@voltro/protocol 0.85.0 → 0.86.0

package/dist/index.js

@@ -1,1701 +1,43 @@
-import { $ as e, A as t, B as n, C as r, D as i, E as a, F as o, G as s, H as c, I as l, J as ee, K as te, L as ne, M as re, N as ie, O as ae, P as oe, Q as se, R as ce, S as le, T as ue, U as de, V as u, W as fe, X as pe, Y as me, Z as he, _ as ge, a as _e, at as ve, b as ye, c as be, d as xe, et as Se, f as Ce, g as we, h as Te, i as Ee, it as De, j as Oe, k as ke, l as Ae, m as je, n as Me, nt as Ne, o as d, ot as Pe, p as Fe, q as Ie, r as Le, rt as Re, s as f, st as ze, t as Be, tt as Ve, u as He, v as Ue, w as We, x as Ge, y as Ke, z as qe } from "./scopes-ClywBij8.js";
-import { A as Je, C as Ye, D as Xe, E as Ze, O as Qe, S as $e, T as et, _ as tt, a as nt, b as rt, c as it, d as at, f as ot, g as st, h as ct, i as lt, j as ut, k as dt, l as ft, m as pt, n as mt, o as ht, p as gt, r as _t, s as vt, t as yt, u as bt, v as xt, w as St, x as Ct, y as wt } from "./restFormat-BlgTLxm1.js";
-import { n as Tt, t as Et } from "./sessionHeader-DriTZhmv.js";
-import { Context as Dt, Effect as Ot, Layer as kt, Result as At, Schema as p, SchemaAST as m, SchemaGetter as jt, SchemaIssue as Mt } from "effect";
-import { Rpc as h } from "effect/rpc";
-import * as Nt from "effect/encoding/Base64";
-import * as g from "effect/SchemaAST";
-import { VersionConflict as Pt } from "@voltro/database/wire";
-//#region src/rowEquality.ts
-var Ft = (e) => e instanceof Uint8Array && Object.getPrototypeOf(e) === Uint8Array.prototype && !("toJSON" in e) && Object.keys(e).length === e.length, It = (e) => {
-	let t = Object.getPrototypeOf(e);
-	return (t === null || t === Object.prototype) && !("toJSON" in e) && !("toJSON" in Object.prototype);
-}, Lt = (e) => e == null || typeof e == "string" || typeof e == "boolean" || typeof e == "number" || Ft(e), Rt = (e, t) => {
-	let n = typeof e == "number" && !Number.isFinite(e) ? null : e, r = typeof t == "number" && !Number.isFinite(t) ? null : t;
-	if (n === r) return !0;
-	if (n instanceof Uint8Array && r instanceof Uint8Array) {
-		if (n.length !== r.length) return !1;
-		for (let e = 0; e < n.length; e++) if (n[e] !== r[e]) return !1;
-		return !0;
-	}
-	return !1;
-}, zt = (e, t) => {
-	if (!It(e) || !It(t)) return;
-	let n = Object.keys(e), r = e === t ? n : Object.keys(t);
-	if (n.length !== r.length) return;
-	let i = !0;
-	for (let r = 0; r < n.length; r++) {
-		let a = n[r];
-		if (a === "__proto__" || a in Object.prototype && Object.getOwnPropertyDescriptor(Object.prototype, a)?.set !== void 0) return;
-		let o = Object.getOwnPropertyDescriptor(e, a), s = e === t ? o : Object.getOwnPropertyDescriptor(t, a);
-		if (o === void 0 || s === void 0 || s.enumerable !== !0 || !("value" in o) || !("value" in s)) return;
-		let c = o.value, l = s.value;
-		if (!Lt(c) || !Lt(l)) return;
-		Rt(c, l) || (i = !1);
-	}
-	return i;
-}, Bt = p.Union([p.String, p.Number]), Vt = (e) => typeof e == "object" && !!e && !Array.isArray(e) && Object.keys(e).length === 1 && typeof e.$bytes == "string", Ht = p.Unknown.pipe(p.decodeTo(p.Unknown, {
-	decode: jt.transform((e) => {
-		if (!Vt(e)) return e;
-		let t = Nt.decode(e.$bytes);
-		return At.isSuccess(t) ? t.success : e;
-	}),
-	encode: jt.transform((e) => e instanceof Uint8Array ? { $bytes: Nt.encode(e) } : e instanceof Date ? e.toISOString() : e)
-})), Ut = p.Record(p.String, Ht).pipe(p.refine((e) => "id" in e, { message: "patch row must carry an id" })), Wt = p.Union([
-	p.Struct({
-		op: p.Literal("add"),
-		path: p.String,
-		value: Ut
-	}),
-	p.Struct({
-		op: p.Literal("replace"),
-		path: p.String,
-		value: Ut
-	}),
-	p.Struct({
-		op: p.Literal("remove"),
-		path: p.String
-	}),
-	p.Struct({
-		op: p.Literal("mergeCells"),
-		path: p.String,
-		value: p.Record(p.String, Ht)
-	})
-]), Gt = p.Struct({
-	ops: p.Array(Wt),
-	order: p.NullOr(p.Array(Bt))
-}), _ = (e) => `/${String(e).replace(/~/g, "~0").replace(/\//g, "~1")}`, v = (e) => (e.startsWith("/") ? e.slice(1) : e).replace(/~1/g, "/").replace(/~0/g, "~"), y = (e) => {
-	let t = Object.keys(e).sort(), n = {};
-	for (let r of t) n[r] = e[r];
-	return JSON.stringify(n);
-}, Kt = (e, t) => zt(e, t) ?? y(e) === y(t), qt = (e, t) => {
-	if (e instanceof Uint8Array && t instanceof Uint8Array) {
-		if (e.length !== t.length) return !1;
-		for (let n = 0; n < e.length; n += 1) if (e[n] !== t[n]) return !1;
-		return !0;
-	}
-	return y({
-		id: 0,
-		v: e
-	}) === y({
-		id: 0,
-		v: t
-	});
-}, Jt = (e, t, n = {}) => {
-	let r = /* @__PURE__ */ new Map();
-	for (let t of e) r.set(t.id, t);
-	let i = [], a = e.length === t.length && t.every((t, n) => t.id === e[n].id) ? null : [], o = /* @__PURE__ */ new Set(), s = n.crdt, c = (e, t) => {
-		if (s === void 0 || s.columns.size === 0) return;
-		let n = {}, r = !1;
-		for (let i of s.columns) {
-			if (!(i in t) || qt(e[i], t[i])) continue;
-			let a = s.incremental(i, e[i], t[i]);
-			if (a === void 0) return;
-			n[i] = a, r = !0;
-		}
-		if (!r) return;
-		let i = {};
-		for (let [e, n] of Object.entries(t)) s.columns.has(e) || (i[e] = n);
-		return {
-			scalars: i,
-			merges: n
-		};
-	};
-	for (let e of t) {
-		a?.push(e.id), o.add(e.id);
-		let t = r.get(e.id);
-		if (t === void 0) i.push({
-			op: "add",
-			path: _(e.id),
-			value: e
-		});
-		else if (!Kt(t, e)) {
-			let n = c(t, e);
-			n === void 0 ? i.push({
-				op: "replace",
-				path: _(e.id),
-				value: e
-			}) : (Kt(Object.fromEntries(Object.entries(t).filter(([e]) => !s.columns.has(e))), n.scalars) || i.push({
-				op: "replace",
-				path: _(e.id),
-				value: n.scalars
-			}), i.push({
-				op: "mergeCells",
-				path: _(e.id),
-				value: n.merges
-			}));
-		}
-	}
-	for (let t of e) o.has(t.id) || i.push({
-		op: "remove",
-		path: _(t.id)
-	});
-	return {
-		ops: i,
-		order: a
-	};
-}, Yt = (e) => e.every((e) => {
-	let t = e.id;
-	return typeof t == "string" || typeof t == "number";
-}), Xt = (e, t, n = {}) => {
-	let r = /* @__PURE__ */ new Map();
-	for (let t of e) r.set(t.id, t);
-	return Zt(e, t, n, r);
-}, Zt = (e, t, n, r, i) => {
-	let a = /* @__PURE__ */ new Map();
-	for (let e of t.ops) e.op === "mergeCells" && a.set(v(e.path), Object.keys(e.value));
-	for (let e of t.ops) {
-		if (e.op === "mergeCells") {
-			let t = v(e.path), i = r.get(t) ?? r.get(Number(t)), a = r.has(t) ? t : Number(t);
-			if (i === void 0) continue;
-			let o = { ...i };
-			for (let [t, r] of Object.entries(e.value)) o[t] = n.mergeCell === void 0 ? r : n.mergeCell(t, i[t], r);
-			r.set(a, o);
-			continue;
-		}
-		if (e.op === "add" && (t.order !== null || r.has(e.value.id)) && r.set(e.value.id, e.value), e.op === "replace") {
-			let n = r.get(e.value.id), i = (n === void 0 ? [] : a.get(String(e.value.id)) ?? []).filter((t) => !(t in e.value) && t in n);
-			(t.order !== null || n !== void 0) && r.set(e.value.id, i.length === 0 ? e.value : {
-				...e.value,
-				...Object.fromEntries(i.map((e) => [e, n[e]]))
-			});
-		}
-	}
-	if (t.order === null && i !== void 0) {
-		let n = e.slice();
-		for (let e of t.ops) {
-			if (e.op === "remove") continue;
-			let t = e.op === "mergeCells" ? v(e.path) : void 0, a = e.op === "mergeCells" ? r.has(t) ? t : Number(t) : e.value.id, o = i.get(a), s = r.get(a);
-			o !== void 0 && s !== void 0 && (n[o] = s);
-		}
-		return n;
-	}
-	let o = [];
-	if (t.order === null) for (let t of e) {
-		let e = r.get(t.id);
-		e !== void 0 && o.push(e);
-	}
-	else for (let e of t.order) {
-		let t = r.get(e);
-		t !== void 0 && o.push(t);
-	}
-	return o;
-}, Qt = () => {
-	let e, t, n, r = () => {
-		e = void 0, t = void 0, n = void 0;
-	}, i = (e) => {
-		let r = /* @__PURE__ */ new Map(), i = Object.getPrototypeOf(e) === Array.prototype;
-		for (let t = 0; t < e.length; t++) {
-			let n = e[t];
-			r.has(n.id) && (i = !1), r.set(n.id, t);
-		}
-		n = i ? r : void 0, t = i ? void 0 : new Map(e.map((e) => [e.id, e]));
-	};
-	return {
-		reset: r,
-		apply: (a, o, s = {}) => {
-			(a !== e || n === void 0 && t === void 0) && i(a);
-			try {
-				let r = n, c = /* @__PURE__ */ new Map(), l = Zt(a, o, s, r === void 0 ? t : {
-					get: (e) => {
-						if (c.has(e)) return c.get(e);
-						let t = r.get(e);
-						return t === void 0 ? void 0 : a[t];
-					},
-					has: (e) => c.has(e) || r.has(e),
-					set: (e, t) => {
-						c.set(e, t);
-					}
-				}, r);
-				return (o.order !== null || o.ops.some((e) => e.op === "mergeCells" && "id" in e.value)) && i(l), e = l, l;
-			} catch (e) {
-				throw r(), e;
-			}
-		}
-	};
-}, $t = (e) => p.Union([
-	p.Struct({
-		_tag: p.Literal("snapshot"),
-		revision: p.Number,
-		data: e,
-		computed: p.optional(p.Boolean),
-		reconciles: p.optional(p.String)
-	}),
-	p.Struct({
-		_tag: p.Literal("delta"),
-		revision: p.Number,
-		emittedAt: p.Number,
-		patch: Gt
-	}),
-	p.Struct({
-		_tag: p.Literal("error"),
-		error: p.Unknown,
-		revision: p.optional(p.Number)
-	})
-]), en = (e, t, n) => {
-	if (!t || typeof t != "object" || !("_tag" in t)) return t;
-	let r = t;
-	switch (r._tag) {
-		case "snapshot": return r.data;
-		case "error": throw r.error === void 0 ? Error(`${n} ${e}: the rpc refused without an error value`) : r.error;
-		case "delta": throw Error(`${n} ${e}: received a 'delta' as the first event, which should be impossible — a subscription always opens with a snapshot. This is a framework bug.`);
-		default: return t;
-	}
-}, tn = (e, t) => {
-	let n = `${e ?? "this procedure"} input`;
-	return t === !0 ? `${n} (guarded — the guard did NOT run: the payload failed to decode first, so this says nothing about access)` : n;
-}, nn = Mt.makeFormatterDefault(), rn = (e) => p.Never.annotate({ message: e.size === 0 ? "is unexpected: the input declares no keys" : `is unexpected: the input declares ${[...e].map(String).join(", ")}` }).ast, an = (e) => p.String.check(p.makeFilter((t) => e.has(t) ? "a declared key" : void 0)).ast, b = (e, t = /* @__PURE__ */ new Map()) => {
-	let n = t.get(e);
-	if (n !== void 0) return n;
-	let r = on(e, t);
-	return t.set(e, r), r;
-}, on = (e, t) => {
-	if (e.encoding !== void 0) {
-		let n = g.toEncoded(e), r = b(n, t);
-		return r === n ? e : p.make(r).pipe(p.decodeTo(p.make(e))).ast;
-	}
-	if (g.isObjects(e)) {
-		let n = e.propertySignatures.map((e) => new g.PropertySignature(e.name, b(e.type, t))), r = new Set(n.map((e) => e.name)), i = e.indexSignatures.length > 0 ? e.indexSignatures.map((e) => new g.IndexSignature(e.parameter, b(e.type, t))) : [new g.IndexSignature(an(r), rn(r))];
-		return new g.Objects(n, i, e.annotations, e.checks, void 0, e.context);
-	}
-	return g.isArrays(e) ? new g.Arrays(e.isMutable, e.elements.map((e) => b(e, t)), e.rest.map((e) => b(e, t)), e.annotations, e.checks, void 0, e.context) : g.isUnion(e) ? new g.Union(e.types.map((e) => b(e, t)), e.options, e.annotations, e.checks, void 0, e.context) : g.isSuspend(e) ? new g.Suspend(() => b(e.thunk(), t), e.annotations, e.checks, void 0, e.context) : e;
-}, x = (e, t, n) => {
-	let r = tn(t, n);
-	return p.make(b(e.ast)).pipe(p.middlewareDecoding((e) => Ot.catch(e, (e) => Ot.fail(new Mt.InvalidValue({ message: `${r}\n${nn(e)}` })))));
-}, sn = class extends p.TaggedError()("BusinessRuleViolation", {
-	rule: p.String,
-	params: p.optional(p.Record(p.String, p.Unknown)),
-	field: p.optional(p.String),
-	message: p.optional(p.String),
-	severity: p.Literals(["error", "warning"])
-}) {}, cn = p.Struct({
-	field: p.String,
-	message: p.String,
-	params: p.optional(p.Record(p.String, p.Unknown))
-}), S = class extends p.TaggedError()("ValidationError", {
-	field: p.String,
-	message: p.String,
-	params: p.optional(p.Record(p.String, p.Unknown))
-}) {}, C = class extends p.TaggedError()("ValidationErrors", { issues: p.Array(cn).pipe(p.check(p.isMinLength(1))) }) {}, ln = (e) => {
-	if (typeof e != "object" || !e) return [];
-	let t = e._tag;
-	if (t === "ValidationError") {
-		let t = e;
-		return [{
-			field: t.field,
-			message: t.message,
-			...t.params === void 0 ? {} : { params: t.params }
-		}];
-	}
-	if (t === "ValidationErrors") {
-		let t = e;
-		return Array.isArray(t.issues) ? t.issues : [];
-	}
-	if (t === "BusinessRuleViolation") {
-		let t = e;
-		if (typeof t.field != "string" || t.field.length === 0) return [];
-		let n = typeof t.message == "string" && t.message.length > 0 ? t.message : String(t.rule ?? "validation.invalid");
-		return [{
-			field: t.field,
-			message: n,
-			...t.params === void 0 ? {} : { params: t.params }
-		}];
-	}
-	return [];
-}, un = class extends p.TaggedError()("ApprovalRequired", {
-	approvalId: p.String,
-	procedure: p.String,
-	expiresAt: p.String,
-	requiredScopes: p.Array(p.String),
-	reason: p.NullOr(p.String),
-	created: p.Boolean
-}) {}, dn = class extends p.TaggedError()("ApprovalNotFound", { approvalId: p.String }) {}, fn = class extends p.TaggedError()("ApprovalSelfApproval", {
-	approvalId: p.String,
-	subjectId: p.NullOr(p.String)
-}) {}, pn = class extends p.TaggedError()("ApprovalRejected", {
-	approvalId: p.String,
-	decidedBy: p.NullOr(p.String),
-	note: p.NullOr(p.String)
-}) {}, mn = class extends p.TaggedError()("ApprovalExpired", {
-	approvalId: p.String,
-	expiredAt: p.String
-}) {}, hn = class extends p.TaggedError()("ApprovalNotPending", {
-	approvalId: p.String,
-	status: p.String
-}) {}, gn = class extends p.TaggedError()("ApprovalForbidden", {
-	approvalId: p.String,
-	required: p.NullOr(p.String),
-	message: p.String
-}) {}, _n = class extends p.TaggedError()("ApprovalUnavailable", {
-	procedure: p.String,
-	message: p.String
-}) {}, vn = p.Union([
-	un,
-	pn,
-	mn,
-	_n
-]), yn = p.Union([
-	dn,
-	fn,
-	mn,
-	hn,
-	gn,
-	_n
-]), bn = p.Struct({
-	id: p.String,
-	procedure: p.String,
-	kind: p.Literals(["mutation", "action"]),
-	requestedBy: p.NullOr(p.String),
-	status: p.Literals([
-		"pending",
-		"approved",
-		"rejected",
-		"expired",
-		"consumed"
-	]),
-	reason: p.NullOr(p.String),
-	requiredScopes: p.Array(p.String),
-	requestedAt: p.String,
-	expiresAt: p.String,
-	decidedBy: p.NullOr(p.String),
-	decidedAt: p.NullOr(p.String),
-	note: p.NullOr(p.String),
-	relation: p.Literals(["to-decide", "requested"])
-}), w = "channel:", xn = Symbol.for("@voltro/protocol/reactivityChannels"), Sn = globalThis, T = Sn[xn] ?? (Sn[xn] = /* @__PURE__ */ new Map()), Cn = /^[a-z][a-z0-9-]*(\.[a-z0-9-]+)*$/, wn = (e) => {
-	if (!Cn.test(e)) throw Error(`reactivityChannel('${e}'): invalid channel name.\n  Use lowercase kebab segments separated by dots — \`presence\`, \`job-queue\`,
-  \`billing.usage\`. A \`:\` is refused because it is the namespace separator in
-  the routing key (\`${w}<name>\`), and an uppercase letter is\n  refused because a key that differs only by case reads as one channel and
-  routes as two.`);
-	let t = T.get(e);
-	if (t !== void 0) return t;
-	let n = `${w}${e}`, r = Object.freeze({
-		kind: "reactivity-channel",
-		name: e,
-		key: n,
-		toString: () => n
-	});
-	return T.set(e, r), r;
-}, Tn = (e) => typeof e == "object" && !!e && e.kind === "reactivity-channel", En = (e) => e.startsWith(w), Dn = () => new Set([...T.values()].map((e) => e.key)), E = (e) => Tn(e) ? e.key : e, On = (e) => e === void 0 ? [] : Array.isArray(e) ? e.map(E) : [E(e)], kn = (e) => e === void 0 ? void 0 : Array.isArray(e) ? e.map(E) : E(e), An = (e) => {
-	let t = Dn(), n = [];
-	for (let r of e) for (let e of On(r.source)) En(e) && !t.has(e) && n.push({
-		procedure: r.name,
-		key: e
-	});
-	return n;
-}, jn = (e, t) => {
-	let n = e?.injectExternalChange;
-	return n !== void 0 && (n.call(e, {
-		table: t.key,
-		op: "update",
-		new: {},
-		old: {},
-		origin: "inline"
-	}), !0);
-}, Mn = (e) => e.internal !== !0, Nn = (e) => e.service === void 0 ? "client" : "service", Pn = (e) => Mn(e) && e.service === void 0, Fn = (e) => Mn(e) && e.service !== void 0, In = /^[a-z][a-z0-9-]{0,55}$/i, D = (e) => {
-	if (Rn(e), Ln(e), e.idempotencyScope !== void 0 && e.idempotencyScope !== "subject" && e.idempotencyScope !== "connection") throw Error(`${e.name}: idempotencyScope must be 'subject' or 'connection'`);
-	let t = e.serialize;
-	if (t !== void 0) {
-		if (typeof t.key != "function") throw Error(`${e.name}: serialize.key must be a function of the input`);
-		if (t.maxPending !== void 0 && (!Number.isSafeInteger(t.maxPending) || t.maxPending < 1)) throw Error(`${e.name}: serialize.maxPending must be a positive integer`);
-	}
-	if (e.idempotencyScope === "connection" && (e.internal === !0 || e.publicApi !== void 0 || e.exposeAsTool !== void 0)) throw Error(`${e.name}: connection-scoped mutations require the native WebSocket RPC surface; internal, publicApi and exposeAsTool cannot establish its connection state`);
-	if (Array.isArray(e.guards) && e.guards.length === 0) throw Error(`${e.name}: \`guards: []\` is empty, so it enforces nothing — but it reads\n  at the call site as if this procedure were protected. Omit the field for an
-  unguarded procedure, or list the scopes required to call it.`);
-	let n = typeof e.source == "string" ? [e.source] : Array.isArray(e.source) ? e.source : void 0;
-	if (n !== void 0 && (n.length === 0 || n.some((e) => String(e).trim() === ""))) throw Error(`${e.name}: \`source\` is empty, so this query declares reactivity and\n  subscribes to nothing — it serves one snapshot and never updates again,
-  which is indistinguishable from "nothing changed". Name the table(s) it
-  reads, or omit \`source\` for a non-reactive query.`);
-	if (e.internal !== !0) return e;
-	if (e.openAccess !== void 0) throw Error(`${e.name}: \`internal: true\` cannot be combined with \`openAccess\`.\n  \`internal\` takes the procedure OFF the wire, and \`openAccess\` declares who may
-  call it there — together they describe a decision about a surface that does not
-  exist. Drop \`openAccess\` (an internal procedure needs no wire decision), or drop
-  \`internal: true\` if the procedure really is meant to be callable.`);
-	if (e.overridesPlugin === !0) throw Error(`${e.name}: \`internal: true\` cannot be combined with \`overridesPlugin\`.\n  The override REMOVES the plugin route, and an internal procedure is not
-  wire-reachable — so the plugin's route would vanish with nothing callable
-  in its place, and callers would get a 404 for something that used to work.`);
-	let r = [e.publicApi === void 0 ? void 0 : "publicApi", e.exposeAsTool === void 0 ? void 0 : "exposeAsTool"].filter((e) => e !== void 0);
-	if (r.length === 0) return e;
-	throw Error(`${e.name}: \`internal: true\` cannot be combined with ${r.map((e) => `\`${e}\``).join(" or ")}. \`internal\` takes the procedure OFF the wire; those put it back ON a different one (${r.includes("publicApi") ? "a REST route" : "an agent tool"}), and that surface is projected without consulting the flag — so the procedure would be unreachable from your client and reachable from the internet. Drop \`internal: true\` if the wider surface is intended, or remove the ${r.join(" / ")} annotation if it is not.`);
-}, Ln = (e) => {
-	let t = e.service;
-	if (t === void 0) return;
-	let n = t.callers;
-	if (!Array.isArray(n) || n.length === 0) throw Error(`${e.name}: \`service.callers\` is empty, so NO app may call this procedure —\n  and no browser either. Name the calling app(s), e.g. \`service: { callers: ['worker'] }\`,
-  or drop \`service:\` if the procedure is meant for this app's own clients.`);
-	let r = n.filter((e) => typeof e != "string" || !In.test(e));
-	if (r.length > 0) throw Error(`${e.name}: \`service.callers\` holds ${r.map((e) => JSON.stringify(e)).join(", ")} — a caller is an\n  app name (letters, digits, dashes; starting with a letter; at most 56 characters), the same name this app
-  lists in \`serviceCallers\` and the caller's credential resolves to.`);
-	if (new Set(n).size !== n.length) throw Error(`${e.name}: \`service.callers\` lists the same app twice`);
-	let i = [
-		e.internal === !0 ? "`internal: true` (it removes the wire surface a service calls over)" : void 0,
-		e.publicApi === void 0 ? void 0 : "`publicApi` (a REST route is for callers that are not the listed apps)",
-		e.exposeAsTool === void 0 ? void 0 : "`exposeAsTool` (an agent tool is not one of the listed apps)",
-		e.requiresApproval === void 0 ? void 0 : "`requiresApproval` (a second HUMAN cannot approve a machine call)",
-		e.overridesPlugin === !0 ? "`overridesPlugin` (a plugin route is a client surface; replacing it with a service-only one breaks its clients)" : void 0,
-		e.idempotencyScope === "connection" ? "`idempotencyScope: 'connection'` (a service call dedups per service, across reconnects)" : void 0
-	].filter((e) => e !== void 0);
-	if (i.length !== 0) throw Error(`${e.name}: \`service:\` cannot be combined with ${i.join("; ")}.\n  A service procedure is callable only by the listed apps of this project, over the
-  socket, with their service credential. Drop the other field, or drop \`service:\`.`);
-}, Rn = (e) => {
-	let t = e.requiresApproval;
-	if (t !== void 0) {
-		if (!Array.isArray(t.approvers) || t.approvers.length === 0) throw Error(`${e.name}: \`requiresApproval.approvers\` is empty, so NOBODY can approve this\n  procedure and every call would park forever. Name the scope(s) an approver must hold
-  — e.g. \`approvers: [{ scope: 'invoices:approve' }]\`.`);
-		if (e.openAccess !== void 0) throw Error(`${e.name}: \`requiresApproval\` cannot be combined with \`openAccess\`.\n  The self-approval refusal compares subject ids, and an unauthenticated caller has
-  none — so on an open procedure every anonymous caller would count as a DIFFERENT
-  human from every other, and the second-pair-of-eyes control would enforce nothing.
-  Give the procedure a \`guards:\` decision, or drop \`requiresApproval\`.`);
-	}
-}, zn = (e) => e.action !== void 0 && e.resourceType !== void 0, Bn = (e) => e.authenticated === !0, Vn = (e) => e.openAccess !== void 0 || e.guards !== void 0 && e.guards.length > 0, O = (e, t, n, i) => {
-	if (i !== void 0) {
-		if (n !== void 0 || t !== void 0 && t.length > 0) throw Error(`${e}: \`service:\` is an access decision of its own — only the listed apps may\n  call this procedure — so it cannot sit beside \`guards:\` or \`openAccess:\`. A service
-  holds no scopes, and no user may call a service procedure. Keep exactly one.`);
-		return Array.isArray(i.callers) ? [a(i.callers)] : void 0;
-	}
-	if (n === void 0) return t;
-	if (n.trim() === "") throw Error(`${e}: \`openAccess\` needs a REASON, not an empty string. It is the sentence a\n  reviewer reads to decide whether this procedure should really be callable
-  without an authorization check — e.g. \`openAccess: 'public pricing, no caller data'\`.`);
-	if (t !== void 0 && t.length > 0) throw Error(`${e}: \`openAccess\` and \`guards\` are two different access decisions, so\n  declaring both says the procedure is protected AND open. Keep the guards if a
-  caller must hold a scope; drop them if anyone may call it.`);
-	return [r(n.trim())];
-}, k = (e) => D({
-	kind: "query",
-	name: e.name,
-	input: e.input,
-	output: e.output,
-	error: e.error ?? p.Never,
-	source: kn(e.source),
-	cache: e.cache,
-	guards: O(e.name, e.guards, e.openAccess, e.service),
-	openAccess: e.openAccess,
-	service: e.service === void 0 ? void 0 : { callers: Array.isArray(e.service.callers) ? [...e.service.callers] : e.service.callers },
-	publicApi: e.publicApi,
-	exposeAsTool: e.exposeAsTool,
-	internal: e.internal,
-	overridesPlugin: e.overridesPlugin
-}), A = (e) => D({
-	kind: "mutation",
-	name: e.name,
-	input: e.input,
-	output: e.output,
-	error: e.error ?? p.Never,
-	...e.idempotencyScope === void 0 ? {} : { idempotencyScope: e.idempotencyScope },
-	...e.serialize === void 0 ? {} : { serialize: e.serialize },
-	target: e.target,
-	guards: O(e.name, e.guards, e.openAccess, e.service),
-	openAccess: e.openAccess,
-	service: e.service === void 0 ? void 0 : { callers: Array.isArray(e.service.callers) ? [...e.service.callers] : e.service.callers },
-	publicApi: e.publicApi,
-	exposeAsTool: e.exposeAsTool,
-	requiresApproval: e.requiresApproval,
-	internal: e.internal,
-	overridesPlugin: e.overridesPlugin
-}), j = (e) => D({
-	kind: "action",
-	name: e.name,
-	input: e.input,
-	output: e.output,
-	error: e.error ?? p.Never,
-	guards: O(e.name, e.guards, e.openAccess, e.service),
-	openAccess: e.openAccess,
-	service: e.service === void 0 ? void 0 : { callers: Array.isArray(e.service.callers) ? [...e.service.callers] : e.service.callers },
-	source: e.source,
-	target: e.target,
-	publicApi: e.publicApi,
-	exposeAsTool: e.exposeAsTool,
-	requiresApproval: e.requiresApproval,
-	internal: e.internal,
-	overridesPlugin: e.overridesPlugin
-}), Hn = (e) => D({
-	kind: "stream",
-	name: e.name,
-	input: e.input,
-	element: e.element,
-	error: e.error ?? p.Never,
-	internal: e.internal,
-	overridesPlugin: e.overridesPlugin,
-	guards: O(e.name, e.guards, e.openAccess),
-	openAccess: e.openAccess
-}), Un = (e, t) => t && t.length > 0 ? p.Union([e, ...t]) : e, M = (e) => e !== void 0 && e.some((e) => !Ke(e)), Wn = (e) => p.Union([
-	e,
-	f,
-	u
-]), Gn = (e) => p.Union([e, sn]), Kn = (e) => p.Union([
-	e,
-	S,
-	C
-]), qn = (e, t) => t === void 0 ? e : p.Union([e, vn]), Jn = (e, t) => xe(t) ? p.Union([e, d]) : e, N = (e, t, n) => Un(Yn(e, t), n), Yn = (e, t) => {
-	let n = Jn(Wn(e.error), e.guards);
-	if (t === "stream" || t === "query") return n;
-	let r = t === "mutation" ? p.Union([
-		Gn(n),
-		Ye,
-		Pt
-	]) : n;
-	return qn(Kn(t === "mutation" && e.idempotencyScope === "connection" ? p.Union([r, $e]) : r), e.requiresApproval);
-}, Xn = {
-	query: [f, u],
-	stream: [f, u],
-	action: [
-		f,
-		u,
-		S,
-		C
-	],
-	mutation: [
-		f,
-		u,
-		sn,
-		Ye,
-		Pt,
-		S,
-		C
-	]
-}, Zn = (e, t) => Un(Jn(Wn(e.errorSchema), e.guards), t), Qn = (e, t) => ({
-	...e,
-	name: t
-}), $n = (e, t) => h.make(e.name, {
-	payload: x(e.input, e.name, M(e.guards)),
-	success: $t(e.output),
-	error: N(e, "query", t),
-	stream: !0
-}), er = (e, t) => h.make(e.name, {
-	payload: x(e.input, e.name, M(e.guards)),
-	success: e.output,
-	error: N(e, "mutation", t)
-}), tr = (e, t) => h.make(e.name, {
-	payload: x(e.input, e.name, M(e.guards)),
-	success: e.output,
-	error: N(e, "action", t)
-}), nr = (e, t) => h.make(e.name, {
-	payload: x(e.input, e.name, M(e.guards)),
-	success: e.element,
-	error: N(e, "stream", t),
-	stream: !0
-}), rr = (e) => {
-	if (typeof e != "object" || !e) return;
-	let t = e._tag;
-	return typeof t == "string" ? t : void 0;
-}, ir = (e) => {
-	if (typeof e == "string") return e;
-	if (typeof e == "object" && e) {
-		let t = e.message;
-		if (typeof t == "string" && t !== "") return t;
-		let n = rr(e);
-		if (n !== void 0) return n;
-	}
-	return String(e);
-}, ar = (e) => {
-	if (e instanceof Error) return e;
-	let t = Error(ir(e), { cause: e });
-	return t.name = rr(e) ?? "NonErrorThrown", t;
-}, or = (e) => {
-	switch (e.kind) {
-		case "query": return $n(e);
-		case "mutation": return er(e);
-		case "action": return tr(e);
-		case "stream": return nr(e);
-	}
-}, sr = (e) => {
-	let t = e.input, n = t === void 0 ? {} : { input: t }, r = e.output, i = r === void 0 ? {} : { output: r };
-	if (e.kind === "query") return {
-		kind: "query",
-		source: e.source,
-		...n,
-		...i
-	};
-	if (e.kind === "action") return {
-		kind: "action",
-		...n,
-		...i
-	};
-	if (e.kind === "stream") return {
-		kind: "stream",
-		...n,
-		...i
-	};
-	let a = e.target, o = e.idempotencyScope === void 0 ? {} : { idempotencyScope: e.idempotencyScope }, s = e.serialize === void 0 ? {} : { serialize: e.serialize };
-	if (a === void 0) return {
-		kind: "mutation",
-		...n,
-		...i,
-		...o,
-		...s
-	};
-	let c = Array.isArray(a) ? a : [a];
-	return {
-		kind: "mutation",
-		...n,
-		...i,
-		...o,
-		...s,
-		targets: c.map((e) => ({
-			table: e.table,
-			op: e.op,
-			..."order" in e && e.order !== void 0 ? { order: e.order } : {},
-			..."shape" in e && e.shape !== void 0 ? { shape: e.shape } : {},
-			..."identify" in e && e.identify !== void 0 ? { identify: e.identify } : {},
-			..."path" in e && e.path !== void 0 ? { path: e.path } : {},
-			..."by" in e && e.by !== void 0 ? { by: e.by } : {},
-			..."match" in e && e.match !== void 0 ? { match: e.match } : {},
-			..."shapeItem" in e && e.shapeItem !== void 0 ? { shapeItem: e.shapeItem } : {},
-			..."relations" in e && e.relations !== void 0 ? { relations: e.relations } : {}
-		}))
-	};
-}, cr = 7500, lr = (e) => typeof e == "object" && !!e && e.kind === "event", ur = (e) => {
-	if (e.name.length === 0) throw Error("defineEvent: `name` must not be empty");
-	if (/\s/.test(e.name)) throw Error(`defineEvent("${e.name}"): \`name\` must not contain whitespace.\n  The name is used as a broker subject segment. NATS refuses a subject with
-  whitespace and delivers nothing — silently, and only on that broker, so an
-  app that works on Redis stops working when the transport changes.
-  Use a dot for namespacing: "orders.paid".`);
-	if (e.guards !== void 0 && e.guards.length === 0) throw Error(`defineEvent("${e.name}"): \`guards: []\` is empty, so it enforces nothing —\n  but it reads at the call site as if the event were protected. Omit the field
-  for an unguarded event, or list the scopes that may subscribe.`);
-	if (e.openAccess !== void 0) {
-		if (e.openAccess.trim() === "") throw Error(`defineEvent("${e.name}"): \`openAccess\` needs a REASON, not an empty string. It is\n  the sentence a reviewer reads to decide whether anyone should really be able to
-  subscribe without an authorization check — e.g. \`openAccess: 'public scoreboard,
-  no caller data'\`.`);
-		if (e.guards !== void 0 && e.guards.length > 0) throw Error(`defineEvent("${e.name}"): \`openAccess\` and \`guards\` are two different access\n  decisions, so declaring both says the event is protected AND open. Keep the guards
-  if a subscriber must hold a scope; drop them if anyone may listen.`);
-	}
-	if (e.webhook?.rateLimit !== void 0 && e.webhook.rateLimit.perMinute < 1) throw Error(`defineEvent("${e.name}"): \`webhook.rateLimit.perMinute\` is ${e.webhook.rateLimit.perMinute}, which defers every delivery forever.\n  There is no "unlimited" spelling here — omit \`rateLimit\` for no ceiling.`);
-	if (e.webhook?.version !== void 0 && e.webhook.version < 1) throw Error(`defineEvent("${e.name}"): \`webhook.version\` must be >= 1 (default 1).\n  A subscriber pinned to 1 would read this event as BEHIND its own version,
-  which is the opposite of what a version bump is for.`);
-	if (e.delivery === "latest" && e.webhook !== void 0) throw Error(`defineEvent(${e.name}): \`delivery: 'latest'\` cannot be combined with \`webhook\`.\n  \`latest\` means a superseded delivery did not matter — but a webhook delivery is a
-  durable side effect at a third party, and one already sent cannot be superseded.
-  A high-rate event with an HTTP audience is also 60 deliveries per second per target;
-  the rate limit DEFERS the excess as pending rows, so it grows a table instead of failing.
-  Split them: publish the high-rate event for clients, and publish a separate, coarser
-  event (a summary, a state change) for the outside world.`);
-	return {
-		kind: "event",
-		name: e.name,
-		key: e.key,
-		payload: e.payload,
-		guards: e.openAccess === void 0 ? e.guards : [r(e.openAccess.trim())],
-		openAccess: e.openAccess,
-		rewind: e.rewind,
-		webhook: e.webhook,
-		delivery: e.delivery
-	};
-}, dr = (e) => p.Struct({
-	_tag: p.Literal("event"),
-	origin: p.String,
-	n: p.Number,
-	emittedAt: p.Number,
-	payload: e
-}), fr = p.Struct({
-	_tag: p.Literal("gap"),
-	missed: p.Number,
-	reason: p.Literals(["buffer", "resume"])
-}), pr = p.Struct({ _tag: p.Literal("attached") }), mr = (e) => p.Union([
-	pr,
-	dr(e),
-	fr
-]), hr = p.Struct({
-	origin: p.String,
-	n: p.Number
-}), gr = (e) => p.Struct({
-	key: e,
-	resume: p.optional(p.Array(hr))
-}), _r = (e, t) => {
-	let n = e.guards !== void 0 && e.guards.some((e) => !Ke(e)) ? p.Union([f, u]) : u, r = xe(e.guards) ? p.Union([n, d]) : n, i = t && t.length > 0 ? p.Union([r, ...t]) : r;
-	return h.make(e.name, {
-		payload: x(gr(e.key), e.name, M(e.guards)),
-		success: mr(e.payload),
-		error: i,
-		stream: !0
-	});
-}, vr = class extends p.TaggedError()("EventPayloadInvalid", {
-	event: p.String,
-	message: p.String
-}) {}, yr = class extends p.TaggedError()("EventKeyInvalid", {
-	event: p.String,
-	message: p.String
-}) {}, br = class extends p.TaggedError()("EventPayloadTooLarge", {
-	event: p.String,
-	bytes: p.Number,
-	limit: p.Number
-}) {}, xr = (e) => {
-	if (typeof e != "object" || !e) return JSON.stringify(e) ?? "null";
-	let t = Object.entries(e), n = 0;
-	for (let e of t) e[1] !== void 0 && (t[n++] = e);
-	return t.length = n, t.sort(([e], [t]) => e < t ? -1 : +(e > t)), JSON.stringify(t);
-}, Sr = "\0", Cr = (e, t, n) => [
-	e ?? "~",
-	t,
-	xr(n)
-].join("\0"), wr = (e) => {
-	let [t = "~", n = "", r = ""] = e.split("\0");
-	return {
-		tenantId: t === "~" ? null : t,
-		event: n,
-		key: r
-	};
-}, Tr = (e) => e.split("\0").join(" · "), Er = Symbol.for("@voltro/protocol/workflow-access"), Dr = {
-	guards: void 0,
-	openAccess: void 0,
-	internal: !1,
-	controls: void 0,
-	controlsOpenAccess: void 0
-}, Or = (e, t) => {
-	let n = t.guards;
-	if (n !== void 0 && n.length === 0) throw Error(`workflow("${e}"): \`guards: []\` is empty, so it enforces nothing —\n  but it reads at the call site as if the start were protected. Omit the field
-  and decide with \`openAccess\` or \`internal\`, or list the scopes that may start it.`);
-	if (t.openAccess !== void 0) {
-		if (t.openAccess.trim() === "") throw Error(`workflow("${e}"): \`openAccess\` needs a REASON, not an empty string. It is\n  the sentence a reviewer reads to decide whether anyone should really be able to
-  start durable work without an authorization check — e.g. \`openAccess: 'public
-  newsletter signup; the payload carries only the address being confirmed'\`.`);
-		if (n !== void 0 && n.length > 0) throw Error(`workflow("${e}"): \`openAccess\` and \`guards\` are two different access\n  decisions, so declaring both says the start is protected AND open. Keep the
-  guards if a caller must hold a scope; drop them if anyone may start it.`);
-		if (t.internal === !0) throw Error(`workflow("${e}"): \`internal: true\` cannot be combined with \`openAccess\`.\n  \`internal\` takes the start OFF the wire, and \`openAccess\` declares who may
-  start it over the wire — a decision about a door that does not exist. Drop
-  \`openAccess\` (an internal workflow needs no wire decision), or drop
-  \`internal: true\` if the workflow really is meant to be startable by clients.`);
-	}
-	let i = t.controls?.guards, a = t.controls?.openAccess;
-	if (i !== void 0 && i.length === 0) throw Error(`workflow("${e}"): \`controls: { guards: [] }\` is empty, so it enforces nothing —\n  but it reads at the call site as if driving this run were protected. Omit
-  \`controls\` (wire control is then refused for everyone but \`admin:full\`), or
-  list the scopes a caller needs to cancel or signal a run.`);
-	if (a !== void 0) {
-		if (a.trim() === "") throw Error(`workflow("${e}"): \`controls: { openAccess }\` needs a REASON, not an empty string.\n  It is the sentence a reviewer reads to decide whether anyone who can see this
-  run should be able to cancel or signal it — e.g. \`controls: { openAccess:
-  'the run belongs to the caller who started it; cancelling it affects nobody else' }\`.`);
-		if (i !== void 0 && i.length > 0) throw Error(`workflow("${e}"): \`controls\` takes \`guards\` OR \`openAccess\`, not both.\n  Two answers to one question; keep the guards if a caller needs a scope.`);
-	}
-	return {
-		guards: t.openAccess === void 0 ? t.guards : [r(t.openAccess.trim())],
-		openAccess: t.openAccess?.trim(),
-		internal: t.internal === !0,
-		controls: a === void 0 ? i : [r(a.trim())],
-		controlsOpenAccess: a?.trim()
-	};
-}, kr = (e, t) => {
-	Object.defineProperty(e, Er, {
-		value: t,
-		enumerable: !1
-	});
-}, Ar = (e) => {
-	if (typeof e != "object" && typeof e != "function" || e === null) return Dr;
-	let t = e[Er];
-	return t === void 0 ? Dr : t;
-}, jr = (e) => {
-	let t = Ar(e);
-	return {
-		name: e.name,
-		internal: t.internal,
-		guards: t.guards,
-		openAccess: t.openAccess,
-		controls: t.controls
-	};
-}, Mr = class extends p.TaggedError()("ApiUnavailable", {
-	api: p.String,
-	tag: p.String,
-	reason: p.Literals([
-		"timeout",
-		"transport",
-		"closed"
-	]),
-	message: p.String
-}) {}, Nr = (e) => typeof e == "object" && !!e && e._tag === "ApiUnavailable", Pr = (e) => e, Fr = (e) => e, Ir = (e) => {
-	let t = e.alias?.trim(), n = e.instance?.trim(), r = t !== void 0 && t !== "" ? t : e.base;
-	return n !== void 0 && n !== "" ? `${r}#${n}` : r;
-}, Lr = (e) => {
-	if (e.length !== 0) return (t, n) => e.reduceRight((e, t) => t(e, n), t);
-}, Rr = (e, t) => {
-	let n = Dt.Service(e);
-	return {
-		Tag: n,
-		Live: kt.succeed(n, t)
-	};
-}, zr = (e, t, n) => {
-	if (!t) return { ok: !0 };
-	let r = n === void 0 ? null : P(n);
-	if (!r) return {
-		ok: !0,
-		unverified: `plugin "${e}" requires framework ${t}, but the running framework version is ${n === void 0 ? "unknown" : `unreadable ("${n}")`} — not checked.`
-	};
-	let i = t.trim();
-	if (i === "*" || i === "") return { ok: !0 };
-	let a = i.split(/\s+/);
-	for (let i of a) if (!Br(i, r)) return {
-		ok: !1,
-		reason: `plugin "${e}" requires framework ${t}, running ${n}`
-	};
-	return { ok: !0 };
-}, P = (e) => {
-	let t = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9a-zA-Z.-]+))?$/.exec(e.trim());
-	return t ? {
-		major: Number(t[1]),
-		minor: Number(t[2]),
-		patch: Number(t[3]),
-		pre: t[4] ?? ""
-	} : null;
-}, F = (e, t) => e.major === t.major ? e.minor === t.minor ? e.patch === t.patch ? e.pre && !t.pre ? -1 : !e.pre && t.pre ? 1 : e.pre && t.pre ? e.pre < t.pre ? -1 : +(e.pre > t.pre) : 0 : e.patch - t.patch : e.minor - t.minor : e.major - t.major, Br = (e, t) => {
-	if (e === "*") return !0;
-	if (e.startsWith("^")) {
-		let n = P(e.slice(1));
-		return !n || t.major !== n.major ? !1 : F(t, n) >= 0;
-	}
-	if (e.startsWith("~")) {
-		let n = P(e.slice(1));
-		return !n || t.major !== n.major || t.minor !== n.minor ? !1 : F(t, n) >= 0;
-	}
-	let n = /^(>=|<=|>|<)(.+)$/.exec(e);
-	if (n) {
-		let e = n[1], r = P(n[2]);
-		if (!r) return !1;
-		let i = F(t, r);
-		if (e === ">=") return i >= 0;
-		if (e === "<=") return i <= 0;
-		if (e === ">") return i > 0;
-		if (e === "<") return i < 0;
-	}
-	let r = P(e);
-	return r ? F(t, r) === 0 : !1;
-}, Vr = (e) => {
-	let t = e.startsWith("@") ? e.replace(/^@[^/]+\//, "") : e;
-	return (t.startsWith("plugin-") ? t.slice(7) : t).replace(/-([a-zA-Z0-9])/g, (e, t) => t.toUpperCase());
-}, Hr = (e) => {
-	let t = e.startsWith("@") ? e.replace(/^@[^/]+\//, "") : e;
-	return (t.startsWith("plugin-") ? t.slice(7) : t).replace(/#/g, "--").replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
-}, Ur = Symbol.for("@voltro/protocol/pluginAliases"), I = () => {
-	let e = globalThis, t = e[Ur];
-	if (t instanceof Map) return t;
-	let n = /* @__PURE__ */ new Map();
-	return e[Ur] = n, n;
-}, Wr = (e) => {
-	let t = I();
-	for (let [n, r] of Object.entries(e)) {
-		if (r === "") continue;
-		let e = t.get(n);
-		e === void 0 ? t.set(n, /* @__PURE__ */ new Set([r])) : e.add(r);
-	}
-}, Gr = () => {
-	I().clear();
-}, Kr = (e, t) => {
-	let n = I().get(e);
-	if (n === void 0 || n.size === 0) return `${Vr(e)}.${t}`;
-	if (n.size === 1) for (let e of n) return `${e}.${t}`;
-	let r, i = 0;
-	for (let e of n) e.includes("#") || (r = e, i++);
-	if (i === 1) return `${r}.${t}`;
-	throw Error(`[voltro] ${e} is installed more than once (${[...n].sort().join(", ")}) and no single install is the primary one, so a plugin hook cannot tell which of them it addresses. Call the route by its full tag instead — e.g. useSubscription(api, '${[...n].sort()[0]}.${t}').`);
-}, L = p.Union([
-	p.Struct({
-		kind: p.Literal("dropped"),
-		at: p.Number,
-		retryAfterMs: p.Number
-	}),
-	p.Struct({
-		kind: p.Literal("skipped"),
-		at: p.Number,
-		executionId: p.String,
-		runId: p.String
-	}),
-	p.Struct({
-		kind: p.Literal("superseded"),
-		at: p.Number
-	}),
-	p.Struct({
-		kind: p.Literal("cancelled"),
-		at: p.Number
-	}),
-	p.Struct({
-		kind: p.Literal("abandoned"),
-		at: p.Number,
-		failureId: p.NonEmptyString
-	})
-]), R = p.Literals([
-	"running",
-	"succeeded",
-	"failed",
-	"cancelled",
-	"suspended"
-]), z = p.Struct({
-	id: p.String,
-	workflowName: p.String,
-	executionId: p.String,
-	status: p.Union([R, p.Literal("unknown")]),
-	output: p.optional(p.Unknown),
-	error: p.optional(p.Struct({
-		tag: p.NullOr(p.String),
-		message: p.String
-	}))
-}), B = p.Struct({
-	operation: p.Literals(["cancel", "resume"]),
-	kind: p.Literals([
-		"accepted",
-		"confirmed",
-		"unknown",
-		"already-terminal"
-	]),
-	requestId: p.NullOr(p.NonEmptyString),
-	snapshot: z
-}).pipe(p.check(p.makeFilter((e) => e.kind === "unknown" ? !0 : e.kind === "accepted" ? e.requestId !== null && (e.snapshot.status === "running" || e.snapshot.status === "suspended") : e.kind === "already-terminal" ? e.snapshot.status === "succeeded" || e.snapshot.status === "failed" || e.snapshot.status === "cancelled" : e.operation === "cancel" ? e.snapshot.status === "cancelled" : e.requestId !== null && e.snapshot.status === "running", { message: "Workflow control acknowledgement contradicts its observed state or receipt identity" }))), V = p.Struct({
-	operation: p.Literal("cancel"),
-	workflowName: p.NonEmptyString,
-	receiptId: p.NonEmptyString,
-	requestId: p.NullOr(p.NonEmptyString),
-	kind: p.Literals([
-		"accepted",
-		"confirmed",
-		"unknown",
-		"already-terminal"
-	]),
-	observation: p.Union([
-		p.Struct({ kind: p.Literal("pending") }),
-		p.Struct({
-			kind: p.Literal("admission"),
-			outcome: p.Union([L, p.Struct({
-				kind: p.Literal("rejected"),
-				failureId: p.NonEmptyString
-			})])
-		}),
-		p.Struct({
-			kind: p.Literal("execution"),
-			snapshot: z
-		}),
-		p.Struct({
-			kind: p.Literal("unavailable"),
-			reason: p.Literals([
-				"missing-request",
-				"missing-run",
-				"unconfirmed-generation",
-				"unbound-submission"
-			])
-		})
-	])
-}).pipe(p.check(p.makeFilter((e) => {
-	let t = e.observation;
-	if (t.kind === "unavailable") return e.kind === "unknown" && (t.reason === "missing-request" ? e.requestId === null : e.requestId !== null);
-	if (e.requestId === null) return !1;
-	if (t.kind === "pending") return e.kind === "accepted";
-	if (t.kind === "admission") return e.kind === (t.outcome.kind === "cancelled" ? "confirmed" : "already-terminal");
-	let n = t.snapshot;
-	return n.workflowName !== e.workflowName || n.id.length === 0 || n.executionId.length === 0 ? !1 : e.kind === "accepted" ? n.status === "running" || n.status === "suspended" : e.kind === "confirmed" ? n.status === "cancelled" : e.kind === "already-terminal" && (n.status === "succeeded" || n.status === "failed" || n.status === "cancelled");
-}, { message: "Queued cancellation acknowledgement contradicts its receipt or observation" }))), qr = p.Literals([
-	"cancel",
-	"terminate",
-	"abandon"
-]), Jr = p.Struct({
-	mode: p.String,
-	dueAt: p.NullOr(p.Number),
-	retryAfterMs: p.NullOr(p.Number),
-	intentId: p.NullOr(p.String)
-}), Yr = p.Struct({
-	id: p.String,
-	workflowName: p.String,
-	executionId: p.NullOr(p.String),
-	status: p.Literals([
-		"running",
-		"succeeded",
-		"queued",
-		"dropped",
-		"skipped",
-		"replayed"
-	]),
-	deferral: p.optional(Jr)
-}), Xr = (e, t) => {
-	let n = Ar(e);
-	return h.make(e.name, {
-		payload: x(e.payloadSchema, e.name, M(n.guards)),
-		success: Yr,
-		error: Zn({
-			errorSchema: e.errorSchema,
-			guards: n.guards
-		}, t)
-	});
-}, H = p.Struct({
-	id: p.String,
-	tag: p.String,
-	executionId: p.String,
-	status: R,
-	payload: p.Unknown,
-	workflowVersion: p.NullOr(p.String),
-	workflowPatches: p.NullOr(p.Unknown),
-	output: p.NullOr(p.Unknown),
-	subject: p.NullOr(p.Unknown),
-	source: p.NullOr(p.String),
-	errorTag: p.NullOr(p.String),
-	errorMessage: p.NullOr(p.String),
-	cancelled: p.Boolean,
-	startedAt: p.DateFromString,
-	completedAt: p.NullOr(p.DateFromString),
-	durationMs: p.NullOr(p.Number),
-	traceId: p.NullOr(p.String),
-	parentExecutionId: p.NullOr(p.String),
-	parentClosePolicy: p.NullOr(qr)
-}), Zr = p.Struct({
-	tag: p.optional(p.String),
-	status: p.optional(R),
-	limit: p.optional(p.Number)
-}), Qr = p.Struct({
-	id: p.String,
-	runId: p.String,
-	stepName: p.String,
-	attempt: p.Number,
-	status: p.Literals([
-		"running",
-		"succeeded",
-		"failed"
-	]),
-	input: p.NullOr(p.Unknown),
-	retryPolicy: p.NullOr(p.Unknown),
-	output: p.NullOr(p.Unknown),
-	errorTag: p.NullOr(p.String),
-	errorMessage: p.NullOr(p.String),
-	errorCause: p.NullOr(p.Unknown),
-	startedAt: p.DateFromString,
-	completedAt: p.NullOr(p.DateFromString),
-	durationMs: p.NullOr(p.Number)
-}), $r = p.Struct({
-	id: p.String,
-	runId: p.String,
-	eventType: p.String,
-	payload: p.NullOr(p.Unknown),
-	occurredAt: p.DateFromString,
-	stepName: p.NullOr(p.String),
-	attempt: p.NullOr(p.Number)
-}), ei = p.Struct({
-	id: p.String,
-	name: p.String,
-	payload: p.Unknown,
-	source: p.String,
-	subject: p.NullOr(p.Unknown),
-	traceId: p.NullOr(p.String),
-	occurredAt: p.DateFromString
-}), ti = p.Struct({
-	id: p.String,
-	eventId: p.String,
-	eventName: p.String,
-	triggerId: p.String,
-	workflowName: p.String,
-	executionId: p.NullOr(p.String),
-	status: p.Literals([
-		"starting",
-		"started",
-		"skipped",
-		"failed"
-	]),
-	idempotencyKey: p.String,
-	skipped: p.Boolean,
-	errorMessage: p.NullOr(p.String),
-	createdAt: p.DateFromString,
-	completedAt: p.NullOr(p.DateFromString)
-}), ni = p.Struct({ id: p.String }), U = p.Struct({ runId: p.String }), ri = p.Struct({
-	name: p.optional(p.String),
-	limit: p.optional(p.Number)
-}), ii = p.Struct({ eventId: p.String }), ai = p.Struct({
-	requestId: p.NonEmptyString,
-	cause: p.optionalKey(p.Struct({
-		reason: p.NonEmptyString,
-		detail: p.optional(p.Record(p.String, p.Unknown))
-	}))
-}), oi = p.Struct({
-	workflowName: p.String,
-	executionId: p.String,
-	control: p.optional(ai)
-}), si = p.Struct({
-	workflowName: p.NonEmptyString,
-	executionId: p.NonEmptyString,
-	operation: p.Literals(["cancel", "resume"]),
-	requestId: p.NonEmptyString
-}), ci = p.Struct({
-	workflowName: p.NonEmptyString,
-	receiptId: p.NonEmptyString,
-	requestId: p.NonEmptyString
-}), li = p.Struct({
-	...ci.fields,
-	cause: ai.fields.cause
-}), ui = j({
-	name: "__voltro.workflow.queued.cancel",
-	input: li,
-	output: V,
-	openAccess: "authorization happens in the executor against the target run — the caller must be authenticated and belong to the run's tenant, and a missing run answers exactly like a foreign one"
-}), di = k({
-	name: "__voltro.workflow.queued.control",
-	input: ci,
-	output: V,
-	openAccess: "authorization happens in the executor against the target run — the caller must be authenticated and belong to the run's tenant, and a missing run answers exactly like a foreign one"
-}), fi = k({
-	name: "__voltro.workflow.control",
-	input: si,
-	output: B,
-	openAccess: "authorization happens in the executor against the target run — the caller must be authenticated and belong to the run's tenant, and a missing run answers exactly like a foreign one"
-}), pi = p.Struct({
-	id: p.String,
-	signalName: p.String,
-	payload: p.optional(p.Unknown)
-}), mi = p.Struct({
-	id: p.String,
-	updateName: p.String,
-	payload: p.optional(p.Unknown),
-	timeoutMs: p.optional(p.Number)
-}), hi = p.Struct({
-	eventId: p.String,
-	updateId: p.String,
-	completedEventId: p.String,
-	result: p.Unknown
-}), gi = k({
-	name: "__voltro.workflow.run",
-	source: "_voltro_workflow_runs",
-	input: ni,
-	output: p.Array(H),
-	openAccess: "the answer is scoped to the caller in the executor — a system or admin:full subject sees every row, an authenticated subject the rows of its own tenant, an anonymous caller none"
-}), _i = k({
-	name: "__voltro.workflow.runs",
-	source: "_voltro_workflow_runs",
-	input: Zr,
-	output: p.Array(H),
-	openAccess: "the answer is scoped to the caller in the executor — a system or admin:full subject sees every row, an authenticated subject the rows of its own tenant, an anonymous caller none"
-}), vi = k({
-	name: "__voltro.workflow.run.steps",
-	source: "_voltro_workflow_run_steps",
-	input: U,
-	output: p.Array(Qr),
-	openAccess: "the answer is scoped to the caller in the executor — a system or admin:full subject sees every row, an authenticated subject the rows of its own tenant, an anonymous caller none"
-}), yi = k({
-	name: "__voltro.workflow.run.events",
-	source: "_voltro_workflow_run_events",
-	input: U,
-	output: p.Array($r),
-	openAccess: "the answer is scoped to the caller in the executor — a system or admin:full subject sees every row, an authenticated subject the rows of its own tenant, an anonymous caller none"
-}), bi = k({
-	name: "__voltro.workflow.domainEvents",
-	source: "_voltro_workflow_events",
-	input: ri,
-	output: p.Array(ei),
-	openAccess: "the answer is scoped to the caller in the executor — a system or admin:full subject sees every row, an authenticated subject the rows of its own tenant, an anonymous caller none"
-}), xi = k({
-	name: "__voltro.workflow.event.deliveries",
-	source: "_voltro_workflow_event_deliveries",
-	input: ii,
-	output: p.Array(ti),
-	openAccess: "the answer is scoped to the caller in the executor — a system or admin:full subject sees every row, an authenticated subject the rows of its own tenant, an anonymous caller none"
-}), Si = j({
-	name: "__voltro.workflow.cancel",
-	input: oi,
-	output: B,
-	openAccess: "authorization happens in the executor against the target run — the caller must be authenticated and belong to the run's tenant, and a missing run answers exactly like a foreign one"
-}), Ci = j({
-	name: "__voltro.workflow.resume",
-	input: oi,
-	output: B,
-	openAccess: "authorization happens in the executor against the target run — the caller must be authenticated and belong to the run's tenant, and a missing run answers exactly like a foreign one"
-}), wi = j({
-	name: "__voltro.workflow.signal",
-	input: pi,
-	output: p.Struct({ eventId: p.String }),
-	openAccess: "authorization happens in the executor against the target run — the caller must be authenticated and belong to the run's tenant, and a missing run answers exactly like a foreign one"
-}), Ti = j({
-	name: "__voltro.workflow.update",
-	input: mi,
-	output: hi,
-	openAccess: "authorization happens in the executor against the target run — the caller must be authenticated and belong to the run's tenant, and a missing run answers exactly like a foreign one"
-}), Ei = p.NonEmptyString.pipe(p.check(p.makeFilter((e) => e.trim().length > 0, { message: "A workflow retry identity must not be blank" }))), Di = p.Struct({
-	runId: Ei,
-	requestId: Ei
-}), Oi = p.Struct({
-	...Di.fields,
-	payloadOverride: p.optional(p.Unknown)
-}), W = {
-	requestId: p.NonEmptyString,
-	originalRunId: p.NonEmptyString,
-	originalExecutionId: p.NonEmptyString,
-	workflowName: p.NonEmptyString
-}, ki = p.Union([
-	p.Struct({
-		...W,
-		kind: p.Literal("queued"),
-		nextAttemptAt: p.NullOr(p.Number)
-	}),
-	p.Struct({
-		...W,
-		kind: p.Literal("accepted"),
-		executionId: p.NonEmptyString
-	}).pipe(p.check(p.makeFilter((e) => e.executionId !== e.originalExecutionId, { message: "A retry cannot accept its original execution identity" }))),
-	p.Struct({
-		...W,
-		kind: p.Literal("unconfirmed"),
-		automaticRetryStopped: p.Boolean,
-		nextAttemptAt: p.NullOr(p.Number)
-	}).pipe(p.check(p.makeFilter((e) => !e.automaticRetryStopped || e.nextAttemptAt === null, { message: "Stopped automatic retries cannot have a next attempt" }))),
-	p.Struct({
-		...W,
-		kind: p.Literal("not-started"),
-		outcome: L
-	}),
-	p.Struct({
-		...W,
-		kind: p.Literal("rejected"),
-		failureId: p.NonEmptyString
-	})
-]), G = p.NonEmptyString.pipe(p.check(p.makeFilter((e) => e.trim().length > 0, { message: "A workflow restart identity must not be blank" }))), Ai = p.Union([p.Struct({ kind: p.Literal("failed-steps") }), p.Struct({
-	kind: p.Literal("from-step"),
-	stepName: G
-})]), K = p.Struct({
-	requestId: G.pipe(p.check(p.isMaxLength(64))),
-	runId: G
-}), ji = p.Struct({
-	...K.fields,
-	selection: Ai
-}), Mi = {
-	...ji.fields,
-	workflowName: G,
-	executionId: G,
-	originalGeneration: G,
-	requestedAt: p.Number.pipe(p.check(p.isFinite())),
-	dispatchAttempts: p.Number.check(p.isInt(), p.isGreaterThanOrEqualTo(0))
-}, Ni = p.Union([
-	p.Struct({
-		...K.fields,
-		kind: p.Literal("not-found")
-	}),
-	p.Struct({
-		...ji.fields,
-		kind: p.Literal("withdrawn"),
-		workflowName: G,
-		withdrawnAt: p.Number.pipe(p.check(p.isFinite()))
-	}),
-	p.Struct({
-		...Mi,
-		kind: p.Literal("pending")
-	}),
-	p.Struct({
-		...Mi,
-		kind: p.Literal("entered"),
-		enteredGeneration: G
-	}).pipe(p.check(p.makeFilter((e) => e.enteredGeneration !== e.originalGeneration && e.dispatchAttempts > 0, { message: "Restart entry requires a dispatched command and a new generation" })))
-]), Pi = p.Union([Ni, p.Struct({
-	...K.fields,
-	kind: p.Literal("not-reserved"),
-	reason: p.Literals(["admission", "journal"])
-})]), Fi = "__voltro.undo.log", Ii = "__voltro.undo.apply", Li = "__voltro.undo.redo", Ri = p.Struct({
-	id: p.String,
-	tag: p.String,
-	label: p.NullOr(p.String),
-	undone: p.Boolean,
-	crossesAction: p.Boolean,
-	createdAt: p.String
-}), zi = class extends p.TaggedError()("UndoNotFound", { invocationId: p.String }) {}, Bi = class extends p.TaggedError()("UndoForbidden", { invocationId: p.String }) {}, Vi = class extends p.TaggedError()("UndoConflict", {
-	invocationId: p.String,
-	reason: p.Literals(["conflict", "action"])
-}) {}, Hi = p.Union([
-	zi,
-	Bi,
-	Vi
-]), Ui = k({
-	name: Fi,
-	source: "_voltro_undo_log",
-	input: p.Struct({ limit: p.optional(p.Number) }),
-	output: p.Array(Ri),
-	openAccess: "subject-scoped by construction: lists only the calling subject's own undoable actions"
-}), Wi = A({
-	name: Ii,
-	input: p.Struct({ invocationId: p.String }),
-	output: p.Struct({ ok: p.Boolean }),
-	error: Hi,
-	openAccess: "subject-scoped by construction: undo is per-actor — another subject's invocation fails typed with UndoForbidden"
-}), Gi = A({
-	name: Li,
-	input: p.Struct({ invocationId: p.String }),
-	output: p.Struct({ ok: p.Boolean }),
-	error: Hi,
-	openAccess: "subject-scoped by construction: redo is per-actor — another subject's invocation fails typed with UndoForbidden"
-}), Ki = class extends p.TaggedError()("TenantScopeViolation", {
-	table: p.String,
-	reason: p.String
-}) {}, qi = class extends p.TaggedError()("StoreOperationFailed", {
-	operation: p.String,
-	table: p.String,
-	cause: p.String
-}) {
-	get message() {
-		return `${this.operation} on '${this.table}' failed: ${this.cause}`;
-	}
-}, Ji = class extends p.TaggedError()("NoRowFound", {
-	table: p.String,
-	found: p.Number
-}) {
-	get message() {
-		return this.found === 0 ? `expected exactly one row in '${this.table}', found none` : `expected exactly one row in '${this.table}', found more than one`;
-	}
-}, Yi = class extends p.TaggedError()("TableValidationFailed", {
-	table: p.String,
-	summary: p.String,
-	issues: p.Array(p.Struct({
-		path: p.String,
-		message: p.String
-	}))
-}) {
-	get message() {
-		return this.summary;
-	}
-}, Xi = class extends p.TaggedError()("TenantRowNotFound", {
-	table: p.String,
-	id: p.String,
-	reason: p.String
-}) {}, Zi = class extends p.TaggedError()("ServerOnlyColumnWrite", {
-	table: p.String,
-	columns: p.Array(p.String)
-}) {}, Qi = class extends p.TaggedError()("ConstraintViolation", {
-	kind: p.Literals([
-		"foreignKey",
-		"foreignKeyInUse",
-		"unique",
-		"notNull",
-		"check"
-	]),
-	table: p.String,
-	operation: p.String,
-	constraint: p.optional(p.String),
-	column: p.optional(p.String),
-	detail: p.optional(p.String)
-}) {
-	get message() {
-		if (this.detail !== void 0) return this.detail;
-		let e = this.constraint ?? this.column, t = e === void 0 ? `on ${this.table}` : `${e} on ${this.table}`;
-		switch (this.kind) {
-			case "foreignKey": return `foreign key ${t}: the referenced row does not exist`;
-			case "foreignKeyInUse": return `foreign key ${t}: the row is still referenced by other rows`;
-			case "unique": return `unique constraint ${t}: a row with this value already exists`;
-			case "notNull": return `not-null constraint ${t}: the column requires a value`;
-			case "check": return `check constraint ${t}: the row does not satisfy it`;
-		}
-	}
-}, $i = "__voltro.approvals.pending", ea = "__voltro.approvals.decide", ta = k({
-	name: $i,
-	source: "_voltro_approvals",
-	input: p.Struct({ limit: p.optional(p.Number) }),
-	output: p.Array(bn),
-	openAccess: "the answer is scoped to the caller — a row appears only if they requested it or hold its recorded approver scopes, so an anonymous caller sees nothing"
-}), na = A({
-	name: ea,
-	input: p.Struct({
-		approvalId: p.String,
-		decision: p.Literals(["approve", "reject"]),
-		note: p.optional(p.String)
-	}),
-	output: p.Struct({
-		approvalId: p.String,
-		status: p.Literals(["approved", "rejected"])
-	}),
-	error: yn,
-	openAccess: "the approver authority is the PENDING ROW's own recorded scopes (plus an unconditional self-approval refusal), checked in-handler — a descriptor-level scope would have to be the union of every approval-requiring procedure in the app"
-}), ra = "__voltro.connections.list", ia = "__voltro.connections.start", aa = "__voltro.connections.submitToken", oa = "__voltro.connections.disconnect", q = p.Literals(["oauth2", "pat"]), sa = p.Literals([
-	"disconnected",
-	"connected",
-	"expired",
-	"revoked",
-	"error"
-]), ca = p.Struct({
-	connectionId: p.String,
-	kind: q,
-	label: p.String,
-	status: sa,
-	accountId: p.NullOr(p.String),
-	accountLabel: p.NullOr(p.String),
-	scopes: p.Array(p.String),
-	expiresAt: p.NullOr(p.String),
-	lastError: p.NullOr(p.String),
-	connectedAt: p.NullOr(p.String)
-}), la = class extends p.TaggedError()("ConnectionNotDeclared", { connectionId: p.String }) {}, ua = class extends p.TaggedError()("ConnectionSubjectRequired", { connectionId: p.String }) {}, da = class extends p.TaggedError()("ConnectionKindMismatch", {
-	connectionId: p.String,
-	expected: q,
-	actual: q
-}) {}, fa = class extends p.TaggedError()("ConnectionHandshakeFailed", {
-	connectionId: p.String,
-	reason: p.String,
-	transient: p.Boolean
-}) {
-	get message() {
-		return this.reason;
-	}
-}, J = p.Union([
-	la,
-	ua,
-	da,
-	fa
-]), pa = k({
-	name: ra,
-	source: "_voltro_connections",
-	input: p.Struct({}),
-	output: p.Array(ca),
-	openAccess: "self-scoped read: projects the declared connections for the calling subject only (its own connect/disconnect state)"
-}), ma = j({
-	name: ia,
-	input: p.Struct({
-		connectionId: p.String,
-		redirectTo: p.optional(p.String)
-	}),
-	output: p.Struct({
-		authorizeUrl: p.String,
-		state: p.String
-	}),
-	error: J,
-	openAccess: "self-service: begins an oauth handshake that stores a credential for the calling subject only; anonymous callers fail typed with ConnectionSubjectRequired"
-}), ha = A({
-	name: aa,
-	input: p.Struct({
-		connectionId: p.String,
-		token: p.String
-	}),
-	output: p.Struct({ ok: p.Boolean }),
-	error: J,
-	openAccess: "self-service: stores a pasted token as the calling subject's own credential; anonymous callers fail typed with ConnectionSubjectRequired"
-}), ga = A({
-	name: oa,
-	input: p.Struct({ connectionId: p.String }),
-	output: p.Struct({ ok: p.Boolean }),
-	error: J,
-	openAccess: "self-service: deletes only the calling subject's own credential row for this connection"
-}), _a = (e) => {
-	let t = e instanceof Date ? e.getTime() : typeof e == "number" ? e : typeof e == "string" ? new Date(e).getTime() : 0;
-	return Number.isNaN(t) ? 0 : t;
-}, va = [
-	"app-store",
-	"play",
-	"mac-app-store",
-	"microsoft-store"
-], Y = [
-	{
-		name: "iphone-6.7",
-		label: "iPhone 6.7″ — 1290×2796",
-		kind: "phone",
-		viewport: {
-			width: 430,
-			height: 932
-		},
-		deviceScaleFactor: 3,
-		stores: ["app-store"]
-	},
-	{
-		name: "iphone-6.5",
-		label: "iPhone 6.5″ — 1242×2688",
-		kind: "phone",
-		viewport: {
-			width: 414,
-			height: 896
-		},
-		deviceScaleFactor: 3,
-		stores: ["app-store"]
-	},
-	{
-		name: "ipad-12.9",
-		label: "iPad 12.9″ — 2048×2732",
-		kind: "tablet",
-		viewport: {
-			width: 1024,
-			height: 1366
-		},
-		deviceScaleFactor: 2,
-		stores: ["app-store"]
-	},
-	{
-		name: "android-phone",
-		label: "Android phone — 1080×2160",
-		kind: "phone",
-		viewport: {
-			width: 360,
-			height: 720
-		},
-		deviceScaleFactor: 3,
-		stores: ["play"]
-	},
-	{
-		name: "android-tablet-10",
-		label: "Android 10″ tablet — 1600×2560",
-		kind: "tablet",
-		viewport: {
-			width: 800,
-			height: 1280
-		},
-		deviceScaleFactor: 2,
-		stores: ["play"]
-	},
-	{
-		name: "mac",
-		label: "Mac — 2880×1800",
-		kind: "desktop",
-		viewport: {
-			width: 1440,
-			height: 900
-		},
-		deviceScaleFactor: 2,
-		stores: ["mac-app-store"]
-	},
-	{
-		name: "windows",
-		label: "Windows — 1366×768",
-		kind: "desktop",
-		viewport: {
-			width: 1366,
-			height: 768
-		},
-		deviceScaleFactor: 1,
-		stores: ["microsoft-store"]
-	}
-], ya = Y.map((e) => e.name), ba = (e) => Y.find((t) => t.name === e), xa = (e) => ({
-	width: e.viewport.width * e.deviceScaleFactor,
-	height: e.viewport.height * e.deviceScaleFactor
-}), Sa = (e) => Y.filter((t) => t.stores.includes(e)), Ca = 4001, wa = /* @__PURE__ */ new Set(["/rpc", "/ws"]), Ta = (e) => {
-	for (let [t, n] of Object.entries(e.limits ?? {})) if (n !== void 0 && (!Number.isSafeInteger(n) || n <= 0)) throw Error(`defineWebSocket: limits.${t} must be a positive safe integer`);
-	if (!e.path.startsWith("/")) throw Error(`defineWebSocket: path must be absolute, got '${e.path}'`);
-	if (wa.has(e.path)) throw Error(`defineWebSocket: '${e.path}' is the framework's own socket surface — mount the gateway elsewhere`);
-	if (e.auth !== "subject" && e.auth !== "public") throw Error(`defineWebSocket: auth must be 'subject' or 'public' (explicitly — an unauthenticated socket has to be a decision somebody wrote down), got '${String(e.auth)}'`);
-	return e;
-}, X = (e) => typeof e == "object" && !!e && !Array.isArray(e), Z = (e, t = /* @__PURE__ */ new Map()) => {
-	let n = t.get(e);
-	if (n !== void 0) return n;
-	let r = Ea(e, t);
-	return t.set(e, r), r;
-}, Ea = (e, t) => e.encoding === void 0 ? m.isNumber(e) ? p.make(e).check(p.isFinite()).ast : m.isObjects(e) ? new m.Objects(e.propertySignatures.map((e) => new m.PropertySignature(e.name, Z(e.type, t))), e.indexSignatures.map((e) => new m.IndexSignature(e.parameter, Z(e.type, t))), e.annotations, e.checks, void 0, e.context) : m.isArrays(e) ? new m.Arrays(e.isMutable, e.elements.map((e) => Z(e, t)), e.rest.map((e) => Z(e, t)), e.annotations, e.checks, void 0, e.context) : m.isUnion(e) ? new m.Union(e.types.map((e) => Z(e, t)), e.options, e.annotations, e.checks, void 0, e.context) : m.isSuspend(e) ? new m.Suspend(() => Z(e.thunk(), t), e.annotations, e.checks, void 0, e.context) : e : e, Q = (e) => {
-	if (Array.isArray(e)) return e.map(Q);
-	if (!X(e)) return e;
-	let t = e.not;
-	if (X(t) && t.type === "null" && Object.keys(e).length === 1) return {
-		type: "object",
-		properties: {},
-		additionalProperties: !1
-	};
-	let n = e.anyOf;
-	if (Array.isArray(n)) {
-		if (n.length === 2) {
-			let t = n.find((e) => X(e) && e.type === "number"), r = n.find((e) => X(e) && e.type === "string" && Array.isArray(e.enum) && e.enum.includes("Infinity"));
-			if (X(t) && r !== void 0) {
-				let { anyOf: n, ...r } = e;
-				return Q({
-					...r,
-					...t
-				});
-			}
-		}
-		if (n.length === 1 && X(n[0])) {
-			let { anyOf: t, ...r } = e;
-			return Q({
-				...r,
-				...n[0]
-			});
-		}
-	}
-	let r = {};
-	for (let [t, n] of Object.entries(e)) r[t] = Q(n);
-	return r;
-}, Da = (e, t = {}) => {
-	let n = p.make(Z(e.ast)), r = p.toJsonSchemaDocument(n, t.closed === !1 ? {} : { onExcessProperty: "error" });
-	return {
-		schema: Q(r.schema),
-		definitions: Q(r.definitions)
-	};
-}, Oa = (e, t = {}) => {
-	let { schema: n, definitions: r } = Da(e, t);
-	return Object.keys(r).length === 0 ? n : {
-		...n,
-		$defs: r
-	};
-}, ka = "voltro-dev", Aa = "pair", $ = "voltro:pairing", ja = (e) => {
-	try {
-		let t = new URL(e);
-		return t.protocol === "http:" || t.protocol === "https:";
-	} catch {
-		return !1;
-	}
-}, Ma = (e) => {
-	try {
-		let t = new URL(e).hostname;
-		return t === "localhost" || t === "127.0.0.1" || t === "::1" || t === "[::1]";
-	} catch {
-		return !1;
-	}
-}, Na = (e) => {
-	if (!ja(e.api)) throw Error(`pairingLink: api must be an http(s) url, got ${JSON.stringify(e.api)}`);
-	if (Ma(e.api)) throw Error("pairingLink: api must be the LAN address — a device cannot reach localhost on this machine");
-	if (!/^[A-Za-z0-9_-]+$/.test(e.name)) throw Error(`pairingLink: name must be a plain identifier, got ${JSON.stringify(e.name)}`);
-	let t = new URLSearchParams({
-		api: e.api,
-		name: e.name
-	});
-	return e.token !== void 0 && e.token.length > 0 && t.set("token", e.token), `${ka}://${Aa}?${t.toString()}`;
-}, Pa = (e) => {
-	let t;
-	try {
-		t = new URL(e);
-	} catch {
-		return null;
-	}
-	if (t.protocol !== "voltro-dev:" || (t.host || t.pathname.replace(/^\/+/, "")) !== "pair") return null;
-	let n = t.searchParams.get("api") ?? "", r = t.searchParams.get("name") ?? "", i = t.searchParams.get("token");
-	return !ja(n) || Ma(n) || !/^[A-Za-z0-9_-]+$/.test(r) ? null : {
-		api: n,
-		name: r,
-		...i !== null && i.length > 0 ? { token: i } : {}
-	};
-}, Fa = (e) => "getItem" in e ? {
-	get: async (t) => e.getItem(t),
-	set: async (t, n) => {
-		await e.setItem(t, n);
-	},
-	remove: e.removeItem ? async (t) => {
-		await e.removeItem(t);
-	} : null
-} : {
-	get: async (t) => e.get(t),
-	set: async (t, n) => {
-		await e.set(t, n);
-	},
-	remove: e.remove ? async (t) => {
-		await e.remove(t);
-	} : null
-}, Ia = async (e, t) => {
-	await Fa(e).set($, JSON.stringify(t));
-}, La = async (e) => {
-	let t = await Fa(e).get($);
-	if (t === null || t === "") return null;
-	try {
-		let e = JSON.parse(t);
-		return typeof e.api != "string" || typeof e.name != "string" || !ja(e.api) ? null : {
-			api: e.api,
-			name: e.name,
-			...typeof e.token == "string" && e.token.length > 0 ? { token: e.token } : {}
-		};
-	} catch {
-		return null;
-	}
-}, Ra = async (e) => {
-	let t = Fa(e);
-	t.remove ? await t.remove($) : await t.set($, "");
-}, za = p.Struct({
-	owner: p.optional(p.Boolean),
-	roles: p.optional(p.Array(p.String)),
-	groups: p.optional(p.Array(p.String)),
-	scopes: p.optional(p.Array(p.String)),
-	tenant: p.optional(p.Boolean),
-	apiKey: p.optional(p.Boolean),
-	password: p.optional(p.Boolean),
-	guard: p.optional(p.String)
-}), Ba = p.Array(za), Va = class {
-	slots = [];
-	head = 0;
-	size = 0;
-	capacity;
-	constructor(e) {
-		this.capacity = Number.isNaN(e) ? Infinity : Math.max(0, Math.floor(e));
-	}
-	get length() {
-		return this.size;
-	}
-	get(e) {
-		if (!(!Number.isInteger(e) || e < 0 || e >= this.size)) return this.slots[(this.head + e) % this.capacity];
-	}
-	push(e) {
-		this.capacity !== 0 && (this.size < this.capacity ? (this.slots[(this.head + this.size) % this.capacity] = e, this.size++) : (this.slots[this.head] = e, this.head = (this.head + 1) % this.capacity));
-	}
-	clear() {
-		this.slots.length = 0, this.head = 0, this.size = 0;
-	}
-	*[Symbol.iterator]() {
-		for (let e = 0; e < this.size; e++) yield this.get(e);
-	}
-}, Ha = 2;
+import { applyRowPatch as e, createRowPatchApplier as t, diffRows as n, idToPath as r, isIdKeyed as i, patchCellSchema as a, pathToId as o, rowPatchOpSchema as s, rowPatchSchema as c } from "./rowPatch.js";
+import { firstEventValue as l, subscriptionEvent as u } from "./subscriptionEvent.js";
+import { RequestedTenantRefused as d, TenantSelectionRefused as f, isTenantSelectable as p, selectSubjectTenant as m } from "./tenantSelection.js";
+import { AuthMiddleware as h, ConnectionInfo as g, ConnectionInfoMiddleware as _, DEFAULT_SCOPE_CACHE_MAX_ENTRIES as v, DEFAULT_SCOPE_CACHE_TTL_MS as y, IMPERSONATION_METADATA_KEY as b, Subject as x, SubjectIdentity as S, SubjectService as C, Unauthenticated as w, anonymousSubject as T, applyScopeDecision as E, assertAuthenticated as D, bindSubjectAuthority as O, composeAuthStrategies as k, currentSubjectAuthority as A, hasCallbackRoutes as j, isMachineSubject as M, isServiceSubject as N, isSystemSubject as P, makeScopeCache as F, orderByBearerPrefix as I, rawImpersonationMark as L, reauthorizeSubject as R, scopeCacheKey as z, serviceSubject as B, subjectAuditActorId as V, subjectIdentity as H, systemSubject as U, tenantScopedSubject as W } from "./auth.js";
+import { ADMIN_SCOPE as G, APIKEY_ISSUE_ORG_SCOPE as K, APIKEY_ISSUE_OTHER_SCOPE as q, APIKEY_ISSUE_SELF_SCOPE as J, DEVICES_MANAGE_SCOPE as Y, NoSuchResource as X, ScopeError as Z, advisoryResourceGuardWarning as Q, checkGuards as $, checkGuardsEffect as ee, declaresResourceGuard as te, effectiveScopes as ne, findAdvisoryResourceGuards as re, getPolicyGuardResolver as ie, getResourceScopeResolver as ae, hasEffectiveScope as oe, hasScope as se, isAuthenticatedCheck as ce, isOpenAccess as le, isPolicyCheck as ue, isServiceAccess as de, missingAccessDecision as fe, openAccessSpec as pe, recheckGuardsEffect as me, refreshEffectiveScopes as he, requireScope as ge, resolvePolicyAction as _e, serviceAccessSpec as ve, serviceCallersOf as ye, setEffectiveScopes as be, setEffectiveScopesRefresher as xe, setPolicyGuardResolver as Se, setResourceScopeResolver as Ce, subjectScopes as we } from "./scopes.js";
+import { inputLabel as Te, strictInput as Ee } from "./strictInput.js";
+import { BusinessRuleViolation as De } from "./businessRule.js";
+import { DEFAULT_IN_FLIGHT_LEASE_MS as Oe, MUTATION_IN_FLIGHT_RETRY_AFTER_MS as ke, MutationConnectionRequired as Ae, MutationInFlight as je, beginIdempotent as Me, failIdempotent as Ne, finishIdempotent as Pe, freshFor as Fe, holdIdempotentClaim as Ie, idempotencyScope as Le, memoryIdempotencyStore as Re, wsMutationIdempotencyScope as ze } from "./idempotency.js";
+import { ValidationError as Be, ValidationErrors as Ve, ValidationIssue as He, fieldIssuesOf as Ue } from "./validation.js";
+import { ApprovalDecisionErrors as We, ApprovalErrors as Ge, ApprovalExpired as Ke, ApprovalForbidden as qe, ApprovalNotFound as Je, ApprovalNotPending as Ye, ApprovalRejected as Xe, ApprovalRequired as Ze, ApprovalSelfApproval as Qe, ApprovalUnavailable as $e, PendingApproval as et } from "./approval.js";
+import { REACTIVITY_CHANNEL_PREFIX as tt, declaredReactivityChannelKeys as nt, isReactivityChannel as rt, isReactivityChannelKey as it, normalizeSource as at, publishReactivity as ot, reactivityChannel as st, sourceKeys as ct, undeclaredChannelKeys as lt } from "./reactivityChannel.js";
+import { FRAMEWORK_WIRE_ERRORS as ut, SERVICE_NAME_PATTERN as dt, actionToRpc as ft, defineAction as pt, defineMutation as mt, defineQuery as ht, defineStream as gt, hasAccessDecision as _t, hasEnforcedGuard as vt, isAuthenticatedGuard as yt, isClientReachable as bt, isPolicyGuard as xt, isServiceReachable as St, isWireReachable as Ct, mutationToRpc as wt, normalizeDescriptor as Tt, queryToRpc as Et, streamToRpc as Dt, toRpc as Ot, wireAudienceOf as kt, wireErrorUnion as At, withRpcTag as jt, workflowWireErrorUnion as Mt } from "./procedure.js";
+import { errorMessage as Nt, errorTag as Pt, reportableError as Ft } from "./errorValue.js";
+import { EVENT_ROUTE_SEP as It, EventKeyInvalid as Lt, EventPayloadInvalid as Rt, EventPayloadTooLarge as zt, MAX_EVENT_ENVELOPE_BYTES as Bt, defineEvent as Vt, encodeEventKey as Ht, eventAttached as Ut, eventEnvelope as Wt, eventGap as Gt, eventResumePoint as Kt, eventRoute as qt, eventStreamEvent as Jt, eventSubscribeInput as Yt, eventToRpc as Xt, formatEventRoute as Zt, isEventDescriptor as Qt, parseEventRoute as $t } from "./event.js";
+import { DEV_ACTIVITY_EVENT as en } from "./devActivity.js";
+import { WorkflowAccessProperty as tn, attachWorkflowAccess as nn, getWorkflowAccess as rn, resolveWorkflowAccess as an, workflowAccessDescriptor as on } from "./workflowAccess.js";
+import { compareSurfaces as sn, groupShapeDigests as cn, procedureShapeDigest as ln, schemaShape as un, shapeDigest as dn } from "./schemaShape.js";
+import { ApiUnavailable as fn, isApiUnavailable as pn } from "./serviceCall.js";
+import { checkFrameworkCompat as mn, composeRpcInterceptors as hn, definePlugin as gn, definePluginRoute as _n, definePluginService as vn, pluginInstanceName as yn } from "./plugin.js";
+import { validateOutboxHandlerDefinition as bn } from "./outbox.js";
+import { pluginAlias as xn, pluginSlug as Sn, pluginTag as Cn, registerPluginAliases as wn, resetPluginAliases as Tn } from "./pluginNaming.js";
+import { publishServerError as En, subscribeServerErrors as Dn, withheldServerError as On } from "./serverErrorBus.js";
+import { WorkflowStartTerminalOutcomeSchema as kn } from "./workflowStartOutcome.js";
+import { WorkflowControlInputSchema as An, WorkflowControlIntentSchema as jn, WorkflowControlReadInputSchema as Mn, WorkflowControlResultSchema as Nn, WorkflowDomainEventRowSchema as Pn, WorkflowDomainEventsInputSchema as Fn, WorkflowEventDeliveriesInputSchema as In, WorkflowEventDeliveryRowSchema as Ln, WorkflowParentClosePolicySchema as Rn, WorkflowQueuedCancelInputSchema as zn, WorkflowQueuedCancellationResultSchema as Bn, WorkflowQueuedControlTargetSchema as Vn, WorkflowRunEventRowSchema as Hn, WorkflowRunHandleSchema as Un, WorkflowRunRefSchema as Wn, WorkflowRunRowSchema as Gn, WorkflowRunSnapshotSchema as Kn, WorkflowRunStatusSchema as qn, WorkflowRunStepRowSchema as Jn, WorkflowRunTableRefSchema as Yn, WorkflowRunsInputSchema as Xn, WorkflowSignalInputSchema as Zn, WorkflowStartDeferralSchema as Qn, WorkflowUpdateInputSchema as $n, WorkflowUpdateResultSchema as er, workflowCancelDescriptor as tr, workflowControlQueryDescriptor as nr, workflowDomainEventsQueryDescriptor as rr, workflowEventDeliveriesQueryDescriptor as ir, workflowQueuedCancelDescriptor as ar, workflowQueuedControlQueryDescriptor as or, workflowResumeDescriptor as sr, workflowRunEventsQueryDescriptor as cr, workflowRunQueryDescriptor as lr, workflowRunStepsQueryDescriptor as ur, workflowRunsQueryDescriptor as dr, workflowSignalDescriptor as fr, workflowToRpc as pr, workflowUpdateDescriptor as mr } from "./workflow.js";
+import { WorkflowRetryCommandSchema as hr, WorkflowRetryObservationSchema as gr, WorkflowRetryTargetSchema as _r } from "./workflowRetry.js";
+import { WorkflowRestartCommandSchema as vr, WorkflowRestartObservationSchema as yr, WorkflowRestartResultSchema as br, WorkflowRestartSelectionSchema as xr, WorkflowRestartTargetSchema as Sr } from "./workflowRestart.js";
+import { UNDO_APPLY_TAG as Cr, UNDO_LOG_TAG as wr, UNDO_REDO_TAG as Tr, UndoConflict as Er, UndoForbidden as Dr, UndoLogEntry as Or, UndoNotFound as kr, undoApplyDescriptor as Ar, undoLogQueryDescriptor as jr, undoRedoDescriptor as Mr } from "./undo.js";
+import { ConstraintViolation as Nr, NoRowFound as Pr, ServerOnlyColumnWrite as Fr, StoreOperationFailed as Ir, TableValidationFailed as Lr, TenantRowNotFound as Rr, TenantScopeViolation as zr } from "./storeErrors.js";
+import { APPROVALS_DECIDE_TAG as Br, APPROVALS_PENDING_TAG as Vr, approvalsDecideDescriptor as Hr, approvalsPendingQueryDescriptor as Ur } from "./approvalDescriptors.js";
+import { CONNECTIONS_LIST_TAG as Wr, CONNECTION_DISCONNECT_TAG as Gr, CONNECTION_START_TAG as Kr, CONNECTION_SUBMIT_TOKEN_TAG as qr, ConnectionHandshakeFailed as Jr, ConnectionKind as Yr, ConnectionKindMismatch as Xr, ConnectionNotDeclared as Zr, ConnectionState as Qr, ConnectionStatus as $r, ConnectionSubjectRequired as ei, connectionDisconnectDescriptor as ti, connectionStartDescriptor as ni, connectionSubmitTokenDescriptor as ri, connectionsListQueryDescriptor as ii } from "./connection.js";
+import { tsMs as ai } from "./time.js";
+import { STORE_SCREENSHOT_PRESETS as oi, STORE_SCREENSHOT_PRESET_NAMES as si, STORE_SCREENSHOT_STORES as ci, storeScreenshotPixels as li, storeScreenshotPreset as ui, storeScreenshotPresetsFor as di } from "./storeScreenshots.js";
+import { GATEWAY_CREDENTIAL_EXPIRED_CLOSE_CODE as fi, defineWebSocket as pi } from "./webSocketGateway.js";
+import { SESSION_HEADER_NAME as mi, sessionValueFromHeaders as hi } from "./sessionHeader.js";
+import { JSONAPI_MEDIA_TYPE as gi, PROBLEM_JSON as _i, REST_PROFILE_NAMES as vi, encodeRestError as yi, encodeRestSuccess as bi, nextLink as xi, problemDetails as Si, problemTypeOf as Ci, resolveRestFormat as wi, restViewSchema as Ti, toSnakeCase as Ei } from "./restFormat.js";
+import { finiteNumberView as Di, jsonSchemaDocumentOf as Oi, jsonSchemaOf as ki, plainJsonSchema as Ai } from "./jsonSchema.js";
+import { PAIRING_HOST as ji, PAIRING_SCHEME as Mi, PAIRING_STORAGE_KEY as Ni, applyPairing as Pi, clearPairing as Fi, pairingLink as Ii, parsePairingLink as Li, readPairing as Ri } from "./pairing.js";
+import { StorageAccessPolicySchema as zi, StorageAccessRuleSchema as Bi } from "./storageAccess.js";
+import { BoundedRing as Vi } from "./boundedRing.js";
+//#region src/index.ts
+var Hi = 2;
 //#endregion
-export { Be as ADMIN_SCOPE, Me as APIKEY_ISSUE_ORG_SCOPE, Le as APIKEY_ISSUE_OTHER_SCOPE, Ee as APIKEY_ISSUE_SELF_SCOPE, ea as APPROVALS_DECIDE_TAG, $i as APPROVALS_PENDING_TAG, Mr as ApiUnavailable, yn as ApprovalDecisionErrors, vn as ApprovalErrors, mn as ApprovalExpired, gn as ApprovalForbidden, dn as ApprovalNotFound, hn as ApprovalNotPending, pn as ApprovalRejected, un as ApprovalRequired, fn as ApprovalSelfApproval, _n as ApprovalUnavailable, re as AuthMiddleware, Va as BoundedRing, sn as BusinessRuleViolation, ra as CONNECTIONS_LIST_TAG, oa as CONNECTION_DISCONNECT_TAG, ia as CONNECTION_START_TAG, aa as CONNECTION_SUBMIT_TOKEN_TAG, fa as ConnectionHandshakeFailed, ie as ConnectionInfo, oe as ConnectionInfoMiddleware, q as ConnectionKind, da as ConnectionKindMismatch, la as ConnectionNotDeclared, ca as ConnectionState, sa as ConnectionStatus, ua as ConnectionSubjectRequired, Qi as ConstraintViolation, rt as DEFAULT_IN_FLIGHT_LEASE_MS, o as DEFAULT_SCOPE_CACHE_MAX_ENTRIES, l as DEFAULT_SCOPE_CACHE_TTL_MS, _e as DEVICES_MANAGE_SCOPE, Sr as EVENT_ROUTE_SEP, yr as EventKeyInvalid, vr as EventPayloadInvalid, br as EventPayloadTooLarge, Xn as FRAMEWORK_WIRE_ERRORS, Ca as GATEWAY_CREDENTIAL_EXPIRED_CLOSE_CODE, ne as IMPERSONATION_METADATA_KEY, yt as JSONAPI_MEDIA_TYPE, cr as MAX_EVENT_ENVELOPE_BYTES, Ct as MUTATION_IN_FLIGHT_RETRY_AFTER_MS, $e as MutationConnectionRequired, Ye as MutationInFlight, Ji as NoRowFound, d as NoSuchResource, Aa as PAIRING_HOST, ka as PAIRING_SCHEME, $ as PAIRING_STORAGE_KEY, mt as PROBLEM_JSON, Ha as PROTOCOL_VERSION, bn as PendingApproval, w as REACTIVITY_CHANNEL_PREFIX, _t as REST_PROFILE_NAMES, In as SERVICE_NAME_PATTERN, Et as SESSION_HEADER_NAME, Y as STORE_SCREENSHOT_PRESETS, ya as STORE_SCREENSHOT_PRESET_NAMES, va as STORE_SCREENSHOT_STORES, f as ScopeError, Zi as ServerOnlyColumnWrite, Ba as StorageAccessPolicySchema, za as StorageAccessRuleSchema, qi as StoreOperationFailed, ce as Subject, qe as SubjectIdentity, n as SubjectService, Yi as TableValidationFailed, Xi as TenantRowNotFound, Ki as TenantScopeViolation, ve as TenantSelectionRefused, Ii as UNDO_APPLY_TAG, Fi as UNDO_LOG_TAG, Li as UNDO_REDO_TAG, u as Unauthenticated, Vi as UndoConflict, Bi as UndoForbidden, Ri as UndoLogEntry, zi as UndoNotFound, S as ValidationError, C as ValidationErrors, cn as ValidationIssue, Er as WorkflowAccessProperty, oi as WorkflowControlInputSchema, ai as WorkflowControlIntentSchema, si as WorkflowControlReadInputSchema, B as WorkflowControlResultSchema, ei as WorkflowDomainEventRowSchema, ri as WorkflowDomainEventsInputSchema, ii as WorkflowEventDeliveriesInputSchema, ti as WorkflowEventDeliveryRowSchema, qr as WorkflowParentClosePolicySchema, li as WorkflowQueuedCancelInputSchema, V as WorkflowQueuedCancellationResultSchema, ci as WorkflowQueuedControlTargetSchema, ji as WorkflowRestartCommandSchema, Ni as WorkflowRestartObservationSchema, Pi as WorkflowRestartResultSchema, Ai as WorkflowRestartSelectionSchema, K as WorkflowRestartTargetSchema, Oi as WorkflowRetryCommandSchema, ki as WorkflowRetryObservationSchema, Di as WorkflowRetryTargetSchema, $r as WorkflowRunEventRowSchema, Yr as WorkflowRunHandleSchema, ni as WorkflowRunRefSchema, H as WorkflowRunRowSchema, z as WorkflowRunSnapshotSchema, R as WorkflowRunStatusSchema, Qr as WorkflowRunStepRowSchema, U as WorkflowRunTableRefSchema, Zr as WorkflowRunsInputSchema, pi as WorkflowSignalInputSchema, Jr as WorkflowStartDeferralSchema, L as WorkflowStartTerminalOutcomeSchema, mi as WorkflowUpdateInputSchema, hi as WorkflowUpdateResultSchema, tr as actionToRpc, be as advisoryResourceGuardWarning, c as anonymousSubject, Ia as applyPairing, Xt as applyRowPatch, de as applyScopeDecision, na as approvalsDecideDescriptor, ta as approvalsPendingQueryDescriptor, fe as assertAuthenticated, kr as attachWorkflowAccess, St as beginIdempotent, zr as checkFrameworkCompat, Ae as checkGuards, He as checkGuardsEffect, Ra as clearPairing, ct as compareSurfaces, s as composeAuthStrategies, Lr as composeRpcInterceptors, ga as connectionDisconnectDescriptor, ma as connectionStartDescriptor, ha as connectionSubmitTokenDescriptor, pa as connectionsListQueryDescriptor, Qt as createRowPatchApplier, Dn as declaredReactivityChannelKeys, xe as declaresResourceGuard, j as defineAction, ur as defineEvent, A as defineMutation, Pr as definePlugin, Fr as definePluginRoute, Rr as definePluginService, k as defineQuery, Hn as defineStream, Ta as defineWebSocket, Jt as diffRows, Ce as effectiveScopes, xr as encodeEventKey, lt as encodeRestError, nt as encodeRestSuccess, ir as errorMessage, rr as errorTag, pr as eventAttached, dr as eventEnvelope, fr as eventGap, hr as eventResumePoint, Cr as eventRoute, mr as eventStreamEvent, gr as eventSubscribeInput, _r as eventToRpc, et as failIdempotent, ln as fieldIssuesOf, Fe as findAdvisoryResourceGuards, Ze as finishIdempotent, Z as finiteNumberView, en as firstEventValue, Tr as formatEventRoute, Xe as freshFor, je as getPolicyGuardResolver, Te as getResourceScopeResolver, Ar as getWorkflowAccess, st as groupShapeDigests, Vn as hasAccessDecision, te as hasCallbackRoutes, we as hasEffectiveScope, M as hasEnforcedGuard, ge as hasScope, Qe as holdIdempotentClaim, _ as idToPath, dt as idempotencyScope, tn as inputLabel, Nr as isApiUnavailable, Ue as isAuthenticatedCheck, Bn as isAuthenticatedGuard, Pn as isClientReachable, lr as isEventDescriptor, Yt as isIdKeyed, Ie as isMachineSubject, Ke as isOpenAccess, ye as isPolicyCheck, zn as isPolicyGuard, Tn as isReactivityChannel, En as isReactivityChannelKey, Ge as isServiceAccess, Fn as isServiceReachable, ee as isServiceSubject, me as isSystemSubject, Pe as isTenantSelectable, Mn as isWireReachable, Da as jsonSchemaDocumentOf, Oa as jsonSchemaOf, pe as makeScopeCache, Je as memoryIdempotencyStore, le as missingAccessDecision, er as mutationToRpc, ht as nextLink, sr as normalizeDescriptor, kn as normalizeSource, r as openAccessSpec, he as orderByBearerPrefix, Na as pairingLink, wr as parseEventRoute, Pa as parsePairingLink, Ht as patchCellSchema, v as pathToId, Q as plainJsonSchema, Vr as pluginAlias, Ir as pluginInstanceName, Hr as pluginSlug, Kr as pluginTag, vt as problemDetails, it as problemTypeOf, tt as procedureShapeDigest, jn as publishReactivity, ot as publishServerError, $n as queryToRpc, se as rawImpersonationMark, wn as reactivityChannel, La as readPairing, Wr as registerPluginAliases, ar as reportableError, We as requireScope, Gr as resetPluginAliases, ue as resolvePolicyAction, ft as resolveRestFormat, Or as resolveWorkflowAccess, bt as restViewSchema, Wt as rowPatchOpSchema, Gt as rowPatchSchema, xt as schemaShape, e as scopeCacheKey, ze as selectSubjectTenant, a as serviceAccessSpec, i as serviceCallersOf, Se as serviceSubject, Tt as sessionValueFromHeaders, ae as setEffectiveScopes, ke as setPolicyGuardResolver, t as setResourceScopeResolver, wt as shapeDigest, On as sourceKeys, xa as storeScreenshotPixels, ba as storeScreenshotPreset, Sa as storeScreenshotPresetsFor, nr as streamToRpc, x as strictInput, Ve as subjectAuditActorId, Ne as subjectIdentity, Oe as subjectScopes, gt as subscribeServerErrors, $t as subscriptionEvent, Re as systemSubject, De as tenantScopedSubject, or as toRpc, at as toSnakeCase, _a as tsMs, An as undeclaredChannelKeys, Wi as undoApplyDescriptor, Ui as undoLogQueryDescriptor, Gi as undoRedoDescriptor, Nn as wireAudienceOf, N as wireErrorUnion, Qn as withRpcTag, pt as withheldServerError, jr as workflowAccessDescriptor, Si as workflowCancelDescriptor, fi as workflowControlQueryDescriptor, bi as workflowDomainEventsQueryDescriptor, xi as workflowEventDeliveriesQueryDescriptor, ui as workflowQueuedCancelDescriptor, di as workflowQueuedControlQueryDescriptor, Ci as workflowResumeDescriptor, yi as workflowRunEventsQueryDescriptor, gi as workflowRunQueryDescriptor, vi as workflowRunStepsQueryDescriptor, _i as workflowRunsQueryDescriptor, wi as workflowSignalDescriptor, Xr as workflowToRpc, Ti as workflowUpdateDescriptor, Zn as workflowWireErrorUnion, ut as wsMutationIdempotencyScope };
+export { G as ADMIN_SCOPE, K as APIKEY_ISSUE_ORG_SCOPE, q as APIKEY_ISSUE_OTHER_SCOPE, J as APIKEY_ISSUE_SELF_SCOPE, Br as APPROVALS_DECIDE_TAG, Vr as APPROVALS_PENDING_TAG, fn as ApiUnavailable, We as ApprovalDecisionErrors, Ge as ApprovalErrors, Ke as ApprovalExpired, qe as ApprovalForbidden, Je as ApprovalNotFound, Ye as ApprovalNotPending, Xe as ApprovalRejected, Ze as ApprovalRequired, Qe as ApprovalSelfApproval, $e as ApprovalUnavailable, h as AuthMiddleware, Vi as BoundedRing, De as BusinessRuleViolation, Wr as CONNECTIONS_LIST_TAG, Gr as CONNECTION_DISCONNECT_TAG, Kr as CONNECTION_START_TAG, qr as CONNECTION_SUBMIT_TOKEN_TAG, Jr as ConnectionHandshakeFailed, g as ConnectionInfo, _ as ConnectionInfoMiddleware, Yr as ConnectionKind, Xr as ConnectionKindMismatch, Zr as ConnectionNotDeclared, Qr as ConnectionState, $r as ConnectionStatus, ei as ConnectionSubjectRequired, Nr as ConstraintViolation, Oe as DEFAULT_IN_FLIGHT_LEASE_MS, v as DEFAULT_SCOPE_CACHE_MAX_ENTRIES, y as DEFAULT_SCOPE_CACHE_TTL_MS, Y as DEVICES_MANAGE_SCOPE, en as DEV_ACTIVITY_EVENT, It as EVENT_ROUTE_SEP, Lt as EventKeyInvalid, Rt as EventPayloadInvalid, zt as EventPayloadTooLarge, ut as FRAMEWORK_WIRE_ERRORS, fi as GATEWAY_CREDENTIAL_EXPIRED_CLOSE_CODE, b as IMPERSONATION_METADATA_KEY, gi as JSONAPI_MEDIA_TYPE, Bt as MAX_EVENT_ENVELOPE_BYTES, ke as MUTATION_IN_FLIGHT_RETRY_AFTER_MS, Ae as MutationConnectionRequired, je as MutationInFlight, Pr as NoRowFound, X as NoSuchResource, ji as PAIRING_HOST, Mi as PAIRING_SCHEME, Ni as PAIRING_STORAGE_KEY, _i as PROBLEM_JSON, Hi as PROTOCOL_VERSION, et as PendingApproval, tt as REACTIVITY_CHANNEL_PREFIX, vi as REST_PROFILE_NAMES, d as RequestedTenantRefused, dt as SERVICE_NAME_PATTERN, mi as SESSION_HEADER_NAME, oi as STORE_SCREENSHOT_PRESETS, si as STORE_SCREENSHOT_PRESET_NAMES, ci as STORE_SCREENSHOT_STORES, Z as ScopeError, Fr as ServerOnlyColumnWrite, zi as StorageAccessPolicySchema, Bi as StorageAccessRuleSchema, Ir as StoreOperationFailed, x as Subject, S as SubjectIdentity, C as SubjectService, Lr as TableValidationFailed, Rr as TenantRowNotFound, zr as TenantScopeViolation, f as TenantSelectionRefused, Cr as UNDO_APPLY_TAG, wr as UNDO_LOG_TAG, Tr as UNDO_REDO_TAG, w as Unauthenticated, Er as UndoConflict, Dr as UndoForbidden, Or as UndoLogEntry, kr as UndoNotFound, Be as ValidationError, Ve as ValidationErrors, He as ValidationIssue, tn as WorkflowAccessProperty, An as WorkflowControlInputSchema, jn as WorkflowControlIntentSchema, Mn as WorkflowControlReadInputSchema, Nn as WorkflowControlResultSchema, Pn as WorkflowDomainEventRowSchema, Fn as WorkflowDomainEventsInputSchema, In as WorkflowEventDeliveriesInputSchema, Ln as WorkflowEventDeliveryRowSchema, Rn as WorkflowParentClosePolicySchema, zn as WorkflowQueuedCancelInputSchema, Bn as WorkflowQueuedCancellationResultSchema, Vn as WorkflowQueuedControlTargetSchema, vr as WorkflowRestartCommandSchema, yr as WorkflowRestartObservationSchema, br as WorkflowRestartResultSchema, xr as WorkflowRestartSelectionSchema, Sr as WorkflowRestartTargetSchema, hr as WorkflowRetryCommandSchema, gr as WorkflowRetryObservationSchema, _r as WorkflowRetryTargetSchema, Hn as WorkflowRunEventRowSchema, Un as WorkflowRunHandleSchema, Wn as WorkflowRunRefSchema, Gn as WorkflowRunRowSchema, Kn as WorkflowRunSnapshotSchema, qn as WorkflowRunStatusSchema, Jn as WorkflowRunStepRowSchema, Yn as WorkflowRunTableRefSchema, Xn as WorkflowRunsInputSchema, Zn as WorkflowSignalInputSchema, Qn as WorkflowStartDeferralSchema, kn as WorkflowStartTerminalOutcomeSchema, $n as WorkflowUpdateInputSchema, er as WorkflowUpdateResultSchema, ft as actionToRpc, Q as advisoryResourceGuardWarning, T as anonymousSubject, Pi as applyPairing, e as applyRowPatch, E as applyScopeDecision, Hr as approvalsDecideDescriptor, Ur as approvalsPendingQueryDescriptor, D as assertAuthenticated, nn as attachWorkflowAccess, Me as beginIdempotent, O as bindSubjectAuthority, mn as checkFrameworkCompat, $ as checkGuards, ee as checkGuardsEffect, Fi as clearPairing, sn as compareSurfaces, k as composeAuthStrategies, hn as composeRpcInterceptors, ti as connectionDisconnectDescriptor, ni as connectionStartDescriptor, ri as connectionSubmitTokenDescriptor, ii as connectionsListQueryDescriptor, t as createRowPatchApplier, A as currentSubjectAuthority, nt as declaredReactivityChannelKeys, te as declaresResourceGuard, pt as defineAction, Vt as defineEvent, mt as defineMutation, gn as definePlugin, _n as definePluginRoute, vn as definePluginService, ht as defineQuery, gt as defineStream, pi as defineWebSocket, n as diffRows, ne as effectiveScopes, Ht as encodeEventKey, yi as encodeRestError, bi as encodeRestSuccess, Nt as errorMessage, Pt as errorTag, Ut as eventAttached, Wt as eventEnvelope, Gt as eventGap, Kt as eventResumePoint, qt as eventRoute, Jt as eventStreamEvent, Yt as eventSubscribeInput, Xt as eventToRpc, Ne as failIdempotent, Ue as fieldIssuesOf, re as findAdvisoryResourceGuards, Pe as finishIdempotent, Di as finiteNumberView, l as firstEventValue, Zt as formatEventRoute, Fe as freshFor, ie as getPolicyGuardResolver, ae as getResourceScopeResolver, rn as getWorkflowAccess, cn as groupShapeDigests, _t as hasAccessDecision, j as hasCallbackRoutes, oe as hasEffectiveScope, vt as hasEnforcedGuard, se as hasScope, Ie as holdIdempotentClaim, r as idToPath, Le as idempotencyScope, Te as inputLabel, pn as isApiUnavailable, ce as isAuthenticatedCheck, yt as isAuthenticatedGuard, bt as isClientReachable, Qt as isEventDescriptor, i as isIdKeyed, M as isMachineSubject, le as isOpenAccess, ue as isPolicyCheck, xt as isPolicyGuard, rt as isReactivityChannel, it as isReactivityChannelKey, de as isServiceAccess, St as isServiceReachable, N as isServiceSubject, P as isSystemSubject, p as isTenantSelectable, Ct as isWireReachable, Oi as jsonSchemaDocumentOf, ki as jsonSchemaOf, F as makeScopeCache, Re as memoryIdempotencyStore, fe as missingAccessDecision, wt as mutationToRpc, xi as nextLink, Tt as normalizeDescriptor, at as normalizeSource, pe as openAccessSpec, I as orderByBearerPrefix, Ii as pairingLink, $t as parseEventRoute, Li as parsePairingLink, a as patchCellSchema, o as pathToId, Ai as plainJsonSchema, xn as pluginAlias, yn as pluginInstanceName, Sn as pluginSlug, Cn as pluginTag, Si as problemDetails, Ci as problemTypeOf, ln as procedureShapeDigest, ot as publishReactivity, En as publishServerError, Et as queryToRpc, L as rawImpersonationMark, st as reactivityChannel, Ri as readPairing, R as reauthorizeSubject, me as recheckGuardsEffect, he as refreshEffectiveScopes, wn as registerPluginAliases, Ft as reportableError, ge as requireScope, Tn as resetPluginAliases, _e as resolvePolicyAction, wi as resolveRestFormat, an as resolveWorkflowAccess, Ti as restViewSchema, s as rowPatchOpSchema, c as rowPatchSchema, un as schemaShape, z as scopeCacheKey, m as selectSubjectTenant, ve as serviceAccessSpec, ye as serviceCallersOf, B as serviceSubject, hi as sessionValueFromHeaders, be as setEffectiveScopes, xe as setEffectiveScopesRefresher, Se as setPolicyGuardResolver, Ce as setResourceScopeResolver, dn as shapeDigest, ct as sourceKeys, li as storeScreenshotPixels, ui as storeScreenshotPreset, di as storeScreenshotPresetsFor, Dt as streamToRpc, Ee as strictInput, V as subjectAuditActorId, H as subjectIdentity, we as subjectScopes, Dn as subscribeServerErrors, u as subscriptionEvent, U as systemSubject, W as tenantScopedSubject, Ot as toRpc, Ei as toSnakeCase, ai as tsMs, lt as undeclaredChannelKeys, Ar as undoApplyDescriptor, jr as undoLogQueryDescriptor, Mr as undoRedoDescriptor, bn as validateOutboxHandlerDefinition, kt as wireAudienceOf, At as wireErrorUnion, jt as withRpcTag, On as withheldServerError, on as workflowAccessDescriptor, tr as workflowCancelDescriptor, nr as workflowControlQueryDescriptor, rr as workflowDomainEventsQueryDescriptor, ir as workflowEventDeliveriesQueryDescriptor, ar as workflowQueuedCancelDescriptor, or as workflowQueuedControlQueryDescriptor, sr as workflowResumeDescriptor, cr as workflowRunEventsQueryDescriptor, lr as workflowRunQueryDescriptor, ur as workflowRunStepsQueryDescriptor, dr as workflowRunsQueryDescriptor, fr as workflowSignalDescriptor, pr as workflowToRpc, mr as workflowUpdateDescriptor, Mt as workflowWireErrorUnion, ze as wsMutationIdempotencyScope };