@voltro/protocol 0.42.0 → 0.43.1

package/CHANGELOG.md

@@ -39,6 +39,166 @@ _Changes staged for the next release accumulate here (rolled up from
 
 ---
 
+## [0.43.1] — 2026-08-18
+
+### Fixed
+
+- **@voltro/database** — A write recorder that fails inside someone's transaction now says which recorder, on which write, and what the database actually said.
+
+  `@effect/sql` renders every driver failure as `SqlError: Failed to execute statement` — one sentence that fits a missing column, a dangling foreign key, an over-long value and a duplicate key equally. The driver's own words hang off a SYMBOL on a `FiberFailure`, so a caller who reaches for `.cause` gets `undefined` and concludes there is nothing there.
+
+  That is expensive precisely where recorders run: the caller's write was ordinary, and what failed was framework machinery one table over. The message now reads
+
+  ```
+  write recorder '_voltro_row_history' failed while recording an update on 'users':
+  Duplicate entry 'rowver_…' for key 'PRIMARY' [code=ER_DUP_ENTRY errno=1062 …]
+  ```
+
+  and the original error is kept as `cause` for anyone who does walk the chain. The failure still takes the transaction down — that is the guarantee and it is unchanged.
+
+  `describeDriverError` (`@voltro/database`) is the shared summariser, built on the existing cause extractor rather than a second walker. It returns nothing when the chain carries nothing driver-shaped, so an ordinary programming error from a recorder arrives as itself instead of wrapped in prose about a database.
+- **@voltro/database** — On MariaDB, a `varchar` column could introspect as `json` because a DIFFERENT table had a json column with the same column name.
+
+  MariaDB names a column-level CHECK after the COLUMN, and those names are unique per table, not per schema. `information_schema.check_constraints` on MySQL has no `TABLE_NAME`, so the introspector recovered it by joining `table_constraints` on `(schema, constraint_name)` — which on MariaDB cross-products every same-named check across every table. Measured on 11.8:
+
+  ```
+  a.payload  LONGTEXT      CHECK (json_valid(`payload`))
+  b.payload  VARCHAR(255)  CHECK (`payload` in ('x','y'))
+  
+  join result:  a → json_valid, a → in(…), b → json_valid, b → in(…)
+  ```
+
+  So `b.payload` reads as `json`, and `a.payload` picks up an enum it does not have. Downstream that is not a cosmetic label: the planner emits a blocked `alter-column-type` with `from: 'json'` that no `.narrowedFrom()` can honestly acknowledge, because the premise is false — and since the data-transfer manifest records introspected types, the same misreading travels into the bundle and reappears as schema drift on import.
+
+  MariaDB's own `check_constraints` HAS `TABLE_NAME`. The introspector asks for it directly now and keeps the join as the MySQL path, where check-constraint names are schema-unique and the join is sound. That asymmetry is why a single-engine test could not see this: the wrong query passes on MySQL.
+- **@voltro/database** — `voltro db apply` could not drop a CHECK constraint on the mysql family at all, and each of the three reasons hid the next.
+
+  **1. `DROP CHECK` is MySQL-8 syntax.** MariaDB has never had it — measured on 11.8, `ALTER TABLE t DROP CHECK c` is `ERROR 1064`, while `DROP CONSTRAINT c` works on both engines. A plan containing a `drop-check` therefore died on the first one, on a family whose migrations are NOT atomic: the run stopped with the earlier statements committed and no rollback.
+
+  **2. The name was assumed, not read.** The applier dropped `<table>_<column>_check` — which is only what its own `add-check` would have named it. A CHECK created at table bring-up is INLINE and UNNAMED, so the server names it (`CONSTRAINT_1` / `<table>_chk_1` / the column name). Dropping a name that does not exist reports "does not exist", which is indistinguishable from the "already gone" a resume legitimately produces — so the statement succeeded, the constraint stayed, and the plan re-proposed the identical `drop-check` forever. The name comes from the catalog now.
+
+  **3. A column-level CHECK cannot be dropped by name on MariaDB at all.** Measured: the catalog lists it under the column's name, `DROP CONSTRAINT` on that name answers 1091, and only redefining the column removes it. The applier now drops by catalog name, ASKS whether the constraint survived, and redefines the column when it did — so a rebuild happens only in the case that needs one.
+
+  **And the same investigation closed the MySQL `.oneOf()` round-trip gap.** `parseEnumCheck` was documented as handling MySQL's rendering and did not: MySQL backslash-escapes the string DELIMITERS (`_utf8mb4\'draft\'`), and the parser rewrote those to the SQL doubling `''` — which is how a quote INSIDE a value is written. Every delimiter became escaped content, every value came back empty, and the filter dropped them. `.oneOf()` now round-trips on MySQL, and the suite that asserted the gap as a known one asserts the round-trip instead.
+
+  Plus, on a failed apply: the error now states how many operations were already applied and whether this dialect rolls back. The ledger held that number; it never reached the operator, who had to re-plan and diff the counts to learn how far the run got.
+- **@voltro/plugin-versioning** — `versioningPlugin({ timing: 'in-transaction' })` built its history row's primary key from `(rowId, version)` while the version counter three lines above was scoped to `(tableName, rowId)`. Two versioned tables carrying the same row id therefore collided — permanently.
+
+  The shape is not exotic: `actors.id === users.id` is what the framework's own audit trail asks for, an `actors` row whose id is the user's so an audited write satisfies `createdBy → actors`. In an app that follows it, every user row has a twin.
+
+  The collision does not heal, and that is what turns a duplicate into an outage. The second table's insert fails, so its history row is never written, so `maxOf` for that table stays `null`, so the next attempt computes the same version and the same id. Every write to that row is dead from then on — surfacing as `ER_DUP_ENTRY` on an ordinary `store.update`, naming a row id in a table the caller never wrote to.
+
+  The key is `(table, rowId, version)` now — the same shape the post-commit path always built. It stays deterministic (no clock, no process-local counter), which is what lets it survive a replica restart; it just carries every part of the key it claims to be unique over.
+
+  **No cleanup is needed for rows already written.** They keep their old ids and belong to whichever table wrote them; the new keys cannot collide with them, and `byRow` is not unique. An app blocked by this is unblocked by the upgrade alone.
+
+  Covered twice: the recorder against a port that refuses duplicates (the mechanism, including that a repeat does not settle), and two versioned tables sharing an id against live postgres (the real primary key, inside the caller's transaction). The suite that existed exercised ONE table, which cannot produce a collision at all — and read exactly like a suite that covered this.
+
+### Internal (no consumer-facing effect)
+
+- **@voltro/sql-mysql** — Two test-only defects in `sql-mysql`, both found by a release gate, both of the same family: a check that could not fail, and a failure reported in the wrong place. No product code changed.
+
+  **An assertion that could not fail.** `dropCheckSyntax.integration.test.ts` fell back to a HAND-BUILT plan when the planner produced no operations — and the fabricated operation was a `drop-check`, which is exactly what the next line asserts the plan contains. So an engine whose planner stopped emitting it would have been handed one and reported green. The fallback is deleted; both engines produce the operation now, which is what this release fixed, and the assertion is load-bearing again (4/4 on mysql AND mariadb without it).
+
+  It surfaced as a TYPE error rather than a false pass, because the fallback's object widened `plan` into a union `applyPlan` does not accept. Worth noting which check caught it: `vitest` transpiles without type-checking, so the suite was green and only `tsc` objected — the gate's `typecheck` and `lint` steps are what went red.
+
+  **A wait that gave up in silence.** `waitFor` in both binlog CDC suites looped to a deadline and then RETURNED, so a "prove the reader is live" wait that expired let the test carry on, kill the binlog dump thread, and fail twenty lines later on `expect(ids).toContain('todo_wd_before')` — an assertion about a different claim, in a different place. It throws now, naming the wait and the window, and all twelve call sites carry a label.
+
+  The window is named too: `FIRST_ATTACH_MS = 30_000`, up from 12 s. The reasoning is the 40 s window already in the same file, whose comment says a re-attach plus binlog catch-up takes longer under a loaded full-suite run — a FIRST attach does both and only skips the backoff, so 12 s beside 40 s was an asymmetry the file's own reasoning did not support. That is an argument from the neighbouring comment, not a measurement; if it expires again, `waitFor` now says which wait and for how long, and that number is the one to argue with rather than raising this one twice.
+
+---
+
+## [0.43.0] — 2026-08-18
+
+### ⚠ BREAKING
+
+- **@voltro/data-transfer, @voltro/cli** — `DanglingReferenceError` is now `RowsRefusedError`, and it separates the rows that failed from the rows that failed because those rows did.
+
+  **The name.** The import raised it for EVERY row still refused after deferred-FK resolution, whatever the reason — a NOT NULL violation, a duplicate key, a value the database computes for itself. The tag named ONE possible cause and put it where a reader looks first, so any other refusal arrived mislabelled. The new name states the outcome; each row's `reason` states the cause, which is where a cause can honestly be claimed.
+
+  **The split.** A row is `derived` when one of its reference columns holds the primary key of another row that also failed in this run: it could not have landed whatever it contained, so its reason describes the parent's problem. The relation is transitive, decided from the DATA (the failed ids against the reference-typed values), so no schema knowledge is needed. `primaryCount` is the number an operator acts on, `rows` lists primary failures FIRST so the cap never spends its budget on consequences, and the CLI leads with both numbers:
+
+  ```
+  import refused 300 row(s), of which 1 are the actual failures — the rest could
+  not land because a row they reference did not.
+    teams t1  foreign key teams_ibfk_1: the referenced row does not exist [1452]
+    … and 299 row(s) behind them. Fix the 1 above and re-run; they resolve with
+    their parents.
+  ```
+
+  In an FK-dense bundle one refused parent takes its whole subtree with it, so the length of a flat list says how connected the data is, not how many problems there are — and the single row that explains all of them sits somewhere in the middle of it.
+
+  The codemod rewrites the import and every use of the symbol. It does NOT rewrite a tag STRING (`Effect.catchTag('DanglingReferenceError', …)`, `err._tag === '…'`) — change those to `'RowsRefusedError'` — and the payload gained `primaryCount` plus a `derived` flag per row.
+
+### Fixed
+
+- **@voltro/cli** — `voltro doctor`'s `subject-write-no-guard` rule reads the DESCRIPTOR before it reports. It looked only at the executor, and the access decision is not declared there.
+
+  Every form of access decision the framework has — `internal: true`, `guards: [...]`, `openAccess:` — is declared on the DESCRIPTOR. So an app that declares them properly got a finding for each one, and on a codebase whose procedures are mostly `internal: true` the rule fires on essentially all of them and is wrong essentially every time.
+
+  That is worse than a rule that finds nothing: it is the longest line in the report and it reads like a security finding, so it teaches the reader to skim the place a real finding would have appeared.
+
+  The premise was structurally impossible for most of them, and the framework says so itself: `security.defaultDeny` refuses at boot any wire-exposed procedure declaring neither `guards:` nor `openAccess:`. So "an anonymous caller reaches the write" can only be true of an `openAccess` procedure. That is what the rule looks for now — plus the handler check it always honoured, plus an ownership comparison against `subject.id`, which is the refusal the rule says is missing. Where no descriptor can be read, it says nothing: the claim is about a declaration, and a finding whose evidence was never opened is the failure mode this fixes.
+
+  The `use:` line changed with it. It recommended `.guard(requireScope('…'))`; the shipped guide teaches declarative `guards:` and calls a hand-written per-executor scope check the thing `guards:` exists to delete. A rule may not recommend the shape the guide argues against.
+- **@voltro/database, @voltro/data-transfer** — A `voltro data` transfer no longer carries GENERATED column values, and no longer loses every row that has one.
+
+  The export wrote the computed values into the bundle and the import sent them back in the `INSERT` column list. MariaDB refuses that for any value except NULL (`1906: The value specified for generated column 'x' in table 't' has been ignored`); postgres refuses a non-DEFAULT value outright. So the transfer failed per ROW, not per table, and only for the rows whose generated value was non-NULL.
+
+  That selectivity is the dangerous part. `.uniqueActive()` lowers to exactly such a column on mysql/mariadb — a STORED generated column holding the key while the row is live and NULL once it is soft-deleted — so the refused rows are the LIVE ones and the accepted ones are the tombstones. A table can come out looking like "a few rows failed" or empty, depending only on how many of its rows are deleted, and any table with a foreign key into it fails behind it.
+
+  Both ends are fixed from one source of truth: **introspection now reports generated columns on every dialect** (`generatedAs`, from `information_schema.generation_expression` on mysql/mariadb, `is_generated` on postgres, `PRAGMA table_xinfo`'s hidden flag on sqlite, `sys.computed_columns` on mssql). It was declared-side only before — invisible to the planner, which does not compare it, and load-bearing for anything that writes rows back.
+
+  The exporter omits those columns, values and all. The importer strips them from every incoming row using the TARGET's snapshot, because a bundle already written still carries them and a file on disk is data, read where it is.
+
+  **`voltro serve`'s admin export/import needed a second fix, and without it this one reached only the direct transport.** The running instance hands those handlers `declaredSnapshot(tables)` — no dialect — and `.uniqueActive()` lowers to a generated column only when the snapshot knows the engine. So over `--target api` the snapshot described a schema with no generated columns while the database had several, and the export wrote their values back into the bundle exactly as before. It passes the dialect now (the variable was already on the next line).
+
+  `generatedAs` is also kept OUT of the schema fingerprint. Introspection can read the fact back but not a comparable value — the engine returns its own normalisation of the expression, never the declared spelling — so hashing it would make declared and live disagree permanently: a schema nobody touched reporting a changed declaration on every boot, and a transfer target that matches its bundle exactly refused as drifted.
+
+  Covered by a live mariadb→mariadb and mysql→mysql round trip over a `.uniqueActive()` table with live and soft-deleted rows, asserting the target recomputed the value rather than that the row merely arrived.
+- **@voltro/sql-mysql** — On mysql/mariadb, a write REJECTED by the database through `insertIgnore` was reported as a conflict when the caller was not inside a transaction — and never reached the caller as a typed `ConstraintViolation` at all.
+
+  Two causes, both measured against live MySQL 8.4 and MariaDB 11.
+
+  **The connection.** `INSERT IGNORE` demotes every error to a warning, so the store reads `SHOW WARNINGS` to tell a rejection from a conflict. That describes the last statement on a CONNECTION, and outside a transaction every statement acquires its own from the pool — so the read was unattributable and came back empty. The rejected write then surfaced as "the insert was skipped as a conflict, but no existing row matches conflictColumns […] the constraint that fired is unknown", whose enumeration lists only conflict causes. A rejection described as a conflict is the exact sentence this path was fixed once already for producing; it survived on the path that had no transaction to read on. The store now pins one connection for the whole decision — the same pinning `insertRecoverAutoId` does for `LAST_INSERT_ID()`.
+
+  **The classification.** The store swallowed the driver's error and raised a prose one of its own, so `classifyConstraintViolation` had nothing to read: this was the one write path where the typed error could not fire, while every other one produced it. The warning IS the driver's payload — `INSERT IGNORE` only changed how it was delivered — so it is handed on in the shape the driver would have thrown. A rejection now arrives as the same `ConstraintViolation { kind: 'foreignKey', … }` a plain `insert` produces. Nothing new crosses the wire: the classifier extracts the constraint NAME as a delimited group, never the sentence.
+
+  This is the default `voltro data import` path (`--mode append`, `--on-conflict skip`, without `--atomic`), so a row rejected by a foreign key was reported to the operator as a conflict with an unknown cause.
+
+  `constraintViolation.integration.test.ts` now asserts the `insertIgnore` seam per dialect against live postgres 17, MySQL 8.4, MariaDB 11 and SQL Server 2022. It was the missing assertion behind a claim derived from the wiring — the classification does sit on all ten write paths, which is not the same as a classifiable error arriving on all ten.
+- **@voltro/protocol, @voltro/runtime** — The framework's store errors — `ConstraintViolation`, `TenantScopeViolation`, `TenantRowNotFound`, `ServerOnlyColumnWrite`, `TableValidationFailed`, `StoreOperationFailed` — are exported from `@voltro/protocol` and can therefore be declared in a descriptor's `error:` union. They could not be.
+
+  They lived in `@voltro/runtime`, which reaches `node:child_process`, `node:http` and `node:crypto`. A descriptor is loaded VALUE-LEVEL by the web client (the `RpcClient` needs every procedure's Schema), so a descriptor importing from there is refused at boot by the browser-safety guard — correctly. The typed half of these errors was therefore unreachable: the docs told you to declare them, and the boot said no.
+
+  What that leaves is the untyped half only. The error still arrives as an `InternalError` carrying a readable sentence, so telling `foreignKey` ("the row you picked is gone") from `foreignKeyInUse` ("this row is still referenced") — two different messages for the user — means parsing that sentence. Over a set of generated delete mutations that is a string comparison per procedure, which is the thing the typed error exists to delete.
+
+  `@voltro/runtime` re-exports all six, so server code is unchanged. The classes have no server dependency of any kind — the file imports `Schema` from `effect` and nothing else, and `browserSafetyGuard.test.ts` now pins a descriptor that declares one, so moving them back reads as a boot failure rather than as a passing rename.
+- **@voltro/database, @voltro/sql-mysql** — A blocked `alter-column-type` told every dialect to write a postgres cast.
+
+  The refusal is correct — a bare type change may not be value-preserving, so it is refused until acknowledged. Its `fix:` line was not:
+
+  ```
+  acknowledge it on the column: `.narrowedFrom('json', { using: 'meta::text' })`
+  ```
+
+  `USING <expr>` is postgres syntax and a postgres capability. The mysql arm of the applier emits `MODIFY COLUMN`, the mssql arm `ALTER COLUMN`, and sqlite rebuilds the table — none of them can carry a cast expression and none of them reads `using`. So an operator on any other engine was handed a line to paste into their schema containing syntax their database has never seen, inside an argument that is discarded. A refusal is read as an instruction, and the more carefully it is read the more thoroughly a wrong one is followed.
+
+  The fix line is dialect-aware now: postgres keeps the `using` half, everything else gets `.narrowedFrom('<type>')` plus the fact that the engine converts in place — because a refusal that offers no expressible fix reads as "the framework cannot do this at all".
+
+  Covered on live MySQL and MariaDB by both halves at once: what the refusal SAYS, and that following it applies AND converges with the row intact. A message test alone would keep passing over a broken apply; a convergence test alone is what let the wrong message survive this long.
+
+  Also on the same path: `upsert` with a PARTIAL row (one omitting a NOT NULL column that has no default) failed on MariaDB and succeeded on MySQL. The native `INSERT … ON DUPLICATE KEY UPDATE` validates its insert half even when only the update half runs, so the row was rejected although the target existed and only needed patching. A partial row takes the lookup path on both engines now; the single-statement form still covers the complete-row case, which is what a data transfer and every generated CRUD write send.
+- **@voltro/sql-mysql** — On MariaDB, `upsert` could write a DIFFERENT row than the one it was given and report success.
+
+  `INSERT … ON DUPLICATE KEY UPDATE` fires on ANY unique key, not on the one named in `conflictColumns`. So an incoming row whose (say) `email` already belonged to a different primary key updated THAT row instead — and since `id` is excluded from the SET list, the row the caller handed over was never written. Measured on a live server: the call returned a row, the target kept the old id, the new row was absent, and the existing row had silently taken the incoming values. A bulk transfer on top of that prints `import complete` over missing data, which is the worst failure shape available: there is nothing to investigate.
+
+  The two engines of the family disagreed here, which is part of why it survived. The non-RETURNING path (MySQL) looks the row up by `conflictColumns` first, does not find it, and lets the INSERT fail with a duplicate-key error. Loud was always right.
+
+  Both refuse now, with a message naming both ids and the fact that the collision was on a constraint other than the one named. The check runs inside a transaction — a short one of the store's own when the caller is not already in one — so the wrong row is rolled back rather than reported after the fact: detecting this afterwards still leaves someone else's row overwritten.
+
+---
+
 ## [0.42.0] — 2026-08-17
 
 ### ⚠ BREAKING

package/dist/apikey.d.ts

@@ -205,7 +205,7 @@ declare const Subject: Schema.Union<[Schema.Struct<{
      * Set when this caller PRESENTED a credential and it was rejected — an
      * expired token above all. Absent when they presented none.
      *
-     * The two are the same Subject and must not be the same ANSWER. A consumer
+     * The two are the same Subject and must not be the same ANSWER. A deployment
      * measured the cost: a user's tab outlived their IdP's token lifetime, the
      * strategy logged `supabase jwt expired`, the caller fell through to
      * anonymous, and the guard then refused with `missing required scope

package/dist/index.d.ts

@@ -1049,6 +1049,64 @@ export declare const connectionSubmitTokenDescriptor: MutationProcedureDescripto
     ok: typeof Schema.Boolean;
 }>, Schema.Union<[typeof ConnectionNotDeclared, typeof ConnectionSubjectRequired, typeof ConnectionKindMismatch, typeof ConnectionHandshakeFailed]>>;
 
+/**
+ * The database refused a write because it broke an integrity rule the SCHEMA
+ * declares — a foreign key, a unique index, a NOT NULL, a CHECK.
+ *
+ * **Why this is typed at all.** Without it the driver failure is a `SqlError`,
+ * which the rpc layer collapses to a bare `InternalError` on purpose (a
+ * `SqlError`'s text is not safe to forward — see below). The caller then gets
+ * "something went wrong" for a failure that is entirely about the input it just
+ * sent, and the only way to find out which rule fired is to re-run the
+ * statement by hand against the database. That is a real reported shape:
+ * that.
+ *
+ * **Why it carries names and not the driver's sentence.** The temptation is to
+ * forward `cause.message`, and it is measured to be wrong: postgres attaches
+ * `Failing row contains (…)` — the complete row, every column — to a not-null
+ * and a check violation; mysql and mssql echo the duplicate VALUE on a unique
+ * violation. A constraint or column NAME is schema, which this framework
+ * already puts on the wire (`TableValidationFailed.table`). A row is data, and
+ * the caller who provoked the error is not automatically entitled to it.
+ *
+ * **Not every dialect can fill every field.** sqlite reports a foreign-key
+ * failure as the bare sentence `FOREIGN KEY constraint failed` — no name, no
+ * column, no direction — so `constraint` is absent there and the direction is
+ * inferred from the operation. `kind` is the field that is always right.
+ */
+export declare class ConstraintViolation extends ConstraintViolation_base {
+    /**
+     * A sentence built from the fields above and nothing else.
+     *
+     * It exists because an undeclared tagged error reaches the client through
+     * `defectMessage`, which renders `String(error)` — and a `Schema.TaggedError`
+     * with no `message` renders as `[object Object]`. Without this getter the
+     * caller would get a correctly-typed error carrying no information, which is
+     * the same dead end in a different shape.
+     */
+    get message(): string;
+}
+
+declare const ConstraintViolation_base: Schema.TaggedErrorClass<ConstraintViolation, "ConstraintViolation", {
+    readonly _tag: Schema.tag<"ConstraintViolation">;
+} & {
+    /**
+     * Which rule fired. `foreignKey` = the row you referenced does not exist;
+     * `foreignKeyInUse` = this row may not go, others still reference it. They
+     * are opposite situations with opposite fixes, so a UI branches on them
+     * separately.
+     */
+    kind: Schema.Literal<["foreignKey", "foreignKeyInUse", "unique", "notNull", "check"]>;
+    /** The table the write targeted — the framework's own name for it, not the driver's. */
+    table: typeof Schema.String;
+    /** Which store op was attempted: 'insert' | 'update' | 'delete' | …. */
+    operation: typeof Schema.String;
+    /** The constraint / index name, when the dialect names one. */
+    constraint: Schema.optional<typeof Schema.String>;
+    /** The column, when the dialect names one instead of (or beside) a constraint. */
+    column: Schema.optional<typeof Schema.String>;
+}>;
+
 /**
  * A handle to a cluster-coordinated periodic task the plugin armed via
  * `PluginBindContext.scheduleCoordinated`. Keep it to `stop()` the task
@@ -1312,7 +1370,7 @@ export declare const defineEvent: <const Name extends string, Key extends Schema
      * `'latest'` — a newer delivery supersedes a pending one; a slow subscriber
      * gets the current value and is told nothing, because nothing was lost.
      *
-     * See {@link EventDeliverySemantics}. The test is "would a consumer be wrong
+     * See {@link EventDeliverySemantics}. The test is "would a deployment be wrong
      * to miss one?" — not "is this event frequent?".
      */
     readonly delivery?: EventDeliverySemantics;
@@ -1672,7 +1730,7 @@ export declare const eventAttached: Schema.Struct<{
  * reach a state it could have had immediately, and report a "loss" that was
  * never a loss.
  *
- * The honest test: **would a consumer be wrong to miss one?** If the next value
+ * The honest test: **would a deployment be wrong to miss one?** If the next value
  * supersedes it, that is `'latest'` — and it is probably state rather than an
  * event at all.
  */
@@ -2025,7 +2083,7 @@ export declare interface GuardSpec<Input = unknown> {
      * in its own tables (a `teamMembers` row, say) registers its own tuple source
      * rather than copying data across; see `policyGuardResolver.ts`.
      *
-     * That paragraph is here because its absence cost a consumer their access
+     * That paragraph is here because its absence cost a deployment their access
      * gate. This comment used to describe the resolver as "a future ReBAC /
      * `accessPolicy()` resolver" — written before the ReBAC path shipped and
      * never updated. They read the type, quoted the sentence, concluded there was
@@ -3528,7 +3586,7 @@ export declare interface QueryCacheConfig {
      *
      * `'tenant'` exists because the other two were the only options and neither
      * fits an org-wide figure: `subject` recomputes it per person, and `global`
-     * is not a cache but a cross-tenant leak. A consumer reported computing the
+     * is not a cache but a cross-tenant leak. A deployment reported computing the
      * same nine-table statistic up to 18 times for 18 employees rather than take
      * the second option, which was the correct call.
      *
@@ -4028,6 +4086,33 @@ declare type ServerErrorListener = (event: ServerErrorEvent) => void;
 
 export declare type ServerErrorSource = 'rest' | 'aggregate' | 'subscriber' | 'reaction' | 'schedule' | 'workflow' | 'webhook' | 'startup';
 
+/**
+ * A generated CRUD write (`crud.create` / `crud.update`) was handed a
+ * `.serverOnly()` column in its INPUT.
+ *
+ * `.serverOnly()` is the WIRE-exposure axis: the column never crosses the
+ * boundary in EITHER direction. Reads strip it; a write that accepts it is the
+ * same violation mirrored — mass assignment of a column the schema declared the
+ * client may not see, let alone set.
+ *
+ * Refused rather than silently stripped: a stripped field makes an attack
+ * indistinguishable from a no-op and leaves an honest caller wondering why the
+ * value it sent never landed. `columns` names what was rejected so the fix
+ * (drop the field from the descriptor's input schema, or from the caller) is
+ * mechanical.
+ */
+export declare class ServerOnlyColumnWrite extends ServerOnlyColumnWrite_base {
+}
+
+declare const ServerOnlyColumnWrite_base: Schema.TaggedErrorClass<ServerOnlyColumnWrite, "ServerOnlyColumnWrite", {
+    readonly _tag: Schema.tag<"ServerOnlyColumnWrite">;
+} & {
+    /** The table the write targeted. */
+    table: typeof Schema.String;
+    /** The `.serverOnly()` columns the input tried to set. */
+    columns: Schema.Array$<typeof Schema.String>;
+}>;
+
 /**
  * Publish the caller's fully-resolved scope set for this request (raw subject
  * scopes ∪ role-derived scopes ∪ any extra grants). Called by the rbac
@@ -4058,6 +4143,33 @@ export declare const setResourceScopeResolver: (resolver: ResourceScopeResolver
  */
 export declare const sourceKeys: (source: ReactivitySource | ReadonlyArray<ReactivitySource> | undefined) => ReadonlyArray<string>;
 
+/**
+ * Discriminated union of all framework-owned store errors. Use it on
+ * a mutation's `error:` schema when you want every kind surfaced
+ * typed to the client.
+ */
+export declare type StoreError = TenantScopeViolation | TenantRowNotFound | ServerOnlyColumnWrite | StoreOperationFailed | TableValidationFailed | ConstraintViolation;
+
+/**
+ * Anything else the underlying `DataStore` raised during a write or
+ * query. `cause` is the stringified original error — sufficient for
+ * logs + UI, doesn't try to serialise complex error chains across the
+ * rpc boundary. The `_tag` discriminator stays cheap to pattern-match.
+ */
+export declare class StoreOperationFailed extends StoreOperationFailed_base {
+}
+
+declare const StoreOperationFailed_base: Schema.TaggedErrorClass<StoreOperationFailed, "StoreOperationFailed", {
+    readonly _tag: Schema.tag<"StoreOperationFailed">;
+} & {
+    /** Which DataStore op was attempted: 'query' | 'insert' | 'update' | 'delete' | 'hardDelete'. */
+    operation: typeof Schema.String;
+    /** The table the op targeted. */
+    table: typeof Schema.String;
+    /** `String(originalError)` — round-trip-safe diagnostic form. */
+    cause: typeof Schema.String;
+}>;
+
 export declare type StrategyResolution = {
     readonly kind: 'matched';
     readonly subject: Subject;
@@ -4156,7 +4268,7 @@ export declare const Subject: Schema.Union<[Schema.Struct<{
      * Set when this caller PRESENTED a credential and it was rejected — an
      * expired token above all. Absent when they presented none.
      *
-     * The two are the same Subject and must not be the same ANSWER. A consumer
+     * The two are the same Subject and must not be the same ANSWER. A deployment
      * measured the cost: a user's tab outlived their IdP's token lifetime, the
      * strategy logged `supabase jwt expired`, the caller fell through to
      * anonymous, and the guard then refused with `missing required scope
@@ -4202,7 +4314,7 @@ export declare const SubjectIdentity: Schema.Union<[Schema.Struct<{
      * Set when this caller PRESENTED a credential and it was rejected — an
      * expired token above all. Absent when they presented none.
      *
-     * The two are the same Subject and must not be the same ANSWER. A consumer
+     * The two are the same Subject and must not be the same ANSWER. A deployment
      * measured the cost: a user's tab outlived their IdP's token lifetime, the
      * strategy logged `supabase jwt expired`, the caller fell through to
      * anonymous, and the guard then refused with `missing required scope
@@ -4360,10 +4472,70 @@ export declare const subscriptionEvent: <D extends Schema.Schema.Any>(data: D) =
 
 export declare const systemSubject: (id: string, scopes?: ReadonlyArray<string>) => Subject;
 
+/**
+ * Pre-INSERT row validation against a table's `.validate(Schema)`
+ * decoder failed. The MutationStore runs the table's `insertSchema`
+ * AFTER defaults + computed + audit/tenant stamps; failure means
+ * the stamped row didn't satisfy the decoder. `issues` is the
+ * formatted ArrayFormatter output (cheap to render in UI, doesn't
+ * leak the original Schema instance).
+ */
+export declare class TableValidationFailed extends TableValidationFailed_base {
+}
+
+declare const TableValidationFailed_base: Schema.TaggedErrorClass<TableValidationFailed, "TableValidationFailed", {
+    readonly _tag: Schema.tag<"TableValidationFailed">;
+} & {
+    /** The table the row targeted. */
+    table: typeof Schema.String;
+    /** Top-level explanation for logs + UI ("user.email failed pattern check"). */
+    summary: typeof Schema.String;
+    /** Flat list of `{ path, message }` per failing leaf. Path uses dot-notation. */
+    issues: Schema.Array$<Schema.Struct<{
+        path: typeof Schema.String;
+        message: typeof Schema.String;
+    }>>;
+}>;
+
 export declare type Target<Input = unknown, Row = unknown> = TargetSpec<Input, Row> | ReadonlyArray<TargetSpec<Input, Row>>;
 
 export declare type TargetSpec<Input = unknown, Row = unknown> = InsertTarget<Input, Row> | UpdateTarget<Input, Row> | DeleteTarget<Input>;
 
+/**
+ * A keyed-by-primary-key write (`ctx.store.update(table, id, patch)`,
+ * `delete(table, id)`, `hardDelete(table, id)`, `patchJson(table, id, …)`) on a
+ * `tenant()`-scoped table did not resolve to a row inside the CALLER's tenant.
+ *
+ * **One error for two situations, on purpose.** It is raised identically when
+ * the row does not exist at all and when it exists but belongs to another
+ * tenant, and it carries no field that separates them. That is the whole point:
+ *
+ *   - Reporting "forbidden" for a foreign row and "not found" for a missing one
+ *     turns any keyed write into a cross-tenant EXISTENCE ORACLE — an attacker
+ *     walks ids and learns which ones are real in someone else's tenant, which
+ *     is exactly the isolation the `tenant()` mixin exists to provide.
+ *   - Collapsing the other way — silently affecting zero rows — is worse than
+ *     either: the handler reads it as "the row is gone", not "you may not touch
+ *     it", so a genuine isolation breach shows up in an app as a confusing
+ *     absent-row branch and never as a security signal.
+ *
+ * So both cases fail LOUDLY and IDENTICALLY. `id` is the key the caller itself
+ * supplied — never another tenant's data.
+ */
+export declare class TenantRowNotFound extends TenantRowNotFound_base {
+}
+
+declare const TenantRowNotFound_base: Schema.TaggedErrorClass<TenantRowNotFound, "TenantRowNotFound", {
+    readonly _tag: Schema.tag<"TenantRowNotFound">;
+} & {
+    /** The table the keyed write targeted. */
+    table: typeof Schema.String;
+    /** The primary key the CALLER supplied. Echoing it leaks nothing. */
+    id: typeof Schema.String;
+    /** Human-readable explanation for diagnostics + UI. */
+    reason: typeof Schema.String;
+}>;
+
 /**
  * The subject a `storeForTenant(id)` view runs as — the caller's identity,
  * re-pointed at ONE explicit tenant.
@@ -4383,6 +4555,25 @@ export declare const tenantScopedSubject: (subject: Subject, tenantId: string) =
     readonly type: "serviceAccount";
 }>;
 
+/**
+ * A write was attempted against a `tenant()`-scoped table, but the
+ * authenticated subject's `tenantId` is null — either anonymous, or
+ * an apiKey / serviceAccount without a tenant binding. Refusing the
+ * write at the boundary is the safe default; a future "system writes"
+ * subject type can opt out.
+ */
+export declare class TenantScopeViolation extends TenantScopeViolation_base {
+}
+
+declare const TenantScopeViolation_base: Schema.TaggedErrorClass<TenantScopeViolation, "TenantScopeViolation", {
+    readonly _tag: Schema.tag<"TenantScopeViolation">;
+} & {
+    /** The table the violating write targeted. */
+    table: typeof Schema.String;
+    /** Human-readable explanation for diagnostics + UI. */
+    reason: typeof Schema.String;
+}>;
+
 export declare const toRpc: <Name extends string, Input extends Schema.Schema.Any, Output extends Schema.Schema.Any, Err extends Schema.Schema.All>(descriptor: QueryProcedureDescriptor<Name, Input, Output, Err> | MutationProcedureDescriptor<Name, Input, Output, Err> | ActionProcedureDescriptor<Name, Input, Output, Err> | StreamProcedureDescriptor<Name, Input, Output, Err>) => Rpc.Rpc<Name, Input extends Schema.Struct.Fields ? Schema.Struct<Input> : Input, Stream<Schema.Union<[Schema.Struct<{
     _tag: Schema.Literal<["snapshot"]>;
     revision: typeof Schema.Number;
@@ -4933,8 +5124,8 @@ export declare interface VoltroPlugin {
  * is the WIDENED one. So the server judged against a narrower set than it had
  * advertised, and the framework's own errors failed that judgement:
  *
- *   - a guard's `ScopeError` — reported by a consumer, who measured it on every
- *     relationship-guarded mutation in their app: a permissions refusal reached
+ *   - a guard's `ScopeError` — reported by a deployment, who measured it on every
+ *     relationship-guarded mutation in a real app: a permissions refusal reached
  *     their client as `InternalError`, so their UI showed "something went wrong"
  *     where it should have shown "forbidden";
  *   - a cross-table `rule()`'s `BusinessRuleViolation` — unconditional for

package/dist/index.js

@@ -138,12 +138,12 @@ var We = d.Union(d.String, d.Number), p = d.Record({
 	decidedAt: d.NullOr(d.String),
 	note: d.NullOr(d.String),
 	relation: d.Literal("to-decide", "requested")
-}), N = "channel:", Ze = Symbol.for("@voltro/protocol/reactivityChannels"), Qe = globalThis, P = Qe[Ze] ?? (Qe[Ze] = /* @__PURE__ */ new Map()), $e = /^[a-z][a-z0-9-]*(\.[a-z0-9-]+)*$/, et = (e) => {
-	if (!$e.test(e)) throw Error(`reactivityChannel('${e}'): invalid channel name.\n  Use lowercase kebab segments separated by dots — \`presence\`, \`job-queue\`,
+}), N = "channel:", P = Symbol.for("@voltro/protocol/reactivityChannels"), Ze = globalThis, F = Ze[P] ?? (Ze[P] = /* @__PURE__ */ new Map()), Qe = /^[a-z][a-z0-9-]*(\.[a-z0-9-]+)*$/, $e = (e) => {
+	if (!Qe.test(e)) throw Error(`reactivityChannel('${e}'): invalid channel name.\n  Use lowercase kebab segments separated by dots — \`presence\`, \`job-queue\`,
   \`billing.usage\`. A \`:\` is refused because it is the namespace separator in
   the routing key (\`${N}<name>\`), and an uppercase letter is\n  refused because a key that differs only by case reads as one channel and
   routes as two.`);
-	let t = P.get(e);
+	let t = F.get(e);
 	if (t !== void 0) return t;
 	let n = `${N}${e}`, r = Object.freeze({
 		kind: "reactivity-channel",
@@ -151,15 +151,15 @@ var We = d.Union(d.String, d.Number), p = d.Record({
 		key: n,
 		toString: () => n
 	});
-	return P.set(e, r), r;
-}, tt = (e) => typeof e == "object" && !!e && e.kind === "reactivity-channel", nt = (e) => e.startsWith(N), rt = () => new Set([...P.values()].map((e) => e.key)), F = (e) => tt(e) ? e.key : e, it = (e) => e === void 0 ? [] : Array.isArray(e) ? e.map(F) : [F(e)], at = (e) => e === void 0 ? void 0 : Array.isArray(e) ? e.map(F) : F(e), ot = (e) => {
-	let t = rt(), n = [];
-	for (let r of e) for (let e of it(r.source)) !nt(e) || t.has(e) || n.push({
+	return F.set(e, r), r;
+}, et = (e) => typeof e == "object" && !!e && e.kind === "reactivity-channel", tt = (e) => e.startsWith(N), nt = () => new Set([...F.values()].map((e) => e.key)), I = (e) => et(e) ? e.key : e, rt = (e) => e === void 0 ? [] : Array.isArray(e) ? e.map(I) : [I(e)], it = (e) => e === void 0 ? void 0 : Array.isArray(e) ? e.map(I) : I(e), at = (e) => {
+	let t = nt(), n = [];
+	for (let r of e) for (let e of rt(r.source)) !tt(e) || t.has(e) || n.push({
 		procedure: r.name,
 		key: e
 	});
 	return n;
-}, st = (e, t) => {
+}, ot = (e, t) => {
 	let n = e?.injectExternalChange;
 	return n !== void 0 && (n.call(e, {
 		table: t.key,
@@ -168,8 +168,8 @@ var We = d.Union(d.String, d.Number), p = d.Record({
 		old: {},
 		origin: "inline"
 	}), !0);
-}, ct = (e) => e.internal !== !0, I = (e) => {
-	if (lt(e), Array.isArray(e.guards) && e.guards.length === 0) throw Error(`${e.name}: \`guards: []\` is empty, so it enforces nothing — but it reads\n  at the call site as if this procedure were protected. Omit the field for an
+}, st = (e) => e.internal !== !0, L = (e) => {
+	if (ct(e), Array.isArray(e.guards) && e.guards.length === 0) throw Error(`${e.name}: \`guards: []\` is empty, so it enforces nothing — but it reads\n  at the call site as if this procedure were protected. Omit the field for an
   unguarded procedure, or list the scopes required to call it.`);
 	let t = typeof e.source == "string" ? [e.source] : Array.isArray(e.source) ? e.source : void 0;
 	if (t !== void 0 && (t.length === 0 || t.some((e) => String(e).trim() === ""))) throw Error(`${e.name}: \`source\` is empty, so this query declares reactivity and\n  subscribes to nothing — it serves one snapshot and never updates again,
@@ -186,7 +186,7 @@ var We = d.Union(d.String, d.Number), p = d.Record({
 	let n = [e.publicApi === void 0 ? void 0 : "publicApi", e.exposeAsTool === void 0 ? void 0 : "exposeAsTool"].filter((e) => e !== void 0);
 	if (n.length === 0) return e;
 	throw Error(`${e.name}: \`internal: true\` cannot be combined with ${n.map((e) => `\`${e}\``).join(" or ")}. \`internal\` takes the procedure OFF the wire; those put it back ON a different one (${n.includes("publicApi") ? "a REST route" : "an agent tool"}), and that surface is projected without consulting the flag — so the procedure would be unreachable from your client and reachable from the internet. Drop \`internal: true\` if the wider surface is intended, or remove the ${n.join(" / ")} annotation if it is not.`);
-}, lt = (e) => {
+}, ct = (e) => {
 	let t = e.requiresApproval;
 	if (t !== void 0) {
 		if (!Array.isArray(t.approvers) || t.approvers.length === 0) throw Error(`${e.name}: \`requiresApproval.approvers\` is empty, so NOBODY can approve this\n  procedure and every call would park forever. Name the scope(s) an approver must hold
@@ -196,48 +196,48 @@ var We = d.Union(d.String, d.Number), p = d.Record({
   human from every other, and the second-pair-of-eyes control would enforce nothing.
   Give the procedure a \`guards:\` decision, or drop \`requiresApproval\`.`);
 	}
-}, ut = (e) => e.action !== void 0 && e.resourceType !== void 0, dt = (e) => e.openAccess !== void 0 || e.guards !== void 0 && e.guards.length > 0, L = (e, t, n) => {
+}, lt = (e) => e.action !== void 0 && e.resourceType !== void 0, ut = (e) => e.openAccess !== void 0 || e.guards !== void 0 && e.guards.length > 0, R = (e, t, n) => {
 	if (n === void 0) return t;
 	if (n.trim() === "") throw Error(`${e}: \`openAccess\` needs a REASON, not an empty string. It is the sentence a\n  reviewer reads to decide whether this procedure should really be callable
   without an authorization check — e.g. \`openAccess: 'public pricing, no caller data'\`.`);
 	if (t !== void 0 && t.length > 0) throw Error(`${e}: \`openAccess\` and \`guards\` are two different access decisions, so\n  declaring both says the procedure is protected AND open. Keep the guards if a
   caller must hold a scope; drop them if anyone may call it.`);
 	return [u(n.trim())];
-}, R = (e) => I({
+}, z = (e) => L({
 	kind: "query",
 	name: e.name,
 	input: e.input,
 	output: e.output,
 	error: e.error ?? d.Never,
-	source: at(e.source),
+	source: it(e.source),
 	cache: e.cache,
-	guards: L(e.name, e.guards, e.openAccess),
+	guards: R(e.name, e.guards, e.openAccess),
 	openAccess: e.openAccess,
 	publicApi: e.publicApi,
 	exposeAsTool: e.exposeAsTool,
 	internal: e.internal,
 	overridesPlugin: e.overridesPlugin
-}), z = (e) => I({
+}), B = (e) => L({
 	kind: "mutation",
 	name: e.name,
 	input: e.input,
 	output: e.output,
 	error: e.error ?? d.Never,
 	target: e.target,
-	guards: L(e.name, e.guards, e.openAccess),
+	guards: R(e.name, e.guards, e.openAccess),
 	openAccess: e.openAccess,
 	publicApi: e.publicApi,
 	exposeAsTool: e.exposeAsTool,
 	requiresApproval: e.requiresApproval,
 	internal: e.internal,
 	overridesPlugin: e.overridesPlugin
-}), B = (e) => I({
+}), V = (e) => L({
 	kind: "action",
 	name: e.name,
 	input: e.input,
 	output: e.output,
 	error: e.error ?? d.Never,
-	guards: L(e.name, e.guards, e.openAccess),
+	guards: R(e.name, e.guards, e.openAccess),
 	openAccess: e.openAccess,
 	source: e.source,
 	target: e.target,
@@ -246,7 +246,7 @@ var We = d.Union(d.String, d.Number), p = d.Record({
 	requiresApproval: e.requiresApproval,
 	internal: e.internal,
 	overridesPlugin: e.overridesPlugin
-}), ft = (e) => I({
+}), dt = (e) => L({
 	kind: "stream",
 	name: e.name,
 	input: e.input,
@@ -254,42 +254,42 @@ var We = d.Union(d.String, d.Number), p = d.Record({
 	error: e.error ?? d.Never,
 	internal: e.internal,
 	overridesPlugin: e.overridesPlugin,
-	guards: L(e.name, e.guards, e.openAccess),
+	guards: R(e.name, e.guards, e.openAccess),
 	openAccess: e.openAccess
-}), V = (e, t) => t && t.length > 0 ? d.Union(e, ...t) : e, H = (e) => e !== void 0 && e.some((e) => !l(e)), pt = (e, t) => H(t) ? d.Union(e, c, s) : e, mt = (e) => d.Union(e, x), ht = (e, t) => t === void 0 ? e : d.Union(e, A), U = (e, t) => {
+}), H = (e, t) => t && t.length > 0 ? d.Union(e, ...t) : e, U = (e) => e !== void 0 && e.some((e) => !l(e)), ft = (e, t) => U(t) ? d.Union(e, c, s) : e, pt = (e) => d.Union(e, x), mt = (e, t) => t === void 0 ? e : d.Union(e, A), W = (e, t) => {
 	if (t === "stream") return e.error;
-	let n = pt(e.error, e.guards);
-	return t === "query" ? n : ht(t === "mutation" ? mt(n) : n, e.requiresApproval);
-}, gt = (e, t) => f.make(e.name, {
-	payload: b(e.input, e.name, H(e.guards)),
+	let n = ft(e.error, e.guards);
+	return t === "query" ? n : mt(t === "mutation" ? pt(n) : n, e.requiresApproval);
+}, ht = (e, t) => f.make(e.name, {
+	payload: b(e.input, e.name, U(e.guards)),
 	success: v(e.output),
-	error: V(U(e, "query"), t),
+	error: H(W(e, "query"), t),
 	stream: !0
+}), gt = (e, t) => f.make(e.name, {
+	payload: b(e.input, e.name, U(e.guards)),
+	success: e.output,
+	error: H(W(e, "mutation"), t)
 }), _t = (e, t) => f.make(e.name, {
-	payload: b(e.input, e.name, H(e.guards)),
+	payload: b(e.input, e.name, U(e.guards)),
 	success: e.output,
-	error: V(U(e, "mutation"), t)
+	error: H(W(e, "action"), t)
 }), vt = (e, t) => f.make(e.name, {
-	payload: b(e.input, e.name, H(e.guards)),
-	success: e.output,
-	error: V(U(e, "action"), t)
-}), yt = (e, t) => f.make(e.name, {
-	payload: b(e.input, e.name, H(e.guards)),
+	payload: b(e.input, e.name, U(e.guards)),
 	success: e.element,
-	error: V(e.error, t),
+	error: H(e.error, t),
 	stream: !0
-}), bt = (e) => {
+}), yt = (e) => {
 	if (typeof e != "object" || !e) return;
 	let t = e._tag;
 	return typeof t == "string" ? t : void 0;
-}, xt = (e) => {
+}, bt = (e) => {
 	switch (e.kind) {
-		case "query": return gt(e);
-		case "mutation": return _t(e);
-		case "action": return vt(e);
-		case "stream": return yt(e);
+		case "query": return ht(e);
+		case "mutation": return gt(e);
+		case "action": return _t(e);
+		case "stream": return vt(e);
 	}
-}, St = (e) => {
+}, xt = (e) => {
 	let t = e.input, n = t === void 0 ? {} : { input: t }, r = e.output, i = r === void 0 ? {} : { output: r };
 	if (e.kind === "query") return {
 		kind: "query",
@@ -330,7 +330,7 @@ var We = d.Union(d.String, d.Number), p = d.Record({
 			..."shapeItem" in e && e.shapeItem !== void 0 ? { shapeItem: e.shapeItem } : {}
 		}))
 	};
-}, Ct = 7500, wt = (e) => typeof e == "object" && !!e && e.kind === "event", Tt = (e) => {
+}, St = 7500, Ct = (e) => typeof e == "object" && !!e && e.kind === "event", wt = (e) => {
 	if (e.name.length === 0) throw Error("defineEvent: `name` must not be empty");
 	if (/\s/.test(e.name)) throw Error(`defineEvent("${e.name}"): \`name\` must not contain whitespace.\n  The name is used as a broker subject segment. NATS refuses a subject with
   whitespace and delivers nothing — silently, and only on that broker, so an
@@ -365,69 +365,69 @@ var We = d.Union(d.String, d.Number), p = d.Record({
 		webhook: e.webhook,
 		delivery: e.delivery
 	};
-}, Et = (e) => d.Struct({
+}, Tt = (e) => d.Struct({
 	_tag: d.Literal("event"),
 	origin: d.String,
 	n: d.Number,
 	emittedAt: d.Number,
 	payload: e
-}), Dt = d.Struct({
+}), Et = d.Struct({
 	_tag: d.Literal("gap"),
 	missed: d.Number,
 	reason: d.Literal("buffer", "resume")
-}), Ot = d.Struct({ _tag: d.Literal("attached") }), kt = (e) => d.Union(Ot, Et(e), Dt), At = d.Struct({
+}), Dt = d.Struct({ _tag: d.Literal("attached") }), Ot = (e) => d.Union(Dt, Tt(e), Et), kt = d.Struct({
 	origin: d.String,
 	n: d.Number
-}), jt = (e) => d.Struct({
+}), At = (e) => d.Struct({
 	key: e,
-	resume: d.optional(d.Array(At))
-}), Mt = (e, t) => {
+	resume: d.optional(d.Array(kt))
+}), jt = (e, t) => {
 	let n = e.guards !== void 0 && e.guards.some((e) => !l(e)) ? d.Union(c, s) : d.Never, r = t && t.length > 0 ? d.Union(n, ...t) : n;
 	return f.make(e.name, {
-		payload: b(jt(e.key), e.name, H(e.guards)),
-		success: kt(e.payload),
+		payload: b(At(e.key), e.name, U(e.guards)),
+		success: Ot(e.payload),
 		error: r,
 		stream: !0
 	});
-}, Nt = class extends d.TaggedError()("EventPayloadInvalid", {
+}, Mt = class extends d.TaggedError()("EventPayloadInvalid", {
 	event: d.String,
 	message: d.String
-}) {}, Pt = class extends d.TaggedError()("EventKeyInvalid", {
+}) {}, Nt = class extends d.TaggedError()("EventKeyInvalid", {
 	event: d.String,
 	message: d.String
-}) {}, Ft = class extends d.TaggedError()("EventPayloadTooLarge", {
+}) {}, Pt = class extends d.TaggedError()("EventPayloadTooLarge", {
 	event: d.String,
 	bytes: d.Number,
 	limit: d.Number
-}) {}, It = (e) => {
+}) {}, Ft = (e) => {
 	if (typeof e != "object" || !e) return JSON.stringify(e) ?? "null";
 	let t = Object.entries(e).filter(([, e]) => e !== void 0).sort(([e], [t]) => e < t ? -1 : +(e > t));
 	return JSON.stringify(t);
-}, Lt = "\0", Rt = (e, t, n) => [
+}, It = "\0", Lt = (e, t, n) => [
 	e ?? "~",
 	t,
-	It(n)
-].join("\0"), zt = (e) => {
+	Ft(n)
+].join("\0"), Rt = (e) => {
 	let [t = "~", n = "", r = ""] = e.split("\0");
 	return {
 		tenantId: t === "~" ? null : t,
 		event: n,
 		key: r
 	};
-}, Bt = (e) => e.split("\0").join(" · "), Vt = (e) => e, Ht = (e) => e, Ut = (e) => {
+}, zt = (e) => e.split("\0").join(" · "), Bt = (e) => e, Vt = (e) => e, Ht = (e) => {
 	let t = e.alias?.trim(), n = e.instance?.trim(), r = t !== void 0 && t !== "" ? t : e.base;
 	return n !== void 0 && n !== "" ? `${r}#${n}` : r;
-}, Wt = (e) => {
+}, Ut = (e) => {
 	if (e.length !== 0) return (t, n) => e.reduceRight((e, t) => t(e, n), t);
-}, Gt = (e, t) => {
+}, Wt = (e, t) => {
 	let n = He.GenericTag(e);
 	return {
 		Tag: n,
 		Live: Ue.succeed(n, t)
 	};
-}, Kt = (e, t, n) => {
+}, Gt = (e, t, n) => {
 	if (!t) return { ok: !0 };
-	let r = W(n);
+	let r = G(n);
 	if (!r) return {
 		ok: !1,
 		reason: `cannot parse runningVersion "${n}"`
@@ -435,12 +435,12 @@ var We = d.Union(d.String, d.Number), p = d.Record({
 	let i = t.trim();
 	if (i === "*" || i === "") return { ok: !0 };
 	let a = i.split(/\s+/).filter((e) => e.length > 0);
-	for (let i of a) if (!qt(i, r)) return {
+	for (let i of a) if (!Kt(i, r)) return {
 		ok: !1,
 		reason: `plugin "${e}" requires framework ${t}, running ${n}`
 	};
 	return { ok: !0 };
-}, W = (e) => {
+}, G = (e) => {
 	let t = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9a-zA-Z.-]+))?$/.exec(e.trim());
 	return t ? {
 		major: Number(t[1]),
@@ -448,44 +448,44 @@ var We = d.Union(d.String, d.Number), p = d.Record({
 		patch: Number(t[3]),
 		pre: t[4] ?? ""
 	} : null;
-}, G = (e, t) => e.major === t.major ? e.minor === t.minor ? e.patch === t.patch ? e.pre && !t.pre ? -1 : !e.pre && t.pre ? 1 : e.pre && t.pre ? e.pre < t.pre ? -1 : +(e.pre > t.pre) : 0 : e.patch - t.patch : e.minor - t.minor : e.major - t.major, qt = (e, t) => {
+}, K = (e, t) => e.major === t.major ? e.minor === t.minor ? e.patch === t.patch ? e.pre && !t.pre ? -1 : !e.pre && t.pre ? 1 : e.pre && t.pre ? e.pre < t.pre ? -1 : +(e.pre > t.pre) : 0 : e.patch - t.patch : e.minor - t.minor : e.major - t.major, Kt = (e, t) => {
 	if (e === "*") return !0;
 	if (e.startsWith("^")) {
-		let n = W(e.slice(1));
-		return !n || t.major !== n.major ? !1 : G(t, n) >= 0;
+		let n = G(e.slice(1));
+		return !n || t.major !== n.major ? !1 : K(t, n) >= 0;
 	}
 	if (e.startsWith("~")) {
-		let n = W(e.slice(1));
-		return !n || t.major !== n.major || t.minor !== n.minor ? !1 : G(t, n) >= 0;
+		let n = G(e.slice(1));
+		return !n || t.major !== n.major || t.minor !== n.minor ? !1 : K(t, n) >= 0;
 	}
 	let n = /^(>=|<=|>|<)(.+)$/.exec(e);
 	if (n) {
-		let e = n[1], r = W(n[2]);
+		let e = n[1], r = G(n[2]);
 		if (!r) return !1;
-		let i = G(t, r);
+		let i = K(t, r);
 		if (e === ">=") return i >= 0;
 		if (e === "<=") return i <= 0;
 		if (e === ">") return i > 0;
 		if (e === "<") return i < 0;
 	}
-	let r = W(e);
-	return r ? G(t, r) === 0 : !1;
-}, K = d.Literal("running", "succeeded", "failed", "cancelled", "suspended"), Jt = d.Literal("cancel", "terminate", "abandon"), Yt = d.Struct({
+	let r = G(e);
+	return r ? K(t, r) === 0 : !1;
+}, q = d.Literal("running", "succeeded", "failed", "cancelled", "suspended"), qt = d.Literal("cancel", "terminate", "abandon"), Jt = d.Struct({
 	mode: d.String,
 	dueAt: d.NullOr(d.Number),
 	retryAfterMs: d.NullOr(d.Number),
 	intentId: d.NullOr(d.String)
-}), Xt = d.Struct({
+}), Yt = d.Struct({
 	id: d.String,
 	workflowName: d.String,
 	executionId: d.NullOr(d.String),
 	status: d.Literal("running", "queued", "dropped", "skipped"),
-	deferral: d.optional(Yt)
-}), q = d.Struct({
+	deferral: d.optional(Jt)
+}), J = d.Struct({
 	id: d.String,
 	tag: d.String,
 	executionId: d.String,
-	status: K,
+	status: q,
 	payload: d.Unknown,
 	workflowVersion: d.NullOr(d.String),
 	workflowPatches: d.NullOr(d.Unknown),
@@ -500,12 +500,12 @@ var We = d.Union(d.String, d.Number), p = d.Record({
 	durationMs: d.NullOr(d.Number),
 	traceId: d.NullOr(d.String),
 	parentExecutionId: d.NullOr(d.String),
-	parentClosePolicy: d.NullOr(Jt)
-}), Zt = d.Struct({
+	parentClosePolicy: d.NullOr(qt)
+}), Xt = d.Struct({
 	tag: d.optional(d.String),
-	status: d.optional(K),
+	status: d.optional(q),
 	limit: d.optional(d.Number)
-}), Qt = d.Struct({
+}), Zt = d.Struct({
 	id: d.String,
 	runId: d.String,
 	stepName: d.String,
@@ -520,7 +520,7 @@ var We = d.Union(d.String, d.Number), p = d.Record({
 	startedAt: d.Date,
 	completedAt: d.NullOr(d.Date),
 	durationMs: d.NullOr(d.Number)
-}), $t = d.Struct({
+}), Qt = d.Struct({
 	id: d.String,
 	runId: d.String,
 	eventType: d.String,
@@ -528,7 +528,7 @@ var We = d.Union(d.String, d.Number), p = d.Record({
 	occurredAt: d.Date,
 	stepName: d.NullOr(d.String),
 	attempt: d.NullOr(d.Number)
-}), en = d.Struct({
+}), $t = d.Struct({
 	id: d.String,
 	name: d.String,
 	payload: d.Unknown,
@@ -536,7 +536,7 @@ var We = d.Union(d.String, d.Number), p = d.Record({
 	subject: d.NullOr(d.Unknown),
 	traceId: d.NullOr(d.String),
 	occurredAt: d.Date
-}), tn = d.Struct({
+}), en = d.Struct({
 	id: d.String,
 	eventId: d.String,
 	eventName: d.String,
@@ -549,108 +549,146 @@ var We = d.Union(d.String, d.Number), p = d.Record({
 	errorMessage: d.NullOr(d.String),
 	createdAt: d.Date,
 	completedAt: d.NullOr(d.Date)
-}), nn = d.Struct({ id: d.String }), J = d.Struct({ runId: d.String }), rn = d.Struct({
+}), tn = d.Struct({ id: d.String }), Y = d.Struct({ runId: d.String }), nn = d.Struct({
 	name: d.optional(d.String),
 	limit: d.optional(d.Number)
-}), an = d.Struct({ eventId: d.String }), Y = d.Struct({
+}), rn = d.Struct({ eventId: d.String }), X = d.Struct({
 	workflowName: d.String,
 	executionId: d.String
-}), on = d.Struct({
+}), an = d.Struct({
 	id: d.String,
 	signalName: d.String,
 	payload: d.optional(d.Unknown)
-}), sn = d.Struct({
+}), on = d.Struct({
 	id: d.String,
 	updateName: d.String,
 	payload: d.optional(d.Unknown),
 	timeoutMs: d.optional(d.Number)
-}), cn = d.Struct({
+}), sn = d.Struct({
 	eventId: d.String,
 	updateId: d.String,
 	completedEventId: d.String,
 	result: d.Unknown
-}), ln = R({
+}), cn = z({
 	name: "__voltro.workflow.run",
 	source: "_voltro_workflow_runs",
-	input: nn,
-	output: d.Array(q)
-}), un = R({
+	input: tn,
+	output: d.Array(J)
+}), ln = z({
 	name: "__voltro.workflow.runs",
 	source: "_voltro_workflow_runs",
-	input: Zt,
-	output: d.Array(q)
-}), dn = R({
+	input: Xt,
+	output: d.Array(J)
+}), un = z({
 	name: "__voltro.workflow.run.steps",
 	source: "_voltro_workflow_run_steps",
-	input: J,
-	output: d.Array(Qt)
-}), fn = R({
+	input: Y,
+	output: d.Array(Zt)
+}), dn = z({
 	name: "__voltro.workflow.run.events",
 	source: "_voltro_workflow_run_events",
-	input: J,
-	output: d.Array($t)
-}), pn = R({
+	input: Y,
+	output: d.Array(Qt)
+}), fn = z({
 	name: "__voltro.workflow.domainEvents",
 	source: "_voltro_workflow_events",
-	input: rn,
-	output: d.Array(en)
-}), mn = R({
+	input: nn,
+	output: d.Array($t)
+}), pn = z({
 	name: "__voltro.workflow.event.deliveries",
 	source: "_voltro_workflow_event_deliveries",
-	input: an,
-	output: d.Array(tn)
-}), hn = B({
+	input: rn,
+	output: d.Array(en)
+}), mn = V({
 	name: "__voltro.workflow.cancel",
-	input: Y,
+	input: X,
 	output: d.Struct({ ok: d.Boolean })
-}), gn = B({
+}), hn = V({
 	name: "__voltro.workflow.resume",
-	input: Y,
+	input: X,
 	output: d.Struct({ ok: d.Boolean })
-}), _n = B({
+}), gn = V({
 	name: "__voltro.workflow.signal",
-	input: on,
+	input: an,
 	output: d.Struct({ eventId: d.String })
-}), vn = B({
+}), _n = V({
 	name: "__voltro.workflow.update",
-	input: sn,
-	output: cn
-}), yn = "__voltro.undo.log", bn = "__voltro.undo.apply", xn = "__voltro.undo.redo", Sn = d.Struct({
+	input: on,
+	output: sn
+}), vn = "__voltro.undo.log", yn = "__voltro.undo.apply", bn = "__voltro.undo.redo", xn = d.Struct({
 	id: d.String,
 	tag: d.String,
 	label: d.NullOr(d.String),
 	undone: d.Boolean,
 	crossesAction: d.Boolean,
 	createdAt: d.String
-}), Cn = class extends d.TaggedError()("UndoNotFound", { invocationId: d.String }) {}, wn = class extends d.TaggedError()("UndoForbidden", { invocationId: d.String }) {}, X = class extends d.TaggedError()("UndoConflict", {
+}), Sn = class extends d.TaggedError()("UndoNotFound", { invocationId: d.String }) {}, Cn = class extends d.TaggedError()("UndoForbidden", { invocationId: d.String }) {}, wn = class extends d.TaggedError()("UndoConflict", {
 	invocationId: d.String,
 	reason: d.Literal("conflict", "action")
-}) {}, Tn = d.Union(Cn, wn, X), En = R({
-	name: yn,
+}) {}, Tn = d.Union(Sn, Cn, wn), En = z({
+	name: vn,
 	source: "_voltro_undo_log",
 	input: d.Struct({ limit: d.optional(d.Number) }),
-	output: d.Array(Sn),
+	output: d.Array(xn),
 	openAccess: "subject-scoped by construction: lists only the calling subject's own undoable actions"
-}), Dn = z({
-	name: bn,
+}), Dn = B({
+	name: yn,
 	input: d.Struct({ invocationId: d.String }),
 	output: d.Struct({ ok: d.Boolean }),
 	error: Tn,
 	openAccess: "subject-scoped by construction: undo is per-actor — another subject's invocation fails typed with UndoForbidden"
-}), On = z({
-	name: xn,
+}), On = B({
+	name: bn,
 	input: d.Struct({ invocationId: d.String }),
 	output: d.Struct({ ok: d.Boolean }),
 	error: Tn,
 	openAccess: "subject-scoped by construction: redo is per-actor — another subject's invocation fails typed with UndoForbidden"
-}), kn = "__voltro.approvals.pending", An = "__voltro.approvals.decide", jn = R({
-	name: kn,
+}), kn = class extends d.TaggedError()("TenantScopeViolation", {
+	table: d.String,
+	reason: d.String
+}) {}, An = class extends d.TaggedError()("StoreOperationFailed", {
+	operation: d.String,
+	table: d.String,
+	cause: d.String
+}) {}, jn = class extends d.TaggedError()("TableValidationFailed", {
+	table: d.String,
+	summary: d.String,
+	issues: d.Array(d.Struct({
+		path: d.String,
+		message: d.String
+	}))
+}) {}, Mn = class extends d.TaggedError()("TenantRowNotFound", {
+	table: d.String,
+	id: d.String,
+	reason: d.String
+}) {}, Nn = class extends d.TaggedError()("ServerOnlyColumnWrite", {
+	table: d.String,
+	columns: d.Array(d.String)
+}) {}, Pn = class extends d.TaggedError()("ConstraintViolation", {
+	kind: d.Literal("foreignKey", "foreignKeyInUse", "unique", "notNull", "check"),
+	table: d.String,
+	operation: d.String,
+	constraint: d.optional(d.String),
+	column: d.optional(d.String)
+}) {
+	get message() {
+		let e = this.constraint ?? this.column, t = e === void 0 ? `on ${this.table}` : `${e} on ${this.table}`;
+		switch (this.kind) {
+			case "foreignKey": return `foreign key ${t}: the referenced row does not exist`;
+			case "foreignKeyInUse": return `foreign key ${t}: the row is still referenced by other rows`;
+			case "unique": return `unique constraint ${t}: a row with this value already exists`;
+			case "notNull": return `not-null constraint ${t}: the column requires a value`;
+			case "check": return `check constraint ${t}: the row does not satisfy it`;
+		}
+	}
+}, Fn = "__voltro.approvals.pending", Z = "__voltro.approvals.decide", In = z({
+	name: Fn,
 	source: "_voltro_approvals",
 	input: d.Struct({ limit: d.optional(d.Number) }),
 	output: d.Array(M),
 	openAccess: "the answer is scoped to the caller — a row appears only if they requested it or hold its recorded approver scopes, so an anonymous caller sees nothing"
-}), Mn = z({
-	name: An,
+}), Ln = B({
+	name: Z,
 	input: d.Struct({
 		approvalId: d.String,
 		decision: d.Literal("approve", "reject"),
@@ -662,33 +700,33 @@ var We = d.Union(d.String, d.Number), p = d.Record({
 	}),
 	error: j,
 	openAccess: "the approver authority is the PENDING ROW's own recorded scopes (plus an unconditional self-approval refusal), checked in-handler — a descriptor-level scope would have to be the union of every approval-requiring procedure in the app"
-}), Nn = "__voltro.connections.list", Pn = "__voltro.connections.start", Fn = "__voltro.connections.submitToken", In = "__voltro.connections.disconnect", Z = d.Literal("oauth2", "pat"), Ln = d.Literal("disconnected", "connected", "expired", "revoked", "error"), Rn = d.Struct({
+}), Rn = "__voltro.connections.list", zn = "__voltro.connections.start", Bn = "__voltro.connections.submitToken", Vn = "__voltro.connections.disconnect", Q = d.Literal("oauth2", "pat"), Hn = d.Literal("disconnected", "connected", "expired", "revoked", "error"), Un = d.Struct({
 	connectionId: d.String,
-	kind: Z,
+	kind: Q,
 	label: d.String,
-	status: Ln,
+	status: Hn,
 	accountId: d.NullOr(d.String),
 	accountLabel: d.NullOr(d.String),
 	scopes: d.Array(d.String),
 	expiresAt: d.NullOr(d.String),
 	lastError: d.NullOr(d.String),
 	connectedAt: d.NullOr(d.String)
-}), zn = class extends d.TaggedError()("ConnectionNotDeclared", { connectionId: d.String }) {}, Bn = class extends d.TaggedError()("ConnectionSubjectRequired", { connectionId: d.String }) {}, Vn = class extends d.TaggedError()("ConnectionKindMismatch", {
+}), Wn = class extends d.TaggedError()("ConnectionNotDeclared", { connectionId: d.String }) {}, Gn = class extends d.TaggedError()("ConnectionSubjectRequired", { connectionId: d.String }) {}, Kn = class extends d.TaggedError()("ConnectionKindMismatch", {
 	connectionId: d.String,
-	expected: Z,
-	actual: Z
-}) {}, Q = class extends d.TaggedError()("ConnectionHandshakeFailed", {
+	expected: Q,
+	actual: Q
+}) {}, qn = class extends d.TaggedError()("ConnectionHandshakeFailed", {
 	connectionId: d.String,
 	reason: d.String,
 	transient: d.Boolean
-}) {}, $ = d.Union(zn, Bn, Vn, Q), Hn = R({
-	name: Nn,
+}) {}, $ = d.Union(Wn, Gn, Kn, qn), Jn = z({
+	name: Rn,
 	source: "_voltro_connections",
 	input: d.Struct({}),
-	output: d.Array(Rn),
+	output: d.Array(Un),
 	openAccess: "self-scoped read: projects the declared connections for the calling subject only (its own connect/disconnect state)"
-}), Un = B({
-	name: Pn,
+}), Yn = V({
+	name: zn,
 	input: d.Struct({
 		connectionId: d.String,
 		redirectTo: d.optional(d.String)
@@ -699,8 +737,8 @@ var We = d.Union(d.String, d.Number), p = d.Record({
 	}),
 	error: $,
 	openAccess: "self-service: begins an oauth handshake that stores a credential for the calling subject only; anonymous callers fail typed with ConnectionSubjectRequired"
-}), Wn = z({
-	name: Fn,
+}), Xn = B({
+	name: Bn,
 	input: d.Struct({
 		connectionId: d.String,
 		token: d.String
@@ -708,15 +746,15 @@ var We = d.Union(d.String, d.Number), p = d.Record({
 	output: d.Struct({ ok: d.Boolean }),
 	error: $,
 	openAccess: "self-service: stores a pasted token as the calling subject's own credential; anonymous callers fail typed with ConnectionSubjectRequired"
-}), Gn = z({
-	name: In,
+}), Zn = B({
+	name: Vn,
 	input: d.Struct({ connectionId: d.String }),
 	output: d.Struct({ ok: d.Boolean }),
 	error: $,
 	openAccess: "self-service: deletes only the calling subject's own credential row for this connection"
-}), Kn = (e) => {
+}), Qn = (e) => {
 	let t = e instanceof Date ? e.getTime() : typeof e == "number" ? e : typeof e == "string" ? new Date(e).getTime() : 0;
 	return Number.isNaN(t) ? 0 : t;
-}, qn = 1;
+}, $n = 1;
 //#endregion
-export { Oe as ADMIN_SCOPE, Ce as APIKEY_ISSUE_ORG_SCOPE, Ee as APIKEY_ISSUE_OTHER_SCOPE, ve as APIKEY_ISSUE_SELF_SCOPE, An as APPROVALS_DECIDE_TAG, kn as APPROVALS_PENDING_TAG, j as ApprovalDecisionErrors, A as ApprovalErrors, E as ApprovalExpired, O as ApprovalForbidden, C as ApprovalNotFound, D as ApprovalNotPending, T as ApprovalRejected, S as ApprovalRequired, w as ApprovalSelfApproval, k as ApprovalUnavailable, Ae as AuthMiddleware, x as BusinessRuleViolation, Nn as CONNECTIONS_LIST_TAG, In as CONNECTION_DISCONNECT_TAG, Pn as CONNECTION_START_TAG, Fn as CONNECTION_SUBMIT_TOKEN_TAG, Q as ConnectionHandshakeFailed, ce as ConnectionInfo, i as ConnectionInfoMiddleware, Z as ConnectionKind, Vn as ConnectionKindMismatch, zn as ConnectionNotDeclared, Rn as ConnectionState, Ln as ConnectionStatus, Bn as ConnectionSubjectRequired, r as DEFAULT_SCOPE_CACHE_MAX_ENTRIES, ie as DEFAULT_SCOPE_CACHE_TTL_MS, Lt as EVENT_ROUTE_SEP, Pt as EventKeyInvalid, Nt as EventPayloadInvalid, Ft as EventPayloadTooLarge, be as IMPERSONATION_METADATA_KEY, Ct as MAX_EVENT_ENVELOPE_BYTES, qn as PROTOCOL_VERSION, M as PendingApproval, N as REACTIVITY_CHANNEL_PREFIX, c as ScopeError, e as Subject, ye as SubjectIdentity, re as SubjectService, bn as UNDO_APPLY_TAG, yn as UNDO_LOG_TAG, xn as UNDO_REDO_TAG, s as Unauthenticated, X as UndoConflict, wn as UndoForbidden, Sn as UndoLogEntry, Cn as UndoNotFound, Y as WorkflowControlInputSchema, en as WorkflowDomainEventRowSchema, rn as WorkflowDomainEventsInputSchema, an as WorkflowEventDeliveriesInputSchema, tn as WorkflowEventDeliveryRowSchema, Jt as WorkflowParentClosePolicySchema, $t as WorkflowRunEventRowSchema, Xt as WorkflowRunHandleSchema, nn as WorkflowRunRefSchema, q as WorkflowRunRowSchema, K as WorkflowRunStatusSchema, Qt as WorkflowRunStepRowSchema, J as WorkflowRunTableRefSchema, Zt as WorkflowRunsInputSchema, on as WorkflowSignalInputSchema, Yt as WorkflowStartDeferralSchema, sn as WorkflowUpdateInputSchema, cn as WorkflowUpdateResultSchema, vt as actionToRpc, we as advisoryResourceGuardWarning, ae as anonymousSubject, Ye as applyRowPatch, a as applyScopeDecision, Mn as approvalsDecideDescriptor, jn as approvalsPendingQueryDescriptor, te as assertAuthenticated, ze as beginIdempotent, Kt as checkFrameworkCompat, De as checkGuards, me as checkGuardsEffect, ne as composeAuthStrategies, Wt as composeRpcInterceptors, Gn as connectionDisconnectDescriptor, Un as connectionStartDescriptor, Wn as connectionSubmitTokenDescriptor, Hn as connectionsListQueryDescriptor, rt as declaredReactivityChannelKeys, B as defineAction, Tt as defineEvent, z as defineMutation, Vt as definePlugin, Ht as definePluginRoute, Gt as definePluginService, R as defineQuery, ft as defineStream, qe as diffRows, xe as effectiveScopes, It as encodeEventKey, bt as errorTag, Ot as eventAttached, Et as eventEnvelope, Dt as eventGap, At as eventResumePoint, Rt as eventRoute, kt as eventStreamEvent, jt as eventSubscribeInput, Mt as eventToRpc, Ie as failIdempotent, ke as findAdvisoryResourceGuards, Pe as finishIdempotent, Bt as formatEventRoute, he as getPolicyGuardResolver, ge as getResourceScopeResolver, dt as hasAccessDecision, oe as hasCallbackRoutes, Te as hasEffectiveScope, H as hasEnforcedGuard, Se as hasScope, g as idToPath, Re as idempotencyScope, y as inputLabel, wt as isEventDescriptor, Je as isIdKeyed, l as isOpenAccess, _e as isPolicyCheck, ut as isPolicyGuard, tt as isReactivityChannel, nt as isReactivityChannelKey, Ne as isSystemSubject, ct as isWireReachable, t as makeScopeCache, Be as memoryIdempotencyStore, fe as missingAccessDecision, _t as mutationToRpc, St as normalizeDescriptor, at as normalizeSource, u as openAccessSpec, zt as parseEventRoute, Ge as pathToId, Ut as pluginInstanceName, st as publishReactivity, Ve as publishServerError, gt as queryToRpc, ue as rawImpersonationMark, et as reactivityChannel, Me as requireScope, m as rowPatchOpSchema, h as rowPatchSchema, ee as scopeCacheKey, pe as setEffectiveScopes, je as setPolicyGuardResolver, se as setResourceScopeResolver, it as sourceKeys, yt as streamToRpc, b as strictInput, le as subjectIdentity, n as subjectScopes, Le as subscribeServerErrors, v as subscriptionEvent, de as systemSubject, o as tenantScopedSubject, xt as toRpc, Kn as tsMs, ot as undeclaredChannelKeys, Dn as undoApplyDescriptor, En as undoLogQueryDescriptor, On as undoRedoDescriptor, U as wireErrorUnion, hn as workflowCancelDescriptor, pn as workflowDomainEventsQueryDescriptor, mn as workflowEventDeliveriesQueryDescriptor, gn as workflowResumeDescriptor, fn as workflowRunEventsQueryDescriptor, ln as workflowRunQueryDescriptor, dn as workflowRunStepsQueryDescriptor, un as workflowRunsQueryDescriptor, _n as workflowSignalDescriptor, vn as workflowUpdateDescriptor, Fe as wsMutationIdempotencyScope };
+export { Oe as ADMIN_SCOPE, Ce as APIKEY_ISSUE_ORG_SCOPE, Ee as APIKEY_ISSUE_OTHER_SCOPE, ve as APIKEY_ISSUE_SELF_SCOPE, Z as APPROVALS_DECIDE_TAG, Fn as APPROVALS_PENDING_TAG, j as ApprovalDecisionErrors, A as ApprovalErrors, E as ApprovalExpired, O as ApprovalForbidden, C as ApprovalNotFound, D as ApprovalNotPending, T as ApprovalRejected, S as ApprovalRequired, w as ApprovalSelfApproval, k as ApprovalUnavailable, Ae as AuthMiddleware, x as BusinessRuleViolation, Rn as CONNECTIONS_LIST_TAG, Vn as CONNECTION_DISCONNECT_TAG, zn as CONNECTION_START_TAG, Bn as CONNECTION_SUBMIT_TOKEN_TAG, qn as ConnectionHandshakeFailed, ce as ConnectionInfo, i as ConnectionInfoMiddleware, Q as ConnectionKind, Kn as ConnectionKindMismatch, Wn as ConnectionNotDeclared, Un as ConnectionState, Hn as ConnectionStatus, Gn as ConnectionSubjectRequired, Pn as ConstraintViolation, r as DEFAULT_SCOPE_CACHE_MAX_ENTRIES, ie as DEFAULT_SCOPE_CACHE_TTL_MS, It as EVENT_ROUTE_SEP, Nt as EventKeyInvalid, Mt as EventPayloadInvalid, Pt as EventPayloadTooLarge, be as IMPERSONATION_METADATA_KEY, St as MAX_EVENT_ENVELOPE_BYTES, $n as PROTOCOL_VERSION, M as PendingApproval, N as REACTIVITY_CHANNEL_PREFIX, c as ScopeError, Nn as ServerOnlyColumnWrite, An as StoreOperationFailed, e as Subject, ye as SubjectIdentity, re as SubjectService, jn as TableValidationFailed, Mn as TenantRowNotFound, kn as TenantScopeViolation, yn as UNDO_APPLY_TAG, vn as UNDO_LOG_TAG, bn as UNDO_REDO_TAG, s as Unauthenticated, wn as UndoConflict, Cn as UndoForbidden, xn as UndoLogEntry, Sn as UndoNotFound, X as WorkflowControlInputSchema, $t as WorkflowDomainEventRowSchema, nn as WorkflowDomainEventsInputSchema, rn as WorkflowEventDeliveriesInputSchema, en as WorkflowEventDeliveryRowSchema, qt as WorkflowParentClosePolicySchema, Qt as WorkflowRunEventRowSchema, Yt as WorkflowRunHandleSchema, tn as WorkflowRunRefSchema, J as WorkflowRunRowSchema, q as WorkflowRunStatusSchema, Zt as WorkflowRunStepRowSchema, Y as WorkflowRunTableRefSchema, Xt as WorkflowRunsInputSchema, an as WorkflowSignalInputSchema, Jt as WorkflowStartDeferralSchema, on as WorkflowUpdateInputSchema, sn as WorkflowUpdateResultSchema, _t as actionToRpc, we as advisoryResourceGuardWarning, ae as anonymousSubject, Ye as applyRowPatch, a as applyScopeDecision, Ln as approvalsDecideDescriptor, In as approvalsPendingQueryDescriptor, te as assertAuthenticated, ze as beginIdempotent, Gt as checkFrameworkCompat, De as checkGuards, me as checkGuardsEffect, ne as composeAuthStrategies, Ut as composeRpcInterceptors, Zn as connectionDisconnectDescriptor, Yn as connectionStartDescriptor, Xn as connectionSubmitTokenDescriptor, Jn as connectionsListQueryDescriptor, nt as declaredReactivityChannelKeys, V as defineAction, wt as defineEvent, B as defineMutation, Bt as definePlugin, Vt as definePluginRoute, Wt as definePluginService, z as defineQuery, dt as defineStream, qe as diffRows, xe as effectiveScopes, Ft as encodeEventKey, yt as errorTag, Dt as eventAttached, Tt as eventEnvelope, Et as eventGap, kt as eventResumePoint, Lt as eventRoute, Ot as eventStreamEvent, At as eventSubscribeInput, jt as eventToRpc, Ie as failIdempotent, ke as findAdvisoryResourceGuards, Pe as finishIdempotent, zt as formatEventRoute, he as getPolicyGuardResolver, ge as getResourceScopeResolver, ut as hasAccessDecision, oe as hasCallbackRoutes, Te as hasEffectiveScope, U as hasEnforcedGuard, Se as hasScope, g as idToPath, Re as idempotencyScope, y as inputLabel, Ct as isEventDescriptor, Je as isIdKeyed, l as isOpenAccess, _e as isPolicyCheck, lt as isPolicyGuard, et as isReactivityChannel, tt as isReactivityChannelKey, Ne as isSystemSubject, st as isWireReachable, t as makeScopeCache, Be as memoryIdempotencyStore, fe as missingAccessDecision, gt as mutationToRpc, xt as normalizeDescriptor, it as normalizeSource, u as openAccessSpec, Rt as parseEventRoute, Ge as pathToId, Ht as pluginInstanceName, ot as publishReactivity, Ve as publishServerError, ht as queryToRpc, ue as rawImpersonationMark, $e as reactivityChannel, Me as requireScope, m as rowPatchOpSchema, h as rowPatchSchema, ee as scopeCacheKey, pe as setEffectiveScopes, je as setPolicyGuardResolver, se as setResourceScopeResolver, rt as sourceKeys, vt as streamToRpc, b as strictInput, le as subjectIdentity, n as subjectScopes, Le as subscribeServerErrors, v as subscriptionEvent, de as systemSubject, o as tenantScopedSubject, bt as toRpc, Qn as tsMs, at as undeclaredChannelKeys, Dn as undoApplyDescriptor, En as undoLogQueryDescriptor, On as undoRedoDescriptor, W as wireErrorUnion, mn as workflowCancelDescriptor, fn as workflowDomainEventsQueryDescriptor, pn as workflowEventDeliveriesQueryDescriptor, hn as workflowResumeDescriptor, dn as workflowRunEventsQueryDescriptor, cn as workflowRunQueryDescriptor, un as workflowRunStepsQueryDescriptor, ln as workflowRunsQueryDescriptor, gn as workflowSignalDescriptor, _n as workflowUpdateDescriptor, Fe as wsMutationIdempotencyScope };

package/dist/jwt.d.ts

@@ -286,7 +286,7 @@ declare const Subject: Schema.Union<[Schema.Struct<{
      * Set when this caller PRESENTED a credential and it was rejected — an
      * expired token above all. Absent when they presented none.
      *
-     * The two are the same Subject and must not be the same ANSWER. A consumer
+     * The two are the same Subject and must not be the same ANSWER. A deployment
      * measured the cost: a user's tab outlived their IdP's token lifetime, the
      * strategy logged `supabase jwt expired`, the caller fell through to
      * anonymous, and the guard then refused with `missing required scope

package/dist/rest.d.ts

@@ -176,7 +176,7 @@ declare interface GuardSpec<Input = unknown> {
      * in its own tables (a `teamMembers` row, say) registers its own tuple source
      * rather than copying data across; see `policyGuardResolver.ts`.
      *
-     * That paragraph is here because its absence cost a consumer their access
+     * That paragraph is here because its absence cost a deployment their access
      * gate. This comment used to describe the resolver as "a future ReBAC /
      * `accessPolicy()` resolver" — written before the ReBAC path shipped and
      * never updated. They read the type, quoted the sentence, concluded there was
@@ -653,7 +653,7 @@ declare interface QueryCacheConfig {
      *
      * `'tenant'` exists because the other two were the only options and neither
      * fits an org-wide figure: `subject` recomputes it per person, and `global`
-     * is not a cache but a cross-tenant leak. A consumer reported computing the
+     * is not a cache but a cross-tenant leak. A deployment reported computing the
      * same nine-table statistic up to 18 times for 18 employees rather than take
      * the second option, which was the correct call.
      *
@@ -897,7 +897,7 @@ declare const Subject: Schema.Union<[Schema.Struct<{
      * Set when this caller PRESENTED a credential and it was rejected — an
      * expired token above all. Absent when they presented none.
      *
-     * The two are the same Subject and must not be the same ANSWER. A consumer
+     * The two are the same Subject and must not be the same ANSWER. A deployment
      * measured the cost: a user's tab outlived their IdP's token lifetime, the
      * strategy logged `supabase jwt expired`, the caller fell through to
      * anonymous, and the guard then refused with `missing required scope

package/dist/session.d.ts

@@ -284,7 +284,7 @@ declare const Subject: Schema.Union<[Schema.Struct<{
      * Set when this caller PRESENTED a credential and it was rejected — an
      * expired token above all. Absent when they presented none.
      *
-     * The two are the same Subject and must not be the same ANSWER. A consumer
+     * The two are the same Subject and must not be the same ANSWER. A deployment
      * measured the cost: a user's tab outlived their IdP's token lifetime, the
      * strategy logged `supabase jwt expired`, the caller fell through to
      * anonymous, and the guard then refused with `missing required scope
@@ -330,7 +330,7 @@ declare const SubjectIdentity: Schema.Union<[Schema.Struct<{
      * Set when this caller PRESENTED a credential and it was rejected — an
      * expired token above all. Absent when they presented none.
      *
-     * The two are the same Subject and must not be the same ANSWER. A consumer
+     * The two are the same Subject and must not be the same ANSWER. A deployment
      * measured the cost: a user's tab outlived their IdP's token lifetime, the
      * strategy logged `supabase jwt expired`, the caller fell through to
      * anonymous, and the guard then refused with `missing required scope

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/protocol",
-  "version": "0.42.0",
+  "version": "0.43.1",
   "description": "The Voltro wire + plugin contract — defineQuery/Mutation/Action/Stream, definePlugin, sessions / JWT / API-keys, and the RPC protocol.",
   "keywords": [
     "voltro",
@@ -54,8 +54,8 @@
   },
   "dependencies": {
     "@effect/sql": "^0.52.0",
-    "@voltro/database": "0.42.0",
-    "@voltro/logger": "0.42.0",
+    "@voltro/database": "0.43.1",
+    "@voltro/logger": "0.43.1",
     "jose": "^6.2.8"
   },
   "peerDependencies": {