create-safest-tools 0.2.0

package/template/src/index.ts

@@ -0,0 +1,4114 @@
+import { canonicalJson } from "./audit";
+import { decodeApiCursor, encodeApiCursor } from "./api-cursor";
+import {
+  assertBackupTransferAllowed,
+  backupBucket,
+  finalizeBackup,
+  listBackupObjects,
+  listBackups,
+  parseBackupBucket,
+  parseBackupCompletion,
+  readBackupObject,
+  startBackup,
+} from "./backup-service";
+import {
+  assertOperatorQueueAccess,
+  assertOperatorReportAccess,
+  assertOperatorWorkflowRunAccess,
+  projectOperatorFields,
+  requireIntegration,
+  requireOperator,
+  resolveInfrastructureOwnerIdentity,
+  appendOperatorAuthenticationCookies,
+  resolveOperatorAuthentication,
+  resolveOperatorSession,
+} from "./report-auth";
+import {
+  callBetterAuth,
+  configuredAuthProviders,
+  handleBetterAuthRequest,
+  inspectInvitation,
+  invitationAllowsEmail,
+  invitationIdFromRequest,
+  revokeBetterAuthSessionsForOperator,
+  sendOperatorInvitationEmail,
+} from "./report-better-auth";
+import {
+  type AiBinding,
+  escalateExpiredAiWaits,
+  markAiJobEnqueued,
+  markAiJobUnexpectedFailure,
+  pendingAiJobs,
+  processAiJob,
+  RetryableAiError,
+} from "./report-ai";
+import {
+  claimAiQualitySample,
+  listAiQualitySamples,
+  loadAiQualitySample,
+  parseQualityReview,
+  recordAiQualityReview,
+} from "./report-ai-quality";
+import { sha256, signContextToken, verifyContextToken } from "./report-crypto";
+import { createStoredReportContext, loadStoredReportContext, pruneReportContexts } from "./report-context";
+import { parseContextSchema, routingContextFacts, validateContextFacts } from "./report-context-schema";
+import { pendingDeliveryJobs, processDeliveryJob, RetryableDeliveryError } from "./report-delivery";
+import { ApiError, allowedOrigin, apiErrorResponse, json, methodNotAllowed, readJsonObject, withCors } from "./report-http";
+import {
+  cancelHumanTask,
+  claimHumanTask,
+  listHumanTasks,
+  loadHumanTask,
+  reassignHumanTask,
+  releaseHumanTaskClaim,
+  respondToHumanTask,
+} from "./human-tasks";
+import {
+  closeAssistantSession,
+  createAssistantSession,
+  loadAssistantDraft,
+  loadAssistantHistory,
+  loadAssistantToolCall,
+  markAssistantDraftAdopted,
+  sendAssistantMessage,
+} from "./assistant";
+import {
+  createDeletionRequest,
+  createLegalHold,
+  listAuditEntries,
+  loadAnalytics,
+  processDeletionRequests,
+  recordExportAudit,
+  refreshDailyAggregatesIfStale,
+  releaseLegalHold,
+  reportsCsv,
+  runRetentionIfDue,
+  verifyAuditChain,
+} from "./report-governance";
+import {
+  createAgent,
+  createModelAlias,
+  listAgents,
+  listBudgets,
+  listModelAliases,
+  listPrompts,
+  publishAgentVersion,
+  publishBudget,
+  publishModelAliasVersion,
+  publishPrompt,
+} from "./ai-registry";
+import {
+  parseAgentCreate,
+  parseAgentVersion,
+  parseBudgetPublication,
+  parseModelAliasCreate,
+  parseModelAliasVersion,
+  parsePromptPublication,
+} from "./ai-registry-validation";
+import { listAgentVersions, listAiRuns, loadAiRun, loadAiUsage } from "./ai-observability";
+import {
+  acknowledgeOperationsIncident,
+  beginReconciliationRun,
+  finishReconciliationRun,
+  listDeadLetters,
+  listOperationsIncidents,
+  loadOperationsIncident,
+  loadOperationsSnapshot,
+  repairStaleOperationalLeases,
+  recordDeadLetter,
+  resolveOperationsIncident,
+  retryOperationsIncident,
+} from "./report-operations";
+import {
+  appendOperatorSessionCookies,
+  bootstrapOwner,
+  clearOperatorSessionCookies,
+  createOperatorInvitation,
+  deleteOperatorProfilePicture,
+  listOperatorPeople,
+  logoutOperator,
+  operatorProfilePictureResponse,
+  revokeOperatorInvitation,
+  revokeOperatorSessions,
+  resolveBetterAuthOperator,
+  updateOperatorUser,
+  updateOperatorProfile,
+  uploadOperatorProfilePicture,
+} from "./report-operator-accounts";
+import { createQueue, listQueues, loadQueue, publishQueuePolicy, updateQueue } from "./report-queues";
+import { parseQueueCreate, parseQueuePolicy, parseQueueUpdate } from "./report-queue-validation";
+import { activeRoutingAgent, listRoutingAgents, publishRoutingAgent, validateRoutingAgentOutput } from "./report-router-agent";
+import { parseRoutingAgentConfiguration } from "./report-router-validation";
+import {
+  listAnalystPresence,
+  parsePresenceHeartbeat,
+  pruneStaleAnalystSessions,
+  recordAnalystAuthentication,
+  touchAnalystSession,
+} from "./report-presence";
+import {
+  createReport,
+  integrationAllowsOrigin,
+  installationAllowsWidgetOrigin,
+  type InboxCursor,
+  listInboxReports,
+  loadContextReportReplay,
+  loadIntegration,
+  markJobEnqueueFailed,
+  markJobEnqueued,
+  pendingRoutingJobs,
+  processRoutingJob,
+  publicForm,
+} from "./report-repository";
+import type { ActionProposalJob, AiJob, ContextClaims, DeliveryJob, EvidenceFetchJob, ReportJob, ReportState, WorkflowDispatchJob } from "./report-types";
+import { enforcePublicRateLimit, turnstileConfig, verifyPublicTurnstile, verifyTurnstile } from "./report-turnstile";
+import { parseContextMintInput, parsePublicReport, parseServerReport, parseWidgetReport } from "./report-validation";
+import {
+  addReviewerMessage,
+  chainPendingAuditEvents,
+  claimAppeal,
+  claimReport,
+  decideAppeal,
+  listAppeals,
+  loadAppealDetail,
+  loadReportDetail,
+  recordHumanDecision,
+  releaseAppealClaim,
+  releaseReportClaim,
+} from "./report-workflow";
+import {
+  closeReport,
+  listReportActions,
+  listReportFindings,
+  loadDecisionDetail,
+  loadReportTimeline,
+  reassignReport,
+  reopenReport,
+} from "./report-admin";
+import { parseAppealDecision, parseDecision, parseReviewerMessage } from "./report-workflow-validation";
+import {
+  parseComponentCreate,
+  parseComponentVersion,
+  parseConnectionCreate,
+  parseConnectionVersion,
+} from "./platform-registry-validation";
+import {
+  componentDependencies,
+  connectionDependencies,
+  createComponent,
+  createConnection,
+  listComponents,
+  listConnections,
+  loadComponent,
+  loadConnection,
+  publishComponentVersion,
+  publishConnectionVersion,
+  setComponentStatus,
+  setConnectionStatus,
+  testComponentDefinition,
+  updateComponentDefinition,
+  updateConnectionDefinition,
+  validateComponentDefinition,
+  validateConnectionDefinition,
+} from "./platform-registry";
+import { ConnectionExecutionError, executeConnectionJson } from "./connection-egress";
+import { completeConnectionOAuth, pruneConnectionOAuthStates, revokeConnectionOAuth, startConnectionOAuth } from "./connection-oauth";
+import { ComponentExecutionError, executeAssistantReadOnlyComponent, executeRoutingReadOnlyComponent } from "./component-executor";
+import { maintainIntakeProtection } from "./intake-abuse";
+import {
+  acceptEvidenceResponse,
+  createEvidenceSnapshot,
+  listReportEvidence,
+  pendingEvidenceFetchJobs,
+  processEvidenceFetch,
+  readEvidenceContent,
+  requestEvidenceFetch,
+  RetryableEvidenceError,
+} from "./evidence-service";
+import { releaseExpiredBudgetReservations } from "./budget-control";
+import {
+  acceptActionResult,
+  decideActionProposal,
+  loadActionProposalDetail,
+  pendingActionProposalJobs,
+  processActionProposalJob,
+  proposeCompensatingAction,
+  reconcileActionProposalEvents,
+  retryActionProposal,
+  RetryableActionProposalError,
+} from "./workflow-actions";
+import type { JsonObject, JsonValue, WorkflowAuthorityMode } from "./workflow-platform-types";
+import { validateJsonSchemaValue } from "./workflow-expressions";
+import {
+  parseWorkflowDefinition,
+  parseWorkflowGraph,
+  parseWorkflowPublish,
+} from "./workflow-platform-validation";
+import {
+  createWorkflowFixture,
+  createWorkflowDefinition,
+  deleteWorkflowFixture,
+  diffWorkflowVersion,
+  listWorkflowFixtures,
+  listWorkflowDefinitions,
+  loadWorkflowTestRun,
+  loadWorkflowVersion,
+  loadQueueWorkflowPins,
+  loadWorkflowDefinition,
+  pinQueueWorkflow,
+  publishWorkflowDraft,
+  replaceWorkflowDraft,
+  retireWorkflowVersion,
+  runWorkflowFixtureTest,
+  updateWorkflowFixture,
+  validateWorkflowDraft,
+} from "./workflow-repository";
+import {
+  controlWorkflowRun,
+  createPinnedWorkflowRun,
+  listWorkflowRuns,
+  loadWorkflowRun,
+  pendingWorkflowDispatchJobs,
+  processWorkflowDispatchJob,
+  reconcileWorkflowRun,
+  RetryableWorkflowDispatchError,
+  sendWorkflowEvent,
+} from "./workflow-runs";
+import {
+  compareCompletedShadowRuns,
+  createShadowQualityTask,
+  dismissShadowComparison,
+  listShadowComparisons,
+} from "./shadow-quality";
+import {
+  createConfigurationDraft,
+  listConfigurations,
+  listPublishedForms,
+  loadConfiguration,
+  publishConfiguration,
+  renderTemplatePreview,
+  type ConfigurationType,
+  updateConfigurationDraft,
+  validateStoredConfiguration,
+} from "./configuration-registry";
+import {
+  createIntegration,
+  listIntegrations,
+  loadInstallation,
+  loadIntegrationAdmin,
+  metaVersion,
+  revokeIntegrationKeys,
+  rotateIntegrationKey,
+  updateInstallation,
+  updateIntegration,
+  verifyFeature,
+} from "./installation-admin";
+import { loadWorkspaceBrand } from "./workspace-branding";
+import {
+  createExport,
+  createSavedView,
+  deleteSavedView,
+  downloadExport,
+  expireExports,
+  listDeletionRequests,
+  listExports,
+  listLegalHolds,
+  listSavedViews,
+  loadExport,
+  loadWorkflowAnalytics,
+  previewRetention,
+  retentionOverview,
+  searchWorkspace,
+  updateSavedView,
+} from "./workspace-governance";
+
+export { WorkspacePresence } from "./report-presence";
+export {
+  DynamicWorkflow,
+  DynamicWorkflowBinding,
+  WorkflowRuntimeCapability,
+} from "./workflow-dynamic-runtime";
+
+const reportStates = new Set<ReportState>([
+  "received", "human_review", "ai_review", "awaiting_reporter", "resolved_by_human",
+  "resolved_by_ai", "human_review_requested", "appealed", "closed",
+]);
+const EXPECTED_DATABASE_MIGRATIONS = 41;
+
+function integer(value: string | undefined, fallback: number, minimum: number, maximum: number): number {
+  const parsed = Number.parseInt(value ?? "", 10);
+  return Number.isFinite(parsed) ? Math.max(minimum, Math.min(maximum, parsed)) : fallback;
+}
+
+function publicBaseUrl(env: Env): string {
+  try {
+    const url = new URL(env.PUBLIC_BASE_URL);
+    const local = url.hostname === "localhost" || url.hostname === "127.0.0.1";
+    if ((url.protocol !== "https:" && !(local && url.protocol === "http:")) || url.username || url.password
+      || url.pathname !== "/" || url.search || url.hash) throw new Error("invalid public origin");
+    return url.origin;
+  } catch {
+    throw new ApiError(503, "public_url_misconfigured", "PUBLIC_BASE_URL is not configured as a valid deployment origin.");
+  }
+}
+
+function receiptJson(receipt: Awaited<ReturnType<typeof createReport>>["receipt"]): Record<string, unknown> {
+  return {
+    schema_version: "1",
+    report_id: receipt.reportId,
+    reference: receipt.reference,
+    state: receipt.state,
+    received_at: receipt.receivedAt,
+    updates_via: "email_or_customer_webhook",
+    idempotent_replay: receipt.idempotentReplay,
+  };
+}
+
+function queueRoutingJob(env: Env, ctx: ExecutionContext, jobId: string, reportId: string): void {
+  const job: ReportJob = { version: 1, jobId, type: "route_report", reportId };
+  ctx.waitUntil((async () => {
+    try {
+      await env.REPORT_JOBS.send(job, { contentType: "json" });
+      await markJobEnqueued(env.DB, jobId);
+    } catch (error) {
+      console.error("report routing enqueue failed", { jobId, errorType: error instanceof Error ? error.name : typeof error });
+      await markJobEnqueueFailed(env.DB, jobId, "queue_send_failed");
+    }
+  })());
+}
+
+function queueDeliveryJobs(env: Env, ctx: ExecutionContext, jobs: DeliveryJob[]): void {
+  if (!jobs.length) return;
+  ctx.waitUntil((async () => {
+    try {
+      await env.DELIVERY_JOBS.sendBatch(jobs.map((job) => ({ body: job, contentType: "json" as const })));
+    } catch (error) {
+      console.error("outbox delivery enqueue failed; scheduled reconciliation will retry", {
+        jobCount: jobs.length,
+        errorType: error instanceof Error ? error.name : typeof error,
+      });
+    }
+  })());
+}
+
+function publishWorkspaceEvent(
+  env: Env,
+  ctx: ExecutionContext,
+  event: { type: "claim_changed" | "reports_changed"; reportId?: string },
+): void {
+  ctx.waitUntil(env.WORKSPACE_PRESENCE.getByName("default").publish(event).catch((error: unknown) => {
+    console.error("workspace presence publish failed", {
+      eventType: event.type,
+      reportId: event.reportId,
+      errorType: error instanceof Error ? error.name : typeof error,
+    });
+  }));
+}
+
+function deliveryOptions(env: Env) {
+  return {
+    notificationEnabled: Boolean(env.NOTIFICATION_WEBHOOK_URL?.trim() && env.NOTIFICATION_WEBHOOK_SECRET?.trim()),
+  };
+}
+
+function intakeDeliveryOptions(env: Env) {
+  const emailBinding = (env as unknown as { EMAIL?: unknown }).EMAIL;
+  return {
+    contactEncryptionKey: env.CREDENTIAL_ENCRYPTION_KEY,
+    emailEnabled: Boolean(emailBinding && env.EMAIL_FROM_ADDRESS?.trim()),
+    notificationEnabled: Boolean(env.NOTIFICATION_WEBHOOK_URL?.trim() && env.NOTIFICATION_WEBHOOK_SECRET?.trim()),
+  };
+}
+
+function configuredAiBinding(env: Env): AiBinding | undefined {
+  if (env.AI_LOCAL_FIXTURE_ENABLED === "true") {
+    const origin = new URL(publicBaseUrl(env));
+    if (origin.hostname !== "localhost" && origin.hostname !== "127.0.0.1") {
+      console.error("local AI fixture ignored outside localhost");
+      return undefined;
+    }
+    return {
+      async run() {
+        const fixture: unknown = JSON.parse(env.AI_LOCAL_FIXTURE_JSON);
+        return fixture;
+      },
+    };
+  }
+  return env.AI;
+}
+
+async function handleContextToken(request: Request, env: Env): Promise<Response> {
+  if (request.method !== "POST") return methodNotAllowed(["POST"]);
+  const integration = await requireIntegration(request, env);
+  if (!integration.scopes.includes("mint_context_tokens")) throw new ApiError(403, "integration_scope_denied", "The integration cannot mint context tokens.");
+  if (integration.channelMode !== "contextual") throw new ApiError(403, "integration_mode_denied", "This reporting channel does not accept authenticated context.");
+  const input = parseContextMintInput(await readJsonObject(request, 32 * 1024));
+  if (!input.reporter.reference) throw new ApiError(400, "authenticated_reporter_required", "A signed-in reporting channel must identify the reporter from the customer backend session.", { field: "reporter.reference" });
+  if (!input.origin) throw new ApiError(400, "widget_origin_required", "origin is required when minting widget context.", { field: "origin" });
+  if (!integration.allowedOrigins.includes(input.origin)) {
+    throw new ApiError(403, "origin_not_allowed", "The widget origin is not allowed for this integration.");
+  }
+  const formVersionId = integration.formVersionId || input.formVersionId || "general-v1";
+  if (integration.formVersionId && input.formVersionId && integration.formVersionId !== input.formVersionId) {
+    throw new ApiError(400, "integration_form_mismatch", "This reporting channel is connected to a different published form.");
+  }
+  if (!await publicForm(env.DB, formVersionId)) throw new ApiError(404, "form_not_found", "The report form is not available.");
+  const contextSchema = parseContextSchema(integration.contextSchema, { allowLegacy: true });
+  validateContextFacts(input.trustedFacts, contextSchema);
+  const issuedAt = Math.floor(Date.now() / 1000);
+  const ttl = integer(env.CONTEXT_TOKEN_TTL_SECONDS, 300, 60, 900);
+  const expiresAt = new Date((issuedAt + ttl) * 1_000).toISOString();
+  const storedContext = await createStoredReportContext(env.DB, { ...input, origin: input.origin }, {
+    integrationId: integration.id,
+    formVersionId,
+    contextSchemaVersion: contextSchema.version,
+    routingFacts: routingContextFacts(input.trustedFacts, contextSchema),
+    expiresAt,
+  });
+  const claims: ContextClaims = {
+    version: 2,
+    iss: publicBaseUrl(env),
+    aud: "safest-resolve-reports",
+    integrationId: integration.id,
+    contextId: storedContext.id,
+    formVersionId,
+    jti: crypto.randomUUID(),
+    iat: issuedAt,
+    exp: issuedAt + ttl,
+    origin: input.origin,
+  };
+  const token = await signContextToken(claims, env.CONTEXT_SIGNING_SECRET);
+  return json({ schema_version: "2", context_token: token, expires_at: expiresAt }, { status: 201 });
+}
+
+async function handleWidgetConfig(request: Request, env: Env): Promise<Response> {
+  if (request.method !== "GET") return methodNotAllowed(["GET"]);
+  const url = new URL(request.url);
+  const integrationId = url.searchParams.get("integration_id")?.trim() ?? "";
+  const formVersion = url.searchParams.get("form_version")?.trim() || "general-v1";
+  if (!integrationId || integrationId.length > 200 || formVersion.length > 100) {
+    throw new ApiError(400, "invalid_query", "integration_id and form_version are required and must be valid.");
+  }
+  const integration = await loadIntegration(env.DB, integrationId);
+  if (!integration || integration.enabled !== 1) throw new ApiError(404, "widget_not_found", "The report widget is not available.");
+  const origin = request.headers.get("origin");
+  if (origin && !integrationAllowsOrigin(integration, origin)) throw new ApiError(403, "origin_not_allowed", "The widget origin is not allowed.");
+  const [form, brand] = await Promise.all([publicForm(env.DB, formVersion), loadWorkspaceBrand(env.DB)]);
+  if (!form) throw new ApiError(404, "form_not_found", "The report form is not available.");
+  if (integration.form_version_id && integration.form_version_id !== formVersion) {
+    throw new ApiError(404, "form_not_found", "This reporting channel is connected to a different form.");
+  }
+  const antiAbuse = turnstileConfig(env);
+  return json({
+    schema_version: "1",
+    integration_id: integrationId,
+    mode: integration.channel_mode,
+    human_verification: { required: true, provider: "cloudflare_turnstile", site_key: antiAbuse.siteKey },
+    form: {
+      id: form.id,
+      title: form.title,
+      description: form.description,
+      target_types: form.targetTypes,
+      reasons: form.reasons,
+      fields: form.fields,
+      consent_notice: form.consentNotice,
+    },
+    brand,
+  });
+}
+
+async function handleWidgetEmbed(request: Request, env: Env): Promise<Response> {
+  if (request.method !== "GET" && request.method !== "HEAD") return methodNotAllowed(["GET", "HEAD"]);
+  const url = new URL(request.url);
+  const integrationId = url.searchParams.get("integration_id")?.trim() ?? "";
+  const parentOrigin = url.searchParams.get("parent_origin")?.trim() ?? "";
+  const preview = url.searchParams.get("preview") === "1";
+  if (!integrationId || integrationId.length > 200 || !parentOrigin || parentOrigin.length > 2_048) {
+    throw new ApiError(400, "embed_configuration_invalid", "The embedded report form is missing its channel or website origin.");
+  }
+  let normalizedParent: string;
+  try {
+    const parsed = new URL(parentOrigin);
+    if (parsed.origin !== parentOrigin || parsed.username || parsed.password) throw new Error("not an origin");
+    normalizedParent = parsed.origin;
+  } catch {
+    throw new ApiError(400, "embed_origin_invalid", "The embedded report form received an invalid website origin.");
+  }
+  const integration = await loadIntegration(env.DB, integrationId);
+  if (!integration || integration.enabled !== 1) throw new ApiError(404, "widget_not_found", "The report widget is not available.");
+  const ownOrigin = publicBaseUrl(env);
+  const allowed = preview && normalizedParent === ownOrigin
+    || integrationAllowsOrigin(integration, normalizedParent);
+  if (!allowed) throw new ApiError(403, "origin_not_allowed", "This website is not allowed to embed the report form.");
+  const assetUrl = new URL("/embed/index.html", request.url);
+  const asset = await env.ASSETS.fetch(new Request(assetUrl, {
+    method: request.method,
+    headers: request.headers,
+  }));
+  const headers = new Headers(asset.headers);
+  headers.set("cache-control", "no-store");
+  headers.set("content-security-policy", [
+    "default-src 'self'",
+    "script-src 'self' https://challenges.cloudflare.com",
+    "style-src 'self' 'unsafe-inline'",
+    "font-src 'self'",
+    "img-src 'self' data: https:",
+    "connect-src 'self' https://challenges.cloudflare.com",
+    "frame-src https://challenges.cloudflare.com",
+    `frame-ancestors ${normalizedParent}`,
+    "object-src 'none'",
+    "base-uri 'none'",
+    "form-action 'self'",
+  ].join("; "));
+  headers.set("referrer-policy", "no-referrer");
+  headers.set("permissions-policy", "camera=(), microphone=(), geolocation=(), payment=()");
+  headers.set("x-content-type-options", "nosniff");
+  headers.delete("x-frame-options");
+  return new Response(request.method === "HEAD" ? null : asset.body, {
+    status: asset.status,
+    statusText: asset.statusText,
+    headers,
+  });
+}
+
+async function handleWidgetReport(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
+  if (request.method !== "POST") return methodNotAllowed(["POST"]);
+  const body = await readJsonObject(request);
+  const rawToken = typeof body.context_token === "string" ? body.context_token : "";
+  const claims = await verifyContextToken(rawToken, env.CONTEXT_SIGNING_SECRET, publicBaseUrl(env));
+  const integration = await loadIntegration(env.DB, claims.integrationId);
+  if (!integration || integration.enabled !== 1) throw new ApiError(401, "integration_not_available", "The application integration is not enabled.");
+  if (integration.channel_mode !== "contextual") throw new ApiError(403, "integration_mode_denied", "This channel does not accept authenticated widget reports.");
+  const origin = request.headers.get("origin");
+  const isolatedEmbedOrigin = publicBaseUrl(env);
+  if (!origin || !integrationAllowsOrigin(integration, claims.origin)
+    || (origin !== isolatedEmbedOrigin && origin !== claims.origin)) {
+    throw new ApiError(403, "origin_not_allowed", "The report origin does not match the signed application context.");
+  }
+  const context = await loadStoredReportContext(env.DB, claims.contextId);
+  if (context.integrationId !== claims.integrationId || context.origin !== claims.origin || context.formVersionId !== claims.formVersionId) {
+    throw new ApiError(401, "report_context_mismatch", "The trusted report context does not match this submission.");
+  }
+  const idempotencyKey = typeof body.idempotency_key === "string" ? body.idempotency_key.trim() : "";
+  if (idempotencyKey) {
+    const replay = await loadContextReportReplay(env.DB, claims.integrationId, claims.jti, idempotencyKey);
+    if (replay) return json(receiptJson(replay));
+  }
+  const remoteIp = request.headers.get("cf-connecting-ip");
+  await verifyTurnstile(body.turnstile_token, remoteIp, turnstileConfig(env), {
+    action: "widget_report_submit",
+    cdata: await sha256(rawToken),
+  });
+  const result = await createReport(env.DB, parseWidgetReport(body, claims, context), {
+    ...intakeDeliveryOptions(env),
+    abusePepper: env.RATE_LIMIT_PEPPER,
+    networkAddress: remoteIp,
+    turnstileOutcome: "verified",
+    surgeThresholdPerFiveMinutes: integer(env.PUBLIC_REPORT_SURGE_PER_5_MINUTES, 250, 25, 100_000),
+  });
+  if (result.route) queueRoutingJob(env, ctx, result.jobId, result.receipt.reportId);
+  queueDeliveryJobs(env, ctx, result.deliveryJobs);
+  return json(receiptJson(result.receipt), { status: result.created ? 201 : 200 });
+}
+
+async function handleAnonymousWidgetReport(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
+  if (request.method !== "POST") return methodNotAllowed(["POST"]);
+  if (request.headers.get("origin") !== publicBaseUrl(env)) {
+    throw new ApiError(403, "origin_not_allowed", "Anonymous embedded reports must be submitted from the isolated Resolve form.");
+  }
+  const body = await readJsonObject(request);
+  const integrationId = typeof body.integration_id === "string" ? body.integration_id.trim() : "";
+  const integration = await loadIntegration(env.DB, integrationId);
+  if (!integration || integration.enabled !== 1 || integration.channel_mode !== "anonymous") {
+    throw new ApiError(404, "widget_not_found", "The anonymous reporting channel is not available.");
+  }
+  if (integration.form_version_id && body.form_version !== integration.form_version_id) {
+    throw new ApiError(400, "integration_form_mismatch", "This reporting channel is connected to a different form.");
+  }
+  const remoteIp = request.headers.get("cf-connecting-ip");
+  await enforcePublicRateLimit(
+    env.DB,
+    remoteIp,
+    env.RATE_LIMIT_PEPPER,
+    integer(env.PUBLIC_REPORT_LIMIT_PER_10_MINUTES, 5, 1, 100),
+  );
+  await verifyTurnstile(body.turnstile_token, remoteIp, turnstileConfig(env), { action: "anonymous_report_submit" });
+  const reportBody = { ...body };
+  delete reportBody.integration_id;
+  const result = await createReport(env.DB, parsePublicReport(reportBody, integration.id), {
+    ...intakeDeliveryOptions(env),
+    abusePepper: env.RATE_LIMIT_PEPPER,
+    networkAddress: remoteIp,
+    turnstileOutcome: "verified",
+    surgeThresholdPerFiveMinutes: integer(env.PUBLIC_REPORT_SURGE_PER_5_MINUTES, 250, 25, 100_000),
+  });
+  if (result.route) queueRoutingJob(env, ctx, result.jobId, result.receipt.reportId);
+  queueDeliveryJobs(env, ctx, result.deliveryJobs);
+  return json(receiptJson(result.receipt), { status: result.created ? 201 : 200 });
+}
+
+async function handleServerReport(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
+  if (request.method !== "POST") return methodNotAllowed(["POST"]);
+  const integration = await requireIntegration(request, env);
+  if (!integration.scopes.includes("submit_reports")) throw new ApiError(403, "integration_scope_denied", "The integration cannot submit reports.");
+  const body = await readJsonObject(request);
+  const headerIdempotency = request.headers.get("idempotency-key")?.trim();
+  if (headerIdempotency && body.idempotency_key !== headerIdempotency) {
+    throw new ApiError(400, "idempotency_key_mismatch", "The Idempotency-Key header and body value must match.");
+  }
+  const result = await createReport(env.DB, parseServerReport(body, integration.id), {
+    ...intakeDeliveryOptions(env),
+    abusePepper: env.RATE_LIMIT_PEPPER,
+    networkAddress: request.headers.get("cf-connecting-ip"),
+    turnstileOutcome: null,
+    surgeThresholdPerFiveMinutes: integer(env.PUBLIC_REPORT_SURGE_PER_5_MINUTES, 250, 25, 100_000),
+  });
+  if (result.route) queueRoutingJob(env, ctx, result.jobId, result.receipt.reportId);
+  queueDeliveryJobs(env, ctx, result.deliveryJobs);
+  return json(receiptJson(result.receipt), { status: result.created ? 201 : 200 });
+}
+
+async function handlePublicConfig(request: Request, env: Env): Promise<Response> {
+  if (request.method !== "GET") return methodNotAllowed(["GET"]);
+  const installation = await env.DB.prepare(`
+    SELECT anonymous_reporting_enabled FROM installations WHERE id = 'default' LIMIT 1
+  `).first<{ anonymous_reporting_enabled: number }>();
+  if (!installation || installation.anonymous_reporting_enabled !== 1) {
+    throw new ApiError(404, "public_reporting_disabled", "Public reporting is not enabled for this deployment.");
+  }
+  const config = turnstileConfig(env);
+  const formVersion = new URL(request.url).searchParams.get("form_version")?.trim() || "general-v1";
+  if (formVersion.length > 100) throw new ApiError(400, "invalid_query", "form_version is invalid.");
+  if (formVersion !== "general-v1") {
+    const settingsRow = await env.DB.prepare(`SELECT settings_json AS settingsJson FROM installations WHERE id = 'default' LIMIT 1`).first<{ settingsJson: string }>();
+    let publicForms: string[] = [];
+    try {
+      const settings: unknown = JSON.parse(settingsRow?.settingsJson || "{}");
+      const configured = settings && typeof settings === "object" && !Array.isArray(settings) ? (settings as Record<string, unknown>).public_form_version_ids : [];
+      if (Array.isArray(configured)) publicForms = configured.filter((value): value is string => typeof value === "string");
+    } catch { publicForms = []; }
+    if (!publicForms.includes(formVersion)) throw new ApiError(404, "form_not_found", "The public report form is not available.");
+  }
+  const [form, brand] = await Promise.all([publicForm(env.DB, formVersion), loadWorkspaceBrand(env.DB)]);
+  if (!form) throw new ApiError(404, "form_not_found", "The public report form is not available.");
+  return json({
+    schema_version: "1",
+    turnstile_site_key: config.siteKey,
+    form: {
+      id: form.id,
+      title: form.title,
+      description: form.description,
+      target_types: form.targetTypes,
+      reasons: form.reasons,
+      fields: form.fields,
+      consent_notice: form.consentNotice,
+    },
+    brand,
+  });
+}
+
+async function handlePublicBrand(request: Request, env: Env): Promise<Response> {
+  if (request.method !== "GET") return methodNotAllowed(["GET"]);
+  return json({ schema_version: "1", brand: await loadWorkspaceBrand(env.DB) }, {
+    headers: { "cache-control": "public, max-age=0, must-revalidate" },
+  });
+}
+
+async function handlePublicReport(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
+  if (request.method !== "POST") return methodNotAllowed(["POST"]);
+  const expectedOrigin = publicBaseUrl(env);
+  if (request.headers.get("origin") !== expectedOrigin) {
+    throw new ApiError(403, "origin_not_allowed", "Public reports must be submitted from this deployment's hosted form.");
+  }
+  const body = await readJsonObject(request);
+  const remoteIp = request.headers.get("cf-connecting-ip");
+  await enforcePublicRateLimit(
+    env.DB,
+    remoteIp,
+    env.RATE_LIMIT_PEPPER,
+    integer(env.PUBLIC_REPORT_LIMIT_PER_10_MINUTES, 5, 1, 100),
+  );
+  await verifyPublicTurnstile(body.turnstile_token, remoteIp, turnstileConfig(env));
+  const result = await createReport(env.DB, parsePublicReport(body, env.PUBLIC_INTEGRATION_ID), {
+    ...intakeDeliveryOptions(env),
+    abusePepper: env.RATE_LIMIT_PEPPER,
+    networkAddress: remoteIp,
+    turnstileOutcome: "verified",
+    surgeThresholdPerFiveMinutes: integer(env.PUBLIC_REPORT_SURGE_PER_5_MINUTES, 250, 25, 100_000),
+  });
+  if (result.route) queueRoutingJob(env, ctx, result.jobId, result.receipt.reportId);
+  queueDeliveryJobs(env, ctx, result.deliveryJobs);
+  return json(receiptJson(result.receipt), { status: result.created ? 201 : 200 });
+}
+
+async function handleAdminSession(request: Request, env: Env): Promise<Response> {
+  if (request.method !== "GET") return methodNotAllowed(["GET"]);
+  const authentication = await resolveOperatorAuthentication(request, env);
+  if (!authentication) throw new ApiError(401, "operator_authentication_required", "Sign in to your Safest workspace to continue.");
+  const session = authentication.session;
+  const profile = await recordAnalystAuthentication(env.DB, session);
+  return appendOperatorAuthenticationCookies(json({
+    session: { ...session, profile },
+    configuration: {
+      allowed_action_codes: env.ALLOWED_ACTION_CODES.split(",").map((value) => value.trim()).filter(Boolean),
+      action_delivery_enabled: Boolean(env.ACTION_WEBHOOK_URL?.trim() && env.ACTION_WEBHOOK_SECRET?.trim()),
+      notification_delivery_enabled: Boolean(env.NOTIFICATION_WEBHOOK_URL?.trim() && env.NOTIFICATION_WEBHOOK_SECRET?.trim()),
+      account_notification_enabled: Boolean(env.OPERATOR_NOTIFICATION_WEBHOOK_URL?.trim() && env.OPERATOR_NOTIFICATION_WEBHOOK_SECRET?.trim()),
+    },
+  }), request, authentication);
+}
+
+async function normalizedBetterAuthError(response: Response, fallback: string): Promise<Response> {
+  const body = await response.json().catch(() => ({})) as { code?: unknown; message?: unknown };
+  const code = typeof body.code === "string" ? body.code.toLowerCase() : "authentication_failed";
+  const message = typeof body.message === "string" && body.message ? body.message : fallback;
+  return json({ error: { code, message } }, { status: response.status });
+}
+
+function normalizedBetterAuthSuccess(response: Response, body: unknown, status = 200): Response {
+  const headers = new Headers(response.headers);
+  headers.set("content-type", "application/json; charset=utf-8");
+  headers.set("cache-control", "no-store");
+  return new Response(JSON.stringify(body), {
+    status,
+    headers,
+  });
+}
+
+async function handleAuthProviders(request: Request, env: Env): Promise<Response> {
+  if (request.method !== "GET") return methodNotAllowed(["GET"]);
+  return json({
+    schema_version: "1",
+    password: true,
+    providers: configuredAuthProviders(env),
+  }, { headers: { "cache-control": "no-store" } });
+}
+
+async function handleOperatorLogin(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
+  if (request.method !== "POST") return methodNotAllowed(["POST"]);
+  const body = await readJsonObject(request, 4 * 1024);
+  const email = typeof body.email === "string" ? body.email.trim().toLowerCase() : "";
+  const operator = email ? await env.DB.prepare(
+    "SELECT status FROM operator_users WHERE email = ?1 LIMIT 1",
+  ).bind(email).first<{ status: string }>() : null;
+  const invited = !operator && await invitationAllowsEmail(request, env, email);
+  if (operator?.status !== "active" && !invited) {
+    throw new ApiError(401, "invalid_operator_credentials", "Email or password is incorrect.");
+  }
+  const better = await callBetterAuth(request, env, ctx, "/sign-in/email", {
+    email,
+    password: body.password,
+    rememberMe: false,
+    callbackURL: "/",
+  });
+  if (better.ok) {
+    return normalizedBetterAuthSuccess(better, { schema_version: "1", authenticated: true });
+  }
+  return normalizedBetterAuthError(better, "Email or password is incorrect.");
+}
+
+async function handleOperatorInvitationAccept(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
+  if (request.method !== "POST") return methodNotAllowed(["POST"]);
+  const body = await readJsonObject(request, 8 * 1024);
+  const inspectionRequest = new Request(request.url, {
+    method: "POST",
+    headers: request.headers,
+    body: JSON.stringify({ token: body.token }),
+  });
+  const inspection = await inspectInvitation(inspectionRequest, env);
+  if (!inspection.ok) return inspection;
+  const details = await inspection.clone().json() as { invitation: { email: string } };
+  const admissionCookie = inspection.headers.get("set-cookie")?.split(";", 1)[0] ?? "";
+  const requestCookies = request.headers.get("cookie") ?? "";
+  const cookie = [requestCookies, admissionCookie].filter(Boolean).join("; ");
+  const better = await callBetterAuth(request, env, ctx, "/sign-up/email", {
+    name: body.display_name,
+    email: details.invitation.email,
+    password: body.password,
+    callbackURL: "/",
+    rememberMe: false,
+  }, cookie);
+  if (!better.ok) return normalizedBetterAuthError(better, "The invitation could not be accepted.");
+  const admittedRequestHeaders = new Headers(request.headers);
+  admittedRequestHeaders.set("cookie", cookie);
+  const invitationId = await invitationIdFromRequest(new Request(request.url, { headers: admittedRequestHeaders }), env);
+  if (!invitationId || !await resolveBetterAuthOperator(env.DB, {
+    email: details.invitation.email,
+    name: typeof body.display_name === "string" ? body.display_name : details.invitation.email.split("@", 1)[0],
+  }, invitationId)) {
+    throw new ApiError(409, "invitation_already_used", "This invitation has already been used or the account already exists.");
+  }
+  const authResult = await better.clone().json().catch(() => ({})) as { token?: unknown };
+  const headers = new Headers(better.headers);
+  const invitationCookie = inspection.headers.get("set-cookie");
+  if (invitationCookie) headers.append("set-cookie", invitationCookie);
+  return new Response(JSON.stringify({
+    schema_version: "1",
+    account_created: true,
+    requires_verification: !authResult.token,
+  }), { status: 201, headers });
+}
+
+async function handleOperatorPasswordResetRequest(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
+  if (request.method !== "POST") return methodNotAllowed(["POST"]);
+  const body = await readJsonObject(request, 4 * 1024);
+  const email = typeof body.email === "string" ? body.email.trim().toLowerCase() : "";
+  const better = await callBetterAuth(request, env, ctx, "/request-password-reset", {
+    email,
+    redirectTo: "/",
+  });
+  if (!better.ok) {
+    console.warn("Password reset request was not accepted by Better Auth", better.status);
+    better.body?.cancel();
+  }
+  return json({
+    schema_version: "1",
+    requested: true,
+    message: "If this account can be reset, password reset instructions are on the way.",
+  }, { status: 202 });
+}
+
+async function handleOperatorPasswordResetComplete(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
+  if (request.method !== "POST") return methodNotAllowed(["POST"]);
+  const body = await readJsonObject(request, 8 * 1024);
+  const better = await callBetterAuth(request, env, ctx, "/reset-password", {
+    token: body.token,
+    newPassword: body.password,
+  });
+  if (!better.ok) return normalizedBetterAuthError(better, "This password reset link is invalid or expired.");
+  return json({ schema_version: "1", reset: true });
+}
+
+async function handleOperatorProfile(request: Request, env: Env): Promise<Response> {
+  const session = await requireOperator(request, env, "readReports");
+  if (request.method === "GET") return json({ schema_version: "1", profile: session });
+  if (request.method === "PATCH") {
+    const profile = await updateOperatorProfile(env.DB, session, await readJsonObject(request, 4 * 1024));
+    return json({ schema_version: "1", profile });
+  }
+  return methodNotAllowed(["GET", "PATCH"]);
+}
+
+async function handleOperatorProfilePicture(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
+  const session = await requireOperator(request, env, "readReports");
+  if (request.method === "PUT") {
+    const result = await uploadOperatorProfilePicture(env.DB, env.PROFILE_MEDIA, session, request);
+    if (result.oldObjectKey) ctx.waitUntil(env.PROFILE_MEDIA.delete(result.oldObjectKey));
+    return json({ schema_version: "1", profile: result.session });
+  }
+  if (request.method === "DELETE") {
+    const result = await deleteOperatorProfilePicture(env.DB, session);
+    if (result.oldObjectKey) ctx.waitUntil(env.PROFILE_MEDIA.delete(result.oldObjectKey));
+    return json({ schema_version: "1", profile: result.session });
+  }
+  return methodNotAllowed(["PUT", "DELETE"]);
+}
+
+async function handleOperatorProfilePictureRead(
+  request: Request,
+  env: Env,
+  userId: string,
+): Promise<Response> {
+  if (request.method !== "GET" && request.method !== "HEAD") return methodNotAllowed(["GET", "HEAD"]);
+  await requireOperator(request, env, "readReports");
+  return operatorProfilePictureResponse(env.DB, env.PROFILE_MEDIA, userId, request.method === "HEAD");
+}
+
+async function handleOperatorLogout(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
+  if (request.method !== "POST") return methodNotAllowed(["POST"]);
+  await logoutOperator(request, env.DB);
+  const better = await callBetterAuth(request, env, ctx, "/sign-out", {});
+  const response = normalizedBetterAuthSuccess(better, { schema_version: "1", signed_out: true });
+  return clearOperatorSessionCookies(response, request);
+}
+
+async function handleInfrastructureBootstrap(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
+  if (request.method !== "GET" && request.method !== "POST") return methodNotAllowed(["GET", "POST"]);
+  const identity = await resolveInfrastructureOwnerIdentity(request, env, ctx);
+  if (!identity) throw new ApiError(401, "infrastructure_authentication_required", "Cloudflare Access authentication is required for infrastructure owner setup.");
+  const issued = await bootstrapOwner(env.DB, identity);
+  if (request.method === "POST") {
+    return appendOperatorSessionCookies(json({ schema_version: "1", bootstrapped: true }, { status: 201 }), issued, request);
+  }
+  return appendOperatorSessionCookies(new Response(null, {
+    status: 303,
+    headers: { location: "/#reports", "cache-control": "no-store" },
+  }), issued, request);
+}
+
+async function handleAdminPeople(request: Request, env: Env): Promise<Response> {
+  const session = await requireOperator(request, env, "managePeople");
+  if (request.method === "GET") {
+    return json({ schema_version: "1", ...(await listOperatorPeople(env.DB)) });
+  }
+  if (request.method === "POST") {
+    const invitation = await createOperatorInvitation(
+      env.DB,
+      session,
+      await readJsonObject(request, 4 * 1024),
+      publicBaseUrl(env),
+    );
+    try {
+      await sendOperatorInvitationEmail(env, invitation);
+    } catch (error) {
+      await revokeOperatorInvitation(env.DB, session, invitation.id);
+      console.error("Operator invitation delivery failed", error instanceof Error ? error.message : typeof error);
+      throw new ApiError(
+        502,
+        "invitation_delivery_failed",
+        "The invitation email could not be delivered, so no active invitation was left behind. Check Email Sending and try again.",
+      );
+    }
+    return json({ schema_version: "1", invitation }, { status: 201 });
+  }
+  return methodNotAllowed(["GET", "POST"]);
+}
+
+async function handleAdminInvitation(
+  request: Request,
+  env: Env,
+  invitationId: string,
+): Promise<Response> {
+  if (request.method !== "DELETE") return methodNotAllowed(["DELETE"]);
+  const session = await requireOperator(request, env, "managePeople");
+  await revokeOperatorInvitation(env.DB, session, invitationId);
+  return new Response(null, { status: 204 });
+}
+
+async function handleAdminOperatorPasswordReset(
+  request: Request,
+  env: Env,
+  userId: string,
+  ctx: ExecutionContext,
+): Promise<Response> {
+  if (request.method !== "POST") return methodNotAllowed(["POST"]);
+  const session = await requireOperator(request, env, "managePeople");
+  const target = await env.DB.prepare(`
+    SELECT operator_users.email AS email, operator_users.roles_json AS rolesJson,
+      EXISTS(
+        SELECT 1
+        FROM auth_user JOIN auth_account ON auth_account.userId = auth_user.id
+        WHERE auth_user.email = operator_users.email COLLATE NOCASE
+          AND auth_account.providerId = 'credential'
+          AND auth_account.password IS NOT NULL
+      ) AS passwordAuth
+    FROM operator_users WHERE operator_users.id = ?1 LIMIT 1
+  `).bind(userId).first<{ email: string; rolesJson: string; passwordAuth: number }>();
+  if (!target) throw new ApiError(404, "operator_not_found", "The Safest account was not found.");
+  const targetRoles = JSON.parse(target.rolesJson) as unknown;
+  const privileged = Array.isArray(targetRoles) && targetRoles.some((role) => role === "owner" || role === "administrator");
+  if (privileged && !session.roles.includes("owner")) {
+    throw new ApiError(403, "owner_required", "Only the infrastructure owner can reset an owner or administrator account.");
+  }
+  if (!target.passwordAuth) {
+    throw new ApiError(
+      409,
+      "password_authentication_unavailable",
+      "This account uses OAuth or Cloudflare Access and does not have a Safest password to reset.",
+    );
+  }
+  const better = await callBetterAuth(request, env, ctx, "/request-password-reset", {
+    email: target.email,
+    redirectTo: "/",
+  });
+  if (!better.ok) return normalizedBetterAuthError(better, "The password reset email could not be sent.");
+  return json({
+    schema_version: "1",
+    password_reset: { delivery: "email", email: target.email },
+  }, { status: 202 });
+}
+
+async function handleAdminOperator(
+  request: Request,
+  env: Env,
+  userId: string,
+  action?: "revoke-sessions",
+): Promise<Response> {
+  const session = await requireOperator(request, env, "managePeople");
+  if (action === "revoke-sessions") {
+    if (request.method !== "POST") return methodNotAllowed(["POST"]);
+    const revoked = await revokeOperatorSessions(env.DB, session, userId)
+      + await revokeBetterAuthSessionsForOperator(env, userId);
+    return json({ schema_version: "1", user_id: userId, revoked_sessions: revoked });
+  }
+  if (request.method !== "PATCH") return methodNotAllowed(["PATCH"]);
+  const operator = await updateOperatorUser(env.DB, session, userId, await readJsonObject(request, 32 * 1024));
+  if (operator.status === "suspended") await revokeBetterAuthSessionsForOperator(env, userId);
+  return json({ schema_version: "1", operator });
+}
+
+async function handleAdminPresence(request: Request, env: Env): Promise<Response> {
+  const session = await requireOperator(request, env, "readReports");
+  const profile = await recordAnalystAuthentication(env.DB, session);
+  if (request.method === "GET") {
+    return json({ schema_version: "1", profile, analysts: await listAnalystPresence(env.DB, 45, session.queueScope ?? null) });
+  }
+  if (request.method === "POST") {
+    const heartbeat = parsePresenceHeartbeat(await readJsonObject(request, 4 * 1024));
+    const result = await touchAnalystSession(env.DB, {
+      ...heartbeat,
+      actorId: session.actor.id,
+      allowedQueueIds: session.queueScope ?? null,
+      claimTtlMinutes: integer(env.CLAIM_TTL_MINUTES, 15, 1, 1_440),
+    });
+    return json({
+      schema_version: "1",
+      profile,
+      claim_renewed: result.claimRenewed,
+      analysts: await listAnalystPresence(env.DB, 45, session.queueScope ?? null),
+    });
+  }
+  return methodNotAllowed(["GET", "POST"]);
+}
+
+async function handleAdminPresenceSocket(request: Request, env: Env): Promise<Response> {
+  if (request.method !== "GET") return methodNotAllowed(["GET"]);
+  if (request.headers.get("upgrade")?.toLowerCase() !== "websocket") {
+    throw new ApiError(426, "websocket_upgrade_required", "A WebSocket upgrade is required.");
+  }
+  const session = await requireOperator(request, env, "readReports");
+  await recordAnalystAuthentication(env.DB, session);
+  const sessionId = new URL(request.url).searchParams.get("session_id") ?? "";
+  parsePresenceHeartbeat({ session_id: sessionId, activity: "online", active_report_id: null });
+  const headers = new Headers(request.headers);
+  headers.set("x-safest-actor-id", session.actor.id);
+  headers.set("x-safest-session-id", sessionId);
+  headers.set("x-safest-queue-scope", canonicalJson(session.queueScope ?? null));
+  return env.WORKSPACE_PRESENCE.getByName("default").fetch(new Request(request, { headers }));
+}
+
+async function handleAdminReports(request: Request, env: Env): Promise<Response> {
+  if (request.method !== "GET") return methodNotAllowed(["GET"]);
+  const session = await requireOperator(request, env, "readReports");
+  const url = new URL(request.url);
+  const queueId = url.searchParams.get("queue_id")?.trim();
+  const rawState = url.searchParams.get("state")?.trim();
+  if (queueId && queueId.length > 100) throw new ApiError(400, "invalid_query", "queue_id is invalid.");
+  if (rawState && !reportStates.has(rawState as ReportState)) throw new ApiError(400, "invalid_query", "state is invalid.");
+  const cursorScope = `reports:${session.actor.id}:${queueId ?? "*"}:${rawState ?? "*"}`;
+  const cursor = await decodeApiCursor<InboxCursor>(env.CONTEXT_SIGNING_SECRET, cursorScope, url.searchParams.get("cursor"));
+  if (cursor && (!Number.isInteger(cursor.priority) || cursor.priority < 0 || cursor.priority > 100
+    || typeof cursor.receivedAt !== "string" || cursor.receivedAt.length > 50
+    || typeof cursor.id !== "string" || cursor.id.length > 100)) {
+    throw new ApiError(400, "cursor_invalid", "cursor is invalid or does not belong to this query.");
+  }
+  const page = await listInboxReports(env.DB, {
+    ...(queueId ? { queueId } : {}),
+    allowedQueueIds: session.queueScope ?? null,
+    ...(rawState ? { state: rawState as ReportState } : {}),
+    cursor,
+    limit: integer(url.searchParams.get("limit") ?? undefined, 50, 1, 100),
+  });
+  return json({
+    schema_version: "1",
+    reports: projectOperatorFields(session, "reports", page.reports),
+    next_cursor: page.nextPosition
+      ? await encodeApiCursor(env.CONTEXT_SIGNING_SECRET, cursorScope, page.nextPosition)
+      : null,
+  });
+}
+
+async function handleAdminQueues(request: Request, env: Env): Promise<Response> {
+  if (request.method === "GET") {
+    const session = await requireOperator(request, env, "readReports");
+    const includeArchived = session.permissions.manageQueues
+      && new URL(request.url).searchParams.get("include_archived") === "true";
+    const queues = await listQueues(env.DB, includeArchived);
+    const visibleQueues = session.permissions.manageQueues || session.queueScope === null
+      ? queues
+      : queues.filter((queue) => session.queueScope?.includes(String(queue.id)));
+    return json({ schema_version: "1", queues: visibleQueues });
+  }
+  if (request.method === "POST") {
+    const session = await requireOperator(request, env, "manageQueues");
+    const result = await createQueue(
+      env.DB,
+      parseQueueCreate(await readJsonObject(request, 64 * 1024)),
+      session,
+      mutationKey(request),
+    );
+    return json({ schema_version: "1", ...result }, { status: result.idempotentReplay ? 200 : 201 });
+  }
+  return methodNotAllowed(["GET", "POST"]);
+}
+
+async function handleAdminRoutingAgent(request: Request, env: Env): Promise<Response> {
+  if (request.method === "GET") {
+    await requireOperator(request, env, "manageAi");
+    return json({ schema_version: "1", configurations: await listRoutingAgents(env.DB) });
+  }
+  if (request.method === "POST") {
+    const session = await requireOperator(request, env, "manageAi");
+    const result = await publishRoutingAgent(
+      env.DB,
+      parseRoutingAgentConfiguration(await readJsonObject(request, 32 * 1024)),
+      session,
+      mutationKey(request),
+    );
+    return json({ schema_version: "1", ...result }, { status: result.idempotentReplay ? 200 : 201 });
+  }
+  return methodNotAllowed(["GET", "POST"]);
+}
+
+async function handleAdminRoutingAgentTest(request: Request, env: Env): Promise<Response> {
+  if (request.method !== "POST") return methodNotAllowed(["POST"]);
+  await requireOperator(request, env, "manageAi");
+  const agent = await activeRoutingAgent(env.DB);
+  if (!agent) throw new ApiError(404, "routing_agent_not_found", "No published routing-agent version exists.");
+  const body = await readJsonObject(request, 32 * 1024);
+  if (!body.simulated_output || typeof body.simulated_output !== "object" || Array.isArray(body.simulated_output)) {
+    throw new ApiError(400, "routing_agent_fixture_invalid", "simulated_output must be a routing-agent output object.");
+  }
+  const candidateIds = agent.candidateQueueIds;
+  const validation = validateRoutingAgentOutput(body.simulated_output, new Set(candidateIds), agent.confidenceThreshold);
+  const accepted = agent.enabled && agent.rolloutMode === "active" && !validation.needsHuman && validation.errors.length === 0;
+  return json({
+    schema_version: "1",
+    test: {
+      routing_agent_version_id: agent.id,
+      candidate_queue_ids: candidateIds,
+      validation,
+      would_accept: accepted,
+      authoritative: false,
+    },
+  }, { status: validation.errors.length ? 422 : 200 });
+}
+
+async function handleAdminQueue(
+  request: Request,
+  env: Env,
+  queueId: string,
+  action?: "versions" | "policy-versions" | "pause" | "resume" | "health",
+): Promise<Response> {
+  if (action === "versions" || action === "policy-versions") {
+    if (request.method === "GET") {
+      await requireOperator(request, env, "manageQueues");
+      const queue = await loadQueue(env.DB, queueId);
+      if (!queue) throw new ApiError(404, "queue_not_found", "The queue does not exist.");
+      return json({ schema_version: "1", versions: queue.versions });
+    }
+    if (request.method === "POST") {
+      const session = await requireOperator(request, env, "manageQueues");
+      const result = await publishQueuePolicy(
+        env.DB,
+        queueId,
+        parseQueuePolicy(await readJsonObject(request, 64 * 1024)),
+        session,
+        mutationKey(request),
+      );
+      return json({ schema_version: "1", ...result }, { status: result.idempotentReplay ? 200 : 201 });
+    }
+    return methodNotAllowed(["GET", "POST"]);
+  }
+  if (action === "pause" || action === "resume") {
+    if (request.method !== "POST") return methodNotAllowed(["POST"]);
+    const session = await requireOperator(request, env, "manageQueues");
+    if (action === "resume") {
+      const ready = await env.DB.prepare(`
+        SELECT q.id FROM queue_definitions q JOIN queue_versions v ON v.id = q.active_version_id
+        WHERE q.id = ?1 AND q.status != 'archived' AND v.published_at IS NOT NULL AND v.retired_at IS NULL
+        LIMIT 1
+      `).bind(queueId).first();
+      if (!ready) throw new ApiError(409, "queue_resume_readiness_failed", "The queue needs a current published policy before it can resume.");
+    }
+    const result = await updateQueue(env.DB, queueId, { status: action === "pause" ? "paused" : "active" }, session, mutationKey(request));
+    return json({ schema_version: "1", ...result });
+  }
+  if (action === "health") {
+    if (request.method !== "GET") return methodNotAllowed(["GET"]);
+    const session = await requireOperator(request, env, "readOperations");
+    assertOperatorQueueAccess(session, queueId);
+    const queue = await loadQueue(env.DB, queueId);
+    if (!queue) throw new ApiError(404, "queue_not_found", "The queue does not exist.");
+    const [reports, runs, tasks, actions, circuits, budgets] = await Promise.all([
+      env.DB.prepare(`SELECT COUNT(*) AS total, SUM(CASE WHEN state NOT IN ('resolved_by_human','resolved_by_ai','closed') THEN 1 ELSE 0 END) AS open, SUM(CASE WHEN due_at IS NOT NULL AND due_at < ?2 AND state NOT IN ('resolved_by_human','resolved_by_ai','closed') THEN 1 ELSE 0 END) AS overdue FROM reports WHERE queue_id = ?1`).bind(queueId, new Date().toISOString()).first(),
+      env.DB.prepare(`SELECT COUNT(*) AS total, SUM(CASE WHEN state IN ('failed','repair_required') THEN 1 ELSE 0 END) AS unhealthy, SUM(CASE WHEN state IN ('created','dispatch_pending','queued','running','waiting','paused') THEN 1 ELSE 0 END) AS active FROM workflow_runs WHERE queue_id = ?1`).bind(queueId).first(),
+      env.DB.prepare(`SELECT COUNT(*) AS open FROM human_tasks WHERE queue_id = ?1 AND state IN ('open','claimed')`).bind(queueId).first(),
+      env.DB.prepare(`SELECT COUNT(*) AS pending FROM action_proposals WHERE report_id IN (SELECT id FROM reports WHERE queue_id = ?1) AND state IN ('proposed','approval_required','approved','queued','applying','failed','compensation_required')`).bind(queueId).first(),
+      env.DB.prepare(`SELECT COUNT(*) AS open FROM connection_health WHERE state IN ('open_circuit','degraded')`).first(),
+      env.DB.prepare(`SELECT COUNT(*) AS exhausted FROM budget_usage u JOIN budget_policies p ON p.id = u.policy_id WHERE p.scope_type = 'queue' AND p.scope_id = ?1 AND u.consumed_value + u.reserved_value >= p.limit_value`).bind(queueId).first(),
+    ]);
+    return json({ schema_version: "1", queue, health: { reports, workflowRuns: runs, tasks, actions, connectionCircuits: circuits, budgets } });
+  }
+  if (request.method === "GET") {
+    const session = await requireOperator(request, env, "manageQueues");
+    assertOperatorQueueAccess(session, queueId);
+    const queue = await loadQueue(env.DB, queueId);
+    if (!queue) throw new ApiError(404, "queue_not_found", "The queue does not exist.");
+    return json({ schema_version: "1", queue });
+  }
+  if (request.method === "PATCH") {
+    const session = await requireOperator(request, env, "manageQueues");
+    const result = await updateQueue(
+      env.DB,
+      queueId,
+      parseQueueUpdate(await readJsonObject(request, 16 * 1024)),
+      session,
+      mutationKey(request),
+    );
+    return json({ schema_version: "1", ...result });
+  }
+  return methodNotAllowed(["GET", "PATCH"]);
+}
+
+function parseWorkflowAuthorityMode(value: unknown): WorkflowAuthorityMode {
+  if (value === "off" || value === "shadow" || value === "assist" || value === "bounded_auto") return value;
+  throw new ApiError(400, "invalid_workflow_authority", "authority_mode must be off, shadow, assist, or bounded_auto.");
+}
+
+async function handleAdminConnections(request: Request, env: Env): Promise<Response> {
+  if (request.method === "GET") {
+    const session = await requireOperator(request, env, "manageConnections");
+    const includeArchived = session.permissions.manageConnections
+      && new URL(request.url).searchParams.get("include_archived") === "true";
+    return json({ schema_version: "1", connections: await listConnections(env.DB, includeArchived) });
+  }
+  if (request.method === "POST") {
+    const session = await requireOperator(request, env, "publishConnections");
+    const result = await createConnection(
+      env.DB,
+      parseConnectionCreate(await readJsonObject(request, 128 * 1024)),
+      session,
+      mutationKey(request),
+    );
+    return json({ schema_version: "1", ...result }, { status: result.idempotentReplay ? 200 : 201 });
+  }
+  return methodNotAllowed(["GET", "POST"]);
+}
+
+async function handleAdminConnection(
+  request: Request,
+  env: Env,
+  connectionId: string,
+  action?: "versions" | "validate" | "test" | "pause" | "resume" | "dependencies",
+): Promise<Response> {
+  if (action === "versions" && request.method === "POST") {
+    const session = await requireOperator(request, env, "publishConnections");
+    const result = await publishConnectionVersion(
+      env.DB,
+      connectionId,
+      parseConnectionVersion(await readJsonObject(request, 64 * 1024)),
+      session,
+      mutationKey(request),
+    );
+    return json({ schema_version: "1", ...result }, { status: result.idempotentReplay ? 200 : 201 });
+  }
+  if (action === "validate") {
+    if (request.method !== "POST") return methodNotAllowed(["POST"]);
+    await requireOperator(request, env, "manageConnections");
+    const validation = await validateConnectionDefinition(env.DB, connectionId);
+    return json({ schema_version: "1", validation }, { status: validation.valid === true ? 200 : 422 });
+  }
+  if (action === "dependencies") {
+    if (request.method !== "GET") return methodNotAllowed(["GET"]);
+    await requireOperator(request, env, "manageConnections");
+    return json({ schema_version: "1", dependencies: await connectionDependencies(env.DB, connectionId) });
+  }
+  if (action === "pause") {
+    if (request.method !== "POST") return methodNotAllowed(["POST"]);
+    const session = await requireOperator(request, env, "manageConnections");
+    const result = await setConnectionStatus(env.DB, connectionId, "paused", session, mutationKey(request));
+    return json({ schema_version: "1", ...result });
+  }
+  if (action === "test" || action === "resume") {
+    if (request.method !== "POST") return methodNotAllowed(["POST"]);
+    const session = await requireOperator(request, env, "manageConnections");
+    const body = await readJsonObject(request, 128 * 1024);
+    if (typeof body.path !== "string" || !body.path.startsWith("/") || body.path.length > 2_048) {
+      throw new ApiError(400, "connection_test_path_required", "A safe absolute path is required for the connection probe.");
+    }
+    const method = typeof body.method === "string" ? body.method.toUpperCase() : "POST";
+    const connection = await loadConnection(env.DB, connectionId);
+    if (!connection) throw new ApiError(404, "connection_not_found", "The connection does not exist.");
+    const definition = connection.definition as Record<string, unknown>;
+    const connectionVersionId = typeof definition.active_version_id === "string" ? definition.active_version_id : null;
+    if (!connectionVersionId) throw new ApiError(409, "connection_version_missing", "The connection has no active version.");
+    let probe;
+    try {
+      probe = await executeConnectionJson(env, {
+        connectionVersionId,
+        operationId: `connection-probe:${connectionId}:${mutationKey(request)}`,
+        attemptNumber: 1,
+        method,
+        path: body.path,
+        body: body.body ?? {},
+        allowPaused: true,
+        headers: { "x-safest-purpose": "connection-health-probe" },
+      });
+    } catch (error) {
+      if (error instanceof ConnectionExecutionError) {
+        const status = ["connection_rate_limited", "connection_concurrency_exhausted"].includes(error.code) ? 429 : error.retryable ? 503 : 422;
+        throw new ApiError(status, error.code, "The connection probe failed safely.", { retryable: error.retryable, retry_after_seconds: error.delaySeconds });
+      }
+      throw error;
+    }
+    const resumed = action === "resume"
+      ? await setConnectionStatus(env.DB, connectionId, "active", session, mutationKey(request)) : null;
+    return json({
+      schema_version: "1",
+      probe: { status: probe.status, data: probe.data, response_digest: probe.responseDigest, attempt_id: probe.connectionAttemptId },
+      ...(resumed ? { connection: resumed } : {}),
+    });
+  }
+  if (!action && request.method === "PATCH") {
+    const session = await requireOperator(request, env, "manageConnections");
+    const result = await updateConnectionDefinition(env.DB, connectionId, await readJsonObject(request, 16 * 1024), session, mutationKey(request));
+    return json({ schema_version: "1", ...result });
+  }
+  if (request.method !== "GET") return methodNotAllowed(action === "versions" ? ["GET", "POST"] : action ? ["GET"] : ["GET", "PATCH"]);
+  await requireOperator(request, env, "manageConnections");
+  const connection = await loadConnection(env.DB, connectionId);
+  if (!connection) throw new ApiError(404, "connection_not_found", "The connection does not exist.");
+  if (action === "versions") return json({ schema_version: "1", versions: connection.versions });
+  return json({ schema_version: "1", connection });
+}
+
+async function handleAdminConnectionOAuthCallback(request: Request, env: Env): Promise<Response> {
+  if (request.method !== "GET") return methodNotAllowed(["GET"]);
+  const session = await requireOperator(request, env, "manageConnections");
+  const url = new URL(request.url);
+  const providerError = url.searchParams.get("error");
+  if (providerError) {
+    throw new ApiError(400, "oauth_authorization_denied", "The OAuth provider did not authorize the connection.", {
+      provider_error: providerError.slice(0, 200),
+    });
+  }
+  const state = url.searchParams.get("state") ?? "";
+  const code = url.searchParams.get("code") ?? "";
+  const result = await completeConnectionOAuth(env, state, code, session);
+  return json({ schema_version: "1", ...result });
+}
+
+async function handleAdminConnectionOAuth(
+  request: Request,
+  env: Env,
+  connectionId: string,
+  action: "start" | "revoke",
+): Promise<Response> {
+  if (request.method !== "POST") return methodNotAllowed(["POST"]);
+  const session = await requireOperator(request, env, "manageConnections");
+  const result = action === "start"
+    ? await startConnectionOAuth(env, connectionId, session)
+    : await revokeConnectionOAuth(env, connectionId, session);
+  return json({ schema_version: "1", ...result });
+}
+
+async function handleAdminComponents(request: Request, env: Env): Promise<Response> {
+  if (request.method === "GET") {
+    const session = await requireOperator(request, env, "manageComponents");
+    const includeArchived = session.permissions.manageComponents
+      && new URL(request.url).searchParams.get("include_archived") === "true";
+    return json({ schema_version: "1", components: await listComponents(env.DB, includeArchived) });
+  }
+  if (request.method === "POST") {
+    const session = await requireOperator(request, env, "publishComponents");
+    const result = await createComponent(
+      env.DB,
+      parseComponentCreate(await readJsonObject(request, 256 * 1024)),
+      session,
+      mutationKey(request),
+    );
+    return json({ schema_version: "1", ...result }, { status: result.idempotentReplay ? 200 : 201 });
+  }
+  return methodNotAllowed(["GET", "POST"]);
+}
+
+async function handleAdminComponent(
+  request: Request,
+  env: Env,
+  componentId: string,
+  action?: "versions" | "validate" | "test" | "pause" | "resume" | "dependencies",
+): Promise<Response> {
+  if (action === "versions" && request.method === "POST") {
+    const session = await requireOperator(request, env, "publishComponents");
+    const definition = await loadComponent(env.DB, componentId);
+    if (!definition) throw new ApiError(404, "component_not_found", "The component does not exist.");
+    const effectClass = (definition.definition as Record<string, unknown>).effect_class;
+    const parsedEffect = effectClass === "side_effecting" ? "side_effecting" : "read_only";
+    const result = await publishComponentVersion(
+      env.DB,
+      componentId,
+      parseComponentVersion(await readJsonObject(request, 256 * 1024), parsedEffect),
+      session,
+      mutationKey(request),
+    );
+    return json({ schema_version: "1", ...result }, { status: result.idempotentReplay ? 200 : 201 });
+  }
+  if (action === "validate") {
+    if (request.method !== "POST") return methodNotAllowed(["POST"]);
+    await requireOperator(request, env, "manageComponents");
+    const validation = await validateComponentDefinition(env.DB, componentId);
+    return json({ schema_version: "1", validation }, { status: validation.valid === true ? 200 : 422 });
+  }
+  if (action === "test") {
+    if (request.method !== "POST") return methodNotAllowed(["POST"]);
+    const session = await requireOperator(request, env, "manageComponents");
+    const result = await testComponentDefinition(env.DB, componentId, session);
+    return json({ schema_version: "1", ...result }, { status: result.passed ? 200 : 422 });
+  }
+  if (action === "dependencies") {
+    if (request.method !== "GET") return methodNotAllowed(["GET"]);
+    await requireOperator(request, env, "manageComponents");
+    return json({ schema_version: "1", dependencies: await componentDependencies(env.DB, componentId) });
+  }
+  if (action === "pause" || action === "resume") {
+    if (request.method !== "POST") return methodNotAllowed(["POST"]);
+    const session = await requireOperator(request, env, "manageComponents");
+    if (action === "resume") {
+      const validation = await validateComponentDefinition(env.DB, componentId);
+      if (validation.valid !== true) throw new ApiError(409, "component_validation_failed", "The component cannot resume until validation passes.", { validation });
+    }
+    const result = await setComponentStatus(env.DB, componentId, action === "pause" ? "paused" : "active", session, mutationKey(request));
+    return json({ schema_version: "1", ...result });
+  }
+  if (!action && request.method === "PATCH") {
+    const session = await requireOperator(request, env, "manageComponents");
+    const result = await updateComponentDefinition(env.DB, componentId, await readJsonObject(request, 16 * 1024), session, mutationKey(request));
+    return json({ schema_version: "1", ...result });
+  }
+  if (request.method !== "GET") return methodNotAllowed(action === "versions" ? ["GET", "POST"] : action ? ["GET"] : ["GET", "PATCH"]);
+  await requireOperator(request, env, "manageComponents");
+  const component = await loadComponent(env.DB, componentId);
+  if (!component) throw new ApiError(404, "component_not_found", "The component does not exist.");
+  if (action === "versions") return json({ schema_version: "1", versions: component.versions });
+  return json({ schema_version: "1", component });
+}
+
+async function handleAdminWorkflows(request: Request, env: Env): Promise<Response> {
+  if (request.method === "GET") {
+    const session = await requireOperator(request, env, "manageWorkflows");
+    const includeArchived = session.permissions.manageWorkflows
+      && new URL(request.url).searchParams.get("include_archived") === "true";
+    return json({ schema_version: "1", workflows: await listWorkflowDefinitions(env.DB, includeArchived) });
+  }
+  if (request.method === "POST") {
+    const session = await requireOperator(request, env, "manageWorkflows");
+    const body = await readJsonObject(request, 512 * 1024);
+    const definition = parseWorkflowDefinition({
+      key: body.key,
+      name: body.name,
+      description: body.description,
+      purpose: body.purpose,
+    });
+    const result = await createWorkflowDefinition(
+      env.DB,
+      definition,
+      parseWorkflowGraph(body.graph),
+      session,
+      mutationKey(request),
+    );
+    return json({ schema_version: "1", ...result }, { status: result.idempotentReplay ? 200 : 201 });
+  }
+  return methodNotAllowed(["GET", "POST"]);
+}
+
+async function handleAdminWorkflow(
+  request: Request,
+  env: Env,
+  ctx: ExecutionContext,
+  workflowId: string,
+  action?: "draft" | "validate" | "publish" | "versions" | "fixtures" | "test" | "test-runs" | "shadow-runs",
+): Promise<Response> {
+  if (!action) {
+    if (request.method !== "GET") return methodNotAllowed(["GET"]);
+    await requireOperator(request, env, "manageWorkflows");
+    const workflow = await loadWorkflowDefinition(env.DB, workflowId);
+    if (!workflow) throw new ApiError(404, "workflow_not_found", "The workflow does not exist.");
+    return json({ schema_version: "1", workflow });
+  }
+  if (action === "draft") {
+    if (request.method === "GET") {
+      await requireOperator(request, env, "manageWorkflows");
+      const workflow = await loadWorkflowDefinition(env.DB, workflowId);
+      if (!workflow) throw new ApiError(404, "workflow_not_found", "The workflow does not exist.");
+      const draft = workflow.draft as Record<string, unknown> | null;
+      const revision = Number(draft?.revision);
+      return json({ schema_version: "1", draft }, {
+        ...(Number.isInteger(revision) && revision > 0 ? { headers: { etag: `W/\"${revision}\"` } } : {}),
+      });
+    }
+    if (request.method === "PUT" || request.method === "PATCH") {
+      const session = await requireOperator(request, env, "manageWorkflows");
+      const body = await readJsonObject(request, 512 * 1024);
+      const headerRevision = request.headers.get("if-match")?.replace(/^W\/|"/gu, "");
+      const expectedRevision = body.expected_revision ?? (headerRevision ? Number(headerRevision) : undefined);
+      if (!Number.isInteger(expectedRevision) || Number(expectedRevision) < 1) {
+        throw new ApiError(400, "invalid_workflow_revision", "expected_revision must be a positive integer.");
+      }
+      const result = await replaceWorkflowDraft(
+        env.DB,
+        workflowId,
+        parseWorkflowGraph(body.graph),
+        Number(expectedRevision),
+        session,
+      );
+      return json({ schema_version: "1", ...result });
+    }
+    return methodNotAllowed(["GET", "PUT", "PATCH"]);
+  }
+  if (action === "validate") {
+    if (request.method !== "POST") return methodNotAllowed(["POST"]);
+    await requireOperator(request, env, "manageWorkflows");
+    const body = await readJsonObject(request, 8 * 1024);
+    const result = await validateWorkflowDraft(env.DB, workflowId, parseWorkflowAuthorityMode(body.authority_mode ?? "assist"));
+    return json({ schema_version: "1", ...result }, { status: result.validation.valid ? 200 : 422 });
+  }
+  if (action === "publish") {
+    if (request.method !== "POST") return methodNotAllowed(["POST"]);
+    const session = await requireOperator(request, env, "publishWorkflows");
+    const result = await publishWorkflowDraft(
+      env.DB,
+      env.WORKFLOW_ARTIFACTS,
+      workflowId,
+      parseWorkflowPublish(await readJsonObject(request, 64 * 1024)),
+      session,
+      mutationKey(request),
+      "2026-08-29",
+    );
+    return json({ schema_version: "1", ...result }, { status: result.idempotentReplay ? 200 : 201 });
+  }
+  if (action === "fixtures") {
+    if (request.method === "GET") {
+      await requireOperator(request, env, "manageWorkflows");
+      return json({ schema_version: "1", fixtures: await listWorkflowFixtures(env.DB, workflowId) });
+    }
+    if (request.method === "POST") {
+      const session = await requireOperator(request, env, "manageWorkflows");
+      const body = await readJsonObject(request, 512 * 1024);
+      if (typeof body.name !== "string") throw new ApiError(400, "workflow_fixture_invalid", "name is required.");
+      const objectField = (value: unknown, field: string): JsonObject => {
+        if (!value || typeof value !== "object" || Array.isArray(value)) throw new ApiError(400, "workflow_fixture_invalid", `${field} must be an object.`);
+        return value as JsonObject;
+      };
+      const result = await createWorkflowFixture(env.DB, workflowId, {
+        name: body.name,
+        input: objectField(body.input ?? {}, "input"),
+        componentResults: objectField(body.component_results ?? {}, "component_results"),
+        humanResponses: objectField(body.human_responses ?? {}, "human_responses"),
+        expected: objectField(body.expected ?? {}, "expected"),
+        failureInjection: objectField(body.failure_injection ?? {}, "failure_injection"),
+      }, session, mutationKey(request));
+      return json({ schema_version: "1", ...result }, { status: result.idempotentReplay ? 200 : 201 });
+    }
+    return methodNotAllowed(["GET", "POST"]);
+  }
+  if (action === "test" || action === "test-runs") {
+    if (request.method !== "POST") return methodNotAllowed(["POST"]);
+    const session = await requireOperator(request, env, "manageWorkflows");
+    const body = await readJsonObject(request, 16 * 1024);
+    if (typeof body.fixture_id !== "string" || !body.fixture_id.trim()) throw new ApiError(400, "workflow_fixture_required", "fixture_id is required.");
+    const result = await runWorkflowFixtureTest(env.DB, workflowId, body.fixture_id.trim(), session);
+    return json({ schema_version: "1", ...result }, { status: result.status === "passed" ? 200 : 422 });
+  }
+  if (action === "shadow-runs") {
+    if (request.method !== "POST") return methodNotAllowed(["POST"]);
+    const session = await requireOperator(request, env, "runShadow");
+    const body = await readJsonObject(request, 16 * 1024);
+    const reportId = boundedBodyString(body.report_id, "report_id", 100);
+    await assertOperatorReportAccess(env.DB, session, reportId);
+    const selected = await env.DB.prepare(`
+      SELECT w.id FROM reports r JOIN queue_workflow_pins p
+        ON p.queue_id = r.queue_id AND p.mode = 'shadow' AND p.deactivated_at IS NULL
+      JOIN workflow_versions v ON v.id = p.workflow_version_id
+      JOIN workflow_definitions w ON w.id = v.workflow_id
+      WHERE r.id = ?1 AND w.id = ?2 LIMIT 1
+    `).bind(reportId, workflowId).first();
+    if (!selected) throw new ApiError(409, "workflow_shadow_pin_mismatch", "This workflow is not the report queue's active shadow pin.");
+    const result = await createPinnedWorkflowRun(env.DB, reportId, "shadow", session, mutationKey(request));
+    ctx.waitUntil(env.CONTROL_JOBS.send(result.job, { contentType: "json" }).catch((error: unknown) => {
+      console.error("shadow workflow dispatch enqueue failed; reconciliation will retry", { runId: result.runId, errorType: error instanceof Error ? error.name : typeof error });
+    }));
+    return json({ schema_version: "1", ...result }, { status: result.idempotentReplay ? 200 : 202 });
+  }
+  if (request.method !== "GET") return methodNotAllowed(["GET"]);
+  await requireOperator(request, env, "manageWorkflows");
+  const workflow = await loadWorkflowDefinition(env.DB, workflowId);
+  if (!workflow) throw new ApiError(404, "workflow_not_found", "The workflow does not exist.");
+  return json({ schema_version: "1", versions: workflow.versions });
+}
+
+async function handleAdminWorkflowFixture(
+  request: Request,
+  env: Env,
+  workflowId: string,
+  fixtureId: string,
+): Promise<Response> {
+  const session = await requireOperator(request, env, "manageWorkflows");
+  if (request.method === "DELETE") {
+    const result = await deleteWorkflowFixture(env.DB, workflowId, fixtureId, session, mutationKey(request));
+    return json({ schema_version: "1", ...result });
+  }
+  if (request.method !== "PATCH") return methodNotAllowed(["PATCH", "DELETE"]);
+  const fixtures = await listWorkflowFixtures(env.DB, workflowId);
+  const current = fixtures.find((fixture) => fixture.id === fixtureId);
+  if (!current) throw new ApiError(404, "workflow_fixture_not_found", "The workflow fixture does not exist.");
+  const body = await readJsonObject(request, 512 * 1024);
+  const objectField = (value: unknown, field: string): JsonObject => {
+    if (!value || typeof value !== "object" || Array.isArray(value)) throw new ApiError(400, "workflow_fixture_invalid", `${field} must be an object.`);
+    return value as JsonObject;
+  };
+  const name = body.name ?? current.name;
+  if (typeof name !== "string") throw new ApiError(400, "workflow_fixture_invalid", "name must be a string.");
+  const result = await updateWorkflowFixture(env.DB, workflowId, fixtureId, {
+    name,
+    input: objectField(body.input ?? current.input, "input"),
+    componentResults: objectField(body.component_results ?? current.componentResults, "component_results"),
+    humanResponses: objectField(body.human_responses ?? current.humanResponses, "human_responses"),
+    expected: objectField(body.expected ?? current.expected, "expected"),
+    failureInjection: objectField(body.failure_injection ?? current.failureInjection, "failure_injection"),
+  }, session, mutationKey(request));
+  return json({ schema_version: "1", ...result });
+}
+
+async function handleAdminWorkflowTestRun(
+  request: Request,
+  env: Env,
+  workflowId: string,
+  testRunId: string,
+): Promise<Response> {
+  if (request.method !== "GET") return methodNotAllowed(["GET"]);
+  await requireOperator(request, env, "manageWorkflows");
+  const testRun = await loadWorkflowTestRun(env.DB, workflowId, testRunId);
+  if (!testRun) throw new ApiError(404, "workflow_test_run_not_found", "The workflow test run does not exist.");
+  return json({ schema_version: "1", test_run: testRun });
+}
+
+async function handleAdminWorkflowVersion(
+  request: Request,
+  env: Env,
+  workflowId: string,
+  versionId: string,
+  action?: "diff" | "retire",
+): Promise<Response> {
+  if (!action) {
+    if (request.method !== "GET") return methodNotAllowed(["GET"]);
+    await requireOperator(request, env, "manageWorkflows");
+    const version = await loadWorkflowVersion(env.DB, workflowId, versionId);
+    if (!version) throw new ApiError(404, "workflow_version_not_found", "The workflow version does not exist.");
+    return json({ schema_version: "1", version });
+  }
+  if (action === "diff") {
+    if (request.method !== "GET") return methodNotAllowed(["GET"]);
+    await requireOperator(request, env, "manageWorkflows");
+    const against = new URL(request.url).searchParams.get("against") ?? undefined;
+    return json({ schema_version: "1", diff: await diffWorkflowVersion(env.DB, workflowId, versionId, against) });
+  }
+  if (request.method !== "POST") return methodNotAllowed(["POST"]);
+  const session = await requireOperator(request, env, "publishWorkflows");
+  const result = await retireWorkflowVersion(env.DB, workflowId, versionId, session, mutationKey(request));
+  return json({ schema_version: "1", ...result });
+}
+
+async function handleAdminQueueWorkflowPin(request: Request, env: Env, queueId: string): Promise<Response> {
+  if (request.method === "GET") {
+    const session = await requireOperator(request, env, "manageWorkflowPins");
+    assertOperatorQueueAccess(session, queueId);
+    return json({ schema_version: "1", pins: await loadQueueWorkflowPins(env.DB, queueId) });
+  }
+  if (request.method === "PUT") {
+    const session = await requireOperator(request, env, "manageWorkflowPins");
+    const body = await readJsonObject(request, 16 * 1024);
+    if (typeof body.workflow_version_id !== "string" || !body.workflow_version_id.trim()) {
+      throw new ApiError(400, "workflow_version_required", "workflow_version_id is required.");
+    }
+    if (body.mode !== "shadow" && body.mode !== "primary") {
+      throw new ApiError(400, "workflow_pin_mode_invalid", "mode must be shadow or primary.");
+    }
+    if (body.rollback_of_pin_id !== undefined && typeof body.rollback_of_pin_id !== "string") {
+      throw new ApiError(400, "workflow_pin_invalid", "rollback_of_pin_id must be a string when supplied.");
+    }
+    const result = await pinQueueWorkflow(env.DB, queueId, {
+      workflowVersionId: body.workflow_version_id.trim(),
+      mode: body.mode,
+      ...(typeof body.rollback_of_pin_id === "string" ? { rollbackOfPinId: body.rollback_of_pin_id } : {}),
+    }, session, mutationKey(request));
+    return json({ schema_version: "1", ...result }, { status: result.idempotentReplay ? 200 : 201 });
+  }
+  return methodNotAllowed(["GET", "PUT"]);
+}
+
+async function handleAdminReportWorkflowRuns(
+  request: Request,
+  env: Env,
+  ctx: ExecutionContext,
+  reportId: string,
+): Promise<Response> {
+  if (request.method === "GET") {
+    const session = await requireOperator(request, env, "readRuns");
+    await assertOperatorReportAccess(env.DB, session, reportId);
+    return json({ schema_version: "1", runs: await listWorkflowRuns(env.DB, { reportId, limit: 100 }) });
+  }
+  if (request.method === "POST") {
+    const body = await readJsonObject(request, 8 * 1024);
+    if (body.mode !== "shadow" && body.mode !== "primary") {
+      throw new ApiError(400, "workflow_run_mode_invalid", "mode must be shadow or primary.");
+    }
+    const session = await requireOperator(request, env, body.mode === "shadow" ? "runShadow" : "operateRuns");
+    await assertOperatorReportAccess(env.DB, session, reportId);
+    const result = await createPinnedWorkflowRun(env.DB, reportId, body.mode, session, mutationKey(request));
+    ctx.waitUntil(env.CONTROL_JOBS.send(result.job, { contentType: "json" }).catch((error: unknown) => {
+      console.error("workflow dispatch enqueue failed; reconciliation will retry", {
+        runId: result.runId,
+        errorType: error instanceof Error ? error.name : typeof error,
+      });
+    }));
+    return json({
+      schema_version: "1",
+      run_id: result.runId,
+      workflow_version_id: result.workflowVersionId,
+      idempotent_replay: result.idempotentReplay,
+    }, { status: result.idempotentReplay ? 200 : 202 });
+  }
+  return methodNotAllowed(["GET", "POST"]);
+}
+
+async function handleAdminWorkflowRuns(request: Request, env: Env): Promise<Response> {
+  if (request.method !== "GET") return methodNotAllowed(["GET"]);
+  const session = await requireOperator(request, env, "readRuns");
+  const url = new URL(request.url);
+  const state = url.searchParams.get("state")?.trim() || undefined;
+  if (state && ![
+    "created", "dispatch_pending", "queued", "running", "waiting", "paused",
+    "succeeded", "failed", "terminated", "superseded", "repair_required",
+  ].includes(state)) throw new ApiError(400, "workflow_run_state_invalid", "state is invalid.");
+  return json({
+    schema_version: "1",
+    runs: await listWorkflowRuns(env.DB, {
+      ...(state ? { state } : {}),
+      allowedQueueIds: session.queueScope ?? null,
+      limit: integer(url.searchParams.get("limit") ?? undefined, 50, 1, 100),
+    }),
+  });
+}
+
+async function handleAdminAssistantSessions(request: Request, env: Env): Promise<Response> {
+  if (request.method !== "POST") return methodNotAllowed(["POST"]);
+  const session = await requireOperator(request, env, "useAssistant");
+  const result = await createAssistantSession(env.DB, session, mutationKey(request));
+  return json({ schema_version: "1", ...result }, { status: result.idempotentReplay ? 200 : 201 });
+}
+
+async function handleAdminPrompts(request: Request, env: Env): Promise<Response> {
+  if (request.method === "GET") {
+    await requireOperator(request, env, "readAi");
+    return json({ schema_version: "1", prompts: await listPrompts(env.DB) });
+  }
+  if (request.method === "POST") {
+    const session = await requireOperator(request, env, "manageAi");
+    const result = await publishPrompt(
+      env.DB,
+      parsePromptPublication(await readJsonObject(request, 64 * 1024)),
+      session,
+      mutationKey(request),
+    );
+    return json({ schema_version: "1", ...result }, { status: result.idempotentReplay ? 200 : 201 });
+  }
+  return methodNotAllowed(["GET", "POST"]);
+}
+
+async function handleAdminModelAliases(request: Request, env: Env): Promise<Response> {
+  if (request.method === "GET") {
+    await requireOperator(request, env, "readAi");
+    return json({ schema_version: "1", model_aliases: await listModelAliases(env.DB) });
+  }
+  if (request.method === "POST") {
+    const session = await requireOperator(request, env, "manageAi");
+    const result = await createModelAlias(
+      env.DB,
+      parseModelAliasCreate(await readJsonObject(request, 64 * 1024)),
+      session,
+      mutationKey(request),
+    );
+    return json({ schema_version: "1", ...result }, { status: result.idempotentReplay ? 200 : 201 });
+  }
+  return methodNotAllowed(["GET", "POST"]);
+}
+
+async function handleAdminModelAliasVersion(request: Request, env: Env, aliasId: string): Promise<Response> {
+  if (request.method !== "POST") return methodNotAllowed(["POST"]);
+  const session = await requireOperator(request, env, "manageAi");
+  const result = await publishModelAliasVersion(
+    env.DB,
+    aliasId,
+    parseModelAliasVersion(await readJsonObject(request, 64 * 1024)),
+    session,
+    mutationKey(request),
+  );
+  return json({ schema_version: "1", ...result }, { status: result.idempotentReplay ? 200 : 201 });
+}
+
+async function handleAdminAgents(request: Request, env: Env): Promise<Response> {
+  if (request.method === "GET") {
+    await requireOperator(request, env, "readAi");
+    return json({ schema_version: "1", agents: await listAgents(env.DB) });
+  }
+  if (request.method === "POST") {
+    const session = await requireOperator(request, env, "manageAi");
+    const result = await createAgent(
+      env.DB,
+      parseAgentCreate(await readJsonObject(request, 128 * 1024)),
+      session,
+      mutationKey(request),
+    );
+    return json({ schema_version: "1", ...result }, { status: result.idempotentReplay ? 200 : 201 });
+  }
+  return methodNotAllowed(["GET", "POST"]);
+}
+
+async function handleAdminAgentVersion(request: Request, env: Env, agentId: string): Promise<Response> {
+  if (request.method === "GET") {
+    await requireOperator(request, env, "manageAi");
+    const versions = await listAgentVersions(env.DB, agentId);
+    if (!versions.length && !await env.DB.prepare(`SELECT id FROM agent_definitions WHERE id = ?1`).bind(agentId).first()) {
+      throw new ApiError(404, "agent_not_found", "The agent does not exist.");
+    }
+    return json({ schema_version: "1", versions });
+  }
+  if (request.method === "POST") {
+    const session = await requireOperator(request, env, "manageAi");
+    const result = await publishAgentVersion(
+      env.DB,
+      agentId,
+      parseAgentVersion(await readJsonObject(request, 128 * 1024)),
+      session,
+      mutationKey(request),
+    );
+    return json({ schema_version: "1", ...result }, { status: result.idempotentReplay ? 200 : 201 });
+  }
+  return methodNotAllowed(["GET", "POST"]);
+}
+
+async function handleAdminAgentTest(request: Request, env: Env, agentId: string): Promise<Response> {
+  if (request.method !== "POST") return methodNotAllowed(["POST"]);
+  await requireOperator(request, env, "manageAi");
+  const body = await readJsonObject(request, 256 * 1024);
+  if (!body.input || typeof body.input !== "object" || Array.isArray(body.input)) {
+    throw new ApiError(400, "agent_test_input_invalid", "input must be an object.");
+  }
+  const active = await env.DB.prepare(`
+    SELECT v.id, v.input_schema_json AS inputSchemaJson, v.tool_manifest_json AS toolManifestJson,
+      v.maximum_turns AS maximumTurns, v.model_alias_version_id AS modelAliasVersionId,
+      v.prompt_version_id AS promptVersionId
+    FROM agent_definitions a JOIN agent_versions v ON v.id = a.active_version_id
+    WHERE a.id = ?1 AND a.status = 'active' AND v.retired_at IS NULL LIMIT 1
+  `).bind(agentId).first<Record<string, unknown>>();
+  if (!active) throw new ApiError(404, "agent_not_found", "The active agent version does not exist.");
+  let schema: JsonObject = {};
+  let tools: unknown = [];
+  try {
+    schema = JSON.parse(String(active.inputSchemaJson)) as JsonObject;
+    tools = JSON.parse(String(active.toolManifestJson));
+  } catch {
+    throw new ApiError(409, "agent_version_invalid", "The active agent version contains invalid stored configuration.");
+  }
+  const errors = validateJsonSchemaValue(body.input as JsonValue, schema);
+  const result = {
+    mode: "schema_and_authority_dry_run",
+    status: errors.length ? "failed" : "passed",
+    agentVersionId: active.id,
+    modelAliasVersionId: active.modelAliasVersionId,
+    promptVersionId: active.promptVersionId,
+    maximumTurns: active.maximumTurns,
+    allowedTools: tools,
+    validationErrors: errors,
+    externalCallsExecuted: false,
+  };
+  return json({ schema_version: "1", test: result }, { status: errors.length ? 422 : 200 });
+}
+
+async function handleAdminAiRuns(request: Request, env: Env): Promise<Response> {
+  if (request.method !== "GET") return methodNotAllowed(["GET"]);
+  const session = await requireOperator(request, env, "readAi");
+  const url = new URL(request.url);
+  const status = url.searchParams.get("status")?.trim() || undefined;
+  if (status && !["running", "succeeded", "invalid", "failed", "escalated", "timed_out"].includes(status)) {
+    throw new ApiError(400, "ai_run_status_invalid", "status is invalid.");
+  }
+  return json({
+    schema_version: "1",
+    runs: await listAiRuns(env.DB, {
+      allowedQueueIds: session.queueScope ?? null,
+      ...(status ? { status } : {}),
+      limit: integer(url.searchParams.get("limit") ?? undefined, 50, 1, 100),
+    }),
+  });
+}
+
+async function handleAdminAiRun(request: Request, env: Env, runId: string): Promise<Response> {
+  if (request.method !== "GET") return methodNotAllowed(["GET"]);
+  const session = await requireOperator(request, env, "readAi");
+  const run = await loadAiRun(env.DB, runId);
+  if (!run) throw new ApiError(404, "ai_run_not_found", "The AI run does not exist.");
+  await assertOperatorReportAccess(env.DB, session, String(run.reportId));
+  return json({ schema_version: "1", run: projectOperatorFields(session, "ai_run", run) });
+}
+
+async function handleAdminAiUsage(request: Request, env: Env): Promise<Response> {
+  if (request.method !== "GET") return methodNotAllowed(["GET"]);
+  await requireOperator(request, env, "readAi");
+  const days = integer(new URL(request.url).searchParams.get("days") ?? undefined, 30, 1, 366);
+  return json({ schema_version: "1", usage: await loadAiUsage(env.DB, days) });
+}
+
+async function handleAdminBudgets(request: Request, env: Env): Promise<Response> {
+  if (request.method === "GET") {
+    await requireOperator(request, env, "readOperations");
+    return json({ schema_version: "1", budgets: await listBudgets(env.DB) });
+  }
+  if (request.method === "POST") {
+    const session = await requireOperator(request, env, "manageBudgets");
+    const result = await publishBudget(
+      env.DB,
+      parseBudgetPublication(await readJsonObject(request, 32 * 1024)),
+      session,
+      mutationKey(request),
+    );
+    return json({ schema_version: "1", ...result }, { status: result.idempotentReplay ? 200 : 201 });
+  }
+  return methodNotAllowed(["GET", "POST"]);
+}
+
+async function handleAdminConfigurations(
+  request: Request,
+  env: Env,
+  type: ConfigurationType,
+): Promise<Response> {
+  if (request.method === "GET") {
+    await requireOperator(request, env, "manageConfiguration");
+    return json({ schema_version: "1", configurations: await listConfigurations(env.DB, type) });
+  }
+  if (request.method === "POST") {
+    const session = await requireOperator(request, env, "manageConfiguration");
+    const body = await readJsonObject(request, 512 * 1024);
+    const key = type === "routing_rules" ? "default" : typeof body.key === "string" ? body.key : "";
+    const result = await createConfigurationDraft(env.DB, type, key, body.content, session, mutationKey(request));
+    return json({ schema_version: "1", ...result }, { status: result.idempotentReplay ? 200 : 201 });
+  }
+  return methodNotAllowed(["GET", "POST"]);
+}
+
+async function handleAdminConfiguration(
+  request: Request,
+  env: Env,
+  type: ConfigurationType,
+  key: string,
+  action: "draft" | "validate" | "publish" | "versions" | "render",
+): Promise<Response> {
+  if (action === "draft") {
+    if (request.method === "GET") {
+      await requireOperator(request, env, "manageConfiguration");
+      const configuration = await loadConfiguration(env.DB, type, key);
+      if (!configuration) throw new ApiError(404, "configuration_not_found", "The configuration does not exist.");
+      const draft = configuration.draft as Record<string, unknown> | null | undefined;
+      const revision = Number(draft?.revision);
+      return json({ schema_version: "1", ...configuration }, {
+        ...(Number.isInteger(revision) && revision > 0 ? { headers: { etag: `W/\"${revision}\"` } } : {}),
+      });
+    }
+    if (request.method === "PATCH" || request.method === "PUT") {
+      const session = await requireOperator(request, env, "manageConfiguration");
+      const body = await readJsonObject(request, 512 * 1024);
+      const headerRevision = request.headers.get("if-match")?.replace(/^W\/|"/gu, "");
+      const expectedRevision = body.expected_revision ?? (headerRevision ? Number(headerRevision) : undefined);
+      if (!Number.isInteger(expectedRevision) || Number(expectedRevision) < 1) throw new ApiError(400, "configuration_revision_invalid", "If-Match or expected_revision must contain a positive integer.");
+      const result = await updateConfigurationDraft(env.DB, type, key, body.content, Number(expectedRevision), session);
+      return json({ schema_version: "1", ...result });
+    }
+    return methodNotAllowed(["GET", "PATCH", "PUT"]);
+  }
+  if (action === "validate") {
+    if (request.method !== "POST") return methodNotAllowed(["POST"]);
+    await requireOperator(request, env, "manageConfiguration");
+    const validation = await validateStoredConfiguration(env.DB, type, key);
+    return json({ schema_version: "1", validation }, { status: validation.valid ? 200 : 422 });
+  }
+  if (action === "publish") {
+    if (request.method !== "POST") return methodNotAllowed(["POST"]);
+    const session = await requireOperator(request, env, "manageConfiguration");
+    const body = await readJsonObject(request, 16 * 1024);
+    if (!Number.isInteger(body.expected_revision) || Number(body.expected_revision) < 1) throw new ApiError(400, "configuration_revision_invalid", "expected_revision must be a positive integer.");
+    const result = await publishConfiguration(env.DB, type, key, Number(body.expected_revision), session, mutationKey(request));
+    return json({ schema_version: "1", ...result }, { status: result.idempotentReplay ? 200 : 201 });
+  }
+  if (action === "render") {
+    if (type !== "template" || request.method !== "POST") return methodNotAllowed(["POST"]);
+    await requireOperator(request, env, "manageConfiguration");
+    const configuration = await loadConfiguration(env.DB, type, key);
+    const draft = configuration?.draft as Record<string, unknown> | null | undefined;
+    if (!draft) throw new ApiError(404, "template_draft_not_found", "The template draft does not exist.");
+    const body = await readJsonObject(request, 64 * 1024);
+    return json({ schema_version: "1", preview: renderTemplatePreview(draft.content, body.variables ?? {}) });
+  }
+  if (request.method !== "GET") return methodNotAllowed(["GET"]);
+  await requireOperator(request, env, "manageConfiguration");
+  const configuration = await loadConfiguration(env.DB, type, key);
+  if (!configuration) throw new ApiError(404, "configuration_not_found", "The configuration does not exist.");
+  return json({ schema_version: "1", versions: configuration.versions });
+}
+
+async function handleAdminAssistantSession(
+  request: Request,
+  env: Env,
+  sessionId: string,
+  messagesRoute: boolean,
+): Promise<Response> {
+  const session = await requireOperator(request, env, "useAssistant");
+  if (messagesRoute) {
+    if (request.method !== "POST") return methodNotAllowed(["POST"]);
+    const body = await readJsonObject(request, 16 * 1024);
+    if (typeof body.body !== "string") throw new ApiError(400, "assistant_message_invalid", "body is required.");
+    if (body.report_reference !== undefined && typeof body.report_reference !== "string") throw new ApiError(400, "assistant_report_reference_invalid", "report_reference must be a string.");
+    if (body.component_version_id !== undefined && typeof body.component_version_id !== "string") {
+      throw new ApiError(400, "assistant_component_version_invalid", "component_version_id must be a string.");
+    }
+    if (body.component_input !== undefined && (!body.component_input || typeof body.component_input !== "object" || Array.isArray(body.component_input))) {
+      throw new ApiError(400, "assistant_component_input_invalid", "component_input must be an object.");
+    }
+    if ((body.component_version_id === undefined) !== (body.component_input === undefined)) {
+      throw new ApiError(400, "assistant_enrichment_request_incomplete", "component_version_id and component_input must be supplied together.");
+    }
+    const hasDraft = body.draft_type !== undefined || body.draft_content !== undefined || body.draft_title !== undefined || body.draft_target_id !== undefined;
+    if (hasDraft) {
+      if (!["workflow", "form", "policy", "template", "routing_rules"].includes(String(body.draft_type))
+        || typeof body.draft_title !== "string"
+        || !body.draft_content || typeof body.draft_content !== "object" || Array.isArray(body.draft_content)
+        || (body.draft_target_id !== undefined && typeof body.draft_target_id !== "string")) {
+        throw new ApiError(400, "assistant_draft_request_invalid", "A valid draft_type, draft_title, draft_content, and optional draft_target_id are required.");
+      }
+      if (body.component_version_id !== undefined) throw new ApiError(400, "assistant_tool_request_ambiguous", "Request either an enrichment or a configuration draft, not both.");
+    }
+    const result = await sendAssistantMessage(env, sessionId, {
+      body: body.body,
+      ...(typeof body.report_reference === "string" ? { reportReference: body.report_reference } : {}),
+      ...(typeof body.component_version_id === "string" ? {
+        componentVersionId: body.component_version_id,
+        componentInput: body.component_input as JsonObject,
+      } : {}),
+      ...(hasDraft ? {
+        draft: {
+          type: body.draft_type as "workflow" | "form" | "policy" | "template" | "routing_rules",
+          title: body.draft_title as string,
+          content: body.draft_content as JsonObject,
+          ...(typeof body.draft_target_id === "string" ? { targetId: body.draft_target_id } : {}),
+        },
+      } : {}),
+    }, session, mutationKey(request));
+    return json({ schema_version: "1", ...result }, { status: result.idempotentReplay ? 200 : 201 });
+  }
+  if (request.method === "GET") return json({ schema_version: "1", ...(await loadAssistantHistory(env.DB, sessionId, session)) });
+  if (request.method === "DELETE") {
+    await closeAssistantSession(env.DB, sessionId, session);
+    return new Response(null, { status: 204 });
+  }
+  return methodNotAllowed(["GET", "DELETE"]);
+}
+
+async function handleAdminAssistantSocket(request: Request, env: Env, sessionId: string): Promise<Response> {
+  if (request.method !== "GET") return methodNotAllowed(["GET"]);
+  if (request.headers.get("upgrade")?.toLowerCase() !== "websocket") {
+    throw new ApiError(426, "websocket_upgrade_required", "A WebSocket upgrade is required.");
+  }
+  const session = await requireOperator(request, env, "useAssistant");
+  const history = await loadAssistantHistory(env.DB, sessionId, session);
+  const pair = new WebSocketPair();
+  const [client, server] = Object.values(pair);
+  server.accept();
+  server.send(canonicalJson({ type: "assistant.session_snapshot", schema_version: "1", ...history }));
+  server.addEventListener("message", () => {
+    server.send(canonicalJson({
+      type: "assistant.command_required",
+      message: "Submit assistant messages through the authenticated messages endpoint; this socket streams session state only.",
+    }));
+  });
+  return new Response(null, { status: 101, webSocket: client });
+}
+
+async function handleAdminAssistantDraftAdopt(
+  request: Request,
+  env: Env,
+  draftId: string,
+): Promise<Response> {
+  if (request.method !== "POST") return methodNotAllowed(["POST"]);
+  const baseSession = await requireOperator(request, env, "useAssistant");
+  const draft = await loadAssistantDraft(env.DB, draftId, baseSession);
+  if (draft.status === "adopted") {
+    return json({ schema_version: "1", draft_id: draftId, adopted_target_id: draft.adoptedTargetId, idempotentReplay: true });
+  }
+  const draftType = String(draft.draftType);
+  const permission = draftType === "workflow" ? "manageWorkflows"
+    : draftType === "form" ? "manageForms"
+      : draftType === "policy" ? "managePolicies"
+        : draftType === "template" ? "manageTemplates" : "manageRouting";
+  const session = await requireOperator(request, env, permission);
+  const content = draft.content as JsonObject;
+  const targetId = draftType === "routing_rules" ? "default" : typeof draft.targetId === "string" ? draft.targetId : "";
+  if (!targetId) throw new ApiError(409, "assistant_draft_target_missing", "This draft has no target editor.");
+  let adoptedTargetId: string;
+  if (draftType === "workflow") {
+    const current = await env.DB.prepare(`SELECT revision FROM workflow_drafts WHERE workflow_id = ?1 LIMIT 1`).bind(targetId).first<{ revision: number }>();
+    if (!current) throw new ApiError(404, "workflow_not_found", "The target workflow does not exist.");
+    const result = await replaceWorkflowDraft(env.DB, targetId, parseWorkflowGraph(content), current.revision, session);
+    adoptedTargetId = result.draftId;
+  } else {
+    const type = draftType as ConfigurationType;
+    const existing = await loadConfiguration(env.DB, type, targetId);
+    const existingDraft = existing?.draft as Record<string, unknown> | null | undefined;
+    if (existingDraft) {
+      const result = await updateConfigurationDraft(env.DB, type, targetId, content, Number(existingDraft.revision), session);
+      adoptedTargetId = result.draftId;
+    } else {
+      const result = await createConfigurationDraft(env.DB, type, targetId, content, session, `assistant-adopt:${mutationKey(request)}`);
+      adoptedTargetId = result.draftId;
+    }
+  }
+  await markAssistantDraftAdopted(env.DB, draftId, adoptedTargetId, session, mutationKey(request));
+  return json({ schema_version: "1", draft_id: draftId, adopted_target_id: adoptedTargetId, idempotentReplay: false }, { status: 201 });
+}
+
+async function handleAdminAssistantToolCall(request: Request, env: Env, toolCallId: string): Promise<Response> {
+  if (request.method !== "GET") return methodNotAllowed(["GET"]);
+  const session = await requireOperator(request, env, "useAssistant");
+  return json({ schema_version: "1", tool_call: await loadAssistantToolCall(env.DB, toolCallId, session) });
+}
+
+async function handleAdminHumanTasks(request: Request, env: Env): Promise<Response> {
+  if (request.method !== "GET") return methodNotAllowed(["GET"]);
+  const session = await requireOperator(request, env, "reviewTasks");
+  const url = new URL(request.url);
+  const state = url.searchParams.get("state")?.trim() || undefined;
+  if (state && !["open", "claimed", "completed", "expired", "cancelled"].includes(state)) {
+    throw new ApiError(400, "human_task_state_invalid", "state is invalid.");
+  }
+  const queueId = url.searchParams.get("queue_id")?.trim() || undefined;
+  if (queueId && queueId.length > 100) throw new ApiError(400, "human_task_queue_invalid", "queue_id is invalid.");
+  if (queueId) assertOperatorQueueAccess(session, queueId);
+  return json({
+    schema_version: "1",
+    tasks: await listHumanTasks(env.DB, {
+      ...(state ? { state } : {}),
+      ...(queueId ? { queueId } : {}),
+      ...(url.searchParams.get("mine") === "true" ? { operatorId: session.actor.id } : {}),
+      allowedQueueIds: session.queueScope ?? null,
+      limit: integer(url.searchParams.get("limit") ?? undefined, 50, 1, 100),
+    }),
+  });
+}
+
+async function handleAdminReportEvidence(
+  request: Request,
+  env: Env,
+  ctx: ExecutionContext,
+  reportId: string,
+  action?: "fetch" | "snapshots",
+): Promise<Response> {
+  if (!action) {
+    if (request.method !== "GET") return methodNotAllowed(["GET"]);
+    const session = await requireOperator(request, env, "readEvidence");
+    await assertOperatorReportAccess(env.DB, session, reportId);
+    return json({ schema_version: "1", evidence: await listReportEvidence(env.DB, reportId) });
+  }
+  if (action === "fetch") {
+    if (request.method !== "POST") return methodNotAllowed(["POST"]);
+    const session = await requireOperator(request, env, "readEvidence");
+    await assertOperatorReportAccess(env.DB, session, reportId);
+    const result = await requestEvidenceFetch(
+      env.DB,
+      reportId,
+      await readJsonObject(request, 64 * 1024),
+      session,
+      mutationKey(request),
+    );
+    ctx.waitUntil(env.REPORT_JOBS.send(result.job, { contentType: "json" }).catch((error: unknown) => {
+      console.error("evidence fetch enqueue failed; scheduled reconciliation will retry", {
+        requestId: result.requestId,
+        errorType: error instanceof Error ? error.name : typeof error,
+      });
+    }));
+    return json({ schema_version: "1", request_id: result.requestId, idempotent_replay: result.idempotentReplay }, { status: result.idempotentReplay ? 200 : 202 });
+  }
+  if (request.method !== "POST") return methodNotAllowed(["POST"]);
+  const session = await requireOperator(request, env, "manageEvidence");
+  await assertOperatorReportAccess(env.DB, session, reportId);
+  const result = await createEvidenceSnapshot(
+    env,
+    reportId,
+    await readJsonObject(request, 1_100_000),
+    session,
+    mutationKey(request),
+  );
+  return json({ schema_version: "1", ...result }, { status: result.idempotentReplay ? 200 : 201 });
+}
+
+async function handleAdminEvidenceContent(request: Request, env: Env, snapshotId: string): Promise<Response> {
+  if (request.method !== "GET") return methodNotAllowed(["GET"]);
+  const session = await requireOperator(request, env, "readSensitiveEvidence");
+  const snapshot = await env.DB.prepare(`SELECT report_id AS reportId FROM evidence_snapshots WHERE id = ?1 AND deleted_at IS NULL LIMIT 1`)
+    .bind(snapshotId).first<{ reportId: string }>();
+  if (!snapshot) throw new ApiError(404, "evidence_snapshot_not_found", "The evidence snapshot is unavailable.");
+  await assertOperatorReportAccess(env.DB, session, snapshot.reportId);
+  const requestId = request.headers.get("cf-ray")?.slice(0, 200) || crypto.randomUUID();
+  return readEvidenceContent(env, snapshotId, session, requestId);
+}
+
+async function handleEvidenceResponse(request: Request, env: Env): Promise<Response> {
+  if (request.method !== "POST") return methodNotAllowed(["POST"]);
+  const integration = await requireIntegration(request, env);
+  if (!integration.scopes.includes("evidence_callback")) throw new ApiError(403, "integration_scope_denied", "This integration cannot submit evidence callbacks.");
+  const result = await acceptEvidenceResponse(env, await readJsonObject(request, 1_100_000), integration.id);
+  return json({ schema_version: "1", ...result }, { status: result.idempotentReplay ? 200 : 202 });
+}
+
+async function handleActionResult(request: Request, env: Env): Promise<Response> {
+  if (request.method !== "POST") return methodNotAllowed(["POST"]);
+  const integration = await requireIntegration(request, env);
+  if (!integration.scopes.includes("action_callback")) throw new ApiError(403, "integration_scope_denied", "This integration cannot submit action callbacks.");
+  const result = await acceptActionResult(env, await readJsonObject(request, 128 * 1024), integration.id);
+  return json({ schema_version: "1", ...result }, { status: result.idempotentReplay ? 200 : 202 });
+}
+
+async function handleAdminHumanTask(
+  request: Request,
+  env: Env,
+  taskId: string,
+  action?: "claim" | "respond" | "response" | "reassign" | "cancel",
+): Promise<Response> {
+  if (!action) {
+    if (request.method !== "GET") return methodNotAllowed(["GET"]);
+    const session = await requireOperator(request, env, "reviewTasks");
+    const task = await loadHumanTask(env.DB, taskId);
+    if (!task) throw new ApiError(404, "human_task_not_found", "The task does not exist.");
+    assertOperatorQueueAccess(session, typeof task.queueId === "string" ? task.queueId : null);
+    return json({ schema_version: "1", task: projectOperatorFields(session, "task", task) });
+  }
+  if (action === "claim") {
+    const session = await requireOperator(request, env, "reviewTasks");
+    const task = await loadHumanTask(env.DB, taskId);
+    if (!task) throw new ApiError(404, "human_task_not_found", "The task does not exist.");
+    assertOperatorQueueAccess(session, typeof task.queueId === "string" ? task.queueId : null);
+    if (request.method === "POST") {
+      const claim = await claimHumanTask(env.DB, taskId, session, integer(env.CLAIM_TTL_MINUTES, 15, 1, 1_440));
+      return json({ schema_version: "1", claim }, { status: 201 });
+    }
+    if (request.method === "DELETE") {
+      await releaseHumanTaskClaim(env.DB, taskId, session);
+      return new Response(null, { status: 204 });
+    }
+    return methodNotAllowed(["POST", "DELETE"]);
+  }
+  if (action === "reassign") {
+    if (request.method !== "POST") return methodNotAllowed(["POST"]);
+    const session = await requireOperator(request, env, "assignTasks");
+    const body = await readJsonObject(request, 16 * 1024);
+    const queueId = boundedBodyString(body.queue_id, "queue_id", 100);
+    const reason = boundedBodyString(body.reason, "reason", 2_000);
+    const task = await loadHumanTask(env.DB, taskId);
+    if (!task) throw new ApiError(404, "human_task_not_found", "The task does not exist.");
+    assertOperatorQueueAccess(session, typeof task.queueId === "string" ? task.queueId : null);
+    assertOperatorQueueAccess(session, queueId);
+    const result = await reassignHumanTask(env.DB, taskId, queueId, reason, session, mutationKey(request));
+    return json({ schema_version: "1", ...result }, { status: result.idempotentReplay ? 200 : 201 });
+  }
+  if (action === "cancel") {
+    if (request.method !== "POST") return methodNotAllowed(["POST"]);
+    const session = await requireOperator(request, env, "operateRuns");
+    const task = await loadHumanTask(env.DB, taskId);
+    if (!task) throw new ApiError(404, "human_task_not_found", "The task does not exist.");
+    assertOperatorQueueAccess(session, typeof task.queueId === "string" ? task.queueId : null);
+    const body = await readJsonObject(request, 16 * 1024);
+    const result = await cancelHumanTask(
+      env.DB, taskId, boundedBodyString(body.reason, "reason", 2_000), session, mutationKey(request),
+    );
+    const event = await sendWorkflowEvent(env, result.runId, {
+      eventType: `task.${taskId}.cancelled`,
+      eventKey: `task-cancel:${taskId}:${mutationKey(request)}`,
+      sourceType: "operator",
+      sourceId: session.actor.id,
+      payload: { task_id: taskId, reason: body.reason },
+    });
+    return json({ schema_version: "1", ...result, event }, { status: result.idempotentReplay ? 200 : 202 });
+  }
+  if (request.method !== "POST") return methodNotAllowed(["POST"]);
+  const session = await requireOperator(request, env, "reviewTasks");
+  const task = await loadHumanTask(env.DB, taskId);
+  if (!task) throw new ApiError(404, "human_task_not_found", "The task does not exist.");
+  assertOperatorQueueAccess(session, typeof task.queueId === "string" ? task.queueId : null);
+  const body = await readJsonObject(request, 256 * 1024);
+  const result = await respondToHumanTask(env, taskId, body.response, session, mutationKey(request));
+  return json({ schema_version: "1", ...result }, { status: result.idempotentReplay ? 200 : 202 });
+}
+
+async function handleAdminWorkflowRun(
+  request: Request,
+  env: Env,
+  runId: string,
+  action?: "pause" | "resume" | "terminate" | "events" | "reconcile",
+): Promise<Response> {
+  if (!action) {
+    if (request.method !== "GET") return methodNotAllowed(["GET"]);
+    const session = await requireOperator(request, env, "readRuns");
+    await assertOperatorWorkflowRunAccess(env.DB, session, runId);
+    const run = await loadWorkflowRun(env.DB, runId);
+    if (!run) throw new ApiError(404, "workflow_run_not_found", "The workflow run does not exist.");
+    return json({ schema_version: "1", ...run });
+  }
+  if (action === "events") {
+    if (request.method !== "POST") return methodNotAllowed(["POST"]);
+    const session = await requireOperator(request, env, "operateRuns");
+    await assertOperatorWorkflowRunAccess(env.DB, session, runId);
+    const body = await readJsonObject(request, 256 * 1024);
+    if (typeof body.event_type !== "string" || typeof body.event_key !== "string") {
+      throw new ApiError(400, "workflow_event_invalid", "event_type and event_key are required.");
+    }
+    const result = await sendWorkflowEvent(env, runId, {
+      eventType: body.event_type,
+      eventKey: body.event_key,
+      sourceType: "operator",
+      sourceId: session.actor.id,
+      payload: body.payload ?? {},
+    });
+    return json({ schema_version: "1", ...result }, { status: result.idempotentReplay ? 200 : 202 });
+  }
+  if (action === "reconcile") {
+    if (request.method !== "POST") return methodNotAllowed(["POST"]);
+    const session = await requireOperator(request, env, "operateRuns");
+    await assertOperatorWorkflowRunAccess(env.DB, session, runId);
+    const result = await reconcileWorkflowRun(env, runId, session, mutationKey(request));
+    return json({ schema_version: "1", ...result }, { status: result.idempotentReplay ? 200 : 202 });
+  }
+  if (request.method !== "POST") return methodNotAllowed(["POST"]);
+  const session = await requireOperator(request, env, "operateRuns");
+  await assertOperatorWorkflowRunAccess(env.DB, session, runId);
+  await controlWorkflowRun(env, runId, action);
+  return json({ schema_version: "1", run_id: runId, state: action === "pause" ? "paused" : action === "resume" ? "running" : "terminated" });
+}
+
+async function handleAdminActionProposal(
+  request: Request,
+  env: Env,
+  proposalId: string,
+  action?: "approve" | "reject" | "retry" | "compensate",
+): Promise<Response> {
+  const reference = await env.DB.prepare(`SELECT report_id AS reportId FROM action_proposals WHERE id = ?1 LIMIT 1`)
+    .bind(proposalId).first<{ reportId: string }>();
+  if (!reference) throw new ApiError(404, "action_proposal_not_found", "The action proposal does not exist.");
+  if (!action) {
+    if (request.method !== "GET") return methodNotAllowed(["GET"]);
+    const session = await requireOperator(request, env, "readReports");
+    await assertOperatorReportAccess(env.DB, session, reference.reportId);
+    const detail = await loadActionProposalDetail(env.DB, proposalId);
+    return json({ schema_version: "1", ...detail });
+  }
+  if (request.method !== "POST") return methodNotAllowed(["POST"]);
+  const session = await requireOperator(request, env, action === "retry" ? "operateActions" : "approveActions");
+  await assertOperatorReportAccess(env.DB, session, reference.reportId);
+  const body = await readJsonObject(request, 32 * 1024);
+  if (action === "compensate") {
+    const result = await proposeCompensatingAction(env, proposalId, body, session, mutationKey(request));
+    return json({ schema_version: "1", ...result }, { status: result.idempotentReplay ? 200 : 201 });
+  }
+  const payloadDigest = typeof body.payload_digest === "string" ? body.payload_digest : "";
+  if (!/^sha256:[a-f0-9]{64}$/u.test(payloadDigest)) throw new ApiError(400, "action_payload_digest_invalid", "payload_digest must be an exact SHA-256 digest.");
+  if (action === "retry") {
+    const result = await retryActionProposal(env, proposalId, payloadDigest, session, mutationKey(request));
+    return json({ schema_version: "1", ...result }, { status: result.idempotentReplay ? 200 : 202 });
+  }
+  const result = await decideActionProposal(env, proposalId, {
+    decision: action === "approve" ? "approved" : "rejected",
+    payloadDigest,
+    ...(typeof body.reason === "string" ? { reason: body.reason } : {}),
+  }, session, mutationKey(request));
+  return json({ schema_version: "1", ...result });
+}
+
+async function handleAdminOperations(request: Request, env: Env): Promise<Response> {
+  if (request.method !== "GET") return methodNotAllowed(["GET"]);
+  await requireOperator(request, env, "readOperations");
+  return json({ schema_version: "1", operations: await loadOperationsSnapshot(env.DB) });
+}
+
+async function handleAdminOperationsIncidents(request: Request, env: Env): Promise<Response> {
+  if (request.method !== "GET") return methodNotAllowed(["GET"]);
+  await requireOperator(request, env, "readOperations");
+  const url = new URL(request.url);
+  const state = url.searchParams.get("state");
+  const severity = url.searchParams.get("severity");
+  if (state && !["open", "acknowledged", "mitigated", "resolved"].includes(state)) {
+    throw new ApiError(400, "operations_incident_state_invalid", "The incident state filter is invalid.");
+  }
+  if (severity && !["info", "low", "medium", "high", "critical"].includes(severity)) {
+    throw new ApiError(400, "operations_incident_severity_invalid", "The incident severity filter is invalid.");
+  }
+  return json({
+    schema_version: "1",
+    incidents: await listOperationsIncidents(env.DB, {
+      state, severity, limit: integer(url.searchParams.get("limit") ?? undefined, 50, 1, 100),
+    }),
+  });
+}
+
+async function handleAdminOperationsIncident(
+  request: Request,
+  env: Env,
+  incidentId: string,
+  action?: "acknowledge" | "resolve" | "retry",
+): Promise<Response> {
+  if (!action) {
+    if (request.method !== "GET") return methodNotAllowed(["GET"]);
+    await requireOperator(request, env, "readOperations");
+    const incident = await loadOperationsIncident(env.DB, incidentId);
+    if (!incident) throw new ApiError(404, "operations_incident_not_found", "The operations incident does not exist.");
+    return json({ schema_version: "1", ...incident });
+  }
+  if (request.method !== "POST") return methodNotAllowed(["POST"]);
+  const session = await requireOperator(request, env, "operateSystem");
+  if (action === "acknowledge") {
+    return json({ schema_version: "1", ...(await acknowledgeOperationsIncident(env.DB, incidentId, session, mutationKey(request))) });
+  }
+  if (action === "resolve") {
+    const body = await readJsonObject(request, 16 * 1024);
+    const result = await resolveOperationsIncident(env.DB, incidentId, {
+      code: typeof body.resolution_code === "string" ? body.resolution_code : "",
+      summary: typeof body.summary === "string" ? body.summary : "",
+    }, session, mutationKey(request));
+    return json({ schema_version: "1", ...result });
+  }
+  const result = await retryOperationsIncident(env.DB, incidentId, session, mutationKey(request));
+  return json({ schema_version: "1", ...result }, { status: result.idempotentReplay ? 200 : 202 });
+}
+
+async function handleAdminDeadLetters(request: Request, env: Env): Promise<Response> {
+  if (request.method !== "GET") return methodNotAllowed(["GET"]);
+  await requireOperator(request, env, "readOperations");
+  const url = new URL(request.url);
+  return json({
+    schema_version: "1",
+    dead_letters: await listDeadLetters(env.DB, integer(url.searchParams.get("limit") ?? undefined, 100, 1, 200)),
+  });
+}
+
+async function handleAdminAiQualitySamples(request: Request, env: Env): Promise<Response> {
+  if (request.method !== "GET") return methodNotAllowed(["GET"]);
+  const session = await requireOperator(request, env, "reviewQuality");
+  const url = new URL(request.url);
+  const stateValue = url.searchParams.get("state");
+  if (stateValue && !["pending", "claimed", "complete"].includes(stateValue)) {
+    throw new ApiError(400, "invalid_quality_sample_state", "The quality sample state filter is invalid.");
+  }
+  const limit = integer(url.searchParams.get("limit") ?? undefined, 50, 1, 100);
+  return json({
+    schema_version: "1",
+    samples: await listAiQualitySamples(env.DB, stateValue as "pending" | "claimed" | "complete" | null, limit, session.queueScope ?? null),
+  });
+}
+
+async function handleAdminShadowComparisons(request: Request, env: Env): Promise<Response> {
+  if (request.method !== "GET") return methodNotAllowed(["GET"]);
+  const session = await requireOperator(request, env, "reviewQuality");
+  const url = new URL(request.url);
+  const status = url.searchParams.get("status");
+  if (status && !["pending", "quality_task_created", "reviewed", "dismissed"].includes(status)) {
+    throw new ApiError(400, "shadow_comparison_status_invalid", "The shadow comparison status filter is invalid.");
+  }
+  return json({
+    schema_version: "1",
+    comparisons: await listShadowComparisons(env.DB, {
+      status,
+      limit: integer(url.searchParams.get("limit") ?? undefined, 50, 1, 100),
+      allowedQueueIds: session.queueScope ?? null,
+    }),
+  });
+}
+
+async function handleAdminShadowComparison(
+  request: Request,
+  env: Env,
+  comparisonId: string,
+  action: "dismiss" | "create-task",
+): Promise<Response> {
+  if (request.method !== "POST") return methodNotAllowed(["POST"]);
+  const session = await requireOperator(request, env, "reviewQuality");
+  const comparison = await env.DB.prepare(`SELECT report_id AS reportId FROM shadow_comparisons WHERE id = ?1 LIMIT 1`)
+    .bind(comparisonId).first<{ reportId: string }>();
+  if (!comparison) throw new ApiError(404, "shadow_comparison_not_found", "The shadow comparison does not exist.");
+  await assertOperatorReportAccess(env.DB, session, comparison.reportId);
+  if (action === "create-task") {
+    const result = await createShadowQualityTask(env.DB, comparisonId, session, mutationKey(request));
+    return json({ schema_version: "1", ...result }, { status: result.idempotentReplay ? 200 : 201 });
+  }
+  const body = await readJsonObject(request, 16 * 1024);
+  const result = await dismissShadowComparison(
+    env.DB,
+    comparisonId,
+    typeof body.reason === "string" ? body.reason : "",
+    session,
+    mutationKey(request),
+  );
+  return json({ schema_version: "1", ...result });
+}
+
+async function handleAdminAiQualitySample(
+  request: Request,
+  env: Env,
+  sampleId: string,
+): Promise<Response> {
+  if (request.method !== "GET") return methodNotAllowed(["GET"]);
+  const session = await requireOperator(request, env, "reviewQuality");
+  const sample = await loadAiQualitySample(env.DB, sampleId);
+  if (!sample) throw new ApiError(404, "quality_sample_not_found", "The quality sample does not exist.");
+  await assertOperatorReportAccess(env.DB, session, String(sample.reportId));
+  const report = await loadReportDetail(env.DB, String(sample.reportId));
+  if (!report) throw new ApiError(404, "report_not_found", "The sampled report does not exist.");
+  return json({ schema_version: "1", sample: projectOperatorFields(session, "quality_sample", sample), report: projectOperatorFields(session, "report", report) });
+}
+
+async function handleAdminAiQualityClaim(
+  request: Request,
+  env: Env,
+  sampleId: string,
+): Promise<Response> {
+  if (request.method !== "POST") return methodNotAllowed(["POST"]);
+  const session = await requireOperator(request, env, "reviewQuality");
+  const sample = await loadAiQualitySample(env.DB, sampleId);
+  if (!sample) throw new ApiError(404, "quality_sample_not_found", "The quality sample does not exist.");
+  await assertOperatorReportAccess(env.DB, session, String(sample.reportId));
+  return json({
+    schema_version: "1",
+    claim: await claimAiQualitySample(env.DB, sampleId, session, integer(env.CLAIM_TTL_MINUTES, 15, 1, 1_440)),
+  }, { status: 201 });
+}
+
+async function handleAdminAiQualityReview(
+  request: Request,
+  env: Env,
+  sampleId: string,
+): Promise<Response> {
+  if (request.method !== "POST") return methodNotAllowed(["POST"]);
+  const session = await requireOperator(request, env, "reviewQuality");
+  const sample = await loadAiQualitySample(env.DB, sampleId);
+  if (!sample) throw new ApiError(404, "quality_sample_not_found", "The quality sample does not exist.");
+  await assertOperatorReportAccess(env.DB, session, String(sample.reportId));
+  const result = await recordAiQualityReview(
+    env.DB,
+    sampleId,
+    session,
+    parseQualityReview(await readJsonObject(request, 16 * 1024), request.headers.get("idempotency-key")),
+  );
+  return json({ schema_version: "1", ...result }, { status: result.idempotentReplay ? 200 : 201 });
+}
+
+async function handleAdminAnalytics(request: Request, env: Env): Promise<Response> {
+  if (request.method !== "GET") return methodNotAllowed(["GET"]);
+  await requireOperator(request, env, "readAnalytics");
+  const days = integer(new URL(request.url).searchParams.get("days") ?? undefined, 30, 1, 366);
+  await refreshDailyAggregatesIfStale(env.DB);
+  return json({ schema_version: "1", analytics: await loadAnalytics(env.DB, days) });
+}
+
+async function handleAdminAnalyticsAi(request: Request, env: Env): Promise<Response> {
+  if (request.method !== "GET") return methodNotAllowed(["GET"]);
+  await requireOperator(request, env, "readAi");
+  const days = integer(new URL(request.url).searchParams.get("days") ?? undefined, 30, 1, 366);
+  return json({ schema_version: "1", analytics: await loadAiUsage(env.DB, days) });
+}
+
+async function handleAdminAnalyticsWorkflows(request: Request, env: Env): Promise<Response> {
+  if (request.method !== "GET") return methodNotAllowed(["GET"]);
+  await requireOperator(request, env, "readAnalytics");
+  const days = integer(new URL(request.url).searchParams.get("days") ?? undefined, 30, 1, 366);
+  return json({ schema_version: "1", analytics: await loadWorkflowAnalytics(env.DB, days) });
+}
+
+async function handleAdminSearch(request: Request, env: Env): Promise<Response> {
+  if (request.method !== "GET") return methodNotAllowed(["GET"]);
+  const session = await requireOperator(request, env, "searchWorkspace");
+  const url = new URL(request.url);
+  return json({
+    schema_version: "1",
+    results: await searchWorkspace(
+      env.DB,
+      url.searchParams.get("q") ?? "",
+      session.queueScope ?? null,
+      integer(url.searchParams.get("limit") ?? undefined, 30, 1, 100),
+    ),
+  });
+}
+
+async function handleAdminSavedViews(request: Request, env: Env): Promise<Response> {
+  const session = await requireOperator(request, env, "searchWorkspace");
+  if (request.method === "GET") return json({ schema_version: "1", saved_views: await listSavedViews(env.DB, session.actor.id) });
+  if (request.method === "POST") {
+    const savedView = await createSavedView(env.DB, session.actor.id, await readJsonObject(request, 64 * 1024));
+    return json({ schema_version: "1", saved_view: savedView }, { status: 201 });
+  }
+  return methodNotAllowed(["GET", "POST"]);
+}
+
+async function handleAdminSavedView(request: Request, env: Env, viewId: string): Promise<Response> {
+  const session = await requireOperator(request, env, "searchWorkspace");
+  if (request.method === "PATCH") {
+    const savedView = await updateSavedView(env.DB, session.actor.id, viewId, await readJsonObject(request, 64 * 1024));
+    return json({ schema_version: "1", saved_view: savedView });
+  }
+  if (request.method === "DELETE") {
+    await deleteSavedView(env.DB, session.actor.id, viewId);
+    return new Response(null, { status: 204 });
+  }
+  return methodNotAllowed(["PATCH", "DELETE"]);
+}
+
+async function handleAdminReportsExport(request: Request, env: Env): Promise<Response> {
+  if (request.method !== "GET") return methodNotAllowed(["GET"]);
+  const session = await requireOperator(request, env, "exportData");
+  const days = integer(new URL(request.url).searchParams.get("days") ?? undefined, 30, 1, 366);
+  const body = await reportsCsv(env.DB, days, session.queueScope ?? null);
+  await recordExportAudit(env.DB, session.actor.id, days);
+  return new Response(body, {
+    headers: {
+      "content-type": "text/csv; charset=utf-8",
+      "content-disposition": `attachment; filename="safest-resolve-${nowDateForFile()}.csv"`,
+      "cache-control": "no-store",
+    },
+  });
+}
+
+async function handleAdminExports(request: Request, env: Env): Promise<Response> {
+  if (request.method === "GET") {
+    const session = await requireOperator(request, env, "exportData");
+    return json({ schema_version: "1", exports: await listExports(env.DB, session.actor.id, integer(new URL(request.url).searchParams.get("limit") ?? undefined, 50, 1, 100)) });
+  }
+  if (request.method === "POST") {
+    const session = await requireOperator(request, env, "exportData");
+    const result = await createExport(env, await readJsonObject(request, 64 * 1024), session, mutationKey(request));
+    return json({ schema_version: "1", ...result }, { status: result.idempotentReplay ? 200 : 201 });
+  }
+  return methodNotAllowed(["GET", "POST"]);
+}
+
+async function handleAdminExport(request: Request, env: Env, exportId: string): Promise<Response> {
+  if (request.method !== "GET") return methodNotAllowed(["GET"]);
+  const session = await requireOperator(request, env, "exportData");
+  if (new URL(request.url).searchParams.get("download") === "1") return downloadExport(env, exportId, session.actor.id);
+  const exportJob = await loadExport(env.DB, exportId, session.actor.id);
+  if (!exportJob) throw new ApiError(404, "export_not_found", "The export does not exist.");
+  return json({
+    schema_version: "1",
+    export: {
+      ...exportJob,
+      objectKey: undefined,
+      downloadUrl: exportJob.state === "ready" ? `/v1/admin/exports/${encodeURIComponent(exportId)}?download=1` : null,
+    },
+  });
+}
+
+function nowDateForFile(): string {
+  return new Date().toISOString().slice(0, 10);
+}
+
+async function handleAdminAudit(request: Request, env: Env): Promise<Response> {
+  if (request.method !== "GET") return methodNotAllowed(["GET"]);
+  const session = await requireOperator(request, env, "viewAudit");
+  const url = new URL(request.url);
+  if (url.searchParams.has("after")) throw new ApiError(400, "invalid_query", "Use the opaque cursor parameter for audit pagination.");
+  const cursorScope = `audit:${session.actor.id}`;
+  const cursor = await decodeApiCursor<{ sequence: number }>(env.CONTEXT_SIGNING_SECRET, cursorScope, url.searchParams.get("cursor"));
+  if (cursor && (!Number.isInteger(cursor.sequence) || cursor.sequence < 0 || cursor.sequence > Number.MAX_SAFE_INTEGER)) {
+    throw new ApiError(400, "cursor_invalid", "cursor is invalid or does not belong to this query.");
+  }
+  const limit = integer(url.searchParams.get("limit") ?? undefined, 100, 1, 500);
+  const page = await listAuditEntries(env.DB, cursor?.sequence ?? 0, limit);
+  return json({
+    schema_version: "1",
+    entries: page.entries,
+    next_cursor: page.nextSequence === null
+      ? null
+      : await encodeApiCursor(env.CONTEXT_SIGNING_SECRET, cursorScope, { sequence: page.nextSequence }),
+  });
+}
+
+async function handleAdminAuditVerify(request: Request, env: Env): Promise<Response> {
+  if (request.method !== "GET" && request.method !== "POST") return methodNotAllowed(["GET", "POST"]);
+  await requireOperator(request, env, "viewAudit");
+  return json({ schema_version: "1", verification: await verifyAuditChain(env.DB) });
+}
+
+function mutationKey(request: Request): string {
+  const key = request.headers.get("idempotency-key")?.trim() ?? "";
+  if (key.length < 8 || key.length > 200) throw new ApiError(400, "idempotency_key_required", "A stable Idempotency-Key header containing 8 to 200 characters is required.");
+  return key;
+}
+
+function boundedBodyString(value: unknown, name: string, maximum: number): string {
+  if (typeof value !== "string" || value.trim().length < 3 || value.trim().length > maximum) {
+    throw new ApiError(400, "invalid_request", `${name} must contain 3 to ${maximum} characters.`);
+  }
+  return value.trim();
+}
+
+async function handleAdminLegalHolds(request: Request, env: Env): Promise<Response> {
+  if (request.method === "GET") {
+    await requireOperator(request, env, "manageGovernance");
+    return json({ schema_version: "1", legal_holds: await listLegalHolds(env.DB, integer(new URL(request.url).searchParams.get("limit") ?? undefined, 100, 1, 200)) });
+  }
+  if (request.method !== "POST") return methodNotAllowed(["GET", "POST"]);
+  const session = await requireOperator(request, env, "manageGovernance");
+  const body = await readJsonObject(request, 8 * 1024);
+  if (Object.keys(body).some((key) => !["report_id", "reason"].includes(key))) throw new ApiError(400, "invalid_request", "The legal-hold request contains unsupported fields.");
+  const reportId = boundedBodyString(body.report_id, "report_id", 100);
+  const reason = boundedBodyString(body.reason, "reason", 2_000);
+  const result = await createLegalHold(env.DB, reportId, reason, session.actor.id, mutationKey(request));
+  return json({ schema_version: "1", legal_hold_id: result.id, idempotent_replay: result.idempotentReplay }, { status: result.idempotentReplay ? 200 : 201 });
+}
+
+async function handleAdminLegalHoldRelease(request: Request, env: Env, holdId: string): Promise<Response> {
+  if (request.method !== "DELETE") return methodNotAllowed(["DELETE"]);
+  const session = await requireOperator(request, env, "manageGovernance");
+  await releaseLegalHold(env.DB, holdId, session.actor.id, mutationKey(request));
+  return new Response(null, { status: 204 });
+}
+
+async function handleAdminDeletionRequests(request: Request, env: Env): Promise<Response> {
+  if (request.method === "GET") {
+    await requireOperator(request, env, "manageGovernance");
+    return json({ schema_version: "1", deletion_requests: await listDeletionRequests(env.DB, integer(new URL(request.url).searchParams.get("limit") ?? undefined, 100, 1, 200)) });
+  }
+  if (request.method !== "POST") return methodNotAllowed(["GET", "POST"]);
+  const session = await requireOperator(request, env, "manageGovernance");
+  const body = await readJsonObject(request, 8 * 1024);
+  if (Object.keys(body).some((key) => !["report_id", "scope", "reason"].includes(key))) throw new ApiError(400, "invalid_request", "The deletion request contains unsupported fields.");
+  const scope = body.scope;
+  if (scope !== "participant_data" && scope !== "all_permitted_data") throw new ApiError(400, "invalid_request", "scope is invalid.");
+  const result = await createDeletionRequest(env.DB, {
+    reportId: boundedBodyString(body.report_id, "report_id", 100),
+    scope,
+    reason: boundedBodyString(body.reason, "reason", 2_000),
+  }, session.actor.id, mutationKey(request));
+  return json({ schema_version: "1", deletion_request_id: result.id, state: result.state, idempotent_replay: result.idempotentReplay }, {
+    status: result.idempotentReplay ? 200 : 201,
+  });
+}
+
+async function handleAdminRetention(request: Request, env: Env, preview: boolean): Promise<Response> {
+  const messageDays = integer(env.MESSAGE_RETENTION_DAYS, 90, 1, 3_650);
+  const reportDays = integer(env.REPORT_RETENTION_DAYS, 365, 30, 3_650);
+  if (preview) {
+    if (request.method !== "POST") return methodNotAllowed(["POST"]);
+    await requireOperator(request, env, "manageGovernance");
+    return json({ schema_version: "1", preview: await previewRetention(env.DB, messageDays, reportDays) });
+  }
+  if (request.method !== "GET") return methodNotAllowed(["GET"]);
+  await requireOperator(request, env, "manageGovernance");
+  return json({ schema_version: "1", retention: await retentionOverview(env.DB, messageDays, reportDays) });
+}
+
+async function handleAdminReportDetail(request: Request, env: Env, reportId: string): Promise<Response> {
+  if (request.method !== "GET") return methodNotAllowed(["GET"]);
+  const session = await requireOperator(request, env, "readReports");
+  await assertOperatorReportAccess(env.DB, session, reportId);
+  const report = await loadReportDetail(env.DB, reportId);
+  if (!report) throw new ApiError(404, "report_not_found", "The report does not exist.");
+  return json({ schema_version: "1", report: projectOperatorFields(session, "report", report) });
+}
+
+async function handleAdminReportClaim(request: Request, env: Env, ctx: ExecutionContext, reportId: string): Promise<Response> {
+  const session = await requireOperator(request, env, "claimReports");
+  await assertOperatorReportAccess(env.DB, session, reportId);
+  if (request.method === "POST") {
+    const claim = await claimReport(env.DB, reportId, session, integer(env.CLAIM_TTL_MINUTES, 15, 1, 1_440));
+    publishWorkspaceEvent(env, ctx, { type: "claim_changed", reportId });
+    return json({ schema_version: "1", claim }, { status: 201 });
+  }
+  if (request.method === "DELETE") {
+    await releaseReportClaim(env.DB, reportId, session);
+    publishWorkspaceEvent(env, ctx, { type: "claim_changed", reportId });
+    return new Response(null, { status: 204 });
+  }
+  return methodNotAllowed(["POST", "DELETE"]);
+}
+
+async function handleAdminReportMessage(
+  request: Request,
+  env: Env,
+  ctx: ExecutionContext,
+  reportId: string,
+): Promise<Response> {
+  if (request.method !== "POST") return methodNotAllowed(["POST"]);
+  const session = await requireOperator(request, env, "messageReporters");
+  await assertOperatorReportAccess(env.DB, session, reportId);
+  const result = await addReviewerMessage(
+    env.DB,
+    reportId,
+    session,
+    parseReviewerMessage(await readJsonObject(request, 16 * 1024), request.headers.get("idempotency-key")),
+    deliveryOptions(env),
+  );
+  queueDeliveryJobs(env, ctx, result.jobs);
+  publishWorkspaceEvent(env, ctx, { type: "reports_changed", reportId });
+  return json({ schema_version: "1", message_id: result.messageId, idempotent_replay: result.idempotentReplay }, {
+    status: result.idempotentReplay ? 200 : 201,
+  });
+}
+
+async function handleAdminReportDecision(
+  request: Request,
+  env: Env,
+  ctx: ExecutionContext,
+  reportId: string,
+): Promise<Response> {
+  if (request.method !== "POST") return methodNotAllowed(["POST"]);
+  const session = await requireOperator(request, env, "decideReports");
+  await assertOperatorReportAccess(env.DB, session, reportId);
+  const allowedActionCodes = new Set(env.ALLOWED_ACTION_CODES.split(",").map((value) => value.trim()).filter(Boolean));
+  const result = await recordHumanDecision(
+    env.DB,
+    reportId,
+    session,
+    parseDecision(await readJsonObject(request, 32 * 1024), request.headers.get("idempotency-key")),
+    {
+      ...deliveryOptions(env),
+      allowedActionCodes,
+      actionEnabled: Boolean(env.ACTION_WEBHOOK_URL?.trim() && env.ACTION_WEBHOOK_SECRET?.trim()),
+    },
+  );
+  queueDeliveryJobs(env, ctx, result.jobs);
+  publishWorkspaceEvent(env, ctx, { type: "reports_changed", reportId });
+  return json({ schema_version: "1", decision_id: result.decisionId, idempotent_replay: result.idempotentReplay }, {
+    status: result.idempotentReplay ? 200 : 201,
+  });
+}
+
+async function terminateActivePrimaryRun(env: Env, reportId: string): Promise<string | null> {
+  const active = await env.DB.prepare(`
+    SELECT id FROM workflow_runs WHERE report_id = ?1 AND run_kind = 'primary'
+      AND state IN ('created','dispatch_pending','queued','running','waiting','paused','repair_required')
+    ORDER BY created_at DESC, id DESC LIMIT 1
+  `).bind(reportId).first<{ id: string }>();
+  if (!active) return null;
+  await controlWorkflowRun(env, active.id, "terminate");
+  return active.id;
+}
+
+async function startAssignedPrimaryRun(
+  env: Env,
+  ctx: ExecutionContext,
+  reportId: string,
+  session: Awaited<ReturnType<typeof requireAnyOperator>>,
+  idempotencyKey: string,
+): Promise<{ runId: string; workflowVersionId: string; idempotentReplay: boolean } | null> {
+  const pin = await env.DB.prepare(`
+    SELECT p.id FROM reports r JOIN queue_workflow_pins p
+      ON p.queue_id = r.queue_id AND p.mode = 'primary' AND p.deactivated_at IS NULL
+    JOIN workflow_versions v ON v.id = p.workflow_version_id AND v.retired_at IS NULL
+    JOIN workflow_artifacts a ON a.id = v.artifact_id AND a.status = 'ready'
+    WHERE r.id = ?1 LIMIT 1
+  `).bind(reportId).first<{ id: string }>();
+  if (!pin) return null;
+  const result = await createPinnedWorkflowRun(env.DB, reportId, "primary", session, idempotencyKey);
+  ctx.waitUntil(env.CONTROL_JOBS.send(result.job, { contentType: "json" }).catch((error: unknown) => {
+    console.error("assigned workflow dispatch enqueue failed; reconciliation will retry", {
+      runId: result.runId,
+      errorType: error instanceof Error ? error.name : typeof error,
+    });
+  }));
+  return { runId: result.runId, workflowVersionId: result.workflowVersionId, idempotentReplay: result.idempotentReplay };
+}
+
+async function handleAdminReportReassign(
+  request: Request,
+  env: Env,
+  ctx: ExecutionContext,
+  reportId: string,
+): Promise<Response> {
+  if (request.method !== "POST") return methodNotAllowed(["POST"]);
+  const session = await requireOperator(request, env, "reassignReports");
+  await assertOperatorReportAccess(env.DB, session, reportId);
+  const body = await readJsonObject(request, 16 * 1024);
+  const queueId = boundedBodyString(body.queue_id, "queue_id", 100);
+  const reason = boundedBodyString(body.reason, "reason", 2_000);
+  assertOperatorQueueAccess(session, queueId);
+  const idempotencyKey = mutationKey(request);
+  await terminateActivePrimaryRun(env, reportId);
+  const assignment = await reassignReport(env.DB, reportId, queueId, reason, session, idempotencyKey);
+  const workflowRun = await startAssignedPrimaryRun(env, ctx, reportId, session, `report-reassign-run:${idempotencyKey}`);
+  publishWorkspaceEvent(env, ctx, { type: "reports_changed", reportId });
+  return json({ schema_version: "1", assignment, workflow_run: workflowRun }, { status: assignment.idempotentReplay ? 200 : 202 });
+}
+
+async function handleAdminReportEnrichment(
+  request: Request,
+  env: Env,
+  reportId: string,
+  componentKey: string,
+): Promise<Response> {
+  if (request.method !== "POST") return methodNotAllowed(["POST"]);
+  const session = await requireOperator(request, env, "runEnrichments");
+  await assertOperatorReportAccess(env.DB, session, reportId);
+  const body = await readJsonObject(request, 256 * 1024);
+  const componentInput = body.input;
+  if (!componentInput || typeof componentInput !== "object" || Array.isArray(componentInput)) {
+    throw new ApiError(400, "component_input_invalid", "input must be an object.");
+  }
+  if (body.component_version_id !== undefined && typeof body.component_version_id !== "string") {
+    throw new ApiError(400, "component_version_invalid", "component_version_id must be a string.");
+  }
+  const version = await env.DB.prepare(`
+    SELECT v.id FROM component_definitions d JOIN component_versions v
+      ON v.definition_id = d.id
+    WHERE d.component_key = ?1 AND d.status = 'active' AND d.effect_class = 'read_only'
+      AND v.id = COALESCE(?2, d.active_version_id)
+      AND v.published_at IS NOT NULL AND v.retired_at IS NULL
+    LIMIT 1
+  `).bind(componentKey, typeof body.component_version_id === "string" ? body.component_version_id : null).first<{ id: string }>();
+  if (!version) throw new ApiError(409, "component_version_unavailable", "The requested published read-only component is unavailable.");
+  try {
+    const result = await executeAssistantReadOnlyComponent(env, {
+      reportId,
+      componentVersionId: version.id,
+      componentInput: componentInput as JsonObject,
+      operationId: mutationKey(request),
+      actorId: session.actor.id,
+      source: "operator",
+    });
+    return json({ schema_version: "1", ...result }, { status: result.idempotentReplay ? 200 : 201 });
+  } catch (error) {
+    if (error instanceof ComponentExecutionError) {
+      throw new ApiError(error.retryable ? 503 : 422, error.code, "The enrichment could not be completed safely.", {
+        retryable: error.retryable,
+        retry_after_seconds: error.delaySeconds,
+      });
+    }
+    throw error;
+  }
+}
+
+async function handleAdminReportCollection(
+  request: Request,
+  env: Env,
+  reportId: string,
+  collection: "timeline" | "findings" | "actions",
+): Promise<Response> {
+  const permission = collection === "findings" ? "readEvidence" : "readReports";
+  if (request.method !== "GET") return methodNotAllowed(["GET"]);
+  const session = await requireOperator(request, env, permission);
+  await assertOperatorReportAccess(env.DB, session, reportId);
+  if (collection === "findings") return json({ schema_version: "1", findings: await listReportFindings(env.DB, reportId) });
+  if (collection === "actions") return json({ schema_version: "1", actions: await listReportActions(env.DB, reportId) });
+  const url = new URL(request.url);
+  const timeline = await loadReportTimeline(env.DB, reportId, {
+    cursor: url.searchParams.get("cursor"),
+    cursorSecret: env.CONTEXT_SIGNING_SECRET,
+    limit: integer(url.searchParams.get("limit") ?? undefined, 50, 1, 100),
+  });
+  return json({ schema_version: "1", events: timeline.events, next_cursor: timeline.nextCursor });
+}
+
+async function handleAdminReportCloseOrReopen(
+  request: Request,
+  env: Env,
+  ctx: ExecutionContext,
+  reportId: string,
+  action: "close" | "reopen",
+): Promise<Response> {
+  if (request.method !== "POST") return methodNotAllowed(["POST"]);
+  const session = await requireOperator(request, env, "decideReports");
+  await assertOperatorReportAccess(env.DB, session, reportId);
+  const body = await readJsonObject(request, 16 * 1024);
+  const reason = boundedBodyString(body.reason, "reason", 2_000);
+  const idempotencyKey = mutationKey(request);
+  if (action === "close") {
+    await terminateActivePrimaryRun(env, reportId);
+    const result = await closeReport(env.DB, reportId, reason, session, idempotencyKey);
+    publishWorkspaceEvent(env, ctx, { type: "reports_changed", reportId });
+    return json({ schema_version: "1", ...result });
+  }
+  const queueId = boundedBodyString(body.queue_id, "queue_id", 100);
+  assertOperatorQueueAccess(session, queueId);
+  const result = await reopenReport(env.DB, reportId, queueId, reason, session, idempotencyKey);
+  const workflowRun = await startAssignedPrimaryRun(env, ctx, reportId, session, `report-reopen-run:${idempotencyKey}`);
+  publishWorkspaceEvent(env, ctx, { type: "reports_changed", reportId });
+  return json({ schema_version: "1", report: result, workflow_run: workflowRun }, { status: result.idempotentReplay ? 200 : 202 });
+}
+
+async function handleAdminDecision(request: Request, env: Env, decisionId: string): Promise<Response> {
+  if (request.method !== "GET") return methodNotAllowed(["GET"]);
+  const session = await requireOperator(request, env, "readReports");
+  const decision = await loadDecisionDetail(env.DB, decisionId);
+  if (!decision) throw new ApiError(404, "decision_not_found", "The decision does not exist.");
+  await assertOperatorReportAccess(env.DB, session, String(decision.reportId));
+  return json({ schema_version: "1", decision: projectOperatorFields(session, "decision", decision) });
+}
+
+async function handleAdminAppeals(request: Request, env: Env): Promise<Response> {
+  if (request.method !== "GET") return methodNotAllowed(["GET"]);
+  const session = await requireOperator(request, env, "reviewAppeals");
+  const limit = integer(new URL(request.url).searchParams.get("limit") ?? undefined, 50, 1, 100);
+  return json({ schema_version: "1", appeals: await listAppeals(env.DB, limit, session.queueScope ?? null) });
+}
+
+async function handleAdminAppealDetail(request: Request, env: Env, appealId: string): Promise<Response> {
+  if (request.method !== "GET") return methodNotAllowed(["GET"]);
+  const session = await requireOperator(request, env, "reviewAppeals");
+  const appeal = await loadAppealDetail(env.DB, appealId);
+  if (!appeal) throw new ApiError(404, "appeal_not_found", "The appeal does not exist.");
+  await assertOperatorReportAccess(env.DB, session, String(appeal.reportId));
+  return json({ schema_version: "1", appeal: projectOperatorFields(session, "appeal", appeal) });
+}
+
+async function handleAdminAppealClaim(
+  request: Request,
+  env: Env,
+  appealId: string,
+): Promise<Response> {
+  const session = await requireOperator(request, env, "reviewAppeals");
+  const appeal = await loadAppealDetail(env.DB, appealId);
+  if (!appeal) throw new ApiError(404, "appeal_not_found", "The appeal does not exist.");
+  await assertOperatorReportAccess(env.DB, session, String(appeal.reportId));
+  if (request.method === "POST") {
+    const claim = await claimAppeal(env.DB, appealId, session, integer(env.CLAIM_TTL_MINUTES, 15, 1, 1_440));
+    return json({ schema_version: "1", claim }, { status: 201 });
+  }
+  if (request.method === "DELETE") {
+    await releaseAppealClaim(env.DB, appealId, session);
+    return new Response(null, { status: 204 });
+  }
+  return methodNotAllowed(["POST", "DELETE"]);
+}
+
+async function handleAdminAppealDecision(
+  request: Request,
+  env: Env,
+  ctx: ExecutionContext,
+  appealId: string,
+): Promise<Response> {
+  if (request.method !== "POST") return methodNotAllowed(["POST"]);
+  const session = await requireOperator(request, env, "decideAppeals");
+  const appeal = await loadAppealDetail(env.DB, appealId);
+  if (!appeal) throw new ApiError(404, "appeal_not_found", "The appeal does not exist.");
+  await assertOperatorReportAccess(env.DB, session, String(appeal.reportId));
+  const allowedActionCodes = new Set(env.ALLOWED_ACTION_CODES.split(",").map((value) => value.trim()).filter(Boolean));
+  const result = await decideAppeal(
+    env.DB,
+    appealId,
+    session,
+    parseAppealDecision(await readJsonObject(request, 32 * 1024), request.headers.get("idempotency-key")),
+    {
+      ...deliveryOptions(env),
+      allowedActionCodes,
+      actionEnabled: Boolean(env.ACTION_WEBHOOK_URL?.trim() && env.ACTION_WEBHOOK_SECRET?.trim()),
+    },
+  );
+  queueDeliveryJobs(env, ctx, result.jobs);
+  return json({
+    schema_version: "1",
+    appeal_decision_id: result.appealDecisionId,
+    idempotent_replay: result.idempotentReplay,
+  }, { status: result.idempotentReplay ? 200 : 201 });
+}
+
+async function handleHealth(request: Request, env: Env): Promise<Response> {
+  if (request.method !== "GET") return methodNotAllowed(["GET"]);
+  void env;
+  return json({ status: "ok", service: "safest-resolve-reports", version: "1" });
+}
+
+async function handleReady(request: Request, env: Env): Promise<Response> {
+  if (request.method !== "GET") return methodNotAllowed(["GET"]);
+  await requireAnyOperator(request, env);
+  try {
+    const [migrations, features] = await Promise.all([
+      env.DB.prepare(`SELECT COUNT(*) AS count FROM d1_migrations`).first<{ count: number }>(),
+      env.DB.prepare(`SELECT feature_key AS featureKey, state FROM installation_features WHERE installation_id = 'default'`).all<{ featureKey: string; state: string }>(),
+      env.PROFILE_MEDIA.list({ limit: 1 }),
+      env.WORKFLOW_ARTIFACTS.list({ limit: 1 }),
+      env.EVIDENCE_OBJECTS.list({ limit: 1 }),
+      env.EXPORTS.list({ limit: 1 }),
+    ]);
+    const migrationCount = Number(migrations?.count ?? 0);
+    const featureStates = new Map(features.results.map((feature) => [feature.featureKey, feature.state]));
+    const requiredFeatures = ["database", "workflow_runtime", "workers_ai", "object_storage", "queues"];
+    const unavailable = requiredFeatures.filter((feature) => featureStates.get(feature) !== "ready");
+    const bindingsReady = Boolean(env.WORKFLOWS && env.LOADER && env.CONTROL_JOBS && env.REPORT_JOBS && env.DELIVERY_JOBS && env.AI);
+    const ready = migrationCount >= EXPECTED_DATABASE_MIGRATIONS && unavailable.length === 0 && bindingsReady;
+    return json({
+      status: ready ? "ready" : "not_ready",
+      service: "safest-resolve-reports",
+      schema_migrations: migrationCount,
+      checks: { database: true, private_object_storage: true, runtime_bindings: bindingsReady, unavailable_features: unavailable },
+    }, { status: ready ? 200 : 503 });
+  } catch {
+    return json({ status: "not_ready", service: "safest-resolve-reports", checks: { dependency_probe: false } }, { status: 503 });
+  }
+}
+
+async function requireAnyOperator(request: Request, env: Env) {
+  const session = await resolveOperatorSession(request, env);
+  if (!session) throw new ApiError(401, "operator_authentication_required", "Sign in to your Safest workspace to continue.");
+  return session;
+}
+
+async function requireDeploymentOwner(request: Request, env: Env) {
+  const session = await resolveOperatorSession(request, env);
+  if (!session) throw new ApiError(401, "infrastructure_authentication_required", "The deployment owner key is required.");
+  if (session.actor.type !== "admin_key" || session.authMethod !== "admin_key") {
+    throw new ApiError(403, "infrastructure_authentication_required", "This operation requires the deployment owner key, not an interactive operator session.");
+  }
+  return session;
+}
+
+async function handleAdminBackups(request: Request, env: Env): Promise<Response> {
+  if (request.method === "GET") {
+    const session = await requireOperator(request, env, "manageGovernance");
+    const url = new URL(request.url);
+    const limit = integer(url.searchParams.get("limit") ?? undefined, 100, 1, 200);
+    const cursorScope = `backup-list:${session.actor.type}:${session.actor.id}`;
+    const cursor = await decodeApiCursor<{ createdAt: string; id: string }>(
+      env.CONTEXT_SIGNING_SECRET,
+      cursorScope,
+      url.searchParams.get("cursor"),
+    );
+    if (cursor && (typeof cursor.createdAt !== "string" || !Number.isFinite(Date.parse(cursor.createdAt))
+      || typeof cursor.id !== "string" || cursor.id.length !== 36)) {
+      throw new ApiError(400, "cursor_invalid", "cursor is invalid or does not belong to this query.");
+    }
+    const page = await listBackups(env.DB, limit, cursor ?? undefined);
+    return json({
+      schema_version: "1",
+      backups: page.backups,
+      next_cursor: page.nextCursor
+        ? await encodeApiCursor(env.CONTEXT_SIGNING_SECRET, cursorScope, page.nextCursor)
+        : null,
+    });
+  }
+  if (request.method !== "POST") return methodNotAllowed(["GET", "POST"]);
+  const session = await requireDeploymentOwner(request, env);
+  const result = await startBackup(
+    env.DB,
+    session,
+    await readJsonObject(request, 8 * 1024),
+    mutationKey(request),
+  );
+  return json({ schema_version: "1", ...result }, { status: result.idempotentReplay ? 200 : 201 });
+}
+
+async function handleAdminBackup(
+  request: Request,
+  env: Env,
+  backupId: string,
+  action?: "r2" | "r2/object",
+): Promise<Response> {
+  if (!action) {
+    if (request.method !== "PATCH") return methodNotAllowed(["PATCH"]);
+    const session = await requireDeploymentOwner(request, env);
+    const result = await finalizeBackup(
+      env.DB,
+      session,
+      backupId,
+      parseBackupCompletion(await readJsonObject(request, 16 * 1024)),
+      mutationKey(request),
+    );
+    return json({ schema_version: "1", ...result });
+  }
+  if (request.method !== "GET") return methodNotAllowed(["GET"]);
+  await requireDeploymentOwner(request, env);
+  const normalizedBackupId = await assertBackupTransferAllowed(env.DB, backupId);
+  const url = new URL(request.url);
+  const bucketName = parseBackupBucket(url.searchParams.get("bucket"));
+  const bucket = backupBucket(env, bucketName);
+  if (action === "r2/object") {
+    const object = await readBackupObject(bucket, url.searchParams.get("key"), url.searchParams.get("etag"));
+    return new Response(object.body, {
+      status: 200,
+      headers: {
+        "cache-control": "no-store",
+        "content-disposition": "attachment; filename=\"r2-object\"",
+        "content-length": String(object.size),
+        "content-type": "application/octet-stream",
+        etag: object.httpEtag,
+        "x-content-type-options": "nosniff",
+      },
+    });
+  }
+  const cursorScope = `backup-r2:${normalizedBackupId}:${bucketName}`;
+  const cursor = await decodeApiCursor<{ r2Cursor: string }>(
+    env.CONTEXT_SIGNING_SECRET,
+    cursorScope,
+    url.searchParams.get("cursor"),
+  );
+  if (cursor && (typeof cursor.r2Cursor !== "string" || cursor.r2Cursor.length > 4_096)) {
+    throw new ApiError(400, "cursor_invalid", "cursor is invalid or does not belong to this query.");
+  }
+  const page = await listBackupObjects(
+    bucket,
+    cursor?.r2Cursor,
+    integer(url.searchParams.get("limit") ?? undefined, 500, 1, 1_000),
+  );
+  return json({
+    schema_version: "1",
+    bucket: bucketName,
+    objects: page.objects,
+    next_cursor: page.nextCursor
+      ? await encodeApiCursor(env.CONTEXT_SIGNING_SECRET, cursorScope, { r2Cursor: page.nextCursor })
+      : null,
+  });
+}
+
+async function handleMetaCapabilities(request: Request, env: Env): Promise<Response> {
+  if (request.method !== "GET") return methodNotAllowed(["GET"]);
+  await requireAnyOperator(request, env);
+  const installation = await loadInstallation(env.DB);
+  return json({ schema_version: "1", capabilities: installation.features });
+}
+
+async function handleMetaVersion(request: Request, env: Env): Promise<Response> {
+  if (request.method !== "GET") return methodNotAllowed(["GET"]);
+  await requireAnyOperator(request, env);
+  return json({ schema_version: "1", version: await metaVersion(env.DB) });
+}
+
+async function handleAdminInstallation(request: Request, env: Env): Promise<Response> {
+  if (request.method === "GET") {
+    await requireOperator(request, env, "manageInstallation");
+    return json({ schema_version: "1", installation: await loadInstallation(env.DB) });
+  }
+  if (request.method === "PATCH") {
+    const session = await requireOperator(request, env, "manageInstallation");
+    const result = await updateInstallation(env.DB, await readJsonObject(request, 64 * 1024), session, mutationKey(request));
+    return json({ schema_version: "1", installation: result });
+  }
+  return methodNotAllowed(["GET", "PATCH"]);
+}
+
+async function handleAdminBrand(request: Request, env: Env): Promise<Response> {
+  if (request.method === "GET") {
+    await requireOperator(request, env, "manageConfiguration");
+    return json({ schema_version: "1", brand: await loadWorkspaceBrand(env.DB) });
+  }
+  if (request.method === "PATCH") {
+    const session = await requireOperator(request, env, "manageConfiguration");
+    const body = await readJsonObject(request, 32 * 1024);
+    if (Object.keys(body).some((key) => key !== "brand") || !body.brand || typeof body.brand !== "object" || Array.isArray(body.brand)) {
+      throw new ApiError(400, "brand_update_invalid", "Provide the visual branding values to save.");
+    }
+    const installation = await loadInstallation(env.DB);
+    const settings = installation.settings && typeof installation.settings === "object" && !Array.isArray(installation.settings)
+      ? { ...(installation.settings as Record<string, unknown>), brand: body.brand }
+      : { brand: body.brand };
+    await updateInstallation(env.DB, { settings }, session, mutationKey(request));
+    return json({ schema_version: "1", brand: await loadWorkspaceBrand(env.DB) });
+  }
+  return methodNotAllowed(["GET", "PATCH"]);
+}
+
+async function handleAdminReportingChannels(request: Request, env: Env): Promise<Response> {
+  if (request.method === "GET") {
+    await requireOperator(request, env, "manageIntegrations");
+    const [installation, publishedForms] = await Promise.all([loadInstallation(env.DB), listPublishedForms(env.DB)]);
+    const settings = installation.settings && typeof installation.settings === "object" && !Array.isArray(installation.settings)
+      ? installation.settings as Record<string, unknown>
+      : {};
+    const publicFormIds = Array.isArray(settings.public_form_version_ids)
+      ? settings.public_form_version_ids.filter((value): value is string => typeof value === "string")
+      : [];
+    let antiAbuseReady = true;
+    try { turnstileConfig(env); } catch { antiAbuseReady = false; }
+    const enabled = installation.anonymousReportingEnabled === true && antiAbuseReady;
+    return json({
+      schema_version: "1",
+      channels: publishedForms.filter((form) => publicFormIds.includes(form.id)).map((form) => ({
+        id: `hosted:${form.id}`,
+        mode: "hosted",
+        name: form.title,
+        formVersionId: form.id,
+        url: new URL(`/report/?form=${encodeURIComponent(form.id)}`, publicBaseUrl(env)).href,
+        enabled,
+        status: antiAbuseReady ? (installation.anonymousReportingEnabled === true ? "ready" : "disabled") : "turnstile_required",
+      })),
+    });
+  }
+  if (request.method !== "POST") return methodNotAllowed(["GET", "POST"]);
+  const session = await requireOperator(request, env, "manageIntegrations");
+  const body = await readJsonObject(request, 16 * 1024);
+  if (body.mode !== "hosted" || typeof body.form_version_id !== "string" || body.form_version_id.length > 160) {
+    throw new ApiError(400, "reporting_channel_invalid", "Choose a published form for the hosted report page.");
+  }
+  const publishedForms = await listPublishedForms(env.DB);
+  if (!publishedForms.some((form) => form.id === body.form_version_id)) {
+    throw new ApiError(400, "reporting_channel_form_unpublished", "Publish this intake form before creating a hosted report page.");
+  }
+  turnstileConfig(env);
+  const installation = await loadInstallation(env.DB);
+  const currentSettings = installation.settings && typeof installation.settings === "object" && !Array.isArray(installation.settings)
+    ? installation.settings as Record<string, unknown>
+    : {};
+  const currentPublicForms = Array.isArray(currentSettings.public_form_version_ids)
+    ? currentSettings.public_form_version_ids.filter((value): value is string => typeof value === "string")
+    : [];
+  const settings = {
+    ...currentSettings,
+    public_form_version_ids: [...new Set([...currentPublicForms, body.form_version_id])],
+  };
+  await updateInstallation(env.DB, { anonymous_reporting_enabled: true, settings }, session, mutationKey(request));
+  return json({
+    schema_version: "1",
+    channel: {
+      mode: "hosted",
+      formVersionId: body.form_version_id,
+      url: new URL(`/report/?form=${encodeURIComponent(body.form_version_id)}`, publicBaseUrl(env)).href,
+    },
+  }, { status: 201 });
+}
+
+async function handleAdminSetup(request: Request, env: Env): Promise<Response> {
+  if (request.method !== "GET") return methodNotAllowed(["GET"]);
+  await requireOperator(request, env, "manageInstallation");
+  const installation = await loadInstallation(env.DB);
+  const features = installation.features as Array<Record<string, unknown>>;
+  return json({
+    schema_version: "1",
+    setup: {
+      ready: features.filter((feature) => feature.featureKey !== "email").every((feature) => feature.state === "ready"),
+      features,
+      optional: ["email"],
+    },
+  });
+}
+
+async function handleAdminSetupVerify(request: Request, env: Env, feature: string): Promise<Response> {
+  if (request.method !== "POST") return methodNotAllowed(["POST"]);
+  const session = await requireOperator(request, env, "manageInstallation");
+  return json({ schema_version: "1", verification: await verifyFeature(env, feature, session.actor.id) });
+}
+
+async function handleAdminIntegrations(request: Request, env: Env): Promise<Response> {
+  if (request.method === "GET") {
+    await requireOperator(request, env, "manageIntegrations");
+    return json({ schema_version: "1", integrations: await listIntegrations(env.DB) });
+  }
+  if (request.method === "POST") {
+    const session = await requireOperator(request, env, "manageIntegrations");
+    const result = await createIntegration(env.DB, await readJsonObject(request, 64 * 1024), session, mutationKey(request));
+    return json({ schema_version: "1", ...result, publicBaseUrl: publicBaseUrl(env) }, { status: 201, headers: { "cache-control": "no-store" } });
+  }
+  return methodNotAllowed(["GET", "POST"]);
+}
+
+async function handleAdminIntegration(
+  request: Request,
+  env: Env,
+  integrationId: string,
+  action?: "rotate-key" | "revoke-key" | "test-report",
+): Promise<Response> {
+  if (!action) {
+    if (request.method === "GET") {
+      await requireOperator(request, env, "manageIntegrations");
+      const integration = await loadIntegrationAdmin(env.DB, integrationId);
+      if (!integration) throw new ApiError(404, "integration_not_found", "The integration does not exist.");
+      return json({ schema_version: "1", integration });
+    }
+    if (request.method === "PATCH") {
+      const session = await requireOperator(request, env, "manageIntegrations");
+      const integration = await updateIntegration(env.DB, integrationId, await readJsonObject(request, 64 * 1024), session, mutationKey(request));
+      return json({ schema_version: "1", integration });
+    }
+    return methodNotAllowed(["GET", "PATCH"]);
+  }
+  if (request.method !== "POST") return methodNotAllowed(["POST"]);
+  const session = await requireOperator(request, env, "manageIntegrations");
+  const body = await readJsonObject(request, 16 * 1024);
+  if (action === "rotate-key") {
+    const overlapSeconds = body.overlap_seconds === undefined ? 300 : body.overlap_seconds;
+    if (!Number.isInteger(overlapSeconds)) throw new ApiError(400, "integration_overlap_invalid", "overlap_seconds must be an integer.");
+    const result = await rotateIntegrationKey(env.DB, integrationId, Number(overlapSeconds), session, mutationKey(request));
+    return json({ schema_version: "1", ...result }, { status: 201, headers: { "cache-control": "no-store" } });
+  }
+  if (action === "revoke-key") {
+    if (body.key_id !== undefined && typeof body.key_id !== "string") throw new ApiError(400, "integration_key_id_invalid", "key_id must be a string.");
+    const revoked = await revokeIntegrationKeys(env.DB, integrationId, typeof body.key_id === "string" ? body.key_id : null, session, mutationKey(request));
+    return json({ schema_version: "1", integration_id: integrationId, revoked });
+  }
+  const [form, queues, integration] = await Promise.all([
+    env.DB.prepare(`SELECT id FROM report_form_versions WHERE published_at IS NOT NULL AND retired_at IS NULL ORDER BY published_at DESC LIMIT 1`).first(),
+    env.DB.prepare(`SELECT COUNT(*) AS count FROM queue_definitions WHERE status = 'active' AND purpose = 'reports'`).first<{ count: number }>(),
+    loadIntegrationAdmin(env.DB, integrationId),
+  ]);
+  if (!integration) throw new ApiError(404, "integration_not_found", "The integration does not exist.");
+  return json({
+    schema_version: "1",
+    test: {
+      mode: "non_mutating",
+      ready: Boolean(form) && Number(queues?.count ?? 0) > 0 && integration.enabled === true,
+      checks: { publishedForm: Boolean(form), activeReportQueues: Number(queues?.count ?? 0), integrationEnabled: integration.enabled },
+    },
+  });
+}
+
+async function route(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
+  const url = new URL(request.url);
+  if (url.pathname === "/api/auth" || url.pathname.startsWith("/api/auth/")) {
+    return handleBetterAuthRequest(request, env, ctx);
+  }
+  if (url.pathname === "/embed" || url.pathname === "/embed/") return handleWidgetEmbed(request, env);
+  if (url.pathname === "/health") return handleHealth(request, env);
+  if (url.pathname === "/ready") return handleReady(request, env);
+  if (url.pathname === "/v1/meta/capabilities") return handleMetaCapabilities(request, env);
+  if (url.pathname === "/v1/meta/version") return handleMetaVersion(request, env);
+  if (url.pathname === "/v1/auth/providers") return handleAuthProviders(request, env);
+  if (url.pathname === "/v1/auth/login") return handleOperatorLogin(request, env, ctx);
+  if (url.pathname === "/v1/auth/invitations/inspect") return inspectInvitation(request, env);
+  if (url.pathname === "/v1/auth/invitations/accept") return handleOperatorInvitationAccept(request, env, ctx);
+  if (url.pathname === "/v1/auth/password-resets") return handleOperatorPasswordResetRequest(request, env, ctx);
+  if (url.pathname === "/v1/auth/password-resets/complete") return handleOperatorPasswordResetComplete(request, env, ctx);
+  if (url.pathname === "/v1/auth/logout") return handleOperatorLogout(request, env, ctx);
+  if (url.pathname === "/v1/account/profile") return handleOperatorProfile(request, env);
+  if (url.pathname === "/v1/account/profile-picture") return handleOperatorProfilePicture(request, env, ctx);
+  if (url.pathname === "/v1/infrastructure/bootstrap") return handleInfrastructureBootstrap(request, env, ctx);
+  if (url.pathname === "/v1/widget/config") return handleWidgetConfig(request, env);
+  if (url.pathname === "/v1/brand") return handlePublicBrand(request, env);
+  if (url.pathname === "/v1/public/config") return handlePublicConfig(request, env);
+  if (url.pathname === "/v1/context-tokens") return handleContextToken(request, env);
+  if (url.pathname === "/v1/reports") return handleWidgetReport(request, env, ctx);
+  if (url.pathname === "/v1/reports/anonymous") return handleAnonymousWidgetReport(request, env, ctx);
+  if (url.pathname === "/v1/reports/server") return handleServerReport(request, env, ctx);
+  if (url.pathname === "/v1/reports/public") return handlePublicReport(request, env, ctx);
+  if (url.pathname === "/v1/evidence-responses") return handleEvidenceResponse(request, env);
+  if (url.pathname === "/v1/action-results") return handleActionResult(request, env);
+  if (url.pathname === "/v1/admin/session") return handleAdminSession(request, env);
+  if (url.pathname === "/v1/admin/installation") return handleAdminInstallation(request, env);
+  if (url.pathname === "/v1/admin/brand") return handleAdminBrand(request, env);
+  if (url.pathname === "/v1/admin/reporting-channels") return handleAdminReportingChannels(request, env);
+  if (url.pathname === "/v1/admin/setup") return handleAdminSetup(request, env);
+  if (url.pathname === "/v1/admin/integrations") return handleAdminIntegrations(request, env);
+  if (url.pathname === "/v1/admin/people") return handleAdminPeople(request, env);
+  if (url.pathname === "/v1/admin/people/invitations") return handleAdminPeople(request, env);
+  if (url.pathname === "/v1/admin/presence") return handleAdminPresence(request, env);
+  if (url.pathname === "/v1/admin/presence/socket") return handleAdminPresenceSocket(request, env);
+  if (url.pathname === "/v1/admin/reports") return handleAdminReports(request, env);
+  if (url.pathname === "/v1/admin/queues") return handleAdminQueues(request, env);
+  if (url.pathname === "/v1/admin/workflows") return handleAdminWorkflows(request, env);
+  if (url.pathname === "/v1/admin/workflow-runs") return handleAdminWorkflowRuns(request, env);
+  if (url.pathname === "/v1/admin/prompts") return handleAdminPrompts(request, env);
+  if (url.pathname === "/v1/admin/model-aliases") return handleAdminModelAliases(request, env);
+  if (url.pathname === "/v1/admin/agents") return handleAdminAgents(request, env);
+  if (url.pathname === "/v1/admin/budgets") return handleAdminBudgets(request, env);
+  if (url.pathname === "/v1/admin/forms") return handleAdminConfigurations(request, env, "form");
+  if (url.pathname === "/v1/admin/forms/published") {
+    if (request.method !== "GET") return methodNotAllowed(["GET"]);
+    await requireOperator(request, env, "manageConfiguration");
+    return json({ schema_version: "1", forms: await listPublishedForms(env.DB) });
+  }
+  if (url.pathname === "/v1/admin/policies") return handleAdminConfigurations(request, env, "policy");
+  if (url.pathname === "/v1/admin/templates") return handleAdminConfigurations(request, env, "template");
+  if (url.pathname === "/v1/admin/routing-rules") return handleAdminConfigurations(request, env, "routing_rules");
+  if (url.pathname === "/v1/admin/routing-rules/draft") return handleAdminConfiguration(request, env, "routing_rules", "default", "draft");
+  if (url.pathname === "/v1/admin/routing-rules/validate") return handleAdminConfiguration(request, env, "routing_rules", "default", "validate");
+  if (url.pathname === "/v1/admin/routing-rules/publish") return handleAdminConfiguration(request, env, "routing_rules", "default", "publish");
+  if (url.pathname === "/v1/admin/assistant/sessions") return handleAdminAssistantSessions(request, env);
+  if (url.pathname === "/v1/admin/tasks") return handleAdminHumanTasks(request, env);
+  if (url.pathname === "/v1/admin/connections") return handleAdminConnections(request, env);
+  if (url.pathname === "/v1/admin/connections/oauth/callback") return handleAdminConnectionOAuthCallback(request, env);
+  if (url.pathname === "/v1/admin/components") return handleAdminComponents(request, env);
+  if (url.pathname === "/v1/admin/routing-agent") return handleAdminRoutingAgent(request, env);
+  if (url.pathname === "/v1/admin/routing-agent/test") return handleAdminRoutingAgentTest(request, env);
+  if (url.pathname === "/v1/admin/appeals") return handleAdminAppeals(request, env);
+  if (url.pathname === "/v1/admin/operations") return handleAdminOperations(request, env);
+  if (url.pathname === "/v1/admin/operations/capacity") return handleAdminOperations(request, env);
+  if (url.pathname === "/v1/admin/operations/incidents") return handleAdminOperationsIncidents(request, env);
+  if (url.pathname === "/v1/admin/operations/dead-letters") return handleAdminDeadLetters(request, env);
+  if (url.pathname === "/v1/admin/ai/runs") return handleAdminAiRuns(request, env);
+  if (url.pathname === "/v1/admin/ai/usage") return handleAdminAiUsage(request, env);
+  if (url.pathname === "/v1/admin/ai/quality-samples") return handleAdminAiQualitySamples(request, env);
+  if (url.pathname === "/v1/admin/shadow-comparisons") return handleAdminShadowComparisons(request, env);
+  if (url.pathname === "/v1/admin/search") return handleAdminSearch(request, env);
+  if (url.pathname === "/v1/admin/saved-views") return handleAdminSavedViews(request, env);
+  if (url.pathname === "/v1/admin/analytics") return handleAdminAnalytics(request, env);
+  if (url.pathname === "/v1/admin/analytics/ai") return handleAdminAnalyticsAi(request, env);
+  if (url.pathname === "/v1/admin/analytics/workflows") return handleAdminAnalyticsWorkflows(request, env);
+  if (url.pathname === "/v1/admin/exports/reports.csv") return handleAdminReportsExport(request, env);
+  if (url.pathname === "/v1/admin/exports") return handleAdminExports(request, env);
+  if (url.pathname === "/v1/admin/backups") return handleAdminBackups(request, env);
+  if (url.pathname === "/v1/admin/audit") return handleAdminAudit(request, env);
+  if (url.pathname === "/v1/admin/audit/verify") return handleAdminAuditVerify(request, env);
+  if (url.pathname === "/v1/admin/legal-holds") return handleAdminLegalHolds(request, env);
+  if (url.pathname === "/v1/admin/deletion-requests") return handleAdminDeletionRequests(request, env);
+  if (url.pathname === "/v1/admin/retention") return handleAdminRetention(request, env, false);
+  if (url.pathname === "/v1/admin/retention/preview") return handleAdminRetention(request, env, true);
+  const evidenceContentRoute = /^\/v1\/admin\/evidence\/([^/]+)\/content$/u.exec(url.pathname);
+  if (evidenceContentRoute) return handleAdminEvidenceContent(request, env, decodeURIComponent(evidenceContentRoute[1] ?? ""));
+  const legalHoldReleaseRoute = /^\/v1\/admin\/legal-holds\/([^/]+)$/u.exec(url.pathname);
+  if (legalHoldReleaseRoute) return handleAdminLegalHoldRelease(request, env, decodeURIComponent(legalHoldReleaseRoute[1] ?? ""));
+  const savedViewRoute = /^\/v1\/admin\/saved-views\/([^/]+)$/u.exec(url.pathname);
+  if (savedViewRoute) return handleAdminSavedView(request, env, decodeURIComponent(savedViewRoute[1] ?? ""));
+  const exportRoute = /^\/v1\/admin\/exports\/([^/]+)$/u.exec(url.pathname);
+  if (exportRoute) return handleAdminExport(request, env, decodeURIComponent(exportRoute[1] ?? ""));
+  const backupRoute = /^\/v1\/admin\/backups\/([^/]+)(?:\/(r2|r2\/object))?$/u.exec(url.pathname);
+  if (backupRoute) return handleAdminBackup(
+    request,
+    env,
+    decodeURIComponent(backupRoute[1] ?? ""),
+    backupRoute[2] as "r2" | "r2/object" | undefined,
+  );
+  const invitationRoute = /^\/v1\/admin\/people\/invitations\/([^/]+)$/u.exec(url.pathname);
+  if (invitationRoute) return handleAdminInvitation(request, env, decodeURIComponent(invitationRoute[1] ?? ""));
+  const operatorPasswordResetRoute = /^\/v1\/admin\/people\/([^/]+)\/password-reset$/u.exec(url.pathname);
+  if (operatorPasswordResetRoute) return handleAdminOperatorPasswordReset(
+    request,
+    env,
+    decodeURIComponent(operatorPasswordResetRoute[1] ?? ""),
+    ctx,
+  );
+  const operatorAdminRoute = /^\/v1\/admin\/people\/([^/]+)(?:\/(revoke-sessions))?$/u.exec(url.pathname);
+  if (operatorAdminRoute) return handleAdminOperator(
+    request,
+    env,
+    decodeURIComponent(operatorAdminRoute[1] ?? ""),
+    operatorAdminRoute[2] as "revoke-sessions" | undefined,
+  );
+  const profilePictureRoute = /^\/v1\/profile-pictures\/([^/]+)$/u.exec(url.pathname);
+  if (profilePictureRoute) return handleOperatorProfilePictureRead(
+    request,
+    env,
+    decodeURIComponent(profilePictureRoute[1] ?? ""),
+  );
+  const setupVerifyRoute = /^\/v1\/admin\/setup\/([^/]+)\/verify$/u.exec(url.pathname);
+  if (setupVerifyRoute) return handleAdminSetupVerify(request, env, decodeURIComponent(setupVerifyRoute[1] ?? ""));
+  const integrationAdminRoute = /^\/v1\/admin\/integrations\/([^/]+)(?:\/(rotate-key|revoke-key|test-report))?$/u.exec(url.pathname);
+  if (integrationAdminRoute) return handleAdminIntegration(
+    request,
+    env,
+    decodeURIComponent(integrationAdminRoute[1] ?? ""),
+    integrationAdminRoute[2] as "rotate-key" | "revoke-key" | "test-report" | undefined,
+  );
+  const queueWorkflowPinRoute = /^\/v1\/admin\/queues\/([^/]+)\/workflow-pin$/u.exec(url.pathname);
+  if (queueWorkflowPinRoute) return handleAdminQueueWorkflowPin(
+    request,
+    env,
+    decodeURIComponent(queueWorkflowPinRoute[1] ?? ""),
+  );
+  const queueRoute = /^\/v1\/admin\/queues\/([^/]+)(?:\/(versions|policy-versions|pause|resume|health))?$/u.exec(url.pathname);
+  if (queueRoute) return handleAdminQueue(
+    request,
+    env,
+    decodeURIComponent(queueRoute[1] ?? ""),
+    queueRoute[2] as "versions" | "policy-versions" | "pause" | "resume" | "health" | undefined,
+  );
+  const connectionRoute = /^\/v1\/admin\/connections\/([^/]+)(?:\/(versions|validate|test|pause|resume|dependencies))?$/u.exec(url.pathname);
+  if (connectionRoute) return handleAdminConnection(
+    request,
+    env,
+    decodeURIComponent(connectionRoute[1] ?? ""),
+    connectionRoute[2] as "versions" | "validate" | "test" | "pause" | "resume" | "dependencies" | undefined,
+  );
+  const connectionOAuthRoute = /^\/v1\/admin\/connections\/([^/]+)\/oauth\/(start|revoke)$/u.exec(url.pathname);
+  if (connectionOAuthRoute) return handleAdminConnectionOAuth(
+    request,
+    env,
+    decodeURIComponent(connectionOAuthRoute[1] ?? ""),
+    connectionOAuthRoute[2] as "start" | "revoke",
+  );
+  const componentRoute = /^\/v1\/admin\/components\/([^/]+)(?:\/(versions|validate|test|pause|resume|dependencies))?$/u.exec(url.pathname);
+  if (componentRoute) return handleAdminComponent(
+    request,
+    env,
+    decodeURIComponent(componentRoute[1] ?? ""),
+    componentRoute[2] as "versions" | "validate" | "test" | "pause" | "resume" | "dependencies" | undefined,
+  );
+  const modelAliasVersionRoute = /^\/v1\/admin\/model-aliases\/([^/]+)\/versions$/u.exec(url.pathname);
+  if (modelAliasVersionRoute) return handleAdminModelAliasVersion(request, env, decodeURIComponent(modelAliasVersionRoute[1] ?? ""));
+  const agentVersionRoute = /^\/v1\/admin\/agents\/([^/]+)\/versions$/u.exec(url.pathname);
+  if (agentVersionRoute) return handleAdminAgentVersion(request, env, decodeURIComponent(agentVersionRoute[1] ?? ""));
+  const agentActionRoute = /^\/v1\/admin\/agents\/([^/]+)\/(test|publish)$/u.exec(url.pathname);
+  if (agentActionRoute) {
+    const agentId = decodeURIComponent(agentActionRoute[1] ?? "");
+    return agentActionRoute[2] === "test"
+      ? handleAdminAgentTest(request, env, agentId)
+      : handleAdminAgentVersion(request, env, agentId);
+  }
+  const configurationRoute = /^\/v1\/admin\/(forms|policies|templates)\/([^/]+)\/(draft|validate|publish|versions|render)$/u.exec(url.pathname);
+  if (configurationRoute) {
+    const type = configurationRoute[1] === "forms" ? "form" : configurationRoute[1] === "policies" ? "policy" : "template";
+    return handleAdminConfiguration(
+      request,
+      env,
+      type,
+      decodeURIComponent(configurationRoute[2] ?? ""),
+      configurationRoute[3] as "draft" | "validate" | "publish" | "versions" | "render",
+    );
+  }
+  const workflowFixtureRoute = /^\/v1\/admin\/workflows\/([^/]+)\/fixtures\/([^/]+)$/u.exec(url.pathname);
+  if (workflowFixtureRoute) return handleAdminWorkflowFixture(
+    request,
+    env,
+    decodeURIComponent(workflowFixtureRoute[1] ?? ""),
+    decodeURIComponent(workflowFixtureRoute[2] ?? ""),
+  );
+  const workflowTestRunRoute = /^\/v1\/admin\/workflows\/([^/]+)\/test-runs\/([^/]+)$/u.exec(url.pathname);
+  if (workflowTestRunRoute) return handleAdminWorkflowTestRun(
+    request,
+    env,
+    decodeURIComponent(workflowTestRunRoute[1] ?? ""),
+    decodeURIComponent(workflowTestRunRoute[2] ?? ""),
+  );
+  const workflowVersionRoute = /^\/v1\/admin\/workflows\/([^/]+)\/versions\/([^/]+)(?:\/(diff|retire))?$/u.exec(url.pathname);
+  if (workflowVersionRoute) return handleAdminWorkflowVersion(
+    request,
+    env,
+    decodeURIComponent(workflowVersionRoute[1] ?? ""),
+    decodeURIComponent(workflowVersionRoute[2] ?? ""),
+    workflowVersionRoute[3] as "diff" | "retire" | undefined,
+  );
+  const workflowRoute = /^\/v1\/admin\/workflows\/([^/]+)(?:\/(draft|validate|publish|versions|fixtures|test|test-runs|shadow-runs))?$/u.exec(url.pathname);
+  if (workflowRoute) return handleAdminWorkflow(
+    request,
+    env,
+    ctx,
+    decodeURIComponent(workflowRoute[1] ?? ""),
+    workflowRoute[2] as "draft" | "validate" | "publish" | "versions" | "fixtures" | "test" | "test-runs" | "shadow-runs" | undefined,
+  );
+  const workflowRunRoute = /^\/v1\/admin\/workflow-runs\/([^/]+)(?:\/(pause|resume|terminate|events|reconcile))?$/u.exec(url.pathname);
+  if (workflowRunRoute) return handleAdminWorkflowRun(
+    request,
+    env,
+    decodeURIComponent(workflowRunRoute[1] ?? ""),
+    workflowRunRoute[2] as "pause" | "resume" | "terminate" | "events" | "reconcile" | undefined,
+  );
+  const actionProposalRoute = /^\/v1\/admin\/actions\/([^/]+)(?:\/(approve|reject|retry|compensate))?$/u.exec(url.pathname);
+  if (actionProposalRoute) return handleAdminActionProposal(
+    request,
+    env,
+    decodeURIComponent(actionProposalRoute[1] ?? ""),
+    actionProposalRoute[2] as "approve" | "reject" | "retry" | "compensate" | undefined,
+  );
+  const decisionRoute = /^\/v1\/admin\/decisions\/([^/]+)$/u.exec(url.pathname);
+  if (decisionRoute) return handleAdminDecision(request, env, decodeURIComponent(decisionRoute[1] ?? ""));
+  const operationsIncidentRoute = /^\/v1\/admin\/operations\/incidents\/([^/]+)(?:\/(acknowledge|resolve|retry))?$/u.exec(url.pathname);
+  if (operationsIncidentRoute) return handleAdminOperationsIncident(
+    request,
+    env,
+    decodeURIComponent(operationsIncidentRoute[1] ?? ""),
+    operationsIncidentRoute[2] as "acknowledge" | "resolve" | "retry" | undefined,
+  );
+  const reconciliationRoute = /^\/v1\/admin\/operations\/reconciliation\/([^/]+)$/u.exec(url.pathname);
+  if (reconciliationRoute) return handleAdminReconciliation(request, env, decodeURIComponent(reconciliationRoute[1] ?? ""));
+  const assistantSessionRoute = /^\/v1\/admin\/assistant\/sessions\/([^/]+)(?:\/(messages))?$/u.exec(url.pathname);
+  if (assistantSessionRoute) return handleAdminAssistantSession(
+    request,
+    env,
+    decodeURIComponent(assistantSessionRoute[1] ?? ""),
+    assistantSessionRoute[2] === "messages",
+  );
+  const assistantSocketRoute = /^\/v1\/admin\/assistant\/sessions\/([^/]+)\/socket$/u.exec(url.pathname);
+  if (assistantSocketRoute) return handleAdminAssistantSocket(
+    request,
+    env,
+    decodeURIComponent(assistantSocketRoute[1] ?? ""),
+  );
+  const assistantToolRoute = /^\/v1\/admin\/assistant\/tool-calls\/([^/]+)$/u.exec(url.pathname);
+  if (assistantToolRoute) return handleAdminAssistantToolCall(request, env, decodeURIComponent(assistantToolRoute[1] ?? ""));
+  const assistantDraftRoute = /^\/v1\/admin\/assistant\/drafts\/([^/]+)\/adopt$/u.exec(url.pathname);
+  if (assistantDraftRoute) return handleAdminAssistantDraftAdopt(request, env, decodeURIComponent(assistantDraftRoute[1] ?? ""));
+  const qualitySampleRoute = /^\/v1\/admin\/ai\/quality-samples\/([^/]+)(?:\/(claim|review))?$/u.exec(url.pathname);
+  if (qualitySampleRoute) {
+    const sampleId = decodeURIComponent(qualitySampleRoute[1] ?? "");
+    if (qualitySampleRoute[2] === "claim") return handleAdminAiQualityClaim(request, env, sampleId);
+    if (qualitySampleRoute[2] === "review") return handleAdminAiQualityReview(request, env, sampleId);
+    return handleAdminAiQualitySample(request, env, sampleId);
+  }
+  const aiRunRoute = /^\/v1\/admin\/ai\/runs\/([^/]+)$/u.exec(url.pathname);
+  if (aiRunRoute) return handleAdminAiRun(request, env, decodeURIComponent(aiRunRoute[1] ?? ""));
+  const shadowComparisonRoute = /^\/v1\/admin\/shadow-comparisons\/([^/]+)\/(dismiss|create-task)$/u.exec(url.pathname);
+  if (shadowComparisonRoute) return handleAdminShadowComparison(
+    request,
+    env,
+    decodeURIComponent(shadowComparisonRoute[1] ?? ""),
+    shadowComparisonRoute[2] as "dismiss" | "create-task",
+  );
+  const taskRoute = /^\/v1\/admin\/tasks\/([^/]+)(?:\/(claim|respond|response|reassign|cancel))?$/u.exec(url.pathname);
+  if (taskRoute) return handleAdminHumanTask(
+    request,
+    env,
+    decodeURIComponent(taskRoute[1]!),
+    taskRoute[2] as "claim" | "respond" | "response" | "reassign" | "cancel" | undefined,
+  );
+  const reportEvidenceRoute = /^\/v1\/admin\/reports\/([^/]+)\/evidence(?:\/(fetch|snapshots))?$/u.exec(url.pathname);
+  if (reportEvidenceRoute) return handleAdminReportEvidence(
+    request, env, ctx, decodeURIComponent(reportEvidenceRoute[1] ?? ""),
+    reportEvidenceRoute[2] as "fetch" | "snapshots" | undefined,
+  );
+  const reportEnrichmentRoute = /^\/v1\/admin\/reports\/([^/]+)\/enrichments\/([^/]+)\/runs$/u.exec(url.pathname);
+  if (reportEnrichmentRoute) return handleAdminReportEnrichment(
+    request,
+    env,
+    decodeURIComponent(reportEnrichmentRoute[1] ?? ""),
+    decodeURIComponent(reportEnrichmentRoute[2] ?? ""),
+  );
+  const reportRoute = /^\/v1\/admin\/reports\/([^/]+)(?:\/(claim|messages|decisions|workflow-runs|reassign|timeline|findings|actions|close|reopen))?$/u.exec(url.pathname);
+  if (reportRoute) {
+    const reportId = decodeURIComponent(reportRoute[1] ?? "");
+    if (reportRoute[2] === "claim") return handleAdminReportClaim(request, env, ctx, reportId);
+    if (reportRoute[2] === "messages") return handleAdminReportMessage(request, env, ctx, reportId);
+    if (reportRoute[2] === "decisions") return handleAdminReportDecision(request, env, ctx, reportId);
+    if (reportRoute[2] === "workflow-runs") return handleAdminReportWorkflowRuns(request, env, ctx, reportId);
+    if (reportRoute[2] === "reassign") return handleAdminReportReassign(request, env, ctx, reportId);
+    if (reportRoute[2] === "timeline" || reportRoute[2] === "findings" || reportRoute[2] === "actions") {
+      return handleAdminReportCollection(request, env, reportId, reportRoute[2]);
+    }
+    if (reportRoute[2] === "close" || reportRoute[2] === "reopen") {
+      return handleAdminReportCloseOrReopen(request, env, ctx, reportId, reportRoute[2]);
+    }
+    return handleAdminReportDetail(request, env, reportId);
+  }
+  const appealClaimRoute = /^\/v1\/admin\/appeals\/([^/]+)\/claim$/u.exec(url.pathname);
+  if (appealClaimRoute) return handleAdminAppealClaim(request, env, decodeURIComponent(appealClaimRoute[1] ?? ""));
+  const appealDecisionRoute = /^\/v1\/admin\/appeals\/([^/]+)\/decision$/u.exec(url.pathname);
+  if (appealDecisionRoute) return handleAdminAppealDecision(request, env, ctx, decodeURIComponent(appealDecisionRoute[1] ?? ""));
+  const appealDetailRoute = /^\/v1\/admin\/appeals\/([^/]+)$/u.exec(url.pathname);
+  if (appealDetailRoute) return handleAdminAppealDetail(request, env, decodeURIComponent(appealDetailRoute[1] ?? ""));
+  if (url.pathname.startsWith("/v1/")) throw new ApiError(404, "route_not_found", "The API route does not exist.");
+  if (request.method !== "GET" && request.method !== "HEAD") return methodNotAllowed(["GET", "HEAD"]);
+  return env.ASSETS.fetch(request);
+}
+
+function isReportJob(value: unknown): value is ReportJob {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const job = value as Partial<ReportJob>;
+  return job.version === 1 && job.type === "route_report" && typeof job.jobId === "string"
+    && job.jobId.length <= 200 && typeof job.reportId === "string" && job.reportId.length <= 100;
+}
+
+function isDeliveryJob(value: unknown): value is DeliveryJob {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const job = value as Partial<DeliveryJob>;
+  return job.version === 1 && (job.type === "deliver_action" || job.type === "deliver_notification" || job.type === "deliver_email")
+    && typeof job.jobId === "string" && typeof job.outboxId === "string";
+}
+
+function isAiJob(value: unknown): value is AiJob {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const job = value as Partial<AiJob>;
+  return job.version === 1 && job.type === "process_ai_report" && typeof job.jobId === "string"
+    && job.jobId.length <= 300 && typeof job.reportId === "string" && job.reportId.length <= 100;
+}
+
+function isWorkflowDispatchJob(value: unknown): value is WorkflowDispatchJob {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const job = value as Partial<WorkflowDispatchJob>;
+  return job.version === 1 && job.type === "dispatch_workflow"
+    && typeof job.jobId === "string" && job.jobId.length <= 300
+    && typeof job.runId === "string" && job.runId.length <= 100
+    && typeof job.outboxId === "string" && job.outboxId.length <= 100;
+}
+
+function isEvidenceFetchJob(value: unknown): value is EvidenceFetchJob {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const job = value as Partial<EvidenceFetchJob>;
+  return job.version === 1 && job.type === "fetch_evidence"
+    && typeof job.jobId === "string" && job.jobId.length <= 300
+    && typeof job.reportId === "string" && job.reportId.length <= 100
+    && typeof job.requestId === "string" && job.requestId.length <= 100;
+}
+
+function isActionProposalJob(value: unknown): value is ActionProposalJob {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const job = value as Partial<ActionProposalJob>;
+  return job.version === 1 && job.type === "apply_action_proposal"
+    && typeof job.jobId === "string" && job.jobId.length <= 600
+    && typeof job.proposalId === "string" && job.proposalId.length <= 500
+    && typeof job.runId === "string" && job.runId.length <= 100;
+}
+
+async function handleQueue(batch: MessageBatch<unknown>, env: Env, ctx: ExecutionContext): Promise<void> {
+  for (const message of batch.messages) {
+    try {
+      if (batch.queue === env.OPERATIONS_DLQ_NAME) {
+        const job = isReportJob(message.body) || isAiJob(message.body) || isEvidenceFetchJob(message.body)
+          || isWorkflowDispatchJob(message.body) || isDeliveryJob(message.body) || isActionProposalJob(message.body) ? message.body : null;
+        await recordDeadLetter(env.DB, batch.queue, message.id, job);
+        message.ack();
+        continue;
+      }
+      if (isWorkflowDispatchJob(message.body)) {
+        await processWorkflowDispatchJob(env, ctx, message.body);
+        message.ack();
+        continue;
+      }
+      if (isEvidenceFetchJob(message.body)) {
+        await processEvidenceFetch(env, message.body);
+        message.ack();
+        continue;
+      }
+      if (isReportJob(message.body)) {
+        try {
+          const jobs = await processRoutingJob(
+            env.DB,
+            message.body.jobId,
+            configuredAiBinding(env),
+            (input) => executeRoutingReadOnlyComponent(env, input),
+          );
+          if (jobs.length) {
+            try {
+              await env.REPORT_JOBS.sendBatch(jobs.map((job) => ({ body: job, contentType: "json" as const })));
+              await Promise.all(jobs.filter(isAiJob).map((job) => markAiJobEnqueued(env.DB, job.jobId, true)));
+            } catch (error) {
+              console.error("post-routing job enqueue failed; scheduled reconciliation will retry", {
+                jobCount: jobs.length,
+                errorType: error instanceof Error ? error.name : typeof error,
+              });
+              await Promise.all(jobs.filter(isAiJob).map((job) => markAiJobEnqueued(env.DB, job.jobId, false)));
+            }
+          }
+          message.ack();
+        } catch (error) {
+          await markJobEnqueueFailed(env.DB, message.body.jobId, "routing_processing_failed");
+          throw error;
+        }
+        continue;
+      }
+      if (isAiJob(message.body)) {
+        let jobs: DeliveryJob[];
+        try {
+          jobs = await processAiJob(env.DB, configuredAiBinding(env), message.body, deliveryOptions(env));
+        } catch (error) {
+          if (error instanceof RetryableAiError) throw error;
+          await markAiJobUnexpectedFailure(env.DB, message.body.jobId);
+          throw new RetryableAiError(30);
+        }
+        if (jobs.length) {
+          try {
+            await env.DELIVERY_JOBS.sendBatch(jobs.map((job) => ({ body: job, contentType: "json" as const })));
+          } catch (error) {
+            console.error("AI notice enqueue failed; delivery reconciliation will retry", {
+              jobCount: jobs.length,
+              errorType: error instanceof Error ? error.name : typeof error,
+            });
+          }
+        }
+        message.ack();
+        continue;
+      }
+      if (isDeliveryJob(message.body)) {
+        await processDeliveryJob(env.DB, message.body, env);
+        message.ack();
+        continue;
+      }
+      if (isActionProposalJob(message.body)) {
+        await processActionProposalJob(env, message.body);
+        message.ack();
+        continue;
+      }
+      console.error("invalid queue message rejected", { queue: batch.queue, messageId: message.id });
+      message.ack();
+    } catch (error) {
+      console.error("queue message processing failed", {
+        queue: batch.queue,
+        messageId: message.id,
+        errorType: error instanceof Error ? error.name : typeof error,
+      });
+      if (error instanceof RetryableDeliveryError || error instanceof RetryableAiError
+        || error instanceof RetryableWorkflowDispatchError
+        || error instanceof RetryableEvidenceError || error instanceof RetryableActionProposalError) {
+        message.retry({ delaySeconds: error.delaySeconds });
+      }
+      else message.retry();
+    }
+  }
+}
+
+interface ReconciliationResult {
+  scanned: number;
+  repaired: number;
+  errorCode?: string;
+}
+
+async function reconcileRouting(env: Env): Promise<ReconciliationResult> {
+  const jobs = await pendingRoutingJobs(env.DB, 50);
+  if (!jobs.length) return { scanned: 0, repaired: 0 };
+  try {
+    await env.REPORT_JOBS.sendBatch(jobs.map((job) => ({
+      body: { version: 1, jobId: job.id, type: "route_report", reportId: job.reportId } satisfies ReportJob,
+      contentType: "json" as const,
+    })));
+    await Promise.all(jobs.map((job) => markJobEnqueued(env.DB, job.id)));
+    return { scanned: jobs.length, repaired: jobs.length };
+  } catch (error) {
+    console.error("routing reconciliation enqueue failed", { jobCount: jobs.length, errorType: error instanceof Error ? error.name : typeof error });
+    await Promise.all(jobs.map((job) => markJobEnqueueFailed(env.DB, job.id, "reconciliation_queue_send_failed")));
+    return { scanned: jobs.length, repaired: 0, errorCode: "routing_reconciliation_enqueue_failed" };
+  }
+}
+
+async function reconcileDeliveries(env: Env): Promise<ReconciliationResult> {
+  const [jobs, actionJobs] = await Promise.all([
+    pendingDeliveryJobs(env.DB, 50),
+    pendingActionProposalJobs(env.DB, 50),
+  ]);
+  const eventRepairs = await reconcileActionProposalEvents(env, 50);
+  if (!jobs.length && !actionJobs.length) return { scanned: eventRepairs, repaired: eventRepairs };
+  try {
+    await env.DELIVERY_JOBS.sendBatch([...jobs, ...actionJobs].map((job) => ({ body: job, contentType: "json" as const })));
+    return { scanned: jobs.length + actionJobs.length + eventRepairs, repaired: jobs.length + actionJobs.length + eventRepairs };
+  } catch (error) {
+    console.error("delivery reconciliation enqueue failed", {
+      jobCount: jobs.length + actionJobs.length,
+      errorType: error instanceof Error ? error.name : typeof error,
+    });
+    return { scanned: jobs.length + actionJobs.length + eventRepairs, repaired: eventRepairs, errorCode: "delivery_reconciliation_enqueue_failed" };
+  }
+}
+
+async function reconcileEvidenceFetches(env: Env): Promise<ReconciliationResult> {
+  const jobs = await pendingEvidenceFetchJobs(env.DB, 50);
+  if (!jobs.length) return { scanned: 0, repaired: 0 };
+  try {
+    await env.REPORT_JOBS.sendBatch(jobs.map((job) => ({ body: job, contentType: "json" as const })));
+    return { scanned: jobs.length, repaired: jobs.length };
+  } catch (error) {
+    console.error("evidence fetch reconciliation enqueue failed", { jobCount: jobs.length, errorType: error instanceof Error ? error.name : typeof error });
+    return { scanned: jobs.length, repaired: 0, errorCode: "evidence_reconciliation_enqueue_failed" };
+  }
+}
+
+async function reconcileAi(env: Env): Promise<ReconciliationResult> {
+  const jobs = await pendingAiJobs(env.DB, 50);
+  if (!jobs.length) return { scanned: 0, repaired: 0 };
+  try {
+    await env.REPORT_JOBS.sendBatch(jobs.map((job) => ({ body: job, contentType: "json" as const })));
+    await Promise.all(jobs.map((job) => markAiJobEnqueued(env.DB, job.jobId, true)));
+    return { scanned: jobs.length, repaired: jobs.length };
+  } catch (error) {
+    console.error("AI reconciliation enqueue failed", { jobCount: jobs.length, errorType: error instanceof Error ? error.name : typeof error });
+    await Promise.all(jobs.map((job) => markAiJobEnqueued(env.DB, job.jobId, false)));
+    return { scanned: jobs.length, repaired: 0, errorCode: "ai_reconciliation_enqueue_failed" };
+  }
+}
+
+async function reconcileWorkflowDispatches(env: Env): Promise<ReconciliationResult> {
+  const jobs = await pendingWorkflowDispatchJobs(env.DB, 50);
+  if (!jobs.length) return { scanned: 0, repaired: 0 };
+  try {
+    await env.CONTROL_JOBS.sendBatch(jobs.map((job) => ({ body: job, contentType: "json" as const })));
+    return { scanned: jobs.length, repaired: jobs.length };
+  } catch (error) {
+    console.error("workflow dispatch reconciliation enqueue failed", {
+      jobCount: jobs.length,
+      errorType: error instanceof Error ? error.name : typeof error,
+    });
+    return { scanned: jobs.length, repaired: 0, errorCode: "workflow_reconciliation_enqueue_failed" };
+  }
+}
+
+const RECONCILIATION_KINDS = ["routing", "evidence", "ai", "workflows", "deliveries", "budgets", "all"] as const;
+type ReconciliationKind = typeof RECONCILIATION_KINDS[number];
+
+async function performReconciliation(
+  env: Env,
+  kind: ReconciliationKind,
+  reconciliationRunId: string,
+  actorId: string,
+): Promise<ReconciliationResult> {
+  if (kind === "routing") return reconcileRouting(env);
+  if (kind === "evidence") {
+    const stale = await repairStaleOperationalLeases(env.DB, reconciliationRunId, actorId);
+    const queued = await reconcileEvidenceFetches(env);
+    return { scanned: stale.scanned + queued.scanned, repaired: stale.repaired + queued.repaired, ...(queued.errorCode ? { errorCode: queued.errorCode } : {}) };
+  }
+  if (kind === "ai") return reconcileAi(env);
+  if (kind === "workflows") {
+    const stale = await repairStaleOperationalLeases(env.DB, reconciliationRunId, actorId);
+    const queued = await reconcileWorkflowDispatches(env);
+    return { scanned: stale.scanned + queued.scanned, repaired: stale.repaired + queued.repaired, ...(queued.errorCode ? { errorCode: queued.errorCode } : {}) };
+  }
+  if (kind === "deliveries") return reconcileDeliveries(env);
+  if (kind === "budgets") {
+    const repaired = await releaseExpiredBudgetReservations(env.DB);
+    return { scanned: repaired, repaired };
+  }
+  const stale = await repairStaleOperationalLeases(env.DB, reconciliationRunId, actorId);
+  const results = await Promise.all([
+    reconcileRouting(env), reconcileEvidenceFetches(env), reconcileAi(env),
+    reconcileWorkflowDispatches(env), reconcileDeliveries(env),
+  ]);
+  const expiredBudgets = await releaseExpiredBudgetReservations(env.DB);
+  return {
+    scanned: results.reduce((sum, result) => sum + result.scanned, expiredBudgets + stale.scanned),
+    repaired: results.reduce((sum, result) => sum + result.repaired, expiredBudgets + stale.repaired),
+    ...(results.some((result) => result.errorCode) ? { errorCode: "one_or_more_reconciliation_kinds_failed" } : {}),
+  };
+}
+
+async function runRecordedReconciliation(env: Env, kind: ReconciliationKind, actorId: string): Promise<{ runId: string } & ReconciliationResult> {
+  const runId = await beginReconciliationRun(env.DB, kind, actorId);
+  try {
+    const result = await performReconciliation(env, kind, runId, actorId);
+    await finishReconciliationRun(env.DB, runId, result);
+    return { runId, ...result };
+  } catch (error) {
+    await finishReconciliationRun(env.DB, runId, { scanned: 0, repaired: 0, errorCode: "reconciliation_failed" });
+    throw error;
+  }
+}
+
+async function handleAdminReconciliation(request: Request, env: Env, rawKind: string): Promise<Response> {
+  if (request.method !== "POST") return methodNotAllowed(["POST"]);
+  const session = await requireOperator(request, env, "operateSystem");
+  if (!RECONCILIATION_KINDS.includes(rawKind as ReconciliationKind)) {
+    throw new ApiError(400, "reconciliation_kind_invalid", "The reconciliation kind is invalid.");
+  }
+  const result = await runRecordedReconciliation(env, rawKind as ReconciliationKind, session.actor.id);
+  return json({ schema_version: "1", reconciliation: result }, { status: 202 });
+}
+
+export default {
+  async fetch(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
+    const requestedOrigin = request.headers.get("origin");
+    let origin = allowedOrigin(requestedOrigin, env.ALLOWED_ORIGINS);
+    const pathname = new URL(request.url).pathname;
+    if (!origin && requestedOrigin && ["/v1/widget/config", "/v1/reports"].includes(pathname)
+      && await installationAllowsWidgetOrigin(env.DB, requestedOrigin)) origin = requestedOrigin;
+    const requestId = request.headers.get("cf-ray")?.slice(0, 200) || crypto.randomUUID();
+    const finish = (response: Response): Response => {
+      const withOrigin = withCors(response, origin);
+      const headers = new Headers(withOrigin.headers);
+      headers.set("request-id", requestId);
+      return new Response(withOrigin.body, {
+        status: withOrigin.status,
+        statusText: withOrigin.statusText,
+        headers,
+        webSocket: withOrigin.webSocket,
+      });
+    };
+    if (request.method === "OPTIONS") {
+      if (!origin) return finish(json({ error: { code: "origin_not_allowed", message: "The request origin is not allowed." } }, { status: 403 }));
+      return finish(new Response(null, { status: 204 }));
+    }
+    try {
+      return finish(await route(request, env, ctx));
+    } catch (error) {
+      return finish(apiErrorResponse(error));
+    }
+  },
+
+  async queue(batch: MessageBatch<unknown>, env: Env, ctx: ExecutionContext): Promise<void> {
+    await handleQueue(batch, env, ctx);
+  },
+
+  async scheduled(_controller: ScheduledController, env: Env, ctx: ExecutionContext): Promise<void> {
+    ctx.waitUntil((async () => {
+      await Promise.all([
+        runRecordedReconciliation(env, "all", "system:maintenance"), escalateExpiredAiWaits(env.DB),
+        maintainIntakeProtection(env.DB),
+        pruneReportContexts(env.DB),
+        compareCompletedShadowRuns(env.DB),
+        expireExports(env),
+        pruneConnectionOAuthStates(env.DB),
+      ]);
+      await pruneStaleAnalystSessions(env.DB);
+      await chainPendingAuditEvents(env.DB);
+      await refreshDailyAggregatesIfStale(env.DB);
+      await processDeletionRequests(env.DB);
+      await runRetentionIfDue(
+        env.DB,
+        integer(env.MESSAGE_RETENTION_DAYS, 180, 1, 3_650),
+        integer(env.REPORT_RETENTION_DAYS, 365, 30, 3_650),
+      );
+    })());
+  },
+};