@camstack/types 1.2.397 → 1.2.398

package/dist/{sleep-Bo7fq491.js → sleep-CD18m9HF.js}

@@ -1,4 +1,4 @@
-const require_event_category = require("./event-category-kpu1bZMs.js");
+const require_event_category = require("./event-category-7AwNbPjm.js");
 let zod = require("zod");
 //#region src/audio/audio-chunk-format.ts
 /**
@@ -3227,7 +3227,8 @@ var RECORDS_ERROR_CODES = [
 	"invalid-record",
 	"declaration-refused",
 	"no-caller",
-	"batch-too-large"
+	"batch-too-large",
+	"transact-refused"
 ];
 var PREFIX = "records/";
 /** The base of every records failure. `detail` is the human part of the message. */
@@ -3335,6 +3336,17 @@ var BatchTooLargeError = class extends RecordsError {
 		this.name = "BatchTooLargeError";
 	}
 };
+/**
+* A `transact` the engine refuses before touching a row: an op on a kind the
+* caller did not declare in ONE file and ONE `transactFamily`. The detail names
+* which rule (`cross-file`, `cross-family`, `no-family`); it is never a silent split.
+*/
+var TransactRefusedError = class extends RecordsError {
+	constructor(detail) {
+		super("transact-refused", detail);
+		this.name = "TransactRefusedError";
+	}
+};
 var FACTORIES = {
 	"rev-conflict": (d) => new RevConflictError(d),
 	"too-large": (d) => new RecordTooLargeError(d),
@@ -3349,7 +3361,8 @@ var FACTORIES = {
 	"invalid-record": (d) => new InvalidRecordError(d),
 	"declaration-refused": (d) => new DeclarationRefusedError(d),
 	"no-caller": (d) => new NoCallerError(d),
-	"batch-too-large": (d) => new BatchTooLargeError(d)
+	"batch-too-large": (d) => new BatchTooLargeError(d),
+	"transact-refused": (d) => new TransactRefusedError(d)
 };
 function isCode(value) {
 	return RECORDS_ERROR_CODES.some((code) => code === value);
@@ -3640,8 +3653,7 @@ var EntryDescriptorSchema = zod.z.object({
 	/** JSON Schema of the entry body; `secret: true` marks a password field. */
 	fields: zod.z.record(zod.z.string(), zod.z.unknown())
 }).strict();
-/** What crosses the wire and sits in the engine's catalog: JSON only, no Zod. */
-var RecordKindDeclarationSchema = zod.z.object({
+var RecordKindDeclarationShape = zod.z.object({
 	database: zod.z.enum(RECORD_DATABASES).default("settings"),
 	class: zod.z.enum(RECORD_CLASSES),
 	writeTrigger: zod.z.string().min(1),
@@ -3659,18 +3671,18 @@ var RecordKindDeclarationSchema = zod.z.object({
 	secretPaths: zod.z.array(zod.z.string().min(1)).default([]),
 	/** The id key of each array that carries a secret (`{ headers: 'name' }`). */
 	secretArrayKeys: zod.z.record(zod.z.string(), zod.z.string()).default({}),
-	/**
-	* RETIRED (D900): the legacy table a kind adopted from during the records
-	* migration. Nothing declares it any more and nothing reads it; the schema
-	* still ACCEPTS it because the catalog rows the migration wrote carry it
-	* (an orphaned kind is never redeclared) and an addon built before the
-	* removal still sends it. Never set it.
-	*/
-	adoptsFrom: zod.z.string().min(1).optional(),
 	/** Kinds that must agree through `transact` sit in one file under one family name. */
 	transactFamily: zod.z.string().min(1).optional(),
 	entry: EntryDescriptorSchema.optional()
-}).strict();
+});
+/** What crosses the wire from an addon: JSON only, no Zod. An unknown key is refused. */
+var RecordKindDeclarationSchema = RecordKindDeclarationShape.strict();
+/**
+* A declaration as the engine's catalog stored it: an unknown key is DROPPED,
+* because a row written by an older engine must never stop records from
+* starting. Only for rows read back from the catalog, never for input.
+*/
+var StoredRecordKindDeclarationSchema = RecordKindDeclarationShape;
 /** The kind names: lower-case, dash separated, short enough for an index name. */
 var RecordKindNameSchema = zod.z.string().regex(/^[a-z][a-z0-9-]{0,47}$/);
 /** Cross-field rules a declaration must satisfy. Throws {@link DeclarationRefusedError}. */
@@ -3761,6 +3773,25 @@ function declarationsOf(kinds) {
 	return Object.fromEntries(Object.entries(kinds).map(([name, kind]) => [name, kind.declaration]));
 }
 //#endregion
+//#region src/records/transact-rules.ts
+/**
+* The scope rule of `transact`, shared by the engine, the provider and the
+* in-memory records so they cannot disagree: every op's kind sits in ONE
+* database file, and when more than one kind is involved they all name the
+* SAME `transactFamily`. A refusal names the rule; nothing is split silently.
+*/
+/** Throws {@link TransactRefusedError} unless the kinds may share one transaction. */
+function assertTransactScope(members) {
+	const byKind = /* @__PURE__ */ new Map();
+	for (const m of members) byKind.set(m.kind, m);
+	const kinds = [...byKind.values()];
+	if (new Set(kinds.map((m) => m.declaration.database)).size > 1) throw new TransactRefusedError(`cross-file: the ops span more than one database file (${kinds.map((m) => `${m.kind}@${m.declaration.database}`).join(", ")}); a transaction lives in ONE file`);
+	if (kinds.length <= 1) return;
+	const missing = kinds.filter((m) => m.declaration.transactFamily === void 0);
+	if (missing.length > 0) throw new TransactRefusedError(`no-family: ${missing.map((m) => m.kind).join(", ")} declare no transactFamily; kinds that must agree through transact share one`);
+	if (new Set(kinds.map((m) => m.declaration.transactFamily)).size > 1) throw new TransactRefusedError(`cross-family: the ops span more than one transactFamily (${kinds.map((m) => `${m.kind}=${String(m.declaration.transactFamily)}`).join(", ")})`);
+}
+//#endregion
 //#region src/records/records-access.ts
 function isRecord$2(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -3935,6 +3966,47 @@ var KindHandle = class {
 			};
 		});
 	}
+	async txPut(input, opts = {}) {
+		const checked = this.validate(input.data, input.id);
+		const { body, rollback } = await this.storeSecrets(input.id, checked, "put");
+		return {
+			wire: {
+				op: "put",
+				kind: this.name,
+				record: {
+					...input,
+					data: toBody(body)
+				},
+				...opts.ifRev === void 0 ? {} : { ifRev: opts.ifRev }
+			},
+			rollback
+		};
+	}
+	async txPatch(id, partial, opts = {}) {
+		const { body, rollback } = await this.storeSecrets(id, partial, "patch");
+		return {
+			wire: {
+				op: "patch",
+				kind: this.name,
+				id,
+				data: toBody(body),
+				...opts.at === void 0 ? {} : { at: opts.at },
+				...opts.expiresAt === void 0 ? {} : { expiresAt: opts.expiresAt },
+				...opts.ifRev === void 0 ? {} : { ifRev: opts.ifRev }
+			},
+			rollback
+		};
+	}
+	txDelete(id) {
+		return {
+			wire: {
+				op: "delete",
+				kind: this.name,
+				id
+			},
+			rollback: async () => {}
+		};
+	}
 	async put(input, opts = {}) {
 		const checked = this.validate(input.data, input.id);
 		const { body, rollback } = await this.storeSecrets(input.id, checked, "put");
@@ -4089,6 +4161,23 @@ function createRecordsAccess(options) {
 			handles.set(definition, handle);
 			return handle;
 		},
+		async transact(ops) {
+			if (ops.length === 0) return [];
+			const result = await call(() => options.transport.transact({ ops: ops.map((op) => op.wire) })).catch(async (err) => {
+				for (const op of ops) await op.rollback();
+				throw err;
+			});
+			const released = [...result.releasedRefs, ...result.secretRefs];
+			if (released.length > 0 && options.secrets !== null) try {
+				await options.secrets.delete(released);
+			} catch (err) {
+				options.logger?.warn("records: could not remove released keychain values", { meta: {
+					count: released.length,
+					error: err instanceof Error ? err.message : "unknown"
+				} });
+			}
+			return result.results;
+		},
 		async deleteDevice(deviceId, opts = {}) {
 			const result = await call(() => options.transport.deleteDevice({
 				deviceId,
@@ -4634,312 +4723,372 @@ function makeInMemoryRecords(owner = "spec", options = {}) {
 			secretRefs: refsOf(decl, gone)
 		};
 	};
-	return {
-		records: createRecordsAccess({
-			owner,
-			transport: {
-				declareKinds: async ({ kinds }) => {
-					const out = {};
-					for (const [name, raw] of Object.entries(kinds)) {
-						const decl = RecordKindDeclarationSchema.parse(raw);
-						assertValidDeclaration(name, decl);
-						const prior = decls.get(name);
-						if (prior !== void 0) assertAdditive(name, prior, decl);
-						const kindId = kindIds.get(name) ?? kindIds.size + 1;
-						kindIds.set(name, kindId);
-						const created = decl.indexes.filter((i) => prior?.indexes.every((p) => p.name !== i.name) ?? true).map((i) => i.name);
-						const state = prior === void 0 ? "created" : JSON.stringify(prior) === JSON.stringify(decl) ? "unchanged" : "updated";
-						decls.set(name, decl);
-						out[name] = {
-							kindId,
-							state,
-							createdIndexes: created,
-							adoptionPending: null
-						};
-					}
-					return { kinds: out };
-				},
-				get: async ({ kind, id }) => {
-					reading();
-					const decl = declOf(kind);
-					const row = table(kind).get(id);
-					return row === void 0 ? null : view(decl, row);
-				},
-				getMany: async ({ kind, ids }) => {
-					reading();
-					const decl = declOf(kind);
-					return [...new Set(ids)].sort((a, b) => compareSql(a, b)).flatMap((id) => {
-						const row = table(kind).get(id);
-						return row === void 0 ? [] : [view(decl, row)];
-					});
-				},
-				secretRefs: async ({ kind, ids }) => {
-					reading();
-					const decl = declOf(kind);
-					const out = {};
-					for (const id of ids) {
-						const row = table(kind).get(id);
-						if (row === void 0) continue;
-						const refs = Object.fromEntries(markersOf(decl, row.data));
-						if (Object.keys(refs).length > 0) out[id] = refs;
+	const transport = {
+		declareKinds: async ({ kinds }) => {
+			const out = {};
+			for (const [name, raw] of Object.entries(kinds)) {
+				const decl = RecordKindDeclarationSchema.parse(raw);
+				assertValidDeclaration(name, decl);
+				const prior = decls.get(name);
+				if (prior !== void 0) assertAdditive(name, prior, decl);
+				const kindId = kindIds.get(name) ?? kindIds.size + 1;
+				kindIds.set(name, kindId);
+				const created = decl.indexes.filter((i) => prior?.indexes.every((p) => p.name !== i.name) ?? true).map((i) => i.name);
+				const state = prior === void 0 ? "created" : JSON.stringify(prior) === JSON.stringify(decl) ? "unchanged" : "updated";
+				decls.set(name, decl);
+				out[name] = {
+					kindId,
+					state,
+					createdIndexes: created
+				};
+			}
+			return { kinds: out };
+		},
+		get: async ({ kind, id }) => {
+			reading();
+			const decl = declOf(kind);
+			const row = table(kind).get(id);
+			return row === void 0 ? null : view(decl, row);
+		},
+		getMany: async ({ kind, ids }) => {
+			reading();
+			const decl = declOf(kind);
+			return [...new Set(ids)].sort((a, b) => compareSql(a, b)).flatMap((id) => {
+				const row = table(kind).get(id);
+				return row === void 0 ? [] : [view(decl, row)];
+			});
+		},
+		secretRefs: async ({ kind, ids }) => {
+			reading();
+			const decl = declOf(kind);
+			const out = {};
+			for (const id of ids) {
+				const row = table(kind).get(id);
+				if (row === void 0) continue;
+				const refs = Object.fromEntries(markersOf(decl, row.data));
+				if (Object.keys(refs).length > 0) out[id] = refs;
+			}
+			return out;
+		},
+		put: async ({ kind, record, ifRev }) => {
+			writing();
+			const written = writeRecord(kind, record, ifRev, now());
+			afterWrite(kind, [record.deviceId]);
+			return {
+				rev: written.rev,
+				releasedRefs: [...written.released]
+			};
+		},
+		putMany: async ({ kind, records }) => {
+			writing();
+			declOf(kind);
+			if (records.length > 1e3) throw new BatchTooLargeError(`${records.length} records exceed ${RECORD_BATCH_MAX}`);
+			const bytes = records.reduce((sum, r) => sum + Buffer.byteLength(JSON.stringify(r.data), "utf8"), 0);
+			if (bytes > 4194304) throw new BatchTooLargeError(`${bytes} bytes exceed ${RECORD_BATCH_MAX_BYTES}`);
+			const nowMs = now();
+			const before = new Map(table(kind));
+			const ridBefore = nextRid;
+			const released = [];
+			try {
+				for (const rec of records) released.push(...writeRecord(kind, rec, void 0, nowMs).released);
+			} catch (err) {
+				tables.set(kind, before);
+				nextRid = ridBefore;
+				throw err;
+			}
+			let top = -1;
+			for (const r of records) if (/^\d{1,15}$/.test(r.id)) top = Math.max(top, Number(r.id));
+			if (top >= 0) sequences.set(kind, Math.max(sequences.get(kind) ?? 0, top + 1));
+			afterWrite(kind, records.map((r) => r.deviceId));
+			return {
+				count: records.length,
+				releasedRefs: released
+			};
+		},
+		patch: async (input) => {
+			writing();
+			const decl = declOf(input.kind);
+			if (input.at !== void 0 && decl.at !== "required") throw new InvalidRecordError(`${input.kind}: declared at: "none"`);
+			if (input.at === null) throw new InvalidRecordError(`${input.kind}: "at" cannot be removed`);
+			if (input.expiresAt !== void 0 && decl.secretPaths.length > 0) throw new InvalidRecordError(`${input.kind}: a kind with secret fields cannot expire by the engine (its keychain values would be orphaned)`);
+			if (input.expiresAt !== void 0 && "ttlMs" in decl.retention) throw new InvalidRecordError(`${input.kind}: expiresAt is set by the engine`);
+			const before = table(input.kind).get(input.id);
+			const checked = enforceSecrets(owner, input.kind, decl, input.id, input.data, before?.data ?? null, "patch");
+			if (before === void 0) throw new RecordNotFoundError(`${input.kind}/${input.id}: no such row`);
+			if (input.ifRev !== void 0 && before.rev !== input.ifRev) throw new RevConflictError(`${input.kind}/${input.id}: expected rev ${String(input.ifRev)}, found rev ${before.rev}`);
+			const merged = jsonCopy(mergePatch(before.data, jsonCopy(checked.body)));
+			const size = [...JSON.stringify(merged)].length;
+			if (size > decl.maxDataBytes) throw new RecordTooLargeError(`${input.kind}/${input.id}: the patched body is ${size} bytes, over maxDataBytes ${decl.maxDataBytes}`);
+			assertUnique(input.kind, decl, input.id, merged);
+			const rev = before.rev + 1;
+			store(input.kind, before, {
+				...before,
+				at: input.at ?? before.at,
+				expiresAt: input.expiresAt === void 0 ? before.expiresAt : input.expiresAt,
+				rev,
+				updatedAt: now(),
+				data: merged
+			});
+			const kept = new Set(markersOf(decl, merged).values());
+			return {
+				rev,
+				releasedRefs: [...markersOf(decl, before.data).values()].filter((r) => !kept.has(r))
+			};
+		},
+		delete: async ({ kind, id }) => {
+			writing();
+			const decl = declOf(kind);
+			const row = table(kind).get(id);
+			if (row === void 0) return {
+				deleted: false,
+				secretRefs: []
+			};
+			table(kind).delete(id);
+			return {
+				deleted: true,
+				secretRefs: refsOf(decl, [row])
+			};
+		},
+		deleteMany: async ({ kind, ids }) => {
+			writing();
+			const wanted = new Set(ids);
+			return removeWhere(kind, (row) => wanted.has(row.id));
+		},
+		query: async (q) => {
+			reading();
+			const decl = declOf(q.kind);
+			queries.push({
+				kind: q.kind,
+				limit: q.limit
+			});
+			assertWindowAllowed(q.kind, decl, q);
+			const desc = q.desc === true;
+			const dir = desc ? "DESC" : "ASC";
+			const where = planWhere(q.kind, decl, q.where, { allowIn: false });
+			const cursor = q.cursor === void 0 ? void 0 : decodeCursor(q.cursor);
+			let rows = [...table(q.kind).values()].filter((r) => inWindow(r, q));
+			let keysOf;
+			let keyCount;
+			let tag;
+			if (where !== null) {
+				if (q.order !== void 0) throw new InvalidRecordError(`${q.kind}: with a where the order is the index's; drop "order"`);
+				const fields = where.orderFields;
+				keysOf = (row) => [...fields.map((f) => extractField(row.data, f)), row.rid];
+				keyCount = fields.length;
+				tag = `rx:${where.indexName}:${dir}`;
+				rows = rows.filter((r) => where.matches(r.data));
+				if (cursor !== void 0) {
+					assertCursor(cursor, tag, fields.length + 1);
+					rows = rows.filter((r) => rowValueAfter(keysOf(r), cursor.values, desc));
+				}
+			} else {
+				const order = q.order ?? (decl.at === "required" ? "at" : "id");
+				keyCount = 1;
+				if (order === "at") {
+					if (decl.at !== "required") throw new InvalidRecordError(`${q.kind}: declared at: "none", it has no time order - use order: "id"`);
+					keysOf = (row) => [row.at, row.rid];
+					tag = `at:${dir}`;
+					if (cursor !== void 0) {
+						assertCursor(cursor, tag, 2);
+						rows = rows.filter((r) => rowValueAfter(keysOf(r), cursor.values, desc));
 					}
-					return out;
-				},
-				put: async ({ kind, record, ifRev }) => {
-					writing();
-					const written = writeRecord(kind, record, ifRev, now());
-					afterWrite(kind, [record.deviceId]);
-					return {
-						rev: written.rev,
-						releasedRefs: [...written.released]
-					};
-				},
-				putMany: async ({ kind, records }) => {
-					writing();
-					declOf(kind);
-					if (records.length > 1e3) throw new BatchTooLargeError(`${records.length} records exceed ${RECORD_BATCH_MAX}`);
-					const bytes = records.reduce((sum, r) => sum + Buffer.byteLength(JSON.stringify(r.data), "utf8"), 0);
-					if (bytes > 4194304) throw new BatchTooLargeError(`${bytes} bytes exceed ${RECORD_BATCH_MAX_BYTES}`);
-					const nowMs = now();
-					const before = new Map(table(kind));
-					const ridBefore = nextRid;
-					const released = [];
-					try {
-						for (const rec of records) released.push(...writeRecord(kind, rec, void 0, nowMs).released);
-					} catch (err) {
-						tables.set(kind, before);
-						nextRid = ridBefore;
-						throw err;
+				} else {
+					if (q.deviceId !== void 0 || q.atFrom !== void 0 || q.atTo !== void 0) throw new UnindexedFilterError(`${q.kind}: order "id" cannot be combined with a device or time window (use order "at")`);
+					keysOf = (row) => [row.id, row.rid];
+					tag = `id:${dir}`;
+					if (cursor !== void 0) {
+						assertCursor(cursor, tag, 2);
+						const last = cursor.values[0] ?? null;
+						rows = rows.filter((r) => rowValueAfter([r.id], [last], desc));
 					}
-					let top = -1;
-					for (const r of records) if (/^\d{1,15}$/.test(r.id)) top = Math.max(top, Number(r.id));
-					if (top >= 0) sequences.set(kind, Math.max(sequences.get(kind) ?? 0, top + 1));
-					afterWrite(kind, records.map((r) => r.deviceId));
-					return {
-						count: records.length,
-						releasedRefs: released
-					};
-				},
-				patch: async (input) => {
-					writing();
-					const decl = declOf(input.kind);
-					if (input.at !== void 0 && decl.at !== "required") throw new InvalidRecordError(`${input.kind}: declared at: "none"`);
-					if (input.at === null) throw new InvalidRecordError(`${input.kind}: "at" cannot be removed`);
-					if (input.expiresAt !== void 0 && decl.secretPaths.length > 0) throw new InvalidRecordError(`${input.kind}: a kind with secret fields cannot expire by the engine (its keychain values would be orphaned)`);
-					if (input.expiresAt !== void 0 && "ttlMs" in decl.retention) throw new InvalidRecordError(`${input.kind}: expiresAt is set by the engine`);
-					const before = table(input.kind).get(input.id);
-					const checked = enforceSecrets(owner, input.kind, decl, input.id, input.data, before?.data ?? null, "patch");
-					if (before === void 0) throw new RecordNotFoundError(`${input.kind}/${input.id}: no such row`);
-					if (input.ifRev !== void 0 && before.rev !== input.ifRev) throw new RevConflictError(`${input.kind}/${input.id}: expected rev ${String(input.ifRev)}, found rev ${before.rev}`);
-					const merged = jsonCopy(mergePatch(before.data, jsonCopy(checked.body)));
-					const size = [...JSON.stringify(merged)].length;
-					if (size > decl.maxDataBytes) throw new RecordTooLargeError(`${input.kind}/${input.id}: the patched body is ${size} bytes, over maxDataBytes ${decl.maxDataBytes}`);
-					assertUnique(input.kind, decl, input.id, merged);
-					const rev = before.rev + 1;
-					store(input.kind, before, {
-						...before,
-						at: input.at ?? before.at,
-						expiresAt: input.expiresAt === void 0 ? before.expiresAt : input.expiresAt,
-						rev,
-						updatedAt: now(),
-						data: merged
+				}
+			}
+			rows.sort((a, b) => (desc ? -1 : 1) * compareKeys(keysOf(a), keysOf(b)));
+			const page = rows.slice(0, q.limit);
+			const more = rows.length > q.limit;
+			const last = page.at(-1);
+			let nextCursor = null;
+			if (more && last !== void 0) {
+				const all = keysOf(last);
+				const keys = [];
+				for (let i = 0; i < keyCount; i += 1) {
+					const value = all[i];
+					if (typeof value !== "string" && typeof value !== "number") throw new InvalidRecordError(`${q.kind}: a row has no value for an ordering field, so this query cannot be paged`);
+					keys.push(value);
+				}
+				keys.push(last.rid);
+				nextCursor = encodeCursor(tag, keys);
+			}
+			return {
+				records: page.map((r) => view(decl, r)),
+				nextCursor
+			};
+		},
+		count: async (q) => {
+			reading();
+			const decl = declOf(q.kind);
+			assertWindowAllowed(q.kind, decl, q);
+			const where = planWhere(q.kind, decl, q.where, { allowIn: true });
+			let n = 0;
+			for (const row of table(q.kind).values()) if (inWindow(row, q) && (where === null || where.matches(row.data))) n += 1;
+			return { count: n };
+		},
+		histogram: async (q) => {
+			reading();
+			const decl = declOf(q.kind);
+			assertWindowAllowed(q.kind, decl, {
+				deviceId: q.deviceId,
+				atFrom: q.from
+			});
+			if (!(q.to > q.from)) throw new InvalidRecordError(`${q.kind}: histogram needs from < to`);
+			if (Math.ceil((q.to - q.from) / q.bucketMs) > 1e4) throw new InvalidRecordError(`${q.kind}: histogram would exceed ${HISTOGRAM_MAX_BUCKETS} buckets`);
+			const from = Math.floor(q.from);
+			const to = Math.ceil(q.to);
+			const step = Math.trunc(q.bucketMs);
+			const counts = /* @__PURE__ */ new Map();
+			for (const row of table(q.kind).values()) {
+				if (q.deviceId !== void 0 && row.deviceId !== q.deviceId) continue;
+				if (row.at === null || row.at < from || row.at >= to) continue;
+				const b = Math.trunc((row.at - from) / step);
+				counts.set(b, (counts.get(b) ?? 0) + 1);
+			}
+			return { buckets: [...counts.entries()].sort(([a], [b]) => a - b).map(([b, count]) => ({
+				bucketStart: from + b * q.bucketMs,
+				count
+			})) };
+		},
+		aggregate: async (q) => {
+			reading();
+			const decl = declOf(q.kind);
+			if (q.op !== "count" && q.field === void 0) throw new InvalidRecordError(`${q.kind}: ${q.op} needs a field`);
+			const extra = [q.field, q.groupBy].filter((f) => f !== void 0);
+			if (extra.length === 0 && q.where === void 0) throw new InvalidRecordError(`${q.kind}: a count with no field and no groupBy is "count"`);
+			const where = planWhere(q.kind, decl, q.where, {
+				allowIn: true,
+				extraFields: extra,
+				groupBy: q.groupBy
+			});
+			if (where === null) throw new InvalidRecordError(`${q.kind}: aggregate has nothing to read`);
+			const rows = [...table(q.kind).values()].filter((r) => where.matches(r.data));
+			const groups = /* @__PURE__ */ new Map();
+			if (q.groupBy === void 0) groups.set(null, rows);
+			else {
+				const by = q.groupBy;
+				for (const row of rows) {
+					const g = extractField(row.data, by);
+					groups.set(g, [...groups.get(g) ?? [], row]);
+				}
+			}
+			return { rows: [...groups.entries()].sort(([a], [b]) => compareSql(a, b)).map(([group, members]) => ({
+				group,
+				value: aggregateOf(q.op, q.field, members)
+			})) };
+		},
+		deleteWhere: async (q) => {
+			writing();
+			const decl = declOf(q.kind);
+			if (q.deviceId === void 0 && q.atBefore === void 0 && (q.where === void 0 || Object.keys(q.where).length === 0)) throw new FilterRequiredError(`${q.kind}: deleteWhere needs deviceId, atBefore or where - there is no "delete all"`);
+			assertWindowAllowed(q.kind, decl, {
+				deviceId: q.deviceId,
+				atFrom: q.atBefore
+			});
+			const where = planWhere(q.kind, decl, q.where, { allowIn: true });
+			return removeWhere(q.kind, (row) => {
+				if (where !== null && !where.matches(row.data)) return false;
+				if (q.deviceId !== void 0 && row.deviceId !== q.deviceId) return false;
+				if (q.atBefore !== void 0 && (row.at === null || row.at >= q.atBefore)) return false;
+				return true;
+			});
+		},
+		transact: async ({ ops }) => {
+			writing();
+			assertTransactScope(ops.map((op) => ({
+				kind: op.kind,
+				declaration: declOf(op.kind)
+			})));
+			const before = new Map([...tables].map(([name, rows]) => [name, new Map(rows)]));
+			const ridBefore = nextRid;
+			const results = [];
+			const releasedRefs = [];
+			const secretRefs = [];
+			try {
+				for (const op of ops) if (op.op === "put") {
+					const r = await transport.put({
+						kind: op.kind,
+						record: op.record,
+						...op.ifRev === void 0 ? {} : { ifRev: op.ifRev }
 					});
-					const kept = new Set(markersOf(decl, merged).values());
-					return {
-						rev,
-						releasedRefs: [...markersOf(decl, before.data).values()].filter((r) => !kept.has(r))
-					};
-				},
-				delete: async ({ kind, id }) => {
-					writing();
-					const decl = declOf(kind);
-					const row = table(kind).get(id);
-					if (row === void 0) return {
-						deleted: false,
-						secretRefs: []
-					};
-					table(kind).delete(id);
-					return {
-						deleted: true,
-						secretRefs: refsOf(decl, [row])
-					};
-				},
-				deleteMany: async ({ kind, ids }) => {
-					writing();
-					const wanted = new Set(ids);
-					return removeWhere(kind, (row) => wanted.has(row.id));
-				},
-				query: async (q) => {
-					reading();
-					const decl = declOf(q.kind);
-					queries.push({
-						kind: q.kind,
-						limit: q.limit
+					releasedRefs.push(...r.releasedRefs);
+					results.push({
+						rev: r.rev,
+						deleted: false
 					});
-					assertWindowAllowed(q.kind, decl, q);
-					const desc = q.desc === true;
-					const dir = desc ? "DESC" : "ASC";
-					const where = planWhere(q.kind, decl, q.where, { allowIn: false });
-					const cursor = q.cursor === void 0 ? void 0 : decodeCursor(q.cursor);
-					let rows = [...table(q.kind).values()].filter((r) => inWindow(r, q));
-					let keysOf;
-					let keyCount;
-					let tag;
-					if (where !== null) {
-						if (q.order !== void 0) throw new InvalidRecordError(`${q.kind}: with a where the order is the index's; drop "order"`);
-						const fields = where.orderFields;
-						keysOf = (row) => [...fields.map((f) => extractField(row.data, f)), row.rid];
-						keyCount = fields.length;
-						tag = `rx:${where.indexName}:${dir}`;
-						rows = rows.filter((r) => where.matches(r.data));
-						if (cursor !== void 0) {
-							assertCursor(cursor, tag, fields.length + 1);
-							rows = rows.filter((r) => rowValueAfter(keysOf(r), cursor.values, desc));
-						}
-					} else {
-						const order = q.order ?? (decl.at === "required" ? "at" : "id");
-						keyCount = 1;
-						if (order === "at") {
-							if (decl.at !== "required") throw new InvalidRecordError(`${q.kind}: declared at: "none", it has no time order - use order: "id"`);
-							keysOf = (row) => [row.at, row.rid];
-							tag = `at:${dir}`;
-							if (cursor !== void 0) {
-								assertCursor(cursor, tag, 2);
-								rows = rows.filter((r) => rowValueAfter(keysOf(r), cursor.values, desc));
-							}
-						} else {
-							if (q.deviceId !== void 0 || q.atFrom !== void 0 || q.atTo !== void 0) throw new UnindexedFilterError(`${q.kind}: order "id" cannot be combined with a device or time window (use order "at")`);
-							keysOf = (row) => [row.id, row.rid];
-							tag = `id:${dir}`;
-							if (cursor !== void 0) {
-								assertCursor(cursor, tag, 2);
-								const last = cursor.values[0] ?? null;
-								rows = rows.filter((r) => rowValueAfter([r.id], [last], desc));
-							}
-						}
-					}
-					rows.sort((a, b) => (desc ? -1 : 1) * compareKeys(keysOf(a), keysOf(b)));
-					const page = rows.slice(0, q.limit);
-					const more = rows.length > q.limit;
-					const last = page.at(-1);
-					let nextCursor = null;
-					if (more && last !== void 0) {
-						const all = keysOf(last);
-						const keys = [];
-						for (let i = 0; i < keyCount; i += 1) {
-							const value = all[i];
-							if (typeof value !== "string" && typeof value !== "number") throw new InvalidRecordError(`${q.kind}: a row has no value for an ordering field, so this query cannot be paged`);
-							keys.push(value);
-						}
-						keys.push(last.rid);
-						nextCursor = encodeCursor(tag, keys);
-					}
-					return {
-						records: page.map((r) => view(decl, r)),
-						nextCursor
-					};
-				},
-				count: async (q) => {
-					reading();
-					const decl = declOf(q.kind);
-					assertWindowAllowed(q.kind, decl, q);
-					const where = planWhere(q.kind, decl, q.where, { allowIn: true });
-					let n = 0;
-					for (const row of table(q.kind).values()) if (inWindow(row, q) && (where === null || where.matches(row.data))) n += 1;
-					return { count: n };
-				},
-				histogram: async (q) => {
-					reading();
-					const decl = declOf(q.kind);
-					assertWindowAllowed(q.kind, decl, {
-						deviceId: q.deviceId,
-						atFrom: q.from
+				} else if (op.op === "patch") {
+					const r = await transport.patch({
+						kind: op.kind,
+						id: op.id,
+						data: op.data,
+						...op.at === void 0 ? {} : { at: op.at },
+						...op.expiresAt === void 0 ? {} : { expiresAt: op.expiresAt },
+						...op.ifRev === void 0 ? {} : { ifRev: op.ifRev }
 					});
-					if (!(q.to > q.from)) throw new InvalidRecordError(`${q.kind}: histogram needs from < to`);
-					if (Math.ceil((q.to - q.from) / q.bucketMs) > 1e4) throw new InvalidRecordError(`${q.kind}: histogram would exceed ${HISTOGRAM_MAX_BUCKETS} buckets`);
-					const from = Math.floor(q.from);
-					const to = Math.ceil(q.to);
-					const step = Math.trunc(q.bucketMs);
-					const counts = /* @__PURE__ */ new Map();
-					for (const row of table(q.kind).values()) {
-						if (q.deviceId !== void 0 && row.deviceId !== q.deviceId) continue;
-						if (row.at === null || row.at < from || row.at >= to) continue;
-						const b = Math.trunc((row.at - from) / step);
-						counts.set(b, (counts.get(b) ?? 0) + 1);
-					}
-					return { buckets: [...counts.entries()].sort(([a], [b]) => a - b).map(([b, count]) => ({
-						bucketStart: from + b * q.bucketMs,
-						count
-					})) };
-				},
-				aggregate: async (q) => {
-					reading();
-					const decl = declOf(q.kind);
-					if (q.op !== "count" && q.field === void 0) throw new InvalidRecordError(`${q.kind}: ${q.op} needs a field`);
-					const extra = [q.field, q.groupBy].filter((f) => f !== void 0);
-					if (extra.length === 0 && q.where === void 0) throw new InvalidRecordError(`${q.kind}: a count with no field and no groupBy is "count"`);
-					const where = planWhere(q.kind, decl, q.where, {
-						allowIn: true,
-						extraFields: extra,
-						groupBy: q.groupBy
+					releasedRefs.push(...r.releasedRefs);
+					results.push({
+						rev: r.rev,
+						deleted: false
 					});
-					if (where === null) throw new InvalidRecordError(`${q.kind}: aggregate has nothing to read`);
-					const rows = [...table(q.kind).values()].filter((r) => where.matches(r.data));
-					const groups = /* @__PURE__ */ new Map();
-					if (q.groupBy === void 0) groups.set(null, rows);
-					else {
-						const by = q.groupBy;
-						for (const row of rows) {
-							const g = extractField(row.data, by);
-							groups.set(g, [...groups.get(g) ?? [], row]);
-						}
-					}
-					return { rows: [...groups.entries()].sort(([a], [b]) => compareSql(a, b)).map(([group, members]) => ({
-						group,
-						value: aggregateOf(q.op, q.field, members)
-					})) };
-				},
-				deleteWhere: async (q) => {
-					writing();
-					const decl = declOf(q.kind);
-					if (q.deviceId === void 0 && q.atBefore === void 0 && (q.where === void 0 || Object.keys(q.where).length === 0)) throw new FilterRequiredError(`${q.kind}: deleteWhere needs deviceId, atBefore or where - there is no "delete all"`);
-					assertWindowAllowed(q.kind, decl, {
-						deviceId: q.deviceId,
-						atFrom: q.atBefore
+				} else {
+					const r = await transport.delete({
+						kind: op.kind,
+						id: op.id
 					});
-					const where = planWhere(q.kind, decl, q.where, { allowIn: true });
-					return removeWhere(q.kind, (row) => {
-						if (where !== null && !where.matches(row.data)) return false;
-						if (q.deviceId !== void 0 && row.deviceId !== q.deviceId) return false;
-						if (q.atBefore !== void 0 && (row.at === null || row.at >= q.atBefore)) return false;
-						return true;
+					secretRefs.push(...r.secretRefs);
+					results.push({
+						rev: null,
+						deleted: r.deleted
 					});
-				},
-				deleteDevice: async ({ deviceId, kinds }) => {
-					writing();
-					const deleted = {};
-					const secretRefs = [];
-					for (const [kind, decl] of decls) {
-						if (decl.deviceRemoval !== "delete") continue;
-						if (kinds !== void 0 && !kinds.includes(kind)) continue;
-						const result = removeWhere(kind, (row) => row.deviceId === deviceId);
-						deleted[kind] = result.deleted;
-						secretRefs.push(...result.secretRefs);
-					}
-					return {
-						deleted,
-						secretRefs
-					};
-				},
-				allocateId: async ({ kind }) => {
-					writing();
-					declOf(kind);
-					const id = sequences.get(kind) ?? 1;
-					sequences.set(kind, id + 1);
-					pendingAllocated.add(`${kind}:${id}`);
-					return { id };
 				}
-			},
+			} catch (err) {
+				tables.clear();
+				for (const [name, rows] of before) tables.set(name, rows);
+				nextRid = ridBefore;
+				throw err;
+			}
+			return {
+				results,
+				releasedRefs,
+				secretRefs
+			};
+		},
+		deleteDevice: async ({ deviceId, kinds }) => {
+			writing();
+			const deleted = {};
+			const secretRefs = [];
+			for (const [kind, decl] of decls) {
+				if (decl.deviceRemoval !== "delete") continue;
+				if (kinds !== void 0 && !kinds.includes(kind)) continue;
+				const result = removeWhere(kind, (row) => row.deviceId === deviceId);
+				deleted[kind] = result.deleted;
+				secretRefs.push(...result.secretRefs);
+			}
+			return {
+				deleted,
+				secretRefs
+			};
+		},
+		allocateId: async ({ kind }) => {
+			writing();
+			declOf(kind);
+			const id = sequences.get(kind) ?? 1;
+			sequences.set(kind, id + 1);
+			pendingAllocated.add(`${kind}:${id}`);
+			return { id };
+		}
+	};
+	return {
+		records: createRecordsAccess({
+			owner,
+			transport,
 			secrets: makeSpecKeychain(owner).access
 		}),
 		tables,
@@ -8556,6 +8705,12 @@ Object.defineProperty(exports, "SHARE_VIEW_KINDS", {
 		return SHARE_VIEW_KINDS;
 	}
 });
+Object.defineProperty(exports, "StoredRecordKindDeclarationSchema", {
+	enumerable: true,
+	get: function() {
+		return StoredRecordKindDeclarationSchema;
+	}
+});
 Object.defineProperty(exports, "StreamSourceEntrySchema", {
 	enumerable: true,
 	get: function() {
@@ -8580,6 +8735,12 @@ Object.defineProperty(exports, "SubscribeAudioChunksResultSchema", {
 		return SubscribeAudioChunksResultSchema;
 	}
 });
+Object.defineProperty(exports, "TransactRefusedError", {
+	enumerable: true,
+	get: function() {
+		return TransactRefusedError;
+	}
+});
 Object.defineProperty(exports, "UnindexedFilterError", {
 	enumerable: true,
 	get: function() {
@@ -8658,6 +8819,12 @@ Object.defineProperty(exports, "asString", {
 		return asString;
 	}
 });
+Object.defineProperty(exports, "assertTransactScope", {
+	enumerable: true,
+	get: function() {
+		return assertTransactScope;
+	}
+});
 Object.defineProperty(exports, "assertValidDeclaration", {
 	enumerable: true,
 	get: function() {