@voltro/protocol 0.74.0 → 0.76.0

package/dist/index.js

@@ -1,4 +1,4 @@
-import { $ as e, A as t, B as n, C as r, D as i, E as a, F as o, G as s, H as c, I as l, J as ee, K as te, L as ne, M as re, N as ie, O as ae, P as oe, Q as se, R as ce, S as le, T as ue, U as de, V as fe, W as pe, X as me, Y as he, Z as ge, _ as u, a as _e, b as d, c as ve, d as ye, f as be, g as xe, h as Se, i as Ce, j as we, k as Te, l as Ee, m as De, n as Oe, o as f, p as ke, q as Ae, r as je, s as Me, t as Ne, u as Pe, v as Fe, w as Ie, x as Le, y as Re, z as ze } from "./scopes-Dj7KCJab.js";
+import { $ as e, A as t, B as n, C as r, D as i, E as a, F as o, G as s, H as c, I as l, J as ee, K as te, L as ne, M as re, N as ie, O as ae, P as oe, Q as se, R as ce, S as le, T as ue, U as de, V as fe, W as pe, X as me, Y as he, Z as ge, _ as u, a as _e, b as d, c as ve, d as ye, f as be, g as xe, h as Se, i as Ce, j as we, k as Te, l as Ee, m as De, n as Oe, o as f, p as ke, q as Ae, r as je, s as Me, t as Ne, u as Pe, v as Fe, w as Ie, x as Le, y as Re, z as ze } from "./scopes-D2dnEr4U.js";
 import { C as Be, D as Ve, E as He, S as Ue, T as We, _ as Ge, a as Ke, b as qe, c as Je, d as Ye, f as Xe, g as Ze, h as Qe, i as $e, l as et, m as tt, n as nt, o as rt, p as it, r as at, s as ot, t as st, u as ct, v as lt, w as ut, x as dt, y as ft } from "./restFormat-ChSVyufA.js";
 import { Context as pt, Layer as mt, Schema as p } from "effect";
 import { Rpc as m } from "@effect/rpc";
@@ -252,14 +252,14 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 		toString: () => n
 	});
 	return T.set(e, r), r;
-}, Ut = (e) => typeof e == "object" && !!e && e.kind === "reactivity-channel", Wt = (e) => e.startsWith(w), Gt = () => new Set([...T.values()].map((e) => e.key)), E = (e) => Ut(e) ? e.key : e, D = (e) => e === void 0 ? [] : Array.isArray(e) ? e.map(E) : [E(e)], O = (e) => e === void 0 ? void 0 : Array.isArray(e) ? e.map(E) : E(e), Kt = (e) => {
+}, Ut = (e) => typeof e == "object" && !!e && e.kind === "reactivity-channel", Wt = (e) => e.startsWith(w), Gt = () => new Set([...T.values()].map((e) => e.key)), E = (e) => Ut(e) ? e.key : e, Kt = (e) => e === void 0 ? [] : Array.isArray(e) ? e.map(E) : [E(e)], qt = (e) => e === void 0 ? void 0 : Array.isArray(e) ? e.map(E) : E(e), Jt = (e) => {
 	let t = Gt(), n = [];
-	for (let r of e) for (let e of D(r.source)) Wt(e) && !t.has(e) && n.push({
+	for (let r of e) for (let e of Kt(r.source)) Wt(e) && !t.has(e) && n.push({
 		procedure: r.name,
 		key: e
 	});
 	return n;
-}, qt = (e, t) => {
+}, Yt = (e, t) => {
 	let n = e?.injectExternalChange;
 	return n !== void 0 && (n.call(e, {
 		table: t.key,
@@ -268,8 +268,8 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 		old: {},
 		origin: "inline"
 	}), !0);
-}, Jt = (e) => e.internal !== !0, k = (e) => {
-	if (Yt(e), e.idempotencyScope !== void 0 && e.idempotencyScope !== "subject" && e.idempotencyScope !== "connection") throw Error(`${e.name}: idempotencyScope must be 'subject' or 'connection'`);
+}, Xt = (e) => e.internal !== !0, D = (e) => {
+	if (Zt(e), e.idempotencyScope !== void 0 && e.idempotencyScope !== "subject" && e.idempotencyScope !== "connection") throw Error(`${e.name}: idempotencyScope must be 'subject' or 'connection'`);
 	let t = e.serialize;
 	if (t !== void 0) {
 		if (typeof t.key != "function") throw Error(`${e.name}: serialize.key must be a function of the input`);
@@ -293,7 +293,7 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 	let r = [e.publicApi === void 0 ? void 0 : "publicApi", e.exposeAsTool === void 0 ? void 0 : "exposeAsTool"].filter((e) => e !== void 0);
 	if (r.length === 0) return e;
 	throw Error(`${e.name}: \`internal: true\` cannot be combined with ${r.map((e) => `\`${e}\``).join(" or ")}. \`internal\` takes the procedure OFF the wire; those put it back ON a different one (${r.includes("publicApi") ? "a REST route" : "an agent tool"}), and that surface is projected without consulting the flag — so the procedure would be unreachable from your client and reachable from the internet. Drop \`internal: true\` if the wider surface is intended, or remove the ${r.join(" / ")} annotation if it is not.`);
-}, Yt = (e) => {
+}, Zt = (e) => {
 	let t = e.requiresApproval;
 	if (t !== void 0) {
 		if (!Array.isArray(t.approvers) || t.approvers.length === 0) throw Error(`${e.name}: \`requiresApproval.approvers\` is empty, so NOBODY can approve this\n  procedure and every call would park forever. Name the scope(s) an approver must hold
@@ -303,28 +303,28 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
   human from every other, and the second-pair-of-eyes control would enforce nothing.
   Give the procedure a \`guards:\` decision, or drop \`requiresApproval\`.`);
 	}
-}, Xt = (e) => e.action !== void 0 && e.resourceType !== void 0, Zt = (e) => e.authenticated === !0, Qt = (e) => e.openAccess !== void 0 || e.guards !== void 0 && e.guards.length > 0, A = (e, t, n) => {
+}, Qt = (e) => e.action !== void 0 && e.resourceType !== void 0, $t = (e) => e.authenticated === !0, en = (e) => e.openAccess !== void 0 || e.guards !== void 0 && e.guards.length > 0, O = (e, t, n) => {
 	if (n === void 0) return t;
 	if (n.trim() === "") throw Error(`${e}: \`openAccess\` needs a REASON, not an empty string. It is the sentence a\n  reviewer reads to decide whether this procedure should really be callable
   without an authorization check — e.g. \`openAccess: 'public pricing, no caller data'\`.`);
 	if (t !== void 0 && t.length > 0) throw Error(`${e}: \`openAccess\` and \`guards\` are two different access decisions, so\n  declaring both says the procedure is protected AND open. Keep the guards if a
   caller must hold a scope; drop them if anyone may call it.`);
 	return [d(n.trim())];
-}, j = (e) => k({
+}, k = (e) => D({
 	kind: "query",
 	name: e.name,
 	input: e.input,
 	output: e.output,
 	error: e.error ?? p.Never,
-	source: O(e.source),
+	source: qt(e.source),
 	cache: e.cache,
-	guards: A(e.name, e.guards, e.openAccess),
+	guards: O(e.name, e.guards, e.openAccess),
 	openAccess: e.openAccess,
 	publicApi: e.publicApi,
 	exposeAsTool: e.exposeAsTool,
 	internal: e.internal,
 	overridesPlugin: e.overridesPlugin
-}), M = (e) => k({
+}), A = (e) => D({
 	kind: "mutation",
 	name: e.name,
 	input: e.input,
@@ -333,20 +333,20 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 	...e.idempotencyScope === void 0 ? {} : { idempotencyScope: e.idempotencyScope },
 	...e.serialize === void 0 ? {} : { serialize: e.serialize },
 	target: e.target,
-	guards: A(e.name, e.guards, e.openAccess),
+	guards: O(e.name, e.guards, e.openAccess),
 	openAccess: e.openAccess,
 	publicApi: e.publicApi,
 	exposeAsTool: e.exposeAsTool,
 	requiresApproval: e.requiresApproval,
 	internal: e.internal,
 	overridesPlugin: e.overridesPlugin
-}), N = (e) => k({
+}), j = (e) => D({
 	kind: "action",
 	name: e.name,
 	input: e.input,
 	output: e.output,
 	error: e.error ?? p.Never,
-	guards: A(e.name, e.guards, e.openAccess),
+	guards: O(e.name, e.guards, e.openAccess),
 	openAccess: e.openAccess,
 	source: e.source,
 	target: e.target,
@@ -355,7 +355,7 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 	requiresApproval: e.requiresApproval,
 	internal: e.internal,
 	overridesPlugin: e.overridesPlugin
-}), $t = (e) => k({
+}), tn = (e) => D({
 	kind: "stream",
 	name: e.name,
 	input: e.input,
@@ -363,47 +363,47 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 	error: e.error ?? p.Never,
 	internal: e.internal,
 	overridesPlugin: e.overridesPlugin,
-	guards: A(e.name, e.guards, e.openAccess),
+	guards: O(e.name, e.guards, e.openAccess),
 	openAccess: e.openAccess
-}), P = (e, t) => t && t.length > 0 ? p.Union(e, ...t) : e, F = (e) => e !== void 0 && e.some((e) => !u(e)), en = (e, t) => F(t) ? p.Union(e, f, l) : e, tn = (e) => p.Union(e, Tt), nn = (e) => p.Union(e, Dt, Ot), rn = (e, t) => t === void 0 ? e : p.Union(e, It), I = (e, t) => {
+}), M = (e, t) => t && t.length > 0 ? p.Union(e, ...t) : e, N = (e) => e !== void 0 && e.some((e) => !u(e)), nn = (e, t) => N(t) ? p.Union(e, f, l) : e, rn = (e) => p.Union(e, Tt), an = (e) => p.Union(e, Dt, Ot), on = (e, t) => t === void 0 ? e : p.Union(e, It), P = (e, t) => {
 	if (t === "stream") return e.error;
-	let n = en(e.error, e.guards);
+	let n = nn(e.error, e.guards);
 	if (t === "query") return n;
-	let r = t === "mutation" ? p.Union(tn(n), dt, ht) : n;
-	return rn(nn(t === "mutation" && e.idempotencyScope === "connection" ? p.Union(r, qe) : r), e.requiresApproval);
-}, an = (e, t) => P(en(e.errorSchema, e.guards), t), on = (e, t) => ({
+	let r = t === "mutation" ? p.Union(rn(n), dt, ht) : n;
+	return on(an(t === "mutation" && e.idempotencyScope === "connection" ? p.Union(r, qe) : r), e.requiresApproval);
+}, sn = (e, t) => M(nn(e.errorSchema, e.guards), t), cn = (e, t) => ({
 	...e,
 	name: t
-}), sn = (e, t) => m.make(e.name, {
-	payload: x(e.input, e.name, F(e.guards)),
+}), ln = (e, t) => m.make(e.name, {
+	payload: x(e.input, e.name, N(e.guards)),
 	success: y(e.output),
-	error: P(I(e, "query"), t),
+	error: M(P(e, "query"), t),
 	stream: !0
-}), cn = (e, t) => m.make(e.name, {
-	payload: x(e.input, e.name, F(e.guards)),
+}), un = (e, t) => m.make(e.name, {
+	payload: x(e.input, e.name, N(e.guards)),
 	success: e.output,
-	error: P(I(e, "mutation"), t)
-}), ln = (e, t) => m.make(e.name, {
-	payload: x(e.input, e.name, F(e.guards)),
+	error: M(P(e, "mutation"), t)
+}), dn = (e, t) => m.make(e.name, {
+	payload: x(e.input, e.name, N(e.guards)),
 	success: e.output,
-	error: P(I(e, "action"), t)
-}), un = (e, t) => m.make(e.name, {
-	payload: x(e.input, e.name, F(e.guards)),
+	error: M(P(e, "action"), t)
+}), fn = (e, t) => m.make(e.name, {
+	payload: x(e.input, e.name, N(e.guards)),
 	success: e.element,
-	error: P(e.error, t),
+	error: M(e.error, t),
 	stream: !0
-}), dn = (e) => {
+}), pn = (e) => {
 	if (typeof e != "object" || !e) return;
 	let t = e._tag;
 	return typeof t == "string" ? t : void 0;
-}, fn = (e) => {
+}, mn = (e) => {
 	switch (e.kind) {
-		case "query": return sn(e);
-		case "mutation": return cn(e);
-		case "action": return ln(e);
-		case "stream": return un(e);
+		case "query": return ln(e);
+		case "mutation": return un(e);
+		case "action": return dn(e);
+		case "stream": return fn(e);
 	}
-}, pn = (e) => {
+}, hn = (e) => {
 	let t = e.input, n = t === void 0 ? {} : { input: t }, r = e.output, i = r === void 0 ? {} : { output: r };
 	if (e.kind === "query") return {
 		kind: "query",
@@ -449,7 +449,7 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 			..."relations" in e && e.relations !== void 0 ? { relations: e.relations } : {}
 		}))
 	};
-}, mn = 7500, hn = (e) => typeof e == "object" && !!e && e.kind === "event", gn = (e) => {
+}, gn = 7500, _n = (e) => typeof e == "object" && !!e && e.kind === "event", vn = (e) => {
 	if (e.name.length === 0) throw Error("defineEvent: `name` must not be empty");
 	if (/\s/.test(e.name)) throw Error(`defineEvent("${e.name}"): \`name\` must not contain whitespace.\n  The name is used as a broker subject segment. NATS refuses a subject with
   whitespace and delivers nothing — silently, and only on that broker, so an
@@ -484,60 +484,62 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 		webhook: e.webhook,
 		delivery: e.delivery
 	};
-}, _n = (e) => p.Struct({
+}, yn = (e) => p.Struct({
 	_tag: p.Literal("event"),
 	origin: p.String,
 	n: p.Number,
 	emittedAt: p.Number,
 	payload: e
-}), vn = p.Struct({
+}), bn = p.Struct({
 	_tag: p.Literal("gap"),
 	missed: p.Number,
 	reason: p.Literal("buffer", "resume")
-}), yn = p.Struct({ _tag: p.Literal("attached") }), bn = (e) => p.Union(yn, _n(e), vn), xn = p.Struct({
+}), xn = p.Struct({ _tag: p.Literal("attached") }), Sn = (e) => p.Union(xn, yn(e), bn), Cn = p.Struct({
 	origin: p.String,
 	n: p.Number
-}), Sn = (e) => p.Struct({
+}), wn = (e) => p.Struct({
 	key: e,
-	resume: p.optional(p.Array(xn))
-}), Cn = (e, t) => {
+	resume: p.optional(p.Array(Cn))
+}), Tn = (e, t) => {
 	let n = e.guards !== void 0 && e.guards.some((e) => !u(e)) ? p.Union(f, l) : p.Never, r = t && t.length > 0 ? p.Union(n, ...t) : n;
 	return m.make(e.name, {
-		payload: x(Sn(e.key), e.name, F(e.guards)),
-		success: bn(e.payload),
+		payload: x(wn(e.key), e.name, N(e.guards)),
+		success: Sn(e.payload),
 		error: r,
 		stream: !0
 	});
-}, wn = class extends p.TaggedError()("EventPayloadInvalid", {
+}, En = class extends p.TaggedError()("EventPayloadInvalid", {
 	event: p.String,
 	message: p.String
-}) {}, Tn = class extends p.TaggedError()("EventKeyInvalid", {
+}) {}, Dn = class extends p.TaggedError()("EventKeyInvalid", {
 	event: p.String,
 	message: p.String
-}) {}, En = class extends p.TaggedError()("EventPayloadTooLarge", {
+}) {}, On = class extends p.TaggedError()("EventPayloadTooLarge", {
 	event: p.String,
 	bytes: p.Number,
 	limit: p.Number
-}) {}, Dn = (e) => {
+}) {}, kn = (e) => {
 	if (typeof e != "object" || !e) return JSON.stringify(e) ?? "null";
 	let t = Object.entries(e).filter(([, e]) => e !== void 0).sort(([e], [t]) => e < t ? -1 : +(e > t));
 	return JSON.stringify(t);
-}, On = "\0", kn = (e, t, n) => [
+}, An = "\0", jn = (e, t, n) => [
 	e ?? "~",
 	t,
-	Dn(n)
-].join("\0"), An = (e) => {
+	kn(n)
+].join("\0"), Mn = (e) => {
 	let [t = "~", n = "", r = ""] = e.split("\0");
 	return {
 		tenantId: t === "~" ? null : t,
 		event: n,
 		key: r
 	};
-}, jn = (e) => e.split("\0").join(" · "), L = Symbol.for("@voltro/protocol/workflow-access"), Mn = {
+}, Nn = (e) => e.split("\0").join(" · "), F = Symbol.for("@voltro/protocol/workflow-access"), Pn = {
 	guards: void 0,
 	openAccess: void 0,
-	internal: !1
-}, Nn = (e, t) => {
+	internal: !1,
+	controls: void 0,
+	controlsOpenAccess: void 0
+}, Fn = (e, t) => {
 	let n = t.guards;
 	if (n !== void 0 && n.length === 0) throw Error(`workflow("${e}"): \`guards: []\` is empty, so it enforces nothing —\n  but it reads at the call site as if the start were protected. Omit the field
   and decide with \`openAccess\` or \`internal\`, or list the scopes that may start it.`);
@@ -552,42 +554,55 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
   \`openAccess\` (an internal workflow needs no wire decision), or drop
   \`internal: true\` if the workflow really is meant to be startable by clients.`);
 	}
+	let r = t.controls?.guards, i = t.controls?.openAccess;
+	if (r !== void 0 && r.length === 0) throw Error(`workflow("${e}"): \`controls: { guards: [] }\` is empty, so it enforces nothing —\n  but it reads at the call site as if driving this run were protected. Omit
+  \`controls\` (wire control is then refused for everyone but \`admin:full\`), or
+  list the scopes a caller needs to cancel or signal a run.`);
+	if (i !== void 0) {
+		if (i.trim() === "") throw Error(`workflow("${e}"): \`controls: { openAccess }\` needs a REASON, not an empty string.\n  It is the sentence a reviewer reads to decide whether anyone who can see this
+  run should be able to cancel or signal it — e.g. \`controls: { openAccess:
+  'the run belongs to the caller who started it; cancelling it affects nobody else' }\`.`);
+		if (r !== void 0 && r.length > 0) throw Error(`workflow("${e}"): \`controls\` takes \`guards\` OR \`openAccess\`, not both.\n  Two answers to one question; keep the guards if a caller needs a scope.`);
+	}
 	return {
 		guards: t.openAccess === void 0 ? t.guards : [d(t.openAccess.trim())],
 		openAccess: t.openAccess?.trim(),
-		internal: t.internal === !0
+		internal: t.internal === !0,
+		controls: i === void 0 ? r : [d(i.trim())],
+		controlsOpenAccess: i?.trim()
 	};
-}, Pn = (e, t) => {
-	Object.defineProperty(e, L, {
+}, In = (e, t) => {
+	Object.defineProperty(e, F, {
 		value: t,
 		enumerable: !1
 	});
-}, R = (e) => {
-	if (typeof e != "object" || !e) return Mn;
-	let t = e[L];
-	return t === void 0 ? Mn : t;
-}, Fn = (e) => {
-	let t = R(e);
+}, I = (e) => {
+	if (typeof e != "object" || !e) return Pn;
+	let t = e[F];
+	return t === void 0 ? Pn : t;
+}, Ln = (e) => {
+	let t = I(e);
 	return {
 		name: e.name,
 		internal: t.internal,
 		guards: t.guards,
-		openAccess: t.openAccess
+		openAccess: t.openAccess,
+		controls: t.controls
 	};
-}, In = (e) => e, Ln = (e) => e, Rn = (e) => {
+}, Rn = (e) => e, zn = (e) => e, Bn = (e) => {
 	let t = e.alias?.trim(), n = e.instance?.trim(), r = t !== void 0 && t !== "" ? t : e.base;
 	return n !== void 0 && n !== "" ? `${r}#${n}` : r;
-}, zn = (e) => {
+}, Vn = (e) => {
 	if (e.length !== 0) return (t, n) => e.reduceRight((e, t) => t(e, n), t);
-}, Bn = (e, t) => {
+}, Hn = (e, t) => {
 	let n = pt.GenericTag(e);
 	return {
 		Tag: n,
 		Live: mt.succeed(n, t)
 	};
-}, Vn = (e, t, n) => {
+}, Un = (e, t, n) => {
 	if (!t) return { ok: !0 };
-	let r = n === void 0 ? null : z(n);
+	let r = n === void 0 ? null : L(n);
 	if (!r) return {
 		ok: !0,
 		unverified: `plugin "${e}" requires framework ${t}, but the running framework version is ${n === void 0 ? "unknown" : `unreadable ("${n}")`} — not checked.`
@@ -595,12 +610,12 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 	let i = t.trim();
 	if (i === "*" || i === "") return { ok: !0 };
 	let a = i.split(/\s+/).filter((e) => e.length > 0);
-	for (let i of a) if (!Hn(i, r)) return {
+	for (let i of a) if (!Wn(i, r)) return {
 		ok: !1,
 		reason: `plugin "${e}" requires framework ${t}, running ${n}`
 	};
 	return { ok: !0 };
-}, z = (e) => {
+}, L = (e) => {
 	let t = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9a-zA-Z.-]+))?$/.exec(e.trim());
 	return t ? {
 		major: Number(t[1]),
@@ -608,56 +623,56 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 		patch: Number(t[3]),
 		pre: t[4] ?? ""
 	} : null;
-}, B = (e, t) => e.major === t.major ? e.minor === t.minor ? e.patch === t.patch ? e.pre && !t.pre ? -1 : !e.pre && t.pre ? 1 : e.pre && t.pre ? e.pre < t.pre ? -1 : +(e.pre > t.pre) : 0 : e.patch - t.patch : e.minor - t.minor : e.major - t.major, Hn = (e, t) => {
+}, R = (e, t) => e.major === t.major ? e.minor === t.minor ? e.patch === t.patch ? e.pre && !t.pre ? -1 : !e.pre && t.pre ? 1 : e.pre && t.pre ? e.pre < t.pre ? -1 : +(e.pre > t.pre) : 0 : e.patch - t.patch : e.minor - t.minor : e.major - t.major, Wn = (e, t) => {
 	if (e === "*") return !0;
 	if (e.startsWith("^")) {
-		let n = z(e.slice(1));
-		return !n || t.major !== n.major ? !1 : B(t, n) >= 0;
+		let n = L(e.slice(1));
+		return !n || t.major !== n.major ? !1 : R(t, n) >= 0;
 	}
 	if (e.startsWith("~")) {
-		let n = z(e.slice(1));
-		return !n || t.major !== n.major || t.minor !== n.minor ? !1 : B(t, n) >= 0;
+		let n = L(e.slice(1));
+		return !n || t.major !== n.major || t.minor !== n.minor ? !1 : R(t, n) >= 0;
 	}
 	let n = /^(>=|<=|>|<)(.+)$/.exec(e);
 	if (n) {
-		let e = n[1], r = z(n[2]);
+		let e = n[1], r = L(n[2]);
 		if (!r) return !1;
-		let i = B(t, r);
+		let i = R(t, r);
 		if (e === ">=") return i >= 0;
 		if (e === "<=") return i <= 0;
 		if (e === ">") return i > 0;
 		if (e === "<") return i < 0;
 	}
-	let r = z(e);
-	return r ? B(t, r) === 0 : !1;
-}, Un = (e) => {
+	let r = L(e);
+	return r ? R(t, r) === 0 : !1;
+}, Gn = (e) => {
 	let t = e.startsWith("@") ? e.replace(/^@[^/]+\//, "") : e;
 	return (t.startsWith("plugin-") ? t.slice(7) : t).replace(/-([a-zA-Z0-9])/g, (e, t) => t.toUpperCase());
-}, Wn = (e) => {
+}, Kn = (e) => {
 	let t = e.startsWith("@") ? e.replace(/^@[^/]+\//, "") : e;
 	return (t.startsWith("plugin-") ? t.slice(7) : t).replace(/#/g, "--").replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
-}, Gn = Symbol.for("@voltro/protocol/pluginAliases"), V = () => {
-	let e = globalThis, t = e[Gn];
+}, qn = Symbol.for("@voltro/protocol/pluginAliases"), z = () => {
+	let e = globalThis, t = e[qn];
 	if (t instanceof Map) return t;
 	let n = /* @__PURE__ */ new Map();
-	return e[Gn] = n, n;
-}, Kn = (e) => {
-	let t = V();
+	return e[qn] = n, n;
+}, Jn = (e) => {
+	let t = z();
 	for (let [n, r] of Object.entries(e)) {
 		if (r === "") continue;
 		let e = t.get(n);
 		e === void 0 ? t.set(n, /* @__PURE__ */ new Set([r])) : e.add(r);
 	}
-}, qn = () => {
-	V().clear();
-}, Jn = (e, t) => {
-	let n = V().get(e);
-	if (n === void 0 || n.size === 0) return `${Un(e)}.${t}`;
+}, Yn = () => {
+	z().clear();
+}, Xn = (e, t) => {
+	let n = z().get(e);
+	if (n === void 0 || n.size === 0) return `${Gn(e)}.${t}`;
 	if (n.size === 1) return `${[...n][0]}.${t}`;
 	let r = [...n].filter((e) => !e.includes("#"));
 	if (r.length === 1) return `${r[0]}.${t}`;
 	throw Error(`[voltro] ${e} is installed more than once (${[...n].sort().join(", ")}) and no single install is the primary one, so a plugin hook cannot tell which of them it addresses. Call the route by its full tag instead — e.g. useSubscription(api, '${[...n].sort()[0]}.${t}').`);
-}, Yn = p.Union(p.Struct({
+}, B = p.Union(p.Struct({
 	kind: p.Literal("dropped"),
 	at: p.Number,
 	retryAfterMs: p.Number
@@ -676,22 +691,22 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 	kind: p.Literal("abandoned"),
 	at: p.Number,
 	failureId: p.NonEmptyString
-})), H = p.Literal("running", "succeeded", "failed", "cancelled", "suspended"), U = p.Struct({
+})), V = p.Literal("running", "succeeded", "failed", "cancelled", "suspended"), H = p.Struct({
 	id: p.String,
 	workflowName: p.String,
 	executionId: p.String,
-	status: p.Union(H, p.Literal("unknown")),
+	status: p.Union(V, p.Literal("unknown")),
 	output: p.optional(p.Unknown),
 	error: p.optional(p.Struct({
 		tag: p.NullOr(p.String),
 		message: p.String
 	}))
-}), W = p.Struct({
+}), U = p.Struct({
 	operation: p.Literal("cancel", "resume"),
 	kind: p.Literal("accepted", "confirmed", "unknown", "already-terminal"),
 	requestId: p.NullOr(p.NonEmptyString),
-	snapshot: U
-}).pipe(p.filter((e) => e.kind === "unknown" ? !0 : e.kind === "accepted" ? e.requestId !== null && (e.snapshot.status === "running" || e.snapshot.status === "suspended") : e.kind === "already-terminal" ? e.snapshot.status === "succeeded" || e.snapshot.status === "failed" || e.snapshot.status === "cancelled" : e.operation === "cancel" ? e.snapshot.status === "cancelled" : e.requestId !== null && e.snapshot.status === "running", { message: () => "Workflow control acknowledgement contradicts its observed state or receipt identity" })), G = p.Struct({
+	snapshot: H
+}).pipe(p.filter((e) => e.kind === "unknown" ? !0 : e.kind === "accepted" ? e.requestId !== null && (e.snapshot.status === "running" || e.snapshot.status === "suspended") : e.kind === "already-terminal" ? e.snapshot.status === "succeeded" || e.snapshot.status === "failed" || e.snapshot.status === "cancelled" : e.operation === "cancel" ? e.snapshot.status === "cancelled" : e.requestId !== null && e.snapshot.status === "running", { message: () => "Workflow control acknowledgement contradicts its observed state or receipt identity" })), W = p.Struct({
 	operation: p.Literal("cancel"),
 	workflowName: p.NonEmptyString,
 	receiptId: p.NonEmptyString,
@@ -699,13 +714,13 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 	kind: p.Literal("accepted", "confirmed", "unknown", "already-terminal"),
 	observation: p.Union(p.Struct({ kind: p.Literal("pending") }), p.Struct({
 		kind: p.Literal("admission"),
-		outcome: p.Union(Yn, p.Struct({
+		outcome: p.Union(B, p.Struct({
 			kind: p.Literal("rejected"),
 			failureId: p.NonEmptyString
 		}))
 	}), p.Struct({
 		kind: p.Literal("execution"),
-		snapshot: U
+		snapshot: H
 	}), p.Struct({
 		kind: p.Literal("unavailable"),
 		reason: p.Literal("missing-request", "missing-run", "unconfirmed-generation", "unbound-submission")
@@ -718,32 +733,32 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 	if (t.kind === "admission") return e.kind === (t.outcome.kind === "cancelled" ? "confirmed" : "already-terminal");
 	let n = t.snapshot;
 	return n.workflowName !== e.workflowName || n.id.length === 0 || n.executionId.length === 0 ? !1 : e.kind === "accepted" ? n.status === "running" || n.status === "suspended" : e.kind === "confirmed" ? n.status === "cancelled" : e.kind === "already-terminal" && (n.status === "succeeded" || n.status === "failed" || n.status === "cancelled");
-}, { message: () => "Queued cancellation acknowledgement contradicts its receipt or observation" })), Xn = p.Literal("cancel", "terminate", "abandon"), Zn = p.Struct({
+}, { message: () => "Queued cancellation acknowledgement contradicts its receipt or observation" })), Zn = p.Literal("cancel", "terminate", "abandon"), Qn = p.Struct({
 	mode: p.String,
 	dueAt: p.NullOr(p.Number),
 	retryAfterMs: p.NullOr(p.Number),
 	intentId: p.NullOr(p.String)
-}), Qn = p.Struct({
+}), $n = p.Struct({
 	id: p.String,
 	workflowName: p.String,
 	executionId: p.NullOr(p.String),
 	status: p.Literal("running", "succeeded", "queued", "dropped", "skipped", "replayed"),
-	deferral: p.optional(Zn)
-}), $n = (e, t) => {
-	let n = R(e);
+	deferral: p.optional(Qn)
+}), er = (e, t) => {
+	let n = I(e);
 	return m.make(e.name, {
-		payload: x(e.payloadSchema, e.name, F(n.guards)),
-		success: Qn,
-		error: an({
+		payload: x(e.payloadSchema, e.name, N(n.guards)),
+		success: $n,
+		error: sn({
 			errorSchema: e.errorSchema,
 			guards: n.guards
 		}, t)
 	});
-}, K = p.Struct({
+}, G = p.Struct({
 	id: p.String,
 	tag: p.String,
 	executionId: p.String,
-	status: H,
+	status: V,
 	payload: p.Unknown,
 	workflowVersion: p.NullOr(p.String),
 	workflowPatches: p.NullOr(p.Unknown),
@@ -758,12 +773,12 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 	durationMs: p.NullOr(p.Number),
 	traceId: p.NullOr(p.String),
 	parentExecutionId: p.NullOr(p.String),
-	parentClosePolicy: p.NullOr(Xn)
-}), er = p.Struct({
+	parentClosePolicy: p.NullOr(Zn)
+}), tr = p.Struct({
 	tag: p.optional(p.String),
-	status: p.optional(H),
+	status: p.optional(V),
 	limit: p.optional(p.Number)
-}), tr = p.Struct({
+}), nr = p.Struct({
 	id: p.String,
 	runId: p.String,
 	stepName: p.String,
@@ -778,7 +793,7 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 	startedAt: p.Date,
 	completedAt: p.NullOr(p.Date),
 	durationMs: p.NullOr(p.Number)
-}), nr = p.Struct({
+}), rr = p.Struct({
 	id: p.String,
 	runId: p.String,
 	eventType: p.String,
@@ -786,7 +801,7 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 	occurredAt: p.Date,
 	stepName: p.NullOr(p.String),
 	attempt: p.NullOr(p.Number)
-}), rr = p.Struct({
+}), ir = p.Struct({
 	id: p.String,
 	name: p.String,
 	payload: p.Unknown,
@@ -794,7 +809,7 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 	subject: p.NullOr(p.Unknown),
 	traceId: p.NullOr(p.String),
 	occurredAt: p.Date
-}), ir = p.Struct({
+}), ar = p.Struct({
 	id: p.String,
 	eventId: p.String,
 	eventName: p.String,
@@ -807,10 +822,10 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 	errorMessage: p.NullOr(p.String),
 	createdAt: p.Date,
 	completedAt: p.NullOr(p.Date)
-}), ar = p.Struct({ id: p.String }), q = p.Struct({ runId: p.String }), or = p.Struct({
+}), or = p.Struct({ id: p.String }), K = p.Struct({ runId: p.String }), sr = p.Struct({
 	name: p.optional(p.String),
 	limit: p.optional(p.Number)
-}), sr = p.Struct({ eventId: p.String }), J = p.Struct({
+}), cr = p.Struct({ eventId: p.String }), q = p.Struct({
 	requestId: p.NonEmptyString,
 	cause: p.optionalWith(p.Struct({
 		reason: p.NonEmptyString,
@@ -819,164 +834,196 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 			value: p.Unknown
 		}))
 	}), { exact: !0 })
-}), Y = p.Struct({
+}), J = p.Struct({
 	workflowName: p.String,
 	executionId: p.String,
-	control: p.optional(J)
-}), cr = p.Struct({
+	control: p.optional(q)
+}), lr = p.Struct({
 	workflowName: p.NonEmptyString,
 	executionId: p.NonEmptyString,
 	operation: p.Literal("cancel", "resume"),
 	requestId: p.NonEmptyString
-}), X = p.Struct({
+}), Y = p.Struct({
 	workflowName: p.NonEmptyString,
 	receiptId: p.NonEmptyString,
 	requestId: p.NonEmptyString
-}), lr = p.Struct({
-	...X.fields,
-	cause: J.fields.cause
-}), ur = N({
+}), ur = p.Struct({
+	...Y.fields,
+	cause: q.fields.cause
+}), dr = j({
 	name: "__voltro.workflow.queued.cancel",
-	input: lr,
-	output: G,
+	input: ur,
+	output: W,
 	openAccess: "authorization happens in the executor against the target run — the caller must be authenticated and belong to the run's tenant, and a missing run answers exactly like a foreign one"
-}), dr = j({
+}), fr = k({
 	name: "__voltro.workflow.queued.control",
-	input: X,
-	output: G,
+	input: Y,
+	output: W,
 	openAccess: "authorization happens in the executor against the target run — the caller must be authenticated and belong to the run's tenant, and a missing run answers exactly like a foreign one"
-}), fr = j({
+}), pr = k({
 	name: "__voltro.workflow.control",
-	input: cr,
-	output: W,
+	input: lr,
+	output: U,
 	openAccess: "authorization happens in the executor against the target run — the caller must be authenticated and belong to the run's tenant, and a missing run answers exactly like a foreign one"
-}), pr = p.Struct({
+}), mr = p.Struct({
 	id: p.String,
 	signalName: p.String,
 	payload: p.optional(p.Unknown)
-}), mr = p.Struct({
+}), hr = p.Struct({
 	id: p.String,
 	updateName: p.String,
 	payload: p.optional(p.Unknown),
 	timeoutMs: p.optional(p.Number)
-}), hr = p.Struct({
+}), gr = p.Struct({
 	eventId: p.String,
 	updateId: p.String,
 	completedEventId: p.String,
 	result: p.Unknown
-}), gr = j({
+}), _r = k({
 	name: "__voltro.workflow.run",
 	source: "_voltro_workflow_runs",
-	input: ar,
-	output: p.Array(K),
+	input: or,
+	output: p.Array(G),
 	openAccess: "the answer is scoped to the caller in the executor — a system or admin:full subject sees every row, an authenticated subject the rows of its own tenant, an anonymous caller none"
-}), _r = j({
+}), vr = k({
 	name: "__voltro.workflow.runs",
 	source: "_voltro_workflow_runs",
-	input: er,
-	output: p.Array(K),
+	input: tr,
+	output: p.Array(G),
 	openAccess: "the answer is scoped to the caller in the executor — a system or admin:full subject sees every row, an authenticated subject the rows of its own tenant, an anonymous caller none"
-}), vr = j({
+}), yr = k({
 	name: "__voltro.workflow.run.steps",
 	source: "_voltro_workflow_run_steps",
-	input: q,
-	output: p.Array(tr),
+	input: K,
+	output: p.Array(nr),
 	openAccess: "the answer is scoped to the caller in the executor — a system or admin:full subject sees every row, an authenticated subject the rows of its own tenant, an anonymous caller none"
-}), yr = j({
+}), br = k({
 	name: "__voltro.workflow.run.events",
 	source: "_voltro_workflow_run_events",
-	input: q,
-	output: p.Array(nr),
+	input: K,
+	output: p.Array(rr),
 	openAccess: "the answer is scoped to the caller in the executor — a system or admin:full subject sees every row, an authenticated subject the rows of its own tenant, an anonymous caller none"
-}), br = j({
+}), xr = k({
 	name: "__voltro.workflow.domainEvents",
 	source: "_voltro_workflow_events",
-	input: or,
-	output: p.Array(rr),
+	input: sr,
+	output: p.Array(ir),
 	openAccess: "the answer is scoped to the caller in the executor — a system or admin:full subject sees every row, an authenticated subject the rows of its own tenant, an anonymous caller none"
-}), xr = j({
+}), Sr = k({
 	name: "__voltro.workflow.event.deliveries",
 	source: "_voltro_workflow_event_deliveries",
-	input: sr,
-	output: p.Array(ir),
+	input: cr,
+	output: p.Array(ar),
 	openAccess: "the answer is scoped to the caller in the executor — a system or admin:full subject sees every row, an authenticated subject the rows of its own tenant, an anonymous caller none"
-}), Sr = N({
+}), Cr = j({
 	name: "__voltro.workflow.cancel",
-	input: Y,
-	output: W,
+	input: J,
+	output: U,
 	openAccess: "authorization happens in the executor against the target run — the caller must be authenticated and belong to the run's tenant, and a missing run answers exactly like a foreign one"
-}), Cr = N({
+}), wr = j({
 	name: "__voltro.workflow.resume",
-	input: Y,
-	output: W,
+	input: J,
+	output: U,
 	openAccess: "authorization happens in the executor against the target run — the caller must be authenticated and belong to the run's tenant, and a missing run answers exactly like a foreign one"
-}), wr = N({
+}), Tr = j({
 	name: "__voltro.workflow.signal",
-	input: pr,
+	input: mr,
 	output: p.Struct({ eventId: p.String }),
 	openAccess: "authorization happens in the executor against the target run — the caller must be authenticated and belong to the run's tenant, and a missing run answers exactly like a foreign one"
-}), Tr = N({
+}), Er = j({
 	name: "__voltro.workflow.update",
-	input: mr,
-	output: hr,
+	input: hr,
+	output: gr,
 	openAccess: "authorization happens in the executor against the target run — the caller must be authenticated and belong to the run's tenant, and a missing run answers exactly like a foreign one"
-}), Er = "__voltro.undo.log", Dr = "__voltro.undo.apply", Or = "__voltro.undo.redo", kr = p.Struct({
+}), Dr = p.NonEmptyString.pipe(p.filter((e) => e.trim().length > 0, { message: () => "A workflow retry identity must not be blank" })), Or = p.Struct({
+	runId: Dr,
+	requestId: Dr
+}), kr = p.Struct({
+	...Or.fields,
+	payloadOverride: p.optional(p.Unknown)
+}), X = {
+	requestId: p.NonEmptyString,
+	originalRunId: p.NonEmptyString,
+	originalExecutionId: p.NonEmptyString,
+	workflowName: p.NonEmptyString
+}, Ar = p.Union(p.Struct({
+	...X,
+	kind: p.Literal("queued"),
+	nextAttemptAt: p.NullOr(p.Number)
+}), p.Struct({
+	...X,
+	kind: p.Literal("accepted"),
+	executionId: p.NonEmptyString
+}).pipe(p.filter((e) => e.executionId !== e.originalExecutionId, { message: () => "A retry cannot accept its original execution identity" })), p.Struct({
+	...X,
+	kind: p.Literal("unconfirmed"),
+	automaticRetryStopped: p.Boolean,
+	nextAttemptAt: p.NullOr(p.Number)
+}).pipe(p.filter((e) => !e.automaticRetryStopped || e.nextAttemptAt === null, { message: () => "Stopped automatic retries cannot have a next attempt" })), p.Struct({
+	...X,
+	kind: p.Literal("not-started"),
+	outcome: B
+}), p.Struct({
+	...X,
+	kind: p.Literal("rejected"),
+	failureId: p.NonEmptyString
+})), jr = "__voltro.undo.log", Mr = "__voltro.undo.apply", Nr = "__voltro.undo.redo", Pr = p.Struct({
 	id: p.String,
 	tag: p.String,
 	label: p.NullOr(p.String),
 	undone: p.Boolean,
 	crossesAction: p.Boolean,
 	createdAt: p.String
-}), Ar = class extends p.TaggedError()("UndoNotFound", { invocationId: p.String }) {}, jr = class extends p.TaggedError()("UndoForbidden", { invocationId: p.String }) {}, Mr = class extends p.TaggedError()("UndoConflict", {
+}), Fr = class extends p.TaggedError()("UndoNotFound", { invocationId: p.String }) {}, Ir = class extends p.TaggedError()("UndoForbidden", { invocationId: p.String }) {}, Lr = class extends p.TaggedError()("UndoConflict", {
 	invocationId: p.String,
 	reason: p.Literal("conflict", "action")
-}) {}, Nr = p.Union(Ar, jr, Mr), Pr = j({
-	name: Er,
+}) {}, Rr = p.Union(Fr, Ir, Lr), zr = k({
+	name: jr,
 	source: "_voltro_undo_log",
 	input: p.Struct({ limit: p.optional(p.Number) }),
-	output: p.Array(kr),
+	output: p.Array(Pr),
 	openAccess: "subject-scoped by construction: lists only the calling subject's own undoable actions"
-}), Fr = M({
-	name: Dr,
+}), Br = A({
+	name: Mr,
 	input: p.Struct({ invocationId: p.String }),
 	output: p.Struct({ ok: p.Boolean }),
-	error: Nr,
+	error: Rr,
 	openAccess: "subject-scoped by construction: undo is per-actor — another subject's invocation fails typed with UndoForbidden"
-}), Ir = M({
-	name: Or,
+}), Vr = A({
+	name: Nr,
 	input: p.Struct({ invocationId: p.String }),
 	output: p.Struct({ ok: p.Boolean }),
-	error: Nr,
+	error: Rr,
 	openAccess: "subject-scoped by construction: redo is per-actor — another subject's invocation fails typed with UndoForbidden"
-}), Lr = class extends p.TaggedError()("TenantScopeViolation", {
+}), Hr = class extends p.TaggedError()("TenantScopeViolation", {
 	table: p.String,
 	reason: p.String
-}) {}, Rr = class extends p.TaggedError()("StoreOperationFailed", {
+}) {}, Ur = class extends p.TaggedError()("StoreOperationFailed", {
 	operation: p.String,
 	table: p.String,
 	cause: p.String
-}) {}, zr = class extends p.TaggedError()("NoRowFound", {
+}) {}, Wr = class extends p.TaggedError()("NoRowFound", {
 	table: p.String,
 	found: p.Number
 }) {
 	get message() {
 		return this.found === 0 ? `expected exactly one row in '${this.table}', found none` : `expected exactly one row in '${this.table}', found more than one`;
 	}
-}, Br = class extends p.TaggedError()("TableValidationFailed", {
+}, Gr = class extends p.TaggedError()("TableValidationFailed", {
 	table: p.String,
 	summary: p.String,
 	issues: p.Array(p.Struct({
 		path: p.String,
 		message: p.String
 	}))
-}) {}, Vr = class extends p.TaggedError()("TenantRowNotFound", {
+}) {}, Kr = class extends p.TaggedError()("TenantRowNotFound", {
 	table: p.String,
 	id: p.String,
 	reason: p.String
-}) {}, Hr = class extends p.TaggedError()("ServerOnlyColumnWrite", {
+}) {}, qr = class extends p.TaggedError()("ServerOnlyColumnWrite", {
 	table: p.String,
 	columns: p.Array(p.String)
-}) {}, Ur = class extends p.TaggedError()("ConstraintViolation", {
+}) {}, Jr = class extends p.TaggedError()("ConstraintViolation", {
 	kind: p.Literal("foreignKey", "foreignKeyInUse", "unique", "notNull", "check"),
 	table: p.String,
 	operation: p.String,
@@ -995,14 +1042,14 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 			case "check": return `check constraint ${t}: the row does not satisfy it`;
 		}
 	}
-}, Wr = "__voltro.approvals.pending", Gr = "__voltro.approvals.decide", Kr = j({
-	name: Wr,
+}, Yr = "__voltro.approvals.pending", Xr = "__voltro.approvals.decide", Zr = k({
+	name: Yr,
 	source: "_voltro_approvals",
 	input: p.Struct({ limit: p.optional(p.Number) }),
 	output: p.Array(Rt),
 	openAccess: "the answer is scoped to the caller — a row appears only if they requested it or hold its recorded approver scopes, so an anonymous caller sees nothing"
-}), qr = M({
-	name: Gr,
+}), Qr = A({
+	name: Xr,
 	input: p.Struct({
 		approvalId: p.String,
 		decision: p.Literal("approve", "reject"),
@@ -1014,33 +1061,33 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 	}),
 	error: Lt,
 	openAccess: "the approver authority is the PENDING ROW's own recorded scopes (plus an unconditional self-approval refusal), checked in-handler — a descriptor-level scope would have to be the union of every approval-requiring procedure in the app"
-}), Jr = "__voltro.connections.list", Yr = "__voltro.connections.start", Xr = "__voltro.connections.submitToken", Z = "__voltro.connections.disconnect", Q = p.Literal("oauth2", "pat"), Zr = p.Literal("disconnected", "connected", "expired", "revoked", "error"), Qr = p.Struct({
+}), Z = "__voltro.connections.list", $r = "__voltro.connections.start", ei = "__voltro.connections.submitToken", ti = "__voltro.connections.disconnect", Q = p.Literal("oauth2", "pat"), ni = p.Literal("disconnected", "connected", "expired", "revoked", "error"), ri = p.Struct({
 	connectionId: p.String,
 	kind: Q,
 	label: p.String,
-	status: Zr,
+	status: ni,
 	accountId: p.NullOr(p.String),
 	accountLabel: p.NullOr(p.String),
 	scopes: p.Array(p.String),
 	expiresAt: p.NullOr(p.String),
 	lastError: p.NullOr(p.String),
 	connectedAt: p.NullOr(p.String)
-}), $r = class extends p.TaggedError()("ConnectionNotDeclared", { connectionId: p.String }) {}, ei = class extends p.TaggedError()("ConnectionSubjectRequired", { connectionId: p.String }) {}, ti = class extends p.TaggedError()("ConnectionKindMismatch", {
+}), ii = class extends p.TaggedError()("ConnectionNotDeclared", { connectionId: p.String }) {}, ai = class extends p.TaggedError()("ConnectionSubjectRequired", { connectionId: p.String }) {}, oi = class extends p.TaggedError()("ConnectionKindMismatch", {
 	connectionId: p.String,
 	expected: Q,
 	actual: Q
-}) {}, ni = class extends p.TaggedError()("ConnectionHandshakeFailed", {
+}) {}, si = class extends p.TaggedError()("ConnectionHandshakeFailed", {
 	connectionId: p.String,
 	reason: p.String,
 	transient: p.Boolean
-}) {}, $ = p.Union($r, ei, ti, ni), ri = j({
-	name: Jr,
+}) {}, $ = p.Union(ii, ai, oi, si), ci = k({
+	name: Z,
 	source: "_voltro_connections",
 	input: p.Struct({}),
-	output: p.Array(Qr),
+	output: p.Array(ri),
 	openAccess: "self-scoped read: projects the declared connections for the calling subject only (its own connect/disconnect state)"
-}), ii = N({
-	name: Yr,
+}), li = j({
+	name: $r,
 	input: p.Struct({
 		connectionId: p.String,
 		redirectTo: p.optional(p.String)
@@ -1051,8 +1098,8 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 	}),
 	error: $,
 	openAccess: "self-service: begins an oauth handshake that stores a credential for the calling subject only; anonymous callers fail typed with ConnectionSubjectRequired"
-}), ai = M({
-	name: Xr,
+}), ui = A({
+	name: ei,
 	input: p.Struct({
 		connectionId: p.String,
 		token: p.String
@@ -1060,20 +1107,21 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 	output: p.Struct({ ok: p.Boolean }),
 	error: $,
 	openAccess: "self-service: stores a pasted token as the calling subject's own credential; anonymous callers fail typed with ConnectionSubjectRequired"
-}), oi = M({
-	name: Z,
+}), di = A({
+	name: ti,
 	input: p.Struct({ connectionId: p.String }),
 	output: p.Struct({ ok: p.Boolean }),
 	error: $,
 	openAccess: "self-service: deletes only the calling subject's own credential row for this connection"
-}), si = (e) => {
+}), fi = (e) => {
 	let t = e instanceof Date ? e.getTime() : typeof e == "number" ? e : typeof e == "string" ? new Date(e).getTime() : 0;
 	return Number.isNaN(t) ? 0 : t;
-}, ci = 4001, li = /* @__PURE__ */ new Set(["/rpc", "/ws"]), ui = (e) => {
+}, pi = 4001, mi = /* @__PURE__ */ new Set(["/rpc", "/ws"]), hi = (e) => {
+	for (let [t, n] of Object.entries(e.limits ?? {})) if (n !== void 0 && (!Number.isSafeInteger(n) || n <= 0)) throw Error(`defineWebSocket: limits.${t} must be a positive safe integer`);
 	if (!e.path.startsWith("/")) throw Error(`defineWebSocket: path must be absolute, got '${e.path}'`);
-	if (li.has(e.path)) throw Error(`defineWebSocket: '${e.path}' is the framework's own socket surface — mount the gateway elsewhere`);
+	if (mi.has(e.path)) throw Error(`defineWebSocket: '${e.path}' is the framework's own socket surface — mount the gateway elsewhere`);
 	if (e.auth !== "subject" && e.auth !== "public") throw Error(`defineWebSocket: auth must be 'subject' or 'public' (explicitly — an unauthenticated socket has to be a decision somebody wrote down), got '${String(e.auth)}'`);
 	return e;
-}, di = 1;
+}, gi = 1;
 //#endregion
-export { Ne as ADMIN_SCOPE, Oe as APIKEY_ISSUE_ORG_SCOPE, je as APIKEY_ISSUE_OTHER_SCOPE, Ce as APIKEY_ISSUE_SELF_SCOPE, Gr as APPROVALS_DECIDE_TAG, Wr as APPROVALS_PENDING_TAG, Lt as ApprovalDecisionErrors, It as ApprovalErrors, S as ApprovalExpired, Ft as ApprovalForbidden, jt as ApprovalNotFound, Pt as ApprovalNotPending, Nt as ApprovalRejected, At as ApprovalRequired, Mt as ApprovalSelfApproval, C as ApprovalUnavailable, i as AuthMiddleware, Tt as BusinessRuleViolation, Jr as CONNECTIONS_LIST_TAG, Z as CONNECTION_DISCONNECT_TAG, Yr as CONNECTION_START_TAG, Xr as CONNECTION_SUBMIT_TOKEN_TAG, ni as ConnectionHandshakeFailed, ae as ConnectionInfo, Te as ConnectionInfoMiddleware, Q as ConnectionKind, ti as ConnectionKindMismatch, $r as ConnectionNotDeclared, Qr as ConnectionState, Zr as ConnectionStatus, ei as ConnectionSubjectRequired, Ur as ConstraintViolation, t as DEFAULT_SCOPE_CACHE_MAX_ENTRIES, we as DEFAULT_SCOPE_CACHE_TTL_MS, _e as DEVICES_MANAGE_SCOPE, On as EVENT_ROUTE_SEP, Tn as EventKeyInvalid, wn as EventPayloadInvalid, En as EventPayloadTooLarge, ci as GATEWAY_CREDENTIAL_EXPIRED_CLOSE_CODE, re as IMPERSONATION_METADATA_KEY, st as JSONAPI_MEDIA_TYPE, mn as MAX_EVENT_ENVELOPE_BYTES, ft as MUTATION_IN_FLIGHT_RETRY_AFTER_MS, qe as MutationConnectionRequired, dt as MutationInFlight, zr as NoRowFound, nt as PROBLEM_JSON, di as PROTOCOL_VERSION, Rt as PendingApproval, w as REACTIVITY_CHANNEL_PREFIX, at as REST_PROFILE_NAMES, f as ScopeError, Hr as ServerOnlyColumnWrite, Rr as StoreOperationFailed, ie as Subject, oe as SubjectIdentity, o as SubjectService, Br as TableValidationFailed, Vr as TenantRowNotFound, Lr as TenantScopeViolation, ge as TenantSelectionRefused, Dr as UNDO_APPLY_TAG, Er as UNDO_LOG_TAG, Or as UNDO_REDO_TAG, l as Unauthenticated, Mr as UndoConflict, jr as UndoForbidden, kr as UndoLogEntry, Ar as UndoNotFound, Dt as ValidationError, Ot as ValidationErrors, Et as ValidationIssue, L as WorkflowAccessProperty, Y as WorkflowControlInputSchema, J as WorkflowControlIntentSchema, cr as WorkflowControlReadInputSchema, W as WorkflowControlResultSchema, rr as WorkflowDomainEventRowSchema, or as WorkflowDomainEventsInputSchema, sr as WorkflowEventDeliveriesInputSchema, ir as WorkflowEventDeliveryRowSchema, Xn as WorkflowParentClosePolicySchema, lr as WorkflowQueuedCancelInputSchema, G as WorkflowQueuedCancellationResultSchema, X as WorkflowQueuedControlTargetSchema, nr as WorkflowRunEventRowSchema, Qn as WorkflowRunHandleSchema, ar as WorkflowRunRefSchema, K as WorkflowRunRowSchema, U as WorkflowRunSnapshotSchema, H as WorkflowRunStatusSchema, tr as WorkflowRunStepRowSchema, q as WorkflowRunTableRefSchema, er as WorkflowRunsInputSchema, pr as WorkflowSignalInputSchema, Zn as WorkflowStartDeferralSchema, Yn as WorkflowStartTerminalOutcomeSchema, mr as WorkflowUpdateInputSchema, hr as WorkflowUpdateResultSchema, ln as actionToRpc, Me as advisoryResourceGuardWarning, ne as anonymousSubject, Ct as applyRowPatch, ce as applyScopeDecision, qr as approvalsDecideDescriptor, Kr as approvalsPendingQueryDescriptor, ze as assertAuthenticated, Pn as attachWorkflowAccess, Ue as beginIdempotent, Vn as checkFrameworkCompat, ve as checkGuards, Ee as checkGuardsEffect, tt as compareSurfaces, n as composeAuthStrategies, zn as composeRpcInterceptors, oi as connectionDisconnectDescriptor, ii as connectionStartDescriptor, ai as connectionSubmitTokenDescriptor, ri as connectionsListQueryDescriptor, Gt as declaredReactivityChannelKeys, N as defineAction, gn as defineEvent, M as defineMutation, In as definePlugin, Ln as definePluginRoute, Bn as definePluginService, j as defineQuery, $t as defineStream, ui as defineWebSocket, xt as diffRows, Pe as effectiveScopes, Dn as encodeEventKey, $e as encodeRestError, Ke as encodeRestSuccess, dn as errorTag, yn as eventAttached, _n as eventEnvelope, vn as eventGap, xn as eventResumePoint, kn as eventRoute, bn as eventStreamEvent, Sn as eventSubscribeInput, Cn as eventToRpc, Be as failIdempotent, kt as fieldIssuesOf, ye as findAdvisoryResourceGuards, ut as finishIdempotent, jn as formatEventRoute, be as getPolicyGuardResolver, ke as getResourceScopeResolver, R as getWorkflowAccess, Qe as groupShapeDigests, Qt as hasAccessDecision, fe as hasCallbackRoutes, De as hasEffectiveScope, F as hasEnforcedGuard, Se as hasScope, g as idToPath, We as idempotencyScope, b as inputLabel, xe as isAuthenticatedCheck, Zt as isAuthenticatedGuard, hn as isEventDescriptor, St as isIdKeyed, u as isOpenAccess, Fe as isPolicyCheck, Xt as isPolicyGuard, Ut as isReactivityChannel, Wt as isReactivityChannelKey, c as isSystemSubject, se as isTenantSelectable, Jt as isWireReachable, de as makeScopeCache, He as memoryIdempotencyStore, Re as missingAccessDecision, cn as mutationToRpc, rt as nextLink, pn as normalizeDescriptor, O as normalizeSource, d as openAccessSpec, pe as orderByBearerPrefix, An as parseEventRoute, yt as pathToId, Un as pluginAlias, Rn as pluginInstanceName, Wn as pluginSlug, Jn as pluginTag, ot as problemDetails, Je as problemTypeOf, Ze as procedureShapeDigest, qt as publishReactivity, Xe as publishServerError, sn as queryToRpc, s as rawImpersonationMark, Ht as reactivityChannel, Kn as registerPluginAliases, Le as requireScope, qn as resetPluginAliases, le as resolvePolicyAction, et as resolveRestFormat, Nn as resolveWorkflowAccess, ct as restViewSchema, _t as rowPatchOpSchema, vt as rowPatchSchema, Ge as schemaShape, te as scopeCacheKey, e as selectSubjectTenant, r as setEffectiveScopes, Ie as setPolicyGuardResolver, ue as setResourceScopeResolver, lt as shapeDigest, D as sourceKeys, un as streamToRpc, x as strictInput, Ae as subjectAuditActorId, ee as subjectIdentity, a as subjectScopes, it as subscribeServerErrors, y as subscriptionEvent, he as systemSubject, me as tenantScopedSubject, fn as toRpc, Ye as toSnakeCase, si as tsMs, Kt as undeclaredChannelKeys, Fr as undoApplyDescriptor, Pr as undoLogQueryDescriptor, Ir as undoRedoDescriptor, I as wireErrorUnion, on as withRpcTag, Fn as workflowAccessDescriptor, Sr as workflowCancelDescriptor, fr as workflowControlQueryDescriptor, br as workflowDomainEventsQueryDescriptor, xr as workflowEventDeliveriesQueryDescriptor, ur as workflowQueuedCancelDescriptor, dr as workflowQueuedControlQueryDescriptor, Cr as workflowResumeDescriptor, yr as workflowRunEventsQueryDescriptor, gr as workflowRunQueryDescriptor, vr as workflowRunStepsQueryDescriptor, _r as workflowRunsQueryDescriptor, wr as workflowSignalDescriptor, $n as workflowToRpc, Tr as workflowUpdateDescriptor, an as workflowWireErrorUnion, Ve as wsMutationIdempotencyScope };
+export { Ne as ADMIN_SCOPE, Oe as APIKEY_ISSUE_ORG_SCOPE, je as APIKEY_ISSUE_OTHER_SCOPE, Ce as APIKEY_ISSUE_SELF_SCOPE, Xr as APPROVALS_DECIDE_TAG, Yr as APPROVALS_PENDING_TAG, Lt as ApprovalDecisionErrors, It as ApprovalErrors, S as ApprovalExpired, Ft as ApprovalForbidden, jt as ApprovalNotFound, Pt as ApprovalNotPending, Nt as ApprovalRejected, At as ApprovalRequired, Mt as ApprovalSelfApproval, C as ApprovalUnavailable, i as AuthMiddleware, Tt as BusinessRuleViolation, Z as CONNECTIONS_LIST_TAG, ti as CONNECTION_DISCONNECT_TAG, $r as CONNECTION_START_TAG, ei as CONNECTION_SUBMIT_TOKEN_TAG, si as ConnectionHandshakeFailed, ae as ConnectionInfo, Te as ConnectionInfoMiddleware, Q as ConnectionKind, oi as ConnectionKindMismatch, ii as ConnectionNotDeclared, ri as ConnectionState, ni as ConnectionStatus, ai as ConnectionSubjectRequired, Jr as ConstraintViolation, t as DEFAULT_SCOPE_CACHE_MAX_ENTRIES, we as DEFAULT_SCOPE_CACHE_TTL_MS, _e as DEVICES_MANAGE_SCOPE, An as EVENT_ROUTE_SEP, Dn as EventKeyInvalid, En as EventPayloadInvalid, On as EventPayloadTooLarge, pi as GATEWAY_CREDENTIAL_EXPIRED_CLOSE_CODE, re as IMPERSONATION_METADATA_KEY, st as JSONAPI_MEDIA_TYPE, gn as MAX_EVENT_ENVELOPE_BYTES, ft as MUTATION_IN_FLIGHT_RETRY_AFTER_MS, qe as MutationConnectionRequired, dt as MutationInFlight, Wr as NoRowFound, nt as PROBLEM_JSON, gi as PROTOCOL_VERSION, Rt as PendingApproval, w as REACTIVITY_CHANNEL_PREFIX, at as REST_PROFILE_NAMES, f as ScopeError, qr as ServerOnlyColumnWrite, Ur as StoreOperationFailed, ie as Subject, oe as SubjectIdentity, o as SubjectService, Gr as TableValidationFailed, Kr as TenantRowNotFound, Hr as TenantScopeViolation, ge as TenantSelectionRefused, Mr as UNDO_APPLY_TAG, jr as UNDO_LOG_TAG, Nr as UNDO_REDO_TAG, l as Unauthenticated, Lr as UndoConflict, Ir as UndoForbidden, Pr as UndoLogEntry, Fr as UndoNotFound, Dt as ValidationError, Ot as ValidationErrors, Et as ValidationIssue, F as WorkflowAccessProperty, J as WorkflowControlInputSchema, q as WorkflowControlIntentSchema, lr as WorkflowControlReadInputSchema, U as WorkflowControlResultSchema, ir as WorkflowDomainEventRowSchema, sr as WorkflowDomainEventsInputSchema, cr as WorkflowEventDeliveriesInputSchema, ar as WorkflowEventDeliveryRowSchema, Zn as WorkflowParentClosePolicySchema, ur as WorkflowQueuedCancelInputSchema, W as WorkflowQueuedCancellationResultSchema, Y as WorkflowQueuedControlTargetSchema, kr as WorkflowRetryCommandSchema, Ar as WorkflowRetryObservationSchema, Or as WorkflowRetryTargetSchema, rr as WorkflowRunEventRowSchema, $n as WorkflowRunHandleSchema, or as WorkflowRunRefSchema, G as WorkflowRunRowSchema, H as WorkflowRunSnapshotSchema, V as WorkflowRunStatusSchema, nr as WorkflowRunStepRowSchema, K as WorkflowRunTableRefSchema, tr as WorkflowRunsInputSchema, mr as WorkflowSignalInputSchema, Qn as WorkflowStartDeferralSchema, B as WorkflowStartTerminalOutcomeSchema, hr as WorkflowUpdateInputSchema, gr as WorkflowUpdateResultSchema, dn as actionToRpc, Me as advisoryResourceGuardWarning, ne as anonymousSubject, Ct as applyRowPatch, ce as applyScopeDecision, Qr as approvalsDecideDescriptor, Zr as approvalsPendingQueryDescriptor, ze as assertAuthenticated, In as attachWorkflowAccess, Ue as beginIdempotent, Un as checkFrameworkCompat, ve as checkGuards, Ee as checkGuardsEffect, tt as compareSurfaces, n as composeAuthStrategies, Vn as composeRpcInterceptors, di as connectionDisconnectDescriptor, li as connectionStartDescriptor, ui as connectionSubmitTokenDescriptor, ci as connectionsListQueryDescriptor, Gt as declaredReactivityChannelKeys, j as defineAction, vn as defineEvent, A as defineMutation, Rn as definePlugin, zn as definePluginRoute, Hn as definePluginService, k as defineQuery, tn as defineStream, hi as defineWebSocket, xt as diffRows, Pe as effectiveScopes, kn as encodeEventKey, $e as encodeRestError, Ke as encodeRestSuccess, pn as errorTag, xn as eventAttached, yn as eventEnvelope, bn as eventGap, Cn as eventResumePoint, jn as eventRoute, Sn as eventStreamEvent, wn as eventSubscribeInput, Tn as eventToRpc, Be as failIdempotent, kt as fieldIssuesOf, ye as findAdvisoryResourceGuards, ut as finishIdempotent, Nn as formatEventRoute, be as getPolicyGuardResolver, ke as getResourceScopeResolver, I as getWorkflowAccess, Qe as groupShapeDigests, en as hasAccessDecision, fe as hasCallbackRoutes, De as hasEffectiveScope, N as hasEnforcedGuard, Se as hasScope, g as idToPath, We as idempotencyScope, b as inputLabel, xe as isAuthenticatedCheck, $t as isAuthenticatedGuard, _n as isEventDescriptor, St as isIdKeyed, u as isOpenAccess, Fe as isPolicyCheck, Qt as isPolicyGuard, Ut as isReactivityChannel, Wt as isReactivityChannelKey, c as isSystemSubject, se as isTenantSelectable, Xt as isWireReachable, de as makeScopeCache, He as memoryIdempotencyStore, Re as missingAccessDecision, un as mutationToRpc, rt as nextLink, hn as normalizeDescriptor, qt as normalizeSource, d as openAccessSpec, pe as orderByBearerPrefix, Mn as parseEventRoute, yt as pathToId, Gn as pluginAlias, Bn as pluginInstanceName, Kn as pluginSlug, Xn as pluginTag, ot as problemDetails, Je as problemTypeOf, Ze as procedureShapeDigest, Yt as publishReactivity, Xe as publishServerError, ln as queryToRpc, s as rawImpersonationMark, Ht as reactivityChannel, Jn as registerPluginAliases, Le as requireScope, Yn as resetPluginAliases, le as resolvePolicyAction, et as resolveRestFormat, Fn as resolveWorkflowAccess, ct as restViewSchema, _t as rowPatchOpSchema, vt as rowPatchSchema, Ge as schemaShape, te as scopeCacheKey, e as selectSubjectTenant, r as setEffectiveScopes, Ie as setPolicyGuardResolver, ue as setResourceScopeResolver, lt as shapeDigest, Kt as sourceKeys, fn as streamToRpc, x as strictInput, Ae as subjectAuditActorId, ee as subjectIdentity, a as subjectScopes, it as subscribeServerErrors, y as subscriptionEvent, he as systemSubject, me as tenantScopedSubject, mn as toRpc, Ye as toSnakeCase, fi as tsMs, Jt as undeclaredChannelKeys, Br as undoApplyDescriptor, zr as undoLogQueryDescriptor, Vr as undoRedoDescriptor, P as wireErrorUnion, cn as withRpcTag, Ln as workflowAccessDescriptor, Cr as workflowCancelDescriptor, pr as workflowControlQueryDescriptor, xr as workflowDomainEventsQueryDescriptor, Sr as workflowEventDeliveriesQueryDescriptor, dr as workflowQueuedCancelDescriptor, fr as workflowQueuedControlQueryDescriptor, wr as workflowResumeDescriptor, br as workflowRunEventsQueryDescriptor, _r as workflowRunQueryDescriptor, yr as workflowRunStepsQueryDescriptor, vr as workflowRunsQueryDescriptor, Tr as workflowSignalDescriptor, er as workflowToRpc, Er as workflowUpdateDescriptor, sn as workflowWireErrorUnion, Ve as wsMutationIdempotencyScope };