@voltro/cli 0.38.0 → 0.39.1

package/dist/inspect-CjTYzAs_.js

@@ -1,1190 +0,0 @@
-import { lastWriteProvenance as e } from "@voltro/runtime";
-import { timingSafeStringEqual as t } from "@voltro/protocol/session";
-//#region src/inspect.ts
-var n = "/_voltro/inspect", r = () => process.env.VOLTRO_INSPECT === "off", i = /* @__PURE__ */ new Set([
-	"GET",
-	"HEAD",
-	"OPTIONS"
-]), a = (e, n) => {
-	let r = process.env.VOLTRO_INSPECT_TOKEN;
-	if (!r || r.length === 0) return {
-		ok: !1,
-		reason: "inspect is closed: no VOLTRO_INSPECT_TOKEN configured. `voltro dev` mints one per project; for serve/start set it explicitly (it is never minted outside dev)."
-	};
-	let a = e.authorization ?? e.Authorization;
-	if (!a) return {
-		ok: !1,
-		reason: "missing Authorization header"
-	};
-	if (!a.startsWith("Bearer ")) return {
-		ok: !1,
-		reason: "expected \"Bearer <token>\" auth scheme"
-	};
-	if (!t(a.slice(7).trim(), r)) return {
-		ok: !1,
-		reason: "token mismatch"
-	};
-	if (!i.has(n.toUpperCase())) {
-		let r = process.env.VOLTRO_INSPECT_WRITE_TOKEN;
-		if (!r || r.length === 0) return {
-			ok: !1,
-			reason: `inspect: ${(n ?? "unknown-method").toUpperCase()} is refused — no VOLTRO_INSPECT_WRITE_TOKEN configured. Mutating inspect endpoints (GDPR erase/export, storage share/revoke, schedule fire) need their own secret; the read token is not enough. \`voltro dev\` mints one per project; outside dev set it explicitly.`
-		};
-		let i = (e["x-voltro-inspect-write"] ?? e["X-Voltro-Inspect-Write"] ?? "").trim();
-		if (i.length === 0) return {
-			ok: !1,
-			reason: `inspect: ${n.toUpperCase()} needs the write credential — send it as the \`x-voltro-inspect-write\` header alongside the bearer. The read token authorises reads only.`
-		};
-		if (!t(i, r)) return {
-			ok: !1,
-			reason: "inspect: write-credential mismatch"
-		};
-	}
-	return { ok: !0 };
-}, o = (e) => {
-	if (!Array.isArray(e) || e.length === 0) return;
-	let t = [];
-	for (let n of e) {
-		if (typeof n != "object" || !n) continue;
-		if (typeof n.open == "string") {
-			t.push({
-				kind: "open",
-				reason: n.open
-			});
-			continue;
-		}
-		if (typeof n.action == "string" && typeof n.resourceType == "string") {
-			t.push({
-				kind: "policy",
-				action: n.action,
-				resourceType: n.resourceType
-			});
-			continue;
-		}
-		let e = n.scope;
-		typeof e != "string" && !Array.isArray(e) || t.push({
-			kind: "scope",
-			scope: typeof e == "string" ? [e] : e.filter((e) => typeof e == "string"),
-			mode: n.mode === "any" ? "any" : "all",
-			resourceScoped: typeof n.resource == "function"
-		});
-	}
-	return t.length > 0 ? t : void 0;
-}, s = (e, t, n = {}) => ({
-	status: e,
-	contentType: "application/json; charset=utf-8",
-	body: JSON.stringify(t),
-	headers: n
-}), c = (e) => {
-	let t;
-	try {
-		t = new URL(e).hostname;
-	} catch {
-		return !1;
-	}
-	return t = t.replace(/^\[|\]$/g, ""), t === "localhost" || t.endsWith(".localhost") || t === "::1" ? !0 : /^127(?:\.\d{1,3}){3}$/.test(t);
-}, l = (e) => !e || e.length === 0 ? {} : c(e) ? {
-	"access-control-allow-origin": e,
-	"access-control-allow-credentials": "true",
-	"access-control-allow-methods": "GET, POST, OPTIONS",
-	"access-control-allow-headers": "authorization, content-type, accept",
-	"access-control-expose-headers": "content-type, content-length",
-	vary: "Origin"
-} : { vary: "Origin" }, u = (e, t = process.env.VOLTRO_DASHBOARD_APPS) => {
-	if (c(e)) return !0;
-	let n;
-	try {
-		n = new URL(e).origin;
-	} catch {
-		return !1;
-	}
-	if (!t || t.trim() === "") return !1;
-	try {
-		let e = JSON.parse(t);
-		return Array.isArray(e) ? e.some((e) => {
-			let t = e?.url;
-			if (typeof t != "string") return !1;
-			try {
-				return new URL(t).origin === n;
-			} catch {
-				return !1;
-			}
-		}) : !1;
-	} catch {
-		return !1;
-	}
-}, d = (e, t, n = {}) => {
-	let r = (e ?? "GET").toUpperCase();
-	if (r === "GET" || r === "HEAD" || r === "OPTIONS") return null;
-	let i = t.origin ?? t.Origin;
-	return i === void 0 || i === "" || c(i) ? null : s(403, {
-		error: "cross-site write rejected",
-		reason: `a state-changing inspect request may not come from origin "${i}" — only same-machine (loopback) origins may write`
-	}, n);
-}, f = (e = process.env.VOLTRO_INSPECT_ALLOWED_HOSTS) => (e ?? "").split(/[,\s]+/).map((e) => e.trim().toLowerCase()).filter((e) => e.length > 0), p = (e) => {
-	if (e === void 0) return "";
-	let t = e.trim();
-	if (t === "") return "";
-	if (t.startsWith("[")) {
-		let e = t.indexOf("]");
-		return (e === -1 ? t.slice(1) : t.slice(1, e)).toLowerCase();
-	}
-	let n = t.indexOf(":");
-	return (n === -1 ? t : t.slice(0, n)).toLowerCase();
-}, m = (e) => /^\d{1,3}(?:\.\d{1,3}){3}$/.test(e) || e.includes(":"), h = (e, t = f()) => {
-	let n = p(e);
-	return n === "" || n === "localhost" || n.endsWith(".localhost") || m(n) ? !0 : t.includes(n);
-}, g = (e, t = {}, n) => h(e, n) ? null : s(403, {
-	error: "forbidden host",
-	reason: `the dev inspect surface refuses a request with Host "${e ?? ""}" — a DNS-rebinding guard. Only loopback names, IP literals, and hosts listed in VOLTRO_INSPECT_ALLOWED_HOSTS may reach it.`
-}, t), _ = (e) => {
-	let t = e.indexOf("?");
-	return t === -1 ? e : e.slice(0, t);
-}, v = (e) => {
-	let t = e.indexOf("?");
-	return t === -1 ? new URLSearchParams() : new URLSearchParams(e.slice(t + 1));
-}, y = (e) => e === "/_voltro/inspect" || e.startsWith("/_voltro/inspect/"), b = [
-	"text",
-	"textarea",
-	"number",
-	"checkbox",
-	"switch",
-	"select",
-	"radio",
-	"async-select",
-	"multi-select",
-	"date",
-	"datetime",
-	"daterange",
-	"file",
-	"hidden",
-	"custom"
-], x = (e, t, n = [], r = []) => ({
-	version: 2,
-	scopes: [...new Set(r.flatMap((e) => e.declaredScopes ?? []))].sort(),
-	procedures: [...e].sort((e, t) => e.tag.localeCompare(t.tag)).map((e) => ({
-		tag: e.tag,
-		kind: e.kind,
-		...e.inputSchema === void 0 ? {} : { input: e.inputSchema },
-		...e.outputSchema === void 0 ? {} : { output: e.outputSchema },
-		...e.source === void 0 ? {} : { source: e.source },
-		...e.targets === void 0 ? {} : { targets: e.targets },
-		...e.guards === void 0 ? {} : { guards: e.guards },
-		...e.publicApi === void 0 ? {} : { publicApi: e.publicApi },
-		...e.exposeAsTool === void 0 ? {} : { exposeAsTool: e.exposeAsTool }
-	})),
-	workflows: [...t].sort((e, t) => e.tag.localeCompare(t.tag)).map((e) => ({ name: e.tag })),
-	widgets: b,
-	tables: [...n].filter((e) => !e.isFrameworkTable).sort((e, t) => e.name.localeCompare(t.name)).map((e) => ({
-		name: e.name,
-		reactive: e.isReactive,
-		framework: e.isFrameworkTable,
-		editable: e.editable ?? !0,
-		...e.pkColumn === void 0 ? {} : { pkColumn: e.pkColumn },
-		columns: e.columns.map((e) => ({
-			name: e.name,
-			type: String(e.type),
-			nullable: e.nullable,
-			...e.referencesTable === void 0 ? {} : { refersTo: e.referencesTable },
-			...e.oneOf === void 0 ? {} : { enum: e.oneOf },
-			...e.serverOnly === !0 ? { serverOnly: !0 } : {},
-			...e.encrypted === !0 ? { encrypted: !0 } : {},
-			...e.sensitive === void 0 ? {} : { sensitive: e.sensitive }
-		}))
-	}))
-}), S = (e, t, n = {}, i = {}) => {
-	let o = _(e);
-	if (!y(o)) return null;
-	let c = l(n.origin ?? n.Origin), u = (i.method ?? "GET").toUpperCase();
-	if (u === "OPTIONS") return {
-		status: 204,
-		contentType: "text/plain",
-		body: "",
-		headers: c
-	};
-	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, c);
-	let d = (i.authResolver ?? a)(n, u);
-	if (!d.ok) return s(401, {
-		error: "unauthorized",
-		reason: d.reason
-	}, c);
-	if (o === "/_voltro/inspect" || o === "/_voltro/inspect/" || o === "/_voltro/inspect/app") return s(200, {
-		kind: t.kind,
-		...t.meta
-	}, c);
-	if (o === "/_voltro/inspect/routes") return t.kind === "web" ? s(200, {
-		pages: t.routes,
-		dirs: t.dirs
-	}, c) : s(404, { error: "routes endpoint is web-only" }, c);
-	if (o === "/_voltro/inspect/cache") return t.kind === "web" ? s(200, t.cache(), c) : s(404, { error: "cache endpoint is web-only" }, c);
-	if (o === "/_voltro/inspect/rpc") return t.kind === "api" ? s(200, {
-		procedures: t.rpc,
-		workflows: t.workflows
-	}, c) : s(404, { error: "rpc endpoint is api-only" }, c);
-	if (o === "/_voltro/inspect/manifest") {
-		if (t.kind !== "api") return s(404, { error: "manifest endpoint is api-only" }, c);
-		let e = t.inspectTables?.().tables ?? [];
-		return s(200, x(t.rpc, t.workflows, e, t.plugins?.().plugins ?? []), c);
-	}
-	return o === "/_voltro/inspect/metrics" ? t.metrics === void 0 ? s(200, [], c) : s(200, t.metrics(), c) : o === "/_voltro/inspect/subscriptions" ? t.kind === "api" ? t.subscriptions === void 0 ? s(200, {
-		subscriptions: [],
-		matcherStats: [],
-		capturedAt: Date.now()
-	}, c) : s(200, t.subscriptions(), c) : s(404, { error: "subscriptions endpoint is api-only" }, c) : o === "/_voltro/inspect/members" ? t.kind === "api" ? t.members === void 0 ? s(200, {
-		members: [],
-		capturedAt: Date.now()
-	}, c) : s(200, t.members(), c) : s(404, { error: "members endpoint is api-only" }, c) : o === "/_voltro/inspect/events" ? t.kind === "api" ? t.events === void 0 ? s(200, {
-		declared: [],
-		routes: [],
-		origin: "",
-		capturedAt: Date.now(),
-		totals: {
-			routes: 0,
-			subscribers: 0,
-			buffered: 0
-		}
-	}, c) : s(200, t.events(), c) : s(404, { error: "events endpoint is api-only" }, c) : o === "/_voltro/inspect/data-cache" ? t.kind === "api" ? t.dataCache === void 0 ? s(200, {
-		backend: "memory",
-		engine: "memory",
-		driver: "resp",
-		hits: 0,
-		misses: 0,
-		hitRate: 0
-	}, c) : s(200, t.dataCache(), c) : s(404, { error: "data-cache endpoint is api-only" }, c) : o === "/_voltro/inspect/database" ? t.kind === "api" ? t.database === void 0 ? s(200, {
-		migrations: [],
-		seeds: []
-	}, c) : s(200, t.database(), c) : s(404, { error: "database endpoint is api-only" }, c) : o === "/_voltro/inspect/plugins" ? t.kind === "api" ? t.plugins === void 0 ? s(200, {
-		plugins: [],
-		capturedAt: Date.now()
-	}, c) : s(200, t.plugins(), c) : s(404, { error: "plugins endpoint is api-only" }, c) : o === "/_voltro/inspect/env" ? t.env === void 0 ? s(200, {
-		app: t.meta.name ?? "app",
-		entries: [],
-		summary: {
-			total: 0,
-			set: 0,
-			missingRequired: 0
-		}
-	}, c) : s(200, t.env(), c) : o === "/_voltro/inspect/data/tables" ? t.kind === "api" ? t.inspectTables === void 0 ? s(200, { tables: [] }, c) : s(200, t.inspectTables(), c) : s(404, { error: "data viewer is api-only" }, c) : o === "/_voltro/inspect/invoke" ? s(404, { error: "invoke not enabled here — use POST handler" }, c) : C.has(o) ? s(404, {
-		error: "endpoint not mounted on this instance",
-		path: o,
-		reason: "This inspect endpoint is served by `voltro dev`. A production `voltro serve` does not mount it — the data behind it (the in-memory log ring, the span buffer, the dev route table) is not collected there. This is not a missing token: the same request with no token would be 401."
-	}, c) : s(404, {
-		error: "unknown inspect endpoint",
-		path: o
-	}, c);
-}, C = /* @__PURE__ */ new Set([
-	`${n}/logs`,
-	`${n}/traces`,
-	`${n}/workflows`,
-	`${n}/storage`,
-	`${n}/aggregates`,
-	`${n}/flags`
-]), w = async (e, t, n, i = {}) => {
-	let o = l(t.origin ?? t.Origin);
-	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, o);
-	let c = (i.method ?? "POST").toUpperCase();
-	if (c !== "POST") return s(405, {
-		error: "method not allowed",
-		expected: "POST"
-	}, o);
-	let u = (i.authResolver ?? a)(t, c);
-	if (!u.ok) return s(401, {
-		error: "unauthorized",
-		reason: u.reason
-	}, o);
-	if (e.kind !== "api") return s(404, { error: "invoke endpoint is api-only" }, o);
-	if (!e.invokers || e.invokers.size === 0) return s(404, { error: "invoke not configured" }, o);
-	let d;
-	try {
-		d = JSON.parse(n || "{}");
-	} catch {
-		return s(400, { error: "body must be JSON" }, o);
-	}
-	let f = d;
-	if (typeof f.tag != "string") return s(400, { error: "body.tag must be a string" }, o);
-	let p = e.invokers.get(f.tag);
-	if (!p) return s(404, {
-		error: "unknown tag",
-		tag: f.tag
-	}, o);
-	let m = typeof f.headers == "object" && f.headers !== null ? f.headers : {}, h = {};
-	for (let [e, n] of Object.entries(t)) h[e.toLowerCase()] = n;
-	for (let [e, t] of Object.entries(m)) {
-		let n = e.toLowerCase();
-		n !== "cookie" && (h[n] = t);
-	}
-	return s(200, await p(f.input, h), o);
-}, T = async (e, t, n, i = {}) => {
-	let o = _(e);
-	if (!y(o) || o !== "/_voltro/inspect/migrations" || (i.method ?? "GET").toUpperCase() !== "GET") return null;
-	let c = l(n.origin ?? n.Origin);
-	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, c);
-	let u = (i.authResolver ?? a)(n, "GET");
-	return u.ok ? t.kind === "api" ? t.migrations === void 0 ? s(200, {
-		drift: {
-			isDrifted: !1,
-			liveFingerprint: "",
-			liveSnapshot: { tables: [] }
-		},
-		pending: null,
-		history: [],
-		softDropSnapshots: []
-	}, c) : s(200, await t.migrations(), c) : s(404, { error: "migrations endpoint is api-only" }, c) : s(401, {
-		error: "unauthorized",
-		reason: u.reason
-	}, c);
-}, E = async (e, t, i, o, c = {}) => {
-	let u = _(e);
-	if (!y(u) || !u.startsWith("/_voltro/inspect/webhooks/")) return null;
-	let f = l(i.origin ?? i.Origin);
-	if ((c.method ?? "POST").toUpperCase() !== "POST") return null;
-	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, f);
-	let p = (c.authResolver ?? a)(i, c.method ?? "POST");
-	if (!p.ok) return s(401, {
-		error: "unauthorized",
-		reason: p.reason
-	}, f);
-	let m = d(c.method, i, f);
-	if (m) return m;
-	if (t.kind !== "api") return s(404, { error: "webhook actions are api-only" }, f);
-	if (!t.webhookActions) return s(404, { error: "webhook actions not configured — is @voltro/plugin-webhooks active?" }, f);
-	let h;
-	try {
-		h = JSON.parse(o || "{}");
-	} catch {
-		return s(400, { error: "body must be JSON" }, f);
-	}
-	let g = u.slice(`${n}/webhooks/`.length);
-	try {
-		switch (g) {
-			case "subscribe": {
-				let e = h;
-				return typeof e.event != "string" || e.event.length === 0 ? s(400, { error: "event required" }, f) : typeof e.url != "string" || e.url.length === 0 ? s(400, { error: "url required" }, f) : s(200, await t.webhookActions.subscribe(e), f);
-			}
-			case "pause": {
-				let e = h.targetId;
-				return typeof e != "string" || e.length === 0 ? s(400, { error: "targetId required" }, f) : (await t.webhookActions.pause(e), s(200, { ok: !0 }, f));
-			}
-			case "resume": {
-				let e = h.targetId;
-				return typeof e != "string" || e.length === 0 ? s(400, { error: "targetId required" }, f) : (await t.webhookActions.resume(e), s(200, { ok: !0 }, f));
-			}
-			case "delete": {
-				let e = h.targetId;
-				return typeof e != "string" || e.length === 0 ? s(400, { error: "targetId required" }, f) : (await t.webhookActions.delete(e), s(200, { ok: !0 }, f));
-			}
-			case "rotateSecret": {
-				let e = h.targetId;
-				return typeof e != "string" || e.length === 0 ? s(400, { error: "targetId required" }, f) : s(200, await t.webhookActions.rotateSecret(e), f);
-			}
-			case "replay": {
-				let e = h.deliveryId;
-				return typeof e != "string" || e.length === 0 ? s(400, { error: "deliveryId required" }, f) : (await t.webhookActions.replay(e), s(200, { ok: !0 }, f));
-			}
-			case "repinVersion": {
-				let e = h.targetId, n = h.version;
-				return typeof e != "string" || e.length === 0 ? s(400, { error: "targetId required" }, f) : typeof n != "number" || !Number.isInteger(n) || n < 1 ? s(400, { error: "version must be a positive integer" }, f) : (await t.webhookActions.updateTargetPayloadVersion(e, n), s(200, { ok: !0 }, f));
-			}
-			default: return s(404, { error: `unknown webhook action: ${g}` }, f);
-		}
-	} catch (e) {
-		return s(500, {
-			error: "webhook action failed",
-			message: e?.message ?? String(e)
-		}, f);
-	}
-}, D = async (e, t, i, o, c = {}) => {
-	let u = _(e);
-	if (!y(u)) return null;
-	let d = l(i.origin ?? i.Origin), f = (c.method ?? "POST").toUpperCase();
-	if (f !== "POST") return null;
-	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, d);
-	let p = (c.authResolver ?? a)(i, f);
-	if (!p.ok) return s(401, {
-		error: "unauthorized",
-		reason: p.reason
-	}, d);
-	if (t.kind !== "api") return s(404, { error: "framework-action endpoints are api-only" }, d);
-	let m = `${n}/seeds/run`, h = `${n}/migrations/rollback`, g = `${n}/migrations/squash`, v = `${n}/migrations/restore-snapshot`;
-	if (u !== m && u !== h && u !== g && u !== v && u !== "/_voltro/inspect/migrations/compare-env") return null;
-	let b;
-	try {
-		b = JSON.parse(o || "{}");
-	} catch {
-		return s(400, { error: "body must be JSON" }, d);
-	}
-	try {
-		if (u === m) return typeof b.id != "string" || b.id.length === 0 ? s(400, { error: "body.id must be a non-empty string" }, d) : t.runSeed ? s(200, await t.runSeed(b.id), d) : s(404, { error: "runSeed not configured" }, d);
-		if (u === h) return typeof b.id != "string" || b.id.length === 0 ? s(400, { error: "body.id must be a non-empty string" }, d) : t.rollbackMigration ? s(200, await t.rollbackMigration(b.id), d) : s(404, { error: "rollbackMigration not configured" }, d);
-		if (u === g) {
-			if (typeof b.before != "string" || b.before.length === 0) return s(400, { error: "body.before must be a non-empty ISO date string" }, d);
-			if (!t.squashMigrationHistory) return s(404, { error: "squashMigrationHistory not configured" }, d);
-			let e = typeof b.note == "string" ? b.note : void 0;
-			return s(200, await t.squashMigrationHistory({
-				before: b.before,
-				note: e
-			}), d);
-		}
-		return u === v ? typeof b.planId != "string" || b.planId.length === 0 ? s(400, { error: "body.planId must be a non-empty string" }, d) : t.restoreSnapshot ? s(200, await t.restoreSnapshot({ planId: b.planId }), d) : s(404, { error: "restoreSnapshot not configured" }, d) : typeof b.url != "string" || b.url.length === 0 ? s(400, { error: "body.url must be a non-empty URL string" }, d) : t.compareCrossEnv ? (await t.compareCrossEnv({
-			url: b.url,
-			label: typeof b.label == "string" ? b.label : void 0,
-			token: typeof b.token == "string" ? b.token : void 0
-		}), s(200, { ok: !0 }, d)) : s(404, { error: "compareCrossEnv not configured" }, d);
-	} catch (e) {
-		return s(500, {
-			error: "framework action failed",
-			message: e?.message ?? String(e)
-		}, d);
-	}
-}, O = async (e, t, n, i = {}) => {
-	if (_(e) !== "/_voltro/inspect/data/rows") return null;
-	let o = l(n.origin ?? n.Origin), c = (i.method ?? "GET").toUpperCase();
-	if (c !== "GET") return s(405, {
-		error: "method not allowed",
-		expected: "GET"
-	}, o);
-	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, o);
-	let u = (i.authResolver ?? a)(n, c);
-	if (!u.ok) return s(401, {
-		error: "unauthorized",
-		reason: u.reason
-	}, o);
-	if (t.kind !== "api") return s(404, { error: "data viewer is api-only" }, o);
-	if (t.inspectRows === void 0) return s(404, { error: "inspectRows not configured" }, o);
-	let d = A(e), f = d.get("table");
-	if (!f) return s(400, { error: "query.table is required" }, o);
-	let p = j(d.get("offset")) ?? 0, m = j(d.get("limit")) ?? 50, h = {}, g = d.get("q");
-	if (g) {
-		if (g.length > 8192) return s(400, { error: "query.q too large" }, o);
-		try {
-			h = JSON.parse(Buffer.from(g, "base64url").toString("utf8"));
-		} catch {
-			return s(400, { error: "query.q is not valid base64url JSON" }, o);
-		}
-	}
-	try {
-		return s(200, await t.inspectRows({
-			table: f,
-			offset: p,
-			limit: m,
-			...h
-		}), o);
-	} catch (e) {
-		return e?.name === "InspectQueryError" ? s(400, {
-			error: "invalid query",
-			message: e.message
-		}, o) : s(500, {
-			error: "data-rows query failed",
-			message: e?.message ?? String(e)
-		}, o);
-	}
-}, k = async (t, n, i, o = {}) => {
-	if (_(t) !== "/_voltro/inspect/provenance") return null;
-	let c = l(i.origin ?? i.Origin), u = (o.method ?? "GET").toUpperCase();
-	if (u !== "GET") return s(405, {
-		error: "method not allowed",
-		expected: "GET"
-	}, c);
-	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, c);
-	let f = (o.authResolver ?? a)(i, u);
-	if (!f.ok) return s(401, {
-		error: "unauthorized",
-		reason: f.reason
-	}, c);
-	let p = d(o.method, i, c);
-	if (p) return p;
-	if (n.kind !== "api") return s(404, { error: "provenance is api-only" }, c);
-	if (n.inspectRows === void 0) return s(404, { error: "inspectRows not configured" }, c);
-	let m = A(t), h = m.get("table"), g = m.get("id"), v = m.get("column") ?? void 0;
-	if (!h || !g) return s(400, { error: "query.table and query.id are required" }, c);
-	try {
-		let t = (await n.inspectRows({
-			table: h,
-			limit: 1,
-			filter: {
-				kind: "leaf",
-				column: "id",
-				op: "eq",
-				value: g
-			}
-		})).rows[0];
-		return s(200, e(t, {
-			table: h,
-			id: g,
-			...v === void 0 ? {} : { column: v }
-		}), c);
-	} catch (e) {
-		return e?.name === "InspectQueryError" ? s(400, {
-			error: "invalid query",
-			message: e.message
-		}, c) : s(500, {
-			error: "provenance query failed",
-			message: e?.message ?? String(e)
-		}, c);
-	}
-}, A = (e) => {
-	let t = e.indexOf("?");
-	return t < 0 ? new URLSearchParams() : new URLSearchParams(e.slice(t + 1));
-}, j = (e) => {
-	if (e === null || e === "") return;
-	let t = Number(e);
-	return Number.isFinite(t) && t >= 0 ? Math.floor(t) : void 0;
-}, M = async (e, t, n, i = {}) => {
-	if (_(e) !== "/_voltro/inspect/workflows/runs") return null;
-	let o = l(n.origin ?? n.Origin), c = (i.method ?? "GET").toUpperCase();
-	if (c !== "GET") return s(405, {
-		error: "method not allowed",
-		expected: "GET"
-	}, o);
-	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, o);
-	let u = (i.authResolver ?? a)(n, c);
-	if (!u.ok) return s(401, {
-		error: "unauthorized",
-		reason: u.reason
-	}, o);
-	if (t.kind !== "api") return s(404, { error: "workflows endpoint is api-only" }, o);
-	if (t.inspectWorkflowRuns === void 0) return s(200, {
-		runs: [],
-		total: 0,
-		offset: 0,
-		limit: 50
-	}, o);
-	let d = A(e);
-	try {
-		let e = d.get("deadLettered") === "1" || d.get("deadLettered") === "true", n = (d.get("statuses") ?? "").split(",").map((e) => e.trim()).filter((e) => e !== "");
-		return s(200, await t.inspectWorkflowRuns({
-			...d.get("tag") === null ? {} : { tag: d.get("tag") },
-			...e ? { deadLettered: !0 } : d.get("status") === null ? n.length > 0 ? { statuses: n } : {} : { status: d.get("status") },
-			...d.get("q") === null ? {} : { tagContains: d.get("q") },
-			...d.get("source") === null ? {} : { source: d.get("source") },
-			...d.get("idPrefix") === null ? {} : { idPrefix: d.get("idPrefix") },
-			...d.get("from") === null ? {} : { startedAfter: d.get("from") },
-			...d.get("to") === null ? {} : { startedBefore: d.get("to") },
-			offset: j(d.get("offset")) ?? 0,
-			limit: j(d.get("limit")) ?? 50
-		}), o);
-	} catch (e) {
-		return s(500, {
-			error: "workflow-runs query failed",
-			message: e?.message ?? String(e)
-		}, o);
-	}
-}, N = async (e, t, n, i = {}) => {
-	if (_(e) !== "/_voltro/inspect/workflows/stats") return null;
-	let o = l(n.origin ?? n.Origin), c = (i.method ?? "GET").toUpperCase();
-	if (c !== "GET") return s(405, {
-		error: "method not allowed",
-		expected: "GET"
-	}, o);
-	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, o);
-	let u = (i.authResolver ?? a)(n, c);
-	if (!u.ok) return s(401, {
-		error: "unauthorized",
-		reason: u.reason
-	}, o);
-	if (t.kind !== "api") return s(404, { error: "workflows endpoint is api-only" }, o);
-	if (t.inspectWorkflowRunStats === void 0) return s(200, {
-		windowHours: 24,
-		bucketMinutes: 30,
-		buckets: [],
-		byTag: [],
-		total: 0,
-		truncated: !1
-	}, o);
-	let d = A(e);
-	try {
-		return s(200, await t.inspectWorkflowRunStats({
-			...d.get("tag") === null ? {} : { tag: d.get("tag") },
-			...j(d.get("hours")) === void 0 ? {} : { hours: j(d.get("hours")) }
-		}), o);
-	} catch (e) {
-		return s(500, {
-			error: "workflow-stats query failed",
-			message: e?.message ?? String(e)
-		}, o);
-	}
-}, P = async (e, t, n, i, o = {}) => {
-	let c = _(e).match(/^\/_voltro\/inspect\/workflows\/start\/([^/]+)$/);
-	if (!c) return null;
-	let u = decodeURIComponent(c[1] ?? ""), d = l(n.origin ?? n.Origin), f = (o.method ?? "POST").toUpperCase();
-	if (f !== "POST") return s(405, {
-		error: "method not allowed",
-		expected: "POST"
-	}, d);
-	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, d);
-	let p = (o.authResolver ?? a)(n, f);
-	if (!p.ok) return s(401, {
-		error: "unauthorized",
-		reason: p.reason
-	}, d);
-	if (t.kind !== "api") return s(404, { error: "workflow start is api-only" }, d);
-	if (t.inspectStartWorkflow === void 0) return s(404, { error: "inspectStartWorkflow not configured" }, d);
-	let m = {};
-	if (i.length > 0) try {
-		m = JSON.parse(i).payload ?? {};
-	} catch {
-		return s(400, { error: "start requires JSON body `{ payload?: unknown }`" }, d);
-	}
-	try {
-		return s(200, await t.inspectStartWorkflow({
-			name: u,
-			payload: m
-		}), d);
-	} catch (e) {
-		return s(500, {
-			error: "workflow start failed",
-			message: e?.message ?? String(e)
-		}, d);
-	}
-}, F = async (e, t, n, i = {}) => {
-	let o = _(e);
-	if (!o.startsWith("/_voltro/inspect/schedules")) return null;
-	let c = l(n.origin ?? n.Origin);
-	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, c);
-	let u = (i.authResolver ?? a)(n, i.method ?? "POST");
-	if (!u.ok) return s(401, {
-		error: "unauthorized",
-		reason: u.reason
-	}, c);
-	let f = d(i.method, n, c);
-	if (f) return f;
-	if (t.kind !== "api") return s(404, { error: "schedules are api-only" }, c);
-	let p = (i.method ?? "GET").toUpperCase(), m = o.match(/^\/_voltro\/inspect\/schedules\/([^/]+)\/backfill$/);
-	if (m) {
-		if (p !== "POST") return s(405, {
-			error: "method not allowed",
-			expected: "POST"
-		}, c);
-		if (!t.inspectBackfillSchedule) return s(404, { error: "inspectBackfillSchedule not configured" }, c);
-		let e = decodeURIComponent(m[1] ?? ""), n;
-		try {
-			n = JSON.parse(i.body ?? "{}");
-		} catch {
-			return s(400, { error: "invalid JSON body — expected { from, to, confirm?, limit? }" }, c);
-		}
-		if (typeof n.from != "string" || typeof n.to != "string") return s(400, { error: "body must carry ISO 'from' and 'to' instants" }, c);
-		try {
-			let r = await t.inspectBackfillSchedule({
-				name: e,
-				from: n.from,
-				to: n.to,
-				confirm: n.confirm === !0,
-				...typeof n.limit == "number" ? { limit: n.limit } : {}
-			});
-			return s(r.kind === "refused" ? 409 : 200, r, c);
-		} catch (e) {
-			return s(500, {
-				error: "backfill failed",
-				message: e?.message ?? String(e)
-			}, c);
-		}
-	}
-	let h = o.match(/^\/_voltro\/inspect\/schedules\/([^/]+)\/fire$/);
-	if (h) {
-		if (p !== "POST") return s(405, {
-			error: "method not allowed",
-			expected: "POST"
-		}, c);
-		if (!t.inspectFireSchedule) return s(404, { error: "inspectFireSchedule not configured" }, c);
-		let n = decodeURIComponent(h[1] ?? ""), r = A(e).get("trigger") === "external" ? "external" : "manual";
-		try {
-			return s(200, await t.inspectFireSchedule({
-				name: n,
-				trigger: r
-			}), c);
-		} catch (e) {
-			return s(500, {
-				error: "fire failed",
-				message: e?.message ?? String(e)
-			}, c);
-		}
-	}
-	if (o === "/_voltro/inspect/schedules/runs") {
-		if (p !== "GET") return s(405, {
-			error: "method not allowed",
-			expected: "GET"
-		}, c);
-		if (!t.inspectScheduleRuns) return s(200, {
-			runs: [],
-			total: 0,
-			offset: 0,
-			limit: 50
-		}, c);
-		let n = A(e);
-		try {
-			return s(200, await t.inspectScheduleRuns({
-				...n.get("name") === null ? {} : { name: n.get("name") },
-				offset: j(n.get("offset")) ?? 0,
-				limit: j(n.get("limit")) ?? 50
-			}), c);
-		} catch (e) {
-			return s(500, {
-				error: "schedule-runs query failed",
-				message: e?.message ?? String(e)
-			}, c);
-		}
-	}
-	return o === "/_voltro/inspect/schedules" ? p === "GET" ? t.inspectSchedules ? s(200, t.inspectSchedules(), c) : s(200, {
-		schedules: [],
-		coordination: "single"
-	}, c) : s(405, {
-		error: "method not allowed",
-		expected: "GET"
-	}, c) : s(404, {
-		error: "unknown schedules endpoint",
-		path: o
-	}, c);
-}, I = async (e, t, n, i = {}) => {
-	if (_(e) !== "/_voltro/inspect/cluster") return null;
-	let o = l(n.origin ?? n.Origin);
-	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, o);
-	let c = (i.authResolver ?? a)(n, i.method ?? "POST");
-	if (!c.ok) return s(401, {
-		error: "unauthorized",
-		reason: c.reason
-	}, o);
-	let u = d(i.method, n, o);
-	if (u) return u;
-	if (t.kind !== "api") return s(404, { error: "cluster is api-only" }, o);
-	if ((i.method ?? "GET").toUpperCase() !== "GET") return s(405, {
-		error: "method not allowed",
-		expected: "GET"
-	}, o);
-	if (!t.cluster) return s(200, {
-		instance: {
-			replicaId: process.env.POD_NAME ?? process.env.HOSTNAME ?? `dev-${process.pid}`,
-			dialect: "memory",
-			runnerHost: "localhost",
-			runnerPort: 0,
-			runnerStorage: "none",
-			shardLock: "none",
-			coordination: "single",
-			cdc: {
-				enabled: !1,
-				flavor: "none (single-process)"
-			},
-			tier: "none",
-			localhostRisk: !1
-		},
-		coordinationState: {
-			recentReplicaIds: [],
-			scheduleClaims: [],
-			runningScheduleRuns: 0,
-			runningWorkflowRuns: 0
-		},
-		capturedAt: Date.now()
-	}, o);
-	try {
-		return s(200, await t.cluster(), o);
-	} catch (e) {
-		return s(500, {
-			error: "cluster snapshot failed",
-			message: e?.message ?? String(e)
-		}, o);
-	}
-}, L = async (e, t, n, i = {}) => {
-	let o = _(e).match(/^\/_voltro\/inspect\/workflows\/runs\/([^/]+)\/steps$/);
-	if (!o) return null;
-	let c = decodeURIComponent(o[1] ?? ""), u = l(n.origin ?? n.Origin), d = (i.method ?? "GET").toUpperCase();
-	if (d !== "GET") return s(405, {
-		error: "method not allowed",
-		expected: "GET"
-	}, u);
-	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, u);
-	let f = (i.authResolver ?? a)(n, d);
-	if (!f.ok) return s(401, {
-		error: "unauthorized",
-		reason: f.reason
-	}, u);
-	if (t.kind !== "api") return s(404, { error: "workflow steps are api-only" }, u);
-	if (t.inspectWorkflowRunSteps === void 0) return s(200, { steps: [] }, u);
-	try {
-		return s(200, await t.inspectWorkflowRunSteps({ runId: c }), u);
-	} catch (e) {
-		return s(500, {
-			error: "steps query failed",
-			message: e?.message ?? String(e)
-		}, u);
-	}
-}, R = async (e, t, n, i = {}) => {
-	let o = _(e).match(/^\/_voltro\/inspect\/workflows\/runs\/([^/]+)\/events$/);
-	if (!o) return null;
-	let c = decodeURIComponent(o[1] ?? ""), u = l(n.origin ?? n.Origin), d = (i.method ?? "GET").toUpperCase();
-	if (d !== "GET") return s(405, {
-		error: "method not allowed",
-		expected: "GET"
-	}, u);
-	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, u);
-	let f = (i.authResolver ?? a)(n, d);
-	if (!f.ok) return s(401, {
-		error: "unauthorized",
-		reason: f.reason
-	}, u);
-	if (t.kind !== "api") return s(404, { error: "workflow events are api-only" }, u);
-	if (t.inspectWorkflowRunEvents === void 0) return s(200, { events: [] }, u);
-	try {
-		return s(200, await t.inspectWorkflowRunEvents({ runId: c }), u);
-	} catch (e) {
-		return s(500, {
-			error: "events query failed",
-			message: e?.message ?? String(e)
-		}, u);
-	}
-}, z = async (e, t, n, i = {}) => {
-	if (_(t) !== "/_voltro/inspect/workflows/events") return null;
-	let o = l(n.origin ?? n.Origin), c = (i.method ?? "GET").toUpperCase();
-	if (c !== "GET") return s(405, {
-		error: "method not allowed",
-		expected: "GET"
-	}, o);
-	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, o);
-	let u = (i.authResolver ?? a)(n, c);
-	if (!u.ok) return s(401, {
-		error: "unauthorized",
-		reason: u.reason
-	}, o);
-	if (e.kind !== "api") return s(404, { error: "workflow domain events are api-only" }, o);
-	if (e.inspectWorkflowDomainEvents === void 0) return s(200, {
-		events: [],
-		total: 0,
-		offset: 0,
-		limit: 100
-	}, o);
-	let d = v(t), f = d.get("name") ?? void 0, p = Number(d.get("offset") ?? "0"), m = Number(d.get("limit") ?? "100");
-	try {
-		return s(200, await e.inspectWorkflowDomainEvents({
-			...f !== void 0 && f !== "" ? { name: f } : {},
-			offset: Number.isFinite(p) ? p : 0,
-			limit: Number.isFinite(m) ? m : 100
-		}), o);
-	} catch (e) {
-		return s(500, {
-			error: "workflow domain events query failed",
-			message: e?.message ?? String(e)
-		}, o);
-	}
-}, B = async (e, t, n, i = {}) => {
-	let o = _(t).match(/^\/_voltro\/inspect\/workflows\/events\/([^/]+)\/deliveries$/);
-	if (!o) return null;
-	let c = decodeURIComponent(o[1] ?? ""), u = l(n.origin ?? n.Origin), d = (i.method ?? "GET").toUpperCase();
-	if (d !== "GET") return s(405, {
-		error: "method not allowed",
-		expected: "GET"
-	}, u);
-	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, u);
-	let f = (i.authResolver ?? a)(n, d);
-	if (!f.ok) return s(401, {
-		error: "unauthorized",
-		reason: f.reason
-	}, u);
-	if (e.kind !== "api") return s(404, { error: "workflow event deliveries are api-only" }, u);
-	if (e.inspectWorkflowEventDeliveries === void 0) return s(200, { deliveries: [] }, u);
-	try {
-		return s(200, await e.inspectWorkflowEventDeliveries({ eventId: c }), u);
-	} catch (e) {
-		return s(500, {
-			error: "workflow event deliveries query failed",
-			message: e?.message ?? String(e)
-		}, u);
-	}
-}, V = async (e, t, n, i = {}) => {
-	if (_(e) !== "/_voltro/inspect/workflows/children") return null;
-	let o = l(n.origin ?? n.Origin), c = (i.method ?? "GET").toUpperCase();
-	if (c !== "GET") return s(405, {
-		error: "method not allowed",
-		expected: "GET"
-	}, o);
-	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, o);
-	let u = (i.authResolver ?? a)(n, c);
-	if (!u.ok) return s(401, {
-		error: "unauthorized",
-		reason: u.reason
-	}, o);
-	if (t.kind !== "api") return s(404, { error: "workflow children are api-only" }, o);
-	let d = A(e).get("parentExecutionId");
-	if (d === null || d === "") return s(400, { error: "parentExecutionId query param required" }, o);
-	if (t.inspectWorkflowChildren === void 0) return s(200, {
-		runs: [],
-		total: 0,
-		offset: 0,
-		limit: 200
-	}, o);
-	try {
-		return s(200, await t.inspectWorkflowChildren({ parentExecutionId: d }), o);
-	} catch (e) {
-		return s(500, {
-			error: "children query failed",
-			message: e?.message ?? String(e)
-		}, o);
-	}
-}, H = async (e, t, n, i, o = {}) => {
-	let c = _(e).match(/^\/_voltro\/inspect\/workflows\/runs\/([^/]+)\/(cancel|retry|suspend|resume-from-step|resume|signal|update|discard|redrive)$/);
-	if (!c) return null;
-	let u = decodeURIComponent(c[1] ?? ""), d = c[2], f = l(n.origin ?? n.Origin), p = (o.method ?? "POST").toUpperCase();
-	if (p !== "POST") return s(405, {
-		error: "method not allowed",
-		expected: "POST"
-	}, f);
-	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, f);
-	let m = (o.authResolver ?? a)(n, p);
-	if (!m.ok) return s(401, {
-		error: "unauthorized",
-		reason: m.reason
-	}, f);
-	if (t.kind !== "api") return s(404, { error: "workflow actions are api-only" }, f);
-	let h = {
-		cancel: t.inspectCancelWorkflowRun,
-		retry: t.inspectRetryWorkflowRun,
-		suspend: t.inspectSuspendWorkflowRun,
-		resume: t.inspectResumeWorkflowRun,
-		signal: t.inspectSignalWorkflowRun,
-		update: t.inspectUpdateWorkflowRun,
-		discard: t.inspectDiscardWorkflowRun,
-		redrive: t.inspectRedriveWorkflowRun,
-		"resume-from-step": t.inspectResumeWorkflowRunFromStep
-	}[d];
-	if (!h) return s(404, { error: d === "resume-from-step" ? "inspectResumeWorkflowRunFromStep not configured" : `inspect${d[0]?.toUpperCase() ?? ""}${d.slice(1)}WorkflowRun not configured` }, f);
-	let g, v, y, b, x, S, C;
-	if (i.length > 0) try {
-		let e = JSON.parse(i);
-		d === "retry" && (g = e.payloadOverride), d === "resume-from-step" && typeof e.step == "string" && e.step.length > 0 && (C = e.step), d === "signal" && (typeof e.signalName == "string" && e.signalName.length > 0 && (v = e.signalName), y = e.payload), d === "update" && (typeof e.updateName == "string" && e.updateName.length > 0 && (b = e.updateName), x = e.payload, typeof e.timeoutMs == "number" && Number.isFinite(e.timeoutMs) && (S = e.timeoutMs));
-	} catch {}
-	if (d === "signal" && v === void 0) return s(400, { error: "signal requires JSON body `{ signalName: string, payload?: unknown }`" }, f);
-	if (d === "update" && b === void 0) return s(400, { error: "update requires JSON body `{ updateName: string, payload?: unknown, timeoutMs?: number }`" }, f);
-	if (d === "resume-from-step" && C === void 0) return s(400, { error: "resume-from-step requires JSON body `{ step: string }` (the step name to rewind to)" }, f);
-	try {
-		return s(200, d === "retry" && g !== void 0 ? await h({
-			runId: u,
-			payloadOverride: g
-		}) : d === "signal" ? await h({
-			runId: u,
-			signalName: v,
-			payload: y
-		}) : d === "update" ? await h({
-			runId: u,
-			updateName: b,
-			payload: x,
-			...S === void 0 ? {} : { timeoutMs: S }
-		}) : d === "resume-from-step" ? await h({
-			runId: u,
-			step: C
-		}) : await h({ runId: u }), f);
-	} catch (e) {
-		return s(500, {
-			error: `${d} failed`,
-			message: e?.message ?? String(e)
-		}, f);
-	}
-}, U = async (e, t, n, i, o = {}) => {
-	if (_(e) !== "/_voltro/inspect/data/import" || (o.method ?? "POST").toUpperCase() !== "POST") return null;
-	let c = l(n.origin ?? n.Origin);
-	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, c);
-	let u = (o.authResolver ?? a)(n, "POST");
-	if (!u.ok) return s(401, {
-		error: "unauthorized",
-		reason: u.reason
-	}, c);
-	let f = d(o.method, n, c);
-	if (f) return f;
-	if (t.kind !== "api") return s(404, { error: "data import is api-only" }, c);
-	if (!t.inspectImport) return s(404, { error: "inspectImport not configured" }, c);
-	let p;
-	try {
-		p = JSON.parse(i || "{}");
-	} catch {
-		return s(400, { error: "body must be JSON" }, c);
-	}
-	if (typeof p.bundleDir != "string" || !p.bundleDir) return s(400, { error: "body.bundleDir (string) is required" }, c);
-	try {
-		return s(200, await t.inspectImport({
-			bundleDir: p.bundleDir,
-			...p.mode === "upsert" || p.mode === "append" || p.mode === "replace" ? { mode: p.mode } : {},
-			...p.onConflict === "skip" || p.onConflict === "fail" ? { onConflict: p.onConflict } : {},
-			...typeof p.atomic == "boolean" ? { atomic: p.atomic } : {}
-		}), c);
-	} catch (e) {
-		return s(500, {
-			error: "import failed",
-			message: e?.message ?? String(e)
-		}, c);
-	}
-}, W = async (e, t, n, i, o = {}) => {
-	let c = _(e);
-	if (!c.startsWith("/_voltro/inspect/data/rows")) return null;
-	let u = (o.method ?? "POST").toUpperCase();
-	if (u === "GET" && c === "/_voltro/inspect/data/rows") return null;
-	let d = l(n.origin ?? n.Origin);
-	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, d);
-	let f = (o.authResolver ?? a)(n, u);
-	if (!f.ok) return s(401, {
-		error: "unauthorized",
-		reason: f.reason
-	}, d);
-	if (t.kind !== "api") return s(404, { error: "data viewer is api-only" }, d);
-	if (u === "POST" && c === "/_voltro/inspect/data/rows") {
-		if (!t.inspectInsertRow) return s(404, { error: "inspectInsertRow not configured" }, d);
-		let e;
-		try {
-			e = JSON.parse(i || "{}");
-		} catch {
-			return s(400, { error: "body must be JSON" }, d);
-		}
-		if (typeof e.table != "string" || !e.row || typeof e.row != "object") return s(400, { error: "body must be { table: string, row: object }" }, d);
-		try {
-			return s(200, await t.inspectInsertRow({
-				table: e.table,
-				row: e.row
-			}), d);
-		} catch (e) {
-			return s(500, {
-				error: "insert failed",
-				message: e?.message ?? String(e)
-			}, d);
-		}
-	}
-	let p = c.match(/^\/_voltro\/inspect\/data\/rows\/([^/]+)$/);
-	if (!p) return null;
-	let m = decodeURIComponent(p[1] ?? "");
-	if (!m) return s(400, { error: "row id is required in URL" }, d);
-	let h = A(e).get("table") ?? "";
-	if (!h) return s(400, { error: "query.table is required" }, d);
-	if (u === "PATCH") {
-		if (!t.inspectUpdateRow) return s(404, { error: "inspectUpdateRow not configured" }, d);
-		let e;
-		try {
-			e = JSON.parse(i || "{}");
-		} catch {
-			return s(400, { error: "body must be JSON" }, d);
-		}
-		if (!e.patch || typeof e.patch != "object") return s(400, { error: "body.patch must be an object" }, d);
-		try {
-			return s(200, await t.inspectUpdateRow({
-				table: h,
-				id: m,
-				patch: e.patch
-			}), d);
-		} catch (e) {
-			return s(500, {
-				error: "update failed",
-				message: e?.message ?? String(e)
-			}, d);
-		}
-	}
-	if (u === "DELETE") {
-		if (!t.inspectDeleteRow) return s(404, { error: "inspectDeleteRow not configured" }, d);
-		try {
-			return s(200, await t.inspectDeleteRow({
-				table: h,
-				id: m
-			}), d);
-		} catch (e) {
-			return s(500, {
-				error: "delete failed",
-				message: e?.message ?? String(e)
-			}, d);
-		}
-	}
-	return s(405, {
-		error: "method not allowed",
-		expected: "POST | PATCH | DELETE"
-	}, d);
-}, G = async (e, t, i, o, c = {}) => {
-	let u = _(e), d = `${n}/workflows/flow-control`;
-	if (u !== d && !u.startsWith(`${d}/`)) return null;
-	let f = l(i.origin ?? i.Origin), p = (c.method ?? "GET").toUpperCase();
-	if (r()) return s(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, f);
-	let m = (c.authResolver ?? a)(i, p);
-	if (!m.ok) return s(401, {
-		error: "unauthorized",
-		reason: m.reason
-	}, f);
-	if (t.kind !== "api") return s(404, { error: "flow control is api-only" }, f);
-	if (u === `${d}/inferences`) {
-		if (p !== "GET") return s(405, {
-			error: "method not allowed",
-			expected: "GET"
-		}, f);
-		if (t.inspectInferences === void 0) return s(404, { error: "inspectInferences not configured" }, f);
-		let n = A(e).get("limit"), r = n === null ? void 0 : Number(n);
-		try {
-			return s(200, await t.inspectInferences(r !== void 0 && Number.isFinite(r) ? { limit: r } : {}), f);
-		} catch (e) {
-			return s(500, {
-				error: "inference queue read failed",
-				message: e?.message ?? String(e)
-			}, f);
-		}
-	}
-	if (u === d) {
-		if (p !== "GET") return s(405, {
-			error: "method not allowed",
-			expected: "GET"
-		}, f);
-		if (t.inspectFlowControl === void 0) return s(404, { error: "inspectFlowControl not configured" }, f);
-		let n = A(e).get("limit"), r = n === null ? void 0 : Number(n);
-		try {
-			return s(200, await t.inspectFlowControl(r !== void 0 && Number.isFinite(r) ? { limit: r } : {}), f);
-		} catch (e) {
-			return s(500, {
-				error: "flow control read failed",
-				message: e?.message ?? String(e)
-			}, f);
-		}
-	}
-	if (p !== "POST") return s(405, {
-		error: "method not allowed",
-		expected: "POST"
-	}, f);
-	let h = {};
-	if (o.length > 0) try {
-		h = JSON.parse(o);
-	} catch {
-		return s(400, { error: "expected a JSON body" }, f);
-	}
-	let g = u.slice(d.length + 1);
-	try {
-		if (g === "pause") return t.inspectPauseWorkflow === void 0 ? s(404, { error: "inspectPauseWorkflow not configured" }, f) : h.workflow ? s(200, await t.inspectPauseWorkflow({
-			workflow: h.workflow,
-			...h.reason === void 0 ? {} : { reason: h.reason }
-		}), f) : s(400, { error: "body.workflow is required" }, f);
-		if (g === "resume") return t.inspectResumeWorkflow === void 0 ? s(404, { error: "inspectResumeWorkflow not configured" }, f) : h.workflow ? s(200, await t.inspectResumeWorkflow({ workflow: h.workflow }), f) : s(400, { error: "body.workflow is required" }, f);
-		if (g === "discard") return t.inspectDiscardIntent === void 0 ? s(404, { error: "inspectDiscardIntent not configured" }, f) : h.intentId ? s(200, await t.inspectDiscardIntent({ intentId: h.intentId }), f) : s(400, { error: "body.intentId is required" }, f);
-		if (g === "bulk") {
-			if (t.inspectBulkWorkflowRuns === void 0) return s(404, { error: "inspectBulkWorkflowRuns not configured" }, f);
-			if (h.op !== "cancel" && h.op !== "replay") return s(400, { error: "body.op must be 'cancel' or 'replay'" }, f);
-			if (typeof h.limit != "number") return s(400, { error: "body.limit is required — a bulk operation has no unbounded form, the cap IS the blast radius. The response reports `truncated` when more matched." }, f);
-			try {
-				return s(200, await t.inspectBulkWorkflowRuns({
-					op: h.op,
-					limit: h.limit,
-					...h.reason === void 0 ? {} : { reason: h.reason },
-					...h.mode === void 0 ? {} : { mode: h.mode },
-					...h.dryRun === void 0 ? {} : { dryRun: h.dryRun },
-					...h.workflow === void 0 ? {} : { workflow: h.workflow },
-					...h.status === void 0 ? {} : { status: h.status },
-					...h.startedAfter === void 0 ? {} : { startedAfter: h.startedAfter },
-					...h.startedBefore === void 0 ? {} : { startedBefore: h.startedBefore }
-				}), f);
-			} catch (e) {
-				if (e?.name === "BulkRequestError") return s(400, { error: e.message }, f);
-				throw e;
-			}
-		}
-	} catch (e) {
-		return s(500, {
-			error: "flow control action failed",
-			message: e?.message ?? String(e)
-		}, f);
-	}
-	return s(404, {
-		error: `unknown flow-control action '${g}'`,
-		expected: [
-			"pause",
-			"resume",
-			"discard",
-			"bulk"
-		]
-	}, f);
-};
-//#endregion
-export { r as A, N as C, l as D, P as E, f as M, g as N, h as O, o as P, R as S, M as T, E as _, a, z as b, U as c, G as d, D as f, F as g, S as h, d as i, c as j, u as k, O as l, k as m, b as n, T as o, w as p, x as r, I as s, n as t, W as u, H as v, L as w, B as x, V as y };