@voltro/runtime 0.22.1 → 0.23.0

package/dist/index.js

@@ -1,12 +1,12 @@
-import { ENCRYPTED_PREFIX as e, and as t, attachEagerLoads as n, attributionFields as r, boolean as i, clearRetentions as a, collectSubqueries as o, contains as s, decryptFieldsOnRead as c, deserializeArraysOnRead as l, encryptFieldsForWrite as u, eq as d, evaluatePredicate as f, generateId as p, getRelations as m, getTable as h, gt as g, gte as _, hasEagerLoads as v, id as y, inSet as b, integer as x, isEncrypted as S, isNull as C, isTableReactive as w, json as T, listRetentions as ee, lt as E, lte as te, missingConflictColumns as ne, missingRequiredColumns as re, neq as D, or as ie, queryFor as ae, raiseChangeListenerCeiling as oe, registerRetention as se, requireTable as ce, retentionTtlMsFromEnv as le, runWithWriteAttribution as ue, serializeArraysForWrite as de, serverOnlyColumns as fe, stampGeneratedId as pe, startsWith as me, sweepRetention as he, table as O, text as k, timestamp as A, walkLeaves as ge } from "@voltro/database";
-import { createCipheriv as _e, createDecipheriv as ve, createHash as ye, randomBytes as be, randomUUID as xe, scryptSync as Se } from "node:crypto";
-import { EventEmitter as Ce } from "node:events";
-import { ADMIN_SCOPE as we, APIKEY_ISSUE_ORG_SCOPE as Te, APIKEY_ISSUE_OTHER_SCOPE as Ee, APIKEY_ISSUE_SELF_SCOPE as De, ConnectionHandshakeFailed as j, ConnectionInfo as Oe, ConnectionKindMismatch as ke, ConnectionNotDeclared as Ae, ConnectionSubjectRequired as je, ScopeError as Me, SubjectService as Ne, UndoConflict as Pe, UndoForbidden as Fe, UndoNotFound as Ie, WorkflowRunHandleSchema as Le, checkGuardsEffect as Re, diffRows as ze, effectiveScopes as Be, hasEffectiveScope as Ve, isIdKeyed as He, publishServerError as Ue, requireScope as We, setPolicyGuardResolver as Ge, systemSubject as Ke, tsMs as qe } from "@voltro/protocol";
-import { createLogger as M } from "@voltro/logger";
-import { Cause as N, Clock as Je, Context as Ye, Cron as Xe, Deferred as Ze, Duration as Qe, Effect as P, Either as $e, Exit as et, Fiber as tt, Layer as F, ManagedRuntime as nt, Metric as I, MetricBoundaries as rt, MetricState as it, Option as at, Ref as L, Schedule as ot, Schema as R, Stream as z, Tracer as st } from "effect";
-import * as ct from "node:http";
-import { createServer as lt } from "node:http";
-import { HttpClient as ut, HttpClientRequest as dt, HttpLayerRouter as B, HttpServer as ft, HttpServerRequest as pt, HttpServerResponse as V } from "@effect/platform";
+import { ENCRYPTED_PREFIX as e, and as t, attachEagerLoads as n, attributionFields as r, boolean as i, clearRetentions as a, collectSubqueries as o, contains as s, decryptFieldsOnRead as c, deserializeArraysOnRead as l, encryptFieldsForWrite as u, eq as d, evaluatePredicate as f, generateId as p, getRelations as m, getTable as h, gt as g, gte as _, hasEagerLoads as v, id as y, inSet as ee, integer as b, isEncrypted as x, isNull as S, isTableReactive as C, json as w, listRetentions as te, lt as T, lte as ne, missingConflictColumns as re, missingRequiredColumns as ie, neq as E, or as ae, queryFor as oe, raiseChangeListenerCeiling as se, registerRetention as ce, requireTable as le, retentionTtlMsFromEnv as ue, runWithWriteAttribution as de, serializeArraysForWrite as fe, serverOnlyColumns as pe, stampGeneratedId as me, startsWith as he, sweepRetention as ge, table as D, text as O, timestamp as k, walkLeaves as _e } from "@voltro/database";
+import { createCipheriv as ve, createDecipheriv as ye, createHash as be, randomBytes as xe, randomUUID as Se, scryptSync as Ce } from "node:crypto";
+import { EventEmitter as we } from "node:events";
+import { ADMIN_SCOPE as Te, APIKEY_ISSUE_ORG_SCOPE as Ee, APIKEY_ISSUE_OTHER_SCOPE as De, APIKEY_ISSUE_SELF_SCOPE as Oe, ConnectionHandshakeFailed as A, ConnectionInfo as ke, ConnectionKindMismatch as Ae, ConnectionNotDeclared as je, ConnectionSubjectRequired as Me, ScopeError as Ne, SubjectService as Pe, UndoConflict as Fe, UndoForbidden as Ie, UndoNotFound as Le, WorkflowRunHandleSchema as Re, checkGuardsEffect as ze, diffRows as Be, effectiveScopes as Ve, hasEffectiveScope as He, isIdKeyed as Ue, publishServerError as We, requireScope as Ge, setPolicyGuardResolver as Ke, systemSubject as qe, tsMs as Je } from "@voltro/protocol";
+import { createLogger as j } from "@voltro/logger";
+import { Cause as M, Clock as Ye, Context as Xe, Cron as Ze, Deferred as Qe, Duration as $e, Effect as N, Either as et, Exit as tt, Fiber as nt, Layer as P, ManagedRuntime as rt, Metric as F, MetricBoundaries as it, MetricState as at, Option as ot, Ref as I, Schedule as st, Schema as L, Stream as R, Tracer as ct } from "effect";
+import * as lt from "node:http";
+import { createServer as ut } from "node:http";
+import { HttpClient as z, HttpClientRequest as dt, HttpLayerRouter as B, HttpServer as ft, HttpServerRequest as pt, HttpServerResponse as V } from "@effect/platform";
 import { NodeContext as mt, NodeHttpServer as ht } from "@effect/platform-node";
 import { Rpc as gt, RpcSerialization as _t, RpcServer as vt } from "@effect/rpc";
 import { defineRestRoute as yt, dispatchSharedPath as bt, requireAnyScope as xt, requireScope as St } from "@voltro/protocol/rest";
@@ -61,7 +61,7 @@ var Rt = class {
 	}
 }, zt = (e) => {
 	let t = [];
-	for (let n of ge(e)) n.conjunctive && n.path === void 0 && (n.op === "eq" && t.push({
+	for (let n of _e(e)) n.conjunctive && n.path === void 0 && (n.op === "eq" && t.push({
 		column: n.column,
 		values: [n.value]
 	}), n.op === "in" && t.push({
@@ -71,14 +71,14 @@ var Rt = class {
 	return t;
 }, Bt = (e) => {
 	let t = [];
-	for (let n of ge(e)) n.conjunctive && n.path === void 0 && (n.op === "gt" || n.op === "gte" || n.op === "lt" || n.op === "lte") && t.push({
+	for (let n of _e(e)) n.conjunctive && n.path === void 0 && (n.op === "gt" || n.op === "gte" || n.op === "lt" || n.op === "lte") && t.push({
 		column: n.column,
 		op: n.op,
 		threshold: n.value
 	});
 	return t;
 }, Vt = (e, t) => {
-	for (let n of ge(e)) if (n.conjunctive && n.path === void 0 && n.op === "eq" && n.column === t) return n.value;
+	for (let n of _e(e)) if (n.conjunctive && n.path === void 0 && n.op === "eq" && n.column === t) return n.value;
 	return null;
 }, Ht = (e, t) => {
 	let n = [];
@@ -312,7 +312,7 @@ var Rt = class {
 		predicate: t,
 		indexHint: n ?? null
 	});
-	return ye("sha256").update(JSON.stringify(r)).digest("hex").slice(0, 16);
+	return be("sha256").update(JSON.stringify(r)).digest("hex").slice(0, 16);
 }, Jt = class {
 	matcher;
 	byFingerprint = /* @__PURE__ */ new Map();
@@ -523,7 +523,7 @@ var Rt = class {
 	#e;
 	#t;
 	#n(e) {
-		w(e.table) && this.#t.emit("change", {
+		C(e.table) && this.#t.emit("change", {
 			...r(),
 			...e
 		});
@@ -535,7 +535,7 @@ var Rt = class {
 		return r.#e = t.tables, r.#t = t.emitter, r.#r = t.numericCounters, r;
 	}
 	constructor(e, t = null) {
-		if (this.#i = t, this.#e = /* @__PURE__ */ new Map(), this.#t = new Ce(), oe(this.#t), this.#r = /* @__PURE__ */ new Map(), e) for (let [n, r] of Object.entries(e)) {
+		if (this.#i = t, this.#e = /* @__PURE__ */ new Map(), this.#t = new we(), se(this.#t), this.#r = /* @__PURE__ */ new Map(), e) for (let [n, r] of Object.entries(e)) {
 			let e = /* @__PURE__ */ new Map();
 			for (let t of r) {
 				let n = t.id;
@@ -565,10 +565,10 @@ var Rt = class {
 	}
 	async query(e) {
 		let t = Qt(e, this.#e.get(this.#o(e.table)) ?? /* @__PURE__ */ new Map(), this.#s());
-		return v(e) ? n(t, e.eager, ce(e.table), (e) => this.query(e)) : t;
+		return v(e) ? n(t, e.eager, le(e.table), (e) => this.query(e)) : t;
 	}
 	async insert(e, t) {
-		t = pe(e, t);
+		t = me(e, t);
 		let n = t;
 		if (n.id === void 0) {
 			let r = this.#l(e);
@@ -762,10 +762,10 @@ var Rt = class {
 	}
 	async query(e) {
 		let t = this.buildTablesView(e), r = Qt(e, this.materialise(e.table), t);
-		return v(e) ? n(r, e.eager, ce(e.table), (e) => this.query(e)) : r;
+		return v(e) ? n(r, e.eager, le(e.table), (e) => this.query(e)) : r;
 	}
 	async insert(e, t) {
-		t = pe(e, t);
+		t = me(e, t);
 		let n = t;
 		n.id === void 0 && (n = {
 			...t,
@@ -917,11 +917,11 @@ var Rt = class {
 	let t = e.dbCode;
 	return t === "23503" || e.dbErrno === 1452 || t === 547 || t === "SQLITE_CONSTRAINT_FOREIGNKEY";
 }, cn = (e) => ({
-	has: (t) => Ve(e, t),
-	hasAny: (t) => t.some((t) => Ve(e, t)),
-	require: (t) => We(e, t),
+	has: (t) => He(e, t),
+	hasAny: (t) => t.some((t) => He(e, t)),
+	require: (t) => Ge(e, t),
 	get scopes() {
-		return Be(e);
+		return Ve(e);
 	}
 }), ln = (e) => {
 	let t = /* @__PURE__ */ new Set();
@@ -1014,26 +1014,26 @@ var Rt = class {
 	if (r.has("*")) return !0;
 	for (let e of r) if (n.has(e)) return !0;
 	return !1;
-}, bn = rt.exponential({
+}, bn = it.exponential({
 	start: .001,
 	factor: 2,
 	count: 16
-}), xn = I.counter("voltro_rpc_requests_total", { description: "Total RPC handler invocations." }), Sn = I.counter("voltro_rpc_errors_total", { description: "RPC handler invocations that errored." }), Cn = I.histogram("voltro_rpc_duration_seconds", bn, "RPC handler duration in seconds."), wn = I.counter("voltro_http_requests_total", { description: "Total HTTP route invocations." }), Tn = I.histogram("voltro_http_duration_seconds", bn, "HTTP route duration in seconds."), En = I.histogram("voltro_plugin_hook_duration_seconds", bn, "Plugin interceptor duration in seconds."), Dn = I.counter("voltro_plugin_hook_errors_total", { description: "Plugin interceptor invocations that errored." }), On = I.counter("voltro_subscription_deliveries_total", { description: "Total subscription deliveries (snapshot + delta)." }), kn = I.histogram("voltro_subscription_delivery_seconds", bn, "Subscription delivery produce→push latency in seconds."), An = I.gauge("voltro_subscriptions_active", { description: "Currently-open subscriptions." }), jn = (e) => {
-	let t = e.durationMs / 1e3, n = e.kind === "rpc" ? P.zipRight(I.increment(xn).pipe(P.tagMetrics("tag", e.tag), P.tagMetrics("status", e.status)), P.zipRight(I.update(Cn, t).pipe(P.tagMetrics("tag", e.tag)), e.status === "error" ? I.increment(Sn).pipe(P.tagMetrics("tag", e.tag)) : P.void)) : e.kind === "request" ? P.zipRight(I.increment(wn).pipe(P.tagMetrics("route", e.tag), P.tagMetrics("status", e.status)), I.update(Tn, t).pipe(P.tagMetrics("route", e.tag))) : P.zipRight(I.update(En, t).pipe(P.tagMetrics("hook", e.tag)), e.status === "error" ? I.increment(Dn).pipe(P.tagMetrics("hook", e.tag)) : P.void);
-	P.runSync(n);
+}), xn = F.counter("voltro_rpc_requests_total", { description: "Total RPC handler invocations." }), Sn = F.counter("voltro_rpc_errors_total", { description: "RPC handler invocations that errored." }), Cn = F.histogram("voltro_rpc_duration_seconds", bn, "RPC handler duration in seconds."), wn = F.counter("voltro_http_requests_total", { description: "Total HTTP route invocations." }), Tn = F.histogram("voltro_http_duration_seconds", bn, "HTTP route duration in seconds."), En = F.histogram("voltro_plugin_hook_duration_seconds", bn, "Plugin interceptor duration in seconds."), Dn = F.counter("voltro_plugin_hook_errors_total", { description: "Plugin interceptor invocations that errored." }), On = F.counter("voltro_subscription_deliveries_total", { description: "Total subscription deliveries (snapshot + delta)." }), kn = F.histogram("voltro_subscription_delivery_seconds", bn, "Subscription delivery produce→push latency in seconds."), An = F.gauge("voltro_subscriptions_active", { description: "Currently-open subscriptions." }), jn = (e) => {
+	let t = e.durationMs / 1e3, n = e.kind === "rpc" ? N.zipRight(F.increment(xn).pipe(N.tagMetrics("tag", e.tag), N.tagMetrics("status", e.status)), N.zipRight(F.update(Cn, t).pipe(N.tagMetrics("tag", e.tag)), e.status === "error" ? F.increment(Sn).pipe(N.tagMetrics("tag", e.tag)) : N.void)) : e.kind === "request" ? N.zipRight(F.increment(wn).pipe(N.tagMetrics("route", e.tag), N.tagMetrics("status", e.status)), F.update(Tn, t).pipe(N.tagMetrics("route", e.tag))) : N.zipRight(F.update(En, t).pipe(N.tagMetrics("hook", e.tag)), e.status === "error" ? F.increment(Dn).pipe(N.tagMetrics("hook", e.tag)) : N.void);
+	N.runSync(n);
 }, Mn = (e) => e.startsWith("subscription.") ? e.slice(13) : e, Nn = (e) => {
 	let t = Mn(e.label);
-	P.runSync(P.zipRight(I.increment(On).pipe(P.tagMetrics("tag", t), P.tagMetrics("kind", e.kind)), I.update(kn, e.durationMs / 1e3).pipe(P.tagMetrics("tag", t), P.tagMetrics("kind", e.kind))));
-}, Pn = /* @__PURE__ */ new Map(), W = (e, t) => {
+	N.runSync(N.zipRight(F.increment(On).pipe(N.tagMetrics("tag", t), N.tagMetrics("kind", e.kind)), F.update(kn, e.durationMs / 1e3).pipe(N.tagMetrics("tag", t), N.tagMetrics("kind", e.kind))));
+}, Pn = /* @__PURE__ */ new Map(), Fn = (e, t) => {
 	let n = Mn(e), r = Math.max(0, (Pn.get(n) ?? 0) + t);
-	r === 0 ? Pn.delete(n) : Pn.set(n, r), P.runSync(I.set(An, r).pipe(P.tagMetrics("tag", n)));
-}, Fn = (e, t) => I.counter(e, t === void 0 ? {} : { description: t }), In = (e, t) => I.gauge(e, t === void 0 ? {} : { description: t }), Ln = (e, t = bn, n) => I.histogram(e, t, n), Rn = (e) => {
+	r === 0 ? Pn.delete(n) : Pn.set(n, r), N.runSync(F.set(An, r).pipe(N.tagMetrics("tag", n)));
+}, In = (e, t) => F.counter(e, t === void 0 ? {} : { description: t }), Ln = (e, t) => F.gauge(e, t === void 0 ? {} : { description: t }), Rn = (e, t = bn, n) => F.histogram(e, t, n), zn = (e) => {
 	let t = {};
 	for (let n of e) t[n.key] = n.value;
 	return t;
-}, zn = I.snapshot.pipe(P.map((e) => e.map((e) => {
-	let t = e.metricKey.name, n = Rn(e.metricKey.tags), r = at.getOrUndefined(e.metricKey.description), i = r === void 0 ? {} : { description: r }, a = e.metricState;
-	if (it.isHistogramState(a)) return {
+}, Bn = F.snapshot.pipe(N.map((e) => e.map((e) => {
+	let t = e.metricKey.name, n = zn(e.metricKey.tags), r = ot.getOrUndefined(e.metricKey.description), i = r === void 0 ? {} : { description: r }, a = e.metricState;
+	if (at.isHistogramState(a)) return {
 		name: t,
 		labels: n,
 		...i,
@@ -1045,14 +1045,14 @@ var Rt = class {
 		sum: a.sum,
 		count: a.count
 	};
-	if (it.isGaugeState(a)) return {
+	if (at.isGaugeState(a)) return {
 		name: t,
 		labels: n,
 		...i,
 		type: "gauge",
 		value: Number(a.value)
 	};
-	if (it.isSummaryState(a)) return {
+	if (at.isSummaryState(a)) return {
 		name: t,
 		labels: n,
 		...i,
@@ -1064,7 +1064,7 @@ var Rt = class {
 			value: t.value
 		}] : [])
 	};
-	if (it.isFrequencyState(a)) {
+	if (at.isFrequencyState(a)) {
 		let e = {};
 		for (let [t, n] of a.occurrences) e[t] = n;
 		return {
@@ -1082,25 +1082,25 @@ var Rt = class {
 		type: "counter",
 		value: Number(a.count)
 	};
-}))), Bn = () => P.runSync(zn), Vn = class extends R.TaggedError()("RowFilterUnavailable", { cause: R.String }) {}, Hn = ot.exponential("20 millis").pipe(ot.intersect(ot.recurs(2))), Un, Wn = (e) => {
-	Un = e;
-}, Gn = () => Un, Kn = () => void 0, qn = (e, t) => Jn(Un, e, t), Jn = (e, t, n) => {
-	if (e === void 0 || t.type === "system") return P.succeed(Kn);
-	let r = e.retry ?? Hn, i = e.load(t);
-	return (r === !1 ? i : P.retry(i, r)).pipe(P.map((t) => (n) => e.predicate(t, n)), P.catchAll((t) => P.suspend(() => (n?.(t), e.onLoadError === "deny" ? P.succeed(Yn) : P.fail(new Vn({ cause: String(t) }))))));
-}, Yn = () => ({
+}))), Vn = () => N.runSync(Bn), Hn = class extends L.TaggedError()("RowFilterUnavailable", { cause: L.String }) {}, Un = st.exponential("20 millis").pipe(st.intersect(st.recurs(2))), Wn, Gn = (e) => {
+	Wn = e;
+}, Kn = () => Wn, qn = () => void 0, Jn = (e, t) => Yn(Wn, e, t), Yn = (e, t, n) => {
+	if (e === void 0 || t.type === "system") return N.succeed(qn);
+	let r = e.retry ?? Un, i = e.load(t);
+	return (r === !1 ? i : N.retry(i, r)).pipe(N.map((t) => (n) => e.predicate(t, n)), N.catchAll((t) => N.suspend(() => (n?.(t), e.onLoadError === "deny" ? N.succeed(Xn) : N.fail(new Hn({ cause: String(t) }))))));
+}, Xn = () => ({
 	column: "id",
 	op: "isNull"
-}), Xn = (e, n, r) => {
+}), Zn = (e, n, r) => {
 	let i = e(n);
 	return i === void 0 ? r : r ? t(r, i) : i;
-}, Zn = (e, t) => {
-	let n = Xn(e, t.table, t.predicate);
+}, Qn = (e, t) => {
+	let n = Zn(e, t.table, t.predicate);
 	return n === t.predicate ? t : {
 		...t,
 		predicate: n
 	};
-}, G = M({ scope: "voltro:dispatcher" }), Qn = (e) => Array.isArray(e) ? e.length : e == null ? 0 : 1, $n = (e) => typeof e == "object" && !!e && e._tag === "ScopeError", er = class {
+}, W = j({ scope: "voltro:dispatcher" }), $n = (e) => Array.isArray(e) ? e.length : e == null ? 0 : 1, er = (e) => typeof e == "object" && !!e && e._tag === "ScopeError", tr = class {
 	deps;
 	subscriptionRegistry;
 	matcher;
@@ -1115,7 +1115,7 @@ var Rt = class {
 		});
 	}
 	async subscribe(e, t, n, r, i, a, o, s) {
-		let c = `sub_${xe()}`, l = i ?? `subscription.${e.table}`, u = ln(e), d = _n(e);
+		let c = `sub_${Se()}`, l = i ?? `subscription.${e.table}`, u = ln(e), d = _n(e);
 		e.predicate !== void 0 && this.subscriptionRegistry.subscribe(c, e.table, e.predicate, r);
 		for (let e of u) {
 			let t = this.dependentByTable.get(e);
@@ -1129,7 +1129,7 @@ var Rt = class {
 			}
 		}, h, g;
 		try {
-			h = s === void 0 ? e : Zn(await s(), e), g = this.deps.cache !== void 0 && a !== void 0 ? await this.deps.cache.wrap(a, p, () => this.deps.store.query(h)) : await this.deps.store.query(h);
+			h = s === void 0 ? e : Qn(await s(), e), g = this.deps.cache !== void 0 && a !== void 0 ? await this.deps.cache.wrap(a, p, () => this.deps.store.query(h)) : await this.deps.store.query(h);
 		} catch (e) {
 			throw m(), e;
 		}
@@ -1146,7 +1146,7 @@ var Rt = class {
 			cacheBinding: a,
 			reauthorize: o,
 			refilter: s
-		}), W(l, 1), t({
+		}), Fn(l, 1), t({
 			_tag: "snapshot",
 			revision: 0,
 			data: g
@@ -1162,16 +1162,16 @@ var Rt = class {
 			durationMs: _ - f,
 			rowCount: g.length
 		}), () => {
-			this.subscriptions.delete(c), W(l, -1), m();
+			this.subscriptions.delete(c), Fn(l, -1), m();
 		};
 	}
 	revokeSubscription(e, t, n = "guards no longer satisfied") {
-		this.subscriptions.delete(e.id), W(e.label, -1), this.subscriptionRegistry.unsubscribe(e.id);
+		this.subscriptions.delete(e.id), Fn(e.label, -1), this.subscriptionRegistry.unsubscribe(e.id);
 		for (let t of e.dependentTables) {
 			let n = this.dependentByTable.get(t);
 			n !== void 0 && (n.delete(e.id), n.size === 0 && this.dependentByTable.delete(t));
 		}
-		G.warn(`subscription revoked mid-stream — ${n}`, {
+		W.warn(`subscription revoked mid-stream — ${n}`, {
 			id: e.id,
 			label: e.label,
 			traceId: e.context.traceId
@@ -1181,12 +1181,12 @@ var Rt = class {
 		});
 	}
 	revokeComputed(e, t) {
-		this.computedSubs.delete(e.id), W(e.label, -1);
+		this.computedSubs.delete(e.id), Fn(e.label, -1);
 		for (let t of e.tables) {
 			let n = this.computedByTable.get(t);
 			n !== void 0 && (n.delete(e.id), n.size === 0 && this.computedByTable.delete(t));
 		}
-		G.warn("computed subscription revoked mid-stream — guards no longer satisfied", {
+		W.warn("computed subscription revoked mid-stream — guards no longer satisfied", {
 			id: e.id,
 			label: e.label,
 			traceId: e.context.traceId
@@ -1196,7 +1196,7 @@ var Rt = class {
 		});
 	}
 	async subscribeComputed(e, t, n, r) {
-		let i = `csub_${xe()}`, a = e.dependentTables, o = {
+		let i = `csub_${Se()}`, a = e.dependentTables, o = {
 			id: i,
 			recompute: e.recompute,
 			tenantId: e.tenantId,
@@ -1204,10 +1204,10 @@ var Rt = class {
 			context: n,
 			label: r ?? "subscription.computed",
 			tables: a,
-			lastJson: tr(e.value),
+			lastJson: nr(e.value),
 			revision: 0
 		};
-		this.computedSubs.set(i, o), W(o.label, 1);
+		this.computedSubs.set(i, o), Fn(o.label, 1);
 		for (let e of a) {
 			let t = this.computedByTable.get(e);
 			t === void 0 && (t = /* @__PURE__ */ new Set(), this.computedByTable.set(e, t)), t.add(i);
@@ -1225,9 +1225,9 @@ var Rt = class {
 			startMs: s,
 			endMs: Date.now(),
 			durationMs: Date.now() - s,
-			rowCount: Qn(e.value)
+			rowCount: $n(e.value)
 		}), () => {
-			this.computedSubs.delete(i), W(o.label, -1);
+			this.computedSubs.delete(i), Fn(o.label, -1);
 			for (let e of a) {
 				let t = this.computedByTable.get(e);
 				t !== void 0 && (t.delete(i), t.size === 0 && this.computedByTable.delete(e));
@@ -1237,7 +1237,7 @@ var Rt = class {
 	async recomputeComputed(e) {
 		let t = Date.now();
 		try {
-			let n = await e.recompute(), r = tr(n);
+			let n = await e.recompute(), r = nr(n);
 			if (r === e.lastJson) return;
 			e.lastJson = r, e.revision += 1;
 			let i = Date.now();
@@ -1253,14 +1253,14 @@ var Rt = class {
 				startMs: t,
 				endMs: i,
 				durationMs: i - t,
-				rowCount: Qn(n)
+				rowCount: $n(n)
 			});
 		} catch (t) {
-			if ($n(t)) {
+			if (er(t)) {
 				this.revokeComputed(e, t);
 				return;
 			}
-			G.warn("computed recompute failed; subscriber left on last value", {
+			W.warn("computed recompute failed; subscriber left on last value", {
 				id: e.id,
 				label: e.label,
 				traceId: e.context.traceId
@@ -1295,7 +1295,7 @@ var Rt = class {
 		for (let e of n) r.add(e.subscriberId);
 		let i = this.dependentByTable.get(e.table);
 		if (i !== void 0) for (let e of i) r.add(e);
-		if (G.trace("handleChange", {
+		if (W.trace("handleChange", {
 			table: e.table,
 			op: e.op,
 			matcher: n.length,
@@ -1306,7 +1306,7 @@ var Rt = class {
 		for (let t of r) {
 			let n = this.subscriptions.get(t);
 			if (!n) {
-				G.trace("missing subscription", { subscriberId: t });
+				W.trace("missing subscription", { subscriberId: t });
 				continue;
 			}
 			if (!yn(e, n.relevantFields)) {
@@ -1332,21 +1332,21 @@ var Rt = class {
 						this.revokeSubscription(n, e, "row filter unavailable");
 						continue;
 					}
-					i = Zn(e, n.baseDescriptor);
+					i = Qn(e, n.baseDescriptor);
 				}
 				let o = await this.deps.store.query(i), s = n.lastDelivered;
-				if (nr(o, s)) {
-					G.trace("suppressed no-op delta", {
+				if (rr(o, s)) {
+					W.trace("suppressed no-op delta", {
 						subscriberId: t,
 						table: e.table
 					});
 					continue;
 				}
-				n.lastDelivered = o, this.deps.cache !== void 0 && n.cacheBinding !== void 0 && this.deps.cache.put(n.cacheBinding, Array.from(n.dependentTables), o), He(s) && He(o) ? n.emit({
+				n.lastDelivered = o, this.deps.cache !== void 0 && n.cacheBinding !== void 0 && this.deps.cache.put(n.cacheBinding, Array.from(n.dependentTables), o), Ue(s) && Ue(o) ? n.emit({
 					_tag: "delta",
 					revision: a,
 					emittedAt: a,
-					patch: ze(s, o)
+					patch: Be(s, o)
 				}) : n.emit({
 					_tag: "snapshot",
 					revision: a,
@@ -1364,7 +1364,7 @@ var Rt = class {
 					rowCount: o.length
 				});
 			} catch (r) {
-				G.warn("reactive re-query failed; subscriber left on last snapshot", {
+				W.warn("reactive re-query failed; subscriber left on last snapshot", {
 					subscriberId: t,
 					label: n.label,
 					table: e.table,
@@ -1372,66 +1372,66 @@ var Rt = class {
 				}, r);
 			}
 		}
-		o > 0 && G.trace("handleChange/prefiltered", {
+		o > 0 && W.trace("handleChange/prefiltered", {
 			table: e.table,
 			op: e.op,
 			skipped: o
 		});
 	}
-}, tr = (e) => {
+}, nr = (e) => {
 	try {
 		return JSON.stringify(e) ?? "null";
 	} catch {
 		return String(e);
 	}
-}, nr = (e, t) => {
+}, rr = (e, t) => {
 	if (e === t) return !0;
 	if (e.length !== t.length) return !1;
 	for (let n = 0; n < e.length; n++) if (JSON.stringify(e[n]) !== JSON.stringify(t[n])) return !1;
 	return !0;
-}, rr = (e) => typeof e == "object" && !!e && e.__voltroComputed === !0, ir = 1440 * 60 * 1e3, ar = 3600 * 1e3, or = /* @__PURE__ */ new Map(), sr = /* @__PURE__ */ new Set(), cr = (e, t) => {
-	or.set(e, {
+}, ir = (e) => typeof e == "object" && !!e && e.__voltroComputed === !0, ar = 1440 * 60 * 1e3, or = 3600 * 1e3, sr = /* @__PURE__ */ new Map(), cr = /* @__PURE__ */ new Set(), lr = (e, t) => {
+	sr.set(e, {
 		subject: t,
 		touchedAt: Date.now()
 	});
-	for (let n of sr) try {
+	for (let n of cr) try {
 		n(e, t);
 	} catch {}
-}, lr = (e) => {
-	let t = or.get(e);
-	if (t) return t.touchedAt = Date.now(), t.subject;
 }, ur = (e) => {
-	or.delete(e);
-}, dr = (e) => (sr.add(e), () => {
+	let t = sr.get(e);
+	if (t) return t.touchedAt = Date.now(), t.subject;
+}, dr = (e) => {
 	sr.delete(e);
-}), fr = setInterval(() => {
-	let e = Date.now() - ir;
-	for (let [t, n] of or) n.touchedAt < e && or.delete(t);
-}, ar);
-typeof fr == "object" && fr && "unref" in fr && fr.unref();
-var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
-	let n = K.get(e);
-	return n || (n = /* @__PURE__ */ new Set(), K.set(e, n)), n.add(t), () => {
-		let n = K.get(e);
-		n && (n.delete(t), n.size === 0 && K.delete(e));
+}, fr = (e) => (cr.add(e), () => {
+	cr.delete(e);
+}), pr = setInterval(() => {
+	let e = Date.now() - ar;
+	for (let [t, n] of sr) n.touchedAt < e && sr.delete(t);
+}, or);
+typeof pr == "object" && pr && "unref" in pr && pr.unref();
+var G = /* @__PURE__ */ new Map(), mr = (e, t) => {
+	let n = G.get(e);
+	return n || (n = /* @__PURE__ */ new Set(), G.set(e, n)), n.add(t), () => {
+		let n = G.get(e);
+		n && (n.delete(t), n.size === 0 && G.delete(e));
 	};
-}, mr = (e) => {
-	let t = K.get(e);
+}, hr = (e) => {
+	let t = G.get(e);
 	if (t) {
 		for (let e of [...t]) try {
 			e();
 		} catch {}
-		K.delete(e);
+		G.delete(e);
 	}
-}, hr = (e) => K.get(e)?.size ?? 0, gr = () => {
-	or.clear(), K.clear();
-}, _r = () => [...or.entries()].map(([e, t]) => ({
+}, gr = (e) => G.get(e)?.size ?? 0, _r = () => {
+	sr.clear(), G.clear();
+}, vr = () => [...sr.entries()].map(([e, t]) => ({
 	clientId: e,
 	subjectType: t.subject.type,
 	tenantId: t.subject.tenantId
-})), vr = /^00-([0-9a-f]{32})-([0-9a-f]{16})-([0-9a-f]{2})$/, yr = (e) => `00-${e.traceId}-${e.spanId}-${e.sampled ? "01" : "00"}`, br = (e) => {
+})), yr = /^00-([0-9a-f]{32})-([0-9a-f]{16})-([0-9a-f]{2})$/, br = (e) => `00-${e.traceId}-${e.spanId}-${e.sampled ? "01" : "00"}`, xr = (e) => {
 	if (typeof e != "string") return null;
-	let t = vr.exec(e.trim().toLowerCase());
+	let t = yr.exec(e.trim().toLowerCase());
 	if (t === null) return null;
 	let [, n, r, i] = t;
 	return n === "0".repeat(32) || r === "0".repeat(16) ? null : {
@@ -1439,37 +1439,37 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 		spanId: r,
 		sampled: (parseInt(i, 16) & 1) == 1
 	};
-}, xr = (e) => {
-	let t = br(e);
-	if (t !== null) return st.externalSpan({
+}, Sr = (e) => {
+	let t = xr(e);
+	if (t !== null) return ct.externalSpan({
 		traceId: t.traceId,
 		spanId: t.spanId,
 		sampled: t.sampled
 	});
-}, Sr = new Ct(), Cr = (e, t) => Sr.run(e, t), wr = () => Sr.getStore(), Tr = (e) => /^[0-9a-f]{64}$/i.test(e) ? Buffer.from(e, "hex") : Se(e, "voltro:field-encryption:v1", 32), Er = (t) => {
+}, Cr = new Ct(), wr = (e, t) => Cr.run(e, t), Tr = () => Cr.getStore(), Er = (e) => /^[0-9a-f]{64}$/i.test(e) ? Buffer.from(e, "hex") : Ce(e, "voltro:field-encryption:v1", 32), Dr = (t) => {
 	if (t.length !== 32) throw Error(`field cipher key must be 32 bytes, got ${t.length}`);
 	return {
 		encrypt: (n) => {
-			let r = be(12), i = _e("aes-256-gcm", t, r), a = Buffer.concat([i.update(n, "utf8"), i.final()]), o = i.getAuthTag();
+			let r = xe(12), i = ve("aes-256-gcm", t, r), a = Buffer.concat([i.update(n, "utf8"), i.final()]), o = i.getAuthTag();
 			return `${e}${r.toString("base64")}:${o.toString("base64")}:${a.toString("base64")}`;
 		},
 		decrypt: (n) => {
 			let [r, i, a] = n.slice(e.length).split(":");
 			if (!r || !i || a === void 0) throw Error("field cipher: malformed ciphertext");
-			let o = ve("aes-256-gcm", t, Buffer.from(r, "base64"));
+			let o = ye("aes-256-gcm", t, Buffer.from(r, "base64"));
 			return o.setAuthTag(Buffer.from(i, "base64")), Buffer.concat([o.update(Buffer.from(a, "base64")), o.final()]).toString("utf8");
 		}
 	};
-}, Dr = (e) => Er(Tr(e)), Or, kr = (e) => {
-	Or = e;
-}, q = () => Or, Ar = "no field cipher registered — enable `@voltro/plugin-governance` `governancePlugin({ fieldEncryption: { key } })` (or call setFieldCipher) so a key is available.", jr = (e) => {
-	let t = q();
-	if (!t) throw Error(`encryptField: ${Ar}`);
+}, Or = (e) => Dr(Er(e)), kr, Ar = (e) => {
+	kr = e;
+}, K = () => kr, jr = "no field cipher registered — enable `@voltro/plugin-governance` `governancePlugin({ fieldEncryption: { key } })` (or call setFieldCipher) so a key is available.", q = (e) => {
+	let t = K();
+	if (!t) throw Error(`encryptField: ${jr}`);
 	return t.encrypt(e);
 }, Mr = (e) => {
-	if (!S(e)) return e;
-	let t = q();
-	if (!t) throw Error(`decryptField: ${Ar}`);
+	if (!x(e)) return e;
+	let t = K();
+	if (!t) throw Error(`decryptField: ${jr}`);
 	return t.decrypt(e);
 }, Nr = new Ct(), Pr = /* @__PURE__ */ new Set(), Fr = /* @__PURE__ */ new Set(), Ir = "\0", Lr = process.env.VOLTRO_OBSERVE_GRAPH === "1", Rr = () => {
 	Lr = !0;
@@ -1514,16 +1514,16 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 		t.transactional = (t) => n.call(e, (e) => t(Wr(e)));
 	}
 	return t;
-}, Gr = class extends R.TaggedError()("NoRowFound", {
-	table: R.String,
-	found: R.Number
+}, Gr = class extends L.TaggedError()("NoRowFound", {
+	table: L.String,
+	found: L.Number
 }) {
 	get message() {
 		return this.found === 0 ? `expected exactly one row in '${this.table}', found none` : `expected exactly one row in '${this.table}', found more than one`;
 	}
-}, Kr = class extends R.TaggedError()("OptimisticLockError", {
-	table: R.String,
-	expected: R.Number
+}, Kr = class extends L.TaggedError()("OptimisticLockError", {
+	table: L.String,
+	expected: L.Number
 }) {
 	get message() {
 		return `optimistic lock failed on '${this.table}': expected version ${this.expected}`;
@@ -1536,21 +1536,21 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 	switch (n) {
 		case "=": return d(t, r);
 		case "!=":
-		case "<>": return D(t, r);
+		case "<>": return E(t, r);
 		case ">": return g(t, r);
 		case ">=": return _(t, r);
-		case "<": return E(t, r);
-		case "<=": return te(t, r);
-		case "in": return b(t, r);
+		case "<": return T(t, r);
+		case "<=": return ne(t, r);
+		case "in": return ee(t, r);
 		case "contains":
 		case "fts": return s(t, r);
-		case "startsWith": return me(t, r);
+		case "startsWith": return he(t, r);
 		default: return d(t, r);
 	}
 }, Yr = (e) => {
 	let t = h(e);
 	if (t === void 0) throw Error(`unknown table '${e}' — is it declared with table()?`);
-	return ae(t);
+	return oe(t);
 }, Xr = class e {
 	backend;
 	scope;
@@ -1599,8 +1599,8 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 	}
 	scopedQuery() {
 		let e = this.query, { subject: t, schemaRegistry: n } = this.scope;
-		!this.skipTenant && n.hasTenant(this.table) && t.tenantId != null && (e = e.where(d("tenantId", t.tenantId))), !this.skipSoftDelete && n.hasSoftDelete(this.table) && (e = e.where(C("deletedAt")));
-		let r = (this.scope.rowFilter ?? Kn)(this.table);
+		!this.skipTenant && n.hasTenant(this.table) && t.tenantId != null && (e = e.where(d("tenantId", t.tenantId))), !this.skipSoftDelete && n.hasSoftDelete(this.table) && (e = e.where(S("deletedAt")));
+		let r = (this.scope.rowFilter ?? qn)(this.table);
 		return r !== void 0 && (e = e.where(r)), e;
 	}
 	async all() {
@@ -1713,19 +1713,19 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 	select: (n) => new Xr(e, t, n, Yr(n)),
 	updateWhere: (n) => new Zr(e, t, n),
 	deleteWhere: (n) => new Qr(e, t, n)
-}), ei = class extends R.TaggedError()("TenantScopeViolation", {
-	table: R.String,
-	reason: R.String
-}) {}, ti = class extends R.TaggedError()("StoreOperationFailed", {
-	operation: R.String,
-	table: R.String,
-	cause: R.String
-}) {}, ni = class extends R.TaggedError()("TableValidationFailed", {
-	table: R.String,
-	summary: R.String,
-	issues: R.Array(R.Struct({
-		path: R.String,
-		message: R.String
+}), ei = class extends L.TaggedError()("TenantScopeViolation", {
+	table: L.String,
+	reason: L.String
+}) {}, ti = class extends L.TaggedError()("StoreOperationFailed", {
+	operation: L.String,
+	table: L.String,
+	cause: L.String
+}) {}, ni = class extends L.TaggedError()("TableValidationFailed", {
+	table: L.String,
+	summary: L.String,
+	issues: L.Array(L.Struct({
+		path: L.String,
+		message: L.String
 	}))
 }) {}, ri = "id", ii = (e) => "descriptor" in e ? e.descriptor : e, ai = (e, t) => {
 	let n = {};
@@ -1741,7 +1741,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 	let t = e.metadata?.userId;
 	return typeof t == "string" && t !== "" ? t : e.id;
 }, li = (e, n) => {
-	let r = Wr(e), i = ci(n.subject), a = n.subject.tenantId, o = n.rowFilter ?? Kn, s = (e, t) => {
+	let r = Wr(e), i = ci(n.subject), a = n.subject.tenantId, o = n.rowFilter ?? qn, s = (e, t) => {
 		let r = { ...t }, o = n.schemaRegistry, s = o.idScheme(e);
 		if (s !== void 0 && r[ri] == null) if (s.kind === "numeric") delete r[ri];
 		else {
@@ -1791,7 +1791,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 	}, _ = (e, t) => {
 		let r = n.schemaRegistry.validatePatchSchema(e);
 		if (r === void 0) return t;
-		let i = R.decodeUnknownEither(r)(t);
+		let i = L.decodeUnknownEither(r)(t);
 		if (i._tag === "Right") return t;
 		let a = wt.formatErrorSync(i.left).map((e) => ({
 			path: e.path.length === 0 ? "<root>" : e.path.join("."),
@@ -1806,7 +1806,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 		let e = { deletedAt: /* @__PURE__ */ new Date() };
 		return i !== null && (e.deletedBy = i), e;
 	}, y = (e, t, n) => {
-		let r = ne(n, t);
+		let r = re(n, t);
 		if (r.length !== 0) throw new ni({
 			table: e,
 			summary: `upsert conflictColumns [${n.map((e) => `'${e}'`).join(", ")}] but the payload is missing ${r.map((e) => `'${e}'`).join(", ")}`,
@@ -1815,10 +1815,10 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 				message: "named in conflictColumns but absent from the payload"
 			}))
 		});
-	}, x = (e, t) => {
+	}, b = (e, t) => {
 		let r = h(e);
 		if (r !== void 0) {
-			let n = re(r, t);
+			let n = ie(r, t);
 			if (n.length > 0) throw new ni({
 				table: e,
 				summary: `missing required column${n.length > 1 ? "s" : ""} ${n.map((e) => `'${e}'`).join(", ")} — NOT NULL with no default and not auto-stamped`,
@@ -1830,7 +1830,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 		}
 		let i = n.schemaRegistry.insertSchema(e);
 		if (i === void 0) return t;
-		let a = R.decodeUnknownEither(i)(t);
+		let a = L.decodeUnknownEither(i)(t);
 		if (a._tag === "Right") return t;
 		let o = wt.formatErrorSync(a.left).map((e) => ({
 			path: e.path.length === 0 ? "<root>" : e.path.join("."),
@@ -1841,41 +1841,41 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 			summary: s === void 0 ? "row validation failed" : `${s.path}: ${s.message}`,
 			issues: o
 		});
-	}, S = n.dialect, w = (e, t) => {
+	}, x = n.dialect, C = (e, t) => {
 		let n = h(e);
-		return u(S ? de(t, n, S) : t, n, q());
-	}, T = process.env.VOLTRO_FIELD_DECRYPT_ON_ERROR === "null" ? "null" : "throw", ee = M({ scope: "store.fieldEncryption" }), E = /* @__PURE__ */ new Set(), te = (e) => {
+		return u(x ? fe(t, n, x) : t, n, K());
+	}, w = process.env.VOLTRO_FIELD_DECRYPT_ON_ERROR === "null" ? "null" : "throw", te = j({ scope: "store.fieldEncryption" }), T = /* @__PURE__ */ new Set(), ne = (e) => {
 		let t = `${e.table}.${e.column}`;
-		E.has(t) || (E.add(t), ee.warn("encrypted column degraded to null — could not decrypt with the active key", {
+		T.has(t) || (T.add(t), te.warn("encrypted column degraded to null — could not decrypt with the active key", {
 			table: e.table,
 			column: e.column,
 			reason: e.reason,
 			hint: "VOLTRO_FIELD_DECRYPT_ON_ERROR=null is set — this row was likely encrypted under a different key"
 		}));
-	}, D = (e, t) => {
-		let n = h(e), r = c(t, n, q(), {
-			onError: T,
-			...T === "null" ? { warn: te } : {}
+	}, E = (e, t) => {
+		let n = h(e), r = c(t, n, K(), {
+			onError: w,
+			...w === "null" ? { warn: ne } : {}
 		});
-		return S ? l(r, n, S) : r;
-	}, ie = (e) => {
+		return x ? l(r, n, x) : r;
+	}, ae = (e) => {
 		let r = e.table, i = e.predicate;
 		if (!e.crossTenant && a != null && n.schemaRegistry.hasTenant(r)) {
 			let e = d("tenantId", a);
 			i = i ? t(i, e) : e;
 		}
 		if (!e.includeDeleted && n.schemaRegistry.hasSoftDelete(r)) {
-			let e = C("deletedAt");
+			let e = S("deletedAt");
 			i = i ? t(i, e) : e;
 		}
-		return i = Xn(o, r, i), i === e.predicate ? e : {
+		return i = Zn(o, r, i), i === e.predicate ? e : {
 			...e,
 			predicate: i
 		};
-	}, ae = async (e) => {
+	}, oe = async (e) => {
 		let t = await r.query(e);
-		return D(e.table, t);
-	}, oe = async (e) => ae(ie(e)), se = async (e, t, i) => {
+		return E(e.table, t);
+	}, se = async (e) => oe(ae(e)), ce = async (e, t, i) => {
 		let a = f(e, i);
 		if (n.schemaRegistry.computedFields(e).size > 0) {
 			let n = (await r.query({
@@ -1891,30 +1891,30 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 				projection: void 0
 			}))[0];
 			if (n === void 0) return null;
-			a = g(e, D(e, [n])[0], a);
+			a = g(e, E(e, [n])[0], a);
 		}
 		a = _(e, a);
-		let o = await r.update(e, t, w(e, a));
-		return o === null ? null : D(e, [o])[0];
-	}, ce = async (e, t) => n.schemaRegistry.hasSoftDelete(e) ? await r.update(e, t, v()) !== null : r.delete(e, t), le = async (e, t, n) => r.updateMany(e, w(e, f(e, t)), n), ue = async (e, t) => r.deleteMany(e, t), fe = (e, r) => a != null && n.schemaRegistry.hasTenant(e) ? t(r, d("tenantId", a)) : r, pe = async (e, t, n) => le(e, t, {
+		let o = await r.update(e, t, C(e, a));
+		return o === null ? null : E(e, [o])[0];
+	}, le = async (e, t) => n.schemaRegistry.hasSoftDelete(e) ? await r.update(e, t, v()) !== null : r.delete(e, t), ue = async (e, t, n) => r.updateMany(e, C(e, f(e, t)), n), de = async (e, t) => r.deleteMany(e, t), pe = (e, r) => a != null && n.schemaRegistry.hasTenant(e) ? t(r, d("tenantId", a)) : r, me = async (e, t, n) => ue(e, t, {
 		...n,
-		where: fe(e, n.where)
-	}), me = async (e, t) => ue(e, {
+		where: pe(e, n.where)
+	}), he = async (e, t) => de(e, {
 		...t,
-		where: fe(e, t.where)
-	}), he = $r({
-		query: ae,
-		updateMany: le,
-		deleteMany: ue,
+		where: pe(e, t.where)
+	}), ge = $r({
+		query: oe,
+		updateMany: ue,
+		deleteMany: de,
 		delete: (e, t) => r.delete(e, t)
 	}, {
 		subject: n.subject,
 		schemaRegistry: n.schemaRegistry,
 		rowFilter: o
-	}), O = ((e, t, n) => t === void 0 ? he.updateWhere(e) : se(e, t, n)), k = ((e, t) => t === void 0 ? he.deleteWhere(e) : ce(e, t)), A = async (e, t) => {
-		let n = t.map((t) => s(e, t)), i = n.map((t) => w(e, x(e, t))), a = await m(e, n[0] ?? {}, () => r.insertMany(e, i));
-		return D(e, a);
-	}, ge = (e, t) => {
+	}), D = ((e, t, n) => t === void 0 ? ge.updateWhere(e) : ce(e, t, n)), O = ((e, t) => t === void 0 ? ge.deleteWhere(e) : le(e, t)), k = async (e, t) => {
+		let n = t.map((t) => s(e, t)), i = n.map((t) => C(e, b(e, t))), a = await m(e, n[0] ?? {}, () => r.insertMany(e, i));
+		return E(e, a);
+	}, _e = (e, t) => {
 		let n = Object.keys(t);
 		if (n.length !== 1) throw Error(`store.links('${e}'): anchor must name exactly one source column, got [${n.join(", ")}]`);
 		let r = n[0], i = t[r], a = h(e);
@@ -1929,9 +1929,9 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 		};
 	};
 	return {
-		query: oe,
+		query: se,
 		one: (async (e) => {
-			let t = ii(e), n = await oe({
+			let t = ii(e), n = await se({
 				...t,
 				take: 2
 			}), r = n[0];
@@ -1945,21 +1945,21 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 			});
 			return r;
 		}),
-		first: (async (e) => (await oe({
+		first: (async (e) => (await se({
 			...ii(e),
 			take: 1
 		}))[0] ?? null),
-		maybeOne: (async (e) => (await oe({
+		maybeOne: (async (e) => (await se({
 			...ii(e),
 			take: 1
 		}))[0] ?? null),
 		insert: async (e, t) => {
-			let n = s(e, t), i = await m(e, n, () => r.insert(e, w(e, x(e, n))));
-			return D(e, [i])[0];
+			let n = s(e, t), i = await m(e, n, () => r.insert(e, C(e, b(e, n))));
+			return E(e, [i])[0];
 		},
-		insertMany: (async (e, t) => A(e, t)),
+		insertMany: (async (e, t) => k(e, t)),
 		links: (e, n) => {
-			let { sourceCol: r, sourceId: i, targetCol: a } = ge(e, n), o = async () => (await oe({
+			let { sourceCol: r, sourceId: i, targetCol: a } = _e(e, n), o = async () => (await se({
 				table: e,
 				predicate: d(r, i),
 				order: [],
@@ -1967,12 +1967,12 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 				skip: void 0,
 				take: void 0
 			})).map((e) => String(e[a])), s = async (t) => {
-				t.length !== 0 && await A(e, t.map((e) => ({
+				t.length !== 0 && await k(e, t.map((e) => ({
 					[r]: i,
 					[a]: e
 				})));
 			}, c = async (n) => {
-				n.length !== 0 && await me(e, { where: t(d(r, i), b(a, n)) });
+				n.length !== 0 && await he(e, { where: t(d(r, i), ee(a, n)) });
 			};
 			return {
 				list: o,
@@ -1992,7 +1992,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 					return await c(n), n;
 				},
 				setRows: async (n) => {
-					let o = /* @__PURE__ */ new Map(), s = await oe({
+					let o = /* @__PURE__ */ new Map(), s = await se({
 						table: e,
 						predicate: d(r, i),
 						order: [],
@@ -2014,9 +2014,9 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 					else {
 						let c = o.get(n), l = {}, u = !1;
 						for (let [e, t] of Object.entries(s)) e === r || e === a || c[e] !== t && (l[e] = t, u = !0);
-						u && (p.push(n), await pe(e, l, { where: t(d(r, i), d(a, n)) }));
+						u && (p.push(n), await me(e, l, { where: t(d(r, i), d(a, n)) }));
 					}
-					return m.length > 0 && await A(e, m), {
+					return m.length > 0 && await k(e, m), {
 						added: f,
 						removed: u,
 						updated: p
@@ -2026,26 +2026,26 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 		},
 		patchJson: async (e, t, n, i) => {
 			let a = await r.patchJson(e, t, n, i);
-			return a === null ? null : D(e, [a])[0];
+			return a === null ? null : E(e, [a])[0];
 		},
-		select: he.select,
-		update: O,
-		delete: k,
+		select: ge.select,
+		update: D,
+		delete: O,
 		applyDefined: ai,
 		hardDelete: async (e, t) => r.delete(e, t),
-		updateMany: pe,
-		deleteMany: me,
+		updateMany: me,
+		deleteMany: he,
 		upsert: async (e, t, n) => {
 			let i = s(e, t);
 			y(e, i, n.conflictColumns);
-			let a = await m(e, i, () => r.upsert(e, w(e, x(e, i)), n));
-			return D(e, [a])[0];
+			let a = await m(e, i, () => r.upsert(e, C(e, b(e, i)), n));
+			return E(e, [a])[0];
 		},
 		insertIgnore: async (e, t, n) => {
 			let i = s(e, t);
 			y(e, i, n.conflictColumns);
-			let a = await m(e, i, () => r.insertIgnore(e, w(e, x(e, i)), n));
-			return D(e, [a])[0];
+			let a = await m(e, i, () => r.insertIgnore(e, C(e, b(e, i)), n));
+			return E(e, [a])[0];
 		},
 		transactional: (e) => r.transactional(async (t) => e(li(t, n))),
 		...r.raw ? { raw: r.raw.bind(r) } : {},
@@ -2194,7 +2194,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 			return o.size;
 		}
 	};
-}, hi = M({ scope: "voltro:replication" }), gi = new Ct(), _i = (e, t) => gi.run(e, t), vi = () => gi.getStore(), yi = class {
+}, hi = j({ scope: "voltro:replication" }), gi = new Ct(), _i = (e, t) => gi.run(e, t), vi = () => gi.getStore(), yi = class {
 	primary;
 	replicas;
 	adapter;
@@ -2431,33 +2431,33 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 }, Si = (e, t) => {
 	let n = xi(e);
 	return n === void 0 ? t() : Br(n, t);
-}, Ci = (e, t, n, r) => e === "subject" ? `${t}:s:${n}` : e === "global" ? `${t}:global` : r.tenantId == null ? void 0 : `${t}:t:${r.tenantId}`, wi = (e, t) => P.async((n) => {
-	let r = ue(t, () => P.runFork(e));
+}, Ci = (e, t, n, r) => e === "subject" ? `${t}:s:${n}` : e === "global" ? `${t}:global` : r.tenantId == null ? void 0 : `${t}:t:${r.tenantId}`, wi = (e, t) => N.async((n) => {
+	let r = de(t, () => N.runFork(e));
 	return r.addObserver((e) => {
 		n(e);
-	}), P.asVoid(tt.interrupt(r));
+	}), N.asVoid(nt.interrupt(r));
 }), Ti = (e, t, n) => ({
 	subject: e,
-	traceId: t?.traceId ?? xe(),
+	traceId: t?.traceId ?? Se(),
 	...t?.spanId === void 0 ? {} : { spanId: t.spanId },
 	...n === void 0 ? {} : { clientId: n }
-}), Ei = P.currentSpan.pipe(P.catchAll(() => P.succeed(void 0))), Di = (e) => ({
+}), Ei = N.currentSpan.pipe(N.catchAll(() => N.succeed(void 0))), Di = (e) => ({
 	traceId: e.traceId,
 	...e.spanId === void 0 ? {} : { spanId: e.spanId }
 }), Oi = (e, t, n) => {
 	e !== void 0 && (e.attribute("rpc.tag", t), e.attribute("subject.type", n.type), n.tenantId !== void 0 && n.tenantId !== null && e.attribute("tenant.id", n.tenantId));
 }, ki = (e) => {
-	if (Gn() !== void 0) return async () => {
-		let t = await P.runPromise(P.either(qn(e, (e) => {
+	if (Kn() !== void 0) return async () => {
+		let t = await N.runPromise(N.either(Jn(e, (e) => {
 			console.error("[voltro] row filter failed to load — subscription", e);
 		})));
 		if (t._tag === "Left") throw t.left;
 		return t.right;
 	};
-}, Ai = (e, t, n, r, i, a, o, s) => z.asyncScoped((c) => P.gen(function* () {
-	let l = yield* P.tryPromise(() => t.subscribe(e, (e) => {
+}, Ai = (e, t, n, r, i, a, o, s) => R.asyncScoped((c) => N.gen(function* () {
+	let l = yield* N.tryPromise(() => t.subscribe(e, (e) => {
 		c.single(e);
-	}, n, r, i, a, o, s)).pipe(P.matchCause({
+	}, n, r, i, a, o, s)).pipe(N.matchCause({
 		onFailure: (e) => (zi(`subscription.${i}`, n.traceId, e), {
 			ok: !1,
 			error: Ui(e)
@@ -2475,23 +2475,23 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 		return;
 	}
 	let u = l.unsubscribe;
-	if (yield* P.addFinalizer(() => P.sync(() => u())), n.clientId !== void 0) {
-		let e = pr(n.clientId, () => {
+	if (yield* N.addFinalizer(() => N.sync(() => u())), n.clientId !== void 0) {
+		let e = mr(n.clientId, () => {
 			c.end();
 		});
-		yield* P.addFinalizer(() => P.sync(() => e()));
+		yield* N.addFinalizer(() => N.sync(() => e()));
 	}
 })), ji = /* @__PURE__ */ new Set(), Mi = () => {
 	ji.clear();
 }, Ni = (e) => {
 	ji.has(e) || (ji.add(e), process.stderr.write(`[voltro] ${e}: \`cache:\` is declared but NOT applied — this query's handler returns a computed value, and the snapshot cache only wraps a store read. Every subscriber re-runs the handler. Either return a query descriptor (so the read can be cached), or drop \`cache:\` so the declaration matches what happens.\n`));
-}, Pi = (e, t, n, r) => z.asyncScoped((i) => P.gen(function* () {
-	let a = yield* P.tryPromise(() => t.subscribeComputed(e, (e) => {
+}, Pi = (e, t, n, r) => R.asyncScoped((i) => N.gen(function* () {
+	let a = yield* N.tryPromise(() => t.subscribeComputed(e, (e) => {
 		i.single(e._tag === "snapshot" ? {
 			...e,
 			computed: !0
 		} : e);
-	}, n, r)).pipe(P.matchCause({
+	}, n, r)).pipe(N.matchCause({
 		onFailure: (e) => (zi(`subscription.${r}`, n.traceId, e), {
 			ok: !1,
 			error: Ui(e)
@@ -2509,19 +2509,19 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 		return;
 	}
 	let o = a.unsubscribe;
-	if (yield* P.addFinalizer(() => P.sync(() => o())), n.clientId !== void 0) {
-		let e = pr(n.clientId, () => {
+	if (yield* N.addFinalizer(() => N.sync(() => o())), n.clientId !== void 0) {
+		let e = mr(n.clientId, () => {
 			i.end();
 		});
-		yield* P.addFinalizer(() => P.sync(() => e()));
+		yield* N.addFinalizer(() => N.sync(() => e()));
 	}
-})), Fi = (e, t, n = "rpc.subscription", r, i, a, o) => z.unwrap(P.gen(function* () {
-	let s = yield* Ne, c = yield* Oe, l = yield* Ei;
+})), Fi = (e, t, n = "rpc.subscription", r, i, a, o) => R.unwrap(N.gen(function* () {
+	let s = yield* Pe, c = yield* ke, l = yield* Ei;
 	Oi(l, n, s);
-	let u = Ti(s, l, c.clientId), d = pi(s.id, c.clientId), f = _i({ subjectKey: d }, () => Cr({
+	let u = Ti(s, l, c.clientId), d = pi(s.id, c.clientId), f = _i({ subjectKey: d }, () => wr({
 		traceId: u.traceId,
 		...u.spanId === void 0 ? {} : { spanId: u.spanId }
-	}, () => Si(n, () => e(u)))), p = P.isEffect(f) ? yield* f.pipe(P.matchCause({
+	}, () => Si(n, () => e(u)))), p = N.isEffect(f) ? yield* f.pipe(N.matchCause({
 		onFailure: (e) => (zi(`subscription.${n}`, u.traceId, e), {
 			ok: !1,
 			error: Ui(e)
@@ -2534,33 +2534,33 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 		ok: !0,
 		value: f
 	};
-	if (!p.ok) return z.make({
+	if (!p.ok) return R.make({
 		_tag: "error",
 		error: p.error
 	});
 	let m = p.value;
-	if (rr(m)) return i !== void 0 && Ni(n), Pi(m, t, u, n);
+	if (ir(m)) return i !== void 0 && Ni(n), Pi(m, t, u, n);
 	let h = m, g = r?.(h), _ = i === void 0 ? void 0 : Ci(i.scope, i.baseKey, d, s);
 	return Ai(h, t, u, g, n, i === void 0 || _ === void 0 ? void 0 : {
 		key: _,
 		ttlMs: i.ttlMs,
 		swrMs: i.swrMs
 	}, a?.(s), o?.(s) ?? ki(s));
-}).pipe(P.withSpan(n, { attributes: { "framework.kind": "subscription" } }))), Ii = (e, t = "rpc.stream") => z.unwrap(P.gen(function* () {
-	let n = yield* Ne, r = yield* Oe, i = yield* Ei;
+}).pipe(N.withSpan(n, { attributes: { "framework.kind": "subscription" } }))), Ii = (e, t = "rpc.stream") => R.unwrap(N.gen(function* () {
+	let n = yield* Pe, r = yield* ke, i = yield* Ei;
 	Oi(i, t, n);
-	let a = Ti(n, i, r.clientId), o = Si(t, () => e(a)), s = P.isEffect(o) ? yield* o.pipe(P.orDie) : o;
+	let a = Ti(n, i, r.clientId), o = Si(t, () => e(a)), s = N.isEffect(o) ? yield* o.pipe(N.orDie) : o;
 	if (a.clientId === void 0) return s;
 	let c = a.clientId;
-	return z.unwrapScoped(P.gen(function* () {
-		let e = yield* Ze.make(), t = pr(c, () => {
-			Ze.unsafeDone(e, P.void);
+	return R.unwrapScoped(N.gen(function* () {
+		let e = yield* Qe.make(), t = mr(c, () => {
+			Qe.unsafeDone(e, N.void);
 		});
-		return yield* P.addFinalizer(() => P.sync(() => t())), s.pipe(z.interruptWhen(Ze.await(e)));
+		return yield* N.addFinalizer(() => N.sync(() => t())), s.pipe(R.interruptWhen(Qe.await(e)));
 	}));
-}).pipe(P.withSpan(t, { attributes: { "framework.kind": "stream" } }))), Li = M({ scope: "voltro:rpc" }), Ri = M({ scope: "voltro:http" }), zi = (e, t, n) => {
-	if (N.isInterruptedOnly(n)) return;
-	let r = N.squash(n), i = r?._tag, a = r instanceof Error ? r.message : r?.message ?? String(r), o = N.dieOption(n)._tag === "Some", s = on(r), c = {
+}).pipe(N.withSpan(t, { attributes: { "framework.kind": "stream" } }))), Li = j({ scope: "voltro:rpc" }), Ri = j({ scope: "voltro:http" }), zi = (e, t, n) => {
+	if (M.isInterruptedOnly(n)) return;
+	let r = M.squash(n), i = r?._tag, a = r instanceof Error ? r.message : r?.message ?? String(r), o = M.dieOption(n)._tag === "Some", s = on(r), c = {
 		traceId: t,
 		...i === void 0 ? {} : { errorTag: i },
 		...s
@@ -2575,7 +2575,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 	message: "internal server error",
 	traceId: e
 }), Ui = (e) => {
-	let t = N.squash(e);
+	let t = M.squash(e);
 	if (t && typeof t == "object" && t._tag === "UnknownException" && (t = t.error ?? t.cause ?? t), Vi(t)) return {
 		_tag: "InternalError",
 		message: "internal server error"
@@ -2588,47 +2588,47 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 		...typeof i == "string" ? { _tag: i } : {},
 		message: typeof a == "string" ? a : String(t)
 	};
-}, Wi = (e, t, n = "rpc.mutation") => P.gen(function* () {
-	let r = yield* Ne, i = yield* Oe, a = yield* Ei;
+}, Wi = (e, t, n = "rpc.mutation") => N.gen(function* () {
+	let r = yield* Pe, i = yield* ke, a = yield* Ei;
 	Oi(a, n, r);
 	let o = Ti(r, a, i.clientId), s = pi(r.id, i.clientId), c = {
 		traceId: o.traceId,
 		subjectId: ci(r),
 		procedure: n
-	}, l = _i({ subjectKey: s }, () => Cr({
+	}, l = _i({ subjectKey: s }, () => wr({
 		traceId: o.traceId,
 		...o.spanId === void 0 ? {} : { spanId: o.spanId }
-	}, () => ue(c, () => Si(n, () => e(t, o)))));
-	return yield* (P.isEffect(l) ? wi(l, c) : P.tryPromise({
+	}, () => de(c, () => Si(n, () => e(t, o)))));
+	return yield* (N.isEffect(l) ? wi(l, c) : N.tryPromise({
 		try: () => Promise.resolve(l),
 		catch: (e) => e
-	})).pipe(P.tapErrorCause((e) => P.sync(() => zi(n, o.traceId, e))), P.catchIf(Vi, () => P.die(Hi(o.traceId))), P.annotateLogs(Di(o)));
-}).pipe(P.withSpan(n, { attributes: { "framework.kind": "mutation" } })), Gi = 8 * 1024 * 1024, Ki = (e) => {
-	let t = e.port ?? 4e3, n = e.path ?? "/ws", r = lt(), i = (t) => pt.HttpServerRequest.pipe(P.flatMap((t) => P.gen(function* () {
+	})).pipe(N.tapErrorCause((e) => N.sync(() => zi(n, o.traceId, e))), N.catchIf(Vi, () => N.die(Hi(o.traceId))), N.annotateLogs(Di(o)));
+}).pipe(N.withSpan(n, { attributes: { "framework.kind": "mutation" } })), Gi = 8 * 1024 * 1024, Ki = (e) => {
+	let t = e.port ?? 4e3, n = e.host, r = e.path ?? "/ws", i = ut(), a = (t) => pt.HttpServerRequest.pipe(N.flatMap((t) => N.gen(function* () {
 		if (!e.inspectRoute) return V.text("inspect route not configured", { status: 404 });
 		let n = {};
 		for (let [e, r] of Object.entries(t.headers)) r !== void 0 && (n[e.toLowerCase()] = Array.isArray(r) ? r.join(", ") : r);
 		let r;
-		t.method !== "GET" && t.method !== "HEAD" && t.method !== "OPTIONS" && (r = yield* t.text.pipe(P.orElseSucceed(() => "")));
-		let i = e.inspectRoute.handle(t.url, n, t.method, r), a = i instanceof Promise ? yield* P.promise(() => i) : i;
+		t.method !== "GET" && t.method !== "HEAD" && t.method !== "OPTIONS" && (r = yield* t.text.pipe(N.orElseSucceed(() => "")));
+		let i = e.inspectRoute.handle(t.url, n, t.method, r), a = i instanceof Promise ? yield* N.promise(() => i) : i;
 		return a === null ? V.text("inspect route not found", { status: 404 }) : V.text(a.body, {
 			status: a.status,
 			contentType: a.contentType,
 			headers: a.headers ?? {}
 		});
-	}))), a = () => pt.HttpServerRequest.pipe(P.flatMap((t) => {
+	}))), o = () => pt.HttpServerRequest.pipe(N.flatMap((t) => {
 		let n = e.inspectStream;
-		if (!n) return P.succeed(V.text("inspect stream not configured", { status: 404 }));
+		if (!n) return N.succeed(V.text("inspect stream not configured", { status: 404 }));
 		let r = {};
 		for (let [e, n] of Object.entries(t.headers)) n !== void 0 && (r[e.toLowerCase()] = Array.isArray(n) ? n.join(", ") : n);
 		let i = n.corsHeaders(r.origin);
-		if (n.isDisabled()) return P.succeed(V.text(JSON.stringify({ error: "inspect disabled (VOLTRO_INSPECT=off)" }), {
+		if (n.isDisabled()) return N.succeed(V.text(JSON.stringify({ error: "inspect disabled (VOLTRO_INSPECT=off)" }), {
 			status: 503,
 			contentType: "application/json; charset=utf-8",
 			headers: i
 		}));
 		let a = n.authorize(r);
-		if (!a.ok) return P.succeed(V.text(JSON.stringify({
+		if (!a.ok) return N.succeed(V.text(JSON.stringify({
 			error: "unauthorized",
 			reason: a.reason
 		}), {
@@ -2640,18 +2640,18 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 			if (!f || e.indexOf("event: ") !== 0) return !0;
 			let t = e.indexOf("\n", 7);
 			return t < 0 || f.has(e.slice(7, t).trim());
-		}, m = z.asyncScoped((e) => P.gen(function* () {
+		}, m = R.asyncScoped((e) => N.gen(function* () {
 			if (e.single(o.encode("retry: 5000\n\n")), !u) for (let t of n.replay()) p(t) && e.single(o.encode(t));
 			let t = n.subscribe((t) => {
 				p(t) && e.single(o.encode(t));
 			}), r = setInterval(() => {
 				e.single(o.encode(n.keepAlive()));
 			}, s);
-			yield* P.addFinalizer(() => P.sync(() => {
+			yield* N.addFinalizer(() => N.sync(() => {
 				clearInterval(r), t();
 			}));
 		}));
-		return P.succeed(V.stream(m, {
+		return N.succeed(V.stream(m, {
 			status: 200,
 			headers: {
 				"content-type": "text/event-stream; charset=utf-8",
@@ -2661,31 +2661,31 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 				...i
 			}
 		}));
-	})), o = B.add("*", "/_voltro/inspect/*", pt.HttpServerRequest.pipe(P.flatMap((t) => P.gen(function* () {
+	})), s = B.add("*", "/_voltro/inspect/*", pt.HttpServerRequest.pipe(N.flatMap((t) => N.gen(function* () {
 		if (!e.inspectRoute) return V.text("inspect route not configured", { status: 404 });
 		let n = {};
 		for (let [e, r] of Object.entries(t.headers)) r !== void 0 && (n[e.toLowerCase()] = Array.isArray(r) ? r.join(", ") : r);
 		let r;
-		t.method !== "GET" && t.method !== "HEAD" && t.method !== "OPTIONS" && (r = yield* t.text.pipe(P.orElseSucceed(() => "")));
-		let i = e.inspectRoute.handle(t.url, n, t.method, r), a = i instanceof Promise ? yield* P.promise(() => i) : i;
+		t.method !== "GET" && t.method !== "HEAD" && t.method !== "OPTIONS" && (r = yield* t.text.pipe(N.orElseSucceed(() => "")));
+		let i = e.inspectRoute.handle(t.url, n, t.method, r), a = i instanceof Promise ? yield* N.promise(() => i) : i;
 		return a === null ? V.text("inspect route not found", { status: 404 }) : V.text(a.body, {
 			status: a.status,
 			contentType: a.contentType,
 			headers: a.headers ?? {}
 		});
-	})))), s = F.empty;
-	e.inspectRoute !== void 0 && (s = e.inspectStream === void 0 ? F.mergeAll(B.add("*", "/_voltro/inspect", i(!0)), o) : F.mergeAll(B.add("GET", "/_voltro/inspect/stream", a()), B.add("*", "/_voltro/inspect", i(!0)), o));
-	let c = F.empty;
+	})))), c = P.empty;
+	e.inspectRoute !== void 0 && (c = e.inspectStream === void 0 ? P.mergeAll(B.add("*", "/_voltro/inspect", a(!0)), s) : P.mergeAll(B.add("GET", "/_voltro/inspect/stream", o()), B.add("*", "/_voltro/inspect", a(!0)), s));
+	let l = P.empty;
 	if (e.webhookRoutes !== void 0 && e.webhookRoutes.size > 0) {
-		let t = (e) => pt.HttpServerRequest.pipe(P.flatMap((t) => P.gen(function* () {
+		let t = (e) => pt.HttpServerRequest.pipe(N.flatMap((t) => N.gen(function* () {
 			let n = {};
 			for (let [e, r] of Object.entries(t.headers)) r !== void 0 && (n[e.toLowerCase()] = Array.isArray(r) ? r.join(", ") : r);
-			let r = t.method !== "GET" && t.method !== "HEAD" ? yield* t.text.pipe(P.orElseSucceed(() => "")) : "", i = new TextEncoder().encode(r), a = t.url.split("?")[0], o = xr(n.traceparent), s = yield* P.promise(() => e.handle({
+			let r = t.method !== "GET" && t.method !== "HEAD" ? yield* t.text.pipe(N.orElseSucceed(() => "")) : "", i = new TextEncoder().encode(r), a = t.url.split("?")[0], o = Sr(n.traceparent), s = yield* N.promise(() => e.handle({
 				method: t.method,
 				path: a,
 				headers: n,
 				rawBody: i
-			})).pipe(P.withSpan(`webhook${a}`, {
+			})).pipe(N.withSpan(`webhook${a}`, {
 				attributes: {
 					"framework.kind": "webhook",
 					"http.route": a
@@ -2697,21 +2697,21 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 				contentType: s.contentType
 			});
 		}))), n = Array.from(e.webhookRoutes.entries()).map(([e, n]) => B.add("*", e, t(n)));
-		c = F.mergeAll(...n);
+		l = P.mergeAll(...n);
 	}
-	let l = F.empty;
+	let u = P.empty;
 	if (e.httpRoutes !== void 0 && e.httpRoutes.length > 0) {
-		let t = (t) => pt.HttpServerRequest.pipe(P.flatMap((n) => P.gen(function* () {
+		let t = (t) => pt.HttpServerRequest.pipe(N.flatMap((n) => N.gen(function* () {
 			let r = {};
 			for (let [e, t] of Object.entries(n.headers)) t !== void 0 && (r[e.toLowerCase()] = Array.isArray(t) ? t.join(", ") : t);
-			let i = n.url.indexOf("?"), a = i >= 0 ? n.url.slice(0, i) : n.url, o = i >= 0 ? n.url.slice(i + 1) : "", s = n.method !== "GET" && n.method !== "HEAD" ? new Uint8Array(yield* n.arrayBuffer.pipe(P.orElseSucceed(() => /* @__PURE__ */ new ArrayBuffer(0)))) : /* @__PURE__ */ new Uint8Array(), c = e.getStore?.(), l = {
+			let i = n.url.indexOf("?"), a = i >= 0 ? n.url.slice(0, i) : n.url, o = i >= 0 ? n.url.slice(i + 1) : "", s = n.method !== "GET" && n.method !== "HEAD" ? new Uint8Array(yield* n.arrayBuffer.pipe(N.orElseSucceed(() => /* @__PURE__ */ new ArrayBuffer(0)))) : /* @__PURE__ */ new Uint8Array(), c = e.getStore?.(), l = {
 				method: n.method,
 				path: a,
 				query: o,
 				headers: r,
 				rawBody: s,
 				...c === void 0 ? {} : { store: c }
-			}, u = yield* P.promise(() => bt(t, l));
+			}, u = yield* N.promise(() => bt(t, l));
 			u.status >= 500 && Ri.warn(`${n.method} ${a} → ${u.status}`, {
 				method: n.method,
 				path: a,
@@ -2724,14 +2724,14 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 				headers: d
 			};
 			if (u.stream !== void 0) {
-				let { subscribe: e, keepAliveMs: t } = u.stream, n = new TextEncoder(), r = t ?? 15e3, i = z.asyncScoped((t) => P.gen(function* () {
+				let { subscribe: e, keepAliveMs: t } = u.stream, n = new TextEncoder(), r = t ?? 15e3, i = R.asyncScoped((t) => N.gen(function* () {
 					t.single(n.encode("retry: 5000\n\n"));
 					let i = e((e) => {
 						t.single(n.encode(e));
 					}), a = r > 0 ? setInterval(() => {
 						t.single(n.encode(": keep-alive\n\n"));
 					}, r) : void 0;
-					yield* P.addFinalizer(() => P.sync(() => {
+					yield* N.addFinalizer(() => N.sync(() => {
 						a !== void 0 && clearInterval(a), i();
 					}));
 				}));
@@ -2747,7 +2747,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 				});
 			}
 			return u.body instanceof Uint8Array ? V.uint8Array(u.body, f) : V.text(u.body ?? "", f);
-		})), P.tapErrorCause((e) => N.isInterruptedOnly(e) ? P.void : P.sync(() => Ri.error(`${t.map((e) => e.method).join("|")} ${t[0].path} threw`, { path: t[0].path }, N.squash(e))))), n = /* @__PURE__ */ new Map();
+		})), N.tapErrorCause((e) => M.isInterruptedOnly(e) ? N.void : N.sync(() => Ri.error(`${t.map((e) => e.method).join("|")} ${t[0].path} threw`, { path: t[0].path }, M.squash(e))))), n = /* @__PURE__ */ new Map();
 		for (let t of e.httpRoutes) {
 			let e = n.get(t.path);
 			e ? e.push(t) : n.set(t.path, [t]);
@@ -2756,29 +2756,29 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 			let r = n.length === 1 ? n[0].method : "*", i = t(n);
 			return [B.add(r, e, i), B.add(r, `${e}/*`, i)];
 		});
-		l = F.mergeAll(...r);
+		u = P.mergeAll(...r);
 	}
-	let u = vt.layerProtocolWebsocketRouter({ path: n }), d = vt.layer(e.group), f = vt.layer(e.group).pipe(F.provide(vt.layerProtocolHttpRouter({ path: "/rpc" })), F.provide(_t.layerJson), F.provide(e.httpHandlersLayer ?? e.handlersLayer)), p = F.scopedDiscard(P.gen(function* () {
+	let d = vt.layerProtocolWebsocketRouter({ path: r }), f = vt.layer(e.group), p = vt.layer(e.group).pipe(P.provide(vt.layerProtocolHttpRouter({ path: "/rpc" })), P.provide(_t.layerJson), P.provide(e.httpHandlersLayer ?? e.handlersLayer)), m = P.scopedDiscard(N.gen(function* () {
 		let e = yield* vt.Protocol;
-		yield* P.forkScoped(P.gen(function* () {
+		yield* N.forkScoped(N.gen(function* () {
 			let t = yield* e.disconnects.take;
-			ur(t), mr(t);
-		}).pipe(P.forever));
-	})), m = F.mergeAll(d, p).pipe(F.provide(u), F.provide(_t.layerJson), F.provide(e.handlersLayer)), h = F.mergeAll(m, f, s, c, l), g = e.pluginHttpInterceptor, _ = e.healthCheck, v = Number(process.env.VOLTRO_MAX_RPC_BODY_BYTES), y = e.maxRpcBodyBytes ?? (Number.isFinite(v) && v > 0 ? v : 8388608), b = { "cache-control": "no-store" }, x = (e) => P.gen(function* () {
+			dr(t), hr(t);
+		}).pipe(N.forever));
+	})), h = P.mergeAll(f, m).pipe(P.provide(d), P.provide(_t.layerJson), P.provide(e.handlersLayer)), g = P.mergeAll(h, p, c, l, u), _ = e.pluginHttpInterceptor, v = e.healthCheck, y = Number(process.env.VOLTRO_MAX_RPC_BODY_BYTES), ee = e.maxRpcBodyBytes ?? (Number.isFinite(y) && y > 0 ? y : 8388608), b = { "cache-control": "no-store" }, x = (e) => N.gen(function* () {
 		let t = yield* pt.HttpServerRequest, n = {};
 		for (let [e, r] of Object.entries(t.headers)) r !== void 0 && (n[e.toLowerCase()] = Array.isArray(r) ? r.join(", ") : r);
 		let r = t.url.indexOf("?"), i = r === -1 ? t.url : t.url.slice(0, r);
 		if (t.method === "POST" && i === "/rpc") {
 			let e = n["content-length"];
-			if (e !== void 0 && Number(e) > y) return V.text("rpc payload too large", {
+			if (e !== void 0 && Number(e) > ee) return V.text("rpc payload too large", {
 				status: 413,
 				headers: b
 			});
 		}
-		if (_ && (i === "/internal/liveness" || i === "/internal/readiness")) return i === "/internal/liveness" ? V.text("ok", {
+		if (v && (i === "/internal/liveness" || i === "/internal/readiness")) return i === "/internal/liveness" ? V.text("ok", {
 			status: 200,
 			headers: b
-		}) : _.isReady() ? _.ping && !(yield* P.tryPromise(() => _.ping()).pipe(P.orElseSucceed(() => !1))) ? V.text("not-ready: dependency", {
+		}) : v.isReady() ? v.ping && !(yield* N.tryPromise(() => v.ping()).pipe(N.orElseSucceed(() => !1))) ? V.text("not-ready: dependency", {
 			status: 503,
 			headers: b
 		}) : V.text("ready", {
@@ -2788,32 +2788,35 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 			status: 503,
 			headers: b
 		});
-		if (!g) return yield* e;
+		if (!_) return yield* e;
 		let a = n["x-forwarded-for"], o = a ? a.split(",")[0].trim() : void 0, s;
 		try {
 			s = t.source?.socket?.remoteAddress;
 		} catch {
 			s = void 0;
 		}
-		let c = o ?? s, l = yield* P.tryPromise(() => g(async () => null, {
+		let c = o ?? s, l = yield* N.tryPromise(() => _(async () => null, {
 			method: t.method,
 			path: i,
 			headers: n,
 			remoteAddr: c
-		})).pipe(P.orElseSucceed(() => null));
+		})).pipe(N.orElseSucceed(() => null));
 		return l === null ? yield* e : V.text(l.body ?? "", {
 			status: l.status,
 			...l.headers ? { headers: l.headers } : {}
 		});
-	}), S = F.unwrapEffect(B.toHttpEffect(h).pipe(P.map((e) => ft.serve(x(e))))).pipe(F.provide(ht.layer(() => r, { port: t })), F.provide(mt.layer));
-	e.tracerLayer && (S = S.pipe(F.provide(e.tracerLayer)));
-	let C = M({ scope: "voltro:rpc" }), w = F.launch(S).pipe(P.catchAllCause((e) => P.sync(() => {
-		C.error("rpc server crashed", {}, N.squash(e)), process.exit(1);
-	}))), T = P.runFork(w);
-	return qi.add(T), $i(), {
-		server: r,
+	}), S = P.unwrapEffect(B.toHttpEffect(g).pipe(N.map((e) => ft.serve(x(e))))).pipe(P.provide(ht.layer(() => i, n === void 0 ? { port: t } : {
+		port: t,
+		host: n
+	})), P.provide(mt.layer));
+	e.tracerLayer && (S = S.pipe(P.provide(e.tracerLayer)));
+	let C = j({ scope: "voltro:rpc" }), w = P.launch(S).pipe(N.catchAllCause((e) => N.sync(() => {
+		C.error("rpc server crashed", {}, M.squash(e)), process.exit(1);
+	}))), te = N.runFork(w);
+	return qi.add(te), $i(), {
+		server: i,
 		shutdown: async () => {
-			qi.delete(T), await P.runPromise(tt.interrupt(T)).then(() => void 0, () => void 0);
+			qi.delete(te), await N.runPromise(nt.interrupt(te)).then(() => void 0, () => void 0);
 		}
 	};
 }, qi = /* @__PURE__ */ new Set(), Ji = /* @__PURE__ */ new Set(), Yi = !1, Xi = (e) => (Ji.add(e), () => {
@@ -2822,7 +2825,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 	let t = !1, n = () => {
 		t || (t = !0, clearTimeout(r), e.exit());
 	}, r = setTimeout(n, e.deadlineMs);
-	r.unref?.(), Promise.all(e.hooks.map((e) => Promise.resolve().then(e).then(() => void 0, () => void 0))).then(() => Promise.all(e.fibers.map((e) => P.runPromise(tt.interrupt(e)).then(() => void 0, () => void 0)))).then(n, n);
+	r.unref?.(), Promise.all(e.hooks.map((e) => Promise.resolve().then(e).then(() => void 0, () => void 0))).then(() => Promise.all(e.fibers.map((e) => N.runPromise(nt.interrupt(e)).then(() => void 0, () => void 0)))).then(n, n);
 }, $i = () => {
 	if (Yi) return;
 	Yi = !0;
@@ -2899,7 +2902,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 }, aa = async (e = {}) => {
 	let t = e.mode ?? ta(), n = e.metricsMode ?? na(), r = e.extraSpanProcessors ?? [], i = e.extraMetricReaders ?? [];
 	if (t === "off" && e.traceSink === void 0 && n === "off" && r.length === 0 && i.length === 0) return {
-		layer: F.empty,
+		layer: P.empty,
 		mode: t,
 		bufferOnly: !1,
 		inMemoryExporter: void 0,
@@ -2912,14 +2915,14 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 		...e.traceSink ? [e.traceSink] : [],
 		...p ? [p] : [],
 		...r
-	], h = m.length === 1 ? m[0] : m, { reader: g, inMemory: _ } = ia(a, n, e.metricExportIntervalMillis ?? (process.env.OTEL_METRIC_EXPORT_INTERVAL ? Number(process.env.OTEL_METRIC_EXPORT_INTERVAL) : 6e4)), v = [...g ? [g] : [], ...i], y = v.length === 0 ? void 0 : v.length === 1 ? v[0] : v, b = {
+	], h = m.length === 1 ? m[0] : m, { reader: g, inMemory: _ } = ia(a, n, e.metricExportIntervalMillis ?? (process.env.OTEL_METRIC_EXPORT_INTERVAL ? Number(process.env.OTEL_METRIC_EXPORT_INTERVAL) : 6e4)), v = [...g ? [g] : [], ...i], y = v.length === 0 ? void 0 : v.length === 1 ? v[0] : v, ee = {
 		serviceName: d,
 		...e.serviceVersion ? { serviceVersion: e.serviceVersion } : {},
 		...e.resourceAttributes ? { attributes: e.resourceAttributes } : {}
 	};
 	return {
 		layer: a.nodeSdk.NodeSdk.layer(() => ({
-			resource: b,
+			resource: ee,
 			spanProcessor: h,
 			...y ? { metricReader: y } : {},
 			...e.sampler ? { tracerConfig: { sampler: e.sampler } } : {}
@@ -3028,7 +3031,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 	key: e.key,
 	status: e.status === "completed" ? "completed" : "in_flight",
 	response: wa(e.response),
-	createdAt: qe(e.createdAt)
+	createdAt: Je(e.createdAt)
 }), Ea = async (e, n, r) => (await e.query({
 	table: Ca,
 	predicate: t(d("scope", n), d("key", r)),
@@ -3055,7 +3058,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 				createdAt: new Date(r)
 			}, { conflictColumns: ["scope", "key"] });
 			if (o.id === a) return "claimed";
-			if (r - qe(o.createdAt) < i) return Ta(o);
+			if (r - Je(o.createdAt) < i) return Ta(o);
 			await e.delete(Ca, o.id);
 		}
 		let a = await Ea(e, t, n);
@@ -3095,7 +3098,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 	skip: void 0,
 	projection: void 0
 }))[0] ?? null, Ma = (e) => {
-	let n = (e, t, n) => P.tryPromise({
+	let n = (e, t, n) => N.tryPromise({
 		try: n,
 		catch: (n) => new kt({
 			operation: e,
@@ -3106,7 +3109,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 	return {
 		get: (t) => n("get", t, async () => {
 			let n = await ja(e, t);
-			return n === null ? at.none() : ka(n, Date.now()) ? (await e.delete(J, n.id), at.none()) : at.some(Aa(n.value));
+			return n === null ? ot.none() : ka(n, Date.now()) ? (await e.delete(J, n.id), ot.none()) : ot.some(Aa(n.value));
 		}),
 		set: (t, r, i) => n("set", t, async () => {
 			let n = Date.now(), a = i?.ttlMs !== void 0 && i.ttlMs > 0 ? new Date(n + i.ttlMs) : null, o = p({
@@ -3139,7 +3142,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 			return n === null ? !1 : ka(n, Date.now()) ? (await e.delete(J, n.id), !1) : !0;
 		}),
 		list: (r) => n("list", "", async () => {
-			let n = Date.now(), i = ie(C("expiresAt"), g("expiresAt", new Date(n))), a = r === "" ? i : t(s("key", r), i), o = await e.query({
+			let n = Date.now(), i = ae(S("expiresAt"), g("expiresAt", new Date(n))), a = r === "" ? i : t(s("key", r), i), o = await e.query({
 				table: J,
 				predicate: a,
 				order: [],
@@ -3158,10 +3161,10 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 		})
 	};
 }, Na = async ({ store: e, env: t = process.env }) => {
-	let n = (t.KV_BACKEND ?? "database").toLowerCase(), r = n === "redis" ? "redis" : n === "memory" ? "memory" : "database", i = r === "redis" ? Nt(t.KV_KEY_PREFIX ? { keyPrefix: t.KV_KEY_PREFIX } : {}).pipe(F.provide(jt)) : r === "memory" ? Mt() : F.succeed(At, At.of(Ma(e))), a = nt.make(Ot.Default.pipe(F.provide(i))), o = await a.runPromise(Ot);
+	let n = (t.KV_BACKEND ?? "database").toLowerCase(), r = n === "redis" ? "redis" : n === "memory" ? "memory" : "database", i = r === "redis" ? Nt(t.KV_KEY_PREFIX ? { keyPrefix: t.KV_KEY_PREFIX } : {}).pipe(P.provide(jt)) : r === "memory" ? Mt() : P.succeed(At, At.of(Ma(e))), a = rt.make(Ot.Default.pipe(P.provide(i))), o = await a.runPromise(Ot);
 	return {
 		kv: {
-			get: (e) => a.runPromise(o.get(e)).then((e) => at.getOrUndefined(e)),
+			get: (e) => a.runPromise(o.get(e)).then((e) => ot.getOrUndefined(e)),
 			getOrElse: (e, t) => a.runPromise(o.getOrElse(e, t)),
 			set: (e, t, n) => a.runPromise(o.set(e, t, n)),
 			delete: (e) => a.runPromise(o.delete(e)),
@@ -3181,7 +3184,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 	has: () => Promise.resolve(!1),
 	list: () => Promise.resolve([]),
 	clear: () => Promise.resolve()
-}, Fa = "_voltro_api_keys", Ia = (e) => ye("sha256").update(e, "utf8").digest("hex"), La = (e = "voltro_") => `${e}${be(30).toString("base64url")}`, Ra = (e) => ({
+}, Fa = "_voltro_api_keys", Ia = (e) => be("sha256").update(e, "utf8").digest("hex"), La = (e = "voltro_") => `${e}${xe(30).toString("base64url")}`, Ra = (e) => ({
 	id: e.id,
 	name: e.name,
 	keyPrefix: e.keyPrefix,
@@ -3340,21 +3343,21 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 		scopes: t.scopes ?? []
 	};
 }, Ja = (e, t = "/v1/api-keys") => {
-	let n = R.Struct({
-		id: R.String,
-		name: R.String,
-		keyPrefix: R.String,
-		tenantId: R.NullOr(R.String),
-		scopes: R.Array(R.String),
-		lastUsedAt: R.NullOr(R.Number),
-		expiresAt: R.NullOr(R.Number),
-		revokedAt: R.NullOr(R.Number),
-		createdAt: R.Number,
-		createdBy: R.NullOr(R.String),
-		onBehalfOf: R.NullOr(R.String),
-		metadata: R.optional(R.NullOr(R.Record({
-			key: R.String,
-			value: R.Unknown
+	let n = L.Struct({
+		id: L.String,
+		name: L.String,
+		keyPrefix: L.String,
+		tenantId: L.NullOr(L.String),
+		scopes: L.Array(L.String),
+		lastUsedAt: L.NullOr(L.Number),
+		expiresAt: L.NullOr(L.Number),
+		revokedAt: L.NullOr(L.Number),
+		createdAt: L.Number,
+		createdBy: L.NullOr(L.String),
+		onBehalfOf: L.NullOr(L.String),
+		metadata: L.optional(L.NullOr(L.Record({
+			key: L.String,
+			value: L.Unknown
 		})))
 	});
 	return [
@@ -3363,42 +3366,42 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 			path: `${t}/issue`,
 			summary: "Issue an API key (the token is returned ONCE).",
 			guards: [xt([
-				we,
-				De,
 				Te,
-				Ee
+				Oe,
+				Ee,
+				De
 			])],
-			input: R.Struct({ body: R.Struct({
-				name: R.String,
-				scopes: R.optional(R.Array(R.String)),
-				expiresInDays: R.optional(R.Number),
-				onBehalfOf: R.optional(R.NullOr(R.String))
+			input: L.Struct({ body: L.Struct({
+				name: L.String,
+				scopes: L.optional(L.Array(L.String)),
+				expiresInDays: L.optional(L.Number),
+				onBehalfOf: L.optional(L.NullOr(L.String))
 			}) }),
-			output: R.Struct({
-				id: R.String,
-				token: R.String,
-				keyPrefix: R.String
+			output: L.Struct({
+				id: L.String,
+				token: L.String,
+				keyPrefix: L.String
 			}),
 			handler: async (t, n) => {
-				let r = t.body, i = qa(n), a = new Set(i.scopes), o = (e) => a.has(we) || a.has(e), s = r.onBehalfOf === void 0 ? i.id : r.onBehalfOf;
+				let r = t.body, i = qa(n), a = new Set(i.scopes), o = (e) => a.has(Te) || a.has(e), s = r.onBehalfOf === void 0 ? i.id : r.onBehalfOf;
 				if (s === null) {
-					if (!o(Te)) throw new Me({
-						required: Te,
+					if (!o(Ee)) throw new Ne({
+						required: Ee,
 						message: "not allowed to issue an organization key"
 					});
 				} else if (s !== i.id) {
-					if (!o(Ee)) throw new Me({
-						required: Ee,
+					if (!o(De)) throw new Ne({
+						required: De,
 						message: "not allowed to issue a key on behalf of another user"
 					});
-				} else if (!o(De)) throw new Me({
-					required: De,
+				} else if (!o(Oe)) throw new Ne({
+					required: Oe,
 					message: "not allowed to issue an api key"
 				});
 				let c = r.scopes ?? [...a];
-				if (!a.has(we)) {
+				if (!a.has(Te)) {
 					let e = c.filter((e) => !a.has(e));
-					if (e.length > 0) throw new Me({
+					if (e.length > 0) throw new Ne({
 						required: String(e[0]),
 						message: `cannot issue a key with scopes you do not hold: ${e.join(", ")}`
 					});
@@ -3422,18 +3425,18 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 			method: "GET",
 			path: t,
 			summary: "List the caller tenant's API keys (no secrets).",
-			guards: [St(we)],
-			input: R.Struct({}),
-			output: R.Struct({ keys: R.Array(n) }),
+			guards: [St(Te)],
+			input: L.Struct({}),
+			output: L.Struct({ keys: L.Array(n) }),
 			handler: async (t, n) => ({ keys: [...await e.list(qa(n).tenantId)] })
 		}),
 		yt({
 			method: "POST",
 			path: `${t}/revoke`,
 			summary: "Revoke an API key by id.",
-			guards: [St(we)],
-			input: R.Struct({ body: R.Struct({ id: R.String }) }),
-			output: R.Struct({ ok: R.Boolean }),
+			guards: [St(Te)],
+			input: L.Struct({ body: L.Struct({ id: L.String }) }),
+			output: L.Struct({ ok: L.Boolean }),
 			handler: async (t, n) => ({ ok: await e.revoke(t.body.id, qa(n).tenantId) })
 		})
 	];
@@ -3441,14 +3444,14 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 	type: "anonymous",
 	id: null,
 	tenantId: null
-}, Xa = class extends Ye.Tag("@voltro/EffectStore")() {}, Za = (e, t) => (n) => n instanceof ei ? n : new ti({
+}, Xa = class extends Xe.Tag("@voltro/EffectStore")() {}, Za = (e, t) => (n) => n instanceof ei ? n : new ti({
 	operation: e,
 	table: t,
 	cause: String(n)
-}), Qa = (e, t, n) => P.tryPromise({
+}), Qa = (e, t, n) => N.tryPromise({
 	try: n,
 	catch: Za(e, t)
-}), $a = (e) => F.succeed(Xa, {
+}), $a = (e) => P.succeed(Xa, {
 	query: ((t) => Qa("query", t.table, () => e.query(t))),
 	insert: (t, n) => Qa("insert", t, () => e.insert(t, n)),
 	update: (t, n, r) => Qa("update", t, () => e.update(t, n, r)),
@@ -3456,7 +3459,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 	hardDelete: (t, n) => Qa("hardDelete", t, () => e.hardDelete(t, n))
 }), eo = (e) => gt.make(e.name, {
 	payload: e.payloadSchema,
-	success: Le,
+	success: Re,
 	error: e.errorSchema
 }), to = (e, t) => ({
 	id: t,
@@ -3464,7 +3467,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 	executionId: t,
 	status: "running"
 }), no = to, ro = (e) => {
-	let t = N.failureOption(e), n = t._tag === "Some" ? t.value : N.squash(e);
+	let t = M.failureOption(e), n = t._tag === "Some" ? t.value : M.squash(e);
 	return {
 		tag: n && typeof n == "object" && "_tag" in n ? String(n._tag) : null,
 		message: n?.message ?? String(n)
@@ -3484,7 +3487,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 	};
 	if (typeof n == "object" && n && n._tag === "Complete") {
 		let r = n.exit;
-		return et.isSuccess(r) ? {
+		return tt.isSuccess(r) ? {
 			id: t,
 			workflowName: e,
 			executionId: t,
@@ -3536,7 +3539,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 		}
 		return n;
 	}, r = (e, t) => {
-		let n = R.validateEither(e.payloadSchema)(t);
+		let n = L.validateEither(e.payloadSchema)(t);
 		if (n._tag === "Right") return;
 		let r = typeof t == "object" && t ? Object.keys(t) : [], i = co(e.payloadSchema).filter((e) => !r.includes(e));
 		throw new oo(e.name, i, Tt.formatErrorSync(n.left));
@@ -3676,11 +3679,11 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 	};
 }, mo = (e, t) => {
 	let n = {};
-	for (let r of e) n[r.definition.name] = (e) => (t ? P.promise(() => t.start(r.definition.name, e)) : r.definition.execute(e, { discard: !0 }).pipe(P.map((e) => to(r.definition.name, e)))).pipe(P.withSpan(`workflow.${r.definition.name}`, { attributes: { "framework.kind": "workflow" } }));
+	for (let r of e) n[r.definition.name] = (e) => (t ? N.promise(() => t.start(r.definition.name, e)) : r.definition.execute(e, { discard: !0 }).pipe(N.map((e) => to(r.definition.name, e)))).pipe(N.withSpan(`workflow.${r.definition.name}`, { attributes: { "framework.kind": "workflow" } }));
 	return n;
 }, ho = (e, t, n) => e.map((e) => e.definition.toLayer(((r, i) => {
 	let a = t.resolveStartContext?.(e.definition.name, i);
-	return (a === void 0 ? P.succeed(void 0) : P.promise(() => Promise.resolve(a))).pipe(P.flatMap((a) => {
+	return (a === void 0 ? N.succeed(void 0) : N.promise(() => Promise.resolve(a))).pipe(N.flatMap((a) => {
 		let o = {
 			...a,
 			subject: a?.subject ?? Ya,
@@ -3690,8 +3693,8 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 			executionId: i,
 			parentExecutionId: a?.parentExecutionId ?? null,
 			parentClosePolicy: a?.parentClosePolicy ?? null
-		}), c = e.buildExecute(s), l = (n?.(e, c, o) ?? c)(r, i), u = F.succeed(Ne, o.subject), d = s?.store, f = d === void 0 ? l : P.provide(l, $a(d));
-		return P.provide(f, u);
+		}), c = e.buildExecute(s), l = (n?.(e, c, o) ?? c)(r, i), u = P.succeed(Pe, o.subject), d = s?.store, f = d === void 0 ? l : N.provide(l, $a(d));
+		return N.provide(f, u);
 	}));
 }))), go = (e) => ({
 	_tag: "workflowEventTrigger",
@@ -3699,32 +3702,32 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 }), _o = go, vo = (e) => typeof e == "object" && !!e && e._tag === "workflowEventTrigger", yo = () => {
 	let e = globalThis.crypto;
 	return typeof e?.randomUUID == "function" ? e.randomUUID() : `${Date.now().toString(36)}${Math.random().toString(36).slice(2)}`;
-}, bo = (e) => `${e}_${yo()}`, xo = (e) => e.id ?? `${e.event}->${e.workflow}`, So = O("_voltro_workflow_events", {
+}, bo = (e) => `${e}_${yo()}`, xo = (e) => e.id ?? `${e.event}->${e.workflow}`, So = D("_voltro_workflow_events", {
 	id: y({ prefix: "wfe" }),
-	name: k(),
-	payload: T(),
-	source: k(),
-	subject: T().nullable(),
-	traceId: k().nullable(),
-	occurredAt: A().default("now")
-}).index(["name"]).index(["source"]).index(["occurredAt"]), Co = O("_voltro_workflow_event_deliveries", {
+	name: O(),
+	payload: w(),
+	source: O(),
+	subject: w().nullable(),
+	traceId: O().nullable(),
+	occurredAt: k().default("now")
+}).index(["name"]).index(["source"]).index(["occurredAt"]), Co = D("_voltro_workflow_event_deliveries", {
 	id: y({ prefix: "wfed" }),
-	eventId: k(),
-	eventName: k(),
-	triggerId: k(),
-	workflowName: k(),
-	executionId: k().nullable(),
-	status: k().oneOf([
+	eventId: O(),
+	eventName: O(),
+	triggerId: O(),
+	workflowName: O(),
+	executionId: O().nullable(),
+	status: O().oneOf([
 		"starting",
 		"started",
 		"skipped",
 		"failed"
 	]).default("starting"),
-	idempotencyKey: k().unique(),
+	idempotencyKey: O().unique(),
 	skipped: i().default(!1),
-	errorMessage: k().nullable(),
-	createdAt: A().default("now"),
-	completedAt: A().nullable()
+	errorMessage: O().nullable(),
+	createdAt: k().default("now"),
+	completedAt: k().nullable()
 }).index(["eventId"]).index(["eventName"]).index(["triggerId"]).index(["workflowName"]).index(["status"]), wo = (e) => {
 	let t = e.makeId ?? bo, n = /* @__PURE__ */ new Map();
 	for (let t of e.triggers) {
@@ -3870,51 +3873,51 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 			triggered: m
 		};
 	} };
-}, To = M({ scope: "voltro:outbox" }), Y = "_voltro_outbox", Eo = {
+}, To = j({ scope: "voltro:outbox" }), Y = "_voltro_outbox", Eo = {
 	kind: "typeid",
 	prefix: "obx"
-}, Do = O(Y, {
+}, Do = D(Y, {
 	id: y({ prefix: "obx" }),
-	effect: k(),
-	payload: T(),
-	status: k(),
-	attempts: x(),
-	maxAttempts: x(),
-	nextAttemptAt: A(),
-	idempotencyKey: k().nullable(),
-	lastError: k().nullable(),
-	subjectId: k().nullable(),
-	tenantId: k().nullable(),
-	traceId: k().nullable(),
-	createdAt: A(),
-	deliveredAt: A().nullable(),
-	resendRequestedBy: k().nullable(),
-	resendReason: k().nullable(),
-	resendCount: x()
+	effect: O(),
+	payload: w(),
+	status: O(),
+	attempts: b(),
+	maxAttempts: b(),
+	nextAttemptAt: k(),
+	idempotencyKey: O().nullable(),
+	lastError: O().nullable(),
+	subjectId: O().nullable(),
+	tenantId: O().nullable(),
+	traceId: O().nullable(),
+	createdAt: k(),
+	deliveredAt: k().nullable(),
+	resendRequestedBy: O().nullable(),
+	resendReason: O().nullable(),
+	resendCount: b()
 }), Oo = "_voltro_outbox_attempts", ko = {
 	kind: "typeid",
 	prefix: "obxa"
-}, Ao = O(Oo, {
+}, Ao = D(Oo, {
 	id: y({ prefix: "obxa" }),
-	outboxId: k(),
-	effect: k(),
-	attempt: x(),
-	trigger: k().oneOf(["automatic", "manual"]),
-	triggeredBy: k().nullable(),
-	reason: k().nullable(),
-	outcome: k().oneOf([
+	outboxId: O(),
+	effect: O(),
+	attempt: b(),
+	trigger: O().oneOf(["automatic", "manual"]),
+	triggeredBy: O().nullable(),
+	reason: O().nullable(),
+	outcome: O().oneOf([
 		"delivered",
 		"failed",
 		"dead"
 	]),
-	startedAt: A(),
-	finishedAt: A(),
-	durationMs: x(),
-	error: k().nullable(),
-	response: T().nullable(),
-	subjectId: k().nullable(),
-	tenantId: k().nullable(),
-	traceId: k().nullable()
+	startedAt: k(),
+	finishedAt: k(),
+	durationMs: b(),
+	error: O().nullable(),
+	response: w().nullable(),
+	subjectId: O().nullable(),
+	tenantId: O().nullable(),
+	traceId: O().nullable()
 }).index(["outboxId", "attempt"]).index(["startedAt"]).index(["outcome"]), jo = (e) => {
 	if (e.effect.trim() === "") throw Error("defineOutboxHandler: `effect` must be a non-empty name");
 	if (e.maxAttempts !== void 0 && e.maxAttempts < 1) throw Error(`defineOutboxHandler("${e.effect}"): maxAttempts must be >= 1`);
@@ -4045,7 +4048,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 }, zo = async (e) => {
 	let n = (e.now ?? (() => /* @__PURE__ */ new Date()))(), r = await e.store.query({
 		table: Y,
-		predicate: t(d("status", "pending"), te("nextAttemptAt", n)),
+		predicate: t(d("status", "pending"), ne("nextAttemptAt", n)),
 		order: [{
 			column: "nextAttemptAt",
 			direction: "asc"
@@ -4122,45 +4125,45 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 		dead: o,
 		skipped: s
 	};
-}, Bo = M({ scope: "voltro:connections" }), X = "_voltro_connections", Vo = {
+}, Bo = j({ scope: "voltro:connections" }), X = "_voltro_connections", Vo = {
 	kind: "typeid",
 	prefix: "conn"
-}, Ho = O(X, {
+}, Ho = D(X, {
 	id: y({ prefix: "conn" }),
-	connectionId: k(),
-	subjectId: k(),
-	tenantId: k().nullable(),
-	kind: k().oneOf(["oauth2", "pat"]),
-	status: k().oneOf([
+	connectionId: O(),
+	subjectId: O(),
+	tenantId: O().nullable(),
+	kind: O().oneOf(["oauth2", "pat"]),
+	status: O().oneOf([
 		"connected",
 		"expired",
 		"revoked",
 		"error"
 	]),
-	accessToken: k(),
-	refreshToken: k().nullable(),
-	expiresAt: A().nullable(),
-	scopes: k().nullable(),
-	accountId: k().nullable(),
-	accountLabel: k().nullable(),
-	lastError: k().nullable(),
-	refreshLockedUntil: A(),
-	metadata: T().nullable(),
-	connectedAt: A(),
-	updatedAt: A()
+	accessToken: O(),
+	refreshToken: O().nullable(),
+	expiresAt: k().nullable(),
+	scopes: O().nullable(),
+	accountId: O().nullable(),
+	accountLabel: O().nullable(),
+	lastError: O().nullable(),
+	refreshLockedUntil: k(),
+	metadata: w().nullable(),
+	connectedAt: k(),
+	updatedAt: k()
 }).unique("byConnectionSubject", ["connectionId", "subjectId"]).index(["subjectId"]), Uo = "_voltro_connection_grants", Wo = {
 	kind: "typeid",
 	prefix: "cgrant"
-}, Go = O(Uo, {
+}, Go = D(Uo, {
 	id: y({ prefix: "cgrant" }),
-	state: k().unique(),
-	connectionId: k(),
-	subjectId: k(),
-	tenantId: k().nullable(),
-	codeVerifier: k().nullable(),
-	redirectTo: k(),
-	createdAt: A(),
-	expiresAt: A()
+	state: O().unique(),
+	connectionId: O(),
+	subjectId: O(),
+	tenantId: O().nullable(),
+	codeVerifier: O().nullable(),
+	redirectTo: O(),
+	createdAt: k(),
+	expiresAt: k()
 }).index(["expiresAt"]), Ko = /^[a-z][a-z0-9-]*$/, qo = (e) => {
 	if (!Ko.test(e.id)) throw Error(`defineConnection: id "${e.id}" must be lowercase kebab-case (it becomes a URL path segment).`);
 	if (e.kind === "oauth2") {
@@ -4173,7 +4176,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 	}
 	return e;
 }, Jo = (e) => e.label ?? e.id, Yo = (e) => {
-	if (e.length !== 0 && q() === void 0) throw Error(`connections: ${e.length} connection(s) declared (${e.map((e) => e.id).join(", ")}) but no field cipher is registered. Connection tokens are stored encrypted and there is no plaintext fallback. Enable \`@voltro/plugin-governance\` with \`governancePlugin({ fieldEncryption: { key: env.FIELD_ENCRYPTION_KEY } })\` (or call setFieldCipher at boot).`);
+	if (e.length !== 0 && K() === void 0) throw Error(`connections: ${e.length} connection(s) declared (${e.map((e) => e.id).join(", ")}) but no field cipher is registered. Connection tokens are stored encrypted and there is no plaintext fallback. Enable \`@voltro/plugin-governance\` with \`governancePlugin({ fieldEncryption: { key: env.FIELD_ENCRYPTION_KEY } })\` (or call setFieldCipher at boot).`);
 }, Xo = (e) => {
 	let t = /* @__PURE__ */ new Map();
 	for (let n of e) {
@@ -4225,8 +4228,8 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 		tenantId: e.tenantId,
 		kind: e.definition.kind,
 		status: "connected",
-		accessToken: jr(e.tokens.accessToken),
-		refreshToken: e.tokens.refreshToken === void 0 ? null : jr(e.tokens.refreshToken),
+		accessToken: q(e.tokens.accessToken),
+		refreshToken: e.tokens.refreshToken === void 0 ? null : q(e.tokens.refreshToken),
 		expiresAt: n,
 		scopes: e.tokens.scopes.length > 0 ? e.tokens.scopes.join(" ") : null,
 		accountId: e.account?.accountId ?? null,
@@ -4280,7 +4283,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 		});
 		i = n.status, a = await n.text();
 	} catch (t) {
-		throw new j({
+		throw new A({
 			connectionId: e.id,
 			reason: `token endpoint unreachable: ${String(t)}`,
 			transient: !0
@@ -4292,12 +4295,12 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 	} catch {
 		o = {};
 	}
-	if (i < 200 || i >= 300) throw new j({
+	if (i < 200 || i >= 300) throw new A({
 		connectionId: e.id,
 		reason: `token endpoint ${i}: ${o.error ?? ""} ${o.error_description ?? a.slice(0, 200)}`.trim(),
 		transient: i >= 500
 	});
-	if (typeof o.access_token != "string" || o.access_token.length === 0) throw new j({
+	if (typeof o.access_token != "string" || o.access_token.length === 0) throw new A({
 		connectionId: e.id,
 		reason: "token response carried no access_token",
 		transient: !1
@@ -4358,14 +4361,14 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 	return ms.set(o, c), c;
 }, bs = async (e) => {
 	let { store: n, subjectId: r, now: i } = e, a = e.definition, o = e.sleep ?? ps, s = a.refreshSkewMs ?? 6e4, c = e.row.id;
-	if (await n.updateMany("_voltro_connections", { refreshLockedUntil: new Date(i() + 3e4) }, { where: t(d("id", c), te("refreshLockedUntil", new Date(i()))) }) === 0) {
+	if (await n.updateMany("_voltro_connections", { refreshLockedUntil: new Date(i() + 3e4) }, { where: t(d("id", c), ne("refreshLockedUntil", new Date(i()))) }) === 0) {
 		for (let e = 0; e < 10; e++) {
 			await o(200);
 			let e = await ts(n, a.id, r);
 			if (e === void 0) throw new fs(a.id, r);
 			if (!vs(e, s, i())) return _s(a, e);
 		}
-		throw new j({
+		throw new A({
 			connectionId: a.id,
 			reason: "another replica held the refresh lease and did not publish a fresh token in time",
 			transient: !0
@@ -4377,7 +4380,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 		lastError: "access token expired and no refresh token is on file — reconnect required",
 		refreshLockedUntil: /* @__PURE__ */ new Date(0),
 		updatedAt: new Date(i())
-	}), new j({
+	}), new A({
 		connectionId: a.id,
 		reason: "access token expired and no refresh token is on file — reconnect required",
 		transient: !1
@@ -4386,7 +4389,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 	try {
 		u = await ls(a, Mr(String(l)), i);
 	} catch (e) {
-		let t = e instanceof j ? e : new j({
+		let t = e instanceof A ? e : new A({
 			connectionId: a.id,
 			reason: String(e),
 			transient: !0
@@ -4397,7 +4400,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 			refreshLockedUntil: /* @__PURE__ */ new Date(0),
 			updatedAt: new Date(i()),
 			...t.transient ? {} : {
-				accessToken: jr(""),
+				accessToken: q(""),
 				refreshToken: null,
 				expiresAt: null
 			}
@@ -4409,8 +4412,8 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 	}
 	let f = {
 		status: "connected",
-		accessToken: jr(u.accessToken),
-		...u.refreshToken === void 0 ? {} : { refreshToken: jr(u.refreshToken) },
+		accessToken: q(u.accessToken),
+		...u.refreshToken === void 0 ? {} : { refreshToken: q(u.refreshToken) },
 		expiresAt: u.expiresAt === void 0 ? null : new Date(u.expiresAt),
 		...u.scopes.length > 0 ? { scopes: u.scopes.join(" ") } : {},
 		lastError: null,
@@ -4439,7 +4442,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 		connectionId: n.id,
 		subjectId: e.subjectId,
 		tenantId: e.tenantId,
-		codeVerifier: i === null ? null : jr(i),
+		codeVerifier: i === null ? null : q(i),
 		redirectTo: Es(e.redirectTo),
 		createdAt: t,
 		expiresAt: new Date(t.getTime() + ws)
@@ -4467,20 +4470,20 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 		skip: void 0,
 		projection: void 0
 	}))[0];
-	if (n === void 0) throw new j({
+	if (n === void 0) throw new A({
 		connectionId: "unknown",
 		reason: "unknown or already-used handshake state",
 		transient: !1
 	});
 	await e.store.delete(Uo, n.id);
 	let r = String(n.connectionId), i = Zo(n.expiresAt);
-	if (i !== null && i.getTime() < t.getTime()) throw new j({
+	if (i !== null && i.getTime() < t.getTime()) throw new A({
 		connectionId: r,
 		reason: "handshake expired — start again",
 		transient: !1
 	});
 	let a = e.registry.get(r);
-	if (a === void 0 || a.kind !== "oauth2") throw new j({
+	if (a === void 0 || a.kind !== "oauth2") throw new A({
 		connectionId: r,
 		reason: "no oauth2 connection is declared under that id",
 		transient: !1
@@ -4510,7 +4513,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 }, As = async (e, t = /* @__PURE__ */ new Date()) => {
 	let n = await e.query({
 		table: Uo,
-		predicate: te("expiresAt", t),
+		predicate: ne("expiresAt", t),
 		order: [],
 		take: void 0,
 		skip: void 0,
@@ -4569,11 +4572,11 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 	};
 }, Ls = (e, t) => {
 	let n = e.request?.subject?.id ?? null;
-	if (n === null || n === "") throw new je({ connectionId: t });
+	if (n === null || n === "") throw new Me({ connectionId: t });
 	return n;
 }, Rs = (e, t) => {
 	let n = e.registry.get(t);
-	if (n === void 0) throw new Ae({ connectionId: t });
+	if (n === void 0) throw new je({ connectionId: t });
 	return n;
 }, zs = (e) => async (t, n) => {
 	let r = n.request?.subject?.id ?? null;
@@ -4591,7 +4594,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 	})) : as(n.store, e.registry, r);
 }, Bs = (e) => async (t, n) => {
 	let r = Rs(e, t.connectionId), i = Ls(n, t.connectionId);
-	if (r.kind !== "oauth2") throw new ke({
+	if (r.kind !== "oauth2") throw new Ae({
 		connectionId: t.connectionId,
 		expected: "oauth2",
 		actual: r.kind
@@ -4606,13 +4609,13 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 	});
 }, Vs = (e) => async (t, n) => {
 	let r = Rs(e, t.connectionId), i = Ls(n, t.connectionId);
-	if (r.kind !== "pat") throw new ke({
+	if (r.kind !== "pat") throw new Ae({
 		connectionId: t.connectionId,
 		expected: "pat",
 		actual: r.kind
 	});
 	let a = t.token.trim();
-	if (a.length === 0) throw new j({
+	if (a.length === 0) throw new A({
 		connectionId: t.connectionId,
 		reason: "token is empty",
 		transient: !1
@@ -4621,7 +4624,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 	if (r.validate !== void 0) try {
 		o = await r.validate(a);
 	} catch (e) {
-		throw new j({
+		throw new A({
 			connectionId: t.connectionId,
 			reason: `the provider rejected that token: ${e instanceof Error ? e.message : String(e)}`,
 			transient: !1
@@ -4642,10 +4645,10 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 	Rs(e, t.connectionId);
 	let r = Ls(n, t.connectionId);
 	return { ok: await is(n.store, t.connectionId, r) };
-}, Us = "admin:full", Ws = class extends R.TaggedError()("AccessDenied", {
-	action: R.String,
-	resourceType: R.String,
-	resourceId: R.String
+}, Us = "admin:full", Ws = class extends L.TaggedError()("AccessDenied", {
+	action: L.String,
+	resourceType: L.String,
+	resourceId: L.String
 }) {}, Gs = /* @__PURE__ */ new Map(), Ks = (e) => {
 	if (typeof e.resourceType != "string" || e.resourceType.length === 0) throw Error("defineResourcePolicy: a non-empty `resourceType` is required");
 	if (e.actions === void 0 || Object.keys(e.actions).length === 0) throw Error(`resource policy '${e.resourceType}': at least one action is required`);
@@ -4695,10 +4698,10 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 	return e.filter((e) => !n.has(e.id)).map((e) => e.id);
 }, rc = new Ct(), ic = (e) => {
 	rc.enterWith(e);
-}, ac = () => rc.getStore(), oc = (e, t) => rc.run(e, t), sc = M({ scope: "voltro:policy" }), cc, lc = (e) => {
+}, ac = () => rc.getStore(), oc = (e, t) => rc.run(e, t), sc = j({ scope: "voltro:policy" }), cc, lc = (e) => {
 	cc = e;
 }, uc = () => cc, dc = () => {
-	Ge((e) => P.gen(function* () {
+	Ke((e) => N.gen(function* () {
 		let t = qs(e.resourceType);
 		if (t === void 0) return sc.warn("policy guard denied — no resource policy registered for this type", {
 			resourceType: e.resourceType,
@@ -4709,7 +4712,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 			resourceType: e.resourceType,
 			action: e.action
 		}), !1;
-		let r = yield* P.tryPromise({
+		let r = yield* N.tryPromise({
 			try: async () => n({
 				subjectId: e.subject.id,
 				resourceType: e.resourceType,
@@ -4717,10 +4720,10 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 				load: ac()
 			}),
 			catch: (e) => e
-		}).pipe(P.catchAll((t) => (sc.error("policy guard denied — tuple source failed", {
+		}).pipe(N.catchAll((t) => (sc.error("policy guard denied — tuple source failed", {
 			resourceType: e.resourceType,
 			resourceId: e.resourceId
-		}, t), P.succeed([])))), i = e.subject;
+		}, t), N.succeed([])))), i = e.subject;
 		return $s({
 			id: e.subject.id,
 			tenantId: i.tenantId ?? null,
@@ -4746,7 +4749,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 			if (o.length > 0) {
 				let r = await e.store.query({
 					table: t,
-					predicate: b("id", o),
+					predicate: ee("id", o),
 					order: [],
 					take: void 0,
 					skip: void 0,
@@ -4783,11 +4786,11 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 		load: async (e, t) => (await o(e, [t]))[0] ?? null,
 		loadMany: (e, t) => o(e, t)
 	};
-}, mc = F.effect(ut.HttpClient, P.map(ut.HttpClient, (e) => e.pipe(ut.mapRequestEffect((e) => P.currentSpan.pipe(P.map((t) => e.headers.traceparent === void 0 ? dt.setHeader(e, "traceparent", yr({
+}, mc = P.effect(z.HttpClient, N.map(z.HttpClient, (e) => e.pipe(z.mapRequestEffect((e) => N.currentSpan.pipe(N.map((t) => e.headers.traceparent === void 0 ? dt.setHeader(e, "traceparent", br({
 	traceId: t.traceId,
 	spanId: t.spanId,
 	sampled: t.sampled
-})) : e), P.catchAll(() => P.succeed(e))))))), hc = class extends Error {
+})) : e), N.catchAll(() => N.succeed(e))))))), hc = class extends Error {
 	url;
 	reason;
 	_tag = "SsrfBlockedError";
@@ -4820,12 +4823,12 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 		return e ? yc(`${n.protocol}//${e[1]}`, t) : _c(r) ? `blocked private/reserved address ${r}` : null;
 	}
 	return null;
-}, bc = (e = {}) => F.effect(ut.HttpClient, P.map(ut.HttpClient, (t) => {
-	let n = ut.transform(t, (t, n) => P.suspend(() => {
+}, bc = (e = {}) => P.effect(z.HttpClient, N.map(z.HttpClient, (t) => {
+	let n = z.transform(t, (t, n) => N.suspend(() => {
 		let r = yc(n.url, e);
-		return r === null ? t : P.die(new hc(n.url, r));
+		return r === null ? t : N.die(new hc(n.url, r));
 	}));
-	return ut.followRedirects(n, e.maxRedirects ?? 5);
+	return z.followRedirects(n, e.maxRedirects ?? 5);
 })), xc = (e) => {
 	let t = e.now ?? Date.now, n = e.intervalMs ?? 3e4, r = e.maxPending ?? 500, i = /* @__PURE__ */ new Map(), a = !1, o = async () => {
 		if (i.size === 0) return;
@@ -4905,7 +4908,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 		insertSchema: (e) => t.get(e)?.insertSchema,
 		validatePatchSchema: (e) => t.get(e)?.validatePatchSchema
 	};
-}, Ec = /* @__PURE__ */ new Map(), Dc = /* @__PURE__ */ new Map(), Oc = /* @__PURE__ */ new Set(), kc = Tc([]), Ac = M({ scope: "store.fieldEncryption" }), jc = (e, t) => {
+}, Ec = /* @__PURE__ */ new Map(), Dc = /* @__PURE__ */ new Map(), Oc = /* @__PURE__ */ new Set(), kc = Tc([]), Ac = j({ scope: "store.fieldEncryption" }), jc = (e, t) => {
 	let n = t, r = process.env.VOLTRO_FIELD_DECRYPT_ON_ERROR === "null" ? "null" : "throw", i = /* @__PURE__ */ new Set(), a = (e) => {
 		let t = `${e.table}.${e.column}`;
 		i.has(t) || (i.add(t), Ac.warn("encrypted column degraded to null — could not decrypt with the active key", {
@@ -4916,9 +4919,9 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 		}));
 	}, o = (e, t) => {
 		let r = h(e);
-		return u(n ? de(t, r, n) : t, r, q());
+		return u(n ? fe(t, r, n) : t, r, K());
 	}, s = (e, t) => {
-		let i = h(e), o = c(t, i, q(), {
+		let i = h(e), o = c(t, i, K(), {
 			onError: r,
 			...r === "null" ? { warn: a } : {}
 		});
@@ -4952,7 +4955,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 	for (let e of t) delete n[e];
 	return n;
 }, Nc = (e, t) => {
-	let n = h(e), r = n === void 0 ? [] : fe(n);
+	let n = h(e), r = n === void 0 ? [] : pe(n);
 	return r.length === 0 ? t ?? [] : t === void 0 ? r : [...t, ...r];
 }, Pc = (e, t) => t.length === 0 ? e : e.map((e) => Mc(e, t)), Fc = (e, t, n, r, i) => {
 	let a = {
@@ -5081,30 +5084,30 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 	table: t
 })) : [], Wc = (e) => {
 	if (e.length !== 0) return `A cached query shares one entry across tenants:\n${e.map((e) => `  • query '${e.query}' caches scope:'global' while reading '${e.table}', a tenant()-scoped table`).join("\n")}\n\nscope:'global' stores ONE entry for every caller. On a tenant-scoped table the\nrows depend on who asked, so the first caller's rows are served to the next one.\n\nUse scope:'tenant' — one entry per org, none shared across orgs. Use 'subject'\nif the result also depends on WHICH person is asking, and 'global' only for data\nthat depends on neither.`;
-}, Gc = class extends R.TaggedError()("CircuitOpen", {
-	name: R.String,
-	retryAfterMs: R.Number
+}, Gc = class extends L.TaggedError()("CircuitOpen", {
+	name: L.String,
+	retryAfterMs: L.Number
 }) {}, Kc = {
 	tag: "closed",
 	failureCount: 0,
 	halfOpenSuccesses: 0,
 	openedAt: 0
-}, qc = { make: (e) => P.gen(function* () {
-	let t = e.name ?? "circuit", n = Qe.toMillis(Qe.decode(e.resetTimeout)), r = e.halfOpenSuccessThreshold ?? 1, i = e.isFailure ?? (() => !0), a = yield* L.make(Kc), o = P.gen(function* () {
-		let e = yield* L.get(a);
+}, qc = { make: (e) => N.gen(function* () {
+	let t = e.name ?? "circuit", n = $e.toMillis($e.decode(e.resetTimeout)), r = e.halfOpenSuccessThreshold ?? 1, i = e.isFailure ?? (() => !0), a = yield* I.make(Kc), o = N.gen(function* () {
+		let e = yield* I.get(a);
 		if (e.tag === "half-open") {
 			let t = e.halfOpenSuccesses + 1;
-			yield* L.set(a, t >= r ? Kc : {
+			yield* I.set(a, t >= r ? Kc : {
 				...e,
 				halfOpenSuccesses: t
 			});
 			return;
 		}
-		e.failureCount !== 0 && (yield* L.set(a, Kc));
-	}), s = P.gen(function* () {
-		let t = yield* Je.currentTimeMillis, n = yield* L.get(a);
+		e.failureCount !== 0 && (yield* I.set(a, Kc));
+	}), s = N.gen(function* () {
+		let t = yield* Ye.currentTimeMillis, n = yield* I.get(a);
 		if (n.tag === "half-open" || n.tag === "open") {
-			yield* L.set(a, {
+			yield* I.set(a, {
 				tag: "open",
 				failureCount: e.failureThreshold,
 				halfOpenSuccesses: 0,
@@ -5113,7 +5116,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 			return;
 		}
 		let r = n.failureCount + 1;
-		yield* L.set(a, r >= e.failureThreshold ? {
+		yield* I.set(a, r >= e.failureThreshold ? {
 			tag: "open",
 			failureCount: r,
 			halfOpenSuccesses: 0,
@@ -5122,32 +5125,32 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 			...n,
 			failureCount: r
 		});
-	}), c = P.gen(function* () {
-		let e = yield* L.get(a);
+	}), c = N.gen(function* () {
+		let e = yield* I.get(a);
 		if (e.tag !== "open") return null;
-		let t = (yield* Je.currentTimeMillis) - e.openedAt;
-		return t >= n ? (yield* L.set(a, {
+		let t = (yield* Ye.currentTimeMillis) - e.openedAt;
+		return t >= n ? (yield* I.set(a, {
 			tag: "half-open",
 			failureCount: 0,
 			halfOpenSuccesses: 0,
 			openedAt: e.openedAt
 		}), null) : n - t;
-	}), l = (e) => P.gen(function* () {
+	}), l = (e) => N.gen(function* () {
 		let n = yield* c;
-		return n === null ? yield* e.pipe(P.tap(() => o), P.tapErrorCause((e) => {
-			if (N.isInterruptedOnly(e)) return P.void;
-			let t = N.failureOption(e), n = t._tag === "Some" ? t.value : void 0;
-			return i(n) ? s : P.void;
-		})) : yield* P.fail(new Gc({
+		return n === null ? yield* e.pipe(N.tap(() => o), N.tapErrorCause((e) => {
+			if (M.isInterruptedOnly(e)) return N.void;
+			let t = M.failureOption(e), n = t._tag === "Some" ? t.value : void 0;
+			return i(n) ? s : N.void;
+		})) : yield* N.fail(new Gc({
 			name: t,
 			retryAfterMs: n
 		}));
 	}), u = ((e) => l(e));
 	return Object.defineProperty(u, "state", {
-		value: L.get(a).pipe(P.map((e) => e.tag)),
+		value: I.get(a).pipe(N.map((e) => e.tag)),
 		enumerable: !0
 	}), Object.defineProperty(u, "reset", {
-		value: L.set(a, Kc),
+		value: I.set(a, Kc),
 		enumerable: !0
 	}), u;
 }) }, Jc, Yc = (e) => {
@@ -5155,7 +5158,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 }, Xc = () => {
 	Jc = void 0;
 }, Zc = () => Jc, Qc = async (e, t = {}) => {
-	let n = t.scopes === void 0 ? Ke(t.id ?? "system") : Ke(t.id ?? "system", t.scopes), r = t.store ?? Jc?.dataStore, i = t.schemaRegistry ?? Jc?.schemaRegistry, a = t.dialect ?? Jc?.dialect;
+	let n = t.scopes === void 0 ? qe(t.id ?? "system") : qe(t.id ?? "system", t.scopes), r = t.store ?? Jc?.dataStore, i = t.schemaRegistry ?? Jc?.schemaRegistry, a = t.dialect ?? Jc?.dialect;
 	if (r === void 0 || i === void 0) throw Error("runAsSystem: no data store available — register one at boot via setSystemStoreHandle({ dataStore, schemaRegistry }) or pass { store, schemaRegistry } in the options.");
 	return e({
 		subject: n,
@@ -5231,8 +5234,8 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 		}
 	};
 }, nl = Symbol.for("@voltro/ScheduleDefinition"), rl = (e) => typeof e == "object" && !!e && nl in e, il = 30 * 6e4, al = (e) => {
-	let t = Xe.parse(e.cron, e.timezone);
-	if ($e.isLeft(t)) throw Error(`defineSchedule("${e.name}"): invalid cron expression "${e.cron}" (tz="${e.timezone}") — ${String(t.left)}`);
+	let t = Ze.parse(e.cron, e.timezone);
+	if (et.isLeft(t)) throw Error(`defineSchedule("${e.name}"): invalid cron expression "${e.cron}" (tz="${e.timezone}") — ${String(t.left)}`);
 	if (!e.timezone || e.timezone.trim() === "") throw Error(`defineSchedule("${e.name}"): timezone is required (e.g. "UTC", "Europe/Berlin")`);
 	if (e.handler === void 0 && e.workflow === void 0) throw Error(`defineSchedule("${e.name}"): define either handler or workflow`);
 	return {
@@ -5242,7 +5245,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 		maxRuntimeMs: e.maxRuntimeMs ?? il,
 		[nl]: !0
 	};
-}, ol = (e) => Xe.unsafeParse(e.cron, e.timezone), sl = (e, t = /* @__PURE__ */ new Date()) => Xe.next(ol(e), t), Z = "_voltro_wakeups", cl = (e) => `${e.tenantId}:${e.kind}:${e.refId}`, ll = (e) => ({
+}, ol = (e) => Ze.unsafeParse(e.cron, e.timezone), sl = (e, t = /* @__PURE__ */ new Date()) => Ze.next(ol(e), t), Z = "_voltro_wakeups", cl = (e) => `${e.tenantId}:${e.kind}:${e.refId}`, ll = (e) => ({
 	tenantId: String(e.tenantId),
 	kind: String(e.kind),
 	refId: String(e.refId),
@@ -5351,7 +5354,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 		s?.(e, Al(t));
 	}, _ = async (e, t, r, i, s, c) => {
 		try {
-			let o = `sr_${xe()}`, l = await n.insert(Dl, {
+			let o = `sr_${Se()}`, l = await n.insert(Dl, {
 				id: o,
 				name: e.name,
 				status: i,
@@ -5409,7 +5412,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 				reason: Q(t)
 			}), !1;
 		}
-	}, b = async (e, t, n, r) => {
+	}, ee = async (e, t, n, r) => {
 		let a = /* @__PURE__ */ new Date(), s = await _(e, t, a, "running", n, r), l = Date.now(), u, d = new Promise((t, n) => {
 			u = setTimeout(() => n(/* @__PURE__ */ Error(`schedule "${e.name}" exceeded maxRuntimeMs=${e.maxRuntimeMs}`)), e.maxRuntimeMs);
 		}), f = {
@@ -5464,7 +5467,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 				timeout: n,
 				...on(t)
 			};
-			o.error ? o.error("schedule: handler failed", a) : o.warn("schedule: handler failed", a), Ue({
+			o.error ? o.error("schedule: handler failed", a) : o.warn("schedule: handler failed", a), We({
 				error: t,
 				source: "schedule",
 				name: e.name,
@@ -5477,9 +5480,9 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 			u && clearTimeout(u);
 		}
 		return s;
-	}, x = async (e, t, n, r) => {
+	}, b = async (e, t, n, r) => {
 		if (n !== "manual" && e.onOverlap === "queue") {
-			let i = (p.get(e.name) ?? Promise.resolve()).then(() => S(e, t, n, r));
+			let i = (p.get(e.name) ?? Promise.resolve()).then(() => x(e, t, n, r));
 			return p.set(e.name, i.catch(() => {})), i;
 		}
 		if (n !== "manual" && e.onOverlap === "skip" && (f.has(e.name) || await y(e.name))) {
@@ -5489,8 +5492,8 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 				scope: f.has(e.name) ? "local" : "cluster"
 			}), i;
 		}
-		return S(e, t, n, r);
-	}, S = async (e, t, n, i) => {
+		return x(e, t, n, r);
+	}, x = async (e, t, n, i) => {
 		let a;
 		if (i !== void 0) a = i;
 		else if (n === "manual") a = "single";
@@ -5507,13 +5510,13 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 		}
 		f.add(e.name);
 		try {
-			return await b(e, t, n, a);
+			return await ee(e, t, n, a);
 		} finally {
 			f.delete(e.name);
 		}
-	}, C = async (e) => {
+	}, S = async (e) => {
 		try {
-			let t = Xe.next(ol(e), /* @__PURE__ */ new Date());
+			let t = Ze.next(ol(e), /* @__PURE__ */ new Date());
 			await ul(n, {
 				tenantId: u,
 				kind: "schedule",
@@ -5526,26 +5529,26 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 				reason: Q(t)
 			});
 		}
-	}, w = 2147483647, T = (e) => {
+	}, C = 2147483647, w = (e) => {
 		if (m) return;
-		let n = ol(e), r = Xe.next(n, /* @__PURE__ */ new Date()), i = () => {
+		let n = ol(e), r = Ze.next(n, /* @__PURE__ */ new Date()), i = () => {
 			if (m) return;
 			let n = r.getTime() - Date.now();
-			if (n > w) {
-				let t = setTimeout(i, w);
+			if (n > C) {
+				let t = setTimeout(i, C);
 				d.set(e.name, t);
 				return;
 			}
 			let a = setTimeout(() => {
-				x(e, r, e.trigger ?? t.defaultTrigger).catch((t) => o.warn("schedule: fire rejected", {
+				b(e, r, e.trigger ?? t.defaultTrigger).catch((t) => o.warn("schedule: fire rejected", {
 					name: e.name,
 					reason: Q(t)
-				})).finally(() => T(e));
+				})).finally(() => w(e));
 			}, Math.max(0, n));
 			d.set(e.name, a);
 		};
 		i();
-	}, ee = async (e) => {
+	}, te = async (e) => {
 		if (e.backfill === "skip") return;
 		let r;
 		try {
@@ -5569,8 +5572,8 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 			return;
 		}
 		if (!r) return;
-		let i = ol(e), a = [], s = Xe.next(i, r), c = Date.now();
-		for (; s.getTime() < c && a.length < 1e3;) a.push(s), s = Xe.next(i, s);
+		let i = ol(e), a = [], s = Ze.next(i, r), c = Date.now();
+		for (; s.getTime() < c && a.length < 1e3;) a.push(s), s = Ze.next(i, s);
 		if (a.length !== 0) if (o.info("schedule: backfill", {
 			name: e.name,
 			missed: a.length,
@@ -5578,35 +5581,35 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 		}), e.backfill === "latest") {
 			for (let n of a.slice(0, -1)) await _(e, n, null, "missed", e.trigger ?? t.defaultTrigger, "single");
 			let n = a[a.length - 1];
-			await x(e, n, e.trigger ?? t.defaultTrigger);
-		} else for (let n of a) await x(e, n, e.trigger ?? t.defaultTrigger);
-	}, E = e.filter((e) => (e.trigger ?? t.defaultTrigger) === "self");
+			await b(e, n, e.trigger ?? t.defaultTrigger);
+		} else for (let n of a) await b(e, n, e.trigger ?? t.defaultTrigger);
+	}, T = e.filter((e) => (e.trigger ?? t.defaultTrigger) === "self");
 	o.info("scheduler: starting", {
 		total: e.length,
-		self: E.length,
-		external: e.length - E.length,
+		self: T.length,
+		external: e.length - T.length,
 		coordinator: r.kind
 	});
-	let te = (t.armSelf ?? !0) && !l;
+	let ne = (t.armSelf ?? !0) && !l;
 	if (l) {
-		o.info("scheduler: sleep mode — registering wakeups, not arming timers", { count: E.length });
-		for (let e of E) await C(e);
-	} else if (te) {
-		for (let e of E) await ee(e);
-		for (let e of E) T(e);
+		o.info("scheduler: sleep mode — registering wakeups, not arming timers", { count: T.length });
+		for (let e of T) await S(e);
+	} else if (ne) {
+		for (let e of T) await te(e);
+		for (let e of T) w(e);
 	}
 	return {
 		fireNow: async (e, t) => {
 			let n = h.get(e);
 			if (!n) throw Error(`scheduler.fireNow: unknown schedule "${e}"`);
-			let r = await x(n, /* @__PURE__ */ new Date(), t);
-			return l && await C(n), r;
+			let r = await b(n, /* @__PURE__ */ new Date(), t);
+			return l && await S(n), r;
 		},
 		fireFromCluster: async (e) => {
 			let t = h.get(e);
 			if (!t) throw Error(`scheduler.fireFromCluster: unknown schedule "${e}"`);
-			let n = await x(t, /* @__PURE__ */ new Date(), "self", "cluster");
-			return l && await C(t), n;
+			let n = await b(t, /* @__PURE__ */ new Date(), "self", "cluster");
+			return l && await S(t), n;
 		},
 		shutdown: async () => {
 			m = !0;
@@ -5648,77 +5651,77 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 			i || (i = !0, a && clearInterval(a), a = void 0);
 		}
 	};
-}, Ml = (e) => (t, n, r) => jl(t, n, r, e), Nl = O("_voltro_schedule_runs", {
+}, Ml = (e) => (t, n, r) => jl(t, n, r, e), Nl = D("_voltro_schedule_runs", {
 	id: y({ prefix: "schrun" }),
-	name: k(),
-	status: k().oneOf([
+	name: O(),
+	status: O().oneOf([
 		"running",
 		"succeeded",
 		"failed",
 		"skipped",
 		"missed"
 	]).default("running"),
-	trigger: k().oneOf([
+	trigger: O().oneOf([
 		"self",
 		"external",
 		"manual"
 	]).default("self"),
-	scheduledAt: A(),
-	firedAt: A().nullable(),
-	completedAt: A().nullable(),
-	durationMs: x().nullable(),
-	errorTag: k().nullable(),
-	errorMessage: k().nullable(),
-	coordinationOutcome: k().oneOf([
+	scheduledAt: k(),
+	firedAt: k().nullable(),
+	completedAt: k().nullable(),
+	durationMs: b().nullable(),
+	errorTag: O().nullable(),
+	errorMessage: O().nullable(),
+	coordinationOutcome: O().oneOf([
 		"single",
 		"wonLock",
 		"lostLock",
 		"external",
 		"cluster"
 	]).nullable(),
-	replicaId: k().nullable(),
-	result: T().nullable()
-}).index(["name", "scheduledAt"]).index(["status"]), Pl = O("_voltro_schedule_claims", {
+	replicaId: O().nullable(),
+	result: w().nullable()
+}).index(["name", "scheduledAt"]).index(["status"]), Pl = D("_voltro_schedule_claims", {
 	id: y({ prefix: "schclaim" }),
-	scheduleName: k(),
-	bucket: k(),
-	claimedBy: k(),
-	claimedAt: A()
-}).index(["scheduleName", "bucket"]).index(["claimedAt"]), Fl = O("_voltro_traces", {
+	scheduleName: O(),
+	bucket: O(),
+	claimedBy: O(),
+	claimedAt: k()
+}).index(["scheduleName", "bucket"]).index(["claimedAt"]), Fl = D("_voltro_traces", {
 	id: y({ prefix: "span" }),
-	traceId: k(),
-	spanId: k(),
-	parentSpanId: k().nullable(),
-	name: k(),
-	kind: k().oneOf([
+	traceId: O(),
+	spanId: O(),
+	parentSpanId: O().nullable(),
+	name: O(),
+	kind: O().oneOf([
 		"internal",
 		"server",
 		"client",
 		"producer",
 		"consumer"
 	]).default("internal"),
-	status: k().oneOf([
+	status: O().oneOf([
 		"ok",
 		"error",
 		"unset"
 	]).default("unset"),
-	statusMessage: k().nullable(),
-	startedAt: A(),
-	endedAt: A(),
-	durationMs: x(),
-	attributes: T().nullable(),
-	events: T().nullable()
-}).index(["traceId", "startedAt"]).index(["startedAt"]).index(["status"]), Il = O("_voltro_undo_log", {
+	statusMessage: O().nullable(),
+	startedAt: k(),
+	endedAt: k(),
+	durationMs: b(),
+	attributes: w().nullable(),
+	events: w().nullable()
+}).index(["traceId", "startedAt"]).index(["startedAt"]).index(["status"]), Il = D("_voltro_undo_log", {
 	id: y({ prefix: "undo" }),
-	tag: k(),
-	label: k().nullable(),
-	subjectId: k().nullable(),
-	tenantId: k().nullable(),
-	traceId: k().nullable(),
-	changes: k(),
+	tag: O(),
+	label: O().nullable(),
+	subjectId: O().nullable(),
+	tenantId: O().nullable(),
+	traceId: O().nullable(),
+	changes: O(),
 	crossesAction: i().default(!1),
 	undone: i().default(!1),
-	createdAt: A().default("now")
+	createdAt: k().default("now")
 }).index(["subjectId", "createdAt"]), Ll = (e = process.env) => {
 	let t = (e.VOLTRO_UNDO ?? "").toLowerCase();
 	return t === "on" || t === "1" || t === "true" ? !0 : t === "off" || t === "0" || t === "false" ? !1 : e.NODE_ENV !== "production";
@@ -5927,20 +5930,20 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 	}));
 }, ru = async (e, t) => {
 	let n = await $l(t.store, "_voltro_undo_log", e.invocationId);
-	if (!n) throw new Ie({ invocationId: e.invocationId });
-	if ((n.subjectId ?? null) !== Zl(t)) throw new Fe({ invocationId: e.invocationId });
+	if (!n) throw new Le({ invocationId: e.invocationId });
+	if ((n.subjectId ?? null) !== Zl(t)) throw new Ie({ invocationId: e.invocationId });
 	return n;
 }, iu = async (e, t) => {
 	let n = await ru(e, t);
 	if (Ql(n.undone)) return { ok: !0 };
-	if (Ql(n.crossesAction)) throw new Pe({
+	if (Ql(n.crossesAction)) throw new Fe({
 		invocationId: e.invocationId,
 		reason: "action"
 	});
 	let r = eu(n.changes);
 	for (let n of r) {
 		let r = tu(n);
-		if (r !== void 0 && !Kl(await $l(t.store, n.table, r), n.next ?? null)) throw new Pe({
+		if (r !== void 0 && !Kl(await $l(t.store, n.table, r), n.next ?? null)) throw new Fe({
 			invocationId: e.invocationId,
 			reason: "conflict"
 		});
@@ -6193,14 +6196,14 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 		for (let r of t) n[r] = e[r];
 		return n;
 	}
-}, Du = O("_voltro_rebac_tuples", {
+}, Du = D("_voltro_rebac_tuples", {
 	id: y({ prefix: "rbct" }),
-	subjectId: k(),
-	relation: k(),
-	resourceType: k(),
-	resourceId: k(),
-	tenantId: k().nullable(),
-	createdAt: A().default("now")
+	subjectId: O(),
+	relation: O(),
+	resourceType: O(),
+	resourceId: O(),
+	tenantId: O().nullable(),
+	createdAt: k().default("now")
 }).index([
 	"subjectId",
 	"resourceType",
@@ -6226,7 +6229,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 	return (r, i) => {
 		let a = e[i.tag];
 		if (a === void 0) return r;
-		let o = n(a.resourceType), s = (e) => P.fail(new Ws({
+		let o = n(a.resourceType), s = (e) => N.fail(new Ws({
 			action: a.action,
 			resourceType: a.resourceType,
 			resourceId: e
@@ -6239,7 +6242,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 			id: c,
 			tenantId: i.subject.tenantId
 		};
-		return P.flatMap(P.promise(async () => t.loadTuples(l.id, a.resourceType, c)), (e) => $s(l, a.action, u, {
+		return N.flatMap(N.promise(async () => t.loadTuples(l.id, a.resourceType, c)), (e) => $s(l, a.action, u, {
 			policy: o,
 			tuples: e
 		}) ? r : s(c));
@@ -6296,13 +6299,13 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 		id: a,
 		via: "agent"
 	}), await n.dedupe.add(r), "acted");
-}, Ru = O("_voltro_wakeups", {
+}, Ru = D("_voltro_wakeups", {
 	id: y({ prefix: "wakeup" }),
-	tenantId: k(),
-	kind: k(),
-	refId: k(),
-	wakeAt: A(),
-	status: k()
+	tenantId: O(),
+	kind: O(),
+	refId: O(),
+	wakeAt: k(),
+	status: O()
 }).index(["status", "wakeAt"]).index(["tenantId"]), zu = async (e) => {
 	let t = e.now?.() ?? /* @__PURE__ */ new Date(), n = await vl(e.store, t, e.batchLimit ?? 100);
 	if (n.length === 0) return 0;
@@ -6424,7 +6427,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 		openConnections: () => t
 	};
 }, qu = (e) => ({ run: async (t) => (e.onActivity?.(), await e.ensureAwake(), t()) }), Ju = (e, t, n, r) => new Promise((i, a) => {
-	let o = ct.request({
+	let o = lt.request({
 		host: n,
 		port: r,
 		method: e.method,
@@ -6435,7 +6438,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 	});
 	o.on("error", a), e.pipe(o);
 }), Yu = (e, t, n, r, i) => new Promise((a, o) => {
-	let s = ct.request({
+	let s = lt.request({
 		host: r,
 		port: i,
 		method: e.method,
@@ -6453,7 +6456,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 	let t = qu({
 		ensureAwake: () => e.supervisor.start(),
 		...e.onActivity === void 0 ? {} : { onActivity: e.onActivity }
-	}), n = e.activity, r = ct.createServer((r, i) => {
+	}), n = e.activity, r = lt.createServer((r, i) => {
 		n?.onRequestStart(), i.on("close", () => n?.onRequestEnd()), t.run(() => Ju(r, i, e.targetHost, e.targetPort)).catch((t) => {
 			e.log?.warn("wake-router: proxy failed", { reason: t instanceof Error ? t.message : String(t) }), i.headersSent || i.writeHead(502), i.end("wake/proxy failed");
 		});
@@ -6545,14 +6548,14 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 			l = !0, u !== void 0 && clearTimeout(u), await new Promise((e) => s.close(() => e()));
 		}
 	};
-}, ed = (e) => e, td = class extends R.TaggedError()("AnalyticsError", {
-	provider: R.String,
-	operation: R.String,
-	cause: R.String
-}) {}, nd = class extends R.TaggedError()("AnalyticsCapabilityNotSupported", {
-	provider: R.String,
-	capability: R.String
-}) {}, rd = class extends Ye.Tag("@voltro/AnalyticsSink")() {}, id = (e, t) => ({
+}, ed = (e) => e, td = class extends L.TaggedError()("AnalyticsError", {
+	provider: L.String,
+	operation: L.String,
+	cause: L.String
+}) {}, nd = class extends L.TaggedError()("AnalyticsCapabilityNotSupported", {
+	provider: L.String,
+	capability: L.String
+}) {}, rd = class extends Xe.Tag("@voltro/AnalyticsSink")() {}, id = (e, t) => ({
 	info: e.info,
 	track: (n) => e.track(n.tenantId === void 0 ? {
 		...n,
@@ -6571,14 +6574,14 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 		tenantId: t
 	} : n),
 	...e.mirror === void 0 ? {} : { mirror: e.mirror }
-}), ad = () => P.gen(function* () {
-	let e = yield* rd, t = yield* P.serviceOption(Ne), n = at.match(t, {
+}), ad = () => N.gen(function* () {
+	let e = yield* rd, t = yield* N.serviceOption(Pe), n = ot.match(t, {
 		onNone: () => null,
 		onSome: (e) => e.tenantId ?? null
 	});
 	return n === null ? e : id(e, n);
 }), od = "noop", sd = () => {
-	let e = (e) => P.fail(new nd({
+	let e = (e) => N.fail(new nd({
 		provider: od,
 		capability: e
 	}));
@@ -6593,7 +6596,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 				mirror: !1
 			}
 		},
-		track: () => P.void,
+		track: () => N.void,
 		aggregate: () => e("aggregate"),
 		timeseries: () => e("timeseries"),
 		topN: () => e("topN")
@@ -6611,22 +6614,22 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 			mirror: e.some((e) => e.info.capabilities.mirror)
 		},
 		detail: { members: e.map((e) => e.info) }
-	}, n = (t) => P.forEach(e, (e) => e.track(t).pipe(P.catchAll((t) => P.logWarning(`analytics-sink ${e.info.provider} track failed`, { err: t }))), {
+	}, n = (t) => N.forEach(e, (e) => e.track(t).pipe(N.catchAll((t) => N.logWarning(`analytics-sink ${e.info.provider} track failed`, { err: t }))), {
 		concurrency: "unbounded",
 		discard: !0
 	}), r = (t, n) => {
 		let r = e.find((e) => e.info.capabilities[t]);
-		return r === void 0 ? P.fail(new nd({
+		return r === void 0 ? N.fail(new nd({
 			provider: "compose",
 			capability: t
 		})) : n(r);
 	}, i = e.filter((e) => e.mirror !== void 0), a = i.length === 0 ? void 0 : {
 		tables: Array.from(new Set(i.flatMap((e) => e.mirror.tables))),
-		upsert: (e, t) => P.forEach(i.filter((t) => t.mirror.tables.includes(e)), (n) => n.mirror.upsert(e, t), {
+		upsert: (e, t) => N.forEach(i.filter((t) => t.mirror.tables.includes(e)), (n) => n.mirror.upsert(e, t), {
 			concurrency: "unbounded",
 			discard: !0
 		}),
-		remove: (e, t) => P.forEach(i.filter((t) => t.mirror.tables.includes(e)), (n) => n.mirror.remove(e, t), {
+		remove: (e, t) => N.forEach(i.filter((t) => t.mirror.tables.includes(e)), (n) => n.mirror.remove(e, t), {
 			concurrency: "unbounded",
 			discard: !0
 		})
@@ -6645,11 +6648,11 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 		kind: "compose",
 		build: (t) => cd(e.map((e) => e.build(t))),
 		tables: e.flatMap((e) => e.tables ?? []),
-		initialize: (t) => P.forEach(e, (e) => e.initialize ? e.initialize(t) : P.void, {
+		initialize: (t) => N.forEach(e, (e) => e.initialize ? e.initialize(t) : N.void, {
 			concurrency: 1,
 			discard: !0
 		}),
-		...t.length > 0 ? { dispose: (e) => P.forEach(t, (t) => t.dispose(e), {
+		...t.length > 0 ? { dispose: (e) => N.forEach(t, (t) => t.dispose(e), {
 			concurrency: 1,
 			discard: !0
 		}) } : {}
@@ -6663,18 +6666,18 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 }, fd = (e) => {
 	let { store: t, sink: n, log: r } = e, i = n.mirror;
 	if (i === void 0 || i.tables.length === 0) return dd;
-	let a = e.run ?? ((e) => P.runPromise(e)), o = i.primaryKey ?? "id", s = new Set(i.tables), c = (e) => {
+	let a = e.run ?? ((e) => N.runPromise(e)), o = i.primaryKey ?? "id", s = new Set(i.tables), c = (e) => {
 		if (e.op === "delete") {
 			let t = e.old;
-			if (t === null) return P.void;
+			if (t === null) return N.void;
 			let n = t[o];
-			return n === void 0 ? P.void : i.remove(e.table, n);
+			return n === void 0 ? N.void : i.remove(e.table, n);
 		}
 		let t = e.new;
-		return t === null ? P.void : i.upsert(e.table, t);
+		return t === null ? N.void : i.upsert(e.table, t);
 	}, l = t.onChange((e) => {
 		if (!s.has(e.table)) return;
-		let t = c(e).pipe(P.catchAll((t) => P.sync(() => r.warn("analytics-mirror: change forward failed", {
+		let t = c(e).pipe(N.catchAll((t) => N.sync(() => r.warn("analytics-mirror: change forward failed", {
 			provider: n.info.provider,
 			table: e.table,
 			op: e.op,
@@ -6712,15 +6715,15 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 		build: e.build,
 		...e.incremental === void 0 ? {} : { incremental: e.incremental }
 	};
-}, md = (e) => typeof e == "object" && !!e && e._voltroAggregate === !0, hd = class extends R.TaggedError()("AggregateStale", {
-	name: R.String,
-	ageMs: R.Number,
-	maxAgeMs: R.Number
-}) {}, gd = class extends R.TaggedError()("AggregateNotFound", { name: R.String }) {}, _d = class extends R.TaggedError()("AggregateError", {
-	name: R.String,
-	operation: R.String,
-	cause: R.String
-}) {}, vd = class extends Ye.Tag("@voltro/AggregateRegistry")() {}, yd = (e) => P.gen(function* () {
+}, md = (e) => typeof e == "object" && !!e && e._voltroAggregate === !0, hd = class extends L.TaggedError()("AggregateStale", {
+	name: L.String,
+	ageMs: L.Number,
+	maxAgeMs: L.Number
+}) {}, gd = class extends L.TaggedError()("AggregateNotFound", { name: L.String }) {}, _d = class extends L.TaggedError()("AggregateError", {
+	name: L.String,
+	operation: L.String,
+	cause: L.String
+}) {}, vd = class extends Xe.Tag("@voltro/AggregateRegistry")() {}, yd = (e) => N.gen(function* () {
 	return (yield* vd).getHandle(e);
 }), bd = (e, n, r) => {
 	if (e.crossTenant || !n.has(e.table) || r == null) return e;
@@ -6731,21 +6734,21 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 	};
 }, xd = (e, t, n) => n === "" && !e.crossTenant && t.has(e.table), Sd = (e) => e?.type === "user" && e.tenantId === "", Cd = (e, n) => {
 	if (e.includeDeleted || !n.has(e.table)) return e;
-	let r = C("deletedAt");
+	let r = S("deletedAt");
 	return {
 		...e,
 		predicate: e.predicate ? t(e.predicate, r) : r
 	};
-}, wd = (e, t) => t, Td = (e) => P.runPromiseExit(e).then((e) => {
-	if (et.isSuccess(e)) return e.value;
-	let t = N.failureOption(e.cause);
-	throw at.isSome(t) ? t.value : N.squash(e.cause);
-}), Ed = (e, t) => e.pipe(P.provideService(Ne, t)), Dd = async (e, t, n) => {
-	let r = await P.runPromise(Re(t, e.guards, n));
+}, wd = (e, t) => t, Td = (e) => N.runPromiseExit(e).then((e) => {
+	if (tt.isSuccess(e)) return e.value;
+	let t = M.failureOption(e.cause);
+	throw ot.isSome(t) ? t.value : M.squash(e.cause);
+}), Ed = (e, t) => e.pipe(N.provideService(Pe, t)), Dd = async (e, t, n) => {
+	let r = await N.runPromise(ze(t, e.guards, n));
 	if (r) throw r;
 }, Od = async (e) => {
-	if (Gn() === void 0) return e;
-	let t = await Td(qn(e.subject, (e) => {
+	if (Kn() === void 0) return e;
+	let t = await Td(Jn(e.subject, (e) => {
 		console.error("[voltro] row filter failed to load", e);
 	}));
 	return {
@@ -6756,7 +6759,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 	let t = `${e.kind}.${e.name}`, n = Date.now(), r = "ok";
 	try {
 		if (e.interceptor) {
-			let t = P.tryPromise({
+			let t = N.tryPromise({
 				try: () => e.runExecutor(),
 				catch: (e) => e
 			}), n = e.interceptor(t, {
@@ -6766,9 +6769,9 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 				subject: e.requestContext.subject,
 				traceId: e.requestContext.traceId,
 				...e.requestContext.spanId === void 0 ? {} : { spanId: e.requestContext.spanId }
-			}), r = await P.runPromiseExit(n);
-			if (et.isSuccess(r)) return r.value;
-			throw N.squash(r.cause);
+			}), r = await N.runPromiseExit(n);
+			if (tt.isSuccess(r)) return r.value;
+			throw M.squash(r.cause);
 		}
 		return await e.runExecutor();
 	} catch (e) {
@@ -6814,7 +6817,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 		let i = await Od(r), a = [], o = await Fd(async () => (a.length = 0, e.store.transactional(async (o) => {
 			let s = e.undoCapture?.(o), c = s ? s.tx : o, l = e.buildContext(i, c, { afterCommit: (e) => {
 				a.push(e);
-			} }), u = t.executor(n, l), d = P.isEffect(u) ? await e.runEffect(Ed(u, r.subject), l.store) : await u;
+			} }), u = t.executor(n, l), d = N.isEffect(u) ? await e.runEffect(Ed(u, r.subject), l.store) : await u;
 			return s && await s.persist(l.store, {
 				tag: t.descriptor.name,
 				subject: r.subject,
@@ -6829,13 +6832,13 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 	return t == null ? [] : typeof t == "string" ? [t] : [...t];
 }, Bd = (e, t) => (n) => () => {
 	let r = e.descriptor.guards;
-	return !r || r.length === 0 ? Promise.resolve(null) : P.runPromise(Re(n, r, t));
+	return !r || r.length === 0 ? Promise.resolve(null) : N.runPromise(ze(n, r, t));
 }, Vd = (e) => (t, n) => (r) => {
 	let i = e.buildContext(r), a = Bd(t, n)(r.subject), o = async () => {
 		let i = await a();
 		if (i) throw i;
 		let o = e.buildContext(await Od(r)), s = t.executor(n, o);
-		return P.isEffect(s) ? P.runPromise(e.provideEffect(Ed(s, r.subject), o.store)) : Ld(await Promise.resolve(s));
+		return N.isEffect(s) ? N.runPromise(e.provideEffect(Ed(s, r.subject), o.store)) : Ld(await Promise.resolve(s));
 	}, s = (n) => {
 		let i = Ld(n);
 		return Rd(i) ? e.finalize(i, r) : {
@@ -6847,19 +6850,19 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 		};
 	}, c = () => {
 		let a = t.executor(n, i);
-		return P.isEffect(a) ? e.provideEffect(Ed(a, r.subject), i.store).pipe(P.map(s)) : a instanceof Promise ? P.promise(() => a).pipe(P.map(s)) : s(a);
+		return N.isEffect(a) ? e.provideEffect(Ed(a, r.subject), i.store).pipe(N.map(s)) : a instanceof Promise ? N.promise(() => a).pipe(N.map(s)) : s(a);
 	}, l = () => {
 		let e = t.descriptor.guards;
-		return !e || e.length === 0 ? c() : Re(r.subject, e, n).pipe(P.flatMap((e) => {
-			if (e) return P.fail(e);
+		return !e || e.length === 0 ? c() : ze(r.subject, e, n).pipe(N.flatMap((e) => {
+			if (e) return N.fail(e);
 			let t = c();
-			return P.isEffect(t) ? t : P.succeed(t);
+			return N.isEffect(t) ? t : N.succeed(t);
 		}));
 	};
 	if (!e.interceptor) return l();
-	let u = P.suspend(() => {
+	let u = N.suspend(() => {
 		let e = l();
-		return P.isEffect(e) ? e : P.succeed(e);
+		return N.isEffect(e) ? e : N.succeed(e);
 	});
 	return e.interceptor(u, {
 		tag: t.descriptor.name,
@@ -6870,13 +6873,13 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 		...r.spanId === void 0 ? {} : { spanId: r.spanId }
 	});
 }, Hd = (e) => async (t, n, r) => {
-	let i = await Od(r), a = Vd(e)(t, n)(i), o = P.isEffect(a) ? await Td(a) : a;
-	return rr(o) ? o.value : e.queryRows(o);
+	let i = await Od(r), a = Vd(e)(t, n)(i), o = N.isEffect(a) ? await Td(a) : a;
+	return ir(o) ? o.value : e.queryRows(o);
 }, Ud = (e) => (t, n, r, i) => {
 	let a = !1, o;
 	return (async () => {
 		try {
-			let s = await Od(r), c = Vd(e)(t, n)(s), l = P.isEffect(c) ? await Td(c) : c, u = (e) => i(e), d = rr(l) ? await e.subscribeComputed(l, u, s) : await e.subscribeDescriptor(l, u, s);
+			let s = await Od(r), c = Vd(e)(t, n)(s), l = N.isEffect(c) ? await Td(c) : c, u = (e) => i(e), d = ir(l) ? await e.subscribeComputed(l, u, s) : await e.subscribeDescriptor(l, u, s);
 			a ? d() : o = d;
 		} catch (e) {
 			i({
@@ -6897,7 +6900,7 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 	runExecutor: async () => {
 		await Dd(t.descriptor, r.subject, n);
 		let i = e.buildContext(await Od(r)), a = t.executor(n, i);
-		return P.isEffect(a) ? e.runEffect(Ed(a, r.subject), i.store) : a;
+		return N.isEffect(a) ? e.runEffect(Ed(a, r.subject), i.store) : a;
 	}
 }), Gd = (e) => e instanceof Date ? e.toISOString() : typeof e == "string" && e.length > 0 ? e : null, Kd = (e) => typeof e == "string" && e.length > 0 ? e : null, qd = [
 	"updatedAt",
@@ -7013,4 +7016,4 @@ var K = /* @__PURE__ */ new Map(), pr = (e, t) => {
 	return n;
 }, nf = "framework-runtime";
 //#endregion
-export { Fa as API_KEYS_TABLE, Ws as AccessDenied, _d as AggregateError, Eu as AggregateMaintainer, gd as AggregateNotFound, vd as AggregateRegistry, hd as AggregateStale, nd as AnalyticsCapabilityNotSupported, td as AnalyticsError, rd as AnalyticsSink, X as CONNECTIONS_TABLE, Uo as CONNECTION_GRANTS_TABLE, qc as CircuitBreaker, Gc as CircuitOpen, fs as ConnectionNotConnected, Gi as DEFAULT_MAX_RPC_BODY_BYTES, us as DEFAULT_REFRESH_SKEW_MS, Hn as DEFAULT_ROW_FILTER_RETRY, Cl as DORMANCY_WAKEUP_TENANT, Qr as DeleteBuilder, er as Dispatcher, Xa as EffectStore, ws as GRANT_TTL_MS, rn as InMemoryDataStore, Gt as IndexedMatcher, Rt as LinearScanMatcher, rt as MetricBoundaries, od as NOOP_ANALYTICS_PROVIDER, Kn as NO_ROW_FILTER, Gr as NoRowFound, Oo as OUTBOX_ATTEMPTS_TABLE, Fo as OUTBOX_ATTEMPT_LOG_CAP, Y as OUTBOX_TABLE, Kr as OptimisticLockError, Us as REBAC_ADMIN_SCOPE, ds as REFRESH_LEASE_MS, nf as RUNTIME_NAME, Iu as ReactionRateLimiter, yi as ReplicatedDataStore, Vn as RowFilterUnavailable, Sl as SCHEDULE_SUBJECT, Ya as SYSTEM_SUBJECT, Xr as SelectBuilder, hc as SsrfBlockedError, ti as StoreOperationFailed, Jt as SubscriptionRegistry, ni as TableValidationFailed, ei as TenantScopeViolation, fu as TimelineRecorder, Gl as UndoBoundaryError, ql as UndoStack, Zr as UpdateBuilder, Sc as VOLTRO_AUDIT_MIXIN_ID, Cc as VOLTRO_SOFT_DELETE_MIXIN_ID, wc as VOLTRO_TENANT_MIXIN_ID, oo as WorkflowPayloadError, hr as _connectionStreamCount, gr as _resetConnectionSubjectsForTest, Go as _voltroConnectionGrantsTable, Ho as _voltroConnectionsTable, Du as _voltroRebacTuplesTable, Pl as _voltroScheduleClaimsTable, Nl as _voltroScheduleRunsTable, Fl as _voltroTracesTable, Il as _voltroUndoLogTable, Ru as _voltroWakeupsTable, Co as _voltroWorkflowEventDeliveriesTable, So as _voltroWorkflowEventsTable, ci as actingUserId, Ja as apiKeyManagementRoutes, ai as applyDefined, wu as applyDelta, Yl as applyInverse, Xl as applyInverses, Xn as applyRowFilter, Zn as applyRowFilterToDescriptor, Cd as applySoftDeleteScope, bd as applyTenantScope, iu as applyUndoInvocation, ec as assertCan, Yo as assertConnectionCipherConfigured, fd as attachAnalyticsMirror, ea as awaitServerListening, Po as backoffMs, Os as beginOAuthConnect, cr as bindConnectionSubject, Wi as bindMutation, Ii as bindStream, Fi as bindSubscription, Ai as bindSubscriptionUntyped, Su as buildIvmState, $d as buildPreview, Au as buildRebacInterceptor, Mu as buildRebacReadFilter, pi as buildSubjectKey, aa as buildTracingLayer, Uc as cacheScopeLeaks, ba as cachedBackend, $s as can, dl as cancelWakeup, vu as classifyShape, gs as clearConnectionRefreshFlights, Ys as clearResourcePolicies, a as clearRetentions, Xc as clearSystemStoreHandle, ol as compileCron, ks as completeOAuthConnect, ld as composeAnalytics, cd as composeAnalyticsSinks, Ts as connectionCallbackPath, Jo as connectionLabel, _r as connectionSubjectsSnapshot, Zu as countRunningWorkflows, Fn as counter, Rc as crud, ac as currentRequestLoader, vi as currentRoutingContext, wr as currentTraceContext, Ga as dataStoreApiKeyStore, Da as dataStoreIdempotencyStore, Ma as dataStoreKvStore, Mr as decryptField, pd as defineAggregate, qo as defineConnection, _o as defineEventTrigger, wd as defineExecutor, jo as defineOutboxHandler, Nu as defineReaction, Ks as defineResourcePolicy, al as defineSchedule, ed as defineSubscriber, Qn as deliveredRowCount, Tr as deriveKey, Qd as diffChange, Qi as drainForShutdown, zo as drainOutbox, vl as dueWakeups, Qs as effectiveRelations, kc as emptySchemaRegistry, Rr as enableGraphObservation, jr as encryptField, ic as enterRequestLoader, ma as envSecretsBackend, cs as exchangeAuthorizationCode, xr as externalSpanFromTraceparent, on as extractDbCause, qt as fingerprintFor, is as forgetCredential, Wc as formatCacheScopeLeaks, Hc as formatServerOnlyLeaks, yr as formatTraceparent, Jl as forwardChangeFromCdc, Ka as frameworkApiKeyStrategy, In as gauge, La as generateApiKeyToken, Ns as getConnectionResolver, lr as getConnectionSubject, q as getFieldCipher, qs as getResourcePolicy, Gn as getRowFilter, Zc as getSystemStoreHandle, mu as getTimelineRecorder, uc as getTupleSource, $ as groupKeyOf, Ln as histogramMetric, Xd as historyProvenance, xa as httpSecretsBackend, It as inspectWorkflow, dc as installPolicyGuardResolver, mr as interruptConnectionStreams, Ul as invertChange, md as isAggregateDefinition, xd as isEmptyTenantScopedRead, sn as isForeignKeyViolation, Wu as isIdleNow, Vi as isInfraError, zr as isObservingGraph, Sd as isOrglessUserSubject, Kl as isSafeToApply, rl as isScheduleDefinition, vo as isWorkflowEventTriggerDefinition, xu as ivmValue, Yd as lastWriteProvenance, as as listConnectionStates, Js as listResourcePolicies, ee as listRetentions, Ou as loadResourceTuples, ju as loadSubjectTuples, $c as localityAwareSelector, Wd as makeActionRunner, El as makeAdvisoryLockCoordinator, Er as makeAesCipher, Ba as makeApiKeyService, xc as makeApiKeyUsageBuffer, Wa as makeApiKeyUsageFlusher, cn as makeAppAccess, Na as makeAsyncKv, pa as makeBufferingSpanProcessor, Xo as makeConnectionRegistry, Fs as makeConnectionResolver, Is as makeConnectionsFacade, Ml as makeCoordinatedScheduler, pc as makeDataLoader, Hs as makeDisconnectConnectionExecutor, $a as makeEffectStoreLayer, wo as makeEventsFacade, Dr as makeFieldCipher, $r as makeFluentStore, Gu as makeIdleGate, po as makeLazyWorkflowFacade, zs as makeListConnectionsExecutor, Id as makeMutationRunner, Hd as makeOneShotQueryRunner, No as makeOutboxFacade, uo as makePostCommitWorkflowFacade, Vu as makeProcessAdapter, Vd as makeQueryDescriptorProducer, Bd as makeQueryReauthorizer, Ud as makeQuerySubscriber, Ku as makeRouterActivity, Tc as makeSchemaRegistry, Bs as makeStartConnectionExecutor, Vs as makeSubmitTokenExecutor, Vl as makeUndoCapture, qu as makeWakeGate, Xu as makeWakeProxyServer, lo as makeWorkflowFacade, fo as makeWorkflowFacadeWithCallerContext, mo as makeWorkflowHandlers, ho as makeWorkflowLayers, no as makeWorkflowRunHandle, fl as markWakeupFired, Cu as materializeIvm, Va as memoryApiKeyStore, tl as memoryReplicationAdapter, fi as memoryRywPositionStore, sl as nextFiring, yl as nextWakeup, Uu as nodeProcessSupervisor, sd as noopAnalytics, ud as noopAnalyticsSpec, Pa as noopKv, Wr as observeStore, Hr as observedGraph, dr as onBindConnectionSubject, Xi as onProcessShutdown, Ao as outboxAttemptsTable, Do as outboxTable, br as parseTraceparent, so as payloadPropertyNames, ui as powerOfTwoSelector, tf as previewInRollback, es as projectConnectionState, xl as pruneWakeups, Xs as rebacPolicyGraph, jn as recordSample, W as recordSubscriptionActive, Nn as recordSubscriptionDelivery, Vr as recordTableAccess, gu as recordTimelineEvent, Pc as redactColumns, lu as redactRow, mi as redisRywPositionStore, au as redoUndoInvocation, ls as refreshAccessToken, pr as registerConnectionStream, se as registerRetention, ul as registerWakeup, hl as releaseWakeup, di as replicaHealth, Mi as resetComputedQueryCacheWarnings, Ur as resetObservedGraph, _a as resetSecretsBackend, ys as resolveConnection, Ps as resolveConnectionForSubject, el as resolveCurrentRegion, ln as resolveDependentTables, Ds as resolveRedirectUri, Tu as resolveRescan, qn as resolveRowFilterScope, Jn as resolveRowFilterScopeFor, va as resolveSecret, ya as resolveSecretSync, Sa as resolveSecretsBackend, ou as resolveTimelineMode, le as retentionTtlMsFromEnv, du as reverseEventOverRows, nc as revokedIds, Qc as runAsSystem, Qu as runOrchestratorTick, Td as runProvidedEffect, Lu as runReaction, $u as runSingleNodeOrchestrator, Bu as runWakeLoop, Fd as runWithDeadlockRetry, Br as runWithObservedProcedure, oc as runWithRequestLoader, _i as runWithRoutingContext, Cr as runWithTraceContext, Es as sanitizeRedirectTo, jl as scheduleCoordinated, zc as schemaPropertyNames, Vc as serverOnlyLeaks, Ms as setConnectionResolver, kr as setFieldCipher, Wn as setRowFilter, ga as setSecretsBackend, Yc as setSystemStoreHandle, hu as setTimelineRecorderForTest, lc as setTupleSource, Ia as sha256Hex, wl as singleCoordinator, zn as snapshotMetrics, Bn as snapshotMetricsSync, bc as ssrfGuardHttpClientLayer, yc as ssrfReason, Ki as startRpcServer, Ol as startScheduler, ns as storeCredential, As as sweepExpiredGrants, he as sweepRetention, Wl as synthesizeInverse, mc as tracingHttpClientLayer, go as triggerWorkflow, ml as tryClaimWakeup, ur as unbindConnectionSubject, Ll as undoCaptureEnabled, nu as undoLogExecutor, yd as useAggregate, ad as useAnalytics, tc as visibleRows, zu as wakeDueOnce, Od as withRowFilter, eo as workflowToRpc, Bl as wrapCaptureStore, jc as wrapStoreWithBootCodec, li as wrapStoreWithMixinBehaviour };
+export { Fa as API_KEYS_TABLE, Ws as AccessDenied, _d as AggregateError, Eu as AggregateMaintainer, gd as AggregateNotFound, vd as AggregateRegistry, hd as AggregateStale, nd as AnalyticsCapabilityNotSupported, td as AnalyticsError, rd as AnalyticsSink, X as CONNECTIONS_TABLE, Uo as CONNECTION_GRANTS_TABLE, qc as CircuitBreaker, Gc as CircuitOpen, fs as ConnectionNotConnected, Gi as DEFAULT_MAX_RPC_BODY_BYTES, us as DEFAULT_REFRESH_SKEW_MS, Un as DEFAULT_ROW_FILTER_RETRY, Cl as DORMANCY_WAKEUP_TENANT, Qr as DeleteBuilder, tr as Dispatcher, Xa as EffectStore, ws as GRANT_TTL_MS, rn as InMemoryDataStore, Gt as IndexedMatcher, Rt as LinearScanMatcher, it as MetricBoundaries, od as NOOP_ANALYTICS_PROVIDER, qn as NO_ROW_FILTER, Gr as NoRowFound, Oo as OUTBOX_ATTEMPTS_TABLE, Fo as OUTBOX_ATTEMPT_LOG_CAP, Y as OUTBOX_TABLE, Kr as OptimisticLockError, Us as REBAC_ADMIN_SCOPE, ds as REFRESH_LEASE_MS, nf as RUNTIME_NAME, Iu as ReactionRateLimiter, yi as ReplicatedDataStore, Hn as RowFilterUnavailable, Sl as SCHEDULE_SUBJECT, Ya as SYSTEM_SUBJECT, Xr as SelectBuilder, hc as SsrfBlockedError, ti as StoreOperationFailed, Jt as SubscriptionRegistry, ni as TableValidationFailed, ei as TenantScopeViolation, fu as TimelineRecorder, Gl as UndoBoundaryError, ql as UndoStack, Zr as UpdateBuilder, Sc as VOLTRO_AUDIT_MIXIN_ID, Cc as VOLTRO_SOFT_DELETE_MIXIN_ID, wc as VOLTRO_TENANT_MIXIN_ID, oo as WorkflowPayloadError, gr as _connectionStreamCount, _r as _resetConnectionSubjectsForTest, Go as _voltroConnectionGrantsTable, Ho as _voltroConnectionsTable, Du as _voltroRebacTuplesTable, Pl as _voltroScheduleClaimsTable, Nl as _voltroScheduleRunsTable, Fl as _voltroTracesTable, Il as _voltroUndoLogTable, Ru as _voltroWakeupsTable, Co as _voltroWorkflowEventDeliveriesTable, So as _voltroWorkflowEventsTable, ci as actingUserId, Ja as apiKeyManagementRoutes, ai as applyDefined, wu as applyDelta, Yl as applyInverse, Xl as applyInverses, Zn as applyRowFilter, Qn as applyRowFilterToDescriptor, Cd as applySoftDeleteScope, bd as applyTenantScope, iu as applyUndoInvocation, ec as assertCan, Yo as assertConnectionCipherConfigured, fd as attachAnalyticsMirror, ea as awaitServerListening, Po as backoffMs, Os as beginOAuthConnect, lr as bindConnectionSubject, Wi as bindMutation, Ii as bindStream, Fi as bindSubscription, Ai as bindSubscriptionUntyped, Su as buildIvmState, $d as buildPreview, Au as buildRebacInterceptor, Mu as buildRebacReadFilter, pi as buildSubjectKey, aa as buildTracingLayer, Uc as cacheScopeLeaks, ba as cachedBackend, $s as can, dl as cancelWakeup, vu as classifyShape, gs as clearConnectionRefreshFlights, Ys as clearResourcePolicies, a as clearRetentions, Xc as clearSystemStoreHandle, ol as compileCron, ks as completeOAuthConnect, ld as composeAnalytics, cd as composeAnalyticsSinks, Ts as connectionCallbackPath, Jo as connectionLabel, vr as connectionSubjectsSnapshot, Zu as countRunningWorkflows, In as counter, Rc as crud, ac as currentRequestLoader, vi as currentRoutingContext, Tr as currentTraceContext, Ga as dataStoreApiKeyStore, Da as dataStoreIdempotencyStore, Ma as dataStoreKvStore, Mr as decryptField, pd as defineAggregate, qo as defineConnection, _o as defineEventTrigger, wd as defineExecutor, jo as defineOutboxHandler, Nu as defineReaction, Ks as defineResourcePolicy, al as defineSchedule, ed as defineSubscriber, $n as deliveredRowCount, Er as deriveKey, Qd as diffChange, Qi as drainForShutdown, zo as drainOutbox, vl as dueWakeups, Qs as effectiveRelations, kc as emptySchemaRegistry, Rr as enableGraphObservation, q as encryptField, ic as enterRequestLoader, ma as envSecretsBackend, cs as exchangeAuthorizationCode, Sr as externalSpanFromTraceparent, on as extractDbCause, qt as fingerprintFor, is as forgetCredential, Wc as formatCacheScopeLeaks, Hc as formatServerOnlyLeaks, br as formatTraceparent, Jl as forwardChangeFromCdc, Ka as frameworkApiKeyStrategy, Ln as gauge, La as generateApiKeyToken, Ns as getConnectionResolver, ur as getConnectionSubject, K as getFieldCipher, qs as getResourcePolicy, Kn as getRowFilter, Zc as getSystemStoreHandle, mu as getTimelineRecorder, uc as getTupleSource, $ as groupKeyOf, Rn as histogramMetric, Xd as historyProvenance, xa as httpSecretsBackend, It as inspectWorkflow, dc as installPolicyGuardResolver, hr as interruptConnectionStreams, Ul as invertChange, md as isAggregateDefinition, xd as isEmptyTenantScopedRead, sn as isForeignKeyViolation, Wu as isIdleNow, Vi as isInfraError, zr as isObservingGraph, Sd as isOrglessUserSubject, Kl as isSafeToApply, rl as isScheduleDefinition, vo as isWorkflowEventTriggerDefinition, xu as ivmValue, Yd as lastWriteProvenance, as as listConnectionStates, Js as listResourcePolicies, te as listRetentions, Ou as loadResourceTuples, ju as loadSubjectTuples, $c as localityAwareSelector, Wd as makeActionRunner, El as makeAdvisoryLockCoordinator, Dr as makeAesCipher, Ba as makeApiKeyService, xc as makeApiKeyUsageBuffer, Wa as makeApiKeyUsageFlusher, cn as makeAppAccess, Na as makeAsyncKv, pa as makeBufferingSpanProcessor, Xo as makeConnectionRegistry, Fs as makeConnectionResolver, Is as makeConnectionsFacade, Ml as makeCoordinatedScheduler, pc as makeDataLoader, Hs as makeDisconnectConnectionExecutor, $a as makeEffectStoreLayer, wo as makeEventsFacade, Or as makeFieldCipher, $r as makeFluentStore, Gu as makeIdleGate, po as makeLazyWorkflowFacade, zs as makeListConnectionsExecutor, Id as makeMutationRunner, Hd as makeOneShotQueryRunner, No as makeOutboxFacade, uo as makePostCommitWorkflowFacade, Vu as makeProcessAdapter, Vd as makeQueryDescriptorProducer, Bd as makeQueryReauthorizer, Ud as makeQuerySubscriber, Ku as makeRouterActivity, Tc as makeSchemaRegistry, Bs as makeStartConnectionExecutor, Vs as makeSubmitTokenExecutor, Vl as makeUndoCapture, qu as makeWakeGate, Xu as makeWakeProxyServer, lo as makeWorkflowFacade, fo as makeWorkflowFacadeWithCallerContext, mo as makeWorkflowHandlers, ho as makeWorkflowLayers, no as makeWorkflowRunHandle, fl as markWakeupFired, Cu as materializeIvm, Va as memoryApiKeyStore, tl as memoryReplicationAdapter, fi as memoryRywPositionStore, sl as nextFiring, yl as nextWakeup, Uu as nodeProcessSupervisor, sd as noopAnalytics, ud as noopAnalyticsSpec, Pa as noopKv, Wr as observeStore, Hr as observedGraph, fr as onBindConnectionSubject, Xi as onProcessShutdown, Ao as outboxAttemptsTable, Do as outboxTable, xr as parseTraceparent, so as payloadPropertyNames, ui as powerOfTwoSelector, tf as previewInRollback, es as projectConnectionState, xl as pruneWakeups, Xs as rebacPolicyGraph, jn as recordSample, Fn as recordSubscriptionActive, Nn as recordSubscriptionDelivery, Vr as recordTableAccess, gu as recordTimelineEvent, Pc as redactColumns, lu as redactRow, mi as redisRywPositionStore, au as redoUndoInvocation, ls as refreshAccessToken, mr as registerConnectionStream, ce as registerRetention, ul as registerWakeup, hl as releaseWakeup, di as replicaHealth, Mi as resetComputedQueryCacheWarnings, Ur as resetObservedGraph, _a as resetSecretsBackend, ys as resolveConnection, Ps as resolveConnectionForSubject, el as resolveCurrentRegion, ln as resolveDependentTables, Ds as resolveRedirectUri, Tu as resolveRescan, Jn as resolveRowFilterScope, Yn as resolveRowFilterScopeFor, va as resolveSecret, ya as resolveSecretSync, Sa as resolveSecretsBackend, ou as resolveTimelineMode, ue as retentionTtlMsFromEnv, du as reverseEventOverRows, nc as revokedIds, Qc as runAsSystem, Qu as runOrchestratorTick, Td as runProvidedEffect, Lu as runReaction, $u as runSingleNodeOrchestrator, Bu as runWakeLoop, Fd as runWithDeadlockRetry, Br as runWithObservedProcedure, oc as runWithRequestLoader, _i as runWithRoutingContext, wr as runWithTraceContext, Es as sanitizeRedirectTo, jl as scheduleCoordinated, zc as schemaPropertyNames, Vc as serverOnlyLeaks, Ms as setConnectionResolver, Ar as setFieldCipher, Gn as setRowFilter, ga as setSecretsBackend, Yc as setSystemStoreHandle, hu as setTimelineRecorderForTest, lc as setTupleSource, Ia as sha256Hex, wl as singleCoordinator, Bn as snapshotMetrics, Vn as snapshotMetricsSync, bc as ssrfGuardHttpClientLayer, yc as ssrfReason, Ki as startRpcServer, Ol as startScheduler, ns as storeCredential, As as sweepExpiredGrants, ge as sweepRetention, Wl as synthesizeInverse, mc as tracingHttpClientLayer, go as triggerWorkflow, ml as tryClaimWakeup, dr as unbindConnectionSubject, Ll as undoCaptureEnabled, nu as undoLogExecutor, yd as useAggregate, ad as useAnalytics, tc as visibleRows, zu as wakeDueOnce, Od as withRowFilter, eo as workflowToRpc, Bl as wrapCaptureStore, jc as wrapStoreWithBootCodec, li as wrapStoreWithMixinBehaviour };