@feltdb/core 0.12.1 → 0.13.0

package/dist/transaction.d.ts

@@ -166,14 +166,37 @@ export interface AtomicTransactionResult {
     transactionId: string;
     /** True when this id was already committed; nothing was applied again. */
     duplicate: boolean;
+    /**
+     * How a duplicate was recognized (present only when `duplicate` is true on an
+     * embedded runtime):
+     * - `verified`: the id and the digest of this request both match what was
+     *   committed, so this request *is* the original one;
+     * - `legacy-unverified`: the id was committed by a build that did not record
+     *   a digest, so only the id could be checked. Treat the outcome as
+     *   uncertain if the request might differ from the original.
+     */
+    binding?: 'verified' | 'legacy-unverified';
+    /**
+     * Whether the fields below describe the original commit. `unavailable` means
+     * the durable record no longer holds the original positions (an id committed
+     * by a build that did not record them, since folded into a snapshot); they
+     * are then absent rather than guessed. Absent on a first commit, where they
+     * are always known.
+     */
+    outcome?: 'original' | 'unavailable';
     operations: number;
-    stateBefore: number;
-    stateAfter: number;
+    /**
+     * Position of the *original* commit: the store's sequence before and after
+     * it, not the store's current sequence. Absent when `outcome` is
+     * `unavailable`.
+     */
+    stateBefore?: number;
+    stateAfter?: number;
     /** Authority revision before and after this atomic commit. */
-    baseRevision: number;
-    commitRevision: number;
+    baseRevision?: number;
+    commitRevision?: number;
     /** Stable revision and operation identities; never aliases of transactionId. */
-    revisionId: string;
+    revisionId?: string;
     operationIds: string[];
 }
 /** Staging surface for one collection inside a transaction. */
@@ -234,6 +257,28 @@ export declare class AtomicTransactionError extends Error {
     readonly status?: number;
     constructor(message: string, transactionId: string, code?: string, status?: number, cause?: unknown);
 }
+/**
+ * The transaction id was already committed with a different payload.
+ *
+ * Nothing was applied and the recorded transaction is unchanged. Retrying with
+ * the same id cannot succeed: choose a new id for a new transaction, or resend
+ * the original payload to confirm the original.
+ */
+export declare class TransactionIdConflictError extends AtomicTransactionError {
+    readonly code: "IDEMPOTENCY_CONFLICT";
+    constructor(transactionId: string, message?: string);
+}
+/**
+ * The transaction id exists, but its recorded identity cannot be checked by
+ * this build (a digest of a newer construction, or a malformed one).
+ *
+ * Not a conflict and not a duplicate: neither can be established. Nothing was
+ * applied. Do not assume either outcome.
+ */
+export declare class TransactionIdUnverifiableError extends AtomicTransactionError {
+    readonly code: "IDEMPOTENCY_UNVERIFIABLE";
+    constructor(transactionId: string, message?: string);
+}
 /** Which predicate failed, and what the authority actually holds. */
 export interface ConditionalConflictDetail {
     predicate: 'version' | 'epoch' | 'lease' | 'present' | 'missing' | 'fence';

package/dist/transaction.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transaction.d.ts","sourceRoot":"","sources":["../src/transaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,6BAA6B;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,iCAAiC;IACjC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sEAAsE;IACtE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oCAAoC;IACpC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iEAAiE;IACjE,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,yDAAyD;AACzD,MAAM,WAAW,sBAAsB;IACrC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,0DAA0D;AAC1D,MAAM,WAAW,iCAAiC;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,iFAAiF;IACjF,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,yBAAyB;IACxC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,6BAA6B,EAAE,CAAC;IAChD,MAAM,CAAC,EAAE,oBAAoB,EAAE,CAAC;IAChC,UAAU,EAAE,iCAAiC,EAAE,CAAC;CACjD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,KAAK,CAAC;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,OAAO,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC,CAAC;CAC1F;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,kBAAkB,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;CACf;AAED,yEAAyE;AACzE,eAAO,MAAM,0BAA0B,OAAQ,CAAC;AAIhD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,kBAAkB,GAAG,QAAQ,CAAC,kBAAkB,CAAC,CAgCxF;AAED,MAAM,WAAW,wBAAwB;IACvC,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,iCAAiC,EAAE,CAAC;IAChD;;;;;OAKG;IACH,aAAa,CAAC,EAAE,6BAA6B,EAAE,CAAC;IAChD;;;;OAIG;IACH,MAAM,CAAC,EAAE,oBAAoB,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,uBAAuB;IACtC,6EAA6E;IAC7E,aAAa,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,gFAAgF;IAChF,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,+DAA+D;AAC/D,MAAM,WAAW,2BAA2B,CAAC,CAAC,GAAG,OAAO;IACtD,qBAAqB;IACrB,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,2BAA2B,CAAC,CAAC,CAAC,CAAC;IACrG;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,2BAA2B,CAAC,CAAC,CAAC,CAAC;IACxG,sBAAsB;IACtB,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,2BAA2B,CAAC,CAAC,CAAC,CAAC;CAC/F;AAED,mDAAmD;AACnD,MAAM,WAAW,sBAAsB;IACrC,mEAAmE;IACnE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,UAAU,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,2BAA2B,CAAC,CAAC,CAAC,CAAC;IACtE;;;;;;OAMG;IACH,OAAO,CAAC,SAAS,EAAE,6BAA6B,GAAG,sBAAsB,CAAC;IAC1E;;;;;;;OAOG;IACH,KAAK,CAAC,KAAK,EAAE,oBAAoB,GAAG,sBAAsB,CAAC;IAC3D,gCAAgC;IAChC,QAAQ,CAAC,UAAU,EAAE,SAAS,iCAAiC,EAAE,CAAC;IAClE,mCAAmC;IACnC,QAAQ,CAAC,aAAa,EAAE,SAAS,6BAA6B,EAAE,CAAC;IACjE,gCAAgC;IAChC,QAAQ,CAAC,MAAM,EAAE,SAAS,oBAAoB,EAAE,CAAC;CAClD;AAED,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,0EAA0E;AAC1E,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBACb,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAOpG;AAED,qEAAqE;AACrE,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,SAAS,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;IAC3E,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CACjC;AAED;;;;;;;;;GASG;AACH,qBAAa,wBAAyB,SAAQ,sBAAsB;IAClE,SAAkB,IAAI,EAAG,qBAAqB,CAAU;IACxD,QAAQ,CAAC,OAAO,CAAC,EAAE,yBAAyB,CAAC;gBACjC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,yBAAyB;CAKxF;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,OAAO,GACb;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,OAAO,CAAC,EAAE,yBAAyB,CAAA;CAAE,GAAG;IAAE,QAAQ,EAAE,KAAK,CAAA;CAAE,CAqB/E;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,6BAA6B,GACvC,6BAA6B,CAU/B;AAOD,sDAAsD;AACtD,qBAAa,wBAAyB,YAAW,sBAAsB;IACrE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2C;IAClE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAuC;IAChE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IACrD,OAAO,CAAC,MAAM,CAAS;gBAEX,aAAa,CAAC,EAAE,MAAM;IAIlC,IAAI,UAAU,IAAI,SAAS,iCAAiC,EAAE,CAE7D;IAED,UAAU,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,2BAA2B,CAAC,CAAC,CAAC;IAgErE,IAAI,aAAa,IAAI,SAAS,6BAA6B,EAAE,CAE5D;IAED,OAAO,CAAC,SAAS,EAAE,6BAA6B,GAAG,sBAAsB;IAuBzE,IAAI,MAAM,IAAI,SAAS,oBAAoB,EAAE,CAE5C;IAED,KAAK,CAAC,KAAK,EAAE,oBAAoB,GAAG,sBAAsB;IAW1D,0DAA0D;IAC1D,IAAI,IAAI,wBAAwB;CASjC"}
+{"version":3,"file":"transaction.d.ts","sourceRoot":"","sources":["../src/transaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,6BAA6B;IAC5C,UAAU,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,iCAAiC;IACjC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sEAAsE;IACtE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oCAAoC;IACpC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,iEAAiE;IACjE,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,yDAAyD;AACzD,MAAM,WAAW,sBAAsB;IACrC,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,0DAA0D;AAC1D,MAAM,WAAW,iCAAiC;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,iFAAiF;IACjF,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,yBAAyB;IACxC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,6BAA6B,EAAE,CAAC;IAChD,MAAM,CAAC,EAAE,oBAAoB,EAAE,CAAC;IAChC,UAAU,EAAE,iCAAiC,EAAE,CAAC;CACjD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,KAAK,CAAC;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,OAAO,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC,CAAC;CAC1F;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,kBAAkB,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;CACf;AAED,yEAAyE;AACzE,eAAO,MAAM,0BAA0B,OAAQ,CAAC;AAIhD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,kBAAkB,GAAG,QAAQ,CAAC,kBAAkB,CAAC,CAgCxF;AAED,MAAM,WAAW,wBAAwB;IACvC,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,iCAAiC,EAAE,CAAC;IAChD;;;;;OAKG;IACH,aAAa,CAAC,EAAE,6BAA6B,EAAE,CAAC;IAChD;;;;OAIG;IACH,MAAM,CAAC,EAAE,oBAAoB,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,uBAAuB;IACtC,6EAA6E;IAC7E,aAAa,EAAE,MAAM,CAAC;IACtB,0EAA0E;IAC1E,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,UAAU,GAAG,mBAAmB,CAAC;IAC3C;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,UAAU,GAAG,aAAa,CAAC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,+DAA+D;AAC/D,MAAM,WAAW,2BAA2B,CAAC,CAAC,GAAG,OAAO;IACtD,qBAAqB;IACrB,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,2BAA2B,CAAC,CAAC,CAAC,CAAC;IACrG;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,2BAA2B,CAAC,CAAC,CAAC,CAAC;IACxG,sBAAsB;IACtB,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,2BAA2B,CAAC,CAAC,CAAC,CAAC;CAC/F;AAED,mDAAmD;AACnD,MAAM,WAAW,sBAAsB;IACrC,mEAAmE;IACnE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,UAAU,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,2BAA2B,CAAC,CAAC,CAAC,CAAC;IACtE;;;;;;OAMG;IACH,OAAO,CAAC,SAAS,EAAE,6BAA6B,GAAG,sBAAsB,CAAC;IAC1E;;;;;;;OAOG;IACH,KAAK,CAAC,KAAK,EAAE,oBAAoB,GAAG,sBAAsB,CAAC;IAC3D,gCAAgC;IAChC,QAAQ,CAAC,UAAU,EAAE,SAAS,iCAAiC,EAAE,CAAC;IAClE,mCAAmC;IACnC,QAAQ,CAAC,aAAa,EAAE,SAAS,6BAA6B,EAAE,CAAC;IACjE,gCAAgC;IAChC,QAAQ,CAAC,MAAM,EAAE,SAAS,oBAAoB,EAAE,CAAC;CAClD;AAED,MAAM,WAAW,wBAAwB;IACvC;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,0EAA0E;AAC1E,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBACb,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAOpG;AAED;;;;;;GAMG;AACH,qBAAa,0BAA2B,SAAQ,sBAAsB;IACpE,SAAkB,IAAI,EAAG,sBAAsB,CAAU;gBAC7C,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM;CAOpD;AAED;;;;;;GAMG;AACH,qBAAa,8BAA+B,SAAQ,sBAAsB;IACxE,SAAkB,IAAI,EAAG,0BAA0B,CAAU;gBACjD,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM;CAOpD;AAED,qEAAqE;AACrE,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,SAAS,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,CAAC;IAC3E,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC3B,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CACjC;AAED;;;;;;;;;GASG;AACH,qBAAa,wBAAyB,SAAQ,sBAAsB;IAClE,SAAkB,IAAI,EAAG,qBAAqB,CAAU;IACxD,QAAQ,CAAC,OAAO,CAAC,EAAE,yBAAyB,CAAC;gBACjC,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,yBAAyB;CAKxF;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,OAAO,GACb;IAAE,QAAQ,EAAE,IAAI,CAAC;IAAC,OAAO,CAAC,EAAE,yBAAyB,CAAA;CAAE,GAAG;IAAE,QAAQ,EAAE,KAAK,CAAA;CAAE,CAqB/E;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,6BAA6B,GACvC,6BAA6B,CAU/B;AAOD,sDAAsD;AACtD,qBAAa,wBAAyB,YAAW,sBAAsB;IACrE,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2C;IAClE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAuC;IAChE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA8B;IACrD,OAAO,CAAC,MAAM,CAAS;gBAEX,aAAa,CAAC,EAAE,MAAM;IAIlC,IAAI,UAAU,IAAI,SAAS,iCAAiC,EAAE,CAE7D;IAED,UAAU,CAAC,CAAC,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,2BAA2B,CAAC,CAAC,CAAC;IAgErE,IAAI,aAAa,IAAI,SAAS,6BAA6B,EAAE,CAE5D;IAED,OAAO,CAAC,SAAS,EAAE,6BAA6B,GAAG,sBAAsB;IAuBzE,IAAI,MAAM,IAAI,SAAS,oBAAoB,EAAE,CAE5C;IAED,KAAK,CAAC,KAAK,EAAE,oBAAoB,GAAG,sBAAsB;IAW1D,0DAA0D;IAC1D,IAAI,IAAI,wBAAwB;CASjC"}

package/dist/transaction.js

@@ -79,6 +79,34 @@ export class AtomicTransactionError extends Error {
         this.status = status;
     }
 }
+/**
+ * The transaction id was already committed with a different payload.
+ *
+ * Nothing was applied and the recorded transaction is unchanged. Retrying with
+ * the same id cannot succeed: choose a new id for a new transaction, or resend
+ * the original payload to confirm the original.
+ */
+export class TransactionIdConflictError extends AtomicTransactionError {
+    code = 'IDEMPOTENCY_CONFLICT';
+    constructor(transactionId, message) {
+        super(message ?? `Transaction ${transactionId} was already committed with a different payload`, transactionId);
+        this.name = 'TransactionIdConflictError';
+    }
+}
+/**
+ * The transaction id exists, but its recorded identity cannot be checked by
+ * this build (a digest of a newer construction, or a malformed one).
+ *
+ * Not a conflict and not a duplicate: neither can be established. Nothing was
+ * applied. Do not assume either outcome.
+ */
+export class TransactionIdUnverifiableError extends AtomicTransactionError {
+    code = 'IDEMPOTENCY_UNVERIFIABLE';
+    constructor(transactionId, message) {
+        super(message ?? `Transaction ${transactionId} exists, but its recorded identity cannot be verified by this build`, transactionId);
+        this.name = 'TransactionIdUnverifiableError';
+    }
+}
 /**
  * A transaction was refused because a precondition did not hold.
  *

package/dist/wasm/package.json

@@ -1,7 +1,7 @@
 {
   "name": "feltdb-wasm",
   "type": "module",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "files": [
     "feltdb_wasm_bg.wasm",
     "feltdb_wasm.js",

package/dist/workspace/local-development-authority.d.ts

@@ -20,6 +20,25 @@ export interface LocalDevelopmentAuthorityOptions {
         applicationUrl?: string;
     };
 }
+export declare const DEVELOPMENT_CONTROL_PLANE_CAPABILITIES: {
+    contract: string;
+    version: number;
+    capabilities: ({
+        status: "available";
+        note: string;
+        area: string;
+        title: string;
+        surface: string[];
+        id: string;
+    } | {
+        id: string;
+        area: string;
+        title: string;
+        status: "unsupported";
+        surface: string[];
+        note: string;
+    })[];
+};
 /** Start the durable, unauthenticated loopback authority used by `feltdb dev`. */
 export declare function startLocalDevelopmentAuthority(options: LocalDevelopmentAuthorityOptions): Promise<LocalDevelopmentAuthority>;
 //# sourceMappingURL=local-development-authority.d.ts.map

package/dist/workspace/local-development-authority.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local-development-authority.d.ts","sourceRoot":"","sources":["../../src/workspace/local-development-authority.ts"],"names":[],"mappings":"AAGA,OAAO,EAAwD,KAAK,eAAe,EAAsB,MAAM,gBAAgB,CAAC;AAEhI,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAE7E,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,MAAM,WAAW,gCAAgC;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,CAAC;IACjD,kBAAkB,CAAC,EAAE,MAAM,qBAAqB,EAAE,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;IACtF,cAAc,CAAC,EAAE;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,OAAO,CAAC;QACrB,oBAAoB,EAAE,MAAM,CAAC;QAC7B,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACH;AAeD,kFAAkF;AAClF,wBAAsB,8BAA8B,CAClD,OAAO,EAAE,gCAAgC,GACxC,OAAO,CAAC,yBAAyB,CAAC,CA6QpC"}
+{"version":3,"file":"local-development-authority.d.ts","sourceRoot":"","sources":["../../src/workspace/local-development-authority.ts"],"names":[],"mappings":"AAIA,OAAO,EAAwD,KAAK,eAAe,EAAsB,MAAM,gBAAgB,CAAC;AAEhI,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAE7E,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,MAAM,WAAW,gCAAgC;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,eAAe,CAAC,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,CAAC;IACjD,kBAAkB,CAAC,EAAE,MAAM,qBAAqB,EAAE,GAAG,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;IACtF,cAAc,CAAC,EAAE;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,OAAO,CAAC;QACrB,oBAAoB,EAAE,MAAM,CAAC;QAC7B,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACH;AAiFD,eAAO,MAAM,sCAAsC;;;;;;cA1Dd,MAAM;eAAS,MAAM;iBAAW,MAAM,EAAE;;;;;;;iBA+DL,MAAM,EAAE;;;CAC/E,CAAC;AAEF,kFAAkF;AAClF,wBAAsB,8BAA8B,CAClD,OAAO,EAAE,gCAAgC,GACxC,OAAO,CAAC,yBAAyB,CAAC,CAsWpC"}

package/dist/workspace/local-development-authority.js

@@ -1,19 +1,91 @@
 import http from 'node:http';
+import { createHash, randomBytes, scryptSync, timingSafeEqual } from 'node:crypto';
 import path from 'node:path';
 import { FileJsDb } from '../file-db.js';
 import { FELTDB_CONVERGENCE_COLLECTION, FeltDBProposalService } from '../proposal.js';
 import { IntentService } from '../intent.js';
-const DEVELOPMENT_CONTROL_PLANE_CAPABILITIES = {
+/**
+ * Why the development authority does not serve a part of the control plane.
+ *
+ * `feltdb dev` runs a lightweight authority that holds application state and
+ * the application contract. Everything else the control plane names belongs to
+ * a deployed feltdb-server. Each capability is declared — available or not —
+ * so Studio can tell "not part of this instance" from "unknown to Studio", and
+ * the reason says where the feature does live.
+ */
+const SERVER_ONLY = {
+    data: 'Record inspection, writes, sorting and index management through the control plane are served by feltdb-server. In development, the application writes its own state, and Data shows it.',
+    state: 'Semantic history, diff, conflict classification and reconciliation are served by feltdb-server; the development authority keeps current state only.',
+    operations: 'Operation history, rejections, transaction status and audit are recorded by feltdb-server; the development authority does not record them.',
+    agents: 'Agent principals, sessions, authorization decisions and Durable Work run on feltdb-server. The development authority does not run agents; the agents your application declares are listed under Build › Agents.',
+    replication: 'Replication health is reported by a feltdb-server cluster; the development authority is a single local node.',
+    applications: 'Managing applications is part of a deployed feltdb-server; a development session serves exactly one application.',
+    monitoring: 'Instance metrics come from feltdb-server; the development authority does not export them.',
+    settings: 'Instance settings belong to a deployed feltdb-server; a development session is configured by feltdb.config.json.',
+    developer: 'Developer access is issued by feltdb-server; the development authority is unauthenticated and loopback-only.',
+};
+const SERVED = {
+    'overview.instance': { area: 'overview', title: 'Development authority overview', surface: ['GET /v1/control-plane/overview'] },
+    'data.collections.list': { area: 'data', title: 'List declared collections', surface: ['GET /v1/application/schema'] },
+    'data.schema.inspect': { area: 'data', title: 'Inspect the application schema', surface: ['GET /v1/application/schema'] },
+    'data.records.browse': { area: 'data', title: 'Browse records', surface: ['GET /v1/data/{collection}'] },
+};
+/**
+ * Every capability the feltdb-server control plane declares, in its order,
+ * with the area it belongs to. Held equal to `control_plane.rs` by
+ * `development-authority-capabilities.test.mjs`.
+ */
+const CONTROL_PLANE_IDS = [
+    ['overview.instance', 'overview', 'Instance overview'],
+    ['data.collections.list', 'data', 'List collections'],
+    ['data.records.browse', 'data', 'Browse records'],
+    ['data.records.inspect', 'data', 'Inspect a record'],
+    ['data.records.create', 'data', 'Create records'],
+    ['data.records.update', 'data', 'Update records'],
+    ['data.records.delete', 'data', 'Delete records'],
+    ['data.records.sort', 'data', 'Sort records'],
+    ['data.schema.inspect', 'data', 'Inspect the schema'],
+    ['data.indexes.inspect', 'data', 'Inspect indexes'],
+    ['data.indexes.rebuild', 'data', 'Rebuild indexes'],
+    ['data.records.history', 'state', 'Record history'],
+    ['state.resources.list', 'state', 'List state resources'],
+    ['state.history', 'state', 'State history'],
+    ['state.diff.semantic', 'state', 'Semantic diff'],
+    ['state.conflict.classify', 'state', 'Classify conflicts'],
+    ['state.reconciliation.plan', 'state', 'Plan reconciliation'],
+    ['state.reconciliation.execute', 'state', 'Execute reconciliation'],
+    ['state.branch.heads', 'state', 'Branch heads'],
+    ['provenance.record', 'state', 'Record provenance'],
+    ['provenance.transactions', 'operations', 'Recent attributed transactions'],
+    ['agents.list', 'agents', 'List agents'],
+    ['agents.identity', 'agents', 'Agent identity'],
+    ['agents.register', 'agents', 'Register agents'],
+    ['agents.work', 'agents', 'Agent work (Durable Work)'],
+    ['agents.work.review_gate', 'agents', 'Agent work review gate'],
+    ['agents.sessions', 'agents', 'Agent sessions'],
+    ['agents.authorization_decisions', 'agents', 'Agent authorization decisions'],
+    ['agents.task_context', 'agents', 'Agent task context'],
+    ['operations.recent', 'operations', 'Recent operations'],
+    ['operations.rejections', 'operations', 'Rejected operations'],
+    ['operations.events', 'operations', 'Operation events'],
+    ['operations.transaction_status', 'operations', 'Transaction status'],
+    ['operations.correlation_id', 'operations', 'Correlation ids'],
+    ['operations.audit_log', 'operations', 'Audit log'],
+    ['replication.health', 'replication', 'Replication health'],
+    ['applications.list', 'applications', 'List applications'],
+    ['monitoring.metrics', 'monitoring', 'Instance metrics'],
+    ['monitoring.latency', 'monitoring', 'Latency'],
+    ['settings.instance', 'settings', 'Instance settings'],
+    ['settings.mutate', 'settings', 'Change settings'],
+    ['developer.tool_projection', 'developer', 'Tool projection'],
+    ['developer.access', 'developer', 'Developer access'],
+];
+export const DEVELOPMENT_CONTROL_PLANE_CAPABILITIES = {
     contract: 'feltdb.control-plane.capabilities',
     version: 1,
-    capabilities: [
-        { id: 'overview.instance', area: 'overview', title: 'Development authority overview', status: 'available', surface: ['GET /v1/control-plane/overview'], note: '' },
-        { id: 'data.collections.list', area: 'data', title: 'List declared collections', status: 'available', surface: ['GET /v1/application/schema'], note: '' },
-        { id: 'data.schema.inspect', area: 'data', title: 'Inspect the application schema', status: 'available', surface: ['GET /v1/application/schema'], note: '' },
-        { id: 'data.records.browse', area: 'data', title: 'Browse records', status: 'available', surface: ['GET /v1/data/{collection}'], note: '' },
-        { id: 'provenance.transactions', area: 'operations', title: 'Recent attributed transactions', status: 'unsupported', surface: [], note: 'Transaction observability is not available from the lightweight development authority.' },
-        { id: 'replication.health', area: 'replication', title: 'Replication health', status: 'unsupported', surface: [], note: 'Replication health is not available from the lightweight development authority.' },
-    ],
+    capabilities: CONTROL_PLANE_IDS.map(([id, area, title]) => SERVED[id]
+        ? { id, ...SERVED[id], status: 'available', note: '' }
+        : { id, area, title, status: 'unsupported', surface: [], note: SERVER_ONLY[area] }),
 };
 /** Start the durable, unauthenticated loopback authority used by `feltdb dev`. */
 export async function startLocalDevelopmentAuthority(options) {
@@ -37,9 +109,26 @@ export async function startLocalDevelopmentAuthority(options) {
     const proposalService = options.proposalContext ? new FeltDBProposalService(store, options.proposalContext, proposalAuthorityToken) : undefined;
     const intentService = proposalService && options.proposalContext ? new IntentService(store, options.proposalContext, proposalService, options.intentObservations) : undefined;
     const streams = new Set();
+    const notify = (collection) => {
+        // `resource` is the field every client reads (the event contract
+        // feltdb-server serves); `change` is kept for readers of the older frame.
+        const frame = `data: ${JSON.stringify({ resource: collection, change: { capability: collection } })}\n\n`;
+        for (const stream of streams)
+            stream.write(frame);
+    };
     let endpoint = '';
     const server = http.createServer(async (request, response) => {
         try {
+            // The authority is unauthenticated, so which pages may reach it is the
+            // whole boundary: only a loopback origin (the developer's own application
+            // and Studio) and a loopback Host (not a rebound DNS name). A request
+            // without an Origin is not a browser page and is not restricted here.
+            if (!loopbackHost(request.headers.host) || (request.headers.origin !== undefined && !loopbackOrigin(request.headers.origin))) {
+                response.statusCode = 403;
+                response.setHeader('Content-Type', 'application/json');
+                response.end(JSON.stringify({ error: 'NON_LOOPBACK_ORIGIN', message: 'The development authority serves loopback origins only.' }));
+                return;
+            }
             response.setHeader('Access-Control-Allow-Origin', '*');
             response.setHeader('Access-Control-Allow-Methods', 'GET, POST, PATCH, DELETE, OPTIONS');
             response.setHeader('Access-Control-Allow-Headers', 'Authorization, Content-Type, FeltDB-Protocol, FeltDB-Proposal-Authority');
@@ -349,14 +438,106 @@ export async function startLocalDevelopmentAuthority(options) {
                 json(response, 405, { error: 'METHOD_NOT_ALLOWED' });
                 return;
             }
+            const authMatch = pathname.match(/^\/v1\/auth\/(signup|signin|signout|session)$/);
+            if (authMatch) {
+                const operation = authMatch[1];
+                const expectedMethod = operation === 'session' ? 'GET' : 'POST';
+                if (request.method !== expectedMethod) {
+                    json(response, 405, { error: 'METHOD_NOT_ALLOWED' });
+                    return;
+                }
+                const body = operation === 'signup' || operation === 'signin' ? parseObject(await readBody(request)) : {};
+                const bearer = String(request.headers.authorization || '').replace(/^Bearer\s+/i, '');
+                const outcome = developmentAuth(db, operation, body, bearer);
+                json(response, outcome.status, outcome.body);
+                return;
+            }
+            // The direct data plane `HttpJsDb` speaks to any authority, so an
+            // application connected to this one behaves as it would against
+            // feltdb-server: same routes, same shapes, same refusals.
+            if (request.method === 'GET' && pathname === '/revision') {
+                json(response, 200, { revision: db.get_sequence(), scope: db.instance_id() });
+                return;
+            }
+            if (request.method === 'POST' && pathname === '/query') {
+                const query = parseObject(await readBody(request));
+                if (namesPrivateCollection([query.collection])) {
+                    refusePrivate(response);
+                    return;
+                }
+                try {
+                    json(response, 200, await db.authority_query(query));
+                }
+                catch (error) {
+                    const code = error.code;
+                    json(response, 400, { code, error: errorMessage(error), message: errorMessage(error) });
+                }
+                return;
+            }
+            if (request.method === 'POST' && pathname === '/transactions/read-basis') {
+                const reads = parseObject(await readBody(request));
+                if (namesPrivateCollection(readSetCollections(reads))) {
+                    refusePrivate(response);
+                    return;
+                }
+                json(response, 200, await db.read_basis(reads));
+                return;
+            }
+            if (request.method === 'POST' && pathname === '/transactions') {
+                const transaction = parseObject(await readBody(request));
+                if (namesPrivateCollection([
+                    ...(transaction.operations ?? []).map((operation) => operation?.collection),
+                    ...(transaction.preconditions ?? []).map((condition) => condition?.collection),
+                    ...(transaction.fences ?? []).flatMap((fence) => readSetCollections(fence?.reads)),
+                ])) {
+                    refusePrivate(response);
+                    return;
+                }
+                let result;
+                try {
+                    result = await db.commit_transaction(transaction);
+                }
+                catch (error) {
+                    json(response, transactionRefusalStatus(error), transactionRefusal(error));
+                    return;
+                }
+                json(response, 200, { ...result, status: 'committed' });
+                if (!result.duplicate) {
+                    const collections = new Set((transaction.operations ?? []).map((operation) => operation.collection));
+                    for (const collection of collections)
+                        notify(collection);
+                }
+                return;
+            }
+            const casMatch = pathname.match(/^\/collections\/([^/]+)\/([^/]+)\/cas$/);
+            if (request.method === 'POST' && casMatch) {
+                const collection = decodeURIComponent(casMatch[1]);
+                if (namesPrivateCollection([collection])) {
+                    refusePrivate(response);
+                    return;
+                }
+                const input = parseObject(await readBody(request));
+                const result = await db.cas({
+                    key: `${collection}:${decodeURIComponent(casMatch[2])}`,
+                    expectedVersion: Number(input.expectedVersion),
+                    expectedEpoch: input.expectedEpoch,
+                    expectedLeaseId: input.expectedLeaseId,
+                    rejectIfDiverged: input.rejectIfDiverged,
+                    value: JSON.stringify(input.value ?? {}),
+                });
+                json(response, 200, result);
+                if (result.updated)
+                    notify(collection);
+                return;
+            }
             const match = pathname.match(/^\/collections\/([^/]+)(?:\/([^/]+))?$/);
             if (!match) {
                 json(response, 404, { error: 'NOT_FOUND' });
                 return;
             }
             const collection = decodeURIComponent(match[1]);
-            if (collection.startsWith('_feltdb.')) {
-                json(response, 403, { error: 'SYSTEM_COLLECTION_REQUIRES_SERVICE_API' });
+            if (namesPrivateCollection([collection])) {
+                refusePrivate(response);
                 return;
             }
             const id = match[2] ? decodeURIComponent(match[2]) : undefined;
@@ -406,9 +587,7 @@ export async function startLocalDevelopmentAuthority(options) {
                 return;
             }
             json(response, request.method === 'POST' ? 201 : 200, { ok: true });
-            const frame = `data: ${JSON.stringify({ change: { capability: collection } })}\n\n`;
-            for (const stream of streams)
-                stream.write(frame);
+            notify(collection);
         }
         catch (error) {
             if (!response.headersSent)
@@ -440,11 +619,152 @@ function json(response, status, value) {
     response.setHeader('Content-Type', 'application/json; charset=utf-8');
     response.end(JSON.stringify(value));
 }
+const IDENTITIES = '_feltdb.development_identities';
+const SESSIONS = '_feltdb.development_sessions';
+const SESSION_TTL_MS = 15 * 60_000;
+function developmentAuth(db, operation, body, bearer) {
+    const read = (key) => {
+        const result = db.get(key);
+        if (!result.success)
+            throw new Error(result.error);
+        return result.data ? JSON.parse(result.data) : undefined;
+    };
+    const tokenHash = (token) => createHash('sha256').update(token).digest('hex');
+    const passwordHash = (password, salt) => scryptSync(password, salt, 32).toString('hex');
+    const refuse = (status, code, message) => ({ status, body: { code, error: code, message } });
+    const issue = (identity) => {
+        const token = randomBytes(32).toString('hex');
+        const session = { session_id: `session_${randomBytes(12).toString('hex')}`, expires_at: Date.now() + SESSION_TTL_MS };
+        const stored = db.insert(`${SESSIONS}:${tokenHash(token)}`, JSON.stringify({ ...session, user_id: identity.id }));
+        if (!stored.success)
+            throw new Error(stored.error);
+        return { status: 200, body: { access_token: token, actor: { user_id: identity.id, email: identity.email, display_name: identity.display_name }, session } };
+    };
+    if (operation === 'signout') {
+        if (bearer)
+            db.delete(`${SESSIONS}:${tokenHash(bearer)}`);
+        return { status: 200, body: {} };
+    }
+    if (operation === 'session') {
+        const sessionKey = `${SESSIONS}:${tokenHash(bearer)}`;
+        const session = bearer ? read(sessionKey) : undefined;
+        // An expired session is dead; remove it rather than keep it forever.
+        if (session && session.expires_at <= Date.now())
+            db.delete(sessionKey);
+        const identity = session && session.expires_at > Date.now()
+            ? read(`${IDENTITIES}:${session.user_id}`)
+            : undefined;
+        if (!session || !identity)
+            return refuse(401, 'AUTHENTICATION_REQUIRED', 'Authentication required');
+        return { status: 200, body: { access_token: bearer, actor: { user_id: identity.id, email: identity.email, display_name: identity.display_name }, session: { session_id: session.session_id, expires_at: session.expires_at } } };
+    }
+    const email = String(body.email ?? '').trim().toLowerCase();
+    const password = String(body.password ?? '');
+    if (!email || password.length < 8)
+        return refuse(422, 'INVALID_CREDENTIALS_FORMAT', 'email and a password of at least 8 characters are required');
+    const byEmail = `${IDENTITIES}:email:${createHash('sha256').update(email).digest('hex')}`;
+    const existingId = read(byEmail)?.id;
+    if (operation === 'signup') {
+        if (existingId)
+            return refuse(409, 'CONFLICT', 'identity already exists');
+        const salt = randomBytes(16).toString('hex');
+        const identity = { id: `user_${randomBytes(12).toString('hex')}`, email, display_name: typeof body.display_name === 'string' ? body.display_name : undefined, salt, password_hash: passwordHash(password, salt), created_at: new Date().toISOString() };
+        const claimed = db.insert(byEmail, JSON.stringify({ id: identity.id }));
+        if (!claimed.success)
+            return refuse(409, 'CONFLICT', 'identity already exists');
+        const stored = db.insert(`${IDENTITIES}:${identity.id}`, JSON.stringify(identity));
+        if (!stored.success) {
+            // Do not leave the email claimed by an identity that was never stored.
+            db.delete(byEmail);
+            throw new Error(stored.error);
+        }
+        return issue(identity);
+    }
+    const identity = existingId ? read(`${IDENTITIES}:${existingId}`) : undefined;
+    const presented = Buffer.from(passwordHash(password, identity?.salt ?? 'no-identity'), 'hex');
+    const expected = Buffer.from(identity?.password_hash ?? '0'.repeat(64), 'hex');
+    if (!identity || presented.length !== expected.length || !timingSafeEqual(presented, expected)) {
+        return refuse(401, 'INVALID_CREDENTIALS', 'invalid credentials');
+    }
+    return issue(identity);
+}
+/**
+ * `_feltdb.*` collections are the authority's own records — development
+ * identities and sessions among them — and no client route reads or writes
+ * them: not `/collections`, not a query, not a transaction or its fences.
+ */
+function namesPrivateCollection(collections) {
+    // Coerced the way the transaction and query engines coerce a collection
+    // name, so a value that is not a string (`["_feltdb.x"]` stringifies to the
+    // private name) is judged by what it will be read as, not by its type.
+    return collections.some(collection => collection !== undefined && collection !== null
+        && String(collection).trim().toLowerCase().startsWith('_feltdb.'));
+}
+function loopbackHost(host) {
+    if (!host)
+        return true;
+    try {
+        return LOOPBACK_HOSTNAMES.has(new URL(`http://${host}`).hostname);
+    }
+    catch {
+        return false;
+    }
+}
+function loopbackOrigin(origin) {
+    if (!origin)
+        return false;
+    try {
+        return LOOPBACK_HOSTNAMES.has(new URL(origin).hostname);
+    }
+    catch {
+        return false;
+    }
+}
+const LOOPBACK_HOSTNAMES = new Set(['localhost', '127.0.0.1', '[::1]']);
+function readSetCollections(reads) {
+    const set = (reads ?? {});
+    return [...(set.records ?? []), ...(set.predicates ?? [])].map(entry => entry?.collection);
+}
+function refusePrivate(response) {
+    json(response, 403, { error: 'SYSTEM_COLLECTION_REQUIRES_SERVICE_API' });
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+/**
+ * A refused transaction, in the document feltdb-server answers with: a lost
+ * conditional race is `409 PRECONDITION_FAILED` with the failed predicate, a
+ * reused transaction id is `409` with its idempotency code, and a malformed
+ * request is `400`. Callers type the refusal from `code`, never from prose.
+ */
+function transactionRefusal(error) {
+    const refusal = error;
+    return {
+        error: errorMessage(error),
+        code: refusal.feltdbCode ?? refusal.code,
+        ...(refusal.feltdbConflict ? { failure: refusal.feltdbConflict } : {}),
+    };
+}
+function transactionRefusalStatus(error) {
+    const refusal = error;
+    if (refusal.feltdbCode === 'PRECONDITION_FAILED')
+        return 409;
+    if (refusal.code === 'IDEMPOTENCY_CONFLICT' || refusal.code === 'IDEMPOTENCY_UNVERIFIABLE')
+        return 409;
+    return 400;
+}
+const MAX_BODY_BYTES = 1024 * 1024;
 function readBody(request) {
     return new Promise((resolve, reject) => {
         let body = '';
         request.setEncoding('utf8');
-        request.on('data', chunk => { body += chunk; });
+        request.on('data', chunk => {
+            body += chunk;
+            if (body.length > MAX_BODY_BYTES) {
+                request.destroy();
+                reject(new Error('Request body is too large'));
+            }
+        });
         request.once('end', () => resolve(body));
         request.once('error', reject);
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@feltdb/core",
-  "version": "0.12.1",
+  "version": "0.13.0",
   "description": "FeltDB Core - Application-facing database with Browser, Local, and Server runtimes. Durable state, reactive APIs.",
   "license": "MIT",
   "type": "module",