@voltro/cli 0.11.3 → 0.12.0

package/dist/{start-Crl39M38.js → start-DKcQd52a.js}

@@ -1,13 +1,14 @@
-import { A as e, C as t, Ct as n, E as r, Et as i, G as a, H as o, I as s, J as c, Mt as l, N as u, O as d, R as ee, St as f, Tt as p, U as m, V as h, W as g, Z as _, _ as v, _t as te, a as y, at as b, b as x, c as ne, f as S, g as re, gt as C, h as w, i as T, j as E, k as D, kt as O, m as k, o as ie, p as ae, q as A, r as oe, s as se, t as ce, v as j, w as le, wt as M, y as N } from "./inspectMetrics-SRtv8KDy.js";
-import { t as ue } from "./bootTiming-BdyP9nYw.js";
-import { dirname as P, extname as F, join as I, resolve as L } from "node:path";
-import { fileURLToPath as R, pathToFileURL as de } from "node:url";
-import { createLogger as z, printReadyBlock as fe } from "@voltro/logger";
-import { promises as B } from "node:fs";
-import { snapshotMetricsSync as pe } from "@voltro/runtime";
-import { createServer as me } from "node:http";
+import { $ as e, A as t, C as n, E as r, G as i, H as a, I as o, J as s, N as c, O as l, Q as u, R as ee, U as d, V as f, W as p, _ as m, a as h, at as g, b as _, c as v, ct as y, et as b, f as te, g as x, h as S, i as C, j as w, k as ne, m as T, nt as re, o as ie, p as E, q as D, r as O, s as k, t as A, tt as j, v as M, w as ae, y as N } from "./inspectMetrics-uEfIS1vp.js";
+import { D as oe, E as se, T as ce, a as P, p as le, w as ue } from "./inspect-Dwx0_tUj.js";
+import { t as de } from "./bootTiming-BdyP9nYw.js";
+import { dirname as fe, extname as F, join as I, resolve as L } from "node:path";
+import { fileURLToPath as R, pathToFileURL as z } from "node:url";
+import { createLogger as B, printReadyBlock as pe } from "@voltro/logger";
+import { promises as V } from "node:fs";
+import { snapshotMetricsSync as me } from "@voltro/runtime";
+import { createServer as he } from "node:http";
 //#region src/isrCdcInvalidator.ts
-var V = z({ scope: "voltro:start:cdc" }), H = (e) => (t) => {
+var H = B({ scope: "voltro:start:cdc" }), U = (e) => (t) => {
 	let n = 0;
 	for (let [r, i] of e.tableSubscriptionsByPattern) {
 		if (!i.includes(t)) continue;
@@ -18,23 +19,23 @@ var V = z({ scope: "voltro:start:cdc" }), H = (e) => (t) => {
 		}));
 	}
 	return n;
-}, U = () => !process.env.PG_HOST && !process.env.PG_DATABASE ? null : {
+}, W = () => !process.env.PG_HOST && !process.env.PG_DATABASE ? null : {
 	host: process.env.PG_HOST ?? "localhost",
 	port: Number(process.env.PG_PORT ?? 5432),
 	user: process.env.PG_USER ?? "app",
 	password: process.env.PG_PASSWORD ?? "app",
 	database: process.env.PG_DATABASE ?? "app"
-}, he = (e) => {
-	let t = e.channel ?? "framework_changes", n = H(e), r = null, i = null;
+}, ge = (e) => {
+	let t = e.channel ?? "framework_changes", n = U(e), r = null, i = null;
 	return {
 		start: async () => {
-			let a = U();
+			let a = W();
 			if (!a) {
-				V.debug("skipped — no PG_* env vars set");
+				H.debug("skipped — no PG_* env vars set");
 				return;
 			}
 			if (e.tableSubscriptionsByPattern.size === 0) {
-				V.debug("skipped — no pages declare cacheInvalidatesOn");
+				H.debug("skipped — no pages declare cacheInvalidatesOn");
 				return;
 			}
 			r = new (await (import("pg"))).default.Client(a), await r.connect(), i = (e) => {
@@ -43,16 +44,16 @@ var V = z({ scope: "voltro:start:cdc" }), H = (e) => (t) => {
 				try {
 					r = JSON.parse(e.payload);
 				} catch (e) {
-					V.warn("bad CDC payload", {}, e);
+					H.warn("bad CDC payload", {}, e);
 					return;
 				}
 				let i = n(r.table);
-				i > 0 && V.info(`${r.op} on '${r.table}' → dropped ${i} cache entries`, {
+				i > 0 && H.info(`${r.op} on '${r.table}' → dropped ${i} cache entries`, {
 					op: r.op,
 					table: r.table,
 					dropped: i
 				});
-			}, r.on("notification", i), await r.query(`LISTEN ${t}`), V.info(`LISTEN ${t}`, {
+			}, r.on("notification", i), await r.query(`LISTEN ${t}`), H.info(`LISTEN ${t}`, {
 				channel: t,
 				host: a.host,
 				port: a.port,
@@ -68,7 +69,7 @@ var V = z({ scope: "voltro:start:cdc" }), H = (e) => (t) => {
 			}
 		}
 	};
-}, W = z({ scope: "voltro:start:isr-cache" }), G = "voltro_isr_cache", ge = (e) => `
+}, G = B({ scope: "voltro:start:isr-cache" }), K = "voltro_isr_cache", _e = (e) => `
 CREATE TABLE IF NOT EXISTS ${e} (
   cache_key                TEXT PRIMARY KEY,
   html                     TEXT NOT NULL,
@@ -79,9 +80,9 @@ CREATE TABLE IF NOT EXISTS ${e} (
   stale_while_revalidate_ms BIGINT NOT NULL DEFAULT 0
 );
 CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
-`, _e = (e) => {
-	let t = e.tableName ?? G, { client: n } = e, r = /* @__PURE__ */ new Map(), i = !1, a = (async () => {
-		i || (i = !0, await n.query(ge(t)));
+`, ve = (e) => {
+	let t = e.tableName ?? K, { client: n } = e, r = /* @__PURE__ */ new Map(), i = !1, a = (async () => {
+		i || (i = !0, await n.query(_e(t)));
 	})().then(async () => {
 		let e = await n.query(`SELECT * FROM ${t}`);
 		for (let t of e.rows) r.set(t.cache_key, {
@@ -93,10 +94,10 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 			staleWhileRevalidateMs: Number(t.stale_while_revalidate_ms)
 		});
 	}).catch((e) => {
-		W.warn("postgres bootstrap failed", {}, e);
+		G.warn("postgres bootstrap failed", {}, e);
 	}), o = (e, t) => {
 		a.then(() => n.query(e, t)).catch((e) => {
-			W.warn("postgres write failed", {}, e);
+			G.warn("postgres write failed", {}, e);
 		});
 	};
 	return {
@@ -141,14 +142,14 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 			return Array.from(r.entries());
 		}
 	};
-}, K = z({ scope: "voltro:start" }), ve = await (async () => {
+}, q = B({ scope: "voltro:start" }), ye = await (async () => {
 	try {
-		let e = I(P(R(import.meta.url)), "..", "package.json"), t = await B.readFile(e, "utf8");
+		let e = I(fe(R(import.meta.url)), "..", "package.json"), t = await V.readFile(e, "utf8");
 		return JSON.parse(t).version ?? "0.0.0";
 	} catch {
 		return "0.0.0";
 	}
-})(), q = (e) => e instanceof Error && e._voltroControl === "redirect" && typeof e.location == "string", ye = (e) => e instanceof Error && e._voltroControl === "not-found", J = {
+})(), J = (e) => e instanceof Error && e._voltroControl === "redirect" && typeof e.location == "string", be = (e) => e instanceof Error && e._voltroControl === "not-found", Y = {
 	".html": "text/html; charset=utf-8",
 	".js": "application/javascript",
 	".mjs": "application/javascript",
@@ -166,13 +167,13 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 	".woff": "font/woff",
 	".woff2": "font/woff2",
 	".txt": "text/plain; charset=utf-8"
-}, be = (e) => J[F(e).toLowerCase()] ?? "application/octet-stream", Y = (e) => e.replace(/<script\b(?=[^>]*\btype="module")(?:(?!<\/script>).)*<\/script>/gi, "").replace(/<script\b(?=[^>]*\bsrc=)(?:(?!<\/script>).)*<\/script>/gi, "").replace(/<link\b[^>]*\brel="modulepreload"[^>]*>/gi, ""), X = async (e) => {
+}, xe = (e) => Y[F(e).toLowerCase()] ?? "application/octet-stream", X = (e) => e.replace(/<script\b(?=[^>]*\btype="module")(?:(?!<\/script>).)*<\/script>/gi, "").replace(/<script\b(?=[^>]*\bsrc=)(?:(?!<\/script>).)*<\/script>/gi, "").replace(/<link\b[^>]*\brel="modulepreload"[^>]*>/gi, ""), Z = async (e) => {
 	try {
-		return await B.stat(e), !0;
+		return await V.stat(e), !0;
 	} catch {
 		return !1;
 	}
-}, Z = (e) => {
+}, Q = (e) => {
 	let t = [], n = 0, r = e.split("/").filter(Boolean), i = [];
 	for (let e of r) e.startsWith("[[...") && e.endsWith("]]") ? (i.push("(.*)"), t.push(e.slice(5, -2)), n += 2) : e.startsWith("[...") && e.endsWith("]") ? (i.push("(.+)"), t.push(e.slice(4, -1)), n += 3) : e.startsWith("[") && e.endsWith("]") ? (i.push("([^/]+)"), t.push(e.slice(1, -1)), n += 1) : i.push(e.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"));
 	let a = i.join("/");
@@ -181,8 +182,8 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 		paramNames: t,
 		priority: n
 	};
-}, xe = (e) => e.map((e) => {
-	let { regex: t, paramNames: n, priority: r } = Z(e.pattern);
+}, Se = (e) => e.map((e) => {
+	let { regex: t, paramNames: n, priority: r } = Q(e.pattern);
 	return {
 		pattern: e.pattern,
 		file: e.file,
@@ -191,7 +192,7 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 		paramNames: n,
 		priority: r
 	};
-}).slice().sort((e, t) => e.priority - t.priority), Se = (e, t) => {
+}).slice().sort((e, t) => e.priority - t.priority), Ce = (e, t) => {
 	for (let n of t) {
 		let t = n.regex.exec(e);
 		if (!t) continue;
@@ -203,81 +204,81 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 		};
 	}
 	return null;
-}, Ce = async (e) => {
-	let { provider: t, route: n, params: r, pathname: a, dirs: o, shellTemplate: c, requestHeaders: l, requestUrl: u = "", apiOrigin: d, apiName: ee } = e, f = T(d, l.cookie, { apiName: ee }), p = await t.getPage(n.pattern, n.file), m = s(p, n.file), h = m === "spa" && ie(o, n.dirChain).some((e) => e.hasLayout);
-	if (m !== "ssr" && m !== "isr" && !h) return null;
-	let g = ie(o, n.dirChain), _ = {}, te = null, b, ne = new AbortController();
+}, we = async (e) => {
+	let { provider: t, route: n, params: r, pathname: i, dirs: a, shellTemplate: s, requestHeaders: c, requestUrl: l = "", apiOrigin: u, apiName: ee } = e, d = C(u, c.cookie, { apiName: ee }), f = await t.getPage(n.pattern, n.file), p = o(f, n.file), g = p === "spa" && ie(a, n.dirChain).some((e) => e.hasLayout);
+	if (p !== "ssr" && p !== "isr" && !g) return null;
+	let v = ie(a, n.dirChain), y = {}, b = null, te, x = new AbortController();
 	try {
-		({chain: b, segmentLoaderData: _} = await y({
-			entries: g,
+		({chain: te, segmentLoaderData: y} = await h({
+			entries: v,
 			loadLayout: (e) => t.getLayout(e.dir),
 			loadError: (e) => t.getError(e.dir),
 			loadPending: (e) => t.getPending(e.dir),
 			ctx: {
 				params: r,
-				pathname: a,
-				signal: ne.signal,
-				headers: l,
-				query: f
+				pathname: i,
+				signal: x.signal,
+				headers: c,
+				query: d
 			}
-		})), typeof p.loader == "function" && !h && (te = await p.loader({
+		})), typeof f.loader == "function" && !g && (b = await f.loader({
 			params: r,
-			pathname: a,
-			signal: ne.signal,
-			headers: l,
-			query: f
+			pathname: i,
+			signal: x.signal,
+			headers: c,
+			query: d
 		}));
 	} catch (e) {
-		if (q(e)) return {
+		if (J(e)) return {
 			control: "redirect",
 			status: e.status,
 			location: e.location
 		};
-		if (ye(e)) return { control: "not-found" };
+		if (be(e)) return { control: "not-found" };
 		throw e;
 	}
-	let S = await t.getHelpers(), re = {
+	let w = await t.getHelpers(), ne = {
 		pattern: n.pattern,
-		Component: p.default,
-		meta: p.meta,
-		loader: p.loader,
-		ErrorBoundary: p.ErrorBoundary,
-		Pending: p.Pending,
-		renderMode: m,
-		chain: b
-	}, C = {
-		cookies: S.parseCookieHeader(l.cookie),
-		headers: l,
-		url: u
-	}, E = S.i18n?.resolve(l.cookie, l["accept-language"]), D = p.interactive ?? "full";
-	if (h) {
-		let e = j({
-			helpers: S,
+		Component: f.default,
+		meta: f.meta,
+		loader: f.loader,
+		ErrorBoundary: f.ErrorBoundary,
+		Pending: f.Pending,
+		renderMode: p,
+		chain: te
+	}, E = {
+		cookies: w.parseCookieHeader(c.cookie),
+		headers: c,
+		url: l
+	}, D = w.i18n?.resolve(c.cookie, c["accept-language"]), O = f.interactive ?? "full";
+	if (g) {
+		let e = M({
+			helpers: w,
 			page: n.pattern,
-			interactive: D,
+			interactive: O,
 			delivery: "stream",
 			renderInput: {
-				descriptor: re,
+				descriptor: ne,
 				params: r,
-				pathname: a,
-				segmentLoaderData: _,
-				requestContext: C,
-				...E ? {
-					outerWrap: E.outerWrap,
-					locale: E.locale
+				pathname: i,
+				segmentLoaderData: y,
+				requestContext: E,
+				...D ? {
+					outerWrap: D.outerWrap,
+					locale: D.locale
 				} : {}
 			}
-		}), t = E?.locale ?? C.cookies["voltro:lang"] ?? "en", i = (t) => x({
-			helpers: S,
+		}), t = D?.locale ?? E.cookies["voltro:lang"] ?? "en", a = (t) => _({
+			helpers: w,
 			prepared: e,
 			meta: t,
-			interactive: D
+			interactive: O
 		});
 		if (e.hasDeferred) {
-			let n = k({ shell: c });
+			let n = T({ shell: s });
 			return {
 				renderMode: "spa",
-				stream: (r) => w({
+				stream: (r) => S({
 					res: r,
 					shell: n,
 					htmlLang: t,
@@ -285,58 +286,58 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 						"content-type": "text/html; charset=utf-8",
 						"x-voltro-rendered-by": "spa"
 					},
-					headInjection: i,
-					render: (t) => S.renderPageToStream({
+					headInjection: a,
+					render: (t) => w.renderPageToStream({
 						...e.renderInput,
 						...t
 					}),
 					onShellError: (e) => {
-						K.error("spa layout shell render failed", { pathname: a }, e), r.writeHead(500, { "content-type": "text/plain; charset=utf-8" }), r.end("server error");
+						q.error("spa layout shell render failed", { pathname: i }, e), r.writeHead(500, { "content-type": "text/plain; charset=utf-8" }), r.end("server error");
 					}
 				})
 			};
 		}
 		let o = N({
-			helpers: S,
+			helpers: w,
 			prepared: e
 		});
 		return {
-			html: c.replace("<div id=\"root\"></div>", `<div id="root">${o.body}</div>`).replace("</head>", `    ${i(o.meta)}\n  </head>`).replace(/<html(\s+lang="[^"]*")?/i, `<html lang="${t}"`),
+			html: s.replace("<div id=\"root\"></div>", `<div id="root">${o.body}</div>`).replace("</head>", `    ${a(o.meta)}\n  </head>`).replace(/<html(\s+lang="[^"]*")?/i, `<html lang="${t}"`),
 			renderMode: "spa",
 			revalidateMs: null
 		};
 	}
-	let O = v({
-		helpers: S,
+	let k = m({
+		helpers: w,
 		page: n.pattern,
-		pathname: a,
-		renderMode: m,
-		interactive: D,
-		loaderData: te,
-		segmentLoaderData: _,
-		pageLoaderRan: typeof p.loader == "function"
-	}), ae = {
-		descriptor: re,
+		pathname: i,
+		renderMode: p,
+		interactive: O,
+		loaderData: b,
+		segmentLoaderData: y,
+		pageLoaderRan: typeof f.loader == "function"
+	}), A = {
+		descriptor: ne,
 		params: r,
-		pathname: a,
-		loaderData: O.loaderData,
-		segmentLoaderData: O.segmentLoaderData,
-		requestContext: C,
-		...E ? {
-			outerWrap: E.outerWrap,
-			locale: E.locale
+		pathname: i,
+		loaderData: k.loaderData,
+		segmentLoaderData: k.segmentLoaderData,
+		requestContext: E,
+		...D ? {
+			outerWrap: D.outerWrap,
+			locale: D.locale
 		} : {}
-	}, A = (e) => [
-		S.renderMetaToHtml(e),
-		`<meta name="voltro-interactive" content="${D}" />`,
-		...O.hasDeferred ? [S.renderDeferredRegistryScript()] : [],
-		S.renderRouterStateScript(O.stateInput)
+	}, j = (e) => [
+		w.renderMetaToHtml(e),
+		`<meta name="voltro-interactive" content="${O}" />`,
+		...k.hasDeferred ? [w.renderDeferredRegistryScript()] : [],
+		w.renderRouterStateScript(k.stateInput)
 	].filter((e) => e.length > 0).join("\n    ");
-	if (m === "ssr" && D === "full" && e.buffered !== !0) {
-		let e = E?.locale ?? C.cookies["voltro:lang"] ?? "en", t = k({ shell: c });
+	if (p === "ssr" && O === "full" && e.buffered !== !0) {
+		let e = D?.locale ?? E.cookies["voltro:lang"] ?? "en", t = T({ shell: s });
 		return {
 			renderMode: "ssr",
-			stream: (n) => w({
+			stream: (n) => S({
 				res: n,
 				shell: t,
 				htmlLang: e,
@@ -344,27 +345,27 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 					"content-type": "text/html; charset=utf-8",
 					"x-voltro-rendered-by": "ssr"
 				},
-				headInjection: A,
-				render: (e) => S.renderPageToStream({
-					...ae,
+				headInjection: j,
+				render: (e) => w.renderPageToStream({
+					...A,
 					...e
 				}),
 				onShellError: (e) => {
-					K.error("ssr shell render failed", { pathname: a }, e), n.writeHead(500, { "content-type": "text/plain; charset=utf-8" }), n.end("server error");
+					q.error("ssr shell render failed", { pathname: i }, e), n.writeHead(500, { "content-type": "text/plain; charset=utf-8" }), n.end("server error");
 				}
 			})
 		};
 	}
-	let { html: oe, meta: se } = S.renderPageToHtml(ae), ce = A(se), le = E?.locale ?? C.cookies["voltro:lang"] ?? "en", M = c.replace("<div id=\"root\"></div>", `<div id="root">${oe}</div>`).replace("</head>", `    ${ce}\n  </head>`).replace(/<html(\s+lang="[^"]*")?/i, `<html lang="${le}"`);
-	D === "none" && (M = Y(M));
-	let ue = m === "isr" ? i(p.revalidate) : null;
+	let { html: ae, meta: oe } = w.renderPageToHtml(A), se = j(oe), ce = D?.locale ?? E.cookies["voltro:lang"] ?? "en", P = s.replace("<div id=\"root\"></div>", `<div id="root">${ae}</div>`).replace("</head>", `    ${se}\n  </head>`).replace(/<html(\s+lang="[^"]*")?/i, `<html lang="${ce}"`);
+	O === "none" && (P = X(P));
+	let le = p === "isr" ? re(f.revalidate) : null;
 	return {
-		html: M,
-		renderMode: m,
-		revalidateMs: ue
+		html: P,
+		renderMode: p,
+		revalidateMs: le
 	};
-}, Q = (e) => e === "" ? "/" : e, we = async (e) => {
-	let t = await import(de(e).href);
+}, $ = (e) => e === "" ? "/" : e, Te = async (e) => {
+	let t = await import(z(e).href);
 	return {
 		kind: "bundle",
 		getPageMeta: () => t.pageMeta,
@@ -374,18 +375,18 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 			return typeof r == "function" ? await r() : r;
 		},
 		async getLayout(e) {
-			let n = t.layouts[Q(e)];
-			if (!n) throw Error(`[voltro start] ssr bundle missing layout for dir ${Q(e)}`);
+			let n = t.layouts[$(e)];
+			if (!n) throw Error(`[voltro start] ssr bundle missing layout for dir ${$(e)}`);
 			return typeof n == "function" ? await n() : n;
 		},
 		async getError(e) {
-			let n = t.errors[Q(e)];
-			if (!n) throw Error(`[voltro start] ssr bundle missing error for dir ${Q(e)}`);
+			let n = t.errors[$(e)];
+			if (!n) throw Error(`[voltro start] ssr bundle missing error for dir ${$(e)}`);
 			return typeof n == "function" ? await n() : n;
 		},
 		async getPending(e) {
-			let n = t.pendings[Q(e)];
-			if (!n) throw Error(`[voltro start] ssr bundle missing pending for dir ${Q(e)}`);
+			let n = t.pendings[$(e)];
+			if (!n) throw Error(`[voltro start] ssr bundle missing pending for dir ${$(e)}`);
 			return typeof n == "function" ? await n() : n;
 		},
 		async getHelpers() {
@@ -393,8 +394,8 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 		},
 		async close() {}
 	};
-}, Te = async (e, t) => {
-	let n = await l("vite", () => import("vite")), r = (await import("@vitejs/plugin-react")).default, i = (await import("@tailwindcss/vite")).default, a = await n.createServer({
+}, Ee = async (e, t) => {
+	let n = await y("vite", () => import("vite")), r = (await import("@vitejs/plugin-react")).default, i = (await import("@tailwindcss/vite")).default, a = await n.createServer({
 		root: t,
 		envPrefix: "__VOLTRO_VITE_ENV_DISABLED__",
 		plugins: [r(), i()],
@@ -406,121 +407,121 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 		},
 		appType: "custom",
 		logLevel: "warn"
-	}), o = I(e, "src", "pages"), s = (e) => e === "" ? o : I(o, e), u = A({ limit: c() }), d = (e) => u.load(e, async () => await a.ssrLoadModule(e));
+	}), o = I(e, "src", "pages"), c = (e) => e === "" ? o : I(o, e), l = D({ limit: s() }), u = (e) => l.load(e, async () => await a.ssrLoadModule(e));
 	return {
 		kind: "middleware",
 		async getPage(e, t) {
-			return d(I(o, t));
+			return u(I(o, t));
 		},
 		async getLayout(e) {
-			return d(I(s(e), "layout.tsx"));
+			return u(I(c(e), "layout.tsx"));
 		},
 		async getError(e) {
-			return d(I(s(e), "error.tsx"));
+			return u(I(c(e), "error.tsx"));
 		},
 		async getPending(e) {
-			return d(I(s(e), "loading.tsx"));
+			return u(I(c(e), "loading.tsx"));
 		},
 		async getHelpers() {
-			return await d("@voltro/web/ssr");
+			return await u("@voltro/web/ssr");
 		},
 		async close() {
 			await a.close();
 		}
 	};
-}, Ee = async (i) => {
-	let s = ue(), c = await se(i);
-	if (!c) return {
+}, De = async (o) => {
+	let s = de(), m = await k(o);
+	if (!m) return {
 		ran: !1,
 		exitCode: 0
 	};
-	if (c.type !== "web") return K.error("only web apps are supported by `voltro start`"), {
+	if (m.type !== "web") return q.error("only web apps are supported by `voltro start`"), {
 		ran: !0,
 		exitCode: 1
 	};
-	let { resolved: l } = await O({
-		rawEnv: c.env,
+	let { resolved: h } = await g({
+		rawEnv: m.env,
 		appType: "web",
-		root: i,
-		log: K,
+		root: o,
+		log: q,
 		generateTypes: !1
-	}), v = l.publicValues;
+	}), _ = h.publicValues;
 	s.mark("config");
-	let y = g();
-	h(y), K.info("booting voltro start", { app: c.name ?? "(unnamed)" });
-	let x = (() => {
+	let y = p();
+	f(y), q.info("booting voltro start", { app: m.name ?? "(unnamed)" });
+	let S = (() => {
 		if (process.env.VOLTRO_IS_DASHBOARD === "1" && process.env.VOLTRO_DASHBOARD_PORT) return Number(process.env.VOLTRO_DASHBOARD_PORT);
 		if (process.env.PORT) {
 			let e = Number(process.env.PORT);
 			if (Number.isFinite(e) && e > 0) return e;
 		}
-		return c.port ?? 5173;
-	})(), w = I(i, ".framework"), T = I(w, "dist"), k = I(T, "index.html");
-	if (!await X(k)) return K.error("no built dist found — run `voltro build` first", { distDir: T }), {
+		return m.port ?? 5173;
+	})(), C = I(o, ".framework"), T = I(C, "dist"), re = I(T, "index.html");
+	if (!await Z(re)) return q.error("no built dist found — run `voltro build` first", { distDir: T }), {
 		ran: !0,
 		exitCode: 1
 	};
-	let A = c.name ?? "unnamed", j = d("web", A, x), N = r(A);
-	await E({
-		id: j,
-		name: A,
+	let D = m.name ?? "unnamed", M = l("web", D, S), N = r(D);
+	await w({
+		id: M,
+		name: D,
 		kind: "web",
-		url: `http://localhost:${x}`,
+		url: `http://localhost:${S}`,
 		pid: process.pid,
 		status: "booting",
 		logFile: N.path
 	}).catch(() => {});
-	let P = I(T, "_voltro", "shell.html"), F = await X(P) ? await B.readFile(P, "utf8") : await B.readFile(k, "utf8"), L = await ne(i, c), R = oe(L[0]), de = L[0]?.name, z, V = null;
-	process.env.SSR_CACHE === "postgres" && process.env.PG_HOST ? (V = new (await (import("pg"))).default.Client({
+	let fe = I(T, "_voltro", "shell.html"), F = await Z(fe) ? await V.readFile(fe, "utf8") : await V.readFile(re, "utf8"), L = await v(o, m), R = O(L[0]), z = L[0]?.name, B, H = null;
+	process.env.SSR_CACHE === "postgres" && process.env.PG_HOST ? (H = new (await (import("pg"))).default.Client({
 		host: process.env.PG_HOST,
 		port: Number(process.env.PG_PORT ?? 5432),
 		user: process.env.PG_USER ?? "app",
 		password: process.env.PG_PASSWORD ?? "app",
 		database: process.env.PG_DATABASE ?? "app"
-	}), await V.connect(), z = _e({ client: V }), K.info("isr cache backend: postgres", { table: "voltro_isr_cache" })) : (z = p(), K.info("isr cache backend: memory (per-process)", { hint: "set SSR_CACHE=postgres for persistent storage" })), await ae(i, c, L, v);
-	let { pages: H, dirs: U } = await S(I(i, "src", "pages")), W = xe(H);
+	}), await H.connect(), B = ve({ client: H }), q.info("isr cache backend: postgres", { table: "voltro_isr_cache" })) : (B = j(), q.info("isr cache backend: memory (per-process)", { hint: "set SSR_CACHE=postgres for persistent storage" })), await E(o, m, L, _);
+	let { pages: U, dirs: W } = await te(I(o, "src", "pages")), G = Se(U);
 	s.mark("scan");
-	let G = I(T, "server", "ssrEntry.js"), ge = await X(G);
-	if (!ge && process.env.NODE_ENV === "production") throw K.fatal(`production \`voltro start\` requires a precompiled SSR bundle at ${G} but it is missing. Run \`voltro build\` before serving — production renders from the bundle and never compiles on demand.`), Error(`[voltro start] missing SSR bundle at ${G}`);
-	let q = ge ? await we(G) : await Te(i, w);
-	K.info(`ssr loader: ${q.kind}`, {
-		kind: q.kind,
-		...q.kind === "middleware" ? { hint: "no pre-built SSR bundle found; run `voltro build` to enable bundle mode" } : {}
+	let K = I(T, "server", "ssrEntry.js"), _e = await Z(K);
+	if (!_e && process.env.NODE_ENV === "production") throw q.fatal(`production \`voltro start\` requires a precompiled SSR bundle at ${K} but it is missing. Run \`voltro build\` before serving — production renders from the bundle and never compiles on demand.`), Error(`[voltro start] missing SSR bundle at ${K}`);
+	let J = _e ? await Te(K) : await Ee(o, C);
+	q.info(`ssr loader: ${J.kind}`, {
+		kind: J.kind,
+		...J.kind === "middleware" ? { hint: "no pre-built SSR bundle found; run `voltro build` to enable bundle mode" } : {}
 	}), s.mark("provider");
-	let ye = q.getPageMeta?.(), J = /* @__PURE__ */ new Map(), Y = 0;
-	for (let e of H) {
-		let t = ye?.[e.pattern];
+	let be = J.getPageMeta?.(), Y = /* @__PURE__ */ new Map(), X = 0;
+	for (let e of U) {
+		let t = be?.[e.pattern];
 		if (t) {
-			J.set(e.pattern, t);
+			Y.set(e.pattern, t);
 			continue;
 		}
 		try {
-			let t = await q.getPage(e.pattern, e.file);
-			J.set(e.pattern, u(t, e.file)), Y++;
+			let t = await J.getPage(e.pattern, e.file);
+			Y.set(e.pattern, c(t, e.file)), X++;
 		} catch (t) {
-			K.warn("failed to load page metadata", { pattern: e.pattern }, t);
+			q.warn("failed to load page metadata", { pattern: e.pattern }, t);
 		}
 	}
-	K.info(`registered ${J.size} route(s)`, {
-		count: J.size,
-		fromManifest: J.size - Y,
-		fromModules: Y
+	q.info(`registered ${Y.size} route(s)`, {
+		count: Y.size,
+		fromManifest: Y.size - X,
+		fromModules: X
 	}), s.mark("routes");
-	let Z = /* @__PURE__ */ new Set();
-	for (let e of W) J.get(e.pattern)?.renderMode === "spa" && ie(U, e.dirChain).some((e) => e.hasLayout) && Z.add(e.pattern);
-	Z.size > 0 && K.info(`${Z.size} spa route(s) render an SSR layout shell`, { patterns: [...Z] });
-	let Q = /* @__PURE__ */ new Map();
-	for (let [e, t] of J) t.cacheInvalidatesOn.length > 0 && Q.set(e, t.cacheInvalidatesOn);
-	let Ee = /* @__PURE__ */ new Map();
-	for (let e of W) Ee.set(e.pattern, e.regex);
-	let De = he({
-		cache: z,
-		tableSubscriptionsByPattern: Q,
-		regexByPattern: Ee
+	let Q = /* @__PURE__ */ new Set();
+	for (let e of G) Y.get(e.pattern)?.renderMode === "spa" && ie(W, e.dirChain).some((e) => e.hasLayout) && Q.add(e.pattern);
+	Q.size > 0 && q.info(`${Q.size} spa route(s) render an SSR layout shell`, { patterns: [...Q] });
+	let $ = /* @__PURE__ */ new Map();
+	for (let [e, t] of Y) t.cacheInvalidatesOn.length > 0 && $.set(e, t.cacheInvalidatesOn);
+	let De = /* @__PURE__ */ new Map();
+	for (let e of G) De.set(e.pattern, e.regex);
+	let Oe = ge({
+		cache: B,
+		tableSubscriptionsByPattern: $,
+		regexByPattern: De
 	});
-	await De.start(), s.mark("cdc");
-	let Oe = ce(), ke = H.map((e) => {
-		let t = J.get(e.pattern);
+	await Oe.start(), s.mark("cdc");
+	let ke = A(), Ae = U.map((e) => {
+		let t = Y.get(e.pattern);
 		return {
 			pattern: e.pattern,
 			file: e.file,
@@ -535,20 +536,20 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 			hasMeta: t?.hasMeta ?? !1,
 			hasGetStaticPaths: t?.hasGetStaticPaths ?? !1
 		};
-	}), Ae = U.map((e) => ({
+	}), je = W.map((e) => ({
 		dir: e.dir,
 		hasLayout: e.hasLayout,
 		hasError: e.hasError,
 		hasPending: e.hasPending,
 		hasNotFound: e.hasNotFound
-	})), je = V ? "postgres" : "memory", Me = {
+	})), Me = H ? "postgres" : "memory", Ne = {
 		kind: "web",
 		meta: {
-			name: c.name ?? "(unnamed)",
-			voltroVersion: ve,
-			port: x,
+			name: m.name ?? "(unnamed)",
+			voltroVersion: ye,
+			port: S,
 			mode: "start",
-			apis: Object.entries(c.apis ?? {}).map(([e, t]) => {
+			apis: Object.entries(m.apis ?? {}).map(([e, t]) => {
 				let n = {
 					name: e,
 					package: t.package
@@ -556,10 +557,10 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 				return t.url !== void 0 && (n.url = t.url), n;
 			})
 		},
-		routes: ke,
-		dirs: Ae,
+		routes: Ae,
+		dirs: je,
 		cache: () => {
-			let e = Date.now(), t = z.snapshot().map(([t, n]) => ({
+			let e = Date.now(), t = B.snapshot().map(([t, n]) => ({
 				key: t,
 				renderedAt: n.renderedAt,
 				expiresAt: n.expiresAt,
@@ -570,16 +571,16 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 				staleWhileRevalidateMs: n.staleWhileRevalidateMs
 			}));
 			return {
-				backend: je,
-				size: z.size(),
+				backend: Me,
+				size: B.size(),
 				entries: t
 			};
 		},
-		metrics: () => pe()
-	}, Ne = async (e, t) => {
-		let r = e.split("?")[0] ?? "/";
-		if (c.name === "voltroDashboard" && r === "/api/dashboard/registry") try {
-			let e = await D();
+		metrics: () => me()
+	}, Pe = async (t, n) => {
+		let r = t.split("?")[0] ?? "/";
+		if (m.name === "voltroDashboard" && r === "/api/dashboard/registry") try {
+			let e = await ne();
 			return {
 				status: 200,
 				headers: { "content-type": "application/json; charset=utf-8" },
@@ -592,7 +593,7 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 				body: `registry read error: ${e.message}`
 			};
 		}
-		if (c.name === "voltroDashboard" && r === "/api/dashboard/config") {
+		if (m.name === "voltroDashboard" && r === "/api/dashboard/config") {
 			let e = process.env.VOLTRO_DASHBOARD_APPS, t = [];
 			if (e && e.trim().length > 0) {
 				let n;
@@ -622,55 +623,55 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 			};
 		}
 		if (r === "/_voltro/inspect/logs") {
-			let n = ee(e, o(), t);
+			let e = ee(t, a(), n);
 			return {
-				status: n.status,
+				status: e.status,
 				headers: {
-					"content-type": n.contentType,
-					...C(t.origin)
+					"content-type": e.contentType,
+					...ue(n.origin)
 				},
-				body: n.body
+				body: e.body
 			};
 		}
 		if (r !== "/_voltro/inspect/stream") {
-			let n = b(e, Me, t);
-			if (n !== null) return {
-				status: n.status,
+			let e = le(t, Ne, n);
+			if (e !== null) return {
+				status: e.status,
 				headers: {
-					"content-type": n.contentType,
-					...n.headers ?? {}
+					"content-type": e.contentType,
+					...e.headers ?? {}
 				},
-				body: n.body
+				body: e.body
 			};
 		}
-		let a = Se(r, W), s = a ? J.get(a.route.pattern)?.renderMode : void 0, l = s === "ssr" || s === "isr" || (a ? Z.has(a.route.pattern) : !1), u = r === "/" ? I(T, "index.html") : I(T, r.replace(/^\//, ""), "index.html");
-		if (!l && await X(u)) return {
+		let i = Ce(r, G), s = i ? Y.get(i.route.pattern)?.renderMode : void 0, c = s === "ssr" || s === "isr" || (i ? Q.has(i.route.pattern) : !1), l = r === "/" ? I(T, "index.html") : I(T, r.replace(/^\//, ""), "index.html");
+		if (!c && await Z(l)) return {
 			status: 200,
 			headers: { "content-type": "text/html; charset=utf-8" },
-			body: await B.readFile(u)
+			body: await V.readFile(l)
 		};
 		if (/\.[a-z0-9]+$/i.test(r)) {
 			let e = I(T, r.replace(/^\//, ""));
-			if (await X(e)) {
-				let t = await B.readFile(e);
+			if (await Z(e)) {
+				let t = await V.readFile(e);
 				return {
 					status: 200,
-					headers: { "content-type": be(e) },
+					headers: { "content-type": xe(e) },
 					body: t
 				};
 			}
 		}
-		let d = Se(r, W);
+		let d = Ce(r, G);
 		if (!d) return {
 			status: 404,
 			headers: { "content-type": "text/plain" },
 			body: "not found"
 		};
-		let p = J.get(d.route.pattern), m = t["x-tenant"] ?? "anonymous", h = (await q.getHelpers()).i18n?.resolve(t.cookie, t["accept-language"])?.locale, g = f(r, {
-			...p?.tenantAware ? { tenant: m } : {},
+		let f = Y.get(d.route.pattern), p = n["x-tenant"] ?? "anonymous", h = (await J.getHelpers()).i18n?.resolve(n.cookie, n["accept-language"])?.locale, g = u(r, {
+			...f?.tenantAware ? { tenant: p } : {},
 			...h ? { locale: h } : {}
-		}), _ = z.get(g), v = Date.now();
-		if (_ && n(_, v)) return y.emit("cache", {
+		}), _ = B.get(g), v = Date.now();
+		if (_ && e(_, v)) return y.emit("cache", {
 			kind: "HIT",
 			key: g,
 			ageMs: v - _.renderedAt
@@ -685,39 +686,39 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 			},
 			body: _.html
 		};
-		if (_ && M(_, v)) return y.emit("cache", {
+		if (_ && b(_, v)) return y.emit("cache", {
 			kind: "STALE",
 			key: g,
 			ageMs: v - _.renderedAt
 		}), (async () => {
 			try {
-				let n = await Ce({
-					provider: q,
-					root: i,
+				let e = await we({
+					provider: J,
+					root: o,
 					route: d.route,
 					params: d.params,
 					pathname: r,
-					dirs: U,
+					dirs: W,
 					shellTemplate: F,
-					requestHeaders: t,
+					requestHeaders: n,
 					apiOrigin: R,
-					apiName: de,
-					requestUrl: e,
+					apiName: z,
+					requestUrl: t,
 					buffered: !0
 				});
-				if (n && "html" in n && n.renderMode === "isr" && n.revalidateMs !== null) {
-					let e = J.get(d.route.pattern)?.staleWhileRevalidateMs ?? 0, t = Date.now();
-					z.set(g, {
-						html: n.html,
-						renderedAt: t,
-						expiresAt: t + n.revalidateMs,
-						servableUntil: t + n.revalidateMs + e,
-						revalidateMs: n.revalidateMs,
-						staleWhileRevalidateMs: e
+				if (e && "html" in e && e.renderMode === "isr" && e.revalidateMs !== null) {
+					let t = Y.get(d.route.pattern)?.staleWhileRevalidateMs ?? 0, n = Date.now();
+					B.set(g, {
+						html: e.html,
+						renderedAt: n,
+						expiresAt: n + e.revalidateMs,
+						servableUntil: n + e.revalidateMs + t,
+						revalidateMs: e.revalidateMs,
+						staleWhileRevalidateMs: t
 					});
 				}
 			} catch (e) {
-				K.warn("background SWR refresh failed", { url: r }, e);
+				q.warn("background SWR refresh failed", { url: r }, e);
 			}
 		})(), {
 			status: 200,
@@ -731,20 +732,20 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 			body: _.html
 		};
 		try {
-			let n = await Ce({
-				provider: q,
-				root: i,
+			let e = await we({
+				provider: J,
+				root: o,
 				route: d.route,
 				params: d.params,
 				pathname: r,
-				dirs: U,
+				dirs: W,
 				shellTemplate: F,
-				requestHeaders: t,
+				requestHeaders: n,
 				apiOrigin: R,
-				apiName: de,
-				requestUrl: e
+				apiName: z,
+				requestUrl: t
 			});
-			if (!n) return {
+			if (!e) return {
 				status: 200,
 				headers: {
 					"content-type": "text/html; charset=utf-8",
@@ -752,16 +753,16 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 				},
 				body: F
 			};
-			if ("stream" in n) return {
+			if ("stream" in e) return {
 				status: 200,
-				headers: { "x-voltro-rendered-by": n.renderMode },
+				headers: { "x-voltro-rendered-by": e.renderMode },
 				body: "",
-				stream: n.stream
+				stream: e.stream
 			};
-			if ("control" in n) return n.control === "redirect" ? {
-				status: n.status,
+			if ("control" in e) return e.control === "redirect" ? {
+				status: e.status,
 				headers: {
-					location: n.location,
+					location: e.location,
 					"x-voltro-rendered-by": "loader-redirect"
 				},
 				body: ""
@@ -773,36 +774,36 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 				},
 				body: "not found"
 			};
-			let a = {
+			let i = {
 				"content-type": "text/html; charset=utf-8",
-				"x-voltro-rendered-by": n.renderMode
+				"x-voltro-rendered-by": e.renderMode
 			};
-			if (n.renderMode === "isr" && n.revalidateMs !== null) {
-				let e = Date.now(), t = J.get(d.route.pattern)?.staleWhileRevalidateMs ?? 0;
-				z.set(g, {
-					html: n.html,
-					renderedAt: e,
-					expiresAt: e + n.revalidateMs,
-					servableUntil: e + n.revalidateMs + t,
-					revalidateMs: n.revalidateMs,
-					staleWhileRevalidateMs: t
-				}), a["x-voltro-cache"] = "MISS", a["x-voltro-cache-key"] = g, a["x-voltro-cache-revalidate-ms"] = String(n.revalidateMs), t > 0 && (a["x-voltro-cache-swr-ms"] = String(t)), y.emit("cache", {
+			if (e.renderMode === "isr" && e.revalidateMs !== null) {
+				let t = Date.now(), n = Y.get(d.route.pattern)?.staleWhileRevalidateMs ?? 0;
+				B.set(g, {
+					html: e.html,
+					renderedAt: t,
+					expiresAt: t + e.revalidateMs,
+					servableUntil: t + e.revalidateMs + n,
+					revalidateMs: e.revalidateMs,
+					staleWhileRevalidateMs: n
+				}), i["x-voltro-cache"] = "MISS", i["x-voltro-cache-key"] = g, i["x-voltro-cache-revalidate-ms"] = String(e.revalidateMs), n > 0 && (i["x-voltro-cache-swr-ms"] = String(n)), y.emit("cache", {
 					kind: "MISS",
 					key: g,
-					revalidateMs: n.revalidateMs,
-					swrMs: t
+					revalidateMs: e.revalidateMs,
+					swrMs: n
 				});
-			} else n.renderMode === "isr" && (a["x-voltro-cache"] = "BYPASS", y.emit("cache", {
+			} else e.renderMode === "isr" && (i["x-voltro-cache"] = "BYPASS", y.emit("cache", {
 				kind: "BYPASS",
 				key: g
 			}));
 			return {
 				status: 200,
-				headers: a,
-				body: n.html
+				headers: i,
+				body: e.html
 			};
 		} catch (e) {
-			return K.error("render error", { url: r }, e), re(e) ? {
+			return q.error("render error", { url: r }, e), x(e) ? {
 				status: 500,
 				headers: {
 					"content-type": "text/plain; charset=utf-8",
@@ -815,9 +816,9 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 				body: "server error"
 			};
 		}
-	}, Pe = !1, Fe = me(async (e, t) => {
-		let n = e.url ?? "/", r = Date.now(), i = {};
-		for (let [t, n] of Object.entries(e.headers)) n !== void 0 && (i[t.toLowerCase()] = Array.isArray(n) ? n.join(", ") : n);
+	}, Fe = !1, Ie = he(async (e, t) => {
+		let n = e.url ?? "/", r = Date.now(), a = {};
+		for (let [t, n] of Object.entries(e.headers)) n !== void 0 && (a[t.toLowerCase()] = Array.isArray(n) ? n.join(", ") : n);
 		let o = n.split("?")[0] ?? "/", s = (e.method ?? "GET").toUpperCase();
 		if (o === "/internal/liveness") {
 			t.writeHead(200, {
@@ -827,36 +828,41 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 			return;
 		}
 		if (o === "/internal/readiness") {
-			let e = Pe ? 200 : 503;
+			let e = Fe ? 200 : 503;
 			t.writeHead(e, {
 				"content-type": "text/plain",
 				"cache-control": "no-store"
-			}), t.end(Pe ? "ready" : "not-ready");
+			}), t.end(Fe ? "ready" : "not-ready");
 			return;
 		}
 		if (s === "OPTIONS" && o.startsWith("/_voltro/inspect")) {
-			let e = C(i.origin);
+			let e = ue(a.origin);
 			t.writeHead(204, e), t.end();
 			return;
 		}
-		if (c.name === "voltroDashboard" && o === "/api/dashboard/proxy") {
+		if (m.name === "voltroDashboard" && o === "/api/dashboard/proxy") {
 			let r = new URL(n, "http://x").searchParams.get("target");
 			if (!r) {
 				t.writeHead(400, { "content-type": "text/plain" }), t.end("missing ?target=");
 				return;
 			}
+			if (!ce(r)) {
+				t.writeHead(400, { "content-type": "text/plain" }), t.end("target not allowed: must be loopback or an origin configured in VOLTRO_DASHBOARD_APPS");
+				return;
+			}
 			try {
-				let n = { accept: i.accept ?? "application/json" }, a = i.authorization;
-				a && (n.authorization = Array.isArray(a) ? a[0] : a);
+				let n = { accept: a.accept ?? "application/json" }, i = a.authorization;
+				i ? n.authorization = Array.isArray(i) ? i[0] : i : oe(r) && process.env.VOLTRO_INSPECT_TOKEN && (n.authorization = `Bearer ${process.env.VOLTRO_INSPECT_TOKEN}`);
 				let o;
 				if (s && s !== "GET" && s !== "HEAD") {
 					let t = [];
 					for await (let n of e) t.push(n);
 					o = Buffer.concat(t);
-					let r = i["content-type"];
+					let r = a["content-type"];
 					r && (n["content-type"] = Array.isArray(r) ? r[0] : r);
 				}
 				let c = await fetch(r, {
+					redirect: "manual",
 					method: s,
 					headers: n,
 					...o ? { body: new Uint8Array(o.buffer, o.byteOffset, o.byteLength) } : {}
@@ -870,22 +876,27 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 			}
 			return;
 		}
-		if (c.name === "voltroDashboard" && o === "/api/dashboard/proxy/stream") {
+		if (m.name === "voltroDashboard" && o === "/api/dashboard/proxy/stream") {
 			let r = new URL(n, "http://x").searchParams.get("target");
 			if (!r) {
 				t.writeHead(400, { "content-type": "text/plain" }), t.end("missing ?target=");
 				return;
 			}
-			let a = new AbortController();
-			e.on("close", () => a.abort()), t.on("close", () => a.abort());
+			if (!ce(r)) {
+				t.writeHead(400, { "content-type": "text/plain" }), t.end("target not allowed: must be loopback or an origin configured in VOLTRO_DASHBOARD_APPS");
+				return;
+			}
+			let i = new AbortController();
+			e.on("close", () => i.abort()), t.on("close", () => i.abort());
 			try {
-				let e = i.authorization, n = await fetch(r, {
+				let e = a.authorization ?? (oe(r) && process.env.VOLTRO_INSPECT_TOKEN ? `Bearer ${process.env.VOLTRO_INSPECT_TOKEN}` : void 0), n = await fetch(r, {
+					redirect: "manual",
 					method: "GET",
 					headers: {
 						accept: "text/event-stream",
 						...e ? { authorization: Array.isArray(e) ? e[0] : e } : {}
 					},
-					signal: a.signal
+					signal: i.signal
 				});
 				if (!n.ok || !n.body) {
 					t.writeHead(n.status, { "content-type": "text/plain" }), t.end(`upstream ${n.status}`);
@@ -913,15 +924,15 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 			return;
 		}
 		if (o === "/_voltro/inspect/stream") {
-			let n = C(i.origin);
-			if (te()) {
+			let n = ue(a.origin);
+			if (se()) {
 				t.writeHead(503, {
 					"content-type": "application/json",
 					...n
 				}), t.end(JSON.stringify({ error: "inspect disabled (VOLTRO_INSPECT=off)" }));
 				return;
 			}
-			let r = _(i);
+			let r = P(a);
 			if (!r.ok) {
 				t.writeHead(401, {
 					"content-type": "application/json",
@@ -939,11 +950,11 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 				"x-accel-buffering": "no",
 				...n
 			}), t.flushHeaders(), t.write("retry: 5000\n\n");
-			for (let e of y.buffered()) t.write(m(e));
+			for (let e of y.buffered()) t.write(d(e));
 			let o = y.subscribe((e) => {
-				t.write(m(e));
+				t.write(d(e));
 			}), s = setInterval(() => {
-				t.write(a());
+				t.write(i());
 			}, 15e3), c = () => {
 				clearInterval(s), o();
 			};
@@ -951,7 +962,7 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 			return;
 		}
 		try {
-			let e = await Ne(n, i);
+			let e = await Pe(n, a);
 			if (e.stream ? e.stream(t) : (t.writeHead(e.status, e.headers), t.end(e.body)), !o.startsWith("/_voltro/inspect")) {
 				let t = Date.now() - r;
 				y.emit("request", {
@@ -961,8 +972,8 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 					renderedBy: e.headers["x-voltro-rendered-by"],
 					cache: e.headers["x-voltro-cache"]
 				});
-				let n = Se(o, W)?.route.pattern ?? (e.status === 404 ? "<unmatched>" : "<asset>");
-				Oe.record({
+				let n = Ce(o, G)?.route.pattern ?? (e.status === 404 ? "<unmatched>" : "<asset>");
+				ke.record({
 					kind: "request",
 					tag: n,
 					durationMs: t,
@@ -973,71 +984,71 @@ CREATE INDEX IF NOT EXISTS ${e}_servable_until_idx ON ${e} (servable_until);
 			t.writeHead(500, { "content-type": "text/plain" }), t.end(`internal error: ${e.message}`);
 		}
 	});
-	await new Promise((e) => Fe.listen(x, "::", e)), Pe = !0, s.mark("ready"), K.info(`listening on http://localhost:${x}`, {
-		port: x,
+	await new Promise((e) => Ie.listen(S, "::", e)), Fe = !0, s.mark("ready"), q.info(`listening on http://localhost:${S}`, {
+		port: S,
 		distDir: T
-	}), K.debug("dynamic + ssr/isr routes resolve via SSR loader");
+	}), q.debug("dynamic + ssr/isr routes resolve via SSR loader");
 	try {
-		await E({
-			id: j,
-			name: A,
+		await w({
+			id: M,
+			name: D,
 			kind: "web",
-			url: `http://localhost:${x}`,
+			url: `http://localhost:${S}`,
 			pid: process.pid,
 			status: "live",
 			logFile: N.path
 		});
-		let e = le(i);
+		let e = ae(o);
 		if (e) {
-			let n = await t({ dashboardAppPath: e });
-			n.status === "launched" ? K.info(`dashboard launched at http://localhost:${n.port}`, { port: n.port }) : n.status === "already-running" && K.debug(`dashboard already running on :${n.port}`, { port: n.port });
+			let t = await n({ dashboardAppPath: e });
+			t.status === "launched" ? q.info(`dashboard launched at http://localhost:${t.port}`, { port: t.port }) : t.status === "already-running" && q.debug(`dashboard already running on :${t.port}`, { port: t.port });
 		}
 		setInterval(() => {
-			E({
-				id: j,
-				name: A,
+			w({
+				id: M,
+				name: D,
 				kind: "web",
-				url: `http://localhost:${x}`,
+				url: `http://localhost:${S}`,
 				pid: process.pid,
 				status: "live",
 				logFile: N.path
 			}).catch(() => {});
 		}, 1e4).unref();
 	} catch (e) {
-		K.warn("runtime-registry write failed", {}, e);
+		q.warn("runtime-registry write failed", {}, e);
 	}
-	fe({
-		app: c.name ?? "unnamed",
+	pe({
+		app: m.name ?? "unnamed",
 		kind: "web",
-		url: `http://localhost:${x}`,
+		url: `http://localhost:${S}`,
 		bootMs: s.total()
 	});
-	let Ie = s.phaseBreakdown();
-	K.info(`start: ready in ${s.total()}ms`, {
+	let Le = s.phaseBreakdown();
+	q.info(`start: ready in ${s.total()}ms`, {
 		bootMs: s.total(),
-		...Ie ? { phases: Ie } : {}
+		...Le ? { phases: Le } : {}
 	});
-	let Le = !1, $ = (t) => async () => {
-		if (!Le) {
-			if (Le = !0, K.info(`received ${t}, shutting down`, { signal: t }), Fe.close(), await De.stop(), V) try {
-				await V.end();
+	let Re = !1, ze = (e) => async () => {
+		if (!Re) {
+			if (Re = !0, q.info(`received ${e}, shutting down`, { signal: e }), Ie.close(), await Oe.stop(), H) try {
+				await H.end();
 			} catch {}
-			await q.close(), await e(j), await N.dispose(), process.exit(0);
+			await J.close(), await t(M), await N.dispose(), process.exit(0);
 		}
 	};
-	process.on("SIGINT", $("SIGINT")), process.on("SIGTERM", $("SIGTERM"));
-	let Re = process.ppid;
-	if (Re > 1) {
+	process.on("SIGINT", ze("SIGINT")), process.on("SIGTERM", ze("SIGTERM"));
+	let Be = process.ppid;
+	if (Be > 1) {
 		let e = setInterval(() => {
-			(process.ppid !== Re || process.ppid === 1) && (clearInterval(e), $("SIGTERM")());
+			(process.ppid !== Be || process.ppid === 1) && (clearInterval(e), ze("SIGTERM")());
 		}, 2e3);
 		e.unref();
 	}
 	return new Promise(() => {});
-}, De = async (e) => {
+}, Oe = async (e) => {
 	process.env.NODE_ENV || (process.env.NODE_ENV = "production");
-	let t = await Ee(L(e.find((e) => !e.startsWith("-")) ?? process.cwd()));
-	return t.ran ? t.exitCode : (K.error("no web app found at this path"), 1);
+	let t = await De(L(e.find((e) => !e.startsWith("-")) ?? process.cwd()));
+	return t.ran ? t.exitCode : (q.error("no web app found at this path"), 1);
 };
 //#endregion
-export { De as t };
+export { Oe as t };