@hot-updater/console 1.0.0-rc.20 → 1.0.0-rc.21

package/.output/server/_ssr/{api-C0G9MTMI.mjs → auth.server-DM1J6NwR.mjs}

@@ -1,9 +1,11 @@
-import { C as isUUIDv7, D as parseReleaseCatalogScopeKey, E as normalizeRolloutCohortCount, T as normalizeCohortValue, a as RELEASE_CATALOG_FALLBACK_POLICY, b as getRolledOutNumericCohorts, c as encodeChannelKey, f as getManifestFileHash, h as getNumericCohortValue, l as getAssetBaseStorageUri, n as MAX_COMPILED_CATALOG_BYTES, o as createReleaseCatalogScopeKey, p as getManifestStorageUri, r as NIL_UUID, s as decodeChannelKey, u as getBundlePatch, x as isCustomCohort } from "./dist-B-r4u3Lg.mjs";
-import { a as bundleToRow, c as rowToBundle, i as bundleToPatchRows, r as DatabaseRowReferencedError, s as releaseRowToRelease, t as DatabaseBundleNotFoundError } from "./databaseRows-CXxf_VIB.mjs";
+import { C as isUUIDv7, D as parseReleaseCatalogScopeKey, E as normalizeRolloutCohortCount, T as normalizeCohortValue, a as RELEASE_CATALOG_FALLBACK_POLICY, b as getRolledOutNumericCohorts, c as decodeChannelKey, d as getBundlePatch, g as getNumericCohortValue, l as encodeChannelKey, m as getManifestStorageUri, n as MAX_COMPILED_CATALOG_BYTES, o as canonicalizeAppVersion, p as getManifestFileHash, r as NIL_UUID, s as createReleaseCatalogScopeKey, u as getAssetBaseStorageUri, x as isCustomCohort } from "./dist-Cxo9ghYv.mjs";
+import { n as DatabaseBundleNotFoundError, r as DatabaseRowReferencedError } from "./databaseJsonValue-Bhxciy7Z.mjs";
+import { i as rowToBundle, n as bundleToRow, r as releaseRowToRelease, t as bundleToPatchRows } from "./databaseRows-DwMAjaF8.mjs";
 import { t as ReleaseManagementError } from "./releaseManagement-B3e7I8J9.mjs";
-import { n as createUUIDv7After, t as createUUIDv7 } from "./uuidv7-BzSO-fr-.mjs";
-import { n as rangesIntersect, t as normalizeRange } from "../_libs/verkit.mjs";
-//#region node_modules/.nitro/vite/services/ssr/assets/api-C0G9MTMI.js
+import { n as createUUIDv7After, t as createUUIDv7 } from "./uuidv7-C8bwiZr8.mjs";
+import { n as defineTable, r as isRemoteDatabase, t as defineAggregate } from "./schema-BKY9SqaY.mjs";
+import { n as rangesIntersect } from "../_libs/verkit.mjs";
+//#region node_modules/.nitro/vite/services/ssr/assets/auth.server-DM1J6NwR.js
 var SHA256_FILE_HASH_RE = /^[0-9a-f]{64}$/;
 var isContentAddressedAssetFileHash = (value) => {
 	return typeof value === "string" && SHA256_FILE_HASH_RE.test(value);
@@ -130,6 +132,9 @@ var getBundleArchiveStorageUri = ({ manifestStorageUri, bundleId }) => replaceSt
 	keySuffix: createBundleStorageKey(bundleId, "manifest.json"),
 	replacement: createBundleStorageKey(bundleId, "bundle.tar.br")
 });
+function assertStorageOperations(adapter, operations) {
+	for (const operation of operations) if (typeof adapter[operation] !== "function") throw new Error(`Storage adapter "${adapter.name}" does not implement ${operation}.`);
+}
 var LETTER_DASH_NUMBER = "[a-zA-Z0-9-]";
 var NUMERIC_IDENTIFIER = String.raw`0|[1-9]\d*`;
 var NUMERIC_IDENTIFIER_LOOSE = String.raw`\d+`;
@@ -173,10 +178,6 @@ function formatComparableVersion(version) {
 	const base = `${version.major}.${version.minor}.${version.patch}`;
 	return version.prerelease?.length ? `${base}-${version.prerelease.join(".")}` : base;
 }
-function formatFullVersion(version) {
-	const comparable = formatComparableVersion(version);
-	return version.build?.length ? `${comparable}+${version.build.join(".")}` : comparable;
-}
 function parse(version, options = {}) {
 	if (typeof version !== "string") return version;
 	if (version.length > 256) throw new TypeError(`Version exceeds the maximum length of 256 characters`);
@@ -245,6 +246,9 @@ function compare(left, right, options = {}) {
 }
 var STRICT_COMPARATOR = safeRegex(String.raw`^${GREATER_LESS_THAN}\s*(${FULL_PLAIN})$|^$`);
 var LOOSE_COMPARATOR$1 = safeRegex(String.raw`^${GREATER_LESS_THAN}\s*(${LOOSE_PLAIN})$|^$`);
+function formatComparator(comparator) {
+	return comparator.version ? `${comparator.operator}${formatComparableVersion(comparator.version)}` : "";
+}
 function parseComparator(comparator, options = {}) {
 	if (typeof comparator !== "string") return comparator;
 	const normalized = comparator.trim().replaceAll(/\s+/g, " ");
@@ -259,6 +263,9 @@ function parseComparator(comparator, options = {}) {
 		version
 	};
 }
+function formatRange(range) {
+	return range.sets.map((set) => set.map(formatComparator).join(" ")).join("||");
+}
 var BUILD_STRIP = new RegExp(BUILD, "g");
 var BUILD_SAFE = safeRegex(BUILD);
 var STRICT_HYPHEN = safeRegex(String.raw`^\s*(${XRANGE_PLAIN})\s+-\s+(${XRANGE_PLAIN})\s*$`);
@@ -401,34 +408,25 @@ function parseRange(range, options = {}) {
 		sets
 	};
 }
-var COERCE_EXACT = safeRegex(COERCE);
-var COERCE_FULL_EXACT = safeRegex(COERCE_FULL);
+function tryParseRange(range, options = {}) {
+	try {
+		return parseRange(range, options);
+	} catch {
+		return null;
+	}
+}
+function normalizeRange$1(range, options = {}) {
+	const parsed = tryParseRange(range, options);
+	return parsed ? formatRange(parsed) || "*" : null;
+}
+safeRegex(COERCE);
+safeRegex(COERCE_FULL);
 safeRegex(`^${PRERELEASE}$`);
 safeRegex(`^${PRERELEASE_LOOSE}$`);
-function normalizeFull(version, options = {}) {
-	const parsed = tryParse(version, options);
-	return parsed ? formatFullVersion(parsed) : null;
-}
 function normalize(version, options = {}) {
 	const parsed = tryParse(version, options);
 	return parsed ? formatComparableVersion(parsed) : null;
 }
-function coerce(value, options = {}) {
-	if (typeof value === "object") return value;
-	const input = typeof value === "number" ? String(value) : value;
-	let match = null;
-	if (options.rtl) {
-		const expression = safeRegex(options.includePrerelease ? COERCE_FULL : COERCE, "g");
-		let next;
-		while ((next = expression.exec(input)) && (!match || match.index + match[0].length !== input.length)) {
-			if (!match || next.index + next[0].length !== match.index + match[0].length) match = next;
-			expression.lastIndex = next.index + next[1].length + next[2].length;
-		}
-	} else match = (options.includePrerelease ? COERCE_FULL_EXACT : COERCE_EXACT).exec(input);
-	if (!match) return null;
-	const major = match[2];
-	return tryParse(`${major}.${match[3] || "0"}.${match[4] || "0"}${options.includePrerelease && match[5] ? `-${match[5]}` : ""}${options.includePrerelease && match[6] ? `+${match[6]}` : ""}`, options);
-}
 var ReleaseCatalogCompilationError = class extends Error {
 	code;
 	constructor(code, message) {
@@ -780,10 +778,6 @@ function versionInSegment(version, segment) {
 	}
 	return true;
 }
-function canonicalizeAppVersion(appVersion) {
-	const version = coerce(appVersion);
-	return version ? normalizeFull(version) : null;
-}
 function projectCompiledCatalog(catalog, appVersion) {
 	let indexes;
 	if (catalog.strategy === "FINGERPRINT") indexes = catalog.releaseIndexes;
@@ -813,42 +807,93 @@ var ReleaseCatalogMutationError = class extends Error {
 		this.code = code;
 	}
 };
-/** A stored catalog payload, checked against its strategy's shape. */
-var parseCompiledCatalog = (payload, strategy) => {
-	const parsed = JSON.parse(payload);
-	if (typeof parsed !== "object" || parsed === null || Reflect.get(parsed, "schemaVersion") !== 1 || Reflect.get(parsed, "strategy") !== strategy || Reflect.get(parsed, "fallbackPolicy") !== "BUILTIN_IF_ACTIVE_INELIGIBLE" || !Array.isArray(Reflect.get(parsed, "releaseDescriptors"))) throw new Error("Stored Release catalog payload is invalid");
-	if (strategy === "APP_VERSION" && !Array.isArray(Reflect.get(parsed, "segments"))) throw new Error("Stored app-version Release catalog is invalid");
-	if (strategy === "FINGERPRINT" && !Array.isArray(Reflect.get(parsed, "releaseIndexes"))) throw new Error("Stored fingerprint Release catalog is invalid");
-	return parsed;
+var decodeBase64Url = (value) => {
+	try {
+		const base64 = value.replaceAll("-", "+").replaceAll("_", "/");
+		const binary = atob(base64.padEnd(Math.ceil(base64.length / 4) * 4, "="));
+		return new TextDecoder(void 0, { fatal: true }).decode(Uint8Array.from(binary, (character) => character.charCodeAt(0)));
+	} catch {
+		return null;
+	}
 };
-/** The scope key an update check reads. */
-var releaseCatalogScopeKeyOf = (input) => input.strategy === "APP_VERSION" ? createReleaseCatalogScopeKey({
-	channelKey: input.channelKey,
-	platform: input.platform,
-	strategy: "APP_VERSION"
-}) : createReleaseCatalogScopeKey({
-	channelKey: input.channelKey,
-	fingerprintHash: input.fingerprintHash,
-	platform: input.platform,
-	strategy: "FINGERPRINT"
-});
-/** Projects a stored catalog row for one update check; null when the row is not this scope's. */
-var projectReleaseCatalogRow = (row, input, scopeKey = releaseCatalogScopeKeyOf(input)) => {
-	if (row === null || row.platform !== input.platform || row.strategy !== input.strategy || row.channel_key !== input.channelKey || row.scope_key !== scopeKey || row.fingerprint_hash !== (input.strategy === "FINGERPRINT" ? input.fingerprintHash : null)) return null;
-	const compiled = parseCompiledCatalog(row.payload, input.strategy);
-	const appVersion = input.strategy === "APP_VERSION" ? input.appVersion : void 0;
-	return {
-		catalogId: row.catalog_id,
-		catalogHash: row.catalog_hash,
-		fallbackPolicy: RELEASE_CATALOG_FALLBACK_POLICY,
-		generation: row.generation,
-		releases: projectCompiledCatalog(compiled, appVersion),
-		rollbackReleases: projectCompiledRollbackCatalog(compiled, appVersion),
-		schemaVersion: 1,
-		scopeKey
-	};
+var parseStorageDownloadPath = (path) => {
+	const match = /^\/storage\/([^/]+)\/([^/]+)$/.exec(path);
+	if (!match) return null;
+	const storageUri = decodeBase64Url(match[1]);
+	if (storageUri === null) return null;
+	try {
+		return {
+			signature: decodeURIComponent(match[2]),
+			storageUri
+		};
+	} catch {
+		return null;
+	}
+};
+var DatabaseConstraintError = class extends Error {
+	reason;
+	model;
+	name = "DatabaseConstraintError";
+	constructor(reason, model) {
+		super(`${model}: ${reason}`);
+		this.reason = reason;
+		this.model = model;
+	}
+};
+/** The retry budget ran out; ingestion answers 503 with Retry-After. */
+var DatabaseConflictError = class extends Error {
+	name = "DatabaseConflictError";
+};
+/** The write may or may not have committed; it is reported, never rerun. */
+var DatabaseAmbiguousCommitError = class extends Error {
+	name = "DatabaseAmbiguousCommitError";
+};
+var DatabaseTransactionError = class extends Error {
+	name = "DatabaseTransactionError";
+};
+/** A read that does not fit its model, such as an unknown index, a missing `where` field, or an out-of-range limit. */
+var DatabaseQueryError = class extends Error {
+	name = "DatabaseQueryError";
+};
+/** A malformed cursor, or one from a read with another model, index, filter, order, or range. */
+var DatabaseCursorError = class extends Error {
+	name = "DatabaseCursorError";
+};
+var REGISTER_COUNT = 1024;
+var MAX_RANK = 55;
+var OFFSET = 33;
+var decode = (summary) => {
+	if (!summary) return new Uint8Array(REGISTER_COUNT);
+	if (summary.length !== REGISTER_COUNT) throw new Error("Invalid distinct sketch");
+	const registers = new Uint8Array(REGISTER_COUNT);
+	for (let index = 0; index < REGISTER_COUNT; index += 1) {
+		const value = summary.charCodeAt(index) - OFFSET;
+		if (!Number.isInteger(value) || value < 0 || value > MAX_RANK) throw new Error("Invalid distinct sketch");
+		registers[index] = value;
+	}
+	return registers;
+};
+var encode$1 = (registers) => Array.from(registers, (value) => String.fromCharCode(value + OFFSET)).join("");
+/**
+* The union of sketches, register by register: how a plugin combines a
+* `distinct` column across the aggregate rows it reads.
+*/
+var mergeDistinct = (summaries) => {
+	const merged = new Uint8Array(REGISTER_COUNT);
+	for (const summary of summaries) {
+		const registers = decode(summary);
+		for (let index = 0; index < REGISTER_COUNT; index += 1) merged[index] = Math.max(merged[index], registers[index]);
+	}
+	return encode$1(merged);
 };
-/** The scope and range a base-candidate key names; null for any other string. */
+/** A misconfigured `createHotUpdater` call, reported at startup. */
+var HotUpdaterConfigError = class extends Error {
+	name = "HotUpdaterConfigError";
+};
+/**
+* The scope and range a base-candidate key names, null for any other
+* string: what an implementation of `findBaseBundleIds` reads the key with.
+*/
 var parseBaseCandidateKey = (key) => {
 	try {
 		const parsed = JSON.parse(key);
@@ -859,7 +904,7 @@ var parseBaseCandidateKey = (key) => {
 			scopeKey,
 			range: null
 		} : null;
-		const range = parsed.length === 2 && typeof text === "string" ? normalizeRange(text) : null;
+		const range = parsed.length === 2 && typeof text === "string" ? normalizeRange$1(text) : null;
 		return range === null ? null : {
 			scopeKey,
 			range
@@ -868,124 +913,24 @@ var parseBaseCandidateKey = (key) => {
 		return null;
 	}
 };
-/** A compiled segment as a range: its version when it holds exactly one. */
-var segmentRange = ({ lower, upper }) => lower?.inclusive && upper?.inclusive && lower.version === upper.version ? lower.version : [lower === null ? "" : `${lower.inclusive ? ">=" : ">"}${lower.version}`, upper === null ? "" : `${upper.inclusive ? "<=" : "<"}${upper.version}`].join(" ").trim() || "*";
-/**
-* Auto-patch bases from a scope's compiled Release Catalog, which holds
-* every enabled bundle release of the scope: those whose range intersects
-* `range` (all of them in a fingerprint scope), newest release first, each
-* bundle once and older than `bundleId`, at most `limit`.
-*/
-var baseBundleIdsOf = (row, range, bundleId, limit) => {
-	const catalog = parseCompiledCatalog(row.payload, row.strategy);
-	const serving = new Set(catalog.strategy === "FINGERPRINT" ? catalog.rollbackReleaseIndexes : catalog.segments.flatMap((segment) => range !== null && rangesIntersect(range, segmentRange(segment)) ? segment.rollbackReleaseIndexes : []));
-	const newestFirst = catalog.releaseDescriptors.map((descriptor, index) => ({
-		descriptor,
-		index
-	})).sort((left, right) => left.descriptor.releaseId < right.descriptor.releaseId ? 1 : -1);
-	const ids = [];
-	for (const { descriptor, index } of newestFirst) {
-		if (ids.length >= limit) break;
-		const id = descriptor.bundleId;
-		if (serving.has(index) && descriptor.kind === "BUNDLE" && id !== null && id < bundleId && !ids.includes(id)) ids.push(id);
-	}
-	return ids;
-};
-var MINUTE_MS = 6e4;
-var HOUR_MS = 60 * MINUTE_MS;
-var DAY_MS = 24 * HOUR_MS;
-/** A model's retention as its physical table carries it, which each adapter maps natively. */
-var physicalRetention = ({ retention }) => retention === void 0 ? {} : { retention: {
-	column: retention.field,
-	ms: retention.days * DAY_MS
-} };
-/** Models in a reference or a rooted index, which an expired row's delete would break. */
-var linkedModels = (schema) => Object.entries(schema).flatMap(([name, { fields, indexes }]) => [...Object.values(fields).map(({ references }) => references), ...Object.values(indexes).map(({ root }) => root)].flatMap((link) => link ? [name, link.model] : []));
-/**
-* What is wrong with a model's retention: it counts from an integer field,
-* over whole days, and expired rows are deleted without cascades, counter
-* moves, or root bumps, so the model is in no reference or rooted index.
-*/
-var retentionProblems = (schema, model) => {
-	const definition = schema[model];
-	if (definition.retention === void 0) return [];
-	const { field, days } = definition.retention;
-	const declared = definition.fields[field] ?? (definition.kind === "table" ? definition.derived[field] : void 0);
-	return [
-		...declared?.type !== "integer" || "multi" in declared && declared.multi === true ? [`retention field "${field}" is not an integer field`] : [],
-		...Number.isSafeInteger(days) && days >= 1 ? [] : ["retention days must be a whole number of at least 1"],
-		...linkedModels(schema).includes(model) ? ["a model with retention is in no reference or rooted index"] : []
-	];
-};
-/**
-* Rows a pass deletes from each table: one statement or two a table, so a
-* pass stays well inside D1's 50 queries an invocation.
-*/
-var PASS_LIMIT = 500;
-/** The lease row: when the next pass is due, in epoch ms. */
-var LEASE_KEY = "retention.nextPassAt";
-/**
-* The adapter, pruning during its writes with no scheduler: once the lease
-* row in `leaseTable` is due, the write that takes it first runs one bounded
-* pass over the tables with retention, and other writers skip. The next pass is due in an hour, or in a minute while a pass still
-* found a full batch of expired rows in some table. A backend that expires
-* rows natively, or a schema without retention, gets its adapter back.
-*/
-var pruneDuringWrites = (adapter, tables, { leaseTable: table, now }) => {
-	const expiring = tables.filter(({ retention }) => retention !== void 0);
-	if (adapter.prune === void 0 || expiring.length === 0) return adapter;
-	const key = [LEASE_KEY];
-	let checkAt = 0;
-	const lease = async (row, due) => {
-		const value = String(due);
-		const guard = { v: row === null ? -1 : Number(row._v) };
-		const next = {
-			key: LEASE_KEY,
-			value,
-			_v: guard.v + 1
-		};
-		const op = row === null ? {
-			type: "insert",
-			table,
-			row: next
-		} : {
-			type: "patch",
-			table,
-			key,
-			set: { value },
-			guard,
-			previous: row
-		};
-		return (await adapter.write([op])).ok ? next : null;
-	};
-	const pass = async () => {
-		const at = now();
-		if (at < checkAt) return;
-		checkAt = at + MINUTE_MS;
-		const [row = null] = await adapter.get(table, [key]);
-		checkAt = row === null ? at : Number(row.value);
-		if (checkAt > at) return;
-		const held = await lease(row, at + HOUR_MS);
-		if (held === null) return;
-		checkAt = at + HOUR_MS;
-		const deleted = [];
-		for (const t of expiring) deleted.push(await adapter.prune(t, at - t.retention.ms, PASS_LIMIT));
-		if (deleted.includes(PASS_LIMIT) && await lease(held, at + MINUTE_MS) !== null) checkAt = at + MINUTE_MS;
-	};
-	const warn = (error) => console.warn("[hot-updater] Pruning expired rows failed.", error);
-	return Object.assign(Object.create(adapter), { async write(ops) {
-		await pass().catch(warn);
-		return adapter.write(ops);
-	} });
-};
 var DatabaseSchemaError = class extends Error {
 	name = "DatabaseSchemaError";
 };
+/**
+* The column `name` of `table`, or a `DatabaseSchemaError`: how an adapter
+* that is neither SQL nor key-value, such as the MongoDB adapter, reads a
+* column's type.
+*/
 var findPhysicalColumn = (table, name) => {
 	const column = table.columns.find((candidate) => candidate.name === name);
 	if (column === void 0) throw new DatabaseSchemaError(`${table.name} has no column ${name}.`);
 	return column;
 };
+/**
+* The index `name` of `table`, or a `DatabaseSchemaError`: how an adapter
+* that is neither SQL nor key-value, such as the MongoDB adapter, resolves a
+* query's `index`.
+*/
 var findPhysicalIndex = (table, name) => {
 	const index = table.indexes.find((candidate) => candidate.name === name);
 	if (index === void 0) throw new DatabaseSchemaError(`${table.name} has no index ${name}.`);
@@ -996,40 +941,24 @@ var findPhysicalIndex = (table, name) => {
 * columns, then the key columns that neither `eq` nor `sort` fixes.
 */
 var indexOrderColumns = (table, index) => [...index.sort, ...table.key.filter((column) => !index.sort.includes(column) && !index.eq.includes(column))];
-/** The primary key of a row, in key-column order. */
+/**
+* The primary key of a row, in key-column order: what `get` takes for it.
+* An adapter that is neither SQL nor key-value, such as the MongoDB adapter,
+* addresses rows by it.
+*/
 var rowKey = (table, row) => table.key.map((column) => {
 	const value = row[column];
 	if (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean") throw new DatabaseSchemaError(`${table.name}.${column} is a key column and must be a string, number, or boolean.`);
 	return value;
 });
-var REGISTER_COUNT = 1024;
-var MAX_RANK = 55;
-var OFFSET = 33;
-var decode = (summary) => {
-	if (!summary) return new Uint8Array(REGISTER_COUNT);
-	if (summary.length !== REGISTER_COUNT) throw new Error("Invalid distinct sketch");
-	const registers = new Uint8Array(REGISTER_COUNT);
-	for (let index = 0; index < REGISTER_COUNT; index += 1) {
-		const value = summary.charCodeAt(index) - OFFSET;
-		if (!Number.isInteger(value) || value < 0 || value > MAX_RANK) throw new Error("Invalid distinct sketch");
-		registers[index] = value;
-	}
-	return registers;
-};
-var encode$1 = (registers) => Array.from(registers, (value) => String.fromCharCode(value + OFFSET)).join("");
-/** The union of sketches, register by register. */
-var mergeDistinct = (summaries) => {
-	const merged = new Uint8Array(REGISTER_COUNT);
-	for (const summary of summaries) {
-		const registers = decode(summary);
-		for (let index = 0; index < REGISTER_COUNT; index += 1) merged[index] = Math.max(merged[index], registers[index]);
-	}
-	return encode$1(merged);
-};
 var DatabaseValueError = class extends Error {
 	name = "DatabaseValueError";
 };
-/** Compares strings in UTF-8 byte order, which is Unicode code point order. */
+/**
+* Compares strings in UTF-8 byte order, which is Unicode code point order:
+* the order the engine sorts string keys in. A plugin that merges rows from
+* several reads, as Insights does, keeps that order with it.
+*/
 var compareUtf8 = (left, right) => {
 	let leftIndex = 0;
 	let rightIndex = 0;
@@ -1087,8 +1016,111 @@ var satisfiesBound = (tuple, bound, side) => {
 };
 /** Whether a stored row belongs to the result range of a query. */
 var matchesQuery = (table, index, request, row) => indexEntries(table, index, row).some((entry) => compareTuples(entry, request.eq) === 0) && satisfiesBound(indexOrderTuple(table, index, row), request.lower, "lower") && satisfiesBound(indexOrderTuple(table, index, row), request.upper, "upper");
-var DatabaseAdapterContractError = class extends Error {
-	name = "DatabaseAdapterContractError";
+var keyId = (key) => JSON.stringify(key);
+var numberOf = (value) => typeof value === "number" ? value : 0;
+var violatesUnique = (table, rows, id, row) => table.indexes.some((index) => {
+	if (!index.unique) return false;
+	const entries = indexEntries(table, index, row);
+	return entries.length > 0 && [...rows].some(([otherId, other]) => otherId !== id && indexEntries(table, index, other).some((entry) => entries.some((candidate) => compareTuples(entry, candidate) === 0)));
+});
+var putRow = (table, rows, id, row) => {
+	if (violatesUnique(table, rows, id, row)) return false;
+	rows.set(id, row);
+	return true;
+};
+/** Applies one op to a draft; false means its guard or a constraint failed. */
+var applyOp = (rows, op) => {
+	const id = keyId(op.type === "insert" ? rowKey(op.table, op.row) : op.key);
+	const current = rows.get(id);
+	const version = numberOf(current?.["_v"]);
+	switch (op.type) {
+		case "insert": return current === void 0 && putRow(op.table, rows, id, structuredClone(op.row));
+		case "patch": return current !== void 0 && version === op.guard.v && putRow(op.table, rows, id, {
+			...current,
+			...structuredClone(op.set),
+			["_v"]: version + 1
+		});
+		case "delete": return current !== void 0 && version === op.guard.v && rows.delete(id);
+		case "increment": {
+			const base = current ?? op.init;
+			if (base === void 0 || op.guard !== void 0 && (current === void 0 || version !== op.guard.v)) return false;
+			const next = structuredClone(base);
+			for (const [column, delta] of Object.entries(op.by)) next[column] = numberOf(base[column]) + delta;
+			next["_v"] = numberOf(base["_v"]) + 1;
+			return putRow(op.table, rows, id, next);
+		}
+		case "check": return current !== void 0 && version === op.guard.v;
+	}
+};
+/**
+* The reference adapter: every read is a consistent snapshot and every write
+* applies to a copy that replaces the state only when all ops succeed.
+*/
+var createMemoryAdapter = (options = {}) => {
+	const prefix = options.tablePrefix ?? "";
+	let state = /* @__PURE__ */ new Map();
+	const rowsOf = (table) => state.get(prefix + table.name) ?? /* @__PURE__ */ new Map();
+	return {
+		id: "memory",
+		fits: () => true,
+		async get(table, keys) {
+			const rows = rowsOf(table);
+			return keys.map((key) => {
+				const row = rows.get(keyId(key));
+				return row === void 0 ? null : structuredClone(row);
+			});
+		},
+		async query(table, request) {
+			const index = findPhysicalIndex(table, request.index);
+			const direction = request.order === "asc" ? 1 : -1;
+			return [...rowsOf(table).values()].filter((row) => matchesQuery(table, index, request, row)).sort((left, right) => direction * compareTuples(indexOrderTuple(table, index, left), indexOrderTuple(table, index, right))).slice(0, request.limit).map((row) => structuredClone(row));
+		},
+		async write(ops) {
+			const draft = new Map(state);
+			const copied = /* @__PURE__ */ new Set();
+			for (const [position, op] of ops.entries()) {
+				const name = prefix + op.table.name;
+				if (!copied.has(name)) {
+					draft.set(name, new Map(draft.get(name)));
+					copied.add(name);
+				}
+				if (!applyOp(draft.get(name), op)) return {
+					ok: false,
+					failedOp: position
+				};
+			}
+			state = draft;
+			return { ok: true };
+		},
+		async prune(table, before, limit) {
+			const column = table.retention?.column ?? "";
+			/** Oldest first; the key breaks a tie. */
+			const order = (row) => [row[column], ...rowKey(table, row)];
+			const doomed = [...rowsOf(table)].filter(([, row]) => {
+				const time = row[column];
+				return typeof time === "number" && time <= before;
+			}).sort(([, left], [, right]) => compareTuples(order(left), order(right))).slice(0, limit);
+			const rows = new Map(rowsOf(table));
+			for (const [id] of doomed) rows.delete(id);
+			state = new Map(state).set(prefix + table.name, rows);
+			return doomed.length;
+		},
+		migrations: { async apply(tables) {
+			const next = new Map(state);
+			for (const table of tables) {
+				const name = prefix + table.name;
+				next.set(name, next.get(name) ?? /* @__PURE__ */ new Map());
+			}
+			state = next;
+		} },
+		async dispose() {
+			state = /* @__PURE__ */ new Map();
+		}
+	};
+};
+/** What `verifyAdapter` throws when an adapter call breaks the adapter contract. */
+var DatabaseAdapterContractError = class extends Error {
+	name = "DatabaseAdapterContractError";
 };
 var EMPTY = {
 	gets: 0,
@@ -1121,43 +1153,43 @@ var createReadMeter = () => {
 		}
 	};
 };
-var fail$1 = (message) => {
+var fail$2 = (message) => {
 	throw new DatabaseAdapterContractError(message);
 };
 var sameKey = (left, right) => left.length === right.length && compareTuples(left, right) === 0;
 var verifyRequest = (table, request) => {
 	const index = findPhysicalIndex(table, request.index);
-	if (!Number.isSafeInteger(request.limit) || request.limit < 1 || request.limit > 500) fail$1(`query limit must be 1–500.`);
-	if (request.eq.length !== index.eq.length || !request.eq.every(isKeyValue)) fail$1(`query on ${table.name}.${index.name} must bind every eq column.`);
+	if (!Number.isSafeInteger(request.limit) || request.limit < 1 || request.limit > 500) fail$2(`query limit must be 1–500.`);
+	if (request.eq.length !== index.eq.length || !request.eq.every(isKeyValue)) fail$2(`query on ${table.name}.${index.name} must bind every eq column.`);
 	return index;
 };
 var verifyRows = (table, request, rows) => {
 	const index = findPhysicalIndex(table, request.index);
-	if (rows.length > request.limit) fail$1(`${table.name}.${index.name} returned more than ${request.limit} rows.`);
+	if (rows.length > request.limit) fail$2(`${table.name}.${index.name} returned more than ${request.limit} rows.`);
 	let previous;
 	for (const row of rows) {
-		if (!matchesQuery(table, index, request, row)) fail$1(`${table.name}.${index.name} returned a row outside the request.`);
+		if (!matchesQuery(table, index, request, row)) fail$2(`${table.name}.${index.name} returned a row outside the request.`);
 		const tuple = indexOrderTuple(table, index, row);
 		if (previous !== void 0) {
 			const order = compareTuples(previous, tuple);
-			if (request.order === "asc" ? order >= 0 : order <= 0) fail$1(`${table.name}.${index.name} returned rows out of order.`);
+			if (request.order === "asc" ? order >= 0 : order <= 0) fail$2(`${table.name}.${index.name} returned rows out of order.`);
 		}
 		previous = tuple;
 	}
 	return previous;
 };
 var verifyWrite = (adapter, ops) => {
-	if (ops.length === 0) fail$1("write needs at least one op.");
+	if (ops.length === 0) fail$2("write needs at least one op.");
 	const seen = /* @__PURE__ */ new Set();
 	for (const op of ops) {
 		const key = op.type === "insert" ? rowKey(op.table, op.row) : op.key;
 		const id = JSON.stringify([op.table.name, key]);
-		if (seen.has(id)) fail$1(`write touches ${op.table.name} ${id} twice.`);
+		if (seen.has(id)) fail$2(`write touches ${op.table.name} ${id} twice.`);
 		seen.add(id);
-		if (op.type === "insert" && typeof op.row["_v"] !== "number") fail$1(`insert into ${op.table.name} must set _v.`);
-		if (op.type === "patch" && Object.keys(op.set).some((column) => column === "_v" || op.table.key.includes(column))) fail$1(`patch of ${op.table.name} may not set key columns or _v.`);
+		if (op.type === "insert" && typeof op.row["_v"] !== "number") fail$2(`insert into ${op.table.name} must set _v.`);
+		if (op.type === "patch" && Object.keys(op.set).some((column) => column === "_v" || op.table.key.includes(column))) fail$2(`patch of ${op.table.name} may not set key columns or _v.`);
 	}
-	if (!adapter.fits(ops)) fail$1("write does not fit in one atomic write.");
+	if (!adapter.fits(ops)) fail$2("write does not fit in one atomic write.");
 };
 /** Wraps an adapter to check the contract at its boundary and count reads. */
 var verifyAdapter = (adapter, options = {}) => {
@@ -1173,9 +1205,9 @@ var verifyAdapter = (adapter, options = {}) => {
 				gets: 1,
 				keys: keys.length
 			});
-			if (rows.length !== keys.length) fail$1(`${table.name} get returned ${rows.length} rows for ${keys.length} keys.`);
+			if (rows.length !== keys.length) fail$2(`${table.name} get returned ${rows.length} rows for ${keys.length} keys.`);
 			rows.forEach((row, position) => {
-				if (row !== null && !sameKey(rowKey(table, row), keys[position])) fail$1(`${table.name} get returned a row for another key.`);
+				if (row !== null && !sameKey(rowKey(table, row), keys[position])) fail$2(`${table.name} get returned a row for another key.`);
 			});
 			return rows;
 		},
@@ -1196,242 +1228,447 @@ var verifyAdapter = (adapter, options = {}) => {
 					...request,
 					limit: 1,
 					...request.order === "asc" ? { lower: bound } : { upper: bound }
-				})).length > 0) fail$1(`${table.name}.${index.name} returned a short page before the range ended.`);
+				})).length > 0) fail$2(`${table.name}.${index.name} returned a short page before the range ended.`);
 			}
 			return rows;
 		},
 		...adapter.prune && { async prune(table, before, limit) {
-			if (table.retention === void 0) fail$1(`${table.name} has no retention to prune by.`);
-			if (!Number.isSafeInteger(limit) || limit < 1) fail$1("prune limit must be a positive integer.");
+			if (table.retention === void 0) fail$2(`${table.name} has no retention to prune by.`);
+			if (!Number.isSafeInteger(limit) || limit < 1) fail$2("prune limit must be a positive integer.");
 			const deleted = await adapter.prune(table, before, limit);
-			if (!Number.isSafeInteger(deleted) || deleted < 0 || deleted > limit) fail$1(`${table.name} prune reported ${deleted} rows for ${limit}.`);
+			if (!Number.isSafeInteger(deleted) || deleted < 0 || deleted > limit) fail$2(`${table.name} prune reported ${deleted} rows for ${limit}.`);
 			return deleted;
 		} },
 		async write(ops) {
 			verifyWrite(adapter, ops);
 			const result = await adapter.write(ops);
 			if (!result.ok && "failedOp" in result) {
-				if (!Number.isSafeInteger(result.failedOp) || result.failedOp < 0 || result.failedOp >= ops.length) fail$1(`write reported failedOp ${result.failedOp} for ${ops.length} ops.`);
+				if (!Number.isSafeInteger(result.failedOp) || result.failedOp < 0 || result.failedOp >= ops.length) fail$2(`write reported failedOp ${result.failedOp} for ${ops.length} ops.`);
 			}
 			return result;
 		}
 	};
 };
-var SHARD_COLUMN = "_shard";
-var NAME = /^[a-z][a-z0-9_]*$/u;
-var INDEX_NAME = /^[A-Za-z][A-Za-z0-9_]*$/u;
-var tableName = (module, model) => module.namespace ? `${module.namespace}_${model}` : model;
-var integer = (name, defaulted = false) => ({
-	name,
-	type: "integer",
-	nullable: false,
-	...defaulted ? { default: 0 } : {}
-});
-/** A declared or derived field's type, and whether it holds several values. */
-var fieldType = (model, name) => {
-	const field = model.fields[name] ?? (model.kind === "table" ? model.derived[name] : void 0);
-	return field && {
-		type: field.type,
-		multi: "multi" in field && !!field.multi
-	};
-};
-var metricsOf$1 = (model) => [
-	...model.counters,
-	...model.gauges,
-	...model.distinct
-];
-/** Field names, the key, and each field's options. */
-var fieldProblems = (definition, add) => {
-	const names = [...Object.keys(definition.fields), ...definition.kind === "table" ? Object.keys(definition.derived) : metricsOf$1(definition)];
-	for (const name of new Set(names)) {
-		if (!NAME.test(name)) add(`field "${name}" must match ${NAME.source}`);
-		if (names.indexOf(name) !== names.lastIndexOf(name)) add(`field "${name}" is declared twice`);
-	}
-	const { key } = definition;
-	if (key.length === 0) add("key is empty");
-	if (new Set(key).size !== key.length) add("key repeats a field");
-	for (const name of key) {
-		const field = definition.fields[name];
-		if (field === void 0) add(`key field "${name}" is not a declared field`);
-		else if (field.required === false) add(`key field "${name}" is nullable`);
-		else if (field.type === "json") add(`key field "${name}" is json`);
-	}
-	for (const [name, { type, maxLength, ascii }] of Object.entries(definition.fields)) {
-		if (maxLength !== void 0 && (type !== "string" || !Number.isSafeInteger(maxLength) || maxLength < 1)) add(`field "${name}" has an invalid maxLength`);
-		if (ascii && type !== "string") add(`field "${name}" is ascii but not a string`);
-	}
+/**
+* The settings rows migrations write, last, and the fence reads; retention
+* passes keep their lease here too. Tooling that creates the tables creates
+* this one with them: an ORM's schema generator, a provider's setup, and an
+* access policy that names the tables a server reads.
+*/
+var SETTINGS_TABLE = {
+	name: "private_hot_updater_settings",
+	columns: [
+		{
+			name: "key",
+			type: "string",
+			nullable: false,
+			maxLength: 255
+		},
+		{
+			name: "value",
+			type: "string",
+			nullable: false,
+			maxLength: 255
+		},
+		{
+			name: "_v",
+			type: "integer",
+			nullable: false,
+			default: 0
+		}
+	],
+	key: ["key"],
+	indexes: []
 };
-/** A table's derived fields and references. */
-var tableProblems = (definition, add, table) => {
-	for (const [name, derived] of Object.entries(definition.derived)) {
-		if (typeof derived.compute !== "function") add(`derived field "${name}" has no compute function`);
-		if (derived.multi && derived.type === "json") add(`derived field "${name}" cannot be multi-valued json`);
-	}
-	for (const [name, { type, references }] of Object.entries(definition.fields)) {
-		if (references === void 0) continue;
-		const target = table(references.model);
-		const targetKey = target?.key.length === 1 ? target.fields[target.key[0]] : void 0;
-		if (targetKey === void 0) add(`field "${name}" references "${references.model}", which is not a single-key table of this module`);
-		else if (targetKey.type !== type) add(`field "${name}" and the key of "${references.model}" differ in type`);
-		if (references.onDelete === "cascade" && !Object.values(definition.indexes).some(({ eq }) => eq.length === 1 && eq[0] === name)) add(`cascade on "${name}" needs an index whose eq is exactly [${name}]`);
+/** The engine's storage-layout generation; it changes only with a migration. */
+var ENGINE_SCHEMA_KEY = "schema.engine";
+var CORE_SCHEMA_KEY = "schema.core";
+var stored = ({ key, expected, found }) => `"${key}" is ${found === null ? "missing" : `"${found}"`}; expected "${expected}"`;
+var settingMessage = (adapterName, { key, expected, found }) => `Hot Updater schema setting "${key}" for ${adapterName} is ${found === null ? "missing" : `"${found}"`}; expected "${expected}". ${key === "schema.engine" ? "Create a new empty database and run `hot-updater db migrate`; databases from before the storage engine are not converted." : "Run `hot-updater db migrate`."}`;
+/** The plugin a `schema.<id>` setting belongs to; undefined for core's and the engine's. */
+var pluginOf = ({ key }) => key.startsWith("schema.") && key !== "schema.engine" && key !== CORE_SCHEMA_KEY ? key.slice(7) : void 0;
+var listed = (items) => items.length < 2 ? items.join("") : `${items.slice(0, -1).join(", ")} and ${items.at(-1)}`;
+/** How to create plugins' tables when the fence was given no fix. */
+var PLUGIN_TABLES_FIX = "Run `hot-updater db migrate`. A managed server runs only its provider's plugins, and rerunning `hot-updater init --provider <provider>` applies the provider's migrations. Run `hot-updater db` commands in the server's project: they load the server file named on the command line, or src/hotUpdater.* or src/db.*, and don't read hot-updater.config.ts.";
+var pluginsMessage = (adapterName, plugins, settings, fix) => `The tables of ${plugins.length === 1 ? "plugin" : "plugins"} ${listed(plugins.map((id) => `"${id}"`))} are not migrated on ${adapterName}: schema ${settings.length === 1 ? "setting" : "settings"} ${settings.map(stored).join(", and ")}. ${fix}`;
+/** The database needs `hot-updater db migrate`, or a new database; the handler answers 503. */
+var HotUpdaterSchemaMigrationRequiredError = class extends Error {
+	adapterName;
+	currentVersion;
+	setting;
+	/** Every setting the fence found missing or different; `setting` is the first. */
+	settings;
+	/**
+	* The ids of the plugins whose `schema.<id>` setting is among them: the
+	* plugins whose tables a migration has yet to create or change.
+	*/
+	plugins;
+	constructor(adapterName, currentVersion, setting, options) {
+		const settings = options?.settings ?? (setting === void 0 ? [] : [setting]);
+		const plugins = settings.flatMap((mismatch) => pluginOf(mismatch) ?? []);
+		super(setting === void 0 ? currentVersion === void 0 ? `Hot Updater database schema is not initialized for ${adapterName}. Run \`hot-updater db migrate\` before using this adapter.` : `Hot Updater v1 cannot migrate schema ${currentVersion} in place. Create a new empty database and run \`hot-updater db migrate\`.` : plugins.length > 0 && plugins.length === settings.length ? pluginsMessage(adapterName, plugins, settings, options?.fix ?? PLUGIN_TABLES_FIX) : settingMessage(adapterName, setting), options?.cause === void 0 ? void 0 : { cause: options.cause });
+		this.adapterName = adapterName;
+		this.currentVersion = currentVersion;
+		this.setting = setting;
+		this.name = "HotUpdaterSchemaMigrationRequiredError";
+		this.settings = settings;
+		this.plugins = plugins;
 	}
 };
-/** An aggregate's identity, metrics, and shards. */
-var aggregateProblems = (definition, add) => {
-	const identity = Object.keys(definition.fields);
-	if (definition.key.join("\0") !== identity.join("\0")) add(`key must list the identity fields in declaration order: ${identity.join(", ")}`);
-	if (metricsOf$1(definition).length === 0) add("aggregate has no metrics");
-	if (definition.distinct.length > 0 && definition.counters.length + definition.gauges.length > 0) add("distinct sketches need an aggregate of their own");
-	const { shards } = definition;
-	if (!Number.isSafeInteger(shards) || shards < 1 || shards > 64) add(`shards must be 1–64`);
-};
-/** Every problem in one model's declaration, its roots and references included. */
-var problemsOf = (module, model, definition) => {
-	const problems = [];
-	const add = (message) => problems.push(`${module.id}.${model}: ${message}`);
-	const table = (name) => {
-		const target = module.schema[name];
-		return target?.kind === "table" ? target : void 0;
-	};
-	if (!NAME.test(model)) add("model names use lowercase letters, digits, and _");
-	fieldProblems(definition, add);
-	for (const [name, index] of Object.entries(definition.indexes)) {
-		const columns = [...index.eq, ...index.sort];
-		if (!INDEX_NAME.test(name)) add(`index "${name}" must match ${INDEX_NAME.source}`);
-		if (columns.length === 0) add(`index "${name}" has no fields`);
-		if (index.unique && index.sort.length > 0) add(`unique index "${name}" cannot sort`);
-		if (columns.filter((column) => {
-			const type = fieldType(definition, column);
-			if (type === void 0) add(`index "${name}" names undeclared field "${column}"`);
-			else if (type.type === "json") add(`index "${name}" names json field "${column}"`);
-			else if (type.multi && index.sort.includes(column)) add(`index "${name}" sorts by multi-valued field "${column}"`);
-			return type?.type !== "json" && type?.multi;
-		}).length > 1) add(`index "${name}" has more than one multi-valued field`);
-		if (index.root === void 0) continue;
-		const root = table(index.root.model);
-		if (root === void 0) add(`index "${name}" is rooted at unknown table "${index.root.model}"`);
-		else if (root.key.length > index.eq.length || root.key.some((field, position) => fieldType(definition, index.eq[position])?.type !== root.fields[field].type)) add(`index "${name}" eq must start with the key of "${index.root.model}"`);
+/** Driver codes for a table or column the database lacks. */
+var MISSING_SCHEMA_CODES = /* @__PURE__ */ new Set([
+	"42P01",
+	"42703",
+	"ER_NO_SUCH_TABLE",
+	"ER_BAD_FIELD_ERROR"
+]);
+var MISSING_SCHEMA_MESSAGE = /no such (?:table|column)|(?:relation|column) .+ does not exist|table .+ doesn't exist|unknown column/iu;
+/**
+* Whether a read failed because a table or column is missing, so the
+* database needs migrations. ORMs may wrap the driver's error in `cause`.
+*/
+var isMissingSchemaError = (error) => {
+	for (let depth = 0; error instanceof Object && depth < 8; depth += 1) {
+		const { code, message, cause } = error;
+		if (MISSING_SCHEMA_CODES.has(String(code)) || typeof message === "string" && MISSING_SCHEMA_MESSAGE.test(message)) return true;
+		error = cause;
 	}
-	if (definition.kind === "table") tableProblems(definition, add, table);
-	else aggregateProblems(definition, add);
-	for (const problem of retentionProblems(module.schema, model)) add(problem);
-	return problems;
+	return false;
 };
-/** Rejects invalid module schemas at startup, listing every problem. */
-var validateSchema = (modules) => {
-	const problems = [];
-	const owners = /* @__PURE__ */ new Map();
-	for (const module of modules) for (const [model, definition] of Object.entries(module.schema)) {
-		const name = tableName(module, model);
-		const owner = owners.get(name);
-		if (owner !== void 0) problems.push(`${module.id}.${model}: table "${name}" is also declared by ${owner}`);
-		owners.set(name, `${module.id}.${model}`);
-		problems.push(...problemsOf(module, model, definition));
+var readSettings = (adapter, keys) => adapter.get(SETTINGS_TABLE, keys.map((key) => [key]));
+/**
+* Throws unless every expected setting is stored with its value: one batch
+* read. The error lists every setting missing or different; `fix` says how
+* to create the plugins' tables on this database.
+*/
+var checkSchemaFence = async (adapter, adapterName, expected, fix) => {
+	const keys = Object.keys(expected);
+	let rows;
+	try {
+		rows = await readSettings(adapter, keys);
+	} catch (cause) {
+		if (!isMissingSchemaError(cause)) throw cause;
+		throw new HotUpdaterSchemaMigrationRequiredError(adapterName, void 0, {
+			key: ENGINE_SCHEMA_KEY,
+			expected: "1",
+			found: null
+		}, { cause });
 	}
-	if (problems.length > 0) throw new DatabaseSchemaError(`Invalid database schema:\n- ${problems.join("\n- ")}`);
+	const settings = keys.flatMap((key, position) => {
+		const found = rows[position]?.value;
+		return found === expected[key] ? [] : [{
+			key,
+			expected: expected[key],
+			found: typeof found === "string" ? found : null
+		}];
+	});
+	const [first] = settings;
+	if (first !== void 0) throw new HotUpdaterSchemaMigrationRequiredError(adapterName, void 0, first, {
+		settings,
+		...fix === void 0 ? {} : { fix }
+	});
 };
-var indexesOf = (definition) => [...Object.entries(definition.indexes).map(([name, index]) => ({
-	name,
-	eq: [...index.eq],
-	sort: [...index.sort],
-	...index.unique ? { unique: true } : {}
-})), ...Object.entries(definition.fields).flatMap(([name, field]) => field.unique ? [{
-	name,
-	eq: [name],
-	sort: [],
-	unique: true
-}] : [])];
-/** Validates the modules, then resolves them into physical tables with engine columns. */
-var resolveSchema = (modules) => {
-	validateSchema(modules);
-	const references = [];
-	for (const module of modules) for (const [model, definition] of Object.entries(module.schema)) {
-		if (definition.kind !== "table") continue;
-		const table = tableName(module, model);
-		for (const [field, { references: to }] of Object.entries(definition.fields)) {
-			if (to === void 0) continue;
-			const { onDelete } = to;
-			const target = tableName(module, to.model);
-			const counter = onDelete === "none" ? {} : { counter: `_refs_${table}_${field}` };
-			references.push({
-				table,
-				field,
-				target,
-				onDelete,
-				...counter
-			});
-		}
-	}
-	const models = /* @__PURE__ */ new Map();
-	for (const module of modules) for (const [model, definition] of Object.entries(module.schema)) {
-		const name = tableName(module, model);
-		const referencedBy = references.filter(({ target }) => target === name);
-		const columns = Object.entries(definition.fields).map(([field, { type, required, maxLength, ascii }]) => ({
-			name: field,
-			type,
-			nullable: required === false,
-			...maxLength === void 0 ? {} : { maxLength },
-			...ascii ? { ascii } : {}
-		}));
-		if (definition.kind === "table") for (const [field, { type, multi }] of Object.entries(definition.derived)) columns.push({
-			name: field,
-			type,
-			nullable: true,
-			...multi ? { multi } : {}
-		});
-		else columns.push(integer(SHARD_COLUMN), ...[...definition.counters, ...definition.gauges].map((metric) => integer(metric)), ...definition.distinct.map((metric) => ({
-			name: metric,
-			type: "string",
-			nullable: true
-		})));
-		for (const { counter } of referencedBy) if (counter !== void 0) columns.push(integer(counter, true));
-		columns.push(integer("_v", true));
-		models.set(name, {
-			module: module.id,
-			model,
-			definition,
-			table: {
-				name,
-				columns,
-				key: definition.kind === "aggregate" ? [...definition.key, SHARD_COLUMN] : [...definition.key],
-				indexes: indexesOf(definition),
-				...physicalRetention(definition)
-			},
-			references: references.filter(({ table }) => table === name),
-			referencedBy,
-			roots: new Map(Object.entries(definition.indexes).flatMap(([index, { root }]) => root === void 0 ? [] : [[index, tableName(module, root.model)]]))
+/** The database name a fenced adapter carries, so a server can fence its plugins' rows too. */
+var FENCED = Symbol.for("@hot-updater/server/schema-fence");
+/** The database name an adapter behind the schema fence reports under. */
+var fencedName = (adapter) => adapter[FENCED];
+/**
+* The adapter behind the schema fence: a process's first read or write
+* checks the settings first. Success is kept; a failure is checked again on
+* the next call.
+*/
+var withSchemaFence = (adapter, adapterName, expected, fix) => {
+	let ready;
+	const fence = () => {
+		ready ??= checkSchemaFence(adapter, adapterName, expected, fix).catch((error) => {
+			ready = void 0;
+			throw error;
 		});
-	}
+		return ready;
+	};
 	return {
-		models,
-		tables: [...models.values()].map(({ table }) => table)
+		...adapter,
+		[FENCED]: adapterName,
+		get: (table, keys) => fence().then(() => adapter.get(table, keys)),
+		query: (table, request) => fence().then(() => adapter.query(table, request)),
+		write: (ops) => fence().then(() => adapter.write(ops)),
+		...adapter.prune && { prune: (table, before, limit) => fence().then(() => adapter.prune(table, before, limit)) }
 	};
 };
-var DatabaseConstraintError = class extends Error {
-	reason;
-	model;
-	name = "DatabaseConstraintError";
-	constructor(reason, model) {
-		super(`${model}: ${reason}`);
-		this.reason = reason;
-		this.model = model;
-	}
-};
-/** The retry budget ran out; ingestion answers 503 with Retry-After. */
-var DatabaseConflictError = class extends Error {
-	name = "DatabaseConflictError";
-};
-/** The write may or may not have committed; it is reported, never rerun. */
-var DatabaseAmbiguousCommitError = class extends Error {
-	name = "DatabaseAmbiguousCommitError";
-};
-var DatabaseTransactionError = class extends Error {
-	name = "DatabaseTransactionError";
-};
-var DatabaseCursorError = class extends Error {
-	name = "DatabaseCursorError";
+var METER = Symbol.for("@hot-updater/plugin-core/read-meter");
+/** The meter `meterReads` gave `database`, if it did. */
+var readMeterOf = (database) => typeof database === "object" && database !== null ? database[METER] : void 0;
+/** A channel's id is `channel:` and its name's channel key, so ids share channel_key's bound. */
+var CHANNEL_ID = {
+	type: "string",
+	maxLength: 1408,
+	ascii: true
 };
-var encoder = new TextEncoder();
+/** Core's module: always installed, never a plugin. */
+var coreModule = {
+	id: "core",
+	schema: {
+		bundles: defineTable({
+			id: {
+				type: "string",
+				maxLength: 36
+			},
+			platform: {
+				type: "string",
+				maxLength: 16
+			},
+			git_commit_hash: {
+				type: "string",
+				maxLength: 255,
+				required: false
+			},
+			metadata: { type: "json" },
+			manifest_storage_uri: { type: "string" },
+			manifest_file_hash: { type: "string" },
+			asset_base_storage_uri: { type: "string" }
+		}, {
+			key: ["id"],
+			indexes: {
+				byPlatform: {
+					eq: ["platform"],
+					sort: ["id"]
+				},
+				all: {
+					eq: [],
+					sort: ["id"]
+				}
+			}
+		}),
+		bundle_patches: defineTable({
+			id: {
+				type: "string",
+				maxLength: 255
+			},
+			bundle_id: {
+				type: "string",
+				maxLength: 36,
+				references: {
+					model: "bundles",
+					onDelete: "cascade"
+				}
+			},
+			base_bundle_id: {
+				type: "string",
+				maxLength: 36,
+				references: {
+					model: "bundles",
+					onDelete: "cascade"
+				}
+			},
+			base_file_hash: { type: "string" },
+			patch_file_hash: { type: "string" },
+			patch_storage_uri: { type: "string" },
+			byte_size: { type: "integer" },
+			order_index: { type: "integer" }
+		}, {
+			key: ["id"],
+			indexes: {
+				pair: {
+					eq: ["bundle_id", "base_bundle_id"],
+					sort: [],
+					unique: true
+				},
+				byBundle: {
+					eq: ["bundle_id"],
+					sort: ["order_index"],
+					root: { model: "bundles" }
+				},
+				byBase: {
+					eq: ["base_bundle_id"],
+					sort: ["bundle_id"]
+				}
+			}
+		}),
+		releases: defineTable({
+			id: {
+				type: "string",
+				maxLength: 36
+			},
+			revision: { type: "integer" },
+			scope_key: {
+				type: "string",
+				maxLength: 2048,
+				ascii: true
+			},
+			channel_id: {
+				...CHANNEL_ID,
+				references: {
+					model: "channels",
+					onDelete: "restrict"
+				}
+			},
+			platform: {
+				type: "string",
+				maxLength: 16
+			},
+			kind: {
+				type: "string",
+				maxLength: 16
+			},
+			bundle_id: {
+				type: "string",
+				maxLength: 36,
+				required: false,
+				references: {
+					model: "bundles",
+					onDelete: "restrict"
+				}
+			},
+			strategy: {
+				type: "string",
+				maxLength: 16
+			},
+			target_app_version: {
+				type: "string",
+				required: false
+			},
+			fingerprint_hash: {
+				type: "string",
+				maxLength: 255,
+				required: false
+			},
+			enabled: { type: "boolean" },
+			should_force_update: { type: "boolean" },
+			message: {
+				type: "string",
+				required: false
+			},
+			rollout_cohort_count: { type: "integer" },
+			target_cohorts: { type: "json" },
+			operation: {
+				type: "string",
+				maxLength: 16
+			},
+			source_release_id: {
+				type: "string",
+				maxLength: 36,
+				required: false,
+				references: {
+					model: "releases",
+					onDelete: "none"
+				}
+			},
+			created_at_ms: { type: "integer" },
+			updated_at_ms: { type: "integer" }
+		}, {
+			key: ["id"],
+			indexes: {
+				byScope: {
+					eq: ["scope_key"],
+					sort: ["id"],
+					root: { model: "release_catalogs" }
+				},
+				byScopeEnabled: {
+					eq: ["scope_key", "enabled"],
+					sort: ["id"],
+					root: { model: "release_catalogs" }
+				},
+				byChannelPlatform: {
+					eq: ["channel_id", "platform"],
+					sort: ["id"]
+				},
+				byChannelPlatformEnabled: {
+					eq: [
+						"channel_id",
+						"platform",
+						"enabled"
+					],
+					sort: ["id"]
+				},
+				byBundle: {
+					eq: ["bundle_id"],
+					sort: ["id"]
+				},
+				all: {
+					eq: [],
+					sort: ["id"]
+				}
+			}
+		}),
+		release_catalogs: defineTable({
+			scope_key: {
+				type: "string",
+				maxLength: 2048,
+				ascii: true
+			},
+			catalog_id: {
+				type: "string",
+				maxLength: 255
+			},
+			strategy: {
+				type: "string",
+				maxLength: 16
+			},
+			channel_id: {
+				...CHANNEL_ID,
+				references: {
+					model: "channels",
+					onDelete: "none"
+				}
+			},
+			channel_key: {
+				type: "string",
+				maxLength: 1400,
+				ascii: true
+			},
+			platform: {
+				type: "string",
+				maxLength: 16
+			},
+			fingerprint_hash: {
+				type: "string",
+				maxLength: 255,
+				required: false
+			},
+			generation: { type: "integer" },
+			payload: { type: "string" },
+			catalog_hash: {
+				type: "string",
+				maxLength: 71
+			},
+			byte_size: { type: "integer" },
+			is_tombstone: { type: "boolean" },
+			updated_at_ms: { type: "integer" }
+		}, {
+			key: ["scope_key"],
+			indexes: { all: {
+				eq: [],
+				sort: ["scope_key"]
+			} }
+		}),
+		channels: defineTable({
+			id: CHANNEL_ID,
+			name: {
+				type: "string",
+				maxLength: 255,
+				unique: true
+			}
+		}, {
+			key: ["id"],
+			indexes: { all: {
+				eq: [],
+				sort: ["name"]
+			} }
+		}),
+		bundle_totals: defineAggregate({ platform_key: {
+			type: "string",
+			maxLength: 16
+		} }, {
+			key: ["platform_key"],
+			counters: ["bundles"],
+			indexes: { byPlatform: {
+				eq: ["platform_key"],
+				sort: []
+			} }
+		})
+	}
+};
+var encoder = new TextEncoder();
 var decoder = new TextDecoder();
 var toBase64Url = (text) => {
 	let binary = "";
@@ -1573,26 +1810,6 @@ var compileAggregates = async (adapter, changes) => {
 	}));
 	return ops;
 };
-var defineTable = (fields, options) => ({
-	kind: "table",
-	fields,
-	key: options.key,
-	derived: options.derived ?? {},
-	indexes: options.indexes ?? {},
-	...options.retention === void 0 ? {} : { retention: options.retention }
-});
-var defineAggregate = (fields, options) => ({
-	kind: "aggregate",
-	fields,
-	key: options.key,
-	counters: options.counters ?? [],
-	gauges: options.gauges ?? [],
-	distinct: options.distinct ?? [],
-	shards: options.shards ?? 1,
-	indexes: options.indexes ?? {},
-	...options.batched ? { batched: true } : {},
-	...options.retention === void 0 ? {} : { retention: options.retention }
-});
 /** Log rows spread over 8 tables, each its own DynamoDB partition. */
 var LOG_TABLES = [
 	0,
@@ -1688,7 +1905,7 @@ var mergeAll = (into, changes) => {
 	return into;
 };
 /** A row's metrics as values to merge: counters, gauges, and the sketches it has. */
-var metricsOf = (model, row) => {
+var metricsOf$1 = (model, row) => {
 	const { counters, gauges, distinct } = shapeOf(model);
 	return Object.fromEntries([...[...counters, ...gauges].map((name) => [name, Number(row[name] ?? 0)]), ...distinct.flatMap((name) => row[name] === null || row[name] === void 0 ? [] : [[name, row[name]]])]);
 };
@@ -1722,7 +1939,7 @@ var rewrite = (change, key, current) => {
 	const { counters, gauges, distinct } = shapeOf(model);
 	const base = current ?? blank(model, key);
 	const sum = mergeAll(/* @__PURE__ */ new Map(), [change]);
-	merge(sum, model, key, metricsOf(model, base));
+	merge(sum, model, key, metricsOf$1(model, base));
 	const set = valuesOf([...sum.values()][0]);
 	if (current && Object.keys(set).every((name) => current[name] === set[name])) return void 0;
 	const row = {
@@ -2210,173 +2427,301 @@ var createAggregateBatches = ({ engine, adapter, schema, batching: { mode = "log
 		}
 	};
 };
-var DatabaseQueryError = class extends Error {
-	name = "DatabaseQueryError";
-};
-var sameFields = (left, right) => left.length === right.length && left.every((field) => right.includes(field));
-var keyValue = (value, field) => {
-	if (isKeyValue(value)) return value;
-	throw new DatabaseQueryError(`${field} needs a string, number, or boolean.`);
-};
-var bound = (exclusive, inclusive, columns) => {
-	if (exclusive !== void 0 && inclusive !== void 0) throw new DatabaseQueryError(`range on ${columns[0]} sets both bounds of one side.`);
-	const value = exclusive ?? inclusive;
-	if (value === void 0) return void 0;
-	const values = Array.isArray(value) ? value : [value];
-	if (values.length === 0 || values.length > columns.length) throw new DatabaseQueryError(`range on ${columns[0]} takes 1–${columns.length} values of ${columns.join(", ")}.`);
-	return {
-		values: values.map((item, position) => keyValue(item, columns[position])),
-		inclusive: inclusive !== void 0
-	};
+var MINUTE_MS = 6e4;
+var HOUR_MS = 60 * MINUTE_MS;
+var DAY_MS = 24 * HOUR_MS;
+/** A model's retention as its physical table carries it, which each adapter maps natively. */
+var physicalRetention = ({ retention }) => retention === void 0 ? {} : { retention: {
+	column: retention.field,
+	ms: retention.days * DAY_MS
+} };
+/** Models in a reference or a rooted index, which an expired row's delete would break. */
+var linkedModels = (schema) => Object.entries(schema).flatMap(([name, { fields, indexes }]) => [...Object.values(fields).map(({ references }) => references), ...Object.values(indexes).map(({ root }) => root)].flatMap((link) => link ? [name, link.model] : []));
+/**
+* What is wrong with a model's retention: it counts from an integer field,
+* over whole days, and expired rows are deleted without cascades, counter
+* moves, or root bumps, so the model is in no reference or rooted index.
+*/
+var retentionProblems = (schema, model) => {
+	const definition = schema[model];
+	if (definition.retention === void 0) return [];
+	const { field, days } = definition.retention;
+	const declared = definition.fields[field] ?? (definition.kind === "table" ? definition.derived[field] : void 0);
+	return [
+		...declared?.type !== "integer" || "multi" in declared && declared.multi === true ? [`retention field "${field}" is not an integer field`] : [],
+		...Number.isSafeInteger(days) && days >= 1 ? [] : ["retention days must be a whole number of at least 1"],
+		...linkedModels(schema).includes(model) ? ["a model with retention is in no reference or rooted index"] : []
+	];
 };
-var createEngineReads = ({ adapter, schema, maxPageSize: requested = 500 }) => {
-	const maxPageSize = Math.min(requested, 500);
-	let count = {
-		calls: 0,
-		rows: 0
-	};
-	const returned = (rows) => {
-		const size = Array.isArray(rows) ? rows.length : rows === null ? 0 : 1;
-		count = {
-			calls: count.calls + 1,
-			rows: count.rows + size
+/**
+* Rows a pass deletes from each table: one statement or two a table, so a
+* pass stays well inside D1's 50 queries an invocation.
+*/
+var PASS_LIMIT = 500;
+/** The lease row: when the next pass is due, in epoch ms. */
+var LEASE_KEY = "retention.nextPassAt";
+/**
+* The adapter, pruning during its writes with no scheduler: once the lease
+* row in `leaseTable` is due, the write that takes it first runs one bounded
+* pass over the tables with retention, and other writers skip. The next pass
+* is due in an hour, or in a minute while a pass still found a full batch of
+* expired rows in some table; a pass that fails is due again at once. A
+* backend that expires rows natively, or a schema without retention, gets its
+* adapter back.
+*/
+var pruneDuringWrites = (adapter, tables, { leaseTable: table, now }) => {
+	const expiring = tables.filter(({ retention }) => retention !== void 0);
+	if (adapter.prune === void 0 || expiring.length === 0) return adapter;
+	const key = [LEASE_KEY];
+	let checkAt = 0;
+	const lease = async (row, due) => {
+		const value = String(due);
+		const guard = { v: row === null ? -1 : Number(row._v) };
+		const next = {
+			key: LEASE_KEY,
+			value,
+			_v: guard.v + 1
 		};
-		return rows;
-	};
-	/** A model of `kind` by physical table name, for reads and transactions. */
-	const modelOf = (name, kind = "table") => {
-		const model = schema.models.get(name);
-		if (model?.definition.kind === kind) return model;
-		throw new DatabaseQueryError(model === void 0 ? `Unknown model ${name}.` : kind === "table" ? `${name} is an aggregate; read it with findAggregates and change it with aggregate.` : `${name} is a table; read it with findMany and change it with create, update, or delete.`);
+		const op = row === null ? {
+			type: "insert",
+			table,
+			row: next
+		} : {
+			type: "patch",
+			table,
+			key,
+			set: { value },
+			guard,
+			previous: row
+		};
+		return (await adapter.write([op])).ok ? next : null;
 	};
-	const plan = ({ table }, input) => {
-		const index = table.indexes.find(({ name }) => name === input.index);
-		if (index === void 0) throw new DatabaseQueryError(`${table.name} has no index ${input.index}.`);
-		const where = input.where ?? {};
-		if (!sameFields(Object.keys(where), index.eq)) throw new DatabaseQueryError(`${table.name}.${index.name} reads need where on exactly: ${index.eq.join(", ") || "(none)"}.`);
-		const { limit, order = "asc", range } = input;
-		if (!Number.isSafeInteger(limit) || limit < 1 || limit > maxPageSize) throw new DatabaseQueryError(`limit must be 1–${maxPageSize}.`);
-		const columns = indexOrderColumns(table, index);
-		const eq = index.eq.map((field) => keyValue(where[field], `${table.name}.${field}`));
-		const scope = cursorScope([
-			table.name,
-			index.name,
-			eq,
-			order,
-			range
-		]);
-		let lower = bound(range?.gt, range?.gte, columns);
-		let upper = bound(range?.lt, range?.lte, columns);
-		if (input.cursor !== void 0) {
-			const values = decodeCursor(scope, input.cursor);
-			if (order === "asc") lower = {
-				values,
-				inclusive: false
-			};
-			else upper = {
-				values,
-				inclusive: false
-			};
+	const pass = async () => {
+		const at = now();
+		if (at < checkAt) return;
+		checkAt = at + MINUTE_MS;
+		const [row = null] = await adapter.get(table, [key]);
+		checkAt = row === null ? at : Number(row.value);
+		if (checkAt > at) return;
+		const held = await lease(row, at + HOUR_MS);
+		if (held === null) return;
+		checkAt = at + HOUR_MS;
+		const deleted = [];
+		try {
+			for (const t of expiring) deleted.push(await adapter.prune(t, at - t.retention.ms, PASS_LIMIT));
+		} catch (error) {
+			checkAt = at + MINUTE_MS;
+			await lease(held, at).catch(() => null);
+			throw error;
 		}
-		return {
-			request: {
-				index: index.name,
-				eq,
-				order,
-				limit,
-				...lower === void 0 ? {} : { lower },
-				...upper === void 0 ? {} : { upper }
-			},
-			index,
-			scope
-		};
+		if (deleted.includes(PASS_LIMIT) && await lease(held, at + MINUTE_MS) !== null) checkAt = at + MINUTE_MS;
+	};
+	const warn = (error) => console.warn("[hot-updater] Pruning expired rows failed.", error);
+	return Object.assign(Object.create(adapter), { async write(ops) {
+		await pass().catch(warn);
+		return adapter.write(ops);
+	} });
+};
+var SHARD_COLUMN = "_shard";
+var NAME = /^[a-z][a-z0-9_]*$/u;
+var INDEX_NAME = /^[A-Za-z][A-Za-z0-9_]*$/u;
+var tableName = (module, model) => module.namespace ? `${module.namespace}_${model}` : model;
+var integer = (name, defaulted = false) => ({
+	name,
+	type: "integer",
+	nullable: false,
+	...defaulted ? { default: 0 } : {}
+});
+/** A declared or derived field's type, and whether it holds several values. */
+var fieldType = (model, name) => {
+	const field = model.fields[name] ?? (model.kind === "table" ? model.derived[name] : void 0);
+	return field && {
+		type: field.type,
+		multi: "multi" in field && !!field.multi
 	};
-	/** Reads rows by key in one batch; the results follow the keys' order. */
-	const findByKeys = async (name, lookups) => {
-		const { table } = modelOf(name, "table");
-		const keys = lookups.map((lookup) => {
-			if (!sameFields(Object.keys(lookup), table.key)) throw new DatabaseQueryError(`findByKeys on ${name} takes its key: ${table.key.join(", ")}.`);
-			return table.key.map((field) => keyValue(lookup[field], `${name}.${field}`));
-		});
-		const rows = keys.length === 0 ? [] : await adapter.get(table, keys);
-		returned(rows.filter((row) => row !== null));
-		return rows.map((row) => row ?? null);
+};
+var metricsOf = (model) => [
+	...model.counters,
+	...model.gauges,
+	...model.distinct
+];
+/** Field names, the key, and each field's options. */
+var fieldProblems = (definition, add) => {
+	const names = [...Object.keys(definition.fields), ...definition.kind === "table" ? Object.keys(definition.derived) : metricsOf(definition)];
+	for (const name of new Set(names)) {
+		if (!NAME.test(name)) add(`field "${name}" must match ${NAME.source}`);
+		if (names.indexOf(name) !== names.lastIndexOf(name)) add(`field "${name}" is declared twice`);
+	}
+	const { key } = definition;
+	if (key.length === 0) add("key is empty");
+	if (new Set(key).size !== key.length) add("key repeats a field");
+	for (const name of key) {
+		const field = definition.fields[name];
+		if (field === void 0) add(`key field "${name}" is not a declared field`);
+		else if (field.required === false) add(`key field "${name}" is nullable`);
+		else if (field.type === "json") add(`key field "${name}" is json`);
+	}
+	for (const [name, { type, maxLength, ascii }] of Object.entries(definition.fields)) {
+		if (maxLength !== void 0 && (type !== "string" || !Number.isSafeInteger(maxLength) || maxLength < 1)) add(`field "${name}" has an invalid maxLength`);
+		if (ascii && type !== "string") add(`field "${name}" is ascii but not a string`);
+	}
+};
+/** A table's derived fields and references. */
+var tableProblems = (definition, add, table) => {
+	for (const [name, derived] of Object.entries(definition.derived)) {
+		if (typeof derived.compute !== "function") add(`derived field "${name}" has no compute function`);
+		if (derived.multi && derived.type === "json") add(`derived field "${name}" cannot be multi-valued json`);
+	}
+	for (const [name, { type, references }] of Object.entries(definition.fields)) {
+		if (references === void 0) continue;
+		const target = table(references.model);
+		const targetKey = target?.key.length === 1 ? target.fields[target.key[0]] : void 0;
+		if (targetKey === void 0) add(`field "${name}" references "${references.model}", which is not a single-key table of this module`);
+		else if (targetKey.type !== type) add(`field "${name}" and the key of "${references.model}" differ in type`);
+		if (references.onDelete === "cascade" && !Object.values(definition.indexes).some(({ eq }) => eq.length === 1 && eq[0] === name)) add(`cascade on "${name}" needs an index whose eq is exactly [${name}]`);
+	}
+};
+/** An aggregate's identity, metrics, and shards. */
+var aggregateProblems = (definition, add) => {
+	const identity = Object.keys(definition.fields);
+	if (definition.key.join("\0") !== identity.join("\0")) add(`key must list the identity fields in declaration order: ${identity.join(", ")}`);
+	if (metricsOf(definition).length === 0) add("aggregate has no metrics");
+	if (definition.distinct.length > 0 && definition.counters.length + definition.gauges.length > 0) add("distinct sketches need an aggregate of their own");
+	const { shards } = definition;
+	if (!Number.isSafeInteger(shards) || shards < 1 || shards > 64) add(`shards must be 1–64`);
+};
+/** Every problem in one model's declaration, its roots and references included. */
+var problemsOf = (module, model, definition) => {
+	const problems = [];
+	const add = (message) => problems.push(`${module.id}.${model}: ${message}`);
+	const table = (name) => {
+		const target = module.schema[name];
+		return target?.kind === "table" ? target : void 0;
 	};
-	return {
-		maxPageSize,
-		modelOf,
-		reads: {
-			total: () => count,
-			reset: () => {
-				count = {
-					calls: 0,
-					rows: 0
-				};
-			}
-		},
-		findByKeys,
-		async findOne(name, lookup) {
-			const { table } = modelOf(name, "table");
-			const fields = Object.keys(lookup);
-			if (sameFields(fields, table.key)) return (await findByKeys(name, [lookup]))[0];
-			const index = table.indexes.find(({ unique, eq }) => unique && sameFields(fields, eq));
-			if (index === void 0) throw new DatabaseQueryError(`findOne on ${name} needs its key or a unique field, not ${fields.join(", ")}.`);
-			const [row] = await adapter.query(table, {
-				index: index.name,
-				eq: index.eq.map((field) => keyValue(lookup[field], `${name}.${field}`)),
-				order: "asc",
-				limit: 1
-			});
-			return returned(row ?? null);
-		},
-		async findMany(name, input) {
-			const model = modelOf(name, "table");
-			const { request, index, scope } = plan(model, input);
-			const rows = returned(await adapter.query(model.table, request));
-			const last = rows.at(-1);
-			return rows.length === input.limit && last !== void 0 ? {
-				rows,
-				next: encodeCursor(scope, indexOrderTuple(model.table, index, last))
-			} : { rows };
-		},
-		async findAggregates(name, input) {
-			const model = modelOf(name, "aggregate");
-			const { table, definition } = model;
-			if (definition.kind !== "aggregate") throw new DatabaseQueryError(name);
-			const { request, index, scope } = plan(model, input);
-			const rows = await adapter.query(table, request);
-			const logicalKey = (row) => definition.key.map((column) => keyValue(row[column], column));
-			const groups = /* @__PURE__ */ new Map();
-			for (const row of rows) {
-				const key = JSON.stringify(logicalKey(row));
-				groups.set(key, [...groups.get(key) ?? [], row]);
-			}
-			const full = rows.length === input.limit;
-			const last = [...groups.values()].at(-1);
-			if (full && last !== void 0) {
-				const seen = new Set(last.map((row) => row[SHARD_COLUMN]));
-				const missing = Array.from({ length: definition.shards }, (_, shard) => shard).filter((shard) => !seen.has(shard));
-				if (missing.length > 0) {
-					const key = logicalKey(last[0]);
-					const rest = await adapter.get(table, missing.map((shard) => [...key, shard]));
-					last.push(...rest.filter((row) => row !== null));
-				}
-			}
-			const merged = [...groups.values()].map((shards) => {
-				const row = Object.fromEntries(definition.key.map((field) => [field, shards[0][field]]));
-				for (const metric of [...definition.counters, ...definition.gauges]) row[metric] = shards.reduce((sum, shard) => sum + Number(shard[metric] ?? 0), 0);
-				for (const metric of definition.distinct) row[metric] = mergeDistinct(shards.map((shard) => shard[metric]));
-				return row;
+	if (!NAME.test(model)) add("model names use lowercase letters, digits, and _");
+	fieldProblems(definition, add);
+	for (const [name, index] of Object.entries(definition.indexes)) {
+		const columns = [...index.eq, ...index.sort];
+		if (!INDEX_NAME.test(name)) add(`index "${name}" must match ${INDEX_NAME.source}`);
+		if (columns.length === 0) add(`index "${name}" has no fields`);
+		if (index.unique && index.sort.length > 0) add(`unique index "${name}" cannot sort`);
+		if (columns.filter((column) => {
+			const type = fieldType(definition, column);
+			if (type === void 0) add(`index "${name}" names undeclared field "${column}"`);
+			else if (type.type === "json") add(`index "${name}" names json field "${column}"`);
+			else if (type.multi && index.sort.includes(column)) add(`index "${name}" sorts by multi-valued field "${column}"`);
+			return type?.type !== "json" && type?.multi;
+		}).length > 1) add(`index "${name}" has more than one multi-valued field`);
+		if (index.root === void 0) continue;
+		const root = table(index.root.model);
+		if (root === void 0) add(`index "${name}" is rooted at unknown table "${index.root.model}"`);
+		else if (root.key.length > index.eq.length || root.key.some((field, position) => fieldType(definition, index.eq[position])?.type !== root.fields[field].type)) add(`index "${name}" eq must start with the key of "${index.root.model}"`);
+	}
+	if (definition.kind === "table") tableProblems(definition, add, table);
+	else aggregateProblems(definition, add);
+	for (const problem of retentionProblems(module.schema, model)) add(problem);
+	return problems;
+};
+/** Rejects invalid module schemas at startup, listing every problem. */
+var validateSchema = (modules) => {
+	const problems = [];
+	const owners = /* @__PURE__ */ new Map();
+	for (const module of modules) for (const [model, definition] of Object.entries(module.schema)) {
+		const name = tableName(module, model);
+		const owner = owners.get(name);
+		if (owner !== void 0) problems.push(`${module.id}.${model}: table "${name}" is also declared by ${owner}`);
+		owners.set(name, `${module.id}.${model}`);
+		problems.push(...problemsOf(module, model, definition));
+	}
+	if (problems.length > 0) throw new DatabaseSchemaError(`Invalid database schema:\n- ${problems.join("\n- ")}`);
+};
+var indexesOf = (definition) => [...Object.entries(definition.indexes).map(([name, index]) => ({
+	name,
+	eq: [...index.eq],
+	sort: [...index.sort],
+	...index.unique ? { unique: true } : {}
+})), ...Object.entries(definition.fields).flatMap(([name, field]) => field.unique ? [{
+	name,
+	eq: [name],
+	sort: [],
+	unique: true
+}] : [])];
+/** Validates the modules, then resolves them into physical tables with engine columns. */
+var resolveSchema = (modules) => {
+	validateSchema(modules);
+	const references = [];
+	for (const module of modules) for (const [model, definition] of Object.entries(module.schema)) {
+		if (definition.kind !== "table") continue;
+		const table = tableName(module, model);
+		for (const [field, { references: to }] of Object.entries(definition.fields)) {
+			if (to === void 0) continue;
+			const { onDelete } = to;
+			const target = tableName(module, to.model);
+			const counter = onDelete === "none" ? {} : { counter: `_refs_${table}_${field}` };
+			references.push({
+				table,
+				field,
+				target,
+				onDelete,
+				...counter
 			});
-			returned(merged);
-			if (!full || last === void 0) return { rows: merged };
-			return {
-				rows: merged,
-				next: encodeCursor(scope, indexOrderTuple(table, index, last[0]).slice(0, -1))
-			};
 		}
+	}
+	const models = /* @__PURE__ */ new Map();
+	for (const module of modules) for (const [model, definition] of Object.entries(module.schema)) {
+		const name = tableName(module, model);
+		const referencedBy = references.filter(({ target }) => target === name);
+		const columns = Object.entries(definition.fields).map(([field, { type, required, maxLength, ascii }]) => ({
+			name: field,
+			type,
+			nullable: required === false,
+			...maxLength === void 0 ? {} : { maxLength },
+			...ascii ? { ascii } : {}
+		}));
+		if (definition.kind === "table") for (const [field, { type, multi }] of Object.entries(definition.derived)) columns.push({
+			name: field,
+			type,
+			nullable: true,
+			...multi ? { multi } : {}
+		});
+		else columns.push(integer(SHARD_COLUMN), ...[...definition.counters, ...definition.gauges].map((metric) => integer(metric)), ...definition.distinct.map((metric) => ({
+			name: metric,
+			type: "string",
+			nullable: true
+		})));
+		for (const { counter } of referencedBy) if (counter !== void 0) columns.push(integer(counter, true));
+		columns.push(integer("_v", true));
+		models.set(name, {
+			module: module.id,
+			model,
+			definition,
+			table: {
+				name,
+				columns,
+				key: definition.kind === "aggregate" ? [...definition.key, SHARD_COLUMN] : [...definition.key],
+				indexes: indexesOf(definition),
+				...physicalRetention(definition)
+			},
+			references: references.filter(({ table }) => table === name),
+			referencedBy,
+			roots: new Map(Object.entries(definition.indexes).flatMap(([index, { root }]) => root === void 0 ? [] : [[index, tableName(module, root.model)]]))
+		});
+	}
+	return {
+		models,
+		tables: [...models.values()].map(({ table }) => table)
 	};
 };
+resolveSchema([coreModule]);
+resolveSchema([aggregateBatchingModule]).tables;
+/** Each plugin's `schema.<id>` settings row. */
+var pluginSettings = (plugins) => Object.fromEntries(plugins.map(({ id, schemaVersion }) => [`schema.${id}`, schemaVersion]));
+/** A plugin's schema as the engine resolves it: prefixed by its id unless it keeps its names. */
+var pluginModule = ({ id, schema, namespace }) => ({
+	id,
+	schema,
+	...namespace === false ? {} : { namespace: id }
+});
 /** A row this attempt read changed while it ran; the attempt reruns. */
 var StaleReadError = class extends Error {};
 var idOf = (table, key) => JSON.stringify([table, key]);
@@ -2766,8 +3111,172 @@ var createTransactions = ({ adapter, schema, reads, retry = {} }) => {
 		throw negative ?? new DatabaseConflictError(`The transaction conflicted ${attempts} times.`);
 	} };
 };
+var sameFields = (left, right) => left.length === right.length && left.every((field) => right.includes(field));
+var keyValue = (value, field) => {
+	if (isKeyValue(value)) return value;
+	throw new DatabaseQueryError(`${field} needs a string, number, or boolean.`);
+};
+var bound = (exclusive, inclusive, columns) => {
+	if (exclusive !== void 0 && inclusive !== void 0) throw new DatabaseQueryError(`range on ${columns[0]} sets both bounds of one side.`);
+	const value = exclusive ?? inclusive;
+	if (value === void 0) return void 0;
+	const values = Array.isArray(value) ? value : [value];
+	if (values.length === 0 || values.length > columns.length) throw new DatabaseQueryError(`range on ${columns[0]} takes 1–${columns.length} values of ${columns.join(", ")}.`);
+	return {
+		values: values.map((item, position) => keyValue(item, columns[position])),
+		inclusive: inclusive !== void 0
+	};
+};
+var createEngineReads = ({ adapter, schema, maxPageSize: requested = 500 }) => {
+	const maxPageSize = Math.min(requested, 500);
+	let count = {
+		calls: 0,
+		rows: 0
+	};
+	const returned = (rows) => {
+		const size = Array.isArray(rows) ? rows.length : rows === null ? 0 : 1;
+		count = {
+			calls: count.calls + 1,
+			rows: count.rows + size
+		};
+		return rows;
+	};
+	/** A model of `kind` by physical table name, for reads and transactions. */
+	const modelOf = (name, kind = "table") => {
+		const model = schema.models.get(name);
+		if (model?.definition.kind === kind) return model;
+		throw new DatabaseQueryError(model === void 0 ? `Unknown model ${name}.` : kind === "table" ? `${name} is an aggregate; read it with findAggregates and change it with aggregate.` : `${name} is a table; read it with findMany and change it with create, update, or delete.`);
+	};
+	const plan = ({ table }, input) => {
+		const index = table.indexes.find(({ name }) => name === input.index);
+		if (index === void 0) throw new DatabaseQueryError(`${table.name} has no index ${input.index}.`);
+		const where = input.where ?? {};
+		if (!sameFields(Object.keys(where), index.eq)) throw new DatabaseQueryError(`${table.name}.${index.name} reads need where on exactly: ${index.eq.join(", ") || "(none)"}.`);
+		const { limit, order = "asc", range } = input;
+		if (!Number.isSafeInteger(limit) || limit < 1 || limit > maxPageSize) throw new DatabaseQueryError(`limit must be 1–${maxPageSize}.`);
+		const columns = indexOrderColumns(table, index);
+		const eq = index.eq.map((field) => keyValue(where[field], `${table.name}.${field}`));
+		const scope = cursorScope([
+			table.name,
+			index.name,
+			eq,
+			order,
+			range
+		]);
+		let lower = bound(range?.gt, range?.gte, columns);
+		let upper = bound(range?.lt, range?.lte, columns);
+		if (input.cursor !== void 0) {
+			const values = decodeCursor(scope, input.cursor);
+			if (order === "asc") lower = {
+				values,
+				inclusive: false
+			};
+			else upper = {
+				values,
+				inclusive: false
+			};
+		}
+		return {
+			request: {
+				index: index.name,
+				eq,
+				order,
+				limit,
+				...lower === void 0 ? {} : { lower },
+				...upper === void 0 ? {} : { upper }
+			},
+			index,
+			scope
+		};
+	};
+	/** Reads rows by key in one batch; the results follow the keys' order. */
+	const findByKeys = async (name, lookups) => {
+		const { table } = modelOf(name, "table");
+		const keys = lookups.map((lookup) => {
+			if (!sameFields(Object.keys(lookup), table.key)) throw new DatabaseQueryError(`findByKeys on ${name} takes its key: ${table.key.join(", ")}.`);
+			return table.key.map((field) => keyValue(lookup[field], `${name}.${field}`));
+		});
+		const rows = keys.length === 0 ? [] : await adapter.get(table, keys);
+		returned(rows.filter((row) => row !== null));
+		return rows.map((row) => row ?? null);
+	};
+	return {
+		maxPageSize,
+		modelOf,
+		reads: {
+			total: () => count,
+			reset: () => {
+				count = {
+					calls: 0,
+					rows: 0
+				};
+			}
+		},
+		findByKeys,
+		async findOne(name, lookup) {
+			const { table } = modelOf(name, "table");
+			const fields = Object.keys(lookup);
+			if (sameFields(fields, table.key)) return (await findByKeys(name, [lookup]))[0];
+			const index = table.indexes.find(({ unique, eq }) => unique && sameFields(fields, eq));
+			if (index === void 0) throw new DatabaseQueryError(`findOne on ${name} needs its key or a unique field, not ${fields.join(", ")}.`);
+			const [row] = await adapter.query(table, {
+				index: index.name,
+				eq: index.eq.map((field) => keyValue(lookup[field], `${name}.${field}`)),
+				order: "asc",
+				limit: 1
+			});
+			return returned(row ?? null);
+		},
+		async findMany(name, input) {
+			const model = modelOf(name, "table");
+			const { request, index, scope } = plan(model, input);
+			const rows = returned(await adapter.query(model.table, request));
+			const last = rows.at(-1);
+			return rows.length === input.limit && last !== void 0 ? {
+				rows,
+				next: encodeCursor(scope, indexOrderTuple(model.table, index, last))
+			} : { rows };
+		},
+		async findAggregates(name, input) {
+			const model = modelOf(name, "aggregate");
+			const { table, definition } = model;
+			if (definition.kind !== "aggregate") throw new DatabaseQueryError(name);
+			const { request, index, scope } = plan(model, input);
+			const rows = await adapter.query(table, request);
+			const logicalKey = (row) => definition.key.map((column) => keyValue(row[column], column));
+			const groups = /* @__PURE__ */ new Map();
+			for (const row of rows) {
+				const key = JSON.stringify(logicalKey(row));
+				groups.set(key, [...groups.get(key) ?? [], row]);
+			}
+			const full = rows.length === input.limit;
+			const last = [...groups.values()].at(-1);
+			if (full && last !== void 0) {
+				const seen = new Set(last.map((row) => row[SHARD_COLUMN]));
+				const missing = Array.from({ length: definition.shards }, (_, shard) => shard).filter((shard) => !seen.has(shard));
+				if (missing.length > 0) {
+					const key = logicalKey(last[0]);
+					const rest = await adapter.get(table, missing.map((shard) => [...key, shard]));
+					last.push(...rest.filter((row) => row !== null));
+				}
+			}
+			const merged = [...groups.values()].map((shards) => {
+				const row = Object.fromEntries(definition.key.map((field) => [field, shards[0][field]]));
+				for (const metric of [...definition.counters, ...definition.gauges]) row[metric] = shards.reduce((sum, shard) => sum + Number(shard[metric] ?? 0), 0);
+				for (const metric of definition.distinct) row[metric] = mergeDistinct(shards.map((shard) => shard[metric]));
+				return row;
+			});
+			returned(merged);
+			if (!full || last === void 0) return { rows: merged };
+			return {
+				rows: merged,
+				next: encodeCursor(scope, indexOrderTuple(table, index, last[0]).slice(0, -1))
+			};
+		}
+	};
+};
 /** Storage semantics over one adapter, addressed by physical table name. */
-var createEngine = ({ adapter: given, schema, maxPageSize, verify, retry }) => {
+var createStorageEngine = ({ adapter: given, schema, maxPageSize, verify, retry }) => {
 	const verified = verify ? verifyAdapter(given) : void 0;
 	const adapter = verified ?? given;
 	const reads = createEngineReads({
@@ -2797,12 +3306,17 @@ var createEngine = ({ adapter: given, schema, maxPageSize, verify, retry }) => {
 	};
 };
 /** The engine plus `database(module)`, which hands a module its typed handle. */
-var createDatabaseEngine = ({ batching, now = Date.now, ...options }) => {
-	const engine = createEngine(options);
+var createDatabaseEngine = ({ batching, now = Date.now, meter, ...options }) => {
+	const adapter = meter ? meter.wrap(options.adapter) : options.adapter;
+	const engine = createStorageEngine({
+		...options,
+		adapter
+	});
 	const { reads } = engine;
+	meter?.attach(reads.reads);
 	const batches = batching && createAggregateBatches({
 		engine,
-		adapter: options.adapter,
+		adapter,
 		schema: options.schema,
 		batching,
 		now
@@ -2851,6 +3365,230 @@ var createDatabaseEngine = ({ batching, now = Date.now, ...options }) => {
 		}
 	};
 };
+/**
+* How to create plugins' tables on a database, by the tooling it offers:
+* what the plugins' schema fence names when their settings rows are missing.
+*/
+var pluginTablesFix = (database) => {
+	const { createMigrator, generateSchema } = database;
+	const managed = "A managed server runs only its provider's plugins, and rerunning `hot-updater init --provider <provider>` applies the provider's migrations.";
+	const serverProject = "Run `hot-updater db` commands in the server's project: they load the server file named on the command line, or src/hotUpdater.* or src/db.*, and don't read hot-updater.config.ts.";
+	return createMigrator !== void 0 ? `Run \`hot-updater db migrate\`. ${managed} ${serverProject}` : generateSchema !== void 0 ? `Run \`hot-updater db generate\` and apply the file it writes. ${managed} ${serverProject}` : managed;
+};
+/**
+* The storage engine over a database, as a server runs it: core's tables
+* and the plugins', with the plugins' settings rows fenced on a fenced
+* database, expired rows pruned during writes, aggregates batched when the
+* database batches them, and reads metered when it came from `meterReads`.
+* `createHotUpdater` runs core and its plugins on one; tests and tools run
+* a plugin on one without a server. Wrap the adapter with `verifyAdapter`
+* to check every call against the adapter contract.
+*/
+var createEngine = (database, { plugins = [], now = Date.now } = {}) => {
+	const modules = /* @__PURE__ */ new Map();
+	for (const plugin of plugins) {
+		if (plugin.id === coreModule.id) throw new HotUpdaterConfigError(`Plugin id "${plugin.id}" is core's own.`);
+		if (modules.has(plugin.id)) throw new HotUpdaterConfigError(`Plugin "${plugin.id}" is registered twice.`);
+		modules.set(plugin.id, pluginModule(plugin));
+	}
+	if (modules.size > 0) validateSchema([coreModule, ...modules.values()]);
+	const name = fencedName(database.adapter);
+	const fenced = name === void 0 || plugins.length === 0 ? database.adapter : withSchemaFence(database.adapter, name, pluginSettings(plugins), pluginTablesFix(database));
+	const batching = database.aggregateBatching;
+	const schema = resolveSchema([
+		coreModule,
+		...modules.values(),
+		...batching === void 0 ? [] : [aggregateBatchingModule]
+	]);
+	const meter = readMeterOf(database);
+	const engine = createDatabaseEngine({
+		adapter: pruneDuringWrites(fenced, schema.tables, {
+			leaseTable: SETTINGS_TABLE,
+			now
+		}),
+		schema,
+		...database.retry === void 0 ? {} : { retry: database.retry },
+		...batching === void 0 ? {} : {
+			batching,
+			now
+		},
+		...meter === void 0 ? {} : { meter }
+	});
+	return {
+		core: engine.database(coreModule),
+		database: (plugin) => {
+			const module = modules.get(plugin.id);
+			if (module === void 0) throw new HotUpdaterConfigError(`Plugin "${plugin.id}" is not one of this engine's plugins.`);
+			return engine.database(module);
+		},
+		flush: () => engine.flush(),
+		dispose: () => engine.dispose()
+	};
+};
+var HOT_UPDATER_SERVER_VERSION = "1.0.0-rc.21";
+/**
+* `/version` on both mounts. The admin mount also lists the ids of the
+* plugins the server runs, sorted; apps never learn which plugins a server
+* runs.
+*/
+var createVersionRouteHandlers = (plugins = []) => {
+	const version = {
+		adminProtocol: 2,
+		infrastructureGeneration: 1,
+		version: HOT_UPDATER_SERVER_VERSION
+	};
+	const adminVersion = {
+		...version,
+		plugins: [...plugins].sort()
+	};
+	return {
+		version: async () => Response.json(version),
+		adminVersion: async () => Response.json(adminVersion)
+	};
+};
+/**
+* The brand Hot Updater's own plugin factories set. It is a registered
+* symbol, not a module-private one, so a plugin made by one package's ESM
+* build still carries it when another's CommonJS build reads it, as a config
+* loaded through `require` may; no plugin sets it by accident. Each official
+* plugin package sets it with a copy of its own, so no package imports
+* another's internals for it. It guards Hot Updater's ids against a
+* clash, not against a determined impostor.
+*/
+var OFFICIAL = Symbol.for("@hot-updater/server/official-plugin");
+/**
+* The ids of Hot Updater's own plugins. The console and tooling tell
+* features apart by plugin id, so no other plugin may take one.
+*/
+var OFFICIAL_IDS = /* @__PURE__ */ new Set(["insights", "apiKeys"]);
+/** Whether one of Hot Updater's own factories made `plugin`. */
+var isOfficialPlugin = (plugin) => typeof plugin === "object" && plugin !== null && Reflect.get(plugin, OFFICIAL) === true;
+/**
+* Refuses a plugin that takes one of Hot Updater's own ids without being
+* that plugin: `at` names it in the error, such as `plugins[0]`.
+*/
+var checkReservedId = (plugin, at) => {
+	const id = typeof plugin === "object" && plugin !== null ? Reflect.get(plugin, "id") : void 0;
+	if (typeof id === "string" && OFFICIAL_IDS.has(id) && !isOfficialPlugin(plugin)) throw new HotUpdaterConfigError(`${at} takes the id "${id}", which is reserved for Hot Updater's ${id}() plugin; give this plugin another id.`);
+};
+var EXPORT_NAME = /^[A-Za-z_$][\w$]*$/u;
+/**
+* Names app code cannot import as they are: reserved words, and the names
+* the printed app code declares itself.
+*/
+var UNAVAILABLE_NAMES = /* @__PURE__ */ new Set([
+	"App",
+	"HotUpdater",
+	"arguments",
+	"await",
+	"break",
+	"case",
+	"catch",
+	"class",
+	"const",
+	"continue",
+	"debugger",
+	"default",
+	"delete",
+	"do",
+	"else",
+	"enum",
+	"eval",
+	"export",
+	"extends",
+	"false",
+	"finally",
+	"for",
+	"function",
+	"if",
+	"implements",
+	"import",
+	"in",
+	"instanceof",
+	"interface",
+	"let",
+	"new",
+	"null",
+	"package",
+	"private",
+	"protected",
+	"public",
+	"return",
+	"static",
+	"super",
+	"switch",
+	"this",
+	"throw",
+	"true",
+	"try",
+	"typeof",
+	"var",
+	"void",
+	"while",
+	"with",
+	"yield"
+]);
+var isRecord$3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/**
+* The client plugins an app adds for the plugins, each once, in plugin
+* order: what init prints in `HotUpdater.init`'s `plugins`. A malformed one,
+* or one name from two modules, throws `HotUpdaterConfigError`.
+*/
+var clientPluginsOf = (plugins) => {
+	if (!Array.isArray(plugins)) throw new HotUpdaterConfigError("plugins must be an array of plugins.");
+	const found = [];
+	plugins.forEach((plugin, position) => checkReservedId(plugin, `plugins[${position}]`));
+	for (const plugin of plugins) {
+		if (!isRecord$3(plugin) || !isRecord$3(plugin.cli)) continue;
+		const value = plugin.cli.clientPlugin;
+		if (value === void 0) continue;
+		const id = String(plugin.id);
+		if (!isRecord$3(value) || typeof value.module !== "string" || value.module === "" || typeof value.name !== "string" || !EXPORT_NAME.test(value.name) || UNAVAILABLE_NAMES.has(value.name)) throw new HotUpdaterConfigError(`Plugin "${id}" cli.clientPlugin needs a module and an export name the app can import: an identifier other than a reserved word, App, or HotUpdater.`);
+		const { module, name } = value;
+		const named = found.find((entry) => entry.name === name);
+		if (named === void 0) found.push({
+			module,
+			name
+		});
+		else if (named.module !== module) throw new HotUpdaterConfigError(`Plugin "${id}" names the client plugin "${name}" from ${module}, but another plugin names it from ${named.module}.`);
+	}
+	return found;
+};
+/** A stored catalog payload, checked against its strategy's shape. */
+var parseCompiledCatalog = (payload, strategy) => {
+	const parsed = JSON.parse(payload);
+	if (typeof parsed !== "object" || parsed === null || Reflect.get(parsed, "schemaVersion") !== 1 || Reflect.get(parsed, "strategy") !== strategy || Reflect.get(parsed, "fallbackPolicy") !== "BUILTIN_IF_ACTIVE_INELIGIBLE" || !Array.isArray(Reflect.get(parsed, "releaseDescriptors"))) throw new Error("Stored Release catalog payload is invalid");
+	if (strategy === "APP_VERSION" && !Array.isArray(Reflect.get(parsed, "segments"))) throw new Error("Stored app-version Release catalog is invalid");
+	if (strategy === "FINGERPRINT" && !Array.isArray(Reflect.get(parsed, "releaseIndexes"))) throw new Error("Stored fingerprint Release catalog is invalid");
+	return parsed;
+};
+/** The scope key an update check reads. */
+var releaseCatalogScopeKeyOf = (input) => input.strategy === "APP_VERSION" ? createReleaseCatalogScopeKey({
+	channelKey: input.channelKey,
+	platform: input.platform,
+	strategy: "APP_VERSION"
+}) : createReleaseCatalogScopeKey({
+	channelKey: input.channelKey,
+	fingerprintHash: input.fingerprintHash,
+	platform: input.platform,
+	strategy: "FINGERPRINT"
+});
+/** Projects a stored catalog row for one update check; null when the row is not this scope's. */
+var projectReleaseCatalogRow = (row, input, scopeKey = releaseCatalogScopeKeyOf(input)) => {
+	if (row === null || row.platform !== input.platform || row.strategy !== input.strategy || row.channel_key !== input.channelKey || row.scope_key !== scopeKey || row.fingerprint_hash !== (input.strategy === "FINGERPRINT" ? input.fingerprintHash : null)) return null;
+	const compiled = parseCompiledCatalog(row.payload, input.strategy);
+	const appVersion = input.strategy === "APP_VERSION" ? input.appVersion : void 0;
+	return {
+		catalogId: row.catalog_id,
+		catalogHash: row.catalog_hash,
+		fallbackPolicy: RELEASE_CATALOG_FALLBACK_POLICY,
+		generation: row.generation,
+		releases: projectCompiledCatalog(compiled, appVersion),
+		rollbackReleases: projectCompiledRollbackCatalog(compiled, appVersion),
+		schemaVersion: 1,
+		scopeKey
+	};
+};
 var HBC_ASSET_PATH_RE = /\.bundle$/;
 var asByteSize = (value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : null;
 var resolveUniqueHbcAssetPath = (manifest) => {
@@ -2997,6 +3735,29 @@ async function resolveManifestArtifacts({ currentBundle, resolveFileUrl, readSto
 		...archiveUrl ? { archiveUrl } : {}
 	};
 }
+/** A compiled segment as a range: its version when it holds exactly one. */
+var segmentRange = ({ lower, upper }) => lower?.inclusive && upper?.inclusive && lower.version === upper.version ? lower.version : [lower === null ? "" : `${lower.inclusive ? ">=" : ">"}${lower.version}`, upper === null ? "" : `${upper.inclusive ? "<=" : "<"}${upper.version}`].join(" ").trim() || "*";
+/**
+* Auto-patch bases from a scope's compiled Release Catalog, which holds
+* every enabled bundle release of the scope: those whose range intersects
+* `range` (all of them in a fingerprint scope), newest release first, each
+* bundle once and older than `bundleId`, at most `limit`.
+*/
+var baseBundleIdsOf = (row, range, bundleId, limit) => {
+	const catalog = parseCompiledCatalog(row.payload, row.strategy);
+	const serving = new Set(catalog.strategy === "FINGERPRINT" ? catalog.rollbackReleaseIndexes : catalog.segments.flatMap((segment) => range !== null && rangesIntersect(range, segmentRange(segment)) ? segment.rollbackReleaseIndexes : []));
+	const newestFirst = catalog.releaseDescriptors.map((descriptor, index) => ({
+		descriptor,
+		index
+	})).sort((left, right) => left.descriptor.releaseId < right.descriptor.releaseId ? 1 : -1);
+	const ids = [];
+	for (const { descriptor, index } of newestFirst) {
+		if (ids.length >= limit) break;
+		const id = descriptor.bundleId;
+		if (serving.has(index) && descriptor.kind === "BUNDLE" && id !== null && id < bundleId && !ids.includes(id)) ids.push(id);
+	}
+	return ids;
+};
 var PAGE$2 = 500;
 var pick = (fields) => (row) => Object.fromEntries(fields.map((field) => [field, row[field]]));
 var toBundleRow = pick([
@@ -3332,7 +4093,7 @@ var deleteChannel = (db, id) => db.transaction(async (tx) => {
 	return { deleted: true };
 });
 var PAGE = 500;
-var fail = (code, message) => {
+var fail$1 = (code, message) => {
 	throw new ReleaseCatalogMutationError(code, message);
 };
 var checkScope = (scope) => {
@@ -3347,7 +4108,7 @@ var checkScope = (scope) => {
 		platform: scope.platform,
 		strategy: "FINGERPRINT"
 	});
-	if (scope.strategy === "FINGERPRINT" !== (scope.fingerprintHash !== null) || scope.scopeKey !== expected) fail("INVALID_SCOPE", "Release catalog scope metadata is inconsistent");
+	if (scope.strategy === "FINGERPRINT" !== (scope.fingerprintHash !== null) || scope.scopeKey !== expected) fail$1("INVALID_SCOPE", "Release catalog scope metadata is inconsistent");
 };
 /** A scope's enabled releases, all of them, under the catalog's guard. */
 var enabledReleases = async (tx, scopeKey) => {
@@ -3385,7 +4146,7 @@ var writeCatalog = async (tx, scope, stored, enabled, updatedAtMs) => {
 		releases: enabled.map(releaseRowToRelease)
 	});
 	const generation = (stored.generation ?? 0) + 1;
-	if (!Number.isSafeInteger(generation)) fail("CATALOG_GENERATION_EXHAUSTED", `Catalog "${scope.scopeKey}" exhausted its generation counter`);
+	if (!Number.isSafeInteger(generation)) fail$1("CATALOG_GENERATION_EXHAUSTED", `Catalog "${scope.scopeKey}" exhausted its generation counter`);
 	const catalog = {
 		scope_key: scope.scopeKey,
 		catalog_id: stored.catalog?.catalog_id ?? createUUIDv7(),
@@ -3420,7 +4181,7 @@ var readCatalog = async (tx, scopeKey) => {
 };
 /** A scope with releases and no compiled catalog lost its history. */
 var assertHistory = (stored, hasReleases) => {
-	if (stored.catalog === null && hasReleases) fail("CATALOG_IDENTITY_MISSING", "Catalog history is missing. Restore its catalog row from backup before rebuilding or deploying.");
+	if (stored.catalog === null && hasReleases) fail$1("CATALOG_IDENTITY_MISSING", "Catalog history is missing. Restore its catalog row from backup before rebuilding or deploying.");
 };
 /** One release change and its scope's next catalog, inside `tx`. */
 var changeRelease = async (tx, { scope, change, bundle, updatedAtMs }) => {
@@ -3438,690 +4199,423 @@ var changeRelease = async (tx, { scope, change, bundle, updatedAtMs }) => {
 		assertHistory(stored, latest !== null);
 		const floor = [latest, bundle && isUUIDv7(bundle.row.id) ? bundle.row.id : null].filter((id) => id !== null).sort().at(-1);
 		const id = change.row.id ?? createUUIDv7After(floor ?? null);
-		if (latest !== null && id <= latest) fail("NON_MONOTONIC_RELEASE_ID", `Release "${id}" must sort after "${latest}"`);
-		release = {
-			...change.row,
-			id
-		};
-		if (release.scope_key !== scope.scopeKey || release.channel_id !== scope.channelId || release.platform !== scope.platform || release.strategy !== scope.strategy || release.fingerprint_hash !== scope.fingerprintHash || release.revision !== 1) fail("INVALID_SCOPE", "Inserted Release does not match its catalog scope");
-		tx.create("releases", release);
-	} else {
-		const row = await tx.findOne("releases", { id: change.id });
-		if (row === null || row.scope_key !== scope.scopeKey) return fail("RELEASE_NOT_FOUND", `Release "${change.id}" was not found in scope "${scope.scopeKey}"`);
-		assertHistory(stored, true);
-		before = toReleaseRow(row);
-		if (change.operation === "delete") {
-			await tx.delete("releases", row);
-			release = null;
-		} else {
-			const set = {
-				...change.update,
-				revision: before.revision + 1
-			};
-			tx.update("releases", row, set);
-			release = {
-				...before,
-				...set
-			};
-		}
-	}
-	const changedId = before?.id ?? release?.id;
-	const { catalog, compilation } = await writeCatalog(tx, scope, stored, [...enabled.filter(({ id }) => id !== changedId), ...release?.enabled ? [release] : []].sort((left, right) => left.id < right.id ? -1 : 1), updatedAtMs);
-	return {
-		catalog,
-		release,
-		diagnostics: compilation.diagnostics
-	};
-};
-/**
-* Release changes rooted at their catalogs: each reads its scope's catalog
-* and enabled releases, applies the change, and writes the next catalog
-* generation, all in one transaction. A concurrent change in a scope bumps
-* its catalog row, so this transaction reruns instead of publishing a stale
-* catalog.
-*/
-var changeReleases = (db, inputs) => {
-	if (new Set(inputs.map(({ scope }) => scope.scopeKey)).size !== inputs.length) fail("INVALID_SCOPE", "A batch cannot change one catalog scope twice");
-	return db.transaction(async (tx) => {
-		const results = [];
-		for (const input of inputs) results.push(await changeRelease(tx, input));
-		return results;
-	});
-};
-/** Recompiles a scope's catalog from its enabled releases inside `tx`; an unchanged catalog is not rewritten. */
-var rebuildScope = async (tx, scope, updatedAtMs) => {
-	checkScope(scope);
-	const stored = await readCatalog(tx, scope.scopeKey);
-	assertHistory(stored, await latestReleaseId(tx, scope.scopeKey) !== null);
-	const enabled = await enabledReleases(tx, scope.scopeKey);
-	const compilation = await compileReleaseCatalog({
-		strategy: scope.strategy,
-		releases: enabled.map(releaseRowToRelease)
-	});
-	const current = stored.catalog;
-	if (current !== null && current.strategy === scope.strategy && current.channel_id === scope.channelId && current.channel_key === encodeChannelKey(scope.channelName) && current.platform === scope.platform && current.fingerprint_hash === scope.fingerprintHash && current.catalog_hash === compilation.catalogHash) return {
-		catalog: current,
-		current,
-		changed: false,
-		diagnostics: compilation.diagnostics
-	};
-	const written = await writeCatalog(tx, scope, stored, enabled, updatedAtMs);
-	return {
-		catalog: written.catalog,
-		current,
-		changed: true,
-		diagnostics: written.compilation.diagnostics
-	};
-};
-/** Carries a preflight's result out of the transaction it stops, so nothing is written. */
-var Preflight = class extends Error {
-	result;
-	constructor(result) {
-		super("preflight");
-		this.result = result;
-	}
-};
-var dryRun = async (db, read) => {
-	try {
-		await db.transaction(async (tx) => {
-			throw new Preflight(await read(tx));
-		});
-	} catch (error) {
-		if (error instanceof Preflight) return error.result;
-		throw error;
-	}
-	throw new Error("A preflight transaction returned without its result.");
-};
-/** A channel's catalog scope for a platform, and a fingerprint when it has one. */
-var scopeOf = (channel, platform, fingerprintHash) => {
-	const channelKey = encodeChannelKey(channel.name);
-	return fingerprintHash === null ? {
-		channelId: channel.id,
-		channelName: channel.name,
-		fingerprintHash,
-		platform,
-		scopeKey: createReleaseCatalogScopeKey({
-			channelKey,
-			platform,
-			strategy: "APP_VERSION"
-		}),
-		strategy: "APP_VERSION"
-	} : {
-		channelId: channel.id,
-		channelName: channel.name,
-		fingerprintHash,
-		platform,
-		scopeKey: createReleaseCatalogScopeKey({
-			channelKey,
-			fingerprintHash,
-			platform,
-			strategy: "FINGERPRINT"
-		}),
-		strategy: "FINGERPRINT"
-	};
-};
-/** A release and its scope, checked against the revision the caller saw. */
-var loadTarget = async (tx, { releaseId, expectedRevision }) => {
-	const row = await tx.findOne("releases", { id: releaseId });
-	if (row === null) throw new ReleaseManagementError("RELEASE_NOT_FOUND", `Release "${releaseId}" was not found.`);
-	const release = toReleaseRow(row);
-	if (expectedRevision !== void 0 && expectedRevision !== release.revision) throw new ReleaseManagementError("VERSION_CONFLICT", `Release "${release.id}" is revision ${release.revision}; expected ${expectedRevision}.`);
-	const catalog = await tx.findOne("release_catalogs", { scope_key: release.scope_key });
-	if (catalog === null) throw new ReleaseCatalogMutationError("INVALID_SCOPE", `Release "${release.id}" has no catalog projection.`);
-	return {
-		release,
-		scope: {
-			channelId: release.channel_id,
-			channelName: decodeChannelKey(catalog.channel_key),
-			fingerprintHash: release.fingerprint_hash,
-			platform: release.platform,
-			scopeKey: release.scope_key,
-			strategy: release.strategy
-		}
-	};
-};
-var policyUpdate = (release, patch, updatedAtMs) => {
-	if (patch.fingerprintHash !== void 0 && patch.fingerprintHash !== release.fingerprint_hash) throw new ReleaseManagementError("SCOPE_MOVE_UNSUPPORTED", "Changing a fingerprint target requires an atomic Release scope move.");
-	return {
-		...patch.enabled === void 0 ? {} : { enabled: patch.enabled },
-		...patch.message === void 0 ? {} : { message: patch.message },
-		...patch.rolloutCohortCount === void 0 ? {} : { rollout_cohort_count: patch.rolloutCohortCount },
-		...patch.shouldForceUpdate === void 0 ? {} : { should_force_update: patch.shouldForceUpdate },
-		...patch.targetAppVersion === void 0 ? {} : { target_app_version: patch.targetAppVersion },
-		...patch.targetCohorts === void 0 ? {} : { target_cohorts: [...patch.targetCohorts] },
-		updated_at_ms: updatedAtMs
-	};
-};
-var mutationResult = ({ catalog, release }) => ({
-	attempts: 1,
-	catalog,
-	release
-});
-/** The scope a catalog row names, for a rebuild. */
-var catalogScope = async (tx, scopeKey) => {
-	const row = await tx.findOne("release_catalogs", { scope_key: scopeKey });
-	if (row === null) throw new Error(`Release catalog "${scopeKey}" was not found.`);
-	return {
-		channelId: row.channel_id,
-		channelName: decodeChannelKey(row.channel_key),
-		fingerprintHash: row.fingerprint_hash,
-		platform: row.platform,
-		scopeKey: row.scope_key,
-		strategy: row.strategy
-	};
-};
-/**
-* Core's typed writes: each runs in one engine transaction rooted at the
-* catalogs it changes, so a concurrent change reruns it instead of
-* publishing a stale catalog.
-*/
-var createCoreOperations = (db, { now = Date.now } = {}) => {
-	const ensureChannel = async (name) => (await insertChannel(db, {
-		id: `channel:${encodeChannelKey(name)}`,
-		name
-	})).row;
-	/**
-	* Runs a write that ensured its channels first. A channel deleted between
-	* that and the write refuses the write, so it runs again and ensures it anew.
-	*/
-	const withChannels = async (write) => {
-		for (let attempt = 1;; attempt += 1) try {
-			return await write();
-		} catch (error) {
-			if (attempt < 3 && error instanceof DatabaseConstraintError && error.reason === "not_found" && error.model === "channels") continue;
-			throw error;
-		}
-	};
-	const deployOnce = async (deployments) => {
-		const channels = /* @__PURE__ */ new Map();
-		for (const { release } of deployments) if (!channels.has(release.channel)) channels.set(release.channel, await ensureChannel(release.channel));
-		const platforms = /* @__PURE__ */ new Map();
-		for (const deployment of deployments) {
-			if (!("bundleId" in deployment) || platforms.has(deployment.bundleId)) continue;
-			const row = await db.findOne("bundles", { id: deployment.bundleId });
-			if (row === null) throw new DatabaseBundleNotFoundError(deployment.bundleId);
-			platforms.set(deployment.bundleId, toBundleRow(row).platform);
-		}
-		const updatedAtMs = now();
-		return (await changeReleases(db, deployments.map((deployment) => {
-			const { release: policy } = deployment;
-			const stored = "bundleId" in deployment;
-			const bundleId = stored ? deployment.bundleId : deployment.bundle.id;
-			const platform = stored ? platforms.get(deployment.bundleId) : deployment.bundle.platform;
-			const scope = scopeOf(channels.get(policy.channel), platform, policy.fingerprintHash);
-			return {
-				scope,
-				...stored ? {} : { bundle: {
-					row: bundleToRow(deployment.bundle),
-					patches: bundleToPatchRows(deployment.bundle)
-				} },
-				change: {
-					operation: "insert",
-					row: {
-						bundle_id: bundleId,
-						channel_id: scope.channelId,
-						created_at_ms: updatedAtMs,
-						enabled: policy.enabled,
-						fingerprint_hash: policy.fingerprintHash,
-						kind: "BUNDLE",
-						message: policy.message,
-						operation: "DEPLOY",
-						platform,
-						revision: 1,
-						rollout_cohort_count: policy.rolloutCohortCount ?? 1e3,
-						scope_key: scope.scopeKey,
-						should_force_update: policy.shouldForceUpdate,
-						source_release_id: null,
-						strategy: scope.strategy,
-						target_app_version: policy.targetAppVersion,
-						target_cohorts: policy.targetCohorts ?? [],
-						updated_at_ms: updatedAtMs
-					}
-				},
-				updatedAtMs
+		if (latest !== null && id <= latest) fail$1("NON_MONOTONIC_RELEASE_ID", `Release "${id}" must sort after "${latest}"`);
+		release = {
+			...change.row,
+			id
+		};
+		if (release.scope_key !== scope.scopeKey || release.channel_id !== scope.channelId || release.platform !== scope.platform || release.strategy !== scope.strategy || release.fingerprint_hash !== scope.fingerprintHash || release.revision !== 1) fail$1("INVALID_SCOPE", "Inserted Release does not match its catalog scope");
+		tx.create("releases", release);
+	} else {
+		const row = await tx.findOne("releases", { id: change.id });
+		if (row === null || row.scope_key !== scope.scopeKey) return fail$1("RELEASE_NOT_FOUND", `Release "${change.id}" was not found in scope "${scope.scopeKey}"`);
+		assertHistory(stored, true);
+		before = toReleaseRow(row);
+		if (change.operation === "delete") {
+			await tx.delete("releases", row);
+			release = null;
+		} else {
+			const set = {
+				...change.update,
+				revision: before.revision + 1
 			};
-		}))).map(mutationResult);
+			tx.update("releases", row, set);
+			release = {
+				...before,
+				...set
+			};
+		}
+	}
+	const changedId = before?.id ?? release?.id;
+	const { catalog, compilation } = await writeCatalog(tx, scope, stored, [...enabled.filter(({ id }) => id !== changedId), ...release?.enabled ? [release] : []].sort((left, right) => left.id < right.id ? -1 : 1), updatedAtMs);
+	return {
+		catalog,
+		release,
+		diagnostics: compilation.diagnostics
+	};
+};
+/**
+* Release changes rooted at their catalogs: each reads its scope's catalog
+* and enabled releases, applies the change, and writes the next catalog
+* generation, all in one transaction. A concurrent change in a scope bumps
+* its catalog row, so this transaction reruns instead of publishing a stale
+* catalog.
+*/
+var changeReleases = (db, inputs) => {
+	if (new Set(inputs.map(({ scope }) => scope.scopeKey)).size !== inputs.length) fail$1("INVALID_SCOPE", "A batch cannot change one catalog scope twice");
+	return db.transaction(async (tx) => {
+		const results = [];
+		for (const input of inputs) results.push(await changeRelease(tx, input));
+		return results;
+	});
+};
+/** Recompiles a scope's catalog from its enabled releases inside `tx`; an unchanged catalog is not rewritten. */
+var rebuildScope = async (tx, scope, updatedAtMs) => {
+	checkScope(scope);
+	const stored = await readCatalog(tx, scope.scopeKey);
+	assertHistory(stored, await latestReleaseId(tx, scope.scopeKey) !== null);
+	const enabled = await enabledReleases(tx, scope.scopeKey);
+	const compilation = await compileReleaseCatalog({
+		strategy: scope.strategy,
+		releases: enabled.map(releaseRowToRelease)
+	});
+	const current = stored.catalog;
+	if (current !== null && current.strategy === scope.strategy && current.channel_id === scope.channelId && current.channel_key === encodeChannelKey(scope.channelName) && current.platform === scope.platform && current.fingerprint_hash === scope.fingerprintHash && current.catalog_hash === compilation.catalogHash) return {
+		catalog: current,
+		current,
+		changed: false,
+		diagnostics: compilation.diagnostics
 	};
+	const written = await writeCatalog(tx, scope, stored, enabled, updatedAtMs);
 	return {
-		deploy: (deployments) => withChannels(() => deployOnce(deployments)),
-		updateReleasePolicy: (input) => {
-			const updatedAtMs = now();
-			return db.transaction(async (tx) => {
-				const { release, scope } = await loadTarget(tx, input);
-				return mutationResult(await changeRelease(tx, {
-					scope,
-					change: {
-						operation: "update",
-						id: release.id,
-						update: policyUpdate(release, input.patch, updatedAtMs)
-					},
-					updatedAtMs
-				}));
-			});
-		},
-		preflightReleasePolicy: (input) => {
-			const updatedAtMs = now();
-			return dryRun(db, async (tx) => {
-				const { release, scope } = await loadTarget(tx, input);
-				const stored = await readCatalog(tx, scope.scopeKey);
-				const changed = await changeRelease(tx, {
-					scope,
-					change: {
-						operation: "update",
-						id: release.id,
-						update: policyUpdate(release, input.patch, updatedAtMs)
-					},
-					updatedAtMs
-				});
-				return {
-					catalog: changed.catalog,
-					currentCatalog: stored.catalog,
-					diagnostics: changed.diagnostics,
-					expectedReleaseRevision: release.revision,
-					release: changed.release
-				};
-			});
-		},
-		deleteRelease: (input) => db.transaction(async (tx) => {
-			const { release, scope } = await loadTarget(tx, input);
-			if (release.enabled) throw new ReleaseManagementError("ENABLED_RELEASE", `Disable Release "${release.id}" before hard deletion.`);
-			return mutationResult(await changeRelease(tx, {
-				scope,
-				change: {
-					operation: "delete",
-					id: release.id
-				},
-				updatedAtMs: now()
-			}));
-		}),
-		promoteRelease: (input) => withChannels(async () => {
-			const checkSource = (source) => {
-				if (source.kind !== "BUNDLE" || source.bundle_id === null) throw new ReleaseManagementError("TARGET_RELEASE_INVALID", "Only a Bundle Release can be promoted.");
-			};
-			checkSource((await db.transaction((tx) => loadTarget(tx, input))).release);
-			const targetChannel = input.targetChannel.trim();
-			if (targetChannel.length === 0) throw new ReleaseManagementError("TARGET_RELEASE_INVALID", "Promotion requires a target channel.");
-			const channel = await ensureChannel(targetChannel);
-			const updatedAtMs = now();
-			return db.transaction(async (tx) => {
-				const { release: source, scope: sourceScope } = await loadTarget(tx, input);
-				checkSource(source);
-				const targetScope = scopeOf(channel, source.platform, source.fingerprint_hash);
-				if (targetScope.scopeKey === sourceScope.scopeKey) throw new ReleaseManagementError("TARGET_RELEASE_INVALID", "Source and target Release scopes are the same.");
-				const { rows } = await tx.findMany("releases", {
-					index: "byScope",
-					where: { scope_key: targetScope.scopeKey },
-					order: "desc",
-					limit: 1
-				});
-				const floor = [
-					rows[0]?.id ?? null,
-					source.id,
-					source.bundle_id
-				].filter((id) => id !== null && isUUIDv7(id)).sort().at(-1);
-				const moved = input.action === "move" ? await changeRelease(tx, {
-					scope: sourceScope,
-					change: {
-						operation: "update",
-						id: source.id,
-						update: {
-							enabled: false,
-							updated_at_ms: updatedAtMs
-						}
-					},
-					updatedAtMs
-				}) : null;
-				const target = await changeRelease(tx, {
-					scope: targetScope,
-					change: {
-						operation: "insert",
-						row: {
-							...source,
-							id: createUUIDv7After(floor ?? null, updatedAtMs),
-							revision: 1,
-							scope_key: targetScope.scopeKey,
-							channel_id: targetScope.channelId,
-							enabled: true,
-							rollout_cohort_count: 1e3,
-							target_cohorts: [],
-							operation: "PROMOTE",
-							source_release_id: source.id,
-							created_at_ms: updatedAtMs,
-							updated_at_ms: updatedAtMs
-						}
-					},
-					updatedAtMs
-				});
-				return {
-					source: moved === null ? null : mutationResult(moved),
-					target: mutationResult(target)
-				};
-			});
+		catalog: written.catalog,
+		current,
+		changed: true,
+		diagnostics: written.compilation.diagnostics
+	};
+};
+/** Carries a preflight's result out of the transaction it stops, so nothing is written. */
+var Preflight = class extends Error {
+	result;
+	constructor(result) {
+		super("preflight");
+		this.result = result;
+	}
+};
+var dryRun = async (db, read) => {
+	try {
+		await db.transaction(async (tx) => {
+			throw new Preflight(await read(tx));
+		});
+	} catch (error) {
+		if (error instanceof Preflight) return error.result;
+		throw error;
+	}
+	throw new Error("A preflight transaction returned without its result.");
+};
+/** A channel's catalog scope for a platform, and a fingerprint when it has one. */
+var scopeOf = (channel, platform, fingerprintHash) => {
+	const channelKey = encodeChannelKey(channel.name);
+	return fingerprintHash === null ? {
+		channelId: channel.id,
+		channelName: channel.name,
+		fingerprintHash,
+		platform,
+		scopeKey: createReleaseCatalogScopeKey({
+			channelKey,
+			platform,
+			strategy: "APP_VERSION"
 		}),
-		rebuildReleaseCatalog: (scopeKey) => {
-			const updatedAtMs = now();
-			return db.transaction(async (tx) => {
-				const { current: _current, ...rebuilt } = await rebuildScope(tx, await catalogScope(tx, scopeKey), updatedAtMs);
-				return {
-					attempts: 1,
-					...rebuilt
-				};
-			});
-		},
-		preflightReleaseCatalogRebuild: (scopeKey) => {
-			const updatedAtMs = now();
-			return dryRun(db, async (tx) => {
-				const rebuilt = await rebuildScope(tx, await catalogScope(tx, scopeKey), updatedAtMs);
-				return {
-					changed: rebuilt.changed,
-					currentCatalog: rebuilt.current,
-					diagnostics: rebuilt.diagnostics,
-					projectedCatalog: rebuilt.catalog
-				};
-			});
-		},
-		ensureChannel,
-		deleteChannel: (id) => deleteChannel(db, id),
-		updateBundle: (id, update) => db.transaction(async (tx) => {
-			const current = await tx.findOne("bundles", { id });
-			if (current === null) throw new DatabaseBundleNotFoundError(id);
-			const { patches, ...fields } = update;
-			const next = {
-				...rowToBundle(toBundleRow(current)),
-				...fields,
-				id
-			};
-			const { id: _id, ...set } = bundleToRow(next);
-			updateBundle(tx, current, set);
-			if (patches !== void 0) await replaceBundlePatches(tx, current, bundleToPatchRows({
-				...next,
-				patches
-			}));
+		strategy: "APP_VERSION"
+	} : {
+		channelId: channel.id,
+		channelName: channel.name,
+		fingerprintHash,
+		platform,
+		scopeKey: createReleaseCatalogScopeKey({
+			channelKey,
+			fingerprintHash,
+			platform,
+			strategy: "FINGERPRINT"
 		}),
-		deleteBundles: async (ids) => {
-			try {
-				await db.transaction(async (tx) => {
-					for (const id of new Set(ids)) {
-						const current = await tx.findOne("bundles", { id });
-						if (current !== null) await deleteBundle(tx, current);
-					}
-				});
-			} catch (error) {
-				if (error instanceof DatabaseConstraintError && error.reason === "referenced") throw new DatabaseRowReferencedError();
-				throw error;
-			}
+		strategy: "FINGERPRINT"
+	};
+};
+/** A release and its scope, checked against the revision the caller saw. */
+var loadTarget = async (tx, { releaseId, expectedRevision }) => {
+	const row = await tx.findOne("releases", { id: releaseId });
+	if (row === null) throw new ReleaseManagementError("RELEASE_NOT_FOUND", `Release "${releaseId}" was not found.`);
+	const release = toReleaseRow(row);
+	if (expectedRevision !== void 0 && expectedRevision !== release.revision) throw new ReleaseManagementError("VERSION_CONFLICT", `Release "${release.id}" is revision ${release.revision}; expected ${expectedRevision}.`);
+	const catalog = await tx.findOne("release_catalogs", { scope_key: release.scope_key });
+	if (catalog === null) throw new ReleaseCatalogMutationError("INVALID_SCOPE", `Release "${release.id}" has no catalog projection.`);
+	return {
+		release,
+		scope: {
+			channelId: release.channel_id,
+			channelName: decodeChannelKey(catalog.channel_key),
+			fingerprintHash: release.fingerprint_hash,
+			platform: release.platform,
+			scopeKey: release.scope_key,
+			strategy: release.strategy
 		}
 	};
 };
-/** A channel's id is `channel:` and its name's channel key, so ids share channel_key's bound. */
-var CHANNEL_ID = {
-	type: "string",
-	maxLength: 1408,
-	ascii: true
+var policyUpdate = (release, patch, updatedAtMs) => {
+	if (patch.fingerprintHash !== void 0 && patch.fingerprintHash !== release.fingerprint_hash) throw new ReleaseManagementError("SCOPE_MOVE_UNSUPPORTED", "Changing a fingerprint target requires an atomic Release scope move.");
+	return {
+		...patch.enabled === void 0 ? {} : { enabled: patch.enabled },
+		...patch.message === void 0 ? {} : { message: patch.message },
+		...patch.rolloutCohortCount === void 0 ? {} : { rollout_cohort_count: patch.rolloutCohortCount },
+		...patch.shouldForceUpdate === void 0 ? {} : { should_force_update: patch.shouldForceUpdate },
+		...patch.targetAppVersion === void 0 ? {} : { target_app_version: patch.targetAppVersion },
+		...patch.targetCohorts === void 0 ? {} : { target_cohorts: [...patch.targetCohorts] },
+		updated_at_ms: updatedAtMs
+	};
 };
-/** Core's module: always installed, never a plugin. */
-var coreModule = {
-	id: "core",
-	schema: {
-		bundles: defineTable({
-			id: {
-				type: "string",
-				maxLength: 36
-			},
-			platform: {
-				type: "string",
-				maxLength: 16
-			},
-			git_commit_hash: {
-				type: "string",
-				maxLength: 255,
-				required: false
-			},
-			metadata: { type: "json" },
-			manifest_storage_uri: { type: "string" },
-			manifest_file_hash: { type: "string" },
-			asset_base_storage_uri: { type: "string" }
-		}, {
-			key: ["id"],
-			indexes: {
-				byPlatform: {
-					eq: ["platform"],
-					sort: ["id"]
-				},
-				all: {
-					eq: [],
-					sort: ["id"]
-				}
-			}
-		}),
-		bundle_patches: defineTable({
-			id: {
-				type: "string",
-				maxLength: 255
-			},
-			bundle_id: {
-				type: "string",
-				maxLength: 36,
-				references: {
-					model: "bundles",
-					onDelete: "cascade"
-				}
-			},
-			base_bundle_id: {
-				type: "string",
-				maxLength: 36,
-				references: {
-					model: "bundles",
-					onDelete: "cascade"
-				}
-			},
-			base_file_hash: { type: "string" },
-			patch_file_hash: { type: "string" },
-			patch_storage_uri: { type: "string" },
-			byte_size: { type: "integer" },
-			order_index: { type: "integer" }
-		}, {
-			key: ["id"],
-			indexes: {
-				pair: {
-					eq: ["bundle_id", "base_bundle_id"],
-					sort: [],
-					unique: true
-				},
-				byBundle: {
-					eq: ["bundle_id"],
-					sort: ["order_index"],
-					root: { model: "bundles" }
-				},
-				byBase: {
-					eq: ["base_bundle_id"],
-					sort: ["bundle_id"]
-				}
-			}
-		}),
-		releases: defineTable({
-			id: {
-				type: "string",
-				maxLength: 36
-			},
-			revision: { type: "integer" },
-			scope_key: {
-				type: "string",
-				maxLength: 2048,
-				ascii: true
-			},
-			channel_id: {
-				...CHANNEL_ID,
-				references: {
-					model: "channels",
-					onDelete: "restrict"
-				}
-			},
-			platform: {
-				type: "string",
-				maxLength: 16
-			},
-			kind: {
-				type: "string",
-				maxLength: 16
-			},
-			bundle_id: {
-				type: "string",
-				maxLength: 36,
-				required: false,
-				references: {
-					model: "bundles",
-					onDelete: "restrict"
-				}
-			},
-			strategy: {
-				type: "string",
-				maxLength: 16
-			},
-			target_app_version: {
-				type: "string",
-				required: false
-			},
-			fingerprint_hash: {
-				type: "string",
-				maxLength: 255,
-				required: false
-			},
-			enabled: { type: "boolean" },
-			should_force_update: { type: "boolean" },
-			message: {
-				type: "string",
-				required: false
-			},
-			rollout_cohort_count: { type: "integer" },
-			target_cohorts: { type: "json" },
-			operation: {
-				type: "string",
-				maxLength: 16
-			},
-			source_release_id: {
-				type: "string",
-				maxLength: 36,
-				required: false,
-				references: {
-					model: "releases",
-					onDelete: "none"
-				}
-			},
-			created_at_ms: { type: "integer" },
-			updated_at_ms: { type: "integer" }
-		}, {
-			key: ["id"],
-			indexes: {
-				byScope: {
-					eq: ["scope_key"],
-					sort: ["id"],
-					root: { model: "release_catalogs" }
-				},
-				byScopeEnabled: {
-					eq: ["scope_key", "enabled"],
-					sort: ["id"],
-					root: { model: "release_catalogs" }
-				},
-				byChannelPlatform: {
-					eq: ["channel_id", "platform"],
-					sort: ["id"]
-				},
-				byChannelPlatformEnabled: {
-					eq: [
-						"channel_id",
-						"platform",
-						"enabled"
-					],
-					sort: ["id"]
+var mutationResult = ({ catalog, release }) => ({
+	attempts: 1,
+	catalog,
+	release
+});
+/** The scope a catalog row names, for a rebuild. */
+var catalogScope = async (tx, scopeKey) => {
+	const row = await tx.findOne("release_catalogs", { scope_key: scopeKey });
+	if (row === null) throw new Error(`Release catalog "${scopeKey}" was not found.`);
+	return {
+		channelId: row.channel_id,
+		channelName: decodeChannelKey(row.channel_key),
+		fingerprintHash: row.fingerprint_hash,
+		platform: row.platform,
+		scopeKey: row.scope_key,
+		strategy: row.strategy
+	};
+};
+/**
+* Core's typed writes: each runs in one engine transaction rooted at the
+* catalogs it changes, so a concurrent change reruns it instead of
+* publishing a stale catalog.
+*/
+var createCoreOperations = (db, { now = Date.now } = {}) => {
+	const ensureChannel = async (name) => (await insertChannel(db, {
+		id: `channel:${encodeChannelKey(name)}`,
+		name
+	})).row;
+	/**
+	* Runs a write that ensured its channels first. A channel deleted between
+	* that and the write refuses the write, so it runs again and ensures it anew.
+	*/
+	const withChannels = async (write) => {
+		for (let attempt = 1;; attempt += 1) try {
+			return await write();
+		} catch (error) {
+			if (attempt < 3 && error instanceof DatabaseConstraintError && error.reason === "not_found" && error.model === "channels") continue;
+			throw error;
+		}
+	};
+	const deployOnce = async (deployments) => {
+		const channels = /* @__PURE__ */ new Map();
+		for (const { release } of deployments) if (!channels.has(release.channel)) channels.set(release.channel, await ensureChannel(release.channel));
+		const platforms = /* @__PURE__ */ new Map();
+		for (const deployment of deployments) {
+			if (!("bundleId" in deployment) || platforms.has(deployment.bundleId)) continue;
+			const row = await db.findOne("bundles", { id: deployment.bundleId });
+			if (row === null) throw new DatabaseBundleNotFoundError(deployment.bundleId);
+			platforms.set(deployment.bundleId, toBundleRow(row).platform);
+		}
+		const updatedAtMs = now();
+		return (await changeReleases(db, deployments.map((deployment) => {
+			const { release: policy } = deployment;
+			const stored = "bundleId" in deployment;
+			const bundleId = stored ? deployment.bundleId : deployment.bundle.id;
+			const platform = stored ? platforms.get(deployment.bundleId) : deployment.bundle.platform;
+			const scope = scopeOf(channels.get(policy.channel), platform, policy.fingerprintHash);
+			return {
+				scope,
+				...stored ? {} : { bundle: {
+					row: bundleToRow(deployment.bundle),
+					patches: bundleToPatchRows(deployment.bundle)
+				} },
+				change: {
+					operation: "insert",
+					row: {
+						bundle_id: bundleId,
+						channel_id: scope.channelId,
+						created_at_ms: updatedAtMs,
+						enabled: policy.enabled,
+						fingerprint_hash: policy.fingerprintHash,
+						kind: "BUNDLE",
+						message: policy.message,
+						operation: "DEPLOY",
+						platform,
+						revision: 1,
+						rollout_cohort_count: policy.rolloutCohortCount ?? 1e3,
+						scope_key: scope.scopeKey,
+						should_force_update: policy.shouldForceUpdate,
+						source_release_id: null,
+						strategy: scope.strategy,
+						target_app_version: policy.targetAppVersion,
+						target_cohorts: policy.targetCohorts ?? [],
+						updated_at_ms: updatedAtMs
+					}
 				},
-				byBundle: {
-					eq: ["bundle_id"],
-					sort: ["id"]
+				updatedAtMs
+			};
+		}))).map(mutationResult);
+	};
+	return {
+		deploy: (deployments) => withChannels(() => deployOnce(deployments)),
+		updateReleasePolicy: (input) => {
+			const updatedAtMs = now();
+			return db.transaction(async (tx) => {
+				const { release, scope } = await loadTarget(tx, input);
+				return mutationResult(await changeRelease(tx, {
+					scope,
+					change: {
+						operation: "update",
+						id: release.id,
+						update: policyUpdate(release, input.patch, updatedAtMs)
+					},
+					updatedAtMs
+				}));
+			});
+		},
+		preflightReleasePolicy: (input) => {
+			const updatedAtMs = now();
+			return dryRun(db, async (tx) => {
+				const { release, scope } = await loadTarget(tx, input);
+				const stored = await readCatalog(tx, scope.scopeKey);
+				const changed = await changeRelease(tx, {
+					scope,
+					change: {
+						operation: "update",
+						id: release.id,
+						update: policyUpdate(release, input.patch, updatedAtMs)
+					},
+					updatedAtMs
+				});
+				return {
+					catalog: changed.catalog,
+					currentCatalog: stored.catalog,
+					diagnostics: changed.diagnostics,
+					expectedReleaseRevision: release.revision,
+					release: changed.release
+				};
+			});
+		},
+		deleteRelease: (input) => db.transaction(async (tx) => {
+			const { release, scope } = await loadTarget(tx, input);
+			if (release.enabled) throw new ReleaseManagementError("ENABLED_RELEASE", `Disable Release "${release.id}" before hard deletion.`);
+			const bundle = release.bundle_id === null ? null : await tx.findOne("bundles", { id: release.bundle_id });
+			const result = mutationResult(await changeRelease(tx, {
+				scope,
+				change: {
+					operation: "delete",
+					id: release.id
 				},
-				all: {
-					eq: [],
-					sort: ["id"]
-				}
-			}
+				updatedAtMs: now()
+			}));
+			if (bundle !== null && (bundle._refs_releases_bundle_id ?? 0) <= 1) await deleteBundle(tx, bundle);
+			return result;
 		}),
-		release_catalogs: defineTable({
-			scope_key: {
-				type: "string",
-				maxLength: 2048,
-				ascii: true
-			},
-			catalog_id: {
-				type: "string",
-				maxLength: 255
-			},
-			strategy: {
-				type: "string",
-				maxLength: 16
-			},
-			channel_id: {
-				...CHANNEL_ID,
-				references: {
-					model: "channels",
-					onDelete: "none"
-				}
-			},
-			channel_key: {
-				type: "string",
-				maxLength: 1400,
-				ascii: true
-			},
-			platform: {
-				type: "string",
-				maxLength: 16
-			},
-			fingerprint_hash: {
-				type: "string",
-				maxLength: 255,
-				required: false
-			},
-			generation: { type: "integer" },
-			payload: { type: "string" },
-			catalog_hash: {
-				type: "string",
-				maxLength: 71
-			},
-			byte_size: { type: "integer" },
-			is_tombstone: { type: "boolean" },
-			updated_at_ms: { type: "integer" }
-		}, {
-			key: ["scope_key"],
-			indexes: { all: {
-				eq: [],
-				sort: ["scope_key"]
-			} }
+		promoteRelease: (input) => withChannels(async () => {
+			const checkSource = (source) => {
+				if (source.kind !== "BUNDLE" || source.bundle_id === null) throw new ReleaseManagementError("TARGET_RELEASE_INVALID", "Only a Bundle Release can be promoted.");
+			};
+			checkSource((await db.transaction((tx) => loadTarget(tx, input))).release);
+			const targetChannel = input.targetChannel.trim();
+			if (targetChannel.length === 0) throw new ReleaseManagementError("TARGET_RELEASE_INVALID", "Promotion requires a target channel.");
+			const channel = await ensureChannel(targetChannel);
+			const updatedAtMs = now();
+			return db.transaction(async (tx) => {
+				const { release: source, scope: sourceScope } = await loadTarget(tx, input);
+				checkSource(source);
+				const targetScope = scopeOf(channel, source.platform, source.fingerprint_hash);
+				if (targetScope.scopeKey === sourceScope.scopeKey) throw new ReleaseManagementError("TARGET_RELEASE_INVALID", "Source and target Release scopes are the same.");
+				const { rows } = await tx.findMany("releases", {
+					index: "byScope",
+					where: { scope_key: targetScope.scopeKey },
+					order: "desc",
+					limit: 1
+				});
+				const floor = [
+					rows[0]?.id ?? null,
+					source.id,
+					source.bundle_id
+				].filter((id) => id !== null && isUUIDv7(id)).sort().at(-1);
+				const moved = input.action === "move" ? await changeRelease(tx, {
+					scope: sourceScope,
+					change: {
+						operation: "update",
+						id: source.id,
+						update: {
+							enabled: false,
+							updated_at_ms: updatedAtMs
+						}
+					},
+					updatedAtMs
+				}) : null;
+				const target = await changeRelease(tx, {
+					scope: targetScope,
+					change: {
+						operation: "insert",
+						row: {
+							...source,
+							id: createUUIDv7After(floor ?? null, updatedAtMs),
+							revision: 1,
+							scope_key: targetScope.scopeKey,
+							channel_id: targetScope.channelId,
+							enabled: true,
+							rollout_cohort_count: 1e3,
+							target_cohorts: [],
+							operation: "PROMOTE",
+							source_release_id: source.id,
+							created_at_ms: updatedAtMs,
+							updated_at_ms: updatedAtMs
+						}
+					},
+					updatedAtMs
+				});
+				return {
+					source: moved === null ? null : mutationResult(moved),
+					target: mutationResult(target)
+				};
+			});
+		}),
+		rebuildReleaseCatalog: (scopeKey) => {
+			const updatedAtMs = now();
+			return db.transaction(async (tx) => {
+				const { current: _current, ...rebuilt } = await rebuildScope(tx, await catalogScope(tx, scopeKey), updatedAtMs);
+				return {
+					attempts: 1,
+					...rebuilt
+				};
+			});
+		},
+		preflightReleaseCatalogRebuild: (scopeKey) => {
+			const updatedAtMs = now();
+			return dryRun(db, async (tx) => {
+				const rebuilt = await rebuildScope(tx, await catalogScope(tx, scopeKey), updatedAtMs);
+				return {
+					changed: rebuilt.changed,
+					currentCatalog: rebuilt.current,
+					diagnostics: rebuilt.diagnostics,
+					projectedCatalog: rebuilt.catalog
+				};
+			});
+		},
+		ensureChannel,
+		deleteChannel: (id) => deleteChannel(db, id),
+		updateBundle: (id, update) => db.transaction(async (tx) => {
+			const current = await tx.findOne("bundles", { id });
+			if (current === null) throw new DatabaseBundleNotFoundError(id);
+			const { patches, ...fields } = update;
+			const next = {
+				...rowToBundle(toBundleRow(current)),
+				...fields,
+				id
+			};
+			const { id: _id, ...set } = bundleToRow(next);
+			updateBundle(tx, current, set);
+			if (patches !== void 0) await replaceBundlePatches(tx, current, bundleToPatchRows({
+				...next,
+				patches
+			}));
 		}),
-		channels: defineTable({
-			id: CHANNEL_ID,
-			name: {
-				type: "string",
-				maxLength: 255,
-				unique: true
+		deleteBundles: async (ids) => {
+			try {
+				await db.transaction(async (tx) => {
+					for (const id of new Set(ids)) {
+						const current = await tx.findOne("bundles", { id });
+						if (current !== null) await deleteBundle(tx, current);
+					}
+				});
+			} catch (error) {
+				if (error instanceof DatabaseConstraintError && error.reason === "referenced") throw new DatabaseRowReferencedError();
+				throw error;
 			}
-		}, {
-			key: ["id"],
-			indexes: { all: {
-				eq: [],
-				sort: ["name"]
-			} }
-		}),
-		bundle_totals: defineAggregate({ platform_key: {
-			type: "string",
-			maxLength: 16
-		} }, {
-			key: ["platform_key"],
-			counters: ["bundles"],
-			indexes: { byPlatform: {
-				eq: ["platform_key"],
-				sort: []
-			} }
-		})
-	}
+		}
+	};
 };
 /**
 * The update check answers from one Release Catalog row, so a transaction
@@ -4168,14 +4662,911 @@ var createCoreApi = (db, storage, options = {}) => {
 		}
 	};
 };
+var PLUGIN_KEYS = /* @__PURE__ */ new Set([
+	"id",
+	"provides",
+	"schemaVersion",
+	"schema",
+	"namespace",
+	"init",
+	"cli"
+]);
+var CLI_KEYS = /* @__PURE__ */ new Set(["clientCredential", "clientPlugin"]);
+var INSTANCE_KEYS = /* @__PURE__ */ new Set([
+	"api",
+	"endpoints",
+	"clientAuth"
+]);
+var METHODS = /* @__PURE__ */ new Set([
+	"GET",
+	"POST",
+	"PUT",
+	"PATCH",
+	"DELETE"
+]);
+/** An id that prefixes table names is a SQL name; one that does not may use camelCase. */
+var PREFIX_ID = /^[a-z][a-z0-9_]*$/u;
+var UNPREFIXED_ID = /^[a-z][A-Za-z0-9_]*$/u;
+var PATH = /^(\/(:?[A-Za-z0-9_.~-]+))+$/u;
+var fail = (message) => {
+	throw new HotUpdaterConfigError(message);
+};
+var isRecord$2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var checkPlugin = (value, at) => {
+	if (!isRecord$2(value)) return fail(`${at} is not a plugin.`);
+	if ("kind" in value) fail(`${at} has a kind; core is built in and is never passed as a plugin.`);
+	const unknown = Object.keys(value).find((key) => !PLUGIN_KEYS.has(key));
+	if (unknown !== void 0) fail(`${at} has an unknown key "${unknown}".`);
+	const plugin = value;
+	if (plugin.namespace !== void 0 && plugin.namespace !== false) fail(`${at} may only set namespace: false.`);
+	const pattern = plugin.namespace === false ? UNPREFIXED_ID : PREFIX_ID;
+	if (typeof plugin.id !== "string" || !pattern.test(plugin.id)) fail(`${at} needs an id matching ${pattern.source}.`);
+	if (plugin.id === "core") fail(`${at} uses the id "core", which is core's own.`);
+	checkReservedId(value, at);
+	if (typeof plugin.schemaVersion !== "string" || !isRecord$2(plugin.schema) || typeof plugin.init !== "function") fail(`Plugin "${plugin.id}" needs a schemaVersion, a schema, and init.`);
+	const provides = plugin.provides;
+	if (provides !== void 0 && (!isRecord$2(provides) || Object.entries(provides).some(([key, flag]) => key !== "clientAuth" || flag !== true))) fail(`Plugin "${plugin.id}" may only declare provides: { clientAuth: true }.`);
+	const cli = value.cli;
+	if (cli !== void 0) {
+		if (!isRecord$2(cli) || Object.keys(cli).some((key) => !CLI_KEYS.has(key))) fail(`Plugin "${plugin.id}" cli may only hold clientCredential and clientPlugin.`);
+		if (cli.clientCredential !== void 0 && plugin.provides?.clientAuth !== true) fail(`Plugin "${plugin.id}" adds cli.clientCredential without declaring provides: { clientAuth: true }.`);
+	}
+	return plugin;
+};
+var checkEndpoint = (id, value) => {
+	const endpoint = isRecord$2(value) ? value : {};
+	if (!METHODS.has(endpoint.method) || typeof endpoint.path !== "string" || !PATH.test(endpoint.path) || endpoint.access !== "client" && endpoint.access !== "admin" || typeof endpoint.handler !== "function") fail(`Plugin "${id}" has an endpoint that needs a method, a path like /name/:param, access "client" or "admin", and a handler.`);
+	return {
+		...endpoint,
+		plugin: id
+	};
+};
+var checkInstance = (plugin, instance) => {
+	const { id } = plugin;
+	if (!isRecord$2(instance)) return fail(`Plugin "${id}" init returned no instance.`);
+	if (typeof instance.then === "function") fail(`Plugin "${id}" init returned a promise; init must be synchronous.`);
+	const unknown = Object.keys(instance).find((key) => !INSTANCE_KEYS.has(key));
+	if (unknown !== void 0 || !("api" in instance)) fail(`Plugin "${id}" init must return { api, endpoints?, clientAuth? }${unknown === void 0 ? "" : `, not "${unknown}"`}.`);
+	const declared = plugin.provides?.clientAuth === true;
+	const clientAuth = instance.clientAuth;
+	if (declared !== (clientAuth !== void 0)) fail(declared ? `Plugin "${id}" declares provides: { clientAuth: true } but its instance has no clientAuth.` : `Plugin "${id}" returns clientAuth without declaring provides: { clientAuth: true }.`);
+	if (clientAuth !== void 0 && (typeof clientAuth.authenticate !== "function" || !Array.isArray(clientAuth.varyHeaders) || !clientAuth.varyHeaders.every((header) => typeof header === "string"))) fail(`Plugin "${id}" clientAuth needs varyHeaders and authenticate.`);
+	const endpoints = instance.endpoints ?? [];
+	if (!Array.isArray(endpoints)) fail(`Plugin "${id}" endpoints must be an array.`);
+	return {
+		api: instance.api,
+		clientAuth,
+		endpoints: endpoints.map((endpoint) => checkEndpoint(id, endpoint))
+	};
+};
+/**
+* Checks every plugin, runs each `init` once against one engine over the
+* database, and collects APIs, endpoints, and clientAuth. Core's reads run
+* on the same engine, so plugins read core through `ctx.core`.
+*/
+var assemblePlugins = (value, database, { now = Date.now, storage = { resolveFileUrl: async () => null } } = {}) => {
+	if (!Array.isArray(value)) return fail("plugins must be an array of plugins.");
+	const plugins = value.map((plugin, position) => checkPlugin(plugin, `plugins[${position}]`));
+	const ids = /* @__PURE__ */ new Set();
+	for (const { id } of plugins) {
+		if (ids.has(id)) fail(`Plugin "${id}" is registered twice.`);
+		ids.add(id);
+	}
+	clientPluginsOf(plugins);
+	const engine = createEngine(database, {
+		plugins,
+		now
+	});
+	const { onCachedRoutesChange } = database;
+	const core = createCoreApi(engine.core, storage, {
+		now,
+		...onCachedRoutesChange === void 0 ? {} : { onCachedRoutesChange: () => onCachedRoutesChange.call(database) }
+	});
+	const reads = createCoreReads(engine.core, storage);
+	const api = {};
+	const endpoints = [];
+	let clientAuth;
+	for (const plugin of plugins) {
+		const instance = checkInstance(plugin, plugin.init({
+			db: engine.database(plugin),
+			core: reads,
+			now
+		}));
+		if (instance.clientAuth !== void 0) {
+			if (clientAuth !== void 0) fail(`Plugins "${clientAuth.plugin}" and "${plugin.id}" both provide clientAuth; keep one.`);
+			const provided = instance.clientAuth;
+			clientAuth = {
+				plugin: plugin.id,
+				varyHeaders: provided.varyHeaders,
+				authenticate: (headers) => provided.authenticate(headers)
+			};
+		}
+		endpoints.push(...instance.endpoints);
+		api[plugin.id] = instance.api;
+	}
+	return {
+		core,
+		api,
+		endpoints,
+		...clientAuth === void 0 ? {} : { clientAuth },
+		flush: engine.flush
+	};
+};
+var HandlerBadRequestError = class extends Error {
+	name = "HandlerBadRequestError";
+	constructor(message) {
+		super(message);
+	}
+};
+var decodeMaybe = (value) => {
+	if (value === void 0) return void 0;
+	try {
+		return decodeURIComponent(value);
+	} catch {
+		return value;
+	}
+};
+var isPlatform = (value) => value === "ios" || value === "android";
+var requireRouteParam = (params, key) => {
+	const value = params[key];
+	if (!value) throw new HandlerBadRequestError(`Missing route parameter: ${key}`);
+	return value;
+};
+var requirePlatformParam = (params) => {
+	const platform = requireRouteParam(params, "platform");
+	if (!isPlatform(platform)) throw new HandlerBadRequestError(`Invalid platform: ${platform}. Expected 'ios' or 'android'.`);
+	return platform;
+};
+var parseBooleanSearchParam = (url, key) => {
+	const value = url.searchParams.get(key);
+	if (value === null) return void 0;
+	if (value === "true") return true;
+	if (value === "false") return false;
+	throw new HandlerBadRequestError(`The '${key}' query parameter must be 'true' or 'false'.`);
+};
+var json = (body, status = 200) => Response.json(body, { status });
+var notFound = () => json({ error: "Not found" }, 404);
+var noContent = () => new Response(null, { status: 204 });
+/** Runs `route` on core, answering its refusals. */
+var onCore = (route) => async (params, request, api) => answer(() => route(api.core, request, params));
+/** Core's refusals as HTTP answers; anything else is a server error. */
+var answer = async (operation) => {
+	try {
+		return await operation();
+	} catch (error) {
+		if (error instanceof ReleaseManagementError || error instanceof ReleaseCatalogMutationError) {
+			const status = error.code === "RELEASE_NOT_FOUND" ? 404 : error.code === "VERSION_CONFLICT" ? 409 : 400;
+			return json({
+				code: error.code,
+				error: error.message
+			}, status);
+		}
+		if (error instanceof DatabaseBundleNotFoundError) return json({
+			code: "BUNDLE_NOT_FOUND",
+			error: error.message
+		}, 404);
+		if (error instanceof DatabaseRowReferencedError) return json({
+			code: "REFERENCED",
+			error: error.message
+		}, 409);
+		throw error;
+	}
+};
+var LIMITS = {
+	defaultValue: 50,
+	maxValue: 500
+};
+/** `order`, `cursor`, and `limit`: one keyset page. */
+var keyset = (url, maxValue = LIMITS.maxValue) => {
+	const order = url.searchParams.get("order") ?? "desc";
+	if (order !== "asc" && order !== "desc") throw new HandlerBadRequestError("order must be 'asc' or 'desc'.");
+	const limitParam = url.searchParams.get("limit");
+	const limit = limitParam === null ? Math.min(LIMITS.defaultValue, maxValue) : Number(limitParam);
+	if (!Number.isSafeInteger(limit) || limit < 1 || limit > maxValue) throw new HandlerBadRequestError(`limit must be between 1 and ${maxValue}.`);
+	const cursor = url.searchParams.get("cursor");
+	return {
+		order,
+		limit,
+		...cursor === null ? {} : { after: cursor }
+	};
+};
+/** A page and the cursor of the next one, when the page is full. */
+var page = (rows, { limit }, keyOf, extra = {}) => json({
+	data: rows,
+	...rows.length === limit && rows.length > 0 ? { next: keyOf(rows.at(-1)) } : {},
+	...extra
+});
+var platformOf = (url) => {
+	const platform = url.searchParams.get("platform");
+	if (platform === null) return void 0;
+	if (!isPlatform(platform)) throw new HandlerBadRequestError(`Invalid platform: ${platform}. Expected 'ios' or 'android'.`);
+	return platform;
+};
+/** The one filter set a release list names; any other mix of filters is refused. */
+var releaseFilter = (url) => {
+	const params = url.searchParams;
+	const named = [
+		"channelId",
+		"platform",
+		"bundleId",
+		"scopeKey"
+	].filter((name) => params.has(name));
+	const enabled = parseBooleanSearchParam(url, "enabled");
+	const withEnabled = enabled === void 0 ? {} : { enabled };
+	const set = named.join(",");
+	if (set === "" && enabled === void 0) return { kind: "all" };
+	if (set === "channelId,platform") {
+		const platform = platformOf(url);
+		return {
+			kind: "channelPlatform",
+			channelId: params.get("channelId"),
+			platform,
+			...withEnabled
+		};
+	}
+	if (set === "bundleId" && enabled === void 0) return {
+		kind: "bundle",
+		bundleId: params.get("bundleId")
+	};
+	if (set === "scopeKey") return {
+		kind: "scope",
+		scopeKey: params.get("scopeKey"),
+		...withEnabled
+	};
+	throw new HandlerBadRequestError("Releases filter by none, channelId and platform (with enabled), bundleId, or scopeKey (with enabled).");
+};
+var isRecord$1 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var body = async (request) => {
+	const value = await request.json();
+	if (!isRecord$1(value)) throw new HandlerBadRequestError("Invalid body");
+	return value;
+};
+var isText = (value) => typeof value === "string" && value.length > 0;
+var isTextOrNull = (value) => value === null || isText(value);
+var isBundle = (bundle) => isRecord$1(bundle) && isText(bundle.id) && typeof bundle.platform === "string" && isPlatform(bundle.platform) && isTextOrNull(bundle.gitCommitHash) && isText(bundle.manifestStorageUri) && isText(bundle.manifestFileHash) && isText(bundle.assetBaseStorageUri) && (bundle.metadata === void 0 || isRecord$1(bundle.metadata)) && (bundle.patches === void 0 || bundle.patches === null || Array.isArray(bundle.patches));
+var isReleasePolicy = (release) => isRecord$1(release) && isText(release.channel) && typeof release.enabled === "boolean" && typeof release.shouldForceUpdate === "boolean" && isTextOrNull(release.fingerprintHash) && isTextOrNull(release.targetAppVersion) && (release.message === null || typeof release.message === "string") && (release.rolloutCohortCount === void 0 || Number.isSafeInteger(release.rolloutCohortCount) && release.rolloutCohortCount >= 0 && release.rolloutCohortCount <= 1e3) && (release.targetCohorts === void 0 || Array.isArray(release.targetCohorts) && release.targetCohorts.every(isText));
+/** A deployment's shape: a new bundle or a stored bundle's id, and its release policy. */
+var isDeployment = (value) => isRecord$1(value) && isReleasePolicy(value.release) && ("bundleId" in value ? isText(value.bundleId) && !("bundle" in value) : isBundle(value.bundle));
+/** An expected release revision from a body number or a query string. */
+var revisionOf = (value) => {
+	if (value === void 0 || value === null || value === "") return void 0;
+	const revision = typeof value === "string" ? Number(value) : value;
+	if (typeof revision !== "number" || !Number.isSafeInteger(revision) || revision < 1) throw new HandlerBadRequestError("Invalid expected Release revision");
+	return revision;
+};
+/** A policy change's body: `{ expectedRevision?, patch }`. */
+var policyInput = async (request) => {
+	const input = await body(request);
+	if (!isRecord$1(input.patch)) throw new HandlerBadRequestError("Invalid Release policy mutation");
+	const expectedRevision = revisionOf(input.expectedRevision);
+	return {
+		patch: input.patch,
+		...expectedRevision === void 0 ? {} : { expectedRevision }
+	};
+};
+/** A bundle update's body: the fields it changes, never another bundle's id. */
+var bundleUpdateOf = (value, bundleId) => {
+	if (!isRecord$1(value)) throw new HandlerBadRequestError("Invalid bundle payload");
+	const { id, ...update } = value;
+	if (id !== void 0 && id !== bundleId) throw new HandlerBadRequestError("Bundle id mismatch");
+	return update;
+};
+var scopeKeyOf = (params) => decodeMaybe(requireRouteParam(params, "scopeKey")) ?? "";
+/** Every admin route's handler, by the name `ADMIN_ROUTES` mounts it under. */
+var createAdminRouteHandlers = () => ({
+	listBundles: onCore(async (core, request) => {
+		const url = new URL(request.url);
+		const input = keyset(url, 100);
+		const platform = platformOf(url);
+		const withTotal = parseBooleanSearchParam(url, "total") === true;
+		const [rows, total] = await Promise.all([core.listBundles({
+			...input,
+			...platform ? { platform } : {}
+		}), withTotal ? core.countBundles(platform) : void 0]);
+		return page(rows, input, (row) => row.bundle.id, total === void 0 ? {} : { total });
+	}),
+	getBundle: onCore(async (core, _request, params) => {
+		const detail = await core.getBundle(requireRouteParam(params, "id"));
+		return detail === null ? notFound() : json({ data: detail });
+	}),
+	listReleases: onCore(async (core, request) => {
+		const url = new URL(request.url);
+		const input = keyset(url);
+		return page(await core.listReleases({
+			...input,
+			filter: releaseFilter(url)
+		}), input, (row) => row.id);
+	}),
+	listReleaseCatalogs: onCore(async (core, request) => {
+		const input = keyset(new URL(request.url));
+		return page(await core.listReleaseCatalogs(input), input, (row) => row.scope_key);
+	}),
+	getChannels: onCore(async (core, request) => {
+		const name = new URL(request.url).searchParams.get("name");
+		if (name === null) return json({ data: await core.listChannels() });
+		const channel = await core.findChannelByName(name);
+		return channel === null ? notFound() : json({ data: channel });
+	}),
+	createChannel: onCore(async (core, request) => {
+		const { name } = await body(request);
+		if (typeof name !== "string" || name.trim().length === 0) throw new HandlerBadRequestError("Invalid channel name");
+		return json({ data: await core.ensureChannel(name) });
+	}),
+	deleteChannel: onCore(async (core, _request, params) => {
+		const result = await core.deleteChannel(decodeMaybe(requireRouteParam(params, "id")) ?? "");
+		if (result.deleted) return noContent();
+		return json({ data: result }, result.reason === "not_found" ? 404 : 409);
+	}),
+	getRelease: onCore(async (core, _request, params) => {
+		const row = await core.getRelease(requireRouteParam(params, "id"));
+		return row === null ? notFound() : json({ data: row });
+	}),
+	updateRelease: onCore(async (core, request, params) => json({ data: await core.updateReleasePolicy({
+		...await policyInput(request),
+		releaseId: requireRouteParam(params, "id")
+	}) })),
+	preflightRelease: onCore(async (core, request, params) => json({ data: await core.preflightReleasePolicy({
+		...await policyInput(request),
+		releaseId: requireRouteParam(params, "id")
+	}) })),
+	deleteRelease: onCore(async (core, request, params) => {
+		const releaseId = requireRouteParam(params, "id");
+		const url = new URL(request.url);
+		if (url.searchParams.get("confirm") !== releaseId) throw new HandlerBadRequestError("Release hard deletion requires confirm=<release-id>");
+		const expectedRevision = revisionOf(url.searchParams.get("expectedRevision"));
+		return json({ data: await core.deleteRelease({
+			releaseId,
+			...expectedRevision === void 0 ? {} : { expectedRevision }
+		}) });
+	}),
+	getReleaseCatalogRow: onCore(async (core, _request, params) => {
+		const row = await core.getReleaseCatalogRow(scopeKeyOf(params));
+		return row === null ? notFound() : json({ data: row });
+	}),
+	rebuildReleaseCatalog: onCore(async (core, _request, params) => json({ data: await core.rebuildReleaseCatalog(scopeKeyOf(params)) })),
+	updateBundle: onCore(async (core, request, params) => {
+		const bundleId = requireRouteParam(params, "id");
+		await core.updateBundle(bundleId, bundleUpdateOf(await request.json(), bundleId));
+		return noContent();
+	}),
+	countBundles: onCore(async (core, request) => json({ data: await core.countBundles(platformOf(new URL(request.url))) })),
+	countBundleChildren: onCore(async (core, request) => {
+		const ids = (new URL(request.url).searchParams.get("ids") ?? "").split(",").filter((id) => id.length > 0);
+		if (ids.length === 0 || ids.length > 100) throw new HandlerBadRequestError("Bundle child counts take ids=<bundle id>,... with 1 to 100 ids.");
+		return json({ data: await core.countBundleChildren(ids) });
+	}),
+	listBundleChildren: onCore(async (core, request, params) => {
+		const input = keyset(new URL(request.url));
+		return page(await core.listPatchesFromBase(requireRouteParam(params, "id"), input), input, (row) => row.bundle_id);
+	}),
+	findBaseCandidates: onCore(async (core, request, params) => {
+		const url = new URL(request.url);
+		const before = url.searchParams.get("before");
+		const limit = Number(url.searchParams.get("limit") ?? "3");
+		if (before === null || !Number.isSafeInteger(limit) || limit < 1 || limit > 100) throw new HandlerBadRequestError("Base candidates need before=<bundle id> and a limit between 1 and 100.");
+		return json({ data: await core.findBaseBundleIds(decodeMaybe(requireRouteParam(params, "candidateKey")) ?? "", before, limit) });
+	}),
+	deployReleases: onCore(async (core, request) => {
+		const { deployments } = await body(request);
+		if (!Array.isArray(deployments) || deployments.length === 0 || !deployments.every(isDeployment)) throw new HandlerBadRequestError("Deploy needs deployments, each a bundle and its release policy.");
+		return json({ data: await core.deploy(deployments) }, 201);
+	}),
+	promoteRelease: onCore(async (core, request, params) => {
+		const input = await body(request);
+		if (typeof input.targetChannel !== "string" || input.action !== void 0 && input.action !== "copy" && input.action !== "move") throw new HandlerBadRequestError("Invalid Release promotion");
+		const expectedRevision = revisionOf(input.expectedRevision);
+		return json({ data: await core.promoteRelease({
+			releaseId: requireRouteParam(params, "id"),
+			targetChannel: input.targetChannel,
+			...input.action === void 0 ? {} : { action: input.action },
+			...expectedRevision === void 0 ? {} : { expectedRevision }
+		}) });
+	}),
+	preflightReleaseCatalogRebuild: onCore(async (core, _request, params) => json({ data: await core.preflightReleaseCatalogRebuild(scopeKeyOf(params)) })),
+	deleteBundles: onCore(async (core, request) => {
+		const { ids } = await body(request);
+		if (!Array.isArray(ids) || !ids.every((id) => typeof id === "string" && id.length > 0)) throw new HandlerBadRequestError("Bundle deletion needs ids");
+		await core.deleteBundles(ids);
+		return noContent();
+	})
+});
+/** The admin mount's routes, by the handler that serves each. */
+var ADMIN_ROUTES = [
+	{
+		method: "POST",
+		path: "/releases",
+		handler: "deployReleases"
+	},
+	{
+		method: "POST",
+		path: "/releases/:id/promote",
+		handler: "promoteRelease"
+	},
+	{
+		method: "GET",
+		path: "/releases/:id",
+		handler: "getRelease"
+	},
+	{
+		method: "GET",
+		path: "/releases",
+		handler: "listReleases"
+	},
+	{
+		method: "PATCH",
+		path: "/releases/:id",
+		handler: "updateRelease"
+	},
+	{
+		method: "POST",
+		path: "/releases/:id/preflight",
+		handler: "preflightRelease"
+	},
+	{
+		method: "DELETE",
+		path: "/releases/:id",
+		handler: "deleteRelease"
+	},
+	{
+		method: "GET",
+		path: "/release-catalogs/:scopeKey",
+		handler: "getReleaseCatalogRow"
+	},
+	{
+		method: "GET",
+		path: "/release-catalogs",
+		handler: "listReleaseCatalogs"
+	},
+	{
+		method: "POST",
+		path: "/release-catalogs/:scopeKey/rebuild",
+		handler: "rebuildReleaseCatalog"
+	},
+	{
+		method: "POST",
+		path: "/release-catalogs/:scopeKey/preflight",
+		handler: "preflightReleaseCatalogRebuild"
+	},
+	{
+		method: "GET",
+		path: "/channels",
+		handler: "getChannels"
+	},
+	{
+		method: "POST",
+		path: "/channels",
+		handler: "createChannel"
+	},
+	{
+		method: "DELETE",
+		path: "/channels/:id",
+		handler: "deleteChannel"
+	},
+	{
+		method: "GET",
+		path: "/bundles/count",
+		handler: "countBundles"
+	},
+	{
+		method: "GET",
+		path: "/bundles/child-counts",
+		handler: "countBundleChildren"
+	},
+	{
+		method: "GET",
+		path: "/bundles/:id",
+		handler: "getBundle"
+	},
+	{
+		method: "GET",
+		path: "/bundles",
+		handler: "listBundles"
+	},
+	{
+		method: "PATCH",
+		path: "/bundles/:id",
+		handler: "updateBundle"
+	},
+	{
+		method: "POST",
+		path: "/bundles/delete",
+		handler: "deleteBundles"
+	},
+	{
+		method: "GET",
+		path: "/bundles/:id/children",
+		handler: "listBundleChildren"
+	},
+	{
+		method: "GET",
+		path: "/base-candidates/:candidateKey",
+		handler: "findBaseCandidates"
+	}
+];
+var CATALOG_CONTENT_TYPE = "application/vnd.hot-updater.release-catalog+json; version=1";
+var ARTIFACT_CONTENT_TYPE = "application/vnd.hot-updater.artifact+json; version=1";
+var ORIGIN_CACHE_TTL_MS = 5e3;
+var ORIGIN_CACHE_MAX_ENTRIES = 128;
+/** Marks the 404 of a scope that has no catalog. */
+var NO_CATALOG_HEADER = "x-hot-updater-catalog";
+/** A shared cache keeps a catalog, or a scope's lack of one, five seconds. */
+var CATALOG_CACHE_CONTROL = "public, max-age=0, s-maxage=5";
+var privateNotFound = () => Response.json({ error: "Not found" }, {
+	status: 404,
+	headers: { "cache-control": "private, no-store" }
+});
 /**
-* Core's API in process, on a database's storage adapter: how the CLI reads
-* and writes a database that runs on the storage engine.
+* A scope with no catalog yet, such as a store version before its first
+* OTA release: cached like a catalog, so its update checks don't all reach
+* the origin, and it holds nothing an API key protects. The header tells it
+* apart from a 404 for a wrong URL: clients read it as "no update", and
+* doctor as a live catalog route.
 */
-var createInProcessCoreApi = (adapter, options = {}) => createCoreApi(createDatabaseEngine({
-	adapter,
-	schema: resolveSchema([coreModule])
-}).database(coreModule), { resolveFileUrl: async () => null }, options);
+var missingCatalog = () => Response.json({ error: "Not found" }, {
+	status: 404,
+	headers: {
+		"cache-control": CATALOG_CACHE_CONTROL,
+		vary: "Accept-Encoding",
+		[NO_CATALOG_HEADER]: "none"
+	}
+});
+var responseHash = async (body) => {
+	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(body));
+	return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+};
+var catalogResponse = async (catalog, request) => {
+	if (catalog === null) return missingCatalog();
+	const body = JSON.stringify(catalog);
+	const etag = `"sha256:${await responseHash(body)}"`;
+	const headers = {
+		"cache-control": CATALOG_CACHE_CONTROL,
+		"content-type": CATALOG_CONTENT_TYPE,
+		etag,
+		vary: "Accept-Encoding"
+	};
+	if (request.headers.get("if-none-match") === etag) return new Response(null, {
+		headers,
+		status: 304
+	});
+	return new Response(body, {
+		headers,
+		status: 200
+	});
+};
+var createReleaseCatalogRouteHandlers = () => {
+	const cache = /* @__PURE__ */ new Map();
+	const inFlight = /* @__PURE__ */ new Map();
+	const loadCatalog = async (key, load) => {
+		const cached = cache.get(key);
+		if (cached !== void 0 && cached.expiresAt > Date.now()) {
+			cache.delete(key);
+			cache.set(key, cached);
+			return cached.catalog;
+		}
+		if (cached !== void 0) cache.delete(key);
+		const pending = inFlight.get(key);
+		if (pending !== void 0) return pending;
+		const next = load().then((catalog) => {
+			if (catalog !== null) {
+				cache.set(key, {
+					catalog,
+					expiresAt: Date.now() + ORIGIN_CACHE_TTL_MS
+				});
+				while (cache.size > ORIGIN_CACHE_MAX_ENTRIES) {
+					const oldestKey = cache.keys().next().value;
+					if (oldestKey === void 0) break;
+					cache.delete(oldestKey);
+				}
+			}
+			return catalog;
+		});
+		inFlight.set(key, next);
+		try {
+			return await next;
+		} finally {
+			inFlight.delete(key);
+		}
+	};
+	return {
+		appVersionReleaseCatalog: async (params, request, { core }) => {
+			const rawAppVersion = requireRouteParam(params, "appVersion");
+			const appVersion = canonicalizeAppVersion(rawAppVersion);
+			if (appVersion === null || appVersion !== rawAppVersion) return Response.json({ error: "Invalid app version" }, {
+				status: 400,
+				headers: { "cache-control": "private, no-store" }
+			});
+			const input = {
+				appVersion,
+				channelKey: requireRouteParam(params, "channelKey"),
+				platform: requirePlatformParam(params),
+				strategy: "APP_VERSION"
+			};
+			return catalogResponse(await loadCatalog(`app-version:${JSON.stringify(input)}`, () => core.getReleaseCatalog(input)), request);
+		},
+		fingerprintReleaseCatalog: async (params, request, { core }) => {
+			const input = {
+				channelKey: requireRouteParam(params, "channelKey"),
+				fingerprintHash: requireRouteParam(params, "fingerprintHash"),
+				platform: requirePlatformParam(params),
+				strategy: "FINGERPRINT"
+			};
+			return catalogResponse(await loadCatalog(`fingerprint:${JSON.stringify(input)}`, () => core.getReleaseCatalog(input)), request);
+		},
+		artifactV1: async (params, _request, { core }) => {
+			const info = await core.getArtifactInfo(requireRouteParam(params, "targetBundleId"), requireRouteParam(params, "currentBundleId"), 1);
+			if (info === null) return privateNotFound();
+			return new Response(JSON.stringify(info), {
+				status: 200,
+				headers: {
+					"cache-control": "private, no-store",
+					"content-type": ARTIFACT_CONTENT_TYPE
+				}
+			});
+		}
+	};
+};
+var normalizePath = (path) => {
+	if (!path) return "/";
+	if (path === "/") return path;
+	const withLeadingSlash = path.startsWith("/") ? path : `/${path}`;
+	return withLeadingSlash.endsWith("/") ? withLeadingSlash.slice(0, -1) : withLeadingSlash;
+};
+var toSegments = (path) => {
+	const normalized = normalizePath(path);
+	return normalized === "/" ? [] : normalized.slice(1).split("/");
+};
+function createRouter() {
+	return { routes: [] };
+}
+function addRoute(router, method, path, data) {
+	const segments = toSegments(path);
+	const paramNames = segments.filter((segment) => segment.startsWith(":")).map((segment) => segment.slice(1));
+	router.routes.push({
+		data,
+		method: method.toUpperCase(),
+		paramNames,
+		segments
+	});
+}
+function findRoute(router, method, path) {
+	const normalizedMethod = method.toUpperCase();
+	const pathSegments = toSegments(path);
+	for (const route of router.routes) {
+		if (route.method !== normalizedMethod) continue;
+		if (route.segments.length !== pathSegments.length) continue;
+		const params = {};
+		let matched = true;
+		for (let index = 0; index < route.segments.length; index += 1) {
+			const routeSegment = route.segments[index];
+			const pathSegment = pathSegments[index];
+			if (routeSegment.startsWith(":")) {
+				params[routeSegment.slice(1)] = pathSegment;
+				continue;
+			}
+			if (routeSegment !== pathSegment) {
+				matched = false;
+				break;
+			}
+		}
+		if (matched) return {
+			data: route.data,
+			params
+		};
+	}
+}
+var withPrivateNoStore = (response) => {
+	const headers = new Headers(response.headers);
+	headers.set("cache-control", "private, no-store");
+	return new Response(response.body, {
+		headers,
+		status: response.status,
+		statusText: response.statusText
+	});
+};
+var errorResponse = (error, status) => Response.json({ error }, {
+	headers: { "cache-control": "private, no-store" },
+	status
+});
+/** `/version` and storage downloads never pass through the client policy. */
+var PUBLIC_CLIENT_ROUTES = /* @__PURE__ */ new Set(["version", "downloadStorageObject"]);
+var routesOf = Symbol.for("@hot-updater/server/routes");
+var withVary = (response, varyHeaders) => {
+	const cacheControl = response.headers.get("cache-control") ?? "";
+	if (varyHeaders.length === 0 || cacheControl === "" || /private|no-store/u.test(cacheControl)) return response;
+	const headers = new Headers(response.headers);
+	headers.set("vary", [response.headers.get("vary"), ...varyHeaders].filter(Boolean).join(", "));
+	return new Response(response.body, {
+		headers,
+		status: response.status,
+		statusText: response.statusText
+	});
+};
+var createRequestHandler = ({ api, clientPolicy, privateResponses = false, routeHandlers, router }) => async (request) => {
+	try {
+		const match = findRoute(router, request.method, new URL(request.url).pathname);
+		if (!match) return errorResponse("Not found", 404);
+		const guarded = clientPolicy !== void 0 && !PUBLIC_CLIENT_ROUTES.has(match.data);
+		if (guarded) {
+			let authenticated;
+			try {
+				authenticated = await clientPolicy.authenticate(request);
+			} catch {
+				return errorResponse("Service unavailable", 503);
+			}
+			if (!authenticated) return errorResponse("Unauthorized", 401);
+		}
+		const handler = routeHandlers[match.data];
+		if (!handler) return errorResponse("Handler not found", 500);
+		const response = await handler(match.params, request, api);
+		if (privateResponses) return withPrivateNoStore(response);
+		return guarded ? withVary(response, clientPolicy.varyHeaders) : response;
+	} catch (error) {
+		if (error instanceof HandlerBadRequestError) return errorResponse(error.message, 400);
+		if (error instanceof HotUpdaterSchemaMigrationRequiredError) {
+			console.error(error.message);
+			return errorResponse("Service unavailable", 503);
+		}
+		console.error("Hot Updater handler error:", error);
+		return Response.json({ error: "Internal server error" }, {
+			headers: { "cache-control": "private, no-store" },
+			status: 500
+		});
+	}
+};
+var createDownloadStorageRouteHandler = (downloadStorageObject) => async (params) => {
+	const token = params.token;
+	const signature = params.signature;
+	if (!token || !signature) return errorResponse("Not found", 404);
+	const response = await downloadStorageObject(token, signature);
+	if (!response) return errorResponse("Not found", 404);
+	const headers = new Headers(response.headers);
+	if (!headers.has("cache-control")) headers.set("cache-control", "public, max-age=31536000, immutable");
+	return new Response(response.body, {
+		headers,
+		status: response.status,
+		statusText: response.statusText
+	});
+};
+function createHotUpdaterHandlers({ api, clientPolicy, downloadStorageObject, endpoints = [], plugins = [] }) {
+	const routeHandlers = {
+		...createVersionRouteHandlers(plugins),
+		...createReleaseCatalogRouteHandlers(),
+		...createAdminRouteHandlers(),
+		...downloadStorageObject === void 0 ? {} : { downloadStorageObject: createDownloadStorageRouteHandler(downloadStorageObject) }
+	};
+	const routes = [];
+	const shapes = /* @__PURE__ */ new Map();
+	const mount = (router, admin) => (method, path, handler) => {
+		const shape = `${admin ? "admin" : "client"} ${method} ${path.replaceAll(/:[^/]+/gu, ":")}`;
+		const taken = shapes.get(shape);
+		if (taken !== void 0) throw new HotUpdaterConfigError(`${handler} (${method} ${path}) collides with ${taken} on handlers.${admin ? "admin" : "client"}.`);
+		shapes.set(shape, handler);
+		addRoute(router, method, path, handler);
+		routes.push({
+			method,
+			path,
+			access: admin ? "admin" : PUBLIC_CLIENT_ROUTES.has(handler) ? "public" : "client"
+		});
+	};
+	const clientRouter = createRouter();
+	const addClientRoute = mount(clientRouter, false);
+	addClientRoute("GET", "/version", "version");
+	if (downloadStorageObject !== void 0) addClientRoute("GET", "/storage/:token/:signature", "downloadStorageObject");
+	addClientRoute("GET", "/release-catalogs/app-version/:platform/:channelKey/:appVersion", "appVersionReleaseCatalog");
+	addClientRoute("GET", "/release-catalogs/fingerprint/:platform/:channelKey/:fingerprintHash", "fingerprintReleaseCatalog");
+	addClientRoute("GET", "/artifacts/v1/:targetBundleId/from/:currentBundleId", "artifactV1");
+	const adminRouter = createRouter();
+	const addAdminRoute = mount(adminRouter, true);
+	addAdminRoute("GET", "/version", "adminVersion");
+	for (const route of ADMIN_ROUTES) addAdminRoute(route.method, route.path, route.handler);
+	for (const endpoint of endpoints) {
+		const name = `plugin ${endpoint.plugin}: ${endpoint.method} ${endpoint.path}`;
+		routeHandlers[name] = (params, request) => endpoint.handler(request, params);
+		(endpoint.access === "admin" ? addAdminRoute : addClientRoute)(endpoint.method, endpoint.path, name);
+	}
+	const handlers = {
+		client: createRequestHandler({
+			api,
+			...clientPolicy === void 0 ? {} : { clientPolicy },
+			routeHandlers,
+			router: clientRouter
+		}),
+		admin: createRequestHandler({
+			api,
+			privateResponses: true,
+			routeHandlers,
+			router: adminRouter
+		})
+	};
+	Object.defineProperty(handlers, routesOf, { value: Object.freeze(routes) });
+	return Object.freeze(handlers);
+}
+var assertRemoteUrl = (value) => {
+	const protocol = new URL(value).protocol;
+	if (protocol !== "http:" && protocol !== "https:") throw new Error("Storage getDownloadUrl must resolve to an HTTP(S) URL.");
+	return value;
+};
+var getStorageProtocol = (storageUri) => new URL(storageUri).protocol.replace(":", "");
+var isRemoteUrlProtocol = (protocol) => protocol === "http" || protocol === "https";
+var resolveDownloadPath = (value, storageUri) => {
+	const parsed = parseStorageDownloadPath(value);
+	if (!parsed || parsed.storageUri !== storageUri) throw new Error("Storage getDownloadUrl must return an HTTP(S) URL or a valid storage download path.");
+	return value;
+};
+var tokensEqual = (left, right) => {
+	const leftBytes = new TextEncoder().encode(left);
+	const rightBytes = new TextEncoder().encode(right);
+	let difference = leftBytes.length ^ rightBytes.length;
+	const length = Math.max(leftBytes.length, rightBytes.length);
+	for (let index = 0; index < length; index += 1) difference |= (leftBytes[index] ?? 0) ^ (rightBytes[index] ?? 0);
+	return difference === 0;
+};
+var createStorageAccess = (storageAdapters) => {
+	const protocols = /* @__PURE__ */ new Set();
+	for (const storage of storageAdapters) {
+		if (protocols.has(storage.protocol)) throw new Error(`Multiple storage adapters handle protocol: ${storage.protocol}`);
+		protocols.add(storage.protocol);
+	}
+	const findStorage = (protocol) => storageAdapters.find((item) => item.protocol === protocol);
+	const readStorageResponse = async (storageUri) => {
+		const protocol = getStorageProtocol(storageUri);
+		const storage = findStorage(protocol);
+		if (storage) {
+			if (!storage.get) return null;
+			return (await storage.get({ storageUri })).response;
+		}
+		if (isRemoteUrlProtocol(protocol)) {
+			const response = await fetch(storageUri);
+			return response.ok ? response : null;
+		}
+		throw new Error(`No storage adapter for protocol: ${protocol}`);
+	};
+	const resolveFileUrl = async (storageUri) => {
+		if (!storageUri) return null;
+		const protocol = getStorageProtocol(storageUri);
+		const storage = findStorage(protocol);
+		if (!storage) {
+			if (isRemoteUrlProtocol(protocol)) return storageUri;
+			throw new Error(`No storage adapter for protocol: ${protocol}`);
+		}
+		if (!storage.getDownloadUrl) return null;
+		const { url: downloadUrl } = await storage.getDownloadUrl({ storageUri });
+		try {
+			return assertRemoteUrl(downloadUrl);
+		} catch (error) {
+			if (/^[a-z][a-z\d+.-]*:/i.test(downloadUrl)) throw error;
+		}
+		return resolveDownloadPath(downloadUrl, storageUri);
+	};
+	const readStorageText = async (storageUri) => {
+		return (await readStorageResponse(storageUri))?.text() ?? null;
+	};
+	return {
+		downloadStorageObject: storageAdapters.some((storage) => storage.getDownloadUrl !== void 0) ? async (storageUriToken, encodedSignature) => {
+			const requestedPath = `/storage/${storageUriToken}/${encodedSignature}`;
+			const requested = parseStorageDownloadPath(requestedPath);
+			if (!requested) return null;
+			let storage;
+			try {
+				storage = findStorage(getStorageProtocol(requested.storageUri));
+			} catch {
+				return null;
+			}
+			if (!storage?.getDownloadUrl || !storage.get) return null;
+			const { url: downloadUrl } = await storage.getDownloadUrl({ storageUri: requested.storageUri });
+			try {
+				new URL(downloadUrl);
+				return null;
+			} catch {
+				if (/^[a-z][a-z\d+.-]*:/i.test(downloadUrl)) return null;
+			}
+			if (!tokensEqual(downloadUrl, requestedPath)) return null;
+			return (await storage.get({ storageUri: requested.storageUri })).response;
+		} : void 0,
+		readStorageText,
+		resolveFileUrl
+	};
+};
 var isRecord = (value) => typeof value === "object" && value !== null;
 var isAdapter = (value) => isRecord(value) && [
 	"fits",
@@ -4183,23 +5574,139 @@ var isAdapter = (value) => isRecord(value) && [
 	"query",
 	"write"
 ].every((method) => typeof value[method] === "function");
-/** The storage adapter a configured database runs on, if it is on the engine. */
-var engineAdapterOf = (database) => isRecord(database) && isAdapter(database.adapter) ? database.adapter : isAdapter(database) ? database : void 0;
-var OFF_ENGINE_DATABASE = "This database does not run on Hot Updater's storage engine. Upgrade its provider package to 1.0.";
+/** The configured database, when it runs on the storage engine. */
+var databaseOf = (value) => {
+	if (isRecord(value) && typeof value.name === "string") {
+		if (isAdapter(value.adapter)) return value;
+		if ("core" in value && "fetchAdmin" in value) throw new HotUpdaterConfigError("standaloneRepository reaches a server's admin API from the CLI and console. createHotUpdater needs the server's own database, such as kyselyAdapter(...).");
+	}
+	throw new HotUpdaterConfigError("database must be a Hot Updater 1.0 database, such as kyselyAdapter(...) or postgres(...). Upgrade the provider package that created it.");
+};
+/** `"public"`, or nothing; a `clientAccess` object says what replaced it. */
+var isPublic = (value) => {
+	if (value === void 0) return false;
+	if (value === "public") return true;
+	throw new HotUpdaterConfigError(isRecord(value) ? "clientAccess objects were removed in 1.0. Set clientAccess: \"public\", or add a plugin that provides clientAuth to plugins." : "clientAccess must be \"public\"; to protect client routes, add a plugin that provides clientAuth to plugins.");
+};
+function createHotUpdater(options) {
+	for (const key of ["authorityId", "catalogId"]) if (Object.hasOwn(options, key)) throw new TypeError(`Remove ${key} from createHotUpdater options. Catalog identity is managed internally.`);
+	const database = databaseOf(options.database);
+	const storage = Object.freeze([...options.storage ?? []]);
+	const { downloadStorageObject, readStorageText, resolveFileUrl } = createStorageAccess(storage);
+	const publicClients = isPublic(options.clientAccess);
+	const configured = Object.freeze([...options.plugins ?? []]);
+	const plugins = assemblePlugins(configured, database, { storage: {
+		readStorageText,
+		resolveFileUrl
+	} });
+	const clientPlugins = Object.freeze(clientPluginsOf(configured));
+	const clientAuth = plugins.clientAuth;
+	if (clientAuth !== void 0 && publicClients) throw new HotUpdaterConfigError(`Plugin "${clientAuth.plugin}" provides clientAuth, so remove clientAccess.`);
+	if (clientAuth === void 0 && !publicClients) throw new HotUpdaterConfigError("Set clientAccess to \"public\", or add a plugin that provides clientAuth.");
+	const varyHeaders = Object.freeze((clientAuth?.varyHeaders ?? []).map((header) => header.toLowerCase()));
+	const clientPolicy = clientAuth === void 0 ? void 0 : {
+		varyHeaders,
+		authenticate: (request) => clientAuth.authenticate(request.headers)
+	};
+	const handlers = createHotUpdaterHandlers({
+		api: { core: plugins.core },
+		...clientPolicy === void 0 ? {} : { clientPolicy },
+		downloadStorageObject,
+		endpoints: plugins.endpoints,
+		plugins: Object.keys(plugins.api)
+	});
+	let serving = false;
+	return {
+		adapterName: database.name,
+		get handlers() {
+			if (!serving) {
+				for (const adapter of storage) assertStorageOperations(adapter, ["get", "getDownloadUrl"]);
+				serving = true;
+			}
+			return handlers;
+		},
+		core: plugins.core,
+		api: plugins.api,
+		flush: plugins.flush,
+		database,
+		storage,
+		plugins: configured,
+		clientPlugins,
+		clientEndpoints: Object.freeze(plugins.endpoints.filter((endpoint) => endpoint.access === "client").map(({ plugin, method, path }) => Object.freeze({
+			plugin,
+			method,
+			path
+		}))),
+		...clientAuth === void 0 ? {} : { clientAuth: Object.freeze({
+			plugin: clientAuth.plugin,
+			varyHeaders
+		}) }
+	};
+}
 /**
-* Core's API for a configured database, as the CLI uses it: a self-hosted
-* server's admin API when the database is `standaloneRepository`, or the
-* database's own storage adapter, in process.
+* Core and the plugins over `database`, assembled by `createHotUpdater` as
+* the server assembles them, with public client routes unless a plugin
+* provides clientAuth: the console mounts no handlers. cli-tools'
+* `assembleServer` does the same for the CLI; the console keeps its own
+* copy, since a hosted console never loads cli-tools.
 */
-var createDatabaseCoreApi = (database, options = {}) => {
-	if (isRecord(database) && isRecord(database.core)) return database.core;
-	const adapter = engineAdapterOf(database);
-	if (adapter === void 0) throw new Error(OFF_ENGINE_DATABASE);
-	const engineDatabase = database;
-	return createInProcessCoreApi(adapter, {
-		...options,
-		...typeof engineDatabase.onCachedRoutesChange === "function" ? { onCachedRoutesChange: () => engineDatabase.onCachedRoutesChange() } : {}
-	});
+var assemble = (database, storage, plugins) => createHotUpdater({
+	database,
+	storage: [storage],
+	plugins,
+	...plugins.some((plugin) => plugin.provides?.clientAuth) ? {} : { clientAccess: "public" }
+});
+var getConsoleAuthAdapter = async () => {
+	return (await import("./auth-BF8mbAgF.mjs")).default;
+};
+var resolveConsoleConfig = async (request) => {
+	const { default: source } = await import("./config-nsIcsHh8.mjs");
+	const config = typeof source === "function" ? await source(request) : source;
+	const { database, storage, plugins = [] } = config;
+	const gitUrl = config.console?.gitUrl === void 0 ? {} : { gitUrl: config.console.gitUrl };
+	if (isRemoteDatabase(database)) {
+		const checked = assemble({
+			name: "memory",
+			adapter: createMemoryAdapter()
+		}, storage, plugins);
+		return {
+			...gitUrl,
+			database,
+			core: database.core,
+			storage: [storage],
+			plugins: checked.plugins
+		};
+	}
+	const server = assemble(database, storage, plugins);
+	return {
+		...gitUrl,
+		database,
+		core: server.core,
+		storage: server.storage,
+		plugins: server.plugins,
+		api: server.api
+	};
+};
+var accessError = (access) => new Response(access.status === "unauthenticated" ? "Unauthorized" : "Forbidden", { status: access.status === "unauthenticated" ? 401 : 403 });
+var accessByRequest = /* @__PURE__ */ new WeakMap();
+var getConsoleAccess = (request) => {
+	let access = accessByRequest.get(request);
+	if (!access) {
+		access = getConsoleAuthAdapter().then((adapter) => adapter.getAccess(request));
+		accessByRequest.set(request, access);
+	}
+	return access;
+};
+var getConsoleAuthProviders = async (request) => {
+	return (await getConsoleAuthAdapter()).getProviders(request);
+};
+var handleConsoleAuth = async (request) => {
+	return (await getConsoleAuthAdapter()).handle(request);
+};
+var requireConsoleAccess = async (request) => {
+	const access = await getConsoleAccess(request);
+	if (access.status !== "authorized") throw accessError(access);
+	return access.principal;
 };
 //#endregion
-export { createCoreReads as a, engineAdapterOf as c, validateSchema as d, createCoreApi as i, pruneDuringWrites as l, aggregateBatchingModule as n, createDatabaseCoreApi as o, coreModule as r, createDatabaseEngine as s, OFF_ENGINE_DATABASE as t, resolveSchema as u };
+export { getConsoleAccess, getConsoleAuthProviders, handleConsoleAuth, requireConsoleAccess, resolveConsoleConfig as t };