@voltro/protocol 0.80.0 → 0.82.0

package/dist/index.js

@@ -1,58 +1,67 @@
-import { $ as e, A as t, B as n, C as r, D as i, E as a, F as o, G as s, H as c, I as l, J as ee, K as te, L as ne, M as re, N as ie, O as ae, P as oe, Q as se, R as ce, S as le, T as ue, U as de, V as fe, W as pe, X as me, Y as he, Z as ge, _ as u, a as _e, b as d, c as ve, d as ye, f as be, g as xe, h as Se, i as Ce, j as we, k as Te, l as Ee, m as De, n as Oe, o as f, p as ke, q as Ae, r as je, s as Me, t as Ne, u as Pe, v as Fe, w as Ie, x as Le, y as Re, z as ze } from "./scopes-BbIyym8y.js";
-import { C as Be, D as Ve, E as He, S as Ue, T as We, _ as Ge, a as Ke, b as qe, c as Je, d as Ye, f as Xe, g as Ze, h as Qe, i as $e, l as et, m as tt, n as nt, o as rt, p as it, r as at, s as ot, t as st, u as ct, v as lt, w as ut, x as dt, y as ft } from "./restFormat-ChSVyufA.js";
-import { Context as pt, Layer as mt, Schema as p } from "effect";
-import { Rpc as m } from "@effect/rpc";
-import { VersionConflict as ht } from "@voltro/database/wire";
+import { $ as e, A as t, B as n, C as r, D as i, E as a, F as o, G as s, H as c, I as ee, J as te, K as ne, L as re, M as ie, N as ae, O as oe, P as se, Q as ce, R as le, S as ue, T as de, U as fe, V as l, W as pe, X as me, Y as he, Z as ge, _ as _e, a as ve, at as ye, b as be, c as xe, d as u, et as Se, f as Ce, g as we, h as Te, i as Ee, it as De, j as Oe, k as ke, l as Ae, m as je, n as Me, nt as Ne, o as d, ot as Pe, p as Fe, q as Ie, r as Le, rt as Re, s as f, st as ze, t as Be, tt as Ve, u as He, v as Ue, w as We, x as Ge, y as p, z as Ke } from "./scopes-Di756ENh.js";
+import { A as qe, C as m, D as Je, E as Ye, O as Xe, S as Ze, T as Qe, _ as $e, a as et, b as tt, c as nt, d as rt, f as it, g as at, h as ot, i as st, j as ct, k as lt, l as ut, m as dt, n as ft, o as pt, p as mt, r as ht, s as gt, t as _t, u as vt, v as yt, w as bt, x as xt, y as St } from "./restFormat-EZ8k9ZcQ.js";
+import { n as Ct, t as wt } from "./sessionHeader-DriTZhmv.js";
+import { Context as Tt, Either as Et, Encoding as Dt, Layer as Ot, Schema as h } from "effect";
+import { Rpc as g } from "@effect/rpc";
+import { VersionConflict as kt } from "@voltro/database/wire";
 //#region src/rowPatch.ts
-var gt = p.Union(p.String, p.Number), h = p.Record({
-	key: p.String,
-	value: p.Unknown
-}).pipe(p.filter((e) => "id" in e, { message: () => "patch row must carry an id" })), _t = p.Union(p.Struct({
-	op: p.Literal("add"),
-	path: p.String,
-	value: h
-}), p.Struct({
-	op: p.Literal("replace"),
-	path: p.String,
-	value: h
-}), p.Struct({
-	op: p.Literal("remove"),
-	path: p.String
-}), p.Struct({
-	op: p.Literal("mergeCells"),
-	path: p.String,
-	value: p.Record({
-		key: p.String,
-		value: p.Unknown
+var At = h.Union(h.String, h.Number), jt = (e) => typeof e == "object" && !!e && !Array.isArray(e) && Object.keys(e).length === 1 && typeof e.$bytes == "string", _ = h.transform(h.Unknown, h.Unknown, {
+	strict: !0,
+	decode: (e) => {
+		if (!jt(e)) return e;
+		let t = Dt.decodeBase64(e.$bytes);
+		return Et.isRight(t) ? t.right : e;
+	},
+	encode: (e) => e instanceof Uint8Array ? { $bytes: Dt.encodeBase64(e) } : e
+}), Mt = h.Record({
+	key: h.String,
+	value: _
+}).pipe(h.filter((e) => "id" in e, { message: () => "patch row must carry an id" })), Nt = h.Union(h.Struct({
+	op: h.Literal("add"),
+	path: h.String,
+	value: Mt
+}), h.Struct({
+	op: h.Literal("replace"),
+	path: h.String,
+	value: Mt
+}), h.Struct({
+	op: h.Literal("remove"),
+	path: h.String
+}), h.Struct({
+	op: h.Literal("mergeCells"),
+	path: h.String,
+	value: h.Record({
+		key: h.String,
+		value: _
 	})
-})), vt = p.Struct({
-	ops: p.Array(_t),
-	order: p.Array(gt)
-}), g = (e) => `/${String(e).replace(/~/g, "~0").replace(/\//g, "~1")}`, yt = (e) => (e.startsWith("/") ? e.slice(1) : e).replace(/~1/g, "/").replace(/~0/g, "~"), _ = (e) => {
+})), Pt = h.Struct({
+	ops: h.Array(Nt),
+	order: h.Array(At)
+}), v = (e) => `/${String(e).replace(/~/g, "~0").replace(/\//g, "~1")}`, y = (e) => (e.startsWith("/") ? e.slice(1) : e).replace(/~1/g, "/").replace(/~0/g, "~"), b = (e) => {
 	let t = Object.keys(e).sort(), n = {};
 	for (let r of t) n[r] = e[r];
 	return JSON.stringify(n);
-}, v = (e, t) => _(e) === _(t), bt = (e, t) => {
+}, Ft = (e, t) => b(e) === b(t), It = (e, t) => {
 	if (e instanceof Uint8Array && t instanceof Uint8Array) {
 		if (e.length !== t.length) return !1;
 		for (let n = 0; n < e.length; n += 1) if (e[n] !== t[n]) return !1;
 		return !0;
 	}
-	return _({
+	return b({
 		id: 0,
 		v: e
-	}) === _({
+	}) === b({
 		id: 0,
 		v: t
 	});
-}, xt = (e, t, n = {}) => {
+}, Lt = (e, t, n = {}) => {
 	let r = /* @__PURE__ */ new Map();
 	for (let t of e) r.set(t.id, t);
 	let i = [], a = [], o = /* @__PURE__ */ new Set(), s = n.crdt, c = (e, t) => {
 		if (s === void 0 || s.columns.size === 0) return;
 		let n = {}, r = !1;
 		for (let i of s.columns) {
-			if (!(i in t) || bt(e[i], t[i])) continue;
+			if (!(i in t) || It(e[i], t[i])) continue;
 			let a = s.incremental(i, e[i], t[i]);
 			if (a === void 0) return;
 			n[i] = a, r = !0;
@@ -70,120 +79,125 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 		let t = r.get(e.id);
 		if (t === void 0) i.push({
 			op: "add",
-			path: g(e.id),
+			path: v(e.id),
 			value: e
 		});
-		else if (!v(t, e)) {
+		else if (!Ft(t, e)) {
 			let n = c(t, e);
 			n === void 0 ? i.push({
 				op: "replace",
-				path: g(e.id),
+				path: v(e.id),
 				value: e
-			}) : (v(Object.fromEntries(Object.entries(t).filter(([e]) => !s.columns.has(e))), n.scalars) || i.push({
+			}) : (Ft(Object.fromEntries(Object.entries(t).filter(([e]) => !s.columns.has(e))), n.scalars) || i.push({
 				op: "replace",
-				path: g(e.id),
+				path: v(e.id),
 				value: n.scalars
 			}), i.push({
 				op: "mergeCells",
-				path: g(e.id),
+				path: v(e.id),
 				value: n.merges
 			}));
 		}
 	}
 	for (let t of e) o.has(t.id) || i.push({
 		op: "remove",
-		path: g(t.id)
+		path: v(t.id)
 	});
 	return {
 		ops: i,
 		order: a
 	};
-}, St = (e) => e.every((e) => {
+}, Rt = (e) => e.every((e) => {
 	let t = e.id;
 	return typeof t == "string" || typeof t == "number";
-}), Ct = (e, t, n = {}) => {
+}), zt = (e, t, n = {}) => {
 	let r = /* @__PURE__ */ new Map();
 	for (let t of e) r.set(t.id, t);
+	let i = /* @__PURE__ */ new Map();
+	for (let e of t.ops) e.op === "mergeCells" && i.set(y(e.path), Object.keys(e.value));
 	for (let e of t.ops) {
 		if (e.op === "mergeCells") {
-			let t = yt(e.path), i = r.get(t) ?? r.get(Number(t)), a = r.has(t) ? t : Number(t);
+			let t = y(e.path), i = r.get(t) ?? r.get(Number(t)), a = r.has(t) ? t : Number(t);
 			if (i === void 0) continue;
 			let o = { ...i };
 			for (let [t, r] of Object.entries(e.value)) o[t] = n.mergeCell === void 0 ? r : n.mergeCell(t, i[t], r);
 			r.set(a, o);
 			continue;
 		}
-		(e.op === "add" || e.op === "replace") && r.set(e.value.id, e.value);
+		if (e.op === "add" && r.set(e.value.id, e.value), e.op === "replace") {
+			let t = r.get(e.value.id), n = (t === void 0 ? [] : i.get(String(e.value.id)) ?? []).filter((n) => !(n in e.value) && n in t);
+			r.set(e.value.id, n.length === 0 ? e.value : {
+				...e.value,
+				...Object.fromEntries(n.map((e) => [e, t[e]]))
+			});
+		}
 	}
-	let i = [];
+	let a = [];
 	for (let e of t.order) {
 		let t = r.get(e);
-		t !== void 0 && i.push(t);
+		t !== void 0 && a.push(t);
 	}
-	return i;
-}, y = (e) => p.Union(p.Struct({
-	_tag: p.Literal("snapshot"),
-	revision: p.Number,
+	return a;
+}, Bt = (e) => h.Union(h.Struct({
+	_tag: h.Literal("snapshot"),
+	revision: h.Number,
 	data: e,
-	computed: p.optional(p.Boolean),
-	reconciles: p.optional(p.String)
-}), p.Struct({
-	_tag: p.Literal("delta"),
-	revision: p.Number,
-	emittedAt: p.Number,
-	patch: vt
-}), p.Struct({
-	_tag: p.Literal("error"),
-	error: p.Unknown,
-	revision: p.optional(p.Number)
-})), wt = (e, t, n) => {
+	computed: h.optional(h.Boolean),
+	reconciles: h.optional(h.String)
+}), h.Struct({
+	_tag: h.Literal("delta"),
+	revision: h.Number,
+	emittedAt: h.Number,
+	patch: Pt
+}), h.Struct({
+	_tag: h.Literal("error"),
+	error: h.Unknown,
+	revision: h.optional(h.Number)
+})), Vt = (e, t, n) => {
 	if (!t || typeof t != "object" || !("_tag" in t)) return t;
 	let r = t;
 	switch (r._tag) {
 		case "snapshot": return r.data;
-		case "error": {
-			let t = r.error;
-			throw Object.assign(Error(`${n} ${e}: ${t?._tag ?? "error"}${t?.message ? ` — ${t.message}` : ""}`, { cause: r.error }), { voltroError: r.error });
-		}
+		case "error": throw r.error === void 0 ? Error(`${n} ${e}: the rpc refused without an error value`) : r.error;
 		case "delta": throw Error(`${n} ${e}: received a 'delta' as the first event, which should be impossible — a subscription always opens with a snapshot. This is a framework bug.`);
 		default: return t;
 	}
-}, b = (e, t) => {
+}, Ht = (e, t) => {
 	let n = `${e ?? "this procedure"} input`;
 	return t === !0 ? `${n} (guarded — the guard did NOT run: the payload failed to decode first, so this says nothing about access)` : n;
-}, Tt = (e) => {
+}, Ut = (e) => {
 	let t = e.ast;
 	return t._tag === "TypeLiteral" && (t.propertySignatures?.length ?? 0) === 0 && (t.indexSignatures?.length ?? 0) === 0;
 }, x = (e, t, n) => {
-	let r = b(t, n), i = e.annotations({
+	let r = Ht(t, n), i = e.annotations({
 		parseOptions: { onExcessProperty: "error" },
 		parseIssueTitle: () => r
 	});
-	return Tt(e) ? p.filter((e) => typeof e == "object" && e && Object.keys(e).length > 0 ? `this procedure declares no input; received: ${Object.keys(e).join(", ")}` : void 0)(i).annotations({ identifier: r }) : i;
-}, Et = class extends p.TaggedError()("BusinessRuleViolation", {
-	rule: p.String,
-	params: p.optional(p.Record({
-		key: p.String,
-		value: p.Unknown
+	return Ut(e) ? h.filter((e) => typeof e == "object" && e && Object.keys(e).length > 0 ? `this procedure declares no input; received: ${Object.keys(e).join(", ")}` : void 0)(i).annotations({ identifier: r }) : i;
+}, S = class extends h.TaggedError()("BusinessRuleViolation", {
+	rule: h.String,
+	params: h.optional(h.Record({
+		key: h.String,
+		value: h.Unknown
 	})),
-	field: p.optional(p.String),
-	message: p.optional(p.String),
-	severity: p.Literal("error", "warning")
-}) {}, Dt = p.Struct({
-	field: p.String,
-	message: p.String,
-	params: p.optional(p.Record({
-		key: p.String,
-		value: p.Unknown
+	field: h.optional(h.String),
+	message: h.optional(h.String),
+	severity: h.Literal("error", "warning")
+}) {}, Wt = h.Struct({
+	field: h.String,
+	message: h.String,
+	params: h.optional(h.Record({
+		key: h.String,
+		value: h.Unknown
 	}))
-}), Ot = class extends p.TaggedError()("ValidationError", {
-	field: p.String,
-	message: p.String,
-	params: p.optional(p.Record({
-		key: p.String,
-		value: p.Unknown
+}), C = class extends h.TaggedError()("ValidationError", {
+	field: h.String,
+	message: h.String,
+	params: h.optional(h.Record({
+		key: h.String,
+		value: h.Unknown
 	}))
-}) {}, kt = class extends p.TaggedError()("ValidationErrors", { issues: p.Array(Dt).pipe(p.minItems(1)) }) {}, At = (e) => {
+}) {}, w = class extends h.TaggedError()("ValidationErrors", { issues: h.Array(Wt).pipe(h.minItems(1)) }) {}, Gt = (e) => {
 	if (typeof e != "object" || !e) return [];
 	let t = e._tag;
 	if (t === "ValidationError") {
@@ -209,69 +223,69 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 		}];
 	}
 	return [];
-}, jt = class extends p.TaggedError()("ApprovalRequired", {
-	approvalId: p.String,
-	procedure: p.String,
-	expiresAt: p.String,
-	requiredScopes: p.Array(p.String),
-	reason: p.NullOr(p.String),
-	created: p.Boolean
-}) {}, Mt = class extends p.TaggedError()("ApprovalNotFound", { approvalId: p.String }) {}, Nt = class extends p.TaggedError()("ApprovalSelfApproval", {
-	approvalId: p.String,
-	subjectId: p.NullOr(p.String)
-}) {}, Pt = class extends p.TaggedError()("ApprovalRejected", {
-	approvalId: p.String,
-	decidedBy: p.NullOr(p.String),
-	note: p.NullOr(p.String)
-}) {}, S = class extends p.TaggedError()("ApprovalExpired", {
-	approvalId: p.String,
-	expiredAt: p.String
-}) {}, Ft = class extends p.TaggedError()("ApprovalNotPending", {
-	approvalId: p.String,
-	status: p.String
-}) {}, It = class extends p.TaggedError()("ApprovalForbidden", {
-	approvalId: p.String,
-	required: p.NullOr(p.String),
-	message: p.String
-}) {}, C = class extends p.TaggedError()("ApprovalUnavailable", {
-	procedure: p.String,
-	message: p.String
-}) {}, Lt = p.Union(jt, Pt, S, C), Rt = p.Union(Mt, Nt, S, Ft, It, C), zt = p.Struct({
-	id: p.String,
-	procedure: p.String,
-	kind: p.Literal("mutation", "action"),
-	requestedBy: p.NullOr(p.String),
-	status: p.Literal("pending", "approved", "rejected", "expired", "consumed"),
-	reason: p.NullOr(p.String),
-	requiredScopes: p.Array(p.String),
-	requestedAt: p.String,
-	expiresAt: p.String,
-	decidedBy: p.NullOr(p.String),
-	decidedAt: p.NullOr(p.String),
-	note: p.NullOr(p.String),
-	relation: p.Literal("to-decide", "requested")
-}), w = "channel:", Bt = Symbol.for("@voltro/protocol/reactivityChannels"), Vt = globalThis, T = Vt[Bt] ?? (Vt[Bt] = /* @__PURE__ */ new Map()), Ht = /^[a-z][a-z0-9-]*(\.[a-z0-9-]+)*$/, Ut = (e) => {
-	if (!Ht.test(e)) throw Error(`reactivityChannel('${e}'): invalid channel name.\n  Use lowercase kebab segments separated by dots — \`presence\`, \`job-queue\`,
+}, Kt = class extends h.TaggedError()("ApprovalRequired", {
+	approvalId: h.String,
+	procedure: h.String,
+	expiresAt: h.String,
+	requiredScopes: h.Array(h.String),
+	reason: h.NullOr(h.String),
+	created: h.Boolean
+}) {}, qt = class extends h.TaggedError()("ApprovalNotFound", { approvalId: h.String }) {}, Jt = class extends h.TaggedError()("ApprovalSelfApproval", {
+	approvalId: h.String,
+	subjectId: h.NullOr(h.String)
+}) {}, Yt = class extends h.TaggedError()("ApprovalRejected", {
+	approvalId: h.String,
+	decidedBy: h.NullOr(h.String),
+	note: h.NullOr(h.String)
+}) {}, T = class extends h.TaggedError()("ApprovalExpired", {
+	approvalId: h.String,
+	expiredAt: h.String
+}) {}, Xt = class extends h.TaggedError()("ApprovalNotPending", {
+	approvalId: h.String,
+	status: h.String
+}) {}, Zt = class extends h.TaggedError()("ApprovalForbidden", {
+	approvalId: h.String,
+	required: h.NullOr(h.String),
+	message: h.String
+}) {}, E = class extends h.TaggedError()("ApprovalUnavailable", {
+	procedure: h.String,
+	message: h.String
+}) {}, Qt = h.Union(Kt, Yt, T, E), $t = h.Union(qt, Jt, T, Xt, Zt, E), en = h.Struct({
+	id: h.String,
+	procedure: h.String,
+	kind: h.Literal("mutation", "action"),
+	requestedBy: h.NullOr(h.String),
+	status: h.Literal("pending", "approved", "rejected", "expired", "consumed"),
+	reason: h.NullOr(h.String),
+	requiredScopes: h.Array(h.String),
+	requestedAt: h.String,
+	expiresAt: h.String,
+	decidedBy: h.NullOr(h.String),
+	decidedAt: h.NullOr(h.String),
+	note: h.NullOr(h.String),
+	relation: h.Literal("to-decide", "requested")
+}), D = "channel:", tn = Symbol.for("@voltro/protocol/reactivityChannels"), nn = globalThis, O = nn[tn] ?? (nn[tn] = /* @__PURE__ */ new Map()), rn = /^[a-z][a-z0-9-]*(\.[a-z0-9-]+)*$/, an = (e) => {
+	if (!rn.test(e)) throw Error(`reactivityChannel('${e}'): invalid channel name.\n  Use lowercase kebab segments separated by dots — \`presence\`, \`job-queue\`,
   \`billing.usage\`. A \`:\` is refused because it is the namespace separator in
-  the routing key (\`${w}<name>\`), and an uppercase letter is\n  refused because a key that differs only by case reads as one channel and
+  the routing key (\`${D}<name>\`), and an uppercase letter is\n  refused because a key that differs only by case reads as one channel and
   routes as two.`);
-	let t = T.get(e);
+	let t = O.get(e);
 	if (t !== void 0) return t;
-	let n = `${w}${e}`, r = Object.freeze({
+	let n = `${D}${e}`, r = Object.freeze({
 		kind: "reactivity-channel",
 		name: e,
 		key: n,
 		toString: () => n
 	});
-	return T.set(e, r), r;
-}, Wt = (e) => typeof e == "object" && !!e && e.kind === "reactivity-channel", Gt = (e) => e.startsWith(w), Kt = () => new Set([...T.values()].map((e) => e.key)), E = (e) => Wt(e) ? e.key : e, qt = (e) => e === void 0 ? [] : Array.isArray(e) ? e.map(E) : [E(e)], Jt = (e) => e === void 0 ? void 0 : Array.isArray(e) ? e.map(E) : E(e), Yt = (e) => {
-	let t = Kt(), n = [];
-	for (let r of e) for (let e of qt(r.source)) Gt(e) && !t.has(e) && n.push({
+	return O.set(e, r), r;
+}, on = (e) => typeof e == "object" && !!e && e.kind === "reactivity-channel", sn = (e) => e.startsWith(D), cn = () => new Set([...O.values()].map((e) => e.key)), k = (e) => on(e) ? e.key : e, ln = (e) => e === void 0 ? [] : Array.isArray(e) ? e.map(k) : [k(e)], un = (e) => e === void 0 ? void 0 : Array.isArray(e) ? e.map(k) : k(e), dn = (e) => {
+	let t = cn(), n = [];
+	for (let r of e) for (let e of ln(r.source)) sn(e) && !t.has(e) && n.push({
 		procedure: r.name,
 		key: e
 	});
 	return n;
-}, Xt = (e, t) => {
+}, fn = (e, t) => {
 	let n = e?.injectExternalChange;
 	return n !== void 0 && (n.call(e, {
 		table: t.key,
@@ -280,8 +294,8 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 		old: {},
 		origin: "inline"
 	}), !0);
-}, Zt = (e) => e.internal !== !0, D = (e) => {
-	if (Qt(e), e.idempotencyScope !== void 0 && e.idempotencyScope !== "subject" && e.idempotencyScope !== "connection") throw Error(`${e.name}: idempotencyScope must be 'subject' or 'connection'`);
+}, A = (e) => e.internal !== !0, pn = (e) => e.service === void 0 ? "client" : "service", mn = (e) => A(e) && e.service === void 0, hn = (e) => A(e) && e.service !== void 0, gn = /^[a-z][a-z0-9-]{0,55}$/i, j = (e) => {
+	if (vn(e), _n(e), e.idempotencyScope !== void 0 && e.idempotencyScope !== "subject" && e.idempotencyScope !== "connection") throw Error(`${e.name}: idempotencyScope must be 'subject' or 'connection'`);
 	let t = e.serialize;
 	if (t !== void 0) {
 		if (typeof t.key != "function") throw Error(`${e.name}: serialize.key must be a function of the input`);
@@ -305,7 +319,27 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 	let r = [e.publicApi === void 0 ? void 0 : "publicApi", e.exposeAsTool === void 0 ? void 0 : "exposeAsTool"].filter((e) => e !== void 0);
 	if (r.length === 0) return e;
 	throw Error(`${e.name}: \`internal: true\` cannot be combined with ${r.map((e) => `\`${e}\``).join(" or ")}. \`internal\` takes the procedure OFF the wire; those put it back ON a different one (${r.includes("publicApi") ? "a REST route" : "an agent tool"}), and that surface is projected without consulting the flag — so the procedure would be unreachable from your client and reachable from the internet. Drop \`internal: true\` if the wider surface is intended, or remove the ${r.join(" / ")} annotation if it is not.`);
-}, Qt = (e) => {
+}, _n = (e) => {
+	let t = e.service;
+	if (t === void 0) return;
+	let n = t.callers;
+	if (!Array.isArray(n) || n.length === 0) throw Error(`${e.name}: \`service.callers\` is empty, so NO app may call this procedure —\n  and no browser either. Name the calling app(s), e.g. \`service: { callers: ['worker'] }\`,
+  or drop \`service:\` if the procedure is meant for this app's own clients.`);
+	let r = n.filter((e) => typeof e != "string" || !gn.test(e));
+	if (r.length > 0) throw Error(`${e.name}: \`service.callers\` holds ${r.map((e) => JSON.stringify(e)).join(", ")} — a caller is an\n  app name (letters, digits, dashes; starting with a letter; at most 56 characters), the same name this app
+  lists in \`serviceCallers\` and the caller's credential resolves to.`);
+	if (new Set(n).size !== n.length) throw Error(`${e.name}: \`service.callers\` lists the same app twice`);
+	let i = [
+		e.internal === !0 ? "`internal: true` (it removes the wire surface a service calls over)" : void 0,
+		e.publicApi === void 0 ? void 0 : "`publicApi` (a REST route is for callers that are not the listed apps)",
+		e.exposeAsTool === void 0 ? void 0 : "`exposeAsTool` (an agent tool is not one of the listed apps)",
+		e.requiresApproval === void 0 ? void 0 : "`requiresApproval` (a second HUMAN cannot approve a machine call)",
+		e.overridesPlugin === !0 ? "`overridesPlugin` (a plugin route is a client surface; replacing it with a service-only one breaks its clients)" : void 0,
+		e.idempotencyScope === "connection" ? "`idempotencyScope: 'connection'` (a service call dedups per service, across reconnects)" : void 0
+	].filter((e) => e !== void 0);
+	if (i.length !== 0) throw Error(`${e.name}: \`service:\` cannot be combined with ${i.join("; ")}.\n  A service procedure is callable only by the listed apps of this project, over the
+  socket, with their service credential. Drop the other field, or drop \`service:\`.`);
+}, vn = (e) => {
 	let t = e.requiresApproval;
 	if (t !== void 0) {
 		if (!Array.isArray(t.approvers) || t.approvers.length === 0) throw Error(`${e.name}: \`requiresApproval.approvers\` is empty, so NOBODY can approve this\n  procedure and every call would park forever. Name the scope(s) an approver must hold
@@ -315,51 +349,59 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
   human from every other, and the second-pair-of-eyes control would enforce nothing.
   Give the procedure a \`guards:\` decision, or drop \`requiresApproval\`.`);
 	}
-}, $t = (e) => e.action !== void 0 && e.resourceType !== void 0, en = (e) => e.authenticated === !0, tn = (e) => e.openAccess !== void 0 || e.guards !== void 0 && e.guards.length > 0, O = (e, t, n) => {
+}, yn = (e) => e.action !== void 0 && e.resourceType !== void 0, bn = (e) => e.authenticated === !0, xn = (e) => e.openAccess !== void 0 || e.guards !== void 0 && e.guards.length > 0, M = (e, t, n, i) => {
+	if (i !== void 0) {
+		if (n !== void 0 || t !== void 0 && t.length > 0) throw Error(`${e}: \`service:\` is an access decision of its own — only the listed apps may\n  call this procedure — so it cannot sit beside \`guards:\` or \`openAccess:\`. A service
+  holds no scopes, and no user may call a service procedure. Keep exactly one.`);
+		return Array.isArray(i.callers) ? [a(i.callers)] : void 0;
+	}
 	if (n === void 0) return t;
 	if (n.trim() === "") throw Error(`${e}: \`openAccess\` needs a REASON, not an empty string. It is the sentence a\n  reviewer reads to decide whether this procedure should really be callable
   without an authorization check — e.g. \`openAccess: 'public pricing, no caller data'\`.`);
 	if (t !== void 0 && t.length > 0) throw Error(`${e}: \`openAccess\` and \`guards\` are two different access decisions, so\n  declaring both says the procedure is protected AND open. Keep the guards if a
   caller must hold a scope; drop them if anyone may call it.`);
-	return [d(n.trim())];
-}, k = (e) => D({
+	return [r(n.trim())];
+}, N = (e) => j({
 	kind: "query",
 	name: e.name,
 	input: e.input,
 	output: e.output,
-	error: e.error ?? p.Never,
-	source: Jt(e.source),
+	error: e.error ?? h.Never,
+	source: un(e.source),
 	cache: e.cache,
-	guards: O(e.name, e.guards, e.openAccess),
+	guards: M(e.name, e.guards, e.openAccess, e.service),
 	openAccess: e.openAccess,
+	service: e.service === void 0 ? void 0 : { callers: Array.isArray(e.service.callers) ? [...e.service.callers] : e.service.callers },
 	publicApi: e.publicApi,
 	exposeAsTool: e.exposeAsTool,
 	internal: e.internal,
 	overridesPlugin: e.overridesPlugin
-}), A = (e) => D({
+}), P = (e) => j({
 	kind: "mutation",
 	name: e.name,
 	input: e.input,
 	output: e.output,
-	error: e.error ?? p.Never,
+	error: e.error ?? h.Never,
 	...e.idempotencyScope === void 0 ? {} : { idempotencyScope: e.idempotencyScope },
 	...e.serialize === void 0 ? {} : { serialize: e.serialize },
 	target: e.target,
-	guards: O(e.name, e.guards, e.openAccess),
+	guards: M(e.name, e.guards, e.openAccess, e.service),
 	openAccess: e.openAccess,
+	service: e.service === void 0 ? void 0 : { callers: Array.isArray(e.service.callers) ? [...e.service.callers] : e.service.callers },
 	publicApi: e.publicApi,
 	exposeAsTool: e.exposeAsTool,
 	requiresApproval: e.requiresApproval,
 	internal: e.internal,
 	overridesPlugin: e.overridesPlugin
-}), j = (e) => D({
+}), F = (e) => j({
 	kind: "action",
 	name: e.name,
 	input: e.input,
 	output: e.output,
-	error: e.error ?? p.Never,
-	guards: O(e.name, e.guards, e.openAccess),
+	error: e.error ?? h.Never,
+	guards: M(e.name, e.guards, e.openAccess, e.service),
 	openAccess: e.openAccess,
+	service: e.service === void 0 ? void 0 : { callers: Array.isArray(e.service.callers) ? [...e.service.callers] : e.service.callers },
 	source: e.source,
 	target: e.target,
 	publicApi: e.publicApi,
@@ -367,54 +409,85 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 	requiresApproval: e.requiresApproval,
 	internal: e.internal,
 	overridesPlugin: e.overridesPlugin
-}), nn = (e) => D({
+}), Sn = (e) => j({
 	kind: "stream",
 	name: e.name,
 	input: e.input,
 	element: e.element,
-	error: e.error ?? p.Never,
+	error: e.error ?? h.Never,
 	internal: e.internal,
 	overridesPlugin: e.overridesPlugin,
-	guards: O(e.name, e.guards, e.openAccess),
+	guards: M(e.name, e.guards, e.openAccess),
 	openAccess: e.openAccess
-}), M = (e, t) => t && t.length > 0 ? p.Union(e, ...t) : e, N = (e) => e !== void 0 && e.some((e) => !u(e)), rn = (e) => p.Union(e, f, l), an = (e) => p.Union(e, Et), on = (e) => p.Union(e, Ot, kt), sn = (e, t) => t === void 0 ? e : p.Union(e, Lt), P = (e, t) => {
-	let n = rn(e.error);
+}), Cn = (e, t) => t && t.length > 0 ? h.Union(e, ...t) : e, I = (e) => e !== void 0 && e.some((e) => !p(e)), wn = (e) => h.Union(e, f, l), Tn = (e) => h.Union(e, S), En = (e) => h.Union(e, C, w), Dn = (e, t) => t === void 0 ? e : h.Union(e, Qt), On = (e, t) => u(t) ? h.Union(e, d) : e, L = (e, t, n) => Cn(kn(e, t), n), kn = (e, t) => {
+	let n = On(wn(e.error), e.guards);
 	if (t === "stream" || t === "query") return n;
-	let r = t === "mutation" ? p.Union(an(n), dt, ht) : n;
-	return sn(on(t === "mutation" && e.idempotencyScope === "connection" ? p.Union(r, qe) : r), e.requiresApproval);
-}, cn = (e, t) => M(rn(e.errorSchema), t), ln = (e, t) => ({
+	let r = t === "mutation" ? h.Union(Tn(n), m, kt) : n;
+	return Dn(En(t === "mutation" && e.idempotencyScope === "connection" ? h.Union(r, Ze) : r), e.requiresApproval);
+}, An = {
+	query: [f, l],
+	stream: [f, l],
+	action: [
+		f,
+		l,
+		C,
+		w
+	],
+	mutation: [
+		f,
+		l,
+		S,
+		m,
+		kt,
+		C,
+		w
+	]
+}, jn = (e, t) => Cn(On(wn(e.errorSchema), e.guards), t), Mn = (e, t) => ({
 	...e,
 	name: t
-}), un = (e, t) => m.make(e.name, {
-	payload: x(e.input, e.name, N(e.guards)),
-	success: y(e.output),
-	error: M(P(e, "query"), t),
+}), Nn = (e, t) => g.make(e.name, {
+	payload: x(e.input, e.name, I(e.guards)),
+	success: Bt(e.output),
+	error: L(e, "query", t),
 	stream: !0
-}), dn = (e, t) => m.make(e.name, {
-	payload: x(e.input, e.name, N(e.guards)),
+}), Pn = (e, t) => g.make(e.name, {
+	payload: x(e.input, e.name, I(e.guards)),
 	success: e.output,
-	error: M(P(e, "mutation"), t)
-}), fn = (e, t) => m.make(e.name, {
-	payload: x(e.input, e.name, N(e.guards)),
+	error: L(e, "mutation", t)
+}), Fn = (e, t) => g.make(e.name, {
+	payload: x(e.input, e.name, I(e.guards)),
 	success: e.output,
-	error: M(P(e, "action"), t)
-}), pn = (e, t) => m.make(e.name, {
-	payload: x(e.input, e.name, N(e.guards)),
+	error: L(e, "action", t)
+}), In = (e, t) => g.make(e.name, {
+	payload: x(e.input, e.name, I(e.guards)),
 	success: e.element,
-	error: M(e.error, t),
+	error: L(e, "stream", t),
 	stream: !0
-}), mn = (e) => {
+}), R = (e) => {
 	if (typeof e != "object" || !e) return;
 	let t = e._tag;
 	return typeof t == "string" ? t : void 0;
-}, hn = (e) => {
+}, Ln = (e) => {
+	if (typeof e == "string") return e;
+	if (typeof e == "object" && e) {
+		let t = e.message;
+		if (typeof t == "string" && t !== "") return t;
+		let n = R(e);
+		if (n !== void 0) return n;
+	}
+	return String(e);
+}, Rn = (e) => {
+	if (e instanceof Error) return e;
+	let t = Error(Ln(e), { cause: e });
+	return t.name = R(e) ?? "NonErrorThrown", t;
+}, zn = (e) => {
 	switch (e.kind) {
-		case "query": return un(e);
-		case "mutation": return dn(e);
-		case "action": return fn(e);
-		case "stream": return pn(e);
+		case "query": return Nn(e);
+		case "mutation": return Pn(e);
+		case "action": return Fn(e);
+		case "stream": return In(e);
 	}
-}, gn = (e) => {
+}, Bn = (e) => {
 	let t = e.input, n = t === void 0 ? {} : { input: t }, r = e.output, i = r === void 0 ? {} : { output: r };
 	if (e.kind === "query") return {
 		kind: "query",
@@ -460,7 +533,7 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 			..."relations" in e && e.relations !== void 0 ? { relations: e.relations } : {}
 		}))
 	};
-}, _n = 7500, vn = (e) => typeof e == "object" && !!e && e.kind === "event", yn = (e) => {
+}, Vn = 7500, Hn = (e) => typeof e == "object" && !!e && e.kind === "event", Un = (e) => {
 	if (e.name.length === 0) throw Error("defineEvent: `name` must not be empty");
 	if (/\s/.test(e.name)) throw Error(`defineEvent("${e.name}"): \`name\` must not contain whitespace.\n  The name is used as a broker subject segment. NATS refuses a subject with
   whitespace and delivers nothing — silently, and only on that broker, so an
@@ -489,68 +562,68 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 		name: e.name,
 		key: e.key,
 		payload: e.payload,
-		guards: e.openAccess === void 0 ? e.guards : [d(e.openAccess.trim())],
+		guards: e.openAccess === void 0 ? e.guards : [r(e.openAccess.trim())],
 		openAccess: e.openAccess,
 		rewind: e.rewind,
 		webhook: e.webhook,
 		delivery: e.delivery
 	};
-}, bn = (e) => p.Struct({
-	_tag: p.Literal("event"),
-	origin: p.String,
-	n: p.Number,
-	emittedAt: p.Number,
+}, Wn = (e) => h.Struct({
+	_tag: h.Literal("event"),
+	origin: h.String,
+	n: h.Number,
+	emittedAt: h.Number,
 	payload: e
-}), xn = p.Struct({
-	_tag: p.Literal("gap"),
-	missed: p.Number,
-	reason: p.Literal("buffer", "resume")
-}), Sn = p.Struct({ _tag: p.Literal("attached") }), Cn = (e) => p.Union(Sn, bn(e), xn), wn = p.Struct({
-	origin: p.String,
-	n: p.Number
-}), Tn = (e) => p.Struct({
+}), Gn = h.Struct({
+	_tag: h.Literal("gap"),
+	missed: h.Number,
+	reason: h.Literal("buffer", "resume")
+}), Kn = h.Struct({ _tag: h.Literal("attached") }), qn = (e) => h.Union(Kn, Wn(e), Gn), Jn = h.Struct({
+	origin: h.String,
+	n: h.Number
+}), Yn = (e) => h.Struct({
 	key: e,
-	resume: p.optional(p.Array(wn))
-}), En = (e, t) => {
-	let n = e.guards !== void 0 && e.guards.some((e) => !u(e)) ? p.Union(f, l) : l, r = t && t.length > 0 ? p.Union(n, ...t) : n;
-	return m.make(e.name, {
-		payload: x(Tn(e.key), e.name, N(e.guards)),
-		success: Cn(e.payload),
-		error: r,
+	resume: h.optional(h.Array(Jn))
+}), Xn = (e, t) => {
+	let n = e.guards !== void 0 && e.guards.some((e) => !p(e)) ? h.Union(f, l) : l, r = u(e.guards) ? h.Union(n, d) : n, i = t && t.length > 0 ? h.Union(r, ...t) : r;
+	return g.make(e.name, {
+		payload: x(Yn(e.key), e.name, I(e.guards)),
+		success: qn(e.payload),
+		error: i,
 		stream: !0
 	});
-}, Dn = class extends p.TaggedError()("EventPayloadInvalid", {
-	event: p.String,
-	message: p.String
-}) {}, On = class extends p.TaggedError()("EventKeyInvalid", {
-	event: p.String,
-	message: p.String
-}) {}, kn = class extends p.TaggedError()("EventPayloadTooLarge", {
-	event: p.String,
-	bytes: p.Number,
-	limit: p.Number
-}) {}, An = (e) => {
+}, Zn = class extends h.TaggedError()("EventPayloadInvalid", {
+	event: h.String,
+	message: h.String
+}) {}, Qn = class extends h.TaggedError()("EventKeyInvalid", {
+	event: h.String,
+	message: h.String
+}) {}, $n = class extends h.TaggedError()("EventPayloadTooLarge", {
+	event: h.String,
+	bytes: h.Number,
+	limit: h.Number
+}) {}, er = (e) => {
 	if (typeof e != "object" || !e) return JSON.stringify(e) ?? "null";
 	let t = Object.entries(e).filter(([, e]) => e !== void 0).sort(([e], [t]) => e < t ? -1 : +(e > t));
 	return JSON.stringify(t);
-}, jn = "\0", Mn = (e, t, n) => [
+}, tr = "\0", nr = (e, t, n) => [
 	e ?? "~",
 	t,
-	An(n)
-].join("\0"), Nn = (e) => {
+	er(n)
+].join("\0"), rr = (e) => {
 	let [t = "~", n = "", r = ""] = e.split("\0");
 	return {
 		tenantId: t === "~" ? null : t,
 		event: n,
 		key: r
 	};
-}, Pn = (e) => e.split("\0").join(" · "), F = Symbol.for("@voltro/protocol/workflow-access"), Fn = {
+}, ir = (e) => e.split("\0").join(" · "), z = Symbol.for("@voltro/protocol/workflow-access"), ar = {
 	guards: void 0,
 	openAccess: void 0,
 	internal: !1,
 	controls: void 0,
 	controlsOpenAccess: void 0
-}, In = (e, t) => {
+}, or = (e, t) => {
 	let n = t.guards;
 	if (n !== void 0 && n.length === 0) throw Error(`workflow("${e}"): \`guards: []\` is empty, so it enforces nothing —\n  but it reads at the call site as if the start were protected. Omit the field
   and decide with \`openAccess\` or \`internal\`, or list the scopes that may start it.`);
@@ -565,34 +638,34 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
   \`openAccess\` (an internal workflow needs no wire decision), or drop
   \`internal: true\` if the workflow really is meant to be startable by clients.`);
 	}
-	let r = t.controls?.guards, i = t.controls?.openAccess;
-	if (r !== void 0 && r.length === 0) throw Error(`workflow("${e}"): \`controls: { guards: [] }\` is empty, so it enforces nothing —\n  but it reads at the call site as if driving this run were protected. Omit
+	let i = t.controls?.guards, a = t.controls?.openAccess;
+	if (i !== void 0 && i.length === 0) throw Error(`workflow("${e}"): \`controls: { guards: [] }\` is empty, so it enforces nothing —\n  but it reads at the call site as if driving this run were protected. Omit
   \`controls\` (wire control is then refused for everyone but \`admin:full\`), or
   list the scopes a caller needs to cancel or signal a run.`);
-	if (i !== void 0) {
-		if (i.trim() === "") throw Error(`workflow("${e}"): \`controls: { openAccess }\` needs a REASON, not an empty string.\n  It is the sentence a reviewer reads to decide whether anyone who can see this
+	if (a !== void 0) {
+		if (a.trim() === "") throw Error(`workflow("${e}"): \`controls: { openAccess }\` needs a REASON, not an empty string.\n  It is the sentence a reviewer reads to decide whether anyone who can see this
   run should be able to cancel or signal it — e.g. \`controls: { openAccess:
   'the run belongs to the caller who started it; cancelling it affects nobody else' }\`.`);
-		if (r !== void 0 && r.length > 0) throw Error(`workflow("${e}"): \`controls\` takes \`guards\` OR \`openAccess\`, not both.\n  Two answers to one question; keep the guards if a caller needs a scope.`);
+		if (i !== void 0 && i.length > 0) throw Error(`workflow("${e}"): \`controls\` takes \`guards\` OR \`openAccess\`, not both.\n  Two answers to one question; keep the guards if a caller needs a scope.`);
 	}
 	return {
-		guards: t.openAccess === void 0 ? t.guards : [d(t.openAccess.trim())],
+		guards: t.openAccess === void 0 ? t.guards : [r(t.openAccess.trim())],
 		openAccess: t.openAccess?.trim(),
 		internal: t.internal === !0,
-		controls: i === void 0 ? r : [d(i.trim())],
-		controlsOpenAccess: i?.trim()
+		controls: a === void 0 ? i : [r(a.trim())],
+		controlsOpenAccess: a?.trim()
 	};
-}, Ln = (e, t) => {
-	Object.defineProperty(e, F, {
+}, sr = (e, t) => {
+	Object.defineProperty(e, z, {
 		value: t,
 		enumerable: !1
 	});
-}, I = (e) => {
-	if (typeof e != "object" || !e) return Fn;
-	let t = e[F];
-	return t === void 0 ? Fn : t;
-}, Rn = (e) => {
-	let t = I(e);
+}, B = (e) => {
+	if (typeof e != "object" || !e) return ar;
+	let t = e[z];
+	return t === void 0 ? ar : t;
+}, cr = (e) => {
+	let t = B(e);
 	return {
 		name: e.name,
 		internal: t.internal,
@@ -600,20 +673,25 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 		openAccess: t.openAccess,
 		controls: t.controls
 	};
-}, zn = (e) => e, Bn = (e) => e, Vn = (e) => {
+}, lr = class extends h.TaggedError()("ApiUnavailable", {
+	api: h.String,
+	tag: h.String,
+	reason: h.Literal("timeout", "transport", "closed"),
+	message: h.String
+}) {}, ur = (e) => typeof e == "object" && !!e && e._tag === "ApiUnavailable", dr = (e) => e, fr = (e) => e, pr = (e) => {
 	let t = e.alias?.trim(), n = e.instance?.trim(), r = t !== void 0 && t !== "" ? t : e.base;
 	return n !== void 0 && n !== "" ? `${r}#${n}` : r;
-}, Hn = (e) => {
+}, mr = (e) => {
 	if (e.length !== 0) return (t, n) => e.reduceRight((e, t) => t(e, n), t);
-}, Un = (e, t) => {
-	let n = pt.GenericTag(e);
+}, hr = (e, t) => {
+	let n = Tt.GenericTag(e);
 	return {
 		Tag: n,
-		Live: mt.succeed(n, t)
+		Live: Ot.succeed(n, t)
 	};
-}, Wn = (e, t, n) => {
+}, gr = (e, t, n) => {
 	if (!t) return { ok: !0 };
-	let r = n === void 0 ? null : L(n);
+	let r = n === void 0 ? null : V(n);
 	if (!r) return {
 		ok: !0,
 		unverified: `plugin "${e}" requires framework ${t}, but the running framework version is ${n === void 0 ? "unknown" : `unreadable ("${n}")`} — not checked.`
@@ -621,12 +699,12 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 	let i = t.trim();
 	if (i === "*" || i === "") return { ok: !0 };
 	let a = i.split(/\s+/).filter((e) => e.length > 0);
-	for (let i of a) if (!Gn(i, r)) return {
+	for (let i of a) if (!_r(i, r)) return {
 		ok: !1,
 		reason: `plugin "${e}" requires framework ${t}, running ${n}`
 	};
 	return { ok: !0 };
-}, L = (e) => {
+}, V = (e) => {
 	let t = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9a-zA-Z.-]+))?$/.exec(e.trim());
 	return t ? {
 		major: Number(t[1]),
@@ -634,109 +712,109 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 		patch: Number(t[3]),
 		pre: t[4] ?? ""
 	} : null;
-}, R = (e, t) => e.major === t.major ? e.minor === t.minor ? e.patch === t.patch ? e.pre && !t.pre ? -1 : !e.pre && t.pre ? 1 : e.pre && t.pre ? e.pre < t.pre ? -1 : +(e.pre > t.pre) : 0 : e.patch - t.patch : e.minor - t.minor : e.major - t.major, Gn = (e, t) => {
+}, H = (e, t) => e.major === t.major ? e.minor === t.minor ? e.patch === t.patch ? e.pre && !t.pre ? -1 : !e.pre && t.pre ? 1 : e.pre && t.pre ? e.pre < t.pre ? -1 : +(e.pre > t.pre) : 0 : e.patch - t.patch : e.minor - t.minor : e.major - t.major, _r = (e, t) => {
 	if (e === "*") return !0;
 	if (e.startsWith("^")) {
-		let n = L(e.slice(1));
-		return !n || t.major !== n.major ? !1 : R(t, n) >= 0;
+		let n = V(e.slice(1));
+		return !n || t.major !== n.major ? !1 : H(t, n) >= 0;
 	}
 	if (e.startsWith("~")) {
-		let n = L(e.slice(1));
-		return !n || t.major !== n.major || t.minor !== n.minor ? !1 : R(t, n) >= 0;
+		let n = V(e.slice(1));
+		return !n || t.major !== n.major || t.minor !== n.minor ? !1 : H(t, n) >= 0;
 	}
 	let n = /^(>=|<=|>|<)(.+)$/.exec(e);
 	if (n) {
-		let e = n[1], r = L(n[2]);
+		let e = n[1], r = V(n[2]);
 		if (!r) return !1;
-		let i = R(t, r);
+		let i = H(t, r);
 		if (e === ">=") return i >= 0;
 		if (e === "<=") return i <= 0;
 		if (e === ">") return i > 0;
 		if (e === "<") return i < 0;
 	}
-	let r = L(e);
-	return r ? R(t, r) === 0 : !1;
-}, Kn = (e) => {
+	let r = V(e);
+	return r ? H(t, r) === 0 : !1;
+}, vr = (e) => {
 	let t = e.startsWith("@") ? e.replace(/^@[^/]+\//, "") : e;
 	return (t.startsWith("plugin-") ? t.slice(7) : t).replace(/-([a-zA-Z0-9])/g, (e, t) => t.toUpperCase());
-}, qn = (e) => {
+}, yr = (e) => {
 	let t = e.startsWith("@") ? e.replace(/^@[^/]+\//, "") : e;
 	return (t.startsWith("plugin-") ? t.slice(7) : t).replace(/#/g, "--").replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
-}, Jn = Symbol.for("@voltro/protocol/pluginAliases"), z = () => {
-	let e = globalThis, t = e[Jn];
+}, br = Symbol.for("@voltro/protocol/pluginAliases"), U = () => {
+	let e = globalThis, t = e[br];
 	if (t instanceof Map) return t;
 	let n = /* @__PURE__ */ new Map();
-	return e[Jn] = n, n;
-}, Yn = (e) => {
-	let t = z();
+	return e[br] = n, n;
+}, xr = (e) => {
+	let t = U();
 	for (let [n, r] of Object.entries(e)) {
 		if (r === "") continue;
 		let e = t.get(n);
 		e === void 0 ? t.set(n, /* @__PURE__ */ new Set([r])) : e.add(r);
 	}
-}, Xn = () => {
-	z().clear();
-}, Zn = (e, t) => {
-	let n = z().get(e);
-	if (n === void 0 || n.size === 0) return `${Kn(e)}.${t}`;
+}, Sr = () => {
+	U().clear();
+}, Cr = (e, t) => {
+	let n = U().get(e);
+	if (n === void 0 || n.size === 0) return `${vr(e)}.${t}`;
 	if (n.size === 1) return `${[...n][0]}.${t}`;
 	let r = [...n].filter((e) => !e.includes("#"));
 	if (r.length === 1) return `${r[0]}.${t}`;
 	throw Error(`[voltro] ${e} is installed more than once (${[...n].sort().join(", ")}) and no single install is the primary one, so a plugin hook cannot tell which of them it addresses. Call the route by its full tag instead — e.g. useSubscription(api, '${[...n].sort()[0]}.${t}').`);
-}, B = p.Union(p.Struct({
-	kind: p.Literal("dropped"),
-	at: p.Number,
-	retryAfterMs: p.Number
-}), p.Struct({
-	kind: p.Literal("skipped"),
-	at: p.Number,
-	executionId: p.String,
-	runId: p.String
-}), p.Struct({
-	kind: p.Literal("superseded"),
-	at: p.Number
-}), p.Struct({
-	kind: p.Literal("cancelled"),
-	at: p.Number
-}), p.Struct({
-	kind: p.Literal("abandoned"),
-	at: p.Number,
-	failureId: p.NonEmptyString
-})), V = p.Literal("running", "succeeded", "failed", "cancelled", "suspended"), H = p.Struct({
-	id: p.String,
-	workflowName: p.String,
-	executionId: p.String,
-	status: p.Union(V, p.Literal("unknown")),
-	output: p.optional(p.Unknown),
-	error: p.optional(p.Struct({
-		tag: p.NullOr(p.String),
-		message: p.String
+}, W = h.Union(h.Struct({
+	kind: h.Literal("dropped"),
+	at: h.Number,
+	retryAfterMs: h.Number
+}), h.Struct({
+	kind: h.Literal("skipped"),
+	at: h.Number,
+	executionId: h.String,
+	runId: h.String
+}), h.Struct({
+	kind: h.Literal("superseded"),
+	at: h.Number
+}), h.Struct({
+	kind: h.Literal("cancelled"),
+	at: h.Number
+}), h.Struct({
+	kind: h.Literal("abandoned"),
+	at: h.Number,
+	failureId: h.NonEmptyString
+})), G = h.Literal("running", "succeeded", "failed", "cancelled", "suspended"), K = h.Struct({
+	id: h.String,
+	workflowName: h.String,
+	executionId: h.String,
+	status: h.Union(G, h.Literal("unknown")),
+	output: h.optional(h.Unknown),
+	error: h.optional(h.Struct({
+		tag: h.NullOr(h.String),
+		message: h.String
 	}))
-}), U = p.Struct({
-	operation: p.Literal("cancel", "resume"),
-	kind: p.Literal("accepted", "confirmed", "unknown", "already-terminal"),
-	requestId: p.NullOr(p.NonEmptyString),
-	snapshot: H
-}).pipe(p.filter((e) => e.kind === "unknown" ? !0 : e.kind === "accepted" ? e.requestId !== null && (e.snapshot.status === "running" || e.snapshot.status === "suspended") : e.kind === "already-terminal" ? e.snapshot.status === "succeeded" || e.snapshot.status === "failed" || e.snapshot.status === "cancelled" : e.operation === "cancel" ? e.snapshot.status === "cancelled" : e.requestId !== null && e.snapshot.status === "running", { message: () => "Workflow control acknowledgement contradicts its observed state or receipt identity" })), W = p.Struct({
-	operation: p.Literal("cancel"),
-	workflowName: p.NonEmptyString,
-	receiptId: p.NonEmptyString,
-	requestId: p.NullOr(p.NonEmptyString),
-	kind: p.Literal("accepted", "confirmed", "unknown", "already-terminal"),
-	observation: p.Union(p.Struct({ kind: p.Literal("pending") }), p.Struct({
-		kind: p.Literal("admission"),
-		outcome: p.Union(B, p.Struct({
-			kind: p.Literal("rejected"),
-			failureId: p.NonEmptyString
+}), q = h.Struct({
+	operation: h.Literal("cancel", "resume"),
+	kind: h.Literal("accepted", "confirmed", "unknown", "already-terminal"),
+	requestId: h.NullOr(h.NonEmptyString),
+	snapshot: K
+}).pipe(h.filter((e) => e.kind === "unknown" ? !0 : e.kind === "accepted" ? e.requestId !== null && (e.snapshot.status === "running" || e.snapshot.status === "suspended") : e.kind === "already-terminal" ? e.snapshot.status === "succeeded" || e.snapshot.status === "failed" || e.snapshot.status === "cancelled" : e.operation === "cancel" ? e.snapshot.status === "cancelled" : e.requestId !== null && e.snapshot.status === "running", { message: () => "Workflow control acknowledgement contradicts its observed state or receipt identity" })), wr = h.Struct({
+	operation: h.Literal("cancel"),
+	workflowName: h.NonEmptyString,
+	receiptId: h.NonEmptyString,
+	requestId: h.NullOr(h.NonEmptyString),
+	kind: h.Literal("accepted", "confirmed", "unknown", "already-terminal"),
+	observation: h.Union(h.Struct({ kind: h.Literal("pending") }), h.Struct({
+		kind: h.Literal("admission"),
+		outcome: h.Union(W, h.Struct({
+			kind: h.Literal("rejected"),
+			failureId: h.NonEmptyString
 		}))
-	}), p.Struct({
-		kind: p.Literal("execution"),
-		snapshot: H
-	}), p.Struct({
-		kind: p.Literal("unavailable"),
-		reason: p.Literal("missing-request", "missing-run", "unconfirmed-generation", "unbound-submission")
+	}), h.Struct({
+		kind: h.Literal("execution"),
+		snapshot: K
+	}), h.Struct({
+		kind: h.Literal("unavailable"),
+		reason: h.Literal("missing-request", "missing-run", "unconfirmed-generation", "unbound-submission")
 	}))
-}).pipe(p.filter((e) => {
+}).pipe(h.filter((e) => {
 	let t = e.observation;
 	if (t.kind === "unavailable") return e.kind === "unknown" && (t.reason === "missing-request" ? e.requestId === null : e.requestId !== null);
 	if (e.requestId === null) return !1;
@@ -744,307 +822,342 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 	if (t.kind === "admission") return e.kind === (t.outcome.kind === "cancelled" ? "confirmed" : "already-terminal");
 	let n = t.snapshot;
 	return n.workflowName !== e.workflowName || n.id.length === 0 || n.executionId.length === 0 ? !1 : e.kind === "accepted" ? n.status === "running" || n.status === "suspended" : e.kind === "confirmed" ? n.status === "cancelled" : e.kind === "already-terminal" && (n.status === "succeeded" || n.status === "failed" || n.status === "cancelled");
-}, { message: () => "Queued cancellation acknowledgement contradicts its receipt or observation" })), Qn = p.Literal("cancel", "terminate", "abandon"), $n = p.Struct({
-	mode: p.String,
-	dueAt: p.NullOr(p.Number),
-	retryAfterMs: p.NullOr(p.Number),
-	intentId: p.NullOr(p.String)
-}), er = p.Struct({
-	id: p.String,
-	workflowName: p.String,
-	executionId: p.NullOr(p.String),
-	status: p.Literal("running", "succeeded", "queued", "dropped", "skipped", "replayed"),
-	deferral: p.optional($n)
-}), tr = (e, t) => {
-	let n = I(e);
-	return m.make(e.name, {
-		payload: x(e.payloadSchema, e.name, N(n.guards)),
-		success: er,
-		error: cn({
+}, { message: () => "Queued cancellation acknowledgement contradicts its receipt or observation" })), Tr = h.Literal("cancel", "terminate", "abandon"), Er = h.Struct({
+	mode: h.String,
+	dueAt: h.NullOr(h.Number),
+	retryAfterMs: h.NullOr(h.Number),
+	intentId: h.NullOr(h.String)
+}), Dr = h.Struct({
+	id: h.String,
+	workflowName: h.String,
+	executionId: h.NullOr(h.String),
+	status: h.Literal("running", "succeeded", "queued", "dropped", "skipped", "replayed"),
+	deferral: h.optional(Er)
+}), Or = (e, t) => {
+	let n = B(e);
+	return g.make(e.name, {
+		payload: x(e.payloadSchema, e.name, I(n.guards)),
+		success: Dr,
+		error: jn({
 			errorSchema: e.errorSchema,
 			guards: n.guards
 		}, t)
 	});
-}, G = p.Struct({
-	id: p.String,
-	tag: p.String,
-	executionId: p.String,
-	status: V,
-	payload: p.Unknown,
-	workflowVersion: p.NullOr(p.String),
-	workflowPatches: p.NullOr(p.Unknown),
-	output: p.NullOr(p.Unknown),
-	subject: p.NullOr(p.Unknown),
-	source: p.NullOr(p.String),
-	errorTag: p.NullOr(p.String),
-	errorMessage: p.NullOr(p.String),
-	cancelled: p.Boolean,
-	startedAt: p.Date,
-	completedAt: p.NullOr(p.Date),
-	durationMs: p.NullOr(p.Number),
-	traceId: p.NullOr(p.String),
-	parentExecutionId: p.NullOr(p.String),
-	parentClosePolicy: p.NullOr(Qn)
-}), nr = p.Struct({
-	tag: p.optional(p.String),
-	status: p.optional(V),
-	limit: p.optional(p.Number)
-}), rr = p.Struct({
-	id: p.String,
-	runId: p.String,
-	stepName: p.String,
-	attempt: p.Number,
-	status: p.Literal("running", "succeeded", "failed"),
-	input: p.NullOr(p.Unknown),
-	retryPolicy: p.NullOr(p.Unknown),
-	output: p.NullOr(p.Unknown),
-	errorTag: p.NullOr(p.String),
-	errorMessage: p.NullOr(p.String),
-	errorCause: p.NullOr(p.Unknown),
-	startedAt: p.Date,
-	completedAt: p.NullOr(p.Date),
-	durationMs: p.NullOr(p.Number)
-}), ir = p.Struct({
-	id: p.String,
-	runId: p.String,
-	eventType: p.String,
-	payload: p.NullOr(p.Unknown),
-	occurredAt: p.Date,
-	stepName: p.NullOr(p.String),
-	attempt: p.NullOr(p.Number)
-}), ar = p.Struct({
-	id: p.String,
-	name: p.String,
-	payload: p.Unknown,
-	source: p.String,
-	subject: p.NullOr(p.Unknown),
-	traceId: p.NullOr(p.String),
-	occurredAt: p.Date
-}), or = p.Struct({
-	id: p.String,
-	eventId: p.String,
-	eventName: p.String,
-	triggerId: p.String,
-	workflowName: p.String,
-	executionId: p.NullOr(p.String),
-	status: p.Literal("starting", "started", "skipped", "failed"),
-	idempotencyKey: p.String,
-	skipped: p.Boolean,
-	errorMessage: p.NullOr(p.String),
-	createdAt: p.Date,
-	completedAt: p.NullOr(p.Date)
-}), sr = p.Struct({ id: p.String }), K = p.Struct({ runId: p.String }), cr = p.Struct({
-	name: p.optional(p.String),
-	limit: p.optional(p.Number)
-}), lr = p.Struct({ eventId: p.String }), q = p.Struct({
-	requestId: p.NonEmptyString,
-	cause: p.optionalWith(p.Struct({
-		reason: p.NonEmptyString,
-		detail: p.optional(p.Record({
-			key: p.String,
-			value: p.Unknown
+}, kr = h.Struct({
+	id: h.String,
+	tag: h.String,
+	executionId: h.String,
+	status: G,
+	payload: h.Unknown,
+	workflowVersion: h.NullOr(h.String),
+	workflowPatches: h.NullOr(h.Unknown),
+	output: h.NullOr(h.Unknown),
+	subject: h.NullOr(h.Unknown),
+	source: h.NullOr(h.String),
+	errorTag: h.NullOr(h.String),
+	errorMessage: h.NullOr(h.String),
+	cancelled: h.Boolean,
+	startedAt: h.Date,
+	completedAt: h.NullOr(h.Date),
+	durationMs: h.NullOr(h.Number),
+	traceId: h.NullOr(h.String),
+	parentExecutionId: h.NullOr(h.String),
+	parentClosePolicy: h.NullOr(Tr)
+}), Ar = h.Struct({
+	tag: h.optional(h.String),
+	status: h.optional(G),
+	limit: h.optional(h.Number)
+}), jr = h.Struct({
+	id: h.String,
+	runId: h.String,
+	stepName: h.String,
+	attempt: h.Number,
+	status: h.Literal("running", "succeeded", "failed"),
+	input: h.NullOr(h.Unknown),
+	retryPolicy: h.NullOr(h.Unknown),
+	output: h.NullOr(h.Unknown),
+	errorTag: h.NullOr(h.String),
+	errorMessage: h.NullOr(h.String),
+	errorCause: h.NullOr(h.Unknown),
+	startedAt: h.Date,
+	completedAt: h.NullOr(h.Date),
+	durationMs: h.NullOr(h.Number)
+}), Mr = h.Struct({
+	id: h.String,
+	runId: h.String,
+	eventType: h.String,
+	payload: h.NullOr(h.Unknown),
+	occurredAt: h.Date,
+	stepName: h.NullOr(h.String),
+	attempt: h.NullOr(h.Number)
+}), Nr = h.Struct({
+	id: h.String,
+	name: h.String,
+	payload: h.Unknown,
+	source: h.String,
+	subject: h.NullOr(h.Unknown),
+	traceId: h.NullOr(h.String),
+	occurredAt: h.Date
+}), Pr = h.Struct({
+	id: h.String,
+	eventId: h.String,
+	eventName: h.String,
+	triggerId: h.String,
+	workflowName: h.String,
+	executionId: h.NullOr(h.String),
+	status: h.Literal("starting", "started", "skipped", "failed"),
+	idempotencyKey: h.String,
+	skipped: h.Boolean,
+	errorMessage: h.NullOr(h.String),
+	createdAt: h.Date,
+	completedAt: h.NullOr(h.Date)
+}), Fr = h.Struct({ id: h.String }), Ir = h.Struct({ runId: h.String }), Lr = h.Struct({
+	name: h.optional(h.String),
+	limit: h.optional(h.Number)
+}), Rr = h.Struct({ eventId: h.String }), zr = h.Struct({
+	requestId: h.NonEmptyString,
+	cause: h.optionalWith(h.Struct({
+		reason: h.NonEmptyString,
+		detail: h.optional(h.Record({
+			key: h.String,
+			value: h.Unknown
 		}))
 	}), { exact: !0 })
-}), J = p.Struct({
-	workflowName: p.String,
-	executionId: p.String,
-	control: p.optional(q)
-}), ur = p.Struct({
-	workflowName: p.NonEmptyString,
-	executionId: p.NonEmptyString,
-	operation: p.Literal("cancel", "resume"),
-	requestId: p.NonEmptyString
-}), Y = p.Struct({
-	workflowName: p.NonEmptyString,
-	receiptId: p.NonEmptyString,
-	requestId: p.NonEmptyString
-}), dr = p.Struct({
-	...Y.fields,
-	cause: q.fields.cause
-}), fr = j({
+}), Br = h.Struct({
+	workflowName: h.String,
+	executionId: h.String,
+	control: h.optional(zr)
+}), Vr = h.Struct({
+	workflowName: h.NonEmptyString,
+	executionId: h.NonEmptyString,
+	operation: h.Literal("cancel", "resume"),
+	requestId: h.NonEmptyString
+}), Hr = h.Struct({
+	workflowName: h.NonEmptyString,
+	receiptId: h.NonEmptyString,
+	requestId: h.NonEmptyString
+}), Ur = h.Struct({
+	...Hr.fields,
+	cause: zr.fields.cause
+}), Wr = F({
 	name: "__voltro.workflow.queued.cancel",
-	input: dr,
-	output: W,
+	input: Ur,
+	output: wr,
 	openAccess: "authorization happens in the executor against the target run — the caller must be authenticated and belong to the run's tenant, and a missing run answers exactly like a foreign one"
-}), pr = k({
+}), Gr = N({
 	name: "__voltro.workflow.queued.control",
-	input: Y,
-	output: W,
+	input: Hr,
+	output: wr,
 	openAccess: "authorization happens in the executor against the target run — the caller must be authenticated and belong to the run's tenant, and a missing run answers exactly like a foreign one"
-}), mr = k({
+}), Kr = N({
 	name: "__voltro.workflow.control",
-	input: ur,
-	output: U,
+	input: Vr,
+	output: q,
 	openAccess: "authorization happens in the executor against the target run — the caller must be authenticated and belong to the run's tenant, and a missing run answers exactly like a foreign one"
-}), hr = p.Struct({
-	id: p.String,
-	signalName: p.String,
-	payload: p.optional(p.Unknown)
-}), gr = p.Struct({
-	id: p.String,
-	updateName: p.String,
-	payload: p.optional(p.Unknown),
-	timeoutMs: p.optional(p.Number)
-}), _r = p.Struct({
-	eventId: p.String,
-	updateId: p.String,
-	completedEventId: p.String,
-	result: p.Unknown
-}), vr = k({
+}), qr = h.Struct({
+	id: h.String,
+	signalName: h.String,
+	payload: h.optional(h.Unknown)
+}), Jr = h.Struct({
+	id: h.String,
+	updateName: h.String,
+	payload: h.optional(h.Unknown),
+	timeoutMs: h.optional(h.Number)
+}), Yr = h.Struct({
+	eventId: h.String,
+	updateId: h.String,
+	completedEventId: h.String,
+	result: h.Unknown
+}), Xr = N({
 	name: "__voltro.workflow.run",
 	source: "_voltro_workflow_runs",
-	input: sr,
-	output: p.Array(G),
+	input: Fr,
+	output: h.Array(kr),
 	openAccess: "the answer is scoped to the caller in the executor — a system or admin:full subject sees every row, an authenticated subject the rows of its own tenant, an anonymous caller none"
-}), yr = k({
+}), Zr = N({
 	name: "__voltro.workflow.runs",
 	source: "_voltro_workflow_runs",
-	input: nr,
-	output: p.Array(G),
+	input: Ar,
+	output: h.Array(kr),
 	openAccess: "the answer is scoped to the caller in the executor — a system or admin:full subject sees every row, an authenticated subject the rows of its own tenant, an anonymous caller none"
-}), br = k({
+}), Qr = N({
 	name: "__voltro.workflow.run.steps",
 	source: "_voltro_workflow_run_steps",
-	input: K,
-	output: p.Array(rr),
+	input: Ir,
+	output: h.Array(jr),
 	openAccess: "the answer is scoped to the caller in the executor — a system or admin:full subject sees every row, an authenticated subject the rows of its own tenant, an anonymous caller none"
-}), xr = k({
+}), $r = N({
 	name: "__voltro.workflow.run.events",
 	source: "_voltro_workflow_run_events",
-	input: K,
-	output: p.Array(ir),
+	input: Ir,
+	output: h.Array(Mr),
 	openAccess: "the answer is scoped to the caller in the executor — a system or admin:full subject sees every row, an authenticated subject the rows of its own tenant, an anonymous caller none"
-}), Sr = k({
+}), ei = N({
 	name: "__voltro.workflow.domainEvents",
 	source: "_voltro_workflow_events",
-	input: cr,
-	output: p.Array(ar),
+	input: Lr,
+	output: h.Array(Nr),
 	openAccess: "the answer is scoped to the caller in the executor — a system or admin:full subject sees every row, an authenticated subject the rows of its own tenant, an anonymous caller none"
-}), Cr = k({
+}), ti = N({
 	name: "__voltro.workflow.event.deliveries",
 	source: "_voltro_workflow_event_deliveries",
-	input: lr,
-	output: p.Array(or),
+	input: Rr,
+	output: h.Array(Pr),
 	openAccess: "the answer is scoped to the caller in the executor — a system or admin:full subject sees every row, an authenticated subject the rows of its own tenant, an anonymous caller none"
-}), wr = j({
+}), ni = F({
 	name: "__voltro.workflow.cancel",
-	input: J,
-	output: U,
+	input: Br,
+	output: q,
 	openAccess: "authorization happens in the executor against the target run — the caller must be authenticated and belong to the run's tenant, and a missing run answers exactly like a foreign one"
-}), Tr = j({
+}), ri = F({
 	name: "__voltro.workflow.resume",
-	input: J,
-	output: U,
+	input: Br,
+	output: q,
 	openAccess: "authorization happens in the executor against the target run — the caller must be authenticated and belong to the run's tenant, and a missing run answers exactly like a foreign one"
-}), Er = j({
+}), ii = F({
 	name: "__voltro.workflow.signal",
-	input: hr,
-	output: p.Struct({ eventId: p.String }),
+	input: qr,
+	output: h.Struct({ eventId: h.String }),
 	openAccess: "authorization happens in the executor against the target run — the caller must be authenticated and belong to the run's tenant, and a missing run answers exactly like a foreign one"
-}), Dr = j({
+}), ai = F({
 	name: "__voltro.workflow.update",
-	input: gr,
-	output: _r,
+	input: Jr,
+	output: Yr,
 	openAccess: "authorization happens in the executor against the target run — the caller must be authenticated and belong to the run's tenant, and a missing run answers exactly like a foreign one"
-}), Or = p.NonEmptyString.pipe(p.filter((e) => e.trim().length > 0, { message: () => "A workflow retry identity must not be blank" })), kr = p.Struct({
-	runId: Or,
-	requestId: Or
-}), Ar = p.Struct({
-	...kr.fields,
-	payloadOverride: p.optional(p.Unknown)
-}), X = {
-	requestId: p.NonEmptyString,
-	originalRunId: p.NonEmptyString,
-	originalExecutionId: p.NonEmptyString,
-	workflowName: p.NonEmptyString
-}, jr = p.Union(p.Struct({
-	...X,
-	kind: p.Literal("queued"),
-	nextAttemptAt: p.NullOr(p.Number)
-}), p.Struct({
-	...X,
-	kind: p.Literal("accepted"),
-	executionId: p.NonEmptyString
-}).pipe(p.filter((e) => e.executionId !== e.originalExecutionId, { message: () => "A retry cannot accept its original execution identity" })), p.Struct({
-	...X,
-	kind: p.Literal("unconfirmed"),
-	automaticRetryStopped: p.Boolean,
-	nextAttemptAt: p.NullOr(p.Number)
-}).pipe(p.filter((e) => !e.automaticRetryStopped || e.nextAttemptAt === null, { message: () => "Stopped automatic retries cannot have a next attempt" })), p.Struct({
-	...X,
-	kind: p.Literal("not-started"),
-	outcome: B
-}), p.Struct({
-	...X,
-	kind: p.Literal("rejected"),
-	failureId: p.NonEmptyString
-})), Mr = "__voltro.undo.log", Nr = "__voltro.undo.apply", Pr = "__voltro.undo.redo", Fr = p.Struct({
-	id: p.String,
-	tag: p.String,
-	label: p.NullOr(p.String),
-	undone: p.Boolean,
-	crossesAction: p.Boolean,
-	createdAt: p.String
-}), Ir = class extends p.TaggedError()("UndoNotFound", { invocationId: p.String }) {}, Lr = class extends p.TaggedError()("UndoForbidden", { invocationId: p.String }) {}, Rr = class extends p.TaggedError()("UndoConflict", {
-	invocationId: p.String,
-	reason: p.Literal("conflict", "action")
-}) {}, zr = p.Union(Ir, Lr, Rr), Br = k({
-	name: Mr,
+}), oi = h.NonEmptyString.pipe(h.filter((e) => e.trim().length > 0, { message: () => "A workflow retry identity must not be blank" })), si = h.Struct({
+	runId: oi,
+	requestId: oi
+}), ci = h.Struct({
+	...si.fields,
+	payloadOverride: h.optional(h.Unknown)
+}), J = {
+	requestId: h.NonEmptyString,
+	originalRunId: h.NonEmptyString,
+	originalExecutionId: h.NonEmptyString,
+	workflowName: h.NonEmptyString
+}, li = h.Union(h.Struct({
+	...J,
+	kind: h.Literal("queued"),
+	nextAttemptAt: h.NullOr(h.Number)
+}), h.Struct({
+	...J,
+	kind: h.Literal("accepted"),
+	executionId: h.NonEmptyString
+}).pipe(h.filter((e) => e.executionId !== e.originalExecutionId, { message: () => "A retry cannot accept its original execution identity" })), h.Struct({
+	...J,
+	kind: h.Literal("unconfirmed"),
+	automaticRetryStopped: h.Boolean,
+	nextAttemptAt: h.NullOr(h.Number)
+}).pipe(h.filter((e) => !e.automaticRetryStopped || e.nextAttemptAt === null, { message: () => "Stopped automatic retries cannot have a next attempt" })), h.Struct({
+	...J,
+	kind: h.Literal("not-started"),
+	outcome: W
+}), h.Struct({
+	...J,
+	kind: h.Literal("rejected"),
+	failureId: h.NonEmptyString
+})), Y = h.NonEmptyString.pipe(h.filter((e) => e.trim().length > 0, { message: () => "A workflow restart identity must not be blank" })), ui = h.Union(h.Struct({ kind: h.Literal("failed-steps") }), h.Struct({
+	kind: h.Literal("from-step"),
+	stepName: Y
+})), X = h.Struct({
+	requestId: Y.pipe(h.maxLength(64)),
+	runId: Y
+}), di = h.Struct({
+	...X.fields,
+	selection: ui
+}), fi = {
+	...di.fields,
+	workflowName: Y,
+	executionId: Y,
+	originalGeneration: Y,
+	requestedAt: h.Number.pipe(h.finite()),
+	dispatchAttempts: h.NonNegativeInt
+}, pi = h.Union(h.Struct({
+	...X.fields,
+	kind: h.Literal("not-found")
+}), h.Struct({
+	...di.fields,
+	kind: h.Literal("withdrawn"),
+	workflowName: Y,
+	withdrawnAt: h.Number.pipe(h.finite())
+}), h.Struct({
+	...fi,
+	kind: h.Literal("pending")
+}), h.Struct({
+	...fi,
+	kind: h.Literal("entered"),
+	enteredGeneration: Y
+}).pipe(h.filter((e) => e.enteredGeneration !== e.originalGeneration && e.dispatchAttempts > 0, { message: () => "Restart entry requires a dispatched command and a new generation" }))), mi = h.Union(pi, h.Struct({
+	...X.fields,
+	kind: h.Literal("not-reserved"),
+	reason: h.Literal("admission", "journal")
+})), hi = "__voltro.undo.log", gi = "__voltro.undo.apply", _i = "__voltro.undo.redo", vi = h.Struct({
+	id: h.String,
+	tag: h.String,
+	label: h.NullOr(h.String),
+	undone: h.Boolean,
+	crossesAction: h.Boolean,
+	createdAt: h.String
+}), yi = class extends h.TaggedError()("UndoNotFound", { invocationId: h.String }) {}, bi = class extends h.TaggedError()("UndoForbidden", { invocationId: h.String }) {}, xi = class extends h.TaggedError()("UndoConflict", {
+	invocationId: h.String,
+	reason: h.Literal("conflict", "action")
+}) {}, Si = h.Union(yi, bi, xi), Ci = N({
+	name: hi,
 	source: "_voltro_undo_log",
-	input: p.Struct({ limit: p.optional(p.Number) }),
-	output: p.Array(Fr),
+	input: h.Struct({ limit: h.optional(h.Number) }),
+	output: h.Array(vi),
 	openAccess: "subject-scoped by construction: lists only the calling subject's own undoable actions"
-}), Vr = A({
-	name: Nr,
-	input: p.Struct({ invocationId: p.String }),
-	output: p.Struct({ ok: p.Boolean }),
-	error: zr,
+}), wi = P({
+	name: gi,
+	input: h.Struct({ invocationId: h.String }),
+	output: h.Struct({ ok: h.Boolean }),
+	error: Si,
 	openAccess: "subject-scoped by construction: undo is per-actor — another subject's invocation fails typed with UndoForbidden"
-}), Hr = A({
-	name: Pr,
-	input: p.Struct({ invocationId: p.String }),
-	output: p.Struct({ ok: p.Boolean }),
-	error: zr,
+}), Ti = P({
+	name: _i,
+	input: h.Struct({ invocationId: h.String }),
+	output: h.Struct({ ok: h.Boolean }),
+	error: Si,
 	openAccess: "subject-scoped by construction: redo is per-actor — another subject's invocation fails typed with UndoForbidden"
-}), Ur = class extends p.TaggedError()("TenantScopeViolation", {
-	table: p.String,
-	reason: p.String
-}) {}, Wr = class extends p.TaggedError()("StoreOperationFailed", {
-	operation: p.String,
-	table: p.String,
-	cause: p.String
+}), Ei = class extends h.TaggedError()("TenantScopeViolation", {
+	table: h.String,
+	reason: h.String
+}) {}, Di = class extends h.TaggedError()("StoreOperationFailed", {
+	operation: h.String,
+	table: h.String,
+	cause: h.String
 }) {
 	get message() {
 		return `${this.operation} on '${this.table}' failed: ${this.cause}`;
 	}
-}, Gr = class extends p.TaggedError()("NoRowFound", {
-	table: p.String,
-	found: p.Number
+}, Oi = class extends h.TaggedError()("NoRowFound", {
+	table: h.String,
+	found: h.Number
 }) {
 	get message() {
 		return this.found === 0 ? `expected exactly one row in '${this.table}', found none` : `expected exactly one row in '${this.table}', found more than one`;
 	}
-}, Kr = class extends p.TaggedError()("TableValidationFailed", {
-	table: p.String,
-	summary: p.String,
-	issues: p.Array(p.Struct({
-		path: p.String,
-		message: p.String
+}, ki = class extends h.TaggedError()("TableValidationFailed", {
+	table: h.String,
+	summary: h.String,
+	issues: h.Array(h.Struct({
+		path: h.String,
+		message: h.String
 	}))
-}) {}, qr = class extends p.TaggedError()("TenantRowNotFound", {
-	table: p.String,
-	id: p.String,
-	reason: p.String
-}) {}, Jr = class extends p.TaggedError()("ServerOnlyColumnWrite", {
-	table: p.String,
-	columns: p.Array(p.String)
-}) {}, Yr = class extends p.TaggedError()("ConstraintViolation", {
-	kind: p.Literal("foreignKey", "foreignKeyInUse", "unique", "notNull", "check"),
-	table: p.String,
-	operation: p.String,
-	constraint: p.optional(p.String),
-	column: p.optional(p.String),
-	detail: p.optional(p.String)
+}) {}, Ai = class extends h.TaggedError()("TenantRowNotFound", {
+	table: h.String,
+	id: h.String,
+	reason: h.String
+}) {}, ji = class extends h.TaggedError()("ServerOnlyColumnWrite", {
+	table: h.String,
+	columns: h.Array(h.String)
+}) {}, Mi = class extends h.TaggedError()("ConstraintViolation", {
+	kind: h.Literal("foreignKey", "foreignKeyInUse", "unique", "notNull", "check"),
+	table: h.String,
+	operation: h.String,
+	constraint: h.optional(h.String),
+	column: h.optional(h.String),
+	detail: h.optional(h.String)
 }) {
 	get message() {
 		if (this.detail !== void 0) return this.detail;
@@ -1057,86 +1170,243 @@ var gt = p.Union(p.String, p.Number), h = p.Record({
 			case "check": return `check constraint ${t}: the row does not satisfy it`;
 		}
 	}
-}, Xr = "__voltro.approvals.pending", Zr = "__voltro.approvals.decide", Qr = k({
-	name: Xr,
+}, Ni = "__voltro.approvals.pending", Pi = "__voltro.approvals.decide", Fi = N({
+	name: Ni,
 	source: "_voltro_approvals",
-	input: p.Struct({ limit: p.optional(p.Number) }),
-	output: p.Array(zt),
+	input: h.Struct({ limit: h.optional(h.Number) }),
+	output: h.Array(en),
 	openAccess: "the answer is scoped to the caller — a row appears only if they requested it or hold its recorded approver scopes, so an anonymous caller sees nothing"
-}), $r = A({
-	name: Zr,
-	input: p.Struct({
-		approvalId: p.String,
-		decision: p.Literal("approve", "reject"),
-		note: p.optional(p.String)
+}), Ii = P({
+	name: Pi,
+	input: h.Struct({
+		approvalId: h.String,
+		decision: h.Literal("approve", "reject"),
+		note: h.optional(h.String)
 	}),
-	output: p.Struct({
-		approvalId: p.String,
-		status: p.Literal("approved", "rejected")
+	output: h.Struct({
+		approvalId: h.String,
+		status: h.Literal("approved", "rejected")
 	}),
-	error: Rt,
+	error: $t,
 	openAccess: "the approver authority is the PENDING ROW's own recorded scopes (plus an unconditional self-approval refusal), checked in-handler — a descriptor-level scope would have to be the union of every approval-requiring procedure in the app"
-}), Z = "__voltro.connections.list", ei = "__voltro.connections.start", ti = "__voltro.connections.submitToken", ni = "__voltro.connections.disconnect", Q = p.Literal("oauth2", "pat"), ri = p.Literal("disconnected", "connected", "expired", "revoked", "error"), ii = p.Struct({
-	connectionId: p.String,
-	kind: Q,
-	label: p.String,
-	status: ri,
-	accountId: p.NullOr(p.String),
-	accountLabel: p.NullOr(p.String),
-	scopes: p.Array(p.String),
-	expiresAt: p.NullOr(p.String),
-	lastError: p.NullOr(p.String),
-	connectedAt: p.NullOr(p.String)
-}), ai = class extends p.TaggedError()("ConnectionNotDeclared", { connectionId: p.String }) {}, oi = class extends p.TaggedError()("ConnectionSubjectRequired", { connectionId: p.String }) {}, si = class extends p.TaggedError()("ConnectionKindMismatch", {
-	connectionId: p.String,
-	expected: Q,
-	actual: Q
-}) {}, ci = class extends p.TaggedError()("ConnectionHandshakeFailed", {
-	connectionId: p.String,
-	reason: p.String,
-	transient: p.Boolean
-}) {}, $ = p.Union(ai, oi, si, ci), li = k({
-	name: Z,
+}), Li = "__voltro.connections.list", Ri = "__voltro.connections.start", zi = "__voltro.connections.submitToken", Bi = "__voltro.connections.disconnect", Z = h.Literal("oauth2", "pat"), Vi = h.Literal("disconnected", "connected", "expired", "revoked", "error"), Hi = h.Struct({
+	connectionId: h.String,
+	kind: Z,
+	label: h.String,
+	status: Vi,
+	accountId: h.NullOr(h.String),
+	accountLabel: h.NullOr(h.String),
+	scopes: h.Array(h.String),
+	expiresAt: h.NullOr(h.String),
+	lastError: h.NullOr(h.String),
+	connectedAt: h.NullOr(h.String)
+}), Ui = class extends h.TaggedError()("ConnectionNotDeclared", { connectionId: h.String }) {}, Wi = class extends h.TaggedError()("ConnectionSubjectRequired", { connectionId: h.String }) {}, Gi = class extends h.TaggedError()("ConnectionKindMismatch", {
+	connectionId: h.String,
+	expected: Z,
+	actual: Z
+}) {}, Ki = class extends h.TaggedError()("ConnectionHandshakeFailed", {
+	connectionId: h.String,
+	reason: h.String,
+	transient: h.Boolean
+}) {}, qi = h.Union(Ui, Wi, Gi, Ki), Ji = N({
+	name: Li,
 	source: "_voltro_connections",
-	input: p.Struct({}),
-	output: p.Array(ii),
+	input: h.Struct({}),
+	output: h.Array(Hi),
 	openAccess: "self-scoped read: projects the declared connections for the calling subject only (its own connect/disconnect state)"
-}), ui = j({
-	name: ei,
-	input: p.Struct({
-		connectionId: p.String,
-		redirectTo: p.optional(p.String)
+}), Yi = F({
+	name: Ri,
+	input: h.Struct({
+		connectionId: h.String,
+		redirectTo: h.optional(h.String)
 	}),
-	output: p.Struct({
-		authorizeUrl: p.String,
-		state: p.String
+	output: h.Struct({
+		authorizeUrl: h.String,
+		state: h.String
 	}),
-	error: $,
+	error: qi,
 	openAccess: "self-service: begins an oauth handshake that stores a credential for the calling subject only; anonymous callers fail typed with ConnectionSubjectRequired"
-}), di = A({
-	name: ti,
-	input: p.Struct({
-		connectionId: p.String,
-		token: p.String
+}), Xi = P({
+	name: zi,
+	input: h.Struct({
+		connectionId: h.String,
+		token: h.String
 	}),
-	output: p.Struct({ ok: p.Boolean }),
-	error: $,
+	output: h.Struct({ ok: h.Boolean }),
+	error: qi,
 	openAccess: "self-service: stores a pasted token as the calling subject's own credential; anonymous callers fail typed with ConnectionSubjectRequired"
-}), fi = A({
-	name: ni,
-	input: p.Struct({ connectionId: p.String }),
-	output: p.Struct({ ok: p.Boolean }),
-	error: $,
+}), Zi = P({
+	name: Bi,
+	input: h.Struct({ connectionId: h.String }),
+	output: h.Struct({ ok: h.Boolean }),
+	error: qi,
 	openAccess: "self-service: deletes only the calling subject's own credential row for this connection"
-}), pi = (e) => {
+}), Qi = (e) => {
 	let t = e instanceof Date ? e.getTime() : typeof e == "number" ? e : typeof e == "string" ? new Date(e).getTime() : 0;
 	return Number.isNaN(t) ? 0 : t;
-}, mi = 4001, hi = /* @__PURE__ */ new Set(["/rpc", "/ws"]), gi = (e) => {
+}, $i = [
+	"app-store",
+	"play",
+	"mac-app-store",
+	"microsoft-store"
+], Q = [
+	{
+		name: "iphone-6.7",
+		label: "iPhone 6.7″ — 1290×2796",
+		kind: "phone",
+		viewport: {
+			width: 430,
+			height: 932
+		},
+		deviceScaleFactor: 3,
+		stores: ["app-store"]
+	},
+	{
+		name: "iphone-6.5",
+		label: "iPhone 6.5″ — 1242×2688",
+		kind: "phone",
+		viewport: {
+			width: 414,
+			height: 896
+		},
+		deviceScaleFactor: 3,
+		stores: ["app-store"]
+	},
+	{
+		name: "ipad-12.9",
+		label: "iPad 12.9″ — 2048×2732",
+		kind: "tablet",
+		viewport: {
+			width: 1024,
+			height: 1366
+		},
+		deviceScaleFactor: 2,
+		stores: ["app-store"]
+	},
+	{
+		name: "android-phone",
+		label: "Android phone — 1080×2160",
+		kind: "phone",
+		viewport: {
+			width: 360,
+			height: 720
+		},
+		deviceScaleFactor: 3,
+		stores: ["play"]
+	},
+	{
+		name: "android-tablet-10",
+		label: "Android 10″ tablet — 1600×2560",
+		kind: "tablet",
+		viewport: {
+			width: 800,
+			height: 1280
+		},
+		deviceScaleFactor: 2,
+		stores: ["play"]
+	},
+	{
+		name: "mac",
+		label: "Mac — 2880×1800",
+		kind: "desktop",
+		viewport: {
+			width: 1440,
+			height: 900
+		},
+		deviceScaleFactor: 2,
+		stores: ["mac-app-store"]
+	},
+	{
+		name: "windows",
+		label: "Windows — 1366×768",
+		kind: "desktop",
+		viewport: {
+			width: 1366,
+			height: 768
+		},
+		deviceScaleFactor: 1,
+		stores: ["microsoft-store"]
+	}
+], ea = Q.map((e) => e.name), ta = (e) => Q.find((t) => t.name === e), na = (e) => ({
+	width: e.viewport.width * e.deviceScaleFactor,
+	height: e.viewport.height * e.deviceScaleFactor
+}), ra = (e) => Q.filter((t) => t.stores.includes(e)), ia = 4001, aa = /* @__PURE__ */ new Set(["/rpc", "/ws"]), oa = (e) => {
 	for (let [t, n] of Object.entries(e.limits ?? {})) if (n !== void 0 && (!Number.isSafeInteger(n) || n <= 0)) throw Error(`defineWebSocket: limits.${t} must be a positive safe integer`);
 	if (!e.path.startsWith("/")) throw Error(`defineWebSocket: path must be absolute, got '${e.path}'`);
-	if (hi.has(e.path)) throw Error(`defineWebSocket: '${e.path}' is the framework's own socket surface — mount the gateway elsewhere`);
+	if (aa.has(e.path)) throw Error(`defineWebSocket: '${e.path}' is the framework's own socket surface — mount the gateway elsewhere`);
 	if (e.auth !== "subject" && e.auth !== "public") throw Error(`defineWebSocket: auth must be 'subject' or 'public' (explicitly — an unauthenticated socket has to be a decision somebody wrote down), got '${String(e.auth)}'`);
 	return e;
-}, _i = 1;
+}, sa = "voltro-dev", ca = "pair", $ = "voltro:pairing", la = (e) => {
+	try {
+		let t = new URL(e);
+		return t.protocol === "http:" || t.protocol === "https:";
+	} catch {
+		return !1;
+	}
+}, ua = (e) => {
+	try {
+		let t = new URL(e).hostname;
+		return t === "localhost" || t === "127.0.0.1" || t === "::1" || t === "[::1]";
+	} catch {
+		return !1;
+	}
+}, da = (e) => {
+	if (!la(e.api)) throw Error(`pairingLink: api must be an http(s) url, got ${JSON.stringify(e.api)}`);
+	if (ua(e.api)) throw Error("pairingLink: api must be the LAN address — a device cannot reach localhost on this machine");
+	if (!/^[A-Za-z0-9_-]+$/.test(e.name)) throw Error(`pairingLink: name must be a plain identifier, got ${JSON.stringify(e.name)}`);
+	let t = new URLSearchParams({
+		api: e.api,
+		name: e.name
+	});
+	return e.token !== void 0 && e.token.length > 0 && t.set("token", e.token), `${sa}://${ca}?${t.toString()}`;
+}, fa = (e) => {
+	let t;
+	try {
+		t = new URL(e);
+	} catch {
+		return null;
+	}
+	if (t.protocol !== "voltro-dev:" || (t.host || t.pathname.replace(/^\/+/, "")) !== "pair") return null;
+	let n = t.searchParams.get("api") ?? "", r = t.searchParams.get("name") ?? "", i = t.searchParams.get("token");
+	return !la(n) || ua(n) || !/^[A-Za-z0-9_-]+$/.test(r) ? null : {
+		api: n,
+		name: r,
+		...i !== null && i.length > 0 ? { token: i } : {}
+	};
+}, pa = (e) => "getItem" in e ? {
+	get: async (t) => e.getItem(t),
+	set: async (t, n) => {
+		await e.setItem(t, n);
+	},
+	remove: e.removeItem ? async (t) => {
+		await e.removeItem(t);
+	} : null
+} : {
+	get: async (t) => e.get(t),
+	set: async (t, n) => {
+		await e.set(t, n);
+	},
+	remove: e.remove ? async (t) => {
+		await e.remove(t);
+	} : null
+}, ma = async (e, t) => {
+	await pa(e).set($, JSON.stringify(t));
+}, ha = async (e) => {
+	let t = await pa(e).get($);
+	if (t === null || t === "") return null;
+	try {
+		let e = JSON.parse(t);
+		return typeof e.api != "string" || typeof e.name != "string" || !la(e.api) ? null : {
+			api: e.api,
+			name: e.name,
+			...typeof e.token == "string" && e.token.length > 0 ? { token: e.token } : {}
+		};
+	} catch {
+		return null;
+	}
+}, ga = async (e) => {
+	let t = pa(e);
+	t.remove ? await t.remove($) : await t.set($, "");
+}, _a = 1;
 //#endregion
-export { Ne as ADMIN_SCOPE, Oe as APIKEY_ISSUE_ORG_SCOPE, je as APIKEY_ISSUE_OTHER_SCOPE, Ce as APIKEY_ISSUE_SELF_SCOPE, Zr as APPROVALS_DECIDE_TAG, Xr as APPROVALS_PENDING_TAG, Rt as ApprovalDecisionErrors, Lt as ApprovalErrors, S as ApprovalExpired, It as ApprovalForbidden, Mt as ApprovalNotFound, Ft as ApprovalNotPending, Pt as ApprovalRejected, jt as ApprovalRequired, Nt as ApprovalSelfApproval, C as ApprovalUnavailable, i as AuthMiddleware, Et as BusinessRuleViolation, Z as CONNECTIONS_LIST_TAG, ni as CONNECTION_DISCONNECT_TAG, ei as CONNECTION_START_TAG, ti as CONNECTION_SUBMIT_TOKEN_TAG, ci as ConnectionHandshakeFailed, ae as ConnectionInfo, Te as ConnectionInfoMiddleware, Q as ConnectionKind, si as ConnectionKindMismatch, ai as ConnectionNotDeclared, ii as ConnectionState, ri as ConnectionStatus, oi as ConnectionSubjectRequired, Yr as ConstraintViolation, t as DEFAULT_SCOPE_CACHE_MAX_ENTRIES, we as DEFAULT_SCOPE_CACHE_TTL_MS, _e as DEVICES_MANAGE_SCOPE, jn as EVENT_ROUTE_SEP, On as EventKeyInvalid, Dn as EventPayloadInvalid, kn as EventPayloadTooLarge, mi as GATEWAY_CREDENTIAL_EXPIRED_CLOSE_CODE, re as IMPERSONATION_METADATA_KEY, st as JSONAPI_MEDIA_TYPE, _n as MAX_EVENT_ENVELOPE_BYTES, ft as MUTATION_IN_FLIGHT_RETRY_AFTER_MS, qe as MutationConnectionRequired, dt as MutationInFlight, Gr as NoRowFound, nt as PROBLEM_JSON, _i as PROTOCOL_VERSION, zt as PendingApproval, w as REACTIVITY_CHANNEL_PREFIX, at as REST_PROFILE_NAMES, f as ScopeError, Jr as ServerOnlyColumnWrite, Wr as StoreOperationFailed, ie as Subject, oe as SubjectIdentity, o as SubjectService, Kr as TableValidationFailed, qr as TenantRowNotFound, Ur as TenantScopeViolation, ge as TenantSelectionRefused, Nr as UNDO_APPLY_TAG, Mr as UNDO_LOG_TAG, Pr as UNDO_REDO_TAG, l as Unauthenticated, Rr as UndoConflict, Lr as UndoForbidden, Fr as UndoLogEntry, Ir as UndoNotFound, Ot as ValidationError, kt as ValidationErrors, Dt as ValidationIssue, F as WorkflowAccessProperty, J as WorkflowControlInputSchema, q as WorkflowControlIntentSchema, ur as WorkflowControlReadInputSchema, U as WorkflowControlResultSchema, ar as WorkflowDomainEventRowSchema, cr as WorkflowDomainEventsInputSchema, lr as WorkflowEventDeliveriesInputSchema, or as WorkflowEventDeliveryRowSchema, Qn as WorkflowParentClosePolicySchema, dr as WorkflowQueuedCancelInputSchema, W as WorkflowQueuedCancellationResultSchema, Y as WorkflowQueuedControlTargetSchema, Ar as WorkflowRetryCommandSchema, jr as WorkflowRetryObservationSchema, kr as WorkflowRetryTargetSchema, ir as WorkflowRunEventRowSchema, er as WorkflowRunHandleSchema, sr as WorkflowRunRefSchema, G as WorkflowRunRowSchema, H as WorkflowRunSnapshotSchema, V as WorkflowRunStatusSchema, rr as WorkflowRunStepRowSchema, K as WorkflowRunTableRefSchema, nr as WorkflowRunsInputSchema, hr as WorkflowSignalInputSchema, $n as WorkflowStartDeferralSchema, B as WorkflowStartTerminalOutcomeSchema, gr as WorkflowUpdateInputSchema, _r as WorkflowUpdateResultSchema, fn as actionToRpc, Me as advisoryResourceGuardWarning, ne as anonymousSubject, Ct as applyRowPatch, ce as applyScopeDecision, $r as approvalsDecideDescriptor, Qr as approvalsPendingQueryDescriptor, ze as assertAuthenticated, Ln as attachWorkflowAccess, Ue as beginIdempotent, Wn as checkFrameworkCompat, ve as checkGuards, Ee as checkGuardsEffect, tt as compareSurfaces, n as composeAuthStrategies, Hn as composeRpcInterceptors, fi as connectionDisconnectDescriptor, ui as connectionStartDescriptor, di as connectionSubmitTokenDescriptor, li as connectionsListQueryDescriptor, Kt as declaredReactivityChannelKeys, j as defineAction, yn as defineEvent, A as defineMutation, zn as definePlugin, Bn as definePluginRoute, Un as definePluginService, k as defineQuery, nn as defineStream, gi as defineWebSocket, xt as diffRows, Pe as effectiveScopes, An as encodeEventKey, $e as encodeRestError, Ke as encodeRestSuccess, mn as errorTag, Sn as eventAttached, bn as eventEnvelope, xn as eventGap, wn as eventResumePoint, Mn as eventRoute, Cn as eventStreamEvent, Tn as eventSubscribeInput, En as eventToRpc, Be as failIdempotent, At as fieldIssuesOf, ye as findAdvisoryResourceGuards, ut as finishIdempotent, wt as firstEventValue, Pn as formatEventRoute, be as getPolicyGuardResolver, ke as getResourceScopeResolver, I as getWorkflowAccess, Qe as groupShapeDigests, tn as hasAccessDecision, fe as hasCallbackRoutes, De as hasEffectiveScope, N as hasEnforcedGuard, Se as hasScope, g as idToPath, We as idempotencyScope, b as inputLabel, xe as isAuthenticatedCheck, en as isAuthenticatedGuard, vn as isEventDescriptor, St as isIdKeyed, u as isOpenAccess, Fe as isPolicyCheck, $t as isPolicyGuard, Wt as isReactivityChannel, Gt as isReactivityChannelKey, c as isSystemSubject, se as isTenantSelectable, Zt as isWireReachable, de as makeScopeCache, He as memoryIdempotencyStore, Re as missingAccessDecision, dn as mutationToRpc, rt as nextLink, gn as normalizeDescriptor, Jt as normalizeSource, d as openAccessSpec, pe as orderByBearerPrefix, Nn as parseEventRoute, yt as pathToId, Kn as pluginAlias, Vn as pluginInstanceName, qn as pluginSlug, Zn as pluginTag, ot as problemDetails, Je as problemTypeOf, Ze as procedureShapeDigest, Xt as publishReactivity, Xe as publishServerError, un as queryToRpc, s as rawImpersonationMark, Ut as reactivityChannel, Yn as registerPluginAliases, Le as requireScope, Xn as resetPluginAliases, le as resolvePolicyAction, et as resolveRestFormat, In as resolveWorkflowAccess, ct as restViewSchema, _t as rowPatchOpSchema, vt as rowPatchSchema, Ge as schemaShape, te as scopeCacheKey, e as selectSubjectTenant, r as setEffectiveScopes, Ie as setPolicyGuardResolver, ue as setResourceScopeResolver, lt as shapeDigest, qt as sourceKeys, pn as streamToRpc, x as strictInput, Ae as subjectAuditActorId, ee as subjectIdentity, a as subjectScopes, it as subscribeServerErrors, y as subscriptionEvent, he as systemSubject, me as tenantScopedSubject, hn as toRpc, Ye as toSnakeCase, pi as tsMs, Yt as undeclaredChannelKeys, Vr as undoApplyDescriptor, Br as undoLogQueryDescriptor, Hr as undoRedoDescriptor, P as wireErrorUnion, ln as withRpcTag, Rn as workflowAccessDescriptor, wr as workflowCancelDescriptor, mr as workflowControlQueryDescriptor, Sr as workflowDomainEventsQueryDescriptor, Cr as workflowEventDeliveriesQueryDescriptor, fr as workflowQueuedCancelDescriptor, pr as workflowQueuedControlQueryDescriptor, Tr as workflowResumeDescriptor, xr as workflowRunEventsQueryDescriptor, vr as workflowRunQueryDescriptor, br as workflowRunStepsQueryDescriptor, yr as workflowRunsQueryDescriptor, Er as workflowSignalDescriptor, tr as workflowToRpc, Dr as workflowUpdateDescriptor, cn as workflowWireErrorUnion, Ve as wsMutationIdempotencyScope };
+export { Be as ADMIN_SCOPE, Me as APIKEY_ISSUE_ORG_SCOPE, Le as APIKEY_ISSUE_OTHER_SCOPE, Ee as APIKEY_ISSUE_SELF_SCOPE, Pi as APPROVALS_DECIDE_TAG, Ni as APPROVALS_PENDING_TAG, lr as ApiUnavailable, $t as ApprovalDecisionErrors, Qt as ApprovalErrors, T as ApprovalExpired, Zt as ApprovalForbidden, qt as ApprovalNotFound, Xt as ApprovalNotPending, Yt as ApprovalRejected, Kt as ApprovalRequired, Jt as ApprovalSelfApproval, E as ApprovalUnavailable, ie as AuthMiddleware, S as BusinessRuleViolation, Li as CONNECTIONS_LIST_TAG, Bi as CONNECTION_DISCONNECT_TAG, Ri as CONNECTION_START_TAG, zi as CONNECTION_SUBMIT_TOKEN_TAG, Ki as ConnectionHandshakeFailed, ae as ConnectionInfo, se as ConnectionInfoMiddleware, Z as ConnectionKind, Gi as ConnectionKindMismatch, Ui as ConnectionNotDeclared, Hi as ConnectionState, Vi as ConnectionStatus, Wi as ConnectionSubjectRequired, Mi as ConstraintViolation, tt as DEFAULT_IN_FLIGHT_LEASE_MS, o as DEFAULT_SCOPE_CACHE_MAX_ENTRIES, ee as DEFAULT_SCOPE_CACHE_TTL_MS, ve as DEVICES_MANAGE_SCOPE, tr as EVENT_ROUTE_SEP, Qn as EventKeyInvalid, Zn as EventPayloadInvalid, $n as EventPayloadTooLarge, An as FRAMEWORK_WIRE_ERRORS, ia as GATEWAY_CREDENTIAL_EXPIRED_CLOSE_CODE, re as IMPERSONATION_METADATA_KEY, _t as JSONAPI_MEDIA_TYPE, Vn as MAX_EVENT_ENVELOPE_BYTES, xt as MUTATION_IN_FLIGHT_RETRY_AFTER_MS, Ze as MutationConnectionRequired, m as MutationInFlight, Oi as NoRowFound, d as NoSuchResource, ca as PAIRING_HOST, sa as PAIRING_SCHEME, $ as PAIRING_STORAGE_KEY, ft as PROBLEM_JSON, _a as PROTOCOL_VERSION, en as PendingApproval, D as REACTIVITY_CHANNEL_PREFIX, ht as REST_PROFILE_NAMES, gn as SERVICE_NAME_PATTERN, wt as SESSION_HEADER_NAME, Q as STORE_SCREENSHOT_PRESETS, ea as STORE_SCREENSHOT_PRESET_NAMES, $i as STORE_SCREENSHOT_STORES, f as ScopeError, ji as ServerOnlyColumnWrite, Di as StoreOperationFailed, le as Subject, Ke as SubjectIdentity, n as SubjectService, ki as TableValidationFailed, Ai as TenantRowNotFound, Ei as TenantScopeViolation, ye as TenantSelectionRefused, gi as UNDO_APPLY_TAG, hi as UNDO_LOG_TAG, _i as UNDO_REDO_TAG, l as Unauthenticated, xi as UndoConflict, bi as UndoForbidden, vi as UndoLogEntry, yi as UndoNotFound, C as ValidationError, w as ValidationErrors, Wt as ValidationIssue, z as WorkflowAccessProperty, Br as WorkflowControlInputSchema, zr as WorkflowControlIntentSchema, Vr as WorkflowControlReadInputSchema, q as WorkflowControlResultSchema, Nr as WorkflowDomainEventRowSchema, Lr as WorkflowDomainEventsInputSchema, Rr as WorkflowEventDeliveriesInputSchema, Pr as WorkflowEventDeliveryRowSchema, Tr as WorkflowParentClosePolicySchema, Ur as WorkflowQueuedCancelInputSchema, wr as WorkflowQueuedCancellationResultSchema, Hr as WorkflowQueuedControlTargetSchema, di as WorkflowRestartCommandSchema, pi as WorkflowRestartObservationSchema, mi as WorkflowRestartResultSchema, ui as WorkflowRestartSelectionSchema, X as WorkflowRestartTargetSchema, ci as WorkflowRetryCommandSchema, li as WorkflowRetryObservationSchema, si as WorkflowRetryTargetSchema, Mr as WorkflowRunEventRowSchema, Dr as WorkflowRunHandleSchema, Fr as WorkflowRunRefSchema, kr as WorkflowRunRowSchema, K as WorkflowRunSnapshotSchema, G as WorkflowRunStatusSchema, jr as WorkflowRunStepRowSchema, Ir as WorkflowRunTableRefSchema, Ar as WorkflowRunsInputSchema, qr as WorkflowSignalInputSchema, Er as WorkflowStartDeferralSchema, W as WorkflowStartTerminalOutcomeSchema, Jr as WorkflowUpdateInputSchema, Yr as WorkflowUpdateResultSchema, Fn as actionToRpc, xe as advisoryResourceGuardWarning, c as anonymousSubject, ma as applyPairing, zt as applyRowPatch, fe as applyScopeDecision, Ii as approvalsDecideDescriptor, Fi as approvalsPendingQueryDescriptor, pe as assertAuthenticated, sr as attachWorkflowAccess, bt as beginIdempotent, gr as checkFrameworkCompat, Ae as checkGuards, He as checkGuardsEffect, ga as clearPairing, ot as compareSurfaces, s as composeAuthStrategies, mr as composeRpcInterceptors, Zi as connectionDisconnectDescriptor, Yi as connectionStartDescriptor, Xi as connectionSubmitTokenDescriptor, Ji as connectionsListQueryDescriptor, cn as declaredReactivityChannelKeys, u as declaresResourceGuard, F as defineAction, Un as defineEvent, P as defineMutation, dr as definePlugin, fr as definePluginRoute, hr as definePluginService, N as defineQuery, Sn as defineStream, oa as defineWebSocket, Lt as diffRows, Ce as effectiveScopes, er as encodeEventKey, st as encodeRestError, et as encodeRestSuccess, Ln as errorMessage, R as errorTag, Kn as eventAttached, Wn as eventEnvelope, Gn as eventGap, Jn as eventResumePoint, nr as eventRoute, qn as eventStreamEvent, Yn as eventSubscribeInput, Xn as eventToRpc, Qe as failIdempotent, Gt as fieldIssuesOf, Fe as findAdvisoryResourceGuards, Ye as finishIdempotent, Vt as firstEventValue, ir as formatEventRoute, Je as freshFor, je as getPolicyGuardResolver, Te as getResourceScopeResolver, B as getWorkflowAccess, at as groupShapeDigests, xn as hasAccessDecision, ne as hasCallbackRoutes, we as hasEffectiveScope, I as hasEnforcedGuard, _e as hasScope, Xe as holdIdempotentClaim, v as idToPath, lt as idempotencyScope, Ht as inputLabel, ur as isApiUnavailable, Ue as isAuthenticatedCheck, bn as isAuthenticatedGuard, mn as isClientReachable, Hn as isEventDescriptor, Rt as isIdKeyed, Ie as isMachineSubject, p as isOpenAccess, be as isPolicyCheck, yn as isPolicyGuard, on as isReactivityChannel, sn as isReactivityChannelKey, Ge as isServiceAccess, hn as isServiceReachable, te as isServiceSubject, he as isSystemSubject, Pe as isTenantSelectable, A as isWireReachable, me as makeScopeCache, qe as memoryIdempotencyStore, ue as missingAccessDecision, Pn as mutationToRpc, pt as nextLink, Bn as normalizeDescriptor, un as normalizeSource, r as openAccessSpec, ge as orderByBearerPrefix, da as pairingLink, rr as parseEventRoute, fa as parsePairingLink, _ as patchCellSchema, y as pathToId, vr as pluginAlias, pr as pluginInstanceName, yr as pluginSlug, Cr as pluginTag, gt as problemDetails, nt as problemTypeOf, $e as procedureShapeDigest, fn as publishReactivity, it as publishServerError, Nn as queryToRpc, ce as rawImpersonationMark, an as reactivityChannel, ha as readPairing, xr as registerPluginAliases, Rn as reportableError, We as requireScope, Sr as resetPluginAliases, de as resolvePolicyAction, ut as resolveRestFormat, or as resolveWorkflowAccess, vt as restViewSchema, Nt as rowPatchOpSchema, Pt as rowPatchSchema, yt as schemaShape, e as scopeCacheKey, ze as selectSubjectTenant, a as serviceAccessSpec, i as serviceCallersOf, Se as serviceSubject, Ct as sessionValueFromHeaders, oe as setEffectiveScopes, ke as setPolicyGuardResolver, t as setResourceScopeResolver, St as shapeDigest, ln as sourceKeys, na as storeScreenshotPixels, ta as storeScreenshotPreset, ra as storeScreenshotPresetsFor, In as streamToRpc, x as strictInput, Ve as subjectAuditActorId, Ne as subjectIdentity, Oe as subjectScopes, mt as subscribeServerErrors, Bt as subscriptionEvent, Re as systemSubject, De as tenantScopedSubject, zn as toRpc, rt as toSnakeCase, Qi as tsMs, dn as undeclaredChannelKeys, wi as undoApplyDescriptor, Ci as undoLogQueryDescriptor, Ti as undoRedoDescriptor, pn as wireAudienceOf, L as wireErrorUnion, Mn as withRpcTag, dt as withheldServerError, cr as workflowAccessDescriptor, ni as workflowCancelDescriptor, Kr as workflowControlQueryDescriptor, ei as workflowDomainEventsQueryDescriptor, ti as workflowEventDeliveriesQueryDescriptor, Wr as workflowQueuedCancelDescriptor, Gr as workflowQueuedControlQueryDescriptor, ri as workflowResumeDescriptor, $r as workflowRunEventsQueryDescriptor, Xr as workflowRunQueryDescriptor, Qr as workflowRunStepsQueryDescriptor, Zr as workflowRunsQueryDescriptor, ii as workflowSignalDescriptor, Or as workflowToRpc, ai as workflowUpdateDescriptor, jn as workflowWireErrorUnion, ct as wsMutationIdempotencyScope };