@thomasfosterau/legation 0.0.0-stage → 0.1.0

package/dist/internal-CxXRlFK9.d.ts

@@ -0,0 +1,2362 @@
+import { $ as MutatorRegistry, A as RelatedRow, B as WindowObservation, Bt as StoreError, C as ClientViewError, D as Entry, Dt as Literal, F as FormRuling$1, G as RowChange, H as FallbackOptions, I as LocalRow, J as MutationStateMap, L as MutationOutcome, Lt as MutatorError, M as ClientEngine, Mt as BackendError, O as Pulled, Ot as LiteralKind, P as EngineEvent, Q as Mutator, R as ReadRow, S as ClientView, St as Subset, T as Reader, Tt as CollectionIndex, U as ServerHandler, V as ClientTransport, Vt as TransportError, X as AnyMutator, _t as CollectionRegistry, a as BusBroker, at as AggregateValue, bt as OrderBy, dt as Mutation, g as MirrorChannel, gt as AnyCollection, h as UrlReads, it as Aggregate, k as EdgeSelect$1, kt as Predicate, lt as ChangeHint, o as InvalidationBus, pt as NodeRegistry, q as MutationState, st as Backend, t as BackendHandler, tt as ClientStore, u as AuthPolicy, v as AnyQuery, wt as TypedSubset, xt as Row$3, z as TypedRow, zt as QueryError } from "./MemoryBackend-BziXwfcs.js";
+import * as Schema from "effect/Schema";
+import * as Effect from "effect/Effect";
+import * as Context from "effect/Context";
+import * as Stream from "effect/Stream";
+import * as Exit from "effect/Exit";
+import * as Scope from "effect/Scope";
+import * as Duration from "effect/Duration";
+import * as Layer from "effect/Layer";
+import * as Metric from "effect/Metric";
+import { Redis } from "effect/persistence";
+import { Rpc, RpcClient, RpcGroup } from "effect/rpc";
+import * as JsonSchema from "effect/JsonSchema";
+import { AsyncResult, Atom, AtomRegistry, Reactivity } from "effect/reactivity";
+import * as Cause from "effect/Cause";
+import * as ManagedRuntime from "effect/ManagedRuntime";
+declare namespace Hash_d_exports {
+  export { canonicalJson, contentHash };
+}
+/**
+ * Hash
+ *
+ * A stable, order-independent content hash, used as a row version when a
+ * backend exposes no native version token (CONTEXT.md: row version). The hash
+ * changes iff the canonical value changes — exactly what CVR diffing needs —
+ * so adapters that sync plain values (the JSON:API and SQL reference backends)
+ * share one implementation here rather than each rolling their own.
+ */
+/**
+ * A canonical, key-order-insensitive JSON serialisation: two structurally
+ * equal values always produce the same string, whatever the order their keys
+ * were written in. The correct basis for cache/subscription keys derived from
+ * args objects (where `JSON.stringify` would key on insertion order and split
+ * one logical subscription across two entries).
+ */
+declare const canonicalJson: (value: unknown) => string;
+/** A content-hash row version (FNV-1a over the canonical value). */
+declare const contentHash: (value: unknown) => string;
+declare namespace UnknownMutator_d_exports {
+  export { Cause$1 as Cause, isError, make$9 as make };
+}
+/** The `cause` of a {@link BackendError} raised for a mutator with no registered handler. */
+interface Cause$1 {
+  readonly _tag: "UnknownMutator";
+  readonly mutator: string;
+}
+/** Build the transient `BackendError` for a mutator with no registered handler. */
+declare const make$9: (mutator: string) => BackendError;
+/**
+ * True when `error` is a `BackendError` built by {@link make}, so its `cause` is
+ * the typed unknown-mutator cause, whatever its message says.
+ */
+declare const isError: (error: unknown) => boolean;
+declare namespace RpcTransport_d_exports {
+  export { FromOriginOptions, RpcTransportOptions, SyncRpc, SyncRpcError, SyncRpcs, fromOrigin, fromRpcClient, layer$2 as layer, layerHandlers, make$8 as make };
+}
+declare const SyncRpcError_base: Schema.Class<SyncRpcError, Schema.TaggedStruct<"SyncRpcError", {
+  readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError & {
+  readonly brand: unique symbol;
+}>;
+/** The wire-serializable failure carried on sync RPCs. */
+declare class SyncRpcError extends SyncRpcError_base {}
+/**
+ * The sync protocol as a typed RPC group. Apps embedding it next to their
+ * own RPCs can namespace it with `SyncRpcs.prefix("sync.")`.
+ */
+declare const SyncRpcs: RpcGroup.RpcGroup<Rpc.Rpc<"push", Schema.Struct<{
+  readonly clientGroupId: Schema.String;
+  readonly mutations: Schema.$Array<Schema.Struct<{
+    readonly clientId: Schema.String;
+    readonly mutationId: Schema.Number;
+    readonly mutator: Schema.String;
+    readonly args: Schema.Unknown;
+    readonly createdAt: Schema.Number;
+  }>>;
+  readonly schemaVersion: Schema.optional<Schema.String>;
+}>, Schema.Struct<{
+  readonly lastMutationIds: Schema.$Record<Schema.String, Schema.Number>;
+  readonly rejected: Schema.optional<Schema.$Array<Schema.Struct<{
+    readonly clientId: Schema.String;
+    readonly mutationId: Schema.Number;
+    readonly reason: Schema.String;
+  }>>>;
+}>, typeof SyncRpcError, never, never> | Rpc.Rpc<"pull", Schema.Struct<{
+  readonly clientGroupId: Schema.String;
+  readonly cookie: Schema.optional<Schema.String>;
+  readonly subscriptions: Schema.$Array<Schema.Struct<{
+    readonly collection: Schema.String;
+    readonly where: Schema.Codec<Predicate, Predicate, never, never>;
+    readonly orderBy: Schema.$Array<Schema.Struct<{
+      readonly field: Schema.String;
+      readonly direction: Schema.Literals<readonly ["asc", "desc"]>;
+    }>>;
+    readonly limit: Schema.optional<Schema.Number>;
+    readonly cursor: Schema.optional<Schema.String>;
+  }>>;
+  readonly namedSubscriptions: Schema.optional<Schema.$Array<Schema.Struct<{
+    readonly name: Schema.String;
+    readonly args: Schema.Unknown;
+  }>>>;
+  readonly schemaVersion: Schema.optional<Schema.String>;
+}>, Schema.Struct<{
+  readonly cookie: Schema.String;
+  readonly patch: Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+    readonly _tag: Schema.tag<"Put">;
+    readonly collection: Schema.String;
+    readonly id: Schema.String;
+    readonly version: Schema.Union<readonly [Schema.String, Schema.Number]>;
+    readonly value: Schema.Unknown;
+  }>, Schema.Struct<{
+    readonly _tag: Schema.tag<"Del">;
+    readonly collection: Schema.String;
+    readonly id: Schema.String;
+  }>, Schema.Struct<{
+    readonly _tag: Schema.tag<"Clear">;
+  }>]>>;
+  readonly lastMutationIds: Schema.$Record<Schema.String, Schema.Number>;
+  readonly rejected: Schema.optional<Schema.$Array<Schema.Struct<{
+    readonly clientId: Schema.String;
+    readonly mutationId: Schema.Number;
+    readonly reason: Schema.String;
+  }>>>;
+}>, typeof SyncRpcError, never, never> | Rpc.Rpc<"read", Schema.Struct<{
+  readonly clientGroupId: Schema.String;
+  readonly subsets: Schema.$Array<Schema.Struct<{
+    readonly collection: Schema.String;
+    readonly where: Schema.Codec<Predicate, Predicate, never, never>;
+    readonly orderBy: Schema.$Array<Schema.Struct<{
+      readonly field: Schema.String;
+      readonly direction: Schema.Literals<readonly ["asc", "desc"]>;
+    }>>;
+    readonly limit: Schema.optional<Schema.Number>;
+    readonly cursor: Schema.optional<Schema.String>;
+  }>>;
+  readonly schemaVersion: Schema.optional<Schema.String>;
+}>, Schema.Struct<{
+  readonly rows: Schema.$Array<Schema.Struct<{
+    readonly collection: Schema.String;
+    readonly id: Schema.String;
+    readonly version: Schema.Union<readonly [Schema.String, Schema.Number]>;
+    readonly value: Schema.Unknown;
+  }>>;
+}>, typeof SyncRpcError, never, never> | Rpc.Rpc<"pokes", Schema.Struct<{
+  clientGroupId: Schema.String;
+}>, import("effect/rpc/RpcSchema").Stream<Schema.Struct<{
+  readonly reason: Schema.optional<Schema.String>;
+}>, Schema.Never>, Schema.Never, never, never>>;
+/** The sync RPCs ({@link SyncRpcs}) as a union of their definitions. */
+type SyncRpc = RpcGroup.Rpcs<typeof SyncRpcs>;
+/** Server side: implement the sync RPCs from an in-context ServerHandler. */
+declare const layerHandlers: Layer.Layer<Rpc.ToHandler<SyncRpc>, never, ServerHandler>;
+/** Options for the RPC client transport. */
+interface RpcTransportOptions {
+  readonly clientGroupId: string;
+}
+/**
+ * Adapt a generated `SyncRpcs` client into a ClientTransport. Connectivity
+ * is reported as permanently "connected": RPC protocols reconnect (or fail
+ * per call) internally, and sync stays correct over pull alone. Wrap the
+ * result with `Transport.withInferredStatus` for behaviour-derived status
+ * (and `Transport.withFallback` to degrade to a second carrier); in browsers
+ * add `BrowserConnectivity.withBrowserConnectivity` on top.
+ */
+declare const fromRpcClient: <E extends {
+  readonly message: string;
+}>(client: RpcClient.RpcClient<SyncRpc, E>, options: RpcTransportOptions) => ClientTransport;
+/** Build a ClientTransport over a real RPC protocol (HTTP, WebSocket, …). */
+declare const make$8: (options: RpcTransportOptions) => Effect.Effect<ClientTransport, never, RpcClient.Protocol | Scope.Scope>;
+/** Layer building the ClientTransport from an in-context RPC protocol. */
+declare const layer$2: (options: RpcTransportOptions) => Layer.Layer<ClientTransport, never, RpcClient.Protocol>;
+/** Options for {@link fromOrigin}. */
+interface FromOriginOptions {
+  readonly clientGroupId: string;
+  /** The sync server's origin, e.g. `https://sync.example.com`. */
+  readonly origin: string;
+  /** The HTTP POST route (the fallback carrier). Default `/sync`. */
+  readonly httpPath?: string;
+  /** The WebSocket route (the live carrier). Default `/sync-ws`. */
+  readonly wsPath?: string;
+  /**
+   * Fallback tuning ({@link Transport.withFallback}). Defaults: sidelined
+   * primaries retry after 30 seconds; each WebSocket call gets a 10-second
+   * budget before the call falls to HTTP.
+   */
+  readonly fallback?: FallbackOptions;
+}
+/**
+ * The standard remote transport: sync RPCs over a WebSocket (the live
+ * path, pokes included) with plain HTTP POST as the fallback carrier —
+ * `Client.make`'s `transport: { url }` shorthand builds exactly this.
+ * Wrap with `BrowserConnectivity.withBrowserConnectivity`
+ * (`@thomasfosterau/legation-browser`) for navigator-aware status in browsers.
+ */
+declare const fromOrigin: (options: FromOriginOptions) => Effect.Effect<ClientTransport, never, Scope.Scope>;
+declare namespace SpecExport_d_exports {
+  export { Document, NamedSchema, SpecInfo, SyncApi, SyncSpec, asyncApi, build, openApi, toAsyncApi, toOpenApi };
+}
+/** Document metadata shared by every emitted format. */
+interface SpecInfo {
+  readonly title: string;
+  readonly version: string;
+  readonly description?: string;
+}
+/**
+ * The app's sync surface to describe: its collections, mutators and queries.
+ * All are optional — a read-only or write-only app still yields a valid spec —
+ * and the protocol messages are always present.
+ */
+interface SyncApi {
+  readonly info: SpecInfo;
+  readonly collections?: ReadonlyArray<AnyCollection>;
+  readonly mutators?: ReadonlyArray<AnyMutator>;
+  readonly queries?: ReadonlyArray<AnyQuery>;
+  /** Base path the sync RPCs are served on. Defaults to `"/sync"`. */
+  readonly path?: string;
+}
+/** The component name an app type resolves to in the shared schema pool. */
+interface NamedSchema {
+  readonly name: string;
+  readonly schema: string;
+}
+/**
+ * A format-neutral description of a sync surface: a shared component pool of
+ * JSON Schemas (OpenAPI-style `#/components/schemas/...` refs) plus the
+ * component name of each protocol message and app type. Emitters project this
+ * into a concrete document; adding a format means adding a `toX(spec)`.
+ */
+interface SyncSpec {
+  readonly info: SpecInfo;
+  readonly path: string;
+  /** Shared JSON-Schema component pool (draft-2020-12, OpenAPI-style refs). */
+  readonly components: JsonSchema.Definitions;
+  /** Component name of each protocol message. */
+  readonly messages: {
+    readonly pushRequest: string;
+    readonly pushResponse: string;
+    readonly pullRequest: string;
+    readonly pullResponse: string;
+    readonly poke: string;
+    readonly error: string;
+  };
+  /** App types, each with the component name of its specialized schema. */
+  readonly catalog: {
+    readonly collections: ReadonlyArray<NamedSchema>;
+    readonly mutators: ReadonlyArray<NamedSchema>;
+    readonly queries: ReadonlyArray<NamedSchema>;
+  };
+}
+/**
+ * Build the format-neutral {@link SyncSpec} from an app's sync surface. The
+ * shared component pool is assembled once (so every message reuses the same
+ * row/args definitions) in OpenAPI-style draft-2020-12.
+ */
+declare const build: (api: SyncApi) => SyncSpec;
+/** A JSON-serializable document (object form), as emitted by the projectors. */
+type Document = {
+  readonly [key: string]: unknown;
+};
+/**
+ * Project a {@link SyncSpec} into an OpenAPI 3.1 document: push and pull as the
+ * protocol's logical `POST {path}/push` and `POST {path}/pull` operations, with
+ * every app type in `components.schemas`. Streamed pokes live in AsyncAPI.
+ */
+declare const toOpenApi: (spec: SyncSpec) => Document;
+/**
+ * Project a {@link SyncSpec} into an AsyncAPI 3.0 document: push and pull as
+ * request/reply send operations and the contentless poke hint as a receive
+ * channel. Component schemas are shared with the OpenAPI projection.
+ */
+declare const toAsyncApi: (spec: SyncSpec) => Document;
+/** Build and project to OpenAPI 3.1 in one step. */
+declare const openApi: (api: SyncApi) => Document;
+/** Build and project to AsyncAPI 3.0 in one step. */
+declare const asyncApi: (api: SyncApi) => Document;
+declare namespace AtomicKeyValue_d_exports {
+  export { AtomicKeyValue, KeyValueEntry, KeyValueOp };
+}
+/**
+ * One operation of an atomic batch. `key` is the full key the backing store
+ * holds, namespace prefix included, exactly as the `KeyValueStore` underneath
+ * stores it. `value` is the string the store would hold for a `set`.
+ */
+type KeyValueOp = {
+  readonly _tag: "Set";
+  readonly key: string;
+  readonly value: string;
+} | {
+  readonly _tag: "Remove";
+  readonly key: string;
+};
+/** One string entry the backing store holds: its full key and its value. */
+interface KeyValueEntry {
+  readonly key: string;
+  readonly value: string;
+}
+/** The {@link AtomicKeyValue} service: an atomic batch over the store's keys. */
+interface AtomicKeyValue {
+  /**
+   * Commit `ops` in order as one all-or-nothing step. Up to the commit point, a
+   * failure or an interruption leaves none of the operations durable. A failure
+   * reported after the commit point may still have committed, so a caller must
+   * treat that outcome as unknown and re-read the store before relying on it. On
+   * success every operation is durable. A later operation on a key replaces an
+   * earlier one in the same batch.
+   */
+  readonly apply: (ops: ReadonlyArray<KeyValueOp>) => Effect.Effect<void, StoreError>;
+  /**
+   * Every string entry the backing store holds, read in one read transaction, so the
+   * result is one state of the store: a batch committed by another connection is
+   * either wholly in it or wholly absent (#392). Optional: a store without it reads
+   * its keys one at a time, which a concurrent connection can straddle.
+   */
+  readonly readAll?: Effect.Effect<ReadonlyArray<KeyValueEntry>, StoreError> | undefined;
+}
+/**
+ * The atomic batch seam (#393), optional: a `ClientStore` reads it with
+ * `Effect.serviceOption` and falls back to its release-record path when absent.
+ */
+declare const AtomicKeyValue: Context.Service<AtomicKeyValue, AtomicKeyValue>;
+declare namespace Undo_d_exports {
+  export { MutateHandle, MutationIntent, UndoEntry, UndoManager, make$7 as make };
+}
+/** A mutator invocation: the name and (decoded) args handed to `mutate`. */
+interface MutationIntent {
+  readonly mutator: string;
+  readonly args: unknown;
+}
+/**
+ * A reversible action as a pair of intents: `execute` applies it, `undo`
+ * reverses it. Both replay through `ClientEngine.mutate`, so both are
+ * optimistic, journaled, and rebased.
+ */
+interface UndoEntry {
+  readonly execute: MutationIntent;
+  readonly undo: MutationIntent;
+}
+/**
+ * The structural shape {@link make} needs: anything that can run a named
+ * mutation. A `ClientEngine` and a `Client` both satisfy this — with
+ * different error channels, hence the type parameter (issue #223).
+ */
+interface MutateHandle<E> {
+  readonly mutate: (mutator: string, args: unknown) => Effect.Effect<void, E>;
+}
+/**
+ * A per-client undo/redo manager over a {@link MutateHandle}. Every operation
+ * runs through the handle's `mutate` pipeline, so a failed mutation surfaces
+ * as `E` — the handle's own error type; the manager itself only owns the
+ * in-memory history and the grouping flag.
+ */
+interface UndoManager<E> {
+  /**
+   * Run an entry's `execute` through `mutate`, push it onto the undo stack, and
+   * clear the redo stack (a new action invalidates any redo). Inside a
+   * {@link group}, the entry is instead accumulated into the group's step.
+   */
+  readonly run: (entry: UndoEntry) => Effect.Effect<void, E>;
+  /**
+   * Pop the top undo step, replay its members' `undo` intents (in reverse order
+   * for a group), and push it onto the redo stack. A no-op when the undo stack
+   * is empty.
+   */
+  readonly undo: Effect.Effect<void, E>;
+  /**
+   * Pop the top redo step, replay its members' `execute` intents (in order for a
+   * group), and push it back onto the undo stack. A no-op when the redo stack is
+   * empty.
+   */
+  readonly redo: Effect.Effect<void, E>;
+  /** Whether an undo is currently possible. */
+  readonly canUndo: Effect.Effect<boolean>;
+  /** Whether a redo is currently possible. */
+  readonly canRedo: Effect.Effect<boolean>;
+  /** Observable {@link canUndo} for bindings (emits now, then on every change). */
+  readonly canUndoChanges: Stream.Stream<boolean>;
+  /** Observable {@link canRedo} for bindings (emits now, then on every change). */
+  readonly canRedoChanges: Stream.Stream<boolean>;
+  /**
+   * Coalesce every `run` made while `effect` runs into a single undo step. The
+   * effect's own result, errors, and requirements pass through unchanged.
+   * Nested groups fold into the outermost one.
+   */
+  readonly group: <A, E2, R>(effect: Effect.Effect<A, E2, R>) => Effect.Effect<A, E2, R>;
+}
+/**
+ * Build an {@link UndoManager} over any {@link MutateHandle} — a
+ * `ClientEngine`, a `Client`, or a test double. History is in-memory, so
+ * nothing needs a scope; the manager lives as long as the reference is held.
+ * The manager's error type is inferred from the handle's `mutate`, so a
+ * `ClientEngine` yields the same mutator/store union it always has, and a
+ * `Client` yields its narrower view error.
+ */
+declare const make$7: <E>(handle: MutateHandle<E>) => Effect.Effect<UndoManager<E>>;
+declare namespace Paced_d_exports {
+  export { PacedMutation, coalesce, debounce, throttle };
+}
+/** A paced mutation bound to one mutator: `call(key, args)` supersedes any of
+ * this key's own prior calls per the strategy's rule. */
+interface PacedMutation {
+  /**
+   * Journal `args` for `key`. `key` scopes compaction — calls with different
+   * keys (e.g. different row ids) never supersede one another, only
+   * consecutive calls sharing a key do.
+   */
+  readonly call: (key: string, args: unknown) => Effect.Effect<void, MutatorError | StoreError>;
+}
+/**
+ * Coalesce: consecutive unpushed invocations of `mutator` for the same `key`
+ * collapse to the last one. No timing — every call journals and compacts
+ * immediately, so nothing is ever buffered only in memory (fully durable),
+ * at the cost of a momentary extra journal entry between a call and its
+ * compaction.
+ */
+declare const coalesce: (engine: ClientEngine, mutator: string) => Effect.Effect<PacedMutation>;
+/**
+ * Debounce: the first call after a quiet period journals immediately (the
+ * overlay renders it right away — optimistic rendering never waits for the
+ * window); every call inside the window just buffers its args and restarts
+ * the trailing timer. When `duration` elapses with no further calls, the
+ * latest buffered args flush once, superseding the leading entry. A 50-call
+ * burst inside one window therefore produces exactly two journal writes
+ * (leading + trailing) no matter how many calls landed in between — see the
+ * module doc for the durability tradeoff this implies.
+ */
+declare const debounce: (engine: ClientEngine, mutator: string, duration: Duration.Input) => Effect.Effect<PacedMutation, never, Scope.Scope>;
+/**
+ * Throttle: like {@link debounce}'s leading edge, but the window is never
+ * reset by later calls — it flushes at most once per `duration` while calls
+ * keep arriving (a continuous drag emits periodic journal writes, not just
+ * one at the very end), then goes idle once a window elapses with nothing new
+ * buffered.
+ */
+declare const throttle: (engine: ClientEngine, mutator: string, duration: Duration.Input) => Effect.Effect<PacedMutation, never, Scope.Scope>;
+declare namespace Introspection_d_exports {
+  export { EngineIntrospection, fromServices, layer$1 as layer, make$6 as make };
+}
+/**
+ * A read-only introspection surface over an engine + store. `subscriptions`
+ * and `events` read the engine; `journal`, `cookie`, and `collections` read
+ * the store — all public reads, no private access.
+ */
+interface EngineIntrospection {
+  /** Active subsets: raw subscriptions plus each named subscription resolved. */
+  readonly subscriptions: Effect.Effect<ReadonlyArray<Subset>>;
+  /**
+   * The journal: pending (unacknowledged) mutations in causal order. It holds
+   * pending entries only. A mutation the backend acknowledged but no pull has
+   * reported yet is in the engine's unpulled tail (#286), which this view does
+   * not show.
+   */
+  readonly journal: Effect.Effect<ReadonlyArray<Mutation>, StoreError>;
+  /** The current pull cookie, or `undefined` before the first pull. */
+  readonly cookie: Effect.Effect<string | undefined, StoreError>;
+  /** Every collection currently holding confirmed rows. */
+  readonly collections: Effect.Effect<ReadonlyArray<string>, StoreError>;
+  /** The unified sync-lifecycle event stream (see {@link EngineEvent}). */
+  readonly events: Stream.Stream<EngineEvent>;
+}
+/** The {@link EngineIntrospection} service devtools read through. */
+declare const EngineIntrospection: Context.Service<EngineIntrospection, EngineIntrospection>;
+/** Build the introspection view over a given engine and store. */
+declare const make$6: (engine: ClientEngine, store: ClientStore) => EngineIntrospection;
+/** Build the view from the {@link ClientEngine} + {@link ClientStore} in context. */
+declare const fromServices: Effect.Effect<EngineIntrospection, never, ClientEngine | ClientStore>;
+/** Layer providing {@link EngineIntrospection} from the engine + store services. */
+declare const layer$1: Layer.Layer<EngineIntrospection, never, ClientEngine | ClientStore>;
+declare namespace OrderedTree_d_exports {
+  export { Tree, at, findBy, fromSorted, insert, rankOf, remove, size, slice, toArray };
+}
+/**
+ * OrderedTree
+ *
+ * A persistent (path-copying) weight-balanced binary search tree keyed by a
+ * caller-supplied total order (bounded-balance / "BB[α]" trees, Adams 1992 —
+ * the algorithm behind Haskell's `Data.Set`/`Data.Map`). Every mutation
+ * returns a new tree sharing everything off the changed path, so an
+ * insert/remove is *O(log n)* node allocations rather than an *O(n)* array
+ * copy. Each node also carries its subtree size, so a value's 0-based rank
+ * (and the reverse: the value at a given rank) resolve in *O(log n)*, and a
+ * `count`-bounded slice starting at a rank costs *O(log n + count)* — this is
+ * what lets `LiveView` reslice its window without rescanning the whole
+ * maintained order (issue #112).
+ *
+ * Weight-balance (rather than a randomized treap) makes bulk construction
+ * from an already-sorted array linear and deterministic: `fromSorted`
+ * recursively roots each half at its middle element, which is already
+ * within the balance bound, so no rotation is needed on the way up.
+ *
+ * Generic over the element type; the caller's `compare` must be a strict
+ * total order (no ties) for `rankOf`/`remove` to behave — `LiveView` gets
+ * this from `Subset.comparator`'s id tie-break.
+ */
+interface Node<T> {
+  readonly value: T;
+  readonly left: Node<T> | undefined;
+  readonly right: Node<T> | undefined;
+  readonly size: number;
+}
+/** An immutable ordered tree; `undefined` is the empty tree. */
+type Tree<T> = Node<T> | undefined;
+/** Number of elements in the tree, O(1). */
+declare const size: <T>(tree: Tree<T>) => number;
+/** Insert (or, if `compare` finds an exact match, replace) a value. O(log n). */
+declare const insert: <T>(tree: Tree<T>, value: T, compare: (a: T, b: T) => number) => Tree<T>;
+/** Remove the value matching `compare`, if present. O(log n); a no-op returns the same reference. */
+declare const remove: <T>(tree: Tree<T>, value: T, compare: (a: T, b: T) => number) => Tree<T>;
+/**
+ * The value whose key matches `key` per `compare` (negative when `key`
+ * belongs left of a node's value, positive when right, zero on a match), or
+ * `undefined` if absent. O(log n) — a plain BST point lookup, independent of
+ * rank, so a second tree can index the same elements by an unrelated key
+ * (`LiveView`'s `byId` alongside its value-ordered `order`) just as cheaply
+ * as a `Map`, but without a `Map`'s O(n) `new Map(bigMap)` copy on "update
+ * one entry, keep the rest" (path-copying only touches O(log n) nodes).
+ */
+declare const findBy: <T, K>(tree: Tree<T>, key: K, compare: (key: K, value: T) => number) => T | undefined;
+/**
+ * The 0-based rank of the value matching `compare`, or `-1` if absent.
+ * O(log n).
+ */
+declare const rankOf: <T>(tree: Tree<T>, value: T, compare: (a: T, b: T) => number) => number;
+/** The value at 0-based rank `index`, or `undefined` if out of bounds. O(log n). */
+declare const at: <T>(tree: Tree<T>, index: number) => T | undefined;
+/** Up to `count` in-order values starting at 0-based rank `from`. O(log n + count). */
+declare const slice: <T>(tree: Tree<T>, from: number, count: number) => ReadonlyArray<T>;
+/** Every value, in order. O(n) — the reference/full-materialization path. */
+declare const toArray: <T>(tree: Tree<T>) => ReadonlyArray<T>;
+/**
+ * Build a tree from an array already sorted per `compare`. O(n): each half
+ * roots at its middle element, which is already within the balance bound
+ * (`|leftSize - rightSize| <= 1`), so `fromSorted` never rotates.
+ */
+declare const fromSorted: <T>(sorted: ReadonlyArray<T>) => Tree<T>;
+declare namespace LiveView_d_exports {
+  export { LiveView, PositionedRow, Row$2 as Row, del, make$5 as make, makeIndexed, put, result, retarget };
+}
+/** A materialized `(id, value)` row, as a subset produces it. */
+type Row$2 = Row$3;
+/** A {@link Row} carrying its stable in-window position (see the module doc). */
+interface PositionedRow extends Row$2 {
+  readonly position: string;
+}
+/**
+ * One subset's incrementally maintained window: the matching rows in subset order, plus an id
+ * index over the same rows.
+ */
+interface LiveView {
+  readonly subset: Subset;
+  /** The full filtered + sorted matching set, maintained as an ordered tree. */
+  readonly order: Tree<Row$2>;
+  /**
+   * The same rows, maintained as a second tree ordered by id — an id index
+   * that supports an O(log n) presence check and O(log n) update, unlike a
+   * `Map` (see the module doc for why that distinction matters here).
+   */
+  readonly byId: Tree<Row$2>;
+  /** id → stable position, for rows currently inside the window only. */
+  readonly positions: ReadonlyMap<string, string>;
+}
+/** Build a view from an unordered collection snapshot. */
+declare const make$5: (subset: Subset, rows: ReadonlyArray<Row$2>) => LiveView;
+/**
+ * {@link make}, but reading rows from an id-keyed map with optional secondary-index
+ * acceleration (issue #113) — the collection-scale rebuild path (`Rebuild`
+ * view changes, a change-hub seq-gap collapse) shares the same narrowing as
+ * one-shot `query`.
+ */
+declare const makeIndexed: (subset: Subset, rowsById: ReadonlyMap<string, Row$2>, index?: CollectionIndex) => LiveView;
+/** The visible page: the subset's cursor + limit over the maintained order. */
+declare const result: (view: LiveView) => ReadonlyArray<PositionedRow>;
+/**
+ * Retarget the window — a new `limit` and/or `cursor`, e.g. "load more"
+ * widening the page — without touching the maintained order: no re-fetch, no
+ * re-sort, just a new O(log n + window) slice of the same tree.
+ * `collection`/`where`/`orderBy` stay the view's own; only `limit`/`cursor`
+ * move, matching `useConnection`'s "load more widens one window" (ADR-0024)
+ * — the pure, comparator-shaped half of "widen"; the engine-level API that
+ * reactively feeds a widened `limit` to an open subscription (so the client
+ * never re-registers it) is `ClientEngine.observeWindow` (#133).
+ * Same-reference-on-no-op: returns `view` unchanged if neither `limit` nor
+ * `cursor` moved.
+ */
+declare const retarget: (view: LiveView, window: {
+  readonly limit?: number;
+  readonly cursor?: string;
+}) => LiveView;
+/**
+ * Apply a row upsert: place it at its sorted position if it matches the
+ * predicate, or remove it if it no longer does. Returns the same view
+ * reference when the row neither matched before nor matches now (an O(log n)
+ * `byId` check).
+ */
+declare const put: (view: LiveView, row: Row$2) => LiveView;
+/** Apply a row deletion. Returns the same view reference if the id is absent. */
+declare const del: (view: LiveView, id: string) => LiveView;
+declare namespace Incremental_d_exports {
+  export { Delta, Group, JoinCombine, JoinOperator, JoinOptions$1 as JoinOptions, Operator, OrderedWindow, Row$1 as Row, applyDelta, deltaFromChanges, diff, distinctFromScratch, emptyDelta, filterFromScratch, groupByFromScratch, indexById, joinFromScratch, makeDistinct, makeFilter, makeGroupBy, makeJoin, makeMap, makeOrderedWindow, mapFromScratch, orderedWindowFromScratch, pageOf };
+}
+/** A `(id, value)` row — structurally `Subset.Row` / `ClientEngine.LocalRow`. */
+interface Row$1 {
+  readonly id: string;
+  readonly value: unknown;
+}
+/**
+ * A batch of row changes. An update is carried as a `removed` (old value)
+ * paired with an `added` (new value) for the same id — the shape
+ * {@link diff} produces from consecutive page snapshots, and the shape every
+ * operator's `step` accepts and returns.
+ */
+interface Delta {
+  readonly added: ReadonlyArray<Row$1>;
+  readonly removed: ReadonlyArray<Row$1>;
+}
+/** The empty delta (a no-op step result). */
+declare const emptyDelta: Delta;
+/** Index a page by id, for diffing against the next snapshot. */
+declare const indexById: (rows: ReadonlyArray<Row$1>) => Map<string, Row$1>;
+/**
+ * Diff a new page against the previous snapshot (by id, value change detected
+ * by content hash): a new id is an `added`, a vanished id a `removed`, a
+ * changed value a `removed` (old) + `added` (new). Returns the delta and the
+ * new snapshot index to carry forward.
+ */
+declare const diff: (previous: ReadonlyMap<string, Row$1>, next: ReadonlyArray<Row$1>) => {
+  readonly delta: Delta;
+  readonly index: Map<string, Row$1>;
+};
+/** Fold a delta into a maintained result map (remove ids, then set adds). */
+declare const applyDelta: (result: Map<string, Row$1>, delta: Delta) => void;
+/**
+ * Recover a {@link Delta} directly from an `observeChanges` batch (#115),
+ * instead of diffing two page snapshots (see {@link diff} above) — the
+ * optimization ADR-0027 §4 and this module's header flag as a follow-up:
+ * `LiveView` already decided enter/update/exit/move per row, so this just
+ * reads that decision instead of recomputing it from two `Map`s. `known`
+ * tracks the last row seen per id (across calls, mutated in place) so a
+ * `reset` can emit a `removed` for everything it cleared — the same
+ * information a page-diff's `previous` snapshot would have given for free.
+ * `move` carries no value change, so it contributes nothing to the delta.
+ */
+declare const deltaFromChanges: (known: Map<string, Row$1>, batch: ReadonlyArray<RowChange<Row$1>>) => Delta;
+/** Materialize a result map to a page in a deterministic (id-ascending, code-point) order. */
+declare const pageOf: (result: ReadonlyMap<string, Row$1>) => ReadonlyArray<Row$1>;
+/** A single-input delta→delta operator maintaining its own internal state. */
+interface Operator {
+  readonly step: (delta: Delta) => Delta;
+}
+/**
+ * `filter` — keep rows whose value passes an arbitrary JS predicate. Stateless
+ * per row: the predicate is deterministic on the value, and a delta carries the
+ * value it concerns, so an added/removed row's membership is decided on the
+ * spot (an update that filters a row out is a `removed` with the old value that
+ * passed; one that filters it in is an `added` that now passes).
+ */
+declare const makeFilter: (predicate: (value: unknown) => boolean) => Operator;
+/** {@link makeFilter}'s naive recompute, for the property test. */
+declare const filterFromScratch: (rows: ReadonlyArray<Row$1>, predicate: (value: unknown) => boolean) => Map<string, Row$1>;
+/**
+ * `map`/select — project each value through an arbitrary JS function, keeping
+ * the row id (projection preserves identity). Stateless: `f` is deterministic,
+ * so an update's `removed` reconstructs the old projection and its `added` the
+ * new one.
+ */
+declare const makeMap: (f: (value: unknown) => unknown) => Operator;
+/** {@link makeMap}'s naive recompute. */
+declare const mapFromScratch: (rows: ReadonlyArray<Row$1>, f: (value: unknown) => unknown) => Map<string, Row$1>;
+/**
+ * `distinct` — collapse duplicate values to one row, keyed and identified by
+ * the value's canonical serialization (so value equality, not reference,
+ * decides duplication and there is no hash-collision risk). A multiplicity
+ * count per distinct value means removing one of several duplicates keeps the
+ * distinct row; the row appears when its count goes 0→1 and disappears at 1→0.
+ */
+declare const makeDistinct: () => Operator;
+/** {@link makeDistinct}'s naive recompute (dedupe by canonical value). */
+declare const distinctFromScratch: (rows: ReadonlyArray<Row$1>) => Map<string, Row$1>;
+/**
+ * `groupBy` returning grouped **rows** (not only scalar aggregates): one output
+ * row per group, `value` = `{ key, rows }` where `rows` are the group members'
+ * values ordered by member id (a deterministic within-group order, so a
+ * from-scratch recompute matches). Only the one or two groups a delta touches
+ * re-materialize — every other group's row is untouched (the same
+ * touch-only-the-affected-bucket discipline as `Aggregate`'s grouped state).
+ */
+declare const makeGroupBy: (key: (value: unknown) => string) => Operator;
+/** A group row's value shape (what {@link makeGroupBy} emits). */
+interface Group {
+  readonly key: string;
+  readonly rows: ReadonlyArray<unknown>;
+}
+/** {@link makeGroupBy}'s naive recompute. */
+declare const groupByFromScratch: (rows: ReadonlyArray<Row$1>, key: (value: unknown) => string) => Map<string, Row$1>;
+/** How a joined row's value is assembled; default `{ left, right }`. */
+type JoinCombine = (left: unknown, right: unknown | null) => unknown;
+/** Options for {@link makeJoin} / {@link joinFromScratch}. */
+interface JoinOptions$1 {
+  /** Extract the left row's join key (an arbitrary value; `null`/`undefined` never matches). */
+  readonly leftKey: (value: unknown) => unknown;
+  /** Extract the right row's join key. */
+  readonly rightKey: (value: unknown) => unknown;
+  /** `inner` drops unmatched left rows; `left` keeps them with a `null` right. */
+  readonly kind: "inner" | "left";
+  /** Assemble the joined value; defaults to `{ left, right }`. */
+  readonly combine?: JoinCombine;
+}
+/**
+ * A two-input join over arbitrary key equality (inner or left). Maintains,
+ * per side, an id→row map and a key→ids index; a change re-derives only the
+ * left rows whose key the change touches (a right delta re-hydrates only the
+ * lefts in the affected buckets; a left delta only itself) — never a full
+ * re-group, the same discipline as `Related.makeJoinEngine`. Left-join null
+ * rows fall out for free: an unmatched left's contribution is a single
+ * `combine(left, null)` row, replaced the moment a matching right arrives.
+ */
+interface JoinOperator {
+  readonly stepLeft: (delta: Delta) => Delta;
+  readonly stepRight: (delta: Delta) => Delta;
+}
+/** Build a {@link JoinOperator} for the given join keys and kind (inner or left). */
+declare const makeJoin: (options: JoinOptions$1) => JoinOperator;
+/** {@link makeJoin}'s naive recompute (nested-loop join by key equality). */
+declare const joinFromScratch: (left: ReadonlyArray<Row$1>, right: ReadonlyArray<Row$1>, options: JoinOptions$1) => Map<string, Row$1>;
+/** An ordered-window operator maintaining a `LiveView` over derived rows. */
+interface OrderedWindow {
+  /** Apply a delta; returns the current window, ordered and limited. */
+  readonly step: (delta: Delta) => ReadonlyArray<Row$1>;
+}
+/**
+ * `orderedWindow` — sort derived rows by an `orderBy` and keep the first
+ * `limit`. Reuses `LiveView` (the `OrderedTree` + fractional-index machinery of
+ * #112): a delta is folded in as O(log n) `put`/`del`s and the window resliced
+ * without a re-sort, so a change outside the page costs the same as one inside
+ * it. Order is `Subset.comparator` — the one ordering authority (ADR-0026), so
+ * "no orderBy" still means a stable id-ascending order.
+ */
+declare const makeOrderedWindow: (orderBy: ReadonlyArray<OrderBy>, limit?: number) => OrderedWindow;
+/** {@link makeOrderedWindow}'s naive recompute (`Subset.apply`: sort then window). */
+declare const orderedWindowFromScratch: (rows: ReadonlyArray<Row$1>, orderBy: ReadonlyArray<OrderBy>, limit?: number) => ReadonlyArray<Row$1>;
+declare namespace Subscriptions_d_exports {
+  export { SubscriptionHandle, Subscriptions, SubscriptionsOptions, WindowHandle, counted, make$4 as make };
+}
+/** A held subscription. `release` is idempotent; the grace timer starts when
+ * the last holder releases. */
+interface SubscriptionHandle {
+  readonly release: Effect.Effect<void>;
+}
+/**
+ * A held, reactively-retargetable window (#133): `rows`/`retarget` are
+ * {@link WindowObservation}'s (see `ClientEngine.observeWindow`); `release`
+ * drops the subscription this window's *current* (possibly retargeted)
+ * subset holds — unlike {@link acquire}, not refcounted, since a window's
+ * subset identity (its `limit`/`cursor`) changes over its lifetime and so
+ * cannot be shared under one hash-keyed entry the way a plain subset
+ * subscription is. Each retargetable window should be its own observation
+ * (the common case: one user's one paginated view); two independent
+ * `acquireWindow` calls that happen to start from equivalently-hashed
+ * subsets are not coordinated with each other.
+ */
+interface WindowHandle extends WindowObservation {
+  readonly release: Effect.Effect<void>;
+}
+/**
+ * Subscription lifecycle over a `ClientEngine`: refcounted acquire/release, a grace period
+ * before an unused subscription is dropped, and preload.
+ */
+interface Subscriptions {
+  /** Acquire a raw-subset subscription (refcounted). */
+  readonly acquire: (subset: Subset) => Effect.Effect<SubscriptionHandle>;
+  /**
+   * Acquire a reactively-retargetable window (#133): composes `acquire`'s
+   * subscribe/release with {@link ClientEngine.observeWindow}, so `retarget`
+   * widens/advances the window in place (reusing `LiveView`'s maintained
+   * order) and keeps the server-synced subscription in step — the
+   * `useConnection` "load more" paging hook's engine-level seam.
+   */
+  readonly acquireWindow: (subset: Subset) => Effect.Effect<WindowHandle, StoreError | MutatorError, Scope.Scope>;
+  /** Acquire a named-query subscription (refcounted). */
+  readonly acquireQuery: (name: string, args: unknown) => Effect.Effect<SubscriptionHandle, QueryError>;
+  /** Pin a subset for the session (never released). */
+  readonly preload: (subset: Subset) => Effect.Effect<void>;
+  /** Pin a named query for the session (never released). */
+  readonly preloadQuery: (name: string, args: unknown) => Effect.Effect<void, QueryError>;
+}
+/**
+ * One counted voice over the engine's set-based subscription list. The
+ * engine's `subscribe` / `unsubscribe` register or drop a window outright,
+ * so two independent registrations of one window — an explicit pin beside
+ * a relational read's own root subscription, two relational reads pinning
+ * one foreign window — would drop it for both when the first released.
+ * Registrations made through the returned engine hold a count per window:
+ * the engine hears `subscribe` on the first hold and `unsubscribe` on the
+ * last. A window this facade never counted (registered on the engine
+ * directly) is released as before, so the engine's own semantics survive
+ * for callers that bypass it. Everything else passes through untouched.
+ *
+ * Idempotent: counting a counted engine returns it, so one engine handed
+ * to several fronts — an `EngineHost` and a `ClientView.fromEngine` in the
+ * same tab, ADR-0010's main-thread path — has one voice, not one per front.
+ */
+declare const counted: (engine: ClientEngine) => ClientEngine;
+/** Options for {@link make}. */
+interface SubscriptionsOptions {
+  /** Grace period a released subscription is kept before being dropped. */
+  readonly ttl?: Duration.Duration;
+}
+/** Build a subscription manager bound to an engine. Scoped: pending grace
+ * timers are interrupted when the scope closes. */
+declare const make$4: (engine: ClientEngine, options?: SubscriptionsOptions) => Effect.Effect<Subscriptions, never, Scope.Scope>;
+declare namespace Derive_d_exports {
+  export { DerivedResult, JoinOptions, OrderedWindowOptions, Row, Source, atom, distinct, filter, groupBy, join, map, observed, orderedWindow, select };
+}
+/** A derived row — the `(id, value)` unit, structurally `ClientEngine.LocalRow`. */
+type Row = Row$1;
+/** A derived source: a stream of page snapshots (what `ClientView.observe` yields). */
+type Source<E> = Stream.Stream<ReadonlyArray<Row>, E>;
+/**
+ * Keep the rows whose value passes an arbitrary JS predicate. The predicate is
+ * never serialized and never narrows what syncs — it shapes only what is shown
+ * of the already-synced page (the boundary rule above).
+ */
+declare const filter: <E>(source: Source<E>, predicate: (value: unknown) => boolean) => Source<E>;
+/** Project each row's value through an arbitrary JS function, keeping its id. */
+declare const map: <E>(source: Source<E>, f: (value: unknown) => unknown) => Source<E>;
+/** {@inheritDoc map} — `select` reads better for a projection; same combinator. */
+declare const select: <E>(source: Source<E>, f: (value: unknown) => unknown) => Source<E>;
+/** Collapse duplicate values to one row, keyed by the canonical value. */
+declare const distinct: <E>(source: Source<E>) => Source<E>;
+/**
+ * Group rows by an arbitrary key function, emitting one row per group whose
+ * value is `{ key, rows }` (the group's member values). A having-clause is
+ * `filter` after `groupBy`; a scalar rollup is `map` over the group rows.
+ */
+declare const groupBy: <E>(source: Source<E>, key: (value: unknown) => string) => Source<E>;
+/** Options for {@link join} (re-exported from {@link Incremental}). */
+type JoinOptions = JoinOptions$1;
+/**
+ * Join two derived sources on arbitrary key equality (inner or left). Merges
+ * the two page streams, feeding each side's delta to the shared join operator,
+ * which re-derives only the left rows a change touches. A joined row's value is
+ * `{ left, right }` by default (`right` is `null` for an unmatched left row
+ * under `kind: "left"`); pass `combine` to shape it otherwise.
+ */
+declare const join: <E, F>(left: Source<E>, right: Source<F>, options: JoinOptions) => Source<E | F>;
+/** Options for {@link orderedWindow}: a sort order and an optional row limit. */
+interface OrderedWindowOptions {
+  readonly orderBy: ReadonlyArray<OrderBy>;
+  readonly limit?: number;
+}
+/**
+ * Sort derived rows by an `orderBy` and keep the first `limit` — an ORDER
+ * BY … LIMIT over the derived result, maintained by `LiveView`'s `OrderedTree`
+ * so a change outside the window costs the same as one inside it (ADR-0026's
+ * one ordering authority applies, so "no orderBy" still means stable id order).
+ */
+declare const orderedWindow: <E>(source: Source<E>, options: OrderedWindowOptions) => Source<E>;
+/** A derived value's Atom: the current page as an `AsyncResult`, re-emitting on change. */
+type DerivedResult<E> = AsyncResult.AsyncResult<ReadonlyArray<Row>, E | Cause.NoSuchElementError>;
+/**
+ * Expose a derived pipeline as an Atom on the standard reactivity surface — the
+ * same shape `LiveQuery.make(...).atom(...)` produces for a raw subset, so a
+ * framework binding renders a derived value with no new machinery.
+ */
+declare const atom: <E>(source: Source<E>) => Atom.Atom<DerivedResult<E>>;
+/**
+ * A scoped leaf source: acquire a refcounted subscription for `subset` (so the
+ * rows actually sync) and observe it, releasing the subscription when the scope
+ * closes. A pipeline built from `observed` leaves holds all its sources'
+ * subscriptions for its lifetime and drops them together on teardown — the
+ * refcounted-lifetime discipline the #114 brief asks for, `Subscriptions`
+ * doing the reference counting so a shared leaf is synced once.
+ *
+ * When `view` is a full {@link ClientView.ClientView} (not just the narrower
+ * {@link ClientView.Reader}), the returned source is built from its
+ * `observeChanges` feed and tagged so every combinator composed on top reads
+ * that feed directly too (see the module doc). A bare `Reader` has no
+ * `observeChanges` to prefer, so this falls back to `observe`'s pages,
+ * unchanged.
+ */
+declare const observed: (subscriptions: Subscriptions, view: Reader | ClientView, subset: Subset) => Effect.Effect<Source<ClientViewError>, never, Scope.Scope>;
+declare namespace FractionalIndex_d_exports {
+  export { compare, generateBetween, generateNBetween };
+}
+/**
+ * FractionalIndex
+ *
+ * Stable position keys for in-window rows (issue #112): a string that sorts
+ * between any two others, so a row entering, leaving, or moving within a
+ * maintained window can be given a key without renumbering its neighbors —
+ * the primitive behind expressing a delta as `{ type: "move", key, position
+ * }` instead of diffing pages (a future row-level delta feed's concern;
+ * `LiveView` only assigns and maintains the keys today).
+ *
+ * Each key is a base-62 digit string (`0-9A-Za-z`, chosen so ASCII order
+ * already matches digit order) read as a fraction in `[0, 1)`:
+ * `digits[0] * 62⁻¹ + digits[1] * 62⁻² + …`. Keys compare by that *value*,
+ * not raw string order — `compare` zero-pads the shorter key first, so e.g.
+ * `"5"` and `"50"` (both 5/62) compare equal. This is what keeps
+ * `generateBetween` total: two real numbers always have a value strictly
+ * between them, so — unlike schemes that compare the raw strings
+ * lexicographically (where, say, nothing sorts between `"A"` and `"A0"`,
+ * since any extension of `"A"` is lexicographically ≥ `"A0"`) — there is no
+ * pair of distinct keys this can fail to split.
+ *
+ * Repeatedly inserting at the same boundary (e.g. always "before the
+ * current first row") grows key length by roughly one digit every ~5-6
+ * insertions at that boundary (`log_2(62)`) — the standard, accepted cost of
+ * any fractional-indexing scheme (TanStack DB's `generateKeyBetween`,
+ * Figma's original algorithm) and not specific to this implementation.
+ */
+/**
+ * Compare two keys by the fraction they encode (zero-padding the shorter
+ * one), not by raw string order — see the module doc for why that matters.
+ */
+declare const compare: (a: string, b: string) => number;
+/**
+ * A key whose value lies strictly between `lo` and `hi` (each defaulting to
+ * the open bound: `lo` omitted means 0, `hi` omitted means unbounded above).
+ * Throws if `lo` is not strictly before `hi`.
+ */
+declare const generateBetween: (lo?: string, hi?: string) => string;
+/**
+ * `count` keys, all strictly between `lo` and `hi` and strictly increasing —
+ * built by recursively bisecting the interval so the keys stay close in
+ * length (O(log count) longer than a single `generateBetween`) rather than
+ * chaining `generateBetween(lo, hi)` calls, which would grow the last key
+ * by one digit per call.
+ */
+declare const generateNBetween: (lo: string | undefined, hi: string | undefined, count: number) => ReadonlyArray<string>;
+declare namespace LiveQuery_d_exports {
+  export { LiveQueries, LiveQueryResult$1 as LiveQueryResult, LiveQuerySource, make$3 as make };
+}
+/** Anything that observes a subset as a stream of materialized rows. */
+interface LiveQuerySource<E> {
+  readonly observe: (subset: Subset) => Stream.Stream<ReadonlyArray<LocalRow>, E>;
+}
+/**
+ * The Atom value for a live query: `AsyncResult` of the current rows. A
+ * never-ending source means it stays `Success` (or `Failure`) after the
+ * first emission; `NoSuchElementError` only appears if a source completes
+ * without emitting.
+ */
+type LiveQueryResult$1<E> = AsyncResult.AsyncResult<ReadonlyArray<LocalRow>, E | Cause.NoSuchElementError>;
+/** Shared live-query Atoms over a {@link LiveQuerySource}, one per subset identity. */
+interface LiveQueries<E> {
+  /**
+   * The Atom for a subset's live results. Stable per subset identity
+   * (`Subset.hash`): the same subset yields the same Atom, so mounting it
+   * from many components shares one subscription.
+   */
+  readonly atom: (subset: Subset) => Atom.Atom<LiveQueryResult$1<E>>;
+}
+/** Build the Atom factory for a source's live queries. */
+declare const make$3: <E>(source: LiveQuerySource<E>) => LiveQueries<E>;
+declare namespace EngineAtoms_d_exports {
+  export { AggregateResult, EngineAtoms, GroupedAggregateResult, LiveQueryResult, MutationArg, MutationStatesResult, MutationsForResult, NamedQueryResult, TypedLiveQueryResult, fromLayer };
+}
+type Rows = ReadonlyArray<LocalRow>;
+/**
+ * A live query's Atom value: the current rows as an `AsyncResult`. A
+ * never-ending source stays `Success` after the first emission;
+ * `NoSuchElementError` only appears if a source completes without emitting.
+ */
+type LiveQueryResult = AsyncResult.AsyncResult<Rows, StoreError | MutatorError | Cause.NoSuchElementError>;
+/**
+ * A typed live query's Atom value: the current rows refined to the row type
+ * `A`, as an `AsyncResult`. `TypedLiveQueryResult<unknown>` is structurally
+ * {@link LiveQueryResult}, so plain-subset callers are unaffected.
+ */
+type TypedLiveQueryResult<A> = AsyncResult.AsyncResult<ReadonlyArray<TypedRow<A>>, StoreError | MutatorError | Cause.NoSuchElementError>;
+/** A named query's Atom value (adds `QueryError` to the failure channel). */
+type NamedQueryResult = AsyncResult.AsyncResult<Rows, StoreError | MutatorError | QueryError | Cause.NoSuchElementError>;
+/** A live aggregate's Atom value: the current aggregate value as an `AsyncResult`. */
+type AggregateResult = AsyncResult.AsyncResult<AggregateValue, StoreError | MutatorError | Cause.NoSuchElementError>;
+/** A live grouped-aggregate's Atom value: the per-group record as an `AsyncResult`. */
+type GroupedAggregateResult = AsyncResult.AsyncResult<Record<string, AggregateValue>, StoreError | MutatorError | Cause.NoSuchElementError>;
+/** What to write to the mutation atom to run a mutator optimistically. */
+interface MutationArg {
+  readonly mutator: string;
+  readonly args: unknown;
+}
+/** The mutation-state map's Atom value (#116): an `AsyncResult` of the current map. */
+type MutationStatesResult = AsyncResult.AsyncResult<MutationStateMap, Cause.NoSuchElementError>;
+/** A `mutationsFor` selector's Atom value: the matching states, oldest first. */
+type MutationsForResult = AsyncResult.AsyncResult<ReadonlyArray<MutationState>, Cause.NoSuchElementError>;
+/** The engine's reactive surface, built from its layer. */
+interface EngineAtoms {
+  /** The runtime backing every engine atom; the registry owns its scope. */
+  readonly runtime: Atom.AtomRuntime<ClientEngine, never>;
+  /**
+   * The Atom for a subset's live results. Stable per subset identity
+   * (`Subset.hash`): the same subset yields the same Atom, so mounting it
+   * from many components shares one subscription. A {@link Subset.TypedSubset}
+   * refines the Atom's rows to its row type.
+   */
+  readonly liveQuery: {
+    <A>(subset: TypedSubset<A>): Atom.Atom<TypedLiveQueryResult<A>>;
+    (subset: Subset): Atom.Atom<LiveQueryResult>;
+  };
+  /** The Atom for a named query's live results, stable per (name, args). */
+  readonly namedQuery: (name: string, args: unknown) => Atom.Atom<NamedQueryResult>;
+  /**
+   * The Atom for a subset's live aggregate value. Stable per
+   * `(subset hash, aggregate)`, so mounting it from many components shares one
+   * subscription. Re-emits only when the aggregate value changes.
+   */
+  readonly aggregate: (subset: Subset, agg: Aggregate) => Atom.Atom<AggregateResult>;
+  /** The Atom for a subset's live grouped aggregate, stable per `(subset hash, aggregate, groupBy)`. */
+  readonly aggregateGrouped: (subset: Subset, agg: Aggregate, groupBy: string) => Atom.Atom<GroupedAggregateResult>;
+  /** Write a {@link MutationArg} to run a mutator; its result is an `AsyncResult`. */
+  readonly mutation: Atom.AtomResultFn<MutationArg, void, MutatorError | StoreError>;
+  /**
+   * The Atom for the engine's whole keyed mutation-state map (#116) —
+   * `ClientEngine.mutationStates` re-emits on every fold; a single shared
+   * Atom, so mounting it from many components shares one subscription.
+   */
+  readonly mutationStates: Atom.Atom<MutationStatesResult>;
+  /**
+   * A derived selector over {@link mutationStates}, filtered to one mutator
+   * and sorted oldest-journaled first — "N unsent changes" or "list failed
+   * intents" for one mutator in one line. Stable per `mutator`.
+   */
+  readonly mutationsFor: (mutator: string) => Atom.Atom<MutationsForResult>;
+  /**
+   * Like {@link mutation}, but its result resolves with the mutation's
+   * authoritative outcome (applied or permanently rejected) once the backend
+   * settles it — the atom stays `Waiting` until then. Backs `useMutationWithAck`.
+   */
+  readonly mutationWithAck: Atom.AtomResultFn<MutationArg, MutationOutcome, MutatorError | StoreError>;
+}
+/**
+ * Build the engine's reactive surface from its layer. The layer must provide
+ * `ClientEngine` with all of its own dependencies already satisfied —
+ * `Atom.runtime` supplies only `AtomRegistry`/`Reactivity` and manages the
+ * engine's scope for the registry's lifetime.
+ */
+declare const fromLayer: (engineLayer: Layer.Layer<ClientEngine, never, AtomRegistry.AtomRegistry | Reactivity.Reactivity>) => EngineAtoms;
+declare namespace PromiseFacade_d_exports {
+  export { PromiseFacade, Subscription, make$2 as make };
+}
+/**
+ * A callback subscription handle.
+ */
+interface Subscription {
+  /** Stop receiving values and release the underlying fiber. */
+  readonly unsubscribe: () => void;
+}
+/**
+ * A promise/callback facade over an Effect runtime.
+ */
+interface PromiseFacade<R> {
+  /** The underlying managed runtime (for advanced use). */
+  readonly runtime: ManagedRuntime.ManagedRuntime<R, never>;
+  /** Run an effect, rejecting the promise on any failure. */
+  readonly run: <A, E>(effect: Effect.Effect<A, E, R>) => Promise<A>;
+  /** Run an effect, resolving with its `Exit` (never rejects on typed failures). */
+  readonly runExit: <A, E>(effect: Effect.Effect<A, E, R>) => Promise<Exit.Exit<A, E>>;
+  /** Consume a stream with callbacks. */
+  readonly subscribe: <A, E>(stream: Stream.Stream<A, E, R>, listener: {
+    readonly onValue: (value: A) => void;
+    readonly onError?: ((error: E) => void) | undefined;
+    readonly onDone?: (() => void) | undefined;
+  }) => Subscription;
+  /** Tear down the runtime and every running subscription. */
+  readonly dispose: () => Promise<void>;
+}
+/**
+ * Build a promise/callback facade from a layer providing `R`.
+ *
+ * ```ts
+ * const facade = makePromiseFacade(
+ *   SyncCache.layer.pipe(Layer.provideMerge(MemoryCacheStore.layer()))
+ * );
+ * const value = await facade.run(
+ *   Effect.flatMap(SyncCache.SyncCache.asEffect(), (cache) =>
+ *     cache.read({ key: ["users", "1"], loader: fetchUser("1") })
+ *   )
+ * );
+ * await facade.dispose();
+ * ```
+ */
+declare const make$2: <R, ER>(layer: Layer.Layer<R, ER, never>) => PromiseFacade<R>;
+declare namespace MirrorProtocol_d_exports {
+  export { EdgeSelect, FORM_MUTATION_MUTATOR, FormMutationBegin, FormRuling, HostMessage, HostMessageSchema, MUTATION_STATES_KEY, MirrorMessage, MirrorMessageSchema, MirrorRelatedRow, MirrorRow, MutationStateEntry, PulledRegistration, decodeHostMessage, decodeMirrorMessage, mirrorUpdate, mutationStatesUpdate, namedKey, relatedKey, relatedUpdate };
+}
+/** Wire codec for one selected edge of a `related` registration. */
+declare const EdgeSelect: Schema.Struct<{
+  readonly name: Schema.String;
+  readonly first: Schema.optional<Schema.Number>;
+}>;
+/** The type {@link EdgeSelect} decodes to. */
+type EdgeSelect = typeof EdgeSelect.Type;
+/** Wire codec for one {@link MutationState.MutationState} entry (#116). */
+declare const MutationStateEntry: Schema.Struct<{
+  readonly mutationId: Schema.Number;
+  readonly mutator: Schema.String;
+  readonly args: Schema.Unknown;
+  readonly phase: Schema.Literals<readonly ["pending", "acknowledged", "rejected", "dropped"]>;
+  readonly reason: Schema.optional<Schema.String>;
+  readonly journaledAt: Schema.Number;
+  readonly settledAt: Schema.optional<Schema.Number>;
+}>;
+/** The type {@link MutationStateEntry} decodes to. */
+type MutationStateEntry = typeof MutationStateEntry.Type;
+/** The broadcast key a named query's results are mirrored under. */
+declare const namedKey: (name: string, args: unknown) => string;
+/**
+ * The broadcast key {@link ClientEngine.ClientEngine.mutationStates} is
+ * mirrored under (#116) — a singleton, unparameterized registration (unlike
+ * subsets/named queries, there is exactly one mutation-state map per engine).
+ */
+declare const MUTATION_STATES_KEY = "mutationStates";
+/**
+ * The broadcast key a `related` registration's resolved rows are mirrored
+ * under. Each edge's window (`first`) is part of the key: reads differing
+ * only in window are distinct registrations (ADR-0024).
+ */
+declare const relatedKey: (collection: string, subset: Subset, edges: ReadonlyArray<string | EdgeSelect$1>) => string;
+/**
+ * The reserved mutator name an enhanced form submit's begin travels under
+ * (ADR-0030 #215 §4, #536). A mirror asks its host to begin a form mutation
+ * with a `Mutate` naming this mutator, its args a {@link FormMutationBegin}.
+ * A host that knows it answers `FormMutationBegun` or `FormMutationFailed`
+ * and journals nothing. It travels as a `Mutate`, not a tag of its own, so a
+ * host that predates it answers too: its engine has no such mutator, so it
+ * replies `MutateError` and journals nothing, and the mirror reports that
+ * the host is too old instead of waiting on a message the host dropped as
+ * foreign traffic. No app mutator may take this name.
+ */
+declare const FORM_MUTATION_MUTATOR = "@thomasfosterau/legation/beginFormMutation";
+/**
+ * The args of a {@link FORM_MUTATION_MUTATOR} `Mutate`: the mirror the entry
+ * belongs to (its `Disconnect`, or the liveness sweep, abandons it), the form
+ * client, and the Mutation with its args in encoded (wire) form, which the
+ * host decodes.
+ */
+declare const FormMutationBegin: Schema.Struct<{
+  readonly mirrorId: Schema.String;
+  readonly form: Schema.Struct<{
+    readonly clientId: Schema.String;
+    readonly mutationId: Schema.Number;
+  }>;
+  readonly mutator: Schema.String;
+  readonly args: Schema.Unknown;
+}>;
+/** The decoded {@link FormMutationBegin}. */
+type FormMutationBegin = typeof FormMutationBegin.Type;
+/** Wire codec for {@link ClientEngine.FormRuling}: the ruling an `EndFormMutation` settles on. */
+declare const FormRuling: Schema.Union<readonly [Schema.Struct<{
+  readonly phase: Schema.Literal<"acknowledged">;
+}>, Schema.Struct<{
+  readonly phase: Schema.Literal<"rejected">;
+  readonly reason: Schema.String;
+}>]>;
+/** The decoded {@link FormRuling}; the same shape as {@link ClientEngine.FormRuling}. */
+type FormRuling = typeof FormRuling.Type;
+/** A message a mirror sends to the host. */
+type MirrorMessage = {
+  readonly _tag: "Mutate";
+  readonly requestId: number;
+  /**
+   * The requesting mirror (#546). Its replies echo it, so a mirror ignores a
+   * reply to another tab's request of the same `requestId`. Absent from a
+   * mirror that predates it.
+   */
+  readonly mirrorId?: string;
+  readonly mutator: string;
+  readonly args: unknown;
+} | {
+  readonly _tag: "Subscribe";
+  readonly mirrorId: string;
+  readonly subset: Subset;
+} | {
+  readonly _tag: "Unsubscribe";
+  readonly mirrorId: string;
+  readonly subset: Subset;
+} | {
+  readonly _tag: "SubscribeNamed";
+  readonly mirrorId: string;
+  readonly name: string;
+  readonly args: unknown;
+} | {
+  readonly _tag: "UnsubscribeNamed";
+  readonly mirrorId: string;
+  readonly name: string;
+  readonly args: unknown;
+} | {
+  readonly _tag: "SubscribeRelated";
+  readonly mirrorId: string;
+  readonly collection: string;
+  readonly subset: Subset;
+  /** The selected edges, each optionally windowed (ADR-0024). */
+  readonly edges: ReadonlyArray<EdgeSelect$1>;
+} | {
+  readonly _tag: "UnsubscribeRelated";
+  readonly mirrorId: string;
+  readonly collection: string;
+  readonly subset: Subset;
+  readonly edges: ReadonlyArray<EdgeSelect$1>;
+} |
+/**
+ * A URL-keyed subscription (ADR-0029 section 2, #159) from a party with
+ * no `Client` of its own — a page posting on the channel. The host parses
+ * the URL through its `UrlReads`, and registers the read's root window
+ * and edge windows under `mirrorId` exactly as a mirror's `Subscribe` and
+ * `SubscribeRelated` would: refcounted per party, replayed on `HostReady`
+ * by the party, and reclaimed by the liveness sweep unless the party
+ * heartbeats. A URL the host cannot parse registers nothing.
+ */
+{
+  readonly _tag: "SubscribeUrl";
+  readonly mirrorId: string;
+  readonly url: string;
+} | {
+  readonly _tag: "UnsubscribeUrl";
+  readonly mirrorId: string;
+  readonly url: string;
+} |
+/** A server-fallthrough read (ADR-0025), answered by `ReadResult`. */
+{
+  readonly _tag: "Read";
+  readonly requestId: number;
+  /**
+   * The requesting mirror (#546). Its replies echo it, so a mirror ignores a
+   * reply to another tab's request of the same `requestId`. Absent from a
+   * mirror that predates it.
+   */
+  readonly mirrorId?: string;
+  readonly subsets: ReadonlyArray<Subset>;
+} |
+/** Register interest in the mutation-state map (#116); see {@link MUTATION_STATES_KEY}. */
+{
+  readonly _tag: "SubscribeMutationStates";
+  readonly mirrorId: string;
+} | {
+  readonly _tag: "UnsubscribeMutationStates";
+  readonly mirrorId: string;
+} |
+/** A mirror leaving: release every subscription it held. */
+{
+  readonly _tag: "Disconnect";
+  readonly mirrorId: string;
+} |
+/** Liveness ping: lets the host reclaim subsets from mirrors that crash. */
+{
+  readonly _tag: "Heartbeat";
+  readonly mirrorId: string;
+} |
+/**
+ * End an enhanced form submission begun with a {@link FORM_MUTATION_MUTATOR}
+ * `Mutate` (#536): `ruling` settles it on the form action's receipt, and its
+ * absence abandons it. `requestId` is the begin's. Answered by
+ * `FormMutationEnded`, also when the host no longer holds the entry.
+ */
+{
+  readonly _tag: "EndFormMutation";
+  readonly mirrorId: string;
+  readonly requestId: number;
+  readonly ruling?: FormRuling$1;
+};
+/** Wire codec for {@link MirrorMessage}. */
+declare const MirrorMessageSchema: Schema.Codec<MirrorMessage>;
+/** A row as the host sends it to a mirror. */
+interface MirrorRow {
+  readonly id: string;
+  readonly value: unknown;
+}
+/** A resolved relational row on the wire: base row + its resolved names. */
+interface MirrorRelatedRow {
+  readonly id: string;
+  readonly value: unknown;
+  readonly related: Readonly<Record<string, unknown>>;
+}
+/** A message the host sends to its mirrors. */
+type HostMessage =
+/**
+ * Broadcast once when a host starts serving. Mirrors answer by re-posting
+ * every registration they hold, so subscriptions survive a host that
+ * (re)starts after the mirror — a killed service worker, or a client context
+ * that raced the worker's boot.
+ */
+{
+  readonly _tag: "HostReady";
+} | {
+  readonly _tag: "MutateAck";
+  readonly requestId: number;
+  /**
+   * The mirror the request came from (#546), echoed from the request. A
+   * mirror ignores a reply addressed to another; a host that predates it
+   * sends none, and the reply is taken by `requestId` alone.
+   */
+  readonly mirrorId?: string;
+} | {
+  readonly _tag: "MutateError";
+  readonly requestId: number;
+  /**
+   * The mirror the request came from (#546), echoed from the request. A
+   * mirror ignores a reply addressed to another; a host that predates it
+   * sends none, and the reply is taken by `requestId` alone.
+   */
+  readonly mirrorId?: string;
+  readonly message: string;
+} |
+/**
+ * The backend's authoritative outcome for a forwarded mutation, correlated by
+ * `requestId`. Sent in addition to `MutateAck` (which still fires on journal),
+ * so a mirror can await the backend verdict via `Mirror.mutateWithAck`.
+ */
+{
+  readonly _tag: "MutateSettled";
+  readonly requestId: number;
+  /**
+   * The mirror the request came from (#546), echoed from the request. A
+   * mirror ignores a reply addressed to another; a host that predates it
+   * sends none, and the reply is taken by `requestId` alone.
+   */
+  readonly mirrorId?: string;
+  readonly outcome: "applied" | "rejected";
+  readonly reason?: string;
+} | {
+  readonly _tag: "MirrorUpdate";
+  /** `Subset.hash` of the subset (or {@link namedKey}) these rows materialize. */
+  readonly key: string;
+  readonly rows: ReadonlyArray<MirrorRow>;
+} | {
+  readonly _tag: "RelatedUpdate";
+  /** {@link relatedKey} of the registration these resolved rows materialize. */
+  readonly key: string;
+  readonly rows: ReadonlyArray<MirrorRelatedRow>;
+} |
+/** The answer to a `Read` request (ADR-0025), correlated by `requestId`. */
+{
+  readonly _tag: "ReadResult";
+  readonly requestId: number;
+  /**
+   * The mirror the request came from (#546), echoed from the request. A
+   * mirror ignores a reply addressed to another; a host that predates it
+   * sends none, and the reply is taken by `requestId` alone.
+   */
+  readonly mirrorId?: string;
+  readonly rows: ReadonlyArray<{
+    readonly collection: string;
+    readonly id: string;
+    readonly value: unknown;
+  }>;
+  /** Set instead of rows when the host could not serve the read. */
+  readonly error?: string;
+} |
+/** The whole mutation-state map, broadcast on every fold (#116). */
+{
+  readonly _tag: "MutationStatesUpdate";
+  readonly states: ReadonlyArray<MutationState>;
+} |
+/**
+ * The pulled summaries of the host's registrations (#426): per key (a
+ * `Subscribe`'s subset hash, or a `SubscribeRelated`'s {@link relatedKey}),
+ * each window the registration holds with whether its rows are in the
+ * replica. A mirror answers a covered read locally only when the windows
+ * the read's rows link to are pulled (`Coverage.pulledFor`). Sent whenever it
+ * changes and on `HostReady`. A mirror that predates it ignores the message
+ * (foreign traffic) and judges coverage from its registrations alone, as it
+ * did before #426: it answers covered reads locally, so the #422 race (a
+ * covered answer before its linked windows are pulled) persists for it until
+ * it is upgraded.
+ */
+{
+  readonly _tag: "PulledRegistrations";
+  readonly registrations: ReadonlyArray<PulledRegistration>;
+} |
+/**
+ * A {@link FORM_MUTATION_MUTATOR} begin overlaid under its form client
+ * (#536). The form replies carry the begin's `mirrorId` as well as its
+ * `requestId`: host messages are broadcast to every mirror, and each
+ * mirror numbers its requests from zero, so a `requestId` alone could
+ * complete another tab's request.
+ */
+{
+  readonly _tag: "FormMutationBegun";
+  readonly mirrorId: string;
+  readonly requestId: number;
+} |
+/**
+ * A {@link FORM_MUTATION_MUTATOR} begin the host refused (unknown Mutation,
+ * args that do not decode, a store failure): nothing was overlaid. A
+ * dedicated tag, so that `MutateError` for a begin means only "this host
+ * predates enhanced form submits".
+ */
+{
+  readonly _tag: "FormMutationFailed";
+  readonly mirrorId: string;
+  readonly requestId: number;
+  readonly message: string;
+} |
+/**
+ * The answer to `EndFormMutation`, correlated by the begin's `requestId`.
+ * `error` is set when settling failed in the host's store (the entry could
+ * not be parked in the unpulled tail); the host rebuilt its overlay and
+ * pulled regardless.
+ */
+{
+  readonly _tag: "FormMutationEnded";
+  readonly mirrorId: string;
+  readonly requestId: number;
+  readonly error?: string;
+};
+/** One registration's pulled summary, keyed as the host keys it. */
+interface PulledRegistration {
+  readonly key: string;
+  readonly pulled: Pulled;
+}
+/** Wire codec for {@link HostMessage}. */
+declare const HostMessageSchema: Schema.Codec<HostMessage>;
+/** Build a MirrorUpdate from materialized engine rows. */
+declare const mirrorUpdate: (key: string, rows: ReadonlyArray<LocalRow>) => HostMessage;
+/** Build a RelatedUpdate from resolved relational rows. */
+declare const relatedUpdate: (key: string, rows: ReadonlyArray<RelatedRow>) => HostMessage;
+/** Build a MutationStatesUpdate from the engine's current mutation-state map (#116). */
+declare const mutationStatesUpdate: (states: MutationStateMap) => HostMessage;
+/** Decode an inbound mirror message; `undefined` for foreign traffic. */
+declare const decodeMirrorMessage: (input: unknown) => Effect.Effect<MirrorMessage | undefined>;
+/** Decode an inbound host message; `undefined` for foreign traffic. */
+declare const decodeHostMessage: (input: unknown) => Effect.Effect<HostMessage | undefined>;
+declare namespace EngineHost_d_exports {
+  export { EngineHostOptions, Host, run$2 as run };
+}
+/** Options for {@link run}: the channel mirrors connect over and the engine they share. */
+interface EngineHostOptions {
+  readonly channel: MirrorChannel;
+  readonly engine: ClientEngine;
+  /**
+   * The collection registry `related` registrations resolve against.
+   * Defaults to `nodes.collections` when `nodes` is given; without either,
+   * `SubscribeRelated` messages are answered with empty results and a
+   * logged warning — pass one whenever mirrors use relational reads.
+   */
+  readonly registry?: CollectionRegistry;
+  /**
+   * The node graph and URL-keyed reads `SubscribeUrl` registrations are
+   * parsed and planned against (#159). Without both, a `SubscribeUrl` is
+   * answered with a logged warning and registers nothing.
+   */
+  readonly nodes?: NodeRegistry;
+  readonly urls?: UrlReads;
+  /**
+   * Liveness sweep: reclaim registrations from mirrors not heard from within
+   * `mirrorTimeout`, checked every `sweepInterval`. Defaults: 30s timeout,
+   * 10s sweep — pair with a Mirror heartbeat shorter than the timeout.
+   */
+  readonly liveness?: {
+    readonly mirrorTimeout?: Duration.Input;
+    readonly sweepInterval?: Duration.Input;
+  };
+}
+/** The running host: what a worker can consult about the mirrors it serves. */
+interface Host {
+  /**
+   * The registrations the host holds on mirrors' behalf at this moment, each
+   * with its pulled summary (#426): root windows (`Subscribe`), relational
+   * registrations with their edge selects (`SubscribeRelated`) and both
+   * halves of a `SubscribeUrl`, the latter carrying its canonical URL for as
+   * long as some party holds it by that URL. A registration's windows are
+   * pulled once a pull started after each was made has applied; a coverage
+   * check counts only the windows a read depends on. Named-query and
+   * mutation-state registrations cover no read and are not listed. The ledger
+   * a coverage check scans: `Coverage.coverageOf(nodes, view.query, host.registrations)`.
+   */
+  readonly registrations: Effect.Effect<ReadonlyArray<Entry>>;
+}
+/**
+ * Serve the engine over the channel. The inbound subscription is
+ * established before this effect completes; message handling runs on a
+ * scoped background fiber.
+ */
+declare const run$2: (options: EngineHostOptions) => Effect.Effect<Host, never, Scope.Scope>;
+declare namespace Mirror_d_exports {
+  export { Mirror, MirrorOptions, make$1 as make };
+}
+/** Options for {@link make}: the channel to the host and the shared mutator registry. */
+interface MirrorOptions {
+  readonly channel: MirrorChannel;
+  /** The shared mutator registry (same definitions the host engine runs). */
+  readonly mutators: MutatorRegistry;
+  /**
+   * How often to send a liveness heartbeat to the host. Keep it shorter
+   * than the host's `mirrorTimeout` so a live mirror is never reclaimed. Defaults
+   * to 10 seconds.
+   */
+  readonly heartbeatInterval?: Duration.Input;
+  /**
+   * Capacity of the bounded change hub (#44). A stalled observer cannot
+   * make the hub grow without limit: at capacity the hub drops the newest
+   * subset keys, and the observer collapses the resulting seq gap into a full
+   * re-read of its subset — lossless because the newest rows live in the
+   * mirror's `Ref`. Defaults to {@link DEFAULT_CHANGE_HUB_CAPACITY}.
+   */
+  readonly changeHubCapacity?: number;
+}
+/**
+ * A client context's in-memory copy of a host engine's subscribed subsets: queries are answered
+ * synchronously from it, and writes are forwarded to the host's journal.
+ */
+interface Mirror {
+  /** Validate args locally, forward to the host journal, await the ack. */
+  readonly mutate: (mutator: string, args: unknown) => Effect.Effect<void, MutatorError | TransportError>;
+  /**
+   * Like {@link mutate}, but resolves with the mutation's authoritative backend
+   * outcome (applied or permanently rejected) once the host forwards it, rather
+   * than on the host journal ack.
+   */
+  readonly mutateWithAck: (mutator: string, args: unknown) => Effect.Effect<MutationOutcome, MutatorError | TransportError>;
+  /**
+   * The client half of an enhanced form submit (ADR-0030 #215 §4), carried to
+   * the host (#536): the host's engine overlays the Mutation under the form
+   * client's id without journaling it, and holds the in-flight entry, so its
+   * overlay and unpulled tail serve every mirror. Settling or abandoning the
+   * returned submission tells the host; as on an engine, an acknowledgement
+   * parks the effect until the pull that covers the form client releases it.
+   * Fails with a `TransportError` when the host predates this, and with a
+   * `MutatorError` when the args do not fit the Mutation or the host refuses
+   * the begin. The signature is `ClientView`'s. A submission whose host is gone (restarted, or this mirror's
+   * scope closed) settles as a no-op: its entry went with the host.
+   */
+  readonly beginFormMutation: NonNullable<ClientView["beginFormMutation"]>;
+  /** Register a subset with the host; rows arrive as mirror updates. */
+  readonly subscribe: (subset: Subset) => Effect.Effect<void, TransportError>;
+  readonly unsubscribe: (subset: Subset) => Effect.Effect<void, TransportError>;
+  /**
+   * Register a named query with the host (which owns the server-authoritative
+   * resolution); results arrive as mirror updates under the named key.
+   */
+  readonly subscribeQuery: (name: string, args: unknown) => Effect.Effect<void, TransportError>;
+  readonly unsubscribeQuery: (name: string, args: unknown) => Effect.Effect<void, TransportError>;
+  /** The mirror's current rows for a subset (empty until hydrated). */
+  readonly query: (subset: Subset) => Effect.Effect<ReadonlyArray<LocalRow>>;
+  /**
+   * Server-fallthrough read (ADR-0025), forwarded to the host — which owns
+   * the transport — and answered point-in-time, never entering the mirror.
+   */
+  readonly read: (subsets: ReadonlyArray<Subset>) => Effect.Effect<ReadonlyArray<ReadRow>, MutatorError | TransportError>;
+  /** The mirror's current rows for a named query (empty until hydrated). */
+  readonly queryNamed: (name: string, args: unknown) => Effect.Effect<ReadonlyArray<LocalRow>>;
+  /** Emits the current rows now and on every mirror update for the subset. */
+  readonly observe: (subset: Subset) => Stream.Stream<ReadonlyArray<LocalRow>>;
+  /** The host's pulled summary of the registration under `key` (#426); see {@link ClientView.ClientView.pulled}. */
+  readonly pulled: (key: string) => Effect.Effect<Pulled>;
+  /**
+   * Row-level deltas of a subset's live window (#115) — see
+   * {@link ClientEngine.ClientEngine.observeChanges}. The mirror has no
+   * incremental `LiveView` of its own: it diffs consecutive whole-page
+   * `MirrorUpdate`s (`RowChange.diff`), which is exact because the host
+   * already delivers the full current page on every change. A gap on the
+   * mirror's change hub (a dropped key — CONTEXT.md's hub table) re-reads
+   * the always-current `rows` Ref, same as `observe`, and is folded into a
+   * `reset` batch here rather than a diff, since the skipped updates in
+   * between are unknown.
+   */
+  readonly observeChanges: (subset: Subset, options?: {
+    readonly includeInitial?: boolean;
+  }) => Stream.Stream<ReadonlyArray<RowChange<LocalRow>>>;
+  /**
+   * The host engine's keyed mutation-state map (#116), mirrored so every tab
+   * sees the same states the host holds. Registers interest with the host for
+   * the stream's lifetime (refcounted like `observe`); emits the current map
+   * now and on every host-side fold.
+   */
+  readonly mutationStates: Stream.Stream<MutationStateMap>;
+  /** Emits the named query's current rows now and on every mirror update. */
+  readonly observeNamed: (name: string, args: unknown) => Stream.Stream<ReadonlyArray<LocalRow>>;
+  /**
+   * Auto-subscribing relational read: the HOST syncs the base and narrowed
+   * foreign subsets and computes the join — the mirror receives resolved rows
+   * (main-thread work stays minimal). The registration is released when the
+   * scope closes. The `registry` parameter exists for {@link ClientView}
+   * signature parity; the host resolves against its own registry.
+   */
+  readonly related: (registry: CollectionRegistry, collectionName: string, subset: Subset, edges: ReadonlyArray<string | EdgeSelect$1>) => Effect.Effect<Stream.Stream<ReadonlyArray<RelatedRow>, never>, never, Scope.Scope>;
+  /**
+   * Hold a relational registration with the host for the scope's lifetime
+   * without reading its resolved rows — an explicit pin's edge windows
+   * (ADR-0029 section 2). The host runs the same reconcile loop it runs for
+   * {@link related}; the signature is `ClientView`'s (the `registry`
+   * parameter exists for that parity alone).
+   */
+  readonly pinEdges: ClientView["pinEdges"];
+}
+/**
+ * Connect a {@link Mirror} to the host on `options.channel`; its subscriptions are released when
+ * the scope closes.
+ */
+declare const make$1: (options: MirrorOptions) => Effect.Effect<Mirror, never, Scope.Scope>;
+declare namespace BackendContract_d_exports {
+  export { ContractViolation, PeerSettle, VerifyOptions, countUp, delRow, failAlways, memoryHandlers, park, putRow, rejectAlways, verifyBackendContract, writeThenFail };
+}
+declare const ContractViolation_base: Schema.Class<ContractViolation, Schema.TaggedStruct<"ContractViolation", {
+  readonly rule: Schema.String;
+  readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError & {
+  readonly brand: unique symbol;
+}>;
+/** A backend broke one of the contract's guarantees. */
+declare class ContractViolation extends ContractViolation_base {}
+/**
+ * The park a `contract/count-up` handler takes between its read and its write.
+ * When the harness has registered `gate`, it signals that the handler is parked
+ * and waits until the harness releases it; for any other name it does nothing.
+ * Only the contract's `countUp` handler calls it, so no production handler should.
+ */
+declare const park: (gate: string) => Effect.Effect<void>;
+/** Write one row. */
+declare const putRow: Mutator<"contract/put", {
+  readonly collection: string;
+  readonly id: string;
+  readonly value: unknown;
+}, {
+  readonly collection: string;
+  readonly id: string;
+  readonly value: unknown;
+}>;
+/** Delete one row. */
+declare const delRow: Mutator<"contract/del", {
+  readonly collection: string;
+  readonly id: string;
+}, {
+  readonly collection: string;
+  readonly id: string;
+}>;
+/**
+ * Fails transiently — probes that a `BackendError` aborts the batch and the
+ * mutation-id bump is atomic with effects (no bump on abort).
+ */
+declare const failAlways: Mutator<"contract/fail", {}, {}>;
+/**
+ * Writes a row and then rejects permanently — probes that a `MutationRejected`
+ * bumps the id *without* leaving effects (the staged write must roll back).
+ */
+declare const rejectAlways: Mutator<"contract/reject", {
+  readonly collection: string;
+  readonly id: string;
+}, {
+  readonly collection: string;
+  readonly id: string;
+}>;
+/**
+ * Writes a row and then fails transiently — probes that a `BackendError` leaves
+ * no trace of that write (the row keeps its value and version) and no bump
+ * (the client's retry applies the mutation again). `failAlways` writes nothing
+ * first, so it does not probe this. A backend that cannot discard a handler's
+ * writes on its own failure fails this rule by design: D1 commits each
+ * statement separately (#342), so it is not run through this contract. A
+ * registered handler that never writes passes this rule vacuously, and the
+ * contract cannot detect that: it sees only the failure.
+ */
+declare const writeThenFail: Mutator<"contract/write-then-fail", {
+  readonly collection: string;
+  readonly id: string;
+}, {
+  readonly collection: string;
+  readonly id: string;
+}>;
+/**
+ * Reads a counter row, parks after the read (see {@link park}), then writes the
+ * counter plus one. Two client groups running it on one row must both count
+ * (rule 11). `gate` names a park gate the harness registered, or matches none.
+ *
+ * A third-party backend registers its handler for this mutator under
+ * `BackendContract.countUp.name` (`contract/count-up`), passes `gate` unchanged
+ * to `park` between its read and its write, and writes the counter plus one. A
+ * handler that omits `park` fails rule 11 with "finished without reaching park()".
+ */
+declare const countUp: Mutator<"contract/count-up", {
+  readonly collection: string;
+  readonly id: string;
+  readonly gate: string;
+}, {
+  readonly collection: string;
+  readonly id: string;
+  readonly gate: string;
+}>;
+/** Ready-made authoritative handlers for MemoryBackend-style registration. */
+declare const memoryHandlers: Record<string, BackendHandler>;
+/**
+ * Waits, while rule 11 holds a parked call, for the peer call the harness started. `peerSettled`
+ * reads true once the peer's call has finished. The returned effect must complete once the peer has
+ * settled, or once the backend observes the peer blocked on a lock the parked call holds (the peer
+ * can then finish only after the parked call is released). It decides on that observed state, never
+ * on elapsed time.
+ */
+type PeerSettle = (peerSettled: Effect.Effect<boolean>) => Effect.Effect<void>;
+/** Options for {@link verifyBackendContract}. */
+interface VerifyOptions {
+  /** Base name for the collections written during verification. */
+  readonly collection?: string;
+  readonly clientGroupId?: string;
+  /**
+   * How rule 11 waits for the peer while the parked call is held. Absent, the
+   * harness gives the peer a bounded number of scheduler turns, which suits a backend
+   * whose peer runs at once or waits on a lock. A backend whose peer does real I/O
+   * (PostgreSQL) cannot reach the overlap that way, so it observes the peer instead
+   * (#416).
+   */
+  readonly awaitPeer?: PeerSettle | undefined;
+  /**
+   * The contract client's ledger a restarted run expects: the id the backend reported for it before the
+   * restart. Absent, the run is a fresh group and expects 0. The contract fails first when the backend
+   * reports another id, naming a forgotten or differing ledger, then numbers its mutations from it (#483).
+   */
+  readonly restoredLedger?: number | undefined;
+  /**
+   * The ledger rule 11's peer group expects on a restarted run, as `restoredLedger` is for the
+   * contract client. Absent, the peer group is fresh and expects 0 (#483).
+   */
+  readonly restoredPeerLedger?: number | undefined;
+}
+/**
+ * Verify a backend against the contract. The backend must have the contract
+ * mutators registered and the contract collections empty. On a fresh client group
+ * the contract expects the backend to report a ledger of 0 for its client. A run
+ * over a restarted backend passes the ledger it expects as `restoredLedger`: the
+ * contract first checks the backend reports exactly that, failing a backend that
+ * forgot its ledger, and then numbers its mutations from it (#483).
+ */
+declare const verifyBackendContract: (backend: Backend, options?: VerifyOptions) => Effect.Effect<void, ContractViolation>;
+declare namespace RejectionMemory_d_exports {
+  export { floorsOf, forgetBelow };
+}
+/**
+ * The forgetting bound for a backend's rejection memory (#355, #366, #468): the
+ * per-client rule that drops a remembered rejection once the client's next push
+ * has moved past it. MemoryBackend and JsonApiBackend bound their memory with
+ * `forgetBelow`; SqlBackend shares only `floorsOf` and keeps its own forgetting
+ * loop over its ledger rows.
+ */
+/**
+ * The lowest mutation id a push carries, per client: the push's floors (#355).
+ * A client resends only ids it has not had acknowledged, so a push whose lowest
+ * id for a client is `f` proves the client has seen the outcome of every id below `f`.
+ */
+declare const floorsOf: (mutations: ReadonlyArray<{
+  readonly clientId: string;
+  readonly mutationId: number;
+}>) => Map<string, number>;
+/**
+ * Forget the rejections a client's push has moved past (#355): drop each client's
+ * remembered rejections whose mutation id is below its floor, and keep the rest.
+ * `clients` maps each client in one client group to its remembered rejections
+ * (mutation id → reason); `floors` maps each client in a push to the lowest
+ * mutation id that push carries (see {@link floorsOf}). A client with no
+ * rejections left is removed from the result, and a pull never forgets, so only
+ * a push calls this. Returns `clients` itself when nothing is forgotten, so a
+ * caller can detect the no-op by reference.
+ */
+declare const forgetBelow: (clients: ReadonlyMap<string, ReadonlyMap<number, string>>, floors: ReadonlyMap<string, number>) => ReadonlyMap<string, ReadonlyMap<number, string>>;
+declare namespace FilterCorpus_d_exports {
+  export { Case, Column, Corpus, CorpusOptions, CorpusRow, Coverage, DEFAULT_SEED, Disagreement, GenerateOptions, OperatorName, corpusColumns, emptyCoverage, formatDisagreement, generateCorpus, generateOrderBy, generatePredicate, generateRows, leafOperators, minimise, minimumRows, resolveSeed, shrinkPredicate };
+}
+/** The default corpus seed; `LEGATION_CORPUS_SEED` overrides it. */
+declare const DEFAULT_SEED = 20260902;
+/**
+ * Resolve the corpus seed from an optional environment override (the value
+ * of `LEGATION_CORPUS_SEED`). Callers pass the variable in so this module
+ * stays free of `process` (it ships in the engine core, which also runs in
+ * browsers).
+ */
+declare const resolveSeed: (override: string | undefined) => number;
+/** One column of the fixture schema: a row field with a declared literal kind (`Predicate.LiteralKind`). */
+interface Column {
+  readonly name: string;
+  readonly kind: LiteralKind;
+}
+/**
+ * The harness's fixture table `corpus`: every non-id column is nullable.
+ * Postgres declares `COLLATE "C"` on `id` and `s` and stores `t` as
+ * `timestamptz`; SQLite uses `BINARY` text throughout.
+ */
+declare const corpusColumns: ReadonlyArray<Column>;
+/** Generator knobs shared by rows and predicates. */
+interface CorpusOptions {
+  /**
+   * Generate NULL and absent (JS-only: the key is missing) field values.
+   * Default `true`. `false` keeps every field present and non-null (the
+   * regression floor every evaluator agreed on before ADR-0028's rules
+   * (a)/(b) were implemented) and also drops the `isnull` operator, which is
+   * a constant predicate over such rows: a corpus only covers `isnull` with
+   * `nulls` on.
+   */
+  readonly nulls?: boolean;
+  /**
+   * Generate astral (non-BMP) text and text mixing BMP and astral
+   * characters. Default `true`. This is where UTF-16 code-unit order (JS)
+   * diverges from code-point order (Postgres `COLLATE "C"`, SQLite
+   * `BINARY`) — ADR-0028 rule (c).
+   */
+  readonly astral?: boolean;
+  /**
+   * Apply the ordered operators (`gt gte lt lte`) to the boolean column too.
+   * Default `true`. Postgres orders booleans `false < true` (ADR-0028
+   * section 3), and so does `Predicate.compareLiterals`; `false` is the
+   * regression floor from before that rule was implemented.
+   */
+  readonly booleanOrder?: boolean;
+}
+/**
+ * A generated row in its JS object form: an absent field is a missing key,
+ * distinct from an explicit `null`. The SQL legs insert both as SQL NULL
+ * (ADR-0028 rule (b)).
+ */
+interface CorpusRow {
+  readonly id: string;
+  readonly value: Readonly<Record<string, Literal>>;
+}
+/**
+ * The fewest rows {@link generateRows} accepts for `columns` under
+ * `options`: the pinned NULL/absent rows plus the sweep that puts every pool
+ * value into every column. Fewer would silently drop guaranteed edge values.
+ */
+declare const minimumRows: (columns?: ReadonlyArray<Column>, options?: CorpusOptions) => number;
+/**
+ * Generate `count` rows over `columns`. Coverage of the edge values is
+ * guaranteed, not left to chance: with `nulls` on, row 0 is all-NULL and row
+ * 1 all-absent; then one row per pool position sweeps every pool value into
+ * every column (int4 bounds, `-0`, `2^53±1`, the empty string, U+FFFF, the
+ * astral characters, …); the remaining rows are random with NULL/absent
+ * rolls. `count` below {@link minimumRows} is an error rather than a
+ * truncated sweep. Ids are zero-padded ASCII (`r000`, `r001`, …) so their
+ * order is the same in JS, SQLite `BINARY`, and Postgres `COLLATE "C"`,
+ * keeping the id tie-break comparable across legs.
+ */
+declare const generateRows: (count: number, columns?: ReadonlyArray<Column>, options?: CorpusOptions) => Effect.Effect<ReadonlyArray<CorpusRow>>;
+/** Every operator name the generator can emit; coverage is counted by these. */
+type OperatorName = "eq" | "ne" | "gt" | "gte" | "lt" | "lte" | "in" | "nin" | "isnull" | "and" | "or" | "not" | "true";
+/** Per-operator emission counts for one generated corpus. */
+type Coverage = Record<OperatorName, number>;
+/** A fresh all-zero coverage table. */
+declare const emptyCoverage: () => Coverage;
+interface LeafOperator {
+  readonly name: OperatorName;
+  /** An ordered comparison: applied to a boolean column only with `booleanOrder`. */
+  readonly ordered: boolean;
+  /** Build the leaf from a literal draw and a list draw; each runs only if used. */
+  readonly build: (field: string, literal: Effect.Effect<Literal>, list: Effect.Effect<ReadonlyArray<Literal>>) => Effect.Effect<Predicate>;
+}
+/** The leaf operator table: one constructor per core operator. */
+declare const leafOperators: ReadonlyArray<LeafOperator>;
+/**
+ * Generate one depth-bounded predicate tree: leaves from the operator table
+ * on a random column with a literal of that column's kind; `And`/`Or` with
+ * 2–3 children and `Not` with one, down to `depth`. Emitted operators are
+ * tallied into `coverage`.
+ */
+declare const generatePredicate: (columns: ReadonlyArray<Column>, options: CorpusOptions | undefined, coverage: Coverage, depth?: number) => Effect.Effect<Predicate>;
+/** Generate 1–2 `orderBy` terms over distinct columns with random directions. */
+declare const generateOrderBy: (columns?: ReadonlyArray<Column>) => Effect.Effect<ReadonlyArray<OrderBy>>;
+/** Options for {@link generateCorpus}. */
+interface GenerateOptions extends CorpusOptions {
+  readonly seed: number;
+  readonly columns?: ReadonlyArray<Column>;
+  /** Rows in the fixture set (default 64: the pinned sweep plus random rows). */
+  readonly rows?: number;
+  /** Predicates to generate (default 200). */
+  readonly predicates?: number;
+  /** `orderBy` term lists to generate (default 60). */
+  readonly orderBys?: number;
+  /** Predicate tree depth bound (default 2). */
+  readonly depth?: number;
+}
+/** A generated corpus: one row set, many predicates and order terms, and coverage. */
+interface Corpus {
+  readonly seed: number;
+  readonly columns: ReadonlyArray<Column>;
+  readonly rows: ReadonlyArray<CorpusRow>;
+  readonly predicates: ReadonlyArray<Predicate>;
+  readonly orderBys: ReadonlyArray<ReadonlyArray<OrderBy>>;
+  readonly coverage: Coverage;
+}
+/**
+ * Generate a whole corpus deterministically from a seed. The generators run
+ * under `Random.withSeed(options.seed)`; the seeding is suspended so every
+ * run of the returned effect starts the sequence afresh and yields the same
+ * corpus.
+ */
+declare const generateCorpus: (options: GenerateOptions) => Effect.Effect<Corpus>;
+/** A predicate over a row set — the unit the harness compares and shrinks. */
+interface Case {
+  readonly predicate: Predicate;
+  readonly rows: ReadonlyArray<CorpusRow>;
+}
+/**
+ * One-step shrinks of a predicate, larger jumps first: replace a junction by
+ * one child, drop one child, unwrap `Not`, drop one `In` value, then the
+ * same recursively inside each child.
+ */
+declare const shrinkPredicate: (predicate: Predicate) => ReadonlyArray<Predicate>;
+/**
+ * Greedily shrink a disagreeing case while `disagrees` keeps holding:
+ * predicate shrinks first, then row removals, restarting from the smallest
+ * accepted candidate until no candidate still disagrees. `disagrees` runs the
+ * subjects, so it is an Effect (the SQL legs are asynchronous).
+ */
+declare const minimise: <E, R>(failing: Case, disagrees: (candidate: Case) => Effect.Effect<boolean, E, R>) => Effect.Effect<Case, E, R>;
+/** A disagreement between subjects, ready to print. */
+interface Disagreement {
+  readonly seed: number;
+  readonly subject: string;
+  readonly predicate?: Predicate;
+  readonly orderBy?: ReadonlyArray<OrderBy>;
+  /** The (minimal) rows; any `(id, value)` row prints, not only corpus rows. */
+  readonly rows: ReadonlyArray<Row$3>;
+  /** Per-subject result (ids), keyed by subject name. */
+  readonly results: Readonly<Record<string, ReadonlyArray<string>>>;
+  /**
+   * How to reproduce at this seed. Defaults to the harness's environment
+   * override; a caller with a fixed seed (`BackendContract`) says so instead.
+   */
+  readonly reproduce?: string;
+}
+/**
+ * Render a disagreement: the seed, the (minimal) predicate or order terms,
+ * the (minimal) rows — absent keys stay absent, `null` prints as `null`,
+ * `-0` prints as `"-0"` — and every subject's ids.
+ */
+declare const formatDisagreement: (disagreement: Disagreement) => string;
+declare namespace HttpCache_d_exports {
+  export { CachedResponseMeta, EvictionTagOptions, HttpCachePolicy, ResponseCacheStore, Touched, evictionTags, fineTagFor, tagFor };
+}
+/** Cache metadata kept alongside a stored Response. */
+interface CachedResponseMeta {
+  readonly url: string;
+  readonly storedAt: number;
+  readonly staleAt: number;
+  readonly expiresAt: number | undefined;
+  readonly tags: ReadonlyArray<string>;
+}
+/** A pluggable store of Request/Response pairs (Cache API in browsers). */
+interface ResponseCacheStore {
+  readonly match: (request: Request) => Effect.Effect<{
+    readonly response: Response;
+    readonly meta: CachedResponseMeta;
+  } | undefined, StoreError>;
+  readonly put: (request: Request, response: Response, meta: CachedResponseMeta) => Effect.Effect<void, StoreError>;
+  readonly delete: (request: Request) => Effect.Effect<void, StoreError>;
+  /** Remove every entry carrying any of the tags. */
+  readonly invalidateTags: (tags: ReadonlyArray<string>) => Effect.Effect<void, StoreError>;
+}
+/**
+ * The {@link ResponseCacheStore} service tag, for apps that provide a store by layer;
+ * the fetch handlers take it as an option.
+ */
+declare const ResponseCacheStore: Context.Service<ResponseCacheStore, ResponseCacheStore>;
+/** Per-route caching policy. */
+interface HttpCachePolicy {
+  readonly staleTime: Duration.Input;
+  readonly timeToLive?: Duration.Input | undefined;
+  readonly tags?: ReadonlyArray<string> | undefined;
+}
+/** The coarse tag of a collection: `collection:{name}`. Every response enumerating (part of) it carries it. */
+declare const tagFor: (collection: string) => string;
+/** The fine tag of one row: `collection:{name}:{id}`. A response carries one per row it contains. */
+declare const fineTagFor: (collection: string, id: string) => string;
+/** The collections and individual rows a change touched. */
+interface Touched {
+  readonly collections: ReadonlyArray<string>;
+  readonly rows: ReadonlyArray<{
+    readonly collection: string;
+    readonly id: string;
+  }>;
+}
+/** Options for {@link evictionTags}: the tag spelling, defaulting to {@link tagFor} and {@link fineTagFor}. */
+interface EvictionTagOptions {
+  readonly tagFor?: (collection: string) => string;
+  readonly fineTagFor?: (collection: string, id: string) => string;
+}
+/**
+ * The tags to evict for a change, each once: the coarse tag of every touched
+ * collection **and** the fine tag of every touched row. The coarse eviction is
+ * not redundant with the fine one: a cached aggregate (a list, a feed, a
+ * sitemap) can be staled by a row it does not yet contain, such as a newly
+ * published one, and only the coarse tag reaches it.
+ */
+declare const evictionTags: (touched: Touched, options?: EvictionTagOptions) => ReadonlyArray<string>;
+declare namespace InvalidationSink_d_exports {
+  export { InvalidationSink, all, run$1 as run, touchedBy };
+}
+/**
+ * A server-side cache that evicts what a change touched (#206). `invalidate`
+ * never fails: an implementation logs its own failures, since a lost eviction
+ * only leaves an entry until its TTL.
+ */
+interface InvalidationSink {
+  readonly invalidate: (touched: Touched) => Effect.Effect<void>;
+}
+/** What a hint batch touched: its collections, and every row id it names (puts and deletes). */
+declare const touchedBy: (hints: ReadonlyArray<ChangeHint>) => Touched;
+/**
+ * One sink over several, run concurrently: a KV cache and the edge cache
+ * evicted from the same hint. A defect in one is logged and does not stop the
+ * others.
+ */
+declare const all: (sinks: ReadonlyArray<InvalidationSink>) => InvalidationSink;
+/**
+ * Subscribe `sink` to the bus for the scope's lifetime: each hint batch's
+ * touched collections and rows are passed to it, on a fibre of its own. Run it
+ * where the bus is, in the process that commits the writes. A sink that has to
+ * reach a cache in another process forwards there (Cloudflare:
+ * `EdgeInvalidation.forward` over a service binding).
+ */
+declare const run$1: (sink: InvalidationSink) => Effect.Effect<void, never, InvalidationBus | Scope.Scope>;
+declare namespace PushPoke_d_exports {
+  export { Budget, SinkOptions, isPoke, payload, sink };
+}
+/**
+ * The payload of every push-poke: a fixed marker, so the worker can tell the
+ * library's push from the app's own, and nothing about what changed.
+ */
+declare const payload = "{\"legation\":\"poke\"}";
+/** Whether a push's text is the library's poke ({@link payload}). */
+declare const isPoke: (text: string) => boolean;
+/** How many push-pokes a target may receive per period. */
+interface Budget {
+  readonly pushes: number;
+  readonly per: Duration.Input;
+}
+/** Options for {@link sink}. `Target` is the app's own push subscription record. */
+interface SinkOptions<Target> {
+  /**
+   * The push subscriptions a change should wake: the app's endpoint registry,
+   * scoped as the app scopes its users' data (a write to a user's rows wakes
+   * that user's devices). Failing reads as no targets, logged.
+   */
+  readonly targetsFor: (touched: Touched) => Effect.Effect<ReadonlyArray<Target>, unknown>;
+  /** A stable key per target, for coalescing and the budget: its endpoint URL, say. */
+  readonly keyOf: (target: Target) => string;
+  /**
+   * Send `payload` to `target` through its push service, signed with the
+   * app's VAPID keys. A failure is logged, never retried here: the next change
+   * pokes again, and pull converges regardless.
+   */
+  readonly send: (target: Target, payload: string) => Effect.Effect<void, unknown>;
+  /** **Required.** At most one push per target per window, plus one trailing push. */
+  readonly coalesce: Duration.Input;
+  /** **Required.** The most pushes a target receives per period; past it, none. */
+  readonly budget: Budget;
+}
+/**
+ * An `InvalidationSink` that pokes the devices a change should wake, over Web
+ * Push, within the app's coalescing window and budget. Run it with
+ * `InvalidationSink.run` where the bus is. Its trailing pushes run on fibres
+ * of the scope it is built in.
+ */
+declare const sink: <Target>(options: SinkOptions<Target>) => Effect.Effect<InvalidationSink, never, Scope.Scope>;
+declare namespace FanoutTopics_d_exports {
+  export { Topic, coarse, collectionOf, derivableSets, fine, topicForSubset, topicsForWrite };
+}
+/** A fan-out topic: `collection` (coarse) or `collection/field=value` (fine). */
+type Topic = string;
+/** The coarse topic of a collection: every write to it publishes here. */
+declare const coarse: (collection: string) => Topic;
+/** A fine topic: a graph location (`reviews/productId=p-1` IS that edge). */
+declare const fine: (collection: string, field: string, value: string | number | boolean) => Topic;
+/** The collection a topic belongs to (both coarse and fine). */
+declare const collectionOf: (topic: Topic) => string;
+/** The derivable set of every node in a registry, keyed by collection. */
+declare const derivableSets: (nodes: NodeRegistry) => ReadonlyMap<string, ReadonlySet<string>>;
+/**
+ * The finest topic a window's predicate legally allows: an equality
+ * conjunct on a derivable field → that fine topic (every row in the
+ * window carries the value, so every affecting write derives it);
+ * anything else → the coarse topic.
+ */
+declare const topicForSubset: (subset: Subset, derivable: ReadonlySet<string> | undefined) => Topic;
+/**
+ * The topics one written row derives: the coarse topic plus a fine topic
+ * per derivable field of its **old and new** values — an update that moves
+ * a row between parents pokes both edge windows; a delete derives from the
+ * old row; a value-less write degrades to coarse alone.
+ */
+declare const topicsForWrite: (collection: string, derivable: ReadonlySet<string> | undefined, values: {
+  readonly oldValue?: unknown;
+  readonly newValue?: unknown;
+}) => ReadonlySet<Topic>;
+declare namespace FanoutBroker_d_exports {
+  export { FanoutBroker, TopicPokes, makeInProcess };
+}
+/** A live subscription to a room's topic pokes. */
+interface TopicPokes {
+  /** The next batch of matched topics; suspends until one arrives. */
+  readonly take: Effect.Effect<ReadonlyArray<Topic>>;
+}
+/**
+ * Topic pub/sub with leased registrations: rooms lease the topics their windows compile to, and
+ * `publish` pokes every room whose live lease intersects a write's topics.
+ */
+interface FanoutBroker {
+  /**
+   * Lease (or replace) a room's topic registrations. The lease expires
+   * after `ttl` unless re-registered — registration is idempotent, so the
+   * heartbeat IS re-registration.
+   */
+  readonly register: (roomId: string, topics: ReadonlySet<Topic>, ttl: Duration.Input) => Effect.Effect<void>;
+  /** Route derived topics to every room whose live lease intersects them. */
+  readonly publish: (topics: Iterable<Topic>) => Effect.Effect<void>;
+  /** A room's poke feed. Established once the effect completes. */
+  readonly pokes: (roomId: string) => Effect.Effect<TopicPokes, never, Scope.Scope>;
+}
+/**
+ * The {@link FanoutBroker} service tag, for apps that provide a broker by layer;
+ * `FanoutBus.make` takes it as an option.
+ */
+declare const FanoutBroker: Context.Service<FanoutBroker, FanoutBroker>;
+/** The in-process broker: leases in a Ref, one dropping hub per room. */
+declare const makeInProcess: Effect.Effect<FanoutBroker, never, Scope.Scope>;
+declare namespace FanoutBus_d_exports {
+  export { MakeOptions, make };
+}
+/**
+ * Options for {@link make}: this room's id at the broker, the broker, and the node graph topics
+ * are derived from.
+ */
+interface MakeOptions {
+  /** This room's identity at the broker (typically the user id). */
+  readonly roomId: string;
+  readonly broker: FanoutBroker;
+  /** The node graph — the derivable sets both derivation sides agree on. */
+  readonly nodes: NodeRegistry;
+  /**
+   * The room's current windows (e.g. the authorized subsets of its client
+   * groups, from the sync server's introspection). Re-evaluated on every
+   * heartbeat, so new subscriptions register within one beat.
+   */
+  readonly subsets: Effect.Effect<ReadonlyArray<Subset>>;
+  /** Lease heartbeat. Default 10 seconds. */
+  readonly heartbeat?: Duration.Input;
+  /** Lease time-to-live. Default 3× the heartbeat. */
+  readonly ttl?: Duration.Input;
+  /**
+   * Bound on each broker call the bus makes (a publish, a lease registration). A call that
+   * exceeds it is logged and dropped, since a lost poke only delays the next pull (ADR-0009).
+   * `publish` makes two such calls in turn (the broker publish, then a lease registration), each
+   * with its own bound, so a hung broker can hold one `publish` for up to two bounds. `publish`
+   * runs inside the sync server's uninterruptible commit-and-publish region, so these bounds are
+   * what keep a hung broker from holding that region open indefinitely. With Durable Objects one
+   * broker publish is many shard calls under its single bound, so a multi-topic publish can be cut
+   * short and its unsent pokes dropped. That is acceptable per ADR-0009: a lost poke only delays
+   * the next pull, which `syncLoop.pullInterval` bounds when it is configured. Default 5 seconds.
+   */
+  readonly timeout?: Duration.Input | undefined;
+}
+/** Build the bus; the lease heartbeat runs until the scope closes. */
+declare const make: (options: MakeOptions) => Effect.Effect<InvalidationBus, never, Scope.Scope>;
+declare namespace BusBrokers_d_exports {
+  export { BroadcastChannelLike, RedisBrokerOptions, WebSocketLike, makeBroadcastChannelBroker, makeRedisBroker, makeWebSocketBroker };
+}
+/** Options for {@link makeRedisBroker}. */
+interface RedisBrokerOptions {
+  /** Stream key all instances share. Defaults to `"legation:hints"`. */
+  readonly stream?: string;
+  /**
+   * XREAD BLOCK timeout before re-issuing. Defaults to 5 seconds. A reader XREAD with no reply
+   * within this plus a fixed 2-second margin is a failed step. `0` disables that hang detection:
+   * the reader parks until an entry arrives, so a dead connection parks it silently, as before.
+   */
+  readonly block?: Duration.Input;
+  /**
+   * Where a new subscriber starts reading. `"$"` (default) delivers only
+   * messages published after it connects — pub/sub semantics; `"0"` replays
+   * the whole stream (harmless for a bus, but unbounded without trimming).
+   */
+  readonly from?: "$" | "0";
+  /**
+   * Bound on one XADD. A publish that exceeds it is logged and dropped: the bus publishes inside
+   * the sync server's uninterruptible commit-and-publish region, so a hung Redis must not hold
+   * that region open. Defaults to 5 seconds.
+   */
+  readonly timeout?: Duration.Input;
+}
+/**
+ * A BusBroker over Redis Streams. Captures the `Redis` service; each
+ * `subscribe` forks a scoped reader looping `XREAD BLOCK`.
+ *
+ * `subscribe` makes one attempt at the start position (`XREVRANGE`, or `0-0`
+ * for an empty stream), waiting at most 500 ms, and returns either way. If the
+ * attempt answers in time, a hint published once `subscribe` returns is never
+ * missed. If it fails or times out, the forked reader resolves the start
+ * position on its first step and retries with back-off (200 ms, doubling,
+ * capped at 5 s) until Redis answers. While Redis is unreachable, a publish that
+ * races the start can be missed: it lands after `subscribe` returns but before
+ * the reader resolves its start position. Delivery is best-effort (ADR-0009).
+ * Each reader XREAD is bounded at its `block` time plus the margin described on
+ * `block`. A call with no reply by then is a failed step: it is logged, backed off
+ * and retried from the last ID seen, as a failed start lookup is, so no entry is
+ * skipped. A reply of null (a normal BLOCK timeout) is a success.
+ *
+ * The `Redis` service's `send` must meet two properties that this bound relies on.
+ * It must be interruptible: the bound interrupts a read that never replies. And
+ * after an aborted `send`, it must keep replies in order on its connection, so a
+ * late reply to an abandoned XREAD is never read as the answer to the next command.
+ *
+ * Known limit: after a `DEL` and recreate of the stream, or a Redis clock
+ * stepping backwards, new IDs can fall at or below the sticky cursor and be
+ * skipped until the subscriber resubscribes.
+ */
+declare const makeRedisBroker: (options?: RedisBrokerOptions) => Effect.Effect<BusBroker, never, Redis.Redis>;
+/** The minimal WebSocket surface this broker uses (browser/DO/ws-compatible). */
+interface WebSocketLike {
+  readonly send: (data: string) => void;
+  readonly addEventListener: (type: "message", listener: (event: {
+    readonly data: unknown;
+  }) => void) => void;
+  readonly removeEventListener: (type: "message", listener: (event: {
+    readonly data: unknown;
+  }) => void) => void;
+}
+/**
+ * A BusBroker over a `WebSocketLike` whose far end rebroadcasts every frame
+ * to all connected peers — the Durable Object relay pattern. `publish` sends
+ * a frame; `subscribe` collects inbound string frames.
+ */
+declare const makeWebSocketBroker: (socket: WebSocketLike) => BusBroker;
+/** The minimal `BroadcastChannel` surface this broker uses. */
+interface BroadcastChannelLike {
+  readonly postMessage: (data: string) => void;
+  readonly addEventListener: (type: "message", listener: (event: {
+    readonly data: unknown;
+  }) => void) => void;
+  readonly removeEventListener: (type: "message", listener: (event: {
+    readonly data: unknown;
+  }) => void) => void;
+}
+/**
+ * A BusBroker over a `BroadcastChannel` — cross-context fan-out on one machine
+ * (browser tabs, Node worker threads). A `BroadcastChannel` delivers to every
+ * *other* channel of the same name but not the sender, so `publish` also offers
+ * to this broker's own subscribers, honoring the contract's self-delivery (each
+ * instance fans the hint out to its local sessions). Point every context's
+ * broker at the same channel name.
+ */
+declare const makeBroadcastChannelBroker: (channel: BroadcastChannelLike) => Effect.Effect<BusBroker, never, Scope.Scope>;
+declare namespace HintSource_d_exports {
+  export { HintSource, fromStream, run };
+}
+/**
+ * A producer of change hints for writes that bypass mutations; fork its `run` beside the server.
+ */
+interface HintSource {
+  /** Run until the scope closes; publishes to the in-context InvalidationBus. */
+  readonly run: Effect.Effect<void, never, InvalidationBus | Scope.Scope>;
+}
+/**
+ * Build a HintSource from a stream of hint batches (used by the LISTEN/NOTIFY
+ * recipe and tests): each emitted batch is published to the in-context bus, and
+ * the consuming fibre is tied to the scope so it stops when the scope closes.
+ */
+declare const fromStream: (hints: Stream.Stream<ReadonlyArray<ChangeHint>>) => HintSource;
+/**
+ * Fork a HintSource for the caller's scope, resolving the bus from context: the
+ * source's worker runs on a scoped fibre alongside the SyncServer and is
+ * interrupted when the scope closes.
+ */
+declare const run: (source: HintSource) => Effect.Effect<void, never, InvalidationBus | Scope.Scope>;
+declare namespace SyncRoom_d_exports {
+  export { layer };
+}
+/**
+ * A self-contained room: provide a Backend and an AuthPolicy, get a
+ * ServerHandler. CVRs and the bus are in-memory/in-process.
+ */
+declare const layer: Layer.Layer<ServerHandler, never, Backend | AuthPolicy>;
+declare namespace Telemetry_d_exports {
+  export { cacheTagBudgetExceededTotal, changeCollapsesTotal, count, fanoutLatencyMs, hintsDroppedTotal, journalDepth, mirrorRefreshesTotal, mutationsPushedTotal, patchOps, pokesSuppressedTotal, pokesTotal, pullPatchOps, pullsTotal, pushMutations, pushesTotal, rebaseDurationMs, serverPullsTotal, span, syncFailuresTotal };
+}
+/** Pulls completed by a client (a patch applied + rebase). */
+declare const pullsTotal: Metric.Counter<number>;
+/** Pushes completed by a client. */
+declare const pushesTotal: Metric.Counter<number>;
+/** Mutations delivered upstream across all pushes. */
+declare const mutationsPushedTotal: Metric.Counter<number>;
+/** Pull requests served by the sync server. */
+declare const serverPullsTotal: Metric.Counter<number>;
+/** Pokes published by server fan-out. */
+declare const pokesTotal: Metric.Counter<number>;
+/**
+ * Pokes suppressed by predicate-level fan-out matching: a group that a
+ * collection-only match would have poked, but whose subscriptions no hinted
+ * change plausibly affects. Over-matching is safe (a redundant poke costs an
+ * empty pull), so this counts avoided-but-safe work, not correctness.
+ */
+declare const pokesSuppressedTotal: Metric.Counter<number>;
+/** Patch sizes (ops per pull) computed by the server. */
+declare const patchOps: Metric.Histogram<number>;
+/**
+ * Sync operations (push/pull/poke stream) that failed terminally after the
+ * client's retry policy was exhausted. A rising count means the transport is
+ * degraded — bindings can surface a "sync degraded" state from it.
+ */
+declare const syncFailuresTotal: Metric.Counter<number>;
+/**
+ * Invalidation-bus hints dropped because a bounded bus (in-process PubSub or
+ * memory broker) overflowed while a consumer was behind. A dropped hint only
+ * delays convergence — the next pull repairs it — so this counts safely-shed
+ * work under backpressure, never lost correctness (ADR-0009).
+ */
+declare const hintsDroppedTotal: Metric.Counter<number>;
+/**
+ * Times a stalled engine observer's bounded change hub dropped a view-change,
+ * forcing the consumer to collapse the gap into a full `Rebuild`. A Rebuild
+ * subsumes any dropped `Patch`es (ADR-0008), so the view stays correct; this
+ * counts backpressure-induced recomputes, not lost updates.
+ */
+declare const changeCollapsesTotal: Metric.Counter<number>;
+/**
+ * Times a stalled mirror observer's bounded change hub dropped a subset
+ * key, forcing a full re-read of the observed subset. The newest rows live in
+ * the mirror's `Ref`, so the re-read is lossless; this counts refreshes forced
+ * by backpressure.
+ */
+declare const mirrorRefreshesTotal: Metric.Counter<number>;
+/**
+ * Depth of the client's journal — the number of pending (unacknowledged)
+ * mutations. Sampled as an absolute gauge on every append (a new pending
+ * mutation) and every acknowledgement (a trim), so it tracks the outbox
+ * backlog: a persistently high value means pushes are not draining.
+ */
+declare const journalDepth: Metric.Gauge<number>;
+/**
+ * Time (ms) to rebuild the optimistic overlay — the rebase (ADR-0008): replay
+ * every pending mutation over confirmed rows. Sampled around the actual
+ * materialisation (cache misses only), so it measures replay cost, not cache
+ * hits.
+ */
+declare const rebaseDurationMs: Metric.Histogram<number>;
+/**
+ * Time (ms) the server fan-out loop spends processing one hint batch — from
+ * taking the batch off the invalidation bus to poking every matching group.
+ * A proxy for hint-published → poke-sent latency (the hints carry no publish
+ * timestamp), so it measures the fan-out leg the server controls.
+ */
+declare const fanoutLatencyMs: Metric.Histogram<number>;
+/** Patch size (ops) a client applies per pull — the downstream volume per rebase. */
+declare const pullPatchOps: Metric.Histogram<number>;
+/** Mutations delivered per push — the upstream batch size the journal coalesced. */
+declare const pushMutations: Metric.Histogram<number>;
+/**
+ * Times a cached response's row count exceeded the HTTP cache's fine-tag
+ * budget (`HttpCacheInvalidation.FINE_TAG_ROW_BUDGET` in `@thomasfosterau/legation-browser`)
+ * and fell back to tagging that response with its coarse
+ * `collection:{name}` tag alone, skipping the per-row `collection:{name}:{id}`
+ * tags. Correctness is unaffected (the coarse tag still evicts it on any row
+ * change in the collection) — this counts responses that lost fine-grained
+ * eviction to the budget, so the fallback is observable rather than silent.
+ */
+declare const cacheTagBudgetExceededTotal: Metric.Counter<number>;
+/** Record an integer count against a counter (no-op-safe in any context). */
+declare const count: <Input extends number>(metric: Metric.Metric<Input, unknown>, amount: Input) => Effect.Effect<void>;
+/** Names used for `Effect.withSpan` on the engine's hot paths. */
+declare const span: {
+  readonly clientPull: "legation.client.pull";
+  readonly clientPush: "legation.client.push";
+  readonly serverPull: "legation.server.pull";
+  readonly serverPush: "legation.server.push";
+  readonly serverRead: "legation.server.read";
+};
+export { AtomicKeyValue_d_exports as A, Subscriptions_d_exports as C, Introspection_d_exports as D, OrderedTree_d_exports as E, RpcTransport_d_exports as M, UnknownMutator_d_exports as N, Paced_d_exports as O, Hash_d_exports as P, Derive_d_exports as S, LiveView_d_exports as T, MirrorProtocol_d_exports as _, BusBrokers_d_exports as a, LiveQuery_d_exports as b, FanoutTopics_d_exports as c, HttpCache_d_exports as d, FilterCorpus_d_exports as f, EngineHost_d_exports as g, Mirror_d_exports as h, HintSource_d_exports as i, SpecExport_d_exports as j, Undo_d_exports as k, PushPoke_d_exports as l, BackendContract_d_exports as m, SyncRoom_d_exports as n, FanoutBus_d_exports as o, RejectionMemory_d_exports as p, HintSource as r, FanoutBroker_d_exports as s, Telemetry_d_exports as t, InvalidationSink_d_exports as u, PromiseFacade_d_exports as v, Incremental_d_exports as w, FractionalIndex_d_exports as x, EngineAtoms_d_exports as y };
+//# sourceMappingURL=internal-CxXRlFK9.d.ts.map