@crvouga/mockingbird-service-cloudcontrol 1.11.0 → 1.12.1

package/dist/server.d.ts

@@ -1,997 +1,5 @@
 import { Server } from 'node:http';
-
-type MountedAPI$1 = FetchAPI$1 & {
-    readonly prefix: string;
-    GET: FetchHandler$1;
-    POST: FetchHandler$1;
-    PUT: FetchHandler$1;
-    PATCH: FetchHandler$1;
-    DELETE: FetchHandler$1;
-    HEAD: FetchHandler$1;
-    OPTIONS: FetchHandler$1;
-};
-
-/** A stable identifier for a point in a {@link Timeline}. */
-type CheckpointId$1 = string;
-/** An immutable node in a timeline's checkpoint DAG. */
-type Checkpoint$1<T> = Readonly<{
-    id: CheckpointId$1;
-    branch: string;
-    parent: CheckpointId$1 | null;
-    /** Logical time supplied by the timeline's injected clock. */
-    at: number;
-    value: T;
-}>;
-type TimelineOptions$1 = {
-    /** Logical clock used to stamp checkpoints. Defaults to a deterministic counter. */
-    now?: () => number;
-    /** Maximum retained checkpoints. Branch heads are never collected. Default 1,000. */
-    maxCheckpoints?: number;
-    /** Customize deterministic checkpoint IDs. */
-    id?: (sequence: number) => CheckpointId$1;
-};
-type CommitOptions$1 = {
-    branch?: string;
-    /** Parent checkpoint. Defaults to the selected branch's current head. */
-    parent?: CheckpointId$1 | null;
-};
-type ForkOptions$1 = {
-    /** Checkpoint to fork from. Defaults to the main branch's head. */
-    from?: CheckpointId$1;
-};
-/**
- * Small, storage-agnostic checkpoint DAG shared by service runtimes. Its values may be immutable
- * records, namespace images, or copy-on-write SQL engine snapshots.
- *
- * Values are retained by reference. Engines can therefore use persistent/COW snapshots while
- * simpler services can use immutable values. IDs and GC order are deterministic, and all IO
- * (the logical clock) is injected.
- */
-declare class Timeline$1<T> {
-    readonly maxCheckpoints: number;
-    private readonly now;
-    private readonly makeId;
-    private readonly nodes;
-    private readonly heads;
-    /** Unreferenced nodes in the exact order they became collectible. */
-    private readonly evictable;
-    /** Branch heads plus explicit retainers. Absent means zero. */
-    private readonly references;
-    private readonly explicitPins;
-    private sequence;
-    constructor(options?: TimelineOptions$1);
-    /** Capture a new immutable value and move `branch` to it. */
-    commit(value: T, options?: CommitOptions$1): Checkpoint$1<T>;
-    /** Create a branch pointer without copying its checkpoint value. */
-    fork(branch: string, options?: ForkOptions$1): Checkpoint$1<T> | undefined;
-    /** Move a branch pointer to an existing checkpoint. */
-    checkout(branch: string, id: CheckpointId$1): Checkpoint$1<T>;
-    get(id: CheckpointId$1): Checkpoint$1<T>;
-    head(branch?: string): Checkpoint$1<T> | undefined;
-    hasBranch(branch: string): boolean;
-    branches(): Readonly<Record<string, CheckpointId$1>>;
-    checkpoints(): readonly Checkpoint$1<T>[];
-    /** Number of retained checkpoints without allocating an array. */
-    get size(): number;
-    /** Pin a checkpoint independently of branch heads (used by compatibility snapshot handles). */
-    retain(id: CheckpointId$1): Checkpoint$1<T>;
-    /** Release one explicit pin. Branch heads remain pinned until moved or deleted. */
-    release(id: CheckpointId$1): boolean;
-    deleteBranch(branch: string): boolean;
-    /**
-     * Deterministically discard oldest unpinned checkpoints. Collection is O(number removed):
-     * commits never scan pinned nodes or the retained history. Parents are metadata rather than a
-     * storage dependency, so a retained node remains usable after pruning.
-     */
-    gc(max?: number): CheckpointId$1[];
-    private collect;
-    private moveHead;
-    private addReference;
-    private removeReference;
-    private assertBranch;
-}
-
-/**
- * Anything that can answer a Fetch `Request` with a `Response`.
- *
- * Every Mockingbird service implements this, and every runtime adapter consumes it.
- * It is the only contract shared across the whole graph.
- */
-interface FetchAPI$1 {
-    fetch(request: Request): Promise<Response>;
-}
-/** A bare function form of {@link FetchAPI}, compatible with `Bun.serve`, workerd, and Deno. */
-type FetchHandler$1 = (request: Request) => Promise<Response>;
-
-/** Bind values accepted by Mockingbird's SQLite port (matches sqlite-mem / better-sqlite3). */
-type SqliteValue$2 = null | number | bigint | string | Uint8Array | boolean;
-/** Mutation counters returned by {@link SqliteStatement.run}. */
-type SqliteRunResult$2 = {
-    changes: number;
-    lastInsertRowid: number | bigint;
-};
-/**
- * Prepared statement bound to a {@link SqliteClient}.
- *
- * Pass bind values as rest arguments on each call (no sticky `bind()`).
- */
-interface SqliteStatement$2 {
-    run(...params: SqliteValue$2[]): SqliteRunResult$2;
-    all<T = Record<string, unknown>>(...params: SqliteValue$2[]): T[];
-    get<T = Record<string, unknown>>(...params: SqliteValue$2[]): T | undefined;
-}
-/**
- * Sync SQLite client port owned by Mockingbird.
- *
- * Duck-typed so `@crvouga/mockingbird-service-sqlite` `Database`, better-sqlite3, and wrapped
- * `bun:sqlite` instances all work when they expose this surface.
- */
-interface SqliteClient$2 {
-    exec(sql: string): void;
-    prepare(sql: string): SqliteStatement$2;
-    transaction<T>(fn: () => T): T;
-}
-
-/**
- * What names an id base: a non-negative safe integer (or its decimal string) or `"boot"`,
- * which derives the base from the wall clock when the runtime is created.
- */
-type IdBase$1 = number | string;
-
-/**
- * The single source of time for a service.
- *
- * Every timestamp a mock writes reads from here, so a suite moves time instead of
- * sleeping: appointment windows, result delays and expiries become reachable in
- * milliseconds. A frozen clock also makes timestamps reproducible from a seed.
- */
-type ClockState$1 = {
-    /** Current epoch milliseconds. */
-    now: number;
-    /** True while time does not advance on its own. */
-    frozen: boolean;
-    /** Milliseconds a running clock adds to its underlying source. `0` while frozen. */
-    offsetMs: number;
-};
-type Clock$1 = {
-    now(): number;
-    /** Pin the clock to an exact instant, keeping it frozen if it already was. */
-    set(epochMs: number): void;
-    /** Move the clock forward, or back with a negative delta. */
-    advance(deltaMs: number): void;
-    /** Stop time at the current instant. */
-    freeze(): void;
-    /** Resume from the current instant. */
-    unfreeze(): void;
-    /** Drop back to the underlying source, live. */
-    reset(): void;
-    state(): ClockState$1;
-};
-
-/**
- * Seeded pseudo-random numbers, so anything a mock invents — ids, jitter, which
- * request a percentage fault hits — is reproducible from a seed.
- *
- * mulberry32: small, fast, and stable across runtimes, which matters more here
- * than statistical quality.
- */
-type Rng$1 = {
-    /** Next value in `[0, 1)`. */
-    next(): number;
-    /** Next integer in `[min, max]`. */
-    int(min: number, max: number): number;
-    /** Restart the stream from its seed. */
-    reset(): void;
-    /** Serializable engine state used by deterministic checkpoints. */
-    state(): number;
-    /** Restore a state previously returned by {@link state}. */
-    setState(state: number): void;
-    /** Restart the stream from a new seed. `reset` then returns to this seed. */
-    reseed(seed: number | string): void;
-    /** The seed the stream currently starts from. */
-    readonly seed: number;
-};
-
-/**
- * A deliberate failure injected in front of an operation.
- *
- * This is how a suite reaches the vendor's failure modes without the vendor: the
- * quota error that only appears when a shared sandbox is full, the 429 that only
- * appears under load, the 5xx that proves a retry path works.
- *
- * A rule has three parts. What it **matches** (`operationId`, `method`, `path`, …), **when**
- * it fires among the matching requests (`after`, `every`, `count`, `rate`, `from`, `until`),
- * and what it **does** (`status`, `delay`, `timeout`, `drop`, `truncate`, `effect`).
- */
-type FaultRule$1 = {
-    /** Stable id, so a suite can retire exactly the rule it added. Unique within a namespace. */
-    id: string;
-    /** Fault only this operation. Omit to match every operation. */
-    operationId?: string;
-    /** Fault only this HTTP method, case-insensitive. Omit to match every method. */
-    method?: string;
-    /** Fault only this exact path. */
-    path?: string;
-    /** Fault only paths starting with this prefix. Omit to match every path. */
-    pathPrefix?: string;
-    /** Fault only paths matching this regular expression (JavaScript syntax, unanchored). */
-    pathPattern?: string;
-    /** Fault only requests carrying these headers. `"*"` matches any value. */
-    requestHeaders?: Record<string, string>;
-    /** Fault only requests carrying these query parameters. `"*"` matches any value. */
-    query?: Record<string, string>;
-    /**
-     * Fault only requests whose JSON body carries these fields. Each key is a dotted path into
-     * the parsed body (`"patient_details.email"`; a number steps into an array, `"items.0.sku"`)
-     * and each value is what the field must equal: a string, number, boolean or `null`, compared
-     * strictly (`3` is not `"3"`). `"*"` matches any value that is present. A request whose body
-     * is missing, is not JSON, or is not a JSON object never matches. Not `body`, which is the
-     * response a rule injects.
-     */
-    requestBody?: Record<string, RequestBodyValue$1>;
-    /**
-     * Fault only this namespace. Omit (or `"*"`) to fault every namespace — which is what
-     * an in-process caller usually wants, and what a parallel worker usually does not:
-     * rules added through `POST /__admin/faults` default to the calling namespace.
-     */
-    namespace?: string;
-    /** Let this many matching requests through first. */
-    after?: number;
-    /** Then fault only every nth matching request: `3` faults the 3rd, 6th, 9th. */
-    every?: number;
-    /** Retire the rule after this many faults. Omit to keep it until removed. */
-    count?: number;
-    /** Fault this fraction of the remaining requests, `0`–`1`, drawn from the seed. Default `1`. */
-    rate?: number;
-    /**
-     * Fault only from this instant on the namespace clock. A duration (`"5m"`) counts from the
-     * clock when the rule was added. Listed as epoch ms.
-     */
-    from?: Instant$1 | Duration$1;
-    /** Stop faulting at this instant on the namespace clock. A duration counts from when added. */
-    until?: Instant$1 | Duration$1;
-    /**
-     * Status of the injected response. Omit for a rule that only delays, times out, drops,
-     * truncates, or switches on an `effect`: the request then still reaches the service.
-     */
-    status?: number;
-    /** Response body, serialized as JSON. A string is sent as-is. */
-    body?: unknown;
-    /** Response headers. */
-    headers?: Record<string, string>;
-    /** Hold the response back this long. Listed as `delayMs`. */
-    delay?: Duration$1;
-    /** `delay`, in milliseconds. */
-    delayMs?: number;
-    /** Alias of `delayMs`. */
-    latencyMs?: number;
-    /** Extra seeded delay in `[0, jitter]`. Listed as `jitterMs`. */
-    jitter?: Duration$1;
-    jitterMs?: number;
-    /**
-     * Never answer: hold the request this long, then drop the connection. Listed as
-     * `timeoutMs`. With virtual time the wait is spent on the mock clock.
-     */
-    timeout?: Duration$1;
-    timeoutMs?: number;
-    /**
-     * Drop the connection instead of answering: an in-process `fetch` rejects with a
-     * `TypeError`, and a served mock destroys the socket. Models "unknown outcome" failures.
-     */
-    drop?: boolean;
-    /**
-     * Cut the response body off after this many bytes: the status and headers arrive, then
-     * the connection dies mid-body.
-     */
-    truncate?: number;
-    /**
-     * A named service behaviour to switch on for the matching request instead of (or
-     * before) a canned response, e.g. `created_but_500` or `numeric_tracking_id`. Services
-     * read it with `faultEffects(request)`.
-     */
-    effect?: string;
-    /** Parameters for `effect`. */
-    params?: Record<string, unknown>;
-    /** The preset this rule was expanded from, if any. */
-    fromPreset?: string;
-};
-/** What a field of the request body must equal in {@link FaultRule.requestBody}. */
-type RequestBodyValue$1 = string | number | boolean | null;
-/** A fault that fired for one request. */
-type FaultHit$1 = {
-    id: string;
-    /** The injected response; absent when the rule only delays, drops, or sets an effect. */
-    response?: Response;
-    drop?: boolean;
-    /** Set with `drop` when the rule held the request for its `timeout` first. */
-    timeout?: boolean;
-    /** Bytes of response body to let through before the connection dies. */
-    truncate?: number;
-    effect?: {
-        name: string;
-        params: Record<string, unknown>;
-    };
-};
-/** What a request looks like to the fault matcher. */
-type FaultCandidate$1 = {
-    operationId: string | undefined;
-    method: string;
-    path: string;
-    namespace: string;
-    /** Request headers and query, for rules that match on them. */
-    headers?: Headers;
-    query?: URLSearchParams;
-    /**
-     * The request body parsed as JSON, read only when a rule matches on `requestBody`. Resolve
-     * `undefined` for a body that is missing or not JSON. It must leave the request readable.
-     */
-    readJson?: () => Promise<unknown>;
-    /** The namespace clock, for `from` / `until`. Rules with a window are skipped without it. */
-    now?: number;
-    /** How to spend a delay for this request. Default: the registry's own sleep. */
-    wait?: (ms: number) => Promise<void>;
-};
-/** A stored rule and how often it was consulted. */
-type FaultListing$1 = FaultRule$1 & {
-    /** Faults left before the rule retires. `null` when it has no `count`. */
-    remaining: number | null;
-    /** Times the rule faulted a request. */
-    hits: number;
-    /** Requests that matched the rule, faulted or not. */
-    seen: number;
-};
-/** A namespace's own rules, with their counters, in the order they are tried. */
-type FaultSnapshot$1 = {
-    /**
-     * `position` is how many `"*"` rules are tried before the rule, which is what its place
-     * in the order means to a request and holds in any process.
-     */
-    rules: (FaultListing$1 & {
-        position?: number;
-    })[];
-    /** How many `fault_<n>` ids the namespace has handed out. */
-    nextId?: number;
-};
-type FaultRegistry$1 = {
-    snapshot(namespace: string): FaultSnapshot$1;
-    /** Add a rule, or replace the rule with the same id in the same namespace. */
-    add(rule: FaultRule$1): FaultRule$1;
-    /** The next unused `fault_<n>` id in `namespace`. */
-    nextId(namespace: string): string;
-    /** Every rule, or the rules a namespace's requests can hit: its own and the global ones. */
-    list(namespace?: string): FaultListing$1[];
-    get(id: string, namespace?: string): FaultListing$1 | undefined;
-    /** Remove a rule by id: from `namespace` (its own, then a global one), or wherever it is. */
-    remove(id: string, namespace?: string): boolean;
-    /** Remove every rule, or one namespace's own rules. */
-    clear(namespace?: string): void;
-    /** Replace a namespace's own rules with a snapshot's, wherever the snapshot was taken. */
-    restore(namespace: string, state: FaultSnapshot$1): void;
-    /**
-     * Every fault this request should get, in rule order, stopping at the first that answers
-     * or drops (effect-only and delay-only rules let later rules match too). Consumes one of
-     * each matching rule's remaining uses.
-     */
-    take(candidate: FaultCandidate$1): Promise<FaultHit$1[]>;
-    /**
-     * Fire these rules at one request without storing them: no matching, no schedule, in order,
-     * stopping at the first that answers or drops. Jitter draws from the namespace's stream.
-     */
-    fire(rules: readonly FaultRule$1[], candidate: FaultCandidate$1): Promise<FaultHit$1[]>;
-};
-
-/**
- * The admin controls every mock shares, as one document.
- *
- * The same shape is accepted in three places, and means the same thing in each:
- *
- * - at boot: `createRuntime({ adminControls })`, `serve --admin-controls`,
- *   `MOCKINGBIRD_ADMIN_CONTROLS`
- * - over HTTP: `PUT /__admin/controls`
- * - per request: the `x-mockingbird-*` headers in {@link CONTROL_HEADERS}
- *
- * Every control is deterministic: given the same seed, clock and requests, a mock answers
- * the same bytes. Nothing here reads the wall clock or `Math.random`.
- */
-/** Milliseconds, or a string like `"250ms"`, `"2s"`, `"15m"`, `"1h"`, `"3d"`. */
-type Duration$1 = number | string;
-/** Epoch milliseconds, or an ISO-8601 string. */
-type Instant$1 = number | string;
-type ClockControls$1 = {
-    /** Move the clock to this instant. */
-    now?: Instant$1;
-    /** Stop time. A frozen clock moves only when told to, so timestamps replay exactly. */
-    frozen?: boolean;
-    /**
-     * Step the clock forward by this much before every vendor request. With a frozen clock
-     * each request still gets its own, reproducible timestamp.
-     */
-    autoAdvance?: Duration$1;
-};
-/** How long a response takes: a fixed delay plus seeded jitter in `[0, jitter]`. */
-type LatencyRuleInput$1 = {
-    delay?: Duration$1;
-    jitter?: Duration$1;
-};
-type LatencyControls$1 = LatencyRuleInput$1 & {
-    /** Per-operation overrides, keyed by operationId. A bare duration is its `delay`. */
-    operations?: Record<string, Duration$1 | LatencyRuleInput$1>;
-};
-/** A fault to add: a rule (the id is assigned when omitted), or a named preset with overrides. */
-type FaultInput$1 = (Omit<FaultRule$1, "id"> & {
-    id?: string;
-}) | ({
-    preset: string;
-} & Partial<FaultRule$1>);
-/** Identifies a {@link SnapshotDocument}. */
-declare const SNAPSHOT_FORMAT$1 = "mockingbird.snapshot/v1";
-/**
- * A namespace, as portable JSON: what `GET /__admin/snapshots/:id` returns and what
- * `PUT /__admin/snapshots/:id` and the boot `snapshot` control accept. Only `format` and
- * `records` are required, so a hand-written seed file is a valid snapshot.
- */
-type SnapshotDocument$1 = {
-    format: typeof SNAPSHOT_FORMAT$1;
-    /** The service that wrote it. A snapshot is rejected by any other service. */
-    service?: string;
-    /**
-     * Stored rows. `seq` orders a collection; omitted, rows keep their listed order. `raw` is
-     * the stored text of a row that is not a plain record, and replaces `value` when present.
-     */
-    records: {
-        collection: string;
-        id: string;
-        seq?: number;
-        value?: unknown;
-        raw?: string;
-    }[];
-    /** Id counters, so the next generated id continues where the snapshot left off. */
-    sequences?: {
-        name: string;
-        kind: string;
-        value: number;
-    }[];
-    clock?: {
-        now: number;
-        frozen: boolean;
-        autoAdvanceMs?: number;
-    };
-    seed?: number | string;
-    /** Positions of the seeded random streams. */
-    rng?: {
-        state: number;
-        faults?: number;
-        latency?: number;
-    };
-    faults?: unknown;
-    latency?: unknown;
-    virtualTime?: boolean;
-    /** Quiescent webhook endpoints, delivery history and fault state. Contains private configuration. */
-    webhooks?: unknown;
-};
-/** Controls for one namespace. */
-type NamespaceControls$1 = {
-    /** Seeds every random choice: fault rates, jitter, and whatever the service invents. */
-    seed?: number | string;
-    clock?: ClockControls$1;
-    /**
-     * Spend injected waits (latency, fault delays, timeouts) on the mock clock instead of the
-     * wall clock: the request returns at once, the clock has moved, and the journal records
-     * the wait exactly. Default `false`: waits are real, so a client's own timeout can fire.
-     */
-    virtualTime?: boolean;
-    /** Baseline response time for every vendor request. A bare duration is its `delay`. */
-    latency?: Duration$1 | LatencyControls$1;
-    faults?: readonly FaultInput$1[];
-    /** Start from this state instead of the service's own seed data. */
-    snapshot?: SnapshotDocument$1;
-};
-/** {@link NamespaceControls} for every namespace, with per-namespace overrides. */
-type MockControls$1 = NamespaceControls$1 & {
-    /** Vendor credential → namespace, for SDKs that cannot send a namespace header. */
-    credentials?: Record<string, string>;
-    /** Overrides for named namespaces. A key given here replaces the shared value. */
-    namespaces?: Record<string, NamespaceControls$1>;
-};
-/** A latency rule in milliseconds. */
-type LatencyRule$1 = {
-    delayMs: number;
-    jitterMs: number;
-};
-/** Baseline latency for a namespace, normalized. */
-type LatencyState$1 = LatencyRule$1 & {
-    operations: Record<string, LatencyRule$1>;
-};
-/** What {@link controlHeaders} turns into request headers. */
-type ControlHeaderInput$1 = {
-    namespace?: string;
-    adminKey?: string;
-    branch?: string;
-    at?: string;
-    reset?: boolean;
-    restore?: string;
-    seed?: number | string;
-    time?: Instant$1 | Date;
-    advance?: Duration$1;
-    virtualTime?: boolean;
-    delay?: Duration$1;
-    timeout?: Duration$1;
-    /** A status, `"drop"`, a preset name, or a fault rule. */
-    fault?: number | string | Record<string, unknown>;
-    snapshot?: string;
-};
-
-/**
- * One problem with a request body, at a dotted path (`patient.address.city`, `items.0.sku`).
- * `kind` is `media_type` when the body is present but its media type is not one the operation
- * accepts (a `415` on most vendors), `syntax` when it could not be decoded, `required` when
- * the operation needs a body and none arrived, and `schema` for a contract violation.
- */
-type BodyIssue$1 = {
-    path: string;
-    message: string;
-    kind?: "media_type" | "syntax" | "required" | "schema";
-};
-
-/**
- * What the mock received from a request it rejected, so a 4xx can be attributed after the
- * fact (an empty body, a missing `content-type`, a schema violation) without logging the body.
- */
-type RejectedRequest$1 = {
-    /** The raw `content-type` header, or `null` when the request sent none. */
-    contentType: string | null;
-    /** Bytes of body received from `content-length` (`0` for none), or `null` when the client sent no length (a streamed / chunked body). */
-    bodyBytes: number | null;
-    /** The raw `transfer-encoding` header (`chunked`), or `null`. */
-    transferEncoding: string | null;
-};
-/** One handled request, as the structured log sees it. */
-type RequestLog$1 = {
-    service: string;
-    namespace: string;
-    operationId: string | undefined;
-    method: string;
-    path: string;
-    status: number;
-    durationMs: number;
-    /** True when the path matched no operation in the contract. */
-    unmatched: boolean;
-    /** Set when a fault rule produced the response. */
-    faultId?: string;
-    /** Milliseconds of injected wait: latency, fault delays and timeouts. Absent when none. */
-    delayMs?: number;
-    /** Resource ids the handler touched (`userId`, `orderId`, …), when the service reports them. */
-    ids?: Record<string, string>;
-    /** Set when the service created a resource the request referred to but that did not exist. */
-    adopted?: boolean;
-    /** Explicit durable acceptance, independent of response delivery. */
-    accepted?: boolean;
-    /** Checkpoint captured at explicit acceptance. */
-    checkpoint?: string;
-    /** Set on a rejection (status ≥ 400) the mock produced itself, never on a scripted fault. */
-    request?: RejectedRequest$1;
-    /** The validation issues behind a rejection, when the service found any. */
-    issues?: BodyIssue$1[];
-};
-type MetricsReport$1 = {
-    requests: number;
-    /** Counts keyed `<operationId> <status>`. */
-    byOperation: Record<string, number>;
-    /**
-     * Paths that matched no operation, most frequent first.
-     *
-     * This is the early-warning signal: a consumer calling something the mock does
-     * not implement shows up here as a count, before it fails a suite as a 404.
-     */
-    unmatched: {
-        method: string;
-        path: string;
-        count: number;
-    }[];
-    faults: number;
-    totalDurationMs: number;
-};
-type Metrics$1 = {
-    record(entry: RequestLog$1): void;
-    report(namespace?: string): MetricsReport$1;
-    reset(namespace?: string): void;
-};
-
-/** One journal entry: a request log stamped with when (on the mock clock) it was handled. */
-type JournalEntry$1 = RequestLog$1 & {
-    at: string;
-};
-type JournalQuery$1 = {
-    /** Only this namespace. Omit for every namespace, oldest first across all of them. */
-    namespace?: string;
-    operationId?: string;
-    /** Only this HTTP method, case-insensitive. */
-    method?: string;
-    /** Only this exact path. */
-    path?: string;
-    /** Only requests this fault rule answered or shaped. */
-    faultId?: string;
-    status?: number;
-    /** Only entries at or after this instant (epoch ms). */
-    since?: number;
-    /** At most this many, the most recent kept. */
-    limit?: number;
-};
-type Journal$1 = {
-    readonly size: number;
-    record(entry: JournalEntry$1): void;
-    list(query?: JournalQuery$1): JournalEntry$1[];
-    /** Forget one namespace's entries, or every namespace's. */
-    clear(namespace?: string): void;
-};
-
-/**
- * Baseline response time, per namespace: how long every vendor request takes before any
- * fault is considered. Jitter draws from a stream the caller owns, one per namespace and
- * separate from the fault stream, so adding latency never shifts which requests a `rate`
- * fault hits.
- */
-type LatencyRegistry$1 = {
-    get(namespace: string): LatencyState$1;
-    set(namespace: string, state: LatencyState$1): LatencyState$1;
-    /** Remove one namespace's latency, or every namespace's. */
-    clear(namespace?: string): void;
-    /** Milliseconds this request waits. Draws jitter, so call it once per request. */
-    take(namespace: string, operationId: string | undefined): number;
-};
-
-/** Clock state as the admin API reports it. */
-type ControlClock$1 = ClockState$1 & {
-    /** `now`, as ISO-8601. */
-    iso: string;
-    /** Milliseconds the clock steps before every vendor request. */
-    autoAdvanceMs: number;
-};
-/** One namespace's controls: the body of `GET /__admin/controls`. */
-type ControlState$1 = {
-    namespace: string;
-    seed: number | string;
-    clock: ControlClock$1;
-    virtualTime: boolean;
-    latency: LatencyState$1;
-    faults: FaultListing$1[];
-};
-
-/** What `GET /__admin/snapshots` lists for each snapshot. */
-type SnapshotInfo$1 = {
-    id: string;
-    namespace: string;
-    /** Stored rows in the snapshot. */
-    records: number;
-    /** The namespace clock when it was taken, epoch ms. */
-    at: number;
-    /** Whether `GET /snapshots/:id` can return it as a {@link SnapshotDocument}. */
-    portable: boolean;
-};
-
-/** Credential → namespace mapping behind `PUT /__admin/credentials`. */
-type CredentialRegistry$1 = {
-    set(credential: string, namespace: string): void;
-    get(credential: string): string | undefined;
-    remove(credential: string): boolean;
-    clear(): void;
-    entries(): {
-        credential: string;
-        namespace: string;
-    }[];
-};
-
-type OwnedTransport$1 = (request: Request, namespace: string, send: typeof fetch) => Promise<Response>;
-
-/**
- * A point-in-time copy of everything a service namespace holds.
- *
- * All service state lives in the two core tables keyed by namespace, so a snapshot
- * is generic: any service gets per-test rollback without knowing its own schema.
- * Restoring is much cheaper than rebuilding a namespace from a corpus.
- */
-type NamespaceSnapshot$1 = {
-    namespace: string;
-    records: {
-        collection: string;
-        id: string;
-        seq: number;
-        value: string;
-    }[];
-    sequences: {
-        name: string;
-        kind: string;
-        value: number;
-    }[];
-};
-
-declare const STATE_FIELD_KINDS$1: readonly ["string", "number", "boolean", "null", "object", "array", "unknown"];
-type StateFieldKind$1 = (typeof STATE_FIELD_KINDS$1)[number];
-/** JSON-safe annotations a bespoke admin UI may read. The default UI shows them as text. */
-type StateMeta$1 = Readonly<Record<string, string | number | boolean | null>>;
-type StateField$1 = {
-    name: string;
-    kind: StateFieldKind$1;
-    optional: boolean;
-    description?: string;
-    /** One level of nested object fields. */
-    fields?: StateField$1[];
-    meta?: StateMeta$1;
-};
-type StateCollectionView$1 = {
-    name: string;
-    label: string;
-    description?: string;
-    count: number;
-    /** `mixed` when a declaration and stored rows both contribute fields. */
-    source: "declared" | "inferred" | "mixed";
-    fields: StateField$1[];
-    meta?: StateMeta$1;
-};
-/** The shape of one namespace, for an admin UI that has never seen the service before. */
-type StateView$1 = {
-    namespace: string;
-    storageNamespace: string;
-    collections: StateCollectionView$1[];
-};
-
-type WebhookEndpoint$1 = {
-    /** Stable id; generated when omitted. */
-    id?: string;
-    url: string;
-    secret?: string;
-    /** Event types to deliver; omit or include `"*"` for every type. */
-    events?: string[];
-    /** Deliver only messages whose tags include all of these (e.g. `{ account: "mso" }`). */
-    tags?: Record<string, string>;
-    /** The public URL the receiver verifies signatures against (Twilio), when it differs. */
-    signUrl?: string;
-    headers?: Record<string, string>;
-};
-type WebhookMessage$1 = {
-    id: string;
-    namespace: string;
-    type: string;
-    body: string;
-    contentType: string;
-    tags: Record<string, string>;
-    headers?: Record<string, string>;
-    /** Wall-clock ISO-8601 time of publication. */
-    publishedAt: string;
-};
-type WebhookAttempt$1 = {
-    attempt: number;
-    at: string;
-    status: number | null;
-    error: string | null;
-    durationMs: number;
-    /** Exact receiver response body, when one was returned. */
-    responseBody?: string | null;
-};
-type WebhookDelivery$1 = {
-    id: string;
-    messageId: string;
-    namespace: string;
-    type: string;
-    endpointId: string;
-    url: string;
-    state: "pending" | "delivered" | "failed" | "dropped";
-    attempts: WebhookAttempt$1[];
-};
-/** A delivery-level fault: what happens to the next `count` messages in a namespace. */
-type WebhookFault$1 = {
-    mode: "duplicate" | "reorder" | "drop";
-    /** Messages affected; default 1. */
-    count?: number;
-};
-type PublishInput$1 = {
-    namespace: string;
-    type: string;
-    /** Exact body; objects are JSON-encoded. */
-    body: string | Record<string, unknown> | unknown[];
-    /** Default `application/json`, or form-encoded when `form` is given. */
-    contentType?: string;
-    /** Form parameters, when the vendor posts `application/x-www-form-urlencoded`. */
-    form?: Record<string, string>;
-    tags?: Record<string, string>;
-    /** Message-specific delivery headers, captured as part of durable message state. */
-    headers?: Record<string, string>;
-    /** Message id; generated when omitted. */
-    id?: string;
-};
-type WebhookHub$1 = {
-    observeDeliveries(listener: (event: {
-        namespace: string;
-        state: string;
-        deliveryId: string;
-    }) => void): () => void;
-    setTransportPolicy(policy: OwnedTransport$1): void;
-    pending(namespace: string): number;
-    snapshot(namespace: string): unknown;
-    exportSnapshot(handle: unknown): unknown;
-    importSnapshot(namespace: string, document: unknown): unknown;
-    restore(namespace: string, snapshot: unknown): void;
-    publish(input: PublishInput$1): WebhookMessage$1;
-    /** Replace a namespace's own endpoints (`PUT /__admin/webhook-endpoints`). */
-    setEndpoints(namespace: string, endpoints: WebhookEndpoint$1[]): WebhookEndpoint$1[];
-    /** The endpoints a namespace delivers to: its own, plus the global ones. */
-    endpoints(namespace: string): WebhookEndpoint$1[];
-    messages(namespace?: string): WebhookMessage$1[];
-    deliveries(namespace?: string): WebhookDelivery$1[];
-    replay(deliveryId: string): Promise<WebhookDelivery$1 | undefined>;
-    /** Run every pending retry (and release held reordered messages) now, and every retry those attempts schedule, until nothing is pending. */
-    flush(): Promise<void>;
-    /** Resolve once nothing is in flight. */
-    idle(namespace?: string): Promise<void>;
-    fault(namespace: string, fault: WebhookFault$1): void;
-    clear(namespace?: string): void;
-};
-
-/** What the runtime needs from a service: a Fetch handler it can reset. */
-type ServiceInstance$1 = FetchAPI$1 & {
-    reset(): Promise<void>;
-};
-type ServiceTimelineState$1 = Readonly<{
-    snapshot: NamespaceSnapshot$1;
-    /** `pinned`: the namespace's clock was frozen itself, not just following a frozen base. */
-    clock: Readonly<ClockState$1 & {
-        pinned?: boolean;
-    }>;
-    rngState: number;
-}>;
-type ServiceCheckpoint$1 = Checkpoint$1<ServiceTimelineState$1>;
-type ServiceRuntime$1<T extends ServiceInstance$1> = FetchAPI$1 & {
-    /** Stop package-owned lifecycle timers when a supervisor closes the runtime. */
-    stop?(): void;
-    readonly name: string;
-    /** Same-origin Fetch handler and App Router method exports, sharing this runtime. */
-    mount(prefix: string): MountedAPI$1;
-    readonly sqlite: SqliteClient$2;
-    readonly clock: Clock$1;
-    /**
-     * Change the id base ({@link RuntimeOptions.idBase}) for ids generated from now on, and
-     * return the number it resolved to. Set it before the first request so a boot's ids stay
-     * one run.
-     */
-    setIdBase(base: IdBase$1): number;
-    readonly faults: FaultRegistry$1;
-    /** Baseline response time per namespace. */
-    readonly latency: LatencyRegistry$1;
-    readonly metrics: Metrics$1;
-    readonly journal: Journal$1;
-    readonly rng: Rng$1;
-    readonly credentials: CredentialRegistry$1;
-    /** The webhook hub, when the service has outbound webhooks. */
-    readonly webhooks: WebhookHub$1 | undefined;
-    /**
-     * A namespace's clock. Each follows the base clock, {@link ServiceRuntime.clock}, with an
-     * offset and a freeze of its own, so moving one never moves another.
-     */
-    namespaceClock(namespace?: string): Clock$1;
-    namespaceOf(request: Request): string;
-    /** Opaque in-process checkpoint including records, controls and webhook history. */
-    fleetSnapshot(namespace: string): object;
-    fleetRestore(snapshot: unknown, namespace: string): void;
-    fleetExport(snapshot: unknown): SnapshotDocument$1;
-    fleetImport(namespace: string, document: unknown): object;
-    /** Expand a named preset into fault rules (and webhook faults) for `namespace`. */
-    applyPreset(name: string, namespace?: string, overrides?: Partial<FaultRule$1>): FaultRule$1[];
-    /** The instance behind `namespace` (the default one when omitted), created on first use. */
-    instance(namespace?: string): T;
-    /** Public names of every namespace created so far. */
-    namespaces(): string[];
-    /** Return one namespace to its boot state, or every namespace with `"*"`. */
-    reset(namespace?: string): Promise<void>;
-    /** Reset a namespace and forget it, releasing everything it held. */
-    dropNamespace(namespace: string): Promise<void>;
-    /** A namespace's controls: seed, clock, virtual time, latency, faults and snapshots. */
-    controls(namespace?: string): ControlState$1 & {
-        snapshots: SnapshotInfo$1[];
-    };
-    /** Apply a control document to a namespace. A given key replaces that control. */
-    configure(controls: NamespaceControls$1, namespace?: string): ControlState$1 & {
-        snapshots: SnapshotInfo$1[];
-    };
-    /** Named snapshots of a namespace: records, clock, random streams, faults and latency. */
-    readonly snapshots: {
-        /** Capture the namespace now. Reusing a name replaces that snapshot. */
-        create(options?: {
-            name?: string;
-            namespace?: string;
-        }): SnapshotInfo$1;
-        list(namespace?: string): SnapshotInfo$1[];
-        /** The snapshot as portable JSON, to commit beside a suite or boot another mock from. */
-        export(id: string, namespace?: string): SnapshotDocument$1;
-        /** Store a document as a snapshot without restoring it. */
-        import(document: SnapshotDocument$1, options?: {
-            name?: string;
-            namespace?: string;
-        }): SnapshotInfo$1;
-        restore(id: string, namespace?: string): void;
-        delete(id: string, namespace?: string): boolean;
-    };
-    /** Request headers that carry controls, checked: spread them into a `fetch` or an SDK's defaults. */
-    headers(input: ControlHeaderInput$1): Record<string, string>;
-    snapshot(namespace?: string): NamespaceSnapshot$1;
-    restore(snapshot: NamespaceSnapshot$1, namespace?: string): void;
-    /** Capture the current branch. Mutating HTTP calls do this automatically. */
-    checkpoint(namespace?: string, branch?: string): ServiceCheckpoint$1;
-    /** Create an isolated branch, optionally from a historical checkpoint. */
-    branch(name: string, options?: {
-        namespace?: string;
-        at?: string;
-    }): ServiceCheckpoint$1;
-    /** Restore a branch, clock, and PRNG to a checkpoint. */
-    checkout(checkpoint: string, options?: {
-        namespace?: string;
-        branch?: string;
-    }): void;
-    /** Inspect the retained history for a namespace. */
-    timeline(namespace?: string): Timeline$1<ServiceTimelineState$1>;
-    /** Collections in one namespace: declared shape plus what the rows actually hold. */
-    state(namespace?: string): StateView$1;
-};
-
-/** A running server, with the address it actually bound. */
-type Listening = {
-    url: string;
-    port: number;
-    host: string;
-    server: Server;
-    close(): Promise<void>;
-};
-
-type CliOption = {
-    type: "string" | "boolean";
-    description: string;
-    /** Shown in help; the value placeholder, e.g. `<port>`. */
-    value?: string;
-    default?: string | boolean;
-};
-type CliValues = Record<string, string | boolean | undefined>;
-type CommonServeOptions = {
-    adminPrefix?: string;
-    adminKey: string | undefined;
-    seed: string | undefined;
-    onLog: ((entry: RequestLog$1) => void) | undefined;
-    /** Admin controls to boot with: clock, latency, faults, a starting snapshot. */
-    adminControls?: MockControls$1;
-    /** Synthetic provider fixture objects supplied by a fleet entry. */
-    fixtures?: Record<string, unknown>;
-    baseUrl?: string;
-    /**
-     * Boot settings from `--settings`, `MOCKINGBIRD_SETTINGS` or a fleet entry's `settings`,
-     * already checked by the target's {@link ServeTarget.parseSettings}. Pass them to the
-     * service's own `settings` option so they become every namespace's defaults.
-     */
-    settings?: Record<string, unknown>;
-};
-/**
- * What a service contributes to `serve`: how to build its runtime from CLI flags,
- * and what to say at startup. Every service's `./server` entry exports one as
- * `serveTarget`, which is also how `serve --config` finds services by name.
- */
-type ServeTarget = {
-    packageVersion?: string;
-    name: string;
-    defaultPort: number;
-    /** Serve flags beyond the common ones. */
-    options?: Record<string, CliOption>;
-    /**
-     * Check the boot settings a caller supplied (`--settings`, `MOCKINGBIRD_SETTINGS`, a fleet
-     * entry's `settings`) against the service's settings schema, returning them normalized
-     * or throwing a message naming the bad field. A target without one takes no boot settings,
-     * and supplying some is refused before a port is bound.
-     */
-    parseSettings?(settings: Record<string, unknown>): Record<string, unknown>;
-    create(values: CliValues, common: CommonServeOptions): Promise<ServiceRuntime$1<ServiceInstance$1>> | ServiceRuntime$1<ServiceInstance$1>;
-    /** Largest request body the HTTP server accepts. Default 16 MiB. */
-    maxBodyBytes?: number;
-    /** Startup lines after the listen address, e.g. the loaded corpus version. */
-    banner?(runtime: ServiceRuntime$1<ServiceInstance$1>): string[];
-    /** After the HTTP server is bound. A service that speaks more than HTTP attaches it here. */
-    listening?(server: Listening): void;
-};
+import { RuntimeOptions, Runtime } from './index.js';
 
 type MountedAPI = FetchAPI & {
     readonly prefix: string;
@@ -1097,9 +105,9 @@ interface FetchAPI {
 type FetchHandler = (request: Request) => Promise<Response>;
 
 /** Bind values accepted by Mockingbird's SQLite port (matches sqlite-mem / better-sqlite3). */
-type SqliteValue$1 = null | number | bigint | string | Uint8Array | boolean;
+type SqliteValue = null | number | bigint | string | Uint8Array | boolean;
 /** Mutation counters returned by {@link SqliteStatement.run}. */
-type SqliteRunResult$1 = {
+type SqliteRunResult = {
     changes: number;
     lastInsertRowid: number | bigint;
 };
@@ -1108,10 +116,10 @@ type SqliteRunResult$1 = {
  *
  * Pass bind values as rest arguments on each call (no sticky `bind()`).
  */
-interface SqliteStatement$1 {
-    run(...params: SqliteValue$1[]): SqliteRunResult$1;
-    all<T = Record<string, unknown>>(...params: SqliteValue$1[]): T[];
-    get<T = Record<string, unknown>>(...params: SqliteValue$1[]): T | undefined;
+interface SqliteStatement {
+    run(...params: SqliteValue[]): SqliteRunResult;
+    all<T = Record<string, unknown>>(...params: SqliteValue[]): T[];
+    get<T = Record<string, unknown>>(...params: SqliteValue[]): T | undefined;
 }
 /**
  * Sync SQLite client port owned by Mockingbird.
@@ -1119,121 +127,17 @@ interface SqliteStatement$1 {
  * Duck-typed so `@crvouga/mockingbird-service-sqlite` `Database`, better-sqlite3, and wrapped
  * `bun:sqlite` instances all work when they expose this surface.
  */
-interface SqliteClient$1 {
+interface SqliteClient {
     exec(sql: string): void;
-    prepare(sql: string): SqliteStatement$1;
+    prepare(sql: string): SqliteStatement;
     transaction<T>(fn: () => T): T;
 }
 
-/** Every stored record carries a monotonically increasing sequence for stable ordering. */
-type Stored<T> = {
-    seq: number;
-    value: T;
-};
-type ListRecordsOptions<T> = {
-    /** Keep only records passing the predicate. */
-    where?: (value: T, seq: number) => boolean;
-    /** Sort order; default newest first. */
-    order?: "newest" | "oldest";
-};
-/**
- * A SQLite-backed table of JSON records addressed by id. Ordering is by insertion
- * sequence, never by id lexicographic order, so list semantics stay stable.
- */
-declare class Collection<T> {
-    private readonly sqlite;
-    /** Storage namespace. Admin introspection uses this to ignore another namespace's tables. */
-    readonly namespace: string;
-    /** Table name inside the namespace. Stable across resets of the rows themselves. */
-    readonly collectionName: string;
-    private readonly statements;
-    private prepare;
-    constructor(sqlite: SqliteClient$1, 
-    /** Storage namespace. Admin introspection uses this to ignore another namespace's tables. */
-    namespace: string, 
-    /** Table name inside the namespace. Stable across resets of the rows themselves. */
-    collectionName: string);
-    private bumpCollectionSeq;
-    nextSequence(): number;
-    get(id: string): T | undefined;
-    has(id: string): boolean;
-    /** Insert a new record, assigning it the next sequence number. */
-    insert(id: string, value: T): Stored<T>;
-    /** Replace an existing record's value, keeping its position. */
-    update(id: string, value: T): Stored<T> | undefined;
-    delete(id: string): boolean;
-    /** How many records the collection holds, without reading them. */
-    count(): number;
-    list(options?: ListRecordsOptions<T>): Array<Stored<T> & {
-        id: string;
-    }>;
-}
-
 /**
  * What names an id base: a non-negative safe integer (or its decimal string) or `"boot"`,
  * which derives the base from the wall clock when the runtime is created.
  */
 type IdBase = number | string;
-/**
- * Sequential id source persisted in SQLite. Ids are deterministic for a given
- * sequence history (`cus_` + 14 opaque chars), so reproductions stay stable.
- * A runtime's `idBase` is mixed in, so a different base reissues none of another's ids.
- */
-declare class IdSequence {
-    private readonly sqlite;
-    private readonly namespace;
-    private readonly salt;
-    constructor(sqlite: SqliteClient$1, namespace: string, salt?: string);
-    next(prefix: string, length?: number): string;
-}
-
-/** Options every provider constructor accepts. */
-type APIOptions$1 = {
-    /** Sync SQLite client. Defaults to `@crvouga/mockingbird-service-sqlite`. */
-    sqlite?: SqliteClient$1;
-    /** Clock used for `created`-style fields. Default `Date.now`. */
-    now?: () => number;
-    /**
-     * Storage namespace for this instance's records. Instances sharing one SQLite
-     * client stay isolated when their namespaces differ. Defaults to the service name.
-     */
-    namespace?: string;
-};
-
-type AwsInput = Record<string, unknown>;
-type AwsProtocolOptions = APIOptions$1 & {
-    region?: string;
-    accountId?: string;
-};
-type AwsOperation = {
-    operation: string;
-    input: AwsInput;
-    request: Request;
-    url: URL;
-};
-/** Fetch-native AWS wire transport. Service subclasses own operations and persisted state. */
-declare abstract class AwsProtocolAPI {
-    readonly service: string;
-    readonly sqlite: SqliteClient$1;
-    readonly namespace: string;
-    readonly now: () => number;
-    readonly region: string;
-    readonly accountId: string;
-    readonly ids: IdSequence;
-    private readonly collections;
-    constructor(service: string, options?: AwsProtocolOptions);
-    collection(name: string): Collection<AwsInput>;
-    arn(type: string, name: string, service?: string): string;
-    reset(): Promise<void>;
-    abstract dispatch(context: AwsOperation): unknown | Promise<unknown>;
-    route(_method: string, _pathname: string): {
-        operation: string;
-        params: AwsInput;
-    } | undefined;
-    fetch(request: Request): Promise<Response>;
-    unsupported(operation: string): never;
-    get(collection: string, id: string, code?: string): AwsInput;
-}
 
 /**
  * The single source of time for a service.
@@ -1943,7 +847,7 @@ type ServiceRuntime<T extends ServiceInstance> = FetchAPI & {
     readonly name: string;
     /** Same-origin Fetch handler and App Router method exports, sharing this runtime. */
     mount(prefix: string): MountedAPI;
-    readonly sqlite: SqliteClient$1;
+    readonly sqlite: SqliteClient;
     readonly clock: Clock;
     /**
      * Change the id base ({@link RuntimeOptions.idBase}) for ids generated from now on, and
@@ -2029,54 +933,66 @@ type ServiceRuntime<T extends ServiceInstance> = FetchAPI & {
     state(namespace?: string): StateView;
 };
 
-/** Bind values accepted by Mockingbird's SQLite port (matches sqlite-mem / better-sqlite3). */
-type SqliteValue = null | number | bigint | string | Uint8Array | boolean;
-/** Mutation counters returned by {@link SqliteStatement.run}. */
-type SqliteRunResult = {
-    changes: number;
-    lastInsertRowid: number | bigint;
+/** A running server, with the address it actually bound. */
+type Listening = {
+    url: string;
+    port: number;
+    host: string;
+    server: Server;
+    close(): Promise<void>;
 };
-/**
- * Prepared statement bound to a {@link SqliteClient}.
- *
- * Pass bind values as rest arguments on each call (no sticky `bind()`).
- */
-interface SqliteStatement {
-    run(...params: SqliteValue[]): SqliteRunResult;
-    all<T = Record<string, unknown>>(...params: SqliteValue[]): T[];
-    get<T = Record<string, unknown>>(...params: SqliteValue[]): T | undefined;
-}
-/**
- * Sync SQLite client port owned by Mockingbird.
- *
- * Duck-typed so `@crvouga/mockingbird-service-sqlite` `Database`, better-sqlite3, and wrapped
- * `bun:sqlite` instances all work when they expose this surface.
- */
-interface SqliteClient {
-    exec(sql: string): void;
-    prepare(sql: string): SqliteStatement;
-    transaction<T>(fn: () => T): T;
-}
-
-type APIOptions = AwsProtocolOptions;
-declare class CloudcontrolAPI extends AwsProtocolAPI {
-    constructor(options?: APIOptions);
-    dispatch({ operation }: AwsOperation): unknown;
-}
 
-type RuntimeOptions = {
-    sqlite?: SqliteClient;
-    clock?: Clock;
-    seed?: number | string;
-    region?: string;
-    accountId?: string;
+type CliOption = {
+    type: "string" | "boolean";
+    description: string;
+    /** Shown in help; the value placeholder, e.g. `<port>`. */
+    value?: string;
+    default?: string | boolean;
+};
+type CliValues = Record<string, string | boolean | undefined>;
+type CommonServeOptions = {
     adminPrefix?: string;
-    adminKey?: string;
-    /** Admin controls to boot with: clock, latency, faults, seed, a starting snapshot. */
+    adminKey: string | undefined;
+    seed: string | undefined;
+    onLog: ((entry: RequestLog) => void) | undefined;
+    /** Admin controls to boot with: clock, latency, faults, a starting snapshot. */
     adminControls?: MockControls;
-    onLog?: (entry: RequestLog) => void;
+    /** Synthetic provider fixture objects supplied by a fleet entry. */
+    fixtures?: Record<string, unknown>;
+    baseUrl?: string;
+    /**
+     * Boot settings from `--settings`, `MOCKINGBIRD_SETTINGS` or a fleet entry's `settings`,
+     * already checked by the target's {@link ServeTarget.parseSettings}. Pass them to the
+     * service's own `settings` option so they become every namespace's defaults.
+     */
+    settings?: Record<string, unknown>;
+};
+/**
+ * What a service contributes to `serve`: how to build its runtime from CLI flags,
+ * and what to say at startup. Every service's `./server` entry exports one as
+ * `serveTarget`, which is also how `serve --config` finds services by name.
+ */
+type ServeTarget = {
+    packageVersion?: string;
+    name: string;
+    defaultPort: number;
+    /** Serve flags beyond the common ones. */
+    options?: Record<string, CliOption>;
+    /**
+     * Check the boot settings a caller supplied (`--settings`, `MOCKINGBIRD_SETTINGS`, a fleet
+     * entry's `settings`) against the service's settings schema, returning them normalized
+     * or throwing a message naming the bad field. A target without one takes no boot settings,
+     * and supplying some is refused before a port is bound.
+     */
+    parseSettings?(settings: Record<string, unknown>): Record<string, unknown>;
+    create(values: CliValues, common: CommonServeOptions): Promise<ServiceRuntime<ServiceInstance>> | ServiceRuntime<ServiceInstance>;
+    /** Largest request body the HTTP server accepts. Default 16 MiB. */
+    maxBodyBytes?: number;
+    /** Startup lines after the listen address, e.g. the loaded corpus version. */
+    banner?(runtime: ServiceRuntime<ServiceInstance>): string[];
+    /** After the HTTP server is bound. A service that speaks more than HTTP attaches it here. */
+    listening?(server: Listening): void;
 };
-type Runtime = ServiceRuntime<CloudcontrolAPI>;
 
 declare const DEFAULT_PORT = 8925;
 type ServerOptions = RuntimeOptions & {