@voltro/protocol 0.64.0 → 0.65.0

package/dist/index.js

@@ -1,54 +1,54 @@
-import { A as e, B as t, C as n, D as r, E as i, F as a, G as o, H as s, I as ee, L as te, M as ne, N as c, O as re, P as ie, R as ae, S as oe, T as se, U as ce, V as le, W as ue, _ as de, a as l, b as fe, c as pe, d as me, f as he, g as ge, h as u, i as _e, j as ve, k as ye, l as be, m as xe, n as Se, o as Ce, p as we, r as Te, s as Ee, t as De, u as Oe, v as d, w as ke, x as Ae, y as je, z as Me } from "./scopes-D9t3tYc7.js";
-import { a as Ne, c as Pe, i as f, l as Fe, n as Ie, o as Le, r as Re, s as ze, t as Be, u as Ve } from "./serverErrorBus-QQgyq6fV.js";
-import { Context as He, Layer as Ue, Schema as p } from "effect";
-import { Rpc as m } from "@effect/rpc";
+import { A as e, B as t, C as n, D as r, E as i, F as a, G as o, H as s, I as c, K as ee, L as te, M as ne, N as re, O as ie, P as l, R as ae, S as oe, T as se, U as ce, V as le, W as ue, _ as de, a as u, b as fe, c as pe, d as me, f as he, g as d, h as ge, i as _e, j as ve, k as ye, l as be, m as xe, n as Se, o as Ce, p as we, r as Te, s as Ee, t as De, u as Oe, v as ke, w as Ae, x as je, y as f, z as Me } from "./scopes-C86BDyNJ.js";
+import { a as Ne, c as Pe, i as p, l as Fe, n as Ie, o as Le, r as Re, s as ze, t as Be, u as Ve } from "./serverErrorBus-QQgyq6fV.js";
+import { Context as He, Layer as Ue, Schema as m } from "effect";
+import { Rpc as h } from "@effect/rpc";
 import { VersionConflict as We } from "@voltro/database/wire";
 //#region src/rowPatch.ts
-var Ge = p.Union(p.String, p.Number), h = p.Record({
-	key: p.String,
-	value: p.Unknown
-}).pipe(p.filter((e) => "id" in e, { message: () => "patch row must carry an id" })), g = p.Union(p.Struct({
-	op: p.Literal("add"),
-	path: p.String,
-	value: h
-}), p.Struct({
-	op: p.Literal("replace"),
-	path: p.String,
-	value: h
-}), p.Struct({
-	op: p.Literal("remove"),
-	path: p.String
-}), p.Struct({
-	op: p.Literal("mergeCells"),
-	path: p.String,
-	value: p.Record({
-		key: p.String,
-		value: p.Unknown
+var Ge = m.Union(m.String, m.Number), g = m.Record({
+	key: m.String,
+	value: m.Unknown
+}).pipe(m.filter((e) => "id" in e, { message: () => "patch row must carry an id" })), _ = m.Union(m.Struct({
+	op: m.Literal("add"),
+	path: m.String,
+	value: g
+}), m.Struct({
+	op: m.Literal("replace"),
+	path: m.String,
+	value: g
+}), m.Struct({
+	op: m.Literal("remove"),
+	path: m.String
+}), m.Struct({
+	op: m.Literal("mergeCells"),
+	path: m.String,
+	value: m.Record({
+		key: m.String,
+		value: m.Unknown
 	})
-})), _ = p.Struct({
-	ops: p.Array(g),
-	order: p.Array(Ge)
-}), v = (e) => `/${String(e).replace(/~/g, "~0").replace(/\//g, "~1")}`, y = (e) => (e.startsWith("/") ? e.slice(1) : e).replace(/~1/g, "/").replace(/~0/g, "~"), b = (e) => {
+})), v = m.Struct({
+	ops: m.Array(_),
+	order: m.Array(Ge)
+}), y = (e) => `/${String(e).replace(/~/g, "~0").replace(/\//g, "~1")}`, b = (e) => (e.startsWith("/") ? e.slice(1) : e).replace(/~1/g, "/").replace(/~0/g, "~"), x = (e) => {
 	let t = Object.keys(e).sort(), n = {};
 	for (let r of t) n[r] = e[r];
 	return JSON.stringify(n);
-}, x = (e, t) => b(e) === b(t), Ke = (e, t) => {
+}, S = (e, t) => x(e) === x(t), Ke = (e, t) => {
 	if (e instanceof Uint8Array && t instanceof Uint8Array) {
 		if (e.length !== t.length) return !1;
 		for (let n = 0; n < e.length; n += 1) if (e[n] !== t[n]) return !1;
 		return !0;
 	}
-	return b({
+	return x({
 		id: 0,
 		v: e
-	}) === b({
+	}) === x({
 		id: 0,
 		v: t
 	});
 }, qe = (e, t, n = {}) => {
 	let r = /* @__PURE__ */ new Map();
 	for (let t of e) r.set(t.id, t);
-	let i = [], a = [], o = /* @__PURE__ */ new Set(), s = n.crdt, ee = (e, t) => {
+	let i = [], a = [], o = /* @__PURE__ */ new Set(), s = n.crdt, c = (e, t) => {
 		if (s === void 0 || s.columns.size === 0) return;
 		let n = {}, r = !1;
 		for (let i of s.columns) {
@@ -70,29 +70,29 @@ var Ge = p.Union(p.String, p.Number), h = p.Record({
 		let t = r.get(e.id);
 		if (t === void 0) i.push({
 			op: "add",
-			path: v(e.id),
+			path: y(e.id),
 			value: e
 		});
-		else if (!x(t, e)) {
-			let n = ee(t, e);
+		else if (!S(t, e)) {
+			let n = c(t, e);
 			n === void 0 ? i.push({
 				op: "replace",
-				path: v(e.id),
+				path: y(e.id),
 				value: e
-			}) : (x(Object.fromEntries(Object.entries(t).filter(([e]) => !s.columns.has(e))), n.scalars) || i.push({
+			}) : (S(Object.fromEntries(Object.entries(t).filter(([e]) => !s.columns.has(e))), n.scalars) || i.push({
 				op: "replace",
-				path: v(e.id),
+				path: y(e.id),
 				value: n.scalars
 			}), i.push({
 				op: "mergeCells",
-				path: v(e.id),
+				path: y(e.id),
 				value: n.merges
 			}));
 		}
 	}
 	for (let t of e) o.has(t.id) || i.push({
 		op: "remove",
-		path: v(t.id)
+		path: y(t.id)
 	});
 	return {
 		ops: i,
@@ -106,7 +106,7 @@ var Ge = p.Union(p.String, p.Number), h = p.Record({
 	for (let t of e) r.set(t.id, t);
 	for (let e of t.ops) {
 		if (e.op === "mergeCells") {
-			let t = y(e.path), i = r.get(t) ?? r.get(Number(t)), a = r.has(t) ? t : Number(t);
+			let t = b(e.path), i = r.get(t) ?? r.get(Number(t)), a = r.has(t) ? t : Number(t);
 			if (i === void 0) continue;
 			let o = { ...i };
 			for (let [t, r] of Object.entries(e.value)) o[t] = n.mergeCell === void 0 ? r : n.mergeCell(t, i[t], r);
@@ -121,56 +121,56 @@ var Ge = p.Union(p.String, p.Number), h = p.Record({
 		t !== void 0 && i.push(t);
 	}
 	return i;
-}, S = (e) => p.Union(p.Struct({
-	_tag: p.Literal("snapshot"),
-	revision: p.Number,
+}, C = (e) => m.Union(m.Struct({
+	_tag: m.Literal("snapshot"),
+	revision: m.Number,
 	data: e,
-	computed: p.optional(p.Boolean)
-}), p.Struct({
-	_tag: p.Literal("delta"),
-	revision: p.Number,
-	emittedAt: p.Number,
-	patch: _
-}), p.Struct({
-	_tag: p.Literal("error"),
-	error: p.Unknown,
-	revision: p.optional(p.Number)
-})), C = (e, t) => {
+	computed: m.optional(m.Boolean)
+}), m.Struct({
+	_tag: m.Literal("delta"),
+	revision: m.Number,
+	emittedAt: m.Number,
+	patch: v
+}), m.Struct({
+	_tag: m.Literal("error"),
+	error: m.Unknown,
+	revision: m.optional(m.Number)
+})), w = (e, t) => {
 	let n = `${e ?? "this procedure"} input`;
 	return t === !0 ? `${n} (guarded — the guard did NOT run: the payload failed to decode first, so this says nothing about access)` : n;
 }, Xe = (e) => {
 	let t = e.ast;
 	return t._tag === "TypeLiteral" && (t.propertySignatures?.length ?? 0) === 0 && (t.indexSignatures?.length ?? 0) === 0;
-}, w = (e, t, n) => {
-	let r = C(t, n), i = e.annotations({
+}, T = (e, t, n) => {
+	let r = w(t, n), i = e.annotations({
 		parseOptions: { onExcessProperty: "error" },
 		parseIssueTitle: () => r
 	});
-	return Xe(e) ? p.filter((e) => typeof e == "object" && e && Object.keys(e).length > 0 ? `this procedure declares no input; received: ${Object.keys(e).join(", ")}` : void 0)(i).annotations({ identifier: r }) : i;
-}, T = class extends p.TaggedError()("BusinessRuleViolation", {
-	rule: p.String,
-	params: p.optional(p.Record({
-		key: p.String,
-		value: p.Unknown
+	return Xe(e) ? m.filter((e) => typeof e == "object" && e && Object.keys(e).length > 0 ? `this procedure declares no input; received: ${Object.keys(e).join(", ")}` : void 0)(i).annotations({ identifier: r }) : i;
+}, E = class extends m.TaggedError()("BusinessRuleViolation", {
+	rule: m.String,
+	params: m.optional(m.Record({
+		key: m.String,
+		value: m.Unknown
 	})),
-	field: p.optional(p.String),
-	message: p.optional(p.String),
-	severity: p.Literal("error", "warning")
-}) {}, E = p.Struct({
-	field: p.String,
-	message: p.String,
-	params: p.optional(p.Record({
-		key: p.String,
-		value: p.Unknown
+	field: m.optional(m.String),
+	message: m.optional(m.String),
+	severity: m.Literal("error", "warning")
+}) {}, D = m.Struct({
+	field: m.String,
+	message: m.String,
+	params: m.optional(m.Record({
+		key: m.String,
+		value: m.Unknown
 	}))
-}), D = class extends p.TaggedError()("ValidationError", {
-	field: p.String,
-	message: p.String,
-	params: p.optional(p.Record({
-		key: p.String,
-		value: p.Unknown
+}), O = class extends m.TaggedError()("ValidationError", {
+	field: m.String,
+	message: m.String,
+	params: m.optional(m.Record({
+		key: m.String,
+		value: m.Unknown
 	}))
-}) {}, O = class extends p.TaggedError()("ValidationErrors", { issues: p.Array(E).pipe(p.minItems(1)) }) {}, Ze = (e) => {
+}) {}, Ze = class extends m.TaggedError()("ValidationErrors", { issues: m.Array(D).pipe(m.minItems(1)) }) {}, Qe = (e) => {
 	if (typeof e != "object" || !e) return [];
 	let t = e._tag;
 	if (t === "ValidationError") {
@@ -196,49 +196,49 @@ var Ge = p.Union(p.String, p.Number), h = p.Record({
 		}];
 	}
 	return [];
-}, Qe = class extends p.TaggedError()("ApprovalRequired", {
-	approvalId: p.String,
-	procedure: p.String,
-	expiresAt: p.String,
-	requiredScopes: p.Array(p.String),
-	reason: p.NullOr(p.String),
-	created: p.Boolean
-}) {}, $e = class extends p.TaggedError()("ApprovalNotFound", { approvalId: p.String }) {}, et = class extends p.TaggedError()("ApprovalSelfApproval", {
-	approvalId: p.String,
-	subjectId: p.NullOr(p.String)
-}) {}, tt = class extends p.TaggedError()("ApprovalRejected", {
-	approvalId: p.String,
-	decidedBy: p.NullOr(p.String),
-	note: p.NullOr(p.String)
-}) {}, k = class extends p.TaggedError()("ApprovalExpired", {
-	approvalId: p.String,
-	expiredAt: p.String
-}) {}, nt = class extends p.TaggedError()("ApprovalNotPending", {
-	approvalId: p.String,
-	status: p.String
-}) {}, rt = class extends p.TaggedError()("ApprovalForbidden", {
-	approvalId: p.String,
-	required: p.NullOr(p.String),
-	message: p.String
-}) {}, A = class extends p.TaggedError()("ApprovalUnavailable", {
-	procedure: p.String,
-	message: p.String
-}) {}, it = p.Union(Qe, tt, k, A), at = p.Union($e, et, k, nt, rt, A), ot = p.Struct({
-	id: p.String,
-	procedure: p.String,
-	kind: p.Literal("mutation", "action"),
-	requestedBy: p.NullOr(p.String),
-	status: p.Literal("pending", "approved", "rejected", "expired", "consumed"),
-	reason: p.NullOr(p.String),
-	requiredScopes: p.Array(p.String),
-	requestedAt: p.String,
-	expiresAt: p.String,
-	decidedBy: p.NullOr(p.String),
-	decidedAt: p.NullOr(p.String),
-	note: p.NullOr(p.String),
-	relation: p.Literal("to-decide", "requested")
-}), j = "channel:", st = Symbol.for("@voltro/protocol/reactivityChannels"), ct = globalThis, M = ct[st] ?? (ct[st] = /* @__PURE__ */ new Map()), lt = /^[a-z][a-z0-9-]*(\.[a-z0-9-]+)*$/, ut = (e) => {
-	if (!lt.test(e)) throw Error(`reactivityChannel('${e}'): invalid channel name.\n  Use lowercase kebab segments separated by dots — \`presence\`, \`job-queue\`,
+}, $e = class extends m.TaggedError()("ApprovalRequired", {
+	approvalId: m.String,
+	procedure: m.String,
+	expiresAt: m.String,
+	requiredScopes: m.Array(m.String),
+	reason: m.NullOr(m.String),
+	created: m.Boolean
+}) {}, et = class extends m.TaggedError()("ApprovalNotFound", { approvalId: m.String }) {}, tt = class extends m.TaggedError()("ApprovalSelfApproval", {
+	approvalId: m.String,
+	subjectId: m.NullOr(m.String)
+}) {}, nt = class extends m.TaggedError()("ApprovalRejected", {
+	approvalId: m.String,
+	decidedBy: m.NullOr(m.String),
+	note: m.NullOr(m.String)
+}) {}, k = class extends m.TaggedError()("ApprovalExpired", {
+	approvalId: m.String,
+	expiredAt: m.String
+}) {}, rt = class extends m.TaggedError()("ApprovalNotPending", {
+	approvalId: m.String,
+	status: m.String
+}) {}, it = class extends m.TaggedError()("ApprovalForbidden", {
+	approvalId: m.String,
+	required: m.NullOr(m.String),
+	message: m.String
+}) {}, A = class extends m.TaggedError()("ApprovalUnavailable", {
+	procedure: m.String,
+	message: m.String
+}) {}, at = m.Union($e, nt, k, A), ot = m.Union(et, tt, k, rt, it, A), st = m.Struct({
+	id: m.String,
+	procedure: m.String,
+	kind: m.Literal("mutation", "action"),
+	requestedBy: m.NullOr(m.String),
+	status: m.Literal("pending", "approved", "rejected", "expired", "consumed"),
+	reason: m.NullOr(m.String),
+	requiredScopes: m.Array(m.String),
+	requestedAt: m.String,
+	expiresAt: m.String,
+	decidedBy: m.NullOr(m.String),
+	decidedAt: m.NullOr(m.String),
+	note: m.NullOr(m.String),
+	relation: m.Literal("to-decide", "requested")
+}), j = "channel:", ct = Symbol.for("@voltro/protocol/reactivityChannels"), lt = globalThis, M = lt[ct] ?? (lt[ct] = /* @__PURE__ */ new Map()), ut = /^[a-z][a-z0-9-]*(\.[a-z0-9-]+)*$/, dt = (e) => {
+	if (!ut.test(e)) throw Error(`reactivityChannel('${e}'): invalid channel name.\n  Use lowercase kebab segments separated by dots — \`presence\`, \`job-queue\`,
   \`billing.usage\`. A \`:\` is refused because it is the namespace separator in
   the routing key (\`${j}<name>\`), and an uppercase letter is\n  refused because a key that differs only by case reads as one channel and
   routes as two.`);
@@ -251,14 +251,14 @@ var Ge = p.Union(p.String, p.Number), h = p.Record({
 		toString: () => n
 	});
 	return M.set(e, r), r;
-}, dt = (e) => typeof e == "object" && !!e && e.kind === "reactivity-channel", ft = (e) => e.startsWith(j), pt = () => new Set([...M.values()].map((e) => e.key)), N = (e) => dt(e) ? e.key : e, mt = (e) => e === void 0 ? [] : Array.isArray(e) ? e.map(N) : [N(e)], ht = (e) => e === void 0 ? void 0 : Array.isArray(e) ? e.map(N) : N(e), gt = (e) => {
-	let t = pt(), n = [];
-	for (let r of e) for (let e of mt(r.source)) !ft(e) || t.has(e) || n.push({
+}, ft = (e) => typeof e == "object" && !!e && e.kind === "reactivity-channel", pt = (e) => e.startsWith(j), mt = () => new Set([...M.values()].map((e) => e.key)), N = (e) => ft(e) ? e.key : e, ht = (e) => e === void 0 ? [] : Array.isArray(e) ? e.map(N) : [N(e)], gt = (e) => e === void 0 ? void 0 : Array.isArray(e) ? e.map(N) : N(e), _t = (e) => {
+	let t = mt(), n = [];
+	for (let r of e) for (let e of ht(r.source)) !pt(e) || t.has(e) || n.push({
 		procedure: r.name,
 		key: e
 	});
 	return n;
-}, _t = (e, t) => {
+}, vt = (e, t) => {
 	let n = e?.injectExternalChange;
 	return n !== void 0 && (n.call(e, {
 		table: t.key,
@@ -267,8 +267,8 @@ var Ge = p.Union(p.String, p.Number), h = p.Record({
 		old: {},
 		origin: "inline"
 	}), !0);
-}, vt = (e) => e.internal !== !0, P = (e) => {
-	if (yt(e), Array.isArray(e.guards) && e.guards.length === 0) throw Error(`${e.name}: \`guards: []\` is empty, so it enforces nothing — but it reads\n  at the call site as if this procedure were protected. Omit the field for an
+}, yt = (e) => e.internal !== !0, P = (e) => {
+	if (bt(e), Array.isArray(e.guards) && e.guards.length === 0) throw Error(`${e.name}: \`guards: []\` is empty, so it enforces nothing — but it reads\n  at the call site as if this procedure were protected. Omit the field for an
   unguarded procedure, or list the scopes required to call it.`);
 	let t = typeof e.source == "string" ? [e.source] : Array.isArray(e.source) ? e.source : void 0;
 	if (t !== void 0 && (t.length === 0 || t.some((e) => String(e).trim() === ""))) throw Error(`${e.name}: \`source\` is empty, so this query declares reactivity and\n  subscribes to nothing — it serves one snapshot and never updates again,
@@ -285,7 +285,7 @@ var Ge = p.Union(p.String, p.Number), h = p.Record({
 	let n = [e.publicApi === void 0 ? void 0 : "publicApi", e.exposeAsTool === void 0 ? void 0 : "exposeAsTool"].filter((e) => e !== void 0);
 	if (n.length === 0) return e;
 	throw Error(`${e.name}: \`internal: true\` cannot be combined with ${n.map((e) => `\`${e}\``).join(" or ")}. \`internal\` takes the procedure OFF the wire; those put it back ON a different one (${n.includes("publicApi") ? "a REST route" : "an agent tool"}), and that surface is projected without consulting the flag — so the procedure would be unreachable from your client and reachable from the internet. Drop \`internal: true\` if the wider surface is intended, or remove the ${n.join(" / ")} annotation if it is not.`);
-}, yt = (e) => {
+}, bt = (e) => {
 	let t = e.requiresApproval;
 	if (t !== void 0) {
 		if (!Array.isArray(t.approvers) || t.approvers.length === 0) throw Error(`${e.name}: \`requiresApproval.approvers\` is empty, so NOBODY can approve this\n  procedure and every call would park forever. Name the scope(s) an approver must hold
@@ -295,20 +295,20 @@ var Ge = p.Union(p.String, p.Number), h = p.Record({
   human from every other, and the second-pair-of-eyes control would enforce nothing.
   Give the procedure a \`guards:\` decision, or drop \`requiresApproval\`.`);
 	}
-}, bt = (e) => e.action !== void 0 && e.resourceType !== void 0, xt = (e) => e.openAccess !== void 0 || e.guards !== void 0 && e.guards.length > 0, F = (e, t, n) => {
+}, xt = (e) => e.action !== void 0 && e.resourceType !== void 0, St = (e) => e.authenticated === !0, Ct = (e) => e.openAccess !== void 0 || e.guards !== void 0 && e.guards.length > 0, F = (e, t, n) => {
 	if (n === void 0) return t;
 	if (n.trim() === "") throw Error(`${e}: \`openAccess\` needs a REASON, not an empty string. It is the sentence a\n  reviewer reads to decide whether this procedure should really be callable
   without an authorization check — e.g. \`openAccess: 'public pricing, no caller data'\`.`);
 	if (t !== void 0 && t.length > 0) throw Error(`${e}: \`openAccess\` and \`guards\` are two different access decisions, so\n  declaring both says the procedure is protected AND open. Keep the guards if a
   caller must hold a scope; drop them if anyone may call it.`);
-	return [d(n.trim())];
+	return [f(n.trim())];
 }, I = (e) => P({
 	kind: "query",
 	name: e.name,
 	input: e.input,
 	output: e.output,
-	error: e.error ?? p.Never,
-	source: ht(e.source),
+	error: e.error ?? m.Never,
+	source: gt(e.source),
 	cache: e.cache,
 	guards: F(e.name, e.guards, e.openAccess),
 	openAccess: e.openAccess,
@@ -321,7 +321,7 @@ var Ge = p.Union(p.String, p.Number), h = p.Record({
 	name: e.name,
 	input: e.input,
 	output: e.output,
-	error: e.error ?? p.Never,
+	error: e.error ?? m.Never,
 	target: e.target,
 	guards: F(e.name, e.guards, e.openAccess),
 	openAccess: e.openAccess,
@@ -335,7 +335,7 @@ var Ge = p.Union(p.String, p.Number), h = p.Record({
 	name: e.name,
 	input: e.input,
 	output: e.output,
-	error: e.error ?? p.Never,
+	error: e.error ?? m.Never,
 	guards: F(e.name, e.guards, e.openAccess),
 	openAccess: e.openAccess,
 	source: e.source,
@@ -345,53 +345,53 @@ var Ge = p.Union(p.String, p.Number), h = p.Record({
 	requiresApproval: e.requiresApproval,
 	internal: e.internal,
 	overridesPlugin: e.overridesPlugin
-}), St = (e) => P({
+}), wt = (e) => P({
 	kind: "stream",
 	name: e.name,
 	input: e.input,
 	element: e.element,
-	error: e.error ?? p.Never,
+	error: e.error ?? m.Never,
 	internal: e.internal,
 	overridesPlugin: e.overridesPlugin,
 	guards: F(e.name, e.guards, e.openAccess),
 	openAccess: e.openAccess
-}), z = (e, t) => t && t.length > 0 ? p.Union(e, ...t) : e, B = (e) => e !== void 0 && e.some((e) => !u(e)), Ct = (e, t) => B(t) ? p.Union(e, l, c) : e, wt = (e) => p.Union(e, T), Tt = (e) => p.Union(e, D, O), Et = (e, t) => t === void 0 ? e : p.Union(e, it), V = (e, t) => {
+}), z = (e, t) => t && t.length > 0 ? m.Union(e, ...t) : e, B = (e) => e !== void 0 && e.some((e) => !d(e)), V = (e, t) => B(t) ? m.Union(e, u, l) : e, Tt = (e) => m.Union(e, E), Et = (e) => m.Union(e, O, Ze), Dt = (e, t) => t === void 0 ? e : m.Union(e, at), H = (e, t) => {
 	if (t === "stream") return e.error;
-	let n = Ct(e.error, e.guards);
-	return t === "query" ? n : Et(Tt(t === "mutation" ? p.Union(wt(n), f, We) : n), e.requiresApproval);
-}, Dt = (e, t) => z(Ct(e.errorSchema, e.guards), t), Ot = (e, t) => ({
+	let n = V(e.error, e.guards);
+	return t === "query" ? n : Dt(Et(t === "mutation" ? m.Union(Tt(n), p, We) : n), e.requiresApproval);
+}, Ot = (e, t) => z(V(e.errorSchema, e.guards), t), kt = (e, t) => ({
 	...e,
 	name: t
-}), kt = (e, t) => m.make(e.name, {
-	payload: w(e.input, e.name, B(e.guards)),
-	success: S(e.output),
-	error: z(V(e, "query"), t),
+}), At = (e, t) => h.make(e.name, {
+	payload: T(e.input, e.name, B(e.guards)),
+	success: C(e.output),
+	error: z(H(e, "query"), t),
 	stream: !0
-}), At = (e, t) => m.make(e.name, {
-	payload: w(e.input, e.name, B(e.guards)),
+}), jt = (e, t) => h.make(e.name, {
+	payload: T(e.input, e.name, B(e.guards)),
 	success: e.output,
-	error: z(V(e, "mutation"), t)
-}), jt = (e, t) => m.make(e.name, {
-	payload: w(e.input, e.name, B(e.guards)),
+	error: z(H(e, "mutation"), t)
+}), Mt = (e, t) => h.make(e.name, {
+	payload: T(e.input, e.name, B(e.guards)),
 	success: e.output,
-	error: z(V(e, "action"), t)
-}), Mt = (e, t) => m.make(e.name, {
-	payload: w(e.input, e.name, B(e.guards)),
+	error: z(H(e, "action"), t)
+}), Nt = (e, t) => h.make(e.name, {
+	payload: T(e.input, e.name, B(e.guards)),
 	success: e.element,
 	error: z(e.error, t),
 	stream: !0
-}), Nt = (e) => {
+}), Pt = (e) => {
 	if (typeof e != "object" || !e) return;
 	let t = e._tag;
 	return typeof t == "string" ? t : void 0;
-}, Pt = (e) => {
+}, Ft = (e) => {
 	switch (e.kind) {
-		case "query": return kt(e);
-		case "mutation": return At(e);
-		case "action": return jt(e);
-		case "stream": return Mt(e);
+		case "query": return At(e);
+		case "mutation": return jt(e);
+		case "action": return Mt(e);
+		case "stream": return Nt(e);
 	}
-}, Ft = (e) => {
+}, It = (e) => {
 	let t = e.input, n = t === void 0 ? {} : { input: t }, r = e.output, i = r === void 0 ? {} : { output: r };
 	if (e.kind === "query") return {
 		kind: "query",
@@ -433,7 +433,7 @@ var Ge = p.Union(p.String, p.Number), h = p.Record({
 			..."relations" in e && e.relations !== void 0 ? { relations: e.relations } : {}
 		}))
 	};
-}, It = 7500, Lt = (e) => typeof e == "object" && !!e && e.kind === "event", Rt = (e) => {
+}, Lt = 7500, Rt = (e) => typeof e == "object" && !!e && e.kind === "event", zt = (e) => {
 	if (e.name.length === 0) throw Error("defineEvent: `name` must not be empty");
 	if (/\s/.test(e.name)) throw Error(`defineEvent("${e.name}"): \`name\` must not contain whitespace.\n  The name is used as a broker subject segment. NATS refuses a subject with
   whitespace and delivers nothing — silently, and only on that broker, so an
@@ -462,66 +462,66 @@ var Ge = p.Union(p.String, p.Number), h = p.Record({
 		name: e.name,
 		key: e.key,
 		payload: e.payload,
-		guards: e.openAccess === void 0 ? e.guards : [d(e.openAccess.trim())],
+		guards: e.openAccess === void 0 ? e.guards : [f(e.openAccess.trim())],
 		openAccess: e.openAccess,
 		rewind: e.rewind,
 		webhook: e.webhook,
 		delivery: e.delivery
 	};
-}, zt = (e) => p.Struct({
-	_tag: p.Literal("event"),
-	origin: p.String,
-	n: p.Number,
-	emittedAt: p.Number,
+}, Bt = (e) => m.Struct({
+	_tag: m.Literal("event"),
+	origin: m.String,
+	n: m.Number,
+	emittedAt: m.Number,
 	payload: e
-}), Bt = p.Struct({
-	_tag: p.Literal("gap"),
-	missed: p.Number,
-	reason: p.Literal("buffer", "resume")
-}), Vt = p.Struct({ _tag: p.Literal("attached") }), Ht = (e) => p.Union(Vt, zt(e), Bt), Ut = p.Struct({
-	origin: p.String,
-	n: p.Number
-}), Wt = (e) => p.Struct({
+}), Vt = m.Struct({
+	_tag: m.Literal("gap"),
+	missed: m.Number,
+	reason: m.Literal("buffer", "resume")
+}), Ht = m.Struct({ _tag: m.Literal("attached") }), Ut = (e) => m.Union(Ht, Bt(e), Vt), Wt = m.Struct({
+	origin: m.String,
+	n: m.Number
+}), Gt = (e) => m.Struct({
 	key: e,
-	resume: p.optional(p.Array(Ut))
-}), Gt = (e, t) => {
-	let n = e.guards !== void 0 && e.guards.some((e) => !u(e)) ? p.Union(l, c) : p.Never, r = t && t.length > 0 ? p.Union(n, ...t) : n;
-	return m.make(e.name, {
-		payload: w(Wt(e.key), e.name, B(e.guards)),
-		success: Ht(e.payload),
+	resume: m.optional(m.Array(Wt))
+}), Kt = (e, t) => {
+	let n = e.guards !== void 0 && e.guards.some((e) => !d(e)) ? m.Union(u, l) : m.Never, r = t && t.length > 0 ? m.Union(n, ...t) : n;
+	return h.make(e.name, {
+		payload: T(Gt(e.key), e.name, B(e.guards)),
+		success: Ut(e.payload),
 		error: r,
 		stream: !0
 	});
-}, Kt = class extends p.TaggedError()("EventPayloadInvalid", {
-	event: p.String,
-	message: p.String
-}) {}, qt = class extends p.TaggedError()("EventKeyInvalid", {
-	event: p.String,
-	message: p.String
-}) {}, Jt = class extends p.TaggedError()("EventPayloadTooLarge", {
-	event: p.String,
-	bytes: p.Number,
-	limit: p.Number
-}) {}, Yt = (e) => {
+}, qt = class extends m.TaggedError()("EventPayloadInvalid", {
+	event: m.String,
+	message: m.String
+}) {}, Jt = class extends m.TaggedError()("EventKeyInvalid", {
+	event: m.String,
+	message: m.String
+}) {}, Yt = class extends m.TaggedError()("EventPayloadTooLarge", {
+	event: m.String,
+	bytes: m.Number,
+	limit: m.Number
+}) {}, Xt = (e) => {
 	if (typeof e != "object" || !e) return JSON.stringify(e) ?? "null";
 	let t = Object.entries(e).filter(([, e]) => e !== void 0).sort(([e], [t]) => e < t ? -1 : +(e > t));
 	return JSON.stringify(t);
-}, Xt = "\0", Zt = (e, t, n) => [
+}, Zt = "\0", Qt = (e, t, n) => [
 	e ?? "~",
 	t,
-	Yt(n)
-].join("\0"), Qt = (e) => {
+	Xt(n)
+].join("\0"), $t = (e) => {
 	let [t = "~", n = "", r = ""] = e.split("\0");
 	return {
 		tenantId: t === "~" ? null : t,
 		event: n,
 		key: r
 	};
-}, $t = (e) => e.split("\0").join(" · "), H = Symbol.for("@voltro/protocol/workflow-access"), en = {
+}, en = (e) => e.split("\0").join(" · "), U = Symbol.for("@voltro/protocol/workflow-access"), tn = {
 	guards: void 0,
 	openAccess: void 0,
 	internal: !1
-}, tn = (e, t) => {
+}, nn = (e, t) => {
 	let n = t.guards;
 	if (n !== void 0 && n.length === 0) throw Error(`workflow("${e}"): \`guards: []\` is empty, so it enforces nothing —\n  but it reads at the call site as if the start were protected. Omit the field
   and decide with \`openAccess\` or \`internal\`, or list the scopes that may start it.`);
@@ -537,41 +537,41 @@ var Ge = p.Union(p.String, p.Number), h = p.Record({
   \`internal: true\` if the workflow really is meant to be startable by clients.`);
 	}
 	return {
-		guards: t.openAccess === void 0 ? t.guards : [d(t.openAccess.trim())],
+		guards: t.openAccess === void 0 ? t.guards : [f(t.openAccess.trim())],
 		openAccess: t.openAccess?.trim(),
 		internal: t.internal === !0
 	};
-}, nn = (e, t) => {
-	Object.defineProperty(e, H, {
+}, rn = (e, t) => {
+	Object.defineProperty(e, U, {
 		value: t,
 		enumerable: !1
 	});
-}, U = (e) => {
-	if (typeof e != "object" || !e) return en;
-	let t = e[H];
-	return t === void 0 ? en : t;
-}, rn = (e) => {
-	let t = U(e);
+}, W = (e) => {
+	if (typeof e != "object" || !e) return tn;
+	let t = e[U];
+	return t === void 0 ? tn : t;
+}, an = (e) => {
+	let t = W(e);
 	return {
 		name: e.name,
 		internal: t.internal,
 		guards: t.guards,
 		openAccess: t.openAccess
 	};
-}, an = (e) => e, on = (e) => e, sn = (e) => {
+}, on = (e) => e, sn = (e) => e, cn = (e) => {
 	let t = e.alias?.trim(), n = e.instance?.trim(), r = t !== void 0 && t !== "" ? t : e.base;
 	return n !== void 0 && n !== "" ? `${r}#${n}` : r;
-}, cn = (e) => {
+}, ln = (e) => {
 	if (e.length !== 0) return (t, n) => e.reduceRight((e, t) => t(e, n), t);
-}, ln = (e, t) => {
+}, un = (e, t) => {
 	let n = He.GenericTag(e);
 	return {
 		Tag: n,
 		Live: Ue.succeed(n, t)
 	};
-}, un = (e, t, n) => {
+}, dn = (e, t, n) => {
 	if (!t) return { ok: !0 };
-	let r = n === void 0 ? null : W(n);
+	let r = n === void 0 ? null : G(n);
 	if (!r) return {
 		ok: !0,
 		unverified: `plugin "${e}" requires framework ${t}, but the running framework version is ${n === void 0 ? "unknown" : `unreadable ("${n}")`} — not checked.`
@@ -579,12 +579,12 @@ var Ge = p.Union(p.String, p.Number), h = p.Record({
 	let i = t.trim();
 	if (i === "*" || i === "") return { ok: !0 };
 	let a = i.split(/\s+/).filter((e) => e.length > 0);
-	for (let i of a) if (!dn(i, r)) return {
+	for (let i of a) if (!fn(i, r)) return {
 		ok: !1,
 		reason: `plugin "${e}" requires framework ${t}, running ${n}`
 	};
 	return { ok: !0 };
-}, W = (e) => {
+}, G = (e) => {
 	let t = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9a-zA-Z.-]+))?$/.exec(e.trim());
 	return t ? {
 		major: Number(t[1]),
@@ -592,266 +592,273 @@ var Ge = p.Union(p.String, p.Number), h = p.Record({
 		patch: Number(t[3]),
 		pre: t[4] ?? ""
 	} : null;
-}, G = (e, t) => e.major === t.major ? e.minor === t.minor ? e.patch === t.patch ? e.pre && !t.pre ? -1 : !e.pre && t.pre ? 1 : e.pre && t.pre ? e.pre < t.pre ? -1 : +(e.pre > t.pre) : 0 : e.patch - t.patch : e.minor - t.minor : e.major - t.major, dn = (e, t) => {
+}, K = (e, t) => e.major === t.major ? e.minor === t.minor ? e.patch === t.patch ? e.pre && !t.pre ? -1 : !e.pre && t.pre ? 1 : e.pre && t.pre ? e.pre < t.pre ? -1 : +(e.pre > t.pre) : 0 : e.patch - t.patch : e.minor - t.minor : e.major - t.major, fn = (e, t) => {
 	if (e === "*") return !0;
 	if (e.startsWith("^")) {
-		let n = W(e.slice(1));
-		return !n || t.major !== n.major ? !1 : G(t, n) >= 0;
+		let n = G(e.slice(1));
+		return !n || t.major !== n.major ? !1 : K(t, n) >= 0;
 	}
 	if (e.startsWith("~")) {
-		let n = W(e.slice(1));
-		return !n || t.major !== n.major || t.minor !== n.minor ? !1 : G(t, n) >= 0;
+		let n = G(e.slice(1));
+		return !n || t.major !== n.major || t.minor !== n.minor ? !1 : K(t, n) >= 0;
 	}
 	let n = /^(>=|<=|>|<)(.+)$/.exec(e);
 	if (n) {
-		let e = n[1], r = W(n[2]);
+		let e = n[1], r = G(n[2]);
 		if (!r) return !1;
-		let i = G(t, r);
+		let i = K(t, r);
 		if (e === ">=") return i >= 0;
 		if (e === "<=") return i <= 0;
 		if (e === ">") return i > 0;
 		if (e === "<") return i < 0;
 	}
-	let r = W(e);
-	return r ? G(t, r) === 0 : !1;
-}, fn = (e) => {
+	let r = G(e);
+	return r ? K(t, r) === 0 : !1;
+}, pn = (e) => {
 	let t = e.startsWith("@") ? e.replace(/^@[^/]+\//, "") : e;
 	return (t.startsWith("plugin-") ? t.slice(7) : t).replace(/-([a-zA-Z0-9])/g, (e, t) => t.toUpperCase());
-}, pn = (e) => {
+}, mn = (e) => {
 	let t = e.startsWith("@") ? e.replace(/^@[^/]+\//, "") : e;
 	return (t.startsWith("plugin-") ? t.slice(7) : t).replace(/#/g, "--").replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
-}, mn = Symbol.for("@voltro/protocol/pluginAliases"), K = () => {
-	let e = globalThis, t = e[mn];
+}, hn = Symbol.for("@voltro/protocol/pluginAliases"), q = () => {
+	let e = globalThis, t = e[hn];
 	if (t instanceof Map) return t;
 	let n = /* @__PURE__ */ new Map();
-	return e[mn] = n, n;
-}, hn = (e) => {
-	let t = K();
+	return e[hn] = n, n;
+}, gn = (e) => {
+	let t = q();
 	for (let [n, r] of Object.entries(e)) {
 		if (r === "") continue;
 		let e = t.get(n);
 		e === void 0 ? t.set(n, /* @__PURE__ */ new Set([r])) : e.add(r);
 	}
-}, gn = () => {
-	K().clear();
-}, _n = (e, t) => {
-	let n = K().get(e);
-	if (n === void 0 || n.size === 0) return `${fn(e)}.${t}`;
+}, _n = () => {
+	q().clear();
+}, vn = (e, t) => {
+	let n = q().get(e);
+	if (n === void 0 || n.size === 0) return `${pn(e)}.${t}`;
 	if (n.size === 1) return `${[...n][0]}.${t}`;
 	let r = [...n].filter((e) => !e.includes("#"));
 	if (r.length === 1) return `${r[0]}.${t}`;
 	throw Error(`[voltro] ${e} is installed more than once (${[...n].sort().join(", ")}) and no single install is the primary one, so a plugin hook cannot tell which of them it addresses. Call the route by its full tag instead — e.g. useSubscription(api, '${[...n].sort()[0]}.${t}').`);
-}, q = p.Literal("running", "succeeded", "failed", "cancelled", "suspended"), vn = p.Literal("cancel", "terminate", "abandon"), yn = p.Struct({
-	mode: p.String,
-	dueAt: p.NullOr(p.Number),
-	retryAfterMs: p.NullOr(p.Number),
-	intentId: p.NullOr(p.String)
-}), bn = p.Struct({
-	id: p.String,
-	workflowName: p.String,
-	executionId: p.NullOr(p.String),
-	status: p.Literal("running", "queued", "dropped", "skipped", "replayed"),
-	deferral: p.optional(yn)
-}), xn = (e, t) => {
-	let n = U(e);
-	return m.make(e.name, {
-		payload: w(e.payloadSchema, e.name, B(n.guards)),
-		success: bn,
-		error: Dt({
+}, J = m.Literal("running", "succeeded", "failed", "cancelled", "suspended"), yn = m.Literal("cancel", "terminate", "abandon"), bn = m.Struct({
+	mode: m.String,
+	dueAt: m.NullOr(m.Number),
+	retryAfterMs: m.NullOr(m.Number),
+	intentId: m.NullOr(m.String)
+}), xn = m.Struct({
+	id: m.String,
+	workflowName: m.String,
+	executionId: m.NullOr(m.String),
+	status: m.Literal("running", "queued", "dropped", "skipped", "replayed"),
+	deferral: m.optional(bn)
+}), Sn = (e, t) => {
+	let n = W(e);
+	return h.make(e.name, {
+		payload: T(e.payloadSchema, e.name, B(n.guards)),
+		success: xn,
+		error: Ot({
 			errorSchema: e.errorSchema,
 			guards: n.guards
 		}, t)
 	});
-}, J = p.Struct({
-	id: p.String,
-	tag: p.String,
-	executionId: p.String,
-	status: q,
-	payload: p.Unknown,
-	workflowVersion: p.NullOr(p.String),
-	workflowPatches: p.NullOr(p.Unknown),
-	output: p.NullOr(p.Unknown),
-	subject: p.NullOr(p.Unknown),
-	source: p.NullOr(p.String),
-	errorTag: p.NullOr(p.String),
-	errorMessage: p.NullOr(p.String),
-	cancelled: p.Boolean,
-	startedAt: p.Date,
-	completedAt: p.NullOr(p.Date),
-	durationMs: p.NullOr(p.Number),
-	traceId: p.NullOr(p.String),
-	parentExecutionId: p.NullOr(p.String),
-	parentClosePolicy: p.NullOr(vn)
-}), Sn = p.Struct({
-	tag: p.optional(p.String),
-	status: p.optional(q),
-	limit: p.optional(p.Number)
-}), Cn = p.Struct({
-	id: p.String,
-	runId: p.String,
-	stepName: p.String,
-	attempt: p.Number,
-	status: p.Literal("running", "succeeded", "failed"),
-	input: p.NullOr(p.Unknown),
-	retryPolicy: p.NullOr(p.Unknown),
-	output: p.NullOr(p.Unknown),
-	errorTag: p.NullOr(p.String),
-	errorMessage: p.NullOr(p.String),
-	errorCause: p.NullOr(p.Unknown),
-	startedAt: p.Date,
-	completedAt: p.NullOr(p.Date),
-	durationMs: p.NullOr(p.Number)
-}), wn = p.Struct({
-	id: p.String,
-	runId: p.String,
-	eventType: p.String,
-	payload: p.NullOr(p.Unknown),
-	occurredAt: p.Date,
-	stepName: p.NullOr(p.String),
-	attempt: p.NullOr(p.Number)
-}), Tn = p.Struct({
-	id: p.String,
-	name: p.String,
-	payload: p.Unknown,
-	source: p.String,
-	subject: p.NullOr(p.Unknown),
-	traceId: p.NullOr(p.String),
-	occurredAt: p.Date
-}), En = p.Struct({
-	id: p.String,
-	eventId: p.String,
-	eventName: p.String,
-	triggerId: p.String,
-	workflowName: p.String,
-	executionId: p.NullOr(p.String),
-	status: p.Literal("starting", "started", "skipped", "failed"),
-	idempotencyKey: p.String,
-	skipped: p.Boolean,
-	errorMessage: p.NullOr(p.String),
-	createdAt: p.Date,
-	completedAt: p.NullOr(p.Date)
-}), Dn = p.Struct({ id: p.String }), Y = p.Struct({ runId: p.String }), On = p.Struct({
-	name: p.optional(p.String),
-	limit: p.optional(p.Number)
-}), kn = p.Struct({ eventId: p.String }), X = p.Struct({
-	workflowName: p.String,
-	executionId: p.String
-}), An = p.Struct({
-	id: p.String,
-	signalName: p.String,
-	payload: p.optional(p.Unknown)
-}), jn = p.Struct({
-	id: p.String,
-	updateName: p.String,
-	payload: p.optional(p.Unknown),
-	timeoutMs: p.optional(p.Number)
-}), Mn = p.Struct({
-	eventId: p.String,
-	updateId: p.String,
-	completedEventId: p.String,
-	result: p.Unknown
-}), Nn = I({
+}, Y = m.Struct({
+	id: m.String,
+	tag: m.String,
+	executionId: m.String,
+	status: J,
+	payload: m.Unknown,
+	workflowVersion: m.NullOr(m.String),
+	workflowPatches: m.NullOr(m.Unknown),
+	output: m.NullOr(m.Unknown),
+	subject: m.NullOr(m.Unknown),
+	source: m.NullOr(m.String),
+	errorTag: m.NullOr(m.String),
+	errorMessage: m.NullOr(m.String),
+	cancelled: m.Boolean,
+	startedAt: m.Date,
+	completedAt: m.NullOr(m.Date),
+	durationMs: m.NullOr(m.Number),
+	traceId: m.NullOr(m.String),
+	parentExecutionId: m.NullOr(m.String),
+	parentClosePolicy: m.NullOr(yn)
+}), Cn = m.Struct({
+	tag: m.optional(m.String),
+	status: m.optional(J),
+	limit: m.optional(m.Number)
+}), wn = m.Struct({
+	id: m.String,
+	runId: m.String,
+	stepName: m.String,
+	attempt: m.Number,
+	status: m.Literal("running", "succeeded", "failed"),
+	input: m.NullOr(m.Unknown),
+	retryPolicy: m.NullOr(m.Unknown),
+	output: m.NullOr(m.Unknown),
+	errorTag: m.NullOr(m.String),
+	errorMessage: m.NullOr(m.String),
+	errorCause: m.NullOr(m.Unknown),
+	startedAt: m.Date,
+	completedAt: m.NullOr(m.Date),
+	durationMs: m.NullOr(m.Number)
+}), Tn = m.Struct({
+	id: m.String,
+	runId: m.String,
+	eventType: m.String,
+	payload: m.NullOr(m.Unknown),
+	occurredAt: m.Date,
+	stepName: m.NullOr(m.String),
+	attempt: m.NullOr(m.Number)
+}), En = m.Struct({
+	id: m.String,
+	name: m.String,
+	payload: m.Unknown,
+	source: m.String,
+	subject: m.NullOr(m.Unknown),
+	traceId: m.NullOr(m.String),
+	occurredAt: m.Date
+}), Dn = m.Struct({
+	id: m.String,
+	eventId: m.String,
+	eventName: m.String,
+	triggerId: m.String,
+	workflowName: m.String,
+	executionId: m.NullOr(m.String),
+	status: m.Literal("starting", "started", "skipped", "failed"),
+	idempotencyKey: m.String,
+	skipped: m.Boolean,
+	errorMessage: m.NullOr(m.String),
+	createdAt: m.Date,
+	completedAt: m.NullOr(m.Date)
+}), On = m.Struct({ id: m.String }), X = m.Struct({ runId: m.String }), kn = m.Struct({
+	name: m.optional(m.String),
+	limit: m.optional(m.Number)
+}), An = m.Struct({ eventId: m.String }), Z = m.Struct({
+	workflowName: m.String,
+	executionId: m.String
+}), jn = m.Struct({
+	id: m.String,
+	signalName: m.String,
+	payload: m.optional(m.Unknown)
+}), Mn = m.Struct({
+	id: m.String,
+	updateName: m.String,
+	payload: m.optional(m.Unknown),
+	timeoutMs: m.optional(m.Number)
+}), Nn = m.Struct({
+	eventId: m.String,
+	updateId: m.String,
+	completedEventId: m.String,
+	result: m.Unknown
+}), Pn = I({
 	name: "__voltro.workflow.run",
 	source: "_voltro_workflow_runs",
-	input: Dn,
-	output: p.Array(J)
-}), Pn = I({
+	input: On,
+	output: m.Array(Y)
+}), Fn = I({
 	name: "__voltro.workflow.runs",
 	source: "_voltro_workflow_runs",
-	input: Sn,
-	output: p.Array(J)
-}), Fn = I({
+	input: Cn,
+	output: m.Array(Y)
+}), In = I({
 	name: "__voltro.workflow.run.steps",
 	source: "_voltro_workflow_run_steps",
-	input: Y,
-	output: p.Array(Cn)
-}), In = I({
+	input: X,
+	output: m.Array(wn)
+}), Ln = I({
 	name: "__voltro.workflow.run.events",
 	source: "_voltro_workflow_run_events",
-	input: Y,
-	output: p.Array(wn)
-}), Ln = I({
+	input: X,
+	output: m.Array(Tn)
+}), Rn = I({
 	name: "__voltro.workflow.domainEvents",
 	source: "_voltro_workflow_events",
-	input: On,
-	output: p.Array(Tn)
-}), Rn = I({
+	input: kn,
+	output: m.Array(En)
+}), zn = I({
 	name: "__voltro.workflow.event.deliveries",
 	source: "_voltro_workflow_event_deliveries",
-	input: kn,
-	output: p.Array(En)
-}), zn = R({
-	name: "__voltro.workflow.cancel",
-	input: X,
-	output: p.Struct({ ok: p.Boolean })
+	input: An,
+	output: m.Array(Dn)
 }), Bn = R({
-	name: "__voltro.workflow.resume",
-	input: X,
-	output: p.Struct({ ok: p.Boolean })
+	name: "__voltro.workflow.cancel",
+	input: Z,
+	output: m.Struct({ ok: m.Boolean })
 }), Vn = R({
-	name: "__voltro.workflow.signal",
-	input: An,
-	output: p.Struct({ eventId: p.String })
+	name: "__voltro.workflow.resume",
+	input: Z,
+	output: m.Struct({ ok: m.Boolean })
 }), Hn = R({
-	name: "__voltro.workflow.update",
+	name: "__voltro.workflow.signal",
 	input: jn,
-	output: Mn
-}), Un = "__voltro.undo.log", Wn = "__voltro.undo.apply", Gn = "__voltro.undo.redo", Kn = p.Struct({
-	id: p.String,
-	tag: p.String,
-	label: p.NullOr(p.String),
-	undone: p.Boolean,
-	crossesAction: p.Boolean,
-	createdAt: p.String
-}), qn = class extends p.TaggedError()("UndoNotFound", { invocationId: p.String }) {}, Jn = class extends p.TaggedError()("UndoForbidden", { invocationId: p.String }) {}, Yn = class extends p.TaggedError()("UndoConflict", {
-	invocationId: p.String,
-	reason: p.Literal("conflict", "action")
-}) {}, Xn = p.Union(qn, Jn, Yn), Zn = I({
-	name: Un,
+	output: m.Struct({ eventId: m.String })
+}), Un = R({
+	name: "__voltro.workflow.update",
+	input: Mn,
+	output: Nn
+}), Wn = "__voltro.undo.log", Gn = "__voltro.undo.apply", Kn = "__voltro.undo.redo", qn = m.Struct({
+	id: m.String,
+	tag: m.String,
+	label: m.NullOr(m.String),
+	undone: m.Boolean,
+	crossesAction: m.Boolean,
+	createdAt: m.String
+}), Jn = class extends m.TaggedError()("UndoNotFound", { invocationId: m.String }) {}, Yn = class extends m.TaggedError()("UndoForbidden", { invocationId: m.String }) {}, Xn = class extends m.TaggedError()("UndoConflict", {
+	invocationId: m.String,
+	reason: m.Literal("conflict", "action")
+}) {}, Zn = m.Union(Jn, Yn, Xn), Qn = I({
+	name: Wn,
 	source: "_voltro_undo_log",
-	input: p.Struct({ limit: p.optional(p.Number) }),
-	output: p.Array(Kn),
+	input: m.Struct({ limit: m.optional(m.Number) }),
+	output: m.Array(qn),
 	openAccess: "subject-scoped by construction: lists only the calling subject's own undoable actions"
-}), Qn = L({
-	name: Wn,
-	input: p.Struct({ invocationId: p.String }),
-	output: p.Struct({ ok: p.Boolean }),
-	error: Xn,
-	openAccess: "subject-scoped by construction: undo is per-actor — another subject's invocation fails typed with UndoForbidden"
 }), $n = L({
 	name: Gn,
-	input: p.Struct({ invocationId: p.String }),
-	output: p.Struct({ ok: p.Boolean }),
-	error: Xn,
+	input: m.Struct({ invocationId: m.String }),
+	output: m.Struct({ ok: m.Boolean }),
+	error: Zn,
+	openAccess: "subject-scoped by construction: undo is per-actor — another subject's invocation fails typed with UndoForbidden"
+}), er = L({
+	name: Kn,
+	input: m.Struct({ invocationId: m.String }),
+	output: m.Struct({ ok: m.Boolean }),
+	error: Zn,
 	openAccess: "subject-scoped by construction: redo is per-actor — another subject's invocation fails typed with UndoForbidden"
-}), er = class extends p.TaggedError()("TenantScopeViolation", {
-	table: p.String,
-	reason: p.String
-}) {}, tr = class extends p.TaggedError()("StoreOperationFailed", {
-	operation: p.String,
-	table: p.String,
-	cause: p.String
-}) {}, nr = class extends p.TaggedError()("TableValidationFailed", {
-	table: p.String,
-	summary: p.String,
-	issues: p.Array(p.Struct({
-		path: p.String,
-		message: p.String
+}), tr = class extends m.TaggedError()("TenantScopeViolation", {
+	table: m.String,
+	reason: m.String
+}) {}, nr = class extends m.TaggedError()("StoreOperationFailed", {
+	operation: m.String,
+	table: m.String,
+	cause: m.String
+}) {}, rr = class extends m.TaggedError()("NoRowFound", {
+	table: m.String,
+	found: m.Number
+}) {
+	get message() {
+		return this.found === 0 ? `expected exactly one row in '${this.table}', found none` : `expected exactly one row in '${this.table}', found more than one`;
+	}
+}, ir = class extends m.TaggedError()("TableValidationFailed", {
+	table: m.String,
+	summary: m.String,
+	issues: m.Array(m.Struct({
+		path: m.String,
+		message: m.String
 	}))
-}) {}, rr = class extends p.TaggedError()("TenantRowNotFound", {
-	table: p.String,
-	id: p.String,
-	reason: p.String
-}) {}, ir = class extends p.TaggedError()("ServerOnlyColumnWrite", {
-	table: p.String,
-	columns: p.Array(p.String)
-}) {}, ar = class extends p.TaggedError()("ConstraintViolation", {
-	kind: p.Literal("foreignKey", "foreignKeyInUse", "unique", "notNull", "check"),
-	table: p.String,
-	operation: p.String,
-	constraint: p.optional(p.String),
-	column: p.optional(p.String),
-	detail: p.optional(p.String)
+}) {}, ar = class extends m.TaggedError()("TenantRowNotFound", {
+	table: m.String,
+	id: m.String,
+	reason: m.String
+}) {}, or = class extends m.TaggedError()("ServerOnlyColumnWrite", {
+	table: m.String,
+	columns: m.Array(m.String)
+}) {}, sr = class extends m.TaggedError()("ConstraintViolation", {
+	kind: m.Literal("foreignKey", "foreignKeyInUse", "unique", "notNull", "check"),
+	table: m.String,
+	operation: m.String,
+	constraint: m.optional(m.String),
+	column: m.optional(m.String),
+	detail: m.optional(m.String)
 }) {
 	get message() {
 		if (this.detail !== void 0) return this.detail;
@@ -864,85 +871,85 @@ var Ge = p.Union(p.String, p.Number), h = p.Record({
 			case "check": return `check constraint ${t}: the row does not satisfy it`;
 		}
 	}
-}, or = "__voltro.approvals.pending", sr = "__voltro.approvals.decide", cr = I({
-	name: or,
+}, cr = "__voltro.approvals.pending", lr = "__voltro.approvals.decide", ur = I({
+	name: cr,
 	source: "_voltro_approvals",
-	input: p.Struct({ limit: p.optional(p.Number) }),
-	output: p.Array(ot),
+	input: m.Struct({ limit: m.optional(m.Number) }),
+	output: m.Array(st),
 	openAccess: "the answer is scoped to the caller — a row appears only if they requested it or hold its recorded approver scopes, so an anonymous caller sees nothing"
-}), lr = L({
-	name: sr,
-	input: p.Struct({
-		approvalId: p.String,
-		decision: p.Literal("approve", "reject"),
-		note: p.optional(p.String)
+}), dr = L({
+	name: lr,
+	input: m.Struct({
+		approvalId: m.String,
+		decision: m.Literal("approve", "reject"),
+		note: m.optional(m.String)
 	}),
-	output: p.Struct({
-		approvalId: p.String,
-		status: p.Literal("approved", "rejected")
+	output: m.Struct({
+		approvalId: m.String,
+		status: m.Literal("approved", "rejected")
 	}),
-	error: at,
+	error: ot,
 	openAccess: "the approver authority is the PENDING ROW's own recorded scopes (plus an unconditional self-approval refusal), checked in-handler — a descriptor-level scope would have to be the union of every approval-requiring procedure in the app"
-}), Z = "__voltro.connections.list", ur = "__voltro.connections.start", dr = "__voltro.connections.submitToken", fr = "__voltro.connections.disconnect", Q = p.Literal("oauth2", "pat"), pr = p.Literal("disconnected", "connected", "expired", "revoked", "error"), mr = p.Struct({
-	connectionId: p.String,
+}), fr = "__voltro.connections.list", pr = "__voltro.connections.start", mr = "__voltro.connections.submitToken", hr = "__voltro.connections.disconnect", Q = m.Literal("oauth2", "pat"), gr = m.Literal("disconnected", "connected", "expired", "revoked", "error"), _r = m.Struct({
+	connectionId: m.String,
 	kind: Q,
-	label: p.String,
-	status: pr,
-	accountId: p.NullOr(p.String),
-	accountLabel: p.NullOr(p.String),
-	scopes: p.Array(p.String),
-	expiresAt: p.NullOr(p.String),
-	lastError: p.NullOr(p.String),
-	connectedAt: p.NullOr(p.String)
-}), hr = class extends p.TaggedError()("ConnectionNotDeclared", { connectionId: p.String }) {}, gr = class extends p.TaggedError()("ConnectionSubjectRequired", { connectionId: p.String }) {}, _r = class extends p.TaggedError()("ConnectionKindMismatch", {
-	connectionId: p.String,
+	label: m.String,
+	status: gr,
+	accountId: m.NullOr(m.String),
+	accountLabel: m.NullOr(m.String),
+	scopes: m.Array(m.String),
+	expiresAt: m.NullOr(m.String),
+	lastError: m.NullOr(m.String),
+	connectedAt: m.NullOr(m.String)
+}), vr = class extends m.TaggedError()("ConnectionNotDeclared", { connectionId: m.String }) {}, yr = class extends m.TaggedError()("ConnectionSubjectRequired", { connectionId: m.String }) {}, br = class extends m.TaggedError()("ConnectionKindMismatch", {
+	connectionId: m.String,
 	expected: Q,
 	actual: Q
-}) {}, vr = class extends p.TaggedError()("ConnectionHandshakeFailed", {
-	connectionId: p.String,
-	reason: p.String,
-	transient: p.Boolean
-}) {}, $ = p.Union(hr, gr, _r, vr), yr = I({
-	name: Z,
+}) {}, xr = class extends m.TaggedError()("ConnectionHandshakeFailed", {
+	connectionId: m.String,
+	reason: m.String,
+	transient: m.Boolean
+}) {}, $ = m.Union(vr, yr, br, xr), Sr = I({
+	name: fr,
 	source: "_voltro_connections",
-	input: p.Struct({}),
-	output: p.Array(mr),
+	input: m.Struct({}),
+	output: m.Array(_r),
 	openAccess: "self-scoped read: projects the declared connections for the calling subject only (its own connect/disconnect state)"
-}), br = R({
-	name: ur,
-	input: p.Struct({
-		connectionId: p.String,
-		redirectTo: p.optional(p.String)
+}), Cr = R({
+	name: pr,
+	input: m.Struct({
+		connectionId: m.String,
+		redirectTo: m.optional(m.String)
 	}),
-	output: p.Struct({
-		authorizeUrl: p.String,
-		state: p.String
+	output: m.Struct({
+		authorizeUrl: m.String,
+		state: m.String
 	}),
 	error: $,
 	openAccess: "self-service: begins an oauth handshake that stores a credential for the calling subject only; anonymous callers fail typed with ConnectionSubjectRequired"
-}), xr = L({
-	name: dr,
-	input: p.Struct({
-		connectionId: p.String,
-		token: p.String
+}), wr = L({
+	name: mr,
+	input: m.Struct({
+		connectionId: m.String,
+		token: m.String
 	}),
-	output: p.Struct({ ok: p.Boolean }),
+	output: m.Struct({ ok: m.Boolean }),
 	error: $,
 	openAccess: "self-service: stores a pasted token as the calling subject's own credential; anonymous callers fail typed with ConnectionSubjectRequired"
-}), Sr = L({
-	name: fr,
-	input: p.Struct({ connectionId: p.String }),
-	output: p.Struct({ ok: p.Boolean }),
+}), Tr = L({
+	name: hr,
+	input: m.Struct({ connectionId: m.String }),
+	output: m.Struct({ ok: m.Boolean }),
 	error: $,
 	openAccess: "self-service: deletes only the calling subject's own credential row for this connection"
-}), Cr = (e) => {
+}), Er = (e) => {
 	let t = e instanceof Date ? e.getTime() : typeof e == "number" ? e : typeof e == "string" ? new Date(e).getTime() : 0;
 	return Number.isNaN(t) ? 0 : t;
-}, wr = 4001, Tr = /* @__PURE__ */ new Set(["/rpc", "/ws"]), Er = (e) => {
+}, Dr = 4001, Or = /* @__PURE__ */ new Set(["/rpc", "/ws"]), kr = (e) => {
 	if (!e.path.startsWith("/")) throw Error(`defineWebSocket: path must be absolute, got '${e.path}'`);
-	if (Tr.has(e.path)) throw Error(`defineWebSocket: '${e.path}' is the framework's own socket surface — mount the gateway elsewhere`);
+	if (Or.has(e.path)) throw Error(`defineWebSocket: '${e.path}' is the framework's own socket surface — mount the gateway elsewhere`);
 	if (e.auth !== "subject" && e.auth !== "public") throw Error(`defineWebSocket: auth must be 'subject' or 'public' (explicitly — an unauthenticated socket has to be a decision somebody wrote down), got '${String(e.auth)}'`);
 	return e;
-}, Dr = 1;
+}, Ar = 1;
 //#endregion
-export { De as ADMIN_SCOPE, Se as APIKEY_ISSUE_ORG_SCOPE, Te as APIKEY_ISSUE_OTHER_SCOPE, _e as APIKEY_ISSUE_SELF_SCOPE, sr as APPROVALS_DECIDE_TAG, or as APPROVALS_PENDING_TAG, at as ApprovalDecisionErrors, it as ApprovalErrors, k as ApprovalExpired, rt as ApprovalForbidden, $e as ApprovalNotFound, nt as ApprovalNotPending, tt as ApprovalRejected, Qe as ApprovalRequired, et as ApprovalSelfApproval, A as ApprovalUnavailable, ke as AuthMiddleware, T as BusinessRuleViolation, Z as CONNECTIONS_LIST_TAG, fr as CONNECTION_DISCONNECT_TAG, ur as CONNECTION_START_TAG, dr as CONNECTION_SUBMIT_TOKEN_TAG, vr as ConnectionHandshakeFailed, se as ConnectionInfo, i as ConnectionInfoMiddleware, Q as ConnectionKind, _r as ConnectionKindMismatch, hr as ConnectionNotDeclared, mr as ConnectionState, pr as ConnectionStatus, gr as ConnectionSubjectRequired, ar as ConstraintViolation, r as DEFAULT_SCOPE_CACHE_MAX_ENTRIES, re as DEFAULT_SCOPE_CACHE_TTL_MS, Xt as EVENT_ROUTE_SEP, qt as EventKeyInvalid, Kt as EventPayloadInvalid, Jt as EventPayloadTooLarge, wr as GATEWAY_CREDENTIAL_EXPIRED_CLOSE_CODE, ye as IMPERSONATION_METADATA_KEY, It as MAX_EVENT_ENVELOPE_BYTES, Re as MUTATION_IN_FLIGHT_RETRY_AFTER_MS, f as MutationInFlight, Dr as PROTOCOL_VERSION, ot as PendingApproval, j as REACTIVITY_CHANNEL_PREFIX, l as ScopeError, ir as ServerOnlyColumnWrite, tr as StoreOperationFailed, e as Subject, ve as SubjectIdentity, ne as SubjectService, nr as TableValidationFailed, rr as TenantRowNotFound, er as TenantScopeViolation, Wn as UNDO_APPLY_TAG, Un as UNDO_LOG_TAG, Gn as UNDO_REDO_TAG, c as Unauthenticated, Yn as UndoConflict, Jn as UndoForbidden, Kn as UndoLogEntry, qn as UndoNotFound, D as ValidationError, O as ValidationErrors, E as ValidationIssue, H as WorkflowAccessProperty, X as WorkflowControlInputSchema, Tn as WorkflowDomainEventRowSchema, On as WorkflowDomainEventsInputSchema, kn as WorkflowEventDeliveriesInputSchema, En as WorkflowEventDeliveryRowSchema, vn as WorkflowParentClosePolicySchema, wn as WorkflowRunEventRowSchema, bn as WorkflowRunHandleSchema, Dn as WorkflowRunRefSchema, J as WorkflowRunRowSchema, q as WorkflowRunStatusSchema, Cn as WorkflowRunStepRowSchema, Y as WorkflowRunTableRefSchema, Sn as WorkflowRunsInputSchema, An as WorkflowSignalInputSchema, yn as WorkflowStartDeferralSchema, jn as WorkflowUpdateInputSchema, Mn as WorkflowUpdateResultSchema, jt as actionToRpc, Ce as advisoryResourceGuardWarning, ie as anonymousSubject, Ye as applyRowPatch, a as applyScopeDecision, lr as approvalsDecideDescriptor, cr as approvalsPendingQueryDescriptor, ee as assertAuthenticated, nn as attachWorkflowAccess, Ne as beginIdempotent, un as checkFrameworkCompat, Ee as checkGuards, pe as checkGuardsEffect, te as composeAuthStrategies, cn as composeRpcInterceptors, Sr as connectionDisconnectDescriptor, br as connectionStartDescriptor, xr as connectionSubmitTokenDescriptor, yr as connectionsListQueryDescriptor, pt as declaredReactivityChannelKeys, R as defineAction, Rt as defineEvent, L as defineMutation, an as definePlugin, on as definePluginRoute, ln as definePluginService, I as defineQuery, St as defineStream, Er as defineWebSocket, qe as diffRows, be as effectiveScopes, Yt as encodeEventKey, Nt as errorTag, Vt as eventAttached, zt as eventEnvelope, Bt as eventGap, Ut as eventResumePoint, Zt as eventRoute, Ht as eventStreamEvent, Wt as eventSubscribeInput, Gt as eventToRpc, Le as failIdempotent, Ze as fieldIssuesOf, Oe as findAdvisoryResourceGuards, ze as finishIdempotent, $t as formatEventRoute, me as getPolicyGuardResolver, he as getResourceScopeResolver, U as getWorkflowAccess, xt as hasAccessDecision, ae as hasCallbackRoutes, we as hasEffectiveScope, B as hasEnforcedGuard, xe as hasScope, v as idToPath, Pe as idempotencyScope, C as inputLabel, Lt as isEventDescriptor, Je as isIdKeyed, u as isOpenAccess, ge as isPolicyCheck, bt as isPolicyGuard, dt as isReactivityChannel, ft as isReactivityChannelKey, Me as isSystemSubject, vt as isWireReachable, t as makeScopeCache, Fe as memoryIdempotencyStore, de as missingAccessDecision, At as mutationToRpc, Ft as normalizeDescriptor, ht as normalizeSource, d as openAccessSpec, Qt as parseEventRoute, y as pathToId, fn as pluginAlias, sn as pluginInstanceName, pn as pluginSlug, _n as pluginTag, _t as publishReactivity, Be as publishServerError, kt as queryToRpc, le as rawImpersonationMark, ut as reactivityChannel, hn as registerPluginAliases, je as requireScope, gn as resetPluginAliases, tn as resolveWorkflowAccess, g as rowPatchOpSchema, _ as rowPatchSchema, s as scopeCacheKey, fe as setEffectiveScopes, Ae as setPolicyGuardResolver, oe as setResourceScopeResolver, mt as sourceKeys, Mt as streamToRpc, w as strictInput, ce as subjectIdentity, n as subjectScopes, Ie as subscribeServerErrors, S as subscriptionEvent, ue as systemSubject, o as tenantScopedSubject, Pt as toRpc, Cr as tsMs, gt as undeclaredChannelKeys, Qn as undoApplyDescriptor, Zn as undoLogQueryDescriptor, $n as undoRedoDescriptor, V as wireErrorUnion, Ot as withRpcTag, rn as workflowAccessDescriptor, zn as workflowCancelDescriptor, Ln as workflowDomainEventsQueryDescriptor, Rn as workflowEventDeliveriesQueryDescriptor, Bn as workflowResumeDescriptor, In as workflowRunEventsQueryDescriptor, Nn as workflowRunQueryDescriptor, Fn as workflowRunStepsQueryDescriptor, Pn as workflowRunsQueryDescriptor, Vn as workflowSignalDescriptor, xn as workflowToRpc, Hn as workflowUpdateDescriptor, Dt as workflowWireErrorUnion, Ve as wsMutationIdempotencyScope };
+export { De as ADMIN_SCOPE, Se as APIKEY_ISSUE_ORG_SCOPE, Te as APIKEY_ISSUE_OTHER_SCOPE, _e as APIKEY_ISSUE_SELF_SCOPE, lr as APPROVALS_DECIDE_TAG, cr as APPROVALS_PENDING_TAG, ot as ApprovalDecisionErrors, at as ApprovalErrors, k as ApprovalExpired, it as ApprovalForbidden, et as ApprovalNotFound, rt as ApprovalNotPending, nt as ApprovalRejected, $e as ApprovalRequired, tt as ApprovalSelfApproval, A as ApprovalUnavailable, se as AuthMiddleware, E as BusinessRuleViolation, fr as CONNECTIONS_LIST_TAG, hr as CONNECTION_DISCONNECT_TAG, pr as CONNECTION_START_TAG, mr as CONNECTION_SUBMIT_TOKEN_TAG, xr as ConnectionHandshakeFailed, i as ConnectionInfo, r as ConnectionInfoMiddleware, Q as ConnectionKind, br as ConnectionKindMismatch, vr as ConnectionNotDeclared, _r as ConnectionState, gr as ConnectionStatus, yr as ConnectionSubjectRequired, sr as ConstraintViolation, ie as DEFAULT_SCOPE_CACHE_MAX_ENTRIES, ye as DEFAULT_SCOPE_CACHE_TTL_MS, Zt as EVENT_ROUTE_SEP, Jt as EventKeyInvalid, qt as EventPayloadInvalid, Yt as EventPayloadTooLarge, Dr as GATEWAY_CREDENTIAL_EXPIRED_CLOSE_CODE, e as IMPERSONATION_METADATA_KEY, Lt as MAX_EVENT_ENVELOPE_BYTES, Re as MUTATION_IN_FLIGHT_RETRY_AFTER_MS, p as MutationInFlight, rr as NoRowFound, Ar as PROTOCOL_VERSION, st as PendingApproval, j as REACTIVITY_CHANNEL_PREFIX, u as ScopeError, or as ServerOnlyColumnWrite, nr as StoreOperationFailed, ve as Subject, ne as SubjectIdentity, re as SubjectService, ir as TableValidationFailed, ar as TenantRowNotFound, tr as TenantScopeViolation, Gn as UNDO_APPLY_TAG, Wn as UNDO_LOG_TAG, Kn as UNDO_REDO_TAG, l as Unauthenticated, Xn as UndoConflict, Yn as UndoForbidden, qn as UndoLogEntry, Jn as UndoNotFound, O as ValidationError, Ze as ValidationErrors, D as ValidationIssue, U as WorkflowAccessProperty, Z as WorkflowControlInputSchema, En as WorkflowDomainEventRowSchema, kn as WorkflowDomainEventsInputSchema, An as WorkflowEventDeliveriesInputSchema, Dn as WorkflowEventDeliveryRowSchema, yn as WorkflowParentClosePolicySchema, Tn as WorkflowRunEventRowSchema, xn as WorkflowRunHandleSchema, On as WorkflowRunRefSchema, Y as WorkflowRunRowSchema, J as WorkflowRunStatusSchema, wn as WorkflowRunStepRowSchema, X as WorkflowRunTableRefSchema, Cn as WorkflowRunsInputSchema, jn as WorkflowSignalInputSchema, bn as WorkflowStartDeferralSchema, Mn as WorkflowUpdateInputSchema, Nn as WorkflowUpdateResultSchema, Mt as actionToRpc, Ce as advisoryResourceGuardWarning, a as anonymousSubject, Ye as applyRowPatch, c as applyScopeDecision, dr as approvalsDecideDescriptor, ur as approvalsPendingQueryDescriptor, te as assertAuthenticated, rn as attachWorkflowAccess, Ne as beginIdempotent, dn as checkFrameworkCompat, Ee as checkGuards, pe as checkGuardsEffect, ae as composeAuthStrategies, ln as composeRpcInterceptors, Tr as connectionDisconnectDescriptor, Cr as connectionStartDescriptor, wr as connectionSubmitTokenDescriptor, Sr as connectionsListQueryDescriptor, mt as declaredReactivityChannelKeys, R as defineAction, zt as defineEvent, L as defineMutation, on as definePlugin, sn as definePluginRoute, un as definePluginService, I as defineQuery, wt as defineStream, kr as defineWebSocket, qe as diffRows, be as effectiveScopes, Xt as encodeEventKey, Pt as errorTag, Ht as eventAttached, Bt as eventEnvelope, Vt as eventGap, Wt as eventResumePoint, Qt as eventRoute, Ut as eventStreamEvent, Gt as eventSubscribeInput, Kt as eventToRpc, Le as failIdempotent, Qe as fieldIssuesOf, Oe as findAdvisoryResourceGuards, ze as finishIdempotent, en as formatEventRoute, me as getPolicyGuardResolver, he as getResourceScopeResolver, W as getWorkflowAccess, Ct as hasAccessDecision, Me as hasCallbackRoutes, we as hasEffectiveScope, B as hasEnforcedGuard, xe as hasScope, y as idToPath, Pe as idempotencyScope, w as inputLabel, ge as isAuthenticatedCheck, St as isAuthenticatedGuard, Rt as isEventDescriptor, Je as isIdKeyed, d as isOpenAccess, de as isPolicyCheck, xt as isPolicyGuard, ft as isReactivityChannel, pt as isReactivityChannelKey, t as isSystemSubject, yt as isWireReachable, le as makeScopeCache, Fe as memoryIdempotencyStore, ke as missingAccessDecision, jt as mutationToRpc, It as normalizeDescriptor, gt as normalizeSource, f as openAccessSpec, $t as parseEventRoute, b as pathToId, pn as pluginAlias, cn as pluginInstanceName, mn as pluginSlug, vn as pluginTag, vt as publishReactivity, Be as publishServerError, At as queryToRpc, s as rawImpersonationMark, dt as reactivityChannel, gn as registerPluginAliases, fe as requireScope, _n as resetPluginAliases, nn as resolveWorkflowAccess, _ as rowPatchOpSchema, v as rowPatchSchema, ce as scopeCacheKey, je as setEffectiveScopes, oe as setPolicyGuardResolver, n as setResourceScopeResolver, ht as sourceKeys, Nt as streamToRpc, T as strictInput, ue as subjectIdentity, Ae as subjectScopes, Ie as subscribeServerErrors, C as subscriptionEvent, o as systemSubject, ee as tenantScopedSubject, Ft as toRpc, Er as tsMs, _t as undeclaredChannelKeys, $n as undoApplyDescriptor, Qn as undoLogQueryDescriptor, er as undoRedoDescriptor, H as wireErrorUnion, kt as withRpcTag, an as workflowAccessDescriptor, Bn as workflowCancelDescriptor, Rn as workflowDomainEventsQueryDescriptor, zn as workflowEventDeliveriesQueryDescriptor, Vn as workflowResumeDescriptor, Ln as workflowRunEventsQueryDescriptor, Pn as workflowRunQueryDescriptor, In as workflowRunStepsQueryDescriptor, Fn as workflowRunsQueryDescriptor, Hn as workflowSignalDescriptor, Sn as workflowToRpc, Un as workflowUpdateDescriptor, Ot as workflowWireErrorUnion, Ve as wsMutationIdempotencyScope };