@terrascale/sdk 0.0.2 → 0.0.4

package/src/v1/shape-crypto.js

@@ -0,0 +1,125 @@
+const MAGIC = "TBS1";
+const HEADER_BYTES = 70;
+const KEY_ID_BYTES = 26;
+const FRAME_BYTES = 1048576;
+const MAX_PLAINTEXT_BYTES = 8388608;
+const TAG_BYTES = 16;
+const LAST_FRAME_FLAG = 0x80000000;
+const LENGTH_MASK = 0x7fffffff;
+const MAX_UINT64 = 2n ** 64n - 1n;
+
+/**
+ * @typedef {object} ShapeObjectRequest
+ * @property {string} handle The shape handle this client requested, e.g. `h1-…`.
+ * @property {string} offset Canonical offset of the object's URL, e.g. `2` or `snap.0.0`.
+ * @property {string} epoch Decimal epoch the client expects in the header.
+ * @property {string} keyId The 26-character project data key id the client expects in the header.
+ * @property {Uint8Array} key Raw 32-byte epoch key `K_e`.
+ */
+
+/**
+ * Verifies and decrypts one TBS1 sealed shape object. The plaintext is returned only when the
+ * header, every frame tag and the framing rules pass. Any failure throws and yields no bytes.
+ *
+ * @param {Uint8Array} input Exact TBS1 object bytes.
+ * @param {ShapeObjectRequest} request
+ * @returns {Promise<Uint8Array>}
+ */
+export async function decryptShapeObject(input, { handle, offset, epoch, keyId, key: keyInput }) {
+  if (input.byteLength > HEADER_BYTES + 9 * (4 + TAG_BYTES) + MAX_PLAINTEXT_BYTES)
+    throw new TypeError("TBS1 object exceeds the maximum sealed size");
+  // WebCrypto needs ArrayBuffer-backed views; copying keeps the caller's (possibly shared) buffer out of it.
+  const bytes = Uint8Array.from(input);
+  const key = Uint8Array.from(keyInput);
+  if (key.byteLength !== 32) throw new TypeError("TBS1 epoch key must be 32 bytes");
+  if (typeof keyId !== "string" || !/^[\x00-\x7f]{26}$/u.test(keyId))
+    throw new TypeError("TBS1 key id must be 26 ASCII characters");
+  if (bytes.byteLength < HEADER_BYTES) throw new TypeError("TBS1 header is short");
+  const view = new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+  if (new TextDecoder().decode(bytes.subarray(0, 4)) !== MAGIC) throw new TypeError("TBS1 magic mismatch");
+  if (view.getBigUint64(4) !== parseEpoch(epoch)) throw new TypeError("TBS1 epoch mismatch");
+  if (new TextDecoder().decode(bytes.subarray(12, 12 + KEY_ID_BYTES)) !== keyId) throw new TypeError("TBS1 key id mismatch");
+
+  const header = bytes.subarray(0, HEADER_BYTES);
+  const { subtle } = globalThis.crypto;
+  const epochKey = await subtle.importKey("raw", key, "HKDF", false, ["deriveKey"]);
+  const objectKey = await subtle.deriveKey(
+    {
+      name: "HKDF",
+      hash: "SHA-256",
+      salt: bytes.slice(38, HEADER_BYTES),
+      info: new TextEncoder().encode(`TBS1 object\u0000${handle}\u0000${offset}`),
+    },
+    epochKey,
+    { name: "AES-GCM", length: 256 },
+    false,
+    ["decrypt"],
+  );
+
+  const plaintextParts = [];
+  let plaintextTotal = 0;
+  let position = HEADER_BYTES;
+  for (let index = 0; ; index += 1) {
+    if (position + 4 > bytes.byteLength) throw new TypeError("TBS1 object ends before its last frame");
+    const lengthWord = view.getUint32(position);
+    const last = (lengthWord & LAST_FRAME_FLAG) !== 0;
+    const length = lengthWord & LENGTH_MASK;
+    if (last ? length >= FRAME_BYTES : length !== FRAME_BYTES) throw new TypeError("TBS1 frame length is invalid");
+    plaintextTotal += length;
+    if (plaintextTotal > MAX_PLAINTEXT_BYTES) throw new TypeError("TBS1 plaintext exceeds 8 MiB");
+    const bodyStart = position + 4;
+    const frameEnd = bodyStart + length + TAG_BYTES;
+    if (frameEnd > bytes.byteLength) throw new TypeError("TBS1 object is truncated");
+    const nonce = concat(new Uint8Array(4), uint64(index));
+    const additionalData = concat(header, uint64(index), bytes.subarray(position, bodyStart));
+    try {
+      const plaintext = await subtle.decrypt(
+        { name: "AES-GCM", iv: nonce, additionalData, tagLength: 128 },
+        objectKey,
+        bytes.subarray(bodyStart, frameEnd),
+      );
+      plaintextParts.push(new Uint8Array(plaintext));
+    } catch {
+      throw new TypeError("TBS1 frame failed authentication");
+    }
+    position = frameEnd;
+    if (last) break;
+  }
+  if (position !== bytes.byteLength) throw new TypeError("TBS1 object has bytes after its last frame");
+  return concat(...plaintextParts);
+}
+
+/**
+ * @param {string} value
+ * @returns {bigint}
+ */
+function parseEpoch(value) {
+  if (!/^(0|[1-9][0-9]*)$/u.test(value)) throw new TypeError("TBS1 epoch must be a canonical decimal");
+  const epoch = BigInt(value);
+  if (epoch > MAX_UINT64) throw new TypeError("TBS1 epoch exceeds uint64");
+  return epoch;
+}
+
+/**
+ * @param {number} value
+ * @returns {Uint8Array}
+ */
+function uint64(value) {
+  const out = new Uint8Array(8);
+  new DataView(out.buffer).setBigUint64(0, BigInt(value));
+  return out;
+}
+
+/**
+ * @param {...Uint8Array} parts
+ * @returns {Uint8Array<ArrayBuffer>}
+ */
+function concat(...parts) {
+  const out = new Uint8Array(parts.reduce((total, part) => total + part.byteLength, 0));
+  let at = 0;
+  for (const part of parts) {
+    out.set(part, at);
+    at += part.byteLength;
+  }
+  return out;
+}

package/src/v1/shape-manifest.js

@@ -0,0 +1,31 @@
+import { requireId } from "../ids.js";
+import { malformed } from "./decode.js";
+import { list, numeric, record, text } from "./management-decode.js";
+import { requireFilter } from "./filter.js";
+import { stringifyExactJson } from "./json.js";
+import { requireShapeHandle, requireShapeOffset } from "./shapes.js";
+/** @import { V1Transport } from "./transport.js" */
+const manifest = record({ handle: requireShapeHandle, objects: list(record({ offset: requireShapeOffset, next_offset: requireShapeOffset,
+  binding: text, object: text, url: text, expires_at: text, epoch: text, key_id: requireId, sha256: text, size: numeric })) });
+/** @typedef {ReturnType<typeof manifest>} V1ShapeManifest */
+/** @typedef {{readonly handle: string; readonly offset: string; readonly where?: import("./filter.js").V1Filter}} V1ShapeManifestRequest */
+/** @param {V1Transport} transport @param {Readonly<Record<string, string>>} params @param {V1ShapeManifestRequest} request @param {AbortSignal | undefined} signal @returns {Promise<V1ShapeManifest>} */
+export async function readShapeManifest(transport, params, request, signal) {
+  const handle = requireShapeHandle(request.handle);
+  const offset = requireShapeOffset(request.offset);
+  if (offset === "-1") throw new TypeError("A manifest requires a snapshot or log offset.");
+  const query = new URLSearchParams({ handle, offset });
+  if (request.where !== undefined) query.set("where", stringifyExactJson(requireFilter(request.where), "shape filter"));
+  const response = await transport.call("getShapeManifest", params, { query, cache: "no-store", signal });
+  const result = manifest(response.value);
+  if (result.handle !== handle || result.objects.length > 8) malformed("shape manifest binding");
+  let next = offset;
+  for (const item of result.objects) {
+    if (item.offset !== next || item.next_offset === item.offset || item.offset === "-1" || item.next_offset === "-1" ||
+        !/^[a-f0-9]{64}$/u.test(item.sha256) || !/^(?:0|[1-9][0-9]*)$/u.test(item.epoch)) malformed("shape manifest object");
+    const url = new URL(item.url);
+    if (url.protocol !== "https:" || url.username !== "" || url.password !== "" || url.hash !== "") malformed("shape object URL");
+    next = item.next_offset;
+  }
+  return result;
+}

package/src/v1/shape-reader.js

@@ -0,0 +1,212 @@
+// The proposed free-read v1 protocol is separate from the historical shape() contract.
+import { requireId } from "../ids.js";
+import { malformed, object, string } from "./decode.js";
+import { decodeShapePage, encodeShapeRequest, requireShapeHandle, requireShapeOffset } from "./shapes.js";
+import { decryptShapeObject } from "./shape-crypto.js";
+import { parseExactJson } from "./json.js";
+import { TerraBaseV1Error } from "./errors.js";
+/** @import { V1Transport } from "./transport.js" */
+/** @import { V1ShapeRequest, V1ShapePage } from "./shapes.js" */
+/** @typedef {{handle: string; offset: string; epoch: string; keyId: string}} V1SealedShapePosition */
+/** @typedef {{ latestEpoch: bigint; keys: Map<string, { epoch: bigint; key: Uint8Array }> }} ShapeKeys */
+/** @type {WeakMap<V1Transport, Map<string, ShapeKeys>>} Keys stay scoped to a credential, database and collection. */
+const shapeKeys = new WeakMap();
+/** @param {Readonly<Record<string, string>>} params */
+const keyScope = params => JSON.stringify([params.database, params.collection]);
+/**
+ * A refetch invalidates both the materialized state and any epoch keys for that collection.
+ * @param {V1Transport} transport @param {Readonly<Record<string, string>>} params
+ * @param {"readFreeShape" | "getShapeKey"} operation @param {import("./transport.js").V1CallOptions} options
+ */
+async function shapeCall(transport, params, operation, options) {
+  try { return await transport.call(operation, params, options); }
+  catch (error) {
+    if (error instanceof TerraBaseV1Error && error.status === 409 && error.code === "must_refetch")
+      shapeKeys.get(transport)?.delete(keyScope(params));
+    throw error;
+  }
+}
+/** @param {V1Transport} transport @param {Readonly<Record<string, string>>} params @returns {ShapeKeys} */
+function currentKeys(transport, params) {
+  let scopes = shapeKeys.get(transport);
+  if (scopes === undefined) { scopes = new Map(); shapeKeys.set(transport, scopes); }
+  const scope = keyScope(params);
+  let cache = scopes.get(scope);
+  if (cache === undefined) { cache = { latestEpoch: 0n, keys: new Map() }; scopes.set(scope, cache); }
+  // Expiry is lazy; a higher served epoch also protects against a regressed client clock.
+  const epoch = BigInt(Math.floor(Date.now() / 600_000));
+  if (epoch > cache.latestEpoch) cache.latestEpoch = epoch;
+  for (const [id, entry] of cache.keys) if (entry.epoch < cache.latestEpoch) cache.keys.delete(id);
+  return cache;
+}
+/** @param {unknown} value @returns {string} */
+function decimal(value) {
+  const text = requireShapeOffset(value);
+  if (text === "-1" || text.startsWith("snap.")) malformed("shape decimal");
+  return text;
+}
+/** @param {unknown} value @returns {string} */
+function resumeToken(value) {
+  // Resume envelopes are opaque: validate header safety, never decode or normalize them.
+  if (typeof value !== "string" || !/^[A-Za-z0-9_-]+$/u.test(value)) malformed("shape resume cursor");
+  return value;
+}
+/** @param {string} offset @returns {string} */
+function snapshotKey(offset) {
+  const encoded = offset.split(".")[2] ?? "";
+  return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(
+    Uint8Array.from(atob(encoded.replace(/-/gu, "+").replace(/_/gu, "/")), c => c.charCodeAt(0)),
+  );
+}
+/** @param {import("./json.js").JsonValue | undefined} value @param {Headers} headers @returns {V1ShapePage} */
+export function decodeFreeShapePage(value, headers) {
+  const page = decodeShapePage(value, headers);
+  const raw = object(value, "free shape page");
+  const covered = decimal(raw.covered_offset);
+  const values = decimal(raw.values_at);
+  resumeToken(raw.cursor_resume);
+  if (page.offset === "-1" || page.nextOffset === "-1" || BigInt(values) < BigInt(covered)) malformed("shape coverage");
+  if (page.offset.startsWith("snap.")) {
+    const head = page.offset.split(".")[1];
+    if (covered !== head || values !== head || page.upToDate || page.changes.length !== 1 || page.changes[0]?.offset !== head ||
+        page.changes[0]?.ops.some(op => op.op !== "upsert") ||
+        (page.nextOffset.startsWith("snap.") ? page.nextOffset.split(".")[1] !== head || page.nextOffset === page.offset : page.nextOffset !== head))
+      malformed("shape snapshot coverage");
+    if (page.nextOffset.startsWith("snap.") && (page.nextOffset.endsWith(".0") ||
+        (!page.offset.endsWith(".0") && snapshotKey(page.nextOffset) <= snapshotKey(page.offset)))) malformed("shape snapshot progression");
+  } else {
+    if (page.nextOffset.startsWith("snap.") || page.nextOffset !== covered || BigInt(covered) < BigInt(page.offset) ||
+        (!page.upToDate && covered === page.offset)) malformed("shape log coverage");
+    let previous = BigInt(page.offset);
+    for (const change of page.changes) {
+      const offset = BigInt(decimal(change.offset));
+      if (offset <= previous || offset > BigInt(covered)) malformed("shape commit order");
+      previous = offset;
+    }
+  }
+  for (const change of page.changes) {
+    let previousId;
+    for (const op of change.ops) {
+      if (previousId !== undefined && op.id <= previousId) malformed("shape document order");
+      previousId = op.id;
+    }
+  }
+  return page;
+}
+/**
+ * Follows exactly one authorized same-route 307; credentials never follow an arbitrary Location.
+ * @param {V1Transport} transport @param {Readonly<Record<string,string>>} params
+ * @param {V1ShapeRequest} request @param {AbortSignal | undefined} signal
+ * @param {string | undefined} [ifNoneMatch] A complete entity-tag list or *; 304 throws not_modified with response headers.
+ * @returns {Promise<V1ShapePage>}
+ */
+export async function readShapePage(transport, params, request, signal, ifNoneMatch) {
+  const isResume = (request.offset ?? "-1") === "-1" && request.cursor !== undefined;
+  if (isResume && (request.handle !== undefined || request.live !== undefined)) throw new TypeError("Shape resume requires offset=-1 without handle or live.");
+  const query = encodeShapeRequest(isResume ? { ...request, cursor: undefined } : request);
+  // Canonical filter size is checked by the producer; check our exact wire spelling here.
+  if (new TextEncoder().encode(query.get("where") ?? "").byteLength > 8192) throw new TypeError("Shape filters are limited to 8 KiB of UTF-8.");
+  if (query.get("offset") === "-1" && query.has("handle")) throw new TypeError("Shape bootstrap must omit handle.");
+  /** @type {Record<string,string>} */
+  const headers = {};
+  if (ifNoneMatch !== undefined) {
+    if (typeof ifNoneMatch !== "string" || !/^[ \t]*(?:\*|(?:W\/)?"[\x21\x23-\x7e\x80-\xff]*"(?:[ \t]*,[ \t]*(?:W\/)?"[\x21\x23-\x7e\x80-\xff]*")*)[ \t]*$/u.test(ifNoneMatch))
+      throw new TypeError("ifNoneMatch must be * or a list of quoted entity tags.");
+    headers["If-None-Match"] = ifNoneMatch;
+  }
+  const source = new URL(await transport.url("readFreeShape", params, signal));
+  if (isResume) {
+    query.set("cursor", resumeToken(request.cursor));
+    // The producer reserves 64 bytes for request-line framing in its 8 KiB ceiling.
+    if (new TextEncoder().encode(`${source.pathname}?${query}`).length > 8192 - 64) {
+      headers["TB-Shape-Resume"] = resumeToken(request.cursor);
+      query.delete("cursor");
+    }
+  }
+  let response = await shapeCall(transport, params, "readFreeShape", { query, headers, signal });
+  if (response.status === 307) {
+    if (query.get("offset") !== "-1") malformed("unexpected shape redirect");
+    const location = response.headers.get("location");
+    if (location === null) malformed("shape redirect Location");
+    const target = new URL(location, source);
+    if (target.origin !== source.origin || target.pathname !== source.pathname || target.username !== "" || target.password !== "" || target.hash !== "") malformed("shape redirect target");
+    for (const key of target.searchParams.keys()) {
+      if (!["where", "handle", "offset"].includes(key) || target.searchParams.getAll(key).length !== 1) malformed("shape redirect query");
+    }
+    const handle = requireShapeHandle(target.searchParams.get("handle"));
+    const offset = requireShapeOffset(target.searchParams.get("offset"));
+    if (offset === "-1" || (!isResume && !/^snap\.[0-9]+\.0$/u.test(offset)) || (isResume && offset.startsWith("snap."))) malformed("shape redirect offset");
+    if (target.searchParams.has("where") !== query.has("where")) malformed("shape redirect filter");
+    // Keep the caller's validated filter: the server's canonical spelling must not broaden it.
+    query.delete("cursor");
+    delete headers["TB-Shape-Resume"];
+    query.set("handle", handle);
+    query.set("offset", offset);
+    response = await shapeCall(transport, params, "readFreeShape", { query, headers, signal });
+    if (response.status !== 200) malformed("repeated shape redirect");
+  } else if (query.get("offset") === "-1") malformed("shape bootstrap requires redirect");
+  const page = decodeFreeShapePage(response.value, response.headers);
+  if (page.handle !== query.get("handle") || page.offset !== query.get("offset")) malformed("shape response position");
+  const inputCursor = query.get("cursor");
+  if (request.live === true && (page.cursor === undefined || (inputCursor !== null && BigInt(page.cursor) <= BigInt(inputCursor)))) malformed("shape live cursor advance");
+  return page;
+}
+/**
+ * Reuse process-memory keys for this handle/epoch/KID; fetch misses without HTTP cache reuse.
+ * @param {V1Transport} transport @param {Readonly<Record<string,string>>} params
+ * @param {Uint8Array} bytes @param {V1SealedShapePosition} position @param {AbortSignal | undefined} signal
+ * @returns {Promise<V1ShapePage>}
+ */
+export async function decryptSealedShapePage(transport, params, bytes, position, signal) {
+  const handle = requireShapeHandle(position.handle);
+  const offset = requireShapeOffset(position.offset);
+  if (offset === "-1") throw new TypeError("Sealed shapes require a snapshot or log offset.");
+  if (typeof position.epoch !== "string" || !/^(?:0|[1-9][0-9]*)$/u.test(position.epoch) || BigInt(position.epoch) > (1n << 64n) - 1n) throw new TypeError("Shape epoch must be a canonical uint64.");
+  const epoch = position.epoch;
+  const keyId = requireId(position.keyId, "Shape key ID");
+  signal?.throwIfAborted();
+  const cache = currentKeys(transport, params);
+  const cacheId = JSON.stringify([handle, epoch, keyId]);
+  let raw = cache.keys.get(cacheId)?.key;
+  if (raw === undefined) {
+    const query = new URLSearchParams({ handle, epoch, key_id: keyId });
+    const response = await shapeCall(transport, params, "getShapeKey", { query, cache: "no-store", signal });
+    const key = object(response.value, "shape epoch key");
+    if (key.handle !== handle || key.epoch !== epoch || key.key_id !== keyId) malformed("shape epoch key binding");
+    const encoded = string(key.key, "shape epoch key");
+    if (!/^[A-Za-z0-9_-]{43}$/u.test(encoded)) malformed("shape epoch key encoding");
+    raw = Uint8Array.from(atob(encoded.replace(/-/gu, "+").replace(/_/gu, "/")), c => c.charCodeAt(0));
+    if (btoa(String.fromCharCode(...raw)).replace(/\+/gu, "-").replace(/\//gu, "_").replace(/=+$/u, "") !== encoded) malformed("shape epoch key encoding");
+    const servedEpoch = BigInt(epoch);
+    const active = currentKeys(transport, params);
+    if (active === cache && servedEpoch >= cache.latestEpoch) {
+      cache.latestEpoch = servedEpoch;
+      for (const [id, entry] of cache.keys) if (entry.epoch < servedEpoch) cache.keys.delete(id);
+      cache.keys.set(cacheId, { epoch: servedEpoch, key: raw });
+    }
+  }
+  const plaintext = await decryptShapeObject(bytes, { handle, offset, epoch, keyId, key: raw });
+  signal?.throwIfAborted();
+  const page = decodeFreeShapePage(parseExactJson(new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(plaintext)), new Headers());
+  if (page.handle !== handle || page.offset !== offset || page.upToDate) malformed("sealed shape position");
+  return page;
+}
+
+/** @typedef {{readonly handle: string; readonly epoch: string; readonly keyId: string}} V1ShapeKeyRequest */
+/** @typedef {V1ShapeKeyRequest & {readonly key: Uint8Array}} V1ShapeKey */
+/** @param {V1Transport} transport @param {Readonly<Record<string, string>>} params @param {V1ShapeKeyRequest} request @param {AbortSignal | undefined} signal @returns {Promise<V1ShapeKey>} */
+export async function readShapeKey(transport, params, request, signal) {
+  const handle = requireShapeHandle(request.handle);
+  const epoch = decimal(request.epoch);
+  const keyId = requireId(request.keyId);
+  const response = await shapeCall(transport, params, "getShapeKey", {
+    query: new URLSearchParams({ handle, epoch, key_id: keyId }), cache: "no-store", signal,
+  });
+  const key = object(response.value, "shape epoch key");
+  if (key.handle !== handle || key.epoch !== epoch || key.key_id !== keyId) malformed("shape epoch key binding");
+  const encoded = string(key.key, "shape key");
+  if (!/^[A-Za-z0-9_-]{43}$/u.test(encoded)) malformed("shape key encoding");
+  const bytes = Uint8Array.from(atob(encoded.replace(/-/gu, "+").replace(/_/gu, "/")), c => c.charCodeAt(0));
+  if (btoa(String.fromCharCode(...bytes)).replace(/\+/gu, "-").replace(/\//gu, "_").replace(/=+$/u, "") !== encoded) malformed("shape key encoding");
+  return Object.freeze({ handle, epoch, keyId, key: bytes });
+}

package/src/v1/shape-subscription.js

@@ -0,0 +1,208 @@
+// Client state for one collection shape: bootstrap, snapshot pages, log chunks, then the live tail.
+import { TerraBaseV1Error } from "./errors.js";
+import { requireFilter } from "./filter.js";
+import { parseExactJson, stringifyExactJson } from "./json.js";
+import { readShapePage } from "./shape-reader.js";
+/**
+ * @import { JsonObject } from "./json.js"
+ * @import { V1Filter } from "./filter.js"
+ * @import { V1Transport } from "./transport.js"
+ */
+/**
+ * @typedef {object} V1ShapeSubscribeOptions
+ * @property {AbortSignal | undefined} [signal] Closes the subscription when aborted; cancellation settles `done`.
+ * @property {((subscription: V1ShapeSubscription) => void) | undefined} [onUpdate] Runs after validated responses and freshness changes; throwing rejects `done` unless already closed or aborted.
+ */
+/** @typedef {{ readonly version: string; readonly document: JsonObject }} V1ShapeDocument */
+const retryBaseMilliseconds = 250;
+const retryCapMilliseconds = 30_000;
+// The eighth attempt reaches the delay ceiling; retries continue until success or cancellation.
+const maximumBackoffAttempt = 8;
+/** @param {import("./errors.js").TerraBaseV1Error} error @returns {boolean} */
+function isRetryable(error) {
+  return (error.status === 429 && error.code === "shape_busy") ||
+    (error.status === 503 && (error.code === "unavailable" || error.code === "shape_too_large"));
+}
+/** @param {number} attempt @param {number | undefined} retryAfter @returns {number} */
+function retryDelay(attempt, retryAfter) {
+  return Math.max(Math.min(retryCapMilliseconds, retryBaseMilliseconds * 2 ** (attempt - 1)), (retryAfter ?? 0) * 1000);
+}
+/** @param {unknown} value @param {readonly string[]} allowed @param {string} what */
+function requireMembers(value, allowed, what) {
+  if (typeof value !== "object" || value === null) throw new TypeError(`${what} is an object.`);
+  for (const key of Object.keys(value)) if (!allowed.includes(key)) throw new TypeError(`Unknown ${what} member ${key}.`);
+}
+/** @template T @param {T} value @returns {T} */
+function deepFreeze(value) {
+  if (typeof value === "object" && value !== null && !Object.isFrozen(value)) {
+    Object.freeze(value);
+    for (const item of Object.values(value)) deepFreeze(item);
+  }
+  return value;
+}
+// setTimeout overflows above 2^31-1 ms and fires at once, so a long Retry-After is waited in chunks.
+const maximumTimerMilliseconds = 2 ** 31 - 1;
+/** @param {number} milliseconds @param {AbortSignal} signal @returns {Promise<void>} */
+function sleep(milliseconds, signal) {
+  return new Promise((resolve, reject) => {
+    signal.throwIfAborted();
+    let remaining = milliseconds;
+    /** @type {ReturnType<typeof setTimeout> | undefined} */
+    let timer;
+    const onAbort = () => { clearTimeout(timer); reject(signal.reason); };
+    const wait = () => {
+      const chunk = Math.min(remaining, maximumTimerMilliseconds);
+      timer = setTimeout(() => {
+        remaining -= chunk;
+        if (remaining > 0) wait();
+        else { signal.removeEventListener("abort", onAbort); resolve(); }
+      }, chunk);
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+    wait();
+  });
+}
+export class V1ShapeSubscription {
+  /** @type {Map<string, V1ShapeDocument>} */
+  #documents = new Map();
+  /** @type {string | undefined} */
+  #handle;
+  #offset = "-1";
+  /** @type {string | undefined} */
+  #cursor;
+  /** @type {string | undefined} Usable only from a snapshot-complete or log position. */
+  #resume;
+  #upToDate = false;
+  // Set after a changed-handle 409 while the saved resume is still usable; cleared by any commit or reset.
+  #resumeAttempt = false;
+  #controller = new AbortController();
+  #transport;
+  #params;
+  /** @type {V1Filter | undefined} */
+  #where;
+  #onUpdate;
+  #external;
+  #onExternalAbort = () => this.close();
+  #done;
+  /**
+   * @param {V1Transport} transport
+   * @param {Readonly<Record<string, string>>} params
+   * @param {{ where?: V1Filter | undefined }} [shape]
+   * @param {V1ShapeSubscribeOptions} [options]
+   */
+  constructor(transport, params, shape = {}, options = {}) {
+    requireMembers(shape, ["where"], "shape");
+    requireMembers(options, ["signal", "onUpdate"], "shape subscribe option");
+    const { where } = shape;
+    const { signal, onUpdate } = options;
+    if (signal !== undefined && !(signal instanceof AbortSignal)) throw new TypeError("signal is an AbortSignal.");
+    if (onUpdate !== undefined && typeof onUpdate !== "function") throw new TypeError("onUpdate is a function.");
+    this.#transport = transport;
+    this.#params = Object.freeze({ ...params });
+    // Exact copy: a structuredClone would lose the source text of large or fractional JSON numbers.
+    this.#where = where === undefined ? undefined : requireFilter(parseExactJson(stringifyExactJson(requireFilter(where), "shape filter")));
+    this.#onUpdate = onUpdate;
+    this.#external = signal;
+    if (signal?.aborted === true) this.close();
+    else signal?.addEventListener("abort", this.#onExternalAbort);
+    this.#done = this.#run();
+    // Callback-only consumers must not trigger a process-level unhandled rejection.
+    void this.#done.catch(() => {});
+  }
+  /** A copy per read: callers cannot change the documents this subscription holds. */
+  get state() { return new Map(this.#documents); }
+  get upToDate() { return this.#upToDate; }
+  /** Settles when the run ends: resolves on close, rejects on a terminal failure. */
+  get done() { return this.#done; }
+  close() { this.#controller.abort(); }
+  /** @returns {Promise<void>} */
+  async #run() {
+    const signal = this.#controller.signal;
+    let retries = 0;
+    try {
+      for (;;) {
+        signal.throwIfAborted();
+        const request = this.#request();
+        let page;
+        try {
+          page = await readShapePage(this.#transport, this.#params, request, signal);
+        } catch (error) {
+          if (!(error instanceof TerraBaseV1Error)) throw error;
+          if (isRetryable(error)) {
+            retries = Math.min(retries + 1, maximumBackoffAttempt);
+            await sleep(retryDelay(retries, error.retryAfter), signal);
+            continue;
+          }
+          if (error.status !== 409 || error.code !== "must_refetch") throw error;
+          this.#recover(request, error);
+          continue;
+        }
+        retries = 0;
+        this.#commit(page);
+        this.#onUpdate?.(this);
+      }
+    } catch (error) {
+      if (signal.aborted) return;
+      throw error;
+    } finally {
+      // A finished run must not keep the caller's signal (and this subscription) alive.
+      this.#external?.removeEventListener("abort", this.#onExternalAbort);
+    }
+  }
+  /** @returns {import("./shapes.js").V1ShapeRequest} */
+  #request() {
+    if (this.#resumeAttempt) return { where: this.#where, offset: "-1", cursor: this.#resume };
+    if (this.#handle === undefined) return { where: this.#where, offset: "-1" };
+    // Only a fresh head is a live tail; snapshot positions are never live.
+    if (this.#upToDate && !this.#offset.startsWith("snap.")) return { where: this.#where, offset: this.#offset, handle: this.#handle, live: true, cursor: this.#cursor };
+    return { where: this.#where, offset: this.#offset, handle: this.#handle };
+  }
+  /**
+   * @param {import("./shapes.js").V1ShapeRequest} request
+   * @param {TerraBaseV1Error} error
+   */
+  #recover(request, error) {
+    if (this.#resumeAttempt) return this.#reset();
+    if (request.handle === undefined) throw error;
+    // §7.6 reads the lineage from the response header. A body that names another handle is ambiguous: fail closed.
+    const handle = error.headers.get("tb-shape-handle");
+    const changed = handle !== null && handle !== this.#handle && (error.handle === undefined || error.handle === handle);
+    if (changed && this.#resume !== undefined) {
+      // One attempt on the new lineage; its own 409 falls through to #reset above.
+      this.#resumeAttempt = true;
+      if (this.#upToDate) {
+        this.#upToDate = false;
+        this.#onUpdate?.(this);
+      }
+      return;
+    }
+    this.#reset();
+  }
+  #reset() {
+    this.#documents = new Map();
+    this.#handle = undefined;
+    this.#offset = "-1";
+    this.#cursor = undefined;
+    this.#resume = undefined;
+    this.#upToDate = false;
+    this.#resumeAttempt = false;
+    this.#onUpdate?.(this);
+  }
+  /** @param {import("./shapes.js").V1ShapePage} page */
+  #commit(page) {
+    // Repeats are applied, never skipped: a repeated event can carry a newer materialized value.
+    const documents = new Map(this.#documents);
+    for (const change of page.changes)
+      for (const op of change.ops) {
+        if (op.op === "delete") documents.delete(op.id);
+        else documents.set(op.id, deepFreeze({ version: op.version, document: op.document }));
+      }
+    this.#documents = documents;
+    this.#handle = page.handle;
+    this.#offset = page.nextOffset;
+    this.#cursor = page.cursor;
+    this.#resume = page.nextOffset.startsWith("snap.") ? undefined : page.cursorResume;
+    this.#upToDate = page.upToDate;
+    this.#resumeAttempt = false;
+  }
+}

package/src/v1/shapes.js

@@ -1,7 +1,7 @@
 // Current C# GET collection/shape contract (docs/shape-reads.md).
-import { array, boolean, malformed, object, string, u64 } from "./decode.js";
+import { array, boolean, documentObject, malformed, object, string, u64 } from "./decode.js";
 import { requireFilter } from "./filter.js";
-import { parseU64, requireVersion } from "./ids.js";
+import { parseU64, requireDocumentId, requireVersion } from "./ids.js";
 import { stringifyExactJson } from "./json.js";
 /**
  * @import { JsonObject, JsonValue } from "./json.js"
@@ -29,6 +29,9 @@ import { stringifyExactJson } from "./json.js";
  * @property {readonly V1ShapeChange[]} changes Apply commits and operations in their received order.
  * @property {string | undefined} cursor Echo this as cursor on the next live request.
  * @property {string | undefined} etag
+ * @property {string | undefined} [coveredOffset] Free-read protocol coverage (feed sequence, not write offset).
+ * @property {string | undefined} [valuesAt] Free-read materialization position.
+ * @property {string | undefined} [cursorResume] Opaque free-read resume token.
  */
 const maximumOffset = (1n << 63n) - 1n;
 const handlePattern = /^h1-[0-9a-f]{16}$/u;
@@ -53,13 +56,13 @@ export function requireShapeOffset(value) {
       const bytes = Uint8Array.from(atob(encoded.replace(/-/gu, "+").replace(/_/gu, "/")), c => c.charCodeAt(0));
       const id = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes);
       const canonical = btoa(String.fromCharCode(...new TextEncoder().encode(id))).replace(/\+/gu, "-").replace(/\//gu, "_").replace(/=+$/u, "");
-      if (canonical === encoded) return value;
+      if (canonical === encoded) { requireDocumentId(id); return value; }
     } catch { /* Invalid base64url or UTF-8. */ }
   }
   throw new TypeError("A shape offset is -1, a signed-64-bit decimal log position, or snap.<head>.<canonical-base64url-id>.");
 }
 /** @param {unknown} value @returns {string} */
-function requireHandle(value) {
+export function requireShapeHandle(value) {
   if (typeof value !== "string" || !handlePattern.test(value)) throw new TypeError("A shape handle is h1- followed by 16 lowercase hex characters.");
   return value;
 }
@@ -72,7 +75,7 @@ export function encodeShapeRequest(request) {
   if (request.where !== undefined) query.set("where", stringifyExactJson(requireFilter(request.where), "shape filter"));
   const offset = requireShapeOffset(request.offset ?? "-1");
   query.set("offset", offset);
-  if (request.handle !== undefined) query.set("handle", requireHandle(request.handle));
+  if (request.handle !== undefined) query.set("handle", requireShapeHandle(request.handle));
   else if (offset !== "-1") throw new TypeError("A shape handle is required after bootstrap.");
   if (request.live !== undefined && typeof request.live !== "boolean") throw new TypeError("live is a boolean.");
   if (request.live === true) {
@@ -94,19 +97,21 @@ export function decodeShapePage(value, headers) {
   const cursor = headers.get("tb-shape-cursor") ?? undefined;
   if (cursor !== undefined && !isLogOffset(cursor)) malformed("shape cursor");
   return Object.freeze({
-    shapeId, handle: requireHandle(raw.handle),
+    shapeId, handle: requireShapeHandle(raw.handle),
     offset: requireShapeOffset(raw.offset), nextOffset: requireShapeOffset(raw.next_offset),
     upToDate: boolean(raw.up_to_date, "shape up_to_date"), cursor,
     etag: headers.get("etag") ?? undefined,
+    ...(raw.covered_offset === undefined ? {} : { coveredOffset: requireShapeOffset(raw.covered_offset) }),
+    ...(raw.values_at === undefined ? {} : { valuesAt: requireShapeOffset(raw.values_at) }),
+    ...(raw.cursor_resume === undefined ? {} : { cursorResume: string(raw.cursor_resume, "shape resume cursor") }),
     changes: Object.freeze(array(raw.changes, "shape changes").map(value => {
       const change = object(value, "shape change");
       return Object.freeze({ offset: u64(change.offset, "shape change offset"), ops: Object.freeze(array(change.ops, "shape operations").map(value => {
         const op = object(value, "shape operation");
-        // Shape snapshots can include stored legacy ids beyond the HTTP point-id limit.
-        const id = string(op.id, "shape document id");
+        const id = requireDocumentId(op.id);
         if (op.op === "delete") return Object.freeze({ op: /** @type {const} */ ("delete"), id });
         if (op.op !== "upsert") malformed("shape operation kind");
-        return Object.freeze({ op: /** @type {const} */ ("upsert"), id, version: requireVersion(op.version), document: object(op.document, "shape document") });
+        return Object.freeze({ op: /** @type {const} */ ("upsert"), id, version: requireVersion(op.version), document: documentObject(op.document) });
       })) });
     })),
   });
@@ -131,7 +136,7 @@ export async function readShape(transport, params, request, signal) {
     const target = new URL(location, source);
     if (target.origin !== source.origin || target.pathname !== source.pathname || target.username !== "" || target.password !== "" || target.hash !== "")
       malformed("shape redirect target");
-    const handle = requireHandle(target.searchParams.get("handle"));
+    const handle = requireShapeHandle(target.searchParams.get("handle"));
     const offset = requireShapeOffset(target.searchParams.get("offset"));
     if (!offset.startsWith("snap.")) malformed("shape bootstrap offset");
     query.set("handle", handle);