@smthrs/sync 0.0.0-stage → 1.0.0-rc.3

package/dist/esm/SyncProtocol.js

@@ -0,0 +1,434 @@
+/**
+ * The wire contract shared by the sync server and the browser-safe client.
+ *
+ * Every message is schema-backed so the same definitions serve the RPC group,
+ * the HTTP transport, and replay tooling.
+ *
+ * @since 0.1.0
+ */
+import * as JournalEvent from "@smthrs/journal/JournalEvent";
+import * as Schema from "effect/Schema";
+import { ShareCapability } from "./BranchProtocol.js";
+/**
+ * Wire revision requiring explicit generations in server positions.
+ * Missing request versions decode so the server can return a typed refusal.
+ *
+ * @category constants
+ * @since 1.0.0-rc.0
+ */
+export const protocolVersion = 1;
+/**
+ * Selects every run in the workspace.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export const WorkspaceScope = Schema.TaggedStruct("Workspace", {});
+/**
+ * Selects a single run.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export const RunScope = Schema.TaggedStruct("Run", { runId: JournalEvent.RunId });
+/**
+ * The set of runs a request covers.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export const Scope = Schema.Union([WorkspaceScope, RunScope]);
+/**
+ * The last sequence one run has been DELIVERED to a client through.
+ *
+ * "Delivered", not "applied": {@link SyncClient}'s default follow advances a
+ * cursor as it hands the entry to the consumer, so a consumer whose own apply
+ * step then fails must not treat the cursor as an acknowledgement of that
+ * apply. A consumer that needs the stronger meaning supplies
+ * `SubscribeOptions.apply`, which the client runs to success before the cursor
+ * moves. `Progress.applied` records that application claim; a bare wire
+ * cursor never acknowledges application to the server.
+ *
+ * `generation` identifies the run's current history after rewinds. Requests may
+ * omit it for persisted generation-zero cursors. Server responses must include
+ * it in exactly one cursor for every run represented in Read entries. Clients
+ * refuse missing cursor rows or generations before delivery; persist a returned
+ * generation with its sequence.
+ * Sequence ordering is meaningful only within one generation.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export const RunCursor = Schema.Struct({
+    runId: JournalEvent.RunId,
+    afterSeq: JournalEvent.Seq,
+    // Omitted only for generation zero (persisted cursors from before rewind support).
+    generation: Schema.optional(Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)))
+});
+/**
+ * A client's delivered position across the workspace.
+ *
+ * At most ONE cursor per run: a request carrying two cursors for the same run
+ * is ambiguous about where the read starts, so the server refuses it with
+ * `invalid_request` rather than picking one (see {@link duplicateCursorRunId}).
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export const WorkspaceCursor = Schema.Array(RunCursor);
+/**
+ * One run's delivered position as a SERVER states it.
+ *
+ * Identical to {@link RunCursor} except that `generation` is required: a
+ * request may omit it for a persisted generation-zero cursor, a response may
+ * not. Server positions are typed with this shape so an implementation that
+ * omits a generation fails to compile rather than being refused at run time by
+ * every client that reads it.
+ *
+ * The wire schemas stay lenient on purpose. {@link ReadResponse} and
+ * {@link Frame} decode an absent generation so {@link SyncClient} can answer a
+ * non-conforming server with a typed `protocol_violation` naming the missing
+ * field, rather than a bare decode failure.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export const ServerCursor = Schema.Struct({
+    ...RunCursor.fields,
+    generation: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0))
+});
+/**
+ * The scope and cursor set every read and subscribe request carries.
+ *
+ * Server read, server subscribe and client subscribe each admit a
+ * caller-built request against this one schema, so an envelope field is
+ * declared once and every entry point agrees on what an admitted request is.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export const RequestEnvelope = Schema.Struct({ scope: Scope, cursors: WorkspaceCursor });
+/**
+ * A client's delivery and application positions, as two cursor sets.
+ *
+ * `delivered` is transport delivery and never an application acknowledgement.
+ * `applied` holds the positions committed after a successful `apply` or
+ * `onResync` callback; consumers persist state and these positions in the
+ * same transaction. The field names carry the distinction, so neither set is
+ * wrapped in a tag.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export const Progress = Schema.Struct({ delivered: WorkspaceCursor, applied: WorkspaceCursor });
+/**
+ * The first run named twice in a cursor set, or `undefined` when every run is
+ * named at most once.
+ *
+ * The schema cannot express the uniqueness — `Schema.Array` has no such check
+ * — so the one rule is stated once here and enforced by both request paths.
+ *
+ * @category predicates
+ * @since 0.1.0
+ */
+export const duplicateCursorRunId = (cursors) => {
+    const seen = new Set();
+    for (const cursor of cursors) {
+        if (seen.has(cursor.runId))
+            return cursor.runId;
+        seen.add(cursor.runId);
+    }
+    return undefined;
+};
+/**
+ * Where a follower must resume after the server refused a cursor that starts
+ * below a run's compaction floor.
+ *
+ * Compaction deletes the entries below a checkpoint, so a cursor under the
+ * floor names history that no longer exists. `checkpointSeq` is that floor:
+ * the checkpoint's state subsumes every entry at or below it, so a follower
+ * must restore a snapshot covering that sequence before reading forward.
+ * Its applied cursor names that snapshot, which may be newer than this floor.
+ *
+ * `generation` is the run's history the floor belongs to. A run rewound
+ * before it was compacted is past generation zero, and a fresh follower has
+ * no earlier cursor to learn that from, so a recovery receipt that omits its
+ * generation is bound to this one. The server's refusal of a read always
+ * carries it; a snapshot that falls short of a floor refuses without one.
+ *
+ * This field carries no replacement state. The client fails closed without
+ * an explicit recovery handler returning the cursor it actually restored.
+ * `SnapshotRequest` fetches a separately selected public projection. Raw journal
+ * checkpoints are unredacted and must not be exposed under history permission.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export const Resync = Schema.Struct({
+    runId: JournalEvent.RunId,
+    checkpointSeq: JournalEvent.Seq,
+    generation: Schema.optional(Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)))
+});
+// `protocolVersion` accepts any integer here for the same reason
+// `ReadRequest` and `SubscribeRequest` do: a mismatch decodes so the boundary
+// can answer it with a typed `protocol_violation` instead of a decode
+// failure, and the accepted number lives only in `protocolVersion`.
+const snapshotIdentity = {
+    protocolVersion: Schema.Int,
+    runId: JournalEvent.RunId,
+    lineageId: Schema.NonEmptyString.check(Schema.isMaxLength(512)),
+    projection: Schema.NonEmptyString.check(Schema.isMaxLength(128)),
+    projectionVersion: Schema.Int.check(Schema.isGreaterThanOrEqualTo(1), Schema.isLessThan(Number.MAX_SAFE_INTEGER))
+};
+/**
+ * Requests an explicitly public projection covering the missing prefix.
+ * Identity and version must match exactly; this never requests raw engine state.
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export const SnapshotRequest = Schema.Struct({
+    ...snapshotIdentity,
+    atLeastSeq: JournalEvent.Seq,
+    capability: Schema.optional(ShareCapability)
+});
+/**
+ * A complete public projection through `seq`, inclusive. Apply its state and
+ * durable cursor atomically, then read entries strictly after `seq`.
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export const Snapshot = Schema.Struct({ ...snapshotIdentity, seq: JournalEvent.Seq, state: Schema.Json });
+/**
+ * Largest number of entries one {@link ReadRequest} may ask for.
+ *
+ * `limit` is request-controlled fan-out: the server passes it to the journal
+ * as the page size, once per covered run, so an unbounded limit made one
+ * workspace read materialize an unbounded number of rows per run. The frame
+ * ceiling does not cover it — that drops entries AFTER they have been read.
+ * A request above this bound is refused at the wire, and an in-process caller
+ * that bypasses the schema is clamped to it.
+ *
+ * @category limits
+ * @since 0.1.0
+ */
+export const maxReadLimit = 1024;
+/**
+ * Largest number of frames one {@link SubscribeRequest} may hold open.
+ *
+ * Credit is a hard frame limit, so it is also how long one subscription may
+ * pin a server-side fan-out. The bound keeps that lifetime a function of the
+ * protocol rather than of what the caller asks for; a follower that wants
+ * more resubscribes from the cursors it has, which is what
+ * `SyncClient.defaultCredit` already does.
+ *
+ * @category limits
+ * @since 0.1.0
+ */
+export const maxSubscribeCredit = 4096;
+/**
+ * A durable catch-up request.
+ *
+ * `capability` authorizes branch runs: a run whose id maps to a shared branch
+ * is only read when the capability verifies for that branch. Non-branch runs
+ * ignore it.
+ *
+ * `limit` is bounded on both sides: at least one entry, at most
+ * {@link maxReadLimit}.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export const ReadRequest = Schema.Struct({
+    protocolVersion: Schema.optional(Schema.Int),
+    scope: Scope,
+    cursors: WorkspaceCursor,
+    limit: Schema.Int.check(Schema.isGreaterThanOrEqualTo(1), Schema.isLessThanOrEqualTo(maxReadLimit)),
+    capability: Schema.optional(ShareCapability)
+});
+/**
+ * One page of durable catch-up entries.
+ *
+ * `done` reports that the page reached the durable tail, which is the point at
+ * which a client may switch from paging to following.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export const ReadResponse = Schema.Struct({
+    entries: Schema.Array(JournalEvent.Entry),
+    cursors: WorkspaceCursor,
+    done: Schema.Boolean
+});
+/**
+ * One page of durable catch-up entries as a SERVER states it.
+ *
+ * Every cursor carries its generation. {@link SyncServer.Service} answers with
+ * this shape; {@link ReadResponse} is the lenient shape a client decodes an
+ * untrusted server's page into before refusing a missing generation.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export const ServerReadResponse = Schema.Struct({
+    ...ReadResponse.fields,
+    cursors: Schema.Array(ServerCursor)
+});
+/**
+ * A request to follow committed entries.
+ *
+ * `capability` authorizes branch runs exactly as on {@link ReadRequest}.
+ *
+ * `credit` is bounded on both sides: at least one frame, at most
+ * {@link maxSubscribeCredit}. Zero is refused rather than served as an
+ * immediately-empty stream, because the two readings of it — "open a window
+ * of nothing" and "a caller computed its window wrong" — are
+ * indistinguishable on the wire, and the second one busy-loops a follow that
+ * replenishes by resubscribing.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export const SubscribeRequest = Schema.Struct({
+    protocolVersion: Schema.optional(Schema.Int),
+    scope: Scope,
+    cursors: WorkspaceCursor,
+    credit: Schema.Int.check(Schema.isGreaterThanOrEqualTo(1), Schema.isLessThanOrEqualTo(maxSubscribeCredit)),
+    capability: Schema.optional(ShareCapability)
+});
+/**
+ * A contiguous batch of committed entries for one run.
+ *
+ * `fromSeq` and `toSeq` describe the interval the server covered, not the
+ * sequences actually carried: dropped admissions leave legitimate holes.
+ * `generation` identifies the history covering the interval and is mandatory
+ * on server responses, including zero. Clients refuse its omission before
+ * deduplicating by sequence. The optional schema permits a typed refusal.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export const EntriesFrame = Schema.TaggedStruct("Entries", {
+    runId: JournalEvent.RunId,
+    generation: Schema.optional(Schema.Int.check(Schema.isGreaterThanOrEqualTo(0))),
+    fromSeq: JournalEvent.Seq,
+    toSeq: JournalEvent.Seq,
+    entries: Schema.Array(JournalEvent.Entry)
+});
+/**
+ * A liveness frame reserved for a future revision, which no rc.0 server emits.
+ *
+ * No server in this package constructs one at rc.0, and a client must not wait
+ * for one: {@link SyncClient} tolerates the variant and ignores it, which is
+ * the whole of the contract today. It stays in the {@link Frame} union so
+ * adding the frame later is not a wire break, and so a third-party client
+ * written against this schema already ignores it.
+ *
+ * Keepalive is a transport concern at rc.0. Emitting a heartbeat here would
+ * spend the subscription's `credit`, which is a hard frame limit, so an idle
+ * follow would resubscribe on a timer instead of staying quiet.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export const HeartbeatFrame = Schema.TaggedStruct("Heartbeat", {});
+/**
+ * A terminal frame reporting that the server ended the subscription.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export const ClosedFrame = Schema.TaggedStruct("Closed", {
+    reason: Schema.optional(Schema.String)
+});
+/**
+ * Any frame a subscription may emit.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export const Frame = Schema.Union([EntriesFrame, HeartbeatFrame, ClosedFrame]);
+/**
+ * A contiguous batch of committed entries as a SERVER states it.
+ *
+ * `generation` is required here: a server that covers an interval knows the
+ * history it read, so omitting it is a compile error rather than a run-time
+ * refusal. {@link EntriesFrame} is the lenient shape a client decodes an
+ * untrusted server's frame into.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export const ServerEntriesFrame = Schema.TaggedStruct("Entries", {
+    runId: JournalEvent.RunId,
+    generation: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+    fromSeq: JournalEvent.Seq,
+    toSeq: JournalEvent.Seq,
+    entries: Schema.Array(JournalEvent.Entry)
+});
+/**
+ * Any frame a subscription may emit, as a server states it.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export const ServerFrame = Schema.Union([ServerEntriesFrame, HeartbeatFrame, ClosedFrame]);
+/**
+ * Whether a scope covers a run.
+ *
+ * @category predicates
+ * @since 0.1.0
+ */
+export const covers = (scope, runId) => scope._tag === "Workspace" || scope.runId === runId;
+/**
+ * Default ceiling on the encoded entries one frame or page may
+ * carry, in bytes.
+ *
+ * Both ends enforce the sum of encoded journal entries, excluding the outer
+ * RPC/frame envelope. Transports must allow their own envelope overhead.
+ * Commands default to 1 MiB; the 2 MiB entry ceiling includes their durable
+ * journal envelope and keeps already-admitted maximum commands consumable.
+ *
+ * @category limits
+ * @since 0.1.0
+ */
+export const defaultMaxFrameBytes = 2 * 1024 * 1024;
+const utf8 = new TextEncoder();
+/** The four bytes `null` occupies, which is what a value with no JSON text
+ * costs once it is inside an encoded frame. */
+const nullByteLength = 4;
+/**
+ * The wire size of one value: the UTF-8 byte length of its JSON text.
+ *
+ * Ceilings measure this encoded form rather than in-memory object size, so a
+ * limit tracks what a transport actually carries.
+ *
+ * The function is TOTAL, because every caller is a size guard whose whole job
+ * is to produce a typed `frame_too_large` refusal rather than a defect:
+ *
+ * - A value with no JSON text at all — `undefined`, a function, a symbol —
+ *   measures {@link nullByteLength}, the bytes it occupies once an enclosing
+ *   array or object encodes it as `null`. It used to measure zero, which let
+ *   an unencodable value pass every ceiling.
+ * - A value `JSON.stringify` refuses — a cycle, a `bigint`, a throwing
+ *   `toJSON` — measures `Infinity`, so it trips every ceiling instead of
+ *   throwing a `TypeError` out of code that only ever fails typed.
+ *
+ * It measures the JSON text, so a `toJSON` method, a getter, or a proxy trap
+ * on the value runs while the size is taken; the read path measures each
+ * entry once per end. Entries that arrive over the wire are schema-decoded
+ * data and have none of those.
+ *
+ * @category limits
+ * @since 0.1.0
+ */
+export const encodedByteLength = (value) => {
+    let text;
+    try {
+        text = JSON.stringify(value);
+    }
+    catch {
+        return Number.POSITIVE_INFINITY;
+    }
+    return text === undefined ? nullByteLength : utf8.encode(text).length;
+};
+//# sourceMappingURL=SyncProtocol.js.map

package/dist/esm/SyncProtocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SyncProtocol.js","sourceRoot":"","sources":["../../src/SyncProtocol.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,YAAY,MAAM,8BAA8B,CAAA;AAC5D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAErD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAA;AAEhC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;AAElE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,EAAE,CAAC,CAAA;AAEjF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC,CAAA;AAU7D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;IACrC,KAAK,EAAE,YAAY,CAAC,KAAK;IACzB,QAAQ,EAAE,YAAY,CAAC,GAAG;IAC1B,mFAAmF;IACnF,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC;CAChF,CAAC,CAAA;AAUF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;AAUtD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC;IACxC,GAAG,SAAS,CAAC,MAAM;IACnB,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;CAC/D,CAAC,CAAA;AAUF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAA;AAUxF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC,CAAA;AAQ/F;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,OAAwB,EAAkC,EAAE;IAC/F,MAAM,IAAI,GAAG,IAAI,GAAG,EAAsB,CAAA;IAC1C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC,KAAK,CAAA;QAC/C,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACxB,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAClC,KAAK,EAAE,YAAY,CAAC,KAAK;IACzB,aAAa,EAAE,YAAY,CAAC,GAAG;IAC/B,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC;CAChF,CAAC,CAAA;AAUF,iEAAiE;AACjE,8EAA8E;AAC9E,sEAAsE;AACtE,oEAAoE;AACpE,MAAM,gBAAgB,GAAG;IACvB,eAAe,EAAE,MAAM,CAAC,GAAG;IAC3B,KAAK,EAAE,YAAY,CAAC,KAAK;IACzB,SAAS,EAAE,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC/D,UAAU,EAAE,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAChE,iBAAiB,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;CAClH,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC;IAC3C,GAAG,gBAAgB;IACnB,UAAU,EAAE,YAAY,CAAC,GAAG;IAC5B,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC;CAC7C,CAAC,CAAA;AAQF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,gBAAgB,EAAE,GAAG,EAAE,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;AAQzG;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAA;AAEhC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,CAAA;AAEtC;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC;IACvC,eAAe,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC;IAC5C,KAAK,EAAE,KAAK;IACZ,OAAO,EAAE,eAAe;IACxB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAC;IACnG,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC;CAC7C,CAAC,CAAA;AAUF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC;IACxC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC;IACzC,OAAO,EAAE,eAAe;IACxB,IAAI,EAAE,MAAM,CAAC,OAAO;CACrB,CAAC,CAAA;AAUF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC9C,GAAG,YAAY,CAAC,MAAM;IACtB,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC;CACpC,CAAC,CAAA;AAUF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC;IAC5C,eAAe,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC;IAC5C,KAAK,EAAE,KAAK;IACZ,OAAO,EAAE,eAAe;IACxB,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,CAAC;IAC1G,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC;CAC7C,CAAC,CAAA;AAUF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE;IACzD,KAAK,EAAE,YAAY,CAAC,KAAK;IACzB,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/E,OAAO,EAAE,YAAY,CAAC,GAAG;IACzB,KAAK,EAAE,YAAY,CAAC,GAAG;IACvB,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC;CAC1C,CAAC,CAAA;AAUF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,YAAY,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;AAElE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE;IACvD,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;CACvC,CAAC,CAAA;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC,CAAA;AAU9E;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE;IAC/D,KAAK,EAAE,YAAY,CAAC,KAAK;IACzB,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;IAC9D,OAAO,EAAE,YAAY,CAAC,GAAG;IACzB,KAAK,EAAE,YAAY,CAAC,GAAG;IACvB,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC;CAC1C,CAAC,CAAA;AAUF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,kBAAkB,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC,CAAA;AAU1F;;;;;GAKG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,KAAY,EAAE,KAAyB,EAAW,EAAE,CACzE,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,CAAA;AAErD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AAEnD,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAA;AAE9B;+CAC+C;AAC/C,MAAM,cAAc,GAAG,CAAC,CAAA;AAExB;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAAc,EAAU,EAAE;IAC1D,IAAI,IAAwB,CAAA;IAC5B,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,iBAAiB,CAAA;IACjC,CAAC;IACD,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAA;AACvE,CAAC,CAAA","sourcesContent":["/**\n * The wire contract shared by the sync server and the browser-safe client.\n *\n * Every message is schema-backed so the same definitions serve the RPC group,\n * the HTTP transport, and replay tooling.\n *\n * @since 0.1.0\n */\n\nimport * as JournalEvent from \"@smthrs/journal/JournalEvent\"\nimport * as Schema from \"effect/Schema\"\nimport { ShareCapability } from \"./BranchProtocol.ts\"\n\n/**\n * Wire revision requiring explicit generations in server positions.\n * Missing request versions decode so the server can return a typed refusal.\n *\n * @category constants\n * @since 1.0.0-rc.0\n */\nexport const protocolVersion = 1\n\n/**\n * Selects every run in the workspace.\n *\n * @category models\n * @since 0.1.0\n */\nexport const WorkspaceScope = Schema.TaggedStruct(\"Workspace\", {})\n\n/**\n * Selects a single run.\n *\n * @category models\n * @since 0.1.0\n */\nexport const RunScope = Schema.TaggedStruct(\"Run\", { runId: JournalEvent.RunId })\n\n/**\n * The set of runs a request covers.\n *\n * @category models\n * @since 0.1.0\n */\nexport const Scope = Schema.Union([WorkspaceScope, RunScope])\n\n/**\n * The set of runs a request covers.\n *\n * @category models\n * @since 0.1.0\n */\nexport type Scope = typeof Scope.Type\n\n/**\n * The last sequence one run has been DELIVERED to a client through.\n *\n * \"Delivered\", not \"applied\": {@link SyncClient}'s default follow advances a\n * cursor as it hands the entry to the consumer, so a consumer whose own apply\n * step then fails must not treat the cursor as an acknowledgement of that\n * apply. A consumer that needs the stronger meaning supplies\n * `SubscribeOptions.apply`, which the client runs to success before the cursor\n * moves. `Progress.applied` records that application claim; a bare wire\n * cursor never acknowledges application to the server.\n *\n * `generation` identifies the run's current history after rewinds. Requests may\n * omit it for persisted generation-zero cursors. Server responses must include\n * it in exactly one cursor for every run represented in Read entries. Clients\n * refuse missing cursor rows or generations before delivery; persist a returned\n * generation with its sequence.\n * Sequence ordering is meaningful only within one generation.\n *\n * @category models\n * @since 0.1.0\n */\nexport const RunCursor = Schema.Struct({\n  runId: JournalEvent.RunId,\n  afterSeq: JournalEvent.Seq,\n  // Omitted only for generation zero (persisted cursors from before rewind support).\n  generation: Schema.optional(Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)))\n})\n\n/**\n * The last sequence one run has been delivered to a client through.\n *\n * @category models\n * @since 0.1.0\n */\nexport type RunCursor = typeof RunCursor.Type\n\n/**\n * A client's delivered position across the workspace.\n *\n * At most ONE cursor per run: a request carrying two cursors for the same run\n * is ambiguous about where the read starts, so the server refuses it with\n * `invalid_request` rather than picking one (see {@link duplicateCursorRunId}).\n *\n * @category models\n * @since 0.1.0\n */\nexport const WorkspaceCursor = Schema.Array(RunCursor)\n\n/**\n * A client's delivered position across the workspace.\n *\n * @category models\n * @since 0.1.0\n */\nexport type WorkspaceCursor = typeof WorkspaceCursor.Type\n\n/**\n * One run's delivered position as a SERVER states it.\n *\n * Identical to {@link RunCursor} except that `generation` is required: a\n * request may omit it for a persisted generation-zero cursor, a response may\n * not. Server positions are typed with this shape so an implementation that\n * omits a generation fails to compile rather than being refused at run time by\n * every client that reads it.\n *\n * The wire schemas stay lenient on purpose. {@link ReadResponse} and\n * {@link Frame} decode an absent generation so {@link SyncClient} can answer a\n * non-conforming server with a typed `protocol_violation` naming the missing\n * field, rather than a bare decode failure.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport const ServerCursor = Schema.Struct({\n  ...RunCursor.fields,\n  generation: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0))\n})\n\n/**\n * One run's delivered position as a server states it.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type ServerCursor = typeof ServerCursor.Type\n\n/**\n * The scope and cursor set every read and subscribe request carries.\n *\n * Server read, server subscribe and client subscribe each admit a\n * caller-built request against this one schema, so an envelope field is\n * declared once and every entry point agrees on what an admitted request is.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport const RequestEnvelope = Schema.Struct({ scope: Scope, cursors: WorkspaceCursor })\n\n/**\n * The scope and cursor set every read and subscribe request carries.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type RequestEnvelope = typeof RequestEnvelope.Type\n\n/**\n * A client's delivery and application positions, as two cursor sets.\n *\n * `delivered` is transport delivery and never an application acknowledgement.\n * `applied` holds the positions committed after a successful `apply` or\n * `onResync` callback; consumers persist state and these positions in the\n * same transaction. The field names carry the distinction, so neither set is\n * wrapped in a tag.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport const Progress = Schema.Struct({ delivered: WorkspaceCursor, applied: WorkspaceCursor })\n\n/** The value form of progress.\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type Progress = typeof Progress.Type\n\n/**\n * The first run named twice in a cursor set, or `undefined` when every run is\n * named at most once.\n *\n * The schema cannot express the uniqueness — `Schema.Array` has no such check\n * — so the one rule is stated once here and enforced by both request paths.\n *\n * @category predicates\n * @since 0.1.0\n */\nexport const duplicateCursorRunId = (cursors: WorkspaceCursor): JournalEvent.RunId | undefined => {\n  const seen = new Set<JournalEvent.RunId>()\n  for (const cursor of cursors) {\n    if (seen.has(cursor.runId)) return cursor.runId\n    seen.add(cursor.runId)\n  }\n  return undefined\n}\n\n/**\n * Where a follower must resume after the server refused a cursor that starts\n * below a run's compaction floor.\n *\n * Compaction deletes the entries below a checkpoint, so a cursor under the\n * floor names history that no longer exists. `checkpointSeq` is that floor:\n * the checkpoint's state subsumes every entry at or below it, so a follower\n * must restore a snapshot covering that sequence before reading forward.\n * Its applied cursor names that snapshot, which may be newer than this floor.\n *\n * `generation` is the run's history the floor belongs to. A run rewound\n * before it was compacted is past generation zero, and a fresh follower has\n * no earlier cursor to learn that from, so a recovery receipt that omits its\n * generation is bound to this one. The server's refusal of a read always\n * carries it; a snapshot that falls short of a floor refuses without one.\n *\n * This field carries no replacement state. The client fails closed without\n * an explicit recovery handler returning the cursor it actually restored.\n * `SnapshotRequest` fetches a separately selected public projection. Raw journal\n * checkpoints are unredacted and must not be exposed under history permission.\n *\n * @category models\n * @since 0.1.0\n */\nexport const Resync = Schema.Struct({\n  runId: JournalEvent.RunId,\n  checkpointSeq: JournalEvent.Seq,\n  generation: Schema.optional(Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)))\n})\n\n/**\n * Where a follower must resume after a compaction refusal.\n *\n * @category models\n * @since 0.1.0\n */\nexport type Resync = typeof Resync.Type\n\n// `protocolVersion` accepts any integer here for the same reason\n// `ReadRequest` and `SubscribeRequest` do: a mismatch decodes so the boundary\n// can answer it with a typed `protocol_violation` instead of a decode\n// failure, and the accepted number lives only in `protocolVersion`.\nconst snapshotIdentity = {\n  protocolVersion: Schema.Int,\n  runId: JournalEvent.RunId,\n  lineageId: Schema.NonEmptyString.check(Schema.isMaxLength(512)),\n  projection: Schema.NonEmptyString.check(Schema.isMaxLength(128)),\n  projectionVersion: Schema.Int.check(Schema.isGreaterThanOrEqualTo(1), Schema.isLessThan(Number.MAX_SAFE_INTEGER))\n}\n\n/**\n * Requests an explicitly public projection covering the missing prefix.\n * Identity and version must match exactly; this never requests raw engine state.\n * @category models\n * @since 1.0.0-rc.0\n */\nexport const SnapshotRequest = Schema.Struct({\n  ...snapshotIdentity,\n  atLeastSeq: JournalEvent.Seq,\n  capability: Schema.optional(ShareCapability)\n})\n\n/** A decoded request for an explicitly public projection.\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type SnapshotRequest = typeof SnapshotRequest.Type\n\n/**\n * A complete public projection through `seq`, inclusive. Apply its state and\n * durable cursor atomically, then read entries strictly after `seq`.\n * @category models\n * @since 1.0.0-rc.0\n */\nexport const Snapshot = Schema.Struct({ ...snapshotIdentity, seq: JournalEvent.Seq, state: Schema.Json })\n\n/** A complete, versioned public projection at one journal sequence.\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type Snapshot = typeof Snapshot.Type\n\n/**\n * Largest number of entries one {@link ReadRequest} may ask for.\n *\n * `limit` is request-controlled fan-out: the server passes it to the journal\n * as the page size, once per covered run, so an unbounded limit made one\n * workspace read materialize an unbounded number of rows per run. The frame\n * ceiling does not cover it — that drops entries AFTER they have been read.\n * A request above this bound is refused at the wire, and an in-process caller\n * that bypasses the schema is clamped to it.\n *\n * @category limits\n * @since 0.1.0\n */\nexport const maxReadLimit = 1024\n\n/**\n * Largest number of frames one {@link SubscribeRequest} may hold open.\n *\n * Credit is a hard frame limit, so it is also how long one subscription may\n * pin a server-side fan-out. The bound keeps that lifetime a function of the\n * protocol rather than of what the caller asks for; a follower that wants\n * more resubscribes from the cursors it has, which is what\n * `SyncClient.defaultCredit` already does.\n *\n * @category limits\n * @since 0.1.0\n */\nexport const maxSubscribeCredit = 4096\n\n/**\n * A durable catch-up request.\n *\n * `capability` authorizes branch runs: a run whose id maps to a shared branch\n * is only read when the capability verifies for that branch. Non-branch runs\n * ignore it.\n *\n * `limit` is bounded on both sides: at least one entry, at most\n * {@link maxReadLimit}.\n *\n * @category models\n * @since 0.1.0\n */\nexport const ReadRequest = Schema.Struct({\n  protocolVersion: Schema.optional(Schema.Int),\n  scope: Scope,\n  cursors: WorkspaceCursor,\n  limit: Schema.Int.check(Schema.isGreaterThanOrEqualTo(1), Schema.isLessThanOrEqualTo(maxReadLimit)),\n  capability: Schema.optional(ShareCapability)\n})\n\n/**\n * A durable catch-up request.\n *\n * @category models\n * @since 0.1.0\n */\nexport type ReadRequest = typeof ReadRequest.Type\n\n/**\n * One page of durable catch-up entries.\n *\n * `done` reports that the page reached the durable tail, which is the point at\n * which a client may switch from paging to following.\n *\n * @category models\n * @since 0.1.0\n */\nexport const ReadResponse = Schema.Struct({\n  entries: Schema.Array(JournalEvent.Entry),\n  cursors: WorkspaceCursor,\n  done: Schema.Boolean\n})\n\n/**\n * One page of durable catch-up entries.\n *\n * @category models\n * @since 0.1.0\n */\nexport type ReadResponse = typeof ReadResponse.Type\n\n/**\n * One page of durable catch-up entries as a SERVER states it.\n *\n * Every cursor carries its generation. {@link SyncServer.Service} answers with\n * this shape; {@link ReadResponse} is the lenient shape a client decodes an\n * untrusted server's page into before refusing a missing generation.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport const ServerReadResponse = Schema.Struct({\n  ...ReadResponse.fields,\n  cursors: Schema.Array(ServerCursor)\n})\n\n/**\n * One page of durable catch-up entries as a server states it.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type ServerReadResponse = typeof ServerReadResponse.Type\n\n/**\n * A request to follow committed entries.\n *\n * `capability` authorizes branch runs exactly as on {@link ReadRequest}.\n *\n * `credit` is bounded on both sides: at least one frame, at most\n * {@link maxSubscribeCredit}. Zero is refused rather than served as an\n * immediately-empty stream, because the two readings of it — \"open a window\n * of nothing\" and \"a caller computed its window wrong\" — are\n * indistinguishable on the wire, and the second one busy-loops a follow that\n * replenishes by resubscribing.\n *\n * @category models\n * @since 0.1.0\n */\nexport const SubscribeRequest = Schema.Struct({\n  protocolVersion: Schema.optional(Schema.Int),\n  scope: Scope,\n  cursors: WorkspaceCursor,\n  credit: Schema.Int.check(Schema.isGreaterThanOrEqualTo(1), Schema.isLessThanOrEqualTo(maxSubscribeCredit)),\n  capability: Schema.optional(ShareCapability)\n})\n\n/**\n * A request to follow committed entries.\n *\n * @category models\n * @since 0.1.0\n */\nexport type SubscribeRequest = typeof SubscribeRequest.Type\n\n/**\n * A contiguous batch of committed entries for one run.\n *\n * `fromSeq` and `toSeq` describe the interval the server covered, not the\n * sequences actually carried: dropped admissions leave legitimate holes.\n * `generation` identifies the history covering the interval and is mandatory\n * on server responses, including zero. Clients refuse its omission before\n * deduplicating by sequence. The optional schema permits a typed refusal.\n *\n * @category models\n * @since 0.1.0\n */\nexport const EntriesFrame = Schema.TaggedStruct(\"Entries\", {\n  runId: JournalEvent.RunId,\n  generation: Schema.optional(Schema.Int.check(Schema.isGreaterThanOrEqualTo(0))),\n  fromSeq: JournalEvent.Seq,\n  toSeq: JournalEvent.Seq,\n  entries: Schema.Array(JournalEvent.Entry)\n})\n\n/**\n * A contiguous batch of committed entries for one run.\n *\n * @category models\n * @since 0.1.0\n */\nexport type EntriesFrame = typeof EntriesFrame.Type\n\n/**\n * A liveness frame reserved for a future revision, which no rc.0 server emits.\n *\n * No server in this package constructs one at rc.0, and a client must not wait\n * for one: {@link SyncClient} tolerates the variant and ignores it, which is\n * the whole of the contract today. It stays in the {@link Frame} union so\n * adding the frame later is not a wire break, and so a third-party client\n * written against this schema already ignores it.\n *\n * Keepalive is a transport concern at rc.0. Emitting a heartbeat here would\n * spend the subscription's `credit`, which is a hard frame limit, so an idle\n * follow would resubscribe on a timer instead of staying quiet.\n *\n * @category models\n * @since 0.1.0\n */\nexport const HeartbeatFrame = Schema.TaggedStruct(\"Heartbeat\", {})\n\n/**\n * A terminal frame reporting that the server ended the subscription.\n *\n * @category models\n * @since 0.1.0\n */\nexport const ClosedFrame = Schema.TaggedStruct(\"Closed\", {\n  reason: Schema.optional(Schema.String)\n})\n\n/**\n * Any frame a subscription may emit.\n *\n * @category models\n * @since 0.1.0\n */\nexport const Frame = Schema.Union([EntriesFrame, HeartbeatFrame, ClosedFrame])\n\n/**\n * Any frame a subscription may emit.\n *\n * @category models\n * @since 0.1.0\n */\nexport type Frame = typeof Frame.Type\n\n/**\n * A contiguous batch of committed entries as a SERVER states it.\n *\n * `generation` is required here: a server that covers an interval knows the\n * history it read, so omitting it is a compile error rather than a run-time\n * refusal. {@link EntriesFrame} is the lenient shape a client decodes an\n * untrusted server's frame into.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport const ServerEntriesFrame = Schema.TaggedStruct(\"Entries\", {\n  runId: JournalEvent.RunId,\n  generation: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),\n  fromSeq: JournalEvent.Seq,\n  toSeq: JournalEvent.Seq,\n  entries: Schema.Array(JournalEvent.Entry)\n})\n\n/**\n * A contiguous batch of committed entries as a server states it.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type ServerEntriesFrame = typeof ServerEntriesFrame.Type\n\n/**\n * Any frame a subscription may emit, as a server states it.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport const ServerFrame = Schema.Union([ServerEntriesFrame, HeartbeatFrame, ClosedFrame])\n\n/**\n * Any frame a subscription may emit, as a server states it.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type ServerFrame = typeof ServerFrame.Type\n\n/**\n * Whether a scope covers a run.\n *\n * @category predicates\n * @since 0.1.0\n */\nexport const covers = (scope: Scope, runId: JournalEvent.RunId): boolean =>\n  scope._tag === \"Workspace\" || scope.runId === runId\n\n/**\n * Default ceiling on the encoded entries one frame or page may\n * carry, in bytes.\n *\n * Both ends enforce the sum of encoded journal entries, excluding the outer\n * RPC/frame envelope. Transports must allow their own envelope overhead.\n * Commands default to 1 MiB; the 2 MiB entry ceiling includes their durable\n * journal envelope and keeps already-admitted maximum commands consumable.\n *\n * @category limits\n * @since 0.1.0\n */\nexport const defaultMaxFrameBytes = 2 * 1024 * 1024\n\nconst utf8 = new TextEncoder()\n\n/** The four bytes `null` occupies, which is what a value with no JSON text\n * costs once it is inside an encoded frame. */\nconst nullByteLength = 4\n\n/**\n * The wire size of one value: the UTF-8 byte length of its JSON text.\n *\n * Ceilings measure this encoded form rather than in-memory object size, so a\n * limit tracks what a transport actually carries.\n *\n * The function is TOTAL, because every caller is a size guard whose whole job\n * is to produce a typed `frame_too_large` refusal rather than a defect:\n *\n * - A value with no JSON text at all — `undefined`, a function, a symbol —\n *   measures {@link nullByteLength}, the bytes it occupies once an enclosing\n *   array or object encodes it as `null`. It used to measure zero, which let\n *   an unencodable value pass every ceiling.\n * - A value `JSON.stringify` refuses — a cycle, a `bigint`, a throwing\n *   `toJSON` — measures `Infinity`, so it trips every ceiling instead of\n *   throwing a `TypeError` out of code that only ever fails typed.\n *\n * It measures the JSON text, so a `toJSON` method, a getter, or a proxy trap\n * on the value runs while the size is taken; the read path measures each\n * entry once per end. Entries that arrive over the wire are schema-decoded\n * data and have none of those.\n *\n * @category limits\n * @since 0.1.0\n */\nexport const encodedByteLength = (value: unknown): number => {\n  let text: string | undefined\n  try {\n    text = JSON.stringify(value)\n  } catch {\n    return Number.POSITIVE_INFINITY\n  }\n  return text === undefined ? nullByteLength : utf8.encode(text).length\n}\n"]}

package/dist/esm/SyncRpcs.d.ts

@@ -0,0 +1,92 @@
+/**
+ * Schema-backed RPC projection of the sync read path.
+ *
+ * @since 0.1.0
+ */
+import { Rpc, RpcGroup, RpcMiddleware } from "effect/unstable/rpc";
+import { SyncError } from "./SyncError.ts";
+declare const SyncAuth_base: RpcMiddleware.ServiceClass<SyncAuth, "@smthrs/sync/SyncAuth", never, typeof SyncError, never, never, false>;
+/**
+ * Authentication boundary for the sync RPC group.
+ *
+ * The middleware authenticates each request to a `SyncPrincipal` before the
+ * handler runs. The production implementation is `SyncAuth.layer`, which
+ * verifies the workspace capability presented in the request headers and
+ * installs the resulting principal; a request without a credential runs as
+ * the anonymous principal, which the server refuses for every non-branch
+ * read.
+ *
+ * @category middleware
+ * @since 0.1.0
+ */
+export declare class SyncAuth extends SyncAuth_base {
+}
+/**
+ * The remote procedures of the sync read path.
+ *
+ * A subscription's `credit` is a hard frame limit. Clients reconnect with
+ * their materialized cursor to replenish it; there is no separate
+ * acknowledgement channel.
+ *
+ * @category groups
+ * @since 0.1.0
+ */
+export declare const SyncRpcs: RpcGroup.RpcGroup<Rpc.Rpc<"Sync.Snapshot", import("effect/Schema").Struct<{
+    readonly atLeastSeq: import("effect/Schema").brand<import("effect/Schema").Int, "@smthrs/journal/JournalEvent/Seq">;
+    readonly capability: import("effect/Schema").optional<typeof import("./BranchProtocol.ts").ShareCapability>;
+    readonly protocolVersion: import("effect/Schema").Int;
+    readonly runId: import("effect/Schema").brand<import("effect/Schema").String, "@smthrs/journal/JournalEvent/RunId">;
+    readonly lineageId: import("effect/Schema").NonEmptyString;
+    readonly projection: import("effect/Schema").NonEmptyString;
+    readonly projectionVersion: import("effect/Schema").Int;
+}>, import("effect/Schema").Struct<{
+    readonly seq: import("effect/Schema").brand<import("effect/Schema").Int, "@smthrs/journal/JournalEvent/Seq">;
+    readonly state: import("effect/Schema").Codec<import("effect/Schema").Json, import("effect/Schema").Json, never, never>;
+    readonly protocolVersion: import("effect/Schema").Int;
+    readonly runId: import("effect/Schema").brand<import("effect/Schema").String, "@smthrs/journal/JournalEvent/RunId">;
+    readonly lineageId: import("effect/Schema").NonEmptyString;
+    readonly projection: import("effect/Schema").NonEmptyString;
+    readonly projectionVersion: import("effect/Schema").Int;
+}>, typeof SyncError, typeof SyncAuth, never> | Rpc.Rpc<"Sync.Read", import("effect/Schema").Struct<{
+    readonly protocolVersion: import("effect/Schema").optional<import("effect/Schema").Int>;
+    readonly scope: import("effect/Schema").Union<readonly [import("effect/Schema").TaggedStruct<"Workspace", {}>, import("effect/Schema").TaggedStruct<"Run", {
+        readonly runId: import("effect/Schema").brand<import("effect/Schema").String, "@smthrs/journal/JournalEvent/RunId">;
+    }>]>;
+    readonly cursors: import("effect/Schema").$Array<import("effect/Schema").Struct<{
+        readonly runId: import("effect/Schema").brand<import("effect/Schema").String, "@smthrs/journal/JournalEvent/RunId">;
+        readonly afterSeq: import("effect/Schema").brand<import("effect/Schema").Int, "@smthrs/journal/JournalEvent/Seq">;
+        readonly generation: import("effect/Schema").optional<import("effect/Schema").Int>;
+    }>>;
+    readonly limit: import("effect/Schema").Int;
+    readonly capability: import("effect/Schema").optional<typeof import("./BranchProtocol.ts").ShareCapability>;
+}>, import("effect/Schema").Struct<{
+    readonly entries: import("effect/Schema").$Array<typeof import("@smthrs/journal/JournalEvent").Entry>;
+    readonly cursors: import("effect/Schema").$Array<import("effect/Schema").Struct<{
+        readonly runId: import("effect/Schema").brand<import("effect/Schema").String, "@smthrs/journal/JournalEvent/RunId">;
+        readonly afterSeq: import("effect/Schema").brand<import("effect/Schema").Int, "@smthrs/journal/JournalEvent/Seq">;
+        readonly generation: import("effect/Schema").optional<import("effect/Schema").Int>;
+    }>>;
+    readonly done: import("effect/Schema").Boolean;
+}>, typeof SyncError, typeof SyncAuth, never> | Rpc.Rpc<"Sync.Subscribe", import("effect/Schema").Struct<{
+    readonly protocolVersion: import("effect/Schema").optional<import("effect/Schema").Int>;
+    readonly scope: import("effect/Schema").Union<readonly [import("effect/Schema").TaggedStruct<"Workspace", {}>, import("effect/Schema").TaggedStruct<"Run", {
+        readonly runId: import("effect/Schema").brand<import("effect/Schema").String, "@smthrs/journal/JournalEvent/RunId">;
+    }>]>;
+    readonly cursors: import("effect/Schema").$Array<import("effect/Schema").Struct<{
+        readonly runId: import("effect/Schema").brand<import("effect/Schema").String, "@smthrs/journal/JournalEvent/RunId">;
+        readonly afterSeq: import("effect/Schema").brand<import("effect/Schema").Int, "@smthrs/journal/JournalEvent/Seq">;
+        readonly generation: import("effect/Schema").optional<import("effect/Schema").Int>;
+    }>>;
+    readonly credit: import("effect/Schema").Int;
+    readonly capability: import("effect/Schema").optional<typeof import("./BranchProtocol.ts").ShareCapability>;
+}>, import("effect/unstable/rpc/RpcSchema").Stream<import("effect/Schema").Union<readonly [import("effect/Schema").TaggedStruct<"Entries", {
+    readonly runId: import("effect/Schema").brand<import("effect/Schema").String, "@smthrs/journal/JournalEvent/RunId">;
+    readonly generation: import("effect/Schema").optional<import("effect/Schema").Int>;
+    readonly fromSeq: import("effect/Schema").brand<import("effect/Schema").Int, "@smthrs/journal/JournalEvent/Seq">;
+    readonly toSeq: import("effect/Schema").brand<import("effect/Schema").Int, "@smthrs/journal/JournalEvent/Seq">;
+    readonly entries: import("effect/Schema").$Array<typeof import("@smthrs/journal/JournalEvent").Entry>;
+}>, import("effect/Schema").TaggedStruct<"Heartbeat", {}>, import("effect/Schema").TaggedStruct<"Closed", {
+    readonly reason: import("effect/Schema").optional<import("effect/Schema").String>;
+}>]>, typeof SyncError>, import("effect/Schema").Never, typeof SyncAuth, never>>;
+export {};
+//# sourceMappingURL=SyncRpcs.d.ts.map

package/dist/esm/SyncRpcs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SyncRpcs.d.ts","sourceRoot":"","sources":["../../src/SyncRpcs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;;AAG1C;;;;;;;;;;;;GAYG;AACH,qBAAa,QAAS,SAAQ,aAAgF;CAAG;AAEjH;;;;;;;;;GASG;AACH,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gFAIC,CAAA"}

package/dist/esm/SyncRpcs.js

@@ -0,0 +1,35 @@
+/**
+ * Schema-backed RPC projection of the sync read path.
+ *
+ * @since 0.1.0
+ */
+import { Rpc, RpcGroup, RpcMiddleware } from "effect/unstable/rpc";
+import { SyncError } from "./SyncError.js";
+import { Frame, ReadRequest, ReadResponse, Snapshot, SnapshotRequest, SubscribeRequest } from "./SyncProtocol.js";
+/**
+ * Authentication boundary for the sync RPC group.
+ *
+ * The middleware authenticates each request to a `SyncPrincipal` before the
+ * handler runs. The production implementation is `SyncAuth.layer`, which
+ * verifies the workspace capability presented in the request headers and
+ * installs the resulting principal; a request without a credential runs as
+ * the anonymous principal, which the server refuses for every non-branch
+ * read.
+ *
+ * @category middleware
+ * @since 0.1.0
+ */
+export class SyncAuth extends RpcMiddleware.Service()("@smthrs/sync/SyncAuth", { error: SyncError }) {
+}
+/**
+ * The remote procedures of the sync read path.
+ *
+ * A subscription's `credit` is a hard frame limit. Clients reconnect with
+ * their materialized cursor to replenish it; there is no separate
+ * acknowledgement channel.
+ *
+ * @category groups
+ * @since 0.1.0
+ */
+export const SyncRpcs = RpcGroup.make(Rpc.make("Sync.Snapshot", { payload: SnapshotRequest, success: Snapshot, error: SyncError }), Rpc.make("Sync.Read", { payload: ReadRequest, success: ReadResponse, error: SyncError }), Rpc.make("Sync.Subscribe", { payload: SubscribeRequest, success: Frame, error: SyncError, stream: true })).middleware(SyncAuth);
+//# sourceMappingURL=SyncRpcs.js.map

package/dist/esm/SyncRpcs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SyncRpcs.js","sourceRoot":"","sources":["../../src/SyncRpcs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAC1C,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAEjH;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,QAAS,SAAQ,aAAa,CAAC,OAAO,EAAY,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;CAAG;AAEjH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CACnC,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAC5F,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EACxF,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAC1G,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAA","sourcesContent":["/**\n * Schema-backed RPC projection of the sync read path.\n *\n * @since 0.1.0\n */\n\nimport { Rpc, RpcGroup, RpcMiddleware } from \"effect/unstable/rpc\"\nimport { SyncError } from \"./SyncError.ts\"\nimport { Frame, ReadRequest, ReadResponse, Snapshot, SnapshotRequest, SubscribeRequest } from \"./SyncProtocol.ts\"\n\n/**\n * Authentication boundary for the sync RPC group.\n *\n * The middleware authenticates each request to a `SyncPrincipal` before the\n * handler runs. The production implementation is `SyncAuth.layer`, which\n * verifies the workspace capability presented in the request headers and\n * installs the resulting principal; a request without a credential runs as\n * the anonymous principal, which the server refuses for every non-branch\n * read.\n *\n * @category middleware\n * @since 0.1.0\n */\nexport class SyncAuth extends RpcMiddleware.Service<SyncAuth>()(\"@smthrs/sync/SyncAuth\", { error: SyncError }) {}\n\n/**\n * The remote procedures of the sync read path.\n *\n * A subscription's `credit` is a hard frame limit. Clients reconnect with\n * their materialized cursor to replenish it; there is no separate\n * acknowledgement channel.\n *\n * @category groups\n * @since 0.1.0\n */\nexport const SyncRpcs = RpcGroup.make(\n  Rpc.make(\"Sync.Snapshot\", { payload: SnapshotRequest, success: Snapshot, error: SyncError }),\n  Rpc.make(\"Sync.Read\", { payload: ReadRequest, success: ReadResponse, error: SyncError }),\n  Rpc.make(\"Sync.Subscribe\", { payload: SubscribeRequest, success: Frame, error: SyncError, stream: true })\n).middleware(SyncAuth)\n"]}