@nifrajs/core 4.0.2 → 5.1.0

package/src/capabilities.ts

@@ -154,6 +154,8 @@ export interface RouteCapabilityEvidence {
   /** True only when the route's reachable module graph was actually scanned. */
   readonly covered: boolean
   readonly evidence: readonly CapabilityEvidence[]
+  /** The probable cause of an uncovered route, when the collector can tell. */
+  readonly uncoveredReason?: string
 }
 
 export interface CapabilityEvidenceSet {
@@ -195,6 +197,9 @@ export interface AssuredCapabilityRoute {
   readonly covered: boolean
   /** Highest data-sensitivity the response carries, when the route declares it. */
   readonly classification?: DataClassification
+  /** `"declared"` for a route an opaque mount states it serves: listed on the mount's word, never
+   * analyzed. Absent on an analyzed route. */
+  readonly analysis?: "declared"
 }
 
 /**
@@ -225,6 +230,7 @@ export interface CapabilitySnapshotRoute {
   readonly unproven: readonly string[]
   /** Recorded so a route that starts returning `pii`/`secret` flips the lockfile and forces a review. */
   readonly classification?: DataClassification
+  readonly analysis?: "declared"
 }
 
 export interface CapabilitySnapshot {
@@ -412,7 +418,7 @@ export function evaluateCapabilityAssurance(
         code: "provenance-uncovered",
         method: route.method,
         path: route.path,
-        message: `${route.method} ${route.path} has no static provenance coverage`,
+        message: `${route.method} ${route.path} has no static provenance coverage${supplied?.uncoveredReason === undefined ? "" : ` - ${supplied.uncoveredReason}`}`,
       })
     }
     // A safe-method route that REACHES a domain write without declaring it used to draw two findings
@@ -513,6 +519,45 @@ export function evaluateCapabilityAssurance(
   for (const mount of evidenceSet.mounts ?? reflectMounts(source)) {
     if (mount.opaque !== undefined) {
       gaps.push(Object.freeze({ kind: "opaque-mount", path: mount.path, reason: mount.opaque }))
+      for (const route of mount.routes ?? []) {
+        // Only what a declaration alone can contradict: an id the policy lacks, or a write a safe
+        // method can never carry. Evidence-backed checks have nothing to read here.
+        for (const id of route.capabilities) {
+          const definition = definitions.get(id)
+          if (definition === undefined) {
+            findings.push({
+              code: "unknown-capability",
+              method: route.method,
+              path: route.path,
+              capability: id,
+              message: `${route.method} ${route.path} (declared by mount ${mount.path}) declares unknown capability ${id}`,
+            })
+          } else if (
+            SAFE_METHODS.has(route.method) &&
+            definition.zone === "domain" &&
+            definition.access === "write"
+          ) {
+            findings.push({
+              code: "safe-method-domain-write",
+              method: route.method,
+              path: route.path,
+              capability: id,
+              message: `${route.method} ${route.path} (declared by mount ${mount.path}) cannot carry domain write capability ${id}`,
+            })
+          }
+        }
+        routes.push(
+          Object.freeze({
+            method: route.method,
+            path: route.path,
+            declared: route.capabilities,
+            evidence: Object.freeze([]),
+            unproven: route.capabilities,
+            covered: false,
+            analysis: "declared",
+          }),
+        )
+      }
       continue
     }
     findings.push({
@@ -722,6 +767,21 @@ async function runCapabilityInterceptors(
   await nextPromise
 }
 
+/** Preserve the request's effect/admission scope while restricting a nested execution's privileges. */
+export function narrowCapabilityContext(context: object, allowed: readonly string[]): object {
+  // biome-ignore lint/plugin/requireSafetyCommentForTypeAssertion: The private symbol stores only the capability guard installed by owner admission.
+  const guard = (context as { readonly [CAPABILITY_GUARD]?: CapabilityGuard })[CAPABILITY_GUARD]
+  const capabilities = Object.freeze([...new Set(allowed)])
+  for (const capability of capabilities) guardFor(context, capability)
+  const child: object = Object.create(context)
+  if (guard !== undefined) {
+    Object.defineProperty(child, CAPABILITY_GUARD, {
+      value: Object.freeze({ ...guard, allowed: capabilities }),
+    })
+  }
+  return child
+}
+
 function guardFor(context: object, capability: string): CapabilityGuard {
   if (!validCapabilityId(capability)) {
     throw new Error(
@@ -914,6 +974,7 @@ export function snapshotCapabilities(report: CapabilityAssuranceReport): Capabil
         evidenced: Object.freeze([...new Set(route.evidence.map((item) => item.id))].sort()),
         unproven: Object.freeze([...route.unproven].sort()),
         ...(route.classification !== undefined ? { classification: route.classification } : {}),
+        ...(route.analysis !== undefined ? { analysis: route.analysis } : {}),
       }),
     )
     .sort((a, b) => codeUnitOrder(a.path, b.path) || codeUnitOrder(a.method, b.method))

package/src/durable-effect.ts

@@ -235,7 +235,7 @@ async function scanEffectRecords(
 ): Promise<ReconciliationScanPage<DurableEffectRecord>> {
   if (store.scan !== undefined) return await store.scan(input)
   if (store.list === undefined) throw new TypeError("effect store does not support reconciliation")
-  return memoryScan(await store.list(), input)
+  return memoryScan(await store.list(), (record) => record.effectId, input)
 }
 
 export async function reconcileEffectsPage(

package/src/durable-saga.ts

@@ -118,6 +118,12 @@ export interface SagaEngineOptions {
   readonly observer?: EffectLifecycleObserver
   /** Tests/local development only. Production sagas require a durable store. */
   readonly allowMemoryStore?: boolean
+  /**
+   * How long one `resume` or `compensate` call owns a saga. A second call while the lease is live
+   * throws `SagaConcurrencyError` and changes nothing; every transition renews the lease, and a call
+   * that died is taken over once it lapses. Default 5 minutes: longer than any one step should run.
+   */
+  readonly leaseMs?: number
 }
 
 export type SagaAmbiguityResolution =
@@ -191,6 +197,8 @@ export function createSagaEngine(options: SagaEngineOptions): SagaEngine {
   const clock = options.now ?? Date.now
   const now = (): number => readClock(clock, "saga clock")
   const observer = options.observer
+  const leaseMs = options.leaseMs ?? 300_000
+  assertPositiveMs(leaseMs, "saga leaseMs")
 
   const load = async (sagaId: string): Promise<SagaRecord> => {
     const record = await options.store.get(sagaId)
@@ -207,6 +215,12 @@ export function createSagaEngine(options: SagaEngineOptions): SagaEngine {
       throw new TypeError(`saga ${sagaId}: store returned an invalid record`)
     }
     assertToken(record.definition, "stored saga definition", 128)
+    if (record.owner !== undefined) {
+      assertToken(record.owner, "stored saga owner", 64)
+      if (record.leaseUntil === undefined)
+        throw new TypeError(`saga ${sagaId}: store returned an owner without a lease`)
+      assertTimestamp(record.leaseUntil, "stored saga leaseUntil")
+    }
     assertTimestamp(record.createdAt, "stored saga createdAt")
     assertTimestamp(record.updatedAt, "stored saga updatedAt")
     if (record.createdAt > record.updatedAt)
@@ -252,7 +266,14 @@ export function createSagaEngine(options: SagaEngineOptions): SagaEngine {
     const next = durableSagaProtocol.transition(current, {
       sagaId: current.sagaId,
       version: current.version,
-      record: Object.freeze({ ...update, version: current.version + 1 }),
+      record: Object.freeze({
+        ...update,
+        // Every transition the owner writes renews its lease.
+        ...(update.owner === undefined
+          ? {}
+          : { leaseUntil: addDuration(now(), leaseMs, "saga leaseUntil") }),
+        version: current.version + 1,
+      }),
     })
     if (next === undefined) throw new SagaConcurrencyError(current.sagaId)
     if (
@@ -275,10 +296,51 @@ export function createSagaEngine(options: SagaEngineOptions): SagaEngine {
     ...(observer === undefined ? {} : { observers: [observer] }),
   })
 
+  /** Take the saga for `owner`, or throw `SagaConcurrencyError` while another call's lease is live. */
+  const claim = async (record: SagaRecord, owner: string): Promise<SagaRecord> => {
+    if (record.owner === owner) return record
+    if (record.owner !== undefined && record.leaseUntil !== undefined && record.leaseUntil > now())
+      throw new SagaConcurrencyError(record.sagaId)
+    return await save(record, { ...record, owner, updatedAt: now() })
+  }
+
+  /** Give the saga up so the next call need not wait out the lease. */
+  const release = async (sagaId: string, owner: string): Promise<void> => {
+    try {
+      const record = await load(sagaId)
+      if (record.owner !== owner) return
+      const { owner: _owner, leaseUntil: _leaseUntil, ...released } = record
+      await save(record, { ...released, updatedAt: now() })
+    } catch {
+      // A release that fails leaves the lease to lapse; the next call then takes the saga over.
+    }
+  }
+
+  /** The saga as `owner` holds it; once another call took it over, `owner` must stop writing. */
+  const loadOwned = async (sagaId: string, owner: string): Promise<SagaRecord> => {
+    const record = await load(sagaId)
+    if (record.owner !== owner) throw new SagaConcurrencyError(sagaId)
+    return record
+  }
+
   const compensate = async <I, C extends Record<string, unknown>>(
     definition: SagaDefinition<I, C>,
     sagaId: string,
     runOptions: { readonly signal?: AbortSignal } = {},
+  ): Promise<SagaRecord> => {
+    const owner = crypto.randomUUID()
+    try {
+      return await compensateOwned(definition, sagaId, runOptions, owner)
+    } finally {
+      await release(sagaId, owner)
+    }
+  }
+
+  const compensateOwned = async <I, C extends Record<string, unknown>>(
+    definition: SagaDefinition<I, C>,
+    sagaId: string,
+    runOptions: { readonly signal?: AbortSignal },
+    owner: string,
   ): Promise<SagaRecord> => {
     assertSagaDefinition(definition)
     assertToken(sagaId, "saga id", 128)
@@ -287,6 +349,7 @@ export function createSagaEngine(options: SagaEngineOptions): SagaEngine {
     let record = await load(sagaId)
     if (record.definition !== definition.name) throw new TypeError("saga definition mismatch")
     if (record.state === "completed" || record.state === "compensated") return record
+    record = await claim(record, owner)
     if (
       record.steps.some(
         (step) =>
@@ -402,6 +465,20 @@ export function createSagaEngine(options: SagaEngineOptions): SagaEngine {
     definition: SagaDefinition<I, C>,
     sagaId: string,
     runOptions: { readonly signal?: AbortSignal } = {},
+  ): Promise<SagaRecord> => {
+    const owner = crypto.randomUUID()
+    try {
+      return await resumeOwned(definition, sagaId, runOptions, owner)
+    } finally {
+      await release(sagaId, owner)
+    }
+  }
+
+  const resumeOwned = async <I, C extends Record<string, unknown>>(
+    definition: SagaDefinition<I, C>,
+    sagaId: string,
+    runOptions: { readonly signal?: AbortSignal },
+    owner: string,
   ): Promise<SagaRecord> => {
     assertSagaDefinition(definition)
     assertToken(sagaId, "saga id", 128)
@@ -410,6 +487,7 @@ export function createSagaEngine(options: SagaEngineOptions): SagaEngine {
     let record = await load(sagaId)
     if (record.definition !== definition.name) throw new TypeError("saga definition mismatch")
     if (record.state !== "running") return record
+    record = await claim(record, owner)
     const context: SagaRunContext<C> = {
       async step(name, compensationArgs, execute) {
         throwIfAborted(signal)
@@ -418,15 +496,15 @@ export function createSagaEngine(options: SagaEngineOptions): SagaEngine {
           throw new TypeError("saga step execute must be a function")
         if (typeof definition.compensators[name] !== "function")
           throw new TypeError(`saga step ${name} has no compensator`)
-        record = await load(sagaId)
+        record = await loadOwned(sagaId, owner)
+        if (record.state !== "running") throw new SagaConcurrencyError(sagaId)
         const existingIndex = record.steps.findIndex((step) => step.name === name)
         if (existingIndex >= 0) {
           const existing = record.steps[existingIndex] as SagaStepRecord
           if (existing.state === "committed")
             return cloneValue(existing.result) as Awaited<ReturnType<typeof execute>>
           if (existing.state === "executing" || existing.state === "ambiguous") {
-            if (record.state !== "manual-review")
-              record = await save(record, { ...record, state: "manual-review", updatedAt: now() })
+            record = await save(record, { ...record, state: "manual-review", updatedAt: now() })
             throw new SagaAmbiguousStepError(sagaId, name, existing.effectId)
           }
           throw new Error(`saga ${sagaId}: step ${name} cannot resume from ${existing.state}`)
@@ -463,8 +541,9 @@ export function createSagaEngine(options: SagaEngineOptions): SagaEngine {
                 })
               },
               async committed(_owned, result) {
-                record = await load(sagaId)
+                record = await loadOwned(sagaId, owner)
                 const index = record.steps.findIndex((candidate) => candidate.effectId === effectId)
+                if (index < 0) throw new SagaConcurrencyError(sagaId)
                 const committed = {
                   ...(record.steps[index] as SagaStepRecord),
                   state: "committed" as const,
@@ -473,8 +552,10 @@ export function createSagaEngine(options: SagaEngineOptions): SagaEngine {
                 record = await save(record, withStep(record, index, committed))
               },
               async failed(_owned, failure) {
-                record = await load(sagaId)
+                record = await loadOwned(sagaId, owner)
                 const index = record.steps.findIndex((candidate) => candidate.effectId === effectId)
+                // The step was never recorded: its intent write lost a race, so it never ran.
+                if (index < 0) throw new SagaConcurrencyError(sagaId)
                 const known = failure.error instanceof SagaStepNotCommittedError || !failure.began
                 const failed = {
                   ...(record.steps[index] as SagaStepRecord),
@@ -500,14 +581,17 @@ export function createSagaEngine(options: SagaEngineOptions): SagaEngine {
     try {
       throwIfAborted(signal)
       await definition.run(context, cloneValue(record.input) as I)
-      record = await load(sagaId)
+      record = await loadOwned(sagaId, owner)
       if (record.state === "running")
         record = await save(record, { ...record, state: "completed", updatedAt: now() })
       return record
     } catch (error) {
+      // Another call holds the saga, or won a write this one lost: what ran is that call's to
+      // finish or roll back, and compensating here would undo it.
+      if (error instanceof SagaConcurrencyError) throw error
       record = await load(sagaId)
-      if (record.state === "manual-review") throw error
-      await compensate(definition, sagaId, runOptions)
+      if (record.state === "manual-review" || record.owner !== owner) throw error
+      await compensateOwned(definition, sagaId, runOptions, owner)
       throw error
     }
   }
@@ -676,7 +760,7 @@ async function scanSagaRecords(
 ): Promise<ReconciliationScanPage<SagaRecord>> {
   if (store.scan !== undefined) return await store.scan(input)
   if (store.list === undefined) throw new TypeError("saga store does not support reconciliation")
-  return memoryScan(await store.list(), input)
+  return memoryScan(await store.list(), (record) => record.sagaId, input)
 }
 
 export async function reconcileSagasPage(

package/src/edge-kit.ts

@@ -8,16 +8,21 @@
  * exposes the one lane the fused body runner already calls, so a compact server reuses it verbatim:
  *
  *   - {@link readBodyFramed}   read + cap + proto-guard + content-type framing (JSON / urlencoded / 415)
- *   - {@link toResponse}       render a {@link ResponseResult} (e.g. a 413 / 415 rejection) to a `Response`
+ *   - {@link capBodyBytes}   the same byte cap on a handler's own reads of the raw request
+ *   - {@link renderResult}     render a {@link ResponseResult} (e.g. a 413 / 415 rejection) to a `Response`
+ *   - {@link toResponse}       render any handler result, a handler's own `Response` included
  *   - {@link plainError}       the structured rejection envelope the lane returns
  *   - {@link queryObjectOf} / {@link searchOf}   query parse without a full WHATWG URL construction
  *   - {@link answerNotFound}   run a not-found handler under the same rules (404 only, no 2xx, fail closed)
+ *   - {@link emitRequestErrorLog}   log an unhandled request error under the app's `errorLogDetail`
  *
  * Everything here carries only structure - bytes, guards, and envelopes - never routing, lifecycle,
  * or app state. It is the interface, not the framework.
  */
 
-export { readBodyFramed } from "./server/body-lane.ts"
+export { type ErrorLogDetail, emitRequestErrorLog } from "./server/bare-error-lane.ts"
+export { capBodyBytes } from "./server/body.ts"
+export { type FormOrigins, readBodyFramed } from "./server/body-lane.ts"
 export { plainError } from "./server/http.ts"
 export {
   answerNotFound,
@@ -27,7 +32,7 @@ export {
 } from "./server/not-found-answer.ts"
 export type { ProtoPoisoning } from "./server/proto-guard.ts"
 export { type QueryValue, queryObjectOf, searchOf } from "./server/query.ts"
-export { toResponse } from "./server/respond.ts"
+export { renderResult, toResponse } from "./server/respond.ts"
 export type { ResponseResult } from "./server/runtime-core.ts"
 export { EMPTY_RESPONSE_CONTROLS } from "./server/runtime-core.ts"
 export type { CtxSet, MaybePromise, RequestSource } from "./server/server.ts"

package/src/effect-scope.ts

@@ -234,10 +234,20 @@ export function createEffectScope(
         })
         return result
       } catch (error) {
-        const errorCode = codeFor(input.errorCode, error, began)
-        const failurePhase = input.failurePhase?.(error, began) ?? (began ? "ambiguous" : "failed")
-        if (failurePhase !== "failed" && failurePhase !== "ambiguous") {
-          throw new TypeError("owned effect failurePhase returned an invalid phase")
+        // A misconfigured `errorCode` or `failurePhase` is thrown only once the effect is settled
+        // with the defaults: thrown here, it left the durable record unfinished.
+        let misconfigured: { readonly error: unknown } | undefined
+        let errorCode = began ? "execution_failed" : "admission_failed"
+        let failurePhase: "failed" | "ambiguous" = began ? "ambiguous" : "failed"
+        try {
+          errorCode = codeFor(input.errorCode, error, began)
+          const phase = input.failurePhase?.(error, began) ?? failurePhase
+          if (phase !== "failed" && phase !== "ambiguous") {
+            throw new TypeError("owned effect failurePhase returned an invalid phase")
+          }
+          failurePhase = phase
+        } catch (invalid) {
+          misconfigured = { error: invalid }
         }
         try {
           await input.transitions?.failed?.(context, { began, errorCode, error })
@@ -253,7 +263,7 @@ export function createEffectScope(
           errorCode,
           ...(input.trace === undefined ? {} : { trace: input.trace }),
         })
-        throw error
+        throw misconfigured === undefined ? error : misconfigured.error
       }
     },
     evidence: () => evidenceScope.evidence(),

package/src/errors.ts

@@ -31,6 +31,7 @@ export type RouteConfigErrorCode =
   | "INVALID_VALIDATION_ORDER"
   | "INVALID_BODY_LIMIT"
   | "PLUGIN_RECONFIGURED"
+  | "MOUNT_CYCLE"
 
 /**
  * Thrown at route registration when a route is misconfigured. This is the

package/src/evidence.ts

@@ -34,6 +34,8 @@ export interface ProjectEvidenceSchemaPart {
 }
 
 export interface ProjectEvidenceSchema {
+  /** Set only when the route chose it; absent means the default for its auth stages. */
+  readonly validationOrder?: "validate-before-auth" | "auth-before-validation"
   readonly bodyLimit?: number | "unlimited"
   readonly bodyLimitReason?: string
   readonly headers?: ProjectEvidenceSchemaPart
@@ -160,6 +162,7 @@ function schemaOf(route: ReflectedRoute): ProjectEvidenceSchema | undefined {
     if (part !== undefined) errors[status] = part
   }
   const schema: ProjectEvidenceSchema = {
+    ...(source.validationOrder !== undefined ? { validationOrder: source.validationOrder } : {}),
     ...(source.bodyLimit !== undefined ? { bodyLimit: source.bodyLimit } : {}),
     ...(source.bodyLimitReason !== undefined ? { bodyLimitReason: source.bodyLimitReason } : {}),
     ...(headers !== undefined ? { headers } : {}),
@@ -328,9 +331,14 @@ function remapEvidenceSnapshot(
     const key = route(item.method, item.path)
     return Object.freeze({ ...item, ...key })
   })
-  const mounts = evidence.mounts?.map((item) =>
-    Object.freeze({ ...item, path: composedPath(pathPrefix, item.path) }),
-  )
+  const mounts = evidence.mounts?.map((item) => {
+    const path = composedPath(pathPrefix, item.path)
+    if (item.routes === undefined) return Object.freeze({ ...item, path })
+    const routes = item.routes.map((declared) =>
+      Object.freeze({ ...declared, path: composedPath(pathPrefix, declared.path) }),
+    )
+    return Object.freeze({ ...item, path, routes: Object.freeze(routes) })
+  })
   const assurance =
     evidence.assurance === undefined
       ? undefined
@@ -499,6 +507,7 @@ function schemaFromEvidence(schema: ProjectEvidenceSchema | undefined): Reflecte
   const response = schemaPartToReflection(schema.response)
   const sse = schemaPartToReflection(schema.sse)
   return {
+    ...(schema.validationOrder !== undefined ? { validationOrder: schema.validationOrder } : {}),
     ...(schema.bodyLimit !== undefined ? { bodyLimit: schema.bodyLimit } : {}),
     ...(schema.bodyLimitReason !== undefined ? { bodyLimitReason: schema.bodyLimitReason } : {}),
     ...(headers !== undefined ? { headers } : {}),

package/src/index.ts

@@ -16,13 +16,13 @@
  * read its own package.json at runtime. `scripts/version.ts` rewrites it on every release bump and
  * `check:publish` asserts it equals `@nifrajs/core`'s package version.
  */
-export const VERSION = "4.0.2" as const
+export const VERSION = "5.1.0" as const
 
 export type Version = typeof VERSION
 
 export { FrameworkError, RouteConfigError, type RouteConfigErrorCode } from "./errors.ts"
 export { FRAMEWORK_NAME, type FrameworkName } from "./internal/brand.ts"
-export { isSameOriginRequest } from "./internal/same-origin.ts"
+export { isSameOriginForm, isSameOriginRequest } from "./internal/same-origin.ts"
 export {
   ROUTE_PATTERN_OVERLAP_MAX_STATES,
   RoutePatternOverlapLimitError,
@@ -54,6 +54,8 @@ export {
   type AuthHeaders,
   type AuthMaybePromise,
   authenticated,
+  isAuthenticatedRequest,
+  markAuthenticatedRequest,
   rejected,
 } from "./server/auth.ts"
 export type {
@@ -116,6 +118,7 @@ export type {
   RouteInfoFor,
 } from "./server/registry.ts"
 export { replacedRequestOf } from "./server/request-lineage.ts"
+export { writableResponse } from "./server/respond.ts"
 export {
   type PlainRender,
   type ResponseResult,
@@ -127,6 +130,7 @@ export {
   type AdmissionDecision,
   type AnyServer,
   type ContextPlugin,
+  type DeclaredMountRoute,
   type DefinePluginResult,
   defineContextPlugin,
   defineIdentityPlugin,
@@ -150,6 +154,7 @@ export {
   type NodeResponseHook,
   type NodeServeOutcome,
   type OnRequestResult,
+  type OpaqueMountDeclaration,
   type PluginTypeCollapsed,
   type PromptArgument,
   type PromptMessage,

package/src/internal/durable-shared.ts

@@ -63,12 +63,22 @@ export function reconciliationLimit(value = DEFAULT_RECONCILIATION_LIMIT): numbe
   return value
 }
 
-export function cursorOffset(cursor?: string): number {
-  if (cursor === undefined) return 0
-  if (!/^(?:0|[1-9][0-9]*)$/u.test(cursor)) throw new TypeError("invalid reconciliation cursor")
-  const offset = Number(cursor)
-  if (!Number.isSafeInteger(offset)) throw new TypeError("invalid reconciliation cursor")
-  return offset
+/**
+ * One page of `matches` in id order, the cursor being the last id returned. Keyed rather than an
+ * offset into the matching set: a caller reconciles each page before asking for the next, so the
+ * set shrinks under it, and an offset then lands past records that were never returned.
+ */
+function keysetPage<Record>(
+  matches: [id: string, record: Record][],
+  limit: number,
+): ReconciliationScanPage<Record> {
+  // Code-unit order, the order the `id > cursor` comparisons use.
+  matches.sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
+  const page = matches.slice(0, limit)
+  const records = Object.freeze(page.map(([, record]) => cloneValue(record)))
+  const last = page.at(-1)
+  if (matches.length <= limit || last === undefined) return Object.freeze({ records })
+  return Object.freeze({ records, cursor: last[0] })
 }
 
 export function memoryScan<
@@ -76,28 +86,18 @@ export function memoryScan<
   State extends string,
 >(
   source: Iterable<Record>,
+  idOf: (record: Record) => string,
   input: ReconciliationScanOptions<State>,
 ): ReconciliationScanPage<Record> {
   const states = new Set(input.states)
-  const offset = cursorOffset(input.cursor)
-  const end = offset + input.limit
-  const records: Record[] = []
-  let seen = 0
-  let more = false
+  const matches: [string, Record][] = []
   for (const record of source) {
     if (!states.has(record.state)) continue
     if (input.updatedBefore !== undefined && record.updatedAt > input.updatedBefore) continue
-    if (seen >= end) {
-      more = true
-      break
-    }
-    if (seen >= offset) records.push(cloneValue(record))
-    seen++
+    const id = idOf(record)
+    if (input.cursor === undefined || id > input.cursor) matches.push([id, record])
   }
-  return Object.freeze({
-    records: Object.freeze(records),
-    ...(more ? { cursor: String(offset + records.length) } : {}),
-  })
+  return keysetPage(matches, input.limit)
 }
 
 export function bucketAdd<State extends string>(
@@ -129,29 +129,17 @@ export function indexedScan<Record extends { readonly updatedAt: number }, State
   resolve: (id: string) => Record | undefined,
   input: ReconciliationScanOptions<State>,
 ): ReconciliationScanPage<Record> {
-  const offset = cursorOffset(input.cursor)
-  const end = offset + input.limit
-  const records: Record[] = []
-  let seen = 0
-  let more = false
+  const matches: [string, Record][] = []
   for (const state of new Set(input.states)) {
-    if (more) break
     const bucket = byState.get(state)
     if (bucket === undefined) continue
     for (const id of bucket) {
+      if (input.cursor !== undefined && id <= input.cursor) continue
       const record = resolve(id)
       if (record === undefined) continue
       if (input.updatedBefore !== undefined && record.updatedAt > input.updatedBefore) continue
-      if (seen >= end) {
-        more = true
-        break
-      }
-      if (seen >= offset) records.push(cloneValue(record))
-      seen++
+      matches.push([id, record])
     }
   }
-  return Object.freeze({
-    records: Object.freeze(records),
-    ...(more ? { cursor: String(offset + records.length) } : {}),
-  })
+  return keysetPage(matches, input.limit)
 }

package/src/internal/durable-types.ts

@@ -138,6 +138,9 @@ export interface SagaRecord {
   readonly createdAt: number
   readonly updatedAt: number
   readonly version: number
+  /** The `resume`/`compensate` call that owns the saga while `leaseUntil` is in the future. */
+  readonly owner?: string
+  readonly leaseUntil?: number
 }
 
 export interface SagaStore {