@thomasfosterau/legation 0.0.0 → 0.1.0

package/dist/internal-JyoQMlfK.js

@@ -0,0 +1,3758 @@
+import { t as __exportAll } from "./rolldown-runtime-D8jQpDG7.js";
+import { $t as apply, At as RejectedMutation, B as FormMutationBegin, Dn as relationshipsOf, Dt as Poke, Et as PatchOp, F as ofPlan, G as mutationStatesUpdate, In as MutationRejected, It as make$8, J as relatedUpdate, K as namedKey, M as make$7, Mn as BackendError, P as NOT_PULLED, Tt as NamedSubscription, U as decodeMirrorMessage, V as MUTATION_STATES_KEY, Vn as TransportError, W as mirrorUpdate, Xt as related, Yt as query, Z as ClientEngine, Zt as Subset, _n as ne, _t as canonicalJson, a as layer$2, an as always, bn as or, cn as eq, dn as isIn, dt as make$6, en as hash, fn as isNotNull, ft as put, gn as lte, hn as lt, j as counted, kt as PushResponse, l as layerInProcess, ln as gt, n as handler, on as and, p as layerMemoryStore, pn as isNull, pt as result, q as relatedKey, qt as tryPlan, r as validatedHandlers, s as InvalidationBus, sn as compareText, tn as make$5, un as gte, ut as del, vn as not, vt as contentHash, wt as Mutation, y as isError, yn as notIn, yt as ClientStore, zn as QueryError } from "./MemoryBackend-DxP8t4ge.js";
+import * as Arr from "effect/Array";
+import * as Schema from "effect/Schema";
+import * as Option from "effect/Option";
+import * as P from "effect/Predicate";
+import * as Effect from "effect/Effect";
+import * as HashMap from "effect/HashMap";
+import * as Context from "effect/Context";
+import * as Result from "effect/Result";
+import * as Stream from "effect/Stream";
+import * as Fiber from "effect/Fiber";
+import * as Queue from "effect/Queue";
+import * as Ref from "effect/Ref";
+import * as Exit from "effect/Exit";
+import * as Scope from "effect/Scope";
+import * as Semaphore from "effect/Semaphore";
+import * as Clock from "effect/Clock";
+import * as Deferred from "effect/Deferred";
+import * as Duration from "effect/Duration";
+import * as Layer from "effect/Layer";
+import * as PubSub from "effect/PubSub";
+import * as SubscriptionRef from "effect/SubscriptionRef";
+import { Redis } from "effect/persistence";
+import * as JsonSchema from "effect/JsonSchema";
+import * as SchemaRepresentation from "effect/SchemaRepresentation";
+import * as Str from "effect/String";
+import { Atom } from "effect/reactivity";
+import * as Cause from "effect/Cause";
+import * as ManagedRuntime from "effect/ManagedRuntime";
+import * as DateTime from "effect/DateTime";
+import * as Random from "effect/Random";
+// src/SpecExport.ts
+/**
+* SpecExport
+*
+* Emit machine-readable API descriptions of an app's sync surface so bespoke
+* clients can be generated in any language (ADR-0017). The protocol is
+* schema-defined (Protocol.ts) and carrier-agnostic (ADR-0002); this module
+* turns those schemas — *specialized with the app's own collections, mutators
+* and queries* — into an OpenAPI document (the unary push/pull operations) and
+* an AsyncAPI document (push/pull plus the streamed poke channel).
+*
+* The value is specialization. The wire protocol moves `unknown` values and
+* args; a generic spec describes an opaque envelope. Here each message is
+* narrowed to a discriminated union over the app's actual names — a `Mutation`
+* per mutator (its `args` schema), a patch `Put` per collection (its row
+* schema), a named subscription per query — so a generated client gets
+* concrete, per-name types instead of `any`.
+*
+* The pipeline is two steps so new formats are cheap to add: `build` produces a
+* format-neutral {@link SyncSpec} (a shared JSON-Schema component pool plus the
+* names of each message), and the emitters (`toOpenApi`, `toAsyncApi`, or your
+* own) project that into a concrete document.
+*
+* The emitted OpenAPI is the protocol's *logical REST projection*: push and
+* pull as `POST {path}/push` and `POST {path}/pull`. The default RPC carrier
+* (RpcTransport.ts) multiplexes both over a single endpoint with its own
+* envelope; the projection is the codegen-friendly contract, equally servable
+* by a thin REST adapter.
+*/
+var SpecExport_exports = /* @__PURE__ */ __exportAll({
+	asyncApi: () => asyncApi,
+	build: () => build,
+	openApi: () => openApi,
+	toAsyncApi: () => toAsyncApi,
+	toOpenApi: () => toOpenApi
+});
+/** Coerce an arbitrary name into a `$ref`-safe component identifier fragment. */
+const sanitize = (name) => {
+	const cleaned = name.replace(/[^A-Za-z0-9_]/g, "_").replace(/^_+|_+$/g, "");
+	if (Str.isEmpty(cleaned)) return "x";
+	return /^[0-9]/.test(cleaned) ? `n${cleaned}` : cleaned;
+};
+/** A namer that keeps identifiers unique by suffixing collisions (`_2`, `_3`). */
+const uniqueNamer = () => {
+	const seen = /* @__PURE__ */ new Set();
+	return (prefix, name) => {
+		const base = `${prefix}${sanitize(name)}`;
+		const at = (n) => n < 2 ? base : `${base}_${n}`;
+		const free = (n) => seen.has(at(n)) ? free(n + 1) : at(n);
+		const candidate = free(1);
+		seen.add(candidate);
+		return candidate;
+	};
+};
+const id = (schema, identifier) => schema.annotate({ identifier });
+/** The serializable failure carried on sync operations (RpcTransport's). */
+const SyncError = Schema.Struct({
+	_tag: Schema.tag("SyncRpcError"),
+	message: Schema.String
+});
+/**
+* Build the specialized message schemas, each tagged with a stable component
+* identifier. Where the app provides names the generic `unknown` envelope is
+* narrowed to a discriminated union; otherwise the generic schema stands in.
+*/
+const specialize = (api) => {
+	const collections = api.collections ?? [];
+	const mutators = api.mutators ?? [];
+	const queries = api.queries ?? [];
+	const name = uniqueNamer();
+	const collectionNames = collections.map((c) => ({
+		def: c,
+		schema: name("Row_", c.name)
+	}));
+	const mutatorNames = mutators.map((m) => ({
+		def: m,
+		schema: name("MutatorArgs_", m.name)
+	}));
+	const queryNames = queries.map((q) => ({
+		def: q,
+		schema: name("QueryArgs_", q.name)
+	}));
+	const mutation = Arr.isReadonlyArrayEmpty(mutatorNames) ? id(Mutation, "Mutation") : id(Schema.Union(mutatorNames.map(({ def, schema }) => id(Schema.Struct({
+		clientId: Schema.String,
+		mutationId: Schema.Number,
+		mutator: Schema.Literal(def.name),
+		args: id(def.args, schema),
+		createdAt: Schema.Number
+	}), `Mutation_${sanitize(def.name)}`))), "Mutation");
+	const patchOp = Arr.isReadonlyArrayEmpty(collectionNames) ? id(PatchOp, "PatchOp") : id(Schema.Union([
+		...collectionNames.map(({ def, schema }) => id(Schema.Struct({
+			_tag: Schema.tag("Put"),
+			collection: Schema.Literal(def.name),
+			id: Schema.String,
+			version: Schema.Union([Schema.String, Schema.Number]),
+			value: id(def.schema, schema)
+		}), `Put_${sanitize(def.name)}`)),
+		Schema.Struct({
+			_tag: Schema.tag("Del"),
+			collection: Schema.String,
+			id: Schema.String
+		}),
+		Schema.Struct({ _tag: Schema.tag("Clear") })
+	]), "PatchOp");
+	const namedSubscription = Arr.isReadonlyArrayEmpty(queryNames) ? id(NamedSubscription, "NamedSubscription") : id(Schema.Union(queryNames.map(({ def, schema }) => id(Schema.Struct({
+		name: Schema.Literal(def.name),
+		args: id(def.args, schema)
+	}), `NamedSubscription_${sanitize(def.name)}`))), "NamedSubscription");
+	const pushRequest = id(Schema.Struct({
+		clientGroupId: Schema.String,
+		mutations: Schema.Array(mutation)
+	}), "PushRequest");
+	const pullRequest = id(Schema.Struct({
+		clientGroupId: Schema.String,
+		cookie: Schema.optional(Schema.String),
+		subscriptions: Schema.Array(id(Subset, "Subset")),
+		namedSubscriptions: Schema.optional(Schema.Array(namedSubscription))
+	}), "PullRequest");
+	const pullResponse = id(Schema.Struct({
+		cookie: Schema.String,
+		patch: Schema.Array(patchOp),
+		lastMutationIds: Schema.Record(Schema.String, Schema.Number),
+		rejected: Schema.optional(Schema.Array(RejectedMutation))
+	}), "PullResponse");
+	return {
+		roots: [
+			pushRequest.ast,
+			id(PushResponse, "PushResponse").ast,
+			pullRequest.ast,
+			pullResponse.ast,
+			id(Poke, "Poke").ast,
+			id(SyncError, "SyncRpcError").ast
+		],
+		catalog: {
+			collections: collectionNames.map(({ def, schema }) => ({
+				name: def.name,
+				schema
+			})),
+			mutators: mutatorNames.map(({ def, schema }) => ({
+				name: def.name,
+				schema
+			})),
+			queries: queryNames.map(({ def, schema }) => ({
+				name: def.name,
+				schema
+			}))
+		}
+	};
+};
+/**
+* Build the format-neutral {@link SyncSpec} from an app's sync surface. The
+* shared component pool is assembled once (so every message reuses the same
+* row/args definitions) in OpenAPI-style draft-2020-12.
+*/
+const build = (api) => {
+	const { roots, catalog } = specialize(api);
+	const openApi = JsonSchema.toMultiDocumentOpenApi3_1(SchemaRepresentation.toJsonSchemaMultiDocument(SchemaRepresentation.toRepresentations(roots)));
+	return {
+		info: api.info,
+		path: api.path ?? "/sync",
+		components: openApi.definitions,
+		messages: {
+			pushRequest: "PushRequest",
+			pushResponse: "PushResponse",
+			pullRequest: "PullRequest",
+			pullResponse: "PullResponse",
+			poke: "Poke",
+			error: "SyncRpcError"
+		},
+		catalog
+	};
+};
+const ref = (name) => ({ $ref: `#/components/schemas/${name}` });
+const msgRef = (name) => ({ $ref: `#/components/messages/${name}` });
+const chanRef = (name) => ({ $ref: `#/channels/${name}` });
+const message = (payload) => ({
+	name: payload,
+	payload: ref(payload)
+});
+const withDescription = (info, extra) => ({
+	title: info.title,
+	version: info.version,
+	description: info.description === void 0 ? extra : `${info.description}\n\n${extra}`
+});
+/**
+* Project a {@link SyncSpec} into an OpenAPI 3.1 document: push and pull as the
+* protocol's logical `POST {path}/push` and `POST {path}/pull` operations, with
+* every app type in `components.schemas`. Streamed pokes live in AsyncAPI.
+*/
+const toOpenApi = (spec) => {
+	const operation = (operationId, summary, request, response) => ({ post: {
+		operationId,
+		summary,
+		requestBody: {
+			required: true,
+			content: { "application/json": { schema: ref(request) } }
+		},
+		responses: {
+			"200": {
+				description: "Success.",
+				content: { "application/json": { schema: ref(response) } }
+			},
+			default: {
+				description: "Sync error.",
+				content: { "application/json": { schema: ref(spec.messages.error) } }
+			}
+		}
+	} });
+	return {
+		openapi: "3.1.0",
+		info: withDescription(spec.info, "Logical REST projection of the sync protocol. The default RPC carrier multiplexes push and pull over a single endpoint; these operations are the codegen-friendly contract."),
+		paths: {
+			[`${spec.path}/push`]: operation("push", "Deliver pending mutations (push).", spec.messages.pushRequest, spec.messages.pushResponse),
+			[`${spec.path}/pull`]: operation("pull", "Request a patch to the next cookie (pull).", spec.messages.pullRequest, spec.messages.pullResponse)
+		},
+		components: { schemas: spec.components }
+	};
+};
+/**
+* Project a {@link SyncSpec} into an AsyncAPI 3.0 document: push and pull as
+* request/reply send operations and the contentless poke hint as a receive
+* channel. Component schemas are shared with the OpenAPI projection.
+*/
+const toAsyncApi = (spec) => {
+	return {
+		asyncapi: "3.0.0",
+		info: withDescription(spec.info, "Message-oriented view of the sync protocol: push/pull request-reply and the streamed poke hint."),
+		channels: {
+			push: {
+				address: `${spec.path}/push`,
+				messages: {
+					request: msgRef(spec.messages.pushRequest),
+					response: msgRef(spec.messages.pushResponse)
+				}
+			},
+			pull: {
+				address: `${spec.path}/pull`,
+				messages: {
+					request: msgRef(spec.messages.pullRequest),
+					response: msgRef(spec.messages.pullResponse)
+				}
+			},
+			pokes: {
+				address: `${spec.path}/pokes`,
+				messages: { poke: msgRef(spec.messages.poke) }
+			}
+		},
+		operations: {
+			push: {
+				action: "send",
+				channel: chanRef("push"),
+				reply: {
+					channel: chanRef("push"),
+					messages: [msgRef(spec.messages.pushResponse)]
+				}
+			},
+			pull: {
+				action: "send",
+				channel: chanRef("pull"),
+				reply: {
+					channel: chanRef("pull"),
+					messages: [msgRef(spec.messages.pullResponse)]
+				}
+			},
+			receivePokes: {
+				action: "receive",
+				channel: chanRef("pokes")
+			}
+		},
+		components: {
+			schemas: spec.components,
+			messages: {
+				[spec.messages.pushRequest]: message(spec.messages.pushRequest),
+				[spec.messages.pushResponse]: message(spec.messages.pushResponse),
+				[spec.messages.pullRequest]: message(spec.messages.pullRequest),
+				[spec.messages.pullResponse]: message(spec.messages.pullResponse),
+				[spec.messages.poke]: message(spec.messages.poke)
+			}
+		}
+	};
+};
+/** Build and project to OpenAPI 3.1 in one step. */
+const openApi = (api) => toOpenApi(build(api));
+/** Build and project to AsyncAPI 3.0 in one step. */
+const asyncApi = (api) => toAsyncApi(build(api));
+// src/Undo.ts
+/**
+* Undo
+*
+* An optional, additive undo/redo module layered over anything that can
+* `mutate(name, args)` — no engine surgery (issue #46). It follows the
+* *paired-intents* design (the `@rocicorp/undo` shape): the caller supplies
+* both directions of a change at run time, and undo/redo replay through the
+* supplied handle's ordinary `mutate` pipeline — a `ClientEngine`, a
+* `Client`, or a test double all satisfy {@link MutateHandle} structurally
+* (issue #223). Because they are just mutations, undo and redo are
+* optimistic, journaled, rebased, and offline-safe like any other write —
+* the module adds only the in-memory history.
+*
+* `ClientEngine.mutate` and `Client.mutate` do not share an error channel
+* (the engine fails with its mutator/store union, the Client with its
+* narrower view error), so both {@link MutateHandle} and {@link UndoManager}
+* are generic in that error type: whatever the supplied handle's `mutate`
+* fails with is what `run`/`undo`/`redo` fail with, unchanged.
+*
+* History is a per-client, in-memory pair of stacks (one manager per handle).
+* It does not survive a reload; the journal (which does) still carries any
+* pending undo/redo mutations to the backend.
+*
+* ## Paired intents
+*
+* Each {@link UndoEntry} names the mutator + args to run now (`execute`) and the
+* mutator + args that reverse it (`undo`). The caller captures whatever the
+* reversal needs at run time — crucially, the *pre-delete value*: read the row
+* from the local view, then `run({ execute: delete, undo: set(capturedValue) })`
+* so an undo re-creates the row exactly.
+*
+* ## Grouping
+*
+* {@link UndoManager.group} coalesces every `run` made while its effect runs
+* into ONE composite step: a single `undo` replays each member's `undo` in
+* reverse order, a single `redo` replays each member's `execute` in order.
+*/
+var Undo_exports = /* @__PURE__ */ __exportAll({ make: () => make$4 });
+const EMPTY_HISTORY = {
+	undo: [],
+	redo: []
+};
+/**
+* Build an {@link UndoManager} over any {@link MutateHandle} — a
+* `ClientEngine`, a `Client`, or a test double. History is in-memory, so
+* nothing needs a scope; the manager lives as long as the reference is held.
+* The manager's error type is inferred from the handle's `mutate`, so a
+* `ClientEngine` yields the same mutator/store union it always has, and a
+* `Client` yields its narrower view error.
+*/
+const make$4 = (handle) => Effect.gen(function* () {
+	const history = yield* SubscriptionRef.make(EMPTY_HISTORY);
+	const groupBuffer = yield* Ref.make(void 0);
+	const runIntent = (intent) => handle.mutate(intent.mutator, intent.args);
+	const pushStep = (step) => SubscriptionRef.update(history, (h) => ({
+		undo: [...h.undo, step],
+		redo: []
+	}));
+	const record = (entry) => Ref.get(groupBuffer).pipe(Effect.flatMap((buffer) => buffer === void 0 ? pushStep([entry]) : Ref.set(groupBuffer, [...buffer, entry])));
+	const run = (entry) => runIntent(entry.execute).pipe(Effect.andThen(record(entry)));
+	const take = (from) => SubscriptionRef.modify(history, (h) => {
+		const stack = h[from];
+		const step = stack.at(-1);
+		if (step === void 0) return [void 0, h];
+		return [step, {
+			...h,
+			[from]: stack.slice(0, -1)
+		}];
+	});
+	const pushOnto = (onto, step) => SubscriptionRef.update(history, (h) => ({
+		...h,
+		[onto]: [...h[onto], step]
+	}));
+	const replay = (step, direction) => Effect.gen(function* () {
+		const ordered = direction === "undo" ? [...step].reverse() : step;
+		yield* Effect.forEach(ordered, (entry) => Effect.gen(function* () {
+			yield* runIntent(direction === "undo" ? entry.undo : entry.execute);
+		}), {
+			concurrency: 1,
+			discard: true
+		});
+	});
+	const step = (from, onto) => take(from).pipe(Effect.flatMap((popped) => popped === void 0 ? Effect.void : replay(popped, from).pipe(Effect.andThen(pushOnto(onto, popped)))));
+	const canUndo = SubscriptionRef.get(history).pipe(Effect.map((h) => Arr.isReadonlyArrayNonEmpty(h.undo)));
+	const canRedo = SubscriptionRef.get(history).pipe(Effect.map((h) => Arr.isReadonlyArrayNonEmpty(h.redo)));
+	const observe = (project) => SubscriptionRef.changes(history).pipe(Stream.map(project), Stream.changes);
+	const flushGroup = Ref.get(groupBuffer).pipe(Effect.flatMap((buffer) => buffer !== void 0 && Arr.isReadonlyArrayNonEmpty(buffer) ? pushStep(buffer) : Effect.void));
+	const group = (effect) => Ref.get(groupBuffer).pipe(Effect.flatMap((existing) => existing !== void 0 ? effect : Ref.set(groupBuffer, []).pipe(Effect.andThen(effect), Effect.tap(() => flushGroup), Effect.ensuring(Ref.set(groupBuffer, void 0)))));
+	return {
+		run,
+		undo: step("undo", "redo"),
+		redo: step("redo", "undo"),
+		canUndo,
+		canRedo,
+		canUndoChanges: observe((h) => Arr.isReadonlyArrayNonEmpty(h.undo)),
+		canRedoChanges: observe((h) => Arr.isReadonlyArrayNonEmpty(h.redo)),
+		group
+	};
+});
+// src/Paced.ts
+/**
+* Paced mutations (#117)
+*
+* Debounce/throttle/coalesce strategies for rapid mutation intents — a text
+* field autosaving per keystroke, a slider, a cart-quantity stepper — layered
+* over {@link ClientEngine} the same way {@link Undo} is: no engine surgery,
+* built entirely from `mutateWithAck` + `dropIfPending` + Effect's own timing
+* primitives (`Effect.sleep`, `Fiber.interrupt`). No pacer dependency, no
+* general-purpose pacer module — just the journal-compaction rule ADR-0008
+* already permits on the unpushed tail.
+*
+* ## Design: journal-then-compact
+*
+* Every call — debounce, throttle, or coalesce — always journals through the
+* ordinary `mutateWithAck` path immediately: full durability, the usual
+* optimistic overlay render, no separate preview mechanism. What pacing adds
+* is a *compaction* step run after journaling: for the mutation's `key` (a
+* caller-supplied string — e.g. a row id — distinguishing independent rapid
+* intents from each other), drop the previous still-pending entry for that
+* key via {@link ClientEngine.dropIfPending}, so a burst collapses to the
+* newest entry rather than piling one row per call into the journal.
+*
+* This was chosen over the alternative sketched in #117 (journal once,
+* replace an unpushed entry's args in place) because it needs no new
+* "mutate this pushed-adjacent entry in place" primitive — `dropIfPending`
+* is a narrow, easily-audited addition (drop specific still-pending ids, never
+* touching anything a push may have claimed) that composes with the journal
+* exactly as `acknowledge` already does, and because journal-then-compact
+* gives every strategy the *same* durability profile for the leading and
+* every eagerly-journaled call: nothing is ever held only in memory once it
+* has been accepted as "the current value" for a key.
+*
+* The one place memory-only buffering remains is intentional: `debounce` and
+* `throttle` do not journal *every* call. A call arriving while a burst is
+* already active only updates an in-memory `latestArgs` slot and (for
+* `debounce`) restarts the trailing timer; the store is touched at most twice
+* per debounce window (leading + trailing) or once per throttle window,
+* regardless of how many calls landed inside it — which is what keeps overlay
+* replays bounded for a 50-keystroke burst. **Durability tradeoff:** the
+* args sitting in that in-memory slot between flushes are not journaled, so a
+* crash inside a debounce/throttle window loses the freshest edit — the
+* journal still holds the last successfully flushed (leading-edge) args, not
+* nothing, but not the very latest keystroke either. This mirrors TanStack
+* DB's `createPacedMutations` debounce/throttle strategies exactly. `coalesce`
+* has no such window — every call journals immediately — so its tradeoff is
+* the opposite one: momentarily more journal entries (until the next call's
+* compaction catches up), never a lost edit.
+*
+* ## Compaction renumbers (#249)
+*
+* The backends reject a gap in a client's mutation ids (ADR-0008), so dropping
+* a superseded entry is not enough: `dropIfPending` also renumbers the
+* surviving unpushed entries, in order, so the journal stays contiguous and a
+* push can drain it. That means an id this module remembered for a key can
+* move — and not only when *its own* instance compacts: any other paced
+* mutation on the same engine shifts every unpushed entry behind the one it
+* drops. Acting on a stale id could drop an unrelated entry that has since
+* taken that number, so every instance's bookkeeping lives in one registry per
+* engine and each compaction's moves are applied to all of it (see
+* {@link Tracker}).
+*
+* ## Undo pairing
+*
+* A caller combining this with {@link Undo}: wrap the whole burst (every
+* `PacedMutation.call` your input handler makes) in `undo.group(...)`. Because
+* `Undo.group` coalesces every `run` made while its effect executes into one
+* step regardless of how many, a coalesced/debounced/throttled burst becomes
+* a single undo step too, matching what the user actually experiences as one
+* edit.
+*/
+var Paced_exports = /* @__PURE__ */ __exportAll({
+	coalesce: () => coalesce,
+	debounce: () => debounce,
+	throttle: () => throttle
+});
+/**
+* Every live {@link Tracker} for one engine. Weakly held, so an instance that
+* is dropped (a `coalesce` has no scope to release it from) does not pin its
+* map for the engine's lifetime.
+*/
+const trackersByEngine = /* @__PURE__ */ new WeakMap();
+/** Trackers already registered, so each is added once. */
+const registered = /* @__PURE__ */ new WeakSet();
+/** Register `tracker` so compactions by any instance on `engine` keep it current. */
+const track = (engine, tracker) => {
+	if (registered.has(tracker)) return;
+	registered.add(tracker);
+	let all = trackersByEngine.get(engine);
+	if (all === void 0) {
+		all = /* @__PURE__ */ new Set();
+		trackersByEngine.set(engine, all);
+	}
+	all.add(new WeakRef(tracker));
+};
+/**
+* Drop `previous` (if still compactable) and apply the renumbering it caused
+* to every tracker on the engine, so no instance is left holding an id that
+* now names a different entry.
+*/
+const compact = (engine, previous) => Effect.uninterruptible(Effect.gen(function* () {
+	const { renumbered } = yield* engine.dropIfPending([previous]);
+	if (Arr.isReadonlyArrayEmpty(renumbered)) return;
+	const moves = new Map(renumbered.map(({ from, to }) => [from, to]));
+	const all = trackersByEngine.get(engine);
+	if (all === void 0) return;
+	Arr.forEach(all, (ref) => {
+		const tracker = ref.deref();
+		if (tracker === void 0) {
+			all.delete(ref);
+			return;
+		}
+		Arr.forEach(tracker, ([key, id]) => {
+			const moved = moves.get(id);
+			if (moved !== void 0) tracker.set(key, moved);
+		});
+	});
+}));
+/**
+* Journal `args` for `mutator`/`key` via `mutateWithAck`, then drop this
+* key's previously-tracked mutation id if it is still pending — the shared
+* compaction step every strategy below is built from. `lastIdByKey` is the
+* caller's own bookkeeping (not the engine's): each Paced instance tracks
+* only the ids *it* journaled, so it only ever asks to drop its own entries.
+*/
+const flush = (engine, mutator, lastIdByKey, key, args) => Effect.gen(function* () {
+	track(engine, lastIdByKey);
+	const previous = yield* Effect.uninterruptible(Effect.gen(function* () {
+		const handle = yield* engine.mutateWithAck(mutator, args);
+		const before = lastIdByKey.get(key);
+		lastIdByKey.set(key, handle.mutationId);
+		return before;
+	}));
+	if (previous !== void 0) yield* compact(engine, previous);
+});
+/**
+* A background flush (debounce's trailing edge, throttle's periodic tick)
+* that isn't awaited by any caller: failures would otherwise die silently in
+* the forked fiber, so log them instead. The entry this call would have
+* compacted simply stays journaled uncompacted — never lost, just uncoalesced
+* (the same "short-lived extra entries" tradeoff `coalesce` always accepts).
+*/
+const flushBackground = (engine, mutator, lastIdByKey, key, args) => flush(engine, mutator, lastIdByKey, key, args).pipe(Effect.catch((error) => Effect.logWarning("Paced: background flush failed; entry left journaled uncompacted", {
+	mutator,
+	key,
+	error
+})));
+/**
+* Coalesce: consecutive unpushed invocations of `mutator` for the same `key`
+* collapse to the last one. No timing — every call journals and compacts
+* immediately, so nothing is ever buffered only in memory (fully durable),
+* at the cost of a momentary extra journal entry between a call and its
+* compaction.
+*/
+const coalesce = (engine, mutator) => Effect.gen(function* () {
+	const lock = yield* Semaphore.make(1);
+	const lastIdByKey = /* @__PURE__ */ new Map();
+	const call = (key, args) => Semaphore.withPermit(lock, flush(engine, mutator, lastIdByKey, key, args));
+	return { call };
+});
+/**
+* Debounce: the first call after a quiet period journals immediately (the
+* overlay renders it right away — optimistic rendering never waits for the
+* window); every call inside the window just buffers its args and restarts
+* the trailing timer. When `duration` elapses with no further calls, the
+* latest buffered args flush once, superseding the leading entry. A 50-call
+* burst inside one window therefore produces exactly two journal writes
+* (leading + trailing) no matter how many calls landed in between — see the
+* module doc for the durability tradeoff this implies.
+*/
+const debounce = (engine, mutator, duration) => Effect.gen(function* () {
+	const scope = yield* Effect.scope;
+	const lock = yield* Semaphore.make(1);
+	const lastIdByKey = /* @__PURE__ */ new Map();
+	const entries = /* @__PURE__ */ new Map();
+	const trailing = (key) => Effect.sleep(duration).pipe(Effect.andThen(Semaphore.withPermit(lock, Effect.gen(function* () {
+		const entry = entries.get(key);
+		if (entry === void 0 || !entry.dirty) {
+			entries.delete(key);
+			return;
+		}
+		const args = entry.latestArgs;
+		entries.delete(key);
+		yield* flushBackground(engine, mutator, lastIdByKey, key, args);
+	}))));
+	const call = (key, args) => Semaphore.withPermit(lock, Effect.gen(function* () {
+		let entry = entries.get(key);
+		if (entry === void 0) {
+			entry = {
+				latestArgs: args,
+				dirty: false,
+				timer: void 0
+			};
+			entries.set(key, entry);
+			yield* flush(engine, mutator, lastIdByKey, key, args);
+		} else {
+			if (entry.timer !== void 0) yield* Fiber.interrupt(entry.timer);
+			entry.latestArgs = args;
+			entry.dirty = true;
+		}
+		entry.timer = yield* Effect.forkIn(trailing(key), scope);
+	}));
+	return { call };
+});
+/**
+* Throttle: like {@link debounce}'s leading edge, but the window is never
+* reset by later calls — it flushes at most once per `duration` while calls
+* keep arriving (a continuous drag emits periodic journal writes, not just
+* one at the very end), then goes idle once a window elapses with nothing new
+* buffered.
+*/
+const throttle = (engine, mutator, duration) => Effect.gen(function* () {
+	const scope = yield* Effect.scope;
+	const lock = yield* Semaphore.make(1);
+	const lastIdByKey = /* @__PURE__ */ new Map();
+	const entries = /* @__PURE__ */ new Map();
+	const tick = (key) => Effect.sleep(duration).pipe(Effect.andThen(Semaphore.withPermit(lock, Effect.gen(function* () {
+		const entry = entries.get(key);
+		if (entry === void 0) return;
+		if (!entry.dirty) {
+			entries.delete(key);
+			return;
+		}
+		entry.dirty = false;
+		const args = entry.latestArgs;
+		yield* flushBackground(engine, mutator, lastIdByKey, key, args);
+		entry.timer = yield* Effect.forkIn(tick(key), scope);
+	}))));
+	const call = (key, args) => Semaphore.withPermit(lock, Effect.gen(function* () {
+		const entry = entries.get(key);
+		if (entry === void 0) {
+			const created = {
+				latestArgs: args,
+				dirty: false,
+				timer: void 0
+			};
+			entries.set(key, created);
+			yield* flush(engine, mutator, lastIdByKey, key, args);
+			created.timer = yield* Effect.forkIn(tick(key), scope);
+			return;
+		}
+		entry.latestArgs = args;
+		entry.dirty = true;
+	}));
+	return { call };
+});
+// src/Introspection.ts
+/**
+* Introspection
+*
+* A read-only view of a running {@link ClientEngine} and its
+* {@link ClientStore} (#45): the active subscriptions, the pending-mutation
+* journal, the pull cookie, the materialised collections, and the unified
+* {@link ClientEngine.engineEvents} lifecycle stream. Built entirely over the
+* engine's public read accessors and the store's public reads — it never
+* reaches into private engine state.
+*
+* Every member is a plain `Effect`/`Stream`, so it drives cleanly through
+* `PromiseFacade` for non-Effect surfaces (devtools panels, a demo journal
+* view):
+*
+* ```ts
+* const intro = Introspection.make(engine, store);
+* const pending = await facade.run(intro.journal);
+* const sub = facade.subscribe(intro.events, {
+*   onValue: (event) => console.log(event._tag),
+* });
+* ```
+*/
+var Introspection_exports = /* @__PURE__ */ __exportAll({
+	EngineIntrospection: () => EngineIntrospection,
+	fromServices: () => fromServices,
+	layer: () => layer$1,
+	make: () => make$3
+});
+/** The {@link EngineIntrospection} service devtools read through. */
+const EngineIntrospection = Context.Service("@thomasfosterau/legation/EngineIntrospection");
+/** Build the introspection view over a given engine and store. */
+const make$3 = (engine, store) => ({
+	subscriptions: engine.activeSubscriptions,
+	journal: store.pendingMutations,
+	cookie: store.getCookie,
+	collections: store.listCollections,
+	events: engine.engineEvents
+});
+/** Build the view from the {@link ClientEngine} + {@link ClientStore} in context. */
+const fromServices = Effect.gen(function* () {
+	const engine = yield* ClientEngine;
+	const store = yield* ClientStore;
+	return make$3(engine, store);
+});
+/** Layer providing {@link EngineIntrospection} from the engine + store services. */
+const layer$1 = Layer.effect(EngineIntrospection)(fromServices);
+// src/Incremental.ts
+/**
+* Incremental
+*
+* The pure delta engines behind #114's derived combinators ({@link Derive}).
+* ADR-0027 (decision 4) blesses the proven per-module seams over extracting a
+* shared #108 operator core, and rules that #114's combinators *are* the
+* operator layer, landing with their consumer — so these are exactly those
+* combinators' engines, not a separately-consumed core. Each mirrors a proven
+* seam's *technique* (not its coupled code): `join` the keyed-bucket-plus-
+* reverse-index of `Related.makeJoinEngine`, `groupBy` the running-fold-plus-
+* `byId` of `Aggregate`, `orderedWindow` the `LiveView`/`OrderedTree`
+* persistent order.
+*
+* The delta currency is keyed `added`/`removed` rows — the `Patch`-op model of
+* ADR-0027 §1, on row identity, not `[value, ±multiplicity]` multiset entries.
+* Each engine is a small, pure, Effect-free function that emits the delta to
+* its result, never a refold of the whole input (a refolding version of this
+* tier was explicitly judged not worth shipping, #114 brief) — and being pure
+* and stream-free is what lets a property test drive it against a naive
+* from-scratch recompute after every prefix of a randomized delta sequence.
+*
+* **The boundary rule (ADR-0027 §3).** These operators are read-layer
+* machinery behind `observe`. They see only rows the client already holds;
+* they never widen what syncs, never serialize, and are never auth-relevant.
+* The serializable `Subset`/`Predicate` tier alone decides what the server
+* ships.
+*
+* The unit is a {@link Row} — the same `(id, value)` shape as `Subset.Row` and
+* `ClientEngine.LocalRow`, so a source's page (`ReadonlyArray<LocalRow>`) is a
+* valid input and an operator's result rows compose as the input of the next
+* operator (queries-from-queries falls out of the shared shape). Output row
+* ids are synthesized where the operation demands it — a join row is keyed by
+* its `(leftId, rightId)` pair, a group row by its group key, a distinct row
+* by its canonical value — always a plain string, always stable.
+*/
+var Incremental_exports = /* @__PURE__ */ __exportAll({
+	applyDelta: () => applyDelta,
+	deltaFromChanges: () => deltaFromChanges,
+	diff: () => diff,
+	distinctFromScratch: () => distinctFromScratch,
+	emptyDelta: () => emptyDelta,
+	filterFromScratch: () => filterFromScratch,
+	groupByFromScratch: () => groupByFromScratch,
+	indexById: () => indexById,
+	joinFromScratch: () => joinFromScratch,
+	makeDistinct: () => makeDistinct,
+	makeFilter: () => makeFilter,
+	makeGroupBy: () => makeGroupBy,
+	makeJoin: () => makeJoin,
+	makeMap: () => makeMap,
+	makeOrderedWindow: () => makeOrderedWindow,
+	mapFromScratch: () => mapFromScratch,
+	orderedWindowFromScratch: () => orderedWindowFromScratch,
+	pageOf: () => pageOf
+});
+/** The empty delta (a no-op step result). */
+const emptyDelta = {
+	added: [],
+	removed: []
+};
+/** Index a page by id, for diffing against the next snapshot. */
+const indexById = (rows) => {
+	const map = /* @__PURE__ */ new Map();
+	for (const row of rows) map.set(row.id, row);
+	return map;
+};
+/**
+* Diff a new page against the previous snapshot (by id, value change detected
+* by content hash): a new id is an `added`, a vanished id a `removed`, a
+* changed value a `removed` (old) + `added` (new). Returns the delta and the
+* new snapshot index to carry forward.
+*/
+const diff = (previous, next) => {
+	const added = [];
+	const removed = [];
+	const index = /* @__PURE__ */ new Map();
+	for (const row of next) {
+		index.set(row.id, row);
+		const prior = previous.get(row.id);
+		if (prior === void 0) added.push(row);
+		else if (prior !== row && contentHash(prior.value) !== contentHash(row.value)) {
+			removed.push(prior);
+			added.push(row);
+		}
+	}
+	for (const [id, prior] of previous) if (!index.has(id)) removed.push(prior);
+	return {
+		delta: {
+			added,
+			removed
+		},
+		index
+	};
+};
+/** Fold a delta into a maintained result map (remove ids, then set adds). */
+const applyDelta = (result, delta) => {
+	for (const row of delta.removed) result.delete(row.id);
+	for (const row of delta.added) result.set(row.id, row);
+};
+/**
+* Recover a {@link Delta} directly from an `observeChanges` batch (#115),
+* instead of diffing two page snapshots (see {@link diff} above) — the
+* optimization ADR-0027 §4 and this module's header flag as a follow-up:
+* `LiveView` already decided enter/update/exit/move per row, so this just
+* reads that decision instead of recomputing it from two `Map`s. `known`
+* tracks the last row seen per id (across calls, mutated in place) so a
+* `reset` can emit a `removed` for everything it cleared — the same
+* information a page-diff's `previous` snapshot would have given for free.
+* `move` carries no value change, so it contributes nothing to the delta.
+*/
+const deltaFromChanges = (known, batch) => {
+	const added = [];
+	const removed = [];
+	for (const change of batch) switch (change._tag) {
+		case "reset":
+			for (const row of known.values()) removed.push(row);
+			known.clear();
+			break;
+		case "enter":
+			added.push(change.row);
+			known.set(change.row.id, change.row);
+			break;
+		case "update":
+			removed.push(change.previous);
+			added.push(change.row);
+			known.set(change.row.id, change.row);
+			break;
+		case "exit":
+			removed.push(change.previous);
+			known.delete(change.id);
+	}
+	return {
+		added,
+		removed
+	};
+};
+/** Materialize a result map to a page in a deterministic (id-ascending, code-point) order. */
+const pageOf = (result) => [...result.values()].toSorted((a, b) => compareText(a.id, b.id));
+/**
+* `filter` — keep rows whose value passes an arbitrary JS predicate. Stateless
+* per row: the predicate is deterministic on the value, and a delta carries the
+* value it concerns, so an added/removed row's membership is decided on the
+* spot (an update that filters a row out is a `removed` with the old value that
+* passed; one that filters it in is an `added` that now passes).
+*/
+const makeFilter = (predicate) => ({ step: (delta) => ({
+	added: delta.added.filter((row) => predicate(row.value)),
+	removed: delta.removed.filter((row) => predicate(row.value))
+}) });
+/** {@link makeFilter}'s naive recompute, for the property test. */
+const filterFromScratch = (rows, predicate) => indexById(rows.filter((row) => predicate(row.value)));
+/**
+* `map`/select — project each value through an arbitrary JS function, keeping
+* the row id (projection preserves identity). Stateless: `f` is deterministic,
+* so an update's `removed` reconstructs the old projection and its `added` the
+* new one.
+*/
+const makeMap = (f) => ({ step: (delta) => ({
+	added: delta.added.map((row) => ({
+		id: row.id,
+		value: f(row.value)
+	})),
+	removed: delta.removed.map((row) => ({
+		id: row.id,
+		value: f(row.value)
+	}))
+}) });
+/** {@link makeMap}'s naive recompute. */
+const mapFromScratch = (rows, f) => indexById(rows.map((row) => ({
+	id: row.id,
+	value: f(row.value)
+})));
+/**
+* `distinct` — collapse duplicate values to one row, keyed and identified by
+* the value's canonical serialization (so value equality, not reference,
+* decides duplication and there is no hash-collision risk). A multiplicity
+* count per distinct value means removing one of several duplicates keeps the
+* distinct row; the row appears when its count goes 0→1 and disappears at 1→0.
+*/
+const makeDistinct = () => {
+	const counts = /* @__PURE__ */ new Map();
+	return { step: (delta) => {
+		const added = [];
+		const removed = [];
+		for (const row of delta.removed) {
+			const key = canonicalJson(row.value);
+			const entry = counts.get(key);
+			if (entry === void 0) continue;
+			entry.count -= 1;
+			if (entry.count === 0) {
+				counts.delete(key);
+				removed.push({
+					id: key,
+					value: entry.value
+				});
+			}
+		}
+		for (const row of delta.added) {
+			const key = canonicalJson(row.value);
+			const entry = counts.get(key);
+			if (entry === void 0) {
+				counts.set(key, {
+					count: 1,
+					value: row.value
+				});
+				added.push({
+					id: key,
+					value: row.value
+				});
+			} else entry.count += 1;
+		}
+		return {
+			added,
+			removed
+		};
+	} };
+};
+/** {@link makeDistinct}'s naive recompute (dedupe by canonical value). */
+const distinctFromScratch = (rows) => {
+	const result = /* @__PURE__ */ new Map();
+	for (const row of rows) {
+		const key = canonicalJson(row.value);
+		if (!result.has(key)) result.set(key, {
+			id: key,
+			value: row.value
+		});
+	}
+	return result;
+};
+/**
+* `groupBy` returning grouped **rows** (not only scalar aggregates): one output
+* row per group, `value` = `{ key, rows }` where `rows` are the group members'
+* values ordered by member id (a deterministic within-group order, so a
+* from-scratch recompute matches). Only the one or two groups a delta touches
+* re-materialize — every other group's row is untouched (the same
+* touch-only-the-affected-bucket discipline as `Aggregate`'s grouped state).
+*/
+const makeGroupBy = (key) => {
+	const groups = /* @__PURE__ */ new Map();
+	const groupOf = /* @__PURE__ */ new Map();
+	const lastRow = /* @__PURE__ */ new Map();
+	const groupRow = (groupKey) => {
+		return {
+			id: groupKey,
+			value: {
+				key: groupKey,
+				rows: [...groups.get(groupKey)?.entries() ?? []].toSorted(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([, value]) => value)
+			}
+		};
+	};
+	return { step: (delta) => {
+		const touched = /* @__PURE__ */ new Set();
+		for (const row of delta.removed) {
+			const groupKey = groupOf.get(row.id);
+			if (groupKey === void 0) continue;
+			const members = groups.get(groupKey);
+			members?.delete(row.id);
+			groupOf.delete(row.id);
+			if (members?.size === 0) groups.delete(groupKey);
+			touched.add(groupKey);
+		}
+		for (const row of delta.added) {
+			const groupKey = key(row.value);
+			let members = groups.get(groupKey);
+			if (members === void 0) {
+				members = /* @__PURE__ */ new Map();
+				groups.set(groupKey, members);
+			}
+			members.set(row.id, row.value);
+			groupOf.set(row.id, groupKey);
+			touched.add(groupKey);
+		}
+		const added = [];
+		const removed = [];
+		for (const groupKey of touched) {
+			const previous = lastRow.get(groupKey);
+			if (previous !== void 0) removed.push(previous);
+			if (groups.has(groupKey)) {
+				const next = groupRow(groupKey);
+				added.push(next);
+				lastRow.set(groupKey, next);
+			} else lastRow.delete(groupKey);
+		}
+		return {
+			added,
+			removed
+		};
+	} };
+};
+/** {@link makeGroupBy}'s naive recompute. */
+const groupByFromScratch = (rows, key) => {
+	const groups = /* @__PURE__ */ new Map();
+	for (const row of rows) {
+		const groupKey = key(row.value);
+		const bucket = groups.get(groupKey) ?? [];
+		bucket.push([row.id, row.value]);
+		groups.set(groupKey, bucket);
+	}
+	const result = /* @__PURE__ */ new Map();
+	for (const [groupKey, bucket] of groups) {
+		const ordered = bucket.toSorted(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([, value]) => value);
+		result.set(groupKey, {
+			id: groupKey,
+			value: {
+				key: groupKey,
+				rows: ordered
+			}
+		});
+	}
+	return result;
+};
+const NUL = "\0";
+const defaultCombine = (left, right) => ({
+	left,
+	right
+});
+/** A join key's canonical string, or `undefined` for a non-joining `null`/`undefined` key. */
+const joinKey = (value) => value === null || value === void 0 ? void 0 : canonicalJson(value);
+/** Build a {@link JoinOperator} for the given join keys and kind (inner or left). */
+const makeJoin = (options) => {
+	const combine = options.combine ?? defaultCombine;
+	const leftById = /* @__PURE__ */ new Map();
+	const rightById = /* @__PURE__ */ new Map();
+	const rightByKey = /* @__PURE__ */ new Map();
+	const leftByKey = /* @__PURE__ */ new Map();
+	const contribution = /* @__PURE__ */ new Map();
+	const contributionOf = (leftId) => {
+		const out = /* @__PURE__ */ new Map();
+		const left = leftById.get(leftId);
+		if (left === void 0) return out;
+		const key = joinKey(options.leftKey(left.value));
+		const rights = key === void 0 ? void 0 : rightByKey.get(key);
+		if (rights !== void 0 && rights.size > 0) for (const [rightId, rightValue] of rights) {
+			const id = `${leftId}${NUL}${rightId}`;
+			out.set(id, {
+				id,
+				value: combine(left.value, rightValue)
+			});
+		}
+		else if (options.kind === "left") {
+			const id = `${leftId}${NUL}`;
+			out.set(id, {
+				id,
+				value: combine(left.value, null)
+			});
+		}
+		return out;
+	};
+	/** Recompute one left row's contribution and emit the diff against its last. */
+	const reconcile = (leftId, added, removed) => {
+		const previous = contribution.get(leftId) ?? /* @__PURE__ */ new Map();
+		const next = contributionOf(leftId);
+		for (const [id, row] of previous) if (!next.has(id)) removed.push(row);
+		for (const [id, row] of next) {
+			const prior = previous.get(id);
+			if (prior === void 0) added.push(row);
+			else if (contentHash(prior.value) !== contentHash(row.value)) {
+				removed.push(prior);
+				added.push(row);
+			}
+		}
+		if (next.size > 0) contribution.set(leftId, next);
+		else contribution.delete(leftId);
+	};
+	const indexLeft = (row) => {
+		leftById.set(row.id, row);
+		const key = joinKey(options.leftKey(row.value));
+		if (key === void 0) return;
+		const set = leftByKey.get(key) ?? /* @__PURE__ */ new Set();
+		set.add(row.id);
+		leftByKey.set(key, set);
+	};
+	const unindexLeft = (row) => {
+		leftById.delete(row.id);
+		const key = joinKey(options.leftKey(row.value));
+		if (key === void 0) return;
+		const set = leftByKey.get(key);
+		if (set === void 0) return;
+		set.delete(row.id);
+		if (set.size === 0) leftByKey.delete(key);
+	};
+	const putRight = (row, keys) => {
+		const key = joinKey(options.rightKey(row.value));
+		rightById.set(row.id, row);
+		if (key === void 0) return;
+		const bucket = rightByKey.get(key) ?? /* @__PURE__ */ new Map();
+		bucket.set(row.id, row.value);
+		rightByKey.set(key, bucket);
+		keys.add(key);
+	};
+	const removeRight = (row, keys) => {
+		const key = joinKey(options.rightKey(row.value));
+		rightById.delete(row.id);
+		if (key === void 0) return;
+		const bucket = rightByKey.get(key);
+		if (bucket === void 0) return;
+		bucket.delete(row.id);
+		if (bucket.size === 0) rightByKey.delete(key);
+		keys.add(key);
+	};
+	return {
+		stepLeft: (delta) => {
+			const affected = /* @__PURE__ */ new Set();
+			for (const row of delta.removed) {
+				unindexLeft(row);
+				affected.add(row.id);
+			}
+			for (const row of delta.added) {
+				const prior = leftById.get(row.id);
+				if (prior !== void 0) unindexLeft(prior);
+				indexLeft(row);
+				affected.add(row.id);
+			}
+			const added = [];
+			const removed = [];
+			for (const leftId of affected) reconcile(leftId, added, removed);
+			return {
+				added,
+				removed
+			};
+		},
+		stepRight: (delta) => {
+			const keys = /* @__PURE__ */ new Set();
+			for (const row of delta.removed) removeRight(row, keys);
+			for (const row of delta.added) {
+				const prior = rightById.get(row.id);
+				if (prior !== void 0) removeRight(prior, keys);
+				putRight(row, keys);
+			}
+			const affectedLefts = /* @__PURE__ */ new Set();
+			for (const key of keys) {
+				const ids = leftByKey.get(key);
+				if (ids !== void 0) for (const id of ids) affectedLefts.add(id);
+			}
+			const added = [];
+			const removed = [];
+			for (const leftId of affectedLefts) reconcile(leftId, added, removed);
+			return {
+				added,
+				removed
+			};
+		}
+	};
+};
+/** {@link makeJoin}'s naive recompute (nested-loop join by key equality). */
+const joinFromScratch = (left, right, options) => {
+	const combine = options.combine ?? defaultCombine;
+	const rightByKey = /* @__PURE__ */ new Map();
+	for (const row of right) {
+		const key = joinKey(options.rightKey(row.value));
+		if (key === void 0) continue;
+		const bucket = rightByKey.get(key) ?? [];
+		bucket.push(row);
+		rightByKey.set(key, bucket);
+	}
+	const result = /* @__PURE__ */ new Map();
+	for (const leftRow of left) {
+		const key = joinKey(options.leftKey(leftRow.value));
+		const matches = key === void 0 ? void 0 : rightByKey.get(key);
+		if (matches !== void 0 && Arr.isReadonlyArrayNonEmpty(matches)) for (const rightRow of matches) {
+			const id = `${leftRow.id}${NUL}${rightRow.id}`;
+			result.set(id, {
+				id,
+				value: combine(leftRow.value, rightRow.value)
+			});
+		}
+		else if (options.kind === "left") {
+			const id = `${leftRow.id}${NUL}`;
+			result.set(id, {
+				id,
+				value: combine(leftRow.value, null)
+			});
+		}
+	}
+	return result;
+};
+/** The subset an ordered window maintains (an always-true `where` over derived rows). */
+const windowSubset = (orderBy, limit) => make$5({
+	collection: "",
+	orderBy,
+	...limit === void 0 ? {} : { limit }
+});
+/**
+* `orderedWindow` — sort derived rows by an `orderBy` and keep the first
+* `limit`. Reuses `LiveView` (the `OrderedTree` + fractional-index machinery of
+* #112): a delta is folded in as O(log n) `put`/`del`s and the window resliced
+* without a re-sort, so a change outside the page costs the same as one inside
+* it. Order is `Subset.comparator` — the one ordering authority (ADR-0026), so
+* "no orderBy" still means a stable id-ascending order.
+*/
+const makeOrderedWindow = (orderBy, limit) => {
+	const subset = windowSubset(orderBy, limit);
+	let view = make$6(subset, []);
+	return { step: (delta) => {
+		for (const row of delta.removed) view = del(view, row.id);
+		for (const row of delta.added) view = put(view, {
+			id: row.id,
+			value: row.value
+		});
+		return result(view).map((row) => ({
+			id: row.id,
+			value: row.value
+		}));
+	} };
+};
+/** {@link makeOrderedWindow}'s naive recompute (`Subset.apply`: sort then window). */
+const orderedWindowFromScratch = (rows, orderBy, limit) => apply(rows, windowSubset(orderBy, limit)).map((row) => ({
+	id: row.id,
+	value: row.value
+}));
+// src/Derive.ts
+var Derive_exports = /* @__PURE__ */ __exportAll({
+	atom: () => atom,
+	distinct: () => distinct,
+	filter: () => filter,
+	groupBy: () => groupBy,
+	join: () => join,
+	map: () => map,
+	observed: () => observed,
+	orderedWindow: () => orderedWindow,
+	select: () => select
+});
+const CHANGES = Symbol.for("@thomasfosterau/legation/Derive/changes");
+const withChanges = (pages, changes) => Object.assign(pages, { [CHANGES]: changes });
+const isChangeTagged = (source) => CHANGES in source;
+const changesOf = (source) => isChangeTagged(source) ? source[CHANGES] : void 0;
+const sameRow = (a, b) => a === b || a.id === b.id && contentHash(a.value) === contentHash(b.value);
+/**
+* Two derived pages are equal when they have the same rows in the same order.
+* Set combinators emit in a stable id order (see {@link Incremental.pageOf}) and
+* `orderedWindow` in its comparator order, so a positional compare never sees a
+* spurious reorder — a genuine no-op step re-emits nothing.
+*/
+const samePage = (a, b) => a.length === b.length && a.every((row, i) => {
+	const other = b[i];
+	return other !== void 0 && sameRow(row, other);
+});
+/**
+* Recover a delta per emission from any `Source`: when it carries the
+* {@link CHANGES} tag (built by `observed` over a `ClientView`), read the
+* delta `LiveView` already computed (`Incremental.deltaFromChanges`);
+* otherwise diff each page against the last snapshot
+* ({@link Incremental.diff}), the pre-#115 fallback for a plain page source.
+* Every combinator funnels through this so the tag needs checking once, not
+* once per combinator.
+*/
+const toDeltaStream = (source) => {
+	const changes = changesOf(source);
+	return changes !== void 0 ? changes.pipe(Stream.mapAccum(() => /* @__PURE__ */ new Map(), (known, batch) => [known, [deltaFromChanges(known, batch)]])) : source.pipe(Stream.mapAccum(() => /* @__PURE__ */ new Map(), (last, page) => {
+		const { delta, index } = diff(last, page);
+		return [index, [delta]];
+	}));
+};
+/**
+* Drive one delta→delta {@link Incremental.Operator} over a source's deltas
+* ({@link toDeltaStream}): step the operator, fold the output delta into a
+* maintained result, and emit the result as a page (deduped). The operator
+* (and its state) is built lazily per subscription, so one derived value
+* mounted from many components each gets its own maintained state.
+*/
+const maintain = (source, makeOperator) => toDeltaStream(source).pipe(Stream.mapAccum(() => ({
+	operator: makeOperator(),
+	result: /* @__PURE__ */ new Map()
+}), (state, delta) => {
+	applyDelta(state.result, state.operator.step(delta));
+	return [state, [pageOf(state.result)]];
+}), Stream.changesWith(samePage));
+/**
+* Keep the rows whose value passes an arbitrary JS predicate. The predicate is
+* never serialized and never narrows what syncs — it shapes only what is shown
+* of the already-synced page (the boundary rule above).
+*/
+const filter = (source, predicate) => maintain(source, () => makeFilter(predicate));
+/** Project each row's value through an arbitrary JS function, keeping its id. */
+const map = (source, f) => maintain(source, () => makeMap(f));
+/** {@inheritDoc map} — `select` reads better for a projection; same combinator. */
+const select = map;
+/** Collapse duplicate values to one row, keyed by the canonical value. */
+const distinct = (source) => maintain(source, () => makeDistinct());
+/**
+* Group rows by an arbitrary key function, emitting one row per group whose
+* value is `{ key, rows }` (the group's member values). A having-clause is
+* `filter` after `groupBy`; a scalar rollup is `map` over the group rows.
+*/
+const groupBy = (source, key) => maintain(source, () => makeGroupBy(key));
+/**
+* Join two derived sources on arbitrary key equality (inner or left). Merges
+* the two page streams, feeding each side's delta to the shared join operator,
+* which re-derives only the left rows a change touches. A joined row's value is
+* `{ left, right }` by default (`right` is `null` for an unmatched left row
+* under `kind: "left"`); pass `combine` to shape it otherwise.
+*/
+const join = (left, right, options) => {
+	return Stream.merge(toDeltaStream(left).pipe(Stream.map((delta) => ({
+		side: "left",
+		delta
+	}))), toDeltaStream(right).pipe(Stream.map((delta) => ({
+		side: "right",
+		delta
+	})))).pipe(Stream.mapAccum(() => ({
+		operator: makeJoin(options),
+		result: /* @__PURE__ */ new Map()
+	}), (state, event) => {
+		const outDelta = event.side === "left" ? state.operator.stepLeft(event.delta) : state.operator.stepRight(event.delta);
+		applyDelta(state.result, outDelta);
+		return [state, [pageOf(state.result)]];
+	}), Stream.changesWith(samePage));
+};
+/**
+* Sort derived rows by an `orderBy` and keep the first `limit` — an ORDER
+* BY … LIMIT over the derived result, maintained by `LiveView`'s `OrderedTree`
+* so a change outside the window costs the same as one inside it (ADR-0026's
+* one ordering authority applies, so "no orderBy" still means stable id order).
+*/
+const orderedWindow = (source, options) => toDeltaStream(source).pipe(Stream.mapAccum(() => makeOrderedWindow(options.orderBy, options.limit), (window, delta) => [window, [window.step(delta)]]), Stream.changesWith(samePage));
+/**
+* Expose a derived pipeline as an Atom on the standard reactivity surface — the
+* same shape `LiveQuery.make(...).atom(...)` produces for a raw subset, so a
+* framework binding renders a derived value with no new machinery.
+*/
+const atom = (source) => Atom.make(source);
+/**
+* Fold an `observeChanges` feed into a page stream without ever diffing a
+* page: each batch's delta ({@link Incremental.deltaFromChanges}) is folded
+* straight into a running result map. This is what `observed` returns when
+* the view has `observeChanges` — a real, standalone page stream (so it's
+* correct if consumed directly), separate from the {@link CHANGES} tag that
+* lets a combinator built on top skip this fold entirely and read the same
+* underlying batches itself.
+*/
+const pagesFromChanges = (changes) => changes.pipe(Stream.mapAccum(() => ({
+	known: /* @__PURE__ */ new Map(),
+	result: /* @__PURE__ */ new Map()
+}), (state, batch) => {
+	applyDelta(state.result, deltaFromChanges(state.known, batch));
+	return [state, [pageOf(state.result)]];
+}), Stream.changesWith(samePage));
+/**
+* A scoped leaf source: acquire a refcounted subscription for `subset` (so the
+* rows actually sync) and observe it, releasing the subscription when the scope
+* closes. A pipeline built from `observed` leaves holds all its sources'
+* subscriptions for its lifetime and drops them together on teardown — the
+* refcounted-lifetime discipline the #114 brief asks for, `Subscriptions`
+* doing the reference counting so a shared leaf is synced once.
+*
+* When `view` is a full {@link ClientView.ClientView} (not just the narrower
+* {@link ClientView.Reader}), the returned source is built from its
+* `observeChanges` feed and tagged so every combinator composed on top reads
+* that feed directly too (see the module doc). A bare `Reader` has no
+* `observeChanges` to prefer, so this falls back to `observe`'s pages,
+* unchanged.
+*/
+const observed = (subscriptions, view, subset) => Effect.gen(function* () {
+	const handle = yield* subscriptions.acquire(subset);
+	yield* Effect.addFinalizer(() => handle.release);
+	if (!("observeChanges" in view)) return view.observe(subset);
+	const changes = view.observeChanges(subset, { includeInitial: true });
+	return withChanges(pagesFromChanges(changes), changes);
+});
+// src/LiveQuery.ts
+var LiveQuery_exports = /* @__PURE__ */ __exportAll({ make: () => make$2 });
+/** Build the Atom factory for a source's live queries. */
+const make$2 = (source) => {
+	const cache = /* @__PURE__ */ new Map();
+	return { atom: (subset) => {
+		const key = hash(subset);
+		const existing = cache.get(key);
+		if (existing !== void 0) return existing;
+		const created = Atom.make(source.observe(subset));
+		cache.set(key, created);
+		return created;
+	} };
+};
+// src/EngineAtoms.ts
+var EngineAtoms_exports = /* @__PURE__ */ __exportAll({ fromLayer: () => fromLayer });
+/**
+* Build the engine's reactive surface from its layer. The layer must provide
+* `ClientEngine` with all of its own dependencies already satisfied —
+* `Atom.runtime` supplies only `AtomRegistry`/`Reactivity` and manages the
+* engine's scope for the registry's lifetime.
+*/
+const fromLayer = (engineLayer) => {
+	const runtime = Atom.runtime(engineLayer);
+	const liveQueries = /* @__PURE__ */ new Map();
+	const liveQuery = (subset) => {
+		const key = hash(subset);
+		const existing = liveQueries.get(key);
+		if (existing !== void 0) return existing;
+		const atom = runtime.atom(Stream.unwrap(Effect.map(ClientEngine, (engine) => engine.observe(subset))));
+		liveQueries.set(key, atom);
+		return atom;
+	};
+	const namedQueries = /* @__PURE__ */ new Map();
+	const namedQuery = (name, args) => {
+		const key = `${name}:${canonicalJson(args)}`;
+		const existing = namedQueries.get(key);
+		if (existing !== void 0) return existing;
+		const atom = runtime.atom(Stream.unwrap(Effect.map(ClientEngine, (engine) => engine.observeNamed(name, args))));
+		namedQueries.set(key, atom);
+		return atom;
+	};
+	const aggregates = /* @__PURE__ */ new Map();
+	const aggregate = (subset, agg) => {
+		const key = `${hash(subset)}:${canonicalJson(agg)}`;
+		const existing = aggregates.get(key);
+		if (existing !== void 0) return existing;
+		const atom = runtime.atom(Stream.unwrap(Effect.map(ClientEngine, (engine) => engine.observeAggregate(subset, agg))));
+		aggregates.set(key, atom);
+		return atom;
+	};
+	const groupedAggregates = /* @__PURE__ */ new Map();
+	const aggregateGrouped = (subset, agg, groupBy) => {
+		const key = `${hash(subset)}:${canonicalJson(agg)}:${groupBy}`;
+		const existing = groupedAggregates.get(key);
+		if (existing !== void 0) return existing;
+		const atom = runtime.atom(Stream.unwrap(Effect.map(ClientEngine, (engine) => engine.observeAggregateGrouped(subset, agg, groupBy))));
+		groupedAggregates.set(key, atom);
+		return atom;
+	};
+	const mutation = runtime.fn((arg) => Effect.flatMap(ClientEngine, (engine) => engine.mutate(arg.mutator, arg.args)));
+	const mutationWithAck = runtime.fn((arg) => Effect.flatMap(ClientEngine, (engine) => engine.mutateWithAck(arg.mutator, arg.args).pipe(Effect.flatMap((handle) => handle.acknowledged))));
+	const mutationStates = runtime.atom(Stream.unwrap(Effect.map(ClientEngine, (engine) => engine.mutationStates)));
+	const mutationsForCache = /* @__PURE__ */ new Map();
+	const mutationsFor = (mutator) => {
+		const existing = mutationsForCache.get(mutator);
+		if (existing !== void 0) return existing;
+		const atom = Atom.mapResult(mutationStates, (states) => [...HashMap.values(states)].filter((state) => state.mutator === mutator).toSorted((a, b) => a.mutationId - b.mutationId));
+		mutationsForCache.set(mutator, atom);
+		return atom;
+	};
+	return {
+		runtime,
+		liveQuery,
+		namedQuery,
+		aggregate,
+		aggregateGrouped,
+		mutation,
+		mutationWithAck,
+		mutationStates,
+		mutationsFor
+	};
+};
+// src/PromiseFacade.ts
+/**
+* PromiseFacade
+*
+* Helpers for driving the Effect-native sync engine from non-Effect code:
+* plain promises and callback subscriptions. This is what framework
+* bindings (React hooks, Vue composables, vanilla JS apps, service worker
+* scripts) build on.
+*
+* A facade wraps a `ManagedRuntime` built from the layer that provides
+* the engine's services. Effects are run with `run`/`runExit`, streams are
+* consumed with `subscribe`, and `dispose` tears everything down.
+*
+* To await a mutation's authoritative backend outcome (#36), run the handle's
+* `acknowledged` effect through `run`:
+* `facade.run(engine.mutateWithAck(m, a).pipe(Effect.flatMap((h) => h.acknowledged)))`.
+*/
+var PromiseFacade_exports = /* @__PURE__ */ __exportAll({ make: () => make$1 });
+/**
+* Build a promise/callback facade from a layer providing `R`.
+*
+* ```ts
+* const facade = makePromiseFacade(
+*   SyncCache.layer.pipe(Layer.provideMerge(MemoryCacheStore.layer()))
+* );
+* const value = await facade.run(
+*   Effect.flatMap(SyncCache.SyncCache.asEffect(), (cache) =>
+*     cache.read({ key: ["users", "1"], loader: fetchUser("1") })
+*   )
+* );
+* await facade.dispose();
+* ```
+*/
+const make$1 = (layer) => {
+	const runtime = ManagedRuntime.make(layer);
+	const run = (effect) => runtime.runPromise(effect);
+	const runExit = (effect) => runtime.runPromiseExit(effect);
+	const subscribe = (stream, listener) => {
+		const consume = Stream.runForEach(stream, (value) => Effect.sync(() => listener.onValue(value)));
+		const fiber = runtime.runFork(consume.pipe(Effect.onExit((exit) => Effect.sync(() => {
+			if (Exit.isSuccess(exit)) listener.onDone?.();
+			else if (Exit.isFailure(exit) && listener.onError !== void 0) {
+				const failure = Cause.findFail(exit.cause);
+				if (Result.isSuccess(failure)) listener.onError(failure.success.error);
+			}
+		}))));
+		return { unsubscribe: () => {
+			runtime.runFork(Fiber.interrupt(fiber));
+		} };
+	};
+	return {
+		runtime,
+		run,
+		runExit,
+		subscribe,
+		dispose: () => runtime.dispose()
+	};
+};
+// src/MirrorChannel.ts
+var MirrorChannel_exports = /* @__PURE__ */ __exportAll({ makeLoopbackPair: () => makeLoopbackPair });
+/**
+* Two linked in-memory channels: messages posted on one side arrive on the
+* other. For tests and main-thread hosting (the documented degraded mode
+* for environments without service workers).
+*/
+const makeLoopbackPair = Effect.gen(function* () {
+	const makeHub = Effect.acquireRelease(PubSub.unbounded(), (hub) => PubSub.shutdown(hub));
+	const toHost = yield* makeHub;
+	const toMirror = yield* makeHub;
+	const side = (outbound, inbound) => ({
+		post: (message) => Effect.asVoid(PubSub.publish(outbound, message)),
+		subscribe: PubSub.subscribe(inbound).pipe(Effect.map((subscription) => ({ take: PubSub.take(subscription) })))
+	});
+	return {
+		host: side(toMirror, toHost),
+		mirror: side(toHost, toMirror)
+	};
+});
+// src/EngineHost.ts
+var EngineHost_exports = /* @__PURE__ */ __exportAll({ run: () => run$2 });
+/** Whether a registration's edges are all declared by the registry; the first that is not, otherwise. */
+const undeclaredEdge = (registry, collection, edges) => {
+	const declared = relationshipsOf(registry, collection);
+	return edges.find((edge) => !declared.has(edge.name));
+};
+/** The subscription an entry reports: its registration, with the URL while a party holds it by URL. */
+const subscriptionOf = (entry) => entry.registered === void 0 ? void 0 : {
+	...entry.registered.registration,
+	...entry.urlMirrors.size > 0 && entry.registered.url !== void 0 ? { url: entry.registered.url } : {}
+};
+/** A set with one member fewer. */
+const without$1 = (set, member) => {
+	const next = new Set(set);
+	next.delete(member);
+	return next;
+};
+/** Liveness settings with their defaults applied. */
+const livenessOf = (options) => ({
+	mirrorTimeout: options.liveness?.mirrorTimeout ?? "30 seconds",
+	sweepInterval: options.liveness?.sweepInterval ?? "10 seconds"
+});
+/** The key a mirror's enhanced form submission is held under (#536): its mirror and the begin's requestId. */
+const formKey = (mirrorId, requestId) => `${mirrorId}:${requestId}`;
+/**
+* A reply's address (#546): the request's `requestId`, and its `mirrorId` when
+* the mirror sent one, so another tab with a request of the same number ignores
+* the reply. A mirror that predates it sends none and gets none back.
+*/
+const replyTo = (request) => request.mirrorId === void 0 ? { requestId: request.requestId } : {
+	requestId: request.requestId,
+	mirrorId: request.mirrorId
+};
+/** Decode a {@link MirrorProtocol.FORM_MUTATION_MUTATOR} `Mutate`'s args. */
+const decodeFormBegin = Schema.decodeUnknownEffect(FormMutationBegin);
+/** Read just the mirror a malformed form begin names, to refuse it to that mirror. */
+const decodeFormSender = Schema.decodeUnknownEffect(Schema.Struct({ mirrorId: Schema.String }));
+/**
+* Serve the engine over the channel. The inbound subscription is
+* established before this effect completes; message handling runs on a
+* scoped background fiber.
+*/
+const run$2 = (options) => Effect.gen(function* () {
+	const { channel } = options;
+	const engine = counted(options.engine);
+	const inbox = yield* channel.subscribe;
+	const active = yield* Ref.make(/* @__PURE__ */ new Map());
+	const lastSeen = yield* Ref.make(/* @__PURE__ */ new Map());
+	const marks = make$7(engine);
+	const announced = yield* Ref.make(void 0);
+	const announce = Effect.gen(function* () {
+		const registrations = yield* marks.registrations;
+		const serialised = JSON.stringify(registrations);
+		if (serialised === (yield* Ref.get(announced))) return;
+		yield* Ref.set(announced, serialised);
+		yield* channel.post({
+			_tag: "PulledRegistrations",
+			registrations
+		}).pipe(Effect.ignore);
+	});
+	const syncState = yield* Ref.make("idle");
+	const syncUntilSettled = engine.pull.pipe(Effect.ignore, Effect.andThen(Ref.modify(syncState, (state) => state === "again" ? [true, "running"] : [false, "idle"])), Effect.flatMap((again) => again ? syncUntilSettled : Effect.void));
+	const syncRegistrations = Ref.modify(syncState, (state) => state === "idle" ? [true, "running"] : [false, "again"]).pipe(Effect.flatMap((started) => started ? Effect.forkScoped(syncUntilSettled) : Effect.void), Effect.asVoid);
+	const touch = (mirrorId) => Clock.currentTimeMillis.pipe(Effect.flatMap((now) => Ref.update(lastSeen, (map) => new Map(map).set(mirrorId, now))));
+	const forget = (mirrorId) => Ref.update(lastSeen, (map) => {
+		const next = new Map(map);
+		next.delete(mirrorId);
+		return next;
+	});
+	const broadcast = (key, rows) => channel.post(mirrorUpdate(key, rows));
+	const broadcastRelated = (key, rows) => channel.post(relatedUpdate(key, rows));
+	const broadcastMutationStates = (states) => channel.post(mutationStatesUpdate(states));
+	const currentMutationStates = Stream.runHead(engine.mutationStates).pipe(Effect.map(Option.getOrElse(() => HashMap.empty())));
+	/**
+	* Register (or refcount) one broadcastable registration. `start` begins
+	* the engine registration and returns the broadcast loop to fork; a mirror
+	* joining an already-active key is hydrated from the current result. What
+	* a read's registration covers is recorded only once `start` has
+	* succeeded — the engine holds the windows — and its URL identity while
+	* some mirror holds the key by URL.
+	*/
+	const acquire = (mirrorId, key, start, registered) => Effect.gen(function* () {
+		const byUrl = registered?.url !== void 0;
+		const existing = (yield* Ref.get(active)).get(key);
+		if (existing !== void 0) {
+			const known = existing.registered?.url === void 0 ? registered : existing.registered;
+			yield* Ref.update(active, (map) => new Map(map).set(key, {
+				...existing,
+				mirrors: new Set(existing.mirrors).add(mirrorId),
+				urlMirrors: byUrl ? new Set(existing.urlMirrors).add(mirrorId) : existing.urlMirrors,
+				...known === void 0 ? {} : { registered: known }
+			}));
+			return yield* existing.hydrate;
+		}
+		const { loop, teardown, hydrate } = yield* start;
+		const fiber = yield* Effect.forkScoped(loop.pipe(Effect.ignore));
+		yield* Ref.update(active, (map) => new Map(map).set(key, {
+			mirrors: /* @__PURE__ */ new Set([mirrorId]),
+			urlMirrors: new Set(byUrl ? [mirrorId] : []),
+			fiber,
+			teardown,
+			hydrate,
+			...registered === void 0 ? {} : { registered }
+		}));
+		yield* announce;
+	});
+	/** Drop one mirror from one registration; tear it down if it was the last. */
+	const release = (mirrorId, key) => Effect.gen(function* () {
+		const entry = (yield* Ref.get(active)).get(key);
+		if (entry === void 0 || !entry.mirrors.has(mirrorId)) return;
+		const mirrors = without$1(entry.mirrors, mirrorId);
+		if (mirrors.size > 0) {
+			yield* Ref.update(active, (map) => new Map(map).set(key, {
+				...entry,
+				mirrors,
+				urlMirrors: without$1(entry.urlMirrors, mirrorId)
+			}));
+			return;
+		}
+		yield* Fiber.interrupt(entry.fiber);
+		yield* entry.teardown.pipe(Effect.ignore);
+		yield* Ref.update(active, (map) => {
+			const next = new Map(map);
+			next.delete(key);
+			return next;
+		});
+		yield* announce;
+	});
+	const handleSubscribe = (mirrorId, subset, url) => {
+		const key = hash(subset);
+		return acquire(mirrorId, key, Effect.gen(function* () {
+			yield* marks.open(key, subset);
+			yield* marks.wrap(key).subscribe(subset).pipe(Effect.tapError(() => marks.close(key)));
+			yield* syncRegistrations;
+			return {
+				loop: Stream.runForEach(engine.observe(subset), (rows) => broadcast(key, rows)).pipe(Effect.asVoid),
+				teardown: marks.wrap(key).unsubscribe(subset).pipe(Effect.ignore, Effect.andThen(marks.close(key))),
+				hydrate: engine.query(subset).pipe(Effect.flatMap((rows) => broadcast(key, rows)), Effect.ignore)
+			};
+		}), {
+			registration: {
+				root: subset,
+				edges: []
+			},
+			...url === void 0 ? {} : { url }
+		});
+	};
+	const handleSubscribeNamed = (mirrorId, name, args) => {
+		const key = namedKey(name, args);
+		return acquire(mirrorId, key, Effect.gen(function* () {
+			yield* engine.subscribeQuery(name, args);
+			yield* engine.pull.pipe(Effect.ignore);
+			return {
+				loop: Stream.runForEach(engine.observeNamed(name, args), (rows) => broadcast(key, rows)).pipe(Effect.asVoid),
+				teardown: engine.unsubscribeQuery(name, args).pipe(Effect.ignore),
+				hydrate: engine.queryNamed(name, args).pipe(Effect.flatMap((rows) => broadcast(key, rows)), Effect.ignore)
+			};
+		}));
+	};
+	const handleSubscribeRelated = (mirrorId, collection, subset, edges, url) => {
+		const key = relatedKey(collection, subset, edges);
+		const registry = options.registry ?? options.nodes?.collections;
+		if (registry === void 0) return Effect.logWarning("EngineHost: SubscribeRelated received but no collection registry was configured").pipe(Effect.andThen(broadcastRelated(key, [])), Effect.ignore);
+		return acquire(mirrorId, key, Effect.gen(function* () {
+			const undeclared = undeclaredEdge(registry, collection, edges);
+			if (undeclared !== void 0) return yield* Effect.fail(new QueryError({
+				message: `EngineHost: SubscribeRelated on "${collection}" names an edge the registry does not declare: "${undeclared.name}"`,
+				query: collection
+			}));
+			const scope = yield* Scope.fork(yield* Effect.scope);
+			yield* marks.open(key, subset);
+			const stream = yield* related(marks.wrap(key), registry, collection, subset, edges).pipe(Scope.provide(scope), Effect.tapError(() => marks.close(key)));
+			return {
+				loop: Stream.runForEach(stream, (rows) => broadcastRelated(key, rows)),
+				teardown: Scope.close(scope, Exit.void).pipe(Effect.andThen(marks.close(key))),
+				hydrate: query(engine, registry, collection, subset, edges).pipe(Effect.flatMap((rows) => broadcastRelated(key, rows)), Effect.ignore)
+			};
+		}).pipe(Effect.tapError((error) => Effect.logWarning(`EngineHost: SubscribeRelated rejected: ${String(error)}`))), {
+			registration: {
+				root: subset,
+				edges
+			},
+			...url === void 0 ? {} : { url }
+		});
+	};
+	const handleSubscribeMutationStates = (mirrorId) => acquire(mirrorId, MUTATION_STATES_KEY, Effect.succeed({
+		loop: Stream.runForEach(engine.mutationStates, broadcastMutationStates).pipe(Effect.asVoid),
+		teardown: Effect.void,
+		hydrate: currentMutationStates.pipe(Effect.flatMap(broadcastMutationStates), Effect.ignore)
+	}));
+	const { nodes, urls } = options;
+	const registrationOfUrl = (url) => urls === void 0 || nodes === void 0 ? Effect.fail(new QueryError({
+		message: "EngineHost: SubscribeUrl received but no `nodes`/`urls` were configured",
+		query: url
+	})) : Effect.gen(function* () {
+		const read = yield* urls.parse(url);
+		const plan = yield* tryPlan(nodes, read);
+		return {
+			...ofPlan(plan),
+			url: yield* urls.canonical(read)
+		};
+	});
+	const handleSubscribeUrl = (mirrorId, url) => registrationOfUrl(url).pipe(Effect.tapError((error) => Effect.logWarning(`EngineHost: SubscribeUrl "${url}" rejected: ${error.message}`)), Effect.flatMap(({ root, edges, url: canonical }) => Arr.isReadonlyArrayEmpty(edges) ? handleSubscribe(mirrorId, root, canonical) : handleSubscribe(mirrorId, root).pipe(Effect.andThen(handleSubscribeRelated(mirrorId, root.collection, root, edges, canonical)))));
+	const handleUnsubscribeUrl = (mirrorId, url) => registrationOfUrl(url).pipe(Effect.flatMap(({ root, edges }) => release(mirrorId, hash(root)).pipe(Effect.andThen(Arr.isReadonlyArrayEmpty(edges) ? Effect.void : release(mirrorId, relatedKey(root.collection, root, edges))))), Effect.ignore);
+	const handleRead = (request, subsets) => (engine.readThrough === void 0 ? Effect.fail(new TransportError({ message: "Host transport does not support reads" })) : engine.readThrough(subsets)).pipe(Effect.flatMap((rows) => channel.post({
+		_tag: "ReadResult",
+		...replyTo(request),
+		rows: rows.map((row) => ({
+			collection: row.collection,
+			id: row.id,
+			value: row.value
+		}))
+	})), Effect.catch((error) => channel.post({
+		_tag: "ReadResult",
+		...replyTo(request),
+		rows: [],
+		error: error.message
+	})));
+	const forms = yield* Ref.make(HashMap.empty());
+	const takeForm = (key) => Ref.modify(forms, (map) => [HashMap.get(map, key), HashMap.remove(map, key)]);
+	const beginForm = (requestId, begin) => touch(begin.mirrorId).pipe(Effect.andThen(engine.beginFormMutationEncoded(begin.form, begin.mutator, begin.args)), Effect.flatMap((submission) => Ref.update(forms, HashMap.set(formKey(begin.mirrorId, requestId), submission))), Effect.matchEffect({
+		onFailure: (error) => channel.post({
+			_tag: "FormMutationFailed",
+			mirrorId: begin.mirrorId,
+			requestId,
+			message: error.message
+		}),
+		onSuccess: () => channel.post({
+			_tag: "FormMutationBegun",
+			mirrorId: begin.mirrorId,
+			requestId
+		})
+	}));
+	const handleBeginForm = (message) => decodeFormBegin(message.args).pipe(Effect.matchEffect({
+		onSuccess: (begin) => beginForm(message.requestId, begin),
+		onFailure: (error) => decodeFormSender(message.args).pipe(Effect.flatMap(({ mirrorId }) => channel.post({
+			_tag: "FormMutationFailed",
+			mirrorId,
+			requestId: message.requestId,
+			message: error.message
+		})), Effect.catch(() => Effect.logWarning("EngineHost: dropped a form begin that names no mirror")))
+	}));
+	const handleEndForm = (message) => takeForm(formKey(message.mirrorId, message.requestId)).pipe(Effect.flatMap(Option.match({
+		onNone: () => Effect.void,
+		onSome: (submission) => message.ruling === void 0 ? submission.abandon : submission.settle(message.ruling)
+	})), Effect.matchEffect({
+		onFailure: (error) => channel.post({
+			_tag: "FormMutationEnded",
+			mirrorId: message.mirrorId,
+			requestId: message.requestId,
+			error: error.message
+		}),
+		onSuccess: () => channel.post({
+			_tag: "FormMutationEnded",
+			mirrorId: message.mirrorId,
+			requestId: message.requestId
+		})
+	}));
+	const abandonForms = (mirrorId) => Ref.modify(forms, (map) => {
+		const prefix = `${mirrorId}:`;
+		return [[...HashMap.values(HashMap.filter(map, (_, key) => key.startsWith(prefix)))], HashMap.filter(map, (_, key) => !key.startsWith(prefix))];
+	}).pipe(Effect.flatMap((held) => Effect.forEach(held, (submission) => submission.abandon, {
+		concurrency: 1,
+		discard: true
+	})));
+	const handleDisconnect = (mirrorId) => Effect.gen(function* () {
+		const keys = [...yield* Ref.get(active)].filter(([, entry]) => entry.mirrors.has(mirrorId)).map(([key]) => key);
+		yield* Effect.forEach(keys, (key) => Effect.gen(function* () {
+			yield* release(mirrorId, key);
+		}), {
+			concurrency: 1,
+			discard: true
+		});
+		yield* abandonForms(mirrorId);
+		yield* forget(mirrorId);
+	});
+	const postSettled = (request, outcome) => channel.post({
+		_tag: "MutateSettled",
+		...replyTo(request),
+		outcome: outcome._tag,
+		...outcome._tag === "rejected" ? { reason: outcome.reason } : {}
+	});
+	const handleMutate = (message) => message.mutator === "@thomasfosterau/legation/beginFormMutation" ? handleBeginForm(message) : handleJournaledMutate(message);
+	const handleJournaledMutate = (message) => engine.mutateWithAck(message.mutator, message.args).pipe(Effect.flatMap((mutation) => channel.post({
+		_tag: "MutateAck",
+		...replyTo(message)
+	}).pipe(Effect.andThen(Effect.forkScoped(mutation.acknowledged.pipe(Effect.flatMap((outcome) => postSettled(message, outcome))))))), Effect.catch((error) => channel.post({
+		_tag: "MutateError",
+		...replyTo(message),
+		message: error.message
+	})));
+	const handle = (message) => {
+		switch (message._tag) {
+			case "Mutate": return handleMutate(message);
+			case "EndFormMutation": return touch(message.mirrorId).pipe(Effect.andThen(handleEndForm(message)));
+			case "Subscribe": return touch(message.mirrorId).pipe(Effect.andThen(handleSubscribe(message.mirrorId, message.subset)));
+			case "Unsubscribe": return touch(message.mirrorId).pipe(Effect.andThen(release(message.mirrorId, hash(message.subset))));
+			case "SubscribeNamed": return touch(message.mirrorId).pipe(Effect.andThen(handleSubscribeNamed(message.mirrorId, message.name, message.args)));
+			case "UnsubscribeNamed": return touch(message.mirrorId).pipe(Effect.andThen(release(message.mirrorId, namedKey(message.name, message.args))));
+			case "SubscribeRelated": return touch(message.mirrorId).pipe(Effect.andThen(handleSubscribeRelated(message.mirrorId, message.collection, message.subset, message.edges)));
+			case "UnsubscribeRelated": return touch(message.mirrorId).pipe(Effect.andThen(release(message.mirrorId, relatedKey(message.collection, message.subset, message.edges))));
+			case "SubscribeUrl": return touch(message.mirrorId).pipe(Effect.andThen(handleSubscribeUrl(message.mirrorId, message.url)));
+			case "UnsubscribeUrl": return touch(message.mirrorId).pipe(Effect.andThen(handleUnsubscribeUrl(message.mirrorId, message.url)));
+			case "Read": return handleRead(message, message.subsets);
+			case "SubscribeMutationStates": return touch(message.mirrorId).pipe(Effect.andThen(handleSubscribeMutationStates(message.mirrorId)));
+			case "UnsubscribeMutationStates": return touch(message.mirrorId).pipe(Effect.andThen(release(message.mirrorId, MUTATION_STATES_KEY)));
+			case "Disconnect": return handleDisconnect(message.mirrorId);
+			case "Heartbeat": return touch(message.mirrorId);
+		}
+	};
+	const { mirrorTimeout, sweepInterval } = livenessOf(options);
+	const sweep = Effect.gen(function* () {
+		const cutoff = (yield* Clock.currentTimeMillis) - Duration.toMillis(mirrorTimeout);
+		const stale = [...yield* Ref.get(lastSeen)].filter(([, seen]) => seen < cutoff).map(([mirrorId]) => mirrorId);
+		yield* Effect.forEach(stale, (mirrorId) => Effect.gen(function* () {
+			yield* handleDisconnect(mirrorId);
+		}), {
+			concurrency: 1,
+			discard: true
+		});
+	});
+	yield* Effect.forkScoped(Effect.forever(sweep.pipe(Effect.andThen(Effect.sleep(sweepInterval)))));
+	const pullEvents = yield* Stream.toPull(engine.engineEvents);
+	yield* Effect.forkScoped(Effect.forever(pullEvents.pipe(Effect.flatMap((events) => Effect.forEach(events, (event) => event._tag === "PullCompleted" ? announce : Effect.void, { discard: true })))).pipe(Effect.ignore));
+	yield* Effect.forkScoped(Effect.forever(inbox.take.pipe(Effect.flatMap(decodeMirrorMessage), Effect.flatMap((message) => message === void 0 ? Effect.void : handle(message).pipe(Effect.ignore)))));
+	yield* announce;
+	yield* channel.post({ _tag: "HostReady" }).pipe(Effect.ignore);
+	return { registrations: Effect.all({
+		entries: Ref.get(active),
+		pulled: marks.registrations
+	}).pipe(Effect.map(({ entries, pulled }) => {
+		const summaries = new Map(pulled.map((entry) => [entry.key, entry.pulled]));
+		return [...entries].flatMap(([key, entry]) => {
+			const subscription = subscriptionOf(entry);
+			return subscription === void 0 ? [] : [{
+				...subscription,
+				pulled: summaries.get(key) ?? NOT_PULLED
+			}];
+		});
+	})) };
+});
+// src/FilterCorpus.ts
+/**
+* FilterCorpus
+*
+* Seeded generators for the differential filter harness (issue #153,
+* ADR-0028). Three evaluators of one predicate AST exist — `Predicate.evaluate`
+* in JS, `Sql.compileWhere` on SQLite, and `Sql.compileWhere` on Postgres —
+* and Postgres is normative: every other evaluator must agree with it
+* exactly. This module produces the corpus they are compared over: random
+* rows over a fixed fixture schema (text, integer, double, boolean, ISO
+* instant) including NULL, absent fields, empty strings, boundary numerics,
+* and non-ASCII text up to astral characters; random depth-bounded
+* predicates covering every operator in the core; random `orderBy` terms;
+* and a minimiser that shrinks a disagreeing predicate/row pair to its
+* smallest reproducing form.
+*
+* The generators are Effects over Effect's `Random` service, and
+* `generateCorpus` runs them under `Random.withSeed(seed)` — Effect's own
+* seedable generator — so a seed reproduces a corpus exactly and a failure
+* reports the seed. This is the repo's shared corpus module; the property
+* tests elsewhere still carry their own hand-rolled mulberry32 copies (no
+* `fast-check` in the dependency set), and `Random.withSeed` is the idiom
+* to reach for instead of another copy.
+*
+* Rule (d) of ADR-0028 — no cross-type comparison — is enforced here by
+* construction: a leaf's literal always has its column's kind. Rule (e)
+* fixes the literal kinds (`Predicate.LiteralKind`): `text`, `integer` (int4
+* range), `double` precision, `boolean`, and `instant` as `Date#toISOString`
+* text compared as text.
+*
+* `Exists` is never generated; it is relational and has no single-row
+* meaning.
+*/
+var FilterCorpus_exports = /* @__PURE__ */ __exportAll({
+	DEFAULT_SEED: () => DEFAULT_SEED,
+	corpusColumns: () => corpusColumns,
+	emptyCoverage: () => emptyCoverage,
+	formatDisagreement: () => formatDisagreement,
+	generateCorpus: () => generateCorpus,
+	generateOrderBy: () => generateOrderBy,
+	generatePredicate: () => generatePredicate,
+	generateRows: () => generateRows,
+	leafOperators: () => leafOperators,
+	minimise: () => minimise,
+	minimumRows: () => minimumRows,
+	resolveSeed: () => resolveSeed,
+	shrinkPredicate: () => shrinkPredicate
+});
+/** A uniform integer in `[0, max)`. */
+const int = (max) => Random.nextIntBetween(0, max, { halfOpen: true });
+/** A uniform pick from a non-empty list (an empty one is a generator bug). */
+const pick = (xs) => Random.choice(xs).pipe(Effect.orDie);
+/** `true` with probability `p`. */
+const chance = (p) => Effect.map(Random.next, (roll) => roll < p);
+/** The default corpus seed; `LEGATION_CORPUS_SEED` overrides it. */
+const DEFAULT_SEED = 20260902;
+/**
+* Resolve the corpus seed from an optional environment override (the value
+* of `LEGATION_CORPUS_SEED`). Callers pass the variable in so this module
+* stays free of `process` (it ships in the engine core, which also runs in
+* browsers).
+*/
+const resolveSeed = (override) => {
+	if (override === void 0 || override.trim() === "") return DEFAULT_SEED;
+	const seed = Number(override);
+	if (!Number.isInteger(seed)) throw new Error(`LEGATION_CORPUS_SEED must be an integer, got ${JSON.stringify(override)}`);
+	return seed;
+};
+/**
+* The harness's fixture table `corpus`: every non-id column is nullable.
+* Postgres declares `COLLATE "C"` on `id` and `s` and stores `t` as
+* `timestamptz`; SQLite uses `BINARY` text throughout.
+*/
+const corpusColumns = [
+	{
+		name: "s",
+		kind: "text"
+	},
+	{
+		name: "i",
+		kind: "integer"
+	},
+	{
+		name: "d",
+		kind: "double"
+	},
+	{
+		name: "b",
+		kind: "boolean"
+	},
+	{
+		name: "t",
+		kind: "instant"
+	}
+];
+const resolveOptions = (options) => ({
+	nulls: options?.nulls ?? true,
+	astral: options?.astral ?? true,
+	booleanOrder: options?.booleanOrder ?? true
+});
+const ASCII_STRINGS = [
+	"",
+	"a",
+	"b",
+	"abc",
+	"abd",
+	"A",
+	"Z",
+	"z",
+	" ",
+	"a b",
+	"0",
+	"10",
+	"9"
+];
+/** BMP non-ASCII: Latin-1, a private-use character, and the U+FFFF noncharacter. */
+const BMP_STRINGS = [
+	"é",
+	"ß",
+	"éa",
+	"",
+	"￿",
+	"ｱ"
+];
+/** Astral characters, alone and mixed with BMP text. */
+const ASTRAL_STRINGS = [
+	"😀",
+	"𝔘",
+	"􏿿",
+	"a😀",
+	"😀a",
+	"￿😀",
+	"é😀",
+	"😀😀"
+];
+const FOREIGN_STRINGS = [
+	"nope",
+	"zz",
+	"è"
+];
+const INTEGERS = [
+	0,
+	-0,
+	1,
+	-1,
+	2,
+	3,
+	7,
+	10,
+	42,
+	100,
+	-7,
+	2147483647,
+	-2147483648,
+	2147483646
+];
+const FOREIGN_INTEGERS = [
+	5,
+	-100,
+	12345
+];
+const DOUBLES = [
+	0,
+	-0,
+	.5,
+	-.5,
+	1e-7,
+	1.5,
+	2 ** 53 - 1,
+	2 ** 53,
+	2 ** 53 + 2,
+	1e300,
+	-1e-300,
+	3.25,
+	100.125,
+	-2.5
+];
+const FOREIGN_DOUBLES = [2.75, 1e-6];
+const INSTANTS = [
+	"1970-01-01T00:00:00.000Z",
+	"1999-12-31T23:59:59.999Z",
+	"2000-01-01T00:00:00.001Z",
+	"2020-02-29T12:34:56.789Z",
+	"2024-01-01T00:00:00.000Z",
+	"2038-01-19T03:14:07.000Z"
+];
+const FOREIGN_INSTANTS = ["2001-09-09T01:46:40.000Z"];
+const poolFor = (kind, options) => {
+	switch (kind) {
+		case "text": return {
+			rows: [
+				...ASCII_STRINGS,
+				...BMP_STRINGS,
+				...options.astral ? ASTRAL_STRINGS : []
+			],
+			foreign: FOREIGN_STRINGS
+		};
+		case "integer": return {
+			rows: INTEGERS,
+			foreign: FOREIGN_INTEGERS
+		};
+		case "double": return {
+			rows: DOUBLES,
+			foreign: FOREIGN_DOUBLES
+		};
+		case "boolean": return {
+			rows: [true, false],
+			foreign: []
+		};
+		case "instant": return {
+			rows: INSTANTS,
+			foreign: FOREIGN_INSTANTS
+		};
+	}
+};
+const NULL_RATE = .12;
+const planRows = (columns, options) => {
+	const pools = columns.map((column) => poolFor(column.kind, options).rows);
+	return {
+		columns,
+		pools,
+		nulls: options.nulls,
+		pinned: options.nulls ? 2 : 0,
+		sweep: Math.max(0, ...pools.map((pool) => pool.length))
+	};
+};
+/** A random field value: NULL, absent (`undefined`), or a pool value. */
+const randomField = (pool, nulls) => Effect.gen(function* () {
+	if (nulls) {
+		const roll = yield* Random.next;
+		if (roll < NULL_RATE) return null;
+		if (roll < .2) return void 0;
+	}
+	return yield* pick(pool);
+});
+const generateRow = (plan, index) => Effect.gen(function* () {
+	const value = {};
+	yield* Effect.forEach(plan.columns.entries(), ([c, column]) => Effect.gen(function* () {
+		const pool = plan.pools[c] ?? [];
+		let field;
+		if (index < plan.pinned) field = index === 0 ? null : void 0;
+		else if (index < plan.pinned + plan.sweep) field = pool[(index - plan.pinned) % pool.length];
+		else field = yield* randomField(pool, plan.nulls);
+		if (field !== void 0) value[column.name] = field;
+	}), {
+		concurrency: 1,
+		discard: true
+	});
+	return {
+		id: `r${String(index).padStart(3, "0")}`,
+		value
+	};
+});
+/**
+* The fewest rows {@link generateRows} accepts for `columns` under
+* `options`: the pinned NULL/absent rows plus the sweep that puts every pool
+* value into every column. Fewer would silently drop guaranteed edge values.
+*/
+const minimumRows = (columns = corpusColumns, options) => {
+	const plan = planRows(columns, resolveOptions(options));
+	return plan.pinned + plan.sweep;
+};
+/**
+* Generate `count` rows over `columns`. Coverage of the edge values is
+* guaranteed, not left to chance: with `nulls` on, row 0 is all-NULL and row
+* 1 all-absent; then one row per pool position sweeps every pool value into
+* every column (int4 bounds, `-0`, `2^53±1`, the empty string, U+FFFF, the
+* astral characters, …); the remaining rows are random with NULL/absent
+* rolls. `count` below {@link minimumRows} is an error rather than a
+* truncated sweep. Ids are zero-padded ASCII (`r000`, `r001`, …) so their
+* order is the same in JS, SQLite `BINARY`, and Postgres `COLLATE "C"`,
+* keeping the id tie-break comparable across legs.
+*/
+const generateRows = (count, columns = corpusColumns, options) => {
+	const plan = planRows(columns, resolveOptions(options));
+	const minimum = plan.pinned + plan.sweep;
+	if (count < minimum) throw new Error(`generateRows needs at least ${minimum} rows for these columns (the pinned rows plus the pool sweep), got ${count}`);
+	return Effect.forEach(Array.from({ length: count }, (_, index) => index), (index) => generateRow(plan, index));
+};
+/** A fresh all-zero coverage table. */
+const emptyCoverage = () => ({
+	eq: 0,
+	ne: 0,
+	gt: 0,
+	gte: 0,
+	lt: 0,
+	lte: 0,
+	in: 0,
+	nin: 0,
+	isnull: 0,
+	and: 0,
+	or: 0,
+	not: 0,
+	true: 0
+});
+const comparison = (make) => (field, literal) => Effect.map(literal, (value) => make(field, value));
+/** The leaf operator table: one constructor per core operator. */
+const leafOperators = [
+	{
+		name: "eq",
+		ordered: false,
+		build: comparison(eq)
+	},
+	{
+		name: "ne",
+		ordered: false,
+		build: comparison(ne)
+	},
+	{
+		name: "gt",
+		ordered: true,
+		build: comparison(gt)
+	},
+	{
+		name: "gte",
+		ordered: true,
+		build: comparison(gte)
+	},
+	{
+		name: "lt",
+		ordered: true,
+		build: comparison(lt)
+	},
+	{
+		name: "lte",
+		ordered: true,
+		build: comparison(lte)
+	},
+	{
+		name: "in",
+		ordered: false,
+		build: (field, _literal, list) => Effect.map(list, (values) => isIn(field, values))
+	},
+	{
+		name: "nin",
+		ordered: false,
+		build: (field, _literal, list) => Effect.map(list, (values) => notIn(field, values))
+	},
+	{
+		name: "isnull",
+		ordered: false,
+		build: (field) => Effect.map(chance(.5), (negated) => negated ? isNotNull(field) : isNull(field))
+	}
+];
+const EMPTY_IN_RATE = .1;
+const LEAF_RATE = .55;
+const TRUE_RATE = .03;
+const FOREIGN_RATE = .3;
+/** A literal of the pool's kind: usually one that occurs, sometimes one that does not. */
+const literalFor = (pool) => Effect.gen(function* () {
+	const foreign = Arr.isReadonlyArrayNonEmpty(pool.foreign) && (yield* chance(FOREIGN_RATE));
+	return yield* pick(foreign ? pool.foreign : pool.rows);
+});
+/** An `In` list: occasionally empty, otherwise 1–4 literals. */
+const listFor = (pool) => Effect.gen(function* () {
+	if (yield* chance(EMPTY_IN_RATE)) return [];
+	const length = 1 + (yield* int(4));
+	return yield* literalFor(pool).pipe(Effect.replicateEffect(length));
+});
+const generateLeaf = (columns, options, coverage) => Effect.gen(function* () {
+	if (yield* chance(TRUE_RATE)) {
+		coverage.true++;
+		return always;
+	}
+	const column = yield* pick(columns);
+	const pool = poolFor(column.kind, options);
+	const candidates = leafOperators.filter((op) => (!op.ordered || column.kind !== "boolean" || options.booleanOrder) && (op.name !== "isnull" || options.nulls));
+	const operator = yield* pick(candidates);
+	coverage[operator.name]++;
+	return yield* operator.build(column.name, literalFor(pool), listFor(pool));
+});
+/**
+* Generate one depth-bounded predicate tree: leaves from the operator table
+* on a random column with a literal of that column's kind; `And`/`Or` with
+* 2–3 children and `Not` with one, down to `depth`. Emitted operators are
+* tallied into `coverage`.
+*/
+const generatePredicate = (columns, options, coverage, depth = 2) => {
+	const resolved = resolveOptions(options);
+	const go = (remaining) => Effect.gen(function* () {
+		if (remaining === 0 || (yield* chance(LEAF_RATE))) return yield* generateLeaf(columns, resolved, coverage);
+		const branch = yield* int(3);
+		if (branch === 2) {
+			coverage.not++;
+			return not(yield* go(remaining - 1));
+		}
+		const width = 2 + (yield* int(2));
+		const children = yield* go(remaining - 1).pipe(Effect.replicateEffect(width));
+		if (branch === 0) {
+			coverage.and++;
+			return and(...children);
+		}
+		coverage.or++;
+		return or(...children);
+	});
+	return go(depth);
+};
+/** Generate 1–2 `orderBy` terms over distinct columns with random directions. */
+const generateOrderBy = (columns = corpusColumns) => Effect.gen(function* () {
+	const count = Math.min(columns.length, 1 + (yield* int(2)));
+	const shuffled = yield* Random.shuffle(columns);
+	return yield* Effect.forEach(shuffled.slice(0, count), (column) => Effect.map(Random.nextBoolean, (asc) => ({
+		field: column.name,
+		direction: asc ? "asc" : "desc"
+	})));
+});
+/**
+* Generate a whole corpus deterministically from a seed. The generators run
+* under `Random.withSeed(options.seed)`; the seeding is suspended so every
+* run of the returned effect starts the sequence afresh and yields the same
+* corpus.
+*/
+const generateCorpus = (options) => Effect.suspend(() => {
+	const columns = options.columns ?? corpusColumns;
+	const coverage = emptyCoverage();
+	return Effect.gen(function* () {
+		const rows = yield* generateRows(options.rows ?? 64, columns, options);
+		const predicates = yield* generatePredicate(columns, options, coverage, options.depth ?? 2).pipe(Effect.replicateEffect(options.predicates ?? 200));
+		const orderBys = yield* generateOrderBy(columns).pipe(Effect.replicateEffect(options.orderBys ?? 60));
+		return {
+			seed: options.seed,
+			columns,
+			rows,
+			predicates,
+			orderBys,
+			coverage
+		};
+	}).pipe(Random.withSeed(options.seed));
+});
+const replaceAt = (xs, index, x) => xs.map((y, i) => i === index ? x : y);
+const without = (xs, index) => xs.filter((_, i) => i !== index);
+/**
+* One-step shrinks of a predicate, larger jumps first: replace a junction by
+* one child, drop one child, unwrap `Not`, drop one `In` value, then the
+* same recursively inside each child.
+*/
+const shrinkPredicate = (predicate) => {
+	switch (predicate._tag) {
+		case "And":
+		case "Or": {
+			const rebuild = predicate._tag === "And" ? and : or;
+			const children = predicate.predicates;
+			const out = [];
+			if (children.length > 1) {
+				out.push(...children);
+				out.push(...children.map((_, i) => rebuild(...without(children, i))));
+			}
+			children.forEach((child, i) => {
+				Arr.forEach(shrinkPredicate(child), (shrunk) => {
+					out.push(rebuild(...replaceAt(children, i, shrunk)));
+				});
+			});
+			return out;
+		}
+		case "Not": return [predicate.predicate, ...shrinkPredicate(predicate.predicate).map(not)];
+		case "In":
+		case "NotIn": {
+			const rebuild = predicate._tag === "In" ? isIn : notIn;
+			return predicate.values.length > 1 ? predicate.values.map((_, i) => rebuild(predicate.field, without(predicate.values, i))) : [];
+		}
+		default: return [];
+	}
+};
+const MAX_SHRINK_STEPS = 1e3;
+/**
+* Greedily shrink a disagreeing case while `disagrees` keeps holding:
+* predicate shrinks first, then row removals, restarting from the smallest
+* accepted candidate until no candidate still disagrees. `disagrees` runs the
+* subjects, so it is an Effect (the SQL legs are asynchronous).
+*/
+const minimise = (failing, disagrees) => {
+	const round = (current, steps) => {
+		if (steps >= MAX_SHRINK_STEPS) return Effect.succeed(current);
+		const candidates = [...shrinkPredicate(current.predicate).map((predicate) => ({
+			predicate,
+			rows: current.rows
+		})), ...current.rows.map((_, i) => ({
+			predicate: current.predicate,
+			rows: without(current.rows, i)
+		}))];
+		let tried = 0;
+		return Effect.findFirst(candidates, (candidate) => {
+			tried++;
+			return disagrees(candidate);
+		}).pipe(Effect.flatMap((accepted) => Option.isSome(accepted) ? round(accepted.value, steps + tried) : Effect.succeed(current)));
+	};
+	return round(failing, 0);
+};
+/**
+* `JSON.stringify` that keeps `-0` visible (as the string `"-0"`): plain
+* JSON prints it as `0`, and a minimal case built on `-0` would not
+* reproduce from its own report.
+*/
+const print = (value) => JSON.stringify(value, (_key, field) => Object.is(field, -0) ? "-0" : field);
+/**
+* Render a disagreement: the seed, the (minimal) predicate or order terms,
+* the (minimal) rows — absent keys stay absent, `null` prints as `null`,
+* `-0` prints as `"-0"` — and every subject's ids.
+*/
+const formatDisagreement = (disagreement) => {
+	const reproduce = disagreement.reproduce ?? "set LEGATION_CORPUS_SEED to reproduce";
+	const lines = [`${disagreement.subject} (seed ${disagreement.seed}; ${reproduce})`];
+	if (disagreement.predicate !== void 0) lines.push(`predicate: ${print(disagreement.predicate)}`);
+	if (disagreement.orderBy !== void 0) lines.push(`orderBy: ${print(disagreement.orderBy)}`);
+	lines.push("rows:");
+	Arr.forEach(disagreement.rows, (row) => {
+		lines.push(`  ${row.id} ${print(row.value)}`);
+	});
+	Arr.forEach(Object.entries(disagreement.results), ([name, ids]) => {
+		lines.push(`${name}: ${JSON.stringify(ids)}`);
+	});
+	return lines.join("\n");
+};
+// src/BackendContract.ts
+/**
+* BackendContract
+*
+* The executable specification of the Backend contract (ADR-0009).
+* `verifyBackendContract` drives an implementation through the guarantees
+* documented in Backend.ts — in-order application, idempotent skip, gap
+* rejection, bump-atomic-with-effects (for both a transient failure and a
+* permanent rejection), version-bumping writes, reference subset-evaluation
+* semantics (Subset.apply), and client-group isolation — failing with a
+* ContractViolation naming the broken rule.
+*
+* The backend under test must register the contract mutators (the
+* definitions below; `memoryHandlers` is the ready-made registration for
+* MemoryBackend-style backends). Verification writes rows into the
+* configured contract collections, so run it against disposable instances.
+*
+* Visibility before the bump (guarantee 1) is not a rule here. The rules make
+* one call at a time, so the harness never observes a backend mid-mutation:
+* that needs a handler parked after its write, which only the backend's own
+* handler can express, and its concurrency differs per backend. Each backend
+* therefore discharges it itself: `MemoryBackend` by its stage (covered by
+* `memory-backend-atomicity.test.ts`, "keeps a handler's writes and its bump
+* invisible until the mutation commits"). `SqlBackend` by its transaction
+* (`sql-backend-visibility.test.ts`: a second connection reads nothing of a
+* parked handler's write or bump). `JsonApiBackend` by the server's
+* all-or-nothing batch (`jsonapi-atomic-contract.test.ts`, "JsonApiBackend
+* visibility before the bump"). A new backend must add its own mid-flight test
+* before it can claim guarantee 1.
+*
+* Serialisability across client groups (guarantee 1, #353) is a rule: rule 11
+* parks a handler after its read, lets another group commit a write to the same
+* row, then resumes the handler and checks that no write was lost. Its handler
+* parks through {@link park}, the one seam a backend's own counter handler needs
+* to expose the read-then-write window. The gate is named by a string in the
+* mutator's args, so the mutation stays serialisable like any other.
+*
+* A backend that caches the rows a listing returns must keep that cache in line
+* with its own writes: rule 12 lists a collection, applies an update and a delete
+* to listed rows through the backend, and checks that `getRows` returns the
+* post-write value and omits the deleted row, without a re-list (#444). It uses
+* the existing `putRow` and `delRow` mutators and the `evaluate` collection.
+*
+* **Types and runtime (#177, ADR-0009's amendment).** A backend whose
+* `applyMutations` is built with `Backend.transaction` gets the ledger's
+* ordering rules by construction: in-order application, idempotent skip and gap
+* rejection (rules 1–3), and the bump travelling with each outcome, a rejection
+* committing no effects (rules 4, 9 and 10). The store keeps one obligation:
+* its `commit` (or `atomically`) must really be atomic and isolated. Types cannot
+* see that, so this suite still runs every rule against every backend, built
+* through the combinator or by hand. Evaluation (rules 6 and 14), row versions,
+* `getRows`, isolation and the rejection list (rules 5, 7, 8, 12 and 13) are
+* behaviour, and stay runtime only.
+*
+* A backend that provides the optional `evaluateMany` (#505) must agree with
+* its own `evaluate`: rule 14 asks for rule 6's subsets, the generated corpus
+* included, in one call and checks each list against `evaluate` for that
+* subset. A backend without it passes that rule vacuously.
+*/
+var BackendContract_exports = /* @__PURE__ */ __exportAll({
+	ContractViolation: () => ContractViolation,
+	countUp: () => countUp,
+	delRow: () => delRow,
+	failAlways: () => failAlways,
+	memoryHandlers: () => memoryHandlers,
+	park: () => park,
+	putRow: () => putRow,
+	rejectAlways: () => rejectAlways,
+	verifyBackendContract: () => verifyBackendContract,
+	writeThenFail: () => writeThenFail
+});
+/** A backend broke one of the contract's guarantees. */
+var ContractViolation = class extends Schema.TaggedError()("ContractViolation", {
+	rule: Schema.String,
+	message: Schema.String
+}) {};
+/** The gates the harness has registered, by name. Args carry the name, never the gate. */
+const parkGates = /* @__PURE__ */ new Map();
+/**
+* The park a `contract/count-up` handler takes between its read and its write.
+* When the harness has registered `gate`, it signals that the handler is parked
+* and waits until the harness releases it; for any other name it does nothing.
+* Only the contract's `countUp` handler calls it, so no production handler should.
+*/
+const park = (gate) => {
+	const registered = parkGates.get(gate);
+	return registered === void 0 ? Effect.void : Deferred.succeed(registered.entered, void 0).pipe(Effect.andThen(Deferred.await(registered.release)));
+};
+/** Write one row. */
+const putRow = make$8("contract/put", Schema.Struct({
+	collection: Schema.String,
+	id: Schema.String,
+	value: Schema.Unknown
+}));
+/** Delete one row. */
+const delRow = make$8("contract/del", Schema.Struct({
+	collection: Schema.String,
+	id: Schema.String
+}));
+/**
+* Fails transiently — probes that a `BackendError` aborts the batch and the
+* mutation-id bump is atomic with effects (no bump on abort).
+*/
+const failAlways = make$8("contract/fail", Schema.Struct({}));
+/** The reason `rejectAlways` gives for its permanent rejection. */
+const rejectReason = "contract/reject always rejects";
+/**
+* Writes a row and then rejects permanently — probes that a `MutationRejected`
+* bumps the id *without* leaving effects (the staged write must roll back).
+*/
+const rejectAlways = make$8("contract/reject", Schema.Struct({
+	collection: Schema.String,
+	id: Schema.String
+}));
+/**
+* Writes a row and then fails transiently — probes that a `BackendError` leaves
+* no trace of that write (the row keeps its value and version) and no bump
+* (the client's retry applies the mutation again). `failAlways` writes nothing
+* first, so it does not probe this. A backend that cannot discard a handler's
+* writes on its own failure fails this rule by design: D1 commits each
+* statement separately (#342), so it is not run through this contract. A
+* registered handler that never writes passes this rule vacuously, and the
+* contract cannot detect that: it sees only the failure.
+*/
+const writeThenFail = make$8("contract/write-then-fail", Schema.Struct({
+	collection: Schema.String,
+	id: Schema.String
+}));
+/**
+* Reads a counter row, parks after the read (see {@link park}), then writes the
+* counter plus one. Two client groups running it on one row must both count
+* (rule 11). `gate` names a park gate the harness registered, or matches none.
+*
+* A third-party backend registers its handler for this mutator under
+* `BackendContract.countUp.name` (`contract/count-up`), passes `gate` unchanged
+* to `park` between its read and its write, and writes the counter plus one. A
+* handler that omits `park` fails rule 11 with "finished without reaching park()".
+*/
+const countUp = make$8("contract/count-up", Schema.Struct({
+	collection: Schema.String,
+	id: Schema.String,
+	gate: Schema.String
+}));
+/** Ready-made authoritative handlers for MemoryBackend-style registration. */
+const memoryHandlers = validatedHandlers([
+	handler(putRow, (args, writer) => writer.put(args.collection, args.id, args.value)),
+	handler(delRow, (args, writer) => writer.del(args.collection, args.id)),
+	handler(failAlways, () => Effect.fail(new BackendError({ message: "contract/fail always fails" }))),
+	handler(rejectAlways, (args, writer) => writer.put(args.collection, args.id, { poison: true }).pipe(Effect.andThen(Effect.fail(new MutationRejected({ reason: rejectReason }))))),
+	handler(writeThenFail, (args, writer) => writer.put(args.collection, args.id, { n: 99 }).pipe(Effect.andThen(Effect.fail(new BackendError({ message: "contract/write-then-fail fails after writing" }))))),
+	handler(countUp, (args, writer) => Effect.gen(function* () {
+		const current = yield* writer.get(args.collection, args.id);
+		yield* park(args.gate);
+		yield* writer.put(args.collection, args.id, { n: (current?.n ?? 0) + 1 });
+	}))
+]);
+/**
+* True when a failed call shows `mutator` is not registered. The
+* `UnknownMutator` tag identifies it; the exact message `UnknownMutator.make`
+* writes is a fallback for a third-party backend that does not use it yet, so a
+* registered handler whose own error merely mentions "Unknown mutator" still counts.
+*/
+const isUnregisteredFailure = (error, mutator) => isError(error) || error.message === `Unknown mutator: ${mutator}`;
+/** The client id every contract mutation is sent under. */
+const CONTRACT_CLIENT = "contract-client";
+/**
+* The rule that checks, before any other rule runs, that the backend reports the
+* ledger the run expects (#483).
+*/
+const restoredLedgerRule = "reports the ledger the run expects";
+/**
+* The message for a backend whose ledger for `clientId` in the named group is not the one the run
+* expects. A fresh group must report 0. A restored group that reports 0 has forgotten its ledger.
+*/
+const ledgerMismatch = (group, clientId, expected, reported) => {
+	const ledger = `lastMutationIds["${clientId}"]`;
+	if (expected === 0) return `A fresh ${group} must report ${ledger} = 0, got ${reported}`;
+	if (reported === 0) return `Expected the restored ${group} ${ledger} = ${expected}, got 0: the backend forgot its ledger on restart`;
+	return `Expected the restored ${group} ${ledger} = ${expected}, got ${reported}: the restored ledger differs`;
+};
+const makeHarness = (backend, options, start, peerStart) => {
+	const rows = options?.collection ?? "__contract";
+	const context = { clientGroupId: options?.clientGroupId ?? "__contract-group" };
+	const clientId = CONTRACT_CLIENT;
+	const violation = (rule, message) => new ContractViolation({
+		rule,
+		message
+	});
+	const check = (rule, condition, message) => condition ? Effect.void : Effect.fail(violation(rule, message));
+	const expectOk = (rule, effect) => effect.pipe(Effect.mapError((error) => violation(rule, `Backend failed unexpectedly: ${error.message}`)));
+	const expectFail = (rule, effect, what) => Effect.exit(effect).pipe(Effect.flatMap((exit) => check(rule, exit._tag === "Failure", `Expected failure: ${what}`)));
+	const expectRegisteredFailure = (rule, effect, mutator, exportName) => Effect.exit(effect).pipe(Effect.flatMap((exit) => {
+		const failure = Exit.findErrorOption(exit);
+		if (Option.isNone(failure)) return check(rule, false, `Expected failure: the ${mutator} mutator`);
+		return check(rule, !isUnregisteredFailure(failure.value, mutator), `${mutator} is not registered: register BackendContract.${exportName}`);
+	}));
+	const mutation = (mutationId, mutator, args) => ({
+		clientId,
+		mutationId,
+		mutator,
+		args,
+		createdAt: DateTime.toEpochMillis(DateTime.nowUnsafe())
+	});
+	return {
+		backend,
+		context,
+		clientId,
+		start,
+		peerStart,
+		rows,
+		evalRows: `${rows}_eval`,
+		check,
+		expectOk,
+		expectFail,
+		expectRegisteredFailure,
+		lastIdOf: (rule) => expectOk(rule, backend.lastMutationIds(context)).pipe(Effect.map((ids) => ids[clientId] ?? 0)),
+		mutation,
+		put: (mutationId, collection, id, value) => mutation(mutationId, putRow.name, {
+			collection,
+			id,
+			value
+		}),
+		reject: (mutationId, collection, id) => mutation(mutationId, rejectAlways.name, {
+			collection,
+			id
+		}),
+		awaitPeer: options?.awaitPeer
+	};
+};
+/** 1. In-order application bumps lastMutationIds and applies effects. */
+const rule1InOrderApplication = ({ backend, context, clientId, rows, start, check, expectOk, put }) => Effect.gen(function* () {
+	const rule = "applies mutations in order and bumps lastMutationIds";
+	const result = yield* expectOk(rule, backend.applyMutations(context, [put(start + 1, rows, "a", { n: 1 }), put(start + 2, rows, "b", { n: 2 })]));
+	yield* check(rule, result.lastMutationIds[clientId] === start + 2, `Expected lastMutationIds["${clientId}"] = ${start + 2}, got ${result.lastMutationIds[clientId]}`);
+	const fetched = yield* expectOk(rule, backend.getRows(context, rows, ["a", "b"]));
+	yield* check(rule, fetched.length === 2, `Expected 2 rows back, got ${fetched.length}`);
+	yield* check(rule, fetched.every((row) => row.version !== void 0 && row.version !== null), "Every row must carry a row version");
+});
+/** 2. Idempotent skip: an already-applied mutation id has no effect. */
+const rule2IdempotentSkip = ({ backend, context, clientId, rows, start, check, expectOk, put }) => Effect.gen(function* () {
+	const rule = "skips already-applied mutation ids (idempotency)";
+	const result = yield* expectOk(rule, backend.applyMutations(context, [put(start + 2, rows, "b", { n: 99 })]));
+	yield* check(rule, result.lastMutationIds[clientId] === start + 2, `Replaying mutation ${start + 2} must keep lastMutationId at ${start + 2}, got ${result.lastMutationIds[clientId]}`);
+	const [b] = yield* expectOk(rule, backend.getRows(context, rows, ["b"]));
+	yield* check(rule, (b?.value)?.n === 2, `Replaying mutation 2 must not re-execute its effects (row "b" became ${JSON.stringify(b?.value)})`);
+});
+/** 3. Gap rejection: a mutation id beyond last+1 is an error. */
+const rule3GapRejection = ({ backend, context, rows, start, check, expectOk, expectFail, lastIdOf, put }) => Effect.gen(function* () {
+	const rule = "rejects mutation-id gaps";
+	yield* expectFail(rule, backend.applyMutations(context, [put(start + 4, rows, "c", { n: 4 })]), `mutation id ${start + 4} after lastMutationId ${start + 2}`);
+	yield* check(rule, (yield* lastIdOf(rule)) === start + 2, "A rejected gap must not bump lastMutationId");
+	const fetched = yield* expectOk(rule, backend.getRows(context, rows, ["c"]));
+	yield* check(rule, Arr.isReadonlyArrayEmpty(fetched), "A rejected gap must not apply effects");
+});
+/** 4. Atomicity: a failed mutator bumps nothing. */
+const rule4AtomicBump = ({ backend, context, start, check, expectRegisteredFailure, lastIdOf, mutation }) => Effect.gen(function* () {
+	const rule = "keeps the lastMutationId bump atomic with mutator effects";
+	yield* expectRegisteredFailure(rule, backend.applyMutations(context, [mutation(start + 3, failAlways.name, {})]), failAlways.name, "failAlways");
+	yield* check(rule, (yield* lastIdOf(rule)) === start + 2, "A failed mutator must not bump lastMutationId");
+});
+/** 5. Authoritative writes change row versions. */
+const rule5VersionBump = ({ backend, context, rows, start, check, expectOk, put }) => Effect.gen(function* () {
+	const rule = "changes the row version on every authoritative write";
+	const [before] = yield* expectOk(rule, backend.getRows(context, rows, ["a"]));
+	yield* expectOk(rule, backend.applyMutations(context, [put(start + 3, rows, "a", { n: 3 })]));
+	const [after] = yield* expectOk(rule, backend.getRows(context, rows, ["a"]));
+	yield* check(rule, before !== void 0 && after !== void 0 && before.version !== after.version, `Rewriting row "a" must change its version (was ${before?.version}, now ${after?.version})`);
+});
+/**
+* `evaluate` must return exactly the ids `Subset.apply` returns over
+* `reference`, order included. Returns the expected ids so a caller can
+* page on from them; `describe` renders the violation from both id lists.
+*/
+const expectEvaluation = ({ backend, context, check, expectOk }, rule, reference, subset, describe) => Effect.gen(function* () {
+	const expected = apply(reference, subset).map((row) => row.id);
+	const evaluated = (yield* expectOk(rule, backend.evaluate(context, subset))).map((entry) => entry.id);
+	yield* check(rule, JSON.stringify(evaluated) === JSON.stringify(expected), describe(expected, evaluated));
+	return expected;
+});
+/** The five hand-picked rows rule 6 starts from, in insertion order. */
+const evalSeed = [
+	["e1", {
+		rank: 10,
+		tag: "keep"
+	}],
+	["e2", {
+		rank: 40,
+		tag: "keep"
+	}],
+	["e3", {
+		rank: 20,
+		tag: "drop"
+	}],
+	["e4", {
+		rank: 30,
+		tag: "keep"
+	}],
+	["e5", {
+		rank: 50,
+		tag: "keep"
+	}]
+];
+/**
+* The generated corpus rules 6 and 14 share (issue #153): two columns, NULL
+* and astral values on, from the fixed seed, so every run sees the same rows,
+* predicates and order terms.
+*/
+const contractCorpus = Effect.suspend(() => {
+	const columns = [{
+		name: "rank",
+		kind: "integer"
+	}, {
+		name: "tag",
+		kind: "text"
+	}];
+	const options = {
+		nulls: true,
+		astral: true
+	};
+	return generateCorpus({
+		seed: DEFAULT_SEED,
+		columns,
+		rows: minimumRows(columns, options) + 10,
+		predicates: 40,
+		orderBys: 40,
+		...options
+	});
+});
+/** The corpus's subsets over the evaluation collection: one per predicate, some with a limit. */
+const corpusSubsets = (h, corpus) => corpus.predicates.map((where, index) => make$5({
+	collection: h.evalRows,
+	where,
+	orderBy: corpus.orderBys[index % corpus.orderBys.length],
+	...index % 3 === 0 ? { limit: 1 + index % 7 } : {}
+}));
+/**
+* The generated half of rule 6: a small corpus (issue #153) over the same two
+* columns, so every backend inherits the check for every operator in the
+* core: `evaluate` must return exactly what `Subset.apply` returns over the
+* same rows, order included, for random predicates, order terms, and
+* limits. NULL/absent values and astral text are on: ADR-0028 makes
+* Postgres normative for both and the JS evaluator is exact there (#155),
+* so a backend whose storage treats NULL two-valued, orders NULL first
+* ascending, or compares text by UTF-16 code unit fails here by design.
+* String order is code-point order (ADR-0028 rule (c)): the `tag` pool
+* mixes case and accents, so a backend whose text column carries a locale
+* collation fails too — the contract requires `COLLATE "C"` (Postgres) or
+* `BINARY` (SQLite).
+*/
+const generatedCorpus = (h, rule, reference, nextMutationId) => Effect.gen(function* () {
+	const corpus = yield* contractCorpus;
+	const corpusRows = corpus.rows.map((row) => ({
+		id: `c-${row.id}`,
+		value: row.value
+	}));
+	yield* h.expectOk(rule, h.backend.applyMutations(h.context, corpusRows.map((row, index) => h.put(nextMutationId + index, h.evalRows, row.id, row.value))));
+	const all = [...reference, ...corpusRows];
+	yield* Effect.forEach(corpusSubsets(h, corpus), (subset, index) => expectEvaluation(h, rule, all, subset, (expected, evaluated) => formatDisagreement({
+		seed: corpus.seed,
+		subject: `generated subset ${index}${subset.limit !== void 0 ? ` (limit ${subset.limit})` : ""}`,
+		predicate: subset.where,
+		orderBy: subset.orderBy,
+		rows: all,
+		results: {
+			"Subset.apply": expected,
+			"backend.evaluate": evaluated
+		},
+		reproduce: "the contract corpus uses FilterCorpus.DEFAULT_SEED, not the environment"
+	})), {
+		concurrency: 1,
+		discard: true
+	});
+});
+/** 6. Evaluate matches the reference subset semantics (Subset.apply). */
+const rule6ReferenceSemantics = (h) => Effect.gen(function* () {
+	const rule = "evaluates subsets with the reference semantics (Subset.apply)";
+	yield* h.expectOk(rule, h.backend.applyMutations(h.context, evalSeed.map(([id, value], index) => h.put(h.start + 4 + index, h.evalRows, id, value))));
+	const reference = evalSeed.map(([id, value]) => ({
+		id,
+		value
+	}));
+	const limited = make$5({
+		collection: h.evalRows,
+		where: eq("tag", "keep"),
+		orderBy: [{
+			field: "rank",
+			direction: "desc"
+		}],
+		limit: 2
+	});
+	const expectedLimited = yield* expectEvaluation(h, rule, reference, limited, (expected, evaluated) => `where+orderBy+limit: expected ${JSON.stringify(expected)}, got ${JSON.stringify(evaluated)}`);
+	const paged = make$5({
+		collection: h.evalRows,
+		where: eq("tag", "keep"),
+		orderBy: [{
+			field: "rank",
+			direction: "desc"
+		}],
+		limit: 2,
+		cursor: expectedLimited[expectedLimited.length - 1]
+	});
+	yield* expectEvaluation(h, rule, reference, paged, (expected, evaluated) => `cursor page: expected ${JSON.stringify(expected)}, got ${JSON.stringify(evaluated)}`);
+	yield* generatedCorpus(h, rule, reference, h.start + 4 + evalSeed.length);
+});
+/** 7. getRows omits missing ids. */
+const rule7OmitsMissingIds = ({ backend, context, rows, check, expectOk }) => Effect.gen(function* () {
+	const rule = "omits missing ids from getRows";
+	const fetched = yield* expectOk(rule, backend.getRows(context, rows, ["a", "does-not-exist"]));
+	yield* check(rule, fetched.length === 1 && fetched[0]?.id === "a", `Expected exactly row "a", got ${JSON.stringify(fetched.map((row) => row.id))}`);
+});
+/** 8. Client groups are isolated. */
+const rule8ClientGroupIsolation = ({ backend, context, clientId, check, expectOk }) => Effect.gen(function* () {
+	const rule = "isolates lastMutationIds between client groups";
+	const other = { clientGroupId: `${context.clientGroupId}-other` };
+	const ids = yield* expectOk(rule, backend.lastMutationIds(other));
+	yield* check(rule, (ids[clientId] ?? 0) === 0, `A fresh client group must not see another group's mutation ids (got ${ids[clientId]})`);
+});
+/**
+* 9. Permanent rejection: the poison mutation is acknowledged (its id
+*    bumped) with no effects, and the mutation queued behind it applies.
+*/
+const rule9PermanentRejection = (h) => Effect.gen(function* () {
+	const { backend, context, clientId, rows, check, expectOk } = h;
+	const rule = "acknowledges a permanent rejection without effects and applies those behind it";
+	const startId = yield* h.lastIdOf(rule);
+	const result = yield* expectOk(rule, backend.applyMutations(context, [h.reject(startId + 1, rows, "poison"), h.put(startId + 2, rows, "behind", { n: 1 })]));
+	yield* check(rule, result.lastMutationIds[clientId] === startId + 2, `A rejection must still bump lastMutationId (expected ${startId + 2}, got ${result.lastMutationIds[clientId]})`);
+	yield* check(rule, (result.rejected ?? []).some((entry) => entry.clientId === clientId && entry.mutationId === startId + 1), "The rejected mutation must appear in the result's `rejected` list");
+	const poison = yield* expectOk(rule, backend.getRows(context, rows, ["poison"]));
+	yield* check(rule, Arr.isReadonlyArrayEmpty(poison), "A rejected mutation must leave no effects (its staged write must roll back)");
+	yield* check(rule, (yield* expectOk(rule, backend.getRows(context, rows, ["behind"]))).length === 1, "A mutation queued behind a rejected one must still apply in the same push");
+});
+/**
+* 10. Transient failure after a write: the failed mutator's write is discarded
+*     (the row keeps its value and version, and a new row is not created) and
+*     the id is not bumped, so the client's retry applies the mutation again.
+*/
+const rule10WriteThenFail = (h) => Effect.gen(function* () {
+	const { backend, context, rows, check, expectOk } = h;
+	const rule = "discards a transiently failed mutation's writes and does not bump";
+	const startId = yield* h.lastIdOf(rule);
+	const [before] = yield* expectOk(rule, backend.getRows(context, rows, ["a"]));
+	yield* check(rule, before !== void 0, "Row \"a\" must exist before the probe");
+	const attempt = (id) => backend.applyMutations(context, [h.mutation(startId + 1, writeThenFail.name, {
+		collection: rows,
+		id
+	})]);
+	yield* h.expectRegisteredFailure(rule, attempt("a"), writeThenFail.name, "writeThenFail");
+	const [after] = yield* expectOk(rule, backend.getRows(context, rows, ["a"]));
+	yield* check(rule, after?.version === before?.version && JSON.stringify(after?.value) === JSON.stringify(before?.value), `A failed write must leave row "a" unchanged (was ${JSON.stringify(before?.value)} at version ${before?.version}, now ${JSON.stringify(after?.value)} at version ${after?.version})`);
+	yield* Effect.exit(attempt("ghost"));
+	const ghost = yield* expectOk(rule, backend.getRows(context, rows, ["ghost"]));
+	yield* check(rule, Arr.isReadonlyArrayEmpty(ghost), "A failed write must not create a row");
+	yield* check(rule, (yield* h.lastIdOf(rule)) === startId, "A failed write must not bump lastMutationId");
+});
+/** How many times a transient `BackendError` is retried, as the client's own retry would. */
+const TRANSIENT_RETRIES = 3;
+/**
+* Scheduler turns the rule gives the peer to commit while the parked handler
+* waits, when the backend supplies no `awaitPeer`. A backend that runs the peer
+* at once commits it within a few turns. One that serialises it behind the parked
+* call (SQLite's writer lock, a server lock) keeps it waiting, and the rule then
+* releases the handler anyway. Counted in turns, not time, so the rule never reads
+* the wall clock. On PostgreSQL the peer's statements are real I/O, so this turn
+* count does not reach the overlap: that backend observes the peer through
+* `awaitPeer` instead (#416).
+*/
+const PEER_TURNS = 1e3;
+/** The rule's own gate names are unique per run, so two verifications in one process cannot collide. */
+let gateRuns = 0;
+/** The gate name for a mutation that parks at nothing: no registered gate has this name. */
+const NO_GATE = "";
+const retryTransient = (effect) => effect.pipe(Effect.retry({
+	times: TRANSIENT_RETRIES,
+	while: (error) => error._tag === "BackendError"
+}));
+/** Runs the scheduler until `peerSettled` reads true, or `PEER_TURNS` turns have passed. */
+const settleByTurns = (peerSettled) => {
+	const turn = (left) => left <= 0 ? Effect.void : Effect.flatMap(peerSettled, (settled) => settled ? Effect.void : Effect.andThen(Effect.yieldNow, turn(left - 1)));
+	return turn(PEER_TURNS);
+};
+/**
+* 11. Serialisable across client groups (guarantee 1, #353). Group X reads a
+*     counter and parks after the read. Group Y increments the same counter and
+*     commits while X is parked. Then X resumes and increments. Both increments
+*     must land, so the counter reads 2. A backend whose handler read is not
+*     validated at commit writes X's stale count over Y's and reads 1. A backend
+*     that serialises the two (a lock, or serialisable isolation) either orders
+*     them or refuses one with a transient `BackendError`, which the harness
+*     retries. Y waits behind X on a backend that serialises by lock, so the rule
+*     releases X once the peer has settled, or blocked on X's lock, and does not
+*     deadlock. That wait is the backend's `awaitPeer`, or `PEER_TURNS` turns when
+*     it supplies none. A PostgreSQL run needs `awaitPeer` to reach the overlap at
+*     all (#416). D1 does not meet guarantee 1 (#342): it has no transaction to
+*     isolate the read from another group's commit, so it is not run through this
+*     contract, and this rule does not claim it.
+*/
+const rule11CrossGroupLostUpdate = (h) => Effect.gen(function* () {
+	const rule = "keeps a read-modify-write across client groups from losing an update (guarantee 1)";
+	const startId = yield* h.lastIdOf(rule);
+	const row = "race";
+	yield* h.expectOk(rule, h.backend.applyMutations(h.context, [h.put(startId + 1, h.rows, row, { n: 0 })]));
+	const peer = { clientGroupId: `${h.context.clientGroupId}-peer` };
+	const peerLedger = (yield* h.expectOk(rule, h.backend.lastMutationIds(peer)))[h.clientId] ?? 0;
+	yield* h.check(rule, peerLedger === h.peerStart, ledgerMismatch("peer group", h.clientId, h.peerStart, peerLedger));
+	gateRuns += 1;
+	const gate = `${h.context.clientGroupId}/race-${gateRuns}`;
+	const parked = {
+		entered: yield* Deferred.make(),
+		release: yield* Deferred.make()
+	};
+	parkGates.set(gate, parked);
+	const increment = (mutationId, gateName) => h.mutation(mutationId, countUp.name, {
+		collection: h.rows,
+		id: row,
+		gate: gateName
+	});
+	yield* Effect.gen(function* () {
+		const first = yield* Effect.forkChild(retryTransient(h.backend.applyMutations(h.context, [increment(startId + 2, gate)])));
+		const firstEarly = yield* Effect.raceFirst(Deferred.await(parked.entered).pipe(Effect.as(void 0)), Effect.exit(Fiber.join(first)));
+		if (firstEarly !== void 0) {
+			const failure = Exit.findErrorOption(firstEarly);
+			if (Option.isSome(failure) && isUnregisteredFailure(failure.value, countUp.name)) return yield* h.check(rule, false, `${countUp.name} is not registered: register BackendContract.countUp`);
+			return yield* h.check(rule, false, Option.isSome(failure) ? `Backend failed unexpectedly: ${failure.value.message}` : `${countUp.name} finished without reaching park(): its handler must call BackendContract.park between its read and its write`);
+		}
+		const peerDone = yield* Deferred.make();
+		const second = yield* Effect.forkChild(retryTransient(h.backend.applyMutations(peer, [increment(h.peerStart + 1, NO_GATE)])).pipe(Effect.ensuring(Deferred.succeed(peerDone, void 0))));
+		const peerSettled = Deferred.isDone(peerDone);
+		yield* (h.awaitPeer ?? settleByTurns)(peerSettled);
+		yield* Deferred.succeed(parked.release, void 0);
+		const firstExit = yield* Effect.exit(Fiber.join(first));
+		const peerExit = yield* Effect.exit(Fiber.join(second));
+		const failed = Arr.findFirst([["first", firstExit], ["peer", peerExit]], ([label, exit]) => Option.map(Exit.findErrorOption(exit), (error) => ({
+			label,
+			error
+		})));
+		if (Option.isSome(failed)) return yield* h.check(rule, false, `The ${failed.value.label} increment failed: ${failed.value.error.message}`);
+		const [stored] = yield* h.expectOk(rule, h.backend.getRows(h.context, h.rows, [row]));
+		const count = (stored?.value)?.n;
+		yield* h.check(rule, count === 2, `Two increments of "${row}" from two client groups must leave it at 2, got ${count}: a committed write was lost to the other group's concurrent commit`);
+	}).pipe(Effect.ensuring(Effect.sync(() => parkGates.delete(gate)).pipe(Effect.andThen(Deferred.succeed(parked.release, void 0)))));
+});
+/**
+* 12. Own writes reach getRows (#444). A listing (`evaluate`) may cache a row, and a
+*     later write of that row through the same backend must show in `getRows` with no
+*     re-list: an update reads back the post-write value, and a delete makes `getRows`
+*     omit the row. A backend that caches listed rows and does not bring its cache into
+*     line with its own writes passes rules 1 to 11 and fails here.
+*/
+const rule12OwnWritesReachGetRows = (h) => Effect.gen(function* () {
+	const { backend, context, check, expectOk, put } = h;
+	const rule = "getRows reflects this backend's own writes to rows a listing has cached";
+	const collection = h.evalRows;
+	const kept = "cached-kept";
+	const gone = "cached-gone";
+	const startId = yield* h.lastIdOf(rule);
+	yield* expectOk(rule, backend.applyMutations(context, [put(startId + 1, collection, kept, { n: 1 }), put(startId + 2, collection, gone, { n: 1 })]));
+	const listed = (yield* expectOk(rule, backend.evaluate(context, make$5({ collection })))).map((entry) => entry.id);
+	yield* check(rule, listed.includes(kept) && listed.includes(gone), `The listing must return both seeded rows so the backend can cache them, got ${JSON.stringify(listed)}`);
+	yield* expectOk(rule, backend.applyMutations(context, [put(startId + 3, collection, kept, { n: 2 })]));
+	const [updated] = yield* expectOk(rule, backend.getRows(context, collection, [kept]));
+	yield* check(rule, (updated?.value)?.n === 2, `An update must show in getRows without a re-list: row "${kept}" reads ${JSON.stringify(updated?.value)}`);
+	yield* expectOk(rule, backend.applyMutations(context, [h.mutation(startId + 4, delRow.name, {
+		collection,
+		id: gone
+	})]));
+	const removed = yield* expectOk(rule, backend.getRows(context, collection, [gone]));
+	yield* check(rule, Arr.isReadonlyArrayEmpty(removed), `A delete must make getRows omit the row without a re-list: row "${gone}" still reads ${JSON.stringify(removed[0]?.value)}`);
+});
+/**
+* 13. Rejection memory: a permanent rejection is listed by `rejections`, with
+*     the reason `applyMutations` reported for it, so a pull whose watermark
+*     covers it can report it (#365). A client whose push response was lost
+*     learns the outcome from that list.
+*/
+const rule13ListsRejections = (h) => Effect.gen(function* () {
+	const { backend, context, clientId, rows, check, expectOk } = h;
+	const rule = "lists a permanent rejection, with the reason applyMutations reported, in rejections";
+	const startId = yield* h.lastIdOf(rule);
+	const reported = ((yield* expectOk(rule, backend.applyMutations(context, [h.reject(startId + 1, rows, "listed")]))).rejected ?? []).find((entry) => entry.clientId === clientId && entry.mutationId === startId + 1);
+	yield* check(rule, reported !== void 0, "The rejected mutation must appear in the result's `rejected` list");
+	const listed = yield* expectOk(rule, backend.rejections(context));
+	yield* check(rule, listed.some((entry) => entry.clientId === clientId && entry.mutationId === startId + 1 && entry.reason === reported?.reason), `A permanent rejection must be listed by rejections with the reason applyMutations reported (${JSON.stringify(reported?.reason)}), got ${JSON.stringify(listed)}`);
+});
+/**
+* 14. `evaluateMany`, when the backend provides it (#505), equals per-subset
+*     `evaluate`: for rule 6's subsets over its rows (the hand-picked windows
+*     and the generated corpus) plus whole-collection subsets of both contract
+*     collections, asked in one call, each list holds the same entries, ids
+*     and versions, in the same order, as `evaluate` gives that subset. Asking
+*     for no subsets gives no lists. A backend without `evaluateMany` passes
+*     vacuously: a pull falls back to `evaluate`.
+*/
+/** Whether two entry lists hold the same ids and versions in the same order. */
+const sameEntries = (left, right) => left.length === right.length && left.every((entry, index) => entry.id === right[index]?.id && entry.version === right[index]?.version);
+/** An entry list for a violation message: `id@version`, comma-separated. */
+const describeEntries = (entries) => entries.map((entry) => `${entry.id}@${entry.version}`).join(", ");
+const rule14EvaluateManyEquivalence = (h) => Effect.gen(function* () {
+	const many = h.backend.evaluateMany;
+	if (many === void 0) return;
+	const rule = "evaluateMany equals per-subset evaluate";
+	const corpus = yield* contractCorpus;
+	const keep = eq("tag", "keep");
+	const byRank = [{
+		field: "rank",
+		direction: "desc"
+	}];
+	const subsets = [
+		make$5({ collection: h.evalRows }),
+		make$5({ collection: h.rows }),
+		make$5({
+			collection: h.evalRows,
+			where: keep,
+			orderBy: byRank,
+			limit: 2
+		}),
+		make$5({
+			collection: h.evalRows,
+			where: keep,
+			orderBy: byRank,
+			limit: 2,
+			cursor: "e5"
+		}),
+		...corpusSubsets(h, corpus)
+	];
+	const batched = yield* h.expectOk(rule, many(h.context, subsets));
+	yield* h.check(rule, batched.length === subsets.length, `Expected ${subsets.length} entry lists, one per subset, got ${batched.length}`);
+	yield* Effect.forEach(subsets, (subset, index) => Effect.gen(function* () {
+		const single = yield* h.expectOk(rule, h.backend.evaluate(h.context, subset));
+		const together = batched[index] ?? [];
+		yield* h.check(rule, sameEntries(together, single), `Subset ${index} over "${subset.collection}": evaluate gave [${describeEntries(single)}], evaluateMany gave [${describeEntries(together)}]`);
+	}), {
+		concurrency: 1,
+		discard: true
+	});
+	const none = yield* h.expectOk(rule, many(h.context, []));
+	yield* h.check(rule, Arr.isReadonlyArrayEmpty(none), `Asked for no subsets, evaluateMany gave ${none.length} lists`);
+});
+/** The contract, in the order the rules build on one another's state. */
+const rules = [
+	rule1InOrderApplication,
+	rule2IdempotentSkip,
+	rule3GapRejection,
+	rule4AtomicBump,
+	rule5VersionBump,
+	rule6ReferenceSemantics,
+	rule7OmitsMissingIds,
+	rule8ClientGroupIsolation,
+	rule9PermanentRejection,
+	rule10WriteThenFail,
+	rule11CrossGroupLostUpdate,
+	rule12OwnWritesReachGetRows,
+	rule13ListsRejections,
+	rule14EvaluateManyEquivalence
+];
+/**
+* Verify a backend against the contract. The backend must have the contract
+* mutators registered and the contract collections empty. On a fresh client group
+* the contract expects the backend to report a ledger of 0 for its client. A run
+* over a restarted backend passes the ledger it expects as `restoredLedger`: the
+* contract first checks the backend reports exactly that, failing a backend that
+* forgot its ledger, and then numbers its mutations from it (#483).
+*/
+const verifyBackendContract = (backend, options) => {
+	const context = { clientGroupId: options?.clientGroupId ?? "__contract-group" };
+	const expected = options?.restoredLedger ?? 0;
+	return backend.lastMutationIds(context).pipe(Effect.mapError((error) => new ContractViolation({
+		rule: restoredLedgerRule,
+		message: `Backend failed unexpectedly: ${error.message}`
+	})), Effect.flatMap((ids) => {
+		const reported = ids[CONTRACT_CLIENT] ?? 0;
+		if (reported !== expected) return Effect.fail(new ContractViolation({
+			rule: restoredLedgerRule,
+			message: ledgerMismatch("contract group", CONTRACT_CLIENT, expected, reported)
+		}));
+		const harness = makeHarness(backend, options, expected, options?.restoredPeerLedger ?? 0);
+		return Effect.forEach(rules, (rule) => rule(harness), { discard: true });
+	}));
+};
+// src/InvalidationSink.ts
+/**
+* InvalidationSink
+*
+* Turn committed writes into evictions of server-side caches (#206). A
+* {@link InvalidationSink} is told what each hint batch on the
+* {@link InvalidationBus} touched, the collections and the row ids, and evicts
+* whatever it caches for them: a KV read-through cache, the edge HTTP cache's
+* tags. {@link run} subscribes a sink to the bus, so eviction stops being an
+* obligation of each mutation's call site.
+*
+* Eviction is best-effort, like the bus itself (ADR-0009): a sink logs a
+* failure and never surfaces it, and it runs on its own fibre, so it can
+* neither fail nor delay the write that published the hint. A cache's TTL is
+* the backstop for an eviction that is lost.
+*
+* The tag spelling is `HttpCache`'s convention (`collection:{name}`,
+* `collection:{name}:{id}`), shared with the browser's Cache API invalidation.
+* Runtime sinks live in their runtime's package: Cloudflare KV and
+* `cache.purge` in `@thomasfosterau/legation-alchemy-cloudflare` (`EdgeInvalidation`).
+*/
+var InvalidationSink_exports = /* @__PURE__ */ __exportAll({
+	all: () => all,
+	run: () => run$1,
+	touchedBy: () => touchedBy
+});
+/** What a hint batch touched: its collections, and every row id it names (puts and deletes). */
+const touchedBy = (hints) => ({
+	collections: Arr.dedupe(hints.map((hint) => hint.collection)),
+	rows: hints.flatMap((hint) => hint.ids.map((id) => ({
+		collection: hint.collection,
+		id
+	})))
+});
+/** Whether a change touched nothing. */
+const isEmpty = (touched) => Arr.isReadonlyArrayEmpty(touched.collections) && Arr.isReadonlyArrayEmpty(touched.rows);
+/**
+* One sink over several, run concurrently: a KV cache and the edge cache
+* evicted from the same hint. A defect in one is logged and does not stop the
+* others.
+*/
+const all = (sinks) => ({ invalidate: (touched) => Effect.forEach(sinks, (sink) => guarded(sink, touched), {
+	concurrency: "unbounded",
+	discard: true
+}) });
+/** Run one sink's eviction, logging rather than propagating a defect it did not catch. */
+const guarded = (sink, touched) => sink.invalidate(touched).pipe(Effect.catchCause((cause) => Effect.logWarning("InvalidationSink: an eviction failed; the cache TTL is the backstop", cause)));
+/**
+* Subscribe `sink` to the bus for the scope's lifetime: each hint batch's
+* touched collections and rows are passed to it, on a fibre of its own. Run it
+* where the bus is, in the process that commits the writes. A sink that has to
+* reach a cache in another process forwards there (Cloudflare:
+* `EdgeInvalidation.forward` over a service binding).
+*/
+const run$1 = (sink) => Effect.gen(function* () {
+	const subscription = yield* (yield* InvalidationBus).subscribe;
+	yield* Effect.forkScoped(Effect.forever(subscription.take.pipe(Effect.flatMap((hints) => {
+		const touched = touchedBy(hints);
+		return isEmpty(touched) ? Effect.void : guarded(sink, touched);
+	}))));
+});
+// src/PushPoke.ts
+/**
+* PushPoke
+*
+* Web Push as a poke carrier (#214): the one mechanism that wakes a service
+* worker that is not running, so a client with no open tab converges before
+* the user returns. Under poke-then-pull it is a safe fit. A poke carries no
+* data, so a lost push costs a delay and a duplicate costs one pull that finds
+* nothing: pull is the correctness path (ADR-0008).
+*
+* ## The payload is contentless
+*
+* Every push this module sends is {@link payload}: a fixed marker and nothing
+* else. No topic, no collection name, no row id. A push payload crosses a
+* third-party push service, and a collection name would tell it what a user
+* subscribes to. The pull the poke prompts is the authenticated channel; that
+* is where the data travels.
+*
+* ## The app owns the subscriptions and the credentials
+*
+* {@link sink} takes the app's endpoint registry (which subscriptions a change
+* should wake, {@link SinkOptions.targetsFor}) and the app's sender
+* ({@link SinkOptions.send}, which signs with the app's VAPID keys). The
+* library holds no credential and stores no subscription.
+*
+* ## The budget is the app's stated choice
+*
+* Browsers penalise a push that shows no notification, and push services
+* rate-limit each subscription: an app that wakes a device for every write can
+* lose its push permission. So {@link SinkOptions.coalesce} and
+* {@link SinkOptions.budget} are required, with no default: the silent-push
+* posture is a decision the app writes down, not a guess the library makes.
+* Within the coalescing window a target gets at most one push, plus one more at
+* the window's end if anything else changed meanwhile; past its budget a
+* target gets none until the budget period moves on. A skipped push is logged
+* at debug level: the next pull, or the next page boot, converges anyway.
+*
+* The worker side, which turns a recognised push into a Background Sync
+* registration or a pull, is `PushPoke` in `@thomasfosterau/legation-browser`.
+*/
+var PushPoke_exports = /* @__PURE__ */ __exportAll({
+	isPoke: () => isPoke,
+	payload: () => payload,
+	sink: () => sink
+});
+/**
+* The payload of every push-poke: a fixed marker, so the worker can tell the
+* library's push from the app's own, and nothing about what changed.
+*/
+const payload = "{\"legation\":\"poke\"}";
+/** Whether a push's text is the library's poke ({@link payload}). */
+const isPoke = (text) => text === payload;
+const emptyState = {
+	lastSent: Number.NEGATIVE_INFINITY,
+	trailing: false,
+	sent: []
+};
+/**
+* An `InvalidationSink` that pokes the devices a change should wake, over Web
+* Push, within the app's coalescing window and budget. Run it with
+* `InvalidationSink.run` where the bus is. Its trailing pushes run on fibres
+* of the scope it is built in.
+*/
+const sink = (options) => Effect.gen(function* () {
+	const window = Duration.toMillis(Duration.fromInputUnsafe(options.coalesce));
+	const period = Duration.toMillis(Duration.fromInputUnsafe(options.budget.per));
+	const limit = Math.max(0, options.budget.pushes);
+	const states = yield* Ref.make(HashMap.empty());
+	const scope = yield* Effect.scope;
+	const stateOf = (all, key) => Option.getOrElse(HashMap.get(all, key), () => emptyState);
+	const claim = (key, now) => Ref.modify(states, (all) => {
+		const sent = stateOf(all, key).sent.filter((at) => now - at < period);
+		if (sent.length >= limit) return [false, all];
+		return [true, HashMap.set(all, key, {
+			lastSent: now,
+			trailing: false,
+			sent: [...sent, now]
+		})];
+	});
+	const push = (target, key, now) => Effect.flatMap(claim(key, now), (allowed) => allowed ? options.send(target, payload).pipe(Effect.catchCause((cause) => Effect.logWarning("PushPoke: a push failed; the next pull converges", cause))) : Effect.logDebug("PushPoke: a target is over its push budget; skipped"));
+	const decide = (key, now) => Ref.modify(states, (all) => {
+		const state = stateOf(all, key);
+		if (now - state.lastSent >= window) return ["send", all];
+		if (state.trailing) return ["skip", all];
+		return ["trail", HashMap.set(all, key, {
+			...state,
+			trailing: true
+		})];
+	});
+	const poke = (target) => Effect.gen(function* () {
+		const key = options.keyOf(target);
+		const now = yield* Clock.currentTimeMillis;
+		const decision = yield* decide(key, now);
+		if (decision === "send") return yield* push(target, key, now);
+		if (decision !== "trail") return;
+		const state = stateOf(yield* Ref.get(states), key);
+		const wait = Math.max(0, state.lastSent + window - now);
+		yield* Effect.forkIn(Effect.sleep(Duration.millis(wait)).pipe(Effect.andThen(Clock.currentTimeMillis), Effect.flatMap((at) => push(target, key, at))), scope);
+	});
+	return { invalidate: (touched) => options.targetsFor(touched).pipe(Effect.catchCause((cause) => Effect.logWarning("PushPoke: the endpoint registry failed; no push sent", cause).pipe(Effect.as(Arr.empty()))), Effect.flatMap((targets) => Effect.forEach(Arr.dedupeWith(targets, (a, b) => options.keyOf(a) === options.keyOf(b)), poke, {
+		concurrency: "unbounded",
+		discard: true
+	}))) };
+});
+// src/FanoutTopics.ts
+/**
+* FanoutTopics
+*
+* The pure topic algebra of ADR-0023: fan-out is publish/subscribe over
+* **derived topics**, and the fan-out layer never evaluates a predicate.
+* For a node type `C` the topic space is the coarse topic `C` plus fine
+* topics `C/field=value`, allowed only for fields in the node's
+* **derivable set** (its `one`-edge keys + declared `hintKeys`) — declared
+* on the Node, so registration and write-derivation cannot disagree.
+*
+* Soundness by construction: a window registers the finest topic its
+* predicate legally allows (an equality conjunct on a derivable field),
+* and a write emits every derivable-set topic for its **old and new**
+* values — so any write that can affect a fine-registered window emits
+* that window's topic. Over-poking is harmless (pull is the correctness
+* path); under-poking is impossible.
+*/
+var FanoutTopics_exports = /* @__PURE__ */ __exportAll({
+	coarse: () => coarse,
+	collectionOf: () => collectionOf,
+	derivableSets: () => derivableSets,
+	fine: () => fine,
+	topicForSubset: () => topicForSubset,
+	topicsForWrite: () => topicsForWrite
+});
+/** The coarse topic of a collection: every write to it publishes here. */
+const coarse = (collection) => collection;
+/** A fine topic: a graph location (`reviews/productId=p-1` IS that edge). */
+const fine = (collection, field, value) => `${collection}/${field}=${String(value)}`;
+/** The collection a topic belongs to (both coarse and fine). */
+const collectionOf = (topic) => {
+	const slash = topic.indexOf("/");
+	return slash === -1 ? topic : topic.slice(0, slash);
+};
+/** The derivable set of every node in a registry, keyed by collection. */
+const derivableSets = (nodes) => {
+	const map = /* @__PURE__ */ new Map();
+	Arr.forEach(nodes.nodes, ([type, node]) => {
+		const fields = new Set(node.hintKeys);
+		Arr.forEach(Object.values(node.edges), (edge) => {
+			if (edge.kind === "one") fields.add(edge.via);
+		});
+		map.set(type, fields);
+	});
+	return map;
+};
+const isLiteral = (value) => P.isString(value) || P.isNumber(value) || P.isBoolean(value);
+/** The equality conjuncts of a predicate (a bare Compare or an And of them). */
+const eqConjuncts = (predicate) => {
+	if (predicate._tag === "Compare" && predicate.op === "eq" && isLiteral(predicate.value)) return [{
+		field: predicate.field,
+		value: predicate.value
+	}];
+	if (predicate._tag === "And") return predicate.predicates.flatMap(eqConjuncts);
+	return [];
+};
+/**
+* The finest topic a window's predicate legally allows: an equality
+* conjunct on a derivable field → that fine topic (every row in the
+* window carries the value, so every affecting write derives it);
+* anything else → the coarse topic.
+*/
+const topicForSubset = (subset, derivable) => {
+	const conjunct = derivable === void 0 ? void 0 : eqConjuncts(subset.where).find((candidate) => derivable.has(candidate.field));
+	return conjunct === void 0 ? coarse(subset.collection) : fine(subset.collection, conjunct.field, conjunct.value);
+};
+/**
+* The topics one written row derives: the coarse topic plus a fine topic
+* per derivable field of its **old and new** values — an update that moves
+* a row between parents pokes both edge windows; a delete derives from the
+* old row; a value-less write degrades to coarse alone.
+*/
+const topicsForWrite = (collection, derivable, values) => {
+	const topics = /* @__PURE__ */ new Set([coarse(collection)]);
+	if (derivable === void 0) return topics;
+	Arr.forEach([values.oldValue, values.newValue], (value) => {
+		if (!P.isObjectOrArray(value)) return;
+		Arr.forEach(derivable, (field) => {
+			const fieldValue = value[field];
+			if (isLiteral(fieldValue)) topics.add(fine(collection, field, fieldValue));
+		});
+	});
+	return topics;
+};
+// src/FanoutBroker.ts
+/**
+* FanoutBroker
+*
+* ADR-0023's shard seam: topic pub/sub with **leased** registrations.
+* Rooms register the topic set their windows compile to and renew on a
+* heartbeat; shards drop expired entries, so crashed rooms age out with no
+* distributed cleanup. `publish` routes a write's derived topics to every
+* room whose live lease intersects them — the fan-out layer never
+* evaluates a predicate.
+*
+* The in-process implementation is the single-process reference (and the
+* semantics a Durable Object or Redis shard must match). A poke here is a
+* batch of matched topics; a dropped poke only delays the next interval
+* pull, never prevents convergence.
+*/
+var FanoutBroker_exports = /* @__PURE__ */ __exportAll({
+	FanoutBroker: () => FanoutBroker,
+	makeInProcess: () => makeInProcess
+});
+/**
+* The {@link FanoutBroker} service tag, for apps that provide a broker by layer;
+* `FanoutBus.make` takes it as an option.
+*/
+const FanoutBroker = Context.Service("@thomasfosterau/legation/FanoutBroker");
+const POKE_CAPACITY = 256;
+/** The in-process broker: leases in a Ref, one dropping hub per room. */
+const makeInProcess = Effect.gen(function* () {
+	const leases = yield* Ref.make(/* @__PURE__ */ new Map());
+	const hubs = yield* Ref.make(/* @__PURE__ */ new Map());
+	const scope = yield* Effect.scope;
+	const hubFor = (roomId) => Effect.gen(function* () {
+		const existing = (yield* Ref.get(hubs)).get(roomId);
+		if (existing !== void 0) return existing;
+		const hub = yield* PubSub.dropping({ capacity: POKE_CAPACITY });
+		yield* Scope.addFinalizer(scope, PubSub.shutdown(hub));
+		yield* Ref.update(hubs, (map) => new Map(map).set(roomId, hub));
+		return hub;
+	});
+	return {
+		register: (roomId, topics, ttl) => Effect.gen(function* () {
+			const now = yield* Clock.currentTimeMillis;
+			yield* Ref.update(leases, (map) => new Map(map).set(roomId, {
+				topics,
+				expiresAt: now + Duration.toMillis(ttl)
+			}));
+		}),
+		publish: (topics) => Effect.gen(function* () {
+			const wanted = new Set(topics);
+			const now = yield* Clock.currentTimeMillis;
+			const live = /* @__PURE__ */ new Map();
+			Arr.forEach(yield* Ref.get(leases), ([roomId, lease]) => {
+				if (lease.expiresAt > now) live.set(roomId, lease);
+			});
+			yield* Ref.set(leases, live);
+			const hubMap = yield* Ref.get(hubs);
+			yield* Effect.forEach(live, ([roomId, lease]) => Effect.gen(function* () {
+				const matched = [...wanted].filter((topic) => lease.topics.has(topic));
+				if (Arr.isReadonlyArrayEmpty(matched)) return;
+				const hub = hubMap.get(roomId);
+				if (hub !== void 0) yield* PubSub.publish(hub, matched);
+			}), {
+				concurrency: 1,
+				discard: true
+			});
+		}),
+		pokes: (roomId) => Effect.gen(function* () {
+			const hub = yield* hubFor(roomId);
+			const subscription = yield* PubSub.subscribe(hub);
+			return { take: PubSub.take(subscription) };
+		})
+	};
+});
+// src/FanoutBus.ts
+/**
+* FanoutBus
+*
+* An {@link InvalidationBus} over a {@link FanoutBroker} — the piece that
+* makes ADR-0023's topic routing a drop-in: `Server.make({ bus })` accepts
+* it unchanged, and the room deployment gets topic-precise cross-room
+* fan-out instead of a flat channel.
+*
+* Publishing derives each hint's topics (coarse always; fine per derivable
+* field of the old and new values) and hands them to the broker. The
+* subscription side surfaces the broker's topic pokes as collection-level
+* hints — within a room the group count is small (typically one user), so
+* the sync server's existing matcher finishes the job.
+*
+* Registration: the room's current windows compile to topics
+* ({@link FanoutTopics.topicForSubset}) and are leased on a heartbeat —
+* registration is idempotent, so the heartbeat IS renewal, and a crashed
+* room simply ages out shard-side.
+*/
+var FanoutBus_exports = /* @__PURE__ */ __exportAll({ make: () => make });
+/** The topics one hint derives (coarse + fine over old and new values). */
+const topicsForHint = (hint, derivable) => {
+	const values = new Map(hint.values?.map(({ id, value }) => [id, value]) ?? []);
+	const olds = new Map(hint.oldValues?.map(({ id, value }) => [id, value]) ?? []);
+	const topics = /* @__PURE__ */ new Set([coarse(hint.collection)]);
+	const ids = Arr.isReadonlyArrayNonEmpty(hint.ids) ? hint.ids : [...values.keys()];
+	Arr.forEach(ids, (id) => {
+		Arr.forEach(topicsForWrite(hint.collection, derivable, {
+			oldValue: olds.get(id),
+			newValue: values.get(id)
+		}), (topic) => {
+			topics.add(topic);
+		});
+	});
+	return topics;
+};
+/** Build the bus; the lease heartbeat runs until the scope closes. */
+const make = (options) => Effect.gen(function* () {
+	const derivable = derivableSets(options.nodes);
+	const heartbeat = options.heartbeat ?? "10 seconds";
+	const ttl = options.ttl ?? Duration.millis(Duration.toMillis(heartbeat) * 3);
+	const timeout = options.timeout ?? "5 seconds";
+	const bounded = (what, call) => call.pipe(Effect.timeoutOrElse({
+		duration: timeout,
+		orElse: () => Effect.logWarning(`FanoutBus: ${what} timed out; dropped (the next heartbeat or pull recovers it)`)
+	}));
+	const registerNow = bounded("lease registration", options.subsets.pipe(Effect.flatMap((subsets) => options.broker.register(options.roomId, new Set(subsets.map((subset) => topicForSubset(subset, derivable.get(subset.collection)))), ttl))));
+	yield* registerNow;
+	yield* Effect.forkScoped(Effect.forever(Effect.sleep(heartbeat).pipe(Effect.andThen(registerNow))));
+	return {
+		publish: (hints) => {
+			const topics = /* @__PURE__ */ new Set();
+			Arr.forEach(hints, (hint) => {
+				Arr.forEach(topicsForHint(hint, derivable.get(hint.collection)), (topic) => {
+					topics.add(topic);
+				});
+			});
+			return bounded("publish", options.broker.publish(topics)).pipe(Effect.andThen(registerNow));
+		},
+		subscribe: Effect.gen(function* () {
+			return { take: (yield* options.broker.pokes(options.roomId)).take.pipe(Effect.map((topics) => {
+				return [...new Set(topics.map(collectionOf))].map((collection) => ({
+					collection,
+					ids: []
+				}));
+			})) };
+		})
+	};
+});
+// src/BusBrokers.ts
+/**
+* BusBrokers
+*
+* Concrete {@link BusBroker} implementations for the distributed
+* invalidation bus (ADR-0009). A broker is one string pub/sub channel;
+* `InvalidationBus.makeSerialized` runs the whole bus over it. These add no
+* dependency footprint (Redis ships inside `effect`; the WebSocket broker is
+* structural), so they live in core per ADR-0006.
+*
+* - `makeRedisBroker`: over Redis **Streams** (`XADD` / `XREAD BLOCK`) using
+*   `effect/persistence` Redis. Streams give durable, replayable
+*   fan-out; point every instance's subscriber at the same stream key.
+* - `makeWebSocketBroker`: over any `WebSocketLike` whose far end broadcasts
+*   every frame to all peers — the shape of a Cloudflare Durable Object
+*   relay (each Worker isolate holds a socket to the DO; the DO rebroadcasts).
+*/
+var BusBrokers_exports = /* @__PURE__ */ __exportAll({
+	makeBroadcastChannelBroker: () => makeBroadcastChannelBroker,
+	makeRedisBroker: () => makeRedisBroker,
+	makeWebSocketBroker: () => makeWebSocketBroker
+});
+const PAYLOAD_FIELD = "p";
+/** Pull the payload value out of an entry's flattened field/value pairs. */
+const payloadOf = (fields) => {
+	const at = Arr.findFirstIndex(fields, (field, i) => i % 2 === 0 && i + 1 < fields.length && String(field) === PAYLOAD_FIELD);
+	return Option.match(at, {
+		onNone: () => void 0,
+		onSome: (i) => String(fields[i + 1])
+	});
+};
+/**
+* The ID an XREAD continues from after the given XREVRANGE reply: the newest
+* entry's ID, or `0-0` for an empty stream (so the next XREAD delivers every entry).
+*/
+const cursorAfter = (reply) => {
+	const [newest] = reply;
+	return newest === void 0 ? "0-0" : newest[0];
+};
+/**
+* How long `subscribe` waits for its one start-position lookup. Past it, the
+* subscription is returned anyway and the reader resolves the position itself.
+*/
+const START_LOOKUP_BOUND = Duration.millis(500);
+/** The reader's start-position lookup did not answer within {@link START_LOOKUP_BOUND}. */
+var StartLookupTimeout = class extends Schema.TaggedError()("StartLookupTimeout", {}) {};
+/**
+* The margin added to the XREAD BLOCK time to bound one reader XREAD. Redis ends a healthy idle
+* block at BLOCK, so a reply still missing at BLOCK plus this margin is a dead read (a half-open
+* connection, say), not a quiet stream.
+*/
+const XREAD_MARGIN_MS = 2e3;
+/** A reader XREAD got no reply within its bound (see {@link XREAD_MARGIN_MS}). */
+var XReadTimeout = class extends Schema.TaggedError()("XReadTimeout", {}) {};
+/** The reader's first back-off after a failed step; it doubles on each consecutive failure. */
+const RETRY_BASE_MS = 200;
+/** The cap on the reader's back-off. */
+const RETRY_CAP_MS = 5e3;
+/** Back-off before the next attempt, after `failures` consecutive failed steps (`failures >= 1`). */
+const backoffMs = (failures) => Math.min(RETRY_CAP_MS, RETRY_BASE_MS * 2 ** (failures - 1));
+/**
+* A BusBroker over Redis Streams. Captures the `Redis` service; each
+* `subscribe` forks a scoped reader looping `XREAD BLOCK`.
+*
+* `subscribe` makes one attempt at the start position (`XREVRANGE`, or `0-0`
+* for an empty stream), waiting at most 500 ms, and returns either way. If the
+* attempt answers in time, a hint published once `subscribe` returns is never
+* missed. If it fails or times out, the forked reader resolves the start
+* position on its first step and retries with back-off (200 ms, doubling,
+* capped at 5 s) until Redis answers. While Redis is unreachable, a publish that
+* races the start can be missed: it lands after `subscribe` returns but before
+* the reader resolves its start position. Delivery is best-effort (ADR-0009).
+* Each reader XREAD is bounded at its `block` time plus the margin described on
+* `block`. A call with no reply by then is a failed step: it is logged, backed off
+* and retried from the last ID seen, as a failed start lookup is, so no entry is
+* skipped. A reply of null (a normal BLOCK timeout) is a success.
+*
+* The `Redis` service's `send` must meet two properties that this bound relies on.
+* It must be interruptible: the bound interrupts a read that never replies. And
+* after an aborted `send`, it must keep replies in order on its connection, so a
+* late reply to an abandoned XREAD is never read as the answer to the next command.
+*
+* Known limit: after a `DEL` and recreate of the stream, or a Redis clock
+* stepping backwards, new IDs can fall at or below the sticky cursor and be
+* skipped until the subscriber resubscribes.
+*/
+const makeRedisBroker = (options) => Effect.gen(function* () {
+	const redis = yield* Redis.Redis;
+	const stream = options?.stream ?? "legation:hints";
+	const blockMillis = Math.trunc(Duration.toMillis(options?.block ?? "5 seconds"));
+	const blockMs = String(blockMillis);
+	const from = options?.from ?? "$";
+	const timeout = options?.timeout ?? "5 seconds";
+	const boundRead = (read) => blockMillis > 0 ? read.pipe(Effect.timeoutOrElse({
+		duration: Duration.millis(blockMillis + XREAD_MARGIN_MS),
+		orElse: () => Effect.fail(new XReadTimeout())
+	})) : read;
+	const lastId = redis.send("XREVRANGE", stream, "+", "-", "COUNT", "1").pipe(Effect.map(cursorAfter));
+	return {
+		publish: (payload) => redis.send("XADD", stream, "*", PAYLOAD_FIELD, payload).pipe(Effect.timeoutOrElse({
+			duration: timeout,
+			orElse: () => Effect.logWarning("Redis broker: XADD timed out; publish dropped")
+		}), Effect.ignore),
+		subscribe: Effect.gen(function* () {
+			const queue = yield* Queue.unbounded();
+			const cursor = { id: from === "0" ? "0" : void 0 };
+			if (cursor.id === void 0) {
+				const first = yield* lastId.pipe(Effect.timeoutOption(START_LOOKUP_BOUND), Effect.orElseSucceed(() => Option.none()));
+				if (Option.isSome(first)) cursor.id = first.value;
+			}
+			const outage = { failures: 0 };
+			const answered = Effect.suspend(() => {
+				const failures = outage.failures;
+				if (failures === 0) return Effect.void;
+				outage.failures = 0;
+				return Effect.logInfo(`Redis broker: reader recovered after ${failures} failed step(s)`);
+			});
+			const failed = (error) => Effect.suspend(() => {
+				outage.failures += 1;
+				const delay = backoffMs(outage.failures);
+				return (outage.failures === 1 ? Effect.logWarning("Redis broker: reader step failed; retrying with back-off", error) : Effect.logDebug(`Redis broker: reader step failed again; retrying in ${delay} millis`, error)).pipe(Effect.andThen(Effect.sleep(Duration.millis(delay))));
+			});
+			const readOnce = Effect.gen(function* () {
+				if (cursor.id === void 0) cursor.id = yield* lastId.pipe(Effect.timeoutOrElse({
+					duration: START_LOOKUP_BOUND,
+					orElse: () => Effect.fail(new StartLookupTimeout())
+				}), Effect.tap(() => answered));
+				const reply = yield* boundRead(redis.send("XREAD", "BLOCK", blockMs, "STREAMS", stream, cursor.id)).pipe(Effect.tap(() => answered));
+				if (reply === null) return;
+				yield* Effect.forEach(reply, ([, entries]) => Effect.gen(function* () {
+					yield* Effect.forEach(entries, ([id, fields]) => Effect.gen(function* () {
+						cursor.id = id;
+						const payload = payloadOf(fields);
+						if (payload !== void 0) yield* Queue.offer(queue, payload);
+					}), {
+						concurrency: 1,
+						discard: true
+					});
+				}), {
+					concurrency: 1,
+					discard: true
+				});
+			}).pipe(Effect.catch(failed));
+			yield* Effect.forkScoped(Effect.forever(readOnce));
+			return { take: Queue.take(queue) };
+		})
+	};
+});
+/**
+* A BusBroker over a `WebSocketLike` whose far end rebroadcasts every frame
+* to all connected peers — the Durable Object relay pattern. `publish` sends
+* a frame; `subscribe` collects inbound string frames.
+*/
+const makeWebSocketBroker = (socket) => ({
+	publish: (payload) => Effect.sync(() => socket.send(payload)),
+	subscribe: Effect.gen(function* () {
+		const queue = yield* Queue.unbounded();
+		yield* Effect.acquireRelease(Effect.sync(() => {
+			const listener = (event) => {
+				if (P.isString(event.data)) Queue.offerUnsafe(queue, event.data);
+			};
+			socket.addEventListener("message", listener);
+			return listener;
+		}), (listener) => Effect.sync(() => socket.removeEventListener("message", listener)));
+		return { take: Queue.take(queue) };
+	})
+});
+/**
+* A BusBroker over a `BroadcastChannel` — cross-context fan-out on one machine
+* (browser tabs, Node worker threads). A `BroadcastChannel` delivers to every
+* *other* channel of the same name but not the sender, so `publish` also offers
+* to this broker's own subscribers, honoring the contract's self-delivery (each
+* instance fans the hint out to its local sessions). Point every context's
+* broker at the same channel name.
+*/
+const makeBroadcastChannelBroker = (channel) => Effect.gen(function* () {
+	const queues = /* @__PURE__ */ new Set();
+	yield* Effect.acquireRelease(Effect.sync(() => {
+		const listener = (event) => {
+			const data = event.data;
+			if (!P.isString(data)) return;
+			Arr.forEach(queues, (queue) => {
+				Queue.offerUnsafe(queue, data);
+			});
+		};
+		channel.addEventListener("message", listener);
+		return listener;
+	}), (listener) => Effect.sync(() => channel.removeEventListener("message", listener)));
+	return {
+		publish: (payload) => Effect.sync(() => {
+			Arr.forEach(queues, (queue) => {
+				Queue.offerUnsafe(queue, payload);
+			});
+			channel.postMessage(payload);
+		}),
+		subscribe: Effect.gen(function* () {
+			const queue = yield* Queue.unbounded();
+			yield* Effect.acquireRelease(Effect.sync(() => queues.add(queue)), () => Effect.sync(() => queues.delete(queue)));
+			return { take: Queue.take(queue) };
+		})
+	};
+});
+// src/HintSource.ts
+/**
+* HintSource
+*
+* A HintSource produces ChangeHints for writes that bypass mutators (CDC —
+* cron jobs, admin tools, another service, psql), publishing them to the
+* InvalidationBus so out-of-band changes poke subscribed clients. Fork its
+* `run` into a scope alongside the SyncServer.
+*
+* Correctness is preserved regardless: a HintSource only pokes, and poke is
+* never a correctness dependency (ADR-0009) — a missed or redundant hint only
+* changes when the next pull happens. A source that publishes value-less hints
+* (no `values`) is matched at the collection level by the #42 fan-out matcher,
+* which is sound: over-matching a poke costs an empty pull, under-matching would
+* delay convergence, so a hint that names only a collection pokes every group
+* subscribed to it.
+*/
+var HintSource_exports = /* @__PURE__ */ __exportAll({
+	fromStream: () => fromStream,
+	run: () => run
+});
+/**
+* Build a HintSource from a stream of hint batches (used by the LISTEN/NOTIFY
+* recipe and tests): each emitted batch is published to the in-context bus, and
+* the consuming fibre is tied to the scope so it stops when the scope closes.
+*/
+const fromStream = (hints) => ({ run: Effect.flatMap(InvalidationBus, (bus) => Effect.asVoid(Effect.forkScoped(Stream.runForEach(hints, bus.publish)))) });
+/**
+* Fork a HintSource for the caller's scope, resolving the bus from context: the
+* source's worker runs on a scoped fibre alongside the SyncServer and is
+* interrupted when the scope closes.
+*/
+const run = (source) => source.run;
+// src/SyncRoom.ts
+/**
+* SyncRoom
+*
+* The packaged server composition (ADR-0009): SyncServer orchestration +
+* in-memory CVR store + in-process invalidation bus, ready to bind to any
+* carrier. The same composition runs in-process on Node or inside a
+* Cloudflare Durable Object (where the DO's single-threaded scope IS the
+* room); distributed deployments swap the bus and CVR store layers.
+*/
+var SyncRoom_exports = /* @__PURE__ */ __exportAll({ layer: () => layer });
+/**
+* A self-contained room: provide a Backend and an AuthPolicy, get a
+* ServerHandler. CVRs and the bus are in-memory/in-process.
+*/
+const layer = layer$2.pipe(Layer.provide(layerMemoryStore), Layer.provide(layerInProcess));
+// src/HttpCache.ts
+/**
+* HttpCache
+*
+* The separate service-worker HTTP caching module (distinct from collection
+* sync; see CONTEXT.md). Core defines the runtime-agnostic service: a
+* Request/Response cache with freshness windows, stale-while-revalidate,
+* and tag-based invalidation. The browser package implements the store over
+* the Cache API (fixing the former text-only body limitation) and closes the
+* loop on collection- and row-driven invalidation: `HttpCacheInvalidation`
+* maps an engine's collection and row changes (the `collection:{name}` /
+* `collection:{name}:{id}` tag convention, #207) onto `invalidateTags`, so a
+* synced change evicts the responses tagged for what it touched.
+* Implementations for edge runtimes can back the store with their own
+* primitives.
+*
+* Phase 3 module: interfaces are final-shape; the fetch-event handler and
+* Cache API store land with the browser host.
+*/
+var HttpCache_exports = /* @__PURE__ */ __exportAll({
+	ResponseCacheStore: () => ResponseCacheStore,
+	evictionTags: () => evictionTags,
+	fineTagFor: () => fineTagFor,
+	tagFor: () => tagFor
+});
+/**
+* The {@link ResponseCacheStore} service tag, for apps that provide a store by layer;
+* the fetch handlers take it as an option.
+*/
+const ResponseCacheStore = Context.Service("@thomasfosterau/legation/ResponseCacheStore");
+/** The coarse tag of a collection: `collection:{name}`. Every response enumerating (part of) it carries it. */
+const tagFor = (collection) => `collection:${collection}`;
+/** The fine tag of one row: `collection:{name}:{id}`. A response carries one per row it contains. */
+const fineTagFor = (collection, id) => `${tagFor(collection)}:${id}`;
+/**
+* The tags to evict for a change, each once: the coarse tag of every touched
+* collection **and** the fine tag of every touched row. The coarse eviction is
+* not redundant with the fine one: a cached aggregate (a list, a feed, a
+* sitemap) can be staled by a row it does not yet contain, such as a newly
+* published one, and only the coarse tag reaches it.
+*/
+const evictionTags = (touched, options = {}) => {
+	const coarse = options.tagFor ?? tagFor;
+	const fine = options.fineTagFor ?? fineTagFor;
+	return Arr.dedupe([...touched.collections.map((collection) => coarse(collection)), ...touched.rows.map((row) => fine(row.collection, row.id))]);
+};
+export { SpecExport_exports as S, Derive_exports as _, FanoutBus_exports as a, Paced_exports as b, PushPoke_exports as c, FilterCorpus_exports as d, EngineHost_exports as f, LiveQuery_exports as g, EngineAtoms_exports as h, BusBrokers_exports as i, InvalidationSink_exports as l, PromiseFacade_exports as m, SyncRoom_exports as n, FanoutBroker_exports as o, MirrorChannel_exports as p, HintSource_exports as r, FanoutTopics_exports as s, HttpCache_exports as t, BackendContract_exports as u, Incremental_exports as v, Undo_exports as x, Introspection_exports as y };
+
+//# sourceMappingURL=internal-JyoQMlfK.js.map