@feltdb/core 0.15.0 → 0.16.1

package/dist/collection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"collection.d.ts","sourceRoot":"","sources":["../src/collection.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAIL,KAAK,mBAAmB,EACxB,KAAK,QAAQ,EACd,MAAM,gBAAgB,CAAC;AAMxB,OAAO,KAAK,EAAE,WAAW,EAAc,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAErF,6CAA6C;AAC7C,MAAM,WAAW,aAAa;IAC5B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAKD,MAAM,MAAM,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC;AAChD,MAAM,MAAM,UAAU,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,IAAI,CAAC;AAEjD,MAAM,WAAW,qBAAqB;IACpC,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,KAAK,GAAG,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAqCD;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,gGAAgG;IAChG,UAAU,EAAE,UAAU,GAAG,SAAS,CAAC;IACnC,4EAA4E;IAC5E,eAAe,EAAE,OAAO,CAAC;IACzB,oEAAoE;IACpE,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,mCAAmC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB,CAAC,CAAC;IACtC,mCAAmC;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,iEAAiE;IACjE,IAAI,CAAC,EAAE,CAAC,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACjC,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wDAAwD;IACxD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,qBAAa,UAAU,CAAC,CAAC;IACvB,OAAO,CAAC,EAAE,CAAO;IACjB,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,SAAS,CAA6B;IAC9C,OAAO,CAAC,KAAK,CAAW;IACxB,OAAO,CAAC,WAAW,CAAiC;IACpD,OAAO,CAAC,MAAM,CAA8B;IAC5C,OAAO,CAAC,QAAQ,CAAuB;IACvC,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,oBAAoB,CAA8B;IAC1D,OAAO,CAAC,gBAAgB,CAA6B;IACrD,OAAO,CAAC,kBAAkB,CAA6B;IACvD,OAAO,CAAC,YAAY,CAAoC;IACxD,iGAAiG;IACjG,OAAO,CAAC,eAAe,CAAkC;IACzD,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,aAAa,CAAS;IAC9B,mFAAmF;IACnF,OAAO,CAAC,eAAe,CAAK;IAC5B,gFAAgF;IAChF,OAAO,CAAC,iBAAiB,CAAM;IAC/B,OAAO,CAAC,QAAQ,CAAoC;IACpD,oEAAoE;IACpE,OAAO,CAAC,WAAW,CAA+B;IAClD,kFAAkF;IAClF,OAAO,CAAC,eAAe,CAAuB;IAC9C;;;;;;;OAOG;IACH,OAAO,CAAC,cAAc,CAAyB;IAC/C,yEAAyE;IACzE,OAAO,CAAC,aAAa,CAA+B;gBAExC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,UAAO;IAoBxG;;OAEG;YACW,oBAAoB;IAelC;;;OAGG;IACG,GAAG,IAAI,OAAO,CAAC,CAAC,EAAE,CAAC;IAOzB,qEAAqE;IAC/D,IAAI,IAAI,OAAO,CAAC,CAAC,EAAE,CAAC;IAI1B;;;;;;;;;;;;;OAaG;IACG,IAAI,CAAC,KAAK,GAAE,OAAO,CAAC,CAAC,CAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;IAuFjF,6EAA6E;IACvE,KAAK,CAAC,KAAK,GAAE,OAAO,CAAC,CAAC,CAAM,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;IAIjD;;;;;OAKG;IACH,aAAa,IAAI,mBAAmB,GAAG,IAAI;IAI3C,wEAAwE;IACxE,OAAO,CAAC,QAAQ;IAWhB;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;IAiBvB;;;;;;OAMG;IACH,OAAO,CAAC,wBAAwB;IA0BhC;;;;;OAKG;IACH,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI;IAatC;;OAEG;IACH,WAAW,IAAI,WAAW,EAAE;IAI5B;;;OAGG;IACG,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAgBrC;;OAEG;IACG,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC;IAazC;;OAEG;IACG,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAYjD;;;OAGG;IACH,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC;IAO7C;;;;;;;;;;;;;;;OAeG;IACG,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,OAAO,CAAC,MAAM,CAAC;IAmDlG,qEAAqE;IAC/D,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIlE;;;;;;;;;;;OAWG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBrE,8EAA8E;YAChE,cAAc;IAc5B,wGAAwG;IACxG,OAAO,CAAC,gBAAgB;IAMxB,4EAA4E;YAC9D,OAAO;IAYrB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACG,eAAe,CACnB,EAAE,EAAE,MAAM,GAAG,MAAM,EACnB,eAAe,EAAE,MAAM,EACvB,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EACnB,aAAa,CAAC,EAAE,MAAM,EACtB,eAAe,CAAC,EAAE,MAAM,EACxB,gBAAgB,CAAC,EAAE,OAAO,EAC1B,YAAY,CAAC,EAAE,CAAC,GACf,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IA6EpC;;OAEG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgChD;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC;IAK9B;;OAEG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKnD;;;;;;OAMG;IACH,OAAO,CAAC,SAAS;IAKjB;;;;;;;;OAQG;YACW,6BAA6B;IAkC3C;;;;;OAKG;YACW,iCAAiC;IAyE/C;;;;;;;;;;;;;OAaG;IACG,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,CAAC,CAAA;KAAE,CAAC;IAsClG;;;OAGG;IACH,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,IAAI;IA6CxE,mEAAmE;IACnE,KAAK,IAAI,IAAI;IASb;;;;;;;;;;;OAWG;IACH,SAAS,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAIzC;;;;;;OAMG;IACH,kBAAkB,IAAI,cAAc,GAAG,IAAI;IAI3C;;;;;;;;;OASG;YACW,eAAe;IAQ7B;;OAEG;IACG,OAAO,CAAC,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,IAAI,CAAC;CA6EjE;AAgBD;;GAEG;AACH,qBAAa,YAAY,CAAC,MAAM,EAAE,KAAK;IACrC,OAAO,CAAC,QAAQ,CAAO;IACvB,OAAO,CAAC,OAAO,CAAO;IACtB,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,UAAU,CAAoC;gBAGpD,QAAQ,EAAE,IAAI,EACd,OAAO,EAAE,IAAI,EACb,eAAe,EAAE,MAAM,EACvB,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,GAAG,MAAM;IAQ/C;;OAEG;IACG,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;CAoBxD"}
+{"version":3,"file":"collection.d.ts","sourceRoot":"","sources":["../src/collection.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAIL,KAAK,mBAAmB,EACxB,KAAK,QAAQ,EACd,MAAM,gBAAgB,CAAC;AAMxB,OAAO,KAAK,EAAE,WAAW,EAAc,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAErF,6CAA6C;AAC7C,MAAM,WAAW,aAAa;IAC5B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAKD,MAAM,MAAM,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC;AAChD,MAAM,MAAM,UAAU,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,IAAI,CAAC;AAEjD,MAAM,WAAW,qBAAqB;IACpC,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,KAAK,GAAG,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAqCD;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,gGAAgG;IAChG,UAAU,EAAE,UAAU,GAAG,SAAS,CAAC;IACnC,4EAA4E;IAC5E,eAAe,EAAE,OAAO,CAAC;IACzB,oEAAoE;IACpE,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,mCAAmC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB,CAAC,CAAC;IACtC,mCAAmC;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,iEAAiE;IACjE,IAAI,CAAC,EAAE,CAAC,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACjC,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wDAAwD;IACxD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAgBD;;;;;GAKG;AACH,qBAAa,UAAU,CAAC,CAAC;IACvB,OAAO,CAAC,EAAE,CAAO;IACjB,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,SAAS,CAA6B;IAC9C,OAAO,CAAC,KAAK,CAAW;IACxB,OAAO,CAAC,WAAW,CAAiC;IACpD,OAAO,CAAC,MAAM,CAA8B;IAC5C,OAAO,CAAC,QAAQ,CAAuB;IACvC,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,oBAAoB,CAA8B;IAC1D,OAAO,CAAC,gBAAgB,CAA6B;IACrD,OAAO,CAAC,kBAAkB,CAA6B;IACvD,OAAO,CAAC,YAAY,CAAoC;IACxD,iGAAiG;IACjG,OAAO,CAAC,eAAe,CAAkC;IACzD,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,aAAa,CAAS;IAC9B,mFAAmF;IACnF,OAAO,CAAC,eAAe,CAAK;IAC5B,gFAAgF;IAChF,OAAO,CAAC,iBAAiB,CAAM;IAC/B,OAAO,CAAC,QAAQ,CAAoC;IACpD,oEAAoE;IACpE,OAAO,CAAC,WAAW,CAA+B;IAClD,kFAAkF;IAClF,OAAO,CAAC,eAAe,CAAuB;IAC9C;;;;;;;OAOG;IACH,OAAO,CAAC,cAAc,CAAyB;IAC/C,yEAAyE;IACzE,OAAO,CAAC,aAAa,CAA+B;gBAExC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,UAAO;IAoBxG;;OAEG;YACW,oBAAoB;IAelC;;;OAGG;IACG,GAAG,IAAI,OAAO,CAAC,CAAC,EAAE,CAAC;IAOzB,qEAAqE;IAC/D,IAAI,IAAI,OAAO,CAAC,CAAC,EAAE,CAAC;IAI1B;;;;;;;;;;;;;OAaG;IACG,IAAI,CAAC,KAAK,GAAE,OAAO,CAAC,CAAC,CAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;IA0FjF,6EAA6E;IACvE,KAAK,CAAC,KAAK,GAAE,OAAO,CAAC,CAAC,CAAM,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;IAIjD;;;;;OAKG;IACH,aAAa,IAAI,mBAAmB,GAAG,IAAI;IAI3C,wEAAwE;IACxE,OAAO,CAAC,QAAQ;IAWhB;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;IAiBvB;;;;;;OAMG;IACH,OAAO,CAAC,wBAAwB;IA0BhC;;;;;OAKG;IACH,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI;IAatC;;OAEG;IACH,WAAW,IAAI,WAAW,EAAE;IAI5B;;;OAGG;IACG,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAgBrC;;OAEG;IACG,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC;IAazC;;OAEG;IACG,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAYjD;;;OAGG;IACH,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC;IAO7C;;;;;;;;;;;;;;;OAeG;IACG,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,OAAO,CAAC,MAAM,CAAC;IAmDlG,qEAAqE;IAC/D,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIlE;;;;;;;;;;;OAWG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAsBrE,8EAA8E;YAChE,cAAc;IAc5B,wGAAwG;IACxG,OAAO,CAAC,gBAAgB;IAMxB,4EAA4E;YAC9D,OAAO;IAYrB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACG,eAAe,CACnB,EAAE,EAAE,MAAM,GAAG,MAAM,EACnB,eAAe,EAAE,MAAM,EACvB,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EACnB,aAAa,CAAC,EAAE,MAAM,EACtB,eAAe,CAAC,EAAE,MAAM,EACxB,gBAAgB,CAAC,EAAE,OAAO,EAC1B,YAAY,CAAC,EAAE,CAAC,GACf,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IA6EpC;;OAEG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgChD;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC;IAK9B;;OAEG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKnD;;;;;;OAMG;IACH,OAAO,CAAC,SAAS;IAKjB;;;;;;;;OAQG;YACW,6BAA6B;IAkC3C;;;;;OAKG;YACW,iCAAiC;IAyE/C;;;;;;;;;;;;;OAaG;IACG,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,CAAC,CAAA;KAAE,CAAC;IAsClG;;;OAGG;IACH,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,IAAI;IA6CxE,mEAAmE;IACnE,KAAK,IAAI,IAAI;IASb;;;;;;;;;;;OAWG;IACH,SAAS,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAIzC;;;;;;OAMG;IACH,kBAAkB,IAAI,cAAc,GAAG,IAAI;IAI3C;;;;;;;;;OASG;YACW,eAAe;IAQ7B;;OAEG;IACG,OAAO,CAAC,OAAO,GAAE;QAAE,MAAM,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,OAAO,CAAC,IAAI,CAAC;CA6EjE;AAgBD;;GAEG;AACH,qBAAa,YAAY,CAAC,MAAM,EAAE,KAAK;IACrC,OAAO,CAAC,QAAQ,CAAO;IACvB,OAAO,CAAC,OAAO,CAAO;IACtB,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,UAAU,CAAoC;gBAGpD,QAAQ,EAAE,IAAI,EACd,OAAO,EAAE,IAAI,EACb,eAAe,EAAE,MAAM,EACvB,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,GAAG,MAAM;IAQ/C;;OAEG;IACG,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;CAoBxD"}

package/dist/collection.js

@@ -41,6 +41,21 @@ function assertRecordValue(collection, operation, value) {
             + `The id goes second: insert(record, id).`, FeltDBErrorCode.INVALID_REQUEST);
     }
 }
+/**
+ * A query result as the document `find()` returns on every backend. A FeltDB server adds its
+ * record identity (`recordId`, authority metadata, equal to the document's `id`) to each
+ * bounded-query result; the embedded runtimes do not. `find()` returns documents, so a caller
+ * that reads one and writes it back never stores the authority's metadata as a field.
+ */
+function storedDocument(record) {
+    if (!record || typeof record !== 'object' || Array.isArray(record))
+        return record;
+    const value = record;
+    if (!('recordId' in value) || value.recordId !== value.id)
+        return record;
+    const { recordId: _authority, ...document } = value;
+    return document;
+}
 /**
  * A live collection that automatically updates when underlying data changes.
  * Represents application state, not a one-time query result.
@@ -168,7 +183,7 @@ export class Collection {
                 candidatesExamined: page.plan?.actual_rows_scanned ?? page.records.length,
                 recordsReturned: page.records.length,
             };
-            return page.records;
+            return page.records.map(storedDocument);
         }
         if (entries.length > 0 && this.db.authority_query && this.db.collection_queries_via_authority) {
             const records = [];
@@ -179,10 +194,13 @@ export class Collection {
                 const page = await this.db.authority_query({
                     collection: this.name,
                     where: entries.map(([field, eq]) => ({ field, eq })),
+                    // The authority requires an ordering. Every match has the same value of an equality-filtered field, so
+                    // ordering by it is a no-op that the authority completes with its record-id tie-breaker: stable pages.
+                    orderBy: [{ field: entries[0][0], direction: 'asc' }],
                     limit: 100,
                     ...(cursor ? { cursor } : {}),
                 });
-                records.push(...page.records);
+                records.push(...page.records.map(storedDocument));
                 candidatesExamined += page.plan?.actual_rows_scanned ?? page.records.length;
                 indexName = page.plan?.index ?? indexName;
                 cursor = page.nextCursor;

package/dist/create/build-identity.json

@@ -1,13 +1,13 @@
 {
   "schema": "feltdb.build-identity.v2",
   "package": "create-feltdb",
-  "version": "0.15.0",
+  "version": "0.16.1",
   "git": {
-    "sha1": "5ad54972a9e31a5459cadbb471428111624ec9c6",
+    "sha1": "dd9fe9449e38054dee71cc9e6e5ea929d25026ee",
     "dirty": false
   },
   "path_in_vcs": "tools/create-feltdb",
-  "source_digest": "sha256:01efc5737aae1fef37c976e5841df3bb9b615d034f31d27b038f7fd4ca202428",
+  "source_digest": "sha256:f5f01ce7dad3501af8542326bdbe3cabfd4859b1e2a31851f6be419988360ce0",
   "inputs": [
     "Cargo.lock",
     "Cargo.toml",
@@ -20,7 +20,15 @@
     "tools/cli",
     "tools/create-feltdb"
   ],
-  "files": 789,
+  "files": 790,
+  "release": {
+    "tag": "v0.16.1",
+    "ref": "main",
+    "origin_main": {
+      "sha1": "dd9fe9449e38054dee71cc9e6e5ea929d25026ee",
+      "contains_commit": true
+    }
+  },
   "build": {
     "command": "npm run build",
     "node": "v24.9.0"

package/dist/create/managed-account.js

@@ -1,5 +1,39 @@
 import fs from 'fs';
 import path from 'path';
+/** Deploy-time key: publish and promote contracts of one application. Never the running app's. */
+export const MANAGED_CONTROL_SCOPES = Object.freeze([
+    'application:read', 'application:write', 'application:revision:create',
+    'application:revision:read', 'application:revision:promote',
+    'application:environment:read', 'application:environment:write',
+    'connections:read',
+]);
+/**
+ * The runtime (data) key a server-side application needs to read and write its state, and
+ * nothing more (docs: public-docs/managed-production.md, "Key types").
+ */
+export const MANAGED_RUNTIME_SCOPES_MINIMAL = Object.freeze([
+    'application:read', 'application:revision:read', 'state:read', 'state:write',
+]);
+/** What a starter's runtime key holds: state plus events, workflows, agents and capabilities. */
+export const MANAGED_RUNTIME_SCOPES_DEFAULT = Object.freeze([
+    ...MANAGED_RUNTIME_SCOPES_MINIMAL, 'events:read', 'workflows:run', 'agents:run', 'capabilities:run',
+]);
+/**
+ * Scopes from the command line: `minimal`, `default`, `control`, or a comma-separated list.
+ * Whether each scope may be granted is the account service's decision; it never issues a
+ * scope the signed-in person does not hold.
+ */
+export function resolveManagedScopes(value) {
+    const presets = { minimal: MANAGED_RUNTIME_SCOPES_MINIMAL, default: MANAGED_RUNTIME_SCOPES_DEFAULT, control: MANAGED_CONTROL_SCOPES };
+    const scopes = presets[value.trim()] ?? value.split(',').map(scope => scope.trim()).filter(Boolean);
+    if (!scopes.length)
+        throw new Error('Name at least one scope: minimal, default, control, or a comma-separated list');
+    for (const scope of scopes) {
+        if (scope === '*' || !/^[a-z][a-z_-]*(?::[a-z_-]+)+$/.test(scope))
+            throw new Error(`"${scope}" is not a scope (expected e.g. state:read). Wildcard keys are operator keys and never belong to an application.`);
+    }
+    return [...new Set(scopes)];
+}
 function loadEnvironment(file) {
     const values = {};
     for (const raw of fs.readFileSync(file, 'utf8').split(/\r?\n/)) {
@@ -21,9 +55,8 @@ async function responseJson(response, fallback) {
         throw new Error(String(body.error || body.message || fallback));
     return body;
 }
-export async function configureManagedAccount(options) {
+export async function signInManagedAccount(options) {
     const accountUrl = (options.accountUrl || process.env.FELTDB_MANAGED_ACCOUNT_URL || 'https://feltdb.com').replace(/\/$/, '');
-    const apiUrl = (options.apiUrl || process.env.FELTDB_MANAGED_URL || 'https://api.feltdb.com').replace(/\/$/, '');
     const request = options.fetchImpl || fetch;
     const authenticated = await request(`${accountUrl}/api/auth`, {
         method: 'POST', headers: { 'Content-Type': 'application/json' },
@@ -33,11 +66,37 @@ export async function configureManagedAccount(options) {
     // fetch follows the feltdb.com -> www.feltdb.com redirect. Reuse the final
     // origin so Node does not strip the explicit Cookie header on later
     // cross-origin redirects.
-    const sessionOrigin = authenticated.url ? new URL(authenticated.url).origin : accountUrl;
+    const origin = authenticated.url ? new URL(authenticated.url).origin : accountUrl;
     const cookie = authenticated.headers.get('set-cookie')?.split(';', 1)[0];
     if (!cookie)
         throw new Error('Managed account service did not return a secure session');
-    const headers = { Cookie: cookie, 'Content-Type': 'application/json' };
+    return { origin, headers: { Cookie: cookie, 'Content-Type': 'application/json' }, request };
+}
+/** Mint a key bound to one application. The secret is returned once and never stored here. */
+export async function createManagedKey(session, input) {
+    const created = await responseJson(await session.request(`${session.origin}/api/keys`, {
+        method: 'POST', headers: session.headers,
+        body: JSON.stringify({ id: input.id, namespace: input.namespace, application_id: input.applicationId, scopes: [...input.scopes] }),
+    }), `Could not create the managed key ${input.id}`);
+    if (!created.secret)
+        throw new Error(`Managed key service did not return the credential for ${input.id}`);
+    return { id: String(created.id ?? input.id), secret: String(created.secret), scopes: Array.isArray(created.scopes) ? created.scopes : [...input.scopes] };
+}
+/** Keys of one application: ids, scopes and state, never secrets. */
+export async function listManagedKeys(session, applicationId) {
+    const listed = await responseJson(await session.request(`${session.origin}/api/keys?application_id=${encodeURIComponent(applicationId)}`, { headers: session.headers }), 'Could not list managed keys');
+    return Array.isArray(listed) ? listed : Array.isArray(listed.tokens) ? listed.tokens : [];
+}
+export async function revokeManagedKey(session, keyId) {
+    const response = await session.request(`${session.origin}/api/keys/${encodeURIComponent(keyId)}`, { method: 'DELETE', headers: session.headers });
+    if (!response.ok)
+        await responseJson(response, `Could not revoke the managed key ${keyId}`);
+}
+export async function configureManagedAccount(options) {
+    const apiUrl = (options.apiUrl || process.env.FELTDB_MANAGED_URL || 'https://api.feltdb.com').replace(/\/$/, '');
+    const session = await signInManagedAccount(options);
+    const { request, headers } = session;
+    const sessionOrigin = session.origin;
     const tenants = await responseJson(await request(`${sessionOrigin}/api/tenants`, { headers }), 'Could not load managed workspaces');
     let tenant = Array.isArray(tenants) ? tenants[0] : undefined;
     if (!tenant) {
@@ -58,37 +117,14 @@ export async function configureManagedAccount(options) {
     // Provision through the account origin that issued the human session. The
     // resulting key is still used against apiUrl, but setup must not require a
     // browser session to be trusted by every managed data-plane hostname.
-    const controlKey = await responseJson(await request(`${sessionOrigin}/api/keys`, {
-        method: 'POST', headers,
-        body: JSON.stringify({
-            id: `${options.applicationName}-control`,
-            namespace: application.namespace || options.namespace,
-            application_id: application.id,
-            scopes: [
-                'application:read', 'application:write', 'application:revision:create',
-                'application:revision:read', 'application:revision:promote',
-                'application:environment:read', 'application:environment:write',
-                'connections:read',
-            ],
-        }),
-    }), 'Could not create the managed control-plane key');
-    if (!controlKey.secret)
-        throw new Error('Managed key service did not return the control-plane credential');
-    const dataKey = await responseJson(await request(`${sessionOrigin}/api/keys`, {
-        method: 'POST', headers,
-        body: JSON.stringify({
-            id: `${options.applicationName}-runtime`,
-            namespace: application.namespace || options.namespace,
-            application_id: application.id,
-            scopes: [
-                'application:read', 'application:revision:read',
-                'state:read', 'state:write', 'events:read',
-                'workflows:run', 'agents:run', 'capabilities:run',
-            ],
-        }),
-    }), 'Could not create the managed application data key');
-    if (!dataKey.secret)
-        throw new Error('Managed key service did not return the application data credential');
+    const namespace = application.namespace || options.namespace;
+    const controlKey = await createManagedKey(session, { id: `${options.applicationName}-control`, namespace, applicationId: application.id, scopes: MANAGED_CONTROL_SCOPES })
+        .catch(error => { throw new Error(`Could not create the managed control-plane key: ${error.message}`); });
+    const dataKey = await createManagedKey(session, { id: `${options.applicationName}-runtime`, namespace, applicationId: application.id, scopes: options.runtimeScopes ?? MANAGED_RUNTIME_SCOPES_DEFAULT })
+        .catch(async (error) => {
+        await revokeManagedKey(session, controlKey.id).catch(() => undefined);
+        throw new Error(`Could not create the managed application data key: ${error.message}`);
+    });
     try {
         await responseJson(await request(`${apiUrl}/api/applications/${encodeURIComponent(application.id)}/revisions`, {
             headers: { Authorization: `Bearer ${controlKey.secret}` },
@@ -149,3 +185,25 @@ export async function finalizeManagedProvisioning(options) {
     fs.writeFileSync(managedFile, `${JSON.stringify({ ...managed, revisionId: published.revisionId }, null, 2)}\n`, { mode: 0o600 });
     return { revisionId: published.revisionId };
 }
+/**
+ * Set `name=value` in an env file, creating it with mode 600 or replacing that one line,
+ * and leave the file at mode 600. Used to put a newly minted key where the server process
+ * (or a deploy script) reads it, without the key ever being printed.
+ */
+export function setEnvironmentValue(file, name, value) {
+    if (!/^[A-Z][A-Z0-9_]*$/.test(name))
+        throw new Error(`${name} is not an environment variable name`);
+    if (/^VITE_|^NEXT_PUBLIC_|^PUBLIC_|^REACT_APP_|^EXPO_PUBLIC_/.test(name))
+        throw new Error(`${name} would be inlined into browser code; a FeltDB key belongs in a server-side variable such as FELTDB_TOKEN`);
+    const lines = fs.existsSync(file) ? fs.readFileSync(file, 'utf8').split(/\r?\n/) : [];
+    const index = lines.findIndex(line => line.startsWith(`${name}=`));
+    if (index >= 0)
+        lines[index] = `${name}=${value}`;
+    else {
+        if (lines.length && lines[lines.length - 1] === '')
+            lines.pop();
+        lines.push(`${name}=${value}`, '');
+    }
+    fs.writeFileSync(file, lines.join('\n'), { mode: 0o600 });
+    fs.chmodSync(file, 0o600);
+}

package/dist/create/package-versions.js

@@ -1,4 +1,4 @@
 // One release train keeps generated applications installable. The repository
 // validation script checks these values against every workspace manifest.
-export const FELTDB_PACKAGE_VERSION = '0.15.0';
+export const FELTDB_PACKAGE_VERSION = '0.16.1';
 export const feltdbPackageRange = `^${FELTDB_PACKAGE_VERSION}`;