@deepexi/datasense-connector 3.0.1 → 3.1.0

package/cjs/testing.cjs

@@ -1,3591 +0,0 @@
-var __create = Object.create;
-var __getProtoOf = Object.getPrototypeOf;
-var __defProp = Object.defineProperty;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-function __accessProp(key) {
-  return this[key];
-}
-var __toESMCache_node;
-var __toESMCache_esm;
-var __toESM = (mod, isNodeMode, target) => {
-  var canCache = mod != null && typeof mod === "object";
-  if (canCache) {
-    var cache = isNodeMode ? __toESMCache_node ??= new WeakMap : __toESMCache_esm ??= new WeakMap;
-    var cached = cache.get(mod);
-    if (cached)
-      return cached;
-  }
-  target = mod != null ? __create(__getProtoOf(mod)) : {};
-  const to = isNodeMode || !mod || !mod.__esModule || !__hasOwnProp.call(mod, "default") ? __defProp(target, "default", { value: mod, enumerable: true }) : target;
-  if (mod && typeof mod === "object" || typeof mod === "function") {
-    for (let key of __getOwnPropNames(mod))
-      if (!__hasOwnProp.call(to, key))
-        __defProp(to, key, {
-          get: __accessProp.bind(mod, key),
-          enumerable: true
-        });
-  }
-  if (canCache)
-    cache.set(mod, to);
-  return to;
-};
-var __toCommonJS = (from) => {
-  var entry = (__moduleCache ??= new WeakMap).get(from), desc;
-  if (entry)
-    return entry;
-  entry = __defProp({}, "__esModule", { value: true });
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (var key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(entry, key))
-        __defProp(entry, key, {
-          get: __accessProp.bind(from, key),
-          enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
-        });
-  }
-  __moduleCache.set(from, entry);
-  return entry;
-};
-var __moduleCache;
-var __returnValue = (v) => v;
-function __exportSetter(name, newValue) {
-  this[name] = __returnValue.bind(null, newValue);
-}
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, {
-      get: all[name],
-      enumerable: true,
-      configurable: true,
-      set: __exportSetter.bind(all, name)
-    });
-};
-
-// src/testing/index.ts
-var exports_testing = {};
-__export(exports_testing, {
-  COMPLIANCE_CODES: () => COMPLIANCE_CODES,
-  CREDENTIAL_HEADER_NAMES: () => CREDENTIAL_HEADER_NAMES,
-  FixtureFormatError: () => FixtureFormatError,
-  FixtureReplayError: () => FixtureReplayError,
-  LocalRunError: () => LocalRunError,
-  SourceLoadError: () => SourceLoadError,
-  checkCompliance: () => checkCompliance,
-  createInProcessExecutor: () => createInProcessExecutor,
-  createLocalGateway: () => createLocalGateway,
-  createRecorder: () => createRecorder,
-  createReplayHost: () => createReplayHost,
-  createVmExecutor: () => createVmExecutor,
-  inferRecordSchema: () => inferRecordSchema,
-  inspectDefinition: () => inspectDefinition,
-  loadConnectorSource: () => loadConnectorSource,
-  parseFixtures: () => parseFixtures,
-  readFixtureDir: () => readFixtureDir,
-  redactHeaders: () => redactHeaders,
-  redactQuery: () => redactQuery,
-  redactSecretValues: () => redactSecretValues,
-  redactUrl: () => redactUrl,
-  runCheck: () => runCheck,
-  runDiscover: () => runDiscover,
-  runFixture: () => runFixture,
-  runFixtures: () => runFixtures,
-  runPush: () => runPush,
-  runStream: () => runStream,
-  secretRedactionTexts: () => secretRedactionTexts,
-  serializeFixture: () => serializeFixture
-});
-module.exports = __toCommonJS(exports_testing);
-
-// src/testing/types.ts
-class LocalRunError extends Error {
-  code;
-  constructor(code, message) {
-    super(message);
-    this.name = "LocalRunError";
-    this.code = code;
-  }
-}
-
-class SourceLoadError extends Error {
-  code;
-  file;
-  constructor(code, message, file = null) {
-    super(message);
-    this.name = "SourceLoadError";
-    this.code = code;
-    this.file = file;
-  }
-}
-// src/testing/gateway.ts
-var import_node_crypto2 = require("node:crypto");
-var import_promises = require("node:dns/promises");
-
-// src/testing/local-db.ts
-var import_node_crypto = require("node:crypto");
-
-// src/testing/redaction.ts
-var CREDENTIAL_HEADER_NAMES = Object.freeze([
-  "authorization",
-  "proxy-authorization",
-  "cookie",
-  "set-cookie",
-  "x-api-key",
-  "x-auth-token"
-]);
-var REDACT_MIN_LENGTH = 4;
-var REDACTED = "***";
-var CREDENTIAL_HEADER_SET = new Set(CREDENTIAL_HEADER_NAMES);
-var HANDLE_PATTERN = /ontos(?::|%3[Aa])secret(?::|%3[Aa])/;
-function containsSecretHandle(text) {
-  return HANDLE_PATTERN.test(text);
-}
-function redactSecretValues(text, secrets) {
-  const candidates = [...new Set(secrets.filter((secret) => typeof secret === "string" && secret.length >= REDACT_MIN_LENGTH))].sort((a, b) => b.length - a.length);
-  let result = text;
-  for (const secret of candidates) {
-    if (result.includes(secret))
-      result = result.split(secret).join(REDACTED);
-  }
-  return result;
-}
-function secretRedactionTexts(secrets) {
-  const result = new Set;
-  for (const secret of secrets) {
-    if (typeof secret !== "string")
-      continue;
-    result.add(secret);
-    result.add(encodeURIComponent(secret));
-    result.add(new URLSearchParams([["", secret]]).toString().slice(1));
-  }
-  return [...result];
-}
-function redactHeaders(headers, secrets) {
-  const result = {};
-  for (const [name, value] of Object.entries(headers)) {
-    result[name] = CREDENTIAL_HEADER_SET.has(name.toLowerCase()) ? REDACTED : redactSecretValues(String(value), secrets);
-  }
-  return result;
-}
-function redactQuery(query, secrets) {
-  const one = (value) => containsSecretHandle(value) ? REDACTED : redactSecretValues(value, secrets);
-  const result = {};
-  for (const [name, value] of Object.entries(query))
-    result[name] = Array.isArray(value) ? value.map(one) : one(value);
-  return result;
-}
-function redactUrl(url, secrets) {
-  let text = url;
-  try {
-    const parsed = new URL(url);
-    const entries = [...parsed.searchParams.entries()];
-    if (entries.some(([, value]) => containsSecretHandle(value))) {
-      const masked = new URLSearchParams;
-      for (const [name, value] of entries)
-        masked.append(name, containsSecretHandle(value) ? REDACTED : value);
-      parsed.search = masked.toString();
-      text = parsed.toString();
-    }
-  } catch {}
-  return redactSecretValues(text, secrets);
-}
-
-// src/testing/local-db.ts
-var BATCH_ROWS = 1000;
-var STATEMENT_TIMEOUT_MS = 300000;
-var APPLICATION_NAME = "datasense-connector-local";
-var RAW_TEXT_OIDS = [1082, 1083, 1114, 1266];
-function isRecord(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function factoryOf(driver) {
-  if (typeof driver === "function")
-    return driver;
-  if (isRecord(driver) && typeof driver.default === "function")
-    return driver.default;
-  return null;
-}
-async function loadDriver(injected) {
-  if (injected !== undefined && injected !== null) {
-    const factory = factoryOf(injected);
-    if (!factory)
-      throw new LocalRunError("DB_DRIVER_MISSING", "the injected postgres driver is not the postgres.js module");
-    return factory;
-  }
-  const specifier = "postgres";
-  let loaded;
-  try {
-    loaded = await import(specifier);
-  } catch {
-    throw new LocalRunError("DB_DRIVER_MISSING", "ctx.db needs the postgres driver: install it next to the connector (npm install --save-dev postgres)");
-  }
-  const factory = factoryOf(loaded);
-  if (!factory)
-    throw new LocalRunError("DB_DRIVER_MISSING", "the installed postgres package is not the postgres.js driver");
-  return factory;
-}
-function toParam(value) {
-  if (value === undefined)
-    return null;
-  if (isRecord(value))
-    return JSON.stringify(value);
-  return value;
-}
-function toJsonValue(value) {
-  if (value instanceof Date)
-    return Number.isNaN(value.getTime()) ? null : value.toISOString();
-  if (typeof value === "bigint")
-    return value.toString();
-  if (value instanceof Uint8Array)
-    return Buffer.from(value).toString("base64");
-  if (Array.isArray(value))
-    return value.map(toJsonValue);
-  return value;
-}
-function toRows(rows) {
-  return rows.map((row) => {
-    const out = {};
-    for (const [name, value] of Object.entries(row))
-      out[name] = toJsonValue(value);
-    return out;
-  });
-}
-
-class LocalDbError extends Error {
-  code;
-  constructor(code, message) {
-    super(message);
-    this.name = "LocalDbError";
-    this.code = code;
-  }
-}
-function createLocalDb(target, options) {
-  let pool = null;
-  const cursors = new Map;
-  const secrets = [...options.secrets, target.password];
-  const poolOf = async () => {
-    if (pool)
-      return pool;
-    const factory = await loadDriver(options.driver);
-    pool = factory({
-      host: target.host,
-      port: target.port,
-      database: target.database,
-      username: target.user,
-      password: target.password,
-      ssl: target.ssl ? "require" : false,
-      max: 4,
-      idle_timeout: 60,
-      connect_timeout: 10,
-      prepare: false,
-      onnotice: () => {},
-      connection: { application_name: APPLICATION_NAME },
-      types: {
-        rawText: { to: 25, from: RAW_TEXT_OIDS, serialize: (value) => String(value), parse: (value) => value }
-      }
-    });
-    return pool;
-  };
-  const failed = (error) => {
-    if (error instanceof LocalDbError || error instanceof LocalRunError)
-      return error;
-    const message = redactSecretValues(error instanceof Error ? error.message : String(error), secrets);
-    return new LocalDbError("DB_PROXY_FAILED", `The query to the source database failed: ${message}`);
-  };
-  const finish = async (id, cursor, ok) => {
-    cursors.delete(id);
-    try {
-      if (ok)
-        await cursor.iterator.return?.();
-      await cursor.reserved.unsafe(ok ? "commit" : "rollback");
-    } catch {
-      await Promise.resolve(cursor.reserved.unsafe("rollback")).then(undefined, () => {
-        return;
-      });
-    } finally {
-      cursor.reserved.release();
-    }
-  };
-  return {
-    async query(request) {
-      const sql = await poolOf();
-      let reserved = null;
-      try {
-        reserved = await sql.reserve();
-        await reserved.unsafe("begin read only");
-        await reserved.unsafe(`set local statement_timeout = ${STATEMENT_TIMEOUT_MS}`);
-        const iterator = reserved.unsafe(request.sql, request.params.map(toParam)).cursor(BATCH_ROWS)[Symbol.asyncIterator]();
-        const first = await iterator.next();
-        const rows = first.done ? [] : first.value;
-        const fields = (rows.columns ?? []).map((column) => ({ name: column.name, dataTypeId: column.type }));
-        const id = import_node_crypto.randomUUID();
-        const cursor = { reserved, iterator };
-        reserved = null;
-        if (first.done === true || rows.length < BATCH_ROWS) {
-          await finish(id, cursor, true);
-          return { cursorId: null, fields, rows: toRows(rows), done: true };
-        }
-        cursors.set(id, cursor);
-        return { cursorId: id, fields, rows: toRows(rows), done: false };
-      } catch (error) {
-        if (reserved) {
-          const held = reserved;
-          await Promise.resolve(held.unsafe("rollback")).then(undefined, () => {
-            return;
-          });
-          held.release();
-        }
-        throw failed(error);
-      }
-    },
-    async next(cursorId) {
-      const cursor = cursors.get(cursorId);
-      if (!cursor)
-        throw new LocalDbError("DB_CURSOR_NOT_FOUND", "The cursor doesn't exist or was closed");
-      try {
-        const step = await cursor.iterator.next();
-        const rows = step.done ? [] : step.value;
-        const done = step.done === true || rows.length < BATCH_ROWS;
-        if (done)
-          await finish(cursorId, cursor, true);
-        return { rows: toRows(rows), done };
-      } catch (error) {
-        await finish(cursorId, cursor, false);
-        throw failed(error);
-      }
-    },
-    async close(cursorId) {
-      const cursor = cursors.get(cursorId);
-      if (cursor)
-        await finish(cursorId, cursor, true);
-    },
-    async end() {
-      for (const [id, cursor] of [...cursors])
-        await finish(id, cursor, false);
-      const current = pool;
-      pool = null;
-      if (current)
-        await current.end({ timeout: 5 }).catch(() => {
-          return;
-        });
-    }
-  };
-}
-
-// src/testing/pinned-http.ts
-var import_node_http = require("node:http");
-var import_node_https = require("node:https");
-var import_node_zlib = require("node:zlib");
-
-class PinnedBodyTooLargeError extends Error {
-  constructor() {
-    super("response body too large");
-    this.name = "PinnedBodyTooLargeError";
-  }
-}
-var NULL_BODY_STATUSES = new Set([101, 103, 204, 205, 304]);
-function pinnedLookup(addresses) {
-  return (_hostname, options, callback) => {
-    const all = typeof options === "object" && options !== null && options.all === true;
-    const first = addresses[0];
-    if (!first) {
-      callback(Object.assign(new Error("no address to connect to"), { code: "ENOTFOUND" }), []);
-      return;
-    }
-    if (all)
-      callback(null, [...addresses]);
-    else
-      callback(null, first.address, first.family);
-  };
-}
-function decompress(bytes, encoding, maxBytes) {
-  const options = { maxOutputLength: maxBytes + 1 };
-  try {
-    switch (encoding) {
-      case "gzip":
-      case "x-gzip":
-        return import_node_zlib.gunzipSync(bytes, options);
-      case "deflate":
-        try {
-          return import_node_zlib.inflateSync(bytes, options);
-        } catch (error) {
-          if (error instanceof RangeError)
-            throw error;
-          return import_node_zlib.inflateRawSync(bytes, options);
-        }
-      case "br":
-        return import_node_zlib.brotliDecompressSync(bytes, options);
-      default:
-        return bytes;
-    }
-  } catch (error) {
-    if (error instanceof RangeError || error.code === "ERR_BUFFER_TOO_LARGE")
-      throw new PinnedBodyTooLargeError;
-    throw error;
-  }
-}
-function toHeaders(response) {
-  const headers = new Headers;
-  const raw = response.rawHeaders;
-  for (let index = 0;index + 1 < raw.length; index += 2) {
-    try {
-      headers.append(raw[index] ?? "", raw[index + 1] ?? "");
-    } catch {}
-  }
-  return headers;
-}
-function pinnedRequest(input) {
-  const { url, method, signal, maxBytes } = input;
-  const send = url.protocol === "https:" ? import_node_https.request : import_node_http.request;
-  const body = input.body !== null && method !== "GET" && method !== "HEAD" ? Buffer.from(input.body) : null;
-  const headers = { ...input.headers };
-  if (body !== null)
-    headers["content-length"] = String(body.byteLength);
-  return new Promise((resolve, reject) => {
-    if (signal.aborted) {
-      reject(new Error("aborted"));
-      return;
-    }
-    let settled = false;
-    const fail = (error) => {
-      if (settled)
-        return;
-      settled = true;
-      signal.removeEventListener("abort", onAbort);
-      reject(error);
-    };
-    const req = send(url, { method, headers, lookup: pinnedLookup(input.addresses) }, (response) => {
-      const chunks = [];
-      let size = 0;
-      response.on("data", (chunk) => {
-        size += chunk.byteLength;
-        if (size > maxBytes) {
-          req.destroy();
-          fail(new PinnedBodyTooLargeError);
-          return;
-        }
-        chunks.push(chunk);
-      });
-      response.on("error", (error) => fail(error));
-      response.on("end", () => {
-        if (settled)
-          return;
-        try {
-          const status = response.statusCode ?? 0;
-          const encoding = (response.headers["content-encoding"] ?? "").trim().toLowerCase();
-          const bytes = method === "HEAD" ? Buffer.alloc(0) : decompress(Buffer.concat(chunks), encoding, maxBytes);
-          const responseHeaders = toHeaders(response);
-          const body = NULL_BODY_STATUSES.has(status) || bytes.byteLength === 0 ? null : bytes;
-          const result = new Response(body, { status, headers: responseHeaders });
-          settled = true;
-          signal.removeEventListener("abort", onAbort);
-          resolve(result);
-        } catch (error) {
-          fail(error instanceof Error ? error : new Error(String(error)));
-        }
-      });
-    });
-    const onAbort = () => {
-      req.destroy(new Error("aborted"));
-      fail(new Error("aborted"));
-    };
-    signal.addEventListener("abort", onAbort, { once: true });
-    req.on("error", (error) => fail(error));
-    req.end(body ?? undefined);
-  });
-}
-
-// src/testing/gateway.ts
-class LocalGatewayError extends Error {
-  code;
-  status;
-  constructor(code, message, status) {
-    super(message);
-    this.name = "LocalGatewayError";
-    this.code = code;
-    this.status = status;
-  }
-}
-var DEFAULT_TIMEOUT_MS = 30000;
-var MAX_TIMEOUT_MS = 120000;
-var RESPONSE_MAX_BYTES = 10 * 1024 * 1024;
-var MAX_REDIRECTS = 5;
-var REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);
-var DROPPED_REQUEST_HEADERS = new Set(["host", "content-length", "connection", "transfer-encoding", "keep-alive", "upgrade"]);
-var METADATA_ADDRESSES = new Set(["169.254.169.254", "100.100.100.200", "fd00:ec2::254"]);
-var SECRET_FIELD = "[A-Za-z_][A-Za-z0-9_]*";
-var PLAIN_HANDLE = new RegExp(`ontos:secret:(${SECRET_FIELD})`, "g");
-var URL_HANDLE = new RegExp(`ontos(?::|%3[Aa])secret(?::|%3[Aa])(${SECRET_FIELD})`, "g");
-function isRecord2(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function errorMessage(error) {
-  return error instanceof Error ? error.message : String(error);
-}
-function sleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
-}
-function normalizeHost(host) {
-  const value = host.trim().replace(/^\[|\]$/g, "").replace(/\.$/, "").toLowerCase();
-  const mapped = /^::ffff:(?:0:)?([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(value);
-  if (mapped) {
-    const high = Number.parseInt(mapped[1] ?? "0", 16);
-    const low = Number.parseInt(mapped[2] ?? "0", 16);
-    return `${high >> 8}.${high & 255}.${low >> 8}.${low & 255}`;
-  }
-  const dotted = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(value);
-  if (dotted?.[1])
-    return dotted[1];
-  return value;
-}
-function matchHostPattern(host, pattern) {
-  const normalized = normalizeHost(pattern);
-  if (normalized.startsWith("*.")) {
-    const suffix = normalized.slice(1);
-    return suffix.length > 1 && host.length > suffix.length && host.endsWith(suffix);
-  }
-  return normalized !== "" && host === normalized;
-}
-function isMetadataAddress(host) {
-  return METADATA_ADDRESSES.has(normalizeHost(host));
-}
-function isIpLiteral(host) {
-  return /^\d+\.\d+\.\d+\.\d+$/.test(host) || host.includes(":");
-}
-function secretUnavailable(field) {
-  return new LocalGatewayError("EGRESS_SECRET_UNAVAILABLE", `Secret '${field}' is unavailable: it isn't configured locally`, 422);
-}
-function lookupSecret(values, field) {
-  const value = Object.hasOwn(values, field) ? values[field] : undefined;
-  if (typeof value !== "string")
-    throw secretUnavailable(field);
-  return value;
-}
-function substituteHandles(text, values) {
-  for (const match of text.matchAll(PLAIN_HANDLE))
-    lookupSecret(values, match[1] ?? "");
-  return text.replace(PLAIN_HANDLE, (_match, field) => lookupSecret(values, field));
-}
-function substituteUrlHandles(text, values) {
-  for (const match of text.matchAll(URL_HANDLE))
-    lookupSecret(values, match[1] ?? "");
-  return text.replace(URL_HANDLE, (_match, field) => encodeURIComponent(lookupSecret(values, field)));
-}
-
-class LocalLimiter {
-  perSecond;
-  concurrency;
-  nextAt = 0;
-  active = 0;
-  waiting = [];
-  constructor(perSecond, concurrency) {
-    this.perSecond = perSecond;
-    this.concurrency = concurrency;
-  }
-  async acquire() {
-    if (this.active < this.concurrency && this.waiting.length === 0) {
-      this.active += 1;
-    } else {
-      await new Promise((resolve) => this.waiting.push(resolve));
-    }
-    const now = Date.now();
-    const at = Math.max(now, this.nextAt);
-    this.nextAt = at + 1000 / this.perSecond;
-    if (at > now)
-      await sleep(at - now);
-    let released = false;
-    return () => {
-      if (released)
-        return;
-      released = true;
-      const next = this.waiting.shift();
-      if (next)
-        next();
-      else
-        this.active -= 1;
-    };
-  }
-}
-function parseHttpRequest(payload) {
-  if (!isRecord2(payload) || typeof payload.url !== "string" || typeof payload.method !== "string") {
-    throw new LocalGatewayError("BAD_REQUEST", "http request must have a method and a url", 400);
-  }
-  return payload;
-}
-function scriptUrlOf(request) {
-  let url;
-  try {
-    url = new URL(request.url);
-  } catch {
-    throw new LocalGatewayError("BAD_REQUEST", "url must be an absolute URL", 400);
-  }
-  for (const [name, value] of Object.entries(request.query ?? {})) {
-    for (const item of Array.isArray(value) ? value : [value])
-      url.searchParams.append(name, item);
-  }
-  return url;
-}
-var utf8 = new TextDecoder("utf-8", { fatal: true });
-function encodeBody(bytes) {
-  try {
-    return { body: utf8.decode(bytes), bodyEncoding: "utf8" };
-  } catch {
-    return { body: Buffer.from(bytes).toString("base64"), bodyEncoding: "base64" };
-  }
-}
-function tooLarge() {
-  return new LocalGatewayError("EGRESS_RESPONSE_TOO_LARGE", `The external system's response exceeds the ${RESPONSE_MAX_BYTES / 1024 / 1024} MiB limit`, 502);
-}
-function hostDenied(host) {
-  return new LocalRunError("HOST_DENIED", `Access to host '${host}' is denied: add it to the connector's hosts and the local configuration`);
-}
-function computeCrypto(request, values) {
-  const data = substituteHandles(request.data, values);
-  switch (request.op) {
-    case "hash":
-      return { value: import_node_crypto2.createHash(request.algorithm).update(data, "utf8").digest(request.encoding) };
-    case "hmac":
-      return { value: import_node_crypto2.createHmac(request.algorithm, substituteHandles(request.key, values)).update(data, "utf8").digest(request.encoding) };
-    case "sign": {
-      try {
-        return { value: import_node_crypto2.sign("sha256", Buffer.from(data, "utf8"), substituteHandles(request.key, values)).toString(request.encoding) };
-      } catch (error) {
-        if (error instanceof LocalGatewayError)
-          throw error;
-        throw new LocalGatewayError("BAD_REQUEST", "key is not a valid RSA private key", 400);
-      }
-    }
-    default:
-      throw new LocalGatewayError("BAD_REQUEST", "op must be one of hmac, sign, hash", 400);
-  }
-}
-function createLocalGateway(options) {
-  const secrets = { ...options.secrets };
-  const secretTexts = secretRedactionTexts([...Object.values(secrets), ...options.db?.password ? [options.db.password] : []]);
-  const redact = (text) => redactSecretValues(text, secretTexts);
-  const hostPatterns = [...options.hosts];
-  const doFetch = options.fetch ?? fetch;
-  const realNetwork = options.fetch === undefined;
-  const resolveHost = options.resolve ?? ((host) => import_promises.lookup(host, { all: true, verbatim: true }));
-  const limiter = options.rateLimit && options.rateLimit.perSecond > 0 ? new LocalLimiter(options.rateLimit.perSecond, Math.max(1, Math.floor(options.rateLimit.concurrency || 1))) : null;
-  const cache = new Map;
-  let db = null;
-  const exchange = (entry) => {
-    try {
-      options.onExchange?.(entry);
-    } catch {}
-  };
-  const checkHost = async (url) => {
-    const host = normalizeHost(url.hostname);
-    if (isMetadataAddress(host))
-      throw hostDenied(host);
-    const allowed = hostPatterns.some((pattern) => matchHostPattern(host, pattern) || normalizeHost(pattern) === url.host.toLowerCase());
-    if (!allowed)
-      throw hostDenied(host);
-    if (!realNetwork)
-      return null;
-    if (isIpLiteral(host))
-      return [{ address: host, family: host.includes(":") ? 6 : 4 }];
-    let addresses;
-    try {
-      addresses = await resolveHost(host);
-    } catch (error) {
-      throw new LocalGatewayError("EGRESS_UPSTREAM_FAILED", redact(`The outbound request failed: cannot resolve ${host}: ${errorMessage(error)}`), 502);
-    }
-    if (addresses.length === 0)
-      throw new LocalGatewayError("EGRESS_UPSTREAM_FAILED", `The outbound request failed: cannot resolve ${host}`, 502);
-    if (addresses.some((record) => isMetadataAddress(record.address)))
-      throw hostDenied(host);
-    return addresses;
-  };
-  const sendOnce = async (url, method, headers, body, addresses, signal) => {
-    try {
-      if (addresses !== null)
-        return await pinnedRequest({ url, method, headers, body, addresses, signal, maxBytes: RESPONSE_MAX_BYTES });
-      return await doFetch(url.toString(), {
-        method,
-        headers,
-        ...body !== null && method !== "GET" && method !== "HEAD" ? { body } : {},
-        redirect: "manual",
-        signal
-      });
-    } catch (error) {
-      if (error instanceof PinnedBodyTooLargeError)
-        throw tooLarge();
-      if (signal.aborted)
-        throw new LocalGatewayError("EGRESS_TIMEOUT", "The outbound request timed out", 504);
-      throw new LocalGatewayError("EGRESS_UPSTREAM_FAILED", redact(`The outbound request failed: ${errorMessage(error)}`), 502);
-    }
-  };
-  const http = async (payload) => {
-    const request = parseHttpRequest(payload);
-    const scriptUrl = scriptUrlOf(request);
-    let url;
-    try {
-      url = new URL(substituteUrlHandles(scriptUrl.toString(), secrets));
-    } catch (error) {
-      if (error instanceof LocalGatewayError)
-        throw error;
-      throw new LocalGatewayError("BAD_REQUEST", "url is not valid after substituting secrets", 400);
-    }
-    if (url.protocol !== "https:" && url.protocol !== "http:")
-      throw new LocalGatewayError("EGRESS_SCHEME_DENIED", "Only http(s) outbound requests are allowed", 403);
-    let addresses = await checkHost(url);
-    let headers = {};
-    for (const [name, value] of Object.entries(request.headers ?? {})) {
-      if (DROPPED_REQUEST_HEADERS.has(name.toLowerCase()))
-        continue;
-      headers[name] = substituteHandles(value, secrets);
-    }
-    let body = null;
-    if (request.body !== null && request.body !== undefined) {
-      body = request.bodyEncoding === "base64" ? Buffer.from(request.body, "base64") : Buffer.from(substituteHandles(request.body, secrets), "utf8");
-    }
-    const timeoutMs = Math.min(request.timeoutMs ?? DEFAULT_TIMEOUT_MS, MAX_TIMEOUT_MS);
-    const release = limiter ? await limiter.acquire() : () => {
-      return;
-    };
-    const controller = new AbortController;
-    const timer = setTimeout(() => controller.abort(), timeoutMs);
-    try {
-      let method = request.method;
-      let redirects = 0;
-      for (;; ) {
-        const response = await sendOnce(url, method, headers, body, addresses, controller.signal);
-        const location = response.headers.get("location");
-        if (REDIRECT_STATUSES.has(response.status) && location !== null && redirects < MAX_REDIRECTS) {
-          let next = null;
-          try {
-            next = new URL(location, url);
-          } catch {
-            next = null;
-          }
-          if (next && next.host === url.host && (next.protocol === "https:" || next.protocol === "http:")) {
-            redirects += 1;
-            if (response.status === 303 ? method !== "HEAD" : (response.status === 301 || response.status === 302) && method !== "GET" && method !== "HEAD") {
-              method = "GET";
-              body = null;
-              headers = Object.fromEntries(Object.entries(headers).filter(([name]) => name.toLowerCase() !== "content-type"));
-            }
-            url = next;
-            addresses = await checkHost(url);
-            continue;
-          }
-        }
-        let bytes;
-        try {
-          bytes = method === "HEAD" ? new Uint8Array : new Uint8Array(await response.arrayBuffer());
-        } catch (error) {
-          if (controller.signal.aborted)
-            throw new LocalGatewayError("EGRESS_TIMEOUT", "The outbound request timed out", 504);
-          throw new LocalGatewayError("EGRESS_UPSTREAM_FAILED", redact(`Reading the response failed: ${errorMessage(error)}`), 502);
-        }
-        if (bytes.byteLength > RESPONSE_MAX_BYTES)
-          throw tooLarge();
-        const responseHeaders = {};
-        response.headers.forEach((value, name) => {
-          const lower = name.toLowerCase();
-          if (lower === "content-encoding" || lower === "content-length")
-            return;
-          responseHeaders[lower] = value;
-        });
-        return {
-          status: response.status,
-          url: redirects === 0 ? scriptUrl.toString() : url.toString(),
-          headers: responseHeaders,
-          ...encodeBody(bytes)
-        };
-      }
-    } finally {
-      clearTimeout(timer);
-      release();
-    }
-  };
-  const redactResponse = (response) => ({
-    ...response,
-    url: redact(response.url),
-    headers: Object.fromEntries(Object.entries(response.headers).map(([name, value]) => [name, redact(value)])),
-    body: response.bodyEncoding === "utf8" ? redact(response.body) : response.body
-  });
-  const dbOf = () => {
-    if (!options.db)
-      throw new LocalGatewayError("DB_PROXY_NOT_DECLARED", "ctx.db is not configured locally: set db in the local configuration", 403);
-    if (isMetadataAddress(options.db.host))
-      throw hostDenied(normalizeHost(options.db.host));
-    db ??= createLocalDb(options.db, { driver: options.postgres, secrets: Object.values(secrets) });
-    return db;
-  };
-  const traced = async (kind, request, run) => {
-    const startedAt = Date.now();
-    try {
-      const response = await run();
-      exchange({ kind, request, response, error: null, durationMs: Date.now() - startedAt });
-      return response;
-    } catch (error) {
-      const code = isRecord2(error) && typeof error.code === "string" ? error.code : "HOST_CALL_FAILED";
-      exchange({ kind, request, response: null, error: { code, message: errorMessage(error) }, durationMs: Date.now() - startedAt });
-      throw error;
-    }
-  };
-  const call = async (method, payload) => {
-    switch (method) {
-      case "http":
-        return redactResponse(await traced("http", payload, () => http(payload)));
-      case "db.query": {
-        const request = payload;
-        return traced("db", request, () => dbOf().query({ sql: request.sql, params: request.params ?? [] }));
-      }
-      case "db.next": {
-        const cursorId = isRecord2(payload) && typeof payload.cursorId === "string" ? payload.cursorId : "";
-        return traced("db", { cursorId }, () => dbOf().next(cursorId));
-      }
-      case "db.close": {
-        const cursorId = isRecord2(payload) && typeof payload.cursorId === "string" ? payload.cursorId : "";
-        await dbOf().close(cursorId);
-        return null;
-      }
-      case "crypto":
-        return traced("crypto", payload, async () => computeCrypto(payload, secrets));
-      case "cache.get": {
-        const key = isRecord2(payload) && typeof payload.key === "string" ? payload.key : "";
-        const entry = cache.get(key);
-        if (!entry || Date.parse(entry.expiresAt) <= Date.now())
-          return null;
-        return entry;
-      }
-      case "cache.set": {
-        if (!isRecord2(payload) || typeof payload.key !== "string" || typeof payload.value !== "string" || typeof payload.ttlSeconds !== "number") {
-          throw new LocalGatewayError("BAD_REQUEST", "cache.set needs key, value and ttlSeconds", 400);
-        }
-        cache.set(payload.key, { value: payload.value, expiresAt: new Date(Date.now() + payload.ttlSeconds * 1000).toISOString() });
-        return null;
-      }
-      case "secret.reveal": {
-        const field = isRecord2(payload) && typeof payload.field === "string" ? payload.field : "";
-        return { value: lookupSecret(secrets, field) };
-      }
-      default:
-        throw new LocalGatewayError("HOST_METHOD_UNSUPPORTED", `the local gateway does not answer ${method}`);
-    }
-  };
-  return {
-    call,
-    redact,
-    async close() {
-      const current = db;
-      db = null;
-      if (current)
-        await current.end();
-    }
-  };
-}
-// src/testing/engine.ts
-var import_node_child_process = require("node:child_process");
-var import_node_path3 = __toESM(require("node:path"), 1);
-
-// src/internal/location.ts
-var import_node_path = __toESM(require("node:path"), 1);
-var IS_SOURCE = false;
-var PACKAGE_ROOT = import_node_path.default.resolve(__dirname, "..");
-function moduleFile(relative) {
-  return import_node_path.default.join(PACKAGE_ROOT, relative + ".js");
-}
-
-// src/runtime/guest-runtime.ts
-var import_promises2 = require("node:fs/promises");
-var import_node_path2 = __toESM(require("node:path"), 1);
-var GUEST_ENTRY_PATH = moduleFile("runtime/guest/index");
-var GUEST_BUNDLE_FILE = "guest.cjs";
-var CODE_FILE = /\.[cm]?[jt]sx?$/;
-function readSourcePlugin(bun) {
-  return {
-    name: "datasense-connector-read-source",
-    setup(build) {
-      build.onLoad({ filter: CODE_FILE }, async (args) => {
-        const extension = args.path.slice(args.path.lastIndexOf(".") + 1);
-        const loader = extension === "tsx" ? "tsx" : extension === "jsx" ? "jsx" : /^[cm]?js$/.test(extension) ? "js" : "ts";
-        return { contents: await bun.file(args.path).text(), loader };
-      });
-    }
-  };
-}
-var MACROS_OFF = { macros: false };
-async function bundleGuestWithBun(entry = GUEST_ENTRY_PATH) {
-  const bun = globalThis.Bun;
-  if (!bun)
-    throw new Error("the guest runtime can only be bundled from source under Bun; use the built package (dist) under Node.js");
-  const result = await bun.build({
-    entrypoints: [entry],
-    format: "cjs",
-    target: "browser",
-    minify: false,
-    external: [],
-    plugins: [readSourcePlugin(bun)],
-    throw: false,
-    ...MACROS_OFF
-  });
-  const output = result.outputs.find((item) => item.kind === "entry-point");
-  if (!result.success || !output) {
-    throw new Error(`guest runtime bundle failed: ${result.logs.map((log) => log.message).join("; ") || "no output"}`);
-  }
-  return output.text();
-}
-var cached = null;
-function loadGuestRuntime() {
-  if (cached)
-    return cached;
-  const pending = IS_SOURCE ? bundleGuestWithBun() : import_promises2.readFile(import_node_path2.default.join(PACKAGE_ROOT, GUEST_BUNDLE_FILE), "utf8");
-  cached = pending;
-  pending.catch(() => {
-    if (cached === pending)
-      cached = null;
-  });
-  return pending;
-}
-
-// src/runtime/protocol.ts
-var HOST_METHODS = Object.freeze([
-  "definition",
-  "declaration",
-  "http",
-  "db.query",
-  "db.next",
-  "db.close",
-  "crypto",
-  "cache.get",
-  "cache.set",
-  "secret.reveal",
-  "emit"
-]);
-var GUEST_FAILURE_CODES = Object.freeze([
-  "CONNECTOR_LOAD_FAILED",
-  "CONFIG_INVALID",
-  "SCHEMA_ERROR",
-  "FATAL_ERROR",
-  "AUTH_ERROR",
-  "TRANSIENT_ERROR",
-  "PUSH_UNKNOWN",
-  "CANCELED"
-]);
-var HTTP_METHODS = new Set(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD"]);
-var BODY_ENCODINGS = new Set(["utf8", "base64"]);
-var DIGEST_ENCODINGS = new Set(["hex", "base64"]);
-var HMAC_ALGORITHMS = new Set(["sha1", "sha256", "sha512"]);
-var HASH_ALGORITHMS = new Set(["md5", "sha1", "sha256", "sha512"]);
-var LOG_LEVELS = new Set(["info", "warn", "error"]);
-var SYNC_MODES = new Set(["full", "incremental"]);
-var SNAPSHOTS = new Set(["complete", "partial"]);
-var HOST_METHOD_SET = new Set(HOST_METHODS);
-var FAILURE_CODE_SET = new Set(GUEST_FAILURE_CODES);
-function isRecord3(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function isStringArray(value) {
-  return Array.isArray(value) && value.every((item) => typeof item === "string");
-}
-function isStringRecord(value) {
-  return isRecord3(value) && Object.values(value).every((item) => typeof item === "string");
-}
-function isId(value) {
-  return typeof value === "number" && Number.isSafeInteger(value) && value > 0;
-}
-function parsePushRequest(value) {
-  if (!isRecord3(value))
-    return null;
-  const { requestId, push, receivedAt, headers, body } = value;
-  if (typeof requestId !== "string" || typeof push !== "string" || typeof receivedAt !== "string" || !isStringRecord(headers) || typeof body !== "string")
-    return null;
-  return { requestId, push, receivedAt, headers: { ...headers }, body };
-}
-function parseJob(value) {
-  if (!isRecord3(value) || !isRecord3(value.config) || !isStringArray(value.secretFields))
-    return null;
-  const config = value.config;
-  const secretFields = [...value.secretFields];
-  if (value.kind === "push") {
-    if (!Array.isArray(value.requests))
-      return null;
-    const requests = [];
-    for (const item of value.requests) {
-      const request = parsePushRequest(item);
-      if (!request)
-        return null;
-      requests.push(request);
-    }
-    return { kind: "push", config, secretFields, requests };
-  }
-  if (value.kind === "discover")
-    return { kind: "discover", config, secretFields };
-  if (value.kind === "check")
-    return { kind: "check", config, secretFields };
-  if (value.kind === "pull") {
-    const { stream, mode, streamConfig, tables, discoverFirst } = value;
-    if (typeof stream !== "string" || typeof mode !== "string" || !SYNC_MODES.has(mode) || !isRecord3(streamConfig) || !isStringArray(tables))
-      return null;
-    if (discoverFirst !== undefined && typeof discoverFirst !== "boolean")
-      return null;
-    return {
-      kind: "pull",
-      config,
-      secretFields,
-      stream,
-      mode,
-      state: value.state,
-      streamConfig,
-      tables: [...tables],
-      ...discoverFirst === true ? { discoverFirst: true } : {}
-    };
-  }
-  return null;
-}
-function parseHostError(value) {
-  if (!isRecord3(value) || typeof value.code !== "string" || typeof value.message !== "string")
-    return null;
-  const error = { code: value.code, message: value.message };
-  if (value.status !== undefined) {
-    if (typeof value.status !== "number" || !Number.isInteger(value.status))
-      return null;
-    error.status = value.status;
-  }
-  if (value.retryAfterMs !== undefined) {
-    if (typeof value.retryAfterMs !== "number" || !Number.isFinite(value.retryAfterMs) || value.retryAfterMs < 0)
-      return null;
-    error.retryAfterMs = value.retryAfterMs;
-  }
-  return error;
-}
-function parseParentMessage(value) {
-  if (!isRecord3(value))
-    return null;
-  switch (value.type) {
-    case "execute": {
-      const { guest, code, expect } = value;
-      if (typeof guest !== "string" || typeof code !== "string")
-        return null;
-      if (!isRecord3(expect) || typeof expect.name !== "string" || typeof expect.version !== "string")
-        return null;
-      const job = parseJob(value.job);
-      return job ? { type: "execute", guest, code, expect: { name: expect.name, version: expect.version }, job } : null;
-    }
-    case "reply": {
-      if (!isId(value.id))
-        return null;
-      if (value.ok === true)
-        return { type: "reply", id: value.id, ok: true, value: value.value };
-      if (value.ok !== false)
-        return null;
-      const error = parseHostError(value.error);
-      return error ? { type: "reply", id: value.id, ok: false, error } : null;
-    }
-    case "cancel":
-      return { type: "cancel" };
-    default:
-      return null;
-  }
-}
-function parseLogs(value) {
-  if (!Array.isArray(value))
-    return null;
-  const logs = [];
-  for (const entry of value) {
-    if (!isRecord3(entry) || typeof entry.at !== "string" || typeof entry.level !== "string" || !LOG_LEVELS.has(entry.level) || typeof entry.message !== "string")
-      return null;
-    if (entry.requestId !== undefined && typeof entry.requestId !== "string")
-      return null;
-    logs.push({
-      at: entry.at,
-      level: entry.level,
-      message: entry.message,
-      ...entry.requestId !== undefined ? { requestId: entry.requestId } : {}
-    });
-  }
-  return logs;
-}
-function parseSummary(value) {
-  if (!isRecord3(value))
-    return null;
-  const { name, version, hosts, db, rateLimit, pushes, streams, secretFields, exposeToScript, config } = value;
-  if (typeof name !== "string" || typeof version !== "string")
-    return null;
-  if (!isStringArray(hosts) || !isStringArray(pushes) || !isStringArray(streams) || !isStringArray(secretFields) || !isStringArray(exposeToScript))
-    return null;
-  if (db !== null && !(isRecord3(db) && db.engine === "postgresql"))
-    return null;
-  let parsedRateLimit = null;
-  if (rateLimit !== null) {
-    if (!isRecord3(rateLimit) || typeof rateLimit.perSecond !== "number" || typeof rateLimit.concurrency !== "number")
-      return null;
-    parsedRateLimit = { perSecond: rateLimit.perSecond, concurrency: rateLimit.concurrency };
-  }
-  return {
-    name,
-    version,
-    hosts: [...hosts],
-    db: db === null ? null : { engine: "postgresql" },
-    rateLimit: parsedRateLimit,
-    pushes: [...pushes],
-    streams: [...streams],
-    secretFields: [...secretFields],
-    exposeToScript: [...exposeToScript],
-    ...isRecord3(config) ? { config } : {}
-  };
-}
-function parseTables(value) {
-  if (!isRecord3(value))
-    return null;
-  const tables = {};
-  for (const [name, table] of Object.entries(value)) {
-    if (!isRecord3(table) || !isRecord3(table.columns) || !isStringArray(table.primaryKey))
-      return null;
-    tables[name] = table;
-  }
-  return tables;
-}
-function parseDiscover(value) {
-  if (!isRecord3(value) || !isRecord3(value.streams) || !isRecord3(value.pushes))
-    return null;
-  const result = { streams: {}, pushes: {} };
-  for (const [name, stream] of Object.entries(value.streams)) {
-    if (!isRecord3(stream) || !isStringArray(stream.syncModes) || !stream.syncModes.every((mode) => SYNC_MODES.has(mode)))
-      return null;
-    if (typeof stream.snapshot !== "string" || !SNAPSHOTS.has(stream.snapshot))
-      return null;
-    if (stream.params !== undefined && !(isRecord3(stream.params) && stream.params.kind === "object"))
-      return null;
-    const tables = parseTables(stream.tables);
-    if (!tables)
-      return null;
-    result.streams[name] = {
-      tables,
-      syncModes: [...stream.syncModes],
-      snapshot: stream.snapshot,
-      ...stream.params !== undefined ? { params: stream.params } : {}
-    };
-  }
-  for (const [name, push] of Object.entries(value.pushes)) {
-    if (!isRecord3(push))
-      return null;
-    const tables = parseTables(push.tables);
-    if (!tables)
-      return null;
-    result.pushes[name] = { tables };
-  }
-  return result;
-}
-function parsePushResult(value, requestIds) {
-  const { records, removals, rejected } = value;
-  if (!Array.isArray(records) || !Array.isArray(removals) || !Array.isArray(rejected))
-    return null;
-  const logs = parseLogs(value.logs);
-  if (!logs)
-    return null;
-  const result = { kind: "push", records: [], removals: [], rejected: [], logs };
-  for (const item of records) {
-    if (!isRecord3(item) || typeof item.requestId !== "string" || !requestIds.has(item.requestId))
-      return null;
-    if (typeof item.table !== "string" || !isRecord3(item.row))
-      return null;
-    result.records.push({ requestId: item.requestId, table: item.table, row: item.row });
-  }
-  for (const item of removals) {
-    if (!isRecord3(item) || typeof item.requestId !== "string" || !requestIds.has(item.requestId))
-      return null;
-    if (typeof item.table !== "string" || !isRecord3(item.key))
-      return null;
-    result.removals.push({ requestId: item.requestId, table: item.table, key: item.key });
-  }
-  for (const item of rejected) {
-    if (!isRecord3(item) || typeof item.requestId !== "string" || !requestIds.has(item.requestId))
-      return null;
-    if (typeof item.code !== "string" || typeof item.message !== "string")
-      return null;
-    result.rejected.push({ requestId: item.requestId, code: item.code, message: item.message });
-  }
-  return result;
-}
-function parseResult(value, job) {
-  if (!isRecord3(value) || value.kind !== job.kind)
-    return null;
-  if (job.kind === "push")
-    return parsePushResult(value, new Set(job.requests.map((request) => request.requestId)));
-  const logs = parseLogs(value.logs);
-  if (!logs)
-    return null;
-  if (job.kind === "discover") {
-    const summary = parseSummary(value.summary);
-    const discover = parseDiscover(value.discover);
-    return summary && discover ? { kind: "discover", summary, discover, logs } : null;
-  }
-  if (job.kind === "check")
-    return value.ok === true ? { kind: "check", ok: true, logs } : null;
-  const emittedBatches = value.emittedBatches;
-  if (typeof emittedBatches !== "number" || !Number.isSafeInteger(emittedBatches) || emittedBatches < 0)
-    return null;
-  if (value.stopped !== undefined && typeof value.stopped !== "boolean")
-    return null;
-  return { kind: "pull", emittedBatches, ...value.stopped === true ? { stopped: true } : {}, logs };
-}
-function parseDeclaration(value) {
-  if (!isRecord3(value))
-    return null;
-  const summary = parseSummary(value.summary);
-  const discover = parseDiscover(value.discover);
-  return summary && discover ? { summary, discover } : null;
-}
-function parseBatch(value, tables) {
-  if (!isRecord3(value) || !Array.isArray(value.records) || !Array.isArray(value.removals))
-    return null;
-  const logs = parseLogs(value.logs);
-  if (!logs)
-    return null;
-  const batch = { records: [], removals: [], logs };
-  for (const item of value.records) {
-    if (!isRecord3(item) || typeof item.table !== "string" || !tables.has(item.table) || !isRecord3(item.row))
-      return null;
-    batch.records.push({ table: item.table, row: item.row });
-  }
-  for (const item of value.removals) {
-    if (!isRecord3(item) || typeof item.table !== "string" || !tables.has(item.table) || !isRecord3(item.key))
-      return null;
-    batch.removals.push({ table: item.table, key: item.key });
-  }
-  if (value.checkpoint !== undefined) {
-    if (!isRecord3(value.checkpoint) || !Object.hasOwn(value.checkpoint, "state"))
-      return null;
-    batch.checkpoint = { state: value.checkpoint.state };
-  }
-  if (value.dropped !== undefined) {
-    if (typeof value.dropped !== "number" || !Number.isSafeInteger(value.dropped) || value.dropped < 0)
-      return null;
-    batch.dropped = value.dropped;
-  }
-  return batch;
-}
-function parseHttpRequest2(value) {
-  if (!isRecord3(value))
-    return null;
-  const { method, url, headers, query, body, bodyEncoding, timeoutMs } = value;
-  if (typeof method !== "string" || !HTTP_METHODS.has(method) || typeof url !== "string" || !isStringRecord(headers))
-    return null;
-  if (!isRecord3(query) || !Object.values(query).every((item) => typeof item === "string" || isStringArray(item)))
-    return null;
-  if (body !== null && typeof body !== "string")
-    return null;
-  if (typeof bodyEncoding !== "string" || !BODY_ENCODINGS.has(bodyEncoding))
-    return null;
-  if (timeoutMs !== undefined && (typeof timeoutMs !== "number" || !Number.isFinite(timeoutMs) || timeoutMs <= 0))
-    return null;
-  const parsedQuery = {};
-  for (const [key, item] of Object.entries(query))
-    parsedQuery[key] = Array.isArray(item) ? [...item] : item;
-  return {
-    method,
-    url,
-    headers: { ...headers },
-    query: parsedQuery,
-    body,
-    bodyEncoding,
-    ...timeoutMs !== undefined ? { timeoutMs } : {}
-  };
-}
-function parseCryptoRequest(value) {
-  if (!isRecord3(value) || typeof value.data !== "string" || typeof value.algorithm !== "string")
-    return null;
-  if (typeof value.encoding !== "string" || !DIGEST_ENCODINGS.has(value.encoding))
-    return null;
-  const { data, algorithm } = value;
-  const encoding = value.encoding;
-  if (value.op === "hash") {
-    return HASH_ALGORITHMS.has(algorithm) ? { op: "hash", algorithm, data, encoding } : null;
-  }
-  if (typeof value.key !== "string")
-    return null;
-  if (value.op === "hmac") {
-    return HMAC_ALGORITHMS.has(algorithm) ? { op: "hmac", algorithm, key: value.key, data, encoding } : null;
-  }
-  if (value.op === "sign")
-    return algorithm === "rsa-sha256" ? { op: "sign", algorithm: "rsa-sha256", key: value.key, data, encoding } : null;
-  return null;
-}
-function parsePayload(method, payload, job, options) {
-  switch (method) {
-    case "definition":
-      return job.kind === "push" ? null : parseSummary(payload);
-    case "declaration":
-      if (options.declared === true)
-        return null;
-      return job.kind === "pull" && job.discoverFirst === true ? parseDeclaration(payload) : null;
-    case "http":
-      return parseHttpRequest2(payload);
-    case "db.query":
-      return isRecord3(payload) && typeof payload.sql === "string" && Array.isArray(payload.params) ? { sql: payload.sql, params: [...payload.params] } : null;
-    case "db.next":
-    case "db.close":
-      return isRecord3(payload) && typeof payload.cursorId === "string" ? { cursorId: payload.cursorId } : null;
-    case "crypto":
-      return parseCryptoRequest(payload);
-    case "cache.get":
-      return isRecord3(payload) && typeof payload.key === "string" ? { key: payload.key } : null;
-    case "cache.set": {
-      if (!isRecord3(payload) || typeof payload.key !== "string" || typeof payload.value !== "string")
-        return null;
-      const ttl = payload.ttlSeconds;
-      return typeof ttl === "number" && Number.isSafeInteger(ttl) && ttl > 0 ? { key: payload.key, value: payload.value, ttlSeconds: ttl } : null;
-    }
-    case "secret.reveal":
-      return isRecord3(payload) && typeof payload.field === "string" && job.secretFields.includes(payload.field) ? { field: payload.field } : null;
-    case "emit":
-      if (job.kind !== "pull")
-        return null;
-      return parseBatch(payload, new Set(job.discoverFirst === true ? options.tables ?? [] : job.tables));
-  }
-}
-function undeclaredEmitTable(value, job, options = {}) {
-  if (job.kind !== "pull" || !isRecord3(value) || value.type !== "call" || value.method !== "emit" || !isRecord3(value.payload))
-    return null;
-  const allowed = new Set(job.discoverFirst === true ? options.tables ?? [] : job.tables);
-  for (const key of ["records", "removals"]) {
-    const items = value.payload[key];
-    if (!Array.isArray(items))
-      continue;
-    for (const item of items) {
-      if (isRecord3(item) && typeof item.table === "string" && !allowed.has(item.table))
-        return item.table;
-    }
-  }
-  return null;
-}
-function parseChildMessage(value, job, options = {}) {
-  if (!isRecord3(value))
-    return null;
-  switch (value.type) {
-    case "ready":
-      return { type: "ready" };
-    case "call": {
-      if (!isId(value.id) || typeof value.method !== "string" || !HOST_METHOD_SET.has(value.method))
-        return null;
-      const method = value.method;
-      const payload = parsePayload(method, value.payload, job, options);
-      return payload === null ? null : { type: "call", id: value.id, method, payload };
-    }
-    case "result": {
-      const result = parseResult(value.result, job);
-      return result ? { type: "result", result } : null;
-    }
-    case "failure": {
-      if (typeof value.code !== "string" || !FAILURE_CODE_SET.has(value.code) || typeof value.message !== "string")
-        return null;
-      if (value.stack !== undefined && typeof value.stack !== "string")
-        return null;
-      const logs = parseLogs(value.logs);
-      if (!logs)
-        return null;
-      return {
-        type: "failure",
-        code: value.code,
-        message: value.message,
-        ...value.stack !== undefined ? { stack: value.stack } : {},
-        logs
-      };
-    }
-    default:
-      return null;
-  }
-}
-
-// src/runtime/session.ts
-function isRecord4(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function guestErrorMessage(error) {
-  try {
-    if (error !== null && typeof error === "object") {
-      const message = error.message;
-      if (typeof message === "string")
-        return message;
-    }
-  } catch {}
-  return "unknown error";
-}
-function createInProcessGuestSession(send, definition) {
-  return createSession(send, (guestSource) => {
-    let exported;
-    try {
-      const module2 = { exports: {} };
-      const noRequire = (specifier) => {
-        throw new Error(`guest runtime cannot require ${specifier}`);
-      };
-      const load = new Function("module", "exports", "require", guestSource);
-      load(module2, module2.exports, noRequire);
-      exported = module2.exports;
-    } catch (error) {
-      return { ok: false, code: "CONNECTOR_LOAD_FAILED", message: `connector runtime failed to start: ${guestErrorMessage(error)}` };
-    }
-    if (typeof exported.bootLocalGuest !== "function") {
-      return { ok: false, code: "CONNECTOR_LOAD_FAILED", message: "connector runtime failed to start: guest runtime does not export bootLocalGuest" };
-    }
-    const guest = exported.bootLocalGuest();
-    const factory = (module2) => {
-      module2.exports = definition;
-    };
-    return { ok: true, guest, factory };
-  });
-}
-function createSession(send, boot) {
-  let guest = null;
-  let started = false;
-  let done = false;
-  let timer;
-  let timerAt = Number.POSITIVE_INFINITY;
-  const stop = () => {
-    done = true;
-    if (timer !== undefined)
-      clearTimeout(timer);
-    timer = undefined;
-  };
-  const fail = (code, message) => {
-    if (done)
-      return;
-    stop();
-    send(JSON.stringify({ type: "failure", code, message, logs: [] }));
-  };
-  const schedule = (delay) => {
-    if (done)
-      return;
-    const at = Date.now() + delay;
-    if (timer !== undefined && timerAt <= at)
-      return;
-    if (timer !== undefined)
-      clearTimeout(timer);
-    timerAt = at;
-    timer = setTimeout(pump, delay);
-  };
-  function pump() {
-    timer = undefined;
-    timerAt = Number.POSITIVE_INFINITY;
-    if (done || !guest)
-      return;
-    let text;
-    try {
-      text = guest.poll();
-    } catch (error) {
-      fail("FATAL_ERROR", `connector runtime failed: ${guestErrorMessage(error)}`);
-      return;
-    }
-    let parsed;
-    try {
-      parsed = typeof text === "string" ? JSON.parse(text) : null;
-    } catch {
-      parsed = null;
-    }
-    if (!isRecord4(parsed) || !Array.isArray(parsed.out)) {
-      fail("FATAL_ERROR", "connector runtime returned a malformed poll result");
-      return;
-    }
-    for (const message of parsed.out) {
-      if (!isRecord4(message))
-        continue;
-      send(JSON.stringify(message));
-      if (message.type === "result" || message.type === "failure") {
-        stop();
-        return;
-      }
-    }
-    if (parsed.out.length > 0 || parsed.fired === true)
-      schedule(0);
-    else if (typeof parsed.wake === "number" && parsed.wake >= 0)
-      schedule(parsed.wake);
-  }
-  const execute = (guestSource, code, payload) => {
-    const booted = boot(guestSource, code);
-    if (!booted.ok) {
-      fail(booted.code, booted.message);
-      return;
-    }
-    guest = booted.guest;
-    try {
-      guest.start(payload, booted.factory);
-    } catch (error) {
-      fail("FATAL_ERROR", `connector runtime failed: ${guestErrorMessage(error)}`);
-      return;
-    }
-    schedule(0);
-  };
-  return {
-    handle(json) {
-      if (done || typeof json !== "string")
-        return;
-      let raw;
-      try {
-        raw = JSON.parse(json);
-      } catch {
-        return;
-      }
-      const message = parseParentMessage(raw);
-      if (!message)
-        return;
-      if (message.type === "execute") {
-        if (started)
-          return;
-        started = true;
-        execute(message.guest, message.code, JSON.stringify({ expect: message.expect, job: message.job }));
-        return;
-      }
-      if (!guest)
-        return;
-      try {
-        guest.handle(JSON.stringify(message));
-      } catch (error) {
-        fail("FATAL_ERROR", `connector runtime failed: ${guestErrorMessage(error)}`);
-        return;
-      }
-      schedule(0);
-    }
-  };
-}
-
-// src/validate.ts
-var RESERVED_PUSH_NAMES = Object.freeze(["dev"]);
-var SCALAR_KINDS = new Set(["string", "integer", "decimal", "boolean", "date", "instant", "json"]);
-var RETENTION_KINDS = new Set(["instant", "date"]);
-var SYNC_MODES2 = new Set(["full", "incremental"]);
-var SNAPSHOTS2 = new Set(["complete", "partial"]);
-var HOST_LABEL = "[a-z0-9](?:[a-z0-9-]*[a-z0-9])?";
-var HOST_PATTERN = new RegExp(`^(?:\\*\\.)?${HOST_LABEL}(?:\\.${HOST_LABEL})*$`, "i");
-var PRESENTATION_LIMITS = Object.freeze({
-  title: 40,
-  description: 120,
-  readmeBytes: 65536,
-  iconBytes: 262144,
-  iconMinPx: 128,
-  fieldTitle: 40,
-  fieldDescription: 200,
-  placeholder: 100,
-  tableTitle: 40,
-  tableDescription: 200
-});
-function isRecord5(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function pushNames(push) {
-  return isRecord5(push) ? Object.keys(push) : [];
-}
-function definitionStreamNames(definition) {
-  if (!isRecord5(definition) || !isRecord5(definition.streams))
-    return [];
-  return Object.keys(definition.streams);
-}
-function topLevelSecrets(config) {
-  if (!isRecord5(config) || !isRecord5(config.shape))
-    return [];
-  const secrets = [];
-  for (const [field, type] of Object.entries(config.shape)) {
-    if (isRecord5(type) && type.kind === "secret")
-      secrets.push({ field, exposeToScript: type.exposeToScript === true });
-  }
-  return secrets;
-}
-function summarizeDefinition(definition) {
-  const secrets = topLevelSecrets(definition.config);
-  const rateLimit = definition.rateLimit;
-  return {
-    name: definition.name,
-    version: definition.version,
-    hosts: Array.isArray(definition.hosts) ? definition.hosts.filter((host) => typeof host === "string") : [],
-    db: definition.db?.engine === "postgresql" ? { engine: "postgresql" } : null,
-    rateLimit: rateLimit ? { perSecond: rateLimit.perSecond, concurrency: rateLimit.concurrency } : null,
-    pushes: pushNames(definition.push),
-    streams: definitionStreamNames(definition),
-    secretFields: secrets.map((secret) => secret.field),
-    exposeToScript: secrets.filter((secret) => secret.exposeToScript).map((secret) => secret.field),
-    ...isRecord5(definition.config) ? { config: JSON.parse(JSON.stringify(definition.config)) } : {}
-  };
-}
-
-// src/testing/engine.ts
-function isRecord6(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function errorMessage2(error) {
-  return error instanceof Error ? error.message : String(error);
-}
-function emptyResult() {
-  return { records: [], removals: [], checkpoints: [], logs: [], rejected: [], declaration: null, stopped: false, error: null };
-}
-function hostCallError(error) {
-  const code = isRecord6(error) && typeof error.code === "string" ? error.code : "HOST_CALL_FAILED";
-  const result = { code: code === "HOST_DENIED" ? "EGRESS_HOST_DENIED" : code, message: errorMessage2(error) };
-  if (isRecord6(error) && typeof error.status === "number" && Number.isInteger(error.status))
-    result.status = error.status;
-  if (isRecord6(error) && typeof error.retryAfterMs === "number" && error.retryAfterMs >= 0)
-    result.retryAfterMs = error.retryAfterMs;
-  return result;
-}
-function decode(raw) {
-  if (typeof raw !== "string")
-    return raw;
-  try {
-    return JSON.parse(raw);
-  } catch {
-    return null;
-  }
-}
-function drive(transportFactory, input) {
-  const { execute, host } = input;
-  const job = execute.job;
-  const redact = (text) => host.redact ? host.redact(text) : text;
-  const result = emptyResult();
-  const limit = input.limit !== undefined && Number.isFinite(input.limit) && input.limit >= 0 ? Math.floor(input.limit) : null;
-  let declaredTables = [];
-  let declared = false;
-  let seq = 0;
-  let finished = false;
-  const addLogs = (logs) => {
-    for (const log of logs)
-      result.logs.push({ at: log.at, level: log.level, message: redact(log.message) });
-  };
-  return new Promise((resolve) => {
-    let timer;
-    let transport = null;
-    const finish = (error) => {
-      if (finished)
-        return;
-      finished = true;
-      if (timer !== undefined)
-        clearTimeout(timer);
-      if (error)
-        result.error = { code: error.code, message: redact(error.message), stack: error.stack === null ? null : redact(error.stack) };
-      const stopping = transport ? transport.stop() : Promise.resolve();
-      stopping.then(() => resolve(result), () => resolve(result));
-    };
-    const send = (message) => {
-      if (finished || !transport)
-        return;
-      transport.send(message);
-    };
-    const onEmit = (id, payload) => {
-      const batch = payload;
-      seq += 1;
-      addLogs(batch.logs);
-      let records = batch.records;
-      let stop = false;
-      if (limit !== null) {
-        const room = Math.max(0, limit - result.records.length);
-        if (records.length >= room) {
-          stop = true;
-          records = records.slice(0, room);
-        }
-      }
-      const truncated = records.length < batch.records.length;
-      result.records.push(...records);
-      result.removals.push(...batch.removals);
-      if (batch.checkpoint && !truncated)
-        result.checkpoints.push({ seq, state: batch.checkpoint.state });
-      if (stop)
-        result.stopped = true;
-      send({ type: "reply", id, ok: true, value: { seq, duplicate: false, rejected: 0, ...stop ? { stop: true } : {} } });
-    };
-    const onCall = (message) => {
-      switch (message.method) {
-        case "definition":
-          try {
-            host.onDefinition?.(message.payload);
-          } catch (error) {
-            finish({ code: "RUNNER_CRASHED", message: `the host rejected the connector definition: ${errorMessage2(error)}`, stack: null });
-            return;
-          }
-          send({ type: "reply", id: message.id, ok: true, value: null });
-          return;
-        case "declaration": {
-          const report = message.payload;
-          result.declaration = { summary: report.summary, discover: report.discover };
-          declared = true;
-          const stream = job.kind === "pull" && Object.hasOwn(report.discover.streams, job.stream) ? report.discover.streams[job.stream] : undefined;
-          declaredTables = stream ? Object.keys(stream.tables) : [];
-          send({ type: "reply", id: message.id, ok: true, value: null });
-          return;
-        }
-        case "emit":
-          onEmit(message.id, message.payload);
-          return;
-        default:
-          host.call(message.method, message.payload).then((value) => send({ type: "reply", id: message.id, ok: true, value: value ?? null }), (error) => {
-            if (error instanceof LocalRunError && error.code === "DB_DRIVER_MISSING") {
-              finish({ code: error.code, message: error.message, stack: null });
-              return;
-            }
-            send({ type: "reply", id: message.id, ok: false, error: hostCallError(error) });
-          });
-      }
-    };
-    const onResult = (outcome) => {
-      switch (outcome.kind) {
-        case "push":
-          for (const record of outcome.records)
-            result.records.push({ table: record.table, row: record.row });
-          for (const removal of outcome.removals)
-            result.removals.push({ table: removal.table, key: removal.key });
-          result.rejected.push(...outcome.rejected.map((item) => ({ requestId: item.requestId, code: item.code, message: redact(item.message) })));
-          break;
-        case "discover":
-          result.declaration = { summary: outcome.summary, discover: outcome.discover };
-          break;
-        case "check":
-          break;
-        case "pull":
-          if (outcome.stopped === true)
-            result.stopped = true;
-          break;
-      }
-      addLogs(outcome.logs);
-      finish(null);
-    };
-    const onMessage = (raw) => {
-      if (finished)
-        return;
-      const decoded = decode(raw);
-      const message = parseChildMessage(decoded, job, { tables: declaredTables, declared });
-      if (!message) {
-        const table = undeclaredEmitTable(decoded, job, { tables: declaredTables });
-        const call = decoded;
-        if (table !== null) {
-          finish({ code: "SCHEMA_ERROR", message: `connector emitted records for undeclared table ${table}`, stack: null });
-        } else if (declared && typeof call === "object" && call !== null && call.type === "call" && call.method === "declaration") {
-          finish({ code: "RUNNER_CRASHED", message: "connector sandbox reported the declaration more than once (protocol error)", stack: null });
-        } else {
-          finish({ code: "RUNNER_CRASHED", message: "connector sandbox sent a malformed message", stack: null });
-        }
-        return;
-      }
-      switch (message.type) {
-        case "ready":
-          send(execute);
-          return;
-        case "call":
-          onCall(message);
-          return;
-        case "result":
-          onResult(message.result);
-          return;
-        case "failure":
-          addLogs(message.logs);
-          finish({ code: message.code, message: message.message, stack: message.stack ?? null });
-          return;
-      }
-    };
-    const onExit = (description) => {
-      finish({ code: "RUNNER_CRASHED", message: `connector sandbox exited without a result (${description})`, stack: null });
-    };
-    try {
-      transport = transportFactory(onMessage, onExit);
-    } catch (error) {
-      finish({ code: "RUNNER_CRASHED", message: `connector sandbox failed to start: ${errorMessage2(error)}`, stack: null });
-      return;
-    }
-    if (input.timeoutMs !== undefined && Number.isFinite(input.timeoutMs)) {
-      timer = setTimeout(() => {
-        finish({ code: "TIMEOUT", message: `connector execution exceeded ${input.timeoutMs} ms`, stack: null });
-      }, Math.max(0, input.timeoutMs));
-    }
-    if (!input.waitForReady)
-      send(execute);
-  });
-}
-function createInProcessExecutor(definition) {
-  return {
-    async run(job, host, options = {}) {
-      const guest = await loadGuestRuntime();
-      const named = isRecord6(definition) ? definition : {};
-      const expect = { name: String(named.name ?? ""), version: String(named.version ?? "") };
-      const execute = { type: "execute", guest, code: "", expect, job };
-      return drive((onMessage) => {
-        let active = true;
-        const session = createInProcessGuestSession((json) => {
-          if (active)
-            queueMicrotask(() => onMessage(json));
-        }, definition);
-        return {
-          send(message) {
-            if (active)
-              session.handle(JSON.stringify(message));
-          },
-          async stop() {
-            if (!active)
-              return;
-            session.handle(JSON.stringify({ type: "cancel" }));
-            active = false;
-          }
-        };
-      }, { execute, host, limit: options.limit, timeoutMs: options.timeoutMs, waitForReady: false });
-    }
-  };
-}
-var VM_CHILD_ENTRY = import_node_path3.default.join(PACKAGE_ROOT, "testing", IS_SOURCE ? "child.ts" : "child.cjs");
-var KILL_WAIT_MS = 5000;
-function forkTransport(entry) {
-  return (onMessage, onExit) => {
-    const child = import_node_child_process.fork(entry, [], {
-      env: {},
-      execArgv: [],
-      stdio: ["ignore", "pipe", "inherit", "ipc"],
-      serialization: "json"
-    });
-    child.stdout?.on("data", (chunk) => process.stderr.write(chunk));
-    let exited = false;
-    const exitedPromise = new Promise((resolve) => {
-      child.once("exit", (code, signal) => {
-        exited = true;
-        resolve();
-        onExit(signal ? `signal ${signal}` : `exit code ${String(code)}`);
-      });
-    });
-    child.on("message", (raw) => onMessage(raw));
-    child.on("error", (error) => onExit(`spawn error: ${error.message}`));
-    return {
-      send(message) {
-        if (exited || !child.connected)
-          return;
-        try {
-          child.send(JSON.stringify(message));
-        } catch {}
-      },
-      async stop() {
-        if (!exited)
-          child.kill("SIGKILL");
-        await Promise.race([exitedPromise, new Promise((resolve) => setTimeout(resolve, KILL_WAIT_MS))]);
-      }
-    };
-  };
-}
-function createVmExecutor(source, options = {}) {
-  const entry = options.childEntry ?? VM_CHILD_ENTRY;
-  return {
-    async run(job, host, runOptions = {}) {
-      const guest = options.guestRuntime ?? await loadGuestRuntime();
-      const execute = {
-        type: "execute",
-        guest,
-        code: source.code,
-        expect: { name: source.name, version: source.version },
-        job
-      };
-      return drive(forkTransport(entry), { execute, host, limit: runOptions.limit, timeoutMs: runOptions.timeoutMs, waitForReady: true });
-    }
-  };
-}
-var INSPECT_ABORT = "inspect-definition: stop after the definition";
-var MISMATCH_PREFIX = "connector code defines ";
-async function inspectDefinition(executor, options = {}) {
-  let summary = null;
-  const host = {
-    call: async (method) => {
-      throw new LocalRunError("HOST_DENIED", `${method} is not available while only loading the definition`);
-    },
-    close: async () => {},
-    onDefinition(value) {
-      summary = value;
-      throw new Error(INSPECT_ABORT);
-    }
-  };
-  const result = await executor.run({ kind: "check", config: {}, secretFields: [] }, host, { timeoutMs: options.timeoutMs ?? 30000 });
-  if (isRecord6(summary) && typeof summary.name === "string" && typeof summary.version === "string") {
-    return { ok: true, summary };
-  }
-  const error = result.error ?? { code: "CONNECTOR_LOAD_FAILED", message: "the connector did not report its definition" };
-  return { ok: false, code: error.code, message: error.message, mismatch: error.message.startsWith(MISMATCH_PREFIX) };
-}
-function secretFieldsOf(definition) {
-  try {
-    return summarizeDefinition(definition).secretFields;
-  } catch {
-    return [];
-  }
-}
-function runStream(definition, input) {
-  const job = {
-    kind: "pull",
-    config: input.config,
-    secretFields: secretFieldsOf(definition),
-    stream: input.stream,
-    mode: input.mode ?? "full",
-    state: input.state ?? null,
-    streamConfig: input.streamConfig ?? {},
-    tables: [],
-    discoverFirst: true
-  };
-  return createInProcessExecutor(definition).run(job, input.host, input.limit !== undefined ? { limit: input.limit } : {});
-}
-function runDiscover(definition, input) {
-  return createInProcessExecutor(definition).run({ kind: "discover", config: input.config, secretFields: secretFieldsOf(definition) }, input.host);
-}
-function runCheck(definition, input) {
-  return createInProcessExecutor(definition).run({ kind: "check", config: input.config, secretFields: secretFieldsOf(definition) }, input.host);
-}
-function runPush(definition, input) {
-  const job = {
-    kind: "push",
-    config: input.config,
-    secretFields: secretFieldsOf(definition),
-    requests: input.requests.map((request) => ({ ...request, push: input.push }))
-  };
-  return createInProcessExecutor(definition).run(job, input.host);
-}
-// src/testing/source-loader.ts
-var import_promises3 = require("node:fs/promises");
-var import_node_path4 = __toESM(require("node:path"), 1);
-
-// src/testing/import-guard.ts
-var CONNECTOR_SDK_SPECIFIER = "@deepexi/datasense-connector";
-var RETIRED_SDK_SPECIFIER = ["@mu-ontos", "connector-sdk"].join("/");
-var MACRO_SPECIFIER = /^macro:/i;
-var NODE_BUILTINS = new Set([
-  "assert",
-  "async_hooks",
-  "buffer",
-  "child_process",
-  "cluster",
-  "console",
-  "constants",
-  "crypto",
-  "dgram",
-  "diagnostics_channel",
-  "dns",
-  "domain",
-  "events",
-  "fs",
-  "http",
-  "http2",
-  "https",
-  "inspector",
-  "module",
-  "net",
-  "os",
-  "path",
-  "perf_hooks",
-  "process",
-  "punycode",
-  "querystring",
-  "readline",
-  "repl",
-  "stream",
-  "string_decoder",
-  "sys",
-  "timers",
-  "tls",
-  "trace_events",
-  "tty",
-  "url",
-  "util",
-  "v8",
-  "vm",
-  "wasi",
-  "worker_threads",
-  "zlib",
-  "test",
-  "sqlite",
-  "sea"
-]);
-function asTypeScript(value) {
-  const api = value !== null && typeof value === "object" && "default" in value && typeof value.default === "object" ? value.default : value;
-  if (!api || typeof api.createSourceFile !== "function" || typeof api.transpileModule !== "function") {
-    throw new TypeError('options.typescript must be the TypeScript compiler API (import ts from "typescript")');
-  }
-  return api;
-}
-function scriptKindOf(ts, filePath) {
-  if (filePath.endsWith(".tsx"))
-    return ts.ScriptKind.TSX;
-  if (filePath.endsWith(".jsx"))
-    return ts.ScriptKind.JSX;
-  if (/\.[cm]?js$/.test(filePath))
-    return ts.ScriptKind.JS;
-  return ts.ScriptKind.TS;
-}
-function sdkSpecifierProblem(specifier) {
-  if (specifier === RETIRED_SDK_SPECIFIER || specifier.startsWith(`${RETIRED_SDK_SPECIFIER}/`)) {
-    return `import '${specifier}' is not allowed; the SDK package is now '${CONNECTOR_SDK_SPECIFIER}'`;
-  }
-  if (specifier.startsWith(`${CONNECTOR_SDK_SPECIFIER}/`)) {
-    return `import '${specifier}' is not allowed; import '${CONNECTOR_SDK_SPECIFIER}' itself`;
-  }
-  return null;
-}
-function literalSpecifier(ts, node) {
-  if (node && (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node)))
-    return node.text;
-  return null;
-}
-function findForbiddenSourceSyntax(ts, filePath, content) {
-  const sourceFile = ts.createSourceFile(filePath, content, ts.ScriptTarget.Latest, true, scriptKindOf(ts, filePath));
-  const problems = [];
-  const report = (position, message, kind) => {
-    const { line, character } = sourceFile.getLineAndCharacterOfPosition(position);
-    problems.push({ file: filePath, line: line + 1, column: character, message, kind });
-  };
-  const parseDiagnostics = sourceFile.parseDiagnostics ?? [];
-  for (const diagnostic of parseDiagnostics) {
-    report(diagnostic.start ?? 0, `syntax error: ${ts.flattenDiagnosticMessageText(diagnostic.messageText, " ")}`, "syntax");
-  }
-  const checkSpecifier = (node) => {
-    const specifier = literalSpecifier(ts, node);
-    if (!node || specifier === null)
-      return;
-    if (MACRO_SPECIFIER.test(specifier)) {
-      report(node.getStart(sourceFile), `import '${specifier}' is not allowed; connectors cannot use Bun macros`, "import");
-      return;
-    }
-    const sdkProblem = sdkSpecifierProblem(specifier);
-    if (sdkProblem !== null)
-      report(node.getStart(sourceFile), sdkProblem, "import");
-  };
-  const attributesMessage = (keyword) => `import attributes ('${keyword} { … }') are not allowed; connectors cannot use Bun macros or other import attributes`;
-  const visit = (node) => {
-    if (ts.isImportDeclaration(node) || ts.isExportDeclaration(node)) {
-      checkSpecifier(node.moduleSpecifier);
-      if (node.attributes) {
-        report(node.attributes.getStart(sourceFile), attributesMessage(node.attributes.token === ts.SyntaxKind.AssertKeyword ? "assert" : "with"), "import");
-      }
-    } else if (ts.isImportEqualsDeclaration(node)) {
-      if (ts.isExternalModuleReference(node.moduleReference))
-        checkSpecifier(node.moduleReference.expression);
-    } else if (ts.isCallExpression(node)) {
-      const callee = node.expression;
-      if (callee.kind === ts.SyntaxKind.ImportKeyword) {
-        checkSpecifier(node.arguments[0]);
-        const options = node.arguments[1];
-        if (options)
-          report(options.getStart(sourceFile), attributesMessage("with"), "import");
-      } else if (ts.isIdentifier(callee) && callee.text === "require") {
-        checkSpecifier(node.arguments[0]);
-      }
-    }
-    ts.forEachChild(node, visit);
-  };
-  visit(sourceFile);
-  return problems;
-}
-function collectRequires(ts, filePath, output) {
-  const sourceFile = ts.createSourceFile(`${filePath}.js`, output, ts.ScriptTarget.Latest, true, ts.ScriptKind.JS);
-  const found = [];
-  const visit = (node) => {
-    if (ts.isCallExpression(node) && ts.isIdentifier(node.expression) && node.expression.text === "require") {
-      const { line } = sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile));
-      found.push({ specifier: literalSpecifier(ts, node.arguments[0]), line: line + 1 });
-    }
-    ts.forEachChild(node, visit);
-  };
-  visit(sourceFile);
-  return found;
-}
-function collectSourceSpecifiers(ts, filePath, content) {
-  const sourceFile = ts.createSourceFile(filePath, content, ts.ScriptTarget.Latest, true, scriptKindOf(ts, filePath));
-  const found = [];
-  const add = (node) => {
-    const specifier = literalSpecifier(ts, node);
-    if (!node || specifier === null)
-      return;
-    const { line } = sourceFile.getLineAndCharacterOfPosition(node.getStart(sourceFile));
-    found.push({ specifier, line: line + 1 });
-  };
-  const visit = (node) => {
-    if (ts.isImportDeclaration(node)) {
-      if (!node.importClause?.isTypeOnly)
-        add(node.moduleSpecifier);
-    } else if (ts.isExportDeclaration(node)) {
-      if (!node.isTypeOnly)
-        add(node.moduleSpecifier);
-    } else if (ts.isImportEqualsDeclaration(node)) {
-      if (!node.isTypeOnly && ts.isExternalModuleReference(node.moduleReference))
-        add(node.moduleReference.expression);
-    } else if (ts.isCallExpression(node)) {
-      const callee = node.expression;
-      if (callee.kind === ts.SyntaxKind.ImportKeyword || ts.isIdentifier(callee) && callee.text === "require")
-        add(node.arguments[0]);
-    }
-    ts.forEachChild(node, visit);
-  };
-  visit(sourceFile);
-  return found;
-}
-function packageNameOf(specifier) {
-  const parts = specifier.split("/");
-  if (specifier.startsWith("@"))
-    return parts.slice(0, 2).join("/");
-  return parts[0] ?? specifier;
-}
-function normalizePosix(input) {
-  const out = [];
-  for (const segment of input.split("/")) {
-    if (segment === "" || segment === ".")
-      continue;
-    if (segment === "..") {
-      if (out.length > 0 && out[out.length - 1] !== "..")
-        out.pop();
-      else
-        out.push("..");
-    } else {
-      out.push(segment);
-    }
-  }
-  return out.length === 0 ? "." : out.join("/");
-}
-function classifySpecifier(specifier, importer) {
-  if (specifier === CONNECTOR_SDK_SPECIFIER)
-    return { kind: "sdk" };
-  const isRelative = specifier === "." || specifier === ".." || specifier.startsWith("./") || specifier.startsWith("../");
-  if (isRelative) {
-    const slash = importer.lastIndexOf("/");
-    const baseDir = slash === -1 ? "" : importer.slice(0, slash);
-    const target = normalizePosix(baseDir ? `${baseDir}/${specifier}` : specifier);
-    if (target === ".." || target.startsWith("../"))
-      return { kind: "escape" };
-    return { kind: "relative", target };
-  }
-  const sdkProblem = sdkSpecifierProblem(specifier);
-  if (sdkProblem !== null)
-    return { kind: "forbidden", message: sdkProblem };
-  if (MACRO_SPECIFIER.test(specifier))
-    return { kind: "forbidden", message: `import '${specifier}' is not allowed; connectors cannot use Bun macros` };
-  if (specifier.startsWith("node:") || specifier.startsWith("bun:") || specifier === "bun" || NODE_BUILTINS.has(packageNameOf(specifier))) {
-    return { kind: "forbidden", message: `import '${specifier}' is not allowed; connectors cannot use Node.js or Bun built-in modules` };
-  }
-  if (specifier.startsWith("/") || /^[a-z][a-z0-9+.-]*:/i.test(specifier)) {
-    return { kind: "forbidden", message: `import '${specifier}' is not allowed; only relative imports and '${CONNECTOR_SDK_SPECIFIER}' are allowed` };
-  }
-  return { kind: "forbidden", message: `import '${specifier}' is not allowed; connectors can only depend on '${CONNECTOR_SDK_SPECIFIER}'` };
-}
-
-// src/testing/source-loader.ts
-var LOCAL_SOURCE_MAX_BYTES = 2 * 1024 * 1024;
-var LOCAL_SOURCE_MAX_FILES = 200;
-var EXCLUDED_DIRECTORIES = new Set(["node_modules", ".git", "dist", ".ontos", ".datasense"]);
-var FIXTURES_DIRECTORY = "fixtures";
-var DEFAULT_MAIN = "src/index.ts";
-var NAME_PATTERN = /^[a-z][a-z0-9_]{0,27}$/;
-var VERSION_PATTERN = /^\d+\.\d+\.\d+$/;
-var CODE_FILE2 = /\.[cm]?[jt]sx?$/;
-var RESOLVE_EXTENSIONS = [".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs", ".json"];
-function isRecord7(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-async function collectFiles(root) {
-  const files = {};
-  let count = 0;
-  let bytes = 0;
-  const visit = async (absolute, relative) => {
-    const entries = await import_promises3.readdir(absolute, { withFileTypes: true });
-    entries.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
-    for (const entry of entries) {
-      const childRelative = relative ? `${relative}/${entry.name}` : entry.name;
-      const excluded = EXCLUDED_DIRECTORIES.has(entry.name) || relative === "" && entry.name === FIXTURES_DIRECTORY;
-      if (excluded && (entry.isDirectory() || entry.isSymbolicLink()))
-        continue;
-      if (entry.isSymbolicLink()) {
-        throw new SourceLoadError("SYMLINK", `symbolic links are not supported in connector source: ${childRelative}`, childRelative);
-      }
-      if (entry.isDirectory()) {
-        await visit(import_node_path4.default.join(absolute, entry.name), childRelative);
-      } else if (entry.isFile()) {
-        count += 1;
-        if (count > LOCAL_SOURCE_MAX_FILES) {
-          throw new SourceLoadError("TOO_LARGE", `connector source has more than ${LOCAL_SOURCE_MAX_FILES} files`);
-        }
-        const text = await import_promises3.readFile(import_node_path4.default.join(absolute, entry.name), "utf8");
-        bytes += Buffer.byteLength(text, "utf8");
-        if (bytes > LOCAL_SOURCE_MAX_BYTES) {
-          throw new SourceLoadError("TOO_LARGE", `connector source exceeds ${LOCAL_SOURCE_MAX_BYTES} bytes`);
-        }
-        files[childRelative] = text;
-      }
-    }
-  };
-  await visit(root, "");
-  return files;
-}
-function readManifest(files) {
-  const text = files["package.json"];
-  if (text === undefined)
-    throw new SourceLoadError("MANIFEST_INVALID", "package.json is missing", "package.json");
-  let pkg;
-  try {
-    pkg = JSON.parse(text);
-  } catch {
-    throw new SourceLoadError("MANIFEST_INVALID", "package.json is not valid JSON", "package.json");
-  }
-  if (!isRecord7(pkg))
-    throw new SourceLoadError("MANIFEST_INVALID", "package.json must be a JSON object", "package.json");
-  const invalid = (message) => new SourceLoadError("MANIFEST_INVALID", message, "package.json");
-  if (typeof pkg.name !== "string" || !NAME_PATTERN.test(pkg.name))
-    throw invalid(`name must match ${NAME_PATTERN.source}`);
-  if (typeof pkg.version !== "string" || !VERSION_PATTERN.test(pkg.version))
-    throw invalid("version must be a semver string like 1.0.0");
-  let main = DEFAULT_MAIN;
-  if (pkg.main !== undefined) {
-    if (typeof pkg.main !== "string")
-      throw invalid("main must be a string");
-    main = import_node_path4.default.posix.normalize(pkg.main.startsWith("./") ? pkg.main.slice(2) : pkg.main);
-    if (main.startsWith("/") || main === ".." || main.startsWith("../")) {
-      throw new SourceLoadError("PATH_ESCAPE", `main escapes the connector source root: ${pkg.main}`, "package.json");
-    }
-  }
-  if (!CODE_FILE2.test(main))
-    throw invalid(`main must be a .ts or .js file: ${main}`);
-  if (files[main] === undefined)
-    throw invalid(`entry file not found: ${main}`);
-  const dependencies = pkg.dependencies;
-  if (!isRecord7(dependencies))
-    throw invalid(`dependencies must list ${CONNECTOR_SDK_SPECIFIER}`);
-  for (const dependency of Object.keys(dependencies)) {
-    if (dependency !== CONNECTOR_SDK_SPECIFIER)
-      throw invalid(`connectors can only depend on ${CONNECTOR_SDK_SPECIFIER}, found ${dependency}`);
-  }
-  const sdkRange = dependencies[CONNECTOR_SDK_SPECIFIER];
-  if (typeof sdkRange !== "string" || sdkRange.length === 0)
-    throw invalid(`dependencies must list ${CONNECTOR_SDK_SPECIFIER}`);
-  return { name: pkg.name, version: pkg.version, main, sdkRange };
-}
-function resolveModule(files, target) {
-  const base = target === "." ? "index" : target;
-  const candidates = [base, ...RESOLVE_EXTENSIONS.map((ext) => `${base}${ext}`), ...RESOLVE_EXTENSIONS.map((ext) => `${base}/index${ext}`)];
-  for (const candidate of candidates) {
-    if (Object.hasOwn(files, candidate) && (CODE_FILE2.test(candidate) || candidate.endsWith(".json")))
-      return candidate;
-  }
-  return null;
-}
-var SOURCE_MAP_COMMENT = /\n?\/\/# sourceMappingURL=[^\n]*\s*$/;
-function transpile(ts, id, content) {
-  const output = ts.transpileModule(content, {
-    fileName: id,
-    reportDiagnostics: false,
-    compilerOptions: {
-      module: ts.ModuleKind.CommonJS,
-      target: ts.ScriptTarget.ES2022,
-      esModuleInterop: true,
-      sourceMap: true,
-      inlineSourceMap: false,
-      inlineSources: true,
-      jsx: ts.JsxEmit.React
-    }
-  });
-  const code = output.outputText.replace(SOURCE_MAP_COMMENT, "");
-  let map = { version: 3, sources: [id], names: [], mappings: "" };
-  if (output.sourceMapText) {
-    const parsed = JSON.parse(output.sourceMapText);
-    map = { ...parsed, sources: [id], sourceRoot: "" };
-    delete map.file;
-  }
-  return { code, map };
-}
-function loadModule(ts, files, id) {
-  const content = files[id] ?? "";
-  if (id.endsWith(".json")) {
-    try {
-      JSON.parse(content);
-    } catch (error) {
-      throw new SourceLoadError("SYNTAX_ERROR", `${id} is not valid JSON: ${error instanceof Error ? error.message : String(error)}`, id);
-    }
-    return { id, body: `module.exports = JSON.parse(${JSON.stringify(content)});`, map: null, requires: {} };
-  }
-  const problems = findForbiddenSourceSyntax(ts, id, content);
-  const syntax = problems.find((problem) => problem.kind === "syntax");
-  if (syntax)
-    throw new SourceLoadError("SYNTAX_ERROR", `${id}:${syntax.line}:${syntax.column + 1} ${syntax.message}`, id);
-  const forbidden = problems[0];
-  if (forbidden)
-    throw new SourceLoadError("IMPORT_FORBIDDEN", `${id}:${forbidden.line}:${forbidden.column + 1} ${forbidden.message}`, id);
-  for (const entry of collectSourceSpecifiers(ts, id, content)) {
-    const kind = classifySpecifier(entry.specifier, id);
-    if (kind.kind === "escape")
-      throw new SourceLoadError("PATH_ESCAPE", `${id}:${entry.line} import '${entry.specifier}' escapes the connector source root`, id);
-    if (kind.kind === "forbidden")
-      throw new SourceLoadError("IMPORT_FORBIDDEN", `${id}:${entry.line} ${kind.message}`, id);
-  }
-  const { code, map } = transpile(ts, id, content);
-  const requires = {};
-  for (const entry of collectRequires(ts, id, code)) {
-    if (entry.specifier === null) {
-      throw new SourceLoadError("IMPORT_FORBIDDEN", `${id}: imports must use a literal path (computed require / import() is not allowed)`, id);
-    }
-    const specifier = entry.specifier;
-    if (Object.hasOwn(requires, specifier))
-      continue;
-    const kind = classifySpecifier(specifier, id);
-    switch (kind.kind) {
-      case "sdk":
-        requires[specifier] = null;
-        break;
-      case "escape":
-        throw new SourceLoadError("PATH_ESCAPE", `${id}: import '${specifier}' escapes the connector source root`, id);
-      case "forbidden":
-        throw new SourceLoadError("IMPORT_FORBIDDEN", `${id}: ${kind.message}`, id);
-      case "relative": {
-        const resolved = resolveModule(files, kind.target);
-        if (resolved === null)
-          throw new SourceLoadError("IMPORT_FORBIDDEN", `${id}: cannot resolve import '${specifier}'`, id);
-        requires[specifier] = resolved;
-        break;
-      }
-    }
-  }
-  return { id, body: code, map, requires };
-}
-function countLines(text) {
-  let lines = 0;
-  for (let i = 0;i < text.length; i += 1)
-    if (text.charCodeAt(i) === 10)
-      lines += 1;
-  return lines;
-}
-function assemble(modules, entry) {
-  const lines = ["var __ontosModules = {"];
-  const sections = [];
-  let line = 1;
-  for (const module2 of modules) {
-    lines.push(`${JSON.stringify(module2.id)}: [${JSON.stringify(module2.requires)}, function (module, exports, require) {`);
-    line += 1;
-    if (module2.map)
-      sections.push({ offset: { line, column: 0 }, map: module2.map });
-    const body = module2.body.endsWith(`
-`) ? module2.body.slice(0, -1) : module2.body;
-    lines.push(body);
-    line += countLines(body) + 1;
-    lines.push("}],");
-    line += 1;
-  }
-  lines.push("};", "var __ontosCache = {};", "function __ontosRequire(id) {", "  var cached = __ontosCache[id];", "  if (cached) return cached.exports;", "  var entry = __ontosModules[id];", "  var mod = { exports: {} };", "  __ontosCache[id] = mod;", "  var table = entry[0];", "  entry[1].call(mod.exports, mod, mod.exports, function (specifier) {", '    if (!Object.prototype.hasOwnProperty.call(table, specifier)) throw new Error("cannot require " + String(specifier) + " from " + id);', "    var target = table[specifier];", "    return target === null ? require(specifier) : __ontosRequire(target);", "  });", "  return mod.exports;", "}", `module.exports = __ontosRequire(${JSON.stringify(entry)});`);
-  return {
-    code: lines.join(`
-`),
-    sourcemap: JSON.stringify({ version: 3, file: "connector.js", sections })
-  };
-}
-async function loadConnectorSource(dir, options) {
-  const ts = asTypeScript(options.typescript);
-  const root = import_node_path4.default.resolve(dir);
-  const stat = await import_promises3.lstat(root).catch(() => null);
-  if (!stat)
-    throw new SourceLoadError("MANIFEST_INVALID", `connector source directory not found: ${dir}`);
-  if (stat.isSymbolicLink())
-    throw new SourceLoadError("SYMLINK", `the connector source directory is a symbolic link: ${dir}`);
-  if (!stat.isDirectory())
-    throw new SourceLoadError("MANIFEST_INVALID", `not a directory: ${dir}`);
-  const files = await collectFiles(root);
-  const manifest = readManifest(files);
-  const modules = [];
-  const seen = new Set;
-  const queue = [manifest.main];
-  while (queue.length > 0) {
-    const id = queue.shift();
-    if (seen.has(id))
-      continue;
-    seen.add(id);
-    const module2 = loadModule(ts, files, id);
-    modules.push(module2);
-    for (const target of Object.values(module2.requires))
-      if (target !== null && !seen.has(target))
-        queue.push(target);
-  }
-  const { code, sourcemap } = assemble(modules, manifest.main);
-  return { name: manifest.name, version: manifest.version, code, sourcemap, files, sdkRange: manifest.sdkRange };
-}
-// src/testing/fixtures.ts
-class FixtureFormatError extends Error {
-  file;
-  line;
-  constructor(message, file, line = null) {
-    super(line === null ? `${file}: ${message}` : `${file}:${line}: ${message}`);
-    this.name = "FixtureFormatError";
-    this.file = file;
-    this.line = line;
-  }
-}
-var FIXTURE_CASE_NAME_PATTERN = /^[a-z0-9][a-z0-9_-]{0,63}$/;
-var FIXTURES_DIR = "fixtures";
-var CASE_FILE = "case.json";
-var EXCHANGES_FILE = "exchanges.ndjson";
-var REQUESTS_FILE = "requests.ndjson";
-var CASE_FILES = new Set([CASE_FILE, EXCHANGES_FILE, REQUESTS_FILE]);
-
-class ShapeError extends Error {
-}
-function isRecord8(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function fail(message) {
-  throw new ShapeError(message);
-}
-function onlyKeys(value, allowed, where) {
-  for (const key of Object.keys(value)) {
-    if (!allowed.includes(key))
-      fail(`${where} has an unknown field "${key}"`);
-  }
-}
-function requireString(value, where) {
-  if (typeof value !== "string")
-    fail(`${where} must be a string`);
-  return value;
-}
-function requireNonEmptyString(value, where) {
-  const text = requireString(value, where);
-  if (text === "")
-    fail(`${where} must not be empty`);
-  return text;
-}
-function requireRecord(value, where) {
-  if (!isRecord8(value))
-    fail(`${where} must be an object`);
-  return value;
-}
-function requireStringRecord(value, where) {
-  const record = requireRecord(value, where);
-  for (const [key, item] of Object.entries(record)) {
-    if (typeof item !== "string")
-      fail(`${where}.${key} must be a string`);
-  }
-  return record;
-}
-function requireCount(value, where) {
-  if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0)
-    fail(`${where} must be a non-negative integer`);
-  return value;
-}
-function requireError(value, where) {
-  if (value === null)
-    return;
-  const error = requireRecord(value, where);
-  onlyKeys(error, ["code", "message"], where);
-  requireString(error.code, `${where}.code`);
-  requireString(error.message, `${where}.message`);
-}
-function requireEncoding(value, where) {
-  if (value !== "utf8" && value !== "base64")
-    fail(`${where} must be "utf8" or "base64"`);
-}
-function validateExpectation(value) {
-  const expectation = requireRecord(value, "expect");
-  onlyKeys(expectation, ["records", "removals", "rejected", "checkpoints", "tables"], "expect");
-  for (const field of ["records", "removals"]) {
-    if (expectation[field] === undefined)
-      continue;
-    for (const [table, count] of Object.entries(requireRecord(expectation[field], `expect.${field}`)))
-      requireCount(count, `expect.${field}.${table}`);
-  }
-  if (expectation.rejected !== undefined)
-    requireCount(expectation.rejected, "expect.rejected");
-  if (expectation.checkpoints !== undefined)
-    requireCount(expectation.checkpoints, "expect.checkpoints");
-  if (expectation.tables !== undefined) {
-    if (!Array.isArray(expectation.tables) || !expectation.tables.every((table) => typeof table === "string"))
-      fail("expect.tables must be an array of strings");
-  }
-}
-function validateCase(value) {
-  const item = requireRecord(value, "case");
-  const common = ["kind", "config", "secrets", "expect"];
-  switch (item.kind) {
-    case "pull":
-      onlyKeys(item, [...common, "stream", "mode", "state", "streamConfig", "limit"], "case");
-      requireNonEmptyString(item.stream, "stream");
-      if (item.mode !== "full" && item.mode !== "incremental")
-        fail('mode must be "full" or "incremental"');
-      if (item.streamConfig !== undefined)
-        requireRecord(item.streamConfig, "streamConfig");
-      if (item.limit !== undefined && (typeof item.limit !== "number" || !Number.isSafeInteger(item.limit) || item.limit <= 0))
-        fail("limit must be a positive integer");
-      break;
-    case "push":
-      onlyKeys(item, [...common, "push"], "case");
-      requireNonEmptyString(item.push, "push");
-      break;
-    case "discover":
-      onlyKeys(item, common, "case");
-      break;
-    default:
-      fail('kind must be one of "pull", "push", "discover"');
-  }
-  requireRecord(item.config, "config");
-  if (item.secrets !== undefined)
-    requireStringRecord(item.secrets, "secrets");
-  if (item.expect !== undefined)
-    validateExpectation(item.expect);
-  return item;
-}
-function validateCryptoRequest(value) {
-  const request = requireRecord(value, "request");
-  requireString(request.data, "request.data");
-  if (request.encoding !== "hex" && request.encoding !== "base64")
-    fail('request.encoding must be "hex" or "base64"');
-  switch (request.op) {
-    case "hash":
-      onlyKeys(request, ["op", "algorithm", "data", "encoding"], "request");
-      if (!["md5", "sha1", "sha256", "sha512"].includes(String(request.algorithm)))
-        fail("request.algorithm is not a hash algorithm");
-      return;
-    case "hmac":
-      onlyKeys(request, ["op", "algorithm", "key", "data", "encoding"], "request");
-      requireString(request.key, "request.key");
-      if (!["sha1", "sha256", "sha512"].includes(String(request.algorithm)))
-        fail("request.algorithm is not an hmac algorithm");
-      return;
-    case "sign":
-      onlyKeys(request, ["op", "algorithm", "key", "data", "encoding"], "request");
-      requireString(request.key, "request.key");
-      if (request.algorithm !== "rsa-sha256")
-        fail('request.algorithm must be "rsa-sha256"');
-      return;
-    default:
-      fail('request.op must be one of "hmac", "sign", "hash"');
-  }
-}
-function validateExchange(value) {
-  const item = requireRecord(value, "exchange");
-  if (typeof item.seq !== "number" || !Number.isSafeInteger(item.seq) || item.seq <= 0)
-    fail("seq must be a positive integer");
-  switch (item.kind) {
-    case "http": {
-      onlyKeys(item, ["seq", "kind", "request", "response", "error"], "exchange");
-      const request = requireRecord(item.request, "request");
-      onlyKeys(request, ["method", "url", "headers", "body", "bodyEncoding"], "request");
-      requireNonEmptyString(request.method, "request.method");
-      requireNonEmptyString(request.url, "request.url");
-      requireStringRecord(request.headers, "request.headers");
-      if (request.body !== null)
-        requireString(request.body, "request.body");
-      requireEncoding(request.bodyEncoding, "request.bodyEncoding");
-      if (item.response !== null) {
-        const response = requireRecord(item.response, "response");
-        onlyKeys(response, ["status", "headers", "body", "bodyEncoding"], "response");
-        if (typeof response.status !== "number" || !Number.isInteger(response.status))
-          fail("response.status must be an integer");
-        requireStringRecord(response.headers, "response.headers");
-        requireString(response.body, "response.body");
-        requireEncoding(response.bodyEncoding, "response.bodyEncoding");
-      }
-      requireError(item.error, "error");
-      if (item.response === null === (item.error === null))
-        fail("exactly one of response and error must be null");
-      break;
-    }
-    case "db": {
-      onlyKeys(item, ["seq", "kind", "sql", "params", "fields", "rows", "error"], "exchange");
-      requireString(item.sql, "sql");
-      if (!Array.isArray(item.params))
-        fail("params must be an array");
-      if (!Array.isArray(item.fields))
-        fail("fields must be an array");
-      for (const field of item.fields) {
-        const entry = requireRecord(field, "fields[]");
-        requireString(entry.name, "fields[].name");
-        if (typeof entry.dataTypeId !== "number" || !Number.isInteger(entry.dataTypeId))
-          fail("fields[].dataTypeId must be an integer");
-      }
-      if (!Array.isArray(item.rows) || !item.rows.every(isRecord8))
-        fail("rows must be an array of objects");
-      requireError(item.error, "error");
-      break;
-    }
-    case "crypto":
-      onlyKeys(item, ["seq", "kind", "request", "value"], "exchange");
-      validateCryptoRequest(item.request);
-      requireString(item.value, "value");
-      break;
-    default:
-      fail('kind must be one of "http", "db", "crypto"');
-  }
-  return item;
-}
-function validateRequest(value) {
-  const item = requireRecord(value, "request");
-  onlyKeys(item, ["requestId", "receivedAt", "headers", "body"], "request");
-  requireNonEmptyString(item.requestId, "requestId");
-  requireNonEmptyString(item.receivedAt, "receivedAt");
-  requireStringRecord(item.headers, "headers");
-  requireString(item.body, "body");
-  return item;
-}
-function parseJsonFile(file, validate) {
-  let value;
-  try {
-    value = JSON.parse(file.content);
-  } catch (error) {
-    throw new FixtureFormatError(`not valid JSON (${error instanceof Error ? error.message : String(error)})`, file.path);
-  }
-  try {
-    return validate(value);
-  } catch (error) {
-    if (error instanceof ShapeError)
-      throw new FixtureFormatError(error.message, file.path);
-    throw error;
-  }
-}
-function parseNdjson(file, validate) {
-  const items = [];
-  const lines = file.content.split(`
-`);
-  for (let index = 0;index < lines.length; index += 1) {
-    const text = (lines[index] ?? "").replace(/\r$/, "");
-    if (text.trim() === "")
-      continue;
-    const line = index + 1;
-    let value;
-    try {
-      value = JSON.parse(text);
-    } catch {
-      throw new FixtureFormatError("not valid JSON", file.path, line);
-    }
-    try {
-      items.push(validate(value, line));
-    } catch (error) {
-      if (error instanceof ShapeError)
-        throw new FixtureFormatError(error.message, file.path, line);
-      throw error;
-    }
-  }
-  return items;
-}
-function normalizePath(filePath) {
-  return filePath.replace(/\\/g, "/").replace(/^\.\//, "");
-}
-function parseFixtures(files) {
-  const groups = new Map;
-  for (const raw of files) {
-    const file = { path: normalizePath(raw.path), content: raw.content };
-    const parts = file.path.split("/");
-    if (parts.some((part) => part === "" || part === "." || part === ".."))
-      throw new FixtureFormatError("fixture paths must be plain relative paths", file.path);
-    if (parts.some((part) => part.startsWith(".")))
-      continue;
-    if (parts.length !== 3 || parts[0] !== FIXTURES_DIR) {
-      throw new FixtureFormatError(`unexpected file: fixture files live at ${FIXTURES_DIR}/<case>/{${[...CASE_FILES].join(",")}}`, file.path);
-    }
-    const name = parts[1] ?? "";
-    const fileName = parts[2] ?? "";
-    if (!FIXTURE_CASE_NAME_PATTERN.test(name)) {
-      throw new FixtureFormatError(`case name "${name}" must match ${FIXTURE_CASE_NAME_PATTERN.source}`, file.path);
-    }
-    if (!CASE_FILES.has(fileName)) {
-      throw new FixtureFormatError(`unexpected file in case "${name}": expected ${[...CASE_FILES].join(", ")}`, file.path);
-    }
-    const group = groups.get(name) ?? new Map;
-    if (group.has(fileName))
-      throw new FixtureFormatError("duplicate file", file.path);
-    group.set(fileName, file);
-    groups.set(name, group);
-  }
-  const fixtures = [];
-  for (const name of [...groups.keys()].sort()) {
-    const group = groups.get(name) ?? new Map;
-    const casePath = `${FIXTURES_DIR}/${name}/${CASE_FILE}`;
-    const caseFile = group.get(CASE_FILE);
-    if (!caseFile)
-      throw new FixtureFormatError(`case "${name}" has no ${CASE_FILE}`, casePath);
-    const fixtureCase = parseJsonFile(caseFile, validateCase);
-    const exchangesFile = group.get(EXCHANGES_FILE);
-    let previousSeq = 0;
-    const exchanges = exchangesFile ? parseNdjson(exchangesFile, (value) => {
-      const exchange = validateExchange(value);
-      if (exchange.seq <= previousSeq)
-        fail(`seq ${exchange.seq} must be greater than the previous seq ${previousSeq}`);
-      previousSeq = exchange.seq;
-      return exchange;
-    }) : [];
-    const requestsFile = group.get(REQUESTS_FILE);
-    if (fixtureCase.kind === "push" && !requestsFile) {
-      throw new FixtureFormatError(`push case "${name}" needs ${REQUESTS_FILE} next to ${CASE_FILE}`, casePath);
-    }
-    if (fixtureCase.kind !== "push" && requestsFile) {
-      throw new FixtureFormatError(`${REQUESTS_FILE} only belongs to push cases`, requestsFile.path);
-    }
-    const seen = new Set;
-    const requests = requestsFile ? parseNdjson(requestsFile, (value) => {
-      const request = validateRequest(value);
-      if (seen.has(request.requestId))
-        fail(`requestId "${request.requestId}" appears more than once`);
-      seen.add(request.requestId);
-      return request;
-    }) : [];
-    fixtures.push({ name, case: fixtureCase, exchanges, requests });
-  }
-  return fixtures;
-}
-function redactCaseSecrets(fixtureCase) {
-  if (!fixtureCase.secrets)
-    return fixtureCase;
-  const secrets = Object.fromEntries(Object.entries(fixtureCase.secrets).map(([field, value]) => [field, value.length >= REDACT_MIN_LENGTH ? REDACTED : value]));
-  return { ...fixtureCase, secrets };
-}
-function ndjson(items) {
-  return items.map((item) => `${JSON.stringify(item)}
-`).join("");
-}
-function serializeFixture(name, input) {
-  const dir = `${FIXTURES_DIR}/${name}`;
-  if (!FIXTURE_CASE_NAME_PATTERN.test(name))
-    throw new FixtureFormatError(`case name "${name}" must match ${FIXTURE_CASE_NAME_PATTERN.source}`, `${dir}/${CASE_FILE}`);
-  const requests = input.requests ?? [];
-  if (input.case.kind !== "push" && requests.length > 0)
-    throw new FixtureFormatError(`${REQUESTS_FILE} only belongs to push cases`, `${dir}/${REQUESTS_FILE}`);
-  const files = [{ path: `${dir}/${CASE_FILE}`, content: `${JSON.stringify(redactCaseSecrets(input.case), null, 2)}
-` }];
-  if (input.exchanges.length > 0)
-    files.push({ path: `${dir}/${EXCHANGES_FILE}`, content: ndjson(input.exchanges) });
-  if (input.case.kind === "push")
-    files.push({ path: `${dir}/${REQUESTS_FILE}`, content: ndjson(requests) });
-  return files;
-}
-async function readFixtureDir(dir) {
-  const fs = await import("node:fs/promises");
-  const path = await import("node:path");
-  const root = path.join(dir, FIXTURES_DIR);
-  const files = [];
-  const walk = async (absolute, relative) => {
-    const entries = await fs.readdir(absolute, { withFileTypes: true });
-    for (const entry of entries) {
-      if (entry.name.startsWith("."))
-        continue;
-      const childAbsolute = path.join(absolute, entry.name);
-      const childRelative = `${relative}/${entry.name}`;
-      if (entry.isSymbolicLink())
-        throw new FixtureFormatError("symbolic links are not allowed in fixtures", childRelative);
-      if (entry.isDirectory())
-        await walk(childAbsolute, childRelative);
-      else if (entry.isFile())
-        files.push({ path: childRelative, content: await fs.readFile(childAbsolute, "utf8") });
-    }
-  };
-  let stat;
-  try {
-    stat = await fs.lstat(root);
-  } catch (error) {
-    if (isRecord8(error) && error.code === "ENOENT")
-      return [];
-    throw error;
-  }
-  if (stat.isSymbolicLink())
-    throw new FixtureFormatError("symbolic links are not allowed in fixtures", FIXTURES_DIR);
-  if (!stat.isDirectory())
-    throw new FixtureFormatError("must be a directory", FIXTURES_DIR);
-  await walk(root, FIXTURES_DIR);
-  return files.sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
-}
-function canonicalRequestUrl(url, query) {
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    return url;
-  }
-  for (const [name, value] of Object.entries(query ?? {})) {
-    for (const item of Array.isArray(value) ? value : [value])
-      parsed.searchParams.append(name, item);
-  }
-  parsed.searchParams.sort();
-  return parsed.toString();
-}
-function canonicalJson(value) {
-  return JSON.stringify(value, (_key, item) => {
-    if (!isRecord8(item))
-      return item;
-    return Object.fromEntries(Object.keys(item).sort().map((key) => [key, item[key]]));
-  });
-}
-// src/testing/recorder.ts
-function isRecord9(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function redactDeep(value, secrets) {
-  const plain = value === undefined ? null : JSON.parse(JSON.stringify(value));
-  const walk = (item) => {
-    if (typeof item === "string")
-      return redactSecretValues(item, secrets);
-    if (Array.isArray(item))
-      return item.map(walk);
-    if (isRecord9(item))
-      return Object.fromEntries(Object.entries(item).map(([key, child]) => [key, walk(child)]));
-    return item;
-  };
-  return walk(plain);
-}
-function createRecorder(options) {
-  const secrets = secretRedactionTexts([...Object.values(options.secrets), ...options.extraSecrets ?? []].filter((value) => typeof value === "string"));
-  const redact = (text) => redactSecretValues(text, secrets);
-  const recorded = [];
-  const openCursors = new Map;
-  let seq = 0;
-  const errorOf = (exchange) => exchange.error ? { code: exchange.error.code, message: redact(exchange.error.message) } : null;
-  const recordHttp = (exchange) => {
-    const request = exchange.request;
-    if (!isRecord9(request) || typeof request.url !== "string" || typeof request.method !== "string")
-      return;
-    const bodyEncoding = request.bodyEncoding === "base64" ? "base64" : "utf8";
-    const body = typeof request.body === "string" ? bodyEncoding === "utf8" ? redact(request.body) : request.body : null;
-    const response = exchange.response;
-    seq += 1;
-    recorded.push({
-      seq,
-      kind: "http",
-      request: {
-        method: request.method,
-        url: redactUrl(canonicalRequestUrl(request.url, request.query), secrets),
-        headers: redactHeaders(isRecord9(request.headers) ? request.headers : {}, secrets),
-        body,
-        bodyEncoding
-      },
-      response: exchange.error || !isRecord9(response) ? null : {
-        status: response.status,
-        headers: redactHeaders(response.headers ?? {}, secrets),
-        body: response.bodyEncoding === "utf8" ? redact(response.body) : response.body,
-        bodyEncoding: response.bodyEncoding
-      },
-      error: errorOf(exchange) ?? (isRecord9(response) ? null : { code: "HOST_CALL_FAILED", message: "no response was recorded" })
-    });
-  };
-  const recordDb = (exchange) => {
-    const request = exchange.request;
-    if (!isRecord9(request))
-      return;
-    if (typeof request.sql === "string") {
-      const response = exchange.response;
-      seq += 1;
-      const entry = {
-        seq,
-        kind: "db",
-        sql: redact(request.sql),
-        params: redactDeep(Array.isArray(request.params) ? request.params : [], secrets),
-        fields: isRecord9(response) && Array.isArray(response.fields) ? response.fields.map((field) => ({ name: field.name, dataTypeId: field.dataTypeId })) : [],
-        rows: isRecord9(response) && Array.isArray(response.rows) ? redactDeep(response.rows, secrets) : [],
-        error: errorOf(exchange)
-      };
-      recorded.push(entry);
-      if (isRecord9(response) && typeof response.cursorId === "string" && response.done === false)
-        openCursors.set(response.cursorId, entry);
-      return;
-    }
-    if (typeof request.cursorId === "string") {
-      const entry = openCursors.get(request.cursorId);
-      if (!entry)
-        return;
-      const response = exchange.response;
-      if (isRecord9(response) && Array.isArray(response.rows))
-        entry.rows.push(...redactDeep(response.rows, secrets));
-      const error = errorOf(exchange);
-      if (error)
-        entry.error = error;
-      if (error || !isRecord9(response) || response.done !== false)
-        openCursors.delete(request.cursorId);
-    }
-  };
-  const recordCrypto = (exchange) => {
-    if (exchange.error || !isRecord9(exchange.request) || !isRecord9(exchange.response) || typeof exchange.response.value !== "string")
-      return;
-    const request = redactDeep(exchange.request, secrets);
-    seq += 1;
-    recorded.push({ seq, kind: "crypto", request, value: redact(exchange.response.value) });
-  };
-  return {
-    onExchange(exchange) {
-      switch (exchange.kind) {
-        case "http":
-          recordHttp(exchange);
-          return;
-        case "db":
-          recordDb(exchange);
-          return;
-        case "crypto":
-          recordCrypto(exchange);
-          return;
-      }
-    },
-    exchanges() {
-      return JSON.parse(JSON.stringify(recorded));
-    }
-  };
-}
-// src/testing/replay.ts
-var import_node_crypto3 = require("node:crypto");
-
-// src/testing/schema.ts
-var ISO_DATE_TIME = /^(\d{4})-(\d{2})-(\d{2})[T ](\d{2}):(\d{2})(?::(\d{2})(?:\.\d{1,9})?)?(Z|[+-]\d{2}(?::?\d{2})?)?$/i;
-var ISO_DATE = /^(\d{4})-(\d{2})-(\d{2})$/;
-function validDate(year, month, day) {
-  return month >= 1 && month <= 12 && day >= 1 && day <= new Date(Date.UTC(year, month, 0)).getUTCDate();
-}
-function parseIsoDateTime(value) {
-  const match = ISO_DATE_TIME.exec(value);
-  if (!match)
-    return null;
-  const [, year, month, day, hour, minute, second, offset] = match;
-  if (!validDate(Number(year), Number(month), Number(day)) || Number(hour) > 23 || Number(minute) > 59 || Number(second ?? "0") > 59)
-    return null;
-  const local = value.slice(0, value.length - (offset?.length ?? 0)).replace(" ", "T").replace(/(\.\d{3})\d+$/, "$1");
-  let zone = "Z";
-  if (offset !== undefined && offset.toUpperCase() !== "Z") {
-    const digits = offset.slice(1).replace(":", "");
-    zone = `${offset[0]}${digits.slice(0, 2)}:${digits.length > 2 ? digits.slice(2) : "00"}`;
-  }
-  const parsed = Date.parse(`${local}${zone}`);
-  return Number.isNaN(parsed) ? null : parsed;
-}
-function parseIsoInstant(value) {
-  const dateTime = parseIsoDateTime(value);
-  if (dateTime !== null)
-    return dateTime;
-  const match = ISO_DATE.exec(value);
-  if (!match || !validDate(Number(match[1]), Number(match[2]), Number(match[3])))
-    return null;
-  return Date.UTC(Number(match[1]), Number(match[2]) - 1, Number(match[3]));
-}
-function kindOf(value) {
-  if (value === null || value === undefined)
-    return null;
-  if (typeof value === "number" || typeof value === "bigint")
-    return "number";
-  if (typeof value === "boolean")
-    return "boolean";
-  if (typeof value === "string")
-    return parseIsoDateTime(value) !== null ? "timestamp" : "string";
-  return "json";
-}
-function inferRecordSchema(rows) {
-  const seen = new Map;
-  for (const row of rows) {
-    for (const [column, value] of Object.entries(row)) {
-      const kinds = seen.get(column) ?? new Set;
-      const kind = kindOf(value);
-      if (kind)
-        kinds.add(kind);
-      seen.set(column, kinds);
-    }
-  }
-  const schema = {};
-  for (const [column, kinds] of seen) {
-    if (kinds.size === 0)
-      schema[column] = "null";
-    else if (kinds.size === 1)
-      schema[column] = [...kinds][0] ?? "json";
-    else if (kinds.size === 2 && kinds.has("string") && kinds.has("timestamp"))
-      schema[column] = "string";
-    else
-      schema[column] = "json";
-  }
-  return schema;
-}
-
-// src/testing/compliance.ts
-var COMPLIANCE_CODES = Object.freeze([
-  "PRIMARY_KEY_DUPLICATE",
-  "RECORD_SCHEMA_MISMATCH",
-  "UNDECLARED_TABLE",
-  "CHECKPOINT_NOT_MONOTONIC",
-  "FULL_READ_NOT_REPEATABLE",
-  "FIXTURE_EXCHANGE_UNUSED",
-  "FIXTURE_EXCHANGE_MISMATCH",
-  "EXPECTATION_FAILED"
-]);
-function isRecord10(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function tablesOf(value) {
-  const tables = {};
-  if (!isRecord10(value))
-    return tables;
-  for (const [name, table] of Object.entries(value)) {
-    if (!isRecord10(table) || !isRecord10(table.columns))
-      continue;
-    const columns = {};
-    for (const [column, type] of Object.entries(table.columns)) {
-      if (isRecord10(type) && typeof type.kind === "string")
-        columns[column] = type;
-    }
-    const primaryKey = Array.isArray(table.primaryKey) ? table.primaryKey.filter((item) => typeof item === "string") : [];
-    tables[name] = { columns, primaryKey };
-  }
-  return tables;
-}
-function entriesOf(value) {
-  return isRecord10(value) ? Object.entries(value).filter((entry) => isRecord10(entry[1])) : [];
-}
-function scopedTables(declaration, scope) {
-  if (!declaration || !isRecord10(declaration.discover))
-    return null;
-  const { streams, pushes } = declaration.discover;
-  if (scope.stream !== undefined) {
-    const stream = entriesOf(streams).find(([name]) => name === scope.stream)?.[1];
-    return tablesOf(stream?.tables);
-  }
-  if (scope.push !== undefined) {
-    const push = entriesOf(pushes).find(([name]) => name === scope.push)?.[1];
-    return tablesOf(push?.tables);
-  }
-  const all = {};
-  for (const [, item] of [...entriesOf(streams), ...entriesOf(pushes)])
-    Object.assign(all, tablesOf(item.tables));
-  return all;
-}
-var INSTANT_PATTERN = /^(\d{4})-(\d{2})-(\d{2})[T ](\d{2}):(\d{2})(?::(\d{2})(?:\.(\d{1,9}))?)?(Z|[+-]\d{2}(?::?\d{2})?)$/i;
-var DATE_PATTERN = /^(\d{4})-(\d{2})-(\d{2})$/;
-var INTEGER_PATTERN = /^-?\d+$/;
-var DECIMAL_PATTERN = /^-?(\d+)(?:\.(\d+))?$/;
-function validCalendarDate(year, month, day) {
-  return month >= 1 && month <= 12 && day >= 1 && day <= new Date(Date.UTC(year, month, 0)).getUTCDate();
-}
-function columnValueProblem(type, value) {
-  if (value === null || value === undefined)
-    return null;
-  switch (type.kind) {
-    case "string":
-      return typeof value === "string" ? null : "is not a valid string";
-    case "integer":
-      if (typeof value === "number" && Number.isSafeInteger(value))
-        return null;
-      if (typeof value === "bigint")
-        return null;
-      if (typeof value === "string" && INTEGER_PATTERN.test(value))
-        return null;
-      return "is not a valid integer";
-    case "decimal": {
-      let text;
-      if (typeof value === "number" && Number.isFinite(value))
-        text = String(value);
-      else if (typeof value === "string")
-        text = value;
-      else
-        return "is not a valid decimal";
-      const match = DECIMAL_PATTERN.exec(text);
-      if (!match)
-        return "is not a valid decimal";
-      if (type.precision !== undefined && type.scale !== undefined) {
-        const integerDigits = (match[1] ?? "").replace(/^0+(?=\d)/, "");
-        if (integerDigits !== "0" && integerDigits.length > type.precision - type.scale)
-          return `exceeds decimal precision ${type.precision},${type.scale}`;
-      }
-      return null;
-    }
-    case "boolean":
-      return typeof value === "boolean" ? null : "is not a valid boolean";
-    case "date": {
-      if (typeof value !== "string")
-        return "is not a valid date";
-      const match = DATE_PATTERN.exec(value);
-      return match && validCalendarDate(Number(match[1]), Number(match[2]), Number(match[3])) ? null : "is not a valid date";
-    }
-    case "instant": {
-      if (typeof value !== "string")
-        return "is not a valid instant";
-      const match = INSTANT_PATTERN.exec(value);
-      if (!match)
-        return "is not an ISO 8601 timestamp with a time zone offset";
-      const [, year, month, day, hour, minute, second] = match;
-      const valid = validCalendarDate(Number(year), Number(month), Number(day)) && Number(hour) <= 23 && Number(minute) <= 59 && Number(second ?? "0") <= 59;
-      return valid && parseIsoInstant(value) !== null ? null : "is not a valid point in time";
-    }
-    case "json":
-      try {
-        return JSON.stringify(value) === undefined ? "is not valid JSON" : null;
-      } catch {
-        return "is not valid JSON";
-      }
-    default:
-      return `has an unsupported column type ${type.kind}`;
-  }
-}
-
-class FindingSet {
-  items = new Map;
-  ordered = [];
-  add(key, build) {
-    const existing = this.items.get(key);
-    if (existing) {
-      existing.count += 1;
-      existing.finding.detail.count = existing.count;
-      return;
-    }
-    const { code, message, table, sample, extra } = build();
-    const finding = { code, message, ...table !== undefined ? { table } : {}, detail: { count: 1, ...sample !== undefined ? { sample } : {}, ...extra } };
-    this.items.set(key, { finding, count: 1 });
-    this.ordered.push(finding);
-  }
-  push(finding) {
-    this.ordered.push(finding);
-  }
-  list() {
-    return this.ordered;
-  }
-}
-function checkRows(input, tables, findings) {
-  const keysSeen = new Map;
-  const undeclared = (table, sample) => {
-    findings.add(`undeclared\x00${table}`, () => ({
-      code: "UNDECLARED_TABLE",
-      table,
-      sample,
-      message: `table "${table}" is not declared${input.stream !== undefined ? ` by stream "${input.stream}"` : input.push !== undefined ? ` by push "${input.push}"` : ""}`
-    }));
-  };
-  const mismatch = (table, column, reason, sample) => {
-    findings.add(`schema\x00${table}\x00${column}\x00${reason}`, () => ({
-      code: "RECORD_SCHEMA_MISMATCH",
-      table,
-      sample,
-      extra: { column },
-      message: `column "${column}" of table "${table}" ${reason}`
-    }));
-  };
-  for (const record of input.result.records) {
-    const declared = Object.hasOwn(tables, record.table) ? tables[record.table] : undefined;
-    if (!declared) {
-      undeclared(record.table, record.row);
-      continue;
-    }
-    for (const column of Object.keys(record.row)) {
-      if (!Object.hasOwn(declared.columns, column))
-        mismatch(record.table, column, "is not declared", record.row);
-    }
-    for (const [column, type] of Object.entries(declared.columns)) {
-      const problem = columnValueProblem(type, record.row[column]);
-      if (problem)
-        mismatch(record.table, column, problem, record.row[column]);
-    }
-    const missing = declared.primaryKey.filter((column) => record.row[column] === null || record.row[column] === undefined);
-    for (const column of missing)
-      mismatch(record.table, column, "is a primary key column and is missing", record.row);
-    if (declared.primaryKey.length === 0 || missing.length > 0)
-      continue;
-    const key = JSON.stringify(declared.primaryKey.map((column) => record.row[column]));
-    const seen = keysSeen.get(record.table) ?? new Set;
-    if (seen.has(key)) {
-      const sample = Object.fromEntries(declared.primaryKey.map((column) => [column, record.row[column]]));
-      findings.add(`pk\x00${record.table}`, () => ({
-        code: "PRIMARY_KEY_DUPLICATE",
-        table: record.table,
-        sample,
-        message: `table "${record.table}" received more than one record with the same primary key (${declared.primaryKey.join(", ")})`
-      }));
-    }
-    seen.add(key);
-    keysSeen.set(record.table, seen);
-  }
-  for (const removal of input.result.removals) {
-    const declared = Object.hasOwn(tables, removal.table) ? tables[removal.table] : undefined;
-    if (!declared) {
-      undeclared(removal.table, removal.key);
-      continue;
-    }
-    for (const column of Object.keys(removal.key)) {
-      if (!declared.primaryKey.includes(column))
-        mismatch(removal.table, column, "is not part of the primary key (removal)", removal.key);
-    }
-    for (const column of declared.primaryKey) {
-      const value = removal.key[column];
-      if (value === null || value === undefined) {
-        mismatch(removal.table, column, "is a primary key column and is missing (removal)", removal.key);
-        continue;
-      }
-      const type = declared.columns[column];
-      const problem = type ? columnValueProblem(type, value) : "is not declared";
-      if (problem)
-        mismatch(removal.table, column, `${problem} (removal)`, value);
-    }
-  }
-}
-function comparable(value) {
-  if (typeof value === "number" && Number.isFinite(value))
-    return { kind: "number", at: value };
-  if (typeof value === "string") {
-    const at = parseIsoInstant(value);
-    if (at !== null)
-      return { kind: "time", at };
-  }
-  return null;
-}
-function checkCheckpoints(checkpoints, findings) {
-  for (let index = 1;index < checkpoints.length; index += 1) {
-    const previous = checkpoints[index - 1];
-    const next = checkpoints[index];
-    if (!previous || !next || !isRecord10(previous.state) || !isRecord10(next.state))
-      continue;
-    for (const [field, before] of Object.entries(previous.state)) {
-      if (!Object.hasOwn(next.state, field))
-        continue;
-      const after = next.state[field];
-      const a = comparable(before);
-      const b = comparable(after);
-      if (!a || !b || a.kind !== b.kind || b.at >= a.at)
-        continue;
-      findings.push({
-        code: "CHECKPOINT_NOT_MONOTONIC",
-        message: `checkpoint field "${field}" went backwards from ${JSON.stringify(before)} to ${JSON.stringify(after)} (checkpoint ${next.seq})`,
-        detail: { field, previous: before, next: after, seq: next.seq }
-      });
-    }
-  }
-}
-function canonical(value) {
-  return JSON.stringify(value, (_key, item) => isRecord10(item) ? Object.fromEntries(Object.keys(item).sort().map((key) => [key, item[key]])) : item);
-}
-function recordSet(records, tables) {
-  return records.map((record) => {
-    const primaryKey = tables && Object.hasOwn(tables, record.table) ? tables[record.table]?.primaryKey ?? [] : [];
-    return `${record.table}\x00${canonical(primaryKey.map((column) => record.row[column]))}\x00${canonical(record.row)}`;
-  }).sort();
-}
-function checkRepeatable(input, tables, findings) {
-  const rerun = input.rerun;
-  if (input.mode !== "full" || !rerun)
-    return;
-  if (rerun.error) {
-    findings.push({
-      code: "FULL_READ_NOT_REPEATABLE",
-      message: `the second full read failed (${rerun.error.code}: ${rerun.error.message})`,
-      detail: { error: rerun.error }
-    });
-    return;
-  }
-  const first = recordSet(input.result.records, tables);
-  const second = recordSet(rerun.records, tables);
-  if (first.length === second.length && first.every((item, index) => item === second[index]))
-    return;
-  const firstSet = new Set(first);
-  const secondSet = new Set(second);
-  findings.push({
-    code: "FULL_READ_NOT_REPEATABLE",
-    message: `two full reads returned different records (${first.length} vs ${second.length} record(s))`,
-    detail: {
-      firstCount: first.length,
-      secondCount: second.length,
-      onlyInFirst: first.filter((item) => !secondSet.has(item)).length,
-      onlyInSecond: second.filter((item) => !firstSet.has(item)).length
-    }
-  });
-}
-function checkCompliance(input) {
-  const findings = new FindingSet;
-  const tables = scopedTables(input.declaration, { ...input.stream !== undefined ? { stream: input.stream } : {}, ...input.push !== undefined ? { push: input.push } : {} });
-  if (tables)
-    checkRows(input, tables, findings);
-  checkCheckpoints(input.result.checkpoints, findings);
-  checkRepeatable(input, tables, findings);
-  return findings.list();
-}
-
-// src/testing/replay.ts
-class FixtureReplayError extends Error {
-  code;
-  constructor(code, message) {
-    super(message);
-    this.name = "FixtureReplayError";
-    this.code = code;
-  }
-}
-var MISMATCH = "FIXTURE_EXCHANGE_MISMATCH";
-var PLAIN_HANDLE2 = /ontos:secret:([A-Za-z_][A-Za-z0-9_]*)/g;
-function isRecord11(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function preview(text, max = 200) {
-  return text.length > max ? `${text.slice(0, max)}…` : text;
-}
-function createReplayHost(fixture) {
-  const caseSecrets = fixture.case.secrets ?? {};
-  const secretValues = Object.values(caseSecrets);
-  const redact = (text) => redactSecretValues(text, secretValues);
-  const used = new Set;
-  const mismatched = [];
-  const failingCursors = new Map;
-  const cache = new Map;
-  const mismatch = (method, detail) => {
-    mismatched.push({ method, detail });
-    throw new FixtureReplayError(MISMATCH, `no recorded exchange in fixture "${fixture.name}" matches ${method} ${detail}`);
-  };
-  const take = (kind, matches) => {
-    for (const exchange of fixture.exchanges) {
-      if (exchange.kind !== kind || used.has(exchange.seq))
-        continue;
-      const typed = exchange;
-      if (!matches(typed))
-        continue;
-      used.add(exchange.seq);
-      return typed;
-    }
-    return null;
-  };
-  const lookupSecret = (field) => {
-    const value = Object.hasOwn(caseSecrets, field) ? caseSecrets[field] : undefined;
-    if (typeof value !== "string")
-      throw new FixtureReplayError("EGRESS_SECRET_UNAVAILABLE", `Secret '${field}' is not in the fixture's case.json secrets`);
-    return value;
-  };
-  const http = (payload) => {
-    if (!isRecord11(payload) || typeof payload.method !== "string" || typeof payload.url !== "string") {
-      throw new FixtureReplayError("BAD_REQUEST", "http request must have a method and a url");
-    }
-    const query = isRecord11(payload.query) ? payload.query : undefined;
-    const scriptUrl = canonicalRequestUrl(payload.url, query);
-    const url = redactUrl(scriptUrl, secretValues);
-    const bodyEncoding = payload.bodyEncoding === "base64" ? "base64" : "utf8";
-    const body = typeof payload.body === "string" ? bodyEncoding === "utf8" ? redact(payload.body) : payload.body : null;
-    const method = payload.method;
-    const exchange = take("http", (item) => item.request.method === method && item.request.url === url && item.request.body === body && (body === null || item.request.bodyEncoding === bodyEncoding));
-    if (!exchange)
-      return mismatch("http", `${method} ${url}${body !== null ? ` with body ${preview(body)}` : ""}`);
-    if (exchange.error)
-      throw new FixtureReplayError(exchange.error.code, exchange.error.message);
-    if (!exchange.response)
-      throw new FixtureReplayError("HOST_CALL_FAILED", "the recorded exchange has no response");
-    return { status: exchange.response.status, url: scriptUrl, headers: { ...exchange.response.headers }, body: exchange.response.body, bodyEncoding: exchange.response.bodyEncoding };
-  };
-  const dbQuery = (payload) => {
-    if (!isRecord11(payload) || typeof payload.sql !== "string")
-      throw new FixtureReplayError("BAD_REQUEST", "db.query needs sql");
-    const sql = redact(payload.sql);
-    const params = canonicalJson(JSON.parse(redact(JSON.stringify(Array.isArray(payload.params) ? payload.params : []))));
-    const exchange = take("db", (item) => item.sql === sql && canonicalJson(item.params) === params);
-    if (!exchange)
-      return mismatch("db.query", `${preview(sql.replace(/\s+/g, " ").trim())} with params ${preview(params)}`);
-    const rows = exchange.rows.map((row) => ({ ...row }));
-    const fields = exchange.fields.map((field) => ({ ...field }));
-    if (!exchange.error)
-      return { cursorId: null, fields, rows, done: true };
-    if (fields.length === 0 && rows.length === 0)
-      throw new FixtureReplayError(exchange.error.code, exchange.error.message);
-    const cursorId = `replay-${exchange.seq}`;
-    failingCursors.set(cursorId, exchange.error);
-    return { cursorId, fields, rows, done: false };
-  };
-  const crypto = (payload) => {
-    if (!isRecord11(payload) || typeof payload.op !== "string")
-      throw new FixtureReplayError("BAD_REQUEST", "crypto request must have an op");
-    const request = JSON.parse(redact(JSON.stringify(payload)));
-    const key = canonicalJson(request);
-    const exchange = take("crypto", (item) => canonicalJson(item.request) === key);
-    if (exchange)
-      return { value: exchange.value };
-    if (request.op === "hash") {
-      const data = request.data.replace(PLAIN_HANDLE2, (_match, field) => lookupSecret(field));
-      return { value: import_node_crypto3.createHash(request.algorithm).update(data, "utf8").digest(request.encoding) };
-    }
-    return mismatch("crypto", `${request.op} ${request.algorithm}`);
-  };
-  const call = async (method, payload) => {
-    switch (method) {
-      case "http":
-        return http(payload);
-      case "db.query":
-        return dbQuery(payload);
-      case "db.next": {
-        const cursorId = isRecord11(payload) && typeof payload.cursorId === "string" ? payload.cursorId : "";
-        const error = failingCursors.get(cursorId);
-        if (!error)
-          throw new FixtureReplayError("DB_CURSOR_NOT_FOUND", "The cursor doesn't exist or was closed");
-        failingCursors.delete(cursorId);
-        throw new FixtureReplayError(error.code, error.message);
-      }
-      case "db.close": {
-        const cursorId = isRecord11(payload) && typeof payload.cursorId === "string" ? payload.cursorId : "";
-        failingCursors.delete(cursorId);
-        return null;
-      }
-      case "crypto":
-        return crypto(payload);
-      case "cache.get": {
-        const key = isRecord11(payload) && typeof payload.key === "string" ? payload.key : "";
-        const entry = cache.get(key);
-        if (!entry || Date.parse(entry.expiresAt) <= Date.now())
-          return null;
-        return entry;
-      }
-      case "cache.set": {
-        if (!isRecord11(payload) || typeof payload.key !== "string" || typeof payload.value !== "string" || typeof payload.ttlSeconds !== "number") {
-          throw new FixtureReplayError("BAD_REQUEST", "cache.set needs key, value and ttlSeconds");
-        }
-        cache.set(payload.key, { value: payload.value, expiresAt: new Date(Date.now() + payload.ttlSeconds * 1000).toISOString() });
-        return null;
-      }
-      case "secret.reveal": {
-        const field = isRecord11(payload) && typeof payload.field === "string" ? payload.field : "";
-        return { value: lookupSecret(field) };
-      }
-      default:
-        throw new FixtureReplayError("HOST_METHOD_UNSUPPORTED", `fixture replay does not answer ${method}`);
-    }
-  };
-  return {
-    call,
-    redact,
-    async close() {
-      failingCursors.clear();
-    },
-    unused() {
-      return fixture.exchanges.filter((exchange) => !used.has(exchange.seq)).map((exchange) => JSON.parse(JSON.stringify(exchange)));
-    },
-    mismatches() {
-      return mismatched.map((item) => ({ ...item }));
-    }
-  };
-}
-function countBy(items) {
-  const counts = {};
-  for (const item of items)
-    counts[item.table] = (counts[item.table] ?? 0) + 1;
-  return counts;
-}
-function toDeclaration(declaration) {
-  if (!declaration || !isRecord11(declaration.discover))
-    return null;
-  const discover = declaration.discover;
-  return { definition: declaration.summary, streams: discover.streams, pushes: discover.pushes };
-}
-function exchangeSummary(exchange) {
-  switch (exchange.kind) {
-    case "http":
-      return `${exchange.request.method} ${exchange.request.url}`;
-    case "db":
-      return preview(exchange.sql.replace(/\s+/g, " ").trim());
-    case "crypto":
-      return `${exchange.request.op} ${exchange.request.algorithm}`;
-  }
-}
-function scopeOf(fixtureCase) {
-  if (fixtureCase.kind === "pull")
-    return { stream: fixtureCase.stream };
-  if (fixtureCase.kind === "push")
-    return { push: fixtureCase.push };
-  return {};
-}
-function sameCounts(expected, actual) {
-  return Object.entries(expected).filter(([table, count]) => (actual[table] ?? 0) !== count).map(([table, count]) => `${table}: expected ${count}, got ${actual[table] ?? 0}`);
-}
-function checkExpectation(fixture, result, declaration) {
-  const expect = fixture.case.expect;
-  if (!expect)
-    return [];
-  const findings = [];
-  const failed = (what, problems, detail) => {
-    findings.push({ code: "EXPECTATION_FAILED", message: `expect.${what} does not match (${problems.join("; ")})`, detail });
-  };
-  if (expect.records) {
-    const actual = countBy(result.records);
-    const problems = sameCounts(expect.records, actual);
-    if (problems.length > 0)
-      failed("records", problems, { expected: expect.records, actual });
-  }
-  if (expect.removals) {
-    const actual = countBy(result.removals);
-    const problems = sameCounts(expect.removals, actual);
-    if (problems.length > 0)
-      failed("removals", problems, { expected: expect.removals, actual });
-  }
-  if (expect.rejected !== undefined && expect.rejected !== result.rejected.length) {
-    failed("rejected", [`expected ${expect.rejected}, got ${result.rejected.length}`], { expected: expect.rejected, actual: result.rejected.length });
-  }
-  if (expect.checkpoints !== undefined && expect.checkpoints !== result.checkpoints.length) {
-    failed("checkpoints", [`expected ${expect.checkpoints}, got ${result.checkpoints.length}`], { expected: expect.checkpoints, actual: result.checkpoints.length });
-  }
-  if (expect.tables) {
-    const actual = Object.keys(scopedTables(declaration, scopeOf(fixture.case)) ?? {}).sort();
-    const expected = [...new Set(expect.tables)].sort();
-    if (actual.length !== expected.length || actual.some((table, index) => table !== expected[index])) {
-      failed("tables", [`expected [${expected.join(", ")}], got [${actual.join(", ")}]`], { expected, actual });
-    }
-  }
-  return findings;
-}
-async function runFixture(executor, fixture, options = {}) {
-  const fixtureCase = fixture.case;
-  const config = fixtureCase.config;
-  const secretFields = Object.keys(fixtureCase.secrets ?? {});
-  const execute = async (job, limit) => {
-    const host = createReplayHost(fixture);
-    try {
-      const result = await executor.run(job, host, {
-        ...limit !== undefined ? { limit } : {},
-        ...options.timeoutMs !== undefined ? { timeoutMs: options.timeoutMs } : {}
-      });
-      return { host, result };
-    } finally {
-      await host.close();
-    }
-  };
-  let main;
-  let declaration = null;
-  let rerun;
-  let error = null;
-  switch (fixtureCase.kind) {
-    case "pull": {
-      const job = {
-        kind: "pull",
-        config,
-        secretFields,
-        stream: fixtureCase.stream,
-        mode: fixtureCase.mode,
-        state: fixtureCase.state ?? null,
-        streamConfig: fixtureCase.streamConfig ?? {},
-        tables: [],
-        discoverFirst: true
-      };
-      main = await execute(job, fixtureCase.limit);
-      declaration = main.result.declaration;
-      if (fixtureCase.mode === "full" && main.result.error === null)
-        rerun = (await execute(job, fixtureCase.limit)).result;
-      break;
-    }
-    case "push": {
-      const discovered = await execute({ kind: "discover", config, secretFields });
-      if (discovered.result.error) {
-        main = discovered;
-        error = { ...discovered.result.error, message: `discover failed before replaying the push requests: ${discovered.result.error.message}` };
-        break;
-      }
-      declaration = discovered.result.declaration;
-      main = await execute({
-        kind: "push",
-        config,
-        secretFields,
-        requests: fixture.requests.map((request) => ({ ...request, headers: { ...request.headers }, push: fixtureCase.push }))
-      });
-      break;
-    }
-    case "discover":
-      main = await execute({ kind: "discover", config, secretFields });
-      declaration = main.result.declaration;
-      break;
-  }
-  const result = main.result;
-  error ??= result.error;
-  const findings = [];
-  for (const item of main.host.mismatches()) {
-    findings.push({ code: "FIXTURE_EXCHANGE_MISMATCH", message: `no recorded exchange matches ${item.method} ${item.detail}`, detail: item });
-  }
-  if (error === null) {
-    for (const exchange of main.host.unused()) {
-      findings.push({
-        code: "FIXTURE_EXCHANGE_UNUSED",
-        message: `recorded exchange ${exchange.seq} (${exchange.kind} ${exchangeSummary(exchange)}) was not used`,
-        detail: { seq: exchange.seq, kind: exchange.kind }
-      });
-    }
-    findings.push(...checkCompliance({
-      declaration,
-      ...scopeOf(fixtureCase),
-      ...fixtureCase.kind === "pull" ? { mode: fixtureCase.mode } : {},
-      result,
-      ...rerun ? { rerun } : {}
-    }));
-    findings.push(...checkExpectation(fixture, result, declaration));
-  }
-  return {
-    name: fixture.name,
-    ok: error === null && findings.every((finding) => finding.code === "FIXTURE_EXCHANGE_UNUSED"),
-    findings,
-    stats: { records: countBy(result.records), removals: countBy(result.removals), checkpoints: result.checkpoints.length, rejected: result.rejected.length },
-    declaration: toDeclaration(declaration),
-    error
-  };
-}
-async function runFixtures(executor, files, options = {}) {
-  const results = [];
-  for (const fixture of parseFixtures(files))
-    results.push(await runFixture(executor, fixture, options));
-  return results;
-}