@voltro/runtime 0.26.0 → 0.28.0

package/dist/index.js

@@ -1443,7 +1443,9 @@ var Qt = (e) => {
 	if (e.length !== t.length) return !1;
 	for (let n = 0; n < e.length; n++) if (JSON.stringify(e[n]) !== JSON.stringify(t[n])) return !1;
 	return !0;
-}, zr = (e) => typeof e == "object" && !!e && e.__voltroComputed === !0, Br = 1440 * 60 * 1e3, Vr = 3600 * 1e3, Hr = /* @__PURE__ */ new Map(), Ur = /* @__PURE__ */ new Set(), Wr = (e, t) => {
+}, zr = (e) => typeof e == "object" && !!e && e.__voltroComputed === !0, Br = 1440 * 60 * 1e3, Vr = 3600 * 1e3, Hr = /* @__PURE__ */ new Map(), Ur = /* @__PURE__ */ new Set(), Wr = /* @__PURE__ */ new Map(), Gr = (e, t) => {
+	t === void 0 ? Wr.delete(e) : Wr.set(e, t);
+}, Kr = (e) => Wr.get(e), qr = (e, t) => {
 	Hr.set(e, {
 		subject: t,
 		touchedAt: Date.now()
@@ -1451,25 +1453,25 @@ var Qt = (e) => {
 	for (let n of Ur) try {
 		n(e, t);
 	} catch {}
-}, Gr = (e) => {
+}, Jr = (e) => {
 	let t = Hr.get(e);
 	if (t) return t.touchedAt = Date.now(), t.subject;
-}, Kr = (e) => {
-	Hr.delete(e);
-}, qr = (e) => (Ur.add(e), () => {
+}, Yr = (e) => {
+	Wr.delete(e), Hr.delete(e);
+}, Xr = (e) => (Ur.add(e), () => {
 	Ur.delete(e);
-}), Jr = setInterval(() => {
+}), Zr = setInterval(() => {
 	let e = Date.now() - Br;
 	for (let [t, n] of Hr) n.touchedAt < e && Hr.delete(t);
 }, Vr);
-typeof Jr == "object" && Jr && "unref" in Jr && Jr.unref();
-var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
+typeof Zr == "object" && Zr && "unref" in Zr && Zr.unref();
+var K = /* @__PURE__ */ new Map(), Qr = (e, t) => {
 	let n = K.get(e);
 	return n || (n = /* @__PURE__ */ new Set(), K.set(e, n)), n.add(t), () => {
 		let n = K.get(e);
 		n && (n.delete(t), n.size === 0 && K.delete(e));
 	};
-}, Xr = (e) => {
+}, $r = (e) => {
 	let t = K.get(e);
 	if (t) {
 		for (let e of [...t]) try {
@@ -1477,15 +1479,15 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		} catch {}
 		K.delete(e);
 	}
-}, Zr = (e) => K.get(e)?.size ?? 0, Qr = () => {
+}, ei = (e) => K.get(e)?.size ?? 0, ti = () => {
 	Hr.clear(), K.clear();
-}, $r = () => [...Hr.entries()].map(([e, t]) => ({
+}, ni = () => [...Hr.entries()].map(([e, t]) => ({
 	clientId: e,
 	subjectType: t.subject.type,
 	tenantId: t.subject.tenantId
-})), ei = /^00-([0-9a-f]{32})-([0-9a-f]{16})-([0-9a-f]{2})$/, ti = (e) => `00-${e.traceId}-${e.spanId}-${e.sampled ? "01" : "00"}`, ni = (e) => {
+})), ri = /^00-([0-9a-f]{32})-([0-9a-f]{16})-([0-9a-f]{2})$/, ii = (e) => `00-${e.traceId}-${e.spanId}-${e.sampled ? "01" : "00"}`, ai = (e) => {
 	if (typeof e != "string") return null;
-	let t = ei.exec(e.trim().toLowerCase());
+	let t = ri.exec(e.trim().toLowerCase());
 	if (t === null) return null;
 	let [, n, r, i] = t;
 	return n === "0".repeat(32) || r === "0".repeat(16) ? null : {
@@ -1493,14 +1495,14 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		spanId: r,
 		sampled: (parseInt(i, 16) & 1) == 1
 	};
-}, ri = (e) => {
-	let t = ni(e);
+}, oi = (e) => {
+	let t = ai(e);
 	if (t !== null) return x.externalSpan({
 		traceId: t.traceId,
 		spanId: t.spanId,
 		sampled: t.sampled
 	});
-}, ii = new Lt(), ai = (e, t) => ii.run(e, t), oi = () => ii.getStore(), si = (e) => /^[0-9a-f]{64}$/i.test(e) ? Buffer.from(e, "hex") : ze(e, "voltro:field-encryption:v1", 32), ci = (e) => {
+}, si = new Lt(), ci = (e, t) => si.run(e, t), li = () => si.getStore(), ui = (e) => /^[0-9a-f]{64}$/i.test(e) ? Buffer.from(e, "hex") : ze(e, "voltro:field-encryption:v1", 32), di = (e) => {
 	if (e.length !== 32) throw Error(`field cipher key must be 32 bytes, got ${e.length}`);
 	return {
 		encrypt: (t) => {
@@ -1514,27 +1516,27 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 			return a.setAuthTag(Buffer.from(r, "base64")), Buffer.concat([a.update(Buffer.from(i, "base64")), a.final()]).toString("utf8");
 		}
 	};
-}, li = (e) => ci(si(e)), ui, di = (e) => {
-	ui = e;
-}, q = () => ui, fi = "no field cipher registered — enable `@voltro/plugin-governance` `governancePlugin({ fieldEncryption: { key } })` (or call setFieldCipher) so a key is available.", pi = (e) => {
+}, fi = (e) => di(ui(e)), pi, mi = (e) => {
+	pi = e;
+}, q = () => pi, hi = "no field cipher registered — enable `@voltro/plugin-governance` `governancePlugin({ fieldEncryption: { key } })` (or call setFieldCipher) so a key is available.", gi = (e) => {
 	let t = q();
-	if (!t) throw Error(`encryptField: ${fi}`);
+	if (!t) throw Error(`encryptField: ${hi}`);
 	return t.encrypt(e);
-}, mi = (e) => {
+}, _i = (e) => {
 	if (!ue(e)) return e;
 	let t = q();
-	if (!t) throw Error(`decryptField: ${fi}`);
+	if (!t) throw Error(`decryptField: ${hi}`);
 	return t.decrypt(e);
-}, hi = new Lt(), gi = /* @__PURE__ */ new Set(), _i = /* @__PURE__ */ new Set(), vi = "\0", yi = process.env.VOLTRO_OBSERVE_GRAPH === "1", bi = () => {
-	yi = !0;
-}, xi = () => yi, Si = (e, t) => yi ? (_i.add(e.tag), hi.run(e, t)) : t(), Ci = (e, t) => {
-	if (!yi) return;
-	let n = hi.getStore();
-	n !== void 0 && (e.startsWith("_voltro_") || gi.add(`${n.tag}${vi}${n.kind}${vi}${e}${vi}${t}`));
-}, wi = () => ({
+}, vi = new Lt(), yi = /* @__PURE__ */ new Set(), bi = /* @__PURE__ */ new Set(), xi = "\0", Si = process.env.VOLTRO_OBSERVE_GRAPH === "1", Ci = () => {
+	Si = !0;
+}, wi = () => Si, Ti = (e, t) => Si ? (bi.add(e.tag), vi.run(e, t)) : t(), Ei = (e, t) => {
+	if (!Si) return;
+	let n = vi.getStore();
+	n !== void 0 && (e.startsWith("_voltro_") || yi.add(`${n.tag}${xi}${n.kind}${xi}${e}${xi}${t}`));
+}, Di = () => ({
 	version: 1,
-	edges: [...gi].map((e) => {
-		let [t, n, r, i] = e.split(vi);
+	edges: [...yi].map((e) => {
+		let [t, n, r, i] = e.split(xi);
 		return {
 			tag: t,
 			kind: n,
@@ -1542,11 +1544,11 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 			op: i
 		};
 	}).sort((e, t) => e.tag.localeCompare(t.tag) || e.table.localeCompare(t.table) || e.op.localeCompare(t.op)),
-	exercised: [..._i].sort()
-}), Ti = () => {
-	gi.clear(), _i.clear();
-}, Ei = (e) => {
-	if (!yi) return e;
+	exercised: [...bi].sort()
+}), Oi = () => {
+	yi.clear(), bi.clear();
+}, ki = (e) => {
+	if (!Si) return e;
 	let t = Object.create(Object.getPrototypeOf(e));
 	for (let n of Reflect.ownKeys(e)) Object.defineProperty(t, n, Object.getOwnPropertyDescriptor(e, n));
 	let n = (n, r, i) => {
@@ -1555,7 +1557,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		let o = a;
 		t[n] = (...t) => {
 			let n = r(t);
-			return n !== void 0 && Ci(n, i), o.apply(e, t);
+			return n !== void 0 && Ei(n, i), o.apply(e, t);
 		};
 	}, r = (e) => typeof e[0] == "string" ? e[0] : void 0;
 	n("query", (e) => {
@@ -1565,25 +1567,25 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 	let i = e.transactional;
 	if (typeof i == "function") {
 		let n = i;
-		t.transactional = (t) => n.call(e, (e) => t(Ei(e)));
+		t.transactional = (t) => n.call(e, (e) => t(ki(e)));
 	}
 	return t;
-}, Di = class extends y.TaggedError()("NoRowFound", {
+}, Ai = class extends y.TaggedError()("NoRowFound", {
 	table: y.String,
 	found: y.Number
 }) {
 	get message() {
 		return this.found === 0 ? `expected exactly one row in '${this.table}', found none` : `expected exactly one row in '${this.table}', found more than one`;
 	}
-}, Oi = class extends y.TaggedError()("OptimisticLockError", {
+}, ji = class extends y.TaggedError()("OptimisticLockError", {
 	table: y.String,
 	expected: y.Number
 }) {
 	get message() {
 		return `optimistic lock failed on '${this.table}': expected version ${this.expected}`;
 	}
-}, ki = (e) => typeof e == "object" && !!e && ("and" in e || "or" in e || "not" in e || "op" in e || "subquery" in e), Ai = (e) => {
-	if (e.length === 1 && ki(e[0])) return e[0];
+}, Mi = (e) => typeof e == "object" && !!e && ("and" in e || "or" in e || "not" in e || "op" in e || "subquery" in e), Ni = (e) => {
+	if (e.length === 1 && Mi(e[0])) return e[0];
 	let t = e[0];
 	if (e.length === 2) return O(t, e[1]);
 	let n = e[1], r = e[2];
@@ -1601,11 +1603,11 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		case "startsWith": return je(t, r);
 		default: return O(t, r);
 	}
-}, ji = (e) => {
+}, Pi = (e) => {
 	let t = j(e);
 	if (t === void 0) throw Error(`unknown table '${e}' — is it declared with table()?`);
 	return xe(t);
-}, Mi = class e {
+}, Fi = class e {
 	backend;
 	scope;
 	table;
@@ -1619,7 +1621,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		return new e(this.backend, this.scope, this.table, t, this.skipTenant, this.skipSoftDelete);
 	}
 	where(...e) {
-		return this.clone(this.query.where(Ai(e)));
+		return this.clone(this.query.where(Ni(e)));
 	}
 	orderBy(e, t = "asc") {
 		return this.clone(this.query.orderBy(e, t));
@@ -1668,11 +1670,11 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 	}
 	async one() {
 		let e = await this.backend.query(this.scopedQuery().limit(2).descriptor), t = e[0];
-		if (t === void 0) throw new Di({
+		if (t === void 0) throw new Ai({
 			table: this.table,
 			found: 0
 		});
-		if (e.length > 1) throw new Di({
+		if (e.length > 1) throw new Ai({
 			table: this.table,
 			found: e.length
 		});
@@ -1688,7 +1690,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 	get descriptor() {
 		return this.scopedQuery().descriptor;
 	}
-}, Ni = class {
+}, Ii = class {
 	backend;
 	scope;
 	table;
@@ -1699,7 +1701,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		this.backend = e, this.scope = t, this.table = n;
 	}
 	where(...e) {
-		let t = Ai(e);
+		let t = Ni(e);
 		return this.predicate = this.predicate ? C(this.predicate, t) : t, this;
 	}
 	unscoped() {
@@ -1723,7 +1725,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 	}
 	async set(e) {
 		let t = await this.backend.updateMany(this.table, e, { where: this.scopedWhere() });
-		if (this.expectedVersion !== void 0 && t === 0) throw new Oi({
+		if (this.expectedVersion !== void 0 && t === 0) throw new ji({
 			table: this.table,
 			expected: this.expectedVersion
 		});
@@ -1732,7 +1734,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 	async restore() {
 		return this.backend.updateMany(this.table, { deletedAt: null }, { where: this.scopedWhere() });
 	}
-}, Pi = class {
+}, Li = class {
 	backend;
 	scope;
 	table;
@@ -1742,7 +1744,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		this.backend = e, this.scope = t, this.table = n;
 	}
 	where(...e) {
-		let t = Ai(e);
+		let t = Ni(e);
 		return this.predicate = this.predicate ? C(this.predicate, t) : t, this;
 	}
 	unscoped() {
@@ -1763,50 +1765,50 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 	async hard() {
 		return this.backend.deleteMany(this.table, { where: this.scopedWhere() });
 	}
-}, Fi = (e, t) => ({
-	select: (n) => new Mi(e, t, n, ji(n)),
-	updateWhere: (n) => new Ni(e, t, n),
-	deleteWhere: (n) => new Pi(e, t, n)
-}), Ii = class extends y.TaggedError()("TenantScopeViolation", {
+}, Ri = (e, t) => ({
+	select: (n) => new Fi(e, t, n, Pi(n)),
+	updateWhere: (n) => new Ii(e, t, n),
+	deleteWhere: (n) => new Li(e, t, n)
+}), zi = class extends y.TaggedError()("TenantScopeViolation", {
 	table: y.String,
 	reason: y.String
-}) {}, Li = class extends y.TaggedError()("StoreOperationFailed", {
+}) {}, Bi = class extends y.TaggedError()("StoreOperationFailed", {
 	operation: y.String,
 	table: y.String,
 	cause: y.String
-}) {}, Ri = class extends y.TaggedError()("TableValidationFailed", {
+}) {}, Vi = class extends y.TaggedError()("TableValidationFailed", {
 	table: y.String,
 	summary: y.String,
 	issues: y.Array(y.Struct({
 		path: y.String,
 		message: y.String
 	}))
-}) {}, zi = "id", Bi = (e) => "descriptor" in e ? e.descriptor : e, Vi = (e, t) => {
+}) {}, Hi = "id", Ui = (e) => "descriptor" in e ? e.descriptor : e, Wi = (e, t) => {
 	let n = {};
 	for (let r of t) e[r] !== void 0 && (n[r] = e[r]);
 	return n;
-}, Hi = "cannot insert into tenant-scoped table without an authenticated tenant — subject.tenantId is null. Either authenticate first or pass tenantId explicitly in the row (admin tooling).", Ui = (e) => {
-	throw new Ii({
+}, Gi = "cannot insert into tenant-scoped table without an authenticated tenant — subject.tenantId is null. Either authenticate first or pass tenantId explicitly in the row (admin tooling).", Ki = (e) => {
+	throw new zi({
 		table: e,
-		reason: Hi
+		reason: Gi
 	});
-}, Wi = (e) => {
+}, qi = (e) => {
 	if (e.type !== "apiKey") return e.id;
 	let t = e.metadata?.userId;
 	return typeof t == "string" && t !== "" ? t : e.id;
-}, Gi = (e, t) => {
-	let n = Ei(e), r = Wi(t.subject), i = t.subject.tenantId, a = t.rowFilter ?? Or, o = (e, n) => {
+}, Ji = (e, t) => {
+	let n = ki(e), r = qi(t.subject), i = t.subject.tenantId, a = t.rowFilter ?? Or, o = (e, n) => {
 		let a = { ...n }, o = t.schemaRegistry, s = o.idScheme(e);
-		if (s !== void 0 && a[zi] == null) if (s.kind === "numeric") delete a[zi];
+		if (s !== void 0 && a[Hi] == null) if (s.kind === "numeric") delete a[Hi];
 		else {
 			let t = A(s, e);
-			t !== null && (a[zi] = t);
+			t !== null && (a[Hi] = t);
 		}
 		if (o.hasAudit(e)) {
 			let e = /* @__PURE__ */ new Date();
 			"createdAt" in a || (a.createdAt = e), "updatedAt" in a || (a.updatedAt = e), r !== null && ("createdBy" in a || (a.createdBy = r), "updatedBy" in a || (a.updatedBy = r));
 		}
-		o.hasTenant(e) && ("tenantId" in a || (i === null && Ui(e), a.tenantId = i));
+		o.hasTenant(e) && ("tenantId" in a || (i === null && Ki(e), a.tenantId = i));
 		let c = o.defaultFactories(e);
 		if (c.size > 0) for (let [e, t] of c) (!(e in a) || a[e] === void 0) && (a[e] = t());
 		let l = o.computedFields(e);
@@ -1826,7 +1828,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 			let r = xn(t);
 			if (Sn(r)) {
 				let t = n.tenantId, i = `${r.dbConstraint ?? ""} ${r.dbColumn ?? ""} ${r.dbMessage ?? ""} ${r.dbCauseChain ?? ""}`.toLowerCase();
-				if (i.includes("tenantid") || /\btenants\b/.test(i) || t != null && i.includes(String(t).toLowerCase())) throw new Ii({
+				if (i.includes("tenantid") || /\btenants\b/.test(i) || t != null && i.includes(String(t).toLowerCase())) throw new zi({
 					table: e,
 					reason: t == null ? "write references a tenant that does not exist" : `tenant '${String(t)}' does not exist — seed the row in \`tenants\`, or fix how the request resolved this tenant (subject.tenantId / the x-tenant header / the dev TENANT fallback)`
 				});
@@ -1851,7 +1853,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 			path: e.path.length === 0 ? "<root>" : e.path.join("."),
 			message: e.message
 		})), o = a[0];
-		throw new Ri({
+		throw new Vi({
 			table: e,
 			summary: o === void 0 ? "patch validation failed" : `${o.path}: ${o.message}`,
 			issues: a
@@ -1861,7 +1863,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		return r !== null && (e.deletedBy = r), e;
 	}, f = (e, t, n) => {
 		let r = ge(n, t);
-		if (r.length !== 0) throw new Ri({
+		if (r.length !== 0) throw new Vi({
 			table: e,
 			summary: `upsert conflictColumns [${n.map((e) => `'${e}'`).join(", ")}] but the payload is missing ${r.map((e) => `'${e}'`).join(", ")}`,
 			issues: r.map((e) => ({
@@ -1873,7 +1875,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		let r = j(e);
 		if (r !== void 0) {
 			let t = _e(r, n);
-			if (t.length > 0) throw new Ri({
+			if (t.length > 0) throw new Vi({
 				table: e,
 				summary: `missing required column${t.length > 1 ? "s" : ""} ${t.map((e) => `'${e}'`).join(", ")} — NOT NULL with no default and not auto-stamped`,
 				issues: t.map((e) => ({
@@ -1890,7 +1892,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 			path: e.path.length === 0 ? "<root>" : e.path.join("."),
 			message: e.message
 		})), s = o[0];
-		throw new Ri({
+		throw new Vi({
 			table: e,
 			summary: s === void 0 ? "row validation failed" : `${s.path}: ${s.message}`,
 			issues: o
@@ -1939,7 +1941,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 			let t = (await n.query({
 				table: e,
 				predicate: {
-					column: zi,
+					column: Hi,
 					op: "eq",
 					value: r
 				},
@@ -1960,7 +1962,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 			}), i = await n.query({
 				table: e,
 				predicate: {
-					column: zi,
+					column: Hi,
 					op: "eq",
 					value: r
 				},
@@ -1989,7 +1991,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 	}), se = async (e, t) => te(e, {
 		...t,
 		where: k(e, t.where)
-	}), ce = Fi({
+	}), ce = Ri({
 		query: w,
 		updateMany: D,
 		deleteMany: te,
@@ -2018,26 +2020,26 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 	return {
 		query: T,
 		one: (async (e) => {
-			let t = Bi(e), n = await T({
+			let t = Ui(e), n = await T({
 				...t,
 				take: 2
 			}), r = n[0];
-			if (r === void 0) throw new Di({
+			if (r === void 0) throw new Ai({
 				table: t.table,
 				found: 0
 			});
-			if (n.length > 1) throw new Di({
+			if (n.length > 1) throw new Ai({
 				table: t.table,
 				found: n.length
 			});
 			return r;
 		}),
 		first: (async (e) => (await T({
-			...Bi(e),
+			...Ui(e),
 			take: 1
 		}))[0] ?? null),
 		maybeOne: (async (e) => (await T({
-			...Bi(e),
+			...Ui(e),
 			take: 1
 		}))[0] ?? null),
 		insert: async (e, t) => {
@@ -2118,7 +2120,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		select: ce.select,
 		update: M,
 		delete: N,
-		applyDefined: Vi,
+		applyDefined: Wi,
 		hardDelete: async (e, t) => n.delete(e, t),
 		updateMany: ae,
 		deleteMany: se,
@@ -2134,13 +2136,13 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 			let a = await c(e, i, () => n.insertIgnore(e, h(e, p(e, i)), r));
 			return x(e, [a])[0];
 		},
-		transactional: (e) => n.transactional(async (n) => e(Gi(n, t))),
+		transactional: (e) => n.transactional(async (n) => e(Ji(n, t))),
 		...n.raw ? { raw: n.raw.bind(n) } : {},
 		onChange: (e) => n.onChange(e),
 		injectExternalChange: (e) => n.injectExternalChange(e),
 		...n.changeScope === void 0 ? {} : { changeScope: n.changeScope }
 	};
-}, Ki = (e = {}) => {
+}, Yi = (e = {}) => {
 	let t = e.random ?? Math.random, n = /* @__PURE__ */ new Map(), r = (e) => n.get(e) ?? 0;
 	return {
 		pick(e) {
@@ -2165,7 +2167,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 			}));
 		}
 	};
-}, qi = (e = {}) => {
+}, Xi = (e = {}) => {
 	let t = e.thresholdFailures ?? 3, n = e.windowMs ?? 1e4, r = e.blackoutMs ?? 6e4, i = e.now ?? Date.now, a = /* @__PURE__ */ new Map(), o = (e) => {
 		let t = a.get(e);
 		return t === void 0 && (t = {
@@ -2199,7 +2201,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 			}));
 		}
 	};
-}, Ji = (e = {}) => {
+}, Zi = (e = {}) => {
 	let t = e.now ?? Date.now, n = /* @__PURE__ */ new Map();
 	return {
 		get(e) {
@@ -2222,7 +2224,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 			return n.size;
 		}
 	};
-}, Yi = (e, t) => e === null ? t === void 0 ? "anon:bg" : `anon:${t}` : `subject:${e}`, Xi = (e) => {
+}, Qi = (e, t) => e === null ? t === void 0 ? "anon:bg" : `anon:${t}` : `subject:${e}`, $i = (e) => {
 	let t = e.now ?? Date.now, n = e.keyPrefix ?? "voltro:ryw", r = e.channel ?? `${n}:bus`, i = e.onError ?? ((e, t) => {
 		process.stderr.write(`[voltro:ryw] redis ${t} failed: ${String(e)}\n`);
 	}), a = `${process.pid ?? 0}:${Math.random() * 1e9 | 0}:${t()}`, o = /* @__PURE__ */ new Map(), s = (e) => {
@@ -2281,7 +2283,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 			return o.size;
 		}
 	};
-}, Zi = z({ scope: "voltro:replication" }), Qi = new Lt(), $i = (e, t) => Qi.run(e, t), ea = () => Qi.getStore(), ta = class {
+}, ea = z({ scope: "voltro:replication" }), ta = new Lt(), na = (e, t) => ta.run(e, t), ra = () => ta.getStore(), ia = class {
 	primary;
 	replicas;
 	adapter;
@@ -2294,10 +2296,10 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 	recordRouting;
 	now;
 	constructor(e) {
-		this.primary = e.primary, this.replicas = e.replicas, this.adapter = e.replicationAdapter, this.policy = e.rywPolicy ?? "fallback", this.rywTtlMs = e.rywTtlMs ?? 3e4, this.rywMaxWaitMs = e.rywMaxWaitMs ?? 500, this.now = e.now ?? Date.now, this.rywStore = e.rywStore ?? Ji({ now: this.now }), this.selector = e.replicaSelector ?? Ki(), this.health = e.replicaHealth ?? qi({ now: this.now }), e.recordRouting !== void 0 && (this.recordRouting = e.recordRouting);
+		this.primary = e.primary, this.replicas = e.replicas, this.adapter = e.replicationAdapter, this.policy = e.rywPolicy ?? "fallback", this.rywTtlMs = e.rywTtlMs ?? 3e4, this.rywMaxWaitMs = e.rywMaxWaitMs ?? 500, this.now = e.now ?? Date.now, this.rywStore = e.rywStore ?? Zi({ now: this.now }), this.selector = e.replicaSelector ?? Yi(), this.health = e.replicaHealth ?? Xi({ now: this.now }), e.recordRouting !== void 0 && (this.recordRouting = e.recordRouting);
 	}
 	async query(e) {
-		let t = Qi.getStore(), n = t?.subjectKey ?? "anon:bg";
+		let t = ta.getStore(), n = t?.subjectKey ?? "anon:bg";
 		if (t?.forcePrimary === !0) return this.emitRouting({
 			target: "primary",
 			replicaIndex: null,
@@ -2361,7 +2363,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 				waitMs: 0
 			}), r;
 		} catch (r) {
-			return this.health.reportFailure(i, String(r)), Zi.warn("replica query failed; falling back to primary", {
+			return this.health.reportFailure(i, String(r)), ea.warn("replica query failed; falling back to primary", {
 				idx: a,
 				err: r
 			}), this.emitRouting({
@@ -2430,7 +2432,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 					fallbackReason: "wait-timeout"
 				}), this.primary.query(e);
 			}
-			await na(10);
+			await aa(10);
 		}
 	}
 	async insert(e, t) {
@@ -2470,8 +2472,8 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		return await this.stampPostWrite(), r;
 	}
 	async transactional(e) {
-		let t = await $i({
-			subjectKey: Qi.getStore()?.subjectKey ?? "anon:bg",
+		let t = await na({
+			subjectKey: ta.getStore()?.subjectKey ?? "anon:bg",
 			forcePrimary: !0
 		}, () => this.primary.transactional(e));
 		return await this.stampPostWrite(), t;
@@ -2487,7 +2489,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 	}
 	async stampPostWrite() {
 		if (this.replicas.length === 0) return;
-		let e = Qi.getStore()?.subjectKey ?? "anon:bg";
+		let e = ta.getStore()?.subjectKey ?? "anon:bg";
 		try {
 			let t = await this.adapter.capturePrimaryPosition(this.primary);
 			this.rywStore.set(e, {
@@ -2495,17 +2497,17 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 				expiresAt: this.now() + this.rywTtlMs
 			});
 		} catch (e) {
-			Zi.warn("failed to capture primary position; RYW skipped", { err: e });
+			ea.warn("failed to capture primary position; RYW skipped", { err: e });
 		}
 	}
 	emitRouting(e) {
 		this.recordRouting?.(e);
 	}
-}, na = (e) => new Promise((t) => setTimeout(t, e)), ra = (e, t, n) => {
+}, aa = (e) => new Promise((t) => setTimeout(t, e)), oa = (e, t, n) => {
 	if (t === void 0) return e;
 	let r = t * 1e3 - Date.now();
 	return r <= 0 ? n : b.interruptWhen(e, o.sleep(a.millis(r)));
-}, ia = (e) => {
+}, sa = (e) => {
 	let t = e.indexOf(".");
 	if (t <= 0) return;
 	let n = e.slice(0, t), r = e.slice(t + 1);
@@ -2519,25 +2521,25 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 			kind: n
 		};
 	}
-}, aa = (e, t) => {
-	let n = ia(e);
-	return n === void 0 ? t() : Si(n, t);
-}, oa = (e, t, n, r) => e === "subject" ? `${t}:s:${n}` : e === "global" ? `${t}:global` : r.tenantId == null ? void 0 : `${t}:t:${r.tenantId}`, sa = (e, t) => o.async((n) => {
+}, ca = (e, t) => {
+	let n = sa(e);
+	return n === void 0 ? t() : Ti(n, t);
+}, la = (e, t, n, r) => e === "subject" ? `${t}:s:${n}` : e === "global" ? `${t}:global` : r.tenantId == null ? void 0 : `${t}:t:${r.tenantId}`, ua = (e, t) => o.async((n) => {
 	let r = Ee(t, () => o.runFork(e));
 	return r.addObserver((e) => {
 		n(e);
 	}), o.asVoid(l.interrupt(r));
-}), ca = (e, t, n) => ({
+}), da = (e, t, n) => ({
 	subject: e,
 	traceId: t?.traceId ?? Re(),
 	...t?.spanId === void 0 ? {} : { spanId: t.spanId },
 	...n === void 0 ? {} : { clientId: n }
-}), la = o.currentSpan.pipe(o.catchAll(() => o.succeed(void 0))), ua = (e) => ({
+}), fa = o.currentSpan.pipe(o.catchAll(() => o.succeed(void 0))), pa = (e) => ({
 	traceId: e.traceId,
 	...e.spanId === void 0 ? {} : { spanId: e.spanId }
-}), da = (e, t, n) => {
+}), ma = (e, t, n) => {
 	e !== void 0 && (e.attribute("rpc.tag", t), e.attribute("subject.type", n.type), n.tenantId !== void 0 && n.tenantId !== null && e.attribute("tenant.id", n.tenantId));
-}, fa = (e) => {
+}, ha = (e) => {
 	if (Dr() !== void 0) return async () => {
 		let t = await o.runPromise(o.either(kr(e, (e) => {
 			console.error("[voltro] row filter failed to load — subscription", e);
@@ -2545,13 +2547,13 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		if (t._tag === "Left") throw t.left;
 		return t.right;
 	};
-}, pa = (e, t, n, r, i, a, s, c) => b.asyncScoped((l) => o.gen(function* () {
+}, ga = (e, t, n, r, i, a, s, c) => b.asyncScoped((l) => o.gen(function* () {
 	let u = yield* o.tryPromise(() => t.subscribe(e, (e) => {
 		l.single(e);
 	}, n, r, i, a, s, c)).pipe(o.matchCause({
-		onFailure: (e) => (Ca(`subscription.${i}`, n.traceId, e), {
+		onFailure: (e) => (Ea(`subscription.${i}`, n.traceId, e), {
 			ok: !1,
-			error: Da(e)
+			error: Aa(e)
 		}),
 		onSuccess: (e) => ({
 			ok: !0,
@@ -2567,25 +2569,25 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 	}
 	let d = u.unsubscribe;
 	if (yield* o.addFinalizer(() => o.sync(() => d())), n.clientId !== void 0) {
-		let e = Yr(n.clientId, () => {
+		let e = Qr(n.clientId, () => {
 			l.end();
 		});
 		yield* o.addFinalizer(() => o.sync(() => e()));
 	}
-})), ma = /* @__PURE__ */ new Set(), ha = () => {
-	ma.clear();
-}, ga = (e) => {
-	ma.has(e) || (ma.add(e), process.stderr.write(`[voltro] ${e}: \`cache:\` is declared but NOT applied — this query's handler returns a computed value, and the snapshot cache only wraps a store read. Every subscriber re-runs the handler. Either return a query descriptor (so the read can be cached), or drop \`cache:\` so the declaration matches what happens.\n`));
-}, _a = (e, t, n, r) => b.asyncScoped((i) => o.gen(function* () {
+})), _a = /* @__PURE__ */ new Set(), va = () => {
+	_a.clear();
+}, ya = (e) => {
+	_a.has(e) || (_a.add(e), process.stderr.write(`[voltro] ${e}: \`cache:\` is declared but NOT applied — this query's handler returns a computed value, and the snapshot cache only wraps a store read. Every subscriber re-runs the handler. Either return a query descriptor (so the read can be cached), or drop \`cache:\` so the declaration matches what happens.\n`));
+}, ba = (e, t, n, r) => b.asyncScoped((i) => o.gen(function* () {
 	let a = yield* o.tryPromise(() => t.subscribeComputed(e, (e) => {
 		i.single(e._tag === "snapshot" ? {
 			...e,
 			computed: !0
 		} : e);
 	}, n, r)).pipe(o.matchCause({
-		onFailure: (e) => (Ca(`subscription.${r}`, n.traceId, e), {
+		onFailure: (e) => (Ea(`subscription.${r}`, n.traceId, e), {
 			ok: !1,
-			error: Da(e)
+			error: Aa(e)
 		}),
 		onSuccess: (e) => ({
 			ok: !0,
@@ -2601,21 +2603,21 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 	}
 	let s = a.unsubscribe;
 	if (yield* o.addFinalizer(() => o.sync(() => s())), n.clientId !== void 0) {
-		let e = Yr(n.clientId, () => {
+		let e = Qr(n.clientId, () => {
 			i.end();
 		});
 		yield* o.addFinalizer(() => o.sync(() => e()));
 	}
-})), va = (e, t, n = "rpc.subscription", r, i, a, s) => b.unwrap(o.gen(function* () {
-	let c = yield* et, l = yield* Ge, u = yield* la;
-	da(u, n, c);
-	let d = ca(c, u, l.clientId), f = Yi(c.id, l.clientId), p = $i({ subjectKey: f }, () => ai({
+})), xa = (e, t, n = "rpc.subscription", r, i, a, s) => b.unwrap(o.gen(function* () {
+	let c = yield* et, l = yield* Ge, u = yield* fa;
+	ma(u, n, c);
+	let d = da(c, u, l.clientId), f = Qi(c.id, l.clientId), p = na({ subjectKey: f }, () => ci({
 		traceId: d.traceId,
 		...d.spanId === void 0 ? {} : { spanId: d.spanId }
-	}, () => aa(n, () => e(d)))), m = o.isEffect(p) ? yield* p.pipe(o.matchCause({
-		onFailure: (e) => (Ca(`subscription.${n}`, d.traceId, e), {
+	}, () => ca(n, () => e(d)))), m = o.isEffect(p) ? yield* p.pipe(o.matchCause({
+		onFailure: (e) => (Ea(`subscription.${n}`, d.traceId, e), {
 			ok: !1,
-			error: Da(e)
+			error: Aa(e)
 		}),
 		onSuccess: (e) => ({
 			ok: !0,
@@ -2630,44 +2632,44 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		error: m.error
 	});
 	let h = m.value;
-	if (zr(h)) return i !== void 0 && ga(n), _a(h, t, d, n);
-	let g = h, _ = r?.(g), v = i === void 0 ? void 0 : oa(i.scope, i.baseKey, f, c);
-	return ra(pa(g, t, d, _, n, i === void 0 || v === void 0 ? void 0 : {
+	if (zr(h)) return i !== void 0 && ya(n), ba(h, t, d, n);
+	let g = h, _ = r?.(g), v = i === void 0 ? void 0 : la(i.scope, i.baseKey, f, c);
+	return oa(ga(g, t, d, _, n, i === void 0 || v === void 0 ? void 0 : {
 		key: v,
 		ttlMs: i.ttlMs,
 		swrMs: i.swrMs
-	}, a?.(c), s?.(c) ?? fa(c)), l.credentialExpiresAt, b.empty);
-}).pipe(o.withSpan(n, { attributes: { "framework.kind": "subscription" } }))), ya = (e, t = "rpc.stream", n, r) => b.unwrap(o.gen(function* () {
-	let a = yield* et, s = yield* Ge, c = yield* la;
-	da(c, t, a);
-	let l = ca(a, c, s.clientId), u = aa(t, () => e(l)), d = o.isEffect(u) ? yield* u.pipe(o.orDie) : u, f = n === void 0 || n.length === 0 ? void 0 : () => ot(a, n, r), p = ra(f === void 0 ? d : b.unwrap(f().pipe(o.map((e) => e ? b.fail(e) : b.flatMap(d, (e) => b.unwrap(f().pipe(o.map((t) => t ? b.fail(t) : b.make(e)))))))), s.credentialExpiresAt, b.empty);
+	}, a?.(c), s?.(c) ?? ha(c)), l.credentialExpiresAt, b.empty);
+}).pipe(o.withSpan(n, { attributes: { "framework.kind": "subscription" } }))), Sa = (e, t = "rpc.stream", n, r) => b.unwrap(o.gen(function* () {
+	let a = yield* et, s = yield* Ge, c = yield* fa;
+	ma(c, t, a);
+	let l = da(a, c, s.clientId), u = ca(t, () => e(l)), d = o.isEffect(u) ? yield* u.pipe(o.orDie) : u, f = n === void 0 || n.length === 0 ? void 0 : () => ot(a, n, r), p = oa(f === void 0 ? d : b.unwrap(f().pipe(o.map((e) => e ? b.fail(e) : b.flatMap(d, (e) => b.unwrap(f().pipe(o.map((t) => t ? b.fail(t) : b.make(e)))))))), s.credentialExpiresAt, b.empty);
 	if (l.clientId === void 0) return p;
 	let m = l.clientId;
 	return b.unwrapScoped(o.gen(function* () {
-		let e = yield* i.make(), t = Yr(m, () => {
+		let e = yield* i.make(), t = Qr(m, () => {
 			i.unsafeDone(e, o.void);
 		});
 		return yield* o.addFinalizer(() => o.sync(() => t())), p.pipe(b.interruptWhen(i.await(e)));
 	}));
-}).pipe(o.withSpan(t, { attributes: { "framework.kind": "stream" } }))), ba = z({ scope: "voltro:rpc" }), xa = z({ scope: "voltro:http" }), Sa = z({ scope: "voltro:shutdown" }), Ca = (t, n, r) => {
+}).pipe(o.withSpan(t, { attributes: { "framework.kind": "stream" } }))), Ca = z({ scope: "voltro:rpc" }), wa = z({ scope: "voltro:http" }), Ta = z({ scope: "voltro:shutdown" }), Ea = (t, n, r) => {
 	if (e.isInterruptedOnly(r)) return;
 	let i = e.squash(r), a = i?._tag, o = i instanceof Error ? i.message : i?.message ?? String(i), s = e.dieOption(r)._tag === "Some", c = xn(i), l = {
 		traceId: n,
 		...a === void 0 ? {} : { errorTag: a },
 		...c
 	}, u = o === "Failed to execute statement" && typeof c.dbMessage == "string" ? c.dbMessage : o;
-	s ? ba.error(`${t} failed: ${u}`, l) : ba.warn(`${t} failed: ${u}`, l);
-}, wa = /* @__PURE__ */ new Set([
+	s ? Ca.error(`${t} failed: ${u}`, l) : Ca.warn(`${t} failed: ${u}`, l);
+}, Da = /* @__PURE__ */ new Set([
 	"SqlError",
 	"ResultLengthMismatch",
 	"FieldDecryptionError"
-]), Ta = (e) => typeof e == "object" && !!e && typeof e._tag == "string" && wa.has(e._tag), Ea = (e) => ({
+]), Oa = (e) => typeof e == "object" && !!e && typeof e._tag == "string" && Da.has(e._tag), ka = (e) => ({
 	_tag: "InternalError",
 	message: "internal server error",
 	traceId: e
-}), Da = (t) => {
+}), Aa = (t) => {
 	let n = e.squash(t);
-	if (n && typeof n == "object" && n._tag === "UnknownException" && (n = n.error ?? n.cause ?? n), Ta(n)) return {
+	if (n && typeof n == "object" && n._tag === "UnknownException" && (n = n.error ?? n.cause ?? n), Oa(n)) return {
 		_tag: "InternalError",
 		message: "internal server error"
 	};
@@ -2679,7 +2681,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		...typeof a == "string" ? { _tag: a } : {},
 		message: typeof o == "string" ? o : String(n)
 	};
-}, Oa = (e) => {
+}, ja = (e) => {
 	if (e === void 0) return;
 	let t = y.encodeUnknownSync(e), n = y.decodeUnknownSync(e);
 	return {
@@ -2698,40 +2700,40 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 			}
 		}
 	};
-}, ka = (e) => ({
+}, Ma = (e) => ({
 	_tag: "MutationInFlight",
 	message: "a request with this idempotency key is already in flight",
 	traceId: e
-}), Aa = (e, t, n = "rpc.mutation", r, i) => o.gen(function* () {
-	let a = yield* et, s = yield* Ge, c = yield* la;
-	da(c, n, a);
-	let l = ca(a, c, s.clientId), u = i && s.idempotencyKey ? {
+}), Na = (e, t, n = "rpc.mutation", r, i) => o.gen(function* () {
+	let a = yield* et, s = yield* Ge, c = yield* fa;
+	ma(c, n, a);
+	let l = da(a, c, s.clientId), u = i && s.idempotencyKey ? {
 		store: i.store,
 		ttlMs: i.ttlMs,
 		key: s.idempotencyKey,
-		scope: bt(a.tenantId, Wi(a), n)
+		scope: bt(a.tenantId, qi(a), n)
 	} : null;
 	if (u) {
 		let e = yield* o.promise(() => at(u.store, u.scope, u.key, u.ttlMs, Date.now()));
 		if (e.kind === "replay") return r ? r.decode(e.response.body) : e.response.body;
-		if (e.kind === "conflict") return yield* o.die(ka(l.traceId));
+		if (e.kind === "conflict") return yield* o.die(Ma(l.traceId));
 	}
-	let d = Yi(a.id, s.clientId), f = {
+	let d = Qi(a.id, s.clientId), f = {
 		traceId: l.traceId,
-		subjectId: Wi(a),
+		subjectId: qi(a),
 		procedure: n
-	}, p = $i({ subjectKey: d }, () => ai({
+	}, p = na({ subjectKey: d }, () => ci({
 		traceId: l.traceId,
 		...l.spanId === void 0 ? {} : { spanId: l.spanId }
-	}, () => Ee(f, () => aa(n, () => e(t, l))))), m = o.isEffect(p) ? sa(p, f) : o.tryPromise({
+	}, () => Ee(f, () => ca(n, () => e(t, l))))), m = o.isEffect(p) ? ua(p, f) : o.tryPromise({
 		try: () => Promise.resolve(p),
 		catch: (e) => e
 	});
 	return yield* (u ? m.pipe(o.tap((e) => o.promise(() => dt(u.store, u.scope, u.key, {
 		status: 200,
 		body: r ? r.encode(e) : e
-	}, Date.now())).pipe(o.ignore)), o.tapErrorCause(() => o.promise(() => ut(u.store, u.scope, u.key)).pipe(o.ignore))) : m).pipe(o.tapErrorCause((e) => o.sync(() => Ca(n, l.traceId, e))), o.catchIf(Ta, () => o.die(Ea(l.traceId))), o.annotateLogs(ua(l)));
-}).pipe(o.withSpan(n, { attributes: { "framework.kind": "mutation" } })), ja = 8 * 1024 * 1024, Ma = (t) => {
+	}, Date.now())).pipe(o.ignore)), o.tapErrorCause(() => o.promise(() => ut(u.store, u.scope, u.key)).pipe(o.ignore))) : m).pipe(o.tapErrorCause((e) => o.sync(() => Ea(n, l.traceId, e))), o.catchIf(Oa, () => o.die(ka(l.traceId))), o.annotateLogs(pa(l)));
+}).pipe(o.withSpan(n, { attributes: { "framework.kind": "mutation" } })), Pa = 8 * 1024 * 1024, Fa = (t) => {
 	let n = t.port ?? 4e3, r = t.host, i = t.path ?? "/ws", a = St(), s = (e) => Dt.HttpServerRequest.pipe(o.flatMap((e) => o.gen(function* () {
 		if (!t.inspectRoute) return V.text("inspect route not configured", { status: 404 });
 		let n = {};
@@ -2808,7 +2810,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		let e = (e) => Dt.HttpServerRequest.pipe(o.flatMap((t) => o.gen(function* () {
 			let n = {};
 			for (let [e, r] of Object.entries(t.headers)) r !== void 0 && (n[e.toLowerCase()] = Array.isArray(r) ? r.join(", ") : r);
-			let r = t.method !== "GET" && t.method !== "HEAD" ? yield* t.text.pipe(o.orElseSucceed(() => "")) : "", i = new TextEncoder().encode(r), a = t.url.split("?")[0], s = ri(n.traceparent), c = yield* o.promise(() => e.handle({
+			let r = t.method !== "GET" && t.method !== "HEAD" ? yield* t.text.pipe(o.orElseSucceed(() => "")) : "", i = new TextEncoder().encode(r), a = t.url.split("?")[0], s = oi(n.traceparent), c = yield* o.promise(() => e.handle({
 				method: t.method,
 				path: a,
 				headers: n,
@@ -2840,7 +2842,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 				rawBody: c,
 				...l === void 0 ? {} : { store: l }
 			}, d = yield* o.promise(() => Pt(n, u));
-			d.status >= 500 && xa.warn(`${e.method} ${a} → ${d.status}`, {
+			d.status >= 500 && wa.warn(`${e.method} ${a} → ${d.status}`, {
 				method: e.method,
 				path: a,
 				status: d.status,
@@ -2875,7 +2877,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 				});
 			}
 			return d.body instanceof Uint8Array ? V.uint8Array(d.body, p) : V.text(d.body ?? "", p);
-		})), o.tapErrorCause((t) => e.isInterruptedOnly(t) ? o.void : o.sync(() => xa.error(`${n.map((e) => e.method).join("|")} ${n[0].path} threw`, { path: n[0].path }, e.squash(t))))), r = /* @__PURE__ */ new Map();
+		})), o.tapErrorCause((t) => e.isInterruptedOnly(t) ? o.void : o.sync(() => wa.error(`${n.map((e) => e.method).join("|")} ${n[0].path} threw`, { path: n[0].path }, e.squash(t))))), r = /* @__PURE__ */ new Map();
 		for (let e of t.httpRoutes) {
 			let t = r.get(e.path);
 			t ? t.push(e) : r.set(e.path, [e]);
@@ -2890,7 +2892,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		let e = yield* Mt.Protocol;
 		yield* o.forkScoped(o.gen(function* () {
 			let t = yield* e.disconnects.take;
-			Kr(t), Xr(t);
+			Yr(t), $r(t);
 		}).pipe(o.forever));
 	})), y = u.mergeAll(g, v).pipe(u.provide(h), u.provide(jt.layerJson), u.provide(t.handlersLayer)), x = u.mergeAll(y, _, f, p, m), S = t.pluginHttpInterceptor, C = t.healthCheck, w = Number(process.env.VOLTRO_MAX_RPC_BODY_BYTES), T = t.maxRpcBodyBytes ?? (Number.isFinite(w) && w > 0 ? w : 8388608), E = { "cache-control": "no-store" }, ee = (e) => o.gen(function* () {
 		let t = yield* Dt.HttpServerRequest, n = {};
@@ -2941,20 +2943,20 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 	let te = z({ scope: "voltro:rpc" }), ne = u.launch(D).pipe(o.catchAllCause((t) => o.sync(() => {
 		te.error("rpc server crashed", {}, e.squash(t)), process.exit(1);
 	}))), re = o.runFork(ne);
-	return Na.add(re), Ha(), {
+	return Ia.add(re), Ga(), {
 		server: a,
 		shutdown: async () => {
-			Na.delete(re), await o.runPromise(l.interrupt(re)).then(() => void 0, () => void 0);
+			Ia.delete(re), await o.runPromise(l.interrupt(re)).then(() => void 0, () => void 0);
 		}
 	};
-}, Na = /* @__PURE__ */ new Set(), Pa = /* @__PURE__ */ new Set(), Fa = !1, Ia = (e) => (Pa.add(e), () => {
-	Pa.delete(e);
-}), La = 1e4, Ra = 1e3, za = 3e5, Ba = () => {
+}, Ia = /* @__PURE__ */ new Set(), La = /* @__PURE__ */ new Set(), Ra = !1, za = (e) => (La.add(e), () => {
+	La.delete(e);
+}), Ba = 1e4, Va = 1e3, Ha = 3e5, Ua = () => {
 	let e = process.env.VOLTRO_SHUTDOWN_GRACE_MS;
-	if (e === void 0 || e === "") return La;
+	if (e === void 0 || e === "") return Ba;
 	let t = Number(e);
-	return !Number.isFinite(t) || t <= 0 ? La : Math.min(za, Math.max(Ra, Math.trunc(t)));
-}, Va = (e) => {
+	return !Number.isFinite(t) || t <= 0 ? Ba : Math.min(Ha, Math.max(Va, Math.trunc(t)));
+}, Wa = (e) => {
 	let t = Date.now(), n = !1, r = (r) => () => {
 		n || (n = !0, clearTimeout(i), e.onOutcome?.({
 			reason: r,
@@ -2962,23 +2964,23 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		}), e.exit());
 	}, i = setTimeout(r("deadline"), e.deadlineMs);
 	i.unref?.(), Promise.all(e.hooks.map((e) => Promise.resolve().then(e).then(() => void 0, () => void 0))).then(() => Promise.all(e.fibers.map((e) => o.runPromise(l.interrupt(e)).then(() => void 0, () => void 0)))).then(r("drained"), r("drained"));
-}, Ha = () => {
-	if (Fa) return;
-	Fa = !0;
+}, Ga = () => {
+	if (Ra) return;
+	Ra = !0;
 	let e = () => {
-		let e = [...Na], t = [...Pa];
-		Na.clear(), Pa.clear(), Va({
+		let e = [...Ia], t = [...La];
+		Ia.clear(), La.clear(), Wa({
 			fibers: e,
 			hooks: t,
-			deadlineMs: Ba(),
+			deadlineMs: Ua(),
 			exit: () => process.exit(0),
 			onOutcome: ({ reason: e, ms: t }) => {
-				e === "drained" ? Sa.info(`drained in ${t}ms`) : Sa.error(`drain deadline exceeded — cut at ${t}ms`, { hint: "a shutdown hook or a pool drain did not complete; whatever had not finished did not happen" });
+				e === "drained" ? Ta.info(`drained in ${t}ms`) : Ta.error(`drain deadline exceeded — cut at ${t}ms`, { hint: "a shutdown hook or a pool drain did not complete; whatever had not finished did not happen" });
 			}
 		});
 	};
 	process.once("SIGINT", e), process.once("SIGTERM", e);
-}, Ua = (e, t = 1e4) => new Promise((n, r) => {
+}, Ka = (e, t = 1e4) => new Promise((n, r) => {
 	if (e.listening) {
 		n();
 		return;
@@ -2994,13 +2996,13 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		o(e);
 	}
 	a = setTimeout(() => o(/* @__PURE__ */ Error(`rpc server did not bind within ${t}ms`)), t), e.on("listening", s), e.on("error", c);
-}), Wa = () => {
+}), qa = () => {
 	let e = process.env.FRAMEWORK_TRACING?.toLowerCase();
 	return e === "console" || e === "otlp" || e === "off" ? e : process.env.OTEL_EXPORTER_OTLP_ENDPOINT || process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT ? "otlp" : "off";
-}, Ga = () => {
+}, Ja = () => {
 	let e = process.env.FRAMEWORK_METRICS?.toLowerCase();
 	return e === "console" || e === "otlp" || e === "off" ? e : process.env.OTEL_EXPORTER_OTLP_ENDPOINT || process.env.OTEL_EXPORTER_OTLP_METRICS_ENDPOINT ? "otlp" : "off";
-}, Ka = async () => {
+}, Ya = async () => {
 	let [e, t, n, r, i] = await Promise.all([
 		import("@opentelemetry/sdk-trace-base"),
 		import("@opentelemetry/sdk-metrics"),
@@ -3015,7 +3017,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		otlpMetrics: r,
 		nodeSdk: i
 	};
-}, qa = (e, t, n) => {
+}, Xa = (e, t, n) => {
 	let { PeriodicExportingMetricReader: r, ConsoleMetricExporter: i, InMemoryMetricExporter: a, AggregationTemporality: o } = e.sdkMetrics;
 	if (t === "off") return {
 		reader: void 0,
@@ -3038,8 +3040,8 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		}),
 		inMemory: void 0
 	};
-}, Ja = async (e = {}) => {
-	let t = e.mode ?? Wa(), n = e.metricsMode ?? Ga(), r = e.extraSpanProcessors ?? [], i = e.extraMetricReaders ?? [];
+}, Za = async (e = {}) => {
+	let t = e.mode ?? qa(), n = e.metricsMode ?? Ja(), r = e.extraSpanProcessors ?? [], i = e.extraMetricReaders ?? [];
 	if (t === "off" && e.traceSink === void 0 && n === "off" && r.length === 0 && i.length === 0) return {
 		layer: u.empty,
 		mode: t,
@@ -3048,13 +3050,13 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		metricsMode: n,
 		inMemoryMetricExporter: void 0
 	};
-	let a = await Ka(), { ConsoleSpanExporter: o, InMemorySpanExporter: s, SimpleSpanProcessor: c, BatchSpanProcessor: l } = a.sdkTrace, d = t === "off", f = e.serviceName ?? process.env.OTEL_SERVICE_NAME ?? "voltro-app", p, m;
+	let a = await Ya(), { ConsoleSpanExporter: o, InMemorySpanExporter: s, SimpleSpanProcessor: c, BatchSpanProcessor: l } = a.sdkTrace, d = t === "off", f = e.serviceName ?? process.env.OTEL_SERVICE_NAME ?? "voltro-app", p, m;
 	e.spanProcessor ? m = e.spanProcessor : d ? m = void 0 : t === "memory" ? (p = new s(), m = new c(p)) : m = t === "console" ? new c(new o()) : new l(new a.otlpTrace.OTLPTraceExporter());
 	let h = [
 		...e.traceSink ? [e.traceSink] : [],
 		...m ? [m] : [],
 		...r
-	], g = h.length === 1 ? h[0] : h, { reader: _, inMemory: v } = qa(a, n, e.metricExportIntervalMillis ?? (process.env.OTEL_METRIC_EXPORT_INTERVAL ? Number(process.env.OTEL_METRIC_EXPORT_INTERVAL) : 6e4)), y = [..._ ? [_] : [], ...i], b = y.length === 0 ? void 0 : y.length === 1 ? y[0] : y, x = {
+	], g = h.length === 1 ? h[0] : h, { reader: _, inMemory: v } = Xa(a, n, e.metricExportIntervalMillis ?? (process.env.OTEL_METRIC_EXPORT_INTERVAL ? Number(process.env.OTEL_METRIC_EXPORT_INTERVAL) : 6e4)), y = [..._ ? [_] : [], ...i], b = y.length === 0 ? void 0 : y.length === 1 ? y[0] : y, x = {
 		serviceName: f,
 		...e.serviceVersion ? { serviceVersion: e.serviceVersion } : {},
 		...e.resourceAttributes ? { attributes: e.resourceAttributes } : {}
@@ -3072,18 +3074,18 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		metricsMode: n,
 		inMemoryMetricExporter: v
 	};
-}, Ya = {
+}, Qa = {
 	[Bt.INTERNAL]: "internal",
 	[Bt.SERVER]: "server",
 	[Bt.CLIENT]: "client",
 	[Bt.PRODUCER]: "producer",
 	[Bt.CONSUMER]: "consumer"
-}, Xa = (e) => e[0] * 1e3 + e[1] / 1e6, Za = 512, Qa = 48, $a = (e) => {
+}, $a = (e) => e[0] * 1e3 + e[1] / 1e6, eo = 512, to = 48, no = (e) => {
 	let t = {}, n = 0;
 	for (let r in e) {
-		if (n >= Qa) break;
+		if (n >= to) break;
 		let i = e[r];
-		if (typeof i == "string") t[r] = i.length > Za ? `${i.slice(0, Za)}…` : i;
+		if (typeof i == "string") t[r] = i.length > eo ? `${i.slice(0, eo)}…` : i;
 		else if (typeof i == "number" || typeof i == "boolean" || i == null) t[r] = i;
 		else {
 			let e;
@@ -3092,49 +3094,49 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 			} catch {
 				e = String(i);
 			}
-			t[r] = e.length > Za ? `${e.slice(0, Za)}…` : e;
+			t[r] = e.length > eo ? `${e.slice(0, eo)}…` : e;
 		}
 		n++;
 	}
 	return t;
-}, eo = {
+}, ro = {
 	[Vt.UNSET]: "unset",
 	[Vt.OK]: "ok",
 	[Vt.ERROR]: "error"
-}, to = (e) => {
+}, io = (e) => {
 	let t = e.spanContext(), n = e.events.length > 0 ? e.events.slice(0, 16).map((e) => ({
 		name: e.name,
-		tsMs: Xa(e.time),
-		...e.attributes ? { attributes: $a(e.attributes) } : {}
+		tsMs: $a(e.time),
+		...e.attributes ? { attributes: no(e.attributes) } : {}
 	})) : void 0;
 	return {
 		traceId: t.traceId,
 		spanId: t.spanId,
 		parentSpanId: e.parentSpanContext?.spanId ?? null,
 		name: e.name,
-		kind: Ya[e.kind] ?? "internal",
-		attributes: $a(e.attributes),
-		startMs: Xa(e.startTime),
-		endMs: Xa(e.endTime),
-		durationMs: Xa(e.duration),
-		status: eo[e.status.code] ?? "unset",
+		kind: Qa[e.kind] ?? "internal",
+		attributes: no(e.attributes),
+		startMs: $a(e.startTime),
+		endMs: $a(e.endTime),
+		durationMs: $a(e.duration),
+		status: ro[e.status.code] ?? "unset",
 		...e.status.message ? { statusMessage: e.status.message } : {},
 		...n ? { events: n } : {}
 	};
-}, no = (e) => ({
+}, ao = (e) => ({
 	onStart: () => {},
 	onEnd: (t) => {
 		try {
-			e(to(t));
+			e(io(t));
 		} catch {}
 	},
 	forceFlush: () => Promise.resolve(),
 	shutdown: () => Promise.resolve()
-}), ro = { get: (e) => Promise.resolve(process.env[e]) }, io = ro, ao = (e) => {
-	io = e;
-}, oo = () => {
-	io = ro;
-}, so = async (e) => await io.get(e) ?? process.env[e], co = (e) => process.env[e], lo = (e, t = 6e4, n = () => Date.now()) => {
+}), oo = { get: (e) => Promise.resolve(process.env[e]) }, so = oo, co = (e) => {
+	so = e;
+}, lo = () => {
+	so = oo;
+}, uo = async (e) => await so.get(e) ?? process.env[e], fo = (e) => process.env[e], po = (e, t = 6e4, n = () => Date.now()) => {
 	let r = /* @__PURE__ */ new Map();
 	return { get: async (i) => {
 		let a = r.get(i);
@@ -3145,12 +3147,12 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 			at: n()
 		}), o;
 	} };
-}, uo = (e) => {
+}, mo = (e) => {
 	let t = {
 		accept: "application/json",
 		...e.headers ?? {}
 	};
-	if (e.perKey) return lo({ get: async (n) => {
+	if (e.perKey) return po({ get: async (n) => {
 		let r = await fetch(`${e.url.replace(/\/$/, "")}/${encodeURIComponent(n)}`, { headers: t });
 		if (!r.ok) return;
 		let i = await r.json();
@@ -3161,34 +3163,34 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		let t = (await a())[e];
 		return typeof t == "string" ? t : void 0;
 	} };
-}, fo = (e) => e === void 0 || e === "env" || typeof e == "object" && e.kind === "env" ? ro : e.kind === "custom" ? e.backend : e.kind === "http" ? uo(e) : ro, po = "_voltro_idempotency", mo = (e) => {
+}, ho = (e) => e === void 0 || e === "env" || typeof e == "object" && e.kind === "env" ? oo : e.kind === "custom" ? e.backend : e.kind === "http" ? mo(e) : oo, go = "_voltro_idempotency", _o = (e) => {
 	if (e == null) return null;
 	let t = typeof e == "string" ? JSON.parse(e) : e;
 	return t && typeof t == "object" && "status" in t ? t : null;
-}, ho = (e) => ({
+}, vo = (e) => ({
 	scope: e.scope,
 	key: e.key,
 	status: e.status === "completed" ? "completed" : "in_flight",
-	response: mo(e.response),
+	response: _o(e.response),
 	createdAt: yt(e.createdAt)
-}), go = async (e, t, n) => (await e.query({
-	table: po,
+}), yo = async (e, t, n) => (await e.query({
+	table: go,
 	predicate: C(O("scope", t), O("key", n)),
 	order: [],
 	take: 1,
 	skip: void 0,
 	projection: void 0
-}))[0] ?? null, _o = (e) => ({
+}))[0] ?? null, bo = (e) => ({
 	get: async (t, n) => {
-		let r = await go(e, t, n);
-		return r ? ho(r) : null;
+		let r = await yo(e, t, n);
+		return r ? vo(r) : null;
 	},
 	claim: async (t, n, r, i) => {
 		for (let a = 0; a < 2; a++) {
 			let a = A({
 				kind: "typeid",
 				prefix: "idem"
-			}, po), o = await e.insertIgnore(po, {
+			}, go), o = await e.insertIgnore(go, {
 				id: a,
 				scope: t,
 				key: n,
@@ -3197,11 +3199,11 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 				createdAt: new Date(r)
 			}, { conflictColumns: ["scope", "key"] });
 			if (o.id === a) return "claimed";
-			if (r - yt(o.createdAt) < i) return ho(o);
-			await e.delete(po, o.id);
+			if (r - yt(o.createdAt) < i) return vo(o);
+			await e.delete(go, o.id);
 		}
-		let a = await go(e, t, n);
-		return a ? ho(a) : {
+		let a = await yo(e, t, n);
+		return a ? vo(a) : {
 			scope: t,
 			key: n,
 			status: "in_flight",
@@ -3210,33 +3212,33 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		};
 	},
 	complete: async (t, n, r, i) => {
-		let a = await go(e, t, n);
-		a && await e.update(po, a.id, {
+		let a = await yo(e, t, n);
+		a && await e.update(go, a.id, {
 			status: "completed",
 			response: r
 		});
 	},
 	release: async (t, n) => {
-		let r = await go(e, t, n);
-		r && await e.delete(po, r.id);
+		let r = await yo(e, t, n);
+		r && await e.delete(go, r.id);
 	}
-}), J = "_voltro_kv", vo = (e) => {
+}), J = "_voltro_kv", xo = (e) => {
 	if (e == null) return null;
 	if (e instanceof Date) return e.getTime();
 	if (typeof e == "number") return e;
 	let t = Date.parse(String(e));
 	return Number.isNaN(t) ? null : t;
-}, yo = (e, t) => {
-	let n = vo(e.expiresAt);
+}, So = (e, t) => {
+	let n = xo(e.expiresAt);
 	return n !== null && n <= t;
-}, bo = (e) => e === null ? null : JSON.parse(e), xo = async (e, t) => (await e.query({
+}, Co = (e) => e === null ? null : JSON.parse(e), wo = async (e, t) => (await e.query({
 	table: J,
 	predicate: O("key", t),
 	order: [],
 	take: 1,
 	skip: void 0,
 	projection: void 0
-}))[0] ?? null, So = (e) => {
+}))[0] ?? null, To = (e) => {
 	let t = (e, t, n) => o.tryPromise({
 		try: n,
 		catch: (n) => new Ut({
@@ -3247,8 +3249,8 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 	});
 	return {
 		get: (n) => t("get", n, async () => {
-			let t = await xo(e, n);
-			return t === null ? h.none() : yo(t, Date.now()) ? (await e.delete(J, t.id), h.none()) : h.some(bo(t.value));
+			let t = await wo(e, n);
+			return t === null ? h.none() : So(t, Date.now()) ? (await e.delete(J, t.id), h.none()) : h.some(Co(t.value));
 		}),
 		set: (n, r, i) => t("set", n, async () => {
 			let t = Date.now(), a = i?.ttlMs !== void 0 && i.ttlMs > 0 ? new Date(t + i.ttlMs) : null, o = A({
@@ -3271,14 +3273,14 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 			});
 		}),
 		delete: (n) => t("delete", n, async () => {
-			let t = await xo(e, n);
+			let t = await wo(e, n);
 			if (t === null) return !1;
-			let r = !yo(t, Date.now());
+			let r = !So(t, Date.now());
 			return await e.delete(J, t.id), r;
 		}),
 		has: (n) => t("has", n, async () => {
-			let t = await xo(e, n);
-			return t === null ? !1 : yo(t, Date.now()) ? (await e.delete(J, t.id), !1) : !0;
+			let t = await wo(e, n);
+			return t === null ? !1 : So(t, Date.now()) ? (await e.delete(J, t.id), !1) : !0;
 		}),
 		list: (n) => t("list", "", async () => {
 			let t = Date.now(), r = ye(de("expiresAt"), oe("expiresAt", new Date(t))), i = n === "" ? r : C(te("key", n), r), a = await e.query({
@@ -3289,7 +3291,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 				skip: void 0,
 				projection: void 0
 			}), o = [];
-			for (let e of a) yo(e, t) || (n === "" || e.key.startsWith(n)) && o.push(e.key);
+			for (let e of a) So(e, t) || (n === "" || e.key.startsWith(n)) && o.push(e.key);
 			return o;
 		}),
 		clear: () => t("clear", "", async () => {
@@ -3299,8 +3301,8 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 			} });
 		})
 	};
-}, Co = async ({ store: e, env: t = process.env }) => {
-	let n = (t.KV_BACKEND ?? "database").toLowerCase(), r = n === "redis" ? "redis" : n === "memory" ? "memory" : "database", i = r === "redis" ? qt(t.KV_KEY_PREFIX ? { keyPrefix: t.KV_KEY_PREFIX } : {}).pipe(u.provide(Gt)) : r === "memory" ? Kt() : u.succeed(Wt, Wt.of(So(e))), a = d.make(Ht.Default.pipe(u.provide(i))), o = await a.runPromise(Ht);
+}, Eo = async ({ store: e, env: t = process.env }) => {
+	let n = (t.KV_BACKEND ?? "database").toLowerCase(), r = n === "redis" ? "redis" : n === "memory" ? "memory" : "database", i = r === "redis" ? qt(t.KV_KEY_PREFIX ? { keyPrefix: t.KV_KEY_PREFIX } : {}).pipe(u.provide(Gt)) : r === "memory" ? Kt() : u.succeed(Wt, Wt.of(To(e))), a = d.make(Ht.Default.pipe(u.provide(i))), o = await a.runPromise(Ht);
 	return {
 		kv: {
 			get: (e) => a.runPromise(o.get(e)).then((e) => h.getOrUndefined(e)),
@@ -3315,7 +3317,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		backend: r,
 		dispose: () => a.dispose()
 	};
-}, wo = {
+}, Do = {
 	get: () => Promise.resolve(void 0),
 	getOrElse: (e, t) => Promise.resolve(t()),
 	set: () => Promise.resolve(),
@@ -3323,7 +3325,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 	has: () => Promise.resolve(!1),
 	list: () => Promise.resolve([]),
 	clear: () => Promise.resolve()
-}, To = "_voltro_api_keys", Eo = (e) => Ie("sha256").update(e, "utf8").digest("hex"), Do = (e = "voltro_") => `${e}${Le(30).toString("base64url")}`, Oo = (e) => ({
+}, Oo = "_voltro_api_keys", ko = (e) => Ie("sha256").update(e, "utf8").digest("hex"), Ao = (e = "voltro_") => `${e}${Le(30).toString("base64url")}`, jo = (e) => ({
 	id: e.id,
 	name: e.name,
 	keyPrefix: e.keyPrefix,
@@ -3336,18 +3338,18 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 	createdBy: e.createdBy ?? null,
 	onBehalfOf: e.onBehalfOf ?? null,
 	...e.metadata == null ? {} : { metadata: e.metadata }
-}), ko = (e, t) => e.revokedAt === null && (e.expiresAt === null || e.expiresAt > t), Ao = (e, t = {}) => {
+}), Mo = (e, t) => e.revokedAt === null && (e.expiresAt === null || e.expiresAt > t), No = (e, t = {}) => {
 	let n = t.prefix ?? "voltro_", r = t.usage, i = async (t) => {
-		let r = Do(n), i = A({
+		let r = Ao(n), i = A({
 			kind: "typeid",
 			prefix: "apikey"
-		}, To), a = t.scopes ?? [], o = t.expiresAt == null ? null : t.expiresAt instanceof Date ? t.expiresAt.getTime() : t.expiresAt;
+		}, Oo), a = t.scopes ?? [], o = t.expiresAt == null ? null : t.expiresAt instanceof Date ? t.expiresAt.getTime() : t.expiresAt;
 		return await e.insert({
 			id: i,
 			tenantId: t.tenantId ?? null,
 			name: t.name,
 			onBehalfOf: t.onBehalfOf ?? null,
-			hashedKey: Eo(r),
+			hashedKey: ko(r),
 			keyPrefix: r.slice(0, n.length + 6),
 			scopes: a,
 			lastUsedAt: null,
@@ -3366,7 +3368,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		};
 	}, a = async (t, n = Date.now()) => {
 		let i = await e.findByHash(t);
-		return !i || !ko(i, n) ? null : (r === void 0 ? await e.patch(i.id, { lastUsedAt: n }) : r.touch(i.id, n), {
+		return !i || !Mo(i, n) ? null : (r === void 0 ? await e.patch(i.id, { lastUsedAt: n }) : r.touch(i.id, n), {
 			id: i.id,
 			tenantId: i.tenantId ?? "",
 			createdBy: i.createdBy ?? null,
@@ -3378,7 +3380,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 	return {
 		issue: i,
 		resolveByHash: a,
-		verify: (e, t) => a(Eo(e), t),
+		verify: (e, t) => a(ko(e), t),
 		revoke: async (t, n, r = Date.now()) => {
 			let i = await e.findById(t);
 			return !i || (i.tenantId ?? null) !== n ? !1 : (await e.patch(t, { revokedAt: r }), !0);
@@ -3394,9 +3396,9 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 				...a.metadata == null ? {} : { metadata: a.metadata }
 			}));
 		},
-		list: async (t) => (await e.listByTenant(t)).map(Oo)
+		list: async (t) => (await e.listByTenant(t)).map(jo)
 	};
-}, jo = () => {
+}, Po = () => {
 	let e = /* @__PURE__ */ new Map();
 	return {
 		insert: async (t) => {
@@ -3413,21 +3415,21 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 			});
 		}
 	};
-}, Mo = (e) => e == null ? null : e instanceof Date ? e.getTime() : typeof e == "number" ? e : typeof e == "string" ? new Date(e).getTime() : null, No = (e) => ({
+}, Fo = (e) => e == null ? null : e instanceof Date ? e.getTime() : typeof e == "number" ? e : typeof e == "string" ? new Date(e).getTime() : null, Io = (e) => ({
 	id: String(e.id),
 	tenantId: e.tenantId ?? null,
 	name: String(e.name),
 	hashedKey: String(e.hashedKey),
 	keyPrefix: String(e.keyPrefix),
 	scopes: e.scopes ?? null,
-	lastUsedAt: Mo(e.lastUsedAt),
-	expiresAt: Mo(e.expiresAt),
-	revokedAt: Mo(e.revokedAt),
+	lastUsedAt: Fo(e.lastUsedAt),
+	expiresAt: Fo(e.expiresAt),
+	revokedAt: Fo(e.revokedAt),
 	createdBy: e.createdBy ?? null,
 	onBehalfOf: e.onBehalfOf ?? null,
-	createdAt: Mo(e.createdAt) ?? 0,
+	createdAt: Fo(e.createdAt) ?? 0,
 	...e.metadata == null ? {} : { metadata: e.metadata }
-}), Po = (e) => async (t, n) => {
+}), Lo = (e) => async (t, n) => {
 	let r = await e.findById(t);
 	if (r === null) return;
 	let i = r.requestCount ?? 0, a = r.lastUsedAt ?? 0;
@@ -3435,9 +3437,9 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		requestCount: i + n.requests,
 		lastUsedAt: Math.max(a, n.lastUsedAt)
 	});
-}, Fo = (e) => {
+}, Ro = (e) => {
 	let t = async (t) => await e.query({
-		table: To,
+		table: Oo,
 		predicate: t,
 		order: [],
 		take: void 0,
@@ -3455,33 +3457,33 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 	};
 	return {
 		insert: async (t) => {
-			await e.insert(To, n(t));
+			await e.insert(Oo, n(t));
 		},
 		findByHash: async (e) => {
 			let n = await t(O("hashedKey", e));
-			return n[0] ? No(n[0]) : null;
+			return n[0] ? Io(n[0]) : null;
 		},
 		findById: async (e) => {
 			let n = await t(O("id", e));
-			return n[0] ? No(n[0]) : null;
+			return n[0] ? Io(n[0]) : null;
 		},
-		listByTenant: async (e) => (await t(e === null ? void 0 : O("tenantId", e))).map(No).filter((t) => e === null || t.tenantId === e),
+		listByTenant: async (e) => (await t(e === null ? void 0 : O("tenantId", e))).map(Io).filter((t) => e === null || t.tenantId === e),
 		patch: async (t, r) => {
-			await e.update(To, t, n(r));
+			await e.update(Oo, t, n(r));
 		}
 	};
-}, Io = (e, t = {}) => Jt({
+}, zo = (e, t = {}) => Jt({
 	id: "voltro-apikey",
 	...t.prefix ? { prefix: t.prefix } : {},
 	resolveKey: (t) => e.resolveByHash(t)
-}), Lo = (e) => {
+}), Bo = (e) => {
 	let t = e.subject;
 	return {
 		id: t.id ?? null,
 		tenantId: t.tenantId ?? null,
 		scopes: t.scopes ?? []
 	};
-}, Ro = (e, t = "/v1/api-keys") => {
+}, Vo = (e, t = "/v1/api-keys") => {
 	let n = y.Struct({
 		id: y.String,
 		name: y.String,
@@ -3522,7 +3524,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 				keyPrefix: y.String
 			}),
 			handler: async (t, n) => {
-				let r = t.body, i = Lo(n), a = new Set(i.scopes), o = (e) => a.has(Ve) || a.has(e), s = r.onBehalfOf === void 0 ? i.id : r.onBehalfOf;
+				let r = t.body, i = Bo(n), a = new Set(i.scopes), o = (e) => a.has(Ve) || a.has(e), s = r.onBehalfOf === void 0 ? i.id : r.onBehalfOf;
 				if (s === null) {
 					if (!o(He)) throw new $e({
 						required: He,
@@ -3567,7 +3569,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 			guards: [It(Ve)],
 			input: y.Struct({}),
 			output: y.Struct({ keys: y.Array(n) }),
-			handler: async (t, n) => ({ keys: [...await e.list(Lo(n).tenantId)] })
+			handler: async (t, n) => ({ keys: [...await e.list(Bo(n).tenantId)] })
 		}),
 		Nt({
 			method: "POST",
@@ -3576,42 +3578,42 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 			guards: [It(Ve)],
 			input: y.Struct({ body: y.Struct({ id: y.String }) }),
 			output: y.Struct({ ok: y.Boolean }),
-			handler: async (t, n) => ({ ok: await e.revoke(t.body.id, Lo(n).tenantId) })
+			handler: async (t, n) => ({ ok: await e.revoke(t.body.id, Bo(n).tenantId) })
 		})
 	];
-}, zo = {
+}, Ho = {
 	type: "anonymous",
 	id: null,
 	tenantId: null
-}, Bo = class extends n.Tag("@voltro/EffectStore")() {}, Vo = (e, t) => (n) => n instanceof Ii ? n : new Li({
+}, Uo = class extends n.Tag("@voltro/EffectStore")() {}, Wo = (e, t) => (n) => n instanceof zi ? n : new Bi({
 	operation: e,
 	table: t,
 	cause: String(n)
-}), Ho = (e, t, n) => o.tryPromise({
+}), Go = (e, t, n) => o.tryPromise({
 	try: n,
-	catch: Vo(e, t)
-}), Uo = (e) => u.succeed(Bo, {
-	query: ((t) => Ho("query", t.table, () => e.query(t))),
-	insert: (t, n) => Ho("insert", t, () => e.insert(t, n)),
-	update: (t, n, r) => Ho("update", t, () => e.update(t, n, r)),
-	delete: (t, n) => Ho("delete", t, () => e.delete(t, n)),
-	hardDelete: (t, n) => Ho("hardDelete", t, () => e.hardDelete(t, n))
-}), Wo = (e) => At.make(e.name, {
+	catch: Wo(e, t)
+}), Ko = (e) => u.succeed(Uo, {
+	query: ((t) => Go("query", t.table, () => e.query(t))),
+	insert: (t, n) => Go("insert", t, () => e.insert(t, n)),
+	update: (t, n, r) => Go("update", t, () => e.update(t, n, r)),
+	delete: (t, n) => Go("delete", t, () => e.delete(t, n)),
+	hardDelete: (t, n) => Go("hardDelete", t, () => e.hardDelete(t, n))
+}), qo = (e) => At.make(e.name, {
 	payload: e.payloadSchema,
 	success: it,
 	error: e.errorSchema
-}), Go = (e, t) => ({
+}), Jo = (e, t) => ({
 	id: t,
 	workflowName: e,
 	executionId: t,
 	status: "running"
-}), Ko = Go, qo = (t) => {
+}), Yo = Jo, Xo = (t) => {
 	let n = e.failureOption(t), r = n._tag === "Some" ? n.value : e.squash(t);
 	return {
 		tag: r && typeof r == "object" && "_tag" in r ? String(r._tag) : null,
 		message: r?.message ?? String(r)
 	};
-}, Jo = (e, t, n) => {
+}, Zo = (e, t, n) => {
 	if (n === void 0) return {
 		id: t,
 		workflowName: e,
@@ -3637,7 +3639,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 			workflowName: e,
 			executionId: t,
 			status: "failed",
-			error: qo(r.cause)
+			error: Xo(r.cause)
 		};
 	}
 	return {
@@ -3646,7 +3648,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		executionId: t,
 		status: "running"
 	};
-}, Yo = (e) => new Promise((t) => setTimeout(t, e)), Xo = class extends Error {
+}, Qo = (e) => new Promise((t) => setTimeout(t, e)), $o = class extends Error {
 	workflowName;
 	missingFields;
 	detail;
@@ -3655,7 +3657,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		let r = t.length > 0 ? ` missing required field(s): ${t.join(", ")}.` : "";
 		super(`Workflow "${e}" was started with an invalid payload.${r} ${n}`), this.workflowName = e, this.missingFields = t, this.detail = n, this.name = "WorkflowPayloadError";
 	}
-}, Zo = (e) => {
+}, es = (e) => {
 	let t = e.ast;
 	if (!Array.isArray(t.propertySignatures)) return {
 		required: [],
@@ -3666,10 +3668,10 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		required: n.filter((e) => !e.isOptional).map((e) => String(e.name)),
 		optional: n.filter((e) => e.isOptional).map((e) => String(e.name))
 	};
-}, Qo = (e) => {
+}, ts = (e) => {
 	let t = e.ast;
 	return Array.isArray(t.propertySignatures) ? t.propertySignatures.filter((e) => !e.isOptional && typeof e.name == "string").map((e) => String(e.name)) : [];
-}, $o = (e) => {
+}, ns = (e) => {
 	let t = new Map(e.workflows.map((e) => [e.definition.name, e.definition])), n = (e) => {
 		let n = t.get(e);
 		if (!n) {
@@ -3680,19 +3682,19 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 	}, r = (e, t) => {
 		let n = y.validateEither(e.payloadSchema)(t);
 		if (n._tag === "Right") return;
-		let r = typeof t == "object" && t ? Object.keys(t) : [], i = Qo(e.payloadSchema).filter((e) => !r.includes(e));
-		throw new Xo(e.name, i, zt.formatErrorSync(n.left));
+		let r = typeof t == "object" && t ? Object.keys(t) : [], i = ts(e.payloadSchema).filter((e) => !r.includes(e));
+		throw new $o(e.name, i, zt.formatErrorSync(n.left));
 	}, i = (e, t) => {
 		let i = n(e);
 		return r(i, t), i;
 	}, a = async (t, r) => {
 		let i = n(t);
-		return Jo(t, r, await e.runEffect(i.poll(r)));
+		return Zo(t, r, await e.runEffect(i.poll(r)));
 	}, o = async () => e.runEffect(Yt()), s = async (t, n, r) => {
 		let a = i(t, n), o;
-		if (r?.callerContext !== void 0 && (o = await e.runEffect(a.executionId(n)), await e.rememberStartContext?.(t, o, r.callerContext)), r?.wait) return await e.runEffect(a.execute(n)), e.onEnqueue?.(), Go(t, o ?? await e.runEffect(a.executionId(n)));
+		if (r?.callerContext !== void 0 && (o = await e.runEffect(a.executionId(n)), await e.rememberStartContext?.(t, o, r.callerContext)), r?.wait) return await e.runEffect(a.execute(n)), e.onEnqueue?.(), Jo(t, o ?? await e.runEffect(a.executionId(n)));
 		let s = await e.runEffect(a.execute(n, { discard: !0 }));
-		return e.onEnqueue?.(), Go(t, s);
+		return e.onEnqueue?.(), Jo(t, s);
 	};
 	return {
 		start: s,
@@ -3730,7 +3732,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 				let e = await a(r, i);
 				if (e.status === "succeeded" || e.status === "failed" || e.status === "cancelled") return e;
 				if (o?.timeoutMs !== void 0 && Date.now() - s >= o.timeoutMs) throw Error(`Timed out waiting for workflow '${r}' run '${i}'`);
-				await Yo(c);
+				await Qo(c);
 			}
 		}),
 		cancel: async (t, r) => {
@@ -3772,22 +3774,22 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 			return e.redrive(t);
 		}
 	};
-}, es = (e, t) => ({
+}, rs = (e, t) => ({
 	...e,
 	start: async (n, r, i) => {
 		if (i?.wait) throw Error("ctx.workflows.start(..., { wait: true }) is not allowed inside a mutation transaction; start the workflow and wait after commit.");
 		let a = await e.executionId(n, r);
-		return t(() => e.start(n, r)), Go(n, a);
+		return t(() => e.start(n, r)), Jo(n, a);
 	},
 	child: async (n, r, i) => {
 		if (i?.wait) throw Error("ctx.workflows.child(..., { wait: true }) is not allowed inside a mutation transaction; start the child workflow and wait after commit.");
 		let a = await e.executionId(n, r);
-		return t(() => e.child(n, r, i)), Go(n, a);
+		return t(() => e.child(n, r, i)), Jo(n, a);
 	},
 	run: async () => {
 		throw Error("ctx.workflows.run(...) is not allowed inside a mutation transaction; use ctx.workflows.start(...) so the workflow starts after commit.");
 	}
-}), ts = (e, t) => ({
+}), is = (e, t) => ({
 	...e,
 	start: (n, r, i) => e.start(n, r, {
 		...i,
@@ -3801,7 +3803,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		...i,
 		callerContext: t
 	})
-}), ns = (e) => {
+}), as = (e) => {
 	let t = () => {
 		let t = e();
 		if (!t) throw Error("Workflow runtime is not ready yet");
@@ -3823,26 +3825,26 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		retry: (e, n) => t().retry(e, n),
 		redrive: (e) => t().redrive(e)
 	};
-}, rs = (e, t) => {
+}, os = (e, t) => {
 	let n = {};
-	for (let r of e) n[r.definition.name] = (e) => (t ? o.promise(() => t.start(r.definition.name, e)) : r.definition.execute(e, { discard: !0 }).pipe(o.map((e) => Go(r.definition.name, e)))).pipe(o.withSpan(`workflow.${r.definition.name}`, { attributes: { "framework.kind": "workflow" } }));
+	for (let r of e) n[r.definition.name] = (e) => (t ? o.promise(() => t.start(r.definition.name, e)) : r.definition.execute(e, { discard: !0 }).pipe(o.map((e) => Jo(r.definition.name, e)))).pipe(o.withSpan(`workflow.${r.definition.name}`, { attributes: { "framework.kind": "workflow" } }));
 	return n;
-}, is = (e, t, n) => e.map((e) => e.definition.toLayer(((r, i) => {
+}, ss = (e, t, n) => e.map((e) => e.definition.toLayer(((r, i) => {
 	let a = t.resolveStartContext?.(e.definition.name, i);
 	return (a === void 0 ? o.succeed(void 0) : o.promise(() => Promise.resolve(a))).pipe(o.flatMap((a) => {
 		let s = {
 			...a,
-			subject: a?.subject ?? zo,
+			subject: a?.subject ?? Ho,
 			traceId: a?.traceId ?? "workflow-bootstrap"
 		}, c = t.buildContext(s, {
 			workflowName: e.definition.name,
 			executionId: i,
 			parentExecutionId: a?.parentExecutionId ?? null,
 			parentClosePolicy: a?.parentClosePolicy ?? null
-		}), l = e.buildExecute(c), d = (n?.(e, l, s) ?? l)(r, i), f = u.succeed(et, s.subject), p = c?.store, m = p === void 0 ? d : o.provide(d, Uo(p));
+		}), l = e.buildExecute(c), d = (n?.(e, l, s) ?? l)(r, i), f = u.succeed(et, s.subject), p = c?.store, m = p === void 0 ? d : o.provide(d, Ko(p));
 		return o.provide(m, f);
 	}));
-}))), as = (e) => {
+}))), cs = (e) => {
 	if ("on" in e) {
 		let { on: t, ...n } = e;
 		return {
@@ -3855,10 +3857,10 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		_tag: "workflowEventTrigger",
 		...e
 	};
-}, os = as, ss = (e) => typeof e == "object" && !!e && e._tag === "workflowEventTrigger", cs = () => {
+}, ls = cs, us = (e) => typeof e == "object" && !!e && e._tag === "workflowEventTrigger", ds = () => {
 	let e = globalThis.crypto;
 	return typeof e?.randomUUID == "function" ? e.randomUUID() : `${Date.now().toString(36)}${Math.random().toString(36).slice(2)}`;
-}, ls = (e) => `${e}_${cs()}`, us = (e) => e.id ?? `${e.event}->${e.workflow}`, ds = F("_voltro_workflow_events", {
+}, fs = (e) => `${e}_${ds()}`, ps = (e) => e.id ?? `${e.event}->${e.workflow}`, ms = F("_voltro_workflow_events", {
 	id: M({ prefix: "wfe" }),
 	name: I(),
 	payload: P(),
@@ -3866,7 +3868,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 	subject: P().nullable(),
 	traceId: I().nullable(),
 	occurredAt: L().default("now")
-}).index(["name"]).index(["source"]).index(["occurredAt"]), fs = F("_voltro_workflow_event_deliveries", {
+}).index(["name"]).index(["source"]).index(["occurredAt"]), hs = F("_voltro_workflow_event_deliveries", {
 	id: M({ prefix: "wfed" }),
 	eventId: I(),
 	eventName: I(),
@@ -3884,8 +3886,8 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 	errorMessage: I().nullable(),
 	createdAt: L().default("now"),
 	completedAt: L().nullable()
-}).index(["eventId"]).index(["eventName"]).index(["triggerId"]).index(["workflowName"]).index(["status"]), ps = (e) => {
-	let t = e.makeId ?? ls, n = /* @__PURE__ */ new Map();
+}).index(["eventId"]).index(["eventName"]).index(["triggerId"]).index(["workflowName"]).index(["status"]), gs = (e) => {
+	let t = e.makeId ?? fs, n = /* @__PURE__ */ new Map();
 	for (let t of e.triggers) {
 		let e = n.get(t.event);
 		e ? e.push(t) : n.set(t.event, [t]);
@@ -3926,7 +3928,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		});
 		let f = o(n), p = [];
 		for (let o of f) {
-			let s = us(o), l = o.workflow, u;
+			let s = ps(o), l = o.workflow, u;
 			try {
 				let f = o.idempotencyKey?.(d) ?? `${c}:${s}`;
 				if (o.filter && !await o.filter(d)) {
@@ -4029,7 +4031,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 			triggered: p
 		};
 	} };
-}, ms = z({ scope: "voltro:events" }), hs = 64, gs = 5 * 6e4, _s = 1e4, vs = class {
+}, _s = z({ scope: "voltro:events" }), vs = 64, ys = 5 * 6e4, bs = 1e4, xs = class {
 	routes = /* @__PURE__ */ new Map();
 	origin;
 	ringSize;
@@ -4041,7 +4043,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 	interestListeners = /* @__PURE__ */ new Set();
 	now;
 	constructor(e) {
-		this.origin = e.origin, this.ringSize = e.ringSize ?? hs, this.ringTtlMs = e.ringTtlMs ?? gs, this.maxRoutes = e.maxRoutes ?? _s, this.publishRemote = e.publishRemote, this.deliveryOf = e.deliveryOf, this.now = e.now ?? Date.now;
+		this.origin = e.origin, this.ringSize = e.ringSize ?? vs, this.ringTtlMs = e.ringTtlMs ?? ys, this.maxRoutes = e.maxRoutes ?? bs, this.publishRemote = e.publishRemote, this.deliveryOf = e.deliveryOf, this.now = e.now ?? Date.now;
 	}
 	get instanceOrigin() {
 		return this.origin;
@@ -4061,7 +4063,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		for (let n of this.interestListeners) try {
 			n(e, t);
 		} catch (n) {
-			ms.warn("event interest listener threw", {
+			_s.warn("event interest listener threw", {
 				event: e,
 				active: t,
 				cause: n
@@ -4096,7 +4098,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 			this.routes.delete(r), n += 1;
 		}
 		if (n === 0) {
-			ms.warn("event ring capacity reached with all routes live — replay buffers cleared", {
+			_s.warn("event ring capacity reached with all routes live — replay buffers cleared", {
 				routes: this.routes.size,
 				maxRoutes: this.maxRoutes
 			});
@@ -4121,7 +4123,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		if (n.localNext += 1, this.accept(n, r), or(e.event), this.publishRemote !== void 0) try {
 			this.publishRemote(r);
 		} catch (t) {
-			ms.warn("event broadcast publish failed — local delivery unaffected", {
+			_s.warn("event broadcast publish failed — local delivery unaffected", {
 				event: e.event,
 				cause: t
 			});
@@ -4150,7 +4152,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		for (let n of e.listeners) try {
 			n(i);
 		} catch (e) {
-			ms.warn("event listener threw — other subscribers unaffected", {
+			_s.warn("event listener threw — other subscribers unaffected", {
 				event: t.event,
 				cause: e
 			});
@@ -4158,9 +4160,17 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 	}
 	subscribe(e) {
 		let t = lt(e.tenantId, e.event, e.key), n = this.state(t);
-		e.onAttach?.(new Map(n.watermark)), n.listeners.add(e.listener), lr(e.event, 1), this.shiftInterest(e.event, 1);
-		let r = e.options?.resume;
-		if (r !== void 0) this.replayForResume(n, r, e.listener);
+		e.onAttach?.(new Map(n.watermark));
+		let r = !0, i = [], a = (t) => {
+			if (r) {
+				i.push(t);
+				return;
+			}
+			e.listener(t);
+		};
+		n.listeners.add(a), lr(e.event, 1), this.shiftInterest(e.event, 1);
+		let o = e.options?.resume;
+		if (o !== void 0) this.replayForResume(n, o, e.listener);
 		else if (e.options?.rewind === !0) {
 			this.pruneRing(n);
 			for (let t of n.ring) e.listener({
@@ -4169,9 +4179,12 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 				prior: t.envelope.n - 1
 			});
 		}
-		let i = !0;
+		r = !1;
+		for (let t of i) e.listener(t);
+		i.length = 0;
+		let s = !0;
 		return () => {
-			i && (i = !1, n.listeners.delete(e.listener), lr(e.event, -1), this.shiftInterest(e.event, -1));
+			s && (s = !1, n.listeners.delete(a), lr(e.event, -1), this.shiftInterest(e.event, -1));
 		};
 	}
 	replayForResume(e, t, n) {
@@ -4223,13 +4236,13 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 	clear() {
 		this.routes.clear();
 	}
-}, ys = (e) => e instanceof Error ? e.message : String(e), bs = (e, t, n, r) => o.gen(function* () {
+}, Ss = (e) => e instanceof Error ? e.message : String(e), Cs = (e, t, n, r) => o.gen(function* () {
 	let i = y.encode(t.key), a = y.encode(t.payload), s = yield* i(n).pipe(o.mapError((e) => new Ye({
 		event: t.name,
-		message: ys(e)
+		message: Ss(e)
 	}))), c = yield* a(r).pipe(o.mapError((e) => new Xe({
 		event: t.name,
-		message: ys(e)
+		message: Ss(e)
 	}))), l = Buffer.byteLength(JSON.stringify({
 		event: t.name,
 		key: s,
@@ -4258,10 +4271,10 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		n: -1,
 		deferred: !0
 	});
-}), xs = (e) => {
+}), ws = (e) => {
 	let t;
 	return Object.assign(e, { then: (n, r) => (t ??= o.runPromise(e), t.then(n, r)) });
-}, Ss = (e) => ({ publish: (t, n, r) => xs(bs(e, t, n, r)) }), Cs = 64, ws = 1, Ts = (e) => e.kind === "gap" ? {
+}, Ts = (e) => ({ publish: (t, n, r) => ws(Cs(e, t, n, r)) }), Es = 64, Ds = 1, Os = (e) => e.kind === "gap" ? {
 	_tag: "gap",
 	missed: e.missed,
 	reason: e.reason
@@ -4271,13 +4284,13 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 	n: e.envelope.n,
 	emittedAt: e.envelope.emittedAt,
 	payload: e.envelope.payload
-}, Es = (e) => {
+}, ks = (e) => {
 	let t = new Map(e ?? []);
 	return (e, n = 0) => {
 		let r = t.get(e.origin) ?? 0;
 		return t.set(e.origin, Math.max(r, e.n)), r === 0 && n === 0 ? 0 : Math.max(0, e.n - r - 1);
 	};
-}, Ds = (e) => b.unwrapScoped(o.gen(function* () {
+}, As = (e) => b.unwrapScoped(o.gen(function* () {
 	let t = yield* et, n = yield* Ge, r = t.tenantId ?? null;
 	if (e.guards !== void 0 && e.guards.length > 0) {
 		let n = yield* ot(t, e.guards, e.key);
@@ -4298,20 +4311,20 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 	if (yield* o.addFinalizer(() => o.sync(() => {
 		c();
 	})), n.clientId !== void 0) {
-		let e = Yr(n.clientId, () => {
+		let e = Qr(n.clientId, () => {
 			o.runPromise(g.shutdown(a));
 		});
 		yield* o.addFinalizer(() => o.sync(() => {
 			e();
 		}));
 	}
-	let l = i ? () => 0 : Es(s), u = e.guards, d = u === void 0 || u.length === 0 ? void 0 : () => ot(t, u, e.key), f = b.fromQueue(a, { shutdown: !0 }).pipe(b.flatMap((e) => d === void 0 ? p(e) : b.unwrap(d().pipe(o.map((t) => t ? b.fail(t) : p(e))))));
+	let l = i ? () => 0 : ks(s), u = e.guards, d = u === void 0 || u.length === 0 ? void 0 : () => ot(t, u, e.key), f = b.fromQueue(a, { shutdown: !0 }).pipe(b.flatMap((e) => d === void 0 ? p(e) : b.unwrap(d().pipe(o.map((t) => t ? b.fail(t) : p(e))))));
 	function p(t) {
 		return b.suspend(() => {
-			if (t.kind === "gap") return b.make(Ts(t));
+			if (t.kind === "gap") return b.make(Os(t));
 			let n = l(t.envelope, t.prior);
 			sr(e.event);
-			let r = Ts(t);
+			let r = Os(t);
 			if (n === 0) return b.make(r);
 			cr(e.event, "buffer", n);
 			let i = {
@@ -4323,8 +4336,8 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		});
 	}
 	let m = { _tag: "attached" };
-	return ra(b.concat(b.fromIterable([m]), f), n.credentialExpiresAt, b.fromIterable([m]));
-})), Os = z({ scope: "voltro:members" }), ks = 5e3, As = class {
+	return oa(b.concat(b.fromIterable([m]), f), n.credentialExpiresAt, b.fromIterable([m]));
+})), js = z({ scope: "voltro:members" }), Ms = 5e3, Ns = class {
 	members = /* @__PURE__ */ new Map();
 	listeners = /* @__PURE__ */ new Set();
 	instanceId;
@@ -4336,7 +4349,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 	now;
 	timer;
 	constructor(e) {
-		this.instanceId = e.instanceId, this.now = e.now ?? Date.now, this.startedAt = e.startedAt ?? this.now(), this.meta = e.meta, this.heartbeatMs = e.heartbeatMs ?? ks, this.downAfterMs = e.downAfterMs ?? this.heartbeatMs * 3, this.announce = e.announce, this.members.set(this.instanceId, {
+		this.instanceId = e.instanceId, this.now = e.now ?? Date.now, this.startedAt = e.startedAt ?? this.now(), this.meta = e.meta, this.heartbeatMs = e.heartbeatMs ?? Ms, this.downAfterMs = e.downAfterMs ?? this.heartbeatMs * 3, this.announce = e.announce, this.members.set(this.instanceId, {
 			startedAt: this.startedAt,
 			meta: this.meta,
 			lastHeardAt: this.now()
@@ -4362,7 +4375,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 				...this.meta === void 0 ? {} : { meta: this.meta }
 			});
 		} catch (e) {
-			Os.warn("membership: announce failed", { cause: e });
+			js.warn("membership: announce failed", { cause: e });
 		}
 	}
 	receive(e) {
@@ -4416,16 +4429,16 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		for (let t of this.listeners) try {
 			t(e);
 		} catch (t) {
-			Os.warn("membership: listener threw", {
+			js.warn("membership: listener threw", {
 				event: e.kind,
 				cause: t
 			});
 		}
 	}
-}, js = z({ scope: "voltro:outbox" }), Y = "_voltro_outbox", Ms = {
+}, Ps = z({ scope: "voltro:outbox" }), Y = "_voltro_outbox", Fs = {
 	kind: "typeid",
 	prefix: "obx"
-}, Ns = F(Y, {
+}, Is = F(Y, {
 	id: M({ prefix: "obx" }),
 	effect: I(),
 	payload: P(),
@@ -4443,10 +4456,10 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 	resendRequestedBy: I().nullable(),
 	resendReason: I().nullable(),
 	resendCount: N()
-}), Ps = "_voltro_outbox_attempts", Fs = {
+}), Ls = "_voltro_outbox_attempts", Rs = {
 	kind: "typeid",
 	prefix: "obxa"
-}, Is = F(Ps, {
+}, zs = F(Ls, {
 	id: M({ prefix: "obxa" }),
 	outboxId: I(),
 	effect: I(),
@@ -4467,11 +4480,11 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 	subjectId: I().nullable(),
 	tenantId: I().nullable(),
 	traceId: I().nullable()
-}).index(["outboxId", "attempt"]).index(["startedAt"]).index(["outcome"]), Ls = (e) => {
+}).index(["outboxId", "attempt"]).index(["startedAt"]).index(["outcome"]), Bs = (e) => {
 	if (e.effect.trim() === "") throw Error("defineOutboxHandler: `effect` must be a non-empty name");
 	if (e.maxAttempts !== void 0 && e.maxAttempts < 1) throw Error(`defineOutboxHandler("${e.effect}"): maxAttempts must be >= 1`);
 	return e;
-}, Rs = 8, zs = (e) => ({
+}, Vs = 8, Hs = (e) => ({
 	enqueue: async (t, n, r) => {
 		let i = (e.now ?? (() => /* @__PURE__ */ new Date()))(), a = r?.idempotencyKey;
 		if (a !== void 0) {
@@ -4486,12 +4499,12 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 			if (t !== void 0) return t.id;
 		}
 		let o = {
-			id: A(Ms, Y),
+			id: A(Fs, Y),
 			effect: t,
 			payload: n,
 			status: "pending",
 			attempts: 0,
-			maxAttempts: r?.maxAttempts ?? Rs,
+			maxAttempts: r?.maxAttempts ?? Vs,
 			nextAttemptAt: new Date(i.getTime() + (r?.delayMs ?? 0)),
 			idempotencyKey: a ?? null,
 			lastError: null,
@@ -4538,7 +4551,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 			});
 		} else e.nudge?.();
 	}
-}), Bs = (e) => Math.min(1e3 * 2 ** Math.max(0, e - 1), 5 * 6e4), Vs = 50, Hs = (e, t) => e.length <= t ? e : `${e.slice(0, t)}… [clipped]`, Us = (e) => {
+}), Us = (e) => Math.min(1e3 * 2 ** Math.max(0, e - 1), 5 * 6e4), Ws = 50, Gs = (e, t) => e.length <= t ? e : `${e.slice(0, t)}… [clipped]`, Ks = (e) => {
 	if (e == null) return null;
 	let t = typeof e == "object" && !Array.isArray(e) ? e : { value: e }, n;
 	try {
@@ -4548,13 +4561,13 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 	}
 	return n.length > 8192 ? {
 		truncated: !0,
-		preview: Hs(n, 8192)
+		preview: Gs(n, 8192)
 	} : t;
-}, Ws = async (e, t, n) => {
+}, qs = async (e, t, n) => {
 	let r = t.outboxRow, i = r.id, a = r.resendRequestedBy ?? null;
 	try {
-		await e.insert(Ps, {
-			id: A(Fs, Ps),
+		await e.insert(Ls, {
+			id: A(Rs, Ls),
 			outboxId: i,
 			effect: r.effect,
 			attempt: t.attempt,
@@ -4565,14 +4578,14 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 			startedAt: t.startedAt,
 			finishedAt: t.finishedAt,
 			durationMs: Math.max(0, t.finishedAt.getTime() - t.startedAt.getTime()),
-			error: t.error === null ? null : Hs(t.error, 4e3),
-			response: Us(t.response),
+			error: t.error === null ? null : Gs(t.error, 4e3),
+			response: Ks(t.response),
 			subjectId: r.subjectId ?? null,
 			tenantId: r.tenantId ?? null,
 			traceId: r.traceId ?? null
 		});
 	} catch (e) {
-		js.warn("outbox: could not record delivery attempt (delivery itself is unaffected)", {
+		Ps.warn("outbox: could not record delivery attempt (delivery itself is unaffected)", {
 			outboxId: i,
 			attempt: t.attempt
 		}, e);
@@ -4580,7 +4593,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 	}
 	if (!(t.attempt <= n)) try {
 		let t = await e.query({
-			table: Ps,
+			table: Ls,
 			predicate: O("outboxId", i),
 			order: [{
 				column: "attempt",
@@ -4590,11 +4603,11 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 			skip: void 0,
 			projection: ["id"]
 		});
-		for (let r of t.slice(0, Math.max(0, t.length - n))) await e.delete(Ps, r.id);
+		for (let r of t.slice(0, Math.max(0, t.length - n))) await e.delete(Ls, r.id);
 	} catch (e) {
-		js.warn("outbox: attempt-log trim failed; the log may exceed its cap", { outboxId: i }, e);
+		Ps.warn("outbox: attempt-log trim failed; the log may exceed its cap", { outboxId: i }, e);
 	}
-}, Gs = async (e) => {
+}, Js = async (e) => {
 	let t = (e.now ?? (() => /* @__PURE__ */ new Date()))(), n = await e.store.query({
 		table: Y,
 		predicate: C(O("status", "pending"), he("nextAttemptAt", t)),
@@ -4612,7 +4625,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 			o++;
 			continue;
 		}
-		let u = s.attempts + 1, d = s.maxAttempts ?? Rs, f = /* @__PURE__ */ new Date(), p = e.attemptLogCap ?? 50;
+		let u = s.attempts + 1, d = s.maxAttempts ?? Vs, f = /* @__PURE__ */ new Date(), p = e.attemptLogCap ?? 50;
 		try {
 			let t = await l.handler({
 				payload: s.payload ?? {},
@@ -4621,7 +4634,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 				tenantId: s.tenantId ?? null,
 				traceId: s.traceId ?? null
 			});
-			await Ws(e.store, {
+			await qs(e.store, {
 				outboxRow: s,
 				attempt: u,
 				outcome: "delivered",
@@ -4639,7 +4652,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 			}), r++;
 		} catch (r) {
 			let o = r instanceof Error ? r.message : String(r), l = u >= d;
-			await Ws(e.store, {
+			await qs(e.store, {
 				outboxRow: s,
 				attempt: u,
 				outcome: l ? "dead" : "failed",
@@ -4651,20 +4664,20 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 				status: l ? "dead" : "pending",
 				attempts: u,
 				lastError: o,
-				nextAttemptAt: new Date(t.getTime() + Bs(u)),
+				nextAttemptAt: new Date(t.getTime() + Us(u)),
 				resendRequestedBy: null,
 				resendReason: null
-			}), l ? (a++, js.error("outbox effect dead-lettered after exhausting attempts", {
+			}), l ? (a++, Ps.error("outbox effect dead-lettered after exhausting attempts", {
 				id: n,
 				effect: c,
 				attempts: u,
 				maxAttempts: d
-			}, r)) : (i++, js.warn("outbox delivery failed; will retry", {
+			}, r)) : (i++, Ps.warn("outbox delivery failed; will retry", {
 				id: n,
 				effect: c,
 				attempt: u,
 				maxAttempts: d,
-				retryInMs: Bs(u)
+				retryInMs: Us(u)
 			}));
 		}
 	}
@@ -4674,10 +4687,10 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		dead: a,
 		skipped: o
 	};
-}, Ks = z({ scope: "voltro:connections" }), X = "_voltro_connections", qs = {
+}, Ys = z({ scope: "voltro:connections" }), X = "_voltro_connections", Xs = {
 	kind: "typeid",
 	prefix: "conn"
-}, Js = F(X, {
+}, Zs = F(X, {
 	id: M({ prefix: "conn" }),
 	connectionId: I(),
 	subjectId: I(),
@@ -4700,10 +4713,10 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 	metadata: P().nullable(),
 	connectedAt: L(),
 	updatedAt: L()
-}).unique("byConnectionSubject", ["connectionId", "subjectId"]).index(["subjectId"]), Ys = "_voltro_connection_grants", Xs = {
+}).unique("byConnectionSubject", ["connectionId", "subjectId"]).index(["subjectId"]), Qs = "_voltro_connection_grants", $s = {
 	kind: "typeid",
 	prefix: "cgrant"
-}, Zs = F(Ys, {
+}, ec = F(Qs, {
 	id: M({ prefix: "cgrant" }),
 	state: I().unique(),
 	connectionId: I(),
@@ -4713,8 +4726,8 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 	redirectTo: I(),
 	createdAt: L(),
 	expiresAt: L()
-}).index(["expiresAt"]), Qs = /^[a-z][a-z0-9-]*$/, $s = (e) => {
-	if (!Qs.test(e.id)) throw Error(`defineConnection: id "${e.id}" must be lowercase kebab-case (it becomes a URL path segment).`);
+}).index(["expiresAt"]), tc = /^[a-z][a-z0-9-]*$/, nc = (e) => {
+	if (!tc.test(e.id)) throw Error(`defineConnection: id "${e.id}" must be lowercase kebab-case (it becomes a URL path segment).`);
 	if (e.kind === "oauth2") {
 		for (let t of [
 			"authorizeUrl",
@@ -4724,9 +4737,9 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		]) if (typeof e[t] != "string" || e[t].length === 0) throw Error(`defineConnection("${e.id}"): \`${t}\` is required for kind 'oauth2'.`);
 	}
 	return e;
-}, ec = (e) => e.label ?? e.id, tc = (e) => {
+}, rc = (e) => e.label ?? e.id, ic = (e) => {
 	if (e.length !== 0 && q() === void 0) throw Error(`connections: ${e.length} connection(s) declared (${e.map((e) => e.id).join(", ")}) but no field cipher is registered. Connection tokens are stored encrypted and there is no plaintext fallback. Enable \`@voltro/plugin-governance\` with \`governancePlugin({ fieldEncryption: { key: env.FIELD_ENCRYPTION_KEY } })\` (or call setFieldCipher at boot).`);
-}, nc = (e) => {
+}, ac = (e) => {
 	let t = /* @__PURE__ */ new Map();
 	for (let n of e) {
 		if (t.has(n.id)) throw Error(`connections: duplicate connection id "${n.id}" — each *.connection.ts must declare a distinct id.`);
@@ -4736,14 +4749,14 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		get: (e) => t.get(e),
 		list: () => [...t.values()]
 	};
-}, rc = (e) => {
+}, oc = (e) => {
 	if (e == null) return null;
 	let t = e instanceof Date ? e : new Date(String(e));
 	return Number.isNaN(t.getTime()) ? null : t;
-}, ic = (e) => rc(e)?.toISOString() ?? null, ac = (e) => String(e ?? "").split(" ").filter((e) => e.length > 0), oc = (e, t) => t === void 0 ? {
+}, sc = (e) => oc(e)?.toISOString() ?? null, cc = (e) => String(e ?? "").split(" ").filter((e) => e.length > 0), lc = (e, t) => t === void 0 ? {
 	connectionId: e.id,
 	kind: e.kind,
-	label: ec(e),
+	label: rc(e),
 	status: "disconnected",
 	accountId: null,
 	accountLabel: null,
@@ -4754,31 +4767,31 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 } : {
 	connectionId: e.id,
 	kind: e.kind,
-	label: ec(e),
+	label: rc(e),
 	status: String(t.status ?? "connected"),
 	accountId: t.accountId ?? null,
 	accountLabel: t.accountLabel ?? null,
-	scopes: ac(t.scopes),
-	expiresAt: ic(t.expiresAt),
+	scopes: cc(t.scopes),
+	expiresAt: sc(t.expiresAt),
 	lastError: t.lastError ?? null,
-	connectedAt: ic(t.connectedAt)
-}, sc = async (e, t, n) => (await e.query({
+	connectedAt: sc(t.connectedAt)
+}, uc = async (e, t, n) => (await e.query({
 	table: X,
 	predicate: C(O("connectionId", t), O("subjectId", n)),
 	order: [],
 	take: 1,
 	skip: void 0,
 	projection: void 0
-}))[0], cc = async (e) => {
+}))[0], dc = async (e) => {
 	let t = (e.now ?? (() => /* @__PURE__ */ new Date()))(), n = e.tokens.expiresAt === void 0 ? null : new Date(e.tokens.expiresAt), r = {
-		id: A(qs, X),
+		id: A(Xs, X),
 		connectionId: e.definition.id,
 		subjectId: e.subjectId,
 		tenantId: e.tenantId,
 		kind: e.definition.kind,
 		status: "connected",
-		accessToken: pi(e.tokens.accessToken),
-		refreshToken: e.tokens.refreshToken === void 0 ? null : pi(e.tokens.refreshToken),
+		accessToken: gi(e.tokens.accessToken),
+		refreshToken: e.tokens.refreshToken === void 0 ? null : gi(e.tokens.refreshToken),
 		expiresAt: n,
 		scopes: e.tokens.scopes.length > 0 ? e.tokens.scopes.join(" ") : null,
 		accountId: e.account?.accountId ?? null,
@@ -4789,8 +4802,8 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		connectedAt: t,
 		updatedAt: t
 	};
-	return lc(e.store, r);
-}, lc = (e, t) => e.upsert(X, t, {
+	return fc(e.store, r);
+}, fc = (e, t) => e.upsert(X, t, {
 	conflictColumns: ["connectionId", "subjectId"],
 	update: [
 		"kind",
@@ -4806,10 +4819,10 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		"metadata",
 		"updatedAt"
 	]
-}), uc = async (e, t, n) => {
-	let r = await sc(e, t, n);
+}), pc = async (e, t, n) => {
+	let r = await uc(e, t, n);
 	return r !== void 0 && e.delete(X, r.id);
-}, dc = async (e, t, n) => {
+}, mc = async (e, t, n) => {
 	let r = await e.query({
 		table: X,
 		predicate: O("subjectId", n),
@@ -4818,9 +4831,9 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		skip: void 0,
 		projection: void 0
 	}), i = new Map(r.map((e) => [String(e.connectionId), e]));
-	return t.list().map((e) => oc(e, i.get(e.id)));
-}, fc = (e, t) => globalThis.fetch(e, t), pc = async (e, t, n) => {
-	let r = e.fetchImpl ?? fc, i, a;
+	return t.list().map((e) => lc(e, i.get(e.id)));
+}, hc = (e, t) => globalThis.fetch(e, t), gc = async (e, t, n) => {
+	let r = e.fetchImpl ?? hc, i, a;
 	try {
 		let n = await r(e.tokenUrl, {
 			method: "POST",
@@ -4860,62 +4873,62 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		...Number.isFinite(o.expires_in) ? { expiresAt: n() + o.expires_in * 1e3 } : {},
 		scopes: (o.scope ?? e.scopes?.join(" ") ?? "").split(" ").filter(Boolean)
 	};
-}, mc = (e, t, n = Date.now) => pc(e, {
+}, _c = (e, t, n = Date.now) => gc(e, {
 	grant_type: "authorization_code",
 	client_id: e.clientId,
 	client_secret: e.clientSecret,
 	code: t.code,
 	redirect_uri: t.redirectUri,
 	...t.codeVerifier ? { code_verifier: t.codeVerifier } : {}
-}, n), hc = (e, t, n = Date.now) => pc(e, {
+}, n), vc = (e, t, n = Date.now) => gc(e, {
 	grant_type: "refresh_token",
 	client_id: e.clientId,
 	client_secret: e.clientSecret,
 	refresh_token: t
-}, n), gc = 6e4, _c = 3e4, vc = class extends Error {
+}, n), yc = 6e4, bc = 3e4, xc = class extends Error {
 	connectionId;
 	subjectId;
 	_tag = "ConnectionNotConnected";
 	constructor(e, t) {
 		super(`connection "${e}" is not connected for this subject`), this.connectionId = e, this.subjectId = t, this.name = "ConnectionNotConnected";
 	}
-}, yc = (e) => new Promise((t) => {
+}, Sc = (e) => new Promise((t) => {
 	setTimeout(t, e);
-}), bc = /* @__PURE__ */ new Map(), xc = (e, t) => `${e}\u0000${t}`, Sc = () => {
-	bc.clear();
-}, Cc = (e, t) => ({
+}), Cc = /* @__PURE__ */ new Map(), wc = (e, t) => `${e}\u0000${t}`, Tc = () => {
+	Cc.clear();
+}, Ec = (e, t) => ({
 	connectionId: e.id,
 	kind: e.kind,
-	accessToken: mi(String(t.accessToken)),
-	expiresAt: rc(t.expiresAt),
-	scopes: ac(t.scopes),
+	accessToken: _i(String(t.accessToken)),
+	expiresAt: oc(t.expiresAt),
+	scopes: cc(t.scopes),
 	accountId: t.accountId ?? null,
 	accountLabel: t.accountLabel ?? null
-}), wc = (e, t, n) => {
-	let r = rc(e.expiresAt);
+}), Dc = (e, t, n) => {
+	let r = oc(e.expiresAt);
 	return r !== null && r.getTime() - n < t;
-}, Tc = async (e) => {
-	let t = e.now ?? Date.now, { store: n, definition: r, subjectId: i } = e, a = await sc(n, r.id, i);
-	if (a === void 0) throw new vc(r.id, i);
-	if (r.kind === "pat" || !wc(a, r.refreshSkewMs ?? 6e4, t())) return Cc(r, a);
-	let o = xc(r.id, i), s = bc.get(o);
+}, Oc = async (e) => {
+	let t = e.now ?? Date.now, { store: n, definition: r, subjectId: i } = e, a = await uc(n, r.id, i);
+	if (a === void 0) throw new xc(r.id, i);
+	if (r.kind === "pat" || !Dc(a, r.refreshSkewMs ?? 6e4, t())) return Ec(r, a);
+	let o = wc(r.id, i), s = Cc.get(o);
 	if (s !== void 0) return s;
-	let c = Ec({
+	let c = kc({
 		...e,
 		now: t,
 		row: a
 	}).finally(() => {
-		bc.delete(o);
+		Cc.delete(o);
 	});
-	return bc.set(o, c), c;
-}, Ec = async (e) => {
-	let { store: t, subjectId: n, now: r } = e, i = e.definition, a = e.sleep ?? yc, o = i.refreshSkewMs ?? 6e4, s = e.row.id;
+	return Cc.set(o, c), c;
+}, kc = async (e) => {
+	let { store: t, subjectId: n, now: r } = e, i = e.definition, a = e.sleep ?? Sc, o = i.refreshSkewMs ?? 6e4, s = e.row.id;
 	if (await t.updateMany("_voltro_connections", { refreshLockedUntil: new Date(r() + 3e4) }, { where: C(O("id", s), he("refreshLockedUntil", new Date(r()))) }) === 0) {
 		for (let e = 0; e < 10; e++) {
 			await a(200);
-			let e = await sc(t, i.id, n);
-			if (e === void 0) throw new vc(i.id, n);
-			if (!wc(e, o, r())) return Cc(i, e);
+			let e = await uc(t, i.id, n);
+			if (e === void 0) throw new xc(i.id, n);
+			if (!Dc(e, o, r())) return Ec(i, e);
 		}
 		throw new R({
 			connectionId: i.id,
@@ -4936,7 +4949,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 	});
 	let l;
 	try {
-		l = await hc(i, mi(String(c)), r);
+		l = await vc(i, _i(String(c)), r);
 	} catch (e) {
 		let n = e instanceof R ? e : new R({
 			connectionId: i.id,
@@ -4949,11 +4962,11 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 			refreshLockedUntil: /* @__PURE__ */ new Date(0),
 			updatedAt: new Date(r()),
 			...n.transient ? {} : {
-				accessToken: pi(""),
+				accessToken: gi(""),
 				refreshToken: null,
 				expiresAt: null
 			}
-		}), Ks.warn("connection refresh failed", {
+		}), Ys.warn("connection refresh failed", {
 			connectionId: i.id,
 			transient: n.transient,
 			reason: n.reason
@@ -4961,40 +4974,40 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 	}
 	let u = {
 		status: "connected",
-		accessToken: pi(l.accessToken),
-		...l.refreshToken === void 0 ? {} : { refreshToken: pi(l.refreshToken) },
+		accessToken: gi(l.accessToken),
+		...l.refreshToken === void 0 ? {} : { refreshToken: gi(l.refreshToken) },
 		expiresAt: l.expiresAt === void 0 ? null : new Date(l.expiresAt),
 		...l.scopes.length > 0 ? { scopes: l.scopes.join(" ") } : {},
 		lastError: null,
 		refreshLockedUntil: /* @__PURE__ */ new Date(0),
 		updatedAt: new Date(r())
 	};
-	return Cc(i, await t.update(X, s, u) ?? {
+	return Ec(i, await t.update(X, s, u) ?? {
 		...e.row,
 		...u
 	});
-}, Dc = (e = 32) => {
+}, Ac = (e = 32) => {
 	let t = new Uint8Array(e);
 	return globalThis.crypto.getRandomValues(t), Array.from(t, (e) => e.toString(16).padStart(2, "0")).join("");
-}, Oc = (e) => {
+}, jc = (e) => {
 	let t = "";
 	for (let n of e) t += String.fromCharCode(n);
 	return btoa(t).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}, kc = async (e) => {
+}, Mc = async (e) => {
 	let t = await globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(e));
-	return Oc(new Uint8Array(t));
-}, Ac = 10 * 6e4, jc = (e) => `/_voltro/connections/${e}/callback`, Mc = (e) => e === void 0 || e.length === 0 || !e.startsWith("/") || e.startsWith("//") || e.startsWith("/\\") ? "/" : e, Nc = (e, t) => e.redirectUri ?? `${t.replace(/\/+$/, "")}${jc(e.id)}`, Pc = async (e) => {
-	let t = (e.now ?? (() => /* @__PURE__ */ new Date()))(), { definition: n } = e, r = Dc(), i = n.pkce === !1 ? null : Dc(48), a = Nc(n, e.publicUrl);
-	await e.store.insert(Ys, {
-		id: A(Xs, Ys),
+	return jc(new Uint8Array(t));
+}, Nc = 10 * 6e4, Pc = (e) => `/_voltro/connections/${e}/callback`, Fc = (e) => e === void 0 || e.length === 0 || !e.startsWith("/") || e.startsWith("//") || e.startsWith("/\\") ? "/" : e, Ic = (e, t) => e.redirectUri ?? `${t.replace(/\/+$/, "")}${Pc(e.id)}`, Lc = async (e) => {
+	let t = (e.now ?? (() => /* @__PURE__ */ new Date()))(), { definition: n } = e, r = Ac(), i = n.pkce === !1 ? null : Ac(48), a = Ic(n, e.publicUrl);
+	await e.store.insert(Qs, {
+		id: A($s, Qs),
 		state: r,
 		connectionId: n.id,
 		subjectId: e.subjectId,
 		tenantId: e.tenantId,
-		codeVerifier: i === null ? null : pi(i),
-		redirectTo: Mc(e.redirectTo),
+		codeVerifier: i === null ? null : gi(i),
+		redirectTo: Fc(e.redirectTo),
 		createdAt: t,
-		expiresAt: new Date(t.getTime() + Ac)
+		expiresAt: new Date(t.getTime() + Nc)
 	});
 	let o = new URLSearchParams({
 		response_type: "code",
@@ -5004,15 +5017,15 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		...n.scopes && n.scopes.length > 0 ? { scope: n.scopes.join(" ") } : {},
 		...n.authorizeParams ?? {}
 	});
-	i !== null && (o.set("code_challenge", await kc(i)), o.set("code_challenge_method", "S256"));
+	i !== null && (o.set("code_challenge", await Mc(i)), o.set("code_challenge_method", "S256"));
 	let s = n.authorizeUrl.includes("?") ? "&" : "?";
 	return {
 		authorizeUrl: `${n.authorizeUrl}${s}${o.toString()}`,
 		state: r
 	};
-}, Fc = async (e) => {
+}, Rc = async (e) => {
 	let t = (e.now ?? (() => /* @__PURE__ */ new Date()))(), n = (await e.store.query({
-		table: Ys,
+		table: Qs,
 		predicate: O("state", e.state),
 		order: [],
 		take: 1,
@@ -5024,8 +5037,8 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		reason: "unknown or already-used handshake state",
 		transient: !1
 	});
-	await e.store.delete(Ys, n.id);
-	let r = String(n.connectionId), i = rc(n.expiresAt);
+	await e.store.delete(Qs, n.id);
+	let r = String(n.connectionId), i = oc(n.expiresAt);
 	if (i !== null && i.getTime() < t.getTime()) throw new R({
 		connectionId: r,
 		reason: "handshake expired — start again",
@@ -5037,17 +5050,17 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		reason: "no oauth2 connection is declared under that id",
 		transient: !1
 	});
-	let o = n.codeVerifier === null || n.codeVerifier === void 0 ? null : mi(String(n.codeVerifier)), s = await mc(a, {
+	let o = n.codeVerifier === null || n.codeVerifier === void 0 ? null : _i(String(n.codeVerifier)), s = await _c(a, {
 		code: e.code,
-		redirectUri: Nc(a, e.publicUrl),
+		redirectUri: Ic(a, e.publicUrl),
 		codeVerifier: o
 	}, () => t.getTime()), c = a.identify === void 0 ? void 0 : await a.identify(s).catch((e) => {
-		Ks.warn("connection identify failed; storing without account details", {
+		Ys.warn("connection identify failed; storing without account details", {
 			connectionId: r,
 			reason: String(e)
 		});
 	});
-	return await cc({
+	return await dc({
 		store: e.store,
 		definition: a,
 		subjectId: String(n.subjectId),
@@ -5057,11 +5070,11 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		now: () => t
 	}), {
 		connectionId: r,
-		redirectTo: Mc(String(n.redirectTo ?? "/"))
+		redirectTo: Fc(String(n.redirectTo ?? "/"))
 	};
-}, Ic = async (e, t = /* @__PURE__ */ new Date()) => {
+}, zc = async (e, t = /* @__PURE__ */ new Date()) => {
 	let n = await e.query({
-		table: Ys,
+		table: Qs,
 		predicate: he("expiresAt", t),
 		order: [],
 		take: void 0,
@@ -5070,27 +5083,27 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 	}), r = 0;
 	for (let t of n) await e.delete("_voltro_connection_grants", t.id) && r++;
 	return r;
-}, Lc, Rc = (e) => {
-	Lc = e;
-}, zc = () => Lc, Bc = (e, t) => {
-	let n = Lc;
+}, Bc, Vc = (e) => {
+	Bc = e;
+}, Hc = () => Bc, Uc = (e, t) => {
+	let n = Bc;
 	return n === void 0 ? Promise.reject(/* @__PURE__ */ Error(`resolveConnectionForSubject("${t}"): no connection vault is registered — the app declares no \`*.connection.ts\`, or this call ran before boot completed.`)) : n(e, t);
-}, Vc = (e) => async (t, n) => {
+}, Wc = (e) => async (t, n) => {
 	let r = e.registry.get(n);
 	if (r === void 0) throw Error(`connection "${n}" is not declared. Declared: ${e.registry.list().map((e) => e.id).join(", ") || "(none)"}.`);
 	let i = t.id ?? null;
-	if (i === null || i === "") throw new vc(n, "<anonymous>");
-	return Tc({
+	if (i === null || i === "") throw new xc(n, "<anonymous>");
+	return Oc({
 		store: e.store,
 		definition: r,
 		subjectId: i
 	});
-}, Hc = (e) => {
+}, Gc = (e) => {
 	let t = e.subject.id ?? null, n = async (n) => {
 		let r = e.registry.get(n);
 		if (r === void 0) throw Error(`ctx.connections.get("${n}"): no such connection is declared. Declared: ${e.registry.list().map((e) => e.id).join(", ") || "(none)"}.`);
-		if (t === null || t === "") throw new vc(n, "<anonymous>");
-		return Tc({
+		if (t === null || t === "") throw new xc(n, "<anonymous>");
+		return Oc({
 			store: e.store,
 			definition: r,
 			subjectId: t
@@ -5102,7 +5115,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 			try {
 				return await n(e);
 			} catch (e) {
-				if (e instanceof vc) return null;
+				if (e instanceof xc) return null;
 				throw e;
 			}
 		},
@@ -5117,17 +5130,17 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 			expiresAt: null,
 			lastError: null,
 			connectedAt: null
-		})) : dc(e.store, e.registry, t)
+		})) : mc(e.store, e.registry, t)
 	};
-}, Uc = (e, t) => {
+}, Kc = (e, t) => {
 	let n = e.request?.subject?.id ?? null;
 	if (n === null || n === "") throw new Je({ connectionId: t });
 	return n;
-}, Wc = (e, t) => {
+}, qc = (e, t) => {
 	let n = e.registry.get(t);
 	if (n === void 0) throw new qe({ connectionId: t });
 	return n;
-}, Gc = (e) => async (t, n) => {
+}, Jc = (e) => async (t, n) => {
 	let r = n.request?.subject?.id ?? null;
 	return r === null || r === "" ? e.registry.list().map((e) => ({
 		connectionId: e.id,
@@ -5140,15 +5153,15 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		expiresAt: null,
 		lastError: null,
 		connectedAt: null
-	})) : dc(n.store, e.registry, r);
-}, Kc = (e) => async (t, n) => {
-	let r = Wc(e, t.connectionId), i = Uc(n, t.connectionId);
+	})) : mc(n.store, e.registry, r);
+}, Yc = (e) => async (t, n) => {
+	let r = qc(e, t.connectionId), i = Kc(n, t.connectionId);
 	if (r.kind !== "oauth2") throw new Ke({
 		connectionId: t.connectionId,
 		expected: "oauth2",
 		actual: r.kind
 	});
-	return Pc({
+	return Lc({
 		store: n.store,
 		definition: r,
 		subjectId: i,
@@ -5156,8 +5169,8 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		publicUrl: e.publicUrl,
 		...t.redirectTo === void 0 ? {} : { redirectTo: t.redirectTo }
 	});
-}, qc = (e) => async (t, n) => {
-	let r = Wc(e, t.connectionId), i = Uc(n, t.connectionId);
+}, Xc = (e) => async (t, n) => {
+	let r = qc(e, t.connectionId), i = Kc(n, t.connectionId);
 	if (r.kind !== "pat") throw new Ke({
 		connectionId: t.connectionId,
 		expected: "pat",
@@ -5179,7 +5192,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 			transient: !1
 		});
 	}
-	return await cc({
+	return await dc({
 		store: n.store,
 		definition: r,
 		subjectId: i,
@@ -5190,20 +5203,20 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		},
 		...o === void 0 ? {} : { account: o }
 	}), { ok: !0 };
-}, Jc = (e) => async (t, n) => {
-	Wc(e, t.connectionId);
-	let r = Uc(n, t.connectionId);
-	return { ok: await uc(n.store, t.connectionId, r) };
-}, Yc = "admin:full", Xc = class extends y.TaggedError()("AccessDenied", {
+}, Zc = (e) => async (t, n) => {
+	qc(e, t.connectionId);
+	let r = Kc(n, t.connectionId);
+	return { ok: await pc(n.store, t.connectionId, r) };
+}, Qc = "admin:full", $c = class extends y.TaggedError()("AccessDenied", {
 	action: y.String,
 	resourceType: y.String,
 	resourceId: y.String
-}) {}, Zc = /* @__PURE__ */ new Map(), Qc = (e) => {
+}) {}, el = /* @__PURE__ */ new Map(), tl = (e) => {
 	if (typeof e.resourceType != "string" || e.resourceType.length === 0) throw Error("defineResourcePolicy: a non-empty `resourceType` is required");
 	if (e.actions === void 0 || Object.keys(e.actions).length === 0) throw Error(`resource policy '${e.resourceType}': at least one action is required`);
-	if (Zc.has(e.resourceType)) throw Error(`resource policy '${e.resourceType}' is already registered — types must be unique`);
-	return Zc.set(e.resourceType, e), e;
-}, $c = (e) => Zc.get(e), el = () => [...Zc.values()], tl = () => Zc.clear(), nl = () => el().map((e) => {
+	if (el.has(e.resourceType)) throw Error(`resource policy '${e.resourceType}' is already registered — types must be unique`);
+	return el.set(e.resourceType, e), e;
+}, nl = (e) => el.get(e), rl = () => [...el.values()], il = () => el.clear(), al = () => rl().map((e) => {
 	let t = /* @__PURE__ */ new Set();
 	for (let n of Object.values(e.actions)) for (let e of n) t.add(e);
 	for (let [n, r] of Object.entries(e.implies ?? {})) {
@@ -5216,7 +5229,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		relations: [...t],
 		implies: e.implies ?? {}
 	};
-}), rl = (e, t) => {
+}), ol = (e, t) => {
 	let n = new Set(e);
 	if (t === void 0) return n;
 	let r = [...e];
@@ -5225,39 +5238,39 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		for (let i of t[e] ?? []) n.has(i) || (n.add(i), r.push(i));
 	}
 	return n;
-}, il = (e, t, n, r) => e.id === null ? /* @__PURE__ */ new Set() : rl(n.filter((n) => n.subjectId === e.id && n.resourceType === t.type && n.resourceId === t.id).map((e) => e.relation), r.implies), al = (e, t, n, r) => {
+}, sl = (e, t, n, r) => e.id === null ? /* @__PURE__ */ new Set() : ol(n.filter((n) => n.subjectId === e.id && n.resourceType === t.type && n.resourceId === t.id).map((e) => e.relation), r.implies), cl = (e, t, n, r) => {
 	if (e.scopes?.includes("admin:full")) return !0;
 	if (e.id === null || n.tenantId != null && e.tenantId !== n.tenantId) return !1;
 	let i = r.policy.actions[t];
 	if (i === void 0 || i.length === 0) return !1;
-	let a = il(e, n, r.tuples, r.policy);
+	let a = sl(e, n, r.tuples, r.policy);
 	return i.some((e) => a.has(e));
-}, ol = (e, t, n, r) => {
-	if (!al(e, t, n, r)) throw new Xc({
+}, ll = (e, t, n, r) => {
+	if (!cl(e, t, n, r)) throw new $c({
 		action: t,
 		resourceType: n.type,
 		resourceId: n.id
 	});
-}, sl = (e, t, n, r, i) => r.filter((r) => al(e, t, {
+}, ul = (e, t, n, r, i) => r.filter((r) => cl(e, t, {
 	type: n,
 	id: r.id,
 	...r.tenantId === void 0 ? {} : { tenantId: r.tenantId }
-}, i)), cl = (e, t) => {
+}, i)), dl = (e, t) => {
 	let n = new Set(t.map((e) => e.id));
 	return e.filter((e) => !n.has(e.id)).map((e) => e.id);
-}, ll = new Lt(), ul = (e) => {
-	ll.enterWith(e);
-}, dl = () => ll.getStore(), fl = (e, t) => ll.run(e, t), pl = z({ scope: "voltro:policy" }), ml, hl = (e) => {
-	ml = e;
-}, gl = () => ml, _l = () => {
+}, fl = new Lt(), pl = (e) => {
+	fl.enterWith(e);
+}, ml = () => fl.getStore(), hl = (e, t) => fl.run(e, t), gl = z({ scope: "voltro:policy" }), _l, vl = (e) => {
+	_l = e;
+}, yl = () => _l, bl = () => {
 	_t((e) => o.gen(function* () {
-		let t = $c(e.resourceType);
-		if (t === void 0) return pl.warn("policy guard denied — no resource policy registered for this type", {
+		let t = nl(e.resourceType);
+		if (t === void 0) return gl.warn("policy guard denied — no resource policy registered for this type", {
 			resourceType: e.resourceType,
 			action: e.action
 		}), !1;
-		let n = ml;
-		if (n === void 0) return pl.warn("policy guard denied — no tuple source registered (call setTupleSource at boot)", {
+		let n = _l;
+		if (n === void 0) return gl.warn("policy guard denied — no tuple source registered (call setTupleSource at boot)", {
 			resourceType: e.resourceType,
 			action: e.action
 		}), !1;
@@ -5266,14 +5279,14 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 				subjectId: e.subject.id,
 				resourceType: e.resourceType,
 				resourceId: e.resourceId,
-				load: dl()
+				load: ml()
 			}),
 			catch: (e) => e
-		}).pipe(o.catchAll((t) => (pl.error("policy guard denied — tuple source failed", {
+		}).pipe(o.catchAll((t) => (gl.error("policy guard denied — tuple source failed", {
 			resourceType: e.resourceType,
 			resourceId: e.resourceId
 		}, t), o.succeed([])))), i = e.subject;
-		return al({
+		return cl({
 			id: e.subject.id,
 			tenantId: i.tenantId ?? null,
 			...i.scopes === void 0 ? {} : { scopes: i.scopes }
@@ -5286,10 +5299,10 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 			tuples: r
 		});
 	}));
-}, vl = (e) => {
+}, xl = (e) => {
 	Promise.resolve().then(e);
-}, yl = (e) => {
-	let t = e.schedule ?? vl, n = /* @__PURE__ */ new Map(), r = /* @__PURE__ */ new Map(), i = (e, t) => `${e}\u0000${t}`, a = async (t) => {
+}, Sl = (e) => {
+	let t = e.schedule ?? xl, n = /* @__PURE__ */ new Map(), r = /* @__PURE__ */ new Map(), i = (e, t) => `${e}\u0000${t}`, a = async (t) => {
 		let a = r.get(t);
 		if (a === void 0) return;
 		r.delete(t);
@@ -5335,23 +5348,23 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		load: async (e, t) => (await o(e, [t]))[0] ?? null,
 		loadMany: (e, t) => o(e, t)
 	};
-}, bl = u.effect(Ct.HttpClient, o.map(Ct.HttpClient, (e) => e.pipe(Ct.mapRequestEffect((e) => o.currentSpan.pipe(o.map((t) => e.headers.traceparent === void 0 ? Tt.setHeader(e, "traceparent", ti({
+}, Cl = u.effect(Ct.HttpClient, o.map(Ct.HttpClient, (e) => e.pipe(Ct.mapRequestEffect((e) => o.currentSpan.pipe(o.map((t) => e.headers.traceparent === void 0 ? Tt.setHeader(e, "traceparent", ii({
 	traceId: t.traceId,
 	spanId: t.spanId,
 	sampled: t.sampled
-})) : e), o.catchAll(() => o.succeed(e))))))), xl = class extends Error {
+})) : e), o.catchAll(() => o.succeed(e))))))), wl = class extends Error {
 	url;
 	reason;
 	_tag = "SsrfBlockedError";
 	constructor(e, t) {
 		super(`SSRF: blocked outbound request to ${e} — ${t}. If this target is intentional, add its host to \`http.allowHosts\` in app.config.ts.`), this.url = e, this.reason = t, this.name = "SsrfBlockedError";
 	}
-}, Sl = (e, t) => e === 0 || e === 10 || e === 127 || e === 100 && t >= 64 && t <= 127 || e === 169 && t === 254 || e === 172 && t >= 16 && t <= 31 || e === 192 && t === 168 || e === 198 && (t === 18 || t === 19) || e >= 224, Cl = (e) => e === "::" || e === "::1" || e.startsWith("fc") || e.startsWith("fd") || e.startsWith("fe80") || e.startsWith("::ffff:"), wl = (e, t, n) => n.some((n) => {
+}, Tl = (e, t) => e === 0 || e === 10 || e === 127 || e === 100 && t >= 64 && t <= 127 || e === 169 && t === 254 || e === 172 && t >= 16 && t <= 31 || e === 192 && t === 168 || e === 198 && (t === 18 || t === 19) || e >= 224, El = (e) => e === "::" || e === "::1" || e.startsWith("fc") || e.startsWith("fd") || e.startsWith("fe80") || e.startsWith("::ffff:"), Dl = (e, t, n) => n.some((n) => {
 	let r = n.trim().toLowerCase();
 	if (r === "") return !1;
 	let i = t === "" ? e : `${e}:${t}`;
 	return r === e || r === i ? !0 : r.startsWith("*.") ? e.endsWith(r.slice(1)) : !1;
-}), Tl = (e, t = {}) => {
+}), Ol = (e, t = {}) => {
 	let n;
 	try {
 		n = new URL(e);
@@ -5360,30 +5373,30 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 	}
 	if (n.protocol !== "http:" && n.protocol !== "https:") return `blocked scheme "${n.protocol}"`;
 	let r = n.hostname.replace(/^\[|\]$/g, "").toLowerCase();
-	if (wl(r, n.port, t.allowHosts ?? [])) return null;
+	if (Dl(r, n.port, t.allowHosts ?? [])) return null;
 	if (r === "localhost" || r.endsWith(".localhost") || r.endsWith(".internal") || r.endsWith(".local")) return `blocked host "${r}"`;
 	let i = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(r);
 	if (i) {
 		let e = Number(i[1]), t = Number(i[2]);
-		return e > 255 || t > 255 || Number(i[3]) > 255 || Number(i[4]) > 255 ? "malformed ipv4 literal" : Sl(e, t) ? `blocked private/reserved address ${r}` : null;
+		return e > 255 || t > 255 || Number(i[3]) > 255 || Number(i[4]) > 255 ? "malformed ipv4 literal" : Tl(e, t) ? `blocked private/reserved address ${r}` : null;
 	}
 	if (r.includes(":")) {
 		let e = /^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/.exec(r);
-		return e ? Tl(`${n.protocol}//${e[1]}`, t) : Cl(r) ? `blocked private/reserved address ${r}` : null;
+		return e ? Ol(`${n.protocol}//${e[1]}`, t) : El(r) ? `blocked private/reserved address ${r}` : null;
 	}
 	return null;
-}, El = (e = {}) => u.effect(Ct.HttpClient, o.map(Ct.HttpClient, (t) => {
+}, kl = (e = {}) => u.effect(Ct.HttpClient, o.map(Ct.HttpClient, (t) => {
 	let n = Ct.transform(t, (t, n) => o.suspend(() => {
-		let r = Tl(n.url, e);
+		let r = Ol(n.url, e);
 		return r === null ? t : o.fail(new wt.RequestError({
 			request: n,
 			reason: "Transport",
-			cause: new xl(n.url, r),
+			cause: new wl(n.url, r),
 			description: `SSRF policy: ${r}`
 		}));
 	}));
 	return Ct.followRedirects(n, e.maxRedirects ?? 5);
-})), Dl = (e) => {
+})), Al = (e) => {
 	let t = e.now ?? Date.now, n = e.intervalMs ?? 3e4, r = e.maxPending ?? 500, i = /* @__PURE__ */ new Map(), a = !1, o = async () => {
 		if (i.size === 0) return;
 		let t = i;
@@ -5412,7 +5425,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		},
 		pending: () => i.size
 	};
-}, Ol = "voltro/audit", kl = "voltro/softDelete", Al = "voltro/expires", jl = "voltro/tenant", Ml = (e) => {
+}, jl = "voltro/audit", Ml = "voltro/softDelete", Nl = "voltro/expires", Pl = "voltro/tenant", Fl = (e) => {
 	let t = /* @__PURE__ */ new Map();
 	for (let n of e) {
 		let e = /* @__PURE__ */ new Set();
@@ -5458,17 +5471,17 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 			return !1;
 		},
 		idScheme: (e) => t.get(e)?.idScheme,
-		defaultFactories: (e) => t.get(e)?.defaultFactories ?? Nl,
-		computedFields: (e) => t.get(e)?.computedFields ?? Pl,
+		defaultFactories: (e) => t.get(e)?.defaultFactories ?? Il,
+		computedFields: (e) => t.get(e)?.computedFields ?? Ll,
 		versionColumn: (e) => t.get(e)?.versionColumn,
-		generatedColumns: (e) => t.get(e)?.generatedColumns ?? Fl,
+		generatedColumns: (e) => t.get(e)?.generatedColumns ?? Rl,
 		insertSchema: (e) => t.get(e)?.insertSchema,
 		validatePatchSchema: (e) => t.get(e)?.validatePatchSchema
 	};
-}, Nl = /* @__PURE__ */ new Map(), Pl = /* @__PURE__ */ new Map(), Fl = /* @__PURE__ */ new Set(), Il = Ml([]), Ll = z({ scope: "store.fieldEncryption" }), Rl = (e, t) => {
+}, Il = /* @__PURE__ */ new Map(), Ll = /* @__PURE__ */ new Map(), Rl = /* @__PURE__ */ new Set(), zl = Fl([]), Bl = z({ scope: "store.fieldEncryption" }), Vl = (e, t) => {
 	let n = t, r = process.env.VOLTRO_FIELD_DECRYPT_ON_ERROR === "null" ? "null" : "throw", i = /* @__PURE__ */ new Set(), a = (e) => {
 		let t = `${e.table}.${e.column}`;
-		i.has(t) || (i.add(t), Ll.warn("encrypted column degraded to null — could not decrypt with the active key", {
+		i.has(t) || (i.add(t), Bl.warn("encrypted column degraded to null — could not decrypt with the active key", {
 			table: e.table,
 			column: e.column,
 			reason: e.reason,
@@ -5492,7 +5505,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 			e.injectExternalChange(t);
 		},
 		...e.changeScope === void 0 ? {} : { changeScope: e.changeScope },
-		...e.withNamespace === void 0 ? {} : { withNamespace: (n) => Rl(e.withNamespace(n), t) },
+		...e.withNamespace === void 0 ? {} : { withNamespace: (n) => Vl(e.withNamespace(n), t) },
 		...e.raw === void 0 ? {} : { raw: ((...t) => e.raw(...t)) },
 		...e.close === void 0 ? {} : { close: (t) => e.close(t) },
 		...e.ping === void 0 ? {} : { ping: () => e.ping() },
@@ -5504,24 +5517,24 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		upsert: async (t, n, r) => c(t, await e.upsert(t, o(t, n), r)),
 		insertIgnore: async (t, n, r) => c(t, await e.insertIgnore(t, o(t, n), r)),
 		patchJson: async (t, n, r, i) => c(t, await e.patchJson(t, n, r, i)),
-		transactional: (n) => e.transactional((e) => n(Rl(e, t)))
+		transactional: (n) => e.transactional((e) => n(Vl(e, t)))
 	};
-}, zl = (e, t) => {
+}, Hl = (e, t) => {
 	if (t === void 0 || t.length === 0) return e;
 	let n = { ...e };
 	for (let e of t) delete n[e];
 	return n;
-}, Bl = (e, t) => {
+}, Ul = (e, t) => {
 	let n = j(e), r = n === void 0 ? [] : Oe(n);
 	return r.length === 0 ? t ?? [] : t === void 0 ? r : [...t, ...r];
-}, Vl = (e, t) => t.length === 0 ? e : e.map((e) => zl(e, t)), Hl = (e, t, n, r, i) => {
+}, Wl = (e, t) => t.length === 0 ? e : e.map((e) => Hl(e, t)), Gl = (e, t, n, r, i) => {
 	let a = {
 		...t?.(r) ?? {},
 		...n?.(i) ?? {}
 	}, o = e;
 	for (let [e, t] of Object.entries(a)) t !== void 0 && (o = o.where(e, t));
 	return o;
-}, Ul = 1e3, Wl = (e, t = Ul) => {
+}, Kl = 1e3, ql = (e, t = Kl) => {
 	let n = (e) => typeof e == "number" && Number.isFinite(e) ? e : void 0, r = (e) => Math.max(1, Math.min(Math.floor(e), t)), i = n(e.page);
 	if (i !== void 0) {
 		let t = r(n(e.pageSize) ?? 100);
@@ -5534,35 +5547,35 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		limit: r(n(e.limit) ?? 100),
 		offset: Math.max(0, Math.floor(n(e.offset) ?? 0))
 	};
-}, Gl = {
+}, Jl = {
 	list: (e, t = {}) => async (n, r) => {
 		let i = n ?? {}, a = r.store.select(e);
 		if (t.columns !== void 0 && t.columns.length > 0) {
-			let n = new Set(Bl(e, void 0)), r = t.columns.filter((e) => !n.has(e));
+			let n = new Set(Ul(e, void 0)), r = t.columns.filter((e) => !n.has(e));
 			r.length > 0 && (a = a.select(...r));
 		}
-		t.include !== void 0 && (a = a.with(t.include)), a = Hl(a, t.filter, t.scope, i, r);
+		t.include !== void 0 && (a = a.with(t.include)), a = Gl(a, t.filter, t.scope, i, r);
 		for (let e of t.sort ?? []) a = a.orderBy(e.column, e.direction ?? "asc");
 		if (t.paginate === !0) {
-			let { limit: e, offset: n } = Wl(i, t.maxPageSize);
+			let { limit: e, offset: n } = ql(i, t.maxPageSize);
 			a = a.limit(e).offset(n);
 		}
-		return Vl(await a.all(), Bl(e, t.redact));
+		return Wl(await a.all(), Ul(e, t.redact));
 	},
 	getById: (e, t = {}) => async (n, r) => {
 		let i = r.store.select(e).where("id", n.id);
 		t.include !== void 0 && (i = i.with(t.include));
 		let a = await i.first();
-		return a === null ? null : zl(a, Bl(e, t.redact));
+		return a === null ? null : Hl(a, Ul(e, t.redact));
 	},
-	create: (e, t = {}) => async (n, r) => zl(await r.store.insert(e, n), Bl(e, t.redact)),
+	create: (e, t = {}) => async (n, r) => Hl(await r.store.insert(e, n), Ul(e, t.redact)),
 	update: (e, t = {}) => async (n, r) => {
 		let { id: i, ...a } = n, o = await r.store.update(e, i, a);
-		return o === null ? null : zl(o, Bl(e, t.redact));
+		return o === null ? null : Hl(o, Ul(e, t.redact));
 	},
-	count: (e, t = {}) => async (n, r) => Hl(r.store.select(e), t.filter, t.scope, n ?? {}, r).count(),
+	count: (e, t = {}) => async (n, r) => Gl(r.store.select(e), t.filter, t.scope, n ?? {}, r).count(),
 	remove: (e) => async (t, n) => ({ deleted: await n.store.delete(e, t.id) })
-}, Kl = (e) => {
+}, Yl = (e) => {
 	let t = /* @__PURE__ */ new Set(), n = /* @__PURE__ */ new Set(), r = (e) => {
 		if (!n.has(e)) switch (n.add(e), e._tag) {
 			case "TypeLiteral":
@@ -5589,7 +5602,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		}
 	};
 	return r(e.ast), t;
-}, ql = (e) => {
+}, Xl = (e) => {
 	let t = /* @__PURE__ */ new Set(), n = /* @__PURE__ */ new Set(), r = (e) => {
 		switch (e._tag) {
 			case "Literal": return e.literal === null;
@@ -5624,24 +5637,24 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		}
 	};
 	return i(e.ast), t;
-}, Jl = (e, t) => {
+}, Zl = (e, t) => {
 	let n = e.source === void 0 ? [] : Array.isArray(e.source) ? e.source : [e.source];
 	if (n.length === 0) return [];
-	let r = Kl(e.output), i = ql(e.output), a = [];
+	let r = Yl(e.output), i = Xl(e.output), a = [];
 	for (let o of n) for (let n of t.get(o) ?? []) r.has(n) && !i.has(n) && a.push({
 		query: e.name,
 		table: o,
 		column: n
 	});
 	return a;
-}, Yl = (e) => {
+}, Ql = (e) => {
 	if (e.length !== 0) return `A wire-reachable query exposes a server-only column:\n${e.map((e) => `  • query '${e.query}' output declares '${e.column}' — a .serverOnly() column of '${e.table}'`).join("\n")}\nThree ways out, in order of preference:\n  1. Omit the column from the query's output schema. The crud.* read helpers strip these automatically.\n  2. Keep the KEY but type it \`Schema.Null\` — for a view that must stay wire-compatible (an importer that breaks if the key vanishes) while never sending a value. The audit accepts that, because the schema then PROVES no value can flow instead of promising it. Pair it with a \`hasX\` boolean.\n  3. Drop the .serverOnly() marker, if the column may in fact reach a client.\nNote the audit reads the DECLARED shape, not what your handler emits: a field typed \`string\` that you always set to null still fails, and should — the next edit to that handler is one line away from sending it.`;
-}, Xl = (e, t) => e.cache?.scope === "global" ? (e.source === void 0 ? [] : Array.isArray(e.source) ? e.source : [e.source]).filter((e) => t.has(e)).map((t) => ({
+}, $l = (e, t) => e.cache?.scope === "global" ? (e.source === void 0 ? [] : Array.isArray(e.source) ? e.source : [e.source]).filter((e) => t.has(e)).map((t) => ({
 	query: e.name,
 	table: t
-})) : [], Zl = (e) => {
+})) : [], eu = (e) => {
 	if (e.length !== 0) return `A cached query shares one entry across tenants:\n${e.map((e) => `  • query '${e.query}' caches scope:'global' while reading '${e.table}', a tenant()-scoped table`).join("\n")}\n\nscope:'global' stores ONE entry for every caller. On a tenant-scoped table the\nrows depend on who asked, so the first caller's rows are served to the next one.\n\nUse scope:'tenant' — one entry per org, none shared across orgs. Use 'subject'\nif the result also depends on WHICH person is asking, and 'global' only for data\nthat depends on neither.`;
-}, Ql = (e, t) => {
+}, tu = (e, t) => {
 	let n, r = 0;
 	for (let i of t) {
 		let t = 0;
@@ -5652,7 +5665,7 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		o > r && o >= .6 && (r = o, n = i);
 	}
 	return n;
-}, $l = (e, t) => {
+}, nu = (e, t) => {
 	if (t.size === 0) return [];
 	let n = [];
 	for (let r of e) {
@@ -5661,11 +5674,11 @@ var K = /* @__PURE__ */ new Map(), Yr = (e, t) => {
 		for (let i of e) t.has(i) || n.push({
 			procedure: r.name,
 			source: i,
-			didYouMean: Ql(i, t)
+			didYouMean: tu(i, t)
 		});
 	}
 	return n;
-}, eu = (e) => {
+}, ru = (e) => {
 	if (e.length === 0) return;
 	let t = e.map((e) => `  ${e.procedure}: source '${e.source}' matches no declared table` + (e.didYouMean === void 0 ? "" : ` — did you mean '${e.didYouMean}'?`));
 	return `${e.length} reactive source(s) name a table that does not exist:\n${t.join("\n")}\n
@@ -5674,77 +5687,78 @@ update again, which is indistinguishable from "nothing has changed" — so the
 symptom is silence, and silence is what this surface exists to eliminate.
 A \`source:\` is a STRING, so \`tsc\` cannot see a stale one and a rename leaves it
 behind quietly.`;
-}, tu = (e) => e.op === "update" && (e.old?.deletedAt ?? null) === null && (e.new?.deletedAt ?? null) !== null, nu = (e, t) => {
-	let n = tu(t);
+}, iu = (e) => e.old ?? e.new ?? {}, au = (e) => String(iu(e).id ?? ""), ou = (e) => {
+	let t = iu(e).tenantId;
+	return typeof t == "string" ? t : null;
+}, su = (e) => e.op === "update" && (e.old?.deletedAt ?? null) === null && (e.new?.deletedAt ?? null) !== null, cu = (e, t) => {
+	let n = su(t);
 	return t.op !== "delete" && !n ? [] : e.filter((e) => e.targetTable === t.table && e.policy !== "keep" && (!n || e.onSoftDelete));
-}, ru = async (e, t, n) => {
-	let r = nu(t, n);
+}, lu = async (e, t, n) => {
+	let r = cu(t, n);
 	if (r.length === 0) return [];
-	let i = [];
+	let i = au(n), a = ou(n), o = [];
 	for (let t of r) {
-		let r = await e.query({
+		let n = await e.query({
 			table: t.table,
 			predicate: {
 				kind: "eq",
 				column: t.column,
-				value: n.rowId
+				value: i
 			},
 			order: void 0,
 			take: void 0,
 			skip: void 0,
 			projection: void 0
-		}), a = n.tenantId === null || n.tenantId === void 0 ? r : r.filter((e) => e.tenantId === n.tenantId);
-		for (let n of a) {
+		}), r = a === null ? n : n.filter((e) => e.tenantId === a);
+		for (let n of r) {
 			let r = String(n.id);
 			t.policy === "delete" ? await e.delete(t.table, r) : await e.update(t.table, r, { [t.column]: null });
 		}
-		i.push({
+		o.push({
 			rule: t,
-			affected: a.length
+			affected: r.length
 		});
 	}
-	return i;
-}, iu = (e, t, n) => {
-	let r = [];
-	for (let i of e) for (let [e, a] of Object.entries(i.columns)) {
-		let o = t(a);
-		if (o === void 0) continue;
-		let s;
+	return o;
+}, uu = (e, t) => {
+	let n = [];
+	for (let r of e) for (let e of r.appliedPluginRefs ?? []) {
+		let i = e.column, a;
 		try {
-			s = o.target()?.name;
+			a = e.target()?.tableName;
 		} catch {
-			s = void 0;
-		}
-		if (s === void 0 || !n.has(s)) throw Error(`pluginRef: ${i.name}.${e} points at ${s ?? "an unresolvable table"}, which no installed plugin registers. A declared orphan rule against an absent table would look enforced and never fire — install the plugin that owns it, or drop the column.`);
-		r.push({
-			table: i.name,
-			column: e,
-			targetTable: s,
-			policy: o.orphanPolicy,
-			onSoftDelete: o.onSoftDelete
+			a = void 0;
+		}
+		if (a === void 0 || !t.has(a)) throw Error(`pluginRef: ${r.name}.${i} points at ${a ?? "an unresolvable table"}, which no installed plugin registers. A declared orphan rule against an absent table would look enforced and never fire — install the plugin that owns it, or drop the column.`);
+		n.push({
+			table: r.name,
+			column: i,
+			targetTable: a,
+			policy: e.orphanPolicy,
+			onSoftDelete: e.onSoftDelete
 		});
 	}
-	return r.filter((e) => e.policy !== "keep");
-}, au = class extends y.TaggedError()("CircuitOpen", {
+	return n.filter((e) => e.policy !== "keep");
+}, du = class extends y.TaggedError()("CircuitOpen", {
 	name: y.String,
 	retryAfterMs: y.Number
-}) {}, ou = {
+}) {}, fu = {
 	tag: "closed",
 	failureCount: 0,
 	halfOpenSuccesses: 0,
 	openedAt: 0
-}, su = { make: (n) => o.gen(function* () {
-	let r = n.name ?? "circuit", i = a.toMillis(a.decode(n.resetTimeout)), s = n.halfOpenSuccessThreshold ?? 1, c = n.isFailure ?? (() => !0), l = yield* _.make(ou), u = o.gen(function* () {
+}, pu = { make: (n) => o.gen(function* () {
+	let r = n.name ?? "circuit", i = a.toMillis(a.decode(n.resetTimeout)), s = n.halfOpenSuccessThreshold ?? 1, c = n.isFailure ?? (() => !0), l = yield* _.make(fu), u = o.gen(function* () {
 		let e = yield* _.get(l);
 		if (e.tag === "half-open") {
 			let t = e.halfOpenSuccesses + 1;
-			yield* _.set(l, t >= s ? ou : {
+			yield* _.set(l, t >= s ? fu : {
 				...e,
 				halfOpenSuccesses: t
 			});
 			return;
 		}
-		e.failureCount !== 0 && (yield* _.set(l, ou));
+		e.failureCount !== 0 && (yield* _.set(l, fu));
 	}), d = o.gen(function* () {
 		let e = yield* t.currentTimeMillis, r = yield* _.get(l);
 		if (r.tag === "half-open" || r.tag === "open") {
@@ -5782,7 +5796,7 @@ behind quietly.`;
 			if (e.isInterruptedOnly(t)) return o.void;
 			let n = e.failureOption(t), r = n._tag === "Some" ? n.value : void 0;
 			return c(r) ? d : o.void;
-		})) : yield* o.fail(new au({
+		})) : yield* o.fail(new du({
 			name: r,
 			retryAfterMs: n
 		}));
@@ -5791,25 +5805,25 @@ behind quietly.`;
 		value: _.get(l).pipe(o.map((e) => e.tag)),
 		enumerable: !0
 	}), Object.defineProperty(m, "reset", {
-		value: _.set(l, ou),
+		value: _.set(l, fu),
 		enumerable: !0
 	}), m;
-}) }, cu, lu = (e) => {
-	cu = e;
-}, uu = () => {
-	cu = void 0;
-}, du = () => cu, fu = async (e, t = {}) => {
-	let n = t.scopes === void 0 ? vt(t.id ?? "system") : vt(t.id ?? "system", t.scopes), r = t.store ?? cu?.dataStore, i = t.schemaRegistry ?? cu?.schemaRegistry, a = t.dialect ?? cu?.dialect;
+}) }, mu, hu = (e) => {
+	mu = e;
+}, gu = () => {
+	mu = void 0;
+}, _u = () => mu, vu = async (e, t = {}) => {
+	let n = t.scopes === void 0 ? vt(t.id ?? "system") : vt(t.id ?? "system", t.scopes), r = t.store ?? mu?.dataStore, i = t.schemaRegistry ?? mu?.schemaRegistry, a = t.dialect ?? mu?.dialect;
 	if (r === void 0 || i === void 0) throw Error("runAsSystem: no data store available — register one at boot via setSystemStoreHandle({ dataStore, schemaRegistry }) or pass { store, schemaRegistry } in the options.");
 	return e({
 		subject: n,
-		store: Gi(r, {
+		store: Ji(r, {
 			subject: n,
 			schemaRegistry: i,
 			...a === void 0 ? {} : { dialect: a }
 		})
 	});
-}, pu = (e) => {
+}, yu = (e) => {
 	let { currentRegion: t, replicaRegions: n, inner: r } = e, i = (e) => {
 		if (t === void 0) return {
 			sameRegion: [],
@@ -5837,7 +5851,7 @@ behind quietly.`;
 			return r.loadSnapshot();
 		}
 	};
-}, mu = (e = process.env) => {
+}, bu = (e = process.env) => {
 	for (let t of [
 		"VOLTRO_REGION",
 		"AWS_REGION",
@@ -5849,7 +5863,7 @@ behind quietly.`;
 		let n = e[t];
 		if (typeof n == "string" && n.length > 0) return n;
 	}
-}, hu = () => {
+}, xu = () => {
 	let e = {
 		primary: 0,
 		lagByReplica: /* @__PURE__ */ new Map()
@@ -5874,7 +5888,7 @@ behind quietly.`;
 			e.lagByReplica.set(t, n);
 		}
 	};
-}, gu = Symbol.for("@voltro/ScheduleDefinition"), _u = (e) => typeof e == "object" && !!e && gu in e, vu = 30 * 6e4, yu = (e) => {
+}, Su = Symbol.for("@voltro/ScheduleDefinition"), Cu = (e) => typeof e == "object" && !!e && Su in e, wu = 30 * 6e4, Tu = (e) => {
 	let t = r.parse(e.cron, e.timezone);
 	if (s.isLeft(t)) throw Error(`defineSchedule("${e.name}"): invalid cron expression "${e.cron}" (tz="${e.timezone}") — ${String(t.left)}`);
 	if (!e.timezone || e.timezone.trim() === "") throw Error(`defineSchedule("${e.name}"): timezone is required (e.g. "UTC", "Europe/Berlin").\nThe field is non-optional in \`ScheduleDefinition\`, so an ABSENT one is a tsc error and never reaches here. Arriving at this message means the value was present and EMPTY — almost always \`process.env.TZ ?? ''\` or a config lookup that missed. A reporter lost a crashloop to it, so the distinction is worth stating: this is not a check the type could have made for you.`);
@@ -5883,18 +5897,18 @@ behind quietly.`;
 		...e,
 		onOverlap: e.onOverlap ?? "skip",
 		backfill: e.backfill ?? "skip",
-		maxRuntimeMs: e.maxRuntimeMs ?? vu,
-		[gu]: !0
+		maxRuntimeMs: e.maxRuntimeMs ?? wu,
+		[Su]: !0
 	};
-}, bu = (e) => r.unsafeParse(e.cron, e.timezone), xu = (e, t = /* @__PURE__ */ new Date()) => r.next(bu(e), t), Z = "_voltro_wakeups", Su = (e) => `${e.tenantId}:${e.kind}:${e.refId}`, Cu = (e) => ({
+}, Eu = (e) => r.unsafeParse(e.cron, e.timezone), Du = (e, t = /* @__PURE__ */ new Date()) => r.next(Eu(e), t), Z = "_voltro_wakeups", Ou = (e) => `${e.tenantId}:${e.kind}:${e.refId}`, ku = (e) => ({
 	tenantId: String(e.tenantId),
 	kind: String(e.kind),
 	refId: String(e.refId),
 	wakeAt: e.wakeAt instanceof Date ? e.wakeAt : new Date(String(e.wakeAt)),
 	status: e.status === "fired" ? "fired" : "pending"
-}), wu = async (e, t) => {
+}), Au = async (e, t) => {
 	await e.upsert(Z, {
-		id: Su(t),
+		id: Ou(t),
 		tenantId: t.tenantId,
 		kind: t.kind,
 		refId: t.refId,
@@ -5904,7 +5918,7 @@ behind quietly.`;
 		conflictColumns: ["id"],
 		update: ["wakeAt", "status"]
 	});
-}, Tu = async (e, t) => e.delete(Z, Su(t)), Eu = async (e, t) => await e.update(Z, Su(t), { status: "fired" }) !== null, Du = (e, t) => ({ and: [{
+}, ju = async (e, t) => e.delete(Z, Ou(t)), Mu = async (e, t) => await e.update(Z, Ou(t), { status: "fired" }) !== null, Nu = (e, t) => ({ and: [{
 	column: "id",
 	op: "eq",
 	value: e
@@ -5912,16 +5926,16 @@ behind quietly.`;
 	column: "status",
 	op: "eq",
 	value: t
-}] }), Ou = async (e, t) => await e.updateMany(Z, { status: "fired" }, { where: Du(Su(t), "pending") }) > 0, ku = async (e, t) => {
-	await e.updateMany(Z, { status: "pending" }, { where: Du(Su(t), "fired") });
-}, Au = {
+}] }), Pu = async (e, t) => await e.updateMany(Z, { status: "fired" }, { where: Nu(Ou(t), "pending") }) > 0, Fu = async (e, t) => {
+	await e.updateMany(Z, { status: "pending" }, { where: Nu(Ou(t), "fired") });
+}, Iu = {
 	column: "status",
 	op: "eq",
 	value: "pending"
-}, ju = async (e, t) => {
+}, Lu = async (e, t) => {
 	let n = {
 		table: Z,
-		predicate: Au,
+		predicate: Iu,
 		order: [{
 			column: "wakeAt",
 			direction: "asc"
@@ -5930,18 +5944,18 @@ behind quietly.`;
 		skip: void 0,
 		projection: void 0
 	};
-	return (await e.query(n)).map(Cu);
-}, Mu = async (e, t, n = 500) => {
-	let r = await ju(e, n), i = t.getTime();
+	return (await e.query(n)).map(ku);
+}, Ru = async (e, t, n = 500) => {
+	let r = await Lu(e, n), i = t.getTime();
 	return r.filter((e) => e.wakeAt.getTime() <= i);
-}, Nu = async (e) => (await ju(e, 1))[0] ?? null, Pu = {
+}, zu = async (e) => (await Lu(e, 1))[0] ?? null, Bu = {
 	column: "status",
 	op: "eq",
 	value: "fired"
-}, Fu = async (e, t = {}) => {
+}, Vu = async (e, t = {}) => {
 	let n = {
 		table: Z,
-		predicate: Pu,
+		predicate: Bu,
 		order: [{
 			column: "wakeAt",
 			direction: "asc"
@@ -5952,12 +5966,12 @@ behind quietly.`;
 	}, r = await e.query(n), i = t.firedOlderThan?.getTime(), a = 0;
 	for (let t of r) i !== void 0 && (t.wakeAt instanceof Date ? t.wakeAt : new Date(String(t.wakeAt))).getTime() >= i || await e.delete(Z, String(t.id)) && a++;
 	return a;
-}, Iu = zo, Lu = "default", Ru = {
+}, Hu = Ho, Uu = "default", Wu = {
 	kind: "single",
 	tryClaim: async () => !0
-}, zu = "_voltro_schedule_claims", Bu = (e, t, n) => {
+}, Gu = "_voltro_schedule_claims", Ku = (e, t, n) => {
 	let r = async (t) => (await e.query({
-		table: zu,
+		table: Gu,
 		order: [],
 		predicate: void 0,
 		projection: ["id"],
@@ -5972,7 +5986,7 @@ behind quietly.`;
 				if (await r(s)) return !1;
 			} catch {}
 			try {
-				return await e.insert(zu, {
+				return await e.insert(Gu, {
 					id: s,
 					scheduleName: i,
 					bucket: o,
@@ -5990,12 +6004,12 @@ behind quietly.`;
 			}
 		}
 	};
-}, Vu = "_voltro_schedule_runs", Hu = async (e, t) => {
+}, qu = "_voltro_schedule_runs", Ju = async (e, t) => {
 	let { store: n, coordinator: i, buildContext: a, replicaId: o, log: s, onRunEvent: c, interceptFire: l } = t, u = t.dormancy === "sleep", d = t.dormancyTenantId ?? "default", f = /* @__PURE__ */ new Map(), p = /* @__PURE__ */ new Set(), m = /* @__PURE__ */ new Map(), h = !1, g = new Map(e.map((e) => [e.name, e])), _ = (e, t) => {
-		c?.(e, Wu(t));
+		c?.(e, Xu(t));
 	}, v = async (e, t, r, i, a, c) => {
 		try {
-			let s = `sr_${Re()}`, l = await n.insert(Vu, {
+			let s = `sr_${Re()}`, l = await n.insert(qu, {
 				id: s,
 				name: e.name,
 				status: i,
@@ -6020,7 +6034,7 @@ behind quietly.`;
 		}
 	}, y = async (e, t) => {
 		try {
-			let r = await n.update(Vu, e, t);
+			let r = await n.update(qu, e, t);
 			r && _("update", r);
 		} catch (t) {
 			s.warn("schedule: failed to record run finish", {
@@ -6031,7 +6045,7 @@ behind quietly.`;
 	}, b = async (e) => {
 		try {
 			let t = await n.query({
-				table: Vu,
+				table: qu,
 				predicate: {
 					_tag: "leaf",
 					column: "status",
@@ -6066,7 +6080,7 @@ behind quietly.`;
 				scheduleName: e.name,
 				trigger: n,
 				runId: o,
-				subject: Iu
+				subject: Hu
 			})
 		};
 		try {
@@ -6102,7 +6116,7 @@ behind quietly.`;
 			let n = Q(t).includes("exceeded maxRuntimeMs"), r = xn(t).dbMessage, i = typeof r == "string" && r !== "" ? `${Q(t)} — ${r}` : Q(t);
 			o && await y(o, {
 				status: "failed",
-				errorTag: n ? "timeout" : Uu(t),
+				errorTag: n ? "timeout" : Yu(t),
 				errorMessage: i,
 				completedAt: /* @__PURE__ */ new Date(),
 				durationMs: Date.now() - c
@@ -6166,8 +6180,8 @@ behind quietly.`;
 		}
 	}, w = async (e) => {
 		try {
-			let t = r.next(bu(e), /* @__PURE__ */ new Date());
-			await wu(n, {
+			let t = r.next(Eu(e), /* @__PURE__ */ new Date());
+			await Au(n, {
 				tenantId: d,
 				kind: "schedule",
 				refId: e.name,
@@ -6181,7 +6195,7 @@ behind quietly.`;
 		}
 	}, T = 2147483647, E = (e) => {
 		if (h) return;
-		let n = bu(e), i = r.next(n, /* @__PURE__ */ new Date()), a = () => {
+		let n = Eu(e), i = r.next(n, /* @__PURE__ */ new Date()), a = () => {
 			if (h) return;
 			let n = i.getTime() - Date.now();
 			if (n > T) {
@@ -6203,7 +6217,7 @@ behind quietly.`;
 		let i;
 		try {
 			let t = (await n.query({
-				table: Vu,
+				table: qu,
 				order: [{
 					column: "scheduledAt",
 					direction: "desc"
@@ -6222,7 +6236,7 @@ behind quietly.`;
 			return;
 		}
 		if (!i) return;
-		let a = bu(e), o = [], c = r.next(a, i), l = Date.now();
+		let a = Eu(e), o = [], c = r.next(a, i), l = Date.now();
 		for (; c.getTime() < l && o.length < 1e3;) o.push(c), c = r.next(a, c);
 		if (o.length !== 0) if (s.info("schedule: backfill", {
 			name: e.name,
@@ -6267,11 +6281,11 @@ behind quietly.`;
 			f.clear(), s.info("scheduler: stopped");
 		}
 	};
-}, Q = (e) => e?.message ?? String(e), Uu = (e) => e && typeof e == "object" && "_tag" in e ? String(e._tag) : null, Wu = (e) => {
+}, Q = (e) => e?.message ?? String(e), Yu = (e) => e && typeof e == "object" && "_tag" in e ? String(e._tag) : null, Xu = (e) => {
 	let t = {};
 	for (let [n, r] of Object.entries(e)) t[n] = r instanceof Date ? r.toISOString() : r;
 	return t;
-}, Gu = (e, t, n, r) => {
+}, Zu = (e, t, n, r) => {
 	let i = !1, a, o = async () => {
 		if (i) return;
 		let a = new Date(Math.floor(Date.now() / t) * t), o = !1;
@@ -6301,7 +6315,7 @@ behind quietly.`;
 			i || (i = !0, a && clearInterval(a), a = void 0);
 		}
 	};
-}, Ku = (e) => (t, n, r) => Gu(t, n, r, e), qu = F("_voltro_schedule_runs", {
+}, Qu = (e) => (t, n, r) => Zu(t, n, r, e), $u = F("_voltro_schedule_runs", {
 	id: M({ prefix: "schrun" }),
 	name: I(),
 	status: I().oneOf([
@@ -6331,13 +6345,13 @@ behind quietly.`;
 	]).nullable(),
 	replicaId: I().nullable(),
 	result: P().nullable()
-}).index(["name", "scheduledAt"]).index(["status"]), Ju = F("_voltro_schedule_claims", {
+}).index(["name", "scheduledAt"]).index(["status"]), ed = F("_voltro_schedule_claims", {
 	id: M({ prefix: "schclaim" }),
 	scheduleName: I(),
 	bucket: I(),
 	claimedBy: I(),
 	claimedAt: L()
-}).index(["scheduleName", "bucket"]).index(["claimedAt"]), Yu = F("_voltro_traces", {
+}).index(["scheduleName", "bucket"]).index(["claimedAt"]), td = F("_voltro_traces", {
 	id: M({ prefix: "span" }),
 	traceId: I(),
 	spanId: I(),
@@ -6361,7 +6375,7 @@ behind quietly.`;
 	durationMs: N(),
 	attributes: P().nullable(),
 	events: P().nullable()
-}).index(["traceId", "startedAt"]).index(["startedAt"]).index(["status"]), Xu = F("_voltro_undo_log", {
+}).index(["traceId", "startedAt"]).index(["startedAt"]).index(["status"]), nd = F("_voltro_undo_log", {
 	id: M({ prefix: "undo" }),
 	tag: I(),
 	label: I().nullable(),
@@ -6372,25 +6386,25 @@ behind quietly.`;
 	crossesAction: E().default(!1),
 	undone: E().default(!1),
 	createdAt: L().default("now")
-}).index(["subjectId", "createdAt"]), Zu = (e = process.env) => {
+}).index(["subjectId", "createdAt"]), rd = (e = process.env) => {
 	let t = (e.VOLTRO_UNDO ?? "").toLowerCase();
 	return t === "on" || t === "1" || t === "true" ? !0 : t === "off" || t === "0" || t === "false" ? !1 : e.NODE_ENV !== "production";
-}, Qu = (e) => e.startsWith("_voltro"), $u = async (e, t, n) => (await e.query({
+}, id = (e) => e.startsWith("_voltro"), ad = async (e, t, n) => (await e.query({
 	table: t,
 	predicate: O("id", n),
 	order: []
-}))[0] ?? null, ed = (e, t) => new Proxy(e, { get(e, n, r) {
+}))[0] ?? null, od = (e, t) => new Proxy(e, { get(e, n, r) {
 	if (n === "insert") return async (n, r) => {
 		let i = await e.insert(n, r);
-		return Qu(n) || t({
+		return id(n) || t({
 			table: n,
 			op: "insert",
 			next: i
 		}), i;
 	};
 	if (n === "update") return async (n, r, i) => {
-		let a = Qu(n) ? null : await $u(e, n, r), o = await e.update(n, r, i);
-		return Qu(n) || t({
+		let a = id(n) ? null : await ad(e, n, r), o = await e.update(n, r, i);
+		return id(n) || t({
 			table: n,
 			op: "update",
 			id: r,
@@ -6399,8 +6413,8 @@ behind quietly.`;
 		}), o;
 	};
 	if (n === "delete") return async (n, r) => {
-		let i = Qu(n) ? null : await $u(e, n, r), a = await e.delete(n, r);
-		return !Qu(n) && a && t({
+		let i = id(n) ? null : await ad(e, n, r), a = await e.delete(n, r);
+		return !id(n) && a && t({
 			table: n,
 			op: "delete",
 			id: r,
@@ -6409,10 +6423,10 @@ behind quietly.`;
 	};
 	let i = Reflect.get(e, n, r);
 	return typeof i == "function" ? i.bind(e) : i;
-} }), td = (e) => {
+} }), sd = (e) => {
 	let t = [];
 	return {
-		tx: ed(e, (e) => t.push(e)),
+		tx: od(e, (e) => t.push(e)),
 		persist: async (e, n) => {
 			if (t.length === 0 || n.tag.startsWith("__voltro")) return;
 			let r = n.subject;
@@ -6428,14 +6442,14 @@ behind quietly.`;
 			});
 		}
 	};
-}, nd = (e) => {
+}, cd = (e) => {
 	if (e.id !== void 0) return e.id;
 	let t = e.next?.id;
 	if (typeof t == "string") return t;
 	let n = e.prev?.id;
 	return typeof n == "string" ? n : void 0;
-}, rd = (e) => {
-	let t = nd(e);
+}, ld = (e) => {
+	let t = cd(e);
 	switch (e.op) {
 		case "insert": return t === void 0 ? null : {
 			table: e.table,
@@ -6459,28 +6473,28 @@ behind quietly.`;
 			row: e.prev
 		};
 	}
-}, id = (e) => {
-	if (e.crossesAction) throw new ad(e.invocationId, "action");
+}, ud = (e) => {
+	if (e.crossesAction) throw new dd(e.invocationId, "action");
 	let t = [];
 	for (let n = e.changes.length - 1; n >= 0; --n) {
-		let r = rd(e.changes[n]);
+		let r = ld(e.changes[n]);
 		r !== null && t.push(r);
 	}
 	return t;
-}, ad = class extends Error {
+}, dd = class extends Error {
 	invocationId;
 	boundary;
 	_tag = "UndoBoundaryError";
 	constructor(e, t) {
 		super(t === "action" ? `cannot undo invocation ${e}: it crossed an action (external side effect)` : `cannot undo invocation ${e}: the row changed since (conflict)`), this.invocationId = e, this.boundary = t, this.name = "UndoBoundaryError";
 	}
-}, od = (e, t, n = ["updatedAt", "updatedBy"]) => {
+}, fd = (e, t, n = ["updatedAt", "updatedBy"]) => {
 	if (t == null) return e == null;
 	if (e == null) return !1;
 	let r = new Set(n);
 	for (let [n, i] of Object.entries(t)) if (!r.has(n) && !Object.is(e[n], i) && JSON.stringify(e[n]) !== JSON.stringify(i)) return !1;
 	return !0;
-}, sd = class {
+}, pd = class {
 	capacity;
 	done = [];
 	undone = [];
@@ -6516,7 +6530,7 @@ behind quietly.`;
 			redo: [...this.undone]
 		};
 	}
-}, cd = (e, t = /* @__PURE__ */ new Set()) => e.op === "insert" ? {
+}, md = (e, t = /* @__PURE__ */ new Set()) => e.op === "insert" ? {
 	table: e.table,
 	op: "insert",
 	next: e.new ?? null
@@ -6533,7 +6547,7 @@ behind quietly.`;
 	table: e.table,
 	op: "delete",
 	prev: e.old ?? null
-}, ld = async (e, t) => {
+}, hd = async (e, t) => {
 	switch (t.op) {
 		case "delete":
 			await e.delete(t.table, t.id);
@@ -6551,21 +6565,21 @@ behind quietly.`;
 			await e.insert(t.table, t.row);
 			return;
 	}
-}, ud = async (e, t) => {
-	for (let n of t) await ld(e, n);
-}, dd = (e) => e.request?.subject?.id ?? null, fd = (e) => e === !0 || e === 1, pd = async (e, t, n) => (await e.query({
+}, gd = async (e, t) => {
+	for (let n of t) await hd(e, n);
+}, _d = (e) => e.request?.subject?.id ?? null, vd = (e) => e === !0 || e === 1, yd = async (e, t, n) => (await e.query({
 	table: t,
 	predicate: O("id", n),
 	order: []
-}))[0] ?? null, md = (e) => {
+}))[0] ?? null, bd = (e) => {
 	try {
 		let t = JSON.parse(String(e ?? "[]"));
 		return Array.isArray(t) ? t : [];
 	} catch {
 		return [];
 	}
-}, hd = (e) => e.id ?? e.next?.id ?? e.prev?.id, gd = async (e, t) => {
-	let n = dd(t);
+}, xd = (e) => e.id ?? e.next?.id ?? e.prev?.id, Sd = async (e, t) => {
+	let n = _d(t);
 	return [...await t.store.query({
 		table: "_voltro_undo_log",
 		predicate: O("subjectId", n),
@@ -6574,68 +6588,68 @@ behind quietly.`;
 		id: String(e.id),
 		tag: String(e.tag ?? ""),
 		label: e.label ?? null,
-		undone: fd(e.undone),
-		crossesAction: fd(e.crossesAction),
+		undone: vd(e.undone),
+		crossesAction: vd(e.crossesAction),
 		createdAt: String(e.createdAt ?? "")
 	}));
-}, _d = async (e, t) => {
-	let n = await pd(t.store, "_voltro_undo_log", e.invocationId);
+}, Cd = async (e, t) => {
+	let n = await yd(t.store, "_voltro_undo_log", e.invocationId);
 	if (!n) throw new rt({ invocationId: e.invocationId });
-	if ((n.subjectId ?? null) !== dd(t)) throw new nt({ invocationId: e.invocationId });
+	if ((n.subjectId ?? null) !== _d(t)) throw new nt({ invocationId: e.invocationId });
 	return n;
-}, vd = async (e, t) => {
-	let n = await _d(e, t);
-	if (fd(n.undone)) return { ok: !0 };
-	if (fd(n.crossesAction)) throw new tt({
+}, wd = async (e, t) => {
+	let n = await Cd(e, t);
+	if (vd(n.undone)) return { ok: !0 };
+	if (vd(n.crossesAction)) throw new tt({
 		invocationId: e.invocationId,
 		reason: "action"
 	});
-	let r = md(n.changes);
+	let r = bd(n.changes);
 	for (let n of r) {
-		let r = hd(n);
-		if (r !== void 0 && !od(await pd(t.store, n.table, r), n.next ?? null)) throw new tt({
+		let r = xd(n);
+		if (r !== void 0 && !fd(await yd(t.store, n.table, r), n.next ?? null)) throw new tt({
 			invocationId: e.invocationId,
 			reason: "conflict"
 		});
 	}
 	let i = {
 		invocationId: e.invocationId,
-		subject: dd(t),
+		subject: _d(t),
 		changes: r,
 		crossesAction: !1
 	};
-	return await ud(t.store, id(i)), await t.store.update("_voltro_undo_log", e.invocationId, { undone: !0 }), { ok: !0 };
-}, yd = async (e, t) => {
-	let n = await _d(e, t);
-	if (!fd(n.undone)) return { ok: !0 };
-	for (let e of md(n.changes)) {
-		let n = hd(e);
+	return await gd(t.store, ud(i)), await t.store.update("_voltro_undo_log", e.invocationId, { undone: !0 }), { ok: !0 };
+}, Td = async (e, t) => {
+	let n = await Cd(e, t);
+	if (!vd(n.undone)) return { ok: !0 };
+	for (let e of bd(n.changes)) {
+		let n = xd(e);
 		e.op === "insert" && e.next ? await t.store.insert(e.table, e.next) : e.op === "update" && n !== void 0 && e.next ? await t.store.update(e.table, n, e.next) : e.op === "delete" && n !== void 0 && await t.store.delete(e.table, n);
 	}
 	return await t.store.update("_voltro_undo_log", e.invocationId, { undone: !1 }), { ok: !0 };
-}, bd = (e = process.env) => {
+}, Ed = (e = process.env) => {
 	let t = (e.VOLTRO_TIMELINE ?? "").toLowerCase();
 	return t === "off" || t === "0" || t === "false" ? "off" : t === "all" ? "all" : t === "interesting" || t === "on" || t === "1" || t === "true" ? "interesting" : e.NODE_ENV === "production" ? "off" : "interesting";
-}, xd = /pass(word)?|secret|token|api[_-]?key|authorization|cookie|ssn|credit[_-]?card|card[_-]?number|cvv|encrypted/i, Sd = "«redacted»", Cd = (e) => {
+}, Dd = /pass(word)?|secret|token|api[_-]?key|authorization|cookie|ssn|credit[_-]?card|card[_-]?number|cvv|encrypted/i, Od = "«redacted»", kd = (e) => {
 	if (e == null) return null;
 	let t = {};
-	for (let [n, r] of Object.entries(e)) t[n] = xd.test(n) ? Sd : r;
+	for (let [n, r] of Object.entries(e)) t[n] = Dd.test(n) ? Od : r;
 	return t;
-}, wd = (e) => {
+}, Ad = (e) => {
 	let t = e?.id;
 	return typeof t == "string" ? t : void 0;
-}, Td = (e, t) => {
+}, jd = (e, t) => {
 	if (t.op === "insert") {
-		let n = wd(t.new);
+		let n = Ad(t.new);
 		return n === void 0 ? e : e.filter((e) => e.id !== n);
 	}
 	if (t.op === "update") {
 		if (t.old == null) return e;
-		let n = wd(t.new) ?? wd(t.old);
+		let n = Ad(t.new) ?? Ad(t.old);
 		return e.map((e) => e.id === n ? t.old : e);
 	}
 	return t.old == null ? e : [...e, t.old];
-}, Ed = class {
+}, Md = class {
 	mode;
 	capacity;
 	now;
@@ -6655,8 +6669,8 @@ behind quietly.`;
 			ts: this.now(),
 			table: e.table,
 			op: e.op,
-			old: Cd(e.old),
-			new: Cd(e.new),
+			old: kd(e.old),
+			new: kd(e.new),
 			tenantId: n
 		}), this.ring.length > this.capacity && this.ring.shift(), t;
 	}
@@ -6669,23 +6683,23 @@ behind quietly.`;
 	}
 	replay(e, t, n) {
 		let r = this.ring.filter((n) => n.table === e && n.seq > t).sort((e, t) => t.seq - e.seq), i = n;
-		for (let e of r) i = Td(i, e);
+		for (let e of r) i = jd(i, e);
 		return i;
 	}
-}, Dd, Od = () => (Dd === void 0 && (Dd = new Ed(bd())), Dd), kd = (e) => {
-	Dd = e;
-}, Ad = (e) => {
-	let t = Od();
+}, Nd, Pd = () => (Nd === void 0 && (Nd = new Md(Ed())), Nd), Fd = (e) => {
+	Nd = e;
+}, Id = (e) => {
+	let t = Pd();
 	if (t.enabled) try {
 		t.record(e);
 	} catch {}
-}, jd = /* @__PURE__ */ new Set([
+}, Ld = /* @__PURE__ */ new Set([
 	"count",
 	"sum",
 	"avg",
 	"min",
 	"max"
-]), Md = (e) => {
+]), Rd = (e) => {
 	if (e.joins !== void 0 && e.joins.length > 0) return {
 		maintainable: !1,
 		reason: "joins are not maintainable in v1"
@@ -6707,7 +6721,7 @@ behind quietly.`;
 		reason: "v1 maintains exactly one aggregation"
 	};
 	let t = e.aggregations[0];
-	return jd.has(t.op) ? t.op !== "count" && (t.column === void 0 || t.column.length === 0) ? {
+	return Ld.has(t.op) ? t.op !== "count" && (t.column === void 0 || t.column.length === 0) ? {
 		maintainable: !1,
 		reason: `op '${t.op}' requires a column`
 	} : {
@@ -6721,7 +6735,7 @@ behind quietly.`;
 		maintainable: !1,
 		reason: `op '${t.op}' is not maintainable`
 	};
-}, Nd = "\0", $ = (e, t) => t === void 0 || t.length === 0 ? "" : t.map((t) => JSON.stringify(e[t] ?? null)).join(Nd), Pd = (e, t) => t === void 0 ? 0 : Number(e[t] ?? 0), Fd = (e, t) => {
+}, zd = "\0", $ = (e, t) => t === void 0 || t.length === 0 ? "" : t.map((t) => JSON.stringify(e[t] ?? null)).join(zd), Bd = (e, t) => t === void 0 ? 0 : Number(e[t] ?? 0), Vd = (e, t) => {
 	switch (e.op) {
 		case "count": return t.count;
 		case "sum": return t.sum ?? 0;
@@ -6729,10 +6743,10 @@ behind quietly.`;
 		case "min":
 		case "max": return t.count > 0 ? t.extreme ?? null : null;
 	}
-}, Id = (e, t) => {
+}, Hd = (e, t) => {
 	let n = /* @__PURE__ */ new Map();
 	for (let r of t) {
-		let t = $(r, e.groupBy), i = n.get(t), a = Pd(r, e.column);
+		let t = $(r, e.groupBy), i = n.get(t), a = Bd(r, e.column);
 		if (i === void 0) n.set(t, {
 			count: 1,
 			...e.op === "sum" || e.op === "avg" ? { sum: a } : {},
@@ -6748,10 +6762,10 @@ behind quietly.`;
 		}
 	}
 	return n;
-}, Ld = (e, t) => [...t.entries()].map(([t, n]) => ({
+}, Ud = (e, t) => [...t.entries()].map(([t, n]) => ({
 	groupKey: t,
-	value: Fd(e, n)
-})), Rd = (e, t, n) => {
+	value: Vd(e, n)
+})), Wd = (e, t, n) => {
 	let r = new Map(t), i = /* @__PURE__ */ new Set(), a = (t) => {
 		let n = $(t, e.groupBy), a = r.get(n);
 		if (a === void 0) return;
@@ -6760,7 +6774,7 @@ behind quietly.`;
 			r.delete(n);
 			return;
 		}
-		let s = Pd(t, e.column);
+		let s = Bd(t, e.column);
 		e.op === "min" || e.op === "max" ? (a.extreme !== void 0 && s === a.extreme && i.add(n), r.set(n, {
 			count: o,
 			...a.extreme === void 0 ? {} : { extreme: a.extreme }
@@ -6769,7 +6783,7 @@ behind quietly.`;
 			...e.op === "sum" || e.op === "avg" ? { sum: (a.sum ?? 0) - s } : {}
 		});
 	}, o = (t) => {
-		let n = $(t, e.groupBy), i = r.get(n), a = Pd(t, e.column);
+		let n = $(t, e.groupBy), i = r.get(n), a = Bd(t, e.column);
 		if (i === void 0) {
 			r.set(n, {
 				count: 1,
@@ -6789,15 +6803,15 @@ behind quietly.`;
 		state: r,
 		rescanGroups: [...i]
 	};
-}, zd = (e, t, n, r) => {
+}, Gd = (e, t, n, r) => {
 	if (n.length === 0) return t;
-	let i = new Set(n), a = Id(e, r.filter((t) => i.has($(t, e.groupBy)))), o = new Map(t);
+	let i = new Set(n), a = Hd(e, r.filter((t) => i.has($(t, e.groupBy)))), o = new Map(t);
 	for (let e of i) {
 		let t = a.get(e);
 		t === void 0 ? o.delete(e) : o.set(e, t);
 	}
 	return o;
-}, Bd = class {
+}, Kd = class {
 	shape;
 	state = /* @__PURE__ */ new Map();
 	groups = /* @__PURE__ */ new Map();
@@ -6805,7 +6819,7 @@ behind quietly.`;
 		this.shape = e;
 	}
 	seed(e) {
-		this.state = Id(this.shape, e), this.groups.clear();
+		this.state = Hd(this.shape, e), this.groups.clear();
 		for (let t of e) {
 			let e = $(t, this.shape.groupBy);
 			this.groups.has(e) || this.groups.set(e, this.groupValues(t));
@@ -6817,14 +6831,14 @@ behind quietly.`;
 			let e = $(t, this.shape.groupBy);
 			this.groups.has(e) || this.groups.set(e, this.groupValues(t));
 		}
-		let n = Rd(this.shape, this.state, e);
+		let n = Wd(this.shape, this.state, e);
 		this.state = n.state;
 		for (let e of this.groups.keys()) this.state.has(e) || this.groups.delete(e);
 		return n.rescanGroups;
 	}
 	resolveRescan(e, t) {
 		if (e.length === 0) return;
-		this.state = zd(this.shape, this.state, e, t);
+		this.state = Gd(this.shape, this.state, e, t);
 		let n = new Set(e);
 		for (let e of t) {
 			let t = $(e, this.shape.groupBy);
@@ -6833,7 +6847,7 @@ behind quietly.`;
 		for (let e of n) this.state.has(e) || this.groups.delete(e);
 	}
 	materialize() {
-		return Ld(this.shape, this.state).map((e) => ({
+		return Ud(this.shape, this.state).map((e) => ({
 			groupKey: e.groupKey,
 			group: this.groups.get(e.groupKey) ?? {},
 			value: e.value
@@ -6846,7 +6860,7 @@ behind quietly.`;
 		for (let r of t) n[r] = e[r];
 		return n;
 	}
-}, Vd = F("_voltro_rebac_tuples", {
+}, qd = F("_voltro_rebac_tuples", {
 	id: M({ prefix: "rbct" }),
 	subjectId: I(),
 	relation: I(),
@@ -6858,7 +6872,7 @@ behind quietly.`;
 	"subjectId",
 	"resourceType",
 	"resourceId"
-]), Hd = async (e, t, n, r) => t === null ? [] : (await e.query({
+]), Jd = async (e, t, n, r) => t === null ? [] : (await e.query({
 	table: "_voltro_rebac_tuples",
 	predicate: C(O("subjectId", t), O("resourceType", n), O("resourceId", r)),
 	order: [],
@@ -6870,16 +6884,16 @@ behind quietly.`;
 	relation: e.relation,
 	resourceType: e.resourceType,
 	resourceId: e.resourceId
-})), Ud = (e) => ({
+})), Yd = (e) => ({
 	id: e.id,
 	tenantId: e.tenantId,
 	...e.scopes === void 0 ? {} : { scopes: e.scopes }
-}), Wd = (e, t) => {
-	let n = t.getPolicy ?? $c;
+}), Xd = (e, t) => {
+	let n = t.getPolicy ?? nl;
 	return (r, i) => {
 		let a = e[i.tag];
 		if (a === void 0) return r;
-		let s = n(a.resourceType), c = (e) => o.fail(new Xc({
+		let s = n(a.resourceType), c = (e) => o.fail(new $c({
 			action: a.action,
 			resourceType: a.resourceType,
 			resourceId: e
@@ -6887,17 +6901,17 @@ behind quietly.`;
 		if (s === void 0) return c("");
 		let l = a.resourceId(i.input);
 		if (l === null || l === "") return c("");
-		let u = Ud(i.subject), d = {
+		let u = Yd(i.subject), d = {
 			type: a.resourceType,
 			id: l,
 			tenantId: i.subject.tenantId
 		};
-		return o.flatMap(o.promise(async () => t.loadTuples(u.id, a.resourceType, l)), (e) => al(u, a.action, d, {
+		return o.flatMap(o.promise(async () => t.loadTuples(u.id, a.resourceType, l)), (e) => cl(u, a.action, d, {
 			policy: s,
 			tuples: e
 		}) ? r : c(l));
 	};
-}, Gd = async (e, t, n) => t === null ? [] : (await e.query({
+}, Zd = async (e, t, n) => t === null ? [] : (await e.query({
 	table: "_voltro_rebac_tuples",
 	predicate: C(O("subjectId", t), O("resourceType", n)),
 	order: [],
@@ -6909,18 +6923,18 @@ behind quietly.`;
 	relation: e.relation,
 	resourceType: e.resourceType,
 	resourceId: e.resourceId
-})), Kd = (e) => {
-	let t = e.getPolicy ?? $c;
+})), Qd = (e) => {
+	let t = e.getPolicy ?? nl;
 	return async (n, r, i, a) => {
 		let o = t(r);
 		if (o === void 0) return [];
-		let s = Ud(n);
-		return sl(s, i, r, a, {
+		let s = Yd(n);
+		return ul(s, i, r, a, {
 			policy: o,
 			tuples: await e.loadSubjectTuples(s.id, r)
 		});
 	};
-}, qd = (e) => {
+}, $d = (e) => {
 	if (typeof e.name != "string" || e.name.length === 0) throw Error("defineReaction: a non-empty `name` is required");
 	if (e.watch === void 0 || typeof e.watch.table != "string" || e.watch.table.length === 0) throw Error(`reaction '${e.name}': watch.table is required`);
 	if (e.act === void 0 || e.act.kind !== "agent" && e.act.kind !== "workflow") throw Error(`reaction '${e.name}': act must be { kind: 'agent' | 'workflow', … }`);
@@ -6928,14 +6942,14 @@ behind quietly.`;
 	if (e.guards.rateLimit !== void 0 && (e.guards.rateLimit.limit <= 0 || e.guards.rateLimit.windowMs <= 0)) throw Error(`reaction '${e.name}': guards.rateLimit needs positive limit + windowMs`);
 	if (e.guards.costBudgetUsd !== void 0 && e.guards.costBudgetUsd < 0) throw Error(`reaction '${e.name}': guards.costBudgetUsd must be >= 0`);
 	return e;
-}, Jd = (e, t) => e === void 0 ? !0 : Array.isArray(e) ? e.includes(t) : e === t, Yd = (e) => e.new?.tenantId ?? e.old?.tenantId ?? null, Xd = class {
+}, ef = (e, t) => e === void 0 ? !0 : Array.isArray(e) ? e.includes(t) : e === t, tf = (e) => e.new?.tenantId ?? e.old?.tenantId ?? null, nf = class {
 	hits = /* @__PURE__ */ new Map();
 	allow(e, t, n, r) {
 		let i = r - n, a = (this.hits.get(e) ?? []).filter((e) => e > i);
 		return a.length >= t ? (this.hits.set(e, a), !1) : (a.push(r), this.hits.set(e, a), !0);
 	}
-}, Zd = async (e, t, n) => {
-	if (t.table !== e.watch.table || !Jd(e.watch.on, t.op)) return "skipped-op";
+}, rf = async (e, t, n) => {
+	if (t.table !== e.watch.table || !ef(e.watch.on, t.op)) return "skipped-op";
 	if (e.when !== void 0 && !e.when(t)) return "skipped-when";
 	let r = `${e.name}:${e.guards.dedupeKey(t)}`;
 	if (await n.dedupe.has(r)) return "skipped-dedupe";
@@ -6944,26 +6958,26 @@ behind quietly.`;
 		let t = n.now?.() ?? Date.now();
 		if (!n.rateLimiter.allow(e.name, i.limit, i.windowMs, t)) return "skipped-ratelimit";
 	}
-	let a = Yd(t);
+	let a = tf(t);
 	return e.guards.costBudgetUsd !== void 0 && n.checkBudget !== void 0 && !await n.checkBudget(a, e.guards.costBudgetUsd) ? "skipped-budget" : (await n.runAct(e.act, t, {
 		id: a,
 		via: "agent"
 	}), await n.dedupe.add(r), "acted");
-}, Qd = F("_voltro_wakeups", {
+}, af = F("_voltro_wakeups", {
 	id: M({ prefix: "wakeup" }),
 	tenantId: I(),
 	kind: I(),
 	refId: I(),
 	wakeAt: L(),
 	status: I()
-}).index(["status", "wakeAt"]).index(["tenantId"]), $d = async (e) => {
-	let t = e.now?.() ?? /* @__PURE__ */ new Date(), n = await Mu(e.store, t, e.batchLimit ?? 100);
+}).index(["status", "wakeAt"]).index(["tenantId"]), of = async (e) => {
+	let t = e.now?.() ?? /* @__PURE__ */ new Date(), n = await Ru(e.store, t, e.batchLimit ?? 100);
 	if (n.length === 0) return 0;
 	let r = 0;
-	for (let t of n) if (await Ou(e.store, t)) try {
+	for (let t of n) if (await Pu(e.store, t)) try {
 		await e.adapter.wake(t), r++;
 	} catch (n) {
-		await ku(e.store, t), e.log?.warn("wake: adapter failed — released for retry", {
+		await Fu(e.store, t), e.log?.warn("wake: adapter failed — released for retry", {
 			tenantId: t.tenantId,
 			kind: t.kind,
 			refId: t.refId,
@@ -6971,11 +6985,11 @@ behind quietly.`;
 		});
 	}
 	return r > 0 && e.log?.info("wake: woke due deployments", { count: r }), r;
-}, ef = (e, t = 1e3) => {
+}, sf = (e, t = 1e3) => {
 	let n = !1, r, i = async () => {
 		if (!n) {
 			try {
-				await $d(e);
+				await of(e);
 			} catch (t) {
 				e.log?.warn("wake: tick failed", { reason: t instanceof Error ? t.message : String(t) });
 			}
@@ -6985,10 +6999,10 @@ behind quietly.`;
 	return i(), { stop: () => {
 		n = !0, r !== void 0 && clearTimeout(r);
 	} };
-}, tf = (e) => ({ wake: async () => {
+}, cf = (e) => ({ wake: async () => {
 	await e.start();
-} }), nf = (e) => new Promise((t) => setTimeout(t, e)), rf = (e) => {
-	let t = e.fetchImpl ?? fetch, n = e.now ?? Date.now, r = e.sleep ?? nf, i = e.spawnImpl ?? Zt, a = e.startTimeoutMs ?? 3e4, o = e.healthPollMs ?? 200, s = e.stopSignal ?? "SIGTERM", c = e.stopGraceMs ?? 1e4, l, u, d = e.healthCheck ?? ((e) => e.ok), f = async () => {
+} }), lf = (e) => new Promise((t) => setTimeout(t, e)), uf = (e) => {
+	let t = e.fetchImpl ?? fetch, n = e.now ?? Date.now, r = e.sleep ?? lf, i = e.spawnImpl ?? Zt, a = e.startTimeoutMs ?? 3e4, o = e.healthPollMs ?? 200, s = e.stopSignal ?? "SIGTERM", c = e.stopGraceMs ?? 1e4, l, u, d = e.healthCheck ?? ((e) => e.ok), f = async () => {
 		try {
 			let n = await t(e.healthUrl);
 			return d(n);
@@ -7042,11 +7056,11 @@ behind quietly.`;
 		},
 		stop: m
 	};
-}, af = async (e) => {
+}, df = async (e) => {
 	if (e.signals.connectedClients() > 0 || e.signals.inFlightRequests() > 0 || e.signals.activeWorkflowExecutions() > 0) return !1;
-	let t = (e.now?.() ?? /* @__PURE__ */ new Date()).getTime() + (e.wakeLookaheadMs ?? 3e4), n = await Nu(e.store);
+	let t = (e.now?.() ?? /* @__PURE__ */ new Date()).getTime() + (e.wakeLookaheadMs ?? 3e4), n = await zu(e.store);
 	return !(n !== null && n.wakeAt.getTime() <= t);
-}, of = (e, t = Date.now) => {
+}, ff = (e, t = Date.now) => {
 	let n;
 	return {
 		update: (r) => {
@@ -7058,7 +7072,7 @@ behind quietly.`;
 			n = void 0;
 		}
 	};
-}, sf = () => {
+}, pf = () => {
 	let e = 0, t = 0;
 	return {
 		onRequestStart: () => {
@@ -7076,7 +7090,7 @@ behind quietly.`;
 		inFlightRequests: () => e,
 		openConnections: () => t
 	};
-}, cf = (e) => ({ run: async (t) => (e.onActivity?.(), await e.ensureAwake(), t()) }), lf = (e, t, n, r) => new Promise((i, a) => {
+}, mf = (e) => ({ run: async (t) => (e.onActivity?.(), await e.ensureAwake(), t()) }), hf = (e, t, n, r) => new Promise((i, a) => {
 	let o = xt.request({
 		host: n,
 		port: r,
@@ -7087,7 +7101,7 @@ behind quietly.`;
 		t.writeHead(e.statusCode ?? 502, e.headers), e.pipe(t), e.on("end", i), e.on("error", a);
 	});
 	o.on("error", a), e.pipe(o);
-}), uf = (e, t, n, r, i) => new Promise((a, o) => {
+}), gf = (e, t, n, r, i) => new Promise((a, o) => {
 	let s = xt.request({
 		host: r,
 		port: i,
@@ -7102,21 +7116,21 @@ behind quietly.`;
 		};
 		t.on("close", s), r.on("close", s), r.on("error", o);
 	}), s.on("error", o), s.end();
-}), df = (e) => {
-	let t = cf({
+}), _f = (e) => {
+	let t = mf({
 		ensureAwake: () => e.supervisor.start(),
 		...e.onActivity === void 0 ? {} : { onActivity: e.onActivity }
 	}), n = e.activity, r = xt.createServer((r, i) => {
-		n?.onRequestStart(), i.on("close", () => n?.onRequestEnd()), t.run(() => lf(r, i, e.targetHost, e.targetPort)).catch((t) => {
+		n?.onRequestStart(), i.on("close", () => n?.onRequestEnd()), t.run(() => hf(r, i, e.targetHost, e.targetPort)).catch((t) => {
 			e.log?.warn("wake-router: proxy failed", { reason: t instanceof Error ? t.message : String(t) }), i.headersSent || i.writeHead(502), i.end("wake/proxy failed");
 		});
 	});
 	return r.on("upgrade", (r, i, a) => {
-		n?.onConnect(), i.on("close", () => n?.onDisconnect()), t.run(() => uf(r, i, a, e.targetHost, e.targetPort)).catch((t) => {
+		n?.onConnect(), i.on("close", () => n?.onDisconnect()), t.run(() => gf(r, i, a, e.targetHost, e.targetPort)).catch((t) => {
 			e.log?.warn("wake-router: upgrade proxy failed", { reason: t instanceof Error ? t.message : String(t) }), i.destroy();
 		});
 	}), r;
-}, ff = async (e) => {
+}, vf = async (e) => {
 	try {
 		return (await e.query({
 			table: "_voltro_workflow_runs",
@@ -7133,15 +7147,15 @@ behind quietly.`;
 	} catch {
 		return 0;
 	}
-}, pf = async (e) => {
-	let t = tf(e.supervisor), n = await $d({
+}, yf = async (e) => {
+	let t = cf(e.supervisor), n = await of({
 		store: e.store,
 		adapter: t,
 		...e.now === void 0 ? {} : { now: e.now },
 		...e.log === void 0 ? {} : { log: e.log }
 	});
 	n > 0 && e.idleGate.reset();
-	let r = await af({
+	let r = await df({
 		store: e.store,
 		signals: e.signals,
 		...e.wakeLookaheadMs === void 0 ? {} : { wakeLookaheadMs: e.wakeLookaheadMs },
@@ -7151,12 +7165,12 @@ behind quietly.`;
 		woke: n,
 		stopped: i
 	};
-}, mf = async (e) => {
-	let t = of(e.idleGraceMs ?? 6e4), n = e.tickMs ?? 1e3, r = sf(), i = 0, a = e.signals === void 0, o = e.signals ?? {
+}, bf = async (e) => {
+	let t = ff(e.idleGraceMs ?? 6e4), n = e.tickMs ?? 1e3, r = pf(), i = 0, a = e.signals === void 0, o = e.signals ?? {
 		connectedClients: () => r.openConnections(),
 		inFlightRequests: () => r.inFlightRequests(),
 		activeWorkflowExecutions: () => i
-	}, s = df({
+	}, s = _f({
 		supervisor: e.supervisor,
 		targetHost: e.targetHost,
 		targetPort: e.targetPort,
@@ -7175,7 +7189,7 @@ behind quietly.`;
 	let l = !1, u, d = e.firedRetentionMs ?? 10 * 6e4, f = 0, p = async () => {
 		if (!l) {
 			try {
-				if (a && (i = await ff(e.store)), await pf({
+				if (a && (i = await vf(e.store)), await yf({
 					store: e.store,
 					supervisor: e.supervisor,
 					signals: o,
@@ -7183,7 +7197,7 @@ behind quietly.`;
 					...e.wakeLookaheadMs === void 0 ? {} : { wakeLookaheadMs: e.wakeLookaheadMs },
 					...e.log === void 0 ? {} : { log: e.log }
 				}), f++ % 60 == 0) {
-					let t = await Fu(e.store, { firedOlderThan: new Date(Date.now() - d) });
+					let t = await Vu(e.store, { firedOlderThan: new Date(Date.now() - d) });
 					t > 0 && e.log?.info("orchestrator: pruned fired wakeups", { count: t });
 				}
 			} catch (t) {
@@ -7198,14 +7212,14 @@ behind quietly.`;
 			l = !0, u !== void 0 && clearTimeout(u), await new Promise((e) => s.close(() => e()));
 		}
 	};
-}, hf = (e) => e, gf = class extends y.TaggedError()("AnalyticsError", {
+}, xf = (e) => e, Sf = class extends y.TaggedError()("AnalyticsError", {
 	provider: y.String,
 	operation: y.String,
 	cause: y.String
-}) {}, _f = class extends y.TaggedError()("AnalyticsCapabilityNotSupported", {
+}) {}, Cf = class extends y.TaggedError()("AnalyticsCapabilityNotSupported", {
 	provider: y.String,
 	capability: y.String
-}) {}, vf = class extends n.Tag("@voltro/AnalyticsSink")() {}, yf = (e, t) => ({
+}) {}, wf = class extends n.Tag("@voltro/AnalyticsSink")() {}, Tf = (e, t) => ({
 	info: e.info,
 	track: (n) => e.track(n.tenantId === void 0 ? {
 		...n,
@@ -7224,20 +7238,20 @@ behind quietly.`;
 		tenantId: t
 	} : n),
 	...e.mirror === void 0 ? {} : { mirror: e.mirror }
-}), bf = () => o.gen(function* () {
-	let e = yield* vf, t = yield* o.serviceOption(et), n = h.match(t, {
+}), Ef = () => o.gen(function* () {
+	let e = yield* wf, t = yield* o.serviceOption(et), n = h.match(t, {
 		onNone: () => null,
 		onSome: (e) => e.tenantId ?? null
 	});
-	return n === null ? e : yf(e, n);
-}), xf = "noop", Sf = () => {
-	let e = (e) => o.fail(new _f({
-		provider: xf,
+	return n === null ? e : Tf(e, n);
+}), Df = "noop", Of = () => {
+	let e = (e) => o.fail(new Cf({
+		provider: Df,
 		capability: e
 	}));
 	return {
 		info: {
-			provider: xf,
+			provider: Df,
 			capabilities: {
 				track: !0,
 				aggregate: !1,
@@ -7251,8 +7265,8 @@ behind quietly.`;
 		timeseries: () => e("timeseries"),
 		topN: () => e("topN")
 	};
-}, Cf = (e) => {
-	if (e.length === 0) return Sf();
+}, kf = (e) => {
+	if (e.length === 0) return Of();
 	if (e.length === 1) return e[0];
 	let t = {
 		provider: "compose",
@@ -7269,7 +7283,7 @@ behind quietly.`;
 		discard: !0
 	}), r = (t, n) => {
 		let r = e.find((e) => e.info.capabilities[t]);
-		return r === void 0 ? o.fail(new _f({
+		return r === void 0 ? o.fail(new Cf({
 			provider: "compose",
 			capability: t
 		})) : n(r);
@@ -7292,11 +7306,11 @@ behind quietly.`;
 		topN: (e) => r("topN", (t) => t.topN(e)),
 		...a === void 0 ? {} : { mirror: a }
 	};
-}, wf = (e) => {
+}, Af = (e) => {
 	let t = e.filter((e) => e.dispose !== void 0);
 	return {
 		kind: "compose",
-		build: (t) => Cf(e.map((e) => e.build(t))),
+		build: (t) => kf(e.map((e) => e.build(t))),
 		tables: e.flatMap((e) => e.tables ?? []),
 		initialize: (t) => o.forEach(e, (e) => e.initialize ? e.initialize(t) : o.void, {
 			concurrency: 1,
@@ -7307,15 +7321,15 @@ behind quietly.`;
 			discard: !0
 		}) } : {}
 	};
-}, Tf = {
+}, jf = {
 	kind: "noop",
-	build: () => Sf()
-}, Ef = {
+	build: () => Of()
+}, Mf = {
 	tables: [],
 	detach: () => {}
-}, Df = (e) => {
+}, Nf = (e) => {
 	let { store: t, sink: n, log: r } = e, i = n.mirror;
-	if (i === void 0 || i.tables.length === 0) return Ef;
+	if (i === void 0 || i.tables.length === 0) return Mf;
 	let a = e.run ?? ((e) => o.runPromise(e)), s = i.primaryKey ?? "id", c = new Set(i.tables), l = (e) => {
 		if (e.op === "delete") {
 			let t = e.old;
@@ -7339,11 +7353,11 @@ behind quietly.`;
 		tables: i.tables,
 		detach: u
 	};
-}, Of = (e) => {
+}, Pf = (e) => {
 	let t = typeof e.refresh == "string" ? { interval: e.refresh } : e.refresh, n = e.strategy ?? "replace";
 	if (n === "merge" && (e.mergeKey === void 0 || e.mergeKey.length === 0)) throw Error(`defineAggregate("${e.name}"): strategy: 'merge' requires mergeKey — the property on each row to upsert by`);
 	if (e.incremental !== void 0) {
-		let t = Md({
+		let t = Rd({
 			aggregations: [{
 				op: e.incremental.op,
 				...e.incremental.column === void 0 ? {} : { column: e.incremental.column }
@@ -7365,47 +7379,51 @@ behind quietly.`;
 		build: e.build,
 		...e.incremental === void 0 ? {} : { incremental: e.incremental }
 	};
-}, kf = (e) => typeof e == "object" && !!e && e._voltroAggregate === !0, Af = class extends y.TaggedError()("AggregateStale", {
+}, Ff = (e) => typeof e == "object" && !!e && e._voltroAggregate === !0, If = class extends y.TaggedError()("AggregateStale", {
 	name: y.String,
 	ageMs: y.Number,
 	maxAgeMs: y.Number
-}) {}, jf = class extends y.TaggedError()("AggregateNotFound", { name: y.String }) {}, Mf = class extends y.TaggedError()("AggregateError", {
+}) {}, Lf = class extends y.TaggedError()("AggregateNotFound", { name: y.String }) {}, Rf = class extends y.TaggedError()("AggregateError", {
 	name: y.String,
 	operation: y.String,
 	cause: y.String
-}) {}, Nf = class extends n.Tag("@voltro/AggregateRegistry")() {}, Pf = (e) => o.gen(function* () {
-	return (yield* Nf).getHandle(e);
-}), Ff = (e, t, n) => {
+}) {}, zf = class extends n.Tag("@voltro/AggregateRegistry")() {}, Bf = (e) => o.gen(function* () {
+	return (yield* zf).getHandle(e);
+}), Vf = (e, t, n) => {
 	if (e.crossTenant || !t.has(e.table) || n == null) return e;
 	let r = O("tenantId", n);
 	return {
 		...e,
 		predicate: e.predicate ? C(e.predicate, r) : r
 	};
-}, If = (e, t, n) => n === "" && !e.crossTenant && t.has(e.table), Lf = (e) => e?.type === "user" && e.tenantId === "", Rf = (e, t) => {
+}, Hf = (e, t, n) => n === "" && !e.crossTenant && t.has(e.table), Uf = (e) => e?.type === "user" && e.tenantId === "", Wf = (e, t) => {
 	if (e.includeDeleted || !t.has(e.table)) return e;
 	let n = de("deletedAt");
 	return {
 		...e,
 		predicate: e.predicate ? C(e.predicate, n) : n
 	};
-}, zf = (e, t) => t, Bf = (t) => o.runPromiseExit(t).then((t) => {
+}, Gf = (e) => (t, n) => {
+	e.observe?.beforeScope?.({ ...t }, n);
+	let r = Wf(Vf(t, e.tenantScopedTables, n.tenantId), e.softDeleteScopedTables);
+	return e.observe?.afterScope?.({ ...r }), r;
+}, Kf = (e, t) => t, qf = (t) => o.runPromiseExit(t).then((t) => {
 	if (c.isSuccess(t)) return t.value;
 	let n = e.failureOption(t.cause);
 	throw h.isSome(n) ? n.value : e.squash(t.cause);
-}), Vf = (e, t) => e.pipe(o.provideService(et, t)), Hf = async (e, t, n) => {
+}), Jf = (e, t) => e.pipe(o.provideService(et, t)), Yf = async (e, t, n) => {
 	let r = await o.runPromise(ot(t, e.guards, n));
 	if (r) throw r;
-}, Uf = async (e) => {
+}, Xf = async (e) => {
 	if (Dr() === void 0) return e;
-	let t = await Bf(kr(e.subject, (e) => {
+	let t = await qf(kr(e.subject, (e) => {
 		console.error("[voltro] row filter failed to load", e);
 	}));
 	return {
 		...e,
 		rowFilter: t
 	};
-}, Wf = async (t) => {
+}, Zf = async (t) => {
 	let n = `${t.kind}.${t.name}`, r = Date.now(), i = "ok";
 	try {
 		if (t.interceptor) {
@@ -7434,28 +7452,28 @@ behind quietly.`;
 			status: i
 		});
 	}
-}, Gf = /* @__PURE__ */ new Set([1213, 1205]), Kf = /* @__PURE__ */ new Set([
+}, Qf = /* @__PURE__ */ new Set([1213, 1205]), $f = /* @__PURE__ */ new Set([
 	"ER_LOCK_DEADLOCK",
 	"ER_LOCK_WAIT_TIMEOUT",
 	"40001",
 	"40P01"
-]), qf = (e) => {
+]), ep = (e) => {
 	let t = e;
 	for (let e = 0; e < 6 && typeof t == "object" && t; e++) {
 		let e = t;
-		if (typeof e.errno == "number" && Gf.has(e.errno) || typeof e.code == "string" && Kf.has(e.code) || typeof e.sqlState == "string" && Kf.has(e.sqlState)) return !0;
+		if (typeof e.errno == "number" && Qf.has(e.errno) || typeof e.code == "string" && $f.has(e.code) || typeof e.sqlState == "string" && $f.has(e.sqlState)) return !0;
 		t = e.cause;
 	}
 	return !1;
-}, Jf = 3, Yf = (e) => new Promise((t) => setTimeout(t, e)), Xf = async (e, t) => {
-	let n = t?.delay ?? ((e) => Yf(e * 20 + Math.floor(Math.random() * 30)));
+}, tp = 3, np = (e) => new Promise((t) => setTimeout(t, e)), rp = async (e, t) => {
+	let n = t?.delay ?? ((e) => np(e * 20 + Math.floor(Math.random() * 30)));
 	for (let t = 1;; t++) try {
 		return await e();
 	} catch (e) {
-		if (t >= Jf || !qf(e)) throw e;
+		if (t >= tp || !ep(e)) throw e;
 		await n(t);
 	}
-}, Zf = (e) => (t, n, r) => Wf({
+}, ip = (e) => (t, n, r) => Zf({
 	name: t.descriptor.name,
 	kind: "mutation",
 	input: n,
@@ -7463,11 +7481,11 @@ behind quietly.`;
 	...e.interceptor ? { interceptor: e.interceptor } : {},
 	...e.recordMetric ? { recordMetric: e.recordMetric } : {},
 	runExecutor: async () => {
-		await Hf(t.descriptor, r.subject, n);
-		let i = await Uf(r), a = [], s = await Xf(async () => (a.length = 0, e.store.transactional(async (s) => {
+		await Yf(t.descriptor, r.subject, n);
+		let i = await Xf(r), a = [], s = await rp(async () => (a.length = 0, e.store.transactional(async (s) => {
 			let c = e.undoCapture?.(s), l = c ? c.tx : s, u = e.buildContext(i, l, { afterCommit: (e) => {
 				a.push(e);
-			} }), d = t.executor(n, u), f = o.isEffect(d) ? await e.runEffect(Vf(d, r.subject), u.store) : await d;
+			} }), d = t.executor(n, u), f = o.isEffect(d) ? await e.runEffect(Jf(d, r.subject), u.store) : await d;
 			return c && await c.persist(u.store, {
 				tag: t.descriptor.name,
 				subject: r.subject,
@@ -7477,30 +7495,30 @@ behind quietly.`;
 		for (let e of a) await e();
 		return s;
 	}
-}), Qf = (e) => e && typeof e == "object" && "descriptor" in e ? e.descriptor : e, $f = (e) => typeof e == "object" && !!e && !Array.isArray(e) && "table" in e && "order" in e, ep = (e) => {
+}), ap = (e) => e && typeof e == "object" && "descriptor" in e ? e.descriptor : e, op = (e) => typeof e == "object" && !!e && !Array.isArray(e) && "table" in e && "order" in e, sp = (e) => {
 	let t = e.descriptor.source;
 	return t == null ? [] : typeof t == "string" ? [t] : [...t];
-}, tp = (e, t) => (n) => () => {
+}, cp = (e, t) => (n) => () => {
 	let r = e.descriptor.guards;
 	return !r || r.length === 0 ? Promise.resolve(null) : o.runPromise(ot(n, r, t));
-}, np = (e) => (t, n) => (r) => {
-	let i = e.buildContext(r), a = tp(t, n)(r.subject), s = async () => {
+}, lp = (e) => (t, n) => (r) => {
+	let i = e.buildContext(r), a = cp(t, n)(r.subject), s = async () => {
 		let i = await a();
 		if (i) throw i;
-		let s = e.buildContext(await Uf(r)), c = t.executor(n, s);
-		return o.isEffect(c) ? o.runPromise(e.provideEffect(Vf(c, r.subject), s.store)) : Qf(await Promise.resolve(c));
+		let s = e.buildContext(await Xf(r)), c = t.executor(n, s);
+		return o.isEffect(c) ? o.runPromise(e.provideEffect(Jf(c, r.subject), s.store)) : ap(await Promise.resolve(c));
 	}, c = (n) => {
-		let i = Qf(n);
-		return $f(i) ? e.finalize(i, r) : {
+		let i = ap(n);
+		return op(i) ? e.finalize(i, r) : {
 			__voltroComputed: !0,
 			value: i,
-			dependentTables: ep(t),
+			dependentTables: sp(t),
 			tenantId: r.subject?.tenantId ?? null,
 			recompute: s
 		};
 	}, l = () => {
 		let a = t.executor(n, i);
-		return o.isEffect(a) ? e.provideEffect(Vf(a, r.subject), i.store).pipe(o.map(c)) : a instanceof Promise ? o.promise(() => a).pipe(o.map(c)) : c(a);
+		return o.isEffect(a) ? e.provideEffect(Jf(a, r.subject), i.store).pipe(o.map(c)) : a instanceof Promise ? o.promise(() => a).pipe(o.map(c)) : c(a);
 	}, u = () => {
 		let e = t.descriptor.guards;
 		return !e || e.length === 0 ? l() : ot(r.subject, e, n).pipe(o.flatMap((e) => {
@@ -7522,14 +7540,14 @@ behind quietly.`;
 		traceId: r.traceId,
 		...r.spanId === void 0 ? {} : { spanId: r.spanId }
 	});
-}, rp = (e) => async (t, n, r) => {
-	let i = await Uf(r), a = np(e)(t, n)(i), s = o.isEffect(a) ? await Bf(a) : a;
+}, up = (e) => async (t, n, r) => {
+	let i = await Xf(r), a = lp(e)(t, n)(i), s = o.isEffect(a) ? await qf(a) : a;
 	return zr(s) ? s.value : e.queryRows(s);
-}, ip = (e) => (t, n, r, i) => {
+}, dp = (e) => (t, n, r, i) => {
 	let a = !1, s;
 	return (async () => {
 		try {
-			let c = await Uf(r), l = np(e)(t, n)(c), u = o.isEffect(l) ? await Bf(l) : l, d = (e) => i(e), f = zr(u) ? await e.subscribeComputed(u, d, c) : await e.subscribeDescriptor(u, d, c);
+			let c = await Xf(r), l = lp(e)(t, n)(c), u = o.isEffect(l) ? await qf(l) : l, d = (e) => i(e), f = zr(u) ? await e.subscribeComputed(u, d, c) : await e.subscribeDescriptor(u, d, c);
 			a ? f() : s = f;
 		} catch (e) {
 			i({
@@ -7540,7 +7558,7 @@ behind quietly.`;
 	})(), () => {
 		a = !0, s?.();
 	};
-}, ap = (e) => (t, n, r) => Wf({
+}, fp = (e) => (t, n, r) => Zf({
 	name: t.descriptor.name,
 	kind: "action",
 	input: n,
@@ -7548,16 +7566,16 @@ behind quietly.`;
 	...e.interceptor ? { interceptor: e.interceptor } : {},
 	...e.recordMetric ? { recordMetric: e.recordMetric } : {},
 	runExecutor: async () => {
-		await Hf(t.descriptor, r.subject, n);
-		let i = e.buildContext(await Uf(r)), a = t.executor(n, i);
-		return o.isEffect(a) ? e.runEffect(Vf(a, r.subject), i.store) : a;
+		await Yf(t.descriptor, r.subject, n);
+		let i = e.buildContext(await Xf(r)), a = t.executor(n, i);
+		return o.isEffect(a) ? e.runEffect(Jf(a, r.subject), i.store) : a;
 	}
-}), op = (e) => e instanceof Date ? e.toISOString() : typeof e == "string" && e.length > 0 ? e : null, sp = (e) => typeof e == "string" && e.length > 0 ? e : null, cp = [
+}), pp = (e) => e instanceof Date ? e.toISOString() : typeof e == "string" && e.length > 0 ? e : null, mp = (e) => typeof e == "string" && e.length > 0 ? e : null, hp = [
 	"updatedAt",
 	"createdAt",
 	"updatedBy",
 	"createdBy"
-], lp = (e) => cp.some((t) => t in e), up = (e, t, n) => {
+], gp = (e) => hp.some((t) => t in e), _p = (e, t, n) => {
 	let r = {
 		table: t.table,
 		id: t.id,
@@ -7572,14 +7590,14 @@ behind quietly.`;
 		found: !1
 	};
 	let i = t.column === void 0 ? void 0 : e[t.column];
-	if (!lp(e)) return {
+	if (!gp(e)) return {
 		...r,
 		value: i,
 		lastWrite: null,
 		attribution: "none",
 		found: !0
 	};
-	let a = sp(e.updatedBy) ?? sp(e.createdBy), o = op(e.updatedAt) ?? op(e.createdAt);
+	let a = mp(e.updatedBy) ?? mp(e.createdBy), o = pp(e.updatedAt) ?? pp(e.createdAt);
 	return {
 		...r,
 		value: i,
@@ -7591,12 +7609,12 @@ behind quietly.`;
 		attribution: "audit",
 		found: !0
 	};
-}, dp = (e, t) => {
+}, vp = (e, t) => {
 	let n = e.map((e) => {
 		let n = e.newValue ?? e.value, r = t.column !== void 0 && n && typeof n == "object" ? n[t.column] : e.newValue ?? e.value;
 		return {
-			actor: { id: sp(e.actor) ?? sp(e.changedBy) },
-			at: op(e.at) ?? op(e.changedAt),
+			actor: { id: mp(e.actor) ?? mp(e.changedBy) },
+			at: pp(e.at) ?? pp(e.changedAt),
 			...e.traceId === void 0 ? {} : { traceId: e.traceId },
 			value: r
 		};
@@ -7611,12 +7629,12 @@ behind quietly.`;
 		history: n,
 		found: n.length > 0
 	};
-}, fp = (e) => {
+}, yp = (e) => {
 	let t = e.new?.id;
 	if (typeof t == "string") return t;
 	let n = e.old?.id;
 	return typeof n == "string" ? n : void 0;
-}, pp = (e) => {
+}, bp = (e) => {
 	let t = {};
 	if (e.op === "insert") for (let [n, r] of Object.entries(e.new ?? {})) t[n] = {
 		from: void 0,
@@ -7636,11 +7654,11 @@ behind quietly.`;
 	return {
 		table: e.table,
 		op: e.op,
-		id: fp(e),
+		id: yp(e),
 		fields: t
 	};
-}, mp = (e) => {
-	let t = e.map(pp);
+}, xp = (e) => {
+	let t = e.map(bp);
 	return {
 		rows: t,
 		summary: {
@@ -7649,21 +7667,21 @@ behind quietly.`;
 			deletes: t.filter((e) => e.op === "delete").length
 		}
 	};
-}, hp = class extends Error {
+}, Sp = class extends Error {
 	constructor() {
 		super("voltro:preview-rollback"), this.name = "PreviewRollback";
 	}
-}, gp = async (e, t) => {
+}, Cp = async (e, t) => {
 	let n, r = !1;
 	try {
 		await e.transactional(async (e) => {
-			throw n = await t(e), r = !0, new hp();
+			throw n = await t(e), r = !0, new Sp();
 		});
 	} catch (e) {
-		if (!(e instanceof hp)) throw e;
+		if (!(e instanceof Sp)) throw e;
 	}
 	if (!r) throw Error("preview: handler did not complete");
 	return n;
-}, _p = "framework-runtime";
+}, wp = "framework-runtime";
 //#endregion
-export { To as API_KEYS_TABLE, Xc as AccessDenied, Mf as AggregateError, Bd as AggregateMaintainer, jf as AggregateNotFound, Nf as AggregateRegistry, Af as AggregateStale, _f as AnalyticsCapabilityNotSupported, gf as AnalyticsError, vf as AnalyticsSink, X as CONNECTIONS_TABLE, Ys as CONNECTION_GRANTS_TABLE, su as CircuitBreaker, au as CircuitOpen, vc as ConnectionNotConnected, ja as DEFAULT_MAX_RPC_BODY_BYTES, gc as DEFAULT_REFRESH_SKEW_MS, wr as DEFAULT_ROW_FILTER_RETRY, Lu as DORMANCY_WAKEUP_TENANT, Pi as DeleteBuilder, Ir as Dispatcher, Cs as EVENT_CLIENT_QUEUE_SIZE, ws as EVENT_LATEST_QUEUE_SIZE, Bo as EffectStore, vs as EventBus, Ac as GRANT_TTL_MS, yn as InMemoryDataStore, sn as IndexedMatcher, As as InstanceMembership, $t as LinearScanMatcher, p as MetricBoundaries, xf as NOOP_ANALYTICS_PROVIDER, Or as NO_ROW_FILTER, Di as NoRowFound, Ps as OUTBOX_ATTEMPTS_TABLE, Vs as OUTBOX_ATTEMPT_LOG_CAP, Y as OUTBOX_TABLE, Oi as OptimisticLockError, Yc as REBAC_ADMIN_SCOPE, _c as REFRESH_LEASE_MS, _p as RUNTIME_NAME, Xd as ReactionRateLimiter, ta as ReplicatedDataStore, Cr as RowFilterUnavailable, Iu as SCHEDULE_SUBJECT, zo as SYSTEM_SUBJECT, Mi as SelectBuilder, xl as SsrfBlockedError, Li as StoreOperationFailed, un as SubscriptionRegistry, Ri as TableValidationFailed, Ii as TenantScopeViolation, Ed as TimelineRecorder, ad as UndoBoundaryError, sd as UndoStack, Ni as UpdateBuilder, Ol as VOLTRO_AUDIT_MIXIN_ID, Al as VOLTRO_EXPIRES_MIXIN_ID, kl as VOLTRO_SOFT_DELETE_MIXIN_ID, jl as VOLTRO_TENANT_MIXIN_ID, Xo as WorkflowPayloadError, Zr as _connectionStreamCount, Qr as _resetConnectionSubjectsForTest, Zs as _voltroConnectionGrantsTable, Js as _voltroConnectionsTable, Vd as _voltroRebacTuplesTable, Ju as _voltroScheduleClaimsTable, qu as _voltroScheduleRunsTable, Yu as _voltroTracesTable, Xu as _voltroUndoLogTable, Qd as _voltroWakeupsTable, fs as _voltroWorkflowEventDeliveriesTable, ds as _voltroWorkflowEventsTable, Wi as actingUserId, Ro as apiKeyManagementRoutes, Vi as applyDefined, Rd as applyDelta, ld as applyInverse, ud as applyInverses, ru as applyPluginRefRules, Mr as applyRowFilter, Nr as applyRowFilterToDescriptor, Rf as applySoftDeleteScope, Ff as applyTenantScope, vd as applyUndoInvocation, ol as assertCan, tc as assertConnectionCipherConfigured, Df as attachAnalyticsMirror, Ua as awaitServerListening, Bs as backoffMs, Pc as beginOAuthConnect, Wr as bindConnectionSubject, Ds as bindEvent, Aa as bindMutation, ya as bindStream, va as bindSubscription, pa as bindSubscriptionUntyped, Id as buildIvmState, mp as buildPreview, Wd as buildRebacInterceptor, Kd as buildRebacReadFilter, Yi as buildSubjectKey, Ja as buildTracingLayer, Xl as cacheScopeLeaks, lo as cachedBackend, al as can, Tu as cancelWakeup, cn as canonicalize, Md as classifyShape, Sc as clearConnectionRefreshFlights, tl as clearResourcePolicies, ee as clearRetentions, uu as clearSystemStoreHandle, iu as collectPluginRefRules, bu as compileCron, Fc as completeOAuthConnect, wf as composeAnalytics, Cf as composeAnalyticsSinks, jc as connectionCallbackPath, ec as connectionLabel, $r as connectionSubjectsSnapshot, ff as countRunningWorkflows, _r as counter, Gl as crud, dl as currentRequestLoader, ea as currentRoutingContext, oi as currentTraceContext, Fo as dataStoreApiKeyStore, _o as dataStoreIdempotencyStore, So as dataStoreKvStore, mi as decryptField, Of as defineAggregate, $s as defineConnection, os as defineEventTrigger, zf as defineExecutor, Ls as defineOutboxHandler, qd as defineReaction, Qc as defineResourcePolicy, yu as defineSchedule, hf as defineSubscriber, Pr as deliveredRowCount, si as deriveKey, pp as diffChange, Va as drainForShutdown, Gs as drainOutbox, Mu as dueWakeups, il as effectiveRelations, Il as emptySchemaRegistry, bi as enableGraphObservation, pi as encryptField, ul as enterRequestLoader, ro as envSecretsBackend, ar as eventMetricTagCacheSizeForTests, mc as exchangeAuthorizationCode, ri as externalSpanFromTraceparent, xn as extractDbCause, ln as fingerprintFor, uc as forgetCredential, Zl as formatCacheScopeLeaks, Yl as formatServerOnlyLeaks, ti as formatTraceparent, eu as formatUnresolvedSources, cd as forwardChangeFromCdc, Io as frameworkApiKeyStrategy, vr as gauge, Do as generateApiKeyToken, zc as getConnectionResolver, Gr as getConnectionSubject, q as getFieldCipher, $c as getResourcePolicy, Dr as getRowFilter, du as getSystemStoreHandle, Od as getTimelineRecorder, gl as getTupleSource, $ as groupKeyOf, yr as histogramMetric, dp as historyProvenance, uo as httpSecretsBackend, Xt as inspectWorkflow, _l as installPolicyGuardResolver, Xr as interruptConnectionStreams, rd as invertChange, kf as isAggregateDefinition, If as isEmptyTenantScopedRead, Sn as isForeignKeyViolation, af as isIdleNow, Ta as isInfraError, xi as isObservingGraph, Lf as isOrglessUserSubject, Cn as isQueryTimeout, od as isSafeToApply, _u as isScheduleDefinition, tu as isSoftDelete, ss as isWorkflowEventTriggerDefinition, Fd as ivmValue, up as lastWriteProvenance, dc as listConnectionStates, el as listResourcePolicies, pe as listRetentions, Hd as loadResourceTuples, Gd as loadSubjectTuples, pu as localityAwareSelector, ap as makeActionRunner, Bu as makeAdvisoryLockCoordinator, ci as makeAesCipher, Ao as makeApiKeyService, Dl as makeApiKeyUsageBuffer, Po as makeApiKeyUsageFlusher, wn as makeAppAccess, Co as makeAsyncKv, Es as makeBufferGapDetector, no as makeBufferingSpanProcessor, nc as makeConnectionRegistry, Vc as makeConnectionResolver, Hc as makeConnectionsFacade, Ku as makeCoordinatedScheduler, yl as makeDataLoader, Jc as makeDisconnectConnectionExecutor, Uo as makeEffectStoreLayer, Ss as makeEventPublisher, ps as makeEventsFacade, li as makeFieldCipher, Fi as makeFluentStore, of as makeIdleGate, ns as makeLazyWorkflowFacade, Gc as makeListConnectionsExecutor, Oa as makeMutationOutputCodec, Zf as makeMutationRunner, rp as makeOneShotQueryRunner, zs as makeOutboxFacade, es as makePostCommitWorkflowFacade, tf as makeProcessAdapter, np as makeQueryDescriptorProducer, tp as makeQueryReauthorizer, ip as makeQuerySubscriber, sf as makeRouterActivity, Ml as makeSchemaRegistry, Kc as makeStartConnectionExecutor, qc as makeSubmitTokenExecutor, td as makeUndoCapture, cf as makeWakeGate, df as makeWakeProxyServer, $o as makeWorkflowFacade, ts as makeWorkflowFacadeWithCallerContext, rs as makeWorkflowHandlers, is as makeWorkflowLayers, Ko as makeWorkflowRunHandle, Eu as markWakeupFired, Ld as materializeIvm, jo as memoryApiKeyStore, hu as memoryReplicationAdapter, Ji as memoryRywPositionStore, xu as nextFiring, Nu as nextWakeup, rf as nodeProcessSupervisor, Sf as noopAnalytics, Tf as noopAnalyticsSpec, wo as noopKv, Ei as observeStore, wi as observedGraph, qr as onBindConnectionSubject, Ia as onProcessShutdown, Is as outboxAttemptsTable, Ns as outboxTable, ni as parseTraceparent, Zo as payloadPropertyNames, Ki as powerOfTwoSelector, gp as previewInRollback, oc as projectConnectionState, Fu as pruneWakeups, bs as publishEvent, nl as rebacPolicyGraph, sr as recordEventDelivered, cr as recordEventDropped, or as recordEventPublished, lr as recordEventSubscribers, ur as recordSample, hr as recordScheduleRun, mr as recordSubscriptionActive, fr as recordSubscriptionDelivery, Ci as recordTableAccess, Ad as recordTimelineEvent, gr as recordWorkflowRun, Vl as redactColumns, Cd as redactRow, Xi as redisRywPositionStore, yd as redoUndoInvocation, hc as refreshAccessToken, Yr as registerConnectionStream, Ce as registerRetention, wu as registerWakeup, ku as releaseWakeup, qi as replicaHealth, ha as resetComputedQueryCacheWarnings, ir as resetEventMetricTagCacheForTests, Ti as resetObservedGraph, oo as resetSecretsBackend, Tc as resolveConnection, Bc as resolveConnectionForSubject, mu as resolveCurrentRegion, Tn as resolveDependentTables, Nc as resolveRedirectUri, zd as resolveRescan, kr as resolveRowFilterScope, Ar as resolveRowFilterScopeFor, so as resolveSecret, co as resolveSecretSync, fo as resolveSecretsBackend, bd as resolveTimelineMode, Te as retentionTtlMsFromEnv, Td as reverseEventOverRows, cl as revokedIds, nu as rulesFor, fu as runAsSystem, pf as runOrchestratorTick, Bf as runProvidedEffect, Zd as runReaction, mf as runSingleNodeOrchestrator, ef as runWakeLoop, Xf as runWithDeadlockRetry, Si as runWithObservedProcedure, fl as runWithRequestLoader, $i as runWithRoutingContext, ai as runWithTraceContext, Mc as sanitizeRedirectTo, Gu as scheduleCoordinated, Kl as schemaPropertyNames, Jl as serverOnlyLeaks, Rc as setConnectionResolver, di as setFieldCipher, Er as setRowFilter, ao as setSecretsBackend, lu as setSystemStoreHandle, kd as setTimelineRecorderForTest, hl as setTupleSource, Qt as settleHandlerBody, Eo as sha256Hex, Ba as shutdownGraceMsFromEnv, Ru as singleCoordinator, xr as snapshotMetrics, Sr as snapshotMetricsSync, El as ssrfGuardHttpClientLayer, Tl as ssrfReason, Ma as startRpcServer, Hu as startScheduler, cc as storeCredential, Ic as sweepExpiredGrants, Me as sweepRetention, id as synthesizeInverse, bl as tracingHttpClientLayer, as as triggerWorkflow, Ou as tryClaimWakeup, Kr as unbindConnectionSubject, Zu as undoCaptureEnabled, gd as undoLogExecutor, $l as unresolvedSources, Pf as useAggregate, bf as useAnalytics, sl as visibleRows, $d as wakeDueOnce, Uf as withRowFilter, Wo as workflowToRpc, ed as wrapCaptureStore, Rl as wrapStoreWithBootCodec, Gi as wrapStoreWithMixinBehaviour };
+export { Oo as API_KEYS_TABLE, $c as AccessDenied, Rf as AggregateError, Kd as AggregateMaintainer, Lf as AggregateNotFound, zf as AggregateRegistry, If as AggregateStale, Cf as AnalyticsCapabilityNotSupported, Sf as AnalyticsError, wf as AnalyticsSink, X as CONNECTIONS_TABLE, Qs as CONNECTION_GRANTS_TABLE, pu as CircuitBreaker, du as CircuitOpen, xc as ConnectionNotConnected, Pa as DEFAULT_MAX_RPC_BODY_BYTES, yc as DEFAULT_REFRESH_SKEW_MS, wr as DEFAULT_ROW_FILTER_RETRY, Uu as DORMANCY_WAKEUP_TENANT, Li as DeleteBuilder, Ir as Dispatcher, Es as EVENT_CLIENT_QUEUE_SIZE, Ds as EVENT_LATEST_QUEUE_SIZE, Uo as EffectStore, xs as EventBus, Nc as GRANT_TTL_MS, yn as InMemoryDataStore, sn as IndexedMatcher, Ns as InstanceMembership, $t as LinearScanMatcher, p as MetricBoundaries, Df as NOOP_ANALYTICS_PROVIDER, Or as NO_ROW_FILTER, Ai as NoRowFound, Ls as OUTBOX_ATTEMPTS_TABLE, Ws as OUTBOX_ATTEMPT_LOG_CAP, Y as OUTBOX_TABLE, ji as OptimisticLockError, Qc as REBAC_ADMIN_SCOPE, bc as REFRESH_LEASE_MS, wp as RUNTIME_NAME, nf as ReactionRateLimiter, ia as ReplicatedDataStore, Cr as RowFilterUnavailable, Hu as SCHEDULE_SUBJECT, Ho as SYSTEM_SUBJECT, Fi as SelectBuilder, wl as SsrfBlockedError, Bi as StoreOperationFailed, un as SubscriptionRegistry, Vi as TableValidationFailed, zi as TenantScopeViolation, Md as TimelineRecorder, dd as UndoBoundaryError, pd as UndoStack, Ii as UpdateBuilder, jl as VOLTRO_AUDIT_MIXIN_ID, Nl as VOLTRO_EXPIRES_MIXIN_ID, Ml as VOLTRO_SOFT_DELETE_MIXIN_ID, Pl as VOLTRO_TENANT_MIXIN_ID, $o as WorkflowPayloadError, ei as _connectionStreamCount, ti as _resetConnectionSubjectsForTest, ec as _voltroConnectionGrantsTable, Zs as _voltroConnectionsTable, qd as _voltroRebacTuplesTable, ed as _voltroScheduleClaimsTable, $u as _voltroScheduleRunsTable, td as _voltroTracesTable, nd as _voltroUndoLogTable, af as _voltroWakeupsTable, hs as _voltroWorkflowEventDeliveriesTable, ms as _voltroWorkflowEventsTable, qi as actingUserId, Vo as apiKeyManagementRoutes, Wi as applyDefined, Wd as applyDelta, hd as applyInverse, gd as applyInverses, lu as applyPluginRefRules, Mr as applyRowFilter, Nr as applyRowFilterToDescriptor, Wf as applySoftDeleteScope, Vf as applyTenantScope, wd as applyUndoInvocation, ll as assertCan, ic as assertConnectionCipherConfigured, Nf as attachAnalyticsMirror, Ka as awaitServerListening, Us as backoffMs, Lc as beginOAuthConnect, qr as bindConnectionSubject, As as bindEvent, Na as bindMutation, Sa as bindStream, xa as bindSubscription, ga as bindSubscriptionUntyped, Hd as buildIvmState, xp as buildPreview, Xd as buildRebacInterceptor, Qd as buildRebacReadFilter, Qi as buildSubjectKey, Za as buildTracingLayer, $l as cacheScopeLeaks, po as cachedBackend, cl as can, ju as cancelWakeup, cn as canonicalize, Rd as classifyShape, Tc as clearConnectionRefreshFlights, il as clearResourcePolicies, ee as clearRetentions, gu as clearSystemStoreHandle, uu as collectPluginRefRules, Eu as compileCron, Rc as completeOAuthConnect, Af as composeAnalytics, kf as composeAnalyticsSinks, Pc as connectionCallbackPath, rc as connectionLabel, ni as connectionSubjectsSnapshot, vf as countRunningWorkflows, _r as counter, Jl as crud, ml as currentRequestLoader, ra as currentRoutingContext, li as currentTraceContext, Ro as dataStoreApiKeyStore, bo as dataStoreIdempotencyStore, To as dataStoreKvStore, _i as decryptField, Pf as defineAggregate, nc as defineConnection, ls as defineEventTrigger, Kf as defineExecutor, Bs as defineOutboxHandler, $d as defineReaction, tl as defineResourcePolicy, Tu as defineSchedule, xf as defineSubscriber, Pr as deliveredRowCount, ui as deriveKey, bp as diffChange, Wa as drainForShutdown, Js as drainOutbox, Ru as dueWakeups, sl as effectiveRelations, zl as emptySchemaRegistry, Ci as enableGraphObservation, gi as encryptField, pl as enterRequestLoader, oo as envSecretsBackend, ar as eventMetricTagCacheSizeForTests, _c as exchangeAuthorizationCode, oi as externalSpanFromTraceparent, xn as extractDbCause, ln as fingerprintFor, pc as forgetCredential, eu as formatCacheScopeLeaks, Ql as formatServerOnlyLeaks, ii as formatTraceparent, ru as formatUnresolvedSources, md as forwardChangeFromCdc, zo as frameworkApiKeyStrategy, vr as gauge, Ao as generateApiKeyToken, Hc as getConnectionResolver, Jr as getConnectionSubject, Kr as getCredentialExpiry, q as getFieldCipher, nl as getResourcePolicy, Dr as getRowFilter, _u as getSystemStoreHandle, Pd as getTimelineRecorder, yl as getTupleSource, $ as groupKeyOf, yr as histogramMetric, vp as historyProvenance, mo as httpSecretsBackend, Xt as inspectWorkflow, bl as installPolicyGuardResolver, $r as interruptConnectionStreams, ld as invertChange, Ff as isAggregateDefinition, Hf as isEmptyTenantScopedRead, Sn as isForeignKeyViolation, df as isIdleNow, Oa as isInfraError, wi as isObservingGraph, Uf as isOrglessUserSubject, Cn as isQueryTimeout, fd as isSafeToApply, Cu as isScheduleDefinition, su as isSoftDelete, us as isWorkflowEventTriggerDefinition, Vd as ivmValue, _p as lastWriteProvenance, mc as listConnectionStates, rl as listResourcePolicies, pe as listRetentions, Jd as loadResourceTuples, Zd as loadSubjectTuples, yu as localityAwareSelector, fp as makeActionRunner, Ku as makeAdvisoryLockCoordinator, di as makeAesCipher, No as makeApiKeyService, Al as makeApiKeyUsageBuffer, Lo as makeApiKeyUsageFlusher, wn as makeAppAccess, Eo as makeAsyncKv, ks as makeBufferGapDetector, ao as makeBufferingSpanProcessor, ac as makeConnectionRegistry, Wc as makeConnectionResolver, Gc as makeConnectionsFacade, Qu as makeCoordinatedScheduler, Sl as makeDataLoader, Zc as makeDisconnectConnectionExecutor, Ko as makeEffectStoreLayer, Ts as makeEventPublisher, gs as makeEventsFacade, fi as makeFieldCipher, Ri as makeFluentStore, ff as makeIdleGate, as as makeLazyWorkflowFacade, Jc as makeListConnectionsExecutor, ja as makeMutationOutputCodec, ip as makeMutationRunner, up as makeOneShotQueryRunner, Hs as makeOutboxFacade, rs as makePostCommitWorkflowFacade, cf as makeProcessAdapter, lp as makeQueryDescriptorProducer, Gf as makeQueryFinalizer, cp as makeQueryReauthorizer, dp as makeQuerySubscriber, pf as makeRouterActivity, Fl as makeSchemaRegistry, Yc as makeStartConnectionExecutor, Xc as makeSubmitTokenExecutor, sd as makeUndoCapture, mf as makeWakeGate, _f as makeWakeProxyServer, ns as makeWorkflowFacade, is as makeWorkflowFacadeWithCallerContext, os as makeWorkflowHandlers, ss as makeWorkflowLayers, Yo as makeWorkflowRunHandle, Mu as markWakeupFired, Ud as materializeIvm, Po as memoryApiKeyStore, xu as memoryReplicationAdapter, Zi as memoryRywPositionStore, Du as nextFiring, zu as nextWakeup, uf as nodeProcessSupervisor, Of as noopAnalytics, jf as noopAnalyticsSpec, Do as noopKv, ki as observeStore, Di as observedGraph, Xr as onBindConnectionSubject, za as onProcessShutdown, zs as outboxAttemptsTable, Is as outboxTable, ai as parseTraceparent, es as payloadPropertyNames, Yi as powerOfTwoSelector, Cp as previewInRollback, lc as projectConnectionState, Vu as pruneWakeups, Cs as publishEvent, al as rebacPolicyGraph, Gr as recordCredentialExpiry, sr as recordEventDelivered, cr as recordEventDropped, or as recordEventPublished, lr as recordEventSubscribers, ur as recordSample, hr as recordScheduleRun, mr as recordSubscriptionActive, fr as recordSubscriptionDelivery, Ei as recordTableAccess, Id as recordTimelineEvent, gr as recordWorkflowRun, Wl as redactColumns, kd as redactRow, $i as redisRywPositionStore, Td as redoUndoInvocation, vc as refreshAccessToken, Qr as registerConnectionStream, Ce as registerRetention, Au as registerWakeup, Fu as releaseWakeup, Xi as replicaHealth, va as resetComputedQueryCacheWarnings, ir as resetEventMetricTagCacheForTests, Oi as resetObservedGraph, lo as resetSecretsBackend, Oc as resolveConnection, Uc as resolveConnectionForSubject, bu as resolveCurrentRegion, Tn as resolveDependentTables, Ic as resolveRedirectUri, Gd as resolveRescan, kr as resolveRowFilterScope, Ar as resolveRowFilterScopeFor, uo as resolveSecret, fo as resolveSecretSync, ho as resolveSecretsBackend, Ed as resolveTimelineMode, Te as retentionTtlMsFromEnv, jd as reverseEventOverRows, dl as revokedIds, cu as rulesFor, vu as runAsSystem, yf as runOrchestratorTick, qf as runProvidedEffect, rf as runReaction, bf as runSingleNodeOrchestrator, sf as runWakeLoop, rp as runWithDeadlockRetry, Ti as runWithObservedProcedure, hl as runWithRequestLoader, na as runWithRoutingContext, ci as runWithTraceContext, Fc as sanitizeRedirectTo, Zu as scheduleCoordinated, Yl as schemaPropertyNames, Zl as serverOnlyLeaks, Vc as setConnectionResolver, mi as setFieldCipher, Er as setRowFilter, co as setSecretsBackend, hu as setSystemStoreHandle, Fd as setTimelineRecorderForTest, vl as setTupleSource, Qt as settleHandlerBody, ko as sha256Hex, Ua as shutdownGraceMsFromEnv, Wu as singleCoordinator, xr as snapshotMetrics, Sr as snapshotMetricsSync, kl as ssrfGuardHttpClientLayer, Ol as ssrfReason, Fa as startRpcServer, Ju as startScheduler, dc as storeCredential, zc as sweepExpiredGrants, Me as sweepRetention, ud as synthesizeInverse, Cl as tracingHttpClientLayer, cs as triggerWorkflow, Pu as tryClaimWakeup, Yr as unbindConnectionSubject, rd as undoCaptureEnabled, Sd as undoLogExecutor, nu as unresolvedSources, Bf as useAggregate, Ef as useAnalytics, ul as visibleRows, of as wakeDueOnce, Xf as withRowFilter, qo as workflowToRpc, od as wrapCaptureStore, Vl as wrapStoreWithBootCodec, Ji as wrapStoreWithMixinBehaviour };