@voltro/cli 0.54.0 → 0.56.0

package/dist/inspect-Bd8-9wsi.js

@@ -1,1193 +0,0 @@
-import { n as e } from "./inspectGateHint-4LxkNtrz.js";
-import { lastWriteProvenance as t } from "@voltro/runtime";
-import { timingSafeStringEqual as n } from "@voltro/protocol/session";
-//#region src/inspect.ts
-var r = "/_voltro/inspect", i = () => process.env.VOLTRO_INSPECT === "off", a = /* @__PURE__ */ new Set([
-	"GET",
-	"HEAD",
-	"OPTIONS"
-]), o = (t, r) => {
-	let i = process.env.VOLTRO_INSPECT_TOKEN;
-	if (!i || i.length === 0) return {
-		ok: !1,
-		reason: "inspect is closed: no VOLTRO_INSPECT_TOKEN configured. `voltro dev` mints one per project; for serve/start set it explicitly (it is never minted outside dev)."
-	};
-	let o = t.authorization ?? t.Authorization;
-	if (!o) return {
-		ok: !1,
-		reason: "missing Authorization header"
-	};
-	if (!o.startsWith("Bearer ")) return {
-		ok: !1,
-		reason: "expected \"Bearer <token>\" auth scheme"
-	};
-	let s = o.slice(7).trim();
-	if (!n(s, i)) return {
-		ok: !1,
-		reason: "token mismatch"
-	};
-	if (!a.has(r.toUpperCase())) {
-		let i = process.env.VOLTRO_INSPECT_WRITE_TOKEN;
-		if (!i || i.length === 0) return {
-			ok: !1,
-			reason: e("unset", r)
-		};
-		let a = (t["x-voltro-inspect-write"] ?? t["X-Voltro-Inspect-Write"] ?? "").trim();
-		if (a.length === 0) return {
-			ok: !1,
-			reason: e("absent", r)
-		};
-		if (!n(a, i)) return {
-			ok: !1,
-			reason: e("mismatch", r)
-		};
-	}
-	return { ok: !0 };
-}, s = (e) => {
-	if (!Array.isArray(e) || e.length === 0) return;
-	let t = [];
-	for (let n of e) {
-		if (typeof n != "object" || !n) continue;
-		if (typeof n.open == "string") {
-			t.push({
-				kind: "open",
-				reason: n.open
-			});
-			continue;
-		}
-		if (typeof n.action == "string" && typeof n.resourceType == "string") {
-			t.push({
-				kind: "policy",
-				action: n.action,
-				resourceType: n.resourceType
-			});
-			continue;
-		}
-		let e = n.scope;
-		typeof e != "string" && !Array.isArray(e) || t.push({
-			kind: "scope",
-			scope: typeof e == "string" ? [e] : e.filter((e) => typeof e == "string"),
-			mode: n.mode === "any" ? "any" : "all",
-			resourceScoped: typeof n.resource == "function"
-		});
-	}
-	return t.length > 0 ? t : void 0;
-}, c = (e, t, n = {}) => ({
-	status: e,
-	contentType: "application/json; charset=utf-8",
-	body: JSON.stringify(t),
-	headers: n
-}), l = (e) => {
-	let t;
-	try {
-		t = new URL(e).hostname;
-	} catch {
-		return !1;
-	}
-	return t = t.replace(/^\[|\]$/g, ""), t === "localhost" || t.endsWith(".localhost") || t === "::1" ? !0 : /^127(?:\.\d{1,3}){3}$/.test(t);
-}, u = (e) => !e || e.length === 0 ? {} : l(e) ? {
-	"access-control-allow-origin": e,
-	"access-control-allow-credentials": "true",
-	"access-control-allow-methods": "GET, POST, OPTIONS",
-	"access-control-allow-headers": "authorization, content-type, accept",
-	"access-control-expose-headers": "content-type, content-length",
-	vary: "Origin"
-} : { vary: "Origin" }, d = (e, t = process.env.VOLTRO_DASHBOARD_APPS) => {
-	if (l(e)) return !0;
-	let n;
-	try {
-		n = new URL(e).origin;
-	} catch {
-		return !1;
-	}
-	if (!t || t.trim() === "") return !1;
-	try {
-		let e = JSON.parse(t);
-		return Array.isArray(e) ? e.some((e) => {
-			let t = e?.url;
-			if (typeof t != "string") return !1;
-			try {
-				return new URL(t).origin === n;
-			} catch {
-				return !1;
-			}
-		}) : !1;
-	} catch {
-		return !1;
-	}
-}, f = (e, t, n = {}) => {
-	let r = (e ?? "GET").toUpperCase();
-	if (r === "GET" || r === "HEAD" || r === "OPTIONS") return null;
-	let i = t.origin ?? t.Origin;
-	return i === void 0 || i === "" || l(i) ? null : c(403, {
-		error: "cross-site write rejected",
-		reason: `a state-changing inspect request may not come from origin "${i}" — only same-machine (loopback) origins may write`
-	}, n);
-}, p = (e = process.env.VOLTRO_INSPECT_ALLOWED_HOSTS) => (e ?? "").split(/[,\s]+/).map((e) => e.trim().toLowerCase()).filter((e) => e.length > 0), m = (e) => {
-	if (e === void 0) return "";
-	let t = e.trim();
-	if (t === "") return "";
-	if (t.startsWith("[")) {
-		let e = t.indexOf("]");
-		return (e === -1 ? t.slice(1) : t.slice(1, e)).toLowerCase();
-	}
-	let n = t.indexOf(":");
-	return (n === -1 ? t : t.slice(0, n)).toLowerCase();
-}, h = (e) => /^\d{1,3}(?:\.\d{1,3}){3}$/.test(e) || e.includes(":"), g = (e, t = p()) => {
-	let n = m(e);
-	return n === "" || n === "localhost" || n.endsWith(".localhost") || h(n) ? !0 : t.includes(n);
-}, _ = (e, t = {}, n) => g(e, n) ? null : c(403, {
-	error: "forbidden host",
-	reason: `the dev inspect surface refuses a request with Host "${e ?? ""}" — a DNS-rebinding guard. Only loopback names, IP literals, and hosts listed in VOLTRO_INSPECT_ALLOWED_HOSTS may reach it.`
-}, t), v = (e) => {
-	let t = e.indexOf("?");
-	return t === -1 ? e : e.slice(0, t);
-}, y = (e) => {
-	let t = e.indexOf("?");
-	return t === -1 ? new URLSearchParams() : new URLSearchParams(e.slice(t + 1));
-}, b = (e) => e === "/_voltro/inspect" || e.startsWith("/_voltro/inspect/"), x = [
-	"text",
-	"textarea",
-	"number",
-	"checkbox",
-	"switch",
-	"select",
-	"radio",
-	"async-select",
-	"multi-select",
-	"date",
-	"datetime",
-	"daterange",
-	"file",
-	"hidden",
-	"custom"
-], S = (e, t, n = [], r = []) => ({
-	version: 2,
-	scopes: [...new Set(r.flatMap((e) => e.declaredScopes ?? []))].sort(),
-	procedures: [...e].sort((e, t) => e.tag.localeCompare(t.tag)).map((e) => ({
-		tag: e.tag,
-		kind: e.kind,
-		...e.inputSchema === void 0 ? {} : { input: e.inputSchema },
-		...e.outputSchema === void 0 ? {} : { output: e.outputSchema },
-		...e.source === void 0 ? {} : { source: e.source },
-		...e.targets === void 0 ? {} : { targets: e.targets },
-		...e.guards === void 0 ? {} : { guards: e.guards },
-		...e.internal === !0 ? { internal: !0 } : {},
-		...e.publicApi === void 0 ? {} : { publicApi: e.publicApi },
-		...e.exposeAsTool === void 0 ? {} : { exposeAsTool: e.exposeAsTool }
-	})),
-	workflows: [...t].sort((e, t) => e.tag.localeCompare(t.tag)).map((e) => ({ name: e.tag })),
-	widgets: x,
-	tables: [...n].filter((e) => !e.isFrameworkTable).sort((e, t) => e.name.localeCompare(t.name)).map((e) => ({
-		name: e.name,
-		reactive: e.isReactive,
-		framework: e.isFrameworkTable,
-		editable: e.editable ?? !0,
-		...e.pkColumn === void 0 ? {} : { pkColumn: e.pkColumn },
-		columns: e.columns.map((e) => ({
-			name: e.name,
-			type: String(e.type),
-			nullable: e.nullable,
-			...e.referencesTable === void 0 ? {} : { refersTo: e.referencesTable },
-			...e.oneOf === void 0 ? {} : { enum: e.oneOf },
-			...e.serverOnly === !0 ? { serverOnly: !0 } : {},
-			...e.encrypted === !0 ? { encrypted: !0 } : {},
-			...e.sensitive === void 0 ? {} : { sensitive: e.sensitive }
-		}))
-	}))
-}), C = (e, t, n = {}, r = {}) => {
-	let a = v(e);
-	if (!b(a)) return null;
-	let s = u(n.origin ?? n.Origin), l = (r.method ?? "GET").toUpperCase();
-	if (l === "OPTIONS") return {
-		status: 204,
-		contentType: "text/plain",
-		body: "",
-		headers: s
-	};
-	if (i()) return c(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, s);
-	let d = (r.authResolver ?? o)(n, l);
-	if (!d.ok) return c(401, {
-		error: "unauthorized",
-		reason: d.reason
-	}, s);
-	if (a === "/_voltro/inspect" || a === "/_voltro/inspect/" || a === "/_voltro/inspect/app") return c(200, {
-		kind: t.kind,
-		...t.meta
-	}, s);
-	if (a === "/_voltro/inspect/routes") return t.kind === "web" ? c(200, {
-		pages: t.routes,
-		dirs: t.dirs
-	}, s) : c(404, { error: "routes endpoint is web-only" }, s);
-	if (a === "/_voltro/inspect/cache") return t.kind === "web" ? c(200, t.cache(), s) : c(404, { error: "cache endpoint is web-only" }, s);
-	if (a === "/_voltro/inspect/rpc") return t.kind === "api" ? c(200, {
-		procedures: t.rpc,
-		workflows: t.workflows
-	}, s) : c(404, { error: "rpc endpoint is api-only" }, s);
-	if (a === "/_voltro/inspect/manifest") {
-		if (t.kind !== "api") return c(404, { error: "manifest endpoint is api-only" }, s);
-		let e = t.inspectTables?.().tables ?? [];
-		return c(200, S(t.rpc, t.workflows, e, t.plugins?.().plugins ?? []), s);
-	}
-	return a === "/_voltro/inspect/metrics" ? t.metrics === void 0 ? c(200, [], s) : c(200, t.metrics(), s) : a === "/_voltro/inspect/subscriptions" ? t.kind === "api" ? t.subscriptions === void 0 ? c(200, {
-		subscriptions: [],
-		matcherStats: [],
-		capturedAt: Date.now()
-	}, s) : c(200, t.subscriptions(), s) : c(404, { error: "subscriptions endpoint is api-only" }, s) : a === "/_voltro/inspect/members" ? t.kind === "api" ? t.members === void 0 ? c(200, {
-		members: [],
-		capturedAt: Date.now()
-	}, s) : c(200, t.members(), s) : c(404, { error: "members endpoint is api-only" }, s) : a === "/_voltro/inspect/events" ? t.kind === "api" ? t.events === void 0 ? c(200, {
-		declared: [],
-		routes: [],
-		origin: "",
-		capturedAt: Date.now(),
-		totals: {
-			routes: 0,
-			subscribers: 0,
-			buffered: 0
-		}
-	}, s) : c(200, t.events(), s) : c(404, { error: "events endpoint is api-only" }, s) : a === "/_voltro/inspect/data-cache" ? t.kind === "api" ? t.dataCache === void 0 ? c(200, {
-		backend: "memory",
-		engine: "memory",
-		driver: "resp",
-		hits: 0,
-		misses: 0,
-		hitRate: 0
-	}, s) : c(200, t.dataCache(), s) : c(404, { error: "data-cache endpoint is api-only" }, s) : a === "/_voltro/inspect/database" ? t.kind === "api" ? t.database === void 0 ? c(200, {
-		migrations: [],
-		seeds: []
-	}, s) : c(200, t.database(), s) : c(404, { error: "database endpoint is api-only" }, s) : a === "/_voltro/inspect/plugins" ? t.kind === "api" ? t.plugins === void 0 ? c(200, {
-		plugins: [],
-		capturedAt: Date.now()
-	}, s) : c(200, t.plugins(), s) : c(404, { error: "plugins endpoint is api-only" }, s) : a === "/_voltro/inspect/env" ? t.env === void 0 ? c(200, {
-		app: t.meta.name ?? "app",
-		entries: [],
-		summary: {
-			total: 0,
-			set: 0,
-			missingRequired: 0
-		}
-	}, s) : c(200, t.env(), s) : a === "/_voltro/inspect/data/tables" ? t.kind === "api" ? t.inspectTables === void 0 ? c(200, { tables: [] }, s) : c(200, t.inspectTables(), s) : c(404, { error: "data viewer is api-only" }, s) : a === "/_voltro/inspect/invoke" ? c(404, { error: "invoke not enabled here — use POST handler" }, s) : w.has(a) ? c(404, {
-		error: "endpoint not mounted on this instance",
-		path: a,
-		reason: "This inspect endpoint is served by `voltro dev`. A production `voltro serve` does not mount it — the data behind it (the in-memory log ring, the span buffer, the dev route table) is not collected there. This is not a missing token: the same request with no token would be 401."
-	}, s) : c(404, {
-		error: "unknown inspect endpoint",
-		path: a
-	}, s);
-}, w = /* @__PURE__ */ new Set([
-	`${r}/logs`,
-	`${r}/traces`,
-	`${r}/workflows`,
-	`${r}/storage`,
-	`${r}/aggregates`,
-	`${r}/flags`
-]), T = async (e, t, n, r = {}) => {
-	let a = u(t.origin ?? t.Origin);
-	if (i()) return c(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, a);
-	let s = (r.method ?? "POST").toUpperCase();
-	if (s !== "POST") return c(405, {
-		error: "method not allowed",
-		expected: "POST"
-	}, a);
-	let l = (r.authResolver ?? o)(t, s);
-	if (!l.ok) return c(401, {
-		error: "unauthorized",
-		reason: l.reason
-	}, a);
-	if (e.kind !== "api") return c(404, { error: "invoke endpoint is api-only" }, a);
-	if (!e.invokers || e.invokers.size === 0) return c(404, { error: "invoke not configured" }, a);
-	let d;
-	try {
-		d = JSON.parse(n || "{}");
-	} catch {
-		return c(400, { error: "body must be JSON" }, a);
-	}
-	let f = d;
-	if (typeof f.tag != "string") return c(400, { error: "body.tag must be a string" }, a);
-	let p = e.invokers.get(f.tag);
-	if (!p) return c(404, {
-		error: "unknown tag",
-		tag: f.tag
-	}, a);
-	let m = typeof f.headers == "object" && f.headers !== null ? f.headers : {}, h = {};
-	for (let [e, n] of Object.entries(t)) h[e.toLowerCase()] = n;
-	for (let [e, t] of Object.entries(m)) {
-		let n = e.toLowerCase();
-		n !== "cookie" && (h[n] = t);
-	}
-	return c(200, await p(f.input, h), a);
-}, E = async (e, t, n, r = {}) => {
-	let a = v(e);
-	if (!b(a) || a !== "/_voltro/inspect/migrations" || (r.method ?? "GET").toUpperCase() !== "GET") return null;
-	let s = u(n.origin ?? n.Origin);
-	if (i()) return c(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, s);
-	let l = (r.authResolver ?? o)(n, "GET");
-	return l.ok ? t.kind === "api" ? t.migrations === void 0 ? c(200, {
-		drift: {
-			isDrifted: !1,
-			liveFingerprint: "",
-			liveSnapshot: { tables: [] }
-		},
-		pending: null,
-		history: [],
-		softDropSnapshots: []
-	}, s) : c(200, await t.migrations(), s) : c(404, { error: "migrations endpoint is api-only" }, s) : c(401, {
-		error: "unauthorized",
-		reason: l.reason
-	}, s);
-}, D = async (e, t, n, a, s = {}) => {
-	let l = v(e);
-	if (!b(l) || !l.startsWith("/_voltro/inspect/webhooks/")) return null;
-	let d = u(n.origin ?? n.Origin);
-	if ((s.method ?? "POST").toUpperCase() !== "POST") return null;
-	if (i()) return c(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, d);
-	let p = (s.authResolver ?? o)(n, s.method ?? "POST");
-	if (!p.ok) return c(401, {
-		error: "unauthorized",
-		reason: p.reason
-	}, d);
-	let m = f(s.method, n, d);
-	if (m) return m;
-	if (t.kind !== "api") return c(404, { error: "webhook actions are api-only" }, d);
-	if (!t.webhookActions) return c(404, { error: "webhook actions not configured — is @voltro/plugin-webhooks active?" }, d);
-	let h;
-	try {
-		h = JSON.parse(a || "{}");
-	} catch {
-		return c(400, { error: "body must be JSON" }, d);
-	}
-	let g = l.slice(`${r}/webhooks/`.length);
-	try {
-		switch (g) {
-			case "subscribe": {
-				let e = h;
-				return typeof e.event != "string" || e.event.length === 0 ? c(400, { error: "event required" }, d) : typeof e.url != "string" || e.url.length === 0 ? c(400, { error: "url required" }, d) : c(200, await t.webhookActions.subscribe(e), d);
-			}
-			case "pause": {
-				let e = h.targetId;
-				return typeof e != "string" || e.length === 0 ? c(400, { error: "targetId required" }, d) : (await t.webhookActions.pause(e), c(200, { ok: !0 }, d));
-			}
-			case "resume": {
-				let e = h.targetId;
-				return typeof e != "string" || e.length === 0 ? c(400, { error: "targetId required" }, d) : (await t.webhookActions.resume(e), c(200, { ok: !0 }, d));
-			}
-			case "delete": {
-				let e = h.targetId;
-				return typeof e != "string" || e.length === 0 ? c(400, { error: "targetId required" }, d) : (await t.webhookActions.delete(e), c(200, { ok: !0 }, d));
-			}
-			case "rotateSecret": {
-				let e = h.targetId;
-				return typeof e != "string" || e.length === 0 ? c(400, { error: "targetId required" }, d) : c(200, await t.webhookActions.rotateSecret(e), d);
-			}
-			case "replay": {
-				let e = h.deliveryId;
-				return typeof e != "string" || e.length === 0 ? c(400, { error: "deliveryId required" }, d) : (await t.webhookActions.replay(e), c(200, { ok: !0 }, d));
-			}
-			case "repinVersion": {
-				let e = h.targetId, n = h.version;
-				return typeof e != "string" || e.length === 0 ? c(400, { error: "targetId required" }, d) : typeof n != "number" || !Number.isInteger(n) || n < 1 ? c(400, { error: "version must be a positive integer" }, d) : (await t.webhookActions.updateTargetPayloadVersion(e, n), c(200, { ok: !0 }, d));
-			}
-			default: return c(404, { error: `unknown webhook action: ${g}` }, d);
-		}
-	} catch (e) {
-		return c(500, {
-			error: "webhook action failed",
-			message: e?.message ?? String(e)
-		}, d);
-	}
-}, O = async (e, t, n, a, s = {}) => {
-	let l = v(e);
-	if (!b(l)) return null;
-	let d = u(n.origin ?? n.Origin), f = (s.method ?? "POST").toUpperCase();
-	if (f !== "POST") return null;
-	if (i()) return c(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, d);
-	let p = (s.authResolver ?? o)(n, f);
-	if (!p.ok) return c(401, {
-		error: "unauthorized",
-		reason: p.reason
-	}, d);
-	if (t.kind !== "api") return c(404, { error: "framework-action endpoints are api-only" }, d);
-	let m = `${r}/seeds/run`, h = `${r}/migrations/rollback`, g = `${r}/migrations/squash`, _ = `${r}/migrations/restore-snapshot`;
-	if (l !== m && l !== h && l !== g && l !== _ && l !== "/_voltro/inspect/migrations/compare-env") return null;
-	let y;
-	try {
-		y = JSON.parse(a || "{}");
-	} catch {
-		return c(400, { error: "body must be JSON" }, d);
-	}
-	try {
-		if (l === m) return typeof y.id != "string" || y.id.length === 0 ? c(400, { error: "body.id must be a non-empty string" }, d) : t.runSeed ? c(200, await t.runSeed(y.id), d) : c(404, { error: "runSeed not configured" }, d);
-		if (l === h) return typeof y.id != "string" || y.id.length === 0 ? c(400, { error: "body.id must be a non-empty string" }, d) : t.rollbackMigration ? c(200, await t.rollbackMigration(y.id), d) : c(404, { error: "rollbackMigration not configured" }, d);
-		if (l === g) {
-			if (typeof y.before != "string" || y.before.length === 0) return c(400, { error: "body.before must be a non-empty ISO date string" }, d);
-			if (!t.squashMigrationHistory) return c(404, { error: "squashMigrationHistory not configured" }, d);
-			let e = typeof y.note == "string" ? y.note : void 0;
-			return c(200, await t.squashMigrationHistory({
-				before: y.before,
-				note: e
-			}), d);
-		}
-		return l === _ ? typeof y.planId != "string" || y.planId.length === 0 ? c(400, { error: "body.planId must be a non-empty string" }, d) : t.restoreSnapshot ? c(200, await t.restoreSnapshot({ planId: y.planId }), d) : c(404, { error: "restoreSnapshot not configured" }, d) : typeof y.url != "string" || y.url.length === 0 ? c(400, { error: "body.url must be a non-empty URL string" }, d) : t.compareCrossEnv ? (await t.compareCrossEnv({
-			url: y.url,
-			label: typeof y.label == "string" ? y.label : void 0,
-			token: typeof y.token == "string" ? y.token : void 0
-		}), c(200, { ok: !0 }, d)) : c(404, { error: "compareCrossEnv not configured" }, d);
-	} catch (e) {
-		return c(500, {
-			error: "framework action failed",
-			message: e?.message ?? String(e)
-		}, d);
-	}
-}, k = async (e, t, n, r = {}) => {
-	if (v(e) !== "/_voltro/inspect/data/rows") return null;
-	let a = u(n.origin ?? n.Origin), s = (r.method ?? "GET").toUpperCase();
-	if (s !== "GET") return c(405, {
-		error: "method not allowed",
-		expected: "GET"
-	}, a);
-	if (i()) return c(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, a);
-	let l = (r.authResolver ?? o)(n, s);
-	if (!l.ok) return c(401, {
-		error: "unauthorized",
-		reason: l.reason
-	}, a);
-	if (t.kind !== "api") return c(404, { error: "data viewer is api-only" }, a);
-	if (t.inspectRows === void 0) return c(404, { error: "inspectRows not configured" }, a);
-	let d = j(e), f = d.get("table");
-	if (!f) return c(400, { error: "query.table is required" }, a);
-	let p = M(d.get("offset")) ?? 0, m = M(d.get("limit")) ?? 50, h = {}, g = d.get("q");
-	if (g) {
-		if (g.length > 8192) return c(400, { error: "query.q too large" }, a);
-		try {
-			h = JSON.parse(Buffer.from(g, "base64url").toString("utf8"));
-		} catch {
-			return c(400, { error: "query.q is not valid base64url JSON" }, a);
-		}
-	}
-	try {
-		return c(200, await t.inspectRows({
-			table: f,
-			offset: p,
-			limit: m,
-			...h
-		}), a);
-	} catch (e) {
-		return e?.name === "InspectQueryError" ? c(400, {
-			error: "invalid query",
-			message: e.message
-		}, a) : c(500, {
-			error: "data-rows query failed",
-			message: e?.message ?? String(e)
-		}, a);
-	}
-}, A = async (e, n, r, a = {}) => {
-	if (v(e) !== "/_voltro/inspect/provenance") return null;
-	let s = u(r.origin ?? r.Origin), l = (a.method ?? "GET").toUpperCase();
-	if (l !== "GET") return c(405, {
-		error: "method not allowed",
-		expected: "GET"
-	}, s);
-	if (i()) return c(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, s);
-	let d = (a.authResolver ?? o)(r, l);
-	if (!d.ok) return c(401, {
-		error: "unauthorized",
-		reason: d.reason
-	}, s);
-	let p = f(a.method, r, s);
-	if (p) return p;
-	if (n.kind !== "api") return c(404, { error: "provenance is api-only" }, s);
-	if (n.inspectRows === void 0) return c(404, { error: "inspectRows not configured" }, s);
-	let m = j(e), h = m.get("table"), g = m.get("id"), _ = m.get("column") ?? void 0;
-	if (!h || !g) return c(400, { error: "query.table and query.id are required" }, s);
-	try {
-		let e = (await n.inspectRows({
-			table: h,
-			limit: 1,
-			filter: {
-				kind: "leaf",
-				column: "id",
-				op: "eq",
-				value: g
-			}
-		})).rows[0];
-		return c(200, t(e, {
-			table: h,
-			id: g,
-			..._ === void 0 ? {} : { column: _ }
-		}), s);
-	} catch (e) {
-		return e?.name === "InspectQueryError" ? c(400, {
-			error: "invalid query",
-			message: e.message
-		}, s) : c(500, {
-			error: "provenance query failed",
-			message: e?.message ?? String(e)
-		}, s);
-	}
-}, j = (e) => {
-	let t = e.indexOf("?");
-	return t < 0 ? new URLSearchParams() : new URLSearchParams(e.slice(t + 1));
-}, M = (e) => {
-	if (e === null || e === "") return;
-	let t = Number(e);
-	return Number.isFinite(t) && t >= 0 ? Math.floor(t) : void 0;
-}, N = async (e, t, n, r = {}) => {
-	if (v(e) !== "/_voltro/inspect/workflows/runs") return null;
-	let a = u(n.origin ?? n.Origin), s = (r.method ?? "GET").toUpperCase();
-	if (s !== "GET") return c(405, {
-		error: "method not allowed",
-		expected: "GET"
-	}, a);
-	if (i()) return c(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, a);
-	let l = (r.authResolver ?? o)(n, s);
-	if (!l.ok) return c(401, {
-		error: "unauthorized",
-		reason: l.reason
-	}, a);
-	if (t.kind !== "api") return c(404, { error: "workflows endpoint is api-only" }, a);
-	if (t.inspectWorkflowRuns === void 0) return c(200, {
-		runs: [],
-		total: 0,
-		offset: 0,
-		limit: 50
-	}, a);
-	let d = j(e);
-	try {
-		let e = d.get("deadLettered") === "1" || d.get("deadLettered") === "true", n = (d.get("statuses") ?? "").split(",").map((e) => e.trim()).filter((e) => e !== "");
-		return c(200, await t.inspectWorkflowRuns({
-			...d.get("tag") === null ? {} : { tag: d.get("tag") },
-			...e ? { deadLettered: !0 } : d.get("status") === null ? n.length > 0 ? { statuses: n } : {} : { status: d.get("status") },
-			...d.get("q") === null ? {} : { tagContains: d.get("q") },
-			...d.get("source") === null ? {} : { source: d.get("source") },
-			...d.get("idPrefix") === null ? {} : { idPrefix: d.get("idPrefix") },
-			...d.get("from") === null ? {} : { startedAfter: d.get("from") },
-			...d.get("to") === null ? {} : { startedBefore: d.get("to") },
-			offset: M(d.get("offset")) ?? 0,
-			limit: M(d.get("limit")) ?? 50
-		}), a);
-	} catch (e) {
-		return c(500, {
-			error: "workflow-runs query failed",
-			message: e?.message ?? String(e)
-		}, a);
-	}
-}, P = async (e, t, n, r = {}) => {
-	if (v(e) !== "/_voltro/inspect/workflows/stats") return null;
-	let a = u(n.origin ?? n.Origin), s = (r.method ?? "GET").toUpperCase();
-	if (s !== "GET") return c(405, {
-		error: "method not allowed",
-		expected: "GET"
-	}, a);
-	if (i()) return c(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, a);
-	let l = (r.authResolver ?? o)(n, s);
-	if (!l.ok) return c(401, {
-		error: "unauthorized",
-		reason: l.reason
-	}, a);
-	if (t.kind !== "api") return c(404, { error: "workflows endpoint is api-only" }, a);
-	if (t.inspectWorkflowRunStats === void 0) return c(200, {
-		windowHours: 24,
-		bucketMinutes: 30,
-		buckets: [],
-		byTag: [],
-		total: 0,
-		truncated: !1
-	}, a);
-	let d = j(e);
-	try {
-		return c(200, await t.inspectWorkflowRunStats({
-			...d.get("tag") === null ? {} : { tag: d.get("tag") },
-			...M(d.get("hours")) === void 0 ? {} : { hours: M(d.get("hours")) }
-		}), a);
-	} catch (e) {
-		return c(500, {
-			error: "workflow-stats query failed",
-			message: e?.message ?? String(e)
-		}, a);
-	}
-}, F = async (e, t, n, r, a = {}) => {
-	let s = v(e).match(/^\/_voltro\/inspect\/workflows\/start\/([^/]+)$/);
-	if (!s) return null;
-	let l = decodeURIComponent(s[1] ?? ""), d = u(n.origin ?? n.Origin), f = (a.method ?? "POST").toUpperCase();
-	if (f !== "POST") return c(405, {
-		error: "method not allowed",
-		expected: "POST"
-	}, d);
-	if (i()) return c(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, d);
-	let p = (a.authResolver ?? o)(n, f);
-	if (!p.ok) return c(401, {
-		error: "unauthorized",
-		reason: p.reason
-	}, d);
-	if (t.kind !== "api") return c(404, { error: "workflow start is api-only" }, d);
-	if (t.inspectStartWorkflow === void 0) return c(404, { error: "inspectStartWorkflow not configured" }, d);
-	let m = {};
-	if (r.length > 0) try {
-		m = JSON.parse(r).payload ?? {};
-	} catch {
-		return c(400, { error: "start requires JSON body `{ payload?: unknown }`" }, d);
-	}
-	try {
-		return c(200, await t.inspectStartWorkflow({
-			name: l,
-			payload: m
-		}), d);
-	} catch (e) {
-		return c(500, {
-			error: "workflow start failed",
-			message: e?.message ?? String(e)
-		}, d);
-	}
-}, I = async (e, t, n, r = {}) => {
-	let a = v(e);
-	if (!a.startsWith("/_voltro/inspect/schedules")) return null;
-	let s = u(n.origin ?? n.Origin);
-	if (i()) return c(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, s);
-	let l = (r.authResolver ?? o)(n, r.method ?? "POST");
-	if (!l.ok) return c(401, {
-		error: "unauthorized",
-		reason: l.reason
-	}, s);
-	let d = f(r.method, n, s);
-	if (d) return d;
-	if (t.kind !== "api") return c(404, { error: "schedules are api-only" }, s);
-	let p = (r.method ?? "GET").toUpperCase(), m = a.match(/^\/_voltro\/inspect\/schedules\/([^/]+)\/backfill$/);
-	if (m) {
-		if (p !== "POST") return c(405, {
-			error: "method not allowed",
-			expected: "POST"
-		}, s);
-		if (!t.inspectBackfillSchedule) return c(404, { error: "inspectBackfillSchedule not configured" }, s);
-		let e = decodeURIComponent(m[1] ?? ""), n;
-		try {
-			n = JSON.parse(r.body ?? "{}");
-		} catch {
-			return c(400, { error: "invalid JSON body — expected { from, to, confirm?, limit? }" }, s);
-		}
-		if (typeof n.from != "string" || typeof n.to != "string") return c(400, { error: "body must carry ISO 'from' and 'to' instants" }, s);
-		try {
-			let r = await t.inspectBackfillSchedule({
-				name: e,
-				from: n.from,
-				to: n.to,
-				confirm: n.confirm === !0,
-				...typeof n.limit == "number" ? { limit: n.limit } : {}
-			});
-			return c(r.kind === "refused" ? 409 : 200, r, s);
-		} catch (e) {
-			return c(500, {
-				error: "backfill failed",
-				message: e?.message ?? String(e)
-			}, s);
-		}
-	}
-	let h = a.match(/^\/_voltro\/inspect\/schedules\/([^/]+)\/fire$/);
-	if (h) {
-		if (p !== "POST") return c(405, {
-			error: "method not allowed",
-			expected: "POST"
-		}, s);
-		if (!t.inspectFireSchedule) return c(404, { error: "inspectFireSchedule not configured" }, s);
-		let n = decodeURIComponent(h[1] ?? ""), r = j(e).get("trigger") === "external" ? "external" : "manual";
-		try {
-			return c(200, await t.inspectFireSchedule({
-				name: n,
-				trigger: r
-			}), s);
-		} catch (e) {
-			return c(500, {
-				error: "fire failed",
-				message: e?.message ?? String(e)
-			}, s);
-		}
-	}
-	if (a === "/_voltro/inspect/schedules/runs") {
-		if (p !== "GET") return c(405, {
-			error: "method not allowed",
-			expected: "GET"
-		}, s);
-		if (!t.inspectScheduleRuns) return c(200, {
-			runs: [],
-			total: 0,
-			offset: 0,
-			limit: 50
-		}, s);
-		let n = j(e);
-		try {
-			return c(200, await t.inspectScheduleRuns({
-				...n.get("name") === null ? {} : { name: n.get("name") },
-				offset: M(n.get("offset")) ?? 0,
-				limit: M(n.get("limit")) ?? 50
-			}), s);
-		} catch (e) {
-			return c(500, {
-				error: "schedule-runs query failed",
-				message: e?.message ?? String(e)
-			}, s);
-		}
-	}
-	return a === "/_voltro/inspect/schedules" ? p === "GET" ? t.inspectSchedules ? c(200, t.inspectSchedules(), s) : c(200, {
-		schedules: [],
-		coordination: "single"
-	}, s) : c(405, {
-		error: "method not allowed",
-		expected: "GET"
-	}, s) : c(404, {
-		error: "unknown schedules endpoint",
-		path: a
-	}, s);
-}, L = async (e, t, n, r = {}) => {
-	if (v(e) !== "/_voltro/inspect/cluster") return null;
-	let a = u(n.origin ?? n.Origin);
-	if (i()) return c(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, a);
-	let s = (r.authResolver ?? o)(n, r.method ?? "POST");
-	if (!s.ok) return c(401, {
-		error: "unauthorized",
-		reason: s.reason
-	}, a);
-	let l = f(r.method, n, a);
-	if (l) return l;
-	if (t.kind !== "api") return c(404, { error: "cluster is api-only" }, a);
-	if ((r.method ?? "GET").toUpperCase() !== "GET") return c(405, {
-		error: "method not allowed",
-		expected: "GET"
-	}, a);
-	if (!t.cluster) return c(200, {
-		instance: {
-			replicaId: process.env.POD_NAME ?? process.env.HOSTNAME ?? `dev-${process.pid}`,
-			dialect: "memory",
-			runnerHost: "localhost",
-			runnerPort: 0,
-			runnerStorage: "none",
-			shardLock: "none",
-			coordination: "single",
-			cdc: {
-				enabled: !1,
-				flavor: "none (single-process)"
-			},
-			tier: "none",
-			localhostRisk: !1
-		},
-		coordinationState: {
-			recentReplicaIds: [],
-			scheduleClaims: [],
-			runningScheduleRuns: 0,
-			runningWorkflowRuns: 0
-		},
-		capturedAt: Date.now()
-	}, a);
-	try {
-		return c(200, await t.cluster(), a);
-	} catch (e) {
-		return c(500, {
-			error: "cluster snapshot failed",
-			message: e?.message ?? String(e)
-		}, a);
-	}
-}, R = async (e, t, n, r = {}) => {
-	let a = v(e).match(/^\/_voltro\/inspect\/workflows\/runs\/([^/]+)\/steps$/);
-	if (!a) return null;
-	let s = decodeURIComponent(a[1] ?? ""), l = u(n.origin ?? n.Origin), d = (r.method ?? "GET").toUpperCase();
-	if (d !== "GET") return c(405, {
-		error: "method not allowed",
-		expected: "GET"
-	}, l);
-	if (i()) return c(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, l);
-	let f = (r.authResolver ?? o)(n, d);
-	if (!f.ok) return c(401, {
-		error: "unauthorized",
-		reason: f.reason
-	}, l);
-	if (t.kind !== "api") return c(404, { error: "workflow steps are api-only" }, l);
-	if (t.inspectWorkflowRunSteps === void 0) return c(200, { steps: [] }, l);
-	try {
-		return c(200, await t.inspectWorkflowRunSteps({ runId: s }), l);
-	} catch (e) {
-		return c(500, {
-			error: "steps query failed",
-			message: e?.message ?? String(e)
-		}, l);
-	}
-}, z = async (e, t, n, r = {}) => {
-	let a = v(e).match(/^\/_voltro\/inspect\/workflows\/runs\/([^/]+)\/events$/);
-	if (!a) return null;
-	let s = decodeURIComponent(a[1] ?? ""), l = u(n.origin ?? n.Origin), d = (r.method ?? "GET").toUpperCase();
-	if (d !== "GET") return c(405, {
-		error: "method not allowed",
-		expected: "GET"
-	}, l);
-	if (i()) return c(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, l);
-	let f = (r.authResolver ?? o)(n, d);
-	if (!f.ok) return c(401, {
-		error: "unauthorized",
-		reason: f.reason
-	}, l);
-	if (t.kind !== "api") return c(404, { error: "workflow events are api-only" }, l);
-	if (t.inspectWorkflowRunEvents === void 0) return c(200, { events: [] }, l);
-	try {
-		return c(200, await t.inspectWorkflowRunEvents({ runId: s }), l);
-	} catch (e) {
-		return c(500, {
-			error: "events query failed",
-			message: e?.message ?? String(e)
-		}, l);
-	}
-}, B = async (e, t, n, r = {}) => {
-	if (v(t) !== "/_voltro/inspect/workflows/events") return null;
-	let a = u(n.origin ?? n.Origin), s = (r.method ?? "GET").toUpperCase();
-	if (s !== "GET") return c(405, {
-		error: "method not allowed",
-		expected: "GET"
-	}, a);
-	if (i()) return c(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, a);
-	let l = (r.authResolver ?? o)(n, s);
-	if (!l.ok) return c(401, {
-		error: "unauthorized",
-		reason: l.reason
-	}, a);
-	if (e.kind !== "api") return c(404, { error: "workflow domain events are api-only" }, a);
-	if (e.inspectWorkflowDomainEvents === void 0) return c(200, {
-		events: [],
-		total: 0,
-		offset: 0,
-		limit: 100
-	}, a);
-	let d = y(t), f = d.get("name") ?? void 0, p = Number(d.get("offset") ?? "0"), m = Number(d.get("limit") ?? "100");
-	try {
-		return c(200, await e.inspectWorkflowDomainEvents({
-			...f !== void 0 && f !== "" ? { name: f } : {},
-			offset: Number.isFinite(p) ? p : 0,
-			limit: Number.isFinite(m) ? m : 100
-		}), a);
-	} catch (e) {
-		return c(500, {
-			error: "workflow domain events query failed",
-			message: e?.message ?? String(e)
-		}, a);
-	}
-}, V = async (e, t, n, r = {}) => {
-	let a = v(t).match(/^\/_voltro\/inspect\/workflows\/events\/([^/]+)\/deliveries$/);
-	if (!a) return null;
-	let s = decodeURIComponent(a[1] ?? ""), l = u(n.origin ?? n.Origin), d = (r.method ?? "GET").toUpperCase();
-	if (d !== "GET") return c(405, {
-		error: "method not allowed",
-		expected: "GET"
-	}, l);
-	if (i()) return c(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, l);
-	let f = (r.authResolver ?? o)(n, d);
-	if (!f.ok) return c(401, {
-		error: "unauthorized",
-		reason: f.reason
-	}, l);
-	if (e.kind !== "api") return c(404, { error: "workflow event deliveries are api-only" }, l);
-	if (e.inspectWorkflowEventDeliveries === void 0) return c(200, { deliveries: [] }, l);
-	try {
-		return c(200, await e.inspectWorkflowEventDeliveries({ eventId: s }), l);
-	} catch (e) {
-		return c(500, {
-			error: "workflow event deliveries query failed",
-			message: e?.message ?? String(e)
-		}, l);
-	}
-}, H = async (e, t, n, r = {}) => {
-	if (v(e) !== "/_voltro/inspect/workflows/children") return null;
-	let a = u(n.origin ?? n.Origin), s = (r.method ?? "GET").toUpperCase();
-	if (s !== "GET") return c(405, {
-		error: "method not allowed",
-		expected: "GET"
-	}, a);
-	if (i()) return c(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, a);
-	let l = (r.authResolver ?? o)(n, s);
-	if (!l.ok) return c(401, {
-		error: "unauthorized",
-		reason: l.reason
-	}, a);
-	if (t.kind !== "api") return c(404, { error: "workflow children are api-only" }, a);
-	let d = j(e).get("parentExecutionId");
-	if (d === null || d === "") return c(400, { error: "parentExecutionId query param required" }, a);
-	if (t.inspectWorkflowChildren === void 0) return c(200, {
-		runs: [],
-		total: 0,
-		offset: 0,
-		limit: 200
-	}, a);
-	try {
-		return c(200, await t.inspectWorkflowChildren({ parentExecutionId: d }), a);
-	} catch (e) {
-		return c(500, {
-			error: "children query failed",
-			message: e?.message ?? String(e)
-		}, a);
-	}
-}, U = async (e, t, n, r, a = {}) => {
-	let s = v(e).match(/^\/_voltro\/inspect\/workflows\/runs\/([^/]+)\/(cancel|retry|suspend|resume-from-step|resume|signal|update|discard|redrive)$/);
-	if (!s) return null;
-	let l = decodeURIComponent(s[1] ?? ""), d = s[2], f = u(n.origin ?? n.Origin), p = (a.method ?? "POST").toUpperCase();
-	if (p !== "POST") return c(405, {
-		error: "method not allowed",
-		expected: "POST"
-	}, f);
-	if (i()) return c(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, f);
-	let m = (a.authResolver ?? o)(n, p);
-	if (!m.ok) return c(401, {
-		error: "unauthorized",
-		reason: m.reason
-	}, f);
-	if (t.kind !== "api") return c(404, { error: "workflow actions are api-only" }, f);
-	let h = {
-		cancel: t.inspectCancelWorkflowRun,
-		retry: t.inspectRetryWorkflowRun,
-		suspend: t.inspectSuspendWorkflowRun,
-		resume: t.inspectResumeWorkflowRun,
-		signal: t.inspectSignalWorkflowRun,
-		update: t.inspectUpdateWorkflowRun,
-		discard: t.inspectDiscardWorkflowRun,
-		redrive: t.inspectRedriveWorkflowRun,
-		"resume-from-step": t.inspectResumeWorkflowRunFromStep
-	}[d];
-	if (!h) return c(404, { error: d === "resume-from-step" ? "inspectResumeWorkflowRunFromStep not configured" : `inspect${d[0]?.toUpperCase() ?? ""}${d.slice(1)}WorkflowRun not configured` }, f);
-	let g, _, y, b, x, S, C;
-	if (r.length > 0) try {
-		let e = JSON.parse(r);
-		d === "retry" && (g = e.payloadOverride), d === "resume-from-step" && typeof e.step == "string" && e.step.length > 0 && (C = e.step), d === "signal" && (typeof e.signalName == "string" && e.signalName.length > 0 && (_ = e.signalName), y = e.payload), d === "update" && (typeof e.updateName == "string" && e.updateName.length > 0 && (b = e.updateName), x = e.payload, typeof e.timeoutMs == "number" && Number.isFinite(e.timeoutMs) && (S = e.timeoutMs));
-	} catch {}
-	if (d === "signal" && _ === void 0) return c(400, { error: "signal requires JSON body `{ signalName: string, payload?: unknown }`" }, f);
-	if (d === "update" && b === void 0) return c(400, { error: "update requires JSON body `{ updateName: string, payload?: unknown, timeoutMs?: number }`" }, f);
-	if (d === "resume-from-step" && C === void 0) return c(400, { error: "resume-from-step requires JSON body `{ step: string }` (the step name to rewind to)" }, f);
-	try {
-		return c(200, d === "retry" && g !== void 0 ? await h({
-			runId: l,
-			payloadOverride: g
-		}) : d === "signal" ? await h({
-			runId: l,
-			signalName: _,
-			payload: y
-		}) : d === "update" ? await h({
-			runId: l,
-			updateName: b,
-			payload: x,
-			...S === void 0 ? {} : { timeoutMs: S }
-		}) : d === "resume-from-step" ? await h({
-			runId: l,
-			step: C
-		}) : await h({ runId: l }), f);
-	} catch (e) {
-		return c(500, {
-			error: `${d} failed`,
-			message: e?.message ?? String(e)
-		}, f);
-	}
-}, W = async (e, t, n, r, a = {}) => {
-	if (v(e) !== "/_voltro/inspect/data/import" || (a.method ?? "POST").toUpperCase() !== "POST") return null;
-	let s = u(n.origin ?? n.Origin);
-	if (i()) return c(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, s);
-	let l = (a.authResolver ?? o)(n, "POST");
-	if (!l.ok) return c(401, {
-		error: "unauthorized",
-		reason: l.reason
-	}, s);
-	let d = f(a.method, n, s);
-	if (d) return d;
-	if (t.kind !== "api") return c(404, { error: "data import is api-only" }, s);
-	if (!t.inspectImport) return c(404, { error: "inspectImport not configured" }, s);
-	let p;
-	try {
-		p = JSON.parse(r || "{}");
-	} catch {
-		return c(400, { error: "body must be JSON" }, s);
-	}
-	if (typeof p.bundleDir != "string" || !p.bundleDir) return c(400, { error: "body.bundleDir (string) is required" }, s);
-	try {
-		return c(200, await t.inspectImport({
-			bundleDir: p.bundleDir,
-			...p.mode === "upsert" || p.mode === "append" || p.mode === "replace" ? { mode: p.mode } : {},
-			...p.onConflict === "skip" || p.onConflict === "fail" ? { onConflict: p.onConflict } : {},
-			...typeof p.atomic == "boolean" ? { atomic: p.atomic } : {}
-		}), s);
-	} catch (e) {
-		return c(500, {
-			error: "import failed",
-			message: e?.message ?? String(e)
-		}, s);
-	}
-}, G = async (e, t, n, r, a = {}) => {
-	let s = v(e);
-	if (!s.startsWith("/_voltro/inspect/data/rows")) return null;
-	let l = (a.method ?? "POST").toUpperCase();
-	if (l === "GET" && s === "/_voltro/inspect/data/rows") return null;
-	let d = u(n.origin ?? n.Origin);
-	if (i()) return c(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, d);
-	let f = (a.authResolver ?? o)(n, l);
-	if (!f.ok) return c(401, {
-		error: "unauthorized",
-		reason: f.reason
-	}, d);
-	if (t.kind !== "api") return c(404, { error: "data viewer is api-only" }, d);
-	if (l === "POST" && s === "/_voltro/inspect/data/rows") {
-		if (!t.inspectInsertRow) return c(404, { error: "inspectInsertRow not configured" }, d);
-		let e;
-		try {
-			e = JSON.parse(r || "{}");
-		} catch {
-			return c(400, { error: "body must be JSON" }, d);
-		}
-		if (typeof e.table != "string" || !e.row || typeof e.row != "object") return c(400, { error: "body must be { table: string, row: object }" }, d);
-		try {
-			return c(200, await t.inspectInsertRow({
-				table: e.table,
-				row: e.row
-			}), d);
-		} catch (e) {
-			return c(500, {
-				error: "insert failed",
-				message: e?.message ?? String(e)
-			}, d);
-		}
-	}
-	let p = s.match(/^\/_voltro\/inspect\/data\/rows\/([^/]+)$/);
-	if (!p) return null;
-	let m = decodeURIComponent(p[1] ?? "");
-	if (!m) return c(400, { error: "row id is required in URL" }, d);
-	let h = j(e).get("table") ?? "";
-	if (!h) return c(400, { error: "query.table is required" }, d);
-	if (l === "PATCH") {
-		if (!t.inspectUpdateRow) return c(404, { error: "inspectUpdateRow not configured" }, d);
-		let e;
-		try {
-			e = JSON.parse(r || "{}");
-		} catch {
-			return c(400, { error: "body must be JSON" }, d);
-		}
-		if (!e.patch || typeof e.patch != "object") return c(400, { error: "body.patch must be an object" }, d);
-		try {
-			return c(200, await t.inspectUpdateRow({
-				table: h,
-				id: m,
-				patch: e.patch
-			}), d);
-		} catch (e) {
-			return c(500, {
-				error: "update failed",
-				message: e?.message ?? String(e)
-			}, d);
-		}
-	}
-	if (l === "DELETE") {
-		if (!t.inspectDeleteRow) return c(404, { error: "inspectDeleteRow not configured" }, d);
-		try {
-			return c(200, await t.inspectDeleteRow({
-				table: h,
-				id: m
-			}), d);
-		} catch (e) {
-			return c(500, {
-				error: "delete failed",
-				message: e?.message ?? String(e)
-			}, d);
-		}
-	}
-	return c(405, {
-		error: "method not allowed",
-		expected: "POST | PATCH | DELETE"
-	}, d);
-}, K = async (e, t, n, a, s = {}) => {
-	let l = v(e), d = `${r}/workflows/flow-control`;
-	if (l !== d && !l.startsWith(`${d}/`)) return null;
-	let f = u(n.origin ?? n.Origin), p = (s.method ?? "GET").toUpperCase();
-	if (i()) return c(503, { error: "inspect disabled (VOLTRO_INSPECT=off)" }, f);
-	let m = (s.authResolver ?? o)(n, p);
-	if (!m.ok) return c(401, {
-		error: "unauthorized",
-		reason: m.reason
-	}, f);
-	if (t.kind !== "api") return c(404, { error: "flow control is api-only" }, f);
-	if (l === `${d}/inferences`) {
-		if (p !== "GET") return c(405, {
-			error: "method not allowed",
-			expected: "GET"
-		}, f);
-		if (t.inspectInferences === void 0) return c(404, { error: "inspectInferences not configured" }, f);
-		let n = j(e).get("limit"), r = n === null ? void 0 : Number(n);
-		try {
-			return c(200, await t.inspectInferences(r !== void 0 && Number.isFinite(r) ? { limit: r } : {}), f);
-		} catch (e) {
-			return c(500, {
-				error: "inference queue read failed",
-				message: e?.message ?? String(e)
-			}, f);
-		}
-	}
-	if (l === d) {
-		if (p !== "GET") return c(405, {
-			error: "method not allowed",
-			expected: "GET"
-		}, f);
-		if (t.inspectFlowControl === void 0) return c(404, { error: "inspectFlowControl not configured" }, f);
-		let n = j(e).get("limit"), r = n === null ? void 0 : Number(n);
-		try {
-			return c(200, await t.inspectFlowControl(r !== void 0 && Number.isFinite(r) ? { limit: r } : {}), f);
-		} catch (e) {
-			return c(500, {
-				error: "flow control read failed",
-				message: e?.message ?? String(e)
-			}, f);
-		}
-	}
-	if (p !== "POST") return c(405, {
-		error: "method not allowed",
-		expected: "POST"
-	}, f);
-	let h = {};
-	if (a.length > 0) try {
-		h = JSON.parse(a);
-	} catch {
-		return c(400, { error: "expected a JSON body" }, f);
-	}
-	let g = l.slice(d.length + 1);
-	try {
-		if (g === "pause") return t.inspectPauseWorkflow === void 0 ? c(404, { error: "inspectPauseWorkflow not configured" }, f) : h.workflow ? c(200, await t.inspectPauseWorkflow({
-			workflow: h.workflow,
-			...h.reason === void 0 ? {} : { reason: h.reason }
-		}), f) : c(400, { error: "body.workflow is required" }, f);
-		if (g === "resume") return t.inspectResumeWorkflow === void 0 ? c(404, { error: "inspectResumeWorkflow not configured" }, f) : h.workflow ? c(200, await t.inspectResumeWorkflow({ workflow: h.workflow }), f) : c(400, { error: "body.workflow is required" }, f);
-		if (g === "discard") return t.inspectDiscardIntent === void 0 ? c(404, { error: "inspectDiscardIntent not configured" }, f) : h.intentId ? c(200, await t.inspectDiscardIntent({ intentId: h.intentId }), f) : c(400, { error: "body.intentId is required" }, f);
-		if (g === "bulk") {
-			if (t.inspectBulkWorkflowRuns === void 0) return c(404, { error: "inspectBulkWorkflowRuns not configured" }, f);
-			if (h.op !== "cancel" && h.op !== "replay") return c(400, { error: "body.op must be 'cancel' or 'replay'" }, f);
-			if (typeof h.limit != "number") return c(400, { error: "body.limit is required — a bulk operation has no unbounded form, the cap IS the blast radius. The response reports `truncated` when more matched." }, f);
-			try {
-				return c(200, await t.inspectBulkWorkflowRuns({
-					op: h.op,
-					limit: h.limit,
-					...h.reason === void 0 ? {} : { reason: h.reason },
-					...h.mode === void 0 ? {} : { mode: h.mode },
-					...h.dryRun === void 0 ? {} : { dryRun: h.dryRun },
-					...h.workflow === void 0 ? {} : { workflow: h.workflow },
-					...h.status === void 0 ? {} : { status: h.status },
-					...h.startedAfter === void 0 ? {} : { startedAfter: h.startedAfter },
-					...h.startedBefore === void 0 ? {} : { startedBefore: h.startedBefore }
-				}), f);
-			} catch (e) {
-				if (e?.name === "BulkRequestError") return c(400, { error: e.message }, f);
-				throw e;
-			}
-		}
-	} catch (e) {
-		return c(500, {
-			error: "flow control action failed",
-			message: e?.message ?? String(e)
-		}, f);
-	}
-	return c(404, {
-		error: `unknown flow-control action '${g}'`,
-		expected: [
-			"pause",
-			"resume",
-			"discard",
-			"bulk"
-		]
-	}, f);
-};
-//#endregion
-export { i as A, P as C, u as D, F as E, p as M, _ as N, g as O, s as P, z as S, N as T, D as _, o as a, B as b, W as c, K as d, O as f, I as g, C as h, f as i, l as j, d as k, k as l, A as m, x as n, E as o, T as p, S as r, L as s, r as t, G as u, U as v, R as w, V as x, H as y };