@voltro/protocol 0.33.0 → 0.35.0

package/dist/index.js

@@ -1,30 +1,30 @@
-import { C as e, D as t, E as n, O as r, S as i, T as a, _ as o, a as ee, b as te, c as ne, d as re, f as ie, g as ae, h as oe, i as se, l as ce, m as le, n as ue, o as de, p as s, r as fe, s as pe, t as me, u as he, v as ge, w as _e, x as ve, y as ye } from "./serverErrorBus-C3JTqgIc.js";
-import { a as be, c as xe, d as Se, f as Ce, i as we, l as Te, n as Ee, o as De, p as Oe, r as ke, s as Ae, t as je, u as Me } from "./auth-CXMrvPyX.js";
-import { Context as Ne, Layer as Pe, Schema as c } from "effect";
-import { Rpc as l } from "@effect/rpc";
+import { A as e, B as t, C as n, D as r, E as i, F as a, H as o, I as ee, L as te, M as ne, N as re, O as ie, P as ae, R as s, S as oe, T as c, U as se, V as ce, _ as le, a as ue, b as de, c as fe, d as pe, f as me, g as he, h as ge, i as _e, j as ve, k as ye, l as be, m as xe, n as Se, o as Ce, p as we, r as Te, s as Ee, t as De, u as Oe, v as ke, w as Ae, x as je, y as Me, z as Ne } from "./auth-B6YZuSBr.js";
+import { a as Pe, c as Fe, i as Ie, n as Le, o as Re, r as ze, s as Be, t as Ve } from "./serverErrorBus-BeN9pOpY.js";
+import { Context as He, Layer as Ue, Schema as l } from "effect";
+import { Rpc as u } from "@effect/rpc";
 //#region src/rowPatch.ts
-var Fe = c.Union(c.String, c.Number), u = c.Record({
-	key: c.String,
-	value: c.Unknown
-}).pipe(c.filter((e) => "id" in e, { message: () => "patch row must carry an id" })), d = c.Union(c.Struct({
-	op: c.Literal("add"),
-	path: c.String,
-	value: u
-}), c.Struct({
-	op: c.Literal("replace"),
-	path: c.String,
-	value: u
-}), c.Struct({
-	op: c.Literal("remove"),
-	path: c.String
-})), f = c.Struct({
-	ops: c.Array(d),
-	order: c.Array(Fe)
-}), p = (e) => `/${String(e).replace(/~/g, "~0").replace(/\//g, "~1")}`, Ie = (e) => (e.startsWith("/") ? e.slice(1) : e).replace(/~1/g, "/").replace(/~0/g, "~"), m = (e) => {
+var We = l.Union(l.String, l.Number), d = l.Record({
+	key: l.String,
+	value: l.Unknown
+}).pipe(l.filter((e) => "id" in e, { message: () => "patch row must carry an id" })), f = l.Union(l.Struct({
+	op: l.Literal("add"),
+	path: l.String,
+	value: d
+}), l.Struct({
+	op: l.Literal("replace"),
+	path: l.String,
+	value: d
+}), l.Struct({
+	op: l.Literal("remove"),
+	path: l.String
+})), p = l.Struct({
+	ops: l.Array(f),
+	order: l.Array(We)
+}), m = (e) => `/${String(e).replace(/~/g, "~0").replace(/\//g, "~1")}`, Ge = (e) => (e.startsWith("/") ? e.slice(1) : e).replace(/~1/g, "/").replace(/~0/g, "~"), h = (e) => {
 	let t = Object.keys(e).sort(), n = {};
 	for (let r of t) n[r] = e[r];
 	return JSON.stringify(n);
-}, Le = (e, t) => m(e) === m(t), Re = (e, t) => {
+}, Ke = (e, t) => h(e) === h(t), qe = (e, t) => {
 	let n = /* @__PURE__ */ new Map();
 	for (let t of e) n.set(t.id, t);
 	let r = [], i = [], a = /* @__PURE__ */ new Set();
@@ -33,26 +33,26 @@ var Fe = c.Union(c.String, c.Number), u = c.Record({
 		let t = n.get(e.id);
 		t === void 0 ? r.push({
 			op: "add",
-			path: p(e.id),
+			path: m(e.id),
 			value: e
-		}) : Le(t, e) || r.push({
+		}) : Ke(t, e) || r.push({
 			op: "replace",
-			path: p(e.id),
+			path: m(e.id),
 			value: e
 		});
 	}
 	for (let t of e) a.has(t.id) || r.push({
 		op: "remove",
-		path: p(t.id)
+		path: m(t.id)
 	});
 	return {
 		ops: r,
 		order: i
 	};
-}, ze = (e) => e.every((e) => {
+}, Je = (e) => e.every((e) => {
 	let t = e.id;
 	return typeof t == "string" || typeof t == "number";
-}), Be = (e, t) => {
+}), Ye = (e, t) => {
 	let n = /* @__PURE__ */ new Map();
 	for (let t of e) n.set(t.id, t);
 	for (let e of t.ops) (e.op === "add" || e.op === "replace") && n.set(e.value.id, e.value);
@@ -62,120 +62,218 @@ var Fe = c.Union(c.String, c.Number), u = c.Record({
 		t !== void 0 && r.push(t);
 	}
 	return r;
-}, Ve = (e) => c.Union(c.Struct({
-	_tag: c.Literal("snapshot"),
-	revision: c.Number,
+}, g = (e) => l.Union(l.Struct({
+	_tag: l.Literal("snapshot"),
+	revision: l.Number,
 	data: e,
-	computed: c.optional(c.Boolean)
-}), c.Struct({
-	_tag: c.Literal("delta"),
-	revision: c.Number,
-	emittedAt: c.Number,
-	patch: f
-}), c.Struct({
-	_tag: c.Literal("error"),
-	error: c.Unknown,
-	revision: c.optional(c.Number)
-})), h = class extends c.TaggedError()("BusinessRuleViolation", {
-	rule: c.String,
-	params: c.optional(c.Record({
-		key: c.String,
-		value: c.Unknown
+	computed: l.optional(l.Boolean)
+}), l.Struct({
+	_tag: l.Literal("delta"),
+	revision: l.Number,
+	emittedAt: l.Number,
+	patch: p
+}), l.Struct({
+	_tag: l.Literal("error"),
+	error: l.Unknown,
+	revision: l.optional(l.Number)
+})), _ = class extends l.TaggedError()("BusinessRuleViolation", {
+	rule: l.String,
+	params: l.optional(l.Record({
+		key: l.String,
+		value: l.Unknown
 	})),
-	field: c.optional(c.String),
-	message: c.optional(c.String),
-	severity: c.Literal("error", "warning")
-}) {}, He = (e) => e.internal !== !0, g = (e) => {
-	if (Array.isArray(e.guards) && e.guards.length === 0) throw Error(`${e.name}: \`guards: []\` is empty, so it enforces nothing — but it reads\n  at the call site as if this procedure were protected. Omit the field for an
+	field: l.optional(l.String),
+	message: l.optional(l.String),
+	severity: l.Literal("error", "warning")
+}) {}, v = class extends l.TaggedError()("ApprovalRequired", {
+	approvalId: l.String,
+	procedure: l.String,
+	expiresAt: l.String,
+	requiredScopes: l.Array(l.String),
+	reason: l.NullOr(l.String),
+	created: l.Boolean
+}) {}, y = class extends l.TaggedError()("ApprovalNotFound", { approvalId: l.String }) {}, b = class extends l.TaggedError()("ApprovalSelfApproval", {
+	approvalId: l.String,
+	subjectId: l.NullOr(l.String)
+}) {}, x = class extends l.TaggedError()("ApprovalRejected", {
+	approvalId: l.String,
+	decidedBy: l.NullOr(l.String),
+	note: l.NullOr(l.String)
+}) {}, S = class extends l.TaggedError()("ApprovalExpired", {
+	approvalId: l.String,
+	expiredAt: l.String
+}) {}, C = class extends l.TaggedError()("ApprovalNotPending", {
+	approvalId: l.String,
+	status: l.String
+}) {}, w = class extends l.TaggedError()("ApprovalForbidden", {
+	approvalId: l.String,
+	required: l.NullOr(l.String),
+	message: l.String
+}) {}, T = class extends l.TaggedError()("ApprovalUnavailable", {
+	procedure: l.String,
+	message: l.String
+}) {}, E = l.Union(v, x, S, T), D = l.Union(y, b, S, C, w, T), O = l.Struct({
+	id: l.String,
+	procedure: l.String,
+	kind: l.Literal("mutation", "action"),
+	requestedBy: l.NullOr(l.String),
+	status: l.Literal("pending", "approved", "rejected", "expired", "consumed"),
+	reason: l.NullOr(l.String),
+	requiredScopes: l.Array(l.String),
+	requestedAt: l.String,
+	expiresAt: l.String,
+	decidedBy: l.NullOr(l.String),
+	decidedAt: l.NullOr(l.String),
+	note: l.NullOr(l.String),
+	relation: l.Literal("to-decide", "requested")
+}), k = "channel:", A = Symbol.for("@voltro/protocol/reactivityChannels"), j = globalThis, M = j[A] ?? (j[A] = /* @__PURE__ */ new Map()), Xe = /^[a-z][a-z0-9-]*(\.[a-z0-9-]+)*$/, Ze = (e) => {
+	if (!Xe.test(e)) throw Error(`reactivityChannel('${e}'): invalid channel name.\n  Use lowercase kebab segments separated by dots — \`presence\`, \`job-queue\`,
+  \`billing.usage\`. A \`:\` is refused because it is the namespace separator in
+  the routing key (\`${k}<name>\`), and an uppercase letter is\n  refused because a key that differs only by case reads as one channel and
+  routes as two.`);
+	let t = M.get(e);
+	if (t !== void 0) return t;
+	let n = `${k}${e}`, r = Object.freeze({
+		kind: "reactivity-channel",
+		name: e,
+		key: n,
+		toString: () => n
+	});
+	return M.set(e, r), r;
+}, N = (e) => typeof e == "object" && !!e && e.kind === "reactivity-channel", P = (e) => e.startsWith(k), F = () => new Set([...M.values()].map((e) => e.key)), I = (e) => N(e) ? e.key : e, L = (e) => e === void 0 ? [] : Array.isArray(e) ? e.map(I) : [I(e)], Qe = (e) => e === void 0 ? void 0 : Array.isArray(e) ? e.map(I) : I(e), $e = (e) => {
+	let t = F(), n = [];
+	for (let r of e) for (let e of L(r.source)) !P(e) || t.has(e) || n.push({
+		procedure: r.name,
+		key: e
+	});
+	return n;
+}, et = (e, t) => {
+	let n = e?.injectExternalChange;
+	return n === void 0 ? !1 : (n.call(e, {
+		table: t.key,
+		op: "update",
+		new: {},
+		old: {},
+		origin: "inline"
+	}), !0);
+}, tt = (e) => e.internal !== !0, R = (e) => {
+	if (nt(e), Array.isArray(e.guards) && e.guards.length === 0) throw Error(`${e.name}: \`guards: []\` is empty, so it enforces nothing — but it reads\n  at the call site as if this procedure were protected. Omit the field for an
   unguarded procedure, or list the scopes required to call it.`);
 	let t = typeof e.source == "string" ? [e.source] : Array.isArray(e.source) ? e.source : void 0;
 	if (t !== void 0 && (t.length === 0 || t.some((e) => String(e).trim() === ""))) throw Error(`${e.name}: \`source\` is empty, so this query declares reactivity and\n  subscribes to nothing — it serves one snapshot and never updates again,
   which is indistinguishable from "nothing changed". Name the table(s) it
   reads, or omit \`source\` for a non-reactive query.`);
 	if (e.internal !== !0) return e;
+	if (e.openAccess !== void 0) throw Error(`${e.name}: \`internal: true\` cannot be combined with \`openAccess\`.\n  \`internal\` takes the procedure OFF the wire, and \`openAccess\` declares who may
+  call it there — together they describe a decision about a surface that does not
+  exist. Drop \`openAccess\` (an internal procedure needs no wire decision), or drop
+  \`internal: true\` if the procedure really is meant to be callable.`);
 	if (e.overridesPlugin === !0) throw Error(`${e.name}: \`internal: true\` cannot be combined with \`overridesPlugin\`.\n  The override REMOVES the plugin route, and an internal procedure is not
   wire-reachable — so the plugin's route would vanish with nothing callable
   in its place, and callers would get a 404 for something that used to work.`);
 	let n = [e.publicApi === void 0 ? void 0 : "publicApi", e.exposeAsTool === void 0 ? void 0 : "exposeAsTool"].filter((e) => e !== void 0);
 	if (n.length === 0) return e;
 	throw Error(`${e.name}: \`internal: true\` cannot be combined with ${n.map((e) => `\`${e}\``).join(" or ")}. \`internal\` takes the procedure OFF the wire; those put it back ON a different one (${n.includes("publicApi") ? "a REST route" : "an agent tool"}), and that surface is projected without consulting the flag — so the procedure would be unreachable from your client and reachable from the internet. Drop \`internal: true\` if the wider surface is intended, or remove the ${n.join(" / ")} annotation if it is not.`);
-}, Ue = (e) => e.action !== void 0 && e.resourceType !== void 0, _ = (e) => g({
+}, nt = (e) => {
+	let t = e.requiresApproval;
+	if (t !== void 0) {
+		if (!Array.isArray(t.approvers) || t.approvers.length === 0) throw Error(`${e.name}: \`requiresApproval.approvers\` is empty, so NOBODY can approve this\n  procedure and every call would park forever. Name the scope(s) an approver must hold
+  — e.g. \`approvers: [{ scope: 'invoices:approve' }]\`.`);
+		if (e.openAccess !== void 0) throw Error(`${e.name}: \`requiresApproval\` cannot be combined with \`openAccess\`.\n  The self-approval refusal compares subject ids, and an unauthenticated caller has
+  none — so on an open procedure every anonymous caller would count as a DIFFERENT
+  human from every other, and the second-pair-of-eyes control would enforce nothing.
+  Give the procedure a \`guards:\` decision, or drop \`requiresApproval\`.`);
+	}
+}, rt = (e) => e.action !== void 0 && e.resourceType !== void 0, it = (e) => e.openAccess !== void 0 || e.guards !== void 0 && e.guards.length > 0, z = (e, t, n) => {
+	if (n === void 0) return t;
+	if (n.trim() === "") throw Error(`${e}: \`openAccess\` needs a REASON, not an empty string. It is the sentence a\n  reviewer reads to decide whether this procedure should really be callable
+  without an authorization check — e.g. \`openAccess: 'public pricing, no caller data'\`.`);
+	if (t !== void 0 && t.length > 0) throw Error(`${e}: \`openAccess\` and \`guards\` are two different access decisions, so\n  declaring both says the procedure is protected AND open. Keep the guards if a
+  caller must hold a scope; drop them if anyone may call it.`);
+	return [s(n.trim())];
+}, B = (e) => R({
 	kind: "query",
 	name: e.name,
 	input: e.input,
 	output: e.output,
-	error: e.error ?? c.Never,
-	source: e.source,
+	error: e.error ?? l.Never,
+	source: Qe(e.source),
 	cache: e.cache,
-	guards: e.guards,
+	guards: z(e.name, e.guards, e.openAccess),
+	openAccess: e.openAccess,
 	publicApi: e.publicApi,
 	exposeAsTool: e.exposeAsTool,
 	internal: e.internal,
 	overridesPlugin: e.overridesPlugin
-}), v = (e) => g({
+}), V = (e) => R({
 	kind: "mutation",
 	name: e.name,
 	input: e.input,
 	output: e.output,
-	error: e.error ?? c.Never,
+	error: e.error ?? l.Never,
 	target: e.target,
-	guards: e.guards,
+	guards: z(e.name, e.guards, e.openAccess),
+	openAccess: e.openAccess,
 	publicApi: e.publicApi,
 	exposeAsTool: e.exposeAsTool,
+	requiresApproval: e.requiresApproval,
 	internal: e.internal,
 	overridesPlugin: e.overridesPlugin
-}), y = (e) => g({
+}), H = (e) => R({
 	kind: "action",
 	name: e.name,
 	input: e.input,
 	output: e.output,
-	error: e.error ?? c.Never,
-	guards: e.guards,
+	error: e.error ?? l.Never,
+	guards: z(e.name, e.guards, e.openAccess),
+	openAccess: e.openAccess,
 	source: e.source,
 	target: e.target,
 	publicApi: e.publicApi,
 	exposeAsTool: e.exposeAsTool,
+	requiresApproval: e.requiresApproval,
 	internal: e.internal,
 	overridesPlugin: e.overridesPlugin
-}), We = (e) => g({
+}), at = (e) => R({
 	kind: "stream",
 	name: e.name,
 	input: e.input,
 	element: e.element,
-	error: e.error ?? c.Never,
+	error: e.error ?? l.Never,
 	internal: e.internal,
 	overridesPlugin: e.overridesPlugin,
-	guards: e.guards
-}), b = (e, t) => t && t.length > 0 ? c.Union(e, ...t) : e, x = (e, t) => t && t.length > 0 ? c.Union(e, s) : e, Ge = (e) => c.Union(e, h), Ke = (e, t) => l.make(e.name, {
+	guards: z(e.name, e.guards, e.openAccess),
+	openAccess: e.openAccess
+}), U = (e, t) => t && t.length > 0 ? l.Union(e, ...t) : e, W = (e, t) => t && t.some((e) => !a(e)) ? l.Union(e, c) : e, ot = (e) => l.Union(e, _), st = (e, t) => t === void 0 ? e : l.Union(e, E), ct = (e, t) => u.make(e.name, {
 	payload: e.input,
-	success: Ve(e.output),
-	error: b(x(e.error, e.guards), t),
+	success: g(e.output),
+	error: U(W(e.error, e.guards), t),
 	stream: !0
-}), qe = (e, t) => l.make(e.name, {
+}), lt = (e, t) => u.make(e.name, {
 	payload: e.input,
 	success: e.output,
-	error: b(Ge(x(e.error, e.guards)), t)
-}), Je = (e, t) => l.make(e.name, {
+	error: U(st(ot(W(e.error, e.guards)), e.requiresApproval), t)
+}), ut = (e, t) => u.make(e.name, {
 	payload: e.input,
 	success: e.output,
-	error: b(x(e.error, e.guards), t)
-}), S = (e, t) => l.make(e.name, {
+	error: U(st(W(e.error, e.guards), e.requiresApproval), t)
+}), dt = (e, t) => u.make(e.name, {
 	payload: e.input,
 	success: e.element,
-	error: b(e.error, t),
+	error: U(e.error, t),
 	stream: !0
-}), Ye = (e) => {
+}), ft = (e) => {
 	if (typeof e != "object" || !e) return;
 	let t = e._tag;
 	return typeof t == "string" ? t : void 0;
-}, Xe = (e) => {
+}, pt = (e) => {
 	switch (e.kind) {
-		case "query": return Ke(e);
-		case "mutation": return qe(e);
-		case "action": return Je(e);
-		case "stream": return S(e);
+		case "query": return ct(e);
+		case "mutation": return lt(e);
+		case "action": return ut(e);
+		case "stream": return dt(e);
 	}
-}, Ze = (e) => {
+}, mt = (e) => {
 	let t = e.input, n = t === void 0 ? {} : { input: t }, r = e.output, i = r === void 0 ? {} : { output: r };
 	if (e.kind === "query") return {
 		kind: "query",
@@ -216,7 +314,7 @@ var Fe = c.Union(c.String, c.Number), u = c.Record({
 			..."shapeItem" in e && e.shapeItem !== void 0 ? { shapeItem: e.shapeItem } : {}
 		}))
 	};
-}, Qe = 7500, $e = (e) => typeof e == "object" && !!e && e.kind === "event", et = (e) => {
+}, ht = 7500, gt = (e) => typeof e == "object" && !!e && e.kind === "event", _t = (e) => {
 	if (e.name.length === 0) throw Error("defineEvent: `name` must not be empty");
 	if (/\s/.test(e.name)) throw Error(`defineEvent("${e.name}"): \`name\` must not contain whitespace.\n  The name is used as a broker subject segment. NATS refuses a subject with
   whitespace and delivers nothing — silently, and only on that broker, so an
@@ -224,6 +322,13 @@ var Fe = c.Union(c.String, c.Number), u = c.Record({
   Use a dot for namespacing: "orders.paid".`);
 	if (e.guards !== void 0 && e.guards.length === 0) throw Error(`defineEvent("${e.name}"): \`guards: []\` is empty, so it enforces nothing —\n  but it reads at the call site as if the event were protected. Omit the field
   for an unguarded event, or list the scopes that may subscribe.`);
+	if (e.openAccess !== void 0) {
+		if (e.openAccess.trim() === "") throw Error(`defineEvent("${e.name}"): \`openAccess\` needs a REASON, not an empty string. It is\n  the sentence a reviewer reads to decide whether anyone should really be able to
+  subscribe without an authorization check — e.g. \`openAccess: 'public scoreboard,
+  no caller data'\`.`);
+		if (e.guards !== void 0 && e.guards.length > 0) throw Error(`defineEvent("${e.name}"): \`openAccess\` and \`guards\` are two different access\n  decisions, so declaring both says the event is protected AND open. Keep the guards
+  if a subscriber must hold a scope; drop them if anyone may listen.`);
+	}
 	if (e.webhook?.rateLimit !== void 0 && e.webhook.rateLimit.perMinute < 1) throw Error(`defineEvent("${e.name}"): \`webhook.rateLimit.perMinute\` is ${e.webhook.rateLimit.perMinute}, which defers every delivery forever.\n  There is no "unlimited" spelling here — omit \`rateLimit\` for no ceiling.`);
 	if (e.webhook?.version !== void 0 && e.webhook.version < 1) throw Error(`defineEvent("${e.name}"): \`webhook.version\` must be >= 1 (default 1).\n  A subscriber pinned to 1 would read this event as BEHIND its own version,
   which is the opposite of what a version bump is for.`);
@@ -238,71 +343,75 @@ var Fe = c.Union(c.String, c.Number), u = c.Record({
 		name: e.name,
 		key: e.key,
 		payload: e.payload,
-		guards: e.guards,
+		guards: e.openAccess === void 0 ? e.guards : [s(e.openAccess.trim())],
+		openAccess: e.openAccess,
 		rewind: e.rewind,
 		webhook: e.webhook,
 		delivery: e.delivery
 	};
-}, C = (e) => c.Struct({
-	_tag: c.Literal("event"),
-	origin: c.String,
-	n: c.Number,
-	emittedAt: c.Number,
+}, vt = (e) => l.Struct({
+	_tag: l.Literal("event"),
+	origin: l.String,
+	n: l.Number,
+	emittedAt: l.Number,
 	payload: e
-}), w = c.Struct({
-	_tag: c.Literal("gap"),
-	missed: c.Number,
-	reason: c.Literal("buffer", "resume")
-}), T = c.Struct({ _tag: c.Literal("attached") }), E = (e) => c.Union(T, C(e), w), D = c.Struct({
-	origin: c.String,
-	n: c.Number
-}), O = (e) => c.Struct({
+}), yt = l.Struct({
+	_tag: l.Literal("gap"),
+	missed: l.Number,
+	reason: l.Literal("buffer", "resume")
+}), bt = l.Struct({ _tag: l.Literal("attached") }), xt = (e) => l.Union(bt, vt(e), yt), G = l.Struct({
+	origin: l.String,
+	n: l.Number
+}), St = (e) => l.Struct({
 	key: e,
-	resume: c.optional(c.Array(D))
-}), tt = (e, t) => {
-	let n = e.guards && e.guards.length > 0 ? s : c.Never, r = t && t.length > 0 ? c.Union(n, ...t) : n;
-	return l.make(e.name, {
-		payload: O(e.key),
-		success: E(e.payload),
+	resume: l.optional(l.Array(G))
+}), Ct = (e, t) => {
+	let n = e.guards !== void 0 && e.guards.some((e) => !a(e)) ? c : l.Never, r = t && t.length > 0 ? l.Union(n, ...t) : n;
+	return u.make(e.name, {
+		payload: St(e.key),
+		success: xt(e.payload),
 		error: r,
 		stream: !0
 	});
-}, nt = class extends c.TaggedError()("EventPayloadInvalid", {
-	event: c.String,
-	message: c.String
-}) {}, rt = class extends c.TaggedError()("EventKeyInvalid", {
-	event: c.String,
-	message: c.String
-}) {}, it = class extends c.TaggedError()("EventPayloadTooLarge", {
-	event: c.String,
-	bytes: c.Number,
-	limit: c.Number
-}) {}, k = (e) => {
+}, wt = class extends l.TaggedError()("EventPayloadInvalid", {
+	event: l.String,
+	message: l.String
+}) {}, Tt = class extends l.TaggedError()("EventKeyInvalid", {
+	event: l.String,
+	message: l.String
+}) {}, Et = class extends l.TaggedError()("EventPayloadTooLarge", {
+	event: l.String,
+	bytes: l.Number,
+	limit: l.Number
+}) {}, Dt = (e) => {
 	if (typeof e != "object" || !e) return JSON.stringify(e) ?? "null";
 	let t = Object.entries(e).filter(([, e]) => e !== void 0).sort(([e], [t]) => e < t ? -1 : +(e > t));
 	return JSON.stringify(t);
-}, at = "\0", ot = (e, t, n) => [
+}, Ot = "\0", kt = (e, t, n) => [
 	e ?? "~",
 	t,
-	k(n)
-].join("\0"), st = (e) => {
+	Dt(n)
+].join("\0"), At = (e) => {
 	let [t = "~", n = "", r = ""] = e.split("\0");
 	return {
 		tenantId: t === "~" ? null : t,
 		event: n,
 		key: r
 	};
-}, ct = (e) => e.split("\0").join(" · "), lt = (e) => e, ut = (e) => e, dt = (e) => {
+}, jt = (e) => e.split("\0").join(" · "), Mt = (e) => e, Nt = (e) => e, Pt = (e) => {
+	let t = e.alias?.trim(), n = e.instance?.trim(), r = t !== void 0 && t !== "" ? t : e.base;
+	return n !== void 0 && n !== "" ? `${r}#${n}` : r;
+}, Ft = (e) => {
 	if (e.length !== 0) return (t, n) => e.reduceRight((e, t) => t(e, n), t);
-}, ft = (e, t) => {
-	let n = Ne.GenericTag(e);
+}, It = (e, t) => {
+	let n = He.GenericTag(e);
 	return {
 		Tag: n,
-		Live: Pe.succeed(n, t)
+		Live: Ue.succeed(n, t)
 	};
-}, pt = (e, t, n) => {
+}, Lt = (e, t, n) => {
 	if (!t) return { ok: !0 };
-	let r = A(n);
+	let r = K(n);
 	if (!r) return {
 		ok: !1,
 		reason: `cannot parse runningVersion "${n}"`
@@ -310,12 +419,12 @@ var Fe = c.Union(c.String, c.Number), u = c.Record({
 	let i = t.trim();
 	if (i === "*" || i === "") return { ok: !0 };
 	let a = i.split(/\s+/).filter((e) => e.length > 0);
-	for (let i of a) if (!mt(i, r)) return {
+	for (let i of a) if (!Rt(i, r)) return {
 		ok: !1,
 		reason: `plugin "${e}" requires framework ${t}, running ${n}`
 	};
 	return { ok: !0 };
-}, A = (e) => {
+}, K = (e) => {
 	let t = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9a-zA-Z.-]+))?$/.exec(e.trim());
 	return t ? {
 		major: Number(t[1]),
@@ -323,249 +432,275 @@ var Fe = c.Union(c.String, c.Number), u = c.Record({
 		patch: Number(t[3]),
 		pre: t[4] ?? ""
 	} : null;
-}, j = (e, t) => e.major === t.major ? e.minor === t.minor ? e.patch === t.patch ? e.pre && !t.pre ? -1 : !e.pre && t.pre ? 1 : e.pre && t.pre ? e.pre < t.pre ? -1 : +(e.pre > t.pre) : 0 : e.patch - t.patch : e.minor - t.minor : e.major - t.major, mt = (e, t) => {
+}, q = (e, t) => e.major === t.major ? e.minor === t.minor ? e.patch === t.patch ? e.pre && !t.pre ? -1 : !e.pre && t.pre ? 1 : e.pre && t.pre ? e.pre < t.pre ? -1 : +(e.pre > t.pre) : 0 : e.patch - t.patch : e.minor - t.minor : e.major - t.major, Rt = (e, t) => {
 	if (e === "*") return !0;
 	if (e.startsWith("^")) {
-		let n = A(e.slice(1));
-		return !n || t.major !== n.major ? !1 : j(t, n) >= 0;
+		let n = K(e.slice(1));
+		return !n || t.major !== n.major ? !1 : q(t, n) >= 0;
 	}
 	if (e.startsWith("~")) {
-		let n = A(e.slice(1));
-		return !n || t.major !== n.major || t.minor !== n.minor ? !1 : j(t, n) >= 0;
+		let n = K(e.slice(1));
+		return !n || t.major !== n.major || t.minor !== n.minor ? !1 : q(t, n) >= 0;
 	}
 	let n = /^(>=|<=|>|<)(.+)$/.exec(e);
 	if (n) {
-		let e = n[1], r = A(n[2]);
+		let e = n[1], r = K(n[2]);
 		if (!r) return !1;
-		let i = j(t, r);
+		let i = q(t, r);
 		if (e === ">=") return i >= 0;
 		if (e === "<=") return i <= 0;
 		if (e === ">") return i > 0;
 		if (e === "<") return i < 0;
 	}
-	let r = A(e);
-	return r ? j(t, r) === 0 : !1;
-}, M = c.Literal("running", "succeeded", "failed", "cancelled", "suspended"), N = c.Literal("cancel", "terminate", "abandon"), P = c.Struct({
-	mode: c.String,
-	dueAt: c.NullOr(c.Number),
-	retryAfterMs: c.NullOr(c.Number),
-	intentId: c.NullOr(c.String)
-}), ht = c.Struct({
-	id: c.String,
-	workflowName: c.String,
-	executionId: c.NullOr(c.String),
-	status: c.Literal("running", "queued", "dropped", "skipped"),
-	deferral: c.optional(P)
-}), F = c.Struct({
-	id: c.String,
-	tag: c.String,
-	executionId: c.String,
-	status: M,
-	payload: c.Unknown,
-	workflowVersion: c.NullOr(c.String),
-	workflowPatches: c.NullOr(c.Unknown),
-	output: c.NullOr(c.Unknown),
-	subject: c.NullOr(c.Unknown),
-	source: c.NullOr(c.String),
-	errorTag: c.NullOr(c.String),
-	errorMessage: c.NullOr(c.String),
-	cancelled: c.Boolean,
-	startedAt: c.Date,
-	completedAt: c.NullOr(c.Date),
-	durationMs: c.NullOr(c.Number),
-	traceId: c.NullOr(c.String),
-	parentExecutionId: c.NullOr(c.String),
-	parentClosePolicy: c.NullOr(N)
-}), I = c.Struct({
-	tag: c.optional(c.String),
-	status: c.optional(M),
-	limit: c.optional(c.Number)
-}), L = c.Struct({
-	id: c.String,
-	runId: c.String,
-	stepName: c.String,
-	attempt: c.Number,
-	status: c.Literal("running", "succeeded", "failed"),
-	input: c.NullOr(c.Unknown),
-	retryPolicy: c.NullOr(c.Unknown),
-	output: c.NullOr(c.Unknown),
-	errorTag: c.NullOr(c.String),
-	errorMessage: c.NullOr(c.String),
-	errorCause: c.NullOr(c.Unknown),
-	startedAt: c.Date,
-	completedAt: c.NullOr(c.Date),
-	durationMs: c.NullOr(c.Number)
-}), R = c.Struct({
-	id: c.String,
-	runId: c.String,
-	eventType: c.String,
-	payload: c.NullOr(c.Unknown),
-	occurredAt: c.Date,
-	stepName: c.NullOr(c.String),
-	attempt: c.NullOr(c.Number)
-}), z = c.Struct({
-	id: c.String,
-	name: c.String,
-	payload: c.Unknown,
-	source: c.String,
-	subject: c.NullOr(c.Unknown),
-	traceId: c.NullOr(c.String),
-	occurredAt: c.Date
-}), B = c.Struct({
-	id: c.String,
-	eventId: c.String,
-	eventName: c.String,
-	triggerId: c.String,
-	workflowName: c.String,
-	executionId: c.NullOr(c.String),
-	status: c.Literal("starting", "started", "skipped", "failed"),
-	idempotencyKey: c.String,
-	skipped: c.Boolean,
-	errorMessage: c.NullOr(c.String),
-	createdAt: c.Date,
-	completedAt: c.NullOr(c.Date)
-}), V = c.Struct({ id: c.String }), H = c.Struct({ runId: c.String }), U = c.Struct({
-	name: c.optional(c.String),
-	limit: c.optional(c.Number)
-}), W = c.Struct({ eventId: c.String }), G = c.Struct({
-	workflowName: c.String,
-	executionId: c.String
-}), K = c.Struct({
-	id: c.String,
-	signalName: c.String,
-	payload: c.optional(c.Unknown)
-}), q = c.Struct({
-	id: c.String,
-	updateName: c.String,
-	payload: c.optional(c.Unknown),
-	timeoutMs: c.optional(c.Number)
-}), J = c.Struct({
-	eventId: c.String,
-	updateId: c.String,
-	completedEventId: c.String,
-	result: c.Unknown
-}), gt = _({
+	let r = K(e);
+	return r ? q(t, r) === 0 : !1;
+}, J = l.Literal("running", "succeeded", "failed", "cancelled", "suspended"), zt = l.Literal("cancel", "terminate", "abandon"), Bt = l.Struct({
+	mode: l.String,
+	dueAt: l.NullOr(l.Number),
+	retryAfterMs: l.NullOr(l.Number),
+	intentId: l.NullOr(l.String)
+}), Vt = l.Struct({
+	id: l.String,
+	workflowName: l.String,
+	executionId: l.NullOr(l.String),
+	status: l.Literal("running", "queued", "dropped", "skipped"),
+	deferral: l.optional(Bt)
+}), Y = l.Struct({
+	id: l.String,
+	tag: l.String,
+	executionId: l.String,
+	status: J,
+	payload: l.Unknown,
+	workflowVersion: l.NullOr(l.String),
+	workflowPatches: l.NullOr(l.Unknown),
+	output: l.NullOr(l.Unknown),
+	subject: l.NullOr(l.Unknown),
+	source: l.NullOr(l.String),
+	errorTag: l.NullOr(l.String),
+	errorMessage: l.NullOr(l.String),
+	cancelled: l.Boolean,
+	startedAt: l.Date,
+	completedAt: l.NullOr(l.Date),
+	durationMs: l.NullOr(l.Number),
+	traceId: l.NullOr(l.String),
+	parentExecutionId: l.NullOr(l.String),
+	parentClosePolicy: l.NullOr(zt)
+}), Ht = l.Struct({
+	tag: l.optional(l.String),
+	status: l.optional(J),
+	limit: l.optional(l.Number)
+}), Ut = l.Struct({
+	id: l.String,
+	runId: l.String,
+	stepName: l.String,
+	attempt: l.Number,
+	status: l.Literal("running", "succeeded", "failed"),
+	input: l.NullOr(l.Unknown),
+	retryPolicy: l.NullOr(l.Unknown),
+	output: l.NullOr(l.Unknown),
+	errorTag: l.NullOr(l.String),
+	errorMessage: l.NullOr(l.String),
+	errorCause: l.NullOr(l.Unknown),
+	startedAt: l.Date,
+	completedAt: l.NullOr(l.Date),
+	durationMs: l.NullOr(l.Number)
+}), Wt = l.Struct({
+	id: l.String,
+	runId: l.String,
+	eventType: l.String,
+	payload: l.NullOr(l.Unknown),
+	occurredAt: l.Date,
+	stepName: l.NullOr(l.String),
+	attempt: l.NullOr(l.Number)
+}), Gt = l.Struct({
+	id: l.String,
+	name: l.String,
+	payload: l.Unknown,
+	source: l.String,
+	subject: l.NullOr(l.Unknown),
+	traceId: l.NullOr(l.String),
+	occurredAt: l.Date
+}), Kt = l.Struct({
+	id: l.String,
+	eventId: l.String,
+	eventName: l.String,
+	triggerId: l.String,
+	workflowName: l.String,
+	executionId: l.NullOr(l.String),
+	status: l.Literal("starting", "started", "skipped", "failed"),
+	idempotencyKey: l.String,
+	skipped: l.Boolean,
+	errorMessage: l.NullOr(l.String),
+	createdAt: l.Date,
+	completedAt: l.NullOr(l.Date)
+}), qt = l.Struct({ id: l.String }), X = l.Struct({ runId: l.String }), Jt = l.Struct({
+	name: l.optional(l.String),
+	limit: l.optional(l.Number)
+}), Yt = l.Struct({ eventId: l.String }), Z = l.Struct({
+	workflowName: l.String,
+	executionId: l.String
+}), Xt = l.Struct({
+	id: l.String,
+	signalName: l.String,
+	payload: l.optional(l.Unknown)
+}), Zt = l.Struct({
+	id: l.String,
+	updateName: l.String,
+	payload: l.optional(l.Unknown),
+	timeoutMs: l.optional(l.Number)
+}), Qt = l.Struct({
+	eventId: l.String,
+	updateId: l.String,
+	completedEventId: l.String,
+	result: l.Unknown
+}), $t = B({
 	name: "__voltro.workflow.run",
 	source: "_voltro_workflow_runs",
-	input: V,
-	output: c.Array(F)
-}), _t = _({
+	input: qt,
+	output: l.Array(Y)
+}), en = B({
 	name: "__voltro.workflow.runs",
 	source: "_voltro_workflow_runs",
-	input: I,
-	output: c.Array(F)
-}), vt = _({
+	input: Ht,
+	output: l.Array(Y)
+}), tn = B({
 	name: "__voltro.workflow.run.steps",
 	source: "_voltro_workflow_run_steps",
-	input: H,
-	output: c.Array(L)
-}), yt = _({
+	input: X,
+	output: l.Array(Ut)
+}), nn = B({
 	name: "__voltro.workflow.run.events",
 	source: "_voltro_workflow_run_events",
-	input: H,
-	output: c.Array(R)
-}), bt = _({
+	input: X,
+	output: l.Array(Wt)
+}), rn = B({
 	name: "__voltro.workflow.domainEvents",
 	source: "_voltro_workflow_events",
-	input: U,
-	output: c.Array(z)
-}), xt = _({
+	input: Jt,
+	output: l.Array(Gt)
+}), an = B({
 	name: "__voltro.workflow.event.deliveries",
 	source: "_voltro_workflow_event_deliveries",
-	input: W,
-	output: c.Array(B)
-}), St = y({
+	input: Yt,
+	output: l.Array(Kt)
+}), on = H({
 	name: "__voltro.workflow.cancel",
-	input: G,
-	output: c.Struct({ ok: c.Boolean })
-}), Ct = y({
+	input: Z,
+	output: l.Struct({ ok: l.Boolean })
+}), sn = H({
 	name: "__voltro.workflow.resume",
-	input: G,
-	output: c.Struct({ ok: c.Boolean })
-}), wt = y({
+	input: Z,
+	output: l.Struct({ ok: l.Boolean })
+}), cn = H({
 	name: "__voltro.workflow.signal",
-	input: K,
-	output: c.Struct({ eventId: c.String })
-}), Tt = y({
+	input: Xt,
+	output: l.Struct({ eventId: l.String })
+}), ln = H({
 	name: "__voltro.workflow.update",
-	input: q,
-	output: J
-}), Y = "__voltro.undo.log", X = "__voltro.undo.apply", Et = "__voltro.undo.redo", Dt = c.Struct({
-	id: c.String,
-	tag: c.String,
-	label: c.NullOr(c.String),
-	undone: c.Boolean,
-	crossesAction: c.Boolean,
-	createdAt: c.String
-}), Ot = class extends c.TaggedError()("UndoNotFound", { invocationId: c.String }) {}, kt = class extends c.TaggedError()("UndoForbidden", { invocationId: c.String }) {}, At = class extends c.TaggedError()("UndoConflict", {
-	invocationId: c.String,
-	reason: c.Literal("conflict", "action")
-}) {}, jt = c.Union(Ot, kt, At), Mt = _({
-	name: Y,
+	input: Zt,
+	output: Qt
+}), un = "__voltro.undo.log", dn = "__voltro.undo.apply", fn = "__voltro.undo.redo", pn = l.Struct({
+	id: l.String,
+	tag: l.String,
+	label: l.NullOr(l.String),
+	undone: l.Boolean,
+	crossesAction: l.Boolean,
+	createdAt: l.String
+}), mn = class extends l.TaggedError()("UndoNotFound", { invocationId: l.String }) {}, hn = class extends l.TaggedError()("UndoForbidden", { invocationId: l.String }) {}, gn = class extends l.TaggedError()("UndoConflict", {
+	invocationId: l.String,
+	reason: l.Literal("conflict", "action")
+}) {}, _n = l.Union(mn, hn, gn), vn = B({
+	name: un,
 	source: "_voltro_undo_log",
-	input: c.Struct({ limit: c.optional(c.Number) }),
-	output: c.Array(Dt)
-}), Nt = v({
-	name: X,
-	input: c.Struct({ invocationId: c.String }),
-	output: c.Struct({ ok: c.Boolean }),
-	error: jt
-}), Pt = v({
-	name: Et,
-	input: c.Struct({ invocationId: c.String }),
-	output: c.Struct({ ok: c.Boolean }),
-	error: jt
-}), Ft = "__voltro.connections.list", It = "__voltro.connections.start", Lt = "__voltro.connections.submitToken", Rt = "__voltro.connections.disconnect", Z = c.Literal("oauth2", "pat"), zt = c.Literal("disconnected", "connected", "expired", "revoked", "error"), Q = c.Struct({
-	connectionId: c.String,
-	kind: Z,
-	label: c.String,
-	status: zt,
-	accountId: c.NullOr(c.String),
-	accountLabel: c.NullOr(c.String),
-	scopes: c.Array(c.String),
-	expiresAt: c.NullOr(c.String),
-	lastError: c.NullOr(c.String),
-	connectedAt: c.NullOr(c.String)
-}), Bt = class extends c.TaggedError()("ConnectionNotDeclared", { connectionId: c.String }) {}, Vt = class extends c.TaggedError()("ConnectionSubjectRequired", { connectionId: c.String }) {}, Ht = class extends c.TaggedError()("ConnectionKindMismatch", {
-	connectionId: c.String,
-	expected: Z,
-	actual: Z
-}) {}, Ut = class extends c.TaggedError()("ConnectionHandshakeFailed", {
-	connectionId: c.String,
-	reason: c.String,
-	transient: c.Boolean
-}) {}, $ = c.Union(Bt, Vt, Ht, Ut), Wt = _({
-	name: Ft,
+	input: l.Struct({ limit: l.optional(l.Number) }),
+	output: l.Array(pn),
+	openAccess: "subject-scoped by construction: lists only the calling subject's own undoable actions"
+}), yn = V({
+	name: dn,
+	input: l.Struct({ invocationId: l.String }),
+	output: l.Struct({ ok: l.Boolean }),
+	error: _n,
+	openAccess: "subject-scoped by construction: undo is per-actor — another subject's invocation fails typed with UndoForbidden"
+}), bn = V({
+	name: fn,
+	input: l.Struct({ invocationId: l.String }),
+	output: l.Struct({ ok: l.Boolean }),
+	error: _n,
+	openAccess: "subject-scoped by construction: redo is per-actor — another subject's invocation fails typed with UndoForbidden"
+}), xn = "__voltro.approvals.pending", Sn = "__voltro.approvals.decide", Cn = B({
+	name: xn,
+	source: "_voltro_approvals",
+	input: l.Struct({ limit: l.optional(l.Number) }),
+	output: l.Array(O),
+	openAccess: "the answer is scoped to the caller — a row appears only if they requested it or hold its recorded approver scopes, so an anonymous caller sees nothing"
+}), wn = V({
+	name: Sn,
+	input: l.Struct({
+		approvalId: l.String,
+		decision: l.Literal("approve", "reject"),
+		note: l.optional(l.String)
+	}),
+	output: l.Struct({
+		approvalId: l.String,
+		status: l.Literal("approved", "rejected")
+	}),
+	error: D,
+	openAccess: "the approver authority is the PENDING ROW's own recorded scopes (plus an unconditional self-approval refusal), checked in-handler — a descriptor-level scope would have to be the union of every approval-requiring procedure in the app"
+}), Tn = "__voltro.connections.list", En = "__voltro.connections.start", Dn = "__voltro.connections.submitToken", On = "__voltro.connections.disconnect", Q = l.Literal("oauth2", "pat"), kn = l.Literal("disconnected", "connected", "expired", "revoked", "error"), An = l.Struct({
+	connectionId: l.String,
+	kind: Q,
+	label: l.String,
+	status: kn,
+	accountId: l.NullOr(l.String),
+	accountLabel: l.NullOr(l.String),
+	scopes: l.Array(l.String),
+	expiresAt: l.NullOr(l.String),
+	lastError: l.NullOr(l.String),
+	connectedAt: l.NullOr(l.String)
+}), jn = class extends l.TaggedError()("ConnectionNotDeclared", { connectionId: l.String }) {}, Mn = class extends l.TaggedError()("ConnectionSubjectRequired", { connectionId: l.String }) {}, Nn = class extends l.TaggedError()("ConnectionKindMismatch", {
+	connectionId: l.String,
+	expected: Q,
+	actual: Q
+}) {}, Pn = class extends l.TaggedError()("ConnectionHandshakeFailed", {
+	connectionId: l.String,
+	reason: l.String,
+	transient: l.Boolean
+}) {}, $ = l.Union(jn, Mn, Nn, Pn), Fn = B({
+	name: Tn,
 	source: "_voltro_connections",
-	input: c.Struct({}),
-	output: c.Array(Q)
-}), Gt = y({
-	name: It,
-	input: c.Struct({
-		connectionId: c.String,
-		redirectTo: c.optional(c.String)
+	input: l.Struct({}),
+	output: l.Array(An),
+	openAccess: "self-scoped read: projects the declared connections for the calling subject only (its own connect/disconnect state)"
+}), In = H({
+	name: En,
+	input: l.Struct({
+		connectionId: l.String,
+		redirectTo: l.optional(l.String)
 	}),
-	output: c.Struct({
-		authorizeUrl: c.String,
-		state: c.String
+	output: l.Struct({
+		authorizeUrl: l.String,
+		state: l.String
 	}),
-	error: $
-}), Kt = v({
-	name: Lt,
-	input: c.Struct({
-		connectionId: c.String,
-		token: c.String
+	error: $,
+	openAccess: "self-service: begins an oauth handshake that stores a credential for the calling subject only; anonymous callers fail typed with ConnectionSubjectRequired"
+}), Ln = V({
+	name: Dn,
+	input: l.Struct({
+		connectionId: l.String,
+		token: l.String
 	}),
-	output: c.Struct({ ok: c.Boolean }),
-	error: $
-}), qt = v({
-	name: Rt,
-	input: c.Struct({ connectionId: c.String }),
-	output: c.Struct({ ok: c.Boolean }),
-	error: $
-}), Jt = (e) => {
+	output: l.Struct({ ok: l.Boolean }),
+	error: $,
+	openAccess: "self-service: stores a pasted token as the calling subject's own credential; anonymous callers fail typed with ConnectionSubjectRequired"
+}), Rn = V({
+	name: On,
+	input: l.Struct({ connectionId: l.String }),
+	output: l.Struct({ ok: l.Boolean }),
+	error: $,
+	openAccess: "self-service: deletes only the calling subject's own credential row for this connection"
+}), zn = (e) => {
 	let t = e instanceof Date ? e.getTime() : typeof e == "number" ? e : typeof e == "string" ? new Date(e).getTime() : 0;
 	return Number.isNaN(t) ? 0 : t;
-}, Yt = 1;
+}, Bn = 1;
 //#endregion
-export { ce as ADMIN_SCOPE, he as APIKEY_ISSUE_ORG_SCOPE, re as APIKEY_ISSUE_OTHER_SCOPE, ie as APIKEY_ISSUE_SELF_SCOPE, je as AuthMiddleware, h as BusinessRuleViolation, Ft as CONNECTIONS_LIST_TAG, Rt as CONNECTION_DISCONNECT_TAG, It as CONNECTION_START_TAG, Lt as CONNECTION_SUBMIT_TOKEN_TAG, Ut as ConnectionHandshakeFailed, Ee as ConnectionInfo, ke as ConnectionInfoMiddleware, Z as ConnectionKind, Ht as ConnectionKindMismatch, Bt as ConnectionNotDeclared, Q as ConnectionState, zt as ConnectionStatus, Vt as ConnectionSubjectRequired, at as EVENT_ROUTE_SEP, rt as EventKeyInvalid, nt as EventPayloadInvalid, it as EventPayloadTooLarge, Qe as MAX_EVENT_ENVELOPE_BYTES, Yt as PROTOCOL_VERSION, s as ScopeError, we as Subject, be as SubjectService, X as UNDO_APPLY_TAG, Y as UNDO_LOG_TAG, Et as UNDO_REDO_TAG, De as Unauthenticated, At as UndoConflict, kt as UndoForbidden, Dt as UndoLogEntry, Ot as UndoNotFound, G as WorkflowControlInputSchema, z as WorkflowDomainEventRowSchema, U as WorkflowDomainEventsInputSchema, W as WorkflowEventDeliveriesInputSchema, B as WorkflowEventDeliveryRowSchema, N as WorkflowParentClosePolicySchema, R as WorkflowRunEventRowSchema, ht as WorkflowRunHandleSchema, V as WorkflowRunRefSchema, F as WorkflowRunRowSchema, M as WorkflowRunStatusSchema, L as WorkflowRunStepRowSchema, H as WorkflowRunTableRefSchema, I as WorkflowRunsInputSchema, K as WorkflowSignalInputSchema, P as WorkflowStartDeferralSchema, q as WorkflowUpdateInputSchema, J as WorkflowUpdateResultSchema, Je as actionToRpc, le as advisoryResourceGuardWarning, Ae as anonymousSubject, Be as applyRowPatch, xe as assertAuthenticated, fe as beginIdempotent, pt as checkFrameworkCompat, oe as checkGuards, ae as checkGuardsEffect, Te as composeAuthStrategies, dt as composeRpcInterceptors, qt as connectionDisconnectDescriptor, Gt as connectionStartDescriptor, Kt as connectionSubmitTokenDescriptor, Wt as connectionsListQueryDescriptor, y as defineAction, et as defineEvent, v as defineMutation, lt as definePlugin, ut as definePluginRoute, ft as definePluginService, _ as defineQuery, We as defineStream, Re as diffRows, o as effectiveScopes, k as encodeEventKey, Ye as errorTag, T as eventAttached, C as eventEnvelope, w as eventGap, D as eventResumePoint, ot as eventRoute, E as eventStreamEvent, O as eventSubscribeInput, tt as eventToRpc, se as failIdempotent, ge as findAdvisoryResourceGuards, ee as finishIdempotent, ct as formatEventRoute, ye as getPolicyGuardResolver, te as getResourceScopeResolver, Me as hasCallbackRoutes, ve as hasEffectiveScope, i as hasScope, p as idToPath, de as idempotencyScope, $e as isEventDescriptor, ze as isIdKeyed, e as isPolicyCheck, Ue as isPolicyGuard, Se as isSystemSubject, He as isWireReachable, pe as memoryIdempotencyStore, qe as mutationToRpc, Ze as normalizeDescriptor, st as parseEventRoute, Ie as pathToId, me as publishServerError, Ke as queryToRpc, _e as requireScope, d as rowPatchOpSchema, f as rowPatchSchema, a as setEffectiveScopes, n as setPolicyGuardResolver, t as setResourceScopeResolver, S as streamToRpc, r as subjectScopes, ue as subscribeServerErrors, Ve as subscriptionEvent, Ce as systemSubject, Oe as tenantScopedSubject, Xe as toRpc, Jt as tsMs, Nt as undoApplyDescriptor, Mt as undoLogQueryDescriptor, Pt as undoRedoDescriptor, St as workflowCancelDescriptor, bt as workflowDomainEventsQueryDescriptor, xt as workflowEventDeliveriesQueryDescriptor, Ct as workflowResumeDescriptor, yt as workflowRunEventsQueryDescriptor, gt as workflowRunQueryDescriptor, vt as workflowRunStepsQueryDescriptor, _t as workflowRunsQueryDescriptor, wt as workflowSignalDescriptor, Tt as workflowUpdateDescriptor, ne as wsMutationIdempotencyScope };
+export { je as ADMIN_SCOPE, oe as APIKEY_ISSUE_ORG_SCOPE, n as APIKEY_ISSUE_OTHER_SCOPE, Ae as APIKEY_ISSUE_SELF_SCOPE, Sn as APPROVALS_DECIDE_TAG, xn as APPROVALS_PENDING_TAG, D as ApprovalDecisionErrors, E as ApprovalErrors, S as ApprovalExpired, w as ApprovalForbidden, y as ApprovalNotFound, C as ApprovalNotPending, x as ApprovalRejected, v as ApprovalRequired, b as ApprovalSelfApproval, T as ApprovalUnavailable, De as AuthMiddleware, _ as BusinessRuleViolation, Tn as CONNECTIONS_LIST_TAG, On as CONNECTION_DISCONNECT_TAG, En as CONNECTION_START_TAG, Dn as CONNECTION_SUBMIT_TOKEN_TAG, Pn as ConnectionHandshakeFailed, Se as ConnectionInfo, Te as ConnectionInfoMiddleware, Q as ConnectionKind, Nn as ConnectionKindMismatch, jn as ConnectionNotDeclared, An as ConnectionState, kn as ConnectionStatus, Mn as ConnectionSubjectRequired, _e as DEFAULT_SCOPE_CACHE_MAX_ENTRIES, ue as DEFAULT_SCOPE_CACHE_TTL_MS, Ot as EVENT_ROUTE_SEP, Tt as EventKeyInvalid, wt as EventPayloadInvalid, Et as EventPayloadTooLarge, ht as MAX_EVENT_ENVELOPE_BYTES, Bn as PROTOCOL_VERSION, O as PendingApproval, k as REACTIVITY_CHANNEL_PREFIX, c as ScopeError, Ce as Subject, Ee as SubjectIdentity, fe as SubjectService, dn as UNDO_APPLY_TAG, un as UNDO_LOG_TAG, fn as UNDO_REDO_TAG, be as Unauthenticated, gn as UndoConflict, hn as UndoForbidden, pn as UndoLogEntry, mn as UndoNotFound, Z as WorkflowControlInputSchema, Gt as WorkflowDomainEventRowSchema, Jt as WorkflowDomainEventsInputSchema, Yt as WorkflowEventDeliveriesInputSchema, Kt as WorkflowEventDeliveryRowSchema, zt as WorkflowParentClosePolicySchema, Wt as WorkflowRunEventRowSchema, Vt as WorkflowRunHandleSchema, qt as WorkflowRunRefSchema, Y as WorkflowRunRowSchema, J as WorkflowRunStatusSchema, Ut as WorkflowRunStepRowSchema, X as WorkflowRunTableRefSchema, Ht as WorkflowRunsInputSchema, Xt as WorkflowSignalInputSchema, Bt as WorkflowStartDeferralSchema, Zt as WorkflowUpdateInputSchema, Qt as WorkflowUpdateResultSchema, ut as actionToRpc, i as advisoryResourceGuardWarning, Oe as anonymousSubject, Ye as applyRowPatch, pe as applyScopeDecision, wn as approvalsDecideDescriptor, Cn as approvalsPendingQueryDescriptor, me as assertAuthenticated, ze as beginIdempotent, Lt as checkFrameworkCompat, r as checkGuards, ie as checkGuardsEffect, we as composeAuthStrategies, Ft as composeRpcInterceptors, Rn as connectionDisconnectDescriptor, In as connectionStartDescriptor, Ln as connectionSubmitTokenDescriptor, Fn as connectionsListQueryDescriptor, F as declaredReactivityChannelKeys, H as defineAction, _t as defineEvent, V as defineMutation, Mt as definePlugin, Nt as definePluginRoute, It as definePluginService, B as defineQuery, at as defineStream, qe as diffRows, ye as effectiveScopes, Dt as encodeEventKey, ft as errorTag, bt as eventAttached, vt as eventEnvelope, yt as eventGap, G as eventResumePoint, kt as eventRoute, xt as eventStreamEvent, St as eventSubscribeInput, Ct as eventToRpc, Ie as failIdempotent, e as findAdvisoryResourceGuards, Pe as finishIdempotent, jt as formatEventRoute, ve as getPolicyGuardResolver, ne as getResourceScopeResolver, it as hasAccessDecision, xe as hasCallbackRoutes, re as hasEffectiveScope, ae as hasScope, m as idToPath, Re as idempotencyScope, gt as isEventDescriptor, Je as isIdKeyed, a as isOpenAccess, ee as isPolicyCheck, rt as isPolicyGuard, N as isReactivityChannel, P as isReactivityChannelKey, ge as isSystemSubject, tt as isWireReachable, he as makeScopeCache, Be as memoryIdempotencyStore, te as missingAccessDecision, lt as mutationToRpc, mt as normalizeDescriptor, Qe as normalizeSource, s as openAccessSpec, At as parseEventRoute, Ge as pathToId, Pt as pluginInstanceName, et as publishReactivity, Ve as publishServerError, ct as queryToRpc, Ze as reactivityChannel, Ne as requireScope, f as rowPatchOpSchema, p as rowPatchSchema, le as scopeCacheKey, t as setEffectiveScopes, ce as setPolicyGuardResolver, o as setResourceScopeResolver, L as sourceKeys, dt as streamToRpc, ke as subjectIdentity, se as subjectScopes, Le as subscribeServerErrors, g as subscriptionEvent, Me as systemSubject, de as tenantScopedSubject, pt as toRpc, zn as tsMs, $e as undeclaredChannelKeys, yn as undoApplyDescriptor, vn as undoLogQueryDescriptor, bn as undoRedoDescriptor, on as workflowCancelDescriptor, rn as workflowDomainEventsQueryDescriptor, an as workflowEventDeliveriesQueryDescriptor, sn as workflowResumeDescriptor, nn as workflowRunEventsQueryDescriptor, $t as workflowRunQueryDescriptor, tn as workflowRunStepsQueryDescriptor, en as workflowRunsQueryDescriptor, cn as workflowSignalDescriptor, ln as workflowUpdateDescriptor, Fe as wsMutationIdempotencyScope };