@voltro/cli 0.21.0 → 0.22.1

package/dist/inspect-_ldwsAwH.js

@@ -0,0 +1,945 @@
+import { lastWriteProvenance as e } from "@voltro/runtime";
+import { timingSafeStringEqual as t } from "@voltro/protocol/session";
+//#region src/inspect.ts
+var n = "/_voltro/inspect", r = () => process.env.VOLTRO_INSPECT === "off", i = /* @__PURE__ */ new Set([
+	"GET",
+	"HEAD",
+	"OPTIONS"
+]), a = (e, n) => {
+	let r = process.env.VOLTRO_INSPECT_TOKEN;
+	if (!r || r.length === 0) return {
+		ok: !1,
+		reason: "inspect is closed: no VOLTRO_INSPECT_TOKEN configured. `voltro dev` mints one per project; for serve/start set it explicitly (it is never minted outside dev)."
+	};
+	let a = e.authorization ?? e.Authorization;
+	if (!a) return {
+		ok: !1,
+		reason: "missing Authorization header"
+	};
+	if (!a.startsWith("Bearer ")) return {
+		ok: !1,
+		reason: "expected \"Bearer <token>\" auth scheme"
+	};
+	if (!t(a.slice(7).trim(), r)) return {
+		ok: !1,
+		reason: "token mismatch"
+	};
+	if (!i.has(n.toUpperCase())) {
+		let r = process.env.VOLTRO_INSPECT_WRITE_TOKEN;
+		if (!r || r.length === 0) return {
+			ok: !1,
+			reason: `inspect: ${(n ?? "unknown-method").toUpperCase()} is refused — no VOLTRO_INSPECT_WRITE_TOKEN configured. Mutating inspect endpoints (GDPR erase/export, storage share/revoke, schedule fire) need their own secret; the read token is not enough. \`voltro dev\` mints one per project; outside dev set it explicitly.`
+		};
+		let i = (e["x-voltro-inspect-write"] ?? e["X-Voltro-Inspect-Write"] ?? "").trim();
+		if (i.length === 0) return {
+			ok: !1,
+			reason: `inspect: ${n.toUpperCase()} needs the write credential — send it as the \`x-voltro-inspect-write\` header alongside the bearer. The read token authorises reads only.`
+		};
+		if (!t(i, r)) return {
+			ok: !1,
+			reason: "inspect: write-credential mismatch"
+		};
+	}
+	return { ok: !0 };
+}, o = (e) => {
+	if (!Array.isArray(e) || e.length === 0) return;
+	let t = [];
+	for (let n of e) {
+		if (typeof n != "object" || !n) continue;
+		if (typeof n.action == "string" && typeof n.resourceType == "string") {
+			t.push({
+				kind: "policy",
+				action: n.action,
+				resourceType: n.resourceType
+			});
+			continue;
+		}
+		let e = n.scope;
+		typeof e != "string" && !Array.isArray(e) || t.push({
+			kind: "scope",
+			scope: typeof e == "string" ? [e] : e.filter((e) => typeof e == "string"),
+			mode: n.mode === "any" ? "any" : "all",
+			resourceScoped: typeof n.resource == "function"
+		});
+	}
+	return t.length > 0 ? t : void 0;
+}, s = (e, t, n = {}) => ({
+	status: e,
+	contentType: "application/json; charset=utf-8",
+	body: JSON.stringify(t),
+	headers: n
+}), c = (e) => {
+	let t;
+	try {
+		t = new URL(e).hostname;
+	} catch {
+		return !1;
+	}
+	return t = t.replace(/^\[|\]$/g, ""), t === "localhost" || t.endsWith(".localhost") || t === "::1" ? !0 : /^127(?:\.\d{1,3}){3}$/.test(t);
+}, l = (e) => !e || e.length === 0 ? {} : c(e) ? {
+	"access-control-allow-origin": e,
+	"access-control-allow-credentials": "true",
+	"access-control-allow-methods": "GET, POST, OPTIONS",
+	"access-control-allow-headers": "authorization, content-type, accept",
+	"access-control-expose-headers": "content-type, content-length",
+	vary: "Origin"
+} : { vary: "Origin" }, u = (e, t = process.env.VOLTRO_DASHBOARD_APPS) => {
+	if (c(e)) return !0;
+	let n;
+	try {
+		n = new URL(e).origin;
+	} catch {
+		return !1;
+	}
+	if (!t || t.trim() === "") return !1;
+	try {
+		let e = JSON.parse(t);
+		return Array.isArray(e) ? e.some((e) => {
+			let t = e?.url;
+			if (typeof t != "string") return !1;
+			try {
+				return new URL(t).origin === n;
+			} catch {
+				return !1;
+			}
+		}) : !1;
+	} catch {
+		return !1;
+	}
+}, d = (e, t, n = {}) => {
+	let r = (e ?? "GET").toUpperCase();
+	if (r === "GET" || r === "HEAD" || r === "OPTIONS") return null;
+	let i = t.origin ?? t.Origin;
+	return i === void 0 || i === "" || c(i) ? null : s(403, {
+		error: "cross-site write rejected",
+		reason: `a state-changing inspect request may not come from origin "${i}" — only same-machine (loopback) origins may write`
+	}, n);
+}, f = (e) => {
+	let t = e.indexOf("?");
+	return t === -1 ? e : e.slice(0, t);
+}, p = (e) => {
+	let t = e.indexOf("?");
+	return t === -1 ? new URLSearchParams() : new URLSearchParams(e.slice(t + 1));
+}, m = (e) => e === "/_voltro/inspect" || e.startsWith("/_voltro/inspect/"), h = [
+	"text",
+	"textarea",
+	"number",
+	"checkbox",
+	"switch",
+	"select",
+	"radio",
+	"async-select",
+	"multi-select",
+	"date",
+	"datetime",
+	"daterange",
+	"file",
+	"hidden",
+	"custom"
+], g = (e, t, n = [], r = []) => ({
+	version: 2,
+	scopes: [...new Set(r.flatMap((e) => e.declaredScopes ?? []))].sort(),
+	procedures: [...e].sort((e, t) => e.tag.localeCompare(t.tag)).map((e) => ({
+		tag: e.tag,
+		kind: e.kind,
+		...e.inputSchema === void 0 ? {} : { input: e.inputSchema },
+		...e.outputSchema === void 0 ? {} : { output: e.outputSchema },
+		...e.source === void 0 ? {} : { source: e.source },
+		...e.targets === void 0 ? {} : { targets: e.targets },
+		...e.guards === void 0 ? {} : { guards: e.guards },
+		...e.publicApi === void 0 ? {} : { publicApi: e.publicApi },
+		...e.exposeAsTool === void 0 ? {} : { exposeAsTool: e.exposeAsTool }
+	})),
+	workflows: [...t].sort((e, t) => e.tag.localeCompare(t.tag)).map((e) => ({ name: e.tag })),
+	widgets: h,
+	tables: [...n].filter((e) => !e.isFrameworkTable).sort((e, t) => e.name.localeCompare(t.name)).map((e) => ({
+		name: e.name,
+		reactive: e.isReactive,
+		framework: e.isFrameworkTable,
+		columns: e.columns.map((e) => ({
+			name: e.name,
+			type: String(e.type),
+			nullable: e.nullable,
+			...e.referencesTable === void 0 ? {} : { refersTo: e.referencesTable },
+			...e.oneOf === void 0 ? {} : { enum: e.oneOf }
+		}))
+	}))
+}), _ = (e, t, n = {}, i = {}) => {
+	let o = f(e);
+	if (!m(o)) return null;
+	let c = l(n.origin ?? n.Origin), u = (i.method ?? "GET").toUpperCase();
+	if (u === "OPTIONS") return {
+		status: 204,
+		contentType: "text/plain",
+		body: "",
+		headers: c
+	};
+	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, c);
+	let d = (i.authResolver ?? a)(n, u);
+	if (!d.ok) return s(401, {
+		error: "unauthorized",
+		reason: d.reason
+	}, c);
+	if (o === "/_voltro/inspect" || o === "/_voltro/inspect/" || o === "/_voltro/inspect/app") return s(200, {
+		kind: t.kind,
+		...t.meta
+	}, c);
+	if (o === "/_voltro/inspect/routes") return t.kind === "web" ? s(200, {
+		pages: t.routes,
+		dirs: t.dirs
+	}, c) : s(404, { error: "routes endpoint is web-only" }, c);
+	if (o === "/_voltro/inspect/cache") return t.kind === "web" ? s(200, t.cache(), c) : s(404, { error: "cache endpoint is web-only" }, c);
+	if (o === "/_voltro/inspect/rpc") return t.kind === "api" ? s(200, {
+		procedures: t.rpc,
+		workflows: t.workflows
+	}, c) : s(404, { error: "rpc endpoint is api-only" }, c);
+	if (o === "/_voltro/inspect/manifest") {
+		if (t.kind !== "api") return s(404, { error: "manifest endpoint is api-only" }, c);
+		let e = t.inspectTables?.().tables ?? [];
+		return s(200, g(t.rpc, t.workflows, e, t.plugins?.().plugins ?? []), c);
+	}
+	return o === "/_voltro/inspect/metrics" ? t.metrics === void 0 ? s(200, [], c) : s(200, t.metrics(), c) : o === "/_voltro/inspect/subscriptions" ? t.kind === "api" ? t.subscriptions === void 0 ? s(200, {
+		subscriptions: [],
+		matcherStats: [],
+		capturedAt: Date.now()
+	}, c) : s(200, t.subscriptions(), c) : s(404, { error: "subscriptions endpoint is api-only" }, c) : o === "/_voltro/inspect/data-cache" ? t.kind === "api" ? t.dataCache === void 0 ? s(200, {
+		backend: "memory",
+		engine: "memory",
+		driver: "resp",
+		hits: 0,
+		misses: 0,
+		hitRate: 0
+	}, c) : s(200, t.dataCache(), c) : s(404, { error: "data-cache endpoint is api-only" }, c) : o === "/_voltro/inspect/database" ? t.kind === "api" ? t.database === void 0 ? s(200, {
+		migrations: [],
+		seeds: []
+	}, c) : s(200, t.database(), c) : s(404, { error: "database endpoint is api-only" }, c) : o === "/_voltro/inspect/plugins" ? t.kind === "api" ? t.plugins === void 0 ? s(200, {
+		plugins: [],
+		capturedAt: Date.now()
+	}, c) : s(200, t.plugins(), c) : s(404, { error: "plugins endpoint is api-only" }, c) : o === "/_voltro/inspect/env" ? t.env === void 0 ? s(200, {
+		app: t.meta.name ?? "app",
+		entries: [],
+		summary: {
+			total: 0,
+			set: 0,
+			missingRequired: 0
+		}
+	}, c) : s(200, t.env(), c) : o === "/_voltro/inspect/data/tables" ? t.kind === "api" ? t.inspectTables === void 0 ? s(200, { tables: [] }, c) : s(200, t.inspectTables(), c) : s(404, { error: "data viewer is api-only" }, c) : o === "/_voltro/inspect/invoke" ? s(404, { error: "invoke not enabled here — use POST handler" }, c) : s(404, {
+		error: "unknown inspect endpoint",
+		path: o
+	}, c);
+}, v = async (e, t, n, i = {}) => {
+	let o = l(t.origin ?? t.Origin);
+	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, o);
+	let c = (i.method ?? "POST").toUpperCase();
+	if (c !== "POST") return s(405, {
+		error: "method not allowed",
+		expected: "POST"
+	}, o);
+	let u = (i.authResolver ?? a)(t, c);
+	if (!u.ok) return s(401, {
+		error: "unauthorized",
+		reason: u.reason
+	}, o);
+	if (e.kind !== "api") return s(404, { error: "invoke endpoint is api-only" }, o);
+	if (!e.invokers || e.invokers.size === 0) return s(404, { error: "invoke not configured" }, o);
+	let d;
+	try {
+		d = JSON.parse(n || "{}");
+	} catch {
+		return s(400, { error: "body must be JSON" }, o);
+	}
+	let f = d;
+	if (typeof f.tag != "string") return s(400, { error: "body.tag must be a string" }, o);
+	let p = e.invokers.get(f.tag);
+	if (!p) return s(404, {
+		error: "unknown tag",
+		tag: f.tag
+	}, o);
+	let m = typeof f.headers == "object" && f.headers !== null ? f.headers : {}, h = {};
+	for (let [e, n] of Object.entries(t)) h[e.toLowerCase()] = n;
+	for (let [e, t] of Object.entries(m)) {
+		let n = e.toLowerCase();
+		n !== "cookie" && (h[n] = t);
+	}
+	return s(200, await p(f.input, h), o);
+}, y = async (e, t, i, o, c = {}) => {
+	let u = f(e);
+	if (!m(u) || !u.startsWith("/_voltro/inspect/webhooks/")) return null;
+	let p = l(i.origin ?? i.Origin);
+	if ((c.method ?? "POST").toUpperCase() !== "POST") return null;
+	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, p);
+	let h = (c.authResolver ?? a)(i, c.method ?? "POST");
+	if (!h.ok) return s(401, {
+		error: "unauthorized",
+		reason: h.reason
+	}, p);
+	let g = d(c.method, i, p);
+	if (g) return g;
+	if (t.kind !== "api") return s(404, { error: "webhook actions are api-only" }, p);
+	if (!t.webhookActions) return s(404, { error: "webhook actions not configured — is @voltro/plugin-webhooks active?" }, p);
+	let _;
+	try {
+		_ = JSON.parse(o || "{}");
+	} catch {
+		return s(400, { error: "body must be JSON" }, p);
+	}
+	let v = u.slice(`${n}/webhooks/`.length);
+	try {
+		switch (v) {
+			case "subscribe": {
+				let e = _;
+				return typeof e.event != "string" || e.event.length === 0 ? s(400, { error: "event required" }, p) : typeof e.url != "string" || e.url.length === 0 ? s(400, { error: "url required" }, p) : s(200, await t.webhookActions.subscribe(e), p);
+			}
+			case "pause": {
+				let e = _.targetId;
+				return typeof e != "string" || e.length === 0 ? s(400, { error: "targetId required" }, p) : (await t.webhookActions.pause(e), s(200, { ok: !0 }, p));
+			}
+			case "resume": {
+				let e = _.targetId;
+				return typeof e != "string" || e.length === 0 ? s(400, { error: "targetId required" }, p) : (await t.webhookActions.resume(e), s(200, { ok: !0 }, p));
+			}
+			case "delete": {
+				let e = _.targetId;
+				return typeof e != "string" || e.length === 0 ? s(400, { error: "targetId required" }, p) : (await t.webhookActions.delete(e), s(200, { ok: !0 }, p));
+			}
+			case "rotateSecret": {
+				let e = _.targetId;
+				return typeof e != "string" || e.length === 0 ? s(400, { error: "targetId required" }, p) : s(200, await t.webhookActions.rotateSecret(e), p);
+			}
+			case "replay": {
+				let e = _.deliveryId;
+				return typeof e != "string" || e.length === 0 ? s(400, { error: "deliveryId required" }, p) : (await t.webhookActions.replay(e), s(200, { ok: !0 }, p));
+			}
+			case "repinVersion": {
+				let e = _.targetId, n = _.version;
+				return typeof e != "string" || e.length === 0 ? s(400, { error: "targetId required" }, p) : typeof n != "number" || !Number.isInteger(n) || n < 1 ? s(400, { error: "version must be a positive integer" }, p) : (await t.webhookActions.updateTargetPayloadVersion(e, n), s(200, { ok: !0 }, p));
+			}
+			default: return s(404, { error: `unknown webhook action: ${v}` }, p);
+		}
+	} catch (e) {
+		return s(500, {
+			error: "webhook action failed",
+			message: e?.message ?? String(e)
+		}, p);
+	}
+}, b = async (e, t, i, o, c = {}) => {
+	let u = f(e);
+	if (!m(u)) return null;
+	let d = l(i.origin ?? i.Origin), p = (c.method ?? "POST").toUpperCase();
+	if (p !== "POST") return null;
+	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, d);
+	let h = (c.authResolver ?? a)(i, p);
+	if (!h.ok) return s(401, {
+		error: "unauthorized",
+		reason: h.reason
+	}, d);
+	if (t.kind !== "api") return s(404, { error: "framework-action endpoints are api-only" }, d);
+	let g = `${n}/seeds/run`, _ = `${n}/migrations/rollback`, v = `${n}/migrations/squash`, y = `${n}/migrations/restore-snapshot`;
+	if (u !== g && u !== _ && u !== v && u !== y && u !== "/_voltro/inspect/migrations/compare-env") return null;
+	let b;
+	try {
+		b = JSON.parse(o || "{}");
+	} catch {
+		return s(400, { error: "body must be JSON" }, d);
+	}
+	try {
+		if (u === g) return typeof b.id != "string" || b.id.length === 0 ? s(400, { error: "body.id must be a non-empty string" }, d) : t.runSeed ? s(200, await t.runSeed(b.id), d) : s(404, { error: "runSeed not configured" }, d);
+		if (u === _) return typeof b.id != "string" || b.id.length === 0 ? s(400, { error: "body.id must be a non-empty string" }, d) : t.rollbackMigration ? s(200, await t.rollbackMigration(b.id), d) : s(404, { error: "rollbackMigration not configured" }, d);
+		if (u === v) {
+			if (typeof b.before != "string" || b.before.length === 0) return s(400, { error: "body.before must be a non-empty ISO date string" }, d);
+			if (!t.squashMigrationHistory) return s(404, { error: "squashMigrationHistory not configured" }, d);
+			let e = typeof b.note == "string" ? b.note : void 0;
+			return s(200, await t.squashMigrationHistory({
+				before: b.before,
+				note: e
+			}), d);
+		}
+		return u === y ? typeof b.planId != "string" || b.planId.length === 0 ? s(400, { error: "body.planId must be a non-empty string" }, d) : t.restoreSnapshot ? s(200, await t.restoreSnapshot({ planId: b.planId }), d) : s(404, { error: "restoreSnapshot not configured" }, d) : typeof b.url != "string" || b.url.length === 0 ? s(400, { error: "body.url must be a non-empty URL string" }, d) : t.compareCrossEnv ? (await t.compareCrossEnv({
+			url: b.url,
+			label: typeof b.label == "string" ? b.label : void 0,
+			token: typeof b.token == "string" ? b.token : void 0
+		}), s(200, { ok: !0 }, d)) : s(404, { error: "compareCrossEnv not configured" }, d);
+	} catch (e) {
+		return s(500, {
+			error: "framework action failed",
+			message: e?.message ?? String(e)
+		}, d);
+	}
+}, x = async (e, t, n, i = {}) => {
+	if (f(e) !== "/_voltro/inspect/data/rows") return null;
+	let o = l(n.origin ?? n.Origin), c = (i.method ?? "GET").toUpperCase();
+	if (c !== "GET") return s(405, {
+		error: "method not allowed",
+		expected: "GET"
+	}, o);
+	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, o);
+	let u = (i.authResolver ?? a)(n, c);
+	if (!u.ok) return s(401, {
+		error: "unauthorized",
+		reason: u.reason
+	}, o);
+	if (t.kind !== "api") return s(404, { error: "data viewer is api-only" }, o);
+	if (t.inspectRows === void 0) return s(404, { error: "inspectRows not configured" }, o);
+	let d = C(e), p = d.get("table");
+	if (!p) return s(400, { error: "query.table is required" }, o);
+	let m = w(d.get("offset")) ?? 0, h = w(d.get("limit")) ?? 50, g = {}, _ = d.get("q");
+	if (_) {
+		if (_.length > 8192) return s(400, { error: "query.q too large" }, o);
+		try {
+			g = JSON.parse(Buffer.from(_, "base64url").toString("utf8"));
+		} catch {
+			return s(400, { error: "query.q is not valid base64url JSON" }, o);
+		}
+	}
+	try {
+		return s(200, await t.inspectRows({
+			table: p,
+			offset: m,
+			limit: h,
+			...g
+		}), o);
+	} catch (e) {
+		return e?.name === "InspectQueryError" ? s(400, {
+			error: "invalid query",
+			message: e.message
+		}, o) : s(500, {
+			error: "data-rows query failed",
+			message: e?.message ?? String(e)
+		}, o);
+	}
+}, S = async (t, n, i, o = {}) => {
+	if (f(t) !== "/_voltro/inspect/provenance") return null;
+	let c = l(i.origin ?? i.Origin), u = (o.method ?? "GET").toUpperCase();
+	if (u !== "GET") return s(405, {
+		error: "method not allowed",
+		expected: "GET"
+	}, c);
+	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, c);
+	let p = (o.authResolver ?? a)(i, u);
+	if (!p.ok) return s(401, {
+		error: "unauthorized",
+		reason: p.reason
+	}, c);
+	let m = d(o.method, i, c);
+	if (m) return m;
+	if (n.kind !== "api") return s(404, { error: "provenance is api-only" }, c);
+	if (n.inspectRows === void 0) return s(404, { error: "inspectRows not configured" }, c);
+	let h = C(t), g = h.get("table"), _ = h.get("id"), v = h.get("column") ?? void 0;
+	if (!g || !_) return s(400, { error: "query.table and query.id are required" }, c);
+	try {
+		let t = (await n.inspectRows({
+			table: g,
+			limit: 1,
+			filter: {
+				kind: "leaf",
+				column: "id",
+				op: "eq",
+				value: _
+			}
+		})).rows[0];
+		return s(200, e(t, {
+			table: g,
+			id: _,
+			...v === void 0 ? {} : { column: v }
+		}), c);
+	} catch (e) {
+		return e?.name === "InspectQueryError" ? s(400, {
+			error: "invalid query",
+			message: e.message
+		}, c) : s(500, {
+			error: "provenance query failed",
+			message: e?.message ?? String(e)
+		}, c);
+	}
+}, C = (e) => {
+	let t = e.indexOf("?");
+	return t < 0 ? new URLSearchParams() : new URLSearchParams(e.slice(t + 1));
+}, w = (e) => {
+	if (e === null || e === "") return;
+	let t = Number(e);
+	return Number.isFinite(t) && t >= 0 ? Math.floor(t) : void 0;
+}, T = async (e, t, n, i = {}) => {
+	if (f(e) !== "/_voltro/inspect/workflows/runs") return null;
+	let o = l(n.origin ?? n.Origin), c = (i.method ?? "GET").toUpperCase();
+	if (c !== "GET") return s(405, {
+		error: "method not allowed",
+		expected: "GET"
+	}, o);
+	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, o);
+	let u = (i.authResolver ?? a)(n, c);
+	if (!u.ok) return s(401, {
+		error: "unauthorized",
+		reason: u.reason
+	}, o);
+	if (t.kind !== "api") return s(404, { error: "workflows endpoint is api-only" }, o);
+	if (t.inspectWorkflowRuns === void 0) return s(200, {
+		runs: [],
+		total: 0,
+		offset: 0,
+		limit: 50
+	}, o);
+	let d = C(e);
+	try {
+		return s(200, await t.inspectWorkflowRuns({
+			...d.get("tag") === null ? {} : { tag: d.get("tag") },
+			...d.get("status") === null ? {} : { status: d.get("status") },
+			offset: w(d.get("offset")) ?? 0,
+			limit: w(d.get("limit")) ?? 50
+		}), o);
+	} catch (e) {
+		return s(500, {
+			error: "workflow-runs query failed",
+			message: e?.message ?? String(e)
+		}, o);
+	}
+}, E = async (e, t, n, i, o = {}) => {
+	let c = f(e).match(/^\/_voltro\/inspect\/workflows\/start\/([^/]+)$/);
+	if (!c) return null;
+	let u = decodeURIComponent(c[1] ?? ""), d = l(n.origin ?? n.Origin), p = (o.method ?? "POST").toUpperCase();
+	if (p !== "POST") return s(405, {
+		error: "method not allowed",
+		expected: "POST"
+	}, d);
+	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, d);
+	let m = (o.authResolver ?? a)(n, p);
+	if (!m.ok) return s(401, {
+		error: "unauthorized",
+		reason: m.reason
+	}, d);
+	if (t.kind !== "api") return s(404, { error: "workflow start is api-only" }, d);
+	if (t.inspectStartWorkflow === void 0) return s(404, { error: "inspectStartWorkflow not configured" }, d);
+	let h = {};
+	if (i.length > 0) try {
+		h = JSON.parse(i).payload ?? {};
+	} catch {
+		return s(400, { error: "start requires JSON body `{ payload?: unknown }`" }, d);
+	}
+	try {
+		return s(200, await t.inspectStartWorkflow({
+			name: u,
+			payload: h
+		}), d);
+	} catch (e) {
+		return s(500, {
+			error: "workflow start failed",
+			message: e?.message ?? String(e)
+		}, d);
+	}
+}, D = async (e, t, n, i = {}) => {
+	let o = f(e);
+	if (!o.startsWith("/_voltro/inspect/schedules")) return null;
+	let c = l(n.origin ?? n.Origin);
+	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, c);
+	let u = (i.authResolver ?? a)(n, i.method ?? "POST");
+	if (!u.ok) return s(401, {
+		error: "unauthorized",
+		reason: u.reason
+	}, c);
+	let p = d(i.method, n, c);
+	if (p) return p;
+	if (t.kind !== "api") return s(404, { error: "schedules are api-only" }, c);
+	let m = (i.method ?? "GET").toUpperCase(), h = o.match(/^\/_voltro\/inspect\/schedules\/([^/]+)\/fire$/);
+	if (h) {
+		if (m !== "POST") return s(405, {
+			error: "method not allowed",
+			expected: "POST"
+		}, c);
+		if (!t.inspectFireSchedule) return s(404, { error: "inspectFireSchedule not configured" }, c);
+		let n = decodeURIComponent(h[1] ?? ""), r = C(e).get("trigger") === "external" ? "external" : "manual";
+		try {
+			return s(200, await t.inspectFireSchedule({
+				name: n,
+				trigger: r
+			}), c);
+		} catch (e) {
+			return s(500, {
+				error: "fire failed",
+				message: e?.message ?? String(e)
+			}, c);
+		}
+	}
+	if (o === "/_voltro/inspect/schedules/runs") {
+		if (m !== "GET") return s(405, {
+			error: "method not allowed",
+			expected: "GET"
+		}, c);
+		if (!t.inspectScheduleRuns) return s(200, {
+			runs: [],
+			total: 0,
+			offset: 0,
+			limit: 50
+		}, c);
+		let n = C(e);
+		try {
+			return s(200, await t.inspectScheduleRuns({
+				...n.get("name") === null ? {} : { name: n.get("name") },
+				offset: w(n.get("offset")) ?? 0,
+				limit: w(n.get("limit")) ?? 50
+			}), c);
+		} catch (e) {
+			return s(500, {
+				error: "schedule-runs query failed",
+				message: e?.message ?? String(e)
+			}, c);
+		}
+	}
+	return o === "/_voltro/inspect/schedules" ? m === "GET" ? t.inspectSchedules ? s(200, t.inspectSchedules(), c) : s(200, {
+		schedules: [],
+		coordination: "single"
+	}, c) : s(405, {
+		error: "method not allowed",
+		expected: "GET"
+	}, c) : s(404, {
+		error: "unknown schedules endpoint",
+		path: o
+	}, c);
+}, O = async (e, t, n, i = {}) => {
+	if (f(e) !== "/_voltro/inspect/cluster") return null;
+	let o = l(n.origin ?? n.Origin);
+	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, o);
+	let c = (i.authResolver ?? a)(n, i.method ?? "POST");
+	if (!c.ok) return s(401, {
+		error: "unauthorized",
+		reason: c.reason
+	}, o);
+	let u = d(i.method, n, o);
+	if (u) return u;
+	if (t.kind !== "api") return s(404, { error: "cluster is api-only" }, o);
+	if ((i.method ?? "GET").toUpperCase() !== "GET") return s(405, {
+		error: "method not allowed",
+		expected: "GET"
+	}, o);
+	if (!t.cluster) return s(200, {
+		instance: {
+			replicaId: process.env.POD_NAME ?? process.env.HOSTNAME ?? `dev-${process.pid}`,
+			dialect: "memory",
+			runnerHost: "localhost",
+			runnerPort: 0,
+			runnerStorage: "none",
+			shardLock: "none",
+			coordination: "single",
+			cdc: {
+				enabled: !1,
+				flavor: "none (single-process)"
+			},
+			tier: "none",
+			localhostRisk: !1
+		},
+		coordinationState: {
+			recentReplicaIds: [],
+			scheduleClaims: [],
+			runningScheduleRuns: 0,
+			runningWorkflowRuns: 0
+		},
+		capturedAt: Date.now()
+	}, o);
+	try {
+		return s(200, await t.cluster(), o);
+	} catch (e) {
+		return s(500, {
+			error: "cluster snapshot failed",
+			message: e?.message ?? String(e)
+		}, o);
+	}
+}, k = async (e, t, n, i = {}) => {
+	let o = f(e).match(/^\/_voltro\/inspect\/workflows\/runs\/([^/]+)\/steps$/);
+	if (!o) return null;
+	let c = decodeURIComponent(o[1] ?? ""), u = l(n.origin ?? n.Origin), d = (i.method ?? "GET").toUpperCase();
+	if (d !== "GET") return s(405, {
+		error: "method not allowed",
+		expected: "GET"
+	}, u);
+	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, u);
+	let p = (i.authResolver ?? a)(n, d);
+	if (!p.ok) return s(401, {
+		error: "unauthorized",
+		reason: p.reason
+	}, u);
+	if (t.kind !== "api") return s(404, { error: "workflow steps are api-only" }, u);
+	if (t.inspectWorkflowRunSteps === void 0) return s(200, { steps: [] }, u);
+	try {
+		return s(200, await t.inspectWorkflowRunSteps({ runId: c }), u);
+	} catch (e) {
+		return s(500, {
+			error: "steps query failed",
+			message: e?.message ?? String(e)
+		}, u);
+	}
+}, A = async (e, t, n, i = {}) => {
+	let o = f(e).match(/^\/_voltro\/inspect\/workflows\/runs\/([^/]+)\/events$/);
+	if (!o) return null;
+	let c = decodeURIComponent(o[1] ?? ""), u = l(n.origin ?? n.Origin), d = (i.method ?? "GET").toUpperCase();
+	if (d !== "GET") return s(405, {
+		error: "method not allowed",
+		expected: "GET"
+	}, u);
+	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, u);
+	let p = (i.authResolver ?? a)(n, d);
+	if (!p.ok) return s(401, {
+		error: "unauthorized",
+		reason: p.reason
+	}, u);
+	if (t.kind !== "api") return s(404, { error: "workflow events are api-only" }, u);
+	if (t.inspectWorkflowRunEvents === void 0) return s(200, { events: [] }, u);
+	try {
+		return s(200, await t.inspectWorkflowRunEvents({ runId: c }), u);
+	} catch (e) {
+		return s(500, {
+			error: "events query failed",
+			message: e?.message ?? String(e)
+		}, u);
+	}
+}, j = async (e, t, n, i = {}) => {
+	if (f(t) !== "/_voltro/inspect/workflows/events") return null;
+	let o = l(n.origin ?? n.Origin), c = (i.method ?? "GET").toUpperCase();
+	if (c !== "GET") return s(405, {
+		error: "method not allowed",
+		expected: "GET"
+	}, o);
+	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, o);
+	let u = (i.authResolver ?? a)(n, c);
+	if (!u.ok) return s(401, {
+		error: "unauthorized",
+		reason: u.reason
+	}, o);
+	if (e.kind !== "api") return s(404, { error: "workflow domain events are api-only" }, o);
+	if (e.inspectWorkflowDomainEvents === void 0) return s(200, {
+		events: [],
+		total: 0,
+		offset: 0,
+		limit: 100
+	}, o);
+	let d = p(t), m = d.get("name") ?? void 0, h = Number(d.get("offset") ?? "0"), g = Number(d.get("limit") ?? "100");
+	try {
+		return s(200, await e.inspectWorkflowDomainEvents({
+			...m !== void 0 && m !== "" ? { name: m } : {},
+			offset: Number.isFinite(h) ? h : 0,
+			limit: Number.isFinite(g) ? g : 100
+		}), o);
+	} catch (e) {
+		return s(500, {
+			error: "workflow domain events query failed",
+			message: e?.message ?? String(e)
+		}, o);
+	}
+}, M = async (e, t, n, i = {}) => {
+	let o = f(t).match(/^\/_voltro\/inspect\/workflows\/events\/([^/]+)\/deliveries$/);
+	if (!o) return null;
+	let c = decodeURIComponent(o[1] ?? ""), u = l(n.origin ?? n.Origin), d = (i.method ?? "GET").toUpperCase();
+	if (d !== "GET") return s(405, {
+		error: "method not allowed",
+		expected: "GET"
+	}, u);
+	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, u);
+	let p = (i.authResolver ?? a)(n, d);
+	if (!p.ok) return s(401, {
+		error: "unauthorized",
+		reason: p.reason
+	}, u);
+	if (e.kind !== "api") return s(404, { error: "workflow event deliveries are api-only" }, u);
+	if (e.inspectWorkflowEventDeliveries === void 0) return s(200, { deliveries: [] }, u);
+	try {
+		return s(200, await e.inspectWorkflowEventDeliveries({ eventId: c }), u);
+	} catch (e) {
+		return s(500, {
+			error: "workflow event deliveries query failed",
+			message: e?.message ?? String(e)
+		}, u);
+	}
+}, N = async (e, t, n, i = {}) => {
+	if (f(e) !== "/_voltro/inspect/workflows/children") return null;
+	let o = l(n.origin ?? n.Origin), c = (i.method ?? "GET").toUpperCase();
+	if (c !== "GET") return s(405, {
+		error: "method not allowed",
+		expected: "GET"
+	}, o);
+	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, o);
+	let u = (i.authResolver ?? a)(n, c);
+	if (!u.ok) return s(401, {
+		error: "unauthorized",
+		reason: u.reason
+	}, o);
+	if (t.kind !== "api") return s(404, { error: "workflow children are api-only" }, o);
+	let d = C(e).get("parentExecutionId");
+	if (d === null || d === "") return s(400, { error: "parentExecutionId query param required" }, o);
+	if (t.inspectWorkflowChildren === void 0) return s(200, {
+		runs: [],
+		total: 0,
+		offset: 0,
+		limit: 200
+	}, o);
+	try {
+		return s(200, await t.inspectWorkflowChildren({ parentExecutionId: d }), o);
+	} catch (e) {
+		return s(500, {
+			error: "children query failed",
+			message: e?.message ?? String(e)
+		}, o);
+	}
+}, P = async (e, t, n, i, o = {}) => {
+	let c = f(e).match(/^\/_voltro\/inspect\/workflows\/runs\/([^/]+)\/(cancel|retry|suspend|resume|signal|update)$/);
+	if (!c) return null;
+	let u = decodeURIComponent(c[1] ?? ""), d = c[2], p = l(n.origin ?? n.Origin), m = (o.method ?? "POST").toUpperCase();
+	if (m !== "POST") return s(405, {
+		error: "method not allowed",
+		expected: "POST"
+	}, p);
+	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, p);
+	let h = (o.authResolver ?? a)(n, m);
+	if (!h.ok) return s(401, {
+		error: "unauthorized",
+		reason: h.reason
+	}, p);
+	if (t.kind !== "api") return s(404, { error: "workflow actions are api-only" }, p);
+	let g = {
+		cancel: t.inspectCancelWorkflowRun,
+		retry: t.inspectRetryWorkflowRun,
+		suspend: t.inspectSuspendWorkflowRun,
+		resume: t.inspectResumeWorkflowRun,
+		signal: t.inspectSignalWorkflowRun,
+		update: t.inspectUpdateWorkflowRun
+	}[d];
+	if (!g) return s(404, { error: `inspect${d[0]?.toUpperCase() ?? ""}${d.slice(1)}WorkflowRun not configured` }, p);
+	let _, v, y, b, x, S;
+	if (i.length > 0) try {
+		let e = JSON.parse(i);
+		d === "retry" && (_ = e.payloadOverride), d === "signal" && (typeof e.signalName == "string" && e.signalName.length > 0 && (v = e.signalName), y = e.payload), d === "update" && (typeof e.updateName == "string" && e.updateName.length > 0 && (b = e.updateName), x = e.payload, typeof e.timeoutMs == "number" && Number.isFinite(e.timeoutMs) && (S = e.timeoutMs));
+	} catch {}
+	if (d === "signal" && v === void 0) return s(400, { error: "signal requires JSON body `{ signalName: string, payload?: unknown }`" }, p);
+	if (d === "update" && b === void 0) return s(400, { error: "update requires JSON body `{ updateName: string, payload?: unknown, timeoutMs?: number }`" }, p);
+	try {
+		return s(200, d === "retry" && _ !== void 0 ? await g({
+			runId: u,
+			payloadOverride: _
+		}) : d === "signal" ? await g({
+			runId: u,
+			signalName: v,
+			payload: y
+		}) : d === "update" ? await g({
+			runId: u,
+			updateName: b,
+			payload: x,
+			...S === void 0 ? {} : { timeoutMs: S }
+		}) : await g({ runId: u }), p);
+	} catch (e) {
+		return s(500, {
+			error: `${d} failed`,
+			message: e?.message ?? String(e)
+		}, p);
+	}
+}, F = async (e, t, n, i, o = {}) => {
+	if (f(e) !== "/_voltro/inspect/data/import" || (o.method ?? "POST").toUpperCase() !== "POST") return null;
+	let c = l(n.origin ?? n.Origin);
+	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, c);
+	let u = (o.authResolver ?? a)(n, "POST");
+	if (!u.ok) return s(401, {
+		error: "unauthorized",
+		reason: u.reason
+	}, c);
+	let p = d(o.method, n, c);
+	if (p) return p;
+	if (t.kind !== "api") return s(404, { error: "data import is api-only" }, c);
+	if (!t.inspectImport) return s(404, { error: "inspectImport not configured" }, c);
+	let m;
+	try {
+		m = JSON.parse(i || "{}");
+	} catch {
+		return s(400, { error: "body must be JSON" }, c);
+	}
+	if (typeof m.bundleDir != "string" || !m.bundleDir) return s(400, { error: "body.bundleDir (string) is required" }, c);
+	try {
+		return s(200, await t.inspectImport({
+			bundleDir: m.bundleDir,
+			...m.mode === "upsert" || m.mode === "append" || m.mode === "replace" ? { mode: m.mode } : {},
+			...m.onConflict === "skip" || m.onConflict === "fail" ? { onConflict: m.onConflict } : {},
+			...typeof m.atomic == "boolean" ? { atomic: m.atomic } : {}
+		}), c);
+	} catch (e) {
+		return s(500, {
+			error: "import failed",
+			message: e?.message ?? String(e)
+		}, c);
+	}
+}, I = async (e, t, n, i, o = {}) => {
+	let c = f(e);
+	if (!c.startsWith("/_voltro/inspect/data/rows")) return null;
+	let u = (o.method ?? "POST").toUpperCase();
+	if (u === "GET" && c === "/_voltro/inspect/data/rows") return null;
+	let d = l(n.origin ?? n.Origin);
+	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, d);
+	let p = (o.authResolver ?? a)(n, u);
+	if (!p.ok) return s(401, {
+		error: "unauthorized",
+		reason: p.reason
+	}, d);
+	if (t.kind !== "api") return s(404, { error: "data viewer is api-only" }, d);
+	if (u === "POST" && c === "/_voltro/inspect/data/rows") {
+		if (!t.inspectInsertRow) return s(404, { error: "inspectInsertRow not configured" }, d);
+		let e;
+		try {
+			e = JSON.parse(i || "{}");
+		} catch {
+			return s(400, { error: "body must be JSON" }, d);
+		}
+		if (typeof e.table != "string" || !e.row || typeof e.row != "object") return s(400, { error: "body must be { table: string, row: object }" }, d);
+		try {
+			return s(200, await t.inspectInsertRow({
+				table: e.table,
+				row: e.row
+			}), d);
+		} catch (e) {
+			return s(500, {
+				error: "insert failed",
+				message: e?.message ?? String(e)
+			}, d);
+		}
+	}
+	let m = c.match(/^\/_voltro\/inspect\/data\/rows\/([^/]+)$/);
+	if (!m) return null;
+	let h = decodeURIComponent(m[1] ?? "");
+	if (!h) return s(400, { error: "row id is required in URL" }, d);
+	let g = C(e).get("table") ?? "";
+	if (!g) return s(400, { error: "query.table is required" }, d);
+	if (u === "PATCH") {
+		if (!t.inspectUpdateRow) return s(404, { error: "inspectUpdateRow not configured" }, d);
+		let e;
+		try {
+			e = JSON.parse(i || "{}");
+		} catch {
+			return s(400, { error: "body must be JSON" }, d);
+		}
+		if (!e.patch || typeof e.patch != "object") return s(400, { error: "body.patch must be an object" }, d);
+		try {
+			return s(200, await t.inspectUpdateRow({
+				table: g,
+				id: h,
+				patch: e.patch
+			}), d);
+		} catch (e) {
+			return s(500, {
+				error: "update failed",
+				message: e?.message ?? String(e)
+			}, d);
+		}
+	}
+	if (u === "DELETE") {
+		if (!t.inspectDeleteRow) return s(404, { error: "inspectDeleteRow not configured" }, d);
+		try {
+			return s(200, await t.inspectDeleteRow({
+				table: g,
+				id: h
+			}), d);
+		} catch (e) {
+			return s(500, {
+				error: "delete failed",
+				message: e?.message ?? String(e)
+			}, d);
+		}
+	}
+	return s(405, {
+		error: "method not allowed",
+		expected: "POST | PATCH | DELETE"
+	}, d);
+};
+//#endregion
+export { E as C, c as D, r as E, o as O, T as S, u as T, N as _, a, A as b, x as c, v as d, S as f, P as g, y as h, d as i, I as l, D as m, h as n, O as o, _ as p, g as r, F as s, n as t, b as u, j as v, l as w, k as x, M as y };