@voltro/cli 0.27.0 → 0.29.0

package/dist/{inspect-CUCCzw2I.js → inspect-BMvQpwqy.js}

@@ -114,13 +114,29 @@ var n = "/_voltro/inspect", r = () => process.env.VOLTRO_INSPECT === "off", i =
 		error: "cross-site write rejected",
 		reason: `a state-changing inspect request may not come from origin "${i}" — only same-machine (loopback) origins may write`
 	}, n);
-}, f = (e) => {
+}, f = (e = process.env.VOLTRO_INSPECT_ALLOWED_HOSTS) => (e ?? "").split(/[,\s]+/).map((e) => e.trim().toLowerCase()).filter((e) => e.length > 0), p = (e) => {
+	if (e === void 0) return "";
+	let t = e.trim();
+	if (t === "") return "";
+	if (t.startsWith("[")) {
+		let e = t.indexOf("]");
+		return (e === -1 ? t.slice(1) : t.slice(1, e)).toLowerCase();
+	}
+	let n = t.indexOf(":");
+	return (n === -1 ? t : t.slice(0, n)).toLowerCase();
+}, m = (e) => /^\d{1,3}(?:\.\d{1,3}){3}$/.test(e) || e.includes(":"), h = (e, t = f()) => {
+	let n = p(e);
+	return n === "" || n === "localhost" || n.endsWith(".localhost") || m(n) ? !0 : t.includes(n);
+}, g = (e, t = {}, n) => h(e, n) ? null : s(403, {
+	error: "forbidden host",
+	reason: `the dev inspect surface refuses a request with Host "${e ?? ""}" — a DNS-rebinding guard. Only loopback names, IP literals, and hosts listed in VOLTRO_INSPECT_ALLOWED_HOSTS may reach it.`
+}, t), _ = (e) => {
 	let t = e.indexOf("?");
 	return t === -1 ? e : e.slice(0, t);
-}, p = (e) => {
+}, v = (e) => {
 	let t = e.indexOf("?");
 	return t === -1 ? new URLSearchParams() : new URLSearchParams(e.slice(t + 1));
-}, m = (e) => e === "/_voltro/inspect" || e.startsWith("/_voltro/inspect/"), h = [
+}, y = (e) => e === "/_voltro/inspect" || e.startsWith("/_voltro/inspect/"), b = [
 	"text",
 	"textarea",
 	"number",
@@ -136,7 +152,7 @@ var n = "/_voltro/inspect", r = () => process.env.VOLTRO_INSPECT === "off", i =
 	"file",
 	"hidden",
 	"custom"
-], g = (e, t, n = [], r = []) => ({
+], x = (e, t, n = [], r = []) => ({
 	version: 2,
 	scopes: [...new Set(r.flatMap((e) => e.declaredScopes ?? []))].sort(),
 	procedures: [...e].sort((e, t) => e.tag.localeCompare(t.tag)).map((e) => ({
@@ -151,7 +167,7 @@ var n = "/_voltro/inspect", r = () => process.env.VOLTRO_INSPECT === "off", i =
 		...e.exposeAsTool === void 0 ? {} : { exposeAsTool: e.exposeAsTool }
 	})),
 	workflows: [...t].sort((e, t) => e.tag.localeCompare(t.tag)).map((e) => ({ name: e.tag })),
-	widgets: h,
+	widgets: b,
 	tables: [...n].filter((e) => !e.isFrameworkTable).sort((e, t) => e.name.localeCompare(t.name)).map((e) => ({
 		name: e.name,
 		reactive: e.isReactive,
@@ -164,9 +180,9 @@ var n = "/_voltro/inspect", r = () => process.env.VOLTRO_INSPECT === "off", i =
 			...e.oneOf === void 0 ? {} : { enum: e.oneOf }
 		}))
 	}))
-}), _ = (e, t, n = {}, i = {}) => {
-	let o = f(e);
-	if (!m(o)) return null;
+}), S = (e, t, n = {}, i = {}) => {
+	let o = _(e);
+	if (!y(o)) return null;
 	let c = l(n.origin ?? n.Origin), u = (i.method ?? "GET").toUpperCase();
 	if (u === "OPTIONS") return {
 		status: 204,
@@ -196,7 +212,7 @@ var n = "/_voltro/inspect", r = () => process.env.VOLTRO_INSPECT === "off", i =
 	if (o === "/_voltro/inspect/manifest") {
 		if (t.kind !== "api") return s(404, { error: "manifest endpoint is api-only" }, c);
 		let e = t.inspectTables?.().tables ?? [];
-		return s(200, g(t.rpc, t.workflows, e, t.plugins?.().plugins ?? []), c);
+		return s(200, x(t.rpc, t.workflows, e, t.plugins?.().plugins ?? []), c);
 	}
 	return o === "/_voltro/inspect/metrics" ? t.metrics === void 0 ? s(200, [], c) : s(200, t.metrics(), c) : o === "/_voltro/inspect/subscriptions" ? t.kind === "api" ? t.subscriptions === void 0 ? s(200, {
 		subscriptions: [],
@@ -240,7 +256,7 @@ var n = "/_voltro/inspect", r = () => process.env.VOLTRO_INSPECT === "off", i =
 		error: "unknown inspect endpoint",
 		path: o
 	}, c);
-}, v = async (e, t, n, i = {}) => {
+}, C = async (e, t, n, i = {}) => {
 	let o = l(t.origin ?? t.Origin);
 	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, o);
 	let c = (i.method ?? "POST").toUpperCase();
@@ -275,80 +291,80 @@ var n = "/_voltro/inspect", r = () => process.env.VOLTRO_INSPECT === "off", i =
 		n !== "cookie" && (h[n] = t);
 	}
 	return s(200, await p(f.input, h), o);
-}, y = async (e, t, i, o, c = {}) => {
-	let u = f(e);
-	if (!m(u) || !u.startsWith("/_voltro/inspect/webhooks/")) return null;
-	let p = l(i.origin ?? i.Origin);
+}, w = async (e, t, i, o, c = {}) => {
+	let u = _(e);
+	if (!y(u) || !u.startsWith("/_voltro/inspect/webhooks/")) return null;
+	let f = l(i.origin ?? i.Origin);
 	if ((c.method ?? "POST").toUpperCase() !== "POST") return null;
-	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, p);
-	let h = (c.authResolver ?? a)(i, c.method ?? "POST");
-	if (!h.ok) return s(401, {
+	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, f);
+	let p = (c.authResolver ?? a)(i, c.method ?? "POST");
+	if (!p.ok) return s(401, {
 		error: "unauthorized",
-		reason: h.reason
-	}, p);
-	let g = d(c.method, i, p);
-	if (g) return g;
-	if (t.kind !== "api") return s(404, { error: "webhook actions are api-only" }, p);
-	if (!t.webhookActions) return s(404, { error: "webhook actions not configured — is @voltro/plugin-webhooks active?" }, p);
-	let _;
+		reason: p.reason
+	}, f);
+	let m = d(c.method, i, f);
+	if (m) return m;
+	if (t.kind !== "api") return s(404, { error: "webhook actions are api-only" }, f);
+	if (!t.webhookActions) return s(404, { error: "webhook actions not configured — is @voltro/plugin-webhooks active?" }, f);
+	let h;
 	try {
-		_ = JSON.parse(o || "{}");
+		h = JSON.parse(o || "{}");
 	} catch {
-		return s(400, { error: "body must be JSON" }, p);
+		return s(400, { error: "body must be JSON" }, f);
 	}
-	let v = u.slice(`${n}/webhooks/`.length);
+	let g = u.slice(`${n}/webhooks/`.length);
 	try {
-		switch (v) {
+		switch (g) {
 			case "subscribe": {
-				let e = _;
-				return typeof e.event != "string" || e.event.length === 0 ? s(400, { error: "event required" }, p) : typeof e.url != "string" || e.url.length === 0 ? s(400, { error: "url required" }, p) : s(200, await t.webhookActions.subscribe(e), p);
+				let e = h;
+				return typeof e.event != "string" || e.event.length === 0 ? s(400, { error: "event required" }, f) : typeof e.url != "string" || e.url.length === 0 ? s(400, { error: "url required" }, f) : s(200, await t.webhookActions.subscribe(e), f);
 			}
 			case "pause": {
-				let e = _.targetId;
-				return typeof e != "string" || e.length === 0 ? s(400, { error: "targetId required" }, p) : (await t.webhookActions.pause(e), s(200, { ok: !0 }, p));
+				let e = h.targetId;
+				return typeof e != "string" || e.length === 0 ? s(400, { error: "targetId required" }, f) : (await t.webhookActions.pause(e), s(200, { ok: !0 }, f));
 			}
 			case "resume": {
-				let e = _.targetId;
-				return typeof e != "string" || e.length === 0 ? s(400, { error: "targetId required" }, p) : (await t.webhookActions.resume(e), s(200, { ok: !0 }, p));
+				let e = h.targetId;
+				return typeof e != "string" || e.length === 0 ? s(400, { error: "targetId required" }, f) : (await t.webhookActions.resume(e), s(200, { ok: !0 }, f));
 			}
 			case "delete": {
-				let e = _.targetId;
-				return typeof e != "string" || e.length === 0 ? s(400, { error: "targetId required" }, p) : (await t.webhookActions.delete(e), s(200, { ok: !0 }, p));
+				let e = h.targetId;
+				return typeof e != "string" || e.length === 0 ? s(400, { error: "targetId required" }, f) : (await t.webhookActions.delete(e), s(200, { ok: !0 }, f));
 			}
 			case "rotateSecret": {
-				let e = _.targetId;
-				return typeof e != "string" || e.length === 0 ? s(400, { error: "targetId required" }, p) : s(200, await t.webhookActions.rotateSecret(e), p);
+				let e = h.targetId;
+				return typeof e != "string" || e.length === 0 ? s(400, { error: "targetId required" }, f) : s(200, await t.webhookActions.rotateSecret(e), f);
 			}
 			case "replay": {
-				let e = _.deliveryId;
-				return typeof e != "string" || e.length === 0 ? s(400, { error: "deliveryId required" }, p) : (await t.webhookActions.replay(e), s(200, { ok: !0 }, p));
+				let e = h.deliveryId;
+				return typeof e != "string" || e.length === 0 ? s(400, { error: "deliveryId required" }, f) : (await t.webhookActions.replay(e), s(200, { ok: !0 }, f));
 			}
 			case "repinVersion": {
-				let e = _.targetId, n = _.version;
-				return typeof e != "string" || e.length === 0 ? s(400, { error: "targetId required" }, p) : typeof n != "number" || !Number.isInteger(n) || n < 1 ? s(400, { error: "version must be a positive integer" }, p) : (await t.webhookActions.updateTargetPayloadVersion(e, n), s(200, { ok: !0 }, p));
+				let e = h.targetId, n = h.version;
+				return typeof e != "string" || e.length === 0 ? s(400, { error: "targetId required" }, f) : typeof n != "number" || !Number.isInteger(n) || n < 1 ? s(400, { error: "version must be a positive integer" }, f) : (await t.webhookActions.updateTargetPayloadVersion(e, n), s(200, { ok: !0 }, f));
 			}
-			default: return s(404, { error: `unknown webhook action: ${v}` }, p);
+			default: return s(404, { error: `unknown webhook action: ${g}` }, f);
 		}
 	} catch (e) {
 		return s(500, {
 			error: "webhook action failed",
 			message: e?.message ?? String(e)
-		}, p);
+		}, f);
 	}
-}, b = async (e, t, i, o, c = {}) => {
-	let u = f(e);
-	if (!m(u)) return null;
-	let d = l(i.origin ?? i.Origin), p = (c.method ?? "POST").toUpperCase();
-	if (p !== "POST") return null;
+}, T = async (e, t, i, o, c = {}) => {
+	let u = _(e);
+	if (!y(u)) return null;
+	let d = l(i.origin ?? i.Origin), f = (c.method ?? "POST").toUpperCase();
+	if (f !== "POST") return null;
 	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, d);
-	let h = (c.authResolver ?? a)(i, p);
-	if (!h.ok) return s(401, {
+	let p = (c.authResolver ?? a)(i, f);
+	if (!p.ok) return s(401, {
 		error: "unauthorized",
-		reason: h.reason
+		reason: p.reason
 	}, d);
 	if (t.kind !== "api") return s(404, { error: "framework-action endpoints are api-only" }, d);
-	let g = `${n}/seeds/run`, _ = `${n}/migrations/rollback`, v = `${n}/migrations/squash`, y = `${n}/migrations/restore-snapshot`;
-	if (u !== g && u !== _ && u !== v && u !== y && u !== "/_voltro/inspect/migrations/compare-env") return null;
+	let m = `${n}/seeds/run`, h = `${n}/migrations/rollback`, g = `${n}/migrations/squash`, v = `${n}/migrations/restore-snapshot`;
+	if (u !== m && u !== h && u !== g && u !== v && u !== "/_voltro/inspect/migrations/compare-env") return null;
 	let b;
 	try {
 		b = JSON.parse(o || "{}");
@@ -356,9 +372,9 @@ var n = "/_voltro/inspect", r = () => process.env.VOLTRO_INSPECT === "off", i =
 		return s(400, { error: "body must be JSON" }, d);
 	}
 	try {
-		if (u === g) return typeof b.id != "string" || b.id.length === 0 ? s(400, { error: "body.id must be a non-empty string" }, d) : t.runSeed ? s(200, await t.runSeed(b.id), d) : s(404, { error: "runSeed not configured" }, d);
-		if (u === _) return typeof b.id != "string" || b.id.length === 0 ? s(400, { error: "body.id must be a non-empty string" }, d) : t.rollbackMigration ? s(200, await t.rollbackMigration(b.id), d) : s(404, { error: "rollbackMigration not configured" }, d);
-		if (u === v) {
+		if (u === m) return typeof b.id != "string" || b.id.length === 0 ? s(400, { error: "body.id must be a non-empty string" }, d) : t.runSeed ? s(200, await t.runSeed(b.id), d) : s(404, { error: "runSeed not configured" }, d);
+		if (u === h) return typeof b.id != "string" || b.id.length === 0 ? s(400, { error: "body.id must be a non-empty string" }, d) : t.rollbackMigration ? s(200, await t.rollbackMigration(b.id), d) : s(404, { error: "rollbackMigration not configured" }, d);
+		if (u === g) {
 			if (typeof b.before != "string" || b.before.length === 0) return s(400, { error: "body.before must be a non-empty ISO date string" }, d);
 			if (!t.squashMigrationHistory) return s(404, { error: "squashMigrationHistory not configured" }, d);
 			let e = typeof b.note == "string" ? b.note : void 0;
@@ -367,7 +383,7 @@ var n = "/_voltro/inspect", r = () => process.env.VOLTRO_INSPECT === "off", i =
 				note: e
 			}), d);
 		}
-		return u === y ? typeof b.planId != "string" || b.planId.length === 0 ? s(400, { error: "body.planId must be a non-empty string" }, d) : t.restoreSnapshot ? s(200, await t.restoreSnapshot({ planId: b.planId }), d) : s(404, { error: "restoreSnapshot not configured" }, d) : typeof b.url != "string" || b.url.length === 0 ? s(400, { error: "body.url must be a non-empty URL string" }, d) : t.compareCrossEnv ? (await t.compareCrossEnv({
+		return u === v ? typeof b.planId != "string" || b.planId.length === 0 ? s(400, { error: "body.planId must be a non-empty string" }, d) : t.restoreSnapshot ? s(200, await t.restoreSnapshot({ planId: b.planId }), d) : s(404, { error: "restoreSnapshot not configured" }, d) : typeof b.url != "string" || b.url.length === 0 ? s(400, { error: "body.url must be a non-empty URL string" }, d) : t.compareCrossEnv ? (await t.compareCrossEnv({
 			url: b.url,
 			label: typeof b.label == "string" ? b.label : void 0,
 			token: typeof b.token == "string" ? b.token : void 0
@@ -378,8 +394,8 @@ var n = "/_voltro/inspect", r = () => process.env.VOLTRO_INSPECT === "off", i =
 			message: e?.message ?? String(e)
 		}, d);
 	}
-}, x = async (e, t, n, i = {}) => {
-	if (f(e) !== "/_voltro/inspect/data/rows") return null;
+}, E = async (e, t, n, i = {}) => {
+	if (_(e) !== "/_voltro/inspect/data/rows") return null;
 	let o = l(n.origin ?? n.Origin), c = (i.method ?? "GET").toUpperCase();
 	if (c !== "GET") return s(405, {
 		error: "method not allowed",
@@ -393,23 +409,23 @@ var n = "/_voltro/inspect", r = () => process.env.VOLTRO_INSPECT === "off", i =
 	}, o);
 	if (t.kind !== "api") return s(404, { error: "data viewer is api-only" }, o);
 	if (t.inspectRows === void 0) return s(404, { error: "inspectRows not configured" }, o);
-	let d = C(e), p = d.get("table");
-	if (!p) return s(400, { error: "query.table is required" }, o);
-	let m = w(d.get("offset")) ?? 0, h = w(d.get("limit")) ?? 50, g = {}, _ = d.get("q");
-	if (_) {
-		if (_.length > 8192) return s(400, { error: "query.q too large" }, o);
+	let d = O(e), f = d.get("table");
+	if (!f) return s(400, { error: "query.table is required" }, o);
+	let p = k(d.get("offset")) ?? 0, m = k(d.get("limit")) ?? 50, h = {}, g = d.get("q");
+	if (g) {
+		if (g.length > 8192) return s(400, { error: "query.q too large" }, o);
 		try {
-			g = JSON.parse(Buffer.from(_, "base64url").toString("utf8"));
+			h = JSON.parse(Buffer.from(g, "base64url").toString("utf8"));
 		} catch {
 			return s(400, { error: "query.q is not valid base64url JSON" }, o);
 		}
 	}
 	try {
 		return s(200, await t.inspectRows({
-			table: p,
-			offset: m,
-			limit: h,
-			...g
+			table: f,
+			offset: p,
+			limit: m,
+			...h
 		}), o);
 	} catch (e) {
 		return e?.name === "InspectQueryError" ? s(400, {
@@ -420,39 +436,39 @@ var n = "/_voltro/inspect", r = () => process.env.VOLTRO_INSPECT === "off", i =
 			message: e?.message ?? String(e)
 		}, o);
 	}
-}, S = async (t, n, i, o = {}) => {
-	if (f(t) !== "/_voltro/inspect/provenance") return null;
+}, D = async (t, n, i, o = {}) => {
+	if (_(t) !== "/_voltro/inspect/provenance") return null;
 	let c = l(i.origin ?? i.Origin), u = (o.method ?? "GET").toUpperCase();
 	if (u !== "GET") return s(405, {
 		error: "method not allowed",
 		expected: "GET"
 	}, c);
 	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, c);
-	let p = (o.authResolver ?? a)(i, u);
-	if (!p.ok) return s(401, {
+	let f = (o.authResolver ?? a)(i, u);
+	if (!f.ok) return s(401, {
 		error: "unauthorized",
-		reason: p.reason
+		reason: f.reason
 	}, c);
-	let m = d(o.method, i, c);
-	if (m) return m;
+	let p = d(o.method, i, c);
+	if (p) return p;
 	if (n.kind !== "api") return s(404, { error: "provenance is api-only" }, c);
 	if (n.inspectRows === void 0) return s(404, { error: "inspectRows not configured" }, c);
-	let h = C(t), g = h.get("table"), _ = h.get("id"), v = h.get("column") ?? void 0;
-	if (!g || !_) return s(400, { error: "query.table and query.id are required" }, c);
+	let m = O(t), h = m.get("table"), g = m.get("id"), v = m.get("column") ?? void 0;
+	if (!h || !g) return s(400, { error: "query.table and query.id are required" }, c);
 	try {
 		let t = (await n.inspectRows({
-			table: g,
+			table: h,
 			limit: 1,
 			filter: {
 				kind: "leaf",
 				column: "id",
 				op: "eq",
-				value: _
+				value: g
 			}
 		})).rows[0];
 		return s(200, e(t, {
-			table: g,
-			id: _,
+			table: h,
+			id: g,
 			...v === void 0 ? {} : { column: v }
 		}), c);
 	} catch (e) {
@@ -464,15 +480,15 @@ var n = "/_voltro/inspect", r = () => process.env.VOLTRO_INSPECT === "off", i =
 			message: e?.message ?? String(e)
 		}, c);
 	}
-}, C = (e) => {
+}, O = (e) => {
 	let t = e.indexOf("?");
 	return t < 0 ? new URLSearchParams() : new URLSearchParams(e.slice(t + 1));
-}, w = (e) => {
+}, k = (e) => {
 	if (e === null || e === "") return;
 	let t = Number(e);
 	return Number.isFinite(t) && t >= 0 ? Math.floor(t) : void 0;
-}, T = async (e, t, n, i = {}) => {
-	if (f(e) !== "/_voltro/inspect/workflows/runs") return null;
+}, A = async (e, t, n, i = {}) => {
+	if (_(e) !== "/_voltro/inspect/workflows/runs") return null;
 	let o = l(n.origin ?? n.Origin), c = (i.method ?? "GET").toUpperCase();
 	if (c !== "GET") return s(405, {
 		error: "method not allowed",
@@ -491,14 +507,14 @@ var n = "/_voltro/inspect", r = () => process.env.VOLTRO_INSPECT === "off", i =
 		offset: 0,
 		limit: 50
 	}, o);
-	let d = C(e);
+	let d = O(e);
 	try {
 		let e = d.get("deadLettered") === "1" || d.get("deadLettered") === "true";
 		return s(200, await t.inspectWorkflowRuns({
 			...d.get("tag") === null ? {} : { tag: d.get("tag") },
 			...e ? { deadLettered: !0 } : d.get("status") === null ? {} : { status: d.get("status") },
-			offset: w(d.get("offset")) ?? 0,
-			limit: w(d.get("limit")) ?? 50
+			offset: k(d.get("offset")) ?? 0,
+			limit: k(d.get("limit")) ?? 50
 		}), o);
 	} catch (e) {
 		return s(500, {
@@ -506,32 +522,32 @@ var n = "/_voltro/inspect", r = () => process.env.VOLTRO_INSPECT === "off", i =
 			message: e?.message ?? String(e)
 		}, o);
 	}
-}, E = async (e, t, n, i, o = {}) => {
-	let c = f(e).match(/^\/_voltro\/inspect\/workflows\/start\/([^/]+)$/);
+}, j = async (e, t, n, i, o = {}) => {
+	let c = _(e).match(/^\/_voltro\/inspect\/workflows\/start\/([^/]+)$/);
 	if (!c) return null;
-	let u = decodeURIComponent(c[1] ?? ""), d = l(n.origin ?? n.Origin), p = (o.method ?? "POST").toUpperCase();
-	if (p !== "POST") return s(405, {
+	let u = decodeURIComponent(c[1] ?? ""), d = l(n.origin ?? n.Origin), f = (o.method ?? "POST").toUpperCase();
+	if (f !== "POST") return s(405, {
 		error: "method not allowed",
 		expected: "POST"
 	}, d);
 	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, d);
-	let m = (o.authResolver ?? a)(n, p);
-	if (!m.ok) return s(401, {
+	let p = (o.authResolver ?? a)(n, f);
+	if (!p.ok) return s(401, {
 		error: "unauthorized",
-		reason: m.reason
+		reason: p.reason
 	}, d);
 	if (t.kind !== "api") return s(404, { error: "workflow start is api-only" }, d);
 	if (t.inspectStartWorkflow === void 0) return s(404, { error: "inspectStartWorkflow not configured" }, d);
-	let h = {};
+	let m = {};
 	if (i.length > 0) try {
-		h = JSON.parse(i).payload ?? {};
+		m = JSON.parse(i).payload ?? {};
 	} catch {
 		return s(400, { error: "start requires JSON body `{ payload?: unknown }`" }, d);
 	}
 	try {
 		return s(200, await t.inspectStartWorkflow({
 			name: u,
-			payload: h
+			payload: m
 		}), d);
 	} catch (e) {
 		return s(500, {
@@ -539,8 +555,8 @@ var n = "/_voltro/inspect", r = () => process.env.VOLTRO_INSPECT === "off", i =
 			message: e?.message ?? String(e)
 		}, d);
 	}
-}, D = async (e, t, n, i = {}) => {
-	let o = f(e);
+}, M = async (e, t, n, i = {}) => {
+	let o = _(e);
 	if (!o.startsWith("/_voltro/inspect/schedules")) return null;
 	let c = l(n.origin ?? n.Origin);
 	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, c);
@@ -549,17 +565,17 @@ var n = "/_voltro/inspect", r = () => process.env.VOLTRO_INSPECT === "off", i =
 		error: "unauthorized",
 		reason: u.reason
 	}, c);
-	let p = d(i.method, n, c);
-	if (p) return p;
+	let f = d(i.method, n, c);
+	if (f) return f;
 	if (t.kind !== "api") return s(404, { error: "schedules are api-only" }, c);
-	let m = (i.method ?? "GET").toUpperCase(), h = o.match(/^\/_voltro\/inspect\/schedules\/([^/]+)\/fire$/);
-	if (h) {
-		if (m !== "POST") return s(405, {
+	let p = (i.method ?? "GET").toUpperCase(), m = o.match(/^\/_voltro\/inspect\/schedules\/([^/]+)\/fire$/);
+	if (m) {
+		if (p !== "POST") return s(405, {
 			error: "method not allowed",
 			expected: "POST"
 		}, c);
 		if (!t.inspectFireSchedule) return s(404, { error: "inspectFireSchedule not configured" }, c);
-		let n = decodeURIComponent(h[1] ?? ""), r = C(e).get("trigger") === "external" ? "external" : "manual";
+		let n = decodeURIComponent(m[1] ?? ""), r = O(e).get("trigger") === "external" ? "external" : "manual";
 		try {
 			return s(200, await t.inspectFireSchedule({
 				name: n,
@@ -573,7 +589,7 @@ var n = "/_voltro/inspect", r = () => process.env.VOLTRO_INSPECT === "off", i =
 		}
 	}
 	if (o === "/_voltro/inspect/schedules/runs") {
-		if (m !== "GET") return s(405, {
+		if (p !== "GET") return s(405, {
 			error: "method not allowed",
 			expected: "GET"
 		}, c);
@@ -583,12 +599,12 @@ var n = "/_voltro/inspect", r = () => process.env.VOLTRO_INSPECT === "off", i =
 			offset: 0,
 			limit: 50
 		}, c);
-		let n = C(e);
+		let n = O(e);
 		try {
 			return s(200, await t.inspectScheduleRuns({
 				...n.get("name") === null ? {} : { name: n.get("name") },
-				offset: w(n.get("offset")) ?? 0,
-				limit: w(n.get("limit")) ?? 50
+				offset: k(n.get("offset")) ?? 0,
+				limit: k(n.get("limit")) ?? 50
 			}), c);
 		} catch (e) {
 			return s(500, {
@@ -597,7 +613,7 @@ var n = "/_voltro/inspect", r = () => process.env.VOLTRO_INSPECT === "off", i =
 			}, c);
 		}
 	}
-	return o === "/_voltro/inspect/schedules" ? m === "GET" ? t.inspectSchedules ? s(200, t.inspectSchedules(), c) : s(200, {
+	return o === "/_voltro/inspect/schedules" ? p === "GET" ? t.inspectSchedules ? s(200, t.inspectSchedules(), c) : s(200, {
 		schedules: [],
 		coordination: "single"
 	}, c) : s(405, {
@@ -607,8 +623,8 @@ var n = "/_voltro/inspect", r = () => process.env.VOLTRO_INSPECT === "off", i =
 		error: "unknown schedules endpoint",
 		path: o
 	}, c);
-}, O = async (e, t, n, i = {}) => {
-	if (f(e) !== "/_voltro/inspect/cluster") return null;
+}, N = async (e, t, n, i = {}) => {
+	if (_(e) !== "/_voltro/inspect/cluster") return null;
 	let o = l(n.origin ?? n.Origin);
 	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, o);
 	let c = (i.authResolver ?? a)(n, i.method ?? "POST");
@@ -655,8 +671,8 @@ var n = "/_voltro/inspect", r = () => process.env.VOLTRO_INSPECT === "off", i =
 			message: e?.message ?? String(e)
 		}, o);
 	}
-}, k = async (e, t, n, i = {}) => {
-	let o = f(e).match(/^\/_voltro\/inspect\/workflows\/runs\/([^/]+)\/steps$/);
+}, P = async (e, t, n, i = {}) => {
+	let o = _(e).match(/^\/_voltro\/inspect\/workflows\/runs\/([^/]+)\/steps$/);
 	if (!o) return null;
 	let c = decodeURIComponent(o[1] ?? ""), u = l(n.origin ?? n.Origin), d = (i.method ?? "GET").toUpperCase();
 	if (d !== "GET") return s(405, {
@@ -664,10 +680,10 @@ var n = "/_voltro/inspect", r = () => process.env.VOLTRO_INSPECT === "off", i =
 		expected: "GET"
 	}, u);
 	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, u);
-	let p = (i.authResolver ?? a)(n, d);
-	if (!p.ok) return s(401, {
+	let f = (i.authResolver ?? a)(n, d);
+	if (!f.ok) return s(401, {
 		error: "unauthorized",
-		reason: p.reason
+		reason: f.reason
 	}, u);
 	if (t.kind !== "api") return s(404, { error: "workflow steps are api-only" }, u);
 	if (t.inspectWorkflowRunSteps === void 0) return s(200, { steps: [] }, u);
@@ -679,8 +695,8 @@ var n = "/_voltro/inspect", r = () => process.env.VOLTRO_INSPECT === "off", i =
 			message: e?.message ?? String(e)
 		}, u);
 	}
-}, A = async (e, t, n, i = {}) => {
-	let o = f(e).match(/^\/_voltro\/inspect\/workflows\/runs\/([^/]+)\/events$/);
+}, F = async (e, t, n, i = {}) => {
+	let o = _(e).match(/^\/_voltro\/inspect\/workflows\/runs\/([^/]+)\/events$/);
 	if (!o) return null;
 	let c = decodeURIComponent(o[1] ?? ""), u = l(n.origin ?? n.Origin), d = (i.method ?? "GET").toUpperCase();
 	if (d !== "GET") return s(405, {
@@ -688,10 +704,10 @@ var n = "/_voltro/inspect", r = () => process.env.VOLTRO_INSPECT === "off", i =
 		expected: "GET"
 	}, u);
 	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, u);
-	let p = (i.authResolver ?? a)(n, d);
-	if (!p.ok) return s(401, {
+	let f = (i.authResolver ?? a)(n, d);
+	if (!f.ok) return s(401, {
 		error: "unauthorized",
-		reason: p.reason
+		reason: f.reason
 	}, u);
 	if (t.kind !== "api") return s(404, { error: "workflow events are api-only" }, u);
 	if (t.inspectWorkflowRunEvents === void 0) return s(200, { events: [] }, u);
@@ -703,8 +719,8 @@ var n = "/_voltro/inspect", r = () => process.env.VOLTRO_INSPECT === "off", i =
 			message: e?.message ?? String(e)
 		}, u);
 	}
-}, j = async (e, t, n, i = {}) => {
-	if (f(t) !== "/_voltro/inspect/workflows/events") return null;
+}, I = async (e, t, n, i = {}) => {
+	if (_(t) !== "/_voltro/inspect/workflows/events") return null;
 	let o = l(n.origin ?? n.Origin), c = (i.method ?? "GET").toUpperCase();
 	if (c !== "GET") return s(405, {
 		error: "method not allowed",
@@ -723,12 +739,12 @@ var n = "/_voltro/inspect", r = () => process.env.VOLTRO_INSPECT === "off", i =
 		offset: 0,
 		limit: 100
 	}, o);
-	let d = p(t), m = d.get("name") ?? void 0, h = Number(d.get("offset") ?? "0"), g = Number(d.get("limit") ?? "100");
+	let d = v(t), f = d.get("name") ?? void 0, p = Number(d.get("offset") ?? "0"), m = Number(d.get("limit") ?? "100");
 	try {
 		return s(200, await e.inspectWorkflowDomainEvents({
-			...m !== void 0 && m !== "" ? { name: m } : {},
-			offset: Number.isFinite(h) ? h : 0,
-			limit: Number.isFinite(g) ? g : 100
+			...f !== void 0 && f !== "" ? { name: f } : {},
+			offset: Number.isFinite(p) ? p : 0,
+			limit: Number.isFinite(m) ? m : 100
 		}), o);
 	} catch (e) {
 		return s(500, {
@@ -736,8 +752,8 @@ var n = "/_voltro/inspect", r = () => process.env.VOLTRO_INSPECT === "off", i =
 			message: e?.message ?? String(e)
 		}, o);
 	}
-}, M = async (e, t, n, i = {}) => {
-	let o = f(t).match(/^\/_voltro\/inspect\/workflows\/events\/([^/]+)\/deliveries$/);
+}, L = async (e, t, n, i = {}) => {
+	let o = _(t).match(/^\/_voltro\/inspect\/workflows\/events\/([^/]+)\/deliveries$/);
 	if (!o) return null;
 	let c = decodeURIComponent(o[1] ?? ""), u = l(n.origin ?? n.Origin), d = (i.method ?? "GET").toUpperCase();
 	if (d !== "GET") return s(405, {
@@ -745,10 +761,10 @@ var n = "/_voltro/inspect", r = () => process.env.VOLTRO_INSPECT === "off", i =
 		expected: "GET"
 	}, u);
 	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, u);
-	let p = (i.authResolver ?? a)(n, d);
-	if (!p.ok) return s(401, {
+	let f = (i.authResolver ?? a)(n, d);
+	if (!f.ok) return s(401, {
 		error: "unauthorized",
-		reason: p.reason
+		reason: f.reason
 	}, u);
 	if (e.kind !== "api") return s(404, { error: "workflow event deliveries are api-only" }, u);
 	if (e.inspectWorkflowEventDeliveries === void 0) return s(200, { deliveries: [] }, u);
@@ -760,8 +776,8 @@ var n = "/_voltro/inspect", r = () => process.env.VOLTRO_INSPECT === "off", i =
 			message: e?.message ?? String(e)
 		}, u);
 	}
-}, N = async (e, t, n, i = {}) => {
-	if (f(e) !== "/_voltro/inspect/workflows/children") return null;
+}, R = async (e, t, n, i = {}) => {
+	if (_(e) !== "/_voltro/inspect/workflows/children") return null;
 	let o = l(n.origin ?? n.Origin), c = (i.method ?? "GET").toUpperCase();
 	if (c !== "GET") return s(405, {
 		error: "method not allowed",
@@ -774,7 +790,7 @@ var n = "/_voltro/inspect", r = () => process.env.VOLTRO_INSPECT === "off", i =
 		reason: u.reason
 	}, o);
 	if (t.kind !== "api") return s(404, { error: "workflow children are api-only" }, o);
-	let d = C(e).get("parentExecutionId");
+	let d = O(e).get("parentExecutionId");
 	if (d === null || d === "") return s(400, { error: "parentExecutionId query param required" }, o);
 	if (t.inspectWorkflowChildren === void 0) return s(200, {
 		runs: [],
@@ -790,22 +806,22 @@ var n = "/_voltro/inspect", r = () => process.env.VOLTRO_INSPECT === "off", i =
 			message: e?.message ?? String(e)
 		}, o);
 	}
-}, P = async (e, t, n, i, o = {}) => {
-	let c = f(e).match(/^\/_voltro\/inspect\/workflows\/runs\/([^/]+)\/(cancel|retry|suspend|resume|signal|update|discard|redrive)$/);
+}, z = async (e, t, n, i, o = {}) => {
+	let c = _(e).match(/^\/_voltro\/inspect\/workflows\/runs\/([^/]+)\/(cancel|retry|suspend|resume-from-step|resume|signal|update|discard|redrive)$/);
 	if (!c) return null;
-	let u = decodeURIComponent(c[1] ?? ""), d = c[2], p = l(n.origin ?? n.Origin), m = (o.method ?? "POST").toUpperCase();
-	if (m !== "POST") return s(405, {
+	let u = decodeURIComponent(c[1] ?? ""), d = c[2], f = l(n.origin ?? n.Origin), p = (o.method ?? "POST").toUpperCase();
+	if (p !== "POST") return s(405, {
 		error: "method not allowed",
 		expected: "POST"
-	}, p);
-	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, p);
-	let h = (o.authResolver ?? a)(n, m);
-	if (!h.ok) return s(401, {
+	}, f);
+	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, f);
+	let m = (o.authResolver ?? a)(n, p);
+	if (!m.ok) return s(401, {
 		error: "unauthorized",
-		reason: h.reason
-	}, p);
-	if (t.kind !== "api") return s(404, { error: "workflow actions are api-only" }, p);
-	let g = {
+		reason: m.reason
+	}, f);
+	if (t.kind !== "api") return s(404, { error: "workflow actions are api-only" }, f);
+	let h = {
 		cancel: t.inspectCancelWorkflowRun,
 		retry: t.inspectRetryWorkflowRun,
 		suspend: t.inspectSuspendWorkflowRun,
@@ -813,38 +829,43 @@ var n = "/_voltro/inspect", r = () => process.env.VOLTRO_INSPECT === "off", i =
 		signal: t.inspectSignalWorkflowRun,
 		update: t.inspectUpdateWorkflowRun,
 		discard: t.inspectDiscardWorkflowRun,
-		redrive: t.inspectRedriveWorkflowRun
+		redrive: t.inspectRedriveWorkflowRun,
+		"resume-from-step": t.inspectResumeWorkflowRunFromStep
 	}[d];
-	if (!g) return s(404, { error: `inspect${d[0]?.toUpperCase() ?? ""}${d.slice(1)}WorkflowRun not configured` }, p);
-	let _, v, y, b, x, S;
+	if (!h) return s(404, { error: d === "resume-from-step" ? "inspectResumeWorkflowRunFromStep not configured" : `inspect${d[0]?.toUpperCase() ?? ""}${d.slice(1)}WorkflowRun not configured` }, f);
+	let g, v, y, b, x, S, C;
 	if (i.length > 0) try {
 		let e = JSON.parse(i);
-		d === "retry" && (_ = e.payloadOverride), d === "signal" && (typeof e.signalName == "string" && e.signalName.length > 0 && (v = e.signalName), y = e.payload), d === "update" && (typeof e.updateName == "string" && e.updateName.length > 0 && (b = e.updateName), x = e.payload, typeof e.timeoutMs == "number" && Number.isFinite(e.timeoutMs) && (S = e.timeoutMs));
+		d === "retry" && (g = e.payloadOverride), d === "resume-from-step" && typeof e.step == "string" && e.step.length > 0 && (C = e.step), d === "signal" && (typeof e.signalName == "string" && e.signalName.length > 0 && (v = e.signalName), y = e.payload), d === "update" && (typeof e.updateName == "string" && e.updateName.length > 0 && (b = e.updateName), x = e.payload, typeof e.timeoutMs == "number" && Number.isFinite(e.timeoutMs) && (S = e.timeoutMs));
 	} catch {}
-	if (d === "signal" && v === void 0) return s(400, { error: "signal requires JSON body `{ signalName: string, payload?: unknown }`" }, p);
-	if (d === "update" && b === void 0) return s(400, { error: "update requires JSON body `{ updateName: string, payload?: unknown, timeoutMs?: number }`" }, p);
+	if (d === "signal" && v === void 0) return s(400, { error: "signal requires JSON body `{ signalName: string, payload?: unknown }`" }, f);
+	if (d === "update" && b === void 0) return s(400, { error: "update requires JSON body `{ updateName: string, payload?: unknown, timeoutMs?: number }`" }, f);
+	if (d === "resume-from-step" && C === void 0) return s(400, { error: "resume-from-step requires JSON body `{ step: string }` (the step name to rewind to)" }, f);
 	try {
-		return s(200, d === "retry" && _ !== void 0 ? await g({
+		return s(200, d === "retry" && g !== void 0 ? await h({
 			runId: u,
-			payloadOverride: _
-		}) : d === "signal" ? await g({
+			payloadOverride: g
+		}) : d === "signal" ? await h({
 			runId: u,
 			signalName: v,
 			payload: y
-		}) : d === "update" ? await g({
+		}) : d === "update" ? await h({
 			runId: u,
 			updateName: b,
 			payload: x,
 			...S === void 0 ? {} : { timeoutMs: S }
-		}) : await g({ runId: u }), p);
+		}) : d === "resume-from-step" ? await h({
+			runId: u,
+			step: C
+		}) : await h({ runId: u }), f);
 	} catch (e) {
 		return s(500, {
 			error: `${d} failed`,
 			message: e?.message ?? String(e)
-		}, p);
+		}, f);
 	}
-}, F = async (e, t, n, i, o = {}) => {
-	if (f(e) !== "/_voltro/inspect/data/import" || (o.method ?? "POST").toUpperCase() !== "POST") return null;
+}, B = async (e, t, n, i, o = {}) => {
+	if (_(e) !== "/_voltro/inspect/data/import" || (o.method ?? "POST").toUpperCase() !== "POST") return null;
 	let c = l(n.origin ?? n.Origin);
 	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, c);
 	let u = (o.authResolver ?? a)(n, "POST");
@@ -852,23 +873,23 @@ var n = "/_voltro/inspect", r = () => process.env.VOLTRO_INSPECT === "off", i =
 		error: "unauthorized",
 		reason: u.reason
 	}, c);
-	let p = d(o.method, n, c);
-	if (p) return p;
+	let f = d(o.method, n, c);
+	if (f) return f;
 	if (t.kind !== "api") return s(404, { error: "data import is api-only" }, c);
 	if (!t.inspectImport) return s(404, { error: "inspectImport not configured" }, c);
-	let m;
+	let p;
 	try {
-		m = JSON.parse(i || "{}");
+		p = JSON.parse(i || "{}");
 	} catch {
 		return s(400, { error: "body must be JSON" }, c);
 	}
-	if (typeof m.bundleDir != "string" || !m.bundleDir) return s(400, { error: "body.bundleDir (string) is required" }, c);
+	if (typeof p.bundleDir != "string" || !p.bundleDir) return s(400, { error: "body.bundleDir (string) is required" }, c);
 	try {
 		return s(200, await t.inspectImport({
-			bundleDir: m.bundleDir,
-			...m.mode === "upsert" || m.mode === "append" || m.mode === "replace" ? { mode: m.mode } : {},
-			...m.onConflict === "skip" || m.onConflict === "fail" ? { onConflict: m.onConflict } : {},
-			...typeof m.atomic == "boolean" ? { atomic: m.atomic } : {}
+			bundleDir: p.bundleDir,
+			...p.mode === "upsert" || p.mode === "append" || p.mode === "replace" ? { mode: p.mode } : {},
+			...p.onConflict === "skip" || p.onConflict === "fail" ? { onConflict: p.onConflict } : {},
+			...typeof p.atomic == "boolean" ? { atomic: p.atomic } : {}
 		}), c);
 	} catch (e) {
 		return s(500, {
@@ -876,17 +897,17 @@ var n = "/_voltro/inspect", r = () => process.env.VOLTRO_INSPECT === "off", i =
 			message: e?.message ?? String(e)
 		}, c);
 	}
-}, I = async (e, t, n, i, o = {}) => {
-	let c = f(e);
+}, V = async (e, t, n, i, o = {}) => {
+	let c = _(e);
 	if (!c.startsWith("/_voltro/inspect/data/rows")) return null;
 	let u = (o.method ?? "POST").toUpperCase();
 	if (u === "GET" && c === "/_voltro/inspect/data/rows") return null;
 	let d = l(n.origin ?? n.Origin);
 	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, d);
-	let p = (o.authResolver ?? a)(n, u);
-	if (!p.ok) return s(401, {
+	let f = (o.authResolver ?? a)(n, u);
+	if (!f.ok) return s(401, {
 		error: "unauthorized",
-		reason: p.reason
+		reason: f.reason
 	}, d);
 	if (t.kind !== "api") return s(404, { error: "data viewer is api-only" }, d);
 	if (u === "POST" && c === "/_voltro/inspect/data/rows") {
@@ -910,12 +931,12 @@ var n = "/_voltro/inspect", r = () => process.env.VOLTRO_INSPECT === "off", i =
 			}, d);
 		}
 	}
-	let m = c.match(/^\/_voltro\/inspect\/data\/rows\/([^/]+)$/);
-	if (!m) return null;
-	let h = decodeURIComponent(m[1] ?? "");
-	if (!h) return s(400, { error: "row id is required in URL" }, d);
-	let g = C(e).get("table") ?? "";
-	if (!g) return s(400, { error: "query.table is required" }, d);
+	let p = c.match(/^\/_voltro\/inspect\/data\/rows\/([^/]+)$/);
+	if (!p) return null;
+	let m = decodeURIComponent(p[1] ?? "");
+	if (!m) return s(400, { error: "row id is required in URL" }, d);
+	let h = O(e).get("table") ?? "";
+	if (!h) return s(400, { error: "query.table is required" }, d);
 	if (u === "PATCH") {
 		if (!t.inspectUpdateRow) return s(404, { error: "inspectUpdateRow not configured" }, d);
 		let e;
@@ -927,8 +948,8 @@ var n = "/_voltro/inspect", r = () => process.env.VOLTRO_INSPECT === "off", i =
 		if (!e.patch || typeof e.patch != "object") return s(400, { error: "body.patch must be an object" }, d);
 		try {
 			return s(200, await t.inspectUpdateRow({
-				table: g,
-				id: h,
+				table: h,
+				id: m,
 				patch: e.patch
 			}), d);
 		} catch (e) {
@@ -942,8 +963,8 @@ var n = "/_voltro/inspect", r = () => process.env.VOLTRO_INSPECT === "off", i =
 		if (!t.inspectDeleteRow) return s(404, { error: "inspectDeleteRow not configured" }, d);
 		try {
 			return s(200, await t.inspectDeleteRow({
-				table: g,
-				id: h
+				table: h,
+				id: m
 			}), d);
 		} catch (e) {
 			return s(500, {
@@ -958,4 +979,4 @@ var n = "/_voltro/inspect", r = () => process.env.VOLTRO_INSPECT === "off", i =
 	}, d);
 };
 //#endregion
-export { E as C, c as D, r as E, o as O, T as S, u as T, N as _, a, A as b, x as c, v as d, S as f, P as g, y as h, d as i, I as l, D as m, h as n, O as o, _ as p, g as r, F as s, n as t, b as u, j as v, l as w, k as x, M as y };
+export { g as A, j as C, r as D, u as E, c as O, A as S, h as T, R as _, a, F as b, E as c, C as d, D as f, z as g, w as h, d as i, o as j, f as k, V as l, M as m, b as n, N as o, S as p, x as r, B as s, n as t, T as u, I as v, l as w, P as x, L as y };