npm - @helipod/cli - Versions diffs - 0.1.0 - Mend

@helipod/cli 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (19) hide show

package/dist/bin.js +14 -0
package/dist/bin.js.map +1 -0
package/dist/chunk-EPHSHGFU.js +86 -0
package/dist/chunk-EPHSHGFU.js.map +1 -0
package/dist/chunk-IBFZ2HUR.js +2653 -0
package/dist/chunk-IBFZ2HUR.js.map +1 -0
package/dist/chunk-N5J276OX.js +218 -0
package/dist/chunk-N5J276OX.js.map +1 -0
package/dist/http-handler-BFprdo3f.d.ts +133 -0
package/dist/http-handler.d.ts +8 -0
package/dist/http-handler.js +7 -0
package/dist/http-handler.js.map +1 -0
package/dist/index.d.ts +366 -0
package/dist/index.js +120 -0
package/dist/index.js.map +1 -0
package/dist/project.d.ts +53 -0
package/dist/project.js +9 -0
package/dist/project.js.map +1 -0
package/package.json +92 -0

package/dist/chunk-N5J276OX.js ADDED Viewed

@@ -0,0 +1,218 @@
+// src/http-handler.ts
+import { convexToJson } from "@helipod/values";
+import { getHttpStatus, toHelipodError, NotShardOwnerError, CommitGuardRejection } from "@helipod/errors";
+import { matchRoute } from "@helipod/executor";
+import { DEFAULT_SHARD } from "@helipod/id-codec";
+import { handleAdminRequest, verifyAdminKey } from "@helipod/admin";
+function isFleetIdempotencyConflict(e) {
+  return e instanceof CommitGuardRejection && e.rejectionCode === "FLEET_IDEMPOTENCY_CONFLICT";
+}
+function idempotencyReplayBody(hit) {
+  return {
+    replayed: true,
+    commitTs: String(hit.commitTs),
+    ...hit.hasValue ? { value: hit.value } : { valueMissing: true }
+  };
+}
+function json(status, value) {
+  return { status, headers: { "content-type": "application/json" }, body: JSON.stringify(value) };
+}
+function html(body) {
+  return { status: 200, headers: { "content-type": "text/html; charset=utf-8" }, body };
+}
+function bearer(authorization) {
+  const m = /^Bearer (.+)$/.exec(authorization ?? "");
+  return m ? m[1] : void 0;
+}
+function escapeHtml(s) {
+  return s.replace(
+    /[&<>"']/g,
+    (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c] ?? c
+  );
+}
+function dashboardHtml(info) {
+  const li = (items) => items.map((i) => `<li><code>${escapeHtml(i)}</code></li>`).join("") || "<li><em>none</em></li>";
+  return `<!doctype html><html><head><meta charset="utf-8"><title>Helipod</title>
+<style>body{font:14px system-ui;margin:2rem;max-width:48rem}code{background:#f4f4f5;padding:.1rem .3rem;border-radius:4px}</style>
+</head><body>
+<h1>Helipod \u2014 dev</h1>
+<p>The reactive backend is running.</p>
+<h2>Tables (${info.tables.length})</h2><ul>${li(info.tables)}</ul>
+<h2>Functions (${info.functions.length})</h2><ul>${li(info.functions)}</ul>
+</body></html>`;
+}
+async function handleHttpRequest(runtime, req, info, admin, routes, deploy, fleet, replicaWriterUrl) {
+  if (fleet && req.method === "POST" && req.path === "/_fleet/run") {
+    if (!admin || !verifyAdminKey(admin.key, bearer(req.authorization))) return json(401, { error: "unauthorized" });
+    try {
+      const p = JSON.parse(req.body ?? "{}");
+      if (!p.path) return json(400, { error: "missing function path" });
+      const identity = p.identity ?? null;
+      const shardId = p.shardId ?? DEFAULT_SHARD;
+      const dedup = p.clientId !== void 0 && p.seq !== void 0 ? { clientId: p.clientId, seq: p.seq } : void 0;
+      if (p.forwarded && fleet.isLocalWriter && !fleet.isLocalWriter(shardId)) {
+        throw new NotShardOwnerError(
+          `fleet: this node is not the owner of shard '${shardId}' \u2014 refresh and retry against the current owner`
+        );
+      }
+      const idempotencyKey = p.idempotencyKey;
+      if (idempotencyKey && fleet.idempotencyLookup && !dedup) {
+        const hit = await fleet.idempotencyLookup(idempotencyKey);
+        if (hit) return json(200, idempotencyReplayBody(hit));
+      }
+      const isInternalForwardPath = p.path.split(":").some((seg) => seg.startsWith("_"));
+      const commitMeta = idempotencyKey ? { idempotencyKey } : void 0;
+      let result;
+      try {
+        result = p.kind === "action" ? await runtime.runAction(p.path, p.args ?? {}, { identity }) : isInternalForwardPath ? await runtime.runSystem(p.path, p.args ?? {}, { shardId, commitMeta }) : await runtime.run(p.path, p.args ?? {}, { identity, commitMeta, dedup });
+      } catch (runErr) {
+        if (idempotencyKey && fleet.idempotencyLookup && isFleetIdempotencyConflict(runErr)) {
+          const hit = await fleet.idempotencyLookup(idempotencyKey);
+          if (hit) return json(200, idempotencyReplayBody(hit));
+        }
+        throw runErr;
+      }
+      if (result.clientReplay) {
+        return json(200, { clientReplay: result.clientReplay });
+      }
+      if (idempotencyKey && fleet.idempotencyRecordValue) {
+        try {
+          await fleet.idempotencyRecordValue(idempotencyKey, convexToJson(result.value));
+        } catch {
+        }
+      }
+      return json(200, {
+        value: convexToJson(result.value),
+        commitTs: String(result.oplog?.commitTs ?? result.commitTs ?? 0n),
+        ...result.oplog?.shardId !== void 0 ? { shardId: result.oplog.shardId } : {}
+      });
+    } catch (e) {
+      const err = toHelipodError(e);
+      return json(getHttpStatus(err), { error: err.message, code: err.code, errorJson: err.toJSON() });
+    }
+  }
+  if (admin && deploy && req.method === "GET" && req.path === "/_admin/deploy/modules") {
+    if (!verifyAdminKey(admin.key, bearer(req.authorization))) return json(401, { ok: false, error: "unauthorized" });
+    return json(200, deploy.modules());
+  }
+  if (admin && deploy && req.method === "POST" && req.path === "/_admin/deploy") {
+    if (!verifyAdminKey(admin.key, bearer(req.authorization))) return json(401, { ok: false, error: "unauthorized" });
+    let payload;
+    try {
+      payload = JSON.parse(req.body ?? "{}");
+    } catch {
+      return json(400, { ok: false, kind: "load-error", error: "invalid deploy payload" });
+    }
+    const result = await deploy.apply(payload);
+    const status = result.ok ? 200 : result.kind === "schema-incompatible" || result.kind === "stale-base" ? 409 : 400;
+    return json(status, result);
+  }
+  if (admin && req.method === "POST" && req.path === "/_admin/wake") {
+    if (!verifyAdminKey(admin.key, bearer(req.authorization))) return json(401, { ok: false, error: "unauthorized" });
+    runtime.fireDueTimers();
+    return json(200, { ok: true });
+  }
+  if (admin && req.path.startsWith("/_admin/")) {
+    const res = await handleAdminRequest(admin.api, admin.key, {
+      method: req.method,
+      path: req.path,
+      query: req.query ?? {},
+      body: req.body,
+      authorization: req.authorization
+    });
+    return json(res.status, res.body);
+  }
+  if (req.method === "GET" && (req.path === "/_dashboard" || req.path === "/_dashboard/")) {
+    return html(dashboardHtml(info));
+  }
+  if (req.method === "GET" && req.path === "/api/health") {
+    const fs = fleet?.frontierStats?.() ?? null;
+    const gc = fleet?.groupCommitStats?.() ?? null;
+    return json(200, {
+      status: "ok",
+      functions: info.functions.length,
+      tables: info.tables.length,
+      ...fs ? { fleet: { frontier: String(fs.frontier), lagMs: fs.lagMs, pinningShard: fs.pinningShard, ...gc ? { groupCommit: gc } : {} } } : {}
+    });
+  }
+  if (req.method === "POST" && req.path === "/api/run") {
+    try {
+      const parsed = JSON.parse(req.body ?? "{}");
+      if (!parsed.path) return json(400, { error: "missing function path" });
+      if (parsed.forwarded && replicaWriterUrl !== void 0) {
+        return json(409, {
+          error: "helipod: this node is a read replica configured to forward writes (--writer-url) and received an already-forwarded write \u2014 check --writer-url points at the actual writer, not another replica."
+        });
+      }
+      const identity = bearer(req.authorization) ?? null;
+      const result = await runtime.run(parsed.path, parsed.args ?? {}, { identity });
+      return json(200, {
+        value: convexToJson(result.value),
+        committed: result.committed,
+        // Additive: lets a forwarding replica's `ReplicaWriteForwarder` report the writer's real
+        // commitTs instead of a hardcoded 0 — see `EmbeddedRuntime.forwardedResult`'s doc comment.
+        commitTs: String(result.oplog?.commitTs ?? result.commitTs ?? 0n)
+      });
+    } catch (e) {
+      const err = toHelipodError(e);
+      return json(getHttpStatus(err), { error: err.message, code: err.code });
+    }
+  }
+  const match = routes && routes.length > 0 ? matchRoute(routes, req.method, req.path) : void 0;
+  if (match) {
+    if (fleet && fleet.role() === "sync") {
+      try {
+        const writerUrl = await fleet.writerUrl();
+        if (!writerUrl) return json(503, { error: "fleet: no writer available" });
+        const qs = req.query && Object.keys(req.query).length ? "?" + new URLSearchParams(req.query).toString() : "";
+        const target = `${writerUrl.replace(/\/$/, "")}${req.path}${qs}`;
+        const headers = new Headers(req.headers ?? {});
+        if (req.authorization && !headers.has("authorization")) headers.set("authorization", req.authorization);
+        headers.delete("host");
+        headers.delete("content-length");
+        const hasBody = req.method !== "GET" && req.method !== "HEAD" && req.body !== void 0;
+        const resp = await fetch(target, { method: req.method, headers, ...hasBody ? { body: req.body } : {} });
+        const outHeaders = {};
+        resp.headers.forEach((v, k) => {
+          outHeaders[k] = v;
+        });
+        delete outHeaders["content-encoding"];
+        delete outHeaders["content-length"];
+        delete outHeaders["transfer-encoding"];
+        delete outHeaders["connection"];
+        return { status: resp.status, headers: outHeaders, body: await resp.text() };
+      } catch (e) {
+        return json(502, { error: `fleet: httpAction proxy to writer failed: ${e instanceof Error ? e.message : String(e)}` });
+      }
+    }
+    try {
+      const headers = new Headers(req.headers ?? {});
+      if (req.authorization && !headers.has("authorization")) headers.set("authorization", req.authorization);
+      const qs = req.query && Object.keys(req.query).length ? "?" + new URLSearchParams(req.query).toString() : "";
+      const host = headers.get("host") ?? "localhost";
+      const url = `http://${host}${req.path}${qs}`;
+      const hasBody = req.method !== "GET" && req.method !== "HEAD" && req.body !== void 0;
+      const request = new Request(url, { method: req.method, headers, ...hasBody ? { body: req.body } : {} });
+      const auth = headers.get("authorization") ?? "";
+      const identity = auth.startsWith("Bearer ") ? auth.slice("Bearer ".length) : null;
+      const response = await runtime.runHttpAction(match.handlerPath, request, { identity });
+      if (!(response instanceof Response)) {
+        return json(500, { error: "httpAction must return a Response" });
+      }
+      const outHeaders = {};
+      response.headers.forEach((v, k) => {
+        outHeaders[k] = v;
+      });
+      return { status: response.status, headers: outHeaders, body: await response.text() };
+    } catch (e) {
+      const err = toHelipodError(e);
+      return json(getHttpStatus(err), { error: err.message, code: err.code });
+    }
+  }
+  return json(404, { error: "not found" });
+}
+export {
+  handleHttpRequest
+};
+//# sourceMappingURL=chunk-N5J276OX.js.map

package/dist/chunk-N5J276OX.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"sources":["../src/http-handler.ts"],"sourcesContent":["/**\n * HTTP routing for the dev server — a pure function over the runtime so it's testable without\n * a socket. Routes: the `_dashboard` status page, a health check, `POST /api/run` for direct\n * function invocation, and `/_admin/*` for the admin API (behind an admin key).\n */\nimport { convexToJson, type JSONValue, type Value } from \"@helipod/values\";\nimport { getHttpStatus, toHelipodError, NotShardOwnerError, CommitGuardRejection } from \"@helipod/errors\";\nimport { matchRoute } from \"@helipod/executor\";\nimport { DEFAULT_SHARD, type ShardId } from \"@helipod/id-codec\";\nimport type { EmbeddedRuntime } from \"@helipod/runtime-embedded\";\nimport { handleAdminRequest, verifyAdminKey, type AdminApi } from \"@helipod/admin\";\nimport type { ResolvedRoute } from \"./project\";\nimport type { DeployWireResult } from \"./deploy-apply\";\n\nexport interface HttpRequest {\n method: string;\n path: string;\n body?: string;\n query?: Record<string, string>;\n authorization?: string;\n headers?: Record<string, string>;\n}\n\n/**\n * The fleet node handle the HTTP layer consumes (structural mirror of `@helipod/fleet`'s\n * `FleetHandles` — declared here so core cli has no static dependency on the enterprise package).\n * `role()` decides whether a sync node proxies public httpActions to the writer; `writerUrl()` is\n * that proxy target. Present only when `serve --fleet` is active.\n */\nexport interface FleetHandles {\n role(): \"sync\" | \"writer\";\n writerUrl(): Promise<string>;\n onPromoted(cb: () => void): void;\n /** Frontier-lag reading for /api/health (B2a, D5): the fleet-wide `min(frontier_ts)`, how long it's\n * been stuck (ms), and which shard is pinning it. Null before the first frontier beat. Optional so\n * older/stub `FleetHandles` (and pre-B2a fleet builds) satisfy the structural mirror; the health\n * handler optional-chains it. The real `@helipod/fleet` node always provides it. */\n frontierStats?(): { frontier: bigint; lagMs: number; pinningShard: string } | null;\n /**\n * Group-commit counters (Fleet B4, T4 health observability): the aggregate `EmbeddedRuntime.\n * groupCommitStats()` reading plus a derived `flushesPerSec` (a rolling delta between successive\n * calls — see `@helipod/fleet`'s `node.ts`). Structurally all-zero when `HELIPOD_GROUP_COMMIT`\n * is off (the underlying counters are simply never touched on the single-commit path), so the\n * health handler below shows zeroed fields rather than omitting them once fleet mode + this method\n * are both present — `undefined` is reserved for \"not wired at all\" (an older/stub `FleetHandles`),\n * mirroring `frontierStats?`'s same optional-for-backward-compat shape. The real `@helipod/fleet`\n * node always provides it.\n */\n groupCommitStats?(): { lastBatchSize: number; maxBatchSize: number; flushCount: number; flushesPerSec: number };\n /**\n * Per-shard ownership (B2b, D1): true when THIS node currently holds `shardId`'s write lease.\n * Backs the `/_fleet/run` single-hop guard below — optional so older/stub `FleetHandles` satisfy\n * the structural mirror; the guard skips (fail open) when absent. The real `@helipod/fleet` node\n * always provides it (delegates to its `WriteForwarder.isLocalWriter`).\n */\n isLocalWriter?(shardId: string): boolean;\n /**\n * Effectively-once forwarding (Fleet B3, D3): read back `key`'s `fleet_idempotency` row for a\n * replay decision — a hit means this write already committed (possibly on a sibling concurrent\n * attempt) and the caller must NOT re-execute. Optional so older/stub `FleetHandles` satisfy the\n * structural mirror; the `/_fleet/run` handler below skips the whole idempotency path when absent\n * (byte-identical to before this feature existed). The real `@helipod/fleet` node always\n * provides it (delegates to `LeaseManager.lookupIdempotency`).\n */\n idempotencyLookup?(key: string): Promise<{ commitTs: bigint; hasValue: boolean; value: JSONValue | null; oversized: boolean } | null>;\n /** Best-effort post-run recording of a forwarded mutation's return value — see\n * `LeaseManager.recordIdempotencyValue`. Optional for the same reason as `idempotencyLookup`. */\n idempotencyRecordValue?(key: string, value: JSONValue): Promise<void>;\n stop(): Promise<void>;\n}\n\n/**\n * True iff `e` is the fleet idempotency guard's rejection (Fleet B3, D3) — the concurrent-duplicate\n * race's loser: its own commit guard INSERT collided with a sibling attempt that committed first,\n * aborting its ENTIRE commit transaction. Since the Receipted Outbox split-retry (decision 2) the\n * guard converts the raw Postgres `unique_violation` into a typed `CommitGuardRejection` carrying\n * `rejectionCode === \"FLEET_IDEMPOTENCY_CONFLICT\"`, so this detection is now a typed `instanceof`\n * rather than a raw-23505 sniff. This is caught on the OWNER (a local throw, before the fleet-hop\n * serialization at the bottom of `/_fleet/run`), so the raw `instanceof` holds. It must stay narrow:\n * an app-schema unique violation surfaces as a raw driver error (NOT a `CommitGuardRejection`) and\n * must NEVER be turned into a replay — the typed guard makes that distinction structural.\n */\nfunction isFleetIdempotencyConflict(e: unknown): boolean {\n return e instanceof CommitGuardRejection && e.rejectionCode === \"FLEET_IDEMPOTENCY_CONFLICT\";\n}\n\n/** The `/_fleet/run` replay response body (Fleet B3, D3) — additive: `replayed: true` alongside\n * either `value` (a genuinely-recorded result, including a legitimate JSON `null`) or\n * `valueMissing: true` (the crash-window or oversized-cap case — `hasValue` is false either way). */\nfunction idempotencyReplayBody(hit: {\n commitTs: bigint;\n hasValue: boolean;\n value: JSONValue | null;\n}): { replayed: true; commitTs: string; value?: JSONValue; valueMissing?: true } {\n return {\n replayed: true,\n commitTs: String(hit.commitTs),\n ...(hit.hasValue ? { value: hit.value } : { valueMissing: true }),\n };\n}\n\nexport interface HttpResponse {\n status: number;\n headers: Record<string, string>;\n body: string;\n}\n\nexport interface ServerInfo {\n functions: string[];\n tables: string[];\n}\n\nfunction json(status: number, value: unknown): HttpResponse {\n return { status, headers: { \"content-type\": \"application/json\" }, body: JSON.stringify(value) };\n}\nfunction html(body: string): HttpResponse {\n return { status: 200, headers: { \"content-type\": \"text/html; charset=utf-8\" }, body };\n}\n\nfunction bearer(authorization?: string): string | undefined {\n const m = /^Bearer (.+)$/.exec(authorization ?? \"\");\n return m ? m[1] : undefined;\n}\n\nfunction escapeHtml(s: string): string {\n return s.replace(\n /[&<>\"']/g,\n (c) => ({ \"&\": \"&\", \"<\": \"<\", \">\": \">\", '\"': \""\", \"'\": \"'\" })[c] ?? c,\n );\n}\n\nfunction dashboardHtml(info: ServerInfo): string {\n const li = (items: string[]) => items.map((i) => `<li><code>${escapeHtml(i)}</code></li>`).join(\"\") || \"<li><em>none</em></li>\";\n return `<!doctype html><html><head><meta charset=\"utf-8\"><title>Helipod</title>\n<style>body{font:14px system-ui;margin:2rem;max-width:48rem}code{background:#f4f4f5;padding:.1rem .3rem;border-radius:4px}</style>\n</head><body>\n<h1>Helipod — dev</h1>\n<p>The reactive backend is running.</p>\n<h2>Tables (${info.tables.length})</h2><ul>${li(info.tables)}</ul>\n<h2>Functions (${info.functions.length})</h2><ul>${li(info.functions)}</ul>\n</body></html>`;\n}\n\nexport async function handleHttpRequest(\n runtime: EmbeddedRuntime,\n req: HttpRequest,\n info: ServerInfo,\n admin?: { api: AdminApi; key: string },\n routes?: ResolvedRoute[],\n deploy?: {\n apply: (\n payload:\n | { files: Array<{ path: string; code: string }> }\n | { changed: Array<{ path: string; code: string }>; unchanged: Array<{ path: string; sha256: string }> },\n ) => Promise<DeployWireResult>;\n modules: () => Record<string, string>;\n },\n fleet?: FleetHandles,\n /**\n * Tier 3 Slice 8 follow-on (replica write-forwarding): set only when THIS node is itself a\n * `--replica` configured with `--writer-url` — i.e. it forwards mutations/actions elsewhere\n * via its own `ReplicaWriteForwarder` (`replica-forward.ts`). Used SOLELY for the `/api/run`\n * single-hop defensive guard below; the value itself is never read here (a plain presence\n * check — `boot.ts`/`serve.ts` own using it to construct the actual forwarder).\n */\n replicaWriterUrl?: string,\n): Promise<HttpResponse> {\n // Fleet write-forwarding target: a sync node's `WriteForwarder` POSTs mutations/actions here.\n // Enabled only in fleet mode (harmless on the writer — `runtime.run` executes locally there).\n // Admin-key gated (same bearer as `/_admin/*`): it can run any function under an arbitrary\n // identity, so it must never be reachable without the deployment admin key.\n if (fleet && req.method === \"POST\" && req.path === \"/_fleet/run\") {\n if (!admin || !verifyAdminKey(admin.key, bearer(req.authorization))) return json(401, { error: \"unauthorized\" });\n try {\n const p = JSON.parse(req.body ?? \"{}\") as {\n path?: string;\n args?: JSONValue;\n identity?: string | null;\n kind?: string;\n shardId?: string;\n /** Set by the forwarder (T2, single-hop guard) — signals this is a fleet-internal hop, not\n * a fresh dispatch, so the receiver checks ownership itself rather than trusting the caller. */\n forwarded?: boolean;\n /** Fleet B3, D3 (effectively-once forwarding): the forwarder's one-per-logical-write UUID,\n * reused verbatim across its retry-once — see `WriteForwarder.forward`. Absent for a\n * non-forwarded call (e.g. a fleet-internal system forward from an older node, or any\n * direct non-fleet caller), which carries no idempotency tracking at all. */\n idempotencyKey?: string;\n /** Receipted Outbox: the durable client dedup key (verdict §(c)). Present → this OWNER\n * classifies the write (the placement rule — repair 3); a recorded verdict replays here. */\n clientId?: string;\n seq?: number;\n };\n if (!p.path) return json(400, { error: \"missing function path\" });\n const identity = p.identity ?? null;\n const shardId = (p.shardId ?? DEFAULT_SHARD) as ShardId;\n const dedup = p.clientId !== undefined && p.seq !== undefined ? { clientId: p.clientId, seq: p.seq } : undefined;\n // Single-hop guard (B2b, D1 spec-review edit): a forward that lands on a node which is ALSO\n // not `shardId`'s owner (a point-in-time race during rebalance/failover convergence) must\n // NEVER re-forward — that would let a forward chase a moving target unboundedly. Reject with\n // a typed, RETRYABLE error instead; the ORIGINAL forwarder's refresh+retry-once re-reads the\n // lease and re-routes to the current owner. `isLocalWriter` is optional (older/stub\n // `FleetHandles`) — absent, this check is skipped (fail open): ordinary, non-forwarded traffic\n // is unaffected either way, since the executor's own per-shard router already forwards\n // correctly on a genuine ownership mismatch.\n if (p.forwarded && fleet.isLocalWriter && !fleet.isLocalWriter(shardId)) {\n throw new NotShardOwnerError(\n `fleet: this node is not the owner of shard '${shardId}' — refresh and retry against the current owner`,\n );\n }\n\n const idempotencyKey = p.idempotencyKey;\n // SELECT-first (Fleet B3, D3): a duplicate delivery of an ALREADY-committed write replays\n // without ever touching the runtime — no re-execution, no double side effects. `idempotencyLookup`\n // is optional (older/stub `FleetHandles`) — absent, this whole path is skipped and behavior is\n // byte-identical to before this feature existed.\n //\n // Receipted Outbox precedence (verdict Risk R2): when a DURABLE client dedup key is present, the\n // client-verdict classification (run inside `runtime.run` below) is authoritative and runs\n // BEFORE any fleet-idempotency decision — so skip the per-hop fleet pre-select here. The client\n // verdict outlives the fleet key's TTL and catches BOTH the cross-reconnect resend and the\n // same-hop retry-once (each mints a fresh `idempotencyKey`, so the fleet pre-select would miss\n // a resend anyway). The fleet `idempotencyKey` still rides `commitMeta` as a belt-and-suspenders\n // guard, but the client receipts guard is the real barrier.\n if (idempotencyKey && fleet.idempotencyLookup && !dedup) {\n const hit = await fleet.idempotencyLookup(idempotencyKey);\n if (hit) return json(200, idempotencyReplayBody(hit));\n }\n\n // `_system:*`/`_storage:*` (and any other underscore-namespaced) built-in mutations reach here\n // when a privileged doc mutation — the admin dashboard editor's `_system:patchDocument`/\n // `deleteDocument`/`insertDocument`, which already carries its resolved `shardId` (B2a) — is\n // forwarded here because this node doesn't hold that shard (B2b, D1: \"the router forwards them\n // like any other when the shard isn't held\"). `runtime.run`'s PUBLIC gate rejects any\n // underscore-segment path outright (`FunctionNotFoundError`), so those must instead route\n // through the SAME privileged entrypoint the origin node used — `runSystem`, with the resolved\n // `shardId` threaded through — rather than the public `run`.\n const isInternalForwardPath = p.path.split(\":\").some((seg) => seg.startsWith(\"_\"));\n // Opaque commit metadata (Fleet B3, D3): threaded through `run`/`runSystem` -> `RunOptions.\n // commitMeta` -> ... -> the fleet commit guard's atomic `fleet_idempotency` INSERT. Actions\n // never reach a top-level commit themselves (their inner `ctx.runMutation` calls are each a\n // fresh `invoke` with their own options), so this is a harmless no-op for `kind === \"action\"`.\n const commitMeta = idempotencyKey ? { idempotencyKey } : undefined;\n\n let result: Awaited<ReturnType<typeof runtime.run>>;\n try {\n result =\n p.kind === \"action\"\n ? await runtime.runAction(p.path, p.args ?? {}, { identity })\n : isInternalForwardPath\n ? await runtime.runSystem(p.path, p.args ?? {}, { shardId, commitMeta })\n : await runtime.run(p.path, p.args ?? {}, { identity, commitMeta, dedup });\n } catch (runErr) {\n // The concurrent-duplicate race's loser (Fleet B3, D3 spec-review requirement): this\n // attempt ALSO passed the SELECT-miss above, then its own commit guard's `fleet_idempotency`\n // INSERT collided with a sibling attempt that committed first — aborting this entire commit\n // transaction (nothing landed; see `installCommitGuard`'s doc comment). That is NOT a\n // caller-visible failure: re-SELECT the row the winner just committed and replay it, rather\n // than surfacing a generic 500 for what is, from the caller's perspective, a successful\n // (if duplicated) write.\n if (idempotencyKey && fleet.idempotencyLookup && isFleetIdempotencyConflict(runErr)) {\n const hit = await fleet.idempotencyLookup(idempotencyKey);\n if (hit) return json(200, idempotencyReplayBody(hit));\n }\n throw runErr;\n }\n\n // Receipted Outbox: the owner classified this dedup forward as a REPLAY of a recorded verdict\n // (no commit happened) — surface it in its own `clientReplay` body (distinct from the fleet\n // per-hop `replayed` body). The sync node's `WriteForwarder` reads `clientReplay` and builds a\n // `MutationReplay`. Skips the fleet value-recording below (there is no fresh value).\n if (result.clientReplay) {\n return json(200, { clientReplay: result.clientReplay });\n }\n\n // Post-run best-effort value recording (Fleet B3, D3): the guard only ever saw `commitTs` (the\n // VALUE isn't known inside the commit transaction), so record it now that `run`/`runAction`/\n // `runSystem` has returned. A failure here (e.g. a transient connection hiccup) must NOT fail\n // an otherwise-successful mutation response — a later replay simply reports `valueMissing:\n // true` for this key, the documented crash-window contract.\n if (idempotencyKey && fleet.idempotencyRecordValue) {\n try {\n await fleet.idempotencyRecordValue(idempotencyKey, convexToJson(result.value as Value));\n } catch {\n // best-effort — see the doc comment above.\n }\n }\n\n // Stringified: a replica's `WriteForwarder` waits on this via `ReplicaTailer.waitFor` for\n // read-your-own-writes, and bigints don't survive JSON.stringify. `result.oplog` is null for\n // actions (they never commit directly) — fall back to `result.commitTs`, which the executor\n // now surfaces as the MAX commitTs across the action's inner runMutation/runAction invokes\n // (0n if it committed nothing), so fleet RYOW covers actions too.\n // `shardId` (B2a, additive): the shard this run committed on, from the commit's oplog (present\n // for a committed mutation; absent for a read/action that committed nothing — omitted then).\n return json(200, {\n value: convexToJson(result.value as Value),\n commitTs: String(result.oplog?.commitTs ?? result.commitTs ?? 0n),\n ...(result.oplog?.shardId !== undefined ? { shardId: result.oplog.shardId } : {}),\n });\n } catch (e) {\n // Preserve the typed error's identity across the fleet hop: return its REAL http status and the\n // full serialized error (`errorJson`) so the forwarding SYNC node can rehydrate it and surface\n // the correct 4xx/5xx + code/retryable, instead of collapsing every forwarded failure to a 500.\n // `error` (the flat message) is kept for back-compat / human-readable logs.\n const err = toHelipodError(e);\n return json(getHttpStatus(err), { error: err.message, code: err.code, errorJson: err.toJSON() });\n }\n }\n if (admin && deploy && req.method === \"GET\" && req.path === \"/_admin/deploy/modules\") {\n if (!verifyAdminKey(admin.key, bearer(req.authorization))) return json(401, { ok: false, error: \"unauthorized\" });\n return json(200, deploy.modules());\n }\n if (admin && deploy && req.method === \"POST\" && req.path === \"/_admin/deploy\") {\n if (!verifyAdminKey(admin.key, bearer(req.authorization))) return json(401, { ok: false, error: \"unauthorized\" });\n let payload:\n | { files: Array<{ path: string; code: string }> }\n | { changed: Array<{ path: string; code: string }>; unchanged: Array<{ path: string; sha256: string }> };\n try {\n payload = JSON.parse(req.body ?? \"{}\");\n } catch {\n return json(400, { ok: false, kind: \"load-error\", error: \"invalid deploy payload\" });\n }\n const result = await deploy.apply(payload);\n const status = result.ok ? 200 : result.kind === \"schema-incompatible\" || result.kind === \"stale-base\" ? 409 : 400;\n return json(status, result);\n }\n // The wake seam's firing half (`serve --wake-url`): the host's alarm went off and is telling this\n // process to run whatever driver timers are due. It CAN'T be a direct call — the alarm lives in the\n // host (a Durable Object), across a network boundary from this process — and the same request that\n // fires the timers is also what BOOTS a stopped container: one mechanism, both jobs. Admin-key\n // gated like every other `/_admin/*` route (it drives privileged driver work), and registered\n // unconditionally: without a `wakeHost` nothing ever arms a wake, and `fireDueTimers()` is a no-op.\n if (admin && req.method === \"POST\" && req.path === \"/_admin/wake\") {\n if (!verifyAdminKey(admin.key, bearer(req.authorization))) return json(401, { ok: false, error: \"unauthorized\" });\n runtime.fireDueTimers();\n return json(200, { ok: true });\n }\n if (admin && req.path.startsWith(\"/_admin/\")) {\n const res = await handleAdminRequest(admin.api, admin.key, {\n method: req.method,\n path: req.path,\n query: req.query ?? {},\n body: req.body,\n authorization: req.authorization,\n });\n return json(res.status, res.body);\n }\n if (req.method === \"GET\" && (req.path === \"/_dashboard\" || req.path === \"/_dashboard/\")) {\n return html(dashboardHtml(info));\n }\n if (req.method === \"GET\" && req.path === \"/api/health\") {\n // Fleet frontier-lag observability (B2a, D5): additive `fleet` field when running under --fleet\n // and a frontier reading is available. `frontier` is a stringified bigint (JSON can't carry one).\n const fs = fleet?.frontierStats?.() ?? null;\n // Fleet B4 (T4) group-commit counters: additive `fleet.groupCommit`, nested inside the SAME `fleet`\n // gate as the frontier reading above (so a build/fleet-mode that hasn't reported ANY health data\n // yet stays byte-identical to before this field existed). `gc` is zeroed (not absent) when\n // `HELIPOD_GROUP_COMMIT` is off — `groupCommitStats()` structurally returns zeros in that case\n // (see its doc comment) — and the field is omitted only when `groupCommitStats` itself isn't wired\n // (an older/stub `FleetHandles`), which is what `?.` falls through to `null` for.\n const gc = fleet?.groupCommitStats?.() ?? null;\n return json(200, {\n status: \"ok\",\n functions: info.functions.length,\n tables: info.tables.length,\n ...(fs\n ? { fleet: { frontier: String(fs.frontier), lagMs: fs.lagMs, pinningShard: fs.pinningShard, ...(gc ? { groupCommit: gc } : {}) } }\n : {}),\n });\n }\n if (req.method === \"POST\" && req.path === \"/api/run\") {\n try {\n const parsed = JSON.parse(req.body ?? \"{}\") as {\n path?: string;\n args?: JSONValue;\n /** Tier 3 Slice 8 follow-on (replica write-forwarding): set by `ReplicaWriteForwarder`\n * (`replica-forward.ts`) — signals this is ALREADY a forward hop, so the receiver must\n * not treat it as a fresh direct call needing forwarding of its own. Ignored on a WRITER\n * (which has no `writeRouter` and so runs everything locally regardless); checked below\n * ONLY to guard against a request landing on ANOTHER replica by misconfiguration. */\n forwarded?: boolean;\n };\n if (!parsed.path) return json(400, { error: \"missing function path\" });\n // Single-hop guard (Tier 3 Slice 8 follow-on): a `forwarded: true` request must land on the\n // actual writer. If THIS node is itself a replica configured to forward elsewhere\n // (`replicaWriterUrl` set), receiving one here means some caller's `--writer-url` points at\n // this replica instead of the real writer — reject clearly rather than silently forwarding\n // again (which, under a symmetric misconfiguration, could loop between two replicas).\n if (parsed.forwarded && replicaWriterUrl !== undefined) {\n return json(409, {\n error:\n \"helipod: this node is a read replica configured to forward writes (--writer-url) and \" +\n \"received an already-forwarded write — check --writer-url points at the actual writer, not another replica.\",\n });\n }\n // Identity pass-through (Tier 3 Slice 8 follow-on): `/api/run` had no identity support\n // before this — additive/backward-compatible (no `Authorization` header -> `identity:\n // null`, byte-identical to before). Mirrors the httpAction router's own bearer -> identity\n // convention (the caller's raw token is passed straight through, unresolved).\n const identity = bearer(req.authorization) ?? null;\n const result = await runtime.run(parsed.path, parsed.args ?? {}, { identity });\n return json(200, {\n value: convexToJson(result.value as Value),\n committed: result.committed,\n // Additive: lets a forwarding replica's `ReplicaWriteForwarder` report the writer's real\n // commitTs instead of a hardcoded 0 — see `EmbeddedRuntime.forwardedResult`'s doc comment.\n commitTs: String(result.oplog?.commitTs ?? result.commitTs ?? 0n),\n });\n } catch (e) {\n const err = toHelipodError(e);\n return json(getHttpStatus(err), { error: err.message, code: err.code });\n }\n }\n // User httpAction routes — matched AFTER the built-ins, only for non-reserved paths.\n const match = routes && routes.length > 0 ? matchRoute(routes, req.method, req.path) : undefined;\n if (match) {\n // Fleet sync node: an httpAction runs like an action (it may `ctx.runMutation`), so the WHOLE\n // request is proxied to the writer and executed there — never run locally on a replica. The\n // writer's Response (status/headers/body) is streamed back verbatim.\n if (fleet && fleet.role() === \"sync\") {\n try {\n const writerUrl = await fleet.writerUrl();\n if (!writerUrl) return json(503, { error: \"fleet: no writer available\" });\n const qs = req.query && Object.keys(req.query).length ? \"?\" + new URLSearchParams(req.query).toString() : \"\";\n const target = `${writerUrl.replace(/\\/$/, \"\")}${req.path}${qs}`;\n const headers = new Headers(req.headers ?? {});\n if (req.authorization && !headers.has(\"authorization\")) headers.set(\"authorization\", req.authorization);\n // `fetch` recomputes these from the URL/body; a stale copied value would mismatch the\n // re-encoded body (or point at this node, not the writer).\n headers.delete(\"host\");\n headers.delete(\"content-length\");\n const hasBody = req.method !== \"GET\" && req.method !== \"HEAD\" && req.body !== undefined;\n const resp = await fetch(target, { method: req.method, headers, ...(hasBody ? { body: req.body } : {}) });\n const outHeaders: Record<string, string> = {};\n resp.headers.forEach((v, k) => { outHeaders[k] = v; });\n // Hop-by-hop / body-framing headers: `undici` already decompressed the body (so a copied\n // content-encoding/content-length would mismatch what we actually relay), and\n // transfer-encoding/connection are connection-scoped, never meaningful to forward verbatim.\n delete outHeaders[\"content-encoding\"];\n delete outHeaders[\"content-length\"];\n delete outHeaders[\"transfer-encoding\"];\n delete outHeaders[\"connection\"];\n return { status: resp.status, headers: outHeaders, body: await resp.text() };\n } catch (e) {\n return json(502, { error: `fleet: httpAction proxy to writer failed: ${e instanceof Error ? e.message : String(e)}` });\n }\n }\n try {\n const headers = new Headers(req.headers ?? {});\n if (req.authorization && !headers.has(\"authorization\")) headers.set(\"authorization\", req.authorization);\n const qs = req.query && Object.keys(req.query).length ? \"?\" + new URLSearchParams(req.query).toString() : \"\";\n const host = headers.get(\"host\") ?? \"localhost\";\n const url = `http://${host}${req.path}${qs}`;\n const hasBody = req.method !== \"GET\" && req.method !== \"HEAD\" && req.body !== undefined;\n const request = new Request(url, { method: req.method, headers, ...(hasBody ? { body: req.body } : {}) });\n\n const auth = headers.get(\"authorization\") ?? \"\";\n const identity = auth.startsWith(\"Bearer \") ? auth.slice(\"Bearer \".length) : null;\n\n const response = await runtime.runHttpAction(match.handlerPath, request, { identity });\n if (!(response instanceof Response)) {\n return json(500, { error: \"httpAction must return a Response\" });\n }\n const outHeaders: Record<string, string> = {};\n response.headers.forEach((v, k) => { outHeaders[k] = v; });\n return { status: response.status, headers: outHeaders, body: await response.text() };\n } catch (e) {\n const err = toHelipodError(e);\n return json(getHttpStatus(err), { error: err.message, code: err.code });\n }\n }\n\n return json(404, { error: \"not found\" });\n}\n"],"mappings":";AAKA,SAAS,oBAAgD;AACzD,SAAS,eAAe,gBAAgB,oBAAoB,4BAA4B;AACxF,SAAS,kBAAkB;AAC3B,SAAS,qBAAmC;AAE5C,SAAS,oBAAoB,sBAAqC;AAwElE,SAAS,2BAA2B,GAAqB;AACvD,SAAO,aAAa,wBAAwB,EAAE,kBAAkB;AAClE;AAKA,SAAS,sBAAsB,KAIkD;AAC/E,SAAO;AAAA,IACL,UAAU;AAAA,IACV,UAAU,OAAO,IAAI,QAAQ;AAAA,IAC7B,GAAI,IAAI,WAAW,EAAE,OAAO,IAAI,MAAM,IAAI,EAAE,cAAc,KAAK;AAAA,EACjE;AACF;AAaA,SAAS,KAAK,QAAgB,OAA8B;AAC1D,SAAO,EAAE,QAAQ,SAAS,EAAE,gBAAgB,mBAAmB,GAAG,MAAM,KAAK,UAAU,KAAK,EAAE;AAChG;AACA,SAAS,KAAK,MAA4B;AACxC,SAAO,EAAE,QAAQ,KAAK,SAAS,EAAE,gBAAgB,2BAA2B,GAAG,KAAK;AACtF;AAEA,SAAS,OAAO,eAA4C;AAC1D,QAAM,IAAI,gBAAgB,KAAK,iBAAiB,EAAE;AAClD,SAAO,IAAI,EAAE,CAAC,IAAI;AACpB;AAEA,SAAS,WAAW,GAAmB;AACrC,SAAO,EAAE;AAAA,IACP;AAAA,IACA,CAAC,OAAO,EAAE,KAAK,SAAS,KAAK,QAAQ,KAAK,QAAQ,KAAK,UAAU,KAAK,QAAQ,GAAG,CAAC,KAAK;AAAA,EACzF;AACF;AAEA,SAAS,cAAc,MAA0B;AAC/C,QAAM,KAAK,CAAC,UAAoB,MAAM,IAAI,CAAC,MAAM,aAAa,WAAW,CAAC,CAAC,cAAc,EAAE,KAAK,EAAE,KAAK;AACvG,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA,cAKK,KAAK,OAAO,MAAM,aAAa,GAAG,KAAK,MAAM,CAAC;AAAA,iBAC3C,KAAK,UAAU,MAAM,aAAa,GAAG,KAAK,SAAS,CAAC;AAAA;AAErE;AAEA,eAAsB,kBACpB,SACA,KACA,MACA,OACA,QACA,QAQA,OAQA,kBACuB;AAKvB,MAAI,SAAS,IAAI,WAAW,UAAU,IAAI,SAAS,eAAe;AAChE,QAAI,CAAC,SAAS,CAAC,eAAe,MAAM,KAAK,OAAO,IAAI,aAAa,CAAC,EAAG,QAAO,KAAK,KAAK,EAAE,OAAO,eAAe,CAAC;AAC/G,QAAI;AACF,YAAM,IAAI,KAAK,MAAM,IAAI,QAAQ,IAAI;AAmBrC,UAAI,CAAC,EAAE,KAAM,QAAO,KAAK,KAAK,EAAE,OAAO,wBAAwB,CAAC;AAChE,YAAM,WAAW,EAAE,YAAY;AAC/B,YAAM,UAAW,EAAE,WAAW;AAC9B,YAAM,QAAQ,EAAE,aAAa,UAAa,EAAE,QAAQ,SAAY,EAAE,UAAU,EAAE,UAAU,KAAK,EAAE,IAAI,IAAI;AASvG,UAAI,EAAE,aAAa,MAAM,iBAAiB,CAAC,MAAM,cAAc,OAAO,GAAG;AACvE,cAAM,IAAI;AAAA,UACR,+CAA+C,OAAO;AAAA,QACxD;AAAA,MACF;AAEA,YAAM,iBAAiB,EAAE;AAazB,UAAI,kBAAkB,MAAM,qBAAqB,CAAC,OAAO;AACvD,cAAM,MAAM,MAAM,MAAM,kBAAkB,cAAc;AACxD,YAAI,IAAK,QAAO,KAAK,KAAK,sBAAsB,GAAG,CAAC;AAAA,MACtD;AAUA,YAAM,wBAAwB,EAAE,KAAK,MAAM,GAAG,EAAE,KAAK,CAAC,QAAQ,IAAI,WAAW,GAAG,CAAC;AAKjF,YAAM,aAAa,iBAAiB,EAAE,eAAe,IAAI;AAEzD,UAAI;AACJ,UAAI;AACF,iBACE,EAAE,SAAS,WACP,MAAM,QAAQ,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,IAC1D,wBACE,MAAM,QAAQ,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,SAAS,WAAW,CAAC,IACrE,MAAM,QAAQ,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,EAAE,UAAU,YAAY,MAAM,CAAC;AAAA,MACjF,SAAS,QAAQ;AAQf,YAAI,kBAAkB,MAAM,qBAAqB,2BAA2B,MAAM,GAAG;AACnF,gBAAM,MAAM,MAAM,MAAM,kBAAkB,cAAc;AACxD,cAAI,IAAK,QAAO,KAAK,KAAK,sBAAsB,GAAG,CAAC;AAAA,QACtD;AACA,cAAM;AAAA,MACR;AAMA,UAAI,OAAO,cAAc;AACvB,eAAO,KAAK,KAAK,EAAE,cAAc,OAAO,aAAa,CAAC;AAAA,MACxD;AAOA,UAAI,kBAAkB,MAAM,wBAAwB;AAClD,YAAI;AACF,gBAAM,MAAM,uBAAuB,gBAAgB,aAAa,OAAO,KAAc,CAAC;AAAA,QACxF,QAAQ;AAAA,QAER;AAAA,MACF;AASA,aAAO,KAAK,KAAK;AAAA,QACf,OAAO,aAAa,OAAO,KAAc;AAAA,QACzC,UAAU,OAAO,OAAO,OAAO,YAAY,OAAO,YAAY,EAAE;AAAA,QAChE,GAAI,OAAO,OAAO,YAAY,SAAY,EAAE,SAAS,OAAO,MAAM,QAAQ,IAAI,CAAC;AAAA,MACjF,CAAC;AAAA,IACH,SAAS,GAAG;AAKV,YAAM,MAAM,eAAe,CAAC;AAC5B,aAAO,KAAK,cAAc,GAAG,GAAG,EAAE,OAAO,IAAI,SAAS,MAAM,IAAI,MAAM,WAAW,IAAI,OAAO,EAAE,CAAC;AAAA,IACjG;AAAA,EACF;AACA,MAAI,SAAS,UAAU,IAAI,WAAW,SAAS,IAAI,SAAS,0BAA0B;AACpF,QAAI,CAAC,eAAe,MAAM,KAAK,OAAO,IAAI,aAAa,CAAC,EAAG,QAAO,KAAK,KAAK,EAAE,IAAI,OAAO,OAAO,eAAe,CAAC;AAChH,WAAO,KAAK,KAAK,OAAO,QAAQ,CAAC;AAAA,EACnC;AACA,MAAI,SAAS,UAAU,IAAI,WAAW,UAAU,IAAI,SAAS,kBAAkB;AAC7E,QAAI,CAAC,eAAe,MAAM,KAAK,OAAO,IAAI,aAAa,CAAC,EAAG,QAAO,KAAK,KAAK,EAAE,IAAI,OAAO,OAAO,eAAe,CAAC;AAChH,QAAI;AAGJ,QAAI;AACF,gBAAU,KAAK,MAAM,IAAI,QAAQ,IAAI;AAAA,IACvC,QAAQ;AACN,aAAO,KAAK,KAAK,EAAE,IAAI,OAAO,MAAM,cAAc,OAAO,yBAAyB,CAAC;AAAA,IACrF;AACA,UAAM,SAAS,MAAM,OAAO,MAAM,OAAO;AACzC,UAAM,SAAS,OAAO,KAAK,MAAM,OAAO,SAAS,yBAAyB,OAAO,SAAS,eAAe,MAAM;AAC/G,WAAO,KAAK,QAAQ,MAAM;AAAA,EAC5B;AAOA,MAAI,SAAS,IAAI,WAAW,UAAU,IAAI,SAAS,gBAAgB;AACjE,QAAI,CAAC,eAAe,MAAM,KAAK,OAAO,IAAI,aAAa,CAAC,EAAG,QAAO,KAAK,KAAK,EAAE,IAAI,OAAO,OAAO,eAAe,CAAC;AAChH,YAAQ,cAAc;AACtB,WAAO,KAAK,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EAC/B;AACA,MAAI,SAAS,IAAI,KAAK,WAAW,UAAU,GAAG;AAC5C,UAAM,MAAM,MAAM,mBAAmB,MAAM,KAAK,MAAM,KAAK;AAAA,MACzD,QAAQ,IAAI;AAAA,MACZ,MAAM,IAAI;AAAA,MACV,OAAO,IAAI,SAAS,CAAC;AAAA,MACrB,MAAM,IAAI;AAAA,MACV,eAAe,IAAI;AAAA,IACrB,CAAC;AACD,WAAO,KAAK,IAAI,QAAQ,IAAI,IAAI;AAAA,EAClC;AACA,MAAI,IAAI,WAAW,UAAU,IAAI,SAAS,iBAAiB,IAAI,SAAS,iBAAiB;AACvF,WAAO,KAAK,cAAc,IAAI,CAAC;AAAA,EACjC;AACA,MAAI,IAAI,WAAW,SAAS,IAAI,SAAS,eAAe;AAGtD,UAAM,KAAK,OAAO,gBAAgB,KAAK;AAOvC,UAAM,KAAK,OAAO,mBAAmB,KAAK;AAC1C,WAAO,KAAK,KAAK;AAAA,MACf,QAAQ;AAAA,MACR,WAAW,KAAK,UAAU;AAAA,MAC1B,QAAQ,KAAK,OAAO;AAAA,MACpB,GAAI,KACA,EAAE,OAAO,EAAE,UAAU,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,OAAO,cAAc,GAAG,cAAc,GAAI,KAAK,EAAE,aAAa,GAAG,IAAI,CAAC,EAAG,EAAE,IAC/H,CAAC;AAAA,IACP,CAAC;AAAA,EACH;AACA,MAAI,IAAI,WAAW,UAAU,IAAI,SAAS,YAAY;AACpD,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,IAAI,QAAQ,IAAI;AAU1C,UAAI,CAAC,OAAO,KAAM,QAAO,KAAK,KAAK,EAAE,OAAO,wBAAwB,CAAC;AAMrE,UAAI,OAAO,aAAa,qBAAqB,QAAW;AACtD,eAAO,KAAK,KAAK;AAAA,UACf,OACE;AAAA,QAEJ,CAAC;AAAA,MACH;AAKA,YAAM,WAAW,OAAO,IAAI,aAAa,KAAK;AAC9C,YAAM,SAAS,MAAM,QAAQ,IAAI,OAAO,MAAM,OAAO,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;AAC7E,aAAO,KAAK,KAAK;AAAA,QACf,OAAO,aAAa,OAAO,KAAc;AAAA,QACzC,WAAW,OAAO;AAAA;AAAA;AAAA,QAGlB,UAAU,OAAO,OAAO,OAAO,YAAY,OAAO,YAAY,EAAE;AAAA,MAClE,CAAC;AAAA,IACH,SAAS,GAAG;AACV,YAAM,MAAM,eAAe,CAAC;AAC5B,aAAO,KAAK,cAAc,GAAG,GAAG,EAAE,OAAO,IAAI,SAAS,MAAM,IAAI,KAAK,CAAC;AAAA,IACxE;AAAA,EACF;AAEA,QAAM,QAAQ,UAAU,OAAO,SAAS,IAAI,WAAW,QAAQ,IAAI,QAAQ,IAAI,IAAI,IAAI;AACvF,MAAI,OAAO;AAIT,QAAI,SAAS,MAAM,KAAK,MAAM,QAAQ;AACpC,UAAI;AACF,cAAM,YAAY,MAAM,MAAM,UAAU;AACxC,YAAI,CAAC,UAAW,QAAO,KAAK,KAAK,EAAE,OAAO,6BAA6B,CAAC;AACxE,cAAM,KAAK,IAAI,SAAS,OAAO,KAAK,IAAI,KAAK,EAAE,SAAS,MAAM,IAAI,gBAAgB,IAAI,KAAK,EAAE,SAAS,IAAI;AAC1G,cAAM,SAAS,GAAG,UAAU,QAAQ,OAAO,EAAE,CAAC,GAAG,IAAI,IAAI,GAAG,EAAE;AAC9D,cAAM,UAAU,IAAI,QAAQ,IAAI,WAAW,CAAC,CAAC;AAC7C,YAAI,IAAI,iBAAiB,CAAC,QAAQ,IAAI,eAAe,EAAG,SAAQ,IAAI,iBAAiB,IAAI,aAAa;AAGtG,gBAAQ,OAAO,MAAM;AACrB,gBAAQ,OAAO,gBAAgB;AAC/B,cAAM,UAAU,IAAI,WAAW,SAAS,IAAI,WAAW,UAAU,IAAI,SAAS;AAC9E,cAAM,OAAO,MAAM,MAAM,QAAQ,EAAE,QAAQ,IAAI,QAAQ,SAAS,GAAI,UAAU,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC,EAAG,CAAC;AACxG,cAAM,aAAqC,CAAC;AAC5C,aAAK,QAAQ,QAAQ,CAAC,GAAG,MAAM;AAAE,qBAAW,CAAC,IAAI;AAAA,QAAG,CAAC;AAIrD,eAAO,WAAW,kBAAkB;AACpC,eAAO,WAAW,gBAAgB;AAClC,eAAO,WAAW,mBAAmB;AACrC,eAAO,WAAW,YAAY;AAC9B,eAAO,EAAE,QAAQ,KAAK,QAAQ,SAAS,YAAY,MAAM,MAAM,KAAK,KAAK,EAAE;AAAA,MAC7E,SAAS,GAAG;AACV,eAAO,KAAK,KAAK,EAAE,OAAO,6CAA6C,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,CAAC,GAAG,CAAC;AAAA,MACvH;AAAA,IACF;AACA,QAAI;AACF,YAAM,UAAU,IAAI,QAAQ,IAAI,WAAW,CAAC,CAAC;AAC7C,UAAI,IAAI,iBAAiB,CAAC,QAAQ,IAAI,eAAe,EAAG,SAAQ,IAAI,iBAAiB,IAAI,aAAa;AACtG,YAAM,KAAK,IAAI,SAAS,OAAO,KAAK,IAAI,KAAK,EAAE,SAAS,MAAM,IAAI,gBAAgB,IAAI,KAAK,EAAE,SAAS,IAAI;AAC1G,YAAM,OAAO,QAAQ,IAAI,MAAM,KAAK;AACpC,YAAM,MAAM,UAAU,IAAI,GAAG,IAAI,IAAI,GAAG,EAAE;AAC1C,YAAM,UAAU,IAAI,WAAW,SAAS,IAAI,WAAW,UAAU,IAAI,SAAS;AAC9E,YAAM,UAAU,IAAI,QAAQ,KAAK,EAAE,QAAQ,IAAI,QAAQ,SAAS,GAAI,UAAU,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC,EAAG,CAAC;AAExG,YAAM,OAAO,QAAQ,IAAI,eAAe,KAAK;AAC7C,YAAM,WAAW,KAAK,WAAW,SAAS,IAAI,KAAK,MAAM,UAAU,MAAM,IAAI;AAE7E,YAAM,WAAW,MAAM,QAAQ,cAAc,MAAM,aAAa,SAAS,EAAE,SAAS,CAAC;AACrF,UAAI,EAAE,oBAAoB,WAAW;AACnC,eAAO,KAAK,KAAK,EAAE,OAAO,oCAAoC,CAAC;AAAA,MACjE;AACA,YAAM,aAAqC,CAAC;AAC5C,eAAS,QAAQ,QAAQ,CAAC,GAAG,MAAM;AAAE,mBAAW,CAAC,IAAI;AAAA,MAAG,CAAC;AACzD,aAAO,EAAE,QAAQ,SAAS,QAAQ,SAAS,YAAY,MAAM,MAAM,SAAS,KAAK,EAAE;AAAA,IACrF,SAAS,GAAG;AACV,YAAM,MAAM,eAAe,CAAC;AAC5B,aAAO,KAAK,cAAc,GAAG,GAAG,EAAE,OAAO,IAAI,SAAS,MAAM,IAAI,KAAK,CAAC;AAAA,IACxE;AAAA,EACF;AAEA,SAAO,KAAK,KAAK,EAAE,OAAO,YAAY,CAAC;AACzC;","names":[]}

package/dist/http-handler-BFprdo3f.d.ts ADDED Viewed

@@ -0,0 +1,133 @@
+import { JSONValue } from '@helipod/values';
+import { EmbeddedRuntime } from '@helipod/runtime-embedded';
+import { AdminApi } from '@helipod/admin';
+import { ResolvedRoute } from './project.js';
+/** The wire-safe subset of `DeployResult` — identical shape minus `modules` (a `Map`, which must
+ *  never cross HTTP). `serve.ts`'s `deploy.apply` closure strips it before returning; this is the
+ *  type that actually travels over `/_admin/deploy`. */
+type DeployWireResult = {
+    ok: true;
+    rev: string;
+    functions: number;
+} | {
+    ok: false;
+    kind: "load-error" | "schema-incompatible" | "stale-base";
+    error: string;
+};
+/**
+ * HTTP routing for the dev server — a pure function over the runtime so it's testable without
+ * a socket. Routes: the `_dashboard` status page, a health check, `POST /api/run` for direct
+ * function invocation, and `/_admin/*` for the admin API (behind an admin key).
+ */
+interface HttpRequest {
+    method: string;
+    path: string;
+    body?: string;
+    query?: Record<string, string>;
+    authorization?: string;
+    headers?: Record<string, string>;
+}
+/**
+ * The fleet node handle the HTTP layer consumes (structural mirror of `@helipod/fleet`'s
+ * `FleetHandles` — declared here so core cli has no static dependency on the enterprise package).
+ * `role()` decides whether a sync node proxies public httpActions to the writer; `writerUrl()` is
+ * that proxy target. Present only when `serve --fleet` is active.
+ */
+interface FleetHandles {
+    role(): "sync" | "writer";
+    writerUrl(): Promise<string>;
+    onPromoted(cb: () => void): void;
+    /** Frontier-lag reading for /api/health (B2a, D5): the fleet-wide `min(frontier_ts)`, how long it's
+     *  been stuck (ms), and which shard is pinning it. Null before the first frontier beat. Optional so
+     *  older/stub `FleetHandles` (and pre-B2a fleet builds) satisfy the structural mirror; the health
+     *  handler optional-chains it. The real `@helipod/fleet` node always provides it. */
+    frontierStats?(): {
+        frontier: bigint;
+        lagMs: number;
+        pinningShard: string;
+    } | null;
+    /**
+     * Group-commit counters (Fleet B4, T4 health observability): the aggregate `EmbeddedRuntime.
+     * groupCommitStats()` reading plus a derived `flushesPerSec` (a rolling delta between successive
+     * calls — see `@helipod/fleet`'s `node.ts`). Structurally all-zero when `HELIPOD_GROUP_COMMIT`
+     * is off (the underlying counters are simply never touched on the single-commit path), so the
+     * health handler below shows zeroed fields rather than omitting them once fleet mode + this method
+     * are both present — `undefined` is reserved for "not wired at all" (an older/stub `FleetHandles`),
+     * mirroring `frontierStats?`'s same optional-for-backward-compat shape. The real `@helipod/fleet`
+     * node always provides it.
+     */
+    groupCommitStats?(): {
+        lastBatchSize: number;
+        maxBatchSize: number;
+        flushCount: number;
+        flushesPerSec: number;
+    };
+    /**
+     * Per-shard ownership (B2b, D1): true when THIS node currently holds `shardId`'s write lease.
+     * Backs the `/_fleet/run` single-hop guard below — optional so older/stub `FleetHandles` satisfy
+     * the structural mirror; the guard skips (fail open) when absent. The real `@helipod/fleet` node
+     * always provides it (delegates to its `WriteForwarder.isLocalWriter`).
+     */
+    isLocalWriter?(shardId: string): boolean;
+    /**
+     * Effectively-once forwarding (Fleet B3, D3): read back `key`'s `fleet_idempotency` row for a
+     * replay decision — a hit means this write already committed (possibly on a sibling concurrent
+     * attempt) and the caller must NOT re-execute. Optional so older/stub `FleetHandles` satisfy the
+     * structural mirror; the `/_fleet/run` handler below skips the whole idempotency path when absent
+     * (byte-identical to before this feature existed). The real `@helipod/fleet` node always
+     * provides it (delegates to `LeaseManager.lookupIdempotency`).
+     */
+    idempotencyLookup?(key: string): Promise<{
+        commitTs: bigint;
+        hasValue: boolean;
+        value: JSONValue | null;
+        oversized: boolean;
+    } | null>;
+    /** Best-effort post-run recording of a forwarded mutation's return value — see
+     *  `LeaseManager.recordIdempotencyValue`. Optional for the same reason as `idempotencyLookup`. */
+    idempotencyRecordValue?(key: string, value: JSONValue): Promise<void>;
+    stop(): Promise<void>;
+}
+interface HttpResponse {
+    status: number;
+    headers: Record<string, string>;
+    body: string;
+}
+interface ServerInfo {
+    functions: string[];
+    tables: string[];
+}
+declare function handleHttpRequest(runtime: EmbeddedRuntime, req: HttpRequest, info: ServerInfo, admin?: {
+    api: AdminApi;
+    key: string;
+}, routes?: ResolvedRoute[], deploy?: {
+    apply: (payload: {
+        files: Array<{
+            path: string;
+            code: string;
+        }>;
+    } | {
+        changed: Array<{
+            path: string;
+            code: string;
+        }>;
+        unchanged: Array<{
+            path: string;
+            sha256: string;
+        }>;
+    }) => Promise<DeployWireResult>;
+    modules: () => Record<string, string>;
+}, fleet?: FleetHandles,
+/**
+ * Tier 3 Slice 8 follow-on (replica write-forwarding): set only when THIS node is itself a
+ * `--replica` configured with `--writer-url` — i.e. it forwards mutations/actions elsewhere
+ * via its own `ReplicaWriteForwarder` (`replica-forward.ts`). Used SOLELY for the `/api/run`
+ * single-hop defensive guard below; the value itself is never read here (a plain presence
+ * check — `boot.ts`/`serve.ts` own using it to construct the actual forwarder).
+ */
+replicaWriterUrl?: string): Promise<HttpResponse>;
+export { type DeployWireResult as D, type FleetHandles as F, type HttpRequest as H, type ServerInfo as S, type HttpResponse as a, handleHttpRequest as h };

package/dist/http-handler.d.ts ADDED Viewed

@@ -0,0 +1,8 @@
+import '@helipod/values';
+import '@helipod/runtime-embedded';
+import '@helipod/admin';
+import './project.js';
+export { F as FleetHandles, H as HttpRequest, a as HttpResponse, S as ServerInfo, h as handleHttpRequest } from './http-handler-BFprdo3f.js';
+import '@helipod/executor';
+import '@helipod/codegen';
+import '@helipod/component';

package/dist/http-handler.js ADDED Viewed

@@ -0,0 +1,7 @@
+import {
+  handleHttpRequest
+} from "./chunk-N5J276OX.js";
+export {
+  handleHttpRequest
+};
+//# sourceMappingURL=http-handler.js.map

package/dist/http-handler.js.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}