@kairos-es/core 1.0.0-alpha.4 → 1.0.0-alpha.6

package/dist/dts-esm/AppendIsOwned.d.ts

@@ -0,0 +1,78 @@
+/**
+ * `AppendIsOwned` — the marker saying *"an append is already owned here"*, and the
+ * check that refuses a second one.
+ *
+ * ## Why a write-side concept core does not need for its own job lives in core
+ *
+ * A bracket that derives one `AppendCondition` from every read its body performed
+ * (`@kairos-es/codec`'s `transact`) owns exactly one append: the one it issues at
+ * close, under that derived condition. Any OTHER append inside that body is a
+ * wiring mistake, and the dangerous case is not the one that looks dangerous. A
+ * command runner appending mid-body usually writes into the very slice the body
+ * read, so its events match the union the bracket is about to guard on — and the
+ * bracket's own closing append is then refused by a condition its own body
+ * invalidated. The failure arrives at the wrong line, describing a conflict that
+ * was self-inflicted.
+ *
+ * The refusal therefore has to catch a RAW `store.append` and not merely a nested
+ * bracket, which is what puts it here rather than in the codec. Enforcing it one
+ * layer up would catch a nested bracket and a command runner and miss a direct
+ * store call — and a syntactic lint rule cannot close that gap either, having no
+ * call graph, so an append one function away in a helper is invisible to both.
+ * `makeContractStore` is the one seam every engine's append already passes
+ * through, so the check is written once and inherited whole, exactly as
+ * `assertServableQuery` is.
+ *
+ * The cost is real and is accepted: core learns a concept it does not need for its
+ * own job. It is affordable because core already owns the write contract, and
+ * *"an append is already owned"* is a write-side fact about that contract rather
+ * than a fact about the codec.
+ *
+ * ## Present means refused, so a sanctioned append REMOVES the marker
+ *
+ * The check reads the service through `Effect.serviceOption`, so its ABSENCE is the
+ * normal case and costs the `append` signature nothing — `DcbEventStore.append`
+ * keeps `R = never` and no caller provides anything. Presence is what refuses.
+ *
+ * That shape decides how the two legitimate appends inside a bracket get through,
+ * and there is only one route: run with the marker STRIPPED from the context
+ * (`Effect.updateContext` over `Context.omit(AppendIsOwned)`). The bracket's own
+ * closing append is issued outside the scope it provided the marker in, and the
+ * codec's escape hatch strips it explicitly. Neither needs a second service, a
+ * sanctioning flag or a mutable cell, and there is no way to be exempt by
+ * accident: an append is either lexically outside the marked region or it says in
+ * as many words that it is removing the marker.
+ */
+import { Context, Effect } from 'effect';
+declare const AppendIsOwned_base: Context.ServiceClass<AppendIsOwned, "@kairos-es/core/AppendIsOwned", {
+    readonly by: string;
+}>;
+/**
+ * Marks that an append is already owned by an enclosing bracket, and names what
+ * owns it.
+ *
+ * `by` is a human-readable owner name and exists for the defect message alone —
+ * the refusal is decided by the service's PRESENCE, never by this value, so nothing
+ * branches on it and no caller need agree on a vocabulary for it.
+ */
+export declare class AppendIsOwned extends AppendIsOwned_base {
+}
+/**
+ * Die if an append is already owned here; do nothing otherwise.
+ *
+ * A DEFECT and not an error-channel value, deliberately. There is no
+ * data-dependent recovery from it: the events this append would have written
+ * belong to a bracket that is going to write its own, so no caller could sensibly
+ * catch it and carry on. It is the same class of fault as a non-servable query,
+ * and it is refused in the same place and in the same way. The remedy is one
+ * identifier away in every case — the codec's `decideOnly` for a command runner,
+ * its escape hatch for a deliberate second append — which is what makes a defect
+ * affordable here.
+ *
+ * `Effect.serviceOption` is what keeps this free: it reads the service if present and
+ * adds NOTHING to the requirement channel, so every existing append is unchanged
+ * and unprovisioned.
+ */
+export declare const assertAppendNotOwned: Effect.Effect<void>;
+export {};
+//# sourceMappingURL=AppendIsOwned.d.ts.map

package/dist/dts-esm/AppendIsOwned.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AppendIsOwned.d.ts","sourceRoot":"","sources":["../../src/AppendIsOwned.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;;iBAYvB,MAAM;;AAVvB;;;;;;;GAOG;AACH,qBAAa,aAAc,SAAQ,kBAGC;CAAG;AAEvC;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAepD,CAAA"}

package/dist/dts-esm/ContractStore.d.ts

@@ -0,0 +1,62 @@
+/**
+ * `makeContractStore` — the shared contract-enforcement POLICY every
+ * `DcbEventStore` engine wears, factored out of the engines so the policy is
+ * DEFINITIONALLY identical across backends rather than identical by inspection.
+ *
+ * Each engine implements only the MECHANICS (`RawDcbEventStore`): the actual
+ * read/append/subscribe, free to surface infrastructure faults on the error
+ * channel (`never` for the pure in-memory engine; `SqlError` for either SQL one).
+ * The decorator wraps those mechanics with the policy the contract demands — the
+ * policy the first two engines hand-duplicated, with the Postgres one even
+ * needing a bespoke `catchAll`/`instanceof` (Effect 3's `catchAll`, which Effect 4
+ * names `catch`):
+ *
+ * - `assertServableQuery` at every verb's entry (read, the append condition's
+ *   guard query, subscribe) — a non-servable query, or one carrying a key the
+ *   grammar does not define, is a DEFECT in every engine, and an append condition
+ *   carrying a key `AppendCondition` does not define is refused alongside it;
+ * - `ReadLimit` decode on `read`'s `limit` — a negative/non-integer limit is a
+ *   DEFECT (so `read` keeps `E = never`), validated through the branded schema
+ *   even at an untyped boundary that reaches the store as `unknown`;
+ * - `orDie` on read/subscribe infrastructure errors — `read`/`subscribe` are
+ *   `E = never` on the contract, so a raw fault is a defect, not a channel value;
+ * - the `AppendConditionFailed`-else-die classification on append, matched by
+ *   `_tag` and never by class identity — ONLY the contract conflict rides the
+ *   error channel; every other fault is a defect;
+ * - `assertAppendNotOwned` on append — an append inside a bracket that already
+ *   owns one is a DEFECT. Read `AppendIsOwned.ts` for the rule and for why a
+ *   write-side concept core does not need for its own job is enforced here.
+ *
+ * The throws are deferred into the returned Effect/Stream (via `Effect.suspend`
+ * / `Effect.sync`), so a validation failure surfaces as a DEFECT WHEN THE EFFECT
+ * RUNS — never as a synchronous throw at the call site. This gives the contract
+ * suite a single trusted choke point and makes a further backend impossible to get
+ * subtly wrong: it supplies mechanics, the policy is inherited whole. That is how
+ * the third engine, `@kairos-es/store-sqlite`, acquired the policy — it writes not
+ * a line of it.
+ */
+import type { Array as Arr, Scope } from 'effect';
+import { Effect, Stream } from 'effect';
+import { AppendCondition } from './AppendCondition.js';
+import type { DcbEventStore, ReadOptions, ReadResponse } from './DcbEventStore.js';
+import type { DcbEvent, Position, SequencedEvent } from './Event.js';
+import type { AppendConditionFailed } from './errors.js';
+import { type Query } from './Query.js';
+/**
+ * The MECHANICS half of a store: the same three verbs as the `DcbEventStore`
+ * contract, but free to surface infrastructure faults (`E`) on the error
+ * channel. `E` is `never` for a pure engine (in-memory) and e.g. `SqlError` for
+ * a database engine. `append` may additionally fail with the contract's
+ * `AppendConditionFailed`. `makeContractStore` turns this into the contract.
+ */
+export interface RawDcbEventStore<E> {
+    readonly read: (query: Query, options?: ReadOptions) => Effect.Effect<ReadResponse, E>;
+    readonly append: (events: Arr.NonEmptyReadonlyArray<DcbEvent>, condition?: AppendCondition) => Effect.Effect<Position, AppendConditionFailed | E>;
+    readonly subscribe: (query: Query, after?: Position) => Stream.Stream<SequencedEvent, E, Scope.Scope>;
+}
+/**
+ * Wrap a raw engine's mechanics with the shared contract-enforcement policy,
+ * producing a full `DcbEventStore` service value.
+ */
+export declare const makeContractStore: <E>(raw: RawDcbEventStore<E>) => DcbEventStore["Service"];
+//# sourceMappingURL=ContractStore.d.ts.map

package/dist/dts-esm/ContractStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ContractStore.d.ts","sourceRoot":"","sources":["../../src/ContractStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,OAAO,KAAK,EAAE,KAAK,IAAI,GAAG,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAA;AACjD,OAAO,EAAE,MAAM,EAAqB,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC/E,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAEjE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAA;AACrD,OAAO,EAAuB,KAAK,KAAK,EAAE,MAAM,SAAS,CAAA;AAKzD;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB,CAAC,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,CACb,KAAK,EAAE,KAAK,EACZ,OAAO,CAAC,EAAE,WAAW,KAClB,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAA;IACnC,QAAQ,CAAC,MAAM,EAAE,CACf,MAAM,EAAE,GAAG,CAAC,qBAAqB,CAAC,QAAQ,CAAC,EAC3C,SAAS,CAAC,EAAE,eAAe,KACxB,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,qBAAqB,GAAG,CAAC,CAAC,CAAA;IACvD,QAAQ,CAAC,SAAS,EAAE,CAClB,KAAK,EAAE,KAAK,EACZ,KAAK,CAAC,EAAE,QAAQ,KACb,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;CACnD;AAED;;;GAGG;AACH,eAAO,MAAM,iBAAiB,GAAI,CAAC,EACjC,KAAK,gBAAgB,CAAC,CAAC,CAAC,KACvB,aAAa,CAAC,SAAS,CAoGxB,CAAA"}

package/dist/dts-esm/DcbEventStore.d.ts

@@ -0,0 +1,64 @@
+/**
+ * The `DcbEventStore` contract: a `Context.Service` with no bundled implementation.
+ * Consumers supply a `Layer` (the in-memory one lives in this package; each SQL
+ * engine is a package of its own — `@kairos-es/store-postgres` and
+ * `@kairos-es/store-sqlite`).
+ *
+ * Head semantics (ported from `popo.py:62-65`):
+ * - `read` with no `limit`  => `head` = the global last position (ignoring the
+ *   query filter) if the store is non-empty, else `ORIGIN` (0n).
+ * - `read` with a `limit`   => `head` = the last *returned* event's position
+ *   (post-filter, post-limit), or `ORIGIN` if none returned.
+ *
+ * `append` returns the last new position (read-your-writes). `subscribe` is
+ * catch-up then live and requires a `Scope` so the live subscription is cleaned
+ * up on scope close.
+ */
+import type { Array as Arr, Effect, Scope, Stream } from 'effect';
+import { Context } from 'effect';
+import type { AppendCondition } from './AppendCondition.js';
+import type { DcbEvent, Position, ReadLimit, SequencedEvent } from './Event.js';
+import type { AppendConditionFailed } from './errors.js';
+import type { Query } from './Query.js';
+/** Options for a read: a lower position bound and/or a maximum count. */
+export interface ReadOptions {
+    /** Only events strictly after this position (exclusive). Absent = from the start. */
+    readonly after?: Position;
+    /**
+     * Cap the number of events returned (a branded non-negative integer). `0`
+     * returns none; absent = all matching events. A negative/non-integer value is
+     * a defect at the store boundary — see `ReadLimit`.
+     */
+    readonly limit?: ReadLimit;
+}
+/**
+ * The result of a read: a stream of matching events (ascending by position)
+ * plus the consistency `head`.
+ */
+export interface ReadResponse {
+    readonly events: Stream.Stream<SequencedEvent>;
+    readonly head: Position;
+}
+declare const DcbEventStore_base: Context.ServiceClass<DcbEventStore, "@kairos-es/core/DcbEventStore", {
+    /**
+     * Read events matching `query` (empty query = all), optionally bounded by
+     * `after`/`limit`. See head semantics in the module docs.
+     */
+    readonly read: (query: Query, options?: ReadOptions) => Effect.Effect<ReadResponse>;
+    /**
+     * Append one or more events atomically. If `condition` is given, the append
+     * fails with `AppendConditionFailed` when its query matches any event after
+     * `condition.after`. Returns the last new position.
+     */
+    readonly append: (events: Arr.NonEmptyReadonlyArray<DcbEvent>, condition?: AppendCondition) => Effect.Effect<Position, AppendConditionFailed>;
+    /**
+     * Subscribe to matching events: first the backlog after `after` (catch-up),
+     * then live events as they are appended. Scoped: the live subscription is
+     * released when the scope closes.
+     */
+    readonly subscribe: (query: Query, after?: Position) => Stream.Stream<SequencedEvent, never, Scope.Scope>;
+}>;
+export declare class DcbEventStore extends DcbEventStore_base {
+}
+export {};
+//# sourceMappingURL=DcbEventStore.d.ts.map

package/dist/dts-esm/DcbEventStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"DcbEventStore.d.ts","sourceRoot":"","sources":["../../src/DcbEventStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,KAAK,IAAI,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AACjE,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAA;AAChC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAC5E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAA;AACrD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAEpC,yEAAyE;AACzE,MAAM,WAAW,WAAW;IAC1B,qFAAqF;IACrF,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAA;IACzB;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAA;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAA;IAC9C,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CACxB;;IAKG;;;OAGG;mBACY,CACb,KAAK,EAAE,KAAK,EACZ,OAAO,CAAC,EAAE,WAAW,KAClB,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC;IAEhC;;;;OAIG;qBACc,CACf,MAAM,EAAE,GAAG,CAAC,qBAAqB,CAAC,QAAQ,CAAC,EAC3C,SAAS,CAAC,EAAE,eAAe,KACxB,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IAEnD;;;;OAIG;wBACiB,CAClB,KAAK,EAAE,KAAK,EACZ,KAAK,CAAC,EAAE,QAAQ,KACb,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC;;AA9B1D,qBAAa,aAAc,SAAQ,kBAgCC;CAAG"}

package/dist/dts-esm/Event.d.ts

@@ -0,0 +1,174 @@
+/**
+ * Core domain types for the DCB event log: branded scalars and the wire
+ * `DcbEvent`/`SequencedEvent` shapes.
+ *
+ * `data` is opaque bytes at the store layer; the codec (`@kairos-es/codec`) turns typed
+ * payloads into these bytes. Ordering is by `position` alone; `occurredAt` is
+ * producer-supplied domain time and is informational only.
+ */
+import { Schema } from 'effect';
+/**
+ * A position in the single global event log: a branded, non-negative `bigint`.
+ *
+ * The log is 64-bit (`bigserial` in Postgres) and exceeds JS `number` safety at
+ * 2^53, so positions are a `bigint`. They are compared, never arithmetic'd.
+ * Encoded, a position is a decimal string (JSON-safe, `String(b)`); decoded, a
+ * `bigint`. `0n` is the "before the first event" sentinel used by `after` and by
+ * an empty store's head.
+ *
+ * The string-to-`bigint` step is hand-built rather than Effect 4's
+ * `Schema.BigIntFromString`, because that schema accepts only `^-?\d+$` and so
+ * refuses inputs the encoded side has always admitted — `" 5"`, `"+5"`,
+ * `"0x10"`. The decode here is the global `BigInt(s)` behind a blank-string
+ * refusal, which is `BigInt.fromString` and is exactly what Effect 3's
+ * `Schema.BigInt` ran, so a position string any earlier release decoded still
+ * decodes to the same value. The non-negative check then runs on the `bigint`,
+ * as it always did.
+ */
+export declare const Position: Schema.brand<Schema.decodeTo<Schema.BigInt, Schema.String, never, never>, "Position">;
+export type Position = typeof Position.Type;
+/** The sentinel position meaning "before the first event". */
+export declare const ORIGIN: Position;
+/**
+ * A business identifier attached to an event, following the `key:value`
+ * convention (e.g. `student:s1`). Tags replace the per-stream id of classic
+ * event sourcing; a query matches an event when the event carries all of an
+ * item's tags (superset test).
+ */
+export declare const Tag: Schema.brand<Schema.String, "Tag">;
+export type Tag = typeof Tag.Type;
+/**
+ * A reusable tag identity: a `key` plus a `.make(value)` that composes the
+ * branded `Tag` `` `${key}:${value}` `` through core's `Tag` schema. Define an
+ * identity once (`const CourseId = tagIdentity('course')`) and reuse
+ * `CourseId.make(id)` everywhere that entity is tagged. The `key` is exposed for
+ * key-aware tooling (e.g. a tag-vocabulary index, a future retag pass).
+ *
+ * The same constructor authors an event's tags (in a codec `tagsFor` mapper,
+ * ADR-0006) and a query's tags, so the `key:value` string a mapper writes and
+ * the string a query matches are produced by one function and cannot drift. It
+ * lives here beside `Tag` — pure (no clock, no RNG, no effect) — so it is
+ * reachable from every tag-authoring site, including core's own query
+ * constructors.
+ *
+ * `key` and `value` are each a single colon-free atom: the `key:value` grammar
+ * splits on the first colon, so both are validated to be non-empty and contain
+ * no `:` — `key` once at construction, `value` on each `make`. This keeps
+ * composition unambiguous and catches the double-prefix footgun loudly:
+ * `CourseId.make('course:123')` throws rather than silently yielding
+ * `course:course:123`. Raw `Tag.make` remains the escape hatch for a value that
+ * must itself contain a colon.
+ */
+export interface TagIdentity {
+    readonly key: string;
+    readonly make: (value: string) => Tag;
+}
+export declare const tagIdentity: (key: string) => TagIdentity;
+/**
+ * A read cap: a branded non-negative integer bounding how many events a `read`
+ * returns. `0` returns none; an absent limit returns all matching events.
+ *
+ * The bound lives in the type, not merely in prose: a negative or non-integer
+ * limit is a programming error, so it is a DEFECT at the store boundary — the
+ * store validates through this schema and dies rather than surfacing it on the
+ * error channel (`read` keeps `E = never`). Constructed at call sites with
+ * `ReadLimit.make(n)`.
+ */
+export declare const ReadLimit: Schema.brand<Schema.Int, "ReadLimit">;
+export type ReadLimit = typeof ReadLimit.Type;
+/**
+ * An event type name, a branded non-empty string. Versioning is by convention
+ * in the name (e.g. `course-registered.v2`); only non-emptiness is enforced.
+ */
+export declare const EventType: Schema.brand<Schema.String, "EventType">;
+export type EventType = typeof EventType.Type;
+/**
+ * An event's metadata: a flat bag of strings carrying the circumstances under
+ * which the event was RECORDED, never anything the business asserts (ADR-0017).
+ * Payload is what happened; metadata is the context of the recording — a
+ * `traceparent`, a correlation or causation id, a deployment revision.
+ *
+ * Values are strings, not `unknown`, for cross-engine parity rather than taste:
+ * both SQL engines carry the bag as a JSON document, and `JSON.stringify` drops
+ * `undefined`, throws on `bigint` and turns `NaN` into `null`, none of which the
+ * in-memory oracle does.
+ *
+ * The key schema carries no refinement, deliberately: a refinement on a
+ * `Schema.Record` key acts as a FILTER on decode, silently dropping a key that
+ * fails it rather than failing the decode. Constraining keys, if ever wanted,
+ * has to be a validating step of its own.
+ *
+ * Two engine limits a consumer must know, because the bag is typically filled
+ * from outside the application at a request edge. Postgres refuses a NUL
+ * character (U+0000) and an unpaired surrogate in any string it stores, so an
+ * event whose bag holds one fails to append there while the in-memory and
+ * SQLite engines accept it; sanitise untrusted values before they reach the
+ * bag. And key ORDER is not preserved: Postgres stores an object's keys in an
+ * order of its own, so compare bags as unordered and never rely on the order
+ * `Object.keys` returns.
+ *
+ * Metadata is never part of a `Query` or an `AppendCondition` — a store refuses
+ * either when it carries a key the grammar does not define, so a metadata
+ * predicate cannot be written and silently ignored — never reaches a codec's
+ * `tagsFor`, and no store offers a way to rewrite it once appended. ADR-0017
+ * owns why each of those is mechanical rather than preferential.
+ *
+ * ## The one home of the shape rule
+ *
+ * The bag is a JSON OBJECT whose every value is a STRING, and this schema is
+ * where that rule is stated. At runtime it is checked in ONE place, at write: the
+ * codec's `toEvent` decodes every bag through this schema and refuses one that
+ * fails on its own error channel, so a value smuggled past the type (through an
+ * `any`) stops there. The schema judges a bag's OWN enumerable keys, so an object
+ * that keeps its entries anywhere else — a `Map`, a `Date` — reads as the empty
+ * bag rather than failing. A store checks no values: an event built by hand and handed
+ * to `append` directly carries whatever it carries, and what each engine then does
+ * with a non-string value differs — one may store it and read it back differently
+ * from another, and a `bigint` makes a SQL engine's append fail. Each
+ * SQL engine keeps a container check of its own on read — the column must hold a
+ * JSON object — because that defends against a writer outside the library and is
+ * about the column, not the values. A VALUE check must never be added on read
+ * alone: it would make an event the store accepted unreadable for ever, so a
+ * value check belongs at write or nowhere.
+ */
+export declare const Metadata: Schema.$Record<Schema.String, Schema.String>;
+export type Metadata = typeof Metadata.Type;
+/**
+ * An event as stored: an opaque payload plus its type, tags, a
+ * producer-supplied `uuid`, producer-supplied `occurredAt` domain time, and its
+ * `metadata` bag.
+ *
+ * `data` is `Uint8Array` (opaque bytes); the store does not interpret it.
+ * `uuid` is producer-supplied to keep `core` deterministic (no RNG in core).
+ * It is checked for UUID SHAPE only (`isGUID`), not for a version nibble: a
+ * stricter check would refuse ids an existing log already holds.
+ * `occurredAt` is informational only; ordering is by position alone.
+ * `metadata` mirrors `tags` rather than `data`: REQUIRED, with an empty bag
+ * legal. Required because an absent-versus-empty divergence between engines is
+ * invisible to `toEqual`, which ignores `undefined` properties, so an optional
+ * field could drift across the three engines with the round-trip suite green.
+ * Core only carries it; the codec's `toEvent` is where it is resolved.
+ */
+export declare const DcbEvent: Schema.Struct<{
+    readonly type: Schema.brand<Schema.String, "EventType">;
+    readonly data: Schema.Uint8Array;
+    readonly tags: Schema.$Array<Schema.brand<Schema.String, "Tag">>;
+    readonly uuid: Schema.String;
+    readonly occurredAt: Schema.DateTimeUtcFromString;
+    readonly metadata: Schema.$Record<Schema.String, Schema.String>;
+}>;
+export type DcbEvent = typeof DcbEvent.Type;
+/** A persisted event: the event together with the position it was written at. */
+export declare const SequencedEvent: Schema.Struct<{
+    readonly event: Schema.Struct<{
+        readonly type: Schema.brand<Schema.String, "EventType">;
+        readonly data: Schema.Uint8Array;
+        readonly tags: Schema.$Array<Schema.brand<Schema.String, "Tag">>;
+        readonly uuid: Schema.String;
+        readonly occurredAt: Schema.DateTimeUtcFromString;
+        readonly metadata: Schema.$Record<Schema.String, Schema.String>;
+    }>;
+    readonly position: Schema.brand<Schema.decodeTo<Schema.BigInt, Schema.String, never, never>, "Position">;
+}>;
+export type SequencedEvent = typeof SequencedEvent.Type;
+//# sourceMappingURL=Event.d.ts.map

package/dist/dts-esm/Event.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Event.d.ts","sourceRoot":"","sources":["../../src/Event.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAIL,MAAM,EAGP,MAAM,QAAQ,CAAA;AAEf;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,QAAQ,uFAuBpB,CAAA;AACD,MAAM,MAAM,QAAQ,GAAG,OAAO,QAAQ,CAAC,IAAI,CAAA;AAE3C,8DAA8D;AAC9D,eAAO,MAAM,MAAM,EAAE,QAA4B,CAAA;AAEjD;;;;;GAKG;AACH,eAAO,MAAM,GAAG,oCAGf,CAAA;AACD,MAAM,MAAM,GAAG,GAAG,OAAO,GAAG,CAAC,IAAI,CAAA;AAEjC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,GAAG,CAAA;CACtC;AAED,eAAO,MAAM,WAAW,GAAI,KAAK,MAAM,KAAG,WAiBzC,CAAA;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,SAAS,uCAGrB,CAAA;AACD,MAAM,MAAM,SAAS,GAAG,OAAO,SAAS,CAAC,IAAI,CAAA;AAE7C;;;GAGG;AACH,eAAO,MAAM,SAAS,0CAGrB,CAAA;AACD,MAAM,MAAM,SAAS,GAAG,OAAO,SAAS,CAAC,IAAI,CAAA;AAE7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AACH,eAAO,MAAM,QAAQ,8CAA8C,CAAA;AACnE,MAAM,MAAM,QAAQ,GAAG,OAAO,QAAQ,CAAC,IAAI,CAAA;AAE3C;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,QAAQ;;;;;;;EAOnB,CAAA;AACF,MAAM,MAAM,QAAQ,GAAG,OAAO,QAAQ,CAAC,IAAI,CAAA;AAE3C,iFAAiF;AACjF,eAAO,MAAM,cAAc;;;;;;;;;;EAGzB,CAAA;AACF,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC,IAAI,CAAA"}

package/dist/dts-esm/Projection.d.ts

@@ -0,0 +1,124 @@
+/**
+ * Pure projections and the composition primitive they fold through.
+ *
+ * A `Projection<S>` = `{ initialState, query, evolve }`: a query selecting the
+ * events it cares about and a pure `evolve` folding an already-*decoded* event
+ * into state. Decoding (wire bytes -> typed payload via `Schema`) is not core's
+ * job — it needs `Schema` and a `Serializer`, which core must not depend on —
+ * so `evolve` folds a `DecodedEvent` (the sequenced envelope plus an opaque
+ * `payload`). `composeProjections` merges several projections into one whose
+ * state is a named record.
+ *
+ * There is no builder and no decision-model orchestration here: both are the
+ * decode-aware `@kairos-es/codec` package's job (its `projection(...)` builder
+ * produces schema-backed projections, and its `modelAtHead` performs the effectful
+ * decode then folds through `composeProjections`, which `buildDecisionModel` builds
+ * on). Core keeps only the pure fold primitives.
+ *
+ * `Projection<S>` is *invariant* in `S`, so a heterogeneous record of
+ * projections (different state per key) cannot be bounded by
+ * `Projection<unknown>`. `AnyProjection` is the single authoritative,
+ * state-erased bound that owns that unsoundness in one place (built only via
+ * `AnyProjection.of`), so no downstream package writes `Projection<any>`; the
+ * precise per-key state is recovered by `StateOf` / `CompositeState`.
+ *
+ * The fold itself is pure and Effect-free.
+ */
+import type { SequencedEvent } from './Event.js';
+import type { Query } from './Query.js';
+/**
+ * An already-decoded event handed to a projection's fold: the sequenced wire
+ * envelope (position, type, tags, timings, metadata) plus the decoded `payload`.
+ *
+ * Core does not decode — it only folds events another layer has already decoded
+ * — so `payload` is `unknown` at this layer. `@kairos-es/codec`'s builder emits
+ * a projection whose `evolve` narrows `payload` per matched event type.
+ */
+export interface DecodedEvent {
+    readonly sequenced: SequencedEvent;
+    readonly payload: unknown;
+}
+/**
+ * A pure projection: the events it reads (`query`), its starting state, and a
+ * fold step.
+ *
+ * `evolve` contract: a projection is only ever invoked with an event that
+ * matches its `query`. `composeProjections` enforces this — it gates every
+ * sub-projection on its own query before dispatching — so an `evolve` may
+ * assume the event matched and need not re-check `matchesSequenced` itself. (It
+ * still dispatches by the event's type, which selects the fold; that is fold
+ * *selection*, not query gating.) `payload` has already been decoded by the
+ * codec layer.
+ */
+export interface Projection<S> {
+    readonly initialState: S;
+    readonly query: Query;
+    readonly evolve: (state: S, event: DecodedEvent) => S;
+}
+/**
+ * A state-erased view of a `Projection<S>`: the single authoritative bound for
+ * a *heterogeneous* record of projections. `Projection<S>` is invariant in `S`
+ * (S is both a parameter and the result of `evolve`), so `Record<string,
+ * Projection<unknown>>` rejects a record whose keys fold different state types.
+ * Rather than leak `Projection<any>` into every package that holds such a
+ * record, this type hides the invariant `evolve` behind an erased
+ * `(unknown) => unknown` surface and carries `S` only through the covariant
+ * `initialState`, so `Record<string, AnyProjection>` is sound with no `any`
+ * anywhere. Build one only via `AnyProjection.of`; recover the precise per-key
+ * `S` with `StateOf` / `CompositeState`. The `evolve` contract is the same as
+ * `Projection`'s: it is only ever called with an event matching `query`
+ * (`composeProjections` gates first), so an implementation may assume the match.
+ */
+export interface AnyProjection<out S = unknown> {
+    readonly initialState: S;
+    readonly query: Query;
+    readonly evolve: (state: unknown, event: DecodedEvent) => unknown;
+}
+export declare const AnyProjection: {
+    /**
+     * View a typed `Projection<S>` as an opaque `AnyProjection<S>`. This is the
+     * one place the invariant `evolve` is widened to the erased surface, so the
+     * unsoundness of a heterogeneous projection record is discharged here and
+     * nowhere else. `composeProjections` calls `evolve` with each projection's
+     * own state, so the widening is sound at runtime.
+     */
+    readonly of: <S>(projection: Projection<S>) => AnyProjection<S>;
+};
+/** Recover the state type a projection folds to. */
+export type StateOf<P> = P extends AnyProjection<infer S> ? S : never;
+/**
+ * The record of named sub-states a composed projection (or decision model)
+ * folds to: each key's precise state type, recovered from its `AnyProjection`.
+ */
+export type CompositeState<T extends Record<string, AnyProjection>> = {
+    readonly [K in keyof T]: StateOf<T[K]>;
+};
+/**
+ * OR-merge a list of queries into one. The empty list is the wildcard.
+ *
+ * The same merge `composeProjections` folds its record through, reachable
+ * WITHOUT a record — which is what a caller accumulating queries rather than
+ * projections needs, and the codec's read ledger is one. Without it that caller
+ * either hand-rolls the merge, or fabricates a projection per query to reach this
+ * one; both were tried and the first is a TRAP. An empty `items` is the WILDCARD
+ * and is absorbing under OR, while spreading an empty list contributes nothing, so
+ * a hand-rolled union silently narrows a match-everything query to its siblings —
+ * in the unsafe direction, and with nothing to notice.
+ *
+ * Seeding the fold with the wildcard would swallow everything for the same reason,
+ * so the list is reduced with no seed and the empty case answers directly.
+ */
+export declare const unionQueries: (queries: ReadonlyArray<Query>) => Query;
+/**
+ * Compose named projections into one whose state is a record of sub-states and
+ * whose query is the OR-merge of all sub-queries. Each sub-projection only
+ * folds events matching its own query — the guarantee that `Projection.evolve`'s
+ * contract lets sub-projections rely on (so they need not re-gate themselves).
+ *
+ * The fold always writes each *matching* sub-result into a fresh record and
+ * returns it (no `changed` short-circuit, no `evolved !== prev` reference
+ * check): an in-place-mutating fold that returns the same reference would
+ * otherwise be silently dropped. At decision-model scale the extra copy is nil.
+ */
+export declare const composeProjections: <T extends Record<string, AnyProjection>>(projections: T) => Projection<CompositeState<T>>;
+//# sourceMappingURL=Projection.d.ts.map

package/dist/dts-esm/Projection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Projection.d.ts","sourceRoot":"","sources":["../../src/Projection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAC7C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAWpC;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,EAAE,cAAc,CAAA;IAClC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAC1B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,UAAU,CAAC,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAA;IACxB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY,KAAK,CAAC,CAAA;CACtD;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,aAAa,CAAC,GAAG,CAAC,CAAC,GAAG,OAAO;IAC5C,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAA;IACxB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,KAAK,OAAO,CAAA;CAClE;AAED,eAAO,MAAM,aAAa;IACxB;;;;;;OAMG;kBACE,CAAC,cAAc,UAAU,CAAC,CAAC,CAAC,KAAG,aAAa,CAAC,CAAC,CAAC;CAE5C,CAAA;AAEV,oDAAoD;AACpD,MAAM,MAAM,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,aAAa,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;AAErE;;;GAGG;AACH,MAAM,MAAM,cAAc,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,IAAI;IACpE,QAAQ,EAAE,CAAC,IAAI,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CACvC,CAAA;AAqBD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,YAAY,GAAI,SAAS,aAAa,CAAC,KAAK,CAAC,KAAG,KAGT,CAAA;AAEpD;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,GAAI,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,EACxE,aAAa,CAAC,KACb,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CA0B9B,CAAA"}