@voltro/runtime 0.3.0 → 0.5.0

package/dist/index.js

@@ -1,24 +1,24 @@
-import { ENCRYPTED_PREFIX as e, and as t, attachEagerLoads as n, boolean as r, clearRetentions as i, collectSubqueries as a, contains as o, decryptFieldsOnRead as s, deserializeArraysOnRead as c, encryptFieldsForWrite as l, eq as u, evaluatePredicate as d, generateId as f, getRelations as p, getTable as m, gt as h, gte as g, hasEagerLoads as _, id as v, inSet as y, integer as b, isNull as x, json as S, listRetentions as C, lt as w, lte as ee, neq as te, or as T, queryFor as ne, registerRetention as re, requireTable as ie, retentionTtlMsFromEnv as ae, serializeArraysForWrite as oe, sweepRetention as se, table as E, text as D, timestamp as O, walkLeaves as ce } from "@voltro/database";
-import { createCipheriv as le, createDecipheriv as ue, createHash as de, randomBytes as fe, randomUUID as pe, scryptSync as me } from "node:crypto";
-import { EventEmitter as he } from "node:events";
-import { ADMIN_SCOPE as ge, ConnectionInfo as _e, SubjectService as ve, UndoConflict as ye, UndoForbidden as be, UndoNotFound as xe, WorkflowRunHandleSchema as Se, checkGuards as Ce, diffRows as we, effectiveScopes as Te, hasEffectiveScope as Ee, isIdKeyed as De, publishServerError as Oe, requireScope as ke, systemSubject as Ae, tsMs as je } from "@voltro/protocol";
-import { createLogger as Me } from "@voltro/logger";
-import { Cause as k, Clock as Ne, Context as Pe, Cron as A, Deferred as Fe, Duration as Ie, Effect as j, Either as Le, Exit as Re, Layer as M, ManagedRuntime as ze, Metric as N, MetricBoundaries as Be, MetricState as Ve, Option as P, Ref as F, Schema as I, Stream as L, Tracer as He } from "effect";
-import * as Ue from "node:http";
-import { createServer as We } from "node:http";
-import { HttpClient as Ge, HttpClientRequest as Ke, HttpLayerRouter as R, HttpServer as qe, HttpServerRequest as z, HttpServerResponse as B } from "@effect/platform";
-import { NodeContext as Je, NodeHttpServer as Ye, NodeRuntime as Xe } from "@effect/platform-node";
-import { Rpc as Ze, RpcSerialization as Qe, RpcServer as $e } from "@effect/rpc";
-import { defineRestRoute as et, dispatchSharedPath as tt, requireScope as nt } from "@voltro/protocol/rest";
-import { AsyncLocalStorage as rt } from "node:async_hooks";
-import { SpanKind as it, SpanStatusCode as at } from "@opentelemetry/api";
-import { Kv as ot, KvError as st, KvStore as ct, layerConnections as lt, layerMemory as ut, layerRedis as dt } from "@voltro/kv";
-import { apiKeyStrategy as ft } from "@voltro/protocol/apikey";
-import { getCurrentWorkflowExecutionId as pt, inspectWorkflow as mt } from "@voltro/workflow";
-import { ArrayFormatter as ht } from "effect/ParseResult";
-import { spawn as gt } from "node:child_process";
+import { ENCRYPTED_PREFIX as e, and as t, attachEagerLoads as n, boolean as r, clearRetentions as i, collectSubqueries as a, contains as o, decryptFieldsOnRead as s, deserializeArraysOnRead as c, encryptFieldsForWrite as l, eq as u, evaluatePredicate as d, generateId as f, getRelations as p, getTable as m, gt as h, gte as g, hasEagerLoads as _, id as v, inSet as y, integer as b, isEncrypted as x, isNull as S, json as C, listRetentions as ee, lt as te, lte as ne, neq as w, or as re, queryFor as ie, registerRetention as ae, requireTable as oe, retentionTtlMsFromEnv as se, serializeArraysForWrite as ce, sweepRetention as le, table as T, text as E, timestamp as D, walkLeaves as ue } from "@voltro/database";
+import { createCipheriv as de, createDecipheriv as fe, createHash as pe, randomBytes as me, randomUUID as he, scryptSync as ge } from "node:crypto";
+import { EventEmitter as _e } from "node:events";
+import { ADMIN_SCOPE as ve, ConnectionInfo as ye, SubjectService as be, UndoConflict as xe, UndoForbidden as Se, UndoNotFound as Ce, WorkflowRunHandleSchema as we, checkGuardsEffect as Te, diffRows as Ee, effectiveScopes as De, hasEffectiveScope as Oe, isIdKeyed as ke, publishServerError as Ae, requireScope as je, setPolicyGuardResolver as Me, systemSubject as Ne, tsMs as Pe } from "@voltro/protocol";
+import { createLogger as O } from "@voltro/logger";
+import { Cause as k, Clock as Fe, Context as Ie, Cron as A, Deferred as Le, Duration as Re, Effect as j, Either as ze, Exit as Be, Layer as M, ManagedRuntime as Ve, Metric as N, MetricBoundaries as He, MetricState as Ue, Option as P, Ref as F, Schema as I, Stream as L, Tracer as We } from "effect";
+import * as Ge from "node:http";
+import { createServer as Ke } from "node:http";
+import { HttpClient as qe, HttpClientRequest as Je, HttpLayerRouter as R, HttpServer as Ye, HttpServerRequest as z, HttpServerResponse as B } from "@effect/platform";
+import { NodeContext as Xe, NodeHttpServer as Ze, NodeRuntime as Qe } from "@effect/platform-node";
+import { Rpc as $e, RpcSerialization as et, RpcServer as tt } from "@effect/rpc";
+import { defineRestRoute as nt, dispatchSharedPath as rt, requireScope as it } from "@voltro/protocol/rest";
+import { AsyncLocalStorage as at } from "node:async_hooks";
+import { SpanKind as ot, SpanStatusCode as st } from "@opentelemetry/api";
+import { Kv as ct, KvError as lt, KvStore as ut, layerConnections as dt, layerMemory as ft, layerRedis as pt } from "@voltro/kv";
+import { apiKeyStrategy as mt } from "@voltro/protocol/apikey";
+import { getCurrentWorkflowExecutionId as ht, inspectWorkflow as gt } from "@voltro/workflow";
+import { ArrayFormatter as _t } from "effect/ParseResult";
+import { spawn as vt } from "node:child_process";
 //#region src/matcher.ts
-var _t = class {
+var yt = class {
 	byTable = /* @__PURE__ */ new Map();
 	register(e) {
 		let t = this.byTable.get(e.table);
@@ -59,9 +59,9 @@ var _t = class {
 		});
 		return { perTable: e };
 	}
-}, vt = (e) => {
+}, bt = (e) => {
 	let t = [];
-	for (let n of ce(e)) n.conjunctive && n.path === void 0 && (n.op === "eq" && t.push({
+	for (let n of ue(e)) n.conjunctive && n.path === void 0 && (n.op === "eq" && t.push({
 		column: n.column,
 		values: [n.value]
 	}), n.op === "in" && t.push({
@@ -69,18 +69,18 @@ var _t = class {
 		values: n.value
 	}));
 	return t;
-}, yt = (e) => {
+}, xt = (e) => {
 	let t = [];
-	for (let n of ce(e)) n.conjunctive && n.path === void 0 && (n.op === "gt" || n.op === "gte" || n.op === "lt" || n.op === "lte") && t.push({
+	for (let n of ue(e)) n.conjunctive && n.path === void 0 && (n.op === "gt" || n.op === "gte" || n.op === "lt" || n.op === "lte") && t.push({
 		column: n.column,
 		op: n.op,
 		threshold: n.value
 	});
 	return t;
-}, bt = (e, t) => {
-	for (let n of ce(e)) if (n.conjunctive && n.path === void 0 && n.op === "eq" && n.column === t) return n.value;
+}, St = (e, t) => {
+	for (let n of ue(e)) if (n.conjunctive && n.path === void 0 && n.op === "eq" && n.column === t) return n.value;
 	return null;
-}, xt = (e, t) => {
+}, Ct = (e, t) => {
 	let n = [];
 	for (let r of e) {
 		let e = t(r);
@@ -88,8 +88,8 @@ var _t = class {
 		n.push(`${typeof e}:${String(e)}`);
 	}
 	return n.join("|");
-}, St = (e, t) => e === null || t === null ? null : e === t ? 0 : typeof e == typeof t ? e > t ? 1 : -1 : null, Ct = (e, t, n) => {
-	let r = St(e, n);
+}, wt = (e, t) => e === null || t === null ? null : e === t ? 0 : typeof e == typeof t ? e > t ? 1 : -1 : null, Tt = (e, t, n) => {
+	let r = wt(e, n);
 	if (r === null) return !1;
 	switch (t) {
 		case "gt": return r > 0;
@@ -97,7 +97,7 @@ var _t = class {
 		case "lt": return r < 0;
 		case "lte": return r <= 0;
 	}
-}, wt = class {
+}, Et = class {
 	columnByTable = /* @__PURE__ */ new Map();
 	rangeByTable = /* @__PURE__ */ new Map();
 	tupleByTable = /* @__PURE__ */ new Map();
@@ -105,9 +105,9 @@ var _t = class {
 	subscriptions = /* @__PURE__ */ new Map();
 	register(e) {
 		this.columnByTable.has(e.table) || this.columnByTable.set(e.table, /* @__PURE__ */ new Map()), this.rangeByTable.has(e.table) || this.rangeByTable.set(e.table, /* @__PURE__ */ new Map()), this.tupleByTable.has(e.table) || this.tupleByTable.set(e.table, /* @__PURE__ */ new Map()), this.unindexedByTable.has(e.table) || this.unindexedByTable.set(e.table, /* @__PURE__ */ new Set());
-		let t = vt(e.predicate), n = yt(e.predicate);
+		let t = bt(e.predicate), n = xt(e.predicate);
 		if (e.usingIndex !== void 0) {
-			let r = e.usingIndex, i = xt(r.fields, (t) => bt(e.predicate, t));
+			let r = e.usingIndex, i = Ct(r.fields, (t) => St(e.predicate, t));
 			if (i !== null) {
 				let a = `${r.name}|${i}`, o = this.tupleByTable.get(e.table), s = o.get(a);
 				s || (s = /* @__PURE__ */ new Set(), o.set(a, s)), s.add(e.id), this.subscriptions.set(e.id, {
@@ -252,7 +252,7 @@ var _t = class {
 				}
 			}
 			for (let [e, a] of i) {
-				let i = xt(a, (e) => t[e]);
+				let i = Ct(a, (e) => t[e]);
 				if (i === null) continue;
 				let o = r.get(`${e}|${i}`);
 				if (o) for (let e of o) n.add(e);
@@ -266,7 +266,7 @@ var _t = class {
 		let a = this.rangeByTable.get(e);
 		if (a) for (let [e, r] of a) {
 			let i = t[e];
-			if (i !== null) for (let [e, t] of r) for (let r of t) Ct(i, e, r.threshold) && n.add(r.subId);
+			if (i !== null) for (let [e, t] of r) for (let r of t) Tt(i, e, r.threshold) && n.add(r.subId);
 		}
 		return n;
 	}
@@ -275,7 +275,7 @@ var _t = class {
 			let e = t[n.column];
 			if (n.kind === "eq") {
 				if (e !== n.value) return !1;
-			} else if (!Ct(e, n.op, n.threshold)) return !1;
+			} else if (!Tt(e, n.op, n.threshold)) return !1;
 		}
 		return !0;
 	}
@@ -297,23 +297,23 @@ var _t = class {
 		}
 		return i;
 	}
-}, Tt = (e) => {
+}, Dt = (e) => {
 	if (e == null) return null;
-	if (Array.isArray(e)) return e.map(Tt);
+	if (Array.isArray(e)) return e.map(Dt);
 	if (typeof e == "object") {
 		let t = e, n = Object.keys(t).sort(), r = {};
-		for (let e of n) r[e] = Tt(t[e]);
+		for (let e of n) r[e] = Dt(t[e]);
 		return r;
 	}
 	return e;
-}, Et = (e, t, n) => {
-	let r = Tt({
+}, Ot = (e, t, n) => {
+	let r = Dt({
 		table: e,
 		predicate: t,
 		indexHint: n ?? null
 	});
-	return de("sha256").update(JSON.stringify(r)).digest("hex").slice(0, 16);
-}, Dt = class {
+	return pe("sha256").update(JSON.stringify(r)).digest("hex").slice(0, 16);
+}, kt = class {
 	matcher;
 	byFingerprint = /* @__PURE__ */ new Map();
 	byClient = /* @__PURE__ */ new Map();
@@ -332,7 +332,7 @@ var _t = class {
 		} catch {}
 	}
 	subscribe(e, t, n, r) {
-		let i = Et(t, n, r?.name), a = this.byFingerprint.get(i);
+		let i = Ot(t, n, r?.name), a = this.byFingerprint.get(i);
 		return a ? (a.subscribers.add(e), this.byClient.set(e, i), this.notifyChange(), {
 			fingerprint: i,
 			deduplicated: !0
@@ -390,7 +390,7 @@ var _t = class {
 		});
 		return e;
 	}
-}, Ot = (e, t) => t.length === 0 ? e : [...e].sort((e, n) => {
+}, At = (e, t) => t.length === 0 ? e : [...e].sort((e, n) => {
 	for (let r of t) {
 		let t = e[r.column], i = n[r.column];
 		if (t === i) continue;
@@ -400,7 +400,7 @@ var _t = class {
 		return r.direction === "asc" ? a : -a;
 	}
 	return 0;
-}), kt = (e, t, n) => {
+}), jt = (e, t, n) => {
 	let r = t.split("."), i = r[0], a = r.slice(1), o = (e) => typeof e == "object" && !!e && !Array.isArray(e), s = e[i], c;
 	if (a.length === 0) c = o(s) && o(n) ? {
 		...s,
@@ -418,11 +418,11 @@ var _t = class {
 		...e,
 		[i]: c
 	};
-}, At = (e, t, n) => !e || d(e, t, n), V = (e, t) => {
+}, Mt = (e, t, n) => !e || d(e, t, n), V = (e, t) => {
 	let n = /* @__PURE__ */ new Map();
 	if (!e) return n;
 	for (let r of a(e)) {
-		let e = t.get(r.descriptor.table) ?? /* @__PURE__ */ new Map(), i = V(r.descriptor.predicate, t), a = jt(r.descriptor, e, t, i);
+		let e = t.get(r.descriptor.table) ?? /* @__PURE__ */ new Map(), i = V(r.descriptor.predicate, t), a = Nt(r.descriptor, e, t, i);
 		if (r.kind === "exists") n.set(r.descriptor, a.length);
 		else {
 			let e = r.descriptor.projection, t = /* @__PURE__ */ new Set();
@@ -437,15 +437,15 @@ var _t = class {
 		}
 	}
 	return n;
-}, jt = (e, t, n = /* @__PURE__ */ new Map(), r = null) => {
-	let i = r ?? V(e.predicate, n), a = [...t.values()].filter((t) => At(e.predicate, t, i));
+}, Nt = (e, t, n = /* @__PURE__ */ new Map(), r = null) => {
+	let i = r ?? V(e.predicate, n), a = [...t.values()].filter((t) => Mt(e.predicate, t, i));
 	if (e.aggregations && e.aggregations.length > 0) {
-		let t = Mt(a, e.aggregations, e.groupBy);
+		let t = Pt(a, e.aggregations, e.groupBy);
 		if (!e.having) return t;
 		let r = V(e.having, n);
-		return t.filter((t) => At(e.having, t, r));
+		return t.filter((t) => Mt(e.having, t, r));
 	}
-	let o = Ot(a, e.order), s = e.skip ? o.slice(e.skip) : o, c = e.take === void 0 ? s : s.slice(0, e.take);
+	let o = At(a, e.order), s = e.skip ? o.slice(e.skip) : o, c = e.take === void 0 ? s : s.slice(0, e.take);
 	if (!e.projection) return c;
 	let l = e.projection;
 	return c.map((e) => {
@@ -453,7 +453,7 @@ var _t = class {
 		for (let n of l) t[n] = e[n];
 		return t;
 	});
-}, Mt = (e, t, n) => {
+}, Pt = (e, t, n) => {
 	let r = /* @__PURE__ */ new Map();
 	for (let t of e) {
 		let e = {};
@@ -471,11 +471,11 @@ var _t = class {
 	let i = [];
 	for (let e of r.values()) {
 		let n = { ...e.keyVals };
-		for (let r of t) n[r.alias] = Nt(r, e.rows);
+		for (let r of t) n[r.alias] = Ft(r, e.rows);
 		i.push(n);
 	}
 	return i;
-}, Nt = (e, t) => {
+}, Ft = (e, t) => {
 	switch (e.op) {
 		case "count": return e.column === void 0 ? t.length : t.reduce((t, n) => t + +(n[e.column] !== null && n[e.column] !== void 0), 0);
 		case "count-distinct": {
@@ -519,7 +519,7 @@ var _t = class {
 		}
 		default: throw Error(`computeAggregates: unknown op '${e.op}'`);
 	}
-}, Pt = "\0", Ft = (e, t) => e === null ? t : `${e}${Pt}${t}`, It = class e {
+}, It = "\0", Lt = (e, t) => e === null ? t : `${e}${It}${t}`, Rt = class e {
 	#e;
 	#t;
 	#n;
@@ -529,13 +529,13 @@ var _t = class {
 		return r.#e = t.tables, r.#t = t.emitter, r.#n = t.numericCounters, r;
 	}
 	constructor(e, t = null) {
-		if (this.#r = t, this.#e = /* @__PURE__ */ new Map(), this.#t = new he(), this.#n = /* @__PURE__ */ new Map(), e) for (let [n, r] of Object.entries(e)) {
+		if (this.#r = t, this.#e = /* @__PURE__ */ new Map(), this.#t = new _e(), this.#n = /* @__PURE__ */ new Map(), e) for (let [n, r] of Object.entries(e)) {
 			let e = /* @__PURE__ */ new Map();
 			for (let t of r) {
 				let n = t.id;
 				n && e.set(n, t);
 			}
-			this.#e.set(Ft(t, n), e);
+			this.#e.set(Lt(t, n), e);
 		}
 	}
 	withNamespace(t) {
@@ -546,11 +546,11 @@ var _t = class {
 		}, t);
 	}
 	#a(e) {
-		return Ft(this.#r, e);
+		return Lt(this.#r, e);
 	}
 	#o() {
-		let e = /* @__PURE__ */ new Map(), t = this.#r === null ? null : `${this.#r}${Pt}`;
-		for (let [n, r] of this.#e) t === null ? n.includes(Pt) || e.set(n, r) : n.startsWith(t) && e.set(n.slice(t.length), r);
+		let e = /* @__PURE__ */ new Map(), t = this.#r === null ? null : `${this.#r}${It}`;
+		for (let [n, r] of this.#e) t === null ? n.includes(It) || e.set(n, r) : n.startsWith(t) && e.set(n.slice(t.length), r);
 		return e;
 	}
 	#s(e) {
@@ -558,8 +558,8 @@ var _t = class {
 		return n || (n = /* @__PURE__ */ new Map(), this.#e.set(t, n)), n;
 	}
 	async query(e) {
-		let t = jt(e, this.#e.get(this.#a(e.table)) ?? /* @__PURE__ */ new Map(), this.#o());
-		return _(e) ? n(t, e.eager, ie(e.table), (e) => this.query(e)) : t;
+		let t = Nt(e, this.#e.get(this.#a(e.table)) ?? /* @__PURE__ */ new Map(), this.#o());
+		return _(e) ? n(t, e.eager, oe(e.table), (e) => this.query(e)) : t;
 	}
 	async insert(e, t) {
 		let n = t;
@@ -588,7 +588,7 @@ var _t = class {
 		if (!i) return null;
 		let a = i.get(t);
 		if (!a) return null;
-		let o = kt(a, n, r);
+		let o = jt(a, n, r);
 		return i.set(t, o), this.#t.emit("change", {
 			table: e,
 			op: "update",
@@ -688,7 +688,7 @@ var _t = class {
 		}
 	}
 	async transactional(e) {
-		let t = new Lt(this.#u());
+		let t = new zt(this.#u());
 		try {
 			let n = await e(t);
 			return t.commit(), n;
@@ -724,7 +724,7 @@ var _t = class {
 			allocateNumericId: (e) => this.#c(e)
 		};
 	}
-}, Lt = class {
+}, zt = class {
 	parent;
 	overlay = /* @__PURE__ */ new Map();
 	tombstones = /* @__PURE__ */ new Map();
@@ -754,8 +754,8 @@ var _t = class {
 		return t || (t = /* @__PURE__ */ new Map(), this.overlay.set(e, t)), t;
 	}
 	async query(e) {
-		let t = this.buildTablesView(e), r = jt(e, this.materialise(e.table), t);
-		return _(e) ? n(r, e.eager, ie(e.table), (e) => this.query(e)) : r;
+		let t = this.buildTablesView(e), r = Nt(e, this.materialise(e.table), t);
+		return _(e) ? n(r, e.eager, oe(e.table), (e) => this.query(e)) : r;
 	}
 	async insert(e, t) {
 		let n = t;
@@ -793,7 +793,7 @@ var _t = class {
 	async patchJson(e, t, n, r) {
 		let i = this.materialise(e).get(t);
 		if (!i) return null;
-		let a = kt(i, n, r);
+		let a = jt(i, n, r);
 		return this.getOrCreateOverlay(e).set(t, a), this.events.push({
 			table: e,
 			op: "update",
@@ -894,7 +894,7 @@ var _t = class {
 	discard() {
 		this.settled || (this.settled = !0, this.overlay.clear(), this.tombstones.clear(), this.events.length = 0);
 	}
-}, Rt = (e) => {
+}, Bt = (e) => {
 	let t = {}, n = [], r = e;
 	for (let e = 0; e < 8 && typeof r == "object" && r; e++) {
 		let e = r;
@@ -905,23 +905,23 @@ var _t = class {
 		(o || s) && n.push(`${o || "Error"}${s ? `: ${s.slice(0, 200)}` : ""}`), r = e.cause;
 	}
 	return n.length > 0 && (t.dbCauseChain = n.join(" ← "), t.dbMessage === void 0 && (t.dbMessage = n[n.length - 1])), t;
-}, zt = (e) => {
+}, Vt = (e) => {
 	let t = e.dbCode;
 	return t === "23503" || e.dbErrno === 1452 || t === 547 || t === "SQLITE_CONSTRAINT_FOREIGNKEY";
-}, Bt = (e) => ({
-	has: (t) => Ee(e, t),
-	hasAny: (t) => t.some((t) => Ee(e, t)),
-	require: (t) => ke(e, t),
+}, Ht = (e) => ({
+	has: (t) => Oe(e, t),
+	hasAny: (t) => t.some((t) => Oe(e, t)),
+	require: (t) => je(e, t),
 	get scopes() {
-		return Te(e);
+		return De(e);
 	}
-}), Vt = (e) => {
+}), Ut = (e) => {
 	let t = /* @__PURE__ */ new Set();
-	return Ht(e, t), t;
-}, Ht = (e, t) => {
-	if (t.add(e.table), e.eager !== void 0 && Ut(e.table, e.eager, t), e.setOp !== void 0) for (let n of e.setOp.queries) Ht(n, t);
-	if (e.ctes !== void 0) for (let n of e.ctes) Ht(n.descriptor, t);
-}, Ut = (e, t, n) => {
+	return Wt(e, t), t;
+}, Wt = (e, t) => {
+	if (t.add(e.table), e.eager !== void 0 && Gt(e.table, e.eager, t), e.setOp !== void 0) for (let n of e.setOp.queries) Wt(n, t);
+	if (e.ctes !== void 0) for (let n of e.ctes) Wt(n.descriptor, t);
+}, Gt = (e, t, n) => {
 	let r = p(e);
 	if (r !== void 0) for (let [e, i] of Object.entries(t)) {
 		let t = r[e];
@@ -929,24 +929,24 @@ var _t = class {
 		let a = i === !0 ? {} : i;
 		if (t.kind === "manyToMany") {
 			let e = t.through().tableName, r = t.target().tableName;
-			n.add(e), n.add(r), a.with !== void 0 && Ut(r, a.with, n);
+			n.add(e), n.add(r), a.with !== void 0 && Gt(r, a.with, n);
 		} else {
 			let e = t.target().tableName;
-			n.add(e), a.with !== void 0 && Ut(e, a.with, n);
+			n.add(e), a.with !== void 0 && Gt(e, a.with, n);
 		}
 	}
-}, Wt = (e) => e.setOp !== void 0 || e.ctes !== void 0 && e.ctes.length > 0 || e.aggregations !== void 0 && e.aggregations.some((e) => e.op.startsWith("window-")), Gt = /* @__PURE__ */ new Set(["*"]), H = (e, t) => {
+}, Kt = (e) => e.setOp !== void 0 || e.ctes !== void 0 && e.ctes.length > 0 || e.aggregations !== void 0 && e.aggregations.some((e) => e.op.startsWith("window-")), qt = /* @__PURE__ */ new Set(["*"]), Jt = (e, t) => {
 	if (e !== void 0) {
 		if ("not" in e) {
-			H(e.not, t);
+			Jt(e.not, t);
 			return;
 		}
 		if ("and" in e) {
-			for (let n of e.and) H(n, t);
+			for (let n of e.and) Jt(n, t);
 			return;
 		}
 		if ("or" in e) {
-			for (let n of e.or) H(n, t);
+			for (let n of e.or) Jt(n, t);
 			return;
 		}
 		if (e.op === "subquery-in" || e.op === "subquery-not-in") {
@@ -955,11 +955,11 @@ var _t = class {
 		}
 		e.op === "exists" || e.op === "not-exists" || t.add(e.column);
 	}
-}, U = (e, t, n) => {
+}, H = (e, t, n) => {
 	let r = e.get(t);
 	r === void 0 && (r = /* @__PURE__ */ new Set(), e.set(t, r));
 	for (let e of n) r.add(e);
-}, Kt = (e, t, n) => {
+}, Yt = (e, t, n) => {
 	let r = p(e);
 	if (r !== void 0) for (let [i, a] of Object.entries(t)) {
 		let t = r[i];
@@ -967,65 +967,65 @@ var _t = class {
 		let o = a === !0 ? {} : a;
 		if (t.kind === "manyToMany") {
 			let r = t.through(), i = t.target();
-			U(n, r.tableName, [t.sourceKey, t.targetKey]), U(n, e, ["id"]), U(n, i.tableName, ["id"]), qt(i.tableName, o, n), o.with !== void 0 && Kt(i.tableName, o.with, n);
+			H(n, r.tableName, [t.sourceKey, t.targetKey]), H(n, e, ["id"]), H(n, i.tableName, ["id"]), Xt(i.tableName, o, n), o.with !== void 0 && Yt(i.tableName, o.with, n);
 			continue;
 		}
 		let s = t.target();
-		t.foreignKey !== void 0 && U(n, s.tableName, [t.foreignKey]), t.sourceKey === void 0 ? U(n, e, ["id"]) : U(n, e, [t.sourceKey]), U(n, s.tableName, ["id"]), qt(s.tableName, o, n), o.with !== void 0 && Kt(s.tableName, o.with, n);
+		t.foreignKey !== void 0 && H(n, s.tableName, [t.foreignKey]), t.sourceKey === void 0 ? H(n, e, ["id"]) : H(n, e, [t.sourceKey]), H(n, s.tableName, ["id"]), Xt(s.tableName, o, n), o.with !== void 0 && Yt(s.tableName, o.with, n);
 	}
-}, qt = (e, t, n) => {
+}, Xt = (e, t, n) => {
 	if (t.where !== void 0) {
 		let r = /* @__PURE__ */ new Set();
-		H(t.where, r), U(n, e, r);
+		Jt(t.where, r), H(n, e, r);
 	}
-	t.orderBy !== void 0 && U(n, e, t.orderBy.map((e) => e.column));
+	t.orderBy !== void 0 && H(n, e, t.orderBy.map((e) => e.column));
 	let r = m(e);
-	r === void 0 ? U(n, e, ["*"]) : U(n, e, Object.keys(r.fields));
-}, Jt = (e) => {
+	r === void 0 ? H(n, e, ["*"]) : H(n, e, Object.keys(r.fields));
+}, Zt = (e) => {
 	let t = /* @__PURE__ */ new Map();
-	if (Wt(e)) {
-		for (let n of Vt(e)) U(t, n, ["*"]);
+	if (Kt(e)) {
+		for (let n of Ut(e)) H(t, n, ["*"]);
 		return t;
 	}
 	let n = /* @__PURE__ */ new Set();
 	if (e.projection !== void 0) for (let t of e.projection) n.add(t);
 	else n.add("*");
-	H(e.predicate, n);
+	Jt(e.predicate, n);
 	for (let t of e.order) n.add(t.column);
-	return U(t, e.table, n), e.eager !== void 0 && Kt(e.table, e.eager, t), t;
-}, Yt = (e) => {
-	if (e.op === "insert" || e.op === "delete" || e.old === null || e.new === null) return Gt;
+	return H(t, e.table, n), e.eager !== void 0 && Yt(e.table, e.eager, t), t;
+}, Qt = (e) => {
+	if (e.op === "insert" || e.op === "delete" || e.old === null || e.new === null) return qt;
 	let t = /* @__PURE__ */ new Set(), n = e.old, r = e.new, i = /* @__PURE__ */ new Set([...Object.keys(n), ...Object.keys(r)]);
 	for (let e of i) Object.is(n[e], r[e]) || t.add(e);
 	return t;
-}, Xt = (e, t) => {
+}, $t = (e, t) => {
 	let n = t.get(e.table);
 	if (n === void 0) return !1;
 	if (n.has("*")) return !0;
-	let r = Yt(e);
+	let r = Qt(e);
 	if (r.has("*")) return !0;
 	for (let e of r) if (n.has(e)) return !0;
 	return !1;
-}, W = Be.exponential({
+}, en = He.exponential({
 	start: .001,
 	factor: 2,
 	count: 16
-}), Zt = N.counter("voltro_rpc_requests_total", { description: "Total RPC handler invocations." }), Qt = N.counter("voltro_rpc_errors_total", { description: "RPC handler invocations that errored." }), $t = N.histogram("voltro_rpc_duration_seconds", W, "RPC handler duration in seconds."), en = N.counter("voltro_http_requests_total", { description: "Total HTTP route invocations." }), tn = N.histogram("voltro_http_duration_seconds", W, "HTTP route duration in seconds."), nn = N.histogram("voltro_plugin_hook_duration_seconds", W, "Plugin interceptor duration in seconds."), rn = N.counter("voltro_plugin_hook_errors_total", { description: "Plugin interceptor invocations that errored." }), an = N.counter("voltro_subscription_deliveries_total", { description: "Total subscription deliveries (snapshot + delta)." }), on = N.histogram("voltro_subscription_delivery_seconds", W, "Subscription delivery produce→push latency in seconds."), sn = N.gauge("voltro_subscriptions_active", { description: "Currently-open subscriptions." }), cn = (e) => {
-	let t = e.durationMs / 1e3, n = e.kind === "rpc" ? j.zipRight(N.increment(Zt).pipe(j.tagMetrics("tag", e.tag), j.tagMetrics("status", e.status)), j.zipRight(N.update($t, t).pipe(j.tagMetrics("tag", e.tag)), e.status === "error" ? N.increment(Qt).pipe(j.tagMetrics("tag", e.tag)) : j.void)) : e.kind === "request" ? j.zipRight(N.increment(en).pipe(j.tagMetrics("route", e.tag), j.tagMetrics("status", e.status)), N.update(tn, t).pipe(j.tagMetrics("route", e.tag))) : j.zipRight(N.update(nn, t).pipe(j.tagMetrics("hook", e.tag)), e.status === "error" ? N.increment(rn).pipe(j.tagMetrics("hook", e.tag)) : j.void);
+}), tn = N.counter("voltro_rpc_requests_total", { description: "Total RPC handler invocations." }), nn = N.counter("voltro_rpc_errors_total", { description: "RPC handler invocations that errored." }), rn = N.histogram("voltro_rpc_duration_seconds", en, "RPC handler duration in seconds."), an = N.counter("voltro_http_requests_total", { description: "Total HTTP route invocations." }), on = N.histogram("voltro_http_duration_seconds", en, "HTTP route duration in seconds."), sn = N.histogram("voltro_plugin_hook_duration_seconds", en, "Plugin interceptor duration in seconds."), cn = N.counter("voltro_plugin_hook_errors_total", { description: "Plugin interceptor invocations that errored." }), ln = N.counter("voltro_subscription_deliveries_total", { description: "Total subscription deliveries (snapshot + delta)." }), un = N.histogram("voltro_subscription_delivery_seconds", en, "Subscription delivery produce→push latency in seconds."), dn = N.gauge("voltro_subscriptions_active", { description: "Currently-open subscriptions." }), fn = (e) => {
+	let t = e.durationMs / 1e3, n = e.kind === "rpc" ? j.zipRight(N.increment(tn).pipe(j.tagMetrics("tag", e.tag), j.tagMetrics("status", e.status)), j.zipRight(N.update(rn, t).pipe(j.tagMetrics("tag", e.tag)), e.status === "error" ? N.increment(nn).pipe(j.tagMetrics("tag", e.tag)) : j.void)) : e.kind === "request" ? j.zipRight(N.increment(an).pipe(j.tagMetrics("route", e.tag), j.tagMetrics("status", e.status)), N.update(on, t).pipe(j.tagMetrics("route", e.tag))) : j.zipRight(N.update(sn, t).pipe(j.tagMetrics("hook", e.tag)), e.status === "error" ? N.increment(cn).pipe(j.tagMetrics("hook", e.tag)) : j.void);
 	j.runSync(n);
-}, ln = (e) => e.startsWith("subscription.") ? e.slice(13) : e, un = (e) => {
-	let t = ln(e.label);
-	j.runSync(j.zipRight(N.increment(an).pipe(j.tagMetrics("tag", t), j.tagMetrics("kind", e.kind)), N.update(on, e.durationMs / 1e3).pipe(j.tagMetrics("tag", t), j.tagMetrics("kind", e.kind))));
-}, dn = /* @__PURE__ */ new Map(), fn = (e, t) => {
-	let n = ln(e), r = Math.max(0, (dn.get(n) ?? 0) + t);
-	r === 0 ? dn.delete(n) : dn.set(n, r), j.runSync(N.set(sn, r).pipe(j.tagMetrics("tag", n)));
-}, pn = (e, t) => N.counter(e, t === void 0 ? {} : { description: t }), mn = (e, t) => N.gauge(e, t === void 0 ? {} : { description: t }), hn = (e, t = W, n) => N.histogram(e, t, n), gn = (e) => {
+}, pn = (e) => e.startsWith("subscription.") ? e.slice(13) : e, mn = (e) => {
+	let t = pn(e.label);
+	j.runSync(j.zipRight(N.increment(ln).pipe(j.tagMetrics("tag", t), j.tagMetrics("kind", e.kind)), N.update(un, e.durationMs / 1e3).pipe(j.tagMetrics("tag", t), j.tagMetrics("kind", e.kind))));
+}, hn = /* @__PURE__ */ new Map(), U = (e, t) => {
+	let n = pn(e), r = Math.max(0, (hn.get(n) ?? 0) + t);
+	r === 0 ? hn.delete(n) : hn.set(n, r), j.runSync(N.set(dn, r).pipe(j.tagMetrics("tag", n)));
+}, gn = (e, t) => N.counter(e, t === void 0 ? {} : { description: t }), _n = (e, t) => N.gauge(e, t === void 0 ? {} : { description: t }), vn = (e, t = en, n) => N.histogram(e, t, n), yn = (e) => {
 	let t = {};
 	for (let n of e) t[n.key] = n.value;
 	return t;
-}, _n = N.snapshot.pipe(j.map((e) => e.map((e) => {
-	let t = e.metricKey.name, n = gn(e.metricKey.tags), r = P.getOrUndefined(e.metricKey.description), i = r === void 0 ? {} : { description: r }, a = e.metricState;
-	if (Ve.isHistogramState(a)) return {
+}, bn = N.snapshot.pipe(j.map((e) => e.map((e) => {
+	let t = e.metricKey.name, n = yn(e.metricKey.tags), r = P.getOrUndefined(e.metricKey.description), i = r === void 0 ? {} : { description: r }, a = e.metricState;
+	if (Ue.isHistogramState(a)) return {
 		name: t,
 		labels: n,
 		...i,
@@ -1037,14 +1037,14 @@ var _t = class {
 		sum: a.sum,
 		count: a.count
 	};
-	if (Ve.isGaugeState(a)) return {
+	if (Ue.isGaugeState(a)) return {
 		name: t,
 		labels: n,
 		...i,
 		type: "gauge",
 		value: Number(a.value)
 	};
-	if (Ve.isSummaryState(a)) return {
+	if (Ue.isSummaryState(a)) return {
 		name: t,
 		labels: n,
 		...i,
@@ -1056,7 +1056,7 @@ var _t = class {
 			value: t.value
 		}] : [])
 	};
-	if (Ve.isFrequencyState(a)) {
+	if (Ue.isFrequencyState(a)) {
 		let e = {};
 		for (let [t, n] of a.occurrences) e[t] = n;
 		return {
@@ -1074,7 +1074,7 @@ var _t = class {
 		type: "counter",
 		value: Number(a.count)
 	};
-}))), vn = () => j.runSync(_n), G = Me({ scope: "voltro:dispatcher" }), yn = class {
+}))), xn = () => j.runSync(bn), W = O({ scope: "voltro:dispatcher" }), Sn = (e) => typeof e == "object" && !!e && e._tag === "ScopeError", Cn = class {
 	deps;
 	subscriptionRegistry;
 	matcher;
@@ -1084,63 +1084,95 @@ var _t = class {
 	computedSubs = /* @__PURE__ */ new Map();
 	computedByTable = /* @__PURE__ */ new Map();
 	constructor(e) {
-		this.deps = e, this.matcher = new wt(), this.subscriptionRegistry = new Dt(this.matcher), this.unsubscribeChange = e.store.onChange((e) => {
+		this.deps = e, this.matcher = new Et(), this.subscriptionRegistry = new kt(this.matcher), this.unsubscribeChange = e.store.onChange((e) => {
 			this.handleChange(e);
 		});
 	}
-	async subscribe(e, t, n, r, i, a) {
-		let o = `sub_${pe()}`, s = i ?? `subscription.${e.table}`, c = Vt(e), l = Jt(e);
-		e.predicate !== void 0 && this.subscriptionRegistry.subscribe(o, e.table, e.predicate, r);
-		for (let e of c) {
+	async subscribe(e, t, n, r, i, a, o) {
+		let s = `sub_${he()}`, c = i ?? `subscription.${e.table}`, l = Ut(e), u = Zt(e);
+		e.predicate !== void 0 && this.subscriptionRegistry.subscribe(s, e.table, e.predicate, r);
+		for (let e of l) {
 			let t = this.dependentByTable.get(e);
-			t === void 0 && (t = /* @__PURE__ */ new Set(), this.dependentByTable.set(e, t)), t.add(o);
+			t === void 0 && (t = /* @__PURE__ */ new Set(), this.dependentByTable.set(e, t)), t.add(s);
 		}
-		let u = Date.now(), d = Array.from(c), f = this.deps.cache !== void 0 && a !== void 0 ? await this.deps.cache.wrap(a, d, () => this.deps.store.query(e)) : await this.deps.store.query(e);
-		this.subscriptions.set(o, {
-			id: o,
+		let d = Date.now(), f = Array.from(l), p = this.deps.cache !== void 0 && a !== void 0 ? await this.deps.cache.wrap(a, f, () => this.deps.store.query(e)) : await this.deps.store.query(e);
+		this.subscriptions.set(s, {
+			id: s,
 			descriptor: e,
 			context: n,
 			emit: t,
-			label: s,
-			dependentTables: c,
-			relevantFields: l,
-			lastDelivered: f,
-			cacheBinding: a
-		}), fn(s, 1), t({
+			label: c,
+			dependentTables: l,
+			relevantFields: u,
+			lastDelivered: p,
+			cacheBinding: a,
+			reauthorize: o
+		}), U(c, 1), t({
 			_tag: "snapshot",
 			revision: 0,
-			data: f
+			data: p
 		});
-		let p = Date.now();
+		let m = Date.now();
 		return this.deps.recordDelivery?.({
 			traceId: n.traceId,
 			parentSpanId: n.spanId,
-			label: s,
+			label: c,
 			kind: "snapshot",
-			startMs: u,
-			endMs: p,
-			durationMs: p - u,
-			rowCount: f.length
+			startMs: d,
+			endMs: m,
+			durationMs: m - d,
+			rowCount: p.length
 		}), () => {
-			this.subscriptions.delete(o), fn(s, -1), this.subscriptionRegistry.unsubscribe(o);
-			for (let e of c) {
+			this.subscriptions.delete(s), U(c, -1), this.subscriptionRegistry.unsubscribe(s);
+			for (let e of l) {
 				let t = this.dependentByTable.get(e);
-				t !== void 0 && (t.delete(o), t.size === 0 && this.dependentByTable.delete(e));
+				t !== void 0 && (t.delete(s), t.size === 0 && this.dependentByTable.delete(e));
 			}
 		};
 	}
+	revokeSubscription(e, t) {
+		this.subscriptions.delete(e.id), U(e.label, -1), this.subscriptionRegistry.unsubscribe(e.id);
+		for (let t of e.dependentTables) {
+			let n = this.dependentByTable.get(t);
+			n !== void 0 && (n.delete(e.id), n.size === 0 && this.dependentByTable.delete(t));
+		}
+		W.warn("subscription revoked mid-stream — guards no longer satisfied", {
+			id: e.id,
+			label: e.label,
+			traceId: e.context.traceId
+		}), e.emit({
+			_tag: "error",
+			error: t
+		});
+	}
+	revokeComputed(e, t) {
+		this.computedSubs.delete(e.id), U(e.label, -1);
+		for (let t of e.tables) {
+			let n = this.computedByTable.get(t);
+			n !== void 0 && (n.delete(e.id), n.size === 0 && this.computedByTable.delete(t));
+		}
+		W.warn("computed subscription revoked mid-stream — guards no longer satisfied", {
+			id: e.id,
+			label: e.label,
+			traceId: e.context.traceId
+		}), e.emit({
+			_tag: "error",
+			error: t
+		});
+	}
 	async subscribeComputed(e, t, n, r) {
-		let i = `csub_${pe()}`, a = e.dependentTables, o = {
+		let i = `csub_${he()}`, a = e.dependentTables, o = {
 			id: i,
 			recompute: e.recompute,
 			tenantId: e.tenantId,
 			emit: t,
 			context: n,
 			label: r ?? "subscription.computed",
-			lastJson: bn(e.value),
+			tables: a,
+			lastJson: wn(e.value),
 			revision: 0
 		};
-		this.computedSubs.set(i, o), fn(o.label, 1);
+		this.computedSubs.set(i, o), U(o.label, 1);
 		for (let e of a) {
 			let t = this.computedByTable.get(e);
 			t === void 0 && (t = /* @__PURE__ */ new Set(), this.computedByTable.set(e, t)), t.add(i);
@@ -1160,7 +1192,7 @@ var _t = class {
 			durationMs: Date.now() - s,
 			rowCount: 1
 		}), () => {
-			this.computedSubs.delete(i), fn(o.label, -1);
+			this.computedSubs.delete(i), U(o.label, -1);
 			for (let e of a) {
 				let t = this.computedByTable.get(e);
 				t !== void 0 && (t.delete(i), t.size === 0 && this.computedByTable.delete(e));
@@ -1170,7 +1202,7 @@ var _t = class {
 	async recomputeComputed(e) {
 		let t = Date.now();
 		try {
-			let n = await e.recompute(), r = bn(n);
+			let n = await e.recompute(), r = wn(n);
 			if (r === e.lastJson) return;
 			e.lastJson = r, e.revision += 1;
 			let i = Date.now();
@@ -1189,7 +1221,11 @@ var _t = class {
 				rowCount: 1
 			});
 		} catch (t) {
-			G.warn("computed recompute failed; subscriber left on last value", {
+			if (Sn(t)) {
+				this.revokeComputed(e, t);
+				return;
+			}
+			W.warn("computed recompute failed; subscriber left on last value", {
 				id: e.id,
 				label: e.label,
 				traceId: e.context.traceId
@@ -1224,7 +1260,7 @@ var _t = class {
 		for (let e of n) r.add(e.subscriberId);
 		let i = this.dependentByTable.get(e.table);
 		if (i !== void 0) for (let e of i) r.add(e);
-		if (G.trace("handleChange", {
+		if (W.trace("handleChange", {
 			table: e.table,
 			op: e.op,
 			matcher: n.length,
@@ -1235,28 +1271,35 @@ var _t = class {
 		for (let t of r) {
 			let n = this.subscriptions.get(t);
 			if (!n) {
-				G.trace("missing subscription", { subscriberId: t });
+				W.trace("missing subscription", { subscriberId: t });
 				continue;
 			}
-			if (!Xt(e, n.relevantFields)) {
+			if (!$t(e, n.relevantFields)) {
 				o++;
 				continue;
 			}
 			let r = Date.now();
 			try {
+				if (n.reauthorize !== void 0) {
+					let e = await n.reauthorize();
+					if (e) {
+						this.revokeSubscription(n, e);
+						continue;
+					}
+				}
 				let i = await this.deps.store.query(n.descriptor), o = n.lastDelivered;
-				if (xn(i, o)) {
-					G.trace("suppressed no-op delta", {
+				if (Tn(i, o)) {
+					W.trace("suppressed no-op delta", {
 						subscriberId: t,
 						table: e.table
 					});
 					continue;
 				}
-				n.lastDelivered = i, this.deps.cache !== void 0 && n.cacheBinding !== void 0 && this.deps.cache.put(n.cacheBinding, Array.from(n.dependentTables), i), De(o) && De(i) ? n.emit({
+				n.lastDelivered = i, this.deps.cache !== void 0 && n.cacheBinding !== void 0 && this.deps.cache.put(n.cacheBinding, Array.from(n.dependentTables), i), ke(o) && ke(i) ? n.emit({
 					_tag: "delta",
 					revision: a,
 					emittedAt: a,
-					patch: we(o, i)
+					patch: Ee(o, i)
 				}) : n.emit({
 					_tag: "snapshot",
 					revision: a,
@@ -1274,7 +1317,7 @@ var _t = class {
 					rowCount: i.length
 				});
 			} catch (r) {
-				G.warn("reactive re-query failed; subscriber left on last snapshot", {
+				W.warn("reactive re-query failed; subscriber left on last snapshot", {
 					subscriberId: t,
 					label: n.label,
 					table: e.table,
@@ -1282,66 +1325,66 @@ var _t = class {
 				}, r);
 			}
 		}
-		o > 0 && G.trace("handleChange/prefiltered", {
+		o > 0 && W.trace("handleChange/prefiltered", {
 			table: e.table,
 			op: e.op,
 			skipped: o
 		});
 	}
-}, bn = (e) => {
+}, wn = (e) => {
 	try {
 		return JSON.stringify(e) ?? "null";
 	} catch {
 		return String(e);
 	}
-}, xn = (e, t) => {
+}, Tn = (e, t) => {
 	if (e === t) return !0;
 	if (e.length !== t.length) return !1;
 	for (let n = 0; n < e.length; n++) if (JSON.stringify(e[n]) !== JSON.stringify(t[n])) return !1;
 	return !0;
-}, Sn = (e) => typeof e == "object" && !!e && e.__voltroComputed === !0, Cn = 1440 * 60 * 1e3, wn = 3600 * 1e3, K = /* @__PURE__ */ new Map(), Tn = /* @__PURE__ */ new Set(), En = (e, t) => {
-	K.set(e, {
+}, En = (e) => typeof e == "object" && !!e && e.__voltroComputed === !0, Dn = 1440 * 60 * 1e3, On = 3600 * 1e3, G = /* @__PURE__ */ new Map(), kn = /* @__PURE__ */ new Set(), An = (e, t) => {
+	G.set(e, {
 		subject: t,
 		touchedAt: Date.now()
 	});
-	for (let n of Tn) try {
+	for (let n of kn) try {
 		n(e, t);
 	} catch {}
-}, Dn = (e) => {
-	let t = K.get(e);
+}, jn = (e) => {
+	let t = G.get(e);
 	if (t) return t.touchedAt = Date.now(), t.subject;
-}, On = (e) => {
-	K.delete(e);
-}, kn = (e) => (Tn.add(e), () => {
-	Tn.delete(e);
-}), An = setInterval(() => {
-	let e = Date.now() - Cn;
-	for (let [t, n] of K) n.touchedAt < e && K.delete(t);
-}, wn);
-typeof An == "object" && An && "unref" in An && An.unref();
-var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
-	let n = q.get(e);
-	return n || (n = /* @__PURE__ */ new Set(), q.set(e, n)), n.add(t), () => {
-		let n = q.get(e);
-		n && (n.delete(t), n.size === 0 && q.delete(e));
-	};
 }, Mn = (e) => {
-	let t = q.get(e);
+	G.delete(e);
+}, Nn = (e) => (kn.add(e), () => {
+	kn.delete(e);
+}), Pn = setInterval(() => {
+	let e = Date.now() - Dn;
+	for (let [t, n] of G) n.touchedAt < e && G.delete(t);
+}, On);
+typeof Pn == "object" && Pn && "unref" in Pn && Pn.unref();
+var K = /* @__PURE__ */ new Map(), Fn = (e, t) => {
+	let n = K.get(e);
+	return n || (n = /* @__PURE__ */ new Set(), K.set(e, n)), n.add(t), () => {
+		let n = K.get(e);
+		n && (n.delete(t), n.size === 0 && K.delete(e));
+	};
+}, In = (e) => {
+	let t = K.get(e);
 	if (t) {
 		for (let e of [...t]) try {
 			e();
 		} catch {}
-		q.delete(e);
+		K.delete(e);
 	}
-}, Nn = (e) => q.get(e)?.size ?? 0, Pn = () => {
-	K.clear(), q.clear();
-}, Fn = () => [...K.entries()].map(([e, t]) => ({
+}, Ln = (e) => K.get(e)?.size ?? 0, Rn = () => {
+	G.clear(), K.clear();
+}, zn = () => [...G.entries()].map(([e, t]) => ({
 	clientId: e,
 	subjectType: t.subject.type,
 	tenantId: t.subject.tenantId
-})), In = /^00-([0-9a-f]{32})-([0-9a-f]{16})-([0-9a-f]{2})$/, Ln = (e) => `00-${e.traceId}-${e.spanId}-${e.sampled ? "01" : "00"}`, Rn = (e) => {
+})), Bn = /^00-([0-9a-f]{32})-([0-9a-f]{16})-([0-9a-f]{2})$/, Vn = (e) => `00-${e.traceId}-${e.spanId}-${e.sampled ? "01" : "00"}`, Hn = (e) => {
 	if (typeof e != "string") return null;
-	let t = In.exec(e.trim().toLowerCase());
+	let t = Bn.exec(e.trim().toLowerCase());
 	if (t === null) return null;
 	let [, n, r, i] = t;
 	return n === "0".repeat(32) || r === "0".repeat(16) ? null : {
@@ -1349,14 +1392,14 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		spanId: r,
 		sampled: (parseInt(i, 16) & 1) == 1
 	};
-}, zn = (e) => {
-	let t = Rn(e);
-	if (t !== null) return He.externalSpan({
+}, Un = (e) => {
+	let t = Hn(e);
+	if (t !== null) return We.externalSpan({
 		traceId: t.traceId,
 		spanId: t.spanId,
 		sampled: t.sampled
 	});
-}, Bn = new rt(), Vn = (e, t) => Bn.run(e, t), Hn = () => Bn.getStore(), Un = (e = {}) => {
+}, Wn = new at(), Gn = (e, t) => Wn.run(e, t), Kn = () => Wn.getStore(), qn = (e = {}) => {
 	let t = e.random ?? Math.random, n = /* @__PURE__ */ new Map(), r = (e) => n.get(e) ?? 0;
 	return {
 		pick(e) {
@@ -1381,7 +1424,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 			}));
 		}
 	};
-}, Wn = (e = {}) => {
+}, Jn = (e = {}) => {
 	let t = e.thresholdFailures ?? 3, n = e.windowMs ?? 1e4, r = e.blackoutMs ?? 6e4, i = e.now ?? Date.now, a = /* @__PURE__ */ new Map(), o = (e) => {
 		let t = a.get(e);
 		return t === void 0 && (t = {
@@ -1415,7 +1458,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 			}));
 		}
 	};
-}, Gn = (e = {}) => {
+}, Yn = (e = {}) => {
 	let t = e.now ?? Date.now, n = /* @__PURE__ */ new Map();
 	return {
 		get(e) {
@@ -1438,7 +1481,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 			return n.size;
 		}
 	};
-}, Kn = (e, t) => e === null ? t === void 0 ? "anon:bg" : `anon:${t}` : `subject:${e}`, qn = (e) => {
+}, Xn = (e, t) => e === null ? t === void 0 ? "anon:bg" : `anon:${t}` : `subject:${e}`, Zn = (e) => {
 	let t = e.now ?? Date.now, n = e.keyPrefix ?? "voltro:ryw", r = e.channel ?? `${n}:bus`, i = e.onError ?? ((e, t) => {
 		process.stderr.write(`[voltro:ryw] redis ${t} failed: ${String(e)}\n`);
 	}), a = `${process.pid ?? 0}:${Math.random() * 1e9 | 0}:${t()}`, o = /* @__PURE__ */ new Map(), s = (e) => {
@@ -1497,7 +1540,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 			return o.size;
 		}
 	};
-}, Jn = Me({ scope: "voltro:replication" }), Yn = new rt(), Xn = (e, t) => Yn.run(e, t), Zn = () => Yn.getStore(), Qn = class {
+}, Qn = O({ scope: "voltro:replication" }), $n = new at(), er = (e, t) => $n.run(e, t), tr = () => $n.getStore(), nr = class {
 	primary;
 	replicas;
 	adapter;
@@ -1510,10 +1553,10 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 	recordRouting;
 	now;
 	constructor(e) {
-		this.primary = e.primary, this.replicas = e.replicas, this.adapter = e.replicationAdapter, this.policy = e.rywPolicy ?? "fallback", this.rywTtlMs = e.rywTtlMs ?? 3e4, this.rywMaxWaitMs = e.rywMaxWaitMs ?? 500, this.now = e.now ?? Date.now, this.rywStore = e.rywStore ?? Gn({ now: this.now }), this.selector = e.replicaSelector ?? Un(), this.health = e.replicaHealth ?? Wn({ now: this.now }), e.recordRouting !== void 0 && (this.recordRouting = e.recordRouting);
+		this.primary = e.primary, this.replicas = e.replicas, this.adapter = e.replicationAdapter, this.policy = e.rywPolicy ?? "fallback", this.rywTtlMs = e.rywTtlMs ?? 3e4, this.rywMaxWaitMs = e.rywMaxWaitMs ?? 500, this.now = e.now ?? Date.now, this.rywStore = e.rywStore ?? Yn({ now: this.now }), this.selector = e.replicaSelector ?? qn(), this.health = e.replicaHealth ?? Jn({ now: this.now }), e.recordRouting !== void 0 && (this.recordRouting = e.recordRouting);
 	}
 	async query(e) {
-		let t = Yn.getStore(), n = t?.subjectKey ?? "anon:bg";
+		let t = $n.getStore(), n = t?.subjectKey ?? "anon:bg";
 		if (t?.forcePrimary === !0) return this.emitRouting({
 			target: "primary",
 			replicaIndex: null,
@@ -1577,7 +1620,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 				waitMs: 0
 			}), r;
 		} catch (r) {
-			return this.health.reportFailure(i, String(r)), Jn.warn("replica query failed; falling back to primary", {
+			return this.health.reportFailure(i, String(r)), Qn.warn("replica query failed; falling back to primary", {
 				idx: a,
 				err: r
 			}), this.emitRouting({
@@ -1646,7 +1689,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 					fallbackReason: "wait-timeout"
 				}), this.primary.query(e);
 			}
-			await $n(10);
+			await rr(10);
 		}
 	}
 	async insert(e, t) {
@@ -1686,8 +1729,8 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		return await this.stampPostWrite(), r;
 	}
 	async transactional(e) {
-		let t = await Xn({
-			subjectKey: Yn.getStore()?.subjectKey ?? "anon:bg",
+		let t = await er({
+			subjectKey: $n.getStore()?.subjectKey ?? "anon:bg",
 			forcePrimary: !0
 		}, () => this.primary.transactional(e));
 		return await this.stampPostWrite(), t;
@@ -1703,7 +1746,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 	}
 	async stampPostWrite() {
 		if (this.replicas.length === 0) return;
-		let e = Yn.getStore()?.subjectKey ?? "anon:bg";
+		let e = $n.getStore()?.subjectKey ?? "anon:bg";
 		try {
 			let t = await this.adapter.capturePrimaryPosition(this.primary);
 			this.rywStore.set(e, {
@@ -1711,59 +1754,59 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 				expiresAt: this.now() + this.rywTtlMs
 			});
 		} catch (e) {
-			Jn.warn("failed to capture primary position; RYW skipped", { err: e });
+			Qn.warn("failed to capture primary position; RYW skipped", { err: e });
 		}
 	}
 	emitRouting(e) {
 		this.recordRouting?.(e);
 	}
-}, $n = (e) => new Promise((t) => setTimeout(t, e)), er = (e, t, n) => ({
+}, rr = (e) => new Promise((t) => setTimeout(t, e)), ir = (e, t, n) => ({
 	subject: e,
-	traceId: t?.traceId ?? pe(),
+	traceId: t?.traceId ?? he(),
 	...t?.spanId === void 0 ? {} : { spanId: t.spanId },
 	...n === void 0 ? {} : { clientId: n }
-}), tr = j.currentSpan.pipe(j.catchAll(() => j.succeed(void 0))), nr = (e) => ({
+}), ar = j.currentSpan.pipe(j.catchAll(() => j.succeed(void 0))), or = (e) => ({
 	traceId: e.traceId,
 	...e.spanId === void 0 ? {} : { spanId: e.spanId }
-}), rr = (e, t, n) => {
+}), sr = (e, t, n) => {
 	e !== void 0 && (e.attribute("rpc.tag", t), e.attribute("subject.type", n.type), n.tenantId !== void 0 && n.tenantId !== null && e.attribute("tenant.id", n.tenantId));
-}, ir = (e, t, n, r, i, a) => L.asyncScoped((o) => j.gen(function* () {
-	let s = yield* j.tryPromise(() => t.subscribe(e, (e) => {
-		o.single(e);
-	}, n, r, i, a)).pipe(j.matchCause({
-		onFailure: (e) => (ur(`subscription.${i}`, n.traceId, e), {
+}, cr = (e, t, n, r, i, a, o) => L.asyncScoped((s) => j.gen(function* () {
+	let c = yield* j.tryPromise(() => t.subscribe(e, (e) => {
+		s.single(e);
+	}, n, r, i, a, o)).pipe(j.matchCause({
+		onFailure: (e) => (mr(`subscription.${i}`, n.traceId, e), {
 			ok: !1,
-			error: mr(e)
+			error: vr(e)
 		}),
 		onSuccess: (e) => ({
 			ok: !0,
 			unsubscribe: e
 		})
 	}));
-	if (!s.ok) {
-		o.single({
+	if (!c.ok) {
+		s.single({
 			_tag: "error",
-			error: s.error
-		}), o.end();
+			error: c.error
+		}), s.end();
 		return;
 	}
-	let c = s.unsubscribe;
-	if (yield* j.addFinalizer(() => j.sync(() => c())), n.clientId !== void 0) {
-		let e = jn(n.clientId, () => {
-			o.end();
+	let l = c.unsubscribe;
+	if (yield* j.addFinalizer(() => j.sync(() => l())), n.clientId !== void 0) {
+		let e = Fn(n.clientId, () => {
+			s.end();
 		});
 		yield* j.addFinalizer(() => j.sync(() => e()));
 	}
-})), ar = (e, t, n, r) => L.asyncScoped((i) => j.gen(function* () {
+})), lr = (e, t, n, r) => L.asyncScoped((i) => j.gen(function* () {
 	let a = yield* j.tryPromise(() => t.subscribeComputed(e, (e) => {
 		i.single(e._tag === "snapshot" ? {
 			...e,
 			computed: !0
 		} : e);
 	}, n, r)).pipe(j.matchCause({
-		onFailure: (e) => (ur(`subscription.${r}`, n.traceId, e), {
+		onFailure: (e) => (mr(`subscription.${r}`, n.traceId, e), {
 			ok: !1,
-			error: mr(e)
+			error: vr(e)
 		}),
 		onSuccess: (e) => ({
 			ok: !0,
@@ -1779,21 +1822,21 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 	}
 	let o = a.unsubscribe;
 	if (yield* j.addFinalizer(() => j.sync(() => o())), n.clientId !== void 0) {
-		let e = jn(n.clientId, () => {
+		let e = Fn(n.clientId, () => {
 			i.end();
 		});
 		yield* j.addFinalizer(() => j.sync(() => e()));
 	}
-})), or = (e, t, n = "rpc.subscription", r, i) => L.unwrap(j.gen(function* () {
-	let a = yield* ve, o = yield* _e, s = yield* tr;
-	rr(s, n, a);
-	let c = er(a, s, o.clientId), l = Kn(a.id, o.clientId), u = Xn({ subjectKey: l }, () => Vn({
-		traceId: c.traceId,
-		...c.spanId === void 0 ? {} : { spanId: c.spanId }
-	}, () => e(c))), d = j.isEffect(u) ? yield* u.pipe(j.matchCause({
-		onFailure: (e) => (ur(`subscription.${n}`, c.traceId, e), {
+})), ur = (e, t, n = "rpc.subscription", r, i, a) => L.unwrap(j.gen(function* () {
+	let o = yield* be, s = yield* ye, c = yield* ar;
+	sr(c, n, o);
+	let l = ir(o, c, s.clientId), u = Xn(o.id, s.clientId), d = er({ subjectKey: u }, () => Gn({
+		traceId: l.traceId,
+		...l.spanId === void 0 ? {} : { spanId: l.spanId }
+	}, () => e(l))), f = j.isEffect(d) ? yield* d.pipe(j.matchCause({
+		onFailure: (e) => (mr(`subscription.${n}`, l.traceId, e), {
 			ok: !1,
-			error: mr(e)
+			error: vr(e)
 		}),
 		onSuccess: (e) => ({
 			ok: !0,
@@ -1801,45 +1844,45 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		})
 	})) : {
 		ok: !0,
-		value: u
+		value: d
 	};
-	if (!d.ok) return L.make({
+	if (!f.ok) return L.make({
 		_tag: "error",
-		error: d.error
+		error: f.error
 	});
-	let f = d.value;
-	if (Sn(f)) return ar(f, t, c, n);
-	let p = f, m = r?.(p);
-	return ir(p, t, c, m, n, i === void 0 ? void 0 : {
-		key: i.scope === "subject" ? `${i.baseKey}:s:${l}` : `${i.baseKey}:global`,
+	let p = f.value;
+	if (En(p)) return lr(p, t, l, n);
+	let m = p, h = r?.(m);
+	return cr(m, t, l, h, n, i === void 0 ? void 0 : {
+		key: i.scope === "subject" ? `${i.baseKey}:s:${u}` : `${i.baseKey}:global`,
 		ttlMs: i.ttlMs,
 		swrMs: i.swrMs
-	});
-}).pipe(j.withSpan(n, { attributes: { "framework.kind": "subscription" } }))), sr = (e, t = "rpc.stream") => L.unwrap(j.gen(function* () {
-	let n = yield* ve, r = yield* _e, i = yield* tr;
-	rr(i, t, n);
-	let a = er(n, i, r.clientId), o = e(a), s = j.isEffect(o) ? yield* o.pipe(j.orDie) : o;
+	}, a?.(o));
+}).pipe(j.withSpan(n, { attributes: { "framework.kind": "subscription" } }))), dr = (e, t = "rpc.stream") => L.unwrap(j.gen(function* () {
+	let n = yield* be, r = yield* ye, i = yield* ar;
+	sr(i, t, n);
+	let a = ir(n, i, r.clientId), o = e(a), s = j.isEffect(o) ? yield* o.pipe(j.orDie) : o;
 	if (a.clientId === void 0) return s;
 	let c = a.clientId;
 	return L.unwrapScoped(j.gen(function* () {
-		let e = yield* Fe.make(), t = jn(c, () => {
-			Fe.unsafeDone(e, j.void);
+		let e = yield* Le.make(), t = Fn(c, () => {
+			Le.unsafeDone(e, j.void);
 		});
-		return yield* j.addFinalizer(() => j.sync(() => t())), s.pipe(L.interruptWhen(Fe.await(e)));
+		return yield* j.addFinalizer(() => j.sync(() => t())), s.pipe(L.interruptWhen(Le.await(e)));
 	}));
-}).pipe(j.withSpan(t, { attributes: { "framework.kind": "stream" } }))), cr = Me({ scope: "voltro:rpc" }), lr = Me({ scope: "voltro:http" }), ur = (e, t, n) => {
+}).pipe(j.withSpan(t, { attributes: { "framework.kind": "stream" } }))), fr = O({ scope: "voltro:rpc" }), pr = O({ scope: "voltro:http" }), mr = (e, t, n) => {
 	if (k.isInterruptedOnly(n)) return;
-	let r = k.squash(n), i = r?._tag, a = r instanceof Error ? r.message : r?.message ?? String(r), o = k.dieOption(n)._tag === "Some", s = Rt(r), c = {
+	let r = k.squash(n), i = r?._tag, a = r instanceof Error ? r.message : r?.message ?? String(r), o = k.dieOption(n)._tag === "Some", s = Bt(r), c = {
 		traceId: t,
 		...i === void 0 ? {} : { errorTag: i },
 		...s
 	}, l = a === "Failed to execute statement" && typeof s.dbMessage == "string" ? s.dbMessage : a;
-	o ? cr.error(`${e} failed: ${l}`, c) : cr.warn(`${e} failed: ${l}`, c);
-}, dr = /* @__PURE__ */ new Set(["SqlError", "ResultLengthMismatch"]), fr = (e) => typeof e == "object" && !!e && typeof e._tag == "string" && dr.has(e._tag), pr = (e) => ({
+	o ? fr.error(`${e} failed: ${l}`, c) : fr.warn(`${e} failed: ${l}`, c);
+}, hr = /* @__PURE__ */ new Set(["SqlError", "ResultLengthMismatch"]), gr = (e) => typeof e == "object" && !!e && typeof e._tag == "string" && hr.has(e._tag), _r = (e) => ({
 	_tag: "InternalError",
 	message: "internal server error",
 	traceId: e
-}), mr = (e) => {
+}), vr = (e) => {
 	let t = k.squash(e);
 	t && typeof t == "object" && t._tag === "UnknownException" && (t = t.error ?? t.cause ?? t);
 	let n = t && typeof t == "object" ? t : {}, r = {};
@@ -1850,19 +1893,19 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		...typeof i == "string" ? { _tag: i } : {},
 		message: typeof a == "string" ? a : String(t)
 	};
-}, hr = (e, t, n = "rpc.mutation") => j.gen(function* () {
-	let r = yield* ve, i = yield* _e, a = yield* tr;
-	rr(a, n, r);
-	let o = er(r, a, i.clientId), s = Xn({ subjectKey: Kn(r.id, i.clientId) }, () => Vn({
+}, yr = (e, t, n = "rpc.mutation") => j.gen(function* () {
+	let r = yield* be, i = yield* ye, a = yield* ar;
+	sr(a, n, r);
+	let o = ir(r, a, i.clientId), s = er({ subjectKey: Xn(r.id, i.clientId) }, () => Gn({
 		traceId: o.traceId,
 		...o.spanId === void 0 ? {} : { spanId: o.spanId }
 	}, () => e(t, o)));
 	return yield* (j.isEffect(s) ? s : j.tryPromise({
 		try: () => Promise.resolve(s),
 		catch: (e) => e
-	})).pipe(j.tapErrorCause((e) => j.sync(() => ur(n, o.traceId, e))), j.catchIf(fr, () => j.die(pr(o.traceId))), j.annotateLogs(nr(o)));
-}).pipe(j.withSpan(n, { attributes: { "framework.kind": "mutation" } })), gr = 8 * 1024 * 1024, _r = (e) => {
-	let t = e.port ?? 4e3, n = e.path ?? "/ws", r = We(), i = (t) => z.HttpServerRequest.pipe(j.flatMap((t) => j.gen(function* () {
+	})).pipe(j.tapErrorCause((e) => j.sync(() => mr(n, o.traceId, e))), j.catchIf(gr, () => j.die(_r(o.traceId))), j.annotateLogs(or(o)));
+}).pipe(j.withSpan(n, { attributes: { "framework.kind": "mutation" } })), br = 8 * 1024 * 1024, xr = (e) => {
+	let t = e.port ?? 4e3, n = e.path ?? "/ws", r = Ke(), i = (t) => z.HttpServerRequest.pipe(j.flatMap((t) => j.gen(function* () {
 		if (!e.inspectRoute) return B.text("inspect route not configured", { status: 404 });
 		let n = {};
 		for (let [e, r] of Object.entries(t.headers)) r !== void 0 && (n[e.toLowerCase()] = Array.isArray(r) ? r.join(", ") : r);
@@ -1938,7 +1981,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		let t = (e) => z.HttpServerRequest.pipe(j.flatMap((t) => j.gen(function* () {
 			let n = {};
 			for (let [e, r] of Object.entries(t.headers)) r !== void 0 && (n[e.toLowerCase()] = Array.isArray(r) ? r.join(", ") : r);
-			let r = t.method !== "GET" && t.method !== "HEAD" ? yield* t.text.pipe(j.orElseSucceed(() => "")) : "", i = new TextEncoder().encode(r), a = t.url.split("?")[0], o = zn(n.traceparent), s = yield* j.promise(() => e.handle({
+			let r = t.method !== "GET" && t.method !== "HEAD" ? yield* t.text.pipe(j.orElseSucceed(() => "")) : "", i = new TextEncoder().encode(r), a = t.url.split("?")[0], o = Un(n.traceparent), s = yield* j.promise(() => e.handle({
 				method: t.method,
 				path: a,
 				headers: n,
@@ -1968,8 +2011,8 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 				query: a,
 				headers: n,
 				rawBody: o
-			}, c = yield* j.promise(() => tt(e, s));
-			c.status >= 500 && lr.warn(`${t.method} ${i} → ${c.status}`, {
+			}, c = yield* j.promise(() => rt(e, s));
+			c.status >= 500 && pr.warn(`${t.method} ${i} → ${c.status}`, {
 				method: t.method,
 				path: i,
 				status: c.status,
@@ -1981,7 +2024,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 				headers: l
 			};
 			return c.body instanceof Uint8Array ? B.uint8Array(c.body, u) : B.text(c.body ?? "", u);
-		})), j.tapErrorCause((t) => k.isInterruptedOnly(t) ? j.void : j.sync(() => lr.error(`${e.map((e) => e.method).join("|")} ${e[0].path} threw`, { path: e[0].path }, k.squash(t))))), n = /* @__PURE__ */ new Map();
+		})), j.tapErrorCause((t) => k.isInterruptedOnly(t) ? j.void : j.sync(() => pr.error(`${e.map((e) => e.method).join("|")} ${e[0].path} threw`, { path: e[0].path }, k.squash(t))))), n = /* @__PURE__ */ new Map();
 		for (let t of e.httpRoutes) {
 			let e = n.get(t.path);
 			e ? e.push(t) : n.set(t.path, [t]);
@@ -1992,13 +2035,13 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		});
 		l = M.mergeAll(...r);
 	}
-	let u = $e.layerProtocolWebsocketRouter({ path: n }), d = $e.layer(e.group), f = $e.layer(e.group).pipe(M.provide($e.layerProtocolHttpRouter({ path: "/rpc" })), M.provide(Qe.layerJson), M.provide(e.httpHandlersLayer ?? e.handlersLayer)), p = M.scopedDiscard(j.gen(function* () {
-		let e = yield* $e.Protocol;
+	let u = tt.layerProtocolWebsocketRouter({ path: n }), d = tt.layer(e.group), f = tt.layer(e.group).pipe(M.provide(tt.layerProtocolHttpRouter({ path: "/rpc" })), M.provide(et.layerJson), M.provide(e.httpHandlersLayer ?? e.handlersLayer)), p = M.scopedDiscard(j.gen(function* () {
+		let e = yield* tt.Protocol;
 		yield* j.forkScoped(j.gen(function* () {
 			let t = yield* e.disconnects.take;
-			On(t), Mn(t);
+			Mn(t), In(t);
 		}).pipe(j.forever));
-	})), m = M.mergeAll(d, p).pipe(M.provide(u), M.provide(Qe.layerJson), M.provide(e.handlersLayer)), h = M.mergeAll(m, f, s, c, l), g = e.pluginHttpInterceptor, _ = e.healthCheck, v = Number(process.env.VOLTRO_MAX_RPC_BODY_BYTES), y = e.maxRpcBodyBytes ?? (Number.isFinite(v) && v > 0 ? v : 8388608), b = { "cache-control": "no-store" }, x = (e) => j.gen(function* () {
+	})), m = M.mergeAll(d, p).pipe(M.provide(u), M.provide(et.layerJson), M.provide(e.handlersLayer)), h = M.mergeAll(m, f, s, c, l), g = e.pluginHttpInterceptor, _ = e.healthCheck, v = Number(process.env.VOLTRO_MAX_RPC_BODY_BYTES), y = e.maxRpcBodyBytes ?? (Number.isFinite(v) && v > 0 ? v : 8388608), b = { "cache-control": "no-store" }, x = (e) => j.gen(function* () {
 		let t = yield* z.HttpServerRequest, n = {};
 		for (let [e, r] of Object.entries(t.headers)) r !== void 0 && (n[e.toLowerCase()] = Array.isArray(r) ? r.join(", ") : r);
 		let r = t.url.indexOf("?"), i = r === -1 ? t.url : t.url.slice(0, r);
@@ -2039,13 +2082,13 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 			status: l.status,
 			...l.headers ? { headers: l.headers } : {}
 		});
-	}), S = M.unwrapEffect(R.toHttpEffect(h).pipe(j.map((e) => qe.serve(x(e))))).pipe(M.provide(Ye.layer(() => r, { port: t })), M.provide(Je.layer));
+	}), S = M.unwrapEffect(R.toHttpEffect(h).pipe(j.map((e) => Ye.serve(x(e))))).pipe(M.provide(Ze.layer(() => r, { port: t })), M.provide(Xe.layer));
 	e.tracerLayer && (S = S.pipe(M.provide(e.tracerLayer)));
-	let C = Me({ scope: "voltro:rpc" }), w = M.launch(S).pipe(j.catchAllCause((e) => j.sync(() => {
+	let C = O({ scope: "voltro:rpc" }), ee = M.launch(S).pipe(j.catchAllCause((e) => j.sync(() => {
 		C.error("rpc server crashed", {}, k.squash(e)), process.exit(1);
 	})));
-	return Xe.runMain(w, { disableErrorReporting: !0 }), r;
-}, vr = (e, t = 1e4) => new Promise((n, r) => {
+	return Qe.runMain(ee, { disableErrorReporting: !0 }), r;
+}, Sr = (e, t = 1e4) => new Promise((n, r) => {
 	if (e.listening) {
 		n();
 		return;
@@ -2061,13 +2104,13 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		o(e);
 	}
 	a = setTimeout(() => o(/* @__PURE__ */ Error(`rpc server did not bind within ${t}ms`)), t), e.on("listening", s), e.on("error", c);
-}), yr = () => {
+}), Cr = () => {
 	let e = process.env.FRAMEWORK_TRACING?.toLowerCase();
 	return e === "console" || e === "otlp" || e === "off" ? e : process.env.OTEL_EXPORTER_OTLP_ENDPOINT || process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT ? "otlp" : "off";
-}, br = () => {
+}, wr = () => {
 	let e = process.env.FRAMEWORK_METRICS?.toLowerCase();
 	return e === "console" || e === "otlp" || e === "off" ? e : process.env.OTEL_EXPORTER_OTLP_ENDPOINT || process.env.OTEL_EXPORTER_OTLP_METRICS_ENDPOINT ? "otlp" : "off";
-}, xr = async () => {
+}, Tr = async () => {
 	let [e, t, n, r, i] = await Promise.all([
 		import("@opentelemetry/sdk-trace-base"),
 		import("@opentelemetry/sdk-metrics"),
@@ -2082,7 +2125,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		otlpMetrics: r,
 		nodeSdk: i
 	};
-}, Sr = (e, t, n) => {
+}, Er = (e, t, n) => {
 	let { PeriodicExportingMetricReader: r, ConsoleMetricExporter: i, InMemoryMetricExporter: a, AggregationTemporality: o } = e.sdkMetrics;
 	if (t === "off") return {
 		reader: void 0,
@@ -2105,8 +2148,8 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		}),
 		inMemory: void 0
 	};
-}, Cr = async (e = {}) => {
-	let t = e.mode ?? yr(), n = e.metricsMode ?? br(), r = e.extraSpanProcessors ?? [], i = e.extraMetricReaders ?? [];
+}, Dr = async (e = {}) => {
+	let t = e.mode ?? Cr(), n = e.metricsMode ?? wr(), r = e.extraSpanProcessors ?? [], i = e.extraMetricReaders ?? [];
 	if (t === "off" && e.traceSink === void 0 && n === "off" && r.length === 0 && i.length === 0) return {
 		layer: M.empty,
 		mode: t,
@@ -2115,13 +2158,13 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		metricsMode: n,
 		inMemoryMetricExporter: void 0
 	};
-	let a = await xr(), { ConsoleSpanExporter: o, InMemorySpanExporter: s, SimpleSpanProcessor: c, BatchSpanProcessor: l } = a.sdkTrace, u = t === "off", d = e.serviceName ?? process.env.OTEL_SERVICE_NAME ?? "voltro-app", f, p;
+	let a = await Tr(), { ConsoleSpanExporter: o, InMemorySpanExporter: s, SimpleSpanProcessor: c, BatchSpanProcessor: l } = a.sdkTrace, u = t === "off", d = e.serviceName ?? process.env.OTEL_SERVICE_NAME ?? "voltro-app", f, p;
 	e.spanProcessor ? p = e.spanProcessor : u ? p = void 0 : t === "memory" ? (f = new s(), p = new c(f)) : p = t === "console" ? new c(new o()) : new l(new a.otlpTrace.OTLPTraceExporter());
 	let m = [
 		...e.traceSink ? [e.traceSink] : [],
 		...p ? [p] : [],
 		...r
-	], h = m.length === 1 ? m[0] : m, { reader: g, inMemory: _ } = Sr(a, n, e.metricExportIntervalMillis ?? (process.env.OTEL_METRIC_EXPORT_INTERVAL ? Number(process.env.OTEL_METRIC_EXPORT_INTERVAL) : 6e4)), v = [...g ? [g] : [], ...i], y = v.length === 0 ? void 0 : v.length === 1 ? v[0] : v, b = {
+	], h = m.length === 1 ? m[0] : m, { reader: g, inMemory: _ } = Er(a, n, e.metricExportIntervalMillis ?? (process.env.OTEL_METRIC_EXPORT_INTERVAL ? Number(process.env.OTEL_METRIC_EXPORT_INTERVAL) : 6e4)), v = [...g ? [g] : [], ...i], y = v.length === 0 ? void 0 : v.length === 1 ? v[0] : v, b = {
 		serviceName: d,
 		...e.serviceVersion ? { serviceVersion: e.serviceVersion } : {},
 		...e.resourceAttributes ? { attributes: e.resourceAttributes } : {}
@@ -2139,18 +2182,18 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		metricsMode: n,
 		inMemoryMetricExporter: _
 	};
-}, wr = {
-	[it.INTERNAL]: "internal",
-	[it.SERVER]: "server",
-	[it.CLIENT]: "client",
-	[it.PRODUCER]: "producer",
-	[it.CONSUMER]: "consumer"
-}, Tr = (e) => e[0] * 1e3 + e[1] / 1e6, Er = 512, Dr = 48, Or = (e) => {
+}, Or = {
+	[ot.INTERNAL]: "internal",
+	[ot.SERVER]: "server",
+	[ot.CLIENT]: "client",
+	[ot.PRODUCER]: "producer",
+	[ot.CONSUMER]: "consumer"
+}, kr = (e) => e[0] * 1e3 + e[1] / 1e6, Ar = 512, jr = 48, Mr = (e) => {
 	let t = {}, n = 0;
 	for (let r in e) {
-		if (n >= Dr) break;
+		if (n >= jr) break;
 		let i = e[r];
-		if (typeof i == "string") t[r] = i.length > Er ? `${i.slice(0, Er)}…` : i;
+		if (typeof i == "string") t[r] = i.length > Ar ? `${i.slice(0, Ar)}…` : i;
 		else if (typeof i == "number" || typeof i == "boolean" || i == null) t[r] = i;
 		else {
 			let e;
@@ -2159,49 +2202,49 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 			} catch {
 				e = String(i);
 			}
-			t[r] = e.length > Er ? `${e.slice(0, Er)}…` : e;
+			t[r] = e.length > Ar ? `${e.slice(0, Ar)}…` : e;
 		}
 		n++;
 	}
 	return t;
-}, kr = {
-	[at.UNSET]: "unset",
-	[at.OK]: "ok",
-	[at.ERROR]: "error"
-}, Ar = (e) => {
+}, Nr = {
+	[st.UNSET]: "unset",
+	[st.OK]: "ok",
+	[st.ERROR]: "error"
+}, Pr = (e) => {
 	let t = e.spanContext(), n = e.events.length > 0 ? e.events.slice(0, 16).map((e) => ({
 		name: e.name,
-		tsMs: Tr(e.time),
-		...e.attributes ? { attributes: Or(e.attributes) } : {}
+		tsMs: kr(e.time),
+		...e.attributes ? { attributes: Mr(e.attributes) } : {}
 	})) : void 0;
 	return {
 		traceId: t.traceId,
 		spanId: t.spanId,
 		parentSpanId: e.parentSpanContext?.spanId ?? null,
 		name: e.name,
-		kind: wr[e.kind] ?? "internal",
-		attributes: Or(e.attributes),
-		startMs: Tr(e.startTime),
-		endMs: Tr(e.endTime),
-		durationMs: Tr(e.duration),
-		status: kr[e.status.code] ?? "unset",
+		kind: Or[e.kind] ?? "internal",
+		attributes: Mr(e.attributes),
+		startMs: kr(e.startTime),
+		endMs: kr(e.endTime),
+		durationMs: kr(e.duration),
+		status: Nr[e.status.code] ?? "unset",
 		...e.status.message ? { statusMessage: e.status.message } : {},
 		...n ? { events: n } : {}
 	};
-}, jr = (e) => ({
+}, Fr = (e) => ({
 	onStart: () => {},
 	onEnd: (t) => {
 		try {
-			e(Ar(t));
+			e(Pr(t));
 		} catch {}
 	},
 	forceFlush: () => Promise.resolve(),
 	shutdown: () => Promise.resolve()
-}), Mr = { get: (e) => Promise.resolve(process.env[e]) }, Nr = Mr, Pr = (e) => {
-	Nr = e;
-}, Fr = () => {
-	Nr = Mr;
-}, Ir = async (e) => await Nr.get(e) ?? process.env[e], Lr = (e) => process.env[e], Rr = (e, t = 6e4, n = () => Date.now()) => {
+}), Ir = { get: (e) => Promise.resolve(process.env[e]) }, Lr = Ir, Rr = (e) => {
+	Lr = e;
+}, zr = () => {
+	Lr = Ir;
+}, Br = async (e) => await Lr.get(e) ?? process.env[e], Vr = (e) => process.env[e], Hr = (e, t = 6e4, n = () => Date.now()) => {
 	let r = /* @__PURE__ */ new Map();
 	return { get: async (i) => {
 		let a = r.get(i);
@@ -2212,12 +2255,12 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 			at: n()
 		}), o;
 	} };
-}, zr = (e) => {
+}, Ur = (e) => {
 	let t = {
 		accept: "application/json",
 		...e.headers ?? {}
 	};
-	if (e.perKey) return Rr({ get: async (n) => {
+	if (e.perKey) return Hr({ get: async (n) => {
 		let r = await fetch(`${e.url.replace(/\/$/, "")}/${encodeURIComponent(n)}`, { headers: t });
 		if (!r.ok) return;
 		let i = await r.json();
@@ -2228,50 +2271,59 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		let t = (await a())[e];
 		return typeof t == "string" ? t : void 0;
 	} };
-}, Br = (e) => e === void 0 || e === "env" || typeof e == "object" && e.kind === "env" ? Mr : e.kind === "custom" ? e.backend : e.kind === "http" ? zr(e) : Mr, Vr = (e) => /^[0-9a-f]{64}$/i.test(e) ? Buffer.from(e, "hex") : me(e, "voltro:field-encryption:v1", 32), Hr = (t) => {
+}, Wr = (e) => e === void 0 || e === "env" || typeof e == "object" && e.kind === "env" ? Ir : e.kind === "custom" ? e.backend : e.kind === "http" ? Ur(e) : Ir, Gr = (e) => /^[0-9a-f]{64}$/i.test(e) ? Buffer.from(e, "hex") : ge(e, "voltro:field-encryption:v1", 32), Kr = (t) => {
 	if (t.length !== 32) throw Error(`field cipher key must be 32 bytes, got ${t.length}`);
 	return {
 		encrypt: (n) => {
-			let r = fe(12), i = le("aes-256-gcm", t, r), a = Buffer.concat([i.update(n, "utf8"), i.final()]), o = i.getAuthTag();
+			let r = me(12), i = de("aes-256-gcm", t, r), a = Buffer.concat([i.update(n, "utf8"), i.final()]), o = i.getAuthTag();
 			return `${e}${r.toString("base64")}:${o.toString("base64")}:${a.toString("base64")}`;
 		},
 		decrypt: (n) => {
 			let [r, i, a] = n.slice(e.length).split(":");
 			if (!r || !i || a === void 0) throw Error("field cipher: malformed ciphertext");
-			let o = ue("aes-256-gcm", t, Buffer.from(r, "base64"));
+			let o = fe("aes-256-gcm", t, Buffer.from(r, "base64"));
 			return o.setAuthTag(Buffer.from(i, "base64")), Buffer.concat([o.update(Buffer.from(a, "base64")), o.final()]).toString("utf8");
 		}
 	};
-}, Ur = (e) => Hr(Vr(e)), Wr, Gr = (e) => {
-	Wr = e;
-}, Kr = () => Wr, J = "_voltro_idempotency", qr = (e) => {
+}, qr = (e) => Kr(Gr(e)), Jr, Yr = (e) => {
+	Jr = e;
+}, Xr = () => Jr, Zr = "no field cipher registered — enable `@voltro/plugin-governance` `governancePlugin({ fieldEncryption: { key } })` (or call setFieldCipher) so a key is available.", Qr = (e) => {
+	let t = Xr();
+	if (!t) throw Error(`encryptField: ${Zr}`);
+	return t.encrypt(e);
+}, $r = (e) => {
+	if (!x(e)) return e;
+	let t = Xr();
+	if (!t) throw Error(`decryptField: ${Zr}`);
+	return t.decrypt(e);
+}, q = "_voltro_idempotency", ei = (e) => {
 	if (e == null) return null;
 	let t = typeof e == "string" ? JSON.parse(e) : e;
 	return t && typeof t == "object" && "status" in t ? t : null;
-}, Jr = (e) => ({
+}, ti = (e) => ({
 	scope: e.scope,
 	key: e.key,
 	status: e.status === "completed" ? "completed" : "in_flight",
-	response: qr(e.response),
-	createdAt: je(e.createdAt)
-}), Yr = async (e, n, r) => (await e.query({
-	table: J,
+	response: ei(e.response),
+	createdAt: Pe(e.createdAt)
+}), ni = async (e, n, r) => (await e.query({
+	table: q,
 	predicate: t(u("scope", n), u("key", r)),
 	order: [],
 	take: 1,
 	skip: void 0,
 	projection: void 0
-}))[0] ?? null, Xr = (e) => ({
+}))[0] ?? null, ri = (e) => ({
 	get: async (t, n) => {
-		let r = await Yr(e, t, n);
-		return r ? Jr(r) : null;
+		let r = await ni(e, t, n);
+		return r ? ti(r) : null;
 	},
 	claim: async (t, n, r, i) => {
 		for (let a = 0; a < 2; a++) {
 			let a = f({
 				kind: "typeid",
 				prefix: "idem"
-			}, J), o = await e.insertIgnore(J, {
+			}, q), o = await e.insertIgnore(q, {
 				id: a,
 				scope: t,
 				key: n,
@@ -2280,11 +2332,11 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 				createdAt: new Date(r)
 			}, { conflictColumns: ["scope", "key"] });
 			if (o.id === a) return "claimed";
-			if (r - je(o.createdAt) < i) return Jr(o);
-			await e.delete(J, o.id);
+			if (r - Pe(o.createdAt) < i) return ti(o);
+			await e.delete(q, o.id);
 		}
-		let a = await Yr(e, t, n);
-		return a ? Jr(a) : {
+		let a = await ni(e, t, n);
+		return a ? ti(a) : {
 			scope: t,
 			key: n,
 			status: "in_flight",
@@ -2293,36 +2345,36 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		};
 	},
 	complete: async (t, n, r, i) => {
-		let a = await Yr(e, t, n);
-		a && await e.update(J, a.id, {
+		let a = await ni(e, t, n);
+		a && await e.update(q, a.id, {
 			status: "completed",
 			response: r
 		});
 	},
 	release: async (t, n) => {
-		let r = await Yr(e, t, n);
-		r && await e.delete(J, r.id);
+		let r = await ni(e, t, n);
+		r && await e.delete(q, r.id);
 	}
-}), Y = "_voltro_kv", Zr = (e) => {
+}), J = "_voltro_kv", ii = (e) => {
 	if (e == null) return null;
 	if (e instanceof Date) return e.getTime();
 	if (typeof e == "number") return e;
 	let t = Date.parse(String(e));
 	return Number.isNaN(t) ? null : t;
-}, Qr = (e, t) => {
-	let n = Zr(e.expiresAt);
+}, ai = (e, t) => {
+	let n = ii(e.expiresAt);
 	return n !== null && n <= t;
-}, $r = (e) => e === null ? null : JSON.parse(e), ei = async (e, t) => (await e.query({
-	table: Y,
+}, oi = (e) => e === null ? null : JSON.parse(e), si = async (e, t) => (await e.query({
+	table: J,
 	predicate: u("key", t),
 	order: [],
 	take: 1,
 	skip: void 0,
 	projection: void 0
-}))[0] ?? null, ti = (e) => {
+}))[0] ?? null, ci = (e) => {
 	let n = (e, t, n) => j.tryPromise({
 		try: n,
-		catch: (n) => new st({
+		catch: (n) => new lt({
 			operation: e,
 			key: t,
 			cause: String(n)
@@ -2330,15 +2382,15 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 	});
 	return {
 		get: (t) => n("get", t, async () => {
-			let n = await ei(e, t);
-			return n === null ? P.none() : Qr(n, Date.now()) ? (await e.delete(Y, n.id), P.none()) : P.some($r(n.value));
+			let n = await si(e, t);
+			return n === null ? P.none() : ai(n, Date.now()) ? (await e.delete(J, n.id), P.none()) : P.some(oi(n.value));
 		}),
 		set: (t, r, i) => n("set", t, async () => {
 			let n = Date.now(), a = i?.ttlMs !== void 0 && i.ttlMs > 0 ? new Date(n + i.ttlMs) : null, o = f({
 				kind: "typeid",
 				prefix: "kv"
-			}, Y);
-			await e.upsert(Y, {
+			}, J);
+			await e.upsert(J, {
 				id: o,
 				key: t,
 				value: JSON.stringify(r),
@@ -2354,36 +2406,36 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 			});
 		}),
 		delete: (t) => n("delete", t, async () => {
-			let n = await ei(e, t);
+			let n = await si(e, t);
 			if (n === null) return !1;
-			let r = !Qr(n, Date.now());
-			return await e.delete(Y, n.id), r;
+			let r = !ai(n, Date.now());
+			return await e.delete(J, n.id), r;
 		}),
 		has: (t) => n("has", t, async () => {
-			let n = await ei(e, t);
-			return n === null ? !1 : Qr(n, Date.now()) ? (await e.delete(Y, n.id), !1) : !0;
+			let n = await si(e, t);
+			return n === null ? !1 : ai(n, Date.now()) ? (await e.delete(J, n.id), !1) : !0;
 		}),
 		list: (r) => n("list", "", async () => {
-			let n = Date.now(), i = T(x("expiresAt"), h("expiresAt", new Date(n))), a = r === "" ? i : t(o("key", r), i), s = await e.query({
-				table: Y,
+			let n = Date.now(), i = re(S("expiresAt"), h("expiresAt", new Date(n))), a = r === "" ? i : t(o("key", r), i), s = await e.query({
+				table: J,
 				predicate: a,
 				order: [],
 				take: void 0,
 				skip: void 0,
 				projection: void 0
 			}), c = [];
-			for (let e of s) Qr(e, n) || (r === "" || e.key.startsWith(r)) && c.push(e.key);
+			for (let e of s) ai(e, n) || (r === "" || e.key.startsWith(r)) && c.push(e.key);
 			return c;
 		}),
 		clear: () => n("clear", "", async () => {
-			await e.deleteMany(Y, { where: {
+			await e.deleteMany(J, { where: {
 				column: "id",
 				op: "isNotNull"
 			} });
 		})
 	};
-}, ni = async ({ store: e, env: t = process.env }) => {
-	let n = (t.KV_BACKEND ?? "database").toLowerCase(), r = n === "redis" ? "redis" : n === "memory" ? "memory" : "database", i = r === "redis" ? dt(t.KV_KEY_PREFIX ? { keyPrefix: t.KV_KEY_PREFIX } : {}).pipe(M.provide(lt)) : r === "memory" ? ut() : M.succeed(ct, ct.of(ti(e))), a = ze.make(ot.Default.pipe(M.provide(i))), o = await a.runPromise(ot);
+}, li = async ({ store: e, env: t = process.env }) => {
+	let n = (t.KV_BACKEND ?? "database").toLowerCase(), r = n === "redis" ? "redis" : n === "memory" ? "memory" : "database", i = r === "redis" ? pt(t.KV_KEY_PREFIX ? { keyPrefix: t.KV_KEY_PREFIX } : {}).pipe(M.provide(dt)) : r === "memory" ? ft() : M.succeed(ut, ut.of(ci(e))), a = Ve.make(ct.Default.pipe(M.provide(i))), o = await a.runPromise(ct);
 	return {
 		kv: {
 			get: (e) => a.runPromise(o.get(e)).then((e) => P.getOrUndefined(e)),
@@ -2398,7 +2450,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		backend: r,
 		dispose: () => a.dispose()
 	};
-}, ri = {
+}, ui = {
 	get: () => Promise.resolve(void 0),
 	getOrElse: (e, t) => Promise.resolve(t()),
 	set: () => Promise.resolve(),
@@ -2406,7 +2458,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 	has: () => Promise.resolve(!1),
 	list: () => Promise.resolve([]),
 	clear: () => Promise.resolve()
-}, ii = "_voltro_api_keys", ai = (e) => de("sha256").update(e, "utf8").digest("hex"), oi = (e = "voltro_") => `${e}${fe(30).toString("base64url")}`, si = (e) => ({
+}, di = "_voltro_api_keys", fi = (e) => pe("sha256").update(e, "utf8").digest("hex"), pi = (e = "voltro_") => `${e}${me(30).toString("base64url")}`, mi = (e) => ({
 	id: e.id,
 	name: e.name,
 	keyPrefix: e.keyPrefix,
@@ -2416,17 +2468,17 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 	expiresAt: e.expiresAt,
 	revokedAt: e.revokedAt,
 	createdAt: e.createdAt
-}), ci = (e, t) => e.revokedAt === null && (e.expiresAt === null || e.expiresAt > t), li = (e, t = {}) => {
+}), hi = (e, t) => e.revokedAt === null && (e.expiresAt === null || e.expiresAt > t), gi = (e, t = {}) => {
 	let n = t.prefix ?? "voltro_", r = async (t) => {
-		let r = oi(n), i = f({
+		let r = pi(n), i = f({
 			kind: "typeid",
 			prefix: "apikey"
-		}, ii), a = t.scopes ?? [], o = t.expiresAt == null ? null : t.expiresAt instanceof Date ? t.expiresAt.getTime() : t.expiresAt;
+		}, di), a = t.scopes ?? [], o = t.expiresAt == null ? null : t.expiresAt instanceof Date ? t.expiresAt.getTime() : t.expiresAt;
 		return await e.insert({
 			id: i,
 			tenantId: t.tenantId ?? null,
 			name: t.name,
-			hashedKey: ai(r),
+			hashedKey: fi(r),
 			keyPrefix: r.slice(0, n.length + 6),
 			scopes: a,
 			lastUsedAt: null,
@@ -2444,7 +2496,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		};
 	}, i = async (t, n = Date.now()) => {
 		let r = await e.findByHash(t);
-		return !r || !ci(r, n) ? null : (await e.patch(r.id, { lastUsedAt: n }), {
+		return !r || !hi(r, n) ? null : (await e.patch(r.id, { lastUsedAt: n }), {
 			id: r.id,
 			tenantId: r.tenantId ?? "",
 			scopes: r.scopes ?? []
@@ -2453,7 +2505,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 	return {
 		issue: r,
 		resolveByHash: i,
-		verify: (e, t) => i(ai(e), t),
+		verify: (e, t) => i(fi(e), t),
 		revoke: async (t, n = Date.now()) => await e.findById(t) ? (await e.patch(t, { revokedAt: n }), !0) : !1,
 		rotate: async (t, n = Date.now()) => {
 			let i = await e.findById(t);
@@ -2464,9 +2516,9 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 				createdBy: i.createdBy
 			})) : null;
 		},
-		list: async (t) => (await e.listByTenant(t)).map(si)
+		list: async (t) => (await e.listByTenant(t)).map(mi)
 	};
-}, ui = () => {
+}, _i = () => {
 	let e = /* @__PURE__ */ new Map();
 	return {
 		insert: async (t) => {
@@ -2483,21 +2535,21 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 			});
 		}
 	};
-}, di = (e) => e == null ? null : e instanceof Date ? e.getTime() : typeof e == "number" ? e : typeof e == "string" ? new Date(e).getTime() : null, fi = (e) => ({
+}, vi = (e) => e == null ? null : e instanceof Date ? e.getTime() : typeof e == "number" ? e : typeof e == "string" ? new Date(e).getTime() : null, yi = (e) => ({
 	id: String(e.id),
 	tenantId: e.tenantId ?? null,
 	name: String(e.name),
 	hashedKey: String(e.hashedKey),
 	keyPrefix: String(e.keyPrefix),
 	scopes: e.scopes ?? null,
-	lastUsedAt: di(e.lastUsedAt),
-	expiresAt: di(e.expiresAt),
-	revokedAt: di(e.revokedAt),
+	lastUsedAt: vi(e.lastUsedAt),
+	expiresAt: vi(e.expiresAt),
+	revokedAt: vi(e.revokedAt),
 	createdBy: e.createdBy ?? null,
-	createdAt: di(e.createdAt) ?? 0
-}), pi = (e) => {
+	createdAt: vi(e.createdAt) ?? 0
+}), bi = (e) => {
 	let t = async (t) => await e.query({
-		table: ii,
+		table: di,
 		predicate: t,
 		order: [],
 		take: void 0,
@@ -2515,32 +2567,32 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 	};
 	return {
 		insert: async (t) => {
-			await e.insert(ii, n(t));
+			await e.insert(di, n(t));
 		},
 		findByHash: async (e) => {
 			let n = await t(u("hashedKey", e));
-			return n[0] ? fi(n[0]) : null;
+			return n[0] ? yi(n[0]) : null;
 		},
 		findById: async (e) => {
 			let n = await t(u("id", e));
-			return n[0] ? fi(n[0]) : null;
+			return n[0] ? yi(n[0]) : null;
 		},
-		listByTenant: async (e) => (await t(e === null ? void 0 : u("tenantId", e))).map(fi).filter((t) => e === null || t.tenantId === e),
+		listByTenant: async (e) => (await t(e === null ? void 0 : u("tenantId", e))).map(yi).filter((t) => e === null || t.tenantId === e),
 		patch: async (t, r) => {
-			await e.update(ii, t, n(r));
+			await e.update(di, t, n(r));
 		}
 	};
-}, mi = (e, t = {}) => ft({
+}, xi = (e, t = {}) => mt({
 	id: "voltro-apikey",
 	...t.prefix ? { prefix: t.prefix } : {},
 	resolveKey: (t) => e.resolveByHash(t)
-}), hi = (e) => {
+}), Si = (e) => {
 	let t = e.subject;
 	return {
 		id: t.id ?? null,
 		tenantId: t.tenantId ?? null
 	};
-}, gi = (e, t = "/v1/api-keys") => {
+}, Ci = (e, t = "/v1/api-keys") => {
 	let n = I.Struct({
 		id: I.String,
 		name: I.String,
@@ -2553,11 +2605,11 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		createdAt: I.Number
 	});
 	return [
-		et({
+		nt({
 			method: "POST",
 			path: `${t}/issue`,
 			summary: "Issue an API key (the token is returned ONCE).",
-			guards: [nt(ge)],
+			guards: [it(ve)],
 			input: I.Struct({ body: I.Struct({
 				name: I.String,
 				scopes: I.optional(I.Array(I.String)),
@@ -2569,7 +2621,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 				keyPrefix: I.String
 			}),
 			handler: async (t, n) => {
-				let r = t.body, i = hi(n), a = await e.issue({
+				let r = t.body, i = Si(n), a = await e.issue({
 					tenantId: i.tenantId,
 					name: r.name,
 					...r.scopes ? { scopes: r.scopes } : {},
@@ -2583,41 +2635,68 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 				};
 			}
 		}),
-		et({
+		nt({
 			method: "GET",
 			path: t,
 			summary: "List the caller tenant's API keys (no secrets).",
-			guards: [nt(ge)],
+			guards: [it(ve)],
 			input: I.Struct({}),
 			output: I.Struct({ keys: I.Array(n) }),
-			handler: async (t, n) => ({ keys: [...await e.list(hi(n).tenantId)] })
+			handler: async (t, n) => ({ keys: [...await e.list(Si(n).tenantId)] })
 		}),
-		et({
+		nt({
 			method: "POST",
 			path: `${t}/revoke`,
 			summary: "Revoke an API key by id.",
-			guards: [nt(ge)],
+			guards: [it(ve)],
 			input: I.Struct({ body: I.Struct({ id: I.String }) }),
 			output: I.Struct({ ok: I.Boolean }),
 			handler: async (t, n) => ({ ok: await e.revoke(t.body.id) })
 		})
 	];
-}, _i = (e) => Ze.make(e.name, {
+}, wi = class extends I.TaggedError()("TenantScopeViolation", {
+	table: I.String,
+	reason: I.String
+}) {}, Ti = class extends I.TaggedError()("StoreOperationFailed", {
+	operation: I.String,
+	table: I.String,
+	cause: I.String
+}) {}, Ei = class extends I.TaggedError()("TableValidationFailed", {
+	table: I.String,
+	summary: I.String,
+	issues: I.Array(I.Struct({
+		path: I.String,
+		message: I.String
+	}))
+}) {}, Di = class extends Ie.Tag("@voltro/EffectStore")() {}, Oi = (e, t) => (n) => n instanceof wi ? n : new Ti({
+	operation: e,
+	table: t,
+	cause: String(n)
+}), ki = (e, t, n) => j.tryPromise({
+	try: n,
+	catch: Oi(e, t)
+}), Ai = (e) => M.succeed(Di, {
+	query: ((t) => ki("query", t.table, () => e.query(t))),
+	insert: (t, n) => ki("insert", t, () => e.insert(t, n)),
+	update: (t, n, r) => ki("update", t, () => e.update(t, n, r)),
+	delete: (t, n) => ki("delete", t, () => e.delete(t, n)),
+	hardDelete: (t, n) => ki("hardDelete", t, () => e.hardDelete(t, n))
+}), ji = (e) => $e.make(e.name, {
 	payload: e.payloadSchema,
-	success: Se,
+	success: we,
 	error: e.errorSchema
-}), X = (e, t) => ({
+}), Y = (e, t) => ({
 	id: t,
 	workflowName: e,
 	executionId: t,
 	status: "running"
-}), vi = X, yi = (e) => {
+}), Mi = Y, Ni = (e) => {
 	let t = k.failureOption(e), n = t._tag === "Some" ? t.value : k.squash(e);
 	return {
 		tag: n && typeof n == "object" && "_tag" in n ? String(n._tag) : null,
 		message: n?.message ?? String(n)
 	};
-}, bi = (e, t, n) => {
+}, Pi = (e, t, n) => {
 	if (n === void 0) return {
 		id: t,
 		workflowName: e,
@@ -2632,7 +2711,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 	};
 	if (typeof n == "object" && n && n._tag === "Complete") {
 		let r = n.exit;
-		return Re.isSuccess(r) ? {
+		return Be.isSuccess(r) ? {
 			id: t,
 			workflowName: e,
 			executionId: t,
@@ -2643,7 +2722,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 			workflowName: e,
 			executionId: t,
 			status: "failed",
-			error: yi(r.cause)
+			error: Ni(r.cause)
 		};
 	}
 	return {
@@ -2652,17 +2731,17 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		executionId: t,
 		status: "running"
 	};
-}, xi = (e) => new Promise((t) => setTimeout(t, e)), Si = (e) => {
+}, Fi = (e) => new Promise((t) => setTimeout(t, e)), Ii = (e) => {
 	let t = new Map(e.workflows.map((e) => [e.definition.name, e.definition])), n = (e) => {
 		let n = t.get(e);
 		if (!n) throw Error(`Unknown workflow: ${e}`);
 		return n;
 	}, r = async (t, r) => {
 		let i = n(t);
-		return bi(t, r, await e.runEffect(i.poll(r)));
-	}, i = async () => e.runEffect(pt()), a = async (t, r, i) => {
+		return Pi(t, r, await e.runEffect(i.poll(r)));
+	}, i = async () => e.runEffect(ht()), a = async (t, r, i) => {
 		let a = n(t), o;
-		return i?.callerContext !== void 0 && (o = await e.runEffect(a.executionId(r)), await e.rememberStartContext?.(t, o, i.callerContext)), i?.wait ? (await e.runEffect(a.execute(r)), X(t, o ?? await e.runEffect(a.executionId(r)))) : X(t, await e.runEffect(a.execute(r, { discard: !0 })));
+		return i?.callerContext !== void 0 && (o = await e.runEffect(a.executionId(r)), await e.rememberStartContext?.(t, o, i.callerContext)), i?.wait ? (await e.runEffect(a.execute(r)), Y(t, o ?? await e.runEffect(a.executionId(r)))) : Y(t, await e.runEffect(a.execute(r, { discard: !0 })));
 	};
 	return {
 		start: a,
@@ -2700,7 +2779,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 				let e = await r(i, a);
 				if (e.status === "succeeded" || e.status === "failed" || e.status === "cancelled") return e;
 				if (o?.timeoutMs !== void 0 && Date.now() - s >= o.timeoutMs) throw Error(`Timed out waiting for workflow '${i}' run '${a}'`);
-				await xi(c);
+				await Fi(c);
 			}
 		}),
 		cancel: async (t, r) => {
@@ -2738,22 +2817,22 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 			return e.retry(t, n);
 		}
 	};
-}, Ci = (e, t) => ({
+}, Li = (e, t) => ({
 	...e,
 	start: async (n, r, i) => {
 		if (i?.wait) throw Error("ctx.workflows.start(..., { wait: true }) is not allowed inside a mutation transaction; start the workflow and wait after commit.");
 		let a = await e.executionId(n, r);
-		return t(() => e.start(n, r)), X(n, a);
+		return t(() => e.start(n, r)), Y(n, a);
 	},
 	child: async (n, r, i) => {
 		if (i?.wait) throw Error("ctx.workflows.child(..., { wait: true }) is not allowed inside a mutation transaction; start the child workflow and wait after commit.");
 		let a = await e.executionId(n, r);
-		return t(() => e.child(n, r, i)), X(n, a);
+		return t(() => e.child(n, r, i)), Y(n, a);
 	},
 	run: async () => {
 		throw Error("ctx.workflows.run(...) is not allowed inside a mutation transaction; use ctx.workflows.start(...) so the workflow starts after commit.");
 	}
-}), wi = (e, t) => ({
+}), Ri = (e, t) => ({
 	...e,
 	start: (n, r, i) => e.start(n, r, {
 		...i,
@@ -2767,7 +2846,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		...i,
 		callerContext: t
 	})
-}), Ti = (e) => {
+}), zi = (e) => {
 	let t = () => {
 		let t = e();
 		if (!t) throw Error("Workflow runtime is not ready yet");
@@ -2788,55 +2867,55 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		listRuns: ((e) => t().listRuns(e)),
 		retry: (e, n) => t().retry(e, n)
 	};
-}, Ei = (e, t) => {
+}, Bi = (e, t) => {
 	let n = {};
-	for (let r of e) n[r.definition.name] = (e) => (t ? j.promise(() => t.start(r.definition.name, e)) : r.definition.execute(e, { discard: !0 }).pipe(j.map((e) => X(r.definition.name, e)))).pipe(j.withSpan(`workflow.${r.definition.name}`, { attributes: { "framework.kind": "workflow" } }));
+	for (let r of e) n[r.definition.name] = (e) => (t ? j.promise(() => t.start(r.definition.name, e)) : r.definition.execute(e, { discard: !0 }).pipe(j.map((e) => Y(r.definition.name, e)))).pipe(j.withSpan(`workflow.${r.definition.name}`, { attributes: { "framework.kind": "workflow" } }));
 	return n;
-}, Di = (e, t, n) => e.map((e) => e.definition.toLayer(((r, i) => {
+}, Vi = (e, t, n) => e.map((e) => e.definition.toLayer(((r, i) => {
 	let a = t.resolveStartContext?.(e.definition.name, i);
 	return (a === void 0 ? j.succeed(void 0) : j.promise(() => Promise.resolve(a))).pipe(j.flatMap((a) => {
-		let o = e.buildExecute(t.buildContext(a, {
+		let o = t.buildContext(a, {
 			workflowName: e.definition.name,
 			executionId: i,
 			parentExecutionId: a?.parentExecutionId ?? null,
 			parentClosePolicy: a?.parentClosePolicy ?? null
-		}));
-		return (n?.(e, o, a) ?? o)(r, i);
+		}), s = e.buildExecute(o), c = (n?.(e, s, a) ?? s)(r, i), l = o?.store;
+		return l === void 0 ? c : j.provide(c, Ai(l));
 	}));
-}))), Oi = (e) => ({
+}))), Hi = (e) => ({
 	_tag: "workflowEventTrigger",
 	...e
-}), ki = Oi, Ai = (e) => typeof e == "object" && !!e && e._tag === "workflowEventTrigger", ji = () => {
+}), Ui = Hi, Wi = (e) => typeof e == "object" && !!e && e._tag === "workflowEventTrigger", Gi = () => {
 	let e = globalThis.crypto;
 	return typeof e?.randomUUID == "function" ? e.randomUUID() : `${Date.now().toString(36)}${Math.random().toString(36).slice(2)}`;
-}, Mi = (e) => `${e}_${ji()}`, Ni = (e) => e.id ?? `${e.event}->${e.workflow}`, Pi = E("_voltro_workflow_events", {
+}, Ki = (e) => `${e}_${Gi()}`, qi = (e) => e.id ?? `${e.event}->${e.workflow}`, Ji = T("_voltro_workflow_events", {
 	id: v({ prefix: "wfe" }),
-	name: D(),
-	payload: S(),
-	source: D(),
-	subject: S().nullable(),
-	traceId: D().nullable(),
-	occurredAt: O().default("now")
-}).index(["name"]).index(["source"]).index(["occurredAt"]).reactive(), Fi = E("_voltro_workflow_event_deliveries", {
+	name: E(),
+	payload: C(),
+	source: E(),
+	subject: C().nullable(),
+	traceId: E().nullable(),
+	occurredAt: D().default("now")
+}).index(["name"]).index(["source"]).index(["occurredAt"]).reactive(), Yi = T("_voltro_workflow_event_deliveries", {
 	id: v({ prefix: "wfed" }),
-	eventId: D(),
-	eventName: D(),
-	triggerId: D(),
-	workflowName: D(),
-	executionId: D().nullable(),
-	status: D().oneOf([
+	eventId: E(),
+	eventName: E(),
+	triggerId: E(),
+	workflowName: E(),
+	executionId: E().nullable(),
+	status: E().oneOf([
 		"starting",
 		"started",
 		"skipped",
 		"failed"
 	]).default("starting"),
-	idempotencyKey: D().unique(),
+	idempotencyKey: E().unique(),
 	skipped: r().default(!1),
-	errorMessage: D().nullable(),
-	createdAt: O().default("now"),
-	completedAt: O().nullable()
-}).index(["eventId"]).index(["eventName"]).index(["triggerId"]).index(["workflowName"]).index(["status"]).reactive(), Ii = (e) => {
-	let t = e.makeId ?? Mi, n = /* @__PURE__ */ new Map();
+	errorMessage: E().nullable(),
+	createdAt: D().default("now"),
+	completedAt: D().nullable()
+}).index(["eventId"]).index(["eventName"]).index(["triggerId"]).index(["workflowName"]).index(["status"]).reactive(), Xi = (e) => {
+	let t = e.makeId ?? Ki, n = /* @__PURE__ */ new Map();
 	for (let t of e.triggers) {
 		let e = n.get(t.event);
 		e ? e.push(t) : n.set(t.event, [t]);
@@ -2877,7 +2956,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		});
 		let p = o(n), m = [];
 		for (let o of p) {
-			let s = Ni(o), l = o.workflow, d;
+			let s = qi(o), l = o.workflow, d;
 			try {
 				let p = o.idempotencyKey?.(f) ?? `${c}:${s}`;
 				if (o.filter && !await o.filter(f)) {
@@ -2980,11 +3059,266 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 			triggered: m
 		};
 	} };
-}, Li = M.effect(Ge.HttpClient, j.map(Ge.HttpClient, (e) => e.pipe(Ge.mapRequestEffect((e) => j.currentSpan.pipe(j.map((t) => e.headers.traceparent === void 0 ? Ke.setHeader(e, "traceparent", Ln({
+}, Zi = O({ scope: "voltro:outbox" }), X = "_voltro_outbox", Qi = {
+	kind: "typeid",
+	prefix: "obx"
+}, $i = T(X, {
+	id: v({ prefix: "obx" }),
+	effect: E(),
+	payload: C(),
+	status: E(),
+	attempts: b(),
+	maxAttempts: b(),
+	nextAttemptAt: D(),
+	idempotencyKey: E().nullable(),
+	lastError: E().nullable(),
+	subjectId: E().nullable(),
+	tenantId: E().nullable(),
+	traceId: E().nullable(),
+	createdAt: D(),
+	deliveredAt: D().nullable()
+}), ea = (e) => {
+	if (e.effect.trim() === "") throw Error("defineOutboxHandler: `effect` must be a non-empty name");
+	if (e.maxAttempts !== void 0 && e.maxAttempts < 1) throw Error(`defineOutboxHandler("${e.effect}"): maxAttempts must be >= 1`);
+	return e;
+}, ta = 8, na = (e) => ({ enqueue: async (n, r, i) => {
+	let a = (e.now ?? (() => /* @__PURE__ */ new Date()))(), o = i?.idempotencyKey;
+	if (o !== void 0) {
+		let n = (await e.store.query({
+			table: X,
+			predicate: t(u("idempotencyKey", o), u("status", "pending")),
+			order: [],
+			take: 1,
+			skip: void 0,
+			projection: void 0
+		}))[0];
+		if (n !== void 0) return n.id;
+	}
+	let s = {
+		id: f(Qi, X),
+		effect: n,
+		payload: r,
+		status: "pending",
+		attempts: 0,
+		maxAttempts: i?.maxAttempts ?? ta,
+		nextAttemptAt: new Date(a.getTime() + (i?.delayMs ?? 0)),
+		idempotencyKey: o ?? null,
+		lastError: null,
+		subjectId: e.subject.id ?? null,
+		tenantId: e.subject.tenantId ?? null,
+		traceId: e.traceId,
+		createdAt: a,
+		deliveredAt: null
+	}, c = await e.store.insert(X, s);
+	if (e.afterCommit !== void 0 && e.nudge !== void 0) {
+		let t = e.nudge;
+		e.afterCommit(async () => {
+			t();
+		});
+	}
+	return c.id ?? s.id;
+} }), ra = (e) => Math.min(1e3 * 2 ** Math.max(0, e - 1), 5 * 6e4), ia = async (e) => {
+	let n = (e.now ?? (() => /* @__PURE__ */ new Date()))(), r = await e.store.query({
+		table: X,
+		predicate: t(u("status", "pending"), ne("nextAttemptAt", n)),
+		order: [{
+			column: "nextAttemptAt",
+			direction: "asc"
+		}],
+		take: e.batchSize ?? 50,
+		skip: void 0,
+		projection: void 0
+	}), i = 0, a = 0, o = 0, s = 0;
+	for (let t of r) {
+		let r = t.id, c = t.effect, l = e.handlers.get(c);
+		if (l === void 0) {
+			s++;
+			continue;
+		}
+		let u = t.attempts + 1, d = t.maxAttempts ?? ta;
+		try {
+			await l.handler({
+				payload: t.payload ?? {},
+				attempt: u,
+				subjectId: t.subjectId ?? null,
+				tenantId: t.tenantId ?? null,
+				traceId: t.traceId ?? null
+			}), await e.store.update(X, r, {
+				status: "delivered",
+				attempts: u,
+				deliveredAt: /* @__PURE__ */ new Date(),
+				lastError: null
+			}), i++;
+		} catch (t) {
+			let i = t instanceof Error ? t.message : String(t), s = u >= d;
+			await e.store.update(X, r, {
+				status: s ? "dead" : "pending",
+				attempts: u,
+				lastError: i,
+				nextAttemptAt: new Date(n.getTime() + ra(u))
+			}), s ? (o++, Zi.error("outbox effect dead-lettered after exhausting attempts", {
+				id: r,
+				effect: c,
+				attempts: u,
+				maxAttempts: d
+			}, t)) : (a++, Zi.warn("outbox delivery failed; will retry", {
+				id: r,
+				effect: c,
+				attempt: u,
+				maxAttempts: d,
+				retryInMs: ra(u)
+			}));
+		}
+	}
+	return {
+		delivered: i,
+		failed: a,
+		dead: o,
+		skipped: s
+	};
+}, aa = "admin:full", oa = class extends I.TaggedError()("AccessDenied", {
+	action: I.String,
+	resourceType: I.String,
+	resourceId: I.String
+}) {}, sa = /* @__PURE__ */ new Map(), ca = (e) => {
+	if (typeof e.resourceType != "string" || e.resourceType.length === 0) throw Error("defineResourcePolicy: a non-empty `resourceType` is required");
+	if (e.actions === void 0 || Object.keys(e.actions).length === 0) throw Error(`resource policy '${e.resourceType}': at least one action is required`);
+	if (sa.has(e.resourceType)) throw Error(`resource policy '${e.resourceType}' is already registered — types must be unique`);
+	return sa.set(e.resourceType, e), e;
+}, la = (e) => sa.get(e), ua = () => [...sa.values()], da = () => sa.clear(), fa = () => ua().map((e) => {
+	let t = /* @__PURE__ */ new Set();
+	for (let n of Object.values(e.actions)) for (let e of n) t.add(e);
+	for (let [n, r] of Object.entries(e.implies ?? {})) {
+		t.add(n);
+		for (let e of r) t.add(e);
+	}
+	return {
+		resourceType: e.resourceType,
+		actions: e.actions,
+		relations: [...t],
+		implies: e.implies ?? {}
+	};
+}), pa = (e, t) => {
+	let n = new Set(e);
+	if (t === void 0) return n;
+	let r = [...e];
+	for (; r.length > 0;) {
+		let e = r.pop();
+		for (let i of t[e] ?? []) n.has(i) || (n.add(i), r.push(i));
+	}
+	return n;
+}, ma = (e, t, n, r) => e.id === null ? /* @__PURE__ */ new Set() : pa(n.filter((n) => n.subjectId === e.id && n.resourceType === t.type && n.resourceId === t.id).map((e) => e.relation), r.implies), ha = (e, t, n, r) => {
+	if (e.scopes?.includes("admin:full")) return !0;
+	if (e.id === null || n.tenantId != null && e.tenantId !== n.tenantId) return !1;
+	let i = r.policy.actions[t];
+	if (i === void 0 || i.length === 0) return !1;
+	let a = ma(e, n, r.tuples, r.policy);
+	return i.some((e) => a.has(e));
+}, ga = (e, t, n, r) => {
+	if (!ha(e, t, n, r)) throw new oa({
+		action: t,
+		resourceType: n.type,
+		resourceId: n.id
+	});
+}, _a = (e, t, n, r, i) => r.filter((r) => ha(e, t, {
+	type: n,
+	id: r.id,
+	...r.tenantId === void 0 ? {} : { tenantId: r.tenantId }
+}, i)), va = (e, t) => {
+	let n = new Set(t.map((e) => e.id));
+	return e.filter((e) => !n.has(e.id)).map((e) => e.id);
+}, ya = O({ scope: "voltro:policy" }), ba, xa = (e) => {
+	ba = e;
+}, Sa = () => ba, Ca = () => {
+	Me((e) => j.gen(function* () {
+		let t = la(e.resourceType);
+		if (t === void 0) return ya.warn("policy guard denied — no resource policy registered for this type", {
+			resourceType: e.resourceType,
+			action: e.action
+		}), !1;
+		let n = ba;
+		if (n === void 0) return ya.warn("policy guard denied — no tuple source registered (call setTupleSource at boot)", {
+			resourceType: e.resourceType,
+			action: e.action
+		}), !1;
+		let r = yield* j.tryPromise({
+			try: async () => n({
+				subjectId: e.subject.id,
+				resourceType: e.resourceType,
+				resourceId: e.resourceId
+			}),
+			catch: (e) => e
+		}).pipe(j.catchAll((t) => (ya.error("policy guard denied — tuple source failed", {
+			resourceType: e.resourceType,
+			resourceId: e.resourceId
+		}, t), j.succeed([])))), i = e.subject;
+		return ha({
+			id: e.subject.id,
+			tenantId: i.tenantId ?? null,
+			...i.scopes === void 0 ? {} : { scopes: i.scopes }
+		}, e.action, {
+			type: e.resourceType,
+			id: e.resourceId,
+			tenantId: i.tenantId ?? null
+		}, {
+			policy: t,
+			tuples: r
+		});
+	}));
+}, wa = (e) => {
+	Promise.resolve().then(e);
+}, Ta = (e) => {
+	let t = e.schedule ?? wa, n = /* @__PURE__ */ new Map(), r = /* @__PURE__ */ new Map(), i = (e, t) => `${e}${t}`, a = async (t) => {
+		let a = r.get(t);
+		if (a === void 0) return;
+		r.delete(t);
+		let o = [...a.ids].filter((e) => !n.has(i(t, e)));
+		try {
+			if (o.length > 0) {
+				let r = await e.store.query({
+					table: t,
+					predicate: y("id", o),
+					order: [],
+					take: void 0,
+					skip: void 0,
+					projection: void 0
+				}), a = new Map(r.map((e) => [String(e.id), e]));
+				for (let e of o) n.set(i(t, e), a.get(e) ?? null);
+			}
+			for (let e of a.waiters) e.resolve(e.ids.map((e) => n.get(i(t, e)) ?? null));
+		} catch (e) {
+			for (let t of a.waiters) t.reject(e);
+		}
+	}, o = (e, o) => {
+		if (o.length === 0) return Promise.resolve([]);
+		if (o.every((t) => n.has(i(e, t)))) return Promise.resolve(o.map((t) => n.get(i(e, t)) ?? null));
+		let s = r.get(e);
+		s === void 0 && (s = {
+			ids: /* @__PURE__ */ new Set(),
+			waiters: [],
+			scheduled: !1
+		}, r.set(e, s));
+		for (let e of o) s.ids.add(e);
+		let c = new Promise((e, t) => {
+			s.waiters.push({
+				ids: o,
+				resolve: e,
+				reject: t
+			});
+		});
+		return s.scheduled || (s.scheduled = !0, t(() => {
+			a(e);
+		})), c;
+	};
+	return {
+		load: async (e, t) => (await o(e, [t]))[0] ?? null,
+		loadMany: (e, t) => o(e, t)
+	};
+}, Ea = M.effect(qe.HttpClient, j.map(qe.HttpClient, (e) => e.pipe(qe.mapRequestEffect((e) => j.currentSpan.pipe(j.map((t) => e.headers.traceparent === void 0 ? Je.setHeader(e, "traceparent", Vn({
 	traceId: t.traceId,
 	spanId: t.spanId,
 	sampled: t.sampled
-})) : e), j.catchAll(() => j.succeed(e))))))), Ri = "voltro/audit", zi = "voltro/softDelete", Bi = "voltro/tenant", Vi = (e) => {
+})) : e), j.catchAll(() => j.succeed(e))))))), Da = "voltro/audit", Oa = "voltro/softDelete", ka = "voltro/tenant", Aa = (e) => {
 	let t = /* @__PURE__ */ new Map();
 	for (let n of e) {
 		let e = /* @__PURE__ */ new Set();
@@ -3027,48 +3361,49 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 			return !1;
 		},
 		idScheme: (e) => t.get(e)?.idScheme,
-		defaultFactories: (e) => t.get(e)?.defaultFactories ?? Hi,
-		computedFields: (e) => t.get(e)?.computedFields ?? Ui,
+		defaultFactories: (e) => t.get(e)?.defaultFactories ?? ja,
+		computedFields: (e) => t.get(e)?.computedFields ?? Ma,
 		insertSchema: (e) => t.get(e)?.insertSchema,
 		validatePatchSchema: (e) => t.get(e)?.validatePatchSchema
 	};
-}, Hi = /* @__PURE__ */ new Map(), Ui = /* @__PURE__ */ new Map(), Wi = Vi([]), Gi = class extends Error {
-	table;
-	_tag = "NoRowFound";
-	constructor(e) {
-		super(`expected exactly one row in '${e}', found none`), this.table = e, this.name = "NoRowFound";
+}, ja = /* @__PURE__ */ new Map(), Ma = /* @__PURE__ */ new Map(), Na = Aa([]), Pa = class extends I.TaggedError()("NoRowFound", {
+	table: I.String,
+	found: I.Number
+}) {
+	get message() {
+		return this.found === 0 ? `expected exactly one row in '${this.table}', found none` : `expected exactly one row in '${this.table}', found more than one`;
 	}
-}, Ki = class extends Error {
-	table;
-	expected;
-	_tag = "OptimisticLockError";
-	constructor(e, t) {
-		super(`optimistic lock failed on '${e}': expected version ${t}`), this.table = e, this.expected = t, this.name = "OptimisticLockError";
+}, Fa = class extends I.TaggedError()("OptimisticLockError", {
+	table: I.String,
+	expected: I.Number
+}) {
+	get message() {
+		return `optimistic lock failed on '${this.table}': expected version ${this.expected}`;
 	}
-}, qi = (e) => typeof e == "object" && !!e && ("and" in e || "or" in e || "not" in e || "op" in e || "subquery" in e), Ji = (e) => {
-	if (e.length === 1 && qi(e[0])) return e[0];
+}, Ia = (e) => typeof e == "object" && !!e && ("and" in e || "or" in e || "not" in e || "op" in e || "subquery" in e), La = (e) => {
+	if (e.length === 1 && Ia(e[0])) return e[0];
 	let t = e[0];
 	if (e.length === 2) return u(t, e[1]);
 	let n = e[1], r = e[2];
 	switch (n) {
 		case "=": return u(t, r);
 		case "!=":
-		case "<>": return te(t, r);
+		case "<>": return w(t, r);
 		case ">": return h(t, r);
 		case ">=": return g(t, r);
-		case "<": return w(t, r);
-		case "<=": return ee(t, r);
+		case "<": return te(t, r);
+		case "<=": return ne(t, r);
 		case "in": return y(t, r);
 		case "like":
 		case "contains":
 		case "fts": return o(t, r);
 		default: return u(t, r);
 	}
-}, Yi = (e) => {
+}, Ra = (e) => {
 	let t = m(e);
 	if (t === void 0) throw Error(`unknown table '${e}' — is it declared with table()?`);
-	return ne(t);
-}, Xi = class e {
+	return ie(t);
+}, za = class e {
 	backend;
 	scope;
 	table;
@@ -3082,7 +3417,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		return new e(this.backend, this.scope, this.table, t, this.skipTenant, this.skipSoftDelete);
 	}
 	where(...e) {
-		return this.clone(this.query.where(Ji(e)));
+		return this.clone(this.query.where(La(e)));
 	}
 	orderBy(e, t = "asc") {
 		return this.clone(this.query.orderBy(e, t));
@@ -3116,7 +3451,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 	}
 	scopedQuery() {
 		let e = this.query, { subject: t, schemaRegistry: n } = this.scope;
-		return !this.skipTenant && n.hasTenant(this.table) && t.tenantId != null && (e = e.where(u("tenantId", t.tenantId))), !this.skipSoftDelete && n.hasSoftDelete(this.table) && (e = e.where(x("deletedAt"))), e;
+		return !this.skipTenant && n.hasTenant(this.table) && t.tenantId != null && (e = e.where(u("tenantId", t.tenantId))), !this.skipSoftDelete && n.hasSoftDelete(this.table) && (e = e.where(S("deletedAt"))), e;
 	}
 	async all() {
 		return this.backend.query(this.scopedQuery().descriptor);
@@ -3128,9 +3463,16 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		return this.maybeOne();
 	}
 	async one() {
-		let e = await this.maybeOne();
-		if (e === null) throw new Gi(this.table);
-		return e;
+		let e = await this.backend.query(this.scopedQuery().limit(2).descriptor), t = e[0];
+		if (t === void 0) throw new Pa({
+			table: this.table,
+			found: 0
+		});
+		if (e.length > 1) throw new Pa({
+			table: this.table,
+			found: e.length
+		});
+		return t;
 	}
 	async count() {
 		let e = (await this.backend.query(this.scopedQuery().count().descriptor))[0]?.count;
@@ -3142,7 +3484,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 	get descriptor() {
 		return this.scopedQuery().descriptor;
 	}
-}, Zi = class {
+}, Ba = class {
 	backend;
 	scope;
 	table;
@@ -3153,7 +3495,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		this.backend = e, this.scope = t, this.table = n;
 	}
 	where(...e) {
-		let n = Ji(e);
+		let n = La(e);
 		return this.predicate = this.predicate ? t(this.predicate, n) : n, this;
 	}
 	unscoped() {
@@ -3177,13 +3519,16 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 	}
 	async set(e) {
 		let t = await this.backend.updateMany(this.table, e, { where: this.scopedWhere() });
-		if (this.expectedVersion !== void 0 && t === 0) throw new Ki(this.table, this.expectedVersion);
+		if (this.expectedVersion !== void 0 && t === 0) throw new Fa({
+			table: this.table,
+			expected: this.expectedVersion
+		});
 		return t;
 	}
 	async restore() {
 		return this.backend.updateMany(this.table, { deletedAt: null }, { where: this.scopedWhere() });
 	}
-}, Qi = class {
+}, Va = class {
 	backend;
 	scope;
 	table;
@@ -3193,7 +3538,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		this.backend = e, this.scope = t, this.table = n;
 	}
 	where(...e) {
-		let n = Ji(e);
+		let n = La(e);
 		return this.predicate = this.predicate ? t(this.predicate, n) : n, this;
 	}
 	unscoped() {
@@ -3214,46 +3559,32 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 	async hard() {
 		return this.backend.deleteMany(this.table, { where: this.scopedWhere() });
 	}
-}, $i = (e, t) => ({
-	select: (n) => new Xi(e, t, n, Yi(n)),
-	updateWhere: (n) => new Zi(e, t, n),
-	deleteWhere: (n) => new Qi(e, t, n)
-}), ea = class extends I.TaggedError()("TenantScopeViolation", {
-	table: I.String,
-	reason: I.String
-}) {}, ta = class extends I.TaggedError()("StoreOperationFailed", {
-	operation: I.String,
-	table: I.String,
-	cause: I.String
-}) {}, na = class extends I.TaggedError()("TableValidationFailed", {
-	table: I.String,
-	summary: I.String,
-	issues: I.Array(I.Struct({
-		path: I.String,
-		message: I.String
-	}))
-}) {}, ra = "id", ia = (e, t) => {
+}, Ha = (e, t) => ({
+	select: (n) => new za(e, t, n, Ra(n)),
+	updateWhere: (n) => new Ba(e, t, n),
+	deleteWhere: (n) => new Va(e, t, n)
+}), Ua = "id", Wa = (e, t) => {
 	let n = {};
 	for (let r of t) e[r] !== void 0 && (n[r] = e[r]);
 	return n;
-}, aa = "cannot insert into tenant-scoped table without an authenticated tenant — subject.tenantId is null. Either authenticate first or pass tenantId explicitly in the row (admin tooling).", oa = (e) => {
-	throw new ea({
+}, Ga = "cannot insert into tenant-scoped table without an authenticated tenant — subject.tenantId is null. Either authenticate first or pass tenantId explicitly in the row (admin tooling).", Ka = (e) => {
+	throw new wi({
 		table: e,
-		reason: aa
+		reason: Ga
 	});
-}, sa = (e, n) => {
+}, qa = (e, n) => {
 	let r = n.subject.id, i = n.subject.tenantId, a = (e, t) => {
 		let a = { ...t }, o = n.schemaRegistry, s = o.idScheme(e);
-		if (s !== void 0 && a[ra] == null) if (s.kind === "numeric") delete a[ra];
+		if (s !== void 0 && a[Ua] == null) if (s.kind === "numeric") delete a[Ua];
 		else {
 			let t = f(s, e);
-			t !== null && (a[ra] = t);
+			t !== null && (a[Ua] = t);
 		}
 		if (o.hasAudit(e)) {
 			let e = /* @__PURE__ */ new Date();
 			"createdAt" in a || (a.createdAt = e), "updatedAt" in a || (a.updatedAt = e), r !== null && ("createdBy" in a || (a.createdBy = r), "updatedBy" in a || (a.updatedBy = r));
 		}
-		o.hasTenant(e) && ("tenantId" in a || (i === null && oa(e), a.tenantId = i));
+		o.hasTenant(e) && ("tenantId" in a || (i === null && Ka(e), a.tenantId = i));
 		let c = o.defaultFactories(e);
 		if (c.size > 0) for (let [e, t] of c) (!(e in a) || a[e] === void 0) && (a[e] = t());
 		let l = o.computedFields(e);
@@ -3268,10 +3599,10 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		try {
 			return await r();
 		} catch (n) {
-			let r = Rt(n);
-			if (zt(r)) {
+			let r = Bt(n);
+			if (Vt(r)) {
 				let n = t.tenantId, i = `${r.dbConstraint ?? ""} ${r.dbColumn ?? ""} ${r.dbMessage ?? ""} ${r.dbCauseChain ?? ""}`.toLowerCase();
-				if (i.includes("tenantid") || /\btenants\b/.test(i) || n != null && i.includes(String(n).toLowerCase())) throw new ea({
+				if (i.includes("tenantid") || /\btenants\b/.test(i) || n != null && i.includes(String(n).toLowerCase())) throw new wi({
 					table: e,
 					reason: n == null ? "write references a tenant that does not exist" : `tenant '${String(n)}' does not exist — seed the row in \`tenants\`, or fix how the request resolved this tenant (subject.tenantId / the x-tenant header / the dev TENANT fallback)`
 				});
@@ -3292,11 +3623,11 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		if (r === void 0) return t;
 		let i = I.decodeUnknownEither(r)(t);
 		if (i._tag === "Right") return t;
-		let a = ht.formatErrorSync(i.left).map((e) => ({
+		let a = _t.formatErrorSync(i.left).map((e) => ({
 			path: e.path.length === 0 ? "<root>" : e.path.join("."),
 			message: e.message
 		})), o = a[0];
-		throw new na({
+		throw new Ei({
 			table: e,
 			summary: o === void 0 ? "patch validation failed" : `${o.path}: ${o.message}`,
 			issues: a
@@ -3309,29 +3640,29 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		if (r === void 0) return t;
 		let i = I.decodeUnknownEither(r)(t);
 		if (i._tag === "Right") return t;
-		let a = ht.formatErrorSync(i.left).map((e) => ({
+		let a = _t.formatErrorSync(i.left).map((e) => ({
 			path: e.path.length === 0 ? "<root>" : e.path.join("."),
 			message: e.message
 		})), o = a[0];
-		throw new na({
+		throw new Ei({
 			table: e,
 			summary: o === void 0 ? "row validation failed" : `${o.path}: ${o.message}`,
 			issues: a
 		});
 	}, v = n.dialect, y = (e, t) => {
 		let n = m(e);
-		return l(v ? oe(t, n, v) : t, n, Kr());
+		return l(v ? ce(t, n, v) : t, n, Xr());
 	}, b = (e, t) => {
-		let n = m(e), r = s(t, n, Kr());
+		let n = m(e), r = s(t, n, Xr());
 		return v ? c(r, n, v) : r;
-	}, S = (e) => {
+	}, x = (e) => {
 		let r = e.table, a = e.predicate;
 		if (!e.crossTenant && i != null && n.schemaRegistry.hasTenant(r)) {
 			let e = u("tenantId", i);
 			a = a ? t(a, e) : e;
 		}
 		if (!e.includeDeleted && n.schemaRegistry.hasSoftDelete(r)) {
-			let e = x("deletedAt");
+			let e = S("deletedAt");
 			a = a ? t(a, e) : e;
 		}
 		return a === e.predicate ? e : {
@@ -3341,13 +3672,13 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 	}, C = async (t) => {
 		let n = await e.query(t);
 		return b(t.table, n);
-	}, w = async (e) => C(S(e)), ee = async (t, r, i) => {
+	}, ee = async (e) => C(x(e)), te = async (t, r, i) => {
 		let a = o(t, i);
 		if (n.schemaRegistry.computedFields(t).size > 0) {
 			let n = (await e.query({
 				table: t,
 				predicate: {
-					column: ra,
+					column: Ua,
 					op: "eq",
 					value: r
 				},
@@ -3362,23 +3693,23 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		a = h(t, a);
 		let s = await e.update(t, r, y(t, a));
 		return s === null ? null : b(t, [s])[0];
-	}, te = async (t, r) => n.schemaRegistry.hasSoftDelete(t) ? await e.update(t, r, g()) !== null : e.delete(t, r), T = async (t, n, r) => e.updateMany(t, y(t, o(t, n)), r), ne = async (t, n) => e.deleteMany(t, n), re = (e, r) => i != null && n.schemaRegistry.hasTenant(e) ? t(r, u("tenantId", i)) : r, ie = async (e, t, n) => T(e, t, {
+	}, ne = async (t, r) => n.schemaRegistry.hasSoftDelete(t) ? await e.update(t, r, g()) !== null : e.delete(t, r), w = async (t, n, r) => e.updateMany(t, y(t, o(t, n)), r), re = async (t, n) => e.deleteMany(t, n), ie = (e, r) => i != null && n.schemaRegistry.hasTenant(e) ? t(r, u("tenantId", i)) : r, ae = async (e, t, n) => w(e, t, {
 		...n,
-		where: re(e, n.where)
-	}), ae = async (e, t) => ne(e, {
+		where: ie(e, n.where)
+	}), oe = async (e, t) => re(e, {
 		...t,
-		where: re(e, t.where)
-	}), se = $i({
+		where: ie(e, t.where)
+	}), se = Ha({
 		query: C,
-		updateMany: T,
-		deleteMany: ne,
+		updateMany: w,
+		deleteMany: re,
 		delete: (t, n) => e.delete(t, n)
 	}, {
 		subject: n.subject,
 		schemaRegistry: n.schemaRegistry
 	});
 	return {
-		query: w,
+		query: ee,
 		insert: async (t, n) => {
 			let r = a(t, n), i = await d(t, r, () => e.insert(t, y(t, _(t, r))));
 			return b(t, [i])[0];
@@ -3392,12 +3723,12 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 			return a === null ? null : b(t, [a])[0];
 		},
 		select: se.select,
-		update: ((e, t, n) => t === void 0 ? se.updateWhere(e) : ee(e, t, n)),
-		delete: ((e, t) => t === void 0 ? se.deleteWhere(e) : te(e, t)),
-		applyDefined: ia,
+		update: ((e, t, n) => t === void 0 ? se.updateWhere(e) : te(e, t, n)),
+		delete: ((e, t) => t === void 0 ? se.deleteWhere(e) : ne(e, t)),
+		applyDefined: Wa,
 		hardDelete: async (t, n) => e.delete(t, n),
-		updateMany: ie,
-		deleteMany: ae,
+		updateMany: ae,
+		deleteMany: oe,
 		upsert: async (t, n, r) => {
 			let i = a(t, n), o = await d(t, i, () => e.upsert(t, y(t, _(t, i)), r));
 			return b(t, [o])[0];
@@ -3406,34 +3737,34 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 			let i = a(t, n), o = await d(t, i, () => e.insertIgnore(t, y(t, _(t, i)), r));
 			return b(t, [o])[0];
 		},
-		transactional: (t) => e.transactional(async (e) => t(sa(e, n))),
+		transactional: (t) => e.transactional(async (e) => t(qa(e, n))),
 		...e.raw ? { raw: e.raw.bind(e) } : {},
 		onChange: (t) => e.onChange(t),
 		injectExternalChange: (t) => e.injectExternalChange(t),
 		...e.changeScope === void 0 ? {} : { changeScope: e.changeScope }
 	};
-}, ca = class extends I.TaggedError()("CircuitOpen", {
+}, Ja = class extends I.TaggedError()("CircuitOpen", {
 	name: I.String,
 	retryAfterMs: I.Number
-}) {}, la = {
+}) {}, Ya = {
 	tag: "closed",
 	failureCount: 0,
 	halfOpenSuccesses: 0,
 	openedAt: 0
-}, ua = { make: (e) => j.gen(function* () {
-	let t = e.name ?? "circuit", n = Ie.toMillis(Ie.decode(e.resetTimeout)), r = e.halfOpenSuccessThreshold ?? 1, i = e.isFailure ?? (() => !0), a = yield* F.make(la), o = j.gen(function* () {
+}, Xa = { make: (e) => j.gen(function* () {
+	let t = e.name ?? "circuit", n = Re.toMillis(Re.decode(e.resetTimeout)), r = e.halfOpenSuccessThreshold ?? 1, i = e.isFailure ?? (() => !0), a = yield* F.make(Ya), o = j.gen(function* () {
 		let e = yield* F.get(a);
 		if (e.tag === "half-open") {
 			let t = e.halfOpenSuccesses + 1;
-			yield* F.set(a, t >= r ? la : {
+			yield* F.set(a, t >= r ? Ya : {
 				...e,
 				halfOpenSuccesses: t
 			});
 			return;
 		}
-		e.failureCount !== 0 && (yield* F.set(a, la));
+		e.failureCount !== 0 && (yield* F.set(a, Ya));
 	}), s = j.gen(function* () {
-		let t = yield* Ne.currentTimeMillis, n = yield* F.get(a);
+		let t = yield* Fe.currentTimeMillis, n = yield* F.get(a);
 		if (n.tag === "half-open" || n.tag === "open") {
 			yield* F.set(a, {
 				tag: "open",
@@ -3456,7 +3787,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 	}), c = j.gen(function* () {
 		let e = yield* F.get(a);
 		if (e.tag !== "open") return null;
-		let t = (yield* Ne.currentTimeMillis) - e.openedAt;
+		let t = (yield* Fe.currentTimeMillis) - e.openedAt;
 		return t >= n ? (yield* F.set(a, {
 			tag: "half-open",
 			failureCount: 0,
@@ -3469,7 +3800,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 			if (k.isInterruptedOnly(e)) return j.void;
 			let t = k.failureOption(e), n = t._tag === "Some" ? t.value : void 0;
 			return i(n) ? s : j.void;
-		})) : yield* j.fail(new ca({
+		})) : yield* j.fail(new Ja({
 			name: t,
 			retryAfterMs: n
 		}));
@@ -3478,38 +3809,25 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		value: F.get(a).pipe(j.map((e) => e.tag)),
 		enumerable: !0
 	}), Object.defineProperty(u, "reset", {
-		value: F.set(a, la),
+		value: F.set(a, Ya),
 		enumerable: !0
 	}), u;
-}) }, da, fa = (e) => {
-	da = e;
-}, pa = () => {
-	da = void 0;
-}, ma = async (e, t = {}) => {
-	let n = t.scopes === void 0 ? Ae(t.id ?? "system") : Ae(t.id ?? "system", t.scopes), r = t.store ?? da?.dataStore, i = t.schemaRegistry ?? da?.schemaRegistry, a = t.dialect ?? da?.dialect;
+}) }, Za, Qa = (e) => {
+	Za = e;
+}, $a = () => {
+	Za = void 0;
+}, eo = async (e, t = {}) => {
+	let n = t.scopes === void 0 ? Ne(t.id ?? "system") : Ne(t.id ?? "system", t.scopes), r = t.store ?? Za?.dataStore, i = t.schemaRegistry ?? Za?.schemaRegistry, a = t.dialect ?? Za?.dialect;
 	if (r === void 0 || i === void 0) throw Error("runAsSystem: no data store available — register one at boot via setSystemStoreHandle({ dataStore, schemaRegistry }) or pass { store, schemaRegistry } in the options.");
 	return e({
 		subject: n,
-		store: sa(r, {
+		store: qa(r, {
 			subject: n,
 			schemaRegistry: i,
 			...a === void 0 ? {} : { dialect: a }
 		})
 	});
-}, ha = class extends Pe.Tag("@voltro/EffectStore")() {}, ga = (e, t) => (n) => n instanceof ea ? n : new ta({
-	operation: e,
-	table: t,
-	cause: String(n)
-}), _a = (e, t, n) => j.tryPromise({
-	try: n,
-	catch: ga(e, t)
-}), va = (e) => M.succeed(ha, {
-	query: (t) => _a("query", t.table, () => e.query(t)),
-	insert: (t, n) => _a("insert", t, () => e.insert(t, n)),
-	update: (t, n, r) => _a("update", t, () => e.update(t, n, r)),
-	delete: (t, n) => _a("delete", t, () => e.delete(t, n)),
-	hardDelete: (t, n) => _a("hardDelete", t, () => e.hardDelete(t, n))
-}), ya = (e) => {
+}, to = (e) => {
 	let { currentRegion: t, replicaRegions: n, inner: r } = e, i = (e) => {
 		if (t === void 0) return {
 			sameRegion: [],
@@ -3537,7 +3855,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 			return r.loadSnapshot();
 		}
 	};
-}, ba = (e = process.env) => {
+}, no = (e = process.env) => {
 	for (let t of [
 		"VOLTRO_REGION",
 		"AWS_REGION",
@@ -3549,7 +3867,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		let n = e[t];
 		if (typeof n == "string" && n.length > 0) return n;
 	}
-}, xa = () => {
+}, ro = () => {
 	let e = {
 		primary: 0,
 		lagByReplica: /* @__PURE__ */ new Map()
@@ -3574,27 +3892,27 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 			e.lagByReplica.set(t, n);
 		}
 	};
-}, Sa = Symbol.for("@voltro/ScheduleDefinition"), Ca = (e) => typeof e == "object" && !!e && Sa in e, wa = 30 * 6e4, Ta = (e) => {
+}, io = Symbol.for("@voltro/ScheduleDefinition"), ao = (e) => typeof e == "object" && !!e && io in e, oo = 30 * 6e4, so = (e) => {
 	let t = A.parse(e.cron, e.timezone);
-	if (Le.isLeft(t)) throw Error(`defineSchedule("${e.name}"): invalid cron expression "${e.cron}" (tz="${e.timezone}") — ${String(t.left)}`);
+	if (ze.isLeft(t)) throw Error(`defineSchedule("${e.name}"): invalid cron expression "${e.cron}" (tz="${e.timezone}") — ${String(t.left)}`);
 	if (!e.timezone || e.timezone.trim() === "") throw Error(`defineSchedule("${e.name}"): timezone is required (e.g. "UTC", "Europe/Berlin")`);
 	if (e.handler === void 0 && e.workflow === void 0) throw Error(`defineSchedule("${e.name}"): define either handler or workflow`);
 	return {
 		...e,
 		onOverlap: e.onOverlap ?? "skip",
 		backfill: e.backfill ?? "skip",
-		maxRuntimeMs: e.maxRuntimeMs ?? wa,
-		[Sa]: !0
+		maxRuntimeMs: e.maxRuntimeMs ?? oo,
+		[io]: !0
 	};
-}, Ea = (e) => A.unsafeParse(e.cron, e.timezone), Da = (e, t = /* @__PURE__ */ new Date()) => A.next(Ea(e), t), Z = "_voltro_wakeups", Oa = (e) => `${e.tenantId}:${e.kind}:${e.refId}`, ka = (e) => ({
+}, co = (e) => A.unsafeParse(e.cron, e.timezone), lo = (e, t = /* @__PURE__ */ new Date()) => A.next(co(e), t), Z = "_voltro_wakeups", uo = (e) => `${e.tenantId}:${e.kind}:${e.refId}`, fo = (e) => ({
 	tenantId: String(e.tenantId),
 	kind: String(e.kind),
 	refId: String(e.refId),
 	wakeAt: e.wakeAt instanceof Date ? e.wakeAt : new Date(String(e.wakeAt)),
 	status: e.status === "fired" ? "fired" : "pending"
-}), Aa = async (e, t) => {
+}), po = async (e, t) => {
 	await e.upsert(Z, {
-		id: Oa(t),
+		id: uo(t),
 		tenantId: t.tenantId,
 		kind: t.kind,
 		refId: t.refId,
@@ -3604,7 +3922,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		conflictColumns: ["id"],
 		update: ["wakeAt", "status"]
 	});
-}, ja = async (e, t) => e.delete(Z, Oa(t)), Ma = async (e, t) => await e.update(Z, Oa(t), { status: "fired" }) !== null, Na = (e, t) => ({ and: [{
+}, mo = async (e, t) => e.delete(Z, uo(t)), ho = async (e, t) => await e.update(Z, uo(t), { status: "fired" }) !== null, go = (e, t) => ({ and: [{
 	column: "id",
 	op: "eq",
 	value: e
@@ -3612,16 +3930,16 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 	column: "status",
 	op: "eq",
 	value: t
-}] }), Pa = async (e, t) => await e.updateMany(Z, { status: "fired" }, { where: Na(Oa(t), "pending") }) > 0, Fa = async (e, t) => {
-	await e.updateMany(Z, { status: "pending" }, { where: Na(Oa(t), "fired") });
-}, Ia = {
+}] }), _o = async (e, t) => await e.updateMany(Z, { status: "fired" }, { where: go(uo(t), "pending") }) > 0, vo = async (e, t) => {
+	await e.updateMany(Z, { status: "pending" }, { where: go(uo(t), "fired") });
+}, yo = {
 	column: "status",
 	op: "eq",
 	value: "pending"
-}, La = async (e, t) => {
+}, bo = async (e, t) => {
 	let n = {
 		table: Z,
-		predicate: Ia,
+		predicate: yo,
 		order: [{
 			column: "wakeAt",
 			direction: "asc"
@@ -3630,18 +3948,18 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		skip: void 0,
 		projection: void 0
 	};
-	return (await e.query(n)).map(ka);
-}, Ra = async (e, t, n = 500) => {
-	let r = await La(e, n), i = t.getTime();
+	return (await e.query(n)).map(fo);
+}, xo = async (e, t, n = 500) => {
+	let r = await bo(e, n), i = t.getTime();
 	return r.filter((e) => e.wakeAt.getTime() <= i);
-}, za = async (e) => (await La(e, 1))[0] ?? null, Ba = {
+}, So = async (e) => (await bo(e, 1))[0] ?? null, Co = {
 	column: "status",
 	op: "eq",
 	value: "fired"
-}, Va = async (e, t = {}) => {
+}, wo = async (e, t = {}) => {
 	let n = {
 		table: Z,
-		predicate: Ba,
+		predicate: Co,
 		order: [{
 			column: "wakeAt",
 			direction: "asc"
@@ -3652,12 +3970,12 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 	}, r = await e.query(n), i = t.firedOlderThan?.getTime(), a = 0;
 	for (let t of r) i !== void 0 && (t.wakeAt instanceof Date ? t.wakeAt : new Date(String(t.wakeAt))).getTime() >= i || await e.delete(Z, String(t.id)) && a++;
 	return a;
-}, Ha = {
+}, To = {
 	kind: "single",
 	tryClaim: async () => !0
-}, Ua = "_voltro_schedule_claims", Wa = (e, t, n) => {
+}, Eo = "_voltro_schedule_claims", Do = (e, t, n) => {
 	let r = async (t) => (await e.query({
-		table: Ua,
+		table: Eo,
 		order: [],
 		predicate: void 0,
 		projection: ["id"],
@@ -3672,7 +3990,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 				if (await r(s)) return !1;
 			} catch {}
 			try {
-				return await e.insert(Ua, {
+				return await e.insert(Eo, {
 					id: s,
 					scheduleName: i,
 					bucket: o,
@@ -3690,12 +4008,12 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 			}
 		}
 	};
-}, Ga = "_voltro_schedule_runs", Ka = async (e, t) => {
+}, Oo = "_voltro_schedule_runs", ko = async (e, t) => {
 	let { store: n, coordinator: r, buildContext: i, replicaId: a, log: o, onRunEvent: s, interceptFire: c } = t, l = t.dormancy === "sleep", u = t.dormancyTenantId ?? "default", d = /* @__PURE__ */ new Map(), f = /* @__PURE__ */ new Set(), p = /* @__PURE__ */ new Map(), m = !1, h = new Map(e.map((e) => [e.name, e])), g = (e, t) => {
-		s?.(e, Ja(t));
+		s?.(e, jo(t));
 	}, _ = async (e, t, r, i, s, c) => {
 		try {
-			let o = `sr_${pe()}`, l = await n.insert(Ga, {
+			let o = `sr_${he()}`, l = await n.insert(Oo, {
 				id: o,
 				name: e.name,
 				status: i,
@@ -3720,7 +4038,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		}
 	}, v = async (e, t) => {
 		try {
-			let r = await n.update(Ga, e, t);
+			let r = await n.update(Oo, e, t);
 			r && g("update", r);
 		} catch (t) {
 			o.warn("schedule: failed to record run finish", {
@@ -3731,7 +4049,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 	}, y = async (e) => {
 		try {
 			let t = await n.query({
-				table: Ga,
+				table: Oo,
 				predicate: {
 					_tag: "leaf",
 					column: "status",
@@ -3796,7 +4114,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 			let n = Q(t).includes("exceeded maxRuntimeMs");
 			s && await v(s, {
 				status: "failed",
-				errorTag: n ? "timeout" : qa(t),
+				errorTag: n ? "timeout" : Ao(t),
 				errorMessage: Q(t),
 				completedAt: /* @__PURE__ */ new Date(),
 				durationMs: Date.now() - l
@@ -3804,7 +4122,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 				name: e.name,
 				reason: Q(t),
 				timeout: n
-			}), Oe({
+			}), Ae({
 				error: t,
 				source: "schedule",
 				name: e.name,
@@ -3853,8 +4171,8 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		}
 	}, C = async (e) => {
 		try {
-			let t = A.next(Ea(e), /* @__PURE__ */ new Date());
-			await Aa(n, {
+			let t = A.next(co(e), /* @__PURE__ */ new Date());
+			await po(n, {
 				tenantId: u,
 				kind: "schedule",
 				refId: e.name,
@@ -3866,13 +4184,13 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 				reason: Q(t)
 			});
 		}
-	}, w = 2147483647, ee = (e) => {
+	}, ee = 2147483647, te = (e) => {
 		if (m) return;
-		let n = Ea(e), r = A.next(n, /* @__PURE__ */ new Date()), i = () => {
+		let n = co(e), r = A.next(n, /* @__PURE__ */ new Date()), i = () => {
 			if (m) return;
 			let n = r.getTime() - Date.now();
-			if (n > w) {
-				let t = setTimeout(i, w);
+			if (n > ee) {
+				let t = setTimeout(i, ee);
 				d.set(e.name, t);
 				return;
 			}
@@ -3880,17 +4198,17 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 				x(e, r, e.trigger ?? t.defaultTrigger).catch((t) => o.warn("schedule: fire rejected", {
 					name: e.name,
 					reason: Q(t)
-				})).finally(() => ee(e));
+				})).finally(() => te(e));
 			}, Math.max(0, n));
 			d.set(e.name, a);
 		};
 		i();
-	}, te = async (e) => {
+	}, ne = async (e) => {
 		if (e.backfill === "skip") return;
 		let r;
 		try {
 			let t = (await n.query({
-				table: Ga,
+				table: Oo,
 				order: [{
 					column: "scheduledAt",
 					direction: "desc"
@@ -3909,7 +4227,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 			return;
 		}
 		if (!r) return;
-		let i = Ea(e), a = [], s = A.next(i, r), c = Date.now();
+		let i = co(e), a = [], s = A.next(i, r), c = Date.now();
 		for (; s.getTime() < c && a.length < 1e3;) a.push(s), s = A.next(i, s);
 		if (a.length !== 0) if (o.info("schedule: backfill", {
 			name: e.name,
@@ -3920,20 +4238,20 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 			let n = a[a.length - 1];
 			await x(e, n, e.trigger ?? t.defaultTrigger);
 		} else for (let n of a) await x(e, n, e.trigger ?? t.defaultTrigger);
-	}, T = e.filter((e) => (e.trigger ?? t.defaultTrigger) === "self");
+	}, w = e.filter((e) => (e.trigger ?? t.defaultTrigger) === "self");
 	o.info("scheduler: starting", {
 		total: e.length,
-		self: T.length,
-		external: e.length - T.length,
+		self: w.length,
+		external: e.length - w.length,
 		coordinator: r.kind
 	});
-	let ne = (t.armSelf ?? !0) && !l;
+	let re = (t.armSelf ?? !0) && !l;
 	if (l) {
-		o.info("scheduler: sleep mode — registering wakeups, not arming timers", { count: T.length });
-		for (let e of T) await C(e);
-	} else if (ne) {
-		for (let e of T) await te(e);
-		for (let e of T) ee(e);
+		o.info("scheduler: sleep mode — registering wakeups, not arming timers", { count: w.length });
+		for (let e of w) await C(e);
+	} else if (re) {
+		for (let e of w) await ne(e);
+		for (let e of w) te(e);
 	}
 	return {
 		fireNow: async (e, t) => {
@@ -3954,11 +4272,11 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 			d.clear(), o.info("scheduler: stopped");
 		}
 	};
-}, Q = (e) => e?.message ?? String(e), qa = (e) => e && typeof e == "object" && "_tag" in e ? String(e._tag) : null, Ja = (e) => {
+}, Q = (e) => e?.message ?? String(e), Ao = (e) => e && typeof e == "object" && "_tag" in e ? String(e._tag) : null, jo = (e) => {
 	let t = {};
 	for (let [n, r] of Object.entries(e)) t[n] = r instanceof Date ? r.toISOString() : r;
 	return t;
-}, Ya = (e, t, n, r) => {
+}, Mo = (e, t, n, r) => {
 	let i = !1, a, o = async () => {
 		if (i) return;
 		let a = new Date(Math.floor(Date.now() / t) * t), o = !1;
@@ -3988,96 +4306,96 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 			i || (i = !0, a && clearInterval(a), a = void 0);
 		}
 	};
-}, Xa = (e) => (t, n, r) => Ya(t, n, r, e), Za = E("_voltro_schedule_runs", {
+}, No = (e) => (t, n, r) => Mo(t, n, r, e), Po = T("_voltro_schedule_runs", {
 	id: v({ prefix: "schrun" }),
-	name: D(),
-	status: D().oneOf([
+	name: E(),
+	status: E().oneOf([
 		"running",
 		"succeeded",
 		"failed",
 		"skipped",
 		"missed"
 	]).default("running"),
-	trigger: D().oneOf([
+	trigger: E().oneOf([
 		"self",
 		"external",
 		"manual"
 	]).default("self"),
-	scheduledAt: O(),
-	firedAt: O().nullable(),
-	completedAt: O().nullable(),
+	scheduledAt: D(),
+	firedAt: D().nullable(),
+	completedAt: D().nullable(),
 	durationMs: b().nullable(),
-	errorTag: D().nullable(),
-	errorMessage: D().nullable(),
-	coordinationOutcome: D().oneOf([
+	errorTag: E().nullable(),
+	errorMessage: E().nullable(),
+	coordinationOutcome: E().oneOf([
 		"single",
 		"wonLock",
 		"lostLock",
 		"external",
 		"cluster"
 	]).nullable(),
-	replicaId: D().nullable(),
-	result: S().nullable()
-}).index(["name", "scheduledAt"]).index(["status"]), Qa = E("_voltro_schedule_claims", {
+	replicaId: E().nullable(),
+	result: C().nullable()
+}).index(["name", "scheduledAt"]).index(["status"]), Fo = T("_voltro_schedule_claims", {
 	id: v({ prefix: "schclaim" }),
-	scheduleName: D(),
-	bucket: D(),
-	claimedBy: D(),
-	claimedAt: O()
-}).index(["scheduleName", "bucket"]).index(["claimedAt"]), $a = E("_voltro_traces", {
+	scheduleName: E(),
+	bucket: E(),
+	claimedBy: E(),
+	claimedAt: D()
+}).index(["scheduleName", "bucket"]).index(["claimedAt"]), Io = T("_voltro_traces", {
 	id: v({ prefix: "span" }),
-	traceId: D(),
-	spanId: D(),
-	parentSpanId: D().nullable(),
-	name: D(),
-	kind: D().oneOf([
+	traceId: E(),
+	spanId: E(),
+	parentSpanId: E().nullable(),
+	name: E(),
+	kind: E().oneOf([
 		"internal",
 		"server",
 		"client",
 		"producer",
 		"consumer"
 	]).default("internal"),
-	status: D().oneOf([
+	status: E().oneOf([
 		"ok",
 		"error",
 		"unset"
 	]).default("unset"),
-	statusMessage: D().nullable(),
-	startedAt: O(),
-	endedAt: O(),
+	statusMessage: E().nullable(),
+	startedAt: D(),
+	endedAt: D(),
 	durationMs: b(),
-	attributes: S().nullable(),
-	events: S().nullable()
-}).index(["traceId", "startedAt"]).index(["startedAt"]).index(["status"]), eo = E("_voltro_undo_log", {
+	attributes: C().nullable(),
+	events: C().nullable()
+}).index(["traceId", "startedAt"]).index(["startedAt"]).index(["status"]), Lo = T("_voltro_undo_log", {
 	id: v({ prefix: "undo" }),
-	tag: D(),
-	label: D().nullable(),
-	subjectId: D().nullable(),
-	tenantId: D().nullable(),
-	traceId: D().nullable(),
-	changes: D(),
+	tag: E(),
+	label: E().nullable(),
+	subjectId: E().nullable(),
+	tenantId: E().nullable(),
+	traceId: E().nullable(),
+	changes: E(),
 	crossesAction: r().default(!1),
 	undone: r().default(!1),
-	createdAt: O().default("now")
-}).index(["subjectId", "createdAt"]).reactive(), to = (e = process.env) => {
+	createdAt: D().default("now")
+}).index(["subjectId", "createdAt"]).reactive(), Ro = (e = process.env) => {
 	let t = (e.VOLTRO_UNDO ?? "").toLowerCase();
 	return t === "on" || t === "1" || t === "true" ? !0 : t === "off" || t === "0" || t === "false" ? !1 : e.NODE_ENV !== "production";
-}, no = (e) => e.startsWith("_voltro"), ro = async (e, t, n) => (await e.query({
+}, zo = (e) => e.startsWith("_voltro"), Bo = async (e, t, n) => (await e.query({
 	table: t,
 	predicate: u("id", n),
 	order: []
-}))[0] ?? null, io = (e, t) => new Proxy(e, { get(e, n, r) {
+}))[0] ?? null, Vo = (e, t) => new Proxy(e, { get(e, n, r) {
 	if (n === "insert") return async (n, r) => {
 		let i = await e.insert(n, r);
-		return no(n) || t({
+		return zo(n) || t({
 			table: n,
 			op: "insert",
 			next: i
 		}), i;
 	};
 	if (n === "update") return async (n, r, i) => {
-		let a = no(n) ? null : await ro(e, n, r), o = await e.update(n, r, i);
-		return no(n) || t({
+		let a = zo(n) ? null : await Bo(e, n, r), o = await e.update(n, r, i);
+		return zo(n) || t({
 			table: n,
 			op: "update",
 			id: r,
@@ -4086,8 +4404,8 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		}), o;
 	};
 	if (n === "delete") return async (n, r) => {
-		let i = no(n) ? null : await ro(e, n, r), a = await e.delete(n, r);
-		return !no(n) && a && t({
+		let i = zo(n) ? null : await Bo(e, n, r), a = await e.delete(n, r);
+		return !zo(n) && a && t({
 			table: n,
 			op: "delete",
 			id: r,
@@ -4096,10 +4414,10 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 	};
 	let i = Reflect.get(e, n, r);
 	return typeof i == "function" ? i.bind(e) : i;
-} }), ao = (e) => {
+} }), Ho = (e) => {
 	let t = [];
 	return {
-		tx: io(e, (e) => t.push(e)),
+		tx: Vo(e, (e) => t.push(e)),
 		persist: async (e, n) => {
 			if (t.length === 0 || n.tag.startsWith("__voltro")) return;
 			let r = n.subject;
@@ -4115,14 +4433,14 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 			});
 		}
 	};
-}, oo = (e) => {
+}, Uo = (e) => {
 	if (e.id !== void 0) return e.id;
 	let t = e.next?.id;
 	if (typeof t == "string") return t;
 	let n = e.prev?.id;
 	return typeof n == "string" ? n : void 0;
-}, so = (e) => {
-	let t = oo(e);
+}, Wo = (e) => {
+	let t = Uo(e);
 	switch (e.op) {
 		case "insert": return t === void 0 ? null : {
 			table: e.table,
@@ -4146,28 +4464,28 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 			row: e.prev
 		};
 	}
-}, co = (e) => {
-	if (e.crossesAction) throw new lo(e.invocationId, "action");
+}, Go = (e) => {
+	if (e.crossesAction) throw new Ko(e.invocationId, "action");
 	let t = [];
 	for (let n = e.changes.length - 1; n >= 0; --n) {
-		let r = so(e.changes[n]);
+		let r = Wo(e.changes[n]);
 		r !== null && t.push(r);
 	}
 	return t;
-}, lo = class extends Error {
+}, Ko = class extends Error {
 	invocationId;
 	boundary;
 	_tag = "UndoBoundaryError";
 	constructor(e, t) {
 		super(t === "action" ? `cannot undo invocation ${e}: it crossed an action (external side effect)` : `cannot undo invocation ${e}: the row changed since (conflict)`), this.invocationId = e, this.boundary = t, this.name = "UndoBoundaryError";
 	}
-}, uo = (e, t, n = ["updatedAt", "updatedBy"]) => {
+}, qo = (e, t, n = ["updatedAt", "updatedBy"]) => {
 	if (t == null) return e == null;
 	if (e == null) return !1;
 	let r = new Set(n);
 	for (let [n, i] of Object.entries(t)) if (!r.has(n) && !Object.is(e[n], i) && JSON.stringify(e[n]) !== JSON.stringify(i)) return !1;
 	return !0;
-}, fo = class {
+}, Jo = class {
 	capacity;
 	done = [];
 	undone = [];
@@ -4203,7 +4521,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 			redo: [...this.undone]
 		};
 	}
-}, po = (e, t = /* @__PURE__ */ new Set()) => e.op === "insert" ? {
+}, Yo = (e, t = /* @__PURE__ */ new Set()) => e.op === "insert" ? {
 	table: e.table,
 	op: "insert",
 	next: e.new ?? null
@@ -4220,7 +4538,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 	table: e.table,
 	op: "delete",
 	prev: e.old ?? null
-}, mo = async (e, t) => {
+}, Xo = async (e, t) => {
 	switch (t.op) {
 		case "delete":
 			await e.delete(t.table, t.id);
@@ -4238,21 +4556,21 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 			await e.insert(t.table, t.row);
 			return;
 	}
-}, ho = async (e, t) => {
-	for (let n of t) await mo(e, n);
-}, go = (e) => e.request?.subject?.id ?? null, _o = (e) => e === !0 || e === 1, vo = async (e, t, n) => (await e.query({
+}, Zo = async (e, t) => {
+	for (let n of t) await Xo(e, n);
+}, Qo = (e) => e.request?.subject?.id ?? null, $o = (e) => e === !0 || e === 1, es = async (e, t, n) => (await e.query({
 	table: t,
 	predicate: u("id", n),
 	order: []
-}))[0] ?? null, yo = (e) => {
+}))[0] ?? null, ts = (e) => {
 	try {
 		let t = JSON.parse(String(e ?? "[]"));
 		return Array.isArray(t) ? t : [];
 	} catch {
 		return [];
 	}
-}, bo = (e) => e.id ?? e.next?.id ?? e.prev?.id, xo = async (e, t) => {
-	let n = go(t);
+}, ns = (e) => e.id ?? e.next?.id ?? e.prev?.id, rs = async (e, t) => {
+	let n = Qo(t);
 	return [...await t.store.query({
 		table: "_voltro_undo_log",
 		predicate: u("subjectId", n),
@@ -4261,68 +4579,68 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		id: String(e.id),
 		tag: String(e.tag ?? ""),
 		label: e.label ?? null,
-		undone: _o(e.undone),
-		crossesAction: _o(e.crossesAction),
+		undone: $o(e.undone),
+		crossesAction: $o(e.crossesAction),
 		createdAt: String(e.createdAt ?? "")
 	}));
-}, So = async (e, t) => {
-	let n = await vo(t.store, "_voltro_undo_log", e.invocationId);
-	if (!n) throw new xe({ invocationId: e.invocationId });
-	if ((n.subjectId ?? null) !== go(t)) throw new be({ invocationId: e.invocationId });
+}, is = async (e, t) => {
+	let n = await es(t.store, "_voltro_undo_log", e.invocationId);
+	if (!n) throw new Ce({ invocationId: e.invocationId });
+	if ((n.subjectId ?? null) !== Qo(t)) throw new Se({ invocationId: e.invocationId });
 	return n;
-}, Co = async (e, t) => {
-	let n = await So(e, t);
-	if (_o(n.undone)) return { ok: !0 };
-	if (_o(n.crossesAction)) throw new ye({
+}, as = async (e, t) => {
+	let n = await is(e, t);
+	if ($o(n.undone)) return { ok: !0 };
+	if ($o(n.crossesAction)) throw new xe({
 		invocationId: e.invocationId,
 		reason: "action"
 	});
-	let r = yo(n.changes);
+	let r = ts(n.changes);
 	for (let n of r) {
-		let r = bo(n);
-		if (r !== void 0 && !uo(await vo(t.store, n.table, r), n.next ?? null)) throw new ye({
+		let r = ns(n);
+		if (r !== void 0 && !qo(await es(t.store, n.table, r), n.next ?? null)) throw new xe({
 			invocationId: e.invocationId,
 			reason: "conflict"
 		});
 	}
 	let i = {
 		invocationId: e.invocationId,
-		subject: go(t),
+		subject: Qo(t),
 		changes: r,
 		crossesAction: !1
 	};
-	return await ho(t.store, co(i)), await t.store.update("_voltro_undo_log", e.invocationId, { undone: !0 }), { ok: !0 };
-}, wo = async (e, t) => {
-	let n = await So(e, t);
-	if (!_o(n.undone)) return { ok: !0 };
-	for (let e of yo(n.changes)) {
-		let n = bo(e);
+	return await Zo(t.store, Go(i)), await t.store.update("_voltro_undo_log", e.invocationId, { undone: !0 }), { ok: !0 };
+}, os = async (e, t) => {
+	let n = await is(e, t);
+	if (!$o(n.undone)) return { ok: !0 };
+	for (let e of ts(n.changes)) {
+		let n = ns(e);
 		e.op === "insert" && e.next ? await t.store.insert(e.table, e.next) : e.op === "update" && n !== void 0 && e.next ? await t.store.update(e.table, n, e.next) : e.op === "delete" && n !== void 0 && await t.store.delete(e.table, n);
 	}
 	return await t.store.update("_voltro_undo_log", e.invocationId, { undone: !1 }), { ok: !0 };
-}, To = (e = process.env) => {
+}, ss = (e = process.env) => {
 	let t = (e.VOLTRO_TIMELINE ?? "").toLowerCase();
 	return t === "off" || t === "0" || t === "false" ? "off" : t === "all" ? "all" : t === "interesting" || t === "on" || t === "1" || t === "true" ? "interesting" : e.NODE_ENV === "production" ? "off" : "interesting";
-}, Eo = /pass(word)?|secret|token|api[_-]?key|authorization|cookie|ssn|credit[_-]?card|card[_-]?number|cvv|encrypted/i, Do = "«redacted»", Oo = (e) => {
+}, cs = /pass(word)?|secret|token|api[_-]?key|authorization|cookie|ssn|credit[_-]?card|card[_-]?number|cvv|encrypted/i, ls = "«redacted»", us = (e) => {
 	if (e == null) return null;
 	let t = {};
-	for (let [n, r] of Object.entries(e)) t[n] = Eo.test(n) ? Do : r;
+	for (let [n, r] of Object.entries(e)) t[n] = cs.test(n) ? ls : r;
 	return t;
-}, ko = (e) => {
+}, ds = (e) => {
 	let t = e?.id;
 	return typeof t == "string" ? t : void 0;
-}, Ao = (e, t) => {
+}, fs = (e, t) => {
 	if (t.op === "insert") {
-		let n = ko(t.new);
+		let n = ds(t.new);
 		return n === void 0 ? e : e.filter((e) => e.id !== n);
 	}
 	if (t.op === "update") {
 		if (t.old == null) return e;
-		let n = ko(t.new) ?? ko(t.old);
+		let n = ds(t.new) ?? ds(t.old);
 		return e.map((e) => e.id === n ? t.old : e);
 	}
 	return t.old == null ? e : [...e, t.old];
-}, jo = class {
+}, ps = class {
 	mode;
 	capacity;
 	now;
@@ -4342,8 +4660,8 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 			ts: this.now(),
 			table: e.table,
 			op: e.op,
-			old: Oo(e.old),
-			new: Oo(e.new),
+			old: us(e.old),
+			new: us(e.new),
 			tenantId: n
 		}), this.ring.length > this.capacity && this.ring.shift(), t;
 	}
@@ -4356,23 +4674,23 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 	}
 	replay(e, t, n) {
 		let r = this.ring.filter((n) => n.table === e && n.seq > t).sort((e, t) => t.seq - e.seq), i = n;
-		for (let e of r) i = Ao(i, e);
+		for (let e of r) i = fs(i, e);
 		return i;
 	}
-}, Mo, No = () => (Mo === void 0 && (Mo = new jo(To())), Mo), Po = (e) => {
-	Mo = e;
-}, Fo = (e) => {
-	let t = No();
+}, ms, hs = () => (ms === void 0 && (ms = new ps(ss())), ms), gs = (e) => {
+	ms = e;
+}, _s = (e) => {
+	let t = hs();
 	if (t.enabled) try {
 		t.record(e);
 	} catch {}
-}, Io = /* @__PURE__ */ new Set([
+}, vs = /* @__PURE__ */ new Set([
 	"count",
 	"sum",
 	"avg",
 	"min",
 	"max"
-]), Lo = (e) => {
+]), ys = (e) => {
 	if (e.joins !== void 0 && e.joins.length > 0) return {
 		maintainable: !1,
 		reason: "joins are not maintainable in v1"
@@ -4394,7 +4712,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		reason: "v1 maintains exactly one aggregation"
 	};
 	let t = e.aggregations[0];
-	return Io.has(t.op) ? t.op !== "count" && (t.column === void 0 || t.column.length === 0) ? {
+	return vs.has(t.op) ? t.op !== "count" && (t.column === void 0 || t.column.length === 0) ? {
 		maintainable: !1,
 		reason: `op '${t.op}' requires a column`
 	} : {
@@ -4408,7 +4726,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		maintainable: !1,
 		reason: `op '${t.op}' is not maintainable`
 	};
-}, Ro = "\0", $ = (e, t) => t === void 0 || t.length === 0 ? "" : t.map((t) => JSON.stringify(e[t] ?? null)).join(Ro), zo = (e, t) => t === void 0 ? 0 : Number(e[t] ?? 0), Bo = (e, t) => {
+}, bs = "\0", $ = (e, t) => t === void 0 || t.length === 0 ? "" : t.map((t) => JSON.stringify(e[t] ?? null)).join(bs), xs = (e, t) => t === void 0 ? 0 : Number(e[t] ?? 0), Ss = (e, t) => {
 	switch (e.op) {
 		case "count": return t.count;
 		case "sum": return t.sum ?? 0;
@@ -4416,10 +4734,10 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		case "min":
 		case "max": return t.count > 0 ? t.extreme ?? null : null;
 	}
-}, Vo = (e, t) => {
+}, Cs = (e, t) => {
 	let n = /* @__PURE__ */ new Map();
 	for (let r of t) {
-		let t = $(r, e.groupBy), i = n.get(t), a = zo(r, e.column);
+		let t = $(r, e.groupBy), i = n.get(t), a = xs(r, e.column);
 		if (i === void 0) n.set(t, {
 			count: 1,
 			...e.op === "sum" || e.op === "avg" ? { sum: a } : {},
@@ -4435,10 +4753,10 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		}
 	}
 	return n;
-}, Ho = (e, t) => [...t.entries()].map(([t, n]) => ({
+}, ws = (e, t) => [...t.entries()].map(([t, n]) => ({
 	groupKey: t,
-	value: Bo(e, n)
-})), Uo = (e, t, n) => {
+	value: Ss(e, n)
+})), Ts = (e, t, n) => {
 	let r = new Map(t), i = /* @__PURE__ */ new Set(), a = (t) => {
 		let n = $(t, e.groupBy), a = r.get(n);
 		if (a === void 0) return;
@@ -4447,7 +4765,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 			r.delete(n);
 			return;
 		}
-		let s = zo(t, e.column);
+		let s = xs(t, e.column);
 		e.op === "min" || e.op === "max" ? (a.extreme !== void 0 && s === a.extreme && i.add(n), r.set(n, {
 			count: o,
 			...a.extreme === void 0 ? {} : { extreme: a.extreme }
@@ -4456,7 +4774,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 			...e.op === "sum" || e.op === "avg" ? { sum: (a.sum ?? 0) - s } : {}
 		});
 	}, o = (t) => {
-		let n = $(t, e.groupBy), i = r.get(n), a = zo(t, e.column);
+		let n = $(t, e.groupBy), i = r.get(n), a = xs(t, e.column);
 		if (i === void 0) {
 			r.set(n, {
 				count: 1,
@@ -4476,15 +4794,15 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		state: r,
 		rescanGroups: [...i]
 	};
-}, Wo = (e, t, n, r) => {
+}, Es = (e, t, n, r) => {
 	if (n.length === 0) return t;
-	let i = new Set(n), a = Vo(e, r.filter((t) => i.has($(t, e.groupBy)))), o = new Map(t);
+	let i = new Set(n), a = Cs(e, r.filter((t) => i.has($(t, e.groupBy)))), o = new Map(t);
 	for (let e of i) {
 		let t = a.get(e);
 		t === void 0 ? o.delete(e) : o.set(e, t);
 	}
 	return o;
-}, Go = class {
+}, Ds = class {
 	shape;
 	state = /* @__PURE__ */ new Map();
 	groups = /* @__PURE__ */ new Map();
@@ -4492,7 +4810,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		this.shape = e;
 	}
 	seed(e) {
-		this.state = Vo(this.shape, e), this.groups.clear();
+		this.state = Cs(this.shape, e), this.groups.clear();
 		for (let t of e) {
 			let e = $(t, this.shape.groupBy);
 			this.groups.has(e) || this.groups.set(e, this.groupValues(t));
@@ -4504,14 +4822,14 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 			let e = $(t, this.shape.groupBy);
 			this.groups.has(e) || this.groups.set(e, this.groupValues(t));
 		}
-		let n = Uo(this.shape, this.state, e);
+		let n = Ts(this.shape, this.state, e);
 		this.state = n.state;
 		for (let e of this.groups.keys()) this.state.has(e) || this.groups.delete(e);
 		return n.rescanGroups;
 	}
 	resolveRescan(e, t) {
 		if (e.length === 0) return;
-		this.state = Wo(this.shape, this.state, e, t);
+		this.state = Es(this.shape, this.state, e, t);
 		let n = new Set(e);
 		for (let e of t) {
 			let t = $(e, this.shape.groupBy);
@@ -4520,7 +4838,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		for (let e of n) this.state.has(e) || this.groups.delete(e);
 	}
 	materialize() {
-		return Ho(this.shape, this.state).map((e) => ({
+		return ws(this.shape, this.state).map((e) => ({
 			groupKey: e.groupKey,
 			group: this.groups.get(e.groupKey) ?? {},
 			value: e.value
@@ -4533,70 +4851,19 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		for (let r of t) n[r] = e[r];
 		return n;
 	}
-}, Ko = "admin:full", qo = class extends I.TaggedError()("AccessDenied", {
-	action: I.String,
-	resourceType: I.String,
-	resourceId: I.String
-}) {}, Jo = /* @__PURE__ */ new Map(), Yo = (e) => {
-	if (typeof e.resourceType != "string" || e.resourceType.length === 0) throw Error("defineResourcePolicy: a non-empty `resourceType` is required");
-	if (e.actions === void 0 || Object.keys(e.actions).length === 0) throw Error(`resource policy '${e.resourceType}': at least one action is required`);
-	if (Jo.has(e.resourceType)) throw Error(`resource policy '${e.resourceType}' is already registered — types must be unique`);
-	return Jo.set(e.resourceType, e), e;
-}, Xo = (e) => Jo.get(e), Zo = () => [...Jo.values()], Qo = () => Jo.clear(), $o = () => Zo().map((e) => {
-	let t = /* @__PURE__ */ new Set();
-	for (let n of Object.values(e.actions)) for (let e of n) t.add(e);
-	for (let [n, r] of Object.entries(e.implies ?? {})) {
-		t.add(n);
-		for (let e of r) t.add(e);
-	}
-	return {
-		resourceType: e.resourceType,
-		actions: e.actions,
-		relations: [...t],
-		implies: e.implies ?? {}
-	};
-}), es = (e, t) => {
-	let n = new Set(e);
-	if (t === void 0) return n;
-	let r = [...e];
-	for (; r.length > 0;) {
-		let e = r.pop();
-		for (let i of t[e] ?? []) n.has(i) || (n.add(i), r.push(i));
-	}
-	return n;
-}, ts = (e, t, n, r) => e.id === null ? /* @__PURE__ */ new Set() : es(n.filter((n) => n.subjectId === e.id && n.resourceType === t.type && n.resourceId === t.id).map((e) => e.relation), r.implies), ns = (e, t, n, r) => {
-	if (e.scopes?.includes("admin:full")) return !0;
-	if (e.id === null || n.tenantId != null && e.tenantId !== n.tenantId) return !1;
-	let i = r.policy.actions[t];
-	if (i === void 0 || i.length === 0) return !1;
-	let a = ts(e, n, r.tuples, r.policy);
-	return i.some((e) => a.has(e));
-}, rs = (e, t, n, r) => {
-	if (!ns(e, t, n, r)) throw new qo({
-		action: t,
-		resourceType: n.type,
-		resourceId: n.id
-	});
-}, is = (e, t, n, r, i) => r.filter((r) => ns(e, t, {
-	type: n,
-	id: r.id,
-	...r.tenantId === void 0 ? {} : { tenantId: r.tenantId }
-}, i)), as = (e, t) => {
-	let n = new Set(t.map((e) => e.id));
-	return e.filter((e) => !n.has(e.id)).map((e) => e.id);
-}, os = E("_voltro_rebac_tuples", {
+}, Os = T("_voltro_rebac_tuples", {
 	id: v({ prefix: "rbct" }),
-	subjectId: D(),
-	relation: D(),
-	resourceType: D(),
-	resourceId: D(),
-	tenantId: D().nullable(),
-	createdAt: O().default("now")
+	subjectId: E(),
+	relation: E(),
+	resourceType: E(),
+	resourceId: E(),
+	tenantId: E().nullable(),
+	createdAt: D().default("now")
 }).index([
 	"subjectId",
 	"resourceType",
 	"resourceId"
-]).reactive(), ss = async (e, n, r, i) => n === null ? [] : (await e.query({
+]).reactive(), ks = async (e, n, r, i) => n === null ? [] : (await e.query({
 	table: "_voltro_rebac_tuples",
 	predicate: t(u("subjectId", n), u("resourceType", r), u("resourceId", i)),
 	order: [],
@@ -4608,16 +4875,16 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 	relation: e.relation,
 	resourceType: e.resourceType,
 	resourceId: e.resourceId
-})), cs = (e) => ({
+})), As = (e) => ({
 	id: e.id,
 	tenantId: e.tenantId,
 	...e.scopes === void 0 ? {} : { scopes: e.scopes }
-}), ls = (e, t) => {
-	let n = t.getPolicy ?? Xo;
+}), js = (e, t) => {
+	let n = t.getPolicy ?? la;
 	return (r, i) => {
 		let a = e[i.tag];
 		if (a === void 0) return r;
-		let o = n(a.resourceType), s = (e) => j.fail(new qo({
+		let o = n(a.resourceType), s = (e) => j.fail(new oa({
 			action: a.action,
 			resourceType: a.resourceType,
 			resourceId: e
@@ -4625,17 +4892,17 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		if (o === void 0) return s("");
 		let c = a.resourceId(i.input);
 		if (c === null || c === "") return s("");
-		let l = cs(i.subject), u = {
+		let l = As(i.subject), u = {
 			type: a.resourceType,
 			id: c,
 			tenantId: i.subject.tenantId
 		};
-		return j.flatMap(j.promise(async () => t.loadTuples(l.id, a.resourceType, c)), (e) => ns(l, a.action, u, {
+		return j.flatMap(j.promise(async () => t.loadTuples(l.id, a.resourceType, c)), (e) => ha(l, a.action, u, {
 			policy: o,
 			tuples: e
 		}) ? r : s(c));
 	};
-}, us = async (e, n, r) => n === null ? [] : (await e.query({
+}, Ms = async (e, n, r) => n === null ? [] : (await e.query({
 	table: "_voltro_rebac_tuples",
 	predicate: t(u("subjectId", n), u("resourceType", r)),
 	order: [],
@@ -4647,18 +4914,18 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 	relation: e.relation,
 	resourceType: e.resourceType,
 	resourceId: e.resourceId
-})), ds = (e) => {
-	let t = e.getPolicy ?? Xo;
+})), Ns = (e) => {
+	let t = e.getPolicy ?? la;
 	return async (n, r, i, a) => {
 		let o = t(r);
 		if (o === void 0) return [];
-		let s = cs(n);
-		return is(s, i, r, a, {
+		let s = As(n);
+		return _a(s, i, r, a, {
 			policy: o,
 			tuples: await e.loadSubjectTuples(s.id, r)
 		});
 	};
-}, fs = (e) => {
+}, Ps = (e) => {
 	if (typeof e.name != "string" || e.name.length === 0) throw Error("defineReaction: a non-empty `name` is required");
 	if (e.watch === void 0 || typeof e.watch.table != "string" || e.watch.table.length === 0) throw Error(`reaction '${e.name}': watch.table is required`);
 	if (e.act === void 0 || e.act.kind !== "agent" && e.act.kind !== "workflow") throw Error(`reaction '${e.name}': act must be { kind: 'agent' | 'workflow', … }`);
@@ -4666,14 +4933,14 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 	if (e.guards.rateLimit !== void 0 && (e.guards.rateLimit.limit <= 0 || e.guards.rateLimit.windowMs <= 0)) throw Error(`reaction '${e.name}': guards.rateLimit needs positive limit + windowMs`);
 	if (e.guards.costBudgetUsd !== void 0 && e.guards.costBudgetUsd < 0) throw Error(`reaction '${e.name}': guards.costBudgetUsd must be >= 0`);
 	return e;
-}, ps = (e, t) => e === void 0 ? !0 : Array.isArray(e) ? e.includes(t) : e === t, ms = (e) => e.new?.tenantId ?? e.old?.tenantId ?? null, hs = class {
+}, Fs = (e, t) => e === void 0 ? !0 : Array.isArray(e) ? e.includes(t) : e === t, Is = (e) => e.new?.tenantId ?? e.old?.tenantId ?? null, Ls = class {
 	hits = /* @__PURE__ */ new Map();
 	allow(e, t, n, r) {
 		let i = r - n, a = (this.hits.get(e) ?? []).filter((e) => e > i);
 		return a.length >= t ? (this.hits.set(e, a), !1) : (a.push(r), this.hits.set(e, a), !0);
 	}
-}, gs = async (e, t, n) => {
-	if (t.table !== e.watch.table || !ps(e.watch.on, t.op)) return "skipped-op";
+}, Rs = async (e, t, n) => {
+	if (t.table !== e.watch.table || !Fs(e.watch.on, t.op)) return "skipped-op";
 	if (e.when !== void 0 && !e.when(t)) return "skipped-when";
 	let r = `${e.name}:${e.guards.dedupeKey(t)}`;
 	if (await n.dedupe.has(r)) return "skipped-dedupe";
@@ -4682,26 +4949,26 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		let t = n.now?.() ?? Date.now();
 		if (!n.rateLimiter.allow(e.name, i.limit, i.windowMs, t)) return "skipped-ratelimit";
 	}
-	let a = ms(t);
+	let a = Is(t);
 	return e.guards.costBudgetUsd !== void 0 && n.checkBudget !== void 0 && !await n.checkBudget(a, e.guards.costBudgetUsd) ? "skipped-budget" : (await n.runAct(e.act, t, {
 		id: a,
 		via: "agent"
 	}), await n.dedupe.add(r), "acted");
-}, _s = E("_voltro_wakeups", {
+}, zs = T("_voltro_wakeups", {
 	id: v({ prefix: "wakeup" }),
-	tenantId: D(),
-	kind: D(),
-	refId: D(),
-	wakeAt: O(),
-	status: D()
-}).index(["status", "wakeAt"]).index(["tenantId"]), vs = async (e) => {
-	let t = e.now?.() ?? /* @__PURE__ */ new Date(), n = await Ra(e.store, t, e.batchLimit ?? 100);
+	tenantId: E(),
+	kind: E(),
+	refId: E(),
+	wakeAt: D(),
+	status: E()
+}).index(["status", "wakeAt"]).index(["tenantId"]), Bs = async (e) => {
+	let t = e.now?.() ?? /* @__PURE__ */ new Date(), n = await xo(e.store, t, e.batchLimit ?? 100);
 	if (n.length === 0) return 0;
 	let r = 0;
-	for (let t of n) if (await Pa(e.store, t)) try {
+	for (let t of n) if (await _o(e.store, t)) try {
 		await e.adapter.wake(t), r++;
 	} catch (n) {
-		await Fa(e.store, t), e.log?.warn("wake: adapter failed — released for retry", {
+		await vo(e.store, t), e.log?.warn("wake: adapter failed — released for retry", {
 			tenantId: t.tenantId,
 			kind: t.kind,
 			refId: t.refId,
@@ -4709,11 +4976,11 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		});
 	}
 	return r > 0 && e.log?.info("wake: woke due deployments", { count: r }), r;
-}, ys = (e, t = 1e3) => {
+}, Vs = (e, t = 1e3) => {
 	let n = !1, r, i = async () => {
 		if (!n) {
 			try {
-				await vs(e);
+				await Bs(e);
 			} catch (t) {
 				e.log?.warn("wake: tick failed", { reason: t instanceof Error ? t.message : String(t) });
 			}
@@ -4723,10 +4990,10 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 	return i(), { stop: () => {
 		n = !0, r !== void 0 && clearTimeout(r);
 	} };
-}, bs = (e) => ({ wake: async () => {
+}, Hs = (e) => ({ wake: async () => {
 	await e.start();
-} }), xs = (e) => new Promise((t) => setTimeout(t, e)), Ss = (e) => {
-	let t = e.fetchImpl ?? fetch, n = e.now ?? Date.now, r = e.sleep ?? xs, i = e.spawnImpl ?? gt, a = e.startTimeoutMs ?? 3e4, o = e.healthPollMs ?? 200, s = e.stopSignal ?? "SIGTERM", c = e.stopGraceMs ?? 1e4, l, u, d = e.healthCheck ?? ((e) => e.ok), f = async () => {
+} }), Us = (e) => new Promise((t) => setTimeout(t, e)), Ws = (e) => {
+	let t = e.fetchImpl ?? fetch, n = e.now ?? Date.now, r = e.sleep ?? Us, i = e.spawnImpl ?? vt, a = e.startTimeoutMs ?? 3e4, o = e.healthPollMs ?? 200, s = e.stopSignal ?? "SIGTERM", c = e.stopGraceMs ?? 1e4, l, u, d = e.healthCheck ?? ((e) => e.ok), f = async () => {
 		try {
 			let n = await t(e.healthUrl);
 			return d(n);
@@ -4780,11 +5047,11 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		},
 		stop: m
 	};
-}, Cs = async (e) => {
+}, Gs = async (e) => {
 	if (e.signals.connectedClients() > 0 || e.signals.inFlightRequests() > 0 || e.signals.activeWorkflowExecutions() > 0) return !1;
-	let t = (e.now?.() ?? /* @__PURE__ */ new Date()).getTime() + (e.wakeLookaheadMs ?? 3e4), n = await za(e.store);
+	let t = (e.now?.() ?? /* @__PURE__ */ new Date()).getTime() + (e.wakeLookaheadMs ?? 3e4), n = await So(e.store);
 	return !(n !== null && n.wakeAt.getTime() <= t);
-}, ws = (e, t = Date.now) => {
+}, Ks = (e, t = Date.now) => {
 	let n;
 	return {
 		update: (r) => {
@@ -4796,7 +5063,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 			n = void 0;
 		}
 	};
-}, Ts = () => {
+}, qs = () => {
 	let e = 0, t = 0;
 	return {
 		onRequestStart: () => {
@@ -4814,8 +5081,8 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		inFlightRequests: () => e,
 		openConnections: () => t
 	};
-}, Es = (e) => ({ run: async (t) => (e.onActivity?.(), await e.ensureAwake(), t()) }), Ds = (e, t, n, r) => new Promise((i, a) => {
-	let o = Ue.request({
+}, Js = (e) => ({ run: async (t) => (e.onActivity?.(), await e.ensureAwake(), t()) }), Ys = (e, t, n, r) => new Promise((i, a) => {
+	let o = Ge.request({
 		host: n,
 		port: r,
 		method: e.method,
@@ -4825,8 +5092,8 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		t.writeHead(e.statusCode ?? 502, e.headers), e.pipe(t), e.on("end", i), e.on("error", a);
 	});
 	o.on("error", a), e.pipe(o);
-}), Os = (e, t, n, r, i) => new Promise((a, o) => {
-	let s = Ue.request({
+}), Xs = (e, t, n, r, i) => new Promise((a, o) => {
+	let s = Ge.request({
 		host: r,
 		port: i,
 		method: e.method,
@@ -4840,21 +5107,21 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		};
 		t.on("close", s), r.on("close", s), r.on("error", o);
 	}), s.on("error", o), s.end();
-}), ks = (e) => {
-	let t = Es({
+}), Zs = (e) => {
+	let t = Js({
 		ensureAwake: () => e.supervisor.start(),
 		...e.onActivity === void 0 ? {} : { onActivity: e.onActivity }
-	}), n = e.activity, r = Ue.createServer((r, i) => {
-		n?.onRequestStart(), i.on("close", () => n?.onRequestEnd()), t.run(() => Ds(r, i, e.targetHost, e.targetPort)).catch((t) => {
+	}), n = e.activity, r = Ge.createServer((r, i) => {
+		n?.onRequestStart(), i.on("close", () => n?.onRequestEnd()), t.run(() => Ys(r, i, e.targetHost, e.targetPort)).catch((t) => {
 			e.log?.warn("wake-router: proxy failed", { reason: t instanceof Error ? t.message : String(t) }), i.headersSent || i.writeHead(502), i.end("wake/proxy failed");
 		});
 	});
 	return r.on("upgrade", (r, i, a) => {
-		n?.onConnect(), i.on("close", () => n?.onDisconnect()), t.run(() => Os(r, i, a, e.targetHost, e.targetPort)).catch((t) => {
+		n?.onConnect(), i.on("close", () => n?.onDisconnect()), t.run(() => Xs(r, i, a, e.targetHost, e.targetPort)).catch((t) => {
 			e.log?.warn("wake-router: upgrade proxy failed", { reason: t instanceof Error ? t.message : String(t) }), i.destroy();
 		});
 	}), r;
-}, As = async (e) => {
+}, Qs = async (e) => {
 	try {
 		return (await e.query({
 			table: "_voltro_workflow_runs",
@@ -4871,15 +5138,15 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 	} catch {
 		return 0;
 	}
-}, js = async (e) => {
-	let t = bs(e.supervisor), n = await vs({
+}, $s = async (e) => {
+	let t = Hs(e.supervisor), n = await Bs({
 		store: e.store,
 		adapter: t,
 		...e.now === void 0 ? {} : { now: e.now },
 		...e.log === void 0 ? {} : { log: e.log }
 	});
 	n > 0 && e.idleGate.reset();
-	let r = await Cs({
+	let r = await Gs({
 		store: e.store,
 		signals: e.signals,
 		...e.wakeLookaheadMs === void 0 ? {} : { wakeLookaheadMs: e.wakeLookaheadMs },
@@ -4889,12 +5156,12 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		woke: n,
 		stopped: i
 	};
-}, Ms = async (e) => {
-	let t = ws(e.idleGraceMs ?? 6e4), n = e.tickMs ?? 1e3, r = Ts(), i = 0, a = e.signals === void 0, o = e.signals ?? {
+}, ec = async (e) => {
+	let t = Ks(e.idleGraceMs ?? 6e4), n = e.tickMs ?? 1e3, r = qs(), i = 0, a = e.signals === void 0, o = e.signals ?? {
 		connectedClients: () => r.openConnections(),
 		inFlightRequests: () => r.inFlightRequests(),
 		activeWorkflowExecutions: () => i
-	}, s = ks({
+	}, s = Zs({
 		supervisor: e.supervisor,
 		targetHost: e.targetHost,
 		targetPort: e.targetPort,
@@ -4913,7 +5180,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 	let l = !1, u, d = e.firedRetentionMs ?? 10 * 6e4, f = 0, p = async () => {
 		if (!l) {
 			try {
-				if (a && (i = await As(e.store)), await js({
+				if (a && (i = await Qs(e.store)), await $s({
 					store: e.store,
 					supervisor: e.supervisor,
 					signals: o,
@@ -4921,7 +5188,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 					...e.wakeLookaheadMs === void 0 ? {} : { wakeLookaheadMs: e.wakeLookaheadMs },
 					...e.log === void 0 ? {} : { log: e.log }
 				}), f++ % 60 == 0) {
-					let t = await Va(e.store, { firedOlderThan: new Date(Date.now() - d) });
+					let t = await wo(e.store, { firedOlderThan: new Date(Date.now() - d) });
 					t > 0 && e.log?.info("orchestrator: pruned fired wakeups", { count: t });
 				}
 			} catch (t) {
@@ -4936,14 +5203,14 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 			l = !0, u !== void 0 && clearTimeout(u), await new Promise((e) => s.close(() => e()));
 		}
 	};
-}, Ns = (e) => e, Ps = class extends I.TaggedError()("AnalyticsError", {
+}, tc = (e) => e, nc = class extends I.TaggedError()("AnalyticsError", {
 	provider: I.String,
 	operation: I.String,
 	cause: I.String
-}) {}, Fs = class extends I.TaggedError()("AnalyticsCapabilityNotSupported", {
+}) {}, rc = class extends I.TaggedError()("AnalyticsCapabilityNotSupported", {
 	provider: I.String,
 	capability: I.String
-}) {}, Is = class extends Pe.Tag("@voltro/AnalyticsSink")() {}, Ls = (e, t) => ({
+}) {}, ic = class extends Ie.Tag("@voltro/AnalyticsSink")() {}, ac = (e, t) => ({
 	info: e.info,
 	track: (n) => e.track(n.tenantId === void 0 ? {
 		...n,
@@ -4962,20 +5229,20 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		tenantId: t
 	} : n),
 	...e.mirror === void 0 ? {} : { mirror: e.mirror }
-}), Rs = () => j.gen(function* () {
-	let e = yield* Is, t = yield* j.serviceOption(ve), n = P.match(t, {
+}), oc = () => j.gen(function* () {
+	let e = yield* ic, t = yield* j.serviceOption(be), n = P.match(t, {
 		onNone: () => null,
 		onSome: (e) => e.tenantId ?? null
 	});
-	return n === null ? e : Ls(e, n);
-}), zs = "noop", Bs = () => {
-	let e = (e) => j.fail(new Fs({
-		provider: zs,
+	return n === null ? e : ac(e, n);
+}), sc = "noop", cc = () => {
+	let e = (e) => j.fail(new rc({
+		provider: sc,
 		capability: e
 	}));
 	return {
 		info: {
-			provider: zs,
+			provider: sc,
 			capabilities: {
 				track: !0,
 				aggregate: !1,
@@ -4989,8 +5256,8 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		timeseries: () => e("timeseries"),
 		topN: () => e("topN")
 	};
-}, Vs = (e) => {
-	if (e.length === 0) return Bs();
+}, lc = (e) => {
+	if (e.length === 0) return cc();
 	if (e.length === 1) return e[0];
 	let t = {
 		provider: "compose",
@@ -5007,7 +5274,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		discard: !0
 	}), r = (t, n) => {
 		let r = e.find((e) => e.info.capabilities[t]);
-		return r === void 0 ? j.fail(new Fs({
+		return r === void 0 ? j.fail(new rc({
 			provider: "compose",
 			capability: t
 		})) : n(r);
@@ -5030,11 +5297,11 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		topN: (e) => r("topN", (t) => t.topN(e)),
 		...a === void 0 ? {} : { mirror: a }
 	};
-}, Hs = (e) => {
+}, uc = (e) => {
 	let t = e.filter((e) => e.dispose !== void 0);
 	return {
 		kind: "compose",
-		build: (t) => Vs(e.map((e) => e.build(t))),
+		build: (t) => lc(e.map((e) => e.build(t))),
 		tables: e.flatMap((e) => e.tables ?? []),
 		initialize: (t) => j.forEach(e, (e) => e.initialize ? e.initialize(t) : j.void, {
 			concurrency: 1,
@@ -5045,15 +5312,15 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 			discard: !0
 		}) } : {}
 	};
-}, Us = {
+}, dc = {
 	kind: "noop",
-	build: () => Bs()
-}, Ws = {
+	build: () => cc()
+}, fc = {
 	tables: [],
 	detach: () => {}
-}, Gs = (e) => {
+}, pc = (e) => {
 	let { store: t, sink: n, log: r } = e, i = n.mirror;
-	if (i === void 0 || i.tables.length === 0) return Ws;
+	if (i === void 0 || i.tables.length === 0) return fc;
 	let a = e.run ?? ((e) => j.runPromise(e)), o = i.primaryKey ?? "id", s = new Set(i.tables), c = (e) => {
 		if (e.op === "delete") {
 			let t = e.old;
@@ -5077,11 +5344,11 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		tables: i.tables,
 		detach: l
 	};
-}, Ks = (e) => {
+}, mc = (e) => {
 	let t = typeof e.refresh == "string" ? { interval: e.refresh } : e.refresh, n = e.strategy ?? "replace";
 	if (n === "merge" && (e.mergeKey === void 0 || e.mergeKey.length === 0)) throw Error(`defineAggregate("${e.name}"): strategy: 'merge' requires mergeKey — the property on each row to upsert by`);
 	if (e.incremental !== void 0) {
-		let t = Lo({
+		let t = ys({
 			aggregations: [{
 				op: e.incremental.op,
 				...e.incremental.column === void 0 ? {} : { column: e.incremental.column }
@@ -5103,38 +5370,38 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		build: e.build,
 		...e.incremental === void 0 ? {} : { incremental: e.incremental }
 	};
-}, qs = (e) => typeof e == "object" && !!e && e._voltroAggregate === !0, Js = class extends I.TaggedError()("AggregateStale", {
+}, hc = (e) => typeof e == "object" && !!e && e._voltroAggregate === !0, gc = class extends I.TaggedError()("AggregateStale", {
 	name: I.String,
 	ageMs: I.Number,
 	maxAgeMs: I.Number
-}) {}, Ys = class extends I.TaggedError()("AggregateNotFound", { name: I.String }) {}, Xs = class extends I.TaggedError()("AggregateError", {
+}) {}, _c = class extends I.TaggedError()("AggregateNotFound", { name: I.String }) {}, vc = class extends I.TaggedError()("AggregateError", {
 	name: I.String,
 	operation: I.String,
 	cause: I.String
-}) {}, Zs = class extends Pe.Tag("@voltro/AggregateRegistry")() {}, Qs = (e) => j.gen(function* () {
-	return (yield* Zs).getHandle(e);
-}), $s = (e, n, r) => {
+}) {}, yc = class extends Ie.Tag("@voltro/AggregateRegistry")() {}, bc = (e) => j.gen(function* () {
+	return (yield* yc).getHandle(e);
+}), xc = (e, n, r) => {
 	if (e.crossTenant || !n.has(e.table) || r == null) return e;
 	let i = u("tenantId", r);
 	return {
 		...e,
 		predicate: e.predicate ? t(e.predicate, i) : i
 	};
-}, ec = (e, n) => {
+}, Sc = (e, n) => {
 	if (e.includeDeleted || !n.has(e.table)) return e;
-	let r = x("deletedAt");
+	let r = S("deletedAt");
 	return {
 		...e,
 		predicate: e.predicate ? t(e.predicate, r) : r
 	};
-}, tc = (e) => j.runPromiseExit(e).then((e) => {
-	if (Re.isSuccess(e)) return e.value;
+}, Cc = (e) => j.runPromiseExit(e).then((e) => {
+	if (Be.isSuccess(e)) return e.value;
 	let t = k.failureOption(e.cause);
 	throw P.isSome(t) ? t.value : k.squash(e.cause);
-}), nc = (e, t) => e.pipe(j.provideService(ve, t)), rc = (e, t) => {
-	let n = Ce(t, e.guards);
-	if (n) throw n;
-}, ic = async (e) => {
+}), wc = (e, t) => e.pipe(j.provideService(be, t)), Tc = async (e, t, n) => {
+	let r = await j.runPromise(Te(t, e.guards, n));
+	if (r) throw r;
+}, Ec = async (e) => {
 	let t = `${e.kind}.${e.name}`, n = Date.now(), r = "ok";
 	try {
 		if (e.interceptor) {
@@ -5149,7 +5416,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 				traceId: e.requestContext.traceId,
 				...e.requestContext.spanId === void 0 ? {} : { spanId: e.requestContext.spanId }
 			}), r = await j.runPromiseExit(n);
-			if (Re.isSuccess(r)) return r.value;
+			if (Be.isSuccess(r)) return r.value;
 			throw k.squash(r.cause);
 		}
 		return await e.runExecutor();
@@ -5163,27 +5430,27 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 			status: r
 		});
 	}
-}, ac = /* @__PURE__ */ new Set([1213, 1205]), oc = /* @__PURE__ */ new Set([
+}, Dc = /* @__PURE__ */ new Set([1213, 1205]), Oc = /* @__PURE__ */ new Set([
 	"ER_LOCK_DEADLOCK",
 	"ER_LOCK_WAIT_TIMEOUT",
 	"40001",
 	"40P01"
-]), sc = (e) => {
+]), kc = (e) => {
 	let t = e;
 	for (let e = 0; e < 6 && typeof t == "object" && t; e++) {
 		let e = t;
-		if (typeof e.errno == "number" && ac.has(e.errno) || typeof e.code == "string" && oc.has(e.code) || typeof e.sqlState == "string" && oc.has(e.sqlState)) return !0;
+		if (typeof e.errno == "number" && Dc.has(e.errno) || typeof e.code == "string" && Oc.has(e.code) || typeof e.sqlState == "string" && Oc.has(e.sqlState)) return !0;
 		t = e.cause;
 	}
 	return !1;
-}, cc = 3, lc = (e) => new Promise((t) => setTimeout(t, e)), uc = async (e) => {
+}, Ac = 3, jc = (e) => new Promise((t) => setTimeout(t, e)), Mc = async (e) => {
 	for (let t = 1;; t++) try {
 		return await e();
 	} catch (e) {
-		if (t >= cc || !sc(e)) throw e;
-		await lc(t * 20 + Math.floor(Math.random() * 30));
+		if (t >= Ac || !kc(e)) throw e;
+		await jc(t * 20 + Math.floor(Math.random() * 30));
 	}
-}, dc = (e) => (t, n, r) => ic({
+}, Nc = (e) => (t, n, r) => Ec({
 	name: t.descriptor.name,
 	kind: "mutation",
 	input: n,
@@ -5191,11 +5458,11 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 	...e.interceptor ? { interceptor: e.interceptor } : {},
 	...e.recordMetric ? { recordMetric: e.recordMetric } : {},
 	runExecutor: async () => {
-		rc(t.descriptor, r.subject);
-		let i = [], a = await uc(async () => (i.length = 0, e.store.transactional(async (a) => {
+		await Tc(t.descriptor, r.subject, n);
+		let i = [], a = await Mc(async () => (i.length = 0, e.store.transactional(async (a) => {
 			let o = e.undoCapture?.(a), s = o ? o.tx : a, c = e.buildContext(r, s, { afterCommit: (e) => {
 				i.push(e);
-			} }), l = t.executor(n, c), u = j.isEffect(l) ? await e.runEffect(nc(l, r.subject), c.store) : await l;
+			} }), l = t.executor(n, c), u = j.isEffect(l) ? await e.runEffect(wc(l, r.subject), c.store) : await l;
 			return o && await o.persist(c.store, {
 				tag: t.descriptor.name,
 				subject: r.subject,
@@ -5205,34 +5472,44 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		for (let e of i) await e();
 		return a;
 	}
-}), fc = (e) => e && typeof e == "object" && "descriptor" in e ? e.descriptor : e, pc = (e) => typeof e == "object" && !!e && !Array.isArray(e) && "table" in e && "order" in e, mc = (e) => {
+}), Pc = (e) => e && typeof e == "object" && "descriptor" in e ? e.descriptor : e, Fc = (e) => typeof e == "object" && !!e && !Array.isArray(e) && "table" in e && "order" in e, Ic = (e) => {
 	let t = e.descriptor.source;
 	return t == null ? [] : typeof t == "string" ? [t] : [...t];
-}, hc = (e) => (t, n) => (r) => {
-	let i = e.buildContext(r), a = async () => {
-		let i = e.buildContext(r), a = t.executor(n, i);
-		return j.isEffect(a) ? j.runPromise(e.provideEffect(nc(a, r.subject), i.store)) : fc(await Promise.resolve(a));
-	}, o = (n) => {
-		let i = fc(n);
-		return pc(i) ? e.finalize(i, r) : {
+}, Lc = (e, t) => (n) => () => {
+	let r = e.descriptor.guards;
+	return !r || r.length === 0 ? Promise.resolve(null) : j.runPromise(Te(n, r, t));
+}, Rc = (e) => (t, n) => (r) => {
+	let i = e.buildContext(r), a = Lc(t, n)(r.subject), o = async () => {
+		let i = await a();
+		if (i) throw i;
+		let o = e.buildContext(r), s = t.executor(n, o);
+		return j.isEffect(s) ? j.runPromise(e.provideEffect(wc(s, r.subject), o.store)) : Pc(await Promise.resolve(s));
+	}, s = (n) => {
+		let i = Pc(n);
+		return Fc(i) ? e.finalize(i, r) : {
 			__voltroComputed: !0,
 			value: i,
-			dependentTables: mc(t),
+			dependentTables: Ic(t),
 			tenantId: r.subject?.tenantId ?? null,
-			recompute: a
+			recompute: o
 		};
-	}, s = () => {
-		let a = Ce(r.subject, t.descriptor.guards);
-		if (a) return j.fail(a);
-		let s = t.executor(n, i);
-		return j.isEffect(s) ? e.provideEffect(nc(s, r.subject), i.store).pipe(j.map(o)) : s instanceof Promise ? j.promise(() => s).pipe(j.map(o)) : o(s);
+	}, c = () => {
+		let a = t.executor(n, i);
+		return j.isEffect(a) ? e.provideEffect(wc(a, r.subject), i.store).pipe(j.map(s)) : a instanceof Promise ? j.promise(() => a).pipe(j.map(s)) : s(a);
+	}, l = () => {
+		let e = t.descriptor.guards;
+		return !e || e.length === 0 ? c() : Te(r.subject, e, n).pipe(j.flatMap((e) => {
+			if (e) return j.fail(e);
+			let t = c();
+			return j.isEffect(t) ? t : j.succeed(t);
+		}));
 	};
-	if (!e.interceptor) return s();
-	let c = j.suspend(() => {
-		let e = s();
+	if (!e.interceptor) return l();
+	let u = j.suspend(() => {
+		let e = l();
 		return j.isEffect(e) ? e : j.succeed(e);
 	});
-	return e.interceptor(c, {
+	return e.interceptor(u, {
 		tag: t.descriptor.name,
 		kind: "query",
 		input: n,
@@ -5240,7 +5517,7 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		traceId: r.traceId,
 		...r.spanId === void 0 ? {} : { spanId: r.spanId }
 	});
-}, gc = (e) => (t, n, r) => ic({
+}, zc = (e) => (t, n, r) => Ec({
 	name: t.descriptor.name,
 	kind: "action",
 	input: n,
@@ -5248,16 +5525,16 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 	...e.interceptor ? { interceptor: e.interceptor } : {},
 	...e.recordMetric ? { recordMetric: e.recordMetric } : {},
 	runExecutor: async () => {
-		rc(t.descriptor, r.subject);
+		await Tc(t.descriptor, r.subject, n);
 		let i = e.buildContext(r), a = t.executor(n, i);
-		return j.isEffect(a) ? e.runEffect(nc(a, r.subject), i.store) : a;
+		return j.isEffect(a) ? e.runEffect(wc(a, r.subject), i.store) : a;
 	}
-}), _c = (e) => e instanceof Date ? e.toISOString() : typeof e == "string" && e.length > 0 ? e : null, vc = (e) => typeof e == "string" && e.length > 0 ? e : null, yc = [
+}), Bc = (e) => e instanceof Date ? e.toISOString() : typeof e == "string" && e.length > 0 ? e : null, Vc = (e) => typeof e == "string" && e.length > 0 ? e : null, Hc = [
 	"updatedAt",
 	"createdAt",
 	"updatedBy",
 	"createdBy"
-], bc = (e) => yc.some((t) => t in e), xc = (e, t, n) => {
+], Uc = (e) => Hc.some((t) => t in e), Wc = (e, t, n) => {
 	let r = {
 		table: t.table,
 		id: t.id,
@@ -5272,14 +5549,14 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		found: !1
 	};
 	let i = t.column === void 0 ? void 0 : e[t.column];
-	if (!bc(e)) return {
+	if (!Uc(e)) return {
 		...r,
 		value: i,
 		lastWrite: null,
 		attribution: "none",
 		found: !0
 	};
-	let a = vc(e.updatedBy) ?? vc(e.createdBy), o = _c(e.updatedAt) ?? _c(e.createdAt);
+	let a = Vc(e.updatedBy) ?? Vc(e.createdBy), o = Bc(e.updatedAt) ?? Bc(e.createdAt);
 	return {
 		...r,
 		value: i,
@@ -5291,12 +5568,12 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		attribution: "audit",
 		found: !0
 	};
-}, Sc = (e, t) => {
+}, Gc = (e, t) => {
 	let n = e.map((e) => {
 		let n = e.newValue ?? e.value, r = t.column !== void 0 && n && typeof n == "object" ? n[t.column] : e.newValue ?? e.value;
 		return {
-			actor: { id: vc(e.actor) ?? vc(e.changedBy) },
-			at: _c(e.at) ?? _c(e.changedAt),
+			actor: { id: Vc(e.actor) ?? Vc(e.changedBy) },
+			at: Bc(e.at) ?? Bc(e.changedAt),
 			...e.traceId === void 0 ? {} : { traceId: e.traceId },
 			value: r
 		};
@@ -5311,12 +5588,12 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 		history: n,
 		found: n.length > 0
 	};
-}, Cc = (e) => {
+}, Kc = (e) => {
 	let t = e.new?.id;
 	if (typeof t == "string") return t;
 	let n = e.old?.id;
 	return typeof n == "string" ? n : void 0;
-}, wc = (e) => {
+}, qc = (e) => {
 	let t = {};
 	if (e.op === "insert") for (let [n, r] of Object.entries(e.new ?? {})) t[n] = {
 		from: void 0,
@@ -5336,11 +5613,11 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 	return {
 		table: e.table,
 		op: e.op,
-		id: Cc(e),
+		id: Kc(e),
 		fields: t
 	};
-}, Tc = (e) => {
-	let t = e.map(wc);
+}, Jc = (e) => {
+	let t = e.map(qc);
 	return {
 		rows: t,
 		summary: {
@@ -5349,21 +5626,21 @@ var q = /* @__PURE__ */ new Map(), jn = (e, t) => {
 			deletes: t.filter((e) => e.op === "delete").length
 		}
 	};
-}, Ec = class extends Error {
+}, Yc = class extends Error {
 	constructor() {
 		super("voltro:preview-rollback"), this.name = "PreviewRollback";
 	}
-}, Dc = async (e, t) => {
+}, Xc = async (e, t) => {
 	let n, r = !1;
 	try {
 		await e.transactional(async (e) => {
-			throw n = await t(e), r = !0, new Ec();
+			throw n = await t(e), r = !0, new Yc();
 		});
 	} catch (e) {
-		if (!(e instanceof Ec)) throw e;
+		if (!(e instanceof Yc)) throw e;
 	}
 	if (!r) throw Error("preview: handler did not complete");
 	return n;
-}, Oc = "framework-runtime";
+}, Zc = "framework-runtime";
 //#endregion
-export { ii as API_KEYS_TABLE, qo as AccessDenied, Xs as AggregateError, Go as AggregateMaintainer, Ys as AggregateNotFound, Zs as AggregateRegistry, Js as AggregateStale, Fs as AnalyticsCapabilityNotSupported, Ps as AnalyticsError, Is as AnalyticsSink, ua as CircuitBreaker, ca as CircuitOpen, gr as DEFAULT_MAX_RPC_BODY_BYTES, Qi as DeleteBuilder, yn as Dispatcher, ha as EffectStore, It as InMemoryDataStore, wt as IndexedMatcher, _t as LinearScanMatcher, Be as MetricBoundaries, zs as NOOP_ANALYTICS_PROVIDER, Gi as NoRowFound, Ki as OptimisticLockError, Ko as REBAC_ADMIN_SCOPE, Oc as RUNTIME_NAME, hs as ReactionRateLimiter, Qn as ReplicatedDataStore, Xi as SelectBuilder, ta as StoreOperationFailed, Dt as SubscriptionRegistry, na as TableValidationFailed, ea as TenantScopeViolation, jo as TimelineRecorder, lo as UndoBoundaryError, fo as UndoStack, Zi as UpdateBuilder, Ri as VOLTRO_AUDIT_MIXIN_ID, zi as VOLTRO_SOFT_DELETE_MIXIN_ID, Bi as VOLTRO_TENANT_MIXIN_ID, Nn as _connectionStreamCount, Pn as _resetConnectionSubjectsForTest, os as _voltroRebacTuplesTable, Qa as _voltroScheduleClaimsTable, Za as _voltroScheduleRunsTable, $a as _voltroTracesTable, eo as _voltroUndoLogTable, _s as _voltroWakeupsTable, Fi as _voltroWorkflowEventDeliveriesTable, Pi as _voltroWorkflowEventsTable, gi as apiKeyManagementRoutes, ia as applyDefined, Uo as applyDelta, mo as applyInverse, ho as applyInverses, ec as applySoftDeleteScope, $s as applyTenantScope, Co as applyUndoInvocation, rs as assertCan, Gs as attachAnalyticsMirror, vr as awaitServerListening, En as bindConnectionSubject, hr as bindMutation, sr as bindStream, or as bindSubscription, ir as bindSubscriptionUntyped, Vo as buildIvmState, Tc as buildPreview, ls as buildRebacInterceptor, ds as buildRebacReadFilter, Kn as buildSubjectKey, Cr as buildTracingLayer, Rr as cachedBackend, ns as can, ja as cancelWakeup, Lo as classifyShape, Qo as clearResourcePolicies, i as clearRetentions, pa as clearSystemStoreHandle, Ea as compileCron, Hs as composeAnalytics, Vs as composeAnalyticsSinks, Fn as connectionSubjectsSnapshot, As as countRunningWorkflows, pn as counter, Zn as currentRoutingContext, Hn as currentTraceContext, pi as dataStoreApiKeyStore, Xr as dataStoreIdempotencyStore, ti as dataStoreKvStore, Ks as defineAggregate, ki as defineEventTrigger, fs as defineReaction, Yo as defineResourcePolicy, Ta as defineSchedule, Ns as defineSubscriber, Vr as deriveKey, wc as diffChange, Ra as dueWakeups, ts as effectiveRelations, Wi as emptySchemaRegistry, Mr as envSecretsBackend, zn as externalSpanFromTraceparent, Rt as extractDbCause, Et as fingerprintFor, Ln as formatTraceparent, po as forwardChangeFromCdc, mi as frameworkApiKeyStrategy, mn as gauge, oi as generateApiKeyToken, Dn as getConnectionSubject, Kr as getFieldCipher, Xo as getResourcePolicy, No as getTimelineRecorder, $ as groupKeyOf, hn as histogramMetric, Sc as historyProvenance, zr as httpSecretsBackend, mt as inspectWorkflow, Mn as interruptConnectionStreams, so as invertChange, qs as isAggregateDefinition, zt as isForeignKeyViolation, Cs as isIdleNow, fr as isInfraError, uo as isSafeToApply, Ca as isScheduleDefinition, Ai as isWorkflowEventTriggerDefinition, Bo as ivmValue, xc as lastWriteProvenance, Zo as listResourcePolicies, C as listRetentions, ss as loadResourceTuples, us as loadSubjectTuples, ya as localityAwareSelector, gc as makeActionRunner, Wa as makeAdvisoryLockCoordinator, Hr as makeAesCipher, li as makeApiKeyService, Bt as makeAppAccess, ni as makeAsyncKv, jr as makeBufferingSpanProcessor, Xa as makeCoordinatedScheduler, va as makeEffectStoreLayer, Ii as makeEventsFacade, Ur as makeFieldCipher, $i as makeFluentStore, ws as makeIdleGate, Ti as makeLazyWorkflowFacade, dc as makeMutationRunner, Ci as makePostCommitWorkflowFacade, bs as makeProcessAdapter, hc as makeQueryDescriptorProducer, Ts as makeRouterActivity, Vi as makeSchemaRegistry, ao as makeUndoCapture, Es as makeWakeGate, ks as makeWakeProxyServer, Si as makeWorkflowFacade, wi as makeWorkflowFacadeWithCallerContext, Ei as makeWorkflowHandlers, Di as makeWorkflowLayers, vi as makeWorkflowRunHandle, Ma as markWakeupFired, Ho as materializeIvm, ui as memoryApiKeyStore, xa as memoryReplicationAdapter, Gn as memoryRywPositionStore, Da as nextFiring, za as nextWakeup, Ss as nodeProcessSupervisor, Bs as noopAnalytics, Us as noopAnalyticsSpec, ri as noopKv, kn as onBindConnectionSubject, Rn as parseTraceparent, Un as powerOfTwoSelector, Dc as previewInRollback, Va as pruneWakeups, $o as rebacPolicyGraph, cn as recordSample, fn as recordSubscriptionActive, un as recordSubscriptionDelivery, Fo as recordTimelineEvent, Oo as redactRow, qn as redisRywPositionStore, wo as redoUndoInvocation, jn as registerConnectionStream, re as registerRetention, Aa as registerWakeup, Fa as releaseWakeup, Wn as replicaHealth, Fr as resetSecretsBackend, ba as resolveCurrentRegion, Vt as resolveDependentTables, Wo as resolveRescan, Ir as resolveSecret, Lr as resolveSecretSync, Br as resolveSecretsBackend, To as resolveTimelineMode, ae as retentionTtlMsFromEnv, Ao as reverseEventOverRows, as as revokedIds, ma as runAsSystem, js as runOrchestratorTick, tc as runProvidedEffect, gs as runReaction, Ms as runSingleNodeOrchestrator, ys as runWakeLoop, Xn as runWithRoutingContext, Vn as runWithTraceContext, Ya as scheduleCoordinated, Gr as setFieldCipher, Pr as setSecretsBackend, fa as setSystemStoreHandle, Po as setTimelineRecorderForTest, ai as sha256Hex, Ha as singleCoordinator, _n as snapshotMetrics, vn as snapshotMetricsSync, _r as startRpcServer, Ka as startScheduler, se as sweepRetention, co as synthesizeInverse, Li as tracingHttpClientLayer, Oi as triggerWorkflow, Pa as tryClaimWakeup, On as unbindConnectionSubject, to as undoCaptureEnabled, xo as undoLogExecutor, Qs as useAggregate, Rs as useAnalytics, is as visibleRows, vs as wakeDueOnce, _i as workflowToRpc, io as wrapCaptureStore, sa as wrapStoreWithMixinBehaviour };
+export { di as API_KEYS_TABLE, oa as AccessDenied, vc as AggregateError, Ds as AggregateMaintainer, _c as AggregateNotFound, yc as AggregateRegistry, gc as AggregateStale, rc as AnalyticsCapabilityNotSupported, nc as AnalyticsError, ic as AnalyticsSink, Xa as CircuitBreaker, Ja as CircuitOpen, br as DEFAULT_MAX_RPC_BODY_BYTES, Va as DeleteBuilder, Cn as Dispatcher, Di as EffectStore, Rt as InMemoryDataStore, Et as IndexedMatcher, yt as LinearScanMatcher, He as MetricBoundaries, sc as NOOP_ANALYTICS_PROVIDER, Pa as NoRowFound, X as OUTBOX_TABLE, Fa as OptimisticLockError, aa as REBAC_ADMIN_SCOPE, Zc as RUNTIME_NAME, Ls as ReactionRateLimiter, nr as ReplicatedDataStore, za as SelectBuilder, Ti as StoreOperationFailed, kt as SubscriptionRegistry, Ei as TableValidationFailed, wi as TenantScopeViolation, ps as TimelineRecorder, Ko as UndoBoundaryError, Jo as UndoStack, Ba as UpdateBuilder, Da as VOLTRO_AUDIT_MIXIN_ID, Oa as VOLTRO_SOFT_DELETE_MIXIN_ID, ka as VOLTRO_TENANT_MIXIN_ID, Ln as _connectionStreamCount, Rn as _resetConnectionSubjectsForTest, Os as _voltroRebacTuplesTable, Fo as _voltroScheduleClaimsTable, Po as _voltroScheduleRunsTable, Io as _voltroTracesTable, Lo as _voltroUndoLogTable, zs as _voltroWakeupsTable, Yi as _voltroWorkflowEventDeliveriesTable, Ji as _voltroWorkflowEventsTable, Ci as apiKeyManagementRoutes, Wa as applyDefined, Ts as applyDelta, Xo as applyInverse, Zo as applyInverses, Sc as applySoftDeleteScope, xc as applyTenantScope, as as applyUndoInvocation, ga as assertCan, pc as attachAnalyticsMirror, Sr as awaitServerListening, ra as backoffMs, An as bindConnectionSubject, yr as bindMutation, dr as bindStream, ur as bindSubscription, cr as bindSubscriptionUntyped, Cs as buildIvmState, Jc as buildPreview, js as buildRebacInterceptor, Ns as buildRebacReadFilter, Xn as buildSubjectKey, Dr as buildTracingLayer, Hr as cachedBackend, ha as can, mo as cancelWakeup, ys as classifyShape, da as clearResourcePolicies, i as clearRetentions, $a as clearSystemStoreHandle, co as compileCron, uc as composeAnalytics, lc as composeAnalyticsSinks, zn as connectionSubjectsSnapshot, Qs as countRunningWorkflows, gn as counter, tr as currentRoutingContext, Kn as currentTraceContext, bi as dataStoreApiKeyStore, ri as dataStoreIdempotencyStore, ci as dataStoreKvStore, $r as decryptField, mc as defineAggregate, Ui as defineEventTrigger, ea as defineOutboxHandler, Ps as defineReaction, ca as defineResourcePolicy, so as defineSchedule, tc as defineSubscriber, Gr as deriveKey, qc as diffChange, ia as drainOutbox, xo as dueWakeups, ma as effectiveRelations, Na as emptySchemaRegistry, Qr as encryptField, Ir as envSecretsBackend, Un as externalSpanFromTraceparent, Bt as extractDbCause, Ot as fingerprintFor, Vn as formatTraceparent, Yo as forwardChangeFromCdc, xi as frameworkApiKeyStrategy, _n as gauge, pi as generateApiKeyToken, jn as getConnectionSubject, Xr as getFieldCipher, la as getResourcePolicy, hs as getTimelineRecorder, Sa as getTupleSource, $ as groupKeyOf, vn as histogramMetric, Gc as historyProvenance, Ur as httpSecretsBackend, gt as inspectWorkflow, Ca as installPolicyGuardResolver, In as interruptConnectionStreams, Wo as invertChange, hc as isAggregateDefinition, Vt as isForeignKeyViolation, Gs as isIdleNow, gr as isInfraError, qo as isSafeToApply, ao as isScheduleDefinition, Wi as isWorkflowEventTriggerDefinition, Ss as ivmValue, Wc as lastWriteProvenance, ua as listResourcePolicies, ee as listRetentions, ks as loadResourceTuples, Ms as loadSubjectTuples, to as localityAwareSelector, zc as makeActionRunner, Do as makeAdvisoryLockCoordinator, Kr as makeAesCipher, gi as makeApiKeyService, Ht as makeAppAccess, li as makeAsyncKv, Fr as makeBufferingSpanProcessor, No as makeCoordinatedScheduler, Ta as makeDataLoader, Ai as makeEffectStoreLayer, Xi as makeEventsFacade, qr as makeFieldCipher, Ha as makeFluentStore, Ks as makeIdleGate, zi as makeLazyWorkflowFacade, Nc as makeMutationRunner, na as makeOutboxFacade, Li as makePostCommitWorkflowFacade, Hs as makeProcessAdapter, Rc as makeQueryDescriptorProducer, Lc as makeQueryReauthorizer, qs as makeRouterActivity, Aa as makeSchemaRegistry, Ho as makeUndoCapture, Js as makeWakeGate, Zs as makeWakeProxyServer, Ii as makeWorkflowFacade, Ri as makeWorkflowFacadeWithCallerContext, Bi as makeWorkflowHandlers, Vi as makeWorkflowLayers, Mi as makeWorkflowRunHandle, ho as markWakeupFired, ws as materializeIvm, _i as memoryApiKeyStore, ro as memoryReplicationAdapter, Yn as memoryRywPositionStore, lo as nextFiring, So as nextWakeup, Ws as nodeProcessSupervisor, cc as noopAnalytics, dc as noopAnalyticsSpec, ui as noopKv, Nn as onBindConnectionSubject, $i as outboxTable, Hn as parseTraceparent, qn as powerOfTwoSelector, Xc as previewInRollback, wo as pruneWakeups, fa as rebacPolicyGraph, fn as recordSample, U as recordSubscriptionActive, mn as recordSubscriptionDelivery, _s as recordTimelineEvent, us as redactRow, Zn as redisRywPositionStore, os as redoUndoInvocation, Fn as registerConnectionStream, ae as registerRetention, po as registerWakeup, vo as releaseWakeup, Jn as replicaHealth, zr as resetSecretsBackend, no as resolveCurrentRegion, Ut as resolveDependentTables, Es as resolveRescan, Br as resolveSecret, Vr as resolveSecretSync, Wr as resolveSecretsBackend, ss as resolveTimelineMode, se as retentionTtlMsFromEnv, fs as reverseEventOverRows, va as revokedIds, eo as runAsSystem, $s as runOrchestratorTick, Cc as runProvidedEffect, Rs as runReaction, ec as runSingleNodeOrchestrator, Vs as runWakeLoop, er as runWithRoutingContext, Gn as runWithTraceContext, Mo as scheduleCoordinated, Yr as setFieldCipher, Rr as setSecretsBackend, Qa as setSystemStoreHandle, gs as setTimelineRecorderForTest, xa as setTupleSource, fi as sha256Hex, To as singleCoordinator, bn as snapshotMetrics, xn as snapshotMetricsSync, xr as startRpcServer, ko as startScheduler, le as sweepRetention, Go as synthesizeInverse, Ea as tracingHttpClientLayer, Hi as triggerWorkflow, _o as tryClaimWakeup, Mn as unbindConnectionSubject, Ro as undoCaptureEnabled, rs as undoLogExecutor, bc as useAggregate, oc as useAnalytics, _a as visibleRows, Bs as wakeDueOnce, ji as workflowToRpc, Vo as wrapCaptureStore, qa as wrapStoreWithMixinBehaviour };