@voltro/runtime 0.38.0 → 0.39.1

package/dist/index.js

@@ -1,8 +1,8 @@
 import { Cause as e, Clock as t, Context as n, Cron as r, Deferred as i, Duration as a, Effect as o, Either as s, Exit as c, Fiber as l, Layer as u, ManagedRuntime as d, Metric as f, MetricBoundaries as p, MetricState as m, Option as h, Queue as g, Ref as _, Schedule as v, Schema as y, Stream as b, Tracer as x } from "effect";
-import { ENCRYPTED_PREFIX as S, and as C, attachEagerLoads as w, attributionFields as T, boolean as E, clearRetentions as ee, collectSubqueries as D, contains as te, decryptFieldsOnRead as ne, deserializeArraysOnRead as re, encryptFieldsForWrite as ie, eq as O, evaluatePredicate as k, externalChangeEvent as ae, generateId as A, getRelations as oe, getTable as j, gt as se, gte as ce, hasEagerLoads as le, id as M, inSet as ue, integer as N, isEncrypted as de, isNull as fe, isTableReactive as pe, json as P, listRetentionConflicts as me, listRetentions as he, lt as ge, lte as _e, missingConflictColumns as ve, missingRequiredColumns as ye, neq as be, or as xe, planVersionedUpdate as Se, queryFor as Ce, raiseChangeListenerCeiling as we, readableByColumns as Te, registerRetention as Ee, registerRetention as De, requireTable as Oe, retentionTtlMsFromEnv as ke, retentionTtlMsFromEnv as Ae, runWithWriteAttribution as je, serializeArraysForWrite as Me, serverOnlyColumns as Ne, settleVersionedUpdate as Pe, stampGeneratedId as Fe, startsWith as Ie, sweepRetention as Le, table as F, text as I, timestamp as L, walkLeaves as Re } from "@voltro/database";
-import { createCipheriv as ze, createDecipheriv as Be, createHash as Ve, randomBytes as He, randomUUID as Ue, scryptSync as We } from "node:crypto";
-import { EventEmitter as Ge } from "node:events";
-import { ADMIN_SCOPE as Ke, APIKEY_ISSUE_ORG_SCOPE as qe, APIKEY_ISSUE_OTHER_SCOPE as Je, APIKEY_ISSUE_SELF_SCOPE as Ye, ApprovalExpired as Xe, ApprovalForbidden as Ze, ApprovalNotFound as Qe, ApprovalNotPending as $e, ApprovalRejected as et, ApprovalRequired as tt, ApprovalSelfApproval as nt, ApprovalUnavailable as rt, AuthMiddleware as it, BusinessRuleViolation as at, ConnectionHandshakeFailed as R, ConnectionInfo as ot, ConnectionInfoMiddleware as st, ConnectionKindMismatch as ct, ConnectionNotDeclared as lt, ConnectionSubjectRequired as ut, EventKeyInvalid as dt, EventPayloadInvalid as ft, EventPayloadTooLarge as pt, MAX_EVENT_ENVELOPE_BYTES as mt, ScopeError as ht, SubjectService as gt, UndoConflict as _t, UndoForbidden as vt, UndoNotFound as yt, WorkflowRunHandleSchema as bt, beginIdempotent as xt, checkGuardsEffect as z, declaredReactivityChannelKeys as St, diffRows as Ct, effectiveScopes as wt, eventRoute as Tt, failIdempotent as Et, finishIdempotent as Dt, hasEffectiveScope as Ot, isIdKeyed as kt, isOpenAccess as At, isPolicyGuard as jt, isReactivityChannelKey as Mt, parseEventRoute as Nt, publishServerError as Pt, requireScope as Ft, setPolicyGuardResolver as It, sourceKeys as Lt, strictInput as Rt, systemSubject as zt, tsMs as Bt, wsMutationIdempotencyScope as Vt } from "@voltro/protocol";
+import { ENCRYPTED_PREFIX as S, and as C, attachEagerLoads as w, attributionFields as T, boolean as E, clearRetentions as ee, collectSubqueries as D, contains as te, decryptFieldsOnRead as ne, deserializeArraysOnRead as re, encryptFieldsForWrite as ie, eq as O, evaluatePredicate as k, externalChangeEvent as ae, generateId as A, getRelations as oe, getTable as j, gt as M, gte as se, hasEagerLoads as ce, id as N, inSet as le, integer as P, isEncrypted as ue, isNull as de, isTableReactive as fe, json as F, listRetentionConflicts as pe, listRetentions as me, lt as he, lte as ge, missingConflictColumns as _e, missingRequiredColumns as ve, neq as ye, or as be, planVersionedUpdate as xe, queryFor as Se, raiseChangeListenerCeiling as Ce, readableByColumns as we, registerRetention as Te, registerRetention as Ee, requireTable as De, retentionTtlMsFromEnv as Oe, retentionTtlMsFromEnv as ke, runWithWriteAttribution as Ae, serializeArraysForWrite as je, serverOnlyColumns as Me, settleVersionedUpdate as Ne, stampGeneratedId as Pe, startsWith as Fe, sweepRetention as Ie, table as I, text as L, timestamp as R, walkLeaves as Le } from "@voltro/database";
+import { createCipheriv as Re, createDecipheriv as ze, createHash as Be, randomBytes as Ve, randomUUID as He, scryptSync as Ue } from "node:crypto";
+import { EventEmitter as We } from "node:events";
+import { ADMIN_SCOPE as Ge, APIKEY_ISSUE_ORG_SCOPE as Ke, APIKEY_ISSUE_OTHER_SCOPE as qe, APIKEY_ISSUE_SELF_SCOPE as Je, ApprovalExpired as Ye, ApprovalForbidden as Xe, ApprovalNotFound as Ze, ApprovalNotPending as Qe, ApprovalRejected as $e, ApprovalRequired as et, ApprovalSelfApproval as tt, ApprovalUnavailable as nt, AuthMiddleware as rt, BusinessRuleViolation as it, ConnectionHandshakeFailed as z, ConnectionInfo as at, ConnectionInfoMiddleware as ot, ConnectionKindMismatch as st, ConnectionNotDeclared as ct, ConnectionSubjectRequired as lt, EventKeyInvalid as ut, EventPayloadInvalid as dt, EventPayloadTooLarge as ft, MAX_EVENT_ENVELOPE_BYTES as pt, ScopeError as mt, SubjectService as ht, UndoConflict as gt, UndoForbidden as _t, UndoNotFound as vt, WorkflowRunHandleSchema as yt, beginIdempotent as bt, checkGuardsEffect as xt, declaredReactivityChannelKeys as St, diffRows as Ct, effectiveScopes as wt, eventRoute as Tt, failIdempotent as Et, finishIdempotent as Dt, hasEffectiveScope as Ot, isIdKeyed as kt, isOpenAccess as At, isPolicyGuard as jt, isReactivityChannelKey as Mt, parseEventRoute as Nt, publishServerError as Pt, requireScope as Ft, setPolicyGuardResolver as It, sourceKeys as Lt, strictInput as Rt, systemSubject as zt, tsMs as Bt, wsMutationIdempotencyScope as Vt } from "@voltro/protocol";
 import { createLogger as B, log as Ht } from "@voltro/logger";
 import { AsyncLocalStorage as Ut } from "node:async_hooks";
 import * as Wt from "node:http";
@@ -66,7 +66,7 @@ var En = (e) => {
 	}
 }, On = (e) => {
 	let t = [];
-	for (let n of Re(e)) n.conjunctive && n.path === void 0 && (n.op === "eq" && t.push({
+	for (let n of Le(e)) n.conjunctive && n.path === void 0 && (n.op === "eq" && t.push({
 		column: n.column,
 		values: [n.value]
 	}), n.op === "in" && t.push({
@@ -76,14 +76,14 @@ var En = (e) => {
 	return t;
 }, kn = (e) => {
 	let t = [];
-	for (let n of Re(e)) n.conjunctive && n.path === void 0 && (n.op === "gt" || n.op === "gte" || n.op === "lt" || n.op === "lte") && t.push({
+	for (let n of Le(e)) n.conjunctive && n.path === void 0 && (n.op === "gt" || n.op === "gte" || n.op === "lt" || n.op === "lte") && t.push({
 		column: n.column,
 		op: n.op,
 		threshold: n.value
 	});
 	return t;
 }, An = (e, t) => {
-	for (let n of Re(e)) if (n.conjunctive && n.path === void 0 && n.op === "eq" && n.column === t) return n.value;
+	for (let n of Le(e)) if (n.conjunctive && n.path === void 0 && n.op === "eq" && n.column === t) return n.value;
 	return null;
 }, jn = (e, t) => {
 	let n = [];
@@ -317,7 +317,7 @@ var En = (e) => {
 		predicate: t,
 		indexHint: n ?? null
 	});
-	return Ve("sha256").update(JSON.stringify(r)).digest("hex").slice(0, 16);
+	return Be("sha256").update(JSON.stringify(r)).digest("hex").slice(0, 16);
 }, Ln = class {
 	matcher;
 	byFingerprint = /* @__PURE__ */ new Map();
@@ -532,7 +532,7 @@ var En = (e) => {
 	#e;
 	#t;
 	#n(e) {
-		pe(e.table) && this.#t.emit("change", {
+		fe(e.table) && this.#t.emit("change", {
 			...T(),
 			...e
 		});
@@ -544,7 +544,7 @@ var En = (e) => {
 		return r.#e = t.tables, r.#t = t.emitter, r.#r = t.numericCounters, r;
 	}
 	constructor(e, t = null) {
-		if (this.#i = t, this.#e = /* @__PURE__ */ new Map(), this.#t = new Ge(), we(this.#t), this.#r = /* @__PURE__ */ new Map(), e) for (let [n, r] of Object.entries(e)) {
+		if (this.#i = t, this.#e = /* @__PURE__ */ new Map(), this.#t = new We(), Ce(this.#t), this.#r = /* @__PURE__ */ new Map(), e) for (let [n, r] of Object.entries(e)) {
 			let e = /* @__PURE__ */ new Map();
 			for (let t of r) {
 				let n = t.id;
@@ -574,10 +574,10 @@ var En = (e) => {
 	}
 	async query(e) {
 		let t = Hn(e, this.#e.get(this.#o(e.table)) ?? /* @__PURE__ */ new Map(), this.#s());
-		return le(e) ? w(t, e.eager, Oe(e.table), (e) => this.query(e)) : t;
+		return ce(e) ? w(t, e.eager, De(e.table), (e) => this.query(e)) : t;
 	}
 	async insert(e, t) {
-		t = Fe(e, t);
+		t = Pe(e, t);
 		let n = t;
 		if (n.id === void 0) {
 			let r = this.#l(e);
@@ -768,10 +768,10 @@ var En = (e) => {
 	}
 	async query(e) {
 		let t = this.buildTablesView(e), n = Hn(e, this.materialise(e.table), t);
-		return le(e) ? w(n, e.eager, Oe(e.table), (e) => this.query(e)) : n;
+		return ce(e) ? w(n, e.eager, De(e.table), (e) => this.query(e)) : n;
 	}
 	async insert(e, t) {
-		t = Fe(e, t);
+		t = Pe(e, t);
 		let n = t;
 		n.id === void 0 && (n = {
 			...t,
@@ -982,7 +982,7 @@ var En = (e) => {
 			t.add(e.column);
 			return;
 		}
-		e.op === "exists" || e.op === "not-exists" || t.add(e.column);
+		e.op !== "exists" && e.op !== "not-exists" && t.add(e.column);
 	}
 }, U = (e, t, n) => {
 	let r = e.get(t);
@@ -1145,7 +1145,7 @@ var En = (e) => {
 	};
 }, Si = (e) => {
 	let t = j(e);
-	return t === void 0 ? [] : Ne(t);
+	return t === void 0 ? [] : Me(t);
 }, Ci = (e, t) => {
 	if (t.length === 0) return e;
 	let n = !1, r = e.map((e) => {
@@ -1157,7 +1157,7 @@ var En = (e) => {
 }, wi = (e, t) => Ci(t, Si(e)), Ti = (e, t) => {
 	let n = j(e);
 	if (n === void 0) return [];
-	let r = Ne(n), i = Te(n);
+	let r = Me(n), i = we(n);
 	if (i.length === 0) return r;
 	let a = [...r];
 	for (let { column: e, scopes: n } of i) n.some((e) => Ot(t, e)) || a.push(e);
@@ -1188,7 +1188,7 @@ var En = (e) => {
 		}
 	}
 	async subscribe(e, t, n, r, i, a, o, s) {
-		let c = `sub_${Ue()}`, l = i ?? `subscription.${e.table}`, u = lr(e), d = _r(e);
+		let c = `sub_${He()}`, l = i ?? `subscription.${e.table}`, u = lr(e), d = _r(e);
 		e.predicate !== void 0 && this.subscriptionRegistry.subscribe(c, e.table, e.predicate, r);
 		for (let e of u) {
 			let t = this.dependentByTable.get(e);
@@ -1272,7 +1272,7 @@ var En = (e) => {
 		});
 	}
 	async subscribeComputed(e, t, n, r) {
-		let i = `csub_${Ue()}`, a = r ?? "subscription.computed", o = or(), s = new Set(e.dependentTables);
+		let i = `csub_${He()}`, a = r ?? "subscription.computed", o = or(), s = new Set(e.dependentTables);
 		for (let e of o) for (let t of e.dependsOn) s.add(t);
 		let c = Array.from(s);
 		this.warnUndeclaredRawReads(a, o.filter((e) => e.dependsOn.length === 0));
@@ -1514,7 +1514,7 @@ var En = (e) => {
 	if (e.length !== t.length) return !1;
 	for (let n = 0; n < e.length; n++) if (JSON.stringify(e[n]) !== JSON.stringify(t[n])) return !1;
 	return !0;
-}, Mi = (e) => typeof e == "object" && !!e && e.__voltroComputed === !0, Ni = 1440 * 60 * 1e3, Pi = 3600 * 1e3, Fi = /* @__PURE__ */ new Map(), Ii = /* @__PURE__ */ new Map(), Li = (e, t) => {
+}, Mi = (e) => typeof e == "object" && !!e && e.__voltroComputed === !0, Ni = 864e5, Pi = 36e5, Fi = /* @__PURE__ */ new Map(), Ii = /* @__PURE__ */ new Map(), Li = (e, t) => {
 	t === void 0 ? Ii.delete(e) : Ii.set(e, t);
 }, Ri = (e) => Ii.get(e), zi = (e, t) => {
 	Fi.set(e, {
@@ -1609,17 +1609,17 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 	if (e.size === 0) return !1;
 	for (let n of e) if (n in t) return !0;
 	return !1;
-}, ia = (e) => /^[0-9a-f]{64}$/i.test(e) ? Buffer.from(e, "hex") : We(e, "voltro:field-encryption:v1", 32), aa = (e) => {
+}, ia = (e) => /^[0-9a-f]{64}$/i.test(e) ? Buffer.from(e, "hex") : Ue(e, "voltro:field-encryption:v1", 32), aa = (e) => {
 	if (e.length !== 32) throw Error(`field cipher key must be 32 bytes, got ${e.length}`);
 	return {
 		encrypt: (t) => {
-			let n = He(12), r = ze("aes-256-gcm", e, n), i = Buffer.concat([r.update(t, "utf8"), r.final()]), a = r.getAuthTag();
+			let n = Ve(12), r = Re("aes-256-gcm", e, n), i = Buffer.concat([r.update(t, "utf8"), r.final()]), a = r.getAuthTag();
 			return `${S}${n.toString("base64")}:${a.toString("base64")}:${i.toString("base64")}`;
 		},
 		decrypt: (t) => {
 			let [n, r, i] = t.slice(S.length).split(":");
 			if (!n || !r || i === void 0) throw Error("field cipher: malformed ciphertext");
-			let a = Be("aes-256-gcm", e, Buffer.from(n, "base64"));
+			let a = ze("aes-256-gcm", e, Buffer.from(n, "base64"));
 			return a.setAuthTag(Buffer.from(r, "base64")), Buffer.concat([a.update(Buffer.from(i, "base64")), a.final()]).toString("utf8");
 		}
 	};
@@ -1630,7 +1630,7 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 	if (!t) throw Error(`encryptField: ${la}`);
 	return t.encrypt(e);
 }, da = (e) => {
-	if (!de(e)) return e;
+	if (!ue(e)) return e;
 	let t = K();
 	if (!t) throw Error(`decryptField: ${la}`);
 	return t.decrypt(e);
@@ -1699,21 +1699,21 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 	switch (n) {
 		case "=": return O(t, r);
 		case "!=":
-		case "<>": return be(t, r);
-		case ">": return se(t, r);
-		case ">=": return ce(t, r);
-		case "<": return ge(t, r);
-		case "<=": return _e(t, r);
-		case "in": return ue(t, r);
+		case "<>": return ye(t, r);
+		case ">": return M(t, r);
+		case ">=": return se(t, r);
+		case "<": return he(t, r);
+		case "<=": return ge(t, r);
+		case "in": return le(t, r);
 		case "contains":
 		case "fts": return te(t, r);
-		case "startsWith": return Ie(t, r);
+		case "startsWith": return Fe(t, r);
 		default: return O(t, r);
 	}
 }, Oa = (e) => {
 	let t = j(e);
 	if (t === void 0) throw Error(`unknown table '${e}' — is it declared with table()?`);
-	return Ce(t);
+	return Se(t);
 }, ka = class e {
 	backend;
 	scope;
@@ -1762,7 +1762,7 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 	}
 	scopedQuery() {
 		let e = this.query, { subject: t, schemaRegistry: n } = this.scope;
-		!this.skipTenant && n.hasTenant(this.table) && t.tenantId != null && (e = e.where(O("tenantId", t.tenantId))), !this.skipSoftDelete && n.hasSoftDelete(this.table) && (e = e.where(fe("deletedAt")));
+		!this.skipTenant && n.hasTenant(this.table) && t.tenantId != null && (e = e.where(O("tenantId", t.tenantId))), !this.skipSoftDelete && n.hasSoftDelete(this.table) && (e = e.where(de("deletedAt")));
 		let r = (this.scope.rowFilter ?? gi)(this.table);
 		return r !== void 0 && (e = e.where(r)), e;
 	}
@@ -1917,10 +1917,12 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 	if (t.rowFilter === void 0 && t.subject.type !== "system" && hi()) throw Error("row filter registered, but this store was scoped without one — refusing to serve an unfiltered read.\n\nThis app called `setRowFilter`, so every scoped store must receive a resolved `rowFilter` (the serve pipeline's `withRowFilter` does this per request). Reaching here with none means a read path was built outside that spine, and continuing would serve rows the filter exists to hide — silently, which is how this was found in the first place.\n\nIf this path is deliberately unfiltered (a system sweep, a migration), pass `rowFilter: NO_ROW_FILTER` explicitly.");
 	let a = t.rowFilter ?? gi, o = (e, n) => {
 		let a = { ...n }, o = t.schemaRegistry, s = o.idScheme(e);
-		if (s !== void 0 && a[Ra] == null) if (s.kind === "numeric") delete a[Ra];
-		else {
-			let t = A(s, e);
-			t !== null && (a[Ra] = t);
+		if (s !== void 0 && a[Ra] == null) {
+			if (s.kind === "numeric") delete a[Ra];
+			else {
+				let t = A(s, e);
+				t !== null && (a[Ra] = t);
+			}
 		}
 		if (o.hasAudit(e)) {
 			let e = /* @__PURE__ */ new Date();
@@ -1980,7 +1982,7 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 		let e = { deletedAt: /* @__PURE__ */ new Date() };
 		return r !== null && (e.deletedBy = r), e;
 	}, f = (e, t, n) => {
-		let r = ve(n, t);
+		let r = _e(n, t);
 		if (r.length !== 0) throw new Fa({
 			table: e,
 			summary: `upsert conflictColumns [${n.map((e) => `'${e}'`).join(", ")}] but the payload is missing ${r.map((e) => `'${e}'`).join(", ")}`,
@@ -1992,7 +1994,7 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 	}, p = (e, n) => {
 		let r = j(e);
 		if (r !== void 0) {
-			let t = ye(r, n);
+			let t = ve(r, n);
 			if (t.length > 0) throw new Fa({
 				table: e,
 				summary: `missing required column${t.length > 1 ? "s" : ""} ${t.map((e) => `'${e}'`).join(", ")} — NOT NULL with no default and not auto-stamped`,
@@ -2016,8 +2018,8 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 			issues: o
 		});
 	}, m = t.dialect, h = (e, t) => {
-		let n = j(e);
-		return ie(m ? Me(t, n, m) : t, n, K());
+		let n = j(e), r = m ? je(t, n, m) : t;
+		return ie(r, n, K());
 	}, g = process.env.VOLTRO_FIELD_DECRYPT_ON_ERROR === "null" ? "null" : "throw", _ = B({ scope: "store.fieldEncryption" }), v = /* @__PURE__ */ new Set(), b = (e) => {
 		let t = `${e.table}.${e.column}`;
 		v.has(t) || (v.add(t), _.warn("encrypted column degraded to null — could not decrypt with the active key", {
@@ -2039,11 +2041,11 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 			r = r ? C(r, e) : e;
 		}
 		if (!e.includeDeleted && t.schemaRegistry.hasSoftDelete(n)) {
-			let e = fe("deletedAt");
+			let e = de("deletedAt");
 			r = r ? C(r, e) : e;
 		}
 		if (!e.includeExpired && t.schemaRegistry.hasExpires(n)) {
-			let e = xe(fe("expiresAt"), se("expiresAt", /* @__PURE__ */ new Date()));
+			let e = be(de("expiresAt"), M("expiresAt", /* @__PURE__ */ new Date()));
 			r = r ? C(r, e) : e;
 		}
 		return r = bi(a, n, r), r === e.predicate ? e : {
@@ -2089,7 +2091,7 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 		a = u(e, a);
 		let d = t.schemaRegistry.versionColumn(e);
 		if (d !== void 0) {
-			let t = Se({
+			let t = xe({
 				versionColumn: d,
 				patch: a
 			}), i = await n.query({
@@ -2103,7 +2105,7 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 				take: 1,
 				skip: void 0,
 				projection: void 0
-			}), o = i[0] === void 0 ? void 0 : i[0][d], s = typeof o == "number" && Number.isFinite(o) ? o : null, c = Pe({
+			}), o = i[0] === void 0 ? void 0 : i[0][d], s = typeof o == "number" && Number.isFinite(o) ? o : null, c = Ne({
 				table: e,
 				id: r,
 				expected: t.expected,
@@ -2121,10 +2123,10 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 	}, D = async (e, r) => (await E(e, r), t.schemaRegistry.hasSoftDelete(e) ? await n.update(e, r, d()) !== null : n.delete(e, r)), te = async (e, t, r) => n.updateMany(e, h(e, s(e, t)), r), k = async (e, t) => n.deleteMany(e, t), ae = (e, n) => i != null && t.schemaRegistry.hasTenant(e) ? C(n, O("tenantId", i)) : n, oe = async (e, t, n) => te(e, t, {
 		...n,
 		where: ae(e, n.where)
-	}), ce = async (e, t) => k(e, {
+	}), se = async (e, t) => k(e, {
 		...t,
 		where: ae(e, t.where)
-	}), le = Ma({
+	}), ce = Ma({
 		query: w,
 		updateMany: te,
 		deleteMany: k,
@@ -2133,10 +2135,10 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 		subject: t.subject,
 		schemaRegistry: t.schemaRegistry,
 		rowFilter: a
-	}), M = ((e, t, n) => t === void 0 ? le.updateWhere(e) : ee(e, t, n)), N = ((e, t) => t === void 0 ? le.deleteWhere(e) : D(e, t)), de = async (e, t) => {
+	}), N = ((e, t, n) => t === void 0 ? ce.updateWhere(e) : ee(e, t, n)), P = ((e, t) => t === void 0 ? ce.deleteWhere(e) : D(e, t)), ue = async (e, t) => {
 		let r = t.map((t) => o(e, t)), i = r.map((t) => h(e, p(e, t))), a = await c(e, r[0] ?? {}, () => n.insertMany(e, i));
 		return x(e, a);
-	}, pe = (e, t) => {
+	}, fe = (e, t) => {
 		let n = Object.keys(t);
 		if (n.length !== 1) throw Error(`store.links('${e}'): anchor must name exactly one source column, got [${n.join(", ")}]`);
 		let r = n[0], i = t[r], a = j(e);
@@ -2179,9 +2181,9 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 			let r = o(e, t), i = await c(e, r, () => n.insert(e, h(e, p(e, r))));
 			return x(e, [i])[0];
 		},
-		insertMany: (async (e, t) => de(e, t)),
+		insertMany: (async (e, t) => ue(e, t)),
 		links: (e, t) => {
-			let { sourceCol: n, sourceId: r, targetCol: i } = pe(e, t), a = async () => (await T({
+			let { sourceCol: n, sourceId: r, targetCol: i } = fe(e, t), a = async () => (await T({
 				table: e,
 				predicate: O(n, r),
 				order: [],
@@ -2189,12 +2191,12 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 				skip: void 0,
 				take: void 0
 			})).map((e) => String(e[i])), o = async (t) => {
-				t.length !== 0 && await de(e, t.map((e) => ({
+				t.length !== 0 && await ue(e, t.map((e) => ({
 					[n]: r,
 					[i]: e
 				})));
 			}, s = async (t) => {
-				t.length !== 0 && await ce(e, { where: C(O(n, r), ue(i, t)) });
+				t.length !== 0 && await se(e, { where: C(O(n, r), le(i, t)) });
 			};
 			return {
 				list: a,
@@ -2235,10 +2237,10 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 					});
 					else {
 						let s = a.get(t), c = {}, l = !1;
-						for (let [e, t] of Object.entries(o)) e === n || e === i || s[e] !== t && (c[e] = t, l = !0);
+						for (let [e, t] of Object.entries(o)) e !== n && e !== i && s[e] !== t && (c[e] = t, l = !0);
 						l && (d.push(t), await oe(e, c, { where: C(O(n, r), O(i, t)) }));
 					}
-					return f.length > 0 && await de(e, f), {
+					return f.length > 0 && await ue(e, f), {
 						added: u,
 						removed: l,
 						updated: d
@@ -2251,13 +2253,13 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 			let a = await n.patchJson(e, t, r, i);
 			return a === null ? null : x(e, [a])[0];
 		},
-		select: le.select,
-		update: M,
-		delete: N,
+		select: ce.select,
+		update: N,
+		delete: P,
 		applyDefined: Ba,
 		hardDelete: async (e, t) => (await E(e, t), n.delete(e, t)),
 		updateMany: oe,
-		deleteMany: ce,
+		deleteMany: se,
 		upsert: async (e, t, r) => {
 			let i = o(e, t);
 			f(e, i, r.conflictColumns);
@@ -2365,13 +2367,15 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 	let t = e.now ?? Date.now, n = e.keyPrefix ?? "voltro:ryw", r = e.channel ?? `${n}:bus`, i = e.onError ?? ((e, t) => {
 		process.stderr.write(`[voltro:ryw] redis ${t} failed: ${String(e)}\n`);
 	}), a = `${process.pid ?? 0}:${Math.random() * 1e9 | 0}:${t()}`, o = /* @__PURE__ */ new Map(), s = (e) => {
-		if (e.senderId !== a) if (e.op === "set") {
-			if (e.position === void 0 || e.expiresAt === void 0) return;
-			o.set(e.subjectKey, {
-				position: e.position,
-				expiresAt: e.expiresAt
-			});
-		} else o.delete(e.subjectKey);
+		if (e.senderId !== a) {
+			if (e.op === "set") {
+				if (e.position === void 0 || e.expiresAt === void 0) return;
+				o.set(e.subjectKey, {
+					position: e.position,
+					expiresAt: e.expiresAt
+				});
+			} else o.delete(e.subjectKey);
+		}
 	};
 	e.subscriber.subscribe(r).then(() => {
 		e.subscriber.on("message", (e, t) => {
@@ -3002,7 +3006,7 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 			tag: r,
 			kind: "query"
 		};
-		if (!(n !== "query" && n !== "mutation" && n !== "action" && n !== "stream")) return {
+		if (n === "query" || n === "mutation" || n === "action" || n === "stream") return {
 			tag: r,
 			kind: n
 		};
@@ -3011,13 +3015,13 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 	let n = Ho(e);
 	return n === void 0 ? t() : ya(n, t);
 }, Wo = (e, t, n, r) => e === "subject" ? `${t}:s:${n}` : e === "global" ? `${t}:global` : r.tenantId == null ? void 0 : `${t}:t:${r.tenantId}`, Go = (e, t) => o.async((n) => {
-	let r = je(t, () => o.runFork(e));
+	let r = Ae(t, () => o.runFork(e));
 	return r.addObserver((e) => {
 		n(e);
 	}), o.asVoid(l.interrupt(r));
 }), Ko = (e, t, n) => ({
 	subject: e,
-	traceId: t?.traceId ?? Ue(),
+	traceId: t?.traceId ?? He(),
 	...t?.spanId === void 0 ? {} : { spanId: t.spanId },
 	...n === void 0 ? {} : { clientId: n }
 }), qo = o.currentSpan.pipe(o.catchAll(() => o.succeed(void 0))), Jo = (e) => ({
@@ -3095,7 +3099,7 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 		yield* o.addFinalizer(() => o.sync(() => e()));
 	}
 })), ns = (e, t, n = "rpc.subscription", r, i, a, s) => b.unwrap(o.gen(function* () {
-	let c = yield* gt, l = yield* ot, u = yield* qo;
+	let c = yield* ht, l = yield* at, u = yield* qo;
 	Yo(u, n, c);
 	let d = Ko(c, u, l.clientId), f = Ja(c.id, l.clientId), p = Qa({ subjectKey: f }, () => ea({
 		traceId: d.traceId,
@@ -3126,9 +3130,9 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 		swrMs: i.swrMs
 	}, a?.(c), s?.(c) ?? Xo(c)), l.credentialExpiresAt, b.empty);
 }).pipe(o.withSpan(n, { attributes: { "framework.kind": "subscription" } }))), rs = (e, t = "rpc.stream", n, r) => b.unwrap(o.gen(function* () {
-	let a = yield* gt, s = yield* ot, c = yield* qo;
+	let a = yield* ht, s = yield* at, c = yield* qo;
 	Yo(c, t, a);
-	let l = Ko(a, c, s.clientId), u = Uo(t, () => e(l)), d = o.isEffect(u) ? yield* u.pipe(o.orDie) : u, f = n === void 0 || n.length === 0 ? void 0 : () => z(a, n, r), p = io(f === void 0 ? d : b.unwrap(f().pipe(o.map((e) => e ? b.fail(e) : b.flatMap(d, (e) => b.unwrap(f().pipe(o.map((t) => t ? b.fail(t) : b.make(e)))))))), s.credentialExpiresAt, b.empty);
+	let l = Ko(a, c, s.clientId), u = Uo(t, () => e(l)), d = o.isEffect(u) ? yield* u.pipe(o.orDie) : u, f = n === void 0 || n.length === 0 ? void 0 : () => xt(a, n, r), p = io(f === void 0 ? d : b.unwrap(f().pipe(o.map((e) => e ? b.fail(e) : b.flatMap(d, (e) => b.unwrap(f().pipe(o.map((t) => t ? b.fail(t) : b.make(e)))))))), s.credentialExpiresAt, b.empty);
 	if (l.clientId === void 0) return p;
 	let m = l.clientId;
 	return b.unwrapScoped(o.gen(function* () {
@@ -3169,7 +3173,7 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 		message: "internal server error"
 	};
 	let r = n && typeof n == "object" ? n : {}, i = {};
-	for (let [e, t] of Object.entries(r)) e === "cause" || e === "stack" || e === "message" || (t === null || typeof t == "string" || typeof t == "number" || typeof t == "boolean") && (i[e] = t);
+	for (let [e, t] of Object.entries(r)) e !== "cause" && e !== "stack" && e !== "message" && (t === null || typeof t == "string" || typeof t == "number" || typeof t == "boolean") && (i[e] = t);
 	let a = n?._tag, o = n instanceof Error ? n.message : n?.message;
 	return {
 		...i,
@@ -3200,7 +3204,7 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 	message: "a request with this idempotency key is already in flight",
 	traceId: e
 }), gs = (e, t, n = "rpc.mutation", r, i, a) => o.gen(function* () {
-	let s = yield* gt, c = yield* ot, l = yield* qo;
+	let s = yield* ht, c = yield* at, l = yield* qo;
 	Yo(l, n, s);
 	let u = Ko(s, l, c.clientId), d = i && c.idempotencyKey ? {
 		store: i.store,
@@ -3209,7 +3213,7 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 		scope: Vt(s.tenantId, Ua(s), n)
 	} : null;
 	if (d) {
-		let e = yield* o.promise(() => xt(d.store, d.scope, d.key, d.ttlMs, Date.now()));
+		let e = yield* o.promise(() => bt(d.store, d.scope, d.key, d.ttlMs, Date.now()));
 		if (e.kind === "replay") return r ? r.decode(e.response.body) : e.response.body;
 		if (e.kind === "conflict") return yield* o.die(hs(u.traceId));
 	}
@@ -3220,7 +3224,7 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 	}, m = Qa({ subjectKey: f }, () => ea({
 		traceId: u.traceId,
 		...u.spanId === void 0 ? {} : { spanId: u.spanId }
-	}, () => je(p, () => Uo(n, () => e(t, u))))), h = o.isEffect(m) ? Go(m, p) : o.tryPromise({
+	}, () => Ae(p, () => Uo(n, () => e(t, u))))), h = o.isEffect(m) ? Go(m, p) : o.tryPromise({
 		try: () => Promise.resolve(m),
 		catch: (e) => e
 	});
@@ -3228,7 +3232,7 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 		status: 200,
 		body: r ? r.encode(e) : e
 	}, Date.now())).pipe(o.ignore)), o.tapErrorCause(() => o.promise(() => Et(d.store, d.scope, d.key)).pipe(o.ignore))) : h).pipe(o.tapErrorCause((e) => o.sync(() => ss(n, u.traceId, e))), o.catchIf(ls, () => o.die(ds(u.traceId))), o.catchIf((e) => e instanceof Error && typeof e._tag != "string", (e) => o.die(ds(u.traceId, fs(e)))), o.catchIf((e) => a !== void 0 && typeof e?._tag == "string" && !us(a, e), (e) => o.die(ds(u.traceId, fs(e)))), o.catchAllDefect((e) => e?._tag === "InternalError" ? o.die(e) : o.die(ds(u.traceId, fs(e)))), o.annotateLogs(Jo(u)));
-}).pipe(o.withSpan(n, { attributes: { "framework.kind": "mutation" } })), _s = 8 * 1024 * 1024, vs = (t) => {
+}).pipe(o.withSpan(n, { attributes: { "framework.kind": "mutation" } })), _s = 8388608, vs = (t) => {
 	let n = t.port ?? 4e3, r = t.host, i = t.path ?? "/ws", a = i;
 	Vo(t.webhookRoutes);
 	let s = Gt(), c = (e) => Zt.HttpServerRequest.pipe(o.flatMap((e) => o.gen(function* () {
@@ -3510,11 +3514,11 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 	t.tracerLayer && (A = A.pipe(u.provide(t.tracerLayer)));
 	let oe = B({ scope: "voltro:rpc" }), j = u.launch(A).pipe(o.catchAllCause((t) => o.sync(() => {
 		oe.error("rpc server crashed", {}, e.squash(t)), process.exit(1);
-	}))), se = o.runFork(j);
-	return ys.add(se), Os(), {
+	}))), M = o.runFork(j);
+	return ys.add(M), Os(), {
 		server: s,
 		shutdown: async () => {
-			ys.delete(se), await o.runPromise(l.interrupt(se)).then(() => void 0, () => void 0);
+			ys.delete(M), await o.runPromise(l.interrupt(M)).then(() => void 0, () => void 0);
 		}
 	};
 }, ys = /* @__PURE__ */ new Set(), bs = /* @__PURE__ */ new Set(), xs = !1, Ss = (e) => (bs.add(e), () => {
@@ -3853,10 +3857,10 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 		}),
 		has: (n) => t("has", n, async () => {
 			let t = await cc(e, n);
-			return t === null ? !1 : oc(t, Date.now()) ? (await e.delete(q, t.id), !1) : !0;
+			return t === null ? !1 : !oc(t, Date.now()) || (await e.delete(q, t.id), !1);
 		}),
 		list: (n) => t("list", "", async () => {
-			let t = Date.now(), r = xe(fe("expiresAt"), se("expiresAt", new Date(t))), i = n === "" ? r : C(te("key", n), r), a = await e.query({
+			let t = Date.now(), r = be(de("expiresAt"), M("expiresAt", new Date(t))), i = n === "" ? r : C(te("key", n), r), a = await e.query({
 				table: q,
 				predicate: i,
 				order: [],
@@ -3898,7 +3902,7 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 	has: () => Promise.resolve(!1),
 	list: () => Promise.resolve([]),
 	clear: () => Promise.resolve()
-}, fc = "_voltro_api_keys", pc = (e) => Ve("sha256").update(e, "utf8").digest("hex"), mc = (e = "voltro_") => `${e}${He(30).toString("base64url")}`, hc = (e) => ({
+}, fc = "_voltro_api_keys", pc = (e) => Be("sha256").update(e, "utf8").digest("hex"), mc = (e = "voltro_") => `${e}${Ve(30).toString("base64url")}`, hc = (e) => ({
 	id: e.id,
 	name: e.name,
 	keyPrefix: e.keyPrefix,
@@ -4080,10 +4084,10 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 			path: `${t}/issue`,
 			summary: "Issue an API key (the token is returned ONCE).",
 			guards: [sn([
+				Ge,
+				Je,
 				Ke,
-				Ye,
-				qe,
-				Je
+				qe
 			])],
 			input: y.Struct({ body: y.Struct({
 				name: y.String,
@@ -4097,25 +4101,25 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 				keyPrefix: y.String
 			}),
 			handler: async (t, n) => {
-				let r = t.body, i = wc(n), a = new Set(i.scopes), o = (e) => a.has(Ke) || a.has(e), s = r.onBehalfOf === void 0 ? i.id : r.onBehalfOf;
+				let r = t.body, i = wc(n), a = new Set(i.scopes), o = (e) => a.has(Ge) || a.has(e), s = r.onBehalfOf === void 0 ? i.id : r.onBehalfOf;
 				if (s === null) {
-					if (!o(qe)) throw new ht({
-						required: qe,
+					if (!o(Ke)) throw new mt({
+						required: Ke,
 						message: "not allowed to issue an organization key"
 					});
 				} else if (s !== i.id) {
-					if (!o(Je)) throw new ht({
-						required: Je,
+					if (!o(qe)) throw new mt({
+						required: qe,
 						message: "not allowed to issue a key on behalf of another user"
 					});
-				} else if (!o(Ye)) throw new ht({
-					required: Ye,
+				} else if (!o(Je)) throw new mt({
+					required: Je,
 					message: "not allowed to issue an api key"
 				});
 				let c = r.scopes ?? [...a];
-				if (!a.has(Ke)) {
+				if (!a.has(Ge)) {
 					let e = c.filter((e) => !a.has(e));
-					if (e.length > 0) throw new ht({
+					if (e.length > 0) throw new mt({
 						required: String(e[0]),
 						message: `cannot issue a key with scopes you do not hold: ${e.join(", ")}`
 					});
@@ -4139,7 +4143,7 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 			method: "GET",
 			path: t,
 			summary: "List the caller tenant's API keys (no secrets).",
-			guards: [cn(Ke)],
+			guards: [cn(Ge)],
 			input: y.Struct({}),
 			output: y.Struct({ keys: y.Array(n) }),
 			handler: async (t, n) => ({ keys: [...await e.list(wc(n).tenantId)] })
@@ -4148,7 +4152,7 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 			method: "POST",
 			path: `${t}/revoke`,
 			summary: "Revoke an API key by id.",
-			guards: [cn(Ke)],
+			guards: [cn(Ge)],
 			input: y.Struct({ body: y.Struct({ id: y.String }) }),
 			output: y.Struct({ ok: y.Boolean }),
 			handler: async (t, n) => ({ ok: await e.revoke(t.body.id, wc(n).tenantId) })
@@ -4173,7 +4177,7 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 	hardDelete: (t, n) => kc("hardDelete", t, () => e.hardDelete(t, n))
 }), jc = (e) => tn.make(e.name, {
 	payload: Rt(e.payloadSchema),
-	success: bt,
+	success: yt,
 	error: e.errorSchema
 }), Mc = (e, t) => ({
 	id: t,
@@ -4532,7 +4536,7 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 			executionId: i,
 			parentExecutionId: a?.parentExecutionId ?? null,
 			parentClosePolicy: a?.parentClosePolicy ?? null
-		}), d = e.buildExecute(l), f = (n?.(e, d, c) ?? d)(r, i), p = u.succeed(gt, c.subject), m = l?.store, h = m === void 0 ? f : o.provide(f, Ac(m));
+		}), d = e.buildExecute(l), f = (n?.(e, d, c) ?? d)(r, i), p = u.succeed(ht, c.subject), m = l?.store, h = m === void 0 ? f : o.provide(f, Ac(m));
 		return o.provide(h, p);
 	}));
 }))), Zc = (e) => {
@@ -4551,32 +4555,32 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 }, Qc = Zc, $c = (e) => typeof e == "object" && !!e && e._tag === "workflowEventTrigger", el = () => {
 	let e = globalThis.crypto;
 	return typeof e?.randomUUID == "function" ? e.randomUUID() : `${Date.now().toString(36)}${Math.random().toString(36).slice(2)}`;
-}, tl = (e) => `${e}_${el()}`, nl = (e) => e.id ?? `${e.event}->${e.workflow}`, rl = F("_voltro_workflow_events", {
-	id: M({ prefix: "wfe" }),
-	name: I(),
-	payload: P(),
-	source: I(),
-	subject: P().nullable(),
-	traceId: I().nullable(),
-	occurredAt: L().default("now")
-}).index(["name"]).index(["source"]).index(["occurredAt"]), il = F("_voltro_workflow_event_deliveries", {
-	id: M({ prefix: "wfed" }),
-	eventId: I(),
-	eventName: I(),
-	triggerId: I(),
-	workflowName: I(),
-	executionId: I().nullable(),
-	status: I().oneOf([
+}, tl = (e) => `${e}_${el()}`, nl = (e) => e.id ?? `${e.event}->${e.workflow}`, rl = I("_voltro_workflow_events", {
+	id: N({ prefix: "wfe" }),
+	name: L(),
+	payload: F(),
+	source: L(),
+	subject: F().nullable(),
+	traceId: L().nullable(),
+	occurredAt: R().default("now")
+}).index(["name"]).index(["source"]).index(["occurredAt"]), il = I("_voltro_workflow_event_deliveries", {
+	id: N({ prefix: "wfed" }),
+	eventId: L(),
+	eventName: L(),
+	triggerId: L(),
+	workflowName: L(),
+	executionId: L().nullable(),
+	status: L().oneOf([
 		"starting",
 		"started",
 		"skipped",
 		"failed"
 	]).default("starting"),
-	idempotencyKey: I().unique(),
+	idempotencyKey: L().unique(),
 	skipped: E().default(!1),
-	errorMessage: I().nullable(),
-	createdAt: L().default("now"),
-	completedAt: L().nullable()
+	errorMessage: L().nullable(),
+	createdAt: R().default("now"),
+	completedAt: R().nullable()
 }).index(["eventId"]).index(["eventName"]).index(["triggerId"]).index(["workflowName"]).index(["status"]), al = (e) => {
 	let t = e.makeId ?? tl, n = /* @__PURE__ */ new Map();
 	for (let t of e.triggers) {
@@ -4722,7 +4726,7 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 			triggered: p
 		};
 	} };
-}, ol = B({ scope: "voltro:events" }), sl = 64, cl = 5 * 6e4, ll = 1e4, ul = class {
+}, ol = B({ scope: "voltro:events" }), sl = 64, cl = 3e5, ll = 1e4, ul = class {
 	routes = /* @__PURE__ */ new Map();
 	origin;
 	ringSize;
@@ -4928,10 +4932,10 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 		this.routes.clear();
 	}
 }, dl = (e) => e instanceof Error ? e.message : String(e), fl = (e, t, n, r) => o.gen(function* () {
-	let i = y.encode(t.key), a = y.encode(t.payload), s = yield* i(n).pipe(o.mapError((e) => new dt({
+	let i = y.encode(t.key), a = y.encode(t.payload), s = yield* i(n).pipe(o.mapError((e) => new ut({
 		event: t.name,
 		message: dl(e)
-	}))), c = yield* a(r).pipe(o.mapError((e) => new ft({
+	}))), c = yield* a(r).pipe(o.mapError((e) => new dt({
 		event: t.name,
 		message: dl(e)
 	}))), l = Buffer.byteLength(JSON.stringify({
@@ -4939,10 +4943,10 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 		key: s,
 		payload: c
 	}), "utf8");
-	if (l > mt) return yield* o.fail(new pt({
+	if (l > pt) return yield* o.fail(new ft({
 		event: t.name,
 		bytes: l,
-		limit: mt
+		limit: pt
 	}));
 	let u = () => {
 		let n = e.bus.publish({
@@ -4982,9 +4986,9 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 		return t.set(e.origin, Math.max(r, e.n)), r === 0 && n === 0 ? 0 : Math.max(0, e.n - r - 1);
 	};
 }, yl = (e) => b.unwrapScoped(o.gen(function* () {
-	let t = yield* gt, n = yield* ot, r = t.tenantId ?? null, i = e.guards === void 0 ? void 0 : e.guards.filter((e) => !At(e));
+	let t = yield* ht, n = yield* at, r = t.tenantId ?? null, i = e.guards === void 0 ? void 0 : e.guards.filter((e) => !At(e));
 	if (i !== void 0 && i.length > 0) {
-		let n = yield* z(t, i, e.key);
+		let n = yield* xt(t, i, e.key);
 		if (n) return yield* o.fail(n);
 	}
 	let a = e.bus.deliveryFor(e.event) === "latest", s = yield* g.sliding(e.queueSize ?? (a ? 1 : 64)), c = /* @__PURE__ */ new Map(), l = e.bus.subscribe({
@@ -5009,7 +5013,7 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 			e();
 		}));
 	}
-	let u = a ? () => 0 : vl(c), d = i === void 0 || i.length === 0 ? void 0 : () => z(t, i, e.key), f = b.fromQueue(s, { shutdown: !0 }).pipe(b.flatMap((e) => d === void 0 ? p(e) : b.unwrap(d().pipe(o.map((t) => t ? b.fail(t) : p(e))))));
+	let u = a ? () => 0 : vl(c), d = i === void 0 || i.length === 0 ? void 0 : () => xt(t, i, e.key), f = b.fromQueue(s, { shutdown: !0 }).pipe(b.flatMap((e) => d === void 0 ? p(e) : b.unwrap(d().pipe(o.map((t) => t ? b.fail(t) : p(e))))));
 	function p(t) {
 		return b.suspend(() => {
 			if (t.kind === "gap") return b.make(_l(t));
@@ -5129,48 +5133,48 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 }, Cl = B({ scope: "voltro:outbox" }), J = "_voltro_outbox", wl = {
 	kind: "typeid",
 	prefix: "obx"
-}, Tl = F(J, {
-	id: M({ prefix: "obx" }),
-	effect: I(),
-	payload: P(),
-	status: I(),
-	attempts: N(),
-	maxAttempts: N(),
-	nextAttemptAt: L(),
-	idempotencyKey: I().nullable(),
-	lastError: I().nullable(),
-	subjectId: I().nullable(),
-	tenantId: I().nullable(),
-	traceId: I().nullable(),
-	createdAt: L(),
-	deliveredAt: L().nullable(),
-	resendRequestedBy: I().nullable(),
-	resendReason: I().nullable(),
-	resendCount: N()
+}, Tl = I(J, {
+	id: N({ prefix: "obx" }),
+	effect: L(),
+	payload: F(),
+	status: L(),
+	attempts: P(),
+	maxAttempts: P(),
+	nextAttemptAt: R(),
+	idempotencyKey: L().nullable(),
+	lastError: L().nullable(),
+	subjectId: L().nullable(),
+	tenantId: L().nullable(),
+	traceId: L().nullable(),
+	createdAt: R(),
+	deliveredAt: R().nullable(),
+	resendRequestedBy: L().nullable(),
+	resendReason: L().nullable(),
+	resendCount: P()
 }), El = "_voltro_outbox_attempts", Dl = {
 	kind: "typeid",
 	prefix: "obxa"
-}, Ol = F(El, {
-	id: M({ prefix: "obxa" }),
-	outboxId: I(),
-	effect: I(),
-	attempt: N(),
-	trigger: I().oneOf(["automatic", "manual"]),
-	triggeredBy: I().nullable(),
-	reason: I().nullable(),
-	outcome: I().oneOf([
+}, Ol = I(El, {
+	id: N({ prefix: "obxa" }),
+	outboxId: L(),
+	effect: L(),
+	attempt: P(),
+	trigger: L().oneOf(["automatic", "manual"]),
+	triggeredBy: L().nullable(),
+	reason: L().nullable(),
+	outcome: L().oneOf([
 		"delivered",
 		"failed",
 		"dead"
 	]),
-	startedAt: L(),
-	finishedAt: L(),
-	durationMs: N(),
-	error: I().nullable(),
-	response: P().nullable(),
-	subjectId: I().nullable(),
-	tenantId: I().nullable(),
-	traceId: I().nullable()
+	startedAt: R(),
+	finishedAt: R(),
+	durationMs: P(),
+	error: L().nullable(),
+	response: F().nullable(),
+	subjectId: L().nullable(),
+	tenantId: L().nullable(),
+	traceId: L().nullable()
 }).index(["outboxId", "attempt"]).index(["startedAt"]).index(["outcome"]), kl = (e) => {
 	if (e.effect.trim() === "") throw Error("defineOutboxHandler: `effect` must be a non-empty name");
 	if (e.maxAttempts !== void 0 && e.maxAttempts < 1) throw Error(`defineOutboxHandler("${e.effect}"): maxAttempts must be >= 1`);
@@ -5242,7 +5246,7 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 			});
 		} else e.nudge?.();
 	}
-}), Ml = (e) => Math.min(1e3 * 2 ** Math.max(0, e - 1), 5 * 6e4), Nl = 50, Pl = (e, t) => e.length <= t ? e : `${e.slice(0, t)}… [clipped]`, Fl = (e) => {
+}), Ml = (e) => Math.min(1e3 * 2 ** Math.max(0, e - 1), 3e5), Nl = 50, Pl = (e, t) => e.length <= t ? e : `${e.slice(0, t)}… [clipped]`, Fl = (e) => {
 	if (e == null) return null;
 	let t = typeof e == "object" && !Array.isArray(e) ? e : { value: e }, n;
 	try {
@@ -5391,42 +5395,42 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 }, Rl = B({ scope: "voltro:connections" }), Y = "_voltro_connections", zl = {
 	kind: "typeid",
 	prefix: "conn"
-}, Bl = F(Y, {
-	id: M({ prefix: "conn" }),
-	connectionId: I(),
-	subjectId: I(),
-	tenantId: I().nullable(),
-	kind: I().oneOf(["oauth2", "pat"]),
-	status: I().oneOf([
+}, Bl = I(Y, {
+	id: N({ prefix: "conn" }),
+	connectionId: L(),
+	subjectId: L(),
+	tenantId: L().nullable(),
+	kind: L().oneOf(["oauth2", "pat"]),
+	status: L().oneOf([
 		"connected",
 		"expired",
 		"revoked",
 		"error"
 	]),
-	accessToken: I(),
-	refreshToken: I().nullable(),
-	expiresAt: L().nullable(),
-	scopes: I().nullable(),
-	accountId: I().nullable(),
-	accountLabel: I().nullable(),
-	lastError: I().nullable(),
-	refreshLockedUntil: L(),
-	metadata: P().nullable(),
-	connectedAt: L(),
-	updatedAt: L()
+	accessToken: L(),
+	refreshToken: L().nullable(),
+	expiresAt: R().nullable(),
+	scopes: L().nullable(),
+	accountId: L().nullable(),
+	accountLabel: L().nullable(),
+	lastError: L().nullable(),
+	refreshLockedUntil: R(),
+	metadata: F().nullable(),
+	connectedAt: R(),
+	updatedAt: R()
 }).unique("byConnectionSubject", ["connectionId", "subjectId"]).index(["subjectId"]), Vl = "_voltro_connection_grants", Hl = {
 	kind: "typeid",
 	prefix: "cgrant"
-}, Ul = F(Vl, {
-	id: M({ prefix: "cgrant" }),
-	state: I().unique(),
-	connectionId: I(),
-	subjectId: I(),
-	tenantId: I().nullable(),
-	codeVerifier: I().nullable(),
-	redirectTo: I(),
-	createdAt: L(),
-	expiresAt: L()
+}, Ul = I(Vl, {
+	id: N({ prefix: "cgrant" }),
+	state: L().unique(),
+	connectionId: L(),
+	subjectId: L(),
+	tenantId: L().nullable(),
+	codeVerifier: L().nullable(),
+	redirectTo: L(),
+	createdAt: R(),
+	expiresAt: R()
 }).index(["expiresAt"]), Wl = /^[a-z][a-z0-9-]*$/, Gl = (e) => {
 	if (!Wl.test(e.id)) throw Error(`defineConnection: id "${e.id}" must be lowercase kebab-case (it becomes a URL path segment).`);
 	if (e.kind === "oauth2") {
@@ -5546,7 +5550,7 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 		});
 		i = n.status, a = await n.text();
 	} catch (t) {
-		throw new R({
+		throw new z({
 			connectionId: e.id,
 			reason: `token endpoint unreachable: ${String(t)}`,
 			transient: !0
@@ -5558,12 +5562,12 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 	} catch {
 		o = {};
 	}
-	if (i < 200 || i >= 300) throw new R({
+	if (i < 200 || i >= 300) throw new z({
 		connectionId: e.id,
 		reason: `token endpoint ${i}: ${o.error ?? ""} ${o.error_description ?? a.slice(0, 200)}`.trim(),
 		transient: i >= 500
 	});
-	if (typeof o.access_token != "string" || o.access_token.length === 0) throw new R({
+	if (typeof o.access_token != "string" || o.access_token.length === 0) throw new z({
 		connectionId: e.id,
 		reason: "token response carried no access_token",
 		transient: !1
@@ -5624,14 +5628,14 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 	return fu.set(o, c), c;
 }, vu = async (e) => {
 	let { store: t, subjectId: n, now: r } = e, i = e.definition, a = e.sleep ?? du, o = i.refreshSkewMs ?? 6e4, s = e.row.id;
-	if (await t.updateMany("_voltro_connections", { refreshLockedUntil: new Date(r() + 3e4) }, { where: C(O("id", s), _e("refreshLockedUntil", new Date(r()))) }) === 0) {
+	if (await t.updateMany("_voltro_connections", { refreshLockedUntil: new Date(r() + 3e4) }, { where: C(O("id", s), ge("refreshLockedUntil", new Date(r()))) }) === 0) {
 		for (let e = 0; e < 10; e++) {
 			await a(200);
 			let e = await $l(t, i.id, n);
 			if (e === void 0) throw new uu(i.id, n);
 			if (!gu(e, o, r())) return hu(i, e);
 		}
-		throw new R({
+		throw new z({
 			connectionId: i.id,
 			reason: "another replica held the refresh lease and did not publish a fresh token in time",
 			transient: !0
@@ -5643,7 +5647,7 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 		lastError: "access token expired and no refresh token is on file — reconnect required",
 		refreshLockedUntil: /* @__PURE__ */ new Date(0),
 		updatedAt: new Date(r())
-	}), new R({
+	}), new z({
 		connectionId: i.id,
 		reason: "access token expired and no refresh token is on file — reconnect required",
 		transient: !1
@@ -5652,7 +5656,7 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 	try {
 		l = await su(i, da(String(c)), r);
 	} catch (e) {
-		let n = e instanceof R ? e : new R({
+		let n = e instanceof z ? e : new z({
 			connectionId: i.id,
 			reason: String(e),
 			transient: !0
@@ -5697,7 +5701,7 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 }, xu = async (e) => {
 	let t = await globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(e));
 	return bu(new Uint8Array(t));
-}, Su = 10 * 6e4, Cu = (e) => `/_voltro/connections/${e}/callback`, wu = (e) => e === void 0 || e.length === 0 || !e.startsWith("/") || e.startsWith("//") || e.startsWith("/\\") ? "/" : e, Tu = (e, t) => e.redirectUri ?? `${t.replace(/\/+$/, "")}${Cu(e.id)}`, Eu = async (e) => {
+}, Su = 6e5, Cu = (e) => `/_voltro/connections/${e}/callback`, wu = (e) => e === void 0 || e.length === 0 || !e.startsWith("/") || e.startsWith("//") || e.startsWith("/\\") ? "/" : e, Tu = (e, t) => e.redirectUri ?? `${t.replace(/\/+$/, "")}${Cu(e.id)}`, Eu = async (e) => {
 	let t = (e.now ?? (() => /* @__PURE__ */ new Date()))(), { definition: n } = e, r = yu(), i = n.pkce === !1 ? null : yu(48), a = Tu(n, e.publicUrl);
 	await e.store.insert(Vl, {
 		id: A(Hl, Vl),
@@ -5733,20 +5737,20 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 		skip: void 0,
 		projection: void 0
 	}))[0];
-	if (n === void 0) throw new R({
+	if (n === void 0) throw new z({
 		connectionId: "unknown",
 		reason: "unknown or already-used handshake state",
 		transient: !1
 	});
 	await e.store.delete(Vl, n.id);
 	let r = String(n.connectionId), i = Yl(n.expiresAt);
-	if (i !== null && i.getTime() < t.getTime()) throw new R({
+	if (i !== null && i.getTime() < t.getTime()) throw new z({
 		connectionId: r,
 		reason: "handshake expired — start again",
 		transient: !1
 	});
 	let a = e.registry.get(r);
-	if (a === void 0 || a.kind !== "oauth2") throw new R({
+	if (a === void 0 || a.kind !== "oauth2") throw new z({
 		connectionId: r,
 		reason: "no oauth2 connection is declared under that id",
 		transient: !1
@@ -5776,7 +5780,7 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 }, Ou = async (e, t = /* @__PURE__ */ new Date()) => {
 	let n = await e.query({
 		table: Vl,
-		predicate: _e("expiresAt", t),
+		predicate: ge("expiresAt", t),
 		order: [],
 		take: void 0,
 		skip: void 0,
@@ -5835,11 +5839,11 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 	};
 }, Fu = (e, t) => {
 	let n = e.request?.subject?.id ?? null;
-	if (n === null || n === "") throw new ut({ connectionId: t });
+	if (n === null || n === "") throw new lt({ connectionId: t });
 	return n;
 }, Iu = (e, t) => {
 	let n = e.registry.get(t);
-	if (n === void 0) throw new lt({ connectionId: t });
+	if (n === void 0) throw new ct({ connectionId: t });
 	return n;
 }, Lu = (e) => async (t, n) => {
 	let r = n.request?.subject?.id ?? null;
@@ -5857,7 +5861,7 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 	})) : ru(n.store, e.registry, r);
 }, Ru = (e) => async (t, n) => {
 	let r = Iu(e, t.connectionId), i = Fu(n, t.connectionId);
-	if (r.kind !== "oauth2") throw new ct({
+	if (r.kind !== "oauth2") throw new st({
 		connectionId: t.connectionId,
 		expected: "oauth2",
 		actual: r.kind
@@ -5872,13 +5876,13 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 	});
 }, zu = (e) => async (t, n) => {
 	let r = Iu(e, t.connectionId), i = Fu(n, t.connectionId);
-	if (r.kind !== "pat") throw new ct({
+	if (r.kind !== "pat") throw new st({
 		connectionId: t.connectionId,
 		expected: "pat",
 		actual: r.kind
 	});
 	let a = t.token.trim();
-	if (a.length === 0) throw new R({
+	if (a.length === 0) throw new z({
 		connectionId: t.connectionId,
 		reason: "token is empty",
 		transient: !1
@@ -5887,7 +5891,7 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 	if (r.validate !== void 0) try {
 		o = await r.validate(a);
 	} catch (e) {
-		throw new R({
+		throw new z({
 			connectionId: t.connectionId,
 			reason: `the provider rejected that token: ${e instanceof Error ? e.message : String(e)}`,
 			transient: !1
@@ -5963,7 +5967,7 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 	td.enterWith(e);
 }, rd = () => td.getStore(), id = (e, t) => td.run(e, t), ad = B({ scope: "voltro:policy" }), od, sd = (e) => {
 	od = e;
-}, cd = () => od, ld = () => {
+}, cd = () => od, ld = (e) => od === void 0 && (od = e, !0), ud = () => {
 	It((e) => o.gen(function* () {
 		let t = Gu(e.resourceType);
 		if (t === void 0) return ad.warn("policy guard denied — no resource policy registered for this type", {
@@ -5978,6 +5982,7 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 		let r = yield* o.tryPromise({
 			try: async () => n({
 				subjectId: e.subject.id,
+				subject: e.subject,
 				resourceType: e.resourceType,
 				resourceId: e.resourceId,
 				load: rd()
@@ -6000,10 +6005,10 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 			tuples: r
 		});
 	}));
-}, ud = (e) => {
-	Promise.resolve().then(e);
 }, dd = (e) => {
-	let t = e.schedule ?? ud, n = /* @__PURE__ */ new Map(), r = /* @__PURE__ */ new Map(), i = (e, t) => `${e}\u0000${t}`, a = async (t) => {
+	Promise.resolve().then(e);
+}, fd = (e) => {
+	let t = e.schedule ?? dd, n = /* @__PURE__ */ new Map(), r = /* @__PURE__ */ new Map(), i = (e, t) => `${e}\u0000${t}`, a = async (t) => {
 		let a = r.get(t);
 		if (a === void 0) return;
 		r.delete(t);
@@ -6012,7 +6017,7 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 			if (o.length > 0) {
 				let r = await e.store.query({
 					table: t,
-					predicate: ue("id", o),
+					predicate: le("id", o),
 					order: [],
 					take: void 0,
 					skip: void 0,
@@ -6049,23 +6054,23 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 		load: async (e, t) => (await o(e, [t]))[0] ?? null,
 		loadMany: (e, t) => o(e, t)
 	};
-}, fd = u.effect(Kt.HttpClient, o.map(Kt.HttpClient, (e) => e.pipe(Kt.mapRequestEffect((e) => o.currentSpan.pipe(o.map((t) => e.headers.traceparent === void 0 ? Jt.setHeader(e, "traceparent", Xi({
+}, pd = u.effect(Kt.HttpClient, o.map(Kt.HttpClient, (e) => e.pipe(Kt.mapRequestEffect((e) => o.currentSpan.pipe(o.map((t) => e.headers.traceparent === void 0 ? Jt.setHeader(e, "traceparent", Xi({
 	traceId: t.traceId,
 	spanId: t.spanId,
 	sampled: t.sampled
-})) : e), o.catchAll(() => o.succeed(e))))))), pd = class extends Error {
+})) : e), o.catchAll(() => o.succeed(e))))))), md = class extends Error {
 	url;
 	reason;
 	_tag = "SsrfBlockedError";
 	constructor(e, t) {
 		super(`SSRF: blocked outbound request to ${e} — ${t}. If this target is intentional, add its host to \`http.allowHosts\` in app.config.ts.`), this.url = e, this.reason = t, this.name = "SsrfBlockedError";
 	}
-}, md = (e, t) => e === 0 || e === 10 || e === 127 || e === 100 && t >= 64 && t <= 127 || e === 169 && t === 254 || e === 172 && t >= 16 && t <= 31 || e === 192 && t === 168 || e === 198 && (t === 18 || t === 19) || e >= 224, hd = (e) => e === "::" || e === "::1" || e.startsWith("fc") || e.startsWith("fd") || e.startsWith("fe80") || e.startsWith("::ffff:"), gd = (e, t, n) => n.some((n) => {
+}, hd = (e, t) => e === 0 || e === 10 || e === 127 || e === 100 && t >= 64 && t <= 127 || e === 169 && t === 254 || e === 172 && t >= 16 && t <= 31 || e === 192 && t === 168 || e === 198 && (t === 18 || t === 19) || e >= 224, gd = (e) => e === "::" || e === "::1" || e.startsWith("fc") || e.startsWith("fd") || e.startsWith("fe80") || e.startsWith("::ffff:"), _d = (e, t, n) => n.some((n) => {
 	let r = n.trim().toLowerCase();
 	if (r === "") return !1;
 	let i = t === "" ? e : `${e}:${t}`;
 	return r === e || r === i ? !0 : r.startsWith("*.") ? e.endsWith(r.slice(1)) : !1;
-}), _d = (e, t = {}) => {
+}), vd = (e, t = {}) => {
 	let n;
 	try {
 		n = new URL(e);
@@ -6074,30 +6079,30 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 	}
 	if (n.protocol !== "http:" && n.protocol !== "https:") return `blocked scheme "${n.protocol}"`;
 	let r = n.hostname.replace(/^\[|\]$/g, "").toLowerCase();
-	if (gd(r, n.port, t.allowHosts ?? [])) return null;
+	if (_d(r, n.port, t.allowHosts ?? [])) return null;
 	if (r === "localhost" || r.endsWith(".localhost") || r.endsWith(".internal") || r.endsWith(".local")) return `blocked host "${r}"`;
 	let i = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(r);
 	if (i) {
 		let e = Number(i[1]), t = Number(i[2]);
-		return e > 255 || t > 255 || Number(i[3]) > 255 || Number(i[4]) > 255 ? "malformed ipv4 literal" : md(e, t) ? `blocked private/reserved address ${r}` : null;
+		return e > 255 || t > 255 || Number(i[3]) > 255 || Number(i[4]) > 255 ? "malformed ipv4 literal" : hd(e, t) ? `blocked private/reserved address ${r}` : null;
 	}
 	if (r.includes(":")) {
 		let e = /^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/.exec(r);
-		return e ? _d(`${n.protocol}//${e[1]}`, t) : hd(r) ? `blocked private/reserved address ${r}` : null;
+		return e ? vd(`${n.protocol}//${e[1]}`, t) : gd(r) ? `blocked private/reserved address ${r}` : null;
 	}
 	return null;
-}, vd = (e = {}) => u.effect(Kt.HttpClient, o.map(Kt.HttpClient, (t) => {
+}, yd = (e = {}) => u.effect(Kt.HttpClient, o.map(Kt.HttpClient, (t) => {
 	let n = Kt.transform(t, (t, n) => o.suspend(() => {
-		let r = _d(n.url, e);
+		let r = vd(n.url, e);
 		return r === null ? t : o.fail(new qt.RequestError({
 			request: n,
 			reason: "Transport",
-			cause: new pd(n.url, r),
+			cause: new md(n.url, r),
 			description: `SSRF policy: ${r}`
 		}));
 	}));
 	return Kt.followRedirects(n, e.maxRedirects ?? 5);
-})), yd = (e) => {
+})), bd = (e) => {
 	let t = e.now ?? Date.now, n = e.intervalMs ?? 3e4, r = e.maxPending ?? 500, i = /* @__PURE__ */ new Map(), a = !1, o = async () => {
 		if (i.size === 0) return;
 		let t = i;
@@ -6126,7 +6131,7 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 		},
 		pending: () => i.size
 	};
-}, bd = "voltro/audit", xd = "voltro/softDelete", Sd = "voltro/expires", Cd = "voltro/tenant", wd = "voltro/localFirst", Td = (e) => {
+}, xd = "voltro/audit", Sd = "voltro/softDelete", Cd = "voltro/expires", wd = "voltro/tenant", Td = "voltro/localFirst", Ed = (e) => {
 	let t = /* @__PURE__ */ new Map();
 	for (let n of e) {
 		let e = /* @__PURE__ */ new Set();
@@ -6174,26 +6179,26 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 			return !1;
 		},
 		idScheme: (e) => t.get(e)?.idScheme,
-		defaultFactories: (e) => t.get(e)?.defaultFactories ?? Ed,
-		computedFields: (e) => t.get(e)?.computedFields ?? Dd,
+		defaultFactories: (e) => t.get(e)?.defaultFactories ?? Dd,
+		computedFields: (e) => t.get(e)?.computedFields ?? Od,
 		versionColumn: (e) => t.get(e)?.versionColumn,
-		generatedColumns: (e) => t.get(e)?.generatedColumns ?? Od,
-		crdtColumns: (e) => t.get(e)?.crdtColumns ?? kd,
+		generatedColumns: (e) => t.get(e)?.generatedColumns ?? kd,
+		crdtColumns: (e) => t.get(e)?.crdtColumns ?? Ad,
 		insertSchema: (e) => t.get(e)?.insertSchema,
 		validatePatchSchema: (e) => t.get(e)?.validatePatchSchema
 	};
-}, Ed = /* @__PURE__ */ new Map(), Dd = /* @__PURE__ */ new Map(), Od = /* @__PURE__ */ new Set(), kd = /* @__PURE__ */ new Set(), Ad = Td([]), jd = B({ scope: "store.fieldEncryption" }), Md = (e, t) => {
+}, Dd = /* @__PURE__ */ new Map(), Od = /* @__PURE__ */ new Map(), kd = /* @__PURE__ */ new Set(), Ad = /* @__PURE__ */ new Set(), jd = Ed([]), Md = B({ scope: "store.fieldEncryption" }), Nd = (e, t) => {
 	let n = t, r = process.env.VOLTRO_FIELD_DECRYPT_ON_ERROR === "null" ? "null" : "throw", i = /* @__PURE__ */ new Set(), a = (e) => {
 		let t = `${e.table}.${e.column}`;
-		i.has(t) || (i.add(t), jd.warn("encrypted column degraded to null — could not decrypt with the active key", {
+		i.has(t) || (i.add(t), Md.warn("encrypted column degraded to null — could not decrypt with the active key", {
 			table: e.table,
 			column: e.column,
 			reason: e.reason,
 			hint: "VOLTRO_FIELD_DECRYPT_ON_ERROR=null is set — this row was likely encrypted under a different key"
 		}));
 	}, o = (e, t) => {
-		let r = j(e);
-		return ie(n ? Me(t, r, n) : t, r, K());
+		let r = j(e), i = n ? je(t, r, n) : t;
+		return ie(i, r, K());
 	}, s = (e, t) => {
 		let i = j(e), o = ne(t, i, K(), {
 			onError: r,
@@ -6209,7 +6214,7 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 			e.injectExternalChange(t);
 		},
 		...e.changeScope === void 0 ? {} : { changeScope: e.changeScope },
-		...e.withNamespace === void 0 ? {} : { withNamespace: (n) => Md(e.withNamespace(n), t) },
+		...e.withNamespace === void 0 ? {} : { withNamespace: (n) => Nd(e.withNamespace(n), t) },
 		...e.raw === void 0 ? {} : { raw: ((...t) => e.raw(...t)) },
 		...e.close === void 0 ? {} : { close: (t) => e.close(t) },
 		...e.ping === void 0 ? {} : { ping: () => e.ping() },
@@ -6221,32 +6226,32 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 		upsert: async (t, n, r) => c(t, await e.upsert(t, o(t, n), r)),
 		insertIgnore: async (t, n, r) => c(t, await e.insertIgnore(t, o(t, n), r)),
 		patchJson: async (t, n, r, i) => c(t, await e.patchJson(t, n, r, i)),
-		transactional: (n) => e.transactional((e) => n(Md(e, t)))
+		transactional: (n) => e.transactional((e) => n(Nd(e, t)))
 	};
-}, Nd = (e, t) => {
+}, Pd = (e, t) => {
 	if (t === void 0 || t.length === 0) return e;
 	let n = { ...e };
 	for (let e of t) delete n[e];
 	return n;
-}, Pd = (e, t) => {
-	let n = j(e), r = n === void 0 ? [] : Ne(n);
-	return r.length === 0 ? t ?? [] : t === void 0 ? r : [...t, ...r];
 }, Fd = (e, t) => {
+	let n = j(e), r = n === void 0 ? [] : Me(n);
+	return r.length === 0 ? t ?? [] : t === void 0 ? r : [...t, ...r];
+}, Id = (e, t) => {
 	let n = j(e);
 	if (n === void 0) return;
-	let r = Ne(n).filter((e) => t[e] !== void 0);
+	let r = Me(n).filter((e) => t[e] !== void 0);
 	if (r.length !== 0) throw new La({
 		table: e,
 		columns: r
 	});
-}, Id = (e, t) => t.length === 0 ? e : e.map((e) => Nd(e, t)), Ld = (e, t, n, r, i) => {
+}, Ld = (e, t) => t.length === 0 ? e : e.map((e) => Pd(e, t)), Rd = (e, t, n, r, i) => {
 	let a = {
 		...t?.(r) ?? {},
 		...n?.(i) ?? {}
 	}, o = e;
 	for (let [e, t] of Object.entries(a)) t !== void 0 && (o = o.where(e, t));
 	return o;
-}, Rd = 1e3, zd = (e, t = Rd) => {
+}, zd = 1e3, Bd = (e, t = zd) => {
 	let n = (e) => typeof e == "number" && Number.isFinite(e) ? e : void 0, r = (e) => Math.max(1, Math.min(Math.floor(e), t)), i = n(e.page);
 	if (i !== void 0) {
 		let t = r(n(e.pageSize) ?? 100);
@@ -6259,37 +6264,37 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 		limit: r(n(e.limit) ?? 100),
 		offset: Math.max(0, Math.floor(n(e.offset) ?? 0))
 	};
-}, Bd = {
+}, Vd = {
 	list: (e, t = {}) => async (n, r) => {
 		let i = n ?? {}, a = r.store.select(e);
 		if (t.columns !== void 0 && t.columns.length > 0) {
-			let n = new Set(Pd(e, void 0)), r = t.columns.filter((e) => !n.has(e));
+			let n = new Set(Fd(e, void 0)), r = t.columns.filter((e) => !n.has(e));
 			r.length > 0 && (a = a.select(...r));
 		}
-		t.include !== void 0 && (a = a.with(t.include)), a = Ld(a, t.filter, t.scope, i, r);
+		t.include !== void 0 && (a = a.with(t.include)), a = Rd(a, t.filter, t.scope, i, r);
 		for (let e of t.sort ?? []) a = a.orderBy(e.column, e.direction ?? "asc");
 		if (t.paginate === !0) {
-			let { limit: e, offset: n } = zd(i, t.maxPageSize);
+			let { limit: e, offset: n } = Bd(i, t.maxPageSize);
 			a = a.limit(e).offset(n);
 		}
-		return Id(await a.all(), Pd(e, t.redact));
+		return Ld(await a.all(), Fd(e, t.redact));
 	},
 	getById: (e, t = {}) => async (n, r) => {
 		let i = r.store.select(e).where("id", n.id);
 		t.include !== void 0 && (i = i.with(t.include));
 		let a = await i.first();
-		return a === null ? null : Nd(a, Pd(e, t.redact));
+		return a === null ? null : Pd(a, Fd(e, t.redact));
 	},
-	create: (e, t = {}) => async (n, r) => (Fd(e, n), Nd(await r.store.insert(e, n), Pd(e, t.redact))),
+	create: (e, t = {}) => async (n, r) => (Id(e, n), Pd(await r.store.insert(e, n), Fd(e, t.redact))),
 	update: (e, t = {}) => async (n, r) => {
 		let { id: i, ...a } = n;
-		Fd(e, a);
+		Id(e, a);
 		let o = await r.store.update(e, i, a);
-		return o === null ? null : Nd(o, Pd(e, t.redact));
+		return o === null ? null : Pd(o, Fd(e, t.redact));
 	},
-	count: (e, t = {}) => async (n, r) => Ld(r.store.select(e), t.filter, t.scope, n ?? {}, r).count(),
+	count: (e, t = {}) => async (n, r) => Rd(r.store.select(e), t.filter, t.scope, n ?? {}, r).count(),
 	remove: (e) => async (t, n) => ({ deleted: await n.store.delete(e, t.id) })
-}, Vd = (e) => {
+}, Hd = (e) => {
 	let t = /* @__PURE__ */ new Set(), n = /* @__PURE__ */ new Set(), r = (e) => {
 		if (!n.has(e)) switch (n.add(e), e._tag) {
 			case "TypeLiteral":
@@ -6309,14 +6314,11 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 			case "Transformation":
 				r(e.from), r(e.to);
 				break;
-			case "Suspend":
-				r(e.f());
-				break;
-			default: break;
+			case "Suspend": r(e.f());
 		}
 	};
 	return r(e.ast), t;
-}, Hd = (e) => {
+}, Ud = (e) => {
 	let t = /* @__PURE__ */ new Set(), n = /* @__PURE__ */ new Set(), r = (e) => {
 		switch (e._tag) {
 			case "Literal": return e.literal === null;
@@ -6344,31 +6346,28 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 			case "Transformation":
 				i(e.from), i(e.to);
 				break;
-			case "Suspend":
-				i(e.f());
-				break;
-			default: break;
+			case "Suspend": i(e.f());
 		}
 	};
 	return i(e.ast), t;
-}, Ud = (e, t) => {
+}, Wd = (e, t) => {
 	let n = e.source === void 0 ? [] : Array.isArray(e.source) ? e.source : [e.source];
 	if (n.length === 0) return [];
-	let r = Vd(e.output), i = Hd(e.output), a = [];
+	let r = Hd(e.output), i = Ud(e.output), a = [];
 	for (let o of n) for (let n of t.get(o) ?? []) r.has(n) && !i.has(n) && a.push({
 		query: e.name,
 		table: o,
 		column: n
 	});
 	return a;
-}, Wd = (e) => {
+}, Gd = (e) => {
 	if (e.length !== 0) return `A wire-reachable query exposes a server-only column:\n${e.map((e) => `  • query '${e.query}' output declares '${e.column}' — a .serverOnly() column of '${e.table}'`).join("\n")}\nThree ways out, in order of preference:\n  1. Omit the column from the query's output schema. The crud.* read helpers strip these automatically.\n  2. Keep the KEY but type it \`Schema.Null\` — for a view that must stay wire-compatible (an importer that breaks if the key vanishes) while never sending a value. The audit accepts that, because the schema then PROVES no value can flow instead of promising it. Pair it with a \`hasX\` boolean.\n  3. Drop the .serverOnly() marker, if the column may in fact reach a client.\nNote the audit reads the DECLARED shape, not what your handler emits: a field typed \`string\` that you always set to null still fails, and should — the next edit to that handler is one line away from sending it.`;
-}, Gd = (e, t) => e.cache?.scope === "global" ? (e.source === void 0 ? [] : Array.isArray(e.source) ? e.source : [e.source]).filter((e) => t.has(e)).map((t) => ({
+}, Kd = (e, t) => e.cache?.scope === "global" ? (e.source === void 0 ? [] : Array.isArray(e.source) ? e.source : [e.source]).filter((e) => t.has(e)).map((t) => ({
 	query: e.name,
 	table: t
-})) : [], Kd = (e) => {
+})) : [], qd = (e) => {
 	if (e.length !== 0) return `A cached query shares one entry across tenants:\n${e.map((e) => `  • query '${e.query}' caches scope:'global' while reading '${e.table}', a tenant()-scoped table`).join("\n")}\n\nscope:'global' stores ONE entry for every caller. On a tenant-scoped table the\nrows depend on who asked, so the first caller's rows are served to the next one.\n\nUse scope:'tenant' — one entry per org, none shared across orgs. Use 'subject'\nif the result also depends on WHICH person is asking, and 'global' only for data\nthat depends on neither.`;
-}, qd = (e, t) => {
+}, Jd = (e, t) => {
 	let n, r = 0;
 	for (let i of t) {
 		let t = 0;
@@ -6379,7 +6378,7 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 		o > r && o >= .6 && (r = o, n = i);
 	}
 	return n;
-}, Jd = (e, t) => {
+}, Yd = (e, t) => {
 	let n = St(), r = [];
 	for (let i of e) for (let e of Lt(i.source)) {
 		if (Mt(e)) {
@@ -6395,12 +6394,12 @@ var G = /* @__PURE__ */ new Map(), Gi = (e, t) => {
 		t.size === 0 || t.has(e) || r.push({
 			procedure: i.name,
 			source: e,
-			didYouMean: qd(e, t),
+			didYouMean: Jd(e, t),
 			channel: !1
 		});
 	}
 	return r;
-}, Yd = (e) => {
+}, Xd = (e) => {
 	if (e.length === 0) return;
 	let t = e.map((e) => e.channel ? `  ${e.procedure}: source '${e.source}' names a reactivity channel nobody declared` : `  ${e.procedure}: source '${e.source}' matches no declared table` + (e.didYouMean === void 0 ? "" : ` — did you mean '${e.didYouMean}'?`)), n = e.some((e) => e.channel) ? "\nFor the `channel:` entries: declare it with `reactivityChannel(<name>)` and pass the\nCHANNEL as `source:`, not its key as a string. Authoring against the object is what\nmakes a channel source impossible to leave stale — you cannot import a declaration\nthat does not exist." : "";
 	return `${e.length} reactive source(s) name a table that does not exist:\n${t.join("\n")}\n
@@ -6409,16 +6408,16 @@ update again, which is indistinguishable from "nothing has changed" — so the
 symptom is silence, and silence is what this surface exists to eliminate.
 A \`source:\` is a STRING, so \`tsc\` cannot see a stale one and a rename leaves it
 behind quietly.` + n;
-}, Xd = (e) => e.old ?? e.new ?? {}, Zd = (e) => String(Xd(e).id ?? ""), Qd = (e) => {
-	let t = Xd(e).tenantId;
+}, Zd = (e) => e.old ?? e.new ?? {}, Qd = (e) => String(Zd(e).id ?? ""), $d = (e) => {
+	let t = Zd(e).tenantId;
 	return typeof t == "string" ? t : null;
-}, $d = (e) => e.op === "update" && (e.old?.deletedAt ?? null) === null && (e.new?.deletedAt ?? null) !== null, ef = (e, t) => {
-	let n = $d(t);
+}, ef = (e) => e.op === "update" && (e.old?.deletedAt ?? null) === null && (e.new?.deletedAt ?? null) !== null, tf = (e, t) => {
+	let n = ef(t);
 	return t.op !== "delete" && !n ? [] : e.filter((e) => e.targetTable === t.table && e.policy !== "keep" && (!n || e.onSoftDelete));
-}, tf = async (e, t, n) => {
-	let r = ef(t, n);
+}, nf = async (e, t, n) => {
+	let r = tf(t, n);
 	if (r.length === 0) return [];
-	let i = Zd(n), a = Qd(n), o = [];
+	let i = Qd(n), a = $d(n), o = [];
 	for (let t of r) {
 		let n = await e.query({
 			table: t.table,
@@ -6442,7 +6441,7 @@ behind quietly.` + n;
 		});
 	}
 	return o;
-}, nf = (e, t) => {
+}, rf = (e, t) => {
 	let n = [];
 	for (let r of e) for (let e of r.appliedPluginRefs ?? []) {
 		let i = e.column, a;
@@ -6461,26 +6460,26 @@ behind quietly.` + n;
 		});
 	}
 	return n.filter((e) => e.policy !== "keep");
-}, rf = class extends y.TaggedError()("CircuitOpen", {
+}, af = class extends y.TaggedError()("CircuitOpen", {
 	name: y.String,
 	retryAfterMs: y.Number
-}) {}, af = {
+}) {}, of = {
 	tag: "closed",
 	failureCount: 0,
 	halfOpenSuccesses: 0,
 	openedAt: 0
-}, of = { make: (n) => o.gen(function* () {
-	let r = n.name ?? "circuit", i = a.toMillis(a.decode(n.resetTimeout)), s = n.halfOpenSuccessThreshold ?? 1, c = n.isFailure ?? (() => !0), l = yield* _.make(af), u = o.gen(function* () {
+}, sf = { make: (n) => o.gen(function* () {
+	let r = n.name ?? "circuit", i = a.toMillis(a.decode(n.resetTimeout)), s = n.halfOpenSuccessThreshold ?? 1, c = n.isFailure ?? (() => !0), l = yield* _.make(of), u = o.gen(function* () {
 		let e = yield* _.get(l);
 		if (e.tag === "half-open") {
 			let t = e.halfOpenSuccesses + 1;
-			yield* _.set(l, t >= s ? af : {
+			yield* _.set(l, t >= s ? of : {
 				...e,
 				halfOpenSuccesses: t
 			});
 			return;
 		}
-		e.failureCount !== 0 && (yield* _.set(l, af));
+		e.failureCount !== 0 && (yield* _.set(l, of));
 	}), d = o.gen(function* () {
 		let e = yield* t.currentTimeMillis, r = yield* _.get(l);
 		if (r.tag === "half-open" || r.tag === "open") {
@@ -6518,7 +6517,7 @@ behind quietly.` + n;
 			if (e.isInterruptedOnly(t)) return o.void;
 			let n = e.failureOption(t), r = n._tag === "Some" ? n.value : void 0;
 			return c(r) ? d : o.void;
-		})) : yield* o.fail(new rf({
+		})) : yield* o.fail(new af({
 			name: r,
 			retryAfterMs: n
 		}));
@@ -6527,15 +6526,15 @@ behind quietly.` + n;
 		value: _.get(l).pipe(o.map((e) => e.tag)),
 		enumerable: !0
 	}), Object.defineProperty(m, "reset", {
-		value: _.set(l, af),
+		value: _.set(l, of),
 		enumerable: !0
 	}), m;
-}) }, sf, cf = (e) => {
-	sf = e;
-}, lf = () => {
-	sf = void 0;
-}, uf = () => sf, df = async (e, t = {}) => {
-	let n = t.scopes === void 0 ? zt(t.id ?? "system") : zt(t.id ?? "system", t.scopes), r = t.store ?? sf?.dataStore, i = t.schemaRegistry ?? sf?.schemaRegistry, a = t.dialect ?? sf?.dialect;
+}) }, cf, lf = (e) => {
+	cf = e;
+}, uf = () => {
+	cf = void 0;
+}, df = () => cf, ff = async (e, t = {}) => {
+	let n = t.scopes === void 0 ? zt(t.id ?? "system") : zt(t.id ?? "system", t.scopes), r = t.store ?? cf?.dataStore, i = t.schemaRegistry ?? cf?.schemaRegistry, a = t.dialect ?? cf?.dialect;
 	if (r === void 0 || i === void 0) throw Error("runAsSystem: no data store available — register one at boot via setSystemStoreHandle({ dataStore, schemaRegistry }) or pass { store, schemaRegistry } in the options.");
 	return e({
 		subject: n,
@@ -6546,20 +6545,20 @@ behind quietly.` + n;
 			rowFilter: gi
 		})
 	});
-}, ff = (e) => u.mergeAll(u.succeed(it, it.of(({ headers: t, clientId: n }) => o.promise(async () => {
+}, pf = (e) => u.mergeAll(u.succeed(rt, rt.of(({ headers: t, clientId: n }) => o.promise(async () => {
 	let r = await e.resolveSubject({
 		headers: Ui(n, t),
 		clientId: n
 	});
 	return Li(n, r.credentialExpiresAt), r.subject;
-}))), u.succeed(st, st.of(({ headers: e, clientId: t }) => o.sync(() => {
+}))), u.succeed(ot, ot.of(({ headers: e, clientId: t }) => o.sync(() => {
 	let n = Ri(t) ?? wn(Ui(t, e)), r = e["idempotency-key"];
 	return {
 		clientId: t,
 		...r ? { idempotencyKey: r } : {},
 		...n === void 0 ? {} : { credentialExpiresAt: n }
 	};
-})))), pf = (e) => {
+})))), mf = (e) => {
 	let { currentRegion: t, replicaRegions: n, inner: r } = e, i = (e) => {
 		if (t === void 0) return {
 			sameRegion: [],
@@ -6587,7 +6586,7 @@ behind quietly.` + n;
 			return r.loadSnapshot();
 		}
 	};
-}, mf = (e = process.env) => {
+}, hf = (e = process.env) => {
 	for (let t of [
 		"VOLTRO_REGION",
 		"AWS_REGION",
@@ -6599,7 +6598,7 @@ behind quietly.` + n;
 		let n = e[t];
 		if (typeof n == "string" && n.length > 0) return n;
 	}
-}, hf = () => {
+}, gf = () => {
 	let e = {
 		primary: 0,
 		lagByReplica: /* @__PURE__ */ new Map()
@@ -6624,7 +6623,7 @@ behind quietly.` + n;
 			e.lagByReplica.set(t, n);
 		}
 	};
-}, gf = Symbol.for("@voltro/ScheduleDefinition"), _f = (e) => typeof e == "object" && !!e && gf in e, vf = 30 * 6e4, yf = (e) => {
+}, _f = Symbol.for("@voltro/ScheduleDefinition"), vf = (e) => typeof e == "object" && !!e && _f in e, yf = 18e5, bf = (e) => {
 	let t = r.parse(e.cron, e.timezone);
 	if (s.isLeft(t)) throw Error(`defineSchedule("${e.name}"): invalid cron expression "${e.cron}" (tz="${e.timezone}") — ${String(t.left)}`);
 	if (!e.timezone || e.timezone.trim() === "") throw Error(`defineSchedule("${e.name}"): timezone is required (e.g. "UTC", "Europe/Berlin").\nThe field is non-optional in \`ScheduleDefinition\`, so an ABSENT one is a tsc error and never reaches here. Arriving at this message means the value was present and EMPTY — almost always \`process.env.TZ ?? ''\` or a config lookup that missed. A reporter lost a crashloop to it, so the distinction is worth stating: this is not a check the type could have made for you.`);
@@ -6633,22 +6632,22 @@ behind quietly.` + n;
 		...e,
 		onOverlap: e.onOverlap ?? "skip",
 		backfill: e.backfill ?? "skip",
-		maxRuntimeMs: e.maxRuntimeMs ?? vf,
-		[gf]: !0
+		maxRuntimeMs: e.maxRuntimeMs ?? yf,
+		[_f]: !0
 	};
-}, bf = (e) => r.unsafeParse(e.cron, e.timezone), xf = (e, t = /* @__PURE__ */ new Date()) => r.next(bf(e), t), Sf = (e, t, n, i) => {
-	let a = bf(e), o = [], s = r.next(a, t);
+}, xf = (e) => r.unsafeParse(e.cron, e.timezone), Sf = (e, t = /* @__PURE__ */ new Date()) => r.next(xf(e), t), Cf = (e, t, n, i) => {
+	let a = xf(e), o = [], s = r.next(a, t);
 	for (; s.getTime() <= n.getTime() && o.length <= i;) o.push(s), s = r.next(a, s);
 	return o;
-}, X = "_voltro_wakeups", Cf = (e) => `${e.tenantId}:${e.kind}:${e.refId}`, wf = (e) => ({
+}, X = "_voltro_wakeups", wf = (e) => `${e.tenantId}:${e.kind}:${e.refId}`, Tf = (e) => ({
 	tenantId: String(e.tenantId),
 	kind: String(e.kind),
 	refId: String(e.refId),
 	wakeAt: e.wakeAt instanceof Date ? e.wakeAt : new Date(String(e.wakeAt)),
 	status: e.status === "fired" ? "fired" : "pending"
-}), Tf = async (e, t) => {
+}), Ef = async (e, t) => {
 	await e.upsert(X, {
-		id: Cf(t),
+		id: wf(t),
 		tenantId: t.tenantId,
 		kind: t.kind,
 		refId: t.refId,
@@ -6658,7 +6657,7 @@ behind quietly.` + n;
 		conflictColumns: ["id"],
 		update: ["wakeAt", "status"]
 	});
-}, Ef = async (e, t) => e.delete(X, Cf(t)), Df = async (e, t) => await e.update(X, Cf(t), { status: "fired" }) !== null, Of = (e, t) => ({ and: [{
+}, Df = async (e, t) => e.delete(X, wf(t)), Of = async (e, t) => await e.update(X, wf(t), { status: "fired" }) !== null, kf = (e, t) => ({ and: [{
 	column: "id",
 	op: "eq",
 	value: e
@@ -6666,16 +6665,16 @@ behind quietly.` + n;
 	column: "status",
 	op: "eq",
 	value: t
-}] }), kf = async (e, t) => await e.updateMany(X, { status: "fired" }, { where: Of(Cf(t), "pending") }) > 0, Af = async (e, t) => {
-	await e.updateMany(X, { status: "pending" }, { where: Of(Cf(t), "fired") });
-}, jf = {
+}] }), Af = async (e, t) => await e.updateMany(X, { status: "fired" }, { where: kf(wf(t), "pending") }) > 0, jf = async (e, t) => {
+	await e.updateMany(X, { status: "pending" }, { where: kf(wf(t), "fired") });
+}, Mf = {
 	column: "status",
 	op: "eq",
 	value: "pending"
-}, Mf = async (e, t) => {
+}, Nf = async (e, t) => {
 	let n = {
 		table: X,
-		predicate: jf,
+		predicate: Mf,
 		order: [{
 			column: "wakeAt",
 			direction: "asc"
@@ -6684,18 +6683,18 @@ behind quietly.` + n;
 		skip: void 0,
 		projection: void 0
 	};
-	return (await e.query(n)).map(wf);
-}, Nf = async (e, t, n = 500) => {
-	let r = await Mf(e, n), i = t.getTime();
+	return (await e.query(n)).map(Tf);
+}, Pf = async (e, t, n = 500) => {
+	let r = await Nf(e, n), i = t.getTime();
 	return r.filter((e) => e.wakeAt.getTime() <= i);
-}, Pf = async (e) => (await Mf(e, 1))[0] ?? null, Ff = {
+}, Ff = async (e) => (await Nf(e, 1))[0] ?? null, If = {
 	column: "status",
 	op: "eq",
 	value: "fired"
-}, If = async (e, t = {}) => {
+}, Lf = async (e, t = {}) => {
 	let n = {
 		table: X,
-		predicate: Ff,
+		predicate: If,
 		order: [{
 			column: "wakeAt",
 			direction: "asc"
@@ -6706,12 +6705,12 @@ behind quietly.` + n;
 	}, r = await e.query(n), i = t.firedOlderThan?.getTime(), a = 0;
 	for (let t of r) i !== void 0 && (t.wakeAt instanceof Date ? t.wakeAt : new Date(String(t.wakeAt))).getTime() >= i || await e.delete(X, String(t.id)) && a++;
 	return a;
-}, Lf = Ec, Rf = "default", zf = {
+}, Rf = Ec, zf = "default", Bf = {
 	kind: "single",
 	tryClaim: async () => !0
-}, Bf = "_voltro_schedule_claims", Vf = 6e4, Hf = 64, Uf = (e) => Math.max((e ?? 6e4) * 64, 6e4), Wf = (e, t, n) => {
+}, Vf = "_voltro_schedule_claims", Hf = 6e4, Uf = 64, Wf = (e) => Math.max((e ?? 6e4) * 64, 6e4), Gf = (e, t, n) => {
 	let r = async (t) => (await e.query({
-		table: Bf,
+		table: Vf,
 		order: [],
 		predicate: O("id", t),
 		projection: ["id"],
@@ -6722,7 +6721,7 @@ behind quietly.` + n;
 		if (!(r - (i.get(t) ?? 0) < n)) {
 			i.set(t, r);
 			try {
-				await e.deleteMany(Bf, { where: C(O("scheduleName", t), ge("claimedAt", new Date(r - n))) });
+				await e.deleteMany(Vf, { where: C(O("scheduleName", t), he("claimedAt", new Date(r - n))) });
 			} catch {}
 		}
 	};
@@ -6734,13 +6733,13 @@ behind quietly.` + n;
 				if (await r(u)) return !1;
 			} catch {}
 			try {
-				return await e.insert(Bf, {
+				return await e.insert(Vf, {
 					id: u,
 					scheduleName: i,
 					bucket: l,
 					claimedBy: t,
 					claimedAt: /* @__PURE__ */ new Date()
-				}), await a(i, Uf(s)), !0;
+				}), await a(i, Wf(s)), !0;
 			} catch (e) {
 				try {
 					if (await r(u)) return !1;
@@ -6752,12 +6751,12 @@ behind quietly.` + n;
 			}
 		}
 	};
-}, Gf = "_voltro_schedule_runs", Kf = async (e, t) => {
+}, Kf = "_voltro_schedule_runs", qf = async (e, t) => {
 	let { store: n, coordinator: i, buildContext: a, replicaId: o, log: s, onRunEvent: c, interceptFire: l } = t, u = t.dormancy === "sleep", d = t.dormancyTenantId ?? "default", f = /* @__PURE__ */ new Map(), p = /* @__PURE__ */ new Set(), m = /* @__PURE__ */ new Map(), h = !1, g = new Map(e.map((e) => [e.name, e])), _ = (e, t) => {
-		c?.(e, Jf(t));
+		c?.(e, Yf(t));
 	}, v = async (e, t, r, i, a, c) => {
 		try {
-			let s = `sr_${Ue()}`, l = await n.insert(Gf, {
+			let s = `sr_${He()}`, l = await n.insert(Kf, {
 				id: s,
 				name: e.name,
 				status: i,
@@ -6782,7 +6781,7 @@ behind quietly.` + n;
 		}
 	}, y = async (e, t) => {
 		try {
-			let r = await n.update(Gf, e, t);
+			let r = await n.update(Kf, e, t);
 			r && _("update", r);
 		} catch (t) {
 			s.warn("schedule: failed to record run finish", {
@@ -6793,7 +6792,7 @@ behind quietly.` + n;
 	}, b = async (e) => {
 		try {
 			let t = await n.query({
-				table: Gf,
+				table: Kf,
 				predicate: {
 					_tag: "leaf",
 					column: "status",
@@ -6828,7 +6827,7 @@ behind quietly.` + n;
 				scheduleName: e.name,
 				trigger: n,
 				runId: o,
-				subject: Lf
+				subject: Rf
 			})
 		};
 		try {
@@ -6864,7 +6863,7 @@ behind quietly.` + n;
 			let n = Z(t).includes("exceeded maxRuntimeMs"), r = Yn(t).dbMessage, i = typeof r == "string" && r !== "" ? `${Z(t)} — ${r}` : Z(t);
 			o && await y(o, {
 				status: "failed",
-				errorTag: n ? "timeout" : qf(t),
+				errorTag: n ? "timeout" : Jf(t),
 				errorMessage: i,
 				completedAt: /* @__PURE__ */ new Date(),
 				durationMs: Date.now() - c
@@ -6928,8 +6927,8 @@ behind quietly.` + n;
 		}
 	}, w = async (e) => {
 		try {
-			let t = r.next(bf(e), /* @__PURE__ */ new Date());
-			await Tf(n, {
+			let t = r.next(xf(e), /* @__PURE__ */ new Date());
+			await Ef(n, {
 				tenantId: d,
 				kind: "schedule",
 				refId: e.name,
@@ -6943,7 +6942,7 @@ behind quietly.` + n;
 		}
 	}, T = 2147483647, E = (e) => {
 		if (h) return;
-		let n = bf(e), i = r.next(n, /* @__PURE__ */ new Date()), a = () => {
+		let n = xf(e), i = r.next(n, /* @__PURE__ */ new Date()), a = () => {
 			if (h) return;
 			let n = i.getTime() - Date.now();
 			if (n > T) {
@@ -6965,7 +6964,7 @@ behind quietly.` + n;
 		let i;
 		try {
 			let t = (await n.query({
-				table: Gf,
+				table: Kf,
 				order: [{
 					column: "scheduledAt",
 					direction: "desc"
@@ -6984,17 +6983,19 @@ behind quietly.` + n;
 			return;
 		}
 		if (!i) return;
-		let a = bf(e), o = [], c = r.next(a, i), l = Date.now();
+		let a = xf(e), o = [], c = r.next(a, i), l = Date.now();
 		for (; c.getTime() < l && o.length < 1e3;) o.push(c), c = r.next(a, c);
-		if (o.length !== 0) if (s.info("schedule: backfill", {
-			name: e.name,
-			missed: o.length,
-			policy: e.backfill
-		}), e.backfill === "latest") {
-			for (let n of o.slice(0, -1)) await v(e, n, null, "missed", e.trigger ?? t.defaultTrigger, "single");
-			let n = o[o.length - 1];
-			await S(e, n, e.trigger ?? t.defaultTrigger);
-		} else for (let n of o) await S(e, n, e.trigger ?? t.defaultTrigger);
+		if (o.length !== 0) {
+			if (s.info("schedule: backfill", {
+				name: e.name,
+				missed: o.length,
+				policy: e.backfill
+			}), e.backfill === "latest") {
+				for (let n of o.slice(0, -1)) await v(e, n, null, "missed", e.trigger ?? t.defaultTrigger, "single");
+				let n = o[o.length - 1];
+				await S(e, n, e.trigger ?? t.defaultTrigger);
+			} else for (let n of o) await S(e, n, e.trigger ?? t.defaultTrigger);
+		}
 	}, D = e.filter((e) => (e.trigger ?? t.defaultTrigger) === "self");
 	s.info("scheduler: starting", {
 		total: e.length,
@@ -7027,7 +7028,7 @@ behind quietly.` + n;
 			let i = g.get(e);
 			if (!i) throw Error(`scheduler.backfillRange: unknown schedule "${e}"`);
 			if (!(t.getTime() < n.getTime())) throw Error(`scheduler.backfillRange("${e}"): 'from' (${t.toISOString()}) must be before 'to' (${n.toISOString()})`);
-			let a = Sf(i, t, n, r.cap);
+			let a = Cf(i, t, n, r.cap);
 			if (a.length > r.cap) throw Error(`scheduler.backfillRange("${e}"): more than ${r.cap} occurrences in ${t.toISOString()}..${n.toISOString()} — narrow the range or raise the cap`);
 			let o = [];
 			for (let e of a) {
@@ -7046,17 +7047,17 @@ behind quietly.` + n;
 			f.clear(), s.info("scheduler: stopped");
 		}
 	};
-}, Z = (e) => e?.message ?? String(e), qf = (e) => e && typeof e == "object" && "_tag" in e ? String(e._tag) : null, Jf = (e) => {
+}, Z = (e) => e?.message ?? String(e), Jf = (e) => e && typeof e == "object" && "_tag" in e ? String(e._tag) : null, Yf = (e) => {
 	let t = {};
 	for (let [n, r] of Object.entries(e)) t[n] = r instanceof Date ? r.toISOString() : r;
 	return t;
-}, Yf = 3e4, Xf = (e = process.env) => {
+}, Xf = 3e4, Zf = (e = process.env) => {
 	let t = e.VOLTRO_POLL_CEILING_MS;
-	if (t === void 0) return Yf;
+	if (t === void 0) return Xf;
 	let n = Number(t);
-	return Number.isFinite(n) && n > 0 ? n : Yf;
-}, Zf = (e, t, n, r) => {
-	let i = Math.max(t, r.maxIdleIntervalMs ?? Xf()), a = !1, o, s = !1, c = t, l = !1, u = !1, d = 0, f = (e) => {
+	return Number.isFinite(n) && n > 0 ? n : Xf;
+}, Qf = (e, t, n, r) => {
+	let i = Math.max(t, r.maxIdleIntervalMs ?? Zf()), a = !1, o, s = !1, c = t, l = !1, u = !1, d = 0, f = (e) => {
 		if (!a) {
 			if (o !== void 0 && clearTimeout(o), o = void 0, e === "disarm") {
 				s = !0;
@@ -7099,7 +7100,7 @@ behind quietly.` + n;
 				}), f(t);
 				return;
 			}
-			f(Qf(s, t, c, i, r.disarmWhenIdle ?? !1));
+			f($f(s, t, c, i, r.disarmWhenIdle ?? !1));
 		} finally {
 			l = !1, u && !a && (u = !1, f(0));
 		}
@@ -7123,107 +7124,107 @@ behind quietly.` + n;
 			a || (a = !0, o !== void 0 && clearTimeout(o), o = void 0);
 		}
 	};
-}, Qf = (e, t, n, r, i = !1) => {
+}, $f = (e, t, n, r, i = !1) => {
 	if (e === void 0 || !e.idle) return t;
 	if (e.nextDueInMs === void 0 && i) return "disarm";
 	let a = Math.min(Math.max(n, t) * 2, r);
 	return e.nextDueInMs === void 0 ? a : Math.max(t, Math.min(a, e.nextDueInMs));
-}, $f = (e) => (t, n, r, i) => Zf(t, n, r, {
+}, ep = (e) => (t, n, r, i) => Qf(t, n, r, {
 	...e,
 	...i?.disarmWhenIdle === void 0 ? {} : { disarmWhenIdle: i.disarmWhenIdle }
-}), ep = F("_voltro_schedule_runs", {
-	id: M({ prefix: "schrun" }),
-	name: I(),
-	status: I().oneOf([
+}), tp = I("_voltro_schedule_runs", {
+	id: N({ prefix: "schrun" }),
+	name: L(),
+	status: L().oneOf([
 		"running",
 		"succeeded",
 		"failed",
 		"skipped",
 		"missed"
 	]).default("running"),
-	trigger: I().oneOf([
+	trigger: L().oneOf([
 		"self",
 		"external",
 		"manual"
 	]).default("self"),
-	scheduledAt: L(),
-	firedAt: L().nullable(),
-	completedAt: L().nullable(),
-	durationMs: N().nullable(),
-	errorTag: I().nullable(),
-	errorMessage: I().nullable(),
-	coordinationOutcome: I().oneOf([
+	scheduledAt: R(),
+	firedAt: R().nullable(),
+	completedAt: R().nullable(),
+	durationMs: P().nullable(),
+	errorTag: L().nullable(),
+	errorMessage: L().nullable(),
+	coordinationOutcome: L().oneOf([
 		"single",
 		"wonLock",
 		"lostLock",
 		"external",
 		"cluster"
 	]).nullable(),
-	replicaId: I().nullable(),
-	result: P().nullable()
-}).index(["name", "scheduledAt"]).index(["status"]), tp = F("_voltro_schedule_claims", {
-	id: M({ prefix: "schclaim" }),
-	scheduleName: I(),
-	bucket: I(),
-	claimedBy: I(),
-	claimedAt: L()
-}).index(["scheduleName", "claimedAt"]).index(["claimedAt"]), np = F("_voltro_traces", {
-	id: M({ prefix: "span" }),
-	traceId: I(),
-	spanId: I(),
-	parentSpanId: I().nullable(),
-	name: I(),
-	kind: I().oneOf([
+	replicaId: L().nullable(),
+	result: F().nullable()
+}).index(["name", "scheduledAt"]).index(["status"]), np = I("_voltro_schedule_claims", {
+	id: N({ prefix: "schclaim" }),
+	scheduleName: L(),
+	bucket: L(),
+	claimedBy: L(),
+	claimedAt: R()
+}).index(["scheduleName", "claimedAt"]).index(["claimedAt"]), rp = I("_voltro_traces", {
+	id: N({ prefix: "span" }),
+	traceId: L(),
+	spanId: L(),
+	parentSpanId: L().nullable(),
+	name: L(),
+	kind: L().oneOf([
 		"internal",
 		"server",
 		"client",
 		"producer",
 		"consumer"
 	]).default("internal"),
-	status: I().oneOf([
+	status: L().oneOf([
 		"ok",
 		"error",
 		"unset"
 	]).default("unset"),
-	statusMessage: I().nullable(),
-	startedAt: L(),
-	endedAt: L(),
-	durationMs: N(),
-	attributes: P().nullable(),
-	events: P().nullable()
-}).index(["traceId", "startedAt"]).index(["startedAt"]).index(["status"]), rp = F("_voltro_undo_log", {
-	id: M({ prefix: "undo" }),
-	tag: I(),
-	label: I().nullable(),
-	subjectId: I().nullable(),
-	tenantId: I().nullable(),
-	traceId: I().nullable(),
-	changes: I(),
+	statusMessage: L().nullable(),
+	startedAt: R(),
+	endedAt: R(),
+	durationMs: P(),
+	attributes: F().nullable(),
+	events: F().nullable()
+}).index(["traceId", "startedAt"]).index(["startedAt"]).index(["status"]), ip = I("_voltro_undo_log", {
+	id: N({ prefix: "undo" }),
+	tag: L(),
+	label: L().nullable(),
+	subjectId: L().nullable(),
+	tenantId: L().nullable(),
+	traceId: L().nullable(),
+	changes: L(),
 	crossesAction: E().default(!1),
 	undone: E().default(!1),
-	createdAt: L().default("now")
-}).index(["subjectId", "createdAt"]), ip = (e = process.env) => {
+	createdAt: R().default("now")
+}).index(["subjectId", "createdAt"]), ap = (e = process.env) => {
 	let t = (e.VOLTRO_UNDO ?? "").toLowerCase();
 	return t === "on" || t === "1" || t === "true" ? !0 : t === "off" || t === "0" || t === "false" ? !1 : e.NODE_ENV !== "production";
-}, ap = (e = process.env) => {
+}, op = (e = process.env) => {
 	let t = (e.VOLTRO_UNDO ?? "").toLowerCase();
-	return !(t === "off" || t === "0" || t === "false");
-}, op = (e) => e.startsWith("_voltro"), sp = async (e, t, n) => (await e.query({
+	return t !== "off" && t !== "0" && t !== "false";
+}, sp = (e) => e.startsWith("_voltro"), cp = async (e, t, n) => (await e.query({
 	table: t,
 	predicate: O("id", n),
 	order: []
-}))[0] ?? null, cp = (e, t) => new Proxy(e, { get(e, n, r) {
+}))[0] ?? null, lp = (e, t) => new Proxy(e, { get(e, n, r) {
 	if (n === "insert") return async (n, r) => {
 		let i = await e.insert(n, r);
-		return op(n) || t({
+		return sp(n) || t({
 			table: n,
 			op: "insert",
 			next: i
 		}), i;
 	};
 	if (n === "update") return async (n, r, i) => {
-		let a = op(n) ? null : await sp(e, n, r), o = await e.update(n, r, i);
-		return op(n) || t({
+		let a = sp(n) ? null : await cp(e, n, r), o = await e.update(n, r, i);
+		return sp(n) || t({
 			table: n,
 			op: "update",
 			id: r,
@@ -7232,8 +7233,8 @@ behind quietly.` + n;
 		}), o;
 	};
 	if (n === "delete") return async (n, r) => {
-		let i = op(n) ? null : await sp(e, n, r), a = await e.delete(n, r);
-		return !op(n) && a && t({
+		let i = sp(n) ? null : await cp(e, n, r), a = await e.delete(n, r);
+		return !sp(n) && a && t({
 			table: n,
 			op: "delete",
 			id: r,
@@ -7242,10 +7243,10 @@ behind quietly.` + n;
 	};
 	let i = Reflect.get(e, n, r);
 	return typeof i == "function" ? i.bind(e) : i;
-} }), lp = (e) => {
+} }), up = (e) => {
 	let t = [];
 	return {
-		tx: cp(e, (e) => t.push(e)),
+		tx: lp(e, (e) => t.push(e)),
 		persist: async (e, n) => {
 			if (t.length === 0 || n.tag.startsWith("__voltro")) return;
 			let r = n.subject;
@@ -7261,13 +7262,13 @@ behind quietly.` + n;
 			});
 		}
 	};
-}, up = (e) => e.startsWith("_voltro"), dp = (e) => {
+}, dp = (e) => e.startsWith("_voltro"), fp = (e) => {
 	let t = e?.id;
 	return typeof t == "string" ? t : void 0;
-}, fp = (e) => {
+}, pp = (e) => {
 	let t = /* @__PURE__ */ new Map(), n = (e, n) => {
-		if (n == null || up(e)) return;
-		let r = dp(n);
+		if (n == null || dp(e)) return;
+		let r = fp(n);
 		r !== void 0 && t.set(`${e}\u0000${r}`, {
 			table: e,
 			id: r,
@@ -7292,9 +7293,9 @@ behind quietly.` + n;
 		} }),
 		drain: () => [...t.values()]
 	};
-}, pp = (e) => {
-	if (!(e === !0 || e === void 0)) return e === !1 ? {} : e;
-}, mp = async (e) => {
+}, mp = (e) => {
+	if (e !== !0 && e !== void 0) return e === !1 ? {} : e;
+}, hp = async (e) => {
 	if (e.touched.length === 0) return;
 	let t = {
 		store: e.store,
@@ -7302,8 +7303,8 @@ behind quietly.` + n;
 	};
 	for (let { table: n, row: r } of e.touched) {
 		let e = j(n)?.appliedRules;
-		if (!(e === void 0 || e.length === 0)) for (let i of e) {
-			let e = pp(await i.predicate(r, t));
+		if (e !== void 0 && e.length !== 0) for (let i of e) {
+			let e = mp(await i.predicate(r, t));
 			if (e !== void 0) {
 				if (i.severity === "warning") {
 					Ht.warn("business rule violated (warning)", {
@@ -7314,7 +7315,7 @@ behind quietly.` + n;
 					});
 					continue;
 				}
-				throw new at({
+				throw new it({
 					rule: i.name,
 					severity: "error",
 					...e.params === void 0 ? {} : { params: e.params },
@@ -7324,14 +7325,14 @@ behind quietly.` + n;
 			}
 		}
 	}
-}, hp = (e) => {
+}, gp = (e) => {
 	if (e.id !== void 0) return e.id;
 	let t = e.next?.id;
 	if (typeof t == "string") return t;
 	let n = e.prev?.id;
 	return typeof n == "string" ? n : void 0;
-}, gp = (e) => {
-	let t = hp(e);
+}, _p = (e) => {
+	let t = gp(e);
 	switch (e.op) {
 		case "insert": return t === void 0 ? null : {
 			table: e.table,
@@ -7355,28 +7356,28 @@ behind quietly.` + n;
 			row: e.prev
 		};
 	}
-}, _p = (e) => {
-	if (e.crossesAction) throw new vp(e.invocationId, "action");
+}, vp = (e) => {
+	if (e.crossesAction) throw new yp(e.invocationId, "action");
 	let t = [];
 	for (let n = e.changes.length - 1; n >= 0; --n) {
-		let r = gp(e.changes[n]);
+		let r = _p(e.changes[n]);
 		r !== null && t.push(r);
 	}
 	return t;
-}, vp = class extends Error {
+}, yp = class extends Error {
 	invocationId;
 	boundary;
 	_tag = "UndoBoundaryError";
 	constructor(e, t) {
 		super(t === "action" ? `cannot undo invocation ${e}: it crossed an action (external side effect)` : `cannot undo invocation ${e}: the row changed since (conflict)`), this.invocationId = e, this.boundary = t, this.name = "UndoBoundaryError";
 	}
-}, yp = (e, t, n = ["updatedAt", "updatedBy"]) => {
+}, bp = (e, t, n = ["updatedAt", "updatedBy"]) => {
 	if (t == null) return e == null;
 	if (e == null) return !1;
 	let r = new Set(n);
 	for (let [n, i] of Object.entries(t)) if (!r.has(n) && !Object.is(e[n], i) && JSON.stringify(e[n]) !== JSON.stringify(i)) return !1;
 	return !0;
-}, bp = class {
+}, xp = class {
 	capacity;
 	done = [];
 	undone = [];
@@ -7412,7 +7413,7 @@ behind quietly.` + n;
 			redo: [...this.undone]
 		};
 	}
-}, xp = (e, t = /* @__PURE__ */ new Set()) => e.op === "insert" ? {
+}, Sp = (e, t = /* @__PURE__ */ new Set()) => e.op === "insert" ? {
 	table: e.table,
 	op: "insert",
 	next: e.new ?? null
@@ -7429,7 +7430,7 @@ behind quietly.` + n;
 	table: e.table,
 	op: "delete",
 	prev: e.old ?? null
-}, Sp = async (e, t) => {
+}, Cp = async (e, t) => {
 	switch (t.op) {
 		case "delete":
 			await e.delete(t.table, t.id);
@@ -7447,21 +7448,21 @@ behind quietly.` + n;
 			await e.insert(t.table, t.row);
 			return;
 	}
-}, Cp = async (e, t) => {
-	for (let n of t) await Sp(e, n);
-}, wp = (e) => e.request?.subject?.id ?? null, Tp = (e) => e === !0 || e === 1, Ep = async (e, t, n) => (await e.query({
+}, wp = async (e, t) => {
+	for (let n of t) await Cp(e, n);
+}, Tp = (e) => e.request?.subject?.id ?? null, Ep = (e) => e === !0 || e === 1, Dp = async (e, t, n) => (await e.query({
 	table: t,
 	predicate: O("id", n),
 	order: []
-}))[0] ?? null, Dp = (e) => {
+}))[0] ?? null, Op = (e) => {
 	try {
 		let t = JSON.parse(String(e ?? "[]"));
 		return Array.isArray(t) ? t : [];
 	} catch {
 		return [];
 	}
-}, Op = (e) => e.id ?? e.next?.id ?? e.prev?.id, kp = async (e, t) => {
-	let n = wp(t);
+}, kp = (e) => e.id ?? e.next?.id ?? e.prev?.id, Ap = async (e, t) => {
+	let n = Tp(t);
 	return [...await t.store.query({
 		table: "_voltro_undo_log",
 		predicate: O("subjectId", n),
@@ -7470,72 +7471,72 @@ behind quietly.` + n;
 		id: String(e.id),
 		tag: String(e.tag ?? ""),
 		label: e.label ?? null,
-		undone: Tp(e.undone),
-		crossesAction: Tp(e.crossesAction),
+		undone: Ep(e.undone),
+		crossesAction: Ep(e.crossesAction),
 		createdAt: String(e.createdAt ?? "")
 	}));
-}, Ap = async (e, t) => {
-	let n = await Ep(t.store, "_voltro_undo_log", e.invocationId);
-	if (!n) throw new yt({ invocationId: e.invocationId });
-	if ((n.subjectId ?? null) !== wp(t)) throw new vt({ invocationId: e.invocationId });
-	return n;
 }, jp = async (e, t) => {
-	let n = await Ap(e, t);
-	if (Tp(n.undone)) return { ok: !0 };
-	if (Tp(n.crossesAction)) throw new _t({
+	let n = await Dp(t.store, "_voltro_undo_log", e.invocationId);
+	if (!n) throw new vt({ invocationId: e.invocationId });
+	if ((n.subjectId ?? null) !== Tp(t)) throw new _t({ invocationId: e.invocationId });
+	return n;
+}, Mp = async (e, t) => {
+	let n = await jp(e, t);
+	if (Ep(n.undone)) return { ok: !0 };
+	if (Ep(n.crossesAction)) throw new gt({
 		invocationId: e.invocationId,
 		reason: "action"
 	});
-	let r = Dp(n.changes);
+	let r = Op(n.changes);
 	for (let n of r) {
-		let r = Op(n);
-		if (r !== void 0 && !yp(await Ep(t.store, n.table, r), n.next ?? null)) throw new _t({
+		let r = kp(n);
+		if (r !== void 0 && !bp(await Dp(t.store, n.table, r), n.next ?? null)) throw new gt({
 			invocationId: e.invocationId,
 			reason: "conflict"
 		});
 	}
 	let i = {
 		invocationId: e.invocationId,
-		subject: wp(t),
+		subject: Tp(t),
 		changes: r,
 		crossesAction: !1
 	};
-	return await Cp(t.store, _p(i)), await t.store.update("_voltro_undo_log", e.invocationId, { undone: !0 }), { ok: !0 };
-}, Mp = async (e, t) => {
-	let n = await Ap(e, t);
-	if (!Tp(n.undone)) return { ok: !0 };
-	for (let e of Dp(n.changes)) {
-		let n = Op(e);
+	return await wp(t.store, vp(i)), await t.store.update("_voltro_undo_log", e.invocationId, { undone: !0 }), { ok: !0 };
+}, Np = async (e, t) => {
+	let n = await jp(e, t);
+	if (!Ep(n.undone)) return { ok: !0 };
+	for (let e of Op(n.changes)) {
+		let n = kp(e);
 		e.op === "insert" && e.next ? await t.store.insert(e.table, e.next) : e.op === "update" && n !== void 0 && e.next ? await t.store.update(e.table, n, e.next) : e.op === "delete" && n !== void 0 && await t.store.delete(e.table, n);
 	}
 	return await t.store.update("_voltro_undo_log", e.invocationId, { undone: !1 }), { ok: !0 };
-}, Np = "_voltro_approvals", Pp = 1440 * 6e4, Fp = F(Np, {
-	id: M({ prefix: "apv" }),
-	intentKey: I().maxLength(191),
-	procedure: I(),
-	kind: I(),
-	requestedBy: I().nullable(),
-	tenantId: I().nullable(),
-	payload: I(),
-	approverGuards: I(),
-	approverScopes: I(),
-	reason: I().nullable(),
-	status: I().default("pending"),
-	decidedBy: I().nullable(),
-	decidedAt: L().nullable(),
-	note: I().nullable(),
-	traceId: I().nullable(),
-	requestedAt: L().default("now"),
-	expiresAt: L(),
-	consumedAt: L().nullable()
-}).index(["status", "expiresAt"]).index(["requestedBy"]), Ip = () => {
-	De({
+}, Pp = "_voltro_approvals", Fp = 864e5, Ip = I(Pp, {
+	id: N({ prefix: "apv" }),
+	intentKey: L().maxLength(191),
+	procedure: L(),
+	kind: L(),
+	requestedBy: L().nullable(),
+	tenantId: L().nullable(),
+	payload: L(),
+	approverGuards: L(),
+	approverScopes: L(),
+	reason: L().nullable(),
+	status: L().default("pending"),
+	decidedBy: L().nullable(),
+	decidedAt: R().nullable(),
+	note: L().nullable(),
+	traceId: L().nullable(),
+	requestedAt: R().default("now"),
+	expiresAt: R(),
+	consumedAt: R().nullable()
+}).index(["status", "expiresAt"]).index(["requestedBy"]), Lp = () => {
+	Ee({
 		source: "framework",
-		table: Np,
+		table: Pp,
 		timeColumn: "requestedAt",
-		ttlMs: Ae(process.env.VOLTRO_APPROVALS_TTL_HOURS, 720)
+		ttlMs: ke(process.env.VOLTRO_APPROVALS_TTL_HOURS, 720)
 	});
-}, Lp = (e, t) => e.map((e) => jt(e) ? {
+}, Rp = (e, t) => e.map((e) => jt(e) ? {
 	kind: "policy",
 	action: e.action,
 	resourceType: e.resourceType,
@@ -7545,7 +7546,7 @@ behind quietly.` + n;
 	scope: typeof e.scope == "string" ? [e.scope] : [...e.scope],
 	mode: e.mode ?? "all",
 	resource: e.resource?.(t) ?? null
-}), Rp = (e) => e.map((e) => e.kind === "policy" ? {
+}), zp = (e) => e.map((e) => e.kind === "policy" ? {
 	action: e.action,
 	resourceType: e.resourceType,
 	resource: () => e.resource ?? void 0
@@ -7553,7 +7554,7 @@ behind quietly.` + n;
 	scope: e.scope,
 	mode: e.mode,
 	...e.resource === null ? {} : { resource: () => e.resource ?? void 0 }
-}), zp = (e) => e.flatMap((e) => e.kind === "policy" ? [`${e.resourceType}:${e.action}`] : [...e.scope]), Bp = (e) => {
+}), Bp = (e) => e.flatMap((e) => e.kind === "policy" ? [`${e.resourceType}:${e.action}`] : [...e.scope]), Vp = (e) => {
 	let t = (e) => {
 		if (Array.isArray(e)) return e.map(t);
 		if (typeof e == "object" && e) {
@@ -7564,7 +7565,7 @@ behind quietly.` + n;
 		return e;
 	};
 	return JSON.stringify(t(e) ?? null);
-}, Vp = (e) => {
+}, Hp = (e) => {
 	let t = [
 		e.procedure,
 		e.requestedBy ?? "",
@@ -7572,49 +7573,49 @@ behind quietly.` + n;
 		e.payload,
 		e.nonce ?? ""
 	].map((e) => `${e.length}:${e}`).join("");
-	return Ve("sha256").update(t, "utf8").digest("hex");
-}, Hp = (e) => e instanceof Date ? e.toISOString() : typeof e == "string" ? e : (/* @__PURE__ */ new Date(0)).toISOString(), Up = (e) => e instanceof Date ? e.getTime() : typeof e == "string" ? Date.parse(e) : 0, Wp = (e) => {
+	return Be("sha256").update(t, "utf8").digest("hex");
+}, Up = (e) => e instanceof Date ? e.toISOString() : typeof e == "string" ? e : (/* @__PURE__ */ new Date(0)).toISOString(), Wp = (e) => e instanceof Date ? e.getTime() : typeof e == "string" ? Date.parse(e) : 0, Gp = (e) => {
 	try {
 		let t = JSON.parse(String(e ?? "[]"));
 		return Array.isArray(t) ? t : [];
 	} catch {
 		return [];
 	}
-}, Gp = async (e, t) => (await e.query({
+}, Kp = async (e, t) => (await e.query({
 	table: "_voltro_approvals",
 	predicate: O("intentKey", t),
 	order: []
-}))[0] ?? null, Kp = async (e, t) => (await e.query({
+}))[0] ?? null, qp = async (e, t) => (await e.query({
 	table: "_voltro_approvals",
 	predicate: O("id", t),
 	order: []
-}))[0] ?? null, qp = async (e, t, n) => {
+}))[0] ?? null, Jp = async (e, t, n) => {
 	let r = String(t.intentKey ?? ""), i = r.includes("#") ? r : `${r}#${String(t.id)}`;
-	await e.update(Np, String(t.id), {
+	await e.update(Pp, String(t.id), {
 		...n,
 		intentKey: i
 	});
-}, Jp = (e) => {
+}, Yp = (e) => {
 	let t = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)$/.exec(e.trim());
 	if (t === null) return null;
 	let n = Number(t[1]);
 	if (!(Number.isFinite(n) && n > 0)) return null;
 	let r = t[2];
 	return n * (r === "ms" ? 1 : r === "s" ? 1e3 : r === "m" ? 6e4 : r === "h" ? 36e5 : 864e5);
-}, Yp = (e) => {
+}, Xp = (e) => {
 	let t = e.store, n = e.now ?? Date.now, r = e.defaultExpiryMs ?? 864e5;
-	Ip();
+	Lp();
 	let i = (e) => {
 		if (e.expiresIn === void 0) return r;
-		let t = Jp(e.expiresIn);
+		let t = Yp(e.expiresIn);
 		if (t === null) throw Error(`requiresApproval.expiresIn must be an interval like '4h' / '30m' (got ${JSON.stringify(e.expiresIn)})`);
 		return t;
 	}, a = async (e, r, a) => {
-		let o = Lp(e.policy.approvers, e.input), s = A({
+		let o = Rp(e.policy.approvers, e.input), s = A({
 			kind: "typeid",
 			prefix: "apv"
-		}, Np), c = n();
-		await t.insertIgnore(Np, {
+		}, Pp), c = n();
+		await t.insertIgnore(Pp, {
 			id: s,
 			intentKey: r,
 			procedure: e.procedure,
@@ -7623,7 +7624,7 @@ behind quietly.` + n;
 			tenantId: e.subject?.tenantId ?? null,
 			payload: a,
 			approverGuards: JSON.stringify(o),
-			approverScopes: JSON.stringify(zp(o)),
+			approverScopes: JSON.stringify(Bp(o)),
 			reason: e.policy.reason ?? null,
 			status: "pending",
 			decidedBy: null,
@@ -7634,36 +7635,36 @@ behind quietly.` + n;
 			expiresAt: new Date(c + i(e.policy)),
 			consumedAt: null
 		}, { conflictColumns: ["intentKey"] });
-		let l = await Gp(t, r);
-		if (l === null) throw new rt({
+		let l = await Kp(t, r);
+		if (l === null) throw new nt({
 			procedure: e.procedure,
 			message: "the approval intent was written and could not be read back"
 		});
 		return l;
-	}, o = (e, t) => new tt({
+	}, o = (e, t) => new et({
 		approvalId: String(e.id),
 		procedure: String(e.procedure),
-		expiresAt: Hp(e.expiresAt),
-		requiredScopes: zp(Wp(e.approverGuards)),
+		expiresAt: Up(e.expiresAt),
+		requiredScopes: Bp(Gp(e.approverGuards)),
 		reason: e.reason ?? null,
 		created: t
 	});
 	return { admit: async (e) => {
-		let r = Bp(e.input), i = Vp({
+		let r = Vp(e.input), i = Hp({
 			procedure: e.procedure,
 			requestedBy: e.subject?.id ?? null,
 			tenantId: e.subject?.tenantId ?? null,
 			payload: r,
 			nonce: e.nonce
-		}), s = await Gp(t, i);
+		}), s = await Kp(t, i);
 		if (s === null) throw o(await a(e, i, r), !0);
-		let c = String(s.status ?? "pending"), l = Up(s.expiresAt);
-		if ((c === "pending" || c === "approved") && n() > l) throw await qp(t, s, { status: "expired" }), new Xe({
+		let c = String(s.status ?? "pending"), l = Wp(s.expiresAt);
+		if ((c === "pending" || c === "approved") && n() > l) throw await Jp(t, s, { status: "expired" }), new Ye({
 			approvalId: String(s.id),
-			expiredAt: Hp(s.expiresAt)
+			expiredAt: Up(s.expiresAt)
 		});
 		if (c === "pending") throw o(s, !1);
-		if (c === "rejected") throw await qp(t, s, {}), new et({
+		if (c === "rejected") throw await Jp(t, s, {}), new $e({
 			approvalId: String(s.id),
 			decidedBy: s.decidedBy ?? null,
 			note: s.note ?? null
@@ -7674,18 +7675,18 @@ behind quietly.` + n;
 				consumedAt: new Date(n()),
 				intentKey: `${i}#${String(s.id)}`
 			}, { where: C(O("id", String(s.id)), O("status", "approved")) }) === 1) return;
-			throw s = await Gp(t, i), s === null ? o(await a(e, i, r), !0) : o(s, !1);
+			throw s = await Kp(t, i), s === null ? o(await a(e, i, r), !0) : o(s, !1);
 		}
-		throw await qp(t, s, {}), o(await a(e, i, r), !0);
+		throw await Jp(t, s, {}), o(await a(e, i, r), !0);
 	} };
-}, Xp, Zp = (e) => {
-	Xp = e;
-}, Qp = () => Xp, $p = () => {
-	Xp = void 0;
-}, em = async (e) => {
+}, Zp, Qp = (e) => {
+	Zp = e;
+}, $p = () => Zp, em = () => {
+	Zp = void 0;
+}, tm = async (e) => {
 	if (e.policy === void 0) return;
-	let t = Qp();
-	if (t === void 0) throw new rt({
+	let t = $p();
+	if (t === void 0) throw new nt({
 		procedure: e.procedure,
 		message: `${e.procedure} declares \`requiresApproval\` and no approvals gate is installed on this boot path, so the framework cannot record the intent or verify a decision. Refusing the call rather than running it unapproved.`
 	});
@@ -7697,30 +7698,30 @@ behind quietly.` + n;
 		input: e.input,
 		...e.traceId === void 0 ? {} : { traceId: e.traceId }
 	});
-}, tm = async (e, t) => {
-	let n = t.now ?? Date.now, r = await Kp(e, t.approvalId);
-	if (r === null) throw new Qe({ approvalId: t.approvalId });
+}, nm = async (e, t) => {
+	let n = t.now ?? Date.now, r = await qp(e, t.approvalId);
+	if (r === null) throw new Ze({ approvalId: t.approvalId });
 	let i = String(r.status ?? "pending");
-	if (i !== "pending") throw new $e({
+	if (i !== "pending") throw new Qe({
 		approvalId: t.approvalId,
 		status: i
 	});
-	if (n() > Up(r.expiresAt)) throw await qp(e, r, { status: "expired" }), new Xe({
+	if (n() > Wp(r.expiresAt)) throw await Jp(e, r, { status: "expired" }), new Ye({
 		approvalId: t.approvalId,
-		expiredAt: Hp(r.expiresAt)
+		expiredAt: Up(r.expiresAt)
 	});
 	let a = t.approver?.id ?? null;
-	if (a === null) throw new Ze({
+	if (a === null) throw new Xe({
 		approvalId: t.approvalId,
 		required: null,
 		message: "an approval decision needs an identified subject — an anonymous caller cannot be the second human"
 	});
-	if (a === (r.requestedBy ?? null)) throw new nt({
+	if (a === (r.requestedBy ?? null)) throw new tt({
 		approvalId: t.approvalId,
 		subjectId: a
 	});
-	let s = Rp(Wp(r.approverGuards)), c = await o.runPromise(z(t.approver, s, JSON.parse(String(r.payload ?? "null"))));
-	if (c) throw new Ze({
+	let s = zp(Gp(r.approverGuards)), c = await o.runPromise(xt(t.approver, s, JSON.parse(String(r.payload ?? "null"))));
+	if (c) throw new Xe({
 		approvalId: t.approvalId,
 		required: c.required ?? null,
 		message: c.message
@@ -7732,8 +7733,8 @@ behind quietly.` + n;
 		decidedAt: new Date(n()),
 		note: t.note ?? null
 	}, { where: C(O("id", t.approvalId), O("status", "pending")) }) !== 1) {
-		let n = await Kp(e, t.approvalId);
-		throw new $e({
+		let n = await qp(e, t.approvalId);
+		throw new Qe({
 			approvalId: t.approvalId,
 			status: String(n?.status ?? "unknown")
 		});
@@ -7742,62 +7743,62 @@ behind quietly.` + n;
 		approvalId: t.approvalId,
 		status: l
 	};
-}, nm = async (e, t, n) => {
+}, rm = async (e, t, n) => {
 	let r = t?.id ?? null;
 	if (r === null) return [];
 	let i = n?.now ?? Date.now, a = await e.query({
-		table: Np,
-		predicate: ue("status", ["pending", "approved"]),
+		table: Pp,
+		predicate: le("status", ["pending", "approved"]),
 		order: []
 	}), s = [];
 	for (let e of a) {
-		if (i() > Up(e.expiresAt)) continue;
-		let n = Wp(e.approverGuards), a = (e.requestedBy ?? null) === r, c = a ? "requested" : null;
-		a || await o.runPromise(z(t, Rp(n), JSON.parse(String(e.payload ?? "null")))) === null && String(e.status) === "pending" && (c = "to-decide"), c !== null && s.push({
+		if (i() > Wp(e.expiresAt)) continue;
+		let n = Gp(e.approverGuards), a = (e.requestedBy ?? null) === r, c = a ? "requested" : null;
+		a || await o.runPromise(xt(t, zp(n), JSON.parse(String(e.payload ?? "null")))) === null && String(e.status) === "pending" && (c = "to-decide"), c !== null && s.push({
 			id: String(e.id),
 			procedure: String(e.procedure),
 			kind: String(e.kind) === "action" ? "action" : "mutation",
 			requestedBy: e.requestedBy ?? null,
 			status: String(e.status ?? "pending"),
 			reason: e.reason ?? null,
-			requiredScopes: zp(n),
-			requestedAt: Hp(e.requestedAt),
-			expiresAt: Hp(e.expiresAt),
+			requiredScopes: Bp(n),
+			requestedAt: Up(e.requestedAt),
+			expiresAt: Up(e.expiresAt),
 			decidedBy: e.decidedBy ?? null,
-			decidedAt: e.decidedAt == null ? null : Hp(e.decidedAt),
+			decidedAt: e.decidedAt == null ? null : Up(e.decidedAt),
 			note: e.note ?? null,
 			relation: c
 		});
 	}
 	return s.sort((e, t) => t.requestedAt.localeCompare(e.requestedAt)).slice(0, n?.limit ?? 50);
-}, rm = () => Ue(), im = (e) => e.request?.subject ?? null, am = async (e, t) => nm(t.store, im(t), { limit: e.limit ?? 50 }), om = async (e, t) => tm(t.store, {
+}, im = () => He(), am = (e) => e.request?.subject ?? null, om = async (e, t) => rm(t.store, am(t), { limit: e.limit ?? 50 }), sm = async (e, t) => nm(t.store, {
 	approvalId: e.approvalId,
 	decision: e.decision,
-	approver: im(t),
+	approver: am(t),
 	...e.note === void 0 ? {} : { note: e.note }
-}), sm = (e = process.env) => {
+}), cm = (e = process.env) => {
 	let t = (e.VOLTRO_TIMELINE ?? "").toLowerCase();
 	return t === "off" || t === "0" || t === "false" ? "off" : t === "all" ? "all" : t === "interesting" || t === "on" || t === "1" || t === "true" ? "interesting" : e.NODE_ENV === "production" ? "off" : "interesting";
-}, cm = /pass(word)?|secret|token|api[_-]?key|authorization|cookie|ssn|credit[_-]?card|card[_-]?number|cvv|encrypted/i, lm = "«redacted»", um = (e) => {
+}, lm = /pass(word)?|secret|token|api[_-]?key|authorization|cookie|ssn|credit[_-]?card|card[_-]?number|cvv|encrypted/i, um = "«redacted»", dm = (e) => {
 	if (e == null) return null;
 	let t = {};
-	for (let [n, r] of Object.entries(e)) t[n] = cm.test(n) ? lm : r;
+	for (let [n, r] of Object.entries(e)) t[n] = lm.test(n) ? um : r;
 	return t;
-}, dm = (e) => {
+}, fm = (e) => {
 	let t = e?.id;
 	return typeof t == "string" ? t : void 0;
-}, fm = (e, t) => {
+}, pm = (e, t) => {
 	if (t.op === "insert") {
-		let n = dm(t.new);
+		let n = fm(t.new);
 		return n === void 0 ? e : e.filter((e) => e.id !== n);
 	}
 	if (t.op === "update") {
 		if (t.old == null) return e;
-		let n = dm(t.new) ?? dm(t.old);
+		let n = fm(t.new) ?? fm(t.old);
 		return e.map((e) => e.id === n ? t.old : e);
 	}
 	return t.old == null ? e : [...e, t.old];
-}, pm = class {
+}, mm = class {
 	mode;
 	capacity;
 	now;
@@ -7817,8 +7818,8 @@ behind quietly.` + n;
 			ts: this.now(),
 			table: e.table,
 			op: e.op,
-			old: um(e.old),
-			new: um(e.new),
+			old: dm(e.old),
+			new: dm(e.new),
 			tenantId: n
 		}), this.ring.length > this.capacity && this.ring.shift(), t;
 	}
@@ -7831,23 +7832,23 @@ behind quietly.` + n;
 	}
 	replay(e, t, n) {
 		let r = this.ring.filter((n) => n.table === e && n.seq > t).sort((e, t) => t.seq - e.seq), i = n;
-		for (let e of r) i = fm(i, e);
+		for (let e of r) i = pm(i, e);
 		return i;
 	}
-}, mm, hm = () => (mm === void 0 && (mm = new pm(sm())), mm), gm = (e) => {
-	mm = e;
-}, _m = (e) => {
-	let t = hm();
+}, hm, gm = () => (hm === void 0 && (hm = new mm(cm())), hm), _m = (e) => {
+	hm = e;
+}, vm = (e) => {
+	let t = gm();
 	if (t.enabled) try {
 		t.record(e);
 	} catch {}
-}, vm = /* @__PURE__ */ new Set([
+}, ym = /* @__PURE__ */ new Set([
 	"count",
 	"sum",
 	"avg",
 	"min",
 	"max"
-]), ym = (e) => {
+]), bm = (e) => {
 	if (e.joins !== void 0 && e.joins.length > 0) return {
 		maintainable: !1,
 		reason: "joins are not maintainable in v1"
@@ -7869,7 +7870,7 @@ behind quietly.` + n;
 		reason: "v1 maintains exactly one aggregation"
 	};
 	let t = e.aggregations[0];
-	return vm.has(t.op) ? t.op !== "count" && (t.column === void 0 || t.column.length === 0) ? {
+	return ym.has(t.op) ? t.op !== "count" && (t.column === void 0 || t.column.length === 0) ? {
 		maintainable: !1,
 		reason: `op '${t.op}' requires a column`
 	} : {
@@ -7883,7 +7884,7 @@ behind quietly.` + n;
 		maintainable: !1,
 		reason: `op '${t.op}' is not maintainable`
 	};
-}, bm = "\0", xm = (e, t) => t === void 0 || t.length === 0 ? "" : t.map((t) => JSON.stringify(e[t] ?? null)).join(bm), Sm = (e, t) => t === void 0 ? 0 : Number(e[t] ?? 0), Cm = (e, t) => {
+}, xm = "\0", Sm = (e, t) => t === void 0 || t.length === 0 ? "" : t.map((t) => JSON.stringify(e[t] ?? null)).join(xm), Cm = (e, t) => t === void 0 ? 0 : Number(e[t] ?? 0), wm = (e, t) => {
 	switch (e.op) {
 		case "count": return t.count;
 		case "sum": return t.sum ?? 0;
@@ -7891,10 +7892,10 @@ behind quietly.` + n;
 		case "min":
 		case "max": return t.count > 0 ? t.extreme ?? null : null;
 	}
-}, wm = (e, t) => {
+}, Tm = (e, t) => {
 	let n = /* @__PURE__ */ new Map();
 	for (let r of t) {
-		let t = xm(r, e.groupBy), i = n.get(t), a = Sm(r, e.column);
+		let t = Sm(r, e.groupBy), i = n.get(t), a = Cm(r, e.column);
 		if (i === void 0) n.set(t, {
 			count: 1,
 			...e.op === "sum" || e.op === "avg" ? { sum: a } : {},
@@ -7910,19 +7911,19 @@ behind quietly.` + n;
 		}
 	}
 	return n;
-}, Tm = (e, t) => [...t.entries()].map(([t, n]) => ({
+}, Em = (e, t) => [...t.entries()].map(([t, n]) => ({
 	groupKey: t,
-	value: Cm(e, n)
-})), Em = (e, t, n) => {
+	value: wm(e, n)
+})), Dm = (e, t, n) => {
 	let r = new Map(t), i = /* @__PURE__ */ new Set(), a = (t) => {
-		let n = xm(t, e.groupBy), a = r.get(n);
+		let n = Sm(t, e.groupBy), a = r.get(n);
 		if (a === void 0) return;
 		let o = a.count - 1;
 		if (o <= 0) {
 			r.delete(n);
 			return;
 		}
-		let s = Sm(t, e.column);
+		let s = Cm(t, e.column);
 		e.op === "min" || e.op === "max" ? (a.extreme !== void 0 && s === a.extreme && i.add(n), r.set(n, {
 			count: o,
 			...a.extreme === void 0 ? {} : { extreme: a.extreme }
@@ -7931,7 +7932,7 @@ behind quietly.` + n;
 			...e.op === "sum" || e.op === "avg" ? { sum: (a.sum ?? 0) - s } : {}
 		});
 	}, o = (t) => {
-		let n = xm(t, e.groupBy), i = r.get(n), a = Sm(t, e.column);
+		let n = Sm(t, e.groupBy), i = r.get(n), a = Cm(t, e.column);
 		if (i === void 0) {
 			r.set(n, {
 				count: 1,
@@ -7951,15 +7952,15 @@ behind quietly.` + n;
 		state: r,
 		rescanGroups: [...i]
 	};
-}, Dm = (e, t, n, r) => {
+}, Om = (e, t, n, r) => {
 	if (n.length === 0) return t;
-	let i = new Set(n), a = wm(e, r.filter((t) => i.has(xm(t, e.groupBy)))), o = new Map(t);
+	let i = new Set(n), a = Tm(e, r.filter((t) => i.has(Sm(t, e.groupBy)))), o = new Map(t);
 	for (let e of i) {
 		let t = a.get(e);
 		t === void 0 ? o.delete(e) : o.set(e, t);
 	}
 	return o;
-}, Om = class {
+}, km = class {
 	shape;
 	state = /* @__PURE__ */ new Map();
 	groups = /* @__PURE__ */ new Map();
@@ -7967,35 +7968,35 @@ behind quietly.` + n;
 		this.shape = e;
 	}
 	seed(e) {
-		this.state = wm(this.shape, e), this.groups.clear();
+		this.state = Tm(this.shape, e), this.groups.clear();
 		for (let t of e) {
-			let e = xm(t, this.shape.groupBy);
+			let e = Sm(t, this.shape.groupBy);
 			this.groups.has(e) || this.groups.set(e, this.groupValues(t));
 		}
 	}
 	applyChange(e) {
 		let t = e.new;
 		if (t) {
-			let e = xm(t, this.shape.groupBy);
+			let e = Sm(t, this.shape.groupBy);
 			this.groups.has(e) || this.groups.set(e, this.groupValues(t));
 		}
-		let n = Em(this.shape, this.state, e);
+		let n = Dm(this.shape, this.state, e);
 		this.state = n.state;
 		for (let e of this.groups.keys()) this.state.has(e) || this.groups.delete(e);
 		return n.rescanGroups;
 	}
 	resolveRescan(e, t) {
 		if (e.length === 0) return;
-		this.state = Dm(this.shape, this.state, e, t);
+		this.state = Om(this.shape, this.state, e, t);
 		let n = new Set(e);
 		for (let e of t) {
-			let t = xm(e, this.shape.groupBy);
+			let t = Sm(e, this.shape.groupBy);
 			n.has(t) && this.state.has(t) && !this.groups.has(t) && this.groups.set(t, this.groupValues(e));
 		}
 		for (let e of n) this.state.has(e) || this.groups.delete(e);
 	}
 	materialize() {
-		return Tm(this.shape, this.state).map((e) => ({
+		return Em(this.shape, this.state).map((e) => ({
 			groupKey: e.groupKey,
 			group: this.groups.get(e.groupKey) ?? {},
 			value: e.value
@@ -8008,19 +8009,19 @@ behind quietly.` + n;
 		for (let r of t) n[r] = e[r];
 		return n;
 	}
-}, km = F("_voltro_rebac_tuples", {
-	id: M({ prefix: "rbct" }),
-	subjectId: I(),
-	relation: I(),
-	resourceType: I(),
-	resourceId: I(),
-	tenantId: I().nullable(),
-	createdAt: L().default("now")
+}, Am = I("_voltro_rebac_tuples", {
+	id: N({ prefix: "rbct" }),
+	subjectId: L(),
+	relation: L(),
+	resourceType: L(),
+	resourceId: L(),
+	tenantId: L().nullable(),
+	createdAt: R().default("now")
 }).index([
 	"subjectId",
 	"resourceType",
 	"resourceId"
-]), Am = async (e, t, n, r) => t === null ? [] : (await e.query({
+]), jm = async (e, t, n, r) => t === null ? [] : (await e.query({
 	table: "_voltro_rebac_tuples",
 	predicate: C(O("subjectId", t), O("resourceType", n), O("resourceId", r)),
 	order: [],
@@ -8032,11 +8033,11 @@ behind quietly.` + n;
 	relation: e.relation,
 	resourceType: e.resourceType,
 	resourceId: e.resourceId
-})), jm = (e) => ({
+})), Mm = (e) => ({
 	id: e.id,
 	tenantId: e.tenantId,
 	...e.scopes === void 0 ? {} : { scopes: e.scopes }
-}), Mm = (e, t) => {
+}), Nm = (e, t) => {
 	let n = t.getPolicy ?? Gu;
 	return (r, i) => {
 		let a = e[i.tag];
@@ -8049,7 +8050,7 @@ behind quietly.` + n;
 		if (s === void 0) return c("");
 		let l = a.resourceId(i.input);
 		if (l === null || l === "") return c("");
-		let u = jm(i.subject), d = {
+		let u = Mm(i.subject), d = {
 			type: a.resourceType,
 			id: l,
 			tenantId: i.subject.tenantId
@@ -8059,7 +8060,7 @@ behind quietly.` + n;
 			tuples: e
 		}) ? r : c(l));
 	};
-}, Nm = async (e, t, n) => t === null ? [] : (await e.query({
+}, Pm = async (e, t, n) => t === null ? [] : (await e.query({
 	table: "_voltro_rebac_tuples",
 	predicate: C(O("subjectId", t), O("resourceType", n)),
 	order: [],
@@ -8071,18 +8072,18 @@ behind quietly.` + n;
 	relation: e.relation,
 	resourceType: e.resourceType,
 	resourceId: e.resourceId
-})), Pm = (e) => {
+})), Fm = (e) => {
 	let t = e.getPolicy ?? Gu;
 	return async (n, r, i, a) => {
 		let o = t(r);
 		if (o === void 0) return [];
-		let s = jm(n);
+		let s = Mm(n);
 		return $u(s, i, r, a, {
 			policy: o,
 			tuples: await e.loadSubjectTuples(s.id, r)
 		});
 	};
-}, Fm = (e) => {
+}, Im = (e) => {
 	if (typeof e.name != "string" || e.name.length === 0) throw Error("defineReaction: a non-empty `name` is required");
 	if (e.watch === void 0 || typeof e.watch.table != "string" || e.watch.table.length === 0) throw Error(`reaction '${e.name}': watch.table is required`);
 	if (e.act === void 0 || e.act.kind !== "agent" && e.act.kind !== "workflow") throw Error(`reaction '${e.name}': act must be { kind: 'agent' | 'workflow', … }`);
@@ -8090,14 +8091,14 @@ behind quietly.` + n;
 	if (e.guards.rateLimit !== void 0 && (e.guards.rateLimit.limit <= 0 || e.guards.rateLimit.windowMs <= 0)) throw Error(`reaction '${e.name}': guards.rateLimit needs positive limit + windowMs`);
 	if (e.guards.costBudgetUsd !== void 0 && e.guards.costBudgetUsd < 0) throw Error(`reaction '${e.name}': guards.costBudgetUsd must be >= 0`);
 	return e;
-}, Im = (e, t) => e === void 0 ? !0 : Array.isArray(e) ? e.includes(t) : e === t, Lm = (e) => e.new?.tenantId ?? e.old?.tenantId ?? null, Rm = class {
+}, Lm = (e, t) => e === void 0 ? !0 : Array.isArray(e) ? e.includes(t) : e === t, Rm = (e) => e.new?.tenantId ?? e.old?.tenantId ?? null, zm = class {
 	hits = /* @__PURE__ */ new Map();
 	allow(e, t, n, r) {
 		let i = r - n, a = (this.hits.get(e) ?? []).filter((e) => e > i);
 		return a.length >= t ? (this.hits.set(e, a), !1) : (a.push(r), this.hits.set(e, a), !0);
 	}
-}, zm = (e, t, n, r, i) => `${e}\u0000${t}\u0000${Math.floor(i / n)}\u0000${r}`, Bm = async (e, t, n) => {
-	if (t.table !== e.watch.table || !Im(e.watch.on, t.op)) return "skipped-op";
+}, Bm = (e, t, n, r, i) => `${e}\u0000${t}\u0000${Math.floor(i / n)}\u0000${r}`, Vm = async (e, t, n) => {
+	if (t.table !== e.watch.table || !Lm(e.watch.on, t.op)) return "skipped-op";
 	if (e.when !== void 0 && !e.when(t)) return "skipped-when";
 	let r = `${e.name}:${e.guards.dedupeKey(t)}`;
 	if (await n.dedupe.has(r)) return "skipped-dedupe";
@@ -8106,23 +8107,23 @@ behind quietly.` + n;
 		let r = n.now?.() ?? Date.now(), a = i.key === void 0 ? "" : i.key(t);
 		if (n.claimRateSlot !== void 0) {
 			let t = !1;
-			for (let o = 0; o < i.limit; o++) if (await n.claimRateSlot(zm(e.name, a, i.windowMs, o, r))) {
+			for (let o = 0; o < i.limit; o++) if (await n.claimRateSlot(Bm(e.name, a, i.windowMs, o, r))) {
 				t = !0;
 				break;
 			}
 			if (!t) return "skipped-ratelimit";
 		} else if (n.rateLimiter !== void 0 && !n.rateLimiter.allow(`${e.name} ${a}`, i.limit, i.windowMs, r)) return "skipped-ratelimit";
 	}
-	let a = Lm(t);
+	let a = Rm(t);
 	return e.guards.costBudgetUsd !== void 0 && n.checkBudget !== void 0 && !await n.checkBudget(a, e.guards.costBudgetUsd) ? "skipped-budget" : (await n.runAct(e.act, t, {
 		id: a,
 		via: "agent"
 	}), await n.dedupe.add(r), "acted");
-}, Vm = /* @__PURE__ */ new Set([
+}, Hm = /* @__PURE__ */ new Set([
 	"info",
 	"warn",
 	"critical"
-]), Q = (e, t) => /* @__PURE__ */ Error(`defineExpectation(${JSON.stringify(e)}): ${t}`), Hm = (e) => {
+]), Q = (e, t) => /* @__PURE__ */ Error(`defineExpectation(${JSON.stringify(e)}): ${t}`), Um = (e) => {
 	let t = e.name;
 	if (typeof t != "string" || t.length === 0) throw Error("defineExpectation: a non-empty `name` is required");
 	if (e.on === void 0 || typeof e.on.table != "string" || e.on.table.length === 0) throw Q(t, "on.table is required — the table whose writes drive the expectation");
@@ -8151,7 +8152,7 @@ behind quietly.` + n;
 		default: throw Q(t, `unknown invariant kind ${JSON.stringify(n.kind)}`);
 	}
 	let r = e.severity ?? "warn";
-	if (!Vm.has(r)) throw Q(t, `severity must be one of info | warn | critical (got ${JSON.stringify(r)})`);
+	if (!Hm.has(r)) throw Q(t, `severity must be one of info | warn | critical (got ${JSON.stringify(r)})`);
 	return {
 		_voltroExpectation: !0,
 		name: t,
@@ -8163,9 +8164,9 @@ behind quietly.` + n;
 		severity: r,
 		...e.description === void 0 ? {} : { description: e.description }
 	};
-}, Um = (e) => typeof e == "object" && !!e && e._voltroExpectation === !0, Wm = class extends n.Tag("@voltro/ExpectationRegistry")() {}, Gm = (e) => o.gen(function* () {
-	return (yield* Wm).get(e.name);
-}), Km = (e) => {
+}, Wm = (e) => typeof e == "object" && !!e && e._voltroExpectation === !0, Gm = class extends n.Tag("@voltro/ExpectationRegistry")() {}, Km = (e) => o.gen(function* () {
+	return (yield* Gm).get(e.name);
+}), qm = (e) => {
 	if (e instanceof Date) return e.getTime();
 	if (typeof e == "number" && Number.isFinite(e)) return e;
 	if (typeof e == "string" && e.length > 0) {
@@ -8173,20 +8174,20 @@ behind quietly.` + n;
 		return Number.isNaN(t) ? null : t;
 	}
 	return null;
-}, qm = class {
+}, Jm = class {
 	maxAgeMs;
 	timeDependent = !0;
 	maintainer;
 	column;
 	constructor(e, t) {
-		this.maxAgeMs = t, this.column = e, this.maintainer = new Om({
+		this.maxAgeMs = t, this.column = e, this.maintainer = new km({
 			op: "max",
 			column: e
 		});
 	}
 	project(e) {
 		if (e == null) return null;
-		let t = Km(e[this.column]);
+		let t = qm(e[this.column]);
 		return t === null ? null : {
 			...e,
 			[this.column]: t
@@ -8228,7 +8229,7 @@ behind quietly.` + n;
 			violated: n > this.maxAgeMs
 		};
 	}
-}, Jm = class {
+}, Ym = class {
 	matches;
 	reduce;
 	timeDependent = !1;
@@ -8253,16 +8254,16 @@ behind quietly.` + n;
 	read() {
 		return this.reduce(this.total, this.matching);
 	}
-}, Ym = (e) => e == null, Xm = (e, t, n) => {
-	if (Ym(e)) return !1;
+}, Xm = (e) => e == null, Zm = (e, t, n) => {
+	if (Xm(e)) return !1;
 	let r = Number(e);
 	return Number.isNaN(r) ? !1 : t !== void 0 && r < t || n !== void 0 && r > n;
-}, Zm = (e) => {
+}, Qm = (e) => {
 	switch (e.kind) {
-		case "freshness": return new qm(e.column, e.maxAgeMs);
+		case "freshness": return new Jm(e.column, e.maxAgeMs);
 		case "nullRate": {
 			let t = e.column, n = e.maxRate;
-			return new Jm((e) => Ym(e[t]), (e, t) => {
+			return new Ym((e) => Xm(e[t]), (e, t) => {
 				let r = e > 0 ? t / e : 0;
 				return {
 					metric: r,
@@ -8273,7 +8274,7 @@ behind quietly.` + n;
 		}
 		case "rowCount": {
 			let { min: t, max: n } = e;
-			return new Jm(() => !1, (e) => ({
+			return new Ym(() => !1, (e) => ({
 				metric: e,
 				threshold: n ?? t ?? null,
 				violated: t !== void 0 && e < t || n !== void 0 && e > n
@@ -8281,7 +8282,7 @@ behind quietly.` + n;
 		}
 		case "valueBounds": {
 			let { column: t, min: n, max: r, maxViolationRate: i } = e;
-			return new Jm((e) => Xm(e[t], n, r), (e, t) => {
+			return new Ym((e) => Zm(e[t], n, r), (e, t) => {
 				if (i !== void 0) {
 					let n = e > 0 ? t / e : 0;
 					return {
@@ -8298,13 +8299,13 @@ behind quietly.` + n;
 			});
 		}
 	}
-}, Qm = (e) => ({
+}, $m = (e) => ({
 	table: e.table,
 	op: e.op,
 	traceId: e.traceId ?? null,
 	subjectId: e.subjectId ?? null,
 	procedure: e.procedure ?? null
-}), $m = (e, t) => !t || e.metric === null ? "unknown" : e.violated ? "violated" : "holding", eh = class {
+}), eh = (e, t) => !t || e.metric === null ? "unknown" : e.violated ? "violated" : "holding", th = class {
 	def;
 	deps;
 	engine;
@@ -8317,7 +8318,7 @@ behind quietly.` + n;
 	lastEvaluatedAt = null;
 	lastCause = null;
 	constructor(e, t) {
-		this.def = e, this.deps = t, this.engine = Zm(e.invariant), this.now = t.now ?? Date.now, this.threshold = null;
+		this.def = e, this.deps = t, this.engine = Qm(e.invariant), this.now = t.now ?? Date.now, this.threshold = null;
 	}
 	get timeDependent() {
 		return this.engine.timeDependent;
@@ -8346,13 +8347,13 @@ behind quietly.` + n;
 			let e = (await this.deps.queryBase()).filter((e) => this.inScope(e));
 			this.engine.resolveRescan(i, e);
 		}
-		return this.commitReading(this.engine.read(this.now()), !0, Qm(e));
+		return this.commitReading(this.engine.read(this.now()), !0, $m(e));
 	}
 	tick() {
 		return this.seeded ? this.commitReading(this.engine.read(this.now()), !0, null) : null;
 	}
 	commitReading(e, t, n) {
-		let r = this.status, i = $m(e, this.seeded);
+		let r = this.status, i = eh(e, this.seeded);
 		if (this.metric = e.metric, this.threshold = e.threshold, this.lastEvaluatedAt = new Date(this.now()), i !== r) {
 			if (this.status = i, this.since = this.lastEvaluatedAt, i === "violated" && (this.lastCause = n), t && i === "violated" && r !== "violated") return {
 				kind: "violated",
@@ -8382,7 +8383,7 @@ behind quietly.` + n;
 			...this.def.description === void 0 ? {} : { description: this.def.description }
 		};
 	}
-}, th = (e) => {
+}, nh = (e) => {
 	let t = e.now ?? Date.now, n = e.log, r = /* @__PURE__ */ new Set(), i = /* @__PURE__ */ new Map(), a = (e) => {
 		for (let t of r) try {
 			t(e);
@@ -8399,7 +8400,7 @@ behind quietly.` + n;
 	}), s = /* @__PURE__ */ new Map(), c = !1;
 	for (let { definition: r } of e.discovered) {
 		if (i.has(r.name)) throw Error(`expectation: duplicate name '${r.name}' — names must be unique across all expectations`);
-		let e = new eh(r, {
+		let e = new th(r, {
 			queryBase: o(r.on.table),
 			now: t,
 			...n === void 0 ? {} : { log: n }
@@ -8417,7 +8418,7 @@ behind quietly.` + n;
 	})();
 	let l = e.store.onChange((e) => {
 		let t = s.get(e.table);
-		t === void 0 || t.length === 0 || (async () => {
+		t !== void 0 && t.length !== 0 && (async () => {
 			for (let r of t) try {
 				let t = await r.applyChange(e);
 				t !== null && a(t);
@@ -8439,7 +8440,7 @@ behind quietly.` + n;
 				await e.seed();
 			} catch {}
 		})();
-	}, e.reconcileIntervalMs ?? 5 * 6e4);
+	}, e.reconcileIntervalMs ?? 3e5);
 	return f.unref?.(), {
 		registry: {
 			snapshot: () => [...i.values()].map((e) => e.state()),
@@ -8453,30 +8454,30 @@ behind quietly.` + n;
 		registered: [...i.keys()],
 		runTick: u
 	};
-}, nh = /* @__PURE__ */ new Set([
+}, rh = /* @__PURE__ */ new Set([
 	"info",
 	"warn",
 	"critical"
-]), rh = /* @__PURE__ */ new Set(["observe", "suspend"]), ih = (e, t) => /* @__PURE__ */ Error(`defineCostBudget(${JSON.stringify(e)}): ${t}`), ah = (e) => {
+]), ih = /* @__PURE__ */ new Set(["observe", "suspend"]), ah = (e, t) => /* @__PURE__ */ Error(`defineCostBudget(${JSON.stringify(e)}): ${t}`), oh = (e) => {
 	let t = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h|d)$/.exec(e.trim());
 	if (t === null) return null;
 	let n = Number(t[1]);
 	if (!(Number.isFinite(n) && n > 0)) return null;
 	let r = t[2];
 	return n * (r === "ms" ? 1 : r === "s" ? 1e3 : r === "m" ? 6e4 : r === "h" ? 36e5 : 864e5);
-}, oh = (e) => {
+}, sh = (e) => {
 	let t = e.name;
 	if (typeof t != "string" || t.length === 0) throw Error("defineCostBudget: a non-empty `name` is required");
-	if (!(typeof e.limit == "number" && Number.isFinite(e.limit) && e.limit > 0)) throw ih(t, "a positive, finite `limit` is required");
-	if (e.unit !== void 0 && (typeof e.unit != "string" || e.unit.length === 0)) throw ih(t, "unit, when present, must be a non-empty string");
+	if (!(typeof e.limit == "number" && Number.isFinite(e.limit) && e.limit > 0)) throw ah(t, "a positive, finite `limit` is required");
+	if (e.unit !== void 0 && (typeof e.unit != "string" || e.unit.length === 0)) throw ah(t, "unit, when present, must be a non-empty string");
 	let n = e.warnAt ?? .8;
-	if (!(typeof n == "number" && n >= 0 && n <= 1)) throw ih(t, "warnAt, when present, must be in [0, 1]");
+	if (!(typeof n == "number" && n >= 0 && n <= 1)) throw ah(t, "warnAt, when present, must be in [0, 1]");
 	let r = null;
-	if (e.window !== void 0 && (r = ah(e.window), r === null)) throw ih(t, `window must be an interval like '1h' / '24h' (got ${JSON.stringify(e.window)})`);
+	if (e.window !== void 0 && (r = oh(e.window), r === null)) throw ah(t, `window must be an interval like '1h' / '24h' (got ${JSON.stringify(e.window)})`);
 	let i = e.severity ?? "warn";
-	if (!nh.has(i)) throw ih(t, `severity must be one of info | warn | critical (got ${JSON.stringify(i)})`);
+	if (!rh.has(i)) throw ah(t, `severity must be one of info | warn | critical (got ${JSON.stringify(i)})`);
 	let a = e.onExceeded ?? "observe";
-	if (!rh.has(a)) throw ih(t, `onExceeded must be observe | suspend (got ${JSON.stringify(e.onExceeded)})`);
+	if (!ih.has(a)) throw ah(t, `onExceeded must be observe | suspend (got ${JSON.stringify(e.onExceeded)})`);
 	return {
 		_voltroCostBudget: !0,
 		name: t,
@@ -8488,9 +8489,9 @@ behind quietly.` + n;
 		onExceeded: a,
 		...e.description === void 0 ? {} : { description: e.description }
 	};
-}, sh = (e) => typeof e == "object" && !!e && e._voltroCostBudget === !0, ch = class extends n.Tag("@voltro/CostRegistry")() {}, lh = (e, t) => o.gen(function* () {
-	return (yield* ch).budget(e.name, t);
-}), uh = class {
+}, ch = (e) => typeof e == "object" && !!e && e._voltroCostBudget === !0, lh = class extends n.Tag("@voltro/CostRegistry")() {}, uh = (e, t) => o.gen(function* () {
+	return (yield* lh).budget(e.name, t);
+}), dh = class {
 	total = 0;
 	byUnit = /* @__PURE__ */ new Map();
 	bySubscription = /* @__PURE__ */ new Map();
@@ -8509,11 +8510,11 @@ behind quietly.` + n;
 			lastUpdatedAt: this.lastUpdatedAt
 		};
 	}
-}, dh = {
+}, fh = {
 	ok: 0,
 	warn: 1,
 	exceeded: 2
-}, fh = class {
+}, ph = class {
 	def;
 	tenantId;
 	spent = 0;
@@ -8539,7 +8540,7 @@ behind quietly.` + n;
 	}
 	settle(e, t, n) {
 		let r = this.status;
-		return e === r ? null : (this.status = e, this.since = t, dh[e] > dh[r] ? (this.lastCause = n, {
+		return e === r ? null : (this.status = e, this.since = t, fh[e] > fh[r] ? (this.lastCause = n, {
 			kind: e === "exceeded" ? "exceeded" : "warn",
 			state: this.state(),
 			cause: n
@@ -8552,7 +8553,7 @@ behind quietly.` + n;
 	apply(e, t, n) {
 		let r = [], i = this.rollWindow(n);
 		i !== null && r.push(i), this.spent += t, this.lastUpdatedAt = e.at ?? n;
-		let a = this.settle(this.statusOf(this.spent), n, ph(e));
+		let a = this.settle(this.statusOf(this.spent), n, mh(e));
 		return a !== null && r.push(a), r;
 	}
 	tick(e) {
@@ -8579,12 +8580,12 @@ behind quietly.` + n;
 			...this.def.description === void 0 ? {} : { description: this.def.description }
 		};
 	}
-}, ph = (e) => ({
+}, mh = (e) => ({
 	unit: e.unit,
 	subscriptionId: e.subscriptionId ?? null,
 	procedure: e.procedure ?? null,
 	traceId: e.traceId ?? null
-}), mh = (e) => Number.isFinite(e) && e > 0 ? e : 0, hh = class {
+}), hh = (e) => Number.isFinite(e) && e > 0 ? e : 0, gh = class {
 	now;
 	attribution = /* @__PURE__ */ new Map();
 	counters = /* @__PURE__ */ new Map();
@@ -8604,13 +8605,13 @@ behind quietly.` + n;
 	}
 	counterFor(e, t) {
 		let n = this.counters.get(e.name), r = n.get(t);
-		return r === void 0 && (r = new fh(e, t), n.set(t, r)), r;
+		return r === void 0 && (r = new ph(e, t), n.set(t, r)), r;
 	}
 	record(e) {
-		let t = mh(e.amount);
+		let t = hh(e.amount);
 		if (t === 0) return [];
 		let n = e.at ?? this.now(), r = this.attribution.get(e.tenantId);
-		r === void 0 && (r = new uh(), this.attribution.set(e.tenantId, r)), r.add(e, t, n);
+		r === void 0 && (r = new dh(), this.attribution.set(e.tenantId, r)), r.add(e, t, n);
 		let i = this.unitBudgets.get(e.unit);
 		if (this.totalBudgets.length === 0 && i === void 0) return [];
 		let a = [];
@@ -8663,8 +8664,8 @@ behind quietly.` + n;
 	breaches() {
 		return this.budgetStates().filter((e) => e.status !== "ok");
 	}
-}, gh = (e) => {
-	let t = e.now ?? Date.now, n = e.log, r = /* @__PURE__ */ new Set(), i = e.discovered.map((e) => e.definition), a = new hh(i, {
+}, _h = (e) => {
+	let t = e.now ?? Date.now, n = e.log, r = /* @__PURE__ */ new Set(), i = e.discovered.map((e) => e.definition), a = new gh(i, {
 		now: t,
 		...n === void 0 ? {} : { log: n }
 	}), o = i.some((e) => e.windowMs !== null), s = (e) => {
@@ -8699,12 +8700,12 @@ behind quietly.` + n;
 		registered: i.map((e) => e.name),
 		runTick: l
 	};
-}, _h = "holdout", $ = (e, t) => /* @__PURE__ */ Error(`defineExperiment(${JSON.stringify(e)}): ${t}`), vh = (e) => {
+}, vh = "holdout", $ = (e, t) => /* @__PURE__ */ Error(`defineExperiment(${JSON.stringify(e)}): ${t}`), yh = (e) => {
 	if (e == null) return null;
 	if (typeof e == "number") return Number.isFinite(e) ? String(e) : null;
 	let t = String(e);
 	return t.length > 0 ? t : null;
-}, yh = (e) => {
+}, bh = (e) => {
 	let t = e.name;
 	if (typeof t != "string" || t.length === 0) throw Error("defineExperiment: a non-empty `name` is required");
 	if (e.on === void 0 || typeof e.on.table != "string" || e.on.table.length === 0) throw $(t, "on.table is required — the table whose writes drive the experiment");
@@ -8712,21 +8713,22 @@ behind quietly.` + n;
 	let n = e.subject !== void 0, r = e.variantFrom !== void 0;
 	if (n && r) throw $(t, "declare `subject` OR `variantFrom`, not both — they are two answers to \"which arm is this row in?\"");
 	let i = null, a = null;
-	if (r) if (typeof e.variantFrom == "string") {
-		if (e.variantFrom.length === 0) throw $(t, "variantFrom, when a column name, must be non-empty");
-		let n = e.variantFrom;
-		a = (e) => vh(e[n]);
-	} else if (typeof e.variantFrom == "function") {
-		let t = e.variantFrom;
-		a = (e) => vh(t(e));
-	} else throw $(t, "variantFrom must be a column name or a (row) => variantName function");
-	else if (typeof e.subject == "string") {
+	if (r) {
+		if (typeof e.variantFrom == "string") {
+			if (e.variantFrom.length === 0) throw $(t, "variantFrom, when a column name, must be non-empty");
+			let n = e.variantFrom;
+			a = (e) => yh(e[n]);
+		} else if (typeof e.variantFrom == "function") {
+			let t = e.variantFrom;
+			a = (e) => yh(t(e));
+		} else throw $(t, "variantFrom must be a column name or a (row) => variantName function");
+	} else if (typeof e.subject == "string") {
 		if (e.subject.length === 0) throw $(t, "subject, when a column name, must be non-empty");
 		let n = e.subject;
-		i = (e) => vh(e[n]);
+		i = (e) => yh(e[n]);
 	} else if (typeof e.subject == "function") {
 		let t = e.subject;
-		i = (e) => vh(t(e));
+		i = (e) => yh(t(e));
 	} else throw $(t, "subject is required — a column name or a (row) => key function (or use `variantFrom` to measure an arm something else assigned)");
 	if (!Array.isArray(e.variants) || e.variants.length < 2) throw $(t, "at least two variants are required (a control + one treatment)");
 	let o = /* @__PURE__ */ new Set(), s = [];
@@ -8743,9 +8745,9 @@ behind quietly.` + n;
 	}
 	let c = 0;
 	if (e.holdout !== void 0) {
-		if (a !== null && e.holdout > 0) throw $(t, `holdout is meaningless with \`variantFrom\` — a holdout is carved out AT ASSIGNMENT, and this experiment does not assign. Declare the holdout arm on whatever does (a flag variant named "${_h}", say) and list it in \`variants\`.`);
+		if (a !== null && e.holdout > 0) throw $(t, `holdout is meaningless with \`variantFrom\` — a holdout is carved out AT ASSIGNMENT, and this experiment does not assign. Declare the holdout arm on whatever does (a flag variant named "${vh}", say) and list it in \`variants\`.`);
 		if (!(typeof e.holdout == "number" && e.holdout >= 0 && e.holdout < 1)) throw $(t, "holdout, when present, must be a fraction in [0, 1)");
-		if (c = e.holdout, c > 0 && o.has("holdout")) throw $(t, `a variant may not be named ${JSON.stringify(_h)} when holdout > 0 (reserved)`);
+		if (c = e.holdout, c > 0 && o.has("holdout")) throw $(t, `a variant may not be named ${JSON.stringify(vh)} when holdout > 0 (reserved)`);
 	}
 	let l = e.metric;
 	if (l === void 0 || typeof l.kind != "string") throw $(t, "metric is required");
@@ -8777,30 +8779,30 @@ behind quietly.` + n;
 		baseline: u,
 		...e.description === void 0 ? {} : { description: e.description }
 	};
-}, bh = (e) => typeof e == "object" && !!e && e._voltroExperiment === !0, xh = (e) => {
+}, xh = (e) => typeof e == "object" && !!e && e._voltroExperiment === !0, Sh = (e) => {
 	let t = 2166136261;
 	for (let n = 0; n < e.length; n++) t ^= e.charCodeAt(n), t = Math.imul(t, 16777619);
 	return (t >>> 0) / 4294967296;
-}, Sh = (e, t) => {
-	let n = xh(`${e.name}\u0000${t}`);
-	if (e.holdout > 0 && n < e.holdout) return _h;
+}, Ch = (e, t) => {
+	let n = Sh(`${e.name}\u0000${t}`);
+	if (e.holdout > 0 && n < e.holdout) return vh;
 	let r = e.holdout > 0 ? (n - e.holdout) / (1 - e.holdout) : n, i = e.variants.reduce((e, t) => e + t.weight, 0), a = 0;
 	for (let t of e.variants) if (a += t.weight / i, r < a) return t.name;
 	return e.variants[e.variants.length - 1].name;
-}, Ch = (e) => e.holdout > 0 ? [...e.variants.map((e) => e.name), _h] : e.variants.map((e) => e.name), wh = class extends n.Tag("@voltro/ExperimentRegistry")() {}, Th = (e) => o.gen(function* () {
-	return (yield* wh).get(e.name);
-}), Eh = "__voltro_variant", Dh = "__voltro_metric", Oh = class {
+}, wh = (e) => e.holdout > 0 ? [...e.variants.map((e) => e.name), vh] : e.variants.map((e) => e.name), Th = class extends n.Tag("@voltro/ExperimentRegistry")() {}, Eh = (e) => o.gen(function* () {
+	return (yield* Th).get(e.name);
+}), Dh = "__voltro_variant", Oh = "__voltro_metric", kh = class {
 	project;
 	maintainer;
 	constructor(e, t) {
-		this.project = t, this.maintainer = new Om(e);
+		this.project = t, this.maintainer = new km(e);
 	}
 	seed(e) {
 		this.maintainer.seed(e.map((e) => this.project(e)).filter((e) => e !== null));
 	}
 	apply(e) {
 		let t = e.old ? this.project(e.old) : null, n = e.new ? this.project(e.new) : null;
-		t === null && n === null || (t === null ? this.maintainer.applyChange({
+		(t !== null || n !== null) && (t === null ? this.maintainer.applyChange({
 			op: "insert",
 			old: null,
 			new: n
@@ -8817,56 +8819,56 @@ behind quietly.` + n;
 	byVariant() {
 		let e = /* @__PURE__ */ new Map();
 		for (let t of this.maintainer.materialize()) {
-			let n = t.group[Eh];
+			let n = t.group[Dh];
 			typeof n == "string" && e.set(n, t.value);
 		}
 		return e;
 	}
-}, kh = (e) => typeof e == "number" && Number.isFinite(e), Ah = (e) => {
-	if (kh(e)) return e;
+}, Ah = (e) => typeof e == "number" && Number.isFinite(e), jh = (e) => {
+	if (Ah(e)) return e;
 	let t = Number(e);
 	return Number.isFinite(t) ? t : null;
-}, jh = (e, t) => new Oh(e.kind === "count" ? {
+}, Mh = (e, t) => new kh(e.kind === "count" ? {
 	op: "count",
-	groupBy: [Eh]
+	groupBy: [Dh]
 } : {
 	op: e.kind === "sum" ? "sum" : "avg",
-	column: Dh,
-	groupBy: [Eh]
+	column: Oh,
+	groupBy: [Dh]
 }, (n) => {
 	let r = t(n);
 	if (r === null) return null;
 	switch (e.kind) {
-		case "count": return { [Eh]: r };
+		case "count": return { [Dh]: r };
 		case "sum":
 		case "avg": {
-			let t = Ah(n[e.column]);
+			let t = jh(n[e.column]);
 			return t === null ? null : {
-				[Eh]: r,
-				[Dh]: t
+				[Dh]: r,
+				[Oh]: t
 			};
 		}
 		case "conversionRate": {
 			let t = n[e.column], i = e.equals === void 0 ? !!t : t === e.equals;
 			return {
-				[Eh]: r,
-				[Dh]: +!!i
+				[Dh]: r,
+				[Oh]: +!!i
 			};
 		}
 	}
-}), Mh = (e) => new Oh({
+}), Nh = (e) => new kh({
 	op: "count",
-	groupBy: [Eh]
+	groupBy: [Dh]
 }, (t) => {
 	let n = e(t);
-	return n === null ? null : { [Eh]: n };
-}), Nh = (e) => ({
+	return n === null ? null : { [Dh]: n };
+}), Ph = (e) => ({
 	table: e.table,
 	op: e.op,
 	traceId: e.traceId ?? null,
 	subjectId: e.subjectId ?? null,
 	procedure: e.procedure ?? null
-}), Ph = class {
+}), Fh = class {
 	def;
 	deps;
 	exposure;
@@ -8877,9 +8879,9 @@ behind quietly.` + n;
 	lastUpdatedAt = null;
 	declaredVariants;
 	constructor(e, t) {
-		this.def = e, this.deps = t, this.now = t.now ?? Date.now, this.declaredVariants = new Set(Ch(e));
+		this.def = e, this.deps = t, this.now = t.now ?? Date.now, this.declaredVariants = new Set(wh(e));
 		let n = (e) => this.variantOf(e);
-		this.exposure = Mh(n), this.metricIsCount = e.metric.kind === "count", this.metric = this.metricIsCount ? this.exposure : jh(e.metric, n);
+		this.exposure = Nh(n), this.metricIsCount = e.metric.kind === "count", this.metric = this.metricIsCount ? this.exposure : Mh(e.metric, n);
 	}
 	variantOf(e) {
 		if (e == null) return null;
@@ -8891,7 +8893,7 @@ behind quietly.` + n;
 		}
 		if (this.def.subject === null) return null;
 		let n = this.def.subject(e);
-		return n === null ? null : Sh(this.def, n);
+		return n === null ? null : Ch(this.def, n);
 	}
 	inScope(e) {
 		return this.variantOf(e) !== null;
@@ -8911,12 +8913,12 @@ behind quietly.` + n;
 		};
 		return this.exposure.apply(r), this.metricIsCount || this.metric.apply(r), this.lastUpdatedAt = new Date(this.now()), {
 			result: this.result(),
-			cause: Nh(e)
+			cause: Ph(e)
 		};
 	}
 	result() {
 		let e = this.exposure.byVariant(), t = this.metricIsCount ? e : this.metric.byVariant(), n = this.def.baseline, r = this.metricValueFor(n, t, e), i = 0, a = [];
-		for (let o of Ch(this.def)) {
+		for (let o of wh(this.def)) {
 			let s = e.get(o) ?? 0;
 			i += s;
 			let c = this.metricValueFor(o, t, e), l = o === n, u = l || c === null || r === null ? null : c - r, d = l || c === null || r === null || r === 0 ? null : (c - r) / r;
@@ -8953,7 +8955,7 @@ behind quietly.` + n;
 	get isSeeded() {
 		return this.seeded;
 	}
-}, Fh = (e) => {
+}, Ih = (e) => {
 	let t = e.now ?? Date.now, n = e.log, r = /* @__PURE__ */ new Set(), i = /* @__PURE__ */ new Map(), a = (e) => {
 		for (let t of r) try {
 			t(e);
@@ -8970,7 +8972,7 @@ behind quietly.` + n;
 	}), s = /* @__PURE__ */ new Map();
 	for (let { definition: r } of e.discovered) {
 		if (i.has(r.name)) throw Error(`experiment: duplicate name '${r.name}' — names must be unique across all experiments`);
-		let e = new Ph(r, {
+		let e = new Fh(r, {
 			queryBase: o(r.on.table),
 			now: t,
 			...n === void 0 ? {} : { log: n }
@@ -8988,7 +8990,7 @@ behind quietly.` + n;
 	})();
 	let c = e.store.onChange((e) => {
 		let t = s.get(e.table);
-		if (!(t === void 0 || t.length === 0)) for (let r of t) try {
+		if (t !== void 0 && t.length !== 0) for (let r of t) try {
 			let t = r.applyChange(e);
 			t !== null && a(t);
 		} catch (e) {
@@ -9000,7 +9002,7 @@ behind quietly.` + n;
 				await e.seed();
 			} catch {}
 		})();
-	}, e.reconcileIntervalMs ?? 5 * 6e4);
+	}, e.reconcileIntervalMs ?? 3e5);
 	return l.unref?.(), {
 		registry: {
 			snapshot: () => [...i.values()].map((e) => e.result()),
@@ -9012,21 +9014,21 @@ behind quietly.` + n;
 		},
 		registered: [...i.keys()]
 	};
-}, Ih = F("_voltro_wakeups", {
-	id: M({ prefix: "wakeup" }),
-	tenantId: I(),
-	kind: I(),
-	refId: I(),
-	wakeAt: L(),
-	status: I()
-}).index(["status", "wakeAt"]).index(["tenantId"]), Lh = async (e) => {
-	let t = e.now?.() ?? /* @__PURE__ */ new Date(), n = await Nf(e.store, t, e.batchLimit ?? 100);
+}, Lh = I("_voltro_wakeups", {
+	id: N({ prefix: "wakeup" }),
+	tenantId: L(),
+	kind: L(),
+	refId: L(),
+	wakeAt: R(),
+	status: L()
+}).index(["status", "wakeAt"]).index(["tenantId"]), Rh = async (e) => {
+	let t = e.now?.() ?? /* @__PURE__ */ new Date(), n = await Pf(e.store, t, e.batchLimit ?? 100);
 	if (n.length === 0) return 0;
 	let r = 0;
-	for (let t of n) if (await kf(e.store, t)) try {
+	for (let t of n) if (await Af(e.store, t)) try {
 		await e.adapter.wake(t), r++;
 	} catch (n) {
-		await Af(e.store, t), e.log?.warn("wake: adapter failed — released for retry", {
+		await jf(e.store, t), e.log?.warn("wake: adapter failed — released for retry", {
 			tenantId: t.tenantId,
 			kind: t.kind,
 			refId: t.refId,
@@ -9034,11 +9036,11 @@ behind quietly.` + n;
 		});
 	}
 	return r > 0 && e.log?.info("wake: woke due deployments", { count: r }), r;
-}, Rh = (e, t = 1e3) => {
+}, zh = (e, t = 1e3) => {
 	let n = !1, r, i = async () => {
 		if (!n) {
 			try {
-				await Lh(e);
+				await Rh(e);
 			} catch (t) {
 				e.log?.warn("wake: tick failed", { reason: t instanceof Error ? t.message : String(t) });
 			}
@@ -9048,10 +9050,10 @@ behind quietly.` + n;
 	return i(), { stop: () => {
 		n = !0, r !== void 0 && clearTimeout(r);
 	} };
-}, zh = (e) => ({ wake: async () => {
+}, Bh = (e) => ({ wake: async () => {
 	await e.start();
-} }), Bh = (e) => new Promise((t) => setTimeout(t, e)), Vh = (e) => {
-	let t = e.fetchImpl ?? fetch, n = e.now ?? Date.now, r = e.sleep ?? Bh, i = e.spawnImpl ?? Tn, a = e.startTimeoutMs ?? 3e4, o = e.healthPollMs ?? 200, s = e.stopSignal ?? "SIGTERM", c = e.stopGraceMs ?? 1e4, l, u, d = e.healthCheck ?? ((e) => e.ok), f = async () => {
+} }), Vh = (e) => new Promise((t) => setTimeout(t, e)), Hh = (e) => {
+	let t = e.fetchImpl ?? fetch, n = e.now ?? Date.now, r = e.sleep ?? Vh, i = e.spawnImpl ?? Tn, a = e.startTimeoutMs ?? 3e4, o = e.healthPollMs ?? 200, s = e.stopSignal ?? "SIGTERM", c = e.stopGraceMs ?? 1e4, l, u, d = e.healthCheck ?? ((e) => e.ok), f = async () => {
 		try {
 			let n = await t(e.healthUrl);
 			return d(n);
@@ -9105,11 +9107,11 @@ behind quietly.` + n;
 		},
 		stop: m
 	};
-}, Hh = async (e) => {
+}, Uh = async (e) => {
 	if (e.signals.connectedClients() > 0 || e.signals.inFlightRequests() > 0 || e.signals.activeWorkflowExecutions() > 0) return !1;
-	let t = (e.now?.() ?? /* @__PURE__ */ new Date()).getTime() + (e.wakeLookaheadMs ?? 3e4), n = await Pf(e.store);
+	let t = (e.now?.() ?? /* @__PURE__ */ new Date()).getTime() + (e.wakeLookaheadMs ?? 3e4), n = await Ff(e.store);
 	return !(n !== null && n.wakeAt.getTime() <= t);
-}, Uh = (e, t = Date.now) => {
+}, Wh = (e, t = Date.now) => {
 	let n;
 	return {
 		update: (r) => {
@@ -9121,7 +9123,7 @@ behind quietly.` + n;
 			n = void 0;
 		}
 	};
-}, Wh = () => {
+}, Gh = () => {
 	let e = 0, t = 0;
 	return {
 		onRequestStart: () => {
@@ -9139,7 +9141,7 @@ behind quietly.` + n;
 		inFlightRequests: () => e,
 		openConnections: () => t
 	};
-}, Gh = (e) => ({ run: async (t) => (e.onActivity?.(), await e.ensureAwake(), t()) }), Kh = (e, t, n, r) => new Promise((i, a) => {
+}, Kh = (e) => ({ run: async (t) => (e.onActivity?.(), await e.ensureAwake(), t()) }), qh = (e, t, n, r) => new Promise((i, a) => {
 	let o = Wt.request({
 		host: n,
 		port: r,
@@ -9150,7 +9152,7 @@ behind quietly.` + n;
 		t.writeHead(e.statusCode ?? 502, e.headers), e.pipe(t), e.on("end", i), e.on("error", a);
 	});
 	o.on("error", a), e.pipe(o);
-}), qh = (e, t, n, r, i) => new Promise((a, o) => {
+}), Jh = (e, t, n, r, i) => new Promise((a, o) => {
 	let s = Wt.request({
 		host: r,
 		port: i,
@@ -9165,21 +9167,21 @@ behind quietly.` + n;
 		};
 		t.on("close", s), r.on("close", s), r.on("error", o);
 	}), s.on("error", o), s.end();
-}), Jh = (e) => {
-	let t = Gh({
+}), Yh = (e) => {
+	let t = Kh({
 		ensureAwake: () => e.supervisor.start(),
 		...e.onActivity === void 0 ? {} : { onActivity: e.onActivity }
 	}), n = e.activity, r = Wt.createServer((r, i) => {
-		n?.onRequestStart(), i.on("close", () => n?.onRequestEnd()), t.run(() => Kh(r, i, e.targetHost, e.targetPort)).catch((t) => {
+		n?.onRequestStart(), i.on("close", () => n?.onRequestEnd()), t.run(() => qh(r, i, e.targetHost, e.targetPort)).catch((t) => {
 			e.log?.warn("wake-router: proxy failed", { reason: t instanceof Error ? t.message : String(t) }), i.headersSent || i.writeHead(502), i.end("wake/proxy failed");
 		});
 	});
 	return r.on("upgrade", (r, i, a) => {
-		n?.onConnect(), i.on("close", () => n?.onDisconnect()), t.run(() => qh(r, i, a, e.targetHost, e.targetPort)).catch((t) => {
+		n?.onConnect(), i.on("close", () => n?.onDisconnect()), t.run(() => Jh(r, i, a, e.targetHost, e.targetPort)).catch((t) => {
 			e.log?.warn("wake-router: upgrade proxy failed", { reason: t instanceof Error ? t.message : String(t) }), i.destroy();
 		});
 	}), r;
-}, Yh = async (e) => {
+}, Xh = async (e) => {
 	try {
 		return (await e.query({
 			table: "_voltro_workflow_runs",
@@ -9196,15 +9198,15 @@ behind quietly.` + n;
 	} catch {
 		return 0;
 	}
-}, Xh = async (e) => {
-	let t = zh(e.supervisor), n = await Lh({
+}, Zh = async (e) => {
+	let t = Bh(e.supervisor), n = await Rh({
 		store: e.store,
 		adapter: t,
 		...e.now === void 0 ? {} : { now: e.now },
 		...e.log === void 0 ? {} : { log: e.log }
 	});
 	n > 0 && e.idleGate.reset();
-	let r = await Hh({
+	let r = await Uh({
 		store: e.store,
 		signals: e.signals,
 		...e.wakeLookaheadMs === void 0 ? {} : { wakeLookaheadMs: e.wakeLookaheadMs },
@@ -9214,12 +9216,12 @@ behind quietly.` + n;
 		woke: n,
 		stopped: i
 	};
-}, Zh = async (e) => {
-	let t = Uh(e.idleGraceMs ?? 6e4), n = e.tickMs ?? 1e3, r = Wh(), i = 0, a = e.signals === void 0, o = e.signals ?? {
+}, Qh = async (e) => {
+	let t = Wh(e.idleGraceMs ?? 6e4), n = e.tickMs ?? 1e3, r = Gh(), i = 0, a = e.signals === void 0, o = e.signals ?? {
 		connectedClients: () => r.openConnections(),
 		inFlightRequests: () => r.inFlightRequests(),
 		activeWorkflowExecutions: () => i
-	}, s = Jh({
+	}, s = Yh({
 		supervisor: e.supervisor,
 		targetHost: e.targetHost,
 		targetPort: e.targetPort,
@@ -9235,10 +9237,10 @@ behind quietly.` + n;
 		});
 	});
 	e.log?.info("orchestrator: router listening", { port: c });
-	let l = !1, u, d = e.firedRetentionMs ?? 10 * 6e4, f = 0, p = async () => {
+	let l = !1, u, d = e.firedRetentionMs ?? 6e5, f = 0, p = async () => {
 		if (!l) {
 			try {
-				if (a && (i = await Yh(e.store)), await Xh({
+				if (a && (i = await Xh(e.store)), await Zh({
 					store: e.store,
 					supervisor: e.supervisor,
 					signals: o,
@@ -9246,7 +9248,7 @@ behind quietly.` + n;
 					...e.wakeLookaheadMs === void 0 ? {} : { wakeLookaheadMs: e.wakeLookaheadMs },
 					...e.log === void 0 ? {} : { log: e.log }
 				}), f++ % 60 == 0) {
-					let t = await If(e.store, { firedOlderThan: new Date(Date.now() - d) });
+					let t = await Lf(e.store, { firedOlderThan: new Date(Date.now() - d) });
 					t > 0 && e.log?.info("orchestrator: pruned fired wakeups", { count: t });
 				}
 			} catch (t) {
@@ -9261,14 +9263,14 @@ behind quietly.` + n;
 			l = !0, u !== void 0 && clearTimeout(u), await new Promise((e) => s.close(() => e()));
 		}
 	};
-}, Qh = (e) => e, $h = class extends y.TaggedError()("AnalyticsError", {
+}, $h = (e) => e, eg = class extends y.TaggedError()("AnalyticsError", {
 	provider: y.String,
 	operation: y.String,
 	cause: y.String
-}) {}, eg = class extends y.TaggedError()("AnalyticsCapabilityNotSupported", {
+}) {}, tg = class extends y.TaggedError()("AnalyticsCapabilityNotSupported", {
 	provider: y.String,
 	capability: y.String
-}) {}, tg = class extends n.Tag("@voltro/AnalyticsSink")() {}, ng = (e, t) => ({
+}) {}, ng = class extends n.Tag("@voltro/AnalyticsSink")() {}, rg = (e, t) => ({
 	info: e.info,
 	track: (n) => e.track(n.tenantId === void 0 ? {
 		...n,
@@ -9287,20 +9289,20 @@ behind quietly.` + n;
 		tenantId: t
 	} : n),
 	...e.mirror === void 0 ? {} : { mirror: e.mirror }
-}), rg = () => o.gen(function* () {
-	let e = yield* tg, t = yield* o.serviceOption(gt), n = h.match(t, {
+}), ig = () => o.gen(function* () {
+	let e = yield* ng, t = yield* o.serviceOption(ht), n = h.match(t, {
 		onNone: () => null,
 		onSome: (e) => e.tenantId ?? null
 	});
-	return n === null ? e : ng(e, n);
-}), ig = "noop", ag = () => {
-	let e = (e) => o.fail(new eg({
-		provider: ig,
+	return n === null ? e : rg(e, n);
+}), ag = "noop", og = () => {
+	let e = (e) => o.fail(new tg({
+		provider: ag,
 		capability: e
 	}));
 	return {
 		info: {
-			provider: ig,
+			provider: ag,
 			capabilities: {
 				track: !0,
 				aggregate: !1,
@@ -9314,8 +9316,8 @@ behind quietly.` + n;
 		timeseries: () => e("timeseries"),
 		topN: () => e("topN")
 	};
-}, og = (e) => {
-	if (e.length === 0) return ag();
+}, sg = (e) => {
+	if (e.length === 0) return og();
 	if (e.length === 1) return e[0];
 	let t = {
 		provider: "compose",
@@ -9332,7 +9334,7 @@ behind quietly.` + n;
 		discard: !0
 	}), r = (t, n) => {
 		let r = e.find((e) => e.info.capabilities[t]);
-		return r === void 0 ? o.fail(new eg({
+		return r === void 0 ? o.fail(new tg({
 			provider: "compose",
 			capability: t
 		})) : n(r);
@@ -9359,11 +9361,11 @@ behind quietly.` + n;
 		topN: (e) => r("topN", (t) => t.topN(e)),
 		...a === void 0 ? {} : { mirror: a }
 	};
-}, sg = (e) => {
+}, cg = (e) => {
 	let t = e.filter((e) => e.dispose !== void 0);
 	return {
 		kind: "compose",
-		build: (t) => og(e.map((e) => e.build(t))),
+		build: (t) => sg(e.map((e) => e.build(t))),
 		tables: e.flatMap((e) => e.tables ?? []),
 		initialize: (t) => o.forEach(e, (e) => e.initialize ? e.initialize(t) : o.void, {
 			concurrency: 1,
@@ -9374,34 +9376,34 @@ behind quietly.` + n;
 			discard: !0
 		}) } : {}
 	};
-}, cg = {
+}, lg = {
 	kind: "noop",
-	build: () => ag()
-}, lg = f.counter("voltro_analytics_mirror_forwarded_total", { description: "Reactive-table changes successfully applied to the analytics mirror." }), ug = f.counter("voltro_analytics_mirror_retries_total", { description: "Analytics-mirror write attempts that failed (each is retried until the budget runs out)." }), dg = f.counter("voltro_analytics_mirror_repair_queued_total", { description: "Analytics-mirror changes whose retries were exhausted and were queued for repair." }), fg = f.counter("voltro_analytics_mirror_dropped_total", { description: "Analytics-mirror changes provably lost (repair queue overflow)." }), pg = (e) => {
+	build: () => og()
+}, ug = f.counter("voltro_analytics_mirror_forwarded_total", { description: "Reactive-table changes successfully applied to the analytics mirror." }), dg = f.counter("voltro_analytics_mirror_retries_total", { description: "Analytics-mirror write attempts that failed (each is retried until the budget runs out)." }), fg = f.counter("voltro_analytics_mirror_repair_queued_total", { description: "Analytics-mirror changes whose retries were exhausted and were queued for repair." }), pg = f.counter("voltro_analytics_mirror_dropped_total", { description: "Analytics-mirror changes provably lost (repair queue overflow)." }), mg = (e) => {
 	o.runSync(f.increment(e));
-}, mg = (t) => e.pretty(t), hg = {
+}, hg = (t) => e.pretty(t), gg = {
 	retryAttempts: 5,
 	retryBaseDelayMs: 100,
 	retryMaxDelayMs: 3e4,
 	repairIntervalMs: 6e4,
 	repairQueueLimit: 1e4,
 	versionStateLimit: 1e5
-}, gg = (e) => {
+}, _g = (e) => {
 	let t = process.env[e];
 	if (t === void 0 || t.trim() === "") return;
 	let n = Number(t);
 	return Number.isFinite(n) && n >= 0 ? n : void 0;
-}, _g = (e) => {
-	let t = hg, n = e ?? {};
+}, vg = (e) => {
+	let t = gg, n = e ?? {};
 	return {
-		retryAttempts: Math.max(1, n.retryAttempts ?? gg("VOLTRO_ANALYTICS_MIRROR_RETRY_ATTEMPTS") ?? t.retryAttempts),
-		retryBaseDelayMs: n.retryBaseDelayMs ?? gg("VOLTRO_ANALYTICS_MIRROR_RETRY_BASE_MS") ?? t.retryBaseDelayMs,
-		retryMaxDelayMs: n.retryMaxDelayMs ?? gg("VOLTRO_ANALYTICS_MIRROR_RETRY_MAX_MS") ?? t.retryMaxDelayMs,
-		repairIntervalMs: n.repairIntervalMs ?? gg("VOLTRO_ANALYTICS_MIRROR_REPAIR_INTERVAL_MS") ?? t.repairIntervalMs,
-		repairQueueLimit: Math.max(1, n.repairQueueLimit ?? gg("VOLTRO_ANALYTICS_MIRROR_REPAIR_QUEUE_LIMIT") ?? t.repairQueueLimit),
-		versionStateLimit: Math.max(1, n.versionStateLimit ?? gg("VOLTRO_ANALYTICS_MIRROR_VERSION_STATE_LIMIT") ?? t.versionStateLimit)
-	};
-}, vg = {
+		retryAttempts: Math.max(1, n.retryAttempts ?? _g("VOLTRO_ANALYTICS_MIRROR_RETRY_ATTEMPTS") ?? t.retryAttempts),
+		retryBaseDelayMs: n.retryBaseDelayMs ?? _g("VOLTRO_ANALYTICS_MIRROR_RETRY_BASE_MS") ?? t.retryBaseDelayMs,
+		retryMaxDelayMs: n.retryMaxDelayMs ?? _g("VOLTRO_ANALYTICS_MIRROR_RETRY_MAX_MS") ?? t.retryMaxDelayMs,
+		repairIntervalMs: n.repairIntervalMs ?? _g("VOLTRO_ANALYTICS_MIRROR_REPAIR_INTERVAL_MS") ?? t.repairIntervalMs,
+		repairQueueLimit: Math.max(1, n.repairQueueLimit ?? _g("VOLTRO_ANALYTICS_MIRROR_REPAIR_QUEUE_LIMIT") ?? t.repairQueueLimit),
+		versionStateLimit: Math.max(1, n.versionStateLimit ?? _g("VOLTRO_ANALYTICS_MIRROR_VERSION_STATE_LIMIT") ?? t.versionStateLimit)
+	};
+}, yg = {
 	tables: [],
 	detach: () => {},
 	flush: () => Promise.resolve(),
@@ -9412,10 +9414,10 @@ behind quietly.` + n;
 		awaitingRepair: 0,
 		dropped: 0
 	})
-}, yg = (e, t) => `${e}\u0000${String(t)}`, bg = (e) => {
+}, bg = (e, t) => `${e}\u0000${String(t)}`, xg = (e) => {
 	let { store: t, sink: n, log: r } = e, i = n.mirror;
-	if (i === void 0 || i.tables.length === 0) return vg;
-	let s = _g(e), c = e.run ?? ((e) => o.runPromise(e)), l = i.primaryKey ?? "id", u = new Set(i.tables), d = n.info.provider, f = t.changeScope === "fleet", p = 0, m = () => {
+	if (i === void 0 || i.tables.length === 0) return yg;
+	let s = vg(e), c = e.run ?? ((e) => o.runPromise(e)), l = i.primaryKey ?? "id", u = new Set(i.tables), d = n.info.provider, f = t.changeScope === "fleet", p = 0, m = () => {
 		let e = Date.now() * 1e3;
 		return p = e > p ? e : p + 1, p;
 	}, h = /* @__PURE__ */ new Map(), g = /* @__PURE__ */ new Set(), _ = /* @__PURE__ */ new Map(), y = /* @__PURE__ */ new Set(), b = 0, x = 0, S = /* @__PURE__ */ new Map(), C = (e) => {
@@ -9435,7 +9437,7 @@ behind quietly.` + n;
 			primaryKeyValue: t.pk
 		}).pipe(o.map((e) => (n.baseline = e ?? 0, n.baseline))) : o.succeed(n.baseline);
 	}), T = (e, t, n) => n.kind === "clock" ? o.succeed(n.version) : w(e, t).pipe(o.map((e) => e + n.ordinal)), E = v.exponential(a.millis(Math.max(1, s.retryBaseDelayMs)), 2).pipe(v.either(v.spaced(a.millis(Math.max(1, s.retryMaxDelayMs)))), v.intersect(v.recurs(s.retryAttempts - 1))), ee = (e, t) => o.gen(function* () {
-		let n = yield* T(yg(e.table, e.pk), e, t.stamp);
+		let n = yield* T(bg(e.table, e.pk), e, t.stamp);
 		yield* t.kind === "upsert" ? i.upsert({
 			table: e.table,
 			row: t.row,
@@ -9446,27 +9448,27 @@ behind quietly.` + n;
 			version: n
 		});
 	}), D = (e) => e instanceof Error ? `${e.name}: ${e.message}` : String(e), te = (e, t) => ee(e, t).pipe(o.tapErrorCause(() => o.sync(() => {
-		pg(ug);
+		mg(dg);
 	})), o.retry(E), o.matchCauseEffect({
 		onSuccess: () => o.sync(() => {
-			b += 1, pg(lg);
+			b += 1, mg(ug);
 		}),
 		onFailure: (n) => o.sync(() => {
-			ne(e, t, mg(n));
+			ne(e, t, hg(n));
 		})
 	})), ne = (e, t, n) => {
-		let i = yg(e.table, e.pk);
+		let i = bg(e.table, e.pk);
 		for (r.warn("analytics-mirror: change forward failed, queued for repair", {
 			provider: d,
 			table: e.table,
 			op: t.kind,
 			attempts: s.retryAttempts,
 			err: n
-		}), _.set(i, e), pg(dg); _.size > s.repairQueueLimit;) {
+		}), _.set(i, e), mg(fg); _.size > s.repairQueueLimit;) {
 			let e = _.keys().next();
 			if (e.done === !0) break;
 			let t = _.get(e.value);
-			_.delete(e.value), x += 1, pg(fg), r.error("analytics-mirror: repair queue full — change dropped, mirror is diverged", {
+			_.delete(e.value), x += 1, mg(pg), r.error("analytics-mirror: repair queue full — change dropped, mirror is diverged", {
 				provider: d,
 				table: t?.table ?? "<unknown>",
 				limit: s.repairQueueLimit
@@ -9496,7 +9498,7 @@ behind quietly.` + n;
 			y.delete(t);
 		});
 	}, ae = (e, t) => {
-		let n = yg(e.table, e.pk);
+		let n = bg(e.table, e.pk);
 		h.set(n, t), !g.has(n) && (g.add(n), k(ie(n, e)));
 	}, A = (e) => o.tryPromise({
 		try: () => t.query({
@@ -9518,18 +9520,18 @@ behind quietly.` + n;
 			table: t.table,
 			row: r,
 			version: n
-		}), _.delete(e), b += 1, pg(lg), !0;
+		}), _.delete(e), b += 1, mg(ug), !0;
 	}).pipe(o.catchAllCause((e) => o.sync(() => (r.warn("analytics-mirror: repair pass failed, key stays queued", {
 		provider: d,
 		table: t.table,
-		err: mg(e)
+		err: hg(e)
 	}), !1)))), j = () => o.gen(function* () {
 		let e = [..._.entries()];
 		if (e.length === 0) return 0;
 		let t = 0;
 		for (let [n, r] of e) (yield* oe(n, r)) && (t += 1);
 		return t;
-	}), se = () => {
+	}), M = () => {
 		let e = 0;
 		return Promise.resolve(c(j().pipe(o.tap((t) => o.sync(() => {
 			e = t;
@@ -9537,21 +9539,21 @@ behind quietly.` + n;
 			provider: d,
 			err: D(e)
 		}), 0));
-	}, ce = s.repairIntervalMs > 0 ? setInterval(() => {
-		se();
+	}, se = s.repairIntervalMs > 0 ? setInterval(() => {
+		M();
 	}, s.repairIntervalMs) : void 0;
-	ce?.unref?.();
-	let le = (e) => {
+	se?.unref?.();
+	let ce = (e) => {
 		if (!f) return {
 			kind: "clock",
 			version: m()
 		};
-		let t = C(yg(e.table, e.pk));
+		let t = C(bg(e.table, e.pk));
 		return t.ordinal += 1, {
 			kind: "ordinal",
 			ordinal: t.ordinal
 		};
-	}, M = (e) => {
+	}, N = (e) => {
 		if (e.op === "delete") {
 			let t = e.old;
 			if (t === null) return;
@@ -9563,7 +9565,7 @@ behind quietly.` + n;
 			};
 			ae(r, {
 				kind: "remove",
-				stamp: le(r)
+				stamp: ce(r)
 			});
 			return;
 		}
@@ -9578,15 +9580,15 @@ behind quietly.` + n;
 		ae(r, {
 			kind: "upsert",
 			row: t,
-			stamp: le(r)
+			stamp: ce(r)
 		});
-	}, ue = t.onChange((e) => {
-		u.has(e.table) && M(e);
+	}, le = t.onChange((e) => {
+		u.has(e.table) && N(e);
 	});
 	return {
 		tables: i.tables,
 		detach: () => {
-			ue(), ce !== void 0 && clearInterval(ce);
+			le(), se !== void 0 && clearInterval(se);
 		},
 		flush: async () => {
 			for (let e = 0; e < 1e3; e++) {
@@ -9594,7 +9596,7 @@ behind quietly.` + n;
 				await Promise.all([...y]);
 			}
 		},
-		repair: se,
+		repair: M,
 		stats: () => ({
 			forwarded: b,
 			pending: h.size,
@@ -9602,11 +9604,11 @@ behind quietly.` + n;
 			dropped: x
 		})
 	};
-}, xg = (e) => {
+}, Sg = (e) => {
 	let t = typeof e.refresh == "string" ? { interval: e.refresh } : e.refresh, n = e.strategy ?? "replace";
 	if (n === "merge" && (e.mergeKey === void 0 || e.mergeKey.length === 0)) throw Error(`defineAggregate("${e.name}"): strategy: 'merge' requires mergeKey — the property on each row to upsert by`);
 	if (e.incremental !== void 0) {
-		let t = ym({
+		let t = bm({
 			aggregations: [{
 				op: e.incremental.op,
 				...e.incremental.column === void 0 ? {} : { column: e.incremental.column }
@@ -9628,46 +9630,46 @@ behind quietly.` + n;
 		build: e.build,
 		...e.incremental === void 0 ? {} : { incremental: e.incremental }
 	};
-}, Sg = (e) => typeof e == "object" && !!e && e._voltroAggregate === !0, Cg = class extends y.TaggedError()("AggregateStale", {
+}, Cg = (e) => typeof e == "object" && !!e && e._voltroAggregate === !0, wg = class extends y.TaggedError()("AggregateStale", {
 	name: y.String,
 	ageMs: y.Number,
 	maxAgeMs: y.Number
-}) {}, wg = class extends y.TaggedError()("AggregateNotFound", { name: y.String }) {}, Tg = class extends y.TaggedError()("AggregateError", {
+}) {}, Tg = class extends y.TaggedError()("AggregateNotFound", { name: y.String }) {}, Eg = class extends y.TaggedError()("AggregateError", {
 	name: y.String,
 	operation: y.String,
 	cause: y.String
-}) {}, Eg = class extends n.Tag("@voltro/AggregateRegistry")() {}, Dg = (e) => o.gen(function* () {
-	return (yield* Eg).getHandle(e);
-}), Og = (e, t, n) => {
+}) {}, Dg = class extends n.Tag("@voltro/AggregateRegistry")() {}, Og = (e) => o.gen(function* () {
+	return (yield* Dg).getHandle(e);
+}), kg = (e, t, n) => {
 	if (e.crossTenant || !t.has(e.table) || n == null) return e;
 	let r = O("tenantId", n);
 	return {
 		...e,
 		predicate: e.predicate ? C(e.predicate, r) : r
 	};
-}, kg = (e, t, n) => n === "" && !e.crossTenant && t.has(e.table), Ag = (e) => e?.type === "user" && e.tenantId === "", jg = (e, t) => {
+}, Ag = (e, t, n) => n === "" && !e.crossTenant && t.has(e.table), jg = (e) => e?.type === "user" && e.tenantId === "", Mg = (e, t) => {
 	if (e.includeDeleted || !t.has(e.table)) return e;
-	let n = fe("deletedAt");
+	let n = de("deletedAt");
 	return {
 		...e,
 		predicate: e.predicate ? C(e.predicate, n) : n
 	};
-}, Mg = (e) => (t, n) => {
+}, Ng = (e) => (t, n) => {
 	e.observe?.beforeScope?.({ ...t }, n);
-	let r = jg(Og(t, e.tenantScopedTables, n.tenantId), e.softDeleteScopedTables);
+	let r = Mg(kg(t, e.tenantScopedTables, n.tenantId), e.softDeleteScopedTables);
 	return e.observe?.afterScope?.({ ...r }), r;
-}, Ng = (e, t) => t, Pg = (t) => o.runPromiseExit(t).then((t) => {
+}, Pg = (e, t) => t, Fg = (t) => o.runPromiseExit(t).then((t) => {
 	if (c.isSuccess(t)) return t.value;
 	let n = e.failureOption(t.cause);
 	throw h.isSome(n) ? n.value : e.squash(t.cause);
-}), Fg = (e, t) => e.pipe(o.provideService(gt, t)), Ig = async (e, t, n, r) => {
-	let i = await o.runPromise(z(t, e.guards, n, {
+}), Ig = (e, t) => e.pipe(o.provideService(ht, t)), Lg = async (e, t, n, r) => {
+	let i = await o.runPromise(xt(t, e.guards, n, {
 		defaultDeny: r === !0,
 		procedure: e.name
 	}));
 	if (i) throw i;
-}, Lg = async (e, t, n, r) => {
-	e.requiresApproval !== void 0 && await em({
+}, Rg = async (e, t, n, r) => {
+	e.requiresApproval !== void 0 && await tm({
 		procedure: e.name,
 		kind: t,
 		policy: e.requiresApproval,
@@ -9675,16 +9677,16 @@ behind quietly.` + n;
 		input: r,
 		traceId: n.traceId
 	});
-}, Rg = async (e) => {
+}, zg = async (e) => {
 	if (mi() === void 0) return e;
-	let t = await Pg(_i(e.subject, (e) => {
+	let t = await Fg(_i(e.subject, (e) => {
 		console.error("[voltro] row filter failed to load", e);
 	}));
 	return {
 		...e,
 		rowFilter: t
 	};
-}, zg = (e) => {
+}, Bg = (e) => {
 	let t = e.descriptor.target;
 	if (t == null) return [];
 	let n = Array.isArray(t) ? t : [t], r = /* @__PURE__ */ new Set();
@@ -9693,7 +9695,7 @@ behind quietly.` + n;
 		typeof t == "string" && t.length > 0 && r.add(t);
 	}
 	return [...r];
-}, Bg = async (t) => {
+}, Vg = async (t) => {
 	let n = `${t.kind}.${t.name}`, r = Date.now(), i = "ok";
 	try {
 		if (t.interceptor) {
@@ -9723,46 +9725,46 @@ behind quietly.` + n;
 			status: i
 		});
 	}
-}, Vg = /* @__PURE__ */ new Set([1213, 1205]), Hg = /* @__PURE__ */ new Set([
+}, Hg = /* @__PURE__ */ new Set([1213, 1205]), Ug = /* @__PURE__ */ new Set([
 	"ER_LOCK_DEADLOCK",
 	"ER_LOCK_WAIT_TIMEOUT",
 	"40001",
 	"40P01"
-]), Ug = (e) => {
+]), Wg = (e) => {
 	let t = e;
 	for (let e = 0; e < 6 && typeof t == "object" && t; e++) {
 		let e = t;
-		if (typeof e.errno == "number" && Vg.has(e.errno) || typeof e.code == "string" && Hg.has(e.code) || typeof e.sqlState == "string" && Hg.has(e.sqlState)) return !0;
+		if (typeof e.errno == "number" && Hg.has(e.errno) || typeof e.code == "string" && Ug.has(e.code) || typeof e.sqlState == "string" && Ug.has(e.sqlState)) return !0;
 		t = e.cause;
 	}
 	return !1;
-}, Wg = 3, Gg = (e) => new Promise((t) => setTimeout(t, e)), Kg = async (e, t) => {
-	let n = t?.delay ?? ((e) => Gg(e * 20 + Math.floor(Math.random() * 30)));
+}, Gg = 3, Kg = (e) => new Promise((t) => setTimeout(t, e)), qg = async (e, t) => {
+	let n = t?.delay ?? ((e) => Kg(e * 20 + Math.floor(Math.random() * 30)));
 	for (let t = 1;; t++) try {
 		return await e();
 	} catch (e) {
-		if (t >= Wg || !Ug(e)) throw e;
+		if (t >= Gg || !Wg(e)) throw e;
 		await n(t);
 	}
-}, qg = (e) => (t, n, r) => Bg({
+}, Jg = (e) => (t, n, r) => Vg({
 	name: t.descriptor.name,
 	kind: "mutation",
 	input: n,
 	requestContext: r,
-	target: zg(t),
+	target: Bg(t),
 	...e.interceptor ? { interceptor: e.interceptor } : {},
 	...e.recordMetric ? { recordMetric: e.recordMetric } : {},
 	runExecutor: async () => {
-		await Ig(t.descriptor, r.subject, n, e.defaultDeny), await Lg(t.descriptor, "mutation", r, n);
-		let i = await Rg(r), a = [], s = await Kg(async () => (a.length = 0, e.store.transactional(async (s) => {
-			let c = e.undoCapture?.(s), l = fp(c ? c.tx : s), u = e.buildContext(i, l.tx, { afterCommit: (e) => {
+		await Lg(t.descriptor, r.subject, n, e.defaultDeny), await Rg(t.descriptor, "mutation", r, n);
+		let i = await zg(r), a = [], s = await qg(async () => (a.length = 0, e.store.transactional(async (s) => {
+			let c = e.undoCapture?.(s), l = pp(c ? c.tx : s), u = e.buildContext(i, l.tx, { afterCommit: (e) => {
 				a.push(e);
-			} }), d = t.executor(n, u), f = o.isEffect(d) ? await e.runEffect(Fg(d, r.subject), u.store) : await d;
+			} }), d = t.executor(n, u), f = o.isEffect(d) ? await e.runEffect(Ig(d, r.subject), u.store) : await d;
 			return c && await c.persist(u.store, {
 				tag: t.descriptor.name,
 				subject: r.subject,
 				traceId: r.traceId
-			}), await mp({
+			}), await hp({
 				touched: l.drain(),
 				store: u.store,
 				subject: r.subject
@@ -9771,40 +9773,40 @@ behind quietly.` + n;
 		for (let e of a) await e();
 		return s;
 	}
-}), Jg = (e) => e && typeof e == "object" && "descriptor" in e ? e.descriptor : e, Yg = (e) => typeof e == "object" && !!e && !Array.isArray(e) && "table" in e && "order" in e, Xg = (e) => {
+}), Yg = (e) => e && typeof e == "object" && "descriptor" in e ? e.descriptor : e, Xg = (e) => typeof e == "object" && !!e && !Array.isArray(e) && "table" in e && "order" in e, Zg = (e) => {
 	let t = e.descriptor.source;
 	return t == null ? [] : typeof t == "string" ? [t] : [...t];
-}, Zg = (e, t, n) => (r) => () => {
+}, Qg = (e, t, n) => (r) => () => {
 	let i = e.descriptor.guards;
-	return (!i || i.length === 0) && n !== !0 ? Promise.resolve(null) : o.runPromise(z(r, i, t, {
+	return (!i || i.length === 0) && n !== !0 ? Promise.resolve(null) : o.runPromise(xt(r, i, t, {
 		defaultDeny: n === !0,
 		procedure: e.descriptor.name
 	}));
-}, Qg = (e, t) => e.rowFilter !== void 0 || mi() === void 0 ? t(e) : o.promise(() => Rg(e)).pipe(o.flatMap((e) => {
+}, $g = (e, t) => e.rowFilter !== void 0 || mi() === void 0 ? t(e) : o.promise(() => zg(e)).pipe(o.flatMap((e) => {
 	let n = t(e);
 	return o.isEffect(n) ? n : o.succeed(n);
-})), $g = (e) => (t, n) => (r) => {
-	if (r.rowFilter === void 0 && mi() !== void 0) return Qg(r, (r) => $g(e)(t, n)(r));
-	let i = e.buildContext(r), a = Zg(t, n, e.defaultDeny)(r.subject), s = async () => {
+})), e_ = (e) => (t, n) => (r) => {
+	if (r.rowFilter === void 0 && mi() !== void 0) return $g(r, (r) => e_(e)(t, n)(r));
+	let i = e.buildContext(r), a = Qg(t, n, e.defaultDeny)(r.subject), s = async () => {
 		let i = await a();
 		if (i) throw i;
-		let s = e.buildContext(await Rg(r)), c = t.executor(n, s);
-		return o.isEffect(c) ? o.runPromise(e.provideEffect(Fg(c, r.subject), s.store)) : Jg(await Promise.resolve(c));
+		let s = e.buildContext(await zg(r)), c = t.executor(n, s);
+		return o.isEffect(c) ? o.runPromise(e.provideEffect(Ig(c, r.subject), s.store)) : Yg(await Promise.resolve(c));
 	}, c = (n) => {
-		let i = Jg(n);
-		return Yg(i) ? e.finalize(i, r) : {
+		let i = Yg(n);
+		return Xg(i) ? e.finalize(i, r) : {
 			__voltroComputed: !0,
 			value: i,
-			dependentTables: Xg(t),
+			dependentTables: Zg(t),
 			tenantId: r.subject?.tenantId ?? null,
 			recompute: s
 		};
 	}, l = () => {
 		let a = t.executor(n, i);
-		return o.isEffect(a) ? e.provideEffect(Fg(a, r.subject), i.store).pipe(o.map(c)) : a instanceof Promise ? o.promise(() => a).pipe(o.map(c)) : c(a);
+		return o.isEffect(a) ? e.provideEffect(Ig(a, r.subject), i.store).pipe(o.map(c)) : a instanceof Promise ? o.promise(() => a).pipe(o.map(c)) : c(a);
 	}, u = () => {
 		let i = t.descriptor.guards;
-		return (!i || i.length === 0) && e.defaultDeny !== !0 ? l() : z(r.subject, i, n, {
+		return (!i || i.length === 0) && e.defaultDeny !== !0 ? l() : xt(r.subject, i, n, {
 			defaultDeny: e.defaultDeny === !0,
 			procedure: t.descriptor.name
 		}).pipe(o.flatMap((e) => {
@@ -9826,14 +9828,14 @@ behind quietly.` + n;
 		traceId: r.traceId,
 		...r.spanId === void 0 ? {} : { spanId: r.spanId }
 	});
-}, e_ = (e) => async (t, n, r) => {
-	let i = await Rg(r), a = $g(e)(t, n)(i), s = o.isEffect(a) ? await Pg(a) : a;
+}, t_ = (e) => async (t, n, r) => {
+	let i = await zg(r), a = e_(e)(t, n)(i), s = o.isEffect(a) ? await Fg(a) : a;
 	return Mi(s) ? s.value : e.queryRows(s, i);
-}, t_ = (e) => (t, n, r, i) => {
+}, n_ = (e) => (t, n, r, i) => {
 	let a = !1, s;
 	return (async () => {
 		try {
-			let c = await Rg(r), l = $g(e)(t, n)(c), u = o.isEffect(l) ? await Pg(l) : l, d = (e) => i(e), f = Mi(u) ? await e.subscribeComputed(u, d, c) : await e.subscribeDescriptor(u, d, c);
+			let c = await zg(r), l = e_(e)(t, n)(c), u = o.isEffect(l) ? await Fg(l) : l, d = (e) => i(e), f = Mi(u) ? await e.subscribeComputed(u, d, c) : await e.subscribeDescriptor(u, d, c);
 			a ? f() : s = f;
 		} catch (e) {
 			i({
@@ -9844,25 +9846,25 @@ behind quietly.` + n;
 	})(), () => {
 		a = !0, s?.();
 	};
-}, n_ = (e) => (t, n, r) => Bg({
+}, r_ = (e) => (t, n, r) => Vg({
 	name: t.descriptor.name,
 	kind: "action",
 	input: n,
 	requestContext: r,
-	target: zg(t),
+	target: Bg(t),
 	...e.interceptor ? { interceptor: e.interceptor } : {},
 	...e.recordMetric ? { recordMetric: e.recordMetric } : {},
 	runExecutor: async () => {
-		await Ig(t.descriptor, r.subject, n, e.defaultDeny), await Lg(t.descriptor, "action", r, n);
-		let i = e.buildContext(await Rg(r)), a = t.executor(n, i);
-		return o.isEffect(a) ? e.runEffect(Fg(a, r.subject), i.store) : a;
+		await Lg(t.descriptor, r.subject, n, e.defaultDeny), await Rg(t.descriptor, "action", r, n);
+		let i = e.buildContext(await zg(r)), a = t.executor(n, i);
+		return o.isEffect(a) ? e.runEffect(Ig(a, r.subject), i.store) : a;
 	}
-}), r_ = (e) => e instanceof Date ? e.toISOString() : typeof e == "string" && e.length > 0 ? e : null, i_ = (e) => typeof e == "string" && e.length > 0 ? e : null, a_ = [
+}), i_ = (e) => e instanceof Date ? e.toISOString() : typeof e == "string" && e.length > 0 ? e : null, a_ = (e) => typeof e == "string" && e.length > 0 ? e : null, o_ = [
 	"updatedAt",
 	"createdAt",
 	"updatedBy",
 	"createdBy"
-], o_ = (e) => a_.some((t) => t in e), s_ = (e, t, n) => {
+], s_ = (e) => o_.some((t) => t in e), c_ = (e, t, n) => {
 	let r = {
 		table: t.table,
 		id: t.id,
@@ -9877,14 +9879,14 @@ behind quietly.` + n;
 		found: !1
 	};
 	let i = t.column === void 0 ? void 0 : e[t.column];
-	if (!o_(e)) return {
+	if (!s_(e)) return {
 		...r,
 		value: i,
 		lastWrite: null,
 		attribution: "none",
 		found: !0
 	};
-	let a = i_(e.updatedBy) ?? i_(e.createdBy), o = r_(e.updatedAt) ?? r_(e.createdAt);
+	let a = a_(e.updatedBy) ?? a_(e.createdBy), o = i_(e.updatedAt) ?? i_(e.createdAt);
 	return {
 		...r,
 		value: i,
@@ -9896,12 +9898,12 @@ behind quietly.` + n;
 		attribution: "audit",
 		found: !0
 	};
-}, c_ = (e, t) => {
+}, l_ = (e, t) => {
 	let n = e.map((e) => {
 		let n = e.newValue ?? e.value, r = t.column !== void 0 && n && typeof n == "object" ? n[t.column] : e.newValue ?? e.value;
 		return {
-			actor: { id: i_(e.actor) ?? i_(e.changedBy) },
-			at: r_(e.at) ?? r_(e.changedAt),
+			actor: { id: a_(e.actor) ?? a_(e.changedBy) },
+			at: i_(e.at) ?? i_(e.changedAt),
 			...e.traceId === void 0 ? {} : { traceId: e.traceId },
 			value: r
 		};
@@ -9916,12 +9918,12 @@ behind quietly.` + n;
 		history: n,
 		found: n.length > 0
 	};
-}, l_ = (e) => {
+}, u_ = (e) => {
 	let t = e.new?.id;
 	if (typeof t == "string") return t;
 	let n = e.old?.id;
 	return typeof n == "string" ? n : void 0;
-}, u_ = (e) => {
+}, d_ = (e) => {
 	let t = {};
 	if (e.op === "insert") for (let [n, r] of Object.entries(e.new ?? {})) t[n] = {
 		from: void 0,
@@ -9941,11 +9943,11 @@ behind quietly.` + n;
 	return {
 		table: e.table,
 		op: e.op,
-		id: l_(e),
+		id: u_(e),
 		fields: t
 	};
-}, d_ = (e) => {
-	let t = e.map(u_);
+}, f_ = (e) => {
+	let t = e.map(d_);
 	return {
 		rows: t,
 		summary: {
@@ -9954,21 +9956,21 @@ behind quietly.` + n;
 			deletes: t.filter((e) => e.op === "delete").length
 		}
 	};
-}, f_ = class extends Error {
+}, p_ = class extends Error {
 	constructor() {
 		super("voltro:preview-rollback"), this.name = "PreviewRollback";
 	}
-}, p_ = async (e, t) => {
+}, m_ = async (e, t) => {
 	let n, r = !1;
 	try {
 		await e.transactional(async (e) => {
-			throw n = await t(e), r = !0, new f_();
+			throw n = await t(e), r = !0, new p_();
 		});
 	} catch (e) {
-		if (!(e instanceof f_)) throw e;
+		if (!(e instanceof p_)) throw e;
 	}
 	if (!r) throw Error("preview: handler did not complete");
 	return n;
-}, m_ = "framework-runtime";
+}, h_ = "framework-runtime";
 //#endregion
-export { Ao as API_CSP, fc as API_KEYS_TABLE, Np as APPROVALS_TABLE, Hu as AccessDenied, Tg as AggregateError, Om as AggregateMaintainer, wg as AggregateNotFound, Eg as AggregateRegistry, Cg as AggregateStale, eg as AnalyticsCapabilityNotSupported, $h as AnalyticsError, tg as AnalyticsSink, Hf as CLAIM_RETENTION_BUCKETS, Y as CONNECTIONS_TABLE, Vl as CONNECTION_GRANTS_TABLE, of as CircuitBreaker, rf as CircuitOpen, uu as ConnectionNotConnected, hh as CostAccountant, ch as CostRegistry, hg as DEFAULT_ANALYTICS_MIRROR_TUNABLES, Pp as DEFAULT_APPROVAL_EXPIRY_MS, Vf as DEFAULT_CLAIM_BUCKET_MS, $n as DEFAULT_DELIVERY_CONCURRENCY, Mo as DEFAULT_HSTS, Yf as DEFAULT_MAX_IDLE_INTERVAL_MS, _s as DEFAULT_MAX_RPC_BODY_BYTES, er as DEFAULT_RAW_READ_TRACKING_LIMIT, cu as DEFAULT_REFRESH_SKEW_MS, li as DEFAULT_ROW_FILTER_RETRY, Rf as DORMANCY_WAKEUP_TENANT, ja as DeleteBuilder, ki as Dispatcher, hl as EVENT_CLIENT_QUEUE_SIZE, gl as EVENT_LATEST_QUEUE_SIZE, Dc as EffectStore, ul as EventBus, eh as ExpectationEvaluator, Wm as ExpectationRegistry, Ph as ExperimentEvaluator, wh as ExperimentRegistry, Su as GRANT_TTL_MS, _h as HOLDOUT_VARIANT, jo as HTML_CSP, qn as InMemoryDataStore, Pn as IndexedMatcher, Sl as InstanceMembership, Dn as LinearScanMatcher, p as MetricBoundaries, ig as NOOP_ANALYTICS_PROVIDER, gi as NO_ROW_FILTER, vo as NO_TRUSTED_PROXIES, wa as NoRowFound, El as OUTBOX_ATTEMPTS_TABLE, Nl as OUTBOX_ATTEMPT_LOG_CAP, J as OUTBOX_TABLE, Ta as OptimisticLockError, Vu as REBAC_ADMIN_SCOPE, lu as REFRESH_LEASE_MS, m_ as RUNTIME_NAME, Rm as ReactionRateLimiter, eo as ReplicatedDataStore, ci as RowFilterUnavailable, Lf as SCHEDULE_SUBJECT, Ec as SYSTEM_SUBJECT, ka as SelectBuilder, La as ServerOnlyColumnWrite, pd as SsrfBlockedError, Pa as StoreOperationFailed, Ln as SubscriptionRegistry, Fa as TableValidationFailed, Ia as TenantRowNotFound, Na as TenantScopeViolation, pm as TimelineRecorder, vp as UndoBoundaryError, bp as UndoStack, Bo as UnverifiedWebhookRoute, Aa as UpdateBuilder, bd as VOLTRO_AUDIT_MIXIN_ID, Sd as VOLTRO_EXPIRES_MIXIN_ID, wd as VOLTRO_LOCAL_FIRST_MIXIN_ID, xd as VOLTRO_SOFT_DELETE_MIXIN_ID, Cd as VOLTRO_TENANT_MIXIN_ID, Lo as WEBHOOK_VERIFICATION_PROPERTY, Pc as WorkflowDeferredResultError, Hc as WorkflowPayloadError, Fc as WorkflowRateLimitedError, Ic as WorkflowSingletonHeldError, qi as _connectionStreamCount, Ji as _resetConnectionCredentialsForTest, Fp as _voltroApprovalsTable, Ul as _voltroConnectionGrantsTable, Bl as _voltroConnectionsTable, km as _voltroRebacTuplesTable, tp as _voltroScheduleClaimsTable, ep as _voltroScheduleRunsTable, np as _voltroTracesTable, rp as _voltroUndoLogTable, Ih as _voltroWakeupsTable, il as _voltroWorkflowEventDeliveriesTable, rl as _voltroWorkflowEventsTable, Ua as actingUserId, Tc as apiKeyManagementRoutes, Ui as applyConnectionCredential, Ba as applyDefined, Em as applyDelta, Sp as applyInverse, Cp as applyInverses, tf as applyPluginRefRules, bi as applyRowFilter, xi as applyRowFilterToDescriptor, jg as applySoftDeleteScope, Og as applyTenantScope, jp as applyUndoInvocation, Vp as approvalIntentKey, rm as approvalNonce, am as approvalsPendingExecutor, Qu as assertCan, ql as assertConnectionCipherConfigured, Vo as assertWebhookRoutesDeclareVerification, Sh as assignVariant, bg as attachAnalyticsMirror, th as attachExpectations, Fh as attachExperiments, gh as attachFinops, ks as awaitServerListening, Ml as backoffMs, Eu as beginOAuthConnect, zi as bindConnectionCredential, yl as bindEvent, gs as bindMutation, rs as bindStream, ns as bindSubscription, Zo as bindSubscriptionUntyped, wm as buildIvmState, d_ as buildPreview, Mm as buildRebacInterceptor, Pm as buildRebacReadFilter, Ja as buildSubjectKey, Is as buildTracingLayer, Gd as cacheScopeLeaks, Zs as cachedBackend, Zu as can, Ef as cancelWakeup, Bp as canonicalJson, Fn as canonicalize, Uf as claimGraceMs, go as classifyRequestOrigin, ym as classifyShape, $p as clearApprovalGate, mu as clearConnectionRefreshFlights, qu as clearResourcePolicies, ee as clearRetentions, lf as clearSystemStoreHandle, nf as collectPluginRefRules, bf as compileCron, Du as completeOAuthConnect, sg as composeAnalytics, og as composeAnalyticsSinks, Cu as connectionCallbackPath, Kl as connectionLabel, Yh as countRunningWorkflows, ni as counter, Sf as cronOccurrences, Bd as crud, or as currentRawReads, rd as currentRequestLoader, $a as currentRoutingContext, ta as currentTraceContext, Sc as dataStoreApiKeyStore, ic as dataStoreIdempotencyStore, lc as dataStoreKvStore, tm as decideApproval, om as decideApprovalInvocation, da as decryptField, fs as defectMessage, xg as defineAggregate, Gl as defineConnection, oh as defineCostBudget, Qc as defineEventTrigger, Ng as defineExecutor, Hm as defineExpectation, yh as defineExperiment, kl as defineOutboxHandler, Fm as defineReaction, Wu as defineResourcePolicy, yf as defineSchedule, Qh as defineSubscriber, Di as deliveredRowCount, ia as deriveKey, u_ as diffChange, Ds as drainForShutdown, Ll as drainOutbox, Nf as dueWakeups, Xu as effectiveRelations, Ad as emptySchemaRegistry, _a as enableGraphObservation, ua as encryptField, em as enforceApproval, nd as enterRequestLoader, Gs as envSecretsBackend, mp as evaluateTouchedRules, Wr as eventMetricTagCacheSizeForTests, ou as exchangeAuthorizationCode, Qi as externalSpanFromTraceparent, Yn as extractDbCause, In as fingerprintFor, Ti as forbiddenColumnsForSubject, nu as forgetCredential, Kd as formatCacheScopeLeaks, Wd as formatServerOnlyLeaks, Xi as formatTraceparent, Yd as formatUnresolvedSources, xp as forwardChangeFromCdc, Cc as frameworkApiKeyStrategy, ri as gauge, mc as generateApiKeyToken, Qp as getApprovalGate, Bi as getConnectionCredential, ju as getConnectionResolver, Ri as getCredentialExpiry, K as getFieldCipher, Gu as getResourcePolicy, mi as getRowFilter, uf as getSystemStoreHandle, hm as getTimelineRecorder, cd as getTupleSource, xm as groupKeyOf, xh as hashUnitInterval, ii as histogramMetric, c_ as historyProvenance, Qs as httpSecretsBackend, Cn as inspectWorkflow, Zp as installApprovalGate, ld as installPolicyGuardResolver, Ki as interruptConnectionStreams, gp as invertChange, So as ipToBytes, Sg as isAggregateDefinition, sh as isCostBudgetDefinition, kg as isEmptyTenantScopedRead, Um as isExpectationDefinition, bh as isExperimentDefinition, Xn as isForeignKeyViolation, Hh as isIdleNow, ls as isInfraError, va as isObservingGraph, Ag as isOrglessUserSubject, Zn as isQueryTimeout, yp as isSafeToApply, _f as isScheduleDefinition, $d as isSoftDelete, ao as isStateChangingMethod, Eo as isTrustedProxy, $c as isWorkflowEventTriggerDefinition, ir as isolateRawReadScope, Cm as ivmValue, s_ as lastWriteProvenance, ru as listConnectionStates, Ku as listResourcePolicies, me as listRetentionConflicts, he as listRetentions, Am as loadResourceTuples, Nm as loadSubjectTuples, pf as localityAwareSelector, n_ as makeActionRunner, Wf as makeAdvisoryLockCoordinator, aa as makeAesCipher, _c as makeApiKeyService, yd as makeApiKeyUsageBuffer, xc as makeApiKeyUsageFlusher, Qn as makeAppAccess, Yp as makeApprovalGate, uc as makeAsyncKv, ff as makeAuthMiddlewareLayers, vl as makeBufferGapDetector, Ws as makeBufferingSpanProcessor, Jl as makeConnectionRegistry, Nu as makeConnectionResolver, Pu as makeConnectionsFacade, $f as makeCoordinatedScheduler, dd as makeDataLoader, Bu as makeDisconnectConnectionExecutor, Ac as makeEffectStoreLayer, ml as makeEventPublisher, al as makeEventsFacade, oa as makeFieldCipher, Ma as makeFluentStore, Uh as makeIdleGate, Jc as makeLazyWorkflowFacade, Lu as makeListConnectionsExecutor, ms as makeMutationOutputCodec, qg as makeMutationRunner, e_ as makeOneShotQueryRunner, co as makeOriginGuardExemption, jl as makeOutboxFacade, Kc as makePostCommitWorkflowFacade, zh as makeProcessAdapter, $g as makeQueryDescriptorProducer, Mg as makeQueryFinalizer, Zg as makeQueryReauthorizer, t_ as makeQuerySubscriber, Wh as makeRouterActivity, fp as makeRuleCapture, Td as makeSchemaRegistry, Ru as makeStartConnectionExecutor, zu as makeSubmitTokenExecutor, lp as makeUndoCapture, Gh as makeWakeGate, Jh as makeWakeProxyServer, Gc as makeWorkflowFacade, qc as makeWorkflowFacadeWithCallerContext, Yc as makeWorkflowHandlers, Xc as makeWorkflowLayers, Rc as makeWorkflowRunHandle, Df as markWakeupFired, Tm as materializeIvm, vc as memoryApiKeyStore, hf as memoryReplicationAdapter, qa as memoryRywPositionStore, Hi as mergeCookieHeader, Qf as nextDelay, xf as nextFiring, Pf as nextWakeup, Vh as nodeProcessSupervisor, ag as noopAnalytics, cg as noopAnalyticsSpec, dc as noopKv, yo as normalizeIp, uo as normalizeOrigin, Ca as observeStore, xa as observedGraph, Ss as onProcessShutdown, Ns as otelImportFailure, Ol as outboxAttemptsTable, Tl as outboxTable, Jp as parseApprovalInterval, Zi as parseTraceparent, Uc as payloadPropertyNames, nm as pendingApprovalsFor, Ga as powerOfTwoSelector, p_ as previewInRollback, Ql as projectConnectionState, If as pruneWakeups, fl as publishEvent, cr as rawSqlPreview, Xf as readPollCeilingMs, Ju as rebacPolicyGraph, Li as recordCredentialExpiry, Kr as recordEventDelivered, qr as recordEventDropped, Gr as recordEventPublished, Jr as recordEventSubscribers, ar as recordRawRead, Yr as recordSample, ei as recordScheduleRun, $r as recordSubscriptionActive, Zr as recordSubscriptionDelivery, ba as recordTableAccess, _m as recordTimelineEvent, ti as recordWorkflowRun, Id as redactColumns, um as redactRow, Ya as redisRywPositionStore, Mp as redoUndoInvocation, su as refreshAccessToken, Gi as registerConnectionStream, Ee as registerRetention, Tf as registerWakeup, Rp as rehydrateGuards, Af as releaseWakeup, Ka as replicaHealth, $o as resetComputedQueryCacheWarnings, Ur as resetEventMetricTagCacheForTests, Sa as resetObservedGraph, Js as resetSecretsBackend, Oo as resolveClientAddress, _u as resolveConnection, Mu as resolveConnectionForSubject, mf as resolveCurrentRegion, lr as resolveDependentTables, _o as resolveOriginGuardConfig, nr as resolveReactiveConfig, Tu as resolveRedirectUri, ko as resolveRequestIsHttps, Dm as resolveRescan, _i as resolveRowFilterScope, vi as resolveRowFilterScopeFor, Ys as resolveSecret, Xs as resolveSecretSync, $s as resolveSecretsBackend, Fo as resolveSecurityHeaders, sm as resolveTimelineMode, Do as resolveTrustedProxies, Ch as resultVariantNames, ke as retentionTtlMsFromEnv, fm as reverseEventOverRows, ed as revokedIds, hi as rowFilterRegistered, ef as rulesFor, df as runAsSystem, Xh as runOrchestratorTick, Pg as runProvidedEffect, Bm as runReaction, Zh as runSingleNodeOrchestrator, Rh as runWakeLoop, Kg as runWithDeadlockRetry, ya as runWithObservedProcedure, sr as runWithRawReadScope, id as runWithRequestLoader, Qa as runWithRoutingContext, ea as runWithTraceContext, wu as sanitizeRedirectTo, Zf as scheduleCoordinated, Vd as schemaPropertyNames, zp as scopeStringsOf, Io as securityHeadersFor, Lp as serializeGuards, Si as serverOnlyColumnNames, Ud as serverOnlyLeaks, Au as setConnectionResolver, ca as setFieldCipher, pi as setRowFilter, qs as setSecretsBackend, cf as setSystemStoreHandle, gm as setTimelineRecorderForTest, sd as setTupleSource, En as settleHandlerBody, pc as sha256Hex, Es as shutdownGraceMsFromEnv, zf as singleCoordinator, oi as snapshotMetrics, si as snapshotMetricsSync, vd as ssrfGuardHttpClientLayer, _d as ssrfReason, vs as startRpcServer, Kf as startScheduler, eu as storeCredential, Ci as stripColumnsFromRows, Ei as stripForbiddenForWire, wi as stripServerOnlyForWire, Ou as sweepExpiredGrants, Le as sweepRetention, _p as synthesizeInverse, fd as tracingHttpClientLayer, Zc as triggerWorkflow, kf as tryClaimWakeup, Vi as unbindConnection, ip as undoCaptureEnabled, kp as undoLogExecutor, ap as undoSurfaceEnabled, Jd as unresolvedSources, Dg as useAggregate, rg as useAnalytics, lh as useCostBudget, Gm as useExpectation, Th as useExperiment, $u as visibleRows, Lh as wakeDueOnce, zo as webhookVerificationOf, Rg as withRowFilter, Qg as withScopedRequest, jc as workflowToRpc, cp as wrapCaptureStore, Md as wrapStoreWithBootCodec, Wa as wrapStoreWithMixinBehaviour };
+export { Ao as API_CSP, fc as API_KEYS_TABLE, Pp as APPROVALS_TABLE, Hu as AccessDenied, Eg as AggregateError, km as AggregateMaintainer, Tg as AggregateNotFound, Dg as AggregateRegistry, wg as AggregateStale, tg as AnalyticsCapabilityNotSupported, eg as AnalyticsError, ng as AnalyticsSink, Uf as CLAIM_RETENTION_BUCKETS, Y as CONNECTIONS_TABLE, Vl as CONNECTION_GRANTS_TABLE, sf as CircuitBreaker, af as CircuitOpen, uu as ConnectionNotConnected, gh as CostAccountant, lh as CostRegistry, gg as DEFAULT_ANALYTICS_MIRROR_TUNABLES, Fp as DEFAULT_APPROVAL_EXPIRY_MS, Hf as DEFAULT_CLAIM_BUCKET_MS, $n as DEFAULT_DELIVERY_CONCURRENCY, Mo as DEFAULT_HSTS, Xf as DEFAULT_MAX_IDLE_INTERVAL_MS, _s as DEFAULT_MAX_RPC_BODY_BYTES, er as DEFAULT_RAW_READ_TRACKING_LIMIT, cu as DEFAULT_REFRESH_SKEW_MS, li as DEFAULT_ROW_FILTER_RETRY, zf as DORMANCY_WAKEUP_TENANT, ja as DeleteBuilder, ki as Dispatcher, hl as EVENT_CLIENT_QUEUE_SIZE, gl as EVENT_LATEST_QUEUE_SIZE, Dc as EffectStore, ul as EventBus, th as ExpectationEvaluator, Gm as ExpectationRegistry, Fh as ExperimentEvaluator, Th as ExperimentRegistry, Su as GRANT_TTL_MS, vh as HOLDOUT_VARIANT, jo as HTML_CSP, qn as InMemoryDataStore, Pn as IndexedMatcher, Sl as InstanceMembership, Dn as LinearScanMatcher, p as MetricBoundaries, ag as NOOP_ANALYTICS_PROVIDER, gi as NO_ROW_FILTER, vo as NO_TRUSTED_PROXIES, wa as NoRowFound, El as OUTBOX_ATTEMPTS_TABLE, Nl as OUTBOX_ATTEMPT_LOG_CAP, J as OUTBOX_TABLE, Ta as OptimisticLockError, Vu as REBAC_ADMIN_SCOPE, lu as REFRESH_LEASE_MS, h_ as RUNTIME_NAME, zm as ReactionRateLimiter, eo as ReplicatedDataStore, ci as RowFilterUnavailable, Rf as SCHEDULE_SUBJECT, Ec as SYSTEM_SUBJECT, ka as SelectBuilder, La as ServerOnlyColumnWrite, md as SsrfBlockedError, Pa as StoreOperationFailed, Ln as SubscriptionRegistry, Fa as TableValidationFailed, Ia as TenantRowNotFound, Na as TenantScopeViolation, mm as TimelineRecorder, yp as UndoBoundaryError, xp as UndoStack, Bo as UnverifiedWebhookRoute, Aa as UpdateBuilder, xd as VOLTRO_AUDIT_MIXIN_ID, Cd as VOLTRO_EXPIRES_MIXIN_ID, Td as VOLTRO_LOCAL_FIRST_MIXIN_ID, Sd as VOLTRO_SOFT_DELETE_MIXIN_ID, wd as VOLTRO_TENANT_MIXIN_ID, Lo as WEBHOOK_VERIFICATION_PROPERTY, Pc as WorkflowDeferredResultError, Hc as WorkflowPayloadError, Fc as WorkflowRateLimitedError, Ic as WorkflowSingletonHeldError, qi as _connectionStreamCount, Ji as _resetConnectionCredentialsForTest, Ip as _voltroApprovalsTable, Ul as _voltroConnectionGrantsTable, Bl as _voltroConnectionsTable, Am as _voltroRebacTuplesTable, np as _voltroScheduleClaimsTable, tp as _voltroScheduleRunsTable, rp as _voltroTracesTable, ip as _voltroUndoLogTable, Lh as _voltroWakeupsTable, il as _voltroWorkflowEventDeliveriesTable, rl as _voltroWorkflowEventsTable, Ua as actingUserId, Tc as apiKeyManagementRoutes, Ui as applyConnectionCredential, Ba as applyDefined, Dm as applyDelta, Cp as applyInverse, wp as applyInverses, nf as applyPluginRefRules, bi as applyRowFilter, xi as applyRowFilterToDescriptor, Mg as applySoftDeleteScope, kg as applyTenantScope, Mp as applyUndoInvocation, Hp as approvalIntentKey, im as approvalNonce, om as approvalsPendingExecutor, Qu as assertCan, ql as assertConnectionCipherConfigured, Vo as assertWebhookRoutesDeclareVerification, Ch as assignVariant, xg as attachAnalyticsMirror, nh as attachExpectations, Ih as attachExperiments, _h as attachFinops, ks as awaitServerListening, Ml as backoffMs, Eu as beginOAuthConnect, zi as bindConnectionCredential, yl as bindEvent, gs as bindMutation, rs as bindStream, ns as bindSubscription, Zo as bindSubscriptionUntyped, Tm as buildIvmState, f_ as buildPreview, Nm as buildRebacInterceptor, Fm as buildRebacReadFilter, Ja as buildSubjectKey, Is as buildTracingLayer, Kd as cacheScopeLeaks, Zs as cachedBackend, Zu as can, Df as cancelWakeup, Vp as canonicalJson, Fn as canonicalize, Wf as claimGraceMs, go as classifyRequestOrigin, bm as classifyShape, em as clearApprovalGate, mu as clearConnectionRefreshFlights, qu as clearResourcePolicies, ee as clearRetentions, uf as clearSystemStoreHandle, rf as collectPluginRefRules, xf as compileCron, Du as completeOAuthConnect, cg as composeAnalytics, sg as composeAnalyticsSinks, Cu as connectionCallbackPath, Kl as connectionLabel, Xh as countRunningWorkflows, ni as counter, Cf as cronOccurrences, Vd as crud, or as currentRawReads, rd as currentRequestLoader, $a as currentRoutingContext, ta as currentTraceContext, Sc as dataStoreApiKeyStore, ic as dataStoreIdempotencyStore, lc as dataStoreKvStore, nm as decideApproval, sm as decideApprovalInvocation, da as decryptField, fs as defectMessage, Sg as defineAggregate, Gl as defineConnection, sh as defineCostBudget, Qc as defineEventTrigger, Pg as defineExecutor, Um as defineExpectation, bh as defineExperiment, kl as defineOutboxHandler, Im as defineReaction, Wu as defineResourcePolicy, bf as defineSchedule, $h as defineSubscriber, Di as deliveredRowCount, ia as deriveKey, d_ as diffChange, Ds as drainForShutdown, Ll as drainOutbox, Pf as dueWakeups, Xu as effectiveRelations, jd as emptySchemaRegistry, _a as enableGraphObservation, ua as encryptField, tm as enforceApproval, nd as enterRequestLoader, Gs as envSecretsBackend, hp as evaluateTouchedRules, Wr as eventMetricTagCacheSizeForTests, ou as exchangeAuthorizationCode, Qi as externalSpanFromTraceparent, Yn as extractDbCause, In as fingerprintFor, Ti as forbiddenColumnsForSubject, nu as forgetCredential, qd as formatCacheScopeLeaks, Gd as formatServerOnlyLeaks, Xi as formatTraceparent, Xd as formatUnresolvedSources, Sp as forwardChangeFromCdc, Cc as frameworkApiKeyStrategy, ri as gauge, mc as generateApiKeyToken, $p as getApprovalGate, Bi as getConnectionCredential, ju as getConnectionResolver, Ri as getCredentialExpiry, K as getFieldCipher, Gu as getResourcePolicy, mi as getRowFilter, df as getSystemStoreHandle, gm as getTimelineRecorder, cd as getTupleSource, Sm as groupKeyOf, Sh as hashUnitInterval, ii as histogramMetric, l_ as historyProvenance, Qs as httpSecretsBackend, Cn as inspectWorkflow, Qp as installApprovalGate, ud as installPolicyGuardResolver, Ki as interruptConnectionStreams, _p as invertChange, So as ipToBytes, Cg as isAggregateDefinition, ch as isCostBudgetDefinition, Ag as isEmptyTenantScopedRead, Wm as isExpectationDefinition, xh as isExperimentDefinition, Xn as isForeignKeyViolation, Uh as isIdleNow, ls as isInfraError, va as isObservingGraph, jg as isOrglessUserSubject, Zn as isQueryTimeout, bp as isSafeToApply, vf as isScheduleDefinition, ef as isSoftDelete, ao as isStateChangingMethod, Eo as isTrustedProxy, $c as isWorkflowEventTriggerDefinition, ir as isolateRawReadScope, wm as ivmValue, c_ as lastWriteProvenance, ru as listConnectionStates, Ku as listResourcePolicies, pe as listRetentionConflicts, me as listRetentions, jm as loadResourceTuples, Pm as loadSubjectTuples, mf as localityAwareSelector, r_ as makeActionRunner, Gf as makeAdvisoryLockCoordinator, aa as makeAesCipher, _c as makeApiKeyService, bd as makeApiKeyUsageBuffer, xc as makeApiKeyUsageFlusher, Qn as makeAppAccess, Xp as makeApprovalGate, uc as makeAsyncKv, pf as makeAuthMiddlewareLayers, vl as makeBufferGapDetector, Ws as makeBufferingSpanProcessor, Jl as makeConnectionRegistry, Nu as makeConnectionResolver, Pu as makeConnectionsFacade, ep as makeCoordinatedScheduler, fd as makeDataLoader, Bu as makeDisconnectConnectionExecutor, Ac as makeEffectStoreLayer, ml as makeEventPublisher, al as makeEventsFacade, oa as makeFieldCipher, Ma as makeFluentStore, Wh as makeIdleGate, Jc as makeLazyWorkflowFacade, Lu as makeListConnectionsExecutor, ms as makeMutationOutputCodec, Jg as makeMutationRunner, t_ as makeOneShotQueryRunner, co as makeOriginGuardExemption, jl as makeOutboxFacade, Kc as makePostCommitWorkflowFacade, Bh as makeProcessAdapter, e_ as makeQueryDescriptorProducer, Ng as makeQueryFinalizer, Qg as makeQueryReauthorizer, n_ as makeQuerySubscriber, Gh as makeRouterActivity, pp as makeRuleCapture, Ed as makeSchemaRegistry, Ru as makeStartConnectionExecutor, zu as makeSubmitTokenExecutor, up as makeUndoCapture, Kh as makeWakeGate, Yh as makeWakeProxyServer, Gc as makeWorkflowFacade, qc as makeWorkflowFacadeWithCallerContext, Yc as makeWorkflowHandlers, Xc as makeWorkflowLayers, Rc as makeWorkflowRunHandle, Of as markWakeupFired, Em as materializeIvm, vc as memoryApiKeyStore, gf as memoryReplicationAdapter, qa as memoryRywPositionStore, Hi as mergeCookieHeader, $f as nextDelay, Sf as nextFiring, Ff as nextWakeup, Hh as nodeProcessSupervisor, og as noopAnalytics, lg as noopAnalyticsSpec, dc as noopKv, yo as normalizeIp, uo as normalizeOrigin, Ca as observeStore, xa as observedGraph, Ss as onProcessShutdown, Ns as otelImportFailure, Ol as outboxAttemptsTable, Tl as outboxTable, Yp as parseApprovalInterval, Zi as parseTraceparent, Uc as payloadPropertyNames, rm as pendingApprovalsFor, Ga as powerOfTwoSelector, m_ as previewInRollback, Ql as projectConnectionState, Lf as pruneWakeups, fl as publishEvent, cr as rawSqlPreview, Zf as readPollCeilingMs, Ju as rebacPolicyGraph, Li as recordCredentialExpiry, Kr as recordEventDelivered, qr as recordEventDropped, Gr as recordEventPublished, Jr as recordEventSubscribers, ar as recordRawRead, Yr as recordSample, ei as recordScheduleRun, $r as recordSubscriptionActive, Zr as recordSubscriptionDelivery, ba as recordTableAccess, vm as recordTimelineEvent, ti as recordWorkflowRun, Ld as redactColumns, dm as redactRow, Ya as redisRywPositionStore, Np as redoUndoInvocation, su as refreshAccessToken, Gi as registerConnectionStream, ld as registerDefaultTupleSource, Te as registerRetention, Ef as registerWakeup, zp as rehydrateGuards, jf as releaseWakeup, Ka as replicaHealth, $o as resetComputedQueryCacheWarnings, Ur as resetEventMetricTagCacheForTests, Sa as resetObservedGraph, Js as resetSecretsBackend, Oo as resolveClientAddress, _u as resolveConnection, Mu as resolveConnectionForSubject, hf as resolveCurrentRegion, lr as resolveDependentTables, _o as resolveOriginGuardConfig, nr as resolveReactiveConfig, Tu as resolveRedirectUri, ko as resolveRequestIsHttps, Om as resolveRescan, _i as resolveRowFilterScope, vi as resolveRowFilterScopeFor, Ys as resolveSecret, Xs as resolveSecretSync, $s as resolveSecretsBackend, Fo as resolveSecurityHeaders, cm as resolveTimelineMode, Do as resolveTrustedProxies, wh as resultVariantNames, Oe as retentionTtlMsFromEnv, pm as reverseEventOverRows, ed as revokedIds, hi as rowFilterRegistered, tf as rulesFor, ff as runAsSystem, Zh as runOrchestratorTick, Fg as runProvidedEffect, Vm as runReaction, Qh as runSingleNodeOrchestrator, zh as runWakeLoop, qg as runWithDeadlockRetry, ya as runWithObservedProcedure, sr as runWithRawReadScope, id as runWithRequestLoader, Qa as runWithRoutingContext, ea as runWithTraceContext, wu as sanitizeRedirectTo, Qf as scheduleCoordinated, Hd as schemaPropertyNames, Bp as scopeStringsOf, Io as securityHeadersFor, Rp as serializeGuards, Si as serverOnlyColumnNames, Wd as serverOnlyLeaks, Au as setConnectionResolver, ca as setFieldCipher, pi as setRowFilter, qs as setSecretsBackend, lf as setSystemStoreHandle, _m as setTimelineRecorderForTest, sd as setTupleSource, En as settleHandlerBody, pc as sha256Hex, Es as shutdownGraceMsFromEnv, Bf as singleCoordinator, oi as snapshotMetrics, si as snapshotMetricsSync, yd as ssrfGuardHttpClientLayer, vd as ssrfReason, vs as startRpcServer, qf as startScheduler, eu as storeCredential, Ci as stripColumnsFromRows, Ei as stripForbiddenForWire, wi as stripServerOnlyForWire, Ou as sweepExpiredGrants, Ie as sweepRetention, vp as synthesizeInverse, pd as tracingHttpClientLayer, Zc as triggerWorkflow, Af as tryClaimWakeup, Vi as unbindConnection, ap as undoCaptureEnabled, Ap as undoLogExecutor, op as undoSurfaceEnabled, Yd as unresolvedSources, Og as useAggregate, ig as useAnalytics, uh as useCostBudget, Km as useExpectation, Eh as useExperiment, $u as visibleRows, Rh as wakeDueOnce, zo as webhookVerificationOf, zg as withRowFilter, $g as withScopedRequest, jc as workflowToRpc, lp as wrapCaptureStore, Nd as wrapStoreWithBootCodec, Wa as wrapStoreWithMixinBehaviour };