@syncular/server-hono 0.0.6-95 → 0.2.0

package/dist/console/routes.js

@@ -1,2890 +0,0 @@
-/**
- * @syncular/server-hono - Console API routes
- *
- * Provides monitoring and operations endpoints for the @syncular dashboard.
- *
- * Endpoints:
- * - GET  /stats           - Sync statistics
- * - GET  /commits         - Paginated commit list
- * - GET  /commits/:seq    - Single commit with changes
- * - GET  /clients         - Client cursor list
- * - GET  /handlers        - Registered handlers
- * - POST /prune           - Trigger pruning
- * - POST /prune/preview   - Preview pruning (dry run)
- * - POST /compact         - Trigger compaction
- * - DELETE /clients/:id   - Evict client
- */
-import { logSyncEvent } from '@syncular/core';
-import { compactChanges, computePruneWatermarkCommitSeq, notifyExternalDataChange, pruneSync, readSyncStats, } from '@syncular/server';
-import { Hono } from 'hono';
-import { cors } from 'hono/cors';
-import { describeRoute, resolver, validator as zValidator } from 'hono-openapi';
-import { sql } from 'kysely';
-import { z } from 'zod';
-import { ApiKeyTypeSchema, ConsoleApiKeyBulkRevokeRequestSchema, ConsoleApiKeyBulkRevokeResponseSchema, ConsoleApiKeyCreateRequestSchema, ConsoleApiKeyCreateResponseSchema, ConsoleApiKeyRevokeResponseSchema, ConsoleApiKeySchema, ConsoleBlobDeleteResponseSchema, ConsoleBlobListQuerySchema, ConsoleBlobListResponseSchema, ConsoleClearEventsResultSchema, ConsoleClientSchema, ConsoleCommitDetailSchema, ConsoleCommitListItemSchema, ConsoleCompactResultSchema, ConsoleEvictResultSchema, ConsoleHandlerSchema, ConsoleOperationEventSchema, ConsoleOperationsQuerySchema, ConsolePaginatedResponseSchema, ConsolePaginationQuerySchema, ConsolePartitionedPaginationQuerySchema, ConsolePartitionQuerySchema, ConsolePruneEventsResultSchema, ConsolePrunePreviewSchema, ConsolePruneResultSchema, ConsoleRequestEventSchema, ConsoleRequestPayloadSchema, ConsoleTimelineItemSchema, ConsoleTimelineQuerySchema, LatencyQuerySchema, LatencyStatsResponseSchema, SyncStatsSchema, TimeseriesQuerySchema, TimeseriesStatsResponseSchema, } from './schemas.js';
-/**
- * Create a simple console event emitter for broadcasting live events.
- */
-export function createConsoleEventEmitter(options) {
-    const listeners = new Set();
-    const history = [];
-    const maxHistory = Math.max(1, options?.maxHistory ?? 500);
-    return {
-        addListener(listener) {
-            listeners.add(listener);
-        },
-        removeListener(listener) {
-            listeners.delete(listener);
-        },
-        emit(event) {
-            history.push(event);
-            if (history.length > maxHistory) {
-                history.splice(0, history.length - maxHistory);
-            }
-            for (const listener of listeners) {
-                try {
-                    listener(event);
-                }
-                catch {
-                    // Ignore errors in listeners
-                }
-            }
-        },
-        replay(replayOptions) {
-            const sinceMs = replayOptions?.since
-                ? Date.parse(replayOptions.since)
-                : Number.NaN;
-            const hasSince = Number.isFinite(sinceMs);
-            const normalizedPartitionId = replayOptions?.partitionId?.trim();
-            const hasPartitionFilter = Boolean(normalizedPartitionId);
-            const filteredByTime = hasSince
-                ? history.filter((event) => {
-                    const eventMs = Date.parse(event.timestamp);
-                    return Number.isFinite(eventMs) && eventMs > sinceMs;
-                })
-                : history;
-            const filtered = hasPartitionFilter
-                ? filteredByTime.filter((event) => {
-                    const eventPartitionId = event.data.partitionId;
-                    return (typeof eventPartitionId === 'string' &&
-                        eventPartitionId === normalizedPartitionId);
-                })
-                : filteredByTime;
-            const normalizedLimit = replayOptions?.limit && replayOptions.limit > 0
-                ? Math.floor(replayOptions.limit)
-                : 100;
-            const limited = filtered.slice(-normalizedLimit);
-            return [...limited];
-        },
-    };
-}
-function coerceNumber(value) {
-    if (value === null || value === undefined)
-        return null;
-    if (typeof value === 'number')
-        return Number.isFinite(value) ? value : null;
-    if (typeof value === 'bigint')
-        return Number.isFinite(Number(value)) ? Number(value) : null;
-    if (typeof value === 'string') {
-        const n = Number(value);
-        return Number.isFinite(n) ? n : null;
-    }
-    return null;
-}
-function parseDate(value) {
-    if (!value)
-        return null;
-    const parsed = Date.parse(value);
-    return Number.isFinite(parsed) ? parsed : null;
-}
-function includesSearchTerm(value, searchTerm) {
-    if (!searchTerm)
-        return true;
-    if (!value)
-        return false;
-    return value.toLowerCase().includes(searchTerm);
-}
-function parseJsonValue(value) {
-    if (value === null || value === undefined)
-        return null;
-    if (typeof value !== 'string')
-        return value;
-    try {
-        return JSON.parse(value);
-    }
-    catch {
-        return value;
-    }
-}
-function parseScopesSummary(value) {
-    const parsed = parseJsonValue(value);
-    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
-        return null;
-    }
-    const summary = {};
-    for (const [key, entry] of Object.entries(parsed)) {
-        if (typeof entry === 'string') {
-            summary[key] = entry;
-            continue;
-        }
-        if (!Array.isArray(entry))
-            continue;
-        summary[key] = entry.filter((value) => typeof value === 'string');
-    }
-    return Object.keys(summary).length > 0 ? summary : null;
-}
-function getClientActivityState(args) {
-    if (args.connectionCount > 0) {
-        return 'active';
-    }
-    const updatedAtMs = parseDate(args.updatedAt);
-    if (updatedAtMs === null) {
-        return 'stale';
-    }
-    const ageMs = Date.now() - updatedAtMs;
-    if (ageMs <= 60_000) {
-        return 'active';
-    }
-    if (ageMs <= 5 * 60_000) {
-        return 'idle';
-    }
-    return 'stale';
-}
-function rangeToMs(range) {
-    if (range === '1h')
-        return 60 * 60 * 1000;
-    if (range === '6h')
-        return 6 * 60 * 60 * 1000;
-    if (range === '24h')
-        return 24 * 60 * 60 * 1000;
-    if (range === '7d')
-        return 7 * 24 * 60 * 60 * 1000;
-    return 30 * 24 * 60 * 60 * 1000;
-}
-function intervalToMs(interval) {
-    if (interval === 'minute')
-        return 60 * 1000;
-    if (interval === 'hour')
-        return 60 * 60 * 1000;
-    return 24 * 60 * 60 * 1000;
-}
-function intervalToSqliteBucketFormat(interval) {
-    if (interval === 'minute')
-        return '%Y-%m-%dT%H:%M:00.000Z';
-    if (interval === 'hour')
-        return '%Y-%m-%dT%H:00:00.000Z';
-    return '%Y-%m-%dT00:00:00.000Z';
-}
-function createEmptyTimeseriesAccumulator() {
-    return {
-        pushCount: 0,
-        pullCount: 0,
-        errorCount: 0,
-        totalLatency: 0,
-        eventCount: 0,
-    };
-}
-function createTimeseriesBucketMap(args) {
-    const map = new Map();
-    const bucketCount = Math.ceil(args.rangeMs / args.intervalMs);
-    for (let i = 0; i < bucketCount; i++) {
-        const bucketTimestamp = new Date(args.startTime.getTime() + i * args.intervalMs).toISOString();
-        map.set(bucketTimestamp, createEmptyTimeseriesAccumulator());
-    }
-    return map;
-}
-function normalizeBucketTimestamp(value) {
-    if (value instanceof Date) {
-        return value.toISOString();
-    }
-    if (typeof value !== 'string') {
-        return null;
-    }
-    const parsed = Date.parse(value);
-    if (!Number.isFinite(parsed))
-        return null;
-    return new Date(parsed).toISOString();
-}
-function finalizeTimeseriesBuckets(bucketMap) {
-    return Array.from(bucketMap.entries())
-        .sort(([a], [b]) => a.localeCompare(b))
-        .map(([timestamp, data]) => ({
-        timestamp,
-        pushCount: data.pushCount,
-        pullCount: data.pullCount,
-        errorCount: data.errorCount,
-        avgLatencyMs: data.eventCount > 0 ? data.totalLatency / data.eventCount : 0,
-    }));
-}
-function calculatePercentiles(latencies) {
-    if (latencies.length === 0) {
-        return { p50: 0, p90: 0, p99: 0 };
-    }
-    const sorted = [...latencies].sort((a, b) => a - b);
-    const getPercentile = (p) => {
-        const index = Math.ceil((p / 100) * sorted.length) - 1;
-        return sorted[Math.max(0, index)] ?? 0;
-    };
-    return {
-        p50: getPercentile(50),
-        p90: getPercentile(90),
-        p99: getPercentile(99),
-    };
-}
-// ============================================================================
-// Route Schemas
-// ============================================================================
-const ErrorResponseSchema = z.object({
-    error: z.string(),
-    message: z.string().optional(),
-});
-const commitSeqParamSchema = z.object({ seq: z.coerce.number().int() });
-const clientIdParamSchema = z.object({ id: z.string().min(1) });
-const eventIdParamSchema = z.object({ id: z.coerce.number().int() });
-const apiKeyIdParamSchema = z.object({ id: z.string().min(1) });
-const eventsQuerySchema = ConsolePartitionedPaginationQuerySchema.extend({
-    eventType: z.enum(['push', 'pull']).optional(),
-    actorId: z.string().optional(),
-    clientId: z.string().optional(),
-    requestId: z.string().optional(),
-    traceId: z.string().optional(),
-    outcome: z.string().optional(),
-});
-const commitDetailQuerySchema = ConsolePartitionQuerySchema;
-const eventDetailQuerySchema = ConsolePartitionQuerySchema;
-const evictClientQuerySchema = ConsolePartitionQuerySchema;
-const apiKeyStatusSchema = z.enum(['active', 'revoked', 'expiring']);
-const apiKeysQuerySchema = ConsolePaginationQuerySchema.extend({
-    type: ApiKeyTypeSchema.optional(),
-    status: apiKeyStatusSchema.optional(),
-    expiresWithinDays: z.coerce.number().int().min(1).max(365).optional(),
-});
-const handlersResponseSchema = z.object({
-    items: z.array(ConsoleHandlerSchema),
-});
-export function createConsoleRoutes(options) {
-    const routes = new Hono();
-    routes.onError((error, context) => {
-        const message = error instanceof Error ? error.message : 'Unknown console error';
-        console.error('[console] route error', error);
-        return context.json({
-            error: 'CONSOLE_ROUTE_ERROR',
-            message,
-        }, 500);
-    });
-    const db = options.db;
-    const metricsAggregationMode = options.metrics?.aggregationMode ?? 'auto';
-    const rawFallbackMaxEvents = Math.max(1, options.metrics?.rawFallbackMaxEvents ?? 5000);
-    // Ensure console schema exists before handlers query console tables.
-    const consoleSchemaReadyPromise = (options.consoleSchemaReady ??
-        options.dialect.ensureConsoleSchema?.(options.db) ??
-        Promise.resolve()).catch((err) => {
-        console.error('[console] Failed to ensure console schema:', err);
-        throw err;
-    });
-    // CORS configuration
-    const corsOrigins = options.corsOrigins ?? [
-        'http://localhost:5173',
-        'https://console.sync.dev',
-    ];
-    const allowWildcardCors = corsOrigins === '*';
-    routes.use('*', cors({
-        origin: allowWildcardCors ? '*' : corsOrigins,
-        allowMethods: ['GET', 'POST', 'DELETE', 'OPTIONS'],
-        allowHeaders: [
-            'Content-Type',
-            'Authorization',
-            'X-Syncular-Transport-Path',
-            'Baggage',
-            'Sentry-Trace',
-            'Traceparent',
-            'Tracestate',
-        ],
-        exposeHeaders: ['X-Total-Count'],
-        credentials: !allowWildcardCors,
-    }));
-    const ensureConsoleSchemaReady = async (c) => {
-        try {
-            await consoleSchemaReadyPromise;
-            return null;
-        }
-        catch {
-            return c.json({ error: 'CONSOLE_SCHEMA_UNAVAILABLE' }, 503);
-        }
-    };
-    routes.use('*', async (c, next) => {
-        const readyError = await ensureConsoleSchemaReady(c);
-        if (readyError) {
-            return readyError;
-        }
-        await next();
-    });
-    // Auth middleware
-    const requireAuth = async (c) => {
-        const auth = await options.authenticate(c);
-        if (!auth) {
-            return null;
-        }
-        return auth;
-    };
-    const requestEventSelectColumns = [
-        'event_id',
-        'partition_id',
-        'request_id',
-        'trace_id',
-        'span_id',
-        'event_type',
-        'sync_path',
-        'transport_path',
-        'actor_id',
-        'client_id',
-        'status_code',
-        'outcome',
-        'response_status',
-        'error_code',
-        'duration_ms',
-        'commit_seq',
-        'operation_count',
-        'row_count',
-        'subscription_count',
-        'scopes_summary',
-        'tables',
-        'error_message',
-        'payload_ref',
-        'created_at',
-    ];
-    const mapRequestEvent = (row) => ({
-        eventId: coerceNumber(row.event_id) ?? 0,
-        partitionId: row.partition_id ?? 'default',
-        requestId: row.request_id ?? '',
-        traceId: row.trace_id ?? null,
-        spanId: row.span_id ?? null,
-        eventType: row.event_type === 'push' ? 'push' : 'pull',
-        syncPath: row.sync_path === 'ws-push' ? 'ws-push' : 'http-combined',
-        transportPath: row.transport_path === 'relay' ? 'relay' : 'direct',
-        actorId: row.actor_id ?? '',
-        clientId: row.client_id ?? '',
-        statusCode: coerceNumber(row.status_code) ?? 0,
-        outcome: row.outcome ?? '',
-        responseStatus: row.response_status ?? 'unknown',
-        errorCode: row.error_code ?? null,
-        durationMs: coerceNumber(row.duration_ms) ?? 0,
-        commitSeq: coerceNumber(row.commit_seq),
-        operationCount: coerceNumber(row.operation_count),
-        rowCount: coerceNumber(row.row_count),
-        subscriptionCount: coerceNumber(row.subscription_count),
-        scopesSummary: parseScopesSummary(row.scopes_summary),
-        tables: options.dialect.dbToArray(row.tables),
-        errorMessage: row.error_message ?? null,
-        payloadRef: row.payload_ref ?? null,
-        createdAt: row.created_at ?? '',
-    });
-    const operationEventSelectColumns = [
-        'operation_id',
-        'operation_type',
-        'console_user_id',
-        'partition_id',
-        'target_client_id',
-        'request_payload',
-        'result_payload',
-        'created_at',
-    ];
-    const mapOperationEvent = (row) => ({
-        operationId: coerceNumber(row.operation_id) ?? 0,
-        operationType: row.operation_type === 'prune' ||
-            row.operation_type === 'compact' ||
-            row.operation_type === 'notify_data_change' ||
-            row.operation_type === 'evict_client'
-            ? row.operation_type
-            : 'prune',
-        consoleUserId: row.console_user_id ?? null,
-        partitionId: row.partition_id ?? null,
-        targetClientId: row.target_client_id ?? null,
-        requestPayload: parseJsonValue(row.request_payload),
-        resultPayload: parseJsonValue(row.result_payload),
-        createdAt: row.created_at ?? '',
-    });
-    const deleteUnreferencedPayloadSnapshots = async () => {
-        const result = await db
-            .deleteFrom('sync_request_payloads')
-            .where('payload_ref', 'not in', db
-            .selectFrom('sync_request_events')
-            .select('payload_ref')
-            .where('payload_ref', 'is not', null))
-            .executeTakeFirst();
-        return Number(result?.numDeletedRows ?? 0);
-    };
-    const recordOperationEvent = async (event) => {
-        await db
-            .insertInto('sync_operation_events')
-            .values({
-            operation_type: event.operationType,
-            console_user_id: event.consoleUserId ?? null,
-            partition_id: event.partitionId ?? null,
-            target_client_id: event.targetClientId ?? null,
-            request_payload: event.requestPayload === undefined
-                ? null
-                : JSON.stringify(event.requestPayload),
-            result_payload: event.resultPayload === undefined
-                ? null
-                : JSON.stringify(event.resultPayload),
-        })
-            .execute();
-    };
-    const shouldUseRawMetrics = async (startIso, partitionId) => {
-        if (metricsAggregationMode === 'raw') {
-            return true;
-        }
-        if (metricsAggregationMode === 'aggregated') {
-            return false;
-        }
-        let countQuery = db
-            .selectFrom('sync_request_events')
-            .select(({ fn }) => fn.countAll().as('total'))
-            .where('created_at', '>=', startIso);
-        if (partitionId) {
-            countQuery = countQuery.where('partition_id', '=', partitionId);
-        }
-        const countRow = await countQuery.executeTakeFirst();
-        const total = coerceNumber(countRow?.total) ?? 0;
-        return total <= rawFallbackMaxEvents;
-    };
-    // -------------------------------------------------------------------------
-    // GET /stats
-    // -------------------------------------------------------------------------
-    routes.get('/stats', describeRoute({
-        tags: ['console'],
-        summary: 'Get sync statistics',
-        responses: {
-            200: {
-                description: 'Sync statistics',
-                content: {
-                    'application/json': { schema: resolver(SyncStatsSchema) },
-                },
-            },
-            401: {
-                description: 'Unauthenticated',
-                content: {
-                    'application/json': { schema: resolver(ErrorResponseSchema) },
-                },
-            },
-        },
-    }), zValidator('query', ConsolePartitionQuerySchema), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
-        const { partitionId } = c.req.valid('query');
-        const stats = await readSyncStats(options.db, {
-            partitionId,
-        });
-        logSyncEvent({
-            event: 'console.stats',
-            consoleUserId: auth.consoleUserId,
-        });
-        return c.json(stats, 200);
-    });
-    // -------------------------------------------------------------------------
-    // GET /stats/timeseries
-    // -------------------------------------------------------------------------
-    routes.get('/stats/timeseries', describeRoute({
-        tags: ['console'],
-        summary: 'Get time-series statistics',
-        responses: {
-            200: {
-                description: 'Time-series statistics',
-                content: {
-                    'application/json': {
-                        schema: resolver(TimeseriesStatsResponseSchema),
-                    },
-                },
-            },
-            401: {
-                description: 'Unauthenticated',
-                content: {
-                    'application/json': { schema: resolver(ErrorResponseSchema) },
-                },
-            },
-        },
-    }), zValidator('query', TimeseriesQuerySchema), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
-        const { interval, range, partitionId } = c.req.valid('query');
-        const rangeMs = rangeToMs(range);
-        const startTime = new Date(Date.now() - rangeMs);
-        const startIso = startTime.toISOString();
-        const intervalMs = intervalToMs(interval);
-        const bucketMap = createTimeseriesBucketMap({
-            startTime,
-            rangeMs,
-            intervalMs,
-        });
-        const useRawMetrics = await shouldUseRawMetrics(startIso, partitionId);
-        if (useRawMetrics) {
-            let eventsQuery = db
-                .selectFrom('sync_request_events')
-                .select(['event_type', 'duration_ms', 'outcome', 'created_at'])
-                .where('created_at', '>=', startIso);
-            if (partitionId) {
-                eventsQuery = eventsQuery.where('partition_id', '=', partitionId);
-            }
-            const events = await eventsQuery.orderBy('created_at', 'asc').execute();
-            for (const event of events) {
-                const eventTime = parseDate(event.created_at);
-                if (eventTime === null)
-                    continue;
-                const bucketIndex = Math.floor((eventTime - startTime.getTime()) / intervalMs);
-                const bucketTime = new Date(startTime.getTime() + bucketIndex * intervalMs).toISOString();
-                let bucket = bucketMap.get(bucketTime);
-                if (!bucket) {
-                    bucket = createEmptyTimeseriesAccumulator();
-                    bucketMap.set(bucketTime, bucket);
-                }
-                if (event.event_type === 'push') {
-                    bucket.pushCount++;
-                }
-                else if (event.event_type === 'pull') {
-                    bucket.pullCount++;
-                }
-                if (event.outcome === 'error') {
-                    bucket.errorCount++;
-                }
-                const durationMs = coerceNumber(event.duration_ms);
-                if (durationMs !== null) {
-                    bucket.totalLatency += durationMs;
-                    bucket.eventCount++;
-                }
-            }
-        }
-        else {
-            const partitionFilter = partitionId
-                ? sql `and partition_id = ${partitionId}`
-                : sql ``;
-            if (options.dialect.family === 'sqlite') {
-                const bucketFormat = intervalToSqliteBucketFormat(interval);
-                const rowsResult = await sql `
-            select
-              strftime(${bucketFormat}, created_at) as bucket,
-              sum(case when event_type = 'push' then 1 else 0 end) as push_count,
-              sum(case when event_type = 'pull' then 1 else 0 end) as pull_count,
-              sum(case when outcome = 'error' then 1 else 0 end) as error_count,
-              avg(duration_ms) as avg_latency_ms
-            from ${sql.table('sync_request_events')}
-            where created_at >= ${startIso}
-            ${partitionFilter}
-            group by 1
-            order by 1 asc
-          `.execute(options.db);
-                for (const row of rowsResult.rows) {
-                    const bucketTimestamp = normalizeBucketTimestamp(row.bucket);
-                    if (!bucketTimestamp)
-                        continue;
-                    let bucket = bucketMap.get(bucketTimestamp);
-                    if (!bucket) {
-                        bucket = createEmptyTimeseriesAccumulator();
-                        bucketMap.set(bucketTimestamp, bucket);
-                    }
-                    const pushCount = coerceNumber(row.push_count) ?? 0;
-                    const pullCount = coerceNumber(row.pull_count) ?? 0;
-                    const errorCount = coerceNumber(row.error_count) ?? 0;
-                    const avgLatencyMs = coerceNumber(row.avg_latency_ms);
-                    const rowEventCount = pushCount + pullCount;
-                    bucket.pushCount += pushCount;
-                    bucket.pullCount += pullCount;
-                    bucket.errorCount += errorCount;
-                    if (avgLatencyMs !== null && rowEventCount > 0) {
-                        bucket.totalLatency += avgLatencyMs * rowEventCount;
-                        bucket.eventCount += rowEventCount;
-                    }
-                }
-            }
-            else {
-                const rowsResult = await sql `
-            select
-              date_trunc(${interval}, created_at::timestamptz) as bucket,
-              count(*) filter (where event_type = 'push') as push_count,
-              count(*) filter (where event_type = 'pull') as pull_count,
-              count(*) filter (where outcome = 'error') as error_count,
-              avg(duration_ms) as avg_latency_ms
-            from ${sql.table('sync_request_events')}
-            where created_at >= ${startIso}
-            ${partitionFilter}
-            group by 1
-            order by 1 asc
-          `.execute(options.db);
-                for (const row of rowsResult.rows) {
-                    const bucketTimestamp = normalizeBucketTimestamp(row.bucket);
-                    if (!bucketTimestamp)
-                        continue;
-                    let bucket = bucketMap.get(bucketTimestamp);
-                    if (!bucket) {
-                        bucket = createEmptyTimeseriesAccumulator();
-                        bucketMap.set(bucketTimestamp, bucket);
-                    }
-                    const pushCount = coerceNumber(row.push_count) ?? 0;
-                    const pullCount = coerceNumber(row.pull_count) ?? 0;
-                    const errorCount = coerceNumber(row.error_count) ?? 0;
-                    const avgLatencyMs = coerceNumber(row.avg_latency_ms);
-                    const rowEventCount = pushCount + pullCount;
-                    bucket.pushCount += pushCount;
-                    bucket.pullCount += pullCount;
-                    bucket.errorCount += errorCount;
-                    if (avgLatencyMs !== null && rowEventCount > 0) {
-                        bucket.totalLatency += avgLatencyMs * rowEventCount;
-                        bucket.eventCount += rowEventCount;
-                    }
-                }
-            }
-        }
-        const buckets = finalizeTimeseriesBuckets(bucketMap);
-        const response = {
-            buckets,
-            interval,
-            range,
-        };
-        return c.json(response, 200);
-    });
-    // -------------------------------------------------------------------------
-    // GET /stats/latency
-    // -------------------------------------------------------------------------
-    routes.get('/stats/latency', describeRoute({
-        tags: ['console'],
-        summary: 'Get latency percentiles',
-        responses: {
-            200: {
-                description: 'Latency percentiles',
-                content: {
-                    'application/json': {
-                        schema: resolver(LatencyStatsResponseSchema),
-                    },
-                },
-            },
-            401: {
-                description: 'Unauthenticated',
-                content: {
-                    'application/json': { schema: resolver(ErrorResponseSchema) },
-                },
-            },
-        },
-    }), zValidator('query', LatencyQuerySchema), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
-        const { range, partitionId } = c.req.valid('query');
-        const rangeMs = rangeToMs(range);
-        const startTime = new Date(Date.now() - rangeMs);
-        const startIso = startTime.toISOString();
-        const useRawMetrics = await shouldUseRawMetrics(startIso, partitionId);
-        if (!useRawMetrics && options.dialect.family !== 'sqlite') {
-            const partitionFilter = partitionId
-                ? sql `and partition_id = ${partitionId}`
-                : sql ``;
-            const rowsResult = await sql `
-          select
-            event_type,
-            percentile_disc(0.5) within group (order by duration_ms) as p50,
-            percentile_disc(0.9) within group (order by duration_ms) as p90,
-            percentile_disc(0.99) within group (order by duration_ms) as p99
-          from ${sql.table('sync_request_events')}
-          where created_at >= ${startIso}
-          ${partitionFilter}
-          group by event_type
-        `.execute(options.db);
-            const push = { p50: 0, p90: 0, p99: 0 };
-            const pull = { p50: 0, p90: 0, p99: 0 };
-            for (const row of rowsResult.rows) {
-                const eventType = row.event_type === 'push' ? 'push' : 'pull';
-                const target = eventType === 'push' ? push : pull;
-                target.p50 = coerceNumber(row.p50) ?? 0;
-                target.p90 = coerceNumber(row.p90) ?? 0;
-                target.p99 = coerceNumber(row.p99) ?? 0;
-            }
-            const aggregatedResponse = {
-                push,
-                pull,
-                range,
-            };
-            return c.json(aggregatedResponse, 200);
-        }
-        // Raw fallback path (default for local/dev and SQLite)
-        let eventsQuery = db
-            .selectFrom('sync_request_events')
-            .select(['event_type', 'duration_ms'])
-            .where('created_at', '>=', startIso);
-        if (partitionId) {
-            eventsQuery = eventsQuery.where('partition_id', '=', partitionId);
-        }
-        const events = await eventsQuery.execute();
-        const pushLatencies = [];
-        const pullLatencies = [];
-        for (const event of events) {
-            const durationMs = coerceNumber(event.duration_ms);
-            if (durationMs !== null) {
-                if (event.event_type === 'push') {
-                    pushLatencies.push(durationMs);
-                }
-                else if (event.event_type === 'pull') {
-                    pullLatencies.push(durationMs);
-                }
-            }
-        }
-        const response = {
-            push: calculatePercentiles(pushLatencies),
-            pull: calculatePercentiles(pullLatencies),
-            range,
-        };
-        return c.json(response, 200);
-    });
-    // -------------------------------------------------------------------------
-    // GET /timeline
-    // -------------------------------------------------------------------------
-    routes.get('/timeline', describeRoute({
-        tags: ['console'],
-        summary: 'List timeline items',
-        responses: {
-            200: {
-                description: 'Paginated merged timeline',
-                content: {
-                    'application/json': {
-                        schema: resolver(ConsolePaginatedResponseSchema(ConsoleTimelineItemSchema)),
-                    },
-                },
-            },
-            401: {
-                description: 'Unauthenticated',
-                content: {
-                    'application/json': { schema: resolver(ErrorResponseSchema) },
-                },
-            },
-        },
-    }), zValidator('query', ConsoleTimelineQuerySchema), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
-        const { limit, offset, view, partitionId, eventType, actorId, clientId, requestId, traceId, table, outcome, search, from, to, } = c.req.valid('query');
-        const items = [];
-        const normalizedSearchTerm = search?.trim().toLowerCase() || null;
-        const normalizedTable = table?.trim() || null;
-        if (view !== 'events' &&
-            !eventType &&
-            !outcome &&
-            !requestId &&
-            !traceId) {
-            let commitsQuery = db
-                .selectFrom('sync_commits')
-                .select([
-                'commit_seq',
-                'actor_id',
-                'client_id',
-                'client_commit_id',
-                'created_at',
-                'change_count',
-                'affected_tables',
-            ]);
-            if (partitionId) {
-                commitsQuery = commitsQuery.where('partition_id', '=', partitionId);
-            }
-            if (actorId) {
-                commitsQuery = commitsQuery.where('actor_id', '=', actorId);
-            }
-            if (clientId) {
-                commitsQuery = commitsQuery.where('client_id', '=', clientId);
-            }
-            if (from) {
-                commitsQuery = commitsQuery.where('created_at', '>=', from);
-            }
-            if (to) {
-                commitsQuery = commitsQuery.where('created_at', '<=', to);
-            }
-            const commitRows = await commitsQuery.execute();
-            for (const row of commitRows) {
-                const commit = {
-                    commitSeq: coerceNumber(row.commit_seq) ?? 0,
-                    actorId: row.actor_id ?? '',
-                    clientId: row.client_id ?? '',
-                    clientCommitId: row.client_commit_id ?? '',
-                    createdAt: row.created_at ?? '',
-                    changeCount: coerceNumber(row.change_count) ?? 0,
-                    affectedTables: options.dialect.dbToArray(row.affected_tables),
-                };
-                items.push({
-                    type: 'commit',
-                    timestamp: commit.createdAt,
-                    commit,
-                    event: null,
-                });
-            }
-        }
-        if (view !== 'commits') {
-            let eventsQuery = db
-                .selectFrom('sync_request_events')
-                .select(requestEventSelectColumns);
-            if (partitionId) {
-                eventsQuery = eventsQuery.where('partition_id', '=', partitionId);
-            }
-            if (eventType) {
-                eventsQuery = eventsQuery.where('event_type', '=', eventType);
-            }
-            if (actorId) {
-                eventsQuery = eventsQuery.where('actor_id', '=', actorId);
-            }
-            if (clientId) {
-                eventsQuery = eventsQuery.where('client_id', '=', clientId);
-            }
-            if (requestId) {
-                eventsQuery = eventsQuery.where('request_id', '=', requestId);
-            }
-            if (traceId) {
-                eventsQuery = eventsQuery.where('trace_id', '=', traceId);
-            }
-            if (outcome) {
-                eventsQuery = eventsQuery.where('outcome', '=', outcome);
-            }
-            if (from) {
-                eventsQuery = eventsQuery.where('created_at', '>=', from);
-            }
-            if (to) {
-                eventsQuery = eventsQuery.where('created_at', '<=', to);
-            }
-            const eventRows = await eventsQuery.execute();
-            for (const row of eventRows) {
-                const event = mapRequestEvent(row);
-                items.push({
-                    type: 'event',
-                    timestamp: event.createdAt,
-                    commit: null,
-                    event,
-                });
-            }
-        }
-        const filteredItems = items.filter((item) => {
-            if (item.type === 'commit') {
-                const commit = item.commit;
-                if (!commit)
-                    return false;
-                if (normalizedTable &&
-                    !(commit.affectedTables ?? []).includes(normalizedTable)) {
-                    return false;
-                }
-                if (!normalizedSearchTerm)
-                    return true;
-                const searchableCommitFields = [
-                    String(commit.commitSeq),
-                    commit.actorId,
-                    commit.clientId,
-                    commit.clientCommitId,
-                    ...(commit.affectedTables ?? []),
-                ];
-                return searchableCommitFields.some((field) => includesSearchTerm(field, normalizedSearchTerm));
-            }
-            const event = item.event;
-            if (!event)
-                return false;
-            if (normalizedTable &&
-                !(event.tables ?? []).includes(normalizedTable)) {
-                return false;
-            }
-            if (!normalizedSearchTerm)
-                return true;
-            const searchableEventFields = [
-                String(event.eventId),
-                event.requestId,
-                event.traceId ?? '',
-                event.actorId,
-                event.clientId,
-                event.outcome,
-                event.responseStatus,
-                event.errorCode ?? '',
-                event.errorMessage ?? '',
-                ...(event.tables ?? []),
-            ];
-            return searchableEventFields.some((field) => includesSearchTerm(field, normalizedSearchTerm));
-        });
-        filteredItems.sort((a, b) => (parseDate(b.timestamp) ?? 0) - (parseDate(a.timestamp) ?? 0));
-        const total = filteredItems.length;
-        const pagedItems = filteredItems.slice(offset, offset + limit);
-        const response = {
-            items: pagedItems,
-            total,
-            offset,
-            limit,
-        };
-        c.header('X-Total-Count', String(total));
-        return c.json(response, 200);
-    });
-    // -------------------------------------------------------------------------
-    // GET /commits
-    // -------------------------------------------------------------------------
-    routes.get('/commits', describeRoute({
-        tags: ['console'],
-        summary: 'List commits',
-        responses: {
-            200: {
-                description: 'Paginated commit list',
-                content: {
-                    'application/json': {
-                        schema: resolver(ConsolePaginatedResponseSchema(ConsoleCommitListItemSchema)),
-                    },
-                },
-            },
-            401: {
-                description: 'Unauthenticated',
-                content: {
-                    'application/json': { schema: resolver(ErrorResponseSchema) },
-                },
-            },
-        },
-    }), zValidator('query', ConsolePartitionedPaginationQuerySchema), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
-        const { limit, offset, partitionId } = c.req.valid('query');
-        let query = db
-            .selectFrom('sync_commits')
-            .select([
-            'commit_seq',
-            'actor_id',
-            'client_id',
-            'client_commit_id',
-            'created_at',
-            'change_count',
-            'affected_tables',
-        ]);
-        let countQuery = db
-            .selectFrom('sync_commits')
-            .select(({ fn }) => fn.countAll().as('total'));
-        if (partitionId) {
-            query = query.where('partition_id', '=', partitionId);
-            countQuery = countQuery.where('partition_id', '=', partitionId);
-        }
-        const [rows, countRow] = await Promise.all([
-            query
-                .orderBy('commit_seq', 'desc')
-                .limit(limit)
-                .offset(offset)
-                .execute(),
-            countQuery.executeTakeFirst(),
-        ]);
-        const items = rows.map((row) => ({
-            commitSeq: coerceNumber(row.commit_seq) ?? 0,
-            actorId: row.actor_id ?? '',
-            clientId: row.client_id ?? '',
-            clientCommitId: row.client_commit_id ?? '',
-            createdAt: row.created_at ?? '',
-            changeCount: coerceNumber(row.change_count) ?? 0,
-            affectedTables: options.dialect.dbToArray(row.affected_tables),
-        }));
-        const total = coerceNumber(countRow?.total) ?? 0;
-        const response = {
-            items,
-            total,
-            offset,
-            limit,
-        };
-        c.header('X-Total-Count', String(total));
-        return c.json(response, 200);
-    });
-    // -------------------------------------------------------------------------
-    // GET /commits/:seq
-    // -------------------------------------------------------------------------
-    routes.get('/commits/:seq', describeRoute({
-        tags: ['console'],
-        summary: 'Get commit details',
-        responses: {
-            200: {
-                description: 'Commit with changes',
-                content: {
-                    'application/json': { schema: resolver(ConsoleCommitDetailSchema) },
-                },
-            },
-            400: {
-                description: 'Invalid request',
-                content: {
-                    'application/json': { schema: resolver(ErrorResponseSchema) },
-                },
-            },
-            401: {
-                description: 'Unauthenticated',
-                content: {
-                    'application/json': { schema: resolver(ErrorResponseSchema) },
-                },
-            },
-            404: {
-                description: 'Not found',
-                content: {
-                    'application/json': { schema: resolver(ErrorResponseSchema) },
-                },
-            },
-        },
-    }), zValidator('param', commitSeqParamSchema), zValidator('query', commitDetailQuerySchema), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
-        const { seq } = c.req.valid('param');
-        const { partitionId } = c.req.valid('query');
-        let commitQuery = db
-            .selectFrom('sync_commits')
-            .select([
-            'commit_seq',
-            'actor_id',
-            'client_id',
-            'client_commit_id',
-            'created_at',
-            'change_count',
-            'affected_tables',
-        ])
-            .where('commit_seq', '=', seq);
-        if (partitionId) {
-            commitQuery = commitQuery.where('partition_id', '=', partitionId);
-        }
-        const commitRow = await commitQuery.executeTakeFirst();
-        if (!commitRow) {
-            return c.json({ error: 'NOT_FOUND' }, 404);
-        }
-        let changesQuery = db
-            .selectFrom('sync_changes')
-            .select([
-            'change_id',
-            'table',
-            'row_id',
-            'op',
-            'row_json',
-            'row_version',
-            'scopes',
-        ])
-            .where('commit_seq', '=', seq);
-        if (partitionId) {
-            changesQuery = changesQuery.where('partition_id', '=', partitionId);
-        }
-        const changeRows = await changesQuery
-            .orderBy('change_id', 'asc')
-            .execute();
-        const changes = changeRows.map((row) => ({
-            changeId: coerceNumber(row.change_id) ?? 0,
-            table: row.table ?? '',
-            rowId: row.row_id ?? '',
-            op: row.op === 'delete' ? 'delete' : 'upsert',
-            rowJson: typeof row.row_json === 'string'
-                ? (() => {
-                    try {
-                        return JSON.parse(row.row_json);
-                    }
-                    catch {
-                        return row.row_json;
-                    }
-                })()
-                : row.row_json,
-            rowVersion: coerceNumber(row.row_version),
-            scopes: typeof row.scopes === 'string'
-                ? JSON.parse(row.scopes || '{}')
-                : (row.scopes ?? {}),
-        }));
-        const commit = {
-            commitSeq: coerceNumber(commitRow.commit_seq) ?? 0,
-            actorId: commitRow.actor_id ?? '',
-            clientId: commitRow.client_id ?? '',
-            clientCommitId: commitRow.client_commit_id ?? '',
-            createdAt: commitRow.created_at ?? '',
-            changeCount: coerceNumber(commitRow.change_count) ?? 0,
-            affectedTables: Array.isArray(commitRow.affected_tables)
-                ? commitRow.affected_tables
-                : typeof commitRow.affected_tables === 'string'
-                    ? JSON.parse(commitRow.affected_tables || '[]')
-                    : [],
-            changes,
-        };
-        return c.json(commit, 200);
-    });
-    // -------------------------------------------------------------------------
-    // GET /clients
-    // -------------------------------------------------------------------------
-    routes.get('/clients', describeRoute({
-        tags: ['console'],
-        summary: 'List clients',
-        responses: {
-            200: {
-                description: 'Paginated client list',
-                content: {
-                    'application/json': {
-                        schema: resolver(ConsolePaginatedResponseSchema(ConsoleClientSchema)),
-                    },
-                },
-            },
-            401: {
-                description: 'Unauthenticated',
-                content: {
-                    'application/json': { schema: resolver(ErrorResponseSchema) },
-                },
-            },
-        },
-    }), zValidator('query', ConsolePartitionedPaginationQuerySchema), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
-        const { limit, offset, partitionId } = c.req.valid('query');
-        let clientsQuery = db
-            .selectFrom('sync_client_cursors')
-            .select([
-            'client_id',
-            'actor_id',
-            'cursor',
-            'effective_scopes',
-            'updated_at',
-        ]);
-        let countQuery = db
-            .selectFrom('sync_client_cursors')
-            .select(({ fn }) => fn.countAll().as('total'));
-        let maxCommitSeqQuery = db
-            .selectFrom('sync_commits')
-            .select(({ fn }) => fn.max('commit_seq').as('max_commit_seq'));
-        if (partitionId) {
-            clientsQuery = clientsQuery.where('partition_id', '=', partitionId);
-            countQuery = countQuery.where('partition_id', '=', partitionId);
-            maxCommitSeqQuery = maxCommitSeqQuery.where('partition_id', '=', partitionId);
-        }
-        const [rows, countRow, maxCommitSeqRow] = await Promise.all([
-            clientsQuery
-                .orderBy('updated_at', 'desc')
-                .limit(limit)
-                .offset(offset)
-                .execute(),
-            countQuery.executeTakeFirst(),
-            maxCommitSeqQuery.executeTakeFirst(),
-        ]);
-        const maxCommitSeq = coerceNumber(maxCommitSeqRow?.max_commit_seq) ?? 0;
-        const pagedClientIds = rows
-            .map((row) => row.client_id)
-            .filter((clientId) => typeof clientId === 'string');
-        const latestEventsByClientId = new Map();
-        if (pagedClientIds.length > 0) {
-            let recentEventsQuery = db
-                .selectFrom('sync_request_events')
-                .select([
-                'client_id',
-                'event_type',
-                'outcome',
-                'created_at',
-                'transport_path',
-            ])
-                .where('client_id', 'in', pagedClientIds);
-            if (partitionId) {
-                recentEventsQuery = recentEventsQuery.where('partition_id', '=', partitionId);
-            }
-            const recentEventRows = await recentEventsQuery
-                .orderBy('created_at', 'desc')
-                .execute();
-            for (const row of recentEventRows) {
-                const clientId = row.client_id;
-                if (!clientId || latestEventsByClientId.has(clientId)) {
-                    continue;
-                }
-                const eventType = row.event_type === 'push' ? 'push' : 'pull';
-                latestEventsByClientId.set(clientId, {
-                    createdAt: row.created_at ?? '',
-                    eventType,
-                    outcome: row.outcome ?? '',
-                    transportPath: row.transport_path === 'relay' ? 'relay' : 'direct',
-                });
-            }
-        }
-        const items = rows.map((row) => {
-            const clientId = row.client_id ?? '';
-            const cursor = coerceNumber(row.cursor) ?? 0;
-            const latestEvent = latestEventsByClientId.get(clientId);
-            const connectionCount = options.wsConnectionManager?.getConnectionCount(clientId) ?? 0;
-            const connectionPath = options.wsConnectionManager?.getClientTransportPath(clientId) ??
-                latestEvent?.transportPath ??
-                'direct';
-            return {
-                clientId,
-                actorId: row.actor_id ?? '',
-                cursor,
-                lagCommitCount: Math.max(0, maxCommitSeq - cursor),
-                connectionPath,
-                connectionMode: connectionCount > 0 ? 'realtime' : 'polling',
-                realtimeConnectionCount: connectionCount,
-                isRealtimeConnected: connectionCount > 0,
-                activityState: getClientActivityState({
-                    connectionCount,
-                    updatedAt: row.updated_at,
-                }),
-                lastRequestAt: latestEvent?.createdAt ?? null,
-                lastRequestType: latestEvent?.eventType ?? null,
-                lastRequestOutcome: latestEvent?.outcome ?? null,
-                effectiveScopes: options.dialect.dbToScopes(row.effective_scopes),
-                updatedAt: row.updated_at ?? '',
-            };
-        });
-        const total = coerceNumber(countRow?.total) ?? 0;
-        const response = {
-            items,
-            total,
-            offset,
-            limit,
-        };
-        c.header('X-Total-Count', String(total));
-        return c.json(response, 200);
-    });
-    // -------------------------------------------------------------------------
-    // GET /handlers
-    // -------------------------------------------------------------------------
-    routes.get('/handlers', describeRoute({
-        tags: ['console'],
-        summary: 'List registered handlers',
-        responses: {
-            200: {
-                description: 'Handler list',
-                content: {
-                    'application/json': { schema: resolver(handlersResponseSchema) },
-                },
-            },
-            401: {
-                description: 'Unauthenticated',
-                content: {
-                    'application/json': { schema: resolver(ErrorResponseSchema) },
-                },
-            },
-        },
-    }), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
-        const items = options.handlers.map((handler) => ({
-            table: handler.table,
-            dependsOn: handler.dependsOn,
-            snapshotChunkTtlMs: handler.snapshotChunkTtlMs,
-        }));
-        return c.json({ items }, 200);
-    });
-    // -------------------------------------------------------------------------
-    // GET /operations - Operation audit log
-    // -------------------------------------------------------------------------
-    routes.get('/operations', describeRoute({
-        tags: ['console'],
-        summary: 'List operation audit events',
-        responses: {
-            200: {
-                description: 'Paginated operation events',
-                content: {
-                    'application/json': {
-                        schema: resolver(ConsolePaginatedResponseSchema(ConsoleOperationEventSchema)),
-                    },
-                },
-            },
-            401: {
-                description: 'Unauthenticated',
-                content: {
-                    'application/json': { schema: resolver(ErrorResponseSchema) },
-                },
-            },
-        },
-    }), zValidator('query', ConsoleOperationsQuerySchema), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
-        const { limit, offset, operationType, partitionId } = c.req.valid('query');
-        let query = db
-            .selectFrom('sync_operation_events')
-            .select(operationEventSelectColumns);
-        let countQuery = db
-            .selectFrom('sync_operation_events')
-            .select(({ fn }) => fn.countAll().as('total'));
-        if (operationType) {
-            query = query.where('operation_type', '=', operationType);
-            countQuery = countQuery.where('operation_type', '=', operationType);
-        }
-        if (partitionId) {
-            query = query.where('partition_id', '=', partitionId);
-            countQuery = countQuery.where('partition_id', '=', partitionId);
-        }
-        const [rows, countRow] = await Promise.all([
-            query
-                .orderBy('created_at', 'desc')
-                .limit(limit)
-                .offset(offset)
-                .execute(),
-            countQuery.executeTakeFirst(),
-        ]);
-        const items = rows.map((row) => mapOperationEvent(row));
-        const total = coerceNumber(countRow?.total) ?? 0;
-        const response = {
-            items,
-            total,
-            offset,
-            limit,
-        };
-        c.header('X-Total-Count', String(total));
-        return c.json(response, 200);
-    });
-    // -------------------------------------------------------------------------
-    // POST /prune/preview
-    // -------------------------------------------------------------------------
-    routes.post('/prune/preview', describeRoute({
-        tags: ['console'],
-        summary: 'Preview pruning',
-        responses: {
-            200: {
-                description: 'Prune preview',
-                content: {
-                    'application/json': { schema: resolver(ConsolePrunePreviewSchema) },
-                },
-            },
-            401: {
-                description: 'Unauthenticated',
-                content: {
-                    'application/json': { schema: resolver(ErrorResponseSchema) },
-                },
-            },
-        },
-    }), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
-        const watermarkCommitSeq = await computePruneWatermarkCommitSeq(options.db, options.prune);
-        // Count commits that would be deleted
-        const countRow = await db
-            .selectFrom('sync_commits')
-            .select(({ fn }) => fn.countAll().as('count'))
-            .where('commit_seq', '<=', watermarkCommitSeq)
-            .executeTakeFirst();
-        const commitsToDelete = coerceNumber(countRow?.count) ?? 0;
-        const preview = {
-            watermarkCommitSeq,
-            commitsToDelete,
-        };
-        return c.json(preview, 200);
-    });
-    // -------------------------------------------------------------------------
-    // POST /prune
-    // -------------------------------------------------------------------------
-    routes.post('/prune', describeRoute({
-        tags: ['console'],
-        summary: 'Trigger pruning',
-        responses: {
-            200: {
-                description: 'Prune result',
-                content: {
-                    'application/json': { schema: resolver(ConsolePruneResultSchema) },
-                },
-            },
-            401: {
-                description: 'Unauthenticated',
-                content: {
-                    'application/json': { schema: resolver(ErrorResponseSchema) },
-                },
-            },
-        },
-    }), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
-        const watermarkCommitSeq = await computePruneWatermarkCommitSeq(options.db, options.prune);
-        const deletedCommits = await pruneSync(options.db, {
-            watermarkCommitSeq,
-            keepNewestCommits: options.prune?.keepNewestCommits,
-        });
-        logSyncEvent({
-            event: 'console.prune',
-            consoleUserId: auth.consoleUserId,
-            deletedCommits,
-            watermarkCommitSeq,
-        });
-        await recordOperationEvent({
-            operationType: 'prune',
-            consoleUserId: auth.consoleUserId,
-            requestPayload: {
-                watermarkCommitSeq,
-                keepNewestCommits: options.prune?.keepNewestCommits ?? null,
-            },
-            resultPayload: { deletedCommits, watermarkCommitSeq },
-        });
-        const result = { deletedCommits };
-        return c.json(result, 200);
-    });
-    // -------------------------------------------------------------------------
-    // POST /compact
-    // -------------------------------------------------------------------------
-    routes.post('/compact', describeRoute({
-        tags: ['console'],
-        summary: 'Trigger compaction',
-        responses: {
-            200: {
-                description: 'Compact result',
-                content: {
-                    'application/json': {
-                        schema: resolver(ConsoleCompactResultSchema),
-                    },
-                },
-            },
-            401: {
-                description: 'Unauthenticated',
-                content: {
-                    'application/json': { schema: resolver(ErrorResponseSchema) },
-                },
-            },
-        },
-    }), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
-        const fullHistoryHours = options.compact?.fullHistoryHours ?? 24 * 7;
-        const deletedChanges = await compactChanges(options.db, {
-            dialect: options.dialect,
-            options: { fullHistoryHours },
-        });
-        logSyncEvent({
-            event: 'console.compact',
-            consoleUserId: auth.consoleUserId,
-            deletedChanges,
-            fullHistoryHours,
-        });
-        await recordOperationEvent({
-            operationType: 'compact',
-            consoleUserId: auth.consoleUserId,
-            requestPayload: { fullHistoryHours },
-            resultPayload: { deletedChanges },
-        });
-        const result = { deletedChanges };
-        return c.json(result, 200);
-    });
-    // -------------------------------------------------------------------------
-    // POST /notify-data-change
-    // -------------------------------------------------------------------------
-    const NotifyDataChangeRequestSchema = z.object({
-        tables: z.array(z.string().min(1)).min(1),
-        partitionId: z.string().optional(),
-    });
-    const NotifyDataChangeResponseSchema = z.object({
-        commitSeq: z.number(),
-        tables: z.array(z.string()),
-        deletedChunks: z.number(),
-    });
-    routes.post('/notify-data-change', describeRoute({
-        tags: ['console'],
-        summary: 'Notify external data change',
-        description: 'Creates a synthetic commit to force re-bootstrap for affected tables. ' +
-            'Use after pipeline imports or direct DB writes to notify connected clients.',
-        responses: {
-            200: {
-                description: 'Notification result',
-                content: {
-                    'application/json': {
-                        schema: resolver(NotifyDataChangeResponseSchema),
-                    },
-                },
-            },
-            400: {
-                description: 'Invalid request',
-                content: {
-                    'application/json': { schema: resolver(ErrorResponseSchema) },
-                },
-            },
-            401: {
-                description: 'Unauthenticated',
-                content: {
-                    'application/json': { schema: resolver(ErrorResponseSchema) },
-                },
-            },
-        },
-    }), zValidator('json', NotifyDataChangeRequestSchema), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
-        const body = c.req.valid('json');
-        const result = await notifyExternalDataChange({
-            db: options.db,
-            dialect: options.dialect,
-            tables: body.tables,
-            partitionId: body.partitionId,
-        });
-        logSyncEvent({
-            event: 'console.notify_data_change',
-            consoleUserId: auth.consoleUserId,
-            tables: body.tables,
-            commitSeq: result.commitSeq,
-            deletedChunks: result.deletedChunks,
-        });
-        await recordOperationEvent({
-            operationType: 'notify_data_change',
-            consoleUserId: auth.consoleUserId,
-            partitionId: body.partitionId ?? null,
-            requestPayload: {
-                tables: body.tables,
-                partitionId: body.partitionId ?? null,
-            },
-            resultPayload: result,
-        });
-        // Wake all WS clients so they pull immediately
-        if (options.wsConnectionManager) {
-            options.wsConnectionManager.notifyAllClients(result.commitSeq);
-        }
-        return c.json(result, 200);
-    });
-    // -------------------------------------------------------------------------
-    // DELETE /clients/:id
-    // -------------------------------------------------------------------------
-    routes.delete('/clients/:id', describeRoute({
-        tags: ['console'],
-        summary: 'Evict client',
-        responses: {
-            200: {
-                description: 'Evict result',
-                content: {
-                    'application/json': { schema: resolver(ConsoleEvictResultSchema) },
-                },
-            },
-            400: {
-                description: 'Invalid request',
-                content: {
-                    'application/json': { schema: resolver(ErrorResponseSchema) },
-                },
-            },
-            401: {
-                description: 'Unauthenticated',
-                content: {
-                    'application/json': { schema: resolver(ErrorResponseSchema) },
-                },
-            },
-        },
-    }), zValidator('param', clientIdParamSchema), zValidator('query', evictClientQuerySchema), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
-        const { id: clientId } = c.req.valid('param');
-        const { partitionId } = c.req.valid('query');
-        let deleteQuery = db
-            .deleteFrom('sync_client_cursors')
-            .where('client_id', '=', clientId);
-        if (partitionId) {
-            deleteQuery = deleteQuery.where('partition_id', '=', partitionId);
-        }
-        const res = await deleteQuery.executeTakeFirst();
-        const evicted = Number(res?.numDeletedRows ?? 0) > 0;
-        logSyncEvent({
-            event: 'console.evict_client',
-            consoleUserId: auth.consoleUserId,
-            clientId,
-            evicted,
-        });
-        await recordOperationEvent({
-            operationType: 'evict_client',
-            consoleUserId: auth.consoleUserId,
-            partitionId: partitionId ?? null,
-            targetClientId: clientId,
-            requestPayload: { clientId, partitionId: partitionId ?? null },
-            resultPayload: { evicted },
-        });
-        const result = { evicted };
-        return c.json(result, 200);
-    });
-    // -------------------------------------------------------------------------
-    // GET /events - Paginated request events list
-    // -------------------------------------------------------------------------
-    routes.get('/events', describeRoute({
-        tags: ['console'],
-        summary: 'List request events',
-        responses: {
-            200: {
-                description: 'Paginated event list',
-                content: {
-                    'application/json': {
-                        schema: resolver(ConsolePaginatedResponseSchema(ConsoleRequestEventSchema)),
-                    },
-                },
-            },
-            401: {
-                description: 'Unauthenticated',
-                content: {
-                    'application/json': { schema: resolver(ErrorResponseSchema) },
-                },
-            },
-        },
-    }), zValidator('query', eventsQuerySchema), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
-        const { limit, offset, partitionId, eventType, actorId, clientId, requestId, traceId, outcome, } = c.req.valid('query');
-        let query = db
-            .selectFrom('sync_request_events')
-            .select(requestEventSelectColumns);
-        let countQuery = db
-            .selectFrom('sync_request_events')
-            .select(({ fn }) => fn.countAll().as('total'));
-        if (partitionId) {
-            query = query.where('partition_id', '=', partitionId);
-            countQuery = countQuery.where('partition_id', '=', partitionId);
-        }
-        if (eventType) {
-            query = query.where('event_type', '=', eventType);
-            countQuery = countQuery.where('event_type', '=', eventType);
-        }
-        if (actorId) {
-            query = query.where('actor_id', '=', actorId);
-            countQuery = countQuery.where('actor_id', '=', actorId);
-        }
-        if (clientId) {
-            query = query.where('client_id', '=', clientId);
-            countQuery = countQuery.where('client_id', '=', clientId);
-        }
-        if (requestId) {
-            query = query.where('request_id', '=', requestId);
-            countQuery = countQuery.where('request_id', '=', requestId);
-        }
-        if (traceId) {
-            query = query.where('trace_id', '=', traceId);
-            countQuery = countQuery.where('trace_id', '=', traceId);
-        }
-        if (outcome) {
-            query = query.where('outcome', '=', outcome);
-            countQuery = countQuery.where('outcome', '=', outcome);
-        }
-        const [rows, countRow] = await Promise.all([
-            query
-                .orderBy('created_at', 'desc')
-                .limit(limit)
-                .offset(offset)
-                .execute(),
-            countQuery.executeTakeFirst(),
-        ]);
-        const items = rows.map((row) => mapRequestEvent(row));
-        const total = coerceNumber(countRow?.total) ?? 0;
-        const response = {
-            items,
-            total,
-            offset,
-            limit,
-        };
-        c.header('X-Total-Count', String(total));
-        return c.json(response, 200);
-    });
-    // -------------------------------------------------------------------------
-    // GET /events/live - WebSocket for live activity feed
-    // NOTE: Must be defined BEFORE /events/:id to avoid route conflict
-    // -------------------------------------------------------------------------
-    if (options.eventEmitter &&
-        options.websocket?.enabled &&
-        options.websocket?.upgradeWebSocket) {
-        const emitter = options.eventEmitter;
-        const upgradeWebSocket = options.websocket.upgradeWebSocket;
-        const heartbeatIntervalMs = options.websocket.heartbeatIntervalMs ?? 30000;
-        const wsState = new WeakMap();
-        const closeUnauthenticated = (ws) => {
-            try {
-                ws.send(JSON.stringify({ type: 'error', message: 'UNAUTHENTICATED' }));
-            }
-            catch {
-                // ignore send errors
-            }
-            ws.close(4001, 'Unauthenticated');
-        };
-        const cleanup = (ws) => {
-            const state = wsState.get(ws);
-            if (!state)
-                return;
-            if (state.listener) {
-                emitter.removeListener(state.listener);
-            }
-            if (state.heartbeatInterval) {
-                clearInterval(state.heartbeatInterval);
-            }
-            if (state.authTimeout) {
-                clearTimeout(state.authTimeout);
-            }
-            wsState.delete(ws);
-        };
-        routes.get('/events/live', upgradeWebSocket(async (c) => {
-            const authHeader = c.req.header('Authorization');
-            const partitionId = c.req.query('partitionId')?.trim() || undefined;
-            const replaySince = c.req.query('since');
-            const replayLimitRaw = c.req.query('replayLimit');
-            const replayLimitNumber = replayLimitRaw
-                ? Number.parseInt(replayLimitRaw, 10)
-                : Number.NaN;
-            const replayLimit = Number.isFinite(replayLimitNumber)
-                ? Math.max(1, Math.min(500, replayLimitNumber))
-                : 100;
-            const mockContext = {
-                req: {
-                    header: (name) => name === 'Authorization' ? authHeader : undefined,
-                    query: () => undefined,
-                },
-            };
-            const initialAuth = await options.authenticate(mockContext);
-            const authenticateWithBearer = async (token) => {
-                const trimmedToken = token.trim();
-                if (!trimmedToken)
-                    return null;
-                const authContext = {
-                    req: {
-                        header: (name) => name === 'Authorization' ? `Bearer ${trimmedToken}` : undefined,
-                        query: () => undefined,
-                    },
-                };
-                return options.authenticate(authContext);
-            };
-            return {
-                onOpen(_event, ws) {
-                    const state = {
-                        listener: null,
-                        heartbeatInterval: null,
-                        authTimeout: null,
-                        isAuthenticated: false,
-                    };
-                    wsState.set(ws, state);
-                    const startAuthenticatedSession = () => {
-                        if (state.isAuthenticated)
-                            return;
-                        state.isAuthenticated = true;
-                        if (state.authTimeout) {
-                            clearTimeout(state.authTimeout);
-                            state.authTimeout = null;
-                        }
-                        const listener = (event) => {
-                            if (partitionId) {
-                                const eventPartitionId = event.data.partitionId;
-                                if (typeof eventPartitionId !== 'string' ||
-                                    eventPartitionId !== partitionId) {
-                                    return;
-                                }
-                            }
-                            try {
-                                ws.send(JSON.stringify(event));
-                            }
-                            catch {
-                                // Connection closed
-                            }
-                        };
-                        emitter.addListener(listener);
-                        state.listener = listener;
-                        ws.send(JSON.stringify({
-                            type: 'connected',
-                            timestamp: new Date().toISOString(),
-                        }));
-                        const replayEvents = emitter.replay({
-                            since: replaySince,
-                            limit: replayLimit,
-                            partitionId,
-                        });
-                        for (const replayEvent of replayEvents) {
-                            try {
-                                ws.send(JSON.stringify(replayEvent));
-                            }
-                            catch {
-                                // Connection closed
-                                break;
-                            }
-                        }
-                        const heartbeatInterval = setInterval(() => {
-                            try {
-                                ws.send(JSON.stringify({
-                                    type: 'heartbeat',
-                                    timestamp: new Date().toISOString(),
-                                }));
-                            }
-                            catch {
-                                clearInterval(heartbeatInterval);
-                            }
-                        }, heartbeatIntervalMs);
-                        state.heartbeatInterval = heartbeatInterval;
-                    };
-                    if (initialAuth) {
-                        startAuthenticatedSession();
-                        return;
-                    }
-                    state.authTimeout = setTimeout(() => {
-                        const current = wsState.get(ws);
-                        if (!current || current.isAuthenticated) {
-                            return;
-                        }
-                        closeUnauthenticated(ws);
-                        cleanup(ws);
-                    }, 5_000);
-                },
-                async onMessage(event, ws) {
-                    const state = wsState.get(ws);
-                    if (!state || state.isAuthenticated) {
-                        return;
-                    }
-                    if (typeof event.data !== 'string') {
-                        closeUnauthenticated(ws);
-                        cleanup(ws);
-                        return;
-                    }
-                    let token = '';
-                    try {
-                        const parsed = JSON.parse(event.data);
-                        if (parsed.type === 'auth' &&
-                            typeof parsed.token === 'string' &&
-                            parsed.token.trim().length > 0) {
-                            token = parsed.token;
-                        }
-                    }
-                    catch {
-                        // Ignore parse errors and close as unauthenticated below.
-                    }
-                    if (!token) {
-                        closeUnauthenticated(ws);
-                        cleanup(ws);
-                        return;
-                    }
-                    const auth = await authenticateWithBearer(token);
-                    const currentState = wsState.get(ws);
-                    if (!currentState || currentState.isAuthenticated) {
-                        return;
-                    }
-                    if (!auth) {
-                        closeUnauthenticated(ws);
-                        cleanup(ws);
-                        return;
-                    }
-                    currentState.isAuthenticated = true;
-                    if (currentState.authTimeout) {
-                        clearTimeout(currentState.authTimeout);
-                        currentState.authTimeout = null;
-                    }
-                    const listener = (liveEvent) => {
-                        if (partitionId) {
-                            const eventPartitionId = liveEvent.data.partitionId;
-                            if (typeof eventPartitionId !== 'string' ||
-                                eventPartitionId !== partitionId) {
-                                return;
-                            }
-                        }
-                        try {
-                            ws.send(JSON.stringify(liveEvent));
-                        }
-                        catch {
-                            // Connection closed
-                        }
-                    };
-                    emitter.addListener(listener);
-                    currentState.listener = listener;
-                    ws.send(JSON.stringify({
-                        type: 'connected',
-                        timestamp: new Date().toISOString(),
-                    }));
-                    const replayEvents = emitter.replay({
-                        since: replaySince,
-                        limit: replayLimit,
-                        partitionId,
-                    });
-                    for (const replayEvent of replayEvents) {
-                        try {
-                            ws.send(JSON.stringify(replayEvent));
-                        }
-                        catch {
-                            // Connection closed
-                            break;
-                        }
-                    }
-                    const heartbeatInterval = setInterval(() => {
-                        try {
-                            ws.send(JSON.stringify({
-                                type: 'heartbeat',
-                                timestamp: new Date().toISOString(),
-                            }));
-                        }
-                        catch {
-                            clearInterval(heartbeatInterval);
-                        }
-                    }, heartbeatIntervalMs);
-                    currentState.heartbeatInterval = heartbeatInterval;
-                },
-                onClose(_event, ws) {
-                    cleanup(ws);
-                },
-                onError(_event, ws) {
-                    cleanup(ws);
-                },
-            };
-        }));
-    }
-    // -------------------------------------------------------------------------
-    // GET /events/:id - Single event detail
-    // -------------------------------------------------------------------------
-    routes.get('/events/:id', describeRoute({
-        tags: ['console'],
-        summary: 'Get event details',
-        responses: {
-            200: {
-                description: 'Event details',
-                content: {
-                    'application/json': {
-                        schema: resolver(ConsoleRequestEventSchema),
-                    },
-                },
-            },
-            400: {
-                description: 'Invalid request',
-                content: {
-                    'application/json': { schema: resolver(ErrorResponseSchema) },
-                },
-            },
-            401: {
-                description: 'Unauthenticated',
-                content: {
-                    'application/json': { schema: resolver(ErrorResponseSchema) },
-                },
-            },
-            404: {
-                description: 'Not found',
-                content: {
-                    'application/json': { schema: resolver(ErrorResponseSchema) },
-                },
-            },
-        },
-    }), zValidator('param', eventIdParamSchema), zValidator('query', eventDetailQuerySchema), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
-        const { id: eventId } = c.req.valid('param');
-        const { partitionId } = c.req.valid('query');
-        let eventQuery = db
-            .selectFrom('sync_request_events')
-            .select(requestEventSelectColumns)
-            .where('event_id', '=', eventId);
-        if (partitionId) {
-            eventQuery = eventQuery.where('partition_id', '=', partitionId);
-        }
-        const row = await eventQuery.executeTakeFirst();
-        if (!row) {
-            return c.json({ error: 'NOT_FOUND' }, 404);
-        }
-        return c.json(mapRequestEvent(row), 200);
-    });
-    // -------------------------------------------------------------------------
-    // GET /events/:id/payload - payload snapshot detail (if retained)
-    // -------------------------------------------------------------------------
-    routes.get('/events/:id/payload', describeRoute({
-        tags: ['console'],
-        summary: 'Get event payload snapshot',
-        responses: {
-            200: {
-                description: 'Payload snapshot details',
-                content: {
-                    'application/json': {
-                        schema: resolver(ConsoleRequestPayloadSchema),
-                    },
-                },
-            },
-            400: {
-                description: 'Invalid request',
-                content: {
-                    'application/json': { schema: resolver(ErrorResponseSchema) },
-                },
-            },
-            401: {
-                description: 'Unauthenticated',
-                content: {
-                    'application/json': { schema: resolver(ErrorResponseSchema) },
-                },
-            },
-            404: {
-                description: 'Not found',
-                content: {
-                    'application/json': { schema: resolver(ErrorResponseSchema) },
-                },
-            },
-        },
-    }), zValidator('param', eventIdParamSchema), zValidator('query', eventDetailQuerySchema), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
-        const { id: eventId } = c.req.valid('param');
-        const { partitionId } = c.req.valid('query');
-        let eventQuery = db
-            .selectFrom('sync_request_events')
-            .select(['payload_ref', 'partition_id'])
-            .where('event_id', '=', eventId);
-        if (partitionId) {
-            eventQuery = eventQuery.where('partition_id', '=', partitionId);
-        }
-        const eventRow = await eventQuery.executeTakeFirst();
-        if (!eventRow) {
-            return c.json({ error: 'NOT_FOUND' }, 404);
-        }
-        const payloadRef = eventRow.payload_ref;
-        if (!payloadRef) {
-            return c.json({ error: 'NOT_FOUND', message: 'No payload snapshot recorded' }, 404);
-        }
-        const payloadRow = await db
-            .selectFrom('sync_request_payloads')
-            .select([
-            'payload_ref',
-            'partition_id',
-            'request_payload',
-            'response_payload',
-            'created_at',
-        ])
-            .where('payload_ref', '=', payloadRef)
-            .where('partition_id', '=', eventRow.partition_id)
-            .executeTakeFirst();
-        if (!payloadRow) {
-            return c.json({ error: 'NOT_FOUND', message: 'Payload snapshot not available' }, 404);
-        }
-        const payload = {
-            payloadRef: payloadRow.payload_ref,
-            partitionId: payloadRow.partition_id,
-            requestPayload: parseJsonValue(payloadRow.request_payload),
-            responsePayload: parseJsonValue(payloadRow.response_payload),
-            createdAt: payloadRow.created_at,
-        };
-        return c.json(payload, 200);
-    });
-    // -------------------------------------------------------------------------
-    // DELETE /events - Clear all events
-    // -------------------------------------------------------------------------
-    routes.delete('/events', describeRoute({
-        tags: ['console'],
-        summary: 'Clear all events',
-        responses: {
-            200: {
-                description: 'Clear result',
-                content: {
-                    'application/json': {
-                        schema: resolver(ConsoleClearEventsResultSchema),
-                    },
-                },
-            },
-            401: {
-                description: 'Unauthenticated',
-                content: {
-                    'application/json': { schema: resolver(ErrorResponseSchema) },
-                },
-            },
-        },
-    }), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
-        const res = await db.deleteFrom('sync_request_events').executeTakeFirst();
-        const deletedCount = Number(res?.numDeletedRows ?? 0);
-        const payloadDeletedCount = await deleteUnreferencedPayloadSnapshots();
-        logSyncEvent({
-            event: 'console.clear_events',
-            consoleUserId: auth.consoleUserId,
-            deletedCount,
-            payloadDeletedCount,
-        });
-        const result = { deletedCount };
-        return c.json(result, 200);
-    });
-    // -------------------------------------------------------------------------
-    // POST /events/prune - Prune old events
-    // -------------------------------------------------------------------------
-    routes.post('/events/prune', describeRoute({
-        tags: ['console'],
-        summary: 'Prune old events',
-        responses: {
-            200: {
-                description: 'Prune result',
-                content: {
-                    'application/json': {
-                        schema: resolver(ConsolePruneEventsResultSchema),
-                    },
-                },
-            },
-            401: {
-                description: 'Unauthenticated',
-                content: {
-                    'application/json': { schema: resolver(ErrorResponseSchema) },
-                },
-            },
-        },
-    }), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
-        // Prune events older than 7 days or keep max 10000 events
-        const cutoffDate = new Date(Date.now() - 7 * 24 * 60 * 60 * 1000);
-        // Delete by date first
-        const resByDate = await db
-            .deleteFrom('sync_request_events')
-            .where('created_at', '<', cutoffDate.toISOString())
-            .executeTakeFirst();
-        let deletedCount = Number(resByDate?.numDeletedRows ?? 0);
-        // Then delete oldest if we still have more than 10000 events
-        const countRow = await db
-            .selectFrom('sync_request_events')
-            .select(({ fn }) => fn.countAll().as('total'))
-            .executeTakeFirst();
-        const total = coerceNumber(countRow?.total) ?? 0;
-        const maxEvents = 10000;
-        if (total > maxEvents) {
-            // Find event_id cutoff to keep only newest maxEvents
-            const cutoffRow = await db
-                .selectFrom('sync_request_events')
-                .select(['event_id'])
-                .orderBy('event_id', 'desc')
-                .offset(maxEvents)
-                .limit(1)
-                .executeTakeFirst();
-            if (cutoffRow) {
-                const cutoffEventId = coerceNumber(cutoffRow.event_id);
-                if (cutoffEventId !== null) {
-                    const resByCount = await db
-                        .deleteFrom('sync_request_events')
-                        .where('event_id', '<=', cutoffEventId)
-                        .executeTakeFirst();
-                    deletedCount += Number(resByCount?.numDeletedRows ?? 0);
-                }
-            }
-        }
-        const payloadDeletedCount = await deleteUnreferencedPayloadSnapshots();
-        logSyncEvent({
-            event: 'console.prune_events',
-            consoleUserId: auth.consoleUserId,
-            deletedCount,
-            payloadDeletedCount,
-        });
-        const result = { deletedCount };
-        return c.json(result, 200);
-    });
-    // -------------------------------------------------------------------------
-    // GET /api-keys - List all API keys
-    // -------------------------------------------------------------------------
-    routes.get('/api-keys', describeRoute({
-        tags: ['console'],
-        summary: 'List API keys',
-        responses: {
-            200: {
-                description: 'Paginated API key list',
-                content: {
-                    'application/json': {
-                        schema: resolver(ConsolePaginatedResponseSchema(ConsoleApiKeySchema)),
-                    },
-                },
-            },
-            401: {
-                description: 'Unauthenticated',
-                content: {
-                    'application/json': { schema: resolver(ErrorResponseSchema) },
-                },
-            },
-        },
-    }), zValidator('query', apiKeysQuerySchema), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
-        const { limit, offset, type: keyType, status, expiresWithinDays, } = c.req.valid('query');
-        let query = db
-            .selectFrom('sync_api_keys')
-            .select([
-            'key_id',
-            'key_prefix',
-            'name',
-            'key_type',
-            'scope_keys',
-            'actor_id',
-            'created_at',
-            'expires_at',
-            'last_used_at',
-            'revoked_at',
-        ]);
-        let countQuery = db
-            .selectFrom('sync_api_keys')
-            .select(({ fn }) => fn.countAll().as('total'));
-        if (keyType) {
-            query = query.where('key_type', '=', keyType);
-            countQuery = countQuery.where('key_type', '=', keyType);
-        }
-        const now = new Date();
-        const nowIso = now.toISOString();
-        const expiringThresholdIso = new Date(now.getTime() + (expiresWithinDays ?? 14) * 24 * 60 * 60 * 1000).toISOString();
-        if (status === 'active') {
-            query = query
-                .where('revoked_at', 'is', null)
-                .where((eb) => eb.or([eb('expires_at', 'is', null), eb('expires_at', '>', nowIso)]));
-            countQuery = countQuery
-                .where('revoked_at', 'is', null)
-                .where((eb) => eb.or([eb('expires_at', 'is', null), eb('expires_at', '>', nowIso)]));
-        }
-        else if (status === 'revoked') {
-            query = query.where('revoked_at', 'is not', null);
-            countQuery = countQuery.where('revoked_at', 'is not', null);
-        }
-        else if (status === 'expiring') {
-            query = query
-                .where('revoked_at', 'is', null)
-                .where('expires_at', '>', nowIso)
-                .where('expires_at', '<=', expiringThresholdIso);
-            countQuery = countQuery
-                .where('revoked_at', 'is', null)
-                .where('expires_at', '>', nowIso)
-                .where('expires_at', '<=', expiringThresholdIso);
-        }
-        const [rows, countRow] = await Promise.all([
-            query
-                .orderBy('created_at', 'desc')
-                .limit(limit)
-                .offset(offset)
-                .execute(),
-            countQuery.executeTakeFirst(),
-        ]);
-        const items = rows.map((row) => ({
-            keyId: row.key_id ?? '',
-            keyPrefix: row.key_prefix ?? '',
-            name: row.name ?? '',
-            keyType: row.key_type,
-            scopeKeys: options.dialect.dbToArray(row.scope_keys),
-            actorId: row.actor_id ?? null,
-            createdAt: row.created_at ?? '',
-            expiresAt: row.expires_at ?? null,
-            lastUsedAt: row.last_used_at ?? null,
-            revokedAt: row.revoked_at ?? null,
-        }));
-        const totalCount = coerceNumber(countRow?.total) ?? 0;
-        const response = {
-            items,
-            total: totalCount,
-            offset,
-            limit,
-        };
-        c.header('X-Total-Count', String(totalCount));
-        return c.json(response, 200);
-    });
-    // -------------------------------------------------------------------------
-    // POST /api-keys - Create new API key
-    // -------------------------------------------------------------------------
-    routes.post('/api-keys', describeRoute({
-        tags: ['console'],
-        summary: 'Create API key',
-        responses: {
-            201: {
-                description: 'Created API key',
-                content: {
-                    'application/json': {
-                        schema: resolver(ConsoleApiKeyCreateResponseSchema),
-                    },
-                },
-            },
-            400: {
-                description: 'Invalid request',
-                content: {
-                    'application/json': { schema: resolver(ErrorResponseSchema) },
-                },
-            },
-            401: {
-                description: 'Unauthenticated',
-                content: {
-                    'application/json': { schema: resolver(ErrorResponseSchema) },
-                },
-            },
-        },
-    }), zValidator('json', ConsoleApiKeyCreateRequestSchema), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
-        const body = c.req.valid('json');
-        // Generate key components
-        const keyId = generateKeyId();
-        const secretKey = generateSecretKey(body.keyType);
-        const keyHash = await hashApiKey(secretKey);
-        const keyPrefix = secretKey.slice(0, 12);
-        // Calculate expiry
-        let expiresAt = null;
-        if (body.expiresInDays && body.expiresInDays > 0) {
-            expiresAt = new Date(Date.now() + body.expiresInDays * 24 * 60 * 60 * 1000).toISOString();
-        }
-        const scopeKeys = body.scopeKeys ?? [];
-        const now = new Date().toISOString();
-        // Insert into database
-        await db
-            .insertInto('sync_api_keys')
-            .values({
-            key_id: keyId,
-            key_hash: keyHash,
-            key_prefix: keyPrefix,
-            name: body.name,
-            key_type: body.keyType,
-            scope_keys: options.dialect.arrayToDb(scopeKeys),
-            actor_id: body.actorId ?? null,
-            created_at: now,
-            expires_at: expiresAt,
-            last_used_at: null,
-            revoked_at: null,
-        })
-            .execute();
-        logSyncEvent({
-            event: 'console.create_api_key',
-            consoleUserId: auth.consoleUserId,
-            keyId,
-            keyType: body.keyType,
-        });
-        const key = {
-            keyId,
-            keyPrefix,
-            name: body.name,
-            keyType: body.keyType,
-            scopeKeys,
-            actorId: body.actorId ?? null,
-            createdAt: now,
-            expiresAt,
-            lastUsedAt: null,
-            revokedAt: null,
-        };
-        const response = {
-            key,
-            secretKey,
-        };
-        return c.json(response, 201);
-    });
-    // -------------------------------------------------------------------------
-    // GET /api-keys/:id - Get single API key
-    // -------------------------------------------------------------------------
-    routes.get('/api-keys/:id', describeRoute({
-        tags: ['console'],
-        summary: 'Get API key',
-        responses: {
-            200: {
-                description: 'API key details',
-                content: {
-                    'application/json': { schema: resolver(ConsoleApiKeySchema) },
-                },
-            },
-            401: {
-                description: 'Unauthenticated',
-                content: {
-                    'application/json': { schema: resolver(ErrorResponseSchema) },
-                },
-            },
-            404: {
-                description: 'Not found',
-                content: {
-                    'application/json': { schema: resolver(ErrorResponseSchema) },
-                },
-            },
-        },
-    }), zValidator('param', apiKeyIdParamSchema), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
-        const { id: keyId } = c.req.valid('param');
-        const row = await db
-            .selectFrom('sync_api_keys')
-            .select([
-            'key_id',
-            'key_prefix',
-            'name',
-            'key_type',
-            'scope_keys',
-            'actor_id',
-            'created_at',
-            'expires_at',
-            'last_used_at',
-            'revoked_at',
-        ])
-            .where('key_id', '=', keyId)
-            .executeTakeFirst();
-        if (!row) {
-            return c.json({ error: 'NOT_FOUND' }, 404);
-        }
-        const key = {
-            keyId: row.key_id ?? '',
-            keyPrefix: row.key_prefix ?? '',
-            name: row.name ?? '',
-            keyType: row.key_type,
-            scopeKeys: options.dialect.dbToArray(row.scope_keys),
-            actorId: row.actor_id ?? null,
-            createdAt: row.created_at ?? '',
-            expiresAt: row.expires_at ?? null,
-            lastUsedAt: row.last_used_at ?? null,
-            revokedAt: row.revoked_at ?? null,
-        };
-        return c.json(key, 200);
-    });
-    // -------------------------------------------------------------------------
-    // DELETE /api-keys/:id - Revoke API key (soft delete)
-    // -------------------------------------------------------------------------
-    routes.delete('/api-keys/:id', describeRoute({
-        tags: ['console'],
-        summary: 'Revoke API key',
-        responses: {
-            200: {
-                description: 'Revoke result',
-                content: {
-                    'application/json': {
-                        schema: resolver(ConsoleApiKeyRevokeResponseSchema),
-                    },
-                },
-            },
-            401: {
-                description: 'Unauthenticated',
-                content: {
-                    'application/json': { schema: resolver(ErrorResponseSchema) },
-                },
-            },
-        },
-    }), zValidator('param', apiKeyIdParamSchema), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
-        const { id: keyId } = c.req.valid('param');
-        const now = new Date().toISOString();
-        const res = await db
-            .updateTable('sync_api_keys')
-            .set({ revoked_at: now })
-            .where('key_id', '=', keyId)
-            .where('revoked_at', 'is', null)
-            .executeTakeFirst();
-        const revoked = Number(res?.numUpdatedRows ?? 0) > 0;
-        logSyncEvent({
-            event: 'console.revoke_api_key',
-            consoleUserId: auth.consoleUserId,
-            keyId,
-            revoked,
-        });
-        return c.json({ revoked }, 200);
-    });
-    // -------------------------------------------------------------------------
-    // POST /api-keys/bulk-revoke - Revoke multiple API keys
-    // -------------------------------------------------------------------------
-    routes.post('/api-keys/bulk-revoke', describeRoute({
-        tags: ['console'],
-        summary: 'Bulk revoke API keys',
-        responses: {
-            200: {
-                description: 'Bulk revoke result',
-                content: {
-                    'application/json': {
-                        schema: resolver(ConsoleApiKeyBulkRevokeResponseSchema),
-                    },
-                },
-            },
-            400: {
-                description: 'Invalid request',
-                content: {
-                    'application/json': { schema: resolver(ErrorResponseSchema) },
-                },
-            },
-            401: {
-                description: 'Unauthenticated',
-                content: {
-                    'application/json': { schema: resolver(ErrorResponseSchema) },
-                },
-            },
-        },
-    }), zValidator('json', ConsoleApiKeyBulkRevokeRequestSchema), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
-        const body = c.req.valid('json');
-        const keyIds = [...new Set(body.keyIds.map((keyId) => keyId.trim()))]
-            .filter((keyId) => keyId.length > 0)
-            .slice(0, 200);
-        if (keyIds.length === 0) {
-            return c.json({ error: 'INVALID_REQUEST', message: 'No API key IDs provided' }, 400);
-        }
-        const now = new Date().toISOString();
-        const existingRows = await db
-            .selectFrom('sync_api_keys')
-            .select(['key_id', 'revoked_at'])
-            .where('key_id', 'in', keyIds)
-            .execute();
-        const existingById = new Map(existingRows.map((row) => [row.key_id, row.revoked_at]));
-        const notFoundKeyIds = [];
-        const alreadyRevokedKeyIds = [];
-        const revokeCandidateKeyIds = [];
-        for (const keyId of keyIds) {
-            const revokedAt = existingById.get(keyId);
-            if (revokedAt === undefined) {
-                notFoundKeyIds.push(keyId);
-            }
-            else if (revokedAt !== null) {
-                alreadyRevokedKeyIds.push(keyId);
-            }
-            else {
-                revokeCandidateKeyIds.push(keyId);
-            }
-        }
-        let revokedCount = 0;
-        if (revokeCandidateKeyIds.length > 0) {
-            const updateResult = await db
-                .updateTable('sync_api_keys')
-                .set({ revoked_at: now })
-                .where('key_id', 'in', revokeCandidateKeyIds)
-                .where('revoked_at', 'is', null)
-                .executeTakeFirst();
-            revokedCount = Number(updateResult?.numUpdatedRows ?? 0);
-        }
-        const response = {
-            requestedCount: keyIds.length,
-            revokedCount,
-            alreadyRevokedCount: alreadyRevokedKeyIds.length,
-            notFoundCount: notFoundKeyIds.length,
-            revokedKeyIds: revokeCandidateKeyIds,
-            alreadyRevokedKeyIds,
-            notFoundKeyIds,
-        };
-        logSyncEvent({
-            event: 'console.bulk_revoke_api_keys',
-            consoleUserId: auth.consoleUserId,
-            requestedCount: response.requestedCount,
-            revokedCount: response.revokedCount,
-            alreadyRevokedCount: response.alreadyRevokedCount,
-            notFoundCount: response.notFoundCount,
-        });
-        return c.json(response, 200);
-    });
-    // -------------------------------------------------------------------------
-    // POST /api-keys/:id/rotate/stage - Stage rotate API key (keep old active)
-    // -------------------------------------------------------------------------
-    routes.post('/api-keys/:id/rotate/stage', describeRoute({
-        tags: ['console'],
-        summary: 'Stage rotate API key',
-        responses: {
-            200: {
-                description: 'Staged API key replacement',
-                content: {
-                    'application/json': {
-                        schema: resolver(ConsoleApiKeyCreateResponseSchema),
-                    },
-                },
-            },
-            401: {
-                description: 'Unauthenticated',
-                content: {
-                    'application/json': { schema: resolver(ErrorResponseSchema) },
-                },
-            },
-            404: {
-                description: 'Not found',
-                content: {
-                    'application/json': { schema: resolver(ErrorResponseSchema) },
-                },
-            },
-        },
-    }), zValidator('param', apiKeyIdParamSchema), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
-        const { id: keyId } = c.req.valid('param');
-        const now = new Date().toISOString();
-        const existingRow = await db
-            .selectFrom('sync_api_keys')
-            .select([
-            'name',
-            'key_type',
-            'scope_keys',
-            'actor_id',
-            'expires_at',
-            'revoked_at',
-        ])
-            .where('key_id', '=', keyId)
-            .where('revoked_at', 'is', null)
-            .executeTakeFirst();
-        if (!existingRow) {
-            return c.json({ error: 'NOT_FOUND' }, 404);
-        }
-        const newKeyId = generateKeyId();
-        const keyType = existingRow.key_type;
-        const secretKey = generateSecretKey(keyType);
-        const keyHash = await hashApiKey(secretKey);
-        const keyPrefix = secretKey.slice(0, 12);
-        const scopeKeys = options.dialect.dbToArray(existingRow.scope_keys);
-        await db
-            .insertInto('sync_api_keys')
-            .values({
-            key_id: newKeyId,
-            key_hash: keyHash,
-            key_prefix: keyPrefix,
-            name: existingRow.name,
-            key_type: keyType,
-            scope_keys: options.dialect.arrayToDb(scopeKeys),
-            actor_id: existingRow.actor_id ?? null,
-            created_at: now,
-            expires_at: existingRow.expires_at,
-            last_used_at: null,
-            revoked_at: null,
-        })
-            .execute();
-        logSyncEvent({
-            event: 'console.stage_rotate_api_key',
-            consoleUserId: auth.consoleUserId,
-            oldKeyId: keyId,
-            newKeyId,
-        });
-        const key = {
-            keyId: newKeyId,
-            keyPrefix,
-            name: existingRow.name,
-            keyType,
-            scopeKeys,
-            actorId: existingRow.actor_id ?? null,
-            createdAt: now,
-            expiresAt: existingRow.expires_at ?? null,
-            lastUsedAt: null,
-            revokedAt: null,
-        };
-        const response = {
-            key,
-            secretKey,
-        };
-        return c.json(response, 200);
-    });
-    // -------------------------------------------------------------------------
-    // POST /api-keys/:id/rotate - Rotate API key
-    // -------------------------------------------------------------------------
-    routes.post('/api-keys/:id/rotate', describeRoute({
-        tags: ['console'],
-        summary: 'Rotate API key',
-        responses: {
-            200: {
-                description: 'Rotated API key',
-                content: {
-                    'application/json': {
-                        schema: resolver(ConsoleApiKeyCreateResponseSchema),
-                    },
-                },
-            },
-            401: {
-                description: 'Unauthenticated',
-                content: {
-                    'application/json': { schema: resolver(ErrorResponseSchema) },
-                },
-            },
-            404: {
-                description: 'Not found',
-                content: {
-                    'application/json': { schema: resolver(ErrorResponseSchema) },
-                },
-            },
-        },
-    }), zValidator('param', apiKeyIdParamSchema), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
-        const { id: keyId } = c.req.valid('param');
-        const now = new Date().toISOString();
-        // Get existing key
-        const existingRow = await db
-            .selectFrom('sync_api_keys')
-            .select([
-            'key_id',
-            'name',
-            'key_type',
-            'scope_keys',
-            'actor_id',
-            'expires_at',
-        ])
-            .where('key_id', '=', keyId)
-            .where('revoked_at', 'is', null)
-            .executeTakeFirst();
-        if (!existingRow) {
-            return c.json({ error: 'NOT_FOUND' }, 404);
-        }
-        // Revoke old key
-        await db
-            .updateTable('sync_api_keys')
-            .set({ revoked_at: now })
-            .where('key_id', '=', keyId)
-            .execute();
-        // Create new key with same properties
-        const newKeyId = generateKeyId();
-        const keyType = existingRow.key_type;
-        const secretKey = generateSecretKey(keyType);
-        const keyHash = await hashApiKey(secretKey);
-        const keyPrefix = secretKey.slice(0, 12);
-        const scopeKeys = options.dialect.dbToArray(existingRow.scope_keys);
-        await db
-            .insertInto('sync_api_keys')
-            .values({
-            key_id: newKeyId,
-            key_hash: keyHash,
-            key_prefix: keyPrefix,
-            name: existingRow.name,
-            key_type: keyType,
-            scope_keys: options.dialect.arrayToDb(scopeKeys),
-            actor_id: existingRow.actor_id ?? null,
-            created_at: now,
-            expires_at: existingRow.expires_at,
-            last_used_at: null,
-            revoked_at: null,
-        })
-            .execute();
-        logSyncEvent({
-            event: 'console.rotate_api_key',
-            consoleUserId: auth.consoleUserId,
-            oldKeyId: keyId,
-            newKeyId,
-        });
-        const key = {
-            keyId: newKeyId,
-            keyPrefix,
-            name: existingRow.name,
-            keyType,
-            scopeKeys,
-            actorId: existingRow.actor_id ?? null,
-            createdAt: now,
-            expiresAt: existingRow.expires_at ?? null,
-            lastUsedAt: null,
-            revokedAt: null,
-        };
-        const response = {
-            key,
-            secretKey,
-        };
-        return c.json(response, 200);
-    });
-    // -----------------------------------------------------------------------
-    // Storage endpoints
-    // -----------------------------------------------------------------------
-    const bucket = options.blobBucket;
-    routes.get('/storage', describeRoute({
-        tags: ['console'],
-        summary: 'List storage items',
-        responses: {
-            200: {
-                description: 'Paginated list of storage items',
-                content: {
-                    'application/json': {
-                        schema: resolver(ConsoleBlobListResponseSchema),
-                    },
-                },
-            },
-            401: {
-                description: 'Unauthenticated',
-                content: {
-                    'application/json': { schema: resolver(ErrorResponseSchema) },
-                },
-            },
-        },
-    }), zValidator('query', ConsoleBlobListQuerySchema), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
-        if (!bucket) {
-            return c.json({ error: 'BLOB_STORAGE_NOT_CONFIGURED' }, 501);
-        }
-        const { prefix, cursor, limit } = c.req.valid('query');
-        const listed = await bucket.list({
-            prefix: prefix || undefined,
-            cursor: cursor || undefined,
-            limit,
-        });
-        return c.json({
-            items: listed.objects.map((obj) => ({
-                key: obj.key,
-                size: obj.size,
-                uploaded: obj.uploaded.toISOString(),
-                httpMetadata: obj.httpMetadata?.contentType
-                    ? { contentType: obj.httpMetadata.contentType }
-                    : undefined,
-            })),
-            truncated: listed.truncated,
-            cursor: listed.cursor ?? null,
-        }, 200);
-    });
-    routes.get('/storage/:key{.+}/download', describeRoute({
-        tags: ['console'],
-        summary: 'Download a storage item',
-        responses: {
-            200: { description: 'Storage item contents' },
-            401: {
-                description: 'Unauthenticated',
-                content: {
-                    'application/json': { schema: resolver(ErrorResponseSchema) },
-                },
-            },
-            404: {
-                description: 'Blob not found',
-                content: {
-                    'application/json': { schema: resolver(ErrorResponseSchema) },
-                },
-            },
-        },
-    }), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
-        if (!bucket) {
-            return c.json({ error: 'BLOB_STORAGE_NOT_CONFIGURED' }, 501);
-        }
-        const key = decodeURIComponent(c.req.param('key'));
-        const object = await bucket.get(key);
-        if (!object) {
-            return c.json({ error: 'BLOB_NOT_FOUND' }, 404);
-        }
-        const headers = new Headers();
-        headers.set('Content-Length', String(object.size));
-        headers.set('Content-Type', object.httpMetadata?.contentType ?? 'application/octet-stream');
-        const filename = key.split('/').pop() || key;
-        headers.set('Content-Disposition', `attachment; filename="${filename.replace(/"/g, '\\"')}"`);
-        return new Response(object.body, {
-            status: 200,
-            headers,
-        });
-    });
-    routes.delete('/storage/:key{.+}', describeRoute({
-        tags: ['console'],
-        summary: 'Delete a storage item',
-        responses: {
-            200: {
-                description: 'Storage item deleted',
-                content: {
-                    'application/json': {
-                        schema: resolver(ConsoleBlobDeleteResponseSchema),
-                    },
-                },
-            },
-            401: {
-                description: 'Unauthenticated',
-                content: {
-                    'application/json': { schema: resolver(ErrorResponseSchema) },
-                },
-            },
-        },
-    }), async (c) => {
-        const auth = await requireAuth(c);
-        if (!auth)
-            return c.json({ error: 'UNAUTHENTICATED' }, 401);
-        if (!bucket) {
-            return c.json({ error: 'BLOB_STORAGE_NOT_CONFIGURED' }, 501);
-        }
-        const key = decodeURIComponent(c.req.param('key'));
-        await bucket.delete(key);
-        return c.json({ deleted: true }, 200);
-    });
-    return routes;
-}
-// ===========================================================================
-// API Key Utilities
-// ===========================================================================
-function generateKeyId() {
-    const bytes = new Uint8Array(16);
-    crypto.getRandomValues(bytes);
-    return Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('');
-}
-function generateSecretKey(keyType) {
-    const bytes = new Uint8Array(24);
-    crypto.getRandomValues(bytes);
-    const random = Array.from(bytes, (b) => b.toString(16).padStart(2, '0')).join('');
-    return `sk_${keyType}_${random}`;
-}
-async function hashApiKey(secretKey) {
-    const encoder = new TextEncoder();
-    const data = encoder.encode(secretKey);
-    const hashBuffer = await crypto.subtle.digest('SHA-256', data);
-    const hashArray = new Uint8Array(hashBuffer);
-    return Array.from(hashArray, (b) => b.toString(16).padStart(2, '0')).join('');
-}
-/**
- * Creates a simple token-based authenticator for local development.
- * The token can be set via SYNC_CONSOLE_TOKEN env var or passed directly.
- */
-export function createTokenAuthenticator(token) {
-    const expectedToken = (token ?? process.env.SYNC_CONSOLE_TOKEN)?.trim() ?? '';
-    return async (c) => {
-        if (!expectedToken)
-            return null;
-        const authHeader = c.req.header('Authorization')?.trim();
-        if (authHeader?.startsWith('Bearer ')) {
-            const bearerToken = authHeader.slice(7).trim();
-            if (bearerToken === expectedToken) {
-                return { consoleUserId: 'token' };
-            }
-        }
-        return null;
-    };
-}
-//# sourceMappingURL=routes.js.map