@lunora/do 1.0.0-alpha.30 → 1.0.0-alpha.32

package/dist/index.d.mts

@@ -614,6 +614,13 @@ declare const rankTableName: (table: string, indexName: string) => string;
 * - `rowId` === `doc._id`, the `__id__` tiebreak.
 */
 declare const stableStringify: (value: unknown) => string;
+/**
+* Stable cache/dedup key for a (possibly wire-typed) `value`: the sorted-key
+* stable encoding of its wire form. Byte-identical to `stableStringify(value)`
+* for pure-JSON values; deterministic tagged tokens for `bigint`/`Date`/`Map`/
+* `Set`/`URL`/bytes; throws a `TypeError` on values the wire refuses.
+*/
+declare const stableWireKey: (value: unknown) => string;
 /** A single memoized result, the deps it read, and any active subscribers. */
 interface CacheEntry {
   /** Approximate serialized size of `result`, charged against `maxBytes`. */
@@ -2400,6 +2407,11 @@ interface MaterializeResult {
   /** `id → projected-value JSON` — the post-tick membership, to feed back as `baseline` next tick. */
   nextBaseline: Map<string, string>;
 }
+/** The outcome of one incremental materialize pass. No baseline: incremental applies only the pulled slice, never a full-membership diff. */
+interface IncrementalMaterializeResult {
+  /** Number of `CdcChange`s applied (upserts + tombstone deletes) for the pulled slice. */
+  applied: number;
+}
 /**
 * Diff `pulled` against `baseline` and apply the delta to `writer`. Returns the
 * applied count and the next baseline. A steady-state tick (membership unchanged)
@@ -2410,6 +2422,36 @@ declare const materializeExternalRows: (writer: DatabaseWriterLike, pulled: Read
   table: string;
 }) => Promise<MaterializeResult>;
 /**
+* Apply an **incremental** slice (plan 136): the freshly-pulled rows changed since
+* the watermark, upsert-only. Unlike {@link materializeExternalRows} this reads no
+* baseline and never diffs the full membership — an absent row means "unchanged
+* since the watermark", NOT "deleted". Each pulled row is projected with the SAME
+* {@link projectExternalSourceRow} full-pull uses, so an incrementally-upserted row
+* is byte-identical to how the next reconcile sweep's full-pull would store it (no
+* spurious update on reconcile).
+*
+* Delete visibility comes from `deletedIds` — the ids the caller resolved from the
+* source's soft-delete tombstone column. Every other pulled row is an `insert`,
+* which {@link applyCdcChanges} upserts (insert, or replace on conflict), so a
+* changed existing row is updated and a genuinely new row is inserted without the
+* caller tracking which is which.
+*
+* **Content short-circuit.** An incremental cursor query uses `>= watermark` (so
+* rows sharing the boundary value are never skipped), which means a steady-state
+* tick re-pulls the boundary row(s) unchanged. Blindly upserting them would append
+* a `__cdc_log` entry, broadcast a spurious `update` to every `defineShape`
+* subscriber, re-run search/aggregate/rank sync, and fire `onWrite` (a Vectorize
+* re-embed = real cost) on every tick — and `replace` would reset `_creationTime`.
+* So each row is diffed against its stored projection (the SAME
+* {@link projectExternalSourceRow} + {@link stableStringify} full-pull uses) and
+* skipped when byte-identical — mirroring the full-pull diff's steady-state no-op.
+*/
+declare const materializeExternalRowsIncremental: (writer: DatabaseWriterLike, pulled: ReadonlyArray<Record<string, unknown>>, options: {
+  columns?: ReadonlyArray<string>;
+  deletedIds?: ReadonlySet<string>;
+  table: string;
+}) => Promise<IncrementalMaterializeResult>;
+/**
 * Read the materialized table's current membership as the canonical full-pull
 * baseline (`id → canonical JSON`). Reuses the shape scanner (`selectShapeRows`)
 * and the SAME {@link projectExternalSourceRow} + {@link stableStringify} the diff
@@ -2438,14 +2480,23 @@ interface SourceClientLike {
 type SourceRefresh = "manual" | {
   everyMs: number;
 };
+/** The incremental cursor config (plan 136): the watermark column + the watermark-parameterized pull query. */
+interface SourceCursorLike {
+  column: string;
+  query: string;
+}
 /** The runtime `.source(...)` config the poll loop reads — a structural mirror of `@lunora/server`'s `ExternalSourceDefinition` (only the fields the tick uses). */
 interface ExternalSourceLike {
   binding: string;
   columns?: ReadonlyArray<string>;
+  cursor?: SourceCursorLike;
   idColumn?: string;
   map?: (row: Record<string, unknown>) => Record<string, unknown>;
+  mode?: string;
   query: string;
+  reconcileEveryMs?: number;
   refresh?: SourceRefresh;
+  softDeleteColumn?: string;
   tenantBy?: (shardKey: string) => ReadonlyArray<unknown>;
 }
 /**
@@ -2475,6 +2526,39 @@ declare const isSourceDue: (refresh: SourceRefresh | undefined, lastPolledMs: nu
 */
 declare const pullExternalSourceTick: (sql: SqlExec, writer: DatabaseWriterLike, client: SourceClientLike, table: string, source: ExternalSourceLike, shardKey: string) => Promise<MaterializeResult>;
 /**
+* Whether an upstream row is a soft-delete tombstone under `column`. A set
+* `deleted_at` (any non-null value, e.g. a timestamp), an `is_deleted = true`, or a
+* non-zero flag all read as deleted; `null` / `undefined` / `false` / `0` mean
+* live. Note an **empty string** reads as deleted (`"" !== 0`), so an upstream that
+* clears the column to `""` rather than `NULL` for a live row would mis-signal —
+* use `NULL` for live rows. The incremental query MUST return tombstoned rows
+* (don't filter `WHERE deleted_at IS NULL`) or the delete is never observed.
+*/
+declare const isSoftDeleted: (row: Record<string, unknown>, column: string) => boolean;
+/**
+* Run one **incremental** tick (plan 136). Reads the durable watermark for
+* `(table, shardKey)`; on the first ever poll or when the `reconcileEveryMs` sweep
+* is due it runs a **full-pull** (seed/GC: {@link runExternalSourceTick} observes
+* deletes and re-establishes membership), otherwise it pulls only rows past the
+* watermark via `cursor.query` and upserts them ({@link materializeExternalRowsIncremental},
+* tombstones → deletes). Either way it advances the watermark to the max cursor
+* value seen and persists it (and the reconcile timestamp).
+*
+* **Crash safety** is by ordering + idempotency, NOT an atomic transaction across
+* the two write channels (the apply goes through the `writer`; the watermark write
+* is a raw `sql` write): the watermark advances only AFTER a fully-applied slice,
+* so a crash between the apply and the watermark write leaves the watermark behind
+* and the next tick re-pulls the same `>= watermark` slice — which the upsert
+* short-circuits (unchanged rows) or re-applies idempotently. It only ever replays,
+* never skips (same self-healing argument as `advanceClientWatermark`).
+*
+* Requires `source.cursor` (validated at `defineSchema` for incremental mode); a
+* missing cursor throws rather than silently degrading to a stuck watermark.
+*/
+declare const pullExternalSourceIncrementalTick: (sql: SqlExec, writer: DatabaseWriterLike, client: SourceClientLike, table: string, source: ExternalSourceLike, shardKey: string, nowMs: number) => Promise<{
+  applied: number;
+}>;
+/**
 * Reserved `functionPath` prefix for admin introspection RPCs. These travel
 * over the same `/_lunora/rpc` → shard `/rpc` path as ordinary functions, but
 * `ShardDO` intercepts them before user dispatch and serves them from the
@@ -6431,7 +6515,12 @@ declare abstract class ShardDO {
   * server logs, browser history, and `Referer` headers on any
   * subresource the upgrade page loads after the handshake. Use a
   * short-lived rotating token in production rather than a long-lived
-  * secret.
+  * secret — for the ADMIN credential specifically, the worker mints one
+  * (`POST /_lunora/admin/ws-token`) and {@link isAdminSocket} accepts it, so
+  * the master `LUNORA_ADMIN_TOKEN` never rides the URL.
+  *
+  * Async because the admin fallback ({@link isAdminSocket}) verifies the
+  * ephemeral sub-token with WebCrypto HMAC.
   */
   private isUpgradeAllowed;
   /**
@@ -6442,10 +6531,20 @@ declare abstract class ShardDO {
   */
   private suppliedWsToken;
   /**
-  * Whether the upgrade presented a token matching `LUNORA_ADMIN_TOKEN`,
-  * constant-time compared. Closed (returns `false`) when the admin token is
-  * unset, mirroring `isAdminAuthorized` for the HTTP path so admin
-  * streaming is opt-in rather than exposed by default.
+  * Whether the upgrade presented an admin credential: the master
+  * `LUNORA_ADMIN_TOKEN` (constant-time compared) or a short-lived sub-token
+  * the worker minted with it (`POST /_lunora/admin/ws-token` —
+  * HMAC-verified statelessly here, since both isolates hold the master token
+  * in `env`). The ephemeral token is what the studio sends in `?token=`, so
+  * the master credential stays out of URLs/logs. Closed (resolves `false`)
+  * when the admin token is unset, mirroring `isAdminAuthorized` for the HTTP
+  * path so admin streaming is opt-in rather than exposed by default.
+  *
+  * Enforcement: with `LUNORA_REQUIRE_EPHEMERAL_WS_TOKEN` set
+  * (`1`/`true`/`on`/`yes`/`enabled`), a raw master token in the
+  * `?token=` query parameter is rejected — the query string is exactly
+  * where it leaks. The `Authorization` header path still takes the master
+  * token: browsers can't set it on a WS upgrade, so it never rides a URL.
   */
   private isAdminSocket;
   /**
@@ -6682,4 +6781,4 @@ interface WhereSqlStrategy {
 * `undefined` when the input imposes no constraint (empty `where`).
 */
 declare const compileWhereSql: (where: WhereInput | undefined, strategy: WhereSqlStrategy) => SQL | undefined;
-export { ADMIN_FUNCTIONS, ADMIN_FUNCTION_PREFIX, AGGREGATE_SQL_FUNCTION, AUTH_METRICS_BUCKETS_TABLE, AUTH_METRICS_BUCKET_MS, AUTH_METRICS_BUCKET_RETENTION, AUTH_METRICS_TABLE, type AdvisoriesResult, type AdvisoryFinding, type AggregateIndexDefinitionLike, type AggregateOp, type AggregateOptions, type AggregateResult, type AggregateTally, type ApplyOnDeleteOptions, type AuditEntry, type AuditLogResult, type AuthMetrics, type AuthMetricsBucket, type BroadcastDelta, CDC_LOG_TABLE, type CacheEntry, type CapturedMailRow, type CdcChange, type Clock, type ColumnMeta, type ColumnMetaLike, ConflictError, type CountArgs, CountRlsUnsupportedError, type CtxDbOptions, DATA_MIGRATION_STATE_TABLE, DEFAULT_MAX_RELATION_KEYS, type DataMigrationDocument, type DataMigrationLike, type DataMigrationTransform, type DatabaseWriterLike, type DependencyTracker, type DeployInfo, type ExportRow, type ExportShardAdminArgs, type ExportShardArgs, type ExternalSourceDiffResult, type ExternalSourceLike, FLAGS_FUNCTION_PREFIX, FUNCTION_METRICS_BUCKETS_TABLE, FUNCTION_METRICS_BUCKET_MS, FUNCTION_METRICS_BUCKET_RETENTION, FUNCTION_METRICS_INDEX_TABLE, FUNCTION_METRICS_TABLE, type FacetColumnOptions, type FacetColumnResult, type FacetValue, type FieldOperators, type FlagEvaluation, type FlagsResult, type FunctionCallStat, type FunctionMetricBucket, type FunctionMetricIndexHit, type FunctionStatsResult, type GroupByEntry, type GroupByOptions, type HibernatableWebSocket, type IdGenerator, type ImportError, type ImportShardAdminArgs, type ImportShardArgs, type ImportShardResult, type IndexDefinitionLike, type IndexRangeBuilderLike, LogBuffer, type LogEntry, type LogEventInput, type LogLevel, type LogSink, MAIL_RETENTION, MAIL_TABLE, MAX_SQL_ROWS, MIN_ADMIN_TOKEN_LENGTH, MIN_AUTH_SECRET_LENGTH, type MaskColumnMetadata, type MaskPoliciesResult, type MaterializeResult, type MigrationDirection, type MigrationRunResult, type MigrationStatus, type MigrationStatusRow, type MutationDelta, type NestedWith, NotFoundError, NotUniqueError, type OnDeleteActionLike, type OrderByInput, type OrderKey, type PaginationOptions, type PitrBookmarkResult, type PitrRestoreArgs, type PitrRestoreResult, type PitrStorage, type QueryArgs, type QueryPage, type QueueMetadata, type QueuesResult, RANK_TIEBREAK, RELATION_FUNCTION_PREFIX, RLS_UNWRAP_SYMBOL, ROOT_DO_SIZE_WARN_BYTES, ROOT_SHARD_NAME, type RankDirection, type RankIndexDefinitionLike, type RankOptions, type RankPage, type RankPageOptions, type RankPageRow, type RankPageRowKey, type RankResult, type RankSortKeyLike, ReactiveCache, type ReactiveCacheOptions, type ReadHook, type ReadTablePageOptions, type RecordAuthEventInput, type RecordFunctionMetricInput, type RecordMailInput, type RelationDefinitionLike, type RenderedSql, type ResolveRelationPredicatesOptions, type ResolveWithOptions, type RestrictableQueryOptions, type RlsPoliciesResult, type RlsPolicyMetadata, RlsRequiredError, type RlsRoleMetadata, type RpcRequest, type RunDataMigrationOptions, type RunShardApplyCdcArgs, type RunShardApplyCdcResult, type RunShardBulkDeleteArgs, type RunShardBulkDeleteResult, type RunShardExportArgs, type RunShardImportArgs, type RunShardMigrationArgs, type RunShardRankBeforeArgs, type RunShardRankPageArgs, type RunShardWriteArgs, type RunShardWriteResult, type RunTriggersOptions, SCAN_DEP, SESSION_DO_TTL_DEFAULT, SHARD_REGISTRY_DO_NAME, type SchedulableWorkflowReferenceLike, type ScheduledFunctionDoc, type SchedulerLike, type SchemaLike, type SearchFilterBuilderLike, type SecurityAuditResult, type SecurityFinding, type SecurityFindingKind, type SecurityFindingLevel, type SelectMatchingIdsOptions, type ServerDefaultContextLike, SessionDO, type SessionRecord, type SettingEntry, type SettingKind, type SettingsResult, type ShapeSubscriptionQuery, ShardDO, type ShardDOOptions, type ShardDOState, type ShardRankPageResult, ShardRegistryDO, type SocketAttachment, type SortDirection, type SourceClientLike, type SourceRefresh, type SqlConsoleResult, type SqlCursor, type SqlEngine, type SqlExec, type StorageRuleMetadata, type StorageRulesResult, type StudioFeaturesResult, type SubscriptionEnvelope, type SubscriptionOutcome, type SubscriptionQuery, type SystemDatabaseReader, type SystemDoc, type SystemQuery, type SystemReaderOptions, type SystemReaderSchedulerLike, type SystemReaderStorageLike, type SystemTableName, type TableColumnsResult, type TableDefinitionLike, type TableIndexInfo, type TableIndexesResult, type TableInfo, type TablePage, type TableReaderLike, type TablesColumnsResult, type TransactionSqlLike, type TriggerContextLike, type TriggerDefinitionLike, type TriggerEventLike, type TriggerOpLike, type TriggerTimingLike, type ValidatorLike, type WhereInput, type WhereSqlStrategy, type WithInput, type WorkflowMetadata, type WorkflowsResult, type WriteEvent, type WriteHook, aggregateSqlFunction, aggregateTableName, applyCdcChanges, applyOnDelete, applySelect, armRestore, assertFlatPredicate, assertReadonly, assertShapeShardable, assertValidClientId, backfillAggregateIndexes, backfillRankIndexes, buildFtsMatch, buildSecurityAudit, buildSeekWhere, clearCapturedMail, coerceAggregateNumber, compileWhereSql, containsRelationPredicate, createDependencyTracker, createShardCtxDb, createSystemReader, decodeCursor, depKey, diffExternalSource, encodeAggregateKey, encodeCursor, encodePartitionKey, ensureAuthMetricsTables, ensureFunctionMetricsTables, ensureMailTable, exportShardRows, exportShardTable, facetColumn, fanOutScalarCounts, foldAggregateTally, ftsTableName, guardWriter, hasTrigger, importShardRows, isRelationPredicate, isSourceDue, liftSourceId, listTables, matchesRankStaticWhere, matchesStaticWhere, materializeExternalRows, mergeWhere, normalizeCountArgument, normalizeIdStructurally, normalizeOrderKeys, parseExportShardArgs, parseImportShardArgs, planAggregateLookup, pullExternalSourceTick, rankTableName, reactiveCacheKey, readAggregateValue, readAuthMetrics, readBookmark, readCapturedMail, readCdcChanges, readExternalSourceBaseline, readFunctionMetricBuckets, readFunctionMetricIndexHits, readFunctionMetrics, readFunctionMetricsTotals, readMigrationStatus, readTablePage, recordAuthEvent, recordCapturedMail, recordFunctionMetric, renderSql, resolveRankPartition, resolveRelationPredicates, resolveWith, runDataMigration, runExternalSourceTick, runReadonlySql, runRowValidators, runShardMigrations, runTriggers, scoreDocument, selectExportTables, selectIndexForAggregate, selectIndexForCount, selectIndexForGroupBy, selectMatchingIds, serveRelationFanout, softDeleteScope, sortColumnName, stableStringify, stringifySearchText, subscriptionListDeltas, throwingScheduler, tokenizeSearch, trimCdcChanges, validateImportRow };
+export { ADMIN_FUNCTIONS, ADMIN_FUNCTION_PREFIX, AGGREGATE_SQL_FUNCTION, AUTH_METRICS_BUCKETS_TABLE, AUTH_METRICS_BUCKET_MS, AUTH_METRICS_BUCKET_RETENTION, AUTH_METRICS_TABLE, type AdvisoriesResult, type AdvisoryFinding, type AggregateIndexDefinitionLike, type AggregateOp, type AggregateOptions, type AggregateResult, type AggregateTally, type ApplyOnDeleteOptions, type AuditEntry, type AuditLogResult, type AuthMetrics, type AuthMetricsBucket, type BroadcastDelta, CDC_LOG_TABLE, type CacheEntry, type CapturedMailRow, type CdcChange, type Clock, type ColumnMeta, type ColumnMetaLike, ConflictError, type CountArgs, CountRlsUnsupportedError, type CtxDbOptions, DATA_MIGRATION_STATE_TABLE, DEFAULT_MAX_RELATION_KEYS, type DataMigrationDocument, type DataMigrationLike, type DataMigrationTransform, type DatabaseWriterLike, type DependencyTracker, type DeployInfo, type ExportRow, type ExportShardAdminArgs, type ExportShardArgs, type ExternalSourceDiffResult, type ExternalSourceLike, FLAGS_FUNCTION_PREFIX, FUNCTION_METRICS_BUCKETS_TABLE, FUNCTION_METRICS_BUCKET_MS, FUNCTION_METRICS_BUCKET_RETENTION, FUNCTION_METRICS_INDEX_TABLE, FUNCTION_METRICS_TABLE, type FacetColumnOptions, type FacetColumnResult, type FacetValue, type FieldOperators, type FlagEvaluation, type FlagsResult, type FunctionCallStat, type FunctionMetricBucket, type FunctionMetricIndexHit, type FunctionStatsResult, type GroupByEntry, type GroupByOptions, type HibernatableWebSocket, type IdGenerator, type ImportError, type ImportShardAdminArgs, type ImportShardArgs, type ImportShardResult, type IncrementalMaterializeResult, type IndexDefinitionLike, type IndexRangeBuilderLike, LogBuffer, type LogEntry, type LogEventInput, type LogLevel, type LogSink, MAIL_RETENTION, MAIL_TABLE, MAX_SQL_ROWS, MIN_ADMIN_TOKEN_LENGTH, MIN_AUTH_SECRET_LENGTH, type MaskColumnMetadata, type MaskPoliciesResult, type MaterializeResult, type MigrationDirection, type MigrationRunResult, type MigrationStatus, type MigrationStatusRow, type MutationDelta, type NestedWith, NotFoundError, NotUniqueError, type OnDeleteActionLike, type OrderByInput, type OrderKey, type PaginationOptions, type PitrBookmarkResult, type PitrRestoreArgs, type PitrRestoreResult, type PitrStorage, type QueryArgs, type QueryPage, type QueueMetadata, type QueuesResult, RANK_TIEBREAK, RELATION_FUNCTION_PREFIX, RLS_UNWRAP_SYMBOL, ROOT_DO_SIZE_WARN_BYTES, ROOT_SHARD_NAME, type RankDirection, type RankIndexDefinitionLike, type RankOptions, type RankPage, type RankPageOptions, type RankPageRow, type RankPageRowKey, type RankResult, type RankSortKeyLike, ReactiveCache, type ReactiveCacheOptions, type ReadHook, type ReadTablePageOptions, type RecordAuthEventInput, type RecordFunctionMetricInput, type RecordMailInput, type RelationDefinitionLike, type RenderedSql, type ResolveRelationPredicatesOptions, type ResolveWithOptions, type RestrictableQueryOptions, type RlsPoliciesResult, type RlsPolicyMetadata, RlsRequiredError, type RlsRoleMetadata, type RpcRequest, type RunDataMigrationOptions, type RunShardApplyCdcArgs, type RunShardApplyCdcResult, type RunShardBulkDeleteArgs, type RunShardBulkDeleteResult, type RunShardExportArgs, type RunShardImportArgs, type RunShardMigrationArgs, type RunShardRankBeforeArgs, type RunShardRankPageArgs, type RunShardWriteArgs, type RunShardWriteResult, type RunTriggersOptions, SCAN_DEP, SESSION_DO_TTL_DEFAULT, SHARD_REGISTRY_DO_NAME, type SchedulableWorkflowReferenceLike, type ScheduledFunctionDoc, type SchedulerLike, type SchemaLike, type SearchFilterBuilderLike, type SecurityAuditResult, type SecurityFinding, type SecurityFindingKind, type SecurityFindingLevel, type SelectMatchingIdsOptions, type ServerDefaultContextLike, SessionDO, type SessionRecord, type SettingEntry, type SettingKind, type SettingsResult, type ShapeSubscriptionQuery, ShardDO, type ShardDOOptions, type ShardDOState, type ShardRankPageResult, ShardRegistryDO, type SocketAttachment, type SortDirection, type SourceClientLike, type SourceCursorLike, type SourceRefresh, type SqlConsoleResult, type SqlCursor, type SqlEngine, type SqlExec, type StorageRuleMetadata, type StorageRulesResult, type StudioFeaturesResult, type SubscriptionEnvelope, type SubscriptionOutcome, type SubscriptionQuery, type SystemDatabaseReader, type SystemDoc, type SystemQuery, type SystemReaderOptions, type SystemReaderSchedulerLike, type SystemReaderStorageLike, type SystemTableName, type TableColumnsResult, type TableDefinitionLike, type TableIndexInfo, type TableIndexesResult, type TableInfo, type TablePage, type TableReaderLike, type TablesColumnsResult, type TransactionSqlLike, type TriggerContextLike, type TriggerDefinitionLike, type TriggerEventLike, type TriggerOpLike, type TriggerTimingLike, type ValidatorLike, type WhereInput, type WhereSqlStrategy, type WithInput, type WorkflowMetadata, type WorkflowsResult, type WriteEvent, type WriteHook, aggregateSqlFunction, aggregateTableName, applyCdcChanges, applyOnDelete, applySelect, armRestore, assertFlatPredicate, assertReadonly, assertShapeShardable, assertValidClientId, backfillAggregateIndexes, backfillRankIndexes, buildFtsMatch, buildSecurityAudit, buildSeekWhere, clearCapturedMail, coerceAggregateNumber, compileWhereSql, containsRelationPredicate, createDependencyTracker, createShardCtxDb, createSystemReader, decodeCursor, depKey, diffExternalSource, encodeAggregateKey, encodeCursor, encodePartitionKey, ensureAuthMetricsTables, ensureFunctionMetricsTables, ensureMailTable, exportShardRows, exportShardTable, facetColumn, fanOutScalarCounts, foldAggregateTally, ftsTableName, guardWriter, hasTrigger, importShardRows, isRelationPredicate, isSoftDeleted, isSourceDue, liftSourceId, listTables, matchesRankStaticWhere, matchesStaticWhere, materializeExternalRows, materializeExternalRowsIncremental, mergeWhere, normalizeCountArgument, normalizeIdStructurally, normalizeOrderKeys, parseExportShardArgs, parseImportShardArgs, planAggregateLookup, pullExternalSourceIncrementalTick, pullExternalSourceTick, rankTableName, reactiveCacheKey, readAggregateValue, readAuthMetrics, readBookmark, readCapturedMail, readCdcChanges, readExternalSourceBaseline, readFunctionMetricBuckets, readFunctionMetricIndexHits, readFunctionMetrics, readFunctionMetricsTotals, readMigrationStatus, readTablePage, recordAuthEvent, recordCapturedMail, recordFunctionMetric, renderSql, resolveRankPartition, resolveRelationPredicates, resolveWith, runDataMigration, runExternalSourceTick, runReadonlySql, runRowValidators, runShardMigrations, runTriggers, scoreDocument, selectExportTables, selectIndexForAggregate, selectIndexForCount, selectIndexForGroupBy, selectMatchingIds, serveRelationFanout, softDeleteScope, sortColumnName, stableStringify, stableWireKey, stringifySearchText, subscriptionListDeltas, throwingScheduler, tokenizeSearch, trimCdcChanges, validateImportRow };

package/dist/index.d.ts

@@ -614,6 +614,13 @@ declare const rankTableName: (table: string, indexName: string) => string;
 * - `rowId` === `doc._id`, the `__id__` tiebreak.
 */
 declare const stableStringify: (value: unknown) => string;
+/**
+* Stable cache/dedup key for a (possibly wire-typed) `value`: the sorted-key
+* stable encoding of its wire form. Byte-identical to `stableStringify(value)`
+* for pure-JSON values; deterministic tagged tokens for `bigint`/`Date`/`Map`/
+* `Set`/`URL`/bytes; throws a `TypeError` on values the wire refuses.
+*/
+declare const stableWireKey: (value: unknown) => string;
 /** A single memoized result, the deps it read, and any active subscribers. */
 interface CacheEntry {
   /** Approximate serialized size of `result`, charged against `maxBytes`. */
@@ -2400,6 +2407,11 @@ interface MaterializeResult {
   /** `id → projected-value JSON` — the post-tick membership, to feed back as `baseline` next tick. */
   nextBaseline: Map<string, string>;
 }
+/** The outcome of one incremental materialize pass. No baseline: incremental applies only the pulled slice, never a full-membership diff. */
+interface IncrementalMaterializeResult {
+  /** Number of `CdcChange`s applied (upserts + tombstone deletes) for the pulled slice. */
+  applied: number;
+}
 /**
 * Diff `pulled` against `baseline` and apply the delta to `writer`. Returns the
 * applied count and the next baseline. A steady-state tick (membership unchanged)
@@ -2410,6 +2422,36 @@ declare const materializeExternalRows: (writer: DatabaseWriterLike, pulled: Read
   table: string;
 }) => Promise<MaterializeResult>;
 /**
+* Apply an **incremental** slice (plan 136): the freshly-pulled rows changed since
+* the watermark, upsert-only. Unlike {@link materializeExternalRows} this reads no
+* baseline and never diffs the full membership — an absent row means "unchanged
+* since the watermark", NOT "deleted". Each pulled row is projected with the SAME
+* {@link projectExternalSourceRow} full-pull uses, so an incrementally-upserted row
+* is byte-identical to how the next reconcile sweep's full-pull would store it (no
+* spurious update on reconcile).
+*
+* Delete visibility comes from `deletedIds` — the ids the caller resolved from the
+* source's soft-delete tombstone column. Every other pulled row is an `insert`,
+* which {@link applyCdcChanges} upserts (insert, or replace on conflict), so a
+* changed existing row is updated and a genuinely new row is inserted without the
+* caller tracking which is which.
+*
+* **Content short-circuit.** An incremental cursor query uses `>= watermark` (so
+* rows sharing the boundary value are never skipped), which means a steady-state
+* tick re-pulls the boundary row(s) unchanged. Blindly upserting them would append
+* a `__cdc_log` entry, broadcast a spurious `update` to every `defineShape`
+* subscriber, re-run search/aggregate/rank sync, and fire `onWrite` (a Vectorize
+* re-embed = real cost) on every tick — and `replace` would reset `_creationTime`.
+* So each row is diffed against its stored projection (the SAME
+* {@link projectExternalSourceRow} + {@link stableStringify} full-pull uses) and
+* skipped when byte-identical — mirroring the full-pull diff's steady-state no-op.
+*/
+declare const materializeExternalRowsIncremental: (writer: DatabaseWriterLike, pulled: ReadonlyArray<Record<string, unknown>>, options: {
+  columns?: ReadonlyArray<string>;
+  deletedIds?: ReadonlySet<string>;
+  table: string;
+}) => Promise<IncrementalMaterializeResult>;
+/**
 * Read the materialized table's current membership as the canonical full-pull
 * baseline (`id → canonical JSON`). Reuses the shape scanner (`selectShapeRows`)
 * and the SAME {@link projectExternalSourceRow} + {@link stableStringify} the diff
@@ -2438,14 +2480,23 @@ interface SourceClientLike {
 type SourceRefresh = "manual" | {
   everyMs: number;
 };
+/** The incremental cursor config (plan 136): the watermark column + the watermark-parameterized pull query. */
+interface SourceCursorLike {
+  column: string;
+  query: string;
+}
 /** The runtime `.source(...)` config the poll loop reads — a structural mirror of `@lunora/server`'s `ExternalSourceDefinition` (only the fields the tick uses). */
 interface ExternalSourceLike {
   binding: string;
   columns?: ReadonlyArray<string>;
+  cursor?: SourceCursorLike;
   idColumn?: string;
   map?: (row: Record<string, unknown>) => Record<string, unknown>;
+  mode?: string;
   query: string;
+  reconcileEveryMs?: number;
   refresh?: SourceRefresh;
+  softDeleteColumn?: string;
   tenantBy?: (shardKey: string) => ReadonlyArray<unknown>;
 }
 /**
@@ -2475,6 +2526,39 @@ declare const isSourceDue: (refresh: SourceRefresh | undefined, lastPolledMs: nu
 */
 declare const pullExternalSourceTick: (sql: SqlExec, writer: DatabaseWriterLike, client: SourceClientLike, table: string, source: ExternalSourceLike, shardKey: string) => Promise<MaterializeResult>;
 /**
+* Whether an upstream row is a soft-delete tombstone under `column`. A set
+* `deleted_at` (any non-null value, e.g. a timestamp), an `is_deleted = true`, or a
+* non-zero flag all read as deleted; `null` / `undefined` / `false` / `0` mean
+* live. Note an **empty string** reads as deleted (`"" !== 0`), so an upstream that
+* clears the column to `""` rather than `NULL` for a live row would mis-signal —
+* use `NULL` for live rows. The incremental query MUST return tombstoned rows
+* (don't filter `WHERE deleted_at IS NULL`) or the delete is never observed.
+*/
+declare const isSoftDeleted: (row: Record<string, unknown>, column: string) => boolean;
+/**
+* Run one **incremental** tick (plan 136). Reads the durable watermark for
+* `(table, shardKey)`; on the first ever poll or when the `reconcileEveryMs` sweep
+* is due it runs a **full-pull** (seed/GC: {@link runExternalSourceTick} observes
+* deletes and re-establishes membership), otherwise it pulls only rows past the
+* watermark via `cursor.query` and upserts them ({@link materializeExternalRowsIncremental},
+* tombstones → deletes). Either way it advances the watermark to the max cursor
+* value seen and persists it (and the reconcile timestamp).
+*
+* **Crash safety** is by ordering + idempotency, NOT an atomic transaction across
+* the two write channels (the apply goes through the `writer`; the watermark write
+* is a raw `sql` write): the watermark advances only AFTER a fully-applied slice,
+* so a crash between the apply and the watermark write leaves the watermark behind
+* and the next tick re-pulls the same `>= watermark` slice — which the upsert
+* short-circuits (unchanged rows) or re-applies idempotently. It only ever replays,
+* never skips (same self-healing argument as `advanceClientWatermark`).
+*
+* Requires `source.cursor` (validated at `defineSchema` for incremental mode); a
+* missing cursor throws rather than silently degrading to a stuck watermark.
+*/
+declare const pullExternalSourceIncrementalTick: (sql: SqlExec, writer: DatabaseWriterLike, client: SourceClientLike, table: string, source: ExternalSourceLike, shardKey: string, nowMs: number) => Promise<{
+  applied: number;
+}>;
+/**
 * Reserved `functionPath` prefix for admin introspection RPCs. These travel
 * over the same `/_lunora/rpc` → shard `/rpc` path as ordinary functions, but
 * `ShardDO` intercepts them before user dispatch and serves them from the
@@ -6431,7 +6515,12 @@ declare abstract class ShardDO {
   * server logs, browser history, and `Referer` headers on any
   * subresource the upgrade page loads after the handshake. Use a
   * short-lived rotating token in production rather than a long-lived
-  * secret.
+  * secret — for the ADMIN credential specifically, the worker mints one
+  * (`POST /_lunora/admin/ws-token`) and {@link isAdminSocket} accepts it, so
+  * the master `LUNORA_ADMIN_TOKEN` never rides the URL.
+  *
+  * Async because the admin fallback ({@link isAdminSocket}) verifies the
+  * ephemeral sub-token with WebCrypto HMAC.
   */
   private isUpgradeAllowed;
   /**
@@ -6442,10 +6531,20 @@ declare abstract class ShardDO {
   */
   private suppliedWsToken;
   /**
-  * Whether the upgrade presented a token matching `LUNORA_ADMIN_TOKEN`,
-  * constant-time compared. Closed (returns `false`) when the admin token is
-  * unset, mirroring `isAdminAuthorized` for the HTTP path so admin
-  * streaming is opt-in rather than exposed by default.
+  * Whether the upgrade presented an admin credential: the master
+  * `LUNORA_ADMIN_TOKEN` (constant-time compared) or a short-lived sub-token
+  * the worker minted with it (`POST /_lunora/admin/ws-token` —
+  * HMAC-verified statelessly here, since both isolates hold the master token
+  * in `env`). The ephemeral token is what the studio sends in `?token=`, so
+  * the master credential stays out of URLs/logs. Closed (resolves `false`)
+  * when the admin token is unset, mirroring `isAdminAuthorized` for the HTTP
+  * path so admin streaming is opt-in rather than exposed by default.
+  *
+  * Enforcement: with `LUNORA_REQUIRE_EPHEMERAL_WS_TOKEN` set
+  * (`1`/`true`/`on`/`yes`/`enabled`), a raw master token in the
+  * `?token=` query parameter is rejected — the query string is exactly
+  * where it leaks. The `Authorization` header path still takes the master
+  * token: browsers can't set it on a WS upgrade, so it never rides a URL.
   */
   private isAdminSocket;
   /**
@@ -6682,4 +6781,4 @@ interface WhereSqlStrategy {
 * `undefined` when the input imposes no constraint (empty `where`).
 */
 declare const compileWhereSql: (where: WhereInput | undefined, strategy: WhereSqlStrategy) => SQL | undefined;
-export { ADMIN_FUNCTIONS, ADMIN_FUNCTION_PREFIX, AGGREGATE_SQL_FUNCTION, AUTH_METRICS_BUCKETS_TABLE, AUTH_METRICS_BUCKET_MS, AUTH_METRICS_BUCKET_RETENTION, AUTH_METRICS_TABLE, type AdvisoriesResult, type AdvisoryFinding, type AggregateIndexDefinitionLike, type AggregateOp, type AggregateOptions, type AggregateResult, type AggregateTally, type ApplyOnDeleteOptions, type AuditEntry, type AuditLogResult, type AuthMetrics, type AuthMetricsBucket, type BroadcastDelta, CDC_LOG_TABLE, type CacheEntry, type CapturedMailRow, type CdcChange, type Clock, type ColumnMeta, type ColumnMetaLike, ConflictError, type CountArgs, CountRlsUnsupportedError, type CtxDbOptions, DATA_MIGRATION_STATE_TABLE, DEFAULT_MAX_RELATION_KEYS, type DataMigrationDocument, type DataMigrationLike, type DataMigrationTransform, type DatabaseWriterLike, type DependencyTracker, type DeployInfo, type ExportRow, type ExportShardAdminArgs, type ExportShardArgs, type ExternalSourceDiffResult, type ExternalSourceLike, FLAGS_FUNCTION_PREFIX, FUNCTION_METRICS_BUCKETS_TABLE, FUNCTION_METRICS_BUCKET_MS, FUNCTION_METRICS_BUCKET_RETENTION, FUNCTION_METRICS_INDEX_TABLE, FUNCTION_METRICS_TABLE, type FacetColumnOptions, type FacetColumnResult, type FacetValue, type FieldOperators, type FlagEvaluation, type FlagsResult, type FunctionCallStat, type FunctionMetricBucket, type FunctionMetricIndexHit, type FunctionStatsResult, type GroupByEntry, type GroupByOptions, type HibernatableWebSocket, type IdGenerator, type ImportError, type ImportShardAdminArgs, type ImportShardArgs, type ImportShardResult, type IndexDefinitionLike, type IndexRangeBuilderLike, LogBuffer, type LogEntry, type LogEventInput, type LogLevel, type LogSink, MAIL_RETENTION, MAIL_TABLE, MAX_SQL_ROWS, MIN_ADMIN_TOKEN_LENGTH, MIN_AUTH_SECRET_LENGTH, type MaskColumnMetadata, type MaskPoliciesResult, type MaterializeResult, type MigrationDirection, type MigrationRunResult, type MigrationStatus, type MigrationStatusRow, type MutationDelta, type NestedWith, NotFoundError, NotUniqueError, type OnDeleteActionLike, type OrderByInput, type OrderKey, type PaginationOptions, type PitrBookmarkResult, type PitrRestoreArgs, type PitrRestoreResult, type PitrStorage, type QueryArgs, type QueryPage, type QueueMetadata, type QueuesResult, RANK_TIEBREAK, RELATION_FUNCTION_PREFIX, RLS_UNWRAP_SYMBOL, ROOT_DO_SIZE_WARN_BYTES, ROOT_SHARD_NAME, type RankDirection, type RankIndexDefinitionLike, type RankOptions, type RankPage, type RankPageOptions, type RankPageRow, type RankPageRowKey, type RankResult, type RankSortKeyLike, ReactiveCache, type ReactiveCacheOptions, type ReadHook, type ReadTablePageOptions, type RecordAuthEventInput, type RecordFunctionMetricInput, type RecordMailInput, type RelationDefinitionLike, type RenderedSql, type ResolveRelationPredicatesOptions, type ResolveWithOptions, type RestrictableQueryOptions, type RlsPoliciesResult, type RlsPolicyMetadata, RlsRequiredError, type RlsRoleMetadata, type RpcRequest, type RunDataMigrationOptions, type RunShardApplyCdcArgs, type RunShardApplyCdcResult, type RunShardBulkDeleteArgs, type RunShardBulkDeleteResult, type RunShardExportArgs, type RunShardImportArgs, type RunShardMigrationArgs, type RunShardRankBeforeArgs, type RunShardRankPageArgs, type RunShardWriteArgs, type RunShardWriteResult, type RunTriggersOptions, SCAN_DEP, SESSION_DO_TTL_DEFAULT, SHARD_REGISTRY_DO_NAME, type SchedulableWorkflowReferenceLike, type ScheduledFunctionDoc, type SchedulerLike, type SchemaLike, type SearchFilterBuilderLike, type SecurityAuditResult, type SecurityFinding, type SecurityFindingKind, type SecurityFindingLevel, type SelectMatchingIdsOptions, type ServerDefaultContextLike, SessionDO, type SessionRecord, type SettingEntry, type SettingKind, type SettingsResult, type ShapeSubscriptionQuery, ShardDO, type ShardDOOptions, type ShardDOState, type ShardRankPageResult, ShardRegistryDO, type SocketAttachment, type SortDirection, type SourceClientLike, type SourceRefresh, type SqlConsoleResult, type SqlCursor, type SqlEngine, type SqlExec, type StorageRuleMetadata, type StorageRulesResult, type StudioFeaturesResult, type SubscriptionEnvelope, type SubscriptionOutcome, type SubscriptionQuery, type SystemDatabaseReader, type SystemDoc, type SystemQuery, type SystemReaderOptions, type SystemReaderSchedulerLike, type SystemReaderStorageLike, type SystemTableName, type TableColumnsResult, type TableDefinitionLike, type TableIndexInfo, type TableIndexesResult, type TableInfo, type TablePage, type TableReaderLike, type TablesColumnsResult, type TransactionSqlLike, type TriggerContextLike, type TriggerDefinitionLike, type TriggerEventLike, type TriggerOpLike, type TriggerTimingLike, type ValidatorLike, type WhereInput, type WhereSqlStrategy, type WithInput, type WorkflowMetadata, type WorkflowsResult, type WriteEvent, type WriteHook, aggregateSqlFunction, aggregateTableName, applyCdcChanges, applyOnDelete, applySelect, armRestore, assertFlatPredicate, assertReadonly, assertShapeShardable, assertValidClientId, backfillAggregateIndexes, backfillRankIndexes, buildFtsMatch, buildSecurityAudit, buildSeekWhere, clearCapturedMail, coerceAggregateNumber, compileWhereSql, containsRelationPredicate, createDependencyTracker, createShardCtxDb, createSystemReader, decodeCursor, depKey, diffExternalSource, encodeAggregateKey, encodeCursor, encodePartitionKey, ensureAuthMetricsTables, ensureFunctionMetricsTables, ensureMailTable, exportShardRows, exportShardTable, facetColumn, fanOutScalarCounts, foldAggregateTally, ftsTableName, guardWriter, hasTrigger, importShardRows, isRelationPredicate, isSourceDue, liftSourceId, listTables, matchesRankStaticWhere, matchesStaticWhere, materializeExternalRows, mergeWhere, normalizeCountArgument, normalizeIdStructurally, normalizeOrderKeys, parseExportShardArgs, parseImportShardArgs, planAggregateLookup, pullExternalSourceTick, rankTableName, reactiveCacheKey, readAggregateValue, readAuthMetrics, readBookmark, readCapturedMail, readCdcChanges, readExternalSourceBaseline, readFunctionMetricBuckets, readFunctionMetricIndexHits, readFunctionMetrics, readFunctionMetricsTotals, readMigrationStatus, readTablePage, recordAuthEvent, recordCapturedMail, recordFunctionMetric, renderSql, resolveRankPartition, resolveRelationPredicates, resolveWith, runDataMigration, runExternalSourceTick, runReadonlySql, runRowValidators, runShardMigrations, runTriggers, scoreDocument, selectExportTables, selectIndexForAggregate, selectIndexForCount, selectIndexForGroupBy, selectMatchingIds, serveRelationFanout, softDeleteScope, sortColumnName, stableStringify, stringifySearchText, subscriptionListDeltas, throwingScheduler, tokenizeSearch, trimCdcChanges, validateImportRow };
+export { ADMIN_FUNCTIONS, ADMIN_FUNCTION_PREFIX, AGGREGATE_SQL_FUNCTION, AUTH_METRICS_BUCKETS_TABLE, AUTH_METRICS_BUCKET_MS, AUTH_METRICS_BUCKET_RETENTION, AUTH_METRICS_TABLE, type AdvisoriesResult, type AdvisoryFinding, type AggregateIndexDefinitionLike, type AggregateOp, type AggregateOptions, type AggregateResult, type AggregateTally, type ApplyOnDeleteOptions, type AuditEntry, type AuditLogResult, type AuthMetrics, type AuthMetricsBucket, type BroadcastDelta, CDC_LOG_TABLE, type CacheEntry, type CapturedMailRow, type CdcChange, type Clock, type ColumnMeta, type ColumnMetaLike, ConflictError, type CountArgs, CountRlsUnsupportedError, type CtxDbOptions, DATA_MIGRATION_STATE_TABLE, DEFAULT_MAX_RELATION_KEYS, type DataMigrationDocument, type DataMigrationLike, type DataMigrationTransform, type DatabaseWriterLike, type DependencyTracker, type DeployInfo, type ExportRow, type ExportShardAdminArgs, type ExportShardArgs, type ExternalSourceDiffResult, type ExternalSourceLike, FLAGS_FUNCTION_PREFIX, FUNCTION_METRICS_BUCKETS_TABLE, FUNCTION_METRICS_BUCKET_MS, FUNCTION_METRICS_BUCKET_RETENTION, FUNCTION_METRICS_INDEX_TABLE, FUNCTION_METRICS_TABLE, type FacetColumnOptions, type FacetColumnResult, type FacetValue, type FieldOperators, type FlagEvaluation, type FlagsResult, type FunctionCallStat, type FunctionMetricBucket, type FunctionMetricIndexHit, type FunctionStatsResult, type GroupByEntry, type GroupByOptions, type HibernatableWebSocket, type IdGenerator, type ImportError, type ImportShardAdminArgs, type ImportShardArgs, type ImportShardResult, type IncrementalMaterializeResult, type IndexDefinitionLike, type IndexRangeBuilderLike, LogBuffer, type LogEntry, type LogEventInput, type LogLevel, type LogSink, MAIL_RETENTION, MAIL_TABLE, MAX_SQL_ROWS, MIN_ADMIN_TOKEN_LENGTH, MIN_AUTH_SECRET_LENGTH, type MaskColumnMetadata, type MaskPoliciesResult, type MaterializeResult, type MigrationDirection, type MigrationRunResult, type MigrationStatus, type MigrationStatusRow, type MutationDelta, type NestedWith, NotFoundError, NotUniqueError, type OnDeleteActionLike, type OrderByInput, type OrderKey, type PaginationOptions, type PitrBookmarkResult, type PitrRestoreArgs, type PitrRestoreResult, type PitrStorage, type QueryArgs, type QueryPage, type QueueMetadata, type QueuesResult, RANK_TIEBREAK, RELATION_FUNCTION_PREFIX, RLS_UNWRAP_SYMBOL, ROOT_DO_SIZE_WARN_BYTES, ROOT_SHARD_NAME, type RankDirection, type RankIndexDefinitionLike, type RankOptions, type RankPage, type RankPageOptions, type RankPageRow, type RankPageRowKey, type RankResult, type RankSortKeyLike, ReactiveCache, type ReactiveCacheOptions, type ReadHook, type ReadTablePageOptions, type RecordAuthEventInput, type RecordFunctionMetricInput, type RecordMailInput, type RelationDefinitionLike, type RenderedSql, type ResolveRelationPredicatesOptions, type ResolveWithOptions, type RestrictableQueryOptions, type RlsPoliciesResult, type RlsPolicyMetadata, RlsRequiredError, type RlsRoleMetadata, type RpcRequest, type RunDataMigrationOptions, type RunShardApplyCdcArgs, type RunShardApplyCdcResult, type RunShardBulkDeleteArgs, type RunShardBulkDeleteResult, type RunShardExportArgs, type RunShardImportArgs, type RunShardMigrationArgs, type RunShardRankBeforeArgs, type RunShardRankPageArgs, type RunShardWriteArgs, type RunShardWriteResult, type RunTriggersOptions, SCAN_DEP, SESSION_DO_TTL_DEFAULT, SHARD_REGISTRY_DO_NAME, type SchedulableWorkflowReferenceLike, type ScheduledFunctionDoc, type SchedulerLike, type SchemaLike, type SearchFilterBuilderLike, type SecurityAuditResult, type SecurityFinding, type SecurityFindingKind, type SecurityFindingLevel, type SelectMatchingIdsOptions, type ServerDefaultContextLike, SessionDO, type SessionRecord, type SettingEntry, type SettingKind, type SettingsResult, type ShapeSubscriptionQuery, ShardDO, type ShardDOOptions, type ShardDOState, type ShardRankPageResult, ShardRegistryDO, type SocketAttachment, type SortDirection, type SourceClientLike, type SourceCursorLike, type SourceRefresh, type SqlConsoleResult, type SqlCursor, type SqlEngine, type SqlExec, type StorageRuleMetadata, type StorageRulesResult, type StudioFeaturesResult, type SubscriptionEnvelope, type SubscriptionOutcome, type SubscriptionQuery, type SystemDatabaseReader, type SystemDoc, type SystemQuery, type SystemReaderOptions, type SystemReaderSchedulerLike, type SystemReaderStorageLike, type SystemTableName, type TableColumnsResult, type TableDefinitionLike, type TableIndexInfo, type TableIndexesResult, type TableInfo, type TablePage, type TableReaderLike, type TablesColumnsResult, type TransactionSqlLike, type TriggerContextLike, type TriggerDefinitionLike, type TriggerEventLike, type TriggerOpLike, type TriggerTimingLike, type ValidatorLike, type WhereInput, type WhereSqlStrategy, type WithInput, type WorkflowMetadata, type WorkflowsResult, type WriteEvent, type WriteHook, aggregateSqlFunction, aggregateTableName, applyCdcChanges, applyOnDelete, applySelect, armRestore, assertFlatPredicate, assertReadonly, assertShapeShardable, assertValidClientId, backfillAggregateIndexes, backfillRankIndexes, buildFtsMatch, buildSecurityAudit, buildSeekWhere, clearCapturedMail, coerceAggregateNumber, compileWhereSql, containsRelationPredicate, createDependencyTracker, createShardCtxDb, createSystemReader, decodeCursor, depKey, diffExternalSource, encodeAggregateKey, encodeCursor, encodePartitionKey, ensureAuthMetricsTables, ensureFunctionMetricsTables, ensureMailTable, exportShardRows, exportShardTable, facetColumn, fanOutScalarCounts, foldAggregateTally, ftsTableName, guardWriter, hasTrigger, importShardRows, isRelationPredicate, isSoftDeleted, isSourceDue, liftSourceId, listTables, matchesRankStaticWhere, matchesStaticWhere, materializeExternalRows, materializeExternalRowsIncremental, mergeWhere, normalizeCountArgument, normalizeIdStructurally, normalizeOrderKeys, parseExportShardArgs, parseImportShardArgs, planAggregateLookup, pullExternalSourceIncrementalTick, pullExternalSourceTick, rankTableName, reactiveCacheKey, readAggregateValue, readAuthMetrics, readBookmark, readCapturedMail, readCdcChanges, readExternalSourceBaseline, readFunctionMetricBuckets, readFunctionMetricIndexHits, readFunctionMetrics, readFunctionMetricsTotals, readMigrationStatus, readTablePage, recordAuthEvent, recordCapturedMail, recordFunctionMetric, renderSql, resolveRankPartition, resolveRelationPredicates, resolveWith, runDataMigration, runExternalSourceTick, runReadonlySql, runRowValidators, runShardMigrations, runTriggers, scoreDocument, selectExportTables, selectIndexForAggregate, selectIndexForCount, selectIndexForGroupBy, selectMatchingIds, serveRelationFanout, softDeleteScope, sortColumnName, stableStringify, stableWireKey, stringifySearchText, subscriptionListDeltas, throwingScheduler, tokenizeSearch, trimCdcChanges, validateImportRow };

package/dist/index.mjs

@@ -7,9 +7,9 @@ export { NotUniqueError, assertValidClientId, createShardCtxDb, normalizeIdStruc
 export { DATA_MIGRATION_STATE_TABLE, readMigrationStatus, runDataMigration } from './packem_shared/DATA_MIGRATION_STATE_TABLE-CYwBpyTr.mjs';
 export { SCAN_DEP, createDependencyTracker, depKey } from './packem_shared/SCAN_DEP-DLJF8dsj.mjs';
 export { renderSql } from './packem_shared/renderSql-D6eUcn2N.mjs';
-export { diffExternalSource } from './packem_shared/diffExternalSource-Cx9HUPJj.mjs';
-export { materializeExternalRows, readExternalSourceBaseline, runExternalSourceTick } from './packem_shared/materializeExternalRows-CTqZisSC.mjs';
-export { isSourceDue, liftSourceId, pullExternalSourceTick } from './packem_shared/isSourceDue-CYkt7Ru8.mjs';
+export { diffExternalSource } from './packem_shared/diffExternalSource-CovHfdyo.mjs';
+export { materializeExternalRows, materializeExternalRowsIncremental, readExternalSourceBaseline, runExternalSourceTick } from './packem_shared/materializeExternalRows-FyA5Rwn4.mjs';
+export { isSoftDeleted, isSourceDue, liftSourceId, pullExternalSourceIncrementalTick, pullExternalSourceTick } from './packem_shared/isSoftDeleted-i5kKh6Up.mjs';
 export { FUNCTION_METRICS_BUCKETS_TABLE, FUNCTION_METRICS_BUCKET_MS, FUNCTION_METRICS_BUCKET_RETENTION, FUNCTION_METRICS_INDEX_TABLE, FUNCTION_METRICS_TABLE, ensureFunctionMetricsTables, readFunctionMetricBuckets, readFunctionMetricIndexHits, readFunctionMetrics, readFunctionMetricsTotals, recordFunctionMetric } from './packem_shared/FUNCTION_METRICS_BUCKETS_TABLE-UDNVD7FS.mjs';
 export { ADMIN_FUNCTIONS, ADMIN_FUNCTION_PREFIX, FLAGS_FUNCTION_PREFIX, RELATION_FUNCTION_PREFIX, facetColumn, listTables, readTablePage, selectMatchingIds } from './packem_shared/ADMIN_FUNCTIONS-CAHLZMj8.mjs';
 export { LogBuffer } from './packem_shared/LogBuffer-B_Ezju_N.mjs';
@@ -18,7 +18,7 @@ export { default as NotFoundError } from './packem_shared/NotFoundError-C70b9hLw
 export { armRestore, readBookmark } from './packem_shared/armRestore-4Px61hHS.mjs';
 export { applySelect, buildSeekWhere, decodeCursor, encodeCursor, normalizeOrderKeys, softDeleteScope } from './packem_shared/applySelect-WQY8m62C.mjs';
 export { RANK_TIEBREAK, encodePartitionKey, matchesRankStaticWhere, rankTableName, resolveRankPartition, sortColumnName } from './packem_shared/RANK_TIEBREAK-CXhdcA1o.mjs';
-export { ReactiveCache, reactiveCacheKey } from './packem_shared/ReactiveCache-BYlSGY0N.mjs';
+export { ReactiveCache, reactiveCacheKey } from './packem_shared/ReactiveCache-DnSvbjil.mjs';
 export { serveRelationFanout } from './packem_shared/serveRelationFanout-BgaNg3Hu.mjs';
 export { DEFAULT_MAX_RELATION_KEYS, assertFlatPredicate, assertShapeShardable, containsRelationPredicate, isRelationPredicate, resolveRelationPredicates } from './packem_shared/DEFAULT_MAX_RELATION_KEYS-BEan1CRD.mjs';
 export { applyOnDelete, fanOutScalarCounts, resolveWith, runRowValidators } from './packem_shared/applyOnDelete-BXSq3S70.mjs';
@@ -26,9 +26,9 @@ export { RLS_UNWRAP_SYMBOL, RlsRequiredError, guardWriter } from './packem_share
 export { buildFtsMatch, ftsTableName, scoreDocument, stringifySearchText, tokenizeSearch } from './packem_shared/buildFtsMatch-BLEMawrp.mjs';
 export { M as MIN_ADMIN_TOKEN_LENGTH, a as MIN_AUTH_SECRET_LENGTH, b as buildSecurityAudit } from './packem_shared/security-audit-CucgBice.mjs';
 export { SESSION_DO_TTL_DEFAULT, SessionDO } from './packem_shared/SESSION_DO_TTL_DEFAULT-BnSKgVO4.mjs';
-export { ROOT_DO_SIZE_WARN_BYTES, ROOT_SHARD_NAME, ShardDO } from './packem_shared/ROOT_DO_SIZE_WARN_BYTES-BA8QOChj.mjs';
+export { ROOT_DO_SIZE_WARN_BYTES, ROOT_SHARD_NAME, ShardDO } from './packem_shared/ROOT_DO_SIZE_WARN_BYTES-BWz51mpB.mjs';
 export { SHARD_REGISTRY_DO_NAME, ShardRegistryDO } from './packem_shared/SHARD_REGISTRY_DO_NAME-D99roc-r.mjs';
-export { MAX_SQL_ROWS, assertReadonly, runReadonlySql } from './packem_shared/MAX_SQL_ROWS-D57CJaT9.mjs';
+export { MAX_SQL_ROWS, assertReadonly, runReadonlySql } from './packem_shared/MAX_SQL_ROWS-iFAA8FbD.mjs';
 export { createSystemReader } from './packem_shared/createSystemReader-D12eNH13.mjs';
 export { ConflictError } from './packem_shared/ConflictError-CLoq37xH.mjs';
 export { hasTrigger, runTriggers } from './packem_shared/hasTrigger-5N6_Fx0A.mjs';
@@ -36,5 +36,6 @@ export { compileWhereSql } from './packem_shared/compileWhereSql-DE6yfRcQ.mjs';
 export { CDC_LOG_TABLE, applyCdcChanges, readCdcChanges, trimCdcChanges } from './packem_shared/CDC_LOG_TABLE-DjJEHiM2.mjs';
 export { backfillAggregateIndexes, backfillRankIndexes } from './packem_shared/backfillAggregateIndexes-DDoT-UUI.mjs';
 export { runShardMigrations } from './packem_shared/runShardMigrations-BGx4v2B6.mjs';
-export { stableStringify } from './packem_shared/stableStringify-MydiuScU.mjs';
-export { s as subscriptionListDeltas } from './packem_shared/subscription-delivery-CWigSEr3.mjs';
+export { stableStringify } from './packem_shared/stableStringify-mC40mZts.mjs';
+export { stableWireKey } from './packem_shared/stableWireKey-DKuXO7T5.mjs';
+export { subscriptionListDeltas } from './packem_shared/subscriptionListDeltas-CT76bYny.mjs';

package/dist/packem_shared/{MAX_SQL_ROWS-D57CJaT9.mjs → MAX_SQL_ROWS-iFAA8FbD.mjs}

@@ -3,9 +3,39 @@ import { LunoraError } from '@lunora/errors';
 const MAX_SQL_ROWS = 1e3;
 const READONLY_LEAD = /^(?:explain\s+(?:query\s+plan\s+)?)?(?:select|with)\b/iu;
 const FORBIDDEN_KEYWORD = /\b(?:alter|attach|create|delete|detach|drop|insert|pragma|reindex|replace|truncate|update|vacuum)\b/iu;
-const LEADING_NOISE = /^(?:\s|--[^\n]*\n?|\/\*[\s\S]*?\*\/)+/u;
 const TRAILING_SEMICOLON = /;\s*$/u;
-const stripLeading = (sql) => sql.replace(LEADING_NOISE, "");
+const WHITESPACE = /\s/u;
+const skipLineComment = (sql, from) => {
+  let index = from + 2;
+  while (index < sql.length && sql[index] !== "\n") {
+    index += 1;
+  }
+  return index;
+};
+const skipBlockComment = (sql, from) => {
+  const close = sql.indexOf("*/", from + 2);
+  return close === -1 ? -1 : close + 2;
+};
+const stripLeading = (sql) => {
+  let index = 0;
+  while (index < sql.length) {
+    const char = sql[index];
+    if (char !== void 0 && WHITESPACE.test(char)) {
+      index += 1;
+    } else if (char === "-" && sql[index + 1] === "-") {
+      index = skipLineComment(sql, index);
+    } else if (char === "/" && sql[index + 1] === "*") {
+      const next = skipBlockComment(sql, index);
+      if (next === -1) {
+        break;
+      }
+      index = next;
+    } else {
+      break;
+    }
+  }
+  return sql.slice(index);
+};
 const sqlError = (message, code) => new LunoraError(code, message, { status: 400 });
 const assertReadonly = (query) => {
   const trimmed = stripLeading(query).trim();