@voltro/protocol 0.85.0 → 0.87.0

package/dist/index.js

@@ -1,1701 +1,55 @@
-import { $ as e, A as t, B as n, C as r, D as i, E as a, F as o, G as s, H as c, I as l, J as ee, K as te, L as ne, M as re, N as ie, O as ae, P as oe, Q as se, R as ce, S as le, T as ue, U as de, V as u, W as fe, X as pe, Y as me, Z as he, _ as ge, a as _e, at as ve, b as ye, c as be, d as xe, et as Se, f as Ce, g as we, h as Te, i as Ee, it as De, j as Oe, k as ke, l as Ae, m as je, n as Me, nt as Ne, o as d, ot as Pe, p as Fe, q as Ie, r as Le, rt as Re, s as f, st as ze, t as Be, tt as Ve, u as He, v as Ue, w as We, x as Ge, y as Ke, z as qe } from "./scopes-ClywBij8.js";
-import { A as Je, C as Ye, D as Xe, E as Ze, O as Qe, S as $e, T as et, _ as tt, a as nt, b as rt, c as it, d as at, f as ot, g as st, h as ct, i as lt, j as ut, k as dt, l as ft, m as pt, n as mt, o as ht, p as gt, r as _t, s as vt, t as yt, u as bt, v as xt, w as St, x as Ct, y as wt } from "./restFormat-BlgTLxm1.js";
-import { n as Tt, t as Et } from "./sessionHeader-DriTZhmv.js";
-import { Context as Dt, Effect as Ot, Layer as kt, Result as At, Schema as p, SchemaAST as m, SchemaGetter as jt, SchemaIssue as Mt } from "effect";
-import { Rpc as h } from "effect/rpc";
-import * as Nt from "effect/encoding/Base64";
-import * as g from "effect/SchemaAST";
-import { VersionConflict as Pt } from "@voltro/database/wire";
-//#region src/rowEquality.ts
-var Ft = (e) => e instanceof Uint8Array && Object.getPrototypeOf(e) === Uint8Array.prototype && !("toJSON" in e) && Object.keys(e).length === e.length, It = (e) => {
-	let t = Object.getPrototypeOf(e);
-	return (t === null || t === Object.prototype) && !("toJSON" in e) && !("toJSON" in Object.prototype);
-}, Lt = (e) => e == null || typeof e == "string" || typeof e == "boolean" || typeof e == "number" || Ft(e), Rt = (e, t) => {
-	let n = typeof e == "number" && !Number.isFinite(e) ? null : e, r = typeof t == "number" && !Number.isFinite(t) ? null : t;
-	if (n === r) return !0;
-	if (n instanceof Uint8Array && r instanceof Uint8Array) {
-		if (n.length !== r.length) return !1;
-		for (let e = 0; e < n.length; e++) if (n[e] !== r[e]) return !1;
-		return !0;
-	}
-	return !1;
-}, zt = (e, t) => {
-	if (!It(e) || !It(t)) return;
-	let n = Object.keys(e), r = e === t ? n : Object.keys(t);
-	if (n.length !== r.length) return;
-	let i = !0;
-	for (let r = 0; r < n.length; r++) {
-		let a = n[r];
-		if (a === "__proto__" || a in Object.prototype && Object.getOwnPropertyDescriptor(Object.prototype, a)?.set !== void 0) return;
-		let o = Object.getOwnPropertyDescriptor(e, a), s = e === t ? o : Object.getOwnPropertyDescriptor(t, a);
-		if (o === void 0 || s === void 0 || s.enumerable !== !0 || !("value" in o) || !("value" in s)) return;
-		let c = o.value, l = s.value;
-		if (!Lt(c) || !Lt(l)) return;
-		Rt(c, l) || (i = !1);
-	}
-	return i;
-}, Bt = p.Union([p.String, p.Number]), Vt = (e) => typeof e == "object" && !!e && !Array.isArray(e) && Object.keys(e).length === 1 && typeof e.$bytes == "string", Ht = p.Unknown.pipe(p.decodeTo(p.Unknown, {
-	decode: jt.transform((e) => {
-		if (!Vt(e)) return e;
-		let t = Nt.decode(e.$bytes);
-		return At.isSuccess(t) ? t.success : e;
-	}),
-	encode: jt.transform((e) => e instanceof Uint8Array ? { $bytes: Nt.encode(e) } : e instanceof Date ? e.toISOString() : e)
-})), Ut = p.Record(p.String, Ht).pipe(p.refine((e) => "id" in e, { message: "patch row must carry an id" })), Wt = p.Union([
-	p.Struct({
-		op: p.Literal("add"),
-		path: p.String,
-		value: Ut
-	}),
-	p.Struct({
-		op: p.Literal("replace"),
-		path: p.String,
-		value: Ut
-	}),
-	p.Struct({
-		op: p.Literal("remove"),
-		path: p.String
-	}),
-	p.Struct({
-		op: p.Literal("mergeCells"),
-		path: p.String,
-		value: p.Record(p.String, Ht)
-	})
-]), Gt = p.Struct({
-	ops: p.Array(Wt),
-	order: p.NullOr(p.Array(Bt))
-}), _ = (e) => `/${String(e).replace(/~/g, "~0").replace(/\//g, "~1")}`, v = (e) => (e.startsWith("/") ? e.slice(1) : e).replace(/~1/g, "/").replace(/~0/g, "~"), y = (e) => {
-	let t = Object.keys(e).sort(), n = {};
-	for (let r of t) n[r] = e[r];
-	return JSON.stringify(n);
-}, Kt = (e, t) => zt(e, t) ?? y(e) === y(t), qt = (e, t) => {
-	if (e instanceof Uint8Array && t instanceof Uint8Array) {
-		if (e.length !== t.length) return !1;
-		for (let n = 0; n < e.length; n += 1) if (e[n] !== t[n]) return !1;
-		return !0;
-	}
-	return y({
-		id: 0,
-		v: e
-	}) === y({
-		id: 0,
-		v: t
-	});
-}, Jt = (e, t, n = {}) => {
-	let r = /* @__PURE__ */ new Map();
-	for (let t of e) r.set(t.id, t);
-	let i = [], a = e.length === t.length && t.every((t, n) => t.id === e[n].id) ? null : [], o = /* @__PURE__ */ new Set(), s = n.crdt, c = (e, t) => {
-		if (s === void 0 || s.columns.size === 0) return;
-		let n = {}, r = !1;
-		for (let i of s.columns) {
-			if (!(i in t) || qt(e[i], t[i])) continue;
-			let a = s.incremental(i, e[i], t[i]);
-			if (a === void 0) return;
-			n[i] = a, r = !0;
-		}
-		if (!r) return;
-		let i = {};
-		for (let [e, n] of Object.entries(t)) s.columns.has(e) || (i[e] = n);
-		return {
-			scalars: i,
-			merges: n
-		};
-	};
-	for (let e of t) {
-		a?.push(e.id), o.add(e.id);
-		let t = r.get(e.id);
-		if (t === void 0) i.push({
-			op: "add",
-			path: _(e.id),
-			value: e
-		});
-		else if (!Kt(t, e)) {
-			let n = c(t, e);
-			n === void 0 ? i.push({
-				op: "replace",
-				path: _(e.id),
-				value: e
-			}) : (Kt(Object.fromEntries(Object.entries(t).filter(([e]) => !s.columns.has(e))), n.scalars) || i.push({
-				op: "replace",
-				path: _(e.id),
-				value: n.scalars
-			}), i.push({
-				op: "mergeCells",
-				path: _(e.id),
-				value: n.merges
-			}));
-		}
-	}
-	for (let t of e) o.has(t.id) || i.push({
-		op: "remove",
-		path: _(t.id)
-	});
-	return {
-		ops: i,
-		order: a
-	};
-}, Yt = (e) => e.every((e) => {
-	let t = e.id;
-	return typeof t == "string" || typeof t == "number";
-}), Xt = (e, t, n = {}) => {
-	let r = /* @__PURE__ */ new Map();
-	for (let t of e) r.set(t.id, t);
-	return Zt(e, t, n, r);
-}, Zt = (e, t, n, r, i) => {
-	let a = /* @__PURE__ */ new Map();
-	for (let e of t.ops) e.op === "mergeCells" && a.set(v(e.path), Object.keys(e.value));
-	for (let e of t.ops) {
-		if (e.op === "mergeCells") {
-			let t = v(e.path), i = r.get(t) ?? r.get(Number(t)), a = r.has(t) ? t : Number(t);
-			if (i === void 0) continue;
-			let o = { ...i };
-			for (let [t, r] of Object.entries(e.value)) o[t] = n.mergeCell === void 0 ? r : n.mergeCell(t, i[t], r);
-			r.set(a, o);
-			continue;
-		}
-		if (e.op === "add" && (t.order !== null || r.has(e.value.id)) && r.set(e.value.id, e.value), e.op === "replace") {
-			let n = r.get(e.value.id), i = (n === void 0 ? [] : a.get(String(e.value.id)) ?? []).filter((t) => !(t in e.value) && t in n);
-			(t.order !== null || n !== void 0) && r.set(e.value.id, i.length === 0 ? e.value : {
-				...e.value,
-				...Object.fromEntries(i.map((e) => [e, n[e]]))
-			});
-		}
-	}
-	if (t.order === null && i !== void 0) {
-		let n = e.slice();
-		for (let e of t.ops) {
-			if (e.op === "remove") continue;
-			let t = e.op === "mergeCells" ? v(e.path) : void 0, a = e.op === "mergeCells" ? r.has(t) ? t : Number(t) : e.value.id, o = i.get(a), s = r.get(a);
-			o !== void 0 && s !== void 0 && (n[o] = s);
-		}
-		return n;
-	}
-	let o = [];
-	if (t.order === null) for (let t of e) {
-		let e = r.get(t.id);
-		e !== void 0 && o.push(e);
-	}
-	else for (let e of t.order) {
-		let t = r.get(e);
-		t !== void 0 && o.push(t);
-	}
-	return o;
-}, Qt = () => {
-	let e, t, n, r = () => {
-		e = void 0, t = void 0, n = void 0;
-	}, i = (e) => {
-		let r = /* @__PURE__ */ new Map(), i = Object.getPrototypeOf(e) === Array.prototype;
-		for (let t = 0; t < e.length; t++) {
-			let n = e[t];
-			r.has(n.id) && (i = !1), r.set(n.id, t);
-		}
-		n = i ? r : void 0, t = i ? void 0 : new Map(e.map((e) => [e.id, e]));
-	};
-	return {
-		reset: r,
-		apply: (a, o, s = {}) => {
-			(a !== e || n === void 0 && t === void 0) && i(a);
-			try {
-				let r = n, c = /* @__PURE__ */ new Map(), l = Zt(a, o, s, r === void 0 ? t : {
-					get: (e) => {
-						if (c.has(e)) return c.get(e);
-						let t = r.get(e);
-						return t === void 0 ? void 0 : a[t];
-					},
-					has: (e) => c.has(e) || r.has(e),
-					set: (e, t) => {
-						c.set(e, t);
-					}
-				}, r);
-				return (o.order !== null || o.ops.some((e) => e.op === "mergeCells" && "id" in e.value)) && i(l), e = l, l;
-			} catch (e) {
-				throw r(), e;
-			}
-		}
-	};
-}, $t = (e) => p.Union([
-	p.Struct({
-		_tag: p.Literal("snapshot"),
-		revision: p.Number,
-		data: e,
-		computed: p.optional(p.Boolean),
-		reconciles: p.optional(p.String)
-	}),
-	p.Struct({
-		_tag: p.Literal("delta"),
-		revision: p.Number,
-		emittedAt: p.Number,
-		patch: Gt
-	}),
-	p.Struct({
-		_tag: p.Literal("error"),
-		error: p.Unknown,
-		revision: p.optional(p.Number)
-	})
-]), en = (e, t, n) => {
-	if (!t || typeof t != "object" || !("_tag" in t)) return t;
-	let r = t;
-	switch (r._tag) {
-		case "snapshot": return r.data;
-		case "error": throw r.error === void 0 ? Error(`${n} ${e}: the rpc refused without an error value`) : r.error;
-		case "delta": throw Error(`${n} ${e}: received a 'delta' as the first event, which should be impossible — a subscription always opens with a snapshot. This is a framework bug.`);
-		default: return t;
-	}
-}, tn = (e, t) => {
-	let n = `${e ?? "this procedure"} input`;
-	return t === !0 ? `${n} (guarded — the guard did NOT run: the payload failed to decode first, so this says nothing about access)` : n;
-}, nn = Mt.makeFormatterDefault(), rn = (e) => p.Never.annotate({ message: e.size === 0 ? "is unexpected: the input declares no keys" : `is unexpected: the input declares ${[...e].map(String).join(", ")}` }).ast, an = (e) => p.String.check(p.makeFilter((t) => e.has(t) ? "a declared key" : void 0)).ast, b = (e, t = /* @__PURE__ */ new Map()) => {
-	let n = t.get(e);
-	if (n !== void 0) return n;
-	let r = on(e, t);
-	return t.set(e, r), r;
-}, on = (e, t) => {
-	if (e.encoding !== void 0) {
-		let n = g.toEncoded(e), r = b(n, t);
-		return r === n ? e : p.make(r).pipe(p.decodeTo(p.make(e))).ast;
-	}
-	if (g.isObjects(e)) {
-		let n = e.propertySignatures.map((e) => new g.PropertySignature(e.name, b(e.type, t))), r = new Set(n.map((e) => e.name)), i = e.indexSignatures.length > 0 ? e.indexSignatures.map((e) => new g.IndexSignature(e.parameter, b(e.type, t))) : [new g.IndexSignature(an(r), rn(r))];
-		return new g.Objects(n, i, e.annotations, e.checks, void 0, e.context);
-	}
-	return g.isArrays(e) ? new g.Arrays(e.isMutable, e.elements.map((e) => b(e, t)), e.rest.map((e) => b(e, t)), e.annotations, e.checks, void 0, e.context) : g.isUnion(e) ? new g.Union(e.types.map((e) => b(e, t)), e.options, e.annotations, e.checks, void 0, e.context) : g.isSuspend(e) ? new g.Suspend(() => b(e.thunk(), t), e.annotations, e.checks, void 0, e.context) : e;
-}, x = (e, t, n) => {
-	let r = tn(t, n);
-	return p.make(b(e.ast)).pipe(p.middlewareDecoding((e) => Ot.catch(e, (e) => Ot.fail(new Mt.InvalidValue({ message: `${r}\n${nn(e)}` })))));
-}, sn = class extends p.TaggedError()("BusinessRuleViolation", {
-	rule: p.String,
-	params: p.optional(p.Record(p.String, p.Unknown)),
-	field: p.optional(p.String),
-	message: p.optional(p.String),
-	severity: p.Literals(["error", "warning"])
-}) {}, cn = p.Struct({
-	field: p.String,
-	message: p.String,
-	params: p.optional(p.Record(p.String, p.Unknown))
-}), S = class extends p.TaggedError()("ValidationError", {
-	field: p.String,
-	message: p.String,
-	params: p.optional(p.Record(p.String, p.Unknown))
-}) {}, C = class extends p.TaggedError()("ValidationErrors", { issues: p.Array(cn).pipe(p.check(p.isMinLength(1))) }) {}, ln = (e) => {
-	if (typeof e != "object" || !e) return [];
-	let t = e._tag;
-	if (t === "ValidationError") {
-		let t = e;
-		return [{
-			field: t.field,
-			message: t.message,
-			...t.params === void 0 ? {} : { params: t.params }
-		}];
-	}
-	if (t === "ValidationErrors") {
-		let t = e;
-		return Array.isArray(t.issues) ? t.issues : [];
-	}
-	if (t === "BusinessRuleViolation") {
-		let t = e;
-		if (typeof t.field != "string" || t.field.length === 0) return [];
-		let n = typeof t.message == "string" && t.message.length > 0 ? t.message : String(t.rule ?? "validation.invalid");
-		return [{
-			field: t.field,
-			message: n,
-			...t.params === void 0 ? {} : { params: t.params }
-		}];
-	}
-	return [];
-}, un = class extends p.TaggedError()("ApprovalRequired", {
-	approvalId: p.String,
-	procedure: p.String,
-	expiresAt: p.String,
-	requiredScopes: p.Array(p.String),
-	reason: p.NullOr(p.String),
-	created: p.Boolean
-}) {}, dn = class extends p.TaggedError()("ApprovalNotFound", { approvalId: p.String }) {}, fn = class extends p.TaggedError()("ApprovalSelfApproval", {
-	approvalId: p.String,
-	subjectId: p.NullOr(p.String)
-}) {}, pn = class extends p.TaggedError()("ApprovalRejected", {
-	approvalId: p.String,
-	decidedBy: p.NullOr(p.String),
-	note: p.NullOr(p.String)
-}) {}, mn = class extends p.TaggedError()("ApprovalExpired", {
-	approvalId: p.String,
-	expiredAt: p.String
-}) {}, hn = class extends p.TaggedError()("ApprovalNotPending", {
-	approvalId: p.String,
-	status: p.String
-}) {}, gn = class extends p.TaggedError()("ApprovalForbidden", {
-	approvalId: p.String,
-	required: p.NullOr(p.String),
-	message: p.String
-}) {}, _n = class extends p.TaggedError()("ApprovalUnavailable", {
-	procedure: p.String,
-	message: p.String
-}) {}, vn = p.Union([
-	un,
-	pn,
-	mn,
-	_n
-]), yn = p.Union([
-	dn,
-	fn,
-	mn,
-	hn,
-	gn,
-	_n
-]), bn = p.Struct({
-	id: p.String,
-	procedure: p.String,
-	kind: p.Literals(["mutation", "action"]),
-	requestedBy: p.NullOr(p.String),
-	status: p.Literals([
-		"pending",
-		"approved",
-		"rejected",
-		"expired",
-		"consumed"
-	]),
-	reason: p.NullOr(p.String),
-	requiredScopes: p.Array(p.String),
-	requestedAt: p.String,
-	expiresAt: p.String,
-	decidedBy: p.NullOr(p.String),
-	decidedAt: p.NullOr(p.String),
-	note: p.NullOr(p.String),
-	relation: p.Literals(["to-decide", "requested"])
-}), w = "channel:", xn = Symbol.for("@voltro/protocol/reactivityChannels"), Sn = globalThis, T = Sn[xn] ?? (Sn[xn] = /* @__PURE__ */ new Map()), Cn = /^[a-z][a-z0-9-]*(\.[a-z0-9-]+)*$/, wn = (e) => {
-	if (!Cn.test(e)) throw Error(`reactivityChannel('${e}'): invalid channel name.\n  Use lowercase kebab segments separated by dots — \`presence\`, \`job-queue\`,
-  \`billing.usage\`. A \`:\` is refused because it is the namespace separator in
-  the routing key (\`${w}<name>\`), and an uppercase letter is\n  refused because a key that differs only by case reads as one channel and
-  routes as two.`);
-	let t = T.get(e);
-	if (t !== void 0) return t;
-	let n = `${w}${e}`, r = Object.freeze({
-		kind: "reactivity-channel",
-		name: e,
-		key: n,
-		toString: () => n
-	});
-	return T.set(e, r), r;
-}, Tn = (e) => typeof e == "object" && !!e && e.kind === "reactivity-channel", En = (e) => e.startsWith(w), Dn = () => new Set([...T.values()].map((e) => e.key)), E = (e) => Tn(e) ? e.key : e, On = (e) => e === void 0 ? [] : Array.isArray(e) ? e.map(E) : [E(e)], kn = (e) => e === void 0 ? void 0 : Array.isArray(e) ? e.map(E) : E(e), An = (e) => {
-	let t = Dn(), n = [];
-	for (let r of e) for (let e of On(r.source)) En(e) && !t.has(e) && n.push({
-		procedure: r.name,
-		key: e
-	});
-	return n;
-}, jn = (e, t) => {
-	let n = e?.injectExternalChange;
-	return n !== void 0 && (n.call(e, {
-		table: t.key,
-		op: "update",
-		new: {},
-		old: {},
-		origin: "inline"
-	}), !0);
-}, Mn = (e) => e.internal !== !0, Nn = (e) => e.service === void 0 ? "client" : "service", Pn = (e) => Mn(e) && e.service === void 0, Fn = (e) => Mn(e) && e.service !== void 0, In = /^[a-z][a-z0-9-]{0,55}$/i, D = (e) => {
-	if (Rn(e), Ln(e), e.idempotencyScope !== void 0 && e.idempotencyScope !== "subject" && e.idempotencyScope !== "connection") throw Error(`${e.name}: idempotencyScope must be 'subject' or 'connection'`);
-	let t = e.serialize;
-	if (t !== void 0) {
-		if (typeof t.key != "function") throw Error(`${e.name}: serialize.key must be a function of the input`);
-		if (t.maxPending !== void 0 && (!Number.isSafeInteger(t.maxPending) || t.maxPending < 1)) throw Error(`${e.name}: serialize.maxPending must be a positive integer`);
-	}
-	if (e.idempotencyScope === "connection" && (e.internal === !0 || e.publicApi !== void 0 || e.exposeAsTool !== void 0)) throw Error(`${e.name}: connection-scoped mutations require the native WebSocket RPC surface; internal, publicApi and exposeAsTool cannot establish its connection state`);
-	if (Array.isArray(e.guards) && e.guards.length === 0) throw Error(`${e.name}: \`guards: []\` is empty, so it enforces nothing — but it reads\n  at the call site as if this procedure were protected. Omit the field for an
-  unguarded procedure, or list the scopes required to call it.`);
-	let n = typeof e.source == "string" ? [e.source] : Array.isArray(e.source) ? e.source : void 0;
-	if (n !== void 0 && (n.length === 0 || n.some((e) => String(e).trim() === ""))) throw Error(`${e.name}: \`source\` is empty, so this query declares reactivity and\n  subscribes to nothing — it serves one snapshot and never updates again,
-  which is indistinguishable from "nothing changed". Name the table(s) it
-  reads, or omit \`source\` for a non-reactive query.`);
-	if (e.internal !== !0) return e;
-	if (e.openAccess !== void 0) throw Error(`${e.name}: \`internal: true\` cannot be combined with \`openAccess\`.\n  \`internal\` takes the procedure OFF the wire, and \`openAccess\` declares who may
-  call it there — together they describe a decision about a surface that does not
-  exist. Drop \`openAccess\` (an internal procedure needs no wire decision), or drop
-  \`internal: true\` if the procedure really is meant to be callable.`);
-	if (e.overridesPlugin === !0) throw Error(`${e.name}: \`internal: true\` cannot be combined with \`overridesPlugin\`.\n  The override REMOVES the plugin route, and an internal procedure is not
-  wire-reachable — so the plugin's route would vanish with nothing callable
-  in its place, and callers would get a 404 for something that used to work.`);
-	let r = [e.publicApi === void 0 ? void 0 : "publicApi", e.exposeAsTool === void 0 ? void 0 : "exposeAsTool"].filter((e) => e !== void 0);
-	if (r.length === 0) return e;
-	throw Error(`${e.name}: \`internal: true\` cannot be combined with ${r.map((e) => `\`${e}\``).join(" or ")}. \`internal\` takes the procedure OFF the wire; those put it back ON a different one (${r.includes("publicApi") ? "a REST route" : "an agent tool"}), and that surface is projected without consulting the flag — so the procedure would be unreachable from your client and reachable from the internet. Drop \`internal: true\` if the wider surface is intended, or remove the ${r.join(" / ")} annotation if it is not.`);
-}, Ln = (e) => {
-	let t = e.service;
-	if (t === void 0) return;
-	let n = t.callers;
-	if (!Array.isArray(n) || n.length === 0) throw Error(`${e.name}: \`service.callers\` is empty, so NO app may call this procedure —\n  and no browser either. Name the calling app(s), e.g. \`service: { callers: ['worker'] }\`,
-  or drop \`service:\` if the procedure is meant for this app's own clients.`);
-	let r = n.filter((e) => typeof e != "string" || !In.test(e));
-	if (r.length > 0) throw Error(`${e.name}: \`service.callers\` holds ${r.map((e) => JSON.stringify(e)).join(", ")} — a caller is an\n  app name (letters, digits, dashes; starting with a letter; at most 56 characters), the same name this app
-  lists in \`serviceCallers\` and the caller's credential resolves to.`);
-	if (new Set(n).size !== n.length) throw Error(`${e.name}: \`service.callers\` lists the same app twice`);
-	let i = [
-		e.internal === !0 ? "`internal: true` (it removes the wire surface a service calls over)" : void 0,
-		e.publicApi === void 0 ? void 0 : "`publicApi` (a REST route is for callers that are not the listed apps)",
-		e.exposeAsTool === void 0 ? void 0 : "`exposeAsTool` (an agent tool is not one of the listed apps)",
-		e.requiresApproval === void 0 ? void 0 : "`requiresApproval` (a second HUMAN cannot approve a machine call)",
-		e.overridesPlugin === !0 ? "`overridesPlugin` (a plugin route is a client surface; replacing it with a service-only one breaks its clients)" : void 0,
-		e.idempotencyScope === "connection" ? "`idempotencyScope: 'connection'` (a service call dedups per service, across reconnects)" : void 0
-	].filter((e) => e !== void 0);
-	if (i.length !== 0) throw Error(`${e.name}: \`service:\` cannot be combined with ${i.join("; ")}.\n  A service procedure is callable only by the listed apps of this project, over the
-  socket, with their service credential. Drop the other field, or drop \`service:\`.`);
-}, Rn = (e) => {
-	let t = e.requiresApproval;
-	if (t !== void 0) {
-		if (!Array.isArray(t.approvers) || t.approvers.length === 0) throw Error(`${e.name}: \`requiresApproval.approvers\` is empty, so NOBODY can approve this\n  procedure and every call would park forever. Name the scope(s) an approver must hold
-  — e.g. \`approvers: [{ scope: 'invoices:approve' }]\`.`);
-		if (e.openAccess !== void 0) throw Error(`${e.name}: \`requiresApproval\` cannot be combined with \`openAccess\`.\n  The self-approval refusal compares subject ids, and an unauthenticated caller has
-  none — so on an open procedure every anonymous caller would count as a DIFFERENT
-  human from every other, and the second-pair-of-eyes control would enforce nothing.
-  Give the procedure a \`guards:\` decision, or drop \`requiresApproval\`.`);
-	}
-}, zn = (e) => e.action !== void 0 && e.resourceType !== void 0, Bn = (e) => e.authenticated === !0, Vn = (e) => e.openAccess !== void 0 || e.guards !== void 0 && e.guards.length > 0, O = (e, t, n, i) => {
-	if (i !== void 0) {
-		if (n !== void 0 || t !== void 0 && t.length > 0) throw Error(`${e}: \`service:\` is an access decision of its own — only the listed apps may\n  call this procedure — so it cannot sit beside \`guards:\` or \`openAccess:\`. A service
-  holds no scopes, and no user may call a service procedure. Keep exactly one.`);
-		return Array.isArray(i.callers) ? [a(i.callers)] : void 0;
-	}
-	if (n === void 0) return t;
-	if (n.trim() === "") throw Error(`${e}: \`openAccess\` needs a REASON, not an empty string. It is the sentence a\n  reviewer reads to decide whether this procedure should really be callable
-  without an authorization check — e.g. \`openAccess: 'public pricing, no caller data'\`.`);
-	if (t !== void 0 && t.length > 0) throw Error(`${e}: \`openAccess\` and \`guards\` are two different access decisions, so\n  declaring both says the procedure is protected AND open. Keep the guards if a
-  caller must hold a scope; drop them if anyone may call it.`);
-	return [r(n.trim())];
-}, k = (e) => D({
-	kind: "query",
-	name: e.name,
-	input: e.input,
-	output: e.output,
-	error: e.error ?? p.Never,
-	source: kn(e.source),
-	cache: e.cache,
-	guards: O(e.name, e.guards, e.openAccess, e.service),
-	openAccess: e.openAccess,
-	service: e.service === void 0 ? void 0 : { callers: Array.isArray(e.service.callers) ? [...e.service.callers] : e.service.callers },
-	publicApi: e.publicApi,
-	exposeAsTool: e.exposeAsTool,
-	internal: e.internal,
-	overridesPlugin: e.overridesPlugin
-}), A = (e) => D({
-	kind: "mutation",
-	name: e.name,
-	input: e.input,
-	output: e.output,
-	error: e.error ?? p.Never,
-	...e.idempotencyScope === void 0 ? {} : { idempotencyScope: e.idempotencyScope },
-	...e.serialize === void 0 ? {} : { serialize: e.serialize },
-	target: e.target,
-	guards: O(e.name, e.guards, e.openAccess, e.service),
-	openAccess: e.openAccess,
-	service: e.service === void 0 ? void 0 : { callers: Array.isArray(e.service.callers) ? [...e.service.callers] : e.service.callers },
-	publicApi: e.publicApi,
-	exposeAsTool: e.exposeAsTool,
-	requiresApproval: e.requiresApproval,
-	internal: e.internal,
-	overridesPlugin: e.overridesPlugin
-}), j = (e) => D({
-	kind: "action",
-	name: e.name,
-	input: e.input,
-	output: e.output,
-	error: e.error ?? p.Never,
-	guards: O(e.name, e.guards, e.openAccess, e.service),
-	openAccess: e.openAccess,
-	service: e.service === void 0 ? void 0 : { callers: Array.isArray(e.service.callers) ? [...e.service.callers] : e.service.callers },
-	source: e.source,
-	target: e.target,
-	publicApi: e.publicApi,
-	exposeAsTool: e.exposeAsTool,
-	requiresApproval: e.requiresApproval,
-	internal: e.internal,
-	overridesPlugin: e.overridesPlugin
-}), Hn = (e) => D({
-	kind: "stream",
-	name: e.name,
-	input: e.input,
-	element: e.element,
-	error: e.error ?? p.Never,
-	internal: e.internal,
-	overridesPlugin: e.overridesPlugin,
-	guards: O(e.name, e.guards, e.openAccess),
-	openAccess: e.openAccess
-}), Un = (e, t) => t && t.length > 0 ? p.Union([e, ...t]) : e, M = (e) => e !== void 0 && e.some((e) => !Ke(e)), Wn = (e) => p.Union([
-	e,
-	f,
-	u
-]), Gn = (e) => p.Union([e, sn]), Kn = (e) => p.Union([
-	e,
-	S,
-	C
-]), qn = (e, t) => t === void 0 ? e : p.Union([e, vn]), Jn = (e, t) => xe(t) ? p.Union([e, d]) : e, N = (e, t, n) => Un(Yn(e, t), n), Yn = (e, t) => {
-	let n = Jn(Wn(e.error), e.guards);
-	if (t === "stream" || t === "query") return n;
-	let r = t === "mutation" ? p.Union([
-		Gn(n),
-		Ye,
-		Pt
-	]) : n;
-	return qn(Kn(t === "mutation" && e.idempotencyScope === "connection" ? p.Union([r, $e]) : r), e.requiresApproval);
-}, Xn = {
-	query: [f, u],
-	stream: [f, u],
-	action: [
-		f,
-		u,
-		S,
-		C
-	],
-	mutation: [
-		f,
-		u,
-		sn,
-		Ye,
-		Pt,
-		S,
-		C
-	]
-}, Zn = (e, t) => Un(Jn(Wn(e.errorSchema), e.guards), t), Qn = (e, t) => ({
-	...e,
-	name: t
-}), $n = (e, t) => h.make(e.name, {
-	payload: x(e.input, e.name, M(e.guards)),
-	success: $t(e.output),
-	error: N(e, "query", t),
-	stream: !0
-}), er = (e, t) => h.make(e.name, {
-	payload: x(e.input, e.name, M(e.guards)),
-	success: e.output,
-	error: N(e, "mutation", t)
-}), tr = (e, t) => h.make(e.name, {
-	payload: x(e.input, e.name, M(e.guards)),
-	success: e.output,
-	error: N(e, "action", t)
-}), nr = (e, t) => h.make(e.name, {
-	payload: x(e.input, e.name, M(e.guards)),
-	success: e.element,
-	error: N(e, "stream", t),
-	stream: !0
-}), rr = (e) => {
-	if (typeof e != "object" || !e) return;
-	let t = e._tag;
-	return typeof t == "string" ? t : void 0;
-}, ir = (e) => {
-	if (typeof e == "string") return e;
-	if (typeof e == "object" && e) {
-		let t = e.message;
-		if (typeof t == "string" && t !== "") return t;
-		let n = rr(e);
-		if (n !== void 0) return n;
-	}
-	return String(e);
-}, ar = (e) => {
-	if (e instanceof Error) return e;
-	let t = Error(ir(e), { cause: e });
-	return t.name = rr(e) ?? "NonErrorThrown", t;
-}, or = (e) => {
-	switch (e.kind) {
-		case "query": return $n(e);
-		case "mutation": return er(e);
-		case "action": return tr(e);
-		case "stream": return nr(e);
-	}
-}, sr = (e) => {
-	let t = e.input, n = t === void 0 ? {} : { input: t }, r = e.output, i = r === void 0 ? {} : { output: r };
-	if (e.kind === "query") return {
-		kind: "query",
-		source: e.source,
-		...n,
-		...i
-	};
-	if (e.kind === "action") return {
-		kind: "action",
-		...n,
-		...i
-	};
-	if (e.kind === "stream") return {
-		kind: "stream",
-		...n,
-		...i
-	};
-	let a = e.target, o = e.idempotencyScope === void 0 ? {} : { idempotencyScope: e.idempotencyScope }, s = e.serialize === void 0 ? {} : { serialize: e.serialize };
-	if (a === void 0) return {
-		kind: "mutation",
-		...n,
-		...i,
-		...o,
-		...s
-	};
-	let c = Array.isArray(a) ? a : [a];
-	return {
-		kind: "mutation",
-		...n,
-		...i,
-		...o,
-		...s,
-		targets: c.map((e) => ({
-			table: e.table,
-			op: e.op,
-			..."order" in e && e.order !== void 0 ? { order: e.order } : {},
-			..."shape" in e && e.shape !== void 0 ? { shape: e.shape } : {},
-			..."identify" in e && e.identify !== void 0 ? { identify: e.identify } : {},
-			..."path" in e && e.path !== void 0 ? { path: e.path } : {},
-			..."by" in e && e.by !== void 0 ? { by: e.by } : {},
-			..."match" in e && e.match !== void 0 ? { match: e.match } : {},
-			..."shapeItem" in e && e.shapeItem !== void 0 ? { shapeItem: e.shapeItem } : {},
-			..."relations" in e && e.relations !== void 0 ? { relations: e.relations } : {}
-		}))
-	};
-}, cr = 7500, lr = (e) => typeof e == "object" && !!e && e.kind === "event", ur = (e) => {
-	if (e.name.length === 0) throw Error("defineEvent: `name` must not be empty");
-	if (/\s/.test(e.name)) throw Error(`defineEvent("${e.name}"): \`name\` must not contain whitespace.\n  The name is used as a broker subject segment. NATS refuses a subject with
-  whitespace and delivers nothing — silently, and only on that broker, so an
-  app that works on Redis stops working when the transport changes.
-  Use a dot for namespacing: "orders.paid".`);
-	if (e.guards !== void 0 && e.guards.length === 0) throw Error(`defineEvent("${e.name}"): \`guards: []\` is empty, so it enforces nothing —\n  but it reads at the call site as if the event were protected. Omit the field
-  for an unguarded event, or list the scopes that may subscribe.`);
-	if (e.openAccess !== void 0) {
-		if (e.openAccess.trim() === "") throw Error(`defineEvent("${e.name}"): \`openAccess\` needs a REASON, not an empty string. It is\n  the sentence a reviewer reads to decide whether anyone should really be able to
-  subscribe without an authorization check — e.g. \`openAccess: 'public scoreboard,
-  no caller data'\`.`);
-		if (e.guards !== void 0 && e.guards.length > 0) throw Error(`defineEvent("${e.name}"): \`openAccess\` and \`guards\` are two different access\n  decisions, so declaring both says the event is protected AND open. Keep the guards
-  if a subscriber must hold a scope; drop them if anyone may listen.`);
-	}
-	if (e.webhook?.rateLimit !== void 0 && e.webhook.rateLimit.perMinute < 1) throw Error(`defineEvent("${e.name}"): \`webhook.rateLimit.perMinute\` is ${e.webhook.rateLimit.perMinute}, which defers every delivery forever.\n  There is no "unlimited" spelling here — omit \`rateLimit\` for no ceiling.`);
-	if (e.webhook?.version !== void 0 && e.webhook.version < 1) throw Error(`defineEvent("${e.name}"): \`webhook.version\` must be >= 1 (default 1).\n  A subscriber pinned to 1 would read this event as BEHIND its own version,
-  which is the opposite of what a version bump is for.`);
-	if (e.delivery === "latest" && e.webhook !== void 0) throw Error(`defineEvent(${e.name}): \`delivery: 'latest'\` cannot be combined with \`webhook\`.\n  \`latest\` means a superseded delivery did not matter — but a webhook delivery is a
-  durable side effect at a third party, and one already sent cannot be superseded.
-  A high-rate event with an HTTP audience is also 60 deliveries per second per target;
-  the rate limit DEFERS the excess as pending rows, so it grows a table instead of failing.
-  Split them: publish the high-rate event for clients, and publish a separate, coarser
-  event (a summary, a state change) for the outside world.`);
-	return {
-		kind: "event",
-		name: e.name,
-		key: e.key,
-		payload: e.payload,
-		guards: e.openAccess === void 0 ? e.guards : [r(e.openAccess.trim())],
-		openAccess: e.openAccess,
-		rewind: e.rewind,
-		webhook: e.webhook,
-		delivery: e.delivery
-	};
-}, dr = (e) => p.Struct({
-	_tag: p.Literal("event"),
-	origin: p.String,
-	n: p.Number,
-	emittedAt: p.Number,
-	payload: e
-}), fr = p.Struct({
-	_tag: p.Literal("gap"),
-	missed: p.Number,
-	reason: p.Literals(["buffer", "resume"])
-}), pr = p.Struct({ _tag: p.Literal("attached") }), mr = (e) => p.Union([
-	pr,
-	dr(e),
-	fr
-]), hr = p.Struct({
-	origin: p.String,
-	n: p.Number
-}), gr = (e) => p.Struct({
-	key: e,
-	resume: p.optional(p.Array(hr))
-}), _r = (e, t) => {
-	let n = e.guards !== void 0 && e.guards.some((e) => !Ke(e)) ? p.Union([f, u]) : u, r = xe(e.guards) ? p.Union([n, d]) : n, i = t && t.length > 0 ? p.Union([r, ...t]) : r;
-	return h.make(e.name, {
-		payload: x(gr(e.key), e.name, M(e.guards)),
-		success: mr(e.payload),
-		error: i,
-		stream: !0
-	});
-}, vr = class extends p.TaggedError()("EventPayloadInvalid", {
-	event: p.String,
-	message: p.String
-}) {}, yr = class extends p.TaggedError()("EventKeyInvalid", {
-	event: p.String,
-	message: p.String
-}) {}, br = class extends p.TaggedError()("EventPayloadTooLarge", {
-	event: p.String,
-	bytes: p.Number,
-	limit: p.Number
-}) {}, xr = (e) => {
-	if (typeof e != "object" || !e) return JSON.stringify(e) ?? "null";
-	let t = Object.entries(e), n = 0;
-	for (let e of t) e[1] !== void 0 && (t[n++] = e);
-	return t.length = n, t.sort(([e], [t]) => e < t ? -1 : +(e > t)), JSON.stringify(t);
-}, Sr = "\0", Cr = (e, t, n) => [
-	e ?? "~",
-	t,
-	xr(n)
-].join("\0"), wr = (e) => {
-	let [t = "~", n = "", r = ""] = e.split("\0");
-	return {
-		tenantId: t === "~" ? null : t,
-		event: n,
-		key: r
-	};
-}, Tr = (e) => e.split("\0").join(" · "), Er = Symbol.for("@voltro/protocol/workflow-access"), Dr = {
-	guards: void 0,
-	openAccess: void 0,
-	internal: !1,
-	controls: void 0,
-	controlsOpenAccess: void 0
-}, Or = (e, t) => {
-	let n = t.guards;
-	if (n !== void 0 && n.length === 0) throw Error(`workflow("${e}"): \`guards: []\` is empty, so it enforces nothing —\n  but it reads at the call site as if the start were protected. Omit the field
-  and decide with \`openAccess\` or \`internal\`, or list the scopes that may start it.`);
-	if (t.openAccess !== void 0) {
-		if (t.openAccess.trim() === "") throw Error(`workflow("${e}"): \`openAccess\` needs a REASON, not an empty string. It is\n  the sentence a reviewer reads to decide whether anyone should really be able to
-  start durable work without an authorization check — e.g. \`openAccess: 'public
-  newsletter signup; the payload carries only the address being confirmed'\`.`);
-		if (n !== void 0 && n.length > 0) throw Error(`workflow("${e}"): \`openAccess\` and \`guards\` are two different access\n  decisions, so declaring both says the start is protected AND open. Keep the
-  guards if a caller must hold a scope; drop them if anyone may start it.`);
-		if (t.internal === !0) throw Error(`workflow("${e}"): \`internal: true\` cannot be combined with \`openAccess\`.\n  \`internal\` takes the start OFF the wire, and \`openAccess\` declares who may
-  start it over the wire — a decision about a door that does not exist. Drop
-  \`openAccess\` (an internal workflow needs no wire decision), or drop
-  \`internal: true\` if the workflow really is meant to be startable by clients.`);
-	}
-	let i = t.controls?.guards, a = t.controls?.openAccess;
-	if (i !== void 0 && i.length === 0) throw Error(`workflow("${e}"): \`controls: { guards: [] }\` is empty, so it enforces nothing —\n  but it reads at the call site as if driving this run were protected. Omit
-  \`controls\` (wire control is then refused for everyone but \`admin:full\`), or
-  list the scopes a caller needs to cancel or signal a run.`);
-	if (a !== void 0) {
-		if (a.trim() === "") throw Error(`workflow("${e}"): \`controls: { openAccess }\` needs a REASON, not an empty string.\n  It is the sentence a reviewer reads to decide whether anyone who can see this
-  run should be able to cancel or signal it — e.g. \`controls: { openAccess:
-  'the run belongs to the caller who started it; cancelling it affects nobody else' }\`.`);
-		if (i !== void 0 && i.length > 0) throw Error(`workflow("${e}"): \`controls\` takes \`guards\` OR \`openAccess\`, not both.\n  Two answers to one question; keep the guards if a caller needs a scope.`);
-	}
-	return {
-		guards: t.openAccess === void 0 ? t.guards : [r(t.openAccess.trim())],
-		openAccess: t.openAccess?.trim(),
-		internal: t.internal === !0,
-		controls: a === void 0 ? i : [r(a.trim())],
-		controlsOpenAccess: a?.trim()
-	};
-}, kr = (e, t) => {
-	Object.defineProperty(e, Er, {
-		value: t,
-		enumerable: !1
-	});
-}, Ar = (e) => {
-	if (typeof e != "object" && typeof e != "function" || e === null) return Dr;
-	let t = e[Er];
-	return t === void 0 ? Dr : t;
-}, jr = (e) => {
-	let t = Ar(e);
-	return {
-		name: e.name,
-		internal: t.internal,
-		guards: t.guards,
-		openAccess: t.openAccess,
-		controls: t.controls
-	};
-}, Mr = class extends p.TaggedError()("ApiUnavailable", {
-	api: p.String,
-	tag: p.String,
-	reason: p.Literals([
-		"timeout",
-		"transport",
-		"closed"
-	]),
-	message: p.String
-}) {}, Nr = (e) => typeof e == "object" && !!e && e._tag === "ApiUnavailable", Pr = (e) => e, Fr = (e) => e, Ir = (e) => {
-	let t = e.alias?.trim(), n = e.instance?.trim(), r = t !== void 0 && t !== "" ? t : e.base;
-	return n !== void 0 && n !== "" ? `${r}#${n}` : r;
-}, Lr = (e) => {
-	if (e.length !== 0) return (t, n) => e.reduceRight((e, t) => t(e, n), t);
-}, Rr = (e, t) => {
-	let n = Dt.Service(e);
-	return {
-		Tag: n,
-		Live: kt.succeed(n, t)
-	};
-}, zr = (e, t, n) => {
-	if (!t) return { ok: !0 };
-	let r = n === void 0 ? null : P(n);
-	if (!r) return {
-		ok: !0,
-		unverified: `plugin "${e}" requires framework ${t}, but the running framework version is ${n === void 0 ? "unknown" : `unreadable ("${n}")`} — not checked.`
-	};
-	let i = t.trim();
-	if (i === "*" || i === "") return { ok: !0 };
-	let a = i.split(/\s+/);
-	for (let i of a) if (!Br(i, r)) return {
-		ok: !1,
-		reason: `plugin "${e}" requires framework ${t}, running ${n}`
-	};
-	return { ok: !0 };
-}, P = (e) => {
-	let t = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9a-zA-Z.-]+))?$/.exec(e.trim());
-	return t ? {
-		major: Number(t[1]),
-		minor: Number(t[2]),
-		patch: Number(t[3]),
-		pre: t[4] ?? ""
-	} : null;
-}, F = (e, t) => e.major === t.major ? e.minor === t.minor ? e.patch === t.patch ? e.pre && !t.pre ? -1 : !e.pre && t.pre ? 1 : e.pre && t.pre ? e.pre < t.pre ? -1 : +(e.pre > t.pre) : 0 : e.patch - t.patch : e.minor - t.minor : e.major - t.major, Br = (e, t) => {
-	if (e === "*") return !0;
-	if (e.startsWith("^")) {
-		let n = P(e.slice(1));
-		return !n || t.major !== n.major ? !1 : F(t, n) >= 0;
-	}
-	if (e.startsWith("~")) {
-		let n = P(e.slice(1));
-		return !n || t.major !== n.major || t.minor !== n.minor ? !1 : F(t, n) >= 0;
-	}
-	let n = /^(>=|<=|>|<)(.+)$/.exec(e);
-	if (n) {
-		let e = n[1], r = P(n[2]);
-		if (!r) return !1;
-		let i = F(t, r);
-		if (e === ">=") return i >= 0;
-		if (e === "<=") return i <= 0;
-		if (e === ">") return i > 0;
-		if (e === "<") return i < 0;
-	}
-	let r = P(e);
-	return r ? F(t, r) === 0 : !1;
-}, Vr = (e) => {
-	let t = e.startsWith("@") ? e.replace(/^@[^/]+\//, "") : e;
-	return (t.startsWith("plugin-") ? t.slice(7) : t).replace(/-([a-zA-Z0-9])/g, (e, t) => t.toUpperCase());
-}, Hr = (e) => {
-	let t = e.startsWith("@") ? e.replace(/^@[^/]+\//, "") : e;
-	return (t.startsWith("plugin-") ? t.slice(7) : t).replace(/#/g, "--").replace(/([a-z0-9])([A-Z])/g, "$1-$2").toLowerCase();
-}, Ur = Symbol.for("@voltro/protocol/pluginAliases"), I = () => {
-	let e = globalThis, t = e[Ur];
-	if (t instanceof Map) return t;
-	let n = /* @__PURE__ */ new Map();
-	return e[Ur] = n, n;
-}, Wr = (e) => {
-	let t = I();
-	for (let [n, r] of Object.entries(e)) {
-		if (r === "") continue;
-		let e = t.get(n);
-		e === void 0 ? t.set(n, /* @__PURE__ */ new Set([r])) : e.add(r);
-	}
-}, Gr = () => {
-	I().clear();
-}, Kr = (e, t) => {
-	let n = I().get(e);
-	if (n === void 0 || n.size === 0) return `${Vr(e)}.${t}`;
-	if (n.size === 1) for (let e of n) return `${e}.${t}`;
-	let r, i = 0;
-	for (let e of n) e.includes("#") || (r = e, i++);
-	if (i === 1) return `${r}.${t}`;
-	throw Error(`[voltro] ${e} is installed more than once (${[...n].sort().join(", ")}) and no single install is the primary one, so a plugin hook cannot tell which of them it addresses. Call the route by its full tag instead — e.g. useSubscription(api, '${[...n].sort()[0]}.${t}').`);
-}, L = p.Union([
-	p.Struct({
-		kind: p.Literal("dropped"),
-		at: p.Number,
-		retryAfterMs: p.Number
-	}),
-	p.Struct({
-		kind: p.Literal("skipped"),
-		at: p.Number,
-		executionId: p.String,
-		runId: p.String
-	}),
-	p.Struct({
-		kind: p.Literal("superseded"),
-		at: p.Number
-	}),
-	p.Struct({
-		kind: p.Literal("cancelled"),
-		at: p.Number
-	}),
-	p.Struct({
-		kind: p.Literal("abandoned"),
-		at: p.Number,
-		failureId: p.NonEmptyString
-	})
-]), R = p.Literals([
-	"running",
-	"succeeded",
-	"failed",
-	"cancelled",
-	"suspended"
-]), z = p.Struct({
-	id: p.String,
-	workflowName: p.String,
-	executionId: p.String,
-	status: p.Union([R, p.Literal("unknown")]),
-	output: p.optional(p.Unknown),
-	error: p.optional(p.Struct({
-		tag: p.NullOr(p.String),
-		message: p.String
-	}))
-}), B = p.Struct({
-	operation: p.Literals(["cancel", "resume"]),
-	kind: p.Literals([
-		"accepted",
-		"confirmed",
-		"unknown",
-		"already-terminal"
-	]),
-	requestId: p.NullOr(p.NonEmptyString),
-	snapshot: z
-}).pipe(p.check(p.makeFilter((e) => e.kind === "unknown" ? !0 : e.kind === "accepted" ? e.requestId !== null && (e.snapshot.status === "running" || e.snapshot.status === "suspended") : e.kind === "already-terminal" ? e.snapshot.status === "succeeded" || e.snapshot.status === "failed" || e.snapshot.status === "cancelled" : e.operation === "cancel" ? e.snapshot.status === "cancelled" : e.requestId !== null && e.snapshot.status === "running", { message: "Workflow control acknowledgement contradicts its observed state or receipt identity" }))), V = p.Struct({
-	operation: p.Literal("cancel"),
-	workflowName: p.NonEmptyString,
-	receiptId: p.NonEmptyString,
-	requestId: p.NullOr(p.NonEmptyString),
-	kind: p.Literals([
-		"accepted",
-		"confirmed",
-		"unknown",
-		"already-terminal"
-	]),
-	observation: p.Union([
-		p.Struct({ kind: p.Literal("pending") }),
-		p.Struct({
-			kind: p.Literal("admission"),
-			outcome: p.Union([L, p.Struct({
-				kind: p.Literal("rejected"),
-				failureId: p.NonEmptyString
-			})])
-		}),
-		p.Struct({
-			kind: p.Literal("execution"),
-			snapshot: z
-		}),
-		p.Struct({
-			kind: p.Literal("unavailable"),
-			reason: p.Literals([
-				"missing-request",
-				"missing-run",
-				"unconfirmed-generation",
-				"unbound-submission"
-			])
-		})
-	])
-}).pipe(p.check(p.makeFilter((e) => {
-	let t = e.observation;
-	if (t.kind === "unavailable") return e.kind === "unknown" && (t.reason === "missing-request" ? e.requestId === null : e.requestId !== null);
-	if (e.requestId === null) return !1;
-	if (t.kind === "pending") return e.kind === "accepted";
-	if (t.kind === "admission") return e.kind === (t.outcome.kind === "cancelled" ? "confirmed" : "already-terminal");
-	let n = t.snapshot;
-	return n.workflowName !== e.workflowName || n.id.length === 0 || n.executionId.length === 0 ? !1 : e.kind === "accepted" ? n.status === "running" || n.status === "suspended" : e.kind === "confirmed" ? n.status === "cancelled" : e.kind === "already-terminal" && (n.status === "succeeded" || n.status === "failed" || n.status === "cancelled");
-}, { message: "Queued cancellation acknowledgement contradicts its receipt or observation" }))), qr = p.Literals([
-	"cancel",
-	"terminate",
-	"abandon"
-]), Jr = p.Struct({
-	mode: p.String,
-	dueAt: p.NullOr(p.Number),
-	retryAfterMs: p.NullOr(p.Number),
-	intentId: p.NullOr(p.String)
-}), Yr = p.Struct({
-	id: p.String,
-	workflowName: p.String,
-	executionId: p.NullOr(p.String),
-	status: p.Literals([
-		"running",
-		"succeeded",
-		"queued",
-		"dropped",
-		"skipped",
-		"replayed"
-	]),
-	deferral: p.optional(Jr)
-}), Xr = (e, t) => {
-	let n = Ar(e);
-	return h.make(e.name, {
-		payload: x(e.payloadSchema, e.name, M(n.guards)),
-		success: Yr,
-		error: Zn({
-			errorSchema: e.errorSchema,
-			guards: n.guards
-		}, t)
-	});
-}, H = p.Struct({
-	id: p.String,
-	tag: p.String,
-	executionId: p.String,
-	status: R,
-	payload: p.Unknown,
-	workflowVersion: p.NullOr(p.String),
-	workflowPatches: p.NullOr(p.Unknown),
-	output: p.NullOr(p.Unknown),
-	subject: p.NullOr(p.Unknown),
-	source: p.NullOr(p.String),
-	errorTag: p.NullOr(p.String),
-	errorMessage: p.NullOr(p.String),
-	cancelled: p.Boolean,
-	startedAt: p.DateFromString,
-	completedAt: p.NullOr(p.DateFromString),
-	durationMs: p.NullOr(p.Number),
-	traceId: p.NullOr(p.String),
-	parentExecutionId: p.NullOr(p.String),
-	parentClosePolicy: p.NullOr(qr)
-}), Zr = p.Struct({
-	tag: p.optional(p.String),
-	status: p.optional(R),
-	limit: p.optional(p.Number)
-}), Qr = p.Struct({
-	id: p.String,
-	runId: p.String,
-	stepName: p.String,
-	attempt: p.Number,
-	status: p.Literals([
-		"running",
-		"succeeded",
-		"failed"
-	]),
-	input: p.NullOr(p.Unknown),
-	retryPolicy: p.NullOr(p.Unknown),
-	output: p.NullOr(p.Unknown),
-	errorTag: p.NullOr(p.String),
-	errorMessage: p.NullOr(p.String),
-	errorCause: p.NullOr(p.Unknown),
-	startedAt: p.DateFromString,
-	completedAt: p.NullOr(p.DateFromString),
-	durationMs: p.NullOr(p.Number)
-}), $r = p.Struct({
-	id: p.String,
-	runId: p.String,
-	eventType: p.String,
-	payload: p.NullOr(p.Unknown),
-	occurredAt: p.DateFromString,
-	stepName: p.NullOr(p.String),
-	attempt: p.NullOr(p.Number)
-}), ei = p.Struct({
-	id: p.String,
-	name: p.String,
-	payload: p.Unknown,
-	source: p.String,
-	subject: p.NullOr(p.Unknown),
-	traceId: p.NullOr(p.String),
-	occurredAt: p.DateFromString
-}), ti = p.Struct({
-	id: p.String,
-	eventId: p.String,
-	eventName: p.String,
-	triggerId: p.String,
-	workflowName: p.String,
-	executionId: p.NullOr(p.String),
-	status: p.Literals([
-		"starting",
-		"started",
-		"skipped",
-		"failed"
-	]),
-	idempotencyKey: p.String,
-	skipped: p.Boolean,
-	errorMessage: p.NullOr(p.String),
-	createdAt: p.DateFromString,
-	completedAt: p.NullOr(p.DateFromString)
-}), ni = p.Struct({ id: p.String }), U = p.Struct({ runId: p.String }), ri = p.Struct({
-	name: p.optional(p.String),
-	limit: p.optional(p.Number)
-}), ii = p.Struct({ eventId: p.String }), ai = p.Struct({
-	requestId: p.NonEmptyString,
-	cause: p.optionalKey(p.Struct({
-		reason: p.NonEmptyString,
-		detail: p.optional(p.Record(p.String, p.Unknown))
-	}))
-}), oi = p.Struct({
-	workflowName: p.String,
-	executionId: p.String,
-	control: p.optional(ai)
-}), si = p.Struct({
-	workflowName: p.NonEmptyString,
-	executionId: p.NonEmptyString,
-	operation: p.Literals(["cancel", "resume"]),
-	requestId: p.NonEmptyString
-}), ci = p.Struct({
-	workflowName: p.NonEmptyString,
-	receiptId: p.NonEmptyString,
-	requestId: p.NonEmptyString
-}), li = p.Struct({
-	...ci.fields,
-	cause: ai.fields.cause
-}), ui = j({
-	name: "__voltro.workflow.queued.cancel",
-	input: li,
-	output: V,
-	openAccess: "authorization happens in the executor against the target run — the caller must be authenticated and belong to the run's tenant, and a missing run answers exactly like a foreign one"
-}), di = k({
-	name: "__voltro.workflow.queued.control",
-	input: ci,
-	output: V,
-	openAccess: "authorization happens in the executor against the target run — the caller must be authenticated and belong to the run's tenant, and a missing run answers exactly like a foreign one"
-}), fi = k({
-	name: "__voltro.workflow.control",
-	input: si,
-	output: B,
-	openAccess: "authorization happens in the executor against the target run — the caller must be authenticated and belong to the run's tenant, and a missing run answers exactly like a foreign one"
-}), pi = p.Struct({
-	id: p.String,
-	signalName: p.String,
-	payload: p.optional(p.Unknown)
-}), mi = p.Struct({
-	id: p.String,
-	updateName: p.String,
-	payload: p.optional(p.Unknown),
-	timeoutMs: p.optional(p.Number)
-}), hi = p.Struct({
-	eventId: p.String,
-	updateId: p.String,
-	completedEventId: p.String,
-	result: p.Unknown
-}), gi = k({
-	name: "__voltro.workflow.run",
-	source: "_voltro_workflow_runs",
-	input: ni,
-	output: p.Array(H),
-	openAccess: "the answer is scoped to the caller in the executor — a system or admin:full subject sees every row, an authenticated subject the rows of its own tenant, an anonymous caller none"
-}), _i = k({
-	name: "__voltro.workflow.runs",
-	source: "_voltro_workflow_runs",
-	input: Zr,
-	output: p.Array(H),
-	openAccess: "the answer is scoped to the caller in the executor — a system or admin:full subject sees every row, an authenticated subject the rows of its own tenant, an anonymous caller none"
-}), vi = k({
-	name: "__voltro.workflow.run.steps",
-	source: "_voltro_workflow_run_steps",
-	input: U,
-	output: p.Array(Qr),
-	openAccess: "the answer is scoped to the caller in the executor — a system or admin:full subject sees every row, an authenticated subject the rows of its own tenant, an anonymous caller none"
-}), yi = k({
-	name: "__voltro.workflow.run.events",
-	source: "_voltro_workflow_run_events",
-	input: U,
-	output: p.Array($r),
-	openAccess: "the answer is scoped to the caller in the executor — a system or admin:full subject sees every row, an authenticated subject the rows of its own tenant, an anonymous caller none"
-}), bi = k({
-	name: "__voltro.workflow.domainEvents",
-	source: "_voltro_workflow_events",
-	input: ri,
-	output: p.Array(ei),
-	openAccess: "the answer is scoped to the caller in the executor — a system or admin:full subject sees every row, an authenticated subject the rows of its own tenant, an anonymous caller none"
-}), xi = k({
-	name: "__voltro.workflow.event.deliveries",
-	source: "_voltro_workflow_event_deliveries",
-	input: ii,
-	output: p.Array(ti),
-	openAccess: "the answer is scoped to the caller in the executor — a system or admin:full subject sees every row, an authenticated subject the rows of its own tenant, an anonymous caller none"
-}), Si = j({
-	name: "__voltro.workflow.cancel",
-	input: oi,
-	output: B,
-	openAccess: "authorization happens in the executor against the target run — the caller must be authenticated and belong to the run's tenant, and a missing run answers exactly like a foreign one"
-}), Ci = j({
-	name: "__voltro.workflow.resume",
-	input: oi,
-	output: B,
-	openAccess: "authorization happens in the executor against the target run — the caller must be authenticated and belong to the run's tenant, and a missing run answers exactly like a foreign one"
-}), wi = j({
-	name: "__voltro.workflow.signal",
-	input: pi,
-	output: p.Struct({ eventId: p.String }),
-	openAccess: "authorization happens in the executor against the target run — the caller must be authenticated and belong to the run's tenant, and a missing run answers exactly like a foreign one"
-}), Ti = j({
-	name: "__voltro.workflow.update",
-	input: mi,
-	output: hi,
-	openAccess: "authorization happens in the executor against the target run — the caller must be authenticated and belong to the run's tenant, and a missing run answers exactly like a foreign one"
-}), Ei = p.NonEmptyString.pipe(p.check(p.makeFilter((e) => e.trim().length > 0, { message: "A workflow retry identity must not be blank" }))), Di = p.Struct({
-	runId: Ei,
-	requestId: Ei
-}), Oi = p.Struct({
-	...Di.fields,
-	payloadOverride: p.optional(p.Unknown)
-}), W = {
-	requestId: p.NonEmptyString,
-	originalRunId: p.NonEmptyString,
-	originalExecutionId: p.NonEmptyString,
-	workflowName: p.NonEmptyString
-}, ki = p.Union([
-	p.Struct({
-		...W,
-		kind: p.Literal("queued"),
-		nextAttemptAt: p.NullOr(p.Number)
-	}),
-	p.Struct({
-		...W,
-		kind: p.Literal("accepted"),
-		executionId: p.NonEmptyString
-	}).pipe(p.check(p.makeFilter((e) => e.executionId !== e.originalExecutionId, { message: "A retry cannot accept its original execution identity" }))),
-	p.Struct({
-		...W,
-		kind: p.Literal("unconfirmed"),
-		automaticRetryStopped: p.Boolean,
-		nextAttemptAt: p.NullOr(p.Number)
-	}).pipe(p.check(p.makeFilter((e) => !e.automaticRetryStopped || e.nextAttemptAt === null, { message: "Stopped automatic retries cannot have a next attempt" }))),
-	p.Struct({
-		...W,
-		kind: p.Literal("not-started"),
-		outcome: L
-	}),
-	p.Struct({
-		...W,
-		kind: p.Literal("rejected"),
-		failureId: p.NonEmptyString
-	})
-]), G = p.NonEmptyString.pipe(p.check(p.makeFilter((e) => e.trim().length > 0, { message: "A workflow restart identity must not be blank" }))), Ai = p.Union([p.Struct({ kind: p.Literal("failed-steps") }), p.Struct({
-	kind: p.Literal("from-step"),
-	stepName: G
-})]), K = p.Struct({
-	requestId: G.pipe(p.check(p.isMaxLength(64))),
-	runId: G
-}), ji = p.Struct({
-	...K.fields,
-	selection: Ai
-}), Mi = {
-	...ji.fields,
-	workflowName: G,
-	executionId: G,
-	originalGeneration: G,
-	requestedAt: p.Number.pipe(p.check(p.isFinite())),
-	dispatchAttempts: p.Number.check(p.isInt(), p.isGreaterThanOrEqualTo(0))
-}, Ni = p.Union([
-	p.Struct({
-		...K.fields,
-		kind: p.Literal("not-found")
-	}),
-	p.Struct({
-		...ji.fields,
-		kind: p.Literal("withdrawn"),
-		workflowName: G,
-		withdrawnAt: p.Number.pipe(p.check(p.isFinite()))
-	}),
-	p.Struct({
-		...Mi,
-		kind: p.Literal("pending")
-	}),
-	p.Struct({
-		...Mi,
-		kind: p.Literal("entered"),
-		enteredGeneration: G
-	}).pipe(p.check(p.makeFilter((e) => e.enteredGeneration !== e.originalGeneration && e.dispatchAttempts > 0, { message: "Restart entry requires a dispatched command and a new generation" })))
-]), Pi = p.Union([Ni, p.Struct({
-	...K.fields,
-	kind: p.Literal("not-reserved"),
-	reason: p.Literals(["admission", "journal"])
-})]), Fi = "__voltro.undo.log", Ii = "__voltro.undo.apply", Li = "__voltro.undo.redo", Ri = p.Struct({
-	id: p.String,
-	tag: p.String,
-	label: p.NullOr(p.String),
-	undone: p.Boolean,
-	crossesAction: p.Boolean,
-	createdAt: p.String
-}), zi = class extends p.TaggedError()("UndoNotFound", { invocationId: p.String }) {}, Bi = class extends p.TaggedError()("UndoForbidden", { invocationId: p.String }) {}, Vi = class extends p.TaggedError()("UndoConflict", {
-	invocationId: p.String,
-	reason: p.Literals(["conflict", "action"])
-}) {}, Hi = p.Union([
-	zi,
-	Bi,
-	Vi
-]), Ui = k({
-	name: Fi,
-	source: "_voltro_undo_log",
-	input: p.Struct({ limit: p.optional(p.Number) }),
-	output: p.Array(Ri),
-	openAccess: "subject-scoped by construction: lists only the calling subject's own undoable actions"
-}), Wi = A({
-	name: Ii,
-	input: p.Struct({ invocationId: p.String }),
-	output: p.Struct({ ok: p.Boolean }),
-	error: Hi,
-	openAccess: "subject-scoped by construction: undo is per-actor — another subject's invocation fails typed with UndoForbidden"
-}), Gi = A({
-	name: Li,
-	input: p.Struct({ invocationId: p.String }),
-	output: p.Struct({ ok: p.Boolean }),
-	error: Hi,
-	openAccess: "subject-scoped by construction: redo is per-actor — another subject's invocation fails typed with UndoForbidden"
-}), Ki = class extends p.TaggedError()("TenantScopeViolation", {
-	table: p.String,
-	reason: p.String
-}) {}, qi = class extends p.TaggedError()("StoreOperationFailed", {
-	operation: p.String,
-	table: p.String,
-	cause: p.String
-}) {
-	get message() {
-		return `${this.operation} on '${this.table}' failed: ${this.cause}`;
-	}
-}, Ji = class extends p.TaggedError()("NoRowFound", {
-	table: p.String,
-	found: p.Number
-}) {
-	get message() {
-		return this.found === 0 ? `expected exactly one row in '${this.table}', found none` : `expected exactly one row in '${this.table}', found more than one`;
-	}
-}, Yi = class extends p.TaggedError()("TableValidationFailed", {
-	table: p.String,
-	summary: p.String,
-	issues: p.Array(p.Struct({
-		path: p.String,
-		message: p.String
-	}))
-}) {
-	get message() {
-		return this.summary;
-	}
-}, Xi = class extends p.TaggedError()("TenantRowNotFound", {
-	table: p.String,
-	id: p.String,
-	reason: p.String
-}) {}, Zi = class extends p.TaggedError()("ServerOnlyColumnWrite", {
-	table: p.String,
-	columns: p.Array(p.String)
-}) {}, Qi = class extends p.TaggedError()("ConstraintViolation", {
-	kind: p.Literals([
-		"foreignKey",
-		"foreignKeyInUse",
-		"unique",
-		"notNull",
-		"check"
-	]),
-	table: p.String,
-	operation: p.String,
-	constraint: p.optional(p.String),
-	column: p.optional(p.String),
-	detail: p.optional(p.String)
-}) {
-	get message() {
-		if (this.detail !== void 0) return this.detail;
-		let e = this.constraint ?? this.column, t = e === void 0 ? `on ${this.table}` : `${e} on ${this.table}`;
-		switch (this.kind) {
-			case "foreignKey": return `foreign key ${t}: the referenced row does not exist`;
-			case "foreignKeyInUse": return `foreign key ${t}: the row is still referenced by other rows`;
-			case "unique": return `unique constraint ${t}: a row with this value already exists`;
-			case "notNull": return `not-null constraint ${t}: the column requires a value`;
-			case "check": return `check constraint ${t}: the row does not satisfy it`;
-		}
-	}
-}, $i = "__voltro.approvals.pending", ea = "__voltro.approvals.decide", ta = k({
-	name: $i,
-	source: "_voltro_approvals",
-	input: p.Struct({ limit: p.optional(p.Number) }),
-	output: p.Array(bn),
-	openAccess: "the answer is scoped to the caller — a row appears only if they requested it or hold its recorded approver scopes, so an anonymous caller sees nothing"
-}), na = A({
-	name: ea,
-	input: p.Struct({
-		approvalId: p.String,
-		decision: p.Literals(["approve", "reject"]),
-		note: p.optional(p.String)
-	}),
-	output: p.Struct({
-		approvalId: p.String,
-		status: p.Literals(["approved", "rejected"])
-	}),
-	error: yn,
-	openAccess: "the approver authority is the PENDING ROW's own recorded scopes (plus an unconditional self-approval refusal), checked in-handler — a descriptor-level scope would have to be the union of every approval-requiring procedure in the app"
-}), ra = "__voltro.connections.list", ia = "__voltro.connections.start", aa = "__voltro.connections.submitToken", oa = "__voltro.connections.disconnect", q = p.Literals(["oauth2", "pat"]), sa = p.Literals([
-	"disconnected",
-	"connected",
-	"expired",
-	"revoked",
-	"error"
-]), ca = p.Struct({
-	connectionId: p.String,
-	kind: q,
-	label: p.String,
-	status: sa,
-	accountId: p.NullOr(p.String),
-	accountLabel: p.NullOr(p.String),
-	scopes: p.Array(p.String),
-	expiresAt: p.NullOr(p.String),
-	lastError: p.NullOr(p.String),
-	connectedAt: p.NullOr(p.String)
-}), la = class extends p.TaggedError()("ConnectionNotDeclared", { connectionId: p.String }) {}, ua = class extends p.TaggedError()("ConnectionSubjectRequired", { connectionId: p.String }) {}, da = class extends p.TaggedError()("ConnectionKindMismatch", {
-	connectionId: p.String,
-	expected: q,
-	actual: q
-}) {}, fa = class extends p.TaggedError()("ConnectionHandshakeFailed", {
-	connectionId: p.String,
-	reason: p.String,
-	transient: p.Boolean
-}) {
-	get message() {
-		return this.reason;
-	}
-}, J = p.Union([
-	la,
-	ua,
-	da,
-	fa
-]), pa = k({
-	name: ra,
-	source: "_voltro_connections",
-	input: p.Struct({}),
-	output: p.Array(ca),
-	openAccess: "self-scoped read: projects the declared connections for the calling subject only (its own connect/disconnect state)"
-}), ma = j({
-	name: ia,
-	input: p.Struct({
-		connectionId: p.String,
-		redirectTo: p.optional(p.String)
-	}),
-	output: p.Struct({
-		authorizeUrl: p.String,
-		state: p.String
-	}),
-	error: J,
-	openAccess: "self-service: begins an oauth handshake that stores a credential for the calling subject only; anonymous callers fail typed with ConnectionSubjectRequired"
-}), ha = A({
-	name: aa,
-	input: p.Struct({
-		connectionId: p.String,
-		token: p.String
-	}),
-	output: p.Struct({ ok: p.Boolean }),
-	error: J,
-	openAccess: "self-service: stores a pasted token as the calling subject's own credential; anonymous callers fail typed with ConnectionSubjectRequired"
-}), ga = A({
-	name: oa,
-	input: p.Struct({ connectionId: p.String }),
-	output: p.Struct({ ok: p.Boolean }),
-	error: J,
-	openAccess: "self-service: deletes only the calling subject's own credential row for this connection"
-}), _a = (e) => {
-	let t = e instanceof Date ? e.getTime() : typeof e == "number" ? e : typeof e == "string" ? new Date(e).getTime() : 0;
-	return Number.isNaN(t) ? 0 : t;
-}, va = [
-	"app-store",
-	"play",
-	"mac-app-store",
-	"microsoft-store"
-], Y = [
-	{
-		name: "iphone-6.7",
-		label: "iPhone 6.7″ — 1290×2796",
-		kind: "phone",
-		viewport: {
-			width: 430,
-			height: 932
-		},
-		deviceScaleFactor: 3,
-		stores: ["app-store"]
-	},
-	{
-		name: "iphone-6.5",
-		label: "iPhone 6.5″ — 1242×2688",
-		kind: "phone",
-		viewport: {
-			width: 414,
-			height: 896
-		},
-		deviceScaleFactor: 3,
-		stores: ["app-store"]
-	},
-	{
-		name: "ipad-12.9",
-		label: "iPad 12.9″ — 2048×2732",
-		kind: "tablet",
-		viewport: {
-			width: 1024,
-			height: 1366
-		},
-		deviceScaleFactor: 2,
-		stores: ["app-store"]
-	},
-	{
-		name: "android-phone",
-		label: "Android phone — 1080×2160",
-		kind: "phone",
-		viewport: {
-			width: 360,
-			height: 720
-		},
-		deviceScaleFactor: 3,
-		stores: ["play"]
-	},
-	{
-		name: "android-tablet-10",
-		label: "Android 10″ tablet — 1600×2560",
-		kind: "tablet",
-		viewport: {
-			width: 800,
-			height: 1280
-		},
-		deviceScaleFactor: 2,
-		stores: ["play"]
-	},
-	{
-		name: "mac",
-		label: "Mac — 2880×1800",
-		kind: "desktop",
-		viewport: {
-			width: 1440,
-			height: 900
-		},
-		deviceScaleFactor: 2,
-		stores: ["mac-app-store"]
-	},
-	{
-		name: "windows",
-		label: "Windows — 1366×768",
-		kind: "desktop",
-		viewport: {
-			width: 1366,
-			height: 768
-		},
-		deviceScaleFactor: 1,
-		stores: ["microsoft-store"]
-	}
-], ya = Y.map((e) => e.name), ba = (e) => Y.find((t) => t.name === e), xa = (e) => ({
-	width: e.viewport.width * e.deviceScaleFactor,
-	height: e.viewport.height * e.deviceScaleFactor
-}), Sa = (e) => Y.filter((t) => t.stores.includes(e)), Ca = 4001, wa = /* @__PURE__ */ new Set(["/rpc", "/ws"]), Ta = (e) => {
-	for (let [t, n] of Object.entries(e.limits ?? {})) if (n !== void 0 && (!Number.isSafeInteger(n) || n <= 0)) throw Error(`defineWebSocket: limits.${t} must be a positive safe integer`);
-	if (!e.path.startsWith("/")) throw Error(`defineWebSocket: path must be absolute, got '${e.path}'`);
-	if (wa.has(e.path)) throw Error(`defineWebSocket: '${e.path}' is the framework's own socket surface — mount the gateway elsewhere`);
-	if (e.auth !== "subject" && e.auth !== "public") throw Error(`defineWebSocket: auth must be 'subject' or 'public' (explicitly — an unauthenticated socket has to be a decision somebody wrote down), got '${String(e.auth)}'`);
-	return e;
-}, X = (e) => typeof e == "object" && !!e && !Array.isArray(e), Z = (e, t = /* @__PURE__ */ new Map()) => {
-	let n = t.get(e);
-	if (n !== void 0) return n;
-	let r = Ea(e, t);
-	return t.set(e, r), r;
-}, Ea = (e, t) => e.encoding === void 0 ? m.isNumber(e) ? p.make(e).check(p.isFinite()).ast : m.isObjects(e) ? new m.Objects(e.propertySignatures.map((e) => new m.PropertySignature(e.name, Z(e.type, t))), e.indexSignatures.map((e) => new m.IndexSignature(e.parameter, Z(e.type, t))), e.annotations, e.checks, void 0, e.context) : m.isArrays(e) ? new m.Arrays(e.isMutable, e.elements.map((e) => Z(e, t)), e.rest.map((e) => Z(e, t)), e.annotations, e.checks, void 0, e.context) : m.isUnion(e) ? new m.Union(e.types.map((e) => Z(e, t)), e.options, e.annotations, e.checks, void 0, e.context) : m.isSuspend(e) ? new m.Suspend(() => Z(e.thunk(), t), e.annotations, e.checks, void 0, e.context) : e : e, Q = (e) => {
-	if (Array.isArray(e)) return e.map(Q);
-	if (!X(e)) return e;
-	let t = e.not;
-	if (X(t) && t.type === "null" && Object.keys(e).length === 1) return {
-		type: "object",
-		properties: {},
-		additionalProperties: !1
-	};
-	let n = e.anyOf;
-	if (Array.isArray(n)) {
-		if (n.length === 2) {
-			let t = n.find((e) => X(e) && e.type === "number"), r = n.find((e) => X(e) && e.type === "string" && Array.isArray(e.enum) && e.enum.includes("Infinity"));
-			if (X(t) && r !== void 0) {
-				let { anyOf: n, ...r } = e;
-				return Q({
-					...r,
-					...t
-				});
-			}
-		}
-		if (n.length === 1 && X(n[0])) {
-			let { anyOf: t, ...r } = e;
-			return Q({
-				...r,
-				...n[0]
-			});
-		}
-	}
-	let r = {};
-	for (let [t, n] of Object.entries(e)) r[t] = Q(n);
-	return r;
-}, Da = (e, t = {}) => {
-	let n = p.make(Z(e.ast)), r = p.toJsonSchemaDocument(n, t.closed === !1 ? {} : { onExcessProperty: "error" });
-	return {
-		schema: Q(r.schema),
-		definitions: Q(r.definitions)
-	};
-}, Oa = (e, t = {}) => {
-	let { schema: n, definitions: r } = Da(e, t);
-	return Object.keys(r).length === 0 ? n : {
-		...n,
-		$defs: r
-	};
-}, ka = "voltro-dev", Aa = "pair", $ = "voltro:pairing", ja = (e) => {
-	try {
-		let t = new URL(e);
-		return t.protocol === "http:" || t.protocol === "https:";
-	} catch {
-		return !1;
-	}
-}, Ma = (e) => {
-	try {
-		let t = new URL(e).hostname;
-		return t === "localhost" || t === "127.0.0.1" || t === "::1" || t === "[::1]";
-	} catch {
-		return !1;
-	}
-}, Na = (e) => {
-	if (!ja(e.api)) throw Error(`pairingLink: api must be an http(s) url, got ${JSON.stringify(e.api)}`);
-	if (Ma(e.api)) throw Error("pairingLink: api must be the LAN address — a device cannot reach localhost on this machine");
-	if (!/^[A-Za-z0-9_-]+$/.test(e.name)) throw Error(`pairingLink: name must be a plain identifier, got ${JSON.stringify(e.name)}`);
-	let t = new URLSearchParams({
-		api: e.api,
-		name: e.name
-	});
-	return e.token !== void 0 && e.token.length > 0 && t.set("token", e.token), `${ka}://${Aa}?${t.toString()}`;
-}, Pa = (e) => {
-	let t;
-	try {
-		t = new URL(e);
-	} catch {
-		return null;
-	}
-	if (t.protocol !== "voltro-dev:" || (t.host || t.pathname.replace(/^\/+/, "")) !== "pair") return null;
-	let n = t.searchParams.get("api") ?? "", r = t.searchParams.get("name") ?? "", i = t.searchParams.get("token");
-	return !ja(n) || Ma(n) || !/^[A-Za-z0-9_-]+$/.test(r) ? null : {
-		api: n,
-		name: r,
-		...i !== null && i.length > 0 ? { token: i } : {}
-	};
-}, Fa = (e) => "getItem" in e ? {
-	get: async (t) => e.getItem(t),
-	set: async (t, n) => {
-		await e.setItem(t, n);
-	},
-	remove: e.removeItem ? async (t) => {
-		await e.removeItem(t);
-	} : null
-} : {
-	get: async (t) => e.get(t),
-	set: async (t, n) => {
-		await e.set(t, n);
-	},
-	remove: e.remove ? async (t) => {
-		await e.remove(t);
-	} : null
-}, Ia = async (e, t) => {
-	await Fa(e).set($, JSON.stringify(t));
-}, La = async (e) => {
-	let t = await Fa(e).get($);
-	if (t === null || t === "") return null;
-	try {
-		let e = JSON.parse(t);
-		return typeof e.api != "string" || typeof e.name != "string" || !ja(e.api) ? null : {
-			api: e.api,
-			name: e.name,
-			...typeof e.token == "string" && e.token.length > 0 ? { token: e.token } : {}
-		};
-	} catch {
-		return null;
-	}
-}, Ra = async (e) => {
-	let t = Fa(e);
-	t.remove ? await t.remove($) : await t.set($, "");
-}, za = p.Struct({
-	owner: p.optional(p.Boolean),
-	roles: p.optional(p.Array(p.String)),
-	groups: p.optional(p.Array(p.String)),
-	scopes: p.optional(p.Array(p.String)),
-	tenant: p.optional(p.Boolean),
-	apiKey: p.optional(p.Boolean),
-	password: p.optional(p.Boolean),
-	guard: p.optional(p.String)
-}), Ba = p.Array(za), Va = class {
-	slots = [];
-	head = 0;
-	size = 0;
-	capacity;
-	constructor(e) {
-		this.capacity = Number.isNaN(e) ? Infinity : Math.max(0, Math.floor(e));
-	}
-	get length() {
-		return this.size;
-	}
-	get(e) {
-		if (!(!Number.isInteger(e) || e < 0 || e >= this.size)) return this.slots[(this.head + e) % this.capacity];
-	}
-	push(e) {
-		this.capacity !== 0 && (this.size < this.capacity ? (this.slots[(this.head + this.size) % this.capacity] = e, this.size++) : (this.slots[this.head] = e, this.head = (this.head + 1) % this.capacity));
-	}
-	clear() {
-		this.slots.length = 0, this.head = 0, this.size = 0;
-	}
-	*[Symbol.iterator]() {
-		for (let e = 0; e < this.size; e++) yield this.get(e);
-	}
-}, Ha = 2;
+import { applyRowPatch as e, createRowPatchApplier as t, diffRows as n, idToPath as r, isIdKeyed as i, patchCellSchema as a, pathToId as o, rowPatchOpSchema as s, rowPatchSchema as c } from "./rowPatch.js";
+import { firstEventValue as l, subscriptionEvent as u } from "./subscriptionEvent.js";
+import { RequestedTenantRefused as d, TenantSelectionRefused as f, isTenantSelectable as p, selectSubjectTenant as m } from "./tenantSelection.js";
+import { AuthMiddleware as h, ConnectionInfo as g, ConnectionInfoMiddleware as _, DEFAULT_SCOPE_CACHE_MAX_ENTRIES as v, DEFAULT_SCOPE_CACHE_TTL_MS as y, IMPERSONATION_METADATA_KEY as b, Subject as x, SubjectIdentity as S, SubjectService as C, Unauthenticated as w, anonymousSubject as T, applyScopeDecision as E, assertAuthenticated as D, bindSubjectAuthority as O, composeAuthStrategies as k, currentSubjectAuthority as A, hasCallbackRoutes as j, isMachineSubject as M, isServiceSubject as N, isSystemSubject as P, makeScopeCache as F, orderByBearerPrefix as I, rawImpersonationMark as L, reauthorizeSubject as R, resolveIdentityAuthority as z, scopeCacheKey as B, serviceSubject as V, subjectAuditActorId as H, subjectIdentity as U, systemSubject as W, tenantScopedSubject as G } from "./auth.js";
+import { ADMIN_SCOPE as K, APIKEY_ISSUE_ORG_SCOPE as q, APIKEY_ISSUE_OTHER_SCOPE as J, APIKEY_ISSUE_SELF_SCOPE as Y, DEVICES_MANAGE_SCOPE as X, NoSuchResource as Z, ScopeError as Q, advisoryResourceGuardWarning as $, checkGuards as ee, checkGuardsEffect as te, declaresResourceGuard as ne, effectiveScopes as re, findAdvisoryResourceGuards as ie, getPolicyGuardResolver as ae, getResourceScopeResolver as oe, hasEffectiveScope as se, hasScope as ce, isAuthenticatedCheck as le, isOpenAccess as ue, isPolicyCheck as de, isServiceAccess as fe, isUpgradedCheck as pe, missingAccessDecision as me, openAccessSpec as he, recheckGuardsEffect as ge, refreshEffectiveScopes as _e, requireScope as ve, resolvePolicyAction as ye, serviceAccessSpec as be, serviceCallersOf as xe, setEffectiveScopes as Se, setEffectiveScopesRefresher as Ce, setPolicyGuardResolver as we, setResourceScopeResolver as Te, subjectScopes as Ee, upgradedGuardShapeError as De } from "./scopes.js";
+import { inputLabel as Oe, strictInput as ke } from "./strictInput.js";
+import { BusinessRuleViolation as Ae } from "./businessRule.js";
+import { DEFAULT_IN_FLIGHT_LEASE_MS as je, MUTATION_IN_FLIGHT_RETRY_AFTER_MS as Me, MutationConnectionRequired as Ne, MutationIdempotencyRefused as Pe, MutationInFlight as Fe, beginIdempotent as Ie, failIdempotent as Le, finishIdempotent as Re, freshFor as ze, holdIdempotentClaim as Be, idempotencyScope as Ve, memoryIdempotencyStore as He, wsMutationIdempotencyScope as Ue } from "./idempotency.js";
+import { ValidationError as We, ValidationErrors as Ge, ValidationIssue as Ke, fieldIssuesOf as qe } from "./validation.js";
+import { ApprovalDecisionErrors as Je, ApprovalErrors as Ye, ApprovalExpired as Xe, ApprovalForbidden as Ze, ApprovalNotFound as Qe, ApprovalNotPending as $e, ApprovalRejected as et, ApprovalRequired as tt, ApprovalSelfApproval as nt, ApprovalUnavailable as rt, PendingApproval as it } from "./approval.js";
+import { REACTIVITY_CHANNEL_PREFIX as at, declaredReactivityChannelKeys as ot, isReactivityChannel as st, isReactivityChannelKey as ct, normalizeSource as lt, publishReactivity as ut, reactivityChannel as dt, sourceKeys as ft, undeclaredChannelKeys as pt } from "./reactivityChannel.js";
+import { captureOptionalQuerySources as mt } from "./queryOptionalSources.js";
+import { FRAMEWORK_WIRE_ERRORS as ht, SERVICE_NAME_PATTERN as gt, actionToRpc as _t, defineAction as vt, defineMutation as yt, defineQuery as bt, defineStream as xt, hasAccessDecision as St, hasEnforcedGuard as Ct, isAuthenticatedGuard as wt, isClientReachable as Tt, isPolicyGuard as Et, isServiceReachable as Dt, isUpgradedGuard as Ot, isWireReachable as kt, mutationToRpc as At, normalizeDescriptor as jt, queryToRpc as Mt, requireUpgraded as Nt, streamToRpc as Pt, toRpc as Ft, wireAudienceOf as It, wireErrorUnion as Lt, withRpcTag as Rt, workflowWireErrorUnion as zt } from "./procedure.js";
+import { errorMessage as Bt, errorTag as Vt, reportableError as Ht } from "./errorValue.js";
+import { declaredErrorTags as Ut, errorMemberSchema as Wt } from "./errorSchema.js";
+import { canonicalJson as Gt } from "./canonicalJson.js";
+import { prepareIdempotentInput as Kt } from "./idempotencyInput.js";
+import { EVENT_ROUTE_SEP as qt, EventKeyInvalid as Jt, EventPayloadInvalid as Yt, EventPayloadTooLarge as Xt, EventRpcWorkload as Zt, MAX_EVENT_ENVELOPE_BYTES as Qt, defineEvent as $t, encodeEventKey as en, eventAttached as tn, eventEnvelope as nn, eventGap as rn, eventResumePoint as an, eventRoute as on, eventStreamEvent as sn, eventSubscribeInput as cn, eventToRpc as ln, formatEventRoute as un, isEventDescriptor as dn, parseEventRoute as fn } from "./event.js";
+import { DEV_ACTIVITY_EVENT as pn } from "./devActivity.js";
+import { WorkflowAccessProperty as mn, attachWorkflowAccess as hn, getWorkflowAccess as gn, resolveWorkflowAccess as _n, workflowAccessDescriptor as vn } from "./workflowAccess.js";
+import { compareSurfaces as yn, groupShapeDigests as bn, procedureShapeDigest as xn, schemaShape as Sn, shapeDigest as Cn } from "./schemaShape.js";
+import { parseRevalidateMs as wn } from "./revalidate.js";
+import { ApiUnavailable as Tn, isApiUnavailable as En } from "./serviceCall.js";
+import { API_WORKLOADS as Dn, checkFrameworkCompat as On, composeReplayAuthorityBindings as kn, composeRpcInterceptors as An, definePlugin as jn, definePluginRoute as Mn, definePluginService as Nn, pluginInstanceName as Pn } from "./plugin.js";
+import { PluginPrivacyErasePhaseSchema as Fn, PluginPrivacyFailure as In, createPluginPrivacyRegistry as Ln } from "./pluginPrivacy.js";
+import { PluginAccountMergeFailure as Rn, createPluginAccountMergeRegistry as zn } from "./pluginAccountMerge.js";
+import { validateHttpStreamMaxDuration as Bn } from "./httpStreamMaxDuration.js";
+import { validateOutboxHandlerDefinition as Vn } from "./outbox.js";
+import { pluginAlias as Hn, pluginSlug as Un, pluginTag as Wn, registerPluginAliases as Gn, resetPluginAliases as Kn } from "./pluginNaming.js";
+import { publishServerError as qn, subscribeServerErrors as Jn, withheldServerError as Yn } from "./serverErrorBus.js";
+import { WorkflowStartTerminalOutcomeSchema as Xn } from "./workflowStartOutcome.js";
+import { WorkflowControlInputSchema as Zn, WorkflowControlIntentSchema as Qn, WorkflowControlReadInputSchema as $n, WorkflowControlResultSchema as er, WorkflowDomainEventRowSchema as tr, WorkflowDomainEventsInputSchema as nr, WorkflowEventDeliveriesInputSchema as rr, WorkflowEventDeliveryRowSchema as ir, WorkflowParentClosePolicySchema as ar, WorkflowQueuedCancelInputSchema as or, WorkflowQueuedCancellationResultSchema as sr, WorkflowQueuedControlTargetSchema as cr, WorkflowRunEventRowSchema as lr, WorkflowRunHandleSchema as ur, WorkflowRunRefSchema as dr, WorkflowRunRowSchema as fr, WorkflowRunSnapshotSchema as pr, WorkflowRunStatusSchema as mr, WorkflowRunStepRowSchema as hr, WorkflowRunTableRefSchema as gr, WorkflowRunsInputSchema as _r, WorkflowSignalInputSchema as vr, WorkflowStartDeferralSchema as yr, WorkflowUpdateInputSchema as br, WorkflowUpdateResultSchema as xr, workflowCancelDescriptor as Sr, workflowControlQueryDescriptor as Cr, workflowDomainEventsQueryDescriptor as wr, workflowEventDeliveriesQueryDescriptor as Tr, workflowQueuedCancelDescriptor as Er, workflowQueuedControlQueryDescriptor as Dr, workflowResumeDescriptor as Or, workflowRunEventsQueryDescriptor as kr, workflowRunQueryDescriptor as Ar, workflowRunStepsQueryDescriptor as jr, workflowRunsQueryDescriptor as Mr, workflowSignalDescriptor as Nr, workflowToRpc as Pr, workflowUpdateDescriptor as Fr } from "./workflow.js";
+import { WorkflowRetryCommandSchema as Ir, WorkflowRetryObservationSchema as Lr, WorkflowRetryTargetSchema as Rr } from "./workflowRetry.js";
+import { WorkflowRestartCommandSchema as zr, WorkflowRestartObservationSchema as Br, WorkflowRestartResultSchema as Vr, WorkflowRestartSelectionSchema as Hr, WorkflowRestartTargetSchema as Ur } from "./workflowRestart.js";
+import { UNDO_APPLY_TAG as Wr, UNDO_LOG_TAG as Gr, UNDO_REDO_TAG as Kr, UndoConflict as qr, UndoForbidden as Jr, UndoLogEntry as Yr, UndoNotFound as Xr, undoApplyDescriptor as Zr, undoLogQueryDescriptor as Qr, undoRedoDescriptor as $r } from "./undo.js";
+import { ssrfReason as ei } from "./ssrfPolicy.js";
+import { ConstraintViolation as ti, NoRowFound as ni, ServerOnlyColumnWrite as ri, StoreOperationFailed as ii, TableValidationFailed as ai, TenantRowNotFound as oi, TenantScopeViolation as si } from "./storeErrors.js";
+import { APPROVALS_DECIDE_TAG as ci, APPROVALS_PENDING_TAG as li, approvalsDecideDescriptor as ui, approvalsPendingQueryDescriptor as di } from "./approvalDescriptors.js";
+import { CONNECTIONS_LIST_TAG as fi, CONNECTION_DISCONNECT_TAG as pi, CONNECTION_START_TAG as mi, CONNECTION_SUBMIT_TOKEN_TAG as hi, ConnectionHandshakeFailed as gi, ConnectionKind as _i, ConnectionKindMismatch as vi, ConnectionNotDeclared as yi, ConnectionState as bi, ConnectionStatus as xi, ConnectionSubjectRequired as Si, connectionDisconnectDescriptor as Ci, connectionStartDescriptor as wi, connectionSubmitTokenDescriptor as Ti, connectionsListQueryDescriptor as Ei } from "./connection.js";
+import { tsMs as Di } from "./time.js";
+import { STORE_SCREENSHOT_PRESETS as Oi, STORE_SCREENSHOT_PRESET_NAMES as ki, STORE_SCREENSHOT_STORES as Ai, storeScreenshotPixels as ji, storeScreenshotPreset as Mi, storeScreenshotPresetsFor as Ni } from "./storeScreenshots.js";
+import { GATEWAY_CREDENTIAL_EXPIRED_CLOSE_CODE as Pi, defineWebSocket as Fi } from "./webSocketGateway.js";
+import { SESSION_HEADER_NAME as Ii, sessionValueFromHeaders as Li } from "./sessionHeader.js";
+import { JSONAPI_MEDIA_TYPE as Ri, PROBLEM_JSON as zi, REST_PROFILE_NAMES as Bi, encodeRestError as Vi, encodeRestSuccess as Hi, nextLink as Ui, problemDetails as Wi, problemTypeOf as Gi, resolveRestFormat as Ki, restViewSchema as qi, toSnakeCase as Ji } from "./restFormat.js";
+import { finiteNumberView as Yi, jsonSchemaDocumentOf as Xi, jsonSchemaOf as Zi, plainJsonSchema as Qi } from "./jsonSchema.js";
+import { PAIRING_HOST as $i, PAIRING_SCHEME as ea, PAIRING_STORAGE_KEY as ta, applyPairing as na, clearPairing as ra, pairingLink as ia, parsePairingLink as aa, readPairing as oa } from "./pairing.js";
+import { apiRoleEndpointUrl as sa, apiRoleProxyBasePath as ca, captureApiRoleEndpoints as la, selectApiRoleEndpoint as ua } from "./apiRoleEndpoints.js";
+import { ApiRoleObservationSchema as da } from "./apiRoleObservation.js";
+import { StorageAccessPolicySchema as fa, StorageAccessRuleSchema as pa } from "./storageAccess.js";
+import { BoundedRing as ma } from "./boundedRing.js";
+import { FORM_CAPTURE_FIELD as ha, FORM_CAPTURE_META_NAME as ga, encodeNativeFormCapture as _a, formCaptureSource as va, readFormCaptureSource as ya } from "./formCapture.js";
+//#region src/index.ts
+var ba = 2;
 //#endregion
-export { Be as ADMIN_SCOPE, Me as APIKEY_ISSUE_ORG_SCOPE, Le as APIKEY_ISSUE_OTHER_SCOPE, Ee as APIKEY_ISSUE_SELF_SCOPE, ea as APPROVALS_DECIDE_TAG, $i as APPROVALS_PENDING_TAG, Mr as ApiUnavailable, yn as ApprovalDecisionErrors, vn as ApprovalErrors, mn as ApprovalExpired, gn as ApprovalForbidden, dn as ApprovalNotFound, hn as ApprovalNotPending, pn as ApprovalRejected, un as ApprovalRequired, fn as ApprovalSelfApproval, _n as ApprovalUnavailable, re as AuthMiddleware, Va as BoundedRing, sn as BusinessRuleViolation, ra as CONNECTIONS_LIST_TAG, oa as CONNECTION_DISCONNECT_TAG, ia as CONNECTION_START_TAG, aa as CONNECTION_SUBMIT_TOKEN_TAG, fa as ConnectionHandshakeFailed, ie as ConnectionInfo, oe as ConnectionInfoMiddleware, q as ConnectionKind, da as ConnectionKindMismatch, la as ConnectionNotDeclared, ca as ConnectionState, sa as ConnectionStatus, ua as ConnectionSubjectRequired, Qi as ConstraintViolation, rt as DEFAULT_IN_FLIGHT_LEASE_MS, o as DEFAULT_SCOPE_CACHE_MAX_ENTRIES, l as DEFAULT_SCOPE_CACHE_TTL_MS, _e as DEVICES_MANAGE_SCOPE, Sr as EVENT_ROUTE_SEP, yr as EventKeyInvalid, vr as EventPayloadInvalid, br as EventPayloadTooLarge, Xn as FRAMEWORK_WIRE_ERRORS, Ca as GATEWAY_CREDENTIAL_EXPIRED_CLOSE_CODE, ne as IMPERSONATION_METADATA_KEY, yt as JSONAPI_MEDIA_TYPE, cr as MAX_EVENT_ENVELOPE_BYTES, Ct as MUTATION_IN_FLIGHT_RETRY_AFTER_MS, $e as MutationConnectionRequired, Ye as MutationInFlight, Ji as NoRowFound, d as NoSuchResource, Aa as PAIRING_HOST, ka as PAIRING_SCHEME, $ as PAIRING_STORAGE_KEY, mt as PROBLEM_JSON, Ha as PROTOCOL_VERSION, bn as PendingApproval, w as REACTIVITY_CHANNEL_PREFIX, _t as REST_PROFILE_NAMES, In as SERVICE_NAME_PATTERN, Et as SESSION_HEADER_NAME, Y as STORE_SCREENSHOT_PRESETS, ya as STORE_SCREENSHOT_PRESET_NAMES, va as STORE_SCREENSHOT_STORES, f as ScopeError, Zi as ServerOnlyColumnWrite, Ba as StorageAccessPolicySchema, za as StorageAccessRuleSchema, qi as StoreOperationFailed, ce as Subject, qe as SubjectIdentity, n as SubjectService, Yi as TableValidationFailed, Xi as TenantRowNotFound, Ki as TenantScopeViolation, ve as TenantSelectionRefused, Ii as UNDO_APPLY_TAG, Fi as UNDO_LOG_TAG, Li as UNDO_REDO_TAG, u as Unauthenticated, Vi as UndoConflict, Bi as UndoForbidden, Ri as UndoLogEntry, zi as UndoNotFound, S as ValidationError, C as ValidationErrors, cn as ValidationIssue, Er as WorkflowAccessProperty, oi as WorkflowControlInputSchema, ai as WorkflowControlIntentSchema, si as WorkflowControlReadInputSchema, B as WorkflowControlResultSchema, ei as WorkflowDomainEventRowSchema, ri as WorkflowDomainEventsInputSchema, ii as WorkflowEventDeliveriesInputSchema, ti as WorkflowEventDeliveryRowSchema, qr as WorkflowParentClosePolicySchema, li as WorkflowQueuedCancelInputSchema, V as WorkflowQueuedCancellationResultSchema, ci as WorkflowQueuedControlTargetSchema, ji as WorkflowRestartCommandSchema, Ni as WorkflowRestartObservationSchema, Pi as WorkflowRestartResultSchema, Ai as WorkflowRestartSelectionSchema, K as WorkflowRestartTargetSchema, Oi as WorkflowRetryCommandSchema, ki as WorkflowRetryObservationSchema, Di as WorkflowRetryTargetSchema, $r as WorkflowRunEventRowSchema, Yr as WorkflowRunHandleSchema, ni as WorkflowRunRefSchema, H as WorkflowRunRowSchema, z as WorkflowRunSnapshotSchema, R as WorkflowRunStatusSchema, Qr as WorkflowRunStepRowSchema, U as WorkflowRunTableRefSchema, Zr as WorkflowRunsInputSchema, pi as WorkflowSignalInputSchema, Jr as WorkflowStartDeferralSchema, L as WorkflowStartTerminalOutcomeSchema, mi as WorkflowUpdateInputSchema, hi as WorkflowUpdateResultSchema, tr as actionToRpc, be as advisoryResourceGuardWarning, c as anonymousSubject, Ia as applyPairing, Xt as applyRowPatch, de as applyScopeDecision, na as approvalsDecideDescriptor, ta as approvalsPendingQueryDescriptor, fe as assertAuthenticated, kr as attachWorkflowAccess, St as beginIdempotent, zr as checkFrameworkCompat, Ae as checkGuards, He as checkGuardsEffect, Ra as clearPairing, ct as compareSurfaces, s as composeAuthStrategies, Lr as composeRpcInterceptors, ga as connectionDisconnectDescriptor, ma as connectionStartDescriptor, ha as connectionSubmitTokenDescriptor, pa as connectionsListQueryDescriptor, Qt as createRowPatchApplier, Dn as declaredReactivityChannelKeys, xe as declaresResourceGuard, j as defineAction, ur as defineEvent, A as defineMutation, Pr as definePlugin, Fr as definePluginRoute, Rr as definePluginService, k as defineQuery, Hn as defineStream, Ta as defineWebSocket, Jt as diffRows, Ce as effectiveScopes, xr as encodeEventKey, lt as encodeRestError, nt as encodeRestSuccess, ir as errorMessage, rr as errorTag, pr as eventAttached, dr as eventEnvelope, fr as eventGap, hr as eventResumePoint, Cr as eventRoute, mr as eventStreamEvent, gr as eventSubscribeInput, _r as eventToRpc, et as failIdempotent, ln as fieldIssuesOf, Fe as findAdvisoryResourceGuards, Ze as finishIdempotent, Z as finiteNumberView, en as firstEventValue, Tr as formatEventRoute, Xe as freshFor, je as getPolicyGuardResolver, Te as getResourceScopeResolver, Ar as getWorkflowAccess, st as groupShapeDigests, Vn as hasAccessDecision, te as hasCallbackRoutes, we as hasEffectiveScope, M as hasEnforcedGuard, ge as hasScope, Qe as holdIdempotentClaim, _ as idToPath, dt as idempotencyScope, tn as inputLabel, Nr as isApiUnavailable, Ue as isAuthenticatedCheck, Bn as isAuthenticatedGuard, Pn as isClientReachable, lr as isEventDescriptor, Yt as isIdKeyed, Ie as isMachineSubject, Ke as isOpenAccess, ye as isPolicyCheck, zn as isPolicyGuard, Tn as isReactivityChannel, En as isReactivityChannelKey, Ge as isServiceAccess, Fn as isServiceReachable, ee as isServiceSubject, me as isSystemSubject, Pe as isTenantSelectable, Mn as isWireReachable, Da as jsonSchemaDocumentOf, Oa as jsonSchemaOf, pe as makeScopeCache, Je as memoryIdempotencyStore, le as missingAccessDecision, er as mutationToRpc, ht as nextLink, sr as normalizeDescriptor, kn as normalizeSource, r as openAccessSpec, he as orderByBearerPrefix, Na as pairingLink, wr as parseEventRoute, Pa as parsePairingLink, Ht as patchCellSchema, v as pathToId, Q as plainJsonSchema, Vr as pluginAlias, Ir as pluginInstanceName, Hr as pluginSlug, Kr as pluginTag, vt as problemDetails, it as problemTypeOf, tt as procedureShapeDigest, jn as publishReactivity, ot as publishServerError, $n as queryToRpc, se as rawImpersonationMark, wn as reactivityChannel, La as readPairing, Wr as registerPluginAliases, ar as reportableError, We as requireScope, Gr as resetPluginAliases, ue as resolvePolicyAction, ft as resolveRestFormat, Or as resolveWorkflowAccess, bt as restViewSchema, Wt as rowPatchOpSchema, Gt as rowPatchSchema, xt as schemaShape, e as scopeCacheKey, ze as selectSubjectTenant, a as serviceAccessSpec, i as serviceCallersOf, Se as serviceSubject, Tt as sessionValueFromHeaders, ae as setEffectiveScopes, ke as setPolicyGuardResolver, t as setResourceScopeResolver, wt as shapeDigest, On as sourceKeys, xa as storeScreenshotPixels, ba as storeScreenshotPreset, Sa as storeScreenshotPresetsFor, nr as streamToRpc, x as strictInput, Ve as subjectAuditActorId, Ne as subjectIdentity, Oe as subjectScopes, gt as subscribeServerErrors, $t as subscriptionEvent, Re as systemSubject, De as tenantScopedSubject, or as toRpc, at as toSnakeCase, _a as tsMs, An as undeclaredChannelKeys, Wi as undoApplyDescriptor, Ui as undoLogQueryDescriptor, Gi as undoRedoDescriptor, Nn as wireAudienceOf, N as wireErrorUnion, Qn as withRpcTag, pt as withheldServerError, jr as workflowAccessDescriptor, Si as workflowCancelDescriptor, fi as workflowControlQueryDescriptor, bi as workflowDomainEventsQueryDescriptor, xi as workflowEventDeliveriesQueryDescriptor, ui as workflowQueuedCancelDescriptor, di as workflowQueuedControlQueryDescriptor, Ci as workflowResumeDescriptor, yi as workflowRunEventsQueryDescriptor, gi as workflowRunQueryDescriptor, vi as workflowRunStepsQueryDescriptor, _i as workflowRunsQueryDescriptor, wi as workflowSignalDescriptor, Xr as workflowToRpc, Ti as workflowUpdateDescriptor, Zn as workflowWireErrorUnion, ut as wsMutationIdempotencyScope };
+export { K as ADMIN_SCOPE, q as APIKEY_ISSUE_ORG_SCOPE, J as APIKEY_ISSUE_OTHER_SCOPE, Y as APIKEY_ISSUE_SELF_SCOPE, Dn as API_WORKLOADS, ci as APPROVALS_DECIDE_TAG, li as APPROVALS_PENDING_TAG, da as ApiRoleObservationSchema, Tn as ApiUnavailable, Je as ApprovalDecisionErrors, Ye as ApprovalErrors, Xe as ApprovalExpired, Ze as ApprovalForbidden, Qe as ApprovalNotFound, $e as ApprovalNotPending, et as ApprovalRejected, tt as ApprovalRequired, nt as ApprovalSelfApproval, rt as ApprovalUnavailable, h as AuthMiddleware, ma as BoundedRing, Ae as BusinessRuleViolation, fi as CONNECTIONS_LIST_TAG, pi as CONNECTION_DISCONNECT_TAG, mi as CONNECTION_START_TAG, hi as CONNECTION_SUBMIT_TOKEN_TAG, gi as ConnectionHandshakeFailed, g as ConnectionInfo, _ as ConnectionInfoMiddleware, _i as ConnectionKind, vi as ConnectionKindMismatch, yi as ConnectionNotDeclared, bi as ConnectionState, xi as ConnectionStatus, Si as ConnectionSubjectRequired, ti as ConstraintViolation, je as DEFAULT_IN_FLIGHT_LEASE_MS, v as DEFAULT_SCOPE_CACHE_MAX_ENTRIES, y as DEFAULT_SCOPE_CACHE_TTL_MS, X as DEVICES_MANAGE_SCOPE, pn as DEV_ACTIVITY_EVENT, qt as EVENT_ROUTE_SEP, Jt as EventKeyInvalid, Yt as EventPayloadInvalid, Xt as EventPayloadTooLarge, Zt as EventRpcWorkload, ha as FORM_CAPTURE_FIELD, ga as FORM_CAPTURE_META_NAME, ht as FRAMEWORK_WIRE_ERRORS, Pi as GATEWAY_CREDENTIAL_EXPIRED_CLOSE_CODE, b as IMPERSONATION_METADATA_KEY, Ri as JSONAPI_MEDIA_TYPE, Qt as MAX_EVENT_ENVELOPE_BYTES, Me as MUTATION_IN_FLIGHT_RETRY_AFTER_MS, Ne as MutationConnectionRequired, Pe as MutationIdempotencyRefused, Fe as MutationInFlight, ni as NoRowFound, Z as NoSuchResource, $i as PAIRING_HOST, ea as PAIRING_SCHEME, ta as PAIRING_STORAGE_KEY, zi as PROBLEM_JSON, ba as PROTOCOL_VERSION, it as PendingApproval, Rn as PluginAccountMergeFailure, Fn as PluginPrivacyErasePhaseSchema, In as PluginPrivacyFailure, at as REACTIVITY_CHANNEL_PREFIX, Bi as REST_PROFILE_NAMES, d as RequestedTenantRefused, gt as SERVICE_NAME_PATTERN, Ii as SESSION_HEADER_NAME, Oi as STORE_SCREENSHOT_PRESETS, ki as STORE_SCREENSHOT_PRESET_NAMES, Ai as STORE_SCREENSHOT_STORES, Q as ScopeError, ri as ServerOnlyColumnWrite, fa as StorageAccessPolicySchema, pa as StorageAccessRuleSchema, ii as StoreOperationFailed, x as Subject, S as SubjectIdentity, C as SubjectService, ai as TableValidationFailed, oi as TenantRowNotFound, si as TenantScopeViolation, f as TenantSelectionRefused, Wr as UNDO_APPLY_TAG, Gr as UNDO_LOG_TAG, Kr as UNDO_REDO_TAG, w as Unauthenticated, qr as UndoConflict, Jr as UndoForbidden, Yr as UndoLogEntry, Xr as UndoNotFound, We as ValidationError, Ge as ValidationErrors, Ke as ValidationIssue, mn as WorkflowAccessProperty, Zn as WorkflowControlInputSchema, Qn as WorkflowControlIntentSchema, $n as WorkflowControlReadInputSchema, er as WorkflowControlResultSchema, tr as WorkflowDomainEventRowSchema, nr as WorkflowDomainEventsInputSchema, rr as WorkflowEventDeliveriesInputSchema, ir as WorkflowEventDeliveryRowSchema, ar as WorkflowParentClosePolicySchema, or as WorkflowQueuedCancelInputSchema, sr as WorkflowQueuedCancellationResultSchema, cr as WorkflowQueuedControlTargetSchema, zr as WorkflowRestartCommandSchema, Br as WorkflowRestartObservationSchema, Vr as WorkflowRestartResultSchema, Hr as WorkflowRestartSelectionSchema, Ur as WorkflowRestartTargetSchema, Ir as WorkflowRetryCommandSchema, Lr as WorkflowRetryObservationSchema, Rr as WorkflowRetryTargetSchema, lr as WorkflowRunEventRowSchema, ur as WorkflowRunHandleSchema, dr as WorkflowRunRefSchema, fr as WorkflowRunRowSchema, pr as WorkflowRunSnapshotSchema, mr as WorkflowRunStatusSchema, hr as WorkflowRunStepRowSchema, gr as WorkflowRunTableRefSchema, _r as WorkflowRunsInputSchema, vr as WorkflowSignalInputSchema, yr as WorkflowStartDeferralSchema, Xn as WorkflowStartTerminalOutcomeSchema, br as WorkflowUpdateInputSchema, xr as WorkflowUpdateResultSchema, _t as actionToRpc, $ as advisoryResourceGuardWarning, T as anonymousSubject, sa as apiRoleEndpointUrl, ca as apiRoleProxyBasePath, na as applyPairing, e as applyRowPatch, E as applyScopeDecision, ui as approvalsDecideDescriptor, di as approvalsPendingQueryDescriptor, D as assertAuthenticated, hn as attachWorkflowAccess, Ie as beginIdempotent, O as bindSubjectAuthority, Gt as canonicalJson, la as captureApiRoleEndpoints, mt as captureOptionalQuerySources, On as checkFrameworkCompat, ee as checkGuards, te as checkGuardsEffect, ra as clearPairing, yn as compareSurfaces, k as composeAuthStrategies, kn as composeReplayAuthorityBindings, An as composeRpcInterceptors, Ci as connectionDisconnectDescriptor, wi as connectionStartDescriptor, Ti as connectionSubmitTokenDescriptor, Ei as connectionsListQueryDescriptor, zn as createPluginAccountMergeRegistry, Ln as createPluginPrivacyRegistry, t as createRowPatchApplier, A as currentSubjectAuthority, Ut as declaredErrorTags, ot as declaredReactivityChannelKeys, ne as declaresResourceGuard, vt as defineAction, $t as defineEvent, yt as defineMutation, jn as definePlugin, Mn as definePluginRoute, Nn as definePluginService, bt as defineQuery, xt as defineStream, Fi as defineWebSocket, n as diffRows, re as effectiveScopes, en as encodeEventKey, _a as encodeNativeFormCapture, Vi as encodeRestError, Hi as encodeRestSuccess, Wt as errorMemberSchema, Bt as errorMessage, Vt as errorTag, tn as eventAttached, nn as eventEnvelope, rn as eventGap, an as eventResumePoint, on as eventRoute, sn as eventStreamEvent, cn as eventSubscribeInput, ln as eventToRpc, Le as failIdempotent, qe as fieldIssuesOf, ie as findAdvisoryResourceGuards, Re as finishIdempotent, Yi as finiteNumberView, l as firstEventValue, va as formCaptureSource, un as formatEventRoute, ze as freshFor, ae as getPolicyGuardResolver, oe as getResourceScopeResolver, gn as getWorkflowAccess, bn as groupShapeDigests, St as hasAccessDecision, j as hasCallbackRoutes, se as hasEffectiveScope, Ct as hasEnforcedGuard, ce as hasScope, Be as holdIdempotentClaim, r as idToPath, Ve as idempotencyScope, Oe as inputLabel, En as isApiUnavailable, le as isAuthenticatedCheck, wt as isAuthenticatedGuard, Tt as isClientReachable, dn as isEventDescriptor, i as isIdKeyed, M as isMachineSubject, ue as isOpenAccess, de as isPolicyCheck, Et as isPolicyGuard, st as isReactivityChannel, ct as isReactivityChannelKey, fe as isServiceAccess, Dt as isServiceReachable, N as isServiceSubject, P as isSystemSubject, p as isTenantSelectable, pe as isUpgradedCheck, Ot as isUpgradedGuard, kt as isWireReachable, Xi as jsonSchemaDocumentOf, Zi as jsonSchemaOf, F as makeScopeCache, He as memoryIdempotencyStore, me as missingAccessDecision, At as mutationToRpc, Ui as nextLink, jt as normalizeDescriptor, lt as normalizeSource, he as openAccessSpec, I as orderByBearerPrefix, ia as pairingLink, fn as parseEventRoute, aa as parsePairingLink, wn as parseRevalidateMs, a as patchCellSchema, o as pathToId, Qi as plainJsonSchema, Hn as pluginAlias, Pn as pluginInstanceName, Un as pluginSlug, Wn as pluginTag, Kt as prepareIdempotentInput, Wi as problemDetails, Gi as problemTypeOf, xn as procedureShapeDigest, ut as publishReactivity, qn as publishServerError, Mt as queryToRpc, L as rawImpersonationMark, dt as reactivityChannel, ya as readFormCaptureSource, oa as readPairing, R as reauthorizeSubject, ge as recheckGuardsEffect, _e as refreshEffectiveScopes, Gn as registerPluginAliases, Ht as reportableError, ve as requireScope, Nt as requireUpgraded, Kn as resetPluginAliases, z as resolveIdentityAuthority, ye as resolvePolicyAction, Ki as resolveRestFormat, _n as resolveWorkflowAccess, qi as restViewSchema, s as rowPatchOpSchema, c as rowPatchSchema, Sn as schemaShape, B as scopeCacheKey, ua as selectApiRoleEndpoint, m as selectSubjectTenant, be as serviceAccessSpec, xe as serviceCallersOf, V as serviceSubject, Li as sessionValueFromHeaders, Se as setEffectiveScopes, Ce as setEffectiveScopesRefresher, we as setPolicyGuardResolver, Te as setResourceScopeResolver, Cn as shapeDigest, ft as sourceKeys, ei as ssrfReason, ji as storeScreenshotPixels, Mi as storeScreenshotPreset, Ni as storeScreenshotPresetsFor, Pt as streamToRpc, ke as strictInput, H as subjectAuditActorId, U as subjectIdentity, Ee as subjectScopes, Jn as subscribeServerErrors, u as subscriptionEvent, W as systemSubject, G as tenantScopedSubject, Ft as toRpc, Ji as toSnakeCase, Di as tsMs, pt as undeclaredChannelKeys, Zr as undoApplyDescriptor, Qr as undoLogQueryDescriptor, $r as undoRedoDescriptor, De as upgradedGuardShapeError, Bn as validateHttpStreamMaxDuration, Vn as validateOutboxHandlerDefinition, It as wireAudienceOf, Lt as wireErrorUnion, Rt as withRpcTag, Yn as withheldServerError, vn as workflowAccessDescriptor, Sr as workflowCancelDescriptor, Cr as workflowControlQueryDescriptor, wr as workflowDomainEventsQueryDescriptor, Tr as workflowEventDeliveriesQueryDescriptor, Er as workflowQueuedCancelDescriptor, Dr as workflowQueuedControlQueryDescriptor, Or as workflowResumeDescriptor, kr as workflowRunEventsQueryDescriptor, Ar as workflowRunQueryDescriptor, jr as workflowRunStepsQueryDescriptor, Mr as workflowRunsQueryDescriptor, Nr as workflowSignalDescriptor, Pr as workflowToRpc, Fr as workflowUpdateDescriptor, zt as workflowWireErrorUnion, Ue as wsMutationIdempotencyScope };