@terrascale/sdk 0.0.3 → 0.0.5

package/src/v1/shape-reader.js

@@ -0,0 +1,214 @@
+// The proposed free-read v1 protocol is separate from the historical shape() contract.
+import { requireId } from "../ids.js";
+import { malformed, object, string } from "./decode.js";
+import { decodeShapePage, encodeShapeRequest, requireShapeHandle, requireShapeOffset } from "./shapes.js";
+import { decryptShapeObject } from "./shape-crypto.js";
+import { parseExactJson } from "./json.js";
+import { TerraBaseV1Error } from "./errors.js";
+/** @import { V1Transport } from "./transport.js" */
+/** @import { V1ShapeRequest, V1ShapePage } from "./shapes.js" */
+/** @typedef {{handle: string; offset: string; epoch: string; keyId: string}} V1SealedShapePosition */
+/** @typedef {{ latestEpoch: bigint; keys: Map<string, { epoch: bigint; key: Uint8Array }> }} ShapeKeys */
+/** @type {WeakMap<V1Transport, Map<string, ShapeKeys>>} Only immutable credentials retain keys across decrypts. */
+const shapeKeys = new WeakMap();
+/** @param {Readonly<Record<string, string>>} params */
+const keyScope = params => JSON.stringify([params.database, params.collection]);
+/**
+ * A refetch invalidates both the materialized state and any epoch keys for that collection.
+ * @param {V1Transport} transport @param {Readonly<Record<string, string>>} params
+ * @param {"readFreeShape" | "getShapeKey"} operation @param {import("./transport.js").V1CallOptions} options
+ */
+async function shapeCall(transport, params, operation, options) {
+  try { return await transport.call(operation, params, options); }
+  catch (error) {
+    if (error instanceof TerraBaseV1Error && error.status === 409 && error.code === "must_refetch")
+      shapeKeys.get(transport)?.delete(keyScope(params));
+    throw error;
+  }
+}
+/** @param {V1Transport} transport @param {Readonly<Record<string, string>>} params @returns {ShapeKeys | undefined} */
+function currentKeys(transport, params) {
+  // Callback tokens can change users; authorize every decrypt without retaining their keys.
+  if (transport.hasTokenProvider) return undefined;
+  let scopes = shapeKeys.get(transport);
+  if (scopes === undefined) { scopes = new Map(); shapeKeys.set(transport, scopes); }
+  const scope = keyScope(params);
+  let cache = scopes.get(scope);
+  if (cache === undefined) { cache = { latestEpoch: 0n, keys: new Map() }; scopes.set(scope, cache); }
+  // Expiry is lazy; a higher served epoch also protects against a regressed client clock.
+  const epoch = BigInt(Math.floor(Date.now() / 600_000));
+  if (epoch > cache.latestEpoch) cache.latestEpoch = epoch;
+  for (const [id, entry] of cache.keys) if (entry.epoch < cache.latestEpoch) cache.keys.delete(id);
+  return cache;
+}
+/** @param {unknown} value @returns {string} */
+function decimal(value) {
+  const text = requireShapeOffset(value);
+  if (text === "-1" || text.startsWith("snap.")) malformed("shape decimal");
+  return text;
+}
+/** @param {unknown} value @returns {string} */
+function resumeToken(value) {
+  // Resume envelopes are opaque: validate header safety, never decode or normalize them.
+  if (typeof value !== "string" || !/^[A-Za-z0-9_-]+$/u.test(value)) malformed("shape resume cursor");
+  return value;
+}
+/** @param {string} offset @returns {string} */
+function snapshotKey(offset) {
+  const encoded = offset.split(".")[2] ?? "";
+  return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(
+    Uint8Array.from(atob(encoded.replace(/-/gu, "+").replace(/_/gu, "/")), c => c.charCodeAt(0)),
+  );
+}
+/** @param {import("./json.js").JsonValue | undefined} value @param {Headers} headers @returns {V1ShapePage} */
+export function decodeFreeShapePage(value, headers) {
+  const page = decodeShapePage(value, headers);
+  const raw = object(value, "free shape page");
+  const covered = decimal(raw.covered_offset);
+  const values = decimal(raw.values_at);
+  resumeToken(raw.cursor_resume);
+  if (page.offset === "-1" || page.nextOffset === "-1" || BigInt(values) < BigInt(covered)) malformed("shape coverage");
+  if (page.offset.startsWith("snap.")) {
+    const head = page.offset.split(".")[1];
+    if (covered !== head || values !== head || page.upToDate || page.changes.length !== 1 || page.changes[0]?.offset !== head ||
+        page.changes[0]?.ops.some(op => op.op !== "upsert") ||
+        (page.nextOffset.startsWith("snap.") ? page.nextOffset.split(".")[1] !== head || page.nextOffset === page.offset : page.nextOffset !== head))
+      malformed("shape snapshot coverage");
+    if (page.nextOffset.startsWith("snap.") && (page.nextOffset.endsWith(".0") ||
+        (!page.offset.endsWith(".0") && snapshotKey(page.nextOffset) <= snapshotKey(page.offset)))) malformed("shape snapshot progression");
+  } else {
+    if (page.nextOffset.startsWith("snap.") || page.nextOffset !== covered || BigInt(covered) < BigInt(page.offset) ||
+        (!page.upToDate && covered === page.offset)) malformed("shape log coverage");
+    let previous = BigInt(page.offset);
+    for (const change of page.changes) {
+      const offset = BigInt(decimal(change.offset));
+      if (offset <= previous || offset > BigInt(covered)) malformed("shape commit order");
+      previous = offset;
+    }
+  }
+  for (const change of page.changes) {
+    let previousId;
+    for (const op of change.ops) {
+      if (previousId !== undefined && op.id <= previousId) malformed("shape document order");
+      previousId = op.id;
+    }
+  }
+  return page;
+}
+/**
+ * Follows exactly one authorized same-route 307; credentials never follow an arbitrary Location.
+ * @param {V1Transport} transport @param {Readonly<Record<string,string>>} params
+ * @param {V1ShapeRequest} request @param {AbortSignal | undefined} signal
+ * @param {string | undefined} [ifNoneMatch] A complete entity-tag list or *; 304 throws not_modified with response headers.
+ * @returns {Promise<V1ShapePage>}
+ */
+export async function readShapePage(transport, params, request, signal, ifNoneMatch) {
+  const isResume = (request.offset ?? "-1") === "-1" && request.cursor !== undefined;
+  if (isResume && (request.handle !== undefined || request.live !== undefined)) throw new TypeError("Shape resume requires offset=-1 without handle or live.");
+  const query = encodeShapeRequest(isResume ? { ...request, cursor: undefined } : request);
+  // Canonical filter size is checked by the producer; check our exact wire spelling here.
+  if (new TextEncoder().encode(query.get("where") ?? "").byteLength > 8192) throw new TypeError("Shape filters are limited to 8 KiB of UTF-8.");
+  if (query.get("offset") === "-1" && query.has("handle")) throw new TypeError("Shape bootstrap must omit handle.");
+  /** @type {Record<string,string>} */
+  const headers = {};
+  if (ifNoneMatch !== undefined) {
+    if (typeof ifNoneMatch !== "string" || !/^[ \t]*(?:\*|(?:W\/)?"[\x21\x23-\x7e\x80-\xff]*"(?:[ \t]*,[ \t]*(?:W\/)?"[\x21\x23-\x7e\x80-\xff]*")*)[ \t]*$/u.test(ifNoneMatch))
+      throw new TypeError("ifNoneMatch must be * or a list of quoted entity tags.");
+    headers["If-None-Match"] = ifNoneMatch;
+  }
+  const source = new URL(await transport.url("readFreeShape", params, signal));
+  if (isResume) {
+    query.set("cursor", resumeToken(request.cursor));
+    // The producer reserves 64 bytes for request-line framing in its 8 KiB ceiling.
+    if (new TextEncoder().encode(`${source.pathname}?${query}`).length > 8192 - 64) {
+      headers["TB-Shape-Resume"] = resumeToken(request.cursor);
+      query.delete("cursor");
+    }
+  }
+  let response = await shapeCall(transport, params, "readFreeShape", { query, headers, signal });
+  if (response.status === 307) {
+    if (query.get("offset") !== "-1") malformed("unexpected shape redirect");
+    const location = response.headers.get("location");
+    if (location === null) malformed("shape redirect Location");
+    const target = new URL(location, source);
+    if (target.origin !== source.origin || target.pathname !== source.pathname || target.username !== "" || target.password !== "" || target.hash !== "") malformed("shape redirect target");
+    for (const key of target.searchParams.keys()) {
+      if (!["where", "handle", "offset"].includes(key) || target.searchParams.getAll(key).length !== 1) malformed("shape redirect query");
+    }
+    const handle = requireShapeHandle(target.searchParams.get("handle"));
+    const offset = requireShapeOffset(target.searchParams.get("offset"));
+    if (offset === "-1" || (!isResume && !/^snap\.[0-9]+\.0$/u.test(offset)) || (isResume && offset.startsWith("snap."))) malformed("shape redirect offset");
+    if (target.searchParams.has("where") !== query.has("where")) malformed("shape redirect filter");
+    // Keep the caller's validated filter: the server's canonical spelling must not broaden it.
+    query.delete("cursor");
+    delete headers["TB-Shape-Resume"];
+    query.set("handle", handle);
+    query.set("offset", offset);
+    response = await shapeCall(transport, params, "readFreeShape", { query, headers, signal });
+    if (response.status !== 200) malformed("repeated shape redirect");
+  } else if (query.get("offset") === "-1") malformed("shape bootstrap requires redirect");
+  const page = decodeFreeShapePage(response.value, response.headers);
+  if (page.handle !== query.get("handle") || page.offset !== query.get("offset")) malformed("shape response position");
+  const inputCursor = query.get("cursor");
+  if (request.live === true && (page.cursor === undefined || (inputCursor !== null && BigInt(page.cursor) <= BigInt(inputCursor)))) malformed("shape live cursor advance");
+  return page;
+}
+/**
+ * Reuse keys only for static credentials; callback tokens authorize every decrypt with no-store.
+ * @param {V1Transport} transport @param {Readonly<Record<string,string>>} params
+ * @param {Uint8Array} bytes @param {V1SealedShapePosition} position @param {AbortSignal | undefined} signal
+ * @returns {Promise<V1ShapePage>}
+ */
+export async function decryptSealedShapePage(transport, params, bytes, position, signal) {
+  const handle = requireShapeHandle(position.handle);
+  const offset = requireShapeOffset(position.offset);
+  if (offset === "-1") throw new TypeError("Sealed shapes require a snapshot or log offset.");
+  if (typeof position.epoch !== "string" || !/^(?:0|[1-9][0-9]*)$/u.test(position.epoch) || BigInt(position.epoch) > (1n << 64n) - 1n) throw new TypeError("Shape epoch must be a canonical uint64.");
+  const epoch = position.epoch;
+  const keyId = requireId(position.keyId, "Shape key ID");
+  signal?.throwIfAborted();
+  const cache = currentKeys(transport, params);
+  const cacheId = JSON.stringify([handle, epoch, keyId]);
+  let raw = cache?.keys.get(cacheId)?.key;
+  if (raw === undefined) {
+    const query = new URLSearchParams({ handle, epoch, key_id: keyId });
+    const response = await shapeCall(transport, params, "getShapeKey", { query, cache: "no-store", signal });
+    const key = object(response.value, "shape epoch key");
+    if (key.handle !== handle || key.epoch !== epoch || key.key_id !== keyId) malformed("shape epoch key binding");
+    const encoded = string(key.key, "shape epoch key");
+    if (!/^[A-Za-z0-9_-]{43}$/u.test(encoded)) malformed("shape epoch key encoding");
+    raw = Uint8Array.from(atob(encoded.replace(/-/gu, "+").replace(/_/gu, "/")), c => c.charCodeAt(0));
+    if (btoa(String.fromCharCode(...raw)).replace(/\+/gu, "-").replace(/\//gu, "_").replace(/=+$/u, "") !== encoded) malformed("shape epoch key encoding");
+    const servedEpoch = BigInt(epoch);
+    const active = currentKeys(transport, params);
+    if (cache !== undefined && active === cache && servedEpoch >= cache.latestEpoch) {
+      cache.latestEpoch = servedEpoch;
+      for (const [id, entry] of cache.keys) if (entry.epoch < servedEpoch) cache.keys.delete(id);
+      cache.keys.set(cacheId, { epoch: servedEpoch, key: raw });
+    }
+  }
+  const plaintext = await decryptShapeObject(bytes, { handle, offset, epoch, keyId, key: raw });
+  signal?.throwIfAborted();
+  const page = decodeFreeShapePage(parseExactJson(new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(plaintext)), new Headers());
+  if (page.handle !== handle || page.offset !== offset || page.upToDate) malformed("sealed shape position");
+  return page;
+}
+
+/** @typedef {{readonly handle: string; readonly epoch: string; readonly keyId: string}} V1ShapeKeyRequest */
+/** @typedef {V1ShapeKeyRequest & {readonly key: Uint8Array}} V1ShapeKey */
+/** @param {V1Transport} transport @param {Readonly<Record<string, string>>} params @param {V1ShapeKeyRequest} request @param {AbortSignal | undefined} signal @returns {Promise<V1ShapeKey>} */
+export async function readShapeKey(transport, params, request, signal) {
+  const handle = requireShapeHandle(request.handle);
+  const epoch = decimal(request.epoch);
+  const keyId = requireId(request.keyId);
+  const response = await shapeCall(transport, params, "getShapeKey", {
+    query: new URLSearchParams({ handle, epoch, key_id: keyId }), cache: "no-store", signal,
+  });
+  const key = object(response.value, "shape epoch key");
+  if (key.handle !== handle || key.epoch !== epoch || key.key_id !== keyId) malformed("shape epoch key binding");
+  const encoded = string(key.key, "shape key");
+  if (!/^[A-Za-z0-9_-]{43}$/u.test(encoded)) malformed("shape key encoding");
+  const bytes = Uint8Array.from(atob(encoded.replace(/-/gu, "+").replace(/_/gu, "/")), c => c.charCodeAt(0));
+  if (btoa(String.fromCharCode(...bytes)).replace(/\+/gu, "-").replace(/\//gu, "_").replace(/=+$/u, "") !== encoded) malformed("shape key encoding");
+  return Object.freeze({ handle, epoch, keyId, key: bytes });
+}

package/src/v1/shape-subscription.js

@@ -0,0 +1,208 @@
+// Client state for one collection shape: bootstrap, snapshot pages, log chunks, then the live tail.
+import { TerraBaseV1Error } from "./errors.js";
+import { requireFilter } from "./filter.js";
+import { parseExactJson, stringifyExactJson } from "./json.js";
+import { readShapePage } from "./shape-reader.js";
+/**
+ * @import { JsonObject } from "./json.js"
+ * @import { V1Filter } from "./filter.js"
+ * @import { V1Transport } from "./transport.js"
+ */
+/**
+ * @typedef {object} V1ShapeSubscribeOptions
+ * @property {AbortSignal | undefined} [signal] Closes the subscription when aborted; cancellation settles `done`.
+ * @property {((subscription: V1ShapeSubscription) => void) | undefined} [onUpdate] Runs after validated responses and freshness changes; throwing rejects `done` unless already closed or aborted.
+ */
+/** @typedef {{ readonly version: string; readonly document: JsonObject }} V1ShapeDocument */
+const retryBaseMilliseconds = 250;
+const retryCapMilliseconds = 30_000;
+// The eighth attempt reaches the delay ceiling; retries continue until success or cancellation.
+const maximumBackoffAttempt = 8;
+/** @param {import("./errors.js").TerraBaseV1Error} error @returns {boolean} */
+function isRetryable(error) {
+  return (error.status === 429 && error.code === "shape_busy") ||
+    (error.status === 503 && (error.code === "unavailable" || error.code === "shape_too_large"));
+}
+/** @param {number} attempt @param {number | undefined} retryAfter @returns {number} */
+function retryDelay(attempt, retryAfter) {
+  return Math.max(Math.min(retryCapMilliseconds, retryBaseMilliseconds * 2 ** (attempt - 1)), (retryAfter ?? 0) * 1000);
+}
+/** @param {unknown} value @param {readonly string[]} allowed @param {string} what */
+function requireMembers(value, allowed, what) {
+  if (typeof value !== "object" || value === null) throw new TypeError(`${what} is an object.`);
+  for (const key of Object.keys(value)) if (!allowed.includes(key)) throw new TypeError(`Unknown ${what} member ${key}.`);
+}
+/** @template T @param {T} value @returns {T} */
+function deepFreeze(value) {
+  if (typeof value === "object" && value !== null && !Object.isFrozen(value)) {
+    Object.freeze(value);
+    for (const item of Object.values(value)) deepFreeze(item);
+  }
+  return value;
+}
+// setTimeout overflows above 2^31-1 ms and fires at once, so a long Retry-After is waited in chunks.
+const maximumTimerMilliseconds = 2 ** 31 - 1;
+/** @param {number} milliseconds @param {AbortSignal} signal @returns {Promise<void>} */
+function sleep(milliseconds, signal) {
+  return new Promise((resolve, reject) => {
+    signal.throwIfAborted();
+    let remaining = milliseconds;
+    /** @type {ReturnType<typeof setTimeout> | undefined} */
+    let timer;
+    const onAbort = () => { clearTimeout(timer); reject(signal.reason); };
+    const wait = () => {
+      const chunk = Math.min(remaining, maximumTimerMilliseconds);
+      timer = setTimeout(() => {
+        remaining -= chunk;
+        if (remaining > 0) wait();
+        else { signal.removeEventListener("abort", onAbort); resolve(); }
+      }, chunk);
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+    wait();
+  });
+}
+export class V1ShapeSubscription {
+  /** @type {Map<string, V1ShapeDocument>} */
+  #documents = new Map();
+  /** @type {string | undefined} */
+  #handle;
+  #offset = "-1";
+  /** @type {string | undefined} */
+  #cursor;
+  /** @type {string | undefined} Usable only from a snapshot-complete or log position. */
+  #resume;
+  #upToDate = false;
+  // Set after a changed-handle 409 while the saved resume is still usable; cleared by any commit or reset.
+  #resumeAttempt = false;
+  #controller = new AbortController();
+  #transport;
+  #params;
+  /** @type {V1Filter | undefined} */
+  #where;
+  #onUpdate;
+  #external;
+  #onExternalAbort = () => this.close();
+  #done;
+  /**
+   * @param {V1Transport} transport
+   * @param {Readonly<Record<string, string>>} params
+   * @param {{ where?: V1Filter | undefined }} [shape]
+   * @param {V1ShapeSubscribeOptions} [options]
+   */
+  constructor(transport, params, shape = {}, options = {}) {
+    requireMembers(shape, ["where"], "shape");
+    requireMembers(options, ["signal", "onUpdate"], "shape subscribe option");
+    const { where } = shape;
+    const { signal, onUpdate } = options;
+    if (signal !== undefined && !(signal instanceof AbortSignal)) throw new TypeError("signal is an AbortSignal.");
+    if (onUpdate !== undefined && typeof onUpdate !== "function") throw new TypeError("onUpdate is a function.");
+    this.#transport = transport;
+    this.#params = Object.freeze({ ...params });
+    // Exact copy: a structuredClone would lose the source text of large or fractional JSON numbers.
+    this.#where = where === undefined ? undefined : requireFilter(parseExactJson(stringifyExactJson(requireFilter(where), "shape filter")));
+    this.#onUpdate = onUpdate;
+    this.#external = signal;
+    if (signal?.aborted === true) this.close();
+    else signal?.addEventListener("abort", this.#onExternalAbort);
+    this.#done = this.#run();
+    // Callback-only consumers must not trigger a process-level unhandled rejection.
+    void this.#done.catch(() => {});
+  }
+  /** A copy per read: callers cannot change the documents this subscription holds. */
+  get state() { return new Map(this.#documents); }
+  get upToDate() { return this.#upToDate; }
+  /** Settles when the run ends: resolves on close, rejects on a terminal failure. */
+  get done() { return this.#done; }
+  close() { this.#controller.abort(); }
+  /** @returns {Promise<void>} */
+  async #run() {
+    const signal = this.#controller.signal;
+    let retries = 0;
+    try {
+      for (;;) {
+        signal.throwIfAborted();
+        const request = this.#request();
+        let page;
+        try {
+          page = await readShapePage(this.#transport, this.#params, request, signal);
+        } catch (error) {
+          if (!(error instanceof TerraBaseV1Error)) throw error;
+          if (isRetryable(error)) {
+            retries = Math.min(retries + 1, maximumBackoffAttempt);
+            await sleep(retryDelay(retries, error.retryAfter), signal);
+            continue;
+          }
+          if (error.status !== 409 || error.code !== "must_refetch") throw error;
+          this.#recover(request, error);
+          continue;
+        }
+        retries = 0;
+        this.#commit(page);
+        this.#onUpdate?.(this);
+      }
+    } catch (error) {
+      if (signal.aborted) return;
+      throw error;
+    } finally {
+      // A finished run must not keep the caller's signal (and this subscription) alive.
+      this.#external?.removeEventListener("abort", this.#onExternalAbort);
+    }
+  }
+  /** @returns {import("./shapes.js").V1ShapeRequest} */
+  #request() {
+    if (this.#resumeAttempt) return { where: this.#where, offset: "-1", cursor: this.#resume };
+    if (this.#handle === undefined) return { where: this.#where, offset: "-1" };
+    // Only a fresh head is a live tail; snapshot positions are never live.
+    if (this.#upToDate && !this.#offset.startsWith("snap.")) return { where: this.#where, offset: this.#offset, handle: this.#handle, live: true, cursor: this.#cursor };
+    return { where: this.#where, offset: this.#offset, handle: this.#handle };
+  }
+  /**
+   * @param {import("./shapes.js").V1ShapeRequest} request
+   * @param {TerraBaseV1Error} error
+   */
+  #recover(request, error) {
+    if (this.#resumeAttempt) return this.#reset();
+    if (request.handle === undefined) throw error;
+    // §7.6 reads the lineage from the response header. A body that names another handle is ambiguous: fail closed.
+    const handle = error.headers.get("tb-shape-handle");
+    const changed = handle !== null && handle !== this.#handle && (error.handle === undefined || error.handle === handle);
+    if (changed && this.#resume !== undefined) {
+      // One attempt on the new lineage; its own 409 falls through to #reset above.
+      this.#resumeAttempt = true;
+      if (this.#upToDate) {
+        this.#upToDate = false;
+        this.#onUpdate?.(this);
+      }
+      return;
+    }
+    this.#reset();
+  }
+  #reset() {
+    this.#documents = new Map();
+    this.#handle = undefined;
+    this.#offset = "-1";
+    this.#cursor = undefined;
+    this.#resume = undefined;
+    this.#upToDate = false;
+    this.#resumeAttempt = false;
+    this.#onUpdate?.(this);
+  }
+  /** @param {import("./shapes.js").V1ShapePage} page */
+  #commit(page) {
+    // Repeats are applied, never skipped: a repeated event can carry a newer materialized value.
+    const documents = new Map(this.#documents);
+    for (const change of page.changes)
+      for (const op of change.ops) {
+        if (op.op === "delete") documents.delete(op.id);
+        else documents.set(op.id, deepFreeze({ version: op.version, document: op.document }));
+      }
+    this.#documents = documents;
+    this.#handle = page.handle;
+    this.#offset = page.nextOffset;
+    this.#cursor = page.cursor;
+    this.#resume = page.nextOffset.startsWith("snap.") ? undefined : page.cursorResume;
+    this.#upToDate = page.upToDate;
+    this.#resumeAttempt = false;
+  }
+}

package/src/v1/shapes.js

@@ -16,7 +16,7 @@ import { stringifyExactJson } from "./json.js";
  * @property {boolean | undefined} [live] True only for log positions; waits up to 20 seconds.
  * @property {string | undefined} [cursor] Previous live response's TB-Shape-Cursor.
  */
-/** @typedef {{ readonly op: "upsert"; readonly id: import("../ids.js").EntityId; readonly version: string; readonly document: JsonObject } | { readonly op: "delete"; readonly id: import("../ids.js").EntityId }} V1ShapeOp */
+/** @typedef {{ readonly op: "upsert"; readonly id: string; readonly version: string; readonly document: JsonObject } | { readonly op: "delete"; readonly id: string }} V1ShapeOp */
 /** @typedef {{ readonly offset: string; readonly ops: readonly V1ShapeOp[] }} V1ShapeChange */
 /**
  * One snapshot page or log chunk. Only a fresh open tail/live response can report upToDate.
@@ -29,6 +29,9 @@ import { stringifyExactJson } from "./json.js";
  * @property {readonly V1ShapeChange[]} changes Apply commits and operations in their received order.
  * @property {string | undefined} cursor Echo this as cursor on the next live request.
  * @property {string | undefined} etag
+ * @property {string | undefined} [coveredOffset] Free-read protocol coverage (feed sequence, not write offset).
+ * @property {string | undefined} [valuesAt] Free-read materialization position.
+ * @property {string | undefined} [cursorResume] Opaque free-read resume token.
  */
 const maximumOffset = (1n << 63n) - 1n;
 const handlePattern = /^h1-[0-9a-f]{16}$/u;
@@ -59,7 +62,7 @@ export function requireShapeOffset(value) {
   throw new TypeError("A shape offset is -1, a signed-64-bit decimal log position, or snap.<head>.<canonical-base64url-id>.");
 }
 /** @param {unknown} value @returns {string} */
-function requireHandle(value) {
+export function requireShapeHandle(value) {
   if (typeof value !== "string" || !handlePattern.test(value)) throw new TypeError("A shape handle is h1- followed by 16 lowercase hex characters.");
   return value;
 }
@@ -72,7 +75,7 @@ export function encodeShapeRequest(request) {
   if (request.where !== undefined) query.set("where", stringifyExactJson(requireFilter(request.where), "shape filter"));
   const offset = requireShapeOffset(request.offset ?? "-1");
   query.set("offset", offset);
-  if (request.handle !== undefined) query.set("handle", requireHandle(request.handle));
+  if (request.handle !== undefined) query.set("handle", requireShapeHandle(request.handle));
   else if (offset !== "-1") throw new TypeError("A shape handle is required after bootstrap.");
   if (request.live !== undefined && typeof request.live !== "boolean") throw new TypeError("live is a boolean.");
   if (request.live === true) {
@@ -94,10 +97,13 @@ export function decodeShapePage(value, headers) {
   const cursor = headers.get("tb-shape-cursor") ?? undefined;
   if (cursor !== undefined && !isLogOffset(cursor)) malformed("shape cursor");
   return Object.freeze({
-    shapeId, handle: requireHandle(raw.handle),
+    shapeId, handle: requireShapeHandle(raw.handle),
     offset: requireShapeOffset(raw.offset), nextOffset: requireShapeOffset(raw.next_offset),
     upToDate: boolean(raw.up_to_date, "shape up_to_date"), cursor,
     etag: headers.get("etag") ?? undefined,
+    ...(raw.covered_offset === undefined ? {} : { coveredOffset: requireShapeOffset(raw.covered_offset) }),
+    ...(raw.values_at === undefined ? {} : { valuesAt: requireShapeOffset(raw.values_at) }),
+    ...(raw.cursor_resume === undefined ? {} : { cursorResume: string(raw.cursor_resume, "shape resume cursor") }),
     changes: Object.freeze(array(raw.changes, "shape changes").map(value => {
       const change = object(value, "shape change");
       return Object.freeze({ offset: u64(change.offset, "shape change offset"), ops: Object.freeze(array(change.ops, "shape operations").map(value => {
@@ -130,7 +136,7 @@ export async function readShape(transport, params, request, signal) {
     const target = new URL(location, source);
     if (target.origin !== source.origin || target.pathname !== source.pathname || target.username !== "" || target.password !== "" || target.hash !== "")
       malformed("shape redirect target");
-    const handle = requireHandle(target.searchParams.get("handle"));
+    const handle = requireShapeHandle(target.searchParams.get("handle"));
     const offset = requireShapeOffset(target.searchParams.get("offset"));
     if (!offset.startsWith("snap.")) malformed("shape bootstrap offset");
     query.set("handle", handle);

package/src/v1/sql.js

@@ -0,0 +1,98 @@
+import { array, boolean, malformed, object, string } from "./decode.js";
+import { requireDocumentId, requireName } from "./ids.js";
+/**
+ * @import { JsonObject, JsonValue } from "./json.js"
+ * @import { V1RequestOptions } from "./terrabase-v1.js"
+ * @import { V1Transport } from "./transport.js"
+ */
+
+/** @typedef {{ readonly id: string; readonly value: JsonObject }} V1SqlRow */
+/**
+ * SQL returns one bounded result, without a pagination cursor.
+ * @typedef {{ readonly matched: number; readonly truncated: boolean; readonly rows: readonly V1SqlRow[] }} V1SqlResult
+ */
+/** @typedef {{ readonly field: string; readonly reason: string }} V1SqlIndexSuggestion */
+/**
+ * @typedef {{
+ *   readonly ok: boolean;
+ *   readonly error: string | null;
+ *   readonly collection: string | null;
+ *   readonly hasLimit: boolean;
+ *   readonly plan: readonly string[];
+ *   readonly indexes: readonly string[];
+ *   readonly suggestions: readonly V1SqlIndexSuggestion[];
+ * }} V1SqlCheck
+ */
+
+/** @param {string} sql @param {V1RequestOptions} options @returns {string} */
+function requestBody(sql, options) {
+  if (typeof sql !== "string" || sql.length > 16_384)
+    throw new TypeError("SQL must be a string of at most 16384 UTF-16 code units.");
+  if (options === null || typeof options !== "object" || Array.isArray(options))
+    throw new TypeError("SQL request options must be an object.");
+  for (const member of Object.keys(options))
+    if (member !== "signal") throw new TypeError(`Unknown SQL request option ${member}.`);
+  // SQL syntax, including empty statements, stays producer-owned: check returns ok:false.
+  return JSON.stringify({ sql });
+}
+
+/** @param {JsonValue | undefined} value @returns {V1SqlResult} */
+function decodeResult(value) {
+  const raw = object(value, "SQL result");
+  const rows = array(raw.rows, "SQL rows").map(entry => {
+    const row = object(entry, "SQL row");
+    return Object.freeze({ id: requireDocumentId(row.id), value: object(row.value, "SQL row value") });
+  });
+  const matched = raw.matched;
+  if (typeof matched !== "number" || !Number.isInteger(matched) || matched < 0 || matched > 1000 || matched !== rows.length)
+    malformed("SQL matched count");
+  if (new Set(rows.map(row => row.id)).size !== rows.length) malformed("SQL row identities");
+  return Object.freeze({ matched, truncated: boolean(raw.truncated, "SQL truncation flag"), rows: Object.freeze(rows) });
+}
+
+/** @param {JsonValue | undefined} value @param {"checkSql" | "explainSql"} operation @returns {V1SqlCheck} */
+function decodeCheck(value, operation) {
+  const raw = object(value, "SQL check");
+  const ok = boolean(raw.ok, "SQL check flag");
+  const error = raw.error === null ? null : string(raw.error, "SQL check error");
+  const collection = raw.collection === null ? null : requireName("collection", raw.collection);
+  const hasLimit = boolean(raw.hasLimit, "SQL limit flag");
+  const plan = array(raw.plan, "SQL plan").map(step => string(step, "SQL plan step"));
+  const indexes = array(raw.indexes, "SQL indexes").map(index => string(index, "SQL index"));
+  const suggestions = array(raw.suggestions, "SQL index suggestions").map(entry => {
+    const suggestion = object(entry, "SQL index suggestion");
+    return Object.freeze({ field: string(suggestion.field, "SQL index field"), reason: string(suggestion.reason, "SQL index reason") });
+  });
+  if (ok ? error !== null || collection === null : error === null || error === "" || collection !== null || hasLimit || plan.length > 0 || indexes.length > 0 || suggestions.length > 0)
+    malformed("SQL check outcome");
+  if (operation === "explainSql" && !ok) malformed("SQL explain outcome");
+  return Object.freeze({ ok, error, collection, hasLimit, plan: Object.freeze(plan), indexes: Object.freeze(indexes), suggestions: Object.freeze(suggestions) });
+}
+
+/**
+ * Runs the producer's read-only SQL subset; it never converts a legacy SQL builder.
+ * @param {V1Transport} transport
+ * @param {string} database
+ * @param {string} sql
+ * @param {V1RequestOptions} [options]
+ * @returns {Promise<V1SqlResult>}
+ */
+export async function runSql(transport, database, sql, options = {}) {
+  const body = requestBody(sql, options);
+  return decodeResult((await transport.call("runSql", { database: requireName("database", database) }, { body, signal: options.signal })).value);
+}
+
+/**
+ * Check reports invalid SQL in a successful body; explain reports a producer HTTP error.
+ * @param {V1Transport} transport
+ * @param {string} database
+ * @param {string} sql
+ * @param {V1RequestOptions} [options]
+ * @param {"checkSql" | "explainSql"} [operation]
+ * @returns {Promise<V1SqlCheck>}
+ */
+export async function checkSql(transport, database, sql, options = {}, operation = "checkSql") {
+  if (operation !== "checkSql" && operation !== "explainSql") throw new TypeError("SQL checks use checkSql or explainSql.");
+  const body = requestBody(sql, options);
+  return decodeCheck((await transport.call(operation, { database: requireName("database", database) }, { body, signal: options.signal })).value, operation);
+}