@voltro/runtime 0.12.0 → 0.13.0

package/dist/index.js

@@ -1883,9 +1883,9 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	let l = yield* P.tryPromise(() => t.subscribe(e, (e) => {
 		c.single(e);
 	}, n, r, i, a, o, s)).pipe(P.matchCause({
-		onFailure: (e) => (ni(`subscription.${i}`, n.traceId, e), {
+		onFailure: (e) => (ai(`subscription.${i}`, n.traceId, e), {
 			ok: !1,
-			error: oi(e)
+			error: li(e)
 		}),
 		onSuccess: (e) => ({
 			ok: !0,
@@ -1906,16 +1906,20 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		});
 		yield* P.addFinalizer(() => P.sync(() => e()));
 	}
-})), Zr = (e, t, n, r) => z.asyncScoped((i) => P.gen(function* () {
+})), Zr = /* @__PURE__ */ new Set(), Qr = () => {
+	Zr.clear();
+}, $r = (e) => {
+	Zr.has(e) || (Zr.add(e), process.stderr.write(`[voltro] ${e}: \`cache:\` is declared but NOT applied — this query's handler returns a computed value, and the snapshot cache only wraps a store read. Every subscriber re-runs the handler. Either return a query descriptor (so the read can be cached), or drop \`cache:\` so the declaration matches what happens.\n`));
+}, ei = (e, t, n, r) => z.asyncScoped((i) => P.gen(function* () {
 	let a = yield* P.tryPromise(() => t.subscribeComputed(e, (e) => {
 		i.single(e._tag === "snapshot" ? {
 			...e,
 			computed: !0
 		} : e);
 	}, n, r)).pipe(P.matchCause({
-		onFailure: (e) => (ni(`subscription.${r}`, n.traceId, e), {
+		onFailure: (e) => (ai(`subscription.${r}`, n.traceId, e), {
 			ok: !1,
-			error: oi(e)
+			error: li(e)
 		}),
 		onSuccess: (e) => ({
 			ok: !0,
@@ -1936,16 +1940,16 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		});
 		yield* P.addFinalizer(() => P.sync(() => e()));
 	}
-})), Qr = (e, t, n = "rpc.subscription", r, i, a, o) => z.unwrap(P.gen(function* () {
+})), ti = (e, t, n = "rpc.subscription", r, i, a, o) => z.unwrap(P.gen(function* () {
 	let s = yield* ke, c = yield* we, l = yield* Kr;
 	Jr(l, n, s);
 	let u = Gr(s, l, c.clientId), d = Cr(s.id, c.clientId), f = Dr({ subjectKey: d }, () => vr({
 		traceId: u.traceId,
 		...u.spanId === void 0 ? {} : { spanId: u.spanId }
 	}, () => Wr(n, () => e(u)))), p = P.isEffect(f) ? yield* f.pipe(P.matchCause({
-		onFailure: (e) => (ni(`subscription.${n}`, u.traceId, e), {
+		onFailure: (e) => (ai(`subscription.${n}`, u.traceId, e), {
 			ok: !1,
-			error: oi(e)
+			error: li(e)
 		}),
 		onSuccess: (e) => ({
 			ok: !0,
@@ -1960,14 +1964,14 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		error: p.error
 	});
 	let m = p.value;
-	if (Qn(m)) return Zr(m, t, u, n);
+	if (Qn(m)) return i !== void 0 && $r(n), ei(m, t, u, n);
 	let h = m, g = r?.(h);
 	return Xr(h, t, u, g, n, i === void 0 ? void 0 : {
 		key: i.scope === "subject" ? `${i.baseKey}:s:${d}` : `${i.baseKey}:global`,
 		ttlMs: i.ttlMs,
 		swrMs: i.swrMs
 	}, a?.(s), o?.(s) ?? Yr(s));
-}).pipe(P.withSpan(n, { attributes: { "framework.kind": "subscription" } }))), $r = (e, t = "rpc.stream") => z.unwrap(P.gen(function* () {
+}).pipe(P.withSpan(n, { attributes: { "framework.kind": "subscription" } }))), ni = (e, t = "rpc.stream") => z.unwrap(P.gen(function* () {
 	let n = yield* ke, r = yield* we, i = yield* Kr;
 	Jr(i, t, n);
 	let a = Gr(n, i, r.clientId), o = Wr(t, () => e(a)), s = P.isEffect(o) ? yield* o.pipe(P.orDie) : o;
@@ -1979,25 +1983,25 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		});
 		return yield* P.addFinalizer(() => P.sync(() => t())), s.pipe(z.interruptWhen(qe.await(e)));
 	}));
-}).pipe(P.withSpan(t, { attributes: { "framework.kind": "stream" } }))), ei = M({ scope: "voltro:rpc" }), ti = M({ scope: "voltro:http" }), ni = (e, t, n) => {
+}).pipe(P.withSpan(t, { attributes: { "framework.kind": "stream" } }))), ri = M({ scope: "voltro:rpc" }), ii = M({ scope: "voltro:http" }), ai = (e, t, n) => {
 	if (N.isInterruptedOnly(n)) return;
 	let r = N.squash(n), i = r?._tag, a = r instanceof Error ? r.message : r?.message ?? String(r), o = N.dieOption(n)._tag === "Some", s = en(r), c = {
 		traceId: t,
 		...i === void 0 ? {} : { errorTag: i },
 		...s
 	}, l = a === "Failed to execute statement" && typeof s.dbMessage == "string" ? s.dbMessage : a;
-	o ? ei.error(`${e} failed: ${l}`, c) : ei.warn(`${e} failed: ${l}`, c);
-}, ri = /* @__PURE__ */ new Set([
+	o ? ri.error(`${e} failed: ${l}`, c) : ri.warn(`${e} failed: ${l}`, c);
+}, oi = /* @__PURE__ */ new Set([
 	"SqlError",
 	"ResultLengthMismatch",
 	"FieldDecryptionError"
-]), ii = (e) => typeof e == "object" && !!e && typeof e._tag == "string" && ri.has(e._tag), ai = (e) => ({
+]), si = (e) => typeof e == "object" && !!e && typeof e._tag == "string" && oi.has(e._tag), ci = (e) => ({
 	_tag: "InternalError",
 	message: "internal server error",
 	traceId: e
-}), oi = (e) => {
+}), li = (e) => {
 	let t = N.squash(e);
-	if (t && typeof t == "object" && t._tag === "UnknownException" && (t = t.error ?? t.cause ?? t), ii(t)) return {
+	if (t && typeof t == "object" && t._tag === "UnknownException" && (t = t.error ?? t.cause ?? t), si(t)) return {
 		_tag: "InternalError",
 		message: "internal server error"
 	};
@@ -2009,7 +2013,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		...typeof i == "string" ? { _tag: i } : {},
 		message: typeof a == "string" ? a : String(t)
 	};
-}, si = (e, t, n = "rpc.mutation") => P.gen(function* () {
+}, ui = (e, t, n = "rpc.mutation") => P.gen(function* () {
 	let r = yield* ke, i = yield* we, a = yield* Kr;
 	Jr(a, n, r);
 	let o = Gr(r, a, i.clientId), s = Dr({ subjectKey: Cr(r.id, i.clientId) }, () => vr({
@@ -2019,8 +2023,8 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	return yield* (P.isEffect(s) ? s : P.tryPromise({
 		try: () => Promise.resolve(s),
 		catch: (e) => e
-	})).pipe(P.tapErrorCause((e) => P.sync(() => ni(n, o.traceId, e))), P.catchIf(ii, () => P.die(ai(o.traceId))), P.annotateLogs(qr(o)));
-}).pipe(P.withSpan(n, { attributes: { "framework.kind": "mutation" } })), ci = 8 * 1024 * 1024, li = (e) => {
+	})).pipe(P.tapErrorCause((e) => P.sync(() => ai(n, o.traceId, e))), P.catchIf(si, () => P.die(ci(o.traceId))), P.annotateLogs(qr(o)));
+}).pipe(P.withSpan(n, { attributes: { "framework.kind": "mutation" } })), di = 8 * 1024 * 1024, fi = (e) => {
 	let t = e.port ?? 4e3, n = e.path ?? "/ws", r = at(), i = (t) => ct.HttpServerRequest.pipe(P.flatMap((t) => P.gen(function* () {
 		if (!e.inspectRoute) return H.text("inspect route not configured", { status: 404 });
 		let n = {};
@@ -2128,7 +2132,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 				headers: n,
 				rawBody: o
 			}, c = yield* P.promise(() => ht(e, s));
-			c.status >= 500 && ti.warn(`${t.method} ${i} → ${c.status}`, {
+			c.status >= 500 && ii.warn(`${t.method} ${i} → ${c.status}`, {
 				method: t.method,
 				path: i,
 				status: c.status,
@@ -2163,7 +2167,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 				});
 			}
 			return c.body instanceof Uint8Array ? H.uint8Array(c.body, u) : H.text(c.body ?? "", u);
-		})), P.tapErrorCause((t) => N.isInterruptedOnly(t) ? P.void : P.sync(() => ti.error(`${e.map((e) => e.method).join("|")} ${e[0].path} threw`, { path: e[0].path }, N.squash(t))))), n = /* @__PURE__ */ new Map();
+		})), P.tapErrorCause((t) => N.isInterruptedOnly(t) ? P.void : P.sync(() => ii.error(`${e.map((e) => e.method).join("|")} ${e[0].path} threw`, { path: e[0].path }, N.squash(t))))), n = /* @__PURE__ */ new Map();
 		for (let t of e.httpRoutes) {
 			let e = n.get(t.path);
 			e ? e.push(t) : n.set(t.path, [t]);
@@ -2226,21 +2230,21 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	let C = M({ scope: "voltro:rpc" }), w = F.launch(S).pipe(P.catchAllCause((e) => P.sync(() => {
 		C.error("rpc server crashed", {}, N.squash(e)), process.exit(1);
 	}))), T = P.runFork(w);
-	return ui.add(T), fi(), {
+	return pi.add(T), hi(), {
 		server: r,
 		shutdown: async () => {
-			ui.delete(T), await P.runPromise(Ze.interrupt(T)).then(() => void 0, () => void 0);
+			pi.delete(T), await P.runPromise(Ze.interrupt(T)).then(() => void 0, () => void 0);
 		}
 	};
-}, ui = /* @__PURE__ */ new Set(), di = !1, fi = () => {
-	if (di) return;
-	di = !0;
+}, pi = /* @__PURE__ */ new Set(), mi = !1, hi = () => {
+	if (mi) return;
+	mi = !0;
 	let e = () => {
-		let e = [...ui];
-		ui.clear(), Promise.all(e.map((e) => P.runPromise(Ze.interrupt(e)).then(() => void 0, () => void 0))).then(() => process.exit(0), () => process.exit(0));
+		let e = [...pi];
+		pi.clear(), Promise.all(e.map((e) => P.runPromise(Ze.interrupt(e)).then(() => void 0, () => void 0))).then(() => process.exit(0), () => process.exit(0));
 	};
 	process.once("SIGINT", e), process.once("SIGTERM", e);
-}, pi = (e, t = 1e4) => new Promise((n, r) => {
+}, gi = (e, t = 1e4) => new Promise((n, r) => {
 	if (e.listening) {
 		n();
 		return;
@@ -2256,13 +2260,13 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		o(e);
 	}
 	a = setTimeout(() => o(/* @__PURE__ */ Error(`rpc server did not bind within ${t}ms`)), t), e.on("listening", s), e.on("error", c);
-}), mi = () => {
+}), _i = () => {
 	let e = process.env.FRAMEWORK_TRACING?.toLowerCase();
 	return e === "console" || e === "otlp" || e === "off" ? e : process.env.OTEL_EXPORTER_OTLP_ENDPOINT || process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT ? "otlp" : "off";
-}, hi = () => {
+}, vi = () => {
 	let e = process.env.FRAMEWORK_METRICS?.toLowerCase();
 	return e === "console" || e === "otlp" || e === "off" ? e : process.env.OTEL_EXPORTER_OTLP_ENDPOINT || process.env.OTEL_EXPORTER_OTLP_METRICS_ENDPOINT ? "otlp" : "off";
-}, gi = async () => {
+}, yi = async () => {
 	let [e, t, n, r, i] = await Promise.all([
 		import("@opentelemetry/sdk-trace-base"),
 		import("@opentelemetry/sdk-metrics"),
@@ -2277,7 +2281,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		otlpMetrics: r,
 		nodeSdk: i
 	};
-}, _i = (e, t, n) => {
+}, bi = (e, t, n) => {
 	let { PeriodicExportingMetricReader: r, ConsoleMetricExporter: i, InMemoryMetricExporter: a, AggregationTemporality: o } = e.sdkMetrics;
 	if (t === "off") return {
 		reader: void 0,
@@ -2300,8 +2304,8 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		}),
 		inMemory: void 0
 	};
-}, vi = async (e = {}) => {
-	let t = e.mode ?? mi(), n = e.metricsMode ?? hi(), r = e.extraSpanProcessors ?? [], i = e.extraMetricReaders ?? [];
+}, xi = async (e = {}) => {
+	let t = e.mode ?? _i(), n = e.metricsMode ?? vi(), r = e.extraSpanProcessors ?? [], i = e.extraMetricReaders ?? [];
 	if (t === "off" && e.traceSink === void 0 && n === "off" && r.length === 0 && i.length === 0) return {
 		layer: F.empty,
 		mode: t,
@@ -2310,13 +2314,13 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		metricsMode: n,
 		inMemoryMetricExporter: void 0
 	};
-	let a = await gi(), { ConsoleSpanExporter: o, InMemorySpanExporter: s, SimpleSpanProcessor: c, BatchSpanProcessor: l } = a.sdkTrace, u = t === "off", d = e.serviceName ?? process.env.OTEL_SERVICE_NAME ?? "voltro-app", f, p;
+	let a = await yi(), { ConsoleSpanExporter: o, InMemorySpanExporter: s, SimpleSpanProcessor: c, BatchSpanProcessor: l } = a.sdkTrace, u = t === "off", d = e.serviceName ?? process.env.OTEL_SERVICE_NAME ?? "voltro-app", f, p;
 	e.spanProcessor ? p = e.spanProcessor : u ? p = void 0 : t === "memory" ? (f = new s(), p = new c(f)) : p = t === "console" ? new c(new o()) : new l(new a.otlpTrace.OTLPTraceExporter());
 	let m = [
 		...e.traceSink ? [e.traceSink] : [],
 		...p ? [p] : [],
 		...r
-	], h = m.length === 1 ? m[0] : m, { reader: g, inMemory: _ } = _i(a, n, e.metricExportIntervalMillis ?? (process.env.OTEL_METRIC_EXPORT_INTERVAL ? Number(process.env.OTEL_METRIC_EXPORT_INTERVAL) : 6e4)), v = [...g ? [g] : [], ...i], y = v.length === 0 ? void 0 : v.length === 1 ? v[0] : v, b = {
+	], h = m.length === 1 ? m[0] : m, { reader: g, inMemory: _ } = bi(a, n, e.metricExportIntervalMillis ?? (process.env.OTEL_METRIC_EXPORT_INTERVAL ? Number(process.env.OTEL_METRIC_EXPORT_INTERVAL) : 6e4)), v = [...g ? [g] : [], ...i], y = v.length === 0 ? void 0 : v.length === 1 ? v[0] : v, b = {
 		serviceName: d,
 		...e.serviceVersion ? { serviceVersion: e.serviceVersion } : {},
 		...e.resourceAttributes ? { attributes: e.resourceAttributes } : {}
@@ -2334,18 +2338,18 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		metricsMode: n,
 		inMemoryMetricExporter: _
 	};
-}, yi = {
+}, Si = {
 	[yt.INTERNAL]: "internal",
 	[yt.SERVER]: "server",
 	[yt.CLIENT]: "client",
 	[yt.PRODUCER]: "producer",
 	[yt.CONSUMER]: "consumer"
-}, bi = (e) => e[0] * 1e3 + e[1] / 1e6, xi = 512, Si = 48, Ci = (e) => {
+}, Ci = (e) => e[0] * 1e3 + e[1] / 1e6, wi = 512, Ti = 48, Ei = (e) => {
 	let t = {}, n = 0;
 	for (let r in e) {
-		if (n >= Si) break;
+		if (n >= Ti) break;
 		let i = e[r];
-		if (typeof i == "string") t[r] = i.length > xi ? `${i.slice(0, xi)}…` : i;
+		if (typeof i == "string") t[r] = i.length > wi ? `${i.slice(0, wi)}…` : i;
 		else if (typeof i == "number" || typeof i == "boolean" || i == null) t[r] = i;
 		else {
 			let e;
@@ -2354,49 +2358,49 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			} catch {
 				e = String(i);
 			}
-			t[r] = e.length > xi ? `${e.slice(0, xi)}…` : e;
+			t[r] = e.length > wi ? `${e.slice(0, wi)}…` : e;
 		}
 		n++;
 	}
 	return t;
-}, wi = {
+}, Di = {
 	[bt.UNSET]: "unset",
 	[bt.OK]: "ok",
 	[bt.ERROR]: "error"
-}, Ti = (e) => {
+}, Oi = (e) => {
 	let t = e.spanContext(), n = e.events.length > 0 ? e.events.slice(0, 16).map((e) => ({
 		name: e.name,
-		tsMs: bi(e.time),
-		...e.attributes ? { attributes: Ci(e.attributes) } : {}
+		tsMs: Ci(e.time),
+		...e.attributes ? { attributes: Ei(e.attributes) } : {}
 	})) : void 0;
 	return {
 		traceId: t.traceId,
 		spanId: t.spanId,
 		parentSpanId: e.parentSpanContext?.spanId ?? null,
 		name: e.name,
-		kind: yi[e.kind] ?? "internal",
-		attributes: Ci(e.attributes),
-		startMs: bi(e.startTime),
-		endMs: bi(e.endTime),
-		durationMs: bi(e.duration),
-		status: wi[e.status.code] ?? "unset",
+		kind: Si[e.kind] ?? "internal",
+		attributes: Ei(e.attributes),
+		startMs: Ci(e.startTime),
+		endMs: Ci(e.endTime),
+		durationMs: Ci(e.duration),
+		status: Di[e.status.code] ?? "unset",
 		...e.status.message ? { statusMessage: e.status.message } : {},
 		...n ? { events: n } : {}
 	};
-}, Ei = (e) => ({
+}, ki = (e) => ({
 	onStart: () => {},
 	onEnd: (t) => {
 		try {
-			e(Ti(t));
+			e(Oi(t));
 		} catch {}
 	},
 	forceFlush: () => Promise.resolve(),
 	shutdown: () => Promise.resolve()
-}), Di = { get: (e) => Promise.resolve(process.env[e]) }, Oi = Di, ki = (e) => {
-	Oi = e;
-}, Ai = () => {
-	Oi = Di;
-}, ji = async (e) => await Oi.get(e) ?? process.env[e], Mi = (e) => process.env[e], Ni = (e, t = 6e4, n = () => Date.now()) => {
+}), Ai = { get: (e) => Promise.resolve(process.env[e]) }, ji = Ai, Mi = (e) => {
+	ji = e;
+}, Ni = () => {
+	ji = Ai;
+}, Pi = async (e) => await ji.get(e) ?? process.env[e], Fi = (e) => process.env[e], Ii = (e, t = 6e4, n = () => Date.now()) => {
 	let r = /* @__PURE__ */ new Map();
 	return { get: async (i) => {
 		let a = r.get(i);
@@ -2407,12 +2411,12 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			at: n()
 		}), o;
 	} };
-}, Pi = (e) => {
+}, Li = (e) => {
 	let t = {
 		accept: "application/json",
 		...e.headers ?? {}
 	};
-	if (e.perKey) return Ni({ get: async (n) => {
+	if (e.perKey) return Ii({ get: async (n) => {
 		let r = await fetch(`${e.url.replace(/\/$/, "")}/${encodeURIComponent(n)}`, { headers: t });
 		if (!r.ok) return;
 		let i = await r.json();
@@ -2423,7 +2427,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		let t = (await a())[e];
 		return typeof t == "string" ? t : void 0;
 	} };
-}, Fi = (e) => e === void 0 || e === "env" || typeof e == "object" && e.kind === "env" ? Di : e.kind === "custom" ? e.backend : e.kind === "http" ? Pi(e) : Di, Ii = (e) => /^[0-9a-f]{64}$/i.test(e) ? Buffer.from(e, "hex") : ve(e, "voltro:field-encryption:v1", 32), Li = (t) => {
+}, Ri = (e) => e === void 0 || e === "env" || typeof e == "object" && e.kind === "env" ? Ai : e.kind === "custom" ? e.backend : e.kind === "http" ? Li(e) : Ai, zi = (e) => /^[0-9a-f]{64}$/i.test(e) ? Buffer.from(e, "hex") : ve(e, "voltro:field-encryption:v1", 32), Bi = (t) => {
 	if (t.length !== 32) throw Error(`field cipher key must be 32 bytes, got ${t.length}`);
 	return {
 		encrypt: (n) => {
@@ -2437,45 +2441,45 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			return o.setAuthTag(Buffer.from(i, "base64")), Buffer.concat([o.update(Buffer.from(a, "base64")), o.final()]).toString("utf8");
 		}
 	};
-}, Ri = (e) => Li(Ii(e)), zi, Bi = (e) => {
-	zi = e;
-}, Vi = () => zi, Hi = "no field cipher registered — enable `@voltro/plugin-governance` `governancePlugin({ fieldEncryption: { key } })` (or call setFieldCipher) so a key is available.", Ui = (e) => {
-	let t = Vi();
-	if (!t) throw Error(`encryptField: ${Hi}`);
+}, Vi = (e) => Bi(zi(e)), Hi, Ui = (e) => {
+	Hi = e;
+}, Wi = () => Hi, Gi = "no field cipher registered — enable `@voltro/plugin-governance` `governancePlugin({ fieldEncryption: { key } })` (or call setFieldCipher) so a key is available.", Ki = (e) => {
+	let t = Wi();
+	if (!t) throw Error(`encryptField: ${Gi}`);
 	return t.encrypt(e);
-}, Wi = (e) => {
+}, qi = (e) => {
 	if (!x(e)) return e;
-	let t = Vi();
-	if (!t) throw Error(`decryptField: ${Hi}`);
+	let t = Wi();
+	if (!t) throw Error(`decryptField: ${Gi}`);
 	return t.decrypt(e);
-}, Gi = "_voltro_idempotency", Ki = (e) => {
+}, Ji = "_voltro_idempotency", Yi = (e) => {
 	if (e == null) return null;
 	let t = typeof e == "string" ? JSON.parse(e) : e;
 	return t && typeof t == "object" && "status" in t ? t : null;
-}, qi = (e) => ({
+}, Xi = (e) => ({
 	scope: e.scope,
 	key: e.key,
 	status: e.status === "completed" ? "completed" : "in_flight",
-	response: Ki(e.response),
+	response: Yi(e.response),
 	createdAt: Ue(e.createdAt)
-}), Ji = async (e, n, r) => (await e.query({
-	table: Gi,
+}), Zi = async (e, n, r) => (await e.query({
+	table: Ji,
 	predicate: t(u("scope", n), u("key", r)),
 	order: [],
 	take: 1,
 	skip: void 0,
 	projection: void 0
-}))[0] ?? null, Yi = (e) => ({
+}))[0] ?? null, Qi = (e) => ({
 	get: async (t, n) => {
-		let r = await Ji(e, t, n);
-		return r ? qi(r) : null;
+		let r = await Zi(e, t, n);
+		return r ? Xi(r) : null;
 	},
 	claim: async (t, n, r, i) => {
 		for (let a = 0; a < 2; a++) {
 			let a = f({
 				kind: "typeid",
 				prefix: "idem"
-			}, Gi), o = await e.insertIgnore(Gi, {
+			}, Ji), o = await e.insertIgnore(Ji, {
 				id: a,
 				scope: t,
 				key: n,
@@ -2484,11 +2488,11 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 				createdAt: new Date(r)
 			}, { conflictColumns: ["scope", "key"] });
 			if (o.id === a) return "claimed";
-			if (r - Ue(o.createdAt) < i) return qi(o);
-			await e.delete(Gi, o.id);
+			if (r - Ue(o.createdAt) < i) return Xi(o);
+			await e.delete(Ji, o.id);
 		}
-		let a = await Ji(e, t, n);
-		return a ? qi(a) : {
+		let a = await Zi(e, t, n);
+		return a ? Xi(a) : {
 			scope: t,
 			key: n,
 			status: "in_flight",
@@ -2497,33 +2501,33 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		};
 	},
 	complete: async (t, n, r, i) => {
-		let a = await Ji(e, t, n);
-		a && await e.update(Gi, a.id, {
+		let a = await Zi(e, t, n);
+		a && await e.update(Ji, a.id, {
 			status: "completed",
 			response: r
 		});
 	},
 	release: async (t, n) => {
-		let r = await Ji(e, t, n);
-		r && await e.delete(Gi, r.id);
+		let r = await Zi(e, t, n);
+		r && await e.delete(Ji, r.id);
 	}
-}), J = "_voltro_kv", Xi = (e) => {
+}), J = "_voltro_kv", $i = (e) => {
 	if (e == null) return null;
 	if (e instanceof Date) return e.getTime();
 	if (typeof e == "number") return e;
 	let t = Date.parse(String(e));
 	return Number.isNaN(t) ? null : t;
-}, Zi = (e, t) => {
-	let n = Xi(e.expiresAt);
+}, ea = (e, t) => {
+	let n = $i(e.expiresAt);
 	return n !== null && n <= t;
-}, Qi = (e) => e === null ? null : JSON.parse(e), $i = async (e, t) => (await e.query({
+}, ta = (e) => e === null ? null : JSON.parse(e), na = async (e, t) => (await e.query({
 	table: J,
 	predicate: u("key", t),
 	order: [],
 	take: 1,
 	skip: void 0,
 	projection: void 0
-}))[0] ?? null, ea = (e) => {
+}))[0] ?? null, ra = (e) => {
 	let n = (e, t, n) => P.tryPromise({
 		try: n,
 		catch: (n) => new St({
@@ -2534,8 +2538,8 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	});
 	return {
 		get: (t) => n("get", t, async () => {
-			let n = await $i(e, t);
-			return n === null ? tt.none() : Zi(n, Date.now()) ? (await e.delete(J, n.id), tt.none()) : tt.some(Qi(n.value));
+			let n = await na(e, t);
+			return n === null ? tt.none() : ea(n, Date.now()) ? (await e.delete(J, n.id), tt.none()) : tt.some(ta(n.value));
 		}),
 		set: (t, r, i) => n("set", t, async () => {
 			let n = Date.now(), a = i?.ttlMs !== void 0 && i.ttlMs > 0 ? new Date(n + i.ttlMs) : null, o = f({
@@ -2558,14 +2562,14 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			});
 		}),
 		delete: (t) => n("delete", t, async () => {
-			let n = await $i(e, t);
+			let n = await na(e, t);
 			if (n === null) return !1;
-			let r = !Zi(n, Date.now());
+			let r = !ea(n, Date.now());
 			return await e.delete(J, n.id), r;
 		}),
 		has: (t) => n("has", t, async () => {
-			let n = await $i(e, t);
-			return n === null ? !1 : Zi(n, Date.now()) ? (await e.delete(J, n.id), !1) : !0;
+			let n = await na(e, t);
+			return n === null ? !1 : ea(n, Date.now()) ? (await e.delete(J, n.id), !1) : !0;
 		}),
 		list: (r) => n("list", "", async () => {
 			let n = Date.now(), i = ie(S("expiresAt"), h("expiresAt", new Date(n))), a = r === "" ? i : t(o("key", r), i), s = await e.query({
@@ -2576,7 +2580,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 				skip: void 0,
 				projection: void 0
 			}), c = [];
-			for (let e of s) Zi(e, n) || (r === "" || e.key.startsWith(r)) && c.push(e.key);
+			for (let e of s) ea(e, n) || (r === "" || e.key.startsWith(r)) && c.push(e.key);
 			return c;
 		}),
 		clear: () => n("clear", "", async () => {
@@ -2586,8 +2590,8 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			} });
 		})
 	};
-}, ta = async ({ store: e, env: t = process.env }) => {
-	let n = (t.KV_BACKEND ?? "database").toLowerCase(), r = n === "redis" ? "redis" : n === "memory" ? "memory" : "database", i = r === "redis" ? Et(t.KV_KEY_PREFIX ? { keyPrefix: t.KV_KEY_PREFIX } : {}).pipe(F.provide(wt)) : r === "memory" ? Tt() : F.succeed(Ct, Ct.of(ea(e))), a = Qe.make(xt.Default.pipe(F.provide(i))), o = await a.runPromise(xt);
+}, ia = async ({ store: e, env: t = process.env }) => {
+	let n = (t.KV_BACKEND ?? "database").toLowerCase(), r = n === "redis" ? "redis" : n === "memory" ? "memory" : "database", i = r === "redis" ? Et(t.KV_KEY_PREFIX ? { keyPrefix: t.KV_KEY_PREFIX } : {}).pipe(F.provide(wt)) : r === "memory" ? Tt() : F.succeed(Ct, Ct.of(ra(e))), a = Qe.make(xt.Default.pipe(F.provide(i))), o = await a.runPromise(xt);
 	return {
 		kv: {
 			get: (e) => a.runPromise(o.get(e)).then((e) => tt.getOrUndefined(e)),
@@ -2602,7 +2606,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		backend: r,
 		dispose: () => a.dispose()
 	};
-}, na = {
+}, aa = {
 	get: () => Promise.resolve(void 0),
 	getOrElse: (e, t) => Promise.resolve(t()),
 	set: () => Promise.resolve(),
@@ -2610,7 +2614,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	has: () => Promise.resolve(!1),
 	list: () => Promise.resolve([]),
 	clear: () => Promise.resolve()
-}, ra = "_voltro_api_keys", ia = (e) => he("sha256").update(e, "utf8").digest("hex"), aa = (e = "voltro_") => `${e}${ge(30).toString("base64url")}`, oa = (e) => ({
+}, oa = "_voltro_api_keys", sa = (e) => he("sha256").update(e, "utf8").digest("hex"), ca = (e = "voltro_") => `${e}${ge(30).toString("base64url")}`, la = (e) => ({
 	id: e.id,
 	name: e.name,
 	keyPrefix: e.keyPrefix,
@@ -2619,26 +2623,30 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	lastUsedAt: e.lastUsedAt,
 	expiresAt: e.expiresAt,
 	revokedAt: e.revokedAt,
-	createdAt: e.createdAt
-}), sa = (e, t) => e.revokedAt === null && (e.expiresAt === null || e.expiresAt > t), ca = (e, t = {}) => {
+	createdAt: e.createdAt,
+	createdBy: e.createdBy ?? null,
+	onBehalfOf: e.onBehalfOf ?? null,
+	...e.metadata == null ? {} : { metadata: e.metadata }
+}), ua = (e, t) => e.revokedAt === null && (e.expiresAt === null || e.expiresAt > t), da = (e, t = {}) => {
 	let n = t.prefix ?? "voltro_", r = t.usage, i = async (t) => {
-		let r = aa(n), i = f({
+		let r = ca(n), i = f({
 			kind: "typeid",
 			prefix: "apikey"
-		}, ra), a = t.scopes ?? [], o = t.expiresAt == null ? null : t.expiresAt instanceof Date ? t.expiresAt.getTime() : t.expiresAt;
+		}, oa), a = t.scopes ?? [], o = t.expiresAt == null ? null : t.expiresAt instanceof Date ? t.expiresAt.getTime() : t.expiresAt;
 		return await e.insert({
 			id: i,
 			tenantId: t.tenantId ?? null,
 			name: t.name,
 			onBehalfOf: t.onBehalfOf ?? null,
-			hashedKey: ia(r),
+			hashedKey: sa(r),
 			keyPrefix: r.slice(0, n.length + 6),
 			scopes: a,
 			lastUsedAt: null,
 			expiresAt: o,
 			revokedAt: null,
 			createdBy: t.createdBy ?? null,
-			createdAt: Date.now()
+			createdAt: Date.now(),
+			...t.metadata == null ? {} : { metadata: t.metadata }
 		}), {
 			id: i,
 			token: r,
@@ -2649,18 +2657,19 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		};
 	}, a = async (t, n = Date.now()) => {
 		let i = await e.findByHash(t);
-		return !i || !sa(i, n) ? null : (r === void 0 ? await e.patch(i.id, { lastUsedAt: n }) : r.touch(i.id, n), {
+		return !i || !ua(i, n) ? null : (r === void 0 ? await e.patch(i.id, { lastUsedAt: n }) : r.touch(i.id, n), {
 			id: i.id,
 			tenantId: i.tenantId ?? "",
 			createdBy: i.createdBy ?? null,
 			onBehalfOf: i.onBehalfOf ?? null,
-			scopes: i.scopes ?? []
+			scopes: i.scopes ?? [],
+			...i.metadata == null ? {} : { metadata: i.metadata }
 		});
 	};
 	return {
 		issue: i,
 		resolveByHash: a,
-		verify: (e, t) => a(ia(e), t),
+		verify: (e, t) => a(sa(e), t),
 		revoke: async (t, n, r = Date.now()) => {
 			let i = await e.findById(t);
 			return !i || (i.tenantId ?? null) !== n ? !1 : (await e.patch(t, { revokedAt: r }), !0);
@@ -2672,12 +2681,13 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 				name: a.name,
 				scopes: a.scopes ?? [],
 				createdBy: a.createdBy,
-				onBehalfOf: a.onBehalfOf ?? null
+				onBehalfOf: a.onBehalfOf ?? null,
+				...a.metadata == null ? {} : { metadata: a.metadata }
 			}));
 		},
-		list: async (t) => (await e.listByTenant(t)).map(oa)
+		list: async (t) => (await e.listByTenant(t)).map(la)
 	};
-}, la = () => {
+}, fa = () => {
 	let e = /* @__PURE__ */ new Map();
 	return {
 		insert: async (t) => {
@@ -2694,20 +2704,21 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			});
 		}
 	};
-}, ua = (e) => e == null ? null : e instanceof Date ? e.getTime() : typeof e == "number" ? e : typeof e == "string" ? new Date(e).getTime() : null, da = (e) => ({
+}, pa = (e) => e == null ? null : e instanceof Date ? e.getTime() : typeof e == "number" ? e : typeof e == "string" ? new Date(e).getTime() : null, ma = (e) => ({
 	id: String(e.id),
 	tenantId: e.tenantId ?? null,
 	name: String(e.name),
 	hashedKey: String(e.hashedKey),
 	keyPrefix: String(e.keyPrefix),
 	scopes: e.scopes ?? null,
-	lastUsedAt: ua(e.lastUsedAt),
-	expiresAt: ua(e.expiresAt),
-	revokedAt: ua(e.revokedAt),
+	lastUsedAt: pa(e.lastUsedAt),
+	expiresAt: pa(e.expiresAt),
+	revokedAt: pa(e.revokedAt),
 	createdBy: e.createdBy ?? null,
 	onBehalfOf: e.onBehalfOf ?? null,
-	createdAt: ua(e.createdAt) ?? 0
-}), fa = (e) => async (t, n) => {
+	createdAt: pa(e.createdAt) ?? 0,
+	...e.metadata == null ? {} : { metadata: e.metadata }
+}), ha = (e) => async (t, n) => {
 	let r = await e.findById(t);
 	if (r === null) return;
 	let i = r.requestCount ?? 0, a = r.lastUsedAt ?? 0;
@@ -2715,9 +2726,9 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		requestCount: i + n.requests,
 		lastUsedAt: Math.max(a, n.lastUsedAt)
 	});
-}, pa = (e) => {
+}, ga = (e) => {
 	let t = async (t) => await e.query({
-		table: ra,
+		table: oa,
 		predicate: t,
 		order: [],
 		take: void 0,
@@ -2735,33 +2746,33 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	};
 	return {
 		insert: async (t) => {
-			await e.insert(ra, n(t));
+			await e.insert(oa, n(t));
 		},
 		findByHash: async (e) => {
 			let n = await t(u("hashedKey", e));
-			return n[0] ? da(n[0]) : null;
+			return n[0] ? ma(n[0]) : null;
 		},
 		findById: async (e) => {
 			let n = await t(u("id", e));
-			return n[0] ? da(n[0]) : null;
+			return n[0] ? ma(n[0]) : null;
 		},
-		listByTenant: async (e) => (await t(e === null ? void 0 : u("tenantId", e))).map(da).filter((t) => e === null || t.tenantId === e),
+		listByTenant: async (e) => (await t(e === null ? void 0 : u("tenantId", e))).map(ma).filter((t) => e === null || t.tenantId === e),
 		patch: async (t, r) => {
-			await e.update(ra, t, n(r));
+			await e.update(oa, t, n(r));
 		}
 	};
-}, ma = (e, t = {}) => Dt({
+}, _a = (e, t = {}) => Dt({
 	id: "voltro-apikey",
 	...t.prefix ? { prefix: t.prefix } : {},
 	resolveKey: (t) => e.resolveByHash(t)
-}), ha = (e) => {
+}), va = (e) => {
 	let t = e.subject;
 	return {
 		id: t.id ?? null,
 		tenantId: t.tenantId ?? null,
 		scopes: t.scopes ?? []
 	};
-}, ga = (e, t = "/v1/api-keys") => {
+}, ya = (e, t = "/v1/api-keys") => {
 	let n = R.Struct({
 		id: R.String,
 		name: R.String,
@@ -2771,7 +2782,13 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		lastUsedAt: R.NullOr(R.Number),
 		expiresAt: R.NullOr(R.Number),
 		revokedAt: R.NullOr(R.Number),
-		createdAt: R.Number
+		createdAt: R.Number,
+		createdBy: R.NullOr(R.String),
+		onBehalfOf: R.NullOr(R.String),
+		metadata: R.optional(R.NullOr(R.Record({
+			key: R.String,
+			value: R.Unknown
+		})))
 	});
 	return [
 		mt({
@@ -2796,7 +2813,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 				keyPrefix: R.String
 			}),
 			handler: async (t, n) => {
-				let r = t.body, i = ha(n), a = new Set(i.scopes), o = (e) => a.has(be) || a.has(e), s = r.onBehalfOf === void 0 ? i.id : r.onBehalfOf;
+				let r = t.body, i = va(n), a = new Set(i.scopes), o = (e) => a.has(be) || a.has(e), s = r.onBehalfOf === void 0 ? i.id : r.onBehalfOf;
 				if (s === null) {
 					if (!o(xe)) throw new Oe({
 						required: xe,
@@ -2841,7 +2858,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			guards: [_t(be)],
 			input: R.Struct({}),
 			output: R.Struct({ keys: R.Array(n) }),
-			handler: async (t, n) => ({ keys: [...await e.list(ha(n).tenantId)] })
+			handler: async (t, n) => ({ keys: [...await e.list(va(n).tenantId)] })
 		}),
 		mt({
 			method: "POST",
@@ -2850,56 +2867,56 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			guards: [_t(be)],
 			input: R.Struct({ body: R.Struct({ id: R.String }) }),
 			output: R.Struct({ ok: R.Boolean }),
-			handler: async (t, n) => ({ ok: await e.revoke(t.body.id, ha(n).tenantId) })
+			handler: async (t, n) => ({ ok: await e.revoke(t.body.id, va(n).tenantId) })
 		})
 	];
-}, _a = {
+}, ba = {
 	type: "anonymous",
 	id: null,
 	tenantId: null
-}, va = class extends R.TaggedError()("TenantScopeViolation", {
+}, xa = class extends R.TaggedError()("TenantScopeViolation", {
 	table: R.String,
 	reason: R.String
-}) {}, ya = class extends R.TaggedError()("StoreOperationFailed", {
+}) {}, Sa = class extends R.TaggedError()("StoreOperationFailed", {
 	operation: R.String,
 	table: R.String,
 	cause: R.String
-}) {}, ba = class extends R.TaggedError()("TableValidationFailed", {
+}) {}, Ca = class extends R.TaggedError()("TableValidationFailed", {
 	table: R.String,
 	summary: R.String,
 	issues: R.Array(R.Struct({
 		path: R.String,
 		message: R.String
 	}))
-}) {}, xa = class extends Ge.Tag("@voltro/EffectStore")() {}, Sa = (e, t) => (n) => n instanceof va ? n : new ya({
+}) {}, wa = class extends Ge.Tag("@voltro/EffectStore")() {}, Ta = (e, t) => (n) => n instanceof xa ? n : new Sa({
 	operation: e,
 	table: t,
 	cause: String(n)
-}), Ca = (e, t, n) => P.tryPromise({
+}), Ea = (e, t, n) => P.tryPromise({
 	try: n,
-	catch: Sa(e, t)
-}), wa = (e) => F.succeed(xa, {
-	query: ((t) => Ca("query", t.table, () => e.query(t))),
-	insert: (t, n) => Ca("insert", t, () => e.insert(t, n)),
-	update: (t, n, r) => Ca("update", t, () => e.update(t, n, r)),
-	delete: (t, n) => Ca("delete", t, () => e.delete(t, n)),
-	hardDelete: (t, n) => Ca("hardDelete", t, () => e.hardDelete(t, n))
-}), Ta = (e) => dt.make(e.name, {
+	catch: Ta(e, t)
+}), Da = (e) => F.succeed(wa, {
+	query: ((t) => Ea("query", t.table, () => e.query(t))),
+	insert: (t, n) => Ea("insert", t, () => e.insert(t, n)),
+	update: (t, n, r) => Ea("update", t, () => e.update(t, n, r)),
+	delete: (t, n) => Ea("delete", t, () => e.delete(t, n)),
+	hardDelete: (t, n) => Ea("hardDelete", t, () => e.hardDelete(t, n))
+}), Oa = (e) => dt.make(e.name, {
 	payload: e.payloadSchema,
 	success: Ne,
 	error: e.errorSchema
-}), Ea = (e, t) => ({
+}), ka = (e, t) => ({
 	id: t,
 	workflowName: e,
 	executionId: t,
 	status: "running"
-}), Da = Ea, Oa = (e) => {
+}), Aa = ka, ja = (e) => {
 	let t = N.failureOption(e), n = t._tag === "Some" ? t.value : N.squash(e);
 	return {
 		tag: n && typeof n == "object" && "_tag" in n ? String(n._tag) : null,
 		message: n?.message ?? String(n)
 	};
-}, ka = (e, t, n) => {
+}, Ma = (e, t, n) => {
 	if (n === void 0) return {
 		id: t,
 		workflowName: e,
@@ -2925,7 +2942,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			workflowName: e,
 			executionId: t,
 			status: "failed",
-			error: Oa(r.cause)
+			error: ja(r.cause)
 		};
 	}
 	return {
@@ -2934,7 +2951,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		executionId: t,
 		status: "running"
 	};
-}, Aa = (e) => new Promise((t) => setTimeout(t, e)), ja = class extends Error {
+}, Na = (e) => new Promise((t) => setTimeout(t, e)), Pa = class extends Error {
 	workflowName;
 	missingFields;
 	detail;
@@ -2943,7 +2960,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		let r = t.length > 0 ? ` missing required field(s): ${t.join(", ")}.` : "";
 		super(`Workflow "${e}" was started with an invalid payload.${r} ${n}`), this.workflowName = e, this.missingFields = t, this.detail = n, this.name = "WorkflowPayloadError";
 	}
-}, Ma = (e) => {
+}, Fa = (e) => {
 	let t = e.ast;
 	if (!Array.isArray(t.propertySignatures)) return {
 		required: [],
@@ -2954,10 +2971,10 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		required: n.filter((e) => !e.isOptional).map((e) => String(e.name)),
 		optional: n.filter((e) => e.isOptional).map((e) => String(e.name))
 	};
-}, Na = (e) => {
+}, Ia = (e) => {
 	let t = e.ast;
 	return Array.isArray(t.propertySignatures) ? t.propertySignatures.filter((e) => !e.isOptional && typeof e.name == "string").map((e) => String(e.name)) : [];
-}, Pa = (e) => {
+}, La = (e) => {
 	let t = new Map(e.workflows.map((e) => [e.definition.name, e.definition])), n = (e) => {
 		let n = t.get(e);
 		if (!n) {
@@ -2968,17 +2985,17 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	}, r = (e, t) => {
 		let n = R.validateEither(e.payloadSchema)(t);
 		if (n._tag === "Right") return;
-		let r = typeof t == "object" && t ? Object.keys(t) : [], i = Na(e.payloadSchema).filter((e) => !r.includes(e));
-		throw new ja(e.name, i, kt.formatErrorSync(n.left));
+		let r = typeof t == "object" && t ? Object.keys(t) : [], i = Ia(e.payloadSchema).filter((e) => !r.includes(e));
+		throw new Pa(e.name, i, kt.formatErrorSync(n.left));
 	}, i = (e, t) => {
 		let i = n(e);
 		return r(i, t), i;
 	}, a = async (t, r) => {
 		let i = n(t);
-		return ka(t, r, await e.runEffect(i.poll(r)));
+		return Ma(t, r, await e.runEffect(i.poll(r)));
 	}, o = async () => e.runEffect(At()), s = async (t, n, r) => {
 		let a = i(t, n), o;
-		return r?.callerContext !== void 0 && (o = await e.runEffect(a.executionId(n)), await e.rememberStartContext?.(t, o, r.callerContext)), r?.wait ? (await e.runEffect(a.execute(n)), Ea(t, o ?? await e.runEffect(a.executionId(n)))) : Ea(t, await e.runEffect(a.execute(n, { discard: !0 })));
+		return r?.callerContext !== void 0 && (o = await e.runEffect(a.executionId(n)), await e.rememberStartContext?.(t, o, r.callerContext)), r?.wait ? (await e.runEffect(a.execute(n)), ka(t, o ?? await e.runEffect(a.executionId(n)))) : ka(t, await e.runEffect(a.execute(n, { discard: !0 })));
 	};
 	return {
 		start: s,
@@ -3016,7 +3033,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 				let e = await a(r, i);
 				if (e.status === "succeeded" || e.status === "failed" || e.status === "cancelled") return e;
 				if (o?.timeoutMs !== void 0 && Date.now() - s >= o.timeoutMs) throw Error(`Timed out waiting for workflow '${r}' run '${i}'`);
-				await Aa(c);
+				await Na(c);
 			}
 		}),
 		cancel: async (t, r) => {
@@ -3054,22 +3071,22 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			return e.retry(t, n);
 		}
 	};
-}, Fa = (e, t) => ({
+}, Ra = (e, t) => ({
 	...e,
 	start: async (n, r, i) => {
 		if (i?.wait) throw Error("ctx.workflows.start(..., { wait: true }) is not allowed inside a mutation transaction; start the workflow and wait after commit.");
 		let a = await e.executionId(n, r);
-		return t(() => e.start(n, r)), Ea(n, a);
+		return t(() => e.start(n, r)), ka(n, a);
 	},
 	child: async (n, r, i) => {
 		if (i?.wait) throw Error("ctx.workflows.child(..., { wait: true }) is not allowed inside a mutation transaction; start the child workflow and wait after commit.");
 		let a = await e.executionId(n, r);
-		return t(() => e.child(n, r, i)), Ea(n, a);
+		return t(() => e.child(n, r, i)), ka(n, a);
 	},
 	run: async () => {
 		throw Error("ctx.workflows.run(...) is not allowed inside a mutation transaction; use ctx.workflows.start(...) so the workflow starts after commit.");
 	}
-}), Ia = (e, t) => ({
+}), za = (e, t) => ({
 	...e,
 	start: (n, r, i) => e.start(n, r, {
 		...i,
@@ -3083,7 +3100,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		...i,
 		callerContext: t
 	})
-}), La = (e) => {
+}), Ba = (e) => {
 	let t = () => {
 		let t = e();
 		if (!t) throw Error("Workflow runtime is not ready yet");
@@ -3104,32 +3121,32 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		listRuns: ((e) => t().listRuns(e)),
 		retry: (e, n) => t().retry(e, n)
 	};
-}, Ra = (e, t) => {
+}, Va = (e, t) => {
 	let n = {};
-	for (let r of e) n[r.definition.name] = (e) => (t ? P.promise(() => t.start(r.definition.name, e)) : r.definition.execute(e, { discard: !0 }).pipe(P.map((e) => Ea(r.definition.name, e)))).pipe(P.withSpan(`workflow.${r.definition.name}`, { attributes: { "framework.kind": "workflow" } }));
+	for (let r of e) n[r.definition.name] = (e) => (t ? P.promise(() => t.start(r.definition.name, e)) : r.definition.execute(e, { discard: !0 }).pipe(P.map((e) => ka(r.definition.name, e)))).pipe(P.withSpan(`workflow.${r.definition.name}`, { attributes: { "framework.kind": "workflow" } }));
 	return n;
-}, za = (e, t, n) => e.map((e) => e.definition.toLayer(((r, i) => {
+}, Ha = (e, t, n) => e.map((e) => e.definition.toLayer(((r, i) => {
 	let a = t.resolveStartContext?.(e.definition.name, i);
 	return (a === void 0 ? P.succeed(void 0) : P.promise(() => Promise.resolve(a))).pipe(P.flatMap((a) => {
 		let o = {
 			...a,
-			subject: a?.subject ?? _a,
+			subject: a?.subject ?? ba,
 			traceId: a?.traceId ?? "workflow-bootstrap"
 		}, s = t.buildContext(o, {
 			workflowName: e.definition.name,
 			executionId: i,
 			parentExecutionId: a?.parentExecutionId ?? null,
 			parentClosePolicy: a?.parentClosePolicy ?? null
-		}), c = e.buildExecute(s), l = (n?.(e, c, o) ?? c)(r, i), u = F.succeed(ke, o.subject), d = s?.store, f = d === void 0 ? l : P.provide(l, wa(d));
+		}), c = e.buildExecute(s), l = (n?.(e, c, o) ?? c)(r, i), u = F.succeed(ke, o.subject), d = s?.store, f = d === void 0 ? l : P.provide(l, Da(d));
 		return P.provide(f, u);
 	}));
-}))), Ba = (e) => ({
+}))), Ua = (e) => ({
 	_tag: "workflowEventTrigger",
 	...e
-}), Va = Ba, Ha = (e) => typeof e == "object" && !!e && e._tag === "workflowEventTrigger", Ua = () => {
+}), Wa = Ua, Ga = (e) => typeof e == "object" && !!e && e._tag === "workflowEventTrigger", Ka = () => {
 	let e = globalThis.crypto;
 	return typeof e?.randomUUID == "function" ? e.randomUUID() : `${Date.now().toString(36)}${Math.random().toString(36).slice(2)}`;
-}, Wa = (e) => `${e}_${Ua()}`, Ga = (e) => e.id ?? `${e.event}->${e.workflow}`, Ka = O("_voltro_workflow_events", {
+}, qa = (e) => `${e}_${Ka()}`, Ja = (e) => e.id ?? `${e.event}->${e.workflow}`, Ya = O("_voltro_workflow_events", {
 	id: v({ prefix: "wfe" }),
 	name: k(),
 	payload: C(),
@@ -3137,7 +3154,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	subject: C().nullable(),
 	traceId: k().nullable(),
 	occurredAt: A().default("now")
-}).index(["name"]).index(["source"]).index(["occurredAt"]).reactive(), qa = O("_voltro_workflow_event_deliveries", {
+}).index(["name"]).index(["source"]).index(["occurredAt"]).reactive(), Xa = O("_voltro_workflow_event_deliveries", {
 	id: v({ prefix: "wfed" }),
 	eventId: k(),
 	eventName: k(),
@@ -3155,8 +3172,8 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	errorMessage: k().nullable(),
 	createdAt: A().default("now"),
 	completedAt: A().nullable()
-}).index(["eventId"]).index(["eventName"]).index(["triggerId"]).index(["workflowName"]).index(["status"]).reactive(), Ja = (e) => {
-	let t = e.makeId ?? Wa, n = /* @__PURE__ */ new Map();
+}).index(["eventId"]).index(["eventName"]).index(["triggerId"]).index(["workflowName"]).index(["status"]).reactive(), Za = (e) => {
+	let t = e.makeId ?? qa, n = /* @__PURE__ */ new Map();
 	for (let t of e.triggers) {
 		let e = n.get(t.event);
 		e ? e.push(t) : n.set(t.event, [t]);
@@ -3197,7 +3214,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		});
 		let p = o(n), m = [];
 		for (let o of p) {
-			let s = Ga(o), l = o.workflow, d;
+			let s = Ja(o), l = o.workflow, d;
 			try {
 				let p = o.idempotencyKey?.(f) ?? `${c}:${s}`;
 				if (o.filter && !await o.filter(f)) {
@@ -3300,10 +3317,10 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			triggered: m
 		};
 	} };
-}, Ya = M({ scope: "voltro:outbox" }), Y = "_voltro_outbox", Xa = {
+}, Qa = M({ scope: "voltro:outbox" }), Y = "_voltro_outbox", $a = {
 	kind: "typeid",
 	prefix: "obx"
-}, Za = O(Y, {
+}, eo = O(Y, {
 	id: v({ prefix: "obx" }),
 	effect: k(),
 	payload: C(),
@@ -3321,10 +3338,10 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	resendRequestedBy: k().nullable(),
 	resendReason: k().nullable(),
 	resendCount: b()
-}), Qa = "_voltro_outbox_attempts", $a = {
+}), to = "_voltro_outbox_attempts", no = {
 	kind: "typeid",
 	prefix: "obxa"
-}, eo = O(Qa, {
+}, ro = O(to, {
 	id: v({ prefix: "obxa" }),
 	outboxId: k(),
 	effect: k(),
@@ -3345,11 +3362,11 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	subjectId: k().nullable(),
 	tenantId: k().nullable(),
 	traceId: k().nullable()
-}).index(["outboxId", "attempt"]).index(["startedAt"]).index(["outcome"]), to = (e) => {
+}).index(["outboxId", "attempt"]).index(["startedAt"]).index(["outcome"]), io = (e) => {
 	if (e.effect.trim() === "") throw Error("defineOutboxHandler: `effect` must be a non-empty name");
 	if (e.maxAttempts !== void 0 && e.maxAttempts < 1) throw Error(`defineOutboxHandler("${e.effect}"): maxAttempts must be >= 1`);
 	return e;
-}, no = 8, ro = (e) => ({
+}, ao = 8, oo = (e) => ({
 	enqueue: async (n, r, i) => {
 		let a = (e.now ?? (() => /* @__PURE__ */ new Date()))(), o = i?.idempotencyKey;
 		if (o !== void 0) {
@@ -3364,12 +3381,12 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			if (n !== void 0) return n.id;
 		}
 		let s = {
-			id: f(Xa, Y),
+			id: f($a, Y),
 			effect: n,
 			payload: r,
 			status: "pending",
 			attempts: 0,
-			maxAttempts: i?.maxAttempts ?? no,
+			maxAttempts: i?.maxAttempts ?? ao,
 			nextAttemptAt: new Date(a.getTime() + (i?.delayMs ?? 0)),
 			idempotencyKey: o ?? null,
 			lastError: null,
@@ -3416,7 +3433,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			});
 		} else e.nudge?.();
 	}
-}), io = (e) => Math.min(1e3 * 2 ** Math.max(0, e - 1), 5 * 6e4), ao = 50, oo = (e, t) => e.length <= t ? e : `${e.slice(0, t)}… [clipped]`, so = (e) => {
+}), so = (e) => Math.min(1e3 * 2 ** Math.max(0, e - 1), 5 * 6e4), co = 50, lo = (e, t) => e.length <= t ? e : `${e.slice(0, t)}… [clipped]`, uo = (e) => {
 	if (e == null) return null;
 	let t = typeof e == "object" && !Array.isArray(e) ? e : { value: e }, n;
 	try {
@@ -3426,13 +3443,13 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	}
 	return n.length > 8192 ? {
 		truncated: !0,
-		preview: oo(n, 8192)
+		preview: lo(n, 8192)
 	} : t;
-}, co = async (e, t, n) => {
+}, fo = async (e, t, n) => {
 	let r = t.outboxRow, i = r.id, a = r.resendRequestedBy ?? null;
 	try {
-		await e.insert(Qa, {
-			id: f($a, Qa),
+		await e.insert(to, {
+			id: f(no, to),
 			outboxId: i,
 			effect: r.effect,
 			attempt: t.attempt,
@@ -3443,14 +3460,14 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			startedAt: t.startedAt,
 			finishedAt: t.finishedAt,
 			durationMs: Math.max(0, t.finishedAt.getTime() - t.startedAt.getTime()),
-			error: t.error === null ? null : oo(t.error, 4e3),
-			response: so(t.response),
+			error: t.error === null ? null : lo(t.error, 4e3),
+			response: uo(t.response),
 			subjectId: r.subjectId ?? null,
 			tenantId: r.tenantId ?? null,
 			traceId: r.traceId ?? null
 		});
 	} catch (e) {
-		Ya.warn("outbox: could not record delivery attempt (delivery itself is unaffected)", {
+		Qa.warn("outbox: could not record delivery attempt (delivery itself is unaffected)", {
 			outboxId: i,
 			attempt: t.attempt
 		}, e);
@@ -3458,7 +3475,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	}
 	if (!(t.attempt <= n)) try {
 		let t = await e.query({
-			table: Qa,
+			table: to,
 			predicate: u("outboxId", i),
 			order: [{
 				column: "attempt",
@@ -3468,11 +3485,11 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			skip: void 0,
 			projection: ["id"]
 		});
-		for (let r of t.slice(0, Math.max(0, t.length - n))) await e.delete(Qa, r.id);
+		for (let r of t.slice(0, Math.max(0, t.length - n))) await e.delete(to, r.id);
 	} catch (e) {
-		Ya.warn("outbox: attempt-log trim failed; the log may exceed its cap", { outboxId: i }, e);
+		Qa.warn("outbox: attempt-log trim failed; the log may exceed its cap", { outboxId: i }, e);
 	}
-}, lo = async (e) => {
+}, po = async (e) => {
 	let n = (e.now ?? (() => /* @__PURE__ */ new Date()))(), r = await e.store.query({
 		table: Y,
 		predicate: t(u("status", "pending"), ee("nextAttemptAt", n)),
@@ -3490,7 +3507,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			s++;
 			continue;
 		}
-		let u = t.attempts + 1, d = t.maxAttempts ?? no, f = /* @__PURE__ */ new Date(), p = e.attemptLogCap ?? 50;
+		let u = t.attempts + 1, d = t.maxAttempts ?? ao, f = /* @__PURE__ */ new Date(), p = e.attemptLogCap ?? 50;
 		try {
 			let n = await l.handler({
 				payload: t.payload ?? {},
@@ -3499,7 +3516,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 				tenantId: t.tenantId ?? null,
 				traceId: t.traceId ?? null
 			});
-			await co(e.store, {
+			await fo(e.store, {
 				outboxRow: t,
 				attempt: u,
 				outcome: "delivered",
@@ -3517,7 +3534,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			}), i++;
 		} catch (i) {
 			let s = i instanceof Error ? i.message : String(i), l = u >= d;
-			await co(e.store, {
+			await fo(e.store, {
 				outboxRow: t,
 				attempt: u,
 				outcome: l ? "dead" : "failed",
@@ -3529,20 +3546,20 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 				status: l ? "dead" : "pending",
 				attempts: u,
 				lastError: s,
-				nextAttemptAt: new Date(n.getTime() + io(u)),
+				nextAttemptAt: new Date(n.getTime() + so(u)),
 				resendRequestedBy: null,
 				resendReason: null
-			}), l ? (o++, Ya.error("outbox effect dead-lettered after exhausting attempts", {
+			}), l ? (o++, Qa.error("outbox effect dead-lettered after exhausting attempts", {
 				id: r,
 				effect: c,
 				attempts: u,
 				maxAttempts: d
-			}, i)) : (a++, Ya.warn("outbox delivery failed; will retry", {
+			}, i)) : (a++, Qa.warn("outbox delivery failed; will retry", {
 				id: r,
 				effect: c,
 				attempt: u,
 				maxAttempts: d,
-				retryInMs: io(u)
+				retryInMs: so(u)
 			}));
 		}
 	}
@@ -3552,10 +3569,10 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		dead: o,
 		skipped: s
 	};
-}, uo = M({ scope: "voltro:connections" }), X = "_voltro_connections", fo = {
+}, mo = M({ scope: "voltro:connections" }), X = "_voltro_connections", ho = {
 	kind: "typeid",
 	prefix: "conn"
-}, po = O(X, {
+}, go = O(X, {
 	id: v({ prefix: "conn" }),
 	connectionId: k(),
 	subjectId: k(),
@@ -3578,10 +3595,10 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	metadata: C().nullable(),
 	connectedAt: A(),
 	updatedAt: A()
-}).unique("bySubject", ["connectionId", "subjectId"]).index(["subjectId"]).reactive(), mo = "_voltro_connection_grants", ho = {
+}).unique("bySubject", ["connectionId", "subjectId"]).index(["subjectId"]).reactive(), _o = "_voltro_connection_grants", vo = {
 	kind: "typeid",
 	prefix: "cgrant"
-}, go = O(mo, {
+}, yo = O(_o, {
 	id: v({ prefix: "cgrant" }),
 	state: k().unique(),
 	connectionId: k(),
@@ -3591,8 +3608,8 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	redirectTo: k(),
 	createdAt: A(),
 	expiresAt: A()
-}).index(["expiresAt"]), _o = /^[a-z][a-z0-9-]*$/, vo = (e) => {
-	if (!_o.test(e.id)) throw Error(`defineConnection: id "${e.id}" must be lowercase kebab-case (it becomes a URL path segment).`);
+}).index(["expiresAt"]), bo = /^[a-z][a-z0-9-]*$/, xo = (e) => {
+	if (!bo.test(e.id)) throw Error(`defineConnection: id "${e.id}" must be lowercase kebab-case (it becomes a URL path segment).`);
 	if (e.kind === "oauth2") {
 		for (let t of [
 			"authorizeUrl",
@@ -3602,9 +3619,9 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		]) if (typeof e[t] != "string" || e[t].length === 0) throw Error(`defineConnection("${e.id}"): \`${t}\` is required for kind 'oauth2'.`);
 	}
 	return e;
-}, yo = (e) => e.label ?? e.id, bo = (e) => {
-	if (e.length !== 0 && Vi() === void 0) throw Error(`connections: ${e.length} connection(s) declared (${e.map((e) => e.id).join(", ")}) but no field cipher is registered. Connection tokens are stored encrypted and there is no plaintext fallback. Enable \`@voltro/plugin-governance\` with \`governancePlugin({ fieldEncryption: { key: env.FIELD_ENCRYPTION_KEY } })\` (or call setFieldCipher at boot).`);
-}, xo = (e) => {
+}, So = (e) => e.label ?? e.id, Co = (e) => {
+	if (e.length !== 0 && Wi() === void 0) throw Error(`connections: ${e.length} connection(s) declared (${e.map((e) => e.id).join(", ")}) but no field cipher is registered. Connection tokens are stored encrypted and there is no plaintext fallback. Enable \`@voltro/plugin-governance\` with \`governancePlugin({ fieldEncryption: { key: env.FIELD_ENCRYPTION_KEY } })\` (or call setFieldCipher at boot).`);
+}, wo = (e) => {
 	let t = /* @__PURE__ */ new Map();
 	for (let n of e) {
 		if (t.has(n.id)) throw Error(`connections: duplicate connection id "${n.id}" — each *.connection.ts must declare a distinct id.`);
@@ -3614,14 +3631,14 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		get: (e) => t.get(e),
 		list: () => [...t.values()]
 	};
-}, So = (e) => {
+}, To = (e) => {
 	if (e == null) return null;
 	let t = e instanceof Date ? e : new Date(String(e));
 	return Number.isNaN(t.getTime()) ? null : t;
-}, Co = (e) => So(e)?.toISOString() ?? null, wo = (e) => String(e ?? "").split(" ").filter((e) => e.length > 0), To = (e, t) => t === void 0 ? {
+}, Eo = (e) => To(e)?.toISOString() ?? null, Do = (e) => String(e ?? "").split(" ").filter((e) => e.length > 0), Oo = (e, t) => t === void 0 ? {
 	connectionId: e.id,
 	kind: e.kind,
-	label: yo(e),
+	label: So(e),
 	status: "disconnected",
 	accountId: null,
 	accountLabel: null,
@@ -3632,31 +3649,31 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 } : {
 	connectionId: e.id,
 	kind: e.kind,
-	label: yo(e),
+	label: So(e),
 	status: String(t.status ?? "connected"),
 	accountId: t.accountId ?? null,
 	accountLabel: t.accountLabel ?? null,
-	scopes: wo(t.scopes),
-	expiresAt: Co(t.expiresAt),
+	scopes: Do(t.scopes),
+	expiresAt: Eo(t.expiresAt),
 	lastError: t.lastError ?? null,
-	connectedAt: Co(t.connectedAt)
-}, Eo = async (e, n, r) => (await e.query({
+	connectedAt: Eo(t.connectedAt)
+}, ko = async (e, n, r) => (await e.query({
 	table: X,
 	predicate: t(u("connectionId", n), u("subjectId", r)),
 	order: [],
 	take: 1,
 	skip: void 0,
 	projection: void 0
-}))[0], Do = async (e) => {
+}))[0], Ao = async (e) => {
 	let t = (e.now ?? (() => /* @__PURE__ */ new Date()))(), n = e.tokens.expiresAt === void 0 ? null : new Date(e.tokens.expiresAt), r = {
-		id: f(fo, X),
+		id: f(ho, X),
 		connectionId: e.definition.id,
 		subjectId: e.subjectId,
 		tenantId: e.tenantId,
 		kind: e.definition.kind,
 		status: "connected",
-		accessToken: Ui(e.tokens.accessToken),
-		refreshToken: e.tokens.refreshToken === void 0 ? null : Ui(e.tokens.refreshToken),
+		accessToken: Ki(e.tokens.accessToken),
+		refreshToken: e.tokens.refreshToken === void 0 ? null : Ki(e.tokens.refreshToken),
 		expiresAt: n,
 		scopes: e.tokens.scopes.length > 0 ? e.tokens.scopes.join(" ") : null,
 		accountId: e.account?.accountId ?? null,
@@ -3667,8 +3684,8 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		connectedAt: t,
 		updatedAt: t
 	};
-	return Oo(e.store, r);
-}, Oo = (e, t) => e.upsert(X, t, {
+	return jo(e.store, r);
+}, jo = (e, t) => e.upsert(X, t, {
 	conflictColumns: ["connectionId", "subjectId"],
 	update: [
 		"kind",
@@ -3684,10 +3701,10 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		"metadata",
 		"updatedAt"
 	]
-}), ko = async (e, t, n) => {
-	let r = await Eo(e, t, n);
+}), Mo = async (e, t, n) => {
+	let r = await ko(e, t, n);
 	return r !== void 0 && e.delete(X, r.id);
-}, Ao = async (e, t, n) => {
+}, No = async (e, t, n) => {
 	let r = await e.query({
 		table: X,
 		predicate: u("subjectId", n),
@@ -3696,9 +3713,9 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		skip: void 0,
 		projection: void 0
 	}), i = new Map(r.map((e) => [String(e.connectionId), e]));
-	return t.list().map((e) => To(e, i.get(e.id)));
-}, jo = (e, t) => globalThis.fetch(e, t), Mo = async (e, t, n) => {
-	let r = e.fetchImpl ?? jo, i, a;
+	return t.list().map((e) => Oo(e, i.get(e.id)));
+}, Po = (e, t) => globalThis.fetch(e, t), Fo = async (e, t, n) => {
+	let r = e.fetchImpl ?? Po, i, a;
 	try {
 		let n = await r(e.tokenUrl, {
 			method: "POST",
@@ -3738,62 +3755,62 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		...Number.isFinite(o.expires_in) ? { expiresAt: n() + o.expires_in * 1e3 } : {},
 		scopes: (o.scope ?? e.scopes?.join(" ") ?? "").split(" ").filter(Boolean)
 	};
-}, No = (e, t, n = Date.now) => Mo(e, {
+}, Io = (e, t, n = Date.now) => Fo(e, {
 	grant_type: "authorization_code",
 	client_id: e.clientId,
 	client_secret: e.clientSecret,
 	code: t.code,
 	redirect_uri: t.redirectUri,
 	...t.codeVerifier ? { code_verifier: t.codeVerifier } : {}
-}, n), Po = (e, t, n = Date.now) => Mo(e, {
+}, n), Lo = (e, t, n = Date.now) => Fo(e, {
 	grant_type: "refresh_token",
 	client_id: e.clientId,
 	client_secret: e.clientSecret,
 	refresh_token: t
-}, n), Fo = 6e4, Io = 3e4, Lo = class extends Error {
+}, n), Ro = 6e4, zo = 3e4, Bo = class extends Error {
 	connectionId;
 	subjectId;
 	_tag = "ConnectionNotConnected";
 	constructor(e, t) {
 		super(`connection "${e}" is not connected for this subject`), this.connectionId = e, this.subjectId = t, this.name = "ConnectionNotConnected";
 	}
-}, Ro = (e) => new Promise((t) => {
+}, Vo = (e) => new Promise((t) => {
 	setTimeout(t, e);
-}), zo = /* @__PURE__ */ new Map(), Bo = (e, t) => `${e}${t}`, Vo = () => {
-	zo.clear();
-}, Ho = (e, t) => ({
+}), Ho = /* @__PURE__ */ new Map(), Uo = (e, t) => `${e}${t}`, Wo = () => {
+	Ho.clear();
+}, Go = (e, t) => ({
 	connectionId: e.id,
 	kind: e.kind,
-	accessToken: Wi(String(t.accessToken)),
-	expiresAt: So(t.expiresAt),
-	scopes: wo(t.scopes),
+	accessToken: qi(String(t.accessToken)),
+	expiresAt: To(t.expiresAt),
+	scopes: Do(t.scopes),
 	accountId: t.accountId ?? null,
 	accountLabel: t.accountLabel ?? null
-}), Uo = (e, t, n) => {
-	let r = So(e.expiresAt);
+}), Ko = (e, t, n) => {
+	let r = To(e.expiresAt);
 	return r !== null && r.getTime() - n < t;
-}, Wo = async (e) => {
-	let t = e.now ?? Date.now, { store: n, definition: r, subjectId: i } = e, a = await Eo(n, r.id, i);
-	if (a === void 0) throw new Lo(r.id, i);
-	if (r.kind === "pat" || !Uo(a, r.refreshSkewMs ?? 6e4, t())) return Ho(r, a);
-	let o = Bo(r.id, i), s = zo.get(o);
+}, qo = async (e) => {
+	let t = e.now ?? Date.now, { store: n, definition: r, subjectId: i } = e, a = await ko(n, r.id, i);
+	if (a === void 0) throw new Bo(r.id, i);
+	if (r.kind === "pat" || !Ko(a, r.refreshSkewMs ?? 6e4, t())) return Go(r, a);
+	let o = Uo(r.id, i), s = Ho.get(o);
 	if (s !== void 0) return s;
-	let c = Go({
+	let c = Jo({
 		...e,
 		now: t,
 		row: a
 	}).finally(() => {
-		zo.delete(o);
+		Ho.delete(o);
 	});
-	return zo.set(o, c), c;
-}, Go = async (e) => {
-	let { store: n, subjectId: r, now: i } = e, a = e.definition, o = e.sleep ?? Ro, s = a.refreshSkewMs ?? 6e4, c = e.row.id;
+	return Ho.set(o, c), c;
+}, Jo = async (e) => {
+	let { store: n, subjectId: r, now: i } = e, a = e.definition, o = e.sleep ?? Vo, s = a.refreshSkewMs ?? 6e4, c = e.row.id;
 	if (await n.updateMany("_voltro_connections", { refreshLockedUntil: new Date(i() + 3e4) }, { where: t(u("id", c), ee("refreshLockedUntil", new Date(i()))) }) === 0) {
 		for (let e = 0; e < 10; e++) {
 			await o(200);
-			let e = await Eo(n, a.id, r);
-			if (e === void 0) throw new Lo(a.id, r);
-			if (!Uo(e, s, i())) return Ho(a, e);
+			let e = await ko(n, a.id, r);
+			if (e === void 0) throw new Bo(a.id, r);
+			if (!Ko(e, s, i())) return Go(a, e);
 		}
 		throw new j({
 			connectionId: a.id,
@@ -3814,7 +3831,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	});
 	let d;
 	try {
-		d = await Po(a, Wi(String(l)), i);
+		d = await Lo(a, qi(String(l)), i);
 	} catch (e) {
 		let t = e instanceof j ? e : new j({
 			connectionId: a.id,
@@ -3827,11 +3844,11 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			refreshLockedUntil: /* @__PURE__ */ new Date(0),
 			updatedAt: new Date(i()),
 			...t.transient ? {} : {
-				accessToken: Ui(""),
+				accessToken: Ki(""),
 				refreshToken: null,
 				expiresAt: null
 			}
-		}), uo.warn("connection refresh failed", {
+		}), mo.warn("connection refresh failed", {
 			connectionId: a.id,
 			transient: t.transient,
 			reason: t.reason
@@ -3839,40 +3856,40 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	}
 	let f = {
 		status: "connected",
-		accessToken: Ui(d.accessToken),
-		...d.refreshToken === void 0 ? {} : { refreshToken: Ui(d.refreshToken) },
+		accessToken: Ki(d.accessToken),
+		...d.refreshToken === void 0 ? {} : { refreshToken: Ki(d.refreshToken) },
 		expiresAt: d.expiresAt === void 0 ? null : new Date(d.expiresAt),
 		...d.scopes.length > 0 ? { scopes: d.scopes.join(" ") } : {},
 		lastError: null,
 		refreshLockedUntil: /* @__PURE__ */ new Date(0),
 		updatedAt: new Date(i())
 	};
-	return Ho(a, await n.update(X, c, f) ?? {
+	return Go(a, await n.update(X, c, f) ?? {
 		...e.row,
 		...f
 	});
-}, Ko = (e = 32) => {
+}, Yo = (e = 32) => {
 	let t = new Uint8Array(e);
 	return globalThis.crypto.getRandomValues(t), Array.from(t, (e) => e.toString(16).padStart(2, "0")).join("");
-}, qo = (e) => {
+}, Xo = (e) => {
 	let t = "";
 	for (let n of e) t += String.fromCharCode(n);
 	return btoa(t).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}, Jo = async (e) => {
+}, Zo = async (e) => {
 	let t = await globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(e));
-	return qo(new Uint8Array(t));
-}, Yo = 10 * 6e4, Xo = (e) => `/_voltro/connections/${e}/callback`, Zo = (e) => e === void 0 || e.length === 0 || !e.startsWith("/") || e.startsWith("//") || e.startsWith("/\\") ? "/" : e, Qo = (e, t) => e.redirectUri ?? `${t.replace(/\/+$/, "")}${Xo(e.id)}`, $o = async (e) => {
-	let t = (e.now ?? (() => /* @__PURE__ */ new Date()))(), { definition: n } = e, r = Ko(), i = n.pkce === !1 ? null : Ko(48), a = Qo(n, e.publicUrl);
-	await e.store.insert(mo, {
-		id: f(ho, mo),
+	return Xo(new Uint8Array(t));
+}, Qo = 10 * 6e4, $o = (e) => `/_voltro/connections/${e}/callback`, es = (e) => e === void 0 || e.length === 0 || !e.startsWith("/") || e.startsWith("//") || e.startsWith("/\\") ? "/" : e, ts = (e, t) => e.redirectUri ?? `${t.replace(/\/+$/, "")}${$o(e.id)}`, ns = async (e) => {
+	let t = (e.now ?? (() => /* @__PURE__ */ new Date()))(), { definition: n } = e, r = Yo(), i = n.pkce === !1 ? null : Yo(48), a = ts(n, e.publicUrl);
+	await e.store.insert(_o, {
+		id: f(vo, _o),
 		state: r,
 		connectionId: n.id,
 		subjectId: e.subjectId,
 		tenantId: e.tenantId,
-		codeVerifier: i === null ? null : Ui(i),
-		redirectTo: Zo(e.redirectTo),
+		codeVerifier: i === null ? null : Ki(i),
+		redirectTo: es(e.redirectTo),
 		createdAt: t,
-		expiresAt: new Date(t.getTime() + Yo)
+		expiresAt: new Date(t.getTime() + Qo)
 	});
 	let o = new URLSearchParams({
 		response_type: "code",
@@ -3882,15 +3899,15 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		...n.scopes && n.scopes.length > 0 ? { scope: n.scopes.join(" ") } : {},
 		...n.authorizeParams ?? {}
 	});
-	i !== null && (o.set("code_challenge", await Jo(i)), o.set("code_challenge_method", "S256"));
+	i !== null && (o.set("code_challenge", await Zo(i)), o.set("code_challenge_method", "S256"));
 	let s = n.authorizeUrl.includes("?") ? "&" : "?";
 	return {
 		authorizeUrl: `${n.authorizeUrl}${s}${o.toString()}`,
 		state: r
 	};
-}, es = async (e) => {
+}, rs = async (e) => {
 	let t = (e.now ?? (() => /* @__PURE__ */ new Date()))(), n = (await e.store.query({
-		table: mo,
+		table: _o,
 		predicate: u("state", e.state),
 		order: [],
 		take: 1,
@@ -3902,8 +3919,8 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		reason: "unknown or already-used handshake state",
 		transient: !1
 	});
-	await e.store.delete(mo, n.id);
-	let r = String(n.connectionId), i = So(n.expiresAt);
+	await e.store.delete(_o, n.id);
+	let r = String(n.connectionId), i = To(n.expiresAt);
 	if (i !== null && i.getTime() < t.getTime()) throw new j({
 		connectionId: r,
 		reason: "handshake expired — start again",
@@ -3915,17 +3932,17 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		reason: "no oauth2 connection is declared under that id",
 		transient: !1
 	});
-	let o = n.codeVerifier === null || n.codeVerifier === void 0 ? null : Wi(String(n.codeVerifier)), s = await No(a, {
+	let o = n.codeVerifier === null || n.codeVerifier === void 0 ? null : qi(String(n.codeVerifier)), s = await Io(a, {
 		code: e.code,
-		redirectUri: Qo(a, e.publicUrl),
+		redirectUri: ts(a, e.publicUrl),
 		codeVerifier: o
 	}, () => t.getTime()), c = a.identify === void 0 ? void 0 : await a.identify(s).catch((e) => {
-		uo.warn("connection identify failed; storing without account details", {
+		mo.warn("connection identify failed; storing without account details", {
 			connectionId: r,
 			reason: String(e)
 		});
 	});
-	return await Do({
+	return await Ao({
 		store: e.store,
 		definition: a,
 		subjectId: String(n.subjectId),
@@ -3935,11 +3952,11 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		now: () => t
 	}), {
 		connectionId: r,
-		redirectTo: Zo(String(n.redirectTo ?? "/"))
+		redirectTo: es(String(n.redirectTo ?? "/"))
 	};
-}, ts = async (e, t = /* @__PURE__ */ new Date()) => {
+}, is = async (e, t = /* @__PURE__ */ new Date()) => {
 	let n = await e.query({
-		table: mo,
+		table: _o,
 		predicate: ee("expiresAt", t),
 		order: [],
 		take: void 0,
@@ -3948,27 +3965,27 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	}), r = 0;
 	for (let t of n) await e.delete("_voltro_connection_grants", t.id) && r++;
 	return r;
-}, ns, rs = (e) => {
-	ns = e;
-}, is = () => ns, as = (e, t) => {
-	let n = ns;
+}, as, os = (e) => {
+	as = e;
+}, ss = () => as, cs = (e, t) => {
+	let n = as;
 	return n === void 0 ? Promise.reject(/* @__PURE__ */ Error(`resolveConnectionForSubject("${t}"): no connection vault is registered — the app declares no \`*.connection.ts\`, or this call ran before boot completed.`)) : n(e, t);
-}, os = (e) => async (t, n) => {
+}, ls = (e) => async (t, n) => {
 	let r = e.registry.get(n);
 	if (r === void 0) throw Error(`connection "${n}" is not declared. Declared: ${e.registry.list().map((e) => e.id).join(", ") || "(none)"}.`);
 	let i = t.id ?? null;
-	if (i === null || i === "") throw new Lo(n, "<anonymous>");
-	return Wo({
+	if (i === null || i === "") throw new Bo(n, "<anonymous>");
+	return qo({
 		store: e.store,
 		definition: r,
 		subjectId: i
 	});
-}, ss = (e) => {
+}, us = (e) => {
 	let t = e.subject.id ?? null, n = async (n) => {
 		let r = e.registry.get(n);
 		if (r === void 0) throw Error(`ctx.connections.get("${n}"): no such connection is declared. Declared: ${e.registry.list().map((e) => e.id).join(", ") || "(none)"}.`);
-		if (t === null || t === "") throw new Lo(n, "<anonymous>");
-		return Wo({
+		if (t === null || t === "") throw new Bo(n, "<anonymous>");
+		return qo({
 			store: e.store,
 			definition: r,
 			subjectId: t
@@ -3980,7 +3997,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			try {
 				return await n(e);
 			} catch (e) {
-				if (e instanceof Lo) return null;
+				if (e instanceof Bo) return null;
 				throw e;
 			}
 		},
@@ -3995,17 +4012,17 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			expiresAt: null,
 			lastError: null,
 			connectedAt: null
-		})) : Ao(e.store, e.registry, t)
+		})) : No(e.store, e.registry, t)
 	};
-}, cs = (e, t) => {
+}, ds = (e, t) => {
 	let n = e.request?.subject?.id ?? null;
 	if (n === null || n === "") throw new De({ connectionId: t });
 	return n;
-}, ls = (e, t) => {
+}, fs = (e, t) => {
 	let n = e.registry.get(t);
 	if (n === void 0) throw new Ee({ connectionId: t });
 	return n;
-}, us = (e) => async (t, n) => {
+}, ps = (e) => async (t, n) => {
 	let r = n.request?.subject?.id ?? null;
 	return r === null || r === "" ? e.registry.list().map((e) => ({
 		connectionId: e.id,
@@ -4018,15 +4035,15 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		expiresAt: null,
 		lastError: null,
 		connectedAt: null
-	})) : Ao(n.store, e.registry, r);
-}, ds = (e) => async (t, n) => {
-	let r = ls(e, t.connectionId), i = cs(n, t.connectionId);
+	})) : No(n.store, e.registry, r);
+}, ms = (e) => async (t, n) => {
+	let r = fs(e, t.connectionId), i = ds(n, t.connectionId);
 	if (r.kind !== "oauth2") throw new Te({
 		connectionId: t.connectionId,
 		expected: "oauth2",
 		actual: r.kind
 	});
-	return $o({
+	return ns({
 		store: n.store,
 		definition: r,
 		subjectId: i,
@@ -4034,8 +4051,8 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		publicUrl: e.publicUrl,
 		...t.redirectTo === void 0 ? {} : { redirectTo: t.redirectTo }
 	});
-}, fs = (e) => async (t, n) => {
-	let r = ls(e, t.connectionId), i = cs(n, t.connectionId);
+}, hs = (e) => async (t, n) => {
+	let r = fs(e, t.connectionId), i = ds(n, t.connectionId);
 	if (r.kind !== "pat") throw new Te({
 		connectionId: t.connectionId,
 		expected: "pat",
@@ -4057,7 +4074,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			transient: !1
 		});
 	}
-	return await Do({
+	return await Ao({
 		store: n.store,
 		definition: r,
 		subjectId: i,
@@ -4068,20 +4085,20 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		},
 		...o === void 0 ? {} : { account: o }
 	}), { ok: !0 };
-}, ps = (e) => async (t, n) => {
-	ls(e, t.connectionId);
-	let r = cs(n, t.connectionId);
-	return { ok: await ko(n.store, t.connectionId, r) };
-}, ms = "admin:full", hs = class extends R.TaggedError()("AccessDenied", {
+}, gs = (e) => async (t, n) => {
+	fs(e, t.connectionId);
+	let r = ds(n, t.connectionId);
+	return { ok: await Mo(n.store, t.connectionId, r) };
+}, _s = "admin:full", vs = class extends R.TaggedError()("AccessDenied", {
 	action: R.String,
 	resourceType: R.String,
 	resourceId: R.String
-}) {}, gs = /* @__PURE__ */ new Map(), _s = (e) => {
+}) {}, ys = /* @__PURE__ */ new Map(), bs = (e) => {
 	if (typeof e.resourceType != "string" || e.resourceType.length === 0) throw Error("defineResourcePolicy: a non-empty `resourceType` is required");
 	if (e.actions === void 0 || Object.keys(e.actions).length === 0) throw Error(`resource policy '${e.resourceType}': at least one action is required`);
-	if (gs.has(e.resourceType)) throw Error(`resource policy '${e.resourceType}' is already registered — types must be unique`);
-	return gs.set(e.resourceType, e), e;
-}, vs = (e) => gs.get(e), ys = () => [...gs.values()], bs = () => gs.clear(), xs = () => ys().map((e) => {
+	if (ys.has(e.resourceType)) throw Error(`resource policy '${e.resourceType}' is already registered — types must be unique`);
+	return ys.set(e.resourceType, e), e;
+}, xs = (e) => ys.get(e), Ss = () => [...ys.values()], Cs = () => ys.clear(), ws = () => Ss().map((e) => {
 	let t = /* @__PURE__ */ new Set();
 	for (let n of Object.values(e.actions)) for (let e of n) t.add(e);
 	for (let [n, r] of Object.entries(e.implies ?? {})) {
@@ -4094,7 +4111,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		relations: [...t],
 		implies: e.implies ?? {}
 	};
-}), Ss = (e, t) => {
+}), Ts = (e, t) => {
 	let n = new Set(e);
 	if (t === void 0) return n;
 	let r = [...e];
@@ -4103,37 +4120,37 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		for (let i of t[e] ?? []) n.has(i) || (n.add(i), r.push(i));
 	}
 	return n;
-}, Cs = (e, t, n, r) => e.id === null ? /* @__PURE__ */ new Set() : Ss(n.filter((n) => n.subjectId === e.id && n.resourceType === t.type && n.resourceId === t.id).map((e) => e.relation), r.implies), ws = (e, t, n, r) => {
+}, Es = (e, t, n, r) => e.id === null ? /* @__PURE__ */ new Set() : Ts(n.filter((n) => n.subjectId === e.id && n.resourceType === t.type && n.resourceId === t.id).map((e) => e.relation), r.implies), Ds = (e, t, n, r) => {
 	if (e.scopes?.includes("admin:full")) return !0;
 	if (e.id === null || n.tenantId != null && e.tenantId !== n.tenantId) return !1;
 	let i = r.policy.actions[t];
 	if (i === void 0 || i.length === 0) return !1;
-	let a = Cs(e, n, r.tuples, r.policy);
+	let a = Es(e, n, r.tuples, r.policy);
 	return i.some((e) => a.has(e));
-}, Ts = (e, t, n, r) => {
-	if (!ws(e, t, n, r)) throw new hs({
+}, Os = (e, t, n, r) => {
+	if (!Ds(e, t, n, r)) throw new vs({
 		action: t,
 		resourceType: n.type,
 		resourceId: n.id
 	});
-}, Es = (e, t, n, r, i) => r.filter((r) => ws(e, t, {
+}, ks = (e, t, n, r, i) => r.filter((r) => Ds(e, t, {
 	type: n,
 	id: r.id,
 	...r.tenantId === void 0 ? {} : { tenantId: r.tenantId }
-}, i)), Ds = (e, t) => {
+}, i)), As = (e, t) => {
 	let n = new Set(t.map((e) => e.id));
 	return e.filter((e) => !n.has(e.id)).map((e) => e.id);
-}, Os = M({ scope: "voltro:policy" }), ks, As = (e) => {
-	ks = e;
-}, js = () => ks, Ms = () => {
+}, js = M({ scope: "voltro:policy" }), Ms, Ns = (e) => {
+	Ms = e;
+}, Ps = () => Ms, Fs = () => {
 	Ve((e) => P.gen(function* () {
-		let t = vs(e.resourceType);
-		if (t === void 0) return Os.warn("policy guard denied — no resource policy registered for this type", {
+		let t = xs(e.resourceType);
+		if (t === void 0) return js.warn("policy guard denied — no resource policy registered for this type", {
 			resourceType: e.resourceType,
 			action: e.action
 		}), !1;
-		let n = ks;
-		if (n === void 0) return Os.warn("policy guard denied — no tuple source registered (call setTupleSource at boot)", {
+		let n = Ms;
+		if (n === void 0) return js.warn("policy guard denied — no tuple source registered (call setTupleSource at boot)", {
 			resourceType: e.resourceType,
 			action: e.action
 		}), !1;
@@ -4144,11 +4161,11 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 				resourceId: e.resourceId
 			}),
 			catch: (e) => e
-		}).pipe(P.catchAll((t) => (Os.error("policy guard denied — tuple source failed", {
+		}).pipe(P.catchAll((t) => (js.error("policy guard denied — tuple source failed", {
 			resourceType: e.resourceType,
 			resourceId: e.resourceId
 		}, t), P.succeed([])))), i = e.subject;
-		return ws({
+		return Ds({
 			id: e.subject.id,
 			tenantId: i.tenantId ?? null,
 			...i.scopes === void 0 ? {} : { scopes: i.scopes }
@@ -4161,10 +4178,10 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			tuples: r
 		});
 	}));
-}, Ns = (e) => {
+}, Is = (e) => {
 	Promise.resolve().then(e);
-}, Ps = (e) => {
-	let t = e.schedule ?? Ns, n = /* @__PURE__ */ new Map(), r = /* @__PURE__ */ new Map(), i = (e, t) => `${e}${t}`, a = async (t) => {
+}, Ls = (e) => {
+	let t = e.schedule ?? Is, n = /* @__PURE__ */ new Map(), r = /* @__PURE__ */ new Map(), i = (e, t) => `${e}${t}`, a = async (t) => {
 		let a = r.get(t);
 		if (a === void 0) return;
 		r.delete(t);
@@ -4210,23 +4227,23 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		load: async (e, t) => (await o(e, [t]))[0] ?? null,
 		loadMany: (e, t) => o(e, t)
 	};
-}, Fs = F.effect(B.HttpClient, P.map(B.HttpClient, (e) => e.pipe(B.mapRequestEffect((e) => P.currentSpan.pipe(P.map((t) => e.headers.traceparent === void 0 ? ot.setHeader(e, "traceparent", mr({
+}, Rs = F.effect(B.HttpClient, P.map(B.HttpClient, (e) => e.pipe(B.mapRequestEffect((e) => P.currentSpan.pipe(P.map((t) => e.headers.traceparent === void 0 ? ot.setHeader(e, "traceparent", mr({
 	traceId: t.traceId,
 	spanId: t.spanId,
 	sampled: t.sampled
-})) : e), P.catchAll(() => P.succeed(e))))))), Is = class extends Error {
+})) : e), P.catchAll(() => P.succeed(e))))))), zs = class extends Error {
 	url;
 	reason;
 	_tag = "SsrfBlockedError";
 	constructor(e, t) {
 		super(`SSRF: blocked outbound request to ${e} — ${t}. If this target is intentional, add its host to \`http.allowHosts\` in app.config.ts.`), this.url = e, this.reason = t, this.name = "SsrfBlockedError";
 	}
-}, Ls = (e, t) => e === 0 || e === 10 || e === 127 || e === 100 && t >= 64 && t <= 127 || e === 169 && t === 254 || e === 172 && t >= 16 && t <= 31 || e === 192 && t === 168 || e === 198 && (t === 18 || t === 19) || e >= 224, Rs = (e) => e === "::" || e === "::1" || e.startsWith("fc") || e.startsWith("fd") || e.startsWith("fe80") || e.startsWith("::ffff:"), zs = (e, t, n) => n.some((n) => {
+}, Bs = (e, t) => e === 0 || e === 10 || e === 127 || e === 100 && t >= 64 && t <= 127 || e === 169 && t === 254 || e === 172 && t >= 16 && t <= 31 || e === 192 && t === 168 || e === 198 && (t === 18 || t === 19) || e >= 224, Vs = (e) => e === "::" || e === "::1" || e.startsWith("fc") || e.startsWith("fd") || e.startsWith("fe80") || e.startsWith("::ffff:"), Hs = (e, t, n) => n.some((n) => {
 	let r = n.trim().toLowerCase();
 	if (r === "") return !1;
 	let i = t === "" ? e : `${e}:${t}`;
 	return r === e || r === i ? !0 : r.startsWith("*.") ? e.endsWith(r.slice(1)) : !1;
-}), Bs = (e, t = {}) => {
+}), Us = (e, t = {}) => {
 	let n;
 	try {
 		n = new URL(e);
@@ -4235,25 +4252,25 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	}
 	if (n.protocol !== "http:" && n.protocol !== "https:") return `blocked scheme "${n.protocol}"`;
 	let r = n.hostname.replace(/^\[|\]$/g, "").toLowerCase();
-	if (zs(r, n.port, t.allowHosts ?? [])) return null;
+	if (Hs(r, n.port, t.allowHosts ?? [])) return null;
 	if (r === "localhost" || r.endsWith(".localhost") || r.endsWith(".internal") || r.endsWith(".local")) return `blocked host "${r}"`;
 	let i = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(r);
 	if (i) {
 		let e = Number(i[1]), t = Number(i[2]);
-		return e > 255 || t > 255 || Number(i[3]) > 255 || Number(i[4]) > 255 ? "malformed ipv4 literal" : Ls(e, t) ? `blocked private/reserved address ${r}` : null;
+		return e > 255 || t > 255 || Number(i[3]) > 255 || Number(i[4]) > 255 ? "malformed ipv4 literal" : Bs(e, t) ? `blocked private/reserved address ${r}` : null;
 	}
 	if (r.includes(":")) {
 		let e = /^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/.exec(r);
-		return e ? Bs(`${n.protocol}//${e[1]}`, t) : Rs(r) ? `blocked private/reserved address ${r}` : null;
+		return e ? Us(`${n.protocol}//${e[1]}`, t) : Vs(r) ? `blocked private/reserved address ${r}` : null;
 	}
 	return null;
-}, Vs = (e = {}) => F.effect(B.HttpClient, P.map(B.HttpClient, (t) => {
+}, Ws = (e = {}) => F.effect(B.HttpClient, P.map(B.HttpClient, (t) => {
 	let n = B.transform(t, (t, n) => P.suspend(() => {
-		let r = Bs(n.url, e);
-		return r === null ? t : P.die(new Is(n.url, r));
+		let r = Us(n.url, e);
+		return r === null ? t : P.die(new zs(n.url, r));
 	}));
 	return B.followRedirects(n, e.maxRedirects ?? 5);
-})), Hs = (e) => {
+})), Gs = (e) => {
 	let t = e.now ?? Date.now, n = e.intervalMs ?? 3e4, r = e.maxPending ?? 500, i = /* @__PURE__ */ new Map(), a = !1, o = async () => {
 		if (i.size === 0) return;
 		let t = i;
@@ -4282,7 +4299,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		},
 		pending: () => i.size
 	};
-}, Us = "voltro/audit", Ws = "voltro/softDelete", Gs = "voltro/tenant", Ks = (e) => {
+}, Ks = "voltro/audit", qs = "voltro/softDelete", Js = "voltro/tenant", Ys = (e) => {
 	let t = /* @__PURE__ */ new Map();
 	for (let n of e) {
 		let e = /* @__PURE__ */ new Set();
@@ -4326,28 +4343,28 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			return !1;
 		},
 		idScheme: (e) => t.get(e)?.idScheme,
-		defaultFactories: (e) => t.get(e)?.defaultFactories ?? qs,
-		computedFields: (e) => t.get(e)?.computedFields ?? Js,
-		generatedColumns: (e) => t.get(e)?.generatedColumns ?? Ys,
+		defaultFactories: (e) => t.get(e)?.defaultFactories ?? Xs,
+		computedFields: (e) => t.get(e)?.computedFields ?? Zs,
+		generatedColumns: (e) => t.get(e)?.generatedColumns ?? Qs,
 		insertSchema: (e) => t.get(e)?.insertSchema,
 		validatePatchSchema: (e) => t.get(e)?.validatePatchSchema
 	};
-}, qs = /* @__PURE__ */ new Map(), Js = /* @__PURE__ */ new Map(), Ys = /* @__PURE__ */ new Set(), Xs = Ks([]), Zs = class extends R.TaggedError()("NoRowFound", {
+}, Xs = /* @__PURE__ */ new Map(), Zs = /* @__PURE__ */ new Map(), Qs = /* @__PURE__ */ new Set(), $s = Ys([]), ec = class extends R.TaggedError()("NoRowFound", {
 	table: R.String,
 	found: R.Number
 }) {
 	get message() {
 		return this.found === 0 ? `expected exactly one row in '${this.table}', found none` : `expected exactly one row in '${this.table}', found more than one`;
 	}
-}, Qs = class extends R.TaggedError()("OptimisticLockError", {
+}, tc = class extends R.TaggedError()("OptimisticLockError", {
 	table: R.String,
 	expected: R.Number
 }) {
 	get message() {
 		return `optimistic lock failed on '${this.table}': expected version ${this.expected}`;
 	}
-}, $s = (e) => typeof e == "object" && !!e && ("and" in e || "or" in e || "not" in e || "op" in e || "subquery" in e), ec = (e) => {
-	if (e.length === 1 && $s(e[0])) return e[0];
+}, nc = (e) => typeof e == "object" && !!e && ("and" in e || "or" in e || "not" in e || "op" in e || "subquery" in e), rc = (e) => {
+	if (e.length === 1 && nc(e[0])) return e[0];
 	let t = e[0];
 	if (e.length === 2) return u(t, e[1]);
 	let n = e[1], r = e[2];
@@ -4365,11 +4382,11 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		case "fts": return o(t, r);
 		default: return u(t, r);
 	}
-}, tc = (e) => {
+}, ic = (e) => {
 	let t = m(e);
 	if (t === void 0) throw Error(`unknown table '${e}' — is it declared with table()?`);
 	return E(t);
-}, nc = class e {
+}, ac = class e {
 	backend;
 	scope;
 	table;
@@ -4383,7 +4400,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		return new e(this.backend, this.scope, this.table, t, this.skipTenant, this.skipSoftDelete);
 	}
 	where(...e) {
-		return this.clone(this.query.where(ec(e)));
+		return this.clone(this.query.where(rc(e)));
 	}
 	orderBy(e, t = "asc") {
 		return this.clone(this.query.orderBy(e, t));
@@ -4432,11 +4449,11 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	}
 	async one() {
 		let e = await this.backend.query(this.scopedQuery().limit(2).descriptor), t = e[0];
-		if (t === void 0) throw new Zs({
+		if (t === void 0) throw new ec({
 			table: this.table,
 			found: 0
 		});
-		if (e.length > 1) throw new Zs({
+		if (e.length > 1) throw new ec({
 			table: this.table,
 			found: e.length
 		});
@@ -4452,7 +4469,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	get descriptor() {
 		return this.scopedQuery().descriptor;
 	}
-}, rc = class {
+}, oc = class {
 	backend;
 	scope;
 	table;
@@ -4463,7 +4480,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		this.backend = e, this.scope = t, this.table = n;
 	}
 	where(...e) {
-		let n = ec(e);
+		let n = rc(e);
 		return this.predicate = this.predicate ? t(this.predicate, n) : n, this;
 	}
 	unscoped() {
@@ -4487,7 +4504,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	}
 	async set(e) {
 		let t = await this.backend.updateMany(this.table, e, { where: this.scopedWhere() });
-		if (this.expectedVersion !== void 0 && t === 0) throw new Qs({
+		if (this.expectedVersion !== void 0 && t === 0) throw new tc({
 			table: this.table,
 			expected: this.expectedVersion
 		});
@@ -4496,7 +4513,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	async restore() {
 		return this.backend.updateMany(this.table, { deletedAt: null }, { where: this.scopedWhere() });
 	}
-}, ic = class {
+}, sc = class {
 	backend;
 	scope;
 	table;
@@ -4506,7 +4523,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		this.backend = e, this.scope = t, this.table = n;
 	}
 	where(...e) {
-		let n = ec(e);
+		let n = rc(e);
 		return this.predicate = this.predicate ? t(this.predicate, n) : n, this;
 	}
 	unscoped() {
@@ -4527,36 +4544,36 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	async hard() {
 		return this.backend.deleteMany(this.table, { where: this.scopedWhere() });
 	}
-}, ac = (e, t) => ({
-	select: (n) => new nc(e, t, n, tc(n)),
-	updateWhere: (n) => new rc(e, t, n),
-	deleteWhere: (n) => new ic(e, t, n)
-}), oc = "id", sc = (e) => "descriptor" in e ? e.descriptor : e, cc = (e, t) => {
+}, cc = (e, t) => ({
+	select: (n) => new ac(e, t, n, ic(n)),
+	updateWhere: (n) => new oc(e, t, n),
+	deleteWhere: (n) => new sc(e, t, n)
+}), lc = "id", uc = (e) => "descriptor" in e ? e.descriptor : e, dc = (e, t) => {
 	let n = {};
 	for (let r of t) e[r] !== void 0 && (n[r] = e[r]);
 	return n;
-}, lc = "cannot insert into tenant-scoped table without an authenticated tenant — subject.tenantId is null. Either authenticate first or pass tenantId explicitly in the row (admin tooling).", uc = (e) => {
-	throw new va({
+}, fc = "cannot insert into tenant-scoped table without an authenticated tenant — subject.tenantId is null. Either authenticate first or pass tenantId explicitly in the row (admin tooling).", pc = (e) => {
+	throw new xa({
 		table: e,
-		reason: lc
+		reason: fc
 	});
-}, dc = (e) => {
+}, mc = (e) => {
 	if (e.type !== "apiKey") return e.id;
 	let t = e.metadata?.userId;
 	return typeof t == "string" && t !== "" ? t : e.id;
-}, fc = (e, n) => {
-	let r = Hr(e), i = dc(n.subject), a = n.subject.tenantId, o = n.rowFilter ?? Vn, d = (e, t) => {
+}, hc = (e, n) => {
+	let r = Hr(e), i = mc(n.subject), a = n.subject.tenantId, o = n.rowFilter ?? Vn, d = (e, t) => {
 		let r = { ...t }, o = n.schemaRegistry, s = o.idScheme(e);
-		if (s !== void 0 && r[oc] == null) if (s.kind === "numeric") delete r[oc];
+		if (s !== void 0 && r[lc] == null) if (s.kind === "numeric") delete r[lc];
 		else {
 			let t = f(s, e);
-			t !== null && (r[oc] = t);
+			t !== null && (r[lc] = t);
 		}
 		if (o.hasAudit(e)) {
 			let e = /* @__PURE__ */ new Date();
 			"createdAt" in r || (r.createdAt = e), "updatedAt" in r || (r.updatedAt = e), i !== null && ("createdBy" in r || (r.createdBy = i), "updatedBy" in r || (r.updatedBy = i));
 		}
-		o.hasTenant(e) && ("tenantId" in r || (a === null && uc(e), r.tenantId = a));
+		o.hasTenant(e) && ("tenantId" in r || (a === null && pc(e), r.tenantId = a));
 		let c = o.defaultFactories(e);
 		if (c.size > 0) for (let [e, t] of c) (!(e in r) || r[e] === void 0) && (r[e] = t());
 		let l = o.computedFields(e);
@@ -4576,7 +4593,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			let r = en(n);
 			if (tn(r)) {
 				let n = t.tenantId, i = `${r.dbConstraint ?? ""} ${r.dbColumn ?? ""} ${r.dbMessage ?? ""} ${r.dbCauseChain ?? ""}`.toLowerCase();
-				if (i.includes("tenantid") || /\btenants\b/.test(i) || n != null && i.includes(String(n).toLowerCase())) throw new va({
+				if (i.includes("tenantid") || /\btenants\b/.test(i) || n != null && i.includes(String(n).toLowerCase())) throw new xa({
 					table: e,
 					reason: n == null ? "write references a tenant that does not exist" : `tenant '${String(n)}' does not exist — seed the row in \`tenants\`, or fix how the request resolved this tenant (subject.tenantId / the x-tenant header / the dev TENANT fallback)`
 				});
@@ -4601,7 +4618,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			path: e.path.length === 0 ? "<root>" : e.path.join("."),
 			message: e.message
 		})), o = a[0];
-		throw new ba({
+		throw new Ca({
 			table: e,
 			summary: o === void 0 ? "patch validation failed" : `${o.path}: ${o.message}`,
 			issues: a
@@ -4611,7 +4628,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		return i !== null && (e.deletedBy = i), e;
 	}, b = (e, t, n) => {
 		let r = te(n, t);
-		if (r.length !== 0) throw new ba({
+		if (r.length !== 0) throw new Ca({
 			table: e,
 			summary: `upsert conflictColumns [${n.map((e) => `'${e}'`).join(", ")}] but the payload is missing ${r.map((e) => `'${e}'`).join(", ")}`,
 			issues: r.map((e) => ({
@@ -4623,7 +4640,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		let r = m(e);
 		if (r !== void 0) {
 			let n = ne(r, t);
-			if (n.length > 0) throw new ba({
+			if (n.length > 0) throw new Ca({
 				table: e,
 				summary: `missing required column${n.length > 1 ? "s" : ""} ${n.map((e) => `'${e}'`).join(", ")} — NOT NULL with no default and not auto-stamped`,
 				issues: n.map((e) => ({
@@ -4640,14 +4657,14 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			path: e.path.length === 0 ? "<root>" : e.path.join("."),
 			message: e.message
 		})), s = o[0];
-		throw new ba({
+		throw new Ca({
 			table: e,
 			summary: s === void 0 ? "row validation failed" : `${s.path}: ${s.message}`,
 			issues: o
 		});
 	}, C = n.dialect, w = (e, t) => {
 		let n = m(e);
-		return l(C ? ce(t, n, C) : t, n, Vi());
+		return l(C ? ce(t, n, C) : t, n, Wi());
 	}, T = process.env.VOLTRO_FIELD_DECRYPT_ON_ERROR === "null" ? "null" : "throw", ee = M({ scope: "store.fieldEncryption" }), re = /* @__PURE__ */ new Set(), ie = (e) => {
 		let t = `${e.table}.${e.column}`;
 		re.has(t) || (re.add(t), ee.warn("encrypted column degraded to null — could not decrypt with the active key", {
@@ -4657,7 +4674,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			hint: "VOLTRO_FIELD_DECRYPT_ON_ERROR=null is set — this row was likely encrypted under a different key"
 		}));
 	}, E = (e, t) => {
-		let n = m(e), r = s(t, n, Vi(), {
+		let n = m(e), r = s(t, n, Wi(), {
 			onError: T,
 			...T === "null" ? { warn: ie } : {}
 		});
@@ -4685,7 +4702,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			let n = (await r.query({
 				table: e,
 				predicate: {
-					column: oc,
+					column: lc,
 					op: "eq",
 					value: t
 				},
@@ -4706,7 +4723,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	}), A = async (e, t) => de(e, {
 		...t,
 		where: O(e, t.where)
-	}), fe = ac({
+	}), fe = cc({
 		query: oe,
 		updateMany: ue,
 		deleteMany: de,
@@ -4735,26 +4752,26 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	return {
 		query: D,
 		one: (async (e) => {
-			let t = sc(e), n = await D({
+			let t = uc(e), n = await D({
 				...t,
 				take: 2
 			}), r = n[0];
-			if (r === void 0) throw new Zs({
+			if (r === void 0) throw new ec({
 				table: t.table,
 				found: 0
 			});
-			if (n.length > 1) throw new Zs({
+			if (n.length > 1) throw new ec({
 				table: t.table,
 				found: n.length
 			});
 			return r;
 		}),
 		first: (async (e) => (await D({
-			...sc(e),
+			...uc(e),
 			take: 1
 		}))[0] ?? null),
 		maybeOne: (async (e) => (await D({
-			...sc(e),
+			...uc(e),
 			take: 1
 		}))[0] ?? null),
 		insert: async (e, t) => {
@@ -4835,7 +4852,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		select: fe.select,
 		update: pe,
 		delete: me,
-		applyDefined: cc,
+		applyDefined: dc,
 		hardDelete: async (e, t) => r.delete(e, t),
 		updateMany: k,
 		deleteMany: A,
@@ -4851,28 +4868,28 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			let a = await h(e, i, () => r.insertIgnore(e, w(e, x(e, i)), n));
 			return E(e, [a])[0];
 		},
-		transactional: (e) => r.transactional(async (t) => e(fc(t, n))),
+		transactional: (e) => r.transactional(async (t) => e(hc(t, n))),
 		...r.raw ? { raw: r.raw.bind(r) } : {},
 		onChange: (e) => r.onChange(e),
 		injectExternalChange: (e) => r.injectExternalChange(e),
 		...r.changeScope === void 0 ? {} : { changeScope: r.changeScope }
 	};
-}, pc = (e, t) => {
+}, gc = (e, t) => {
 	if (t === void 0 || t.length === 0) return e;
 	let n = { ...e };
 	for (let e of t) delete n[e];
 	return n;
-}, mc = (e, t) => {
+}, _c = (e, t) => {
 	let n = m(e), r = n === void 0 ? [] : le(n);
 	return r.length === 0 ? t ?? [] : t === void 0 ? r : [...t, ...r];
-}, hc = (e, t) => t.length === 0 ? e : e.map((e) => pc(e, t)), gc = (e, t, n, r, i) => {
+}, vc = (e, t) => t.length === 0 ? e : e.map((e) => gc(e, t)), yc = (e, t, n, r, i) => {
 	let a = {
 		...t?.(r) ?? {},
 		...n?.(i) ?? {}
 	}, o = e;
 	for (let [e, t] of Object.entries(a)) t !== void 0 && (o = o.where(e, t));
 	return o;
-}, _c = 1e3, vc = (e, t = _c) => {
+}, bc = 1e3, xc = (e, t = bc) => {
 	let n = (e) => typeof e == "number" && Number.isFinite(e) ? e : void 0, r = (e) => Math.max(1, Math.min(Math.floor(e), t)), i = n(e.page);
 	if (i !== void 0) {
 		let t = r(n(e.pageSize) ?? 100);
@@ -4885,35 +4902,35 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		limit: r(n(e.limit) ?? 100),
 		offset: Math.max(0, Math.floor(n(e.offset) ?? 0))
 	};
-}, yc = {
+}, Sc = {
 	list: (e, t = {}) => async (n, r) => {
 		let i = n ?? {}, a = r.store.select(e);
 		if (t.columns !== void 0 && t.columns.length > 0) {
-			let n = new Set(mc(e, void 0)), r = t.columns.filter((e) => !n.has(e));
+			let n = new Set(_c(e, void 0)), r = t.columns.filter((e) => !n.has(e));
 			r.length > 0 && (a = a.select(...r));
 		}
-		t.include !== void 0 && (a = a.with(t.include)), a = gc(a, t.filter, t.scope, i, r);
+		t.include !== void 0 && (a = a.with(t.include)), a = yc(a, t.filter, t.scope, i, r);
 		for (let e of t.sort ?? []) a = a.orderBy(e.column, e.direction ?? "asc");
 		if (t.paginate === !0) {
-			let { limit: e, offset: n } = vc(i, t.maxPageSize);
+			let { limit: e, offset: n } = xc(i, t.maxPageSize);
 			a = a.limit(e).offset(n);
 		}
-		return hc(await a.all(), mc(e, t.redact));
+		return vc(await a.all(), _c(e, t.redact));
 	},
 	getById: (e, t = {}) => async (n, r) => {
 		let i = r.store.select(e).where("id", n.id);
 		t.include !== void 0 && (i = i.with(t.include));
 		let a = await i.first();
-		return a === null ? null : pc(a, mc(e, t.redact));
+		return a === null ? null : gc(a, _c(e, t.redact));
 	},
-	create: (e, t = {}) => async (n, r) => pc(await r.store.insert(e, n), mc(e, t.redact)),
+	create: (e, t = {}) => async (n, r) => gc(await r.store.insert(e, n), _c(e, t.redact)),
 	update: (e, t = {}) => async (n, r) => {
 		let { id: i, ...a } = n, o = await r.store.update(e, i, a);
-		return o === null ? null : pc(o, mc(e, t.redact));
+		return o === null ? null : gc(o, _c(e, t.redact));
 	},
-	count: (e, t = {}) => async (n, r) => gc(r.store.select(e), t.filter, t.scope, n ?? {}, r).count(),
+	count: (e, t = {}) => async (n, r) => yc(r.store.select(e), t.filter, t.scope, n ?? {}, r).count(),
 	remove: (e) => async (t, n) => ({ deleted: await n.store.delete(e, t.id) })
-}, bc = (e) => {
+}, Cc = (e) => {
 	let t = /* @__PURE__ */ new Set(), n = /* @__PURE__ */ new Set(), r = (e) => {
 		if (!n.has(e)) switch (n.add(e), e._tag) {
 			case "TypeLiteral":
@@ -4940,7 +4957,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		}
 	};
 	return r(e.ast), t;
-}, xc = (e) => {
+}, wc = (e) => {
 	let t = /* @__PURE__ */ new Set(), n = /* @__PURE__ */ new Set(), r = (e) => {
 		switch (e._tag) {
 			case "Literal": return e.literal === null;
@@ -4975,38 +4992,38 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		}
 	};
 	return i(e.ast), t;
-}, Sc = (e, t) => {
+}, Tc = (e, t) => {
 	let n = e.source === void 0 ? [] : Array.isArray(e.source) ? e.source : [e.source];
 	if (n.length === 0) return [];
-	let r = bc(e.output), i = xc(e.output), a = [];
+	let r = Cc(e.output), i = wc(e.output), a = [];
 	for (let o of n) for (let n of t.get(o) ?? []) r.has(n) && !i.has(n) && a.push({
 		query: e.name,
 		table: o,
 		column: n
 	});
 	return a;
-}, Cc = (e) => {
+}, Ec = (e) => {
 	if (e.length !== 0) return `A wire-reachable query exposes a server-only column:\n${e.map((e) => `  • query '${e.query}' output declares '${e.column}' — a .serverOnly() column of '${e.table}'`).join("\n")}\nThree ways out, in order of preference:\n  1. Omit the column from the query's output schema. The crud.* read helpers strip these automatically.\n  2. Keep the KEY but type it \`Schema.Null\` — for a view that must stay wire-compatible (an importer that breaks if the key vanishes) while never sending a value. The audit accepts that, because the schema then PROVES no value can flow instead of promising it. Pair it with a \`hasX\` boolean.\n  3. Drop the .serverOnly() marker, if the column may in fact reach a client.\nNote the audit reads the DECLARED shape, not what your handler emits: a field typed \`string\` that you always set to null still fails, and should — the next edit to that handler is one line away from sending it.`;
-}, wc = class extends R.TaggedError()("CircuitOpen", {
+}, Dc = class extends R.TaggedError()("CircuitOpen", {
 	name: R.String,
 	retryAfterMs: R.Number
-}) {}, Tc = {
+}) {}, Oc = {
 	tag: "closed",
 	failureCount: 0,
 	halfOpenSuccesses: 0,
 	openedAt: 0
-}, Ec = { make: (e) => P.gen(function* () {
-	let t = e.name ?? "circuit", n = Je.toMillis(Je.decode(e.resetTimeout)), r = e.halfOpenSuccessThreshold ?? 1, i = e.isFailure ?? (() => !0), a = yield* L.make(Tc), o = P.gen(function* () {
+}, kc = { make: (e) => P.gen(function* () {
+	let t = e.name ?? "circuit", n = Je.toMillis(Je.decode(e.resetTimeout)), r = e.halfOpenSuccessThreshold ?? 1, i = e.isFailure ?? (() => !0), a = yield* L.make(Oc), o = P.gen(function* () {
 		let e = yield* L.get(a);
 		if (e.tag === "half-open") {
 			let t = e.halfOpenSuccesses + 1;
-			yield* L.set(a, t >= r ? Tc : {
+			yield* L.set(a, t >= r ? Oc : {
 				...e,
 				halfOpenSuccesses: t
 			});
 			return;
 		}
-		e.failureCount !== 0 && (yield* L.set(a, Tc));
+		e.failureCount !== 0 && (yield* L.set(a, Oc));
 	}), s = P.gen(function* () {
 		let t = yield* We.currentTimeMillis, n = yield* L.get(a);
 		if (n.tag === "half-open" || n.tag === "open") {
@@ -5044,7 +5061,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			if (N.isInterruptedOnly(e)) return P.void;
 			let t = N.failureOption(e), n = t._tag === "Some" ? t.value : void 0;
 			return i(n) ? s : P.void;
-		})) : yield* P.fail(new wc({
+		})) : yield* P.fail(new Dc({
 			name: t,
 			retryAfterMs: n
 		}));
@@ -5053,25 +5070,25 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		value: L.get(a).pipe(P.map((e) => e.tag)),
 		enumerable: !0
 	}), Object.defineProperty(u, "reset", {
-		value: L.set(a, Tc),
+		value: L.set(a, Oc),
 		enumerable: !0
 	}), u;
-}) }, Dc, Oc = (e) => {
-	Dc = e;
-}, kc = () => {
-	Dc = void 0;
-}, Ac = () => Dc, jc = async (e, t = {}) => {
-	let n = t.scopes === void 0 ? He(t.id ?? "system") : He(t.id ?? "system", t.scopes), r = t.store ?? Dc?.dataStore, i = t.schemaRegistry ?? Dc?.schemaRegistry, a = t.dialect ?? Dc?.dialect;
+}) }, Ac, jc = (e) => {
+	Ac = e;
+}, Mc = () => {
+	Ac = void 0;
+}, Nc = () => Ac, Pc = async (e, t = {}) => {
+	let n = t.scopes === void 0 ? He(t.id ?? "system") : He(t.id ?? "system", t.scopes), r = t.store ?? Ac?.dataStore, i = t.schemaRegistry ?? Ac?.schemaRegistry, a = t.dialect ?? Ac?.dialect;
 	if (r === void 0 || i === void 0) throw Error("runAsSystem: no data store available — register one at boot via setSystemStoreHandle({ dataStore, schemaRegistry }) or pass { store, schemaRegistry } in the options.");
 	return e({
 		subject: n,
-		store: fc(r, {
+		store: hc(r, {
 			subject: n,
 			schemaRegistry: i,
 			...a === void 0 ? {} : { dialect: a }
 		})
 	});
-}, Mc = (e) => {
+}, Fc = (e) => {
 	let { currentRegion: t, replicaRegions: n, inner: r } = e, i = (e) => {
 		if (t === void 0) return {
 			sameRegion: [],
@@ -5099,7 +5116,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			return r.loadSnapshot();
 		}
 	};
-}, Nc = (e = process.env) => {
+}, Ic = (e = process.env) => {
 	for (let t of [
 		"VOLTRO_REGION",
 		"AWS_REGION",
@@ -5111,7 +5128,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		let n = e[t];
 		if (typeof n == "string" && n.length > 0) return n;
 	}
-}, Pc = () => {
+}, Lc = () => {
 	let e = {
 		primary: 0,
 		lagByReplica: /* @__PURE__ */ new Map()
@@ -5136,7 +5153,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			e.lagByReplica.set(t, n);
 		}
 	};
-}, Fc = Symbol.for("@voltro/ScheduleDefinition"), Ic = (e) => typeof e == "object" && !!e && Fc in e, Lc = 30 * 6e4, Rc = (e) => {
+}, Rc = Symbol.for("@voltro/ScheduleDefinition"), zc = (e) => typeof e == "object" && !!e && Rc in e, Bc = 30 * 6e4, Vc = (e) => {
 	let t = Ke.parse(e.cron, e.timezone);
 	if (Ye.isLeft(t)) throw Error(`defineSchedule("${e.name}"): invalid cron expression "${e.cron}" (tz="${e.timezone}") — ${String(t.left)}`);
 	if (!e.timezone || e.timezone.trim() === "") throw Error(`defineSchedule("${e.name}"): timezone is required (e.g. "UTC", "Europe/Berlin")`);
@@ -5145,18 +5162,18 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		...e,
 		onOverlap: e.onOverlap ?? "skip",
 		backfill: e.backfill ?? "skip",
-		maxRuntimeMs: e.maxRuntimeMs ?? Lc,
-		[Fc]: !0
+		maxRuntimeMs: e.maxRuntimeMs ?? Bc,
+		[Rc]: !0
 	};
-}, zc = (e) => Ke.unsafeParse(e.cron, e.timezone), Bc = (e, t = /* @__PURE__ */ new Date()) => Ke.next(zc(e), t), Z = "_voltro_wakeups", Vc = (e) => `${e.tenantId}:${e.kind}:${e.refId}`, Hc = (e) => ({
+}, Hc = (e) => Ke.unsafeParse(e.cron, e.timezone), Uc = (e, t = /* @__PURE__ */ new Date()) => Ke.next(Hc(e), t), Z = "_voltro_wakeups", Wc = (e) => `${e.tenantId}:${e.kind}:${e.refId}`, Gc = (e) => ({
 	tenantId: String(e.tenantId),
 	kind: String(e.kind),
 	refId: String(e.refId),
 	wakeAt: e.wakeAt instanceof Date ? e.wakeAt : new Date(String(e.wakeAt)),
 	status: e.status === "fired" ? "fired" : "pending"
-}), Uc = async (e, t) => {
+}), Kc = async (e, t) => {
 	await e.upsert(Z, {
-		id: Vc(t),
+		id: Wc(t),
 		tenantId: t.tenantId,
 		kind: t.kind,
 		refId: t.refId,
@@ -5166,7 +5183,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		conflictColumns: ["id"],
 		update: ["wakeAt", "status"]
 	});
-}, Wc = async (e, t) => e.delete(Z, Vc(t)), Gc = async (e, t) => await e.update(Z, Vc(t), { status: "fired" }) !== null, Kc = (e, t) => ({ and: [{
+}, qc = async (e, t) => e.delete(Z, Wc(t)), Jc = async (e, t) => await e.update(Z, Wc(t), { status: "fired" }) !== null, Yc = (e, t) => ({ and: [{
 	column: "id",
 	op: "eq",
 	value: e
@@ -5174,16 +5191,16 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	column: "status",
 	op: "eq",
 	value: t
-}] }), qc = async (e, t) => await e.updateMany(Z, { status: "fired" }, { where: Kc(Vc(t), "pending") }) > 0, Jc = async (e, t) => {
-	await e.updateMany(Z, { status: "pending" }, { where: Kc(Vc(t), "fired") });
-}, Yc = {
+}] }), Xc = async (e, t) => await e.updateMany(Z, { status: "fired" }, { where: Yc(Wc(t), "pending") }) > 0, Zc = async (e, t) => {
+	await e.updateMany(Z, { status: "pending" }, { where: Yc(Wc(t), "fired") });
+}, Qc = {
 	column: "status",
 	op: "eq",
 	value: "pending"
-}, Xc = async (e, t) => {
+}, $c = async (e, t) => {
 	let n = {
 		table: Z,
-		predicate: Yc,
+		predicate: Qc,
 		order: [{
 			column: "wakeAt",
 			direction: "asc"
@@ -5192,18 +5209,18 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		skip: void 0,
 		projection: void 0
 	};
-	return (await e.query(n)).map(Hc);
-}, Zc = async (e, t, n = 500) => {
-	let r = await Xc(e, n), i = t.getTime();
+	return (await e.query(n)).map(Gc);
+}, el = async (e, t, n = 500) => {
+	let r = await $c(e, n), i = t.getTime();
 	return r.filter((e) => e.wakeAt.getTime() <= i);
-}, Qc = async (e) => (await Xc(e, 1))[0] ?? null, $c = {
+}, tl = async (e) => (await $c(e, 1))[0] ?? null, nl = {
 	column: "status",
 	op: "eq",
 	value: "fired"
-}, el = async (e, t = {}) => {
+}, rl = async (e, t = {}) => {
 	let n = {
 		table: Z,
-		predicate: $c,
+		predicate: nl,
 		order: [{
 			column: "wakeAt",
 			direction: "asc"
@@ -5214,12 +5231,12 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	}, r = await e.query(n), i = t.firedOlderThan?.getTime(), a = 0;
 	for (let t of r) i !== void 0 && (t.wakeAt instanceof Date ? t.wakeAt : new Date(String(t.wakeAt))).getTime() >= i || await e.delete(Z, String(t.id)) && a++;
 	return a;
-}, tl = _a, nl = "default", rl = {
+}, il = ba, al = "default", ol = {
 	kind: "single",
 	tryClaim: async () => !0
-}, il = "_voltro_schedule_claims", al = (e, t, n) => {
+}, sl = "_voltro_schedule_claims", cl = (e, t, n) => {
 	let r = async (t) => (await e.query({
-		table: il,
+		table: sl,
 		order: [],
 		predicate: void 0,
 		projection: ["id"],
@@ -5234,7 +5251,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 				if (await r(s)) return !1;
 			} catch {}
 			try {
-				return await e.insert(il, {
+				return await e.insert(sl, {
 					id: s,
 					scheduleName: i,
 					bucket: o,
@@ -5252,12 +5269,12 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			}
 		}
 	};
-}, ol = "_voltro_schedule_runs", sl = async (e, t) => {
+}, ll = "_voltro_schedule_runs", ul = async (e, t) => {
 	let { store: n, coordinator: r, buildContext: i, replicaId: a, log: o, onRunEvent: s, interceptFire: c } = t, l = t.dormancy === "sleep", u = t.dormancyTenantId ?? "default", d = /* @__PURE__ */ new Map(), f = /* @__PURE__ */ new Set(), p = /* @__PURE__ */ new Map(), m = !1, h = new Map(e.map((e) => [e.name, e])), g = (e, t) => {
-		s?.(e, ll(t));
+		s?.(e, fl(t));
 	}, _ = async (e, t, r, i, s, c) => {
 		try {
-			let o = `sr_${_e()}`, l = await n.insert(ol, {
+			let o = `sr_${_e()}`, l = await n.insert(ll, {
 				id: o,
 				name: e.name,
 				status: i,
@@ -5282,7 +5299,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		}
 	}, v = async (e, t) => {
 		try {
-			let r = await n.update(ol, e, t);
+			let r = await n.update(ll, e, t);
 			r && g("update", r);
 		} catch (t) {
 			o.warn("schedule: failed to record run finish", {
@@ -5293,7 +5310,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	}, y = async (e) => {
 		try {
 			let t = await n.query({
-				table: ol,
+				table: ll,
 				predicate: {
 					_tag: "leaf",
 					column: "status",
@@ -5328,7 +5345,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 				scheduleName: e.name,
 				trigger: n,
 				runId: s,
-				subject: tl
+				subject: il
 			})
 		};
 		try {
@@ -5359,7 +5376,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			let n = Q(t).includes("exceeded maxRuntimeMs"), r = en(t).dbMessage, i = typeof r == "string" && r !== "" ? `${Q(t)} — ${r}` : Q(t);
 			s && await v(s, {
 				status: "failed",
-				errorTag: n ? "timeout" : cl(t),
+				errorTag: n ? "timeout" : dl(t),
 				errorMessage: i,
 				completedAt: /* @__PURE__ */ new Date(),
 				durationMs: Date.now() - l
@@ -5419,8 +5436,8 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		}
 	}, C = async (e) => {
 		try {
-			let t = Ke.next(zc(e), /* @__PURE__ */ new Date());
-			await Uc(n, {
+			let t = Ke.next(Hc(e), /* @__PURE__ */ new Date());
+			await Kc(n, {
 				tenantId: u,
 				kind: "schedule",
 				refId: e.name,
@@ -5434,7 +5451,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		}
 	}, w = 2147483647, T = (e) => {
 		if (m) return;
-		let n = zc(e), r = Ke.next(n, /* @__PURE__ */ new Date()), i = () => {
+		let n = Hc(e), r = Ke.next(n, /* @__PURE__ */ new Date()), i = () => {
 			if (m) return;
 			let n = r.getTime() - Date.now();
 			if (n > w) {
@@ -5456,7 +5473,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		let r;
 		try {
 			let t = (await n.query({
-				table: ol,
+				table: ll,
 				order: [{
 					column: "scheduledAt",
 					direction: "desc"
@@ -5475,7 +5492,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			return;
 		}
 		if (!r) return;
-		let i = zc(e), a = [], s = Ke.next(i, r), c = Date.now();
+		let i = Hc(e), a = [], s = Ke.next(i, r), c = Date.now();
 		for (; s.getTime() < c && a.length < 1e3;) a.push(s), s = Ke.next(i, s);
 		if (a.length !== 0) if (o.info("schedule: backfill", {
 			name: e.name,
@@ -5520,11 +5537,11 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			d.clear(), o.info("scheduler: stopped");
 		}
 	};
-}, Q = (e) => e?.message ?? String(e), cl = (e) => e && typeof e == "object" && "_tag" in e ? String(e._tag) : null, ll = (e) => {
+}, Q = (e) => e?.message ?? String(e), dl = (e) => e && typeof e == "object" && "_tag" in e ? String(e._tag) : null, fl = (e) => {
 	let t = {};
 	for (let [n, r] of Object.entries(e)) t[n] = r instanceof Date ? r.toISOString() : r;
 	return t;
-}, ul = (e, t, n, r) => {
+}, pl = (e, t, n, r) => {
 	let i = !1, a, o = async () => {
 		if (i) return;
 		let a = new Date(Math.floor(Date.now() / t) * t), o = !1;
@@ -5554,7 +5571,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			i || (i = !0, a && clearInterval(a), a = void 0);
 		}
 	};
-}, dl = (e) => (t, n, r) => ul(t, n, r, e), fl = O("_voltro_schedule_runs", {
+}, ml = (e) => (t, n, r) => pl(t, n, r, e), hl = O("_voltro_schedule_runs", {
 	id: v({ prefix: "schrun" }),
 	name: k(),
 	status: k().oneOf([
@@ -5584,13 +5601,13 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	]).nullable(),
 	replicaId: k().nullable(),
 	result: C().nullable()
-}).index(["name", "scheduledAt"]).index(["status"]), pl = O("_voltro_schedule_claims", {
+}).index(["name", "scheduledAt"]).index(["status"]), gl = O("_voltro_schedule_claims", {
 	id: v({ prefix: "schclaim" }),
 	scheduleName: k(),
 	bucket: k(),
 	claimedBy: k(),
 	claimedAt: A()
-}).index(["scheduleName", "bucket"]).index(["claimedAt"]), ml = O("_voltro_traces", {
+}).index(["scheduleName", "bucket"]).index(["claimedAt"]), _l = O("_voltro_traces", {
 	id: v({ prefix: "span" }),
 	traceId: k(),
 	spanId: k(),
@@ -5614,7 +5631,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	durationMs: b(),
 	attributes: C().nullable(),
 	events: C().nullable()
-}).index(["traceId", "startedAt"]).index(["startedAt"]).index(["status"]), hl = O("_voltro_undo_log", {
+}).index(["traceId", "startedAt"]).index(["startedAt"]).index(["status"]), vl = O("_voltro_undo_log", {
 	id: v({ prefix: "undo" }),
 	tag: k(),
 	label: k().nullable(),
@@ -5625,25 +5642,25 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	crossesAction: r().default(!1),
 	undone: r().default(!1),
 	createdAt: A().default("now")
-}).index(["subjectId", "createdAt"]).reactive(), gl = (e = process.env) => {
+}).index(["subjectId", "createdAt"]).reactive(), yl = (e = process.env) => {
 	let t = (e.VOLTRO_UNDO ?? "").toLowerCase();
 	return t === "on" || t === "1" || t === "true" ? !0 : t === "off" || t === "0" || t === "false" ? !1 : e.NODE_ENV !== "production";
-}, _l = (e) => e.startsWith("_voltro"), vl = async (e, t, n) => (await e.query({
+}, bl = (e) => e.startsWith("_voltro"), xl = async (e, t, n) => (await e.query({
 	table: t,
 	predicate: u("id", n),
 	order: []
-}))[0] ?? null, yl = (e, t) => new Proxy(e, { get(e, n, r) {
+}))[0] ?? null, Sl = (e, t) => new Proxy(e, { get(e, n, r) {
 	if (n === "insert") return async (n, r) => {
 		let i = await e.insert(n, r);
-		return _l(n) || t({
+		return bl(n) || t({
 			table: n,
 			op: "insert",
 			next: i
 		}), i;
 	};
 	if (n === "update") return async (n, r, i) => {
-		let a = _l(n) ? null : await vl(e, n, r), o = await e.update(n, r, i);
-		return _l(n) || t({
+		let a = bl(n) ? null : await xl(e, n, r), o = await e.update(n, r, i);
+		return bl(n) || t({
 			table: n,
 			op: "update",
 			id: r,
@@ -5652,8 +5669,8 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		}), o;
 	};
 	if (n === "delete") return async (n, r) => {
-		let i = _l(n) ? null : await vl(e, n, r), a = await e.delete(n, r);
-		return !_l(n) && a && t({
+		let i = bl(n) ? null : await xl(e, n, r), a = await e.delete(n, r);
+		return !bl(n) && a && t({
 			table: n,
 			op: "delete",
 			id: r,
@@ -5662,10 +5679,10 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	};
 	let i = Reflect.get(e, n, r);
 	return typeof i == "function" ? i.bind(e) : i;
-} }), bl = (e) => {
+} }), Cl = (e) => {
 	let t = [];
 	return {
-		tx: yl(e, (e) => t.push(e)),
+		tx: Sl(e, (e) => t.push(e)),
 		persist: async (e, n) => {
 			if (t.length === 0 || n.tag.startsWith("__voltro")) return;
 			let r = n.subject;
@@ -5681,14 +5698,14 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			});
 		}
 	};
-}, xl = (e) => {
+}, wl = (e) => {
 	if (e.id !== void 0) return e.id;
 	let t = e.next?.id;
 	if (typeof t == "string") return t;
 	let n = e.prev?.id;
 	return typeof n == "string" ? n : void 0;
-}, Sl = (e) => {
-	let t = xl(e);
+}, Tl = (e) => {
+	let t = wl(e);
 	switch (e.op) {
 		case "insert": return t === void 0 ? null : {
 			table: e.table,
@@ -5712,28 +5729,28 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			row: e.prev
 		};
 	}
-}, Cl = (e) => {
-	if (e.crossesAction) throw new wl(e.invocationId, "action");
+}, El = (e) => {
+	if (e.crossesAction) throw new Dl(e.invocationId, "action");
 	let t = [];
 	for (let n = e.changes.length - 1; n >= 0; --n) {
-		let r = Sl(e.changes[n]);
+		let r = Tl(e.changes[n]);
 		r !== null && t.push(r);
 	}
 	return t;
-}, wl = class extends Error {
+}, Dl = class extends Error {
 	invocationId;
 	boundary;
 	_tag = "UndoBoundaryError";
 	constructor(e, t) {
 		super(t === "action" ? `cannot undo invocation ${e}: it crossed an action (external side effect)` : `cannot undo invocation ${e}: the row changed since (conflict)`), this.invocationId = e, this.boundary = t, this.name = "UndoBoundaryError";
 	}
-}, Tl = (e, t, n = ["updatedAt", "updatedBy"]) => {
+}, Ol = (e, t, n = ["updatedAt", "updatedBy"]) => {
 	if (t == null) return e == null;
 	if (e == null) return !1;
 	let r = new Set(n);
 	for (let [n, i] of Object.entries(t)) if (!r.has(n) && !Object.is(e[n], i) && JSON.stringify(e[n]) !== JSON.stringify(i)) return !1;
 	return !0;
-}, El = class {
+}, kl = class {
 	capacity;
 	done = [];
 	undone = [];
@@ -5769,7 +5786,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			redo: [...this.undone]
 		};
 	}
-}, Dl = (e, t = /* @__PURE__ */ new Set()) => e.op === "insert" ? {
+}, Al = (e, t = /* @__PURE__ */ new Set()) => e.op === "insert" ? {
 	table: e.table,
 	op: "insert",
 	next: e.new ?? null
@@ -5786,7 +5803,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	table: e.table,
 	op: "delete",
 	prev: e.old ?? null
-}, Ol = async (e, t) => {
+}, jl = async (e, t) => {
 	switch (t.op) {
 		case "delete":
 			await e.delete(t.table, t.id);
@@ -5804,21 +5821,21 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			await e.insert(t.table, t.row);
 			return;
 	}
-}, kl = async (e, t) => {
-	for (let n of t) await Ol(e, n);
-}, Al = (e) => e.request?.subject?.id ?? null, jl = (e) => e === !0 || e === 1, Ml = async (e, t, n) => (await e.query({
+}, Ml = async (e, t) => {
+	for (let n of t) await jl(e, n);
+}, Nl = (e) => e.request?.subject?.id ?? null, Pl = (e) => e === !0 || e === 1, Fl = async (e, t, n) => (await e.query({
 	table: t,
 	predicate: u("id", n),
 	order: []
-}))[0] ?? null, Nl = (e) => {
+}))[0] ?? null, Il = (e) => {
 	try {
 		let t = JSON.parse(String(e ?? "[]"));
 		return Array.isArray(t) ? t : [];
 	} catch {
 		return [];
 	}
-}, Pl = (e) => e.id ?? e.next?.id ?? e.prev?.id, Fl = async (e, t) => {
-	let n = Al(t);
+}, Ll = (e) => e.id ?? e.next?.id ?? e.prev?.id, Rl = async (e, t) => {
+	let n = Nl(t);
 	return [...await t.store.query({
 		table: "_voltro_undo_log",
 		predicate: u("subjectId", n),
@@ -5827,68 +5844,68 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		id: String(e.id),
 		tag: String(e.tag ?? ""),
 		label: e.label ?? null,
-		undone: jl(e.undone),
-		crossesAction: jl(e.crossesAction),
+		undone: Pl(e.undone),
+		crossesAction: Pl(e.crossesAction),
 		createdAt: String(e.createdAt ?? "")
 	}));
-}, Il = async (e, t) => {
-	let n = await Ml(t.store, "_voltro_undo_log", e.invocationId);
+}, zl = async (e, t) => {
+	let n = await Fl(t.store, "_voltro_undo_log", e.invocationId);
 	if (!n) throw new Me({ invocationId: e.invocationId });
-	if ((n.subjectId ?? null) !== Al(t)) throw new je({ invocationId: e.invocationId });
+	if ((n.subjectId ?? null) !== Nl(t)) throw new je({ invocationId: e.invocationId });
 	return n;
-}, Ll = async (e, t) => {
-	let n = await Il(e, t);
-	if (jl(n.undone)) return { ok: !0 };
-	if (jl(n.crossesAction)) throw new Ae({
+}, Bl = async (e, t) => {
+	let n = await zl(e, t);
+	if (Pl(n.undone)) return { ok: !0 };
+	if (Pl(n.crossesAction)) throw new Ae({
 		invocationId: e.invocationId,
 		reason: "action"
 	});
-	let r = Nl(n.changes);
+	let r = Il(n.changes);
 	for (let n of r) {
-		let r = Pl(n);
-		if (r !== void 0 && !Tl(await Ml(t.store, n.table, r), n.next ?? null)) throw new Ae({
+		let r = Ll(n);
+		if (r !== void 0 && !Ol(await Fl(t.store, n.table, r), n.next ?? null)) throw new Ae({
 			invocationId: e.invocationId,
 			reason: "conflict"
 		});
 	}
 	let i = {
 		invocationId: e.invocationId,
-		subject: Al(t),
+		subject: Nl(t),
 		changes: r,
 		crossesAction: !1
 	};
-	return await kl(t.store, Cl(i)), await t.store.update("_voltro_undo_log", e.invocationId, { undone: !0 }), { ok: !0 };
-}, Rl = async (e, t) => {
-	let n = await Il(e, t);
-	if (!jl(n.undone)) return { ok: !0 };
-	for (let e of Nl(n.changes)) {
-		let n = Pl(e);
+	return await Ml(t.store, El(i)), await t.store.update("_voltro_undo_log", e.invocationId, { undone: !0 }), { ok: !0 };
+}, Vl = async (e, t) => {
+	let n = await zl(e, t);
+	if (!Pl(n.undone)) return { ok: !0 };
+	for (let e of Il(n.changes)) {
+		let n = Ll(e);
 		e.op === "insert" && e.next ? await t.store.insert(e.table, e.next) : e.op === "update" && n !== void 0 && e.next ? await t.store.update(e.table, n, e.next) : e.op === "delete" && n !== void 0 && await t.store.delete(e.table, n);
 	}
 	return await t.store.update("_voltro_undo_log", e.invocationId, { undone: !1 }), { ok: !0 };
-}, zl = (e = process.env) => {
+}, Hl = (e = process.env) => {
 	let t = (e.VOLTRO_TIMELINE ?? "").toLowerCase();
 	return t === "off" || t === "0" || t === "false" ? "off" : t === "all" ? "all" : t === "interesting" || t === "on" || t === "1" || t === "true" ? "interesting" : e.NODE_ENV === "production" ? "off" : "interesting";
-}, Bl = /pass(word)?|secret|token|api[_-]?key|authorization|cookie|ssn|credit[_-]?card|card[_-]?number|cvv|encrypted/i, Vl = "«redacted»", Hl = (e) => {
+}, Ul = /pass(word)?|secret|token|api[_-]?key|authorization|cookie|ssn|credit[_-]?card|card[_-]?number|cvv|encrypted/i, Wl = "«redacted»", Gl = (e) => {
 	if (e == null) return null;
 	let t = {};
-	for (let [n, r] of Object.entries(e)) t[n] = Bl.test(n) ? Vl : r;
+	for (let [n, r] of Object.entries(e)) t[n] = Ul.test(n) ? Wl : r;
 	return t;
-}, Ul = (e) => {
+}, Kl = (e) => {
 	let t = e?.id;
 	return typeof t == "string" ? t : void 0;
-}, Wl = (e, t) => {
+}, ql = (e, t) => {
 	if (t.op === "insert") {
-		let n = Ul(t.new);
+		let n = Kl(t.new);
 		return n === void 0 ? e : e.filter((e) => e.id !== n);
 	}
 	if (t.op === "update") {
 		if (t.old == null) return e;
-		let n = Ul(t.new) ?? Ul(t.old);
+		let n = Kl(t.new) ?? Kl(t.old);
 		return e.map((e) => e.id === n ? t.old : e);
 	}
 	return t.old == null ? e : [...e, t.old];
-}, Gl = class {
+}, Jl = class {
 	mode;
 	capacity;
 	now;
@@ -5908,8 +5925,8 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			ts: this.now(),
 			table: e.table,
 			op: e.op,
-			old: Hl(e.old),
-			new: Hl(e.new),
+			old: Gl(e.old),
+			new: Gl(e.new),
 			tenantId: n
 		}), this.ring.length > this.capacity && this.ring.shift(), t;
 	}
@@ -5922,23 +5939,23 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	}
 	replay(e, t, n) {
 		let r = this.ring.filter((n) => n.table === e && n.seq > t).sort((e, t) => t.seq - e.seq), i = n;
-		for (let e of r) i = Wl(i, e);
+		for (let e of r) i = ql(i, e);
 		return i;
 	}
-}, Kl, ql = () => (Kl === void 0 && (Kl = new Gl(zl())), Kl), Jl = (e) => {
-	Kl = e;
-}, Yl = (e) => {
-	let t = ql();
+}, Yl, Xl = () => (Yl === void 0 && (Yl = new Jl(Hl())), Yl), Zl = (e) => {
+	Yl = e;
+}, Ql = (e) => {
+	let t = Xl();
 	if (t.enabled) try {
 		t.record(e);
 	} catch {}
-}, Xl = /* @__PURE__ */ new Set([
+}, $l = /* @__PURE__ */ new Set([
 	"count",
 	"sum",
 	"avg",
 	"min",
 	"max"
-]), Zl = (e) => {
+]), eu = (e) => {
 	if (e.joins !== void 0 && e.joins.length > 0) return {
 		maintainable: !1,
 		reason: "joins are not maintainable in v1"
@@ -5960,7 +5977,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		reason: "v1 maintains exactly one aggregation"
 	};
 	let t = e.aggregations[0];
-	return Xl.has(t.op) ? t.op !== "count" && (t.column === void 0 || t.column.length === 0) ? {
+	return $l.has(t.op) ? t.op !== "count" && (t.column === void 0 || t.column.length === 0) ? {
 		maintainable: !1,
 		reason: `op '${t.op}' requires a column`
 	} : {
@@ -5974,7 +5991,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		maintainable: !1,
 		reason: `op '${t.op}' is not maintainable`
 	};
-}, Ql = "\0", $ = (e, t) => t === void 0 || t.length === 0 ? "" : t.map((t) => JSON.stringify(e[t] ?? null)).join(Ql), $l = (e, t) => t === void 0 ? 0 : Number(e[t] ?? 0), eu = (e, t) => {
+}, tu = "\0", $ = (e, t) => t === void 0 || t.length === 0 ? "" : t.map((t) => JSON.stringify(e[t] ?? null)).join(tu), nu = (e, t) => t === void 0 ? 0 : Number(e[t] ?? 0), ru = (e, t) => {
 	switch (e.op) {
 		case "count": return t.count;
 		case "sum": return t.sum ?? 0;
@@ -5982,10 +5999,10 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		case "min":
 		case "max": return t.count > 0 ? t.extreme ?? null : null;
 	}
-}, tu = (e, t) => {
+}, iu = (e, t) => {
 	let n = /* @__PURE__ */ new Map();
 	for (let r of t) {
-		let t = $(r, e.groupBy), i = n.get(t), a = $l(r, e.column);
+		let t = $(r, e.groupBy), i = n.get(t), a = nu(r, e.column);
 		if (i === void 0) n.set(t, {
 			count: 1,
 			...e.op === "sum" || e.op === "avg" ? { sum: a } : {},
@@ -6001,10 +6018,10 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		}
 	}
 	return n;
-}, nu = (e, t) => [...t.entries()].map(([t, n]) => ({
+}, au = (e, t) => [...t.entries()].map(([t, n]) => ({
 	groupKey: t,
-	value: eu(e, n)
-})), ru = (e, t, n) => {
+	value: ru(e, n)
+})), ou = (e, t, n) => {
 	let r = new Map(t), i = /* @__PURE__ */ new Set(), a = (t) => {
 		let n = $(t, e.groupBy), a = r.get(n);
 		if (a === void 0) return;
@@ -6013,7 +6030,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			r.delete(n);
 			return;
 		}
-		let s = $l(t, e.column);
+		let s = nu(t, e.column);
 		e.op === "min" || e.op === "max" ? (a.extreme !== void 0 && s === a.extreme && i.add(n), r.set(n, {
 			count: o,
 			...a.extreme === void 0 ? {} : { extreme: a.extreme }
@@ -6022,7 +6039,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			...e.op === "sum" || e.op === "avg" ? { sum: (a.sum ?? 0) - s } : {}
 		});
 	}, o = (t) => {
-		let n = $(t, e.groupBy), i = r.get(n), a = $l(t, e.column);
+		let n = $(t, e.groupBy), i = r.get(n), a = nu(t, e.column);
 		if (i === void 0) {
 			r.set(n, {
 				count: 1,
@@ -6042,15 +6059,15 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		state: r,
 		rescanGroups: [...i]
 	};
-}, iu = (e, t, n, r) => {
+}, su = (e, t, n, r) => {
 	if (n.length === 0) return t;
-	let i = new Set(n), a = tu(e, r.filter((t) => i.has($(t, e.groupBy)))), o = new Map(t);
+	let i = new Set(n), a = iu(e, r.filter((t) => i.has($(t, e.groupBy)))), o = new Map(t);
 	for (let e of i) {
 		let t = a.get(e);
 		t === void 0 ? o.delete(e) : o.set(e, t);
 	}
 	return o;
-}, au = class {
+}, cu = class {
 	shape;
 	state = /* @__PURE__ */ new Map();
 	groups = /* @__PURE__ */ new Map();
@@ -6058,7 +6075,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		this.shape = e;
 	}
 	seed(e) {
-		this.state = tu(this.shape, e), this.groups.clear();
+		this.state = iu(this.shape, e), this.groups.clear();
 		for (let t of e) {
 			let e = $(t, this.shape.groupBy);
 			this.groups.has(e) || this.groups.set(e, this.groupValues(t));
@@ -6070,14 +6087,14 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			let e = $(t, this.shape.groupBy);
 			this.groups.has(e) || this.groups.set(e, this.groupValues(t));
 		}
-		let n = ru(this.shape, this.state, e);
+		let n = ou(this.shape, this.state, e);
 		this.state = n.state;
 		for (let e of this.groups.keys()) this.state.has(e) || this.groups.delete(e);
 		return n.rescanGroups;
 	}
 	resolveRescan(e, t) {
 		if (e.length === 0) return;
-		this.state = iu(this.shape, this.state, e, t);
+		this.state = su(this.shape, this.state, e, t);
 		let n = new Set(e);
 		for (let e of t) {
 			let t = $(e, this.shape.groupBy);
@@ -6086,7 +6103,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		for (let e of n) this.state.has(e) || this.groups.delete(e);
 	}
 	materialize() {
-		return nu(this.shape, this.state).map((e) => ({
+		return au(this.shape, this.state).map((e) => ({
 			groupKey: e.groupKey,
 			group: this.groups.get(e.groupKey) ?? {},
 			value: e.value
@@ -6099,7 +6116,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		for (let r of t) n[r] = e[r];
 		return n;
 	}
-}, ou = O("_voltro_rebac_tuples", {
+}, lu = O("_voltro_rebac_tuples", {
 	id: v({ prefix: "rbct" }),
 	subjectId: k(),
 	relation: k(),
@@ -6111,7 +6128,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	"subjectId",
 	"resourceType",
 	"resourceId"
-]).reactive(), su = async (e, n, r, i) => n === null ? [] : (await e.query({
+]).reactive(), uu = async (e, n, r, i) => n === null ? [] : (await e.query({
 	table: "_voltro_rebac_tuples",
 	predicate: t(u("subjectId", n), u("resourceType", r), u("resourceId", i)),
 	order: [],
@@ -6123,16 +6140,16 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	relation: e.relation,
 	resourceType: e.resourceType,
 	resourceId: e.resourceId
-})), cu = (e) => ({
+})), du = (e) => ({
 	id: e.id,
 	tenantId: e.tenantId,
 	...e.scopes === void 0 ? {} : { scopes: e.scopes }
-}), lu = (e, t) => {
-	let n = t.getPolicy ?? vs;
+}), fu = (e, t) => {
+	let n = t.getPolicy ?? xs;
 	return (r, i) => {
 		let a = e[i.tag];
 		if (a === void 0) return r;
-		let o = n(a.resourceType), s = (e) => P.fail(new hs({
+		let o = n(a.resourceType), s = (e) => P.fail(new vs({
 			action: a.action,
 			resourceType: a.resourceType,
 			resourceId: e
@@ -6140,17 +6157,17 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		if (o === void 0) return s("");
 		let c = a.resourceId(i.input);
 		if (c === null || c === "") return s("");
-		let l = cu(i.subject), u = {
+		let l = du(i.subject), u = {
 			type: a.resourceType,
 			id: c,
 			tenantId: i.subject.tenantId
 		};
-		return P.flatMap(P.promise(async () => t.loadTuples(l.id, a.resourceType, c)), (e) => ws(l, a.action, u, {
+		return P.flatMap(P.promise(async () => t.loadTuples(l.id, a.resourceType, c)), (e) => Ds(l, a.action, u, {
 			policy: o,
 			tuples: e
 		}) ? r : s(c));
 	};
-}, uu = async (e, n, r) => n === null ? [] : (await e.query({
+}, pu = async (e, n, r) => n === null ? [] : (await e.query({
 	table: "_voltro_rebac_tuples",
 	predicate: t(u("subjectId", n), u("resourceType", r)),
 	order: [],
@@ -6162,18 +6179,18 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	relation: e.relation,
 	resourceType: e.resourceType,
 	resourceId: e.resourceId
-})), du = (e) => {
-	let t = e.getPolicy ?? vs;
+})), mu = (e) => {
+	let t = e.getPolicy ?? xs;
 	return async (n, r, i, a) => {
 		let o = t(r);
 		if (o === void 0) return [];
-		let s = cu(n);
-		return Es(s, i, r, a, {
+		let s = du(n);
+		return ks(s, i, r, a, {
 			policy: o,
 			tuples: await e.loadSubjectTuples(s.id, r)
 		});
 	};
-}, fu = (e) => {
+}, hu = (e) => {
 	if (typeof e.name != "string" || e.name.length === 0) throw Error("defineReaction: a non-empty `name` is required");
 	if (e.watch === void 0 || typeof e.watch.table != "string" || e.watch.table.length === 0) throw Error(`reaction '${e.name}': watch.table is required`);
 	if (e.act === void 0 || e.act.kind !== "agent" && e.act.kind !== "workflow") throw Error(`reaction '${e.name}': act must be { kind: 'agent' | 'workflow', … }`);
@@ -6181,14 +6198,14 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	if (e.guards.rateLimit !== void 0 && (e.guards.rateLimit.limit <= 0 || e.guards.rateLimit.windowMs <= 0)) throw Error(`reaction '${e.name}': guards.rateLimit needs positive limit + windowMs`);
 	if (e.guards.costBudgetUsd !== void 0 && e.guards.costBudgetUsd < 0) throw Error(`reaction '${e.name}': guards.costBudgetUsd must be >= 0`);
 	return e;
-}, pu = (e, t) => e === void 0 ? !0 : Array.isArray(e) ? e.includes(t) : e === t, mu = (e) => e.new?.tenantId ?? e.old?.tenantId ?? null, hu = class {
+}, gu = (e, t) => e === void 0 ? !0 : Array.isArray(e) ? e.includes(t) : e === t, _u = (e) => e.new?.tenantId ?? e.old?.tenantId ?? null, vu = class {
 	hits = /* @__PURE__ */ new Map();
 	allow(e, t, n, r) {
 		let i = r - n, a = (this.hits.get(e) ?? []).filter((e) => e > i);
 		return a.length >= t ? (this.hits.set(e, a), !1) : (a.push(r), this.hits.set(e, a), !0);
 	}
-}, gu = async (e, t, n) => {
-	if (t.table !== e.watch.table || !pu(e.watch.on, t.op)) return "skipped-op";
+}, yu = async (e, t, n) => {
+	if (t.table !== e.watch.table || !gu(e.watch.on, t.op)) return "skipped-op";
 	if (e.when !== void 0 && !e.when(t)) return "skipped-when";
 	let r = `${e.name}:${e.guards.dedupeKey(t)}`;
 	if (await n.dedupe.has(r)) return "skipped-dedupe";
@@ -6197,26 +6214,26 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		let t = n.now?.() ?? Date.now();
 		if (!n.rateLimiter.allow(e.name, i.limit, i.windowMs, t)) return "skipped-ratelimit";
 	}
-	let a = mu(t);
+	let a = _u(t);
 	return e.guards.costBudgetUsd !== void 0 && n.checkBudget !== void 0 && !await n.checkBudget(a, e.guards.costBudgetUsd) ? "skipped-budget" : (await n.runAct(e.act, t, {
 		id: a,
 		via: "agent"
 	}), await n.dedupe.add(r), "acted");
-}, _u = O("_voltro_wakeups", {
+}, bu = O("_voltro_wakeups", {
 	id: v({ prefix: "wakeup" }),
 	tenantId: k(),
 	kind: k(),
 	refId: k(),
 	wakeAt: A(),
 	status: k()
-}).index(["status", "wakeAt"]).index(["tenantId"]), vu = async (e) => {
-	let t = e.now?.() ?? /* @__PURE__ */ new Date(), n = await Zc(e.store, t, e.batchLimit ?? 100);
+}).index(["status", "wakeAt"]).index(["tenantId"]), xu = async (e) => {
+	let t = e.now?.() ?? /* @__PURE__ */ new Date(), n = await el(e.store, t, e.batchLimit ?? 100);
 	if (n.length === 0) return 0;
 	let r = 0;
-	for (let t of n) if (await qc(e.store, t)) try {
+	for (let t of n) if (await Xc(e.store, t)) try {
 		await e.adapter.wake(t), r++;
 	} catch (n) {
-		await Jc(e.store, t), e.log?.warn("wake: adapter failed — released for retry", {
+		await Zc(e.store, t), e.log?.warn("wake: adapter failed — released for retry", {
 			tenantId: t.tenantId,
 			kind: t.kind,
 			refId: t.refId,
@@ -6224,11 +6241,11 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		});
 	}
 	return r > 0 && e.log?.info("wake: woke due deployments", { count: r }), r;
-}, yu = (e, t = 1e3) => {
+}, Su = (e, t = 1e3) => {
 	let n = !1, r, i = async () => {
 		if (!n) {
 			try {
-				await vu(e);
+				await xu(e);
 			} catch (t) {
 				e.log?.warn("wake: tick failed", { reason: t instanceof Error ? t.message : String(t) });
 			}
@@ -6238,10 +6255,10 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	return i(), { stop: () => {
 		n = !0, r !== void 0 && clearTimeout(r);
 	} };
-}, bu = (e) => ({ wake: async () => {
+}, Cu = (e) => ({ wake: async () => {
 	await e.start();
-} }), xu = (e) => new Promise((t) => setTimeout(t, e)), Su = (e) => {
-	let t = e.fetchImpl ?? fetch, n = e.now ?? Date.now, r = e.sleep ?? xu, i = e.spawnImpl ?? Mt, a = e.startTimeoutMs ?? 3e4, o = e.healthPollMs ?? 200, s = e.stopSignal ?? "SIGTERM", c = e.stopGraceMs ?? 1e4, l, u, d = e.healthCheck ?? ((e) => e.ok), f = async () => {
+} }), wu = (e) => new Promise((t) => setTimeout(t, e)), Tu = (e) => {
+	let t = e.fetchImpl ?? fetch, n = e.now ?? Date.now, r = e.sleep ?? wu, i = e.spawnImpl ?? Mt, a = e.startTimeoutMs ?? 3e4, o = e.healthPollMs ?? 200, s = e.stopSignal ?? "SIGTERM", c = e.stopGraceMs ?? 1e4, l, u, d = e.healthCheck ?? ((e) => e.ok), f = async () => {
 		try {
 			let n = await t(e.healthUrl);
 			return d(n);
@@ -6295,11 +6312,11 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		},
 		stop: m
 	};
-}, Cu = async (e) => {
+}, Eu = async (e) => {
 	if (e.signals.connectedClients() > 0 || e.signals.inFlightRequests() > 0 || e.signals.activeWorkflowExecutions() > 0) return !1;
-	let t = (e.now?.() ?? /* @__PURE__ */ new Date()).getTime() + (e.wakeLookaheadMs ?? 3e4), n = await Qc(e.store);
+	let t = (e.now?.() ?? /* @__PURE__ */ new Date()).getTime() + (e.wakeLookaheadMs ?? 3e4), n = await tl(e.store);
 	return !(n !== null && n.wakeAt.getTime() <= t);
-}, wu = (e, t = Date.now) => {
+}, Du = (e, t = Date.now) => {
 	let n;
 	return {
 		update: (r) => {
@@ -6311,7 +6328,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			n = void 0;
 		}
 	};
-}, Tu = () => {
+}, Ou = () => {
 	let e = 0, t = 0;
 	return {
 		onRequestStart: () => {
@@ -6329,7 +6346,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		inFlightRequests: () => e,
 		openConnections: () => t
 	};
-}, Eu = (e) => ({ run: async (t) => (e.onActivity?.(), await e.ensureAwake(), t()) }), Du = (e, t, n, r) => new Promise((i, a) => {
+}, ku = (e) => ({ run: async (t) => (e.onActivity?.(), await e.ensureAwake(), t()) }), Au = (e, t, n, r) => new Promise((i, a) => {
 	let o = it.request({
 		host: n,
 		port: r,
@@ -6340,7 +6357,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		t.writeHead(e.statusCode ?? 502, e.headers), e.pipe(t), e.on("end", i), e.on("error", a);
 	});
 	o.on("error", a), e.pipe(o);
-}), Ou = (e, t, n, r, i) => new Promise((a, o) => {
+}), ju = (e, t, n, r, i) => new Promise((a, o) => {
 	let s = it.request({
 		host: r,
 		port: i,
@@ -6355,21 +6372,21 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		};
 		t.on("close", s), r.on("close", s), r.on("error", o);
 	}), s.on("error", o), s.end();
-}), ku = (e) => {
-	let t = Eu({
+}), Mu = (e) => {
+	let t = ku({
 		ensureAwake: () => e.supervisor.start(),
 		...e.onActivity === void 0 ? {} : { onActivity: e.onActivity }
 	}), n = e.activity, r = it.createServer((r, i) => {
-		n?.onRequestStart(), i.on("close", () => n?.onRequestEnd()), t.run(() => Du(r, i, e.targetHost, e.targetPort)).catch((t) => {
+		n?.onRequestStart(), i.on("close", () => n?.onRequestEnd()), t.run(() => Au(r, i, e.targetHost, e.targetPort)).catch((t) => {
 			e.log?.warn("wake-router: proxy failed", { reason: t instanceof Error ? t.message : String(t) }), i.headersSent || i.writeHead(502), i.end("wake/proxy failed");
 		});
 	});
 	return r.on("upgrade", (r, i, a) => {
-		n?.onConnect(), i.on("close", () => n?.onDisconnect()), t.run(() => Ou(r, i, a, e.targetHost, e.targetPort)).catch((t) => {
+		n?.onConnect(), i.on("close", () => n?.onDisconnect()), t.run(() => ju(r, i, a, e.targetHost, e.targetPort)).catch((t) => {
 			e.log?.warn("wake-router: upgrade proxy failed", { reason: t instanceof Error ? t.message : String(t) }), i.destroy();
 		});
 	}), r;
-}, Au = async (e) => {
+}, Nu = async (e) => {
 	try {
 		return (await e.query({
 			table: "_voltro_workflow_runs",
@@ -6386,15 +6403,15 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	} catch {
 		return 0;
 	}
-}, ju = async (e) => {
-	let t = bu(e.supervisor), n = await vu({
+}, Pu = async (e) => {
+	let t = Cu(e.supervisor), n = await xu({
 		store: e.store,
 		adapter: t,
 		...e.now === void 0 ? {} : { now: e.now },
 		...e.log === void 0 ? {} : { log: e.log }
 	});
 	n > 0 && e.idleGate.reset();
-	let r = await Cu({
+	let r = await Eu({
 		store: e.store,
 		signals: e.signals,
 		...e.wakeLookaheadMs === void 0 ? {} : { wakeLookaheadMs: e.wakeLookaheadMs },
@@ -6404,12 +6421,12 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		woke: n,
 		stopped: i
 	};
-}, Mu = async (e) => {
-	let t = wu(e.idleGraceMs ?? 6e4), n = e.tickMs ?? 1e3, r = Tu(), i = 0, a = e.signals === void 0, o = e.signals ?? {
+}, Fu = async (e) => {
+	let t = Du(e.idleGraceMs ?? 6e4), n = e.tickMs ?? 1e3, r = Ou(), i = 0, a = e.signals === void 0, o = e.signals ?? {
 		connectedClients: () => r.openConnections(),
 		inFlightRequests: () => r.inFlightRequests(),
 		activeWorkflowExecutions: () => i
-	}, s = ku({
+	}, s = Mu({
 		supervisor: e.supervisor,
 		targetHost: e.targetHost,
 		targetPort: e.targetPort,
@@ -6428,7 +6445,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	let l = !1, u, d = e.firedRetentionMs ?? 10 * 6e4, f = 0, p = async () => {
 		if (!l) {
 			try {
-				if (a && (i = await Au(e.store)), await ju({
+				if (a && (i = await Nu(e.store)), await Pu({
 					store: e.store,
 					supervisor: e.supervisor,
 					signals: o,
@@ -6436,7 +6453,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 					...e.wakeLookaheadMs === void 0 ? {} : { wakeLookaheadMs: e.wakeLookaheadMs },
 					...e.log === void 0 ? {} : { log: e.log }
 				}), f++ % 60 == 0) {
-					let t = await el(e.store, { firedOlderThan: new Date(Date.now() - d) });
+					let t = await rl(e.store, { firedOlderThan: new Date(Date.now() - d) });
 					t > 0 && e.log?.info("orchestrator: pruned fired wakeups", { count: t });
 				}
 			} catch (t) {
@@ -6451,14 +6468,14 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			l = !0, u !== void 0 && clearTimeout(u), await new Promise((e) => s.close(() => e()));
 		}
 	};
-}, Nu = (e) => e, Pu = class extends R.TaggedError()("AnalyticsError", {
+}, Iu = (e) => e, Lu = class extends R.TaggedError()("AnalyticsError", {
 	provider: R.String,
 	operation: R.String,
 	cause: R.String
-}) {}, Fu = class extends R.TaggedError()("AnalyticsCapabilityNotSupported", {
+}) {}, Ru = class extends R.TaggedError()("AnalyticsCapabilityNotSupported", {
 	provider: R.String,
 	capability: R.String
-}) {}, Iu = class extends Ge.Tag("@voltro/AnalyticsSink")() {}, Lu = (e, t) => ({
+}) {}, zu = class extends Ge.Tag("@voltro/AnalyticsSink")() {}, Bu = (e, t) => ({
 	info: e.info,
 	track: (n) => e.track(n.tenantId === void 0 ? {
 		...n,
@@ -6477,20 +6494,20 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		tenantId: t
 	} : n),
 	...e.mirror === void 0 ? {} : { mirror: e.mirror }
-}), Ru = () => P.gen(function* () {
-	let e = yield* Iu, t = yield* P.serviceOption(ke), n = tt.match(t, {
+}), Vu = () => P.gen(function* () {
+	let e = yield* zu, t = yield* P.serviceOption(ke), n = tt.match(t, {
 		onNone: () => null,
 		onSome: (e) => e.tenantId ?? null
 	});
-	return n === null ? e : Lu(e, n);
-}), zu = "noop", Bu = () => {
-	let e = (e) => P.fail(new Fu({
-		provider: zu,
+	return n === null ? e : Bu(e, n);
+}), Hu = "noop", Uu = () => {
+	let e = (e) => P.fail(new Ru({
+		provider: Hu,
 		capability: e
 	}));
 	return {
 		info: {
-			provider: zu,
+			provider: Hu,
 			capabilities: {
 				track: !0,
 				aggregate: !1,
@@ -6504,8 +6521,8 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		timeseries: () => e("timeseries"),
 		topN: () => e("topN")
 	};
-}, Vu = (e) => {
-	if (e.length === 0) return Bu();
+}, Wu = (e) => {
+	if (e.length === 0) return Uu();
 	if (e.length === 1) return e[0];
 	let t = {
 		provider: "compose",
@@ -6522,7 +6539,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		discard: !0
 	}), r = (t, n) => {
 		let r = e.find((e) => e.info.capabilities[t]);
-		return r === void 0 ? P.fail(new Fu({
+		return r === void 0 ? P.fail(new Ru({
 			provider: "compose",
 			capability: t
 		})) : n(r);
@@ -6545,11 +6562,11 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		topN: (e) => r("topN", (t) => t.topN(e)),
 		...a === void 0 ? {} : { mirror: a }
 	};
-}, Hu = (e) => {
+}, Gu = (e) => {
 	let t = e.filter((e) => e.dispose !== void 0);
 	return {
 		kind: "compose",
-		build: (t) => Vu(e.map((e) => e.build(t))),
+		build: (t) => Wu(e.map((e) => e.build(t))),
 		tables: e.flatMap((e) => e.tables ?? []),
 		initialize: (t) => P.forEach(e, (e) => e.initialize ? e.initialize(t) : P.void, {
 			concurrency: 1,
@@ -6560,15 +6577,15 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			discard: !0
 		}) } : {}
 	};
-}, Uu = {
+}, Ku = {
 	kind: "noop",
-	build: () => Bu()
-}, Wu = {
+	build: () => Uu()
+}, qu = {
 	tables: [],
 	detach: () => {}
-}, Gu = (e) => {
+}, Ju = (e) => {
 	let { store: t, sink: n, log: r } = e, i = n.mirror;
-	if (i === void 0 || i.tables.length === 0) return Wu;
+	if (i === void 0 || i.tables.length === 0) return qu;
 	let a = e.run ?? ((e) => P.runPromise(e)), o = i.primaryKey ?? "id", s = new Set(i.tables), c = (e) => {
 		if (e.op === "delete") {
 			let t = e.old;
@@ -6592,11 +6609,11 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		tables: i.tables,
 		detach: l
 	};
-}, Ku = (e) => {
+}, Yu = (e) => {
 	let t = typeof e.refresh == "string" ? { interval: e.refresh } : e.refresh, n = e.strategy ?? "replace";
 	if (n === "merge" && (e.mergeKey === void 0 || e.mergeKey.length === 0)) throw Error(`defineAggregate("${e.name}"): strategy: 'merge' requires mergeKey — the property on each row to upsert by`);
 	if (e.incremental !== void 0) {
-		let t = Zl({
+		let t = eu({
 			aggregations: [{
 				op: e.incremental.op,
 				...e.incremental.column === void 0 ? {} : { column: e.incremental.column }
@@ -6618,47 +6635,47 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		build: e.build,
 		...e.incremental === void 0 ? {} : { incremental: e.incremental }
 	};
-}, qu = (e) => typeof e == "object" && !!e && e._voltroAggregate === !0, Ju = class extends R.TaggedError()("AggregateStale", {
+}, Xu = (e) => typeof e == "object" && !!e && e._voltroAggregate === !0, Zu = class extends R.TaggedError()("AggregateStale", {
 	name: R.String,
 	ageMs: R.Number,
 	maxAgeMs: R.Number
-}) {}, Yu = class extends R.TaggedError()("AggregateNotFound", { name: R.String }) {}, Xu = class extends R.TaggedError()("AggregateError", {
+}) {}, Qu = class extends R.TaggedError()("AggregateNotFound", { name: R.String }) {}, $u = class extends R.TaggedError()("AggregateError", {
 	name: R.String,
 	operation: R.String,
 	cause: R.String
-}) {}, Zu = class extends Ge.Tag("@voltro/AggregateRegistry")() {}, Qu = (e) => P.gen(function* () {
-	return (yield* Zu).getHandle(e);
-}), $u = (e, n, r) => {
+}) {}, ed = class extends Ge.Tag("@voltro/AggregateRegistry")() {}, td = (e) => P.gen(function* () {
+	return (yield* ed).getHandle(e);
+}), nd = (e, n, r) => {
 	if (e.crossTenant || !n.has(e.table) || r == null) return e;
 	let i = u("tenantId", r);
 	return {
 		...e,
 		predicate: e.predicate ? t(e.predicate, i) : i
 	};
-}, ed = (e, t, n) => n === "" && !e.crossTenant && t.has(e.table), td = (e) => e?.type === "user" && e.tenantId === "", nd = (e, n) => {
+}, rd = (e, t, n) => n === "" && !e.crossTenant && t.has(e.table), id = (e) => e?.type === "user" && e.tenantId === "", ad = (e, n) => {
 	if (e.includeDeleted || !n.has(e.table)) return e;
 	let r = S("deletedAt");
 	return {
 		...e,
 		predicate: e.predicate ? t(e.predicate, r) : r
 	};
-}, rd = (e, t) => t, id = (e) => P.runPromiseExit(e).then((e) => {
+}, od = (e, t) => t, sd = (e) => P.runPromiseExit(e).then((e) => {
 	if (Xe.isSuccess(e)) return e.value;
 	let t = N.failureOption(e.cause);
 	throw tt.isSome(t) ? t.value : N.squash(e.cause);
-}), ad = (e, t) => e.pipe(P.provideService(ke, t)), od = async (e, t, n) => {
+}), cd = (e, t) => e.pipe(P.provideService(ke, t)), ld = async (e, t, n) => {
 	let r = await P.runPromise(Pe(t, e.guards, n));
 	if (r) throw r;
-}, sd = async (e) => {
+}, ud = async (e) => {
 	if (Bn() === void 0) return e;
-	let t = await id(Hn(e.subject, (e) => {
+	let t = await sd(Hn(e.subject, (e) => {
 		console.error("[voltro] row filter failed to load", e);
 	}));
 	return {
 		...e,
 		rowFilter: t
 	};
-}, cd = async (e) => {
+}, dd = async (e) => {
 	let t = `${e.kind}.${e.name}`, n = Date.now(), r = "ok";
 	try {
 		if (e.interceptor) {
@@ -6687,28 +6704,28 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			status: r
 		});
 	}
-}, ld = /* @__PURE__ */ new Set([1213, 1205]), ud = /* @__PURE__ */ new Set([
+}, fd = /* @__PURE__ */ new Set([1213, 1205]), pd = /* @__PURE__ */ new Set([
 	"ER_LOCK_DEADLOCK",
 	"ER_LOCK_WAIT_TIMEOUT",
 	"40001",
 	"40P01"
-]), dd = (e) => {
+]), md = (e) => {
 	let t = e;
 	for (let e = 0; e < 6 && typeof t == "object" && t; e++) {
 		let e = t;
-		if (typeof e.errno == "number" && ld.has(e.errno) || typeof e.code == "string" && ud.has(e.code) || typeof e.sqlState == "string" && ud.has(e.sqlState)) return !0;
+		if (typeof e.errno == "number" && fd.has(e.errno) || typeof e.code == "string" && pd.has(e.code) || typeof e.sqlState == "string" && pd.has(e.sqlState)) return !0;
 		t = e.cause;
 	}
 	return !1;
-}, fd = 3, pd = (e) => new Promise((t) => setTimeout(t, e)), md = async (e, t) => {
-	let n = t?.delay ?? ((e) => pd(e * 20 + Math.floor(Math.random() * 30)));
+}, hd = 3, gd = (e) => new Promise((t) => setTimeout(t, e)), _d = async (e, t) => {
+	let n = t?.delay ?? ((e) => gd(e * 20 + Math.floor(Math.random() * 30)));
 	for (let t = 1;; t++) try {
 		return await e();
 	} catch (e) {
-		if (t >= fd || !dd(e)) throw e;
+		if (t >= hd || !md(e)) throw e;
 		await n(t);
 	}
-}, hd = (e) => (t, n, r) => cd({
+}, vd = (e) => (t, n, r) => dd({
 	name: t.descriptor.name,
 	kind: "mutation",
 	input: n,
@@ -6716,11 +6733,11 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	...e.interceptor ? { interceptor: e.interceptor } : {},
 	...e.recordMetric ? { recordMetric: e.recordMetric } : {},
 	runExecutor: async () => {
-		await od(t.descriptor, r.subject, n);
-		let i = await sd(r), a = [], o = await md(async () => (a.length = 0, e.store.transactional(async (o) => {
+		await ld(t.descriptor, r.subject, n);
+		let i = await ud(r), a = [], o = await _d(async () => (a.length = 0, e.store.transactional(async (o) => {
 			let s = e.undoCapture?.(o), c = s ? s.tx : o, l = e.buildContext(i, c, { afterCommit: (e) => {
 				a.push(e);
-			} }), u = t.executor(n, l), d = P.isEffect(u) ? await e.runEffect(ad(u, r.subject), l.store) : await u;
+			} }), u = t.executor(n, l), d = P.isEffect(u) ? await e.runEffect(cd(u, r.subject), l.store) : await u;
 			return s && await s.persist(l.store, {
 				tag: t.descriptor.name,
 				subject: r.subject,
@@ -6730,30 +6747,30 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		for (let e of a) await e();
 		return o;
 	}
-}), gd = (e) => e && typeof e == "object" && "descriptor" in e ? e.descriptor : e, _d = (e) => typeof e == "object" && !!e && !Array.isArray(e) && "table" in e && "order" in e, vd = (e) => {
+}), yd = (e) => e && typeof e == "object" && "descriptor" in e ? e.descriptor : e, bd = (e) => typeof e == "object" && !!e && !Array.isArray(e) && "table" in e && "order" in e, xd = (e) => {
 	let t = e.descriptor.source;
 	return t == null ? [] : typeof t == "string" ? [t] : [...t];
-}, yd = (e, t) => (n) => () => {
+}, Sd = (e, t) => (n) => () => {
 	let r = e.descriptor.guards;
 	return !r || r.length === 0 ? Promise.resolve(null) : P.runPromise(Pe(n, r, t));
-}, bd = (e) => (t, n) => (r) => {
-	let i = e.buildContext(r), a = yd(t, n)(r.subject), o = async () => {
+}, Cd = (e) => (t, n) => (r) => {
+	let i = e.buildContext(r), a = Sd(t, n)(r.subject), o = async () => {
 		let i = await a();
 		if (i) throw i;
-		let o = e.buildContext(await sd(r)), s = t.executor(n, o);
-		return P.isEffect(s) ? P.runPromise(e.provideEffect(ad(s, r.subject), o.store)) : gd(await Promise.resolve(s));
+		let o = e.buildContext(await ud(r)), s = t.executor(n, o);
+		return P.isEffect(s) ? P.runPromise(e.provideEffect(cd(s, r.subject), o.store)) : yd(await Promise.resolve(s));
 	}, s = (n) => {
-		let i = gd(n);
-		return _d(i) ? e.finalize(i, r) : {
+		let i = yd(n);
+		return bd(i) ? e.finalize(i, r) : {
 			__voltroComputed: !0,
 			value: i,
-			dependentTables: vd(t),
+			dependentTables: xd(t),
 			tenantId: r.subject?.tenantId ?? null,
 			recompute: o
 		};
 	}, c = () => {
 		let a = t.executor(n, i);
-		return P.isEffect(a) ? e.provideEffect(ad(a, r.subject), i.store).pipe(P.map(s)) : a instanceof Promise ? P.promise(() => a).pipe(P.map(s)) : s(a);
+		return P.isEffect(a) ? e.provideEffect(cd(a, r.subject), i.store).pipe(P.map(s)) : a instanceof Promise ? P.promise(() => a).pipe(P.map(s)) : s(a);
 	}, l = () => {
 		let e = t.descriptor.guards;
 		return !e || e.length === 0 ? c() : Pe(r.subject, e, n).pipe(P.flatMap((e) => {
@@ -6775,14 +6792,14 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		traceId: r.traceId,
 		...r.spanId === void 0 ? {} : { spanId: r.spanId }
 	});
-}, xd = (e) => async (t, n, r) => {
-	let i = await sd(r), a = bd(e)(t, n)(i), o = P.isEffect(a) ? await id(a) : a;
+}, wd = (e) => async (t, n, r) => {
+	let i = await ud(r), a = Cd(e)(t, n)(i), o = P.isEffect(a) ? await sd(a) : a;
 	return Qn(o) ? o.value : e.queryRows(o);
-}, Sd = (e) => (t, n, r, i) => {
+}, Td = (e) => (t, n, r, i) => {
 	let a = !1, o;
 	return (async () => {
 		try {
-			let s = await sd(r), c = bd(e)(t, n)(s), l = P.isEffect(c) ? await id(c) : c, u = (e) => i(e), d = Qn(l) ? await e.subscribeComputed(l, u, s) : await e.subscribeDescriptor(l, u, s);
+			let s = await ud(r), c = Cd(e)(t, n)(s), l = P.isEffect(c) ? await sd(c) : c, u = (e) => i(e), d = Qn(l) ? await e.subscribeComputed(l, u, s) : await e.subscribeDescriptor(l, u, s);
 			a ? d() : o = d;
 		} catch (e) {
 			i({
@@ -6793,7 +6810,7 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	})(), () => {
 		a = !0, o?.();
 	};
-}, Cd = (e) => (t, n, r) => cd({
+}, Ed = (e) => (t, n, r) => dd({
 	name: t.descriptor.name,
 	kind: "action",
 	input: n,
@@ -6801,16 +6818,16 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	...e.interceptor ? { interceptor: e.interceptor } : {},
 	...e.recordMetric ? { recordMetric: e.recordMetric } : {},
 	runExecutor: async () => {
-		await od(t.descriptor, r.subject, n);
-		let i = e.buildContext(await sd(r)), a = t.executor(n, i);
-		return P.isEffect(a) ? e.runEffect(ad(a, r.subject), i.store) : a;
+		await ld(t.descriptor, r.subject, n);
+		let i = e.buildContext(await ud(r)), a = t.executor(n, i);
+		return P.isEffect(a) ? e.runEffect(cd(a, r.subject), i.store) : a;
 	}
-}), wd = (e) => e instanceof Date ? e.toISOString() : typeof e == "string" && e.length > 0 ? e : null, Td = (e) => typeof e == "string" && e.length > 0 ? e : null, Ed = [
+}), Dd = (e) => e instanceof Date ? e.toISOString() : typeof e == "string" && e.length > 0 ? e : null, Od = (e) => typeof e == "string" && e.length > 0 ? e : null, kd = [
 	"updatedAt",
 	"createdAt",
 	"updatedBy",
 	"createdBy"
-], Dd = (e) => Ed.some((t) => t in e), Od = (e, t, n) => {
+], Ad = (e) => kd.some((t) => t in e), jd = (e, t, n) => {
 	let r = {
 		table: t.table,
 		id: t.id,
@@ -6825,14 +6842,14 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		found: !1
 	};
 	let i = t.column === void 0 ? void 0 : e[t.column];
-	if (!Dd(e)) return {
+	if (!Ad(e)) return {
 		...r,
 		value: i,
 		lastWrite: null,
 		attribution: "none",
 		found: !0
 	};
-	let a = Td(e.updatedBy) ?? Td(e.createdBy), o = wd(e.updatedAt) ?? wd(e.createdAt);
+	let a = Od(e.updatedBy) ?? Od(e.createdBy), o = Dd(e.updatedAt) ?? Dd(e.createdAt);
 	return {
 		...r,
 		value: i,
@@ -6844,12 +6861,12 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		attribution: "audit",
 		found: !0
 	};
-}, kd = (e, t) => {
+}, Md = (e, t) => {
 	let n = e.map((e) => {
 		let n = e.newValue ?? e.value, r = t.column !== void 0 && n && typeof n == "object" ? n[t.column] : e.newValue ?? e.value;
 		return {
-			actor: { id: Td(e.actor) ?? Td(e.changedBy) },
-			at: wd(e.at) ?? wd(e.changedAt),
+			actor: { id: Od(e.actor) ?? Od(e.changedBy) },
+			at: Dd(e.at) ?? Dd(e.changedAt),
 			...e.traceId === void 0 ? {} : { traceId: e.traceId },
 			value: r
 		};
@@ -6864,12 +6881,12 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 		history: n,
 		found: n.length > 0
 	};
-}, Ad = (e) => {
+}, Nd = (e) => {
 	let t = e.new?.id;
 	if (typeof t == "string") return t;
 	let n = e.old?.id;
 	return typeof n == "string" ? n : void 0;
-}, jd = (e) => {
+}, Pd = (e) => {
 	let t = {};
 	if (e.op === "insert") for (let [n, r] of Object.entries(e.new ?? {})) t[n] = {
 		from: void 0,
@@ -6889,11 +6906,11 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 	return {
 		table: e.table,
 		op: e.op,
-		id: Ad(e),
+		id: Nd(e),
 		fields: t
 	};
-}, Md = (e) => {
-	let t = e.map(jd);
+}, Fd = (e) => {
+	let t = e.map(Pd);
 	return {
 		rows: t,
 		summary: {
@@ -6902,21 +6919,21 @@ var q = /* @__PURE__ */ new Map(), cr = (e, t) => {
 			deletes: t.filter((e) => e.op === "delete").length
 		}
 	};
-}, Nd = class extends Error {
+}, Id = class extends Error {
 	constructor() {
 		super("voltro:preview-rollback"), this.name = "PreviewRollback";
 	}
-}, Pd = async (e, t) => {
+}, Ld = async (e, t) => {
 	let n, r = !1;
 	try {
 		await e.transactional(async (e) => {
-			throw n = await t(e), r = !0, new Nd();
+			throw n = await t(e), r = !0, new Id();
 		});
 	} catch (e) {
-		if (!(e instanceof Nd)) throw e;
+		if (!(e instanceof Id)) throw e;
 	}
 	if (!r) throw Error("preview: handler did not complete");
 	return n;
-}, Fd = "framework-runtime";
+}, Rd = "framework-runtime";
 //#endregion
-export { ra as API_KEYS_TABLE, hs as AccessDenied, Xu as AggregateError, au as AggregateMaintainer, Yu as AggregateNotFound, Zu as AggregateRegistry, Ju as AggregateStale, Fu as AnalyticsCapabilityNotSupported, Pu as AnalyticsError, Iu as AnalyticsSink, X as CONNECTIONS_TABLE, mo as CONNECTION_GRANTS_TABLE, Ec as CircuitBreaker, wc as CircuitOpen, Lo as ConnectionNotConnected, ci as DEFAULT_MAX_RPC_BODY_BYTES, Fo as DEFAULT_REFRESH_SKEW_MS, Ln as DEFAULT_ROW_FILTER_RETRY, nl as DORMANCY_WAKEUP_TENANT, ic as DeleteBuilder, Yn as Dispatcher, xa as EffectStore, Yo as GRANT_TTL_MS, Qt as InMemoryDataStore, Bt as IndexedMatcher, Nt as LinearScanMatcher, $e as MetricBoundaries, zu as NOOP_ANALYTICS_PROVIDER, Vn as NO_ROW_FILTER, Zs as NoRowFound, Qa as OUTBOX_ATTEMPTS_TABLE, ao as OUTBOX_ATTEMPT_LOG_CAP, Y as OUTBOX_TABLE, Qs as OptimisticLockError, ms as REBAC_ADMIN_SCOPE, Io as REFRESH_LEASE_MS, Fd as RUNTIME_NAME, hu as ReactionRateLimiter, kr as ReplicatedDataStore, In as RowFilterUnavailable, tl as SCHEDULE_SUBJECT, _a as SYSTEM_SUBJECT, nc as SelectBuilder, Is as SsrfBlockedError, ya as StoreOperationFailed, Ut as SubscriptionRegistry, ba as TableValidationFailed, va as TenantScopeViolation, Gl as TimelineRecorder, wl as UndoBoundaryError, El as UndoStack, rc as UpdateBuilder, Us as VOLTRO_AUDIT_MIXIN_ID, Ws as VOLTRO_SOFT_DELETE_MIXIN_ID, Gs as VOLTRO_TENANT_MIXIN_ID, ja as WorkflowPayloadError, ur as _connectionStreamCount, dr as _resetConnectionSubjectsForTest, go as _voltroConnectionGrantsTable, po as _voltroConnectionsTable, ou as _voltroRebacTuplesTable, pl as _voltroScheduleClaimsTable, fl as _voltroScheduleRunsTable, ml as _voltroTracesTable, hl as _voltroUndoLogTable, _u as _voltroWakeupsTable, qa as _voltroWorkflowEventDeliveriesTable, Ka as _voltroWorkflowEventsTable, ga as apiKeyManagementRoutes, cc as applyDefined, ru as applyDelta, Ol as applyInverse, kl as applyInverses, Gn as applyRowFilter, Kn as applyRowFilterToDescriptor, nd as applySoftDeleteScope, $u as applyTenantScope, Ll as applyUndoInvocation, Ts as assertCan, bo as assertConnectionCipherConfigured, Gu as attachAnalyticsMirror, pi as awaitServerListening, io as backoffMs, $o as beginOAuthConnect, rr as bindConnectionSubject, si as bindMutation, $r as bindStream, Qr as bindSubscription, Xr as bindSubscriptionUntyped, tu as buildIvmState, Md as buildPreview, lu as buildRebacInterceptor, du as buildRebacReadFilter, Cr as buildSubjectKey, vi as buildTracingLayer, Ni as cachedBackend, ws as can, Wc as cancelWakeup, Zl as classifyShape, Vo as clearConnectionRefreshFlights, bs as clearResourcePolicies, i as clearRetentions, kc as clearSystemStoreHandle, zc as compileCron, es as completeOAuthConnect, Hu as composeAnalytics, Vu as composeAnalyticsSinks, Xo as connectionCallbackPath, yo as connectionLabel, fr as connectionSubjectsSnapshot, Au as countRunningWorkflows, An as counter, yc as crud, Or as currentRoutingContext, yr as currentTraceContext, pa as dataStoreApiKeyStore, Yi as dataStoreIdempotencyStore, ea as dataStoreKvStore, Wi as decryptField, Ku as defineAggregate, vo as defineConnection, Va as defineEventTrigger, rd as defineExecutor, to as defineOutboxHandler, fu as defineReaction, _s as defineResourcePolicy, Rc as defineSchedule, Nu as defineSubscriber, qn as deliveredRowCount, Ii as deriveKey, jd as diffChange, lo as drainOutbox, Zc as dueWakeups, Cs as effectiveRelations, Xs as emptySchemaRegistry, Ir as enableGraphObservation, Ui as encryptField, Di as envSecretsBackend, No as exchangeAuthorizationCode, gr as externalSpanFromTraceparent, en as extractDbCause, Ht as fingerprintFor, ko as forgetCredential, Cc as formatServerOnlyLeaks, mr as formatTraceparent, Dl as forwardChangeFromCdc, ma as frameworkApiKeyStrategy, jn as gauge, aa as generateApiKeyToken, is as getConnectionResolver, ir as getConnectionSubject, Vi as getFieldCipher, vs as getResourcePolicy, Bn as getRowFilter, Ac as getSystemStoreHandle, ql as getTimelineRecorder, js as getTupleSource, $ as groupKeyOf, Mn as histogramMetric, kd as historyProvenance, Pi as httpSecretsBackend, jt as inspectWorkflow, Ms as installPolicyGuardResolver, lr as interruptConnectionStreams, Sl as invertChange, qu as isAggregateDefinition, ed as isEmptyTenantScopedRead, tn as isForeignKeyViolation, Cu as isIdleNow, ii as isInfraError, Lr as isObservingGraph, td as isOrglessUserSubject, Tl as isSafeToApply, Ic as isScheduleDefinition, Ha as isWorkflowEventTriggerDefinition, eu as ivmValue, Od as lastWriteProvenance, Ao as listConnectionStates, ys as listResourcePolicies, w as listRetentions, su as loadResourceTuples, uu as loadSubjectTuples, Mc as localityAwareSelector, Cd as makeActionRunner, al as makeAdvisoryLockCoordinator, Li as makeAesCipher, ca as makeApiKeyService, Hs as makeApiKeyUsageBuffer, fa as makeApiKeyUsageFlusher, nn as makeAppAccess, ta as makeAsyncKv, Ei as makeBufferingSpanProcessor, xo as makeConnectionRegistry, os as makeConnectionResolver, ss as makeConnectionsFacade, dl as makeCoordinatedScheduler, Ps as makeDataLoader, ps as makeDisconnectConnectionExecutor, wa as makeEffectStoreLayer, Ja as makeEventsFacade, Ri as makeFieldCipher, ac as makeFluentStore, wu as makeIdleGate, La as makeLazyWorkflowFacade, us as makeListConnectionsExecutor, hd as makeMutationRunner, xd as makeOneShotQueryRunner, ro as makeOutboxFacade, Fa as makePostCommitWorkflowFacade, bu as makeProcessAdapter, bd as makeQueryDescriptorProducer, yd as makeQueryReauthorizer, Sd as makeQuerySubscriber, Tu as makeRouterActivity, Ks as makeSchemaRegistry, ds as makeStartConnectionExecutor, fs as makeSubmitTokenExecutor, bl as makeUndoCapture, Eu as makeWakeGate, ku as makeWakeProxyServer, Pa as makeWorkflowFacade, Ia as makeWorkflowFacadeWithCallerContext, Ra as makeWorkflowHandlers, za as makeWorkflowLayers, Da as makeWorkflowRunHandle, Gc as markWakeupFired, nu as materializeIvm, la as memoryApiKeyStore, Pc as memoryReplicationAdapter, Sr as memoryRywPositionStore, Bc as nextFiring, Qc as nextWakeup, Su as nodeProcessSupervisor, Bu as noopAnalytics, Uu as noopAnalyticsSpec, na as noopKv, Hr as observeStore, Br as observedGraph, or as onBindConnectionSubject, eo as outboxAttemptsTable, Za as outboxTable, hr as parseTraceparent, Ma as payloadPropertyNames, br as powerOfTwoSelector, Pd as previewInRollback, To as projectConnectionState, el as pruneWakeups, xs as rebacPolicyGraph, En as recordSample, G as recordSubscriptionActive, On as recordSubscriptionDelivery, zr as recordTableAccess, Yl as recordTimelineEvent, hc as redactColumns, Hl as redactRow, wr as redisRywPositionStore, Rl as redoUndoInvocation, Po as refreshAccessToken, cr as registerConnectionStream, oe as registerRetention, Uc as registerWakeup, Jc as releaseWakeup, xr as replicaHealth, Vr as resetObservedGraph, Ai as resetSecretsBackend, Wo as resolveConnection, as as resolveConnectionForSubject, Nc as resolveCurrentRegion, rn as resolveDependentTables, Qo as resolveRedirectUri, iu as resolveRescan, Hn as resolveRowFilterScope, Un as resolveRowFilterScopeFor, ji as resolveSecret, Mi as resolveSecretSync, Fi as resolveSecretsBackend, zl as resolveTimelineMode, se as retentionTtlMsFromEnv, Wl as reverseEventOverRows, Ds as revokedIds, jc as runAsSystem, ju as runOrchestratorTick, id as runProvidedEffect, gu as runReaction, Mu as runSingleNodeOrchestrator, yu as runWakeLoop, md as runWithDeadlockRetry, Rr as runWithObservedProcedure, Dr as runWithRoutingContext, vr as runWithTraceContext, Zo as sanitizeRedirectTo, ul as scheduleCoordinated, bc as schemaPropertyNames, Sc as serverOnlyLeaks, rs as setConnectionResolver, Bi as setFieldCipher, zn as setRowFilter, ki as setSecretsBackend, Oc as setSystemStoreHandle, Jl as setTimelineRecorderForTest, As as setTupleSource, ia as sha256Hex, rl as singleCoordinator, Pn as snapshotMetrics, Fn as snapshotMetricsSync, Vs as ssrfGuardHttpClientLayer, Bs as ssrfReason, li as startRpcServer, sl as startScheduler, Do as storeCredential, ts as sweepExpiredGrants, de as sweepRetention, Cl as synthesizeInverse, Fs as tracingHttpClientLayer, Ba as triggerWorkflow, qc as tryClaimWakeup, ar as unbindConnectionSubject, gl as undoCaptureEnabled, Fl as undoLogExecutor, Qu as useAggregate, Ru as useAnalytics, Es as visibleRows, vu as wakeDueOnce, sd as withRowFilter, Ta as workflowToRpc, yl as wrapCaptureStore, fc as wrapStoreWithMixinBehaviour };
+export { oa as API_KEYS_TABLE, vs as AccessDenied, $u as AggregateError, cu as AggregateMaintainer, Qu as AggregateNotFound, ed as AggregateRegistry, Zu as AggregateStale, Ru as AnalyticsCapabilityNotSupported, Lu as AnalyticsError, zu as AnalyticsSink, X as CONNECTIONS_TABLE, _o as CONNECTION_GRANTS_TABLE, kc as CircuitBreaker, Dc as CircuitOpen, Bo as ConnectionNotConnected, di as DEFAULT_MAX_RPC_BODY_BYTES, Ro as DEFAULT_REFRESH_SKEW_MS, Ln as DEFAULT_ROW_FILTER_RETRY, al as DORMANCY_WAKEUP_TENANT, sc as DeleteBuilder, Yn as Dispatcher, wa as EffectStore, Qo as GRANT_TTL_MS, Qt as InMemoryDataStore, Bt as IndexedMatcher, Nt as LinearScanMatcher, $e as MetricBoundaries, Hu as NOOP_ANALYTICS_PROVIDER, Vn as NO_ROW_FILTER, ec as NoRowFound, to as OUTBOX_ATTEMPTS_TABLE, co as OUTBOX_ATTEMPT_LOG_CAP, Y as OUTBOX_TABLE, tc as OptimisticLockError, _s as REBAC_ADMIN_SCOPE, zo as REFRESH_LEASE_MS, Rd as RUNTIME_NAME, vu as ReactionRateLimiter, kr as ReplicatedDataStore, In as RowFilterUnavailable, il as SCHEDULE_SUBJECT, ba as SYSTEM_SUBJECT, ac as SelectBuilder, zs as SsrfBlockedError, Sa as StoreOperationFailed, Ut as SubscriptionRegistry, Ca as TableValidationFailed, xa as TenantScopeViolation, Jl as TimelineRecorder, Dl as UndoBoundaryError, kl as UndoStack, oc as UpdateBuilder, Ks as VOLTRO_AUDIT_MIXIN_ID, qs as VOLTRO_SOFT_DELETE_MIXIN_ID, Js as VOLTRO_TENANT_MIXIN_ID, Pa as WorkflowPayloadError, ur as _connectionStreamCount, dr as _resetConnectionSubjectsForTest, yo as _voltroConnectionGrantsTable, go as _voltroConnectionsTable, lu as _voltroRebacTuplesTable, gl as _voltroScheduleClaimsTable, hl as _voltroScheduleRunsTable, _l as _voltroTracesTable, vl as _voltroUndoLogTable, bu as _voltroWakeupsTable, Xa as _voltroWorkflowEventDeliveriesTable, Ya as _voltroWorkflowEventsTable, ya as apiKeyManagementRoutes, dc as applyDefined, ou as applyDelta, jl as applyInverse, Ml as applyInverses, Gn as applyRowFilter, Kn as applyRowFilterToDescriptor, ad as applySoftDeleteScope, nd as applyTenantScope, Bl as applyUndoInvocation, Os as assertCan, Co as assertConnectionCipherConfigured, Ju as attachAnalyticsMirror, gi as awaitServerListening, so as backoffMs, ns as beginOAuthConnect, rr as bindConnectionSubject, ui as bindMutation, ni as bindStream, ti as bindSubscription, Xr as bindSubscriptionUntyped, iu as buildIvmState, Fd as buildPreview, fu as buildRebacInterceptor, mu as buildRebacReadFilter, Cr as buildSubjectKey, xi as buildTracingLayer, Ii as cachedBackend, Ds as can, qc as cancelWakeup, eu as classifyShape, Wo as clearConnectionRefreshFlights, Cs as clearResourcePolicies, i as clearRetentions, Mc as clearSystemStoreHandle, Hc as compileCron, rs as completeOAuthConnect, Gu as composeAnalytics, Wu as composeAnalyticsSinks, $o as connectionCallbackPath, So as connectionLabel, fr as connectionSubjectsSnapshot, Nu as countRunningWorkflows, An as counter, Sc as crud, Or as currentRoutingContext, yr as currentTraceContext, ga as dataStoreApiKeyStore, Qi as dataStoreIdempotencyStore, ra as dataStoreKvStore, qi as decryptField, Yu as defineAggregate, xo as defineConnection, Wa as defineEventTrigger, od as defineExecutor, io as defineOutboxHandler, hu as defineReaction, bs as defineResourcePolicy, Vc as defineSchedule, Iu as defineSubscriber, qn as deliveredRowCount, zi as deriveKey, Pd as diffChange, po as drainOutbox, el as dueWakeups, Es as effectiveRelations, $s as emptySchemaRegistry, Ir as enableGraphObservation, Ki as encryptField, Ai as envSecretsBackend, Io as exchangeAuthorizationCode, gr as externalSpanFromTraceparent, en as extractDbCause, Ht as fingerprintFor, Mo as forgetCredential, Ec as formatServerOnlyLeaks, mr as formatTraceparent, Al as forwardChangeFromCdc, _a as frameworkApiKeyStrategy, jn as gauge, ca as generateApiKeyToken, ss as getConnectionResolver, ir as getConnectionSubject, Wi as getFieldCipher, xs as getResourcePolicy, Bn as getRowFilter, Nc as getSystemStoreHandle, Xl as getTimelineRecorder, Ps as getTupleSource, $ as groupKeyOf, Mn as histogramMetric, Md as historyProvenance, Li as httpSecretsBackend, jt as inspectWorkflow, Fs as installPolicyGuardResolver, lr as interruptConnectionStreams, Tl as invertChange, Xu as isAggregateDefinition, rd as isEmptyTenantScopedRead, tn as isForeignKeyViolation, Eu as isIdleNow, si as isInfraError, Lr as isObservingGraph, id as isOrglessUserSubject, Ol as isSafeToApply, zc as isScheduleDefinition, Ga as isWorkflowEventTriggerDefinition, ru as ivmValue, jd as lastWriteProvenance, No as listConnectionStates, Ss as listResourcePolicies, w as listRetentions, uu as loadResourceTuples, pu as loadSubjectTuples, Fc as localityAwareSelector, Ed as makeActionRunner, cl as makeAdvisoryLockCoordinator, Bi as makeAesCipher, da as makeApiKeyService, Gs as makeApiKeyUsageBuffer, ha as makeApiKeyUsageFlusher, nn as makeAppAccess, ia as makeAsyncKv, ki as makeBufferingSpanProcessor, wo as makeConnectionRegistry, ls as makeConnectionResolver, us as makeConnectionsFacade, ml as makeCoordinatedScheduler, Ls as makeDataLoader, gs as makeDisconnectConnectionExecutor, Da as makeEffectStoreLayer, Za as makeEventsFacade, Vi as makeFieldCipher, cc as makeFluentStore, Du as makeIdleGate, Ba as makeLazyWorkflowFacade, ps as makeListConnectionsExecutor, vd as makeMutationRunner, wd as makeOneShotQueryRunner, oo as makeOutboxFacade, Ra as makePostCommitWorkflowFacade, Cu as makeProcessAdapter, Cd as makeQueryDescriptorProducer, Sd as makeQueryReauthorizer, Td as makeQuerySubscriber, Ou as makeRouterActivity, Ys as makeSchemaRegistry, ms as makeStartConnectionExecutor, hs as makeSubmitTokenExecutor, Cl as makeUndoCapture, ku as makeWakeGate, Mu as makeWakeProxyServer, La as makeWorkflowFacade, za as makeWorkflowFacadeWithCallerContext, Va as makeWorkflowHandlers, Ha as makeWorkflowLayers, Aa as makeWorkflowRunHandle, Jc as markWakeupFired, au as materializeIvm, fa as memoryApiKeyStore, Lc as memoryReplicationAdapter, Sr as memoryRywPositionStore, Uc as nextFiring, tl as nextWakeup, Tu as nodeProcessSupervisor, Uu as noopAnalytics, Ku as noopAnalyticsSpec, aa as noopKv, Hr as observeStore, Br as observedGraph, or as onBindConnectionSubject, ro as outboxAttemptsTable, eo as outboxTable, hr as parseTraceparent, Fa as payloadPropertyNames, br as powerOfTwoSelector, Ld as previewInRollback, Oo as projectConnectionState, rl as pruneWakeups, ws as rebacPolicyGraph, En as recordSample, G as recordSubscriptionActive, On as recordSubscriptionDelivery, zr as recordTableAccess, Ql as recordTimelineEvent, vc as redactColumns, Gl as redactRow, wr as redisRywPositionStore, Vl as redoUndoInvocation, Lo as refreshAccessToken, cr as registerConnectionStream, oe as registerRetention, Kc as registerWakeup, Zc as releaseWakeup, xr as replicaHealth, Qr as resetComputedQueryCacheWarnings, Vr as resetObservedGraph, Ni as resetSecretsBackend, qo as resolveConnection, cs as resolveConnectionForSubject, Ic as resolveCurrentRegion, rn as resolveDependentTables, ts as resolveRedirectUri, su as resolveRescan, Hn as resolveRowFilterScope, Un as resolveRowFilterScopeFor, Pi as resolveSecret, Fi as resolveSecretSync, Ri as resolveSecretsBackend, Hl as resolveTimelineMode, se as retentionTtlMsFromEnv, ql as reverseEventOverRows, As as revokedIds, Pc as runAsSystem, Pu as runOrchestratorTick, sd as runProvidedEffect, yu as runReaction, Fu as runSingleNodeOrchestrator, Su as runWakeLoop, _d as runWithDeadlockRetry, Rr as runWithObservedProcedure, Dr as runWithRoutingContext, vr as runWithTraceContext, es as sanitizeRedirectTo, pl as scheduleCoordinated, Cc as schemaPropertyNames, Tc as serverOnlyLeaks, os as setConnectionResolver, Ui as setFieldCipher, zn as setRowFilter, Mi as setSecretsBackend, jc as setSystemStoreHandle, Zl as setTimelineRecorderForTest, Ns as setTupleSource, sa as sha256Hex, ol as singleCoordinator, Pn as snapshotMetrics, Fn as snapshotMetricsSync, Ws as ssrfGuardHttpClientLayer, Us as ssrfReason, fi as startRpcServer, ul as startScheduler, Ao as storeCredential, is as sweepExpiredGrants, de as sweepRetention, El as synthesizeInverse, Rs as tracingHttpClientLayer, Ua as triggerWorkflow, Xc as tryClaimWakeup, ar as unbindConnectionSubject, yl as undoCaptureEnabled, Rl as undoLogExecutor, td as useAggregate, Vu as useAnalytics, ks as visibleRows, xu as wakeDueOnce, ud as withRowFilter, Oa as workflowToRpc, Sl as wrapCaptureStore, hc as wrapStoreWithMixinBehaviour };