@onetype/stack-api-kit 1.0.0

package/dist/chunk-UCWOCNTI.js

@@ -0,0 +1,1749 @@
+import { AsyncLocalStorage } from 'async_hooks';
+import { timingSafeEqual, createHash } from 'crypto';
+import { mkdirSync, readdirSync, readFileSync } from 'fs';
+import { dirname, join } from 'path';
+import { eq } from 'drizzle-orm';
+import Database from 'better-sqlite3';
+import { drizzle } from 'drizzle-orm/better-sqlite3';
+
+// src/plugins/kernel/internal/faults.ts
+var KernelFault = class extends Error {
+  code;
+  plugin;
+  detail;
+  constructor(code, message, made = {}) {
+    super(message, made.cause === void 0 ? void 0 : { cause: made.cause });
+    this.name = "KernelFault";
+    this.code = code;
+    this.plugin = made.plugin;
+    this.detail = made.detail ?? {};
+  }
+  toString() {
+    return this.plugin === void 0 ? `${this.name} [${this.code}]: ${this.message}` : `${this.name} [${this.code}] in plugin "${this.plugin}": ${this.message}`;
+  }
+};
+
+// src/plugins/kernel/internal/answer.ts
+var Answered = class _Answered {
+  status;
+  body;
+  headers;
+  constructor(status, body, headers = {}) {
+    this.status = status;
+    this.body = body;
+    this.headers = headers;
+  }
+  /** Sends the caller somewhere else. */
+  static redirect(to, permanent = false) {
+    return new _Answered(permanent ? 308 : 307, { to }, { location: to });
+  }
+};
+var Refusal = class extends Error {
+  status;
+  code;
+  fields;
+  constructor(status, code, message, fields2) {
+    super(message);
+    this.name = "Refusal";
+    this.status = status;
+    this.code = code;
+    this.fields = fields2;
+  }
+};
+var SPOKEN = {
+  UNAUTHENTICATED: { status: 401, message: "This request needs to be signed in." },
+  PERMISSION_DENIED: { status: 403, message: "This request is not permitted." },
+  RATE_LIMITED: { status: 429, message: "Too many requests. Try again shortly." },
+  INVALID_PAYLOAD: { status: 400, message: "The request body is not valid." }
+};
+function answer(cause) {
+  if (cause instanceof Refusal) {
+    return {
+      status: cause.status,
+      code: cause.code,
+      message: cause.message,
+      ...cause.fields !== void 0 && { fields: cause.fields }
+    };
+  }
+  if (cause instanceof KernelFault) {
+    const known = SPOKEN[cause.code];
+    if (known !== void 0) {
+      return { status: known.status, code: cause.code, message: known.message };
+    }
+  }
+  return { status: 500, code: "INTERNAL", message: "The request could not be completed." };
+}
+
+// src/plugins/kernel/internal/permissions.ts
+function permissions(caller) {
+  const granted = () => {
+    return new Set(caller()?.permissions ?? []);
+  };
+  return {
+    has: (permission) => {
+      return granted().has(permission);
+    },
+    all: (wanted) => {
+      const carries = granted();
+      return wanted.every((one) => carries.has(one));
+    },
+    /**
+     * What the project attached to this caller: a tenant, a role, a
+     * session. Read back as it was given, and never interpreted here.
+     *
+     * The kernel cannot know what a tenant means, so it carries the value
+     * and refuses to guess. A plugin scoping by tenant reads it and puts
+     * it in its own queries.
+     */
+    claims: () => {
+      return caller()?.claims ?? {};
+    }
+  };
+}
+
+// src/plugins/kernel/internal/context.ts
+function absent(what, used, pass) {
+  throw new KernelFault(
+    "NOT_STARTED",
+    `A plugin used ctx.${used}, but no ${what} was given. Pass \`${pass}\` to createKernel, \`${pass}: true\` to start, or \`${pass}: true\` to booting in a test.`
+  );
+}
+function origin(url) {
+  try {
+    const parsed = new URL(url);
+    return parsed.origin === "null" || parsed.origin === "" ? `${parsed.protocol}//${parsed.host}` : parsed.origin;
+  } catch {
+    return void 0;
+  }
+}
+function dialable(url) {
+  return url.toLowerCase().startsWith("https://");
+}
+function context(wiring, plugin2, caller, within, headers = {}, acting) {
+  const may = permissions(() => caller);
+  const seenBy = (plugin3, inside = within) => {
+    return context(wiring, plugin3, caller, inside, headers, acting);
+  };
+  const heard = (plugin3) => {
+    return context(wiring, plugin3, void 0, void 0, {});
+  };
+  const made = /* @__PURE__ */ new Map();
+  const of = (name) => {
+    if (made.has(name)) {
+      return made.get(name);
+    }
+    made.set(name, void 0);
+    const services = wiring.known.get(name)?.definition.services?.(
+      name === plugin2 ? ctx : seenBy(name)
+    );
+    made.set(name, services);
+    return services;
+  };
+  const scoping = (table) => {
+    const scope = wiring.known.get(plugin2)?.definition.scope;
+    if (scope === void 0) {
+      throw new KernelFault(
+        "UNDECLARED_SCOPE",
+        `"${plugin2}" asked to scope "${table}", but declares no scope. Add one, naming the claim and which column each table carries it in.`,
+        { plugin: plugin2 }
+      );
+    }
+    const column = scope.tables[table];
+    if (column === void 0) {
+      throw new KernelFault(
+        "UNDECLARED_SCOPE",
+        `"${plugin2}" asked to scope "${table}", which its scope does not name. Add it, or stop scoping a table nobody owns.`,
+        { plugin: plugin2 }
+      );
+    }
+    const held = caller === void 0 ? acting : caller.claims[scope.claim];
+    if (typeof held !== "string" || held.trim() === "") {
+      throw new Refusal(
+        403,
+        "OUT_OF_SCOPE",
+        "This request carries nothing to say whose rows it may reach."
+      );
+    }
+    return { column, held };
+  };
+  const ctx = {
+    name: plugin2,
+    config: wiring.parsed.get(plugin2) ?? wiring.config[plugin2],
+    get services() {
+      return of(plugin2);
+    },
+    caller,
+    headers,
+    now: wiring.now,
+    log: {
+      debug: (line, about) => {
+        wiring.log("debug", plugin2, line, about);
+      },
+      info: (line, about) => {
+        wiring.log("info", plugin2, line, about);
+      },
+      warn: (line, about) => {
+        wiring.log("warn", plugin2, line, about);
+      },
+      error: (line, about) => {
+        wiring.log("error", plugin2, line, about);
+      }
+    },
+    get db() {
+      if (within !== void 0) {
+        return within.db;
+      }
+      return wiring.db === void 0 ? absent("store", "db", "db") : wiring.db.of(plugin2);
+    },
+    write: (run) => {
+      if (within !== void 0 || wiring.db?.write === void 0) {
+        return run();
+      }
+      return wiring.db.write(run);
+    },
+    tx: async (run) => {
+      const store2 = wiring.db;
+      if (store2 === void 0) {
+        return absent("store", "db", "db");
+      }
+      const mark = {};
+      const outer = wiring.open.getStore();
+      const nested = within !== void 0;
+      wiring.pending.set(mark, []);
+      try {
+        const returned = await wiring.open.run(mark, () => store2.tx(plugin2, async (db) => {
+          const made2 = await run(seenBy(plugin2, { mark, db }));
+          const waiting = wiring.pending.get(mark) ?? [];
+          if (wiring.outbox !== void 0 && waiting.length > 0 && !(nested && outer !== void 0)) {
+            wiring.outbox.keep(db, waiting.map((one) => ({
+              id: one.id,
+              plugin: one.plugin,
+              name: one.name,
+              payload: one.payload
+            })));
+          }
+          return made2;
+        }));
+        const announced = wiring.pending.get(mark) ?? [];
+        if (nested && outer !== void 0) {
+          wiring.pending.get(outer)?.push(...announced);
+          return returned;
+        }
+        for (const announcement of announced) {
+          const delivered = wiring.bus.deliver(announcement.plugin, announcement.name, announcement.payload, (to) => heard(to));
+          void delivered.then(() => wiring.outbox?.sent(announcement.id));
+        }
+        return returned;
+      } finally {
+        wiring.pending.delete(mark);
+      }
+    },
+    // Async throughout, refusal included: a caller writing `.catch()`
+    // around a call would otherwise get an uncaught error for the one
+    // case it was guarding against.
+    fetch: async (call) => {
+      const allowed = wiring.known.get(plugin2)?.definition.outbound ?? [];
+      const host = origin(call.url);
+      if (host === void 0 || !allowed.includes(host)) {
+        throw new KernelFault(
+          "UNDECLARED_HOST",
+          `"${plugin2}" called ${host ?? `"${call.url}"`}, which it does not declare. Add it to outbound.`,
+          { plugin: plugin2 }
+        );
+      }
+      if (!dialable(call.url)) {
+        throw new KernelFault(
+          "UNDECLARED_HOST",
+          `"${plugin2}" declares ${host}, but ctx.fetch speaks https and nothing else. Reach it with its own client, opened in setup and closed in teardown.`,
+          { plugin: plugin2 }
+        );
+      }
+      return wiring.dial === void 0 ? absent("dialer", "dial", "dial") : wiring.dial(call);
+    },
+    events: {
+      emit: (event, payload) => {
+        const checked = wiring.bus.checked(plugin2, event, payload);
+        const mark = within?.mark ?? wiring.open.getStore();
+        const waiting = mark === void 0 ? void 0 : wiring.pending.get(mark);
+        if (waiting !== void 0) {
+          waiting.push({ id: crypto.randomUUID(), plugin: plugin2, name: event, payload: checked });
+          return;
+        }
+        wiring.bus.deliver(plugin2, event, checked, (to) => heard(to));
+      }
+    },
+    hooks: {
+      run: (hook, payload) => {
+        return wiring.points.run(plugin2, hook, payload, (to) => seenBy(to));
+      }
+    },
+    permissions: may,
+    commands: {
+      run: (command, input) => {
+        return wiring.run(command, input, caller);
+      },
+      later: (command, input, inSeconds) => {
+        if (wiring.schedule === void 0) {
+          absent("schedule", "commands.later", "schedule");
+        }
+        const owns = wiring.known.get(plugin2)?.definition.commands ?? {};
+        if (!(command in owns)) {
+          throw new KernelFault(
+            "UNDECLARED_COMMAND",
+            `"${plugin2}" scheduled "${command}", which it does not declare. A plugin schedules only its own commands.`,
+            { plugin: plugin2 }
+          );
+        }
+        wiring.schedule.keep(within?.db, {
+          id: crypto.randomUUID(),
+          plugin: plugin2,
+          command,
+          input,
+          at: wiring.now() + inSeconds * 1e3,
+          attempts: 0
+        });
+      }
+    },
+    owns: (owned) => {
+      wiring.owned.set(plugin2, owned);
+      return owned;
+    },
+    owned: () => {
+      return wiring.owned.get(plugin2);
+    },
+    forScope: (claim) => {
+      if (caller !== void 0) {
+        throw new KernelFault(
+          "OUT_OF_SCOPE",
+          `"${plugin2}" called ctx.forScope inside a request. The scope of a request is the caller's; forScope is for a listener or a scheduled command, where nobody is calling.`,
+          { plugin: plugin2 }
+        );
+      }
+      if (claim.trim() === "") {
+        throw new KernelFault(
+          "OUT_OF_SCOPE",
+          `"${plugin2}" called ctx.forScope with nothing. A scope acted for is named, or it is every scope.`,
+          { plugin: plugin2 }
+        );
+      }
+      return context(wiring, plugin2, void 0, within, headers, claim);
+    },
+    stamped: (table) => {
+      const { column, held } = scoping(table);
+      return { [column]: held };
+    },
+    scoped: (table) => {
+      const { column, held } = scoping(table);
+      return wiring.narrow === void 0 ? absent("narrowing", "scoped", "narrow") : wiring.narrow(table, column, held);
+    },
+    use: (name) => {
+      const declared2 = wiring.known.get(plugin2)?.definition.dependsOn ?? [];
+      if (name !== plugin2 && !declared2.includes(name)) {
+        throw new KernelFault(
+          "UNDECLARED_DEPENDENCY",
+          `"${plugin2}" reached "${name}", which it does not depend on. Add "${name}" to dependsOn.`,
+          { plugin: plugin2 }
+        );
+      }
+      return of(name);
+    }
+  };
+  return ctx;
+}
+
+// src/plugins/kernel/internal/events.ts
+var KEPT = 100;
+function events(now = Date.now, told2 = () => {
+}) {
+  const published = /* @__PURE__ */ new Map();
+  const subscribers = /* @__PURE__ */ new Map();
+  const failures = [];
+  function record(event, plugin2, error) {
+    failures.push({ event, plugin: plugin2, error, at: now() });
+    if (failures.length > KEPT) {
+      failures.splice(0, failures.length - KEPT);
+    }
+    told2(plugin2, `listening to "${event}" failed`, {
+      event,
+      error: error instanceof Error ? error.message : String(error),
+      ...error instanceof Error && error.stack !== void 0 && { stack: error.stack }
+    });
+  }
+  function checked(plugin2, name, payload) {
+    const publisher = published.get(name);
+    if (publisher === void 0) {
+      throw new KernelFault("UNDECLARED_EVENT", `"${plugin2}" emitted "${name}", which no plugin declares. Add it to emits.`, { plugin: plugin2 });
+    }
+    if (publisher.owner !== plugin2) {
+      throw new KernelFault("UNDECLARED_EVENT", `"${plugin2}" emitted "${name}", which belongs to "${publisher.owner}". A plugin emits only what it owns.`, { plugin: plugin2, detail: { owner: publisher.owner } });
+    }
+    const parsed = publisher.event.schema.safeParse(payload);
+    if (!parsed.success) {
+      throw new KernelFault("WRONG_PAYLOAD", `The payload for "${name}" does not match its schema: ${parsed.error.issues[0]?.message ?? "it was rejected"}.`, { plugin: plugin2 });
+    }
+    return parsed.data;
+  }
+  return {
+    checked,
+    declare: (owner, name, event) => {
+      published.set(name, { owner, event });
+    },
+    listen: (plugin2, name, listener) => {
+      subscribers.set(name, [...subscribers.get(name) ?? [], { plugin: plugin2, listener }]);
+    },
+    // A listener that throws is recorded and reaches neither the emitter
+    // nor the ones behind it: one plugin's bug is not another's failure.
+    /**
+     * Calls every listener, and answers when they have all settled.
+     *
+     * The emitter never waits on this: it returns void from `emit`, and
+     * one plugin's slow listener is not another's slow request. What does
+     * wait is an outbox, which cannot forget an event until something has
+     * actually heard it.
+     */
+    deliver: (plugin2, name, payload, ctx) => {
+      const heard = [];
+      for (const subscriber of subscribers.get(name) ?? []) {
+        if (subscriber.plugin === plugin2) {
+          continue;
+        }
+        try {
+          const handling = subscriber.listener.handle(payload, ctx(subscriber.plugin));
+          heard.push(Promise.resolve(handling).catch((error) => {
+            record(name, subscriber.plugin, error);
+          }));
+        } catch (error) {
+          record(name, subscriber.plugin, error);
+        }
+      }
+      return Promise.all(heard).then(() => void 0);
+    },
+    failures: () => {
+      return [...failures];
+    }
+  };
+}
+
+// src/plugins/kernel/internal/hooks.ts
+var LATE = /* @__PURE__ */ Symbol("late");
+var PATIENCE = 5e3;
+function hooks(patience = PATIENCE) {
+  const opened = /* @__PURE__ */ new Map();
+  const joined = /* @__PURE__ */ new Map();
+  return {
+    declare: (owner, name, hook) => {
+      opened.set(name, { owner, hook });
+    },
+    participate: (plugin2, name, participant) => {
+      joined.set(name, [...joined.get(name) ?? [], { plugin: plugin2, participant }]);
+    },
+    run: async (plugin2, name, payload, ctx) => {
+      const point = opened.get(name);
+      if (point === void 0) {
+        throw new KernelFault("UNDECLARED_HOOK", `"${plugin2}" ran "${name}", which no plugin declares. Add it to hooks.`, { plugin: plugin2 });
+      }
+      if (point.owner !== plugin2) {
+        throw new KernelFault("UNDECLARED_HOOK", `"${plugin2}" ran "${name}", which belongs to "${point.owner}". A plugin runs only the hooks it owns.`, { plugin: plugin2, detail: { owner: point.owner } });
+      }
+      const parsed = point.hook.schema.safeParse(payload);
+      if (!parsed.success) {
+        throw new KernelFault("WRONG_PAYLOAD", `The payload for "${name}" does not match its schema: ${parsed.error.issues[0]?.message ?? "it was rejected"}.`, { plugin: plugin2 });
+      }
+      for (const participant of joined.get(name) ?? []) {
+        let timer;
+        try {
+          const answered = participant.participant.handle(parsed.data, ctx(participant.plugin));
+          const refusal = await Promise.race([
+            answered,
+            new Promise((keep) => {
+              timer = setTimeout(() => keep(LATE), patience);
+            })
+          ]);
+          if (refusal === LATE) {
+            return `"${participant.plugin}" did not answer in ${String(patience)}ms.`;
+          }
+          if (refusal !== void 0) {
+            return refusal;
+          }
+        } catch (cause) {
+          return `"${participant.plugin}" refused: ${cause instanceof Error ? cause.message : String(cause)}`;
+        } finally {
+          clearTimeout(timer);
+        }
+      }
+      return void 0;
+    }
+  };
+}
+
+// src/plugins/kernel/internal/order.ts
+function order(known) {
+  const sorted = [];
+  const state = /* @__PURE__ */ new Map();
+  function walk(name) {
+    if (state.get(name) !== void 0) {
+      return;
+    }
+    state.set(name, "open");
+    const plugin2 = known.get(name);
+    for (const need of [...plugin2?.definition.dependsOn ?? []].sort()) {
+      if (known.has(need)) {
+        walk(need);
+      }
+    }
+    state.set(name, "done");
+    if (plugin2 !== void 0) {
+      sorted.push(plugin2);
+    }
+  }
+  for (const name of [...known.keys()].sort()) {
+    walk(name);
+  }
+  return sorted;
+}
+
+// src/plugins/kernel/internal/request.ts
+var unknownRoute = {
+  status: 404,
+  body: { code: "NOT_FOUND", message: "No such route." }
+};
+var notServing = {
+  status: 503,
+  body: { code: "NOT_SERVING", message: "The service is shutting down." }
+};
+async function respond(mounted, incoming, context2, log, budget) {
+  const { plugin: plugin2, route } = mounted;
+  const caller = incoming.caller;
+  const may = permissions(() => caller);
+  const who = caller?.id !== void 0 && caller.id.trim() !== "" ? caller.id : void 0;
+  try {
+    if (route.public !== true && who === void 0) {
+      throw new KernelFault("UNAUTHENTICATED", `${route.method} ${route.path} needs a caller.`, { plugin: plugin2 });
+    }
+    if (route.limit !== void 0 && budget !== void 0) {
+      const verdict = budget.take(`${who ?? incoming.from ?? "anonymous"}:${route.method} ${route.path}`, route.limit);
+      if (!verdict.allowed) {
+        return {
+          status: 429,
+          body: { code: "RATE_LIMITED", message: "Too many requests. Try again shortly." },
+          headers: { "retry-after": String(verdict.resetsIn) }
+        };
+      }
+    }
+    const lacking = (route.requires ?? []).filter((permission) => !may.has(permission));
+    if (lacking.length > 0) {
+      throw new KernelFault(
+        "PERMISSION_DENIED",
+        `${route.method} ${route.path} needs ${lacking.map((permission) => `"${permission}"`).join(", ")}.`,
+        { plugin: plugin2, detail: { lacking } }
+      );
+    }
+    const parsed = route.input.safeParse(incoming.input);
+    if (!parsed.success) {
+      throw new Refusal(400, "INVALID_INPUT", "The request is not valid.", fields(parsed.error));
+    }
+    const returned = await route.handle(parsed.data, context2(plugin2, caller, declared(route, incoming.headers)));
+    const carried = returned instanceof Answered ? returned : void 0;
+    const filtered = route.output.safeParse(carried === void 0 ? returned : carried.body);
+    if (!filtered.success) {
+      log("error", plugin2, `${route.method} ${route.path} returned what its output schema refuses`, {
+        issues: filtered.error.issues.map((issue) => `${issue.path.join(".")}: ${issue.message}`)
+      });
+      return { status: 500, body: { code: "INTERNAL", message: "The request could not be completed." } };
+    }
+    if (carried !== void 0) {
+      return { status: carried.status, body: filtered.data, headers: sendable(carried.headers, plugin2, route, log) };
+    }
+    return { status: route.method === "POST" ? 201 : 200, body: filtered.data };
+  } catch (cause) {
+    const refusal = answer(cause);
+    if (refusal.status >= 500) {
+      log("error", plugin2, `${route.method} ${route.path} threw`, told(cause));
+    }
+    return {
+      status: refusal.status,
+      body: {
+        code: refusal.code,
+        message: refusal.message,
+        ...refusal.fields !== void 0 && { fields: refusal.fields }
+      }
+    };
+  }
+}
+function told(cause) {
+  if (cause instanceof Error) {
+    return {
+      error: cause.message,
+      kind: cause.name,
+      ...cause.stack !== void 0 && { stack: cause.stack },
+      ...cause.cause !== void 0 && { cause: told(cause.cause) }
+    };
+  }
+  return { error: String(cause) };
+}
+var KEPT2 = /* @__PURE__ */ new Set([
+  "set-cookie",
+  "content-security-policy",
+  "x-content-type-options",
+  "x-frame-options",
+  "access-control-allow-origin",
+  "access-control-allow-credentials"
+]);
+function sendable(asked, plugin2, route, log) {
+  const sending = {};
+  for (const [name, value] of Object.entries(asked)) {
+    const lower = name.toLowerCase();
+    if (KEPT2.has(lower)) {
+      log("warn", plugin2, `${route.method} ${route.path} tried to set "${lower}", which the kit answers for`);
+      continue;
+    }
+    if (/[\r\n]/.test(value)) {
+      log("warn", plugin2, `${route.method} ${route.path} tried to set "${lower}" to a value carrying a newline`);
+      continue;
+    }
+    sending[lower] = value;
+  }
+  return sending;
+}
+function declared(route, sent = {}) {
+  const sending = {};
+  for (const name of route.reads ?? []) {
+    const value = sent[name];
+    if (value !== void 0) {
+      sending[name] = value;
+    }
+  }
+  return sending;
+}
+function fields(error) {
+  const named2 = {};
+  for (const issue of error.issues) {
+    const at = issue.path.map((segment) => String(segment)).join(".");
+    if (at !== "" && named2[at] === void 0) {
+      named2[at] = issue.message;
+    }
+  }
+  return named2;
+}
+
+// src/plugins/kernel/internal/names.ts
+var PLUGIN = /^[a-z][a-z0-9-]{0,63}$/;
+var NAMESPACED = /^[a-z][a-z0-9-]{0,63}(\.[a-z][a-z0-9-]{0,63})+$/;
+function describe(value) {
+  const at = [...value].findIndex((character) => !/[a-z0-9.-]/.test(character));
+  return at === -1 ? `"${value}"` : `"${value}" (unsupported character at position ${at + 1}: "${value[at]}")`;
+}
+function plugin(value) {
+  if (!PLUGIN.test(value)) {
+    throw new KernelFault(
+      "INVALID_NAME",
+      `A plugin name is lowercase letters, digits and hyphens, starting with a letter, up to 64 characters. Received ${describe(value)}.`,
+      { detail: { received: value } }
+    );
+  }
+  return value;
+}
+function namespaced(value, kind, owner) {
+  if (!NAMESPACED.test(value)) {
+    throw new KernelFault(
+      "INVALID_NAME",
+      `A ${kind} name is dot-separated lowercase segments, such as "${owner}.thing". Received ${describe(value)}.`,
+      { plugin: owner, detail: { received: value, kind } }
+    );
+  }
+  if (!value.startsWith(`${owner}.`)) {
+    throw new KernelFault(
+      "INVALID_NAME",
+      `A ${kind} is named inside its own plugin: "${value}" belongs to "${value.split(".")[0] ?? ""}", not to "${owner}". Rename it to "${owner}.${value.split(".").slice(1).join(".")}".`,
+      { plugin: owner, detail: { received: value, kind, owner } }
+    );
+  }
+  return value;
+}
+
+// src/plugins/kernel/internal/output.ts
+function filters(schema) {
+  return whitelists(schema, 0, /* @__PURE__ */ new Set());
+}
+var OPEN = /* @__PURE__ */ new Set(["any", "unknown", "record", "map", "custom", "never", "void", "transform", "pipe", "promise", "function", "file", "symbol"]);
+function kindOf(schema) {
+  if (schema === null || typeof schema !== "object") {
+    return "";
+  }
+  return String(schema._zod?.def?.type ?? "");
+}
+function whitelists(schema, depth, seen) {
+  if (depth > 24 || schema === null || typeof schema !== "object") {
+    return false;
+  }
+  if (seen.has(schema)) {
+    return true;
+  }
+  seen.add(schema);
+  const zod = schema;
+  const def = zod._zod?.def;
+  if (def === void 0) {
+    return false;
+  }
+  const kind = String(def["type"] ?? "");
+  if (OPEN.has(kind)) {
+    return false;
+  }
+  switch (kind) {
+    case "object": {
+      const catchall = def["catchall"];
+      if (catchall !== void 0 && kindOf(catchall) !== "never") {
+        return false;
+      }
+      const shape = def["shape"];
+      if (shape === null || typeof shape !== "object") {
+        return false;
+      }
+      return Object.values(shape).every((field) => whitelists(field, depth + 1, seen));
+    }
+    case "array":
+    case "set": {
+      return whitelists(def["element"], depth + 1, seen);
+    }
+    case "tuple": {
+      const items = Array.isArray(def["items"]) ? def["items"] : [];
+      return items.every((item) => whitelists(item, depth + 1, seen)) && def["rest"] === void 0;
+    }
+    case "union": {
+      const options = Array.isArray(def["options"]) ? def["options"] : [];
+      return options.length > 0 && options.every((option) => whitelists(option, depth + 1, seen));
+    }
+    case "intersection": {
+      return whitelists(def["left"], depth + 1, seen) && whitelists(def["right"], depth + 1, seen);
+    }
+    case "optional":
+    case "nullable":
+    case "default":
+    case "prefault":
+    case "readonly":
+    case "nonoptional":
+    case "catch": {
+      return whitelists(def["innerType"], depth + 1, seen);
+    }
+    // A recursive shape: the schema is behind a getter, so it has to be
+    // called. Depth stops the walk before the recursion does, and a tree
+    // that deep is one nobody reviews anyway.
+    case "lazy": {
+      const getter = def["getter"];
+      if (typeof getter !== "function") {
+        return false;
+      }
+      try {
+        return whitelists(getter(), depth + 1, seen);
+      } catch {
+        return false;
+      }
+    }
+    // A leaf: it carries its own value and nothing of the caller's shape.
+    default: {
+      return true;
+    }
+  }
+}
+
+// src/plugins/kernel/internal/validate.ts
+function validate(plugins, config) {
+  const wrong = [];
+  const say = (code, plugin2, message) => {
+    wrong.push({ code, plugin: plugin2, message });
+  };
+  const by = /* @__PURE__ */ new Map();
+  for (const plugin2 of plugins) {
+    if (by.has(plugin2.name)) {
+      say("DUPLICATE_PLUGIN", plugin2.name, `Two plugins are named "${plugin2.name}". A name is what everything else refers to, so it must be unique.`);
+      continue;
+    }
+    by.set(plugin2.name, plugin2);
+  }
+  const owned = {
+    routes: /* @__PURE__ */ new Map(),
+    events: /* @__PURE__ */ new Map(),
+    hooks: /* @__PURE__ */ new Map(),
+    commands: /* @__PURE__ */ new Map(),
+    permissions: /* @__PURE__ */ new Map(),
+    tables: /* @__PURE__ */ new Map()
+  };
+  for (const [name, plugin2] of by) {
+    declares(name, plugin2, owned, say);
+  }
+  for (const [name, plugin2] of by) {
+    refers(name, plugin2, by, owned, say);
+    settings(name, plugin2, config, say);
+  }
+  cycles(by, say);
+  return wrong;
+}
+function declares(name, plugin2, owned, say) {
+  const claim = (kind, key, code, label) => {
+    const first = owned[kind].get(key);
+    if (first !== void 0) {
+      say(code, name, `${label} "${key}" is already declared by "${first}". Two plugins cannot own one name.`);
+      return;
+    }
+    owned[kind].set(key, name);
+  };
+  for (const key of Object.keys(plugin2.definition.permissions ?? {})) {
+    named(name, key, "permission", say) && claim("permissions", key, "DUPLICATE_PERMISSION", "Permission");
+  }
+  for (const key of Object.keys(plugin2.definition.emits ?? {})) {
+    named(name, key, "event", say) && claim("events", key, "DUPLICATE_EVENT", "Event");
+  }
+  for (const key of Object.keys(plugin2.definition.hooks ?? {})) {
+    named(name, key, "hook", say) && claim("hooks", key, "DUPLICATE_HOOK", "Hook");
+  }
+  for (const key of Object.keys(plugin2.definition.commands ?? {})) {
+    named(name, key, "command", say) && claim("commands", key, "DUPLICATE_COMMAND", "Command");
+  }
+  for (const key of Object.keys(plugin2.definition.tables ?? {})) {
+    claim("tables", key, "DUPLICATE_TABLE", "Table");
+  }
+  for (const route of plugin2.definition.routes ?? []) {
+    path(name, route.method, route.path, owned, say);
+    if (route.describe.trim() === "") {
+      say("INVALID_ROUTE", name, `Route ${route.method} "${route.path}" has no description. A route nobody described is one nobody can review.`);
+    }
+    if (!filters(route.output)) {
+      say("INVALID_OUTPUT", name, `Route ${route.method} "${route.path}" has an output schema that cannot filter what leaves. Use z.object naming every field that may be sent: it strips the rest. z.any, z.unknown, z.record, z.looseObject, a catchall and a transform all forward whatever the handler returned.`);
+    }
+    limits(name, route, say);
+    reads(name, route, say);
+  }
+  const scope = plugin2.definition.scope;
+  if (scope !== void 0) {
+    const owns = plugin2.definition.tables ?? {};
+    if (scope.claim.trim() === "") {
+      say("UNDECLARED_SCOPE", name, "A scope names the claim it reads. An empty one reads nothing.");
+    }
+    for (const table of Object.keys(scope.tables)) {
+      if (!(table in owns)) {
+        say("UNDECLARED_SCOPE", name, `Scope names "${table}", which is not one of this plugin's tables. A plugin scopes only what it owns.`);
+      }
+    }
+    if (Object.keys(scope.tables).length === 0) {
+      say("UNDECLARED_SCOPE", name, "A scope names no table, so nothing is scoped. Name the tables that carry the claim, or remove it.");
+    }
+  }
+  for (const host of plugin2.definition.outbound ?? []) {
+    const wrong = unreachable(host);
+    if (wrong !== void 0) {
+      say("UNDECLARED_HOST", name, wrong);
+    }
+  }
+  if (!/^\d+\.\d+\.\d+/.test(plugin2.definition.version)) {
+    say("INVALID_NAME", name, `Version "${plugin2.definition.version}" is not a version. Use major.minor.patch.`);
+  }
+  if (plugin2.definition.describe.trim() === "") {
+    say("INVALID_NAME", name, "A plugin describes itself in one sentence. An empty description tells the next reader nothing.");
+  }
+}
+var SECRET = /* @__PURE__ */ new Set(["cookie", "authorization", "proxy-authorization", "set-cookie"]);
+function reads(name, route, say) {
+  for (const header of route.reads ?? []) {
+    if (header !== header.toLowerCase()) {
+      say("INVALID_ROUTE", name, `Route ${route.method} "${route.path}" reads "${header}". Header names are matched lowercase.`);
+      continue;
+    }
+    if (SECRET.has(header)) {
+      say("INVALID_ROUTE", name, `Route ${route.method} "${route.path}" reads "${header}", which carries a credential. Whoever identifies the caller reads it; a handler holding it would log it.`);
+    }
+  }
+}
+var SCHEMES = /* @__PURE__ */ new Set([
+  "https",
+  // an api, and what ctx.fetch dials
+  "wss",
+  // a socket, encrypted
+  "redis",
+  "rediss",
+  "postgres",
+  "postgresql",
+  "mysql",
+  "mongodb",
+  "mongodb+srv",
+  "amqp",
+  "amqps",
+  "grpc",
+  "grpcs"
+]);
+var PLAIN = /* @__PURE__ */ new Set(["http", "ws", "ftp"]);
+function unreachable(host) {
+  const at = host.indexOf("://");
+  if (at === -1) {
+    return `Outbound host "${host}" names no scheme. Write it as an origin, such as "https://api.stripe.com" or "redis://cache.internal:6379".`;
+  }
+  const scheme = host.slice(0, at).toLowerCase();
+  const rest = host.slice(at + 3);
+  if (PLAIN.has(scheme)) {
+    return `Outbound host "${host}" is not encrypted. Use "${scheme}s://" instead: what travels over ${scheme} travels in the clear, credentials included.`;
+  }
+  if (!SCHEMES.has(scheme)) {
+    return `Outbound host "${host}" uses a scheme this kit does not know. Declared hosts are one of: ${[...SCHEMES].join(", ")}.`;
+  }
+  if (!/^[a-z0-9._-]+(:\d+)?$/i.test(rest)) {
+    return `Outbound host "${host}" is not an origin. Declare the host it reaches, such as "${scheme}://cache.internal:6379", and no path.`;
+  }
+  return void 0;
+}
+function limits(name, route, say) {
+  const limit = route.limit;
+  if (limit === void 0) {
+    return;
+  }
+  if (!Number.isInteger(limit.requests) || limit.requests < 1) {
+    say("INVALID_ROUTE", name, `Route ${route.method} "${route.path}" declares ${limit.requests} requests per window. A budget under one refuses everything, including the caller who set it.`);
+  }
+  if (!Number.isInteger(limit.seconds) || limit.seconds < 1) {
+    say("INVALID_ROUTE", name, `Route ${route.method} "${route.path}" declares a window of ${limit.seconds} seconds. A window without length is one that never resets.`);
+  }
+}
+function path(name, method, given, owned, say) {
+  if (!given.startsWith("/")) {
+    say("INVALID_ROUTE", name, `Route path "${given}" must start with "/".`);
+    return;
+  }
+  if (/\s/.test(given)) {
+    say("INVALID_ROUTE", name, `Route path "${given}" contains whitespace.`);
+    return;
+  }
+  if (given.includes("//") || given.length > 1 && given.endsWith("/")) {
+    say("INVALID_ROUTE", name, `Route path "${given}" has an empty segment. Two paths differing only by a slash are one route to a caller and two to a router.`);
+    return;
+  }
+  for (const segment of given.split("/").slice(1)) {
+    const named2 = segment.startsWith(":") ? /^:[a-zA-Z][a-zA-Z0-9]*$/.test(segment) : /^[a-z0-9][a-z0-9-]*$/.test(segment);
+    if (!named2) {
+      say("INVALID_ROUTE", name, segment.startsWith(":") ? `Route path "${given}" names a parameter "${segment}", which is not letters and digits starting with a letter.` : `Route path "${given}" has a segment "${segment}" outside lowercase letters, digits and hyphens.`);
+      return;
+    }
+  }
+  const shape = `${method} ${given.replace(/:[a-zA-Z0-9]+/g, ":*")}`;
+  const first = owned.routes.get(shape);
+  if (first !== void 0) {
+    say("DUPLICATE_ROUTE", name, `Route ${method} "${given}" is already declared by "${first}". Which one answers would depend on order.`);
+    return;
+  }
+  owned.routes.set(shape, name);
+}
+function named(owner, key, kind, say) {
+  try {
+    namespaced(key, kind, owner);
+    return true;
+  } catch (cause) {
+    say("INVALID_NAME", owner, cause instanceof Error ? cause.message : String(cause));
+    return false;
+  }
+}
+function refers(name, plugin2, by, owned, say) {
+  const declared2 = new Set(plugin2.definition.dependsOn ?? []);
+  const exists = (kind, key, code, label) => {
+    if (owned[kind].get(key) === void 0) {
+      const owner = key.split(".")[0] ?? "";
+      const missing = owner !== "" && owner !== name && !by.has(owner) ? ` "${owner}" would declare it and was not given to createKernel: pass it too, which a test of a listener has to do.` : "";
+      say(code, name, `${label} "${key}" is not declared by any plugin. Declare it, or correct the name.${missing}`);
+    }
+  };
+  for (const need of declared2) {
+    if (!by.has(need)) {
+      say("UNKNOWN_DEPENDENCY", name, `"${name}" depends on "${need}", which no plugin provides. Pass it to createKernel, or remove it from dependsOn.`);
+    }
+  }
+  const reach = (kind, key, code, label) => {
+    const from = owned[kind].get(key);
+    if (from === void 0) {
+      say(code, name, `${label} "${key}" is not declared by any plugin. Declare it, or correct the name.`);
+      return;
+    }
+    if (from !== name && !declared2.has(from)) {
+      say("UNDECLARED_DEPENDENCY", name, `${label} "${key}" belongs to "${from}", which "${name}" does not depend on. Add "${from}" to dependsOn.`);
+    }
+  };
+  for (const key of Object.keys(plugin2.definition.listens ?? {})) {
+    exists("events", key, "UNDECLARED_EVENT", "Event");
+  }
+  for (const key of Object.keys(plugin2.definition.participates ?? {})) {
+    exists("hooks", key, "UNDECLARED_HOOK", "Hook");
+  }
+  for (const route of plugin2.definition.routes ?? []) {
+    for (const permission of route.requires ?? []) {
+      reach("permissions", permission, "UNDECLARED_PERMISSION", "Permission");
+    }
+    if (route.public === true && (route.requires ?? []).length > 0) {
+      say("INVALID_ROUTE", name, `Route ${route.method} "${route.path}" is public and also requires ${(route.requires ?? []).map((one) => `"${one}"`).join(", ")}. It is one or the other.`);
+    }
+  }
+  for (const one of Object.values(plugin2.definition.commands ?? {})) {
+    for (const permission of one.requires ?? []) {
+      reach("permissions", permission, "UNDECLARED_PERMISSION", "Permission");
+    }
+  }
+}
+function settings(name, plugin2, config, say) {
+  const schema = plugin2.definition.config;
+  if (schema === void 0) {
+    return;
+  }
+  const answered = schema.safeParse(config[name] ?? {});
+  if (!answered.success) {
+    const first = answered.error.issues[0];
+    const at = first === void 0 || first.path.length === 0 ? "" : ` at "${first.path.join(".")}"`;
+    say("INVALID_CONFIG", name, `Config for "${name}" is invalid${at}: ${first?.message ?? "it does not match the schema"}.`);
+  }
+}
+function cycles(by, say) {
+  const state = /* @__PURE__ */ new Map();
+  const walking = [];
+  const reported = /* @__PURE__ */ new Set();
+  function walk(name) {
+    if (state.get(name) === "done") {
+      return;
+    }
+    if (state.get(name) === "open") {
+      const at = walking.indexOf(name);
+      const loop = [...walking.slice(at === -1 ? 0 : at), name];
+      const key = [...loop].sort().join(",");
+      if (!reported.has(key)) {
+        reported.add(key);
+        say("DEPENDENCY_CYCLE", name, `Plugins depend on each other in a loop: ${loop.join(" -> ")}. One of them has to stop.`);
+      }
+      return;
+    }
+    state.set(name, "open");
+    walking.push(name);
+    for (const need of [...by.get(name)?.definition.dependsOn ?? []].sort()) {
+      if (by.has(need)) {
+        walk(need);
+      }
+    }
+    walking.pop();
+    state.set(name, "done");
+  }
+  for (const name of [...by.keys()].sort()) {
+    walk(name);
+  }
+}
+
+// src/plugins/kernel/internal/kernel.ts
+var quiet = () => {
+};
+function readable(given) {
+  try {
+    return decodeURIComponent(given);
+  } catch {
+    return void 0;
+  }
+}
+function matched(routes, method, path2) {
+  const exact = routes.get(`${method} ${path2}`);
+  if (exact !== void 0) {
+    return { mounted: exact, params: {} };
+  }
+  const asked = path2.split("/");
+  for (const [key, mounted] of routes) {
+    const [verb, declared2] = key.split(" ");
+    if (verb !== method || declared2 === void 0) {
+      continue;
+    }
+    const parts = declared2.split("/");
+    if (parts.length !== asked.length) {
+      continue;
+    }
+    const params = {};
+    const fits = parts.every((part, at) => {
+      const given = asked[at] ?? "";
+      if (!part.startsWith(":")) {
+        return part === given;
+      }
+      const value = readable(given);
+      if (value === void 0) {
+        return false;
+      }
+      params[part.slice(1)] = value;
+      return given !== "";
+    });
+    if (fits) {
+      return { mounted, params };
+    }
+  }
+  return void 0;
+}
+function taken(input, params) {
+  if (Object.keys(params).length === 0) {
+    return input;
+  }
+  const given = input !== null && typeof input === "object" && !Array.isArray(input) ? { ...input } : {};
+  return { ...given, ...params };
+}
+function createKernel(options) {
+  const config = options.config ?? {};
+  const log = options.log ?? quiet;
+  const known = new Map(options.plugins.map((one) => [one.name, one]));
+  const bus = events(Date.now, (plugin2, line, about) => {
+    log("error", plugin2, line, about);
+  });
+  const points = hooks(options.patience);
+  const parsed = /* @__PURE__ */ new Map();
+  const pending = /* @__PURE__ */ new Map();
+  const routes = /* @__PURE__ */ new Map();
+  const commands = /* @__PURE__ */ new Map();
+  let running = false;
+  let beating;
+  async function due() {
+    if (options.schedule === void 0 || !running) {
+      return;
+    }
+    const clock = options.now ?? Date.now;
+    const taken2 = await options.schedule.take(clock(), 20);
+    for (const job of taken2) {
+      try {
+        await run(job.command, job.input);
+        await options.schedule.done(job.id);
+      } catch (cause) {
+        log("error", job.plugin, "a scheduled command failed", {
+          command: job.command,
+          attempts: job.attempts + 1,
+          error: cause instanceof Error ? cause.message : String(cause)
+        });
+        if (job.attempts + 1 >= (options.attempts ?? 8)) {
+          log("error", job.plugin, "a scheduled command gave up", {
+            command: job.command,
+            attempts: job.attempts + 1
+          });
+          await options.schedule.gaveUp(job.id);
+        } else {
+          await options.schedule.failed(job.id, clock() + Math.min(2 ** job.attempts, 60) * 1e3);
+        }
+      }
+    }
+  }
+  const inFlight = /* @__PURE__ */ new Set();
+  let started = [];
+  const wiring = {
+    known,
+    parsed,
+    open: new AsyncLocalStorage(),
+    config,
+    bus,
+    points,
+    pending,
+    outbox: options.outbox,
+    now: options.now ?? Date.now,
+    schedule: options.schedule,
+    narrow: options.narrow,
+    owned: /* @__PURE__ */ new Map(),
+    db: options.db,
+    dial: options.dial,
+    log,
+    run: (command, input, caller) => run(command, input, caller)
+  };
+  const seenBy = (plugin2, caller, headers) => {
+    return context(wiring, plugin2, caller, void 0, headers);
+  };
+  async function run(command, input, caller) {
+    if (!running) {
+      throw new KernelFault(
+        "NOT_STARTED",
+        `Command "${command}" was run before the kernel started. Every plugin's setup runs first, so a command called from one is too early: reach the service directly instead.`
+      );
+    }
+    const declared2 = commands.get(command);
+    if (declared2 === void 0) {
+      throw new KernelFault("UNDECLARED_COMMAND", `Command "${command}" is not declared by any plugin.`);
+    }
+    const may = permissions(() => caller);
+    const lacking = declared2.requires.filter((permission) => !may.has(permission));
+    if (lacking.length > 0) {
+      const scheduled = caller === void 0 ? " A scheduled run has no caller, so a command asked for by commands.later declares no requires." : "";
+      throw new KernelFault(
+        "PERMISSION_DENIED",
+        `Command "${command}" needs ${lacking.map((permission) => `"${permission}"`).join(", ")}, which the caller does not have.${scheduled}`,
+        { plugin: declared2.plugin, detail: { lacking } }
+      );
+    }
+    const parsed2 = declared2.schema.safeParse(input);
+    if (!parsed2.success) {
+      throw new KernelFault(
+        "INVALID_PAYLOAD",
+        `The input for "${command}" does not match its schema: ${parsed2.error?.issues[0]?.message ?? "it was rejected"}.`,
+        { plugin: declared2.plugin }
+      );
+    }
+    await declared2.run(parsed2.data, seenBy(declared2.plugin, caller));
+  }
+  return {
+    started: () => {
+      return running;
+    },
+    async start() {
+      if (running) {
+        return;
+      }
+      const wrong = validate(options.plugins, config);
+      if (wrong.length > 0) {
+        const lines = wrong.map((problem) => `  - [${problem.code}] ${problem.plugin}: ${problem.message}`);
+        throw new KernelFault(
+          wrong[0]?.code ?? "INVALID_CONFIG",
+          `${wrong.length} ${wrong.length === 1 ? "problem" : "problems"} stopped the kernel from starting:
+${lines.join("\n")}`,
+          { plugin: wrong[0]?.plugin ?? "", detail: { wrong } }
+        );
+      }
+      started = order(known);
+      for (const plugin2 of started) {
+        const schema = plugin2.definition.config;
+        if (schema !== void 0) {
+          parsed.set(plugin2.name, schema.parse(config[plugin2.name] ?? {}));
+        }
+      }
+      for (const plugin2 of started) {
+        for (const [name, event] of Object.entries(plugin2.definition.emits ?? {})) {
+          bus.declare(plugin2.name, name, event);
+        }
+        for (const [name, hook] of Object.entries(plugin2.definition.hooks ?? {})) {
+          points.declare(plugin2.name, name, hook);
+        }
+      }
+      for (const plugin2 of started) {
+        for (const [name, listener] of Object.entries(plugin2.definition.listens ?? {})) {
+          bus.listen(plugin2.name, name, listener);
+        }
+        for (const [name, participant] of Object.entries(plugin2.definition.participates ?? {})) {
+          points.participate(plugin2.name, name, participant);
+        }
+        for (const [name, command] of Object.entries(plugin2.definition.commands ?? {})) {
+          commands.set(name, {
+            plugin: plugin2.name,
+            requires: command.requires ?? [],
+            schema: command.schema,
+            run: command.run
+          });
+        }
+        for (const route of plugin2.definition.routes ?? []) {
+          routes.set(`${route.method} ${route.path}`, { plugin: plugin2.name, route });
+        }
+      }
+      if (options.budget === void 0) {
+        const declared2 = [...routes.values()].filter(({ route }) => route.limit !== void 0);
+        if (declared2.length > 0) {
+          const named2 = declared2.map(({ plugin: plugin2, route }) => `${plugin2}: ${route.method} ${route.path}`);
+          throw new KernelFault(
+            "INVALID_ROUTE",
+            `${declared2.length} ${declared2.length === 1 ? "route declares a limit" : "routes declare limits"} and no budget was given to createKernel, so nothing would enforce them:
+${named2.map((one) => `  - ${one}`).join("\n")}
+Pass \`budget\`, or remove the limits.`,
+            { plugin: declared2[0]?.plugin ?? "" }
+          );
+        }
+      }
+      for (const plugin2 of started) {
+        await plugin2.definition.setup?.(seenBy(plugin2.name));
+      }
+      running = true;
+      if (options.schedule !== void 0) {
+        beating = setInterval(() => void due(), options.beat ?? 1e3);
+        beating.unref?.();
+      }
+      const interrupted = await options.outbox?.waiting() ?? [];
+      for (const announcement of interrupted) {
+        log("info", announcement.plugin, "delivering an event that outlived its process", {
+          event: announcement.name
+        });
+        await bus.deliver(announcement.plugin, announcement.name, announcement.payload, (to) => seenBy(to));
+        await options.outbox?.sent(announcement.id);
+      }
+    },
+    async stop() {
+      running = false;
+      if (beating !== void 0) {
+        clearInterval(beating);
+        beating = void 0;
+      }
+      if (inFlight.size > 0) {
+        log("info", "kernel", "waiting for requests in flight", { count: inFlight.size });
+        await Promise.allSettled([...inFlight]);
+      }
+      for (const plugin2 of [...started].reverse()) {
+        try {
+          await plugin2.definition.teardown?.(seenBy(plugin2.name));
+        } catch (cause) {
+          log("error", plugin2.name, "teardown threw", { cause });
+        }
+      }
+    },
+    routes: () => [...routes.values()].map(({ plugin: plugin2, route }) => ({
+      plugin: plugin2,
+      method: route.method,
+      path: route.path,
+      describe: route.describe,
+      requires: route.requires ?? [],
+      public: route.public === true,
+      limit: route.limit,
+      reads: route.reads ?? []
+    })),
+    handle: (incoming) => {
+      if (!running) {
+        return Promise.resolve(notServing);
+      }
+      const found = matched(routes, incoming.method, incoming.path);
+      if (found === void 0) {
+        return Promise.resolve(unknownRoute);
+      }
+      const answering = respond(
+        found.mounted,
+        { ...incoming, input: taken(incoming.input, found.params) },
+        seenBy,
+        log,
+        options.budget
+      );
+      inFlight.add(answering);
+      return answering.finally(() => {
+        inFlight.delete(answering);
+      });
+    },
+    context: seenBy,
+    events: { failures: bus.failures },
+    due,
+    run
+  };
+}
+
+// src/plugins/kernel/internal/define.ts
+function definePlugin(name, definition) {
+  plugin(name);
+  return { name, definition };
+}
+definePlugin.over = () => (name, definition) => {
+  plugin(name);
+  return { name, definition };
+};
+function defineRoute() {
+  return (route) => {
+    return route;
+  };
+}
+function defineListener() {
+  return (_schema, listener) => {
+    return listener;
+  };
+}
+function defineParticipant() {
+  return (_schema, participant) => {
+    return participant;
+  };
+}
+function defineCommand() {
+  return (command) => {
+    return command;
+  };
+}
+var MigrationFault = class extends Error {
+  plugin;
+  step;
+  constructor(message, plugin2, step) {
+    super(message);
+    this.name = "MigrationFault";
+    this.plugin = plugin2;
+    this.step = step;
+  }
+};
+var NAMED = /^(\d{4})-[a-z0-9][a-z0-9-]*\.sql$/;
+var LEDGER = `
+    CREATE TABLE IF NOT EXISTS _migrations (
+        plugin TEXT NOT NULL,
+        name   TEXT NOT NULL,
+        hash   TEXT NOT NULL,
+        ran_at TEXT NOT NULL,
+        PRIMARY KEY (plugin, name)
+    )
+`;
+function read(plugin2, from, name) {
+  const sql = readFileSync(join(from, name), "utf8");
+  return { plugin: plugin2, name, sql, hash: createHash("sha256").update(sql).digest("hex") };
+}
+function steps(source) {
+  let found;
+  try {
+    found = readdirSync(source.from);
+  } catch {
+    throw new MigrationFault(`"${source.plugin}" declares migrations at "${source.from}", which cannot be read.`, source.plugin);
+  }
+  const sql = found.filter((name) => name.endsWith(".sql"));
+  for (const name of sql) {
+    if (!NAMED.test(name)) {
+      throw new MigrationFault(`"${name}" is not named NNNN-name.sql, so its place in the order is ambiguous.`, source.plugin, name);
+    }
+  }
+  const numbers = /* @__PURE__ */ new Map();
+  for (const name of sql) {
+    const at = NAMED.exec(name)?.[1] ?? "";
+    const first = numbers.get(at);
+    if (first !== void 0) {
+      throw new MigrationFault(`"${name}" and "${first}" share the number ${at}, so which runs first is undefined.`, source.plugin, name);
+    }
+    numbers.set(at, name);
+  }
+  return [...sql].sort().map((name) => read(source.plugin, source.from, name));
+}
+function migrate(connection, sources) {
+  connection.exec(LEDGER);
+  const seen = /* @__PURE__ */ new Map();
+  for (const row of connection.prepare("SELECT plugin, name, hash FROM _migrations").all()) {
+    seen.set(`${row.plugin}/${row.name}`, row.hash);
+  }
+  const ran = [];
+  for (const source of sources) {
+    for (const step of steps(source)) {
+      const before = seen.get(`${step.plugin}/${step.name}`);
+      if (before === step.hash) {
+        continue;
+      }
+      if (before !== void 0) {
+        throw new MigrationFault(
+          `"${step.name}" has changed since it ran. A migration is history: add a new one rather than editing what other databases already applied.`,
+          step.plugin,
+          step.name
+        );
+      }
+      const apply = connection.transaction(() => {
+        connection.exec(step.sql);
+        connection.prepare("INSERT INTO _migrations (plugin, name, hash, ran_at) VALUES (?, ?, ?, ?)").run(step.plugin, step.name, step.hash, (/* @__PURE__ */ new Date()).toISOString());
+      });
+      try {
+        apply();
+      } catch (cause) {
+        throw new MigrationFault(
+          `"${step.name}" failed: ${cause instanceof Error ? cause.message : String(cause)}`,
+          step.plugin,
+          step.name
+        );
+      }
+      ran.push(step);
+    }
+  }
+  return ran;
+}
+function narrowing(owned) {
+  return (table, column, value) => {
+    const found = Object.values(owned).map((tables) => tables[table]).find((one) => one !== void 0);
+    if (found === void 0) {
+      throw new Error(`Cannot scope "${table}": no table of that name was given to the store.`);
+    }
+    const at = found[column];
+    if (at === void 0) {
+      throw new Error(`Cannot scope "${table}" by "${column}": the table declares no such column.`);
+    }
+    return eq(at, value);
+  };
+}
+
+// src/plugins/database/internal/outbox.ts
+function outbox(connection) {
+  connection.exec(`
+        CREATE TABLE IF NOT EXISTS kit_outbox (
+            id TEXT PRIMARY KEY,
+            plugin TEXT NOT NULL,
+            name TEXT NOT NULL,
+            payload TEXT NOT NULL,
+            keptAt TEXT NOT NULL
+        )
+    `);
+  const insert = connection.prepare(
+    "INSERT INTO kit_outbox (id, plugin, name, payload, keptAt) VALUES (?, ?, ?, ?, ?)"
+  );
+  const remove = connection.prepare("DELETE FROM kit_outbox WHERE id = ?");
+  const unsent = connection.prepare("SELECT id, plugin, name, payload FROM kit_outbox ORDER BY keptAt");
+  return {
+    // Synchronous, and it must stay that way: this runs inside an open
+    // transaction, and an await here would let another one interleave.
+    keep: (_db, announcements) => {
+      const at = (/* @__PURE__ */ new Date()).toISOString();
+      for (const one of announcements) {
+        insert.run(one.id, one.plugin, one.name, JSON.stringify(one.payload), at);
+      }
+    },
+    sent: (id) => {
+      try {
+        remove.run(id);
+      } catch (cause) {
+        if (!(cause instanceof TypeError)) {
+          throw cause;
+        }
+      }
+      return Promise.resolve();
+    },
+    waiting: () => {
+      const rows = unsent.all();
+      return Promise.resolve(rows.map((row) => ({
+        id: row.id,
+        plugin: row.plugin,
+        name: row.name,
+        payload: JSON.parse(row.payload)
+      })));
+    }
+  };
+}
+
+// src/plugins/database/internal/schedule.ts
+function schedule(connection) {
+  connection.exec(`
+        CREATE TABLE IF NOT EXISTS kit_schedule (
+            id TEXT PRIMARY KEY,
+            plugin TEXT NOT NULL,
+            command TEXT NOT NULL,
+            input TEXT NOT NULL,
+            runAt INTEGER NOT NULL,
+            takenAt INTEGER,
+            attempts INTEGER NOT NULL DEFAULT 0
+        );
+
+        CREATE INDEX IF NOT EXISTS kit_schedule_due ON kit_schedule (runAt) WHERE takenAt IS NULL;
+    `);
+  const insert = connection.prepare(
+    "INSERT INTO kit_schedule (id, plugin, command, input, runAt, attempts) VALUES (?, ?, ?, ?, ?, ?)"
+  );
+  const claim = connection.prepare(`
+        UPDATE kit_schedule SET takenAt = ?
+        WHERE id IN (
+            SELECT id FROM kit_schedule
+            WHERE takenAt IS NULL AND runAt <= ?
+            ORDER BY runAt
+            LIMIT ?
+        )
+        RETURNING id, plugin, command, input, runAt, attempts
+    `);
+  const remove = connection.prepare("DELETE FROM kit_schedule WHERE id = ?");
+  const again = connection.prepare(
+    "UPDATE kit_schedule SET takenAt = NULL, runAt = ?, attempts = attempts + 1 WHERE id = ?"
+  );
+  return {
+    keep: (_db, job) => {
+      insert.run(job.id, job.plugin, job.command, JSON.stringify(job.input), job.at, job.attempts);
+    },
+    take: (now, limit) => {
+      const rows = claim.all(now, now, limit);
+      return Promise.resolve(rows.map((row) => ({
+        id: row.id,
+        plugin: row.plugin,
+        command: row.command,
+        input: JSON.parse(row.input),
+        at: row.runAt,
+        attempts: row.attempts
+      })));
+    },
+    done: (id) => {
+      remove.run(id);
+      return Promise.resolve();
+    },
+    failed: (id, at) => {
+      again.run(at, id);
+      return Promise.resolve();
+    },
+    gaveUp: (id) => {
+      remove.run(id);
+      return Promise.resolve();
+    }
+  };
+}
+function connect(opening) {
+  const memory = opening.file === ":memory:";
+  if (!memory) {
+    mkdirSync(dirname(opening.file), { recursive: true });
+  }
+  const connection = new Database(opening.file);
+  if (opening.wal ?? !memory) {
+    connection.pragma("journal_mode = WAL");
+    connection.pragma("synchronous = NORMAL");
+  }
+  connection.pragma("foreign_keys = ON");
+  connection.pragma(`busy_timeout = ${opening.busyMs ?? 5e3}`);
+  return connection;
+}
+
+// src/plugins/database/internal/queue.ts
+function queue() {
+  let last = Promise.resolve();
+  return {
+    run: (work) => {
+      const mine = last.then(work, work);
+      last = mine.catch(() => void 0);
+      return mine;
+    }
+  };
+}
+
+// src/plugins/database/internal/store.ts
+function store(holding) {
+  const handles = /* @__PURE__ */ new Map();
+  const waiting = queue();
+  const inside = new AsyncLocalStorage();
+  let open = true;
+  let counter = 0;
+  function of(plugin2) {
+    if (!open) {
+      throw new Error(`"${plugin2}" reached the database after it was closed.`);
+    }
+    const already = handles.get(plugin2);
+    if (already !== void 0) {
+      return already;
+    }
+    const owns = holding.tables[plugin2];
+    if (owns === void 0) {
+      throw new Error(`"${plugin2}" asked for a database handle but declares no tables. Add them to its contract, or stop reaching for ctx.db.`);
+    }
+    const made = drizzle(holding.connection, { schema: owns });
+    handles.set(plugin2, made);
+    return made;
+  }
+  async function within(plugin2, run) {
+    const db = of(plugin2);
+    const nested = inside.getStore() !== void 0;
+    counter += 1;
+    const at = counter;
+    const name = `sp_${String(at)}`;
+    holding.connection.exec(nested ? `SAVEPOINT ${name}` : "BEGIN IMMEDIATE");
+    try {
+      const made = await inside.run(at, () => run(db));
+      holding.connection.exec(nested ? `RELEASE ${name}` : "COMMIT");
+      return made;
+    } catch (cause) {
+      try {
+        holding.connection.exec(nested ? `ROLLBACK TO ${name}; RELEASE ${name}` : "ROLLBACK");
+      } catch {
+      }
+      throw cause;
+    }
+  }
+  return {
+    of,
+    /**
+     * Runs work in one transaction, rolled back if it throws.
+     *
+     * Serialised against every other transaction and every write: this is
+     * async but better-sqlite3 is not, so an await inside would otherwise
+     * leave the connection in a transaction while other work ran through
+     * it. That work would then belong to this transaction, and vanish
+     * with its rollback.
+     *
+     * A transaction already open on this call stack becomes a savepoint
+     * rather than queueing behind itself, which would deadlock.
+     */
+    tx: (plugin2, run) => {
+      return inside.getStore() === void 0 ? waiting.run(() => within(plugin2, run)) : within(plugin2, run);
+    },
+    /**
+     * Runs work outside a transaction, but never during someone else's.
+     *
+     * better-sqlite3 is synchronous, so one statement cannot interleave
+     * with another. What can interleave is a statement issued while an
+     * async transaction is parked on an await: it joins that transaction
+     * and is undone by its rollback, having told its caller it succeeded.
+     *
+     * The kernel routes every non-transactional query through here, so
+     * that window does not exist. It always queues: `depth` says a
+     * transaction is open somewhere, never that this caller is the one
+     * inside it, and work that is genuinely inside one reaches the
+     * database through the transaction's own handle instead.
+     */
+    write: (run) => {
+      return inside.getStore() === void 0 ? waiting.run(run) : run();
+    },
+    /** Whether the running code is inside a transaction. For diagnosis. */
+    inTransaction: () => {
+      return inside.getStore() !== void 0;
+    },
+    close: () => {
+      open = false;
+      handles.clear();
+      holding.connection.close();
+    }
+  };
+}
+
+// src/plugins/database/api.ts
+function database(settings2) {
+  const connection = connect(settings2);
+  const made = store({ connection, tables: settings2.tables });
+  return {
+    of: made.of,
+    tx: made.tx,
+    write: made.write,
+    inTransaction: made.inTransaction,
+    close: made.close,
+    /** Runs every migration that has not run, in the order given. */
+    migrate: (sources) => {
+      return migrate(connection, sources);
+    },
+    /**
+     * Where events wait, in this same database.
+     *
+     * Built here rather than from a connection handed out, because an
+     * outbox that wrote somewhere else would be exactly the thing it
+     * exists to prevent: two places that can disagree about whether the
+     * work happened.
+     */
+    outbox: () => {
+      return outbox(connection);
+    },
+    /** Where later work waits, in this same database. */
+    schedule: () => {
+      return schedule(connection);
+    },
+    /** How a scope narrows a query, over the tables one plugin declared. */
+    narrowing: () => {
+      return narrowing(settings2.tables);
+    }
+  };
+}
+function same(left, right) {
+  const first = Buffer.from(left, "utf8");
+  const second = Buffer.from(right, "utf8");
+  if (first.length !== second.length) {
+    return false;
+  }
+  return timingSafeEqual(first, second);
+}
+
+// src/plugins/guard/internal/limit.ts
+function limiter(now = Date.now) {
+  const counted = /* @__PURE__ */ new Map();
+  return {
+    take: (key, window) => {
+      const at = now();
+      const seen = counted.get(key);
+      if (seen === void 0 || seen.until <= at) {
+        counted.set(key, { hits: 1, until: at + window.seconds * 1e3 });
+        return { allowed: true, remaining: window.requests - 1, resetsIn: window.seconds };
+      }
+      seen.hits += 1;
+      return {
+        allowed: seen.hits <= window.requests,
+        remaining: Math.max(0, window.requests - seen.hits),
+        resetsIn: Math.ceil((seen.until - at) / 1e3)
+      };
+    },
+    // Called on a timer by whoever holds the limiter: a map that only
+    // grows is a slow leak on a public route.
+    sweep: () => {
+      const at = now();
+      let dropped = 0;
+      for (const [key, seen] of counted) {
+        if (seen.until <= at) {
+          counted.delete(key);
+          dropped += 1;
+        }
+      }
+      return dropped;
+    },
+    size: () => {
+      return counted.size;
+    }
+  };
+}
+
+export { Answered, KernelFault, MigrationFault, Refusal, answer, createKernel, database, defineCommand, defineListener, defineParticipant, definePlugin, defineRoute, limiter, narrowing, outbox, same, schedule };
+//# sourceMappingURL=chunk-UCWOCNTI.js.map
+//# sourceMappingURL=chunk-UCWOCNTI.js.map