@deepexi/datasense-connector 0.0.0-stage → 3.0.1

package/guest.cjs

@@ -0,0 +1,2659 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+function __accessProp(key) {
+  return this[key];
+}
+var __toCommonJS = (from) => {
+  var entry = (__moduleCache ??= new WeakMap).get(from), desc;
+  if (entry)
+    return entry;
+  entry = __defProp({}, "__esModule", { value: true });
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (var key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(entry, key))
+        __defProp(entry, key, {
+          get: __accessProp.bind(from, key),
+          enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+        });
+  }
+  __moduleCache.set(from, entry);
+  return entry;
+};
+var __moduleCache;
+var __returnValue = (v) => v;
+function __exportSetter(name, newValue) {
+  this[name] = __returnValue.bind(null, newValue);
+}
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {
+      get: all[name],
+      enumerable: true,
+      configurable: true,
+      set: __exportSetter.bind(all, name)
+    });
+};
+
+// src/runtime/guest/index.ts
+var exports_guest = {};
+__export(exports_guest, {
+  bootGuest: () => bootGuest,
+  bootLocalGuest: () => bootLocalGuest
+});
+module.exports = __toCommonJS(exports_guest);
+
+// src/index.ts
+var exports_src = {};
+__export(exports_src, {
+  ConnectorError: () => ConnectorError,
+  DEFAULT_PUSH_NAME: () => DEFAULT_PUSH_NAME,
+  PNG_DATA_URI_PREFIX: () => PNG_DATA_URI_PREFIX,
+  PRESENTATION_LIMITS: () => PRESENTATION_LIMITS,
+  RESERVED_PUSH_NAMES: () => RESERVED_PUSH_NAMES,
+  SDK_NAME_PATTERN: () => SDK_NAME_PATTERN,
+  SDK_VERSION: () => SDK_VERSION,
+  SUPPORTED_SDK_MAJORS: () => SUPPORTED_SDK_MAJORS,
+  decodeConnectorIcon: () => decodeConnectorIcon,
+  defineConnector: () => defineConnector,
+  errors: () => errors,
+  normalizeDiscoverResult: () => normalizeDiscoverResult,
+  readConnectorPresentation: () => readConnectorPresentation,
+  summarizeDefinition: () => summarizeDefinition,
+  t: () => t,
+  validateConfig: () => validateConfig,
+  validateConnectorDefinition: () => validateConnectorDefinition,
+  validateDiscoverResult: () => validateDiscoverResult
+});
+
+// src/types.ts
+function isSingleObjectPush(push) {
+  if (push === null || typeof push !== "object" || Array.isArray(push))
+    return false;
+  const value = push;
+  return typeof value.map === "function" || typeof value.verify === "function";
+}
+var SINGLE_OBJECT_PUSH_MESSAGE = "push must be declared by name, e.g. push: { default: { map } }; the single-object form push: { map } is not supported";
+function defineConnector(definition) {
+  if (definition !== null && typeof definition === "object" && isSingleObjectPush(definition.push)) {
+    throw new TypeError(SINGLE_OBJECT_PUSH_MESSAGE);
+  }
+  return definition;
+}
+
+// src/validate.ts
+var SDK_NAME_PATTERN = /^[a-z][a-z0-9_]{0,27}$/;
+var RESERVED_PUSH_NAMES = Object.freeze(["dev"]);
+var DEFAULT_PUSH_NAME = "default";
+var VERSION_PATTERN = /^\d+\.\d+\.\d+$/;
+var SCALAR_KINDS = new Set(["string", "integer", "decimal", "boolean", "date", "instant", "json"]);
+var RETENTION_KINDS = new Set(["instant", "date"]);
+var SYNC_MODES = new Set(["full", "incremental"]);
+var SNAPSHOTS = new Set(["complete", "partial"]);
+var PURGE_KEYS = ["tenant", "user"];
+var FIELD_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var HOST_PLACEHOLDER = /\{config\.([^{}]*)\}/g;
+var HOST_LABEL = "[a-z0-9](?:[a-z0-9-]*[a-z0-9])?";
+var HOST_PATTERN = new RegExp(`^(?:\\*\\.)?${HOST_LABEL}(?:\\.${HOST_LABEL})*$`, "i");
+var DATE_PATTERN = /^\d{4}-\d{2}-\d{2}$/;
+var INSTANT_PATTERN = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(?::\d{2}(?:\.\d+)?)?(?:Z|[+-]\d{2}:\d{2})$/;
+var DECIMAL_TEXT_PATTERN = /^-?\d+(?:\.\d+)?$/;
+var PRESENTATION_LIMITS = Object.freeze({
+  title: 40,
+  description: 120,
+  readmeBytes: 65536,
+  iconBytes: 262144,
+  iconMinPx: 128,
+  fieldTitle: 40,
+  fieldDescription: 200,
+  placeholder: 100,
+  tableTitle: 40,
+  tableDescription: 200
+});
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isPositiveInteger(value) {
+  return typeof value === "number" && Number.isInteger(value) && value > 0;
+}
+function isStringArray(value) {
+  return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+function validateText(path, owner, key, max, issues) {
+  const value = owner[key];
+  if (value === undefined)
+    return;
+  if (typeof value !== "string") {
+    issues.push({ path: `${path}.${key}`, message: `${key} must be a string` });
+  } else if ([...value].length > max) {
+    issues.push({ path: `${path}.${key}`, message: `${key} must be at most ${max} characters` });
+  }
+}
+function validateFieldMeta(path, type, issues) {
+  validateText(path, type, "title", PRESENTATION_LIMITS.fieldTitle, issues);
+  validateText(path, type, "description", PRESENTATION_LIMITS.fieldDescription, issues);
+  if (type.placeholder !== undefined && (type.kind === "object" || type.kind === "array")) {
+    issues.push({ path: `${path}.placeholder`, message: "placeholder is only allowed on scalar and secret fields" });
+    return;
+  }
+  validateText(path, type, "placeholder", PRESENTATION_LIMITS.placeholder, issues);
+}
+function columnTypeProblem(type) {
+  if (!isRecord(type) || typeof type.kind !== "string" || !SCALAR_KINDS.has(type.kind)) {
+    return "column type must be a scalar type (string, integer, decimal, boolean, date, instant or json)";
+  }
+  if (type.kind === "decimal")
+    return decimalProblem(type);
+  return null;
+}
+function decimalProblem(type) {
+  const { precision, scale } = type;
+  if (!isPositiveInteger(precision) || typeof scale !== "number" || !Number.isInteger(scale) || scale < 0 || scale > precision) {
+    return "decimal needs an integer precision > 0 and an integer scale between 0 and precision";
+  }
+  return null;
+}
+function validateTable(path, table, issues) {
+  if (!isRecord(table)) {
+    issues.push({ path, message: "table declaration must be an object" });
+    return;
+  }
+  const columns = isRecord(table.columns) ? table.columns : null;
+  if (!columns) {
+    issues.push({ path: `${path}.columns`, message: "columns must be an object" });
+    return;
+  }
+  const columnKind = (name) => {
+    const type = columns[name];
+    return isRecord(type) && typeof type.kind === "string" ? type.kind : undefined;
+  };
+  const isDeclared = (name) => typeof name === "string" && Object.hasOwn(columns, name);
+  for (const [name, type] of Object.entries(columns)) {
+    const problem = columnTypeProblem(type);
+    if (problem)
+      issues.push({ path: `${path}.columns.${name}`, message: problem });
+    else
+      validateFieldMeta(`${path}.columns.${name}`, type, issues);
+  }
+  validateText(path, table, "title", PRESENTATION_LIMITS.tableTitle, issues);
+  validateText(path, table, "description", PRESENTATION_LIMITS.tableDescription, issues);
+  const primaryKey = table.primaryKey;
+  if (!isStringArray(primaryKey) || primaryKey.length === 0) {
+    issues.push({ path: `${path}.primaryKey`, message: "primaryKey must be a non-empty list of column names" });
+  } else {
+    const missing = primaryKey.filter((name) => !isDeclared(name));
+    if (missing.length > 0) {
+      issues.push({ path: `${path}.primaryKey`, message: `primaryKey references undeclared columns: ${missing.join(", ")}` });
+    }
+  }
+  if (table.retention !== undefined) {
+    const retention = table.retention;
+    if (!isRecord(retention)) {
+      issues.push({ path: `${path}.retention`, message: "retention must be an object" });
+    } else {
+      const column = retention.column;
+      if (!isDeclared(column)) {
+        issues.push({ path: `${path}.retention.column`, message: "retention column must be a declared column" });
+      } else if (!RETENTION_KINDS.has(columnKind(column) ?? "")) {
+        issues.push({ path: `${path}.retention.column`, message: "retention column must be of type instant or date" });
+      } else if (!isStringArray(primaryKey) || !primaryKey.includes(column)) {
+        issues.push({ path: `${path}.retention.column`, message: "retention column must be part of primaryKey" });
+      }
+      if (!isPositiveInteger(retention.days)) {
+        issues.push({ path: `${path}.retention.days`, message: "retention days must be a positive integer" });
+      }
+    }
+  }
+  if (table.purgeColumns !== undefined) {
+    const purgeColumns = table.purgeColumns;
+    if (!isRecord(purgeColumns)) {
+      issues.push({ path: `${path}.purgeColumns`, message: "purgeColumns must be an object" });
+    } else {
+      for (const key of PURGE_KEYS) {
+        const column = purgeColumns[key];
+        if (column !== undefined && !isDeclared(column)) {
+          issues.push({ path: `${path}.purgeColumns.${key}`, message: "purge column must be a declared column" });
+        }
+      }
+    }
+  }
+  if (table.indexes !== undefined) {
+    const indexes = table.indexes;
+    if (!Array.isArray(indexes)) {
+      issues.push({ path: `${path}.indexes`, message: "indexes must be a list of column lists" });
+    } else {
+      indexes.forEach((index, i) => {
+        if (!isStringArray(index) || index.length === 0 || !index.every(isDeclared)) {
+          issues.push({ path: `${path}.indexes[${i}]`, message: "index must be a non-empty list of declared columns" });
+        }
+      });
+    }
+  }
+}
+function validateTables(path, tables, owners, owner, issues) {
+  if (!isRecord(tables)) {
+    issues.push({ path, message: "tables must be an object" });
+    return;
+  }
+  for (const [name, table] of Object.entries(tables)) {
+    const tablePath = `${path}.${name}`;
+    if (!SDK_NAME_PATTERN.test(name)) {
+      issues.push({ path: tablePath, message: `table name must match ${SDK_NAME_PATTERN.source}` });
+    }
+    const previous = owners.get(name);
+    if (previous !== undefined) {
+      issues.push({ path: tablePath, message: `table ${name} is already declared by ${previous}` });
+    } else {
+      owners.set(name, owner);
+    }
+    validateTable(tablePath, table, issues);
+  }
+}
+function validateSdkType(path, type, rules, issues) {
+  if (!isRecord(type) || typeof type.kind !== "string") {
+    issues.push({ path, message: "type must be declared with t.*()" });
+    return;
+  }
+  const nested = { secretAllowed: false, secretMessage: rules.secretMessage };
+  if (type.kind === "secret" || type.kind === "object" || type.kind === "array" || SCALAR_KINDS.has(type.kind)) {
+    validateFieldMeta(path, type, issues);
+  }
+  switch (type.kind) {
+    case "secret":
+      if (!rules.secretAllowed)
+        issues.push({ path, message: rules.secretMessage });
+      else if (type.exposeToScript !== undefined && typeof type.exposeToScript !== "boolean") {
+        issues.push({ path: `${path}.exposeToScript`, message: "exposeToScript must be a boolean" });
+      }
+      return;
+    case "object":
+      validateShape(path, type, nested, issues);
+      return;
+    case "array":
+      validateSdkType(`${path}[]`, type.item, nested, issues);
+      return;
+    case "decimal": {
+      const problem = decimalProblem(type);
+      if (problem)
+        issues.push({ path, message: problem });
+      return;
+    }
+    default:
+      if (!SCALAR_KINDS.has(type.kind))
+        issues.push({ path, message: `unknown type kind ${type.kind}` });
+  }
+}
+function validateShape(path, type, fieldRules, issues) {
+  if (!isRecord(type.shape)) {
+    issues.push({ path, message: "object type needs a shape" });
+    return;
+  }
+  for (const [field, fieldType] of Object.entries(type.shape)) {
+    const fieldPath = `${path}.${field}`;
+    if (!FIELD_NAME_PATTERN.test(field)) {
+      issues.push({ path: fieldPath, message: `field name must match ${FIELD_NAME_PATTERN.source}` });
+    }
+    validateSdkType(fieldPath, fieldType, fieldRules, issues);
+  }
+}
+function validateObjectDeclaration(path, type, rules, issues) {
+  if (!isRecord(type) || type.kind !== "object") {
+    issues.push({ path, message: `${path} must be declared with t.object()` });
+    return false;
+  }
+  validateFieldMeta(path, type, issues);
+  validateShape(path, type, rules, issues);
+  return true;
+}
+function configFieldType(config, fieldPath) {
+  let current = config;
+  for (const segment of fieldPath.split(".")) {
+    if (!isRecord(current) || current.kind !== "object" || !isRecord(current.shape) || !Object.hasOwn(current.shape, segment))
+      return;
+    current = current.shape[segment];
+  }
+  return isRecord(current) ? current : undefined;
+}
+function pushNames(push) {
+  return isRecord(push) ? Object.keys(push) : [];
+}
+function validatePushHandler(path, handler, issues) {
+  if (!isRecord(handler)) {
+    issues.push({ path, message: "push handler must be an object with map()" });
+    return;
+  }
+  if (handler.verify !== undefined && typeof handler.verify !== "function") {
+    issues.push({ path: `${path}.verify`, message: `${path}.verify must be a function` });
+  }
+  if (typeof handler.map !== "function") {
+    issues.push({ path: `${path}.map`, message: `${path}.map must be a function` });
+  }
+}
+function validatePush(push, issues) {
+  if (push === undefined)
+    return 0;
+  if (!isRecord(push)) {
+    issues.push({ path: "push", message: "push must be an object" });
+    return 0;
+  }
+  if (isSingleObjectPush(push)) {
+    issues.push({ path: "push", message: SINGLE_OBJECT_PUSH_MESSAGE });
+    return 1;
+  }
+  const names = Object.keys(push);
+  if (names.length === 0) {
+    issues.push({ path: "push", message: "push must declare at least one handler, e.g. push: { default: { map } }" });
+    return 0;
+  }
+  for (const name of names) {
+    const path = `push.${name}`;
+    if (!SDK_NAME_PATTERN.test(name)) {
+      issues.push({ path, message: `push name must match ${SDK_NAME_PATTERN.source}` });
+    } else if (RESERVED_PUSH_NAMES.includes(name)) {
+      issues.push({ path, message: `push name ${name} is reserved` });
+    }
+    validatePushHandler(path, push[name], issues);
+  }
+  return names.length;
+}
+function validateHosts(hosts, config, issues) {
+  if (hosts === undefined)
+    return 0;
+  if (!Array.isArray(hosts)) {
+    issues.push({ path: "hosts", message: "hosts must be a list of host names" });
+    return 0;
+  }
+  hosts.forEach((host, i) => {
+    const path = `hosts[${i}]`;
+    if (typeof host !== "string" || host.length === 0 || host.length > 253) {
+      issues.push({ path, message: "host must be a non-empty string" });
+      return;
+    }
+    for (const match of host.matchAll(HOST_PLACEHOLDER)) {
+      const fieldPath = match[1] ?? "";
+      const fieldType = configFieldType(config, fieldPath);
+      if (!fieldType) {
+        issues.push({ path, message: `host template references undeclared config field ${fieldPath}` });
+      } else if (fieldType.kind !== "string") {
+        issues.push({ path, message: `host template field ${fieldPath} must be declared with t.string()` });
+      }
+    }
+    if (!HOST_PATTERN.test(host.replace(HOST_PLACEHOLDER, "x"))) {
+      issues.push({ path, message: "host must be an exact host name or *.suffix, without scheme, port or path" });
+    }
+  });
+  return hosts.length;
+}
+function validateRateLimit(rateLimit, issues) {
+  if (rateLimit === undefined)
+    return;
+  if (!isRecord(rateLimit)) {
+    issues.push({ path: "rateLimit", message: "rateLimit must be { perSecond, concurrency }" });
+    return;
+  }
+  const { perSecond, concurrency } = rateLimit;
+  if (typeof perSecond !== "number" || !Number.isFinite(perSecond) || perSecond <= 0) {
+    issues.push({ path: "rateLimit.perSecond", message: "rateLimit.perSecond must be a positive number" });
+  }
+  if (!isPositiveInteger(concurrency)) {
+    issues.push({ path: "rateLimit.concurrency", message: "rateLimit.concurrency must be a positive integer" });
+  }
+}
+function validateStreams(streams, issues) {
+  if (streams === undefined)
+    return 0;
+  if (!isRecord(streams)) {
+    issues.push({ path: "streams", message: "streams must be an object of async generator functions" });
+    return 0;
+  }
+  for (const [name, stream] of Object.entries(streams)) {
+    const path = `streams.${name}`;
+    if (!SDK_NAME_PATTERN.test(name))
+      issues.push({ path, message: `stream name must match ${SDK_NAME_PATTERN.source}` });
+    if (typeof stream !== "function")
+      issues.push({ path, message: `${path} must be an async generator function` });
+  }
+  return Object.keys(streams).length;
+}
+function validateConnectorDefinition(definition) {
+  if (!isRecord(definition)) {
+    return [{ path: "", message: "connector definition must be an object" }];
+  }
+  const issues = [];
+  if (typeof definition.name !== "string" || !SDK_NAME_PATTERN.test(definition.name)) {
+    issues.push({ path: "name", message: `name must match ${SDK_NAME_PATTERN.source}` });
+  }
+  if (typeof definition.version !== "string" || !VERSION_PATTERN.test(definition.version)) {
+    issues.push({ path: "version", message: "version must be a semver string like 1.0.0" });
+  }
+  validateObjectDeclaration("config", definition.config, {
+    secretAllowed: true,
+    secretMessage: "secret fields must be top-level config fields"
+  }, issues);
+  const hostCount = validateHosts(definition.hosts, definition.config, issues);
+  const hasDb = definition.db !== undefined;
+  if (hasDb && (!isRecord(definition.db) || definition.db.engine !== "postgresql")) {
+    issues.push({ path: "db.engine", message: "db.engine must be 'postgresql'" });
+  }
+  validateRateLimit(definition.rateLimit, issues);
+  if (definition.check !== undefined && typeof definition.check !== "function") {
+    issues.push({ path: "check", message: "check must be a function" });
+  }
+  if (typeof definition.discover !== "function") {
+    issues.push({ path: "discover", message: "discover must be a function" });
+  }
+  if (definition.writes !== undefined) {
+    issues.push({ path: "writes", message: "external write operations are not available yet" });
+  }
+  const streamCount = validateStreams(definition.streams, issues);
+  const pushCount = validatePush(definition.push, issues);
+  if (streamCount === 0 && pushCount === 0) {
+    issues.push({ path: "streams", message: "connector must declare at least one stream or push" });
+  }
+  if (streamCount > 0 && hostCount === 0 && !hasDb) {
+    issues.push({ path: "hosts", message: "connectors with streams must declare hosts (for ctx.http) or db (for ctx.db)" });
+  }
+  return issues;
+}
+function validateStreamDiscovery(path, stream, owners, issues) {
+  if (!isRecord(stream)) {
+    issues.push({ path, message: "stream declaration must be an object" });
+    return;
+  }
+  validateTables(`${path}.tables`, stream.tables, owners, path, issues);
+  const syncModes = stream.syncModes;
+  if (!isStringArray(syncModes) || syncModes.length === 0 || !syncModes.every((mode) => SYNC_MODES.has(mode)) || new Set(syncModes).size !== syncModes.length) {
+    issues.push({ path: `${path}.syncModes`, message: "syncModes must be a non-empty list of 'full' and/or 'incremental'" });
+  }
+  if (stream.snapshot !== undefined && (typeof stream.snapshot !== "string" || !SNAPSHOTS.has(stream.snapshot))) {
+    issues.push({ path: `${path}.snapshot`, message: "snapshot must be 'complete' or 'partial'" });
+  }
+  if (stream.params !== undefined) {
+    validateObjectDeclaration(`${path}.params`, stream.params, {
+      secretAllowed: false,
+      secretMessage: "stream params cannot contain secret fields"
+    }, issues);
+  }
+}
+function definitionStreamNames(definition) {
+  if (!isRecord(definition) || !isRecord(definition.streams))
+    return [];
+  return Object.keys(definition.streams);
+}
+function definitionPushNames(definition) {
+  if (!isRecord(definition))
+    return [];
+  return pushNames(definition.push);
+}
+function validateDiscoverResult(result, definition) {
+  if (!isRecord(result)) {
+    return [{ path: "", message: "discover result must be an object" }];
+  }
+  const issues = [];
+  const owners = new Map;
+  const declaredStreams = definitionStreamNames(definition);
+  const streams = result.streams === undefined ? {} : result.streams;
+  if (!isRecord(streams)) {
+    issues.push({ path: "streams", message: "streams must be an object" });
+  } else {
+    for (const [name, stream] of Object.entries(streams)) {
+      const path = `streams.${name}`;
+      if (!declaredStreams.includes(name)) {
+        issues.push({ path, message: `stream ${name} is not defined in the connector's streams` });
+      }
+      validateStreamDiscovery(path, stream, owners, issues);
+    }
+    for (const name of declaredStreams) {
+      if (!Object.hasOwn(streams, name)) {
+        issues.push({ path: `streams.${name}`, message: `stream ${name} is defined but missing from the discover result` });
+      }
+    }
+  }
+  const declaredPushes = definitionPushNames(definition);
+  const pushes = result.push === undefined ? {} : result.push;
+  if (!isRecord(pushes)) {
+    issues.push({ path: "push", message: "push must be an object of { tables } by push name" });
+  } else {
+    for (const [name, push] of Object.entries(pushes)) {
+      const path = `push.${name}`;
+      if (!declaredPushes.includes(name)) {
+        issues.push({ path, message: `push ${name} is not defined in the connector's push handlers` });
+      }
+      if (!isRecord(push)) {
+        issues.push({ path, message: "push declaration must be { tables }" });
+        continue;
+      }
+      validateTables(`${path}.tables`, push.tables, owners, path, issues);
+    }
+    for (const name of declaredPushes) {
+      if (!Object.hasOwn(pushes, name)) {
+        issues.push({ path: `push.${name}`, message: `push ${name} is defined but missing from the discover result` });
+      }
+    }
+  }
+  return issues;
+}
+function normalizeDiscoverResult(result) {
+  const streams = {};
+  for (const [name, stream] of Object.entries(result.streams ?? {})) {
+    streams[name] = {
+      tables: stream.tables,
+      syncModes: [...stream.syncModes],
+      snapshot: stream.snapshot ?? "partial",
+      ...stream.params ? { params: stream.params } : {}
+    };
+  }
+  const pushes = {};
+  for (const [name, push] of Object.entries(result.push ?? {}))
+    pushes[name] = { tables: push.tables };
+  return { streams, pushes };
+}
+function topLevelSecrets(config) {
+  if (!isRecord(config) || !isRecord(config.shape))
+    return [];
+  const secrets = [];
+  for (const [field, type] of Object.entries(config.shape)) {
+    if (isRecord(type) && type.kind === "secret")
+      secrets.push({ field, exposeToScript: type.exposeToScript === true });
+  }
+  return secrets;
+}
+function summarizeDefinition(definition) {
+  const secrets = topLevelSecrets(definition.config);
+  const rateLimit = definition.rateLimit;
+  return {
+    name: definition.name,
+    version: definition.version,
+    hosts: Array.isArray(definition.hosts) ? definition.hosts.filter((host) => typeof host === "string") : [],
+    db: definition.db?.engine === "postgresql" ? { engine: "postgresql" } : null,
+    rateLimit: rateLimit ? { perSecond: rateLimit.perSecond, concurrency: rateLimit.concurrency } : null,
+    pushes: pushNames(definition.push),
+    streams: definitionStreamNames(definition),
+    secretFields: secrets.map((secret) => secret.field),
+    exposeToScript: secrets.filter((secret) => secret.exposeToScript).map((secret) => secret.field),
+    ...isRecord(definition.config) ? { config: JSON.parse(JSON.stringify(definition.config)) } : {}
+  };
+}
+function isValidDate(text) {
+  if (!DATE_PATTERN.test(text))
+    return false;
+  const date = new Date(`${text}T00:00:00Z`);
+  return !Number.isNaN(date.getTime()) && date.toISOString().slice(0, 10) === text;
+}
+function validateValue(path, type, value, issues) {
+  if (!isRecord(type) || typeof type.kind !== "string") {
+    issues.push({ path, message: "field type is not a valid t.*() declaration" });
+    return;
+  }
+  const fail = (expected) => issues.push({ path, message: `${path} must be ${expected}` });
+  switch (type.kind) {
+    case "string":
+      if (typeof value !== "string")
+        fail("a string");
+      return;
+    case "integer":
+      if (typeof value !== "number" || !Number.isSafeInteger(value))
+        fail("an integer");
+      return;
+    case "decimal":
+      if (!(typeof value === "number" && Number.isFinite(value)) && !(typeof value === "string" && DECIMAL_TEXT_PATTERN.test(value)))
+        fail("a decimal number");
+      return;
+    case "boolean":
+      if (typeof value !== "boolean")
+        fail("a boolean");
+      return;
+    case "date":
+      if (typeof value !== "string" || !isValidDate(value))
+        fail("a date like 2026-01-31");
+      return;
+    case "instant":
+      if (typeof value !== "string" || !INSTANT_PATTERN.test(value) || Number.isNaN(Date.parse(value)))
+        fail("an ISO 8601 timestamp with time zone");
+      return;
+    case "json":
+      return;
+    case "object":
+      if (!isRecord(value)) {
+        fail("an object");
+        return;
+      }
+      validateFields(path, type, value, issues, false);
+      return;
+    case "array":
+      if (!Array.isArray(value)) {
+        fail("an array");
+        return;
+      }
+      value.forEach((item, i) => {
+        if (item === undefined || item === null)
+          issues.push({ path: `${path}[${i}]`, message: `${path}[${i}] is required` });
+        else
+          validateValue(`${path}[${i}]`, type.item, item, issues);
+      });
+      return;
+    case "secret":
+      issues.push({ path, message: "secret fields must be top-level config fields" });
+      return;
+    default:
+      issues.push({ path, message: `unknown type kind ${type.kind}` });
+  }
+}
+function validateFields(path, type, value, issues, topLevel) {
+  const shape = isRecord(type.shape) ? type.shape : {};
+  for (const [field, fieldType] of Object.entries(shape)) {
+    const fieldPath = `${path}.${field}`;
+    if (topLevel && isRecord(fieldType) && fieldType.kind === "secret")
+      continue;
+    const fieldValue = value[field];
+    if (fieldValue === undefined || fieldValue === null) {
+      if (!(isRecord(fieldType) && fieldType.kind === "json" && fieldValue === null)) {
+        issues.push({ path: fieldPath, message: `${fieldPath} is required` });
+      }
+      continue;
+    }
+    validateValue(fieldPath, fieldType, fieldValue, issues);
+  }
+  for (const field of Object.keys(value)) {
+    if (!Object.hasOwn(shape, field))
+      issues.push({ path: `${path}.${field}`, message: `${path}.${field} is not declared` });
+  }
+}
+function validateConfig(schema, config) {
+  if (!isRecord(config))
+    return [{ path: "config", message: "config must be an object" }];
+  const issues = [];
+  validateFields("config", schema, config, issues, true);
+  return issues;
+}
+
+// src/errors.ts
+class ConnectorError extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "ConnectorError";
+    this.code = code;
+  }
+}
+
+class AuthError extends ConnectorError {
+  constructor(message) {
+    super("AUTH_ERROR", message);
+    this.name = "AuthError";
+  }
+}
+
+class RateLimited extends ConnectorError {
+  retryAfterMs;
+  constructor(retryAfterMs, message) {
+    super("RATE_LIMITED", message ?? `rate limited, retry after ${retryAfterMs} ms`);
+    this.name = "RateLimited";
+    this.retryAfterMs = retryAfterMs;
+  }
+}
+
+class TransientError extends ConnectorError {
+  constructor(message) {
+    super("TRANSIENT_ERROR", message);
+    this.name = "TransientError";
+  }
+}
+
+class SchemaError extends ConnectorError {
+  constructor(message) {
+    super("SCHEMA_ERROR", message);
+    this.name = "SchemaError";
+  }
+}
+
+class FatalError extends ConnectorError {
+  constructor(message) {
+    super("FATAL_ERROR", message);
+    this.name = "FatalError";
+  }
+}
+
+class RejectedPayload extends ConnectorError {
+  constructor(message) {
+    super("REJECTED_PAYLOAD", message);
+    this.name = "RejectedPayload";
+  }
+}
+
+class NotAvailable extends ConnectorError {
+  constructor(feature) {
+    super("NOT_AVAILABLE", `${feature} is not available yet`);
+    this.name = "NotAvailable";
+  }
+}
+var errors = Object.freeze({ AuthError, RateLimited, TransientError, SchemaError, FatalError, RejectedPayload, NotAvailable });
+
+// src/runtime/guest/bridge.ts
+var jsonParse = JSON.parse;
+var jsonStringify = JSON.stringify;
+var dateNow = Date.now;
+var reflectApply = Reflect.apply;
+var mathMin = Math.min;
+var MapCtor = Map;
+class HostCallFailure extends ConnectorError {
+  status;
+  retryAfterMs;
+  constructor(code, message, status, retryAfterMs) {
+    super(code, message);
+    this.name = "HostCallFailure";
+    this.status = status;
+    this.retryAfterMs = retryAfterMs;
+  }
+}
+
+class CanceledError extends ConnectorError {
+  constructor() {
+    super("CANCELED", "run was canceled");
+    this.name = "CanceledError";
+  }
+}
+var nextCallId = 1;
+var pending = new MapCtor;
+var timers = [];
+var outbox = [];
+var finished = false;
+var aborted = false;
+var declared = false;
+var stopped = false;
+var abortListeners = [];
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function now() {
+  return reflectApply(dateNow, Date, []);
+}
+function enqueue(message) {
+  const text = jsonStringify(message);
+  if (typeof text !== "string")
+    throw new TypeError("message is not serializable");
+  outbox[outbox.length] = text;
+}
+function call(method, payload) {
+  if (method === "declaration") {
+    if (declared)
+      return Promise.reject(new ConnectorError("FATAL_ERROR", "declaration was already reported in this run"));
+    declared = true;
+  }
+  const id = nextCallId;
+  nextCallId += 1;
+  return new Promise((resolve, reject) => {
+    try {
+      enqueue({ type: "call", id, method, payload });
+    } catch (error) {
+      reject(new TypeError(`${method} payload is not serializable: ${error instanceof Error ? error.message : String(error)}`));
+      return;
+    }
+    pending.set(id, { resolve, reject });
+  });
+}
+function sleep(ms) {
+  if (aborted || !(ms > 0))
+    return Promise.resolve();
+  return new Promise((resolve) => {
+    timers[timers.length] = { at: now() + ms, resolve };
+  });
+}
+function isAborted() {
+  return aborted;
+}
+function isStopped() {
+  return stopped;
+}
+function requestStop() {
+  if (aborted)
+    return;
+  stopped = true;
+  abort();
+}
+function throwIfAborted() {
+  if (aborted)
+    throw new CanceledError;
+}
+function onAbort(listener) {
+  if (aborted) {
+    Promise.resolve().then(() => runListener(listener));
+    return;
+  }
+  abortListeners[abortListeners.length] = listener;
+}
+function runListener(listener) {
+  try {
+    listener();
+  } catch {}
+}
+function abort() {
+  if (aborted)
+    return;
+  aborted = true;
+  const due = timers;
+  timers = [];
+  for (const timer of due)
+    timer.resolve();
+  for (const [id, entry] of pending) {
+    pending.delete(id);
+    entry.reject(new CanceledError);
+  }
+  const listeners = abortListeners.splice(0, abortListeners.length);
+  for (const listener of listeners)
+    runListener(listener);
+}
+function finish(message) {
+  if (finished)
+    return;
+  finished = true;
+  try {
+    enqueue(message);
+  } catch (error) {
+    outbox[outbox.length] = jsonStringify({
+      type: "failure",
+      code: "FATAL_ERROR",
+      logs: [],
+      message: `connector result is not serializable: ${error instanceof Error ? error.message : String(error)}`
+    });
+  }
+}
+function handle(json) {
+  if (typeof json !== "string")
+    return;
+  let message;
+  try {
+    message = jsonParse(json);
+  } catch {
+    return;
+  }
+  if (!isRecord2(message))
+    return;
+  if (message.type === "cancel") {
+    abort();
+    return;
+  }
+  if (message.type !== "reply" || typeof message.id !== "number")
+    return;
+  const entry = pending.get(message.id);
+  if (!entry)
+    return;
+  pending.delete(message.id);
+  if (message.ok === true) {
+    entry.resolve(message.value);
+    return;
+  }
+  const error = isRecord2(message.error) ? message.error : {};
+  entry.reject(new HostCallFailure(typeof error.code === "string" ? error.code : "HOST_ERROR", typeof error.message === "string" ? error.message : "host call failed", typeof error.status === "number" ? error.status : undefined, typeof error.retryAfterMs === "number" ? error.retryAfterMs : undefined));
+}
+function poll() {
+  const current = now();
+  let fired = false;
+  if (timers.length > 0) {
+    const due = [];
+    const rest = [];
+    for (const timer of timers) {
+      if (timer.at <= current)
+        due[due.length] = timer;
+      else
+        rest[rest.length] = timer;
+    }
+    timers = rest;
+    for (const timer of due)
+      timer.resolve();
+    fired = due.length > 0;
+  }
+  let wake = -1;
+  for (const timer of timers)
+    wake = wake < 0 ? timer.at - current : mathMin(wake, timer.at - current);
+  const out = outbox;
+  outbox = [];
+  return `{"out":[${out.join(",")}],"wake":${wake < 0 ? -1 : wake},"fired":${fired ? "true" : "false"}}`;
+}
+
+// src/runtime/guest/cache.ts
+function key(value) {
+  if (typeof value !== "string" || value.length === 0)
+    throw new TypeError("cache key must be a non-empty string");
+  return value;
+}
+function ttl(value) {
+  if (typeof value !== "number" || !Number.isInteger(value) || value < 1)
+    throw new TypeError("cache ttlSeconds must be a positive integer");
+  return value;
+}
+async function get(name) {
+  const entry = await call("cache.get", { key: key(name) });
+  if (entry === null || typeof entry !== "object" || typeof entry.value !== "string")
+    return;
+  const expiresAt = typeof entry.expiresAt === "string" ? Date.parse(entry.expiresAt) : Number.NaN;
+  if (!Number.isNaN(expiresAt) && expiresAt <= now())
+    return;
+  return entry.value;
+}
+async function set(name, value, ttlSeconds) {
+  if (typeof value !== "string")
+    throw new TypeError("cache value must be a string");
+  await call("cache.set", { key: key(name), value, ttlSeconds: ttl(ttlSeconds) });
+}
+function createCache() {
+  return Object.freeze({
+    get: (name) => Promise.resolve().then(() => get(name)),
+    set: (name, value, ttlSeconds) => Promise.resolve().then(() => set(name, value, ttlSeconds)),
+    async getOrSet(name, ttlSeconds, fn) {
+      ttl(ttlSeconds);
+      if (typeof fn !== "function")
+        throw new TypeError("cache.getOrSet expects a function");
+      const cached = await get(name);
+      if (cached !== undefined)
+        return cached;
+      const value = await fn();
+      await set(name, value, ttlSeconds);
+      return value;
+    }
+  });
+}
+
+// src/runtime/guest/crypto.ts
+var HMAC_ALGORITHMS = ["sha1", "sha256", "sha512"];
+var HASH_ALGORITHMS = ["md5", "sha1", "sha256", "sha512"];
+var ENCODINGS = ["hex", "base64"];
+var ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+function encoding(value) {
+  if (value === undefined)
+    return "hex";
+  if (typeof value !== "string" || !ENCODINGS.includes(value))
+    throw new TypeError("encoding must be 'hex' or 'base64'");
+  return value;
+}
+function text(value, what) {
+  if (typeof value !== "string")
+    throw new TypeError(`${what} must be a string`);
+  return value;
+}
+async function digest(request) {
+  const response = await call("crypto", request);
+  if (!response || typeof response.value !== "string")
+    throw new TypeError("crypto host call returned no value");
+  return response.value;
+}
+function utf8Encode(input) {
+  const bytes = [];
+  for (let i = 0;i < input.length; i += 1) {
+    let code = input.charCodeAt(i);
+    if (code >= 55296 && code <= 56319 && i + 1 < input.length) {
+      const low = input.charCodeAt(i + 1);
+      if (low >= 56320 && low <= 57343) {
+        code = 65536 + (code - 55296 << 10) + (low - 56320);
+        i += 1;
+      }
+    }
+    if (code >= 55296 && code <= 57343)
+      code = 65533;
+    if (code < 128)
+      bytes.push(code);
+    else if (code < 2048)
+      bytes.push(192 | code >> 6, 128 | code & 63);
+    else if (code < 65536)
+      bytes.push(224 | code >> 12, 128 | code >> 6 & 63, 128 | code & 63);
+    else
+      bytes.push(240 | code >> 18, 128 | code >> 12 & 63, 128 | code >> 6 & 63, 128 | code & 63);
+  }
+  return bytes;
+}
+function utf8Length(input) {
+  let length = 0;
+  for (let i = 0;i < input.length; i += 1) {
+    const code = input.charCodeAt(i);
+    if (code < 128)
+      length += 1;
+    else if (code < 2048)
+      length += 2;
+    else if (code >= 55296 && code <= 56319 && i + 1 < input.length) {
+      const low = input.charCodeAt(i + 1);
+      if (low >= 56320 && low <= 57343) {
+        length += 4;
+        i += 1;
+      } else {
+        length += 3;
+      }
+    } else
+      length += 3;
+  }
+  return length;
+}
+function utf8Decode(bytes) {
+  let out = "";
+  let i = 0;
+  while (i < bytes.length) {
+    const b0 = bytes[i] ?? 0;
+    let code = 65533;
+    let size = 1;
+    const cont = (offset) => {
+      const b = bytes[i + offset];
+      return b !== undefined && (b & 192) === 128 ? b & 63 : -1;
+    };
+    if (b0 < 128) {
+      code = b0;
+    } else if (b0 >= 194 && b0 < 224) {
+      const b1 = cont(1);
+      if (b1 >= 0) {
+        code = (b0 & 31) << 6 | b1;
+        size = 2;
+      }
+    } else if (b0 >= 224 && b0 < 240) {
+      const b1 = cont(1);
+      const b2 = cont(2);
+      if (b1 >= 0 && b2 >= 0) {
+        const value = (b0 & 15) << 12 | b1 << 6 | b2;
+        if (value >= 2048 && (value < 55296 || value > 57343)) {
+          code = value;
+          size = 3;
+        }
+      }
+    } else if (b0 >= 240 && b0 < 245) {
+      const b1 = cont(1);
+      const b2 = cont(2);
+      const b3 = cont(3);
+      if (b1 >= 0 && b2 >= 0 && b3 >= 0) {
+        const value = (b0 & 7) << 18 | b1 << 12 | b2 << 6 | b3;
+        if (value >= 65536 && value <= 1114111) {
+          code = value;
+          size = 4;
+        }
+      }
+    }
+    out += String.fromCodePoint(code);
+    i += size;
+  }
+  return out;
+}
+function bytesToBase64(bytes) {
+  let out = "";
+  for (let i = 0;i < bytes.length; i += 3) {
+    const b0 = bytes[i] ?? 0;
+    const b1 = bytes[i + 1];
+    const b2 = bytes[i + 2];
+    const chunk = b0 << 16 | (b1 ?? 0) << 8 | (b2 ?? 0);
+    out += ALPHABET.charAt(chunk >> 18 & 63) + ALPHABET.charAt(chunk >> 12 & 63);
+    out += b1 === undefined ? "=" : ALPHABET.charAt(chunk >> 6 & 63);
+    out += b2 === undefined ? "=" : ALPHABET.charAt(chunk & 63);
+  }
+  return out;
+}
+function base64ToBytes(input) {
+  const clean = input.replace(/[\s=]/g, "").replace(/-/g, "+").replace(/_/g, "/");
+  const bytes = [];
+  let buffer = 0;
+  let bits = 0;
+  for (let i = 0;i < clean.length; i += 1) {
+    const value = ALPHABET.indexOf(clean.charAt(i));
+    if (value < 0)
+      throw new TypeError("invalid base64 text");
+    buffer = buffer << 6 | value;
+    bits += 6;
+    if (bits >= 8) {
+      bits -= 8;
+      bytes.push(buffer >> bits & 255);
+    }
+  }
+  return bytes;
+}
+function base64Encode(input) {
+  return bytesToBase64(utf8Encode(text(input, "base64Encode input")));
+}
+function base64Decode(input) {
+  return utf8Decode(base64ToBytes(text(input, "base64Decode input")));
+}
+function createCrypto() {
+  return Object.freeze({
+    hmac(algorithm, key, data, enc) {
+      if (!HMAC_ALGORITHMS.includes(algorithm))
+        return Promise.reject(new TypeError(`unsupported hmac algorithm ${String(algorithm)}`));
+      return Promise.resolve().then(() => digest({ op: "hmac", algorithm, key: text(key, "hmac key"), data: text(data, "hmac data"), encoding: encoding(enc) }));
+    },
+    sign(algorithm, key, data, enc) {
+      if (algorithm !== "rsa-sha256")
+        return Promise.reject(new TypeError(`unsupported sign algorithm ${String(algorithm)}`));
+      return Promise.resolve().then(() => digest({ op: "sign", algorithm, key: text(key, "sign key"), data: text(data, "sign data"), encoding: encoding(enc) }));
+    },
+    hash(algorithm, data, enc) {
+      if (!HASH_ALGORITHMS.includes(algorithm))
+        return Promise.reject(new TypeError(`unsupported hash algorithm ${String(algorithm)}`));
+      return Promise.resolve().then(() => digest({ op: "hash", algorithm, data: text(data, "hash data"), encoding: encoding(enc) }));
+    },
+    base64Encode,
+    base64Decode
+  });
+}
+
+// src/runtime/guest/db.ts
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function param(value) {
+  if (value === undefined)
+    return null;
+  if (typeof value === "bigint")
+    return value.toString();
+  if (value instanceof Date)
+    return value.toISOString();
+  return value;
+}
+function rowsOf(value) {
+  if (!isRecord3(value) || !Array.isArray(value.rows) || typeof value.done !== "boolean")
+    throw new TypeError("db host call returned a malformed response");
+  return value.rows;
+}
+async function* run(sql, params) {
+  throwIfAborted();
+  const first = await call("db.query", { sql, params: params.map(param) });
+  let rows = rowsOf(first);
+  let done = first.done;
+  const cursorId = typeof first.cursorId === "string" ? first.cursorId : null;
+  if (!done && cursorId === null)
+    throw new TypeError("db host call returned more rows without a cursor");
+  try {
+    for (;; ) {
+      for (const row of rows)
+        yield row;
+      if (done || cursorId === null)
+        return;
+      throwIfAborted();
+      const next = await call("db.next", { cursorId });
+      rows = rowsOf(next);
+      done = next.done;
+    }
+  } finally {
+    if (!done && cursorId !== null) {
+      const closing = call("db.close", { cursorId });
+      if (isAborted())
+        closing.catch(() => {
+          return;
+        });
+      else
+        await closing;
+    }
+  }
+}
+function createDb() {
+  return Object.freeze({
+    query(sql, params = []) {
+      if (typeof sql !== "string" || sql.trim().length === 0)
+        throw new TypeError("ctx.db.query expects a SQL string");
+      if (!Array.isArray(params))
+        throw new TypeError("ctx.db.query params must be an array");
+      return run(sql, [...params]);
+    }
+  });
+}
+
+// src/runtime/guest/limits.ts
+var PULL_BATCH_MAX_RECORDS = 1000;
+var PULL_BATCH_MAX_BYTES = 4 * 1024 * 1024;
+var PULL_REJECT_THRESHOLD = 1000;
+var MAX_LOGS = 1000;
+var MAX_LOG_MESSAGE = 4096;
+var DEFAULT_CONCURRENCY = 4;
+var RATE_LIMIT_RETRIES = 5;
+var TRANSIENT_RETRIES = 3;
+var TRANSIENT_BACKOFF_MS = 200;
+var RATE_LIMIT_BACKOFF_MS = 1000;
+var MAX_RETRY_WAIT_MS = 600000;
+var CONNECTOR_FILENAME = "connector.js";
+
+// src/runtime/guest/http.ts
+var METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD"];
+var ABSOLUTE_URL = /^https?:\/\//i;
+var TRANSIENT_STATUS = [502, 503, 504];
+var IDEMPOTENT_METHODS = ["GET", "HEAD", "PUT", "DELETE"];
+var JSON_CONTENT_TYPE = /(?:^|[/+])json\s*(?:;|$)/i;
+function isRecord4(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function stringify(value) {
+  if (typeof value === "string")
+    return value;
+  if (value instanceof Date)
+    return value.toISOString();
+  if (typeof value === "object" && value !== null)
+    return jsonStringify(value);
+  return String(value);
+}
+function resolveUrl(url, baseUrl) {
+  if (ABSOLUTE_URL.test(url))
+    return url;
+  if (!baseUrl)
+    throw new TypeError(`relative URL ${url} needs auth.baseUrl or a fixed host in the connector's hosts`);
+  const base = baseUrl.replace(/\/+$/, "");
+  return `${base}${url.startsWith("/") ? "" : "/"}${url}`;
+}
+function buildHeaders(options) {
+  const headers = {};
+  for (const source of [options.auth?.headers, options.headers]) {
+    if (source === undefined)
+      continue;
+    if (!isRecord4(source))
+      throw new TypeError("headers must be an object");
+    for (const [name, value] of Object.entries(source)) {
+      if (value === undefined || value === null)
+        continue;
+      headers[name.toLowerCase()] = stringify(value);
+    }
+  }
+  return headers;
+}
+function buildQuery(query) {
+  const out = {};
+  if (query === undefined)
+    return out;
+  if (!isRecord4(query))
+    throw new TypeError("query must be an object");
+  for (const [name, value] of Object.entries(query)) {
+    if (value === undefined || value === null)
+      continue;
+    out[name] = Array.isArray(value) ? value.filter((item) => item !== undefined && item !== null).map(stringify) : stringify(value);
+  }
+  return out;
+}
+function buildBody(body, headers) {
+  if (body === undefined || body === null)
+    return { body: null, bodyEncoding: "utf8" };
+  if (typeof body === "string")
+    return { body, bodyEncoding: "utf8" };
+  if (body instanceof Uint8Array)
+    return { body: bytesToBase64(Array.from(body)), bodyEncoding: "base64" };
+  if (body instanceof ArrayBuffer)
+    return { body: bytesToBase64(Array.from(new Uint8Array(body))), bodyEncoding: "base64" };
+  const text = jsonStringify(body);
+  if (typeof text !== "string")
+    throw new TypeError("request body is not serializable");
+  if (headers["content-type"] === undefined)
+    headers["content-type"] = "application/json";
+  return { body: text, bodyEncoding: "utf8" };
+}
+function buildRequest(method, url, options, defaultBaseUrl) {
+  const upper = typeof method === "string" ? method.toUpperCase() : "";
+  if (!METHODS.includes(upper))
+    throw new TypeError(`unsupported HTTP method ${String(method)}`);
+  if (typeof url !== "string" || url.length === 0)
+    throw new TypeError("url must be a non-empty string");
+  if (!isRecord4(options))
+    throw new TypeError("options must be an object");
+  const baseUrl = options.auth?.baseUrl ?? defaultBaseUrl;
+  const headers = buildHeaders(options);
+  const request = {
+    method: upper,
+    url: resolveUrl(url, typeof baseUrl === "string" ? baseUrl : null),
+    headers,
+    query: buildQuery(options.query),
+    ...buildBody(options.body, headers)
+  };
+  if (options.retry !== undefined && typeof options.retry !== "boolean")
+    throw new TypeError("retry must be a boolean");
+  if (options.timeoutMs !== undefined) {
+    if (typeof options.timeoutMs !== "number" || !(options.timeoutMs > 0))
+      throw new TypeError("timeoutMs must be a positive number");
+    request.timeoutMs = options.timeoutMs;
+  }
+  return request;
+}
+function toResponse(value, parseJson) {
+  if (!isRecord4(value) || typeof value.status !== "number" || typeof value.body !== "string")
+    throw new TypeError("http host call returned a malformed response");
+  const raw = value;
+  const headers = {};
+  if (isRecord4(raw.headers)) {
+    for (const [name, item] of Object.entries(raw.headers))
+      if (typeof item === "string")
+        headers[name.toLowerCase()] = item;
+  }
+  const text = raw.body;
+  const url = typeof raw.url === "string" ? raw.url : "";
+  let data = text;
+  if (parseJson && raw.bodyEncoding !== "base64" && JSON_CONTENT_TYPE.test(headers["content-type"] ?? "") && text.length > 0) {
+    try {
+      data = jsonParse(text);
+    } catch {
+      throw new errors.FatalError(`response from ${url} is not valid JSON`);
+    }
+  }
+  return { status: raw.status, url, headers, data, text };
+}
+function retryAfterMs(headers) {
+  const value = headers["retry-after"];
+  if (value === undefined)
+    return;
+  const trimmed = value.trim();
+  if (/^\d+(?:\.\d+)?$/.test(trimmed))
+    return Number(trimmed) * 1000;
+  const at = Date.parse(trimmed);
+  return Number.isNaN(at) ? undefined : Math.max(0, at - now());
+}
+function clampWait(ms) {
+  return Math.min(Math.max(0, ms), MAX_RETRY_WAIT_MS);
+}
+function createHttp(defaultBaseUrl) {
+  async function request(method, url, options = {}) {
+    const req = buildRequest(method, url, options, defaultBaseUrl);
+    const raw = options.raw === true;
+    const label = `${req.method} ${req.url}`;
+    const retryTransient = options.retry ?? IDEMPOTENT_METHODS.includes(req.method);
+    const transientLimit = retryTransient ? TRANSIENT_RETRIES : 0;
+    let rateRetries = 0;
+    let transientRetries = 0;
+    for (;; ) {
+      throwIfAborted();
+      let value;
+      try {
+        value = await call("http", req);
+      } catch (error) {
+        if (error instanceof HostCallFailure && error.code === "EGRESS_RATE_LIMITED") {
+          const wait = error.retryAfterMs ?? RATE_LIMIT_BACKOFF_MS * 2 ** rateRetries;
+          if (rateRetries >= RATE_LIMIT_RETRIES)
+            throw new errors.RateLimited(wait, `${label} is still rate limited after ${RATE_LIMIT_RETRIES} retries`);
+          rateRetries += 1;
+          await sleep(clampWait(wait));
+          continue;
+        }
+        if (error instanceof HostCallFailure && error.code === "EGRESS_TIMEOUT") {
+          if (transientRetries >= transientLimit)
+            throw new errors.TransientError(`${label} timed out after ${transientRetries} retries`);
+          await sleep(TRANSIENT_BACKOFF_MS * 2 ** transientRetries);
+          transientRetries += 1;
+          continue;
+        }
+        throw error;
+      }
+      const response = toResponse(value, !raw);
+      if (raw)
+        return response;
+      const status = response.status;
+      if (status === 429) {
+        const wait = retryAfterMs(response.headers) ?? RATE_LIMIT_BACKOFF_MS * 2 ** rateRetries;
+        if (rateRetries >= RATE_LIMIT_RETRIES)
+          throw new errors.RateLimited(wait, `${label} returned 429 after ${RATE_LIMIT_RETRIES} retries`);
+        rateRetries += 1;
+        await sleep(clampWait(wait));
+        continue;
+      }
+      if (TRANSIENT_STATUS.includes(status)) {
+        if (transientRetries >= transientLimit)
+          throw new errors.TransientError(`${label} returned ${status} after ${transientRetries} retries`);
+        await sleep(TRANSIENT_BACKOFF_MS * 2 ** transientRetries);
+        transientRetries += 1;
+        continue;
+      }
+      if (status === 401)
+        throw new errors.AuthError(`${label} returned 401`);
+      if (status >= 400)
+        throw new errors.FatalError(`${label} returned ${status}`);
+      return response;
+    }
+  }
+  const verb = (method) => (url, options) => request(method, url, options);
+  return Object.freeze({
+    get: verb("GET"),
+    post: verb("POST"),
+    put: verb("PUT"),
+    patch: verb("PATCH"),
+    delete: verb("DELETE"),
+    request
+  });
+}
+
+// src/runtime/guest/map.ts
+function positiveInteger(value, what) {
+  if (typeof value !== "number" || !Number.isInteger(value) || value < 1)
+    throw new TypeError(`${what} must be a positive integer`);
+  return value;
+}
+function createMap(concurrency) {
+  const cap = concurrency ?? DEFAULT_CONCURRENCY;
+  return async (items, fn, options) => {
+    if (!Array.isArray(items))
+      throw new TypeError("ctx.map expects an array");
+    if (typeof fn !== "function")
+      throw new TypeError("ctx.map expects a function");
+    const requested = options?.concurrency === undefined ? cap : positiveInteger(options.concurrency, "ctx.map concurrency");
+    const limit = Math.min(requested, cap);
+    const results = new Array(items.length);
+    let next = 0;
+    let failed = false;
+    let firstError;
+    const worker = async () => {
+      while (!failed && next < items.length) {
+        const index = next;
+        next += 1;
+        try {
+          throwIfAborted();
+          results[index] = await fn(items[index]);
+        } catch (error) {
+          if (!failed) {
+            failed = true;
+            firstError = error;
+          }
+        }
+      }
+    };
+    const workers = [];
+    for (let i = 0;i < Math.min(limit, items.length); i += 1)
+      workers.push(worker());
+    await Promise.all(workers);
+    if (failed)
+      throw firstError;
+    return results;
+  };
+}
+
+// src/runtime/guest/paginate.ts
+function compare(a, b) {
+  if (typeof a === "number" && typeof b === "number")
+    return a - b;
+  if (typeof a === "bigint" && typeof b === "bigint")
+    return a < b ? -1 : a > b ? 1 : 0;
+  if (a instanceof Date && b instanceof Date)
+    return a.getTime() - b.getTime();
+  const left = String(a);
+  const right = String(b);
+  return left < right ? -1 : left > right ? 1 : 0;
+}
+function makePage(rows) {
+  return Object.freeze({
+    rows,
+    maxOf(fn) {
+      let max;
+      for (const row of rows) {
+        const value = fn(row);
+        if (value === undefined || value === null)
+          continue;
+        if (max === undefined || compare(value, max) > 0)
+          max = value;
+      }
+      return max;
+    }
+  });
+}
+function rowsOf2(value, what) {
+  if (!Array.isArray(value))
+    throw new TypeError(`${what} must return an array of rows`);
+  return value;
+}
+function requireFunction(value, what) {
+  if (typeof value !== "function")
+    throw new TypeError(`${what} must be a function`);
+}
+async function* pageIterator(options) {
+  requireFunction(options.request, "paginate.page request");
+  requireFunction(options.rows, "paginate.page rows");
+  const first = options.firstPage ?? 1;
+  for (let page = first;; page += 1) {
+    throwIfAborted();
+    const res = await options.request(page);
+    const rows = rowsOf2(options.rows(res), "paginate.page rows");
+    if (rows.length === 0)
+      return;
+    yield makePage(rows);
+    if (options.totalPages) {
+      const total = options.totalPages(res);
+      if (typeof total !== "number" || !Number.isFinite(total) || page - first + 1 >= total)
+        return;
+    }
+  }
+}
+async function* offsetIterator(options) {
+  requireFunction(options.request, "paginate.offset request");
+  requireFunction(options.rows, "paginate.offset rows");
+  const limit = options.limit;
+  if (typeof limit !== "number" || !Number.isInteger(limit) || limit < 1)
+    throw new TypeError("paginate.offset limit must be a positive integer");
+  for (let offset = options.startOffset ?? 0;; offset += limit) {
+    throwIfAborted();
+    const res = await options.request(offset, limit);
+    const rows = rowsOf2(options.rows(res), "paginate.offset rows");
+    if (rows.length === 0)
+      return;
+    yield makePage(rows);
+    if (options.total) {
+      const total = options.total(res);
+      if (typeof total !== "number" || !Number.isFinite(total) || offset + limit >= total)
+        return;
+    } else if (rows.length < limit) {
+      return;
+    }
+  }
+}
+async function* cursorIterator(options) {
+  requireFunction(options.request, "paginate.cursor request");
+  requireFunction(options.rows, "paginate.cursor rows");
+  requireFunction(options.nextCursor, "paginate.cursor nextCursor");
+  let cursor;
+  const seen = new Set;
+  for (;; ) {
+    throwIfAborted();
+    const res = await options.request(cursor);
+    const rows = rowsOf2(options.rows(res), "paginate.cursor rows");
+    if (rows.length > 0)
+      yield makePage(rows);
+    const next = options.nextCursor(res);
+    if (next === null || next === undefined || next === "")
+      return;
+    const text = String(next);
+    if (seen.has(text))
+      throw new TypeError(`paginate.cursor got the same cursor twice: ${text}`);
+    seen.add(text);
+    cursor = text;
+  }
+}
+function nextLink(header) {
+  if (!header)
+    return null;
+  for (const part of header.split(",")) {
+    const match = /^\s*<([^>]*)>(.*)$/.exec(part);
+    if (!match)
+      continue;
+    for (const param of (match[2] ?? "").split(";")) {
+      const rel = /^\s*rel\s*=\s*"?([^"]*)"?\s*$/i.exec(param);
+      if (rel && (rel[1] ?? "").toLowerCase().split(/\s+/).includes("next"))
+        return match[1] ?? null;
+    }
+  }
+  return null;
+}
+function resolveAgainst(link, current) {
+  if (/^https?:\/\//i.test(link))
+    return link;
+  const origin = /^(https?:\/\/[^/?#]+)/i.exec(current)?.[1];
+  if (!origin)
+    return link;
+  if (link.startsWith("//"))
+    return `${current.slice(0, current.indexOf(":") + 1)}${link}`;
+  if (link.startsWith("/"))
+    return `${origin}${link}`;
+  const path = current.slice(origin.length).replace(/[?#].*$/, "");
+  const dir = path.slice(0, path.lastIndexOf("/") + 1) || "/";
+  return `${origin}${dir}${link}`;
+}
+function linkIterator(http) {
+  return async function* (options) {
+    requireFunction(options.rows, "paginate.link rows");
+    if (typeof options.url !== "string")
+      throw new TypeError("paginate.link url must be a string");
+    let url = options.url;
+    const seen = new Set;
+    while (url !== null) {
+      throwIfAborted();
+      seen.add(url);
+      const res = await http.get(url, options.options);
+      const rows = rowsOf2(options.rows(res), "paginate.link rows");
+      if (rows.length > 0)
+        yield makePage(rows);
+      const next = options.next ? options.next(res) : nextLink(res.headers.link);
+      if (next === null || next === undefined || next === "")
+        return;
+      const resolved = resolveAgainst(String(next), res.url || url);
+      if (seen.has(resolved))
+        throw new TypeError(`paginate.link got the same next link twice: ${resolved}`);
+      url = resolved;
+    }
+  };
+}
+async function* keysetIterator(options) {
+  requireFunction(options.query, "paginate.keyset query");
+  requireFunction(options.key, "paginate.keyset key");
+  let last;
+  for (;; ) {
+    throwIfAborted();
+    const rows = [];
+    for await (const row of options.query(last))
+      rows.push(row);
+    if (rows.length === 0)
+      return;
+    yield makePage(rows);
+    const key = options.key(rows[rows.length - 1]);
+    if (key === undefined || key === null)
+      throw new TypeError("paginate.keyset key returned no value for the last row");
+    last = key;
+  }
+}
+function createPaginate(http) {
+  return Object.freeze({
+    page: pageIterator,
+    offset: offsetIterator,
+    cursor: cursorIterator,
+    link: linkIterator(http),
+    keyset: keysetIterator
+  });
+}
+
+// src/runtime/guest/signal.ts
+function createSignal() {
+  const signal = {
+    onAbort(fn) {
+      if (typeof fn !== "function")
+        throw new TypeError("ctx.signal.onAbort expects a function");
+      onAbort(fn);
+    }
+  };
+  Object.defineProperty(signal, "aborted", { get: isAborted, enumerable: true });
+  return Object.freeze(signal);
+}
+
+// src/runtime/guest/time.ts
+var DateCtor = Date;
+var dateUtc = Date.UTC;
+var dateParse = Date.parse;
+var reflectApply2 = Reflect.apply;
+var toISOString = Date.prototype.toISOString;
+var DateTimeFormat = Intl.DateTimeFormat;
+function isoNow() {
+  return reflectApply2(toISOString, new DateCtor, []);
+}
+function iso(ms) {
+  return reflectApply2(toISOString, new DateCtor(ms), []);
+}
+var DEFAULT_PATTERN = /^(\d{4})[-/](\d{1,2})[-/](\d{1,2})(?:[ T](\d{1,2}):(\d{2})(?::(\d{2})(?:\.(\d{1,9}))?)?)?$/;
+var ZONED_PATTERN = /^\d{4}-\d{2}-\d{2}[ T]\d{2}:\d{2}(?::\d{2}(?:\.\d+)?)?(?:Z|[+-]\d{2}:?\d{2})$/i;
+var TOKENS = [
+  { token: "YYYY", field: "year", pattern: "(\\d{4})" },
+  { token: "SSS", field: "millisecond", pattern: "(\\d{1,3})" },
+  { token: "MM", field: "month", pattern: "(\\d{2})" },
+  { token: "DD", field: "day", pattern: "(\\d{2})" },
+  { token: "HH", field: "hour", pattern: "(\\d{2})" },
+  { token: "mm", field: "minute", pattern: "(\\d{2})" },
+  { token: "ss", field: "second", pattern: "(\\d{2})" },
+  { token: "M", field: "month", pattern: "(\\d{1,2})" },
+  { token: "D", field: "day", pattern: "(\\d{1,2})" },
+  { token: "H", field: "hour", pattern: "(\\d{1,2})" }
+];
+function escapeRegExp(text) {
+  return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function parseWithFormat(local, format) {
+  const fields = [];
+  let source = "";
+  let i = 0;
+  while (i < format.length) {
+    const match = TOKENS.find((entry) => format.startsWith(entry.token, i));
+    if (match) {
+      fields.push(match.field);
+      source += match.pattern;
+      i += match.token.length;
+    } else {
+      source += escapeRegExp(format.charAt(i));
+      i += 1;
+    }
+  }
+  const result = new RegExp(`^${source}$`).exec(local);
+  if (!result || !fields.includes("year") || !fields.includes("month") || !fields.includes("day"))
+    return null;
+  const clock = { year: 0, month: 0, day: 0, hour: 0, minute: 0, second: 0, millisecond: 0 };
+  fields.forEach((field, index) => {
+    const text = result[index + 1] ?? "0";
+    clock[field] = field === "millisecond" ? Number(text.padEnd(3, "0")) : Number(text);
+  });
+  return clock;
+}
+function parseDefault(local) {
+  const match = DEFAULT_PATTERN.exec(local);
+  if (!match)
+    return null;
+  return {
+    year: Number(match[1]),
+    month: Number(match[2]),
+    day: Number(match[3]),
+    hour: Number(match[4] ?? 0),
+    minute: Number(match[5] ?? 0),
+    second: Number(match[6] ?? 0),
+    millisecond: Number((match[7] ?? "0").slice(0, 3).padEnd(3, "0"))
+  };
+}
+function wallMillis(clock) {
+  const ms = dateUtc(clock.year, clock.month - 1, clock.day, clock.hour, clock.minute, clock.second, clock.millisecond);
+  if (Number.isNaN(ms))
+    return null;
+  const check = new DateCtor(ms);
+  if (check.getUTCFullYear() !== clock.year || check.getUTCMonth() !== clock.month - 1 || check.getUTCDate() !== clock.day || check.getUTCHours() !== clock.hour || check.getUTCMinutes() !== clock.minute || check.getUTCSeconds() !== clock.second)
+    return null;
+  return ms;
+}
+var formatters = new Map;
+function formatter(timeZone) {
+  let cached = formatters.get(timeZone);
+  if (!cached) {
+    try {
+      cached = new DateTimeFormat("en-US", {
+        timeZone,
+        hourCycle: "h23",
+        year: "numeric",
+        month: "numeric",
+        day: "numeric",
+        hour: "numeric",
+        minute: "numeric",
+        second: "numeric"
+      });
+    } catch {
+      throw new TypeError(`unknown time zone ${timeZone}`);
+    }
+    formatters.set(timeZone, cached);
+  }
+  return cached;
+}
+function zoneOffset(timeZone, utcMs) {
+  const base = utcMs - (utcMs % 1000 + 1000) % 1000;
+  const parts = {};
+  for (const part of formatter(timeZone).formatToParts(new DateCtor(base))) {
+    if (part.type !== "literal")
+      parts[part.type] = Number(part.value);
+  }
+  const asUtc = dateUtc(parts.year ?? 0, (parts.month ?? 1) - 1, parts.day ?? 1, parts.hour ?? 0, parts.minute ?? 0, parts.second ?? 0);
+  return asUtc - base;
+}
+function toUtc(local, timeZone, format) {
+  if (typeof local !== "string")
+    throw new TypeError("ctx.time.toUtc expects a date-time string");
+  if (typeof timeZone !== "string" || timeZone.length === 0)
+    throw new TypeError("ctx.time.toUtc expects a time zone like Asia/Shanghai");
+  const text = local.trim();
+  if (format === undefined && ZONED_PATTERN.test(text)) {
+    const ms = dateParse(text.replace(" ", "T"));
+    if (Number.isNaN(ms))
+      throw new TypeError(`invalid date-time ${local}`);
+    return iso(ms);
+  }
+  const clock = format === undefined ? parseDefault(text) : parseWithFormat(text, format);
+  const wall = clock ? wallMillis(clock) : null;
+  if (wall === null)
+    throw new TypeError(`invalid date-time ${local}${format === undefined ? "" : ` for format ${format}`}`);
+  const first = zoneOffset(timeZone, wall);
+  let utc = wall - first;
+  const second = zoneOffset(timeZone, utc);
+  if (second !== first)
+    utc = wall - second;
+  return iso(utc);
+}
+function createTime() {
+  return Object.freeze({ now: isoNow, toUtc });
+}
+
+// src/runtime/guest/ctx.ts
+var SECRET_HANDLE_PREFIX = "ontos:secret:";
+var HOST_PLACEHOLDER2 = /\{config\.([^{}]*)\}/g;
+function isRecord5(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function deepFreeze(value) {
+  if (value === null || typeof value !== "object")
+    return value;
+  for (const key of Object.keys(value))
+    deepFreeze(value[key]);
+  return Object.freeze(value);
+}
+function configString(config, path) {
+  let current = config;
+  for (const segment of path.split(".")) {
+    if (!isRecord5(current) || !Object.hasOwn(current, segment))
+      return;
+    current = current[segment];
+  }
+  return typeof current === "string" && current.length > 0 ? current : undefined;
+}
+function defaultBaseUrl(hosts, config) {
+  for (const host of hosts) {
+    let missing = false;
+    const expanded = host.replace(HOST_PLACEHOLDER2, (_match, path) => {
+      const value = configString(config, path);
+      if (value === undefined)
+        missing = true;
+      return value ?? "";
+    });
+    if (!missing && !expanded.includes("*"))
+      return `https://${expanded}`;
+  }
+  return null;
+}
+async function prepareSecrets(summary, secretFields) {
+  const secrets = {};
+  for (const field of secretFields) {
+    if (!summary.secretFields.includes(field))
+      continue;
+    if (summary.exposeToScript.includes(field)) {
+      const response = await call("secret.reveal", { field });
+      if (!isRecord5(response) || typeof response.value !== "string")
+        throw new TypeError(`secret.reveal returned no value for ${field}`);
+      secrets[field] = response.value;
+    } else {
+      secrets[field] = `${SECRET_HANDLE_PREFIX}${field}`;
+    }
+  }
+  return Object.freeze(secrets);
+}
+function concurrencyFromDefinitionReply(reply) {
+  if (!isRecord5(reply) || !isRecord5(reply.rateLimit))
+    return null;
+  const concurrency = reply.rateLimit.concurrency;
+  if (typeof concurrency !== "number" || !Number.isFinite(concurrency) || concurrency < 1)
+    return null;
+  return Math.floor(concurrency);
+}
+function mapConcurrency(options) {
+  const declared = options.summary.rateLimit?.concurrency ?? DEFAULT_CONCURRENCY;
+  const effective = options.effectiveConcurrency ?? null;
+  return effective === null ? declared : Math.min(declared, effective);
+}
+function tableName(table) {
+  if (typeof table !== "string" || table.length === 0)
+    throw new TypeError("table must be a non-empty string");
+  return table;
+}
+function plainObject(value, what) {
+  if (!isRecord5(value))
+    throw new TypeError(`${what} must be an object`);
+  return value;
+}
+function createCheckContext(options) {
+  const config = deepFreeze(options.config);
+  const http = createHttp(defaultBaseUrl(options.summary.hosts, config));
+  const ctx = {
+    config,
+    secrets: options.secrets,
+    http,
+    paginate: createPaginate(http),
+    db: createDb(),
+    map: createMap(mapConcurrency(options)),
+    cache: createCache(),
+    crypto: createCrypto(),
+    time: createTime(),
+    log: options.logs.logger(),
+    signal: createSignal()
+  };
+  Object.defineProperty(ctx, "files", {
+    get() {
+      throw new errors.NotAvailable("ctx.files");
+    }
+  });
+  return Object.freeze(ctx);
+}
+function createPullContext(options) {
+  const base = createCheckContext(options);
+  const ctx = Object.create(null);
+  for (const key of Object.keys(base))
+    ctx[key] = base[key];
+  Object.defineProperty(ctx, "files", {
+    get() {
+      throw new errors.NotAvailable("ctx.files");
+    }
+  });
+  ctx.record = (table, row) => Object.freeze({ __ontos: "record", table: tableName(table), row: plainObject(row, "row") });
+  ctx.remove = (table, key) => Object.freeze({ __ontos: "remove", table: tableName(table), key: plainObject(key, "key") });
+  ctx.checkpoint = (state) => Object.freeze({ __ontos: "checkpoint", state });
+  return Object.freeze(ctx);
+}
+
+// src/runtime/guest/failure.ts
+function errorInfo(error) {
+  let code = null;
+  let message = "connector threw a non-error value";
+  let stack;
+  if (error !== null && (typeof error === "object" || typeof error === "function")) {
+    const value = error;
+    try {
+      if (typeof value.code === "string")
+        code = value.code;
+    } catch {
+      code = null;
+    }
+    try {
+      if (typeof value.message === "string")
+        message = value.message;
+    } catch {}
+    try {
+      if (typeof value.stack === "string")
+        stack = value.stack;
+    } catch {
+      stack = undefined;
+    }
+  } else if (typeof error === "string") {
+    message = error;
+  }
+  return { code, message, stack };
+}
+function connectorStack(stack) {
+  if (stack === undefined)
+    return;
+  const lines = stack.split(`
+`);
+  const frames = lines.slice(1).filter((line) => line.includes(`${CONNECTOR_FILENAME}:`));
+  if (frames.length === 0)
+    return;
+  return [lines[0] ?? "", ...frames].join(`
+`);
+}
+var CODE_MAP = Object.freeze({
+  AUTH_ERROR: "AUTH_ERROR",
+  TRANSIENT_ERROR: "TRANSIENT_ERROR",
+  RATE_LIMITED: "TRANSIENT_ERROR",
+  SCHEMA_ERROR: "SCHEMA_ERROR",
+  FATAL_ERROR: "FATAL_ERROR",
+  CANCELED: "CANCELED"
+});
+function failure(code, message, logs, stack) {
+  return { type: "failure", code, message, ...stack !== undefined ? { stack } : {}, logs };
+}
+function failureFromError(error, logs) {
+  const info = errorInfo(error);
+  const stack = connectorStack(info.stack);
+  if (isAborted())
+    return failure("CANCELED", "run was canceled", logs, stack);
+  const mapped = info.code !== null && Object.hasOwn(CODE_MAP, info.code) ? CODE_MAP[info.code] : undefined;
+  if (mapped)
+    return failure(mapped, info.message, logs, stack);
+  return failure("FATAL_ERROR", info.code === null ? info.message : `${info.code}: ${info.message}`, logs, stack);
+}
+
+// src/runtime/guest/discover.ts
+function plain(value) {
+  const text = jsonStringify(value);
+  if (typeof text !== "string")
+    throw new TypeError("discover result is not serializable");
+  return jsonParse(text);
+}
+async function discoverDeclaration(definition, options) {
+  const ctx = createCheckContext(options);
+  let raw;
+  try {
+    if (typeof definition.check === "function")
+      await Reflect.apply(definition.check, definition, [ctx]);
+    throwIfAborted();
+    raw = plain(await Reflect.apply(definition.discover, definition, [ctx]));
+    throwIfAborted();
+  } catch (error) {
+    return { ok: false, failure: failureFromError(error, options.logs.drain()) };
+  }
+  const issues = validateDiscoverResult(raw, definition);
+  if (issues.length > 0) {
+    const message = `invalid discover result: ${issues.map((issue) => `${issue.path || "(root)"}: ${issue.message}`).join("; ")}`;
+    return { ok: false, failure: failure("SCHEMA_ERROR", message, options.logs.drain()) };
+  }
+  return { ok: true, discover: normalizeDiscoverResult(raw) };
+}
+async function runDiscover(definition, options) {
+  const outcome = await discoverDeclaration(definition, options);
+  if (!outcome.ok)
+    return outcome.failure;
+  return {
+    type: "result",
+    result: { kind: "discover", summary: options.summary, discover: outcome.discover, logs: options.logs.drain() }
+  };
+}
+async function runCheck(definition, options) {
+  const ctx = createCheckContext(options);
+  try {
+    if (typeof definition.check === "function")
+      await Reflect.apply(definition.check, definition, [ctx]);
+    throwIfAborted();
+  } catch (error) {
+    return failureFromError(error, options.logs.drain());
+  }
+  return { type: "result", result: { kind: "check", ok: true, logs: options.logs.drain() } };
+}
+// src/t.ts
+var META_KEYS = ["title", "description", "placeholder"];
+function build(base, meta) {
+  const out = { ...base };
+  if (meta) {
+    for (const key of META_KEYS) {
+      if (meta[key] !== undefined)
+        out[key] = meta[key];
+    }
+  }
+  return Object.freeze(out);
+}
+function scalar(kind, meta) {
+  return build({ kind }, meta);
+}
+var t = Object.freeze({
+  string: (meta) => scalar("string", meta),
+  integer: (meta) => scalar("integer", meta),
+  decimal: (precision, scale, meta) => build({ kind: "decimal", precision, scale }, meta),
+  boolean: (meta) => scalar("boolean", meta),
+  date: (meta) => scalar("date", meta),
+  instant: (meta) => scalar("instant", meta),
+  json: (meta) => scalar("json", meta),
+  object: (shape, meta) => build({ kind: "object", shape: Object.freeze({ ...shape }) }, meta),
+  array: (item, meta) => build({ kind: "array", item }, meta),
+  secret: (options) => build(options?.exposeToScript === true ? { kind: "secret", exposeToScript: true } : { kind: "secret" }, options)
+});
+// src/presentation.ts
+var PACKAGE_JSON = "package.json";
+var README = "README.md";
+var ICON_PATHS = ["icon.svg", "icon.png"];
+var ICON_MIME = { "icon.svg": "image/svg+xml", "icon.png": "image/png" };
+var PNG_DATA_URI_PREFIX = "data:image/png;base64,";
+var PNG_SIGNATURE = [137, 80, 78, 71, 13, 10, 26, 10];
+var BASE64 = /^[A-Za-z0-9+/]*={0,2}$/;
+var FORBIDDEN_SVG_ELEMENTS = new Set(["script", "foreignobject", "iframe", "object", "embed"]);
+var ALLOWED_ENTITIES = new Set(["amp", "lt", "gt", "quot", "apos"]);
+var EMPTY_PRESENTATION = { title: null, description: null, icon: null, readme: false };
+function isRecord6(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function charCount(text) {
+  return [...text].length;
+}
+function utf8Length2(text) {
+  return new TextEncoder().encode(text).length;
+}
+function readText(owner, key, path, max, issues) {
+  const value = owner[key];
+  if (value === undefined)
+    return null;
+  if (typeof value !== "string" || value.trim().length === 0) {
+    issues.push({ path, message: `${path.slice(PACKAGE_JSON.length + 1)} must be a non-empty string` });
+    return null;
+  }
+  if (charCount(value) > max) {
+    issues.push({ path, message: `${path.slice(PACKAGE_JSON.length + 1)} must be at most ${max} characters` });
+    return null;
+  }
+  return value;
+}
+function scanSvgTags(text) {
+  const tags = [];
+  let i = 0;
+  const n = text.length;
+  const isSpace = (ch) => ch === " " || ch === "\t" || ch === `
+` || ch === "\r";
+  while (i < n) {
+    const lt = text.indexOf("<", i);
+    if (lt === -1)
+      break;
+    if (text.startsWith("<!--", lt)) {
+      const end = text.indexOf("-->", lt + 4);
+      if (end === -1)
+        return null;
+      i = end + 3;
+      continue;
+    }
+    if (text.startsWith("<?", lt)) {
+      const end = text.indexOf("?>", lt + 2);
+      if (end === -1)
+        return null;
+      i = end + 2;
+      continue;
+    }
+    i = lt + 1;
+    if (text[i] === "/") {
+      const end = text.indexOf(">", i);
+      if (end === -1)
+        return null;
+      i = end + 1;
+      continue;
+    }
+    while (isSpace(text[i]))
+      i += 1;
+    let name = "";
+    while (i < n && !isSpace(text[i]) && text[i] !== ">" && text[i] !== "/")
+      name += text[i++];
+    const tag = { name: name.slice(name.lastIndexOf(":") + 1), attributes: [] };
+    for (;; ) {
+      while (isSpace(text[i]))
+        i += 1;
+      if (i >= n)
+        return null;
+      if (text[i] === ">") {
+        i += 1;
+        break;
+      }
+      if (text[i] === "/") {
+        i += 1;
+        continue;
+      }
+      let attr = "";
+      while (i < n && !isSpace(text[i]) && text[i] !== "=" && text[i] !== ">" && text[i] !== "/")
+        attr += text[i++];
+      while (isSpace(text[i]))
+        i += 1;
+      let value = "";
+      if (text[i] === "=") {
+        i += 1;
+        while (isSpace(text[i]))
+          i += 1;
+        const quote = text[i];
+        if (quote === '"' || quote === "'") {
+          const end = text.indexOf(quote, i + 1);
+          if (end === -1)
+            return null;
+          value = text.slice(i + 1, end);
+          i = end + 1;
+        } else {
+          while (i < n && !isSpace(text[i]) && text[i] !== ">")
+            value += text[i++];
+        }
+      }
+      if (attr)
+        tag.attributes.push({ name: attr, value });
+    }
+    tags.push(tag);
+  }
+  return tags;
+}
+function cssProblem(css) {
+  const lower = css.toLowerCase();
+  if (lower.includes("url(") || lower.includes("@import"))
+    return "must not reference url() or @import in styles";
+  if (css.includes("\\"))
+    return "must not use escapes in styles";
+  return null;
+}
+function svgIconProblem(text) {
+  const lower = text.toLowerCase();
+  if (lower.includes("<!doctype") || lower.includes("<!entity"))
+    return "icon.svg must not contain <!DOCTYPE> or <!ENTITY>";
+  if (lower.includes("<![cdata["))
+    return "icon.svg must not contain CDATA sections";
+  for (const match of lower.matchAll(/&(#?[a-z0-9]*);?/g)) {
+    if (!ALLOWED_ENTITIES.has(match[1] ?? "") || !match[0].endsWith(";"))
+      return "icon.svg must not contain character or entity references other than &amp; &lt; &gt; &quot; &apos;";
+  }
+  const tags = scanSvgTags(lower);
+  if (tags === null)
+    return "icon.svg is not well-formed XML";
+  const root = tags[0];
+  if (!root || root.name !== "svg")
+    return "icon.svg must have an <svg> root element";
+  if (!root.attributes.some((attribute) => attribute.name === "viewbox"))
+    return "icon.svg root element must have a viewBox";
+  for (const tag of tags) {
+    if (FORBIDDEN_SVG_ELEMENTS.has(tag.name))
+      return `icon.svg must not contain <${tag.name}>`;
+    for (const { name, value } of tag.attributes) {
+      const local = name.slice(name.lastIndexOf(":") + 1);
+      if (local.startsWith("on"))
+        return `icon.svg must not contain event handler attributes (${name})`;
+      if (local === "href" && !value.trim().startsWith("#"))
+        return `icon.svg ${name} must be a local reference starting with #`;
+      if (local === "style") {
+        const problem = cssProblem(value);
+        if (problem)
+          return `icon.svg style attribute ${problem}`;
+      }
+    }
+  }
+  for (const match of lower.matchAll(/<(?:[a-z0-9_.-]+:)?style\b[^>]*>([\s\S]*?)(?:<\/|$)/g)) {
+    const problem = cssProblem(match[1] ?? "");
+    if (problem)
+      return `icon.svg <style> ${problem}`;
+  }
+  return null;
+}
+function decodeBase64(text) {
+  if (text.length % 4 !== 0 || !BASE64.test(text))
+    return null;
+  try {
+    const binary = atob(text);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0;i < binary.length; i += 1)
+      bytes[i] = binary.charCodeAt(i);
+    return bytes;
+  } catch {
+    return null;
+  }
+}
+function readUint32(bytes, offset) {
+  return (bytes[offset] ?? 0) * 16777216 + ((bytes[offset + 1] ?? 0) << 16 | (bytes[offset + 2] ?? 0) << 8 | (bytes[offset + 3] ?? 0));
+}
+function checkIcon(path, content) {
+  const limit = PRESENTATION_LIMITS.iconBytes;
+  if (path === "icon.svg") {
+    const bytes = new TextEncoder().encode(content);
+    if (bytes.length > limit)
+      return { problem: `icon.svg must be at most ${limit} bytes` };
+    const problem = svgIconProblem(content);
+    return problem ? { problem } : { bytes };
+  }
+  if (!content.startsWith(PNG_DATA_URI_PREFIX))
+    return { problem: `icon.png must be stored as ${PNG_DATA_URI_PREFIX}<data>` };
+  const encoded = content.slice(PNG_DATA_URI_PREFIX.length);
+  if (Math.floor(encoded.length / 4) * 3 - 2 > limit)
+    return { problem: `icon.png must be at most ${limit} bytes` };
+  const bytes = decodeBase64(encoded);
+  if (bytes === null)
+    return { problem: "icon.png is not valid base64" };
+  if (bytes.length > limit)
+    return { problem: `icon.png must be at most ${limit} bytes` };
+  if (bytes.length < 24 || PNG_SIGNATURE.some((byte, i) => bytes[i] !== byte) || String.fromCharCode(...bytes.subarray(12, 16)) !== "IHDR") {
+    return { problem: "icon.png is not a PNG image" };
+  }
+  const width = readUint32(bytes, 16);
+  const height = readUint32(bytes, 20);
+  const min = PRESENTATION_LIMITS.iconMinPx;
+  if (width !== height || width < min)
+    return { problem: `icon.png must be square and at least ${min}×${min} pixels, got ${width}×${height}` };
+  return { bytes };
+}
+function readConnectorPresentation(files, sha256) {
+  const issues = [];
+  let pkg;
+  try {
+    pkg = JSON.parse(files[PACKAGE_JSON] ?? "");
+  } catch {
+    pkg = undefined;
+  }
+  if (!isRecord6(pkg)) {
+    return { presentation: { ...EMPTY_PRESENTATION }, issues: [{ path: PACKAGE_JSON, message: "package.json must be a JSON object" }] };
+  }
+  const presentation = { ...EMPTY_PRESENTATION };
+  presentation.description = readText(pkg, "description", `${PACKAGE_JSON}:description`, PRESENTATION_LIMITS.description, issues);
+  const ontos = pkg.ontos;
+  if (ontos !== undefined && !isRecord6(ontos)) {
+    issues.push({ path: `${PACKAGE_JSON}:ontos`, message: "ontos must be an object" });
+  } else if (ontos) {
+    presentation.title = readText(ontos, "title", `${PACKAGE_JSON}:ontos.title`, PRESENTATION_LIMITS.title, issues);
+    const icon = ontos.icon;
+    if (icon !== undefined) {
+      if (typeof icon !== "string" || !ICON_PATHS.includes(icon)) {
+        issues.push({ path: `${PACKAGE_JSON}:ontos.icon`, message: "ontos.icon must be icon.svg or icon.png (a file in the source root)" });
+      } else {
+        const path = icon;
+        const content = files[path];
+        if (content === undefined) {
+          issues.push({ path, message: `${path} is referenced by ontos.icon but missing` });
+        } else {
+          const checked = checkIcon(path, content);
+          if ("problem" in checked)
+            issues.push({ path, message: checked.problem });
+          else
+            presentation.icon = { path, mime: ICON_MIME[path], sha256: sha256(checked.bytes), bytes: checked.bytes.length };
+        }
+      }
+    }
+  }
+  const readme = files[README];
+  if (readme !== undefined) {
+    if (utf8Length2(readme) > PRESENTATION_LIMITS.readmeBytes) {
+      issues.push({ path: README, message: `README.md must be at most ${PRESENTATION_LIMITS.readmeBytes} bytes` });
+    } else {
+      presentation.readme = true;
+    }
+  }
+  return { presentation, issues };
+}
+function decodeConnectorIcon(files, path) {
+  const content = files[path];
+  if (content === undefined || !ICON_PATHS.includes(path))
+    return null;
+  const checked = checkIcon(path, content);
+  return "bytes" in checked ? checked.bytes : null;
+}
+
+// src/index.ts
+var SDK_VERSION = "3.0.1";
+var SUPPORTED_SDK_MAJORS = [3];
+
+// src/runtime/guest/loader.ts
+var SDK_SPECIFIER = "@deepexi/datasense-connector";
+var sdkModule = Object.freeze({ ...exports_src, __esModule: true });
+function connectorRequire(specifier) {
+  if (specifier === SDK_SPECIFIER)
+    return sdkModule;
+  throw new ConnectorError("CONNECTOR_LOAD_FAILED", `cannot require ${String(specifier)}: connectors can only import ${SDK_SPECIFIER} and relative files`);
+}
+function resolveExport(exported) {
+  if (exported !== null && (typeof exported === "object" || typeof exported === "function")) {
+    const fallback = exported.default;
+    if (fallback !== undefined && fallback !== null)
+      return fallback;
+  }
+  return exported;
+}
+function loadDefinition(factory, expect) {
+  if (typeof factory !== "function")
+    return { ok: false, message: "connector code did not compile to a module", stack: undefined };
+  let definition;
+  try {
+    const module2 = { exports: {} };
+    Reflect.apply(factory, undefined, [module2, module2.exports, connectorRequire]);
+    definition = resolveExport(module2.exports);
+  } catch (error) {
+    const info = errorInfo(error);
+    return { ok: false, message: `connector code failed to load: ${info.message}`, stack: info.stack };
+  }
+  const issues = validateConnectorDefinition(definition);
+  if (issues.length > 0) {
+    return { ok: false, message: `invalid connector definition: ${issues.map((issue) => `${issue.path || "(root)"}: ${issue.message}`).join("; ")}`, stack: undefined };
+  }
+  const loaded = definition;
+  if (loaded.name !== expect.name || loaded.version !== expect.version) {
+    return { ok: false, message: `connector code defines ${loaded.name}@${loaded.version}, expected ${expect.name}@${expect.version}`, stack: undefined };
+  }
+  return { ok: true, definition: loaded };
+}
+
+// src/runtime/guest/log.ts
+function render(message, data) {
+  let text = typeof message === "string" ? message : "non-string log message";
+  if (data !== undefined) {
+    try {
+      const extra = jsonStringify(data);
+      if (typeof extra === "string")
+        text = `${text} ${extra}`;
+    } catch {}
+  }
+  return text.length > MAX_LOG_MESSAGE ? text.slice(0, MAX_LOG_MESSAGE) : text;
+}
+function createLogBuffer() {
+  let entries = [];
+  let total = 0;
+  const write = (level, requestId, isOpen) => (message, data) => {
+    if (total >= MAX_LOGS || isOpen && !isOpen())
+      return;
+    total += 1;
+    entries[entries.length] = { at: isoNow(), level, message: render(message, data), ...requestId !== undefined ? { requestId } : {} };
+  };
+  return {
+    drain() {
+      const out = entries;
+      entries = [];
+      return out;
+    },
+    logger(requestId, isOpen) {
+      return Object.freeze({ info: write("info", requestId, isOpen), warn: write("warn", requestId, isOpen), error: write("error", requestId, isOpen) });
+    }
+  };
+}
+
+// src/runtime/guest/pull.ts
+function isRecord7(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function copy(value, what) {
+  let text;
+  try {
+    text = jsonStringify(value);
+  } catch (error) {
+    throw new errors.SchemaError(`${what} is not serializable: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  if (typeof text !== "string")
+    throw new errors.SchemaError(`${what} is not serializable`);
+  return { value: jsonParse(text), text };
+}
+var BATCH_FRAME_BYTES = 5;
+var ITEM_FRAME_BYTES = 17 + 1;
+function itemBytes(table, valueText) {
+  return ITEM_FRAME_BYTES + utf8Length(jsonStringify(table)) + utf8Length(valueText);
+}
+function emptyBatch() {
+  return { records: [], removals: [], checkpoint: undefined, bytes: BATCH_FRAME_BYTES, dropped: 0 };
+}
+function closeIterator(iterator) {
+  try {
+    const closing = iterator.return?.();
+    if (closing && typeof closing.then === "function")
+      closing.then(undefined, () => {
+        return;
+      });
+  } catch {}
+}
+async function runPull(definition, job, options) {
+  const streams = definition.streams ?? {};
+  const stream = streams[job.stream];
+  const ctx = createPullContext(options);
+  const input = Object.freeze({
+    mode: job.mode,
+    state: job.state === null ? undefined : deepFreeze(job.state),
+    streamConfig: deepFreeze(job.streamConfig)
+  });
+  const tables = new Set(job.tables);
+  let batch = emptyBatch();
+  let emitted = 0;
+  const flush = async () => {
+    const payload = {
+      records: batch.records,
+      removals: batch.removals,
+      ...batch.checkpoint ? { checkpoint: batch.checkpoint } : {},
+      logs: options.logs.drain(),
+      ...batch.dropped > 0 ? { dropped: batch.dropped } : {}
+    };
+    batch = emptyBatch();
+    const reply = await call("emit", payload);
+    emitted += 1;
+    if (isRecord7(reply) && reply.stop === true)
+      requestStop();
+  };
+  const result = () => ({
+    type: "result",
+    result: { kind: "pull", emittedBatches: emitted, ...isStopped() ? { stopped: true } : {}, logs: options.logs.drain() }
+  });
+  let oversized = 0;
+  const log = options.logs.logger();
+  const add = async (what, table, size, push) => {
+    if (BATCH_FRAME_BYTES + size > PULL_BATCH_MAX_BYTES) {
+      oversized += 1;
+      batch.dropped += 1;
+      log.warn(`RECORD_TOO_LARGE: ${what} for table "${table}" is ${size} bytes, more than the ${PULL_BATCH_MAX_BYTES}-byte batch limit; it was dropped`);
+      if (oversized > PULL_REJECT_THRESHOLD) {
+        throw new errors.SchemaError(`stream ${job.stream} produced ${oversized} records larger than ${PULL_BATCH_MAX_BYTES} bytes, more than ${PULL_REJECT_THRESHOLD}`);
+      }
+      return;
+    }
+    if (batch.records.length + batch.removals.length > 0 && batch.bytes + size > PULL_BATCH_MAX_BYTES)
+      await flush();
+    push();
+    batch.bytes += size;
+    if (batch.records.length + batch.removals.length >= PULL_BATCH_MAX_RECORDS)
+      await flush();
+  };
+  const checkTable = (table) => {
+    if (typeof table !== "string" || !tables.has(table)) {
+      throw new errors.SchemaError(`stream ${job.stream} produced a record for table ${String(table)}, which is not declared for this stream`);
+    }
+    return table;
+  };
+  let iterator;
+  try {
+    const iterable = Reflect.apply(stream, streams, [ctx, input]);
+    const factory = isRecord7(iterable) || typeof iterable === "function" ? iterable[Symbol.asyncIterator] : undefined;
+    if (typeof factory !== "function")
+      throw new errors.SchemaError(`stream ${job.stream} must be an async generator function`);
+    iterator = Reflect.apply(factory, iterable, []);
+  } catch (error) {
+    return failureFromError(error, options.logs.drain());
+  }
+  try {
+    for (;; ) {
+      if (isAborted()) {
+        closeIterator(iterator);
+        return isStopped() ? result() : failure("CANCELED", "run was canceled", options.logs.drain());
+      }
+      const step = await iterator.next();
+      if (step.done)
+        break;
+      const item = step.value;
+      const kind = isRecord7(item) ? item.__ontos : undefined;
+      if (kind === "record" && isRecord7(item)) {
+        const table = checkTable(item.table);
+        if (!isRecord7(item.row))
+          throw new errors.SchemaError(`stream ${job.stream} produced a record whose row is not an object`);
+        const row = copy(item.row, "row");
+        await add("record", table, itemBytes(table, row.text), () => batch.records.push({ table, row: row.value }));
+      } else if (kind === "remove" && isRecord7(item)) {
+        const table = checkTable(item.table);
+        if (!isRecord7(item.key))
+          throw new errors.SchemaError(`stream ${job.stream} produced a removal whose key is not an object`);
+        const key = copy(item.key, "key");
+        await add("removal", table, itemBytes(table, key.text), () => batch.removals.push({ table, key: key.value }));
+      } else if (kind === "checkpoint" && isRecord7(item)) {
+        batch.checkpoint = { state: copy(item.state, "checkpoint state").value };
+        await flush();
+      } else {
+        throw new errors.SchemaError(`stream ${job.stream} yielded a value that is not ctx.record(), ctx.remove() or ctx.checkpoint()`);
+      }
+    }
+    if (isAborted())
+      return isStopped() ? result() : failure("CANCELED", "run was canceled", options.logs.drain());
+    if (batch.records.length + batch.removals.length > 0 || batch.dropped > 0)
+      await flush();
+  } catch (error) {
+    closeIterator(iterator);
+    if (isStopped())
+      return result();
+    return failureFromError(error, options.logs.drain());
+  }
+  return result();
+}
+
+// src/runtime/guest/push.ts
+var WHOLE_RUN_FAILURES = ["SCHEMA_ERROR", "FATAL_ERROR"];
+function copyRecord(value, what) {
+  if (value === null || typeof value !== "object" || Array.isArray(value))
+    throw new TypeError(`${what} must be an object`);
+  const text = jsonStringify(value);
+  if (typeof text !== "string")
+    throw new TypeError(`${what} is not serializable`);
+  return jsonParse(text);
+}
+async function runPush(definition, job) {
+  const handlers = definition.push !== null && typeof definition.push === "object" ? definition.push : {};
+  if (Object.keys(handlers).length === 0)
+    return failure("CONNECTOR_LOAD_FAILED", "connector does not support push", []);
+  const config = deepFreeze(job.config);
+  const logs = createLogBuffer();
+  const result = { kind: "push", records: [], removals: [], rejected: [], logs: [] };
+  for (const request of job.requests) {
+    const requestId = request.requestId;
+    const handler = Object.hasOwn(handlers, request.push) ? handlers[request.push] : undefined;
+    if (!handler) {
+      result.rejected.push({ requestId, code: "PUSH_UNKNOWN", message: `connector has no push named ${request.push}` });
+      continue;
+    }
+    const pending = { records: [], removals: [], open: true };
+    const assertOpen = () => {
+      if (!pending.open)
+        throw new TypeError("ctx is no longer usable after the request finished");
+    };
+    const ctx = Object.freeze({
+      config,
+      record(table, row) {
+        assertOpen();
+        if (typeof table !== "string")
+          throw new TypeError("table must be a string");
+        pending.records.push({ requestId, table, row: copyRecord(row, "row") });
+      },
+      remove(table, key) {
+        assertOpen();
+        if (typeof table !== "string")
+          throw new TypeError("table must be a string");
+        pending.removals.push({ requestId, table, key: copyRecord(key, "key") });
+      },
+      log: logs.logger(requestId, () => pending.open),
+      time: Object.freeze({ now: isoNow })
+    });
+    const body = request.body;
+    const req = Object.freeze({
+      id: requestId,
+      receivedAt: request.receivedAt,
+      headers: deepFreeze({ ...request.headers }),
+      body,
+      json() {
+        return jsonParse(body);
+      }
+    });
+    try {
+      if (typeof handler.verify === "function")
+        await Reflect.apply(handler.verify, handler, [ctx, req]);
+      await Reflect.apply(handler.map, handler, [ctx, req]);
+      pending.open = false;
+      result.records.push(...pending.records);
+      result.removals.push(...pending.removals);
+    } catch (error) {
+      pending.open = false;
+      const info = errorInfo(error);
+      if (info.code !== null && WHOLE_RUN_FAILURES.includes(info.code)) {
+        return failure(info.code, info.message, logs.drain(), connectorStack(info.stack));
+      }
+      result.rejected.push({ requestId, code: info.code ?? "CONNECTOR_ERROR", message: info.message });
+    }
+  }
+  result.logs = logs.drain();
+  return { type: "result", result };
+}
+
+// src/runtime/guest/index.ts
+var STRIPPED_GLOBALS = ["WebAssembly", "ShadowRealm", "console"];
+function issuesText(issues) {
+  return issues.map((issue) => `${issue.path || "(root)"}: ${issue.message}`).join("; ");
+}
+async function run2(definition, job) {
+  if (job.kind === "push")
+    return runPush(definition, job);
+  if (job.kind === "pull" && !(definition.streams && Object.hasOwn(definition.streams, job.stream))) {
+    return failure("CONNECTOR_LOAD_FAILED", `connector has no stream named ${job.stream}`, []);
+  }
+  const summary = jsonParse(jsonStringify(summarizeDefinition(definition)));
+  const logs = createLogBuffer();
+  let effectiveConcurrency;
+  try {
+    effectiveConcurrency = concurrencyFromDefinitionReply(await call("definition", summary));
+  } catch (error) {
+    return failureFromError(error, logs.drain());
+  }
+  const issues = validateConfig(definition.config, job.config);
+  if (issues.length > 0)
+    return failure("CONFIG_INVALID", `invalid connection config: ${issuesText(issues)}`, logs.drain());
+  let secrets;
+  try {
+    secrets = await prepareSecrets(summary, job.secretFields);
+  } catch (error) {
+    return failureFromError(error, logs.drain());
+  }
+  const options = { config: job.config, secrets, summary, logs, effectiveConcurrency };
+  if (job.kind === "discover")
+    return runDiscover(definition, options);
+  if (job.kind === "check")
+    return runCheck(definition, options);
+  if (job.discoverFirst !== true)
+    return runPull(definition, job, options);
+  const declared = await discoverDeclaration(definition, options);
+  if (!declared.ok)
+    return declared.failure;
+  try {
+    await call("declaration", { summary, discover: declared.discover });
+  } catch (error) {
+    return failureFromError(error, logs.drain());
+  }
+  const stream = Object.hasOwn(declared.discover.streams, job.stream) ? declared.discover.streams[job.stream] : undefined;
+  if (!stream)
+    return failure("SCHEMA_ERROR", `stream ${job.stream} is not in the discover result`, logs.drain());
+  return runPull(definition, { ...job, tables: Object.keys(stream.tables) }, options);
+}
+async function execute(json, factory) {
+  const { expect, job } = jsonParse(json);
+  const loaded = loadDefinition(factory, expect);
+  if (!loaded.ok)
+    return failure("CONNECTOR_LOAD_FAILED", loaded.message, [], connectorStack(loaded.stack));
+  return run2(loaded.definition, job);
+}
+var started = false;
+function start(json, factory) {
+  if (started || typeof json !== "string")
+    return;
+  started = true;
+  let pending;
+  try {
+    pending = execute(json, factory);
+  } catch (error) {
+    finish(failure("FATAL_ERROR", errorInfo(error).message, []));
+    return;
+  }
+  pending.then((outcome) => finish(outcome), (error) => finish(failure("FATAL_ERROR", `connector runtime failed: ${errorInfo(error).message}`, [])));
+}
+function bootGuest() {
+  for (const name of STRIPPED_GLOBALS)
+    Reflect.deleteProperty(globalThis, name);
+  return Object.freeze({ start, handle, poll });
+}
+function bootLocalGuest() {
+  return Object.freeze({ start, handle, poll });
+}