@voltro/cli 0.21.0 → 0.22.0

package/dist/inspect-Dwx0_tUj.js

@@ -1,921 +0,0 @@
-import { lastWriteProvenance as e } from "@voltro/runtime";
-import { timingSafeStringEqual as t } from "@voltro/protocol/session";
-//#region src/inspect.ts
-var n = "/_voltro/inspect", r = () => process.env.VOLTRO_INSPECT === "off", i = (e) => {
-	let n = process.env.VOLTRO_INSPECT_TOKEN;
-	if (!n || n.length === 0) return {
-		ok: !1,
-		reason: "inspect is closed: no VOLTRO_INSPECT_TOKEN configured. `voltro dev` mints one per project; for serve/start set it explicitly (it is never minted outside dev)."
-	};
-	let r = e.authorization ?? e.Authorization;
-	return r ? r.startsWith("Bearer ") ? t(r.slice(7).trim(), n) ? { ok: !0 } : {
-		ok: !1,
-		reason: "token mismatch"
-	} : {
-		ok: !1,
-		reason: "expected \"Bearer <token>\" auth scheme"
-	} : {
-		ok: !1,
-		reason: "missing Authorization header"
-	};
-}, a = (e) => {
-	if (!Array.isArray(e) || e.length === 0) return;
-	let t = [];
-	for (let n of e) {
-		if (typeof n != "object" || !n) continue;
-		if (typeof n.action == "string" && typeof n.resourceType == "string") {
-			t.push({
-				kind: "policy",
-				action: n.action,
-				resourceType: n.resourceType
-			});
-			continue;
-		}
-		let e = n.scope;
-		typeof e != "string" && !Array.isArray(e) || t.push({
-			kind: "scope",
-			scope: typeof e == "string" ? [e] : e.filter((e) => typeof e == "string"),
-			mode: n.mode === "any" ? "any" : "all",
-			resourceScoped: typeof n.resource == "function"
-		});
-	}
-	return t.length > 0 ? t : void 0;
-}, o = (e, t, n = {}) => ({
-	status: e,
-	contentType: "application/json; charset=utf-8",
-	body: JSON.stringify(t),
-	headers: n
-}), s = (e) => {
-	let t;
-	try {
-		t = new URL(e).hostname;
-	} catch {
-		return !1;
-	}
-	return t = t.replace(/^\[|\]$/g, ""), t === "localhost" || t.endsWith(".localhost") || t === "::1" ? !0 : /^127(?:\.\d{1,3}){3}$/.test(t);
-}, c = (e) => !e || e.length === 0 ? {} : s(e) ? {
-	"access-control-allow-origin": e,
-	"access-control-allow-credentials": "true",
-	"access-control-allow-methods": "GET, POST, OPTIONS",
-	"access-control-allow-headers": "authorization, content-type, accept",
-	"access-control-expose-headers": "content-type, content-length",
-	vary: "Origin"
-} : { vary: "Origin" }, l = (e, t = process.env.VOLTRO_DASHBOARD_APPS) => {
-	if (s(e)) return !0;
-	let n;
-	try {
-		n = new URL(e).origin;
-	} catch {
-		return !1;
-	}
-	if (!t || t.trim() === "") return !1;
-	try {
-		let e = JSON.parse(t);
-		return Array.isArray(e) ? e.some((e) => {
-			let t = e?.url;
-			if (typeof t != "string") return !1;
-			try {
-				return new URL(t).origin === n;
-			} catch {
-				return !1;
-			}
-		}) : !1;
-	} catch {
-		return !1;
-	}
-}, u = (e, t, n = {}) => {
-	let r = (e ?? "GET").toUpperCase();
-	if (r === "GET" || r === "HEAD" || r === "OPTIONS") return null;
-	let i = t.origin ?? t.Origin;
-	return i === void 0 || i === "" || s(i) ? null : o(403, {
-		error: "cross-site write rejected",
-		reason: `a state-changing inspect request may not come from origin "${i}" — only same-machine (loopback) origins may write`
-	}, n);
-}, d = (e) => {
-	let t = e.indexOf("?");
-	return t === -1 ? e : e.slice(0, t);
-}, f = (e) => {
-	let t = e.indexOf("?");
-	return t === -1 ? new URLSearchParams() : new URLSearchParams(e.slice(t + 1));
-}, p = (e) => e === "/_voltro/inspect" || e.startsWith("/_voltro/inspect/"), m = [
-	"text",
-	"textarea",
-	"number",
-	"checkbox",
-	"switch",
-	"select",
-	"radio",
-	"async-select",
-	"multi-select",
-	"date",
-	"datetime",
-	"daterange",
-	"file",
-	"hidden",
-	"custom"
-], h = (e, t, n = [], r = []) => ({
-	version: 2,
-	scopes: [...new Set(r.flatMap((e) => e.declaredScopes ?? []))].sort(),
-	procedures: [...e].sort((e, t) => e.tag.localeCompare(t.tag)).map((e) => ({
-		tag: e.tag,
-		kind: e.kind,
-		...e.inputSchema === void 0 ? {} : { input: e.inputSchema },
-		...e.outputSchema === void 0 ? {} : { output: e.outputSchema },
-		...e.source === void 0 ? {} : { source: e.source },
-		...e.targets === void 0 ? {} : { targets: e.targets },
-		...e.guards === void 0 ? {} : { guards: e.guards },
-		...e.publicApi === void 0 ? {} : { publicApi: e.publicApi },
-		...e.exposeAsTool === void 0 ? {} : { exposeAsTool: e.exposeAsTool }
-	})),
-	workflows: [...t].sort((e, t) => e.tag.localeCompare(t.tag)).map((e) => ({ name: e.tag })),
-	widgets: m,
-	tables: [...n].filter((e) => !e.isFrameworkTable).sort((e, t) => e.name.localeCompare(t.name)).map((e) => ({
-		name: e.name,
-		reactive: e.isReactive,
-		framework: e.isFrameworkTable,
-		columns: e.columns.map((e) => ({
-			name: e.name,
-			type: String(e.type),
-			nullable: e.nullable,
-			...e.referencesTable === void 0 ? {} : { refersTo: e.referencesTable },
-			...e.oneOf === void 0 ? {} : { enum: e.oneOf }
-		}))
-	}))
-}), g = (e, t, n = {}, a = {}) => {
-	let s = d(e);
-	if (!p(s)) return null;
-	let l = c(n.origin ?? n.Origin);
-	if ((a.method ?? "GET").toUpperCase() === "OPTIONS") return {
-		status: 204,
-		contentType: "text/plain",
-		body: "",
-		headers: l
-	};
-	if (r()) return o(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, l);
-	let u = (a.authResolver ?? i)(n);
-	if (!u.ok) return o(401, {
-		error: "unauthorized",
-		reason: u.reason
-	}, l);
-	if (s === "/_voltro/inspect" || s === "/_voltro/inspect/" || s === "/_voltro/inspect/app") return o(200, {
-		kind: t.kind,
-		...t.meta
-	}, l);
-	if (s === "/_voltro/inspect/routes") return t.kind === "web" ? o(200, {
-		pages: t.routes,
-		dirs: t.dirs
-	}, l) : o(404, { error: "routes endpoint is web-only" }, l);
-	if (s === "/_voltro/inspect/cache") return t.kind === "web" ? o(200, t.cache(), l) : o(404, { error: "cache endpoint is web-only" }, l);
-	if (s === "/_voltro/inspect/rpc") return t.kind === "api" ? o(200, {
-		procedures: t.rpc,
-		workflows: t.workflows
-	}, l) : o(404, { error: "rpc endpoint is api-only" }, l);
-	if (s === "/_voltro/inspect/manifest") {
-		if (t.kind !== "api") return o(404, { error: "manifest endpoint is api-only" }, l);
-		let e = t.inspectTables?.().tables ?? [];
-		return o(200, h(t.rpc, t.workflows, e, t.plugins?.().plugins ?? []), l);
-	}
-	return s === "/_voltro/inspect/metrics" ? t.metrics === void 0 ? o(200, [], l) : o(200, t.metrics(), l) : s === "/_voltro/inspect/subscriptions" ? t.kind === "api" ? t.subscriptions === void 0 ? o(200, {
-		subscriptions: [],
-		matcherStats: [],
-		capturedAt: Date.now()
-	}, l) : o(200, t.subscriptions(), l) : o(404, { error: "subscriptions endpoint is api-only" }, l) : s === "/_voltro/inspect/data-cache" ? t.kind === "api" ? t.dataCache === void 0 ? o(200, {
-		backend: "memory",
-		engine: "memory",
-		driver: "resp",
-		hits: 0,
-		misses: 0,
-		hitRate: 0
-	}, l) : o(200, t.dataCache(), l) : o(404, { error: "data-cache endpoint is api-only" }, l) : s === "/_voltro/inspect/database" ? t.kind === "api" ? t.database === void 0 ? o(200, {
-		migrations: [],
-		seeds: []
-	}, l) : o(200, t.database(), l) : o(404, { error: "database endpoint is api-only" }, l) : s === "/_voltro/inspect/plugins" ? t.kind === "api" ? t.plugins === void 0 ? o(200, {
-		plugins: [],
-		capturedAt: Date.now()
-	}, l) : o(200, t.plugins(), l) : o(404, { error: "plugins endpoint is api-only" }, l) : s === "/_voltro/inspect/env" ? t.env === void 0 ? o(200, {
-		app: t.meta.name ?? "app",
-		entries: [],
-		summary: {
-			total: 0,
-			set: 0,
-			missingRequired: 0
-		}
-	}, l) : o(200, t.env(), l) : s === "/_voltro/inspect/data/tables" ? t.kind === "api" ? t.inspectTables === void 0 ? o(200, { tables: [] }, l) : o(200, t.inspectTables(), l) : o(404, { error: "data viewer is api-only" }, l) : s === "/_voltro/inspect/invoke" ? o(404, { error: "invoke not enabled here — use POST handler" }, l) : o(404, {
-		error: "unknown inspect endpoint",
-		path: s
-	}, l);
-}, _ = async (e, t, n, a = {}) => {
-	let s = c(t.origin ?? t.Origin);
-	if (r()) return o(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, s);
-	if ((a.method ?? "POST").toUpperCase() !== "POST") return o(405, {
-		error: "method not allowed",
-		expected: "POST"
-	}, s);
-	let l = (a.authResolver ?? i)(t);
-	if (!l.ok) return o(401, {
-		error: "unauthorized",
-		reason: l.reason
-	}, s);
-	if (e.kind !== "api") return o(404, { error: "invoke endpoint is api-only" }, s);
-	if (!e.invokers || e.invokers.size === 0) return o(404, { error: "invoke not configured" }, s);
-	let u;
-	try {
-		u = JSON.parse(n || "{}");
-	} catch {
-		return o(400, { error: "body must be JSON" }, s);
-	}
-	let d = u;
-	if (typeof d.tag != "string") return o(400, { error: "body.tag must be a string" }, s);
-	let f = e.invokers.get(d.tag);
-	if (!f) return o(404, {
-		error: "unknown tag",
-		tag: d.tag
-	}, s);
-	let p = typeof d.headers == "object" && d.headers !== null ? d.headers : {}, m = {};
-	for (let [e, n] of Object.entries(t)) m[e.toLowerCase()] = n;
-	for (let [e, t] of Object.entries(p)) {
-		let n = e.toLowerCase();
-		n !== "cookie" && (m[n] = t);
-	}
-	return o(200, await f(d.input, m), s);
-}, v = async (e, t, a, s, l = {}) => {
-	let f = d(e);
-	if (!p(f) || !f.startsWith("/_voltro/inspect/webhooks/")) return null;
-	let m = c(a.origin ?? a.Origin);
-	if ((l.method ?? "POST").toUpperCase() !== "POST") return null;
-	if (r()) return o(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, m);
-	let h = (l.authResolver ?? i)(a);
-	if (!h.ok) return o(401, {
-		error: "unauthorized",
-		reason: h.reason
-	}, m);
-	let g = u(l.method, a, m);
-	if (g) return g;
-	if (t.kind !== "api") return o(404, { error: "webhook actions are api-only" }, m);
-	if (!t.webhookActions) return o(404, { error: "webhook actions not configured — is @voltro/plugin-webhooks active?" }, m);
-	let _;
-	try {
-		_ = JSON.parse(s || "{}");
-	} catch {
-		return o(400, { error: "body must be JSON" }, m);
-	}
-	let v = f.slice(`${n}/webhooks/`.length);
-	try {
-		switch (v) {
-			case "subscribe": {
-				let e = _;
-				return typeof e.event != "string" || e.event.length === 0 ? o(400, { error: "event required" }, m) : typeof e.url != "string" || e.url.length === 0 ? o(400, { error: "url required" }, m) : o(200, await t.webhookActions.subscribe(e), m);
-			}
-			case "pause": {
-				let e = _.targetId;
-				return typeof e != "string" || e.length === 0 ? o(400, { error: "targetId required" }, m) : (await t.webhookActions.pause(e), o(200, { ok: !0 }, m));
-			}
-			case "resume": {
-				let e = _.targetId;
-				return typeof e != "string" || e.length === 0 ? o(400, { error: "targetId required" }, m) : (await t.webhookActions.resume(e), o(200, { ok: !0 }, m));
-			}
-			case "delete": {
-				let e = _.targetId;
-				return typeof e != "string" || e.length === 0 ? o(400, { error: "targetId required" }, m) : (await t.webhookActions.delete(e), o(200, { ok: !0 }, m));
-			}
-			case "rotateSecret": {
-				let e = _.targetId;
-				return typeof e != "string" || e.length === 0 ? o(400, { error: "targetId required" }, m) : o(200, await t.webhookActions.rotateSecret(e), m);
-			}
-			case "replay": {
-				let e = _.deliveryId;
-				return typeof e != "string" || e.length === 0 ? o(400, { error: "deliveryId required" }, m) : (await t.webhookActions.replay(e), o(200, { ok: !0 }, m));
-			}
-			case "repinVersion": {
-				let e = _.targetId, n = _.version;
-				return typeof e != "string" || e.length === 0 ? o(400, { error: "targetId required" }, m) : typeof n != "number" || !Number.isInteger(n) || n < 1 ? o(400, { error: "version must be a positive integer" }, m) : (await t.webhookActions.updateTargetPayloadVersion(e, n), o(200, { ok: !0 }, m));
-			}
-			default: return o(404, { error: `unknown webhook action: ${v}` }, m);
-		}
-	} catch (e) {
-		return o(500, {
-			error: "webhook action failed",
-			message: e?.message ?? String(e)
-		}, m);
-	}
-}, y = async (e, t, a, s, l = {}) => {
-	let u = d(e);
-	if (!p(u)) return null;
-	let f = c(a.origin ?? a.Origin);
-	if ((l.method ?? "POST").toUpperCase() !== "POST") return null;
-	if (r()) return o(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, f);
-	let m = (l.authResolver ?? i)(a);
-	if (!m.ok) return o(401, {
-		error: "unauthorized",
-		reason: m.reason
-	}, f);
-	if (t.kind !== "api") return o(404, { error: "framework-action endpoints are api-only" }, f);
-	let h = `${n}/seeds/run`, g = `${n}/migrations/rollback`, _ = `${n}/migrations/squash`, v = `${n}/migrations/restore-snapshot`;
-	if (u !== h && u !== g && u !== _ && u !== v && u !== "/_voltro/inspect/migrations/compare-env") return null;
-	let y;
-	try {
-		y = JSON.parse(s || "{}");
-	} catch {
-		return o(400, { error: "body must be JSON" }, f);
-	}
-	try {
-		if (u === h) return typeof y.id != "string" || y.id.length === 0 ? o(400, { error: "body.id must be a non-empty string" }, f) : t.runSeed ? o(200, await t.runSeed(y.id), f) : o(404, { error: "runSeed not configured" }, f);
-		if (u === g) return typeof y.id != "string" || y.id.length === 0 ? o(400, { error: "body.id must be a non-empty string" }, f) : t.rollbackMigration ? o(200, await t.rollbackMigration(y.id), f) : o(404, { error: "rollbackMigration not configured" }, f);
-		if (u === _) {
-			if (typeof y.before != "string" || y.before.length === 0) return o(400, { error: "body.before must be a non-empty ISO date string" }, f);
-			if (!t.squashMigrationHistory) return o(404, { error: "squashMigrationHistory not configured" }, f);
-			let e = typeof y.note == "string" ? y.note : void 0;
-			return o(200, await t.squashMigrationHistory({
-				before: y.before,
-				note: e
-			}), f);
-		}
-		return u === v ? typeof y.planId != "string" || y.planId.length === 0 ? o(400, { error: "body.planId must be a non-empty string" }, f) : t.restoreSnapshot ? o(200, await t.restoreSnapshot({ planId: y.planId }), f) : o(404, { error: "restoreSnapshot not configured" }, f) : typeof y.url != "string" || y.url.length === 0 ? o(400, { error: "body.url must be a non-empty URL string" }, f) : t.compareCrossEnv ? (await t.compareCrossEnv({
-			url: y.url,
-			label: typeof y.label == "string" ? y.label : void 0,
-			token: typeof y.token == "string" ? y.token : void 0
-		}), o(200, { ok: !0 }, f)) : o(404, { error: "compareCrossEnv not configured" }, f);
-	} catch (e) {
-		return o(500, {
-			error: "framework action failed",
-			message: e?.message ?? String(e)
-		}, f);
-	}
-}, b = async (e, t, n, a = {}) => {
-	if (d(e) !== "/_voltro/inspect/data/rows") return null;
-	let s = c(n.origin ?? n.Origin);
-	if ((a.method ?? "GET").toUpperCase() !== "GET") return o(405, {
-		error: "method not allowed",
-		expected: "GET"
-	}, s);
-	if (r()) return o(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, s);
-	let l = (a.authResolver ?? i)(n);
-	if (!l.ok) return o(401, {
-		error: "unauthorized",
-		reason: l.reason
-	}, s);
-	if (t.kind !== "api") return o(404, { error: "data viewer is api-only" }, s);
-	if (t.inspectRows === void 0) return o(404, { error: "inspectRows not configured" }, s);
-	let u = S(e), f = u.get("table");
-	if (!f) return o(400, { error: "query.table is required" }, s);
-	let p = C(u.get("offset")) ?? 0, m = C(u.get("limit")) ?? 50, h = {}, g = u.get("q");
-	if (g) {
-		if (g.length > 8192) return o(400, { error: "query.q too large" }, s);
-		try {
-			h = JSON.parse(Buffer.from(g, "base64url").toString("utf8"));
-		} catch {
-			return o(400, { error: "query.q is not valid base64url JSON" }, s);
-		}
-	}
-	try {
-		return o(200, await t.inspectRows({
-			table: f,
-			offset: p,
-			limit: m,
-			...h
-		}), s);
-	} catch (e) {
-		return e?.name === "InspectQueryError" ? o(400, {
-			error: "invalid query",
-			message: e.message
-		}, s) : o(500, {
-			error: "data-rows query failed",
-			message: e?.message ?? String(e)
-		}, s);
-	}
-}, x = async (t, n, a, s = {}) => {
-	if (d(t) !== "/_voltro/inspect/provenance") return null;
-	let l = c(a.origin ?? a.Origin);
-	if ((s.method ?? "GET").toUpperCase() !== "GET") return o(405, {
-		error: "method not allowed",
-		expected: "GET"
-	}, l);
-	if (r()) return o(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, l);
-	let f = (s.authResolver ?? i)(a);
-	if (!f.ok) return o(401, {
-		error: "unauthorized",
-		reason: f.reason
-	}, l);
-	let p = u(s.method, a, l);
-	if (p) return p;
-	if (n.kind !== "api") return o(404, { error: "provenance is api-only" }, l);
-	if (n.inspectRows === void 0) return o(404, { error: "inspectRows not configured" }, l);
-	let m = S(t), h = m.get("table"), g = m.get("id"), _ = m.get("column") ?? void 0;
-	if (!h || !g) return o(400, { error: "query.table and query.id are required" }, l);
-	try {
-		let t = (await n.inspectRows({
-			table: h,
-			limit: 1,
-			filter: {
-				kind: "leaf",
-				column: "id",
-				op: "eq",
-				value: g
-			}
-		})).rows[0];
-		return o(200, e(t, {
-			table: h,
-			id: g,
-			..._ === void 0 ? {} : { column: _ }
-		}), l);
-	} catch (e) {
-		return e?.name === "InspectQueryError" ? o(400, {
-			error: "invalid query",
-			message: e.message
-		}, l) : o(500, {
-			error: "provenance query failed",
-			message: e?.message ?? String(e)
-		}, l);
-	}
-}, S = (e) => {
-	let t = e.indexOf("?");
-	return t < 0 ? new URLSearchParams() : new URLSearchParams(e.slice(t + 1));
-}, C = (e) => {
-	if (e === null || e === "") return;
-	let t = Number(e);
-	return Number.isFinite(t) && t >= 0 ? Math.floor(t) : void 0;
-}, w = async (e, t, n, a = {}) => {
-	if (d(e) !== "/_voltro/inspect/workflows/runs") return null;
-	let s = c(n.origin ?? n.Origin);
-	if ((a.method ?? "GET").toUpperCase() !== "GET") return o(405, {
-		error: "method not allowed",
-		expected: "GET"
-	}, s);
-	if (r()) return o(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, s);
-	let l = (a.authResolver ?? i)(n);
-	if (!l.ok) return o(401, {
-		error: "unauthorized",
-		reason: l.reason
-	}, s);
-	if (t.kind !== "api") return o(404, { error: "workflows endpoint is api-only" }, s);
-	if (t.inspectWorkflowRuns === void 0) return o(200, {
-		runs: [],
-		total: 0,
-		offset: 0,
-		limit: 50
-	}, s);
-	let u = S(e);
-	try {
-		return o(200, await t.inspectWorkflowRuns({
-			...u.get("tag") === null ? {} : { tag: u.get("tag") },
-			...u.get("status") === null ? {} : { status: u.get("status") },
-			offset: C(u.get("offset")) ?? 0,
-			limit: C(u.get("limit")) ?? 50
-		}), s);
-	} catch (e) {
-		return o(500, {
-			error: "workflow-runs query failed",
-			message: e?.message ?? String(e)
-		}, s);
-	}
-}, T = async (e, t, n, a, s = {}) => {
-	let l = d(e).match(/^\/_voltro\/inspect\/workflows\/start\/([^/]+)$/);
-	if (!l) return null;
-	let u = decodeURIComponent(l[1] ?? ""), f = c(n.origin ?? n.Origin);
-	if ((s.method ?? "POST").toUpperCase() !== "POST") return o(405, {
-		error: "method not allowed",
-		expected: "POST"
-	}, f);
-	if (r()) return o(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, f);
-	let p = (s.authResolver ?? i)(n);
-	if (!p.ok) return o(401, {
-		error: "unauthorized",
-		reason: p.reason
-	}, f);
-	if (t.kind !== "api") return o(404, { error: "workflow start is api-only" }, f);
-	if (t.inspectStartWorkflow === void 0) return o(404, { error: "inspectStartWorkflow not configured" }, f);
-	let m = {};
-	if (a.length > 0) try {
-		m = JSON.parse(a).payload ?? {};
-	} catch {
-		return o(400, { error: "start requires JSON body `{ payload?: unknown }`" }, f);
-	}
-	try {
-		return o(200, await t.inspectStartWorkflow({
-			name: u,
-			payload: m
-		}), f);
-	} catch (e) {
-		return o(500, {
-			error: "workflow start failed",
-			message: e?.message ?? String(e)
-		}, f);
-	}
-}, E = async (e, t, n, a = {}) => {
-	let s = d(e);
-	if (!s.startsWith("/_voltro/inspect/schedules")) return null;
-	let l = c(n.origin ?? n.Origin);
-	if (r()) return o(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, l);
-	let f = (a.authResolver ?? i)(n);
-	if (!f.ok) return o(401, {
-		error: "unauthorized",
-		reason: f.reason
-	}, l);
-	let p = u(a.method, n, l);
-	if (p) return p;
-	if (t.kind !== "api") return o(404, { error: "schedules are api-only" }, l);
-	let m = (a.method ?? "GET").toUpperCase(), h = s.match(/^\/_voltro\/inspect\/schedules\/([^/]+)\/fire$/);
-	if (h) {
-		if (m !== "POST") return o(405, {
-			error: "method not allowed",
-			expected: "POST"
-		}, l);
-		if (!t.inspectFireSchedule) return o(404, { error: "inspectFireSchedule not configured" }, l);
-		let n = decodeURIComponent(h[1] ?? ""), r = S(e).get("trigger") === "external" ? "external" : "manual";
-		try {
-			return o(200, await t.inspectFireSchedule({
-				name: n,
-				trigger: r
-			}), l);
-		} catch (e) {
-			return o(500, {
-				error: "fire failed",
-				message: e?.message ?? String(e)
-			}, l);
-		}
-	}
-	if (s === "/_voltro/inspect/schedules/runs") {
-		if (m !== "GET") return o(405, {
-			error: "method not allowed",
-			expected: "GET"
-		}, l);
-		if (!t.inspectScheduleRuns) return o(200, {
-			runs: [],
-			total: 0,
-			offset: 0,
-			limit: 50
-		}, l);
-		let n = S(e);
-		try {
-			return o(200, await t.inspectScheduleRuns({
-				...n.get("name") === null ? {} : { name: n.get("name") },
-				offset: C(n.get("offset")) ?? 0,
-				limit: C(n.get("limit")) ?? 50
-			}), l);
-		} catch (e) {
-			return o(500, {
-				error: "schedule-runs query failed",
-				message: e?.message ?? String(e)
-			}, l);
-		}
-	}
-	return s === "/_voltro/inspect/schedules" ? m === "GET" ? t.inspectSchedules ? o(200, t.inspectSchedules(), l) : o(200, {
-		schedules: [],
-		coordination: "single"
-	}, l) : o(405, {
-		error: "method not allowed",
-		expected: "GET"
-	}, l) : o(404, {
-		error: "unknown schedules endpoint",
-		path: s
-	}, l);
-}, D = async (e, t, n, a = {}) => {
-	if (d(e) !== "/_voltro/inspect/cluster") return null;
-	let s = c(n.origin ?? n.Origin);
-	if (r()) return o(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, s);
-	let l = (a.authResolver ?? i)(n);
-	if (!l.ok) return o(401, {
-		error: "unauthorized",
-		reason: l.reason
-	}, s);
-	let f = u(a.method, n, s);
-	if (f) return f;
-	if (t.kind !== "api") return o(404, { error: "cluster is api-only" }, s);
-	if ((a.method ?? "GET").toUpperCase() !== "GET") return o(405, {
-		error: "method not allowed",
-		expected: "GET"
-	}, s);
-	if (!t.cluster) return o(200, {
-		instance: {
-			replicaId: process.env.POD_NAME ?? process.env.HOSTNAME ?? `dev-${process.pid}`,
-			dialect: "memory",
-			runnerHost: "localhost",
-			runnerPort: 0,
-			runnerStorage: "none",
-			shardLock: "none",
-			coordination: "single",
-			cdc: {
-				enabled: !1,
-				flavor: "none (single-process)"
-			},
-			tier: "none",
-			localhostRisk: !1
-		},
-		coordinationState: {
-			recentReplicaIds: [],
-			scheduleClaims: [],
-			runningScheduleRuns: 0,
-			runningWorkflowRuns: 0
-		},
-		capturedAt: Date.now()
-	}, s);
-	try {
-		return o(200, await t.cluster(), s);
-	} catch (e) {
-		return o(500, {
-			error: "cluster snapshot failed",
-			message: e?.message ?? String(e)
-		}, s);
-	}
-}, O = async (e, t, n, a = {}) => {
-	let s = d(e).match(/^\/_voltro\/inspect\/workflows\/runs\/([^/]+)\/steps$/);
-	if (!s) return null;
-	let l = decodeURIComponent(s[1] ?? ""), u = c(n.origin ?? n.Origin);
-	if ((a.method ?? "GET").toUpperCase() !== "GET") return o(405, {
-		error: "method not allowed",
-		expected: "GET"
-	}, u);
-	if (r()) return o(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, u);
-	let f = (a.authResolver ?? i)(n);
-	if (!f.ok) return o(401, {
-		error: "unauthorized",
-		reason: f.reason
-	}, u);
-	if (t.kind !== "api") return o(404, { error: "workflow steps are api-only" }, u);
-	if (t.inspectWorkflowRunSteps === void 0) return o(200, { steps: [] }, u);
-	try {
-		return o(200, await t.inspectWorkflowRunSteps({ runId: l }), u);
-	} catch (e) {
-		return o(500, {
-			error: "steps query failed",
-			message: e?.message ?? String(e)
-		}, u);
-	}
-}, k = async (e, t, n, a = {}) => {
-	let s = d(e).match(/^\/_voltro\/inspect\/workflows\/runs\/([^/]+)\/events$/);
-	if (!s) return null;
-	let l = decodeURIComponent(s[1] ?? ""), u = c(n.origin ?? n.Origin);
-	if ((a.method ?? "GET").toUpperCase() !== "GET") return o(405, {
-		error: "method not allowed",
-		expected: "GET"
-	}, u);
-	if (r()) return o(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, u);
-	let f = (a.authResolver ?? i)(n);
-	if (!f.ok) return o(401, {
-		error: "unauthorized",
-		reason: f.reason
-	}, u);
-	if (t.kind !== "api") return o(404, { error: "workflow events are api-only" }, u);
-	if (t.inspectWorkflowRunEvents === void 0) return o(200, { events: [] }, u);
-	try {
-		return o(200, await t.inspectWorkflowRunEvents({ runId: l }), u);
-	} catch (e) {
-		return o(500, {
-			error: "events query failed",
-			message: e?.message ?? String(e)
-		}, u);
-	}
-}, A = async (e, t, n, a = {}) => {
-	if (d(t) !== "/_voltro/inspect/workflows/events") return null;
-	let s = c(n.origin ?? n.Origin);
-	if ((a.method ?? "GET").toUpperCase() !== "GET") return o(405, {
-		error: "method not allowed",
-		expected: "GET"
-	}, s);
-	if (r()) return o(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, s);
-	let l = (a.authResolver ?? i)(n);
-	if (!l.ok) return o(401, {
-		error: "unauthorized",
-		reason: l.reason
-	}, s);
-	if (e.kind !== "api") return o(404, { error: "workflow domain events are api-only" }, s);
-	if (e.inspectWorkflowDomainEvents === void 0) return o(200, {
-		events: [],
-		total: 0,
-		offset: 0,
-		limit: 100
-	}, s);
-	let u = f(t), p = u.get("name") ?? void 0, m = Number(u.get("offset") ?? "0"), h = Number(u.get("limit") ?? "100");
-	try {
-		return o(200, await e.inspectWorkflowDomainEvents({
-			...p !== void 0 && p !== "" ? { name: p } : {},
-			offset: Number.isFinite(m) ? m : 0,
-			limit: Number.isFinite(h) ? h : 100
-		}), s);
-	} catch (e) {
-		return o(500, {
-			error: "workflow domain events query failed",
-			message: e?.message ?? String(e)
-		}, s);
-	}
-}, j = async (e, t, n, a = {}) => {
-	let s = d(t).match(/^\/_voltro\/inspect\/workflows\/events\/([^/]+)\/deliveries$/);
-	if (!s) return null;
-	let l = decodeURIComponent(s[1] ?? ""), u = c(n.origin ?? n.Origin);
-	if ((a.method ?? "GET").toUpperCase() !== "GET") return o(405, {
-		error: "method not allowed",
-		expected: "GET"
-	}, u);
-	if (r()) return o(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, u);
-	let f = (a.authResolver ?? i)(n);
-	if (!f.ok) return o(401, {
-		error: "unauthorized",
-		reason: f.reason
-	}, u);
-	if (e.kind !== "api") return o(404, { error: "workflow event deliveries are api-only" }, u);
-	if (e.inspectWorkflowEventDeliveries === void 0) return o(200, { deliveries: [] }, u);
-	try {
-		return o(200, await e.inspectWorkflowEventDeliveries({ eventId: l }), u);
-	} catch (e) {
-		return o(500, {
-			error: "workflow event deliveries query failed",
-			message: e?.message ?? String(e)
-		}, u);
-	}
-}, M = async (e, t, n, a = {}) => {
-	if (d(e) !== "/_voltro/inspect/workflows/children") return null;
-	let s = c(n.origin ?? n.Origin);
-	if ((a.method ?? "GET").toUpperCase() !== "GET") return o(405, {
-		error: "method not allowed",
-		expected: "GET"
-	}, s);
-	if (r()) return o(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, s);
-	let l = (a.authResolver ?? i)(n);
-	if (!l.ok) return o(401, {
-		error: "unauthorized",
-		reason: l.reason
-	}, s);
-	if (t.kind !== "api") return o(404, { error: "workflow children are api-only" }, s);
-	let u = S(e).get("parentExecutionId");
-	if (u === null || u === "") return o(400, { error: "parentExecutionId query param required" }, s);
-	if (t.inspectWorkflowChildren === void 0) return o(200, {
-		runs: [],
-		total: 0,
-		offset: 0,
-		limit: 200
-	}, s);
-	try {
-		return o(200, await t.inspectWorkflowChildren({ parentExecutionId: u }), s);
-	} catch (e) {
-		return o(500, {
-			error: "children query failed",
-			message: e?.message ?? String(e)
-		}, s);
-	}
-}, N = async (e, t, n, a, s = {}) => {
-	let l = d(e).match(/^\/_voltro\/inspect\/workflows\/runs\/([^/]+)\/(cancel|retry|suspend|resume|signal|update)$/);
-	if (!l) return null;
-	let u = decodeURIComponent(l[1] ?? ""), f = l[2], p = c(n.origin ?? n.Origin);
-	if ((s.method ?? "POST").toUpperCase() !== "POST") return o(405, {
-		error: "method not allowed",
-		expected: "POST"
-	}, p);
-	if (r()) return o(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, p);
-	let m = (s.authResolver ?? i)(n);
-	if (!m.ok) return o(401, {
-		error: "unauthorized",
-		reason: m.reason
-	}, p);
-	if (t.kind !== "api") return o(404, { error: "workflow actions are api-only" }, p);
-	let h = {
-		cancel: t.inspectCancelWorkflowRun,
-		retry: t.inspectRetryWorkflowRun,
-		suspend: t.inspectSuspendWorkflowRun,
-		resume: t.inspectResumeWorkflowRun,
-		signal: t.inspectSignalWorkflowRun,
-		update: t.inspectUpdateWorkflowRun
-	}[f];
-	if (!h) return o(404, { error: `inspect${f[0]?.toUpperCase() ?? ""}${f.slice(1)}WorkflowRun not configured` }, p);
-	let g, _, v, y, b, x;
-	if (a.length > 0) try {
-		let e = JSON.parse(a);
-		f === "retry" && (g = e.payloadOverride), f === "signal" && (typeof e.signalName == "string" && e.signalName.length > 0 && (_ = e.signalName), v = e.payload), f === "update" && (typeof e.updateName == "string" && e.updateName.length > 0 && (y = e.updateName), b = e.payload, typeof e.timeoutMs == "number" && Number.isFinite(e.timeoutMs) && (x = e.timeoutMs));
-	} catch {}
-	if (f === "signal" && _ === void 0) return o(400, { error: "signal requires JSON body `{ signalName: string, payload?: unknown }`" }, p);
-	if (f === "update" && y === void 0) return o(400, { error: "update requires JSON body `{ updateName: string, payload?: unknown, timeoutMs?: number }`" }, p);
-	try {
-		return o(200, f === "retry" && g !== void 0 ? await h({
-			runId: u,
-			payloadOverride: g
-		}) : f === "signal" ? await h({
-			runId: u,
-			signalName: _,
-			payload: v
-		}) : f === "update" ? await h({
-			runId: u,
-			updateName: y,
-			payload: b,
-			...x === void 0 ? {} : { timeoutMs: x }
-		}) : await h({ runId: u }), p);
-	} catch (e) {
-		return o(500, {
-			error: `${f} failed`,
-			message: e?.message ?? String(e)
-		}, p);
-	}
-}, P = async (e, t, n, a, s = {}) => {
-	if (d(e) !== "/_voltro/inspect/data/import" || (s.method ?? "POST").toUpperCase() !== "POST") return null;
-	let l = c(n.origin ?? n.Origin);
-	if (r()) return o(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, l);
-	let f = (s.authResolver ?? i)(n);
-	if (!f.ok) return o(401, {
-		error: "unauthorized",
-		reason: f.reason
-	}, l);
-	let p = u(s.method, n, l);
-	if (p) return p;
-	if (t.kind !== "api") return o(404, { error: "data import is api-only" }, l);
-	if (!t.inspectImport) return o(404, { error: "inspectImport not configured" }, l);
-	let m;
-	try {
-		m = JSON.parse(a || "{}");
-	} catch {
-		return o(400, { error: "body must be JSON" }, l);
-	}
-	if (typeof m.bundleDir != "string" || !m.bundleDir) return o(400, { error: "body.bundleDir (string) is required" }, l);
-	try {
-		return o(200, await t.inspectImport({
-			bundleDir: m.bundleDir,
-			...m.mode === "upsert" || m.mode === "append" || m.mode === "replace" ? { mode: m.mode } : {},
-			...m.onConflict === "skip" || m.onConflict === "fail" ? { onConflict: m.onConflict } : {},
-			...typeof m.atomic == "boolean" ? { atomic: m.atomic } : {}
-		}), l);
-	} catch (e) {
-		return o(500, {
-			error: "import failed",
-			message: e?.message ?? String(e)
-		}, l);
-	}
-}, F = async (e, t, n, a, s = {}) => {
-	let l = d(e);
-	if (!l.startsWith("/_voltro/inspect/data/rows")) return null;
-	let u = (s.method ?? "POST").toUpperCase();
-	if (u === "GET" && l === "/_voltro/inspect/data/rows") return null;
-	let f = c(n.origin ?? n.Origin);
-	if (r()) return o(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, f);
-	let p = (s.authResolver ?? i)(n);
-	if (!p.ok) return o(401, {
-		error: "unauthorized",
-		reason: p.reason
-	}, f);
-	if (t.kind !== "api") return o(404, { error: "data viewer is api-only" }, f);
-	if (u === "POST" && l === "/_voltro/inspect/data/rows") {
-		if (!t.inspectInsertRow) return o(404, { error: "inspectInsertRow not configured" }, f);
-		let e;
-		try {
-			e = JSON.parse(a || "{}");
-		} catch {
-			return o(400, { error: "body must be JSON" }, f);
-		}
-		if (typeof e.table != "string" || !e.row || typeof e.row != "object") return o(400, { error: "body must be { table: string, row: object }" }, f);
-		try {
-			return o(200, await t.inspectInsertRow({
-				table: e.table,
-				row: e.row
-			}), f);
-		} catch (e) {
-			return o(500, {
-				error: "insert failed",
-				message: e?.message ?? String(e)
-			}, f);
-		}
-	}
-	let m = l.match(/^\/_voltro\/inspect\/data\/rows\/([^/]+)$/);
-	if (!m) return null;
-	let h = decodeURIComponent(m[1] ?? "");
-	if (!h) return o(400, { error: "row id is required in URL" }, f);
-	let g = S(e).get("table") ?? "";
-	if (!g) return o(400, { error: "query.table is required" }, f);
-	if (u === "PATCH") {
-		if (!t.inspectUpdateRow) return o(404, { error: "inspectUpdateRow not configured" }, f);
-		let e;
-		try {
-			e = JSON.parse(a || "{}");
-		} catch {
-			return o(400, { error: "body must be JSON" }, f);
-		}
-		if (!e.patch || typeof e.patch != "object") return o(400, { error: "body.patch must be an object" }, f);
-		try {
-			return o(200, await t.inspectUpdateRow({
-				table: g,
-				id: h,
-				patch: e.patch
-			}), f);
-		} catch (e) {
-			return o(500, {
-				error: "update failed",
-				message: e?.message ?? String(e)
-			}, f);
-		}
-	}
-	if (u === "DELETE") {
-		if (!t.inspectDeleteRow) return o(404, { error: "inspectDeleteRow not configured" }, f);
-		try {
-			return o(200, await t.inspectDeleteRow({
-				table: g,
-				id: h
-			}), f);
-		} catch (e) {
-			return o(500, {
-				error: "delete failed",
-				message: e?.message ?? String(e)
-			}, f);
-		}
-	}
-	return o(405, {
-		error: "method not allowed",
-		expected: "POST | PATCH | DELETE"
-	}, f);
-};
-//#endregion
-export { T as C, s as D, r as E, a as O, w as S, l as T, M as _, i as a, k as b, b as c, _ as d, x as f, N as g, v as h, u as i, F as l, E as m, m as n, D as o, g as p, h as r, P as s, n as t, y as u, A as v, c as w, O as x, j as y };