@kairos-es/feed 0.0.0-stage → 0.0.0

package/dist/dts-esm/index.d.ts

@@ -0,0 +1,63 @@
+/**
+ * @kairos-es/feed — a state-only change feed: the newest state of each record a
+ * read model touches, written inside that read model's own commit, and copied by
+ * a sync worker to a sink that has no transaction of its own — a search index, a
+ * cache, a mirror (ADR-0019).
+ *
+ * The feed copies STATE. It never tells anyone each thing that happened; that is
+ * `@kairos-es/automation`'s job, and the two are deliberately different shapes: an
+ * automation's only progress record is the log, while a feed keeps a cursor, a
+ * lease and a parked list beside its rows, because what it mirrors is state and
+ * its progress is legitimately a cursor.
+ *
+ * What is here, and where each part's argument lives:
+ *
+ * - The identifiers (`identifiers.ts`) and the error vocabulary (`errors.ts`).
+ * - The feed's write and read sides, `BatchedFeedWriter` / `FeedWriter` and
+ *   `FeedSource` (`Feed.ts`): why the feed is written inside the commit, and what
+ *   "coalesced, latest wins" means for a stored row.
+ * - The sink port, `FeedSink` with its optional `FeedResync` and `FeedReconcile`
+ *   (`FeedSink.ts`): what a sink must keep, and why a sink with neither optional
+ *   part is refused.
+ * - The sync store port, `FeedSyncStore` (`FeedSyncStore.ts`): the cursor, the
+ *   parked list and the worker lease, and the exact contract a backend implements.
+ * - The driver, `runFeedSync` (`runFeedSync.ts`): the lifecycle, the rules it
+ *   keeps, resync, and its own supervision.
+ * - `FeedReadiness` and `materialisationCaughtUp` (`readiness.ts`): why a
+ *   rebuild's publish can wait for the materialisation, and what it waits on.
+ * - `reconcileFeed` (`reconcile.ts`), and `inspectFeed` / `retryParked` /
+ *   `removeSink` (`inspect.ts`).
+ * - The in-memory feed (`inMemoryFeed.ts`) and sink (`inMemorySink.ts`): the parity
+ *   oracles, and what the in-memory feed refuses.
+ *
+ * Wiring, end to end, in memory:
+ *
+ * ```ts
+ * const feed = yield* makeInMemoryFeed({ feed: FeedName.make('course-search'), doc: CourseDoc })
+ * const store = yield* withInMemoryFeed(yield* makeInMemoryProjectionStore, feed, key)
+ *
+ * // In the read model's `apply`, as the LAST step of the batch:
+ * const apply = (batch) =>
+ *   feed.write(Arr.lastNonEmpty(batch).sequenced.position, (writer) =>
+ *     Effect.forEach(touchedCourses(batch), (course) =>
+ *       writer.upsert(FeedKey.make(course.id), toDoc(course)),
+ *     ),
+ *   )
+ *
+ * // Beside the projections, in a fibre of its own:
+ * const { sink } = yield* makeInMemorySink<CourseDoc>({ name: SinkName.make('search'), resync: true })
+ * yield* Effect.forkScoped(runFeedSync({ source: feed.source, sink, store: feed.syncStore }))
+ * ```
+ */
+export { CursorSuperseded, FeedSyncStalled, FeedUnreadable, FeedWriteFailed, LeaseHeld, LeaseLost, SinkHalted, SinkRejected, SinkRetryable, } from './errors.js';
+export type { BatchedFeedWriter, FeedRow, FeedSource, FeedWriter, } from './Feed.js';
+export { changeOf, FeedChange, type FeedChangeDefinition, type FeedReconcile, type FeedResync, type FeedSink, type ResyncTarget, } from './FeedSink.js';
+export { type FeedCursor, type FeedLease, type FeedSyncDescription, type FeedSyncStore, type LeaseDescription, type ParkedChange, type ParkedRecord, type SinkSyncState, sameCursor, } from './FeedSyncStore.js';
+export { FEED_ORIGIN, FeedKey, FeedName, FeedSeq, type FeedSinkId, Generation, LeaseHolder, SinkName, } from './identifiers.js';
+export { type InMemoryFeed, type InMemoryFeedOptions, makeInMemoryFeed, withInMemoryFeed, } from './inMemoryFeed.js';
+export { type InMemoryReceipt, type InMemorySentBatch, type InMemorySink, type InMemorySinkOptions, makeInMemorySink, } from './inMemorySink.js';
+export { type FeedInspection, inspectFeed, removeSink, retryParked, type SinkInspection, } from './inspect.js';
+export { type CaughtUpReadModel, type FeedReadiness, type FeedReadinessProbe, materialisationCaughtUp, } from './readiness.js';
+export { type ReconcileFeedOptions, type ReconcileReport, reconcileFeed, } from './reconcile.js';
+export { type FeedSyncRestart, type FeedSyncTuning, type RunFeedSyncOptions, runFeedSync, } from './runFeedSync.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/dts-esm/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAEH,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,eAAe,EACf,SAAS,EACT,SAAS,EACT,UAAU,EACV,YAAY,EACZ,aAAa,GACd,MAAM,UAAU,CAAA;AACjB,YAAY,EACV,iBAAiB,EACjB,OAAO,EACP,UAAU,EACV,UAAU,GACX,MAAM,QAAQ,CAAA;AACf,OAAO,EACL,QAAQ,EACR,UAAU,EACV,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,QAAQ,EACb,KAAK,YAAY,GAClB,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,UAAU,GACX,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACL,WAAW,EACX,OAAO,EACP,QAAQ,EACR,OAAO,EACP,KAAK,UAAU,EACf,UAAU,EACV,WAAW,EACX,QAAQ,GACT,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,mBAAmB,EACxB,gBAAgB,GACjB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,KAAK,cAAc,EACnB,WAAW,EACX,UAAU,EACV,WAAW,EACX,KAAK,cAAc,GACpB,MAAM,WAAW,CAAA;AAClB,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,uBAAuB,GACxB,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,KAAK,oBAAoB,EACzB,KAAK,eAAe,EACpB,aAAa,GACd,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,WAAW,GACZ,MAAM,eAAe,CAAA"}

package/dist/dts-esm/inspect.d.ts

@@ -0,0 +1,71 @@
+/**
+ * `inspectFeed`, `retryParked` and `removeSink`: an operator's view of a feed's
+ * sinks, and the two repairs an operator makes by hand.
+ *
+ * None of them needs the sink's client, because everything they read or change
+ * lives in the source database beside the feed: an operator can see a sink's lag,
+ * its lease, its parked records and when it last advanced, send a parked record
+ * again, and retire a sink, without the credentials of the index concerned. The
+ * same choice `@kairos-es/automation` made for its own `inspect`. There is no CLI
+ * or UI over any of them; they are effects an application wires into whatever it
+ * already has.
+ *
+ * `lastAdvance` and `removeSink` are a pair. Every sink registered on a feed holds
+ * its tombstone collection back, so a sink the application stopped running and
+ * never removed lets tombstones pile up for good; `lastAdvance` is how such a sink
+ * shows — still, while the head moves — and `removeSink` is what lets collection
+ * proceed without it. `FeedSyncStore.ts` owns both rules.
+ */
+import { type DateTime, Effect, Option } from 'effect';
+import type { FeedUnreadable, FeedWriteFailed, LeaseHeld } from './errors.js';
+import type { FeedSource } from './Feed.js';
+import type { FeedCursor, FeedSyncStore, LeaseDescription, ParkedRecord } from './FeedSyncStore.js';
+import type { FeedKey, FeedName, FeedSeq, Generation, SinkName } from './identifiers.js';
+/** One sink of a feed, as `inspectFeed` reports it. */
+export interface SinkInspection {
+    readonly sink: SinkName;
+    /** The generation the sink's cursor was saved at; `None` before its first sync. */
+    readonly generation: Option.Option<Generation>;
+    readonly cursor: Option.Option<FeedCursor>;
+    /** When the cursor last moved; `None` if it never has. See `SinkSyncState.lastAdvance`. */
+    readonly lastAdvance: Option.Option<DateTime.Utc>;
+    /** True when the next pass will resync: no cursor, or one at another generation. */
+    readonly resyncDue: boolean;
+    /** Rows the sink has still to receive; see `SinkSyncState.pending`. */
+    readonly lag: number;
+    readonly lease: Option.Option<LeaseDescription>;
+    readonly parked: ReadonlyArray<ParkedRecord>;
+}
+/** A feed and its sinks. */
+export interface FeedInspection {
+    readonly feed: FeedName;
+    readonly generation: Generation;
+    /** The highest `seq` the feed holds. */
+    readonly head: FeedSeq;
+    readonly sinks: ReadonlyArray<SinkInspection>;
+}
+/** Every sink of `source`'s feed: its cursor, lag, lease and parked records. */
+export declare const inspectFeed: <D>(source: FeedSource<D>, store: FeedSyncStore) => Effect.Effect<FeedInspection, FeedUnreadable>;
+/**
+ * Send one parked record again: delete its park and re-stamp its row's `seq`, so
+ * the next pass of every sink on the feed sends it. Succeeds with whether the key
+ * was parked at all. Every sink on the feed receives the record again, not only
+ * `sink`; an idempotent sink absorbs that.
+ */
+export declare const retryParked: (store: FeedSyncStore, args: {
+    readonly feed: FeedName;
+    readonly sink: SinkName;
+    readonly key: FeedKey;
+}) => Effect.Effect<boolean, FeedWriteFailed>;
+/**
+ * Retire `sink` from `feed`: delete its cursor, its lease record and its parked
+ * records, so it no longer holds the feed's tombstone collection back. Succeeds
+ * with whether the store held anything for it. Fails `LeaseHeld`, removing
+ * nothing, while a worker for the sink is running: stop the worker first. A worker
+ * started for the sink later registers it again from scratch, and resyncs.
+ */
+export declare const removeSink: (store: FeedSyncStore, args: {
+    readonly feed: FeedName;
+    readonly sink: SinkName;
+}) => Effect.Effect<boolean, LeaseHeld | FeedWriteFailed>;
+//# sourceMappingURL=inspect.d.ts.map

package/dist/dts-esm/inspect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inspect.d.ts","sourceRoot":"","sources":["../../src/inspect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AAC1E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AACxC,OAAO,KAAK,EACV,UAAU,EACV,aAAa,EACb,gBAAgB,EAChB,YAAY,EACb,MAAM,iBAAiB,CAAA;AACxB,OAAO,KAAK,EACV,OAAO,EACP,QAAQ,EACR,OAAO,EACP,UAAU,EACV,QAAQ,EACT,MAAM,eAAe,CAAA;AAEtB,uDAAuD;AACvD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,mFAAmF;IACnF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IAC9C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IAC1C,2FAA2F;IAC3F,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IACjD,oFAAoF;IACpF,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;IAC3B,uEAAuE;IACvE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAA;IAC/C,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,YAAY,CAAC,CAAA;CAC7C;AAED,4BAA4B;AAC5B,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAA;IAC/B,wCAAwC;IACxC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,cAAc,CAAC,CAAA;CAC9C;AAED,gFAAgF;AAChF,eAAO,MAAM,WAAW,GAAI,CAAC,EAC3B,QAAQ,UAAU,CAAC,CAAC,CAAC,EACrB,OAAO,aAAa,KACnB,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,cAAc,CAsB3C,CAAA;AAEJ;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GACtB,OAAO,aAAa,EACpB,MAAM;IACJ,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAA;CACtB,KACA,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,eAAe,CAA4B,CAAA;AAErE;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,GACrB,OAAO,aAAa,EACpB,MAAM;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,KACzD,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,GAAG,eAAe,CAA2B,CAAA"}

package/dist/dts-esm/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "module"
+}

package/dist/dts-esm/readiness.d.ts

@@ -0,0 +1,84 @@
+/**
+ * `FeedReadiness` — when a rebuilt copy may go live — and
+ * `materialisationCaughtUp`, the readiness of the common case.
+ *
+ * ## Why a rebuild has anything to wait for
+ *
+ * A reset empties the feed and moves its generation on, and the materialisation
+ * then replays the log, writing the feed afresh as it goes. The sync worker sees
+ * the new generation within a poll interval and starts its resync at once, but the
+ * feed it pages through is only as complete as the replay is far along. Reaching
+ * the feed's last row says nothing about the replay: it is wherever the replay had
+ * got to. So a resync that publishes at the feed's end swaps a complete live copy
+ * for whatever fraction of the rebuild the replay had written, and search serves
+ * that partial copy until the tail fills the rest in.
+ *
+ * Only the materialisation knows how far its replay has got, and the feed's ports
+ * deliberately name no materialisation, so the driver is TOLD, through an optional
+ * readiness signal on `runFeedSync`, and holds the step that makes the rebuild
+ * final until the signal says yes. With no signal the resync publishes at the
+ * feed's end, as it always did, and a rebuild can serve a partial copy for as long
+ * as the replay takes.
+ *
+ * ## Why it is a function returning an effect
+ *
+ * "Caught up" has to be relative to a fixed point: the log as it stood when the
+ * rebuild began. Judged against the log as it stands at each ask, a read model
+ * under steady writes is always a batch or two behind, and the publish would wait
+ * for a quiet moment that may never come. So the signal is asked ONCE per resync
+ * attempt, as the attempt starts, for the generation that attempt rebuilds, and
+ * returns the PROBE the worker then polls — by which time whatever point the probe
+ * judges by is fixed. An attempt starts after the reset that moved the generation,
+ * so a point taken then is at or after the log as it stood at the reset: the error
+ * is towards waiting slightly longer, never towards publishing early.
+ *
+ * Both halves fail `FeedUnreadable`, the feed's own "a read could not be made":
+ * the worker cannot tell a probe that could not read the materialisation's
+ * progress from a feed it could not read, and needs to do the same thing about
+ * either — end the session and try again after a back-off.
+ */
+import { type AnyProjection, DcbEventStore } from '@kairos-es/core';
+import type { KeyedProjectionStore } from '@kairos-es/read';
+import { Effect } from 'effect';
+import { FeedUnreadable } from './errors.js';
+import type { Generation } from './identifiers.js';
+/**
+ * Polled by the worker, between pages, until it answers `true`: the rebuild this
+ * probe was made for may now go live. See the module doc.
+ */
+export type FeedReadinessProbe = Effect.Effect<boolean, FeedUnreadable>;
+/**
+ * Asked once per resync attempt, as it starts, for the generation it rebuilds,
+ * and answering with the {@link FeedReadinessProbe} that attempt polls. See the
+ * module doc for why it is two steps.
+ */
+export type FeedReadiness = (generation: Generation) => Effect.Effect<FeedReadinessProbe, FeedUnreadable>;
+/**
+ * What {@link materialisationCaughtUp} needs of a read model: its bound view store
+ * and its slices. Structural, so any `ReadModel` from `@kairos-es/read` is one.
+ */
+export interface CaughtUpReadModel {
+    readonly store: KeyedProjectionStore;
+    readonly slices: Readonly<Record<string, AnyProjection>>;
+}
+/**
+ * The readiness of the common case: the materialisation's checkpoint has reached
+ * the last event its query selects, as the log stood when the resync attempt
+ * started. Pass the very read model whose `apply` writes the feed, so its query
+ * and its checkpoint are the ones the replay moves.
+ *
+ * The point is the last event the read model's QUERY selects, and not the log's
+ * head, because the runner advances its checkpoint to the positions it is
+ * delivered and is never delivered an event its query does not select: a
+ * checkpoint judged against a head an unrelated event moved would never arrive.
+ * The store hands no cheaper way to that position than reading up to it, so each
+ * attempt starts with one paged read of the query's events past the checkpoint —
+ * the backlog the replay itself is about to read, a page at a time and never held
+ * whole — and each probe after it is one checkpoint read.
+ *
+ * Generation-blind, deliberately: the read model has one checkpoint whatever the
+ * feed's generation, and an attempt whose generation moves on while it waits is
+ * abandoned by the worker's own generation check, so the probe never has to know.
+ */
+export declare const materialisationCaughtUp: (readModel: CaughtUpReadModel) => Effect.Effect<FeedReadiness, never, DcbEventStore>;
+//# sourceMappingURL=readiness.d.ts.map

package/dist/dts-esm/readiness.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"readiness.d.ts","sourceRoot":"","sources":["../../src/readiness.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,OAAO,EACL,KAAK,aAAa,EAElB,aAAa,EAId,MAAM,iBAAiB,CAAA;AACxB,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AAC3D,OAAO,EAAgB,MAAM,EAAkB,MAAM,QAAQ,CAAA;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AACzC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAE/C;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,cAAc,CAAC,CAAA;AAEvE;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,CAC1B,UAAU,EAAE,UAAU,KACnB,MAAM,CAAC,MAAM,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAA;AAEtD;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAA;IACpC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAA;CACzD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,uBAAuB,GAClC,WAAW,iBAAiB,KAC3B,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,aAAa,CAuChD,CAAA"}

package/dist/dts-esm/reconcile.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Reconcile: delete what a sink holds that the feed no longer has.
+ *
+ * ## Why a feed needs it at all
+ *
+ * The steady state deletes through tombstones, and a tombstone lives only until
+ * every sink registered on the feed has passed it. A record can still be left
+ * behind in a sink: a sink restored from a backup, a key written into the index by
+ * hand, or a record deleted before a reset, whose tombstone the reset cleared with
+ * every other row, followed by an in-place resync that, having no atomic swap,
+ * sends only the rows the new generation holds and so never deletes it. Reconcile is the one operation that compares the sink with the feed
+ * rather than replaying the feed into the sink, and so the only one that finds
+ * those orphans.
+ *
+ * ## The order of the two reads, and why it is safe
+ *
+ * The sink's keys are listed FIRST and the feed's live keys read SECOND. A key the
+ * sink lists that has a live row by the time the feed is read is kept, so a record
+ * written while reconcile runs is never deleted by it. A key whose row turns into
+ * a tombstone after the feed is read is kept too, and its tombstone deletes it on
+ * the next pass. And a key whose row comes back to life after the feed is read is
+ * deleted here and re-sent by the next pass, because its new `seq` is above the
+ * cursor. Reconcile runs inside the worker that holds the lease, between batches,
+ * so nothing else is sending to the sink while it does (ADR-0019 §8).
+ *
+ * ## What it costs
+ *
+ * It holds every key the sink lists and every live key of the feed in memory at
+ * once, and reads every live document to find the keys. It is a periodic repair,
+ * not a steady-state path: `reconcileEvery` should be measured in hours.
+ */
+import { Effect } from 'effect';
+import type { FeedUnreadable, FeedWriteFailed, LeaseHeld, LeaseLost, SinkHalted, SinkRetryable } from './errors.js';
+import type { FeedSource } from './Feed.js';
+import { type FeedReconcile, type FeedSink } from './FeedSink.js';
+import type { FeedSyncStore } from './FeedSyncStore.js';
+import { type FeedKey } from './identifiers.js';
+/** What one reconcile did. */
+export interface ReconcileReport {
+    /** How many keys the sink listed. */
+    readonly listed: number;
+    /** The orphans deleted: listed by the sink, with no live row in the feed. */
+    readonly deleted: ReadonlyArray<FeedKey>;
+    /** Orphans whose delete the sink refused, with its reason. They stay in the sink. */
+    readonly refused: ReadonlyArray<{
+        readonly key: FeedKey;
+        readonly reason: string;
+    }>;
+}
+/** Every key of `source` whose row is live, read page by page from the origin. */
+export declare const liveKeys: <D>(source: FeedSource<D>, pageSize: number) => Effect.Effect<ReadonlySet<FeedKey>, FeedUnreadable>;
+/** Options for {@link reconcileFeed}. */
+export interface ReconcileFeedOptions<D, Receipt> {
+    readonly source: FeedSource<D>;
+    readonly sink: FeedSink<D, Receipt> & {
+        readonly reconcile: FeedReconcile;
+    };
+    readonly store: FeedSyncStore;
+    /** How many rows to read, and deletes to send, at a time. */
+    readonly pageSize?: number;
+}
+/**
+ * Reconcile `sink` against `source` once, now. It takes the worker lease itself,
+ * so it fails `LeaseHeld` while a sync worker for the same feed and sink runs —
+ * reconcile through that worker's `reconcileEvery` instead, or stop it first.
+ */
+export declare const reconcileFeed: <D, Receipt>(options: ReconcileFeedOptions<D, Receipt>) => Effect.Effect<ReconcileReport, LeaseHeld | LeaseLost | FeedUnreadable | FeedWriteFailed | SinkRetryable | SinkHalted>;
+//# sourceMappingURL=reconcile.d.ts.map

package/dist/dts-esm/reconcile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcile.d.ts","sourceRoot":"","sources":["../../src/reconcile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAgB,MAAM,EAAkB,MAAM,QAAQ,CAAA;AAG7D,OAAO,KAAK,EACV,cAAc,EACd,eAAe,EACf,SAAS,EACT,SAAS,EACT,UAAU,EACV,aAAa,EACd,MAAM,UAAU,CAAA;AACjB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AACxC,OAAO,EAAc,KAAK,aAAa,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,CAAA;AAC1E,OAAO,KAAK,EAAa,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAC/D,OAAO,EAAe,KAAK,OAAO,EAAmB,MAAM,eAAe,CAAA;AAG1E,8BAA8B;AAC9B,MAAM,WAAW,eAAe;IAC9B,qCAAqC;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,6EAA6E;IAC7E,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,CAAA;IACxC,qFAAqF;IACrF,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;QAC9B,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAA;QACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KACxB,CAAC,CAAA;CACH;AAED,kFAAkF;AAClF,eAAO,MAAM,QAAQ,GAAI,CAAC,EACxB,QAAQ,UAAU,CAAC,CAAC,CAAC,EACrB,UAAU,MAAM,KACf,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,cAAc,CAoBjD,CAAA;AAmGJ,yCAAyC;AACzC,MAAM,WAAW,oBAAoB,CAAC,CAAC,EAAE,OAAO;IAC9C,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,CAAA;IAC9B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,GAAG;QAAE,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAA;KAAE,CAAA;IAC3E,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAA;IAC7B,6DAA6D;IAC7D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAC3B;AAED;;;;GAIG;AACH,eAAO,MAAM,aAAa,GAAI,CAAC,EAAE,OAAO,EACtC,SAAS,oBAAoB,CAAC,CAAC,EAAE,OAAO,CAAC,KACxC,MAAM,CAAC,MAAM,CACd,eAAe,EACb,SAAS,GACT,SAAS,GACT,cAAc,GACd,eAAe,GACf,aAAa,GACb,UAAU,CAgBX,CAAA"}

package/dist/dts-esm/runFeedSync.d.ts

@@ -0,0 +1,220 @@
+/**
+ * `runFeedSync` — the sync worker: one per feed and sink, holding the lease,
+ * copying the feed's rows to the sink and moving its cursor only once the sink
+ * confirms them (ADR-0019).
+ *
+ * ## The lifecycle
+ *
+ * A worker runs in SESSIONS. A session takes the lease, then loops:
+ *
+ * 1. Read the cursor and the feed's generation. No cursor, or a cursor at another
+ *    generation, means the sink holds a copy of something the feed no longer is,
+ *    so the session RESYNCS (below) and loops.
+ * 2. Otherwise it TAILS: the rows after the cursor, through core's generic
+ *    subscribe machine with `emit: 'page'`, so each page is sent as it is read and
+ *    the worker holds one page in memory, never the backlog. Each page is checked
+ *    against the generation first, and so is every poll interval on its own, since
+ *    a reset that writes nothing yields no page; a generation that moved since the
+ *    cursor was saved ends the tail, and step 1 sees the mismatch.
+ *
+ * Every page goes through one delivery: send, park the keys the sink refuses with
+ * its reasons, send the rest again, confirm. Then ONE compare-and-set moves the
+ * cursor past the whole page and moves the parked list with it — the refused keys
+ * parked, every key that was taken unparked — and fenced on the lease holder, so a
+ * worker that lost its lease moves nothing. Then tombstones every sink has passed
+ * are collected.
+ *
+ * The rules that sequence keeps, each a consequence of a sink not being
+ * transactional:
+ *
+ * - **The cursor moves only after `confirm`.** A crash between `apply` and
+ *   `confirm` resends the batch; a sink is idempotent, so that costs a resend and
+ *   nothing else.
+ * - **A refused key does not hold the feed up.** It is parked and the cursor moves
+ *   past it. It is retried when its row next changes, because a change gives the
+ *   row a `seq` above the cursor, and it leaves the parked list once it is sent
+ *   successfully — a tombstone for a parked key included, which is how a refused
+ *   record that is then deleted stops being parked without anyone acting.
+ * - **A retryable failure keeps the cursor.** The session ends, and supervision
+ *   (below) starts a new one after a back-off no shorter than the sink's
+ *   `retryAfter`; the new session sends the same page again.
+ *
+ * ## Resync
+ *
+ * Every row, page by page from the origin, goes into `resync.begin`'s fresh
+ * target; then the generation is checked once more, the target is published over
+ * the live copy, and the cursor is saved at the new generation with the parked list
+ * REPLACED by the refusals the resync met. Resync progress is held in memory only,
+ * so a crash restarts it from the origin, with a new `begin` that drops the
+ * half-built target the crash left.
+ *
+ * ### Waiting for the materialisation
+ *
+ * The feed's end is not the rebuild's end. After a reset the materialisation
+ * replays the log and writes the feed as it goes, so a resync that reaches the
+ * feed's last row has reached wherever the replay had got to, and publishing there
+ * swaps a complete live copy for a partial one. `readiness.ts` owns that argument.
+ * So `runFeedSync` takes an optional `readiness`: asked once as each attempt
+ * starts, it hands back a probe, and the attempt does not publish until the probe
+ * says the materialisation has caught up. Until then the attempt polls: once per
+ * poll interval it checks the generation, abandoning the attempt as stale if a
+ * reset moved it again, asks the probe, and reads the feed on from where it left
+ * off, loading what the replay wrote meanwhile. The probe is asked BEFORE that
+ * read, so the read that follows a `true` sees every row the materialisation had
+ * committed by the time it answered, since a feed row commits with the checkpoint
+ * that produced it. The lease is still checked immediately before `publish`, and
+ * the generation once more just before that, however long the wait was.
+ *
+ * With no `readiness` the attempt publishes at the feed's end, which is exactly the
+ * behaviour above, and search can serve a PARTIAL copy for as long as the replay
+ * takes. An in-place rebuild has no publish; there the wait holds the closing
+ * reconcile and the cursor save instead, so the reconcile never deletes a record
+ * the replay has not reached yet. Without a `readiness` an in-place rebuild
+ * reconciles at the feed's end too, and so deletes from the live copy every record
+ * the replay had not yet written again; the tail sends each back as the replay
+ * reaches it.
+ *
+ * The wait is UNBOUNDED. A probe that never says yes holds the attempt for good,
+ * with no error and no restart, because publishing early is the very failure the
+ * wait exists to prevent and no timeout could tell a stuck replay from a long one.
+ * It is made visible instead: `inspectFeed` reports the sink `resyncDue` for as long
+ * as it lasts, since the cursor stays at the old generation, and every
+ * `HELD_WAIT_WARN_POLLS` poll intervals (`tuning.ts`) the attempt logs a warning,
+ * "feed sync rebuild held on readiness", with the feed, the sink, the generation,
+ * the polls so far and how long it has been held.
+ *
+ * Each `begin` names a target of its own, never one an earlier attempt used, and
+ * that is what bounds a lease lapse here. A worker that has lost its lease can
+ * still land one call after the new holder's (`FeedSyncStore.ts` says when). Were
+ * the target named after its generation alone, that call could be a `publish` of
+ * the NEW holder's half-built target, which then goes on loading into a fresh one
+ * holding only the later pages, publishes it, and saves its cursor at the head:
+ * whole pages lost, and nothing to bring them back. With a target per attempt, a
+ * stale `publish` moves only the stale worker's own target — or fails, retryably,
+ * when a newer `begin` has dropped it — and a stale `begin` drops the new holder's
+ * target, whose `publish` then fails retryably and whose resync starts again.
+ * What a stale `publish` of its own target still costs is `FeedSyncStore.ts`'s to
+ * say, with the rest of the lease's window.
+ *
+ * `begin`, `load`, `apply` and `publish` each run behind `ensureHeld`; `confirm`
+ * and a reconcile's key listing change nothing, and do not.
+ *
+ * Tombstones are sent as deletes, although the target starts empty. The feed does
+ * not stand still while a resync pages through it: a key loaded on an early page
+ * can be deleted by the read model before the resync is done, and its tombstone
+ * then sits at a `seq` a LATER page reads. Dropping it would load the key, save
+ * the cursor past its delete, and publish a target that holds a record the feed no
+ * longer has, with nothing ever coming to remove it. A tombstone for a key the
+ * target never held costs a send and changes nothing, since a delete of an absent
+ * key is a no-op by the sink laws.
+ *
+ * The same movement decides the parked list. A key can be met more than once in
+ * one resync — refused on an early page, then changed and met again later — so
+ * the list saved is what each key's LAST change in the resync came to: parked if
+ * that change was refused, absent if it was taken. Keeping every refusal the
+ * resync met would leave parked a key the target holds, or one the feed deleted.
+ *
+ * A sink with no `resync` is resynced IN PLACE: every row is sent to the live copy,
+ * live rows as upserts and tombstones as deletes, and then a reconcile deletes what
+ * the feed no longer holds. The live copy serves a mixture of old and new from the
+ * first page on, which is the price of a target with no atomic swap. Its refusals
+ * land in the parked list it saves like any resync's, with two consequences of
+ * writing over the live copy: a refused upsert leaves the PREVIOUS generation's
+ * document of that key live, and an orphan whose delete the closing reconcile was
+ * refused stays live too. Both are parked with the sink's reason, the orphan at the
+ * origin `seq` since it has no row, and the closing reconcile's report goes to
+ * `onReconcile` like a scheduled one's. A sink with neither part could never be
+ * rebuilt, and is refused at construction.
+ *
+ * ## Supervision
+ *
+ * Every failure a session meets ends it, and the worker's own loop decides what
+ * next. It follows `@kairos-es/automation`'s daemon rather than generalising the
+ * read side's supervisor, whose own doc says a progress signal the caller owns does
+ * not qualify — and the signal here, a cursor advance, is the worker's own.
+ *
+ * - `LeaseHeld`: another worker is running. This one waits a poll interval and
+ *   tries again, and the wait is not a failure: a standby worker is a healthy one,
+ *   and it takes over within a poll interval of the first worker's lease going.
+ * - Anything else: a back-off of `restartMinDelay` doubling to `restartMaxDelay`,
+ *   scaled by a jitter drawn from `Random` so a fleet of workers does not retry in
+ *   lockstep, and never shorter than a `SinkRetryable`'s `retryAfter`. A restart
+ *   that follows no cursor advance since the previous restart counts towards
+ *   `maxNoProgressRestarts`; reaching it ends the worker with `FeedSyncStalled`,
+ *   for the caller to report. Any advance resets the count and the curve.
+ *
+ * Defects are not caught: they are bugs, in the driver or in a sink or store that
+ * should have classified its fault, and supervision must not retry a bug.
+ *
+ * ## The scope
+ *
+ * The worker never returns. Run it in a fibre of its own beside the projections,
+ * and close the scope to stop it: each session runs in a child scope of the
+ * caller's, so closing the caller's scope releases the lease.
+ */
+import { Duration, Effect, Scope } from 'effect';
+import { FeedSyncStalled } from './errors.js';
+import type { FeedSource } from './Feed.js';
+import { type FeedSink } from './FeedSink.js';
+import type { FeedSyncStore } from './FeedSyncStore.js';
+import { type FeedName, type SinkName } from './identifiers.js';
+import type { FeedReadiness } from './readiness.js';
+import { type ReconcileReport } from './reconcile.js';
+/** What `onRestart` is told before each restart's back-off. */
+export interface FeedSyncRestart {
+    readonly feed: FeedName;
+    readonly sink: SinkName;
+    /** Consecutive restarts with no cursor advance, this one included. */
+    readonly restarts: number;
+    readonly delay: Duration.Duration;
+    /** The failure that ended the session. */
+    readonly reason: unknown;
+}
+/** The worker's knobs. Every one has a default; see `tuning.ts`'s module doc. */
+export interface FeedSyncTuning {
+    /** The upper bound on an idle sleep. Default 1 second. */
+    readonly pollInterval?: Duration.Input;
+    /** Rows read, and changes sent, per page. Default core's catch-up page, 512. */
+    readonly pageSize?: number;
+    /** The first restart back-off. Default 100 ms. */
+    readonly restartMinDelay?: Duration.Input;
+    /** The restart back-off's cap, before jitter. Default 30 seconds. */
+    readonly restartMaxDelay?: Duration.Input;
+    /** Consecutive restarts with no cursor advance before `FeedSyncStalled`. Default 40. */
+    readonly maxNoProgressRestarts?: number;
+    readonly onRestart?: (info: FeedSyncRestart) => Effect.Effect<void>;
+    /**
+     * Told what each reconcile the worker runs did: each scheduled one, and the one
+     * that closes an in-place rebuild.
+     */
+    readonly onReconcile?: (report: ReconcileReport) => Effect.Effect<void>;
+}
+/** Options for {@link runFeedSync}. */
+export interface RunFeedSyncOptions<D, Receipt> {
+    readonly source: FeedSource<D>;
+    readonly sink: FeedSink<D, Receipt>;
+    readonly store: FeedSyncStore;
+    readonly tuning?: FeedSyncTuning;
+    /**
+     * Reconcile the sink against the feed this often, between batches, under the
+     * worker's own lease. Needs the sink's `reconcile`; absent, the worker
+     * reconciles only as part of an in-place resync.
+     */
+    readonly reconcileEvery?: Duration.Input;
+    /**
+     * Hold each resync's `publish` — or, in place, its closing reconcile — until the
+     * materialisation writing the feed has caught up with the log, for as long as
+     * that takes; see the module doc's Resync section. Absent, a resync publishes at
+     * the feed's end, and search can be PARTIAL while a rebuild's replay runs.
+     * `materialisationCaughtUp` builds the common case from the read model.
+     */
+    readonly readiness?: FeedReadiness;
+}
+/**
+ * Run the sync worker for `options.source` and `options.sink`; see the module doc.
+ * Dies at once, before taking the lease, on a sink that has neither `resync` nor
+ * `reconcile`, on a `reconcileEvery` for a sink with no `reconcile`, and on tuning
+ * that is out of range.
+ */
+export declare const runFeedSync: <D, Receipt>(options: RunFeedSyncOptions<D, Receipt>) => Effect.Effect<never, FeedSyncStalled, Scope.Scope>;
+//# sourceMappingURL=runFeedSync.d.ts.map

package/dist/dts-esm/runFeedSync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runFeedSync.d.ts","sourceRoot":"","sources":["../../src/runFeedSync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyJG;AAGH,OAAO,EAKL,QAAQ,EACR,MAAM,EAIN,KAAK,EAEN,MAAM,QAAQ,CAAA;AAGf,OAAO,EAEL,eAAe,EAQhB,MAAM,UAAU,CAAA;AACjB,OAAO,KAAK,EAAW,UAAU,EAAE,MAAM,QAAQ,CAAA;AACjD,OAAO,EAKL,KAAK,QAAQ,EACd,MAAM,YAAY,CAAA;AACnB,OAAO,KAAK,EAGV,aAAa,EAGd,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAGL,KAAK,QAAQ,EAGb,KAAK,QAAQ,EACd,MAAM,eAAe,CAAA;AACtB,OAAO,KAAK,EAAE,aAAa,EAAsB,MAAM,aAAa,CAAA;AACpE,OAAO,EAEL,KAAK,eAAe,EAGrB,MAAM,aAAa,CAAA;AAYpB,+DAA+D;AAC/D,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAA;IACjC,0CAA0C;IAC1C,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CACzB;AAED,iFAAiF;AACjF,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,QAAQ,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAA;IACtC,gFAAgF;IAChF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,kDAAkD;IAClD,QAAQ,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAA;IACzC,qEAAqE;IACrE,QAAQ,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAA;IACzC,wFAAwF;IACxF,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAA;IACvC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,eAAe,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACnE;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,eAAe,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;CACxE;AAED,uCAAuC;AACvC,MAAM,WAAW,kBAAkB,CAAC,CAAC,EAAE,OAAO;IAC5C,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,CAAA;IAC9B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;IACnC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAA;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAA;IAChC;;;;OAIG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAA;IACxC;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAA;CACnC;AAmBD;;;;;GAKG;AACH,eAAO,MAAM,WAAW,GAAI,CAAC,EAAE,OAAO,EACpC,SAAS,kBAAkB,CAAC,CAAC,EAAE,OAAO,CAAC,KACtC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,KAAK,CAiDhD,CAAA"}

package/dist/dts-esm/tuning.d.ts

@@ -0,0 +1,40 @@
+/**
+ * The driver's tuning: its defaults, and the checks that refuse a nonsensical
+ * value at construction rather than somewhere inside a running worker.
+ *
+ * The page size defaults to core's own catch-up page, and the supervision curve to
+ * the read side's — 100 ms doubling to 30 s — so a feed behaves like its
+ * neighbours unless told otherwise. The no-progress cap is the read side's too,
+ * and for the same reason: forty restarts on that curve is some twenty minutes of
+ * a sink refusing everything, which is long enough to ride out an outage and short
+ * enough that a broken wiring is reported the same day.
+ *
+ * Package-internal; the options a caller sets are `FeedSyncTuning`'s, on
+ * `runFeedSync`.
+ */
+import { ReadLimit } from '@kairos-es/core';
+import { Duration } from 'effect';
+/** Rows read, and changes sent, per page. */
+export declare const DEFAULT_FEED_PAGE_SIZE: number;
+/** The upper bound on an idle worker's sleep: the poll that is the guarantee. */
+export declare const DEFAULT_FEED_POLL_INTERVAL: Duration.Duration;
+/** The first restart back-off. */
+export declare const DEFAULT_FEED_RESTART_MIN_DELAY: Duration.Duration;
+/** The restart back-off's cap, before jitter. */
+export declare const DEFAULT_FEED_RESTART_MAX_DELAY: Duration.Duration;
+/** Consecutive restarts without a cursor advance before the worker gives up. */
+export declare const DEFAULT_FEED_MAX_NO_PROGRESS_RESTARTS = 40;
+/**
+ * How many poll intervals a rebuild held on its readiness waits between two
+ * warnings that it is still held. Not a bound: the wait goes on, since publishing
+ * early is the failure the wait exists to prevent. Counted in polls, not time, so
+ * it scales with `pollInterval`: sixty polls is long past any replay that is
+ * merely busy at any sensible interval, and rare enough not to flood a log while
+ * a long one runs.
+ */
+export declare const HELD_WAIT_WARN_POLLS = 60;
+/** The page size as a `ReadLimit`, refusing one that is not a positive integer. */
+export declare const readLimit: (pageSize: number) => ReadLimit;
+/** A duration input decoded, refusing one that is not positive and finite. */
+export declare const positiveDuration: (label: string, input: Duration.Input) => Duration.Duration;
+//# sourceMappingURL=tuning.d.ts.map

package/dist/dts-esm/tuning.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tuning.d.ts","sourceRoot":"","sources":["../../src/tuning.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAA8B,SAAS,EAAE,MAAM,iBAAiB,CAAA;AACvE,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAA;AAEjC,6CAA6C;AAC7C,eAAO,MAAM,sBAAsB,EAAE,MAAmC,CAAA;AAExE,iFAAiF;AACjF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,QAA8B,CAAA;AAEhF,kCAAkC;AAClC,eAAO,MAAM,8BAA8B,EAAE,QAAQ,CAAC,QAChC,CAAA;AAEtB,iDAAiD;AACjD,eAAO,MAAM,8BAA8B,EAAE,QAAQ,CAAC,QAChC,CAAA;AAEtB,gFAAgF;AAChF,eAAO,MAAM,qCAAqC,KAAK,CAAA;AAEvD;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,KAAK,CAAA;AAEtC,mFAAmF;AACnF,eAAO,MAAM,SAAS,GAAI,UAAU,MAAM,KAAG,SAO5C,CAAA;AAED,8EAA8E;AAC9E,eAAO,MAAM,gBAAgB,GAC3B,OAAO,MAAM,EACb,OAAO,QAAQ,CAAC,KAAK,KACpB,QAAQ,CAAC,QAMX,CAAA"}

package/dist/esm/Feed.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=Feed.js.map

package/dist/esm/Feed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Feed.js","names":[],"sources":["../../src/Feed.ts"],"sourcesContent":[null],"mappings":"","ignoreList":[]}

package/dist/esm/FeedSink.js

@@ -0,0 +1,46 @@
+/**
+ * The sink port: what a target a feed is copied to must offer the driver.
+ *
+ * ## Three parts, two of them optional
+ *
+ * - `apply` and `confirm` are the whole of the steady state. `apply` sends a
+ *   batch and returns a `Receipt`; `confirm` resolves once that batch is applied
+ *   AND VISIBLE in the target. The driver moves its cursor only after `confirm`
+ *   (ADR-0019 §6), so a crash between the two resends the batch — which is why
+ *   every sink must be IDEMPOTENT: the same batch applied twice leaves the target
+ *   as once. Full-record replace satisfies that; a partial operation such as an
+ *   increment does not, and a sink must never use one.
+ * - `resync` is how a sink rebuilds after the feed's generation moves: load every
+ *   row into a fresh target that is not yet serving — tombstones too, as deletes,
+ *   since the feed can delete a key the same resync has already loaded — then swap
+ *   it over the live one atomically, so search keeps serving the old copy until the new one is
+ *   complete and records deleted from the feed do not survive the rebuild.
+ * - `reconcile` lists the keys the target holds, so the driver can delete those
+ *   the feed no longer has. Deletes go through the ordinary `apply`.
+ *
+ * A sink with no atomic swap leaves out `resync`, and the driver then resyncs IN
+ * PLACE: it sends every row to the live target and reconciles away what the feed
+ * no longer holds. That needs `reconcile`, so `runFeedSync` refuses at
+ * construction a sink that has neither part: such a sink could never be rebuilt.
+ *
+ * ## Why `FeedChange` is not `FeedRow`
+ *
+ * A sink is handed the change to make, not the row it came from: an `Upsert` with
+ * the document or a `Delete`. The sequence and the event position are the
+ * driver's business, and a sink that could see them could be tempted to keep a
+ * cursor of its own, which would be a second record of progress.
+ */
+import { Data, Option } from 'effect';
+/** `FeedChange.Upsert({ key, doc })`, `FeedChange.Delete({ key })`, and matchers. */
+export const FeedChange = /*#__PURE__*/Data.taggedEnum();
+/** The change a row asks of a sink: its document as an upsert, a tombstone as a delete. */
+export const changeOf = row => Option.match(row.doc, {
+  onNone: () => FeedChange.Delete({
+    key: row.key
+  }),
+  onSome: doc => FeedChange.Upsert({
+    key: row.key,
+    doc
+  })
+});
+//# sourceMappingURL=FeedSink.js.map