@ultimat3/realtime 20.2.1 → 22.0.0

package/src/use-query.ts

@@ -0,0 +1,260 @@
+// The ONE read hook. Live-ness is the query's, not the hook's: a live ref subscribes over the
+// page socket, any other is one HTTP read through `@ultimat3/query`'s client (and so through
+// core's one transport). Either way a list is an ORDER of keys and the rows are the page store's,
+// so a record updated anywhere re-renders every list showing it without refetching the list.
+
+import { type AsyncState, isSuperseded, type RecordEnvelope, type Row } from '@ultimat3/core/page';
+import { queryClientMethodFor } from '@ultimat3/query/client';
+import type { LiveHandle } from './client-contract';
+import type { JsonValue } from './json';
+import { pageSocket } from './page-socket';
+import { pageStore } from './page-store';
+import { isServerRender, signalFor } from './reactivity';
+import { type RecordStore, recordKey } from './record-store';
+
+/**
+ * What a browser may name a query by: its registered name and two facts the server declaration
+ * holds. Never the query VALUE — importing one drags its whole read path into the island
+ * (measured 698,801 B for the dummy feed). The type has no server field, which is the rule.
+ */
+export interface QueryRef {
+  readonly name: string;
+  /** `live: true` on the declaration: rows arrive and move over the page socket. */
+  readonly live?: boolean;
+  /**
+   * The record type (entity name) a NON-live read's rows are. Named, the list is the keys of the
+   * answer's `records[type]` — store records any write moves; omitted, or answered with no records
+   * envelope, the list holds its rows itself and only a refetch moves them. A live read needs none.
+   */
+  readonly entity?: string;
+}
+
+/** A callable `AsyncState` over the list, plus the two things a caller does to it. */
+export type QueryAccessor<R extends object = Row> = (() => AsyncState<readonly R[]>) & {
+  /** Read again from the first page, keeping the current rows on screen (`refreshing`). */
+  refetch(): void;
+  /**
+   * The next page, appended — from the cursor the server's last page answered with. A no-op on a
+   * live read, on a read with no `first`, and once the server said there is no next page.
+   */
+  more(): void;
+  /** Whether the server's last page said another follows. Reactive, like the accessor itself. */
+  hasMore(): boolean;
+  release(): void;
+  [Symbol.dispose](): void;
+};
+
+const PENDING: AsyncState<never> = Object.freeze({ status: 'pending' });
+const nothing = (): void => undefined;
+
+/**
+ * `input` is read ONCE, at call time: there is no reactive runtime here to re-run it, and a
+ * silently stale subscription is worse than a new call. A changed input is a new `useQuery`.
+ */
+export interface QueryOptions {
+  /** Read in pages of this many rows (`query.page`); `more()` appends the next. Non-live only. */
+  readonly first?: number;
+}
+
+export function useQuery<R extends object = Row>(
+  ref: QueryRef,
+  input: JsonValue,
+  options: QueryOptions = {},
+): QueryAccessor<R> {
+  const signal = signalFor('useQuery');
+  if (isServerRender()) {
+    return Object.assign((): AsyncState<readonly R[]> => PENDING, {
+      refetch: nothing,
+      more: nothing,
+      hasMore: () => false,
+      release: nothing,
+      [Symbol.dispose]: nothing,
+    });
+  }
+  const [version, setVersion] = signal(0);
+  const bump = (): void => setVersion(version() + 1);
+  return ref.live === true
+    ? liveAccessor<R>(pageSocket('useQuery').subscribeLive<R>(ref, input), version, bump)
+    : readAccessor<R>(pageStore(), ref, input, options, version, bump);
+}
+
+function liveAccessor<R extends object>(
+  handle: LiveHandle<R>,
+  version: () => number,
+  bump: () => void,
+): QueryAccessor<R> {
+  // Seen once a snapshot landed — read or not — so a drop after it keeps the rows on screen.
+  let seen = handle.state() === 'live';
+  const off = handle.onChange(() => {
+    if (handle.state() === 'live') seen = true;
+    bump();
+  });
+  const read = (): AsyncState<readonly R[]> => {
+    version();
+    const state = handle.state();
+    if (state === 'failed') return { status: 'failed', error: handle.error() };
+    if (state === 'live') {
+      seen = true;
+      return { status: 'ready', data: handle.rows() };
+    }
+    // Loading, stale or offline: what was shown stays shown, marked busy — never torn down.
+    return seen ? { status: 'refreshing', data: handle.rows() } : PENDING;
+  };
+  const release = (): void => {
+    off();
+    handle.unsubscribe();
+  };
+  return Object.assign(read, {
+    refetch: nothing,
+    more: nothing,
+    hasMore: () => false,
+    release,
+    [Symbol.dispose]: release,
+  });
+}
+
+function readAccessor<R extends object>(
+  store: RecordStore,
+  ref: QueryRef,
+  input: JsonValue,
+  options: QueryOptions,
+  version: () => number,
+  bump: () => void,
+): QueryAccessor<R> {
+  const type = ref.entity;
+  const method = queryClientMethodFor(ref.name, { baseUrl: '' });
+  let state: AsyncState<readonly Row[]> = PENDING;
+  /** Record keys in answer order when the rows are records; the rows themselves when not. */
+  let keys: readonly string[] = [];
+  let own: readonly Row[] = [];
+  let released = false;
+  let generation = 0;
+  /** The cursor the server's last page answered with; `null` = no next page (or not paged). */
+  let after: string | null = null;
+  const off =
+    type === undefined
+      ? nothing
+      : store.subscribe((changed) => {
+          if (keys.some((key) => changed.has(recordKey(type, key)))) bump();
+        });
+
+  const rows = (): readonly Row[] => {
+    if (type === undefined || keys.length === 0) return own;
+    const out: Row[] = [];
+    for (const key of keys) {
+      const row = store.peek(type, key);
+      if (row !== undefined) out.push(row);
+    }
+    return out;
+  };
+
+  const hold = (next: readonly string[]): void => {
+    if (type === undefined) return;
+    store.batch(() => {
+      for (const key of next) store.retain(type, key);
+      for (const key of keys) store.release(type, key);
+    });
+  };
+
+  /**
+   * One answer: its rows, and — when the server sent the records envelope — the KEYS of this
+   * read's records in answer order (`records[type]`, which `rowsOf` fills first-seen = data order).
+   * The browser never derives a key: an answer with no records envelope holds its rows itself.
+   */
+  const fetch = (
+    append: boolean,
+  ): Promise<{ rows: readonly Row[]; keys: string[] | null; next?: string | null }> => {
+    let keysOf: string[] | null = null;
+    const onEnvelope = (envelope: RecordEnvelope): void => {
+      const records = type === undefined ? undefined : envelope.records?.[type];
+      keysOf = records === undefined ? null : Object.keys(records);
+    };
+    const answered = (rows: readonly Row[]) => ({ rows, keys: keysOf });
+    if (options.first === undefined) {
+      return (method(input, { onEnvelope }) as Promise<readonly Row[]>).then(answered);
+    }
+    const controls =
+      append && after !== null ? { first: options.first, after } : { first: options.first };
+    // The page's cursor travels WITH its rows and is taken only where the rows are: a `more()`
+    // a refetch superseded wrote its cursor here, before the generation check discarded its rows.
+    return method.page(input, controls, { onEnvelope }).then((page) => ({
+      ...answered(page.rows as readonly Row[]),
+      next: page.hasNextPage ? page.endCursor : null,
+    }));
+  };
+
+  const load = (append = false): void => {
+    const mine = ++generation;
+    if (state.status === 'ready') state = { status: 'refreshing', data: rows() };
+    bump();
+    fetch(append).then(
+      (answer) => {
+        if (released || mine !== generation) return;
+        if (answer.next !== undefined) after = answer.next;
+        if (type === undefined || answer.keys === null) {
+          // Not records — no type named, or no envelope: the list holds its own rows.
+          own = append ? [...own, ...answer.rows] : answer.rows;
+          if (!append) {
+            hold([]);
+            keys = [];
+          }
+        } else {
+          // The transport adopted the envelope's records before this ran; the window is their keys.
+          const answered = answer.keys;
+          const next = append
+            ? [...keys, ...answered.filter((key) => !keys.includes(key))]
+            : answered;
+          hold(next);
+          keys = next;
+          if (!append) own = [];
+        }
+        state = { status: 'ready', data: [] };
+        bump();
+      },
+      (error: unknown) => {
+        if (released || mine !== generation) return;
+        // The page changed principal under this read: its answer was the previous one's, and the
+        // store it would have landed in is already empty. Read again, as the new principal.
+        if (isSuperseded(error)) {
+          load();
+          return;
+        }
+        state = { status: 'failed', error };
+        bump();
+      },
+    );
+  };
+
+  load();
+  const read = (): AsyncState<readonly R[]> => {
+    version();
+    if (state.status === 'pending' || state.status === 'failed') return state;
+    // Rows are typed by the caller's query; the store holds them as JSON rows.
+    const data = rows() as readonly R[];
+    return state.status === 'refreshing'
+      ? { status: 'refreshing', data }
+      : { status: 'ready', data };
+  };
+  const release = (): void => {
+    if (released) return;
+    released = true;
+    off();
+    hold([]);
+    keys = [];
+  };
+  return Object.assign(read, {
+    refetch: () => {
+      after = null;
+      load();
+    },
+    more: () => {
+      if (after !== null && state.status === 'ready') load(true);
+    },
+    hasMore: () => {
+      version();
+      return after !== null;
+    },
+    release,
+    [Symbol.dispose]: release,
+  });
+}

package/src/use-record.ts

@@ -0,0 +1,121 @@
+// One record, by type and key, out of the page's store — the same object every island showing it
+// holds, moved once by whichever write lands first (an HTTP answer, a socket frame, an optimistic
+// twin). Imports no socket: an island that only reads records ships none of the lifecycle.
+
+import type { AsyncState, Row } from '@ultimat3/core/page';
+import { pageStore } from './page-store';
+import { isServerRender, signalFor } from './reactivity';
+import { recordKey } from './record-store';
+
+/**
+ * A callable `AsyncState`: `pending` until the record first arrives, `ready` from then on —
+ * `ready` with `undefined` once the server removed it, so a deleted record is a settled answer
+ * and never a skeleton forever. `release()` lets go; the caller owns it (Solid: `onCleanup`).
+ */
+export type RecordAccessor<R extends object = Row> = (() => AsyncState<R | undefined>) & {
+  release(): void;
+  [Symbol.dispose](): void;
+};
+
+const PENDING: AsyncState<never> = Object.freeze({ status: 'pending' });
+
+/** Nothing was held, so nothing is released — and a teardown never fails a render. */
+const releaseNothing = (): void => undefined;
+
+export function useRecord<R extends object = Row>(type: string, key: string): RecordAccessor<R> {
+  const signal = signalFor('useRecord');
+  if (isServerRender()) {
+    // The record arrives in a browser this render does not have: the page's own loading branch.
+    return Object.assign((): AsyncState<R | undefined> => PENDING, {
+      release: releaseNothing,
+      [Symbol.dispose]: releaseNothing,
+    });
+  }
+  const store = pageStore();
+  const [version, setVersion] = signal(0);
+  const target = recordKey(type, key);
+  store.retain(type, key);
+  // Seen once it has ever been there — read or not — so a removal after it is a settled answer.
+  let seen = store.peek(type, key) !== undefined;
+  const unsubscribe = store.subscribe((changed) => {
+    if (!changed.has(target)) return;
+    if (store.peek(type, key) !== undefined) seen = true;
+    setVersion(version() + 1);
+  });
+  const read = (): AsyncState<R | undefined> => {
+    version();
+    // The store holds JSON rows; the caller names the entity row type it reads them as.
+    const row = store.peek(type, key) as R | undefined;
+    if (row !== undefined) seen = true;
+    return row === undefined && !seen ? PENDING : { status: 'ready', data: row };
+  };
+  let held = true;
+  const release = (): void => {
+    if (!held) return;
+    held = false;
+    unsubscribe();
+    store.release(type, key);
+  };
+  return Object.assign(read, { release, [Symbol.dispose]: release });
+}
+
+/** A callable `AsyncState` over several records, in the order their keys were given. */
+export type RecordsAccessor<R extends object = Row> = (() => AsyncState<readonly R[]>) & {
+  release(): void;
+  [Symbol.dispose](): void;
+};
+
+/**
+ * Several records of one type, by key — the same store objects `useRecord` hands out. `pending`
+ * until the first of them arrives; then `ready` with those present, in key order: a record the
+ * server removed simply drops out, and a list is never shown as its skeleton again.
+ */
+export function useRecords<R extends object = Row>(
+  type: string,
+  keys: readonly string[],
+): RecordsAccessor<R> {
+  const signal = signalFor('useRecords');
+  if (isServerRender()) {
+    return Object.assign((): AsyncState<readonly R[]> => PENDING, {
+      release: releaseNothing,
+      [Symbol.dispose]: releaseNothing,
+    });
+  }
+  const store = pageStore();
+  const [version, setVersion] = signal(0);
+  const targets = new Set(keys.map((key) => recordKey(type, key)));
+  const present = (): R[] => {
+    const out: R[] = [];
+    // The store holds JSON rows; the caller names the entity row type it reads them as.
+    for (const key of keys) {
+      const row = store.peek(type, key) as R | undefined;
+      if (row !== undefined) out.push(row);
+    }
+    return out;
+  };
+  store.batch(() => {
+    for (const key of keys) store.retain(type, key);
+  });
+  let seen = present().length > 0;
+  const unsubscribe = store.subscribe((changed) => {
+    if (![...changed].some((key) => targets.has(key))) return;
+    if (present().length > 0) seen = true;
+    setVersion(version() + 1);
+  });
+  const read = (): AsyncState<readonly R[]> => {
+    version();
+    const rows = present();
+    if (rows.length > 0) seen = true;
+    return !seen ? PENDING : { status: 'ready', data: rows };
+  };
+  let held = true;
+  const release = (): void => {
+    if (!held) return;
+    held = false;
+    unsubscribe();
+    store.batch(() => {
+      for (const key of keys) store.release(type, key);
+    });
+  };
+  return Object.assign(read, { release, [Symbol.dispose]: release });
+}

package/src/wire-channel.ts

@@ -0,0 +1,116 @@
+// Decoding the channel frames (plan 101, slices 09–10): `records` writes the page store, `events`
+// never does, `replay-gap` is the node's verdict that a socket lost a `records` frame. Held to the
+// same ceilings as every other kind — a `records` frame is rows a socket could otherwise size.
+
+import { isWriteDigest, type Row, WRITE_DIGEST_LENGTH } from '@ultimat3/core/page';
+import type {
+  ChannelAdopt,
+  ChannelEventsFrame,
+  ChannelRecordsFrame,
+  ChannelRemove,
+  ChannelSince,
+  ChannelSubscribeTarget,
+  ReplayGapFrame,
+} from './channel-wire';
+import { isJsonObject, type JsonObject } from './json';
+import { fail, list, num, object, str } from './wire-read';
+import { FRAME_LIMITS, PROTOCOL_VERSION } from './wire-version';
+
+export function records(parsed: JsonObject): ChannelRecordsFrame {
+  const base = {
+    type: 'records',
+    v: PROTOCOL_VERSION,
+    channel: str(parsed, 'channel'),
+    seq: num(parsed, 'seq'),
+    epoch: str(parsed, 'epoch'),
+  } as const;
+  const adopt = parsed['adopt'] === undefined ? undefined : adoptOf(parsed['adopt']);
+  const remove = parsed['remove'] === undefined ? undefined : removeOf(parsed['remove']);
+  const write = parsed['write'];
+  if (write !== undefined && !isWriteDigest(write)) {
+    throw fail(`records.write must be a ${WRITE_DIGEST_LENGTH}-character lowercase hex digest`);
+  }
+  return {
+    ...base,
+    ...(adopt === undefined ? {} : { adopt }),
+    ...(remove === undefined ? {} : { remove }),
+    ...(write === undefined ? {} : { write }),
+  };
+}
+
+export function events(parsed: JsonObject): ChannelEventsFrame {
+  return {
+    type: 'events',
+    v: PROTOCOL_VERSION,
+    channel: str(parsed, 'channel'),
+    event: object(parsed['event']),
+  };
+}
+
+export function replayGap(parsed: JsonObject): ReplayGapFrame {
+  return {
+    type: 'replay-gap',
+    v: PROTOCOL_VERSION,
+    channel: str(parsed, 'channel'),
+    epoch: str(parsed, 'epoch'),
+  };
+}
+
+/** `subscribe.target` for a declared channel: a name, string params (capped), an optional resume. */
+export function channelTarget(value: JsonObject): ChannelSubscribeTarget {
+  const raw = object(value['params'] ?? {});
+  const entries = Object.entries(raw);
+  if (entries.length > FRAME_LIMITS.channelParams) {
+    throw fail(
+      `channel params carry ${entries.length}, over the limit of ${FRAME_LIMITS.channelParams}`,
+    );
+  }
+  const params: Record<string, string> = {};
+  for (const [key, param] of entries) {
+    if (typeof param !== 'string') throw fail(`channel param "${key}" must be a string`);
+    params[key] = param;
+  }
+  const base = { kind: 'channel', channel: str(value, 'channel'), params } as const;
+  return value['since'] === undefined || value['since'] === null
+    ? base
+    : { ...base, since: sinceOf(value['since']) };
+}
+
+function sinceOf(value: unknown): ChannelSince {
+  if (!isJsonObject(value)) throw fail('channel since must be an object');
+  const seq = num(value, 'seq');
+  if (!Number.isInteger(seq) || seq < 0) throw fail('channel since.seq must be a whole number');
+  return { epoch: str(value, 'epoch'), seq };
+}
+
+/** type → key → row. Every row an object, and the whole frame under the snapshot row ceiling. */
+function adoptOf(value: unknown): ChannelAdopt {
+  if (!isJsonObject(value)) throw fail('records.adopt must be an object');
+  let total = 0;
+  const out: Record<string, Readonly<Record<string, Row>>> = {};
+  for (const [type, keyed] of Object.entries(value)) {
+    if (!isJsonObject(keyed)) throw fail(`records.adopt.${type} must be an object`);
+    const rows: Record<string, Row> = {};
+    for (const [key, row] of Object.entries(keyed)) {
+      total += 1;
+      if (total > FRAME_LIMITS.rows) {
+        throw fail(`records.adopt carries more than ${FRAME_LIMITS.rows} rows`);
+      }
+      rows[key] = object(row);
+    }
+    out[type] = rows;
+  }
+  return out;
+}
+
+function removeOf(value: unknown): ChannelRemove {
+  if (!isJsonObject(value)) throw fail('records.remove must be an object');
+  const out: Record<string, readonly string[]> = {};
+  for (const type of Object.keys(value)) {
+    out[type] = list(value, type, FRAME_LIMITS.rows, `records.remove.${type}`).map((key) => {
+      if (typeof key !== 'string') throw fail(`records.remove.${type} must hold strings`);
+      return key;
+    });
+  }
+  return out;
+}

package/src/wire-read.ts

@@ -0,0 +1,86 @@
+// The decoder's primitives: every field a frame carries is read through one of these, and every
+// refusal is `X_PROTOCOL_VERSION` with the field named. Shared by `sync-protocol.ts` and
+// `wire-channel.ts`, so the channel frames are held to the same ceilings as every other kind.
+
+import { isJsonObject, type JsonObject, type JsonValue } from './json';
+import { ProtocolVersionError } from './page-errors';
+import { FRAME_LIMITS, PROTOCOL_VERSION } from './wire-version';
+
+export function fail(detail: string): ProtocolVersionError {
+  return new ProtocolVersionError({ got: detail, expected: PROTOCOL_VERSION, detail });
+}
+
+export function str(obj: JsonObject, key: string): string {
+  const value = obj[key];
+  if (typeof value !== 'string') throw fail(`field "${key}" must be a string`);
+  return value;
+}
+
+export function nullableStr(obj: JsonObject, key: string): string | null {
+  const value = obj[key];
+  if (value === null || value === undefined) return null;
+  if (typeof value !== 'string') throw fail(`field "${key}" must be a string or null`);
+  return value;
+}
+
+export function num(obj: JsonObject, key: string): number {
+  const value = obj[key];
+  if (typeof value !== 'number' || !Number.isFinite(value)) {
+    throw fail(`field "${key}" must be a finite number`);
+  }
+  return value;
+}
+
+export function pick<T extends string>(obj: JsonObject, key: string, allowed: readonly T[]): T {
+  const value = str(obj, key);
+  const found = allowed.find((candidate) => candidate === value);
+  if (found === undefined) throw fail(`field "${key}" must be one of ${allowed.join('|')}`);
+  return found;
+}
+
+/**
+ * An array field, with the ceiling the caller had to choose. `max` is required rather than
+ * defaulted: a new list field on a new frame is a new thing an authenticated socket can make
+ * arbitrarily large, and a default would let one ship without anyone deciding its size.
+ */
+export function list(obj: JsonObject, key: string, max: number, label = key): JsonValue[] {
+  const value = obj[key];
+  if (value === undefined || value === null) return [];
+  if (!Array.isArray(value)) throw fail(`field "${label}" must be an array`);
+  if (value.length > max) {
+    throw fail(`field "${label}" carries ${value.length} entries, over the limit of ${max}`);
+  }
+  return value;
+}
+
+/**
+ * A client-supplied value, walked ITERATIVELY to its limits. Iteratively because the thing being
+ * refused is a stack overflow: `queryHash` -> `canonicalJson` recurses over exactly this value, so a
+ * depth check that recursed would be the same crash one frame earlier.
+ */
+export function bounded(value: JsonValue, label: string): JsonValue {
+  const stack: { node: JsonValue; depth: number }[] = [{ node: value, depth: 1 }];
+  let seen = 0;
+  while (stack.length > 0) {
+    // `pop` cannot answer undefined here — the loop guard is the length — and the check is what
+    // makes that readable to the compiler without a cast.
+    const next = stack.pop();
+    if (next === undefined) break;
+    seen += 1;
+    if (seen > FRAME_LIMITS.inputNodes) {
+      throw fail(`field "${label}" holds more than ${FRAME_LIMITS.inputNodes} values`);
+    }
+    if (next.depth > FRAME_LIMITS.inputDepth) {
+      throw fail(`field "${label}" is nested deeper than ${FRAME_LIMITS.inputDepth}`);
+    }
+    if (next.node === null || typeof next.node !== 'object') continue;
+    const children = Array.isArray(next.node) ? next.node : Object.values(next.node);
+    for (const child of children) stack.push({ node: child, depth: next.depth + 1 });
+  }
+  return value;
+}
+
+export function object(value: unknown): JsonObject {
+  if (!isJsonObject(value)) throw fail('expected a JSON object');
+  return value;
+}

package/src/wire-version.ts

@@ -0,0 +1,44 @@
+// The wire's version and its hard ceilings — a leaf, so every reader (`sync-protocol.ts`,
+// `wire-read.ts`, `wire-channel.ts`) shares one number and one table with no import cycle.
+
+import { CURSOR_ID_LIMIT } from './cursor';
+
+/**
+ * **3 since 21.0.0** (plan 101), when the socket stopped carrying writes: the `mutate` and
+ * `rebase` kinds are deleted, so a client one major behind sends a frame this node refuses with
+ * `X_PROTOCOL_VERSION` — its instruction is the rebuild that client needs. Writes are HTTP
+ * (`useMutation`). Slice 09's `records` frame reuses this bump; it does not take another.
+ *
+ * 2 since 2026-08-24, when `cursor.digest` and `cursor.count` were deleted. The version guards
+ * incompatibility, never novelty — an additive optional field (`snapshot.entity`) and a removed
+ * field read through `list()` (`hello.resume`) both stayed at 1, because `decode` is a whitelist
+ * and `list()` answers `[]` for an absent field. `cursor()` is the other kind of reader: it reads
+ * through `str`/`num`, which THROW on an absent field, so a cursor without those two is a frame a
+ * node or a client one deploy behind cannot read — in BOTH directions, since a cursor rides the
+ * client's `subscribe` and the node's `snapshot`. That is exactly what this number refuses, with
+ * one instruction instead of a per-frame "field \"digest\" must be a string".
+ */
+export const PROTOCOL_VERSION = 3;
+
+/**
+ * What one frame may contain. Hard ceilings a caller cannot widen — the shape
+ * `packages/mcp/src/query-limits.ts` uses — because every one of them is read off a socket the
+ * node has already paid for: an unbounded `cursor.ids` was consumed raw into a `Set`, and an
+ * `input` of arbitrary depth reached `canonicalJson`, which recurses.
+ *
+ * Every number clears what this node itself produces, or the decoder refuses its own frames on
+ * the next reconnect: `cursorIds` is `CURSOR_ID_LIMIT`, `patches` clears
+ * `defaultReconnectBudget.maxPatches`.
+ */
+export const FRAME_LIMITS = Object.freeze({
+  cursorIds: CURSOR_ID_LIMIT,
+  patches: 4_096,
+  rows: 10_000,
+  members: 4_096,
+  /** Nesting one `input` may reach. 32 is far past any query's real argument shape. */
+  inputDepth: 32,
+  /** Values one `input` may hold in total, so a flat-but-enormous object is refused too. */
+  inputNodes: 10_000,
+  /** Params one channel subscribe may name. A channel declares a handful; a client picks none. */
+  channelParams: 16,
+});