@voltro/cli 0.54.0 → 0.56.0

package/dist/inspect-CNYvNXPU.js

@@ -0,0 +1,1484 @@
+import { n as e } from "./inspectGateHint-4LxkNtrz.js";
+import { processIdentity as t, replicaId as n } from "@voltro/protocol/identity";
+import { lastWriteProvenance as r } from "@voltro/runtime";
+import { timingSafeStringEqual as i } from "@voltro/protocol/session";
+//#region src/observation.ts
+var a = (e) => ({
+	replicaId: e.replicaId,
+	instanceId: e.instanceId,
+	startedAt: e.startedAt,
+	version: e.version,
+	bootPath: e.bootPath
+}), o = (e) => e === void 0 ? {
+	complete: !1,
+	reason: "process-scoped, and membership could not say how many replicas exist"
+} : e <= 1 ? {
+	complete: !0,
+	fleetSize: e
+} : {
+	complete: !1,
+	fleetSize: e,
+	reason: `process-scoped: this is 1 of ${e} replicas`
+}, s = () => ({ complete: !0 }), c = () => ({ complete: !0 }), l = [
+	["", "declaration"],
+	["/", "declaration"],
+	["/app", "declaration"],
+	["/routes", "declaration"],
+	["/manifest", "declaration"],
+	["/rpc", "declaration"],
+	["/env", "declaration"],
+	["/checks", "declaration"],
+	["/agent/tools", "declaration"],
+	["/subscriptions", "process"],
+	["/metrics", "process"],
+	["/logs", "process"],
+	["/cache", "process"],
+	["/data-cache", "process"],
+	["/events", "process"],
+	["/traces", "process"],
+	["/aggregates", "process"],
+	["/flags", "process"],
+	["/cluster", "process"],
+	["/members", "observed-fleet"],
+	["/schedules", "shared-store"],
+	["/schedules/runs", "shared-store"],
+	["/workflows", "shared-store"],
+	["/migrations", "shared-store"],
+	["/database", "shared-store"],
+	["/data/tables", "shared-store"],
+	["/data/rows", "shared-store"],
+	["/provenance", "shared-store"],
+	["/storage", "shared-store"],
+	["/webhooks", "shared-store"],
+	["/plugins", "shared-store"],
+	["/invoke", "write"],
+	["/seeds/run", "write"],
+	["/data/import", "write"],
+	["/migrations/rollback", "write"],
+	["/migrations/squash", "write"],
+	["/migrations/restore-snapshot", "write"],
+	["/migrations/compare-env", "write"],
+	["/webhooks/", "write"],
+	["/agent/call", "write"]
+], u = (e) => {
+	let t;
+	for (let n of l) {
+		let [r] = n;
+		(e === r || r.length > 0 && r !== "/" && (e.startsWith(`${r}/`) || e.startsWith(r))) && (t === void 0 || r.length > t[0].length) && (t = n);
+	}
+	return t?.[1];
+}, d = "voltro-inspect-hop", f = (e, t) => {
+	let [n, r = ""] = e.split("?"), i = new URLSearchParams(r);
+	i.delete("replica"), i.set("scope", "process");
+	let a = i.toString();
+	return `http://${t}${n}${a === "" ? "" : `?${a}`}`;
+}, p = async (e) => {
+	let t = (e.url.split("?")[0] ?? e.url).replace(/^.*\/_voltro\/inspect/, ""), n = u(t);
+	if (n === "write") return {
+		kind: "refused",
+		status: 400,
+		body: {
+			error: "a mutating endpoint cannot be addressed to a replica",
+			reason: "choosing which replica runs a destructive operation is not something a query parameter should hand out; call the replica directly if that is genuinely what you mean"
+		}
+	};
+	if (n === void 0) return {
+		kind: "refused",
+		status: 404,
+		body: {
+			error: "inspect route has no declared scope",
+			path: t
+		}
+	};
+	let r = await e.lookup.addressOf(e.replicaId);
+	if (r === void 0) return {
+		kind: "refused",
+		status: 404,
+		body: {
+			error: `no reachable replica named ${JSON.stringify(e.replicaId)}`,
+			reason: "the id is unknown, or that replica published no address a peer can reach (a loopback address is recorded as unreachable rather than attempted)",
+			fix: "read `/_voltro/inspect/subscriptions?scope=fleet` for the replicas that can be addressed"
+		}
+	};
+	let i = new AbortController(), a = setTimeout(() => i.abort(), e.timeoutMs ?? 3e3);
+	try {
+		let t = await (e.fetchImpl ?? fetch)(f(e.url, r), {
+			headers: {
+				...e.authorization === void 0 ? {} : { authorization: e.authorization },
+				[d]: "1",
+				accept: "application/json"
+			},
+			signal: i.signal
+		});
+		return {
+			kind: "answered",
+			status: t.status,
+			body: await t.text()
+		};
+	} catch (t) {
+		return {
+			kind: "refused",
+			status: 504,
+			body: {
+				error: `replica ${JSON.stringify(e.replicaId)} did not answer`,
+				reason: String(t?.message ?? t)
+			}
+		};
+	} finally {
+		clearTimeout(a);
+	}
+}, m = "/_voltro/inspect", h = () => process.env.VOLTRO_INSPECT === "off", g = /* @__PURE__ */ new Set([
+	"GET",
+	"HEAD",
+	"OPTIONS"
+]), _ = (t, n) => {
+	let r = process.env.VOLTRO_INSPECT_TOKEN;
+	if (!r || r.length === 0) return {
+		ok: !1,
+		reason: "inspect is closed: no VOLTRO_INSPECT_TOKEN configured. `voltro dev` mints one per project; for serve/start set it explicitly (it is never minted outside dev)."
+	};
+	let a = t.authorization ?? t.Authorization;
+	if (!a) return {
+		ok: !1,
+		reason: "missing Authorization header"
+	};
+	if (!a.startsWith("Bearer ")) return {
+		ok: !1,
+		reason: "expected \"Bearer <token>\" auth scheme"
+	};
+	let o = a.slice(7).trim();
+	if (!i(o, r)) return {
+		ok: !1,
+		reason: "token mismatch"
+	};
+	if (!g.has(n.toUpperCase())) {
+		let r = process.env.VOLTRO_INSPECT_WRITE_TOKEN;
+		if (!r || r.length === 0) return {
+			ok: !1,
+			reason: e("unset", n)
+		};
+		let a = (t["x-voltro-inspect-write"] ?? t["X-Voltro-Inspect-Write"] ?? "").trim();
+		if (a.length === 0) return {
+			ok: !1,
+			reason: e("absent", n)
+		};
+		if (!i(a, r)) return {
+			ok: !1,
+			reason: e("mismatch", n)
+		};
+	}
+	return { ok: !0 };
+}, v = (e) => {
+	if (!Array.isArray(e) || e.length === 0) return;
+	let t = [];
+	for (let n of e) {
+		if (typeof n != "object" || !n) continue;
+		if (typeof n.open == "string") {
+			t.push({
+				kind: "open",
+				reason: n.open
+			});
+			continue;
+		}
+		if (typeof n.action == "string" && typeof n.resourceType == "string") {
+			t.push({
+				kind: "policy",
+				action: n.action,
+				resourceType: n.resourceType
+			});
+			continue;
+		}
+		let e = n.scope;
+		typeof e != "string" && !Array.isArray(e) || t.push({
+			kind: "scope",
+			scope: typeof e == "string" ? [e] : e.filter((e) => typeof e == "string"),
+			mode: n.mode === "any" ? "any" : "all",
+			resourceScoped: typeof n.resource == "function"
+		});
+	}
+	return t.length > 0 ? t : void 0;
+}, y = (e, t, n = {}) => ({
+	status: e,
+	contentType: "application/json; charset=utf-8",
+	body: JSON.stringify(t),
+	headers: n,
+	payload: t
+}), b = (e) => {
+	let t;
+	try {
+		t = new URL(e).hostname;
+	} catch {
+		return !1;
+	}
+	return t = t.replace(/^\[|\]$/g, ""), t === "localhost" || t.endsWith(".localhost") || t === "::1" ? !0 : /^127(?:\.\d{1,3}){3}$/.test(t);
+}, x = (e) => !e || e.length === 0 ? {} : b(e) ? {
+	"access-control-allow-origin": e,
+	"access-control-allow-credentials": "true",
+	"access-control-allow-methods": "GET, POST, OPTIONS",
+	"access-control-allow-headers": "authorization, content-type, accept",
+	"access-control-expose-headers": "content-type, content-length",
+	vary: "Origin"
+} : { vary: "Origin" }, S = "voltro_devtools_stream_token", C = (e, t, n = process.env) => {
+	let r = (e) => Array.isArray(e) ? e[0] : e, i = r(e.authorization);
+	if (i !== void 0 && i !== "") return i;
+	let a = r(e.cookie);
+	if (a !== void 0) for (let e of a.split(";")) {
+		let [t, ...n] = e.trim().split("=");
+		if (t === "voltro_devtools_stream_token" && n.length > 0) {
+			let e = decodeURIComponent(n.join("="));
+			if (e !== "") return `Bearer ${e}`;
+		}
+	}
+	let o = n.VOLTRO_INSPECT_TOKEN;
+	return b(t) && o !== void 0 && o !== "" ? `Bearer ${o}` : void 0;
+}, w = (e, t = process.env.VOLTRO_DASHBOARD_APPS) => {
+	if (b(e)) return !0;
+	let n;
+	try {
+		n = new URL(e).origin;
+	} catch {
+		return !1;
+	}
+	if (!t || t.trim() === "") return !1;
+	try {
+		let e = JSON.parse(t);
+		return Array.isArray(e) ? e.some((e) => {
+			let t = e?.url;
+			if (typeof t != "string") return !1;
+			try {
+				return new URL(t).origin === n;
+			} catch {
+				return !1;
+			}
+		}) : !1;
+	} catch {
+		return !1;
+	}
+}, T = (e, t, n = {}) => {
+	let r = (e ?? "GET").toUpperCase();
+	if (r === "GET" || r === "HEAD" || r === "OPTIONS") return null;
+	let i = t.origin ?? t.Origin;
+	return i === void 0 || i === "" || b(i) ? null : y(403, {
+		error: "cross-site write rejected",
+		reason: `a state-changing inspect request may not come from origin "${i}" — only same-machine (loopback) origins may write`
+	}, n);
+}, E = (e = process.env.VOLTRO_INSPECT_ALLOWED_HOSTS) => (e ?? "").split(/[,\s]+/).map((e) => e.trim().toLowerCase()).filter((e) => e.length > 0), D = (e) => {
+	if (e === void 0) return "";
+	let t = e.trim();
+	if (t === "") return "";
+	if (t.startsWith("[")) {
+		let e = t.indexOf("]");
+		return (e === -1 ? t.slice(1) : t.slice(1, e)).toLowerCase();
+	}
+	let n = t.indexOf(":");
+	return (n === -1 ? t : t.slice(0, n)).toLowerCase();
+}, O = (e) => /^\d{1,3}(?:\.\d{1,3}){3}$/.test(e) || e.includes(":"), k = (e, t = E()) => {
+	let n = D(e);
+	return n === "" || n === "localhost" || n.endsWith(".localhost") || O(n) ? !0 : t.includes(n);
+}, A = (e, t = {}, n) => k(e, n) ? null : y(403, {
+	error: "forbidden host",
+	reason: `the dev inspect surface refuses a request with Host "${e ?? ""}" — a DNS-rebinding guard. Only loopback names, IP literals, and hosts listed in VOLTRO_INSPECT_ALLOWED_HOSTS may reach it.`
+}, t), j = (e) => {
+	let t = e.indexOf("?");
+	return t === -1 ? e : e.slice(0, t);
+}, M = (e) => {
+	let t = e.indexOf("?");
+	return t === -1 ? new URLSearchParams() : new URLSearchParams(e.slice(t + 1));
+}, N = (e) => e === "/_voltro/inspect" || e.startsWith("/_voltro/inspect/"), P = [
+	"text",
+	"textarea",
+	"rich-text",
+	"number",
+	"checkbox",
+	"switch",
+	"select",
+	"radio",
+	"async-select",
+	"multi-select",
+	"date",
+	"datetime",
+	"daterange",
+	"file",
+	"hidden",
+	"array",
+	"reference",
+	"custom"
+], F = (e, t, n = [], r = []) => ({
+	version: 2,
+	scopes: [...new Set(r.flatMap((e) => e.declaredScopes ?? []))].sort(),
+	procedures: [...e].sort((e, t) => e.tag.localeCompare(t.tag)).map((e) => ({
+		tag: e.tag,
+		kind: e.kind,
+		...e.inputSchema === void 0 ? {} : { input: e.inputSchema },
+		...e.outputSchema === void 0 ? {} : { output: e.outputSchema },
+		...e.source === void 0 ? {} : { source: e.source },
+		...e.targets === void 0 ? {} : { targets: e.targets },
+		...e.guards === void 0 ? {} : { guards: e.guards },
+		...e.internal === !0 ? { internal: !0 } : {},
+		...e.publicApi === void 0 ? {} : { publicApi: e.publicApi },
+		...e.exposeAsTool === void 0 ? {} : { exposeAsTool: e.exposeAsTool }
+	})),
+	workflows: [...t].sort((e, t) => e.tag.localeCompare(t.tag)).map((e) => ({ name: e.tag })),
+	widgets: P,
+	tables: [...n].filter((e) => !e.isFrameworkTable).sort((e, t) => e.name.localeCompare(t.name)).map((e) => ({
+		name: e.name,
+		reactive: e.isReactive,
+		framework: e.isFrameworkTable,
+		editable: e.editable ?? !0,
+		...e.pkColumn === void 0 ? {} : { pkColumn: e.pkColumn },
+		columns: e.columns.map((e) => ({
+			name: e.name,
+			type: String(e.type),
+			nullable: e.nullable,
+			...e.referencesTable === void 0 ? {} : { refersTo: e.referencesTable },
+			...e.oneOf === void 0 ? {} : { enum: e.oneOf },
+			...e.serverOnly === !0 ? { serverOnly: !0 } : {},
+			...e.encrypted === !0 ? { encrypted: !0 } : {},
+			...e.sensitive === void 0 ? {} : { sensitive: e.sensitive }
+		}))
+	}))
+}), I = (e) => {
+	let t = String(e?.message ?? e);
+	return /no such table/i.test(t) || /relation ".*" does not exist/i.test(t) || /Table '.*' doesn't exist/i.test(t) || /Invalid object name/i.test(t) || /Failed to prepare statement/i.test(t);
+}, L = Symbol("inspect.parseFailed"), R = (e) => {
+	try {
+		return JSON.parse(e);
+	} catch {
+		return L;
+	}
+}, z = (e, n, r) => {
+	if (n.status < 200 || n.status >= 300 || !n.contentType.startsWith("application/json")) return n;
+	let i = e.startsWith("/_voltro/inspect") ? e.slice(16) : e, l = u(i);
+	if (l === void 0) return y(500, {
+		error: "inspect route has no declared scope",
+		path: i,
+		fix: "add it to ROUTE_SCOPES in packages/cli/src/observation.ts — a payload that does not say whether it describes this process or the fleet cannot be acted on."
+	}, n.headers ?? {});
+	if (l === "write") return n;
+	let d = t();
+	if (n.assembled !== void 0) {
+		let e = n.assembled, t = n.payload === void 0 ? R(n.body) : n.payload;
+		return t === L ? n : y(n.status, {
+			data: t,
+			scope: {
+				kind: "fleet",
+				assembledBy: d.replicaId,
+				assembledAt: Date.now()
+			},
+			origin: a(d),
+			completeness: {
+				complete: e.missing.length === 0 && e.stale.length === 0,
+				responded: e.responded,
+				expected: e.expected,
+				...e.missing.length > 0 ? { missing: e.missing } : {},
+				...e.stale.length > 0 ? { stale: e.stale } : {},
+				...e.versions === void 0 ? {} : { versions: e.versions },
+				...e.missing.length > 0 || e.stale.length > 0 ? { reason: [e.missing.length > 0 ? `${e.missing.length} replica(s) have written nothing readable` : "", e.stale.length > 0 ? `${e.stale.length} answer(s) are older than the freshness window` : ""].filter((e) => e !== "").join("; ") } : {}
+			},
+			capturedAt: Date.now()
+		}, n.headers ?? {});
+	}
+	let f = l === "process" ? { kind: "process" } : l === "shared-store" ? { kind: "shared-store" } : l === "declaration" ? { kind: "declaration" } : {
+		kind: "fleet",
+		assembledBy: d.replicaId,
+		assembledAt: Date.now()
+	}, p = l === "process" ? o(r) : l === "shared-store" ? s() : l === "declaration" ? c() : {
+		complete: !0,
+		...r === void 0 ? {} : { fleetSize: r },
+		reason: "one observer’s view: another replica may reach a different set, and that disagreement is the diagnostic rather than a fault to smooth over"
+	}, m = n.payload === void 0 ? R(n.body) : n.payload;
+	if (m === L) return n;
+	let h = {
+		data: m,
+		scope: f,
+		origin: a(d),
+		completeness: p,
+		capturedAt: Date.now()
+	};
+	return y(n.status, h, n.headers ?? {});
+}, B = (e, t, n = {}, r = {}) => {
+	let i = V(e, t, n, r);
+	return i === null ? null : z(j(e), i, r.fleetSize);
+}, V = (e, t, n = {}, r = {}) => {
+	let i = j(e);
+	if (!N(i)) return null;
+	let a = x(n.origin ?? n.Origin), o = (r.method ?? "GET").toUpperCase();
+	if (o === "OPTIONS") return {
+		status: 204,
+		contentType: "text/plain",
+		body: "",
+		headers: a
+	};
+	if (h()) return y(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, a);
+	let s = (r.authResolver ?? _)(n, o);
+	if (!s.ok) return y(401, {
+		error: "unauthorized",
+		reason: s.reason
+	}, a);
+	if (i === "/_voltro/inspect" || i === "/_voltro/inspect/" || i === "/_voltro/inspect/app") return y(200, {
+		kind: t.kind,
+		...t.meta
+	}, a);
+	if (i === "/_voltro/inspect/routes") return t.kind === "web" ? y(200, {
+		pages: t.routes,
+		dirs: t.dirs
+	}, a) : y(404, { error: "routes endpoint is web-only" }, a);
+	if (i === "/_voltro/inspect/cache") return t.kind === "web" ? y(200, t.cache(), a) : y(404, { error: "cache endpoint is web-only" }, a);
+	if (i === "/_voltro/inspect/rpc") return t.kind === "api" ? y(200, {
+		procedures: t.rpc,
+		workflows: t.workflows
+	}, a) : y(404, { error: "rpc endpoint is api-only" }, a);
+	if (i === "/_voltro/inspect/manifest") {
+		if (t.kind !== "api") return y(404, { error: "manifest endpoint is api-only" }, a);
+		let e = t.inspectTables?.().tables ?? [];
+		return y(200, F(t.rpc, t.workflows, e, t.plugins?.().plugins ?? []), a);
+	}
+	return i === "/_voltro/inspect/metrics" ? t.metrics === void 0 ? y(200, [], a) : y(200, t.metrics(), a) : i === "/_voltro/inspect/subscriptions" ? t.kind === "api" ? t.subscriptions === void 0 ? y(200, {
+		subscriptions: [],
+		matcherStats: [],
+		resume: [],
+		capturedAt: Date.now()
+	}, a) : y(200, t.subscriptions(), a) : y(404, { error: "subscriptions endpoint is api-only" }, a) : i === "/_voltro/inspect/members" ? t.kind === "api" ? t.members === void 0 ? y(200, {
+		members: [],
+		capturedAt: Date.now()
+	}, a) : y(200, t.members(), a) : y(404, { error: "members endpoint is api-only" }, a) : i === "/_voltro/inspect/events" ? t.kind === "api" ? t.events === void 0 ? y(200, {
+		declared: [],
+		routes: [],
+		origin: "",
+		capturedAt: Date.now(),
+		totals: {
+			routes: 0,
+			subscribers: 0,
+			buffered: 0
+		}
+	}, a) : y(200, t.events(), a) : y(404, { error: "events endpoint is api-only" }, a) : i === "/_voltro/inspect/data-cache" ? t.kind === "api" ? t.dataCache === void 0 ? y(200, {
+		backend: "memory",
+		engine: "memory",
+		driver: "resp",
+		hits: 0,
+		misses: 0,
+		hitRate: 0
+	}, a) : y(200, t.dataCache(), a) : y(404, { error: "data-cache endpoint is api-only" }, a) : i === "/_voltro/inspect/database" ? t.kind === "api" ? t.database === void 0 ? y(200, {
+		migrations: [],
+		seeds: [],
+		dialect: "memory",
+		replication: {
+			replicaCount: 0,
+			rywPolicy: "off",
+			rywStore: "memory",
+			region: null,
+			localityEnabled: !1
+		}
+	}, a) : y(200, t.database(), a) : y(404, { error: "database endpoint is api-only" }, a) : i === "/_voltro/inspect/plugins" ? t.kind === "api" ? t.plugins === void 0 ? y(200, {
+		plugins: [],
+		capturedAt: Date.now()
+	}, a) : y(200, t.plugins(), a) : y(404, { error: "plugins endpoint is api-only" }, a) : i === "/_voltro/inspect/env" ? t.env === void 0 ? y(200, {
+		app: t.meta.name ?? "app",
+		entries: [],
+		summary: {
+			total: 0,
+			set: 0,
+			missingRequired: 0
+		}
+	}, a) : y(200, t.env(), a) : i === "/_voltro/inspect/data/tables" ? t.kind === "api" ? t.inspectTables === void 0 ? y(200, { tables: [] }, a) : y(200, t.inspectTables(), a) : y(404, { error: "data viewer is api-only" }, a) : i === "/_voltro/inspect/invoke" ? y(404, { error: "invoke not enabled here — use POST handler" }, a) : H.has(i) ? y(404, {
+		error: "endpoint not mounted on this instance",
+		path: i,
+		reason: "This inspect endpoint is served by `voltro dev`. A production `voltro serve` does not mount it — the data behind it (the in-memory log ring, the span buffer, the dev route table) is not collected there. This is not a missing token: the same request with no token would be 401."
+	}, a) : y(404, {
+		error: "unknown inspect endpoint",
+		path: i
+	}, a);
+}, H = /* @__PURE__ */ new Set([
+	`${m}/logs`,
+	`${m}/traces`,
+	`${m}/workflows`,
+	`${m}/storage`,
+	`${m}/aggregates`,
+	`${m}/flags`
+]), U = async (e, t, n, r = {}) => {
+	let i = x(t.origin ?? t.Origin);
+	if (h()) return y(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, i);
+	let a = (r.method ?? "POST").toUpperCase();
+	if (a !== "POST") return y(405, {
+		error: "method not allowed",
+		expected: "POST"
+	}, i);
+	let o = (r.authResolver ?? _)(t, a);
+	if (!o.ok) return y(401, {
+		error: "unauthorized",
+		reason: o.reason
+	}, i);
+	if (e.kind !== "api") return y(404, { error: "invoke endpoint is api-only" }, i);
+	if (!e.invokers || e.invokers.size === 0) return y(404, { error: "invoke not configured" }, i);
+	let s;
+	try {
+		s = JSON.parse(n || "{}");
+	} catch {
+		return y(400, { error: "body must be JSON" }, i);
+	}
+	let c = s;
+	if (typeof c.tag != "string") return y(400, { error: "body.tag must be a string" }, i);
+	let l = e.invokers.get(c.tag);
+	if (!l) return y(404, {
+		error: "unknown tag",
+		tag: c.tag
+	}, i);
+	let u = typeof c.headers == "object" && c.headers !== null ? c.headers : {}, d = {};
+	for (let [e, n] of Object.entries(t)) d[e.toLowerCase()] = n;
+	for (let [e, t] of Object.entries(u)) {
+		let n = e.toLowerCase();
+		n !== "cookie" && (d[n] = t);
+	}
+	return y(200, await l(c.input, d), i);
+}, W = async (e, t, n, r = {}) => {
+	let i = /[?&]replica=([^&]+)/.exec(e)?.[1], a = n[d] !== void 0;
+	if (i !== void 0 && !a && t.kind === "api") {
+		let a = x(n.origin ?? n.Origin), o = (r.authResolver ?? _)(n, (r.method ?? "GET").toUpperCase());
+		if (!o.ok) return y(401, {
+			error: "unauthorized",
+			reason: o.reason
+		}, a);
+		if (t.peerAddress === void 0) return y(501, {
+			error: "this process cannot address another replica",
+			reason: "peer addresses are published into `_voltro_replica_observations`, which needs a shared store — a memory-store app is a single process by construction"
+		}, a);
+		let s = await p({
+			url: e,
+			replicaId: decodeURIComponent(i),
+			authorization: n.authorization ?? n.Authorization,
+			lookup: { addressOf: t.peerAddress }
+		});
+		return s.kind === "answered" ? {
+			status: s.status,
+			contentType: "application/json; charset=utf-8",
+			body: s.body,
+			headers: a
+		} : y(s.status, s.body, a);
+	}
+	let o = await G(e, t, n, r);
+	return o === null ? null : z(j(e), o, r.fleetSize);
+}, G = async (e, t, n, r = {}) => {
+	let i = j(e);
+	if (!N(i)) return null;
+	let a = /[?&]scope=fleet(?:&|$)/.test(e), o = i === "/_voltro/inspect/subscriptions" && a;
+	if (i !== "/_voltro/inspect/migrations" && !o || (r.method ?? "GET").toUpperCase() !== "GET") return null;
+	let s = x(n.origin ?? n.Origin);
+	if (h()) return y(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, s);
+	let c = (r.authResolver ?? _)(n, "GET");
+	if (!c.ok) return y(401, {
+		error: "unauthorized",
+		reason: c.reason
+	}, s);
+	if (t.kind !== "api") return y(404, { error: `${o ? "subscriptions" : "migrations"} endpoint is api-only` }, s);
+	if (o) {
+		if (t.fleetObservations === void 0) return y(501, {
+			error: "fleet-scoped subscriptions are not available on this process",
+			reason: "the app has no shared store to read other replicas’ observations from (a memory-store app is a single process by construction)",
+			fix: "omit `?scope=fleet` for this replica’s own answer"
+		}, s);
+		let e;
+		try {
+			e = await t.fleetObservations("resume");
+		} catch (e) {
+			return y(503, {
+				error: "the fleet view could not be read",
+				reason: String(e?.message ?? e),
+				fix: "run `voltro db apply` — the fleet view reads `_voltro_replica_observations`, which a database migrated before this version does not have yet"
+			}, s);
+		}
+		return {
+			...y(200, { resume: e.byReplica }, s),
+			assembled: {
+				responded: e.responded,
+				expected: e.expected,
+				missing: e.missing,
+				stale: e.stale,
+				versions: e.versions
+			}
+		};
+	}
+	return t.migrations === void 0 ? y(200, {
+		drift: {
+			isDrifted: !1,
+			liveFingerprint: "",
+			liveSnapshot: { tables: [] }
+		},
+		pending: null,
+		history: [],
+		softDropSnapshots: []
+	}, s) : y(200, await t.migrations(), s);
+}, K = async (e, t, n, r, i = {}) => {
+	let a = j(e);
+	if (!N(a) || !a.startsWith("/_voltro/inspect/webhooks/")) return null;
+	let o = x(n.origin ?? n.Origin);
+	if ((i.method ?? "POST").toUpperCase() !== "POST") return null;
+	if (h()) return y(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, o);
+	let s = (i.authResolver ?? _)(n, i.method ?? "POST");
+	if (!s.ok) return y(401, {
+		error: "unauthorized",
+		reason: s.reason
+	}, o);
+	let c = T(i.method, n, o);
+	if (c) return c;
+	if (t.kind !== "api") return y(404, { error: "webhook actions are api-only" }, o);
+	if (!t.webhookActions) return y(404, { error: "webhook actions not configured — is @voltro/plugin-webhooks active?" }, o);
+	let l;
+	try {
+		l = JSON.parse(r || "{}");
+	} catch {
+		return y(400, { error: "body must be JSON" }, o);
+	}
+	let u = a.slice(`${m}/webhooks/`.length);
+	try {
+		switch (u) {
+			case "subscribe": {
+				let e = l;
+				return typeof e.event != "string" || e.event.length === 0 ? y(400, { error: "event required" }, o) : typeof e.url != "string" || e.url.length === 0 ? y(400, { error: "url required" }, o) : y(200, await t.webhookActions.subscribe(e), o);
+			}
+			case "pause": {
+				let e = l.targetId;
+				return typeof e != "string" || e.length === 0 ? y(400, { error: "targetId required" }, o) : (await t.webhookActions.pause(e), y(200, { ok: !0 }, o));
+			}
+			case "resume": {
+				let e = l.targetId;
+				return typeof e != "string" || e.length === 0 ? y(400, { error: "targetId required" }, o) : (await t.webhookActions.resume(e), y(200, { ok: !0 }, o));
+			}
+			case "delete": {
+				let e = l.targetId;
+				return typeof e != "string" || e.length === 0 ? y(400, { error: "targetId required" }, o) : (await t.webhookActions.delete(e), y(200, { ok: !0 }, o));
+			}
+			case "rotateSecret": {
+				let e = l.targetId;
+				return typeof e != "string" || e.length === 0 ? y(400, { error: "targetId required" }, o) : y(200, await t.webhookActions.rotateSecret(e), o);
+			}
+			case "replay": {
+				let e = l.deliveryId;
+				return typeof e != "string" || e.length === 0 ? y(400, { error: "deliveryId required" }, o) : (await t.webhookActions.replay(e), y(200, { ok: !0 }, o));
+			}
+			case "repinVersion": {
+				let e = l.targetId, n = l.version;
+				return typeof e != "string" || e.length === 0 ? y(400, { error: "targetId required" }, o) : typeof n != "number" || !Number.isInteger(n) || n < 1 ? y(400, { error: "version must be a positive integer" }, o) : (await t.webhookActions.updateTargetPayloadVersion(e, n), y(200, { ok: !0 }, o));
+			}
+			default: return y(404, { error: `unknown webhook action: ${u}` }, o);
+		}
+	} catch (e) {
+		return y(500, {
+			error: "webhook action failed",
+			message: e?.message ?? String(e)
+		}, o);
+	}
+}, q = async (e, t, n, r, i = {}) => {
+	let a = j(e);
+	if (!N(a)) return null;
+	let o = x(n.origin ?? n.Origin), s = (i.method ?? "POST").toUpperCase();
+	if (s !== "POST") return null;
+	if (h()) return y(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, o);
+	let c = (i.authResolver ?? _)(n, s);
+	if (!c.ok) return y(401, {
+		error: "unauthorized",
+		reason: c.reason
+	}, o);
+	if (t.kind !== "api") return y(404, { error: "framework-action endpoints are api-only" }, o);
+	let l = `${m}/seeds/run`, u = `${m}/migrations/rollback`, d = `${m}/migrations/squash`, f = `${m}/migrations/restore-snapshot`;
+	if (a !== l && a !== u && a !== d && a !== f && a !== "/_voltro/inspect/migrations/compare-env") return null;
+	let p;
+	try {
+		p = JSON.parse(r || "{}");
+	} catch {
+		return y(400, { error: "body must be JSON" }, o);
+	}
+	try {
+		if (a === l) return typeof p.id != "string" || p.id.length === 0 ? y(400, { error: "body.id must be a non-empty string" }, o) : t.runSeed ? y(200, await t.runSeed(p.id), o) : y(404, { error: "runSeed not configured" }, o);
+		if (a === u) return typeof p.id != "string" || p.id.length === 0 ? y(400, { error: "body.id must be a non-empty string" }, o) : t.rollbackMigration ? y(200, await t.rollbackMigration(p.id), o) : y(404, { error: "rollbackMigration not configured" }, o);
+		if (a === d) {
+			if (typeof p.before != "string" || p.before.length === 0) return y(400, { error: "body.before must be a non-empty ISO date string" }, o);
+			if (!t.squashMigrationHistory) return y(404, { error: "squashMigrationHistory not configured" }, o);
+			let e = typeof p.note == "string" ? p.note : void 0;
+			return y(200, await t.squashMigrationHistory({
+				before: p.before,
+				note: e
+			}), o);
+		}
+		return a === f ? typeof p.planId != "string" || p.planId.length === 0 ? y(400, { error: "body.planId must be a non-empty string" }, o) : t.restoreSnapshot ? y(200, await t.restoreSnapshot({ planId: p.planId }), o) : y(404, { error: "restoreSnapshot not configured" }, o) : typeof p.url != "string" || p.url.length === 0 ? y(400, { error: "body.url must be a non-empty URL string" }, o) : t.compareCrossEnv ? (await t.compareCrossEnv({
+			url: p.url,
+			label: typeof p.label == "string" ? p.label : void 0,
+			token: typeof p.token == "string" ? p.token : void 0
+		}), y(200, { ok: !0 }, o)) : y(404, { error: "compareCrossEnv not configured" }, o);
+	} catch (e) {
+		return y(500, {
+			error: "framework action failed",
+			message: e?.message ?? String(e)
+		}, o);
+	}
+}, J = async (e, t, n, r = {}) => {
+	if (j(e) !== "/_voltro/inspect/data/rows") return null;
+	let i = x(n.origin ?? n.Origin), a = (r.method ?? "GET").toUpperCase();
+	if (a !== "GET") return y(405, {
+		error: "method not allowed",
+		expected: "GET"
+	}, i);
+	if (h()) return y(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, i);
+	let o = (r.authResolver ?? _)(n, a);
+	if (!o.ok) return y(401, {
+		error: "unauthorized",
+		reason: o.reason
+	}, i);
+	if (t.kind !== "api") return y(404, { error: "data viewer is api-only" }, i);
+	if (t.inspectRows === void 0) return y(404, { error: "inspectRows not configured" }, i);
+	let s = X(e), c = s.get("table");
+	if (!c) return y(400, { error: "query.table is required" }, i);
+	let l = Z(s.get("offset")) ?? 0, u = Z(s.get("limit")) ?? 50, d = {}, f = s.get("q");
+	if (f) {
+		if (f.length > 8192) return y(400, { error: "query.q too large" }, i);
+		try {
+			d = JSON.parse(Buffer.from(f, "base64url").toString("utf8"));
+		} catch {
+			return y(400, { error: "query.q is not valid base64url JSON" }, i);
+		}
+	}
+	try {
+		return y(200, await t.inspectRows({
+			table: c,
+			offset: l,
+			limit: u,
+			...d
+		}), i);
+	} catch (e) {
+		return e?.name === "InspectQueryError" ? y(400, {
+			error: "invalid query",
+			message: e.message
+		}, i) : y(500, {
+			error: "data-rows query failed",
+			message: e?.message ?? String(e)
+		}, i);
+	}
+}, Y = async (e, t, n, i = {}) => {
+	if (j(e) !== "/_voltro/inspect/provenance") return null;
+	let a = x(n.origin ?? n.Origin), o = (i.method ?? "GET").toUpperCase();
+	if (o !== "GET") return y(405, {
+		error: "method not allowed",
+		expected: "GET"
+	}, a);
+	if (h()) return y(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, a);
+	let s = (i.authResolver ?? _)(n, o);
+	if (!s.ok) return y(401, {
+		error: "unauthorized",
+		reason: s.reason
+	}, a);
+	let c = T(i.method, n, a);
+	if (c) return c;
+	if (t.kind !== "api") return y(404, { error: "provenance is api-only" }, a);
+	if (t.inspectRows === void 0) return y(404, { error: "inspectRows not configured" }, a);
+	let l = X(e), u = l.get("table"), d = l.get("id"), f = l.get("column") ?? void 0;
+	if (!u || !d) return y(400, { error: "query.table and query.id are required" }, a);
+	try {
+		let e = (await t.inspectRows({
+			table: u,
+			limit: 1,
+			filter: {
+				kind: "leaf",
+				column: "id",
+				op: "eq",
+				value: d
+			}
+		})).rows[0];
+		return y(200, r(e, {
+			table: u,
+			id: d,
+			...f === void 0 ? {} : { column: f }
+		}), a);
+	} catch (e) {
+		return e?.name === "InspectQueryError" ? y(400, {
+			error: "invalid query",
+			message: e.message
+		}, a) : y(500, {
+			error: "provenance query failed",
+			message: e?.message ?? String(e)
+		}, a);
+	}
+}, X = (e) => {
+	let t = e.indexOf("?");
+	return t < 0 ? new URLSearchParams() : new URLSearchParams(e.slice(t + 1));
+}, Z = (e) => {
+	if (e === null || e === "") return;
+	let t = Number(e);
+	return Number.isFinite(t) && t >= 0 ? Math.floor(t) : void 0;
+}, Q = async (e, t, n, r = {}) => {
+	if (j(e) !== "/_voltro/inspect/workflows/runs") return null;
+	let i = x(n.origin ?? n.Origin), a = (r.method ?? "GET").toUpperCase();
+	if (a !== "GET") return y(405, {
+		error: "method not allowed",
+		expected: "GET"
+	}, i);
+	if (h()) return y(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, i);
+	let o = (r.authResolver ?? _)(n, a);
+	if (!o.ok) return y(401, {
+		error: "unauthorized",
+		reason: o.reason
+	}, i);
+	if (t.kind !== "api") return y(404, { error: "workflows endpoint is api-only" }, i);
+	if (t.inspectWorkflowRuns === void 0) return y(200, {
+		runs: [],
+		total: 0,
+		offset: 0,
+		limit: 50
+	}, i);
+	let s = X(e);
+	try {
+		let e = s.get("deadLettered") === "1" || s.get("deadLettered") === "true", n = (s.get("statuses") ?? "").split(",").map((e) => e.trim()).filter((e) => e !== "");
+		return y(200, await t.inspectWorkflowRuns({
+			...s.get("tag") === null ? {} : { tag: s.get("tag") },
+			...e ? { deadLettered: !0 } : s.get("status") === null ? n.length > 0 ? { statuses: n } : {} : { status: s.get("status") },
+			...s.get("q") === null ? {} : { tagContains: s.get("q") },
+			...s.get("source") === null ? {} : { source: s.get("source") },
+			...s.get("idPrefix") === null ? {} : { idPrefix: s.get("idPrefix") },
+			...s.get("from") === null ? {} : { startedAfter: s.get("from") },
+			...s.get("to") === null ? {} : { startedBefore: s.get("to") },
+			offset: Z(s.get("offset")) ?? 0,
+			limit: Z(s.get("limit")) ?? 50
+		}), i);
+	} catch (e) {
+		return I(e) ? y(200, {
+			runs: [],
+			total: 0,
+			offset: 0,
+			limit: 0,
+			unavailable: "this app declares no workflows, so there is no run history to read"
+		}, i) : y(500, {
+			error: "workflow-runs query failed",
+			message: e?.message ?? String(e)
+		}, i);
+	}
+}, $ = async (e, t, n, r = {}) => {
+	if (j(e) !== "/_voltro/inspect/workflows/stats") return null;
+	let i = x(n.origin ?? n.Origin), a = (r.method ?? "GET").toUpperCase();
+	if (a !== "GET") return y(405, {
+		error: "method not allowed",
+		expected: "GET"
+	}, i);
+	if (h()) return y(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, i);
+	let o = (r.authResolver ?? _)(n, a);
+	if (!o.ok) return y(401, {
+		error: "unauthorized",
+		reason: o.reason
+	}, i);
+	if (t.kind !== "api") return y(404, { error: "workflows endpoint is api-only" }, i);
+	if (t.inspectWorkflowRunStats === void 0) return y(200, {
+		windowHours: 24,
+		bucketMinutes: 30,
+		buckets: [],
+		byTag: [],
+		total: 0,
+		truncated: !1
+	}, i);
+	let s = X(e);
+	try {
+		return y(200, await t.inspectWorkflowRunStats({
+			...s.get("tag") === null ? {} : { tag: s.get("tag") },
+			...Z(s.get("hours")) === void 0 ? {} : { hours: Z(s.get("hours")) }
+		}), i);
+	} catch (e) {
+		return I(e) ? y(200, {
+			windowHours: 24,
+			bucketMinutes: 30,
+			buckets: [],
+			byTag: [],
+			total: 0,
+			truncated: !1,
+			unavailable: "this app declares no workflows, so there is no run history to read"
+		}, i) : y(500, {
+			error: "workflow-stats query failed",
+			message: e?.message ?? String(e)
+		}, i);
+	}
+}, ee = async (e, t, n, r, i = {}) => {
+	let a = j(e).match(/^\/_voltro\/inspect\/workflows\/start\/([^/]+)$/);
+	if (!a) return null;
+	let o = decodeURIComponent(a[1] ?? ""), s = x(n.origin ?? n.Origin), c = (i.method ?? "POST").toUpperCase();
+	if (c !== "POST") return y(405, {
+		error: "method not allowed",
+		expected: "POST"
+	}, s);
+	if (h()) return y(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, s);
+	let l = (i.authResolver ?? _)(n, c);
+	if (!l.ok) return y(401, {
+		error: "unauthorized",
+		reason: l.reason
+	}, s);
+	if (t.kind !== "api") return y(404, { error: "workflow start is api-only" }, s);
+	if (t.inspectStartWorkflow === void 0) return y(404, { error: "inspectStartWorkflow not configured" }, s);
+	let u = {};
+	if (r.length > 0) try {
+		u = JSON.parse(r).payload ?? {};
+	} catch {
+		return y(400, { error: "start requires JSON body `{ payload?: unknown }`" }, s);
+	}
+	try {
+		return y(200, await t.inspectStartWorkflow({
+			name: o,
+			payload: u
+		}), s);
+	} catch (e) {
+		return y(500, {
+			error: "workflow start failed",
+			message: e?.message ?? String(e)
+		}, s);
+	}
+}, te = async (e, t, n, r = {}) => {
+	let i = j(e);
+	if (!i.startsWith("/_voltro/inspect/schedules")) return null;
+	let a = x(n.origin ?? n.Origin);
+	if (h()) return y(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, a);
+	let o = (r.authResolver ?? _)(n, r.method ?? "POST");
+	if (!o.ok) return y(401, {
+		error: "unauthorized",
+		reason: o.reason
+	}, a);
+	let s = T(r.method, n, a);
+	if (s) return s;
+	if (t.kind !== "api") return y(404, { error: "schedules are api-only" }, a);
+	let c = (r.method ?? "GET").toUpperCase(), l = i.match(/^\/_voltro\/inspect\/schedules\/([^/]+)\/backfill$/);
+	if (l) {
+		if (c !== "POST") return y(405, {
+			error: "method not allowed",
+			expected: "POST"
+		}, a);
+		if (!t.inspectBackfillSchedule) return y(404, { error: "inspectBackfillSchedule not configured" }, a);
+		let e = decodeURIComponent(l[1] ?? ""), n;
+		try {
+			n = JSON.parse(r.body ?? "{}");
+		} catch {
+			return y(400, { error: "invalid JSON body — expected { from, to, confirm?, limit? }" }, a);
+		}
+		if (typeof n.from != "string" || typeof n.to != "string") return y(400, { error: "body must carry ISO 'from' and 'to' instants" }, a);
+		try {
+			let r = await t.inspectBackfillSchedule({
+				name: e,
+				from: n.from,
+				to: n.to,
+				confirm: n.confirm === !0,
+				...typeof n.limit == "number" ? { limit: n.limit } : {}
+			});
+			return y(r.kind === "refused" ? 409 : 200, r, a);
+		} catch (e) {
+			return y(500, {
+				error: "backfill failed",
+				message: e?.message ?? String(e)
+			}, a);
+		}
+	}
+	let u = i.match(/^\/_voltro\/inspect\/schedules\/([^/]+)\/fire$/);
+	if (u) {
+		if (c !== "POST") return y(405, {
+			error: "method not allowed",
+			expected: "POST"
+		}, a);
+		if (!t.inspectFireSchedule) return y(404, { error: "inspectFireSchedule not configured" }, a);
+		let n = decodeURIComponent(u[1] ?? ""), r = X(e).get("trigger") === "external" ? "external" : "manual";
+		try {
+			return y(200, await t.inspectFireSchedule({
+				name: n,
+				trigger: r
+			}), a);
+		} catch (e) {
+			return y(500, {
+				error: "fire failed",
+				message: e?.message ?? String(e)
+			}, a);
+		}
+	}
+	if (i === "/_voltro/inspect/schedules/runs") {
+		if (c !== "GET") return y(405, {
+			error: "method not allowed",
+			expected: "GET"
+		}, a);
+		if (!t.inspectScheduleRuns) return y(200, {
+			runs: [],
+			total: 0,
+			offset: 0,
+			limit: 50
+		}, a);
+		let n = X(e);
+		try {
+			return y(200, await t.inspectScheduleRuns({
+				...n.get("name") === null ? {} : { name: n.get("name") },
+				offset: Z(n.get("offset")) ?? 0,
+				limit: Z(n.get("limit")) ?? 50
+			}), a);
+		} catch (e) {
+			return y(500, {
+				error: "schedule-runs query failed",
+				message: e?.message ?? String(e)
+			}, a);
+		}
+	}
+	return i === "/_voltro/inspect/schedules" ? c === "GET" ? t.inspectSchedules ? y(200, t.inspectSchedules(), a) : y(200, {
+		schedules: [],
+		coordination: "single"
+	}, a) : y(405, {
+		error: "method not allowed",
+		expected: "GET"
+	}, a) : y(404, {
+		error: "unknown schedules endpoint",
+		path: i
+	}, a);
+}, ne = async (e, t, r, i = {}) => {
+	if (j(e) !== "/_voltro/inspect/cluster") return null;
+	let a = x(r.origin ?? r.Origin);
+	if (h()) return y(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, a);
+	let o = (i.authResolver ?? _)(r, i.method ?? "POST");
+	if (!o.ok) return y(401, {
+		error: "unauthorized",
+		reason: o.reason
+	}, a);
+	let s = T(i.method, r, a);
+	if (s) return s;
+	if (t.kind !== "api") return y(404, { error: "cluster is api-only" }, a);
+	if ((i.method ?? "GET").toUpperCase() !== "GET") return y(405, {
+		error: "method not allowed",
+		expected: "GET"
+	}, a);
+	if (!t.cluster) return y(200, {
+		instance: {
+			replicaId: n(),
+			dialect: "memory",
+			runnerHost: "localhost",
+			runnerPort: 0,
+			runnerStorage: "none",
+			shardLock: "none",
+			coordination: "single",
+			cdc: {
+				enabled: !1,
+				flavor: "none (single-process)"
+			},
+			tier: "none",
+			localhostRisk: !1
+		},
+		coordinationState: {
+			recentReplicaIds: [],
+			scheduleClaims: [],
+			runningScheduleRuns: 0,
+			runningWorkflowRuns: 0
+		},
+		capturedAt: Date.now()
+	}, a);
+	try {
+		return y(200, await t.cluster(), a);
+	} catch (e) {
+		return y(500, {
+			error: "cluster snapshot failed",
+			message: e?.message ?? String(e)
+		}, a);
+	}
+}, re = async (e, t, n, r = {}) => {
+	let i = j(e).match(/^\/_voltro\/inspect\/workflows\/runs\/([^/]+)\/steps$/);
+	if (!i) return null;
+	let a = decodeURIComponent(i[1] ?? ""), o = x(n.origin ?? n.Origin), s = (r.method ?? "GET").toUpperCase();
+	if (s !== "GET") return y(405, {
+		error: "method not allowed",
+		expected: "GET"
+	}, o);
+	if (h()) return y(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, o);
+	let c = (r.authResolver ?? _)(n, s);
+	if (!c.ok) return y(401, {
+		error: "unauthorized",
+		reason: c.reason
+	}, o);
+	if (t.kind !== "api") return y(404, { error: "workflow steps are api-only" }, o);
+	if (t.inspectWorkflowRunSteps === void 0) return y(200, { steps: [] }, o);
+	try {
+		return y(200, await t.inspectWorkflowRunSteps({ runId: a }), o);
+	} catch (e) {
+		return y(500, {
+			error: "steps query failed",
+			message: e?.message ?? String(e)
+		}, o);
+	}
+}, ie = async (e, t, n, r = {}) => {
+	let i = j(e).match(/^\/_voltro\/inspect\/workflows\/runs\/([^/]+)\/events$/);
+	if (!i) return null;
+	let a = decodeURIComponent(i[1] ?? ""), o = x(n.origin ?? n.Origin), s = (r.method ?? "GET").toUpperCase();
+	if (s !== "GET") return y(405, {
+		error: "method not allowed",
+		expected: "GET"
+	}, o);
+	if (h()) return y(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, o);
+	let c = (r.authResolver ?? _)(n, s);
+	if (!c.ok) return y(401, {
+		error: "unauthorized",
+		reason: c.reason
+	}, o);
+	if (t.kind !== "api") return y(404, { error: "workflow events are api-only" }, o);
+	if (t.inspectWorkflowRunEvents === void 0) return y(200, { events: [] }, o);
+	try {
+		return y(200, await t.inspectWorkflowRunEvents({ runId: a }), o);
+	} catch (e) {
+		return y(500, {
+			error: "events query failed",
+			message: e?.message ?? String(e)
+		}, o);
+	}
+}, ae = async (e, t, n, r = {}) => {
+	if (j(t) !== "/_voltro/inspect/workflows/events") return null;
+	let i = x(n.origin ?? n.Origin), a = (r.method ?? "GET").toUpperCase();
+	if (a !== "GET") return y(405, {
+		error: "method not allowed",
+		expected: "GET"
+	}, i);
+	if (h()) return y(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, i);
+	let o = (r.authResolver ?? _)(n, a);
+	if (!o.ok) return y(401, {
+		error: "unauthorized",
+		reason: o.reason
+	}, i);
+	if (e.kind !== "api") return y(404, { error: "workflow domain events are api-only" }, i);
+	if (e.inspectWorkflowDomainEvents === void 0) return y(200, {
+		events: [],
+		total: 0,
+		offset: 0,
+		limit: 100
+	}, i);
+	let s = M(t), c = s.get("name") ?? void 0, l = Number(s.get("offset") ?? "0"), u = Number(s.get("limit") ?? "100");
+	try {
+		return y(200, await e.inspectWorkflowDomainEvents({
+			...c !== void 0 && c !== "" ? { name: c } : {},
+			offset: Number.isFinite(l) ? l : 0,
+			limit: Number.isFinite(u) ? u : 100
+		}), i);
+	} catch (e) {
+		return I(e) ? y(200, {
+			events: [],
+			total: 0,
+			offset: 0,
+			limit: 100,
+			unavailable: "this app declares no workflows, so there is no event history to read"
+		}, i) : y(500, {
+			error: "workflow domain events query failed",
+			message: e?.message ?? String(e)
+		}, i);
+	}
+}, oe = async (e, t, n, r = {}) => {
+	let i = j(t).match(/^\/_voltro\/inspect\/workflows\/events\/([^/]+)\/deliveries$/);
+	if (!i) return null;
+	let a = decodeURIComponent(i[1] ?? ""), o = x(n.origin ?? n.Origin), s = (r.method ?? "GET").toUpperCase();
+	if (s !== "GET") return y(405, {
+		error: "method not allowed",
+		expected: "GET"
+	}, o);
+	if (h()) return y(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, o);
+	let c = (r.authResolver ?? _)(n, s);
+	if (!c.ok) return y(401, {
+		error: "unauthorized",
+		reason: c.reason
+	}, o);
+	if (e.kind !== "api") return y(404, { error: "workflow event deliveries are api-only" }, o);
+	if (e.inspectWorkflowEventDeliveries === void 0) return y(200, { deliveries: [] }, o);
+	try {
+		return y(200, await e.inspectWorkflowEventDeliveries({ eventId: a }), o);
+	} catch (e) {
+		return y(500, {
+			error: "workflow event deliveries query failed",
+			message: e?.message ?? String(e)
+		}, o);
+	}
+}, se = async (e, t, n, r = {}) => {
+	if (j(e) !== "/_voltro/inspect/workflows/children") return null;
+	let i = x(n.origin ?? n.Origin), a = (r.method ?? "GET").toUpperCase();
+	if (a !== "GET") return y(405, {
+		error: "method not allowed",
+		expected: "GET"
+	}, i);
+	if (h()) return y(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, i);
+	let o = (r.authResolver ?? _)(n, a);
+	if (!o.ok) return y(401, {
+		error: "unauthorized",
+		reason: o.reason
+	}, i);
+	if (t.kind !== "api") return y(404, { error: "workflow children are api-only" }, i);
+	let s = X(e).get("parentExecutionId");
+	if (s === null || s === "") return y(400, { error: "parentExecutionId query param required" }, i);
+	if (t.inspectWorkflowChildren === void 0) return y(200, {
+		runs: [],
+		total: 0,
+		offset: 0,
+		limit: 200
+	}, i);
+	try {
+		return y(200, await t.inspectWorkflowChildren({ parentExecutionId: s }), i);
+	} catch (e) {
+		return y(500, {
+			error: "children query failed",
+			message: e?.message ?? String(e)
+		}, i);
+	}
+}, ce = async (e, t, n, r, i = {}) => {
+	let a = j(e).match(/^\/_voltro\/inspect\/workflows\/runs\/([^/]+)\/(cancel|retry|suspend|resume-from-step|resume|signal|update|discard|redrive)$/);
+	if (!a) return null;
+	let o = decodeURIComponent(a[1] ?? ""), s = a[2], c = x(n.origin ?? n.Origin), l = (i.method ?? "POST").toUpperCase();
+	if (l !== "POST") return y(405, {
+		error: "method not allowed",
+		expected: "POST"
+	}, c);
+	if (h()) return y(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, c);
+	let u = (i.authResolver ?? _)(n, l);
+	if (!u.ok) return y(401, {
+		error: "unauthorized",
+		reason: u.reason
+	}, c);
+	if (t.kind !== "api") return y(404, { error: "workflow actions are api-only" }, c);
+	let d = {
+		cancel: t.inspectCancelWorkflowRun,
+		retry: t.inspectRetryWorkflowRun,
+		suspend: t.inspectSuspendWorkflowRun,
+		resume: t.inspectResumeWorkflowRun,
+		signal: t.inspectSignalWorkflowRun,
+		update: t.inspectUpdateWorkflowRun,
+		discard: t.inspectDiscardWorkflowRun,
+		redrive: t.inspectRedriveWorkflowRun,
+		"resume-from-step": t.inspectResumeWorkflowRunFromStep
+	}[s];
+	if (!d) return y(404, { error: s === "resume-from-step" ? "inspectResumeWorkflowRunFromStep not configured" : `inspect${s[0]?.toUpperCase() ?? ""}${s.slice(1)}WorkflowRun not configured` }, c);
+	let f, p, m, g, v, b, S;
+	if (r.length > 0) try {
+		let e = JSON.parse(r);
+		s === "retry" && (f = e.payloadOverride), s === "resume-from-step" && typeof e.step == "string" && e.step.length > 0 && (S = e.step), s === "signal" && (typeof e.signalName == "string" && e.signalName.length > 0 && (p = e.signalName), m = e.payload), s === "update" && (typeof e.updateName == "string" && e.updateName.length > 0 && (g = e.updateName), v = e.payload, typeof e.timeoutMs == "number" && Number.isFinite(e.timeoutMs) && (b = e.timeoutMs));
+	} catch {}
+	if (s === "signal" && p === void 0) return y(400, { error: "signal requires JSON body `{ signalName: string, payload?: unknown }`" }, c);
+	if (s === "update" && g === void 0) return y(400, { error: "update requires JSON body `{ updateName: string, payload?: unknown, timeoutMs?: number }`" }, c);
+	if (s === "resume-from-step" && S === void 0) return y(400, { error: "resume-from-step requires JSON body `{ step: string }` (the step name to rewind to)" }, c);
+	try {
+		return y(200, s === "retry" && f !== void 0 ? await d({
+			runId: o,
+			payloadOverride: f
+		}) : s === "signal" ? await d({
+			runId: o,
+			signalName: p,
+			payload: m
+		}) : s === "update" ? await d({
+			runId: o,
+			updateName: g,
+			payload: v,
+			...b === void 0 ? {} : { timeoutMs: b }
+		}) : s === "resume-from-step" ? await d({
+			runId: o,
+			step: S
+		}) : await d({ runId: o }), c);
+	} catch (e) {
+		return y(500, {
+			error: `${s} failed`,
+			message: e?.message ?? String(e)
+		}, c);
+	}
+}, le = async (e, t, n, r, i = {}) => {
+	if (j(e) !== "/_voltro/inspect/data/import" || (i.method ?? "POST").toUpperCase() !== "POST") return null;
+	let a = x(n.origin ?? n.Origin);
+	if (h()) return y(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, a);
+	let o = (i.authResolver ?? _)(n, "POST");
+	if (!o.ok) return y(401, {
+		error: "unauthorized",
+		reason: o.reason
+	}, a);
+	let s = T(i.method, n, a);
+	if (s) return s;
+	if (t.kind !== "api") return y(404, { error: "data import is api-only" }, a);
+	if (!t.inspectImport) return y(404, { error: "inspectImport not configured" }, a);
+	let c;
+	try {
+		c = JSON.parse(r || "{}");
+	} catch {
+		return y(400, { error: "body must be JSON" }, a);
+	}
+	if (typeof c.bundleDir != "string" || !c.bundleDir) return y(400, { error: "body.bundleDir (string) is required" }, a);
+	try {
+		return y(200, await t.inspectImport({
+			bundleDir: c.bundleDir,
+			...c.mode === "upsert" || c.mode === "append" || c.mode === "replace" ? { mode: c.mode } : {},
+			...c.onConflict === "skip" || c.onConflict === "fail" ? { onConflict: c.onConflict } : {},
+			...typeof c.atomic == "boolean" ? { atomic: c.atomic } : {}
+		}), a);
+	} catch (e) {
+		return y(500, {
+			error: "import failed",
+			message: e?.message ?? String(e)
+		}, a);
+	}
+}, ue = async (e, t, n, r, i = {}) => {
+	let a = j(e);
+	if (!a.startsWith("/_voltro/inspect/data/rows")) return null;
+	let o = (i.method ?? "POST").toUpperCase();
+	if (o === "GET" && a === "/_voltro/inspect/data/rows") return null;
+	let s = x(n.origin ?? n.Origin);
+	if (h()) return y(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, s);
+	let c = (i.authResolver ?? _)(n, o);
+	if (!c.ok) return y(401, {
+		error: "unauthorized",
+		reason: c.reason
+	}, s);
+	if (t.kind !== "api") return y(404, { error: "data viewer is api-only" }, s);
+	if (o === "POST" && a === "/_voltro/inspect/data/rows") {
+		if (!t.inspectInsertRow) return y(404, { error: "inspectInsertRow not configured" }, s);
+		let e;
+		try {
+			e = JSON.parse(r || "{}");
+		} catch {
+			return y(400, { error: "body must be JSON" }, s);
+		}
+		if (typeof e.table != "string" || !e.row || typeof e.row != "object") return y(400, { error: "body must be { table: string, row: object }" }, s);
+		try {
+			return y(200, await t.inspectInsertRow({
+				table: e.table,
+				row: e.row
+			}), s);
+		} catch (e) {
+			return y(500, {
+				error: "insert failed",
+				message: e?.message ?? String(e)
+			}, s);
+		}
+	}
+	let l = a.match(/^\/_voltro\/inspect\/data\/rows\/([^/]+)$/);
+	if (!l) return null;
+	let u = decodeURIComponent(l[1] ?? "");
+	if (!u) return y(400, { error: "row id is required in URL" }, s);
+	let d = X(e).get("table") ?? "";
+	if (!d) return y(400, { error: "query.table is required" }, s);
+	if (o === "PATCH") {
+		if (!t.inspectUpdateRow) return y(404, { error: "inspectUpdateRow not configured" }, s);
+		let e;
+		try {
+			e = JSON.parse(r || "{}");
+		} catch {
+			return y(400, { error: "body must be JSON" }, s);
+		}
+		if (!e.patch || typeof e.patch != "object") return y(400, { error: "body.patch must be an object" }, s);
+		try {
+			return y(200, await t.inspectUpdateRow({
+				table: d,
+				id: u,
+				patch: e.patch
+			}), s);
+		} catch (e) {
+			return y(500, {
+				error: "update failed",
+				message: e?.message ?? String(e)
+			}, s);
+		}
+	}
+	if (o === "DELETE") {
+		if (!t.inspectDeleteRow) return y(404, { error: "inspectDeleteRow not configured" }, s);
+		try {
+			return y(200, await t.inspectDeleteRow({
+				table: d,
+				id: u
+			}), s);
+		} catch (e) {
+			return y(500, {
+				error: "delete failed",
+				message: e?.message ?? String(e)
+			}, s);
+		}
+	}
+	return y(405, {
+		error: "method not allowed",
+		expected: "POST | PATCH | DELETE"
+	}, s);
+}, de = async (e, t, n, r, i = {}) => {
+	let a = j(e), o = `${m}/workflows/flow-control`;
+	if (a !== o && !a.startsWith(`${o}/`)) return null;
+	let s = x(n.origin ?? n.Origin), c = (i.method ?? "GET").toUpperCase();
+	if (h()) return y(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, s);
+	let l = (i.authResolver ?? _)(n, c);
+	if (!l.ok) return y(401, {
+		error: "unauthorized",
+		reason: l.reason
+	}, s);
+	if (t.kind !== "api") return y(404, { error: "flow control is api-only" }, s);
+	if (a === `${o}/inferences`) {
+		if (c !== "GET") return y(405, {
+			error: "method not allowed",
+			expected: "GET"
+		}, s);
+		if (t.inspectInferences === void 0) return y(404, { error: "inspectInferences not configured" }, s);
+		let n = X(e).get("limit"), r = n === null ? void 0 : Number(n);
+		try {
+			return y(200, await t.inspectInferences(r !== void 0 && Number.isFinite(r) ? { limit: r } : {}), s);
+		} catch (e) {
+			return y(500, {
+				error: "inference queue read failed",
+				message: e?.message ?? String(e)
+			}, s);
+		}
+	}
+	if (a === o) {
+		if (c !== "GET") return y(405, {
+			error: "method not allowed",
+			expected: "GET"
+		}, s);
+		if (t.inspectFlowControl === void 0) return y(404, { error: "inspectFlowControl not configured" }, s);
+		let n = X(e).get("limit"), r = n === null ? void 0 : Number(n);
+		try {
+			return y(200, await t.inspectFlowControl(r !== void 0 && Number.isFinite(r) ? { limit: r } : {}), s);
+		} catch (e) {
+			return y(500, {
+				error: "flow control read failed",
+				message: e?.message ?? String(e)
+			}, s);
+		}
+	}
+	if (c !== "POST") return y(405, {
+		error: "method not allowed",
+		expected: "POST"
+	}, s);
+	let u = {};
+	if (r.length > 0) try {
+		u = JSON.parse(r);
+	} catch {
+		return y(400, { error: "expected a JSON body" }, s);
+	}
+	let d = a.slice(o.length + 1);
+	try {
+		if (d === "pause") return t.inspectPauseWorkflow === void 0 ? y(404, { error: "inspectPauseWorkflow not configured" }, s) : u.workflow ? y(200, await t.inspectPauseWorkflow({
+			workflow: u.workflow,
+			...u.reason === void 0 ? {} : { reason: u.reason }
+		}), s) : y(400, { error: "body.workflow is required" }, s);
+		if (d === "resume") return t.inspectResumeWorkflow === void 0 ? y(404, { error: "inspectResumeWorkflow not configured" }, s) : u.workflow ? y(200, await t.inspectResumeWorkflow({ workflow: u.workflow }), s) : y(400, { error: "body.workflow is required" }, s);
+		if (d === "discard") return t.inspectDiscardIntent === void 0 ? y(404, { error: "inspectDiscardIntent not configured" }, s) : u.intentId ? y(200, await t.inspectDiscardIntent({ intentId: u.intentId }), s) : y(400, { error: "body.intentId is required" }, s);
+		if (d === "bulk") {
+			if (t.inspectBulkWorkflowRuns === void 0) return y(404, { error: "inspectBulkWorkflowRuns not configured" }, s);
+			if (u.op !== "cancel" && u.op !== "replay") return y(400, { error: "body.op must be 'cancel' or 'replay'" }, s);
+			if (typeof u.limit != "number") return y(400, { error: "body.limit is required — a bulk operation has no unbounded form, the cap IS the blast radius. The response reports `truncated` when more matched." }, s);
+			try {
+				return y(200, await t.inspectBulkWorkflowRuns({
+					op: u.op,
+					limit: u.limit,
+					...u.reason === void 0 ? {} : { reason: u.reason },
+					...u.mode === void 0 ? {} : { mode: u.mode },
+					...u.dryRun === void 0 ? {} : { dryRun: u.dryRun },
+					...u.workflow === void 0 ? {} : { workflow: u.workflow },
+					...u.status === void 0 ? {} : { status: u.status },
+					...u.startedAfter === void 0 ? {} : { startedAfter: u.startedAfter },
+					...u.startedBefore === void 0 ? {} : { startedBefore: u.startedBefore }
+				}), s);
+			} catch (e) {
+				if (e?.name === "BulkRequestError") return y(400, { error: e.message }, s);
+				throw e;
+			}
+		}
+	} catch (e) {
+		return y(500, {
+			error: "flow control action failed",
+			message: e?.message ?? String(e)
+		}, s);
+	}
+	return y(404, {
+		error: `unknown flow-control action '${d}'`,
+		expected: [
+			"pause",
+			"resume",
+			"discard",
+			"bulk"
+		]
+	}, s);
+};
+//#endregion
+export { w as A, ie as C, ee as D, Q as E, A as F, C as I, v as L, b as M, z as N, x as O, E as P, oe as S, re as T, te as _, T as a, se as b, ne as c, ue as d, de as f, B as g, Y as h, F as i, h as j, k, le as l, U as m, P as n, _ as o, q as p, S as r, W as s, m as t, J as u, K as v, $ as w, ae as x, ce as y };