE_TAG, xn as APPROVALS_PENDING_TAG, E as ApprovalDecisionErrors, T as ApprovalErrors, x as ApprovalExpired, C as ApprovalForbidden, v as ApprovalNotFound, S as ApprovalNotPending, b as ApprovalRejected, _ as ApprovalRequired, y as ApprovalSelfApproval, w as ApprovalUnavailable, Oe as AuthMiddleware, g as BusinessRuleViolation, Tn as CONNECTIONS_LIST_TAG, On as CONNECTION_DISCONNECT_TAG, En as CONNECTION_START_TAG, Dn as CONNECTION_SUBMIT_TOKEN_TAG, Pn as ConnectionHandshakeFailed, Ce as ConnectionInfo, Ee as ConnectionInfoMiddleware, Q as ConnectionKind, Nn as ConnectionKindMismatch, jn as ConnectionNotDeclared, An as ConnectionState, kn as ConnectionStatus, Mn as ConnectionSubjectRequired, ve as DEFAULT_SCOPE_CACHE_MAX_ENTRIES, de as DEFAULT_SCOPE_CACHE_TTL_MS, Ot as EVENT_ROUTE_SEP, Tt as EventKeyInvalid, wt as EventPayloadInvalid, Et as EventPayloadTooLarge, ht as MAX_EVENT_ENVELOPE_BYTES, Bn as PROTOCOL_VERSION, D as PendingApproval, O as REACTIVITY_CHANNEL_PREFIX, s as ScopeError, we as Subject, De as SubjectIdentity, pe as SubjectService, dn as UNDO_APPLY_TAG, un as UNDO_LOG_TAG, fn as UNDO_REDO_TAG, xe as Unauthenticated, gn as UndoConflict, hn as UndoForbidden, pn as UndoLogEntry, mn as UndoNotFound, Z as WorkflowControlInputSchema, Gt as WorkflowDomainEventRowSchema, Jt as WorkflowDomainEventsInputSchema, Yt as WorkflowEventDeliveriesInputSchema, Kt as WorkflowEventDeliveryRowSchema, zt as WorkflowParentClosePolicySchema, Wt as WorkflowRunEventRowSchema, Vt as WorkflowRunHandleSchema, qt as WorkflowRunRefSchema, Y as WorkflowRunRowSchema, J as WorkflowRunStatusSchema, Ut as WorkflowRunStepRowSchema, X as WorkflowRunTableRefSchema, Ht as WorkflowRunsInputSchema, Xt as WorkflowSignalInputSchema, Bt as WorkflowStartDeferralSchema, Zt as WorkflowUpdateInputSchema, Qt as WorkflowUpdateResultSchema, ut as actionToRpc, i as advisoryResourceGuardWarning, ke as anonymousSubject, Xe as applyRowPatch, me as applyScopeDecision, wn as approvalsDecideDescriptor, Cn as approvalsPendingQueryDescriptor, he as assertAuthenticated, Be as beginIdempotent, Lt as checkFrameworkCompat, r as checkGuards, ae as checkGuardsEffect, Te as composeAuthStrategies, Ft as composeRpcInterceptors, Rn as connectionDisconnectDescriptor, In as connectionStartDescriptor, Ln as connectionSubmitTokenDescriptor, Fn as connectionsListQueryDescriptor, P as declaredReactivityChannelKeys, H as defineAction, _t as defineEvent, V as defineMutation, Mt as definePlugin, Nt as definePluginRoute, It as definePluginService, B as defineQuery, at as defineStream, Je as diffRows, be as effectiveScopes, Dt as encodeEventKey, ft as errorTag, bt as eventAttached, vt as eventEnvelope, yt as eventGap, G as eventResumePoint, kt as eventRoute, xt as eventStreamEvent, St as eventSubscribeInput, Ct as eventToRpc, Le as failIdempotent, e as findAdvisoryResourceGuards, Fe as finishIdempotent, jt as formatEventRoute, ye as getPolicyGuardResolver, re as getResourceScopeResolver, it as hasAccessDecision, Se as hasCallbackRoutes, ie as hasEffectiveScope, oe as hasScope, p as idToPath, ze as idempotencyScope, gt as isEventDescriptor, Ye as isIdKeyed, a as isOpenAccess, te as isPolicyCheck, rt as isPolicyGuard, M as isReactivityChannel, N as isReactivityChannelKey, _e as isSystemSubject, tt as isWireReachable, ge as makeScopeCache, Ve as memoryIdempotencyStore, ne as missingAccessDecision, lt as mutationToRpc, mt as normalizeDescriptor, L as normalizeSource, o as openAccessSpec, At as parseEventRoute, Ke as pathToId, Pt as pluginInstanceName, et as publishReactivity, He as publishServerError, ct as queryToRpc, Qe as reactivityChannel, Pe as requireScope, d as rowPatchOpSchema, f as rowPatchSchema, ue as scopeCacheKey, t as setEffectiveScopes, le as setPolicyGuardResolver, ee as setResourceScopeResolver, I as sourceKeys, dt as streamToRpc, Ae as subjectIdentity, ce as subjectScopes, Re as subscribeServerErrors, h as subscriptionEvent, Ne as systemSubject, fe as tenantScopedSubject, pt as toRpc, zn as tsMs, $e as undeclaredChannelKeys, yn as undoApplyDescriptor, vn as undoLogQueryDescriptor, bn as undoRedoDescriptor, on as workflowCancelDescriptor, rn as workflowDomainEventsQueryDescriptor, an as workflowEventDeliveriesQueryDescriptor, sn as workflowResumeDescriptor, nn as workflowRunEventsQueryDescriptor, $t as workflowRunQueryDescriptor, tn as workflowRunStepsQueryDescriptor, en as workflowRunsQueryDescriptor, cn as workflowSignalDescriptor, ln as workflowUpdateDescriptor, Ie as wsMutationIdempotencyScope };