@kairos-es/core 1.0.0-alpha.4 → 1.0.0-alpha.6

package/dist/dts-esm/Query.d.ts

@@ -0,0 +1,180 @@
+/**
+ * The DCB selection language: `Query` is an OR of `QueryItem`s. Within an item,
+ * `types` is an OR-filter (empty means any type) and `tags` is an AND superset
+ * test (the event must carry all of the item's tags; extra event tags are
+ * fine). The empty query (`items: []`) matches every event.
+ *
+ * The match predicate is a single pure module function over plain data;
+ * `Query` values carry no methods. See `matchesQuery` / `matchesQueryItem`.
+ *
+ * Smart constructors enforce the indexed fast-path restriction at the
+ * constructor surface (not via a runtime throw): every query built through them
+ * is the wildcard (`query.all`), a single type-only item (`query.types`), or an
+ * OR of tagged items each carrying at least one tag (`query.item` + `query.or`,
+ * or `query.tags` for the single-item case). The `query.item` constructor
+ * requires a non-empty `tags` at the type level, so there is no public way to
+ * build an unrestricted item (empty types and empty tags). `QueryItem`/`Query`
+ * are plain data, so internal decision-model plumbing can still assemble any
+ * shape directly; the restriction binds the public surface, where consumers
+ * build their consistency boundaries.
+ *
+ * The grammar's DISPATCH lives here too, beside the grammar it dispatches over:
+ * `ServableQueryShape` / `classifyServableQuery` own the three shapes an engine
+ * serves and the routing of the degenerate empty item.
+ */
+import { Array as Arr, Schema } from 'effect';
+import { type DcbEvent, EventType, type SequencedEvent, Tag } from './Event.js';
+/**
+ * One clause of a query: a set of types (OR, empty = any) AND a set of tags
+ * (superset test, empty = no tag constraint).
+ */
+export declare const QueryItem: Schema.Struct<{
+    readonly types: Schema.$Array<Schema.brand<Schema.String, "EventType">>;
+    readonly tags: Schema.$Array<Schema.brand<Schema.String, "Tag">>;
+}>;
+export type QueryItem = typeof QueryItem.Type;
+/** A query: an OR of items. Empty `items` matches everything. */
+export declare const Query: Schema.Struct<{
+    readonly items: Schema.$Array<Schema.Struct<{
+        readonly types: Schema.$Array<Schema.brand<Schema.String, "EventType">>;
+        readonly tags: Schema.$Array<Schema.brand<Schema.String, "Tag">>;
+    }>>;
+}>;
+export type Query = typeof Query.Type;
+/**
+ * True when `event` satisfies `item`: its type is in `item.types` (or the item
+ * has no type constraint) AND the event's tags are a superset of `item.tags`.
+ */
+export declare const matchesQueryItem: (event: DcbEvent, item: QueryItem) => boolean;
+/**
+ * The one true match predicate (ported from `popo.py:48-54`): an empty query is
+ * a wildcard; otherwise the event must match at least one item (OR across
+ * items).
+ */
+export declare const matchesQuery: (event: DcbEvent, query: Query) => boolean;
+/** Convenience predicate over a `SequencedEvent`. */
+export declare const matchesSequenced: (sequenced: SequencedEvent, query: Query) => boolean;
+/**
+ * Assert `query` is *servable* by the indexed fast paths, throwing a plain
+ * `Error` describing the violation otherwise. This enforces at the store
+ * boundary the restriction the smart constructors enforce at the type level
+ * (`Query.ts` module docs) but which plain-data assembly — e.g. decision-model
+ * composition, `Projection.ts:31-36` — can still bypass.
+ *
+ * A query, or any of its items, carrying a key the grammar does not define is
+ * refused before anything else is judged (`unknownKeyFault` below says why).
+ *
+ * The servable grammar is exactly one of:
+ * - the wildcard (`items.length === 0`), which matches every event;
+ * - a *single* item (`items.length === 1`), any types/tags, including a
+ *   type-only item; or
+ * - a *multi*-item query (`items.length > 1`) in which every item carries at
+ *   least one tag.
+ *
+ * A multi-item query that mixes a tagless (type-only) item with tagged items is
+ * NOT servable: the by-type path and the by-tag path are indexed differently,
+ * so an OR spanning both cannot ride a single index. This is the previously
+ * un-enforced edge (`Projection.ts:31-36`).
+ *
+ * This function is pure (no clock, no RNG, no effect). Every engine applies it at
+ * its read/subscribe/append entry points, through the one shared
+ * `makeContractStore` decorator, so the rule is inherited rather than restated per
+ * backend; a throw inside a store `Effect` becomes a *defect* — a programming
+ * error, not an error-channel value — which is the intended "defect in every
+ * engine" behaviour.
+ */
+export declare const assertServableQuery: (query: Query) => void;
+/**
+ * The unknown-key half of `servableQueryFault`, on its own: the refusal of a key the
+ * grammar does not define on the envelope or on any item, or `undefined`.
+ *
+ * It is the same rule and not a second statement of it — `servableQueryFault` calls
+ * this first. It is exported because ONE caller has to tell the two halves apart:
+ * the codec's read ledger refuses an unservable SHAPE on its own error channel, and
+ * must not report an unknown key as one. An unknown key is not something a slice's
+ * tags can fix, so the ledger leaves it to the store, which refuses it as a defect.
+ */
+export declare const unknownQueryKeyFault: (query: Query) => string | undefined;
+/**
+ * The servable grammar as a TOTAL function: the reason `query` cannot be served,
+ * or `undefined` when it can.
+ *
+ * The same rule as `assertServableQuery` above and NOT a second statement of it —
+ * that function is this one plus a throw, so the grammar is defined once and the
+ * two differ only in DISPOSITION. A store boundary wants the defect, because a
+ * non-servable query there is a programming error with no recovery; a caller that
+ * can still act on the answer wants a value, and the codec's read ledger is one:
+ * it asks whether a hop it is about to record would make the accumulated union
+ * unservable, and refuses on the error channel BEFORE the read is paid for.
+ *
+ * The alternative was for that caller to re-derive the rule, and it was tried:
+ * the codec's own copy tested each recorded query separately, which silently
+ * admitted a FIRST hop composed of two tagless slices — a multi-item query, and
+ * unservable, dying at the store one layer away. A grammar with two homes drifts
+ * at exactly the shapes neither author had in mind. The shape here is the read
+ * side's own (`projectionWiringFault` returns `string | undefined` for the same
+ * reason), so a fault is one exit route and one return type.
+ */
+export declare const servableQueryFault: (query: Query) => string | undefined;
+/**
+ * The three shapes a servable query is SERVED by, and therefore the only three an
+ * engine's plan compiler dispatches over: the wildcard, a single type-only item,
+ * and an all-tagged query. `assertServableQuery` has already refused the mixed
+ * tagless-plus-tagged multi-item query, so these three are exhaustive over
+ * everything that reaches a store.
+ *
+ * `typeOnly` carries a NON-EMPTY list of types, and that is the whole guard
+ * against the degenerate empty item: see `classifyServableQuery`.
+ */
+export type ServableQueryShape = {
+    readonly kind: 'wildcard';
+} | {
+    readonly kind: 'typeOnly';
+    readonly types: Arr.NonEmptyReadonlyArray<EventType>;
+} | {
+    readonly kind: 'tagged';
+};
+/**
+ * Classify a servable `Query` into the shape that serves it.
+ *
+ * ## Why the dispatch lives beside the grammar
+ *
+ * The three shapes ARE the three bullets `assertServableQuery` above admits, so an
+ * engine that re-derives the dispatch is a second answer to "which shape is
+ * this?", and the shapes only stay in step while there is one answer. Core states
+ * the grammar, so stating the dispatch over it here is that one fact once rather
+ * than once per backend. It is pure — no clock, no RNG, no effect — and knows
+ * nothing of SQL: what a shape COMPILES to stays entirely the engine's.
+ *
+ * ## The degenerate empty item routes to the WILDCARD, structurally
+ *
+ * A single item with neither types nor tags — `{ items: [{ types: [], tags: [] }] }`
+ * — matches EVERY event: `matchesQueryItem` reads empty types as "any type" and
+ * empty tags as a vacuous superset test. It must therefore be served by the
+ * wildcard. Served by the type-only path it would compile to a value list with
+ * nothing in it, and a membership test against an empty list matches NOTHING — the
+ * exact inversion of what the query means. Nothing upstream stops it reaching an
+ * engine: `assertServableQuery` admits a SINGLE item of any shape, and the servable
+ * grammar forbids a tagless item only in a MULTI-item query, so this dispatch is
+ * the last place the divergence can be closed.
+ *
+ * It is closed by the SHAPE and not by a branch in front of it. `typeOnly` carries
+ * `NonEmptyReadonlyArray`, so there is no way to construct it from an empty list;
+ * the emptiness test IS the constructor, and deleting it does not silently restore
+ * the wrong routing, it stops compiling. A guard clause placed before the
+ * construction would have been deletable by anyone tidying what looks like a
+ * redundant check on a list that "obviously" has types in it.
+ */
+export declare const classifyServableQuery: (query: Query) => ServableQueryShape;
+/** Namespaced smart constructors for `Query`. */
+export declare const query: {
+    readonly all: () => Query;
+    readonly item: (fields: {
+        readonly tags: readonly [Tag, ...ReadonlyArray<Tag>];
+        readonly types?: ReadonlyArray<EventType>;
+    }) => QueryItem;
+    readonly or: (items: readonly [QueryItem, ...ReadonlyArray<QueryItem>]) => Query;
+    readonly tags: (tags: readonly [Tag, ...ReadonlyArray<Tag>], types?: ReadonlyArray<EventType>) => Query;
+    readonly types: (types: readonly [EventType, ...ReadonlyArray<EventType>]) => Query;
+};
+//# sourceMappingURL=Query.d.ts.map

package/dist/dts-esm/Query.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Query.d.ts","sourceRoot":"","sources":["../../src/Query.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,KAAK,IAAI,GAAG,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,KAAK,QAAQ,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,GAAG,EAAE,MAAM,SAAS,CAAA;AAE5E;;;GAGG;AACH,eAAO,MAAM,SAAS;;;EAGpB,CAAA;AACF,MAAM,MAAM,SAAS,GAAG,OAAO,SAAS,CAAC,IAAI,CAAA;AAE7C,iEAAiE;AACjE,eAAO,MAAM,KAAK;;;;;EAEhB,CAAA;AACF,MAAM,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC,IAAI,CAAA;AAErC;;;GAGG;AACH,eAAO,MAAM,gBAAgB,GAAI,OAAO,QAAQ,EAAE,MAAM,SAAS,KAAG,OAOnE,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,YAAY,GAAI,OAAO,QAAQ,EAAE,OAAO,KAAK,KAAG,OAK5D,CAAA;AAED,qDAAqD;AACrD,eAAO,MAAM,gBAAgB,GAC3B,WAAW,cAAc,EACzB,OAAO,KAAK,KACX,OAA+C,CAAA;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,mBAAmB,GAAI,OAAO,KAAK,KAAG,IAKlD,CAAA;AAkDD;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,GAAI,OAAO,KAAK,KAAG,MAAM,GAAG,SAM1D,CAAA;AAEH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,kBAAkB,GAAI,OAAO,KAAK,KAAG,MAAM,GAAG,SAsB1D,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;CAAE,GAC7B;IACE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAA;CACrD,GACD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAA;AAE/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,qBAAqB,GAAI,OAAO,KAAK,KAAG,kBAWpD,CAAA;AAoDD,iDAAiD;AACjD,eAAO,MAAM,KAAK;wBAlCF,KAAK;4BATC;QACpB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAA;QACpD,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,SAAS,CAAC,CAAA;KAC1C,KAAG,SAAS;yBAkCJ,SAAS,CAAC,SAAS,EAAE,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,KACvD,KAAK;0BAtBA,SAAS,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,UACnC,aAAa,CAAC,SAAS,CAAC,KAC/B,KAAK;4BAUC,SAAS,CAAC,SAAS,EAAE,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,KACvD,KAAK;CAoBE,CAAA"}

package/dist/dts-esm/SubscribeMachine.d.ts

@@ -0,0 +1,289 @@
+/**
+ * The subscribe machine every engine's `subscribe` is built from — the in-memory
+ * store, `@kairos-es/store-postgres` and `@kairos-es/store-sqlite`: the wake queue,
+ * the wake-source drain, the paged catch-up reconcile, the `> boundary` de-dup (via
+ * the cursor's exclusive lower bound) and the poll loop that together turn a paged
+ * read into a live subscription.
+ *
+ * The algorithm is `subscribeItems`, generic over the item `A` it delivers and the
+ * cursor `C` it resumes from, because nothing in it is about an event: any source
+ * that can page-read strictly after a cursor and name the cursor of what it
+ * returned is subscribable by the same loop. `subscribeStream` is the event-store
+ * shape — `SequencedEvent` ordered by `Position` — over the same loop, and it is
+ * what every engine calls, unchanged by the generalisation. A second kind of
+ * source reuses the loop rather than growing a second one, for the reason the next
+ * paragraph gives.
+ *
+ * It lives in core because delivery semantics are contract semantics. An engine
+ * supplies TRANSPORT through two STUBBABLE seams — `fetch`, a paged read strictly
+ * after a cursor, and `listen`, an optional wake source — and inherits the delivery
+ * behaviour whole, exactly as it supplies mechanics to `makeContractStore` and
+ * inherits the contract policy whole. Two engines that each grew their own wake
+ * loop would be identical only by inspection, and `subscribe` is the verb where
+ * that is least affordable: a divergence there loses events rather than failing.
+ * Both seams take plain in-memory values in a test, so the wake/poll/de-dup logic
+ * is exercisable with no live backend at all.
+ *
+ * All THREE engines are callers, and the count matters to a reader here: it means
+ * there is exactly ONE delivery algorithm in this repo, and it is the code below. The
+ * in-memory store is a caller like the rest — it hands in a `fetch` over its log
+ * `Ref` and its append `PubSub` as a wake source and keeps no delivery logic of its
+ * own — which is what makes the shared contract suite's subscribe cases a comparison
+ * of two BACKENDS rather than of two delivery algorithms.
+ *
+ * Correctness rests on the periodic cursor-based reconcile — a re-read from the
+ * cursor every poll interval — and NEVER on the wake source, which only lowers
+ * delivery latency below that interval. A subscription with no wake source at all
+ * is therefore complete and correct, merely slower, which is why `listen` is
+ * optional in the TYPE rather than by the convention of passing `Stream.never`:
+ * poll-only delivery is a supported shape, not a degraded one.
+ *
+ * ## The precondition every caller inherits: ASCENDING COMMIT ORDER
+ *
+ * It binds EVERY caller, over whatever cursor it chose — an engine's `Position`, or
+ * any other `C` handed to `subscribeItems` — and the example below is written in
+ * positions only because the engines are the callers it was first written for. A
+ * cursor that is committed and VISIBLE must never be below one already delivered.
+ * Gaps are fine: the cursor is an ascending exclusive lower bound, so a number
+ * that is allocated and never committed, or never allocated at all, is simply a
+ * number the machine never sees. Out-of-order commits are not fine. If one
+ * writer allocates position 5 and another allocates 6, and 6 commits first, a poll
+ * landing between the two commits delivers 6 and advances the cursor past it — and
+ * 5 is then lost forever, because no later read looks below the cursor and nothing
+ * anywhere notices the hole. A caller whose concurrent writers can commit out of
+ * order MUST serialise them, or this machine will silently skip. An engine that
+ * takes an exclusive lock on both of its append paths discharges the obligation
+ * that way; an engine whose append is a single statement discharges it
+ * structurally.
+ *
+ * The obligation is written down HERE, in the algorithm that depends on it, rather
+ * than in whichever caller happens to satisfy it. It is a property of this delivery
+ * loop and of nothing else, so an author reading only their own source has
+ * no way to discover that anything downstream needs it — and the failure mode is
+ * the worst kind there is: no error, no defect, no failing test, just an event that
+ * a subscriber never receives. A single engine owning both its append path and its
+ * own wake loop can leave the assumption implicit; a shared machine cannot.
+ *
+ * ## `catchUpPageSize` bounds the READ, not the emission — unless `emit: 'page'`
+ *
+ * Under the default `emit: 'backlog'`, which is what `subscribeStream` and so every
+ * engine uses, `drainFrom` below PAGES the catch-up read — `catchUpPageSize` bounds
+ * each `fetch` — but it COLLECTS every page into one array, which is emitted as a
+ * SINGLE chunk. So peak memory at subscription start is O(backlog) rather than O(page): a
+ * subscriber joining behind a large log materialises the whole backlog before its
+ * consumer sees the first element.
+ *
+ * That is a memory characteristic and nothing more, which is why ONE chunk is
+ * enough here: downstream commit boundaries do not depend on the upstream chunking
+ * at all, because the read side's `Stream.groupedWithin` re-chunks the stream into
+ * bounded micro-batches whatever arrives (ADR-0007), so a projection's transactions
+ * stay small even against a one-chunk catch-up. The cost therefore lands on backlog
+ * memory alone, and it lands hardest on the durable-log-with-in-memory-view mode,
+ * where an ephemeral view re-catches-up the entire log on every boot.
+ *
+ * `emit: 'page'` changes exactly that and nothing else. Each fetched page is
+ * emitted as its own chunk and the cursor advances past it before the next read, so
+ * peak memory is O(page) and the consumer sees the first item after ONE read rather
+ * than after the whole backlog. Delivery is unchanged: the same items in the same
+ * order, the same de-dup, the same wake and poll. What a caller gives up is the
+ * one-chunk catch-up, so it must not read meaning into chunk boundaries under
+ * either mode. It is for a consumer that does NOT re-chunk downstream and whose
+ * catch-up can be the whole of a large source — a full resync of a table, say —
+ * where holding the backlog would be the cost the paging was meant to avoid. The
+ * engines keep `'backlog'` because the read side's re-chunking already bounds what
+ * they commit, and changing their emission would move a behaviour nobody asked to
+ * move.
+ */
+import { Effect, Schema, type Scope, Stream } from 'effect';
+import type { Position, SequencedEvent } from './Event.js';
+import { ReadLimit } from './Event.js';
+/**
+ * A short catch-up page size default for the reconcile loop. Reads page by page
+ * until a short page signals the tail is drained, so a large backlog is streamed in
+ * bounded chunks rather than one unbounded read. Every engine takes its
+ * `catchUpPageSize` from here — each SQL engine as its config's default, the
+ * in-memory store as its options' — so backends cannot drift on tuning.
+ */
+export declare const DEFAULT_CATCH_UP_PAGE_SIZE = 512;
+/**
+ * The default upper bound a subscriber waits for a wake before re-reading from its
+ * cursor ANYWAY (milliseconds). Every engine takes its `pollInterval` from here —
+ * each SQL engine as its config's default, the in-memory store as its options' — so
+ * backends cannot drift on tuning.
+ *
+ * This periodic position-based poll — not the wake source — IS the correctness
+ * guarantee: every committed position is reconciled within this interval whether or
+ * not a wake for it was ever heard. That covers a wake fired before the source was
+ * fully established, a coalesced or dropped wake, and a wake source that died
+ * silently and never said so. A wake source only lowers delivery latency BELOW this
+ * interval; it never carries delivery, so no engine's wake mechanism can make the
+ * right figure here engine-specific. It trades worst-case delivery latency against
+ * idle read volume and nothing else. Upstream `postgres_tt.py` picks the same
+ * one-second fallback poll (`conn.wait(..., interval=1)`).
+ */
+export declare const DEFAULT_POLL_INTERVAL_MILLIS = 1000;
+/**
+ * The two subscribe-tuning config FIELDS, for an engine whose config is a `Schema`
+ * to spread into its own struct.
+ *
+ * These knobs are the machine's, not any engine's: they name what the loop above
+ * does, the figures they fall back to are the two constants declared beside them,
+ * and neither is derivable from a backend's own properties — which is why the
+ * defaults already live here. Shipping the FIELD rather than only the default is
+ * what closes the last gap in that arrangement. An engine that spreads these gets
+ * the key NAME, the VALIDATION and the DEFAULT from one place, so a caller who has
+ * tuned one engine's subscribe reads another's without translating, and the two
+ * cannot drift in what they ACCEPT any more than in what they assume. Two engines
+ * hand-authoring the identical `Schema.optionalKey(…)` twice were identical only
+ * by inspection.
+ *
+ * The bounds differ between the two because the quantities do. `pollInterval` is a
+ * duration, so a fraction of a millisecond is meaningful and only `isGreaterThan(0)`
+ * and `isFinite` matter: at zero or below the loop would spin without ever waiting for a
+ * wake, and at `Infinity` the periodic re-read — the half that carries delivery —
+ * would never come, which silently converts the wake source from an optimisation
+ * into the guarantee. `catchUpPageSize` is a COUNT, so it must be an integer
+ * (`Schema.Int` excludes `Infinity` with it): the reconcile loop compares a page's
+ * length against it to decide the tail is drained, and a page of zero would report
+ * "drained" forever without reading anything.
+ *
+ * `optionalKey` on both keeps the decoded type at `key?: T` rather than
+ * `T | undefined`, matching the repo's `exactOptionalPropertyTypes` discipline — an
+ * absent key, never an explicit `undefined`.
+ */
+export declare const subscriptionTuningFields: {
+    readonly pollInterval: Schema.optionalKey<Schema.Number>;
+    readonly catchUpPageSize: Schema.optionalKey<Schema.Int>;
+};
+/**
+ * How a subscription hands its catch-up to the consumer: the whole backlog as ONE
+ * chunk (`'backlog'`), or each fetched page as a chunk of its own (`'page'`). The
+ * module doc's "`catchUpPageSize` bounds the READ" section owns what each costs.
+ *
+ * A closed union of two words rather than a boolean, so a call site says WHICH
+ * behaviour it chose instead of what it turned off, and a third shape, should one
+ * ever be argued for, is added beside these rather than encoded in a second flag.
+ */
+export type SubscriptionEmission = 'backlog' | 'page';
+/**
+ * The machine's inputs over ANY item `A` with an ascending cursor `C`: the two seams,
+ * where the cursor comes from and starts, and the tuning.
+ *
+ * Generic in the item and the cursor because nothing in the algorithm is about an
+ * EVENT. The wake queue, the poll, the paged reconcile and the exclusive-lower-bound
+ * de-dup need only three things of what they deliver: a page-read strictly after a
+ * cursor, a way to read the cursor OFF a delivered item, and a starting cursor. A
+ * log of `SequencedEvent`s ordered by `Position` is one such source; a feed of rows
+ * ordered by a feed-local sequence is another, and a second copy of this loop for it
+ * would be exactly the divergence the module doc argues against.
+ *
+ * The machine never COMPARES two cursors. `fetch` is the only thing that interprets
+ * one — its exclusive lower bound is what does the de-dup — so `C` needs no ordering
+ * instance here, and the ascending-commit-order obligation in the module doc is the
+ * caller's, stated over whatever `C` it chose.
+ *
+ * `initial` is REQUIRED, unlike `subscribeStream`'s `after`. Only a cursor type the
+ * machine knows can have a default — `ORIGIN` for `Position` — and for any other the
+ * caller is the only party that knows what "before everything" is.
+ *
+ * `pollInterval` and `catchUpPageSize` are optional here and fall back to
+ * `DEFAULT_POLL_INTERVAL_MILLIS` and `DEFAULT_CATCH_UP_PAGE_SIZE`: a caller with no
+ * config of its own takes the same figures every engine does, from the same place.
+ * The event-store shape, `SubscriptionDeps`, keeps them required, because every
+ * engine already resolves them from its config and that type is unchanged.
+ */
+export interface ItemSubscriptionDeps<A, C, E> {
+    /**
+     * Page-read the items strictly after `after`, up to `limit`, ascending by cursor.
+     * Returning FEWER than `limit` signals the tail is drained. The exclusive lower
+     * bound IS the de-dup: a re-read from the cursor never returns what was delivered.
+     */
+    readonly fetch: (after: C, limit: ReadLimit) => Effect.Effect<ReadonlyArray<A>, E>;
+    /** The cursor of a delivered item: the next `fetch` starts strictly after it. */
+    readonly cursorOf: (item: A) => C;
+    /** The cursor to start from, exclusive: the first `fetch` reads strictly after it. */
+    readonly initial: C;
+    /** The raw wake source — see `SubscriptionDeps.listen`, whose rules it shares. */
+    readonly listen?: Stream.Stream<unknown, E>;
+    /**
+     * The poll interval in milliseconds (default `DEFAULT_POLL_INTERVAL_MILLIS`):
+     * finite and greater than 0, or `subscribeItems` dies.
+     */
+    readonly pollInterval?: number;
+    /**
+     * The catch-up page size (default `DEFAULT_CATCH_UP_PAGE_SIZE`): an integer
+     * greater than 0, or `subscribeItems` dies.
+     */
+    readonly catchUpPageSize?: number;
+    /** The catch-up's chunking (default `'backlog'`); see `SubscriptionEmission`. */
+    readonly emit?: SubscriptionEmission;
+}
+/**
+ * The two seams the event-store subscribe machine runs over, plus the two tuning
+ * knobs: `ItemSubscriptionDeps` fixed to `SequencedEvent` and `Position`, the shape
+ * every engine's `subscribe` already hands to `subscribeStream`. `E` is the engine's
+ * own infrastructure error — whatever its reads fail with — and it stays on the
+ * channel through to `makeContractStore`, which dies it.
+ *
+ * ONE type parameter and not two, deliberately: a wake source with an error type of
+ * its own is `Stream.orDie`d by the caller, yielding a `Stream<unknown, never>`
+ * that is assignable here under Effect's covariant error channel. A second
+ * parameter would buy nothing and would have to be spelled at every call site. Nor
+ * is there an `R`: neither seam contributes a requirement, and unused generality is
+ * not free.
+ */
+export interface SubscriptionDeps<E> {
+    /**
+     * Page-read the events strictly after `from`, up to `limit`, ascending by
+     * position. Returning FEWER than `limit` signals the tail is drained.
+     */
+    readonly fetch: (from: Position, limit: ReadLimit) => Effect.Effect<ReadonlyArray<SequencedEvent>, E>;
+    /**
+     * The raw wake source: each element is an OPAQUE wake signal. The machine taps it
+     * into its own wake queue and drains it on a background fibre; it never reads the
+     * elements, so anything an engine can push on a change will do.
+     *
+     * OPTIONAL, and omitting it defaults to `Stream.never` at the point of use — an
+     * engine with no wake mechanism gets poll-only delivery, which the poll loop
+     * already makes correct. Under `exactOptionalPropertyTypes` that means omitting
+     * the key entirely rather than passing `undefined`.
+     */
+    readonly listen?: Stream.Stream<unknown, E>;
+    /** The poll interval in milliseconds (see `DEFAULT_POLL_INTERVAL_MILLIS`). */
+    readonly pollInterval: number;
+    /** The catch-up page size (see `DEFAULT_CATCH_UP_PAGE_SIZE`). */
+    readonly catchUpPageSize: number;
+}
+/**
+ * Build a subscription `Stream` over any ascending-cursor source: catch up from
+ * `initial`, then track the live tail. The cursor threads through the
+ * `Stream.paginate` state, starting at `initial` and advancing to the cursor of the
+ * last delivered item each batch; the stream never completes on its own (the next
+ * state is always `Option.some`), so the enclosing scope interrupts it on close. An
+ * `E` mid-stream stays on the channel, for the caller to die or to supervise.
+ *
+ * This is THE delivery algorithm, and `subscribeStream` runs the same machine. Under
+ * `emit: 'backlog'` a batch is everything a drain to the tail returned; under
+ * `'page'` it is one fetched page, so the paginate step and the page coincide and a
+ * full page is followed at once by the next read rather than by a wait.
+ *
+ * A `pollInterval` or `catchUpPageSize` the config fields would refuse is a DEFECT
+ * here, raised by the stream before it reads or forks anything, with a message
+ * naming the field. This caller may have no config whose decode would have caught
+ * it, and unchecked the two failures are silent or late: a page size of 0 gives a
+ * stream that never emits and never fails, and 1.5 dies only at the first read,
+ * inside `ReadLimit`, in words that name neither knob.
+ */
+export declare const subscribeItems: <A, C, E>(deps: ItemSubscriptionDeps<A, C, E>) => Stream.Stream<A, E, Scope.Scope>;
+/**
+ * Build the event subscription `Stream`: catch up from `after`, then track the live
+ * tail. A THIN wrapper over the machine `subscribeItems` runs, fixing the item to
+ * `SequencedEvent`, the cursor to its `position`, the start to `ORIGIN` when `after`
+ * is absent, and the emission to the default `'backlog'` — so every engine's call
+ * site, and every figure it delivers, is what it was before the machine became
+ * generic. It skips `subscribeItems`' tuning check, for the reason on `machine`. An `E`
+ * mid-stream stays on the channel; `makeContractStore` dies it (subscribe is
+ * `E = never` on the contract).
+ */
+export declare const subscribeStream: <E>(deps: SubscriptionDeps<E>, after: Position | undefined) => Stream.Stream<SequencedEvent, E, Scope.Scope>;
+//# sourceMappingURL=SubscribeMachine.d.ts.map

package/dist/dts-esm/SubscribeMachine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SubscribeMachine.d.ts","sourceRoot":"","sources":["../../src/SubscribeMachine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+FG;AACH,OAAO,EACL,MAAM,EAIN,MAAM,EACN,KAAK,KAAK,EACV,MAAM,EACP,MAAM,QAAQ,CAAA;AACf,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AACvD,OAAO,EAAU,SAAS,EAAE,MAAM,SAAS,CAAA;AAE3C;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,MAAM,CAAA;AAE7C;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,4BAA4B,OAAO,CAAA;AAWhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,eAAO,MAAM,wBAAwB;;;CAG3B,CAAA;AA2CV;;;;;;;;GAQG;AACH,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,MAAM,CAAA;AAErD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,WAAW,oBAAoB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC3C;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,CACd,KAAK,EAAE,CAAC,EACR,KAAK,EAAE,SAAS,KACb,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IACvC,iFAAiF;IACjF,QAAQ,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAA;IACjC,sFAAsF;IACtF,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAA;IACnB,kFAAkF;IAClF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;IAC3C;;;OAGG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;IAC9B;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC,iFAAiF;IACjF,QAAQ,CAAC,IAAI,CAAC,EAAE,oBAAoB,CAAA;CACrC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,gBAAgB,CAAC,CAAC;IACjC;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,CACd,IAAI,EAAE,QAAQ,EACd,KAAK,EAAE,SAAS,KACb,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAA;IACpD;;;;;;;;;OASG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;IAC3C,8EAA8E;IAC9E,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,iEAAiE;IACjE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAA;CACjC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,cAAc,GAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EACpC,MAAM,oBAAoB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAClC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,KAAK,CAGjC,CAAA;AA4HD;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,GAAI,CAAC,EAC/B,MAAM,gBAAgB,CAAC,CAAC,CAAC,EACzB,OAAO,QAAQ,GAAG,SAAS,KAC1B,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC,EAAE,KAAK,CAAC,KAAK,CAQ3C,CAAA"}

package/dist/dts-esm/errors.d.ts

@@ -0,0 +1,17 @@
+import type { AppendCondition } from './AppendCondition.js';
+declare const AppendConditionFailed_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "AppendConditionFailed";
+} & Readonly<A>;
+/**
+ * Raised by `append` when the append condition's `failIfEventsMatch` query
+ * matches at least one event after `condition.after`. Carries only the
+ * offending condition: a correct retry re-reads the store to its new head and
+ * rebuilds its condition from there, so no conflicting position is carried (it
+ * would already be stale by the time it was acted on).
+ */
+export declare class AppendConditionFailed extends AppendConditionFailed_base<{
+    readonly condition: AppendCondition;
+}> {
+}
+export {};
+//# sourceMappingURL=errors.d.ts.map

package/dist/dts-esm/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/errors.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;;;;AAExD;;;;;;GAMG;AACH,qBAAa,qBAAsB,SAAQ,2BAEzC;IACA,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAA;CACpC,CAAC;CAAG"}

package/dist/dts-esm/inMemory.d.ts

@@ -0,0 +1,76 @@
+import { Effect, Layer } from 'effect';
+import { DcbEventStore } from './DcbEventStore.js';
+/**
+ * Options for the in-memory store factory.
+ *
+ * `beforeCommit` runs inside the append critical section, between the
+ * conflict-check and the commit. It defaults to `Effect.void` — a synchronous
+ * no-op — so the shipped critical section stays atomic by construction
+ * (`Ref.get` -> filter -> `Ref.set`, no suspension), which is the whole
+ * exactly-one-wins guarantee. It is a test seam: the concurrency contract test
+ * overrides it with `Effect.yieldNow()` to force a check/commit suspension, so
+ * the guarantee genuinely depends on `withPermits(1)` serialising across that
+ * boundary — without an injected suspension the test is vacuous (it passes even
+ * with the mutex removed). Real async backends (e.g. Postgres) have this
+ * boundary intrinsically; the in-memory store injects it only under test.
+ *
+ * `suppressWake` stops `append` publishing to the hub, so no wake ever reaches a
+ * live subscriber and the only path left to a delivery is the subscribe machine's
+ * periodic poll. It defaults to `false` — the shipped store always wakes — and it
+ * earns its place for the same reason `beforeCommit` does: the machine's stated
+ * guarantee is that the POLL and not the wake source is what makes delivery correct,
+ * and every ordinary subscribe test could be passing purely via the hub, which
+ * leaves that load-bearing claim asserted only in a comment. Suppressing the PUBLISH
+ * rather than the machine's `listen` keeps `subscribe`'s wiring identical to
+ * production's: what changes is that the wake never fires, which is exactly what a
+ * wake source that died silently does to a real engine.
+ *
+ * `catchUpPageSize` lowers the catch-up page size the subscribe machine runs this
+ * store's subscriptions at, defaulting to core's `DEFAULT_CATCH_UP_PAGE_SIZE` — and it
+ * earns its place the same way its siblings here do. At that default a catch-up drains
+ * in ONE page for any backlog a test would write, so the page loop's exit condition is
+ * taken on the FIRST page every time and `fetchPage`'s whole reason for existing is a
+ * claim about a boundary nothing reaches. Lowering the page brings the SECOND one
+ * within reach: a store that cannot be made to page cannot be asked whether it pages
+ * correctly.
+ *
+ * `pollInterval` lowers the ceiling on how long the subscribe machine waits for a
+ * wake before re-reading from its cursor anyway (milliseconds), defaulting to core's
+ * `DEFAULT_POLL_INTERVAL_MILLIS`. The oracle takes its subscribe tuning from exactly
+ * where the engines it judges take theirs, so a figure chosen here instead would be
+ * this store drifting from all of them by a factor nothing outside its own tests ever
+ * asked for.
+ *
+ * A seam rather than a shorter shipped default, and what that costs is MEASURED
+ * rather than assumed: at core's default, NO subscribe case in the shared contract
+ * suite reaches a poll timeout against this store. Those cases run on a real clock
+ * and finish in a few hundred milliseconds, and the hub wake carries every delivery
+ * they assert, so the poll — the half that carries delivery whenever no wake is
+ * heard — is never what delivered one. A case that wants the POLL to deliver here
+ * must therefore ask for an interval short enough to elapse inside it, and taking the
+ * wake away is what makes such a case prove anything. Asking is cheap: the machine
+ * treats the interval as a CEILING on a wait and never as a tick rate, so a wake
+ * still returns at once and only an IDLE subscription pays — one `fetch` per
+ * interval, which here is a binary search plus a bounded scan over an array.
+ */
+export interface InMemoryStoreOptions {
+    readonly beforeCommit?: Effect.Effect<void>;
+    readonly suppressWake?: boolean;
+    readonly catchUpPageSize?: number;
+    readonly pollInterval?: number;
+}
+/** The in-memory `DcbEventStore` layer (production; no test seam). */
+export declare const DcbEventStoreInMemory: Layer.Layer<DcbEventStore>;
+/**
+ * Test-only in-memory layer factory: the same store as `DcbEventStoreInMemory`, but
+ * with `InMemoryStoreOptions`' seams open. Kept off the package's public surface
+ * (deliberately not re-exported from `index.ts`); production code always uses
+ * `DcbEventStoreInMemory`. Every seam exists to make a claim about this store
+ * FALSIFIABLE rather than merely commented — the store contract suite forces the
+ * check/commit interleaving the exactly-one-wins case needs, one core test takes the
+ * wake away and shortens the poll so that what delivers can only be the poll, and
+ * another lowers the catch-up page to reach the second-page boundary the shipped page
+ * size puts out of reach.
+ */
+export declare const makeInMemoryTestLayer: (options: InMemoryStoreOptions) => Layer.Layer<DcbEventStore>;
+//# sourceMappingURL=inMemory.d.ts.map

package/dist/dts-esm/inMemory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inMemory.d.ts","sourceRoot":"","sources":["../../src/inMemory.ts"],"names":[],"mappings":"AA2BA,OAAO,EAAY,MAAM,EAAE,KAAK,EAAkC,MAAM,QAAQ,CAAA;AAIhF,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAuL/C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAC3C,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAA;IAC/B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;IACjC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAC/B;AAuID,sEAAsE;AACtE,eAAO,MAAM,qBAAqB,EAAE,KAAK,CAAC,KAAK,CAAC,aAAa,CAG5D,CAAA;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,GAChC,SAAS,oBAAoB,KAC5B,KAAK,CAAC,KAAK,CAAC,aAAa,CAC+C,CAAA"}

package/dist/dts-esm/index.d.ts

@@ -0,0 +1,40 @@
+/**
+ * @kairos-es/core: DCB-first event-sourcing contract and in-memory store for
+ * Effect.
+ *
+ * Exposes the domain types (`DcbEvent`, `SequencedEvent`, `Position`, `Tag`,
+ * `EventType`), the selection language (`Query`, `QueryItem`, the pure match
+ * predicate + smart constructors, the servable grammar in both its dispositions —
+ * `assertServableQuery`'s throw and `servableQueryFault`'s total `string |
+ * undefined` — and the servable-shape dispatch every engine compiles its plans
+ * through), the `AppendCondition`, tagged errors, the
+ * `DcbEventStore` contract, `AppendIsOwned` and the refusal every engine's `append`
+ * inherits from it, the in-memory layer, the shared subscribe machine
+ * every engine's `subscribe` is built from (`SubscribeMachine.ts`), the pure
+ * projection primitives (`Projection`, `DecodedEvent`, `composeProjections` and the
+ * `unionQueries` its query merge is reachable through without a record), and
+ * `retryOnConflict`.
+ *
+ * Core keeps only the *pure* fold: projections fold an already-`DecodedEvent`
+ * (decoding needs `Schema` + a `Serializer`, which core must not depend on).
+ * The event-def builder and the decode-aware `buildDecisionModel` live in
+ * `@kairos-es/codec`.
+ *
+ * `retryOnConflict` is here because it is the recovery half of the append
+ * condition — the only consistency mechanism there is. It matches the
+ * `AppendConditionFailed` core defines and needs nothing beyond `effect`'s
+ * `Schedule`, which core already peers, so homing it downstream only made a
+ * write-only consumer depend on a package it uses nothing else of (ADR-0008).
+ */
+export * from './AppendCondition.js';
+export * from './AppendIsOwned.js';
+export * from './ContractStore.js';
+export * from './DcbEventStore.js';
+export * from './Event.js';
+export * from './errors.js';
+export { DcbEventStoreInMemory } from './inMemory.js';
+export * from './Projection.js';
+export * from './Query.js';
+export * from './retryOnConflict.js';
+export * from './SubscribeMachine.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/dts-esm/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,cAAc,mBAAmB,CAAA;AACjC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,iBAAiB,CAAA;AAC/B,cAAc,SAAS,CAAA;AACvB,cAAc,UAAU,CAAA;AAIxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAA;AAClD,cAAc,cAAc,CAAA;AAC5B,cAAc,SAAS,CAAA;AACvB,cAAc,mBAAmB,CAAA;AACjC,cAAc,oBAAoB,CAAA"}

package/dist/dts-esm/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "module"
+}