@voltro/protocol 0.80.0 → 0.81.0

package/dist/index.js

@@ -1,38 +1,38 @@
-import { $ as e, A as t, B as n, C as r, D as i, E as a, F as o, G as s, H as c, I as l, J as ee, K as te, L as ne, M as re, N as ie, O as ae, P as oe, Q as se, R as ce, S as le, T as ue, U as de, V as fe, W as pe, X as me, Y as he, Z as ge, _ as u, a as _e, b as d, c as ve, d as ye, f as be, g as xe, h as Se, i as Ce, j as we, k as Te, l as Ee, m as De, n as Oe, o as f, p as ke, q as Ae, r as je, s as Me, t as Ne, u as Pe, v as Fe, w as Ie, x as Le, y as Re, z as ze } from "./scopes-BbIyym8y.js";
-import { C as Be, D as Ve, E as He, S as Ue, T as We, _ as Ge, a as Ke, b as qe, c as Je, d as Ye, f as Xe, g as Ze, h as Qe, i as $e, l as et, m as tt, n as nt, o as rt, p as it, r as at, s as ot, t as st, u as ct, v as lt, w as ut, x as dt, y as ft } from "./restFormat-ChSVyufA.js";
-import { Context as pt, Layer as mt, Schema as p } from "effect";
-import { Rpc as m } from "@effect/rpc";
-import { VersionConflict as ht } from "@voltro/database/wire";
+import { $ as e, A as t, B as n, C as r, D as i, E as a, F as o, G as s, H as c, I as ee, J as te, K as ne, L as re, M as ie, N as ae, O as oe, P as se, Q as ce, R as le, S as ue, T as de, U as fe, V as pe, W as me, X as he, Y as ge, Z as _e, _ as l, a as ve, at as ye, b as be, c as xe, d as Se, et as Ce, f as we, g as Te, h as Ee, i as De, it as Oe, j as ke, k as Ae, l as je, m as Me, n as Ne, nt as Pe, o as u, p as Fe, q as Ie, r as Le, rt as Re, s as ze, t as Be, tt as Ve, u as He, v as Ue, w as d, x as f, y as We, z as p } from "./scopes-CvU5QBQ4.js";
+import { A as Ge, C as Ke, D as qe, E as Je, O as Ye, S as Xe, T as Ze, _ as Qe, a as $e, b as et, c as tt, d as nt, f as rt, g as it, h as at, i as ot, k as st, l as ct, m as lt, n as ut, o as dt, p as ft, r as pt, s as mt, t as ht, u as gt, v as _t, w as vt, x as yt, y as bt } from "./restFormat-CzdGVkuB.js";
+import { Context as xt, Layer as St, Schema as m } from "effect";
+import { Rpc as h } from "@effect/rpc";
+import { VersionConflict as Ct } from "@voltro/database/wire";
 //#region src/rowPatch.ts
-var gt = p.Union(p.String, p.Number), h = p.Record({
-	key: p.String,
-	value: p.Unknown
-}).pipe(p.filter((e) => "id" in e, { message: () => "patch row must carry an id" })), _t = p.Union(p.Struct({
-	op: p.Literal("add"),
-	path: p.String,
-	value: h
-}), p.Struct({
-	op: p.Literal("replace"),
-	path: p.String,
-	value: h
-}), p.Struct({
-	op: p.Literal("remove"),
-	path: p.String
-}), p.Struct({
-	op: p.Literal("mergeCells"),
-	path: p.String,
-	value: p.Record({
-		key: p.String,
-		value: p.Unknown
+var wt = m.Union(m.String, m.Number), Tt = m.Record({
+	key: m.String,
+	value: m.Unknown
+}).pipe(m.filter((e) => "id" in e, { message: () => "patch row must carry an id" })), Et = m.Union(m.Struct({
+	op: m.Literal("add"),
+	path: m.String,
+	value: Tt
+}), m.Struct({
+	op: m.Literal("replace"),
+	path: m.String,
+	value: Tt
+}), m.Struct({
+	op: m.Literal("remove"),
+	path: m.String
+}), m.Struct({
+	op: m.Literal("mergeCells"),
+	path: m.String,
+	value: m.Record({
+		key: m.String,
+		value: m.Unknown
 	})
-})), vt = p.Struct({
-	ops: p.Array(_t),
-	order: p.Array(gt)
-}), g = (e) => `/${String(e).replace(/~/g, "~0").replace(/\//g, "~1")}`, yt = (e) => (e.startsWith("/") ? e.slice(1) : e).replace(/~1/g, "/").replace(/~0/g, "~"), _ = (e) => {
+})), Dt = m.Struct({
+	ops: m.Array(Et),
+	order: m.Array(wt)
+}), g = (e) => `/${String(e).replace(/~/g, "~0").replace(/\//g, "~1")}`, Ot = (e) => (e.startsWith("/") ? e.slice(1) : e).replace(/~1/g, "/").replace(/~0/g, "~"), _ = (e) => {
 	let t = Object.keys(e).sort(), n = {};
 	for (let r of t) n[r] = e[r];
 	return JSON.stringify(n);
-}, v = (e, t) => _(e) === _(t), bt = (e, t) => {
+}, v = (e, t) => _(e) === _(t), kt = (e, t) => {
 	if (e instanceof Uint8Array && t instanceof Uint8Array) {
 		if (e.length !== t.length) return !1;
 		for (let n = 0; n < e.length; n += 1) if (e[n] !== t[n]) return !1;
@@ -45,14 +45,14 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 		id: 0,
 		v: t
 	});
-}, xt = (e, t, n = {}) => {
+}, At = (e, t, n = {}) => {
 	let r = /* @__PURE__ */ new Map();
 	for (let t of e) r.set(t.id, t);
 	let i = [], a = [], o = /* @__PURE__ */ new Set(), s = n.crdt, c = (e, t) => {
 		if (s === void 0 || s.columns.size === 0) return;
 		let n = {}, r = !1;
 		for (let i of s.columns) {
-			if (!(i in t) || bt(e[i], t[i])) continue;
+			if (!(i in t) || kt(e[i], t[i])) continue;
 			let a = s.incremental(i, e[i], t[i]);
 			if (a === void 0) return;
 			n[i] = a, r = !0;
@@ -98,15 +98,15 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 		ops: i,
 		order: a
 	};
-}, St = (e) => e.every((e) => {
+}, jt = (e) => e.every((e) => {
 	let t = e.id;
 	return typeof t == "string" || typeof t == "number";
-}), Ct = (e, t, n = {}) => {
+}), Mt = (e, t, n = {}) => {
 	let r = /* @__PURE__ */ new Map();
 	for (let t of e) r.set(t.id, t);
 	for (let e of t.ops) {
 		if (e.op === "mergeCells") {
-			let t = yt(e.path), i = r.get(t) ?? r.get(Number(t)), a = r.has(t) ? t : Number(t);
+			let t = Ot(e.path), i = r.get(t) ?? r.get(Number(t)), a = r.has(t) ? t : Number(t);
 			if (i === void 0) continue;
 			let o = { ...i };
 			for (let [t, r] of Object.entries(e.value)) o[t] = n.mergeCell === void 0 ? r : n.mergeCell(t, i[t], r);
@@ -121,22 +121,22 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 		t !== void 0 && i.push(t);
 	}
 	return i;
-}, y = (e) => p.Union(p.Struct({
-	_tag: p.Literal("snapshot"),
-	revision: p.Number,
+}, Nt = (e) => m.Union(m.Struct({
+	_tag: m.Literal("snapshot"),
+	revision: m.Number,
 	data: e,
-	computed: p.optional(p.Boolean),
-	reconciles: p.optional(p.String)
-}), p.Struct({
-	_tag: p.Literal("delta"),
-	revision: p.Number,
-	emittedAt: p.Number,
-	patch: vt
-}), p.Struct({
-	_tag: p.Literal("error"),
-	error: p.Unknown,
-	revision: p.optional(p.Number)
-})), wt = (e, t, n) => {
+	computed: m.optional(m.Boolean),
+	reconciles: m.optional(m.String)
+}), m.Struct({
+	_tag: m.Literal("delta"),
+	revision: m.Number,
+	emittedAt: m.Number,
+	patch: Dt
+}), m.Struct({
+	_tag: m.Literal("error"),
+	error: m.Unknown,
+	revision: m.optional(m.Number)
+})), Pt = (e, t, n) => {
 	if (!t || typeof t != "object" || !("_tag" in t)) return t;
 	let r = t;
 	switch (r._tag) {
@@ -148,42 +148,42 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 		case "delta": throw Error(`${n} ${e}: received a 'delta' as the first event, which should be impossible — a subscription always opens with a snapshot. This is a framework bug.`);
 		default: return t;
 	}
-}, b = (e, t) => {
+}, Ft = (e, t) => {
 	let n = `${e ?? "this procedure"} input`;
 	return t === !0 ? `${n} (guarded — the guard did NOT run: the payload failed to decode first, so this says nothing about access)` : n;
-}, Tt = (e) => {
+}, It = (e) => {
 	let t = e.ast;
 	return t._tag === "TypeLiteral" && (t.propertySignatures?.length ?? 0) === 0 && (t.indexSignatures?.length ?? 0) === 0;
-}, x = (e, t, n) => {
-	let r = b(t, n), i = e.annotations({
+}, y = (e, t, n) => {
+	let r = Ft(t, n), i = e.annotations({
 		parseOptions: { onExcessProperty: "error" },
 		parseIssueTitle: () => r
 	});
-	return Tt(e) ? p.filter((e) => typeof e == "object" && e && Object.keys(e).length > 0 ? `this procedure declares no input; received: ${Object.keys(e).join(", ")}` : void 0)(i).annotations({ identifier: r }) : i;
-}, Et = class extends p.TaggedError()("BusinessRuleViolation", {
-	rule: p.String,
-	params: p.optional(p.Record({
-		key: p.String,
-		value: p.Unknown
+	return It(e) ? m.filter((e) => typeof e == "object" && e && Object.keys(e).length > 0 ? `this procedure declares no input; received: ${Object.keys(e).join(", ")}` : void 0)(i).annotations({ identifier: r }) : i;
+}, Lt = class extends m.TaggedError()("BusinessRuleViolation", {
+	rule: m.String,
+	params: m.optional(m.Record({
+		key: m.String,
+		value: m.Unknown
 	})),
-	field: p.optional(p.String),
-	message: p.optional(p.String),
-	severity: p.Literal("error", "warning")
-}) {}, Dt = p.Struct({
-	field: p.String,
-	message: p.String,
-	params: p.optional(p.Record({
-		key: p.String,
-		value: p.Unknown
+	field: m.optional(m.String),
+	message: m.optional(m.String),
+	severity: m.Literal("error", "warning")
+}) {}, Rt = m.Struct({
+	field: m.String,
+	message: m.String,
+	params: m.optional(m.Record({
+		key: m.String,
+		value: m.Unknown
 	}))
-}), Ot = class extends p.TaggedError()("ValidationError", {
-	field: p.String,
-	message: p.String,
-	params: p.optional(p.Record({
-		key: p.String,
-		value: p.Unknown
+}), zt = class extends m.TaggedError()("ValidationError", {
+	field: m.String,
+	message: m.String,
+	params: m.optional(m.Record({
+		key: m.String,
+		value: m.Unknown
 	}))
-}) {}, kt = class extends p.TaggedError()("ValidationErrors", { issues: p.Array(Dt).pipe(p.minItems(1)) }) {}, At = (e) => {
+}) {}, Bt = class extends m.TaggedError()("ValidationErrors", { issues: m.Array(Rt).pipe(m.minItems(1)) }) {}, Vt = (e) => {
 	if (typeof e != "object" || !e) return [];
 	let t = e._tag;
 	if (t === "ValidationError") {
@@ -209,69 +209,69 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 		}];
 	}
 	return [];
-}, jt = class extends p.TaggedError()("ApprovalRequired", {
-	approvalId: p.String,
-	procedure: p.String,
-	expiresAt: p.String,
-	requiredScopes: p.Array(p.String),
-	reason: p.NullOr(p.String),
-	created: p.Boolean
-}) {}, Mt = class extends p.TaggedError()("ApprovalNotFound", { approvalId: p.String }) {}, Nt = class extends p.TaggedError()("ApprovalSelfApproval", {
-	approvalId: p.String,
-	subjectId: p.NullOr(p.String)
-}) {}, Pt = class extends p.TaggedError()("ApprovalRejected", {
-	approvalId: p.String,
-	decidedBy: p.NullOr(p.String),
-	note: p.NullOr(p.String)
-}) {}, S = class extends p.TaggedError()("ApprovalExpired", {
-	approvalId: p.String,
-	expiredAt: p.String
-}) {}, Ft = class extends p.TaggedError()("ApprovalNotPending", {
-	approvalId: p.String,
-	status: p.String
-}) {}, It = class extends p.TaggedError()("ApprovalForbidden", {
-	approvalId: p.String,
-	required: p.NullOr(p.String),
-	message: p.String
-}) {}, C = class extends p.TaggedError()("ApprovalUnavailable", {
-	procedure: p.String,
-	message: p.String
-}) {}, Lt = p.Union(jt, Pt, S, C), Rt = p.Union(Mt, Nt, S, Ft, It, C), zt = p.Struct({
-	id: p.String,
-	procedure: p.String,
-	kind: p.Literal("mutation", "action"),
-	requestedBy: p.NullOr(p.String),
-	status: p.Literal("pending", "approved", "rejected", "expired", "consumed"),
-	reason: p.NullOr(p.String),
-	requiredScopes: p.Array(p.String),
-	requestedAt: p.String,
-	expiresAt: p.String,
-	decidedBy: p.NullOr(p.String),
-	decidedAt: p.NullOr(p.String),
-	note: p.NullOr(p.String),
-	relation: p.Literal("to-decide", "requested")
-}), w = "channel:", Bt = Symbol.for("@voltro/protocol/reactivityChannels"), Vt = globalThis, T = Vt[Bt] ?? (Vt[Bt] = /* @__PURE__ */ new Map()), Ht = /^[a-z][a-z0-9-]*(\.[a-z0-9-]+)*$/, Ut = (e) => {
-	if (!Ht.test(e)) throw Error(`reactivityChannel('${e}'): invalid channel name.\n  Use lowercase kebab segments separated by dots — \`presence\`, \`job-queue\`,
+}, Ht = class extends m.TaggedError()("ApprovalRequired", {
+	approvalId: m.String,
+	procedure: m.String,
+	expiresAt: m.String,
+	requiredScopes: m.Array(m.String),
+	reason: m.NullOr(m.String),
+	created: m.Boolean
+}) {}, Ut = class extends m.TaggedError()("ApprovalNotFound", { approvalId: m.String }) {}, Wt = class extends m.TaggedError()("ApprovalSelfApproval", {
+	approvalId: m.String,
+	subjectId: m.NullOr(m.String)
+}) {}, Gt = class extends m.TaggedError()("ApprovalRejected", {
+	approvalId: m.String,
+	decidedBy: m.NullOr(m.String),
+	note: m.NullOr(m.String)
+}) {}, b = class extends m.TaggedError()("ApprovalExpired", {
+	approvalId: m.String,
+	expiredAt: m.String
+}) {}, Kt = class extends m.TaggedError()("ApprovalNotPending", {
+	approvalId: m.String,
+	status: m.String
+}) {}, qt = class extends m.TaggedError()("ApprovalForbidden", {
+	approvalId: m.String,
+	required: m.NullOr(m.String),
+	message: m.String
+}) {}, x = class extends m.TaggedError()("ApprovalUnavailable", {
+	procedure: m.String,
+	message: m.String
+}) {}, Jt = m.Union(Ht, Gt, b, x), Yt = m.Union(Ut, Wt, b, Kt, qt, x), Xt = m.Struct({
+	id: m.String,
+	procedure: m.String,
+	kind: m.Literal("mutation", "action"),
+	requestedBy: m.NullOr(m.String),
+	status: m.Literal("pending", "approved", "rejected", "expired", "consumed"),
+	reason: m.NullOr(m.String),
+	requiredScopes: m.Array(m.String),
+	requestedAt: m.String,
+	expiresAt: m.String,
+	decidedBy: m.NullOr(m.String),
+	decidedAt: m.NullOr(m.String),
+	note: m.NullOr(m.String),
+	relation: m.Literal("to-decide", "requested")
+}), S = "channel:", Zt = Symbol.for("@voltro/protocol/reactivityChannels"), Qt = globalThis, C = Qt[Zt] ?? (Qt[Zt] = /* @__PURE__ */ new Map()), $t = /^[a-z][a-z0-9-]*(\.[a-z0-9-]+)*$/, en = (e) => {
+	if (!$t.test(e)) throw Error(`reactivityChannel('${e}'): invalid channel name.\n  Use lowercase kebab segments separated by dots — \`presence\`, \`job-queue\`,
   \`billing.usage\`. A \`:\` is refused because it is the namespace separator in
-  the routing key (\`${w}<name>\`), and an uppercase letter is\n  refused because a key that differs only by case reads as one channel and
+  the routing key (\`${S}<name>\`), and an uppercase letter is\n  refused because a key that differs only by case reads as one channel and
   routes as two.`);
-	let t = T.get(e);
+	let t = C.get(e);
 	if (t !== void 0) return t;
-	let n = `${w}${e}`, r = Object.freeze({
+	let n = `${S}${e}`, r = Object.freeze({
 		kind: "reactivity-channel",
 		name: e,
 		key: n,
 		toString: () => n
 	});
-	return T.set(e, r), r;
-}, Wt = (e) => typeof e == "object" && !!e && e.kind === "reactivity-channel", Gt = (e) => e.startsWith(w), Kt = () => new Set([...T.values()].map((e) => e.key)), E = (e) => Wt(e) ? e.key : e, qt = (e) => e === void 0 ? [] : Array.isArray(e) ? e.map(E) : [E(e)], Jt = (e) => e === void 0 ? void 0 : Array.isArray(e) ? e.map(E) : E(e), Yt = (e) => {
-	let t = Kt(), n = [];
-	for (let r of e) for (let e of qt(r.source)) Gt(e) && !t.has(e) && n.push({
+	return C.set(e, r), r;
+}, tn = (e) => typeof e == "object" && !!e && e.kind === "reactivity-channel", nn = (e) => e.startsWith(S), rn = () => new Set([...C.values()].map((e) => e.key)), w = (e) => tn(e) ? e.key : e, an = (e) => e === void 0 ? [] : Array.isArray(e) ? e.map(w) : [w(e)], on = (e) => e === void 0 ? void 0 : Array.isArray(e) ? e.map(w) : w(e), sn = (e) => {
+	let t = rn(), n = [];
+	for (let r of e) for (let e of an(r.source)) nn(e) && !t.has(e) && n.push({
 		procedure: r.name,
 		key: e
 	});
 	return n;
-}, Xt = (e, t) => {
+}, cn = (e, t) => {
 	let n = e?.injectExternalChange;
 	return n !== void 0 && (n.call(e, {
 		table: t.key,
@@ -280,8 +280,8 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 		old: {},
 		origin: "inline"
 	}), !0);
-}, Zt = (e) => e.internal !== !0, D = (e) => {
-	if (Qt(e), e.idempotencyScope !== void 0 && e.idempotencyScope !== "subject" && e.idempotencyScope !== "connection") throw Error(`${e.name}: idempotencyScope must be 'subject' or 'connection'`);
+}, T = (e) => e.internal !== !0, ln = (e) => e.service === void 0 ? "client" : "service", un = (e) => T(e) && e.service === void 0, dn = (e) => T(e) && e.service !== void 0, E = /^[a-z][a-z0-9-]{0,55}$/i, D = (e) => {
+	if (pn(e), fn(e), e.idempotencyScope !== void 0 && e.idempotencyScope !== "subject" && e.idempotencyScope !== "connection") throw Error(`${e.name}: idempotencyScope must be 'subject' or 'connection'`);
 	let t = e.serialize;
 	if (t !== void 0) {
 		if (typeof t.key != "function") throw Error(`${e.name}: serialize.key must be a function of the input`);
@@ -305,7 +305,27 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 	let r = [e.publicApi === void 0 ? void 0 : "publicApi", e.exposeAsTool === void 0 ? void 0 : "exposeAsTool"].filter((e) => e !== void 0);
 	if (r.length === 0) return e;
 	throw Error(`${e.name}: \`internal: true\` cannot be combined with ${r.map((e) => `\`${e}\``).join(" or ")}. \`internal\` takes the procedure OFF the wire; those put it back ON a different one (${r.includes("publicApi") ? "a REST route" : "an agent tool"}), and that surface is projected without consulting the flag — so the procedure would be unreachable from your client and reachable from the internet. Drop \`internal: true\` if the wider surface is intended, or remove the ${r.join(" / ")} annotation if it is not.`);
-}, Qt = (e) => {
+}, fn = (e) => {
+	let t = e.service;
+	if (t === void 0) return;
+	let n = t.callers;
+	if (!Array.isArray(n) || n.length === 0) throw Error(`${e.name}: \`service.callers\` is empty, so NO app may call this procedure —\n  and no browser either. Name the calling app(s), e.g. \`service: { callers: ['worker'] }\`,
+  or drop \`service:\` if the procedure is meant for this app's own clients.`);
+	let r = n.filter((e) => typeof e != "string" || !E.test(e));
+	if (r.length > 0) throw Error(`${e.name}: \`service.callers\` holds ${r.map((e) => JSON.stringify(e)).join(", ")} — a caller is an\n  app name (letters, digits, dashes; starting with a letter; at most 56 characters), the same name this app
+  lists in \`serviceCallers\` and the caller's credential resolves to.`);
+	if (new Set(n).size !== n.length) throw Error(`${e.name}: \`service.callers\` lists the same app twice`);
+	let i = [
+		e.internal === !0 ? "`internal: true` (it removes the wire surface a service calls over)" : void 0,
+		e.publicApi === void 0 ? void 0 : "`publicApi` (a REST route is for callers that are not the listed apps)",
+		e.exposeAsTool === void 0 ? void 0 : "`exposeAsTool` (an agent tool is not one of the listed apps)",
+		e.requiresApproval === void 0 ? void 0 : "`requiresApproval` (a second HUMAN cannot approve a machine call)",
+		e.overridesPlugin === !0 ? "`overridesPlugin` (a plugin route is a client surface; replacing it with a service-only one breaks its clients)" : void 0,
+		e.idempotencyScope === "connection" ? "`idempotencyScope: 'connection'` (a service call dedups per service, across reconnects)" : void 0
+	].filter((e) => e !== void 0);
+	if (i.length !== 0) throw Error(`${e.name}: \`service:\` cannot be combined with ${i.join("; ")}.\n  A service procedure is callable only by the listed apps of this project, over the
+  socket, with their service credential. Drop the other field, or drop \`service:\`.`);
+}, pn = (e) => {
 	let t = e.requiresApproval;
 	if (t !== void 0) {
 		if (!Array.isArray(t.approvers) || t.approvers.length === 0) throw Error(`${e.name}: \`requiresApproval.approvers\` is empty, so NOBODY can approve this\n  procedure and every call would park forever. Name the scope(s) an approver must hold
@@ -315,23 +335,29 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
   human from every other, and the second-pair-of-eyes control would enforce nothing.
   Give the procedure a \`guards:\` decision, or drop \`requiresApproval\`.`);
 	}
-}, $t = (e) => e.action !== void 0 && e.resourceType !== void 0, en = (e) => e.authenticated === !0, tn = (e) => e.openAccess !== void 0 || e.guards !== void 0 && e.guards.length > 0, O = (e, t, n) => {
+}, mn = (e) => e.action !== void 0 && e.resourceType !== void 0, hn = (e) => e.authenticated === !0, gn = (e) => e.openAccess !== void 0 || e.guards !== void 0 && e.guards.length > 0, O = (e, t, n, r) => {
+	if (r !== void 0) {
+		if (n !== void 0 || t !== void 0 && t.length > 0) throw Error(`${e}: \`service:\` is an access decision of its own — only the listed apps may\n  call this procedure — so it cannot sit beside \`guards:\` or \`openAccess:\`. A service
+  holds no scopes, and no user may call a service procedure. Keep exactly one.`);
+		return Array.isArray(r.callers) ? [d(r.callers)] : void 0;
+	}
 	if (n === void 0) return t;
 	if (n.trim() === "") throw Error(`${e}: \`openAccess\` needs a REASON, not an empty string. It is the sentence a\n  reviewer reads to decide whether this procedure should really be callable
   without an authorization check — e.g. \`openAccess: 'public pricing, no caller data'\`.`);
 	if (t !== void 0 && t.length > 0) throw Error(`${e}: \`openAccess\` and \`guards\` are two different access decisions, so\n  declaring both says the procedure is protected AND open. Keep the guards if a
   caller must hold a scope; drop them if anyone may call it.`);
-	return [d(n.trim())];
+	return [f(n.trim())];
 }, k = (e) => D({
 	kind: "query",
 	name: e.name,
 	input: e.input,
 	output: e.output,
-	error: e.error ?? p.Never,
-	source: Jt(e.source),
+	error: e.error ?? m.Never,
+	source: on(e.source),
 	cache: e.cache,
-	guards: O(e.name, e.guards, e.openAccess),
+	guards: O(e.name, e.guards, e.openAccess, e.service),
 	openAccess: e.openAccess,
+	service: e.service === void 0 ? void 0 : { callers: Array.isArray(e.service.callers) ? [...e.service.callers] : e.service.callers },
 	publicApi: e.publicApi,
 	exposeAsTool: e.exposeAsTool,
 	internal: e.internal,
@@ -341,12 +367,13 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 	name: e.name,
 	input: e.input,
 	output: e.output,
-	error: e.error ?? p.Never,
+	error: e.error ?? m.Never,
 	...e.idempotencyScope === void 0 ? {} : { idempotencyScope: e.idempotencyScope },
 	...e.serialize === void 0 ? {} : { serialize: e.serialize },
 	target: e.target,
-	guards: O(e.name, e.guards, e.openAccess),
+	guards: O(e.name, e.guards, e.openAccess, e.service),
 	openAccess: e.openAccess,
+	service: e.service === void 0 ? void 0 : { callers: Array.isArray(e.service.callers) ? [...e.service.callers] : e.service.callers },
 	publicApi: e.publicApi,
 	exposeAsTool: e.exposeAsTool,
 	requiresApproval: e.requiresApproval,
@@ -357,9 +384,10 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 	name: e.name,
 	input: e.input,
 	output: e.output,
-	error: e.error ?? p.Never,
-	guards: O(e.name, e.guards, e.openAccess),
+	error: e.error ?? m.Never,
+	guards: O(e.name, e.guards, e.openAccess, e.service),
 	openAccess: e.openAccess,
+	service: e.service === void 0 ? void 0 : { callers: Array.isArray(e.service.callers) ? [...e.service.callers] : e.service.callers },
 	source: e.source,
 	target: e.target,
 	publicApi: e.publicApi,
@@ -367,54 +395,54 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 	requiresApproval: e.requiresApproval,
 	internal: e.internal,
 	overridesPlugin: e.overridesPlugin
-}), nn = (e) => D({
+}), _n = (e) => D({
 	kind: "stream",
 	name: e.name,
 	input: e.input,
 	element: e.element,
-	error: e.error ?? p.Never,
+	error: e.error ?? m.Never,
 	internal: e.internal,
 	overridesPlugin: e.overridesPlugin,
 	guards: O(e.name, e.guards, e.openAccess),
 	openAccess: e.openAccess
-}), M = (e, t) => t && t.length > 0 ? p.Union(e, ...t) : e, N = (e) => e !== void 0 && e.some((e) => !u(e)), rn = (e) => p.Union(e, f, l), an = (e) => p.Union(e, Et), on = (e) => p.Union(e, Ot, kt), sn = (e, t) => t === void 0 ? e : p.Union(e, Lt), P = (e, t) => {
-	let n = rn(e.error);
+}), M = (e, t) => t && t.length > 0 ? m.Union(e, ...t) : e, N = (e) => e !== void 0 && e.some((e) => !l(e)), vn = (e) => m.Union(e, u, p), yn = (e) => m.Union(e, Lt), bn = (e) => m.Union(e, zt, Bt), xn = (e, t) => t === void 0 ? e : m.Union(e, Jt), P = (e, t) => {
+	let n = vn(e.error);
 	if (t === "stream" || t === "query") return n;
-	let r = t === "mutation" ? p.Union(an(n), dt, ht) : n;
-	return sn(on(t === "mutation" && e.idempotencyScope === "connection" ? p.Union(r, qe) : r), e.requiresApproval);
-}, cn = (e, t) => M(rn(e.errorSchema), t), ln = (e, t) => ({
+	let r = t === "mutation" ? m.Union(yn(n), Xe, Ct) : n;
+	return xn(bn(t === "mutation" && e.idempotencyScope === "connection" ? m.Union(r, yt) : r), e.requiresApproval);
+}, Sn = (e, t) => M(vn(e.errorSchema), t), Cn = (e, t) => ({
 	...e,
 	name: t
-}), un = (e, t) => m.make(e.name, {
-	payload: x(e.input, e.name, N(e.guards)),
-	success: y(e.output),
+}), wn = (e, t) => h.make(e.name, {
+	payload: y(e.input, e.name, N(e.guards)),
+	success: Nt(e.output),
 	error: M(P(e, "query"), t),
 	stream: !0
-}), dn = (e, t) => m.make(e.name, {
-	payload: x(e.input, e.name, N(e.guards)),
+}), Tn = (e, t) => h.make(e.name, {
+	payload: y(e.input, e.name, N(e.guards)),
 	success: e.output,
 	error: M(P(e, "mutation"), t)
-}), fn = (e, t) => m.make(e.name, {
-	payload: x(e.input, e.name, N(e.guards)),
+}), En = (e, t) => h.make(e.name, {
+	payload: y(e.input, e.name, N(e.guards)),
 	success: e.output,
 	error: M(P(e, "action"), t)
-}), pn = (e, t) => m.make(e.name, {
-	payload: x(e.input, e.name, N(e.guards)),
+}), Dn = (e, t) => h.make(e.name, {
+	payload: y(e.input, e.name, N(e.guards)),
 	success: e.element,
 	error: M(e.error, t),
 	stream: !0
-}), mn = (e) => {
+}), On = (e) => {
 	if (typeof e != "object" || !e) return;
 	let t = e._tag;
 	return typeof t == "string" ? t : void 0;
-}, hn = (e) => {
+}, kn = (e) => {
 	switch (e.kind) {
-		case "query": return un(e);
-		case "mutation": return dn(e);
-		case "action": return fn(e);
-		case "stream": return pn(e);
+		case "query": return wn(e);
+		case "mutation": return Tn(e);
+		case "action": return En(e);
+		case "stream": return Dn(e);
 	}
-}, gn = (e) => {
+}, An = (e) => {
 	let t = e.input, n = t === void 0 ? {} : { input: t }, r = e.output, i = r === void 0 ? {} : { output: r };
 	if (e.kind === "query") return {
 		kind: "query",
@@ -460,7 +488,7 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 			..."relations" in e && e.relations !== void 0 ? { relations: e.relations } : {}
 		}))
 	};
-}, _n = 7500, vn = (e) => typeof e == "object" && !!e && e.kind === "event", yn = (e) => {
+}, jn = 7500, Mn = (e) => typeof e == "object" && !!e && e.kind === "event", Nn = (e) => {
 	if (e.name.length === 0) throw Error("defineEvent: `name` must not be empty");
 	if (/\s/.test(e.name)) throw Error(`defineEvent("${e.name}"): \`name\` must not contain whitespace.\n  The name is used as a broker subject segment. NATS refuses a subject with
   whitespace and delivers nothing — silently, and only on that broker, so an
@@ -489,68 +517,68 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 		name: e.name,
 		key: e.key,
 		payload: e.payload,
-		guards: e.openAccess === void 0 ? e.guards : [d(e.openAccess.trim())],
+		guards: e.openAccess === void 0 ? e.guards : [f(e.openAccess.trim())],
 		openAccess: e.openAccess,
 		rewind: e.rewind,
 		webhook: e.webhook,
 		delivery: e.delivery
 	};
-}, bn = (e) => p.Struct({
-	_tag: p.Literal("event"),
-	origin: p.String,
-	n: p.Number,
-	emittedAt: p.Number,
+}, Pn = (e) => m.Struct({
+	_tag: m.Literal("event"),
+	origin: m.String,
+	n: m.Number,
+	emittedAt: m.Number,
 	payload: e
-}), xn = p.Struct({
-	_tag: p.Literal("gap"),
-	missed: p.Number,
-	reason: p.Literal("buffer", "resume")
-}), Sn = p.Struct({ _tag: p.Literal("attached") }), Cn = (e) => p.Union(Sn, bn(e), xn), wn = p.Struct({
-	origin: p.String,
-	n: p.Number
-}), Tn = (e) => p.Struct({
+}), Fn = m.Struct({
+	_tag: m.Literal("gap"),
+	missed: m.Number,
+	reason: m.Literal("buffer", "resume")
+}), In = m.Struct({ _tag: m.Literal("attached") }), Ln = (e) => m.Union(In, Pn(e), Fn), Rn = m.Struct({
+	origin: m.String,
+	n: m.Number
+}), zn = (e) => m.Struct({
 	key: e,
-	resume: p.optional(p.Array(wn))
-}), En = (e, t) => {
-	let n = e.guards !== void 0 && e.guards.some((e) => !u(e)) ? p.Union(f, l) : l, r = t && t.length > 0 ? p.Union(n, ...t) : n;
-	return m.make(e.name, {
-		payload: x(Tn(e.key), e.name, N(e.guards)),
-		success: Cn(e.payload),
+	resume: m.optional(m.Array(Rn))
+}), Bn = (e, t) => {
+	let n = e.guards !== void 0 && e.guards.some((e) => !l(e)) ? m.Union(u, p) : p, r = t && t.length > 0 ? m.Union(n, ...t) : n;
+	return h.make(e.name, {
+		payload: y(zn(e.key), e.name, N(e.guards)),
+		success: Ln(e.payload),
 		error: r,
 		stream: !0
 	});
-}, Dn = class extends p.TaggedError()("EventPayloadInvalid", {
-	event: p.String,
-	message: p.String
-}) {}, On = class extends p.TaggedError()("EventKeyInvalid", {
-	event: p.String,
-	message: p.String
-}) {}, kn = class extends p.TaggedError()("EventPayloadTooLarge", {
-	event: p.String,
-	bytes: p.Number,
-	limit: p.Number
-}) {}, An = (e) => {
+}, Vn = class extends m.TaggedError()("EventPayloadInvalid", {
+	event: m.String,
+	message: m.String
+}) {}, Hn = class extends m.TaggedError()("EventKeyInvalid", {
+	event: m.String,
+	message: m.String
+}) {}, Un = class extends m.TaggedError()("EventPayloadTooLarge", {
+	event: m.String,
+	bytes: m.Number,
+	limit: m.Number
+}) {}, Wn = (e) => {
 	if (typeof e != "object" || !e) return JSON.stringify(e) ?? "null";
 	let t = Object.entries(e).filter(([, e]) => e !== void 0).sort(([e], [t]) => e < t ? -1 : +(e > t));
 	return JSON.stringify(t);
-}, jn = "\0", Mn = (e, t, n) => [
+}, Gn = "\0", Kn = (e, t, n) => [
 	e ?? "~",
 	t,
-	An(n)
-].join("\0"), Nn = (e) => {
+	Wn(n)
+].join("\0"), qn = (e) => {
 	let [t = "~", n = "", r = ""] = e.split("\0");
 	return {
 		tenantId: t === "~" ? null : t,
 		event: n,
 		key: r
 	};
-}, Pn = (e) => e.split("\0").join(" · "), F = Symbol.for("@voltro/protocol/workflow-access"), Fn = {
+}, Jn = (e) => e.split("\0").join(" · "), F = Symbol.for("@voltro/protocol/workflow-access"), Yn = {
 	guards: void 0,
 	openAccess: void 0,
 	internal: !1,
 	controls: void 0,
 	controlsOpenAccess: void 0
-}, In = (e, t) => {
+}, Xn = (e, t) => {
 	let n = t.guards;
 	if (n !== void 0 && n.length === 0) throw Error(`workflow("${e}"): \`guards: []\` is empty, so it enforces nothing —\n  but it reads at the call site as if the start were protected. Omit the field
   and decide with \`openAccess\` or \`internal\`, or list the scopes that may start it.`);
@@ -576,22 +604,22 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 		if (r !== void 0 && r.length > 0) throw Error(`workflow("${e}"): \`controls\` takes \`guards\` OR \`openAccess\`, not both.\n  Two answers to one question; keep the guards if a caller needs a scope.`);
 	}
 	return {
-		guards: t.openAccess === void 0 ? t.guards : [d(t.openAccess.trim())],
+		guards: t.openAccess === void 0 ? t.guards : [f(t.openAccess.trim())],
 		openAccess: t.openAccess?.trim(),
 		internal: t.internal === !0,
-		controls: i === void 0 ? r : [d(i.trim())],
+		controls: i === void 0 ? r : [f(i.trim())],
 		controlsOpenAccess: i?.trim()
 	};
-}, Ln = (e, t) => {
+}, Zn = (e, t) => {
 	Object.defineProperty(e, F, {
 		value: t,
 		enumerable: !1
 	});
 }, I = (e) => {
-	if (typeof e != "object" || !e) return Fn;
+	if (typeof e != "object" || !e) return Yn;
 	let t = e[F];
-	return t === void 0 ? Fn : t;
-}, Rn = (e) => {
+	return t === void 0 ? Yn : t;
+}, Qn = (e) => {
 	let t = I(e);
 	return {
 		name: e.name,
@@ -600,18 +628,23 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 		openAccess: t.openAccess,
 		controls: t.controls
 	};
-}, zn = (e) => e, Bn = (e) => e, Vn = (e) => {
+}, $n = class extends m.TaggedError()("ApiUnavailable", {
+	api: m.String,
+	tag: m.String,
+	reason: m.Literal("timeout", "transport", "closed"),
+	message: m.String
+}) {}, er = (e) => typeof e == "object" && !!e && e._tag === "ApiUnavailable", tr = (e) => e, nr = (e) => e, rr = (e) => {
 	let t = e.alias?.trim(), n = e.instance?.trim(), r = t !== void 0 && t !== "" ? t : e.base;
 	return n !== void 0 && n !== "" ? `${r}#${n}` : r;
-}, Hn = (e) => {
+}, ir = (e) => {
 	if (e.length !== 0) return (t, n) => e.reduceRight((e, t) => t(e, n), t);
-}, Un = (e, t) => {
-	let n = pt.GenericTag(e);
+}, ar = (e, t) => {
+	let n = xt.GenericTag(e);
 	return {
 		Tag: n,
-		Live: mt.succeed(n, t)
+		Live: St.succeed(n, t)
 	};
-}, Wn = (e, t, n) => {
+}, or = (e, t, n) => {
 	if (!t) return { ok: !0 };
 	let r = n === void 0 ? null : L(n);
 	if (!r) return {
@@ -621,7 +654,7 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 	let i = t.trim();
 	if (i === "*" || i === "") return { ok: !0 };
 	let a = i.split(/\s+/).filter((e) => e.length > 0);
-	for (let i of a) if (!Gn(i, r)) return {
+	for (let i of a) if (!sr(i, r)) return {
 		ok: !1,
 		reason: `plugin "${e}" requires framework ${t}, running ${n}`
 	};
@@ -634,7 +667,7 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 		patch: Number(t[3]),
 		pre: t[4] ?? ""
 	} : null;
-}, R = (e, t) => e.major === t.major ? e.minor === t.minor ? e.patch === t.patch ? e.pre && !t.pre ? -1 : !e.pre && t.pre ? 1 : e.pre && t.pre ? e.pre < t.pre ? -1 : +(e.pre > t.pre) : 0 : e.patch - t.patch : e.minor - t.minor : e.major - t.major, Gn = (e, t) => {
+}, R = (e, t) => e.major === t.major ? e.minor === t.minor ? e.patch === t.patch ? e.pre && !t.pre ? -1 : !e.pre && t.pre ? 1 : e.pre && t.pre ? e.pre < t.pre ? -1 : +(e.pre > t.pre) : 0 : e.patch - t.patch : e.minor - t.minor : e.major - t.major, sr = (e, t) => {
 	if (e === "*") return !0;
 	if (e.startsWith("^")) {
 		let n = L(e.slice(1));
@@ -656,87 +689,87 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 	}
 	let r = L(e);
 	return r ? R(t, r) === 0 : !1;
-}, Kn = (e) => {
+}, cr = (e) => {
 	let t = e.startsWith("@") ? e.replace(/^@[^/]+\//, "") : e;
 	return (t.startsWith("plugin-") ? t.slice(7) : t).replace(/-([a-zA-Z0-9])/g, (e, t) => t.toUpperCase());
-}, qn = (e) => {
+}, lr = (e) => {
 	let t = e.startsWith("@") ? e.replace(/^@[^/]+\//, "") : e;
 	return (t.startsWith("plugin-") ? t.slice(7) : t).replace(/#/g, "--").replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
-}, Jn = Symbol.for("@voltro/protocol/pluginAliases"), z = () => {
-	let e = globalThis, t = e[Jn];
+}, ur = Symbol.for("@voltro/protocol/pluginAliases"), z = () => {
+	let e = globalThis, t = e[ur];
 	if (t instanceof Map) return t;
 	let n = /* @__PURE__ */ new Map();
-	return e[Jn] = n, n;
-}, Yn = (e) => {
+	return e[ur] = n, n;
+}, dr = (e) => {
 	let t = z();
 	for (let [n, r] of Object.entries(e)) {
 		if (r === "") continue;
 		let e = t.get(n);
 		e === void 0 ? t.set(n, /* @__PURE__ */ new Set([r])) : e.add(r);
 	}
-}, Xn = () => {
+}, fr = () => {
 	z().clear();
-}, Zn = (e, t) => {
+}, pr = (e, t) => {
 	let n = z().get(e);
-	if (n === void 0 || n.size === 0) return `${Kn(e)}.${t}`;
+	if (n === void 0 || n.size === 0) return `${cr(e)}.${t}`;
 	if (n.size === 1) return `${[...n][0]}.${t}`;
 	let r = [...n].filter((e) => !e.includes("#"));
 	if (r.length === 1) return `${r[0]}.${t}`;
 	throw Error(`[voltro] ${e} is installed more than once (${[...n].sort().join(", ")}) and no single install is the primary one, so a plugin hook cannot tell which of them it addresses. Call the route by its full tag instead — e.g. useSubscription(api, '${[...n].sort()[0]}.${t}').`);
-}, B = p.Union(p.Struct({
-	kind: p.Literal("dropped"),
-	at: p.Number,
-	retryAfterMs: p.Number
-}), p.Struct({
-	kind: p.Literal("skipped"),
-	at: p.Number,
-	executionId: p.String,
-	runId: p.String
-}), p.Struct({
-	kind: p.Literal("superseded"),
-	at: p.Number
-}), p.Struct({
-	kind: p.Literal("cancelled"),
-	at: p.Number
-}), p.Struct({
-	kind: p.Literal("abandoned"),
-	at: p.Number,
-	failureId: p.NonEmptyString
-})), V = p.Literal("running", "succeeded", "failed", "cancelled", "suspended"), H = p.Struct({
-	id: p.String,
-	workflowName: p.String,
-	executionId: p.String,
-	status: p.Union(V, p.Literal("unknown")),
-	output: p.optional(p.Unknown),
-	error: p.optional(p.Struct({
-		tag: p.NullOr(p.String),
-		message: p.String
+}, B = m.Union(m.Struct({
+	kind: m.Literal("dropped"),
+	at: m.Number,
+	retryAfterMs: m.Number
+}), m.Struct({
+	kind: m.Literal("skipped"),
+	at: m.Number,
+	executionId: m.String,
+	runId: m.String
+}), m.Struct({
+	kind: m.Literal("superseded"),
+	at: m.Number
+}), m.Struct({
+	kind: m.Literal("cancelled"),
+	at: m.Number
+}), m.Struct({
+	kind: m.Literal("abandoned"),
+	at: m.Number,
+	failureId: m.NonEmptyString
+})), V = m.Literal("running", "succeeded", "failed", "cancelled", "suspended"), H = m.Struct({
+	id: m.String,
+	workflowName: m.String,
+	executionId: m.String,
+	status: m.Union(V, m.Literal("unknown")),
+	output: m.optional(m.Unknown),
+	error: m.optional(m.Struct({
+		tag: m.NullOr(m.String),
+		message: m.String
 	}))
-}), U = p.Struct({
-	operation: p.Literal("cancel", "resume"),
-	kind: p.Literal("accepted", "confirmed", "unknown", "already-terminal"),
-	requestId: p.NullOr(p.NonEmptyString),
+}), U = m.Struct({
+	operation: m.Literal("cancel", "resume"),
+	kind: m.Literal("accepted", "confirmed", "unknown", "already-terminal"),
+	requestId: m.NullOr(m.NonEmptyString),
 	snapshot: H
-}).pipe(p.filter((e) => e.kind === "unknown" ? !0 : e.kind === "accepted" ? e.requestId !== null && (e.snapshot.status === "running" || e.snapshot.status === "suspended") : e.kind === "already-terminal" ? e.snapshot.status === "succeeded" || e.snapshot.status === "failed" || e.snapshot.status === "cancelled" : e.operation === "cancel" ? e.snapshot.status === "cancelled" : e.requestId !== null && e.snapshot.status === "running", { message: () => "Workflow control acknowledgement contradicts its observed state or receipt identity" })), W = p.Struct({
-	operation: p.Literal("cancel"),
-	workflowName: p.NonEmptyString,
-	receiptId: p.NonEmptyString,
-	requestId: p.NullOr(p.NonEmptyString),
-	kind: p.Literal("accepted", "confirmed", "unknown", "already-terminal"),
-	observation: p.Union(p.Struct({ kind: p.Literal("pending") }), p.Struct({
-		kind: p.Literal("admission"),
-		outcome: p.Union(B, p.Struct({
-			kind: p.Literal("rejected"),
-			failureId: p.NonEmptyString
+}).pipe(m.filter((e) => e.kind === "unknown" ? !0 : e.kind === "accepted" ? e.requestId !== null && (e.snapshot.status === "running" || e.snapshot.status === "suspended") : e.kind === "already-terminal" ? e.snapshot.status === "succeeded" || e.snapshot.status === "failed" || e.snapshot.status === "cancelled" : e.operation === "cancel" ? e.snapshot.status === "cancelled" : e.requestId !== null && e.snapshot.status === "running", { message: () => "Workflow control acknowledgement contradicts its observed state or receipt identity" })), W = m.Struct({
+	operation: m.Literal("cancel"),
+	workflowName: m.NonEmptyString,
+	receiptId: m.NonEmptyString,
+	requestId: m.NullOr(m.NonEmptyString),
+	kind: m.Literal("accepted", "confirmed", "unknown", "already-terminal"),
+	observation: m.Union(m.Struct({ kind: m.Literal("pending") }), m.Struct({
+		kind: m.Literal("admission"),
+		outcome: m.Union(B, m.Struct({
+			kind: m.Literal("rejected"),
+			failureId: m.NonEmptyString
 		}))
-	}), p.Struct({
-		kind: p.Literal("execution"),
+	}), m.Struct({
+		kind: m.Literal("execution"),
 		snapshot: H
-	}), p.Struct({
-		kind: p.Literal("unavailable"),
-		reason: p.Literal("missing-request", "missing-run", "unconfirmed-generation", "unbound-submission")
+	}), m.Struct({
+		kind: m.Literal("unavailable"),
+		reason: m.Literal("missing-request", "missing-run", "unconfirmed-generation", "unbound-submission")
 	}))
-}).pipe(p.filter((e) => {
+}).pipe(m.filter((e) => {
 	let t = e.observation;
 	if (t.kind === "unavailable") return e.kind === "unknown" && (t.reason === "missing-request" ? e.requestId === null : e.requestId !== null);
 	if (e.requestId === null) return !1;
@@ -744,307 +777,307 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 	if (t.kind === "admission") return e.kind === (t.outcome.kind === "cancelled" ? "confirmed" : "already-terminal");
 	let n = t.snapshot;
 	return n.workflowName !== e.workflowName || n.id.length === 0 || n.executionId.length === 0 ? !1 : e.kind === "accepted" ? n.status === "running" || n.status === "suspended" : e.kind === "confirmed" ? n.status === "cancelled" : e.kind === "already-terminal" && (n.status === "succeeded" || n.status === "failed" || n.status === "cancelled");
-}, { message: () => "Queued cancellation acknowledgement contradicts its receipt or observation" })), Qn = p.Literal("cancel", "terminate", "abandon"), $n = p.Struct({
-	mode: p.String,
-	dueAt: p.NullOr(p.Number),
-	retryAfterMs: p.NullOr(p.Number),
-	intentId: p.NullOr(p.String)
-}), er = p.Struct({
-	id: p.String,
-	workflowName: p.String,
-	executionId: p.NullOr(p.String),
-	status: p.Literal("running", "succeeded", "queued", "dropped", "skipped", "replayed"),
-	deferral: p.optional($n)
-}), tr = (e, t) => {
+}, { message: () => "Queued cancellation acknowledgement contradicts its receipt or observation" })), mr = m.Literal("cancel", "terminate", "abandon"), hr = m.Struct({
+	mode: m.String,
+	dueAt: m.NullOr(m.Number),
+	retryAfterMs: m.NullOr(m.Number),
+	intentId: m.NullOr(m.String)
+}), gr = m.Struct({
+	id: m.String,
+	workflowName: m.String,
+	executionId: m.NullOr(m.String),
+	status: m.Literal("running", "succeeded", "queued", "dropped", "skipped", "replayed"),
+	deferral: m.optional(hr)
+}), _r = (e, t) => {
 	let n = I(e);
-	return m.make(e.name, {
-		payload: x(e.payloadSchema, e.name, N(n.guards)),
-		success: er,
-		error: cn({
+	return h.make(e.name, {
+		payload: y(e.payloadSchema, e.name, N(n.guards)),
+		success: gr,
+		error: Sn({
 			errorSchema: e.errorSchema,
 			guards: n.guards
 		}, t)
 	});
-}, G = p.Struct({
-	id: p.String,
-	tag: p.String,
-	executionId: p.String,
+}, G = m.Struct({
+	id: m.String,
+	tag: m.String,
+	executionId: m.String,
 	status: V,
-	payload: p.Unknown,
-	workflowVersion: p.NullOr(p.String),
-	workflowPatches: p.NullOr(p.Unknown),
-	output: p.NullOr(p.Unknown),
-	subject: p.NullOr(p.Unknown),
-	source: p.NullOr(p.String),
-	errorTag: p.NullOr(p.String),
-	errorMessage: p.NullOr(p.String),
-	cancelled: p.Boolean,
-	startedAt: p.Date,
-	completedAt: p.NullOr(p.Date),
-	durationMs: p.NullOr(p.Number),
-	traceId: p.NullOr(p.String),
-	parentExecutionId: p.NullOr(p.String),
-	parentClosePolicy: p.NullOr(Qn)
-}), nr = p.Struct({
-	tag: p.optional(p.String),
-	status: p.optional(V),
-	limit: p.optional(p.Number)
-}), rr = p.Struct({
-	id: p.String,
-	runId: p.String,
-	stepName: p.String,
-	attempt: p.Number,
-	status: p.Literal("running", "succeeded", "failed"),
-	input: p.NullOr(p.Unknown),
-	retryPolicy: p.NullOr(p.Unknown),
-	output: p.NullOr(p.Unknown),
-	errorTag: p.NullOr(p.String),
-	errorMessage: p.NullOr(p.String),
-	errorCause: p.NullOr(p.Unknown),
-	startedAt: p.Date,
-	completedAt: p.NullOr(p.Date),
-	durationMs: p.NullOr(p.Number)
-}), ir = p.Struct({
-	id: p.String,
-	runId: p.String,
-	eventType: p.String,
-	payload: p.NullOr(p.Unknown),
-	occurredAt: p.Date,
-	stepName: p.NullOr(p.String),
-	attempt: p.NullOr(p.Number)
-}), ar = p.Struct({
-	id: p.String,
-	name: p.String,
-	payload: p.Unknown,
-	source: p.String,
-	subject: p.NullOr(p.Unknown),
-	traceId: p.NullOr(p.String),
-	occurredAt: p.Date
-}), or = p.Struct({
-	id: p.String,
-	eventId: p.String,
-	eventName: p.String,
-	triggerId: p.String,
-	workflowName: p.String,
-	executionId: p.NullOr(p.String),
-	status: p.Literal("starting", "started", "skipped", "failed"),
-	idempotencyKey: p.String,
-	skipped: p.Boolean,
-	errorMessage: p.NullOr(p.String),
-	createdAt: p.Date,
-	completedAt: p.NullOr(p.Date)
-}), sr = p.Struct({ id: p.String }), K = p.Struct({ runId: p.String }), cr = p.Struct({
-	name: p.optional(p.String),
-	limit: p.optional(p.Number)
-}), lr = p.Struct({ eventId: p.String }), q = p.Struct({
-	requestId: p.NonEmptyString,
-	cause: p.optionalWith(p.Struct({
-		reason: p.NonEmptyString,
-		detail: p.optional(p.Record({
-			key: p.String,
-			value: p.Unknown
+	payload: m.Unknown,
+	workflowVersion: m.NullOr(m.String),
+	workflowPatches: m.NullOr(m.Unknown),
+	output: m.NullOr(m.Unknown),
+	subject: m.NullOr(m.Unknown),
+	source: m.NullOr(m.String),
+	errorTag: m.NullOr(m.String),
+	errorMessage: m.NullOr(m.String),
+	cancelled: m.Boolean,
+	startedAt: m.Date,
+	completedAt: m.NullOr(m.Date),
+	durationMs: m.NullOr(m.Number),
+	traceId: m.NullOr(m.String),
+	parentExecutionId: m.NullOr(m.String),
+	parentClosePolicy: m.NullOr(mr)
+}), vr = m.Struct({
+	tag: m.optional(m.String),
+	status: m.optional(V),
+	limit: m.optional(m.Number)
+}), yr = m.Struct({
+	id: m.String,
+	runId: m.String,
+	stepName: m.String,
+	attempt: m.Number,
+	status: m.Literal("running", "succeeded", "failed"),
+	input: m.NullOr(m.Unknown),
+	retryPolicy: m.NullOr(m.Unknown),
+	output: m.NullOr(m.Unknown),
+	errorTag: m.NullOr(m.String),
+	errorMessage: m.NullOr(m.String),
+	errorCause: m.NullOr(m.Unknown),
+	startedAt: m.Date,
+	completedAt: m.NullOr(m.Date),
+	durationMs: m.NullOr(m.Number)
+}), br = m.Struct({
+	id: m.String,
+	runId: m.String,
+	eventType: m.String,
+	payload: m.NullOr(m.Unknown),
+	occurredAt: m.Date,
+	stepName: m.NullOr(m.String),
+	attempt: m.NullOr(m.Number)
+}), xr = m.Struct({
+	id: m.String,
+	name: m.String,
+	payload: m.Unknown,
+	source: m.String,
+	subject: m.NullOr(m.Unknown),
+	traceId: m.NullOr(m.String),
+	occurredAt: m.Date
+}), Sr = m.Struct({
+	id: m.String,
+	eventId: m.String,
+	eventName: m.String,
+	triggerId: m.String,
+	workflowName: m.String,
+	executionId: m.NullOr(m.String),
+	status: m.Literal("starting", "started", "skipped", "failed"),
+	idempotencyKey: m.String,
+	skipped: m.Boolean,
+	errorMessage: m.NullOr(m.String),
+	createdAt: m.Date,
+	completedAt: m.NullOr(m.Date)
+}), Cr = m.Struct({ id: m.String }), K = m.Struct({ runId: m.String }), wr = m.Struct({
+	name: m.optional(m.String),
+	limit: m.optional(m.Number)
+}), Tr = m.Struct({ eventId: m.String }), q = m.Struct({
+	requestId: m.NonEmptyString,
+	cause: m.optionalWith(m.Struct({
+		reason: m.NonEmptyString,
+		detail: m.optional(m.Record({
+			key: m.String,
+			value: m.Unknown
 		}))
 	}), { exact: !0 })
-}), J = p.Struct({
-	workflowName: p.String,
-	executionId: p.String,
-	control: p.optional(q)
-}), ur = p.Struct({
-	workflowName: p.NonEmptyString,
-	executionId: p.NonEmptyString,
-	operation: p.Literal("cancel", "resume"),
-	requestId: p.NonEmptyString
-}), Y = p.Struct({
-	workflowName: p.NonEmptyString,
-	receiptId: p.NonEmptyString,
-	requestId: p.NonEmptyString
-}), dr = p.Struct({
+}), J = m.Struct({
+	workflowName: m.String,
+	executionId: m.String,
+	control: m.optional(q)
+}), Er = m.Struct({
+	workflowName: m.NonEmptyString,
+	executionId: m.NonEmptyString,
+	operation: m.Literal("cancel", "resume"),
+	requestId: m.NonEmptyString
+}), Y = m.Struct({
+	workflowName: m.NonEmptyString,
+	receiptId: m.NonEmptyString,
+	requestId: m.NonEmptyString
+}), Dr = m.Struct({
 	...Y.fields,
 	cause: q.fields.cause
-}), fr = j({
+}), Or = j({
 	name: "__voltro.workflow.queued.cancel",
-	input: dr,
+	input: Dr,
 	output: W,
 	openAccess: "authorization happens in the executor against the target run — the caller must be authenticated and belong to the run's tenant, and a missing run answers exactly like a foreign one"
-}), pr = k({
+}), kr = k({
 	name: "__voltro.workflow.queued.control",
 	input: Y,
 	output: W,
 	openAccess: "authorization happens in the executor against the target run — the caller must be authenticated and belong to the run's tenant, and a missing run answers exactly like a foreign one"
-}), mr = k({
+}), Ar = k({
 	name: "__voltro.workflow.control",
-	input: ur,
+	input: Er,
 	output: U,
 	openAccess: "authorization happens in the executor against the target run — the caller must be authenticated and belong to the run's tenant, and a missing run answers exactly like a foreign one"
-}), hr = p.Struct({
-	id: p.String,
-	signalName: p.String,
-	payload: p.optional(p.Unknown)
-}), gr = p.Struct({
-	id: p.String,
-	updateName: p.String,
-	payload: p.optional(p.Unknown),
-	timeoutMs: p.optional(p.Number)
-}), _r = p.Struct({
-	eventId: p.String,
-	updateId: p.String,
-	completedEventId: p.String,
-	result: p.Unknown
-}), vr = k({
+}), jr = m.Struct({
+	id: m.String,
+	signalName: m.String,
+	payload: m.optional(m.Unknown)
+}), Mr = m.Struct({
+	id: m.String,
+	updateName: m.String,
+	payload: m.optional(m.Unknown),
+	timeoutMs: m.optional(m.Number)
+}), Nr = m.Struct({
+	eventId: m.String,
+	updateId: m.String,
+	completedEventId: m.String,
+	result: m.Unknown
+}), Pr = k({
 	name: "__voltro.workflow.run",
 	source: "_voltro_workflow_runs",
-	input: sr,
-	output: p.Array(G),
+	input: Cr,
+	output: m.Array(G),
 	openAccess: "the answer is scoped to the caller in the executor — a system or admin:full subject sees every row, an authenticated subject the rows of its own tenant, an anonymous caller none"
-}), yr = k({
+}), Fr = k({
 	name: "__voltro.workflow.runs",
 	source: "_voltro_workflow_runs",
-	input: nr,
-	output: p.Array(G),
+	input: vr,
+	output: m.Array(G),
 	openAccess: "the answer is scoped to the caller in the executor — a system or admin:full subject sees every row, an authenticated subject the rows of its own tenant, an anonymous caller none"
-}), br = k({
+}), Ir = k({
 	name: "__voltro.workflow.run.steps",
 	source: "_voltro_workflow_run_steps",
 	input: K,
-	output: p.Array(rr),
+	output: m.Array(yr),
 	openAccess: "the answer is scoped to the caller in the executor — a system or admin:full subject sees every row, an authenticated subject the rows of its own tenant, an anonymous caller none"
-}), xr = k({
+}), Lr = k({
 	name: "__voltro.workflow.run.events",
 	source: "_voltro_workflow_run_events",
 	input: K,
-	output: p.Array(ir),
+	output: m.Array(br),
 	openAccess: "the answer is scoped to the caller in the executor — a system or admin:full subject sees every row, an authenticated subject the rows of its own tenant, an anonymous caller none"
-}), Sr = k({
+}), Rr = k({
 	name: "__voltro.workflow.domainEvents",
 	source: "_voltro_workflow_events",
-	input: cr,
-	output: p.Array(ar),
+	input: wr,
+	output: m.Array(xr),
 	openAccess: "the answer is scoped to the caller in the executor — a system or admin:full subject sees every row, an authenticated subject the rows of its own tenant, an anonymous caller none"
-}), Cr = k({
+}), zr = k({
 	name: "__voltro.workflow.event.deliveries",
 	source: "_voltro_workflow_event_deliveries",
-	input: lr,
-	output: p.Array(or),
+	input: Tr,
+	output: m.Array(Sr),
 	openAccess: "the answer is scoped to the caller in the executor — a system or admin:full subject sees every row, an authenticated subject the rows of its own tenant, an anonymous caller none"
-}), wr = j({
+}), Br = j({
 	name: "__voltro.workflow.cancel",
 	input: J,
 	output: U,
 	openAccess: "authorization happens in the executor against the target run — the caller must be authenticated and belong to the run's tenant, and a missing run answers exactly like a foreign one"
-}), Tr = j({
+}), Vr = j({
 	name: "__voltro.workflow.resume",
 	input: J,
 	output: U,
 	openAccess: "authorization happens in the executor against the target run — the caller must be authenticated and belong to the run's tenant, and a missing run answers exactly like a foreign one"
-}), Er = j({
+}), Hr = j({
 	name: "__voltro.workflow.signal",
-	input: hr,
-	output: p.Struct({ eventId: p.String }),
+	input: jr,
+	output: m.Struct({ eventId: m.String }),
 	openAccess: "authorization happens in the executor against the target run — the caller must be authenticated and belong to the run's tenant, and a missing run answers exactly like a foreign one"
-}), Dr = j({
+}), Ur = j({
 	name: "__voltro.workflow.update",
-	input: gr,
-	output: _r,
+	input: Mr,
+	output: Nr,
 	openAccess: "authorization happens in the executor against the target run — the caller must be authenticated and belong to the run's tenant, and a missing run answers exactly like a foreign one"
-}), Or = p.NonEmptyString.pipe(p.filter((e) => e.trim().length > 0, { message: () => "A workflow retry identity must not be blank" })), kr = p.Struct({
-	runId: Or,
-	requestId: Or
-}), Ar = p.Struct({
-	...kr.fields,
-	payloadOverride: p.optional(p.Unknown)
+}), Wr = m.NonEmptyString.pipe(m.filter((e) => e.trim().length > 0, { message: () => "A workflow retry identity must not be blank" })), Gr = m.Struct({
+	runId: Wr,
+	requestId: Wr
+}), Kr = m.Struct({
+	...Gr.fields,
+	payloadOverride: m.optional(m.Unknown)
 }), X = {
-	requestId: p.NonEmptyString,
-	originalRunId: p.NonEmptyString,
-	originalExecutionId: p.NonEmptyString,
-	workflowName: p.NonEmptyString
-}, jr = p.Union(p.Struct({
+	requestId: m.NonEmptyString,
+	originalRunId: m.NonEmptyString,
+	originalExecutionId: m.NonEmptyString,
+	workflowName: m.NonEmptyString
+}, qr = m.Union(m.Struct({
 	...X,
-	kind: p.Literal("queued"),
-	nextAttemptAt: p.NullOr(p.Number)
-}), p.Struct({
+	kind: m.Literal("queued"),
+	nextAttemptAt: m.NullOr(m.Number)
+}), m.Struct({
 	...X,
-	kind: p.Literal("accepted"),
-	executionId: p.NonEmptyString
-}).pipe(p.filter((e) => e.executionId !== e.originalExecutionId, { message: () => "A retry cannot accept its original execution identity" })), p.Struct({
+	kind: m.Literal("accepted"),
+	executionId: m.NonEmptyString
+}).pipe(m.filter((e) => e.executionId !== e.originalExecutionId, { message: () => "A retry cannot accept its original execution identity" })), m.Struct({
 	...X,
-	kind: p.Literal("unconfirmed"),
-	automaticRetryStopped: p.Boolean,
-	nextAttemptAt: p.NullOr(p.Number)
-}).pipe(p.filter((e) => !e.automaticRetryStopped || e.nextAttemptAt === null, { message: () => "Stopped automatic retries cannot have a next attempt" })), p.Struct({
+	kind: m.Literal("unconfirmed"),
+	automaticRetryStopped: m.Boolean,
+	nextAttemptAt: m.NullOr(m.Number)
+}).pipe(m.filter((e) => !e.automaticRetryStopped || e.nextAttemptAt === null, { message: () => "Stopped automatic retries cannot have a next attempt" })), m.Struct({
 	...X,
-	kind: p.Literal("not-started"),
+	kind: m.Literal("not-started"),
 	outcome: B
-}), p.Struct({
+}), m.Struct({
 	...X,
-	kind: p.Literal("rejected"),
-	failureId: p.NonEmptyString
-})), Mr = "__voltro.undo.log", Nr = "__voltro.undo.apply", Pr = "__voltro.undo.redo", Fr = p.Struct({
-	id: p.String,
-	tag: p.String,
-	label: p.NullOr(p.String),
-	undone: p.Boolean,
-	crossesAction: p.Boolean,
-	createdAt: p.String
-}), Ir = class extends p.TaggedError()("UndoNotFound", { invocationId: p.String }) {}, Lr = class extends p.TaggedError()("UndoForbidden", { invocationId: p.String }) {}, Rr = class extends p.TaggedError()("UndoConflict", {
-	invocationId: p.String,
-	reason: p.Literal("conflict", "action")
-}) {}, zr = p.Union(Ir, Lr, Rr), Br = k({
-	name: Mr,
+	kind: m.Literal("rejected"),
+	failureId: m.NonEmptyString
+})), Jr = "__voltro.undo.log", Yr = "__voltro.undo.apply", Xr = "__voltro.undo.redo", Zr = m.Struct({
+	id: m.String,
+	tag: m.String,
+	label: m.NullOr(m.String),
+	undone: m.Boolean,
+	crossesAction: m.Boolean,
+	createdAt: m.String
+}), Qr = class extends m.TaggedError()("UndoNotFound", { invocationId: m.String }) {}, $r = class extends m.TaggedError()("UndoForbidden", { invocationId: m.String }) {}, ei = class extends m.TaggedError()("UndoConflict", {
+	invocationId: m.String,
+	reason: m.Literal("conflict", "action")
+}) {}, ti = m.Union(Qr, $r, ei), ni = k({
+	name: Jr,
 	source: "_voltro_undo_log",
-	input: p.Struct({ limit: p.optional(p.Number) }),
-	output: p.Array(Fr),
+	input: m.Struct({ limit: m.optional(m.Number) }),
+	output: m.Array(Zr),
 	openAccess: "subject-scoped by construction: lists only the calling subject's own undoable actions"
-}), Vr = A({
-	name: Nr,
-	input: p.Struct({ invocationId: p.String }),
-	output: p.Struct({ ok: p.Boolean }),
-	error: zr,
+}), ri = A({
+	name: Yr,
+	input: m.Struct({ invocationId: m.String }),
+	output: m.Struct({ ok: m.Boolean }),
+	error: ti,
 	openAccess: "subject-scoped by construction: undo is per-actor — another subject's invocation fails typed with UndoForbidden"
-}), Hr = A({
-	name: Pr,
-	input: p.Struct({ invocationId: p.String }),
-	output: p.Struct({ ok: p.Boolean }),
-	error: zr,
+}), ii = A({
+	name: Xr,
+	input: m.Struct({ invocationId: m.String }),
+	output: m.Struct({ ok: m.Boolean }),
+	error: ti,
 	openAccess: "subject-scoped by construction: redo is per-actor — another subject's invocation fails typed with UndoForbidden"
-}), Ur = class extends p.TaggedError()("TenantScopeViolation", {
-	table: p.String,
-	reason: p.String
-}) {}, Wr = class extends p.TaggedError()("StoreOperationFailed", {
-	operation: p.String,
-	table: p.String,
-	cause: p.String
+}), ai = class extends m.TaggedError()("TenantScopeViolation", {
+	table: m.String,
+	reason: m.String
+}) {}, oi = class extends m.TaggedError()("StoreOperationFailed", {
+	operation: m.String,
+	table: m.String,
+	cause: m.String
 }) {
 	get message() {
 		return `${this.operation} on '${this.table}' failed: ${this.cause}`;
 	}
-}, Gr = class extends p.TaggedError()("NoRowFound", {
-	table: p.String,
-	found: p.Number
+}, si = class extends m.TaggedError()("NoRowFound", {
+	table: m.String,
+	found: m.Number
 }) {
 	get message() {
 		return this.found === 0 ? `expected exactly one row in '${this.table}', found none` : `expected exactly one row in '${this.table}', found more than one`;
 	}
-}, Kr = class extends p.TaggedError()("TableValidationFailed", {
-	table: p.String,
-	summary: p.String,
-	issues: p.Array(p.Struct({
-		path: p.String,
-		message: p.String
+}, ci = class extends m.TaggedError()("TableValidationFailed", {
+	table: m.String,
+	summary: m.String,
+	issues: m.Array(m.Struct({
+		path: m.String,
+		message: m.String
 	}))
-}) {}, qr = class extends p.TaggedError()("TenantRowNotFound", {
-	table: p.String,
-	id: p.String,
-	reason: p.String
-}) {}, Jr = class extends p.TaggedError()("ServerOnlyColumnWrite", {
-	table: p.String,
-	columns: p.Array(p.String)
-}) {}, Yr = class extends p.TaggedError()("ConstraintViolation", {
-	kind: p.Literal("foreignKey", "foreignKeyInUse", "unique", "notNull", "check"),
-	table: p.String,
-	operation: p.String,
-	constraint: p.optional(p.String),
-	column: p.optional(p.String),
-	detail: p.optional(p.String)
+}) {}, li = class extends m.TaggedError()("TenantRowNotFound", {
+	table: m.String,
+	id: m.String,
+	reason: m.String
+}) {}, ui = class extends m.TaggedError()("ServerOnlyColumnWrite", {
+	table: m.String,
+	columns: m.Array(m.String)
+}) {}, di = class extends m.TaggedError()("ConstraintViolation", {
+	kind: m.Literal("foreignKey", "foreignKeyInUse", "unique", "notNull", "check"),
+	table: m.String,
+	operation: m.String,
+	constraint: m.optional(m.String),
+	column: m.optional(m.String),
+	detail: m.optional(m.String)
 }) {
 	get message() {
 		if (this.detail !== void 0) return this.detail;
@@ -1057,86 +1090,86 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 			case "check": return `check constraint ${t}: the row does not satisfy it`;
 		}
 	}
-}, Xr = "__voltro.approvals.pending", Zr = "__voltro.approvals.decide", Qr = k({
-	name: Xr,
+}, fi = "__voltro.approvals.pending", pi = "__voltro.approvals.decide", mi = k({
+	name: fi,
 	source: "_voltro_approvals",
-	input: p.Struct({ limit: p.optional(p.Number) }),
-	output: p.Array(zt),
+	input: m.Struct({ limit: m.optional(m.Number) }),
+	output: m.Array(Xt),
 	openAccess: "the answer is scoped to the caller — a row appears only if they requested it or hold its recorded approver scopes, so an anonymous caller sees nothing"
-}), $r = A({
-	name: Zr,
-	input: p.Struct({
-		approvalId: p.String,
-		decision: p.Literal("approve", "reject"),
-		note: p.optional(p.String)
+}), hi = A({
+	name: pi,
+	input: m.Struct({
+		approvalId: m.String,
+		decision: m.Literal("approve", "reject"),
+		note: m.optional(m.String)
 	}),
-	output: p.Struct({
-		approvalId: p.String,
-		status: p.Literal("approved", "rejected")
+	output: m.Struct({
+		approvalId: m.String,
+		status: m.Literal("approved", "rejected")
 	}),
-	error: Rt,
+	error: Yt,
 	openAccess: "the approver authority is the PENDING ROW's own recorded scopes (plus an unconditional self-approval refusal), checked in-handler — a descriptor-level scope would have to be the union of every approval-requiring procedure in the app"
-}), Z = "__voltro.connections.list", ei = "__voltro.connections.start", ti = "__voltro.connections.submitToken", ni = "__voltro.connections.disconnect", Q = p.Literal("oauth2", "pat"), ri = p.Literal("disconnected", "connected", "expired", "revoked", "error"), ii = p.Struct({
-	connectionId: p.String,
+}), gi = "__voltro.connections.list", _i = "__voltro.connections.start", vi = "__voltro.connections.submitToken", Z = "__voltro.connections.disconnect", Q = m.Literal("oauth2", "pat"), yi = m.Literal("disconnected", "connected", "expired", "revoked", "error"), bi = m.Struct({
+	connectionId: m.String,
 	kind: Q,
-	label: p.String,
-	status: ri,
-	accountId: p.NullOr(p.String),
-	accountLabel: p.NullOr(p.String),
-	scopes: p.Array(p.String),
-	expiresAt: p.NullOr(p.String),
-	lastError: p.NullOr(p.String),
-	connectedAt: p.NullOr(p.String)
-}), ai = class extends p.TaggedError()("ConnectionNotDeclared", { connectionId: p.String }) {}, oi = class extends p.TaggedError()("ConnectionSubjectRequired", { connectionId: p.String }) {}, si = class extends p.TaggedError()("ConnectionKindMismatch", {
-	connectionId: p.String,
+	label: m.String,
+	status: yi,
+	accountId: m.NullOr(m.String),
+	accountLabel: m.NullOr(m.String),
+	scopes: m.Array(m.String),
+	expiresAt: m.NullOr(m.String),
+	lastError: m.NullOr(m.String),
+	connectedAt: m.NullOr(m.String)
+}), xi = class extends m.TaggedError()("ConnectionNotDeclared", { connectionId: m.String }) {}, Si = class extends m.TaggedError()("ConnectionSubjectRequired", { connectionId: m.String }) {}, Ci = class extends m.TaggedError()("ConnectionKindMismatch", {
+	connectionId: m.String,
 	expected: Q,
 	actual: Q
-}) {}, ci = class extends p.TaggedError()("ConnectionHandshakeFailed", {
-	connectionId: p.String,
-	reason: p.String,
-	transient: p.Boolean
-}) {}, $ = p.Union(ai, oi, si, ci), li = k({
-	name: Z,
+}) {}, wi = class extends m.TaggedError()("ConnectionHandshakeFailed", {
+	connectionId: m.String,
+	reason: m.String,
+	transient: m.Boolean
+}) {}, $ = m.Union(xi, Si, Ci, wi), Ti = k({
+	name: gi,
 	source: "_voltro_connections",
-	input: p.Struct({}),
-	output: p.Array(ii),
+	input: m.Struct({}),
+	output: m.Array(bi),
 	openAccess: "self-scoped read: projects the declared connections for the calling subject only (its own connect/disconnect state)"
-}), ui = j({
-	name: ei,
-	input: p.Struct({
-		connectionId: p.String,
-		redirectTo: p.optional(p.String)
+}), Ei = j({
+	name: _i,
+	input: m.Struct({
+		connectionId: m.String,
+		redirectTo: m.optional(m.String)
 	}),
-	output: p.Struct({
-		authorizeUrl: p.String,
-		state: p.String
+	output: m.Struct({
+		authorizeUrl: m.String,
+		state: m.String
 	}),
 	error: $,
 	openAccess: "self-service: begins an oauth handshake that stores a credential for the calling subject only; anonymous callers fail typed with ConnectionSubjectRequired"
-}), di = A({
-	name: ti,
-	input: p.Struct({
-		connectionId: p.String,
-		token: p.String
+}), Di = A({
+	name: vi,
+	input: m.Struct({
+		connectionId: m.String,
+		token: m.String
 	}),
-	output: p.Struct({ ok: p.Boolean }),
+	output: m.Struct({ ok: m.Boolean }),
 	error: $,
 	openAccess: "self-service: stores a pasted token as the calling subject's own credential; anonymous callers fail typed with ConnectionSubjectRequired"
-}), fi = A({
-	name: ni,
-	input: p.Struct({ connectionId: p.String }),
-	output: p.Struct({ ok: p.Boolean }),
+}), Oi = A({
+	name: Z,
+	input: m.Struct({ connectionId: m.String }),
+	output: m.Struct({ ok: m.Boolean }),
 	error: $,
 	openAccess: "self-service: deletes only the calling subject's own credential row for this connection"
-}), pi = (e) => {
+}), ki = (e) => {
 	let t = e instanceof Date ? e.getTime() : typeof e == "number" ? e : typeof e == "string" ? new Date(e).getTime() : 0;
 	return Number.isNaN(t) ? 0 : t;
-}, mi = 4001, hi = /* @__PURE__ */ new Set(["/rpc", "/ws"]), gi = (e) => {
+}, Ai = 4001, ji = /* @__PURE__ */ new Set(["/rpc", "/ws"]), Mi = (e) => {
 	for (let [t, n] of Object.entries(e.limits ?? {})) if (n !== void 0 && (!Number.isSafeInteger(n) || n <= 0)) throw Error(`defineWebSocket: limits.${t} must be a positive safe integer`);
 	if (!e.path.startsWith("/")) throw Error(`defineWebSocket: path must be absolute, got '${e.path}'`);
-	if (hi.has(e.path)) throw Error(`defineWebSocket: '${e.path}' is the framework's own socket surface — mount the gateway elsewhere`);
+	if (ji.has(e.path)) throw Error(`defineWebSocket: '${e.path}' is the framework's own socket surface — mount the gateway elsewhere`);
 	if (e.auth !== "subject" && e.auth !== "public") throw Error(`defineWebSocket: auth must be 'subject' or 'public' (explicitly — an unauthenticated socket has to be a decision somebody wrote down), got '${String(e.auth)}'`);
 	return e;
-}, _i = 1;
+}, Ni = 1;
 //#endregion
-export { Ne as ADMIN_SCOPE, Oe as APIKEY_ISSUE_ORG_SCOPE, je as APIKEY_ISSUE_OTHER_SCOPE, Ce as APIKEY_ISSUE_SELF_SCOPE, Zr as APPROVALS_DECIDE_TAG, Xr as APPROVALS_PENDING_TAG, Rt as ApprovalDecisionErrors, Lt as ApprovalErrors, S as ApprovalExpired, It as ApprovalForbidden, Mt as ApprovalNotFound, Ft as ApprovalNotPending, Pt as ApprovalRejected, jt as ApprovalRequired, Nt as ApprovalSelfApproval, C as ApprovalUnavailable, i as AuthMiddleware, Et as BusinessRuleViolation, Z as CONNECTIONS_LIST_TAG, ni as CONNECTION_DISCONNECT_TAG, ei as CONNECTION_START_TAG, ti as CONNECTION_SUBMIT_TOKEN_TAG, ci as ConnectionHandshakeFailed, ae as ConnectionInfo, Te as ConnectionInfoMiddleware, Q as ConnectionKind, si as ConnectionKindMismatch, ai as ConnectionNotDeclared, ii as ConnectionState, ri as ConnectionStatus, oi as ConnectionSubjectRequired, Yr as ConstraintViolation, t as DEFAULT_SCOPE_CACHE_MAX_ENTRIES, we as DEFAULT_SCOPE_CACHE_TTL_MS, _e as DEVICES_MANAGE_SCOPE, jn as EVENT_ROUTE_SEP, On as EventKeyInvalid, Dn as EventPayloadInvalid, kn as EventPayloadTooLarge, mi as GATEWAY_CREDENTIAL_EXPIRED_CLOSE_CODE, re as IMPERSONATION_METADATA_KEY, st as JSONAPI_MEDIA_TYPE, _n as MAX_EVENT_ENVELOPE_BYTES, ft as MUTATION_IN_FLIGHT_RETRY_AFTER_MS, qe as MutationConnectionRequired, dt as MutationInFlight, Gr as NoRowFound, nt as PROBLEM_JSON, _i as PROTOCOL_VERSION, zt as PendingApproval, w as REACTIVITY_CHANNEL_PREFIX, at as REST_PROFILE_NAMES, f as ScopeError, Jr as ServerOnlyColumnWrite, Wr as StoreOperationFailed, ie as Subject, oe as SubjectIdentity, o as SubjectService, Kr as TableValidationFailed, qr as TenantRowNotFound, Ur as TenantScopeViolation, ge as TenantSelectionRefused, Nr as UNDO_APPLY_TAG, Mr as UNDO_LOG_TAG, Pr as UNDO_REDO_TAG, l as Unauthenticated, Rr as UndoConflict, Lr as UndoForbidden, Fr as UndoLogEntry, Ir as UndoNotFound, Ot as ValidationError, kt as ValidationErrors, Dt as ValidationIssue, F as WorkflowAccessProperty, J as WorkflowControlInputSchema, q as WorkflowControlIntentSchema, ur as WorkflowControlReadInputSchema, U as WorkflowControlResultSchema, ar as WorkflowDomainEventRowSchema, cr as WorkflowDomainEventsInputSchema, lr as WorkflowEventDeliveriesInputSchema, or as WorkflowEventDeliveryRowSchema, Qn as WorkflowParentClosePolicySchema, dr as WorkflowQueuedCancelInputSchema, W as WorkflowQueuedCancellationResultSchema, Y as WorkflowQueuedControlTargetSchema, Ar as WorkflowRetryCommandSchema, jr as WorkflowRetryObservationSchema, kr as WorkflowRetryTargetSchema, ir as WorkflowRunEventRowSchema, er as WorkflowRunHandleSchema, sr as WorkflowRunRefSchema, G as WorkflowRunRowSchema, H as WorkflowRunSnapshotSchema, V as WorkflowRunStatusSchema, rr as WorkflowRunStepRowSchema, K as WorkflowRunTableRefSchema, nr as WorkflowRunsInputSchema, hr as WorkflowSignalInputSchema, $n as WorkflowStartDeferralSchema, B as WorkflowStartTerminalOutcomeSchema, gr as WorkflowUpdateInputSchema, _r as WorkflowUpdateResultSchema, fn as actionToRpc, Me as advisoryResourceGuardWarning, ne as anonymousSubject, Ct as applyRowPatch, ce as applyScopeDecision, $r as approvalsDecideDescriptor, Qr as approvalsPendingQueryDescriptor, ze as assertAuthenticated, Ln as attachWorkflowAccess, Ue as beginIdempotent, Wn as checkFrameworkCompat, ve as checkGuards, Ee as checkGuardsEffect, tt as compareSurfaces, n as composeAuthStrategies, Hn as composeRpcInterceptors, fi as connectionDisconnectDescriptor, ui as connectionStartDescriptor, di as connectionSubmitTokenDescriptor, li as connectionsListQueryDescriptor, Kt as declaredReactivityChannelKeys, j as defineAction, yn as defineEvent, A as defineMutation, zn as definePlugin, Bn as definePluginRoute, Un as definePluginService, k as defineQuery, nn as defineStream, gi as defineWebSocket, xt as diffRows, Pe as effectiveScopes, An as encodeEventKey, $e as encodeRestError, Ke as encodeRestSuccess, mn as errorTag, Sn as eventAttached, bn as eventEnvelope, xn as eventGap, wn as eventResumePoint, Mn as eventRoute, Cn as eventStreamEvent, Tn as eventSubscribeInput, En as eventToRpc, Be as failIdempotent, At as fieldIssuesOf, ye as findAdvisoryResourceGuards, ut as finishIdempotent, wt as firstEventValue, Pn as formatEventRoute, be as getPolicyGuardResolver, ke as getResourceScopeResolver, I as getWorkflowAccess, Qe as groupShapeDigests, tn as hasAccessDecision, fe as hasCallbackRoutes, De as hasEffectiveScope, N as hasEnforcedGuard, Se as hasScope, g as idToPath, We as idempotencyScope, b as inputLabel, xe as isAuthenticatedCheck, en as isAuthenticatedGuard, vn as isEventDescriptor, St as isIdKeyed, u as isOpenAccess, Fe as isPolicyCheck, $t as isPolicyGuard, Wt as isReactivityChannel, Gt as isReactivityChannelKey, c as isSystemSubject, se as isTenantSelectable, Zt as isWireReachable, de as makeScopeCache, He as memoryIdempotencyStore, Re as missingAccessDecision, dn as mutationToRpc, rt as nextLink, gn as normalizeDescriptor, Jt as normalizeSource, d as openAccessSpec, pe as orderByBearerPrefix, Nn as parseEventRoute, yt as pathToId, Kn as pluginAlias, Vn as pluginInstanceName, qn as pluginSlug, Zn as pluginTag, ot as problemDetails, Je as problemTypeOf, Ze as procedureShapeDigest, Xt as publishReactivity, Xe as publishServerError, un as queryToRpc, s as rawImpersonationMark, Ut as reactivityChannel, Yn as registerPluginAliases, Le as requireScope, Xn as resetPluginAliases, le as resolvePolicyAction, et as resolveRestFormat, In as resolveWorkflowAccess, ct as restViewSchema, _t as rowPatchOpSchema, vt as rowPatchSchema, Ge as schemaShape, te as scopeCacheKey, e as selectSubjectTenant, r as setEffectiveScopes, Ie as setPolicyGuardResolver, ue as setResourceScopeResolver, lt as shapeDigest, qt as sourceKeys, pn as streamToRpc, x as strictInput, Ae as subjectAuditActorId, ee as subjectIdentity, a as subjectScopes, it as subscribeServerErrors, y as subscriptionEvent, he as systemSubject, me as tenantScopedSubject, hn as toRpc, Ye as toSnakeCase, pi as tsMs, Yt as undeclaredChannelKeys, Vr as undoApplyDescriptor, Br as undoLogQueryDescriptor, Hr as undoRedoDescriptor, P as wireErrorUnion, ln as withRpcTag, Rn as workflowAccessDescriptor, wr as workflowCancelDescriptor, mr as workflowControlQueryDescriptor, Sr as workflowDomainEventsQueryDescriptor, Cr as workflowEventDeliveriesQueryDescriptor, fr as workflowQueuedCancelDescriptor, pr as workflowQueuedControlQueryDescriptor, Tr as workflowResumeDescriptor, xr as workflowRunEventsQueryDescriptor, vr as workflowRunQueryDescriptor, br as workflowRunStepsQueryDescriptor, yr as workflowRunsQueryDescriptor, Er as workflowSignalDescriptor, tr as workflowToRpc, Dr as workflowUpdateDescriptor, cn as workflowWireErrorUnion, Ve as wsMutationIdempotencyScope };
+export { Be as ADMIN_SCOPE, Ne as APIKEY_ISSUE_ORG_SCOPE, Le as APIKEY_ISSUE_OTHER_SCOPE, De as APIKEY_ISSUE_SELF_SCOPE, pi as APPROVALS_DECIDE_TAG, fi as APPROVALS_PENDING_TAG, $n as ApiUnavailable, Yt as ApprovalDecisionErrors, Jt as ApprovalErrors, b as ApprovalExpired, qt as ApprovalForbidden, Ut as ApprovalNotFound, Kt as ApprovalNotPending, Gt as ApprovalRejected, Ht as ApprovalRequired, Wt as ApprovalSelfApproval, x as ApprovalUnavailable, t as AuthMiddleware, Lt as BusinessRuleViolation, gi as CONNECTIONS_LIST_TAG, Z as CONNECTION_DISCONNECT_TAG, _i as CONNECTION_START_TAG, vi as CONNECTION_SUBMIT_TOKEN_TAG, wi as ConnectionHandshakeFailed, ke as ConnectionInfo, ie as ConnectionInfoMiddleware, Q as ConnectionKind, Ci as ConnectionKindMismatch, xi as ConnectionNotDeclared, bi as ConnectionState, yi as ConnectionStatus, Si as ConnectionSubjectRequired, di as ConstraintViolation, bt as DEFAULT_IN_FLIGHT_LEASE_MS, ae as DEFAULT_SCOPE_CACHE_MAX_ENTRIES, se as DEFAULT_SCOPE_CACHE_TTL_MS, ve as DEVICES_MANAGE_SCOPE, Gn as EVENT_ROUTE_SEP, Hn as EventKeyInvalid, Vn as EventPayloadInvalid, Un as EventPayloadTooLarge, Ai as GATEWAY_CREDENTIAL_EXPIRED_CLOSE_CODE, o as IMPERSONATION_METADATA_KEY, ht as JSONAPI_MEDIA_TYPE, jn as MAX_EVENT_ENVELOPE_BYTES, et as MUTATION_IN_FLIGHT_RETRY_AFTER_MS, yt as MutationConnectionRequired, Xe as MutationInFlight, si as NoRowFound, ut as PROBLEM_JSON, Ni as PROTOCOL_VERSION, Xt as PendingApproval, S as REACTIVITY_CHANNEL_PREFIX, pt as REST_PROFILE_NAMES, E as SERVICE_NAME_PATTERN, u as ScopeError, ui as ServerOnlyColumnWrite, oi as StoreOperationFailed, ee as Subject, re as SubjectIdentity, le as SubjectService, ci as TableValidationFailed, li as TenantRowNotFound, ai as TenantScopeViolation, Re as TenantSelectionRefused, Yr as UNDO_APPLY_TAG, Jr as UNDO_LOG_TAG, Xr as UNDO_REDO_TAG, p as Unauthenticated, ei as UndoConflict, $r as UndoForbidden, Zr as UndoLogEntry, Qr as UndoNotFound, zt as ValidationError, Bt as ValidationErrors, Rt as ValidationIssue, F as WorkflowAccessProperty, J as WorkflowControlInputSchema, q as WorkflowControlIntentSchema, Er as WorkflowControlReadInputSchema, U as WorkflowControlResultSchema, xr as WorkflowDomainEventRowSchema, wr as WorkflowDomainEventsInputSchema, Tr as WorkflowEventDeliveriesInputSchema, Sr as WorkflowEventDeliveryRowSchema, mr as WorkflowParentClosePolicySchema, Dr as WorkflowQueuedCancelInputSchema, W as WorkflowQueuedCancellationResultSchema, Y as WorkflowQueuedControlTargetSchema, Kr as WorkflowRetryCommandSchema, qr as WorkflowRetryObservationSchema, Gr as WorkflowRetryTargetSchema, br as WorkflowRunEventRowSchema, gr as WorkflowRunHandleSchema, Cr as WorkflowRunRefSchema, G as WorkflowRunRowSchema, H as WorkflowRunSnapshotSchema, V as WorkflowRunStatusSchema, yr as WorkflowRunStepRowSchema, K as WorkflowRunTableRefSchema, vr as WorkflowRunsInputSchema, jr as WorkflowSignalInputSchema, hr as WorkflowStartDeferralSchema, B as WorkflowStartTerminalOutcomeSchema, Mr as WorkflowUpdateInputSchema, Nr as WorkflowUpdateResultSchema, En as actionToRpc, ze as advisoryResourceGuardWarning, n as anonymousSubject, Mt as applyRowPatch, pe as applyScopeDecision, hi as approvalsDecideDescriptor, mi as approvalsPendingQueryDescriptor, c as assertAuthenticated, Zn as attachWorkflowAccess, Ke as beginIdempotent, or as checkFrameworkCompat, xe as checkGuards, je as checkGuardsEffect, lt as compareSurfaces, fe as composeAuthStrategies, ir as composeRpcInterceptors, Oi as connectionDisconnectDescriptor, Ei as connectionStartDescriptor, Di as connectionSubmitTokenDescriptor, Ti as connectionsListQueryDescriptor, rn as declaredReactivityChannelKeys, j as defineAction, Nn as defineEvent, A as defineMutation, tr as definePlugin, nr as definePluginRoute, ar as definePluginService, k as defineQuery, _n as defineStream, Mi as defineWebSocket, At as diffRows, He as effectiveScopes, Wn as encodeEventKey, ot as encodeRestError, $e as encodeRestSuccess, On as errorTag, In as eventAttached, Pn as eventEnvelope, Fn as eventGap, Rn as eventResumePoint, Kn as eventRoute, Ln as eventStreamEvent, zn as eventSubscribeInput, Bn as eventToRpc, vt as failIdempotent, Vt as fieldIssuesOf, Se as findAdvisoryResourceGuards, Ze as finishIdempotent, Pt as firstEventValue, Jn as formatEventRoute, Je as freshFor, we as getPolicyGuardResolver, Fe as getResourceScopeResolver, I as getWorkflowAccess, at as groupShapeDigests, gn as hasAccessDecision, me as hasCallbackRoutes, Me as hasEffectiveScope, N as hasEnforcedGuard, Ee as hasScope, qe as holdIdempotentClaim, g as idToPath, Ye as idempotencyScope, Ft as inputLabel, er as isApiUnavailable, Te as isAuthenticatedCheck, hn as isAuthenticatedGuard, un as isClientReachable, Mn as isEventDescriptor, jt as isIdKeyed, s as isMachineSubject, l as isOpenAccess, Ue as isPolicyCheck, mn as isPolicyGuard, tn as isReactivityChannel, nn as isReactivityChannelKey, We as isServiceAccess, dn as isServiceReachable, ne as isServiceSubject, Ie as isSystemSubject, Oe as isTenantSelectable, T as isWireReachable, te as makeScopeCache, st as memoryIdempotencyStore, be as missingAccessDecision, Tn as mutationToRpc, dt as nextLink, An as normalizeDescriptor, on as normalizeSource, f as openAccessSpec, ge as orderByBearerPrefix, qn as parseEventRoute, Ot as pathToId, cr as pluginAlias, rr as pluginInstanceName, lr as pluginSlug, pr as pluginTag, mt as problemDetails, tt as problemTypeOf, it as procedureShapeDigest, cn as publishReactivity, rt as publishServerError, wn as queryToRpc, he as rawImpersonationMark, en as reactivityChannel, dr as registerPluginAliases, ue as requireScope, fr as resetPluginAliases, r as resolvePolicyAction, ct as resolveRestFormat, Xn as resolveWorkflowAccess, gt as restViewSchema, Et as rowPatchOpSchema, Dt as rowPatchSchema, Qe as schemaShape, _e as scopeCacheKey, ye as selectSubjectTenant, d as serviceAccessSpec, de as serviceCallersOf, ce as serviceSubject, a as setEffectiveScopes, i as setPolicyGuardResolver, oe as setResourceScopeResolver, _t as shapeDigest, an as sourceKeys, Dn as streamToRpc, y as strictInput, e as subjectAuditActorId, Ce as subjectIdentity, Ae as subjectScopes, ft as subscribeServerErrors, Nt as subscriptionEvent, Ve as systemSubject, Pe as tenantScopedSubject, kn as toRpc, nt as toSnakeCase, ki as tsMs, sn as undeclaredChannelKeys, ri as undoApplyDescriptor, ni as undoLogQueryDescriptor, ii as undoRedoDescriptor, ln as wireAudienceOf, P as wireErrorUnion, Cn as withRpcTag, Qn as workflowAccessDescriptor, Br as workflowCancelDescriptor, Ar as workflowControlQueryDescriptor, Rr as workflowDomainEventsQueryDescriptor, zr as workflowEventDeliveriesQueryDescriptor, Or as workflowQueuedCancelDescriptor, kr as workflowQueuedControlQueryDescriptor, Vr as workflowResumeDescriptor, Lr as workflowRunEventsQueryDescriptor, Pr as workflowRunQueryDescriptor, Ir as workflowRunStepsQueryDescriptor, Fr as workflowRunsQueryDescriptor, Hr as workflowSignalDescriptor, _r as workflowToRpc, Ur as workflowUpdateDescriptor, Sn as workflowWireErrorUnion, Ge as wsMutationIdempotencyScope };