@voltro/protocol 0.68.0 → 0.69.0

package/dist/index.js

@@ -1,20 +1,20 @@
-import { A as e, B as t, C as n, D as r, E as i, F as a, G as o, H as s, I as c, K as ee, L as te, M as ne, N as re, O as ie, P as l, R as ae, S as oe, T as se, U as ce, V as le, W as ue, _ as de, a as u, b as fe, c as pe, d as me, f as he, g as d, h as ge, i as _e, j as ve, k as ye, l as be, m as xe, n as Se, o as Ce, p as we, r as Te, s as Ee, t as De, u as Oe, v as ke, w as Ae, x as je, y as f, z as Me } from "./scopes-C86BDyNJ.js";
-import { a as Ne, c as Pe, d as Fe, i as p, l as Ie, n as Le, o as Re, r as ze, s as Be, t as Ve, u as He } from "./serverErrorBus-BTnTpMqj.js";
-import { Context as Ue, Layer as We, Schema as m } from "effect";
+import { A as e, B as t, C as n, D as r, E as i, F as a, G as o, H as s, I as c, K as ee, L as te, M as ne, N as re, O as ie, P as l, R as ae, S as oe, T as se, U as ce, V as le, W as ue, _ as de, a as u, b as fe, c as pe, d as me, f as he, g as d, h as ge, i as _e, j as ve, k as ye, l as be, m as xe, n as Se, o as Ce, p as we, q as Te, r as Ee, s as De, t as Oe, u as ke, v as Ae, w as je, x as Me, y as f, z as Ne } from "./scopes-DVtiKKsm.js";
+import { a as Pe, c as Fe, d as Ie, i as p, l as Le, n as Re, o as ze, r as Be, s as Ve, t as He, u as Ue } from "./serverErrorBus-BTnTpMqj.js";
+import { Context as We, Layer as Ge, Schema as m } from "effect";
 import { Rpc as h } from "@effect/rpc";
-import { VersionConflict as Ge } from "@voltro/database/wire";
+import { VersionConflict as Ke } from "@voltro/database/wire";
 //#region src/rowPatch.ts
-var Ke = m.Union(m.String, m.Number), qe = m.Record({
+var qe = m.Union(m.String, m.Number), Je = m.Record({
 	key: m.String,
 	value: m.Unknown
-}).pipe(m.filter((e) => "id" in e, { message: () => "patch row must carry an id" })), Je = m.Union(m.Struct({
+}).pipe(m.filter((e) => "id" in e, { message: () => "patch row must carry an id" })), Ye = m.Union(m.Struct({
 	op: m.Literal("add"),
 	path: m.String,
-	value: qe
+	value: Je
 }), m.Struct({
 	op: m.Literal("replace"),
 	path: m.String,
-	value: qe
+	value: Je
 }), m.Struct({
 	op: m.Literal("remove"),
 	path: m.String
@@ -25,14 +25,14 @@ var Ke = m.Union(m.String, m.Number), qe = m.Record({
 		key: m.String,
 		value: m.Unknown
 	})
-})), Ye = m.Struct({
-	ops: m.Array(Je),
-	order: m.Array(Ke)
+})), Xe = m.Struct({
+	ops: m.Array(Ye),
+	order: m.Array(qe)
 }), g = (e) => `/${String(e).replace(/~/g, "~0").replace(/\//g, "~1")}`, _ = (e) => (e.startsWith("/") ? e.slice(1) : e).replace(/~1/g, "/").replace(/~0/g, "~"), v = (e) => {
 	let t = Object.keys(e).sort(), n = {};
 	for (let r of t) n[r] = e[r];
 	return JSON.stringify(n);
-}, y = (e, t) => v(e) === v(t), Xe = (e, t) => {
+}, y = (e, t) => v(e) === v(t), Ze = (e, t) => {
 	if (e instanceof Uint8Array && t instanceof Uint8Array) {
 		if (e.length !== t.length) return !1;
 		for (let n = 0; n < e.length; n += 1) if (e[n] !== t[n]) return !1;
@@ -45,14 +45,14 @@ var Ke = m.Union(m.String, m.Number), qe = m.Record({
 		id: 0,
 		v: t
 	});
-}, Ze = (e, t, n = {}) => {
+}, Qe = (e, t, n = {}) => {
 	let r = /* @__PURE__ */ new Map();
 	for (let t of e) r.set(t.id, t);
 	let i = [], a = [], o = /* @__PURE__ */ new Set(), s = n.crdt, c = (e, t) => {
 		if (s === void 0 || s.columns.size === 0) return;
 		let n = {}, r = !1;
 		for (let i of s.columns) {
-			if (!(i in t) || Xe(e[i], t[i])) continue;
+			if (!(i in t) || Ze(e[i], t[i])) continue;
 			let a = s.incremental(i, e[i], t[i]);
 			if (a === void 0) return;
 			n[i] = a, r = !0;
@@ -98,10 +98,10 @@ var Ke = m.Union(m.String, m.Number), qe = m.Record({
 		ops: i,
 		order: a
 	};
-}, Qe = (e) => e.every((e) => {
+}, $e = (e) => e.every((e) => {
 	let t = e.id;
 	return typeof t == "string" || typeof t == "number";
-}), $e = (e, t, n = {}) => {
+}), et = (e, t, n = {}) => {
 	let r = /* @__PURE__ */ new Map();
 	for (let t of e) r.set(t.id, t);
 	for (let e of t.ops) {
@@ -131,7 +131,7 @@ var Ke = m.Union(m.String, m.Number), qe = m.Record({
 	_tag: m.Literal("delta"),
 	revision: m.Number,
 	emittedAt: m.Number,
-	patch: Ye
+	patch: Xe
 }), m.Struct({
 	_tag: m.Literal("error"),
 	error: m.Unknown,
@@ -139,7 +139,7 @@ var Ke = m.Union(m.String, m.Number), qe = m.Record({
 })), x = (e, t) => {
 	let n = `${e ?? "this procedure"} input`;
 	return t === !0 ? `${n} (guarded — the guard did NOT run: the payload failed to decode first, so this says nothing about access)` : n;
-}, et = (e) => {
+}, tt = (e) => {
 	let t = e.ast;
 	return t._tag === "TypeLiteral" && (t.propertySignatures?.length ?? 0) === 0 && (t.indexSignatures?.length ?? 0) === 0;
 }, S = (e, t, n) => {
@@ -147,8 +147,8 @@ var Ke = m.Union(m.String, m.Number), qe = m.Record({
 		parseOptions: { onExcessProperty: "error" },
 		parseIssueTitle: () => r
 	});
-	return et(e) ? m.filter((e) => typeof e == "object" && e && Object.keys(e).length > 0 ? `this procedure declares no input; received: ${Object.keys(e).join(", ")}` : void 0)(i).annotations({ identifier: r }) : i;
-}, tt = class extends m.TaggedError()("BusinessRuleViolation", {
+	return tt(e) ? m.filter((e) => typeof e == "object" && e && Object.keys(e).length > 0 ? `this procedure declares no input; received: ${Object.keys(e).join(", ")}` : void 0)(i).annotations({ identifier: r }) : i;
+}, nt = class extends m.TaggedError()("BusinessRuleViolation", {
 	rule: m.String,
 	params: m.optional(m.Record({
 		key: m.String,
@@ -157,21 +157,21 @@ var Ke = m.Union(m.String, m.Number), qe = m.Record({
 	field: m.optional(m.String),
 	message: m.optional(m.String),
 	severity: m.Literal("error", "warning")
-}) {}, nt = m.Struct({
+}) {}, rt = m.Struct({
 	field: m.String,
 	message: m.String,
 	params: m.optional(m.Record({
 		key: m.String,
 		value: m.Unknown
 	}))
-}), rt = class extends m.TaggedError()("ValidationError", {
+}), it = class extends m.TaggedError()("ValidationError", {
 	field: m.String,
 	message: m.String,
 	params: m.optional(m.Record({
 		key: m.String,
 		value: m.Unknown
 	}))
-}) {}, it = class extends m.TaggedError()("ValidationErrors", { issues: m.Array(nt).pipe(m.minItems(1)) }) {}, at = (e) => {
+}) {}, at = class extends m.TaggedError()("ValidationErrors", { issues: m.Array(rt).pipe(m.minItems(1)) }) {}, ot = (e) => {
 	if (typeof e != "object" || !e) return [];
 	let t = e._tag;
 	if (t === "ValidationError") {
@@ -197,34 +197,34 @@ var Ke = m.Union(m.String, m.Number), qe = m.Record({
 		}];
 	}
 	return [];
-}, ot = class extends m.TaggedError()("ApprovalRequired", {
+}, st = class extends m.TaggedError()("ApprovalRequired", {
 	approvalId: m.String,
 	procedure: m.String,
 	expiresAt: m.String,
 	requiredScopes: m.Array(m.String),
 	reason: m.NullOr(m.String),
 	created: m.Boolean
-}) {}, st = class extends m.TaggedError()("ApprovalNotFound", { approvalId: m.String }) {}, ct = class extends m.TaggedError()("ApprovalSelfApproval", {
+}) {}, ct = class extends m.TaggedError()("ApprovalNotFound", { approvalId: m.String }) {}, lt = class extends m.TaggedError()("ApprovalSelfApproval", {
 	approvalId: m.String,
 	subjectId: m.NullOr(m.String)
-}) {}, lt = class extends m.TaggedError()("ApprovalRejected", {
+}) {}, ut = class extends m.TaggedError()("ApprovalRejected", {
 	approvalId: m.String,
 	decidedBy: m.NullOr(m.String),
 	note: m.NullOr(m.String)
 }) {}, C = class extends m.TaggedError()("ApprovalExpired", {
 	approvalId: m.String,
 	expiredAt: m.String
-}) {}, ut = class extends m.TaggedError()("ApprovalNotPending", {
+}) {}, dt = class extends m.TaggedError()("ApprovalNotPending", {
 	approvalId: m.String,
 	status: m.String
-}) {}, dt = class extends m.TaggedError()("ApprovalForbidden", {
+}) {}, ft = class extends m.TaggedError()("ApprovalForbidden", {
 	approvalId: m.String,
 	required: m.NullOr(m.String),
 	message: m.String
 }) {}, w = class extends m.TaggedError()("ApprovalUnavailable", {
 	procedure: m.String,
 	message: m.String
-}) {}, ft = m.Union(ot, lt, C, w), pt = m.Union(st, ct, C, ut, dt, w), mt = m.Struct({
+}) {}, pt = m.Union(st, ut, C, w), mt = m.Union(ct, lt, C, dt, ft, w), ht = m.Struct({
 	id: m.String,
 	procedure: m.String,
 	kind: m.Literal("mutation", "action"),
@@ -238,8 +238,8 @@ var Ke = m.Union(m.String, m.Number), qe = m.Record({
 	decidedAt: m.NullOr(m.String),
 	note: m.NullOr(m.String),
 	relation: m.Literal("to-decide", "requested")
-}), T = "channel:", ht = Symbol.for("@voltro/protocol/reactivityChannels"), gt = globalThis, E = gt[ht] ?? (gt[ht] = /* @__PURE__ */ new Map()), _t = /^[a-z][a-z0-9-]*(\.[a-z0-9-]+)*$/, vt = (e) => {
-	if (!_t.test(e)) throw Error(`reactivityChannel('${e}'): invalid channel name.\n  Use lowercase kebab segments separated by dots — \`presence\`, \`job-queue\`,
+}), T = "channel:", gt = Symbol.for("@voltro/protocol/reactivityChannels"), _t = globalThis, E = _t[gt] ?? (_t[gt] = /* @__PURE__ */ new Map()), vt = /^[a-z][a-z0-9-]*(\.[a-z0-9-]+)*$/, yt = (e) => {
+	if (!vt.test(e)) throw Error(`reactivityChannel('${e}'): invalid channel name.\n  Use lowercase kebab segments separated by dots — \`presence\`, \`job-queue\`,
   \`billing.usage\`. A \`:\` is refused because it is the namespace separator in
   the routing key (\`${T}<name>\`), and an uppercase letter is\n  refused because a key that differs only by case reads as one channel and
   routes as two.`);
@@ -252,14 +252,14 @@ var Ke = m.Union(m.String, m.Number), qe = m.Record({
 		toString: () => n
 	});
 	return E.set(e, r), r;
-}, D = (e) => typeof e == "object" && !!e && e.kind === "reactivity-channel", O = (e) => e.startsWith(T), k = () => new Set([...E.values()].map((e) => e.key)), A = (e) => D(e) ? e.key : e, j = (e) => e === void 0 ? [] : Array.isArray(e) ? e.map(A) : [A(e)], M = (e) => e === void 0 ? void 0 : Array.isArray(e) ? e.map(A) : A(e), yt = (e) => {
+}, D = (e) => typeof e == "object" && !!e && e.kind === "reactivity-channel", O = (e) => e.startsWith(T), k = () => new Set([...E.values()].map((e) => e.key)), A = (e) => D(e) ? e.key : e, j = (e) => e === void 0 ? [] : Array.isArray(e) ? e.map(A) : [A(e)], M = (e) => e === void 0 ? void 0 : Array.isArray(e) ? e.map(A) : A(e), bt = (e) => {
 	let t = k(), n = [];
 	for (let r of e) for (let e of j(r.source)) O(e) && !t.has(e) && n.push({
 		procedure: r.name,
 		key: e
 	});
 	return n;
-}, bt = (e, t) => {
+}, xt = (e, t) => {
 	let n = e?.injectExternalChange;
 	return n !== void 0 && (n.call(e, {
 		table: t.key,
@@ -268,8 +268,8 @@ var Ke = m.Union(m.String, m.Number), qe = m.Record({
 		old: {},
 		origin: "inline"
 	}), !0);
-}, xt = (e) => e.internal !== !0, N = (e) => {
-	if (St(e), e.idempotencyScope !== void 0 && e.idempotencyScope !== "subject" && e.idempotencyScope !== "connection") throw Error(`${e.name}: idempotencyScope must be 'subject' or 'connection'`);
+}, St = (e) => e.internal !== !0, N = (e) => {
+	if (Ct(e), e.idempotencyScope !== void 0 && e.idempotencyScope !== "subject" && e.idempotencyScope !== "connection") throw Error(`${e.name}: idempotencyScope must be 'subject' or 'connection'`);
 	if (e.idempotencyScope === "connection" && (e.internal === !0 || e.publicApi !== void 0 || e.exposeAsTool !== void 0)) throw Error(`${e.name}: connection-scoped mutations require the native WebSocket RPC surface; internal, publicApi and exposeAsTool cannot establish its connection state`);
 	if (Array.isArray(e.guards) && e.guards.length === 0) throw Error(`${e.name}: \`guards: []\` is empty, so it enforces nothing — but it reads\n  at the call site as if this procedure were protected. Omit the field for an
   unguarded procedure, or list the scopes required to call it.`);
@@ -288,7 +288,7 @@ var Ke = m.Union(m.String, m.Number), qe = m.Record({
 	let n = [e.publicApi === void 0 ? void 0 : "publicApi", e.exposeAsTool === void 0 ? void 0 : "exposeAsTool"].filter((e) => e !== void 0);
 	if (n.length === 0) return e;
 	throw Error(`${e.name}: \`internal: true\` cannot be combined with ${n.map((e) => `\`${e}\``).join(" or ")}. \`internal\` takes the procedure OFF the wire; those put it back ON a different one (${n.includes("publicApi") ? "a REST route" : "an agent tool"}), and that surface is projected without consulting the flag — so the procedure would be unreachable from your client and reachable from the internet. Drop \`internal: true\` if the wider surface is intended, or remove the ${n.join(" / ")} annotation if it is not.`);
-}, St = (e) => {
+}, Ct = (e) => {
 	let t = e.requiresApproval;
 	if (t !== void 0) {
 		if (!Array.isArray(t.approvers) || t.approvers.length === 0) throw Error(`${e.name}: \`requiresApproval.approvers\` is empty, so NOBODY can approve this\n  procedure and every call would park forever. Name the scope(s) an approver must hold
@@ -298,7 +298,7 @@ var Ke = m.Union(m.String, m.Number), qe = m.Record({
   human from every other, and the second-pair-of-eyes control would enforce nothing.
   Give the procedure a \`guards:\` decision, or drop \`requiresApproval\`.`);
 	}
-}, Ct = (e) => e.action !== void 0 && e.resourceType !== void 0, wt = (e) => e.authenticated === !0, Tt = (e) => e.openAccess !== void 0 || e.guards !== void 0 && e.guards.length > 0, P = (e, t, n) => {
+}, wt = (e) => e.action !== void 0 && e.resourceType !== void 0, Tt = (e) => e.authenticated === !0, Et = (e) => e.openAccess !== void 0 || e.guards !== void 0 && e.guards.length > 0, P = (e, t, n) => {
 	if (n === void 0) return t;
 	if (n.trim() === "") throw Error(`${e}: \`openAccess\` needs a REASON, not an empty string. It is the sentence a\n  reviewer reads to decide whether this procedure should really be callable
   without an authorization check — e.g. \`openAccess: 'public pricing, no caller data'\`.`);
@@ -349,7 +349,7 @@ var Ke = m.Union(m.String, m.Number), qe = m.Record({
 	requiresApproval: e.requiresApproval,
 	internal: e.internal,
 	overridesPlugin: e.overridesPlugin
-}), Et = (e) => N({
+}), Dt = (e) => N({
 	kind: "stream",
 	name: e.name,
 	input: e.input,
@@ -359,45 +359,45 @@ var Ke = m.Union(m.String, m.Number), qe = m.Record({
 	overridesPlugin: e.overridesPlugin,
 	guards: P(e.name, e.guards, e.openAccess),
 	openAccess: e.openAccess
-}), R = (e, t) => t && t.length > 0 ? m.Union(e, ...t) : e, z = (e) => e !== void 0 && e.some((e) => !d(e)), Dt = (e, t) => z(t) ? m.Union(e, u, l) : e, Ot = (e) => m.Union(e, tt), kt = (e) => m.Union(e, rt, it), At = (e, t) => t === void 0 ? e : m.Union(e, ft), B = (e, t) => {
+}), R = (e, t) => t && t.length > 0 ? m.Union(e, ...t) : e, z = (e) => e !== void 0 && e.some((e) => !d(e)), Ot = (e, t) => z(t) ? m.Union(e, u, l) : e, kt = (e) => m.Union(e, nt), At = (e) => m.Union(e, it, at), jt = (e, t) => t === void 0 ? e : m.Union(e, pt), B = (e, t) => {
 	if (t === "stream") return e.error;
-	let n = Dt(e.error, e.guards);
+	let n = Ot(e.error, e.guards);
 	if (t === "query") return n;
-	let r = t === "mutation" ? m.Union(Ot(n), Ne, Ge) : n;
-	return At(kt(t === "mutation" && e.idempotencyScope === "connection" ? m.Union(r, p) : r), e.requiresApproval);
-}, jt = (e, t) => R(Dt(e.errorSchema, e.guards), t), Mt = (e, t) => ({
+	let r = t === "mutation" ? m.Union(kt(n), Pe, Ke) : n;
+	return jt(At(t === "mutation" && e.idempotencyScope === "connection" ? m.Union(r, p) : r), e.requiresApproval);
+}, Mt = (e, t) => R(Ot(e.errorSchema, e.guards), t), Nt = (e, t) => ({
 	...e,
 	name: t
-}), Nt = (e, t) => h.make(e.name, {
+}), Pt = (e, t) => h.make(e.name, {
 	payload: S(e.input, e.name, z(e.guards)),
 	success: b(e.output),
 	error: R(B(e, "query"), t),
 	stream: !0
-}), Pt = (e, t) => h.make(e.name, {
+}), Ft = (e, t) => h.make(e.name, {
 	payload: S(e.input, e.name, z(e.guards)),
 	success: e.output,
 	error: R(B(e, "mutation"), t)
-}), Ft = (e, t) => h.make(e.name, {
+}), It = (e, t) => h.make(e.name, {
 	payload: S(e.input, e.name, z(e.guards)),
 	success: e.output,
 	error: R(B(e, "action"), t)
-}), It = (e, t) => h.make(e.name, {
+}), Lt = (e, t) => h.make(e.name, {
 	payload: S(e.input, e.name, z(e.guards)),
 	success: e.element,
 	error: R(e.error, t),
 	stream: !0
-}), Lt = (e) => {
+}), Rt = (e) => {
 	if (typeof e != "object" || !e) return;
 	let t = e._tag;
 	return typeof t == "string" ? t : void 0;
-}, Rt = (e) => {
+}, zt = (e) => {
 	switch (e.kind) {
-		case "query": return Nt(e);
-		case "mutation": return Pt(e);
-		case "action": return Ft(e);
-		case "stream": return It(e);
+		case "query": return Pt(e);
+		case "mutation": return Ft(e);
+		case "action": return It(e);
+		case "stream": return Lt(e);
 	}
-}, zt = (e) => {
+}, Bt = (e) => {
 	let t = e.input, n = t === void 0 ? {} : { input: t }, r = e.output, i = r === void 0 ? {} : { output: r };
 	if (e.kind === "query") return {
 		kind: "query",
@@ -441,7 +441,7 @@ var Ke = m.Union(m.String, m.Number), qe = m.Record({
 			..."relations" in e && e.relations !== void 0 ? { relations: e.relations } : {}
 		}))
 	};
-}, Bt = 7500, Vt = (e) => typeof e == "object" && !!e && e.kind === "event", Ht = (e) => {
+}, Vt = 7500, Ht = (e) => typeof e == "object" && !!e && e.kind === "event", Ut = (e) => {
 	if (e.name.length === 0) throw Error("defineEvent: `name` must not be empty");
 	if (/\s/.test(e.name)) throw Error(`defineEvent("${e.name}"): \`name\` must not contain whitespace.\n  The name is used as a broker subject segment. NATS refuses a subject with
   whitespace and delivers nothing — silently, and only on that broker, so an
@@ -476,60 +476,60 @@ var Ke = m.Union(m.String, m.Number), qe = m.Record({
 		webhook: e.webhook,
 		delivery: e.delivery
 	};
-}, Ut = (e) => m.Struct({
+}, Wt = (e) => m.Struct({
 	_tag: m.Literal("event"),
 	origin: m.String,
 	n: m.Number,
 	emittedAt: m.Number,
 	payload: e
-}), Wt = m.Struct({
+}), Gt = m.Struct({
 	_tag: m.Literal("gap"),
 	missed: m.Number,
 	reason: m.Literal("buffer", "resume")
-}), Gt = m.Struct({ _tag: m.Literal("attached") }), Kt = (e) => m.Union(Gt, Ut(e), Wt), qt = m.Struct({
+}), Kt = m.Struct({ _tag: m.Literal("attached") }), qt = (e) => m.Union(Kt, Wt(e), Gt), Jt = m.Struct({
 	origin: m.String,
 	n: m.Number
-}), Jt = (e) => m.Struct({
+}), Yt = (e) => m.Struct({
 	key: e,
-	resume: m.optional(m.Array(qt))
-}), Yt = (e, t) => {
+	resume: m.optional(m.Array(Jt))
+}), Xt = (e, t) => {
 	let n = e.guards !== void 0 && e.guards.some((e) => !d(e)) ? m.Union(u, l) : m.Never, r = t && t.length > 0 ? m.Union(n, ...t) : n;
 	return h.make(e.name, {
-		payload: S(Jt(e.key), e.name, z(e.guards)),
-		success: Kt(e.payload),
+		payload: S(Yt(e.key), e.name, z(e.guards)),
+		success: qt(e.payload),
 		error: r,
 		stream: !0
 	});
-}, Xt = class extends m.TaggedError()("EventPayloadInvalid", {
+}, Zt = class extends m.TaggedError()("EventPayloadInvalid", {
 	event: m.String,
 	message: m.String
-}) {}, Zt = class extends m.TaggedError()("EventKeyInvalid", {
+}) {}, Qt = class extends m.TaggedError()("EventKeyInvalid", {
 	event: m.String,
 	message: m.String
-}) {}, Qt = class extends m.TaggedError()("EventPayloadTooLarge", {
+}) {}, $t = class extends m.TaggedError()("EventPayloadTooLarge", {
 	event: m.String,
 	bytes: m.Number,
 	limit: m.Number
-}) {}, $t = (e) => {
+}) {}, en = (e) => {
 	if (typeof e != "object" || !e) return JSON.stringify(e) ?? "null";
 	let t = Object.entries(e).filter(([, e]) => e !== void 0).sort(([e], [t]) => e < t ? -1 : +(e > t));
 	return JSON.stringify(t);
-}, en = "\0", tn = (e, t, n) => [
+}, tn = "\0", nn = (e, t, n) => [
 	e ?? "~",
 	t,
-	$t(n)
-].join("\0"), nn = (e) => {
+	en(n)
+].join("\0"), rn = (e) => {
 	let [t = "~", n = "", r = ""] = e.split("\0");
 	return {
 		tenantId: t === "~" ? null : t,
 		event: n,
 		key: r
 	};
-}, rn = (e) => e.split("\0").join(" · "), V = Symbol.for("@voltro/protocol/workflow-access"), an = {
+}, an = (e) => e.split("\0").join(" · "), V = Symbol.for("@voltro/protocol/workflow-access"), on = {
 	guards: void 0,
 	openAccess: void 0,
 	internal: !1
-}, on = (e, t) => {
+}, sn = (e, t) => {
 	let n = t.guards;
 	if (n !== void 0 && n.length === 0) throw Error(`workflow("${e}"): \`guards: []\` is empty, so it enforces nothing —\n  but it reads at the call site as if the start were protected. Omit the field
   and decide with \`openAccess\` or \`internal\`, or list the scopes that may start it.`);
@@ -549,16 +549,16 @@ var Ke = m.Union(m.String, m.Number), qe = m.Record({
 		openAccess: t.openAccess?.trim(),
 		internal: t.internal === !0
 	};
-}, sn = (e, t) => {
+}, cn = (e, t) => {
 	Object.defineProperty(e, V, {
 		value: t,
 		enumerable: !1
 	});
 }, H = (e) => {
-	if (typeof e != "object" || !e) return an;
+	if (typeof e != "object" || !e) return on;
 	let t = e[V];
-	return t === void 0 ? an : t;
-}, cn = (e) => {
+	return t === void 0 ? on : t;
+}, ln = (e) => {
 	let t = H(e);
 	return {
 		name: e.name,
@@ -566,9 +566,9 @@ var Ke = m.Union(m.String, m.Number), qe = m.Record({
 		guards: t.guards,
 		openAccess: t.openAccess
 	};
-}, ln = (e) => typeof e == "object" && !!e && typeof e._tag == "string", un = 64, U = (e, t = 0) => {
-	if (!ln(e)) return String(e);
-	if (t >= un) return "…";
+}, un = (e) => typeof e == "object" && !!e && typeof e._tag == "string", dn = 64, U = (e, t = 0) => {
+	if (!un(e)) return String(e);
+	if (t >= dn) return "…";
 	let n = t + 1, r = (t) => U(e[t], n), i = (t) => Array.isArray(e[t]) ? e[t] : [];
 	switch (e._tag) {
 		case "Transformation": return `T(${r("from")}->${r("to")})`;
@@ -595,23 +595,23 @@ var Ke = m.Union(m.String, m.Number), qe = m.Record({
 		case "Declaration": return `D(${i("typeParameters").map((e) => U(e, n)).join(",")})`;
 		default: return String(e);
 	}
-}, dn = (e) => {
+}, fn = (e) => {
 	let t = 2166136261;
 	for (let n = 0; n < e.length; n++) t ^= e.charCodeAt(n), t = Math.imul(t, 16777619) >>> 0;
 	return t.toString(16).padStart(8, "0");
-}, fn = (e) => dn([
+}, pn = (e) => fn([
 	U(e.payloadSchema?.ast),
 	U(e.successSchema?.ast),
 	U(e.errorSchema?.ast)
-].join("\0")), pn = (e) => {
+].join("\0")), mn = (e) => {
 	let t = {}, n = e.requests, r = n instanceof Map ? n.entries() : Array.isArray(n) ? n.map((e, t) => [t, e]) : [];
 	for (let [, e] of r) {
 		if (typeof e != "object" && typeof e != "function" || e === null) continue;
 		let n = e;
-		typeof n._tag == "string" && (t[n._tag] = fn(n));
+		typeof n._tag == "string" && (t[n._tag] = pn(n));
 	}
 	return t;
-}, mn = (e, t) => {
+}, hn = (e, t) => {
 	let n = [], r = [];
 	for (let [i, a] of Object.entries(t)) {
 		let t = e[i];
@@ -621,18 +621,18 @@ var Ke = m.Union(m.String, m.Number), qe = m.Record({
 		differing: n.sort(),
 		missingHere: r.sort()
 	};
-}, hn = (e) => e, gn = (e) => e, _n = (e) => {
+}, gn = (e) => e, _n = (e) => e, vn = (e) => {
 	let t = e.alias?.trim(), n = e.instance?.trim(), r = t !== void 0 && t !== "" ? t : e.base;
 	return n !== void 0 && n !== "" ? `${r}#${n}` : r;
-}, vn = (e) => {
+}, yn = (e) => {
 	if (e.length !== 0) return (t, n) => e.reduceRight((e, t) => t(e, n), t);
-}, yn = (e, t) => {
-	let n = Ue.GenericTag(e);
+}, bn = (e, t) => {
+	let n = We.GenericTag(e);
 	return {
 		Tag: n,
-		Live: We.succeed(n, t)
+		Live: Ge.succeed(n, t)
 	};
-}, bn = (e, t, n) => {
+}, xn = (e, t, n) => {
 	if (!t) return { ok: !0 };
 	let r = n === void 0 ? null : W(n);
 	if (!r) return {
@@ -642,7 +642,7 @@ var Ke = m.Union(m.String, m.Number), qe = m.Record({
 	let i = t.trim();
 	if (i === "*" || i === "") return { ok: !0 };
 	let a = i.split(/\s+/).filter((e) => e.length > 0);
-	for (let i of a) if (!xn(i, r)) return {
+	for (let i of a) if (!Sn(i, r)) return {
 		ok: !1,
 		reason: `plugin "${e}" requires framework ${t}, running ${n}`
 	};
@@ -655,7 +655,7 @@ var Ke = m.Union(m.String, m.Number), qe = m.Record({
 		patch: Number(t[3]),
 		pre: t[4] ?? ""
 	} : null;
-}, G = (e, t) => e.major === t.major ? e.minor === t.minor ? e.patch === t.patch ? e.pre && !t.pre ? -1 : !e.pre && t.pre ? 1 : e.pre && t.pre ? e.pre < t.pre ? -1 : +(e.pre > t.pre) : 0 : e.patch - t.patch : e.minor - t.minor : e.major - t.major, xn = (e, t) => {
+}, G = (e, t) => e.major === t.major ? e.minor === t.minor ? e.patch === t.patch ? e.pre && !t.pre ? -1 : !e.pre && t.pre ? 1 : e.pre && t.pre ? e.pre < t.pre ? -1 : +(e.pre > t.pre) : 0 : e.patch - t.patch : e.minor - t.minor : e.major - t.major, Sn = (e, t) => {
 	if (e === "*") return !0;
 	if (e.startsWith("^")) {
 		let n = W(e.slice(1));
@@ -677,50 +677,50 @@ var Ke = m.Union(m.String, m.Number), qe = m.Record({
 	}
 	let r = W(e);
 	return r ? G(t, r) === 0 : !1;
-}, Sn = (e) => {
+}, Cn = (e) => {
 	let t = e.startsWith("@") ? e.replace(/^@[^/]+\//, "") : e;
 	return (t.startsWith("plugin-") ? t.slice(7) : t).replace(/-([a-zA-Z0-9])/g, (e, t) => t.toUpperCase());
-}, Cn = (e) => {
+}, wn = (e) => {
 	let t = e.startsWith("@") ? e.replace(/^@[^/]+\//, "") : e;
 	return (t.startsWith("plugin-") ? t.slice(7) : t).replace(/#/g, "--").replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
-}, wn = Symbol.for("@voltro/protocol/pluginAliases"), K = () => {
-	let e = globalThis, t = e[wn];
+}, Tn = Symbol.for("@voltro/protocol/pluginAliases"), K = () => {
+	let e = globalThis, t = e[Tn];
 	if (t instanceof Map) return t;
 	let n = /* @__PURE__ */ new Map();
-	return e[wn] = n, n;
-}, Tn = (e) => {
+	return e[Tn] = n, n;
+}, En = (e) => {
 	let t = K();
 	for (let [n, r] of Object.entries(e)) {
 		if (r === "") continue;
 		let e = t.get(n);
 		e === void 0 ? t.set(n, /* @__PURE__ */ new Set([r])) : e.add(r);
 	}
-}, En = () => {
+}, Dn = () => {
 	K().clear();
-}, Dn = (e, t) => {
+}, On = (e, t) => {
 	let n = K().get(e);
-	if (n === void 0 || n.size === 0) return `${Sn(e)}.${t}`;
+	if (n === void 0 || n.size === 0) return `${Cn(e)}.${t}`;
 	if (n.size === 1) return `${[...n][0]}.${t}`;
 	let r = [...n].filter((e) => !e.includes("#"));
 	if (r.length === 1) return `${r[0]}.${t}`;
 	throw Error(`[voltro] ${e} is installed more than once (${[...n].sort().join(", ")}) and no single install is the primary one, so a plugin hook cannot tell which of them it addresses. Call the route by its full tag instead — e.g. useSubscription(api, '${[...n].sort()[0]}.${t}').`);
-}, q = m.Literal("running", "succeeded", "failed", "cancelled", "suspended"), On = m.Literal("cancel", "terminate", "abandon"), kn = m.Struct({
+}, q = m.Literal("running", "succeeded", "failed", "cancelled", "suspended"), kn = m.Literal("cancel", "terminate", "abandon"), An = m.Struct({
 	mode: m.String,
 	dueAt: m.NullOr(m.Number),
 	retryAfterMs: m.NullOr(m.Number),
 	intentId: m.NullOr(m.String)
-}), An = m.Struct({
+}), jn = m.Struct({
 	id: m.String,
 	workflowName: m.String,
 	executionId: m.NullOr(m.String),
 	status: m.Literal("running", "queued", "dropped", "skipped", "replayed"),
-	deferral: m.optional(kn)
-}), jn = (e, t) => {
+	deferral: m.optional(An)
+}), Mn = (e, t) => {
 	let n = H(e);
 	return h.make(e.name, {
 		payload: S(e.payloadSchema, e.name, z(n.guards)),
-		success: An,
-		error: jt({
+		success: jn,
+		error: Mt({
 			errorSchema: e.errorSchema,
 			guards: n.guards
 		}, t)
@@ -744,12 +744,12 @@ var Ke = m.Union(m.String, m.Number), qe = m.Record({
 	durationMs: m.NullOr(m.Number),
 	traceId: m.NullOr(m.String),
 	parentExecutionId: m.NullOr(m.String),
-	parentClosePolicy: m.NullOr(On)
-}), Mn = m.Struct({
+	parentClosePolicy: m.NullOr(kn)
+}), Nn = m.Struct({
 	tag: m.optional(m.String),
 	status: m.optional(q),
 	limit: m.optional(m.Number)
-}), Nn = m.Struct({
+}), Pn = m.Struct({
 	id: m.String,
 	runId: m.String,
 	stepName: m.String,
@@ -764,7 +764,7 @@ var Ke = m.Union(m.String, m.Number), qe = m.Record({
 	startedAt: m.Date,
 	completedAt: m.NullOr(m.Date),
 	durationMs: m.NullOr(m.Number)
-}), Pn = m.Struct({
+}), Fn = m.Struct({
 	id: m.String,
 	runId: m.String,
 	eventType: m.String,
@@ -772,7 +772,7 @@ var Ke = m.Union(m.String, m.Number), qe = m.Record({
 	occurredAt: m.Date,
 	stepName: m.NullOr(m.String),
 	attempt: m.NullOr(m.Number)
-}), Fn = m.Struct({
+}), In = m.Struct({
 	id: m.String,
 	name: m.String,
 	payload: m.Unknown,
@@ -780,7 +780,7 @@ var Ke = m.Union(m.String, m.Number), qe = m.Record({
 	subject: m.NullOr(m.Unknown),
 	traceId: m.NullOr(m.String),
 	occurredAt: m.Date
-}), In = m.Struct({
+}), Ln = m.Struct({
 	id: m.String,
 	eventId: m.String,
 	eventName: m.String,
@@ -793,129 +793,129 @@ var Ke = m.Union(m.String, m.Number), qe = m.Record({
 	errorMessage: m.NullOr(m.String),
 	createdAt: m.Date,
 	completedAt: m.NullOr(m.Date)
-}), Ln = m.Struct({ id: m.String }), Y = m.Struct({ runId: m.String }), Rn = m.Struct({
+}), Rn = m.Struct({ id: m.String }), Y = m.Struct({ runId: m.String }), zn = m.Struct({
 	name: m.optional(m.String),
 	limit: m.optional(m.Number)
-}), zn = m.Struct({ eventId: m.String }), X = m.Struct({
+}), Bn = m.Struct({ eventId: m.String }), X = m.Struct({
 	workflowName: m.String,
 	executionId: m.String
-}), Bn = m.Struct({
+}), Vn = m.Struct({
 	id: m.String,
 	signalName: m.String,
 	payload: m.optional(m.Unknown)
-}), Vn = m.Struct({
+}), Hn = m.Struct({
 	id: m.String,
 	updateName: m.String,
 	payload: m.optional(m.Unknown),
 	timeoutMs: m.optional(m.Number)
-}), Hn = m.Struct({
+}), Un = m.Struct({
 	eventId: m.String,
 	updateId: m.String,
 	completedEventId: m.String,
 	result: m.Unknown
-}), Un = F({
+}), Wn = F({
 	name: "__voltro.workflow.run",
 	source: "_voltro_workflow_runs",
-	input: Ln,
+	input: Rn,
 	output: m.Array(J)
-}), Wn = F({
+}), Gn = F({
 	name: "__voltro.workflow.runs",
 	source: "_voltro_workflow_runs",
-	input: Mn,
+	input: Nn,
 	output: m.Array(J)
-}), Gn = F({
+}), Kn = F({
 	name: "__voltro.workflow.run.steps",
 	source: "_voltro_workflow_run_steps",
 	input: Y,
-	output: m.Array(Nn)
-}), Kn = F({
+	output: m.Array(Pn)
+}), qn = F({
 	name: "__voltro.workflow.run.events",
 	source: "_voltro_workflow_run_events",
 	input: Y,
-	output: m.Array(Pn)
-}), qn = F({
-	name: "__voltro.workflow.domainEvents",
-	source: "_voltro_workflow_events",
-	input: Rn,
 	output: m.Array(Fn)
 }), Jn = F({
-	name: "__voltro.workflow.event.deliveries",
-	source: "_voltro_workflow_event_deliveries",
+	name: "__voltro.workflow.domainEvents",
+	source: "_voltro_workflow_events",
 	input: zn,
 	output: m.Array(In)
-}), Yn = L({
+}), Yn = F({
+	name: "__voltro.workflow.event.deliveries",
+	source: "_voltro_workflow_event_deliveries",
+	input: Bn,
+	output: m.Array(Ln)
+}), Xn = L({
 	name: "__voltro.workflow.cancel",
 	input: X,
 	output: m.Struct({ ok: m.Boolean })
-}), Xn = L({
+}), Zn = L({
 	name: "__voltro.workflow.resume",
 	input: X,
 	output: m.Struct({ ok: m.Boolean })
-}), Zn = L({
+}), Qn = L({
 	name: "__voltro.workflow.signal",
-	input: Bn,
+	input: Vn,
 	output: m.Struct({ eventId: m.String })
-}), Qn = L({
+}), $n = L({
 	name: "__voltro.workflow.update",
-	input: Vn,
-	output: Hn
-}), $n = "__voltro.undo.log", er = "__voltro.undo.apply", tr = "__voltro.undo.redo", nr = m.Struct({
+	input: Hn,
+	output: Un
+}), er = "__voltro.undo.log", tr = "__voltro.undo.apply", nr = "__voltro.undo.redo", rr = m.Struct({
 	id: m.String,
 	tag: m.String,
 	label: m.NullOr(m.String),
 	undone: m.Boolean,
 	crossesAction: m.Boolean,
 	createdAt: m.String
-}), rr = class extends m.TaggedError()("UndoNotFound", { invocationId: m.String }) {}, ir = class extends m.TaggedError()("UndoForbidden", { invocationId: m.String }) {}, ar = class extends m.TaggedError()("UndoConflict", {
+}), ir = class extends m.TaggedError()("UndoNotFound", { invocationId: m.String }) {}, ar = class extends m.TaggedError()("UndoForbidden", { invocationId: m.String }) {}, or = class extends m.TaggedError()("UndoConflict", {
 	invocationId: m.String,
 	reason: m.Literal("conflict", "action")
-}) {}, Z = m.Union(rr, ir, ar), or = F({
-	name: $n,
+}) {}, Z = m.Union(ir, ar, or), sr = F({
+	name: er,
 	source: "_voltro_undo_log",
 	input: m.Struct({ limit: m.optional(m.Number) }),
-	output: m.Array(nr),
+	output: m.Array(rr),
 	openAccess: "subject-scoped by construction: lists only the calling subject's own undoable actions"
-}), sr = I({
-	name: er,
+}), cr = I({
+	name: tr,
 	input: m.Struct({ invocationId: m.String }),
 	output: m.Struct({ ok: m.Boolean }),
 	error: Z,
 	openAccess: "subject-scoped by construction: undo is per-actor — another subject's invocation fails typed with UndoForbidden"
-}), cr = I({
-	name: tr,
+}), lr = I({
+	name: nr,
 	input: m.Struct({ invocationId: m.String }),
 	output: m.Struct({ ok: m.Boolean }),
 	error: Z,
 	openAccess: "subject-scoped by construction: redo is per-actor — another subject's invocation fails typed with UndoForbidden"
-}), lr = class extends m.TaggedError()("TenantScopeViolation", {
+}), ur = class extends m.TaggedError()("TenantScopeViolation", {
 	table: m.String,
 	reason: m.String
-}) {}, ur = class extends m.TaggedError()("StoreOperationFailed", {
+}) {}, dr = class extends m.TaggedError()("StoreOperationFailed", {
 	operation: m.String,
 	table: m.String,
 	cause: m.String
-}) {}, dr = class extends m.TaggedError()("NoRowFound", {
+}) {}, fr = class extends m.TaggedError()("NoRowFound", {
 	table: m.String,
 	found: m.Number
 }) {
 	get message() {
 		return this.found === 0 ? `expected exactly one row in '${this.table}', found none` : `expected exactly one row in '${this.table}', found more than one`;
 	}
-}, fr = class extends m.TaggedError()("TableValidationFailed", {
+}, pr = class extends m.TaggedError()("TableValidationFailed", {
 	table: m.String,
 	summary: m.String,
 	issues: m.Array(m.Struct({
 		path: m.String,
 		message: m.String
 	}))
-}) {}, pr = class extends m.TaggedError()("TenantRowNotFound", {
+}) {}, mr = class extends m.TaggedError()("TenantRowNotFound", {
 	table: m.String,
 	id: m.String,
 	reason: m.String
-}) {}, mr = class extends m.TaggedError()("ServerOnlyColumnWrite", {
+}) {}, hr = class extends m.TaggedError()("ServerOnlyColumnWrite", {
 	table: m.String,
 	columns: m.Array(m.String)
-}) {}, hr = class extends m.TaggedError()("ConstraintViolation", {
+}) {}, gr = class extends m.TaggedError()("ConstraintViolation", {
 	kind: m.Literal("foreignKey", "foreignKeyInUse", "unique", "notNull", "check"),
 	table: m.String,
 	operation: m.String,
@@ -934,14 +934,14 @@ var Ke = m.Union(m.String, m.Number), qe = m.Record({
 			case "check": return `check constraint ${t}: the row does not satisfy it`;
 		}
 	}
-}, gr = "__voltro.approvals.pending", _r = "__voltro.approvals.decide", vr = F({
-	name: gr,
+}, _r = "__voltro.approvals.pending", vr = "__voltro.approvals.decide", yr = F({
+	name: _r,
 	source: "_voltro_approvals",
 	input: m.Struct({ limit: m.optional(m.Number) }),
-	output: m.Array(mt),
+	output: m.Array(ht),
 	openAccess: "the answer is scoped to the caller — a row appears only if they requested it or hold its recorded approver scopes, so an anonymous caller sees nothing"
-}), yr = I({
-	name: _r,
+}), br = I({
+	name: vr,
 	input: m.Struct({
 		approvalId: m.String,
 		decision: m.Literal("approve", "reject"),
@@ -951,35 +951,35 @@ var Ke = m.Union(m.String, m.Number), qe = m.Record({
 		approvalId: m.String,
 		status: m.Literal("approved", "rejected")
 	}),
-	error: pt,
+	error: mt,
 	openAccess: "the approver authority is the PENDING ROW's own recorded scopes (plus an unconditional self-approval refusal), checked in-handler — a descriptor-level scope would have to be the union of every approval-requiring procedure in the app"
-}), br = "__voltro.connections.list", xr = "__voltro.connections.start", Sr = "__voltro.connections.submitToken", Cr = "__voltro.connections.disconnect", Q = m.Literal("oauth2", "pat"), wr = m.Literal("disconnected", "connected", "expired", "revoked", "error"), Tr = m.Struct({
+}), xr = "__voltro.connections.list", Sr = "__voltro.connections.start", Cr = "__voltro.connections.submitToken", wr = "__voltro.connections.disconnect", Q = m.Literal("oauth2", "pat"), Tr = m.Literal("disconnected", "connected", "expired", "revoked", "error"), Er = m.Struct({
 	connectionId: m.String,
 	kind: Q,
 	label: m.String,
-	status: wr,
+	status: Tr,
 	accountId: m.NullOr(m.String),
 	accountLabel: m.NullOr(m.String),
 	scopes: m.Array(m.String),
 	expiresAt: m.NullOr(m.String),
 	lastError: m.NullOr(m.String),
 	connectedAt: m.NullOr(m.String)
-}), Er = class extends m.TaggedError()("ConnectionNotDeclared", { connectionId: m.String }) {}, Dr = class extends m.TaggedError()("ConnectionSubjectRequired", { connectionId: m.String }) {}, Or = class extends m.TaggedError()("ConnectionKindMismatch", {
+}), Dr = class extends m.TaggedError()("ConnectionNotDeclared", { connectionId: m.String }) {}, Or = class extends m.TaggedError()("ConnectionSubjectRequired", { connectionId: m.String }) {}, kr = class extends m.TaggedError()("ConnectionKindMismatch", {
 	connectionId: m.String,
 	expected: Q,
 	actual: Q
-}) {}, kr = class extends m.TaggedError()("ConnectionHandshakeFailed", {
+}) {}, Ar = class extends m.TaggedError()("ConnectionHandshakeFailed", {
 	connectionId: m.String,
 	reason: m.String,
 	transient: m.Boolean
-}) {}, $ = m.Union(Er, Dr, Or, kr), Ar = F({
-	name: br,
+}) {}, $ = m.Union(Dr, Or, kr, Ar), jr = F({
+	name: xr,
 	source: "_voltro_connections",
 	input: m.Struct({}),
-	output: m.Array(Tr),
+	output: m.Array(Er),
 	openAccess: "self-scoped read: projects the declared connections for the calling subject only (its own connect/disconnect state)"
-}), jr = L({
-	name: xr,
+}), Mr = L({
+	name: Sr,
 	input: m.Struct({
 		connectionId: m.String,
 		redirectTo: m.optional(m.String)
@@ -990,8 +990,8 @@ var Ke = m.Union(m.String, m.Number), qe = m.Record({
 	}),
 	error: $,
 	openAccess: "self-service: begins an oauth handshake that stores a credential for the calling subject only; anonymous callers fail typed with ConnectionSubjectRequired"
-}), Mr = I({
-	name: Sr,
+}), Nr = I({
+	name: Cr,
 	input: m.Struct({
 		connectionId: m.String,
 		token: m.String
@@ -999,20 +999,20 @@ var Ke = m.Union(m.String, m.Number), qe = m.Record({
 	output: m.Struct({ ok: m.Boolean }),
 	error: $,
 	openAccess: "self-service: stores a pasted token as the calling subject's own credential; anonymous callers fail typed with ConnectionSubjectRequired"
-}), Nr = I({
-	name: Cr,
+}), Pr = I({
+	name: wr,
 	input: m.Struct({ connectionId: m.String }),
 	output: m.Struct({ ok: m.Boolean }),
 	error: $,
 	openAccess: "self-service: deletes only the calling subject's own credential row for this connection"
-}), Pr = (e) => {
+}), Fr = (e) => {
 	let t = e instanceof Date ? e.getTime() : typeof e == "number" ? e : typeof e == "string" ? new Date(e).getTime() : 0;
 	return Number.isNaN(t) ? 0 : t;
-}, Fr = 4001, Ir = /* @__PURE__ */ new Set(["/rpc", "/ws"]), Lr = (e) => {
+}, Ir = 4001, Lr = /* @__PURE__ */ new Set(["/rpc", "/ws"]), Rr = (e) => {
 	if (!e.path.startsWith("/")) throw Error(`defineWebSocket: path must be absolute, got '${e.path}'`);
-	if (Ir.has(e.path)) throw Error(`defineWebSocket: '${e.path}' is the framework's own socket surface — mount the gateway elsewhere`);
+	if (Lr.has(e.path)) throw Error(`defineWebSocket: '${e.path}' is the framework's own socket surface — mount the gateway elsewhere`);
 	if (e.auth !== "subject" && e.auth !== "public") throw Error(`defineWebSocket: auth must be 'subject' or 'public' (explicitly — an unauthenticated socket has to be a decision somebody wrote down), got '${String(e.auth)}'`);
 	return e;
-}, Rr = 1;
+}, zr = 1;
 //#endregion
-export { De as ADMIN_SCOPE, Se as APIKEY_ISSUE_ORG_SCOPE, Te as APIKEY_ISSUE_OTHER_SCOPE, _e as APIKEY_ISSUE_SELF_SCOPE, _r as APPROVALS_DECIDE_TAG, gr as APPROVALS_PENDING_TAG, pt as ApprovalDecisionErrors, ft as ApprovalErrors, C as ApprovalExpired, dt as ApprovalForbidden, st as ApprovalNotFound, ut as ApprovalNotPending, lt as ApprovalRejected, ot as ApprovalRequired, ct as ApprovalSelfApproval, w as ApprovalUnavailable, se as AuthMiddleware, tt as BusinessRuleViolation, br as CONNECTIONS_LIST_TAG, Cr as CONNECTION_DISCONNECT_TAG, xr as CONNECTION_START_TAG, Sr as CONNECTION_SUBMIT_TOKEN_TAG, kr as ConnectionHandshakeFailed, i as ConnectionInfo, r as ConnectionInfoMiddleware, Q as ConnectionKind, Or as ConnectionKindMismatch, Er as ConnectionNotDeclared, Tr as ConnectionState, wr as ConnectionStatus, Dr as ConnectionSubjectRequired, hr as ConstraintViolation, ie as DEFAULT_SCOPE_CACHE_MAX_ENTRIES, ye as DEFAULT_SCOPE_CACHE_TTL_MS, en as EVENT_ROUTE_SEP, Zt as EventKeyInvalid, Xt as EventPayloadInvalid, Qt as EventPayloadTooLarge, Fr as GATEWAY_CREDENTIAL_EXPIRED_CLOSE_CODE, e as IMPERSONATION_METADATA_KEY, Bt as MAX_EVENT_ENVELOPE_BYTES, ze as MUTATION_IN_FLIGHT_RETRY_AFTER_MS, p as MutationConnectionRequired, Ne as MutationInFlight, dr as NoRowFound, Rr as PROTOCOL_VERSION, mt as PendingApproval, T as REACTIVITY_CHANNEL_PREFIX, u as ScopeError, mr as ServerOnlyColumnWrite, ur as StoreOperationFailed, ve as Subject, ne as SubjectIdentity, re as SubjectService, fr as TableValidationFailed, pr as TenantRowNotFound, lr as TenantScopeViolation, er as UNDO_APPLY_TAG, $n as UNDO_LOG_TAG, tr as UNDO_REDO_TAG, l as Unauthenticated, ar as UndoConflict, ir as UndoForbidden, nr as UndoLogEntry, rr as UndoNotFound, rt as ValidationError, it as ValidationErrors, nt as ValidationIssue, V as WorkflowAccessProperty, X as WorkflowControlInputSchema, Fn as WorkflowDomainEventRowSchema, Rn as WorkflowDomainEventsInputSchema, zn as WorkflowEventDeliveriesInputSchema, In as WorkflowEventDeliveryRowSchema, On as WorkflowParentClosePolicySchema, Pn as WorkflowRunEventRowSchema, An as WorkflowRunHandleSchema, Ln as WorkflowRunRefSchema, J as WorkflowRunRowSchema, q as WorkflowRunStatusSchema, Nn as WorkflowRunStepRowSchema, Y as WorkflowRunTableRefSchema, Mn as WorkflowRunsInputSchema, Bn as WorkflowSignalInputSchema, kn as WorkflowStartDeferralSchema, Vn as WorkflowUpdateInputSchema, Hn as WorkflowUpdateResultSchema, Ft as actionToRpc, Ce as advisoryResourceGuardWarning, a as anonymousSubject, $e as applyRowPatch, c as applyScopeDecision, yr as approvalsDecideDescriptor, vr as approvalsPendingQueryDescriptor, te as assertAuthenticated, sn as attachWorkflowAccess, Re as beginIdempotent, bn as checkFrameworkCompat, Ee as checkGuards, pe as checkGuardsEffect, mn as compareSurfaces, ae as composeAuthStrategies, vn as composeRpcInterceptors, Nr as connectionDisconnectDescriptor, jr as connectionStartDescriptor, Mr as connectionSubmitTokenDescriptor, Ar as connectionsListQueryDescriptor, k as declaredReactivityChannelKeys, L as defineAction, Ht as defineEvent, I as defineMutation, hn as definePlugin, gn as definePluginRoute, yn as definePluginService, F as defineQuery, Et as defineStream, Lr as defineWebSocket, Ze as diffRows, be as effectiveScopes, $t as encodeEventKey, Lt as errorTag, Gt as eventAttached, Ut as eventEnvelope, Wt as eventGap, qt as eventResumePoint, tn as eventRoute, Kt as eventStreamEvent, Jt as eventSubscribeInput, Yt as eventToRpc, Be as failIdempotent, at as fieldIssuesOf, Oe as findAdvisoryResourceGuards, Pe as finishIdempotent, rn as formatEventRoute, me as getPolicyGuardResolver, he as getResourceScopeResolver, H as getWorkflowAccess, pn as groupShapeDigests, Tt as hasAccessDecision, Me as hasCallbackRoutes, we as hasEffectiveScope, z as hasEnforcedGuard, xe as hasScope, g as idToPath, Ie as idempotencyScope, x as inputLabel, ge as isAuthenticatedCheck, wt as isAuthenticatedGuard, Vt as isEventDescriptor, Qe as isIdKeyed, d as isOpenAccess, de as isPolicyCheck, Ct as isPolicyGuard, D as isReactivityChannel, O as isReactivityChannelKey, t as isSystemSubject, xt as isWireReachable, le as makeScopeCache, He as memoryIdempotencyStore, ke as missingAccessDecision, Pt as mutationToRpc, zt as normalizeDescriptor, M as normalizeSource, f as openAccessSpec, nn as parseEventRoute, _ as pathToId, Sn as pluginAlias, _n as pluginInstanceName, Cn as pluginSlug, Dn as pluginTag, fn as procedureShapeDigest, bt as publishReactivity, Ve as publishServerError, Nt as queryToRpc, s as rawImpersonationMark, vt as reactivityChannel, Tn as registerPluginAliases, fe as requireScope, En as resetPluginAliases, on as resolveWorkflowAccess, Je as rowPatchOpSchema, Ye as rowPatchSchema, U as schemaShape, ce as scopeCacheKey, je as setEffectiveScopes, oe as setPolicyGuardResolver, n as setResourceScopeResolver, dn as shapeDigest, j as sourceKeys, It as streamToRpc, S as strictInput, ue as subjectIdentity, Ae as subjectScopes, Le as subscribeServerErrors, b as subscriptionEvent, o as systemSubject, ee as tenantScopedSubject, Rt as toRpc, Pr as tsMs, yt as undeclaredChannelKeys, sr as undoApplyDescriptor, or as undoLogQueryDescriptor, cr as undoRedoDescriptor, B as wireErrorUnion, Mt as withRpcTag, cn as workflowAccessDescriptor, Yn as workflowCancelDescriptor, qn as workflowDomainEventsQueryDescriptor, Jn as workflowEventDeliveriesQueryDescriptor, Xn as workflowResumeDescriptor, Kn as workflowRunEventsQueryDescriptor, Un as workflowRunQueryDescriptor, Gn as workflowRunStepsQueryDescriptor, Wn as workflowRunsQueryDescriptor, Zn as workflowSignalDescriptor, jn as workflowToRpc, Qn as workflowUpdateDescriptor, jt as workflowWireErrorUnion, Fe as wsMutationIdempotencyScope };
+export { Oe as ADMIN_SCOPE, Se as APIKEY_ISSUE_ORG_SCOPE, Ee as APIKEY_ISSUE_OTHER_SCOPE, _e as APIKEY_ISSUE_SELF_SCOPE, vr as APPROVALS_DECIDE_TAG, _r as APPROVALS_PENDING_TAG, mt as ApprovalDecisionErrors, pt as ApprovalErrors, C as ApprovalExpired, ft as ApprovalForbidden, ct as ApprovalNotFound, dt as ApprovalNotPending, ut as ApprovalRejected, st as ApprovalRequired, lt as ApprovalSelfApproval, w as ApprovalUnavailable, se as AuthMiddleware, nt as BusinessRuleViolation, xr as CONNECTIONS_LIST_TAG, wr as CONNECTION_DISCONNECT_TAG, Sr as CONNECTION_START_TAG, Cr as CONNECTION_SUBMIT_TOKEN_TAG, Ar as ConnectionHandshakeFailed, i as ConnectionInfo, r as ConnectionInfoMiddleware, Q as ConnectionKind, kr as ConnectionKindMismatch, Dr as ConnectionNotDeclared, Er as ConnectionState, Tr as ConnectionStatus, Or as ConnectionSubjectRequired, gr as ConstraintViolation, ie as DEFAULT_SCOPE_CACHE_MAX_ENTRIES, ye as DEFAULT_SCOPE_CACHE_TTL_MS, tn as EVENT_ROUTE_SEP, Qt as EventKeyInvalid, Zt as EventPayloadInvalid, $t as EventPayloadTooLarge, Ir as GATEWAY_CREDENTIAL_EXPIRED_CLOSE_CODE, e as IMPERSONATION_METADATA_KEY, Vt as MAX_EVENT_ENVELOPE_BYTES, Be as MUTATION_IN_FLIGHT_RETRY_AFTER_MS, p as MutationConnectionRequired, Pe as MutationInFlight, fr as NoRowFound, zr as PROTOCOL_VERSION, ht as PendingApproval, T as REACTIVITY_CHANNEL_PREFIX, u as ScopeError, hr as ServerOnlyColumnWrite, dr as StoreOperationFailed, ve as Subject, ne as SubjectIdentity, re as SubjectService, pr as TableValidationFailed, mr as TenantRowNotFound, ur as TenantScopeViolation, tr as UNDO_APPLY_TAG, er as UNDO_LOG_TAG, nr as UNDO_REDO_TAG, l as Unauthenticated, or as UndoConflict, ar as UndoForbidden, rr as UndoLogEntry, ir as UndoNotFound, it as ValidationError, at as ValidationErrors, rt as ValidationIssue, V as WorkflowAccessProperty, X as WorkflowControlInputSchema, In as WorkflowDomainEventRowSchema, zn as WorkflowDomainEventsInputSchema, Bn as WorkflowEventDeliveriesInputSchema, Ln as WorkflowEventDeliveryRowSchema, kn as WorkflowParentClosePolicySchema, Fn as WorkflowRunEventRowSchema, jn as WorkflowRunHandleSchema, Rn as WorkflowRunRefSchema, J as WorkflowRunRowSchema, q as WorkflowRunStatusSchema, Pn as WorkflowRunStepRowSchema, Y as WorkflowRunTableRefSchema, Nn as WorkflowRunsInputSchema, Vn as WorkflowSignalInputSchema, An as WorkflowStartDeferralSchema, Hn as WorkflowUpdateInputSchema, Un as WorkflowUpdateResultSchema, It as actionToRpc, Ce as advisoryResourceGuardWarning, a as anonymousSubject, et as applyRowPatch, c as applyScopeDecision, br as approvalsDecideDescriptor, yr as approvalsPendingQueryDescriptor, te as assertAuthenticated, cn as attachWorkflowAccess, ze as beginIdempotent, xn as checkFrameworkCompat, De as checkGuards, pe as checkGuardsEffect, hn as compareSurfaces, ae as composeAuthStrategies, yn as composeRpcInterceptors, Pr as connectionDisconnectDescriptor, Mr as connectionStartDescriptor, Nr as connectionSubmitTokenDescriptor, jr as connectionsListQueryDescriptor, k as declaredReactivityChannelKeys, L as defineAction, Ut as defineEvent, I as defineMutation, gn as definePlugin, _n as definePluginRoute, bn as definePluginService, F as defineQuery, Dt as defineStream, Rr as defineWebSocket, Qe as diffRows, be as effectiveScopes, en as encodeEventKey, Rt as errorTag, Kt as eventAttached, Wt as eventEnvelope, Gt as eventGap, Jt as eventResumePoint, nn as eventRoute, qt as eventStreamEvent, Yt as eventSubscribeInput, Xt as eventToRpc, Ve as failIdempotent, ot as fieldIssuesOf, ke as findAdvisoryResourceGuards, Fe as finishIdempotent, an as formatEventRoute, me as getPolicyGuardResolver, he as getResourceScopeResolver, H as getWorkflowAccess, mn as groupShapeDigests, Et as hasAccessDecision, Ne as hasCallbackRoutes, we as hasEffectiveScope, z as hasEnforcedGuard, xe as hasScope, g as idToPath, Le as idempotencyScope, x as inputLabel, ge as isAuthenticatedCheck, Tt as isAuthenticatedGuard, Ht as isEventDescriptor, $e as isIdKeyed, d as isOpenAccess, de as isPolicyCheck, wt as isPolicyGuard, D as isReactivityChannel, O as isReactivityChannelKey, t as isSystemSubject, St as isWireReachable, le as makeScopeCache, Ue as memoryIdempotencyStore, Ae as missingAccessDecision, Ft as mutationToRpc, Bt as normalizeDescriptor, M as normalizeSource, f as openAccessSpec, s as orderByBearerPrefix, rn as parseEventRoute, _ as pathToId, Cn as pluginAlias, vn as pluginInstanceName, wn as pluginSlug, On as pluginTag, pn as procedureShapeDigest, xt as publishReactivity, He as publishServerError, Pt as queryToRpc, ce as rawImpersonationMark, yt as reactivityChannel, En as registerPluginAliases, fe as requireScope, Dn as resetPluginAliases, sn as resolveWorkflowAccess, Ye as rowPatchOpSchema, Xe as rowPatchSchema, U as schemaShape, ue as scopeCacheKey, Me as setEffectiveScopes, oe as setPolicyGuardResolver, n as setResourceScopeResolver, fn as shapeDigest, j as sourceKeys, Lt as streamToRpc, S as strictInput, o as subjectIdentity, je as subjectScopes, Re as subscribeServerErrors, b as subscriptionEvent, ee as systemSubject, Te as tenantScopedSubject, zt as toRpc, Fr as tsMs, bt as undeclaredChannelKeys, cr as undoApplyDescriptor, sr as undoLogQueryDescriptor, lr as undoRedoDescriptor, B as wireErrorUnion, Nt as withRpcTag, ln as workflowAccessDescriptor, Xn as workflowCancelDescriptor, Jn as workflowDomainEventsQueryDescriptor, Yn as workflowEventDeliveriesQueryDescriptor, Zn as workflowResumeDescriptor, qn as workflowRunEventsQueryDescriptor, Wn as workflowRunQueryDescriptor, Kn as workflowRunStepsQueryDescriptor, Gn as workflowRunsQueryDescriptor, Qn as workflowSignalDescriptor, Mn as workflowToRpc, $n as workflowUpdateDescriptor, Mt as workflowWireErrorUnion, Ie as wsMutationIdempotencyScope };