@raybase/record-mount 0.0.1 → 0.3.3

package/dist/contract.d.ts

@@ -0,0 +1,261 @@
+/**
+ * The record door's wire contract, declared here.
+ *
+ * These types are OURS. They are written against the record door's
+ * published wire contract, and this package imports nothing from any
+ * particular door's implementation — a client that compiled against its
+ * service's source would not be a client; it would be a fork of the
+ * service. The pin is `RECORD_DOOR_CONTRACT_VERSION` and a door answers it
+ * from `version()`, so drift between these declarations and a deployed
+ * door is detected at runtime rather than assumed away.
+ *
+ * Nothing in this module runs. It holds shapes and two constants so both
+ * halves of the seam — the client and the test double — compile against
+ * one description.
+ */
+/**
+ * The contract version this package speaks. Fail-closed: a client bound to
+ * a door serving anything else refuses `contract_mismatch` and nothing
+ * proceeds.
+ *
+ * It moves when the shape a consumer compiles against changes in a way that
+ * breaks EITHER direction of the seam — a verb added or removed, an argument
+ * or return shape altered, a taxonomy code appearing on a verb that could not
+ * raise it. It does not move for an implementation change behind an unchanged
+ * shape.
+ *
+ * **The rule, refined when `RecordDoorVersion.writes` was added (2026-08-30).**
+ * An ADDITIVE OPTIONAL field with defined absence semantics does not move the
+ * pin, because both directions stay compatible: an old client reading a new
+ * door ignores the field, and a new client reading an old door reads absence
+ * as "undeclared" and falls back to behavior it can observe. `writes` is
+ * exactly that — its absence means "this door predates the declaration", and
+ * the client degrades toward `unknown`, never toward a confident answer.
+ *
+ * Bumping to "2" for it would have been the expensive lie: the pin is
+ * fail-closed, so every door currently deployed would refuse every consumer at
+ * once, and this package cannot execute that flag day — the doors are deployed
+ * by the consumer organization, not by this repository, and nothing here can
+ * roll them forward. A version bump a package cannot land is an outage wearing
+ * a migration.
+ *
+ * The pin still moves for anything that breaks either direction: a required
+ * field, a changed meaning for an existing field, a removed verb, a widened
+ * return a consumer must handle.
+ */
+export declare const RECORD_DOOR_CONTRACT_VERSION = "1";
+/**
+ * A record id. The contract's own scheme is `<prefix>-<yyyy-mm-dd>-<slug>`,
+ * but the prefix vocabulary belongs to the consumer's schema domain, not to
+ * this package — so the type is a string and the *shape* is checked by
+ * whatever descriptor the consumer supplies.
+ */
+export type RecordId = string;
+/**
+ * The envelope, as the door returns it. `type` is the family the id's
+ * prefix names; which families exist is the consumer's business.
+ */
+export type RecordEnvelope = {
+    id: RecordId;
+    type: string;
+    created?: string;
+    ts?: string;
+    by: string;
+    status?: string;
+    disposition?: string;
+    refs: RecordId[];
+    case?: string;
+    due?: string;
+    kind?: string;
+    severity?: string;
+    decided?: string;
+    "decided-by"?: string;
+    body_sha256: string;
+    head_seq: number;
+};
+/** One applied event on a record. */
+export type RecordEvent = {
+    record: RecordId;
+    seq: number;
+    kind: "transition" | "note";
+    from?: string;
+    to?: string;
+    by: string;
+    ts: string;
+    fields?: Record<string, unknown>;
+};
+/**
+ * The read model's unit: the envelope plus the two derived columns a list
+ * UI would otherwise open a body for. `headline` is never empty;
+ * `head_ts` is null for a record with no events.
+ *
+ * `headline` is UNTRUSTED TEXT. The door strips control characters, ANSI
+ * escapes and the Unicode bidi controls before capping the line, and it
+ * deliberately does NOT strip markup — escaping is the renderer's act, at
+ * render time, unconditionally. This package never renders; it passes the
+ * string through, and a consumer that interpolates it into HTML without
+ * escaping has the bug.
+ */
+export type RecordRow = RecordEnvelope & {
+    headline: string;
+    head_ts: string | null;
+};
+/**
+ * The closed error taxonomy. A consumer switches on this once.
+ *
+ * `unavailable` is the only retryable code. `contract_mismatch` is raised
+ * by the client and never crosses the wire.
+ */
+export type RecordErrorCode = "invalid_id" | "invalid_record" | "conflict" | "not_found" | "stale" | "illegal_transition" | "invalid_event" | "invalid_query" | "invalid_cursor" | "invalid_prefix" | "forbidden" | "corrupt" | "unavailable" | "no_serializer" | "invalid_binding" | "contract_mismatch";
+/** Every code in the taxonomy, as data — for exhaustiveness checks. */
+export declare const RECORD_ERROR_CODES: readonly ["invalid_id", "invalid_record", "conflict", "not_found", "stale", "illegal_transition", "invalid_event", "invalid_query", "invalid_cursor", "invalid_prefix", "forbidden", "corrupt", "unavailable", "no_serializer", "invalid_binding", "contract_mismatch"];
+/** The one code a caller may sensibly retry. */
+export declare const RECORD_RETRYABLE_ERROR_CODES: readonly RecordErrorCode[];
+export type RecordDoorRefusal = {
+    code: RecordErrorCode;
+    detail: Record<string, unknown>;
+    message: string;
+};
+/** The result envelope every door verb answers with. */
+export type RecordResult<T> = ({
+    ok: true;
+} & T) | {
+    ok: false;
+    error: RecordDoorRefusal;
+};
+/** The exact-match filter vocabulary. It grows by amending the contract. */
+export declare const RECORD_EXACT_FILTERS: readonly ["family", "status", "disposition", "by", "case", "kind", "severity"];
+/** The two filters the read model's `list` widens to an explicit OR-set. */
+export declare const RECORD_SET_FILTERS: readonly ["status", "disposition"];
+export type RecordRange = {
+    gte?: string;
+    lte?: string;
+};
+/** The substrate's query: exact-match filters, two ranges, keyset paging. */
+export type RecordQuery = {
+    family?: string;
+    status?: string;
+    disposition?: string;
+    by?: string;
+    case?: string;
+    kind?: string;
+    severity?: string;
+    ts?: RecordRange;
+    due?: RecordRange;
+    order?: "asc" | "desc";
+    limit?: number;
+    cursor?: string;
+};
+/**
+ * The read model's query: the substrate's, with `status` and `disposition`
+ * accepting an OR-set. Nothing else widens — an array on any other filter
+ * refuses `invalid_query`, and so does an empty set.
+ */
+export type RecordListQuery = Omit<RecordQuery, "status" | "disposition"> & {
+    status?: string | string[];
+    disposition?: string | string[];
+};
+/** What `count` may group by: the two lifecycle columns, nothing else. */
+export declare const RECORD_COUNT_GROUPS: readonly ["status", "disposition"];
+export type RecordCountGroup = (typeof RECORD_COUNT_GROUPS)[number];
+/**
+ * What `version()` answers: the door's identity, plus the one capability a
+ * client cannot otherwise observe across an RPC seam.
+ *
+ * `writes` is the entrypoint's own declaration: `true` for a write door (it
+ * carries `append` and `transition`), `false` for a read door (it does not).
+ * **Absent means undeclared** — a door built before this field existed — and a
+ * client reading absence must degrade toward `unknown`, never toward `true`.
+ *
+ * It exists because property presence is not observable on a Cloudflare RPC
+ * service-binding stub: the stub answers EVERY property access with a
+ * callable, so `typeof stub.append === "function"` is true against a read
+ * door. The runtime still refuses the missing method when the call is made —
+ * the wall holds — but the refusal arrives as a bare `TypeError` rather than
+ * as this package's typed one, and no mount-time check can fire. A declared
+ * capability is the only thing that crosses the seam as data.
+ */
+export type RecordDoorVersion = {
+    deployment: string;
+    contract: string;
+    writes?: boolean;
+};
+export type RecordGetResult = {
+    envelope: RecordEnvelope;
+    body: string;
+    events: RecordEvent[];
+};
+export type RecordQueryResult = {
+    envelopes: RecordEnvelope[];
+    cursor?: string;
+};
+export type RecordAppendResult = {
+    id: RecordId;
+    created: boolean;
+};
+export type RecordTransitionResult = {
+    seq: number;
+};
+export type RecordMaterializeEntry = {
+    path: string;
+    bytes: Uint8Array;
+};
+export type RecordMaterializePage = {
+    entries: RecordMaterializeEntry[];
+    cursor?: string;
+};
+export type RecordListResult = {
+    rows: RecordRow[];
+    cursor?: string;
+};
+export type RecordCountResult = {
+    groups: Array<{
+        value: string | null;
+        count: number;
+    }>;
+    total: number;
+};
+export type RecordReverseRefsResult = {
+    rows: RecordRow[];
+};
+/** The event a `transition` carries. */
+export type RecordTransitionEvent = {
+    by: string;
+    ts?: string;
+    fields?: Record<string, unknown>;
+};
+/**
+ * The bound entrypoint, structurally — what `env.<BINDING>` is on a
+ * consumer Worker.
+ *
+ * `append` and `transition` are optional because a READ door genuinely
+ * lacks them: the contract makes the read door refuse writes STRUCTURALLY
+ * (the methods are absent, and the runtime answers its own TypeError
+ * before any policy code runs). Which door a Worker holds is deploy
+ * configuration, not something code can change.
+ *
+ * **Absence is real but not visible across an RPC service binding.** A
+ * Cloudflare RPC stub answers every property access with a callable, so this
+ * type's optionality describes the door, not what a client can see: `typeof
+ * stub.append === "function"` holds against a read door and tells the caller
+ * nothing. The wall is the call itself, which the runtime refuses. What
+ * crosses as data is `RecordDoorVersion.writes`.
+ */
+export type RecordDoorStub = {
+    version(): Promise<RecordResult<RecordDoorVersion>>;
+    get(id: RecordId): Promise<RecordResult<RecordGetResult>>;
+    query(q: RecordQuery): Promise<RecordResult<RecordQueryResult>>;
+    materialize(prefix: string, cursor?: string): Promise<RecordResult<RecordMaterializePage>>;
+    list(q: RecordListQuery): Promise<RecordResult<RecordListResult>>;
+    count(args: {
+        family?: string;
+        groupBy: RecordCountGroup;
+    }): Promise<RecordResult<RecordCountResult>>;
+    reverseRefs(id: RecordId, opts?: {
+        limit?: number;
+        order?: "asc" | "desc";
+    }): Promise<RecordResult<RecordReverseRefsResult>>;
+    append?(body: string | Uint8Array): Promise<RecordResult<RecordAppendResult>>;
+    transition?(id: RecordId, expected: string, next: string, event: RecordTransitionEvent): Promise<RecordResult<RecordTransitionResult>>;
+};
+//# sourceMappingURL=contract.d.ts.map

package/dist/contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../src/contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAEhD;;;;;GAKG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC;AAE9B;;;GAGG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,EAAE,QAAQ,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,QAAQ,EAAE,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,qCAAqC;AACrC,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,EAAE,QAAQ,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,YAAY,GAAG,MAAM,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,SAAS,GAAG,cAAc,GAAG;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GACvB,YAAY,GACZ,gBAAgB,GAChB,UAAU,GACV,WAAW,GACX,OAAO,GACP,oBAAoB,GACpB,eAAe,GACf,eAAe,GACf,gBAAgB,GAChB,gBAAgB,GAChB,WAAW,GACX,SAAS,GACT,aAAa,GACb,eAAe,GACf,iBAAiB,GACjB,mBAAmB,CAAC;AAExB,uEAAuE;AACvE,eAAO,MAAM,kBAAkB,yQAiBgB,CAAC;AAEhD,gDAAgD;AAChD,eAAO,MAAM,4BAA4B,EAAE,SAAS,eAAe,EAAoB,CAAC;AAExF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,EAAE,eAAe,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,wDAAwD;AACxD,MAAM,MAAM,YAAY,CAAC,CAAC,IAAI,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG,CAAC,CAAC,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,iBAAiB,CAAA;CAAE,CAAC;AAI3F,4EAA4E;AAC5E,eAAO,MAAM,oBAAoB,gFAQvB,CAAC;AAEX,4EAA4E;AAC5E,eAAO,MAAM,kBAAkB,oCAAqC,CAAC;AAErE,MAAM,MAAM,WAAW,GAAG;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzD,6EAA6E;AAC7E,MAAM,MAAM,WAAW,GAAG;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,EAAE,CAAC,EAAE,WAAW,CAAC;IACjB,GAAG,CAAC,EAAE,WAAW,CAAC;IAClB,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,IAAI,CAAC,WAAW,EAAE,QAAQ,GAAG,aAAa,CAAC,GAAG;IAC1E,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CACjC,CAAC;AAEF,0EAA0E;AAC1E,eAAO,MAAM,mBAAmB,oCAAqC,CAAC;AACtE,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAIpE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB,CAAC;AACF,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,EAAE,cAAc,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,WAAW,EAAE,CAAC;CACvB,CAAC;AACF,MAAM,MAAM,iBAAiB,GAAG;IAAE,SAAS,EAAE,cAAc,EAAE,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AACjF,MAAM,MAAM,kBAAkB,GAAG;IAAE,EAAE,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC;AACpE,MAAM,MAAM,sBAAsB,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AACrD,MAAM,MAAM,sBAAsB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,CAAC;AACzE,MAAM,MAAM,qBAAqB,GAAG;IAClC,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AACF,MAAM,MAAM,gBAAgB,GAAG;IAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AACtE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,MAAM,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvD,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AACF,MAAM,MAAM,uBAAuB,GAAG;IAAE,IAAI,EAAE,SAAS,EAAE,CAAA;CAAE,CAAC;AAE5D,wCAAwC;AACxC,MAAM,MAAM,qBAAqB,GAAG;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,OAAO,IAAI,OAAO,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACpD,GAAG,CAAC,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC;IAC1D,KAAK,CAAC,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAChE,WAAW,CACT,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,YAAY,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAChD,IAAI,CAAC,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAClE,KAAK,CAAC,IAAI,EAAE;QACV,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,gBAAgB,CAAC;KAC3B,GAAG,OAAO,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC7C,WAAW,CACT,EAAE,EAAE,QAAQ,EACZ,IAAI,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,CAAA;KAAE,GAChD,OAAO,CAAC,YAAY,CAAC,uBAAuB,CAAC,CAAC,CAAC;IAClD,MAAM,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC9E,UAAU,CAAC,CACT,EAAE,EAAE,QAAQ,EACZ,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,qBAAqB,GAC3B,OAAO,CAAC,YAAY,CAAC,sBAAsB,CAAC,CAAC,CAAC;CAClD,CAAC"}

package/dist/contract.js

@@ -0,0 +1,83 @@
+/**
+ * The record door's wire contract, declared here.
+ *
+ * These types are OURS. They are written against the record door's
+ * published wire contract, and this package imports nothing from any
+ * particular door's implementation — a client that compiled against its
+ * service's source would not be a client; it would be a fork of the
+ * service. The pin is `RECORD_DOOR_CONTRACT_VERSION` and a door answers it
+ * from `version()`, so drift between these declarations and a deployed
+ * door is detected at runtime rather than assumed away.
+ *
+ * Nothing in this module runs. It holds shapes and two constants so both
+ * halves of the seam — the client and the test double — compile against
+ * one description.
+ */
+/**
+ * The contract version this package speaks. Fail-closed: a client bound to
+ * a door serving anything else refuses `contract_mismatch` and nothing
+ * proceeds.
+ *
+ * It moves when the shape a consumer compiles against changes in a way that
+ * breaks EITHER direction of the seam — a verb added or removed, an argument
+ * or return shape altered, a taxonomy code appearing on a verb that could not
+ * raise it. It does not move for an implementation change behind an unchanged
+ * shape.
+ *
+ * **The rule, refined when `RecordDoorVersion.writes` was added (2026-08-30).**
+ * An ADDITIVE OPTIONAL field with defined absence semantics does not move the
+ * pin, because both directions stay compatible: an old client reading a new
+ * door ignores the field, and a new client reading an old door reads absence
+ * as "undeclared" and falls back to behavior it can observe. `writes` is
+ * exactly that — its absence means "this door predates the declaration", and
+ * the client degrades toward `unknown`, never toward a confident answer.
+ *
+ * Bumping to "2" for it would have been the expensive lie: the pin is
+ * fail-closed, so every door currently deployed would refuse every consumer at
+ * once, and this package cannot execute that flag day — the doors are deployed
+ * by the consumer organization, not by this repository, and nothing here can
+ * roll them forward. A version bump a package cannot land is an outage wearing
+ * a migration.
+ *
+ * The pin still moves for anything that breaks either direction: a required
+ * field, a changed meaning for an existing field, a removed verb, a widened
+ * return a consumer must handle.
+ */
+export const RECORD_DOOR_CONTRACT_VERSION = "1";
+/** Every code in the taxonomy, as data — for exhaustiveness checks. */
+export const RECORD_ERROR_CODES = [
+    "invalid_id",
+    "invalid_record",
+    "conflict",
+    "not_found",
+    "stale",
+    "illegal_transition",
+    "invalid_event",
+    "invalid_query",
+    "invalid_cursor",
+    "invalid_prefix",
+    "forbidden",
+    "corrupt",
+    "unavailable",
+    "no_serializer",
+    "invalid_binding",
+    "contract_mismatch"
+];
+/** The one code a caller may sensibly retry. */
+export const RECORD_RETRYABLE_ERROR_CODES = ["unavailable"];
+// --- Queries ---------------------------------------------------------------
+/** The exact-match filter vocabulary. It grows by amending the contract. */
+export const RECORD_EXACT_FILTERS = [
+    "family",
+    "status",
+    "disposition",
+    "by",
+    "case",
+    "kind",
+    "severity"
+];
+/** The two filters the read model's `list` widens to an explicit OR-set. */
+export const RECORD_SET_FILTERS = ["status", "disposition"];
+/** What `count` may group by: the two lifecycle columns, nothing else. */
+export const RECORD_COUNT_GROUPS = ["status", "disposition"];
+//# sourceMappingURL=contract.js.map

package/dist/contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract.js","sourceRoot":"","sources":["../src/contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAG,CAAC;AAsFhD,uEAAuE;AACvE,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,YAAY;IACZ,gBAAgB;IAChB,UAAU;IACV,WAAW;IACX,OAAO;IACP,oBAAoB;IACpB,eAAe;IACf,eAAe;IACf,gBAAgB;IAChB,gBAAgB;IAChB,WAAW;IACX,SAAS;IACT,aAAa;IACb,eAAe;IACf,iBAAiB;IACjB,mBAAmB;CAC0B,CAAC;AAEhD,gDAAgD;AAChD,MAAM,CAAC,MAAM,4BAA4B,GAA+B,CAAC,aAAa,CAAC,CAAC;AAWxF,8EAA8E;AAE9E,4EAA4E;AAC5E,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,QAAQ;IACR,QAAQ;IACR,aAAa;IACb,IAAI;IACJ,MAAM;IACN,MAAM;IACN,UAAU;CACF,CAAC;AAEX,4EAA4E;AAC5E,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,QAAQ,EAAE,aAAa,CAAU,CAAC;AA8BrE,0EAA0E;AAC1E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,QAAQ,EAAE,aAAa,CAAU,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,41 @@
+/**
+ * The closed error class a consumer switches on, and the envelope
+ * unwrapper that produces it.
+ *
+ * Rehydration is real work, not ceremony. A class instance crossing a
+ * service binding arrives with its constructor gone — `instanceof` on the
+ * far side is false for anything the door could have thrown — so the door
+ * answers a result ENVELOPE and the client turns `{ok:false, error}` back
+ * into a typed throw on this side of the seam. Data crosses; types do not.
+ */
+import type { RecordErrorCode, RecordResult } from "./contract.js";
+/**
+ * A refusal from the record door, typed. `code` is the closed taxonomy;
+ * `detail` is the per-code payload the contract pins.
+ *
+ * `detail` is operator-facing and may name ids, actors and grants. A mount
+ * that echoes a whole `detail` into an end-user response is disclosing
+ * more than it means to — `code` and `message` are the caller-facing half.
+ */
+export declare class RecordDoorError extends Error {
+    readonly code: RecordErrorCode;
+    readonly detail: Record<string, unknown>;
+    constructor(code: RecordErrorCode, detail: Record<string, unknown>, message?: string);
+    /** Whether a caller may sensibly try this call again. */
+    get retryable(): boolean;
+}
+/** Typed constructor, so a code and its message are built in one place. */
+export declare function recordDoorError(code: RecordErrorCode, detail: Record<string, unknown>, message?: string): RecordDoorError;
+/** Whether an unknown value is one of this package's typed refusals. */
+export declare function isRecordDoorError(value: unknown): value is RecordDoorError;
+/**
+ * The envelope, unwrapped. `{ok:true, …}` becomes the payload;
+ * `{ok:false, …}` becomes a throw of the same code, detail and message the
+ * door refused with.
+ *
+ * A reply that is neither is the seam itself misbehaving. It refuses as
+ * `unavailable` rather than being coerced into a success — a malformed
+ * reply read as data is how a store outage becomes silent corruption.
+ */
+export declare function rehydrateRecordResult<T>(reply: RecordResult<T>): T;
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAqB,eAAe,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAItF;;;;;;;GAOG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAE7B,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,EAAE,MAAM;IAOpF,yDAAyD;IACzD,IAAI,SAAS,IAAI,OAAO,CAEvB;CACF;AAED,2EAA2E;AAC3E,wBAAgB,eAAe,CAC7B,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,OAAO,CAAC,EAAE,MAAM,GACf,eAAe,CAEjB;AAED,wEAAwE;AACxE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,eAAe,CAE1E;AAED;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CA4BlE"}

package/dist/errors.js

@@ -0,0 +1,81 @@
+/**
+ * The closed error class a consumer switches on, and the envelope
+ * unwrapper that produces it.
+ *
+ * Rehydration is real work, not ceremony. A class instance crossing a
+ * service binding arrives with its constructor gone — `instanceof` on the
+ * far side is false for anything the door could have thrown — so the door
+ * answers a result ENVELOPE and the client turns `{ok:false, error}` back
+ * into a typed throw on this side of the seam. Data crosses; types do not.
+ */
+import { RECORD_ERROR_CODES, RECORD_RETRYABLE_ERROR_CODES } from "./contract.js";
+const KNOWN_CODES = new Set(RECORD_ERROR_CODES);
+/**
+ * A refusal from the record door, typed. `code` is the closed taxonomy;
+ * `detail` is the per-code payload the contract pins.
+ *
+ * `detail` is operator-facing and may name ids, actors and grants. A mount
+ * that echoes a whole `detail` into an end-user response is disclosing
+ * more than it means to — `code` and `message` are the caller-facing half.
+ */
+export class RecordDoorError extends Error {
+    code;
+    detail;
+    constructor(code, detail, message) {
+        super(message ?? `${code}: ${JSON.stringify(detail)}`);
+        this.name = "RecordDoorError";
+        this.code = code;
+        this.detail = detail;
+    }
+    /** Whether a caller may sensibly try this call again. */
+    get retryable() {
+        return RECORD_RETRYABLE_ERROR_CODES.includes(this.code);
+    }
+}
+/** Typed constructor, so a code and its message are built in one place. */
+export function recordDoorError(code, detail, message) {
+    return new RecordDoorError(code, detail, message);
+}
+/** Whether an unknown value is one of this package's typed refusals. */
+export function isRecordDoorError(value) {
+    return value instanceof RecordDoorError;
+}
+/**
+ * The envelope, unwrapped. `{ok:true, …}` becomes the payload;
+ * `{ok:false, …}` becomes a throw of the same code, detail and message the
+ * door refused with.
+ *
+ * A reply that is neither is the seam itself misbehaving. It refuses as
+ * `unavailable` rather than being coerced into a success — a malformed
+ * reply read as data is how a store outage becomes silent corruption.
+ */
+export function rehydrateRecordResult(reply) {
+    if (reply !== null && typeof reply === "object" && reply.ok === true) {
+        const { ok: _ok, ...payload } = reply;
+        return payload;
+    }
+    const error = reply?.error;
+    if (error === undefined || error === null || typeof error.code !== "string") {
+        throw recordDoorError("unavailable", {
+            cause: `the record door returned a reply that is neither ok nor a typed refusal: ${safeJson(reply)}`
+        });
+    }
+    if (!KNOWN_CODES.has(error.code)) {
+        // A code outside the closed set means the door is speaking a taxonomy
+        // this build does not know. That is a contract problem wearing an
+        // error, and guessing at it would be a fallback (the contract pin is
+        // the migration). Refuse loudly, keeping the unknown code visible.
+        throw recordDoorError("contract_mismatch", { expected: [...KNOWN_CODES].join("|"), served: error.code }, `the record door refused with '${error.code}', which is not in this build's error taxonomy — ` +
+            "the bound door speaks a contract this client does not");
+    }
+    throw new RecordDoorError(error.code, (error.detail ?? {}), typeof error.message === "string" ? error.message : error.code);
+}
+function safeJson(value) {
+    try {
+        return JSON.stringify(value) ?? String(value);
+    }
+    catch {
+        return String(value);
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,kBAAkB,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAC;AAGjF,MAAM,WAAW,GAAG,IAAI,GAAG,CAAS,kBAAkB,CAAC,CAAC;AAExD;;;;;;;GAOG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAC/B,IAAI,CAAkB;IACtB,MAAM,CAA0B;IAEzC,YAAY,IAAqB,EAAE,MAA+B,EAAE,OAAgB;QAClF,KAAK,CAAC,OAAO,IAAI,GAAG,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,yDAAyD;IACzD,IAAI,SAAS;QACX,OAAO,4BAA4B,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1D,CAAC;CACF;AAED,2EAA2E;AAC3E,MAAM,UAAU,eAAe,CAC7B,IAAqB,EACrB,MAA+B,EAC/B,OAAgB;IAEhB,OAAO,IAAI,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AACpD,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,OAAO,KAAK,YAAY,eAAe,CAAC;AAC1C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAI,KAAsB;IAC7D,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAK,KAA0B,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QAC3F,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,GAAG,KAA+C,CAAC;QAChF,OAAO,OAAY,CAAC;IACtB,CAAC;IACD,MAAM,KAAK,GAAI,KAAmE,EAAE,KAAK,CAAC;IAC1F,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC5E,MAAM,eAAe,CAAC,aAAa,EAAE;YACnC,KAAK,EAAE,4EAA4E,QAAQ,CAAC,KAAK,CAAC,EAAE;SACrG,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,sEAAsE;QACtE,kEAAkE;QAClE,qEAAqE;QACrE,mEAAmE;QACnE,MAAM,eAAe,CACnB,mBAAmB,EACnB,EAAE,QAAQ,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,EAC5D,iCAAiC,KAAK,CAAC,IAAI,mDAAmD;YAC5F,uDAAuD,CAC1D,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,eAAe,CACvB,KAAK,CAAC,IAAuB,EAC7B,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAA4B,EAC/C,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAC/D,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,22 @@
+/**
+ * `@raybase/record-mount` — mount an external append-only record layer into
+ * a Raybase app.
+ *
+ * Three things, in the order an app meets them: `openRecordDoor` turns a
+ * declared service binding into a typed client pinned to the wire contract;
+ * `defineRecordMount` puts the app's two authorization gates in front of it;
+ * `createRecordBodyComposer` builds the canonical bytes a filing needs.
+ *
+ * The in-memory door double lives at `@raybase/record-mount/testing` — a
+ * separate entry point so a production bundle never carries it.
+ */
+export { RECORD_DOOR_CONTRACT_VERSION, RECORD_COUNT_GROUPS, RECORD_ERROR_CODES, RECORD_EXACT_FILTERS, RECORD_RETRYABLE_ERROR_CODES, RECORD_SET_FILTERS } from "./contract.js";
+export type { RecordAppendResult, RecordCountGroup, RecordCountResult, RecordDoorRefusal, RecordDoorStub, RecordDoorVersion, RecordEnvelope, RecordErrorCode, RecordEvent, RecordGetResult, RecordId, RecordListQuery, RecordListResult, RecordMaterializeEntry, RecordMaterializePage, RecordQuery, RecordQueryResult, RecordRange, RecordResult, RecordReverseRefsResult, RecordRow, RecordTransitionEvent, RecordTransitionResult } from "./contract.js";
+export { RecordDoorError, isRecordDoorError, recordDoorError, rehydrateRecordResult } from "./errors.js";
+export { openRecordDoor } from "./client.js";
+export type { OpenRecordDoorOptions, RecordDoorClient } from "./client.js";
+export { RECORD_ID_PATTERN, createRecordBodyComposer, mintRecordId, parseRecordFrontmatter, recordProseOf } from "./body.js";
+export type { RecordBodyComposer, RecordFamilyDescriptor, RecordFieldDescriptor, RecordFieldRender } from "./body.js";
+export { allowAnyAuthenticated, defineRecordMount, denyAllRecords } from "./mount.js";
+export type { DefineRecordMountOptions, RecordMount, RecordMountAuth, RecordReadPolicy, RecordReadVerb, RecordUnfilteredRead, RecordViewer } from "./mount.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,4BAA4B,EAC5B,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,EACpB,4BAA4B,EAC5B,kBAAkB,EACnB,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,WAAW,EACX,eAAe,EACf,QAAQ,EACR,eAAe,EACf,gBAAgB,EAChB,sBAAsB,EACtB,qBAAqB,EACrB,WAAW,EACX,iBAAiB,EACjB,WAAW,EACX,YAAY,EACZ,uBAAuB,EACvB,SAAS,EACT,qBAAqB,EACrB,sBAAsB,EACvB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,qBAAqB,EACtB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,YAAY,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE3E,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,YAAY,EACZ,sBAAsB,EACtB,aAAa,EACd,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,EACrB,iBAAiB,EAClB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACtF,YAAY,EACV,wBAAwB,EACxB,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,oBAAoB,EACpB,YAAY,EACb,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,18 @@
+/**
+ * `@raybase/record-mount` — mount an external append-only record layer into
+ * a Raybase app.
+ *
+ * Three things, in the order an app meets them: `openRecordDoor` turns a
+ * declared service binding into a typed client pinned to the wire contract;
+ * `defineRecordMount` puts the app's two authorization gates in front of it;
+ * `createRecordBodyComposer` builds the canonical bytes a filing needs.
+ *
+ * The in-memory door double lives at `@raybase/record-mount/testing` — a
+ * separate entry point so a production bundle never carries it.
+ */
+export { RECORD_DOOR_CONTRACT_VERSION, RECORD_COUNT_GROUPS, RECORD_ERROR_CODES, RECORD_EXACT_FILTERS, RECORD_RETRYABLE_ERROR_CODES, RECORD_SET_FILTERS } from "./contract.js";
+export { RecordDoorError, isRecordDoorError, recordDoorError, rehydrateRecordResult } from "./errors.js";
+export { openRecordDoor } from "./client.js";
+export { RECORD_ID_PATTERN, createRecordBodyComposer, mintRecordId, parseRecordFrontmatter, recordProseOf } from "./body.js";
+export { allowAnyAuthenticated, defineRecordMount, denyAllRecords } from "./mount.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,4BAA4B,EAC5B,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,EACpB,4BAA4B,EAC5B,kBAAkB,EACnB,MAAM,eAAe,CAAC;AA2BvB,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,eAAe,EACf,qBAAqB,EACtB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAG7C,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,YAAY,EACZ,sBAAsB,EACtB,aAAa,EACd,MAAM,WAAW,CAAC;AAQnB,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC"}