@vendoai/store 0.1.0 → 0.4.0

package/dist/db.js

@@ -1,105 +1,354 @@
 import { PGlite } from "@electric-sql/pglite";
-import { drizzle as drizzlePglite } from "drizzle-orm/pglite";
-import { migrate as migratePglite } from "drizzle-orm/pglite/migrator";
-import { drizzle as drizzlePg } from "drizzle-orm/node-postgres";
-import { migrate as migratePg } from "drizzle-orm/node-postgres/migrator";
-import { sql } from "drizzle-orm";
 import { Client, Pool } from "pg";
-import { fileURLToPath } from "node:url";
 import fs from "node:fs";
-import path from "node:path";
+import { join, resolve } from "node:path";
 const SERVERLESS_ENVS = ["VERCEL", "CF_PAGES", "AWS_LAMBDA_FUNCTION_NAME"];
-const MIGRATIONS_DIR = path.join(path.dirname(fileURLToPath(import.meta.url)), "..", "migrations");
-const ADVISORY_LOCK_KEY = 7461001;
-const registry = (globalThis["__vendoStoreRegistry"] ??= {
-    instances: new Map(),
-    migrated: new Map(),
-});
-/**
- * pg.Pool re-emits idle-client errors (backend restart, dropped connection)
- * on itself; with no 'error' listener Node escalates that to an uncaught
- * exception and kills the host process. The pool already discards the dead
- * client — log and keep serving.
- */
-export function createPgPool(connectionString) {
-    const pool = new Pool({ connectionString });
-    pool.on("error", (err) => console.error("[vendo] postgres pool: idle connection error (recovering)", err));
-    return pool;
+const ADVISORY_LOCK_KEY = 7_461_001;
+const pgUrls = new WeakMap();
+function preparePgliteDir(dataDir) {
+    if (dataDir.startsWith("memory://"))
+        return;
+    try {
+        fs.mkdirSync(dataDir, { recursive: true });
+        fs.accessSync(dataDir, fs.constants.W_OK);
+    }
+    catch (error) {
+        const cause = error instanceof Error ? error.message : String(error);
+        throw new Error(`[vendo] PGlite data directory "${dataDir}" is not writable — fix its permissions or choose another dataDir. Cause: ${cause}`);
+    }
 }
-export function createVendoDatabase(config = {}) {
-    // Precedence: explicit connectionString > explicit pglite > env DATABASE_URL
-    // > default PGlite — an explicitly passed `pglite` config must not lose to
-    // an ambient DATABASE_URL env var.
-    // `||` (not `??`): a set-but-empty DATABASE_URL means "no connection string",
-    // and must not become a shared "" cache key across different PGlite dirs.
-    const conn = config.connectionString || (config.pglite ? undefined : process.env["DATABASE_URL"] || undefined);
-    const dataDir = config.pglite?.dataDir ?? process.env["VENDO_DATA_DIR"] ?? ".vendo/data";
-    const cacheKey = conn ?? `pglite:${dataDir}`;
-    const existing = registry.instances.get(cacheKey);
-    if (existing)
-        return existing;
-    const created = (async () => {
-        if (conn)
-            return { kind: "pg", db: drizzlePg(createPgPool(conn)), cacheKey };
-        const onServerless = SERVERLESS_ENVS.find((e) => process.env[e]);
-        if (onServerless) {
-            throw new Error(`[vendo] PGlite (the zero-config store) cannot run on ${onServerless} — filesystems there are ephemeral. ` +
-                `Set DATABASE_URL to a hosted Postgres (Supabase, Neon, …) instead.`);
+/** ENG-350 — a dev server killed uncleanly leaves postmaster.pid in the data
+    dir, and PGlite.create can then hard-abort with a raw `Aborted()`
+    (electric-sql/pglite#2, #794). PGlite's wasm postgres always records
+    Emscripten's fake pid (-42), so a non-positive or unparseable pid can never
+    belong to a live owner — stale by definition. A real positive pid (a native
+    postgres dir, or a custom writer) is only stale once that process is gone. */
+function readPgliteLock(dataDir) {
+    if (dataDir.startsWith("memory://"))
+        return undefined;
+    const lockPath = join(dataDir, "postmaster.pid");
+    let firstLine;
+    try {
+        firstLine = fs.readFileSync(lockPath, "utf8").split("\n", 1)[0] ?? "";
+    }
+    catch {
+        return undefined; // no lock file — nothing to heal
+    }
+    const pid = Number.parseInt(firstLine.trim(), 10);
+    if (Number.isFinite(pid) && pid > 0 && isPidAlive(pid))
+        return { path: lockPath, livePid: pid };
+    return { path: lockPath };
+}
+function isPidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (error) {
+        // EPERM = exists but owned by someone else — still alive.
+        return error.code === "EPERM";
+    }
+}
+const errorMessage = (error) => (error instanceof Error ? error.message : String(error));
+/* ENG-351 — single-writer discipline for the PGlite default.
+
+   Under `next dev` the host's server module graph is evaluated by more than
+   one OS process (Turbopack spawns transient evaluator workers) and, after an
+   HMR edit, more than once within one process. Each evaluation runs
+   `createVendo` → `createStore` → PGlite on the SAME data dir. PGlite has no
+   cross-process locking, and even a second instance's STARTUP (WAL recovery,
+   pg_control writes) tears the live writer's state — the dir later reopens
+   with a raw `Aborted()` and the last turns are gone (ENG-351's field trace).
+
+   Two layers, both keyed by the resolved data dir:
+   - In-process: a globalThis registry shares ONE live driver across every
+     handle (and every HMR copy of this module), refcounted so closing one
+     handle never tears the driver out from under another.
+   - Cross-process: a `<dataDir>/.vendo-writer.lock` pidfile taken BEFORE
+     PGlite.create. A second process WAITS (it never touches postgres files)
+     and takes over only once the holder is provably gone — recorded pid dead,
+     or the holder's mtime refresh stopped long ago (pid-reuse fallback). Lock
+     release rides close(); a SIGKILLed holder self-heals via the dead-pid
+     check, which is also what makes the ENG-350 postmaster.pid heal safe:
+     only the lock holder ever reaches it. */
+const LOCK_TOUCH_MS = 5_000;
+const LOCK_STALE_MTIME_MS = 30_000;
+const LOCK_POLL_MS = 250;
+const LOCK_WARN_AFTER_MS = 5_000;
+const LOCK_REWARN_EVERY_MS = 60_000;
+function readLockPid(lockPath) {
+    try {
+        const pid = Number.parseInt(fs.readFileSync(lockPath, "utf8").split("\n", 1)[0] ?? "", 10);
+        return Number.isFinite(pid) ? pid : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The holder is provably gone: its recorded pid is dead, it recorded THIS
+    process (a crashed predecessor with our reused pid — a live foreign holder
+    can never be us), or it stopped refreshing the lock's mtime long ago. */
+function lockIsStale(lockPath) {
+    const pid = readLockPid(lockPath);
+    if (pid !== undefined && (pid === process.pid || !isPidAlive(pid)))
+        return true;
+    try {
+        return Date.now() - fs.statSync(lockPath).mtimeMs > LOCK_STALE_MTIME_MS;
+    }
+    catch {
+        return false; // vanished — the acquire loop just retries
+    }
+}
+async function acquirePgliteDirLock(dataDir) {
+    const lockPath = join(resolve(dataDir), ".vendo-writer.lock");
+    const startedAt = Date.now();
+    let warnedAt;
+    for (;;) {
+        try {
+            fs.writeFileSync(lockPath, `${process.pid}\n`, { flag: "wx" });
+            break;
+        }
+        catch (error) {
+            if (error.code !== "EEXIST") {
+                throw new Error(`[vendo] cannot create the PGlite lock file "${lockPath}" — fix permissions on its directory or choose another dataDir. Cause: ${errorMessage(error)}`);
+            }
+        }
+        if (lockIsStale(lockPath)) {
+            fs.rmSync(lockPath, { force: true });
+            continue; // re-race the wx create; exactly one contender wins
         }
-        if (!dataDir.startsWith("memory://")) {
+        const waitedMs = Date.now() - startedAt;
+        if (waitedMs >= LOCK_WARN_AFTER_MS && (warnedAt === undefined || Date.now() - warnedAt >= LOCK_REWARN_EVERY_MS)) {
+            warnedAt = Date.now();
+            console.warn(`[vendo] PGlite data directory "${dataDir}" is held by another process (pid ${readLockPid(lockPath) ?? "unknown"}) — waiting for it to release the lock. If a second server runs on this dataDir, stop it or point it at its own dataDir / a Postgres url.`);
+        }
+        await wait(LOCK_POLL_MS);
+    }
+    // Refresh mtime while held so waiters can tell a live holder from a
+    // pid-reused ghost; unref'd so the lock never keeps the process alive.
+    const touch = setInterval(() => {
+        try {
+            const now = new Date();
+            fs.utimesSync(lockPath, now, now);
+        }
+        catch {
+            // Lock stolen or dir gone — nothing to refresh; release() still guards on pid.
+        }
+    }, LOCK_TOUCH_MS);
+    touch.unref?.();
+    let released = false;
+    return {
+        release() {
+            if (released)
+                return;
+            released = true;
+            clearInterval(touch);
             try {
-                fs.mkdirSync(dataDir, { recursive: true });
-                fs.accessSync(dataDir, fs.constants.W_OK);
+                if (readLockPid(lockPath) === process.pid)
+                    fs.rmSync(lockPath, { force: true });
             }
-            catch (err) {
-                // Fail boot loudly — never fall back to a silent ephemeral store.
-                throw new Error(`[vendo] PGlite data directory "${dataDir}" is not writable — ` +
-                    `fix its permissions or point VENDO_DATA_DIR elsewhere. Cause: ${err instanceof Error ? err.message : String(err)}`);
+            catch {
+                // Best-effort: a leftover lock self-heals via the dead-pid check.
             }
-        }
-        const client = await PGlite.create(dataDir);
-        return { kind: "pglite", db: drizzlePglite(client), cacheKey };
-    })();
-    created.catch(() => registry.instances.delete(cacheKey)); // failed boots retry
-    registry.instances.set(cacheKey, created);
-    return created;
+        },
+    };
+}
+const wait = (ms) => new Promise((done) => setTimeout(done, ms));
+const PGLITE_REGISTRY_KEY = Symbol.for("vendoai.store.pglite-registry@1");
+function pgliteRegistry() {
+    const holder = globalThis;
+    return (holder[PGLITE_REGISTRY_KEY] ??= new Map());
 }
-/** Idempotent, race-safe (advisory lock on real PG), memoized per handle. */
-export function migrateVendoDatabase(handle) {
-    const memo = registry.migrated.get(handle.cacheKey);
-    if (memo)
-        return memo;
-    const run = (async () => {
-        if (handle.kind === "pglite") {
-            await migratePglite(handle.db, { migrationsFolder: MIGRATIONS_DIR, migrationsSchema: "vendo" });
-            return;
+function acquireSharedPglite(dataDir) {
+    const registry = pgliteRegistry();
+    const key = resolve(dataDir);
+    let entry = registry.get(key);
+    if (!entry) {
+        const created = { refs: 0, driver: Promise.resolve(undefined) };
+        created.driver = (async () => {
+            const lock = await acquirePgliteDirLock(dataDir);
+            created.lock = lock;
+            try {
+                return await createPgliteHealingStaleLock(dataDir);
+            }
+            catch (error) {
+                lock.release();
+                throw error;
+            }
+        })();
+        // A failed open must not poison the dir for later attempts.
+        created.driver.catch(() => {
+            if (registry.get(key) === created)
+                registry.delete(key);
+        });
+        registry.set(key, created);
+        entry = created;
+    }
+    entry.refs += 1;
+    return entry;
+}
+async function releaseSharedPglite(dataDir, entry) {
+    entry.refs -= 1;
+    if (entry.refs > 0)
+        return;
+    const registry = pgliteRegistry();
+    const key = resolve(dataDir);
+    if (registry.get(key) === entry)
+        registry.delete(key);
+    const driver = await entry.driver.catch(() => undefined);
+    try {
+        await driver?.close();
+    }
+    finally {
+        entry.lock?.release();
+    }
+}
+/** ENG-350 — self-heal a stale lock instead of hard-aborting boot. */
+async function createPgliteHealingStaleLock(dataDir) {
+    try {
+        return await PGlite.create(dataDir);
+    }
+    catch (error) {
+        const lock = readPgliteLock(dataDir);
+        if (!lock)
+            throw error;
+        if (lock.livePid !== undefined) {
+            throw new Error(`[vendo] PGlite data directory "${dataDir}" is locked by a live process (pid ${lock.livePid}) — stop that process or point dataDir elsewhere. Cause: ${errorMessage(error)}`);
         }
-        // Advisory locks are SESSION-scoped, and the handle's db wraps a pg.Pool:
-        // lock, migrate, and unlock could each run on a DIFFERENT pooled session,
-        // so the lock would protect nothing (and the unlock could target a session
-        // that never held it, leaking the lock on the one that did). Run the whole
-        // lock → migrate → unlock sequence on ONE dedicated connection instead.
-        // For the pg kind, cacheKey IS the connection string (see createVendoDatabase).
-        const client = new Client({ connectionString: handle.cacheKey });
-        await client.connect();
+        console.warn(`[vendo] PGlite data directory "${dataDir}" failed to open with a stale postmaster.pid left by an unclean shutdown — removing the stale lock and retrying.`);
+        fs.rmSync(lock.path, { force: true });
         try {
-            const db = drizzlePg(client);
-            await db.execute(sql `select pg_advisory_lock(${ADVISORY_LOCK_KEY})`);
+            return await PGlite.create(dataDir);
+        }
+        catch (retryError) {
+            throw new Error(`[vendo] PGlite data directory "${dataDir}" failed to open even after clearing its stale lock — the store is likely corrupt. Back up and delete the directory to start fresh, or set a Postgres url. Cause: ${errorMessage(retryError)}`);
+        }
+    }
+}
+/** 02-store §4 */
+export function createDb(config = {}) {
+    const kind = config.url ? "pg" : "pglite";
+    const dataDir = config.dataDir ?? ".vendo/data";
+    let driver;
+    let opening;
+    let shared;
+    let closed = false;
+    if (config.url) {
+        const pool = new Pool({ connectionString: config.url });
+        pool.on("error", (error) => {
+            console.error("[vendo] postgres pool: idle connection error (recovering)", error);
+        });
+        driver = pool;
+    }
+    const open = () => {
+        if (closed)
+            return Promise.reject(new Error("[vendo] store is closed"));
+        if (driver)
+            return Promise.resolve(driver);
+        if (opening)
+            return opening;
+        opening = (async () => {
+            const serverlessEnv = SERVERLESS_ENVS.find((name) => process.env[name]);
+            if (serverlessEnv) {
+                throw new Error(`[vendo] PGlite cannot run on ${serverlessEnv} because its filesystem is ephemeral. Set a Postgres url instead.`);
+            }
+            preparePgliteDir(dataDir);
+            // memory:// dirs are private to this handle; a real dir goes through the
+            // shared single-writer registry (ENG-351).
+            if (dataDir.startsWith("memory://")) {
+                const pglite = await createPgliteHealingStaleLock(dataDir);
+                driver = pglite;
+                return pglite;
+            }
+            shared = acquireSharedPglite(dataDir);
             try {
-                await migratePg(db, { migrationsFolder: MIGRATIONS_DIR, migrationsSchema: "vendo" });
+                const pglite = await shared.driver;
+                driver = pglite;
+                return pglite;
+            }
+            catch (error) {
+                const failed = shared;
+                shared = undefined;
+                await releaseSharedPglite(dataDir, failed);
+                throw error;
+            }
+        })();
+        opening.catch(() => {
+            if (!closed)
+                opening = undefined;
+        });
+        return opening;
+    };
+    const db = {
+        kind,
+        async query(text, params = []) {
+            const active = await open();
+            const result = active instanceof Pool
+                ? await active.query(text, params)
+                : await active.query(text, params);
+            return { rows: result.rows };
+        },
+        async close() {
+            if (closed)
+                return;
+            closed = true;
+            if (!opening && !driver)
+                return;
+            const active = driver ?? (opening ? await opening.catch(() => undefined) : undefined);
+            driver = undefined;
+            if (shared) {
+                // Shared PGlite: drop this handle's ref; the last one out closes the
+                // wasm instance and releases the dir lock (ENG-351).
+                const held = shared;
+                shared = undefined;
+                await releaseSharedPglite(dataDir, held);
+                return;
             }
-            finally {
-                await db.execute(sql `select pg_advisory_unlock(${ADVISORY_LOCK_KEY})`);
+            if (!active)
+                return;
+            if (active instanceof Pool)
+                await active.end();
+            else
+                await active.close();
+        },
+        raw() {
+            if (!driver) {
+                throw new Error("[vendo] store not opened yet — run ensureSchema() or any query first");
             }
+            return driver;
+        },
+    };
+    if (config.url)
+        pgUrls.set(db, config.url);
+    return db;
+}
+/** 02-store §4 */
+export async function withSchemaLock(db, work) {
+    return withAdvisoryLock(db, ADVISORY_LOCK_KEY, work);
+}
+async function withAdvisoryLock(db, key, work) {
+    if (db.kind === "pglite")
+        return work(db.query.bind(db));
+    const url = pgUrls.get(db);
+    if (!url)
+        throw new Error("[vendo] missing Postgres connection string");
+    const client = new Client({ connectionString: url });
+    await client.connect();
+    const query = async (text, params = []) => {
+        const result = await client.query(text, params);
+        return { rows: result.rows };
+    };
+    try {
+        await query("SELECT pg_advisory_lock($1)", [key]);
+        try {
+            return await work(query);
         }
         finally {
-            await client.end();
+            await query("SELECT pg_advisory_unlock($1)", [key]);
         }
-    })().catch((err) => {
-        throw new Error(`[vendo] migration failed — if this is a permissions error, grant the role CREATE on the database ` +
-            `or run migrations out-of-band (autoMigrate: false + migrateVendoDatabase). Cause: ${err instanceof Error ? err.message : String(err)}`);
-    });
-    run.catch(() => registry.migrated.delete(handle.cacheKey));
-    registry.migrated.set(handle.cacheKey, run);
-    return run;
+    }
+    finally {
+        await client.end();
+    }
 }
+//# sourceMappingURL=db.js.map

package/dist/db.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.js","sourceRoot":"","sources":["../src/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAwB1C,MAAM,eAAe,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE,0BAA0B,CAAU,CAAC;AACpF,MAAM,iBAAiB,GAAG,SAAS,CAAC;AACpC,MAAM,MAAM,GAAG,IAAI,OAAO,EAAc,CAAC;AAEzC,SAAS,gBAAgB,CAAC,OAAe;IACvC,IAAI,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO;IAC5C,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrE,MAAM,IAAI,KAAK,CACb,kCAAkC,OAAO,6EAA6E,KAAK,EAAE,CAC9H,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;iFAKiF;AACjF,SAAS,cAAc,CAAC,OAAe;IACrC,IAAI,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC;QAAE,OAAO,SAAS,CAAC;IACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IACjD,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC,CAAC,iCAAiC;IACrD,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAClD,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAChG,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,CAAC;QACH,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,0DAA0D;QAC1D,OAAQ,KAA+B,CAAC,IAAI,KAAK,OAAO,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,KAAc,EAAU,EAAE,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AAE1G;;;;;;;;;;;;;;;;;;;;6CAoB6C;AAE7C,MAAM,aAAa,GAAG,KAAK,CAAC;AAC5B,MAAM,mBAAmB,GAAG,MAAM,CAAC;AACnC,MAAM,YAAY,GAAG,GAAG,CAAC;AACzB,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAMpC,SAAS,WAAW,CAAC,QAAgB;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3F,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;4EAE4E;AAC5E,SAAS,WAAW,CAAC,QAAgB;IACnC,MAAM,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,GAAG,KAAK,SAAS,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAChF,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,GAAG,mBAAmB,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC,CAAC,2CAA2C;IAC3D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,OAAe;IACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,IAAI,QAA4B,CAAC;IACjC,SAAS,CAAC;QACR,IAAI,CAAC;YACH,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,GAAG,OAAO,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/D,MAAM;QACR,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvD,MAAM,IAAI,KAAK,CACb,+CAA+C,QAAQ,0EAA0E,YAAY,CAAC,KAAK,CAAC,EAAE,CACvJ,CAAC;YACJ,CAAC;QACH,CAAC;QACD,IAAI,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1B,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACrC,SAAS,CAAC,oDAAoD;QAChE,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;QACxC,IAAI,QAAQ,IAAI,kBAAkB,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,IAAI,oBAAoB,CAAC,EAAE,CAAC;YAChH,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CACV,kCAAkC,OAAO,qCAAqC,WAAW,CAAC,QAAQ,CAAC,IAAI,SAAS,2IAA2I,CAC5P,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3B,CAAC;IACD,oEAAoE;IACpE,uEAAuE;IACvE,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,+EAA+E;QACjF,CAAC;IACH,CAAC,EAAE,aAAa,CAAC,CAAC;IAClB,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAChB,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,OAAO;QACL,OAAO;YACL,IAAI,QAAQ;gBAAE,OAAO;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,aAAa,CAAC,KAAK,CAAC,CAAC;YACrB,IAAI,CAAC;gBACH,IAAI,WAAW,CAAC,QAAQ,CAAC,KAAK,OAAO,CAAC,GAAG;oBAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAClF,CAAC;YAAC,MAAM,CAAC;gBACP,kEAAkE;YACpE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,EAAU,EAAiB,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;AAUxF,MAAM,mBAAmB,GAAG,MAAM,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;AAE1E,SAAS,cAAc;IACrB,MAAM,MAAM,GAAG,UAAmE,CAAC;IACnF,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAe;IAC1C,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,OAAO,GAAiB,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,SAAkB,CAAC,EAAE,CAAC;QACvF,OAAO,CAAC,MAAM,GAAG,CAAC,KAAK,IAAI,EAAE;YAC3B,MAAM,IAAI,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;YACjD,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;YACpB,IAAI,CAAC;gBACH,OAAO,MAAM,4BAA4B,CAAC,OAAO,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,OAAO,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,4DAA4D;QAC5D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;YACxB,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO;gBAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;QACH,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC3B,KAAK,GAAG,OAAO,CAAC;IAClB,CAAC;IACD,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;IAChB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,OAAe,EAAE,KAAmB;IACrE,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC;IAChB,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC;QAAE,OAAO;IAC3B,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7B,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK;QAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,MAAM,EAAE,KAAK,EAAE,CAAC;IACxB,CAAC;YAAS,CAAC;QACT,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;IACxB,CAAC;AACH,CAAC;AAED,sEAAsE;AACtE,KAAK,UAAU,4BAA4B,CAAC,OAAe;IACzD,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI;YAAE,MAAM,KAAK,CAAC;QACvB,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,kCAAkC,OAAO,sCAAsC,IAAI,CAAC,OAAO,4DAA4D,YAAY,CAAC,KAAK,CAAC,EAAE,CAC7K,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,IAAI,CACV,kCAAkC,OAAO,kHAAkH,CAC5J,CAAC;QACF,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;QAAC,OAAO,UAAU,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,kCAAkC,OAAO,qKAAqK,YAAY,CAAC,UAAU,CAAC,EAAE,CACzO,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,kBAAkB;AAClB,MAAM,UAAU,QAAQ,CAAC,SAAsB,EAAE;IAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC1C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,aAAa,CAAC;IAChD,IAAI,MAA0B,CAAC;IAC/B,IAAI,OAAoC,CAAC;IACzC,IAAI,MAAgC,CAAC;IACrC,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YACzB,OAAO,CAAC,KAAK,CAAC,2DAA2D,EAAE,KAAK,CAAC,CAAC;QACpF,CAAC,CAAC,CAAC;QACH,MAAM,GAAG,IAAI,CAAC;IAChB,CAAC;IAED,MAAM,IAAI,GAAG,GAAoB,EAAE;QACjC,IAAI,MAAM;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC;QACxE,IAAI,MAAM;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAE5B,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;YACpB,MAAM,aAAa,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YACxE,IAAI,aAAa,EAAE,CAAC;gBAClB,MAAM,IAAI,KAAK,CACb,gCAAgC,aAAa,mEAAmE,CACjH,CAAC;YACJ,CAAC;YACD,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAC1B,yEAAyE;YACzE,2CAA2C;YAC3C,IAAI,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBACpC,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC,OAAO,CAAC,CAAC;gBAC3D,MAAM,GAAG,MAAM,CAAC;gBAChB,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC;gBACnC,MAAM,GAAG,MAAM,CAAC;gBAChB,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,MAAM,GAAG,MAAM,CAAC;gBACtB,MAAM,GAAG,SAAS,CAAC;gBACnB,MAAM,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAC3C,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE;YACjB,IAAI,CAAC,MAAM;gBAAE,OAAO,GAAG,SAAS,CAAC;QACnC,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;IAEF,MAAM,EAAE,GAAO;QACb,IAAI;QACJ,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,EAAE;YAC3B,MAAM,MAAM,GAAG,MAAM,IAAI,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,MAAM,YAAY,IAAI;gBACnC,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC;gBAClC,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAA0B,IAAI,EAAE,MAAM,CAAC,CAAC;YAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAiC,EAAE,CAAC;QAC5D,CAAC;QACD,KAAK,CAAC,KAAK;YACT,IAAI,MAAM;gBAAE,OAAO;YACnB,MAAM,GAAG,IAAI,CAAC;YACd,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM;gBAAE,OAAO;YAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACtF,MAAM,GAAG,SAAS,CAAC;YACnB,IAAI,MAAM,EAAE,CAAC;gBACX,qEAAqE;gBACrE,qDAAqD;gBACrD,MAAM,IAAI,GAAG,MAAM,CAAC;gBACpB,MAAM,GAAG,SAAS,CAAC;gBACnB,MAAM,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;gBACzC,OAAO;YACT,CAAC;YACD,IAAI,CAAC,MAAM;gBAAE,OAAO;YACpB,IAAI,MAAM,YAAY,IAAI;gBAAE,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC;;gBAC1C,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QAC5B,CAAC;QACD,GAAG;YACD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;YAC1F,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;IAEF,IAAI,MAAM,CAAC,GAAG;QAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3C,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,kBAAkB;AAClB,MAAM,CAAC,KAAK,UAAU,cAAc,CAAI,EAAM,EAAE,IAAkC;IAChF,OAAO,gBAAgB,CAAC,EAAE,EAAE,iBAAiB,EAAE,IAAI,CAAC,CAAC;AACvD,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAI,EAAM,EAAE,GAAW,EAAE,IAAkC;IACxF,IAAI,EAAE,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IAEzD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3B,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC;IACrD,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;IACvB,MAAM,KAAK,GAAU,KAAK,EAAE,IAAI,EAAE,MAAM,GAAG,EAAE,EAAE,EAAE;QAC/C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAChD,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAiC,EAAE,CAAC;IAC5D,CAAC,CAAC;IACF,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,6BAA6B,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAClD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;gBAAS,CAAC;YACT,MAAM,KAAK,CAAC,+BAA+B,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC;IACrB,CAAC;AACH,CAAC"}

package/dist/erase.d.ts

@@ -0,0 +1,33 @@
+import { type VendoStore } from "./store.js";
+/** 02-store §5 — every table in §2's public map. The erase API cascades the
+ *  matching data across all of them; `vendo_meta` holds schema metadata (schema
+ *  version, boot id), never user data, so no selector ever matches it and its
+ *  count stays 0 — as does `vendo_secrets` (name-keyed host config, likewise
+ *  never matched by a subject or app selector). Listed so the report provably
+ *  covers the whole map. */
+export declare const ERASE_TABLES: readonly ["vendo_meta", "vendo_apps", "vendo_records", "vendo_blobs", "vendo_state", "vendo_threads", "vendo_grants", "vendo_approvals", "vendo_audit", "vendo_runs", "vendo_secrets", "vendo_mcp_clients", "vendo_mcp_grants", "vendo_sessions"];
+export type EraseTable = typeof ERASE_TABLES[number];
+/** Rows deleted per table. */
+export type EraseReport = Record<EraseTable, number>;
+/**
+ * 02-store §5 — the store-level erase API: by subject (full erasure) or by
+ * app, cascading the matching data across all 14 tables of §2's map. It is
+ * the ONLY sanctioned deletion path for `vendo_audit` rows — the routed door
+ * refuses audit deletion (§2); this API reaches the tables directly.
+ * Ephemeral subjects are erased the same way (their rows are ordinary disk
+ * rows — kill-list B3); the TTL sweep (sessions.ts) is built on this cascade.
+ * Policy engines and schedulers stay out of scope: hosts call this from their
+ * own jobs, and host SQL remains available for everything else.
+ */
+export declare function eraseStore(store: VendoStore): {
+    /** Full erasure of one subject: their apps (and each app's records, blobs,
+        state, and runs), plus every subject-keyed or subject-ref'd row and the
+        subject's session registration (§4). */
+    bySubject(subject: string): Promise<EraseReport>;
+    /** Erase one app: its row, record collections, blob namespaces, state, runs,
+        app-scoped grants and audit rows, and app-ref'd generic/door rows.
+        (Threads and approvals have no app axis in §2 — the subject selector
+        covers them.) */
+    byApp(appId: string): Promise<EraseReport>;
+};
+//# sourceMappingURL=erase.d.ts.map

package/dist/erase.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"erase.d.ts","sourceRoot":"","sources":["../src/erase.ts"],"names":[],"mappings":"AACA,OAAO,EAAS,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAGpD;;;;;4BAK4B;AAC5B,eAAO,MAAM,YAAY,mPAef,CAAC;AAEX,MAAM,MAAM,UAAU,GAAG,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;AAErD,8BAA8B;AAC9B,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;AAMrD;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG;IAC7C;;+CAE2C;IAC3C,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACjD;;;wBAGoB;IACpB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CAC5C,CA8EA"}

package/dist/erase.js

@@ -0,0 +1,107 @@
+import { escapeLike } from "./helpers/utils.js";
+import { dbFor } from "./store.js";
+import { invalid } from "./validate.js";
+/** 02-store §5 — every table in §2's public map. The erase API cascades the
+ *  matching data across all of them; `vendo_meta` holds schema metadata (schema
+ *  version, boot id), never user data, so no selector ever matches it and its
+ *  count stays 0 — as does `vendo_secrets` (name-keyed host config, likewise
+ *  never matched by a subject or app selector). Listed so the report provably
+ *  covers the whole map. */
+export const ERASE_TABLES = [
+    "vendo_meta",
+    "vendo_apps",
+    "vendo_records",
+    "vendo_blobs",
+    "vendo_state",
+    "vendo_threads",
+    "vendo_grants",
+    "vendo_approvals",
+    "vendo_audit",
+    "vendo_runs",
+    "vendo_secrets",
+    "vendo_mcp_clients",
+    "vendo_mcp_grants",
+    "vendo_sessions",
+];
+function emptyReport() {
+    return Object.fromEntries(ERASE_TABLES.map((table) => [table, 0]));
+}
+/**
+ * 02-store §5 — the store-level erase API: by subject (full erasure) or by
+ * app, cascading the matching data across all 14 tables of §2's map. It is
+ * the ONLY sanctioned deletion path for `vendo_audit` rows — the routed door
+ * refuses audit deletion (§2); this API reaches the tables directly.
+ * Ephemeral subjects are erased the same way (their rows are ordinary disk
+ * rows — kill-list B3); the TTL sweep (sessions.ts) is built on this cascade.
+ * Policy engines and schedulers stay out of scope: hosts call this from their
+ * own jobs, and host SQL remains available for everything else.
+ */
+export function eraseStore(store) {
+    const db = dbFor(store);
+    const del = async (report, table, where, params) => {
+        const result = await db.query(`DELETE FROM ${table} WHERE ${where} RETURNING 1`, params);
+        report[table] += result.rows.length;
+    };
+    /** App-scoped data shared by the subject and app cascades: the app's record
+        collections and blob namespaces (`app:<appId>:...` — §3's naming
+        convention), its per-user state, and its run records. */
+    const eraseAppData = async (report, appId) => {
+        const prefix = `app:${escapeLike(appId)}:%`;
+        await del(report, "vendo_records", "collection LIKE $1 ESCAPE '\\'", [prefix]);
+        await del(report, "vendo_blobs", "namespace LIKE $1 ESCAPE '\\'", [prefix]);
+        await del(report, "vendo_state", "app_id = $1", [appId]);
+        await del(report, "vendo_runs", "app_id = $1", [appId]);
+    };
+    return {
+        async bySubject(subject) {
+            if (typeof subject !== "string" || subject === "") {
+                invalid("erase subject must be a non-empty string");
+            }
+            const report = emptyReport();
+            const subjectRef = JSON.stringify({ subject });
+            // The subject's apps drive the app-scoped cascade (records/blobs/state/runs
+            // carry the app id, not the subject). The app ROWS are deleted FIRST:
+            // once they are gone, no new gated write (records/blobs WHERE EXISTS)
+            // can land, so the data deletes below collect any stragglers — the
+            // remaining race residue is a write statement already in flight.
+            const owned = (await db.query("SELECT id FROM vendo_apps WHERE subject = $1", [subject])).rows
+                .map((row) => String(row["id"]));
+            await del(report, "vendo_apps", "subject = $1", [subject]);
+            for (const appId of owned)
+                await eraseAppData(report, appId);
+            // Ordering matters for accurate counts: the app cascade above already
+            // removed the subject's own state/run rows, so the subject-level deletes
+            // below only count rows the cascade did not reach (e.g. this subject's
+            // state under ANOTHER owner's app).
+            await del(report, "vendo_state", "subject = $1", [subject]);
+            await del(report, "vendo_threads", "subject = $1", [subject]);
+            await del(report, "vendo_grants", "subject = $1", [subject]);
+            await del(report, "vendo_approvals", "subject = $1", [subject]);
+            await del(report, "vendo_audit", "subject = $1", [subject]);
+            // Generic and door-owned rows carry the subject only as a ref (§2/§3).
+            await del(report, "vendo_records", "refs @> $1::jsonb", [subjectRef]);
+            await del(report, "vendo_mcp_clients", "refs @> $1::jsonb", [subjectRef]);
+            await del(report, "vendo_mcp_grants", "refs @> $1::jsonb", [subjectRef]);
+            // The session registration (if any) is retired with the data (§4).
+            await del(report, "vendo_sessions", "subject = $1", [subject]);
+            return report;
+        },
+        async byApp(appId) {
+            if (typeof appId !== "string" || appId === "") {
+                invalid("erase appId must be a non-empty string");
+            }
+            const report = emptyReport();
+            const appRef = JSON.stringify({ app_id: appId });
+            // App row first (same gate-closing order as bySubject), then its data.
+            await del(report, "vendo_apps", "id = $1", [appId]);
+            await eraseAppData(report, appId);
+            await del(report, "vendo_grants", "app_id = $1", [appId]);
+            await del(report, "vendo_audit", "app_id = $1", [appId]);
+            await del(report, "vendo_records", "refs @> $1::jsonb", [appRef]);
+            await del(report, "vendo_mcp_clients", "refs @> $1::jsonb", [appRef]);
+            await del(report, "vendo_mcp_grants", "refs @> $1::jsonb", [appRef]);
+            return report;
+        },
+    };
+}
+//# sourceMappingURL=erase.js.map

package/dist/erase.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"erase.js","sourceRoot":"","sources":["../src/erase.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,KAAK,EAAmB,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC;;;;;4BAK4B;AAC5B,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,YAAY;IACZ,YAAY;IACZ,eAAe;IACf,aAAa;IACb,aAAa;IACb,eAAe;IACf,cAAc;IACd,iBAAiB;IACjB,aAAa;IACb,YAAY;IACZ,eAAe;IACf,mBAAmB;IACnB,kBAAkB;IAClB,gBAAgB;CACR,CAAC;AAOX,SAAS,WAAW;IAClB,OAAO,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAgB,CAAC;AACpF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU,CAAC,KAAiB;IAW1C,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;IAExB,MAAM,GAAG,GAAG,KAAK,EACf,MAAmB,EACnB,KAAiB,EACjB,KAAa,EACb,MAAiB,EACF,EAAE;QACjB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,eAAe,KAAK,UAAU,KAAK,cAAc,EAAE,MAAM,CAAC,CAAC;QACzF,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;IACtC,CAAC,CAAC;IAEF;;gEAE4D;IAC5D,MAAM,YAAY,GAAG,KAAK,EAAE,MAAmB,EAAE,KAAa,EAAiB,EAAE;QAC/E,MAAM,MAAM,GAAG,OAAO,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC;QAC5C,MAAM,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,gCAAgC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/E,MAAM,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,+BAA+B,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5E,MAAM,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,MAAM,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,SAAS,CAAC,OAAO;YACrB,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;gBAClD,OAAO,CAAC,0CAA0C,CAAC,CAAC;YACtD,CAAC;YACD,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;YAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;YAE/C,4EAA4E;YAC5E,sEAAsE;YACtE,sEAAsE;YACtE,mEAAmE;YACnE,iEAAiE;YACjE,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,8CAA8C,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;iBAC3F,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACnC,MAAM,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,cAAc,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3D,KAAK,MAAM,KAAK,IAAI,KAAK;gBAAE,MAAM,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAE7D,sEAAsE;YACtE,yEAAyE;YACzE,uEAAuE;YACvE,oCAAoC;YACpC,MAAM,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YAC5D,MAAM,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YAC9D,MAAM,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YAC7D,MAAM,GAAG,CAAC,MAAM,EAAE,iBAAiB,EAAE,cAAc,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YAChE,MAAM,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YAC5D,uEAAuE;YACvE,MAAM,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,mBAAmB,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;YACtE,MAAM,GAAG,CAAC,MAAM,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;YAC1E,MAAM,GAAG,CAAC,MAAM,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;YACzE,mEAAmE;YACnE,MAAM,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE,cAAc,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;YAC/D,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,KAAK;YACf,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBAC9C,OAAO,CAAC,wCAAwC,CAAC,CAAC;YACpD,CAAC;YACD,MAAM,MAAM,GAAG,WAAW,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAEjD,uEAAuE;YACvE,MAAM,GAAG,CAAC,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;YACpD,MAAM,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YAClC,MAAM,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1D,MAAM,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;YACzD,MAAM,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,mBAAmB,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;YAClE,MAAM,GAAG,CAAC,MAAM,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;YACtE,MAAM,GAAG,CAAC,MAAM,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;YACrE,OAAO,MAAM,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/helpers/approvals.d.ts

@@ -0,0 +1,12 @@
+import type { ApprovalId, ApprovalRequest, IsoDateTime, Principal } from "@vendoai/core";
+import { type VendoStore } from "../store.js";
+import type { ApprovalRow } from "./types.js";
+/** 02-store §3 */
+export declare function approvalStore(store: VendoStore): {
+    create(request: ApprovalRequest): Promise<void>;
+    get(id: ApprovalId): Promise<ApprovalRow | null>;
+    pending(principal: Principal): Promise<ApprovalRequest[]>;
+    decide(ids: ApprovalId | ApprovalId[], status: "approved" | "denied", decidedAt: IsoDateTime): Promise<ApprovalId[]>;
+};
+export type { ApprovalRow } from "./types.js";
+//# sourceMappingURL=approvals.d.ts.map

package/dist/helpers/approvals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approvals.d.ts","sourceRoot":"","sources":["../../src/helpers/approvals.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACzF,OAAO,EAAS,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAK9C,kBAAkB;AAClB,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG;IAChD,MAAM,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,GAAG,CAAC,EAAE,EAAE,UAAU,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACjD,OAAO,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAC1D,MAAM,CAAC,GAAG,EAAE,UAAU,GAAG,UAAU,EAAE,EAAE,MAAM,EAAE,UAAU,GAAG,QAAQ,EAAE,SAAS,EAAE,WAAW,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;CACtH,CAoCA;AAED,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC"}