@apisurf/wireui 0.1.2

package/dist/server/_ssr/api-Dw1Zb_PK.mjs

@@ -0,0 +1,931 @@
+import { TSS_SERVER_FUNCTION, createServerFn } from "./ssr.mjs";
+import { existsSync, statSync } from "node:fs";
+import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
+import Database from "better-sqlite3";
+import { homedir } from "node:os";
+//#region node_modules/.nitro/vite/services/ssr/assets/api-Dw1Zb_PK.js
+var createServerRpc = (serverFnMeta, splitImportFn) => {
+	const url = "/_serverFn/" + serverFnMeta.id;
+	return Object.assign(splitImportFn, {
+		url,
+		serverFnMeta,
+		[TSS_SERVER_FUNCTION]: true
+	});
+};
+/** Schema version this build writes. Equals the number of migrations. */
+var SCHEMA_VERSION = 4;
+/** Default database filename, created in the working directory. */
+var DEFAULT_DB_FILENAME = "wire.sqlite";
+function resolveDbPath(options = {}) {
+	const cwd = options.cwd ?? process.cwd();
+	const raw = options.path ?? DEFAULT_DB_FILENAME;
+	return isAbsolute(raw) ? raw : resolve(cwd, raw);
+}
+/**
+* Types for view columns SQLite cannot type on its own.
+*
+* `pragma_table_info` on a view resolves each column back to its origin
+* column's declared type — `v_requests.status` reports INTEGER — but returns an
+* empty string for columns that are expressions, because there is no origin
+* column to inherit from. That is a dozen columns across the views, all of
+* them either a correlated subquery counter or a CASE/concatenation.
+* better-sqlite3's `statement.columns()` reports null for exactly the same set
+* and for the same reason, so there is nothing to fall back to but this map.
+*
+* Keep it in step with the views in ./schema.ts. {@link untypedColumns} below
+* turns a drift into a test failure rather than a silently untyped column.
+*/
+var COMPUTED_TYPES = {
+	"v_runs.request_count": "INTEGER",
+	"v_runs.error_count": "INTEGER",
+	"v_runs.connection_count": "INTEGER",
+	"v_runs.message_count": "INTEGER",
+	"v_runs.check_count": "INTEGER",
+	"v_runs.failed_check_count": "INTEGER",
+	"v_runs.total_duration_ms": "REAL",
+	"v_runs.total_bytes": "INTEGER",
+	"v_requests.message_count": "INTEGER",
+	"v_messages.endpoint": "TEXT",
+	"v_messages.direction": "TEXT",
+	"v_messages.text": "TEXT",
+	"v_headers.kind": "TEXT",
+	"v_bodies.text": "TEXT"
+};
+/** One line per view, for `wire schema` with no argument. */
+var RELATION_DESCRIPTIONS = {
+	v_runs: "One row per execute, counts computed on read.",
+	v_requests: "One HTTP request, or one WebSocket/SSE connection.",
+	v_headers: "Request and response headers, in wire order.",
+	v_bodies: "Deduped payloads, content-addressed by SHA-256.",
+	v_messages: "WebSocket frames and SSE events, with payloads.",
+	v_checks: "Assertions a run made, from check() and assert().",
+	tags: "Per-request key/value tags, from execute --tag.",
+	body_fts: "FTS5 index over text payloads. Join on body_id."
+};
+/**
+* Every relation worth querying.
+*
+* Views only by default, because that is the documented surface and the raw
+* tables store interned ids rather than the strings anyone wants to read.
+* `all` adds the base tables — minus FTS5's shadow tables, which are storage
+* for `body_fts` and not something to query directly.
+*/
+function listRelations(db, options = {}) {
+	const types = options.all ? ["view", "table"] : ["view"];
+	return db.prepare(`SELECT name, type FROM sqlite_master
+       WHERE type IN (${types.map(() => "?").join(", ")})
+         AND name NOT LIKE 'sqlite_%'
+         AND name NOT LIKE 'body_fts_%'
+       ORDER BY type DESC, name`).all(...types).map((r) => ({
+		name: r.name,
+		type: r.type,
+		description: RELATION_DESCRIPTIONS[r.name] ?? null
+	}));
+}
+/**
+* Columns of a view or table, with types.
+*
+* Uses the `pragma_table_info` table-valued function rather than the `PRAGMA`
+* statement so the relation name is a bound parameter and never string
+* interpolation.
+*/
+function describeRelation(db, name) {
+	return db.prepare(`SELECT name, type FROM pragma_table_info(?) ORDER BY cid`).all(name).map((r) => {
+		const declared = r.type.trim();
+		if (declared) return {
+			name: r.name,
+			type: declared,
+			computed: false
+		};
+		return {
+			name: r.name,
+			type: COMPUTED_TYPES[`${name}.${r.name}`] ?? "",
+			computed: true
+		};
+	});
+}
+/** Runs, newest first. */
+function listRuns(db, limit = 200) {
+	return db.prepare(`SELECT * FROM v_runs ORDER BY started_at DESC LIMIT ?`).all(limit);
+}
+function getRun$1(db, id) {
+	return db.prepare(`SELECT * FROM v_runs WHERE id = ?`).get(id) ?? null;
+}
+/**
+* Every script that has been run, one row each, most recently run first.
+*
+* Grouping is on `entry` — the absolute path of the executed file — because
+* that is the only stable identity a script has. `--label` is per run and the
+* default label is a basename, which collides the moment two folders hold a
+* `sync.ts`.
+*
+* `label`, `id` and `exit_status` are bare columns under a GROUP BY, which
+* SQLite answers from the row that produced the query's single MAX() — so they
+* describe the latest run, not an arbitrary one. That is a documented SQLite
+* guarantee (one min/max aggregate, bare columns come from that row), not an
+* accident of the query plan.
+*/
+function listScripts(db) {
+	return db.prepare(`SELECT entry,
+              cwd,
+              label,
+              id                                  AS last_run_id,
+              MAX(started_at)                     AS last_started_at,
+              exit_status                         AS last_exit_status,
+              COUNT(*)                            AS run_count,
+              SUM(exit_status = 'error')          AS failed_run_count,
+              SUM(request_count)                  AS request_count,
+              SUM(connection_count)               AS connection_count,
+              SUM(message_count)                  AS message_count,
+              SUM(error_count)                    AS error_count,
+              SUM(check_count)                    AS check_count,
+              SUM(failed_check_count)             AS failed_check_count,
+              SUM(total_bytes)                    AS total_bytes
+       FROM v_runs
+       GROUP BY entry
+       ORDER BY last_started_at DESC`).all();
+}
+/** Runs of one script, newest first — the sessions behind a script row. */
+function listRunsForEntry(db, entry, limit = 200) {
+	return db.prepare(`SELECT * FROM v_runs WHERE entry = ? ORDER BY started_at DESC LIMIT ?`).all(entry, limit);
+}
+/** Requests for a run, in capture order. */
+function listRequests(db, runId) {
+	return db.prepare(`SELECT id, seq, ts, kind, message_count, method, host, path, status, ok, error_name,
+              duration_ms, request_bytes, response_bytes
+       FROM v_requests WHERE run_id = ? ORDER BY seq ASC`).all(runId);
+}
+function getRequestDetail(db, id) {
+	const request = db.prepare(`SELECT * FROM v_requests WHERE id = ?`).get(id);
+	if (!request) return null;
+	const headers = db.prepare(`SELECT kind, name, value FROM v_headers WHERE request_id = ? ORDER BY kind, ord`).all(id);
+	const tags = db.prepare(`SELECT key, value FROM tags WHERE request_id = ? ORDER BY key`).all(id);
+	const split = (kind) => headers.filter((h) => h.kind === kind).map((h) => [h.name, h.value]);
+	return {
+		request,
+		requestHeaders: split("request"),
+		responseHeaders: split("response"),
+		requestBody: loadBody(db, request.request_body_id, request.request_content_type),
+		responseBody: loadBody(db, request.response_body_id, request.response_content_type),
+		tags,
+		messages: request.kind === "http" ? [] : listMessages(db, id)
+	};
+}
+/**
+* Every tag on a run's requests, once each.
+*
+* `execute --tag` attaches the same pairs to every capture in the run, so read
+* back per request they are the same two or three facts repeated a hundred
+* times — they describe the run, not the call. The DISTINCT is what makes this
+* honest for the one case that is not uniform: a library caller can configure
+* two recorders differently inside one run, and then the union is the answer.
+*/
+function listRunTags(db, runId) {
+	return db.prepare(`SELECT DISTINCT t.key, t.value
+       FROM tags t JOIN requests r ON r.id = t.request_id
+       WHERE r.run_id = ?
+       ORDER BY t.key, t.value`).all(runId);
+}
+/** Every assertion a run made, in the order the script made them. */
+function listChecks(db, runId) {
+	return db.prepare(`SELECT id, run_id, seq, ts, name, mode, status, message
+       FROM v_checks WHERE run_id = ? ORDER BY seq ASC`).all(runId);
+}
+/** Every frame or event on one connection, in the order it happened. */
+function listMessages(db, requestId) {
+	return db.prepare(`SELECT id, request_id, seq, ts, direction, name, code, event_id,
+              bytes, body_id, truncated, text
+       FROM v_messages WHERE request_id = ? ORDER BY seq ASC`).all(requestId);
+}
+/**
+* Image types worth inlining into the page.
+*
+* An allow-list rather than a `image/*` prefix test: the content type recorded
+* off the wire ends up verbatim in a `data:` URL, and only these are types a
+* browser will draw.
+*/
+var IMAGE_MIME = /* @__PURE__ */ new Set([
+	"image/apng",
+	"image/avif",
+	"image/bmp",
+	"image/gif",
+	"image/jpeg",
+	"image/png",
+	"image/svg+xml",
+	"image/webp",
+	"image/x-icon",
+	"image/vnd.microsoft.icon"
+]);
+/**
+* Largest image inlined as a `data:` URL.
+*
+* Base64 costs a third on top, and the encoded string travels inside the page's
+* loader payload — past a couple of megabytes the picture costs more than it is
+* worth. The capture cap (1 MiB by default) usually bites first.
+*/
+var MAX_INLINE_IMAGE_BYTES = 2e6;
+/** `image/png; charset=x` → `image/png`, or null when it is not a drawable image. */
+function imageMime(contentType) {
+	if (!contentType) return null;
+	const mime = contentType.split(";")[0].trim().toLowerCase();
+	return IMAGE_MIME.has(mime) ? mime : null;
+}
+/**
+* Fetch a payload and shape it for display: decode text, parse JSON, inline an
+* image, and say plainly why there is nothing to show when there isn't.
+*
+* `kind` is the whole answer — the UI switches on it and never re-sniffs the
+* content type.
+*/
+function loadBody(db, bodyId, contentType) {
+	const base = {
+		present: false,
+		text: null,
+		json: null,
+		dataUrl: null,
+		contentType,
+		size: null,
+		truncated: false
+	};
+	const empty = (note) => ({
+		...base,
+		kind: "empty",
+		note
+	});
+	if (bodyId == null) return empty("No body captured (absent or redacted).");
+	const row = db.prepare(`SELECT size, stored_size, truncated, is_text, content FROM bodies WHERE id = ?`).get(bodyId);
+	if (!row) return empty("Body reference is set but the payload row is missing.");
+	const truncated = row.truncated === 1;
+	const stored = {
+		...base,
+		present: true,
+		size: row.size,
+		truncated
+	};
+	const binary = (note) => ({
+		...stored,
+		kind: "binary",
+		note
+	});
+	const mime = imageMime(contentType);
+	if (mime) {
+		if (truncated) return binary(`Image truncated at ${row.stored_size} of ${row.size} bytes — too incomplete to draw.`);
+		if (row.stored_size > MAX_INLINE_IMAGE_BYTES) return binary(`Image is ${row.stored_size} bytes — too large to inline.`);
+		return {
+			...stored,
+			kind: "image",
+			text: row.is_text === 1 ? row.content.toString("utf8") : null,
+			dataUrl: `data:${mime};base64,${row.content.toString("base64")}`,
+			note: null
+		};
+	}
+	if (row.is_text !== 1) return binary(`Binary body — ${row.stored_size} bytes stored, not shown.`);
+	const text = row.content.toString("utf8");
+	if (contentType && /json/i.test(contentType)) try {
+		const json = JSON.parse(text);
+		if (json !== null && typeof json === "object") return {
+			...stored,
+			kind: "json",
+			json,
+			note: null
+		};
+	} catch {
+		return {
+			...stored,
+			kind: "text",
+			text,
+			note: "Content-Type is JSON but the body did not parse; shown as-is."
+		};
+	}
+	return {
+		...stored,
+		kind: "text",
+		text,
+		note: null
+	};
+}
+/**
+* Per-run aggregates.
+*
+* SQLite has no `quantile()`, so percentiles use the nearest-rank definition:
+* order the durations, take the row at ceil(q * n). One ordered CTE serves all
+* three, and with `idx_requests_run_seq` narrowing to the run first the sort is
+* over that run's rows only.
+*
+* Latency figures cover HTTP requests only. A connection's `duration_ms` is how
+* long it stayed open, so letting one WebSocket sit in the same distribution
+* would make "p95" mean nothing. `latencySamples` says how many rows they are
+* computed over; the status mix and totals still count everything.
+*/
+function getRunAnalytics(db, runId) {
+	const quantiles = db.prepare(`WITH d AS (
+         SELECT duration_ms, ROW_NUMBER() OVER (ORDER BY duration_ms) AS rn
+         FROM requests WHERE run_id = @run AND kind = 'http'
+       ), c AS (SELECT COUNT(*) AS n FROM d)
+       SELECT
+         (SELECT COUNT(*) FROM requests WHERE run_id = @run) AS total,
+         (SELECT n FROM c) AS latency_samples,
+         (SELECT duration_ms FROM d
+            WHERE rn = MAX(1, CAST((SELECT n FROM c) * 0.50 AS INTEGER))) AS p50,
+         (SELECT duration_ms FROM d
+            WHERE rn = MAX(1, CAST((SELECT n FROM c) * 0.95 AS INTEGER))) AS p95,
+         (SELECT duration_ms FROM d
+            WHERE rn = MAX(1, CAST((SELECT n FROM c) * 0.99 AS INTEGER))) AS p99`).get({ run: runId });
+	const statusMix = db.prepare(`SELECT CASE
+                WHEN status IS NULL THEN 'error'
+                ELSE CAST(status / 100 AS TEXT) || 'xx'
+              END AS status_class,
+              COUNT(*) AS count
+       FROM requests WHERE run_id = ?
+       GROUP BY status_class ORDER BY status_class`).all(runId);
+	const slowest = db.prepare(`SELECT id, method, host, path, duration_ms FROM v_requests
+       WHERE run_id = ? AND kind = 'http' ORDER BY duration_ms DESC LIMIT 5`).all(runId);
+	const byHost = db.prepare(`WITH d AS (
+         SELECT host_id, duration_ms, status, error_name,
+                ROW_NUMBER() OVER (PARTITION BY host_id ORDER BY duration_ms) AS rn,
+                COUNT(*)     OVER (PARTITION BY host_id)                      AS n
+         FROM requests WHERE run_id = @run AND kind = 'http'
+       )
+       SELECT h.host AS host,
+              MAX(d.n) AS count,
+              MAX(CASE WHEN d.rn = MAX(1, CAST(d.n * 0.95 AS INTEGER))
+                       THEN d.duration_ms END) AS p95,
+              SUM(CASE WHEN d.error_name IS NOT NULL OR d.status >= 400
+                       THEN 1 ELSE 0 END) AS errors
+       FROM d JOIN hosts h ON h.id = d.host_id
+       GROUP BY d.host_id ORDER BY count DESC`).all({ run: runId });
+	return {
+		total: quantiles.total,
+		latencySamples: quantiles.latency_samples,
+		statusMix,
+		p50: quantiles.latency_samples > 0 ? quantiles.p50 : null,
+		p95: quantiles.latency_samples > 0 ? quantiles.p95 : null,
+		p99: quantiles.latency_samples > 0 ? quantiles.p99 : null,
+		slowest,
+		byHost
+	};
+}
+var cached = null;
+/** Absolute path of the database this server is showing. */
+function dbPath() {
+	const raw = process.env.WIRE_DB;
+	return resolveDbPath({
+		...raw ? { path: raw } : {},
+		cwd: process.cwd()
+	});
+}
+/**
+* The open database, or null when the file does not exist yet.
+*
+* Null is a normal state, not an error: someone can start the UI before their
+* first run. Pages render an empty state for it rather than a 500. A missing
+* file is re-checked on every call, so the first `wire execute` after start-up
+* is picked up without a restart.
+*
+* The connection is opened `readonly` and additionally `query_only`, which is
+* what makes the SQL console safe to offer: a write fails in SQLite itself, not
+* in a check this module could get wrong. Migrations are never applied — a
+* viewer must not change the file it is showing.
+*/
+function getDb() {
+	if (cached) return cached;
+	const file = dbPath();
+	if (!existsSync(file)) return null;
+	const db = new Database(file, {
+		readonly: true,
+		fileMustExist: true
+	});
+	db.pragma("query_only = ON");
+	db.pragma("temp_store = MEMORY");
+	cached = db;
+	return cached;
+}
+/** The schema version of the file being read, or 0 when there is nothing to read. */
+function fileSchemaVersion(db) {
+	if (!db) return 0;
+	return db.pragma("user_version", { simple: true });
+}
+function schemaState(db) {
+	const version = fileSchemaVersion(db);
+	if (!db || version === 0) return "missing";
+	if (version < SCHEMA_VERSION) return "stale";
+	return version > SCHEMA_VERSION ? "newer" : "current";
+}
+var EXPECTED_SCHEMA_VERSION = SCHEMA_VERSION;
+/** The database's size on disk, WAL included — what a recording costs. */
+function fileBytes() {
+	const file = dbPath();
+	let total = 0;
+	for (const path of [file, `${file}-wal`]) try {
+		total += statSync(path).size;
+	} catch {}
+	return total;
+}
+/**
+* How far above the root a script may sit and still be shown relative to it.
+*
+* One or two `../` reads fine and stays searchable. Six means the database and
+* the script only share a home directory, and `~/work/api/scripts/sync.ts` is
+* the more honest rendering of that.
+*/
+var MAX_ASCENT = 2;
+/** The folder paths are shown relative to: the one holding the database. */
+function pathRoot(dbPath) {
+	return dirname(dbPath);
+}
+/** Describe one absolute entry path against a root. */
+function describeEntry(root, entry) {
+	return split(shorten(root, entry));
+}
+function shorten(root, entry) {
+	if (!isAbsolute(entry)) return entry;
+	const rel = toPosix(relative(root, entry));
+	if (rel === "" || isAbsolute(rel)) return home(entry);
+	return rel.split("/").filter((segment) => segment === "..").length > MAX_ASCENT ? home(entry) : rel;
+}
+/** `/Users/you/work/sync.ts` → `~/work/sync.ts`. */
+function home(absolute) {
+	const dir = toPosix(homedir());
+	const path = toPosix(absolute);
+	return path === dir || path.startsWith(`${dir}/`) ? `~${path.slice(dir.length)}` : path;
+}
+function split(path) {
+	const cut = path.lastIndexOf("/");
+	return {
+		rel: path,
+		dir: cut < 0 ? "" : path.slice(0, cut + 1),
+		file: cut < 0 ? path : path.slice(cut + 1)
+	};
+}
+function toPosix(path) {
+	return sep === "/" ? path : path.split(sep).join("/");
+}
+function workspaceCounts(db) {
+	return db.prepare(`SELECT
+         (SELECT COUNT(DISTINCT entry) FROM runs)                          AS scripts,
+         (SELECT COUNT(*) FROM runs)                                       AS runs,
+         (SELECT COUNT(*) FROM requests WHERE kind = 'http')               AS requests,
+         (SELECT COUNT(*) FROM requests WHERE kind <> 'http')              AS connections,
+         (SELECT COUNT(*) FROM messages)                                   AS messages,
+         (SELECT COUNT(*) FROM checks)                                     AS checks,
+         (SELECT COUNT(*) FROM checks WHERE status = 'fail')               AS failedChecks,
+         (SELECT COUNT(*) FROM requests
+            WHERE error_name IS NOT NULL OR status >= 400)                 AS failedRequests,
+         (SELECT COUNT(*) FROM bodies)                                     AS bodies,
+         (SELECT COALESCE(SUM(stored_size), 0) FROM bodies)                AS storedBodyBytes,
+         (SELECT COALESCE(SUM(request_bytes + response_bytes), 0)
+            FROM requests)                                                 AS trafficBytes`).get();
+}
+function envClause(env, column = "env") {
+	if (env === void 0) return {
+		sql: "",
+		params: []
+	};
+	if (env === null) return {
+		sql: ` AND ${column} IS NULL`,
+		params: []
+	};
+	return {
+		sql: ` AND ${column} = ?`,
+		params: [env]
+	};
+}
+/** Every environment the recording has runs for, most recently used first. */
+function listEnvs(db) {
+	return db.prepare(`SELECT env,
+              COUNT(*)                   AS run_count,
+              COUNT(DISTINCT entry)      AS script_count,
+              MAX(started_at)            AS last_started_at,
+              SUM(exit_status = 'error') AS failed_run_count
+       FROM runs GROUP BY env ORDER BY last_started_at DESC`).all();
+}
+/**
+* An FTS5 MATCH expression for free text.
+*
+* Every term is quoted, so what someone types is always searched for as words
+* and never parsed as FTS syntax — `a-b` or a stray `"` would otherwise be a
+* query error. Terms are ANDed, which is what a search box means.
+*/
+function ftsExpression(text) {
+	const terms = text.split(/\s+/).map((t) => t.trim()).filter(Boolean);
+	if (terms.length === 0) return null;
+	return terms.map((t) => `"${t.replace(/"/g, "\"\"")}"`).join(" ");
+}
+/** Recent requests across every run, newest first, with the run they belong to. */
+function listHistory(db, filter) {
+	const where = [];
+	const params = [];
+	const q = filter.q?.trim() ?? "";
+	if (q) {
+		const text = [`q.url LIKE ?`, `q.method = ?`];
+		params.push(`%${q}%`, q.toUpperCase());
+		if (/^\d{3}$/.test(q)) {
+			text.push(`q.status = ?`);
+			params.push(Number(q));
+		}
+		const match = filter.bodies ? ftsExpression(q) : null;
+		if (match) {
+			const hits = `(SELECT CAST(body_id AS INTEGER) FROM body_fts WHERE body_fts MATCH ?)`;
+			text.push(`q.request_body_id IN ${hits}`, `q.response_body_id IN ${hits}`, `q.id IN (SELECT request_id FROM messages WHERE body_id IN ${hits})`);
+			params.push(match, match, match);
+		}
+		where.push(`(${text.join(" OR ")})`);
+	}
+	if (filter.kind === "http") where.push(`q.kind = 'http'`);
+	if (filter.kind === "stream") where.push(`q.kind <> 'http'`);
+	if (filter.failed) where.push(`(q.error_name IS NOT NULL OR q.status >= 400)`);
+	const env = envClause(filter.env, "r.env");
+	const limit = Math.min(Math.max(filter.limit ?? 300, 1), 2e3);
+	const sql = `SELECT q.id, q.run_id, q.seq, q.ts, q.kind, q.method, q.host, q.path, q.query,
+                      q.status, q.error_name, q.duration_ms, q.response_bytes, q.message_count,
+                      r.label AS run_label, r.env, r.entry
+               FROM v_requests q JOIN runs r ON r.id = q.run_id
+               WHERE 1 = 1 ${where.length ? `AND ${where.join(" AND ")}` : ""}${env.sql}
+               ORDER BY q.ts DESC, q.id DESC
+               LIMIT ${limit}`;
+	return db.prepare(sql).all(...params, ...env.params);
+}
+function recentFailedChecks(db, env, limit = 12) {
+	const e = envClause(env, "r.env");
+	return db.prepare(`SELECT c.id, c.run_id, c.ts, c.name, c.mode, c.message,
+              r.label AS run_label, r.entry, r.env
+       FROM checks c JOIN runs r ON r.id = c.run_id
+       WHERE c.status = 'fail'${e.sql}
+       ORDER BY c.ts DESC LIMIT ?`).all(...e.params, limit);
+}
+/**
+* The endpoints that cost the most, across every run.
+*
+* Grouped on method + host + path — the query string is left out on purpose,
+* because `/products?skip=0` and `/products?skip=30` are one endpoint to anyone
+* asking what is slow. HTTP only: a connection's duration is its lifetime.
+*/
+function slowestEndpoints(db, env, limit = 8) {
+	const e = envClause(env, "r.env");
+	return db.prepare(`SELECT m.method, h.host, q.path,
+              COUNT(*)                AS count,
+              AVG(q.duration_ms)      AS avg_ms,
+              MAX(q.duration_ms)      AS max_ms,
+              SUM(q.error_name IS NOT NULL OR q.status >= 400) AS errors,
+              -- Bare column under the one MAX(): SQLite takes it from the
+              -- slowest row, which is the call worth opening.
+              q.id                    AS slowest_request_id
+       FROM requests q
+       JOIN runs r    ON r.id = q.run_id
+       JOIN methods m ON m.id = q.method_id
+       JOIN hosts h   ON h.id = q.host_id
+       WHERE q.kind = 'http'${e.sql}
+       GROUP BY q.method_id, q.host_id, q.path
+       ORDER BY avg_ms DESC LIMIT ?`).all(...e.params, limit);
+}
+/**
+* The requests a script makes, once each — what Postman calls a collection.
+*
+* A script has no saved request definitions; its collection is whatever it
+* actually called. Ordered by where each endpoint first appears in a run, which
+* reads as the script's own order. The `last_*` columns come from joining the
+* newest exchange back in: SQLite only takes bare columns from the MAX() row
+* when a query has a single min/max aggregate, and this one needs two.
+*/
+function listEndpoints(db, entry, env) {
+	const e = envClause(env, "r.env");
+	return db.prepare(`WITH g AS (
+         SELECT q.kind, q.method_id, q.host_id, q.path,
+                COUNT(*)            AS count,
+                SUM(q.error_name IS NOT NULL OR q.status >= 400) AS errors,
+                AVG(q.duration_ms)  AS avg_ms,
+                MAX(q.id)           AS last_id,
+                MIN(q.seq)          AS first_seq
+         FROM requests q JOIN runs r ON r.id = q.run_id
+         WHERE r.entry = ?${e.sql}
+         GROUP BY q.kind, q.method_id, q.host_id, q.path
+       )
+       SELECT g.kind, m.method, h.host, g.path, g.count, g.errors, g.avg_ms,
+              g.last_id      AS last_request_id,
+              l.status       AS last_status,
+              l.error_name   AS last_error_name,
+              l.ts           AS last_ts
+       FROM g
+       JOIN requests l ON l.id = g.last_id
+       JOIN methods m  ON m.id = g.method_id
+       JOIN hosts h    ON h.id = g.host_id
+       ORDER BY g.first_seq, g.count DESC`).all(entry, ...e.params);
+}
+/**
+* Every check a script makes, with its record across runs: has it always
+* passed? The newest outcome is joined back in, for the reason given on
+* {@link listEndpoints}.
+*/
+function listCheckHistory(db, entry, env) {
+	const e = envClause(env, "r.env");
+	return db.prepare(`WITH g AS (
+         SELECT c.name,
+                COUNT(*)                AS total,
+                SUM(c.status = 'fail')  AS failures,
+                MAX(c.id)               AS last_id,
+                MIN(c.seq)              AS first_seq
+         FROM checks c JOIN runs r ON r.id = c.run_id
+         WHERE r.entry = ?${e.sql}
+         GROUP BY c.name
+       )
+       SELECT g.name, g.total, g.failures,
+              g.last_id    AS last_check_id,
+              l.run_id     AS last_run_id,
+              l.status     AS last_status,
+              l.message    AS last_message
+       FROM g JOIN checks l ON l.id = g.last_id
+       ORDER BY g.first_seq`).all(entry, ...e.params);
+}
+function requestNeighbours(db, runId, seq) {
+	return db.prepare(`SELECT
+         (SELECT id FROM requests WHERE run_id = @run AND seq < @seq ORDER BY seq DESC LIMIT 1) AS prev,
+         (SELECT id FROM requests WHERE run_id = @run AND seq > @seq ORDER BY seq ASC  LIMIT 1) AS next`).get({
+		run: runId,
+		seq
+	});
+}
+/** Older and newer runs of the same script. */
+function runNeighbours(db, entry, startedAt, id) {
+	return db.prepare(`SELECT
+         (SELECT id FROM runs WHERE entry = @entry AND (started_at, id) < (@at, @id)
+            ORDER BY started_at DESC, id DESC LIMIT 1) AS prev,
+         (SELECT id FROM runs WHERE entry = @entry AND (started_at, id) > (@at, @id)
+            ORDER BY started_at ASC, id ASC LIMIT 1) AS next`).get({
+		entry,
+		at: startedAt,
+		id
+	});
+}
+/**
+* Run one read statement and return at most {@link MAX_QUERY_ROWS} rows.
+*
+* Safety is not this function's job — the connection is read-only and
+* `query_only`, so SQLite itself refuses a write. What this adds is a clear
+* message for a statement that returns nothing to show, and a row cap enforced
+* by stepping the cursor rather than by rewriting the SQL with a LIMIT.
+*/
+function runQuery(db, sql) {
+	const started = performance.now();
+	try {
+		const statement = db.prepare(sql);
+		if (!statement.reader) return {
+			ok: false,
+			error: "Only statements that return rows run here — SELECT, WITH, PRAGMA, EXPLAIN. The database is open read-only."
+		};
+		const columns = statement.columns().map((c) => c.name);
+		const rows = [];
+		let truncated = false;
+		for (const row of statement.raw(true).iterate()) {
+			if (rows.length === 1e3) {
+				truncated = true;
+				break;
+			}
+			rows.push(row.map(cell));
+		}
+		return {
+			ok: true,
+			columns,
+			rows,
+			truncated,
+			ms: performance.now() - started
+		};
+	} catch (err) {
+		return {
+			ok: false,
+			error: err instanceof Error ? err.message : String(err)
+		};
+	}
+}
+/** A value that survives the trip to the browser and says what it is. */
+function cell(value) {
+	if (value === null || value === void 0) return null;
+	if (typeof value === "number" || typeof value === "string") return value;
+	if (typeof value === "bigint") return value.toString();
+	if (Buffer.isBuffer(value)) return `<blob · ${value.length} bytes>`;
+	return String(value);
+}
+function record(input) {
+	return input && typeof input === "object" ? input : {};
+}
+function id(value, name) {
+	const n = typeof value === "string" ? Number(value) : value;
+	if (typeof n !== "number" || !Number.isInteger(n) || n <= 0) throw new Error(`${name} must be a positive integer`);
+	return n;
+}
+function optionalString(value) {
+	return typeof value === "string" ? value : void 0;
+}
+/** `undefined` → every environment, `null` → runs recorded without one. */
+function env(value) {
+	if (value === null) return null;
+	return typeof value === "string" ? value : void 0;
+}
+/** The open database when its schema is one these queries can read, else null. */
+function readable() {
+	const db = getDb();
+	const state = schemaState(db);
+	return state === "current" || state === "newer" ? db : null;
+}
+function describe(row) {
+	return {
+		...row,
+		...describeEntry(pathRoot(dbPath()), row.entry)
+	};
+}
+/** Runs the sidebar holds. Older ones stay reachable from their script's page. */
+var RUN_WINDOW = 500;
+var getWorkspace_createServerFn_handler = createServerRpc({
+	id: "65bc418eb60581304ebde68d2b8b775b58aa758789bcdd2e616a2bdd5657ef20",
+	name: "getWorkspace",
+	filename: "src/server/api.ts"
+}, (opts) => getWorkspace.__executeServer(opts));
+var getWorkspace = createServerFn({ method: "GET" }).handler(getWorkspace_createServerFn_handler, async () => {
+	const path = dbPath();
+	const handle = getDb();
+	const schema = {
+		state: schemaState(handle),
+		file: fileSchemaVersion(handle),
+		expected: EXPECTED_SCHEMA_VERSION
+	};
+	const base = {
+		path,
+		root: pathRoot(path),
+		schema,
+		now: Date.now()
+	};
+	const db = readable();
+	if (!db) return {
+		...base,
+		bytes: handle ? fileBytes() : 0,
+		counts: null,
+		envs: [],
+		scripts: [],
+		runs: []
+	};
+	return {
+		...base,
+		bytes: fileBytes(),
+		counts: workspaceCounts(db),
+		envs: listEnvs(db),
+		scripts: listScripts(db).map(describe),
+		runs: listRuns(db, RUN_WINDOW).map(describe)
+	};
+});
+var getOverview_createServerFn_handler = createServerRpc({
+	id: "edb0cb28f3af0347a499a4c076ecc5f8247f0ace0fb524957f40f6a706d7224d",
+	name: "getOverview",
+	filename: "src/server/api.ts"
+}, (opts) => getOverview.__executeServer(opts));
+var getOverview = createServerFn({ method: "GET" }).validator((input) => ({ env: env(record(input).env) })).handler(getOverview_createServerFn_handler, async ({ data }) => {
+	const db = readable();
+	if (!db) return {
+		runs: [],
+		failedRequests: [],
+		failedChecks: [],
+		slowest: []
+	};
+	return {
+		runs: listRuns(db, 200).filter((r) => data.env === void 0 || r.env === data.env).slice(0, 12).map(describe),
+		failedRequests: listHistory(db, {
+			env: data.env,
+			failed: true,
+			limit: 12
+		}).map(describe),
+		failedChecks: recentFailedChecks(db, data.env).map(describe),
+		slowest: slowestEndpoints(db, data.env)
+	};
+});
+var getHistory_createServerFn_handler = createServerRpc({
+	id: "c1e4e973ed505d1515bcb9192482c65b1680975a5daa6973befb704515a618e3",
+	name: "getHistory",
+	filename: "src/server/api.ts"
+}, (opts) => getHistory.__executeServer(opts));
+var getHistory = createServerFn({ method: "GET" }).validator((input) => {
+	const r = record(input);
+	const kind = r.kind === "http" || r.kind === "stream" ? r.kind : void 0;
+	return {
+		q: optionalString(r.q),
+		env: env(r.env),
+		kind,
+		failed: r.failed === true,
+		bodies: r.bodies === true,
+		limit: typeof r.limit === "number" ? r.limit : void 0
+	};
+}).handler(getHistory_createServerFn_handler, async ({ data }) => {
+	const db = readable();
+	if (!db) return [];
+	try {
+		return listHistory(db, data).map(describe);
+	} catch (err) {
+		if (data.bodies) return listHistory(db, {
+			...data,
+			bodies: false
+		}).map(describe);
+		throw err;
+	}
+});
+var getScript_createServerFn_handler = createServerRpc({
+	id: "5eff62884e56f81742c81b44dc7dcd1afc2e67323a30591a8b94b8895eda0dc9",
+	name: "getScript",
+	filename: "src/server/api.ts"
+}, (opts) => getScript.__executeServer(opts));
+var getScript = createServerFn({ method: "GET" }).validator((input) => {
+	const r = record(input);
+	const entry = optionalString(r.entry);
+	if (!entry) throw new Error("entry is required");
+	return {
+		entry,
+		env: env(r.env)
+	};
+}).handler(getScript_createServerFn_handler, async ({ data }) => {
+	const db = readable();
+	if (!db) return null;
+	const script = listScripts(db).find((s) => s.entry === data.entry);
+	if (!script) return null;
+	const runs = listRunsForEntry(db, data.entry, 1e3).filter((r) => data.env === void 0 || r.env === data.env);
+	return {
+		script: describe(script),
+		runs,
+		endpoints: listEndpoints(db, data.entry, data.env),
+		checks: listCheckHistory(db, data.entry, data.env)
+	};
+});
+var getRunRequests_createServerFn_handler = createServerRpc({
+	id: "3828e982aebdd19568d199b4820f9fb3ca9fab2c60ce502ee35e3f6075d422c9",
+	name: "getRunRequests",
+	filename: "src/server/api.ts"
+}, (opts) => getRunRequests.__executeServer(opts));
+var getRunRequests = createServerFn({ method: "GET" }).validator((input) => ({ runId: id(record(input).runId, "runId") })).handler(getRunRequests_createServerFn_handler, async ({ data }) => {
+	const db = readable();
+	return db ? listRequests(db, data.runId) : [];
+});
+var getRun_createServerFn_handler = createServerRpc({
+	id: "56c165307cd91159eb72bfa882932f9552f05a5bbd6b5725f0fd5f4ad6b8295d",
+	name: "getRun",
+	filename: "src/server/api.ts"
+}, (opts) => getRun.__executeServer(opts));
+var getRun = createServerFn({ method: "GET" }).validator((input) => ({ runId: id(record(input).runId, "runId") })).handler(getRun_createServerFn_handler, async ({ data }) => {
+	const db = readable();
+	if (!db) return null;
+	const run = getRun$1(db, data.runId);
+	if (!run) return null;
+	return {
+		run: describe(run),
+		tags: listRunTags(db, run.id),
+		requests: listRequests(db, run.id),
+		checks: listChecks(db, run.id),
+		analytics: getRunAnalytics(db, run.id),
+		neighbours: runNeighbours(db, run.entry, run.started_at, run.id)
+	};
+});
+var getRequest_createServerFn_handler = createServerRpc({
+	id: "3772b5ea3e53d85a63e4df11f128b1c907e508d82cca6e71e6ee48dba1664133",
+	name: "getRequest",
+	filename: "src/server/api.ts"
+}, (opts) => getRequest.__executeServer(opts));
+var getRequest = createServerFn({ method: "GET" }).validator((input) => ({ requestId: id(record(input).requestId, "requestId") })).handler(getRequest_createServerFn_handler, async ({ data }) => {
+	const db = readable();
+	if (!db) return null;
+	const detail = getRequestDetail(db, data.requestId);
+	if (!detail) return null;
+	const run = getRun$1(db, detail.request.run_id);
+	if (!run) return null;
+	return {
+		detail,
+		run: describe(run),
+		neighbours: requestNeighbours(db, run.id, detail.request.seq),
+		runRequestCount: run.request_count
+	};
+});
+var getSchema_createServerFn_handler = createServerRpc({
+	id: "06ff3639e7164884f56665ea621dc233dbfc78fa1557b1cb20105ff2fa90521e",
+	name: "getSchema",
+	filename: "src/server/api.ts"
+}, (opts) => getSchema.__executeServer(opts));
+var getSchema = createServerFn({ method: "GET" }).handler(getSchema_createServerFn_handler, async () => {
+	const db = getDb();
+	if (!db) return [];
+	return listRelations(db, { all: true }).map((relation) => ({
+		...relation,
+		columns: describeRelation(db, relation.name)
+	}));
+});
+var runSql_createServerFn_handler = createServerRpc({
+	id: "0f45629470ab3fbe618e9693d8685920d6ce48b2384512e5d9eb88f6b46ec2d9",
+	name: "runSql",
+	filename: "src/server/api.ts"
+}, (opts) => runSql.__executeServer(opts));
+var runSql = createServerFn({ method: "POST" }).validator((input) => {
+	const sql = optionalString(record(input).sql)?.trim();
+	if (!sql) throw new Error("sql is required");
+	return { sql };
+}).handler(runSql_createServerFn_handler, async ({ data }) => {
+	const db = getDb();
+	if (!db) return {
+		ok: false,
+		error: `No database at ${dbPath()} yet.`
+	};
+	return runQuery(db, data.sql);
+});
+//#endregion
+export { getHistory_createServerFn_handler, getOverview_createServerFn_handler, getRequest_createServerFn_handler, getRunRequests_createServerFn_handler, getRun_createServerFn_handler, getSchema_createServerFn_handler, getScript_createServerFn_handler, getWorkspace_createServerFn_handler, runSql_createServerFn_handler };