@spine-event-engine/server 2.0.0-snapshot.24 → 2.0.0-snapshot.26

package/dist/stand/stand.js

@@ -12,14 +12,23 @@
  * the License.
  */
 var _a;
-import { clone } from "@bufbuild/protobuf";
-import { TypeUrls } from "@spine-event-engine/core";
-import { TenantIdSchema, VersionSchema, } from "@spine-event-engine/proto";
+import { clone, create, toBinary } from "@bufbuild/protobuf";
+import { AnySchema } from "@bufbuild/protobuf/wkt";
+import { TypeRegistry, TypeUrls } from "@spine-event-engine/core";
+import { registeredProtoModules } from "@spine-event-engine/proto/codegen";
+import { ActorContextSchema, EventSchema, TenantIdSchema, VersionSchema, } from "@spine-event-engine/proto";
 import { ColumnTypes, RecordColumn, RecordQuery, } from "@spine-event-engine/storage";
 import { TenantBoundary } from "@spine-event-engine/storage/provider";
-import { EntityRecords, standEntityStorageDescriptor, } from "../entity/entity-storage-descriptor.js";
+import { EntityIds, EntityRecords, standEntityStorageDescriptor, } from "../entity/entity-storage-descriptor.js";
 import { SubscriptionObservers } from "./subscription-observer.js";
+import { ReadSideFilterEngine } from "./read-side-filter-engine.js";
+import { SubscriptionReadFilters } from "./subscription-read-filters.js";
+import { ReadSideMessages } from "./read-side-message.js";
+import { StandDirectDelivery, } from "./stand-direct-delivery.js";
+import { ServerEnvironment } from "../server/server-environment.js";
+import { snapshotTrustedReader, } from "@spine-event-engine/core/spi/trusted-reader";
 const HANDLE_CLOSE_ERROR_LIMIT = 16;
+export { StandSubscriptionCapacityError } from "./stand-direct-delivery.js";
 /**
  * Error thrown when direct Stand access targets an unregistered state type.
  */
@@ -54,12 +63,14 @@ export class StandStateTypeError extends Error {
  */
 export class Stand {
     #context;
+    #subscriptionQueueCapacity;
     #storageFactory;
     #registrations = new Map();
     #entityHandles = new Map();
     #handleCloseErrors = [];
     #omittedHandleCloseErrors = 0;
     #inFlight = new Set();
+    #pendingUpdates = new Map();
     #closing = false;
     #closed = false;
     #closedPromise;
@@ -69,10 +80,12 @@ export class Stand {
      * @param options The storage context and factory used for state records.
      */
     constructor(options) {
+        this.#subscriptionQueueCapacity = ServerEnvironment.instance().subscriptionQueueCapacity;
         this.#context = _a.#cloneContext(options.context);
         this.#storageFactory = options.storageFactory;
         deferredUpdates.set(this, (schema, state, updateOptions, metadata) => this.#deferUpdate(schema, state, updateOptions, metadata));
         currentReads.set(this, (schema, id, readOptions) => this.#readCurrent(schema, id, readOptions));
+        routedQueryPlans.set(this, (schema, plan, readOptions, readSide) => this.#queryPlanVersioned(schema, plan, readOptions, readSide));
     }
     /**
      * Registers one entity state schema. Re-registering the same schema is idempotent.
@@ -144,26 +157,46 @@ export class Stand {
      * @returns The current state and version, or undefined when no live record exists.
      */
     async readVersioned(schema, id, options = {}) {
-        const finish = this.#beginOperation();
+        const finish = this.#beginPublicOperation();
         try {
+            const captured = _a.#snapshotRead(options);
+            const copiedId = ReadSideMessages.copy(id);
             const registration = this.#registration(schema, "read");
-            const tenantId = this.#tenantId(options.tenantId);
-            const storage = this.#leaseCurrent(registration, tenantId);
-            try {
-                const stored = await storage.current.read(id);
-                if (stored === undefined || EntityRecords.unpack(registration.schema, stored).deleted) {
-                    return undefined;
-                }
-                return this.#currentResult(registration, stored);
-            }
-            finally {
-                storage.release();
-            }
+            const tenantId = await this.#checkedTenantId(captured.tenantId);
+            const result = await this.#readStored(registration, copiedId, tenantId);
+            return await this.#filteredResult(registration.schema, result, {
+                ...captured,
+                ...(tenantId === undefined ? {} : { tenantId }),
+            }, {
+                kind: "direct",
+                read: { typeUrl: registration.typeUrl, id: copiedId },
+            });
         }
         finally {
             finish();
         }
     }
+    /**
+     * Captures a current record and releases its provider lease before policy awaits.
+     *
+     * @typeParam Schema Registered state schema.
+     * @param registration State metadata and storage descriptor.
+     * @param id Detached Entity identifier.
+     * @param tenantId Admitted tenant, if multitenant.
+     * @returns Detached live state and version, or undefined.
+     */
+    async #readStored(registration, id, tenantId) {
+        const storage = this.#leaseCurrent(registration, tenantId);
+        try {
+            const stored = await storage.current.read(id);
+            if (stored === undefined || EntityRecords.unpack(registration.schema, stored).deleted)
+                return undefined;
+            return this.#currentResult(registration, stored);
+        }
+        finally {
+            storage.release();
+        }
+    }
     /**
      * Reads all latest states and version metadata in storage query order.
      *
@@ -185,19 +218,27 @@ export class Stand {
      * @returns The matching current states and versions.
      */
     async queryVersioned(schema, query = {}, options = {}) {
-        const finish = this.#beginOperation();
+        const finish = this.#beginPublicOperation();
         try {
+            const captured = _a.#snapshotRead(options);
+            const copiedQuery = ReadSideMessages.copy(query);
             const registration = this.#registration(schema, "read");
-            const tenantId = this.#tenantId(options.tenantId);
+            const tenantId = await this.#checkedTenantId(captured.tenantId);
             const storage = this.#leaseCurrent(registration, tenantId);
+            let results;
             try {
-                const stored = await storage.current.query(_a.#legacyPlan(query));
-                const results = stored.map((entry) => this.#entryResult(registration, entry.record));
-                return results.filter((result) => result !== undefined);
+                const stored = await storage.current.query(_a.#legacyPlan(copiedQuery));
+                results = stored
+                    .map((entry) => this.#entryResult(registration, entry.record))
+                    .filter((result) => result !== undefined);
             }
             finally {
                 storage.release();
             }
+            return await this.#filteredResults(registration.schema, results, {
+                ...captured,
+                ...(tenantId === undefined ? {} : { tenantId }),
+            }, { kind: "direct", query: copiedQuery });
         }
         finally {
             finish();
@@ -213,24 +254,117 @@ export class Stand {
      * @returns The matching current states and versions.
      */
     async queryPlanVersioned(schema, plan, options = {}) {
-        const finish = this.#beginOperation();
+        return this.#queryPlanVersioned(schema, plan, options);
+    }
+    /**
+     * Reads stored rows and applies the context's outward policy in one operation lifetime.
+     * @typeParam Schema Registered state schema.
+     * @param schema Registered Entity state schema.
+     * @param plan Normalized storage query plan.
+     * @param options Trusted read facts and tenant.
+     * @param readSide Actual routed Query context, if supplied internally.
+     * @returns Surviving versioned state records.
+     */
+    async #queryPlanVersioned(schema, plan, options, readSide) {
+        const finish = this.#beginPublicOperation();
         try {
+            const captured = _a.#snapshotRead(options, readSide);
+            const copiedPlan = ReadSideMessages.copy(plan);
             const registration = this.#registration(schema, "read");
-            const tenantId = this.#tenantId(options.tenantId);
+            const tenantId = await this.#checkedTenantId(captured.tenantId);
             const storage = this.#leaseCurrent(registration, tenantId);
+            let results;
             try {
-                const stored = await storage.current.query(plan);
-                const results = stored.map((entry) => this.#entryResult(registration, entry.record));
-                return results.filter((result) => result !== undefined);
+                const stored = await storage.current.query(copiedPlan);
+                results = stored
+                    .map((entry) => this.#entryResult(registration, entry.record))
+                    .filter((result) => result !== undefined);
             }
             finally {
                 storage.release();
             }
+            return await this.#filteredResults(registration.schema, results, {
+                ...captured,
+                ...(tenantId === undefined ? {} : { tenantId }),
+            }, { kind: "direct", plan: copiedPlan });
         }
         finally {
             finish();
         }
     }
+    /**
+     * Detaches mutable caller facts before storage admission can await.
+     *
+     * @param options Direct or service read options.
+     * @returns Stable tenant and invocation facts, retaining the live cancellation signal.
+     */
+    static #snapshotRead(options, side) {
+        const { signal, producingContext, effectiveTenant, parent, field, ...facts } = side ?? {};
+        void producingContext;
+        void effectiveTenant;
+        void parent;
+        void field;
+        return {
+            ...(options.tenantId === undefined
+                ? {}
+                : { tenantId: clone(TenantIdSchema, options.tenantId) }),
+            readSide: {
+                ...(side === undefined ? {} : ReadSideMessages.copy(facts)),
+                ...(options.actorContext === undefined
+                    ? {}
+                    : { actorContext: clone(ActorContextSchema, options.actorContext) }),
+                ...(options.reader === undefined ? {} : snapshotTrustedReader(options.reader)),
+                ...((signal ?? options.signal) === undefined ? {} : { signal: signal ?? options.signal }),
+            },
+        };
+    }
+    /**
+     * Applies this context's outward read policy after storage has been released.
+     *
+     * @typeParam Schema Registered state schema.
+     * @param schema State schema selected by the read.
+     * @param result Captured state and durable version.
+     * @param options Tenant and service read facts.
+     * @param operation Actual direct operation when no service request is present.
+     * @returns Detached visible state with its unchanged version, or no state.
+     */
+    async #filteredResult(schema, result, options, operation) {
+        if (result === undefined)
+            return undefined;
+        const filters = standReadFilters.get(this);
+        if (filters === undefined)
+            return result;
+        const producer = standProducingContexts.get(this);
+        const context = {
+            ...(options.readSide ?? {}),
+            operation: options.readSide?.operation ?? operation,
+            ...(producer === undefined ? {} : { producingContext: producer }),
+            ...(options.tenantId === undefined ? {} : { effectiveTenant: options.tenantId }),
+        };
+        const state = await filters.apply(schema, result.state, context);
+        return state === null ? undefined : { ...result, state };
+    }
+    /**
+     * Applies outward policy in stored query order without replenishing removed records.
+     *
+     * @typeParam Schema Registered state schema.
+     * @param schema State schema selected by the read.
+     * @param results Captured stored states and durable versions.
+     * @param options Tenant and service read facts.
+     * @param operation Actual direct query when no service request is present.
+     * @returns Surviving visible records in their original order.
+     */
+    async #filteredResults(schema, results, options, operation) {
+        if (!standReadFilters.has(this))
+            return results;
+        const visible = [];
+        for (const result of results) {
+            const next = await this.#filteredResult(schema, result, options, operation);
+            if (next !== undefined)
+                visible.push(next);
+        }
+        return visible;
+    }
     /**
      * Clears all stored states and durable version metadata for one known state schema.
      *
@@ -246,7 +380,7 @@ export class Stand {
         const finish = this.#beginOperation();
         try {
             const registration = this.#registration(schema, "clear");
-            const tenantId = this.#tenantId(options.tenantId);
+            const tenantId = await this.#checkedTenantId(options.tenantId);
             const storage = this.#leaseCurrent(registration, tenantId);
             try {
                 const entries = await storage.current.query({
@@ -317,26 +451,77 @@ export class Stand {
      * @returns Prepared write with cleanup actions.
      */
     async #prepareUpdate(schema, state, options, metadata) {
-        const finish = this.#beginOperation();
+        const onFinish = this.#beginOperation();
         let storage;
+        let releaseUpdate;
         try {
             const registration = this.#registration(schema, "update");
-            if (metadata !== undefined && metadata.schema !== registration.schema)
-                throw new Error("Repository metadata does not match the Entity state schema.");
-            const tenantId = this.#tenantId(options.tenantId);
+            _a.#requireUpdateMetadata(registration, metadata);
             const snapshot = _a.#snapshotUpdateOptions(options);
             const stateCopy = clone(schema, state);
+            const tenantId = await this.#checkedTenantId(options.tenantId);
             const id = _a.#readStateId(stateCopy, registration);
+            releaseUpdate = await this.#reserveUpdate(registration, tenantId, id, metadata);
             storage = this.#leaseCurrent(registration, tenantId);
             const previousState = await this.#previousUpdateState(registration, tenantId, id, storage);
-            return this.#preparedUpdate(registration, { id, previousState, state: stateCopy, tenantId, version: snapshot.version }, snapshot, metadata, storage, finish);
+            return this.#preparedUpdate(registration, { id, previousState, state: stateCopy, tenantId, version: snapshot.version }, snapshot, metadata, storage, () => {
+                _a.#finishUpdate(releaseUpdate, onFinish);
+            });
         }
         catch (error) {
             storage?.release();
-            finish();
+            _a.#finishUpdate(releaseUpdate, onFinish);
             throw error;
         }
     }
+    /**
+     * Checks repository metadata before preparing the state update.
+     *
+     * @param registration Registered state metadata.
+     * @param metadata Repository metadata, when supplied.
+     */
+    static #requireUpdateMetadata(registration, metadata) {
+        if (metadata !== undefined && metadata.schema !== registration.schema)
+            throw new Error("Repository metadata does not match the Entity state schema.");
+    }
+    /**
+     * Releases the update reservation and completes its tracked Stand operation.
+     *
+     * @param onReleaseUpdate Per-Entity reservation release, when acquired.
+     * @param onFinish Completes the tracked Stand operation.
+     */
+    static #finishUpdate(onReleaseUpdate, onFinish) {
+        onReleaseUpdate?.();
+        onFinish();
+    }
+    /**
+     * Keeps one Entity's previous-state read and commit in notification order.
+     *
+     * @param registration State metadata.
+     * @param tenantId Tenant for the state.
+     * @param id Entity identifier.
+     * @param metadata Repository-validated identifier metadata, when available.
+     * @returns A release action for notification or cancellation.
+     */
+    async #reserveUpdate(registration, tenantId, id, metadata) {
+        const packed = metadata === undefined
+            ? EntityIds.pack(registration.schema, id)
+            : EntityIds.packField(metadata.idField.descriptor, id);
+        const key = JSON.stringify([
+            registration.typeUrl,
+            this.#tenantKey(tenantId),
+            Buffer.from(toBinary(AnySchema, packed)).toString("base64"),
+        ]);
+        const previous = this.#pendingUpdates.get(key);
+        const settled = Promise.withResolvers();
+        this.#pendingUpdates.set(key, settled.promise);
+        await previous;
+        return () => {
+            if (this.#pendingUpdates.get(key) === settled.promise)
+                this.#pendingUpdates.delete(key);
+            settled.resolve(undefined);
+        };
+    }
     /**
      * Copies mutable Version and lifecycle input before update preparation awaits.
      * @param options Update metadata supplied by the caller.
@@ -425,7 +610,7 @@ export class Stand {
         const finish = this.#beginOperation();
         try {
             const registration = this.#registration(schema, "read");
-            const tenantId = this.#tenantId(options.tenantId);
+            const tenantId = await this.#checkedTenantId(options.tenantId);
             const storage = this.#leaseCurrent(registration, tenantId);
             try {
                 const stored = await storage.current.read(id);
@@ -453,29 +638,74 @@ export class Stand {
      *
      * @typeParam Schema The registered state schema.
      * @param schema The registered entity state schema.
-     * @param callback The function receiving matching state updates.
-     * @param options The tenant slice to subscribe to.
-     * @returns A handle that stops future callback delivery.
+     * @param observer Receives serial visible updates and one terminal local fault.
+     * @param options Tenant, trusted facts, and cancellation.
+     * @returns A handle that invalidates pending and active delivery.
      */
-    subscribe(schema, callback, options = {}) {
+    subscribe(schema, observer, options = {}) {
         this.#requireOpen();
+        _a.#requireObserver(observer);
         const registration = this.#registration(schema, "subscribe");
         const tenantKey = this.#tenantKey(options.tenantId);
-        const subscriber = Object.freeze({ tenantKey, callback });
-        let closed = false;
-        registration.subscribers.add(subscriber);
+        const delivery = this.#subscribeDelivery(schema, observer, options, registration, tenantKey);
         return Object.freeze({
+            /**
+             * Reports whether this subscription handle has stopped delivering.
+             */
             get closed() {
-                return closed;
+                return delivery.closed;
             },
+            /**
+             * Detaches the subscriber and stops future local deliveries.
+             */
             unsubscribe() {
-                if (!closed) {
-                    closed = true;
-                    registration.subscribers.delete(subscriber);
-                }
+                delivery.close();
             },
         });
     }
+    /**
+     * Rejects a raw callback or malformed JavaScript observer before registration.
+     *
+     * @param observer The runtime value supplied for direct delivery.
+     */
+    static #requireObserver(observer) {
+        if (typeof observer !== "object" ||
+            observer === null ||
+            !("next" in observer) ||
+            typeof observer.next !== "function" ||
+            !("error" in observer) ||
+            typeof observer.error !== "function")
+            throw new TypeError("Stand.subscribe requires an observer with next and error callbacks.");
+    }
+    /**
+     * Captures the subscriber's read facts and attaches its independent delivery queue.
+     *
+     * @typeParam Schema The registered state schema.
+     * @param schema The state schema selected by the caller.
+     * @param observer Receives visible updates or one terminal local fault.
+     * @param options Trusted reader, tenant, and cancellation at subscribe time.
+     * @param registration The Stand registration for this state schema.
+     * @param tenantKey The normalized tenant slice for delivery.
+     * @returns The subscriber's serial delivery queue.
+     */
+    #subscribeDelivery(schema, observer, options, registration, tenantKey) {
+        const captured = _a.#snapshotRead(options);
+        const producingContext = standProducingContexts.get(this);
+        const attachment = {};
+        const delivery = new StandDirectDelivery(schema, observer, standReadFilters.get(this), {
+            ...captured.readSide,
+            operation: { kind: "direct", subscription: { typeUrl: registration.typeUrl } },
+            ...(captured.tenantId === undefined ? {} : { effectiveTenant: captured.tenantId }),
+            ...(producingContext === undefined ? {} : { producingContext }),
+        }, this.#subscriptionQueueCapacity, () => {
+            if (attachment.subscriber !== undefined)
+                registration.subscribers.delete(attachment.subscriber);
+        }, options.signal);
+        attachment.subscriber = Object.freeze({ tenantKey, delivery });
+        if (!delivery.closed)
+            registration.subscribers.add(attachment.subscriber);
+        return delivery;
+    }
     /**
      * Closes direct subscriptions and rejects later Stand operations.
      *
@@ -490,10 +720,15 @@ export class Stand {
         this.#closedPromise ??= this.#closeOnce();
         return this.#closedPromise;
     }
+    /**
+     * Drains accepted Stand work, closes subscriptions, and releases Entity handles.
+     */
     async #closeOnce() {
         this.#closing = true;
         await Promise.all([...this.#inFlight]);
         for (const registration of this.#registrations.values()) {
+            for (const subscriber of registration.subscribers)
+                subscriber.delivery.close();
             registration.subscribers.clear();
         }
         const errors = this.#handleCloseErrors.splice(0);
@@ -535,6 +770,9 @@ export class Stand {
         }
         return registration;
     }
+    /**
+     * Reuses single-tenant storage or opens a temporary multitenant Entity handle.
+     */
     #leaseCurrent(registration, tenantId) {
         if (this.#context.multitenant) {
             return this.#lease(_a.#openStorage(this.#storageFactory, standEntityStorageDescriptor(this.#storageContext(tenantId), registration.schema, registration.columns)), true);
@@ -547,6 +785,9 @@ export class Stand {
         this.#entityHandles.set(key, handle);
         return this.#lease(handle, false);
     }
+    /**
+     * Returns a release callback for a current-state storage handle.
+     */
     #lease(handle, releaseAfterOperation) {
         let released = false;
         return {
@@ -611,28 +852,22 @@ export class Stand {
      * @param captured Subscribers captured before persistence, if available.
      */
     #notify(registration, input, captured) {
-        const errors = [];
         const tenantKey = this.#tenantKey(input.tenantId);
         const subscribers = captured ?? this.#tenantSubscribers(registration, tenantKey);
         for (const subscriber of subscribers) {
-            try {
-                subscriber.callback(_a.#createUpdate(registration, input));
-            }
-            catch (error) {
-                errors.push(error);
-            }
-        }
-        if (errors.length === 1) {
-            throw errors[0];
-        }
-        if (errors.length > 1) {
-            throw new AggregateError(errors, "Stand subscriber delivery failed.");
+            subscriber.delivery.admit(_a.#createUpdate(registration, input));
         }
     }
+    /**
+     * Creates the subscription partition key for the selected tenant.
+     */
     #tenantKey(tenantId) {
         const selected = this.#tenantId(tenantId);
         return selected === undefined ? "__single__" : String(TenantBoundary.from(selected).key);
     }
+    /**
+     * Checks whether a registered Entity state has subscribers in this tenant slice.
+     */
     #hasTenantSubscribers(registration, tenantId) {
         const tenantKey = this.#tenantKey(tenantId);
         for (const subscriber of registration.subscribers) {
@@ -653,6 +888,9 @@ export class Stand {
     #tenantSubscribers(registration, tenantKey) {
         return [...registration.subscribers].filter((subscriber) => subscriber.tenantKey === tenantKey);
     }
+    /**
+     * Validates and detaches the tenant ID required by this Stand's tenancy mode.
+     */
     #tenantId(tenantId) {
         if (!this.#context.multitenant) {
             if (tenantId !== undefined) {
@@ -665,6 +903,20 @@ export class Stand {
         }
         return TenantBoundary.from(tenantId).tenantId;
     }
+    /**
+     * Validates shape and awaits live membership before leasing a storage handle.
+     *
+     * @param tenantId Selected tenant identity.
+     * @returns Detached selected tenant identity, when applicable.
+     */
+    async #checkedTenantId(tenantId) {
+        const selected = this.#tenantId(tenantId);
+        await standAdmissions.get(this)?.(selected);
+        return selected;
+    }
+    /**
+     * Builds the provider storage scope for a validated tenant selection.
+     */
     #storageContext(tenantId) {
         if (!this.#context.multitenant) {
             this.#tenantId(tenantId);
@@ -679,11 +931,17 @@ export class Stand {
             tenantId: TenantBoundary.from(tenantId).tenantId,
         });
     }
+    /**
+     * Rejects a new operation once Stand closing has begun.
+     */
     #requireOpen() {
         if (this.#closing || this.#closed) {
             throw new Error("Stand is closed.");
         }
     }
+    /**
+     * Tracks an accepted operation and returns its completion callback.
+     */
     #beginOperation() {
         this.#requireOpen();
         let finish;
@@ -696,6 +954,15 @@ export class Stand {
             finish?.();
         };
     }
+    /**
+     * Admits an external read before repository operations can continue internally.
+     * @returns Completion callback for the tracked read.
+     */
+    #beginPublicOperation() {
+        this.#requireOpen();
+        standPublicAdmissions.get(this)?.();
+        return this.#beginOperation();
+    }
     /**
      * Clones a state update before delivering it to subscribers.
      *
@@ -717,6 +984,9 @@ export class Stand {
             ...(input.tenantId === undefined ? {} : { tenantId: clone(TenantIdSchema, input.tenantId) }),
         });
     }
+    /**
+     * Extracts the registered Entity ID field from a state update.
+     */
     static #readStateId(state, registration) {
         const id = state[registration.idField];
         if (id === undefined || id === null) {
@@ -724,9 +994,15 @@ export class Stand {
         }
         return id;
     }
+    /**
+     * Detaches a structured storage value before returning it to a caller.
+     */
     static #cloneValue(value) {
         return typeof value === "object" && value !== null ? globalThis.structuredClone(value) : value;
     }
+    /**
+     * Translates a supported RecordQuery into the normalized storage query plan.
+     */
     static #legacyPlan(query) {
         RecordQuery.validate(query);
         if (query.after !== undefined) {
@@ -774,6 +1050,9 @@ export class Stand {
         }
         return candidate.createEntityStorage(input);
     }
+    /**
+     * Freezes a detached name and tenancy mode for storage configuration.
+     */
     static #cloneContext(context) {
         return Object.freeze({ name: context.name, multitenant: context.multitenant });
     }
@@ -785,6 +1064,122 @@ _a = Stand;
  * @internal
  */
 export const standAccess = Object.freeze({
+    /**
+     * Forwards trusted routed Query context to the private Stand read path.
+     * @typeParam Schema Registered state schema.
+     * @param stand Producing context's Stand.
+     * @param schema Registered state schema.
+     * @param plan Normalized routed query plan.
+     * @param options Admitted tenant and trusted facts.
+     * @param readSide Actual service or handler Query context.
+     * @returns Surviving versioned states.
+     */
+    queryPlanVersioned(stand, schema, plan, options, readSide) {
+        const read = routedQueryPlans.get(stand);
+        if (read === undefined)
+            throw new Error("Stand routed read is unavailable.");
+        return read(schema, plan, options, readSide);
+    },
+    /**
+     * Associates actual context identity with direct and historical outward reads.
+     *
+     * @param stand Context Stand.
+     * @param context Built Bounded Context.
+     */
+    bindProducingContext(stand, context) {
+        standProducingContexts.set(stand, context);
+    },
+    /**
+     * Applies a history state policy after the physical history read.
+     *
+     * @typeParam Schema Registered domain schema.
+     * @param stand Context read facade.
+     * @param schema Historical state schema.
+     * @param state Captured state.
+     * @param context Actual history call.
+     * @returns Filtered state or null.
+     */
+    filterState(stand, schema, state, context) {
+        const filters = standReadFilters.get(stand);
+        const producer = standProducingContexts.get(stand);
+        return filters === undefined
+            ? Promise.resolve(state)
+            : filters.apply(schema, state, {
+                ...context,
+                ...(producer === undefined ? {} : { producingContext: producer }),
+            });
+    },
+    /**
+     * Filters a retained Event payload while retaining envelope identity and metadata.
+     *
+     * @param stand Context read facade.
+     * @param event Retained Event envelope.
+     * @param context Actual history call.
+     * @returns Event with filtered payload, or null when removed.
+     */
+    async filterEvent(stand, event, context) {
+        const filters = standReadFilters.get(stand);
+        if (filters === undefined)
+            return event;
+        if (event.message === undefined)
+            throw new TypeError("Retained Event payload is missing.");
+        const producer = standProducingContexts.get(stand);
+        const message = await filters.applyPacked(event.message, {
+            ...context,
+            ...(producer === undefined ? {} : { producingContext: producer }),
+        });
+        return message === null ? null : create(EventSchema, { ...clone(EventSchema, event), message });
+    },
+    /**
+     * Applies Bounded Context policy to one subscription update before delivery.
+     *
+     * @param stand Context read facade.
+     * @param update Subscription update awaiting delivery.
+     * @param context Actual subscription read facts.
+     * @returns Visible update, or null when policy removes it.
+     */
+    filterSubscription(stand, update, context) {
+        const producer = standProducingContexts.get(stand);
+        return SubscriptionReadFilters.apply(update, standReadFilters.get(stand), {
+            ...context,
+            ...(producer === undefined ? {} : { producingContext: producer }),
+        });
+    },
+    /**
+     * Attaches registered policies to this Stand without changing persistence reads.
+     *
+     * @param stand Context read facade.
+     * @param filters Policies in registration order.
+     */
+    installReadFilters(stand, filters) {
+        if (!(stand instanceof Stand))
+            throw new TypeError("Read filters require a Stand instance.");
+        if (standReadFilters.has(stand))
+            throw new TypeError("Stand read filters are already installed.");
+        standReadFilters.set(stand, new ReadSideFilterEngine(filters, TypeRegistry.from(...registeredProtoModules())));
+    },
+    /**
+     * Sets the immediate external read admission check.
+     *
+     * @param stand Context Stand.
+     * @param onAdmit Synchronous external admission check.
+     */
+    setPublicAdmission(stand, onAdmit) {
+        if (!(stand instanceof Stand))
+            throw new TypeError("Stand admission requires a Stand instance.");
+        standPublicAdmissions.set(stand, onAdmit);
+    },
+    /**
+     * Installs an internal receiving-context membership check.
+     *
+     * @param stand Context Stand.
+     * @param onAdmit Checks current membership.
+     */
+    setAdmission(stand, onAdmit) {
+        if (!(stand instanceof Stand))
+            throw new TypeError("Stand admission requires a Stand instance.");
+        standAdmissions.set(stand, onAdmit);
+    },
     /**
      * Finds observer metadata on the supplied Stand.
      *
@@ -849,5 +1244,10 @@ export const standAccess = Object.freeze({
     },
 });
 const deferredUpdates = new WeakMap();
+const standAdmissions = new WeakMap();
+const standPublicAdmissions = new WeakMap();
+const standReadFilters = new WeakMap();
+const standProducingContexts = new WeakMap();
 const currentReads = new WeakMap();
+const routedQueryPlans = new WeakMap();
 //# sourceMappingURL=stand.js.map