@voltro/protocol 0.40.0 → 0.41.0

package/CHANGELOG.md

@@ -39,6 +39,80 @@ _Changes staged for the next release accumulate here (rolled up from
 
 ---
 
+## [0.41.0] — 2026-08-17
+
+### ⚠ BREAKING
+
+- **@voltro/web, @voltro/cli** — `middleware.ts` exports `defineMiddleware(...)` (from `@voltro/web/middleware`) instead of a bare function, and each export carries its own `match`. Several middlewares per file are allowed; **at most one may match a given route**.
+
+  Migration: the codemod wraps the existing default export. That is behaviour-preserving — no `match` means every server-rendered route, which is what an unwrapped middleware did — and its note explains how to replace a hand-written path gate with a `match`.
+
+  **Why it was worth a break.** A hand-written `if (!req.pathname.startsWith('/app')) return` is invisible: nothing can tell you a middleware runs nowhere, or that two of them claim one route. `match` puts it where both the boot and `voltro doctor` can read it.
+
+  **The matcher speaks ROUTES, not URL patterns** — `under` / `routes` / `except`, validated against the app's own route patterns. A path matching no route refuses the boot instead of silently never firing. This is the deliberate difference from the `'/((?!api|_next/static|…).*)'` shape: our hook runs after route matching, so an app has never needed to know its own asset layout, and non-page requests are reachable only by asking (`assets: true`) — where, note, there is no render, so only `setCookies` takes effect.
+
+  An overlap refuses the boot and names both middlewares plus the route. Declaration order is not a semantic, "most specific wins" silently drops the broader hook, and merging needs a per-field rule nobody remembers — so two hooks writing one `authorization` header is a refusal, not a resolution.
+
+  **The web bundle budget moved UP, and the split is worth stating** because only one half is a cost the framework imposes:
+
+  | measured | before | after | | --- | --- | --- | | first load | 184 955 B | 185 309 B (**+354**) | | lazy route chunks | 3 502 B | 4 415 B (+913) |
+
+  The **+354 B of first load is the real price** — one `serverContext` chunk, 0.2 KB gz, which every app now carries whether or not it declares a middleware. That is the number to argue with, and it leaves 6.7 KB of headroom under the ceiling.
+
+  The +913 B is NOT a per-route regression: the fixture gained four routes (`exact`, `exact/[id]`, `mw`, `mw/skip`) to exercise the feature end to end, at 0.1–0.2 KB gz each, which accounts for the growth without remainder. Re-pinned with `--update` rather than by hand, so the `slackFloor` keeps ratcheting — a ceiling nobody lowers again silently permits re-inflating to the old number.
+
+### Fixed
+
+- **@voltro/data-transfer, @voltro/cli** — `voltro data export` could not export a table whose primary key is not named `id`, and one of its two failure modes reported success.
+
+  The keyset column was `columns.find(c => c.type === 'id')?.name ?? 'id'`, and `type: 'id'` is tagged only on a column that is BOTH the single-column primary key AND literally named `id` — identically in all four dialect introspectors. So any introspected table with another PK name was ordered by a column that does not exist. It now comes from the real primary key (the synthesised `<table>_pkey` index), with the declared `id()` column still winning where there is one.
+
+  **A composite or absent primary key is now REFUSED**, not silently ordered by the first column: keyset pagination on a non-unique order splits equal values across page boundaries, so rows are dropped or duplicated into a bundle that reports success. Bounded exports are recoverable; a quietly short backup is discovered at the restore.
+
+  **A requested table missing from the schema is refused too.** `scope: { kind: 'tables' }` used to drop unknown names, so a run that explicitly named a table wrote `"tables": []` and printed `export complete` with exit 0. `kind: 'all'` over an empty database is still a legal empty export — the asymmetry is deliberate: a named table is an expectation.
+
+  **Failure reasons survive.** `String(e?.message ?? e)` produced `"write table failed: "` with nothing after the colon — `??` falls back on null/undefined, and an Effect `TaggedError` carries an empty-string `message`. Every catch site in the exporter now reports tag, message or cause.
+
+  **New: `voltro data export --exclude a,b`** — everything except these, resolved against the live table list. It is the escape hatch the refusals above require; without it a single unkeyable table would block a whole-database export. An unknown name is refused for the same reason. Direct target only (the expansion needs the live table list), and it expands to an explicit `tables` scope, so the manifest records what was actually exported.
+
+  Reported with a reduced repro, a four-way variation over PK TYPES that ruled type out, and two disproved hypotheses. The affected tables include `@effect/cluster`'s own (`cluster_locks`, `cluster_migrations`), so no app running workflows could take a whole-database export.
+- **@voltro/database, @voltro/runtime, @voltro/cli** — `.encrypted()` had three writers and two encodings. The store wrote `encrypt(JSON.stringify(v))`; `encryptField` — the documented raw-SQL escape hatch — and `voltro db encrypt-column` wrote `encrypt(v)`. All three produce the same `enc:v1:` envelope and nothing distinguished them, so a value written by one and read by another either threw with the wrong diagnosis or came back subtly wrong (`decryptField` handed back the JSON encoding verbatim, quotes and all, raising nothing).
+
+  There is one encoding for every WRITE now, and every READ resolves BOTH forms — so **no data has to be rewritten and nothing is blocked**. That second half is the point: the old form is already on staging and production disks, and a fix that needs the rows rewritten before the app works is an outage with a migration attached.
+
+  Reading two forms is deterministic, not a heuristic. After decrypting, a parse failure is the raw form; a parse to a STRING is the JSON form; a parse to a non-string depends on the column's declared type (a text column cannot hold a number, so `12345` is a raw string that parsed by accident). The one case nothing can separate — a raw secret whose literal text is `"abc"`, quotes included — is stated in the code rather than hidden.
+
+  **`voltro db encrypt-column` verified itself against the wrong decoder.** It wrote the raw form and checked it with `cipher.decrypt` — a decoder nothing reads these columns with — so it reported success over columns the app could not read. It round-trips through `decodeFieldValue` now, the same function the store calls. A self-check against a decoder the runtime does not use is not a weaker check; it is a second opinion from the same mistake.
+
+  The command also NORMALISES rows in the old encoding as it goes (reported separately from the ones it encrypts), so an operator does not write a script per column. It skips anything ambiguous and anything it cannot decrypt.
+
+  **The width pre-flight measured the wrong thing after the encoding changed.** It sized the ciphertext from the PLAINTEXT's byte length while the cipher is handed the JSON encoding — two characters more at minimum, and more for every escape. Measured on a real MariaDB: a 63-byte value in a `varchar(135)` passed the check and the UPDATE answered `ER_DATA_TOO_LONG`, which is the failure that check exists to prevent, mid-column with the rest already converted. It measures the encoded length now, and the refusal says "encodes to" rather than "is" so an operator measuring their own column finds the number it names.
+
+  **Two dialect defects, both found by running the command against real servers.** SQL Server reports `-1` for `NVARCHAR(MAX)` — its spelling of unbounded — and the pre-flight read it as a one-character column, so it refused the widest column the dialect has and printed `declared as -1` at the operator. And SQLITE has no `information_schema` at all: the shared catalog query died there with `Failed to prepare statement` and no statement attached, on a dialect the command claims to support. It uses `pragma_table_info` now, reporting no length because sqlite enforces none.
+
+  Measured end to end on postgres, mysql, mariadb, mssql and sqlite: a table holding plaintext, the old encoding and the current encoding side by side converts, every row decodes back to its original value, a re-run writes nothing, and a wrong key refuses with exit 1.
+
+  **Backups and restores were never affected and now say so.** `voltro data export` reads through the raw dialect store, so ciphertext travels verbatim in either encoding — pinned by a test, because a future change that wrapped that store would put plaintext credentials in a bundle.
+- **@voltro/protocol, @voltro/cli** — Three findings from one consumer round, all of the same shape: something the framework knows and does not say.
+
+  **A decode failure on a GUARDED procedure now says the guard did not run.** The payload decodes before the handler, so a guard on a procedure with a malformed payload never gets the chance to refuse. A consumer auditing a guard called one with an incomplete payload, got a decode error instead of a `ScopeError`, and concluded the guard was not applied — the wrong conclusion in the dangerous direction. The title now carries `(guarded — the guard did NOT run: the payload failed to decode first, so this says nothing about access)`. It discloses nothing new: that a procedure is guarded is already visible to anyone who sends a VALID payload. An `openAccess:` declaration is not an enforced guard and gets no such sentence — `hasEnforcedGuard` is the one predicate, read by both the label and the wire error union, because two copies of that rule would disagree invisibly.
+
+  **`middleware.ts`'s `httpOnly` default is documented at the field, and warned about.** It defaults to `HttpOnly`, which is wrong for a session cookie a browser SDK reads back: Supabase's `createBrowserClient` reads `document.cookie`, so a forgotten `httpOnly: false` gives the browser a session it cannot see — the SSR render is perfect and the user is signed out at the first client-side call. The consumer only avoided shipping it because their probes already set the flag. `voltro dev` warns once per cookie when a session-shaped name is written with no `httpOnly` decision; an explicit decision either way silences it, because warning on a decision is how a diagnostic becomes noise.
+
+  **`voltro dev` restarts when `middleware.ts` changes.** It is loaded once per boot, that is documented, and a consumer read it and still lost an afternoon: they sabotaged the middleware, saw no change, and concluded it was not wired — in an environment where everything else hot-reloads. It now restarts through the same respawn a hard-restart field in `app.config.ts` uses, extracted so there is one copy of the `execArgv` inheritance and the signal forwarding.
+- **@voltro/cli** — `middleware.ts` now produces ONE view of the request that every downstream reader takes. Previously only `buildLoaderQuery` saw the hook's result, while the loader context (`ctx.headers`), the SSR request snapshot (`useServerRequest()`) and the locale resolver kept reading the raw request — four readers, two answers, within eighty lines of one function.
+
+  The consequence was worse than an inconsistency: a hook that renews purely via `setCookies` — no `headers` at all, which is the normal shape for a cookie-session IdP and the reason the response half exists — moved nothing for the render that ran it. The rpc call still sent the old `Cookie` header, because a renewed cookie only reached the browser.
+
+  `setCookies` is applied to the cookie jar before the render, the `Cookie` header is rebuilt from that jar (an explicit `cookie` in the hook's own `headers` still wins), and `maxAge <= 0` deletes, so a hook that signs someone out renders them signed out. Both SSR boot paths shadow the raw headers out of scope after the hook runs, so a new reader added below is correct without knowing any of this.
+- **@voltro/cli** — `voltro start` dropped `middleware.ts`'s `Set-Cookie` on **streamed** responses — which is the arm a plain `renderMode: 'ssr'` page takes, so it was the common case. The hook renewed the session server-side, the render used the fresh value, and the browser kept the consumed one. Against an IdP that rotates refresh tokens and detects reuse, that is worse than not renewing at all.
+
+  The cause is worth stating because it read as handled: a streamed response hands the socket to `stream(res)` and the caller never looks at the returned `headers`, so the `withCookies(...)` wrapper on that arm was dead code — sitting under a comment promising the cookies were written on every arm. The cookies now travel with the headers `streamSsrResponse` itself writes, and the dead wrapper is gone.
+
+  Found by booting real `voltro dev` and `voltro start` servers against a fixture and reading the response. Every unit test was green throughout, and the render's own HTML was correct — only the wire was wrong.
+
+---
+
 ## [0.40.0] — 2026-08-16
 
 ### ⚠ BREAKING

package/dist/index.d.ts

@@ -2052,6 +2052,22 @@ export declare const hasCallbackRoutes: (s: AuthStrategy) => s is AuthStrategyWi
  *  `hasScope` anywhere rbac roles should count. */
 export declare const hasEffectiveScope: (subject: Subject, scope: string) => boolean;
 
+/**
+ * Does this procedure carry a guard that can actually REFUSE?
+ *
+ * A declared `openAccess:` is an access decision, not a check — nothing can fail
+ * with a `ScopeError`, so it neither widens the wire union nor makes a decode
+ * failure worth annotating.
+ *
+ * One function because it now has two readers, and this repo's per-seam scar is
+ * exactly a predicate that got copied: `withGuardError` decides the wire error
+ * union, and `strictInput`'s label decides whether a decode failure says the
+ * guard did not run. Two copies would eventually disagree about `openAccess:`,
+ * and the disagreement would surface as a procedure that says "guarded" while
+ * declaring no `ScopeError` — or the reverse.
+ */
+export declare const hasEnforcedGuard: (guards: DeclaredAccess | undefined) => boolean;
+
 /** True if the subject holds `scope` (or the `admin:full` bypass). Checks only
  *  the RAW subject scopes — use `hasEffectiveScope` to include rbac roles. */
 export declare const hasScope: (subject: Subject, scope: string) => boolean;
@@ -2186,6 +2202,33 @@ export declare const idToPath: (id: RowId) => string;
  */
 export declare const IMPERSONATION_METADATA_KEY: "impersonation";
 
+/**
+ * The title a decode failure carries — and, on a GUARDED procedure, the one
+ * sentence that stops the failure being read as "the guard did not fire".
+ *
+ * ── Why this sentence exists ───────────────────────────────────────────────
+ *
+ * The ordering above is not fixable at this seam: the payload decodes before
+ * the handler, so a guard on a procedure with a malformed payload never runs. A
+ * consumer checking a guard on 2026-08-16 called such a procedure with an
+ * incomplete payload, got a decode error instead of a `ScopeError`, and
+ * concluded the guard was not being applied. It was; it never got the chance.
+ * With a complete payload the picture flipped immediately.
+ *
+ * That is the more dangerous of the two misreadings — it says "unprotected"
+ * about something protected — and it is the one the ordering makes easy. So a
+ * guarded procedure says so in the title:
+ *
+ *     workAreas.create input (guarded — the guard did NOT run: the payload
+ *     failed to decode first, so this says nothing about access)
+ *     └─ ["type"] └─ is missing
+ *
+ * It discloses nothing new. That a procedure is guarded is already visible to
+ * any caller who sends a VALID payload and receives `ScopeError`, and the
+ * message names no scope, no resource and no field type.
+ */
+export declare const inputLabel: (procedure?: string, guarded?: boolean) => string;
+
 export declare interface InsertTarget<Input = unknown, Row = unknown, Item = Record<string, unknown>> extends NestedTargetFields<Input> {
     readonly table: string;
     readonly op: 'insert';
@@ -4085,7 +4128,7 @@ export declare const streamToRpc: <Name extends string, Input extends Schema.Sch
  * non-struct payload (`Schema.Void`, a scalar) is unaffected — there is no
  * excess property for it to have.
  */
-export declare const strictInput: <S extends Schema.Schema.Any>(input: S, procedure?: string) => S;
+export declare const strictInput: <S extends Schema.Schema.Any>(input: S, procedure?: string, guarded?: boolean) => S;
 
 export declare const Subject: Schema.Union<[Schema.Struct<{
     type: Schema.Literal<["user"]>;

package/dist/index.js

@@ -76,16 +76,19 @@ var We = d.Union(d.String, d.Number), p = d.Record({
 	_tag: d.Literal("error"),
 	error: d.Unknown,
 	revision: d.optional(d.Number)
-})), Xe = (e) => {
+})), y = (e, t) => {
+	let n = `${e ?? "this procedure"} input`;
+	return t === !0 ? `${n} (guarded — the guard did NOT run: the payload failed to decode first, so this says nothing about access)` : n;
+}, Xe = (e) => {
 	let t = e.ast;
 	return t._tag === "TypeLiteral" && (t.propertySignatures?.length ?? 0) === 0 && (t.indexSignatures?.length ?? 0) === 0;
-}, y = (e, t) => {
-	let n = e.annotations({
+}, b = (e, t, n) => {
+	let r = y(t, n), i = e.annotations({
 		parseOptions: { onExcessProperty: "error" },
-		parseIssueTitle: () => `${t ?? "this procedure"} input`
+		parseIssueTitle: () => r
 	});
-	return Xe(e) ? d.filter((e) => typeof e == "object" && e && Object.keys(e).length > 0 ? `this procedure declares no input; received: ${Object.keys(e).join(", ")}` : void 0)(n).annotations({ identifier: `${t ?? "this procedure"} input` }) : n;
-}, b = class extends d.TaggedError()("BusinessRuleViolation", {
+	return Xe(e) ? d.filter((e) => typeof e == "object" && e && Object.keys(e).length > 0 ? `this procedure declares no input; received: ${Object.keys(e).join(", ")}` : void 0)(i).annotations({ identifier: r }) : i;
+}, x = class extends d.TaggedError()("BusinessRuleViolation", {
 	rule: d.String,
 	params: d.optional(d.Record({
 		key: d.String,
@@ -94,34 +97,34 @@ var We = d.Union(d.String, d.Number), p = d.Record({
 	field: d.optional(d.String),
 	message: d.optional(d.String),
 	severity: d.Literal("error", "warning")
-}) {}, x = class extends d.TaggedError()("ApprovalRequired", {
+}) {}, S = class extends d.TaggedError()("ApprovalRequired", {
 	approvalId: d.String,
 	procedure: d.String,
 	expiresAt: d.String,
 	requiredScopes: d.Array(d.String),
 	reason: d.NullOr(d.String),
 	created: d.Boolean
-}) {}, S = class extends d.TaggedError()("ApprovalNotFound", { approvalId: d.String }) {}, C = class extends d.TaggedError()("ApprovalSelfApproval", {
+}) {}, C = class extends d.TaggedError()("ApprovalNotFound", { approvalId: d.String }) {}, w = class extends d.TaggedError()("ApprovalSelfApproval", {
 	approvalId: d.String,
 	subjectId: d.NullOr(d.String)
-}) {}, w = class extends d.TaggedError()("ApprovalRejected", {
+}) {}, T = class extends d.TaggedError()("ApprovalRejected", {
 	approvalId: d.String,
 	decidedBy: d.NullOr(d.String),
 	note: d.NullOr(d.String)
-}) {}, T = class extends d.TaggedError()("ApprovalExpired", {
+}) {}, E = class extends d.TaggedError()("ApprovalExpired", {
 	approvalId: d.String,
 	expiredAt: d.String
-}) {}, E = class extends d.TaggedError()("ApprovalNotPending", {
+}) {}, D = class extends d.TaggedError()("ApprovalNotPending", {
 	approvalId: d.String,
 	status: d.String
-}) {}, D = class extends d.TaggedError()("ApprovalForbidden", {
+}) {}, O = class extends d.TaggedError()("ApprovalForbidden", {
 	approvalId: d.String,
 	required: d.NullOr(d.String),
 	message: d.String
-}) {}, O = class extends d.TaggedError()("ApprovalUnavailable", {
+}) {}, k = class extends d.TaggedError()("ApprovalUnavailable", {
 	procedure: d.String,
 	message: d.String
-}) {}, k = d.Union(x, w, T, O), A = d.Union(S, C, T, E, D, O), j = d.Struct({
+}) {}, A = d.Union(S, T, E, k), j = d.Union(C, w, E, D, O, k), M = d.Struct({
 	id: d.String,
 	procedure: d.String,
 	kind: d.Literal("mutation", "action"),
@@ -135,28 +138,28 @@ var We = d.Union(d.String, d.Number), p = d.Record({
 	decidedAt: d.NullOr(d.String),
 	note: d.NullOr(d.String),
 	relation: d.Literal("to-decide", "requested")
-}), M = "channel:", N = Symbol.for("@voltro/protocol/reactivityChannels"), P = globalThis, F = P[N] ?? (P[N] = /* @__PURE__ */ new Map()), Ze = /^[a-z][a-z0-9-]*(\.[a-z0-9-]+)*$/, Qe = (e) => {
-	if (!Ze.test(e)) throw Error(`reactivityChannel('${e}'): invalid channel name.\n  Use lowercase kebab segments separated by dots — \`presence\`, \`job-queue\`,
+}), N = "channel:", Ze = Symbol.for("@voltro/protocol/reactivityChannels"), Qe = globalThis, P = Qe[Ze] ?? (Qe[Ze] = /* @__PURE__ */ new Map()), $e = /^[a-z][a-z0-9-]*(\.[a-z0-9-]+)*$/, et = (e) => {
+	if (!$e.test(e)) throw Error(`reactivityChannel('${e}'): invalid channel name.\n  Use lowercase kebab segments separated by dots — \`presence\`, \`job-queue\`,
   \`billing.usage\`. A \`:\` is refused because it is the namespace separator in
-  the routing key (\`${M}<name>\`), and an uppercase letter is\n  refused because a key that differs only by case reads as one channel and
+  the routing key (\`${N}<name>\`), and an uppercase letter is\n  refused because a key that differs only by case reads as one channel and
   routes as two.`);
-	let t = F.get(e);
+	let t = P.get(e);
 	if (t !== void 0) return t;
-	let n = `${M}${e}`, r = Object.freeze({
+	let n = `${N}${e}`, r = Object.freeze({
 		kind: "reactivity-channel",
 		name: e,
 		key: n,
 		toString: () => n
 	});
-	return F.set(e, r), r;
-}, I = (e) => typeof e == "object" && !!e && e.kind === "reactivity-channel", $e = (e) => e.startsWith(M), et = () => new Set([...F.values()].map((e) => e.key)), L = (e) => I(e) ? e.key : e, tt = (e) => e === void 0 ? [] : Array.isArray(e) ? e.map(L) : [L(e)], nt = (e) => e === void 0 ? void 0 : Array.isArray(e) ? e.map(L) : L(e), rt = (e) => {
-	let t = et(), n = [];
-	for (let r of e) for (let e of tt(r.source)) !$e(e) || t.has(e) || n.push({
+	return P.set(e, r), r;
+}, tt = (e) => typeof e == "object" && !!e && e.kind === "reactivity-channel", nt = (e) => e.startsWith(N), rt = () => new Set([...P.values()].map((e) => e.key)), F = (e) => tt(e) ? e.key : e, it = (e) => e === void 0 ? [] : Array.isArray(e) ? e.map(F) : [F(e)], at = (e) => e === void 0 ? void 0 : Array.isArray(e) ? e.map(F) : F(e), ot = (e) => {
+	let t = rt(), n = [];
+	for (let r of e) for (let e of it(r.source)) !nt(e) || t.has(e) || n.push({
 		procedure: r.name,
 		key: e
 	});
 	return n;
-}, it = (e, t) => {
+}, st = (e, t) => {
 	let n = e?.injectExternalChange;
 	return n !== void 0 && (n.call(e, {
 		table: t.key,
@@ -165,8 +168,8 @@ var We = d.Union(d.String, d.Number), p = d.Record({
 		old: {},
 		origin: "inline"
 	}), !0);
-}, at = (e) => e.internal !== !0, R = (e) => {
-	if (ot(e), Array.isArray(e.guards) && e.guards.length === 0) throw Error(`${e.name}: \`guards: []\` is empty, so it enforces nothing — but it reads\n  at the call site as if this procedure were protected. Omit the field for an
+}, ct = (e) => e.internal !== !0, I = (e) => {
+	if (lt(e), Array.isArray(e.guards) && e.guards.length === 0) throw Error(`${e.name}: \`guards: []\` is empty, so it enforces nothing — but it reads\n  at the call site as if this procedure were protected. Omit the field for an
   unguarded procedure, or list the scopes required to call it.`);
 	let t = typeof e.source == "string" ? [e.source] : Array.isArray(e.source) ? e.source : void 0;
 	if (t !== void 0 && (t.length === 0 || t.some((e) => String(e).trim() === ""))) throw Error(`${e.name}: \`source\` is empty, so this query declares reactivity and\n  subscribes to nothing — it serves one snapshot and never updates again,
@@ -183,7 +186,7 @@ var We = d.Union(d.String, d.Number), p = d.Record({
 	let n = [e.publicApi === void 0 ? void 0 : "publicApi", e.exposeAsTool === void 0 ? void 0 : "exposeAsTool"].filter((e) => e !== void 0);
 	if (n.length === 0) return e;
 	throw Error(`${e.name}: \`internal: true\` cannot be combined with ${n.map((e) => `\`${e}\``).join(" or ")}. \`internal\` takes the procedure OFF the wire; those put it back ON a different one (${n.includes("publicApi") ? "a REST route" : "an agent tool"}), and that surface is projected without consulting the flag — so the procedure would be unreachable from your client and reachable from the internet. Drop \`internal: true\` if the wider surface is intended, or remove the ${n.join(" / ")} annotation if it is not.`);
-}, ot = (e) => {
+}, lt = (e) => {
 	let t = e.requiresApproval;
 	if (t !== void 0) {
 		if (!Array.isArray(t.approvers) || t.approvers.length === 0) throw Error(`${e.name}: \`requiresApproval.approvers\` is empty, so NOBODY can approve this\n  procedure and every call would park forever. Name the scope(s) an approver must hold
@@ -193,48 +196,48 @@ var We = d.Union(d.String, d.Number), p = d.Record({
   human from every other, and the second-pair-of-eyes control would enforce nothing.
   Give the procedure a \`guards:\` decision, or drop \`requiresApproval\`.`);
 	}
-}, st = (e) => e.action !== void 0 && e.resourceType !== void 0, ct = (e) => e.openAccess !== void 0 || e.guards !== void 0 && e.guards.length > 0, z = (e, t, n) => {
+}, ut = (e) => e.action !== void 0 && e.resourceType !== void 0, dt = (e) => e.openAccess !== void 0 || e.guards !== void 0 && e.guards.length > 0, L = (e, t, n) => {
 	if (n === void 0) return t;
 	if (n.trim() === "") throw Error(`${e}: \`openAccess\` needs a REASON, not an empty string. It is the sentence a\n  reviewer reads to decide whether this procedure should really be callable
   without an authorization check — e.g. \`openAccess: 'public pricing, no caller data'\`.`);
 	if (t !== void 0 && t.length > 0) throw Error(`${e}: \`openAccess\` and \`guards\` are two different access decisions, so\n  declaring both says the procedure is protected AND open. Keep the guards if a
   caller must hold a scope; drop them if anyone may call it.`);
 	return [u(n.trim())];
-}, B = (e) => R({
+}, R = (e) => I({
 	kind: "query",
 	name: e.name,
 	input: e.input,
 	output: e.output,
 	error: e.error ?? d.Never,
-	source: nt(e.source),
+	source: at(e.source),
 	cache: e.cache,
-	guards: z(e.name, e.guards, e.openAccess),
+	guards: L(e.name, e.guards, e.openAccess),
 	openAccess: e.openAccess,
 	publicApi: e.publicApi,
 	exposeAsTool: e.exposeAsTool,
 	internal: e.internal,
 	overridesPlugin: e.overridesPlugin
-}), V = (e) => R({
+}), z = (e) => I({
 	kind: "mutation",
 	name: e.name,
 	input: e.input,
 	output: e.output,
 	error: e.error ?? d.Never,
 	target: e.target,
-	guards: z(e.name, e.guards, e.openAccess),
+	guards: L(e.name, e.guards, e.openAccess),
 	openAccess: e.openAccess,
 	publicApi: e.publicApi,
 	exposeAsTool: e.exposeAsTool,
 	requiresApproval: e.requiresApproval,
 	internal: e.internal,
 	overridesPlugin: e.overridesPlugin
-}), H = (e) => R({
+}), B = (e) => I({
 	kind: "action",
 	name: e.name,
 	input: e.input,
 	output: e.output,
 	error: e.error ?? d.Never,
-	guards: z(e.name, e.guards, e.openAccess),
+	guards: L(e.name, e.guards, e.openAccess),
 	openAccess: e.openAccess,
 	source: e.source,
 	target: e.target,
@@ -243,7 +246,7 @@ var We = d.Union(d.String, d.Number), p = d.Record({
 	requiresApproval: e.requiresApproval,
 	internal: e.internal,
 	overridesPlugin: e.overridesPlugin
-}), lt = (e) => R({
+}), ft = (e) => I({
 	kind: "stream",
 	name: e.name,
 	input: e.input,
@@ -251,42 +254,42 @@ var We = d.Union(d.String, d.Number), p = d.Record({
 	error: e.error ?? d.Never,
 	internal: e.internal,
 	overridesPlugin: e.overridesPlugin,
-	guards: z(e.name, e.guards, e.openAccess),
+	guards: L(e.name, e.guards, e.openAccess),
 	openAccess: e.openAccess
-}), U = (e, t) => t && t.length > 0 ? d.Union(e, ...t) : e, ut = (e, t) => t && t.some((e) => !l(e)) ? d.Union(e, c, s) : e, dt = (e) => d.Union(e, b), ft = (e, t) => t === void 0 ? e : d.Union(e, k), W = (e, t) => {
+}), V = (e, t) => t && t.length > 0 ? d.Union(e, ...t) : e, H = (e) => e !== void 0 && e.some((e) => !l(e)), pt = (e, t) => H(t) ? d.Union(e, c, s) : e, mt = (e) => d.Union(e, x), ht = (e, t) => t === void 0 ? e : d.Union(e, A), U = (e, t) => {
 	if (t === "stream") return e.error;
-	let n = ut(e.error, e.guards);
-	return t === "query" ? n : ft(t === "mutation" ? dt(n) : n, e.requiresApproval);
-}, pt = (e, t) => f.make(e.name, {
-	payload: y(e.input, e.name),
+	let n = pt(e.error, e.guards);
+	return t === "query" ? n : ht(t === "mutation" ? mt(n) : n, e.requiresApproval);
+}, gt = (e, t) => f.make(e.name, {
+	payload: b(e.input, e.name, H(e.guards)),
 	success: v(e.output),
-	error: U(W(e, "query"), t),
+	error: V(U(e, "query"), t),
 	stream: !0
-}), mt = (e, t) => f.make(e.name, {
-	payload: y(e.input, e.name),
+}), _t = (e, t) => f.make(e.name, {
+	payload: b(e.input, e.name, H(e.guards)),
 	success: e.output,
-	error: U(W(e, "mutation"), t)
-}), ht = (e, t) => f.make(e.name, {
-	payload: y(e.input, e.name),
+	error: V(U(e, "mutation"), t)
+}), vt = (e, t) => f.make(e.name, {
+	payload: b(e.input, e.name, H(e.guards)),
 	success: e.output,
-	error: U(W(e, "action"), t)
-}), gt = (e, t) => f.make(e.name, {
-	payload: y(e.input, e.name),
+	error: V(U(e, "action"), t)
+}), yt = (e, t) => f.make(e.name, {
+	payload: b(e.input, e.name, H(e.guards)),
 	success: e.element,
-	error: U(e.error, t),
+	error: V(e.error, t),
 	stream: !0
-}), _t = (e) => {
+}), bt = (e) => {
 	if (typeof e != "object" || !e) return;
 	let t = e._tag;
 	return typeof t == "string" ? t : void 0;
-}, vt = (e) => {
+}, xt = (e) => {
 	switch (e.kind) {
-		case "query": return pt(e);
-		case "mutation": return mt(e);
-		case "action": return ht(e);
-		case "stream": return gt(e);
+		case "query": return gt(e);
+		case "mutation": return _t(e);
+		case "action": return vt(e);
+		case "stream": return yt(e);
 	}
-}, yt = (e) => {
+}, St = (e) => {
 	let t = e.input, n = t === void 0 ? {} : { input: t }, r = e.output, i = r === void 0 ? {} : { output: r };
 	if (e.kind === "query") return {
 		kind: "query",
@@ -327,7 +330,7 @@ var We = d.Union(d.String, d.Number), p = d.Record({
 			..."shapeItem" in e && e.shapeItem !== void 0 ? { shapeItem: e.shapeItem } : {}
 		}))
 	};
-}, bt = 7500, xt = (e) => typeof e == "object" && !!e && e.kind === "event", St = (e) => {
+}, Ct = 7500, wt = (e) => typeof e == "object" && !!e && e.kind === "event", Tt = (e) => {
 	if (e.name.length === 0) throw Error("defineEvent: `name` must not be empty");
 	if (/\s/.test(e.name)) throw Error(`defineEvent("${e.name}"): \`name\` must not contain whitespace.\n  The name is used as a broker subject segment. NATS refuses a subject with
   whitespace and delivers nothing — silently, and only on that broker, so an
@@ -362,69 +365,69 @@ var We = d.Union(d.String, d.Number), p = d.Record({
 		webhook: e.webhook,
 		delivery: e.delivery
 	};
-}, Ct = (e) => d.Struct({
+}, Et = (e) => d.Struct({
 	_tag: d.Literal("event"),
 	origin: d.String,
 	n: d.Number,
 	emittedAt: d.Number,
 	payload: e
-}), wt = d.Struct({
+}), Dt = d.Struct({
 	_tag: d.Literal("gap"),
 	missed: d.Number,
 	reason: d.Literal("buffer", "resume")
-}), Tt = d.Struct({ _tag: d.Literal("attached") }), Et = (e) => d.Union(Tt, Ct(e), wt), Dt = d.Struct({
+}), Ot = d.Struct({ _tag: d.Literal("attached") }), kt = (e) => d.Union(Ot, Et(e), Dt), At = d.Struct({
 	origin: d.String,
 	n: d.Number
-}), Ot = (e) => d.Struct({
+}), jt = (e) => d.Struct({
 	key: e,
-	resume: d.optional(d.Array(Dt))
-}), kt = (e, t) => {
+	resume: d.optional(d.Array(At))
+}), Mt = (e, t) => {
 	let n = e.guards !== void 0 && e.guards.some((e) => !l(e)) ? d.Union(c, s) : d.Never, r = t && t.length > 0 ? d.Union(n, ...t) : n;
 	return f.make(e.name, {
-		payload: y(Ot(e.key), e.name),
-		success: Et(e.payload),
+		payload: b(jt(e.key), e.name, H(e.guards)),
+		success: kt(e.payload),
 		error: r,
 		stream: !0
 	});
-}, At = class extends d.TaggedError()("EventPayloadInvalid", {
+}, Nt = class extends d.TaggedError()("EventPayloadInvalid", {
 	event: d.String,
 	message: d.String
-}) {}, jt = class extends d.TaggedError()("EventKeyInvalid", {
+}) {}, Pt = class extends d.TaggedError()("EventKeyInvalid", {
 	event: d.String,
 	message: d.String
-}) {}, Mt = class extends d.TaggedError()("EventPayloadTooLarge", {
+}) {}, Ft = class extends d.TaggedError()("EventPayloadTooLarge", {
 	event: d.String,
 	bytes: d.Number,
 	limit: d.Number
-}) {}, Nt = (e) => {
+}) {}, It = (e) => {
 	if (typeof e != "object" || !e) return JSON.stringify(e) ?? "null";
 	let t = Object.entries(e).filter(([, e]) => e !== void 0).sort(([e], [t]) => e < t ? -1 : +(e > t));
 	return JSON.stringify(t);
-}, Pt = "\0", Ft = (e, t, n) => [
+}, Lt = "\0", Rt = (e, t, n) => [
 	e ?? "~",
 	t,
-	Nt(n)
-].join("\0"), It = (e) => {
+	It(n)
+].join("\0"), zt = (e) => {
 	let [t = "~", n = "", r = ""] = e.split("\0");
 	return {
 		tenantId: t === "~" ? null : t,
 		event: n,
 		key: r
 	};
-}, Lt = (e) => e.split("\0").join(" · "), Rt = (e) => e, zt = (e) => e, Bt = (e) => {
+}, Bt = (e) => e.split("\0").join(" · "), Vt = (e) => e, Ht = (e) => e, Ut = (e) => {
 	let t = e.alias?.trim(), n = e.instance?.trim(), r = t !== void 0 && t !== "" ? t : e.base;
 	return n !== void 0 && n !== "" ? `${r}#${n}` : r;
-}, Vt = (e) => {
+}, Wt = (e) => {
 	if (e.length !== 0) return (t, n) => e.reduceRight((e, t) => t(e, n), t);
-}, Ht = (e, t) => {
+}, Gt = (e, t) => {
 	let n = He.GenericTag(e);
 	return {
 		Tag: n,
 		Live: Ue.succeed(n, t)
 	};
-}, Ut = (e, t, n) => {
+}, Kt = (e, t, n) => {
 	if (!t) return { ok: !0 };
-	let r = G(n);
+	let r = W(n);
 	if (!r) return {
 		ok: !1,
 		reason: `cannot parse runningVersion "${n}"`
@@ -432,12 +435,12 @@ var We = d.Union(d.String, d.Number), p = d.Record({
 	let i = t.trim();
 	if (i === "*" || i === "") return { ok: !0 };
 	let a = i.split(/\s+/).filter((e) => e.length > 0);
-	for (let i of a) if (!Wt(i, r)) return {
+	for (let i of a) if (!qt(i, r)) return {
 		ok: !1,
 		reason: `plugin "${e}" requires framework ${t}, running ${n}`
 	};
 	return { ok: !0 };
-}, G = (e) => {
+}, W = (e) => {
 	let t = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9a-zA-Z.-]+))?$/.exec(e.trim());
 	return t ? {
 		major: Number(t[1]),
@@ -445,44 +448,44 @@ var We = d.Union(d.String, d.Number), p = d.Record({
 		patch: Number(t[3]),
 		pre: t[4] ?? ""
 	} : null;
-}, K = (e, t) => e.major === t.major ? e.minor === t.minor ? e.patch === t.patch ? e.pre && !t.pre ? -1 : !e.pre && t.pre ? 1 : e.pre && t.pre ? e.pre < t.pre ? -1 : +(e.pre > t.pre) : 0 : e.patch - t.patch : e.minor - t.minor : e.major - t.major, Wt = (e, t) => {
+}, G = (e, t) => e.major === t.major ? e.minor === t.minor ? e.patch === t.patch ? e.pre && !t.pre ? -1 : !e.pre && t.pre ? 1 : e.pre && t.pre ? e.pre < t.pre ? -1 : +(e.pre > t.pre) : 0 : e.patch - t.patch : e.minor - t.minor : e.major - t.major, qt = (e, t) => {
 	if (e === "*") return !0;
 	if (e.startsWith("^")) {
-		let n = G(e.slice(1));
-		return !n || t.major !== n.major ? !1 : K(t, n) >= 0;
+		let n = W(e.slice(1));
+		return !n || t.major !== n.major ? !1 : G(t, n) >= 0;
 	}
 	if (e.startsWith("~")) {
-		let n = G(e.slice(1));
-		return !n || t.major !== n.major || t.minor !== n.minor ? !1 : K(t, n) >= 0;
+		let n = W(e.slice(1));
+		return !n || t.major !== n.major || t.minor !== n.minor ? !1 : G(t, n) >= 0;
 	}
 	let n = /^(>=|<=|>|<)(.+)$/.exec(e);
 	if (n) {
-		let e = n[1], r = G(n[2]);
+		let e = n[1], r = W(n[2]);
 		if (!r) return !1;
-		let i = K(t, r);
+		let i = G(t, r);
 		if (e === ">=") return i >= 0;
 		if (e === "<=") return i <= 0;
 		if (e === ">") return i > 0;
 		if (e === "<") return i < 0;
 	}
-	let r = G(e);
-	return r ? K(t, r) === 0 : !1;
-}, q = d.Literal("running", "succeeded", "failed", "cancelled", "suspended"), Gt = d.Literal("cancel", "terminate", "abandon"), Kt = d.Struct({
+	let r = W(e);
+	return r ? G(t, r) === 0 : !1;
+}, K = d.Literal("running", "succeeded", "failed", "cancelled", "suspended"), Jt = d.Literal("cancel", "terminate", "abandon"), Yt = d.Struct({
 	mode: d.String,
 	dueAt: d.NullOr(d.Number),
 	retryAfterMs: d.NullOr(d.Number),
 	intentId: d.NullOr(d.String)
-}), qt = d.Struct({
+}), Xt = d.Struct({
 	id: d.String,
 	workflowName: d.String,
 	executionId: d.NullOr(d.String),
 	status: d.Literal("running", "queued", "dropped", "skipped"),
-	deferral: d.optional(Kt)
-}), J = d.Struct({
+	deferral: d.optional(Yt)
+}), q = d.Struct({
 	id: d.String,
 	tag: d.String,
 	executionId: d.String,
-	status: q,
+	status: K,
 	payload: d.Unknown,
 	workflowVersion: d.NullOr(d.String),
 	workflowPatches: d.NullOr(d.Unknown),
@@ -497,12 +500,12 @@ var We = d.Union(d.String, d.Number), p = d.Record({
 	durationMs: d.NullOr(d.Number),
 	traceId: d.NullOr(d.String),
 	parentExecutionId: d.NullOr(d.String),
-	parentClosePolicy: d.NullOr(Gt)
-}), Jt = d.Struct({
+	parentClosePolicy: d.NullOr(Jt)
+}), Zt = d.Struct({
 	tag: d.optional(d.String),
-	status: d.optional(q),
+	status: d.optional(K),
 	limit: d.optional(d.Number)
-}), Yt = d.Struct({
+}), Qt = d.Struct({
 	id: d.String,
 	runId: d.String,
 	stepName: d.String,
@@ -517,7 +520,7 @@ var We = d.Union(d.String, d.Number), p = d.Record({
 	startedAt: d.Date,
 	completedAt: d.NullOr(d.Date),
 	durationMs: d.NullOr(d.Number)
-}), Xt = d.Struct({
+}), $t = d.Struct({
 	id: d.String,
 	runId: d.String,
 	eventType: d.String,
@@ -525,7 +528,7 @@ var We = d.Union(d.String, d.Number), p = d.Record({
 	occurredAt: d.Date,
 	stepName: d.NullOr(d.String),
 	attempt: d.NullOr(d.Number)
-}), Zt = d.Struct({
+}), en = d.Struct({
 	id: d.String,
 	name: d.String,
 	payload: d.Unknown,
@@ -533,7 +536,7 @@ var We = d.Union(d.String, d.Number), p = d.Record({
 	subject: d.NullOr(d.Unknown),
 	traceId: d.NullOr(d.String),
 	occurredAt: d.Date
-}), Qt = d.Struct({
+}), tn = d.Struct({
 	id: d.String,
 	eventId: d.String,
 	eventName: d.String,
@@ -546,108 +549,108 @@ var We = d.Union(d.String, d.Number), p = d.Record({
 	errorMessage: d.NullOr(d.String),
 	createdAt: d.Date,
 	completedAt: d.NullOr(d.Date)
-}), $t = d.Struct({ id: d.String }), Y = d.Struct({ runId: d.String }), en = d.Struct({
+}), nn = d.Struct({ id: d.String }), J = d.Struct({ runId: d.String }), rn = d.Struct({
 	name: d.optional(d.String),
 	limit: d.optional(d.Number)
-}), tn = d.Struct({ eventId: d.String }), X = d.Struct({
+}), an = d.Struct({ eventId: d.String }), Y = d.Struct({
 	workflowName: d.String,
 	executionId: d.String
-}), nn = d.Struct({
+}), on = d.Struct({
 	id: d.String,
 	signalName: d.String,
 	payload: d.optional(d.Unknown)
-}), rn = d.Struct({
+}), sn = d.Struct({
 	id: d.String,
 	updateName: d.String,
 	payload: d.optional(d.Unknown),
 	timeoutMs: d.optional(d.Number)
-}), an = d.Struct({
+}), cn = d.Struct({
 	eventId: d.String,
 	updateId: d.String,
 	completedEventId: d.String,
 	result: d.Unknown
-}), on = B({
+}), ln = R({
 	name: "__voltro.workflow.run",
 	source: "_voltro_workflow_runs",
-	input: $t,
-	output: d.Array(J)
-}), sn = B({
+	input: nn,
+	output: d.Array(q)
+}), un = R({
 	name: "__voltro.workflow.runs",
 	source: "_voltro_workflow_runs",
-	input: Jt,
-	output: d.Array(J)
-}), cn = B({
+	input: Zt,
+	output: d.Array(q)
+}), dn = R({
 	name: "__voltro.workflow.run.steps",
 	source: "_voltro_workflow_run_steps",
-	input: Y,
-	output: d.Array(Yt)
-}), ln = B({
+	input: J,
+	output: d.Array(Qt)
+}), fn = R({
 	name: "__voltro.workflow.run.events",
 	source: "_voltro_workflow_run_events",
-	input: Y,
-	output: d.Array(Xt)
-}), un = B({
+	input: J,
+	output: d.Array($t)
+}), pn = R({
 	name: "__voltro.workflow.domainEvents",
 	source: "_voltro_workflow_events",
-	input: en,
-	output: d.Array(Zt)
-}), dn = B({
+	input: rn,
+	output: d.Array(en)
+}), mn = R({
 	name: "__voltro.workflow.event.deliveries",
 	source: "_voltro_workflow_event_deliveries",
-	input: tn,
-	output: d.Array(Qt)
-}), fn = H({
+	input: an,
+	output: d.Array(tn)
+}), hn = B({
 	name: "__voltro.workflow.cancel",
-	input: X,
+	input: Y,
 	output: d.Struct({ ok: d.Boolean })
-}), pn = H({
+}), gn = B({
 	name: "__voltro.workflow.resume",
-	input: X,
+	input: Y,
 	output: d.Struct({ ok: d.Boolean })
-}), mn = H({
+}), _n = B({
 	name: "__voltro.workflow.signal",
-	input: nn,
+	input: on,
 	output: d.Struct({ eventId: d.String })
-}), hn = H({
+}), vn = B({
 	name: "__voltro.workflow.update",
-	input: rn,
-	output: an
-}), gn = "__voltro.undo.log", Z = "__voltro.undo.apply", _n = "__voltro.undo.redo", vn = d.Struct({
+	input: sn,
+	output: cn
+}), yn = "__voltro.undo.log", bn = "__voltro.undo.apply", xn = "__voltro.undo.redo", Sn = d.Struct({
 	id: d.String,
 	tag: d.String,
 	label: d.NullOr(d.String),
 	undone: d.Boolean,
 	crossesAction: d.Boolean,
 	createdAt: d.String
-}), yn = class extends d.TaggedError()("UndoNotFound", { invocationId: d.String }) {}, bn = class extends d.TaggedError()("UndoForbidden", { invocationId: d.String }) {}, xn = class extends d.TaggedError()("UndoConflict", {
+}), Cn = class extends d.TaggedError()("UndoNotFound", { invocationId: d.String }) {}, wn = class extends d.TaggedError()("UndoForbidden", { invocationId: d.String }) {}, X = class extends d.TaggedError()("UndoConflict", {
 	invocationId: d.String,
 	reason: d.Literal("conflict", "action")
-}) {}, Sn = d.Union(yn, bn, xn), Cn = B({
-	name: gn,
+}) {}, Tn = d.Union(Cn, wn, X), En = R({
+	name: yn,
 	source: "_voltro_undo_log",
 	input: d.Struct({ limit: d.optional(d.Number) }),
-	output: d.Array(vn),
+	output: d.Array(Sn),
 	openAccess: "subject-scoped by construction: lists only the calling subject's own undoable actions"
-}), wn = V({
-	name: Z,
+}), Dn = z({
+	name: bn,
 	input: d.Struct({ invocationId: d.String }),
 	output: d.Struct({ ok: d.Boolean }),
-	error: Sn,
+	error: Tn,
 	openAccess: "subject-scoped by construction: undo is per-actor — another subject's invocation fails typed with UndoForbidden"
-}), Tn = V({
-	name: _n,
+}), On = z({
+	name: xn,
 	input: d.Struct({ invocationId: d.String }),
 	output: d.Struct({ ok: d.Boolean }),
-	error: Sn,
+	error: Tn,
 	openAccess: "subject-scoped by construction: redo is per-actor — another subject's invocation fails typed with UndoForbidden"
-}), En = "__voltro.approvals.pending", Dn = "__voltro.approvals.decide", On = B({
-	name: En,
+}), kn = "__voltro.approvals.pending", An = "__voltro.approvals.decide", jn = R({
+	name: kn,
 	source: "_voltro_approvals",
 	input: d.Struct({ limit: d.optional(d.Number) }),
-	output: d.Array(j),
+	output: d.Array(M),
 	openAccess: "the answer is scoped to the caller — a row appears only if they requested it or hold its recorded approver scopes, so an anonymous caller sees nothing"
-}), kn = V({
-	name: Dn,
+}), Mn = z({
+	name: An,
 	input: d.Struct({
 		approvalId: d.String,
 		decision: d.Literal("approve", "reject"),
@@ -657,35 +660,35 @@ var We = d.Union(d.String, d.Number), p = d.Record({
 		approvalId: d.String,
 		status: d.Literal("approved", "rejected")
 	}),
-	error: A,
+	error: j,
 	openAccess: "the approver authority is the PENDING ROW's own recorded scopes (plus an unconditional self-approval refusal), checked in-handler — a descriptor-level scope would have to be the union of every approval-requiring procedure in the app"
-}), An = "__voltro.connections.list", jn = "__voltro.connections.start", Mn = "__voltro.connections.submitToken", Nn = "__voltro.connections.disconnect", Q = d.Literal("oauth2", "pat"), Pn = d.Literal("disconnected", "connected", "expired", "revoked", "error"), Fn = d.Struct({
+}), Nn = "__voltro.connections.list", Pn = "__voltro.connections.start", Fn = "__voltro.connections.submitToken", In = "__voltro.connections.disconnect", Z = d.Literal("oauth2", "pat"), Ln = d.Literal("disconnected", "connected", "expired", "revoked", "error"), Rn = d.Struct({
 	connectionId: d.String,
-	kind: Q,
+	kind: Z,
 	label: d.String,
-	status: Pn,
+	status: Ln,
 	accountId: d.NullOr(d.String),
 	accountLabel: d.NullOr(d.String),
 	scopes: d.Array(d.String),
 	expiresAt: d.NullOr(d.String),
 	lastError: d.NullOr(d.String),
 	connectedAt: d.NullOr(d.String)
-}), In = class extends d.TaggedError()("ConnectionNotDeclared", { connectionId: d.String }) {}, Ln = class extends d.TaggedError()("ConnectionSubjectRequired", { connectionId: d.String }) {}, Rn = class extends d.TaggedError()("ConnectionKindMismatch", {
+}), zn = class extends d.TaggedError()("ConnectionNotDeclared", { connectionId: d.String }) {}, Bn = class extends d.TaggedError()("ConnectionSubjectRequired", { connectionId: d.String }) {}, Vn = class extends d.TaggedError()("ConnectionKindMismatch", {
 	connectionId: d.String,
-	expected: Q,
-	actual: Q
-}) {}, zn = class extends d.TaggedError()("ConnectionHandshakeFailed", {
+	expected: Z,
+	actual: Z
+}) {}, Q = class extends d.TaggedError()("ConnectionHandshakeFailed", {
 	connectionId: d.String,
 	reason: d.String,
 	transient: d.Boolean
-}) {}, $ = d.Union(In, Ln, Rn, zn), Bn = B({
-	name: An,
+}) {}, $ = d.Union(zn, Bn, Vn, Q), Hn = R({
+	name: Nn,
 	source: "_voltro_connections",
 	input: d.Struct({}),
-	output: d.Array(Fn),
+	output: d.Array(Rn),
 	openAccess: "self-scoped read: projects the declared connections for the calling subject only (its own connect/disconnect state)"
-}), Vn = H({
-	name: jn,
+}), Un = B({
+	name: Pn,
 	input: d.Struct({
 		connectionId: d.String,
 		redirectTo: d.optional(d.String)
@@ -696,8 +699,8 @@ var We = d.Union(d.String, d.Number), p = d.Record({
 	}),
 	error: $,
 	openAccess: "self-service: begins an oauth handshake that stores a credential for the calling subject only; anonymous callers fail typed with ConnectionSubjectRequired"
-}), Hn = V({
-	name: Mn,
+}), Wn = z({
+	name: Fn,
 	input: d.Struct({
 		connectionId: d.String,
 		token: d.String
@@ -705,15 +708,15 @@ var We = d.Union(d.String, d.Number), p = d.Record({
 	output: d.Struct({ ok: d.Boolean }),
 	error: $,
 	openAccess: "self-service: stores a pasted token as the calling subject's own credential; anonymous callers fail typed with ConnectionSubjectRequired"
-}), Un = V({
-	name: Nn,
+}), Gn = z({
+	name: In,
 	input: d.Struct({ connectionId: d.String }),
 	output: d.Struct({ ok: d.Boolean }),
 	error: $,
 	openAccess: "self-service: deletes only the calling subject's own credential row for this connection"
-}), Wn = (e) => {
+}), Kn = (e) => {
 	let t = e instanceof Date ? e.getTime() : typeof e == "number" ? e : typeof e == "string" ? new Date(e).getTime() : 0;
 	return Number.isNaN(t) ? 0 : t;
-}, Gn = 1;
+}, qn = 1;
 //#endregion
-export { Oe as ADMIN_SCOPE, Ce as APIKEY_ISSUE_ORG_SCOPE, Ee as APIKEY_ISSUE_OTHER_SCOPE, ve as APIKEY_ISSUE_SELF_SCOPE, Dn as APPROVALS_DECIDE_TAG, En as APPROVALS_PENDING_TAG, A as ApprovalDecisionErrors, k as ApprovalErrors, T as ApprovalExpired, D as ApprovalForbidden, S as ApprovalNotFound, E as ApprovalNotPending, w as ApprovalRejected, x as ApprovalRequired, C as ApprovalSelfApproval, O as ApprovalUnavailable, Ae as AuthMiddleware, b as BusinessRuleViolation, An as CONNECTIONS_LIST_TAG, Nn as CONNECTION_DISCONNECT_TAG, jn as CONNECTION_START_TAG, Mn as CONNECTION_SUBMIT_TOKEN_TAG, zn as ConnectionHandshakeFailed, ce as ConnectionInfo, i as ConnectionInfoMiddleware, Q as ConnectionKind, Rn as ConnectionKindMismatch, In as ConnectionNotDeclared, Fn as ConnectionState, Pn as ConnectionStatus, Ln as ConnectionSubjectRequired, r as DEFAULT_SCOPE_CACHE_MAX_ENTRIES, ie as DEFAULT_SCOPE_CACHE_TTL_MS, Pt as EVENT_ROUTE_SEP, jt as EventKeyInvalid, At as EventPayloadInvalid, Mt as EventPayloadTooLarge, be as IMPERSONATION_METADATA_KEY, bt as MAX_EVENT_ENVELOPE_BYTES, Gn as PROTOCOL_VERSION, j as PendingApproval, M as REACTIVITY_CHANNEL_PREFIX, c as ScopeError, e as Subject, ye as SubjectIdentity, re as SubjectService, Z as UNDO_APPLY_TAG, gn as UNDO_LOG_TAG, _n as UNDO_REDO_TAG, s as Unauthenticated, xn as UndoConflict, bn as UndoForbidden, vn as UndoLogEntry, yn as UndoNotFound, X as WorkflowControlInputSchema, Zt as WorkflowDomainEventRowSchema, en as WorkflowDomainEventsInputSchema, tn as WorkflowEventDeliveriesInputSchema, Qt as WorkflowEventDeliveryRowSchema, Gt as WorkflowParentClosePolicySchema, Xt as WorkflowRunEventRowSchema, qt as WorkflowRunHandleSchema, $t as WorkflowRunRefSchema, J as WorkflowRunRowSchema, q as WorkflowRunStatusSchema, Yt as WorkflowRunStepRowSchema, Y as WorkflowRunTableRefSchema, Jt as WorkflowRunsInputSchema, nn as WorkflowSignalInputSchema, Kt as WorkflowStartDeferralSchema, rn as WorkflowUpdateInputSchema, an as WorkflowUpdateResultSchema, ht as actionToRpc, we as advisoryResourceGuardWarning, ae as anonymousSubject, Ye as applyRowPatch, a as applyScopeDecision, kn as approvalsDecideDescriptor, On as approvalsPendingQueryDescriptor, te as assertAuthenticated, ze as beginIdempotent, Ut as checkFrameworkCompat, De as checkGuards, me as checkGuardsEffect, ne as composeAuthStrategies, Vt as composeRpcInterceptors, Un as connectionDisconnectDescriptor, Vn as connectionStartDescriptor, Hn as connectionSubmitTokenDescriptor, Bn as connectionsListQueryDescriptor, et as declaredReactivityChannelKeys, H as defineAction, St as defineEvent, V as defineMutation, Rt as definePlugin, zt as definePluginRoute, Ht as definePluginService, B as defineQuery, lt as defineStream, qe as diffRows, xe as effectiveScopes, Nt as encodeEventKey, _t as errorTag, Tt as eventAttached, Ct as eventEnvelope, wt as eventGap, Dt as eventResumePoint, Ft as eventRoute, Et as eventStreamEvent, Ot as eventSubscribeInput, kt as eventToRpc, Ie as failIdempotent, ke as findAdvisoryResourceGuards, Pe as finishIdempotent, Lt as formatEventRoute, he as getPolicyGuardResolver, ge as getResourceScopeResolver, ct as hasAccessDecision, oe as hasCallbackRoutes, Te as hasEffectiveScope, Se as hasScope, g as idToPath, Re as idempotencyScope, xt as isEventDescriptor, Je as isIdKeyed, l as isOpenAccess, _e as isPolicyCheck, st as isPolicyGuard, I as isReactivityChannel, $e as isReactivityChannelKey, Ne as isSystemSubject, at as isWireReachable, t as makeScopeCache, Be as memoryIdempotencyStore, fe as missingAccessDecision, mt as mutationToRpc, yt as normalizeDescriptor, nt as normalizeSource, u as openAccessSpec, It as parseEventRoute, Ge as pathToId, Bt as pluginInstanceName, it as publishReactivity, Ve as publishServerError, pt as queryToRpc, ue as rawImpersonationMark, Qe as reactivityChannel, Me as requireScope, m as rowPatchOpSchema, h as rowPatchSchema, ee as scopeCacheKey, pe as setEffectiveScopes, je as setPolicyGuardResolver, se as setResourceScopeResolver, tt as sourceKeys, gt as streamToRpc, y as strictInput, le as subjectIdentity, n as subjectScopes, Le as subscribeServerErrors, v as subscriptionEvent, de as systemSubject, o as tenantScopedSubject, vt as toRpc, Wn as tsMs, rt as undeclaredChannelKeys, wn as undoApplyDescriptor, Cn as undoLogQueryDescriptor, Tn as undoRedoDescriptor, W as wireErrorUnion, fn as workflowCancelDescriptor, un as workflowDomainEventsQueryDescriptor, dn as workflowEventDeliveriesQueryDescriptor, pn as workflowResumeDescriptor, ln as workflowRunEventsQueryDescriptor, on as workflowRunQueryDescriptor, cn as workflowRunStepsQueryDescriptor, sn as workflowRunsQueryDescriptor, mn as workflowSignalDescriptor, hn as workflowUpdateDescriptor, Fe as wsMutationIdempotencyScope };
+export { Oe as ADMIN_SCOPE, Ce as APIKEY_ISSUE_ORG_SCOPE, Ee as APIKEY_ISSUE_OTHER_SCOPE, ve as APIKEY_ISSUE_SELF_SCOPE, An as APPROVALS_DECIDE_TAG, kn as APPROVALS_PENDING_TAG, j as ApprovalDecisionErrors, A as ApprovalErrors, E as ApprovalExpired, O as ApprovalForbidden, C as ApprovalNotFound, D as ApprovalNotPending, T as ApprovalRejected, S as ApprovalRequired, w as ApprovalSelfApproval, k as ApprovalUnavailable, Ae as AuthMiddleware, x as BusinessRuleViolation, Nn as CONNECTIONS_LIST_TAG, In as CONNECTION_DISCONNECT_TAG, Pn as CONNECTION_START_TAG, Fn as CONNECTION_SUBMIT_TOKEN_TAG, Q as ConnectionHandshakeFailed, ce as ConnectionInfo, i as ConnectionInfoMiddleware, Z as ConnectionKind, Vn as ConnectionKindMismatch, zn as ConnectionNotDeclared, Rn as ConnectionState, Ln as ConnectionStatus, Bn as ConnectionSubjectRequired, r as DEFAULT_SCOPE_CACHE_MAX_ENTRIES, ie as DEFAULT_SCOPE_CACHE_TTL_MS, Lt as EVENT_ROUTE_SEP, Pt as EventKeyInvalid, Nt as EventPayloadInvalid, Ft as EventPayloadTooLarge, be as IMPERSONATION_METADATA_KEY, Ct as MAX_EVENT_ENVELOPE_BYTES, qn as PROTOCOL_VERSION, M as PendingApproval, N as REACTIVITY_CHANNEL_PREFIX, c as ScopeError, e as Subject, ye as SubjectIdentity, re as SubjectService, bn as UNDO_APPLY_TAG, yn as UNDO_LOG_TAG, xn as UNDO_REDO_TAG, s as Unauthenticated, X as UndoConflict, wn as UndoForbidden, Sn as UndoLogEntry, Cn as UndoNotFound, Y as WorkflowControlInputSchema, en as WorkflowDomainEventRowSchema, rn as WorkflowDomainEventsInputSchema, an as WorkflowEventDeliveriesInputSchema, tn as WorkflowEventDeliveryRowSchema, Jt as WorkflowParentClosePolicySchema, $t as WorkflowRunEventRowSchema, Xt as WorkflowRunHandleSchema, nn as WorkflowRunRefSchema, q as WorkflowRunRowSchema, K as WorkflowRunStatusSchema, Qt as WorkflowRunStepRowSchema, J as WorkflowRunTableRefSchema, Zt as WorkflowRunsInputSchema, on as WorkflowSignalInputSchema, Yt as WorkflowStartDeferralSchema, sn as WorkflowUpdateInputSchema, cn as WorkflowUpdateResultSchema, vt as actionToRpc, we as advisoryResourceGuardWarning, ae as anonymousSubject, Ye as applyRowPatch, a as applyScopeDecision, Mn as approvalsDecideDescriptor, jn as approvalsPendingQueryDescriptor, te as assertAuthenticated, ze as beginIdempotent, Kt as checkFrameworkCompat, De as checkGuards, me as checkGuardsEffect, ne as composeAuthStrategies, Wt as composeRpcInterceptors, Gn as connectionDisconnectDescriptor, Un as connectionStartDescriptor, Wn as connectionSubmitTokenDescriptor, Hn as connectionsListQueryDescriptor, rt as declaredReactivityChannelKeys, B as defineAction, Tt as defineEvent, z as defineMutation, Vt as definePlugin, Ht as definePluginRoute, Gt as definePluginService, R as defineQuery, ft as defineStream, qe as diffRows, xe as effectiveScopes, It as encodeEventKey, bt as errorTag, Ot as eventAttached, Et as eventEnvelope, Dt as eventGap, At as eventResumePoint, Rt as eventRoute, kt as eventStreamEvent, jt as eventSubscribeInput, Mt as eventToRpc, Ie as failIdempotent, ke as findAdvisoryResourceGuards, Pe as finishIdempotent, Bt as formatEventRoute, he as getPolicyGuardResolver, ge as getResourceScopeResolver, dt as hasAccessDecision, oe as hasCallbackRoutes, Te as hasEffectiveScope, H as hasEnforcedGuard, Se as hasScope, g as idToPath, Re as idempotencyScope, y as inputLabel, wt as isEventDescriptor, Je as isIdKeyed, l as isOpenAccess, _e as isPolicyCheck, ut as isPolicyGuard, tt as isReactivityChannel, nt as isReactivityChannelKey, Ne as isSystemSubject, ct as isWireReachable, t as makeScopeCache, Be as memoryIdempotencyStore, fe as missingAccessDecision, _t as mutationToRpc, St as normalizeDescriptor, at as normalizeSource, u as openAccessSpec, zt as parseEventRoute, Ge as pathToId, Ut as pluginInstanceName, st as publishReactivity, Ve as publishServerError, gt as queryToRpc, ue as rawImpersonationMark, et as reactivityChannel, Me as requireScope, m as rowPatchOpSchema, h as rowPatchSchema, ee as scopeCacheKey, pe as setEffectiveScopes, je as setPolicyGuardResolver, se as setResourceScopeResolver, it as sourceKeys, yt as streamToRpc, b as strictInput, le as subjectIdentity, n as subjectScopes, Le as subscribeServerErrors, v as subscriptionEvent, de as systemSubject, o as tenantScopedSubject, xt as toRpc, Kn as tsMs, ot as undeclaredChannelKeys, Dn as undoApplyDescriptor, En as undoLogQueryDescriptor, On as undoRedoDescriptor, U as wireErrorUnion, hn as workflowCancelDescriptor, pn as workflowDomainEventsQueryDescriptor, mn as workflowEventDeliveriesQueryDescriptor, gn as workflowResumeDescriptor, fn as workflowRunEventsQueryDescriptor, ln as workflowRunQueryDescriptor, dn as workflowRunStepsQueryDescriptor, un as workflowRunsQueryDescriptor, _n as workflowSignalDescriptor, vn as workflowUpdateDescriptor, Fe as wsMutationIdempotencyScope };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/protocol",
-  "version": "0.40.0",
+  "version": "0.41.0",
   "description": "The Voltro wire + plugin contract — defineQuery/Mutation/Action/Stream, definePlugin, sessions / JWT / API-keys, and the RPC protocol.",
   "keywords": [
     "voltro",
@@ -54,8 +54,8 @@
   },
   "dependencies": {
     "@effect/sql": "^0.52.0",
-    "@voltro/database": "0.40.0",
-    "@voltro/logger": "0.40.0",
+    "@voltro/database": "0.41.0",
+    "@voltro/logger": "0.41.0",
     "jose": "^6.2.8"
   },
   "peerDependencies": {