@feltdb/core 0.8.7 → 0.9.0

package/dist/authority-scope.d.ts

@@ -0,0 +1,14 @@
+export interface TenantAuthorityScope {
+    kind: 'tenant';
+    tenantId: string;
+    environmentId?: string;
+}
+export interface PlatformAuthorityScope {
+    kind: 'platform';
+}
+export type AuthorityScope = TenantAuthorityScope | PlatformAuthorityScope;
+export declare function normalizeAuthorityScope(scope: AuthorityScope | undefined): AuthorityScope;
+export declare function authorityScopeKey(scope: AuthorityScope): string;
+export declare function sameAuthorityScope(left: AuthorityScope, right: AuthorityScope): boolean;
+export declare function assertAuthorityScope(expected: AuthorityScope, actual: AuthorityScope): void;
+//# sourceMappingURL=authority-scope.d.ts.map

package/dist/authority-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authority-scope.d.ts","sourceRoot":"","sources":["../src/authority-scope.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,QAAQ,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,UAAU,CAAC;CAClB;AAED,MAAM,MAAM,cAAc,GAAG,oBAAoB,GAAG,sBAAsB,CAAC;AAE3E,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,cAAc,GAAG,SAAS,GAAG,cAAc,CAyBzF;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAK/D;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,cAAc,GAAG,OAAO,CAGvF;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,cAAc,GAAG,IAAI,CAI3F"}

package/dist/authority-scope.js

@@ -0,0 +1,34 @@
+import { FeltDBErrorCode, FeltDBServiceError } from './error-codes.js';
+export function normalizeAuthorityScope(scope) {
+    if (!scope) {
+        throw new FeltDBServiceError('An explicit tenant or platform authority scope is required', FeltDBErrorCode.AUTHORITY_SCOPE_REQUIRED);
+    }
+    if (scope.kind === 'platform')
+        return { kind: 'platform' };
+    if (scope.kind !== 'tenant' || typeof scope.tenantId !== 'string' || !scope.tenantId.trim()) {
+        throw new FeltDBServiceError('Tenant authority requires a non-empty tenantId', FeltDBErrorCode.AUTHORITY_SCOPE_REQUIRED);
+    }
+    if (scope.environmentId !== undefined && (typeof scope.environmentId !== 'string' || !scope.environmentId.trim())) {
+        throw new FeltDBServiceError('environmentId must be a non-empty string when provided', FeltDBErrorCode.AUTHORITY_SCOPE_INVALID);
+    }
+    return {
+        kind: 'tenant',
+        tenantId: scope.tenantId.trim(),
+        ...(scope.environmentId ? { environmentId: scope.environmentId.trim() } : {}),
+    };
+}
+export function authorityScopeKey(scope) {
+    const pathSafe = (value) => Array.from(new TextEncoder().encode(value), byte => byte.toString(16).padStart(2, '0')).join('');
+    return scope.kind === 'platform'
+        ? 'platform'
+        : `tenant/${pathSafe(scope.tenantId)}/${pathSafe(scope.environmentId ?? 'default')}`;
+}
+export function sameAuthorityScope(left, right) {
+    return left.kind === right.kind && (left.kind === 'platform'
+        || (right.kind === 'tenant' && left.tenantId === right.tenantId && left.environmentId === right.environmentId));
+}
+export function assertAuthorityScope(expected, actual) {
+    if (!sameAuthorityScope(expected, normalizeAuthorityScope(actual))) {
+        throw new FeltDBServiceError('Operation authority scope does not match the bound session', FeltDBErrorCode.AUTHORITY_SCOPE_MISMATCH);
+    }
+}

package/dist/collection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"collection.d.ts","sourceRoot":"","sources":["../src/collection.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAIL,KAAK,mBAAmB,EACxB,KAAK,QAAQ,EACd,MAAM,gBAAgB,CAAC;AAKxB,OAAO,KAAK,EAAE,WAAW,EAAc,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAErF,MAAM,MAAM,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC;AAChD,MAAM,MAAM,UAAU,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,IAAI,CAAC;AAiBjD;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,gGAAgG;IAChG,UAAU,EAAE,UAAU,GAAG,SAAS,CAAC;IACnC,4EAA4E;IAC5E,eAAe,EAAE,OAAO,CAAC;IACzB,oEAAoE;IACpE,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,mCAAmC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB,CAAC,CAAC;IACtC,mCAAmC;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,iEAAiE;IACjE,IAAI,CAAC,EAAE,CAAC,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACjC,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wDAAwD;IACxD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,qBAAa,UAAU,CAAC,CAAC;IACvB,OAAO,CAAC,EAAE,CAAO;IACjB,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,SAAS,CAA6B;IAC9C,OAAO,CAAC,KAAK,CAAW;IACxB,OAAO,CAAC,WAAW,CAAiC;IACpD,OAAO,CAAC,MAAM,CAA8B;IAC5C,OAAO,CAAC,QAAQ,CAAuB;IACvC,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,oBAAoB,CAA8B;IAC1D,OAAO,CAAC,gBAAgB,CAA6B;IACrD,OAAO,CAAC,kBAAkB,CAA6B;IACvD,OAAO,CAAC,YAAY,CAAoC;IACxD,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,aAAa,CAAS;IAC9B,mFAAmF;IACnF,OAAO,CAAC,eAAe,CAAK;IAC5B,gFAAgF;IAChF,OAAO,CAAC,iBAAiB,CAAM;IAC/B,OAAO,CAAC,QAAQ,CAAoC;IACpD,oEAAoE;IACpE,OAAO,CAAC,WAAW,CAA+B;IAClD,kFAAkF;IAClF,OAAO,CAAC,eAAe,CAAuB;IAC9C;;;;;;;OAOG;IACH,OAAO,CAAC,cAAc,CAAyB;IAC/C,yEAAyE;IACzE,OAAO,CAAC,aAAa,CAA+B;gBAExC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,UAAO;IAoBxG;;OAEG;YACW,oBAAoB;IAalC;;;OAGG;IACG,GAAG,IAAI,OAAO,CAAC,CAAC,EAAE,CAAC;IAKzB,qEAAqE;IAC/D,IAAI,IAAI,OAAO,CAAC,CAAC,EAAE,CAAC;IAI1B;;;;;;;;;;;;;OAaG;IACG,IAAI,CAAC,KAAK,GAAE,OAAO,CAAC,CAAC,CAAM,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;IAsChD,6EAA6E;IACvE,KAAK,CAAC,KAAK,GAAE,OAAO,CAAC,CAAC,CAAM,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;IAIjD;;;;;OAKG;IACH,aAAa,IAAI,mBAAmB,GAAG,IAAI;IAI3C,wEAAwE;IACxE,OAAO,CAAC,QAAQ;IAWhB;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;IAiBvB;;;;;;OAMG;IACH,OAAO,CAAC,wBAAwB;IA0BhC;;;;;OAKG;IACH,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI;IAWtC;;OAEG;IACH,WAAW,IAAI,WAAW,EAAE;IAI5B;;;OAGG;IACG,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAYrC;;OAEG;IACG,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC;IAazC;;OAEG;IACG,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAYjD;;;OAGG;IACH,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC;IAO7C;;;OAGG;IACG,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA4BrE,qEAAqE;IAC/D,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIlE;;OAEG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IA+BrE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACG,eAAe,CACnB,EAAE,EAAE,MAAM,GAAG,MAAM,EACnB,eAAe,EAAE,MAAM,EACvB,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EACnB,aAAa,CAAC,EAAE,MAAM,EACtB,eAAe,CAAC,EAAE,MAAM,EACxB,gBAAgB,CAAC,EAAE,OAAO,EAC1B,YAAY,CAAC,EAAE,CAAC,GACf,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IA2EpC;;OAEG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA2BhD;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC;IAK9B;;OAEG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKnD;;;;;;OAMG;IACH,OAAO,CAAC,SAAS;IAKjB;;;;;;;;OAQG;YACW,6BAA6B;IAkC3C;;;;;OAKG;YACW,iCAAiC;IAyE/C;;;;;;;;;;;;;OAaG;IACG,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,CAAC,CAAA;KAAE,CAAC;IAsClG;;;OAGG;IACH,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,IAAI;IA6CxE,mEAAmE;IACnE,KAAK,IAAI,IAAI;IASb;;;;;;;;;;;OAWG;IACH,SAAS,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAIzC;;;;;;OAMG;IACH,kBAAkB,IAAI,cAAc,GAAG,IAAI;IAI3C;;;;;;;;;OASG;YACW,eAAe;IAQ7B;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CA2E/B;AAED;;GAEG;AACH,qBAAa,YAAY,CAAC,MAAM,EAAE,KAAK;IACrC,OAAO,CAAC,QAAQ,CAAO;IACvB,OAAO,CAAC,OAAO,CAAO;IACtB,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,UAAU,CAAoC;gBAGpD,QAAQ,EAAE,IAAI,EACd,OAAO,EAAE,IAAI,EACb,eAAe,EAAE,MAAM,EACvB,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,GAAG,MAAM;IAQ/C;;OAEG;IACG,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;CAoBxD"}
+{"version":3,"file":"collection.d.ts","sourceRoot":"","sources":["../src/collection.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAIL,KAAK,mBAAmB,EACxB,KAAK,QAAQ,EACd,MAAM,gBAAgB,CAAC;AAKxB,OAAO,KAAK,EAAE,WAAW,EAAc,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAErF,MAAM,MAAM,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC;AAChD,MAAM,MAAM,UAAU,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,IAAI,CAAC;AAiBjD;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,gGAAgG;IAChG,UAAU,EAAE,UAAU,GAAG,SAAS,CAAC;IACnC,4EAA4E;IAC5E,eAAe,EAAE,OAAO,CAAC;IACzB,oEAAoE;IACpE,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,mCAAmC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB,CAAC,CAAC;IACtC,mCAAmC;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,iEAAiE;IACjE,IAAI,CAAC,EAAE,CAAC,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;IACjC,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wDAAwD;IACxD,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,qBAAa,UAAU,CAAC,CAAC;IACvB,OAAO,CAAC,EAAE,CAAO;IACjB,OAAO,CAAC,IAAI,CAAS;IACrB,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,SAAS,CAA6B;IAC9C,OAAO,CAAC,KAAK,CAAW;IACxB,OAAO,CAAC,WAAW,CAAiC;IACpD,OAAO,CAAC,MAAM,CAA8B;IAC5C,OAAO,CAAC,QAAQ,CAAuB;IACvC,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,oBAAoB,CAA8B;IAC1D,OAAO,CAAC,gBAAgB,CAA6B;IACrD,OAAO,CAAC,kBAAkB,CAA6B;IACvD,OAAO,CAAC,YAAY,CAAoC;IACxD,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,aAAa,CAAS;IAC9B,mFAAmF;IACnF,OAAO,CAAC,eAAe,CAAK;IAC5B,gFAAgF;IAChF,OAAO,CAAC,iBAAiB,CAAM;IAC/B,OAAO,CAAC,QAAQ,CAAoC;IACpD,oEAAoE;IACpE,OAAO,CAAC,WAAW,CAA+B;IAClD,kFAAkF;IAClF,OAAO,CAAC,eAAe,CAAuB;IAC9C;;;;;;;OAOG;IACH,OAAO,CAAC,cAAc,CAAyB;IAC/C,yEAAyE;IACzE,OAAO,CAAC,aAAa,CAA+B;gBAExC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,UAAO;IAoBxG;;OAEG;YACW,oBAAoB;IAalC;;;OAGG;IACG,GAAG,IAAI,OAAO,CAAC,CAAC,EAAE,CAAC;IAKzB,qEAAqE;IAC/D,IAAI,IAAI,OAAO,CAAC,CAAC,EAAE,CAAC;IAI1B;;;;;;;;;;;;;OAaG;IACG,IAAI,CAAC,KAAK,GAAE,OAAO,CAAC,CAAC,CAAM,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;IAoEhD,6EAA6E;IACvE,KAAK,CAAC,KAAK,GAAE,OAAO,CAAC,CAAC,CAAM,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;IAIjD;;;;;OAKG;IACH,aAAa,IAAI,mBAAmB,GAAG,IAAI;IAI3C,wEAAwE;IACxE,OAAO,CAAC,QAAQ;IAWhB;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;IAiBvB;;;;;;OAMG;IACH,OAAO,CAAC,wBAAwB;IA0BhC;;;;;OAKG;IACH,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI;IAWtC;;OAEG;IACH,WAAW,IAAI,WAAW,EAAE;IAI5B;;;OAGG;IACG,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAYrC;;OAEG;IACG,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC;IAazC;;OAEG;IACG,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC;IAYjD;;;OAGG;IACH,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC;IAO7C;;;OAGG;IACG,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA4BrE,qEAAqE;IAC/D,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIlE;;OAEG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IA+BrE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACG,eAAe,CACnB,EAAE,EAAE,MAAM,GAAG,MAAM,EACnB,eAAe,EAAE,MAAM,EACvB,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EACnB,aAAa,CAAC,EAAE,MAAM,EACtB,eAAe,CAAC,EAAE,MAAM,EACxB,gBAAgB,CAAC,EAAE,OAAO,EAC1B,YAAY,CAAC,EAAE,CAAC,GACf,OAAO,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IA2EpC;;OAEG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA2BhD;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,MAAM,CAAC;IAK9B;;OAEG;IACG,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKnD;;;;;;OAMG;IACH,OAAO,CAAC,SAAS;IAKjB;;;;;;;;OAQG;YACW,6BAA6B;IAkC3C;;;;;OAKG;YACW,iCAAiC;IAyE/C;;;;;;;;;;;;;OAaG;IACG,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,CAAC,CAAA;KAAE,CAAC;IAsClG;;;OAGG;IACH,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,IAAI;IA6CxE,mEAAmE;IACnE,KAAK,IAAI,IAAI;IASb;;;;;;;;;;;OAWG;IACH,SAAS,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAIzC;;;;;;OAMG;IACH,kBAAkB,IAAI,cAAc,GAAG,IAAI;IAI3C;;;;;;;;;OASG;YACW,eAAe;IAQ7B;;OAEG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CA2E/B;AAED;;GAEG;AACH,qBAAa,YAAY,CAAC,MAAM,EAAE,KAAK;IACrC,OAAO,CAAC,QAAQ,CAAO;IACvB,OAAO,CAAC,OAAO,CAAO;IACtB,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,UAAU,CAAoC;gBAGpD,QAAQ,EAAE,IAAI,EACd,OAAO,EAAE,IAAI,EACb,eAAe,EAAE,MAAM,EACvB,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,GAAG,MAAM;IAQ/C;;OAEG;IACG,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,KAAK,EAAE,CAAC;CAoBxD"}

package/dist/collection.js

@@ -130,8 +130,33 @@ export class Collection {
      * `lastQueryPlan()` reports which path ran.
      */
     async find(query = {}) {
-        const items = await this.all();
         const entries = Object.entries(query);
+        if (entries.length > 0 && this.db.authority_query) {
+            const records = [];
+            let cursor;
+            let candidatesExamined = 0;
+            let indexName;
+            do {
+                const page = await this.db.authority_query({
+                    collection: this.name,
+                    where: entries.map(([field, eq]) => ({ field, eq })),
+                    limit: 100,
+                    ...(cursor ? { cursor } : {}),
+                });
+                records.push(...page.records);
+                candidatesExamined += page.plan?.actual_rows_scanned ?? page.records.length;
+                indexName = page.plan?.index ?? indexName;
+                cursor = page.nextCursor;
+            } while (cursor);
+            this.lastPlan = {
+                strategy: indexName ? 'index' : 'scan',
+                ...(indexName ? { indexName } : { reason: 'server reported no applicable index' }),
+                candidatesExamined,
+                recordsReturned: records.length,
+            };
+            return records;
+        }
+        const items = await this.all();
         if (entries.length === 0) {
             this.lastPlan = { strategy: 'scan', reason: 'no query fields', candidatesExamined: items.length, recordsReturned: items.length };
             return items;

package/dist/create/package-versions.js

@@ -1,4 +1,4 @@
 // One release train keeps generated applications installable. The repository
 // validation script checks these values against every workspace manifest.
-export const FELTDB_PACKAGE_VERSION = '0.8.7';
+export const FELTDB_PACKAGE_VERSION = '0.9.0';
 export const feltdbPackageRange = `^${FELTDB_PACKAGE_VERSION}`;

package/dist/create/server-source/crates/feltdb/src/lib.rs

@@ -278,7 +278,7 @@ use serde_json::Value;
 use sha2::{Digest, Sha256};
 use std::any::type_name;
 use std::collections::hash_map::DefaultHasher;
-use std::collections::{BTreeMap, BTreeSet, HashMap, HashSet};
+use std::collections::{BTreeMap, BTreeSet, HashMap, HashSet, VecDeque};
 use std::fmt::{Display, Formatter};
 use std::fs::{self, OpenOptions};
 use std::hash::{Hash, Hasher};
@@ -390,6 +390,19 @@ struct Inner {
     applied_transactions: HashSet<String>,
     transaction_payload_hashes: HashMap<String, String>,
     transaction_revisions: HashMap<String, (u64, u64)>,
+    /// Recent commits, and who asked for them.
+    ///
+    /// Every transaction already records its actor: the audit document written
+    /// into the durable log carries `subject`, tenant, application and
+    /// revision. Until this existed that document was written and never read
+    /// back — replay parsed the record and discarded the audit — so the
+    /// database could say *what* changed and never *who changed it*.
+    ///
+    /// Bounded on purpose. This answers "who did this, recently", which is the
+    /// question a human asks while operating a running system; it is not an
+    /// audit archive, and the durable log remains the record of what happened.
+    /// Keeping it bounded is what makes it safe to maintain on the commit path.
+    transaction_attributions: VecDeque<TransactionAttribution>,
     collection_cardinality: HashMap<String, u64>,
     /// Derived equality index over `rows`. Never durable, never replicated, and
     /// never consulted for anything but candidate selection: it is maintained
@@ -737,6 +750,102 @@ pub enum JsonCasResult {
     },
     NotFound,
 }
+/// How many recent commits keep their attribution in memory.
+///
+/// Sized to cover what an operator reads in one sitting rather than to be a
+/// log. A larger window costs memory on every instance to answer a question the
+/// durable log already answers more completely.
+const TRANSACTION_ATTRIBUTION_WINDOW: usize = 512;
+
+/// How many mutated keys one attribution names before it stops listing them.
+///
+/// A bulk transaction can touch thousands of records; naming them all would
+/// make one commit's attribution larger than the rest of the window. The count
+/// is always exact, so a truncated list is visible as a truncated list.
+const TRANSACTION_ATTRIBUTION_KEYS: usize = 32;
+
+/// Who committed a transaction, and what it touched.
+///
+/// Projected from the audit document the transaction already writes. It carries
+/// no record values: attribution answers *who, when, and to what*, and the
+/// values are reachable through the record and revision APIs that authorize
+/// each read.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct TransactionAttribution {
+    pub transaction_id: String,
+    /// The actor the caller authenticated as, when the transaction named one.
+    pub subject: Option<String>,
+    pub tenant_id: Option<String>,
+    pub application_id: Option<String>,
+    /// The application contract revision the transaction was executed against.
+    pub application_revision: Option<String>,
+    pub base_revision: u64,
+    pub commit_revision: u64,
+    pub state_before: u64,
+    pub state_after: u64,
+    /// `capability:key` for each mutation, truncated at
+    /// [`TRANSACTION_ATTRIBUTION_KEYS`].
+    pub keys: Vec<String>,
+    /// How many mutations the transaction made, whether or not `keys` lists
+    /// them all.
+    pub operations: usize,
+    /// Milliseconds since the epoch, matching `StoredRow::unix_ms`.
+    pub unix_ms: u128,
+}
+
+impl TransactionAttribution {
+    /// Builds an attribution from a transaction record's own audit document.
+    fn from_record(
+        transaction_id: &str,
+        audit: Option<&Value>,
+        base_revision: u64,
+        commit_revision: u64,
+        state_before: u64,
+        state_after: u64,
+        rows: &[StoredRow],
+        unix_ms: u128,
+    ) -> Self {
+        let text = |field: &str| {
+            audit
+                .and_then(|value| value.get(field))
+                .and_then(Value::as_str)
+                .map(str::to_string)
+        };
+        TransactionAttribution {
+            transaction_id: transaction_id.to_string(),
+            subject: text("subject"),
+            tenant_id: text("tenant"),
+            application_id: text("application"),
+            application_revision: text("revision"),
+            base_revision,
+            commit_revision,
+            state_before,
+            state_after,
+            keys: rows
+                .iter()
+                .take(TRANSACTION_ATTRIBUTION_KEYS)
+                .map(|row| format!("{}:{}", row.capability, row.key))
+                .collect(),
+            operations: rows.len(),
+            unix_ms,
+        }
+    }
+
+    /// Whether this transaction touched a record, as far as `keys` records it.
+    pub fn touched(&self, capability: &str, key: &str) -> bool {
+        let target = format!("{capability}:{key}");
+        self.keys.iter().any(|held| *held == target)
+    }
+}
+
+/// Records an attribution, discarding the oldest once the window is full.
+fn remember_attribution(inner: &mut Inner, attribution: TransactionAttribution) {
+    if inner.transaction_attributions.len() >= TRANSACTION_ATTRIBUTION_WINDOW {
+        inner.transaction_attributions.pop_front();
+    }
+    inner.transaction_attributions.push_back(attribution);
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 struct TransactionLogRecord {
     record_type: String,
@@ -2827,6 +2936,22 @@ impl FeltDb {
                 bookkeeping_nanos += began.elapsed().as_nanos().min(u64::MAX as u128) as u64;
             }
             append_transaction(&inner.path, &record)?;
+            // Retained from the record that was just made durable, so the
+            // in-memory answer to "who committed this" cannot describe a
+            // transaction the log does not hold.
+            remember_attribution(
+                &mut inner,
+                TransactionAttribution::from_record(
+                    transaction_id,
+                    record.audit.as_ref(),
+                    base_revision,
+                    base_revision + 1,
+                    state_before,
+                    next_sequence,
+                    &record.rows,
+                    now_ms(),
+                ),
+            );
             inner.authority_revision = base_revision + 1;
             inner.sequence = next_sequence;
             for row in &rows {
@@ -3809,6 +3934,71 @@ impl FeltDb {
     }
 
     /// Earliest operation still available for incremental replay, by origin.
+    /// Recent commits and who made them, newest first.
+    ///
+    /// Bounded by [`TRANSACTION_ATTRIBUTION_WINDOW`]. A transaction older than
+    /// the window is not absent from history — it is in the durable log — it is
+    /// simply no longer answerable from memory, and callers that present this
+    /// to a human must say which of the two they are showing.
+    pub fn recent_transactions(&self, limit: usize) -> Result<Vec<TransactionAttribution>> {
+        let inner = self.state();
+        Ok(inner
+            .transaction_attributions
+            .iter()
+            .rev()
+            .take(limit)
+            .cloned()
+            .collect())
+    }
+
+    /// One transaction's attribution, if it is still inside the window.
+    pub fn transaction_attribution(
+        &self,
+        transaction_id: &str,
+    ) -> Result<Option<TransactionAttribution>> {
+        let inner = self.state();
+        Ok(inner
+            .transaction_attributions
+            .iter()
+            .rev()
+            .find(|attribution| attribution.transaction_id == transaction_id)
+            .cloned())
+    }
+
+    /// Recent commits that named this record, newest first.
+    ///
+    /// This is how "who last changed this record" is answered without scanning
+    /// the durable log: a transaction names the keys it mutated, so the join is
+    /// over data the commit already recorded.
+    pub fn transactions_touching(
+        &self,
+        capability: &str,
+        key: &str,
+        limit: usize,
+    ) -> Result<Vec<TransactionAttribution>> {
+        let inner = self.state();
+        Ok(inner
+            .transaction_attributions
+            .iter()
+            .rev()
+            .filter(|attribution| attribution.touched(capability, key))
+            .take(limit)
+            .cloned()
+            .collect())
+    }
+
+    /// How much of the attribution window is in use, and what it can hold.
+    ///
+    /// Reported so a reader can tell an idle system from a window that has
+    /// already rolled over.
+    pub fn transaction_attribution_window(&self) -> Result<(usize, usize)> {
+        let inner = self.state();
+        Ok((
+            inner.transaction_attributions.len(),
+            TRANSACTION_ATTRIBUTION_WINDOW,
+        ))
+    }
+
     pub fn retained_operation_floors(&self) -> Result<HashMap<String, u64>> {
         let inner = self.state();
         Ok(inner.change_log.retained_from())
@@ -4693,6 +4883,24 @@ fn replay_log(inner: &mut Inner) -> Result<()> {
                     .transaction_payload_hashes
                     .insert(transaction.transaction_id.clone(), hash);
             }
+            // Attribution is restored on replay for the same reason it is kept
+            // on commit: an operator who restarts a server must not lose the
+            // answer to "who did this" for work the server already holds.
+            let attribution = TransactionAttribution::from_record(
+                &transaction.transaction_id,
+                transaction.audit.as_ref(),
+                base_revision,
+                inner.authority_revision,
+                transaction.state_before,
+                transaction.state_after,
+                &transaction.rows,
+                transaction
+                    .rows
+                    .first()
+                    .map(|row| row.unix_ms)
+                    .unwrap_or_default(),
+            );
+            remember_attribution(inner, attribution);
             if inner
                 .applied_transactions
                 .insert(transaction.transaction_id)
@@ -4987,6 +5195,140 @@ mod tests {
         ))
     }
 
+    /// A commit is attributable: the audit document a transaction already
+    /// writes is retained, so a human can ask who made a change.
+    #[test]
+    fn a_committed_transaction_records_who_committed_it() {
+        let path = temp_file();
+        let db = open(&path).expect("open");
+        db.apply_atomic_transaction(
+            "tx_agent_1",
+            None,
+            &[],
+            &[AtomicMutation {
+                capability: "billing:Customer".into(),
+                key: "cus_1".into(),
+                value: Some(serde_json::json!({"name": "Ada", "status": "active"})),
+            }],
+            Some(serde_json::json!({
+                "subject": "agent_data_cleanup",
+                "tenant": "acme",
+                "application": "app_billing",
+                "revision": "rev_7",
+            })),
+        )
+        .expect("commit");
+
+        let recent = db.recent_transactions(10).expect("attributions");
+        assert_eq!(recent.len(), 1);
+        assert_eq!(recent[0].transaction_id, "tx_agent_1");
+        assert_eq!(recent[0].subject.as_deref(), Some("agent_data_cleanup"));
+        assert_eq!(recent[0].application_id.as_deref(), Some("app_billing"));
+        assert_eq!(recent[0].operations, 1);
+        assert_eq!(recent[0].keys, vec!["billing:Customer:cus_1".to_string()]);
+        // Attribution says who and what, never what was written.
+        assert!(!serde_json::to_string(&recent[0]).unwrap().contains("Ada"));
+
+        let touching = db
+            .transactions_touching("billing:Customer", "cus_1", 10)
+            .expect("touching");
+        assert_eq!(touching.len(), 1);
+        assert_eq!(touching[0].transaction_id, "tx_agent_1");
+        assert!(db
+            .transactions_touching("billing:Customer", "cus_2", 10)
+            .expect("touching")
+            .is_empty());
+
+        assert_eq!(
+            db.transaction_attribution("tx_agent_1")
+                .expect("lookup")
+                .map(|value| value.subject)
+                .flatten()
+                .as_deref(),
+            Some("agent_data_cleanup")
+        );
+
+        // Attribution survives a restart, because it is rebuilt from the same
+        // durable records the rest of recovery replays.
+        drop(db);
+        let reopened = open(&path).expect("reopen");
+        let after = reopened.recent_transactions(10).expect("attributions");
+        assert_eq!(after.len(), 1);
+        assert_eq!(after[0].subject.as_deref(), Some("agent_data_cleanup"));
+        assert_eq!(after[0].keys, vec!["billing:Customer:cus_1".to_string()]);
+        drop(reopened);
+        let _ = fs::remove_file(path);
+    }
+
+    /// The window is bounded, and reports that it is.
+    #[test]
+    fn transaction_attribution_is_bounded_and_newest_first() {
+        let path = temp_file();
+        let db = open(&path).expect("open");
+        let commits = TRANSACTION_ATTRIBUTION_WINDOW + 5;
+        for index in 0..commits {
+            db.apply_atomic_transaction(
+                &format!("tx_{index}"),
+                None,
+                &[],
+                &[AtomicMutation {
+                    capability: "app:Note".into(),
+                    key: format!("note_{index}"),
+                    value: Some(serde_json::json!({"index": index})),
+                }],
+                Some(serde_json::json!({"subject": format!("actor_{index}")})),
+            )
+            .expect("commit");
+        }
+        let (held, capacity) = db.transaction_attribution_window().expect("window");
+        assert_eq!(capacity, TRANSACTION_ATTRIBUTION_WINDOW);
+        assert_eq!(held, TRANSACTION_ATTRIBUTION_WINDOW);
+        let recent = db.recent_transactions(3).expect("attributions");
+        assert_eq!(
+            recent.iter().map(|value| value.transaction_id.clone()).collect::<Vec<_>>(),
+            vec![
+                format!("tx_{}", commits - 1),
+                format!("tx_{}", commits - 2),
+                format!("tx_{}", commits - 3),
+            ]
+        );
+        // The oldest commits rolled out of the window rather than being kept
+        // forever; the durable log still holds them.
+        assert!(db.transaction_attribution("tx_0").expect("lookup").is_none());
+        drop(db);
+        let _ = fs::remove_file(path);
+    }
+
+    /// A bulk transaction names a bounded sample of keys and an exact count.
+    #[test]
+    fn a_bulk_transaction_truncates_its_key_list_and_keeps_the_count() {
+        let path = temp_file();
+        let db = open(&path).expect("open");
+        let mutations = (0..TRANSACTION_ATTRIBUTION_KEYS + 20)
+            .map(|index| AtomicMutation {
+                capability: "app:Customer".into(),
+                key: format!("cus_{index}"),
+                value: Some(serde_json::json!({"index": index})),
+            })
+            .collect::<Vec<_>>();
+        db.apply_atomic_transaction(
+            "tx_bulk",
+            None,
+            &[],
+            &mutations,
+            Some(serde_json::json!({"subject": "migration_agent"})),
+        )
+        .expect("commit");
+        let attribution = db
+            .transaction_attribution("tx_bulk")
+            .expect("lookup")
+            .expect("held");
+        assert_eq!(attribution.operations, mutations.len());
+        assert_eq!(attribution.keys.len(), TRANSACTION_ATTRIBUTION_KEYS);
+        drop(db);
+        let _ = fs::remove_file(path);
+    }
+
     #[test]
     fn open_is_zero_init_and_creates_store() {
         let path = temp_file();