@crvouga/mockingbird-service-docker 1.2.0 → 1.4.0

package/dist/cli.js

@@ -1,97 +1,3192 @@
 #!/usr/bin/env node
 import {
   serveTarget
-} from "./chunk-TR75ZFCZ.js";
+} from "./chunk-DG4KWFV5.js";
 import {
   createClock,
+  normalizeBootControls,
+  normalizeControls,
+  ownedTransport,
   parseDuration,
-  resolveAdminPrefix
-} from "./chunk-5I542RFL.js";
+  parseFaultHeader,
+  resolveAdminPrefix,
+  restoreClock
+} from "./chunk-PEU54Q4H.js";
 
 // ../../adapters/node/dist/cli.js
-import { readFile as readFile2 } from "node:fs/promises";
-import { createRequire } from "node:module";
-import { resolve } from "node:path";
+import { readFile as readFile5 } from "node:fs/promises";
+import { createRequire as createRequire3 } from "node:module";
+import { resolve as resolve3 } from "node:path";
 import { pathToFileURL } from "node:url";
 import { parseArgs } from "node:util";
 
 // ../../adapters/node/dist/fleet.js
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
+import { createHash as createHash4, randomUUID as randomUUID4 } from "node:crypto";
+import { chmod, readFile as readFile2, rename, rm, writeFile } from "node:fs/promises";
+
+// ../../adapters/node/dist/fleet-management.js
+import { AsyncLocalStorage } from "node:async_hooks";
+import { createHash as createHash3, randomBytes, randomUUID as randomUUID3 } from "node:crypto";
+
+// ../../adapters/node/dist/fleet-archive.js
+import { createHash } from "node:crypto";
+var canonical = (value) => {
+  if (Array.isArray(value))
+    return `[${value.map(canonical).join(",")}]`;
+  if (value !== null && typeof value === "object")
+    return `{${Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, v]) => `${JSON.stringify(k)}:${canonical(v)}`).join(",")}}`;
+  return JSON.stringify(value);
+};
+var digest = (value) => createHash("sha256").update(canonical(value)).digest("hex");
+var sealArchive = (content) => ({
+  ...content,
+  sha256: digest(content)
+});
+function validateArchive(value) {
+  if (!value || typeof value !== "object")
+    throw new Error("expected fleet archive");
+  const doc = value;
+  const { sha256, ...content } = doc;
+  if (doc.format !== "mockingbird.fleet/v1" || typeof doc.sourceId !== "string" || typeof doc.createdAt !== "string" || !doc.namespaces || typeof doc.namespaces !== "object" || Array.isArray(doc.namespaces) || sha256 !== digest(content))
+    throw new Error("unsupported or corrupt fleet archive");
+  for (const [namespace, entry] of Object.entries(doc.namespaces)) {
+    if (!/^[A-Za-z0-9_.-]{1,64}$/.test(namespace) || !entry || !Number.isFinite(entry.clock?.now) || typeof entry.clock?.frozen !== "boolean" || !entry.services || !Object.keys(entry.services).length)
+      throw new Error("invalid archive namespace");
+    for (const [name, child] of Object.entries(entry.services))
+      if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(name) || !child || child.version !== 1 || !["http", "postgres", "redis", "external"].includes(child.protocol))
+        throw new Error("unsupported archive service/version");
+  }
+  return doc;
+}
+function inspectArchive(input) {
+  const archive = validateArchive(input);
+  return {
+    format: archive.format,
+    createdAt: archive.createdAt,
+    sha256: archive.sha256,
+    namespaces: Object.fromEntries(Object.entries(archive.namespaces).map(([name, ns]) => [
+      name,
+      {
+        clock: ns.clock,
+        services: Object.fromEntries(Object.entries(ns.services).map(([service, state]) => [
+          service,
+          {
+            protocol: state.protocol,
+            version: state.version,
+            bytes: Buffer.byteLength(canonical(state.state))
+          }
+        ]))
+      }
+    ]))
+  };
+}
+function diffArchives(left, right, options = {}) {
+  const a = validateArchive(left), b = validateArchive(right);
+  const limit = Math.min(1e3, Math.max(1, options.limit ?? 100));
+  const changes = [];
+  let total = 0;
+  const walk = (namespace, service, path, before, after) => {
+    if (canonical(before) === canonical(after))
+      return;
+    if (before && after && typeof before === "object" && typeof after === "object" && !Array.isArray(before) && !Array.isArray(after)) {
+      for (const key of /* @__PURE__ */ new Set([...Object.keys(before), ...Object.keys(after)]))
+        walk(namespace, service, `${path}/${key}`, before[key], after[key]);
+      return;
+    }
+    total++;
+    if (changes.length < limit)
+      changes.push({
+        namespace,
+        service,
+        path,
+        kind: before === void 0 ? "added" : after === void 0 ? "removed" : "changed",
+        ...options.values ? { before, after } : {}
+      });
+  };
+  for (const ns of /* @__PURE__ */ new Set([...Object.keys(a.namespaces), ...Object.keys(b.namespaces)])) {
+    if (options.namespace !== void 0 && options.namespace !== ns)
+      continue;
+    const an = a.namespaces[ns], bn = b.namespaces[ns];
+    walk(ns, "$clock", "/clock", an?.clock, bn?.clock);
+    for (const service of /* @__PURE__ */ new Set([
+      ...Object.keys(an?.services ?? {}),
+      ...Object.keys(bn?.services ?? {})
+    ])) {
+      if (options.service !== void 0 && options.service !== service)
+        continue;
+      const x = an?.services[service], y = bn?.services[service];
+      if (x && y && (x.protocol !== y.protocol || x.version !== y.version))
+        throw new Error("incompatible snapshot comparison");
+      const normalize = (state) => {
+        if (state && typeof state === "object") {
+          const obj = state;
+          if (obj.format === "mockingbird.postgres/v1" && obj.inventory) {
+            if (options.values)
+              throw new Error("raw PostgreSQL row diff is unsupported; use bounded namespace inspection");
+            const { databases: _databases, ...metadata } = obj;
+            return metadata;
+          }
+          if (obj.$redis === "map" && Array.isArray(obj.value))
+            return Object.fromEntries(obj.value.map((pair) => [
+              typeof pair[0] === "string" ? pair[0] : canonical(pair[0]),
+              normalize(pair[1])
+            ]));
+          if (Array.isArray(state))
+            return Object.fromEntries(state.map((value, index) => [String(index), normalize(value)]));
+        }
+        if (state && typeof state === "object" && Array.isArray(state.records)) {
+          const { records, ...rest } = state;
+          return {
+            ...rest,
+            records: Object.fromEntries(records.map((r) => [`${r.collection}/${r.id}`, r]))
+          };
+        }
+        if (state && typeof state === "object" && !Array.isArray(state))
+          return Object.fromEntries(Object.entries(state).map(([k, v]) => [k, normalize(v)]));
+        return state;
+      };
+      walk(ns, service, "/state", normalize(x?.state), normalize(y?.state));
+    }
+  }
+  return { format: "mockingbird.fleet-diff/v1", total, truncated: total > changes.length, changes };
+}
+
+// ../../adapters/node/dist/fleet-bindings.js
+var object = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+async function planRestoreBindings(input, plan, resolveSecret) {
+  const source = validateArchive(input), copy = structuredClone(source);
+  if (!plan || !Array.isArray(plan.bindings) || !object(plan.endpoints))
+    throw new Error("expected explicit restore bindings and endpoint references");
+  const changes = [];
+  const seen = /* @__PURE__ */ new Set();
+  const endpoint = (reference) => {
+    const value = plan.endpoints[reference];
+    if (typeof value !== "string")
+      throw new Error(`unresolved endpoint reference ${reference}`);
+    const url = new URL(value);
+    if (!["http:", "https:"].includes(url.protocol) || url.username || url.password)
+      throw new Error(`invalid endpoint reference ${reference}`);
+    return url.href;
+  };
+  for (const binding of plan.bindings) {
+    const identity = `${binding.namespace}/${binding.service}/${binding.endpointId}`;
+    if (seen.has(identity))
+      throw new Error(`ambiguous binding ${identity}`);
+    seen.add(identity);
+    const section = copy.namespaces[binding.namespace]?.services[binding.service];
+    if (section?.protocol !== "http" || !object(section.state) || !object(section.state.webhooks) || !Array.isArray(section.state.webhooks.endpoints))
+      throw new Error(`unsupported callback binding ${identity}`);
+    const hub = section.state.webhooks;
+    const matches = hub.endpoints.filter((e) => object(e) && e.id === binding.endpointId);
+    if (matches.length !== 1)
+      throw new Error(`unresolved or ambiguous endpoint ${identity}`);
+    const current = matches[0], old = String(current.url), destination2 = endpoint(binding.endpointRef);
+    if (current.signUrl !== void 0 && binding.signing === void 0)
+      throw new Error(`signing policy required for ${identity}`);
+    if (binding.signing !== void 0 && !["preserve", "replace"].includes(binding.signing))
+      throw new Error(`unsupported signing policy ${identity}`);
+    const signUrl = binding.signing === "replace" ? endpoint(binding.signingRef ?? binding.endpointRef) : current.signUrl;
+    let secret;
+    if (binding.secretRef !== void 0) {
+      if (!resolveSecret)
+        throw new Error(`unresolved secret reference ${binding.secretRef}`);
+      try {
+        secret = await resolveSecret(binding.secretRef);
+        if (typeof secret !== "string" || !secret)
+          throw new Error();
+      } catch {
+        throw new Error(`unresolved secret reference ${binding.secretRef}`);
+      }
+    }
+    const apply = (value) => {
+      value.url = destination2;
+      if (signUrl !== void 0)
+        value.signUrl = signUrl;
+      if (secret !== void 0)
+        value.secret = secret;
+    };
+    apply(current);
+    if (Array.isArray(hub.payloads)) {
+      for (const pair of hub.payloads)
+        if (Array.isArray(pair) && object(pair[1]) && object(pair[1].endpoint) && pair[1].endpoint.id === binding.endpointId)
+          apply(pair[1].endpoint);
+    }
+    if (Array.isArray(hub.deliveries)) {
+      for (const pair of hub.deliveries)
+        if (Array.isArray(pair) && object(pair[1]) && pair[1].endpointId === binding.endpointId)
+          pair[1].url = destination2;
+    }
+    if (Array.isArray(section.state.records)) {
+      for (const row of section.state.records)
+        if (object(row) && row.collection === "runtime_webhook_endpoints" && object(row.value) && row.value.id === binding.endpointId)
+          apply(row.value);
+    }
+    changes.push({
+      namespace: binding.namespace,
+      service: binding.service,
+      endpointId: binding.endpointId,
+      endpointRef: binding.endpointRef,
+      ...binding.secretRef ? { secretRef: binding.secretRef } : {},
+      previousFingerprint: digest(old),
+      destinationFingerprint: digest(destination2),
+      signing: binding.signing ?? "not-configured"
+    });
+  }
+  const { sha256: _sha, ...content } = copy;
+  return {
+    report: {
+      version: 1,
+      source: source.sha256,
+      changes,
+      limitations: [
+        "opaque payloads, tokens, issuer material and application URLs are unchanged",
+        "protocol key rebinding requires a registered participant transformation"
+      ]
+    },
+    archive: sealArchive(content)
+  };
+}
+var rebaseArchiveNamespace = (input, source, destination2) => {
+  const archive = validateArchive(input);
+  if (!/^[A-Za-z0-9_.-]{1,64}$/.test(destination2) || !archive.namespaces[source])
+    throw new Error("invalid namespace fork");
+  const { sha256: _sha, ...content } = archive;
+  return sealArchive({
+    ...content,
+    namespaces: { [destination2]: structuredClone(archive.namespaces[source]) }
+  });
+};
+
+// ../../adapters/node/dist/fleet-instrumentation.js
 import { randomUUID } from "node:crypto";
-import { chmod, readFile, rename, rm, writeFile } from "node:fs/promises";
+var FleetInstrumentation = class {
+  options;
+  auditEntries = [];
+  started = /* @__PURE__ */ new Map();
+  terminal = /* @__PURE__ */ new Set();
+  metrics = {
+    started: 0,
+    succeeded: 0,
+    failed: 0,
+    cancelled: 0,
+    recoveryRequired: 0,
+    phaseEvents: 0,
+    auditFailures: 0,
+    rollbackAttempts: 0,
+    rollbackFailures: 0,
+    telemetryFailures: 0,
+    durationsMs: { count: 0, sum: 0, max: 0 }
+  };
+  constructor(options = {}) {
+    this.options = options;
+  }
+  async audit(input) {
+    const event = { ...input, id: randomUUID(), timestamp: (/* @__PURE__ */ new Date()).toISOString() };
+    let accepted = true;
+    try {
+      if (this.options.audit) {
+        await this.options.audit.write(event);
+        event.durable = true;
+      } else
+        event.durable = false;
+    } catch {
+      this.metrics.auditFailures++;
+      event.durable = false;
+      accepted = this.options.audit?.failurePolicy !== "closed";
+    }
+    this.auditEntries.push(event);
+    if (this.auditEntries.length > 200)
+      this.auditEntries.shift();
+    return accepted;
+  }
+  phase(operation, recoveryRequired) {
+    if (!this.started.has(operation.id)) {
+      this.started.set(operation.id, performance.now());
+      this.metrics.started++;
+    }
+    const elapsedMs = Math.max(0, performance.now() - this.started.get(operation.id));
+    this.metrics.phaseEvents++;
+    if (operation.phase === "rolling-back")
+      this.metrics.rollbackAttempts++;
+    if (operation.phase === "rollback-failed")
+      this.metrics.rollbackFailures++;
+    if (operation.status !== "running" && !this.terminal.has(operation.id)) {
+      this.terminal.add(operation.id);
+      if (operation.status === "succeeded")
+        this.metrics.succeeded++;
+      else if (operation.status === "cancelled")
+        this.metrics.cancelled++;
+      else
+        this.metrics.failed++;
+      if (recoveryRequired)
+        this.metrics.recoveryRequired++;
+      this.metrics.durationsMs.count++;
+      this.metrics.durationsMs.sum += elapsedMs;
+      this.metrics.durationsMs.max = Math.max(this.metrics.durationsMs.max, elapsedMs);
+    }
+    const action = operation.action.replace(/\/namespaces\/[^/]+/g, "/namespaces/{namespace}").replace(/\/snapshots\/[^/]+/g, "/snapshots/{id}").replace(/\/scenarios\/[^/]+/g, "/scenarios/{name}");
+    try {
+      const sent = this.options.telemetry?.({
+        ...operation.participant ? { participant: operation.participant } : {},
+        operationId: operation.id,
+        phase: operation.phase,
+        action,
+        services: operation.services ?? [],
+        status: operation.status,
+        elapsedMs,
+        recoveryRequired
+      });
+      if (sent)
+        void sent.catch(() => {
+          this.metrics.telemetryFailures++;
+        });
+    } catch {
+      this.metrics.telemetryFailures++;
+    }
+    while (this.started.size > 200) {
+      const id = this.started.keys().next().value;
+      this.started.delete(id);
+      this.terminal.delete(id);
+    }
+  }
+  snapshot() {
+    return {
+      version: 1,
+      metrics: structuredClone(this.metrics),
+      cardinality: "aggregate-no-namespace-labels"
+    };
+  }
+  auditTrail() {
+    return {
+      version: 1,
+      entries: structuredClone(this.auditEntries),
+      retention: 200,
+      durableSink: Boolean(this.options.audit),
+      failurePolicy: this.options.audit?.failurePolicy ?? "memory-only"
+    };
+  }
+};
+
+// ../../adapters/node/dist/fleet-journal.js
+import { mkdir, readdir } from "node:fs/promises";
+import { join } from "node:path";
+var validate = (record) => {
+  if (record?.version !== 1 || !Number.isSafeInteger(record.revision) || record.revision < 1 || !/^[a-f0-9-]{36}$/.test(record.operationId) || !Array.isArray(record.scope) || record.scope.length > 1e3 || record.scope.some((ns) => !/^[A-Za-z0-9_.-]{1,64}$/.test(ns)) || ![
+    "prepared",
+    "committing",
+    "uploading",
+    "publishing",
+    "succeeded",
+    "failed",
+    "recovery-required",
+    "resolved"
+  ].includes(record.phase) || [record.before, record.after].some((id) => id !== void 0 && !/^[a-f0-9]{64}$/.test(id)) || Object.keys(record).some((key) => ![
+    "version",
+    "revision",
+    "operationId",
+    "controller",
+    "namespace",
+    "scope",
+    "action",
+    "phase",
+    "timestamp",
+    "requestFingerprint",
+    "before",
+    "after",
+    "writerGeneration",
+    "resolution"
+  ].includes(key)))
+    throw new Error("invalid durable operation metadata");
+};
+async function reconcileOperation(record, repository) {
+  validate(record);
+  if (["succeeded", "failed", "resolved"].includes(record.phase))
+    return { status: "terminal", operationId: record.operationId };
+  if (record.phase === "prepared")
+    return { status: "abandoned-before-commit", operationId: record.operationId };
+  if (record.after) {
+    try {
+      const archive = await repository.get(record.after), publication = await repository.publicationMetadata?.();
+      if (archive.sha256 === record.after && publication?.id === record.after && record.writerGeneration !== void 0 && publication.generation === record.writerGeneration)
+        return {
+          status: "verified-publication",
+          operationId: record.operationId,
+          archive: record.after
+        };
+    } catch {
+    }
+  }
+  if (record.before)
+    try {
+      await repository.get(record.before);
+    } catch {
+      return {
+        status: "recovery-required",
+        operationId: record.operationId,
+        reason: "before-state archive unavailable",
+        scope: record.scope
+      };
+    }
+  return {
+    status: "recovery-required",
+    operationId: record.operationId,
+    reason: "commit or rollback cannot be proven",
+    scope: record.scope
+  };
+}
+
+// ../../adapters/node/dist/fleet-observations.js
+import { createHash as createHash2, randomUUID as randomUUID2 } from "node:crypto";
+var hash = (text) => createHash2("sha256").update(text).digest("hex");
+var boundedText = async (stream, max) => {
+  if (!stream)
+    return "";
+  const reader = stream.getReader(), chunks = [];
+  let bytes = 0, timedOut = false;
+  const timer = setTimeout(() => {
+    timedOut = true;
+    void reader.cancel().catch(() => {
+    });
+  }, 100);
+  try {
+    for (; ; ) {
+      const result = await reader.read();
+      if (result.done)
+        break;
+      bytes += result.value.length;
+      if (bytes > max)
+        throw new Error("capture byte limit");
+      chunks.push(result.value);
+    }
+    if (timedOut)
+      throw new Error("capture deadline");
+    return Buffer.concat(chunks).toString("utf8");
+  } finally {
+    clearTimeout(timer);
+    void reader.cancel().catch(() => {
+    });
+    reader.releaseLock();
+  }
+};
+var FleetObservations = class {
+  processId;
+  limits;
+  sequence = 0;
+  entries = [];
+  baselines = /* @__PURE__ */ new Map();
+  traces = /* @__PURE__ */ new Map();
+  constructor(processId, limits = { events: 500, traceEvents: 200, traceBytes: 1024 * 1024 }) {
+    this.processId = processId;
+    this.limits = limits;
+  }
+  record(event) {
+    this.entries.push({ ...event, id: ++this.sequence });
+    if (this.entries.length > this.limits.events)
+      this.entries.shift();
+  }
+  baseline(namespace, services) {
+    const id = randomUUID2();
+    this.baselines.set(id, { namespace, services, sequence: this.sequence });
+    while (this.baselines.size > 200)
+      this.baselines.delete(this.baselines.keys().next().value);
+    return { id, namespace, services, sequence: this.sequence };
+  }
+  assertClean(id, namespace, diagnostics, options = {}) {
+    const baseline = this.baselines.get(id);
+    if (!baseline || baseline.namespace !== namespace)
+      throw new Error("assertion baseline not found in this namespace");
+    const allowances = options.allowances ?? [];
+    if (!Array.isArray(allowances) || allowances.some((a) => !["unmatched", "rejected", "fault"].includes(a.kind) || !a.service || !a.pathFingerprint && !a.operationId || !Number.isSafeInteger(a.maxCount) || a.maxCount < 1))
+      throw new Error("allowances must identify a service and exact operation or path fingerprint with a bounded count");
+    const consumed = /* @__PURE__ */ new Map(), failures = [];
+    if (this.entries.length && baseline.sequence < (this.entries[0]?.id ?? 0) - 1)
+      failures.push({ kind: "evidence_truncated" });
+    for (const entry of this.entries) {
+      if (entry.id <= baseline.sequence || entry.namespace !== namespace || !baseline.services.includes(entry.service))
+        continue;
+      const kinds = entry.kind === "webhook" ? entry.deliveryState === "failed" || entry.deliveryState === "dropped" ? ["failed_delivery"] : [] : entry.fault ? ["fault"] : entry.unmatched ? ["unmatched"] : (entry.status ?? 0) >= 400 ? ["rejected"] : [];
+      for (const kind of kinds) {
+        const allowed = allowances.find((a) => a.kind === kind && a.service === entry.service && (!a.pathFingerprint || a.pathFingerprint === entry.pathFingerprint) && (!a.operationId || a.operationId === entry.operationId) && (a.status === void 0 || a.status === entry.status) && (consumed.get(a) ?? 0) < a.maxCount);
+        if (allowed)
+          consumed.set(allowed, (consumed.get(allowed) ?? 0) + 1);
+        else
+          failures.push({
+            kind,
+            service: entry.service,
+            method: entry.method,
+            pathFingerprint: entry.pathFingerprint,
+            operationId: entry.operationId,
+            status: entry.status,
+            journalReference: entry.id
+          });
+      }
+    }
+    for (const service of baseline.services) {
+      const d = diagnostics[service];
+      if (!d)
+        throw new Error(`missing assertion diagnostics for ${service}`);
+      if (d.activeRequests + d.activeConnections + d.blockedCommands + d.pendingWebhooks + (d.activeJobs ?? 0) > 0 || !options.allowCheckpointablePending && d.pendingJobs > 0)
+        failures.push({ kind: "leftover_work", service, diagnostics: d });
+    }
+    return {
+      format: "mockingbird.assertions/v1",
+      clean: failures.length === 0,
+      namespace,
+      baseline: id,
+      failures: failures.slice(0, 100),
+      truncated: failures.length > 100,
+      inspectedThrough: this.sequence
+    };
+  }
+  startTrace(namespace, input, includeBodies = false, limitations = []) {
+    const baseline = validateArchive(input);
+    if (!baseline.namespaces[namespace])
+      throw new Error("trace baseline lacks selected namespace");
+    if (Buffer.byteLength(JSON.stringify(baseline)) > 8 * 1024 * 1024)
+      throw new Error("trace baseline exceeds 8 MiB limit");
+    if (this.traces.size >= 4 && !this.traces.has(namespace))
+      throw new Error("trace capacity reached");
+    const artifact = {
+      format: "mockingbird.trace/v1",
+      sourceProcess: this.processId,
+      namespace,
+      baseline: structuredClone(baseline),
+      events: [],
+      limitations: [...limitations],
+      truncated: false,
+      active: true
+    };
+    this.traces.set(namespace, { artifact, includeBodies, bytes: 0, inFlight: 0, next: 0 });
+    return structuredClone(artifact);
+  }
+  limitation(artifact, limitation) {
+    if (!artifact.limitations.includes(limitation))
+      artifact.limitations.push(limitation);
+  }
+  beginHTTP(namespace, service, request, logicalPath) {
+    const trace = this.traces.get(namespace);
+    if (!trace?.artifact.active)
+      return void 0;
+    const url = new URL(request.url), omitted = [];
+    if (logicalPath)
+      url.pathname = logicalPath;
+    for (const key of [...url.searchParams.keys()])
+      if (/(token|key|password|secret|signature|credential)/i.test(key)) {
+        url.searchParams.set(key, "[redacted]");
+        omitted.push("sensitive query fields redacted");
+      }
+    if ([...request.headers.keys()].some((h) => /authorization|api-key|token|secret|cookie/i.test(h)))
+      omitted.push("credential headers require explicit replay bindings");
+    const event = {
+      sequence: ++trace.next,
+      kind: "http",
+      service,
+      method: request.method,
+      path: `${url.pathname}${url.search}`,
+      contentType: request.headers.get("content-type") ?? "",
+      omitted
+    };
+    if (trace.inFlight++)
+      this.limitation(trace.artifact, "concurrent interactions are not certified for serial replay");
+    let body = Promise.resolve({ omitted: [] });
+    if (request.body) {
+      if (!trace.includeBodies)
+        body = Promise.resolve({ omitted: ["request body omitted"] });
+      else {
+        body = (async () => {
+          let timeout;
+          try {
+            let text = await Promise.race([
+              boundedText(request.clone().body, 65536),
+              new Promise((_, reject) => {
+                timeout = setTimeout(() => reject(new Error("capture deadline")), 100);
+              })
+            ]);
+            const removed = [];
+            if (event.contentType?.includes("json")) {
+              text = JSON.stringify(JSON.parse(text), (key, value) => {
+                if (/(token|password|secret|credential|authorization|api.?key)/i.test(key)) {
+                  removed.push("sensitive JSON body fields redacted");
+                  return "[redacted]";
+                }
+                return value;
+              });
+            } else if (event.contentType?.includes("x-www-form-urlencoded")) {
+              const form = new URLSearchParams(text);
+              for (const key of [...form.keys()])
+                if (/(token|password|secret|credential|api.?key)/i.test(key)) {
+                  form.set(key, "[redacted]");
+                  removed.push("sensitive form fields redacted");
+                }
+              text = form.toString();
+            }
+            return { text, omitted: removed };
+          } catch {
+            return { omitted: ["request body capture truncated or unavailable"] };
+          } finally {
+            clearTimeout(timeout);
+          }
+        })();
+      }
+    }
+    return { artifact: trace.artifact, event, body };
+  }
+  async finishHTTP(token, response) {
+    if (!token)
+      return;
+    const trace = this.traces.get(token.artifact.namespace);
+    if (!trace || trace.artifact !== token.artifact)
+      return;
+    const captured = await token.body;
+    token.event.status = response.status;
+    token.event.omitted.push(...captured.omitted);
+    if (captured.text !== void 0)
+      token.event.body = captured.text;
+    if (response.headers.get("content-type")?.includes("text/event-stream"))
+      token.event.omitted.push("streaming responses are unsupported");
+    else {
+      try {
+        const text = await boundedText(response.clone().body, 65536);
+        token.event.responseHash = hash(text);
+      } catch {
+        token.event.omitted.push("response hash unavailable or truncated");
+      }
+    }
+    trace.inFlight--;
+    for (const omitted of token.event.omitted)
+      this.limitation(trace.artifact, omitted);
+    this.append(trace, token.event);
+  }
+  append(trace, event) {
+    const bytes = Buffer.byteLength(JSON.stringify(event));
+    if (trace.artifact.events.length >= this.limits.traceEvents || trace.bytes + bytes > this.limits.traceBytes) {
+      trace.artifact.truncated = true;
+      trace.artifact.active = false;
+      this.limitation(trace.artifact, "recording limits reached");
+      return;
+    }
+    trace.bytes += bytes;
+    trace.artifact.events.push(event);
+    trace.artifact.events.sort((a, b) => a.sequence - b.sequence);
+  }
+  unsupportedControl(namespace, action) {
+    const trace = this.traces.get(namespace);
+    if (trace?.artifact.active)
+      this.limitation(trace.artifact, `control not replayable: ${action}`);
+  }
+  control(namespace, action, controls) {
+    const trace = this.traces.get(namespace);
+    if (trace?.artifact.active)
+      this.append(trace, {
+        sequence: ++trace.next,
+        kind: "control",
+        action,
+        controls: structuredClone(controls),
+        omitted: []
+      });
+  }
+  trace(namespace, stop = false) {
+    const trace = this.traces.get(namespace);
+    if (!trace)
+      throw new Error("trace not started");
+    if (stop)
+      trace.artifact.active = false;
+    if (trace.inFlight)
+      this.limitation(trace.artifact, "requests still in flight when inspected");
+    return structuredClone(trace.artifact);
+  }
+};
+
+// ../../adapters/node/dist/fleet-proxy.js
+var ingressSupport = {
+  stripe: {
+    publicOrigin: true,
+    pathPrefix: true,
+    namespaces: "path-or-header",
+    streaming: true,
+    signing: "vendor request signing is not used; webhook signatures remain payload based"
+  },
+  other: {
+    publicOrigin: false,
+    reason: "host/path-sensitive signing and hosted URL rewriting are not certified; use a direct endpoint"
+  }
+};
+function advertisedHttpBase(entry) {
+  if (entry.publicPath !== void 0 && !entry.publicOrigin)
+    throw new Error("publicPath requires publicOrigin");
+  if (!entry.publicOrigin)
+    return void 0;
+  const url = new URL(entry.publicOrigin);
+  if (!["http:", "https:"].includes(url.protocol) || url.username || url.password || url.pathname !== "/" || url.search || url.hash)
+    throw new Error("publicOrigin must be an HTTP(S) origin without credentials or a path");
+  const prefix = entry.publicPath ?? "";
+  if (prefix && (!/^\/(?:[A-Za-z0-9_-]+\/?)*$/.test(prefix) || prefix.endsWith("/")))
+    throw new Error("publicPath must be a canonical path prefix without a trailing slash");
+  return `${url.origin}${prefix}`;
+}
+
+// ../../adapters/node/dist/fleet-time.js
+var FleetTimeController = class {
+  context;
+  constructor(context) {
+    this.context = context;
+  }
+  async run(namespace, selected, body, single) {
+    const condition = body.condition ?? "no-events", maxEvents = single ? 1 : body.maxEvents ?? 100, maxAdvanceMs = body.maxAdvanceMs ?? 864e5, timeoutMs = body.timeoutMs ?? 5e3;
+    if (!["no-events", "idle", "checkpoint-ready"].includes(String(condition)) || typeof maxEvents !== "number" || !Number.isSafeInteger(maxEvents) || maxEvents < 1 || maxEvents > 1e4 || typeof maxAdvanceMs !== "number" || !Number.isFinite(maxAdvanceMs) || maxAdvanceMs < 0 || typeof timeoutMs !== "number" || !Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 3e4)
+      throw new Error("invalid bounded time-control condition or budgets");
+    const unsupported = [...selected].filter(([, child]) => !child.nextEvent).map(([name]) => name);
+    if (unsupported.length)
+      throw new Error(`next-event inspection unsupported for ${unsupported.join(", ")}`);
+    const clocks = [...selected.values()].map((child) => child.clock(namespace).state());
+    if (clocks.some((clock) => !clock.frozen || clock.now !== clocks[0]?.now))
+      throw new Error("freeze and align selected participant clocks before event stepping");
+    const start2 = clocks[0]?.now ?? this.context.clock(namespace).now(), deadline = Date.now() + timeoutMs;
+    const steps = [];
+    const diagnostics = () => Object.fromEntries([...selected].map(([name, child]) => [name, child.diagnostics(namespace)]));
+    const bounded = async (promise) => {
+      let timer;
+      try {
+        return await Promise.race([
+          promise,
+          new Promise((_, reject) => {
+            timer = setTimeout(() => reject(Object.assign(new Error("time-control host budget exceeded; recovery may be required"), { code: "MOCKINGBIRD_WORKLOAD_UNCERTAIN" })), Math.max(1, deadline - Date.now()));
+          })
+        ]);
+      } finally {
+        clearTimeout(timer);
+      }
+    };
+    for (; ; ) {
+      const due = await bounded(Promise.all([...selected].map(async ([name, child]) => [name, await child.nextEvent?.(namespace)])));
+      if (due.some(([, time]) => time !== void 0 && !Number.isFinite(time)))
+        throw new Error("participant returned an invalid event time");
+      const services = diagnostics(), states = Object.values(services);
+      const ready = condition === "checkpoint-ready" ? states.every((d) => d.activeRequests + d.blockedCommands + d.pendingWebhooks + (d.activeJobs ?? 0) === 0) : condition === "idle" ? states.every((d) => d.activeRequests + d.blockedCommands + d.pendingWebhooks + d.pendingJobs === 0) : due.every(([, time]) => time === void 0);
+      if (!single && ready)
+        return Response.json({ status: "settled", namespace, condition, steps, services });
+      const times = due.flatMap(([, time]) => time === void 0 ? [] : [time]);
+      if (!times.length)
+        return Response.json({
+          status: "no-events",
+          namespace,
+          condition,
+          settled: ready,
+          steps,
+          services
+        });
+      const current = [...selected.values()][0]?.clock(namespace).now() ?? start2, target = Math.max(current, Math.min(...times));
+      if (Date.now() >= deadline || steps.length >= maxEvents || target - start2 > maxAdvanceMs)
+        return Response.json({ status: "budget-exhausted", namespace, condition, steps, services }, { status: 409 });
+      const signal = AbortSignal.timeout(Math.max(1, deadline - Date.now()));
+      const response = await this.context.transaction(namespace, selected, async (_name, child) => {
+        child.clock(namespace).set(target);
+        if (child.settle)
+          await bounded(child.settle(namespace, signal));
+      });
+      if (!response.ok)
+        return response;
+      this.context.clock(namespace).freeze();
+      this.context.clock(namespace).set(target);
+      try {
+        if (this.context.synchronize)
+          await bounded(this.context.synchronize({
+            namespace,
+            services: [...selected.keys()],
+            now: target,
+            signal
+          }));
+      } catch (error) {
+        const fences = [];
+        for (const child of selected.values())
+          try {
+            fences.push(child.lock(namespace));
+          } catch {
+          }
+        this.context.recovery.set(namespace, fences);
+        throw error;
+      }
+      const processed = due.filter(([, time]) => time !== void 0 && time <= target).map(([name]) => name);
+      steps.push({ now: target, processed });
+      this.context.phase(namespace, "stepping", steps.length, steps.length);
+      if (single)
+        return Response.json({
+          status: "stepped",
+          namespace,
+          steps,
+          services: diagnostics(),
+          clientClockSynchronization: this.context.synchronize ? "hook-invoked" : "external worker clocks are unchanged"
+        });
+    }
+  }
+};
+
+// ../../adapters/node/dist/fleet-management.js
+var object2 = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+var fleetError = (status, message, extra = {}) => Response.json({
+  ...extra,
+  error: {
+    type: "mockingbird_admin",
+    code: {
+      400: "invalid_request",
+      401: "unauthorized",
+      403: "forbidden",
+      404: "not_found",
+      409: "conflict",
+      413: "too_large",
+      429: "quota_exceeded",
+      500: "operation_failed",
+      503: "unavailable"
+    }[status] ?? "request_failed",
+    message
+  }
+}, { status });
+var checked = (body, keys) => {
+  const unknown = Object.keys(body).filter((k) => !keys.includes(k));
+  if (unknown.length)
+    throw new Error(`unknown fields: ${unknown.join(", ")}`);
+};
+var namePattern = /^[A-Za-z0-9_.-]{1,64}$/;
+var FleetManagement = class {
+  ctx;
+  operationContext = new AsyncLocalStorage();
+  interrupted = /* @__PURE__ */ new Map();
+  durable = /* @__PURE__ */ new Map();
+  async recoverOperations() {
+    if (!this.ctx.options.journal)
+      return;
+    if (!this.ctx.options.repository)
+      throw new Error("durable journal requires a portable archive repository");
+    let records;
+    try {
+      records = await this.ctx.options.journal.load();
+    } catch {
+      throw new Error("durable operation journal unavailable");
+    }
+    for (const record of records) {
+      const decision = await reconcileOperation(record, this.ctx.options.repository);
+      if (decision.status === "terminal")
+        continue;
+      if (decision.status === "abandoned-before-commit" || decision.status === "verified-publication") {
+        if (decision.status === "verified-publication")
+          await this.restoreArchive(await this.ctx.options.repository.get(decision.archive));
+        await this.ctx.options.journal.write({
+          ...record,
+          revision: record.revision + 1,
+          phase: "resolved",
+          resolution: decision.status,
+          timestamp: (/* @__PURE__ */ new Date()).toISOString()
+        });
+        continue;
+      }
+      this.interrupted.set(record.operationId, record);
+      for (const namespace of record.scope) {
+        if (!this.namespaces.has(namespace)) {
+          const result = await this.createNamespace(namespace);
+          if (!result.ok)
+            throw new Error("cannot prepare interrupted namespace for recovery");
+        }
+        if (this.ctx.recovery.has(namespace))
+          continue;
+        const releases = [];
+        for (const child of this.ctx.children.values())
+          try {
+            releases.push(child.lock(namespace));
+          } catch {
+          }
+        this.ctx.recovery.set(namespace, releases);
+      }
+    }
+  }
+  fenceNamespaces(scope) {
+    for (const namespace of scope) {
+      const releases = this.ctx.recovery.get(namespace) ?? [];
+      for (const child of this.ctx.children.values())
+        try {
+          releases.push(child.lock(namespace));
+        } catch {
+        }
+      this.ctx.recovery.set(namespace, releases);
+    }
+  }
+  async journalPhase(operationId, phase, extra = {}) {
+    const current = this.durable.get(operationId);
+    if (!current || !this.ctx.options.journal)
+      return;
+    const next = {
+      ...current,
+      ...extra,
+      revision: current.revision + 1,
+      phase,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    await this.ctx.options.journal.write(next);
+    this.durable.set(operationId, next);
+  }
+  observations;
+  requestPath(service, request) {
+    const prefix = this.ctx.config.services[service]?.adminPrefix ?? this.ctx.config.adminPrefix ?? "/__admin";
+    let path = new URL(request.url).pathname;
+    if (path.startsWith(`${prefix}/ns/`)) {
+      const tail = path.slice(`${prefix}/ns/`.length), slash = tail.indexOf("/");
+      path = slash < 0 ? "/" : tail.slice(slash);
+    }
+    return { path, admin: path === prefix || path.startsWith(`${prefix}/`) };
+  }
+  beginRequest(service, namespace, request) {
+    const route = this.requestPath(service, request);
+    return route.admin ? void 0 : this.observations.beginHTTP(namespace, service, request, route.path);
+  }
+  async finishRequest(service, namespace, _request, response, log, token) {
+    if (this.requestPath(service, _request).admin)
+      return;
+    const pathFingerprint = createHash3("sha256").update(log.path).digest("hex");
+    this.observations.record({
+      namespace,
+      service,
+      kind: "http",
+      method: log.method,
+      pathFingerprint,
+      status: log.status,
+      unmatched: log.unmatched,
+      fault: log.faultId !== void 0,
+      ...log.operationId ? { operationId: log.operationId } : {}
+    });
+    await this.observations.finishHTTP(token, response);
+  }
+  observeDelivery(service, event) {
+    this.observations.record({
+      namespace: event.namespace,
+      service,
+      kind: "webhook",
+      deliveryState: event.state
+    });
+  }
+  instrumentation;
+  initializationToken = randomBytes(32).toString("base64url");
+  environmentContext = new AsyncLocalStorage();
+  environment;
+  ownsEnvironment() {
+    return this.environment !== void 0 && this.environmentContext.getStore() === this.environment.id;
+  }
+  topologyBusy(namespace) {
+    return this.topology.has(namespace) || this.environment !== void 0 && !this.ownsEnvironment();
+  }
+  environmentFence(namespace, service) {
+    return this.ownsEnvironment() && this.environment?.fences.get(namespace)?.has(service) === true;
+  }
+  checkCancelled(namespace) {
+    const id = this.operationId(namespace);
+    if (id && this.aborts.get(id)?.signal.aborted)
+      throw new Error("operation cancelled before commit");
+  }
+  activeOperation(namespace) {
+    const current = this.operationContext.getStore();
+    return current?.status === "running" ? current : [...this.operations.values()].find((operation) => operation.namespace === namespace && operation.status === "running");
+  }
+  operationId(namespace) {
+    return this.activeOperation(namespace)?.id;
+  }
+  async withEnvironment(namespaces, selected, run) {
+    if (this.ownsEnvironment())
+      return run();
+    if (this.environment || this.ctx.controlling.size || this.topology.size)
+      throw new Error("environment operation conflicts with active namespace work");
+    const env = { id: randomUUID3(), fences: /* @__PURE__ */ new Map() };
+    this.environment = env;
+    return this.environmentContext.run(env.id, async () => {
+      try {
+        for (const ns of namespaces) {
+          if (!this.namespaces.has(ns))
+            continue;
+          await this.hook("prepare", ns, selected);
+          const fences = /* @__PURE__ */ new Map();
+          env.fences.set(ns, fences);
+          for (const [name, child] of selected) {
+            if (child.protocol !== "http" && !Object.hasOwn(child.namespaces.endpoints ?? {}, ns))
+              continue;
+            if (this.ctx.recovery.has(ns))
+              continue;
+            fences.set(name, child.lock(ns));
+          }
+          if (this.busy(ns, selected).length)
+            throw new Error(`namespace ${ns} is not quiescent`);
+        }
+        return await run();
+      } finally {
+        for (const [ns, fences] of env.fences) {
+          if (this.ctx.recovery.has(ns))
+            this.ctx.recovery.get(ns)?.push(...fences.values());
+          else
+            for (const unlock of [...fences.values()].reverse())
+              unlock();
+        }
+        this.environment = void 0;
+      }
+    });
+  }
+  operations = /* @__PURE__ */ new Map();
+  namespaces = /* @__PURE__ */ new Map();
+  credentials = /* @__PURE__ */ new Map();
+  retries = /* @__PURE__ */ new Map();
+  events = [];
+  subscribers = /* @__PURE__ */ new Set();
+  aborts = /* @__PURE__ */ new Map();
+  topology = /* @__PURE__ */ new Set();
+  privateRequests = /* @__PURE__ */ new Map();
+  privateRequest(namespace, request) {
+    const token = request.headers.get("x-mockingbird-initializer");
+    return token !== null && (this.privateRequests.get(namespace) === token || this.lifecycle === "initializing" && token === this.initializationToken);
+  }
+  sequence = 0;
+  timer;
+  expiryTimer;
+  backupRunning = false;
+  backupStatus = {};
+  lifecycle = "starting";
+  constructor(ctx) {
+    this.ctx = ctx;
+    this.instrumentation = new FleetInstrumentation(ctx.options);
+    this.observations = new FleetObservations(ctx.id);
+    this.remember("default");
+    for (const child of ctx.children.values())
+      for (const ns of Object.keys(child.namespaces.endpoints ?? {}))
+        this.remember(ns);
+    for (const value of Object.values(ctx.options.limits ?? {}))
+      if (!Number.isSafeInteger(value) || value < 0)
+        throw new Error("limits must be nonnegative integers");
+    for (const child of ctx.children.values())
+      child.setAdmission?.((namespace) => {
+        const entry = this.namespaces.get(namespace);
+        if (entry)
+          entry.activityAt = Date.now();
+        if (this.lifecycle === "initializing" || this.lifecycle === "draining" || this.lifecycle === "failed" || this.environment || this.topology.has(namespace) || this.ctx.recovery.has(namespace))
+          return false;
+        const limit = this.ctx.options.limits?.connections;
+        if (limit === void 0)
+          return true;
+        let connections = 0;
+        for (const c of ctx.children.values()) {
+          if (c.protocol !== "http" && !Object.hasOwn(c.namespaces.endpoints ?? {}, namespace))
+            continue;
+          const d = c.diagnostics(namespace);
+          connections += d.activeConnections + (c.protocol === "http" ? d.activeRequests : 0);
+        }
+        return connections < limit;
+      });
+    const retention = ctx.options.retention;
+    if (retention?.maxCount !== void 0 && (!Number.isSafeInteger(retention.maxCount) || retention.maxCount < 1))
+      throw new Error("retention maxCount must be positive");
+    if (retention?.ttlMs !== void 0 && (!Number.isFinite(retention.ttlMs) || retention.ttlMs < 1))
+      throw new Error("retention ttlMs must be positive");
+  }
+  remember(namespace) {
+    if (!this.namespaces.has(namespace))
+      this.namespaces.set(namespace, {
+        generation: randomUUID3(),
+        createdAt: Date.now(),
+        activityAt: Date.now(),
+        pinned: false
+      });
+    return this.namespaces.get(namespace);
+  }
+  generation(namespace) {
+    return this.remember(namespace).generation;
+  }
+  admit(namespace, request) {
+    if (this.privateRequest(namespace, request))
+      return void 0;
+    if (this.topology.has(namespace) || this.environment)
+      return fleetError(409, "namespace lifecycle operation in progress", { namespace });
+    if (this.lifecycle === "initializing" && request.headers.get("x-mockingbird-initializer") === this.initializationToken)
+      return void 0;
+    if (this.lifecycle !== "ready" && this.lifecycle !== "starting")
+      return fleetError(503, `fleet is ${this.lifecycle}`);
+    if (!this.namespaces.has(namespace) && this.ctx.options.limits?.maxNamespaces !== void 0 && this.namespaces.size + this.topology.size >= this.ctx.options.limits.maxNamespaces)
+      return fleetError(429, "maximum namespaces reached");
+    const entry = this.remember(namespace);
+    entry.activityAt = Date.now();
+    const expected = request.headers.get("x-mockingbird-generation");
+    if (!["GET", "HEAD", "OPTIONS"].includes(request.method) && expected !== null && expected !== entry.generation)
+      return fleetError(409, "stale namespace generation", { generation: entry.generation });
+    const limits = this.ctx.options.limits;
+    if (limits)
+      for (const child of this.ctx.children.values()) {
+        if (child.protocol !== "http" && !Object.hasOwn(child.namespaces.endpoints ?? {}, namespace))
+          continue;
+        const usage = child.diagnostics(namespace);
+        if (limits.connections !== void 0 && usage.activeConnections + usage.activeRequests >= limits.connections)
+          return fleetError(429, "namespace admission quota reached", { namespace });
+      }
+    return void 0;
+  }
+  emit(operation) {
+    this.instrumentation.phase(operation, (operation.scope ?? [operation.namespace]).some((namespace) => this.ctx.recovery.has(namespace)));
+    const event = {
+      id: `${this.ctx.id}:${++this.sequence}`,
+      namespace: operation.namespace,
+      operation: structuredClone(operation)
+    };
+    this.events.push(event);
+    if (this.events.length > 500)
+      this.events.shift();
+    for (const sub of this.subscribers)
+      if (sub.namespace === operation.namespace) {
+        const data = sub.member ? {
+          id: event.id,
+          namespace: event.namespace,
+          operation: {
+            id: operation.id,
+            phase: operation.phase,
+            status: operation.status,
+            completed: operation.completed,
+            total: operation.total
+          }
+        } : event;
+        sub.push(`id: ${event.id}
+event: lifecycle
+data: ${JSON.stringify(data)}
+
+`);
+      }
+  }
+  phase(namespace, phase, completed, total, participant) {
+    const operation = this.activeOperation(namespace);
+    if (operation) {
+      operation.phase = phase;
+      if (participant)
+        operation.participant = participant;
+      else
+        delete operation.participant;
+      if (completed !== void 0)
+        operation.completed = completed;
+      if (total !== void 0)
+        operation.total = total;
+      this.emit(operation);
+    }
+  }
+  prune() {
+    const { maxCount = 50, ttlMs = 24 * 36e5 } = this.ctx.options.retention ?? {};
+    const entries = [...this.ctx.checkpoints];
+    for (const [id, point] of entries)
+      if (Date.now() - Date.parse(point.createdAt ?? (/* @__PURE__ */ new Date()).toISOString()) > ttlMs)
+        this.ctx.checkpoints.delete(id);
+    while (this.ctx.checkpoints.size > maxCount)
+      this.ctx.checkpoints.delete(this.ctx.checkpoints.keys().next().value);
+  }
+  select(body) {
+    if (body.services === void 0)
+      return this.ctx.children;
+    if (!Array.isArray(body.services) || !body.services.length || body.services.some((n) => typeof n !== "string" || !this.ctx.children.has(n)))
+      throw new Error("services must be a nonempty list of configured service names");
+    return new Map(body.services.map((n) => [n, this.ctx.children.get(n)]));
+  }
+  scope(namespace, selected) {
+    for (const [name, child] of selected)
+      if (child.protocol !== "http" && !Object.hasOwn(child.namespaces.endpoints ?? {}, namespace))
+        throw new Error(`namespace ${namespace} is not configured for ${name}`);
+  }
+  capability() {
+    return {
+      version: 1,
+      archiveFormat: "mockingbird.fleet/v1",
+      archiveProtection: this.ctx.options.archiveProtection?.policy ?? { format: "none" },
+      processId: this.ctx.id,
+      authentication: ["admin-key", "scoped-credential"],
+      scopes: ["namespace", "services", "environment"],
+      routes: [
+        ["GET", ""],
+        ["GET", "/namespaces"],
+        ["POST", "/namespaces/{namespace}/fork"],
+        ["GET", "/audit"],
+        ["GET", "/telemetry"],
+        ["GET", "/recovery"],
+        ["POST", "/recovery/{id}/rollback"],
+        ["POST", "/time/step-next"],
+        ["POST", "/time/run-until"],
+        ["POST", "/assertions/baseline"],
+        ["POST", "/assertions/{id}/check"],
+        ["POST", "/trace/start"],
+        ["POST", "/trace/stop"],
+        ["GET", "/trace"],
+        ["POST", "/archives/bindings"],
+        ["POST", "/namespaces/{namespace}"],
+        ["DELETE", "/namespaces/{namespace}"],
+        ["GET", "/namespaces/{namespace}/snapshots"],
+        ["POST", "/namespaces/{namespace}/snapshots"],
+        ["GET", "/namespaces/{namespace}/snapshots/{id}"],
+        ["DELETE", "/namespaces/{namespace}/snapshots/{id}"],
+        ["POST", "/namespaces/{namespace}/snapshots/{id}/restore"],
+        ["GET", "/metrics"],
+        ["GET", "/clock"],
+        ["POST", "/clock"],
+        ["POST", "/can-checkpoint"],
+        ["POST", "/wait-until-idle"],
+        ["POST", "/archives/export"],
+        ["POST", "/archives/import"],
+        ["POST", "/archives/inspect"],
+        ["POST", "/archives/diff"],
+        ["GET", "/operations"],
+        ["GET", "/operations/{id}"],
+        ["POST", "/operations/{id}/cancel"],
+        ["GET", "/events"],
+        ["POST", "/profiles/apply"],
+        ["POST", "/profiles/baseline"],
+        ["GET", "/scenarios"],
+        ["POST", "/scenarios/{name}/apply"],
+        ["GET", "/inspect"],
+        ["GET", "/diagnostics"],
+        ["POST", "/credentials"],
+        ["DELETE", "/credentials/{id}"],
+        ["POST", "/backups"],
+        ["GET", "/backups"],
+        ["GET", "/cleanup"],
+        ["POST", "/cleanup"],
+        ["POST", "/namespaces/{namespace}/policy"]
+      ].map(([method, path]) => ({ method, path })),
+      services: Object.fromEntries([...this.ctx.children].map(([name, c]) => [
+        name,
+        {
+          protocol: c.protocol,
+          coverage: c.coverage,
+          ingress: c.targetName === "stripe" ? ingressSupport.stripe : ingressSupport.other,
+          target: c.targetName,
+          outboundPolicy: c.outboundPolicy ?? "unsupported",
+          version: 1,
+          packageVersion: c.packageVersion,
+          nextEvent: Boolean(c.nextEvent),
+          externalWorkerClock: "requires explicit harness synchronization",
+          checkpoint: true,
+          portable: Boolean(c.exportCheckpoint && c.importCheckpoint),
+          provisioning: Boolean(c.createNamespace && c.deleteNamespace),
+          inspect: Boolean(c.inspect),
+          controls: c.protocol === "http" ? ["clock", "faults", "latency", "seed"] : ["clock"],
+          stalePrecondition: c.protocol === "http"
+        }
+      ])),
+      limits: {
+        usage: {
+          namespaces: this.namespaces.size,
+          listeners: [...this.ctx.children.values()].reduce((n, c) => n + (c.protocol === "http" ? 1 : Object.keys(c.namespaces.endpoints ?? {}).length), 1)
+        },
+        headroom: {
+          namespaces: this.ctx.options.limits?.maxNamespaces === void 0 ? null : this.ctx.options.limits.maxNamespaces - this.namespaces.size
+        },
+        checkpoints: this.ctx.options.retention?.maxCount ?? 50,
+        eventHistory: 500,
+        operationHistory: 200,
+        idempotencyMs: 36e5,
+        supportedBudgets: ["maxNamespaces", "maxListeners", "connections"],
+        unsupportedBudgets: ["objectBytes", "records", "pendingJobs"],
+        ...this.ctx.options.limits
+      }
+    };
+  }
+  action(path, method) {
+    if (["GET", "HEAD"].includes(method))
+      return "read";
+    if (/\/credentials/.test(path))
+      return "credentials";
+    if (/\/reset$/.test(path))
+      return "reset";
+    if (/\/restore$/.test(path) || path.endsWith("/archives/import"))
+      return "restore";
+    if (/\/snapshots/.test(path) || path.endsWith("/archives/export"))
+      return "snapshot";
+    if (/\/namespaces\/[^/]+$/.test(path))
+      return "namespace";
+    return "control";
+  }
+  auth(request, namespace, action, path) {
+    const key = request.headers.get("x-mockingbird-admin-key");
+    const adminKey = this.ctx.config.adminKey ?? process.env.MOCKINGBIRD_ADMIN_KEY;
+    if (key !== null && (adminKey === void 0 || key !== adminKey)) {
+      const credential = this.credentials.get(digest(key));
+      if (credential && credential.expiresAt > Date.now()) {
+        if (!credential.namespaces.includes(namespace) || !credential.actions.includes(action) || /\/(credentials|cleanup|backups)(\/|$)/.test(path) || ["/fleet", "/fleet/namespaces"].includes(path) || path === "/fleet/archives/import" || path === "/fleet/archives/export")
+          return fleetError(403, "credential does not permit this scope or action");
+        return credential.id;
+      }
+      return fleetError(401, "invalid or expired credential");
+    }
+    if (adminKey !== void 0 && key !== adminKey)
+      return fleetError(401, "admin key required");
+    return "admin";
+  }
+  async dispatch(request, fallback) {
+    const cors = this.ctx.options.cors;
+    const url = new URL(request.url), prefix = this.ctx.config.adminPrefix ?? "/__admin";
+    const controlled = url.pathname === `${prefix}/fleet` || url.pathname.startsWith(`${prefix}/fleet/`) || url.pathname === `${prefix}/ui`;
+    const origin = request.headers.get("origin");
+    const allowed = controlled && cors !== void 0 && origin !== null && cors.origins.includes(origin);
+    const methods = cors?.methods ?? ["GET", "POST", "DELETE", "OPTIONS"];
+    const headers = cors?.headers ?? [
+      "content-type",
+      "x-mockingbird-admin-key",
+      "x-mockingbird-namespace",
+      "idempotency-key",
+      "last-event-id"
+    ];
+    if (controlled && cors && request.method === "OPTIONS" && origin !== null) {
+      const method = request.headers.get("access-control-request-method");
+      const requested = (request.headers.get("access-control-request-headers") ?? "").split(",").map((h) => h.trim().toLowerCase()).filter(Boolean);
+      if (!allowed || !method || !methods.includes(method) || requested.some((h) => !headers.map((v) => v.toLowerCase()).includes(h)))
+        return fleetError(403, "CORS preflight denied");
+      return new Response(null, {
+        status: 204,
+        headers: {
+          "access-control-allow-origin": origin,
+          "access-control-allow-methods": methods.join(", "),
+          "access-control-allow-headers": headers.join(", "),
+          vary: "Origin, Access-Control-Request-Method, Access-Control-Request-Headers"
+        }
+      });
+    }
+    const response = await this.dispatchControl(request, fallback);
+    if (controlled && cors) {
+      response.headers.append("vary", "Origin");
+      if (allowed && origin)
+        response.headers.set("access-control-allow-origin", origin);
+    }
+    return response;
+  }
+  async dispatchControl(request, fallback) {
+    const url = new URL(request.url), prefix = this.ctx.config.adminPrefix ?? "/__admin";
+    if (!url.pathname.startsWith(`${prefix}/`) && url.pathname !== prefix)
+      return fallback();
+    const path = url.pathname.slice(prefix.length).replace(/\/$/, "");
+    if (path === "/live" && request.method === "GET")
+      return Response.json({ status: this.lifecycle === "stopped" ? "stopped" : "alive", id: this.ctx.id }, { status: this.lifecycle === "stopped" ? 503 : 200 });
+    if (path === "/health" && (this.lifecycle !== "ready" || this.ctx.controlling.size || this.ctx.recovery.size || this.environment))
+      return Response.json({
+        status: this.ctx.recovery.size ? "failed" : this.ctx.controlling.size || this.environment ? "maintenance" : this.lifecycle,
+        alive: this.lifecycle !== "stopped",
+        operations: [...this.ctx.controlling].map(([namespace2, operationId]) => ({
+          namespace: namespace2,
+          operationId
+        })),
+        fenced: [...this.ctx.recovery.keys()]
+      }, { status: 503 });
+    if (!path.startsWith("/fleet") && path !== "/ui")
+      return fallback();
+    let namespace;
+    try {
+      namespace = /^\/fleet\/namespaces\/([^/]+)/.test(path) ? decodeURIComponent(path.split("/")[3]) : url.searchParams.get("namespace") ?? request.headers.get("x-mockingbird-namespace") ?? this.ctx.config.namespace ?? "default";
+    } catch {
+      return fleetError(400, "invalid namespace encoding");
+    }
+    if (!namePattern.test(namespace))
+      return fleetError(400, "invalid namespace");
+    const action = this.action(path, request.method), caller = this.auth(request, namespace, action, path);
+    const member = path === "/fleet/events" && request.method === "GET" && this.ctx.options.memberStatus === true;
+    if (caller instanceof Response && !member) {
+      const audited = await this.instrumentation.audit({
+        actor: "unauthorized",
+        namespace,
+        action: `${request.method} ${this.action(path, request.method)}`,
+        services: [],
+        stage: "denied"
+      });
+      if (!audited)
+        return fleetError(503, "required audit sink unavailable");
+      return caller;
+    }
+    let body = {};
+    if (!["GET", "HEAD", "DELETE"].includes(request.method)) {
+      try {
+        const text = await request.clone().text();
+        const parsed = text ? JSON.parse(text) : {};
+        if (!object2(parsed))
+          throw new Error();
+        body = parsed;
+      } catch {
+        return fleetError(400, "expected JSON object");
+      }
+    }
+    this.prune();
+    const mutating = !["GET", "HEAD"].includes(request.method);
+    const run = async () => {
+      let operation;
+      if (mutating && !path.includes("/operations/") && !path.endsWith("/can-checkpoint") && !path.endsWith("/wait-until-idle")) {
+        operation = {
+          id: randomUUID3(),
+          scope: body.allNamespaces === true ? [...this.namespaces.keys()] : [namespace],
+          actor: typeof caller === "string" ? caller : "member",
+          services: Array.isArray(body.services) && body.services.every((s) => typeof s === "string" && this.ctx.children.has(s)) ? body.services : [...this.ctx.children.keys()],
+          namespace,
+          action: `${request.method} ${path}`,
+          phase: "validating",
+          startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+          status: "running",
+          completed: 0,
+          total: this.ctx.children.size
+        };
+        this.operations.set(operation.id, operation);
+        this.aborts.set(operation.id, new AbortController());
+        this.emit(operation);
+      }
+      const execute = async () => {
+        try {
+          if (operation && !await this.instrumentation.audit({
+            actor: operation.actor ?? "admin",
+            namespace,
+            action,
+            services: operation.services ?? [],
+            operationId: operation.id,
+            stage: "attempt"
+          }))
+            throw new Error("required audit sink unavailable before mutation");
+          if (operation && this.ctx.options.journal && !path.startsWith("/fleet/recovery") && !path.includes("/assertions/") && !path.startsWith("/fleet/trace")) {
+            if (!this.ctx.options.repository)
+              throw new Error("durable journal requires a repository");
+            let before;
+            if (this.namespaces.has(namespace) && !this.ctx.recovery.has(namespace)) {
+              const archive = await this.capture(body.allNamespaces === true ? [...this.namespaces.keys()] : [namespace], this.select(body));
+              before = await this.ctx.options.repository.put(archive);
+              await this.ctx.options.repository.get(before);
+            }
+            const record = {
+              version: 1,
+              revision: 1,
+              operationId: operation.id,
+              controller: this.ctx.id,
+              namespace,
+              scope: body.allNamespaces === true ? [...this.namespaces.keys()] : [namespace],
+              action,
+              phase: "prepared",
+              timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+              requestFingerprint: digest({ path, body, method: request.method }),
+              ...before ? { before } : {}
+            };
+            await this.ctx.options.journal.write(record);
+            this.durable.set(operation.id, record);
+            await this.journalPhase(operation.id, "committing");
+          }
+          const result = await this.handle(request, path, namespace, body, caller === "admin" && (!member || request.headers.has("x-mockingbird-admin-key"))) ?? await fallback();
+          if (operation) {
+            operation.status = this.aborts.get(operation.id)?.signal.aborted ? "cancelled" : result.ok ? "succeeded" : "failed";
+            operation.phase = operation.status;
+            operation.finishedAt = (/* @__PURE__ */ new Date()).toISOString();
+            const payload = await result.clone().json().catch(() => void 0);
+            operation.result = object2(payload) ? Object.fromEntries(Object.entries(payload).filter(([key2]) => [
+              "status",
+              "id",
+              "namespace",
+              "failedService",
+              "rollback",
+              "rolledBack",
+              "error",
+              "sha256"
+            ].includes(key2))) : { status: result.status };
+            if (result.ok)
+              operation.completed = operation.total;
+            await this.journalPhase(operation.id, result.ok ? "succeeded" : this.ctx.recovery.has(namespace) ? "recovery-required" : "failed");
+            if (result.ok && (action === "reset" || action === "restore")) {
+              for (const record of this.interrupted.values())
+                if (record.scope.includes(namespace)) {
+                  const scope2 = record.scope.filter((ns) => ns !== namespace);
+                  const resolved = {
+                    ...record,
+                    scope: scope2,
+                    revision: record.revision + 1,
+                    phase: scope2.length ? "recovery-required" : "resolved",
+                    resolution: `explicit-${action}`,
+                    timestamp: (/* @__PURE__ */ new Date()).toISOString()
+                  };
+                  try {
+                    await this.ctx.options.journal?.write(resolved);
+                  } catch (error) {
+                    this.fenceNamespaces(record.scope);
+                    throw error;
+                  }
+                  if (scope2.length)
+                    this.interrupted.set(record.operationId, resolved);
+                  else
+                    this.interrupted.delete(record.operationId);
+                }
+              await this.ctx.publish();
+            }
+            if (!await this.instrumentation.audit({
+              actor: operation.actor ?? "admin",
+              namespace,
+              action,
+              services: operation.services ?? [],
+              operationId: operation.id,
+              stage: "terminal",
+              result: operation.status === "succeeded" ? "succeeded" : operation.status === "cancelled" ? "cancelled" : "failed"
+            })) {
+              const fences = [];
+              for (const name of operation.services ?? [])
+                try {
+                  const release = this.ctx.children.get(name)?.lock(namespace);
+                  if (release)
+                    fences.push(release);
+                } catch {
+                }
+              this.ctx.recovery.set(namespace, fences);
+              await this.journalPhase(operation.id, "recovery-required");
+              throw new Error("required terminal audit unavailable; recovery required");
+            }
+            result.headers.set("x-mockingbird-operation-id", operation.id);
+            this.emit(operation);
+            if (result.ok && request.method !== "DELETE" && (action === "restore" || action === "reset" || action === "namespace"))
+              this.remember(namespace).generation = randomUUID3();
+          }
+          if (result.ok && request.method === "POST") {
+            if (path === "/fleet/clock")
+              this.observations.control(namespace, "clock", body);
+            else if (/^\/fleet\/namespaces\/[^/]+\/reset$/.test(path))
+              this.observations.control(namespace, "reset", body);
+            else if (!path.startsWith("/fleet/trace") && !path.includes("/assertions/"))
+              this.observations.unsupportedControl(namespace, action);
+          }
+          for (const point of this.ctx.checkpoints.values())
+            if (!point.createdAt) {
+              point.createdAt = (/* @__PURE__ */ new Date()).toISOString();
+              if (body.label !== void 0)
+                point.label = body.label;
+            }
+          this.prune();
+          if (this.ctx.recovery.size)
+            await this.ctx.publish();
+          return result;
+        } catch (error) {
+          if (operation && ["committing", "uploading", "publishing"].includes(this.durable.get(operation.id)?.phase ?? "")) {
+            const releases = this.ctx.recovery.get(namespace) ?? [];
+            for (const child of this.ctx.children.values())
+              try {
+                releases.push(child.lock(namespace));
+              } catch {
+              }
+            this.ctx.recovery.set(namespace, releases);
+          }
+          if (operation) {
+            operation.status = "failed";
+            operation.phase = "failed";
+            operation.finishedAt = (/* @__PURE__ */ new Date()).toISOString();
+            operation.result = {
+              message: error instanceof Error ? error.message : "operation failed"
+            };
+            this.emit(operation);
+          }
+          if (this.ctx.recovery.size)
+            await this.ctx.publish().catch(() => {
+            });
+          return fleetError(400, error instanceof Error ? error.message : "invalid control");
+        } finally {
+          if (operation)
+            this.aborts.delete(operation.id);
+          while (this.operations.size > 200) {
+            const entry = [...this.operations].find(([, o]) => o.status !== "running");
+            if (!entry)
+              break;
+            this.operations.delete(entry[0]);
+          }
+        }
+      };
+      return operation ? this.operationContext.run(operation, execute) : execute();
+    };
+    const key = request.headers.get("idempotency-key");
+    if (!key || !mutating)
+      return run();
+    if (key.length > 256)
+      return fleetError(400, "idempotency key too long");
+    for (const [id, kept] of this.retries)
+      if (kept.expires < Date.now())
+        this.retries.delete(id);
+    const scope = `${typeof caller === "string" ? caller : "member"}:${namespace}:${key}`;
+    const fingerprint = digest({ path, method: request.method, body });
+    const existing = this.retries.get(scope);
+    if (existing)
+      return existing.fingerprint === fingerprint ? (await existing.response).clone() : fleetError(409, "idempotency key reused with different request");
+    if (this.retries.size >= 1e3)
+      return fleetError(429, "idempotency retention capacity reached");
+    const response = Promise.resolve().then(run);
+    this.retries.set(scope, { fingerprint, expires: Date.now() + 36e5, response });
+    return (await response).clone();
+  }
+  async handle(request, path, namespace, body, admin) {
+    const route = path.slice("/fleet".length), method = request.method;
+    if (path === "/ui")
+      return new Response(fleetConsole(this.ctx.config.adminPrefix ?? "/__admin"), {
+        headers: { "content-type": "text/html; charset=utf-8" }
+      });
+    if (route === "" && method === "GET")
+      return Response.json({
+        ...this.capability(),
+        manifest: this.ctx.manifest(),
+        namespaces: this.namespaceStatus()
+      });
+    if (route === "/recovery" && method === "GET")
+      return admin ? Response.json({
+        version: 1,
+        interrupted: [...this.interrupted.values()],
+        resumable: Boolean(this.ctx.options.journal)
+      }) : fleetError(403, "recovery administration required");
+    const recovery = /^\/recovery\/([^/]+)\/rollback$/.exec(route);
+    if (recovery && method === "POST") {
+      checked(body, []);
+      if (!admin)
+        return fleetError(403, "recovery administration required");
+      const record = this.interrupted.get(recovery[1]);
+      if (!record?.before || !this.ctx.options.repository || !this.ctx.options.journal)
+        throw new Error("interrupted operation has no verified portable before-state; explicit namespace reset is required");
+      const beforeArchive = await this.ctx.options.repository.get(record.before);
+      const { sha256: _identity, ...content } = beforeArchive;
+      await this.restoreArchive(sealArchive({
+        ...content,
+        namespaces: Object.fromEntries(Object.entries(beforeArchive.namespaces).filter(([namespace2]) => record.scope.includes(namespace2)))
+      }));
+      try {
+        await this.ctx.options.journal.write({
+          ...record,
+          revision: record.revision + 1,
+          phase: "resolved",
+          resolution: "explicit-restore-before",
+          timestamp: (/* @__PURE__ */ new Date()).toISOString()
+        });
+      } catch (error) {
+        this.fenceNamespaces(record.scope);
+        throw error;
+      }
+      this.interrupted.delete(record.operationId);
+      await this.ctx.publish();
+      return Response.json({
+        status: "resolved",
+        operationId: record.operationId,
+        resolution: "restored-before-state"
+      });
+    }
+    if (route === "/telemetry" && method === "GET")
+      return admin ? Response.json(this.instrumentation.snapshot()) : fleetError(403, "operator telemetry requires administrator scope");
+    if (route === "/audit" && method === "GET")
+      return admin ? Response.json(this.instrumentation.auditTrail()) : fleetError(403, "audit trail requires administrator scope");
+    if (route === "/namespaces" && method === "GET")
+      return Response.json({ namespaces: this.namespaceStatus() });
+    const fork = /^\/namespaces\/[^/]+\/fork$/.test(route);
+    if (fork && method === "POST") {
+      checked(body, ["destination", "bindings"]);
+      if (!admin)
+        return fleetError(403, "namespace fork requires administrator scope");
+      if (typeof body.destination !== "string" || !namePattern.test(body.destination))
+        throw new Error("destination namespace required");
+      const destination2 = body.destination;
+      if (this.namespaces.has(destination2))
+        return fleetError(409, "destination namespace already exists");
+      return this.withEnvironment([namespace, destination2], this.ctx.children, async () => {
+        let archive = await this.capture([namespace]);
+        let bindings = {
+          changes: [],
+          limitations: ["opaque namespace-bearing keys and application credentials are unchanged"]
+        };
+        if (body.bindings !== void 0) {
+          const prepared = await planRestoreBindings(archive, body.bindings, this.ctx.options.resolveArchiveSecret);
+          archive = prepared.archive;
+          bindings = prepared.report;
+        }
+        await this.restoreArchive(rebaseArchiveNamespace(archive, namespace, destination2));
+        return Response.json({
+          namespace: destination2,
+          generation: this.generation(destination2),
+          manifest: this.ctx.manifest(),
+          bindings,
+          connections: Object.fromEntries([...this.ctx.children].map(([name, child]) => [
+            name,
+            child.connections?.[destination2] ?? `${child.url}${this.ctx.config.adminPrefix ?? "/__admin"}/ns/${destination2}`
+          ]))
+        }, { status: 201 });
+      });
+    }
+    if (route === "/archives/bindings" && method === "POST") {
+      if (!admin)
+        return fleetError(403, "restore binding plans require administrator scope");
+      checked(body, ["archive", "plan"]);
+      const prepared = await planRestoreBindings(body.archive, body.plan, this.ctx.options.resolveArchiveSecret);
+      return Response.json(prepared.report);
+    }
+    if (route === "/assertions/baseline" && method === "POST") {
+      checked(body, ["services"]);
+      const selected = this.select(body);
+      this.scope(namespace, selected);
+      return Response.json(this.observations.baseline(namespace, [...selected.keys()]));
+    }
+    const assertion = /^\/assertions\/([^/]+)\/check$/.exec(route);
+    if (assertion && method === "POST") {
+      checked(body, ["allowances", "allowCheckpointablePending"]);
+      if (body.allowCheckpointablePending !== void 0 && typeof body.allowCheckpointablePending !== "boolean")
+        throw new Error("allowCheckpointablePending must be boolean");
+      const diagnostics = Object.fromEntries([...this.ctx.children].filter(([, child]) => child.protocol === "http" || Object.hasOwn(child.namespaces.endpoints ?? {}, namespace)).map(([name, child]) => [name, child.diagnostics(namespace)]));
+      const report = this.observations.assertClean(assertion[1], namespace, diagnostics, body);
+      return Response.json(report, { status: report.clean ? 200 : 409 });
+    }
+    if (route.startsWith("/trace")) {
+      if (!admin)
+        return fleetError(403, "trace capture requires administrator scope");
+      if (!this.ctx.options.trace)
+        return fleetError(400, "trace capture is not enabled");
+      if (route === "/trace/start" && method === "POST") {
+        checked(body, ["includeBodies"]);
+        if (body.includeBodies !== void 0 && typeof body.includeBodies !== "boolean")
+          throw new Error("includeBodies must be boolean");
+        const baseline = await this.capture([namespace]);
+        const limitations = [...this.ctx.children.values()].some((child) => child.protocol !== "http") ? ["protocol/external interactions are not captured"] : [];
+        return Response.json(this.observations.startTrace(namespace, baseline, body.includeBodies === true, limitations));
+      }
+      if (route === "/trace" && method === "GET")
+        return Response.json(this.observations.trace(namespace));
+      if (route === "/trace/stop" && method === "POST") {
+        checked(body, []);
+        return Response.json(this.observations.trace(namespace, true));
+      }
+    }
+    const nsRoute = /^\/namespaces\/([^/]+)$/.exec(route);
+    if (nsRoute && method === "POST") {
+      checked(body, ["baseline"]);
+      if (body.baseline !== void 0 && typeof body.baseline !== "string")
+        throw new Error("baseline must be a checkpoint id");
+      return this.createNamespace(namespace, body.baseline);
+    }
+    if (nsRoute && method === "DELETE")
+      return this.deleteNamespace(namespace);
+    if (/^\/namespaces\/[^/]+\/policy$/.test(route) && method === "POST") {
+      checked(body, ["pinned", "expiresInMs"]);
+      if (body.pinned !== void 0 && typeof body.pinned !== "boolean")
+        throw new Error("pinned must be boolean");
+      if (body.expiresInMs !== void 0 && (typeof body.expiresInMs !== "number" || !Number.isSafeInteger(body.expiresInMs) || body.expiresInMs < 1 || body.expiresInMs > 864e5))
+        throw new Error("expiry must be within one host day");
+      if (body.pinned === void 0 && body.expiresInMs === void 0)
+        throw new Error("namespace policy required");
+      if (typeof body.pinned === "boolean")
+        this.remember(namespace).pinned = body.pinned;
+      if (typeof body.expiresInMs === "number") {
+        this.remember(namespace).expiresAt = Date.now() + body.expiresInMs;
+        if (!this.expiryTimer) {
+          this.expiryTimer = setInterval(() => {
+            for (const entry of this.cleanupPreview())
+              if (entry.eligible)
+                void this.deleteNamespace(entry.namespace).catch(() => {
+                });
+          }, Math.max(10, Math.min(6e4, body.expiresInMs)));
+          this.expiryTimer.unref?.();
+        }
+      }
+      return Response.json({ namespace, ...this.remember(namespace) });
+    }
+    const snapshot = /^\/namespaces\/[^/]+\/snapshots(?:\/([^/]+))?$/.exec(route);
+    if (snapshot && (method === "GET" || method === "DELETE")) {
+      const info = (id, p) => ({
+        id,
+        namespace: p.namespace,
+        label: p.label,
+        createdAt: p.createdAt,
+        services: [...p.values.keys()],
+        portable: [...p.values.keys()].every((s) => Boolean(this.ctx.children.get(s)?.exportCheckpoint))
+      });
+      if (!snapshot[1]) {
+        if (method !== "GET")
+          return fleetError(405, "select a checkpoint to delete");
+        return Response.json({
+          snapshots: [...this.ctx.checkpoints].filter(([, p]) => p.namespace === namespace).map(([id, p]) => info(id, p))
+        });
+      }
+      const point = this.ctx.checkpoints.get(snapshot[1]);
+      if (!point || point.namespace !== namespace)
+        return fleetError(404, "no checkpoint in this namespace");
+      if (method === "DELETE")
+        this.ctx.checkpoints.delete(snapshot[1]);
+      return Response.json(method === "DELETE" ? { status: "deleted", id: snapshot[1] } : info(snapshot[1], point));
+    }
+    if ((route === "/time/step-next" || route === "/time/run-until") && method === "POST") {
+      checked(body, ["services", "condition", "maxEvents", "maxAdvanceMs", "timeoutMs"]);
+      const selected = this.select(body);
+      this.scope(namespace, selected);
+      const controller = new FleetTimeController({
+        clock: this.ctx.clock,
+        transaction: this.ctx.transaction,
+        phase: (ns, phase, done, total) => this.phase(ns, phase, done, total),
+        recovery: this.ctx.recovery,
+        ...this.ctx.options.synchronizeClock ? { synchronize: this.ctx.options.synchronizeClock } : {}
+      });
+      return controller.run(namespace, selected, body, route === "/time/step-next");
+    }
+    if (route === "/can-checkpoint" && method === "POST") {
+      checked(body, ["services", "timeoutMs"]);
+      if (body.timeoutMs !== void 0 && (typeof body.timeoutMs !== "number" || body.timeoutMs < 0 || body.timeoutMs > 3e4))
+        throw new Error("timeoutMs must be between 0 and 30000");
+      const selected = this.select(body);
+      this.scope(namespace, selected);
+      const until = Date.now() + (body.timeoutMs ?? 0);
+      for (; ; ) {
+        const services = Object.fromEntries([...selected].map(([n, c]) => {
+          const d = c.diagnostics(namespace);
+          return [
+            n,
+            {
+              ...d,
+              checkpointReady: d.activeRequests + d.blockedCommands + d.pendingWebhooks + (d.activeJobs ?? 0) === 0,
+              idle: d.activeRequests + d.blockedCommands + d.pendingWebhooks + d.pendingJobs === 0
+            }
+          ];
+        }));
+        const ready = !this.ctx.controlling.has(namespace) && !this.ctx.recovery.has(namespace) && Object.values(services).every((d) => d.checkpointReady);
+        if (ready || Date.now() >= until)
+          return Response.json({ namespace, checkpointReady: ready, services }, { status: ready ? 200 : 409 });
+        await new Promise((r) => setTimeout(r, 10));
+      }
+    }
+    if (route === "/operations" && method === "GET")
+      return Response.json({
+        operations: [...this.operations.values()].filter((o) => o.namespace === namespace)
+      });
+    const operationRoute = /^\/operations\/([^/]+)(\/cancel)?$/.exec(route);
+    if (operationRoute) {
+      const op = this.operations.get(operationRoute[1]);
+      if (!op || op.namespace !== namespace)
+        return fleetError(404, "operation not found");
+      if (operationRoute[2] && method === "POST") {
+        checked(body, []);
+        if (op.status !== "running" || !["validating", "preparing", "checkpointing"].includes(op.phase))
+          return fleetError(409, "operation has passed cancellable phase");
+        this.aborts.get(op.id)?.abort();
+        return Response.json({ id: op.id, cancellationRequested: true });
+      }
+      if (method === "GET")
+        return Response.json(op);
+    }
+    if (route === "/events" && method === "GET") {
+      const cursor = request.headers.get("last-event-id");
+      const encode = new TextEncoder();
+      let subscription;
+      let heartbeat;
+      const cleanup = () => {
+        if (subscription)
+          this.subscribers.delete(subscription);
+        clearInterval(heartbeat);
+      };
+      const stream = new ReadableStream({
+        start: (controller) => {
+          subscription = {
+            namespace,
+            member: this.ctx.options.memberStatus === true && !admin,
+            push: (event) => {
+              if ((controller.desiredSize ?? 0) < -32) {
+                cleanup();
+                controller.close();
+              } else
+                controller.enqueue(encode.encode(event));
+            }
+          };
+          this.subscribers.add(subscription);
+          const at = this.events.findIndex((e) => e.id === cursor);
+          if (cursor === null || at < 0)
+            subscription.push(`event: resync
+data: ${JSON.stringify({ processId: this.ctx.id, namespace, generation: this.generation(namespace), lifecycle: this.lifecycle })}
+
+`);
+          for (const event of this.events.slice(at < 0 ? 0 : at + 1))
+            if (event.namespace === namespace) {
+              const data = this.ctx.options.memberStatus && !admin ? {
+                id: event.id,
+                namespace,
+                operation: {
+                  id: event.operation.id,
+                  phase: event.operation.phase,
+                  status: event.operation.status,
+                  completed: event.operation.completed,
+                  total: event.operation.total
+                }
+              } : event;
+              subscription.push(`id: ${event.id}
+event: lifecycle
+data: ${JSON.stringify(data)}
+
+`);
+            }
+          heartbeat = setInterval(() => subscription.push(": heartbeat\n\n"), 15e3);
+          heartbeat.unref?.();
+          request.signal.addEventListener("abort", () => {
+            cleanup();
+            try {
+              controller.close();
+            } catch {
+            }
+          }, { once: true });
+        },
+        cancel: cleanup
+      });
+      return new Response(stream, {
+        headers: { "content-type": "text/event-stream", "cache-control": "no-cache" }
+      });
+    }
+    if (route === "/archives/export" && method === "POST") {
+      checked(body, ["services", "allNamespaces"]);
+      if (body.allNamespaces !== void 0 && typeof body.allNamespaces !== "boolean")
+        throw new Error("allNamespaces must be boolean");
+      const archive = await this.capture(body.allNamespaces === true ? [...this.namespaces.keys()] : [namespace], this.select(body));
+      return Response.json(this.ctx.options.archiveProtection ? await this.ctx.options.archiveProtection.seal(archive) : archive);
+    }
+    if (route === "/archives/import" && method === "POST") {
+      checked(body, ["archive", "namespace", "bindings"]);
+      let archive = this.ctx.options.archiveProtection ? await this.ctx.options.archiveProtection.open(body.archive) : validateArchive(body.archive);
+      if (body.namespace !== void 0 && (typeof body.namespace !== "string" || !namePattern.test(body.namespace)))
+        throw new Error("invalid selected archive namespace");
+      if (body.bindings !== void 0)
+        archive = (await planRestoreBindings(archive, body.bindings, this.ctx.options.resolveArchiveSecret)).archive;
+      await this.restoreArchive(archive, body.namespace);
+      return Response.json({
+        status: "restored",
+        sha256: archive.sha256,
+        namespaces: body.namespace ? [body.namespace] : Object.keys(archive.namespaces)
+      });
+    }
+    if (route === "/archives/inspect" && method === "POST") {
+      checked(body, ["archive"]);
+      return Response.json(inspectArchive(body.archive));
+    }
+    if (route === "/archives/diff" && method === "POST") {
+      checked(body, ["left", "right", "namespace", "service", "values", "limit"]);
+      if (body.values !== void 0 && typeof body.values !== "boolean" || body.limit !== void 0 && (typeof body.limit !== "number" || !Number.isInteger(body.limit) || body.limit < 1 || body.limit > 1e3))
+        throw new Error("invalid diff options");
+      return Response.json(diffArchives(body.left, body.right, body));
+    }
+    if (route === "/profiles/apply" && method === "POST") {
+      checked(body, ["name", "profile"]);
+      const profile = typeof body.name === "string" ? this.ctx.options.profiles?.[body.name] : body.profile;
+      return this.applyProfile(namespace, profile);
+    }
+    if (route === "/profiles/baseline" && method === "POST") {
+      checked(body, ["services"]);
+      return this.applyProfile(namespace, Object.fromEntries([...this.select(body)].map(([name, c]) => [
+        name,
+        c.protocol === "http" ? { faults: [], latency: 0 } : {}
+      ])));
+    }
+    if (route === "/scenarios" && method === "GET")
+      return Response.json({
+        scenarios: Object.entries(this.ctx.options.scenarios ?? {}).map(([name, b]) => ({
+          name,
+          format: b.format,
+          version: b.version,
+          description: b.description,
+          services: Object.keys(b.services)
+        }))
+      });
+    const scenario = /^\/scenarios\/([^/]+)\/apply$/.exec(route);
+    if (scenario && method === "POST") {
+      checked(body, []);
+      const bundle = this.ctx.options.scenarios?.[scenario[1]];
+      if (bundle?.format !== "mockingbird.scenario/v1" || !Number.isSafeInteger(bundle.version) || bundle.version < 1)
+        throw new Error("unknown or incompatible scenario bundle");
+      for (const [name, entry] of Object.entries(bundle.services))
+        if (this.ctx.children.get(name)?.protocol !== entry.protocol)
+          throw new Error(`incompatible scenario service ${name}`);
+      for (const [name, entry] of Object.entries(bundle.services))
+        if (entry.fixtures !== void 0) {
+          const child = this.ctx.children.get(name);
+          if (entry.protocol !== "http" || !child?.importCheckpoint)
+            throw new Error(`scenario fixtures unsupported for ${name}`);
+          await child.importCheckpoint(namespace, {
+            format: "mockingbird.snapshot/v1",
+            service: name,
+            records: entry.fixtures
+          });
+        }
+      const profile = Object.fromEntries(Object.entries(bundle.services).map(([name, entry]) => [
+        name,
+        {
+          ...entry.controls,
+          ...bundle.seed !== void 0 && entry.protocol === "http" ? { seed: bundle.seed } : {},
+          ...bundle.clock ? { clock: bundle.clock } : {}
+        }
+      ]));
+      const response = await this.applyProfile(namespace, profile, async (name, child) => {
+        const fixtures = bundle.services[name]?.fixtures;
+        if (fixtures !== void 0) {
+          if (!child.configure)
+            throw new Error(`fixtures unsupported for ${name}`);
+          const document = { format: "mockingbird.snapshot/v1", service: name, records: fixtures };
+          await child.configure(namespace, { snapshot: document });
+        }
+      }, bundle.seedApplication);
+      return response;
+    }
+    if (route === "/inspect" && method === "GET") {
+      const url = new URL(request.url), service = url.searchParams.get("service");
+      const child = service ? this.ctx.children.get(service) : void 0;
+      if (!child?.inspect)
+        return fleetError(400, "service inspection is unsupported");
+      const offset = Number(url.searchParams.get("offset") ?? 0), limit = Number(url.searchParams.get("limit") ?? 100);
+      if (!Number.isInteger(offset) || offset < 0 || !Number.isInteger(limit) || limit < 1 || limit > 1e3)
+        throw new Error("invalid pagination");
+      this.scope(namespace, /* @__PURE__ */ new Map([[service, child]]));
+      const collection = url.searchParams.get("collection");
+      return Response.json({
+        namespace,
+        service,
+        result: await child.inspect(namespace, {
+          offset,
+          limit,
+          ...collection !== null ? { collection } : {}
+        })
+      });
+    }
+    if (route === "/diagnostics" && method === "GET") {
+      const selected = new URL(request.url).searchParams.getAll("service");
+      const children = selected.length ? this.select({ services: selected }) : this.ctx.children;
+      this.scope(namespace, children);
+      return Response.json({
+        format: "mockingbird.diagnostics/v1",
+        createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+        processId: this.ctx.id,
+        namespace,
+        generation: this.generation(namespace),
+        configurationFingerprint: digest(this.ctx.config),
+        capabilities: this.capability(),
+        services: Object.fromEntries([...children].map(([name, c]) => [
+          name,
+          {
+            protocol: c.protocol,
+            diagnostics: c.diagnostics(namespace),
+            unmatched: c.unmatched?.(namespace, 50)
+          }
+        ])),
+        operations: [...this.operations.values()].filter((o) => o.namespace === namespace).slice(-50).map(({ id, phase, action, status, startedAt, finishedAt }) => ({
+          id,
+          phase,
+          action,
+          status,
+          startedAt,
+          finishedAt
+        })),
+        truncated: [...this.operations.values()].filter((o) => o.namespace === namespace).length > 50,
+        excluded: ["credentials", "requestBodies", "records", "modelText", "operationPayloads"]
+      });
+    }
+    if (route === "/credentials" && method === "POST") {
+      checked(body, ["namespaces", "actions", "ttlMs"]);
+      if (!admin)
+        return fleetError(403, "admin credential required");
+      if (!Array.isArray(body.namespaces) || !body.namespaces.length || body.namespaces.some((n) => typeof n !== "string" || !namePattern.test(n)) || !Array.isArray(body.actions) || !body.actions.length || body.actions.some((a) => !["read", "reset", "restore", "snapshot", "control"].includes(String(a))) || typeof body.ttlMs !== "number" || body.ttlMs <= 0 || body.ttlMs > 864e5)
+        throw new Error("expected namespaces, actions and ttlMs (at most one day)");
+      const credential2 = randomBytes(32).toString("base64url"), id = randomUUID3(), expiresAt = Date.now() + body.ttlMs;
+      this.credentials.set(digest(credential2), {
+        id,
+        namespaces: body.namespaces,
+        actions: body.actions,
+        expiresAt
+      });
+      return Response.json({ id, credential: credential2, expiresAt }, { status: 201 });
+    }
+    const credential = /^\/credentials\/([^/]+)$/.exec(route);
+    if (credential && method === "DELETE") {
+      if (!admin)
+        return fleetError(403, "admin credential required");
+      for (const [key, c] of this.credentials)
+        if (c.id === credential[1]) {
+          this.credentials.delete(key);
+          return Response.json({ status: "revoked", id: c.id });
+        }
+      return fleetError(404, "credential not found");
+    }
+    if (route === "/backups" && method === "GET")
+      return Response.json({
+        ...this.backupStatus,
+        running: this.backupRunning,
+        archives: await this.ctx.options.repository?.list() ?? []
+      });
+    if (route === "/backups" && method === "POST") {
+      checked(body, ["allNamespaces"]);
+      return Response.json(await this.backup(body.allNamespaces === true ? [...this.namespaces.keys()] : [namespace], [...this.operations.values()].reverse().find((o) => o.status === "running" && o.namespace === namespace)?.id));
+    }
+    if (route === "/cleanup" && method === "GET")
+      return Response.json({ candidates: this.cleanupPreview() });
+    if (route === "/cleanup" && method === "POST") {
+      checked(body, []);
+      const results = {};
+      for (const entry of this.cleanupPreview())
+        if (entry.eligible) {
+          try {
+            if (this.ctx.options.expiry?.finalBackup)
+              await this.backup([entry.namespace]);
+            const response = await this.deleteNamespace(entry.namespace);
+            results[entry.namespace] = { status: response.status, result: await response.json() };
+          } catch (error) {
+            results[entry.namespace] = {
+              status: "failed",
+              message: error instanceof Error ? error.message : "cleanup failed"
+            };
+          }
+        }
+      return Response.json({ results });
+    }
+    return void 0;
+  }
+  namespaceStatus() {
+    return [...this.namespaces].map(([namespace, state]) => ({
+      namespace,
+      ...state,
+      status: this.ctx.recovery.has(namespace) ? "failed" : this.ctx.controlling.has(namespace) || this.topology.has(namespace) ? "maintenance" : "ready",
+      operationId: this.ctx.controlling.get(namespace),
+      expiresAt: state.expiresAt ?? (this.ctx.options.expiry ? Math.max(state.activityAt, ...[...this.ctx.children.values()].map((c) => c.lastActivity?.(namespace) ?? 0)) + this.ctx.options.expiry.idleMs : void 0)
+    }));
+  }
+  busy(namespace, selected = this.ctx.children) {
+    return [...selected].filter(([, c]) => {
+      const d = c.diagnostics(namespace);
+      return d.activeRequests + d.blockedCommands + d.pendingWebhooks + (d.activeJobs ?? 0) > 0;
+    }).map(([name]) => name);
+  }
+  async hook(phase, namespace, selected) {
+    const hook = this.ctx.options.workload?.[phase];
+    const op = this.activeOperation(namespace);
+    this.phase(namespace, phase === "prepare" ? "preparing" : phase === "verify" ? "verifying" : "resuming");
+    const controller = op ? this.aborts.get(op.id) : new AbortController();
+    if (controller?.signal.aborted && phase !== "resume")
+      throw new Error("operation cancelled before commit");
+    if (!hook)
+      return;
+    const timeout = AbortSignal.timeout(this.ctx.options.hookTimeoutMs ?? 3e4);
+    const signal = controller && !controller.signal.aborted ? AbortSignal.any([controller.signal, timeout]) : timeout;
+    await Promise.race([
+      hook({
+        namespace,
+        services: [...selected.keys()],
+        signal,
+        operationId: op?.id ?? randomUUID3()
+      }),
+      new Promise((_, reject) => signal.addEventListener("abort", () => reject(new Error(`${phase} hook aborted or timed out`)), { once: true }))
+    ]);
+  }
+  async createNamespace(namespace, baseline) {
+    if (this.environment && !this.ownsEnvironment())
+      return fleetError(409, "environment operation in progress");
+    if (this.namespaces.has(namespace) || this.topology.has(namespace))
+      return fleetError(409, "namespace already exists or is provisioning");
+    if (this.ctx.controlling.has(namespace))
+      return fleetError(409, "namespace operation in progress", {
+        operationId: this.ctx.controlling.get(namespace)
+      });
+    const limits = this.ctx.options.limits;
+    if (limits?.maxNamespaces !== void 0 && this.namespaces.size + this.topology.size >= limits.maxNamespaces)
+      return fleetError(429, "maximum namespaces reached");
+    const protocolCount = [...this.ctx.children.values()].filter((c) => c.protocol !== "http").length;
+    const listenerCount = [...this.ctx.children.values()].reduce((n, c) => n + (c.protocol === "external" ? 0 : c.protocol === "http" ? 1 : Object.keys(c.namespaces.endpoints ?? {}).length), 1);
+    if (limits?.maxListeners !== void 0 && listenerCount + (this.topology.size + 1) * protocolCount > limits.maxListeners)
+      return fleetError(429, "maximum listeners reached");
+    for (const [name, c] of this.ctx.children)
+      if (!c.createNamespace || !c.deleteNamespace)
+        throw new Error(`namespace provisioning unsupported for ${name}`);
+    const point = baseline ? this.ctx.checkpoints.get(baseline) : void 0;
+    if (baseline && !point)
+      throw new Error("baseline checkpoint not found");
+    this.topology.add(namespace);
+    const created = [];
+    try {
+      this.phase(namespace, "provisioning");
+      const docs = /* @__PURE__ */ new Map();
+      if (point)
+        for (const [name, value] of point.values) {
+          const child = this.ctx.children.get(name);
+          if (!child?.exportCheckpoint || !child.importCheckpoint)
+            throw new Error(`portable baseline unsupported for ${name}`);
+          docs.set(name, await child.exportCheckpoint(point.namespace, value));
+        }
+      for (const [name, child] of this.ctx.children) {
+        await child.createNamespace?.(namespace);
+        created.push(child);
+        if (docs.has(name))
+          await child.restore(namespace, await child.importCheckpoint?.(namespace, docs.get(name)));
+      }
+      if (point)
+        restoreClock(this.ctx.clock(namespace), point.clock);
+      this.remember(namespace);
+      await this.ctx.publish();
+      return Response.json({
+        namespace,
+        generation: this.generation(namespace),
+        manifest: this.ctx.manifest(),
+        connections: Object.fromEntries([...this.ctx.children].map(([n, c]) => [
+          n,
+          c.connections?.[namespace] ?? `${c.url}${this.ctx.config.adminPrefix ?? "/__admin"}/ns/${encodeURIComponent(namespace)}`
+        ]))
+      }, { status: 201 });
+    } catch (error) {
+      const results = await Promise.allSettled(created.reverse().map((c) => c.deleteNamespace?.(namespace)));
+      this.namespaces.delete(namespace);
+      if (results.some((r) => r.status === "rejected"))
+        return fleetError(500, "namespace provisioning cleanup failed", {
+          namespace,
+          recoveryRequired: true
+        });
+      throw error;
+    } finally {
+      this.topology.delete(namespace);
+    }
+  }
+  async deleteNamespace(namespace) {
+    if (this.environment && !this.ownsEnvironment())
+      return fleetError(409, "environment operation in progress");
+    if (namespace === "default")
+      return fleetError(409, "default namespace cannot be deleted");
+    if (!this.namespaces.has(namespace))
+      return fleetError(404, "namespace not found");
+    if (this.remember(namespace).pinned)
+      return fleetError(409, "namespace is pinned");
+    if (this.topology.has(namespace) || this.ctx.controlling.has(namespace) || this.ctx.recovery.has(namespace))
+      return fleetError(409, "namespace is busy or requires recovery");
+    this.scope(namespace, this.ctx.children);
+    const busy = this.busy(namespace);
+    for (const [name, c] of this.ctx.children)
+      if (c.diagnostics(namespace).activeConnections)
+        busy.push(name);
+    if (busy.length)
+      return fleetError(409, "namespace has active work or clients", {
+        services: [...new Set(busy)]
+      });
+    const selected = this.ctx.children;
+    for (const [name, child] of selected)
+      if (!child.deleteNamespace || !child.createNamespace || !child.exportCheckpoint || !child.importCheckpoint)
+        throw new Error(`transactional namespace deletion unsupported for ${name}`);
+    this.topology.add(namespace);
+    const release = [];
+    const documents = /* @__PURE__ */ new Map();
+    const deleted = /* @__PURE__ */ new Set();
+    const original = { ...this.remember(namespace) };
+    try {
+      for (const child of selected.values())
+        release.push(child.lock(namespace));
+      if (this.busy(namespace).length)
+        return fleetError(409, "namespace acquired active work before deletion");
+      for (const [name, child] of selected)
+        documents.set(name, await child.exportCheckpoint?.(namespace, await child.checkpoint(namespace)));
+      for (const [name, child] of selected) {
+        await child.deleteNamespace?.(namespace);
+        deleted.add(name);
+      }
+      this.namespaces.delete(namespace);
+      await this.ctx.publish();
+      for (const [id, p] of this.ctx.checkpoints)
+        if (p.namespace === namespace)
+          this.ctx.checkpoints.delete(id);
+      return Response.json({ status: "deleted", namespace });
+    } catch (error) {
+      const rollback = {};
+      for (const [name, child] of selected)
+        if (documents.has(name)) {
+          try {
+            if (deleted.has(name) || child.protocol !== "http" && !Object.hasOwn(child.namespaces.endpoints ?? {}, namespace))
+              await child.createNamespace?.(namespace);
+            await child.restore(namespace, await child.importCheckpoint?.(namespace, documents.get(name)));
+            rollback[name] = "restored";
+          } catch {
+            rollback[name] = "failed";
+          }
+        }
+      this.namespaces.set(namespace, original);
+      if (Object.values(rollback).includes("failed")) {
+        const fences = [];
+        for (const child of selected.values())
+          try {
+            fences.push(child.lock(namespace));
+          } catch {
+          }
+        this.ctx.recovery.set(namespace, fences);
+      }
+      await this.ctx.publish().catch(() => {
+      });
+      return fleetError(500, error instanceof Error ? error.message : "namespace deletion failed", {
+        namespace,
+        rollback,
+        rolledBack: Object.values(rollback).every((v) => v === "restored")
+      });
+    } finally {
+      for (const unlock of release.reverse())
+        unlock();
+      this.topology.delete(namespace);
+    }
+  }
+  async capture(namespaces, selected = this.ctx.children) {
+    if (namespaces.length > 1 && !this.ownsEnvironment())
+      return this.withEnvironment(namespaces, selected, () => this.capture(namespaces, selected));
+    const contents = {};
+    for (const [name, child] of selected)
+      if (!child.exportCheckpoint || !child.importCheckpoint)
+        throw new Error(`portable snapshots unsupported for ${name}`);
+    for (const namespace of namespaces) {
+      this.scope(namespace, selected);
+      const services = {};
+      const response = await this.ctx.transaction(namespace, selected, async (name, child) => {
+        const point = await child.checkpoint(namespace);
+        services[name] = {
+          protocol: child.protocol,
+          target: child.targetName ?? name,
+          version: 1,
+          ...child.packageVersion ? { packageVersion: child.packageVersion } : {},
+          state: await child.exportCheckpoint?.(namespace, point)
+        };
+      });
+      if (!response.ok)
+        throw new Error(`capture ${namespace} refused: ${canonical(await response.json())}`);
+      contents[namespace] = { clock: this.ctx.clock(namespace).state(), services };
+    }
+    return sealArchive({
+      format: "mockingbird.fleet/v1",
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      sourceId: this.ctx.id,
+      namespaces: contents
+    });
+  }
+  async restoreArchive(input, selectedNamespace) {
+    const archive = validateArchive(input);
+    const entries = Object.entries(archive.namespaces).filter(([ns]) => selectedNamespace === void 0 || ns === selectedNamespace);
+    if (!entries.length)
+      throw new Error("selected namespace absent from archive");
+    if (entries.length > 1 && !this.ownsEnvironment()) {
+      const selected = new Map([...new Set(entries.flatMap(([, ns]) => Object.keys(ns.services)))].map((name) => [
+        name,
+        this.ctx.children.get(name)
+      ]));
+      for (const [name, child] of selected)
+        if (!child)
+          throw new Error(`unsupported archive service ${name}`);
+      return this.withEnvironment(entries.map(([ns]) => ns), selected, () => this.restoreArchive(archive, selectedNamespace));
+    }
+    for (const [namespace, ns] of entries)
+      for (const [name, state] of Object.entries(ns.services)) {
+        const child = this.ctx.children.get(name);
+        if (!child || child.protocol !== state.protocol || !child.importCheckpoint || (state.target ?? name) !== (child.targetName ?? name))
+          throw new Error(`unsupported archive service ${name}`);
+        await child.importCheckpoint(namespace, state.state);
+      }
+    const rollback = [];
+    const created = [];
+    try {
+      for (const [namespace, ns] of entries) {
+        if (!this.namespaces.has(namespace)) {
+          const response2 = await this.createNamespace(namespace);
+          if (!response2.ok)
+            throw new Error(`namespace creation refused: ${canonical(await response2.json())}`);
+          created.push(namespace);
+        }
+        const selected = new Map(Object.keys(ns.services).map((name) => [name, this.ctx.children.get(name)]));
+        const values = /* @__PURE__ */ new Map();
+        const oldClock = this.ctx.clock(namespace).state();
+        const response = await this.ctx.transaction(namespace, selected, async (name, child) => {
+          values.set(name, await child.checkpoint(namespace));
+          await child.restore(namespace, await child.importCheckpoint?.(namespace, ns.services[name]?.state));
+        }, true);
+        if (!response.ok)
+          throw new Error(`restore ${namespace} failed: ${canonical(await response.json())}`);
+        rollback.push({ namespace, selected, values, clock: oldClock });
+        restoreClock(this.ctx.clock(namespace), ns.clock);
+        this.remember(namespace).generation = randomUUID3();
+      }
+    } catch (error) {
+      const failures = [];
+      for (const point of rollback.reverse()) {
+        const response = await this.ctx.transaction(point.namespace, point.selected, async (name, child) => child.restore(point.namespace, point.values.get(name)), true);
+        if (!response.ok)
+          failures.push(point.namespace);
+        else
+          restoreClock(this.ctx.clock(point.namespace), point.clock);
+      }
+      for (const namespace of created.reverse()) {
+        const response = await this.deleteNamespace(namespace);
+        if (!response.ok)
+          failures.push(namespace);
+      }
+      if (failures.length)
+        throw new Error(`archive rollback requires recovery for ${failures.join(", ")}`, {
+          cause: error
+        });
+      throw error;
+    }
+  }
+  async applyProfile(namespace, input, extra, seedApplication) {
+    if (!object2(input) || !Object.keys(input).length)
+      throw new Error("expected nonempty service control profile");
+    const selected = this.select({ services: Object.keys(input) });
+    for (const [name, child] of selected) {
+      const controls = input[name];
+      if (!object2(controls))
+        throw new Error(`expected controls for ${name}`);
+      normalizeControls(controls, `profile.${name}`);
+      if (child.protocol !== "http" && Object.keys(controls).some((key) => key !== "clock"))
+        throw new Error(`unsupported protocol controls for ${name}`);
+    }
+    return this.ctx.transaction(namespace, selected, async (name, child) => {
+      const controls = input[name];
+      if (child.configure)
+        await child.configure(namespace, controls);
+      else {
+        const plan = normalizeControls(controls);
+        if (plan.clock?.frozen === true)
+          child.clock(namespace).freeze();
+        if (plan.clock?.now !== void 0)
+          child.clock(namespace).set(plan.clock.now);
+        if (plan.clock?.frozen === false)
+          child.clock(namespace).unfreeze();
+      }
+      await extra?.(name, child);
+      if (name === [...selected.keys()].at(-1) && seedApplication) {
+        const operation = [...this.operations.values()].find((o) => o.namespace === namespace && o.status === "running");
+        const token = randomBytes(32).toString("base64url");
+        this.privateRequests.set(namespace, token);
+        const access = [];
+        const connections = {};
+        try {
+          for (const [service, target] of selected) {
+            if (target.initializationAccess) {
+              const seedAccess = await target.initializationAccess();
+              access.push(seedAccess);
+              const url = seedAccess.connections[namespace];
+              if (url)
+                connections[service] = { url, namespaces: { [namespace]: url } };
+            } else
+              connections[service] = { url: target.url, namespaces: {} };
+          }
+          const signal = AbortSignal.timeout(this.ctx.options.hookTimeoutMs ?? 3e4);
+          await Promise.race([
+            seedApplication({
+              namespace,
+              services: [...selected.keys()],
+              operationId: operation?.id ?? randomUUID3(),
+              signal,
+              manifest: this.ctx.manifest(),
+              connections,
+              headers: { "x-mockingbird-initializer": token, "x-mockingbird-namespace": namespace }
+            }),
+            new Promise((_, reject) => signal.addEventListener("abort", () => reject(new Error("application seed hook timed out")), { once: true }))
+          ]);
+        } catch (error) {
+          throw Object.assign(new Error("application seed hook failed; recovery required", { cause: error }), { code: "MOCKINGBIRD_WORKLOAD_UNCERTAIN" });
+        } finally {
+          this.privateRequests.delete(namespace);
+          await Promise.all(access.map((a) => a.close()));
+        }
+      }
+    });
+  }
+  async backup(namespaces, operationId) {
+    if (!this.ctx.options.repository)
+      throw new Error("archive repository is not configured");
+    if (this.backupRunning)
+      throw new Error("backup is already running; overlapping run skipped");
+    this.backupRunning = true;
+    this.backupStatus.lastAttempt = (/* @__PURE__ */ new Date()).toISOString();
+    try {
+      const archive = await this.capture(namespaces);
+      for (const namespace of namespaces)
+        this.phase(namespace, "uploading");
+      if (operationId)
+        await this.journalPhase(operationId, "uploading", { after: archive.sha256 });
+      const id = await this.ctx.options.repository.put(archive);
+      for (const namespace of namespaces)
+        this.phase(namespace, "verifying-upload");
+      const verified = validateArchive(await this.ctx.options.repository.get(id));
+      if (verified.sha256 !== archive.sha256)
+        throw new Error("backup verification failed");
+      if (operationId)
+        await this.journalPhase(operationId, "publishing", this.ctx.options.repository.writerGeneration !== void 0 ? { writerGeneration: this.ctx.options.repository.writerGeneration } : {});
+      for (const namespace of namespaces)
+        this.phase(namespace, "publishing");
+      await this.ctx.options.repository.publishLatest(id);
+      const publication = await this.ctx.options.repository.publicationMetadata?.();
+      if (operationId && publication)
+        await this.journalPhase(operationId, "publishing", {
+          writerGeneration: publication.generation
+        });
+      this.backupStatus.lastSuccess = (/* @__PURE__ */ new Date()).toISOString();
+      this.backupStatus.archiveId = id;
+      delete this.backupStatus.lastFailure;
+      const keep = this.ctx.options.backupPolicy?.keep;
+      if (keep !== void 0) {
+        const archives = await this.ctx.options.repository.list();
+        for (const old of archives.slice(0, Math.max(0, archives.length - keep)))
+          if (old !== id)
+            await this.ctx.options.repository.delete(old);
+      }
+      return { id, sha256: archive.sha256, verified: true };
+    } catch (error) {
+      this.backupStatus.lastFailure = error instanceof Error ? error.message : "backup failed";
+      throw error;
+    } finally {
+      this.backupRunning = false;
+    }
+  }
+  cleanupPreview() {
+    return this.namespaceStatus().filter((entry) => entry.namespace !== "default").map((entry) => {
+      let busy = true;
+      try {
+        busy = this.busy(entry.namespace).length > 0 || [...this.ctx.children.values()].some((c) => c.diagnostics(entry.namespace).activeConnections > 0);
+      } catch {
+      }
+      return {
+        namespace: entry.namespace,
+        expiresAt: entry.expiresAt,
+        pinned: entry.pinned,
+        eligible: entry.expiresAt !== void 0 && !entry.pinned && !busy && entry.status === "ready" && !this.topology.has(entry.namespace) && Date.now() >= (entry.expiresAt ?? Infinity)
+      };
+    });
+  }
+  async startPolicies() {
+    if (this.ctx.options.repository && this.ctx.options.backupPolicy) {
+      try {
+        const id = await this.ctx.options.repository.latest();
+        if (id) {
+          await this.ctx.options.repository.get(id);
+          this.backupStatus.archiveId = id;
+          this.backupStatus.lastSuccess = (/* @__PURE__ */ new Date()).toISOString();
+        }
+      } catch (error) {
+        this.backupStatus.lastFailure = error instanceof Error ? error.message : "repository recovery failed";
+      }
+    }
+    this.lifecycle = "ready";
+    const policy = this.ctx.options.backupPolicy;
+    if (policy) {
+      if (!Number.isFinite(policy.intervalMs) || policy.intervalMs < 10)
+        throw new Error("backup intervalMs must be at least 10");
+      const schedule = () => {
+        this.backupStatus.nextRun = new Date(Date.now() + policy.intervalMs).toISOString();
+        if (!this.backupRunning)
+          void this.backup(policy.namespaces ?? [...this.namespaces.keys()]).catch(() => {
+          });
+      };
+      this.backupStatus.nextRun = new Date(Date.now() + policy.intervalMs).toISOString();
+      this.timer = setInterval(schedule, policy.intervalMs);
+      this.timer.unref?.();
+    }
+    const expiry = this.ctx.options.expiry;
+    if (expiry) {
+      if (!Number.isFinite(expiry.idleMs) || expiry.idleMs < 1)
+        throw new Error("expiry idleMs must be positive");
+      this.expiryTimer = setInterval(() => {
+        for (const entry of this.cleanupPreview())
+          if (entry.eligible)
+            void (async () => {
+              if (expiry.finalBackup)
+                await this.backup([entry.namespace]);
+              await this.deleteNamespace(entry.namespace);
+            })().catch(() => {
+            });
+      }, expiry.intervalMs ?? 6e4);
+      this.expiryTimer.unref?.();
+    }
+  }
+  stopPolicies() {
+    clearInterval(this.timer);
+    clearInterval(this.expiryTimer);
+  }
+};
+var fleetConsole = (prefix) => `<!doctype html><html lang="en"><meta charset="utf-8"><meta name="viewport" content="width=device-width"><title>Mockingbird Fleet</title><style>body{font:16px system-ui;max-width:1000px;margin:3rem auto;padding:1rem;background:#10151b;color:#e0e9f2}input,select,button{padding:.7rem;margin:.3rem;background:#233142;color:inherit;border:1px solid #60768b;border-radius:5px}pre{white-space:pre-wrap;overflow-wrap:anywhere}a{color:#9fdbff}</style><h1>Mockingbird Fleet</h1><label>Admin key <input id="key" type="password" autocomplete="off"></label><label>Namespace <input id="ns" value="default"></label><button id="refresh">Refresh</button><section id="children"></section><label>Action <select id="action"><option value="snapshots">Capture checkpoint</option><option value="reset">Reset namespace</option></select></label><button id="run">Run</button><h2>Lifecycle and operations</h2><pre id="result"></pre><script type="module">const base=${JSON.stringify(`${prefix}/fleet`)};const key=document.querySelector('#key'),ns=document.querySelector('#ns'),result=document.querySelector('#result');async function api(path,method='GET',body){const r=await fetch(base+path,{method,headers:{'content-type':'application/json','x-mockingbird-admin-key':key.value},...(body?{body:JSON.stringify(body)}:{})});const data=await r.json();result.textContent=JSON.stringify(data,null,2);return data}document.querySelector('#refresh').onclick=async()=>{const data=await api('');const host=document.querySelector('#children');host.replaceChildren();for(const [name,child]of Object.entries(data.manifest?.services??{})){const link=document.createElement('a');link.href=child.adminUrl;link.textContent=name+' ('+child.protocol+') ';host.append(link)}await api('/operations?namespace='+encodeURIComponent(ns.value))};document.querySelector('#run').onclick=()=>api('/namespaces/'+encodeURIComponent(ns.value)+'/'+document.querySelector('#action').value,'POST',{});</script></html>`;
+
+// ../../adapters/node/dist/fleet-preflight.js
+import { readFile, realpath } from "node:fs/promises";
+import { createRequire } from "node:module";
+import { basename, dirname, resolve } from "node:path";
+
+// ../../adapters/node/dist/fleet-config.schema.json
+var fleet_config_schema_default = {
+  $schema: "https://json-schema.org/draft/2020-12/schema",
+  $id: "https://mockingbird.chrisvouga.dev/schemas/fleet-v1.json",
+  title: "Mockingbird fleet configuration v1",
+  type: "object",
+  required: ["services"],
+  additionalProperties: false,
+  properties: {
+    $schema: {
+      const: "https://mockingbird.chrisvouga.dev/schemas/fleet-v1.json"
+    },
+    schemaVersion: {
+      const: 1
+    },
+    services: {
+      type: "object",
+      propertyNames: {
+        pattern: "^[a-z0-9]+(?:-[a-z0-9]+)*$"
+      },
+      additionalProperties: {
+        $ref: "#/$defs/service"
+      }
+    },
+    log: {
+      enum: ["pretty", "json", "off"]
+    },
+    adminPrefix: {
+      type: "string"
+    },
+    adminKey: {
+      type: "string"
+    },
+    adminControls: {
+      $ref: "#/$defs/controls"
+    },
+    namespace: {
+      type: "string",
+      pattern: "^[A-Za-z0-9_.-]{1,64}$"
+    },
+    control: {
+      type: "object",
+      additionalProperties: false,
+      properties: {
+        port: {
+          type: "integer",
+          minimum: 0,
+          maximum: 65535
+        },
+        host: {
+          type: "string"
+        }
+      }
+    },
+    cors: {
+      type: "object",
+      required: ["origins"],
+      additionalProperties: false,
+      properties: {
+        origins: {
+          type: "array",
+          items: {
+            type: "string"
+          }
+        },
+        methods: {
+          type: "array",
+          items: {
+            enum: ["GET", "POST", "PUT", "DELETE", "HEAD", "OPTIONS"]
+          }
+        },
+        headers: {
+          type: "array",
+          items: {
+            type: "string"
+          }
+        }
+      }
+    },
+    extensions: {
+      type: "object",
+      propertyNames: {
+        pattern: "^x-[a-z0-9-]+$"
+      },
+      additionalProperties: false
+    }
+  },
+  $defs: {
+    service: {
+      type: "object",
+      additionalProperties: false,
+      properties: {
+        target: {
+          type: "string",
+          pattern: "^[a-z0-9]+(?:-[a-z0-9]+)*$"
+        },
+        dependsOn: {
+          type: "array",
+          items: {
+            type: "string"
+          }
+        },
+        protocol: {
+          enum: ["http", "postgres", "redis"]
+        },
+        port: {
+          type: "integer",
+          minimum: 0,
+          maximum: 65535
+        },
+        host: {
+          type: "string"
+        },
+        adminPrefix: {
+          type: "string"
+        },
+        adminKey: {
+          type: "string"
+        },
+        seed: {
+          type: "string"
+        },
+        adminControls: {
+          $ref: "#/$defs/controls"
+        },
+        fixtures: {
+          type: "object"
+        },
+        baseUrl: {
+          type: "string"
+        },
+        password: {
+          type: "string"
+        },
+        user: {
+          type: "string"
+        },
+        database: {
+          type: "string"
+        },
+        namespaces: {
+          type: "object",
+          propertyNames: {
+            pattern: "^[A-Za-z0-9_.-]{1,64}$"
+          },
+          additionalProperties: {
+            anyOf: [
+              {
+                type: "string"
+              },
+              {
+                type: "integer",
+                minimum: 0,
+                maximum: 15
+              }
+            ]
+          }
+        },
+        options: {
+          type: "object",
+          additionalProperties: false,
+          description: "Compose the selected target option schema before supplying service-specific flags."
+        },
+        publicOrigin: {
+          type: "string"
+        },
+        publicPath: {
+          type: "string"
+        }
+      }
+    },
+    controls: {
+      type: "object",
+      additionalProperties: false,
+      properties: {
+        seed: {},
+        clock: {
+          type: "object"
+        },
+        latency: {},
+        faults: {
+          type: "array"
+        },
+        snapshot: {
+          type: "object"
+        },
+        virtualTime: {
+          type: "boolean"
+        },
+        credentials: {
+          type: "object"
+        },
+        namespaces: {
+          type: "object"
+        }
+      }
+    }
+  }
+};
+
+// ../../adapters/node/dist/fleet-schema.js
+var object3 = (v) => v !== null && typeof v === "object" && !Array.isArray(v);
+function validateFleetConfig(value, targetOptions = {}, extensions = {}) {
+  const composed = composeFleetSchema(value, targetOptions, extensions), issues = [];
+  const walk = (input, rule, path, output) => {
+    if (rule.$ref) {
+      const resolved = composed.$defs?.[rule.$ref.slice("#/$defs/".length)];
+      if (!resolved)
+        output.push({ path, message: "unresolved configuration schema" });
+      else
+        walk(input, resolved, path, output);
+      return;
+    }
+    if (rule.anyOf) {
+      if (!rule.anyOf.some((branch) => {
+        const found = [];
+        walk(input, branch, path, found);
+        return found.length === 0;
+      }))
+        output.push({ path, message: "value does not match an allowed shape" });
+      return;
+    }
+    if ("const" in rule && input !== rule.const) {
+      output.push({
+        path,
+        message: path === "$.schemaVersion" || path === "$.$schema" ? "unsupported fleet schema version; upgrade the consumer/schema together" : "unexpected fixed value"
+      });
+      return;
+    }
+    if (rule.enum && !rule.enum.includes(input))
+      output.push({ path, message: "unsupported enumerated value" });
+    if (rule.type) {
+      const valid = rule.type === "object" ? object3(input) : rule.type === "array" ? Array.isArray(input) : rule.type === "integer" ? typeof input === "number" && Number.isInteger(input) : typeof input === rule.type;
+      if (!valid) {
+        output.push({ path, message: `expected ${rule.type}` });
+        return;
+      }
+    }
+    if (typeof input === "number" && (rule.minimum !== void 0 && input < rule.minimum || rule.maximum !== void 0 && input > rule.maximum))
+      output.push({ path, message: "number outside supported bounds" });
+    if (typeof input === "string" && rule.pattern && !new RegExp(rule.pattern).test(input))
+      output.push({ path, message: "invalid identifier" });
+    if (Array.isArray(input) && rule.items)
+      input.forEach((entry, index) => {
+        walk(entry, rule.items, `${path}[${index}]`, output);
+      });
+    if (object3(input)) {
+      for (const name of rule.required ?? [])
+        if (!Object.hasOwn(input, name))
+          output.push({ path: `${path}.${name}`, message: "required field missing" });
+      for (const [key, entry] of Object.entries(input)) {
+        if (rule.propertyNames)
+          walk(key, rule.propertyNames, `${path}.${key}`, output);
+        const property = rule.properties?.[key];
+        if (property)
+          walk(entry, property, `${path}.${key}`, output);
+        else if (rule.additionalProperties === false)
+          output.push({ path: `${path}.${key}`, message: "unknown configuration field" });
+        else if (object3(rule.additionalProperties))
+          walk(entry, rule.additionalProperties, `${path}.${key}`, output);
+      }
+    }
+  };
+  walk(value, composed, "$", issues);
+  return issues;
+}
+function composeFleetSchema(value, targetOptions = {}, extensions = {}) {
+  const composed = structuredClone(fleet_config_schema_default);
+  const serviceRule = composed.$defs?.service;
+  const servicesRule = composed.properties?.services;
+  servicesRule.properties = {};
+  if (object3(value) && object3(value.services))
+    for (const [instance, entry] of Object.entries(value.services)) {
+      if (!object3(entry))
+        continue;
+      const target = typeof entry.target === "string" ? entry.target : instance;
+      const declared = targetOptions[target] ?? {};
+      const configured = structuredClone(serviceRule);
+      configured.properties = {
+        ...configured.properties,
+        options: {
+          type: "object",
+          additionalProperties: false,
+          properties: Object.fromEntries(Object.entries(declared).map(([key, option]) => [key, { type: option.type }]))
+        }
+      };
+      servicesRule.properties[instance] = configured;
+    }
+  if (composed.properties?.extensions)
+    composed.properties.extensions.properties = extensions;
+  return composed;
+}
+function assertFleetConfig(config, targetOptions = {}) {
+  const issues = validateFleetConfig(config, targetOptions);
+  if (issues.length)
+    throw new Error(issues.slice(0, 20).map((i) => `${i.path}: ${i.message}`).join("; "));
+}
+
+// ../../adapters/node/dist/fleet-preflight.js
+var destination = async (path) => {
+  const absolute = resolve(path);
+  try {
+    return await realpath(absolute);
+  } catch (error) {
+    if (error.code !== "ENOENT")
+      throw error;
+    const parent = dirname(absolute);
+    return parent === absolute ? absolute : resolve(await destination(parent), basename(absolute));
+  }
+};
+async function preflightFleet(config, options) {
+  if (options.readyFile && options.connectionsFile && await destination(options.readyFile) === await destination(options.connectionsFile))
+    throw new Error("ready-file and connections-file destinations must differ");
+  if (!config.services || typeof config.services !== "object" || !Object.keys(config.services).length && !Object.keys(options.participants ?? {}).length)
+    throw new Error("config must contain at least one service");
+  validateFleetPolicies(options);
+  if (options.archiveProtection && options.repository && options.repository.protectionPolicy?.format !== options.archiveProtection.policy.format)
+    throw new Error("protected archive policy requires a protected repository; configure its protector before startup");
+  resolveAdminPrefix(config.adminPrefix);
+  normalizeBootControls(config.adminControls);
+  const targets = /* @__PURE__ */ new Map();
+  const ports = /* @__PURE__ */ new Set();
+  for (const [name, entry] of Object.entries(config.services)) {
+    try {
+      if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(name))
+        throw new Error("invalid service name");
+      if (!entry || typeof entry !== "object" || Array.isArray(entry))
+        throw new Error("expected service object");
+      resolveAdminPrefix(entry.adminPrefix ?? config.adminPrefix);
+      normalizeBootControls({ ...config.adminControls, ...entry.adminControls }, `services.${name}.adminControls`);
+      if (entry.port !== void 0 && (!Number.isInteger(entry.port) || entry.port < 0 || entry.port > 65535))
+        throw new Error("invalid port");
+      if (entry.target !== void 0 && !/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(entry.target))
+        throw new Error("target must name a supported service suffix");
+      const service = entry.target ?? name;
+      if (advertisedHttpBase(entry) && service !== "stripe")
+        throw new Error(`public ingress unsupported for ${service}; use a direct endpoint to preserve signed targets`);
+      const target = await options.load(service);
+      const protocol = "protocol" in target ? target.protocol : "http";
+      if (entry.protocol !== void 0 && entry.protocol !== protocol)
+        throw new Error("configured protocol does not match target");
+      if (protocol !== "http") {
+        if (entry.seed !== void 0 && (!String(entry.seed).trim() || !Number.isFinite(Number(entry.seed))))
+          throw new Error("protocol seed must be a finite number");
+        for (const [namespace, selector] of Object.entries(entry.namespaces ?? {})) {
+          if (!/^[A-Za-z0-9_.-]{1,64}$/.test(namespace))
+            throw new Error("invalid namespace");
+          if (protocol === "postgres" ? typeof selector !== "string" || !selector.length : typeof selector !== "number" || !Number.isInteger(selector) || selector < 0 || selector > 15)
+            throw new Error("invalid protocol namespace selector");
+        }
+      }
+      const port = entry.port ?? target.defaultPort;
+      if (port !== 0) {
+        const key = `${entry.host ?? "127.0.0.1"}:${port}`;
+        if (ports.has(key))
+          throw new Error(`duplicate listener ${key}`);
+        ports.add(key);
+      }
+      let packageVersion = target.packageVersion;
+      if (!packageVersion) {
+        for (const from of [
+          createRequire(resolve(process.cwd(), "package.json")),
+          createRequire(import.meta.url)
+        ]) {
+          try {
+            let directory = dirname(from.resolve(`@crvouga/mockingbird-service-${service}/server`));
+            for (; ; ) {
+              try {
+                const manifest = JSON.parse(await readFile(resolve(directory, "package.json"), "utf8"));
+                if (manifest.name === `@crvouga/mockingbird-service-${service}`) {
+                  packageVersion = manifest.version;
+                  break;
+                }
+              } catch {
+              }
+              const parent = dirname(directory);
+              if (parent === directory)
+                break;
+              directory = parent;
+            }
+          } catch {
+          }
+          if (packageVersion)
+            break;
+        }
+      }
+      targets.set(name, { ...target, packageVersion: packageVersion ?? "1.4.0" });
+    } catch (error) {
+      throw new Error(`service ${name}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+    }
+  }
+  for (const [name, participant] of Object.entries(options.participants ?? {})) {
+    if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(name) || targets.has(name))
+      throw new Error(`external participant identity collision ${name}`);
+    if (participant.protocol !== "external")
+      throw new Error(`registered participant ${name} must declare external protocol`);
+    targets.set(name, {
+      name,
+      protocol: "external",
+      defaultPort: 0,
+      start: async () => participant
+    });
+  }
+  assertFleetConfig(config, Object.fromEntries([...targets].map(([name, target]) => [
+    config.services[name]?.target ?? name,
+    "options" in target ? target.options ?? {} : {}
+  ])));
+  const ordered = /* @__PURE__ */ new Map();
+  const visiting = /* @__PURE__ */ new Set();
+  const visit = (name, chain) => {
+    if (ordered.has(name))
+      return;
+    if (!targets.has(name))
+      throw new Error(`unknown dependency ${[...chain, name].join(" -> ")}`);
+    if (visiting.has(name))
+      throw new Error(`dependency cycle ${[...chain, name].join(" -> ")}`);
+    visiting.add(name);
+    const dependencies = config.services[name]?.dependsOn ?? options.participants?.[name]?.dependencies ?? [];
+    if (!Array.isArray(dependencies) || dependencies.some((d) => typeof d !== "string"))
+      throw new Error(`services.${name}.dependsOn must be a list of instance names`);
+    for (const dependency of dependencies)
+      visit(dependency, [...chain, name]);
+    visiting.delete(name);
+    ordered.set(name, targets.get(name));
+  };
+  for (const name of targets.keys())
+    visit(name, []);
+  return ordered;
+}
+function validateFleetPolicies(options) {
+  if (options.journal && !options.repository)
+    throw new Error("durable operation journal requires an archive repository");
+  if (options.cors) {
+    if (!Array.isArray(options.cors.origins) || options.cors.origins.some((o) => {
+      try {
+        const u = new URL(o);
+        return !["http:", "https:"].includes(u.protocol) || u.origin !== o;
+      } catch {
+        return true;
+      }
+    }))
+      throw new Error("cors.origins must contain explicit HTTP origins");
+    if (options.cors.methods?.some((m) => !["GET", "POST", "PUT", "DELETE", "HEAD", "OPTIONS"].includes(m)) || options.cors.headers?.some((h) => !/^[a-zA-Z0-9-]+$/.test(h)))
+      throw new Error("invalid CORS methods/headers");
+  }
+  for (const [key, value] of Object.entries(options.limits ?? {})) {
+    if (!["maxNamespaces", "maxListeners", "connections"].includes(key))
+      throw new Error(`unsupported namespace budget ${key}`);
+    if (!Number.isSafeInteger(value) || value < 0)
+      throw new Error(`invalid limit ${key}`);
+  }
+  for (const [key, value] of Object.entries(options.retention ?? {}))
+    if (!["maxCount", "ttlMs"].includes(key) || !Number.isSafeInteger(value) || value < 1)
+      throw new Error(`invalid retention ${key}`);
+  if (options.backupPolicy && (!options.repository || !Number.isSafeInteger(options.backupPolicy.intervalMs) || options.backupPolicy.intervalMs < 10 || options.backupPolicy.keep !== void 0 && (!Number.isSafeInteger(options.backupPolicy.keep) || options.backupPolicy.keep < 1)))
+    throw new Error("backup policy requires a repository, intervalMs >= 10 and positive retention");
+  if (options.expiry && (!Number.isSafeInteger(options.expiry.idleMs) || options.expiry.idleMs < 1 || options.expiry.intervalMs !== void 0 && (!Number.isSafeInteger(options.expiry.intervalMs) || options.expiry.intervalMs < 10) || options.expiry.finalBackup && !options.repository))
+    throw new Error("invalid expiry policy or missing final-backup repository");
+  for (const duration of [
+    options.hookTimeoutMs,
+    options.initializationTimeoutMs,
+    options.shutdownTimeoutMs
+  ])
+    if (duration !== void 0 && (!Number.isSafeInteger(duration) || duration < 1))
+      throw new Error("hook deadlines must be positive integer milliseconds");
+}
 
 // ../../adapters/node/dist/serve.js
 import { createServer } from "node:http";
+import { Readable } from "node:stream";
 var serve = async (api, options = {}) => {
+  const maxBytes = options.maxBodyBytes ?? 16 * 1024 * 1024;
+  const timeoutMs = options.requestTimeoutMs ?? 3e4;
+  if (!Number.isSafeInteger(maxBytes) || maxBytes < 0 || !Number.isSafeInteger(timeoutMs) || timeoutMs < 1)
+    throw new Error("invalid request limits");
   const server = createServer(async (req, res) => {
-    const chunks = [];
-    for await (const chunk of req) {
-      chunks.push(Buffer.from(chunk));
-    }
-    const body = Buffer.concat(chunks);
-    const address = server.address();
-    const port = typeof address === "object" && address !== null ? address.port : void 0;
-    const base = `http://${req.headers.host ?? `localhost:${port ?? 80}`}`;
-    const raw = req.url ?? "/";
-    const url = new URL(raw.replace(/^\/+/, "/"), base);
-    const method = req.method ?? "GET";
-    const init = { method, headers: req.headers };
-    if (method !== "GET" && method !== "HEAD" && body.length > 0) {
-      init.body = body;
-    }
     const aborted = new AbortController();
-    res.once("close", () => {
-      if (!res.writableFinished)
-        aborted.abort();
-    });
-    init.signal = aborted.signal;
-    const request = new Request(url, init);
-    let response;
+    let reader;
+    let timer;
+    const abort = () => {
+      aborted.abort();
+      void reader?.cancel().catch(() => {
+      });
+    };
+    const fail = (status, message) => {
+      if (!res.headersSent && !res.destroyed) {
+        res.writeHead(status, { "content-type": "application/json", connection: "close" });
+        res.end(JSON.stringify({ error: { type: "mockingbird_transport", message } }));
+      }
+      abort();
+    };
+    req.once("aborted", abort);
+    res.once("close", abort);
+    res.once("error", abort);
     try {
-      response = await api.fetch(request);
-    } catch (error) {
-      if (error.code === "MOCKINGBIRD_DROP") {
-        req.socket.destroy();
-        return;
+      const address = server.address();
+      const port = typeof address === "object" && address !== null ? address.port : 80;
+      const url = new URL((req.url ?? "/").replace(/^\/+/, "/"), `http://${req.headers.host ?? `localhost:${port}`}`);
+      const headers = new Headers();
+      for (const [name, value] of Object.entries(req.headers)) {
+        if (Array.isArray(value))
+          for (const item of value)
+            headers.append(name, item);
+        else if (value !== void 0)
+          headers.set(name, value);
       }
-      res.writeHead(500, { "content-type": "application/json" });
-      res.end(JSON.stringify({
-        error: {
-          type: "mockingbird_internal",
-          message: error instanceof Error ? error.message : String(error)
+      const init = {
+        method: req.method ?? "GET",
+        headers,
+        signal: aborted.signal
+      };
+      if (init.method !== "GET" && init.method !== "HEAD") {
+        if (Number(req.headers["content-length"]) > maxBytes) {
+          fail(413, "request body exceeds byte limit");
+          return;
         }
-      }));
-      return;
-    }
-    const headers = Object.fromEntries(response.headers);
-    const cookies = response.headers.getSetCookie();
-    if (cookies.length > 0)
-      headers["set-cookie"] = cookies;
-    if (!response.body) {
-      res.writeHead(response.status, headers);
-      res.end();
-      return;
-    }
-    res.writeHead(response.status, headers);
-    res.flushHeaders();
-    const reader = response.body.getReader();
-    try {
+        let bytes = 0;
+        const source = Readable.toWeb(req);
+        init.body = source.pipeThrough(new TransformStream({
+          transform(chunk, controller) {
+            bytes += chunk.byteLength;
+            if (bytes > maxBytes) {
+              fail(413, "request body exceeds byte limit");
+              controller.error(new Error("request body exceeds byte limit"));
+            } else
+              controller.enqueue(chunk);
+          }
+        }));
+        init.duplex = "half";
+        timer = setTimeout(() => fail(408, "request body timed out"), timeoutMs);
+        req.once("end", () => clearTimeout(timer));
+      }
+      const response = await api.fetch(new Request(url, init));
+      if (aborted.signal.aborted || res.destroyed) {
+        await response.body?.cancel();
+        return;
+      }
+      const output = Object.fromEntries(response.headers);
+      const cookies = response.headers.getSetCookie();
+      if (cookies.length)
+        output["set-cookie"] = cookies;
+      res.writeHead(response.status, output);
+      if (!response.body) {
+        res.end();
+        return;
+      }
+      res.flushHeaders();
+      reader = response.body.getReader();
       for (; ; ) {
         const { done, value } = await reader.read();
-        if (done)
+        if (done || aborted.signal.aborted)
           break;
-        if (!res.write(value))
-          await new Promise((resolve2) => res.once("drain", resolve2));
+        if (!res.write(value)) {
+          await new Promise((resolve4) => {
+            const finish = () => {
+              res.off("drain", finish);
+              res.off("close", finish);
+              res.off("error", finish);
+              resolve4();
+            };
+            res.once("drain", finish);
+            res.once("close", finish);
+            res.once("error", finish);
+            if (res.destroyed || aborted.signal.aborted)
+              finish();
+          });
+        }
+      }
+      if (!aborted.signal.aborted)
+        res.end();
+    } catch (error) {
+      if (error.code === "MOCKINGBIRD_DROP")
+        req.socket.destroy();
+      else if (!aborted.signal.aborted && !res.destroyed) {
+        if (res.headersSent)
+          res.destroy();
+        else {
+          res.writeHead(500, { "content-type": "application/json" });
+          res.end(JSON.stringify({
+            error: {
+              type: "mockingbird_internal",
+              message: error instanceof Error ? error.message : String(error)
+            }
+          }));
+        }
       }
-      res.end();
-    } catch {
-      res.destroy();
     } finally {
-      reader.releaseLock();
+      clearTimeout(timer);
+      reader?.releaseLock();
+      req.off("aborted", abort);
+      res.off("close", abort);
+      res.off("error", abort);
+      if (!req.complete)
+        req.resume();
     }
   });
-  await new Promise((resolve2, reject) => {
+  server.requestTimeout = timeoutMs;
+  await new Promise((resolve4, reject) => {
     server.once("error", reject);
-    server.listen(options.port ?? 0, options.host, resolve2);
+    server.listen(options.port ?? 0, options.host, resolve4);
   });
   return server;
 };
@@ -108,12 +3203,12 @@ var listen = async (api, options = {}) => {
     port,
     host,
     server,
-    close: () => new Promise((resolve2, reject) => {
+    close: () => new Promise((resolve4, reject) => {
       server.close((error) => {
         if (error && error.code !== "ERR_SERVER_NOT_RUNNING")
           reject(error);
         else
-          resolve2();
+          resolve4();
       });
       server.closeAllConnections?.();
     })
@@ -130,7 +3225,26 @@ var EMPTY = {
   unmatchedRequests: 0
 };
 var NS = /^[A-Za-z0-9_.-]{1,64}$/;
-var json = (status, value) => Response.json(value, { status });
+var json = (status, value) => {
+  if (status >= 400 && isObject(value)) {
+    const message = typeof value.error === "string" ? value.error : typeof value.message === "string" ? value.message : value.status === "failed" ? "fleet operation failed" : "fleet request rejected";
+    return Response.json({
+      ...value,
+      error: {
+        type: "mockingbird_admin",
+        code: {
+          400: "invalid_request",
+          401: "unauthorized",
+          404: "not_found",
+          409: "conflict",
+          500: "operation_failed"
+        }[status] ?? "request_failed",
+        message
+      }
+    }, { status });
+  }
+  return Response.json(value, { status });
+};
 var isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 var pending = (d) => d.activeRequests + d.blockedCommands + d.pendingJobs + d.pendingWebhooks;
 var publicUrl = (raw) => {
@@ -139,7 +3253,7 @@ var publicUrl = (raw) => {
   return url.href;
 };
 var atomicWrite = async (path, value) => {
-  const temp = `${path}.${randomUUID()}.tmp`;
+  const temp = `${path}.${randomUUID4()}.tmp`;
   try {
     await writeFile(temp, `${JSON.stringify(value, null, 2)}
 `, { mode: 384, flag: "wx" });
@@ -153,7 +3267,7 @@ var removeOwned = async (path, id) => {
   if (!path)
     return;
   try {
-    const value = JSON.parse(await readFile(path, "utf8"));
+    const value = JSON.parse(await readFile2(path, "utf8"));
     if (isObject(value) && value.id === id)
       await rm(path, { force: true });
   } catch (error) {
@@ -161,29 +3275,114 @@ var removeOwned = async (path, id) => {
       throw error;
   }
 };
-var httpChild = async (target, entry, options) => {
-  const runtime = await target.create(entry.options ?? {}, {
+var httpChild = async (target, entry, options, admission, generation, privateAccess, observer) => {
+  const requestLog = new AsyncLocalStorage2();
+  const created = await target.create(entry.options ?? {}, {
     adminPrefix: resolveAdminPrefix(entry.adminPrefix),
     adminKey: entry.adminKey,
     seed: entry.seed,
-    onLog: options.onLog,
+    onLog: (entry2) => {
+      const current = requestLog.getStore();
+      if (current)
+        current.entry = entry2;
+      options.onLog?.(entry2);
+    },
+    ...entry.adminControls !== void 0 ? { adminControls: entry.adminControls } : {},
     ...entry.fixtures !== void 0 ? { fixtures: entry.fixtures } : {},
-    ...entry.baseUrl !== void 0 ? { baseUrl: entry.baseUrl } : {}
+    ...(advertisedHttpBase(entry) ?? entry.baseUrl) !== void 0 ? { baseUrl: advertisedHttpBase(entry) ?? entry.baseUrl } : {}
   });
+  if (!isObject(created) || [
+    "fetch",
+    "fleetSnapshot",
+    "fleetRestore",
+    "fleetExport",
+    "fleetImport",
+    "namespaceOf",
+    "instance",
+    "namespaceClock",
+    "reset",
+    "configure",
+    "dropNamespace"
+  ].some((method) => typeof created[method] !== "function"))
+    throw new Error("HTTP target does not implement the fleet runtime protocol; build/install matching supported service versions");
+  const runtime = created;
+  const unobserve = runtime.webhooks?.observeDeliveries(observer.delivery);
+  if (options.outbound && runtime.webhooks)
+    runtime.webhooks.setTransportPolicy(ownedTransport(options.outbound));
   const adminPrefix = resolveAdminPrefix(entry.adminPrefix);
-  runtime.isolateNamespaces();
   const locked = /* @__PURE__ */ new Set();
   const active = /* @__PURE__ */ new Map();
+  const activity = /* @__PURE__ */ new Map();
   const api = {
     async fetch(request) {
       const namespace = runtime.namespaceOf(request);
-      if (locked.has(namespace))
+      if (locked.has(namespace) && !privateAccess(namespace, request))
         return json(409, { error: "fleet control in progress", namespace });
+      if (!new URL(request.url).pathname.endsWith(`${adminPrefix}/health`)) {
+        const refused = admission(namespace, request);
+        if (refused)
+          return refused;
+      }
+      activity.set(namespace, Date.now());
       active.set(namespace, (active.get(namespace) ?? 0) + 1);
-      try {
-        return await runtime.fetch(request);
-      } finally {
+      let complete = false;
+      const finish = () => {
+        if (complete)
+          return;
+        complete = true;
         active.set(namespace, (active.get(namespace) ?? 1) - 1);
+        request.signal.removeEventListener("abort", finish);
+      };
+      request.signal.addEventListener("abort", finish, { once: true });
+      try {
+        const log = {}, traceToken = observer.begin(namespace, request), started = performance.now();
+        const response = await requestLog.run(log, () => runtime.fetch(request));
+        await observer.finish(namespace, request, response, log.entry ?? {
+          service: target.name,
+          namespace,
+          operationId: void 0,
+          method: request.method,
+          path: new URL(request.url).pathname,
+          status: response.status,
+          durationMs: performance.now() - started,
+          unmatched: response.status === 404
+        }, traceToken);
+        if (!response.body) {
+          finish();
+          return response;
+        }
+        const reader = response.body.getReader();
+        const headers = new Headers(response.headers);
+        const epoch = generation(namespace);
+        if (epoch)
+          headers.set("x-mockingbird-generation", epoch);
+        return new Response(new ReadableStream({
+          async pull(controller) {
+            try {
+              const next = await reader.read();
+              if (next.done) {
+                finish();
+                controller.close();
+                reader.releaseLock();
+              } else
+                controller.enqueue(next.value);
+            } catch (error) {
+              finish();
+              controller.error(error);
+            }
+          },
+          async cancel(reason) {
+            try {
+              await reader.cancel(reason);
+            } finally {
+              finish();
+              reader.releaseLock();
+            }
+          }
+        }), { status: response.status, statusText: response.statusText, headers });
+      } catch (error) {
+        finish();
+        throw error;
       }
     }
   };
@@ -195,6 +3394,7 @@ var httpChild = async (target, entry, options) => {
     });
     target.listening?.(server);
   } catch (error) {
+    unobserve?.();
     runtime.stop?.();
     await server?.close();
     runtime.webhooks?.clear();
@@ -203,6 +3403,7 @@ var httpChild = async (target, entry, options) => {
   }
   return {
     protocol: "http",
+    outboundPolicy: runtime.webhooks ? "webhook-hub" : "unsupported",
     url: server.url,
     healthUrl: `${server.url}${adminPrefix}/health`,
     adminUrl: `${server.url}${adminPrefix}`,
@@ -215,6 +3416,7 @@ var httpChild = async (target, entry, options) => {
       }
     },
     async close() {
+      unobserve?.();
       runtime.stop?.();
       runtime.webhooks?.clear();
       await server.close();
@@ -242,30 +3444,141 @@ var httpChild = async (target, entry, options) => {
     },
     reset: (namespace) => runtime.reset(namespace),
     clock: (namespace) => runtime.namespaceClock(namespace),
+    unmatched(namespace, limit) {
+      const entries = runtime.metrics.report(namespace).unmatched;
+      return {
+        entries: entries.slice(0, limit).map(({ method, path, count }) => ({
+          method,
+          pathFingerprint: createHash4("sha256").update(path).digest("hex"),
+          count
+        })),
+        truncated: entries.length > limit
+      };
+    },
+    lastActivity: (namespace) => activity.get(namespace) ?? 0,
+    async exportCheckpoint(_namespace, point) {
+      return runtime.fleetExport(point);
+    },
+    async importCheckpoint(namespace, document) {
+      return runtime.fleetImport(namespace, document);
+    },
+    async createNamespace(namespace) {
+      runtime.instance(namespace);
+    },
+    deleteNamespace: (namespace) => runtime.dropNamespace(namespace),
+    async configure(namespace, controls) {
+      return runtime.configure(controls, namespace);
+    },
+    async inspect(namespace, { offset, limit, collection }) {
+      const doc = runtime.fleetExport(runtime.fleetSnapshot(namespace));
+      const rows = collection ? doc.records.filter((row) => row.collection === collection) : doc.records;
+      return {
+        total: rows.length,
+        offset,
+        records: rows.slice(offset, offset + limit),
+        collections: [...new Set(doc.records.map((row) => row.collection))]
+      };
+    },
+    ...typeof runtime.instance().nextEvent === "function" ? {
+      nextEvent: (namespace) => runtime.instance(namespace).nextEvent()
+    } : {},
     async settle(namespace) {
       const instance = runtime.instance(namespace);
-      instance.tick?.();
-      await runtime.webhooks?.idle();
+      await instance.tick?.();
+      await runtime.webhooks?.idle(namespace);
     }
   };
 };
 async function startFleet(config, options) {
-  const id = randomUUID();
+  if (config.cors && options.cors === void 0)
+    options = { ...options, cors: config.cors };
+  const targets = await preflightFleet(config, options);
+  const id = randomUUID4();
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   const children = /* @__PURE__ */ new Map();
   const clocks = /* @__PURE__ */ new Map();
   const checkpoints = /* @__PURE__ */ new Map();
   let supervisor;
-  let stopped = false;
-  let controlling = false;
-  const close = async () => {
-    if (stopped)
+  let management;
+  let manifest;
+  const privateConnections = () => Object.fromEntries([...children].map(([name, child]) => [
+    name,
+    { url: child.connection ?? child.url, namespaces: child.connections }
+  ]));
+  const publish = async () => {
+    if (!manifest || management && management.lifecycle !== "ready")
       return;
-    stopped = true;
-    await Promise.allSettled([...children.values()].map((child) => child.close()));
-    await supervisor?.close();
-    await removeOwned(options.readyFile, id);
-    await removeOwned(options.connectionsFile, id);
+    manifest.state = recovery.size ? "recovery-required" : "ready";
+    for (const [name, child] of children)
+      if (manifest.services[name])
+        manifest.services[name].namespaces = child.namespaces;
+    if (options.connectionsFile)
+      await atomicWrite(options.connectionsFile, {
+        version: 1,
+        id,
+        pid: process.pid,
+        services: privateConnections()
+      });
+    if (options.readyFile)
+      await atomicWrite(options.readyFile, manifest);
+  };
+  let stopped = false;
+  const controlling = /* @__PURE__ */ new Map();
+  const recovery = /* @__PURE__ */ new Map();
+  let closing;
+  const close = () => {
+    if (closing)
+      return closing;
+    closing = (async () => {
+      management?.stopPolicies();
+      let gateFailure;
+      if (options.beforeClose && management && ["ready", "failed"].includes(management.lifecycle)) {
+        management.lifecycle = "draining";
+        const signal = AbortSignal.timeout(options.shutdownTimeoutMs ?? 3e4);
+        try {
+          await Promise.race([
+            options.beforeClose({
+              manifest,
+              signal,
+              capture: (namespaces) => management.capture(namespaces)
+            }),
+            new Promise((_, reject) => signal.addEventListener("abort", () => reject(new Error("pre-shutdown hook timed out")), { once: true }))
+          ]);
+        } catch (error) {
+          management.lifecycle = "failed";
+          if (options.shutdownFailure !== "close") {
+            closing = void 0;
+            throw error;
+          }
+          gateFailure = error;
+        }
+      }
+      stopped = true;
+      if (management)
+        management.lifecycle = "stopped";
+      const entries = [...children];
+      const results = [];
+      for (const [, child] of [...entries].reverse()) {
+        try {
+          await child.close();
+          results.unshift({ status: "fulfilled", value: void 0 });
+        } catch (reason) {
+          results.unshift({ status: "rejected", reason });
+        }
+      }
+      const cleanup = await Promise.allSettled([
+        supervisor?.close(),
+        removeOwned(options.readyFile, id),
+        removeOwned(options.connectionsFile, id)
+      ]);
+      const failures = results.flatMap((r, i) => r.status === "rejected" ? [{ service: entries[i]?.[0], cause: r.reason }] : []);
+      if (gateFailure)
+        failures.push({ service: "pre-shutdown", cause: gateFailure });
+      failures.push(...cleanup.flatMap((r) => r.status === "rejected" ? [{ service: "controller", cause: r.reason }] : []));
+      if (failures.length)
+        throw new AggregateError(failures.map((f) => f.cause), `fleet shutdown failed: ${failures.map((f) => f.service).join(", ")}`);
+    })();
+    return closing;
   };
   if (options.readyFile)
     await rm(options.readyFile, { force: true });
@@ -275,6 +3588,12 @@ async function startFleet(config, options) {
     let value = clocks.get(namespace);
     if (!value) {
       value = createClock();
+      const plan = normalizeBootControls(config.adminControls);
+      const boot = { ...plan.shared.clock, ...plan.namespaces[namespace]?.clock };
+      if (boot.frozen)
+        value.freeze();
+      if (boot.now !== void 0)
+        value.set(boot.now);
       clocks.set(namespace, value);
     }
     return value;
@@ -292,19 +3611,47 @@ async function startFleet(config, options) {
     }
     return selected;
   };
-  const diagnostics = (namespace) => Object.fromEntries([...children].map(([name, child]) => [name, child.diagnostics(namespace)]));
-  const transaction = async (namespace, selected, run) => {
-    if (controlling)
-      return json(409, { error: "another fleet operation is in progress" });
-    controlling = true;
+  const diagnostics = (namespace, selected = children) => Object.fromEntries([...selected].map(([name, child]) => [name, child.diagnostics(namespace)]));
+  const missingNamespace = (namespace, selected) => {
+    const missing = [...selected].filter(([, c]) => c.protocol !== "http" && !Object.hasOwn(c.namespaces.endpoints ?? {}, namespace)).map(([name]) => name);
+    return missing.length ? json(404, { error: "namespace is not configured", namespace, services: missing }) : void 0;
+  };
+  const transaction = async (namespace, selected, run, recover = false) => {
+    const unavailable = missingNamespace(namespace, selected);
+    if (unavailable)
+      return unavailable;
+    if (management?.topologyBusy(namespace))
+      return json(409, { error: "namespace topology operation in progress" });
+    if (controlling.has(namespace))
+      return json(409, {
+        error: "another fleet operation is in progress",
+        operationId: controlling.get(namespace)
+      });
+    if (recovery.has(namespace) && !recover)
+      return json(409, {
+        error: "namespace requires explicit reset or restore recovery",
+        namespace
+      });
+    const held = recovery.get(namespace);
+    if (held) {
+      for (const unlock of held.reverse())
+        unlock();
+      recovery.delete(namespace);
+    }
+    controlling.set(namespace, management?.operationId(namespace) ?? randomUUID4());
     const release = [];
+    let keepFence = false;
     const before = /* @__PURE__ */ new Map();
     const results = {};
     let failure;
     try {
+      if (![...selected.keys()].every((name) => management?.environmentFence(namespace, name)))
+        await management?.hook("prepare", namespace, selected);
+      management?.phase(namespace, "checkpointing");
       for (const [name, child] of selected) {
         failure = name;
-        release.push(child.lock(namespace));
+        if (!management?.environmentFence(namespace, name))
+          release.push(child.lock(namespace));
       }
       const busy = Object.fromEntries([...selected].filter(([, child]) => {
         const state = child.diagnostics(namespace);
@@ -314,24 +3661,54 @@ async function startFleet(config, options) {
         return json(409, { error: "namespace is not quiescent", services: busy });
       for (const [name, child] of selected) {
         failure = name;
+        management?.phase(namespace, "checkpointing", before.size, selected.size, name);
         before.set(name, await child.checkpoint(namespace));
       }
+      management?.checkCancelled(namespace);
+      management?.phase(namespace, "committing");
       for (const [name, child] of selected) {
         failure = name;
+        management?.phase(namespace, "committing", Object.keys(results).length, selected.size, name);
         results[name] = { status: "ok", result: await run(name, child) };
+        management?.phase(namespace, "committing", Object.keys(results).length, selected.size);
+      }
+      await management?.hook("verify", namespace, selected);
+      try {
+        await management?.hook("resume", namespace, selected);
+      } catch (error) {
+        keepFence = true;
+        throw error;
       }
       return json(200, { status: "ok", namespace, services: results });
-    } catch {
+    } catch (error) {
+      if (error.code === "MOCKINGBIRD_WORKLOAD_UNCERTAIN")
+        keepFence = true;
       const rollback = {};
       for (const [name, point] of before) {
         try {
+          management?.phase(namespace, "rolling-back", void 0, void 0, name);
           await selected.get(name)?.restore(namespace, point);
           rollback[name] = "restored";
         } catch {
           rollback[name] = "failed";
+          management?.phase(namespace, "rollback-failed", void 0, void 0, name);
         }
       }
+      keepFence = keepFence || Object.values(rollback).includes("failed") || held !== void 0;
+      if (!keepFence)
+        try {
+          await management?.hook("resume", namespace, selected);
+        } catch {
+          keepFence = true;
+        }
+      if (keepFence && release.length === 0)
+        for (const child of selected.values())
+          try {
+            release.push(child.lock(namespace));
+          } catch {
+          }
       return json(500, {
+        error: error instanceof Error ? error.message : "fleet operation failed",
         status: "failed",
         namespace,
         failedService: failure,
@@ -340,12 +3717,15 @@ async function startFleet(config, options) {
         rolledBack: before.size > 0 && Object.values(rollback).every((value) => value === "restored")
       });
     } finally {
-      for (const unlock of release.reverse())
-        unlock();
-      controlling = false;
+      if (keepFence)
+        recovery.set(namespace, release);
+      else
+        for (const unlock of release.reverse())
+          unlock();
+      controlling.delete(namespace);
     }
   };
-  const api = {
+  const coreApi = {
     async fetch(request) {
       const url = new URL(request.url);
       const adminPrefix = resolveAdminPrefix(config.adminPrefix);
@@ -376,13 +3756,20 @@ async function startFleet(config, options) {
       }
       if (!path.startsWith("/fleet/"))
         return json(404, { error: "not found" });
-      const adminKey = config.adminKey ?? process.env.MOCKINGBIRD_ADMIN_KEY;
-      if (adminKey !== void 0 && request.headers.get("x-mockingbird-admin-key") !== adminKey)
-        return json(401, { error: "admin key required" });
       const route = /^\/fleet\/namespaces\/([^/]+)\/(reset|snapshots)(?:\/([^/]+)\/restore)?$/.exec(path);
-      const namespace = route ? decodeURIComponent(route[1]) : url.searchParams.get("namespace") ?? request.headers.get("x-mockingbird-namespace") ?? config.namespace ?? "default";
+      let namespace;
+      try {
+        namespace = route ? decodeURIComponent(route[1]) : url.searchParams.get("namespace") ?? request.headers.get("x-mockingbird-namespace") ?? config.namespace ?? "default";
+      } catch {
+        return json(400, { error: "invalid namespace encoding" });
+      }
       if (!NS.test(namespace))
         return json(400, { error: "invalid namespace" });
+      if (request.method === "GET") {
+        const unavailable2 = missingNamespace(namespace, children);
+        if (unavailable2)
+          return unavailable2;
+      }
       if (request.method === "GET" && path === "/fleet/metrics")
         return json(200, { namespace, services: diagnostics(namespace) });
       if (request.method === "GET" && path === "/fleet/clock")
@@ -409,13 +3796,27 @@ async function startFleet(config, options) {
       } catch (error) {
         return json(400, { error: error instanceof Error ? error.message : "bad selection" });
       }
+      const allowed = route?.[3] ? [] : path === "/fleet/clock" ? ["services", "set", "advance", "freeze"] : route?.[2] === "snapshots" ? ["services", "label"] : ["services"];
+      if (Object.keys(body).some((key) => !allowed.includes(key)))
+        return json(400, { error: "unknown control field" });
+      if (body.label !== void 0 && (typeof body.label !== "string" || body.label.length > 256))
+        return json(400, { error: "label must be a string of at most 256 characters" });
+      const unavailable = missingNamespace(namespace, selected);
+      if (unavailable)
+        return unavailable;
       if (path === "/fleet/wait-until-idle") {
-        const services = diagnostics(namespace);
+        const services = diagnostics(namespace, selected);
         const idle = Object.values(services).every((d) => pending(d) === 0);
         return json(idle ? 200 : 409, { status: idle ? "idle" : "busy", namespace, services });
       }
       if (path === "/fleet/clock") {
         const current = clock(namespace);
+        if (body.set === void 0 && body.advance === void 0 && body.freeze === void 0)
+          return json(200, {
+            namespace,
+            ...current.state(),
+            services: Object.fromEntries([...selected].map(([name, child]) => [name, child.clock(namespace).state()]))
+          });
         let target = current.now();
         if (body.set !== void 0) {
           target = typeof body.set === "number" ? body.set : typeof body.set === "string" ? Date.parse(body.set) : NaN;
@@ -433,19 +3834,15 @@ async function startFleet(config, options) {
           return json(400, { error: "freeze must be boolean" });
         const response2 = await transaction(namespace, selected, async (_name, child) => {
           const childClock = child.clock(namespace);
-          childClock.freeze();
-          childClock.set(target);
-          if (!frozen)
-            childClock.unfreeze();
+          restoreClock(childClock, {
+            now: body.set !== void 0 ? target : childClock.now() + (body.advance !== void 0 ? parseDuration(body.advance) ?? 0 : 0),
+            frozen: body.freeze === void 0 ? childClock.state().frozen : frozen
+          });
           await child.settle?.(namespace);
           return childClock.state();
         });
-        if (response2.ok) {
-          current.freeze();
-          current.set(target);
-          if (!frozen)
-            current.unfreeze();
-        }
+        if (response2.ok)
+          restoreClock(current, { now: target, frozen });
         return response2;
       }
       if (!route)
@@ -453,9 +3850,11 @@ async function startFleet(config, options) {
       if (route[2] === "reset") {
         if (route[3])
           return json(404, { error: "not found" });
-        const response2 = await transaction(namespace, selected, async (_name, child) => child.reset(namespace));
-        if (response2.ok && selected.size === children.size)
-          clock(namespace).reset();
+        const response2 = await transaction(namespace, selected, async (_name, child) => child.reset(namespace), true);
+        if (response2.ok && selected.size === children.size) {
+          clocks.delete(namespace);
+          clock(namespace);
+        }
         return response2;
       }
       if (route[3]) {
@@ -463,17 +3862,12 @@ async function startFleet(config, options) {
         if (!point || point.namespace !== namespace)
           return json(404, { error: "no snapshot in this namespace" });
         const restored = new Map([...point.values].map(([name]) => [name, children.get(name)]));
-        const response2 = await transaction(namespace, restored, async (name, child) => child.restore(namespace, point.values.get(name)));
-        if (response2.ok) {
-          const current = clock(namespace);
-          current.freeze();
-          current.set(point.clock.now);
-          if (!point.clock.frozen)
-            current.unfreeze();
-        }
+        const response2 = await transaction(namespace, restored, async (name, child) => child.restore(namespace, point.values.get(name)), true);
+        if (response2.ok)
+          restoreClock(clock(namespace), point.clock);
         return response2;
       }
-      const snapshotId = randomUUID();
+      const snapshotId = randomUUID4();
       const values = /* @__PURE__ */ new Map();
       const response = await transaction(namespace, selected, async (name, child) => {
         values.set(name, await child.checkpoint(namespace));
@@ -491,34 +3885,67 @@ async function startFleet(config, options) {
   };
   try {
     const adminPrefix = resolveAdminPrefix(config.adminPrefix);
-    if (!isObject(config.services) || Object.keys(config.services).length === 0)
+    if (!isObject(config.services) || targets.size === 0)
       throw new Error("config must contain at least one service");
-    for (const [name, entry] of Object.entries(config.services)) {
+    for (const [name, target] of targets) {
+      const entry = config.services[name] ?? {};
       if (!/^[a-z0-9]+(?:-[a-z0-9]+)*$/.test(name))
         throw new Error("invalid service name");
+      if (config.adminControls !== void 0 || entry.adminControls !== void 0)
+        normalizeBootControls({ ...config.adminControls, ...entry.adminControls }, `services.${name}.adminControls`);
       try {
-        const target = await options.load(name);
         if (entry.protocol && entry.protocol !== ("protocol" in target ? target.protocol : "http"))
           throw new Error("configured protocol does not match target");
         const adminKey = entry.adminKey ?? config.adminKey ?? process.env.MOCKINGBIRD_ADMIN_KEY;
-        const child = "start" in target ? await target.start(entry) : await httpChild(target, {
+        const child = "start" in target ? await target.start({
+          ...entry,
+          ...config.adminControls !== void 0 || entry.adminControls !== void 0 ? { adminControls: { ...config.adminControls, ...entry.adminControls } } : {}
+        }) : await httpChild(target, {
           ...entry,
           adminPrefix: resolveAdminPrefix(entry.adminPrefix ?? adminPrefix),
-          ...adminKey !== void 0 ? { adminKey } : {}
-        }, options);
+          ...adminKey !== void 0 ? { adminKey } : {},
+          // Fleet-wide controls, with the service's own keys replacing them.
+          ...config.adminControls !== void 0 || entry.adminControls !== void 0 ? { adminControls: { ...config.adminControls, ...entry.adminControls } } : {}
+        }, options, (namespace, request) => management?.admit(namespace, request), (namespace) => management?.generation(namespace), (namespace, request) => management?.privateRequest(namespace, request) ?? false, {
+          begin: (namespace, request) => management?.beginRequest(name, namespace, request),
+          finish: async (namespace, request, response, log, token) => {
+            await management?.finishRequest(name, namespace, request, response, log, token);
+          },
+          delivery: (event) => management?.observeDelivery(name, event)
+        });
+        child.targetName = entry.target ?? name;
+        if (target.packageVersion)
+          child.packageVersion = target.packageVersion;
         children.set(name, child);
         if (!await child.ready())
           throw new Error("protocol readiness failed");
-      } catch {
-        throw new Error(`service ${name} failed to start; all started listeners were closed`);
+      } catch (error) {
+        throw new Error(`service ${name} failed to start; all started listeners were closed: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
       }
     }
+    management = new FleetManagement({
+      id,
+      config: { ...config, adminPrefix },
+      options,
+      children,
+      checkpoints,
+      clock,
+      transaction,
+      manifest: () => manifest,
+      publish,
+      recovery,
+      controlling
+    });
+    const api = {
+      fetch: (request) => management.dispatch(request, () => coreApi.fetch(request))
+    };
     supervisor = await listen(api, {
       port: config.control?.port ?? 0,
       host: config.control?.host ?? "127.0.0.1"
     });
-    const manifest = {
+    manifest = {
       version: 1,
+      capabilityVersion: 1,
       state: "ready",
       pid: process.pid,
       id,
@@ -529,7 +3956,7 @@ async function startFleet(config, options) {
         name,
         {
           protocol: child.protocol,
-          url: publicUrl(child.url),
+          url: advertisedHttpBase(config.services[name] ?? {}) ?? publicUrl(child.url),
           healthUrl: child.healthUrl ?? `${supervisor?.url}${adminPrefix}/health`,
           adminUrl: child.adminUrl ?? `${supervisor?.url}${adminPrefix}/fleet`,
           namespaces: child.namespaces,
@@ -538,26 +3965,395 @@ async function startFleet(config, options) {
         }
       ]))
     };
-    if (options.connectionsFile)
-      await atomicWrite(options.connectionsFile, {
-        version: 1,
-        id,
-        pid: process.pid,
-        services: Object.fromEntries([...children].map(([name, child]) => [
-          name,
-          { url: child.connection ?? child.url, namespaces: child.connections }
-        ]))
-      });
-    if (options.readyFile)
-      await atomicWrite(options.readyFile, manifest);
-    options.onReady?.(manifest);
+    await management.recoverOperations();
+    if (options.initialize) {
+      management.lifecycle = "initializing";
+      const access = [];
+      const connections = privateConnections();
+      try {
+        for (const [name, child] of children)
+          if (child.initializationAccess) {
+            const privateAccess = await child.initializationAccess();
+            access.push(privateAccess);
+            connections[name] = {
+              url: privateAccess.connections.default ?? child.connection ?? child.url,
+              namespaces: privateAccess.connections
+            };
+          }
+        const signal = AbortSignal.timeout(options.initializationTimeoutMs ?? 3e4);
+        await Promise.race([
+          options.initialize({
+            manifest,
+            connections,
+            headers: { "x-mockingbird-initializer": management.initializationToken },
+            signal
+          }),
+          new Promise((_, reject) => signal.addEventListener("abort", () => reject(new Error("fleet initialization timed out")), { once: true }))
+        ]);
+      } finally {
+        await Promise.all(access.map((entry) => entry.close()));
+      }
+    }
+    await management.startPolicies();
+    await publish();
+    if (manifest.state === "ready")
+      options.onReady?.(manifest);
     return { manifest, children, fetch: api.fetch, close };
   } catch (error) {
-    await close();
+    try {
+      await close();
+    } catch (cleanup) {
+      throw new AggregateError([error, cleanup], `fleet startup and cleanup failed: ${error instanceof Error ? error.message : String(error)}`);
+    }
     throw error;
   }
 }
 
+// ../../adapters/node/dist/fleet-tools.js
+import { readFile as readFile4 } from "node:fs/promises";
+import { createRequire as createRequire2 } from "node:module";
+import { resolve as resolve2 } from "node:path";
+
+// ../../adapters/node/dist/fleet-client.js
+import { randomUUID as randomUUID5 } from "node:crypto";
+import { chmod as chmod2, readFile as readFile3, rename as rename2, rm as rm2, writeFile as writeFile2 } from "node:fs/promises";
+var FleetClientError = class extends Error {
+  status;
+  details;
+  constructor(status, details) {
+    super(`fleet control HTTP ${status}: ${canonical(details)}`);
+    this.status = status;
+    this.details = details;
+  }
+};
+var FleetClient = class {
+  base;
+  options;
+  constructor(base, options = {}) {
+    this.base = base;
+    this.options = options;
+  }
+  async request(path, options = {}) {
+    const url = new URL(`${this.base.replace(/\/$/, "")}/${path.replace(/^\//, "")}`);
+    if (url.username || url.password)
+      throw new Error("fleet client URL must not contain credentials");
+    url.searchParams.set("namespace", options.namespace ?? this.options.namespace ?? "default");
+    const response = await (this.options.fetch ?? fetch)(url, {
+      method: options.method ?? (options.body === void 0 ? "GET" : "POST"),
+      headers: {
+        "content-type": "application/json",
+        ...this.options.adminKey ? { "x-mockingbird-admin-key": this.options.adminKey } : {},
+        ...options.idempotencyKey ? { "idempotency-key": options.idempotencyKey } : {}
+      },
+      ...options.body !== void 0 ? { body: JSON.stringify(options.body) } : {},
+      signal: options.signal ?? AbortSignal.timeout(this.options.timeoutMs ?? 3e4)
+    });
+    const data = await response.json();
+    if (!response.ok)
+      throw new FleetClientError(response.status, data);
+    return data;
+  }
+  discover() {
+    return this.request("");
+  }
+  namespaces() {
+    return this.request("namespaces");
+  }
+  createNamespace(namespace, baseline) {
+    return this.request(`namespaces/${encodeURIComponent(namespace)}`, {
+      body: baseline ? { baseline } : {}
+    });
+  }
+  deleteNamespace(namespace) {
+    return this.request(`namespaces/${encodeURIComponent(namespace)}`, { method: "DELETE" });
+  }
+  reset(namespace, options = {}) {
+    return this.request(`namespaces/${encodeURIComponent(namespace)}/reset`, {
+      body: options.services ? { services: options.services } : {},
+      ...options.idempotencyKey ? { idempotencyKey: options.idempotencyKey } : {}
+    });
+  }
+  snapshot(namespace, options = {}) {
+    const { idempotencyKey, ...body } = options;
+    return this.request(`namespaces/${encodeURIComponent(namespace)}/snapshots`, {
+      body,
+      ...idempotencyKey ? { idempotencyKey } : {}
+    });
+  }
+  restore(namespace, id, idempotencyKey) {
+    return this.request(`namespaces/${encodeURIComponent(namespace)}/snapshots/${encodeURIComponent(id)}/restore`, { body: {}, ...idempotencyKey ? { idempotencyKey } : {} });
+  }
+  exportArchive(namespace, allNamespaces = false) {
+    return this.request("archives/export", {
+      body: { allNamespaces },
+      ...namespace ? { namespace } : {}
+    });
+  }
+  exportProtectedArchive(namespace, allNamespaces = false) {
+    return this.request("archives/export", {
+      body: { allNamespaces },
+      ...namespace ? { namespace } : {}
+    });
+  }
+  importArchive(archive, namespace) {
+    if (archive.format !== "mockingbird.jwe/v1")
+      validateArchive(archive);
+    return this.request("archives/import", {
+      body: { archive, ...namespace ? { namespace } : {} }
+    });
+  }
+  operation(id) {
+    return this.request(`operations/${encodeURIComponent(id)}`);
+  }
+};
+function renderConnections(manifest, privateManifest, namespace, mapping) {
+  if (!/^[A-Za-z0-9_.-]{1,64}$/.test(namespace))
+    throw new Error("invalid namespace");
+  const result = {};
+  for (const [variable, entry] of Object.entries(mapping)) {
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(variable))
+      throw new Error(`invalid variable name ${variable}`);
+    const child = manifest.services[entry.service], secret = privateManifest.services[entry.service];
+    if (!child || !secret)
+      throw new Error(`missing service mapping ${entry.service}`);
+    if (child.protocol === "http") {
+      const template = child.namespaces.path;
+      if (typeof template !== "string")
+        throw new Error(`missing HTTP namespace mapping ${entry.service}`);
+      result[variable] = new URL(template.replace("{name}", encodeURIComponent(namespace)), secret.url).href;
+    } else {
+      const endpoint = secret.namespaces?.[namespace];
+      if (!endpoint)
+        throw new Error(`missing namespace mapping ${namespace}/${entry.service}`);
+      result[variable] = endpoint;
+    }
+  }
+  return result;
+}
+async function writeConnections(path, values, format = "json") {
+  const temp = `${path}.${randomUUID5()}.tmp`;
+  const text = format === "json" ? `${JSON.stringify(values, null, 2)}
+` : `${Object.entries(values).map(([key, value]) => `${key}=${JSON.stringify(value)}`).join("\n")}
+`;
+  try {
+    await writeFile2(temp, text, { mode: 384, flag: "wx" });
+    await chmod2(temp, 384);
+    await rename2(temp, path);
+  } finally {
+    await rm2(temp, { force: true });
+  }
+}
+
+// ../../adapters/node/dist/fleet-tools.js
+async function doctorFleet(config, options, probes = []) {
+  const findings = [];
+  const plan = [];
+  try {
+    const targets = await preflightFleet(config, options);
+    const require2 = createRequire2(resolve2(process.cwd(), "package.json"));
+    for (const [service, target] of targets) {
+      let version = "development";
+      try {
+        version = require2(`@crvouga/mockingbird-service-${service}/package.json`).version;
+      } catch {
+      }
+      plan.push({
+        service,
+        protocol: "protocol" in target ? target.protocol : "http",
+        port: config.services[service]?.port ?? target.defaultPort,
+        version
+      });
+    }
+    findings.push({
+      check: "configuration",
+      ok: true,
+      message: "all targets and control documents validated; no listeners opened"
+    });
+  } catch (error) {
+    findings.push({
+      check: "configuration",
+      ok: false,
+      message: error instanceof Error ? error.message : "configuration failed"
+    });
+  }
+  for (const probe of probes) {
+    try {
+      const url = new URL(probe.url);
+      if (url.username || url.password)
+        throw new Error("probe URLs must not contain credentials");
+      const response = await fetch(url, { signal: AbortSignal.timeout(probe.timeoutMs ?? 2e3) });
+      await response.body?.cancel();
+      findings.push({
+        check: "reachability",
+        ok: response.ok,
+        message: `endpoint returned HTTP ${response.status}`
+      });
+    } catch {
+      findings.push({
+        check: "reachability",
+        ok: false,
+        message: "endpoint unreachable; verify the listener host, port and readiness"
+      });
+    }
+  }
+  return {
+    version: 1,
+    ok: findings.every((f) => f.ok),
+    findings,
+    plan,
+    storageWritesPerformed: false
+  };
+}
+async function rehearseFleet(config, options, input, probes = [], timeoutMs = 3e4) {
+  const archive = validateArchive(input);
+  const startedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const isolated = {
+    ...config,
+    control: { host: "127.0.0.1", port: 0 },
+    services: Object.fromEntries(Object.entries(config.services).map(([name, entry]) => [
+      name,
+      { ...entry, host: "127.0.0.1", port: 0 }
+    ]))
+  };
+  let fleet;
+  try {
+    fleet = await startFleet(isolated, { load: options.load });
+    const client = new FleetClient(fleet.manifest.adminBase, {
+      ...config.adminKey ? { adminKey: config.adminKey } : {}
+    });
+    await client.importArchive(archive);
+    const signal = AbortSignal.timeout(timeoutMs);
+    for (const probe of probes)
+      await Promise.race([
+        probe(fleet, signal),
+        new Promise((_, reject) => signal.addEventListener("abort", () => reject(new Error("rehearsal probe timed out")), {
+          once: true
+        }))
+      ]);
+    return {
+      version: 1,
+      ok: true,
+      startedAt,
+      finishedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      sourceArchive: archive.sha256,
+      rehearsalProcess: fleet.manifest.id,
+      probes: probes.length
+    };
+  } finally {
+    await fleet?.close();
+  }
+}
+function fleetCommands(load) {
+  const parse = async (path) => {
+    if (typeof path !== "string")
+      throw new Error("file path required");
+    return JSON.parse(await readFile4(path, "utf8"));
+  };
+  return {
+    "fleet control": {
+      summary: "Call authenticated fleet controls using discovered adminBase",
+      options: {
+        base: { type: "string", description: "Discovered adminBase URL" },
+        action: { type: "string", description: "Relative control route" },
+        method: { type: "string", description: "HTTP method" },
+        body: { type: "string", description: "JSON request file" },
+        namespace: { type: "string", description: "Selected namespace" },
+        "key-env": {
+          type: "string",
+          description: "Admin-key environment variable name",
+          default: "MOCKINGBIRD_ADMIN_KEY"
+        },
+        "idempotency-key": { type: "string", description: "Retry identity" }
+      },
+      async run(values) {
+        try {
+          if (typeof values.base !== "string" || typeof values.action !== "string")
+            throw new Error("--base and --action required");
+          const key = process.env[String(values["key-env"] ?? "MOCKINGBIRD_ADMIN_KEY")];
+          const client = new FleetClient(values.base, {
+            ...key ? { adminKey: key } : {},
+            ...typeof values.namespace === "string" ? { namespace: values.namespace } : {}
+          });
+          console.log(JSON.stringify(await client.request(values.action, {
+            ...typeof values.method === "string" ? { method: values.method } : {},
+            ...values.body ? { body: await parse(values.body) } : {},
+            ...typeof values["idempotency-key"] === "string" ? { idempotencyKey: values["idempotency-key"] } : {}
+          })));
+          return 0;
+        } catch (error) {
+          console.error(error instanceof Error ? error.message : "fleet control failed");
+          return 1;
+        }
+      }
+    },
+    "fleet doctor": {
+      summary: "Validate fleet configuration without starting or resetting services",
+      options: {
+        config: { type: "string", description: "Fleet configuration file" },
+        json: { type: "boolean", description: "Machine-readable report" },
+        endpoint: { type: "string", description: "Optional read-only reachability probe" },
+        "ready-file": { type: "string", description: "Validate readiness destination" },
+        "connections-file": { type: "string", description: "Validate private destination" }
+      },
+      async run(values) {
+        try {
+          const report = await doctorFleet(await parse(values.config), {
+            load,
+            ...typeof values["ready-file"] === "string" ? { readyFile: values["ready-file"] } : {},
+            ...typeof values["connections-file"] === "string" ? { connectionsFile: values["connections-file"] } : {}
+          }, typeof values.endpoint === "string" ? [{ url: values.endpoint }] : []);
+          console.log(values.json ? JSON.stringify(report) : report.findings.map((f) => `${f.ok ? "PASS" : "FAIL"} ${f.check}: ${f.message}`).join("\n"));
+          return report.ok ? 0 : 1;
+        } catch (error) {
+          console.error(error instanceof Error ? error.message : "doctor failed");
+          return 1;
+        }
+      }
+    },
+    "fleet render": {
+      summary: "Render explicit application variables from private namespace discovery",
+      options: {
+        manifest: { type: "string", description: "Public ready manifest file" },
+        connections: { type: "string", description: "Private connection manifest file" },
+        mapping: { type: "string", description: "JSON variable-to-service mapping" },
+        namespace: { type: "string", description: "Explicit namespace" },
+        output: { type: "string", description: "Private destination file" },
+        format: { type: "string", description: "json or dotenv", default: "json" }
+      },
+      async run(values) {
+        try {
+          if (typeof values.namespace !== "string" || typeof values.output !== "string" || !["json", "dotenv"].includes(String(values.format)))
+            throw new Error("--namespace, --output and valid --format required");
+          const manifest = await parse(values.manifest), connections = await parse(values.connections);
+          const output = renderConnections(manifest, connections, values.namespace, await parse(values.mapping));
+          await writeConnections(values.output, output, values.format);
+          console.log(JSON.stringify({ written: values.output, variables: Object.keys(output) }));
+          return 0;
+        } catch (error) {
+          console.error(error instanceof Error ? error.message : "render failed");
+          return 1;
+        }
+      }
+    },
+    "fleet rehearse": {
+      summary: "Restore an archive in an isolated ephemeral fleet, then close it",
+      options: {
+        config: { type: "string", description: "Fleet configuration file" },
+        archive: { type: "string", description: "Saved fleet archive file" }
+      },
+      async run(values) {
+        try {
+          console.log(JSON.stringify(await rehearseFleet(await parse(values.config), { load }, await parse(values.archive))));
+          return 0;
+        } catch (error) {
+          console.error(error instanceof Error ? error.message : "rehearsal failed");
+          return 1;
+        }
+      }
+    }
+  };
+}
+
 // ../../adapters/node/dist/cli.js
 var optionHelp = (options) => Object.entries(options).map(([name, option]) => {
   const flag = `--${name}${option.type === "string" ? ` ${option.value ?? "<value>"}` : ""}`;
@@ -583,6 +4379,12 @@ var commandHelp = (spec, name, command) => [
   ...command.options ? ["", "Options:", ...optionHelp(command.options)] : []
 ].join("\n");
 var runCli = async (spec, argv) => {
+  const own = spec.commands.serve?.fleetTarget;
+  if (own)
+    spec = {
+      ...spec,
+      commands: { ...fleetCommands((name2) => loadTarget(name2, own)), ...spec.commands }
+    };
   const pair = argv.length >= 2 ? `${argv[0]} ${argv[1]}` : void 0;
   const words = pair !== void 0 && spec.commands[pair] ? 2 : 1;
   const name = words === 2 ? pair : argv[0];
@@ -637,7 +4439,51 @@ var COMMON_SERVE_OPTIONS = {
     value: "<key>",
     description: "Require x-mockingbird-admin-key on /__admin/* (env MOCKINGBIRD_ADMIN_KEY)"
   },
-  seed: { type: "string", value: "<seed>", description: "Seed for every random choice" },
+  seed: {
+    type: "string",
+    value: "<seed>",
+    description: "Seed for every random choice (env MOCKINGBIRD_SEED)"
+  },
+  "admin-controls": {
+    type: "string",
+    value: "<json|file>",
+    description: "Admin controls to boot with, as JSON or a JSON file: clock, latency, faults, snapshot, namespaces (env MOCKINGBIRD_ADMIN_CONTROLS)"
+  },
+  clock: {
+    type: "string",
+    value: "<instant>",
+    description: "Start the clock at this instant (epoch ms or ISO-8601)"
+  },
+  freeze: { type: "boolean", description: "Freeze the clock: it moves only when told to" },
+  "auto-advance": {
+    type: "string",
+    value: "<duration>",
+    description: "Step the clock this much before every request (e.g. 1s)"
+  },
+  latency: {
+    type: "string",
+    value: "<duration>",
+    description: "Baseline response time for every request (e.g. 250ms)"
+  },
+  jitter: {
+    type: "string",
+    value: "<duration>",
+    description: "Seeded extra latency between 0 and this"
+  },
+  "virtual-time": {
+    type: "boolean",
+    description: "Spend latency, delays and timeouts on the mock clock instead of really waiting"
+  },
+  fault: {
+    type: "string",
+    value: "<fault>",
+    description: 'A fault to boot with, as in x-mockingbird-fault: 503, rate_limited, "status=503; delay=2s"'
+  },
+  snapshot: {
+    type: "string",
+    value: "<file>",
+    description: "Start from a snapshot document (GET /__admin/snapshots/:id)"
+  },
   log: {
     type: "string",
     value: "<pretty|json|off>",
@@ -684,6 +4530,68 @@ var formatLog = (format) => {
   };
 };
 var asString = (value) => typeof value === "string" ? value : void 0;
+var readJsonFile = async (path, label) => {
+  try {
+    return JSON.parse(await readFile5(path, "utf8"));
+  } catch (error) {
+    throw new Error(`${label}: cannot read ${path}: ${error instanceof Error ? error.message : error}`);
+  }
+};
+var isObject2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var resolveServeControls = async (values, env = process.env, base) => {
+  const source = asString(values["admin-controls"]) ?? env.MOCKINGBIRD_ADMIN_CONTROLS;
+  let document = isObject2(base) ? { ...base } : {};
+  if (source !== void 0 && source.trim() !== "") {
+    let parsed;
+    if (source.trim().startsWith("{")) {
+      try {
+        parsed = JSON.parse(source);
+      } catch {
+        throw new Error("--admin-controls: not valid JSON");
+      }
+    } else
+      parsed = await readJsonFile(source, "--admin-controls");
+    if (!isObject2(parsed))
+      throw new Error("--admin-controls: expected a JSON object");
+    document = { ...document, ...parsed };
+  }
+  const clock = isObject2(document.clock) ? { ...document.clock } : {};
+  const now = asString(values.clock);
+  if (now !== void 0)
+    clock.now = now;
+  if (values.freeze === true)
+    clock.frozen = true;
+  const autoAdvance = asString(values["auto-advance"]);
+  if (autoAdvance !== void 0)
+    clock.autoAdvance = autoAdvance;
+  if (Object.keys(clock).length > 0)
+    document.clock = clock;
+  const delay = asString(values.latency);
+  const jitter = asString(values.jitter);
+  if (delay !== void 0 || jitter !== void 0) {
+    const latency = isObject2(document.latency) ? { ...document.latency } : document.latency !== void 0 ? { delay: document.latency } : {};
+    if (delay !== void 0)
+      latency.delay = delay;
+    if (jitter !== void 0)
+      latency.jitter = jitter;
+    document.latency = latency;
+  }
+  if (values["virtual-time"] === true)
+    document.virtualTime = true;
+  const fault = asString(values.fault);
+  if (fault !== void 0)
+    document.faults = [
+      ...Array.isArray(document.faults) ? document.faults : [],
+      parseFaultHeader(fault, "--fault")
+    ];
+  const snapshot = asString(values.snapshot);
+  if (snapshot !== void 0)
+    document.snapshot = await readJsonFile(snapshot, "--snapshot");
+  if (Object.keys(document).length === 0)
+    return void 0;
+  normalizeBootControls(document, "adminControls");
+  return document;
+};
 var loadTarget = async (name, own) => {
   if (name === own.name)
     return own;
@@ -693,7 +4601,7 @@ var loadTarget = async (name, own) => {
     try {
       mod = await import(specifier);
     } catch {
-      const fromProject = createRequire(resolve(process.cwd(), "package.json"));
+      const fromProject = createRequire3(resolve3(process.cwd(), "package.json"));
       mod = await import(pathToFileURL(fromProject.resolve(specifier)).href);
     }
     if (!mod.serveTarget)
@@ -710,7 +4618,8 @@ var start = async (target, values, config) => {
     adminPrefix,
     adminKey: config.adminKey,
     seed: config.seed,
-    onLog: formatLog(config.log)
+    onLog: formatLog(config.log),
+    ...config.adminControls !== void 0 ? { adminControls: config.adminControls } : {}
   });
   const listening = await listen(runtime, { port: config.port, host: config.host });
   target.listening?.(listening);
@@ -722,18 +4631,22 @@ var start = async (target, values, config) => {
     console.log(`${target.name} ${line.replaceAll("/__admin", adminPrefix)}`);
   return listening;
 };
-var untilSignal = async (servers) => new Promise((resolve2) => {
+var untilSignal = async (servers) => new Promise((resolve4) => {
   const stop = async () => {
     ;
     process.removeListener("SIGINT", stop);
     process.removeListener("SIGTERM", stop);
-    await Promise.allSettled(servers.map((s) => s.close()));
-    resolve2(0);
+    const results = await Promise.allSettled(servers.map((s) => s.close()));
+    for (const result of results)
+      if (result.status === "rejected")
+        console.error(result.reason instanceof Error ? result.reason.message : String(result.reason));
+    resolve4(results.some((r) => r.status === "rejected") ? 1 : 0);
   };
   process.once("SIGINT", stop);
   process.once("SIGTERM", stop);
 });
 var serveCommand = (target) => ({
+  fleetTarget: target,
   summary: `Serve the ${target.name} emulator or a configured fleet`,
   options: { ...COMMON_SERVE_OPTIONS, ..."options" in target ? target.options : {} },
   async run(values) {
@@ -745,11 +4658,14 @@ var serveCommand = (target) => ({
     const configPath = asString(values.config);
     if (configPath !== void 0) {
       try {
-        const config = JSON.parse(await readFile2(configPath, "utf8"));
+        const config = JSON.parse(await readFile5(configPath, "utf8"));
         config.adminPrefix = resolveAdminPrefix(config.adminPrefix ?? asString(values["admin-prefix"]) ?? process.env.MOCKINGBIRD_ADMIN_PREFIX);
         const adminKey2 = config.adminKey ?? asString(values["admin-key"]) ?? process.env.MOCKINGBIRD_ADMIN_KEY;
         if (adminKey2 !== void 0)
           config.adminKey = adminKey2;
+        const adminControls = await resolveServeControls(values, process.env, config.adminControls);
+        if (adminControls !== void 0)
+          config.adminControls = adminControls;
         const fleet = await startFleet(config, {
           load: (name) => loadTarget(name, target),
           onLog: formatLog(config.log ?? log),
@@ -775,10 +4691,12 @@ var serveCommand = (target) => ({
     }
     const port = asString(values.port);
     const adminKey = asString(values["admin-key"]) ?? process.env.MOCKINGBIRD_ADMIN_KEY;
-    const seed = asString(values.seed);
+    const seed = asString(values.seed) ?? process.env.MOCKINGBIRD_SEED;
     let listening;
     try {
+      const adminControls = await resolveServeControls(values);
       listening = await start(target, values, {
+        ...adminControls !== void 0 ? { adminControls } : {},
         adminPrefix: resolveAdminPrefix(asString(values["admin-prefix"]) ?? process.env.MOCKINGBIRD_ADMIN_PREFIX),
         port: port === void 0 ? target.defaultPort : Number.parseInt(port, 10),
         host: asString(values.host) ?? "127.0.0.1",