@camstack/types 1.2.394 → 1.2.396

package/dist/{sleep-gRQc2IoX.js → sleep-Re8daN0Y.js}

@@ -166,7 +166,7 @@ function omitTransientConfig(schema, config) {
 	return next;
 }
 function collectOmitted(field, out) {
-	if (!isRecord$6(field)) return;
+	if (!isRecord$7(field)) return;
 	const type = field["type"];
 	const key = field["key"];
 	if (field["omitFromSettings"] === true && typeof key === "string" && key.length > 0) out.add(key);
@@ -186,7 +186,7 @@ function collectKeychainStoredKeys(schema) {
 	return keys;
 }
 function walkKeychainField(field, out) {
-	if (!isRecord$6(field)) return;
+	if (!isRecord$7(field)) return;
 	const type = field["type"];
 	const key = field["key"];
 	const isSecret = type === "password" || field["secret"] === true;
@@ -211,21 +211,21 @@ function schemaDeclaresAnyField(schema) {
 	for (const section of sectionsOf(schema)) if (fieldsOf(section).length > 0) return true;
 	return false;
 }
-function isRecord$6(value) {
+function isRecord$7(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function sectionsOf(schema) {
-	if (!isRecord$6(schema)) return [];
+	if (!isRecord$7(schema)) return [];
 	const sections = schema["sections"];
 	return Array.isArray(sections) ? sections : [];
 }
 function fieldsOf(node) {
-	if (!isRecord$6(node)) return [];
+	if (!isRecord$7(node)) return [];
 	const fields = node["fields"];
 	return Array.isArray(fields) ? fields : [];
 }
 function walkField(field, out) {
-	if (!isRecord$6(field)) return;
+	if (!isRecord$7(field)) return;
 	const type = field["type"];
 	const key = field["key"];
 	if ((type === "password" || field["secret"] === true) && typeof key === "string" && key.length > 0) out.add(key);
@@ -265,7 +265,7 @@ function walkField(field, out) {
 var SECRET_CLEAR = { $secretClear: true };
 /** The `'***'` token D634 redaction writes for non-admins. */
 var LEGACY_DEVICE_REDACTION = "***";
-function isRecord$5(value) {
+function isRecord$6(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function makeSecretMarker(ref) {
@@ -276,19 +276,19 @@ function makeSecretMarker(ref) {
 }
 /** A stored marker: an object whose `$secret` is a non-empty string. */
 function isSecretMarker(value) {
-	if (!isRecord$5(value)) return false;
+	if (!isRecord$6(value)) return false;
 	const ref = value["$secret"];
 	return typeof ref === "string" && ref.length > 0;
 }
 /** Anything carrying a `$secret` key — a stored marker or a UI view of one. */
 function isSecretMarkerLike(value) {
-	return isRecord$5(value) && Object.prototype.hasOwnProperty.call(value, "$secret");
+	return isRecord$6(value) && Object.prototype.hasOwnProperty.call(value, "$secret");
 }
 function isSecretClear(value) {
-	return isRecord$5(value) && value["$secretClear"] === true;
+	return isRecord$6(value) && value["$secretClear"] === true;
 }
 function isSecretFieldView(value) {
-	return isRecord$5(value) && value["set"] === true && isSecretMarkerLike(value);
+	return isRecord$6(value) && value["set"] === true && isSecretMarkerLike(value);
 }
 /**
 * The UI view of a stored secret field value: a marker becomes "set", inline
@@ -1069,7 +1069,7 @@ var KeychainWriteRefusedError = class extends Error {
 	}
 };
 var KEEP = { kind: "keep" };
-function isRecord$4(value) {
+function isRecord$5(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function defaultMintId() {
@@ -1082,7 +1082,7 @@ function collectSecretMarkerRefs(value, out = []) {
 		return out;
 	}
 	if (Array.isArray(value)) for (const item of value) collectSecretMarkerRefs(item, out);
-	else if (isRecord$4(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
+	else if (isRecord$5(value)) for (const child of Object.values(value)) collectSecretMarkerRefs(child, out);
 	return out;
 }
 async function storedValueEquals(secrets, marker, candidate) {
@@ -1137,7 +1137,7 @@ function rowId(row, idKey) {
 	return null;
 }
 async function writeArray(ctx, node, incoming, stored, fieldPath) {
-	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$4) : [];
+	const storedRows = Array.isArray(stored) ? stored.filter(isRecord$5) : [];
 	if (!Array.isArray(incoming)) {
 		ctx.deletes.push(...collectSecretMarkerRefs(storedRows));
 		return {
@@ -1153,7 +1153,7 @@ async function writeArray(ctx, node, incoming, stored, fieldPath) {
 	const kept = /* @__PURE__ */ new Set();
 	const rows = [];
 	for (const row of incoming) {
-		if (!isRecord$4(row)) {
+		if (!isRecord$5(row)) {
 			rows.push(row);
 			continue;
 		}
@@ -1178,7 +1178,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 		case "leaf": return writeLeaf(ctx, incoming, stored, fieldPath);
 		case "array": return writeArray(ctx, node, incoming, stored, fieldPath);
 		case "object": {
-			if (!isRecord$4(incoming)) {
+			if (!isRecord$5(incoming)) {
 				if (incoming === void 0) return KEEP;
 				ctx.deletes.push(...collectSecretMarkerRefs(stored));
 				return {
@@ -1186,7 +1186,7 @@ async function writeNode(ctx, node, incoming, stored, fieldPath) {
 					value: incoming
 				};
 			}
-			const storedObj = isRecord$4(stored) ? stored : {};
+			const storedObj = isRecord$5(stored) ? stored : {};
 			return {
 				kind: "value",
 				value: await writeMembers(ctx, node.children, incoming, storedObj, (m) => `${fieldPath}.${m}`)
@@ -1309,7 +1309,7 @@ async function resolveSecretMarkers(value, secrets, options = {}) {
 				value: items
 			};
 		}
-		if (isRecord$4(v)) {
+		if (isRecord$5(v)) {
 			const out = {};
 			for (const [k, child] of Object.entries(v)) {
 				const s = substitute(child);
@@ -1343,7 +1343,7 @@ var SecretOverwriteRefusedError = class extends Error {
 		this.name = "SecretOverwriteRefusedError";
 	}
 };
-function isRecord$3(value) {
+function isRecord$4(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function resolvedValue(pass, marker) {
@@ -1372,7 +1372,7 @@ function inArray(pass, incoming, stored) {
 	return incoming.map((item, index) => {
 		const twin = stored[index];
 		if (isSecretMarker(twin)) return typeof item === "string" && item === resolvedValue(pass, twin) ? twin : item;
-		if (isRecord$3(item) && isRecord$3(twin)) return inArrayRow(pass, item, twin);
+		if (isRecord$4(item) && isRecord$4(twin)) return inArrayRow(pass, item, twin);
 		if (Array.isArray(item) && Array.isArray(twin)) return inArray(pass, item, twin);
 		return item;
 	});
@@ -1383,7 +1383,7 @@ function inArrayRow(pass, incoming, stored) {
 		const twin = stored[key];
 		if (isSecretMarker(twin)) {
 			if (typeof value === "string" && value === resolvedValue(pass, twin)) out[key] = twin;
-		} else if (isRecord$3(value) && isRecord$3(twin)) out[key] = inArrayRow(pass, value, twin);
+		} else if (isRecord$4(value) && isRecord$4(twin)) out[key] = inArrayRow(pass, value, twin);
 		else if (Array.isArray(value) && Array.isArray(twin)) out[key] = inArray(pass, value, twin);
 	}
 	return out;
@@ -1391,7 +1391,7 @@ function inArrayRow(pass, incoming, stored) {
 async function walk(pass, incoming, stored) {
 	if (isSecretMarker(stored)) return atMarker(pass, incoming, stored);
 	if (Array.isArray(incoming) && Array.isArray(stored)) return inArray(pass, incoming, stored);
-	if (!isRecord$3(incoming) || !isRecord$3(stored)) return incoming;
+	if (!isRecord$4(incoming) || !isRecord$4(stored)) return incoming;
 	const out = { ...incoming };
 	for (const [key, value] of Object.entries(incoming)) out[key] = await walk(pass, value, stored[key]);
 	return out;
@@ -1422,7 +1422,7 @@ async function restoreUnchangedSecrets(input) {
 function isJsonEqual(a, b) {
 	if (Object.is(a, b)) return true;
 	if (Array.isArray(a)) return Array.isArray(b) && a.length === b.length && a.every((v, i) => isJsonEqual(v, b[i]));
-	if (isRecord$3(a) && isRecord$3(b)) {
+	if (isRecord$4(a) && isRecord$4(b)) {
 		const keys = Object.keys(a);
 		if (keys.length !== Object.keys(b).length) return false;
 		return keys.every((k) => Object.prototype.hasOwnProperty.call(b, k) && isJsonEqual(a[k], b[k]));
@@ -1446,7 +1446,7 @@ function markerKeysOf(blob, owner) {
 }
 function nodeFromStored(value, owner) {
 	if (isSecretMarker(value)) return isSecretRefOwnedBy(value.$secret, owner) ? { kind: "leaf" } : null;
-	if (!isRecord$3(value)) return null;
+	if (!isRecord$4(value)) return null;
 	const children = /* @__PURE__ */ new Map();
 	for (const [key, child] of Object.entries(value)) {
 		const node = nodeFromStored(child, owner);
@@ -3505,11 +3505,11 @@ function secretArrayPrefixes(path) {
 	}
 	return prefixes;
 }
-function isRecord$2(value) {
+function isRecord$3(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function elementId(element, idKey, declared, prefix) {
-	const id = isRecord$2(element) ? element[idKey] : void 0;
+	const id = isRecord$3(element) ? element[idKey] : void 0;
 	if (typeof id !== "string" || id.length === 0) throw new InvalidRecordError(`"${declared}": every element of "${prefix}" needs a non-empty string "${idKey}" to carry a secret`);
 	return id;
 }
@@ -3520,7 +3520,7 @@ function elementId(element, idKey, declared, prefix) {
 */
 var REMOVE_LEAF = Symbol("remove-leaf");
 function mapAt(node, segments, index, walkedKeys, concretePrefix, declared, arrayKeys, visit) {
-	if (!isRecord$2(node)) return node;
+	if (!isRecord$3(node)) return node;
 	const segment = segments[index];
 	if (segment === void 0) return node;
 	if (!Object.prototype.hasOwnProperty.call(node, segment.key)) return node;
@@ -3762,7 +3762,7 @@ function declarationsOf(kinds) {
 }
 //#endregion
 //#region src/records/records-access.ts
-function isRecord$1(value) {
+function isRecord$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 /** Run a transport call and give a wire failure its typed class back. */
@@ -3887,7 +3887,7 @@ var KindHandle = class {
 		}) : data;
 		const parsed = this.def.schema.safeParse(shaped);
 		if (!parsed.success) throw new InvalidRecordError(`${this.name}/${id}: ${zodSummary(parsed.error)}`);
-		if (!isRecord$1(parsed.data)) throw new InvalidRecordError(`${this.name}/${id}: the body must be an object`);
+		if (!isRecord$2(parsed.data)) throw new InvalidRecordError(`${this.name}/${id}: the body must be an object`);
 		return parsed.data;
 	}
 	async get(id) {
@@ -4056,7 +4056,7 @@ var KindHandle = class {
 	}
 };
 function toBody(value) {
-	if (!isRecord$1(value)) throw new InvalidRecordError("the record body must be an object");
+	if (!isRecord$2(value)) throw new InvalidRecordError("the record body must be an object");
 	return value;
 }
 /** Build the owner's records handle. */
@@ -4144,17 +4144,236 @@ function defineEntryKind(name, spec) {
 	return defined;
 }
 //#endregion
-//#region src/records/in-memory-records.ts
+//#region src/records/in-memory-records-plan.ts
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** `json_extract(data, '$.a.b')`. */
+function extractField(data, path) {
+	let current = data;
+	for (const segment of path.split(".")) {
+		if (!isRecord$1(current)) return null;
+		current = current[segment];
+	}
+	if (current === void 0 || current === null) return null;
+	if (typeof current === "boolean") return current ? 1 : 0;
+	if (typeof current === "number" || typeof current === "string") return current;
+	return JSON.stringify(current);
+}
+/** A bound parameter. */
+function bindable(value) {
+	if (typeof value === "boolean") return value ? 1 : 0;
+	if (typeof value === "string" || typeof value === "number") return value;
+	throw new InvalidRecordError("a where value must be a string, number or boolean");
+}
+function compareText(a, b) {
+	const ai = a[Symbol.iterator]();
+	const bi = b[Symbol.iterator]();
+	for (;;) {
+		const x = ai.next();
+		const y = bi.next();
+		if (x.done === true) return y.done === true ? 0 : -1;
+		if (y.done === true) return 1;
+		const cx = x.value.codePointAt(0) ?? 0;
+		const cy = y.value.codePointAt(0) ?? 0;
+		if (cx !== cy) return cx < cy ? -1 : 1;
+	}
+}
+/** ORDER BY order: NULL < numbers < text. */
+function compareSql(a, b) {
+	if (a === null || b === null) return a === b ? 0 : a === null ? -1 : 1;
+	if (typeof a === "number" && typeof b === "number") return a === b ? 0 : a < b ? -1 : 1;
+	if (typeof a === "number") return -1;
+	if (typeof b === "number") return 1;
+	return compareText(a, b);
+}
 /**
-* In-memory `RecordsAccess` for specs. Kinds are declared by the caller.
-* Lives in `@camstack/types` so a spec does not import another package's source.
+* A row-value comparison `(a, b, …) > (x, y, …)` with SQL's three values:
+* the first unequal pair decides, and a NULL met before it makes the whole
+* comparison NULL (the row is not returned).
+*/
+function rowValueAfter(row, cursor, desc) {
+	for (let i = 0; i < row.length; i += 1) {
+		const a = row[i] ?? null;
+		const b = cursor[i] ?? null;
+		if (a === null || b === null) return false;
+		const c = compareSql(a, b);
+		if (c !== 0) return desc ? c < 0 : c > 0;
+	}
+	return false;
+}
+function predicateOf(field, value) {
+	if (typeof value === "object") return {
+		field,
+		shape: "in" in value ? "in" : "range",
+		value
+	};
+	return {
+		field,
+		shape: "eq",
+		value
+	};
+}
+function predicateTest(p) {
+	const value = p.value;
+	if (p.shape === "eq") {
+		const wanted = bindable(value);
+		return (data) => {
+			const got = extractField(data, p.field);
+			return got !== null && compareSql(got, wanted) === 0;
+		};
+	}
+	if (typeof value === "object" && "in" in value) {
+		const set = value.in.map(bindable);
+		return (data) => {
+			const got = extractField(data, p.field);
+			return got !== null && set.some((w) => w !== null && compareSql(got, w) === 0);
+		};
+	}
+	if (typeof value !== "object") return () => false;
+	const active = [
+		["gt" in value ? value.gt : void 0, (c) => c > 0],
+		["gte" in value ? value.gte : void 0, (c) => c >= 0],
+		["lt" in value ? value.lt : void 0, (c) => c < 0],
+		["lte" in value ? value.lte : void 0, (c) => c <= 0]
+	].flatMap(([b, ok]) => b === void 0 ? [] : [{
+		bound: bindable(b),
+		ok
+	}]);
+	return (data) => {
+		const got = extractField(data, p.field);
+		if (got === null) return false;
+		return active.every(({ bound, ok }) => ok(compareSql(got, bound)));
+	};
+}
+/** `planWhere` of the engine: find the declared index, or refuse with the engine's error. */
+function planWhere(kind, decl, where, opts) {
+	const predicates = Object.entries(where ?? {}).map(([f, v]) => predicateOf(f, v));
+	const extra = opts.extraFields ?? [];
+	if (predicates.length === 0 && extra.length === 0) return null;
+	const equalities = predicates.filter((p) => p.shape !== "range");
+	const ranges = predicates.filter((p) => p.shape === "range");
+	if (ranges.length > 1) throw new UnindexedFilterError(`${kind}: at most one range predicate (${ranges.map((r) => r.field).join(", ")}) - it must be the field right after the equality fields of one index`);
+	if (!opts.allowIn && equalities.some((p) => p.shape === "in")) throw new UnindexedFilterError(`${kind}: an "in" set cannot be paged in index order - ask once per value`);
+	const eqCount = equalities.length;
+	const eqSet = new Set(equalities.map((p) => p.field));
+	const range = ranges[0];
+	const candidates = decl.indexes.filter((index) => {
+		const leading = index.fields.slice(0, eqCount);
+		if (leading.length !== eqCount || !leading.every((f) => eqSet.has(f))) return false;
+		if (range !== void 0 && index.fields[eqCount] !== range.field) return false;
+		return extra.every((f) => index.fields.includes(f));
+	});
+	const groupBy = opts.groupBy;
+	const candidate = (groupBy === void 0 ? void 0 : candidates.find((index) => index.fields[eqCount] === groupBy)) ?? candidates[0];
+	if (candidate === void 0) {
+		const declared = decl.indexes.map((i) => `${i.name}(${i.fields.join(", ")})`).join("; ");
+		throw new UnindexedFilterError(`${kind}: no declared index serves [${[...predicates.map((p) => p.field), ...extra].join(", ")}]. Declared: ${declared.length > 0 ? declared : "none"}. A filter on an unindexed field does not compile - declare an index`);
+	}
+	const tests = predicates.map(predicateTest);
+	return {
+		indexName: candidate.name,
+		orderFields: candidate.fields.slice(eqCount),
+		matches: (data) => tests.every((t) => t(data))
+	};
+}
+function assertWindowAllowed(kind, decl, w) {
+	if (w.deviceId !== void 0 && decl.device === "none") throw new InvalidRecordError(`${kind}: declared device: "none", it cannot be filtered by deviceId`);
+	if ((w.atFrom !== void 0 || w.atTo !== void 0) && decl.at === "none") throw new InvalidRecordError(`${kind}: declared at: "none", it cannot be filtered by time`);
+}
+function inWindow(row, w) {
+	if (w.deviceId !== void 0 && row.deviceId !== w.deviceId) return false;
+	if (w.atFrom !== void 0 && (row.at === null || row.at < w.atFrom)) return false;
+	if (w.atTo !== void 0 && (row.at === null || row.at >= w.atTo)) return false;
+	return true;
+}
+//#endregion
+//#region src/records/in-memory-records-rows.ts
+/**
+* The row rules of the records engine for the in-memory world. MIRRORS
+* `packages/system/src/builtins/sqlite-storage/records/records-rows.ts`
+* (`validateHeader`, `enforceSecrets`, the `maxDataBytes` refusal); the
+* contract spec in `@camstack/system` holds the two together.
 */
 function isRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-/** RFC 7396: objects merge key by key, `null` removes, anything else replaces. */
+function validateHeader(kind, decl, rec, nowMs) {
+	const fail = (why) => {
+		throw new InvalidRecordError(`${kind}/${rec.id.slice(0, 64)}: ${why}`);
+	};
+	if (rec.id.length === 0 || rec.id.length > 256) fail(`the id must be 1..256 characters`);
+	if (decl.device === "required" && rec.deviceId === void 0) fail("deviceId is required");
+	if (decl.device === "none" && rec.deviceId !== void 0) fail("this kind is not device-scoped");
+	if (decl.at === "required" && rec.at === void 0) fail("at is required");
+	if (decl.at === "none" && rec.at !== void 0) fail("this kind has no time");
+	const { retention } = decl;
+	let expiresAt = rec.expiresAt ?? null;
+	if ("ttlMs" in retention) {
+		if (rec.expiresAt !== void 0) fail("expiresAt is set by the engine on a kind with a ttl retention");
+		expiresAt = (retention.from === "at" ? rec.at ?? nowMs : nowMs) + retention.ttlMs;
+	} else if (rec.expiresAt !== void 0 && decl.secretPaths.length > 0) fail("a kind with secret fields cannot expire by the engine (its keychain values would be orphaned)");
+	return {
+		id: rec.id,
+		deviceId: rec.deviceId ?? null,
+		at: rec.at ?? null,
+		expiresAt
+	};
+}
+/** The stored text of a body; refuses one over `maxDataBytes`. */
+function serializeBody(kind, decl, id, body) {
+	const json = JSON.stringify(body);
+	const bytes = Buffer.byteLength(json, "utf8");
+	if (bytes > decl.maxDataBytes) throw new RecordTooLargeError(`${kind}/${id.slice(0, 64)}: ${bytes} bytes exceeds maxDataBytes ${decl.maxDataBytes}. Bytes are never record fields - use files and ctx.peerBytes`);
+	return json;
+}
+/** Markers found in a stored body, by concrete path. */
+function markersOf(decl, body) {
+	const out = /* @__PURE__ */ new Map();
+	if (decl.secretPaths.length === 0) return out;
+	for (const leaf of collectSecretLeaves(body, decl.secretPaths, decl.secretArrayKeys)) if (isSecretMarker(leaf.value)) out.set(leaf.concrete, leaf.value.$secret);
+	return out;
+}
+/** Every set secret field becomes the redaction token. */
+function redactBody(decl, body) {
+	if (decl.secretPaths.length === 0) return body;
+	const redacted = mapSecretLeaves(body, decl.secretPaths, decl.secretArrayKeys, (leaf) => leaf.value === null ? null : REDACTED_SECRET);
+	return isRecord(redacted) ? redacted : body;
+}
+/** The engine's secret rule of a write (D878): see `records-rows.ts` `enforceSecrets`. */
+function enforceSecrets(owner, kind, decl, id, body, stored, mode) {
+	if (decl.secretPaths.length === 0) return {
+		body,
+		releasedRefs: []
+	};
+	const storedMarkers = stored === null ? /* @__PURE__ */ new Map() : markersOf(decl, stored);
+	const next = mapSecretLeaves(body, decl.secretPaths, decl.secretArrayKeys, (leaf) => {
+		const expected = recordSecretRef(owner, kind, id, leaf.concrete);
+		if (isSecretMarker(leaf.value)) {
+			if (leaf.value.$secret !== expected) throw new ForeignSecretMarkerError(`${kind}/${id.slice(0, 64)} field "${leaf.concrete}": the marker is not this row's own ref`);
+			return leaf.value;
+		}
+		if (leaf.value === "__camstack_redacted__") {
+			const keep = storedMarkers.get(leaf.concrete);
+			if (keep === void 0) return REMOVE_LEAF;
+			if (mode === "patch" && !leaf.concrete.includes("[")) return REMOVE_LEAF;
+			return {
+				$secret: keep,
+				v: 1
+			};
+		}
+		if (leaf.value === null || leaf.value === void 0) return mode === "patch" ? null : REMOVE_LEAF;
+		throw new PlaintextSecretError(`${kind}/${id.slice(0, 64)} field "${leaf.concrete}": a secret field takes a keychain marker, never a value`);
+	});
+	if (!isRecord(next)) throw new InvalidRecordError(`${kind}/${id}: the body must be an object`);
+	const nextMarkers = markersOf(decl, next);
+	return {
+		body: next,
+		releasedRefs: [...storedMarkers.entries()].filter(([path, ref]) => mode === "put" && nextMarkers.get(path) !== ref).map(([, ref]) => ref)
+	};
+}
+/** RFC 7396, as `jsonb_patch`: objects merge key by key, `null` removes, anything else replaces. */
 function mergePatch(target, patch) {
-	if (!isRecord(patch)) return target;
 	const out = { ...target };
 	for (const [key, value] of Object.entries(patch)) {
 		if (value === null) {
@@ -4162,18 +4381,24 @@ function mergePatch(target, patch) {
 			continue;
 		}
 		const current = out[key];
-		out[key] = isRecord(value) && isRecord(current) ? mergePatch(current, value) : value;
+		out[key] = isRecord(value) ? mergePatch(isRecord(current) ? current : {}, value) : value;
 	}
 	return out;
 }
-function markersOf(decl, body) {
-	const out = /* @__PURE__ */ new Map();
-	mapSecretLeaves(body, decl.secretPaths, decl.secretArrayKeys, (leaf) => {
-		if (isSecretMarker(leaf.value)) out.set(leaf.concrete, leaf.value.$secret);
-		return leaf.value;
-	});
-	return out;
+/** A JSON round trip: what the engine stores and hands back is never the caller's object. */
+function jsonCopy(body) {
+	const parsed = JSON.parse(JSON.stringify(body));
+	if (!isRecord(parsed)) throw new InvalidRecordError("a stored body is not an object");
+	return parsed;
 }
+//#endregion
+//#region src/records/in-memory-records-support.ts
+/**
+* Helpers of the in-memory records world (`in-memory-records.ts`): the spec
+* keychain, the keyset cursor, the declaration and ring rules, and the
+* aggregate fold. Each mirrors its engine counterpart under
+* `packages/system/src/builtins/sqlite-storage/records/`.
+*/
 function makeSpecKeychain(owner) {
 	const values = /* @__PURE__ */ new Map();
 	return { access: {
@@ -4209,10 +4434,90 @@ function makeSpecKeychain(owner) {
 		forOwner: null
 	} };
 }
-function makeInMemoryRecords(owner = "spec") {
+function encodeCursor(tag, values) {
+	return Buffer.from(JSON.stringify({
+		t: tag,
+		v: values
+	}), "utf8").toString("base64url");
+}
+function decodeCursor(cursor) {
+	try {
+		const parsed = JSON.parse(Buffer.from(cursor, "base64url").toString("utf8"));
+		if (typeof parsed === "object" && parsed !== null) {
+			const t = Reflect.get(parsed, "t");
+			const v = Reflect.get(parsed, "v");
+			if (typeof t === "string" && Array.isArray(v)) {
+				const values = [];
+				for (const item of v) if (typeof item === "string" || typeof item === "number" || item === null) values.push(item);
+				else throw new Error("bad cursor value");
+				return {
+					tag: t,
+					values
+				};
+			}
+		}
+	} catch {}
+	throw new InvalidRecordError("the cursor is not valid");
+}
+function assertCursor(cursor, tag, length) {
+	if (cursor.tag !== tag || cursor.values.length !== length) throw new InvalidRecordError("the cursor does not belong to this query");
+}
+function compareKeys(a, b) {
+	for (let i = 0; i < a.length; i += 1) {
+		const c = compareSql(a[i] ?? null, b[i] ?? null);
+		if (c !== 0) return c;
+	}
+	return 0;
+}
+/** What a re-declaration may not change (the engine's `assertAdditive`). */
+function assertAdditive(kind, before, next) {
+	const refuse = (why) => {
+		throw new DeclarationRefusedError(`kind "${kind}": ${why} - the engine never migrates data; a changed index is a new name`);
+	};
+	if (before.database !== next.database) refuse("the database cannot change");
+	if (before.device !== next.device) refuse("\"device\" cannot change");
+	if (before.at !== next.at) refuse("\"at\" cannot change");
+	for (const old of before.indexes) {
+		const same = next.indexes.find((i) => i.name === old.name);
+		if (same === void 0) continue;
+		if (same.unique !== old.unique || same.fields.join(",") !== old.fields.join(",")) refuse(`index "${old.name}" was declared differently before`);
+	}
+	for (const path of before.secretPaths) if (!next.secretPaths.includes(path)) refuse(`secret path "${path}" cannot stop being secret`);
+}
+/** The row bounds of a kind whose retention is a ring, else null. */
+function ringBounds(decl) {
+	const { retention } = decl;
+	if ("maxRows" in retention || "maxRowsPerDevice" in retention) return {
+		...retention.maxRows === void 0 ? {} : { maxRows: retention.maxRows },
+		...retention.maxRowsPerDevice === void 0 ? {} : { maxRowsPerDevice: retention.maxRowsPerDevice }
+	};
+	return null;
+}
+/** Buckets one histogram answer may carry (the engine's `HISTOGRAM_MAX_BUCKETS`). */
+var HISTOGRAM_MAX_BUCKETS = 1e4;
+/** SUM / MIN / MAX / COUNT over `json_extract` values, as SQLite folds them. */
+function aggregateOf(op, field, rows) {
+	if (field === void 0) return rows.length;
+	const values = rows.map((r) => extractField(r.data, field)).filter((v) => v !== null);
+	if (op === "count") return values.length;
+	if (values.length === 0) return null;
+	if (op === "sum") return values.reduce((s, v) => s + (typeof v === "number" ? v : Number(v) || 0), 0);
+	const sorted = [...values].sort(compareSql);
+	const picked = op === "min" ? sorted[0] : sorted.at(-1);
+	return typeof picked === "number" ? picked : null;
+}
+//#endregion
+//#region src/records/in-memory-records.ts
+function makeInMemoryRecords(owner = "spec", options = {}) {
+	const now = options.now ?? Date.now;
 	const decls = /* @__PURE__ */ new Map();
+	const kindIds = /* @__PURE__ */ new Map();
 	const tables = /* @__PURE__ */ new Map();
-	let clock = 1;
+	const sequences = /* @__PURE__ */ new Map();
+	const pendingAllocated = /* @__PURE__ */ new Set();
+	const writesSinceTrim = /* @__PURE__ */ new Map();
+	const queries = [];
+	let nextRid = 1;
 	let writesFail = false;
 	let readsFail = false;
 	const table = (kind) => {
@@ -4225,74 +4530,109 @@ function makeInMemoryRecords(owner = "spec") {
 	};
 	const declOf = (kind) => {
 		const decl = decls.get(kind);
-		if (decl === void 0) throw new Error(`kind "${kind}" is not declared`);
+		if (decl === void 0) throw new UnknownRecordKindError(`"${owner}" declared no kind "${kind}"`);
 		return decl;
 	};
-	const redact = (decl, body) => {
-		if (decl.secretPaths.length === 0) return body;
-		const out = mapSecretLeaves(body, decl.secretPaths, decl.secretArrayKeys, (leaf) => leaf.value === null ? null : REDACTED_SECRET);
-		return isRecord(out) ? out : body;
+	const reading = () => {
+		if (readsFail) throw new Error("records engine unreachable");
+	};
+	const writing = () => {
+		if (writesFail) throw new Error("records engine unreachable");
 	};
-	const view = (kind, row) => ({
+	const view = (decl, row) => ({
 		id: row.id,
-		deviceId: null,
+		deviceId: row.deviceId,
 		at: row.at,
-		expiresAt: null,
+		expiresAt: row.expiresAt,
 		rev: row.rev,
 		updatedAt: row.updatedAt,
-		data: redact(declOf(kind), row.data)
+		data: redactBody(decl, jsonCopy(row.data))
 	});
-	const enforce = (kind, id, body, stored) => {
-		const decl = declOf(kind);
-		if (decl.secretPaths.length === 0) return {
-			body,
-			released: []
-		};
-		const before = stored === null ? /* @__PURE__ */ new Map() : markersOf(decl, stored);
-		const next = mapSecretLeaves(body, decl.secretPaths, decl.secretArrayKeys, (leaf) => {
-			const expected = recordSecretRef(owner, kind, id, leaf.concrete);
-			if (isSecretMarker(leaf.value)) {
-				if (leaf.value.$secret !== expected) throw new Error("foreign secret marker");
-				return leaf.value;
+	const assertUnique = (kind, decl, id, body) => {
+		for (const index of decl.indexes) {
+			if (index.unique !== true) continue;
+			const mine = index.fields.map((f) => extractField(body, f));
+			if (mine.some((v) => v === null)) continue;
+			for (const other of table(kind).values()) {
+				if (other.id === id) continue;
+				const theirs = index.fields.map((f) => extractField(other.data, f));
+				if (compareKeys(mine, theirs) === 0 && theirs.every((v) => v !== null)) throw new RecordUniqueViolationError(`${kind}: the unique index "${index.name}" refused the write`);
 			}
-			if (leaf.value === "__camstack_redacted__") {
-				const keep = before.get(leaf.concrete);
-				return keep === void 0 ? REMOVE_LEAF : {
-					$secret: keep,
-					v: 1
-				};
-			}
-			if (leaf.value === null || leaf.value === void 0) return REMOVE_LEAF;
-			throw new Error(`${kind}/${id}: a secret field takes a keychain marker, never a value`);
+		}
+	};
+	const store = (kind, prev, next) => {
+		const rid = prev?.rid ?? nextRid;
+		if (prev === void 0) nextRid += 1;
+		table(kind).set(next.id, {
+			...next,
+			rid
 		});
-		if (!isRecord(next)) throw new Error("the body must be an object");
-		const after = markersOf(decl, next);
-		return {
-			body: next,
-			released: [...before.entries()].filter(([p, ref]) => after.get(p) !== ref).map(([, r]) => r)
-		};
 	};
-	const write = (kind, input) => {
-		if (writesFail) throw new Error("records engine unreachable");
-		if (declOf(kind).at === "required" && input.at === void 0) throw new Error(`${kind}/${input.id}: the kind needs "at" on every write`);
-		const prev = table(kind).get(input.id);
-		const { body, released } = enforce(kind, input.id, input.data, prev?.data ?? null);
+	/** One row of a put / putMany: the engine's `writeRecord`. */
+	const writeRecord = (kind, rec, ifRev, nowMs) => {
+		const decl = declOf(kind);
+		const header = validateHeader(kind, decl, rec, nowMs);
+		const allocatedKey = `${kind}:${rec.id}`;
+		const prev = table(kind).get(rec.id);
+		if (pendingAllocated.has(allocatedKey) && prev !== void 0) throw new RevConflictError(`${kind}/${rec.id}: an allocated id is insert-only and a row already holds it`);
+		if (ifRev !== void 0) {
+			if (ifRev === 0 && prev !== void 0) throw new RevConflictError(`${kind}/${rec.id}: the row exists (ifRev 0 means "must not exist")`);
+			if (ifRev > 0 && prev?.rev !== ifRev) throw new RevConflictError(`${kind}/${rec.id}: expected rev ${ifRev}, found ${prev === void 0 ? "no row" : `rev ${prev.rev}`}`);
+		}
+		const checked = enforceSecrets(owner, kind, decl, rec.id, rec.data, prev?.data ?? null, "put");
+		serializeBody(kind, decl, rec.id, checked.body);
+		const body = jsonCopy(checked.body);
+		assertUnique(kind, decl, rec.id, body);
 		const rev = (prev?.rev ?? 0) + 1;
-		clock += 1;
-		table(kind).set(input.id, {
-			id: input.id,
-			at: input.at ?? null,
+		store(kind, prev, {
+			id: header.id,
+			deviceId: header.deviceId,
+			at: header.at,
+			expiresAt: header.expiresAt,
 			rev,
-			updatedAt: clock,
+			updatedAt: nowMs,
 			data: body
 		});
+		pendingAllocated.delete(allocatedKey);
 		return {
 			rev,
-			released
+			released: checked.releasedRefs
 		};
 	};
-	const unimplemented = (op) => {
-		throw new Error(`the fake records transport does not implement ${op}`);
+	const trimScope = (kind, max, deviceId) => {
+		const scope = [...table(kind).values()].filter((r) => deviceId === void 0 || r.deviceId === deviceId);
+		const excess = Math.min(scope.length - max, RECORD_DELETE_BATCH);
+		if (excess <= 0) return;
+		scope.sort((a, b) => compareKeys([a.at, a.rid], [b.at, b.rid]));
+		for (const row of scope.slice(0, excess)) table(kind).delete(row.id);
+	};
+	/** The engine's ring trim, at the same cadence (once per bound / TRIM_SLACK writes). */
+	const afterWrite = (kind, devices) => {
+		const bounds = ringBounds(declOf(kind));
+		if (bounds === null) return;
+		const bound = Math.max(bounds.maxRows ?? 0, bounds.maxRowsPerDevice ?? 0);
+		const interval = bound <= 100 ? 1 : Math.floor(bound / 100);
+		const count = (writesSinceTrim.get(kind) ?? 0) + devices.length;
+		if (count < interval) {
+			writesSinceTrim.set(kind, count);
+			return;
+		}
+		writesSinceTrim.set(kind, 0);
+		if (bounds.maxRows !== void 0) trimScope(kind, bounds.maxRows, void 0);
+		if (bounds.maxRowsPerDevice !== void 0) {
+			const seen = new Set(devices.filter((d) => d !== void 0));
+			for (const device of seen) trimScope(kind, bounds.maxRowsPerDevice, device);
+		}
+	};
+	const refsOf = (decl, rows) => rows.flatMap((row) => [...markersOf(decl, row.data).values()]);
+	const removeWhere = (kind, test) => {
+		const decl = declOf(kind);
+		const gone = [...table(kind).values()].filter(test);
+		for (const row of gone) table(kind).delete(row.id);
+		return {
+			deleted: gone.length,
+			secretRefs: refsOf(decl, gone)
+		};
 	};
 	return {
 		records: createRecordsAccess({
@@ -4300,69 +4640,119 @@ function makeInMemoryRecords(owner = "spec") {
 			transport: {
 				declareKinds: async ({ kinds }) => {
 					const out = {};
-					let n = 0;
-					for (const [name, decl] of Object.entries(kinds)) {
+					for (const [name, raw] of Object.entries(kinds)) {
+						const decl = RecordKindDeclarationSchema.parse(raw);
+						assertValidDeclaration(name, decl);
+						const prior = decls.get(name);
+						if (prior !== void 0) assertAdditive(name, prior, decl);
+						const kindId = kindIds.get(name) ?? kindIds.size + 1;
+						kindIds.set(name, kindId);
+						const created = decl.indexes.filter((i) => prior?.indexes.every((p) => p.name !== i.name) ?? true).map((i) => i.name);
+						const state = prior === void 0 ? "created" : JSON.stringify(prior) === JSON.stringify(decl) ? "unchanged" : "updated";
 						decls.set(name, decl);
-						n += 1;
 						out[name] = {
-							kindId: n,
-							state: "created",
-							createdIndexes: decl.indexes.map((i) => i.name),
+							kindId,
+							state,
+							createdIndexes: created,
 							adoptionPending: null
 						};
 					}
 					return { kinds: out };
 				},
 				get: async ({ kind, id }) => {
-					if (readsFail) throw new Error("records engine unreachable");
+					reading();
+					const decl = declOf(kind);
 					const row = table(kind).get(id);
-					return row === void 0 ? null : view(kind, row);
+					return row === void 0 ? null : view(decl, row);
+				},
+				getMany: async ({ kind, ids }) => {
+					reading();
+					const decl = declOf(kind);
+					return [...new Set(ids)].sort((a, b) => compareSql(a, b)).flatMap((id) => {
+						const row = table(kind).get(id);
+						return row === void 0 ? [] : [view(decl, row)];
+					});
 				},
-				getMany: async ({ kind, ids }) => ids.flatMap((id) => {
-					const row = table(kind).get(id);
-					return row === void 0 ? [] : [view(kind, row)];
-				}),
 				secretRefs: async ({ kind, ids }) => {
+					reading();
 					const decl = declOf(kind);
 					const out = {};
 					for (const id of ids) {
 						const row = table(kind).get(id);
-						if (row !== void 0) out[id] = Object.fromEntries(markersOf(decl, row.data));
+						if (row === void 0) continue;
+						const refs = Object.fromEntries(markersOf(decl, row.data));
+						if (Object.keys(refs).length > 0) out[id] = refs;
 					}
 					return out;
 				},
 				put: async ({ kind, record, ifRev }) => {
-					if (ifRev !== void 0 && (table(kind).get(record.id)?.rev ?? 0) !== ifRev) throw new Error("stale ifRev");
-					const { rev, released } = write(kind, record);
+					writing();
+					const written = writeRecord(kind, record, ifRev, now());
+					afterWrite(kind, [record.deviceId]);
 					return {
-						rev,
-						releasedRefs: released
+						rev: written.rev,
+						releasedRefs: [...written.released]
 					};
 				},
 				putMany: async ({ kind, records }) => {
+					writing();
+					declOf(kind);
+					if (records.length > 1e3) throw new BatchTooLargeError(`${records.length} records exceed ${RECORD_BATCH_MAX}`);
+					const bytes = records.reduce((sum, r) => sum + Buffer.byteLength(JSON.stringify(r.data), "utf8"), 0);
+					if (bytes > 4194304) throw new BatchTooLargeError(`${bytes} bytes exceed ${RECORD_BATCH_MAX_BYTES}`);
+					const nowMs = now();
+					const before = new Map(table(kind));
+					const ridBefore = nextRid;
 					const released = [];
-					for (const record of records) released.push(...write(kind, record).released);
+					try {
+						for (const rec of records) released.push(...writeRecord(kind, rec, void 0, nowMs).released);
+					} catch (err) {
+						tables.set(kind, before);
+						nextRid = ridBefore;
+						throw err;
+					}
+					let top = -1;
+					for (const r of records) if (/^\d{1,15}$/.test(r.id)) top = Math.max(top, Number(r.id));
+					if (top >= 0) sequences.set(kind, Math.max(sequences.get(kind) ?? 0, top + 1));
+					afterWrite(kind, records.map((r) => r.deviceId));
 					return {
 						count: records.length,
 						releasedRefs: released
 					};
 				},
-				patch: async ({ kind, id, data, at, ifRev }) => {
-					const prev = table(kind).get(id);
-					if (prev === void 0) throw new Error(`${kind}/${id}: no such record`);
-					if (ifRev !== void 0 && prev.rev !== ifRev) throw new Error("stale ifRev");
-					const { rev, released } = write(kind, {
-						id,
-						...at !== void 0 && at !== null ? { at } : prev.at !== null ? { at: prev.at } : {},
-						data: mergePatch(prev.data, data)
+				patch: async (input) => {
+					writing();
+					const decl = declOf(input.kind);
+					if (input.at !== void 0 && decl.at !== "required") throw new InvalidRecordError(`${input.kind}: declared at: "none"`);
+					if (input.at === null) throw new InvalidRecordError(`${input.kind}: "at" cannot be removed`);
+					if (input.expiresAt !== void 0 && decl.secretPaths.length > 0) throw new InvalidRecordError(`${input.kind}: a kind with secret fields cannot expire by the engine (its keychain values would be orphaned)`);
+					if (input.expiresAt !== void 0 && "ttlMs" in decl.retention) throw new InvalidRecordError(`${input.kind}: expiresAt is set by the engine`);
+					const before = table(input.kind).get(input.id);
+					const checked = enforceSecrets(owner, input.kind, decl, input.id, input.data, before?.data ?? null, "patch");
+					if (before === void 0) throw new RecordNotFoundError(`${input.kind}/${input.id}: no such row`);
+					if (input.ifRev !== void 0 && before.rev !== input.ifRev) throw new RevConflictError(`${input.kind}/${input.id}: expected rev ${String(input.ifRev)}, found rev ${before.rev}`);
+					const merged = jsonCopy(mergePatch(before.data, jsonCopy(checked.body)));
+					const size = [...JSON.stringify(merged)].length;
+					if (size > decl.maxDataBytes) throw new RecordTooLargeError(`${input.kind}/${input.id}: the patched body is ${size} bytes, over maxDataBytes ${decl.maxDataBytes}`);
+					assertUnique(input.kind, decl, input.id, merged);
+					const rev = before.rev + 1;
+					store(input.kind, before, {
+						...before,
+						at: input.at ?? before.at,
+						expiresAt: input.expiresAt === void 0 ? before.expiresAt : input.expiresAt,
+						rev,
+						updatedAt: now(),
+						data: merged
 					});
+					const kept = new Set(markersOf(decl, merged).values());
 					return {
 						rev,
-						releasedRefs: released
+						releasedRefs: [...markersOf(decl, before.data).values()].filter((r) => !kept.has(r))
 					};
 				},
 				delete: async ({ kind, id }) => {
-					if (writesFail) throw new Error("records engine unreachable");
+					writing();
+					const decl = declOf(kind);
 					const row = table(kind).get(id);
 					if (row === void 0) return {
 						deleted: false,
@@ -4371,57 +4761,189 @@ function makeInMemoryRecords(owner = "spec") {
 					table(kind).delete(id);
 					return {
 						deleted: true,
-						secretRefs: [...markersOf(declOf(kind), row.data).values()]
+						secretRefs: refsOf(decl, [row])
 					};
 				},
 				deleteMany: async ({ kind, ids }) => {
-					let deleted = 0;
-					const refs = [];
-					for (const id of ids) {
-						const row = table(kind).get(id);
-						if (row === void 0) continue;
-						table(kind).delete(id);
-						deleted += 1;
-						refs.push(...markersOf(declOf(kind), row.data).values());
+					writing();
+					const wanted = new Set(ids);
+					return removeWhere(kind, (row) => wanted.has(row.id));
+				},
+				query: async (q) => {
+					reading();
+					const decl = declOf(q.kind);
+					queries.push({
+						kind: q.kind,
+						limit: q.limit
+					});
+					assertWindowAllowed(q.kind, decl, q);
+					const desc = q.desc === true;
+					const dir = desc ? "DESC" : "ASC";
+					const where = planWhere(q.kind, decl, q.where, { allowIn: false });
+					const cursor = q.cursor === void 0 ? void 0 : decodeCursor(q.cursor);
+					let rows = [...table(q.kind).values()].filter((r) => inWindow(r, q));
+					let keysOf;
+					let keyCount;
+					let tag;
+					if (where !== null) {
+						if (q.order !== void 0) throw new InvalidRecordError(`${q.kind}: with a where the order is the index's; drop "order"`);
+						const fields = where.orderFields;
+						keysOf = (row) => [...fields.map((f) => extractField(row.data, f)), row.rid];
+						keyCount = fields.length;
+						tag = `rx:${where.indexName}:${dir}`;
+						rows = rows.filter((r) => where.matches(r.data));
+						if (cursor !== void 0) {
+							assertCursor(cursor, tag, fields.length + 1);
+							rows = rows.filter((r) => rowValueAfter(keysOf(r), cursor.values, desc));
+						}
+					} else {
+						const order = q.order ?? (decl.at === "required" ? "at" : "id");
+						keyCount = 1;
+						if (order === "at") {
+							if (decl.at !== "required") throw new InvalidRecordError(`${q.kind}: declared at: "none", it has no time order - use order: "id"`);
+							keysOf = (row) => [row.at, row.rid];
+							tag = `at:${dir}`;
+							if (cursor !== void 0) {
+								assertCursor(cursor, tag, 2);
+								rows = rows.filter((r) => rowValueAfter(keysOf(r), cursor.values, desc));
+							}
+						} else {
+							if (q.deviceId !== void 0 || q.atFrom !== void 0 || q.atTo !== void 0) throw new UnindexedFilterError(`${q.kind}: order "id" cannot be combined with a device or time window (use order "at")`);
+							keysOf = (row) => [row.id, row.rid];
+							tag = `id:${dir}`;
+							if (cursor !== void 0) {
+								assertCursor(cursor, tag, 2);
+								const last = cursor.values[0] ?? null;
+								rows = rows.filter((r) => rowValueAfter([r.id], [last], desc));
+							}
+						}
+					}
+					rows.sort((a, b) => (desc ? -1 : 1) * compareKeys(keysOf(a), keysOf(b)));
+					const page = rows.slice(0, q.limit);
+					const more = rows.length > q.limit;
+					const last = page.at(-1);
+					let nextCursor = null;
+					if (more && last !== void 0) {
+						const all = keysOf(last);
+						const keys = [];
+						for (let i = 0; i < keyCount; i += 1) {
+							const value = all[i];
+							if (typeof value !== "string" && typeof value !== "number") throw new InvalidRecordError(`${q.kind}: a row has no value for an ordering field, so this query cannot be paged`);
+							keys.push(value);
+						}
+						keys.push(last.rid);
+						nextCursor = encodeCursor(tag, keys);
 					}
 					return {
-						deleted,
-						secretRefs: refs
+						records: page.map((r) => view(decl, r)),
+						nextCursor
 					};
 				},
-				query: async (q) => {
-					if (readsFail) throw new Error("records engine unreachable");
+				count: async (q) => {
+					reading();
+					const decl = declOf(q.kind);
+					assertWindowAllowed(q.kind, decl, q);
+					const where = planWhere(q.kind, decl, q.where, { allowIn: true });
+					let n = 0;
+					for (const row of table(q.kind).values()) if (inWindow(row, q) && (where === null || where.matches(row.data))) n += 1;
+					return { count: n };
+				},
+				histogram: async (q) => {
+					reading();
+					const decl = declOf(q.kind);
+					assertWindowAllowed(q.kind, decl, {
+						deviceId: q.deviceId,
+						atFrom: q.from
+					});
+					if (!(q.to > q.from)) throw new InvalidRecordError(`${q.kind}: histogram needs from < to`);
+					if (Math.ceil((q.to - q.from) / q.bucketMs) > 1e4) throw new InvalidRecordError(`${q.kind}: histogram would exceed ${HISTOGRAM_MAX_BUCKETS} buckets`);
+					const from = Math.floor(q.from);
+					const to = Math.ceil(q.to);
+					const step = Math.trunc(q.bucketMs);
+					const counts = /* @__PURE__ */ new Map();
+					for (const row of table(q.kind).values()) {
+						if (q.deviceId !== void 0 && row.deviceId !== q.deviceId) continue;
+						if (row.at === null || row.at < from || row.at >= to) continue;
+						const b = Math.trunc((row.at - from) / step);
+						counts.set(b, (counts.get(b) ?? 0) + 1);
+					}
+					return { buckets: [...counts.entries()].sort(([a], [b]) => a - b).map(([b, count]) => ({
+						bucketStart: from + b * q.bucketMs,
+						count
+					})) };
+				},
+				aggregate: async (q) => {
+					reading();
 					const decl = declOf(q.kind);
-					const asked = Object.keys(q.where ?? {});
-					if (asked.length > 0) {
-						if (!decl.indexes.some((index) => {
-							const leading = new Set(index.fields.slice(0, asked.length));
-							return asked.length <= index.fields.length && asked.every((f) => leading.has(f));
-						})) throw new Error(`${q.kind}: no declared index serves [${asked.join(", ")}]`);
+					if (q.op !== "count" && q.field === void 0) throw new InvalidRecordError(`${q.kind}: ${q.op} needs a field`);
+					const extra = [q.field, q.groupBy].filter((f) => f !== void 0);
+					if (extra.length === 0 && q.where === void 0) throw new InvalidRecordError(`${q.kind}: a count with no field and no groupBy is "count"`);
+					const where = planWhere(q.kind, decl, q.where, {
+						allowIn: true,
+						extraFields: extra,
+						groupBy: q.groupBy
+					});
+					if (where === null) throw new InvalidRecordError(`${q.kind}: aggregate has nothing to read`);
+					const rows = [...table(q.kind).values()].filter((r) => where.matches(r.data));
+					const groups = /* @__PURE__ */ new Map();
+					if (q.groupBy === void 0) groups.set(null, rows);
+					else {
+						const by = q.groupBy;
+						for (const row of rows) {
+							const g = extractField(row.data, by);
+							groups.set(g, [...groups.get(g) ?? [], row]);
+						}
+					}
+					return { rows: [...groups.entries()].sort(([a], [b]) => compareSql(a, b)).map(([group, members]) => ({
+						group,
+						value: aggregateOf(q.op, q.field, members)
+					})) };
+				},
+				deleteWhere: async (q) => {
+					writing();
+					const decl = declOf(q.kind);
+					if (q.deviceId === void 0 && q.atBefore === void 0 && (q.where === void 0 || Object.keys(q.where).length === 0)) throw new FilterRequiredError(`${q.kind}: deleteWhere needs deviceId, atBefore or where - there is no "delete all"`);
+					assertWindowAllowed(q.kind, decl, {
+						deviceId: q.deviceId,
+						atFrom: q.atBefore
+					});
+					const where = planWhere(q.kind, decl, q.where, { allowIn: true });
+					return removeWhere(q.kind, (row) => {
+						if (where !== null && !where.matches(row.data)) return false;
+						if (q.deviceId !== void 0 && row.deviceId !== q.deviceId) return false;
+						if (q.atBefore !== void 0 && (row.at === null || row.at >= q.atBefore)) return false;
+						return true;
+					});
+				},
+				deleteDevice: async ({ deviceId, kinds }) => {
+					writing();
+					const deleted = {};
+					const secretRefs = [];
+					for (const [kind, decl] of decls) {
+						if (decl.deviceRemoval !== "delete") continue;
+						if (kinds !== void 0 && !kinds.includes(kind)) continue;
+						const result = removeWhere(kind, (row) => row.deviceId === deviceId);
+						deleted[kind] = result.deleted;
+						secretRefs.push(...result.secretRefs);
 					}
-					let rows = [...table(q.kind).values()];
-					for (const [field, wanted] of Object.entries(q.where ?? {})) rows = rows.filter((r) => r.data[field] === wanted);
-					const byAt = q.order === "at" || q.order === void 0 && decl.at === "required";
-					rows.sort((a, b) => byAt ? (a.at ?? 0) - (b.at ?? 0) : a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
-					if (q.desc === true) rows.reverse();
-					const start = q.cursor === void 0 ? 0 : Number(q.cursor);
-					const page = rows.slice(start, start + q.limit);
-					const more = start + q.limit < rows.length;
 					return {
-						records: page.map((r) => view(q.kind, r)),
-						nextCursor: more ? String(start + q.limit) : null
+						deleted,
+						secretRefs
 					};
 				},
-				count: async ({ kind }) => ({ count: table(kind).size }),
-				histogram: async () => unimplemented("histogram"),
-				aggregate: async () => unimplemented("aggregate"),
-				deleteWhere: async () => unimplemented("deleteWhere"),
-				deleteDevice: async () => unimplemented("deleteDevice"),
-				allocateId: async () => unimplemented("allocateId")
+				allocateId: async ({ kind }) => {
+					writing();
+					declOf(kind);
+					const id = sequences.get(kind) ?? 1;
+					sequences.set(kind, id + 1);
+					pendingAllocated.add(`${kind}:${id}`);
+					return { id };
+				}
 			},
 			secrets: makeSpecKeychain(owner).access
 		}),
 		tables,
+		queries,
 		failWrites: (on) => {
 			writesFail = on;
 		},
@@ -4429,12 +4951,14 @@ function makeInMemoryRecords(owner = "spec") {
 			readsFail = on;
 		},
 		seed: (kind, row) => {
-			table(kind).set(row.id, {
+			store(kind, table(kind).get(row.id), {
 				id: row.id,
+				deviceId: row.deviceId ?? null,
 				at: row.at ?? null,
+				expiresAt: row.expiresAt ?? null,
 				rev: 1,
 				updatedAt: 1,
-				data: row.data
+				data: jsonCopy(row.data)
 			});
 		}
 	};