@raybase/record-mount 0.0.1 → 0.3.3

package/dist/client.d.ts

@@ -0,0 +1,132 @@
+/**
+ * The declarable client binding: an app names its record-door service
+ * binding and gets a typed client against the door's wire contract.
+ *
+ * Two refusals live here and they land at different moments, deliberately.
+ *
+ * **The address is checked at construction.** A binding name that is
+ * absent from `env`, or present but not door-shaped, is a deploy
+ * misconfiguration and there is nothing to wait for: `openRecordDoor`
+ * throws immediately. So does a malformed declared namespace.
+ *
+ * **The contract version is checked at the first verb call**, memoized per
+ * door stub — which is per isolate, because a Worker's `env` and its
+ * binding stubs are built once per isolate and handed to every request.
+ * The check cannot honestly happen at construction: a Worker constructs
+ * its handle on every request, and an RPC round trip there would price the
+ * check per request. `assertContract()` is the eager form for an app that
+ * genuinely has a boot hook and wants to pay once. Either way no verb
+ * result reaches the app before the pin has been checked, a mismatch is
+ * terminal and stays memoized, and a failure to reach the door at all
+ * clears the memo so a flap does not poison an isolate.
+ *
+ * ## What a Cloudflare RPC stub does to property checks
+ *
+ * A real service-binding stub answers EVERY property access with a callable.
+ * `typeof stub.append === "function"` is therefore true against a read door,
+ * true against a service that is not a record door at all, and true for a
+ * property nobody ever defined. Property presence carries no information
+ * there, and code that reads it is reading its own assumption back.
+ *
+ * So this module detects the stub's KIND by behavior — probing a sentinel
+ * property no door will ever serve — and takes a different route for each:
+ *
+ * - **A plain object** (a test double, an in-process fake): presence is real.
+ *   The construction-time "not a record door" refusal and the read-door
+ *   `writable` answer both mean what they say.
+ * - **An RPC stub**: presence means nothing, so the missing-verb refusal at
+ *   construction is skipped rather than pretended, and writability comes from
+ *   the door's own `version().writes` declaration. Until that reply lands,
+ *   `writable` is `"unknown"` — an honest third state, not a guess — and a
+ *   `TypeError` from a write verb on an undeclared door is TRANSLATED into
+ *   this package's typed refusal so a consumer switches on one taxonomy
+ *   rather than sniffing runtime messages.
+ */
+import type { RecordAppendResult, RecordCountGroup, RecordCountResult, RecordDoorVersion, RecordGetResult, RecordId, RecordListQuery, RecordListResult, RecordMaterializeEntry, RecordQuery, RecordQueryResult, RecordReverseRefsResult, RecordTransitionEvent, RecordTransitionResult } from "./contract.js";
+export type OpenRecordDoorOptions<Env> = {
+    /** The Worker's environment — where the service binding lives. */
+    env: Env;
+    /**
+     * The binding name declared in `wrangler.jsonc`, e.g. `"STORE_DOOR"`.
+     * Named rather than passed as a stub so the refusal can say which line
+     * of configuration is wrong, and so the contract check has a stable
+     * identity to memoize against.
+     */
+    binding: string;
+    /**
+     * The namespace this mount believes its binding carries.
+     *
+     * **This is a declaration, not a verification.** The namespace is a
+     * deploy-seam fact: it rides the binding's `props` beside the actor,
+     * where only a chair-signed `wrangler` config can write it, and no verb
+     * takes or returns a namespace — that one-wayness is what makes the
+     * address unforgeable. The client can read `version()`; it cannot read
+     * props. So what this value buys is: exactly one namespace per mount
+     * (asserted structurally — a mount holds one store), a legible name in
+     * refusals and telemetry, and a written-down claim a reviewer can diff
+     * against the deployed config. What it cannot do is catch a config that
+     * says `prod` here and something else in the props.
+     */
+    namespace: string;
+    /**
+     * Pin a contract version other than the one this build compiles
+     * against. Present for a consumer that deliberately lags a release;
+     * absent, the client expects its own.
+     */
+    expect?: string;
+};
+/**
+ * The typed client. Every verb the door serves, the taxonomy rehydrated
+ * into `RecordDoorError`, and `materialize` paging under the covers so a
+ * caller sees the stream the substrate's own signature promises.
+ */
+export type RecordDoorClient = {
+    /** The binding name this client was opened against. */
+    readonly binding: string;
+    /** The declared namespace. See `OpenRecordDoorOptions.namespace`. */
+    readonly namespace: string;
+    /** The contract version this client pins. */
+    readonly contract: string;
+    /**
+     * Whether the bound door carries the write verbs — and `"unknown"` when
+     * nothing observable says yet.
+     *
+     * This is a getter, and its answer sharpens as the client learns:
+     *
+     * - **Plain binding** (a double, an in-process fake): the methods are
+     *   really there or really not, so this is a boolean from the first read
+     *   and never changes.
+     * - **RPC stub**: `"unknown"` at construction — property presence is
+     *   meaningless across the seam — and then the door's declared
+     *   `version().writes` once the contract check has resolved one. A door
+     *   that declares nothing (one built before the field existed) leaves this
+     *   `"unknown"` forever, which is the honest answer rather than a guess.
+     *
+     * For a definite answer, `await client.assertContract()` first and then
+     * read it. `"unknown"` never blocks a write: the call goes out, and a
+     * `TypeError` from a door that turns out to lack the verb comes back as
+     * this package's typed `forbidden` refusal.
+     */
+    readonly writable: boolean | "unknown";
+    /** The door's identity, unchecked — the one call that must work before
+     *  the contract is known. */
+    version(): Promise<RecordDoorVersion>;
+    /** Check the pin now rather than at the first verb. Idempotent. */
+    assertContract(): Promise<void>;
+    get(id: RecordId): Promise<RecordGetResult>;
+    query(q: RecordQuery): Promise<RecordQueryResult>;
+    materialize(prefix: string): Promise<AsyncIterable<RecordMaterializeEntry>>;
+    list(q: RecordListQuery): Promise<RecordListResult>;
+    count(args: {
+        family?: string;
+        groupBy: RecordCountGroup;
+    }): Promise<RecordCountResult>;
+    reverseRefs(id: RecordId, opts?: {
+        limit?: number;
+        order?: "asc" | "desc";
+    }): Promise<RecordReverseRefsResult>;
+    append(body: string | Uint8Array): Promise<RecordAppendResult>;
+    transition(id: RecordId, expected: string, next: string, event: RecordTransitionEvent): Promise<RecordTransitionResult>;
+};
+export declare function openRecordDoor<Env>(options: OpenRecordDoorOptions<Env>): RecordDoorClient;
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAGH,OAAO,KAAK,EACV,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EAEjB,iBAAiB,EACjB,eAAe,EACf,QAAQ,EACR,eAAe,EACf,gBAAgB,EAChB,sBAAsB,EACtB,WAAW,EACX,iBAAiB,EACjB,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EACvB,MAAM,eAAe,CAAC;AAwBvB,MAAM,MAAM,qBAAqB,CAAC,GAAG,IAAI;IACvC,kEAAkE;IAClE,GAAG,EAAE,GAAG,CAAC;IACT;;;;;OAKG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;;;;;;;OAaG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,uDAAuD;IACvD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;;;;;;;;;;;;;;;;OAmBG;IACH,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,SAAS,CAAC;IAEvC;iCAC6B;IAC7B,OAAO,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACtC,mEAAmE;IACnE,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhC,GAAG,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC5C,KAAK,CAAC,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAClD,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAC5E,IAAI,CAAC,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACpD,KAAK,CAAC,IAAI,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,gBAAgB,CAAA;KAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACxF,WAAW,CACT,EAAE,EAAE,QAAQ,EACZ,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;KAAE,GAChD,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACpC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/D,UAAU,CACR,EAAE,EAAE,QAAQ,EACZ,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACpC,CAAC;AAoBF,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,qBAAqB,CAAC,GAAG,CAAC,GAAG,gBAAgB,CAiVzF"}

package/dist/client.js

@@ -0,0 +1,376 @@
+/**
+ * The declarable client binding: an app names its record-door service
+ * binding and gets a typed client against the door's wire contract.
+ *
+ * Two refusals live here and they land at different moments, deliberately.
+ *
+ * **The address is checked at construction.** A binding name that is
+ * absent from `env`, or present but not door-shaped, is a deploy
+ * misconfiguration and there is nothing to wait for: `openRecordDoor`
+ * throws immediately. So does a malformed declared namespace.
+ *
+ * **The contract version is checked at the first verb call**, memoized per
+ * door stub — which is per isolate, because a Worker's `env` and its
+ * binding stubs are built once per isolate and handed to every request.
+ * The check cannot honestly happen at construction: a Worker constructs
+ * its handle on every request, and an RPC round trip there would price the
+ * check per request. `assertContract()` is the eager form for an app that
+ * genuinely has a boot hook and wants to pay once. Either way no verb
+ * result reaches the app before the pin has been checked, a mismatch is
+ * terminal and stays memoized, and a failure to reach the door at all
+ * clears the memo so a flap does not poison an isolate.
+ *
+ * ## What a Cloudflare RPC stub does to property checks
+ *
+ * A real service-binding stub answers EVERY property access with a callable.
+ * `typeof stub.append === "function"` is therefore true against a read door,
+ * true against a service that is not a record door at all, and true for a
+ * property nobody ever defined. Property presence carries no information
+ * there, and code that reads it is reading its own assumption back.
+ *
+ * So this module detects the stub's KIND by behavior — probing a sentinel
+ * property no door will ever serve — and takes a different route for each:
+ *
+ * - **A plain object** (a test double, an in-process fake): presence is real.
+ *   The construction-time "not a record door" refusal and the read-door
+ *   `writable` answer both mean what they say.
+ * - **An RPC stub**: presence means nothing, so the missing-verb refusal at
+ *   construction is skipped rather than pretended, and writability comes from
+ *   the door's own `version().writes` declaration. Until that reply lands,
+ *   `writable` is `"unknown"` — an honest third state, not a guess — and a
+ *   `TypeError` from a write verb on an undeclared door is TRANSLATED into
+ *   this package's typed refusal so a consumer switches on one taxonomy
+ *   rather than sniffing runtime messages.
+ */
+import { RECORD_DOOR_CONTRACT_VERSION } from "./contract.js";
+import { recordDoorError, rehydrateRecordResult, RecordDoorError } from "./errors.js";
+/** The namespace rule the record substrate itself enforces. */
+const NAMESPACE_RE = /^[a-z0-9-]+$/;
+/**
+ * A property no record door will ever serve. If reading it off the binding
+ * yields a callable, the binding answers every property access with one — it
+ * is an RPC stub, and nothing about it can be learned by looking.
+ */
+const RPC_PROBE = "__raybaseRecordDoorRpcProbe__";
+/** The verbs every door carries, whichever entrypoint it is. */
+const REQUIRED_VERBS = [
+    "version",
+    "get",
+    "query",
+    "materialize",
+    "list",
+    "count",
+    "reverseRefs"
+];
+/**
+ * The per-isolate contract memo.
+ *
+ * Keyed by the door stub itself, then by the pinned version. A Worker's
+ * binding stubs are built with `env` once per isolate, so a WeakMap on the
+ * stub memoizes for exactly the isolate's life — and two clients against
+ * two different doors cannot share an answer even when their bindings are
+ * spelled the same, which a name-keyed cache would let happen.
+ *
+ * It memoizes the SERVED VERSION, not merely "the check passed". A Worker
+ * builds a fresh client per request over one isolate-lifetime stub, so the
+ * second client and every one after it must be able to read the door's
+ * declared capabilities out of the memo. Memoizing a bare `Promise<void>`
+ * meant only the isolate's first client ever saw `version().writes`, and
+ * every later request read `"unknown"` forever.
+ */
+const contractChecks = new WeakMap();
+export function openRecordDoor(options) {
+    const { env, binding, namespace } = options;
+    const expect = options.expect ?? RECORD_DOOR_CONTRACT_VERSION;
+    if (typeof binding !== "string" || binding.length === 0) {
+        throw new Error("openRecordDoor requires a binding name, e.g. binding: \"STORE_DOOR\"");
+    }
+    if (typeof namespace !== "string" || !NAMESPACE_RE.test(namespace)) {
+        throw new Error(`openRecordDoor: namespace ${JSON.stringify(namespace)} is not a legal record namespace ` +
+            "(lowercase letters, digits and hyphens). The namespace a mount declares must match the " +
+            "one its binding's props carry; nothing at runtime can check that for you.");
+    }
+    const bag = env;
+    const candidate = bag === null || bag === undefined ? undefined : bag[binding];
+    if (candidate === undefined || candidate === null || typeof candidate !== "object") {
+        throw new Error(`openRecordDoor: no service binding named ${JSON.stringify(binding)} on this Worker's env. ` +
+            "Declare it in wrangler.jsonc with the door's entrypoint and its {actor, namespace} props.");
+    }
+    const stub = candidate;
+    /**
+     * Does this binding answer every property access with a callable?
+     *
+     * A Cloudflare RPC service-binding stub does, so the probe below is a
+     * function on a real stub and `undefined` on any ordinary object. This one
+     * fact decides which of the two checks that follow are meaningful.
+     */
+    const isRpcStub = typeof stub[RPC_PROBE] === "function";
+    if (!isRpcStub) {
+        // On a plain binding, absence is absence: a missing verb is a genuinely
+        // wrong object and saying so at construction beats a TypeError at the
+        // first call. On an RPC stub this check is skipped rather than performed
+        // and believed — every verb would "be there", including on a service
+        // that has never heard of a record door. What catches THAT case is the
+        // translation in `notARecordDoor` below, at the first call that goes out.
+        const missing = REQUIRED_VERBS.filter((verb) => typeof stub[verb] !== "function");
+        if (missing.length > 0) {
+            throw new Error(`openRecordDoor: the binding ${JSON.stringify(binding)} is not a record door — it carries no ` +
+                `${missing.join(", ")}. Check the binding's "entrypoint" in wrangler.jsonc.`);
+        }
+    }
+    /**
+     * Writability, as far as this client honestly knows it right now.
+     *
+     * A plain binding settles it at construction and never moves. An RPC stub
+     * starts `"unknown"` and moves exactly once, when a `version()` reply
+     * declares `writes`.
+     */
+    let writable = isRpcStub
+        ? "unknown"
+        : typeof stub.append === "function" && typeof stub.transition === "function";
+    /** Record what a `version()` reply declared, if it declared anything. */
+    const learnFrom = (served) => {
+        if (isRpcStub && typeof served.writes === "boolean")
+            writable = served.writes;
+    };
+    /**
+     * The runtime's method-missing signal, and only for this verb's own name.
+     *
+     * workerd refuses a method the bound entrypoint does not carry with a
+     * TypeError whose message names the method — the observed shape is
+     * `The RPC receiver does not implement the method "append"`. Only that
+     * exact situation may be read as "the door does not carry this verb":
+     * any other TypeError — a broken door, a serialization failure, a
+     * mis-invocation like the extracted-`.call` form that filed
+     * fnd-2026-08-31-mount-write-call-invocation — propagates raw, because
+     * loud beats mislabeled. If workerd's wording ever shifts, this
+     * translation stops firing and consumers see the raw TypeError:
+     * fail-open to noise, never to a wrong diagnosis.
+     */
+    const isVerbMissing = (ex, verb) => ex instanceof TypeError &&
+        ex.message.includes("does not implement") &&
+        ex.message.includes(`"${verb}"`);
+    /**
+     * The bound service does not speak this contract at all.
+     *
+     * Only reachable on an RPC stub: a plain binding without `version()` was
+     * refused at construction. There, `version`'s own method-missing TypeError
+     * (see `isVerbMissing`) is the runtime saying "no such method", which is
+     * the only signal the seam gives that the binding points at the wrong
+     * service — so it is translated into the taxonomy's own `invalid_binding`
+     * rather than propagating as a bare runtime error a consumer would have to
+     * sniff. Any other TypeError is a different defect and is left alone.
+     */
+    const notARecordDoor = (verb, cause) => recordDoorError("invalid_binding", {
+        binding,
+        verb,
+        cause: cause instanceof Error ? cause.message : String(cause)
+    }, `invalid_binding: the service bound at '${binding}' does not speak the record-door contract — ` +
+        `calling '${verb}' on it found no such method. Check the binding's "service" and ` +
+        '"entrypoint" in wrangler.jsonc.');
+    /**
+     * `version()` against the stub, with the not-a-door translation. Kept
+     * separate from `rehydrateRecordResult` deliberately: only the CALL is
+     * guarded, so a typed refusal the door itself answers with propagates
+     * untouched instead of being swallowed by a catch meant for the seam.
+     */
+    const askVersion = async () => {
+        let reply;
+        try {
+            reply = await stub.version();
+        }
+        catch (ex) {
+            // Same razor as the write verbs: only the method-missing shape that
+            // names `version` itself means "not a record door" — any other
+            // TypeError is a different defect and propagates raw.
+            if (isRpcStub && isVerbMissing(ex, "version"))
+                throw notARecordDoor("version", ex);
+            throw ex;
+        }
+        const served = rehydrateRecordResult(reply);
+        learnFrom(served);
+        return served;
+    };
+    /** The memoized contract check, resolving to the version the door served. */
+    const checked = () => {
+        let byVersion = contractChecks.get(stub);
+        if (byVersion === undefined) {
+            byVersion = new Map();
+            contractChecks.set(stub, byVersion);
+        }
+        const memo = byVersion.get(expect);
+        if (memo !== undefined)
+            return memo;
+        const check = (async () => {
+            const served = await askVersion();
+            if (served.contract !== expect) {
+                throw recordDoorError("contract_mismatch", { expected: expect, served: served.contract }, `contract_mismatch: this client pins record-door contract '${expect}' and the door bound at ` +
+                    `'${binding}' serves '${served.contract}' (deployment '${served.deployment}') — refusing ` +
+                    "rather than guessing which shape is live");
+            }
+            return served;
+        })();
+        byVersion.set(expect, check);
+        check.catch((ex) => {
+            // Two codes are terminal and stay memoized, because both are deploy
+            // configuration rather than weather: `contract_mismatch` (this door
+            // serves another shape) and `invalid_binding` (this binding points at
+            // a service that is not a record door). Neither resolves by being
+            // asked again inside one isolate, and re-asking would price a round
+            // trip on every verb of a permanently misconfigured Worker.
+            //
+            // Anything else — the door unreachable, the seam flapping — is the
+            // world's unreliability and must not poison the isolate.
+            const terminal = ex instanceof RecordDoorError &&
+                (ex.code === "contract_mismatch" || ex.code === "invalid_binding");
+            if (!terminal)
+                byVersion.delete(expect);
+        });
+        return check;
+    };
+    /**
+     * The gate every verb passes: the pin is checked, and this client has read
+     * whatever the door declared about itself.
+     *
+     * The `learnFrom` is here rather than only inside the check because the
+     * check is memoized per STUB and this client may be the tenth one built
+     * over it. A client that never ran the check itself still learns from the
+     * reply the check kept.
+     */
+    const ready = async () => {
+        learnFrom(await checked());
+    };
+    /**
+     * The typed read-door refusal, with the reason it was reached.
+     *
+     * All three forms name the same fact — this binding cannot write — and
+     * differ in how the client learned it, because that is what an operator
+     * needs to tell "I bound the read entrypoint" from "the door is older than
+     * the declaration" from "the door says it writes and does not".
+     */
+    const noWriteVerb = (verb, how, cause) => {
+        const why = how === "declared"
+            ? `its version() reply declares writes: false, so it carries no '${verb}' verb`
+            : how === "runtime"
+                ? `calling '${verb}' on it found no such method, and it declares no writability of its own`
+                : `it carries no '${verb}' verb at all`;
+        const detail = {
+            actor: "(read binding)",
+            verb,
+            family: "(any)",
+            id: "(none)"
+        };
+        if (cause !== undefined) {
+            detail.cause = cause instanceof Error ? cause.message : String(cause);
+        }
+        return recordDoorError("forbidden", detail, `forbidden: the binding '${binding}' is a read door — ${why}. ` +
+            "Which door a Worker holds is deploy configuration, not something code can change.");
+    };
+    return {
+        binding,
+        namespace,
+        contract: expect,
+        get writable() {
+            return writable;
+        },
+        async version() {
+            return askVersion();
+        },
+        async assertContract() {
+            await ready();
+        },
+        async get(id) {
+            await ready();
+            return rehydrateRecordResult(await stub.get(id));
+        },
+        async query(q) {
+            await ready();
+            return rehydrateRecordResult(await stub.query(q));
+        },
+        async list(q) {
+            await ready();
+            return rehydrateRecordResult(await stub.list(q));
+        },
+        async count(args) {
+            await ready();
+            return rehydrateRecordResult(await stub.count(args));
+        },
+        async reverseRefs(id, opts) {
+            await ready();
+            return rehydrateRecordResult(await stub.reverseRefs(id, opts));
+        },
+        async materialize(prefix) {
+            await ready();
+            // The wire pages; the caller does not. A page always moves — the
+            // door emits an oversized single entry alone rather than stalling —
+            // so this walk terminates on any corpus the door will serve.
+            //
+            // A paged materialize is NOT a snapshot: the cursor is a position in
+            // a deterministic order, not a point in time, so a multi-page walk
+            // taken while writes land under the same prefix can repeat an entry
+            // or miss one. Walk a quiesced namespace when that matters.
+            async function* pages() {
+                let cursor;
+                do {
+                    const page = rehydrateRecordResult(await stub.materialize(prefix, cursor));
+                    yield* page.entries;
+                    cursor = page.cursor;
+                } while (cursor !== undefined);
+            }
+            return pages();
+        },
+        // The two write verbs share one shape, spelled out at each so neither
+        // drifts. Refuse BEFORE calling when writability is known false; call
+        // when it is true or unknown; and translate the runtime's method-missing
+        // TypeError into the typed refusal only while writability is undeclared
+        // AND the error names this verb's own method. A door that declared
+        // `writes: true` and still throws is either lying or broken, and any
+        // TypeError that is not this verb's method-missing is a real defect —
+        // translating either would hide it behind a refusal that reads as
+        // configuration (fnd-2026-08-31-mount-write-call-invocation was masked
+        // exactly that way for an evening).
+        //
+        // Each verb is invoked DIRECTLY on the stub, never extracted and
+        // re-invoked via Function.prototype.call: workerd's RPC proxy answers
+        // the `.call` property access as an RPC method named "call", so the
+        // extracted form throws `does not implement the method "call"` on
+        // every real binding.
+        async append(body) {
+            await ready();
+            // The second clause is the optional type's, not a second policy: a
+            // plain binding missing the verb already read `false` above.
+            if (writable === false || stub.append === undefined) {
+                throw noWriteVerb("append", isRpcStub ? "declared" : "absent");
+            }
+            let reply;
+            try {
+                reply = await stub.append(body);
+            }
+            catch (ex) {
+                if (writable !== true && isVerbMissing(ex, "append")) {
+                    throw noWriteVerb("append", "runtime", ex);
+                }
+                throw ex;
+            }
+            return rehydrateRecordResult(reply);
+        },
+        async transition(id, expected, next, event) {
+            await ready();
+            if (writable === false || stub.transition === undefined) {
+                throw noWriteVerb("transition", isRpcStub ? "declared" : "absent");
+            }
+            let reply;
+            try {
+                reply = await stub.transition(id, expected, next, event);
+            }
+            catch (ex) {
+                if (writable !== true && isVerbMissing(ex, "transition")) {
+                    throw noWriteVerb("transition", "runtime", ex);
+                }
+                throw ex;
+            }
+            return rehydrateRecordResult(reply);
+        }
+    };
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AAEH,OAAO,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAC;AAkB7D,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEtF,+DAA+D;AAC/D,MAAM,YAAY,GAAG,cAAc,CAAC;AAEpC;;;;GAIG;AACH,MAAM,SAAS,GAAG,+BAA+B,CAAC;AAElD,gEAAgE;AAChE,MAAM,cAAc,GAAG;IACrB,SAAS;IACT,KAAK;IACL,OAAO;IACP,aAAa;IACb,MAAM;IACN,OAAO;IACP,aAAa;CACL,CAAC;AA6FX;;;;;;;;;;;;;;;GAeG;AACH,MAAM,cAAc,GAAG,IAAI,OAAO,EAAmD,CAAC;AAEtF,MAAM,UAAU,cAAc,CAAM,OAAmC;IACrE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,4BAA4B,CAAC;IAE9D,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CACb,6BAA6B,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,mCAAmC;YACvF,yFAAyF;YACzF,2EAA2E,CAC9E,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,GAAiD,CAAC;IAC9D,MAAM,SAAS,GAAG,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC/E,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QACnF,MAAM,IAAI,KAAK,CACb,4CAA4C,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,yBAAyB;YAC1F,2FAA2F,CAC9F,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,SAAsC,CAAC;IAEpD;;;;;;OAMG;IACH,MAAM,SAAS,GAAG,OAAQ,IAA2C,CAAC,SAAS,CAAC,KAAK,UAAU,CAAC;IAEhG,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,wEAAwE;QACxE,sEAAsE;QACtE,yEAAyE;QACzE,qEAAqE;QACrE,uEAAuE;QACvE,0EAA0E;QAC1E,MAAM,OAAO,GAAG,cAAc,CAAC,MAAM,CACnC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAQ,IAA2C,CAAC,IAAI,CAAC,KAAK,UAAU,CACnF,CAAC;QACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,+BAA+B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,wCAAwC;gBAC5F,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,uDAAuD,CAC/E,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,IAAI,QAAQ,GAAwB,SAAS;QAC3C,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,OAAO,IAAI,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,UAAU,CAAC;IAE/E,yEAAyE;IACzE,MAAM,SAAS,GAAG,CAAC,MAAyB,EAAQ,EAAE;QACpD,IAAI,SAAS,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC;IAChF,CAAC,CAAC;IAEF;;;;;;;;;;;;;OAaG;IACH,MAAM,aAAa,GAAG,CAAC,EAAW,EAAE,IAAY,EAAW,EAAE,CAC3D,EAAE,YAAY,SAAS;QACvB,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAC;QACzC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC;IAEnC;;;;;;;;;;OAUG;IACH,MAAM,cAAc,GAAG,CAAC,IAAY,EAAE,KAAc,EAAmB,EAAE,CACvE,eAAe,CACb,iBAAiB,EACjB;QACE,OAAO;QACP,IAAI;QACJ,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;KAC9D,EACD,0CAA0C,OAAO,8CAA8C;QAC7F,YAAY,IAAI,kEAAkE;QAClF,iCAAiC,CACpC,CAAC;IAEJ;;;;;OAKG;IACH,MAAM,UAAU,GAAG,KAAK,IAAgC,EAAE;QACxD,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QAC/B,CAAC;QAAC,OAAO,EAAE,EAAE,CAAC;YACZ,oEAAoE;YACpE,+DAA+D;YAC/D,sDAAsD;YACtD,IAAI,SAAS,IAAI,aAAa,CAAC,EAAE,EAAE,SAAS,CAAC;gBAAE,MAAM,cAAc,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YACnF,MAAM,EAAE,CAAC;QACX,CAAC;QACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC5C,SAAS,CAAC,MAAM,CAAC,CAAC;QAClB,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,6EAA6E;IAC7E,MAAM,OAAO,GAAG,GAA+B,EAAE;QAC/C,IAAI,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,IAAyB,CAAC,CAAC;QAC9D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,SAAS,GAAG,IAAI,GAAG,EAAE,CAAC;YACtB,cAAc,CAAC,GAAG,CAAC,IAAyB,EAAE,SAAS,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACpC,MAAM,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE;YACxB,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;YAClC,IAAI,MAAM,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBAC/B,MAAM,eAAe,CACnB,mBAAmB,EACnB,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,EAC7C,6DAA6D,MAAM,0BAA0B;oBAC3F,IAAI,OAAO,aAAa,MAAM,CAAC,QAAQ,kBAAkB,MAAM,CAAC,UAAU,gBAAgB;oBAC1F,0CAA0C,CAC7C,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC,EAAE,CAAC;QACL,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC7B,KAAK,CAAC,KAAK,CAAC,CAAC,EAAW,EAAE,EAAE;YAC1B,oEAAoE;YACpE,oEAAoE;YACpE,sEAAsE;YACtE,kEAAkE;YAClE,oEAAoE;YACpE,4DAA4D;YAC5D,EAAE;YACF,mEAAmE;YACnE,yDAAyD;YACzD,MAAM,QAAQ,GACZ,EAAE,YAAY,eAAe;gBAC7B,CAAC,EAAE,CAAC,IAAI,KAAK,mBAAmB,IAAI,EAAE,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAC;YACrE,IAAI,CAAC,QAAQ;gBAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF;;;;;;;;OAQG;IACH,MAAM,KAAK,GAAG,KAAK,IAAmB,EAAE;QACtC,SAAS,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC;IAC7B,CAAC,CAAC;IAEF;;;;;;;OAOG;IACH,MAAM,WAAW,GAAG,CAClB,IAA6B,EAC7B,GAAsC,EACtC,KAAe,EACE,EAAE;QACnB,MAAM,GAAG,GACP,GAAG,KAAK,UAAU;YAChB,CAAC,CAAC,iEAAiE,IAAI,QAAQ;YAC/E,CAAC,CAAC,GAAG,KAAK,SAAS;gBACjB,CAAC,CAAC,YAAY,IAAI,yEAAyE;gBAC3F,CAAC,CAAC,kBAAkB,IAAI,eAAe,CAAC;QAC9C,MAAM,MAAM,GAA4B;YACtC,KAAK,EAAE,gBAAgB;YACvB,IAAI;YACJ,MAAM,EAAE,OAAO;YACf,EAAE,EAAE,QAAQ;SACb,CAAC;QACF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,CAAC,KAAK,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,eAAe,CACpB,WAAW,EACX,MAAM,EACN,2BAA2B,OAAO,sBAAsB,GAAG,IAAI;YAC7D,mFAAmF,CACtF,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO;QACL,OAAO;QACP,SAAS;QACT,QAAQ,EAAE,MAAM;QAChB,IAAI,QAAQ;YACV,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,KAAK,CAAC,OAAO;YACX,OAAO,UAAU,EAAE,CAAC;QACtB,CAAC;QAED,KAAK,CAAC,cAAc;YAClB,MAAM,KAAK,EAAE,CAAC;QAChB,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,EAAE;YACV,MAAM,KAAK,EAAE,CAAC;YACd,OAAO,qBAAqB,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QACnD,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,CAAC;YACX,MAAM,KAAK,EAAE,CAAC;YACd,OAAO,qBAAqB,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,CAAC;YACV,MAAM,KAAK,EAAE,CAAC;YACd,OAAO,qBAAqB,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,IAAI;YACd,MAAM,KAAK,EAAE,CAAC;YACd,OAAO,qBAAqB,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QACvD,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI;YACxB,MAAM,KAAK,EAAE,CAAC;YACd,OAAO,qBAAqB,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;QACjE,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,MAAM;YACtB,MAAM,KAAK,EAAE,CAAC;YACd,iEAAiE;YACjE,oEAAoE;YACpE,6DAA6D;YAC7D,EAAE;YACF,qEAAqE;YACrE,mEAAmE;YACnE,oEAAoE;YACpE,4DAA4D;YAC5D,KAAK,SAAS,CAAC,CAAC,KAAK;gBACnB,IAAI,MAA0B,CAAC;gBAC/B,GAAG,CAAC;oBACF,MAAM,IAAI,GAAG,qBAAqB,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;oBAC3E,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;oBACpB,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;gBACvB,CAAC,QAAQ,MAAM,KAAK,SAAS,EAAE;YACjC,CAAC;YACD,OAAO,KAAK,EAAE,CAAC;QACjB,CAAC;QAED,sEAAsE;QACtE,sEAAsE;QACtE,yEAAyE;QACzE,wEAAwE;QACxE,mEAAmE;QACnE,qEAAqE;QACrE,sEAAsE;QACtE,kEAAkE;QAClE,uEAAuE;QACvE,oCAAoC;QACpC,EAAE;QACF,iEAAiE;QACjE,sEAAsE;QACtE,oEAAoE;QACpE,kEAAkE;QAClE,sBAAsB;QAEtB,KAAK,CAAC,MAAM,CAAC,IAAI;YACf,MAAM,KAAK,EAAE,CAAC;YACd,mEAAmE;YACnE,6DAA6D;YAC7D,IAAI,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACpD,MAAM,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACjE,CAAC;YACD,IAAI,KAAK,CAAC;YACV,IAAI,CAAC;gBACH,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAClC,CAAC;YAAC,OAAO,EAAE,EAAE,CAAC;gBACZ,IAAI,QAAQ,KAAK,IAAI,IAAI,aAAa,CAAC,EAAE,EAAE,QAAQ,CAAC,EAAE,CAAC;oBACrD,MAAM,WAAW,CAAC,QAAQ,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;gBAC7C,CAAC;gBACD,MAAM,EAAE,CAAC;YACX,CAAC;YACD,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK;YACxC,MAAM,KAAK,EAAE,CAAC;YACd,IAAI,QAAQ,KAAK,KAAK,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;gBACxD,MAAM,WAAW,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACrE,CAAC;YACD,IAAI,KAAK,CAAC;YACV,IAAI,CAAC;gBACH,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAC3D,CAAC;YAAC,OAAO,EAAE,EAAE,CAAC;gBACZ,IAAI,QAAQ,KAAK,IAAI,IAAI,aAAa,CAAC,EAAE,EAAE,YAAY,CAAC,EAAE,CAAC;oBACzD,MAAM,WAAW,CAAC,YAAY,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;gBACjD,CAAC;gBACD,MAAM,EAAE,CAAC;YACX,CAAC;YACD,OAAO,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACtC,CAAC;KACF,CAAC;AACJ,CAAC"}