@voltro/cli 0.38.0 → 0.39.1

package/dist/inspect-B7U7Cl_Z.js

@@ -0,0 +1,1192 @@
+import { n as e } from "./inspectGateHint-BjnFubmH.js";
+import { lastWriteProvenance as t } from "@voltro/runtime";
+import { timingSafeStringEqual as n } from "@voltro/protocol/session";
+//#region src/inspect.ts
+var r = "/_voltro/inspect", i = () => process.env.VOLTRO_INSPECT === "off", a = /* @__PURE__ */ new Set([
+	"GET",
+	"HEAD",
+	"OPTIONS"
+]), o = (t, r) => {
+	let i = process.env.VOLTRO_INSPECT_TOKEN;
+	if (!i || i.length === 0) return {
+		ok: !1,
+		reason: "inspect is closed: no VOLTRO_INSPECT_TOKEN configured. `voltro dev` mints one per project; for serve/start set it explicitly (it is never minted outside dev)."
+	};
+	let o = t.authorization ?? t.Authorization;
+	if (!o) return {
+		ok: !1,
+		reason: "missing Authorization header"
+	};
+	if (!o.startsWith("Bearer ")) return {
+		ok: !1,
+		reason: "expected \"Bearer <token>\" auth scheme"
+	};
+	let s = o.slice(7).trim();
+	if (!n(s, i)) return {
+		ok: !1,
+		reason: "token mismatch"
+	};
+	if (!a.has(r.toUpperCase())) {
+		let i = process.env.VOLTRO_INSPECT_WRITE_TOKEN;
+		if (!i || i.length === 0) return {
+			ok: !1,
+			reason: e("unset", r)
+		};
+		let a = (t["x-voltro-inspect-write"] ?? t["X-Voltro-Inspect-Write"] ?? "").trim();
+		if (a.length === 0) return {
+			ok: !1,
+			reason: e("absent", r)
+		};
+		if (!n(a, i)) return {
+			ok: !1,
+			reason: e("mismatch", r)
+		};
+	}
+	return { ok: !0 };
+}, s = (e) => {
+	if (!Array.isArray(e) || e.length === 0) return;
+	let t = [];
+	for (let n of e) {
+		if (typeof n != "object" || !n) continue;
+		if (typeof n.open == "string") {
+			t.push({
+				kind: "open",
+				reason: n.open
+			});
+			continue;
+		}
+		if (typeof n.action == "string" && typeof n.resourceType == "string") {
+			t.push({
+				kind: "policy",
+				action: n.action,
+				resourceType: n.resourceType
+			});
+			continue;
+		}
+		let e = n.scope;
+		typeof e != "string" && !Array.isArray(e) || t.push({
+			kind: "scope",
+			scope: typeof e == "string" ? [e] : e.filter((e) => typeof e == "string"),
+			mode: n.mode === "any" ? "any" : "all",
+			resourceScoped: typeof n.resource == "function"
+		});
+	}
+	return t.length > 0 ? t : void 0;
+}, c = (e, t, n = {}) => ({
+	status: e,
+	contentType: "application/json; charset=utf-8",
+	body: JSON.stringify(t),
+	headers: n
+}), l = (e) => {
+	let t;
+	try {
+		t = new URL(e).hostname;
+	} catch {
+		return !1;
+	}
+	return t = t.replace(/^\[|\]$/g, ""), t === "localhost" || t.endsWith(".localhost") || t === "::1" ? !0 : /^127(?:\.\d{1,3}){3}$/.test(t);
+}, u = (e) => !e || e.length === 0 ? {} : l(e) ? {
+	"access-control-allow-origin": e,
+	"access-control-allow-credentials": "true",
+	"access-control-allow-methods": "GET, POST, OPTIONS",
+	"access-control-allow-headers": "authorization, content-type, accept",
+	"access-control-expose-headers": "content-type, content-length",
+	vary: "Origin"
+} : { vary: "Origin" }, d = (e, t = process.env.VOLTRO_DASHBOARD_APPS) => {
+	if (l(e)) return !0;
+	let n;
+	try {
+		n = new URL(e).origin;
+	} catch {
+		return !1;
+	}
+	if (!t || t.trim() === "") return !1;
+	try {
+		let e = JSON.parse(t);
+		return Array.isArray(e) ? e.some((e) => {
+			let t = e?.url;
+			if (typeof t != "string") return !1;
+			try {
+				return new URL(t).origin === n;
+			} catch {
+				return !1;
+			}
+		}) : !1;
+	} catch {
+		return !1;
+	}
+}, f = (e, t, n = {}) => {
+	let r = (e ?? "GET").toUpperCase();
+	if (r === "GET" || r === "HEAD" || r === "OPTIONS") return null;
+	let i = t.origin ?? t.Origin;
+	return i === void 0 || i === "" || l(i) ? null : c(403, {
+		error: "cross-site write rejected",
+		reason: `a state-changing inspect request may not come from origin "${i}" — only same-machine (loopback) origins may write`
+	}, n);
+}, p = (e = process.env.VOLTRO_INSPECT_ALLOWED_HOSTS) => (e ?? "").split(/[,\s]+/).map((e) => e.trim().toLowerCase()).filter((e) => e.length > 0), m = (e) => {
+	if (e === void 0) return "";
+	let t = e.trim();
+	if (t === "") return "";
+	if (t.startsWith("[")) {
+		let e = t.indexOf("]");
+		return (e === -1 ? t.slice(1) : t.slice(1, e)).toLowerCase();
+	}
+	let n = t.indexOf(":");
+	return (n === -1 ? t : t.slice(0, n)).toLowerCase();
+}, h = (e) => /^\d{1,3}(?:\.\d{1,3}){3}$/.test(e) || e.includes(":"), g = (e, t = p()) => {
+	let n = m(e);
+	return n === "" || n === "localhost" || n.endsWith(".localhost") || h(n) ? !0 : t.includes(n);
+}, _ = (e, t = {}, n) => g(e, n) ? null : c(403, {
+	error: "forbidden host",
+	reason: `the dev inspect surface refuses a request with Host "${e ?? ""}" — a DNS-rebinding guard. Only loopback names, IP literals, and hosts listed in VOLTRO_INSPECT_ALLOWED_HOSTS may reach it.`
+}, t), v = (e) => {
+	let t = e.indexOf("?");
+	return t === -1 ? e : e.slice(0, t);
+}, y = (e) => {
+	let t = e.indexOf("?");
+	return t === -1 ? new URLSearchParams() : new URLSearchParams(e.slice(t + 1));
+}, b = (e) => e === "/_voltro/inspect" || e.startsWith("/_voltro/inspect/"), x = [
+	"text",
+	"textarea",
+	"number",
+	"checkbox",
+	"switch",
+	"select",
+	"radio",
+	"async-select",
+	"multi-select",
+	"date",
+	"datetime",
+	"daterange",
+	"file",
+	"hidden",
+	"custom"
+], S = (e, t, n = [], r = []) => ({
+	version: 2,
+	scopes: [...new Set(r.flatMap((e) => e.declaredScopes ?? []))].sort(),
+	procedures: [...e].sort((e, t) => e.tag.localeCompare(t.tag)).map((e) => ({
+		tag: e.tag,
+		kind: e.kind,
+		...e.inputSchema === void 0 ? {} : { input: e.inputSchema },
+		...e.outputSchema === void 0 ? {} : { output: e.outputSchema },
+		...e.source === void 0 ? {} : { source: e.source },
+		...e.targets === void 0 ? {} : { targets: e.targets },
+		...e.guards === void 0 ? {} : { guards: e.guards },
+		...e.publicApi === void 0 ? {} : { publicApi: e.publicApi },
+		...e.exposeAsTool === void 0 ? {} : { exposeAsTool: e.exposeAsTool }
+	})),
+	workflows: [...t].sort((e, t) => e.tag.localeCompare(t.tag)).map((e) => ({ name: e.tag })),
+	widgets: x,
+	tables: [...n].filter((e) => !e.isFrameworkTable).sort((e, t) => e.name.localeCompare(t.name)).map((e) => ({
+		name: e.name,
+		reactive: e.isReactive,
+		framework: e.isFrameworkTable,
+		editable: e.editable ?? !0,
+		...e.pkColumn === void 0 ? {} : { pkColumn: e.pkColumn },
+		columns: e.columns.map((e) => ({
+			name: e.name,
+			type: String(e.type),
+			nullable: e.nullable,
+			...e.referencesTable === void 0 ? {} : { refersTo: e.referencesTable },
+			...e.oneOf === void 0 ? {} : { enum: e.oneOf },
+			...e.serverOnly === !0 ? { serverOnly: !0 } : {},
+			...e.encrypted === !0 ? { encrypted: !0 } : {},
+			...e.sensitive === void 0 ? {} : { sensitive: e.sensitive }
+		}))
+	}))
+}), C = (e, t, n = {}, r = {}) => {
+	let a = v(e);
+	if (!b(a)) return null;
+	let s = u(n.origin ?? n.Origin), l = (r.method ?? "GET").toUpperCase();
+	if (l === "OPTIONS") return {
+		status: 204,
+		contentType: "text/plain",
+		body: "",
+		headers: s
+	};
+	if (i()) return c(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, s);
+	let d = (r.authResolver ?? o)(n, l);
+	if (!d.ok) return c(401, {
+		error: "unauthorized",
+		reason: d.reason
+	}, s);
+	if (a === "/_voltro/inspect" || a === "/_voltro/inspect/" || a === "/_voltro/inspect/app") return c(200, {
+		kind: t.kind,
+		...t.meta
+	}, s);
+	if (a === "/_voltro/inspect/routes") return t.kind === "web" ? c(200, {
+		pages: t.routes,
+		dirs: t.dirs
+	}, s) : c(404, { error: "routes endpoint is web-only" }, s);
+	if (a === "/_voltro/inspect/cache") return t.kind === "web" ? c(200, t.cache(), s) : c(404, { error: "cache endpoint is web-only" }, s);
+	if (a === "/_voltro/inspect/rpc") return t.kind === "api" ? c(200, {
+		procedures: t.rpc,
+		workflows: t.workflows
+	}, s) : c(404, { error: "rpc endpoint is api-only" }, s);
+	if (a === "/_voltro/inspect/manifest") {
+		if (t.kind !== "api") return c(404, { error: "manifest endpoint is api-only" }, s);
+		let e = t.inspectTables?.().tables ?? [];
+		return c(200, S(t.rpc, t.workflows, e, t.plugins?.().plugins ?? []), s);
+	}
+	return a === "/_voltro/inspect/metrics" ? t.metrics === void 0 ? c(200, [], s) : c(200, t.metrics(), s) : a === "/_voltro/inspect/subscriptions" ? t.kind === "api" ? t.subscriptions === void 0 ? c(200, {
+		subscriptions: [],
+		matcherStats: [],
+		capturedAt: Date.now()
+	}, s) : c(200, t.subscriptions(), s) : c(404, { error: "subscriptions endpoint is api-only" }, s) : a === "/_voltro/inspect/members" ? t.kind === "api" ? t.members === void 0 ? c(200, {
+		members: [],
+		capturedAt: Date.now()
+	}, s) : c(200, t.members(), s) : c(404, { error: "members endpoint is api-only" }, s) : a === "/_voltro/inspect/events" ? t.kind === "api" ? t.events === void 0 ? c(200, {
+		declared: [],
+		routes: [],
+		origin: "",
+		capturedAt: Date.now(),
+		totals: {
+			routes: 0,
+			subscribers: 0,
+			buffered: 0
+		}
+	}, s) : c(200, t.events(), s) : c(404, { error: "events endpoint is api-only" }, s) : a === "/_voltro/inspect/data-cache" ? t.kind === "api" ? t.dataCache === void 0 ? c(200, {
+		backend: "memory",
+		engine: "memory",
+		driver: "resp",
+		hits: 0,
+		misses: 0,
+		hitRate: 0
+	}, s) : c(200, t.dataCache(), s) : c(404, { error: "data-cache endpoint is api-only" }, s) : a === "/_voltro/inspect/database" ? t.kind === "api" ? t.database === void 0 ? c(200, {
+		migrations: [],
+		seeds: []
+	}, s) : c(200, t.database(), s) : c(404, { error: "database endpoint is api-only" }, s) : a === "/_voltro/inspect/plugins" ? t.kind === "api" ? t.plugins === void 0 ? c(200, {
+		plugins: [],
+		capturedAt: Date.now()
+	}, s) : c(200, t.plugins(), s) : c(404, { error: "plugins endpoint is api-only" }, s) : a === "/_voltro/inspect/env" ? t.env === void 0 ? c(200, {
+		app: t.meta.name ?? "app",
+		entries: [],
+		summary: {
+			total: 0,
+			set: 0,
+			missingRequired: 0
+		}
+	}, s) : c(200, t.env(), s) : a === "/_voltro/inspect/data/tables" ? t.kind === "api" ? t.inspectTables === void 0 ? c(200, { tables: [] }, s) : c(200, t.inspectTables(), s) : c(404, { error: "data viewer is api-only" }, s) : a === "/_voltro/inspect/invoke" ? c(404, { error: "invoke not enabled here — use POST handler" }, s) : w.has(a) ? c(404, {
+		error: "endpoint not mounted on this instance",
+		path: a,
+		reason: "This inspect endpoint is served by `voltro dev`. A production `voltro serve` does not mount it — the data behind it (the in-memory log ring, the span buffer, the dev route table) is not collected there. This is not a missing token: the same request with no token would be 401."
+	}, s) : c(404, {
+		error: "unknown inspect endpoint",
+		path: a
+	}, s);
+}, w = /* @__PURE__ */ new Set([
+	`${r}/logs`,
+	`${r}/traces`,
+	`${r}/workflows`,
+	`${r}/storage`,
+	`${r}/aggregates`,
+	`${r}/flags`
+]), T = async (e, t, n, r = {}) => {
+	let a = u(t.origin ?? t.Origin);
+	if (i()) return c(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, a);
+	let s = (r.method ?? "POST").toUpperCase();
+	if (s !== "POST") return c(405, {
+		error: "method not allowed",
+		expected: "POST"
+	}, a);
+	let l = (r.authResolver ?? o)(t, s);
+	if (!l.ok) return c(401, {
+		error: "unauthorized",
+		reason: l.reason
+	}, a);
+	if (e.kind !== "api") return c(404, { error: "invoke endpoint is api-only" }, a);
+	if (!e.invokers || e.invokers.size === 0) return c(404, { error: "invoke not configured" }, a);
+	let d;
+	try {
+		d = JSON.parse(n || "{}");
+	} catch {
+		return c(400, { error: "body must be JSON" }, a);
+	}
+	let f = d;
+	if (typeof f.tag != "string") return c(400, { error: "body.tag must be a string" }, a);
+	let p = e.invokers.get(f.tag);
+	if (!p) return c(404, {
+		error: "unknown tag",
+		tag: f.tag
+	}, a);
+	let m = typeof f.headers == "object" && f.headers !== null ? f.headers : {}, h = {};
+	for (let [e, n] of Object.entries(t)) h[e.toLowerCase()] = n;
+	for (let [e, t] of Object.entries(m)) {
+		let n = e.toLowerCase();
+		n !== "cookie" && (h[n] = t);
+	}
+	return c(200, await p(f.input, h), a);
+}, E = async (e, t, n, r = {}) => {
+	let a = v(e);
+	if (!b(a) || a !== "/_voltro/inspect/migrations" || (r.method ?? "GET").toUpperCase() !== "GET") return null;
+	let s = u(n.origin ?? n.Origin);
+	if (i()) return c(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, s);
+	let l = (r.authResolver ?? o)(n, "GET");
+	return l.ok ? t.kind === "api" ? t.migrations === void 0 ? c(200, {
+		drift: {
+			isDrifted: !1,
+			liveFingerprint: "",
+			liveSnapshot: { tables: [] }
+		},
+		pending: null,
+		history: [],
+		softDropSnapshots: []
+	}, s) : c(200, await t.migrations(), s) : c(404, { error: "migrations endpoint is api-only" }, s) : c(401, {
+		error: "unauthorized",
+		reason: l.reason
+	}, s);
+}, D = async (e, t, n, a, s = {}) => {
+	let l = v(e);
+	if (!b(l) || !l.startsWith("/_voltro/inspect/webhooks/")) return null;
+	let d = u(n.origin ?? n.Origin);
+	if ((s.method ?? "POST").toUpperCase() !== "POST") return null;
+	if (i()) return c(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, d);
+	let p = (s.authResolver ?? o)(n, s.method ?? "POST");
+	if (!p.ok) return c(401, {
+		error: "unauthorized",
+		reason: p.reason
+	}, d);
+	let m = f(s.method, n, d);
+	if (m) return m;
+	if (t.kind !== "api") return c(404, { error: "webhook actions are api-only" }, d);
+	if (!t.webhookActions) return c(404, { error: "webhook actions not configured — is @voltro/plugin-webhooks active?" }, d);
+	let h;
+	try {
+		h = JSON.parse(a || "{}");
+	} catch {
+		return c(400, { error: "body must be JSON" }, d);
+	}
+	let g = l.slice(`${r}/webhooks/`.length);
+	try {
+		switch (g) {
+			case "subscribe": {
+				let e = h;
+				return typeof e.event != "string" || e.event.length === 0 ? c(400, { error: "event required" }, d) : typeof e.url != "string" || e.url.length === 0 ? c(400, { error: "url required" }, d) : c(200, await t.webhookActions.subscribe(e), d);
+			}
+			case "pause": {
+				let e = h.targetId;
+				return typeof e != "string" || e.length === 0 ? c(400, { error: "targetId required" }, d) : (await t.webhookActions.pause(e), c(200, { ok: !0 }, d));
+			}
+			case "resume": {
+				let e = h.targetId;
+				return typeof e != "string" || e.length === 0 ? c(400, { error: "targetId required" }, d) : (await t.webhookActions.resume(e), c(200, { ok: !0 }, d));
+			}
+			case "delete": {
+				let e = h.targetId;
+				return typeof e != "string" || e.length === 0 ? c(400, { error: "targetId required" }, d) : (await t.webhookActions.delete(e), c(200, { ok: !0 }, d));
+			}
+			case "rotateSecret": {
+				let e = h.targetId;
+				return typeof e != "string" || e.length === 0 ? c(400, { error: "targetId required" }, d) : c(200, await t.webhookActions.rotateSecret(e), d);
+			}
+			case "replay": {
+				let e = h.deliveryId;
+				return typeof e != "string" || e.length === 0 ? c(400, { error: "deliveryId required" }, d) : (await t.webhookActions.replay(e), c(200, { ok: !0 }, d));
+			}
+			case "repinVersion": {
+				let e = h.targetId, n = h.version;
+				return typeof e != "string" || e.length === 0 ? c(400, { error: "targetId required" }, d) : typeof n != "number" || !Number.isInteger(n) || n < 1 ? c(400, { error: "version must be a positive integer" }, d) : (await t.webhookActions.updateTargetPayloadVersion(e, n), c(200, { ok: !0 }, d));
+			}
+			default: return c(404, { error: `unknown webhook action: ${g}` }, d);
+		}
+	} catch (e) {
+		return c(500, {
+			error: "webhook action failed",
+			message: e?.message ?? String(e)
+		}, d);
+	}
+}, O = async (e, t, n, a, s = {}) => {
+	let l = v(e);
+	if (!b(l)) return null;
+	let d = u(n.origin ?? n.Origin), f = (s.method ?? "POST").toUpperCase();
+	if (f !== "POST") return null;
+	if (i()) return c(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, d);
+	let p = (s.authResolver ?? o)(n, f);
+	if (!p.ok) return c(401, {
+		error: "unauthorized",
+		reason: p.reason
+	}, d);
+	if (t.kind !== "api") return c(404, { error: "framework-action endpoints are api-only" }, d);
+	let m = `${r}/seeds/run`, h = `${r}/migrations/rollback`, g = `${r}/migrations/squash`, _ = `${r}/migrations/restore-snapshot`;
+	if (l !== m && l !== h && l !== g && l !== _ && l !== "/_voltro/inspect/migrations/compare-env") return null;
+	let y;
+	try {
+		y = JSON.parse(a || "{}");
+	} catch {
+		return c(400, { error: "body must be JSON" }, d);
+	}
+	try {
+		if (l === m) return typeof y.id != "string" || y.id.length === 0 ? c(400, { error: "body.id must be a non-empty string" }, d) : t.runSeed ? c(200, await t.runSeed(y.id), d) : c(404, { error: "runSeed not configured" }, d);
+		if (l === h) return typeof y.id != "string" || y.id.length === 0 ? c(400, { error: "body.id must be a non-empty string" }, d) : t.rollbackMigration ? c(200, await t.rollbackMigration(y.id), d) : c(404, { error: "rollbackMigration not configured" }, d);
+		if (l === g) {
+			if (typeof y.before != "string" || y.before.length === 0) return c(400, { error: "body.before must be a non-empty ISO date string" }, d);
+			if (!t.squashMigrationHistory) return c(404, { error: "squashMigrationHistory not configured" }, d);
+			let e = typeof y.note == "string" ? y.note : void 0;
+			return c(200, await t.squashMigrationHistory({
+				before: y.before,
+				note: e
+			}), d);
+		}
+		return l === _ ? typeof y.planId != "string" || y.planId.length === 0 ? c(400, { error: "body.planId must be a non-empty string" }, d) : t.restoreSnapshot ? c(200, await t.restoreSnapshot({ planId: y.planId }), d) : c(404, { error: "restoreSnapshot not configured" }, d) : typeof y.url != "string" || y.url.length === 0 ? c(400, { error: "body.url must be a non-empty URL string" }, d) : t.compareCrossEnv ? (await t.compareCrossEnv({
+			url: y.url,
+			label: typeof y.label == "string" ? y.label : void 0,
+			token: typeof y.token == "string" ? y.token : void 0
+		}), c(200, { ok: !0 }, d)) : c(404, { error: "compareCrossEnv not configured" }, d);
+	} catch (e) {
+		return c(500, {
+			error: "framework action failed",
+			message: e?.message ?? String(e)
+		}, d);
+	}
+}, k = async (e, t, n, r = {}) => {
+	if (v(e) !== "/_voltro/inspect/data/rows") return null;
+	let a = u(n.origin ?? n.Origin), s = (r.method ?? "GET").toUpperCase();
+	if (s !== "GET") return c(405, {
+		error: "method not allowed",
+		expected: "GET"
+	}, a);
+	if (i()) return c(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, a);
+	let l = (r.authResolver ?? o)(n, s);
+	if (!l.ok) return c(401, {
+		error: "unauthorized",
+		reason: l.reason
+	}, a);
+	if (t.kind !== "api") return c(404, { error: "data viewer is api-only" }, a);
+	if (t.inspectRows === void 0) return c(404, { error: "inspectRows not configured" }, a);
+	let d = j(e), f = d.get("table");
+	if (!f) return c(400, { error: "query.table is required" }, a);
+	let p = M(d.get("offset")) ?? 0, m = M(d.get("limit")) ?? 50, h = {}, g = d.get("q");
+	if (g) {
+		if (g.length > 8192) return c(400, { error: "query.q too large" }, a);
+		try {
+			h = JSON.parse(Buffer.from(g, "base64url").toString("utf8"));
+		} catch {
+			return c(400, { error: "query.q is not valid base64url JSON" }, a);
+		}
+	}
+	try {
+		return c(200, await t.inspectRows({
+			table: f,
+			offset: p,
+			limit: m,
+			...h
+		}), a);
+	} catch (e) {
+		return e?.name === "InspectQueryError" ? c(400, {
+			error: "invalid query",
+			message: e.message
+		}, a) : c(500, {
+			error: "data-rows query failed",
+			message: e?.message ?? String(e)
+		}, a);
+	}
+}, A = async (e, n, r, a = {}) => {
+	if (v(e) !== "/_voltro/inspect/provenance") return null;
+	let s = u(r.origin ?? r.Origin), l = (a.method ?? "GET").toUpperCase();
+	if (l !== "GET") return c(405, {
+		error: "method not allowed",
+		expected: "GET"
+	}, s);
+	if (i()) return c(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, s);
+	let d = (a.authResolver ?? o)(r, l);
+	if (!d.ok) return c(401, {
+		error: "unauthorized",
+		reason: d.reason
+	}, s);
+	let p = f(a.method, r, s);
+	if (p) return p;
+	if (n.kind !== "api") return c(404, { error: "provenance is api-only" }, s);
+	if (n.inspectRows === void 0) return c(404, { error: "inspectRows not configured" }, s);
+	let m = j(e), h = m.get("table"), g = m.get("id"), _ = m.get("column") ?? void 0;
+	if (!h || !g) return c(400, { error: "query.table and query.id are required" }, s);
+	try {
+		let e = (await n.inspectRows({
+			table: h,
+			limit: 1,
+			filter: {
+				kind: "leaf",
+				column: "id",
+				op: "eq",
+				value: g
+			}
+		})).rows[0];
+		return c(200, t(e, {
+			table: h,
+			id: g,
+			..._ === void 0 ? {} : { column: _ }
+		}), s);
+	} catch (e) {
+		return e?.name === "InspectQueryError" ? c(400, {
+			error: "invalid query",
+			message: e.message
+		}, s) : c(500, {
+			error: "provenance query failed",
+			message: e?.message ?? String(e)
+		}, s);
+	}
+}, j = (e) => {
+	let t = e.indexOf("?");
+	return t < 0 ? new URLSearchParams() : new URLSearchParams(e.slice(t + 1));
+}, M = (e) => {
+	if (e === null || e === "") return;
+	let t = Number(e);
+	return Number.isFinite(t) && t >= 0 ? Math.floor(t) : void 0;
+}, N = async (e, t, n, r = {}) => {
+	if (v(e) !== "/_voltro/inspect/workflows/runs") return null;
+	let a = u(n.origin ?? n.Origin), s = (r.method ?? "GET").toUpperCase();
+	if (s !== "GET") return c(405, {
+		error: "method not allowed",
+		expected: "GET"
+	}, a);
+	if (i()) return c(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, a);
+	let l = (r.authResolver ?? o)(n, s);
+	if (!l.ok) return c(401, {
+		error: "unauthorized",
+		reason: l.reason
+	}, a);
+	if (t.kind !== "api") return c(404, { error: "workflows endpoint is api-only" }, a);
+	if (t.inspectWorkflowRuns === void 0) return c(200, {
+		runs: [],
+		total: 0,
+		offset: 0,
+		limit: 50
+	}, a);
+	let d = j(e);
+	try {
+		let e = d.get("deadLettered") === "1" || d.get("deadLettered") === "true", n = (d.get("statuses") ?? "").split(",").map((e) => e.trim()).filter((e) => e !== "");
+		return c(200, await t.inspectWorkflowRuns({
+			...d.get("tag") === null ? {} : { tag: d.get("tag") },
+			...e ? { deadLettered: !0 } : d.get("status") === null ? n.length > 0 ? { statuses: n } : {} : { status: d.get("status") },
+			...d.get("q") === null ? {} : { tagContains: d.get("q") },
+			...d.get("source") === null ? {} : { source: d.get("source") },
+			...d.get("idPrefix") === null ? {} : { idPrefix: d.get("idPrefix") },
+			...d.get("from") === null ? {} : { startedAfter: d.get("from") },
+			...d.get("to") === null ? {} : { startedBefore: d.get("to") },
+			offset: M(d.get("offset")) ?? 0,
+			limit: M(d.get("limit")) ?? 50
+		}), a);
+	} catch (e) {
+		return c(500, {
+			error: "workflow-runs query failed",
+			message: e?.message ?? String(e)
+		}, a);
+	}
+}, P = async (e, t, n, r = {}) => {
+	if (v(e) !== "/_voltro/inspect/workflows/stats") return null;
+	let a = u(n.origin ?? n.Origin), s = (r.method ?? "GET").toUpperCase();
+	if (s !== "GET") return c(405, {
+		error: "method not allowed",
+		expected: "GET"
+	}, a);
+	if (i()) return c(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, a);
+	let l = (r.authResolver ?? o)(n, s);
+	if (!l.ok) return c(401, {
+		error: "unauthorized",
+		reason: l.reason
+	}, a);
+	if (t.kind !== "api") return c(404, { error: "workflows endpoint is api-only" }, a);
+	if (t.inspectWorkflowRunStats === void 0) return c(200, {
+		windowHours: 24,
+		bucketMinutes: 30,
+		buckets: [],
+		byTag: [],
+		total: 0,
+		truncated: !1
+	}, a);
+	let d = j(e);
+	try {
+		return c(200, await t.inspectWorkflowRunStats({
+			...d.get("tag") === null ? {} : { tag: d.get("tag") },
+			...M(d.get("hours")) === void 0 ? {} : { hours: M(d.get("hours")) }
+		}), a);
+	} catch (e) {
+		return c(500, {
+			error: "workflow-stats query failed",
+			message: e?.message ?? String(e)
+		}, a);
+	}
+}, F = async (e, t, n, r, a = {}) => {
+	let s = v(e).match(/^\/_voltro\/inspect\/workflows\/start\/([^/]+)$/);
+	if (!s) return null;
+	let l = decodeURIComponent(s[1] ?? ""), d = u(n.origin ?? n.Origin), f = (a.method ?? "POST").toUpperCase();
+	if (f !== "POST") return c(405, {
+		error: "method not allowed",
+		expected: "POST"
+	}, d);
+	if (i()) return c(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, d);
+	let p = (a.authResolver ?? o)(n, f);
+	if (!p.ok) return c(401, {
+		error: "unauthorized",
+		reason: p.reason
+	}, d);
+	if (t.kind !== "api") return c(404, { error: "workflow start is api-only" }, d);
+	if (t.inspectStartWorkflow === void 0) return c(404, { error: "inspectStartWorkflow not configured" }, d);
+	let m = {};
+	if (r.length > 0) try {
+		m = JSON.parse(r).payload ?? {};
+	} catch {
+		return c(400, { error: "start requires JSON body `{ payload?: unknown }`" }, d);
+	}
+	try {
+		return c(200, await t.inspectStartWorkflow({
+			name: l,
+			payload: m
+		}), d);
+	} catch (e) {
+		return c(500, {
+			error: "workflow start failed",
+			message: e?.message ?? String(e)
+		}, d);
+	}
+}, I = async (e, t, n, r = {}) => {
+	let a = v(e);
+	if (!a.startsWith("/_voltro/inspect/schedules")) return null;
+	let s = u(n.origin ?? n.Origin);
+	if (i()) return c(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, s);
+	let l = (r.authResolver ?? o)(n, r.method ?? "POST");
+	if (!l.ok) return c(401, {
+		error: "unauthorized",
+		reason: l.reason
+	}, s);
+	let d = f(r.method, n, s);
+	if (d) return d;
+	if (t.kind !== "api") return c(404, { error: "schedules are api-only" }, s);
+	let p = (r.method ?? "GET").toUpperCase(), m = a.match(/^\/_voltro\/inspect\/schedules\/([^/]+)\/backfill$/);
+	if (m) {
+		if (p !== "POST") return c(405, {
+			error: "method not allowed",
+			expected: "POST"
+		}, s);
+		if (!t.inspectBackfillSchedule) return c(404, { error: "inspectBackfillSchedule not configured" }, s);
+		let e = decodeURIComponent(m[1] ?? ""), n;
+		try {
+			n = JSON.parse(r.body ?? "{}");
+		} catch {
+			return c(400, { error: "invalid JSON body — expected { from, to, confirm?, limit? }" }, s);
+		}
+		if (typeof n.from != "string" || typeof n.to != "string") return c(400, { error: "body must carry ISO 'from' and 'to' instants" }, s);
+		try {
+			let r = await t.inspectBackfillSchedule({
+				name: e,
+				from: n.from,
+				to: n.to,
+				confirm: n.confirm === !0,
+				...typeof n.limit == "number" ? { limit: n.limit } : {}
+			});
+			return c(r.kind === "refused" ? 409 : 200, r, s);
+		} catch (e) {
+			return c(500, {
+				error: "backfill failed",
+				message: e?.message ?? String(e)
+			}, s);
+		}
+	}
+	let h = a.match(/^\/_voltro\/inspect\/schedules\/([^/]+)\/fire$/);
+	if (h) {
+		if (p !== "POST") return c(405, {
+			error: "method not allowed",
+			expected: "POST"
+		}, s);
+		if (!t.inspectFireSchedule) return c(404, { error: "inspectFireSchedule not configured" }, s);
+		let n = decodeURIComponent(h[1] ?? ""), r = j(e).get("trigger") === "external" ? "external" : "manual";
+		try {
+			return c(200, await t.inspectFireSchedule({
+				name: n,
+				trigger: r
+			}), s);
+		} catch (e) {
+			return c(500, {
+				error: "fire failed",
+				message: e?.message ?? String(e)
+			}, s);
+		}
+	}
+	if (a === "/_voltro/inspect/schedules/runs") {
+		if (p !== "GET") return c(405, {
+			error: "method not allowed",
+			expected: "GET"
+		}, s);
+		if (!t.inspectScheduleRuns) return c(200, {
+			runs: [],
+			total: 0,
+			offset: 0,
+			limit: 50
+		}, s);
+		let n = j(e);
+		try {
+			return c(200, await t.inspectScheduleRuns({
+				...n.get("name") === null ? {} : { name: n.get("name") },
+				offset: M(n.get("offset")) ?? 0,
+				limit: M(n.get("limit")) ?? 50
+			}), s);
+		} catch (e) {
+			return c(500, {
+				error: "schedule-runs query failed",
+				message: e?.message ?? String(e)
+			}, s);
+		}
+	}
+	return a === "/_voltro/inspect/schedules" ? p === "GET" ? t.inspectSchedules ? c(200, t.inspectSchedules(), s) : c(200, {
+		schedules: [],
+		coordination: "single"
+	}, s) : c(405, {
+		error: "method not allowed",
+		expected: "GET"
+	}, s) : c(404, {
+		error: "unknown schedules endpoint",
+		path: a
+	}, s);
+}, L = async (e, t, n, r = {}) => {
+	if (v(e) !== "/_voltro/inspect/cluster") return null;
+	let a = u(n.origin ?? n.Origin);
+	if (i()) return c(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, a);
+	let s = (r.authResolver ?? o)(n, r.method ?? "POST");
+	if (!s.ok) return c(401, {
+		error: "unauthorized",
+		reason: s.reason
+	}, a);
+	let l = f(r.method, n, a);
+	if (l) return l;
+	if (t.kind !== "api") return c(404, { error: "cluster is api-only" }, a);
+	if ((r.method ?? "GET").toUpperCase() !== "GET") return c(405, {
+		error: "method not allowed",
+		expected: "GET"
+	}, a);
+	if (!t.cluster) return c(200, {
+		instance: {
+			replicaId: process.env.POD_NAME ?? process.env.HOSTNAME ?? `dev-${process.pid}`,
+			dialect: "memory",
+			runnerHost: "localhost",
+			runnerPort: 0,
+			runnerStorage: "none",
+			shardLock: "none",
+			coordination: "single",
+			cdc: {
+				enabled: !1,
+				flavor: "none (single-process)"
+			},
+			tier: "none",
+			localhostRisk: !1
+		},
+		coordinationState: {
+			recentReplicaIds: [],
+			scheduleClaims: [],
+			runningScheduleRuns: 0,
+			runningWorkflowRuns: 0
+		},
+		capturedAt: Date.now()
+	}, a);
+	try {
+		return c(200, await t.cluster(), a);
+	} catch (e) {
+		return c(500, {
+			error: "cluster snapshot failed",
+			message: e?.message ?? String(e)
+		}, a);
+	}
+}, R = async (e, t, n, r = {}) => {
+	let a = v(e).match(/^\/_voltro\/inspect\/workflows\/runs\/([^/]+)\/steps$/);
+	if (!a) return null;
+	let s = decodeURIComponent(a[1] ?? ""), l = u(n.origin ?? n.Origin), d = (r.method ?? "GET").toUpperCase();
+	if (d !== "GET") return c(405, {
+		error: "method not allowed",
+		expected: "GET"
+	}, l);
+	if (i()) return c(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, l);
+	let f = (r.authResolver ?? o)(n, d);
+	if (!f.ok) return c(401, {
+		error: "unauthorized",
+		reason: f.reason
+	}, l);
+	if (t.kind !== "api") return c(404, { error: "workflow steps are api-only" }, l);
+	if (t.inspectWorkflowRunSteps === void 0) return c(200, { steps: [] }, l);
+	try {
+		return c(200, await t.inspectWorkflowRunSteps({ runId: s }), l);
+	} catch (e) {
+		return c(500, {
+			error: "steps query failed",
+			message: e?.message ?? String(e)
+		}, l);
+	}
+}, z = async (e, t, n, r = {}) => {
+	let a = v(e).match(/^\/_voltro\/inspect\/workflows\/runs\/([^/]+)\/events$/);
+	if (!a) return null;
+	let s = decodeURIComponent(a[1] ?? ""), l = u(n.origin ?? n.Origin), d = (r.method ?? "GET").toUpperCase();
+	if (d !== "GET") return c(405, {
+		error: "method not allowed",
+		expected: "GET"
+	}, l);
+	if (i()) return c(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, l);
+	let f = (r.authResolver ?? o)(n, d);
+	if (!f.ok) return c(401, {
+		error: "unauthorized",
+		reason: f.reason
+	}, l);
+	if (t.kind !== "api") return c(404, { error: "workflow events are api-only" }, l);
+	if (t.inspectWorkflowRunEvents === void 0) return c(200, { events: [] }, l);
+	try {
+		return c(200, await t.inspectWorkflowRunEvents({ runId: s }), l);
+	} catch (e) {
+		return c(500, {
+			error: "events query failed",
+			message: e?.message ?? String(e)
+		}, l);
+	}
+}, B = async (e, t, n, r = {}) => {
+	if (v(t) !== "/_voltro/inspect/workflows/events") return null;
+	let a = u(n.origin ?? n.Origin), s = (r.method ?? "GET").toUpperCase();
+	if (s !== "GET") return c(405, {
+		error: "method not allowed",
+		expected: "GET"
+	}, a);
+	if (i()) return c(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, a);
+	let l = (r.authResolver ?? o)(n, s);
+	if (!l.ok) return c(401, {
+		error: "unauthorized",
+		reason: l.reason
+	}, a);
+	if (e.kind !== "api") return c(404, { error: "workflow domain events are api-only" }, a);
+	if (e.inspectWorkflowDomainEvents === void 0) return c(200, {
+		events: [],
+		total: 0,
+		offset: 0,
+		limit: 100
+	}, a);
+	let d = y(t), f = d.get("name") ?? void 0, p = Number(d.get("offset") ?? "0"), m = Number(d.get("limit") ?? "100");
+	try {
+		return c(200, await e.inspectWorkflowDomainEvents({
+			...f !== void 0 && f !== "" ? { name: f } : {},
+			offset: Number.isFinite(p) ? p : 0,
+			limit: Number.isFinite(m) ? m : 100
+		}), a);
+	} catch (e) {
+		return c(500, {
+			error: "workflow domain events query failed",
+			message: e?.message ?? String(e)
+		}, a);
+	}
+}, V = async (e, t, n, r = {}) => {
+	let a = v(t).match(/^\/_voltro\/inspect\/workflows\/events\/([^/]+)\/deliveries$/);
+	if (!a) return null;
+	let s = decodeURIComponent(a[1] ?? ""), l = u(n.origin ?? n.Origin), d = (r.method ?? "GET").toUpperCase();
+	if (d !== "GET") return c(405, {
+		error: "method not allowed",
+		expected: "GET"
+	}, l);
+	if (i()) return c(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, l);
+	let f = (r.authResolver ?? o)(n, d);
+	if (!f.ok) return c(401, {
+		error: "unauthorized",
+		reason: f.reason
+	}, l);
+	if (e.kind !== "api") return c(404, { error: "workflow event deliveries are api-only" }, l);
+	if (e.inspectWorkflowEventDeliveries === void 0) return c(200, { deliveries: [] }, l);
+	try {
+		return c(200, await e.inspectWorkflowEventDeliveries({ eventId: s }), l);
+	} catch (e) {
+		return c(500, {
+			error: "workflow event deliveries query failed",
+			message: e?.message ?? String(e)
+		}, l);
+	}
+}, H = async (e, t, n, r = {}) => {
+	if (v(e) !== "/_voltro/inspect/workflows/children") return null;
+	let a = u(n.origin ?? n.Origin), s = (r.method ?? "GET").toUpperCase();
+	if (s !== "GET") return c(405, {
+		error: "method not allowed",
+		expected: "GET"
+	}, a);
+	if (i()) return c(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, a);
+	let l = (r.authResolver ?? o)(n, s);
+	if (!l.ok) return c(401, {
+		error: "unauthorized",
+		reason: l.reason
+	}, a);
+	if (t.kind !== "api") return c(404, { error: "workflow children are api-only" }, a);
+	let d = j(e).get("parentExecutionId");
+	if (d === null || d === "") return c(400, { error: "parentExecutionId query param required" }, a);
+	if (t.inspectWorkflowChildren === void 0) return c(200, {
+		runs: [],
+		total: 0,
+		offset: 0,
+		limit: 200
+	}, a);
+	try {
+		return c(200, await t.inspectWorkflowChildren({ parentExecutionId: d }), a);
+	} catch (e) {
+		return c(500, {
+			error: "children query failed",
+			message: e?.message ?? String(e)
+		}, a);
+	}
+}, U = async (e, t, n, r, a = {}) => {
+	let s = v(e).match(/^\/_voltro\/inspect\/workflows\/runs\/([^/]+)\/(cancel|retry|suspend|resume-from-step|resume|signal|update|discard|redrive)$/);
+	if (!s) return null;
+	let l = decodeURIComponent(s[1] ?? ""), d = s[2], f = u(n.origin ?? n.Origin), p = (a.method ?? "POST").toUpperCase();
+	if (p !== "POST") return c(405, {
+		error: "method not allowed",
+		expected: "POST"
+	}, f);
+	if (i()) return c(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, f);
+	let m = (a.authResolver ?? o)(n, p);
+	if (!m.ok) return c(401, {
+		error: "unauthorized",
+		reason: m.reason
+	}, f);
+	if (t.kind !== "api") return c(404, { error: "workflow actions are api-only" }, f);
+	let h = {
+		cancel: t.inspectCancelWorkflowRun,
+		retry: t.inspectRetryWorkflowRun,
+		suspend: t.inspectSuspendWorkflowRun,
+		resume: t.inspectResumeWorkflowRun,
+		signal: t.inspectSignalWorkflowRun,
+		update: t.inspectUpdateWorkflowRun,
+		discard: t.inspectDiscardWorkflowRun,
+		redrive: t.inspectRedriveWorkflowRun,
+		"resume-from-step": t.inspectResumeWorkflowRunFromStep
+	}[d];
+	if (!h) return c(404, { error: d === "resume-from-step" ? "inspectResumeWorkflowRunFromStep not configured" : `inspect${d[0]?.toUpperCase() ?? ""}${d.slice(1)}WorkflowRun not configured` }, f);
+	let g, _, y, b, x, S, C;
+	if (r.length > 0) try {
+		let e = JSON.parse(r);
+		d === "retry" && (g = e.payloadOverride), d === "resume-from-step" && typeof e.step == "string" && e.step.length > 0 && (C = e.step), d === "signal" && (typeof e.signalName == "string" && e.signalName.length > 0 && (_ = e.signalName), y = e.payload), d === "update" && (typeof e.updateName == "string" && e.updateName.length > 0 && (b = e.updateName), x = e.payload, typeof e.timeoutMs == "number" && Number.isFinite(e.timeoutMs) && (S = e.timeoutMs));
+	} catch {}
+	if (d === "signal" && _ === void 0) return c(400, { error: "signal requires JSON body `{ signalName: string, payload?: unknown }`" }, f);
+	if (d === "update" && b === void 0) return c(400, { error: "update requires JSON body `{ updateName: string, payload?: unknown, timeoutMs?: number }`" }, f);
+	if (d === "resume-from-step" && C === void 0) return c(400, { error: "resume-from-step requires JSON body `{ step: string }` (the step name to rewind to)" }, f);
+	try {
+		return c(200, d === "retry" && g !== void 0 ? await h({
+			runId: l,
+			payloadOverride: g
+		}) : d === "signal" ? await h({
+			runId: l,
+			signalName: _,
+			payload: y
+		}) : d === "update" ? await h({
+			runId: l,
+			updateName: b,
+			payload: x,
+			...S === void 0 ? {} : { timeoutMs: S }
+		}) : d === "resume-from-step" ? await h({
+			runId: l,
+			step: C
+		}) : await h({ runId: l }), f);
+	} catch (e) {
+		return c(500, {
+			error: `${d} failed`,
+			message: e?.message ?? String(e)
+		}, f);
+	}
+}, W = async (e, t, n, r, a = {}) => {
+	if (v(e) !== "/_voltro/inspect/data/import" || (a.method ?? "POST").toUpperCase() !== "POST") return null;
+	let s = u(n.origin ?? n.Origin);
+	if (i()) return c(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, s);
+	let l = (a.authResolver ?? o)(n, "POST");
+	if (!l.ok) return c(401, {
+		error: "unauthorized",
+		reason: l.reason
+	}, s);
+	let d = f(a.method, n, s);
+	if (d) return d;
+	if (t.kind !== "api") return c(404, { error: "data import is api-only" }, s);
+	if (!t.inspectImport) return c(404, { error: "inspectImport not configured" }, s);
+	let p;
+	try {
+		p = JSON.parse(r || "{}");
+	} catch {
+		return c(400, { error: "body must be JSON" }, s);
+	}
+	if (typeof p.bundleDir != "string" || !p.bundleDir) return c(400, { error: "body.bundleDir (string) is required" }, s);
+	try {
+		return c(200, await t.inspectImport({
+			bundleDir: p.bundleDir,
+			...p.mode === "upsert" || p.mode === "append" || p.mode === "replace" ? { mode: p.mode } : {},
+			...p.onConflict === "skip" || p.onConflict === "fail" ? { onConflict: p.onConflict } : {},
+			...typeof p.atomic == "boolean" ? { atomic: p.atomic } : {}
+		}), s);
+	} catch (e) {
+		return c(500, {
+			error: "import failed",
+			message: e?.message ?? String(e)
+		}, s);
+	}
+}, G = async (e, t, n, r, a = {}) => {
+	let s = v(e);
+	if (!s.startsWith("/_voltro/inspect/data/rows")) return null;
+	let l = (a.method ?? "POST").toUpperCase();
+	if (l === "GET" && s === "/_voltro/inspect/data/rows") return null;
+	let d = u(n.origin ?? n.Origin);
+	if (i()) return c(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, d);
+	let f = (a.authResolver ?? o)(n, l);
+	if (!f.ok) return c(401, {
+		error: "unauthorized",
+		reason: f.reason
+	}, d);
+	if (t.kind !== "api") return c(404, { error: "data viewer is api-only" }, d);
+	if (l === "POST" && s === "/_voltro/inspect/data/rows") {
+		if (!t.inspectInsertRow) return c(404, { error: "inspectInsertRow not configured" }, d);
+		let e;
+		try {
+			e = JSON.parse(r || "{}");
+		} catch {
+			return c(400, { error: "body must be JSON" }, d);
+		}
+		if (typeof e.table != "string" || !e.row || typeof e.row != "object") return c(400, { error: "body must be { table: string, row: object }" }, d);
+		try {
+			return c(200, await t.inspectInsertRow({
+				table: e.table,
+				row: e.row
+			}), d);
+		} catch (e) {
+			return c(500, {
+				error: "insert failed",
+				message: e?.message ?? String(e)
+			}, d);
+		}
+	}
+	let p = s.match(/^\/_voltro\/inspect\/data\/rows\/([^/]+)$/);
+	if (!p) return null;
+	let m = decodeURIComponent(p[1] ?? "");
+	if (!m) return c(400, { error: "row id is required in URL" }, d);
+	let h = j(e).get("table") ?? "";
+	if (!h) return c(400, { error: "query.table is required" }, d);
+	if (l === "PATCH") {
+		if (!t.inspectUpdateRow) return c(404, { error: "inspectUpdateRow not configured" }, d);
+		let e;
+		try {
+			e = JSON.parse(r || "{}");
+		} catch {
+			return c(400, { error: "body must be JSON" }, d);
+		}
+		if (!e.patch || typeof e.patch != "object") return c(400, { error: "body.patch must be an object" }, d);
+		try {
+			return c(200, await t.inspectUpdateRow({
+				table: h,
+				id: m,
+				patch: e.patch
+			}), d);
+		} catch (e) {
+			return c(500, {
+				error: "update failed",
+				message: e?.message ?? String(e)
+			}, d);
+		}
+	}
+	if (l === "DELETE") {
+		if (!t.inspectDeleteRow) return c(404, { error: "inspectDeleteRow not configured" }, d);
+		try {
+			return c(200, await t.inspectDeleteRow({
+				table: h,
+				id: m
+			}), d);
+		} catch (e) {
+			return c(500, {
+				error: "delete failed",
+				message: e?.message ?? String(e)
+			}, d);
+		}
+	}
+	return c(405, {
+		error: "method not allowed",
+		expected: "POST | PATCH | DELETE"
+	}, d);
+}, K = async (e, t, n, a, s = {}) => {
+	let l = v(e), d = `${r}/workflows/flow-control`;
+	if (l !== d && !l.startsWith(`${d}/`)) return null;
+	let f = u(n.origin ?? n.Origin), p = (s.method ?? "GET").toUpperCase();
+	if (i()) return c(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, f);
+	let m = (s.authResolver ?? o)(n, p);
+	if (!m.ok) return c(401, {
+		error: "unauthorized",
+		reason: m.reason
+	}, f);
+	if (t.kind !== "api") return c(404, { error: "flow control is api-only" }, f);
+	if (l === `${d}/inferences`) {
+		if (p !== "GET") return c(405, {
+			error: "method not allowed",
+			expected: "GET"
+		}, f);
+		if (t.inspectInferences === void 0) return c(404, { error: "inspectInferences not configured" }, f);
+		let n = j(e).get("limit"), r = n === null ? void 0 : Number(n);
+		try {
+			return c(200, await t.inspectInferences(r !== void 0 && Number.isFinite(r) ? { limit: r } : {}), f);
+		} catch (e) {
+			return c(500, {
+				error: "inference queue read failed",
+				message: e?.message ?? String(e)
+			}, f);
+		}
+	}
+	if (l === d) {
+		if (p !== "GET") return c(405, {
+			error: "method not allowed",
+			expected: "GET"
+		}, f);
+		if (t.inspectFlowControl === void 0) return c(404, { error: "inspectFlowControl not configured" }, f);
+		let n = j(e).get("limit"), r = n === null ? void 0 : Number(n);
+		try {
+			return c(200, await t.inspectFlowControl(r !== void 0 && Number.isFinite(r) ? { limit: r } : {}), f);
+		} catch (e) {
+			return c(500, {
+				error: "flow control read failed",
+				message: e?.message ?? String(e)
+			}, f);
+		}
+	}
+	if (p !== "POST") return c(405, {
+		error: "method not allowed",
+		expected: "POST"
+	}, f);
+	let h = {};
+	if (a.length > 0) try {
+		h = JSON.parse(a);
+	} catch {
+		return c(400, { error: "expected a JSON body" }, f);
+	}
+	let g = l.slice(d.length + 1);
+	try {
+		if (g === "pause") return t.inspectPauseWorkflow === void 0 ? c(404, { error: "inspectPauseWorkflow not configured" }, f) : h.workflow ? c(200, await t.inspectPauseWorkflow({
+			workflow: h.workflow,
+			...h.reason === void 0 ? {} : { reason: h.reason }
+		}), f) : c(400, { error: "body.workflow is required" }, f);
+		if (g === "resume") return t.inspectResumeWorkflow === void 0 ? c(404, { error: "inspectResumeWorkflow not configured" }, f) : h.workflow ? c(200, await t.inspectResumeWorkflow({ workflow: h.workflow }), f) : c(400, { error: "body.workflow is required" }, f);
+		if (g === "discard") return t.inspectDiscardIntent === void 0 ? c(404, { error: "inspectDiscardIntent not configured" }, f) : h.intentId ? c(200, await t.inspectDiscardIntent({ intentId: h.intentId }), f) : c(400, { error: "body.intentId is required" }, f);
+		if (g === "bulk") {
+			if (t.inspectBulkWorkflowRuns === void 0) return c(404, { error: "inspectBulkWorkflowRuns not configured" }, f);
+			if (h.op !== "cancel" && h.op !== "replay") return c(400, { error: "body.op must be 'cancel' or 'replay'" }, f);
+			if (typeof h.limit != "number") return c(400, { error: "body.limit is required — a bulk operation has no unbounded form, the cap IS the blast radius. The response reports `truncated` when more matched." }, f);
+			try {
+				return c(200, await t.inspectBulkWorkflowRuns({
+					op: h.op,
+					limit: h.limit,
+					...h.reason === void 0 ? {} : { reason: h.reason },
+					...h.mode === void 0 ? {} : { mode: h.mode },
+					...h.dryRun === void 0 ? {} : { dryRun: h.dryRun },
+					...h.workflow === void 0 ? {} : { workflow: h.workflow },
+					...h.status === void 0 ? {} : { status: h.status },
+					...h.startedAfter === void 0 ? {} : { startedAfter: h.startedAfter },
+					...h.startedBefore === void 0 ? {} : { startedBefore: h.startedBefore }
+				}), f);
+			} catch (e) {
+				if (e?.name === "BulkRequestError") return c(400, { error: e.message }, f);
+				throw e;
+			}
+		}
+	} catch (e) {
+		return c(500, {
+			error: "flow control action failed",
+			message: e?.message ?? String(e)
+		}, f);
+	}
+	return c(404, {
+		error: `unknown flow-control action '${g}'`,
+		expected: [
+			"pause",
+			"resume",
+			"discard",
+			"bulk"
+		]
+	}, f);
+};
+//#endregion
+export { i as A, P as C, u as D, F as E, p as M, _ as N, g as O, s as P, z as S, N as T, D as _, o as a, B as b, W as c, K as d, O as f, I as g, C as h, f as i, l as j, d as k, k as l, A as m, x as n, E as o, T as p, S as r, L as s, r as t, G as u, U as v, R as w, V as x, H as y };