@cero-base/cero 1.19.0 → 2.1.0

package/src/lib/operators.js

@@ -7,6 +7,7 @@ import { onAbort } from '@cero-base/core/utils'
 
 /**
  * @typedef {import('./refs.js').Ref} Ref
+ * @typedef {import('@cero-base/core/database').HookContext} HookContext
  * @typedef {import('../handle/index.js').CeroHandle} CeroHandle
  * @typedef {{ data: any }} SingleResult
  * @typedef {{ data: any[], total: number, size: number }} ListResult
@@ -30,9 +31,7 @@ export function resolveFile(handle, id, name) {
 }
 
 /**
- * Insert (or overwrite by id) a row on `ref`. The `files` builtin is special:
- * `put(handle.files, { data, type, name? })` uploads the bytes to this handle's
- * blob store, records `{ id, name }`, and resolves the file.
+ * Insert (or overwrite by id) a row on `ref`.
  *
  * @param {Ref} ref
  * @param {Record<string, any>} row
@@ -55,9 +54,7 @@ async function putFile(ref, row) {
 }
 
 /**
- * Upsert a row on `ref` — merges with the existing row and preserves
- * `createdAt`. Pass `{ upsert: false }` to update-only: a missing row is left
- * untouched instead of created (atomic — never resurrects a deleted row).
+ * Upsert a row on `ref` — merges with the existing row and preserves `createdAt`.
  *
  * @param {Ref} ref
  * @param {Record<string, any>} row
@@ -79,17 +76,6 @@ export function del(ref, id) {
   return ref.handle.store.del(ref.name, id)
 }
 
-/**
- * Count rows on `ref`, optionally filtered.
- *
- * @param {Ref} ref
- * @param {Record<string, any>} [q]
- * @returns {Promise<{ data: number }>}
- */
-export function count(ref, q) {
-  return ref.handle.store.count(ref.name, q)
-}
-
 /**
  * Invoke an `action`-kind ref (a custom mutation declared in the schema).
  *
@@ -101,20 +87,25 @@ export function call(ref, d) {
   return ref.handle.store.call(ref.name, d)
 }
 
-// Write ops per ref kind, for `before`/`after` subscriptions.
 const WRITES = { single: ['set'], collection: ['put', 'set', 'del'] }
 
 /**
- * Intercept writes to `ref` before they commit — `fn(ctx)` runs in-path
- * (awaited). Return `false` to cancel the write, or mutate `ctx.row`.
- * Returns an unsubscribe fn; pass `{ signal }` to unsubscribe on abort.
+ * Rule that runs before a write to `ref` lands — at apply, on every peer, inside the op's
+ * transaction. Return `false` to refuse it: the writer's own call rejects with `REFUSED`.
+ * `ctx` is `{ op, name, row, existing, id, memberId, role, get, put, set, del }`; mutate
+ * `ctx.row` to rewrite what is stored. `op` is the op as it applies, so an upsert on a
+ * collection is a `put`. The four operators on `ctx` read and write the room as it stands at
+ * this op, inside the transaction. Must be deterministic — read only `ctx`, never a clock or
+ * local state — and registered before any op applies, in the process that owns the data. The
+ * imported operators throw inside a hook; use the ones on `ctx`. Not available over RPC.
  *
  * @param {Ref} ref
- * @param {(ctx: { op: string, name: string, row: any }) => any} fn
+ * @param {(ctx: HookContext) => unknown} fn
  * @param {{ signal?: AbortSignal }} [opts]
  * @returns {() => void}
  */
 export function before(ref, fn, opts) {
+  if (ref.type) return ref.handle._hookType(before, ref, fn, opts)
   const db = ref.handle.store
   const ops = WRITES[ref.kind] || ['set']
   const offs = ops.map((op) =>
@@ -130,33 +121,31 @@ export function before(ref, fn, opts) {
 }
 
 /**
- * Subscribe to writes on `ref` — fires after each committed write,
- * non-blocking (observe only). Returns an unsubscribe fn; pass `{ signal }`
- * to unsubscribe on abort.
+ * Rule that runs after a write to `ref` lands — at apply, on every peer, inside the op's
+ * transaction. Write derived rows through `ctx.put` / `ctx.set` / `ctx.del`; a throw refuses
+ * the whole op. Same `ctx` and the same determinism and registration rules as `before`. Use
+ * `changes(ref)` instead to observe writes locally.
  *
  * @param {Ref} ref
- * @param {(ctx: { op: string, name: string, row: any }) => void} fn
+ * @param {(ctx: HookContext) => unknown} fn
  * @param {{ signal?: AbortSignal }} [opts]
  * @returns {() => void}
  */
 export function after(ref, fn, opts) {
+  if (ref.type) return ref.handle._hookType(after, ref, fn, opts)
   const db = ref.handle.store
   const ops = WRITES[ref.kind] || ['set']
-  const handler = (ctx) => ctx.name === ref.name && fn(ctx)
-  for (const op of ops) db.on(`after:${op}`, handler)
+  const offs = ops.map((op) => db.after(op, (ctx) => (ctx.name === ref.name ? fn(ctx) : undefined)))
   let stopAbort
   const off = () => {
-    ops.forEach((op) => db.off(`after:${op}`, handler))
+    offs.forEach((unsub) => unsub())
     stopAbort?.()
   }
   stopAbort = onAbort(opts?.signal, off)
   return off
 }
 
-// get/watch on a handle-kind ref list its rows from the `handles` collection
-// filtered by type (handle types are stored there with their { id, key,
-// encryptionKey, name }). Data-kind refs go straight to the store.
-// For handle-kind refs on the facade, the parent store lives on `root`.
+// handle refs read their rows from the parent's `handles` collection, filtered by type
 const parentStore = (ref) => (ref.handle.root ? ref.handle.root.store : ref.handle.store)
 
 const normalize = (rows, name) => {
@@ -195,9 +184,7 @@ function resolveRow(ref, row) {
 }
 
 /**
- * Read from `ref`. For data refs, dispatches to the underlying store. For
- * `handle`-kind refs, lists existing child handles of that type from the
- * parent's `handles` collection.
+ * Read from `ref`. For data refs, dispatches to the underlying store.
  *
  * @param {Ref} ref
  * @param {string | Record<string, any>} [q]
@@ -212,22 +199,17 @@ export async function get(ref, q) {
   return resolveResult(ref, res)
 }
 
-// Tie a fresh watch stream to its handle's lifecycle (destroyed on close) and
-// to an optional `{ signal }` (destroyed on abort). Local refs have no
-// close-cascade, so they keep managing their own streams.
+// a watch stream dies with its handle, or with the signal
 const bindStream = (owner, stream, opts) => {
   const stopAbort = onAbort(opts?.signal, () => stream.destroy())
-  // drop the abort listener once the stream ends, so it doesn't linger on a
-  // long-lived signal after the stream is gone
+  // drop the abort listener once the stream ends
   if (stopAbort) stream.once('close', stopAbort)
   return owner.own ? owner.own(stream) : stream
 }
 
 /**
- * Live snapshot stream on `ref` — re-emits the latest `get()` result on
- * every underlying mutation. Tied to `ref.handle`'s lifecycle: closing the
- * handle destroys it. Pass `{ signal }` to bind it to a finer scope, or
- * destroy the stream directly to stop watching sooner.
+ * Live snapshot stream on `ref` — re-emits the latest `get()` result on every underlying
+ * mutation.
  *
  * @param {Ref} ref
  * @param {Record<string, any>} [q]
@@ -247,10 +229,9 @@ export function watch(ref, q, opts) {
 }
 
 /**
- * Delta subscription: batches of `{ prev, next }` row pairs instead of
- * full snapshots — lossless under backpressure, self-contained (the first
- * batch, and any batch after a view swap, replays current state as inserts
- * with `reset: true`). File-typed fields resolve on both sides.
+ * Delta subscription: batches of `{ prev, next }` row pairs instead of full snapshots —
+ * lossless under backpressure, self-contained (the first batch, and any batch after a view
+ * swap, replays current.
  */
 export function changes(ref, q, opts) {
   const owner = ref.handle
@@ -297,9 +278,7 @@ export function changes(ref, q, opts) {
   return bindStream(owner, out, opts)
 }
 
-// Snapshots are idempotent — under a slow consumer hold only the NEWEST one
-// instead of queueing every intermediate (a busy room + un-drained reader
-// used to buffer full result sets without bound).
+// snapshots are idempotent: a slow consumer gets only the newest
 function snapshotStream(src, map) {
   let pending
   let wanted = false
@@ -329,19 +308,8 @@ function snapshotStream(src, map) {
   return out
 }
 
-// Universal signal instantiator. Dispatch on the second arg:
-//   string                  → join via invite
-//   { invite: string }      → join via invite (object form)
-//   { id: string }          → load an existing handle by id
-//   object | undefined      → create (opts)
 /**
- * Open (or create / join / load) a child handle through a `handle`-kind
- * ref. Dispatches on the normalize of `arg`:
- *
- *   - `string`                → join via an invite string
- *   - `{ invite: string }`    → join via invite (object form)
- *   - `{ id: string }`        → load an existing handle by id
- *   - `object | undefined`    → create a new handle with the given opts
+ * Open (or create / join / load) a child handle through a `handle`-kind ref.
  *
  * @param {Ref} ref
  * @param {string | { invite?: string, id?: string, name?: string, routes?: any, role?: string, accept?: boolean } | undefined} [arg]
@@ -355,13 +323,9 @@ export function open(ref, arg) {
 }
 
 /**
- * Rotate a handle's encryption epoch. A fresh secret is sealed to every
- * current member and announced through the log — members removed before the
- * rotation cannot decrypt anything written after it. Requires the remove
- * permission (admin or owner). Compose with removal:
- *
- *   await cero.del(room.members, memberId)
- *   await cero.rotate(room)
+ * Rotate a handle's encryption epoch. A fresh secret is sealed to every current member and
+ * announced through the log — members removed before the rotation cannot decrypt anything
+ * written after it.
  *
  * @param {any} handle
  * @returns {Promise<{ epoch: number }>}
@@ -369,66 +333,3 @@ export function open(ref, arg) {
 export function rotate(handle) {
   return handle.store.rotate()
 }
-
-// ─── custom operators ──────────────────────────────────────────────────────
-// App business logic lives as custom operators: pure functions whose first arg
-// is the handle they act on, composed from the operators above. `define`
-// registers them by scope; `bind` puts them on a handle — either an explicit
-// `{ ns: module }` map, or (given a scope) the registered operators for that
-// scope, which is how cero auto-binds the root and each child as it opens.
-
-const registry = {}
-
-// Curry `handle` as arg 0 of every function in `fns`, under `handle[ns]`.
-function attach(handle, ns, fns) {
-  const bound = {}
-  for (const key of Object.keys(fns)) {
-    if (typeof fns[key] === 'function') bound[key] = (...args) => fns[key](handle, ...args)
-  }
-  handle[ns] = bound
-}
-
-/**
- * Put custom operators on `handle`, currying it as their first argument so
- * `handle.ns.fn(args)` calls `fn(handle, args)`. `arg` is either:
- *   - a `{ ns: module }` map  → bind exactly those, or
- *   - `null`                  → the registered root operators, or
- *   - a child-handle type     → the registered operators for that type.
- * The scope forms are how cero binds handles automatically; pass a map yourself
- * for manual binding.
- *
- * @param {any} handle
- * @param {Record<string, any> | string | null} arg
- * @returns {any} handle
- */
-export function bind(handle, arg) {
-  if (arg !== null && typeof arg !== 'string') {
-    for (const ns of Object.keys(arg)) attach(handle, ns, arg[ns])
-    return handle
-  }
-  const handles = handle.spec?.meta?.handles || {}
-  for (const ns of Object.keys(registry)) {
-    if (arg === null) {
-      if (!(ns in handles)) attach(handle, ns, registry[ns]) // bare root namespace
-    } else if (ns === arg) {
-      for (const k of Object.keys(registry[ns])) attach(handle, k, registry[ns][k]) // child group
-    }
-  }
-  return handle
-}
-
-/**
- * Register custom operators by scope. A bare key binds on the root handle; a key
- * that names a child-handle type binds on every handle of that type. Call once
- * at startup, before `cero()` / `connect()`, in both processes.
- *
- * @param {Record<string, any>} map
- */
-export function define(map) {
-  Object.assign(registry, map)
-}
-
-/** Test seam: clear all registered operators. */
-export function _clearDefined() {
-  for (const k of Object.keys(registry)) delete registry[k]
-}

package/src/lib/peek.js

@@ -6,14 +6,11 @@ import { CeroError } from '@cero-base/core/errors'
 
 import { Local } from '../local/index.js'
 
-// Lives outside operators.js so the storage deps stay off the RPC client's
-// module graph — bundlers follow even dynamic imports, and a browser build
-// must never reach hypercore/sodium.
+// outside operators.js so storage deps stay off the client's module graph
 
 /**
- * Quickly check whether the on-disk directory at `dir` already holds an
- * initialised cero identity (i.e. a stored master seed). Opens the local store
- * read-only and closes everything before returning.
+ * Quickly check whether the on-disk directory at `dir` already holds an initialised cero
+ * identity (i.e. a stored master seed).
  *
  * @param {string} dir   Cero data directory.
  * @param {any} spec     Built spec — same value passed to `cero(dir, spec)`.
@@ -23,8 +20,7 @@ export async function peek(dir, spec) {
   if (typeof dir !== 'string' || !dir) throw CeroError.INVALID('dir must be a non-empty string')
   if (!spec) throw CeroError.REQUIRED('spec')
 
-  // Construct first (cheap), ready inside the try — a corrupt dir that throws in
-  // any ready() must still close root + store + local, not leak the storage lock.
+  // construct first, ready inside the try: a corrupt dir must still close everything
   const root = new HypercoreStorage(`${dir}/main`)
   const store = new Corestore(root, { manifestVersion: 2 })
   const local = new Local(null, spec, { store })

package/src/lib/refs.js

@@ -9,9 +9,7 @@ import { CeroError } from '@cero-base/core/errors'
  */
 
 /**
- * Typed pointer to a single ref (table or handle slot) on a `Handle` or
- * `Local`. Operators (`put`/`get`/`open`/...) take a `Ref` as their first
- * argument and dispatch through the owning handle's store.
+ * Typed pointer to a single ref (table or handle slot) on a `Handle` or `Local`.
  */
 export class Ref {
   /**
@@ -20,11 +18,12 @@ export class Ref {
    * @param {string} kind  Ref kind: `'collection'`, `'single'`, `'action'`, or `'handle'`.
    * @param {string | null} [schema]  Fully-qualified schema id, if any.
    */
-  constructor(handle, name, kind, schema = null) {
+  constructor(handle, name, kind, schema = null, type = null) {
     this.handle = handle
     this.name = name
     this.kind = kind
     this.schema = schema
+    this.type = type
   }
 
   /**
@@ -33,17 +32,20 @@ export class Ref {
    *
    * @param {any} target
    * @param {Record<string, RefInfo>} refs
+   * @param {Record<string, any>} [handles]  The handle types, so `target.room.notes` names every room's notes.
    */
-  static attach(target, refs) {
+  static attach(target, refs, handles) {
     for (const [name, info] of Object.entries(refs || {})) {
-      // fail loud rather than silently overwrite a method or property (close,
-      // on, store) when a schema declares a ref named like a reserved member
+      // a ref named like a reserved member must fail loud, not overwrite it
       if (name in target) {
         throw CeroError.INVALID(
           `schema ref '${name}' collides with a reserved ${target.constructor?.name || 'handle'} member — rename it`
         )
       }
-      target[name] = new Ref(target, name, info.kind, info.schema)
+      const ref = (target[name] = new Ref(target, name, info.kind, info.schema))
+      for (const [sub, i] of Object.entries(handles?.[name]?.meta?.refs || {})) {
+        ref[sub] = new Ref(target, sub, i.kind, i.schema, name)
+      }
     }
   }
 }

package/src/lib/spec.js

@@ -1,6 +1,5 @@
 /**
- * Re-exports of the schema DSL (`t`) and `schema()` wrapper from
- * `@cero-base/core/schema`, so cero apps can describe their tables without
- * pulling in the core package directly.
+ * Re-exports of the schema DSL (`t`) and `schema()` wrapper from `@cero-base/core/schema`,
+ * so cero apps can describe their tables without pulling in the core package directly.
  */
 export { t, schema } from '@cero-base/core/schema'

package/src/local/index.js

@@ -13,9 +13,8 @@ import { Ref } from '../lib/refs.js'
  */
 
 /**
- * Per-device, single-writer storage for cero — holds the master seed,
- * device keypair and any per-handle keypairs. Wraps a hyperbee-backed
- * `Storage` and exposes each local ref as a property of the instance.
+ * Per-device, single-writer storage for cero — holds the master seed, device keypair and
+ * any per-handle keypairs.
  */
 export class Local extends ReadyResource {
   /**

package/src/rpc/client.js

@@ -5,23 +5,11 @@ import z32 from 'z32'
 import { decodeId } from '@cero-base/core/blobs/codec'
 
 import { Ref } from '../lib/refs.js'
-import {
-  put,
-  set,
-  get,
-  del,
-  count,
-  watch,
-  changes,
-  call,
-  open,
-  rotate,
-  bind,
-  define
-} from '../lib/operators.js'
+import { put, set, get, del, watch, changes, call, open, rotate } from '../lib/operators.js'
 import { t, schema } from '../lib/spec.js'
+import { operatorsOf, bind } from '../extensions/index.js'
 
-export { put, set, get, del, count, watch, changes, call, open, rotate, bind, define, t, schema }
+export { put, set, get, del, watch, changes, call, open, rotate, t, schema }
 
 /**
  * @typedef {import('@cero-base/core/rpc').RPCClient} BaseRPCClient
@@ -30,7 +18,7 @@ export { put, set, get, del, count, watch, changes, call, open, rotate, bind, de
  * @property {'single'|'collection'|'action'|'handle'} [kind]
  * @property {string} [schema]
  * @property {string} [type]
- * @property {boolean} [builtin]
+ * @property {boolean} [internal]
  *
  * @typedef {import('@cero-base/core/rpc').Spec & { meta: { ns?: string, refs: Record<string, RefInfo>, local?: { refs: Record<string, RefInfo> }, handles?: Record<string, Spec> }, handles: Record<string, Spec> }} Spec  Built cero spec (schema + rpc + per-handle child specs).
  *
@@ -48,7 +36,6 @@ export { put, set, get, del, count, watch, changes, call, open, rotate, bind, de
  * @property {string|null} name
  */
 
-// Compact-encoding blobId struct matching hypercore-blob-server's wire format.
 const blobIdEnc = {
   preencode(state, b) {
     c.uint.preencode(state, b.blockOffset)
@@ -72,9 +59,7 @@ const blobIdEnc = {
   }
 }
 
-// Mixin applied to Client, Handle and LocalRefs so they expose the same
-// row-ops surface as a local cero handle but routed over the wire. `_local`
-// selects the per-device store + JSON codec; main refs use the schema codec.
+// the same row-ops surface as a local handle, routed over the wire
 const operators = {
   _local: false,
 
@@ -113,9 +98,8 @@ const operators = {
   },
 
   /**
-   * Augment a decoded row (or array of rows) to resolve file-typed fields to
-   * `{ id, type, size, url }` objects. The `files` builtin's own `id` is the
-   * file id; other refs declare file fields in `meta.refs[name].files`.
+   * Augment a decoded row (or array of rows) to resolve file-typed fields to `{ id, type,
+   * size, url }` objects.
    *
    * @param {string} name
    * @param {any} data
@@ -130,7 +114,7 @@ const operators = {
 
   _resolveRow(name, info, row) {
     if (!row || typeof row !== 'object') return row
-    if (info?.builtin && info?.verb === 'file') {
+    if (info?.internal && info?.verb === 'file') {
       if (!row.id) return row
       try {
         const { type, blobId } = decodeId(row.id)
@@ -256,24 +240,6 @@ const operators = {
     await this.rpc.del({ handle: this.id, ref: name, id, local: this._local })
   },
 
-  /**
-   * Count matching rows.
-   *
-   * @param {string} name
-   * @param {Record<string, any>} [query]
-   * @returns {Promise<{ data: number }>}
-   */
-  async count(name, query) {
-    const codec = this._codec()
-    const res = await this.rpc.count({
-      handle: this.id,
-      ref: name,
-      query: codec.encodeQuery(query),
-      local: this._local
-    })
-    return { data: res.count }
-  },
-
   /**
    * Live snapshot stream. Re-emits the latest `get()` shape on every
    * underlying mutation. Destroy the stream to stop watching.
@@ -318,15 +284,14 @@ const operators = {
     wire.on('end', end)
     wire.on('close', end)
     // the channel tears the stream down on client close — that is an end,
-    // not a failure (bare-rpc ≥1.3.2 errors every in-flight op on teardown)
+    // not a failure
     wire.on('error', (err) => (err.code === 'CHANNEL_CLOSED' ? end() : out.destroy(err)))
     return out
   },
 
   /**
-   * Delta subscription over the wire — same contract as the local operator:
-   * batches of `{ prev, next }` with file fields resolved, `reset` marks
-   * a full replay. Lossless: server-side the cursor folds under backpressure.
+   * Delta subscription over the wire — same contract as the local operator: batches of `{
+   * prev, next }` with file fields resolved, `reset` marks a full replay.
    */
   changes(name, query) {
     const refInfo = this._refInfo(name)
@@ -358,8 +323,7 @@ const operators = {
     }
     pump().catch((err) => {
       if (out.destroyed) return
-      // the server tears the stream down on handle close, and the channel on
-      // client close — both are ends, not failures (same contract as watch)
+      // both are ends, not failures
       if (err.code === 'PREMATURE_CLOSE' || err.code === 'CHANNEL_CLOSED') out.push(null)
       else out.destroy(err)
     })
@@ -415,6 +379,16 @@ const operators = {
   async rotate() {
     const { epoch } = await this.rpc.rotate({ handle: this.id })
     return { epoch }
+  },
+
+  /**
+   * `true` ranks this handle as just updated on the server, `false` takes it off the swarm.
+   *
+   * @param {boolean} active
+   * @returns {Promise<void>}
+   */
+  async setActive(active) {
+    await this.rpc.setActive({ handle: this.id, active })
   }
 }
 
@@ -435,10 +409,7 @@ export async function restore(me, phrase) {
 }
 
 /**
- * Per-device `local`-namespace surface on a Client. Exposes each app-defined
- * local ref (e.g. `client.local.settings`) and routes ops over RPC with
- * `local: true`, so they hit the server's per-device store and never
- * replicate. Built-in local refs (identity master/keypair) are not exposed.
+ * Per-device `local`-namespace surface on a Client.
  */
 class LocalRefs {
   /** @param {Client} client */
@@ -449,7 +420,7 @@ class LocalRefs {
     this.store = this
     this._local = true
     const refs = client.spec.meta.local?.refs || {}
-    const exposed = Object.fromEntries(Object.entries(refs).filter(([, info]) => !info.builtin))
+    const exposed = Object.fromEntries(Object.entries(refs).filter(([, info]) => !info.internal))
     Ref.attach(this, exposed)
   }
 
@@ -465,19 +436,21 @@ class LocalRefs {
 }
 
 /**
- * IPC-side RPC client for cero. Wraps an `hrpc` channel and exposes the
- * same handle/ref/row API as a local cero instance, transparently
- * routing every operation across the wire.
+ * IPC-side RPC client for cero. Wraps an `hrpc` channel and exposes the same
+ * handle/ref/row API as a local cero instance, transparently routing every operation
+ * across the wire.
  */
 export class Client extends RPCClient {
   /**
    * @param {any} ipc   Framed IPC stream (must be writable).
    * @param {Spec} spec  Compiled cero spec (schema + rpc + handles).
+   * @param {{ operators?: Record<string, any> }} [opts]  The operators to bind, instead of the ones the spec carries.
    */
-  constructor(ipc, spec) {
+  constructor(ipc, spec, opts = {}) {
     super(ipc, spec)
     if (spec.local?.schema && !spec.local.codec) bindCodec(spec.local)
     Object.assign(this, operators)
+    this.operators = operatorsOf(spec, opts.operators)
     this.id = null
     this.deviceId = null
     this.store = this
@@ -493,10 +466,20 @@ export class Client extends RPCClient {
     this._fileToken = fileToken || ''
     this.identity = { id, toPhrase: async () => (await this.rpc.seed({})).phrase || null }
     Ref.attach(this, /** @type {Spec} */ (this.spec).meta.refs)
-    bind(this, null)
+    bind(this, null, this.operators)
     if (/** @type {Spec} */ (this.spec).meta.local?.refs) this.local = new LocalRefs(this)
   }
 
+  /** Pause networking and storage on the server. Idempotent. */
+  async suspend() {
+    await this.rpc.suspend({})
+  }
+
+  /** Resume a suspended server. Idempotent. */
+  async resume() {
+    await this.rpc.resume({})
+  }
+
   /**
    * Create a new child handle of the given type.
    *
@@ -505,7 +488,7 @@ export class Client extends RPCClient {
    * @returns {Promise<Handle>}
    */
   async _create(type, opts = {}) {
-    // `routes` are functions and can't cross the wire; role/accept now do.
+    // routes are functions and cannot cross the wire
     const wire = { ...opts, noAccept: opts.accept === false || undefined }
     const stub = await this.rpc.addHandle({
       ref: type,
@@ -541,9 +524,9 @@ export class Client extends RPCClient {
 }
 
 /**
- * Client-side proxy for a remote handle. Exposes the same row-ops surface
- * as `Client` but scoped to a single child handle id, and routes every
- * call through the parent's RPC channel.
+ * Client-side proxy for a remote handle. Exposes the same row-ops surface as `Client` but
+ * scoped to a single child handle id, and routes every call through the parent's RPC
+ * channel.
  */
 class Handle {
   /**
@@ -562,7 +545,7 @@ class Handle {
     if (!this.spec.codec) bindCodec(this.spec)
     this.store = this
     Ref.attach(this, this.spec.meta.refs)
-    bind(this, this.type)
+    bind(this, this.type, parent.operators)
   }
 
   /** Underlying RPC channel borrowed from the parent. */
@@ -586,29 +569,26 @@ class Handle {
  *
  * @param {any} ipc
  * @param {object} spec
+ * @param {{ operators?: Record<string, any> }} [opts]
  * @returns {Promise<Client>}
  */
-export async function connect(ipc, spec) {
-  const client = new Client(ipc, spec)
+export async function connect(ipc, spec, opts) {
+  const client = new Client(ipc, spec, opts)
   await client.ready()
   return client
 }
 
 /**
- * Symmetric client entry. Mirrors the main `cero`, but `cero(ipc, spec)` connects
- * to a server (via `connect`) instead of opening a local store. The same operator
- * surface is attached, so `import { cero } from '@cero-base/cero/client'` works
- * just like `import { cero } from '@cero-base/cero'`.
- *
- * Note: `before`/`after`/`peek` are intentionally not exposed here — they hook the
- * local write path / probe a local store, which a client proxy has no notion of.
+ * Symmetric client entry. Mirrors the main `cero`, but `cero(ipc, spec)` connects to a
+ * server (via `connect`) instead of opening a local store.
  *
  * @param {any} ipc    Framed IPC duplex stream.
  * @param {any} spec   Built cero spec.
+ * @param {{ operators?: Record<string, any> }} [opts]
  * @returns {Promise<Client>}
  */
-export function cero(ipc, spec) {
-  return connect(ipc, spec)
+export function cero(ipc, spec, opts) {
+  return connect(ipc, spec, opts)
 }
 cero.connect = connect
 cero.restore = restore
@@ -617,12 +597,9 @@ cero.put = put
 cero.set = set
 cero.get = get
 cero.del = del
-cero.count = count
 cero.watch = watch
 cero.changes = changes
 cero.call = call
 cero.open = open
 cero.rotate = rotate
-cero.bind = bind
-cero.define = define
 cero.schema = schema